@yadsh/dsh-qa-surface 0.1.1 → 0.2.0

package/CHANGELOG.md

@@ -1,3 +1,36 @@
+## 0.2.0 (2026-09-10)
+
+### 🚀 Features
+
+- Make the QA surface a complete end-user assistant shell: image attachments ([b9af082](https://github.com/xarleyn/dsh-plugins/commit/b9af082))
+  (drag & drop, paste, and a picker with removable previews; base64 prompt
+  parts the Host promotes to durable attachments, rendered back as clickable
+  thumbnails), subagent delegation presentation (launch work items with the
+  durable child id, settlement notices collapsed into titled expandable rows,
+  an agents panel listing the chat's subagents, and live read-only subagent
+  transcripts with a one-click return), source cards with a full-output detail
+  pane, clickable links and an open action, answer regeneration with
+  ChatGPT-style variant switching, message ratings with hover response
+  metadata (duration, TTFT, tokens per second), a data-usage disclaimer
+  plate under the composer, per-browser chat history
+  ordered by host updates with search and a collapsible sidebar, lazy draft
+  chats that create nothing until the first prompt, directory/workspace
+  pinning with a dedicated `workspace-unavailable` refusal, the company
+  interaction palette as `--dsh-qa-*` tokens, and a split of the surface into
+  focused drawer, switcher, and formatting modules.
+
+
+### 🩹 Fixes
+
+- Pack the generated Typert host and remote-client entrypoints: the `files` ([0059cb4](https://github.com/xarleyn/dsh-plugins/commit/0059cb4))
+  allowlist only kept declarations under `lib/types/`, so the `./remote` and
+  `./typert` exports previously shipped without their implementation modules
+  and type definitions.
+
+### ❤️ Thank You
+
+- xarleyn @xarleyn
+
 ## 0.1.1 (2026-09-06)
 
 ### 🩹 Fixes
@@ -23,3 +56,38 @@
 - Added Host settings registration and safety filtering for internal events.
 - Added a narrow Host navigation redirect for DSH releases whose static
   frontend returns 404 for direct `/qa` requests.
+- Added fail-closed Host policy attestation, the `qa-read-only` permission pin,
+  an inherited-tool allow-list, and a monotonic execution guard.
+- Disabled session reset by default and added capability-regression gates.
+- Refined the QA surface with first-party-style conversation chrome, plain
+  assistant flow, user bubbles, copy actions and a floating two-row composer.
+- Added opt-in reasoning and tool-call details grouped into a live turn work
+  disclosure that collapses to a `Worked for …` summary before the final answer.
+- Added an optional minimal chat-history sidebar (`ui.showSessionList`) with a
+  per-browser localStorage chat index, attested switching and a gated
+  New chat control.
+- Send-time policy attestation now survives a Host that idled the session's
+  agent out: the client re-binds the session (re-materializing the agent) and,
+  when the refused session is still blank, continues in a fresh attested
+  session instead of surfacing an error.
+- Added GFM table, ordered-list and horizontal-rule rendering to the safe
+  Markdown output.
+- Added a two-click chat delete control to the chat-history sidebar; it
+  removes the chat from the per-browser index only (DSH has no
+  session-deletion seam).
+- Added attestation diagnostics: the Host folds a coarse reason code into the
+  refusal and the browser console prints one operator hint instead of a
+  duplicate stack trace.
+- Fixed repeated policy attestation for tools contributed by an agent preset:
+  the applied restriction now retains the exact scoped allow-list instead of
+  accidentally reducing it to global-only tools. Removed the redundant native
+  presentation override so reloads cannot collide with the preset's mode.
+- The browser re-reads the Host configuration when the connection is restored,
+  so an open page survives a Host restart with a changed deployment config.
+- Added LAN serving support: a shipped `deploy/qa-lan.patch.yml` webserver
+  overlay, and a `qaSurface/describe` Host Remote the browser falls back to
+  when the loopback-pinned settings namespace is unavailable, so branding,
+  session pinning and lockdown UI switches keep working over the network.
+- Localized the end-user chat interface into Russian, added rotating playful
+  thinking phrases, and moved the default quick-question chips next to the
+  composer on an empty chat.

package/README.md

@@ -11,8 +11,13 @@ Session and Agent Loop.
 - stays invisible outside the configured route;
 - creates or restores one real DSH Session;
 - renders only user text, assistant-visible text and safe status messages;
-- supports streaming, Stop, New chat, safe Markdown and mobile layouts;
+- supports streaming, Stop, optional New chat, safe Markdown, copy actions and
+  a responsive first-party-style conversation layout;
+- optionally shows a minimal per-browser chat-history sidebar
+  (`ui.showSessionList`) whose switching re-runs policy attestation;
 - blocks unsupported approvals/questions instead of auto-approving them;
+- pins locked sessions to `read-only` + `approval=never` before Send is enabled;
+- applies a Host-side tool allow-list plus a monotonic execution guard;
 - uses the existing same-origin DSH connection and trust boundary.
 
