@yadsh/dsh-qa-surface 0.18.0 → 0.19.0

package/lib/types/attachment-access.d.ts

@@ -0,0 +1,29 @@
+import type { Context } from "@deepseek-ai/cordis";
+interface SessionSource {
+    readonly id: unknown;
+    snapshotEvents?(): readonly unknown[];
+}
+export interface QaAttachmentRecovery {
+    readonly readEvents?: (sessionId: string) => Promise<readonly unknown[]>;
+    readonly restoreFiles?: (sessionId: string) => Promise<void>;
+}
+/** Exact attachment capabilities, owned by one admitted conversation. */
+export declare class QaAttachmentAccess {
+    private readonly ctx;
+    private readonly recovery;
+    private readonly bindings;
+    constructor(ctx: Context, recovery?: QaAttachmentRecovery);
+    root(): string | undefined;
+    admit(session: SessionSource): Promise<void>;
+    inherit(session: SessionSource, parentId: string): void;
+    /** Only Host-admitted file blocks are authority; text and tool output are not. */
+    observe(sessionId: string, events: readonly unknown[]): void;
+    /** Called only after a durable form's bytes and session ownership are verified. */
+    grantFile(sessionId: string, file: string): void;
+    files(sessionId: string): readonly string[];
+    private publish;
+    revoke(sessionId: string): void;
+    dispose(): void;
+}
+export {};
+//# sourceMappingURL=attachment-access.d.ts.map

package/lib/types/chat-sharing/search.d.ts

@@ -0,0 +1,5 @@
+import type { Context } from "@deepseek-ai/cordis";
+import type { SessionSearchValue } from "@deepseek-ai/dsh-api-session-controller/types";
+/** Apply account scope before the provider's ranking/limit, then recheck each read. */
+export declare function searchQaChats(ctx: Context, query: string, visible: () => Promise<ReadonlySet<string>>, signal: AbortSignal): Promise<SessionSearchValue>;
+//# sourceMappingURL=search.d.ts.map

package/lib/types/client/QaSessionController.d.ts

@@ -54,13 +54,13 @@ export interface QaSessionControllerOptions {
      */
     readonly slashApi?: QaSlashApi;
     /**
-     * The Host's live read of the request ceiling. Absent on a Host build that
-     * predates it — and unanswered, or answered by a deployment that sets no
-     * ceiling — the surface sends the way it always did: the ceiling is an
-     * arrangement between browsers about how much this stand can take, never a
-     * reason a question cannot be asked.
+     * Global admission snapshot. Managed queues accept sends even while full;
+     * legacy Hosts retain the courtesy refusal. A failed read still submits the
+     * prompt through the server's own admission boundary.
      */
     readonly queueStatus?: QaQueueStatusRemote;
+    /** Authorized per-chat queue status, polled while the Host driver is live. */
+    readonly requestStatus?: QaQueueStatusRemote;
     readonly storage?: StorageLike;
     /**
      * Browser file-upload service, resolved lazily: the page may not serve the
@@ -187,6 +187,10 @@ export declare class QaSessionController {
     /** Host-side question requests of the bound chat waiting for the operator. */
     private readonly hostQuestions;
     private readonly queueRemote;
+    private readonly requestRemote;
+    private requestWaitStatus;
+    private requestReadRevision;
+    private requestReading;
     /** Last send the stand had no room for; drives the request-ceiling dialog. */
     private requestQueueNotice;
     /** Set while a running turn is polled for parked requests. */
@@ -244,12 +248,11 @@ export declare class QaSessionController {
     /**
      * What the stand answers about its load, or null when it does not answer.
      *
-     * Every failure here sends the question anyway. The ceiling exists to keep a
-     * weak model from drowning, not to be a door a browser cannot open: an
-     * unreadable count says nothing about the load, and refusing a visitor on
-     * that would be a worse answer than the one they would have got.
+     * A failed status read does not bypass the server queue. Submit normally;
+     * the Host owns admission even when the browser cannot read its load.
      */
     private readQueueStatus;
+    private refreshRequestStatus;
     /**
      * Close the request-ceiling dialog. Nothing is retried and nothing is
      * dropped: the held-back question is still the composer's own text, so asking

package/lib/types/client/components/QaRequestWait.d.ts

@@ -0,0 +1,6 @@
+import type { QaQueueStatus } from "../../types.js";
+/** A queued turn belongs to the Host and starts without resending the question. */
+export declare function QaRequestWait({ status, }: {
+    readonly status: QaQueueStatus | null;
+}): import("react/jsx-runtime").JSX.Element | null;
+//# sourceMappingURL=QaRequestWait.d.ts.map

package/lib/types/client/project-session-state.d.ts

@@ -40,10 +40,8 @@ export interface QaBoundProjectionInput {
     readonly questions: readonly QaPendingQuestion[];
     readonly operationError: string | null;
     /**
-     * A send the stand had no room for. The dialog is the whole of what the
-     * visitor learns: the question never reached the Host, so the transcript has
-     * no row to carry the refusal on. Distinct from `queue`, the waiting rows of
-     * this chat.
+     * Server admission status for this waiting chat, or a legacy Host's
+     * pre-send refusal. Distinct from `queue`, the next messages of this chat.
      */
     readonly requestQueue: QaQueueStatus | null;
     readonly policyReady: boolean;

