SSH connections, kept by the people who own them

An agent chat will act on a machine you choose, so this is the screen where
you choose it. User-owned like a note, not admin-owned like a connection:
these are somebody's own machines and somebody's own keys, and "anyone in
this group may log in to my server" is a different feature with a different
blast radius. services/sharing.py is deliberately not involved either --
sharing grants reading, and a host somebody else can read is a host they
can log in to.

Trust on first use, made explicit rather than assumed. Adding a host does
not connect to it. Check looks at its key and shows you the fingerprint;
nothing is sent until you accept, because get_server_host_key completes the
key exchange and stops -- no username, no credential. Accepting pins it,
and a host that later presents a different key is refused with the reason
rather than quietly trusted. Moving a profile to another host or port
forgets the pin, since a key belongs to the machine it came from.

Four asyncssh defaults are actively wrong here and all four are passed
explicitly: every LLeMbas user shares one unix account, so `known_hosts`
would be a shared trust store, `client_keys` would authenticate one person
with another's key, `config` would let a ProxyCommand redirect the
connection, and `agent_path` would silently use $SSH_AUTH_SOCK. There is a
test for exactly that, and it needs no server.

Files go over SFTP rather than through a shell. The SSH exec protocol
carries one command *string* that the far side parses, with no argv form at
all, so a model-supplied path in a command line is unavoidably a quoting
problem. Over SFTP a path is a path.

Chat gains its kind, connection, project directory and mode; the first
three are fixed once a chat has a message, because a transcript whose
earlier turns ran somewhere else is not one conversation.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/lembas/web/templates/admin/agents.html

