@yadsh/dsh-qa-surface 0.19.0 → 0.21.0

package/lib/index.js

@@ -34,6 +34,8 @@ var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn,
 };
 import { readSourceImage as readSourceImagePreview } from "./provenance/source-image.js";
 import path from "node:path";
+import { QaCodeSourceSelection } from "./code-source-selection.js";
+import { qaDelegatedHeader } from "./shared/session-lineage.js";
 import { defaultAccountsFilePath } from "./accounts/store.js";
 import { QaChatSharingStore } from "./chat-sharing/store.js";
 import { QaChatTransport } from "./chat-sharing/transport.js";
@@ -56,6 +58,7 @@ import { createQaPersonalSkillRemotes, QaPersonalSkillsHost, } from "./personal-
 import { QaApprovalGate } from "./approvals.js";
 import { QaAttestationError } from "./attestation.js";
 import { QaFileDeleteGate } from "./qa-tools/file-delete-gate.js";
+import { installQaFileWriteGate } from "./qa-tools/file-write-gate.js";
 import { QaQuestionGate } from "./questions.js";
 import { QaFormStore } from "./forms/store.js";
 import { QaFormService } from "./forms/service.js";
@@ -77,6 +80,7 @@ import { createQaIntegrationRunner } from "./integration/host-runner.js";
 import { QaIntegrationService } from "./integration/service.js";
 import { QaPolicyAdmission } from "./secure-session.js";
 import { QaAccessService } from "./access/service.js";
+import { userModelOptions, selectUserModel } from "./access/model-choices.js";
 import { userInvocableSkillNames } from "./access/model.js";
 import { createQaSlashRemotes } from "./slash/remotes.js";
 import { QaPromptNotes } from "./prompt-notes.js";
@@ -99,6 +103,7 @@ export const inject = [
     "systemPrompt",
     "workspaceRegistry",
     "sessionController",
+    "llm",
 ];
 // One home for the namespace: the browser card binds to the same constant
 // through `src/shared/settings.ts`, which avoids importing this module (and
@@ -142,6 +147,8 @@ function releaseScopeLease(lease) {
 let QaSurface = (() => {
     let _classSuper = TypertRemoteService;
     let _instanceExtraInitializers = [];
+    let _chatCodeSources_decorators;
+    let _chatSelectCodeSource_decorators;
     let _accountsRegister_decorators;
     let _accountsLogin_decorators;
     let _accountsOidcStart_decorators;
@@ -160,6 +167,7 @@ let QaSurface = (() => {
     let _accountsCreateServiceToken_decorators;
     let _accountsRevokeServiceToken_decorators;
     let _accountsSetServiceTokenClarifications_decorators;
+    let _accountsSetServiceTokenHistoryFolder_decorators;
     let _describe_decorators;
     let _queueStatus_decorators;
     let _createSession_decorators;
@@ -170,6 +178,7 @@ let QaSurface = (() => {
     let _accessCreateSubrole_decorators;
     let _accessUpdateSubrole_decorators;
     let _accessModelCatalog_decorators;
+    let _accessUserModels_decorators;
     let _accessDeleteSubrole_decorators;
     let _accessUpdateCommon_decorators;
     let _accessUpdateAssignment_decorators;
@@ -255,6 +264,8 @@ let QaSurface = (() => {
     return class QaSurface extends _classSuper {
         static {
             const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            _chatCodeSources_decorators = [Remote("chatCodeSources")];
+            _chatSelectCodeSource_decorators = [Remote("chatSelectCodeSource")];
             _accountsRegister_decorators = [Remote("accountsRegister")];
             _accountsLogin_decorators = [Remote("accountsLogin")];
             _accountsOidcStart_decorators = [Remote("accountsOidcStart")];
@@ -273,6 +284,7 @@ let QaSurface = (() => {
             _accountsCreateServiceToken_decorators = [Remote("accountsCreateServiceToken")];
             _accountsRevokeServiceToken_decorators = [Remote("accountsRevokeServiceToken")];
             _accountsSetServiceTokenClarifications_decorators = [Remote("accountsSetServiceTokenClarifications")];
+            _accountsSetServiceTokenHistoryFolder_decorators = [Remote("accountsSetServiceTokenHistoryFolder")];
             _describe_decorators = [Remote("describe")];
             _queueStatus_decorators = [Remote("queueStatus")];
             _createSession_decorators = [Remote("createSession")];
@@ -283,6 +295,7 @@ let QaSurface = (() => {
             _accessCreateSubrole_decorators = [Remote("accessCreateSubrole")];
             _accessUpdateSubrole_decorators = [Remote("accessUpdateSubrole")];
