Write down what agent chats are and what will bite you

CLAUDE.md gets the entries worth having been told: that the mode is
enforced in the loop rather than the prompt and why that distinction is
load-bearing; that an approved call has to be told it was approved, or the
runners' own backstop refuses the very thing somebody just allowed; that
`registry` must know the agent tools or the harness cannot name the machine
-- the same omission that cost custom tools their guidance once already;
that each command is a fresh shell and `apt-get install` needs an update
first, which are the two likeliest sources of "the agent seems stupid";
that asyncssh's four defaults are all wrong when one unix account is
shared; and that rewind rewinds the transcript and not the machine.

"Not built yet" loses agentic execution and gains the reason nothing runs
on this host -- with the two consequences stated plainly, since they are
the ones somebody has to weigh: the security of an agent chat is the
security of the host behind its profile, and there is no "no network"
switch, because the network belongs to the far side.

README gets a section that starts with the container, because that is the
intended shape and the thing a reader has to build before any of it means
anything.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

README.md

@@ -55,6 +55,17 @@ runtime. Clone it, `pip install -e .`, run it.
   template, a secret) and a model can make it. Or add an **MCP server** by URL
   and its tools appear beside the built-in ones. Both restrictable to groups,
   and neither can be pointed at your own network unless you say so
+- **Agent chats** — start a chat as an *Agent* instead, pointed at one of your
+  own SSH connections and a directory on it, and a model can read files, write
+  files and run commands **there**. Nothing ever runs on the machine LLeMbas
+  itself is on. What it may do without asking is a mode you set and can change
+  mid-conversation: *Manual* shows you everything first, *Edit* writes freely
+  but asks before commands, *Auto* asks about nothing, and *Plan* reads freely,
+  changes nothing, and finishes by proposing steps you can carry out with one
+  button. Adding a host shows you its fingerprint before anything is sent to it
+- **It can ask you things** — a model that needs a decision can stop and put a
+  few questions on one card, with answers to pick from and a box to write your
+  own. In any chat, not only an agent one
 - **Speech in and out** — dictate a message and have replies read aloud, against
   any OpenAI-compatible audio endpoint (whisper.cpp, Speaches, Kokoro…). Each
   person picks their own voice
@@ -83,8 +94,7 @@ runtime. Clone it, `pip install -e .`, run it.
 
 **Planned**
 
-Agentic execution (local and over SSH) · image generation · OCR for scanned
-PDFs · semantic search in the library.
+Image generation · OCR for scanned PDFs · semantic search in the library.
 
 See [PLAN.md](PLAN.md) for what is built, what is not, and why.
 
@@ -95,7 +105,8 @@ git clone https://git.houmeres.sk/Houmeres/LLeMbas.git
 cd LLeMbas
 
 python -m venv .venv && . .venv/bin/activate
-pip install -e ".[dev,search]"   # `search` adds DuckDuckGo; drop it if unwanted
+pip install -e ".[dev,search,ssh]"   # search: DuckDuckGo. ssh: agent chats.
+                                     # Drop either if you do not want it
 
 cp .env.example .env
 lembas secret-key           # paste the result into LEMBAS_SECRET_KEY
@@ -141,6 +152,48 @@ Recorded audio is passed straight through and never written to disk.
 > The microphone needs HTTPS or localhost. Browsers do not grant it over plain
 > HTTP, so a LAN install without TLS will not offer dictation.
 
+### Agent chats
+
+**Admin → Agents** to turn the feature on, then **Connections** in the sidebar
+to add a machine. Three things have to line up before an agent chat can start:
+the feature enabled, the *Run commands* permission, and a model flagged **Agent
+execution**. All three are off by default, on purpose.
+
+Nothing an agent does runs on the machine LLeMbas is on. Commands go to a host
+you name over SSH, which means **the containment is that host** — a container
+built for the job is a very different thing from a key to a server you care
+about, and LLeMbas cannot tell them apart. A throwaway container is the intended
+shape:
+
+```bash
+docker run -d --name agent-box -p 127.0.0.1:2222:22 <an sshd image>
+```
+
+Adding a connection does not connect to it. **Check** shows you the host's
+fingerprint with nothing sent — not your username, not your key — and only
+accepting pins it. If that host later answers with a different key, it is
+refused rather than quietly trusted.
+
+Then start a chat with the **Agent** toggle, pick the connection and a
+directory, and choose a mode. The mode is in the chat header and changes at any
+time:
+
+| | Reads | Writes files | Runs commands |
+|---|---|---|---|
+| **Manual** | asks | asks | asks |
+| **Edit** | free | free | asks |
+| **Auto** | free | free | free |
+| **Plan** | free | asks | asks |
+
+The mode is enforced in the reply loop, not written into the prompt: everything
+a model reads — a web page, a README, the last command's output — is untrusted,
+and a rule that lives only in a system message is one a poisoned file can argue
+with. In **Auto**, nothing stands between that and a command running.
+
+*Plan* finishes by proposing steps, with a button that carries them out — which
+switches to *Edit*, never *Auto*, because the plan was written under a mode
+where every command still asked.
+
 ### The library
 
 **Sidebar → Library**, and **Settings → Memory**. Nothing is on by default for a