package/lib/types/client/request-wait-styles.d.ts

@@ -0,0 +1,2 @@
+export declare const requestWaitStyles = "\n.dsh-qa-request-wait{display:flex;align-items:center;gap:8px;align-self:flex-start;width:fit-content;max-width:100%;box-sizing:border-box;margin:0 0 10px;padding:6px 12px;border:1px solid var(--dsw-alias-border-l2);border-radius:8px;background:var(--dsw-alias-bg-layer-2);color:var(--dsw-alias-label-secondary);font-size:13px;line-height:1.45;overflow-wrap:anywhere}\n.dsh-qa-request-wait__spinner{width:12px;height:12px;flex:none;border:1.5px solid var(--dsw-alias-border-l2);border-top-color:var(--dsw-alias-label-secondary);border-radius:50%;animation:dsh-qa-request-spin 1s linear infinite}\n@keyframes dsh-qa-request-spin{to{transform:rotate(360deg)}}\n@media(prefers-reduced-motion:reduce){.dsh-qa-request-wait__spinner{animation:none}}\n";
+//# sourceMappingURL=request-wait-styles.d.ts.map

package/lib/types/client/types.d.ts

@@ -37,10 +37,10 @@ export type QaCreateSession = (token: string, subroleId: string | null, adminPre
 export type QaForkSession = (token: string, sourceId: string, answerSeq: number) => Promise<RemoteResult<string>>;
 /**
  * The Host's live read of the request ceiling (`qaSurface/queueStatus`), asked
- * per send: how many questions the stand is answering and whether one more
- * fits.
+ * per send and for the current waiting chat. Supplying a session id requires
+ * current account read access; global reads expose counts only.
  */
-export type QaQueueStatusRemote = () => Promise<RemoteResult<QaQueueStatus>>;
+export type QaQueueStatusRemote = (token?: string, sessionId?: string) => Promise<RemoteResult<QaQueueStatus>>;
 /** Role selector plus administrator mutation channel. */
 export interface QaAccessApi {
     current(token: string): Promise<RemoteResult<QaCurrentAccess>>;

package/lib/types/filesystem-intent.d.ts

@@ -0,0 +1,12 @@
+/** The Host tool contract, normalized once for path and storage policy. */
+export type QaFilesystemIntent = {
+    readonly kind: "read";
+    readonly path: string;
+    readonly fileOnlyGrant: boolean;
+} | {
+    readonly kind: "write";
+    readonly path: string;
+    readonly bytes: number;
+};
+export declare function qaFilesystemIntent(name: string, args: Record<string, unknown> | undefined): QaFilesystemIntent | undefined;
+//# sourceMappingURL=filesystem-intent.d.ts.map

package/lib/types/forms/attachments.d.ts

@@ -27,7 +27,8 @@ export declare function validateFormFile(name: string, data: Buffer): string;
 export declare class QaFormAttachmentAdapter {
     private readonly service;
     private readonly host;
-    constructor(service: () => QaFormService, host: () => QaFormHostAttachments | undefined);
+    private readonly grantFile?;
+    constructor(service: () => QaFormService, host: () => QaFormHostAttachments | undefined, grantFile?: ((sessionId: string, file: string) => void) | undefined);
     available(): boolean;
     check(session: string, formId: string, uploadId: string): void;
     claim(session: string, uploadId: string): {
@@ -37,12 +38,14 @@ export declare class QaFormAttachmentAdapter {
     complete(session: string, formId: string, uploadId: string, raw: unknown, signal: AbortSignal, authorize: () => void): Promise<QaFormRecord>;
     fail(session: string, formId: string, uploadId: string): void;
     /** Exact saved bytes are re-projected through the Host on each successful resume. */
-    readable(submission: QaFormSubmission): Promise<QaFormSubmission & {
+    readable(submission: QaFormSubmission, sessionId?: string): Promise<QaFormSubmission & {
         resources: {
             resource_id: string;
             read_path: string;
         }[];
     }>;
+    /** Rebuild exact grants from this chat's persisted, verified submissions. */
+    restore(sessionId: string): Promise<void>;
 }
 export {};
 //# sourceMappingURL=attachments.d.ts.map

package/lib/types/index.d.ts

@@ -79,6 +79,7 @@ export declare class QaSurface extends TypertRemoteService {
     private chatSharingStore;
     private readonly chatTransport;
     private readonly chatTurnGuard;
+    private readonly requestScheduler;
     private sharing;
     constructor(ctx: Context, entry?: Partial<QaSurfaceConfigRefs>);
     /** The quality store, opening its file the first time anyone needs it. */
@@ -237,19 +238,11 @@ export declare class QaSurface extends TypertRemoteService {
      */
     describe(): ResolvedQaSurfaceConfig;
     /**
-     * Report how much of the deployment's request ceiling the stand is using, so
-     * a browser holds its question back instead of opening another turn on a
-     * model that is busy answering the ones it allows.
-     *
-     * The count is the Host's, not the browser's: a visitor cannot see another
-     * account's chats, and the HTTP API's questions are invisible to every chat
-     * view. Read-only, and a ceiling rather than a lock — a prompt rides the
-     * native session RPC this plugin does not own, so the boundary is the
-     * browser's own courtesy, and two questions sent in the same instant can
-     * still overshoot by one. What the ceiling buys is that steady state, not a
-     * strict bound.
-     */
-    queueStatus(): QaQueueStatus;
+     * Report server admission. Global reads expose counts only; a chat's FIFO
+     * position requires that account's current read access to the chat. The
+     * scheduler gates every root turn, including native and integration sends.
+     */
+    queueStatus(token?: string, sessionId?: string): QaQueueStatus;
     /**
      * Create a QA session from Host-owned inputs. With account workspaces on,
      * cwd is `<configured workspace>/.qa-users/<account UUID>` and the child is

