@yadsh/dsh-qa-surface 0.1.1 → 0.3.0

package/CHANGELOG.md

@@ -1,3 +1,119 @@
+## 0.3.0 (2026-09-12)
+
+### 🚀 Features
+
+- Optional QA accounts and entry routing. `accounts.enabled` mounts a ([dc2f582](https://github.com/xarleyn/dsh-plugins/commit/dc2f582))
+  full-frame login/registration gate (email + password, coarse audience-safe
+  refusals, per-store rate limiting, self-registration toggle) backed by
+  `$DSH_HOME/qa-accounts.json`: scrypt password hashes, a persisted HMAC secret
+  for stateful-expiry account tokens, and a session ownership map. Ownership is
+  first come, first served - attesting or bulk-claiming an unowned session binds
+  it to the caller (the migration path for existing per-browser chats on first
+  login); sessions owned by another user refuse attestation with
+  `session-owned-elsewhere` and stay hidden from the sidebar, admins are not
+  refused. The identity rides as an explicit token argument into the gated
+  `qaSurface` remotes (the typert carrier never exposes HTTP requests), the
+  policy admission checks it before any session fact is revealed
+  (`auth-required` reopens the gate on expiry), and the account chip with
+  logout lives in the sidebar footer. `entry.redirectNonLoopback` injects a
+  guarded head script through the `webserver/index-inject` event that continues
+  non-loopback hostnames into the QA route - the navigation-marker hand-off is
+  never redirected (no loops), `/?ui=admin` persists an operator bypass and
+  `/?ui=qa` clears it. Accounts are an identity layer for the QA surface, not a
+  harness boundary: QA users still hold the shared host launch-token cookie.
+
+  Follow-ups adopted from a review of the independent dsh-auth-gate plugin: a
+  proxy-side deny list for the privileged config-plane RPC methods behind the
+  deploy proxy's Host/Origin rewrite, a plugin-side launch-token bridge
+  (`entry.cookieBootstrap`) that performs the one-time host-cookie exchange on
+  the `/qa` route itself, a `qa-accounts` bin CLI (list/add/set-role/disable/
+  enable/revoke) so account administration never requires hand-editing the
+  JSON file, and per-account state — a `disabled` flag refusing logins with
+  `account-disabled` plus a `tokenVersion` burned into tokens that
+  `disable`/`revoke` bump, making logout and lockout server-side facts.
+
+  Admins get cross-user views over the same ownership map:
+  `qaSurface/accountsListOwnership` (admin-only, `admin-required` refusal
+  otherwise) returns every chat with its owner's resolved display name, the
+  admin sidebar switches to per-owner sections ordered by their freshest chat
+  (unclaimed chats trail under "Без владельца"), and user messages in foreign
+  chats carry an `author` byline naming the chat owner. Ordinary accounts and
+  deployments with accounts disabled keep the flat sidebar and unlabeled
+  messages.
+
+- The chat-history sidebar gained a footer version button that opens an ([d9d5868](https://github.com/xarleyn/dsh-plugins/commit/d9d5868))
+  end-user changelog dialog: a curated per-version summary (new features and
+  fixes in Russian) rendered in a themed modal with Escape/backdrop close.
+  The bundled version and entries are pinned to package.json and the release
+  CHANGELOG by a unit test, so a release cannot ship a stale dialog.
+
+- Rebuild the client on the 0.1.5 surfaces: the transcript projects from the ([458b9c2](https://github.com/xarleyn/dsh-plugins/commit/458b9c2))
+  ui-chat conversation view's legacy slice, chat/model pinning moves to the
+  wire remotes (`agentPresets.select` on the still-blank session, then
+  `session.selectModel`) with the attestation ordering preserved, and
+  history reads go through the session-v3 surface. The supported host range
+  moves to `>=0.1.5-rc.2 <0.2.0`, dropping 0.1.1-rc.2.