 It does not add another HTTP server, provider proxy, permissive CORS rule, or
@@ -58,14 +63,17 @@ config:
     path: /qa
     matchChildren: true
   branding:
-    title: Internal Assistant
-    subtitle: Answers about the internal platform
-    welcomeMessage: How can I help?
-    placeholder: Ask a question...
+    title: Внутренний помощник
+    subtitle: Отвечает на вопросы о внутренней платформе
+    welcomeMessage: Чем могу помочь?
+    placeholder: Задайте вопрос…
     logoUrl: null
   session:
+    # Pin every chat to a directory (optional, one of):
+    # cwd: "D:/qa-docs"        # direct absolute directory pin
+    # workspaceId: "<uuid>"    # or a registered DSH workspace
     policy: browser-persistent
-    storageKey: dsh-qa-surface
+    storageKey: dsh-qa-surface.session
     workspaceId: company-knowledge
     fixedSessionId: null
     agentPreset: qa-assistant
@@ -74,19 +82,38 @@ config:
     reasoningEffort: null
   ui:
     showHeader: true
-    showReset: true
+    showReset: false
     showStop: true
     showTimestamps: false
     showToolActivity: false
     showReasoning: false
     renderMarkdown: true
     maxContentWidth: 900
+    showSessionList: false
   suggestedQuestions:
-    - How do I request access?
-    - Where is the runbook?
+    - Как запросить доступ?
+    - Где лежит инструкция?
   interaction:
     approvals: blocked
     questions: unsupported
+  lockdown:
+    enabled: true
+    enforceFixedAgentPreset: true
+    enforceFixedWorkspace: true
+    enforceFixedModel: true
+    sandboxMode: read-only
+    approvalPolicy: never
+    permissionPreset: qa-read-only
+    allowPermissionChanges: false
+    allowSlashCommands: false
+    allowSettingsMutation: false
+    allowSessionReset: false
+    allowSessionRename: false
+    allowSessionDelete: false
+    allowArbitrarySessionOpen: false
+    toolPolicy:
+      mode: allow-list
+      allow: []
 ```
 
 `workspaceId` is recommended for a deterministic assistant. Without it, DSH
@@ -95,8 +122,12 @@ skills, knowledge connections and permission policy in `agentPreset`, not in
 this UI plugin.
 
 Model override is opt-in: `provider` and `model` must be set together. Slash
-commands are rejected as plain QA input in this MVP. `showReasoning: true` is
-also rejected; raw reasoning is intentionally outside the safe MVP surface.
+commands are rejected as plain QA input. Reasoning and tool details remain
+hidden by default. Enabling `ui.showReasoning` and `ui.showToolActivity` adds a
+turn-scoped work disclosure: it stays open while the assistant is working,
+then collapses to `Worked for ...` before the final answer. Tool capability is
+still controlled exclusively by `lockdown.toolPolicy.allow`; the display flags
+do not grant tools.
 
 Session policies:
 
@@ -106,8 +137,85 @@ Session policies:
 - `fixed` requires `fixedSessionId`, never creates a replacement, and is meant
   only for controlled single-user deployments.
 
-New chat creates another DSH Session and leaves the old one intact for operator
-inspection.
+New chat is disabled by default. To expose it, set `lockdown.allowSessionReset:
+true` plus either `ui.showReset: true` (header button) or `ui.showSessionList:
+true` (sidebar button). Pressing it opens a draft composer and creates nothing:
+the DSH Session is materialized lazily by the first prompt, so the chat list
+stays quiet until a message is actually sent, and the old session stays intact
+for operator inspection. The sidebar orders chats by the host's last update,
+so merely opening a chat never moves it.
+
+Regeneration: the last committed answer offers a retry action. The session log
+is append-only, so "regenerate" sends a hidden instruction as an ordinary
+prompt and the answer arrives as a follow-up turn; the projection hides that
+instruction and the consecutive turns read as variants of one question,
+navigable with a `< 2/2 >` switcher (newest shown by default).
+
+Sources: with `ui.showToolActivity: true` a header button opens a right-hand
+drawer listing the pages fetched, searches run and files read in this chat,
+projected from the same tool activity the work groups render - no extra
+prompting or tooling is involved. Clicking a source opens its full tool
+output with every http(s) link clickable, and web sources carry an
+"Открыть" button straight to the page (a Jira issue, a wiki article).
+
+Images: the composer accepts PNG/JPEG/WebP/GIF via drag & drop onto the
+composer, paste, and the picker button, several at once (soft client caps:
+8 images, 15 MB each). Images ride the prompt as base64 uploads the Host
+promotes to durable attachments, so they survive reloads; sent images
+render as clickable thumbnails on the message. Whether the model can see
+them depends on the deployment's model (vision).
+
+Subagents: the deployment may opt the delegation family (`subagent`,
+`subagent_fork`, `send_message`, `list_agents`, `interrupt_agent`) into the
+lockdown allow-list; the preset must mount them. Launches then render as
