Files, open beside the conversation

A third side panel, built the way the terminal is and filled the way the
inspector is: tabs holding open files. Project files over SFTP in an agent
chat; notes, skills, knowledge documents, this chat's text attachments and its
own scratch document everywhere. Read with pygments, edited in a plain
textarea, saved with a conflict check.

A bug found on the way in, and the reason this needed its own read path.
`ssh.read_file` ends in `clean_output`, which strips ANSI escapes and decodes
with errors="replace" -- right for the output of a command, and fatal for an
editor: open a file containing an escape byte, press Save, and you have
silently rewritten it with the escapes gone and every undecodable byte replaced
by U+FFFD. `read_text`/`write_text` decode strictly, report binary rather than
mangling it, carry an mtime:size token for a file that moved underneath, and
refuse an oversize write rather than truncating -- `write_file` truncates
because a model is told how many bytes it wrote, and somebody pressing Save is
not. The model-facing pair is untouched: what it returns is a contract a model
has been shown. A truncated read opens read-only for the mirror-image reason.

Six sources go through one dispatch table, for the reason tool_labels.py is a
table: six independently written permission checks is how one ends up written
slightly differently, and that failure looks like editing somebody else's note.

A save on a project file bypasses agent/policy.py, which makes it the fourth
documented exception to "the modes do not govern the keyboard" and the first
that writes. Same argument as the terminal panel -- whoever owns the credential
could write the file with scp -- but the consequence is larger and is now said
out loud rather than left to be inferred.

The model opens tabs from the file tools it was already calling, so no new
schema and no tokens. It never brings one to the front: an agent reads forty
files in a long reply, and taking the screen each time would drag somebody
through all of them and lose any edit in progress. Only the strip is streamed,
guarded on truthiness so the frame can never blank itself -- an empty one would
close every open tab, the approval card you could press twice with the sign
reversed. Both halves are settled on the server, which is why canvas.js needs
no guard against a swap at all.

No vendored editor. CodeMirror 6 needs a bundler, which is hard rule 1;
CodeMirror 5 would be a larger payload than xterm on every page, and xterm is
the one heavy dependency precisely because it loads only where it can be used.
So: server-rendered highlighting for reading, a textarea for writing, and the
panel says there is no colour while you type rather than pretending.

Also here: a scratch document per chat, with `scratch_write` at RISK_READ on
plan_update's argument, and a test pinning the three numbers that decide a
panel's width -- LAYOUT_BOUNDS drops an unknown variable silently, so a panel
missing from it has a drag handle that works and forgets.

Driven under a DOM stub and against the running application.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/lembas/db/models/__init__.py

@@ -18,6 +18,7 @@ from lembas.db.models.attachment import (
     KIND_TEXT,
     Attachment,
 )
+from lembas.db.models.canvas import ScratchDoc
 from lembas.db.models.chat import (
     KIND_AGENT,
     KIND_CHAT,
@@ -124,6 +125,7 @@ __all__ = [
     "Message",
     "Model",
     "Note",
+    "ScratchDoc",
     "Session",
     "Setting",
     "Share",

src/lembas/db/models/canvas.py

@@ -0,0 +1,50 @@
+"""A chat's own working surface."""
+
+from __future__ import annotations
+
+from sqlalchemy import ForeignKey, String, Text
+from sqlalchemy.orm import Mapped, mapped_column
+
+from lembas.db.base import Base, Timestamps, UUIDPrimaryKey
+from lembas.db.models.library import AUTHOR_USER
+
+
+class ScratchDoc(UUIDPrimaryKey, Timestamps, Base):
+    """A text artefact belonging to one chat, written by either side of it.
+
+    The model can write into it, the person can edit it, and either can hand the
+    result to the next message as an ordinary attachment. Distinct from a note,
+    which is a durable artefact of the reader's that outlives the chat -- this
+    is the chat's own record of what it is working on, which is the same line
+    `plan_update` is on rather than `notes_edit`.
+
+    A separate table rather than a column on `chats` for one plain reason:
+    `select(Chat)` runs for the sidebar on every page load, and SQLAlchemy loads
+    every column -- so a Text body would ride along with two hundred sidebar
+    rows to answer a question about none of them.
+
+    One per chat. Several would mean a picker, names, deletion and a sweep, and
+    would mean the model choosing an id; one means `scratch:<chat_id>` is
+    derivable rather than looked up. If several are ever wanted, they are notes.
+    """
+
+    __tablename__ = "scratch_docs"
+
+    chat_id: Mapped[str] = mapped_column(
+        String(32),
+        ForeignKey("chats.id", ondelete="CASCADE"),
+        nullable=False,
+        index=True,
+        unique=True,
+    )
+    user_id: Mapped[str] = mapped_column(
+        String(32), ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    title: Mapped[str] = mapped_column(String(300), default="Scratch")
+    body: Mapped[str] = mapped_column(Text, default="")
+    # Who wrote it last, so the panel can say. Not authorisation: the chat's
+    # owner is the only person who can reach it either way.
+    author: Mapped[str] = mapped_column(String(16), default=AUTHOR_USER, nullable=False)
+
+    def __repr__(self) -> str:
+        return f"<ScratchDoc {self.chat_id}>"

src/lembas/db/models/chat.py

@@ -218,6 +218,18 @@ class Chat(UUIDPrimaryKey, Timestamps, Base):
     # representations of "on" makes "why is this off?" unanswerable.
     scope_json: Mapped[dict[str, Any]] = mapped_column(JSONDict, default=dict)
 
+    # Which files are open in the canvas panel, and which of them is in front.
+    # {"tabs": [{"key": "agent:/srv/app/main.py", "title": …, "source": …}],
+    #  "active": "agent:/srv/app/main.py"}
+    #
+    # Server-side rather than in the browser because a model reading a file
+    # opens a tab, and every frame this application streams is HTML swapped
+    # whole -- if the browser owned the list, the server could not render the
+    # strip and the frame would have to become data for JavaScript to interpret.
+    # One chat, one canvas, the same consequence the terminal panel documents:
+    # two tabs on the same chat share it.
+    canvas_json: Mapped[dict[str, Any]] = mapped_column(JSONDict, default=dict)
+
     # --- Compaction ----------------------------------------------------------
     # A summary of the turns up to `compacted_through_id`, sent in their place.
     # The messages themselves are kept and still shown; they simply stop being