@yadsh/dsh-qa-surface 0.1.0 → 0.2.0

package/lib/config.js

@@ -10,25 +10,28 @@ const configSchema = z.object({
         .default({ path: "/qa", matchChildren: true }),
     branding: z
         .object({
-        title: z.string().default("Assistant"),
+        title: z.string().default("Помощник"),
         subtitle: z.string().default(""),
-        welcomeMessage: z.string().default("How can I help?"),
-        placeholder: z.string().default("Ask a question..."),
+        welcomeMessage: z.string().default("Чем могу помочь?"),
+        placeholder: z.string().default("Задайте вопрос…"),
         logoUrl: nullableString.default(null),
+        disclaimer: nullableString.default("Диалоги могут быть видны другим пользователям сервера и используются для улучшения качества ответов."),
     })
         .default({
-        title: "Assistant",
+        title: "Помощник",
         subtitle: "",
-        welcomeMessage: "How can I help?",
-        placeholder: "Ask a question...",
+        welcomeMessage: "Чем могу помочь?",
+        placeholder: "Задайте вопрос…",
         logoUrl: null,
+        disclaimer: "Диалоги могут быть видны другим пользователям сервера и используются для улучшения качества ответов.",
     }),
     session: z
         .object({
         policy: z
             .union(["browser-persistent", "new-on-load", "fixed"])
             .default("browser-persistent"),
-        storageKey: z.string().default("dsh-qa-surface"),
+        storageKey: z.string().default("dsh-qa-surface.session"),
+        cwd: nullableString.default(null),
         workspaceId: nullableString.default(null),
         fixedSessionId: nullableString.default(null),
         agentPreset: nullableString.default(null),
@@ -38,7 +41,8 @@ const configSchema = z.object({
     })
         .default({
         policy: "browser-persistent",
-        storageKey: "dsh-qa-surface",
+        storageKey: "dsh-qa-surface.session",
+        cwd: null,
         workspaceId: null,
         fixedSessionId: null,
         agentPreset: null,
@@ -56,6 +60,7 @@ const configSchema = z.object({
         showReasoning: z.boolean().default(false),
         renderMarkdown: z.boolean().default(true),
         maxContentWidth: z.number().step(1).min(480).max(1600).default(900),
+        showSessionList: z.boolean().default(false),
     })
         .default({
         showHeader: true,
@@ -66,14 +71,61 @@ const configSchema = z.object({
         showReasoning: false,
         renderMarkdown: true,
         maxContentWidth: 900,
+        showSessionList: false,
     }),
-    suggestedQuestions: z.array(z.string()).default([]),
+    suggestedQuestions: z
+        .array(z.string())
+        .default([
+        "Что ты умеешь?",
+        "С чего начать?",
+        "Помоги разобраться с ошибкой",
+    ]),
     interaction: z
         .object({
         approvals: z.union(["blocked"]).default("blocked"),
         questions: z.union(["unsupported"]).default("unsupported"),
     })
         .default({ approvals: "blocked", questions: "unsupported" }),
+    lockdown: z
+        .object({
+        enabled: z.boolean().default(true),
+        enforceFixedAgentPreset: z.boolean().default(true),
+        enforceFixedWorkspace: z.boolean().default(true),
+        enforceFixedModel: z.boolean().default(true),
+        sandboxMode: z.union(["read-only"]).default("read-only"),
+        approvalPolicy: z.union(["never"]).default("never"),
+        permissionPreset: z.string().default("qa-read-only"),
+        allowPermissionChanges: z.const(false).default(false),
+        allowSlashCommands: z.const(false).default(false),
+        allowSettingsMutation: z.const(false).default(false),
+        allowSessionReset: z.boolean().default(false),
+        allowSessionRename: z.const(false).default(false),
+        allowSessionDelete: z.const(false).default(false),
+        allowArbitrarySessionOpen: z.const(false).default(false),
+        toolPolicy: z
+            .object({
+            mode: z.union(["allow-list"]).default("allow-list"),
+            allow: z.array(z.string()).default([]),
+        })
+            .default({ mode: "allow-list", allow: [] }),
+    })
+        .default({
+        enabled: true,
+        enforceFixedAgentPreset: true,
+        enforceFixedWorkspace: true,
+        enforceFixedModel: true,
+        sandboxMode: "read-only",
+        approvalPolicy: "never",
+        permissionPreset: "qa-read-only",
+        allowPermissionChanges: false,
+        allowSlashCommands: false,
+        allowSettingsMutation: false,
+        allowSessionReset: false,
+        allowSessionRename: false,
+        allowSessionDelete: false,
+        allowArbitrarySessionOpen: false,
+        toolPolicy: { mode: "allow-list", allow: [] },
+    }),
     embedding: z
         .object({ frameAncestors: nullableString.default(null) })
         .default({ frameAncestors: null }),