             _accessModelCatalog_decorators = [Remote("accessModelCatalog")];
+            _accessUserModels_decorators = [Remote("accessUserModels")];
             _accessDeleteSubrole_decorators = [Remote("accessDeleteSubrole")];
             _accessUpdateCommon_decorators = [Remote("accessUpdateCommon")];
             _accessUpdateAssignment_decorators = [Remote("accessUpdateAssignment")];
@@ -365,6 +378,8 @@ let QaSurface = (() => {
             _skillsTools_decorators = [Remote("skillsTools")];
             _slashCatalog_decorators = [Remote("slashCatalog")];
             _slashExecute_decorators = [Remote("slashExecute")];
+            __esDecorate(this, null, _chatCodeSources_decorators, { kind: "method", name: "chatCodeSources", static: false, private: false, access: { has: obj => "chatCodeSources" in obj, get: obj => obj.chatCodeSources }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _chatSelectCodeSource_decorators, { kind: "method", name: "chatSelectCodeSource", static: false, private: false, access: { has: obj => "chatSelectCodeSource" in obj, get: obj => obj.chatSelectCodeSource }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _accountsRegister_decorators, { kind: "method", name: "accountsRegister", static: false, private: false, access: { has: obj => "accountsRegister" in obj, get: obj => obj.accountsRegister }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _accountsLogin_decorators, { kind: "method", name: "accountsLogin", static: false, private: false, access: { has: obj => "accountsLogin" in obj, get: obj => obj.accountsLogin }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _accountsOidcStart_decorators, { kind: "method", name: "accountsOidcStart", static: false, private: false, access: { has: obj => "accountsOidcStart" in obj, get: obj => obj.accountsOidcStart }, metadata: _metadata }, null, _instanceExtraInitializers);
@@ -383,6 +398,7 @@ let QaSurface = (() => {
             __esDecorate(this, null, _accountsCreateServiceToken_decorators, { kind: "method", name: "accountsCreateServiceToken", static: false, private: false, access: { has: obj => "accountsCreateServiceToken" in obj, get: obj => obj.accountsCreateServiceToken }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _accountsRevokeServiceToken_decorators, { kind: "method", name: "accountsRevokeServiceToken", static: false, private: false, access: { has: obj => "accountsRevokeServiceToken" in obj, get: obj => obj.accountsRevokeServiceToken }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _accountsSetServiceTokenClarifications_decorators, { kind: "method", name: "accountsSetServiceTokenClarifications", static: false, private: false, access: { has: obj => "accountsSetServiceTokenClarifications" in obj, get: obj => obj.accountsSetServiceTokenClarifications }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _accountsSetServiceTokenHistoryFolder_decorators, { kind: "method", name: "accountsSetServiceTokenHistoryFolder", static: false, private: false, access: { has: obj => "accountsSetServiceTokenHistoryFolder" in obj, get: obj => obj.accountsSetServiceTokenHistoryFolder }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _describe_decorators, { kind: "method", name: "describe", static: false, private: false, access: { has: obj => "describe" in obj, get: obj => obj.describe }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _queueStatus_decorators, { kind: "method", name: "queueStatus", static: false, private: false, access: { has: obj => "queueStatus" in obj, get: obj => obj.queueStatus }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _createSession_decorators, { kind: "method", name: "createSession", static: false, private: false, access: { has: obj => "createSession" in obj, get: obj => obj.createSession }, metadata: _metadata }, null, _instanceExtraInitializers);
@@ -393,6 +409,7 @@ let QaSurface = (() => {
