Files
LLeMbas/src/lembas/web/templates/chat/_composer.html
T
Jaroslav Beneš b6aab8de55 Agent chats run commands, and stop to ask first
The four tools an agent chat has -- shell_run, file_read, file_write,
file_list -- and the mode table wired into the loop that decides which of
them stop for approval. Verified end to end against a real Kali container
over SSH: the card shows the command, allowing it runs it there, and the
file it writes is visible from outside.

The mode is enforced in `_authorise`, in the generation loop, server-side,
keyed on each tool's declared risk. Not in the prompt: a model is told
which mode it is in so it behaves sensibly, but everything it reads -- a
web page, a README, the output of the last command -- is untrusted, and a
rule written only into a system message is one a poisoned file can argue
with. Within an agent chat every call goes through the table, including
the built-in ones, because notes_edit writes and Plan mode meaning "look
but do not touch" has to mean that too.

Two things this turned up.

The runners re-check the mode as a backstop, and that backstop refused the
very thing a person had just approved -- the mode says "ask", and asking
was exactly what happened. Approval is now threaded per call, on a copy of
the context, because a round runs its calls together and only some of them
were allowed.

And the harness said nothing at all, because `registry` maps an offered
tool *name* back to a family and did not know the agent tools existed. So
shell_run resolved to no family and the fragment naming the machine, the
directory and the mode was never admitted. The same omission cost custom
tools their guidance once already; there is a test for it now.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-02 00:08:48 +02:00