package/lib/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,0BAA0B,CAAC;AAGzC,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAE5D,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAC/B,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KACzC,CAAC;SACD,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IAChD,QAAQ,EAAE,CAAC;SACR,MAAM,CAAC;QACN,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC;QACtC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC;QACrD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,mBAAmB,CAAC;QACpD,OAAO,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC;KACtC,CAAC;SACD,OAAO,CAAC;QACP,KAAK,EAAE,WAAW;QAClB,QAAQ,EAAE,EAAE;QACZ,cAAc,EAAE,iBAAiB;QACjC,WAAW,EAAE,mBAAmB;QAChC,OAAO,EAAE,IAAI;KACd,CAAC;IACJ,OAAO,EAAE,CAAC;SACP,MAAM,CAAC;QACN,MAAM,EAAE,CAAC;aACN,KAAK,CAAC,CAAC,oBAAoB,EAAE,aAAa,EAAE,OAAO,CAAU,CAAC;aAC9D,OAAO,CAAC,oBAAoB,CAAC;QAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC;QAChD,WAAW,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC;QACzC,cAAc,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC;QAC5C,WAAW,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC;QACzC,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC;QACtC,KAAK,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC;QACnC,eAAe,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC;KAC9C,CAAC;SACD,OAAO,CAAC;QACP,MAAM,EAAE,oBAAoB;QAC5B,UAAU,EAAE,gBAAgB;QAC5B,WAAW,EAAE,IAAI;QACjB,cAAc,EAAE,IAAI;QACpB,WAAW,EAAE,IAAI;QACjB,QAAQ,EAAE,IAAI;QACd,KAAK,EAAE,IAAI;QACX,eAAe,EAAE,IAAI;KACtB,CAAC;IACJ,EAAE,EAAE,CAAC;SACF,MAAM,CAAC;QACN,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACrC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACpC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACnC,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAC1C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAC5C,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QACzC,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACzC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;KACpE,CAAC;SACD,OAAO,CAAC;QACP,UAAU,EAAE,IAAI;QAChB,SAAS,EAAE,IAAI;QACf,QAAQ,EAAE,IAAI;QACd,cAAc,EAAE,KAAK;QACrB,gBAAgB,EAAE,KAAK;QACvB,aAAa,EAAE,KAAK;QACpB,cAAc,EAAE,IAAI;QACpB,eAAe,EAAE,GAAG;KACrB,CAAC;IACJ,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACnD,WAAW,EAAE,CAAC;SACX,MAAM,CAAC;QACN,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,CAAU,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAC3D,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,aAAa,CAAU,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;KACpE,CAAC;SACD,OAAO,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;IAC9D,SAAS,EAAE,CAAC;SACT,MAAM,CAAC,EAAE,cAAc,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;SACxD,OAAO,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;CACrC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,YAA6C,CAAC;AAC1E,OAAO,EACL,yBAAyB,EACzB,kBAAkB,EAClB,aAAa,GACd,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,0BAA0B,CAAC;AAGzC,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAE5D,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAC/B,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KACzC,CAAC;SACD,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IAChD,QAAQ,EAAE,CAAC;SACR,MAAM,CAAC;QACN,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC;QACrC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,kBAAkB,CAAC;QACtD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC;QAClD,OAAO,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC;QACrC,UAAU,EAAE,cAAc,CAAC,OAAO,CAChC,sGAAsG,CACvG;KACF,CAAC;SACD,OAAO,CAAC;QACP,KAAK,EAAE,UAAU;QACjB,QAAQ,EAAE,EAAE;QACZ,cAAc,EAAE,kBAAkB;QAClC,WAAW,EAAE,iBAAiB;QAC9B,OAAO,EAAE,IAAI;QACb,UAAU,EACR,sGAAsG;KACzG,CAAC;IACJ,OAAO,EAAE,CAAC;SACP,MAAM,CAAC;QACN,MAAM,EAAE,CAAC;aACN,KAAK,CAAC,CAAC,oBAAoB,EAAE,aAAa,EAAE,OAAO,CAAU,CAAC;aAC9D,OAAO,CAAC,oBAAoB,CAAC;QAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,wBAAwB,CAAC;QACxD,GAAG,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC;QACjC,WAAW,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC;QACzC,cAAc,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC;QAC5C,WAAW,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC;QACzC,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC;QACtC,KAAK,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC;QACnC,eAAe,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC;KAC9C,CAAC;SACD,OAAO,CAAC;QACP,MAAM,EAAE,oBAAoB;QAC5B,UAAU,EAAE,wBAAwB;QACpC,GAAG,EAAE,IAAI;QACT,WAAW,EAAE,IAAI;QACjB,cAAc,EAAE,IAAI;QACpB,WAAW,EAAE,IAAI;QACjB,QAAQ,EAAE,IAAI;QACd,KAAK,EAAE,IAAI;QACX,eAAe,EAAE,IAAI;KACtB,CAAC;IACJ,EAAE,EAAE,CAAC;SACF,MAAM,CAAC;QACN,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACrC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACpC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACnC,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAC1C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAC5C,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QACzC,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACzC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;QACnE,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;KAC5C,CAAC;SACD,OAAO,CAAC;QACP,UAAU,EAAE,IAAI;QAChB,SAAS,EAAE,IAAI;QACf,QAAQ,EAAE,IAAI;QACd,cAAc,EAAE,KAAK;QACrB,gBAAgB,EAAE,KAAK;QACvB,aAAa,EAAE,KAAK;QACpB,cAAc,EAAE,IAAI;QACpB,eAAe,EAAE,GAAG;QACpB,eAAe,EAAE,KAAK;KACvB,CAAC;IACJ,kBAAkB,EAAE,CAAC;SAClB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,OAAO,CAAC;QACP,gBAAgB;QAChB,gBAAgB;QAChB,8BAA8B;KAC/B,CAAC;IACJ,WAAW,EAAE,CAAC;SACX,MAAM,CAAC;QACN,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,CAAU,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAC3D,