+
+- Harden the gated QA experience and make cross-user history explicitly ([2ed2024](https://github.com/xarleyn/dsh-plugins/commit/2ed2024))
+  opt-in. A new `accounts.showOtherUsersChats` setting defaults to `false`, so
+  administrators only see their own chats unless the deployment enables the
+  shared ownership view. Account storage now follows external CLI updates and
+  uses process-scoped temporary writes, while session admission and client state
+  handling avoid stale async results and reset session-bound assets reliably.
+
+  The QA client now presents a dedicated test-interface disclosure, improves
+  chat search and owner matching, keeps row actions from disturbing result
+  layout, distinguishes administrator roles, and removes decorative middle-dot
+  separators from the sidebar, messages, and source details. Its curated 0.3.0
+  history entry is prepared in advance, while the current-version marker is
+  injected from package.json at build time so the release bump promotes it
+  without another source edit.
+
+### ❤️ Thank You
+
+- xarleyn @xarleyn
+
+## 0.2.0 (2026-09-10)
+
+- Added DSH-style symmetric transcript/composer width handles with adaptive
+  defaults, viewport clamping, and per-route browser persistence.
+- Added Host-owned structured source provenance for parent and delegated turns,
+  replayable `qa/sources` snapshots, dedupe/ranking, opaque-provider reporting,
+  grouped source UI, and safe rendered/raw file previews.
+- Updated packed Host/browser smoke coverage for browser authentication,
+  revisioned client batches, scoped Remote injection, and current Typert RPC
+  envelopes.
+
+### 🚀 Features
+
+- Make the QA surface a complete end-user assistant shell: image attachments ([b9af082](https://github.com/xarleyn/dsh-plugins/commit/b9af082))
+  (drag & drop, paste, and a picker with removable previews; base64 prompt
+  parts the Host promotes to durable attachments, rendered back as clickable
+  thumbnails), subagent delegation presentation (launch work items with the
+  durable child id, settlement notices collapsed into titled expandable rows,
+  an agents panel listing the chat's subagents, and live read-only subagent
+  transcripts with a one-click return), source cards with a full-output detail
+  pane, clickable links and an open action, answer regeneration with
+  ChatGPT-style variant switching, message ratings with hover response
+  metadata (duration, TTFT, tokens per second), a data-usage disclaimer
+  plate under the composer, per-browser chat history
+  ordered by host updates with search and a collapsible sidebar, lazy draft
+  chats that create nothing until the first prompt, directory/workspace
+  pinning with a dedicated `workspace-unavailable` refusal, the company
+  interaction palette as `--dsh-qa-*` tokens, and a split of the surface into
+  focused drawer, switcher, and formatting modules.
+
+### 🩹 Fixes
+
+- Pack the generated Typert host and remote-client entrypoints: the `files` ([0059cb4](https://github.com/xarleyn/dsh-plugins/commit/0059cb4))
+  allowlist only kept declarations under `lib/types/`, so the `./remote` and
+  `./typert` exports previously shipped without their implementation modules
+  and type definitions.
+
+### ❤️ Thank You
+
+- xarleyn @xarleyn
+
 ## 0.1.1 (2026-09-06)
 
 ### 🩹 Fixes
@@ -23,3 +139,38 @@
 - Added Host settings registration and safety filtering for internal events.
 - Added a narrow Host navigation redirect for DSH releases whose static
   frontend returns 404 for direct `/qa` requests.
+- Added fail-closed Host policy attestation, the `qa-read-only` permission pin,
+  an inherited-tool allow-list, and a monotonic execution guard.
+- Disabled session reset by default and added capability-regression gates.
+- Refined the QA surface with first-party-style conversation chrome, plain
+  assistant flow, user bubbles, copy actions and a floating two-row composer.
+- Added opt-in reasoning and tool-call details grouped into a live turn work
+  disclosure that collapses to a `Worked for …` summary before the final answer.
+- Added an optional minimal chat-history sidebar (`ui.showSessionList`) with a
+  per-browser localStorage chat index, attested switching and a gated
+  New chat control.