198 lines
9.0 KiB
HTML

{% from "_macros.html" import icon %}
{#
The composer, used both inside an existing chat and on /chat where no chat
row exists yet.
The only difference is where it posts. With a chat, the turn is appended to
the thread in place; without one, /api/chats/start creates the chat and
redirects, and the reply streams on arrival because the page renders the
unfinished assistant message with its sse-connect. That is what stops an
opened-and-abandoned chat ever being written to the database.
The attachment chips live INSIDE this form on purpose. Each carries a hidden
file_ids input, and being inside the form is what gets them serialised with
the message. Keeping them outside and reaching for hx-include does not work:
that attribute only has an effect on the element issuing the request.
#}
<div class="composer" {% if can.get("files.upload") %}data-dropzone{% endif %}>
{% if can.get("files.upload") %}
{# Outside the form: it is only ever read by JavaScript, and inside it would
be submitted as an empty file part on every message.
Two inputs rather than one whose accept attribute is rewritten: changing
accept and then calling click() in the same tick is unreliable in Safari,
and two hidden inputs cost nothing. #}
<input class="visually-hidden" type="file" id="file-input" multiple
data-upload-url="/api/files{% if chat %}?chat_id={{ chat.id }}{% endif %}"
accept=".pdf,.txt,.md,.csv,.json,.py,.js,.ts,.rs,.go,.sh,.sql,.yaml,.yml,.toml,.log"
onchange="window.lembas.uploadFiles(this.files); this.value = ''">
<input class="visually-hidden" type="file" id="image-input" multiple accept="image/*"
onchange="window.lembas.uploadFiles(this.files); this.value = ''">
{% endif %}
<div class="composer__inner">
<form class="composer__form"
{% if chat %}
hx-post="/api/chats/{{ chat.id }}/messages"
hx-target="#thread" hx-swap="beforeend"
hx-on::after-request="if (event.detail.successful) {
this.reset();
document.getElementById('attachments').replaceChildren();
window.lembas.autosize(this.querySelector('textarea'));
window.lembas.scrollThread(true);
}"
{% else %}
hx-post="/api/chats/start" hx-swap="none"
{% endif %}>
<div class="composer__attachments" id="attachments"></div>
{% if not chat and current_model %}
<input type="hidden" name="model_id" value="{{ current_model.model_id }}">
{% endif %}
{% if not chat and starting_temporary %}
<input type="hidden" name="temporary" value="true">
{% endif %}
{# Chat or Agent, chosen once. There is no switching afterwards: the
tools offered, the harness and the approval loop all differ, so a
conversation whose earlier turns ran somewhere else is not one
conversation. Only shown when picking Agent would lead anywhere. #}
{% if not chat and agent_profiles %}
<input type="hidden" name="kind" value="chat" id="chat-kind">
<div class="composer__kind" data-agent-picker>
<label class="chip">
<input type="radio" name="kind_choice" value="chat" checked>
<span>{{ icon("chat", "icon--sm") }} Chat</span>
</label>
<label class="chip">
<input type="radio" name="kind_choice" value="agent">
<span>{{ icon("server", "icon--sm") }} Agent</span>
</label>
<span class="composer__kind-agent" hidden>
<select class="select select--sm" name="ssh_profile_id" aria-label="Connection">
{% for profile in agent_profiles %}
<option value="{{ profile.id }}" data-dir="{{ profile.default_dir }}"
{{ 'disabled' if not profile.verified }}>
{{ profile.name }}{{ ' — not checked' if not profile.verified }}
</option>
{% endfor %}
</select>
<input class="input input--sm input--mono" name="project_dir"
value="{{ agent_profiles[0].default_dir }}"
aria-label="Project directory" placeholder="/project">
</span>
</div>
{% endif %}
<div class="composer__row">
{% if can.get("files.upload") %}
{# A menu rather than the file picker straight away: there are four ways
to attach something now, and only one of them is a file on disk.
Uses the same picker machinery as the model chooser -- see ui.js. #}
<div class="picker picker--up" data-picker>
<button class="btn btn--icon composer__btn" type="button" data-picker-toggle
aria-haspopup="menu" aria-expanded="false"
aria-label="Attach" title="Attach">
{{ icon("attach") }}
</button>
<div class="picker__menu picker__menu--compact" data-picker-menu role="menu"
hidden aria-label="Attach">
<button class="picker__option" type="button" role="menuitem"
data-attach="file">
{{ icon("attach", "icon--sm") }}
<span class="picker__option-body">
<span class="picker__option-name">File</span>
<span class="picker__option-note">PDF, text, code</span>
</span>
</button>
<button class="picker__option" type="button" role="menuitem"
data-attach="image">
{{ icon("image", "icon--sm") }}
<span class="picker__option-body">
<span class="picker__option-name">Image</span>
<span class="picker__option-note">Sent only to vision models</span>
</span>
</button>
<button class="picker__option" type="button" role="menuitem"
data-attach="link">
{{ icon("link", "icon--sm") }}
<span class="picker__option-body">
<span class="picker__option-name">Link</span>
<span class="picker__option-note">Fetch a page and attach its text</span>
</span>
</button>
{% if can.get("library.use") %}
<button class="picker__option" type="button" role="menuitem"
data-attach="knowledge">
{{ icon("archive", "icon--sm") }}
<span class="picker__option-body">
<span class="picker__option-name">Knowledge</span>
<span class="picker__option-note">From your library</span>
</span>
</button>
{% endif %}
</div>
</div>
{% endif %}
<textarea class="composer__input" name="content" rows="1"
data-autosize data-max-height="320" data-composer-input
placeholder="{% if chat %}Send a message…{% else %}Ask anything…{% endif %}"
aria-label="Message" {{ 'autofocus' if not chat }}></textarea>
{% if can_dictate %}
{# Recording is started and stopped by the same button; audio.js swaps
data-mic-state and the icon with it. #}
<button class="btn btn--icon composer__btn composer__mic" type="button"
data-mic data-mic-state="idle"
aria-label="Dictate a message" title="Dictate a message">
<span class="composer__icon composer__icon--mic">{{ icon("mic") }}</span>
<span class="composer__icon composer__icon--recording" aria-hidden="true">
{{ icon("stop-circle") }}
</span>
</button>
{% endif %}
{#
One button, two jobs. While a reply is being written it becomes Stop,
because that is where the hand already is and a second button sitting
permanently beside Send is clutter that is wrong most of the time.
ui.js flips data-composer-action, and the type with it: as `submit`
the form's own handler sends, as `button` the click handler stops.
Both icons are rendered here and chosen in CSS, so the swap costs no
layout and cannot flash an empty button.
#}
<button class="btn btn--primary btn--icon composer__btn" type="submit"
data-composer-action="send" aria-label="Send">
<span class="composer__icon composer__icon--send">{{ icon("send") }}</span>
<span class="composer__icon composer__icon--stop" aria-hidden="true">
<span class="composer__stop-square"></span>
</span>
</button>
</div>
</form>
<p class="composer__hint">
Enter to send, Shift+Enter for a new line.
{% if can.get("files.upload") %}
Drag files in, or paste an image.
{% if current_model and not current_model.capabilities_json.get("vision") %}
<strong>{{ current_model.label }} has no vision</strong>, so images
will not be sent — documents still will.
{% endif %}
{% endif %}
</p>
</div>
{% if can.get("files.upload") %}
<div class="dropzone-overlay" aria-hidden="true">
{{ icon("attach", "icon--lg") }}
<span>Drop to attach</span>
</div>
{% endif %}
</div>