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,aAAa,CAAU,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;KACpE,CAAC;SACD,OAAO,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;IAC9D,QAAQ,EAAE,CAAC;SACR,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAClC,uBAAuB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAClD,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAChD,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC5C,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,CAAU,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;QACjE,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAU,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QAC5D,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC;QACpD,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACrD,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACjD,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACpD,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAC7C,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACjD,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACjD,yBAAyB,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACxD,UAAU,EAAE,CAAC;aACV,MAAM,CAAC;YACN,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY,CAAU,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;YAC5D,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;SACvC,CAAC;aACD,OAAO,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;KAC9C,CAAC;SACD,OAAO,CAAC;QACP,OAAO,EAAE,IAAI;QACb,uBAAuB,EAAE,IAAI;QAC7B,qBAAqB,EAAE,IAAI;QAC3B,iBAAiB,EAAE,IAAI;QACvB,WAAW,EAAE,WAAW;QACxB,cAAc,EAAE,OAAO;QACvB,gBAAgB,EAAE,cAAc;QAChC,sBAAsB,EAAE,KAAK;QAC7B,kBAAkB,EAAE,KAAK;QACzB,qBAAqB,EAAE,KAAK;QAC5B,iBAAiB,EAAE,KAAK;QACxB,kBAAkB,EAAE,KAAK;QACzB,kBAAkB,EAAE,KAAK;QACzB,yBAAyB,EAAE,KAAK;QAChC,UAAU,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,EAAE;KAC9C,CAAC;IACJ,SAAS,EAAE,CAAC;SACT,MAAM,CAAC,EAAE,cAAc,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;SACxD,OAAO,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;CACrC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,YAA6C,CAAC;AAC1E,OAAO,EACL,yBAAyB,EACzB,kBAAkB,EAClB,aAAa,GACd,MAAM,qBAAqB,CAAC"}

package/lib/index.js

@@ -1,83 +1,179 @@
-import { Service } from "@deepseek-ai/cordis";
+var __runInitializers = (this && this.__runInitializers) || function (thisArg, initializers, value) {
+    var useValue = arguments.length > 2;
+    for (var i = 0; i < initializers.length; i++) {
+        value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
+    }
+    return useValue ? value : void 0;
+};
+var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
+    function accept(f) { if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected"); return f; }
+    var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
+    var target = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
+    var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});
+    var _, done = false;
+    for (var i = decorators.length - 1; i >= 0; i--) {
+        var context = {};
+        for (var p in contextIn) context[p] = p === "access" ? {} : contextIn[p];
+        for (var p in contextIn.access) context.access[p] = contextIn.access[p];
+        context.addInitializer = function (f) { if (done) throw new TypeError("Cannot add initializers after decoration has completed"); extraInitializers.push(accept(f || null)); };
+        var result = (0, decorators[i])(kind === "accessor" ? { get: descriptor.get, set: descriptor.set } : descriptor[key], context);
+        if (kind === "accessor") {
+            if (result === void 0) continue;
+            if (result === null || typeof result !== "object") throw new TypeError("Object expected");
+            if (_ = accept(result.get)) descriptor.get = _;
+            if (_ = accept(result.set)) descriptor.set = _;
+            if (_ = accept(result.init)) initializers.unshift(_);
+        }
+        else if (_ = accept(result)) {
+            if (kind === "field") initializers.unshift(_);
+            else descriptor[key] = _;
+        }
+    }
+    if (target) Object.defineProperty(target, contextIn.name, descriptor);
+    done = true;
+};
+import { Remote, TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
 import { installSettingsSection, settingsNamespace, } from "@deepseek-ai/dsh-settings";
 import { createHostLoggerSink, getPluginLogger, } from "@yadsh/dsh-plugin-log";
 import { ConfigSchema, resolveConfig } from "./config.js";
+import { QaAttestationError } from "./attestation.js";
 import { registerQaNavigationRoute } from "./host-route.js";
+import { QaPolicyAdmission } from "./secure-session.js";
 export const name = "qa-surface";
-export const inject = [];
+export const inject = [
+    "agents",
+    "agentPresets",
+    "permissionPresets",
+    "tools",
+    "workspaceRegistry",
+];
 export const QA_SURFACE_SETTINGS_NAMESPACE = settingsNamespace("qa-surface");
 export const Config = ConfigSchema;
-/** Small Host companion: validates config and exposes it through DSH settings. */
-export class QaSurface extends Service {
-    static inject = inject;
-    static Config = ConfigSchema;
-    source;
-    logger;
-    webServer;
-    disposeRoute;
-    routeKey;
-    constructor(ctx, entry = {}) {
-        super(ctx, "qaSurface");