package/lib/types/qa-tools/catalog.d.ts

@@ -13,7 +13,7 @@ export declare const QA_TOOL_CATALOG_VERSION = "4";
 /** What the catalog's definitions read, beyond the execution record. */
 export interface QaToolsSelfcheckDeps {
     readonly forms?: QaFormGate;
-    readonly formProjection?: (submission: import("../forms/types.js").QaFormSubmission) => Promise<unknown>;
+    readonly formProjection?: (submission: import("../forms/types.js").QaFormSubmission, sessionId: string) => Promise<unknown>;
     readonly catalogVersion: string;
     readonly activationMode: string;
     /** Names the catalog contributes, in catalog order. */

package/lib/types/qa-tools/index.d.ts

@@ -5,7 +5,7 @@ import type { QaToolActivation } from "./types.js";
 export interface QaToolsOptions {
     readonly forms?: import("../forms/gate.js").QaFormGate;
     readonly formsEnabled?: () => boolean;
-    readonly formProjection?: (submission: import("../forms/types.js").QaFormSubmission) => Promise<unknown>;
+    readonly formProjection?: (submission: import("../forms/types.js").QaFormSubmission, sessionId: string) => Promise<unknown>;
     readonly logger: PluginLogger;
     readonly dynamicActivation: boolean;
     readonly activationSkill: string;

package/lib/types/qa-tools/request-user-form.d.ts

@@ -1,5 +1,5 @@
 import type { ToolDefinition } from "@deepseek-ai/dsh-tools";
 import type { QaFormGate } from "../forms/gate.js";
 /** Build only; the QA activation manager owns registration and role admission. */
-export declare function createRequestUserFormTool(gate: QaFormGate, project?: (submission: import("../forms/types.js").QaFormSubmission) => Promise<unknown>): ToolDefinition;
+export declare function createRequestUserFormTool(gate: QaFormGate, project?: (submission: import("../forms/types.js").QaFormSubmission, sessionId: string) => Promise<unknown>): ToolDefinition;
 //# sourceMappingURL=request-user-form.d.ts.map

package/lib/types/request-scheduler.d.ts

@@ -0,0 +1,28 @@
+import type { Context } from "@deepseek-ai/cordis";
+import type { Agent } from "@deepseek-ai/dsh-agent";
+import type { QaQueueStatus } from "./types.js";
+/** A FIFO admission lease covers a complete root turn, including its experts. */
+export declare class QaRequestScheduler {
+    private readonly limit;
+    private readonly roots;
+    private readonly now;
+    private readonly familyBusy;
+    private readonly active;
+    private readonly waiting;
+    private readonly completed;
+    private readonly retiring;
+    private closed;
+    constructor(limit: () => number, roots: () => readonly Agent[], now?: () => number, familyBusy?: (agent: Agent) => boolean);
+    install(ctx: Context): () => void;
+    acquire(agent: Agent, signal: AbortSignal): Promise<void>;
+    release(agent: Agent, completed?: boolean): void;
+    private pump;
+    status(sessionId?: string): QaQueueStatus;
+    private estimate;
+    dispose(): void;
+}
+/** Include background descendants whose root has already ended its own turn. */
+export declare function qaRequestFamilyBusy(ctx: Context, root: Agent): boolean;
+/** Older optional compositions may lack the registry, but cannot enforce a cap. */
+export declare function qaRequestRoots(ctx: Context, required: boolean): readonly Agent[];
+//# sourceMappingURL=request-scheduler.d.ts.map