             __esDecorate(this, null, _accessCreateSubrole_decorators, { kind: "method", name: "accessCreateSubrole", static: false, private: false, access: { has: obj => "accessCreateSubrole" in obj, get: obj => obj.accessCreateSubrole }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _accessUpdateSubrole_decorators, { kind: "method", name: "accessUpdateSubrole", static: false, private: false, access: { has: obj => "accessUpdateSubrole" in obj, get: obj => obj.accessUpdateSubrole }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _accessModelCatalog_decorators, { kind: "method", name: "accessModelCatalog", static: false, private: false, access: { has: obj => "accessModelCatalog" in obj, get: obj => obj.accessModelCatalog }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _accessUserModels_decorators, { kind: "method", name: "accessUserModels", static: false, private: false, access: { has: obj => "accessUserModels" in obj, get: obj => obj.accessUserModels }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _accessDeleteSubrole_decorators, { kind: "method", name: "accessDeleteSubrole", static: false, private: false, access: { has: obj => "accessDeleteSubrole" in obj, get: obj => obj.accessDeleteSubrole }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _accessUpdateCommon_decorators, { kind: "method", name: "accessUpdateCommon", static: false, private: false, access: { has: obj => "accessUpdateCommon" in obj, get: obj => obj.accessUpdateCommon }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _accessUpdateAssignment_decorators, { kind: "method", name: "accessUpdateAssignment", static: false, private: false, access: { has: obj => "accessUpdateAssignment" in obj, get: obj => obj.accessUpdateAssignment }, metadata: _metadata }, null, _instanceExtraInitializers);
@@ -477,9 +494,20 @@ let QaSurface = (() => {
             __esDecorate(this, null, _slashExecute_decorators, { kind: "method", name: "slashExecute", static: false, private: false, access: { has: obj => "slashExecute" in obj, get: obj => obj.slashExecute }, metadata: _metadata }, null, _instanceExtraInitializers);
             if (_metadata) Object.defineProperty(this, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
         }
+        sourceSelections = __runInitializers(this, _instanceExtraInitializers);
+        codeSourceStore() {
+            return (this.sourceSelections ??= new QaCodeSourceSelection(path.join(path.dirname(defaultAccountsFilePath()), "qa-code-sources.db"), () => this.getConfig().codeSources, (id) => this.ctx.sessions.get(SessionId(id)), (id) => {
+                const agent = this.ctx.agents.get(SessionId(id));
+                return (agent !== undefined &&
+                    (agent.status === "running" ||
+                        agent.inbox.nextStep.length > 0 ||
+                        qaRequestFamilyBusy(this.ctx, agent) ||
+                        this.requestScheduler.status(id).waiting === true));
+            }));
+        }
         static inject = inject;
         static Config = ConfigSchema;
-        source = __runInitializers(this, _instanceExtraInitializers);
+        source;
         logger;
         admission;
         approvals;
@@ -560,7 +588,20 @@ let QaSurface = (() => {
             // the one live source: each read folds its current snapshots, and a settings
             // write is visible on the next read without reloading the plugin.
             this.source = () => readConfigRefs(entry);
-            this.requestScheduler = new QaRequestScheduler(() => this.getConfig().session.maxActiveRequests, () => qaRequestRoots(ctx, this.getConfig().session.maxActiveRequests > 0), Date.now, (agent) => qaRequestFamilyBusy(ctx, agent));
+            ctx.effect(() => ctx.on("agent/created", ({ agent }) => {
+                const { parentSession } = agent.session.header;
+                if (parentSession !== undefined &&
+                    (qaDelegatedHeader(agent.session.header) ||
+                        agent.session.header.isSeeded === true)) {
+                    this.codeSourceStore().inherit(String(agent.session.id), String(parentSession), this.admission.knowsSession(String(parentSession)));
+                }
+            }, { global: true }), "dsh-qa-surface.code-source-inheritance");
+            ctx.effect(() => () => this.sourceSelections?.close(), "dsh-qa-surface.code-source-store");
+            this.requestScheduler = new QaRequestScheduler(() => this.getConfig().session.maxActiveRequests, () => qaRequestRoots(ctx, this.getConfig().session.maxActiveRequests > 0), Date.now, (agent) => qaRequestFamilyBusy(ctx, agent), 
+            // The ceiling one turn fills against, resolved per admission: a role or
+            // an account that overrides the deployment's number is read here, where
+            // the scheduler decides, not once at boot.