-        const resolvedEntry = resolveConfig(entry);
-        this.source = () => resolvedEntry;
-        this.logger = getPluginLogger({
-            pluginId: "dsh-qa-surface",
-            consoleSink: createHostLoggerSink(ctx.logger),
-        });
-        ctx.effect(() => async () => this.logger.close(), "dsh-qa-surface.logger");
-        installSettingsSection(ctx, QA_SURFACE_SETTINGS_NAMESPACE, ConfigSchema, entry, {
-            setSource: (source) => {
-                this.source = source;
-            },
-            onChange: () => {
-                const config = this.getConfig();
+const CONFIGURATION_ERROR = "Assistant configuration is unavailable.";
+/** Host companion: validates config, owns the admission boundary and the route. */
+let QaSurface = (() => {
+    let _classSuper = TypertRemoteService;
+    let _instanceExtraInitializers = [];
+    let _describe_decorators;
+    let _secureSession_decorators;
+    return class QaSurface extends _classSuper {
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            _describe_decorators = [Remote("describe")];
+            _secureSession_decorators = [Remote("secureSession")];
+            __esDecorate(this, null, _describe_decorators, { kind: "method", name: "describe", static: false, private: false, access: { has: obj => "describe" in obj, get: obj => obj.describe }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _secureSession_decorators, { kind: "method", name: "secureSession", static: false, private: false, access: { has: obj => "secureSession" in obj, get: obj => obj.secureSession }, metadata: _metadata }, null, _instanceExtraInitializers);
+            if (_metadata) Object.defineProperty(this, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+        }
+        static inject = inject;
+        static Config = ConfigSchema;
+        source = __runInitializers(this, _instanceExtraInitializers);
+        logger;
+        admission;
+        webServer;
+        disposeRoute;
+        routeKey;
+        constructor(ctx, entry = {}) {
+            super(ctx, "qaSurface", { namespace: "qaSurface" });
+            const resolvedEntry = resolveConfig(entry);
+            this.source = () => resolvedEntry;
+            this.logger = getPluginLogger({
+                pluginId: "dsh-qa-surface",
+                consoleSink: createHostLoggerSink(ctx.logger),
+            });
+            this.admission = new QaPolicyAdmission(ctx, () => this.getConfig(), this.logger);
+            ctx.effect(() => async () => this.logger.close(), "dsh-qa-surface.logger");
+            ctx.effect(() => () => this.admission.dispose(), "dsh-qa-surface.lockdown-policies");
+            installSettingsSection(ctx, QA_SURFACE_SETTINGS_NAMESPACE, ConfigSchema, entry, {
+                setSource: (source) => {
+                    this.source = source;
+                },
+                onChange: () => {
+                    const config = this.getConfig();
+                    this.refreshRoute();
+                    this.logger.info("config.updated", {
+                        enabled: config.enabled,
+                        route: config.route.path,
+                        sessionPolicy: config.session.policy,
+                    });
+                },
+                validate: (value) => {
+                    resolveConfig(value);
+                },
+            });
+            ctx.inject(["webServer"], (webContext) => {
+                this.webServer = webContext.webServer;
                 this.refreshRoute();
-                this.logger.info("config.updated", {
-                    enabled: config.enabled,
-                    route: config.route.path,
-                    sessionPolicy: config.session.policy,
+                webContext.effect(() => () => {
+                    this.disposeRoute?.();
+                    this.disposeRoute = undefined;
+                    this.routeKey = undefined;
+                    this.webServer = undefined;
+                }, "dsh-qa-surface.navigation-route");
+            });
+            this.logger.info("plugin.ready", {
+                enabled: resolvedEntry.enabled,
+                route: resolvedEntry.route.path,
+                sessionPolicy: resolvedEntry.session.policy,
+            });
+        }
+        getConfig() {
+            return resolveConfig(this.source());
+        }
+        /**
+         * Serve the effective QA configuration to the browser. The DSH gateway pins
+         * settings RPCs to loopback, so a browser served over the LAN always sees
+         * the settings namespace as unavailable; this method is the config channel
+         * such a browser falls back to. It is read-only projection — the admission
+         * boundary stays in {@link secureSession}.
+         */
+        describe() {
+            return this.getConfig();
+        }
+        /** Pin and attest the effective policy. The browser supplies identity only. */
+        secureSession(sessionId) {
+            try {
+                return this.admission.secureSession(sessionId);
+            }
+            catch (error) {
+                // The carrier empties error.details, so the coarse reason rides the
+                // wire message for the browser console; the specific mismatch facts
+                // stay in this log only.
