A directory the model knows about, and @ to name a file in it

An agent chat used to open with the model knowing the name of a machine and
nothing about what was on it, so the first two rounds of every reply went on
finding out. It now gets a listing: one read-only command, `git ls-files` where
that works and `find` otherwise, falling back to an SFTP walk that always does.
git first because a repository already carries somebody's considered list of
what is not part of the project, and reproducing it by hand is how an index
ends up mostly build output.

The listing is budgeted rather than dumped. A tree of a thousand files is worse
than no tree -- it costs the window on every request forever and buries the four
names that mattered -- so directories that will not fit are shown as a count and
the model is told to open one itself. Collapsing picks the deepest and largest
first: by saving alone it would take `src/` before `src/web/static/vendor/`,
because it contains it, and lose every name worth having.

Read from a cache and never fetched. `harness.context_variables` is synchronous
and sits on the request path; the walk happens in the generation setup, which is
async and already doing network work, with a short wait. A chat whose first
reply outruns its first walk simply has no listing that turn and the fragment
disappears rather than appearing as an empty heading.

Then `@`, over the same index and over the library, and `/` for commands with an
Alt-based keyboard for the same jobs. A mentioned file arrives as contents, not
a reference -- a small model asked to call file_read often does not bother -- and
it arrives with its absolute path and the machine it came from, because a model
handed `main.py` cannot tell which of four it is and cannot name it back when
asked to change something.

The rule that matters for `/`: a message that merely starts with a slash still
sends. `//` escapes and an unrecognised command is posted as written. Swallowing
somebody's message is a much worse failure than an unknown command.

Two exceptions to Manual mode now, not one. Browsing and indexing are a person
acting, not a model, so neither passes through policy.py -- the same argument
the terminal panel rests on.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/lembas/api/files.py

@@ -19,6 +19,7 @@ from fastapi.responses import FileResponse
 
 from lembas.api.deps import Db, RequiredUser, require_permission
 from lembas.db.models import Attachment, Document
+from lembas.security import permissions
 from lembas.services import files as files_service
 from lembas.services import settings_store
 from lembas.services.fetch import FetchError, fetch
@@ -167,6 +168,146 @@ async def knowledge_picker(
     )
 
 
+@router.get("/mention-picker", dependencies=[Depends(require_permission("files.upload"))])
+async def mention_picker(
+    request: Request,
+    db: Db,
+    user: RequiredUser,
+    q: str = "",
+    chat_id: str = "",
+    profile_id: str = "",
+    project_dir: str = "",
+) -> Response:
+    """What `@` offers: files under the project directory, and the library.
+
+    One menu from two sources, because a person typing `@readme` is not
+    thinking about which store the answer lives in. The project half is only
+    there for an agent chat and only when a listing has already been built --
+    this is a keystroke-latency path and it must never wait on a machine.
+
+    Filtered server-side, like the knowledge picker beside it and for the same
+    reason: the library is searched with FTS rather than filtered in the
+    browser, which is what makes it work at five hundred documents. The project
+    half is filtered here too, so the client stays one `fetch` and a list.
+    """
+    needle = q.strip().lower()
+
+    files: list[dict] = []
+    if profile_id and permissions.has(db, user, "tools.agent"):
+        from lembas.db.models import SshProfile
+        from lembas.services.agent import index as index_service
+
+        profile = db.get(SshProfile, profile_id)
+        # Re-checked rather than trusted from the query string: an id in a URL
+        # is not an authorisation, and this lists somebody's machine.
+        if profile is not None and profile.owner_id == user.id:
+            found = index_service.cached(profile_id, project_dir or profile.default_dir)
+            if found is not None:
+                files = [
+                    {"path": path, "name": path.rstrip("/").rsplit("/", 1)[-1]}
+                    for path in found.paths
+                    if not needle or needle in path.lower()
+                ][:20]
+
+    documents: list = []
+    if permissions.has(db, user, "library.use"):
+        if needle:
+            documents = documents_service.search(db, user, q, limit=10)
+        else:
+            documents = list(
+                db.scalars(
+                    documents_service.visible(db, user)
+                    .order_by(Document.created_at.desc())
+                    .limit(10)
+                )
+            )
+
+    return templates.TemplateResponse(
+        request,
+        "chat/_mention_picker.html",
+        {
+            "request": request,
+            "user": user,
+            "files": files,
+            "documents": documents,
+            "q": q,
+            "chat_id": chat_id,
+            "profile_id": profile_id,
+        },
+    )
+
+
+@router.post("/from-project", dependencies=[Depends(require_permission("files.upload"))])
+async def attach_from_project(
+    request: Request,
+    db: Db,
+    user: RequiredUser,
+    profile_id: str = Form(""),
+    path: str = Form(""),
+    chat_id: str = Form(""),
+) -> Response:
+    """Pull one file off the far machine and attach it to this message.
+
+    Its contents, not a reference: a model that has to spend a round calling
+    `file_read` often does not bother, and on a plain chat there is no
+    `file_read` to call. The path and the machine travel with it, so the model
+    is told exactly which file it is looking at rather than a bare basename it
+    cannot act on.
+
+    A directory attaches its listing instead of refusing -- "@ that folder" is
+    a reasonable thing to mean, and the listing is what it means.
+    """
+    from lembas.db.models import SshProfile
+    from lembas.services.agent import ssh as ssh_service
+    from lembas.services.agent.base import ExecError
+
+    def _failed(message: str) -> Response:
+        return templates.TemplateResponse(
+            request,
+            "chat/_attachment_error.html",
+            {"request": request, "filename": path or "file", "error": message},
+        )
+
+    if not permissions.has(db, user, "tools.agent"):
+        return _failed("You do not have access to connections.")
+
+    profile = db.get(SshProfile, profile_id)
+    if profile is None or profile.owner_id != user.id or not profile.enabled:
+        return _failed("That connection is not available.")
+    if hint := ssh_service.available():
+        return _failed(hint)
+
+    wanted = path.strip()
+    if not wanted:
+        return _failed("No file was named.")
+
+    executor = ssh_service.SshExecutor(ssh_service.spec_from(profile), profile.default_dir)
+    try:
+        if wanted.endswith("/"):
+            names = await executor.list_dir(wanted.rstrip("/"))
+            body = "\n".join(names)
+            truncated = len(names) >= ssh_service.MAX_ENTRIES
+        else:
+            body = await executor.read_file(wanted, max_bytes=ssh_service.MAX_READ_BYTES)
+            truncated = len(body.encode("utf-8", "ignore")) >= ssh_service.MAX_READ_BYTES
+    except ExecError as exc:
+        return _failed(exc.message)
+
+    attachment = files_service.store_text(
+        db,
+        user_id=user.id,
+        chat_id=chat_id or None,
+        filename=wanted.rstrip("/").rsplit("/", 1)[-1] or wanted,
+        text=body,
+        truncated=truncated,
+        source_path=wanted,
+        source_label=profile.name,
+    )
+    return templates.TemplateResponse(
+        request, "chat/_attachment_chip.html", {"request": request, "attachment": attachment}
+    )
+
+
 @router.delete("/{attachment_id}")
 async def remove(db: Db, user: RequiredUser, attachment_id: str) -> Response:
     """Detach a file before it has been sent."""