A directory the model knows about, and @ to name a file in it

An agent chat used to open with the model knowing the name of a machine and
nothing about what was on it, so the first two rounds of every reply went on
finding out. It now gets a listing: one read-only command, `git ls-files` where
that works and `find` otherwise, falling back to an SFTP walk that always does.
git first because a repository already carries somebody's considered list of
what is not part of the project, and reproducing it by hand is how an index
ends up mostly build output.

The listing is budgeted rather than dumped. A tree of a thousand files is worse
than no tree -- it costs the window on every request forever and buries the four
names that mattered -- so directories that will not fit are shown as a count and
the model is told to open one itself. Collapsing picks the deepest and largest
first: by saving alone it would take `src/` before `src/web/static/vendor/`,
because it contains it, and lose every name worth having.

Read from a cache and never fetched. `harness.context_variables` is synchronous
and sits on the request path; the walk happens in the generation setup, which is
async and already doing network work, with a short wait. A chat whose first
reply outruns its first walk simply has no listing that turn and the fragment
disappears rather than appearing as an empty heading.

Then `@`, over the same index and over the library, and `/` for commands with an
Alt-based keyboard for the same jobs. A mentioned file arrives as contents, not
a reference -- a small model asked to call file_read often does not bother -- and
it arrives with its absolute path and the machine it came from, because a model
handed `main.py` cannot tell which of four it is and cannot name it back when
asked to change something.

The rule that matters for `/`: a message that merely starts with a slash still
sends. `//` escapes and an unrecognised command is posted as written. Swallowing
somebody's message is a much worse failure than an unknown command.

Two exceptions to Manual mode now, not one. Browsing and indexing are a person
acting, not a model, so neither passes through policy.py -- the same argument
the terminal panel rests on.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/test_harness.py

@@ -257,3 +257,103 @@ def test_the_tools_array_rides_along(db, owner):
     offered = tools_service.enabled_tools(db, chat, owner)
     body = chat_service.build_request(db, chat, tools=offered, user=owner)
     assert body["tools"] == offered
+
+
+# --- The project listing -----------------------------------------------------
+# Injected from a cache that something else fills, because this module runs
+# synchronously on the request path and an SFTP round trip here would hold a
+# request open while somebody's machine thought about it.
+def _agent_chat(db, owner):
+    from lembas.db.models import KIND_AGENT, SshProfile
+
+    settings_store.update(db, {"enabled": True}, key=settings_store.AGENTS)
+    profile = SshProfile(
+        owner_id=owner.id,
+        name="Test box",
+        host="127.0.0.1",
+        port=22,
+        username="tester",
+        host_key="host key",
+        host_fingerprint="SHA256:x",
+        default_dir="/work",
+    )
+    db.add(profile)
+    db.commit()
+    chat = Chat(
+        user_id=owner.id,
+        kind=KIND_AGENT,
+        ssh_profile_id=profile.id,
+        project_dir="/work",
+    )
+    db.add(chat)
+    db.commit()
+    return chat, profile
+
+
+def _agent_tools(db):
+    """The agent tools as offered, which REGISTRY does not carry.
+
+    `REGISTRY` is built at import time and holds the built-ins alone; the agent
+    tools are listed by `registry(db)`, unbound to any chat. That is the same
+    lookup the harness does to map `shell_run` back to the `agent` family, and
+    the reason it exists at all.
+    """
+    book = tools_service.registry(db)
+    return [book["shell_run"].schema]
+
+
+def _cache(profile_id, paths):
+    import time
+
+    from lembas.services.agent import index as index_service
+
+    index_service._CACHE[(profile_id, "/work")] = index_service.ProjectIndex(
+        paths=tuple(paths), total=len(paths), source="git", built_at=time.monotonic()
+    )
+
+
+def test_the_project_listing_reaches_the_model(db, owner):
+    chat, profile = _agent_chat(db, owner)
+    _cache(profile.id, ["README.md", "src/main.py"])
+
+    text = harness.compose(db, owner, _agent_tools(db), chat=chat)
+
+    assert "Files in /work" in text
+    assert "README.md" in text
+
+
+def test_nothing_cached_means_no_section_at_all(db, owner):
+    """Not an empty heading. `Fragment.requires` makes the whole thing vanish,
+    which is what lets the first reply in a new chat outrun the first walk
+    without saying anything strange."""
+    chat, _profile = _agent_chat(db, owner)
+
+    text = harness.compose(db, owner, _agent_tools(db), chat=chat)
+
+    assert "Files in" not in text
+
+
+def test_a_budget_of_zero_keeps_the_listing_out_of_the_prompt(db, owner):
+    """The listing is still built and the file picker still uses it. This is
+    the only way to say "index it, but do not spend context on it"."""
+    chat, profile = _agent_chat(db, owner)
+    _cache(profile.id, ["README.md"])
+    settings_store.update(db, {"index_chars": 0}, key=settings_store.AGENTS)
+
+    assert "Files in" not in harness.compose(db, owner, _agent_tools(db), chat=chat)
+
+
+def test_switching_the_listing_off_keeps_it_out(db, owner):
+    chat, profile = _agent_chat(db, owner)
+    _cache(profile.id, ["README.md"])
+    settings_store.update(db, {"index_enabled": False}, key=settings_store.AGENTS)
+
+    assert "Files in" not in harness.compose(db, owner, _agent_tools(db), chat=chat)
+
+
+def test_a_plain_chat_is_told_nothing_about_files(db, owner):
+    chat = Chat(user_id=owner.id)
+    db.add(chat)
+    db.commit()
+
+    assert "Files in" not in harness.compose(db, owner, _tools("web_search"), chat=chat)