+                const reason = error instanceof QaAttestationError
+                    ? error.reason
+                    : "attestation-failed";
+                this.logger.error("lockdown.rejected", {
+                    sessionId,
+                    reason,
+                    error: error instanceof Error ? error.message : String(error),
                 });
-            },
-            validate: (value) => {
-                resolveConfig(value);
-            },
-        });
-        ctx.inject(["webServer"], (webContext) => {
-            this.webServer = webContext.webServer;
-            this.refreshRoute();
-            webContext.effect(() => () => {
-                this.disposeRoute?.();
-                this.disposeRoute = undefined;
-                this.routeKey = undefined;
-                this.webServer = undefined;
-            }, "dsh-qa-surface.navigation-route");
-        });
-        this.logger.info("plugin.ready", {
-            enabled: resolvedEntry.enabled,
-            route: resolvedEntry.route.path,
-            sessionPolicy: resolvedEntry.session.policy,
-        });
-    }
-    getConfig() {
-        return resolveConfig(this.source());
-    }
-    refreshRoute() {
-        const config = this.getConfig();
-        const key = config.enabled
-            ? `${config.route.path}:${config.route.matchChildren}`
-            : undefined;
-        if (key === this.routeKey)
-            return;
-        this.disposeRoute?.();
-        this.disposeRoute = undefined;
-        this.routeKey = undefined;
-        if (key === undefined || this.webServer === undefined)
-            return;
-        this.disposeRoute = registerQaNavigationRoute(this.webServer, config);
-        this.routeKey = key;
-    }
-}
+                throw new Error(`${CONFIGURATION_ERROR} (reason: ${reason})`, {
+                    cause: error,
+                });
+            }
+        }
+        refreshRoute() {
+            const config = this.getConfig();
+            const key = config.enabled
+                ? `${config.route.path}:${config.route.matchChildren}`
+                : undefined;
+            if (key === this.routeKey)
+                return;
+            this.disposeRoute?.();
+            this.disposeRoute = undefined;
+            this.routeKey = undefined;
+            if (key === undefined || this.webServer === undefined)
+                return;
+            this.disposeRoute = registerQaNavigationRoute(this.webServer, config);
+            this.routeKey = key;
+        }
+    };
+})();
+export { QaSurface };
 export { ConfigSchema, DEFAULT_QA_SURFACE_CONFIG, normalizeRoutePath, resolveConfig, } from "./config.js";
+export { QaAttestationError } from "./attestation.js";
 export { registerQaNavigationRoute } from "./host-route.js";
+export { qaToolDenial, qaToolPolicyPlan } from "./lockdown-policy.js";
+export { QaPolicyAdmission } from "./secure-session.js";
 export default QaSurface;
 //# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAgB,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EACL,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,oBAAoB,EACpB,eAAe,GAEhB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAG5D,MAAM,CAAC,MAAM,IAAI,GAAG,YAAY,CAAC;AACjC,MAAM,CAAC,MAAM,MAAM,GAAsB,EAAE,CAAC;AAC5C,MAAM,CAAC,MAAM,6BAA6B,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;AAC7E,MAAM,CAAC,MAAM,MAAM,GAAG,YAAY,CAAC;AAQnC,kFAAkF;AAClF,MAAM,OAAO,SAAU,SAAQ,OAAO;IACpC,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,MAAM,CAAC,MAAM,GAAG,YAAY,CAAC;IAErB,MAAM,CAAwB;IACrB,MAAM,CAAe;IAC9B,SAAS,CAC6C;IACtD,YAAY,CAA2B;IACvC,QAAQ,CAAqB;IAErC,YAAY,GAAY,EAAE,KAAK,GAAoB,EAAE;QACnD,KAAK,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QACxB,MAAM,aAAa,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC,aAAa,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,eAAe,CAAC;YAC5B,QAAQ,EAAE,gBAAgB;YAC1B,WAAW,EAAE,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC;SAC9C,CAAC,CAAC;QACH,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,uBAAuB,CAAC,CAAC;QAC3E,sBAAsB,CACpB,GAAG,EACH,6BAA6B,EAC7B,YAAY,EACZ,KAAK,EACL;YACE,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE;gBACpB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;YACvB,CAAC;YACD,QAAQ,EAAE,GAAG,EAAE;gBACb,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;gBAChC,IAAI,CAAC,YAAY,EAAE,CAAC;gBACpB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE;oBACjC,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI;oBACxB,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;iBACrC,CAAC,CAAC;YACL,CAAC;YACD,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE;gBAClB,aAAa,CAAC,KAAK,CAAC,CAAC;YACvB,CAAC;SACF,CACF,CAAC;QACF,GAAG,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE;YACvC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;YACtC,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,UAAU,CAAC,MAAM,CACf,GAAG,EAAE,CAAC,GAAG,EAAE;gBACT,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;gBACtB,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;gBAC9B,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;gBAC1B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;YAC7B,CAAC,EACD,iCAAiC,CAClC,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE;YAC/B,OAAO,EAAE,aAAa,CAAC,OAAO;YAC9B,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,IAAI;YAC/B,aAAa,EAAE,aAAa,CAAC,OAAO,CAAC,MAAM;SAC5C,CAAC,CAAC;IACL,CAAC;IAED,SAAS;QACP,OAAO,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACtC,CAAC;IAEO,YAAY;QAClB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO;YACxB,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE;YACtD,