+- Send-time policy attestation now survives a Host that idled the session's
+  agent out: the client re-binds the session (re-materializing the agent) and,
+  when the refused session is still blank, continues in a fresh attested
+  session instead of surfacing an error.
+- Added GFM table, ordered-list and horizontal-rule rendering to the safe
+  Markdown output.
+- Added a two-click chat delete control to the chat-history sidebar; it
+  removes the chat from the per-browser index only (DSH has no
+  session-deletion seam).
+- Added attestation diagnostics: the Host folds a coarse reason code into the
+  refusal and the browser console prints one operator hint instead of a
+  duplicate stack trace.
+- Fixed repeated policy attestation for tools contributed by an agent preset:
+  the applied restriction now retains the exact scoped allow-list instead of
+  accidentally reducing it to global-only tools. Removed the redundant native
+  presentation override so reloads cannot collide with the preset's mode.
+- The browser re-reads the Host configuration when the connection is restored,
+  so an open page survives a Host restart with a changed deployment config.
+- Added LAN serving support: a shipped `deploy/qa-lan.patch.yml` webserver
+  overlay, and a `qaSurface/describe` Host Remote the browser falls back to
+  when the loopback-pinned settings namespace is unavailable, so branding,
+  session pinning and lockdown UI switches keep working over the network.
+- Localized the end-user chat interface into Russian, added rotating playful
+  thinking phrases, and moved the default quick-question chips next to the
+  composer on an empty chat.

package/README.md

@@ -11,8 +11,21 @@ Session and Agent Loop.
 - stays invisible outside the configured route;
 - creates or restores one real DSH Session;
 - renders only user text, assistant-visible text and safe status messages;
-- supports streaming, Stop, New chat, safe Markdown and mobile layouts;
+- supports streaming, Stop, optional New chat, safe Markdown, copy actions and
+  a responsive first-party-style conversation layout;
+- optionally shows a minimal per-browser chat-history sidebar
+  (`ui.showSessionList`) whose switching re-runs policy attestation;
 - blocks unsupported approvals/questions instead of auto-approving them;
+- pins locked sessions to `read-only` + `approval=never` before Send is enabled;
+- applies a Host-side tool allow-list plus a monotonic execution guard;
+- optionally gates the surface behind email + password accounts
+  (`accounts.enabled`) with server-side session ownership, a first-login
+  migration of the browser's existing chats, a `qa-accounts` management CLI
+  (list/add/set-role/disable/revoke), and a coarse honest boundary:
+  accounts identify QA users, they do not fence the harness root;
+- optionally redirects non-loopback hostnames from the harness root into the
+  QA route (`entry.redirectNonLoopback`), keeping the operator's localhost
+  harness UI untouched;
 - uses the existing same-origin DSH connection and trust boundary.
 
 It does not add another HTTP server, provider proxy, permissive CORS rule, or
@@ -38,8 +51,8 @@ Some DSH patch operations replace a row's complete `config` instead of deeply
 merging it. When editing an existing row, provide every value that deployment
 needs.
 
-DSH `0.1.1-rc.2` serves unknown frontend paths as 404 rather than falling back
-to `index.html`. The Host half therefore claims only the configured QA
+Tested DSH releases serve unknown frontend paths as 404 rather than falling
+back to `index.html`. The Host half therefore claims only the configured QA
 navigation path and redirects it through the canonical `/` document with a
 short-lived query marker. The browser restores the requested `/qa` URL with
 `history.replaceState` before mounting the overlay. No second server, duplicate
@@ -58,14 +71,17 @@ config:
     path: /qa
     matchChildren: true
   branding:
-    title: Internal Assistant
-    subtitle: Answers about the internal platform
-    welcomeMessage: How can I help?
-    placeholder: Ask a question...
+    title: Внутренний помощник
+    subtitle: Отвечает на вопросы о внутренней платформе
+    welcomeMessage: Чем могу помочь?