+first-class work items (description, background flag, durable child id),
+settlement notices appear as status rows, an "Агенты" header drawer lists the
+chat's subagents with live status, and any subagent opens as a read-only
+live transcript (composer disabled, one click back to the chat) - viewing
+never attests or writes.
+
+`ui.showSessionList: true` renders a minimal chat-history sidebar beside the
+conversation. It lists only the chats this browser has actually used: the
+client keeps a per-browser id index under
+`<storageKey>:v1:<route>:chats` in localStorage (capped at 50, most recently
+used first) and intersects it with the Host session list, so users sharing the
+deployment never see each other's chats. Switching re-runs the full policy
+attestation; a chat the Host no longer lists is pruned from the index. Each
+row carries a two-click delete control that removes the chat from this
+browser's index; deleting the chat that is currently open continues in a
+fresh attested session. Host-side sessions are not deleted — DSH 0.1.x
+exposes no session-deletion seam. The sidebar hides below 600px viewports.
+
+Locked mode requires a deployment permission preset named `qa-read-only`.
+Extend the existing `@deepseek-ai/dsh-permission-presets` row without changing
+its process-wide default:
+
+```yaml
+- id: permission
+  name: "@deepseek-ai/dsh-permission-presets"
+  config:
+    presets:
+      read-only:
+        sandbox: read-only
+        approval: ask
+      workspace-write:
+        sandbox: workspace-write
+        approval: ask
+      danger-full-access:
+        sandbox: danger-full-access
+        approval: never
+      qa-read-only:
+        sandbox: read-only
+        approval: never
+        name: QA Read Only
+        description: No filesystem mutations and no permission escalation.
+```
+
+The shipped tool allow-list is empty. Add only reviewed read-only tool names
+from the actual deployment. A name that is not registered fails closed. The
+Host restriction retains exact allow-listed tools from the agent preset's
+ancestor scope, and the additional execution guard also denies session-scoped
+tools and `run_code` unless their exact names are allowed.
 
 ## Security and deployment
 
@@ -115,12 +223,52 @@ inspection.
 with the same deployment authentication and DSH browser trust policy as the
 operator UI. The plugin never auto-approves a permission request or answers an
 interactive agent question. Configure a least-privilege, non-interactive agent
-preset for end-user deployments.
+preset for end-user deployments. On a shared Host, a user who can open `/`,
+call the normal DSH APIs, or use another authenticated client can bypass the
+QA presentation. Use a dedicated DSH process/identity and network boundary
+when `/qa` must be a strong security boundary.
 
 The `embedding.frameAncestors` field is reserved deployment metadata in 0.1.x;
 the plugin does not mutate CSP headers. Configure `frame-ancestors` at the
 trusted reverse proxy if iframe embedding is required.
 
+### Serving the QA rig over the LAN
+
+The plugin itself needs no changes to be reachable from other machines; the
+web server's bind address is a deployment composition decision. DSH refuses
+`dsh --host 0.0.0.0` on the command line on purpose, so network exposure is
+expressed with the shipped patch overlay instead:
+
+```bash
+pnpm dsh --profile qa-surface --no-open --port 3082 \
+  --patch plugins/dsh-qa-surface/deploy/qa-lan.patch.yml
+```
+
+The overlay sets the `webserver` row to `0.0.0.0` while keeping the `--port`
+flag working. On an all-interfaces bind DSH derives trusted `/api` authorities
+from the machine's LAN IPv4 addresses, so `http://<lan-ip>:3082/qa` works
+without extra configuration; users reaching a DNS name instead of an IP
+literal need `--trusted-host <name>` on the same command line.
+
+LAN browsers cannot read the DSH settings namespace (settings RPCs are pinned
+to loopback by the gateway). The plugin covers this itself: a browser that
+sees the namespace as unavailable reads the effective configuration through
+the `qaSurface/describe` Host Remote, so branding, session pinning and
+lockdown UI switches keep working over the LAN. Host-side enforcement was
+never dependent on that read path.
+
+What a LAN deployment does not change:
+
+- DSH has no authentication or TLS on this port; anyone who can reach it can
+  drive the harness, and the full operator UI at `/` stays reachable next to
+  `/qa`. Scope the port's reachability (subnet-limited firewall rule, VPN or
+  tailnet, authenticating reverse proxy) and use a dedicated process identity.
+- Loopback-only settings, directory picking and credential RPCs stay refused
+  for LAN clients; the first-load welcome notice re-appears on reload because
+  remote browsers have no settings persistence.
+
+See [Configuration](docs/CONFIGURATION.md) for the config-channel details.
+
 See [Architecture](docs/ARCHITECTURE.md),
 [Configuration](docs/CONFIGURATION.md), and
 [Compatibility](docs/COMPATIBILITY.md).