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,GAAG,KAAK,IAAI,CAAC,QAAQ;YAAE,OAAO;QAClC,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;QACtB,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;QAC9B,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;QAC1B,IAAI,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO;QAC9D,IAAI,CAAC,YAAY,GAAG,yBAAyB,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACtE,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC;IACtB,CAAC;CACF;AAED,OAAO,EACL,YAAY,EACZ,yBAAyB,EACzB,kBAAkB,EAClB,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAE5D,eAAe,SAAS,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAGA,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAE/E,OAAO,EACL,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,oBAAoB,EACpB,eAAe,GAEhB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAOxD,MAAM,CAAC,MAAM,IAAI,GAAG,YAAY,CAAC;AACjC,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,QAAQ;IACR,cAAc;IACd,mBAAmB;IACnB,OAAO;IACP,mBAAmB;CACpB,CAAC;AACF,MAAM,CAAC,MAAM,6BAA6B,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;AAC7E,MAAM,CAAC,MAAM,MAAM,GAAG,YAAY,CAAC;AAQnC,MAAM,mBAAmB,GAAG,yCAAyC,CAAC;AAEtE,mFAAmF;IACtE,SAAS;sBAAS,mBAAmB;;;;iBAArC,SAAU,SAAQ,WAAmB;;;oCAoF/C,MAAM,CAAC,UAAU,CAAC;yCAMlB,MAAM,CAAC,eAAe,CAAC;YALxB,2KAAA,QAAQ,6DAEP;YAID,0LAAA,aAAa,6DAoBZ;;;QA9GD,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;QACvB,MAAM,CAAC,MAAM,GAAG,YAAY,CAAC;QAErB,MAAM,GAJH,mDAAS,CAIkB;QACrB,MAAM,CAAe;QACrB,SAAS,CAAoB;QACtC,SAAS,CAC6C;QACtD,YAAY,CAA2B;QACvC,QAAQ,CAAqB;QAErC,YAAY,GAAY,EAAE,KAAK,GAAoB,EAAE;YACnD,KAAK,CAAC,GAAG,EAAE,WAAW,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;YACpD,MAAM,aAAa,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;YAC3C,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC,aAAa,CAAC;YAClC,IAAI,CAAC,MAAM,GAAG,eAAe,CAAC;gBAC5B,QAAQ,EAAE,gBAAgB;gBAC1B,WAAW,EAAE,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC;aAC9C,CAAC,CAAC;YACH,IAAI,CAAC,SAAS,GAAG,IAAI,iBAAiB,CACpC,GAAG,EACH,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,EACtB,IAAI,CAAC,MAAM,CACZ,CAAC;YACF,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,uBAAuB,CAAC,CAAC;YAC3E,GAAG,CAAC,MAAM,CACR,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,EACpC,kCAAkC,CACnC,CAAC;YACF,sBAAsB,CACpB,GAAG,EACH,6BAA6B,EAC7B,YAAY,EACZ,KAAK,EACL;gBACE,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE;oBACpB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;gBACvB,CAAC;gBACD,QAAQ,EAAE,GAAG,EAAE;oBACb,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;oBAChC,IAAI,CAAC,YAAY,EAAE,CAAC;oBACpB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE;wBACjC,OAAO,EAAE,MAAM,CAAC,OAAO;wBACvB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI;wBACxB,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;qBACrC,CAAC,CAAC;gBACL,CAAC;gBACD,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE;oBAClB,aAAa,CAAC,KAAK,CAAC,CAAC;gBACvB,CAAC;aACF,CACF,CAAC;YACF,GAAG,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE;gBACvC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;gBACtC,IAAI,CAAC,YAAY,EAAE,CAAC;gBACpB,UAAU,CAAC,MAAM,CACf,GAAG,EAAE,CAAC,GAAG,EAAE;oBACT,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;oBACtB,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;oBAC9B,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;oBAC1B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;gBAC7B,CAAC,EACD,iCAAiC,CAClC,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE;gBAC/B,OAAO,EAAE,aAAa,CAAC,OAAO;gBAC9B,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,IAAI;gBAC/B,aAAa,EAAE,aAAa,CAAC,OAAO,CAAC,MAAM;aAC5C,CAAC,CAAC;QACL,CAAC;QAED,SAAS;YACP,OAAO,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACtC,CAAC;QAED;;;;;;WAMG;QAEH,QAAQ;YACN,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;QAC1B,CAAC;QAED,+EAA+E;QAE/E,aAAa,CAAC,SAAiB;YAC7B,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;YACjD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,oEAAoE;gBACpE,oEAAoE;gBACpE,yBAAyB;gBACzB,MAAM,MAAM,GACV,KAAK,YAAY,kBAAkB;oBACjC,CAAC,CAAC,KAAK,CAAC,MAAM;oBACd,CAAC,CAAC,oBAAoB,CAAC;gBAC3B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,EAAE;oBACrC,SAAS;oBACT,MAAM;oBACN,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CAAC,CAAC;gBACH,MAAM,IAAI,KAAK,CAAC,GAAG,mBAAmB,aAAa,MAAM,GAAG,EAAE;oBAC5D,KAAK,EAAE,KAAK;iBACb,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAEO,YAAY;YAClB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO;gBACxB,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE;gBACtD,CAAC,CAAC,SAAS,CAAC;YACd,IAAI,GAAG,KAAK,IAAI,CAAC,QAAQ;gBAAE,OAAO;YAClC,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;YACtB,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;YAC9B,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;YAC1B,IAAI,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;gBAAE,OAAO;YAC9D,IAAI,CAAC,YAAY,GAAG,yBAAyB,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACtE,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC;QACtB,CAAC;;;SA7HU,SAAS;AAgItB,OAAO,EACL,YAAY,EACZ,yBAAyB,EACzB,kBAAkB,EAClB,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,eAAe,SAAS,CAAC"}

package/lib/lockdown-policy.js

@@ -0,0 +1,20 @@
+const TOOL_DENIAL = "This tool is not available in the QA execution profile.";
+/**
+ * Validate an allow-list against the complete agent-scoped view.
+ *
+ * Preset tools live on an ancestor scope, not necessarily in the global tool
+ * layer. The restriction must therefore retain the configured names verbatim;
+ * deriving it from the global view would hide every preset-owned tool after a
+ * successful first attestation and make the next attestation fail.