+    placeholder: Задайте вопрос…
     logoUrl: null
   session:
+    # Pin every chat to a directory (optional, one of):
+    # cwd: "D:/qa-docs"        # direct absolute directory pin
+    # workspaceId: "<uuid>"    # or a registered DSH workspace
     policy: browser-persistent
-    storageKey: dsh-qa-surface
+    storageKey: dsh-qa-surface.session
     workspaceId: company-knowledge
     fixedSessionId: null
     agentPreset: qa-assistant
@@ -74,19 +90,75 @@ config:
     reasoningEffort: null
   ui:
     showHeader: true
-    showReset: true
+    showReset: false
     showStop: true
     showTimestamps: false
     showToolActivity: false
     showReasoning: false
     renderMarkdown: true
     maxContentWidth: 900
+    showSessionList: false
+  accounts:
+    enabled: false
+    allowRegistration: true
+    sessionTtlDays: 30
+    showOtherUsersChats: false
   suggestedQuestions:
-    - How do I request access?
-    - Where is the runbook?
+    - Как запросить доступ?
+    - Где лежит инструкция?
   interaction:
     approvals: blocked
     questions: unsupported
+  lockdown:
+    enabled: true
+    enforceFixedAgentPreset: true
+    enforceFixedWorkspace: true
+    enforceFixedModel: true
+    sandboxMode: read-only
+    approvalPolicy: never
+    permissionPreset: qa-read-only
+    allowPermissionChanges: false
+    allowSlashCommands: false
+    allowSettingsMutation: false
+    allowSessionReset: false
+    allowSessionRename: false
+    allowSessionDelete: false
+    allowArbitrarySessionOpen: false
+    toolPolicy:
+      mode: allow-list
+      allow: []
+  sources:
+    enabled: true
+    collect:
+      parentAgent: true
+      subagents: true
+      persistTurnEvent: true
+    display:
+      sidebar: true
+      footer: true
+      groupByKind: true
+      showDiscovered: false
+      showOriginBadges: false
+      maxInitiallyVisiblePerGroup: 8
+    webSearch:
+      promoteSearchResultsWithoutFetch: true
+      maxPromotedPerSearch: 5
+    dedupe:
+      normalizeUrls: true
+      stripTrackingParams: true
+      mergeFileRanges: true
+    filePreview:
+      enabled: true
+      markdownRenderedByDefault: true
+      allowRawToggle: true
+      maxBytes: 2000000
+      maxMarkdownRenderBytes: 1000000
+    subagents:
+      inheritSources: true
+      enableReportToolFallback: true
+      markIncompleteOpaqueRuns: true
+    legacy:
+      parseAssistantSourcesBlock: false
 ```
 
 `workspaceId` is recommended for a deterministic assistant. Without it, DSH
@@ -95,8 +167,12 @@ skills, knowledge connections and permission policy in `agentPreset`, not in
 this UI plugin.
 
 Model override is opt-in: `provider` and `model` must be set together. Slash
-commands are rejected as plain QA input in this MVP. `showReasoning: true` is
-also rejected; raw reasoning is intentionally outside the safe MVP surface.
+commands are rejected as plain QA input. Reasoning and tool details remain
+hidden by default. Enabling `ui.showReasoning` and `ui.showToolActivity` adds a
+turn-scoped work disclosure: it stays open while the assistant is working,
+then collapses to `Worked for ...` before the final answer. Tool capability is
+still controlled exclusively by `lockdown.toolPolicy.allow`; the display flags
+do not grant tools.
 
 Session policies:
 
@@ -106,8 +182,113 @@ Session policies:
 - `fixed` requires `fixedSessionId`, never creates a replacement, and is meant
   only for controlled single-user deployments.
 
-New chat creates another DSH Session and leaves the old one intact for operator
-inspection.
+New chat is disabled by default. To expose it, set `lockdown.allowSessionReset:
+true` plus either `ui.showReset: true` (header button) or `ui.showSessionList:
+true` (sidebar button). Pressing it opens a draft composer and creates nothing:
+the DSH Session is materialized lazily by the first prompt, so the chat list
+stays quiet until a message is actually sent, and the old session stays intact
+for operator inspection. The sidebar orders chats by the host's last update,
+so merely opening a chat never moves it.