@@ -0,0 +1,184 @@
+{% extends "admin/_layout.html" %}
+{% from "_macros.html" import icon %}
+{% set section = "agents" %}
+
+{% block title %}Agents - LLeMbas{% endblock %}
+{% block heading %}Agents{% endblock %}
+
+{% block admin_content %}
+<p class="admin-lede">
+  An <strong>Agent</strong> chat can read files, write files and run commands on
+  a machine reached over SSH. Nothing runs on this server. People add their own
+  connections under <strong>Connections</strong>; what you decide here is
+  whether the feature exists and what one reply may spend.
+</p>
+
+<div class="alert">
+  {{ icon("shield", "icon--sm") }}
+  <span>
+    There is no sandbox to configure, and that is deliberate: containment is
+    whatever host somebody points a connection at. A container built for the
+    job is a very different thing from a key to a live server, and LLeMbas
+    cannot tell them apart. What a model reads — a web page, a file, the output
+    of the last command — is untrusted, and in <strong>Auto</strong> mode
+    nothing stands between that and a command running.
+  </span>
+</div>
+
+{% if problem %}
+<div class="alert alert--error">{{ icon("warning", "icon--sm") }} <span>{{ problem }}</span></div>
+{% endif %}
+
+{% if saved %}
+<div class="alert alert--success">{{ icon("check", "icon--sm") }} <span>Saved.</span></div>
+{% endif %}
+
+<form method="post" action="/admin/agents" class="form-grid">
+
+  <section class="card">
+    <h2 class="card__title">Switch</h2>
+    <div class="field">
+      <label class="checkbox">
+        <input type="checkbox" name="enabled" value="true" {{ 'checked' if values.enabled }}>
+        <span>Allow agent chats</span>
+      </label>
+      <p class="field__hint">
+        Off, nobody can start one and no agent tool is offered, whatever
+        permissions they hold. {{ profile_count }} connection{{ '' if profile_count == 1 else 's' }}
+        saved across all accounts.
+      </p>
+    </div>
+    <p class="field__hint">
+      People also need the <strong>Run commands</strong> permission, a model
+      flagged <strong>Agent execution</strong>, and a connection of their own.
+    </p>
+  </section>
+
+  <section class="card">
+    <h2 class="card__title">The modes</h2>
+    <p class="field__hint">
+      Set per chat and switchable at any time. This is what each one means; the
+      two lists below adjust them.
+    </p>
+    <dl class="mode-list">
+      {% for value, label, hint in modes %}
+      <div class="mode-list__row">
+        <dt><strong>{{ label }}</strong></dt>
+        <dd>{{ hint }}</dd>
+      </div>
+      {% endfor %}
+    </dl>
+  </section>
+
+  <section class="card">
+    <h2 class="card__title">What never needs asking</h2>
+    <div class="field">
+      <label class="field__label" for="allow_default">Always allow</label>
+      <textarea class="textarea input--mono" id="allow_default" name="allow_default" rows="5"
+                spellcheck="false">{{ allow_text }}</textarea>
+      <p class="field__hint">
+        One per line: a tool name like <code>file_read</code>, or a command with
+        wildcards like <code>git *</code>. A command containing anything that
+        joins two commands together — a semicolon, a pipe, backticks — can never
+        match one of these, so <code>git *</code> does not quietly also mean
+        <code>git status; curl … | sh</code>.
+      </p>
+    </div>
+  </section>
+
+  <section class="card">
+    <h2 class="card__title">What always needs asking</h2>
+    <div class="field">
+      <label class="field__label" for="deny_default">Always ask</label>
+      <textarea class="textarea input--mono" id="deny_default" name="deny_default" rows="5"
+                spellcheck="false">{{ deny_text }}</textarea>
+      <p class="field__hint">
+        Checked before everything, including <strong>Auto</strong>. Treat it as
+        a guard against an accident rather than against an adversary:
+        <code>rm -rf /*</code> here does not stop <code>/bin/rm -rf /</code>, and
+        nothing pattern-shaped could.
+      </p>
+    </div>
+  </section>
+
+  <section class="card">
+    <h2 class="card__title">What one command may spend</h2>
+
+    <div class="field">
+      <label class="field__label" for="default_timeout">Timeout (seconds)</label>
+      <input class="input" id="default_timeout" name="default_timeout"
+             value="{{ values.default_timeout }}" inputmode="numeric">
+    </div>
+    <div class="field">
+      <label class="field__label" for="max_timeout">Longest a command may ask for</label>
+      <input class="input" id="max_timeout" name="max_timeout"
+             value="{{ values.max_timeout }}" inputmode="numeric">
+    </div>
+    <div class="field">
+      <label class="field__label" for="max_output_bytes">Most output to keep</label>
+      <input class="input" id="max_output_bytes" name="max_output_bytes"
+             value="{{ values.max_output_bytes }}" inputmode="numeric">
+      <p class="field__hint">
+        Characters. The rest is cut off and the model is told so.
+      </p>
+    </div>
+  </section>
+
+  <section class="card">
+    <h2 class="card__title">What one reply may spend</h2>
+    <p class="field__hint">
+      Three separate bounds, because they fail differently: steps stop a loop,
+      the clock stops one slow command eating an afternoon, and output stops a
+      model filling its own context with build logs and having no room to answer.
+    </p>
+
+    <div class="field">
+      <label class="field__label" for="max_steps">Most rounds of tool calls</label>
+      <input class="input" id="max_steps" name="max_steps"
+             value="{{ values.max_steps }}" inputmode="numeric">
+    </div>
+    <div class="field">
+      <label class="field__label" for="max_wall_seconds">Longest a reply may take</label>
+      <input class="input" id="max_wall_seconds" name="max_wall_seconds"
+             value="{{ values.max_wall_seconds }}" inputmode="numeric">
+      <p class="field__hint">Time spent waiting for you to answer does not count.</p>
+    </div>
+    <div class="field">
+      <label class="field__label" for="max_total_output_bytes">Most output across a reply</label>
+      <input class="input" id="max_total_output_bytes" name="max_total_output_bytes"
+             value="{{ values.max_total_output_bytes }}" inputmode="numeric">
+    </div>
+  </section>
+
+  <section class="card">
+    <h2 class="card__title">Asking you things</h2>
+
+    <div class="field">
+      <label class="field__label" for="approval_timeout">How long a question waits</label>
+      <input class="input" id="approval_timeout" name="approval_timeout"
+             value="{{ values.approval_timeout }}" inputmode="numeric">
+      <p class="field__hint">
+        Seconds. After this the reply carries on without an answer and says so.
+        At least a minute, whatever is typed here.
+      </p>
+    </div>
+
+    <div class="field">
+      <label class="checkbox">
+        <input type="checkbox" name="ask_free_text" value="true"
+               {{ 'checked' if values.ask_free_text }}>
+        <span>Let people write their own answer</span>
+      </label>
+      <p class="field__hint">
+        When a model asks a question it can offer answers to pick from, and by
+        default a box to write something else. Turn this off if you would rather
+        nobody typed free text into a prompt a model composed.
+      </p>
+    </div>
+  </section>
+
+  <div class="btn-row">
+    <button class="btn btn--primary" type="submit">Save changes</button>
+  </div>
+</form>
+{% endblock %}