+ */
+export function qaToolPolicyPlan(allow, isMounted) {
+    return {
+        allow: [...allow],
+        unknown: allow.filter((toolName) => !isMounted(toolName)),
+    };
+}
+/** Monotonic execution decision shared by inherited, scoped and transport tools. */
+export function qaToolDenial(allowed, toolName) {
+    return allowed.has(toolName) ? undefined : TOOL_DENIAL;
+}
+//# sourceMappingURL=lockdown-policy.js.map

package/lib/lockdown-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lockdown-policy.js","sourceRoot":"","sources":["../src/lockdown-policy.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,GAAG,yDAAyD,CAAC;AAS9E;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAAwB,EACxB,SAAwC;IAExC,OAAO;QACL,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC;QACjB,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;KAC1D,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,YAAY,CAC1B,OAA4B,EAC5B,QAAgB;IAEhB,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;AACzD,CAAC"}

package/lib/resolve-config.js

@@ -2,15 +2,17 @@ export const DEFAULT_QA_SURFACE_CONFIG = Object.freeze({
     enabled: true,
     route: Object.freeze({ path: "/qa", matchChildren: true }),
     branding: Object.freeze({
-        title: "Assistant",
+        title: "Помощник",
         subtitle: "",
-        welcomeMessage: "How can I help?",
-        placeholder: "Ask a question...",
+        welcomeMessage: "Чем могу помочь?",
+        placeholder: "Задайте вопрос…",
         logoUrl: null,
+        disclaimer: "Диалоги могут быть видны другим пользователям сервера и используются для улучшения качества ответов.",
     }),
     session: Object.freeze({
         policy: "browser-persistent",
-        storageKey: "dsh-qa-surface",
+        storageKey: "dsh-qa-surface.session",
+        cwd: null,
         workspaceId: null,
         fixedSessionId: null,
         agentPreset: null,
@@ -20,19 +22,44 @@ export const DEFAULT_QA_SURFACE_CONFIG = Object.freeze({
     }),
     ui: Object.freeze({
         showHeader: true,
-        showReset: true,
+        showReset: false,
         showStop: true,
         showTimestamps: false,
         showToolActivity: false,
         showReasoning: false,
         renderMarkdown: true,
         maxContentWidth: 900,
+        showSessionList: false,
     }),
-    suggestedQuestions: Object.freeze([]),
+    suggestedQuestions: Object.freeze([
+        "Что ты умеешь?",
+        "С чего начать?",
+        "Помоги разобраться с ошибкой",
+    ]),
     interaction: Object.freeze({
         approvals: "blocked",
         questions: "unsupported",
     }),
+    lockdown: Object.freeze({
+        enabled: true,
+        enforceFixedAgentPreset: true,
+        enforceFixedWorkspace: true,
+        enforceFixedModel: true,
+        sandboxMode: "read-only",
+        approvalPolicy: "never",
+        permissionPreset: "qa-read-only",
+        allowPermissionChanges: false,
+        allowSlashCommands: false,
+        allowSettingsMutation: false,
+        allowSessionReset: false,
+        allowSessionRename: false,
+        allowSessionDelete: false,
+        allowArbitrarySessionOpen: false,
+        toolPolicy: Object.freeze({
+            mode: "allow-list",
+            allow: Object.freeze([]),
+        }),
+    }),
     embedding: Object.freeze({ frameAncestors: null }),
 });
 function optionalText(value) {
@@ -65,6 +92,15 @@ function uniqueQuestions(values) {
     }
     return Object.freeze(questions);
 }
+function uniqueToolNames(values) {
+    const names = [
+        ...new Set(values.map((value) => value.trim()).filter(Boolean)),
+    ];
+    if (names.some((value) => value.length > 200)) {
+        throw new TypeError("dsh-qa-surface: lockdown.toolPolicy.allow names must be at most 200 characters");
+    }
+    return Object.freeze(names);
+}
 /** Materialize defaults and enforce route/session/model safety constraints. */
 export function resolveConfig(input = {}) {
     const routePath = normalizeRoutePath(input.route?.path ?? DEFAULT_QA_SURFACE_CONFIG.route.path);
@@ -73,6 +109,16 @@ export function resolveConfig(input = {}) {
     if (policy === "fixed" && fixedSessionId === null) {
         throw new TypeError("dsh-qa-surface: session.fixedSessionId is required for fixed policy");
     }
+    // The cwd pin is the no-registry alternative to workspaceId; both pin the
+    // session to one directory, so together they are a configuration error.
+    const cwd = optionalText(input.session?.cwd);
+    if (cwd !== null && !/^([a-zA-Z]:[/\\]|\/)/u.test(cwd)) {
+        throw new TypeError("dsh-qa-surface: session.cwd must be an absolute directory path");
+    }
+    const workspaceId = optionalText(input.session?.workspaceId);
+    if (workspaceId !== null && cwd !== null) {
+        throw new TypeError("dsh-qa-surface: session.workspaceId and session.cwd are mutually exclusive");
+    }
     const provider = optionalText(input.session?.provider);
     const model = optionalText(input.session?.model);
     if ((provider === null) !== (model === null)) {
@@ -89,8 +135,43 @@ export function resolveConfig(input = {}) {
         maxContentWidth > 1600) {
         throw new TypeError("dsh-qa-surface: ui.maxContentWidth must be an integer from 480 to 1600");
     }
-    if (input.ui?.showReasoning === true) {
-        throw new TypeError("dsh-qa-surface: ui.showReasoning is not supported by the safe MVP surface");
+    const lockdownEnabled = input.lockdown?.enabled ?? DEFAULT_QA_SURFACE_CONFIG.lockdown.enabled;
+    const rawLockdown = input.lockdown;
+    const forbiddenCapabilityFlags = [
+        ["allowPermissionChanges", rawLockdown?.allowPermissionChanges],
+        ["allowSlashCommands", rawLockdown?.allowSlashCommands],
+        ["allowSettingsMutation", rawLockdown?.allowSettingsMutation],
+        ["allowSessionRename", rawLockdown?.allowSessionRename],
+        ["allowSessionDelete", rawLockdown?.allowSessionDelete],
+        ["allowArbitrarySessionOpen", rawLockdown?.allowArbitrarySessionOpen],
+    ];
+    const weakenedFlag = forbiddenCapabilityFlags.find(([, value]) => value === true);
+    if (weakenedFlag !== undefined) {
+        throw new TypeError(`dsh-qa-surface: lockdown.${weakenedFlag[0]} cannot be enabled`);
+    }
+    if (input.lockdown?.sandboxMode !== undefined &&
+        input.lockdown.sandboxMode !== "read-only") {
+        throw new TypeError("dsh-qa-surface: lockdown.sandboxMode must be read-only");
+    }
+    if (input.lockdown?.approvalPolicy !== undefined &&
+        input.lockdown.approvalPolicy !== "never") {
+        throw new TypeError("dsh-qa-surface: lockdown.approvalPolicy must be never");
+    }
+    if (input.lockdown?.toolPolicy?.mode !== undefined &&
+        input.lockdown.toolPolicy.mode !== "allow-list") {
+        throw new TypeError("dsh-qa-surface: lockdown.toolPolicy.mode must be allow-list");
+    }
+    const permissionPreset = input.lockdown?.permissionPreset?.trim() ??