+
+Regeneration: the last committed answer offers a retry action. The session log
+is append-only, so "regenerate" sends a hidden instruction as an ordinary
+prompt and the answer arrives as a follow-up turn; the projection hides that
+instruction and the consecutive turns read as variants of one question,
+navigable with a `< 2/2 >` switcher (newest shown by default).
+
+Sources are structured Host-owned provenance, independent of
+`ui.showToolActivity`. Successful reads/fetches, bounded web-search evidence,
+Jira/Confluence/knowledge results, and inherited subagent sources are
+normalized and deduplicated into one turn bundle. That exact bundle feeds the
+answer footer and grouped drawer and is persisted as `qa/sources`, so reload
+does not rerun tools. Search-only discovery stays hidden by default.
+
+Local file cards open a source-scoped, read-only preview after Host-side real
+path validation against the attested session root. Markdown opens rendered by
+default with an HTML-free renderer and offers `Rendered / Raw`; raw mode jumps
+to recorded line ranges. The endpoint cannot browse or write files and refuses
+paths that are not evidence in the canonical bundle.
+
+Observable local subagents are inherited recursively. The internal
+`qa_report_sources` tool covers opaque delegated providers and is admitted as
+a provenance-only capability even when it is not listed among ordinary QA
+tools. A provider that neither exposes events nor reports sources marks the
+turn provenance incomplete. The QA prompt tells models not to append a manual
+`Sources`/`Источники` bibliography.
+
+Images: the composer accepts PNG/JPEG/WebP/GIF via drag & drop onto the
+composer, paste, and the picker button, several at once (soft client caps:
+8 images, 15 MB each). Images ride the prompt as base64 uploads the Host
+promotes to durable attachments, so they survive reloads; sent images
+render as clickable thumbnails on the message. Whether the model can see
+them depends on the deployment's model (vision).
+
+Subagents: the deployment may opt the delegation family (`subagent`,
+`subagent_fork`, `send_message`, `list_agents`, `interrupt_agent`) into the
+lockdown allow-list; the preset must mount them. Launches then render as
+first-class work items (description, background flag, durable child id),
+settlement notices appear as status rows, an "Агенты" header drawer lists the
+chat's subagents with live status, and any subagent opens as a read-only
+live transcript (composer disabled, one click back to the chat) - viewing
+never attests or writes.
+
+`ui.showSessionList: true` renders a minimal chat-history sidebar beside the
+conversation. By default it lists only the current user's chats: the
+client keeps a per-browser id index under
+`<storageKey>:v1:<route>:chats` in localStorage (capped at 50, most recently
+used first) and intersects it with the Host session list, so users sharing the
+deployment never see each other's chats. An admin can explicitly enable
+`accounts.showOtherUsersChats: true` to add chats owned by other QA accounts,
+grouped by owner. Switching re-runs the full policy
+attestation; a chat the Host no longer lists is pruned from the index. Each
+row carries a two-click delete control that removes the chat from this
+browser's index; deleting the chat that is currently open continues in a
+fresh attested session. Host-side sessions are not deleted — DSH 0.1.x
+exposes no session-deletion seam. The sidebar hides below 600px viewports.
+
+The sidebar footer shows the deployed plugin version. Clicking it opens a
+changelog dialog with a curated per-version summary (features and fixes);
+Escape or a backdrop click closes it.
+
+On `/qa`, the plugin shadows DSH's stock `welcome-notice` onboarding entry and
+renders a route-owned Russian testing disclosure. Keeping the visible dialog
+in the QA overlay prevents DSH's blank-session onboarding lifecycle from
+dismissing it when a question is submitted. It explains the DeepSeek Harness
+preview foundation, QA review of questions and answers, the work-related
+scope, and local in-contour model processing. Explicit acknowledgement is
+stored as a versioned browser-local flag; changing the disclosure version
+shows it again. Other DSH routes retain the stock onboarding entry.