package/lib/types/secure-session.d.ts

@@ -1,5 +1,6 @@
 import type { Agent } from "@deepseek-ai/dsh-agent";
 import type { Context } from "@deepseek-ai/cordis";
+import { type QaAttachmentRecovery } from "./attachment-access.js";
 import type { PluginLogger } from "@yadsh/dsh-plugin-log";
 import { type QaSessionFacts } from "./accounts/store.js";
 import type { QaIntegrationPrincipalBindings } from "./integration-principals.js";
@@ -71,13 +72,10 @@ export declare class QaPolicyAdmission {
      * one set answers for the whole chat.
      */
     private readonly attested;
+    private readonly rejected;
     private readonly questionWarnings;
     private readonly workspaceAccess;
-    /**
-     * Removers of the document input roots granted per session, so a grant lives
-     * exactly as long as the workspace access that justified it.
-     */
-    private readonly documentInputRoots;
+    private readonly attachmentAccess;
     /**
      * Every name reachable anywhere in one QA conversation, keyed by session id.
      *
@@ -116,7 +114,7 @@ export declare class QaPolicyAdmission {
      * deliberately not a delegation); {@link secureSessionForUser} has no token
      * to compare, so it fills it here, against the ownership record it checked.
      */
-    principals?: QaIntegrationPrincipalBindings | undefined);
+    principals?: QaIntegrationPrincipalBindings | undefined, attachmentRecovery?: QaAttachmentRecovery);
     /**
      * Add tools whose own executor resolves the QA principal server-side.
      * Enabling the contributing plugin is the operator decision; model arguments
@@ -130,29 +128,17 @@ export declare class QaPolicyAdmission {
      * newly-created, permanently unusable chat behind.
      */
     preflightDeployment(): void;
+    /** Keep a failed creation fenced even when its Host teardown cannot finish. */
+    rejectSession(sessionId: string): void;
+    /** Called only after failed creation confirms resource and ownership cleanup. */
+    forgetRejectedSession(sessionId: string): void;
     /**
-     * The mounted attachment store's verbatim root, when the backend exposes
-     * one. It sits outside every workspace, so the per-user fence would
-     * otherwise deny the model the exact file an upload produced and the prompt
-     * points it at. A backend without a resolvable root simply keeps the fence
-     * closed — attachments then only work where reads are not fenced per user.
-     * Source preview asks for the same root, so one upload is readable by both.
+     * The backend location used to validate exact file capabilities. The root
+     * itself grants no read access; only this conversation's Host-admitted
+     * user-message references and verified submitted form resources do.
      */
     attachmentRoot(): string | undefined;
-    /**
-     * Carry the fence's attachment exemption into the document pipeline.
-     *
-     * The guard above lets a single-file read reach the mounted store: an upload
-     * is content-addressed, immutable, outside every workspace, and the prompt
-     * hands the model exactly that path. The document pipeline keeps its own
-     * read scope and knew nothing about the store, so `document_*` refused the
-     * very file the model was allowed to read — the panel's own Word preview hit
-     * the same wall. The grant is the missing hand-over, made where the access it
-     * mirrors is made: per admitted session, and revoked with it.
-     */
-    private grantDocumentInputRoots;
-    /** Drop one session's document grant, if the pipeline still holds it. */
-    private revokeDocumentInputRoots;
+    grantAttachmentFile(sessionId: string, file: string): void;
     /**
      * The live agent for one session, resuming a Session the Host has not
      * materialized in this process.

package/lib/types/session-create.d.ts

@@ -0,0 +1,29 @@
+import type { Context } from "@deepseek-ai/cordis";
+import type { PluginLogger } from "@yadsh/dsh-plugin-log";
+import type { QaStoredSessionEraser } from "./admin/session-log.js";
+import type { QaSessionModelPolicy } from "./access/model-policy.js";
+import type { ResolvedQaSurfaceConfig } from "./types.js";
+export interface QaSessionCreateOptions {
+    readonly ctx: Context;
+    readonly config: ResolvedQaSurfaceConfig;
+    readonly logger: PluginLogger;
+    readonly sessionFiles: QaStoredSessionEraser;
+    reserve(id: string): {
+        readonly id: string;
+    } | undefined;
+    release(owner: string, id: string): void;
+    modelPolicy(id: string): QaSessionModelPolicy;
+    preflight(): void;
+    admit(id: string): Promise<unknown>;
+    attest(id: string, owner: string | undefined): void;
+    reject(id: string): void;
+    /** Drop failure-only metadata after resource and ownership cleanup succeeds. */
+    forget(id: string): void;
+}
+/**
+ * Admit inside the native factory's serial publication callback. A failure is
+ * rolled back by the Host's lifecycle owner before we erase this UUID's log;
+ * native preset composition and dynamic default-model hooks stay intact.
+ */
+export declare function createQaSession(options: QaSessionCreateOptions): Promise<string>;
+//# sourceMappingURL=session-create.d.ts.map

package/lib/types/types/session.d.ts

@@ -331,6 +331,14 @@ export interface QaQueueStatus {
     readonly active: number;
     /** Whether one more turn fits; false while no ceiling is set. */
     readonly full: boolean;
+    /** The Host enforces admission and starts queued turns automatically. */
+    readonly managed?: boolean;
+    readonly queued?: number;
+    /** Present only for the authorized chat whose status was requested. */
+    readonly waiting?: boolean;
+    readonly position?: number | null;
+    /** Approximate delay derived from completed turns, or null without a sample. */
+    readonly estimatedWaitMs?: number | null;
 }
 export interface QaSessionState {
     readonly chatAccess?: import("../chat-sharing/types.js").QaChatAccess;

package/lib/types/user-workspace.d.ts

@@ -10,6 +10,8 @@ export interface QaToolExecutionLike {
 export interface QaUserWorkspaceReadPolicy {
     /** Shared directories exposed only to read-only filesystem tools. */
     readonly sharedReadOnlyRoots?: readonly string[];
+    /** Exact canonical files derived from this conversation's trusted references. */
+    readonly attachmentFiles?: readonly string[];
 }
 export declare function pathIsInside(target: string, root: string): boolean;
 /**
@@ -31,12 +33,8 @@ export declare function existingQaUserWorkspace(workspaceRoot: string, userId: s
  * fences model-controlled file paths for both reads and writes, rejects tools
  * whose implementation can walk above cwd, and enforces bounded scratch use.
  *
- * `attachmentRoot` is the one deliberate read exemption: an uploaded file is
- * an immutable content-addressed copy the deployment stores outside every
- * workspace, and the model reaches it exactly as the harness intends (the
- * prompt carries the stored path). Reads of a single such file are allowed;
- * directory-wide tools stay confined because the store is shared by every
- * account, and writes are never exempted.
+ * `attachmentRoot` identifies the storage backend, never authority to read it.
+ * Only regular files in `attachmentFiles` may cross the workspace boundary.
  */
 export declare function qaUserWorkspaceDenial(execution: QaToolExecutionLike, root: string, attachmentRoot?: string, readPolicy?: QaUserWorkspaceReadPolicy): string | undefined;
 //# sourceMappingURL=user-workspace.d.ts.map