+        DEFAULT_QA_SURFACE_CONFIG.lockdown.permissionPreset;
+    if (lockdownEnabled && permissionPreset === "") {
+        throw new TypeError("dsh-qa-surface: lockdown.permissionPreset is required when lockdown is enabled");
+    }
+    const allowSessionReset = input.lockdown?.allowSessionReset ??
+        DEFAULT_QA_SURFACE_CONFIG.lockdown.allowSessionReset;
+    if (lockdownEnabled &&
+        (input.ui?.showReset ?? DEFAULT_QA_SURFACE_CONFIG.ui.showReset) &&
+        !allowSessionReset) {
+        throw new TypeError("dsh-qa-surface: ui.showReset requires lockdown.allowSessionReset");
     }
     return Object.freeze({
         enabled: input.enabled ?? DEFAULT_QA_SURFACE_CONFIG.enabled,
@@ -108,10 +189,16 @@ export function resolveConfig(input = {}) {
             placeholder: input.branding?.placeholder?.trim() ||
                 DEFAULT_QA_SURFACE_CONFIG.branding.placeholder,
             logoUrl: optionalText(input.branding?.logoUrl),
+            // Undefined falls back to the default notice; an explicit null or
+            // empty string hides the plate entirely.
+            disclaimer: input.branding?.disclaimer === undefined
+                ? DEFAULT_QA_SURFACE_CONFIG.branding.disclaimer
+                : (optionalText(input.branding.disclaimer) ?? ""),
         }),
         session: Object.freeze({
             policy,
             storageKey,
+            cwd,
             workspaceId: optionalText(input.session?.workspaceId),
             fixedSessionId,
             agentPreset: optionalText(input.session?.agentPreset),
@@ -126,15 +213,40 @@ export function resolveConfig(input = {}) {
             showTimestamps: input.ui?.showTimestamps ?? DEFAULT_QA_SURFACE_CONFIG.ui.showTimestamps,
             showToolActivity: input.ui?.showToolActivity ??
                 DEFAULT_QA_SURFACE_CONFIG.ui.showToolActivity,
-            showReasoning: false,
+            showReasoning: input.ui?.showReasoning ?? DEFAULT_QA_SURFACE_CONFIG.ui.showReasoning,
             renderMarkdown: input.ui?.renderMarkdown ?? DEFAULT_QA_SURFACE_CONFIG.ui.renderMarkdown,
             maxContentWidth,
+            showSessionList: input.ui?.showSessionList ??
+                DEFAULT_QA_SURFACE_CONFIG.ui.showSessionList,
         }),
-        suggestedQuestions: uniqueQuestions(input.suggestedQuestions ?? []),
+        suggestedQuestions: uniqueQuestions(input.suggestedQuestions ?? DEFAULT_QA_SURFACE_CONFIG.suggestedQuestions),
         interaction: Object.freeze({
             approvals: "blocked",
             questions: "unsupported",
         }),
+        lockdown: Object.freeze({
+            enabled: lockdownEnabled,
+            enforceFixedAgentPreset: input.lockdown?.enforceFixedAgentPreset ??
+                DEFAULT_QA_SURFACE_CONFIG.lockdown.enforceFixedAgentPreset,
+            enforceFixedWorkspace: input.lockdown?.enforceFixedWorkspace ??
+                DEFAULT_QA_SURFACE_CONFIG.lockdown.enforceFixedWorkspace,
+            enforceFixedModel: input.lockdown?.enforceFixedModel ??
+                DEFAULT_QA_SURFACE_CONFIG.lockdown.enforceFixedModel,
+            sandboxMode: "read-only",
+            approvalPolicy: "never",
+            permissionPreset,
+            allowPermissionChanges: false,
+            allowSlashCommands: false,
+            allowSettingsMutation: false,
+            allowSessionReset,
+            allowSessionRename: false,
+            allowSessionDelete: false,
+            allowArbitrarySessionOpen: false,
+            toolPolicy: Object.freeze({
+                mode: "allow-list",
+                allow: uniqueToolNames(input.lockdown?.toolPolicy?.allow ?? []),
+            }),
+        }),
         embedding: Object.freeze({
             frameAncestors: optionalText(input.embedding?.frameAncestors),
         }),