+
+Locked mode requires a deployment permission preset named `qa-read-only`.
+Extend the existing `@deepseek-ai/dsh-permission-presets` row without changing
+its process-wide default:
+
+```yaml
+- id: permission
+  name: "@deepseek-ai/dsh-permission-presets"
+  config:
+    presets:
+      read-only:
+        sandbox: read-only
+        approval: ask
+      workspace-write:
+        sandbox: workspace-write
+        approval: ask
+      danger-full-access:
+        sandbox: danger-full-access
+        approval: never
+      qa-read-only:
+        sandbox: read-only
+        approval: never
+        name: QA Read Only
+        description: No filesystem mutations and no permission escalation.
+```
+
+The shipped tool allow-list is empty. Add only reviewed read-only tool names
+from the actual deployment. A name that is not registered fails closed. The
+Host restriction retains exact allow-listed tools from the agent preset's
+ancestor scope, and the additional execution guard also denies session-scoped
+tools and `run_code` unless their exact names are allowed.
 
 ## Security and deployment
 
@@ -115,12 +296,54 @@ inspection.
 with the same deployment authentication and DSH browser trust policy as the
 operator UI. The plugin never auto-approves a permission request or answers an
 interactive agent question. Configure a least-privilege, non-interactive agent
-preset for end-user deployments.
+preset for end-user deployments. On a shared Host, a user who can open `/`,
+call the normal DSH APIs, or use another authenticated client can bypass the
+QA presentation. Use a dedicated DSH process/identity and network boundary
+when `/qa` must be a strong security boundary.
 
 The `embedding.frameAncestors` field is reserved deployment metadata in 0.1.x;
 the plugin does not mutate CSP headers. Configure `frame-ancestors` at the
 trusted reverse proxy if iframe embedding is required.
 
+### Serving the QA rig over the LAN
+
+The plugin itself needs no changes to be reachable from other machines; the
+web server's bind address is a deployment composition decision. DSH refuses
+`dsh --host 0.0.0.0` on the command line on purpose, so network exposure is
+expressed with the shipped patch overlay instead:
+
+```bash
+pnpm dsh --profile qa-surface --no-open --port 3082 \
+  --patch plugins/dsh-qa-surface/deploy/qa-lan.patch.yml
+```
+
+The overlay sets the `webserver` row to `0.0.0.0` while keeping the `--port`
+flag working. On an all-interfaces bind DSH derives trusted `/api` authorities
+from the machine's LAN IPv4 addresses, so `http://<lan-ip>:3082/qa` works
+without extra configuration; users reaching a DNS name instead of an IP
+literal need `--trusted-host <name>` on the same command line.
+
+LAN browsers cannot read the DSH settings namespace (settings RPCs are pinned
+to loopback by the gateway). The plugin covers this itself: a browser that
+sees the namespace as unavailable reads the effective configuration through
+the `qaSurface/describe` Host Remote, so branding, session pinning and
+lockdown UI switches keep working over the LAN. Host-side enforcement was
+never dependent on that read path.
+
+What a LAN deployment does not change:
+
+- DSH has no authentication or TLS on this port; anyone who can reach it can
+  drive the harness, and the full operator UI at `/` stays reachable next to
+  `/qa`. Scope the port's reachability (subnet-limited firewall rule, VPN or
+  tailnet, authenticating reverse proxy) and use a dedicated process identity.
+- Loopback-only settings, directory picking and credential RPCs stay refused
+  for LAN clients. On `/qa`, the plugin replaces DSH's non-persistent welcome
+  step with a QA-specific testing disclosure and remembers its exact copy
+  version in that browser's local storage. The stock DSH notice remains
+  unchanged on operator routes.
+
+See [Configuration](docs/CONFIGURATION.md) for the config-channel details.
+
 See [Architecture](docs/ARCHITECTURE.md),
 [Configuration](docs/CONFIGURATION.md), and
 [Compatibility](docs/COMPATIBILITY.md).