package/lib/user-workspace.js

@@ -1,5 +1,6 @@
 import { chmodSync, lstatSync, mkdirSync, readdirSync, realpathSync, statSync, } from "node:fs";
 import path from "node:path";
+import { qaFilesystemIntent } from "./filesystem-intent.js";
 /** Stable, non-workspace child used to keep account directories out of sight. */
 export const QA_USER_WORKSPACES_DIRECTORY = ".qa-users";
 /** Conservative fixed budgets; there is deliberately no browser override. */
@@ -105,49 +106,6 @@ function record(value) {
         ? value
         : undefined;
 }
-function requestedPaths(execution) {
-    const args = record(execution.arguments);
-    if (args === undefined)
-        return [];
-    switch (execution.name) {
-        case "read":
-        case "read_image":
-        case "write":
-        case "edit": {
-            return typeof args.file_path === "string" ? [args.file_path] : [];
-        }
-        case "glob":
-        case "grep": {
-            return [typeof args.path === "string" ? args.path : "."];
-        }
-        case "str_replace_editor": {
-            return typeof args.path === "string" ? [args.path] : [];
-        }
-        default:
-            return [];
-    }
-}
-/**
- * Whether the named path is only read. Directory-wide tools stay confined even
- * for reads: the attachment store is shared by every account, and only the
- * exact file an upload produced is meant to be reachable.
- */
-function readsSharedRoot(execution) {
-    if (execution.name === "read" ||
-        execution.name === "read_image" ||
-        execution.name === "glob" ||
-        execution.name === "grep") {
-        return true;
-    }
-    return (execution.name === "str_replace_editor" &&
-        record(execution.arguments)?.command === "view");
-}
-function readsSingleFile(execution) {
-    if (execution.name === "read" || execution.name === "read_image")
-        return true;
-    return (execution.name === "str_replace_editor" &&
-        record(execution.arguments)?.command === "view");
-}
 function directoryBytes(root, stopAfter) {
     let total = 0;
     const pending = [root];
@@ -167,24 +125,13 @@ function directoryBytes(root, stopAfter) {
     }
     return total;
 }
-function requestedWriteBytes(execution) {
-    const args = record(execution.arguments);
-    if (args === undefined)
-        return 0;
-    const values = [args.content, args.new_string, args.new_str];
-    return values.reduce((total, value) => total + (typeof value === "string" ? Buffer.byteLength(value) : 0), 0);
-}
 /**
  * Monotonic guard used in addition to DSH's workspace-write sandbox. It
  * fences model-controlled file paths for both reads and writes, rejects tools
  * whose implementation can walk above cwd, and enforces bounded scratch use.
  *
- * `attachmentRoot` is the one deliberate read exemption: an uploaded file is
- * an immutable content-addressed copy the deployment stores outside every
- * workspace, and the model reaches it exactly as the harness intends (the
- * prompt carries the stored path). Reads of a single such file are allowed;
- * directory-wide tools stay confined because the store is shared by every
- * account, and writes are never exempted.
+ * `attachmentRoot` identifies the storage backend, never authority to read it.
+ * Only regular files in `attachmentFiles` may cross the workspace boundary.
  */
 export function qaUserWorkspaceDenial(execution, root, attachmentRoot, readPolicy = {}) {
     const args = record(execution.arguments);
@@ -202,35 +149,34 @@ export function qaUserWorkspaceDenial(execution, root, attachmentRoot, readPolic
         execution.name === "apply_patch") {
         return PATH_DENIAL;
     }
-    const readsShared = readsSharedRoot(execution);
-    const readsOneFile = readsSingleFile(execution);
+    const intent = qaFilesystemIntent(execution.name, args);
     try {
         const sharedReadOnlyRoots = (readPolicy.sharedReadOnlyRoots ?? []).map(canonicalCandidate);
-        for (const requested of requestedPaths(execution)) {
+        for (const requested of intent === undefined ? [] : [intent.path]) {
             const absolute = path.isAbsolute(requested)
                 ? requested
                 : path.resolve(root, requested);
             const canonical = canonicalCandidate(absolute);
             if (pathIsInside(canonical, root))
                 continue;
-            if (readsShared &&
+            if (intent?.kind === "read" &&
                 sharedReadOnlyRoots.some((readRoot) => pathIsInside(canonical, readRoot))) {
                 continue;
             }
             // Resolved only for a path the fence would otherwise refuse, so the
             // common case pays no extra filesystem walk.
-            if (readsOneFile &&
+            if (intent?.kind === "read" &&
+                intent.fileOnlyGrant &&
                 attachmentRoot !== undefined &&
-                pathIsInside(canonical, canonicalCandidate(attachmentRoot))) {
+                pathIsInside(canonical, canonicalCandidate(attachmentRoot)) &&
+                (readPolicy.attachmentFiles ?? []).some((file) => samePath(canonical, file)) &&
+                statSync(canonical).isFile()) {
                 continue;
             }
             return PATH_DENIAL;
         }
-        if (execution.name === "write" ||
-            execution.name === "edit" ||
-            (execution.name === "str_replace_editor" &&
-                record(execution.arguments)?.command !== "view")) {
-            const requested = requestedWriteBytes(execution);
+        if (intent?.kind === "write") {
+            const requested = intent.bytes;
             if (requested > QA_USER_WORKSPACE_MAX_WRITE_BYTES ||
                 directoryBytes(root, QA_USER_WORKSPACE_MAX_BYTES) + requested >
                     QA_USER_WORKSPACE_MAX_BYTES) {

