Commit a4edbdb

- `shelldeck/gitgraph.py`: git log parsing + lane layout for the sidebar git popup (`static/gitgraph.js`), and `checkout` (refs starting with `-` refused). `has_git` flags projects in `/api/projects`. `changes()` (porcelain v1 `-z` + numstat against HEAD, untracked counted from the file) and `diff()` (only paths `changes()` reports) back the dialog's *Changes* tab; `/api/projects` adds `git_changes` from `_git_count` (cached `GIT_COUNT_S`) for the sidebar `±N` chip.

- **Machines.** SSH targets are Linux machines, reachable from Windows hosts too (OpenSSH); Windows targets are RDP (`S.desktops`, listed in the picker menu, opened with `remotes.connect`). `projects.remote_id`/`remote_path` mark a folder on a saved SSH machine (`db.ensure_remote_project`, path key `ssh://<remote>/<folder>` keeps `path` unique; `/api/projects` reports them `exists` with no git). `POST /api/remotes` (ssh) creates the `/` project; `_remote_line` makes `_attach` type `remotes.ssh_line(r, folder, shell)` on every spawn of such a terminal (`-t` + `'cd <folder> && exec $SHELL -l'`, double quotes for cmd; `check_path` allows no spaces/quotes), and its cwd is the local home. Users go in with `-l` (LDAP/NTID `CORP\user` single-quoted except in cmd). The sidebar picker (`#machine`, `S.machine` in localStorage, `machineProjects()`/`sessionOnMachine()`) filters projects, the agents page and the agents count. `POST /api/remotes/test` (`remotes.test_ssh`): TCP connect, then ssh with throwaway known_hosts: `BatchMode=yes` (key/agent; "Permission denied" means it wants a password), or with the dialog's password through `SSH_ASKPASS` + `SSH_ASKPASS_REQUIRE=force` (`_askpass` writes a helper in a temp dir that prints `SHELLDECK_ASKPASS`; the password is only in ssh's env, never argv, logs or the DB). Deleting a machine deletes its projects and closes their terminals.

- `shelldeck/remotes.py` + `static/remotes.js`: saved remote systems (`remotes` table). `validate()` is the only way values get in (host/user regexes, no leading `-`, port range, key path without shell metacharacters), and connect re-validates stored rows. SSH opens a normal terminal and `_start_agent` types `ssh_line()` after the first prompt; RDP runs `rdp_argv()` (mstsc on Windows, xfreerdp3/xfreerdp/remmina elsewhere) detached, host only (`_host`). No passwords are stored.

- **Background terminals.** `hidePane` (pane eye button, `Ctrl+Alt+W`) only removes the leaf; the PTY and `Term` keep running and the sidebar row shows `bg-chip` while `t.running`. `closeTerminal` (pane ×, sidebar ×, `Ctrl+Alt+Q`) offers *Keep in background* when a command runs. `replayLast` (`Ctrl+Alt+P`) re-sends `t.cmd`, refused while running or when an agent owns the pane.

- **Agents and the UI.** `sd notes` (scratchpad; CLI writes broadcast `{"type":"scratch"}` so an open Scratchpad reloads unless mid-edit; `_text_args` in `_main` passes markdown starting with `-` after `--`), `sd top` (`/api/stats`), `sd ps` / `sd kill` (`/api/sessions/{id}/processes`, `stats.processes` / `stats.end`: only descendants of that terminal's shell, terminate then kill after 3s, zombies count as ended; the CLI also refuses its own ancestors). All are in the skill text.

- **Replay the last command** with `Ctrl+Alt+P` or the pane's replay button (refused while a command runs, or when an AI agent owns the terminal).

- **Run in the background.** The pane's eye button (`Ctrl+Alt+W`) takes a terminal off the screen while it keeps running; it stays in the sidebar, marked *running* while a command is busy, and a click brings it back. Closing a terminal with a running command asks whether to keep it in the background instead.

- **Git changes at a glance.** A git project with uncommitted work shows a `±N` chip in the sidebar. Click it (or *Git changes* in the palette) to see the branch, ahead/behind, and every changed file with its added/removed lines; click a file for its diff.

- **Git graph.** The branch icon on every git project also opens its full commit graph, with branches, merges and tags drawn as colored lanes. Click a branch or tag, or right-click a commit, to check it out.

- **Scratchpad** for quick markdown notes that belong to no project, with a preview, saved as you type. Agents (and scripts) add to it with `sd notes`.

- **Machines.** The picker above *New terminal* (on Windows and Linux alike) switches the sidebar between **Local** and your SSH machines; projects, terminals and the AI agents list follow it. *Add machine…* asks for host, user (plain, or LDAP/NTID like `CORP\jdoe` or `jdoe@corp.com`), port and an optional key file, with **Test connection** (network, then a real login with your key/agent, or with the password you type in the dialog for that test; it is never saved). Each machine starts with a project for its root folder `/`; the folder button adds more (`~/code/app`, `/srv/app`). Its terminals run `ssh -t ... 'cd <folder> && exec $SHELL -l'`, so a password is typed in the terminal and never stored. SSH machines are Linux targets (from Windows it uses the built-in OpenSSH client); Windows targets are RDP desktops, listed in the same picker and opened in mstsc. Agents inside an SSH session aren't detected yet.

- **Remote systems.** Save Linux servers (SSH) and Windows machines (RDP) under *More › Remote systems*. *Connect* opens an SSH host as a shelldeck terminal (exit ssh and you're back in a local shell), or a desktop in `mstsc` on Windows (xfreerdp or Remmina on Linux) on the host machine. Passwords are never stored: ssh asks in the terminal (keys and ssh-agent work), the RDP client asks in its window.

| `Ctrl+Alt+Q` | Close the focused terminal (offers the background when a command runs) |

| `Ctrl+Alt+P` | Replay the last command |

| `Ctrl+Alt+W` | Send the terminal to the background (keeps running) |

version = "0.0.10"