+            (agent) => this.queueSlotsOverride(agent));
             ctx.effect(() => this.requestScheduler.install(ctx), "dsh-qa-surface.request-queue");
             this.logger = getPluginLogger({
                 pluginId: "dsh-qa-surface",
@@ -752,6 +793,8 @@ let QaSurface = (() => {
             this.approvals.install();
             this.userQuestions.install();
             this.fileDeleteGate.install();
+            const disposeFileWriteGate = installQaFileWriteGate(ctx, ownership, () => this.getConfig().tools.fileWritePolicy);
+            ctx.effect(() => disposeFileWriteGate, "dsh-qa-surface.file-write-gate");
             // A turn the Host ended with a provider failure is written to the plugin's
             // log with its code and the provider the request was routed to. The chat row
             // names the code only, and the durable journal that holds the rest is a zstd
@@ -766,6 +809,7 @@ let QaSurface = (() => {
             // complete persona closes the system prompt to plugins, the conversation
             // stays open.
             this.notes = new QaPromptNotes(ctx, {
+                codeSources: (sessionId) => this.getCodeSources(sessionId),
                 config: () => this.getConfig(),
                 accounts: () => this.accountRemotes.resolve(this.getConfig()),
                 isQaSession: (sessionId) => this.admission.knowsSession(sessionId),
@@ -793,6 +837,20 @@ let QaSurface = (() => {
             // The QA tool catalog is attached per agent, never at boot: nothing here
             // reaches the model until a managed agent loads the activation skill.
             this.tools = new QaTools(ctx, {
+                subagents: {
+                    ctx,
+                    runtime: () => ctx.get("subagents"),
+                    policy: (agent) => {
+                        const root = ownership.rootOf(String(agent.session.id));
+                        if (root === undefined)
+                            throw new Error("An attested QA conversation is required.");
+                        return this.access.modelPolicyFor(root);
+                    },
+                },
+                codeSources: (exec) => this.getCodeSources(exec?.agent?.session?.id === undefined
+                    ? undefined
+                    : String(exec.agent.session.id)),
+                codeReadRoots: () => this.getConfig().lockdown.sharedReadOnlyRoots,
                 forms: this.formGate,
                 formsEnabled: () => this.getConfig().forms.enabled,
                 formProjection: (submission, sessionId) => this.formAttachments.readable(submission, sessionId),
@@ -972,6 +1030,33 @@ let QaSurface = (() => {
         modelPolicyForSession(sessionId) {
             return this.access.modelPolicyFor(sessionId).pair;
         }
+        /** Shared source catalogue consumed by preset-mounted Git tools at call time. */
+        getCodeSources(sessionId) {
+            return sessionId === undefined
+                ? this.getConfig().codeSources
+                : this.codeSourceStore().catalog(sessionId);
+        }
+        getSelectedCodeSource(sessionId) {
+            return this.codeSourceStore().selected(sessionId);
+        }
+        async chatCodeSources(token, sessionId) {
+            const finish = await this.admitChatRead(token, sessionId);
+            let owner = true;
+            try {
+                this.requireChatOwner(token, sessionId);
+            }
+            catch {
+                owner = false;
+            }
+            finish();
+            return this.codeSourceStore().view(sessionId, owner);
+        }
+        async chatSelectCodeSource(token, sessionId, source) {
+            const finish = await this.admitChatRead(token, sessionId);
+            this.requireChatOwner(token, sessionId);
+            finish();
+            return this.codeSourceStore().select(sessionId, source);
+        }
         getConfig() {
             return resolveConfig(this.source());
         }
@@ -1118,6 +1203,9 @@ let QaSurface = (() => {
         accountsSetServiceTokenClarifications(token, tokenId, allowed) {
             return this.accountRemotes.setServiceTokenClarifications(token, tokenId, allowed);
         }
+        accountsSetServiceTokenHistoryFolder(token, tokenId, folder) {
+            return this.accountRemotes.setServiceTokenHistoryFolder(token, tokenId, folder);
+        }
         /**
          * Serve the effective QA configuration to the browser. The DSH gateway pins
          * settings RPCs to loopback, so a browser served over the LAN always sees
@@ -1132,12 +1220,68 @@ let QaSurface = (() => {
          * Report server admission. Global reads expose counts only; a chat's FIFO
          * position requires that account's current read access to the chat. The
          * scheduler gates every root turn, including native and integration sends.
+         *
+         * Both arguments are part of the wire contract: the gateway client counts
+         * declared parameters rather than TypeScript optionals, so a call that omits
+         * them is refused on the browser before the Host ever sees it. An empty
+         * session id is the global read — the shape every initial send asks for,
+         * while its draft chat has no session to name yet.