package/lib/user-workspace.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-workspace.js","sourceRoot":"","sources":["../src/user-workspace.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,SAAS,EACT,SAAS,EACT,WAAW,EACX,YAAY,EACZ,QAAQ,GACT,MAAM,SAAS,CAAC;AACjB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,iFAAiF;AACjF,MAAM,CAAC,MAAM,4BAA4B,GAAG,WAAW,CAAC;AAExD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAC7D,MAAM,CAAC,MAAM,iCAAiC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAElE,MAAM,eAAe,GACnB,6EAA6E,CAAC;AAChF,MAAM,WAAW,GACf,+DAA+D,CAAC;AAClE,MAAM,YAAY,GAAG,gDAAgD,CAAC;AAYtE,SAAS,QAAQ,CAAC,IAAY,EAAE,KAAa;IAC3C,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO;QACjC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE;QAC5C,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,IAAY;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7C,OAAO,CACL,QAAQ,KAAK,EAAE;QACf,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;YACpC,QAAQ,KAAK,IAAI;YACjB,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAC9B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,MAAM,GAAG,QAAQ,CAAC;IACtB,SAAS,CAAC;QACR,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;YACpE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACpC,IAAI,MAAM,KAAK,MAAM;gBAAE,MAAM,KAAK,CAAC;YACnC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YACtC,MAAM,GAAG,MAAM,CAAC;QAClB,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,+CAA+C,KAAK,EAAE,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,aAAqB,EACrB,MAAc;IAEd,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,kBAAkB,GAAG,YAAY,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,4BAA4B,CAAC,CAAC;IAC9E,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAChC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC9D,MAAM,kBAAkB,GAAG,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1D,IAAI,CAAC,YAAY,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;IACvD,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC/B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC7D,MAAM,iBAAiB,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxD,IACE,CAAC,YAAY,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;QACpD,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,kBAAkB,CAAC,EAC9D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,uBAAuB,CACrC,aAAqB,EACrB,MAAc;IAEd,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,kBAAkB,GAAG,YAAY,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,4BAA4B,CAAC,CAAC;IAC9E,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC9C,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAChC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC/B,MAAM,kBAAkB,GAAG,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1D,MAAM,iBAAiB,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxD,IACE,CAAC,YAAY,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;QACrD,CAAC,YAAY,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;QACpD,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,kBAAkB,CAAC,EAC9D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,SAA8B;IACpD,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAClC,QAAQ,SAAS,CAAC,IAAI,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC;QACZ,KAAK,YAAY,CAAC;QAClB,KAAK,OAAO,CAAC;QACb,KAAK,MAAM,EAAE,CAAC;YACZ,OAAO,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,CAAC;QACD,KAAK,MAAM,CAAC;QACZ,KAAK,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3D,CAAC;QACD,KAAK,oBAAoB,EAAE,CAAC;YAC1B,OAAO,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,CAAC;QACD;YACE,OAAO,EAAE,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,SAA8B;IACrD,IACE,SAAS,CAAC,IAAI,KAAK,MAAM;QACzB,SAAS,CAAC,IAAI,KAAK,YAAY;QAC/B,SAAS,CAAC,IAAI,KAAK,MAAM;QACzB,SAAS,CAAC,IAAI,KAAK,MAAM,EACzB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CACL,SAAS,CAAC,IAAI,KAAK,oBAAoB;QACvC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,MAAM,CAChD,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,SAA8B;IACrD,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM,IAAI,SAAS,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IAC9E,OAAO,CACL,SAAS,CAAC,IAAI,KAAK,oBAAoB;QACvC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,MAAM,CAChD,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,SAAiB;IACrD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC;IACvB,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,IAAI,SAAS,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAG,CAAC;QAC/B,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAClE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACjD,IAAI,KAAK,CAAC,cAAc,EAAE;gBAAE,SAAS;YACrC,IAAI,KAAK,CAAC,WAAW,EAAE;gBAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;iBAC5C,IAAI,KAAK,CAAC,MAAM,EAAE;gBAAE,KAAK,IAAI,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC;YAC3D,IAAI,KAAK,GAAG,SAAS;gBAAE,MAAM;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,mBAAmB,CAAC,SAA8B;IACzD,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7D,OAAO,MAAM,CAAC,MAAM,CAClB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CACf,KAAK,GAAG,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EACpE,CAAC,CACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAA8B,EAC9B,IAAY,EACZ,cAAuB,EACvB,UAAU,GAA8B,EAAE;IAE1C,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACzC,IACE,IAAI,EAAE,mBAAmB,KAAK,SAAS;QACvC,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM;YACxB,CAAC,IAAI,EAAE,WAAW,KAAK,IAAI,IAAI,IAAI,EAAE,UAAU,KAAK,IAAI,CAAC,CAAC,EAC5D,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,IACE,SAAS,CAAC,IAAI,KAAK,MAAM;QACzB,SAAS,CAAC,IAAI,KAAK,OAAO;QAC1B,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QACtC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QACjC,SAAS,CAAC,IAAI,KAAK,UAAU;QAC7B,SAAS,CAAC,IAAI,KAAK,KAAK;QACxB,SAAS,CAAC,IAAI,KAAK,aAAa,EAChC,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,MAAM,WAAW,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,YAAY,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,mBAAmB,GAAG,CAAC,UAAU,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,GAAG,CACpE,kBAAkB,CACnB,CAAC;QACF,KAAK,MAAM,SAAS,IAAI,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;YAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;gBACzC,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAClC,MAAM,SAAS,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YAC/C,IAAI,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC;gBAAE,SAAS;YAC5C,IACE,WAAW;gBACX,mBAAmB,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CACpC,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAC,CAClC,EACD,CAAC;gBACD,SAAS;YACX,CAAC;YACD,oEAAoE;YACpE,6CAA6C;YAC7C,IACE,YAAY;gBACZ,cAAc,KAAK,SAAS;gBAC5B,YAAY,CAAC,SAAS,EAAE,kBAAkB,CAAC,cAAc,CAAC,CAAC,EAC3D,CAAC;gBACD,SAAS;YACX,CAAC;YACD,OAAO,WAAW,CAAC;QACrB,CAAC;QACD,IACE,SAAS,CAAC,IAAI,KAAK,OAAO;YAC1B,SAAS,CAAC,IAAI,KAAK,MAAM;YACzB,CAAC,SAAS,CAAC,IAAI,KAAK,oBAAoB;gBACtC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,MAAM,CAAC,EAClD,CAAC;YACD,MAAM,SAAS,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;YACjD,IACE,SAAS,GAAG,iCAAiC;gBAC7C,cAAc,CAAC,IAAI,EAAE,2BAA2B,CAAC,GAAG,SAAS;oBAC3D,2BAA2B,EAC7B,CAAC;gBACD,OAAO,YAAY,CAAC;YACtB,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAC;IACrB,CAAC;AACH,CAAC"}
+{"version":3,"file":"user-workspace.js","sourceRoot":"","sources":["../src/user-workspace.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,SAAS,EACT,SAAS,EACT,WAAW,EACX,YAAY,EACZ,QAAQ,GACT,MAAM,SAAS,CAAC;AACjB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAE5D,iFAAiF;AACjF,MAAM,CAAC,MAAM,4BAA4B,GAAG,WAAW,CAAC;AAExD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAC7D,MAAM,CAAC,MAAM,iCAAiC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAElE,MAAM,eAAe,GACnB,6EAA6E,CAAC;AAChF,MAAM,WAAW,GACf,+DAA+D,CAAC;AAClE,MAAM,YAAY,GAAG,gDAAgD,CAAC;AActE,SAAS,QAAQ,CAAC,IAAY,EAAE,KAAa;IAC3C,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO;QACjC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE;QAC5C,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,IAAY;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7C,OAAO,CACL,QAAQ,KAAK,EAAE;QACf,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;YACpC,QAAQ,KAAK,IAAI;YACjB,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAC9B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,MAAM,GAAG,QAAQ,CAAC;IACtB,SAAS,CAAC;QACR,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;YACpE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACpC,IAAI,MAAM,KAAK,MAAM;gBAAE,MAAM,KAAK,CAAC;YACnC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YACtC,MAAM,GAAG,MAAM,CAAC;QAClB,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,+CAA+C,KAAK,EAAE,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,aAAqB,EACrB,MAAc;IAEd,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,kBAAkB,GAAG,YAAY,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,4BAA4B,CAAC,CAAC;IAC9E,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAChC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC9D,MAAM,kBAAkB,GAAG,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1D,IAAI,CAAC,YAAY,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;IACvD,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC/B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC7D,MAAM,iBAAiB,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxD,IACE,CAAC,YAAY,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;QACpD,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,kBAAkB,CAAC,EAC9D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,uBAAuB,CACrC,aAAqB,EACrB,MAAc;IAEd,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,kBAAkB,GAAG,YAAY,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,4BAA4B,CAAC,CAAC;IAC9E,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC9C,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAChC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC/B,MAAM,kBAAkB,GAAG,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1D,MAAM,iBAAiB,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxD,IACE,CAAC,YAAY,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;QACrD,CAAC,YAAY,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