          */
         queueStatus(token, sessionId) {
-            if (sessionId !== undefined && this.getConfig().accounts.enabled) {
-                this.sharing().access(token ?? "", sessionId);
+            const requested = sessionId === "" ? undefined : sessionId;
+            if (requested !== undefined && this.getConfig().accounts.enabled) {
+                this.sharing().access(token, requested);
+            }
+            return this.requestScheduler.status(requested, this.queueCeiling(token, requested));
+        }
+        /**
+         * The ceiling this read answers against: the chat's own account chain when
+         * the read names a chat, the caller's account chain when it does not (the
+         * pre-send check carries a token but no chat yet), and the deployment's
+         * number whenever accounts are off or nobody matches. `undefined` is the
+         * scheduler's signal to fall back to that number, so the branch is a value
+         * rather than a flag.
+         */
+        queueCeiling(token, sessionId) {
+            const config = this.getConfig();
+            if (!config.accounts.enabled)
+                return undefined;
+            const accounts = this.accountRemotes.resolve(config);
+            if (accounts === undefined)
+                return undefined;
+            if (sessionId !== undefined) {
+                return accounts.ownerIdOf(sessionId) === undefined
+                    ? undefined
+                    : this.access.queueSlotsFor(sessionId);
+            }
+            try {
+                return this.access.queueSlotsForUser(accounts.currentUser(token).id);
+            }
+            catch {
+                // An anonymous or stale browser still deserves the deployment's numbers:
+                // the read is advisory, and the browser holds its question back on its
+                // own only for a ceiling it can actually name.
+                return undefined;
             }
-            return this.requestScheduler.status(sessionId);
+        }
+        /**
+         * The ceiling override one arriving turn fills against, or `undefined` when
+         * the deployment default governs it: without accounts every turn shares the
+         * one number, and an unowned session (an integration or an admin preview)
+         * stays in that shared pool whatever its role might say.
+         */
+        queueSlotsOverride(agent) {
+            const config = this.getConfig();
+            if (!config.accounts.enabled)
+                return undefined;
+            const sessionId = String(agent.session.id);
+            if (sessionId === "")
+                return undefined;
+            const accounts = this.accountRemotes.resolve(config);
+            if (accounts === undefined || accounts.ownerIdOf(sessionId) === undefined) {
+                return undefined;
+            }
+            return this.access.queueSlotsFor(sessionId);
         }
         /**
          * Create a QA session from Host-owned inputs. With account workspaces on,
@@ -1210,6 +1354,11 @@ let QaSurface = (() => {
         async accessModelCatalog(token) {
             return await this.accountRemotes.runAsync(() => this.access.modelCatalog(token));
         }
+        async accessUserModels(token, sessionId, subroleId, adminPreview) {
+            if (sessionId !== null)
+                this.requireChatOwner(token, sessionId);
+            return this.accountRemotes.runAsync(() => userModelOptions(this.ctx, this.access, token, sessionId, subroleId, adminPreview));
+        }
         accessDeleteSubrole(token, id, replacementId) {
             return this.accountRemotes.run(() => {
                 this.access.deleteSubrole(token, id, replacementId);
@@ -1490,9 +1639,12 @@ let QaSurface = (() => {
         }
         chatSelectModel(token, request) {
             this.requireChatOwner(token, String(request.sessionId));
-            if (this.getConfig().lockdown.enforceFixedModel)
-                throw new Error("The chat model is fixed by its policy.");
-            return this.chatTransport.selectModel(token, request);
+            return this.chatTransport.selectModel(token, request, async () => {
+                const id = String(request.sessionId);
+                if (this.requestScheduler.status(id).waiting === true)
+                    throw new Error("Wait for the queued request before changing the model.");
+                return selectUserModel(this.ctx, this.access, token, request);
+            });
         }
         async chatPage(token, request, signal) {
             return (await this.chatTransport.page(token, request, signal));
@@ -2043,7 +2195,7 @@ let QaSurface = (() => {
         refreshIntegrationRoutes() {
             const config = this.getConfig();
             const key = config.integration.enabled && config.accounts.enabled
-                ? `${config.integration.basePath}:${String(config.integration.maxRequestBytes)}:${String(config.integration.maxAttachmentBytes)}`
+                ? `${config.integration.basePath}:${String(config.integration.maxRequestBytes)}:${String(config.integration.maxAttachmentBytes)}:${String(config.integration.maxAttachments)}`
                 : undefined;
             if (key === this.integrationRouteKey)
                 return;