;QACpD,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,kBAAkB,CAAC,EAC9D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,SAAiB;IACrD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC;IACvB,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,IAAI,SAAS,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAG,CAAC;QAC/B,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAClE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACjD,IAAI,KAAK,CAAC,cAAc,EAAE;gBAAE,SAAS;YACrC,IAAI,KAAK,CAAC,WAAW,EAAE;gBAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;iBAC5C,IAAI,KAAK,CAAC,MAAM,EAAE;gBAAE,KAAK,IAAI,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC;YAC3D,IAAI,KAAK,GAAG,SAAS;gBAAE,MAAM;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAA8B,EAC9B,IAAY,EACZ,cAAuB,EACvB,UAAU,GAA8B,EAAE;IAE1C,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACzC,IACE,IAAI,EAAE,mBAAmB,KAAK,SAAS;QACvC,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM;YACxB,CAAC,IAAI,EAAE,WAAW,KAAK,IAAI,IAAI,IAAI,EAAE,UAAU,KAAK,IAAI,CAAC,CAAC,EAC5D,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,IACE,SAAS,CAAC,IAAI,KAAK,MAAM;QACzB,SAAS,CAAC,IAAI,KAAK,OAAO;QAC1B,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QACtC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QACjC,SAAS,CAAC,IAAI,KAAK,UAAU;QAC7B,SAAS,CAAC,IAAI,KAAK,KAAK;QACxB,SAAS,CAAC,IAAI,KAAK,aAAa,EAChC,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,mBAAmB,GAAG,CAAC,UAAU,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,GAAG,CACpE,kBAAkB,CACnB,CAAC;QACF,KAAK,MAAM,SAAS,IAAI,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;gBACzC,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAClC,MAAM,SAAS,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YAC/C,IAAI,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC;gBAAE,SAAS;YAC5C,IACE,MAAM,EAAE,IAAI,KAAK,MAAM;gBACvB,mBAAmB,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CACpC,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAC,CAClC,EACD,CAAC;gBACD,SAAS;YACX,CAAC;YACD,oEAAoE;YACpE,6CAA6C;YAC7C,IACE,MAAM,EAAE,IAAI,KAAK,MAAM;gBACvB,MAAM,CAAC,aAAa;gBACpB,cAAc,KAAK,SAAS;gBAC5B,YAAY,CAAC,SAAS,EAAE,kBAAkB,CAAC,cAAc,CAAC,CAAC;gBAC3D,CAAC,UAAU,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAC/C,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,CAC1B;gBACD,QAAQ,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,EAC5B,CAAC;gBACD,SAAS;YACX,CAAC;YACD,OAAO,WAAW,CAAC;QACrB,CAAC;QACD,IAAI,MAAM,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;YAC7B,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC;YAC/B,IACE,SAAS,GAAG,iCAAiC;gBAC7C,cAAc,CAAC,IAAI,EAAE,2BAA2B,CAAC,GAAG,SAAS;oBAC3D,2BAA2B,EAC7B,CAAC;gBACD,OAAO,YAAY,CAAC;YACtB,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAC;IACrB,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yadsh/dsh-qa-surface",
-  "version": "0.18.0",
+  "version": "0.19.0",
   "description": "A focused end-user QA surface backed by native DeepSeek Harness sessions",
   "repository": {
     "type": "git",
@@ -103,7 +103,7 @@
     "node": "^22.19.0 || >=24.0.0"
   },
   "peerDependencies": {
-    "@deepseek-ai/cordis": "^4.0.4",
+    "@deepseek-ai/cordis": "~4.0.4",
     "@deepseek-ai/dsh-agent": ">=0.1.7-rc.2 <0.3.0-0",
     "@deepseek-ai/dsh-agent-preset-registry": ">=0.1.7-rc.2 <0.3.0-0",
     "@deepseek-ai/dsh-api-gateway": ">=0.1.7-rc.2 <0.3.0-0",
@@ -137,15 +137,16 @@
     "openid-client": "6.8.8",
     "yaml": "^2.9.0",
     "zod": "^4.4.3",
-    "@yadsh/dsh-audit-core": "^0.1.2",
-    "@yadsh/dsh-audit-ui": "^0.1.3",
-    "@yadsh/dsh-documents": "^0.8.1",
-    "@yadsh/dsh-plugin-kit": "^0.6.0",
-    "@yadsh/dsh-plugin-log": "^0.4.2"
+    "@yadsh/dsh-audit-core": "^0.1.3",
+    "@yadsh/dsh-plugin-kit": "^0.7.0",
+    "@yadsh/dsh-audit-ui": "^0.1.4",
+    "@yadsh/dsh-plugin-log": "^0.4.3",
+    "@yadsh/dsh-documents": "^0.8.2"
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "4.0.5",
     "@deepseek-ai/dsh-agent": "0.2.1-rc.3",
+    "@deepseek-ai/dsh-agent-loop": "0.2.1-rc.3",
     "@deepseek-ai/dsh-agent-preset-registry": "0.2.1-rc.3",
     "@deepseek-ai/dsh-api-gateway": "0.2.1-rc.3",
     "@deepseek-ai/dsh-api-session-controller": "0.2.1-rc.3",
@@ -164,6 +165,7 @@
     "@deepseek-ai/dsh-permission-presets": "0.2.1-rc.3",
     "@deepseek-ai/dsh-scope": "0.2.1-rc.3",
     "@deepseek-ai/dsh-session": "0.2.1-rc.3",
+    "@deepseek-ai/dsh-session-projection": "0.2.1-rc.3",
     "@deepseek-ai/dsh-settings": "0.2.1-rc.3",
     "@deepseek-ai/dsh-skill": "0.2.1-rc.3",
     "@deepseek-ai/dsh-system-prompt": "0.2.1-rc.3",
@@ -177,7 +179,7 @@
     "@types/node": "^26.4.0",
     "@types/react": "18.3.28",
     "@types/react-dom": "18.3.7",
-    "@vitest/coverage-v8": "^4.1.8",
+    "@vitest/coverage-v8": "^4.1.12",
     "eslint": "10.9.1",
     "jsdom": "^26.1.0",
     "katex": "^0.18.2",
@@ -186,7 +188,7 @@
     "react-dom": "18.3.1",
     "tsdown": "^0.22.14",
     "typescript": "^7.0.2",
-    "vitest": "^4.1.11",
+    "vitest": "^4.1.12",
     "@yadsh/dsh-config": "^0.0.0",
     "@yadsh/dsh-plugin-scripts": "^0.0.0"
   },