@yadsh/dsh-qa-surface 0.19.0 → 0.21.0

package/lib/types/client/types.d.ts

@@ -1,7 +1,7 @@
 import type { ClientRemote } from "@deepseek-ai/dsh-api-gateway/client";
 import type { ISessions, SessionFace } from "@deepseek-ai/dsh-api-session-controller/client";
 import type { UiConversation } from "@deepseek-ai/dsh-client-ui-conversation/client";
-import type { QaAccountNotificationsInput, QaAccountProfileInput, QaAccountSession, QaAccountStartersInput, QaAccountStarter, QaAccountUserPublic, QaAccessAdminSnapshot, QaApprovalDecision, QaClaimResult, QaLockdownProof, QaModelCatalogEntry, QaOwnershipEntry, QaPasswordResetRequest, QaPendingApproval, QaPendingQuestion, QaQuestionAnswerItem, QaQueueStatus, QaIssuedServiceToken, QaServiceTokenCreateInput, QaServiceTokenSummary, QaSessionState, QaSkillDocument, QaSkillDraftInput, QaSkillRemoval, QaSkillSummary, QaSkillToolDescriptor, QaSkillValidation, QaSourceFilePreview, QaTurnSources, QaWhoamiResult, QaDocumentPreview, QaSpreadsheetPreviewSelection, QaWorkspaceFile, QaWorkspaceFileChunk, QaDocumentWorkflowStatus, QaWorkspaceListing, QaCapabilitySelection, QaCurrentAccess, QaSessionAccess, QaSkillActivationRecord, QaSkillAssignmentOverride, QaSubrole, QaUserAccess, QaAdminAuditEvent, QaAdminOverview, QaAdminPage, QaAdminSkillScope, QaAdminSkillsView, QaAdminUserDetail, QaAdminUserRow, QaAdminUserUpdate, QaAuditQuery, QaConversationDetail, QaConversationDeletion, QaConversationQuery, QaConversationReview, QaConversationReviewInput, QaConversationSummary, QaExpertMemoryDraft, QaExpertMemoryPage, QaExpertMemoryRecord, QaExpertMemoryScope, QaFeedbackQuery, QaFeedbackRow, QaMessageFeedback, QaMessageFeedbackInput, QaQualityMetrics, QaReviewQueueItem, QaReviewQueueRow, QaSlashCatalog, QaSlashExecution, QaSlashSubmitAttachment, QaUserQuery } from "../types.js";
+import type { QaAccountNotificationsInput, QaAccountProfileInput, QaAccountSession, QaAccountStartersInput, QaAccountStarter, QaAccountUserPublic, QaAccessAdminSnapshot, QaApprovalDecision, QaClaimResult, QaLockdownProof, QaModelCatalogEntry, QaModelOptions, QaOwnershipEntry, QaPasswordResetRequest, QaPendingApproval, QaPendingQuestion, QaQuestionAnswerItem, QaQueueStatus, QaIssuedServiceToken, QaServiceTokenCreateInput, QaServiceTokenSummary, QaSessionState, QaSkillDocument, QaSkillDraftInput, QaSkillRemoval, QaSkillSummary, QaSkillToolDescriptor, QaSkillValidation, QaSourceFilePreview, QaTurnSources, QaWhoamiResult, QaDocumentPreview, QaSpreadsheetPreviewSelection, QaWorkspaceFile, QaWorkspaceFileChunk, QaDocumentWorkflowStatus, QaWorkspaceListing, QaCapabilitySelection, QaCurrentAccess, QaSessionAccess, QaSkillActivationRecord, QaSkillAssignmentOverride, QaSubrole, QaUserAccess, QaAdminAuditEvent, QaAdminOverview, QaAdminPage, QaAdminSkillScope, QaAdminSkillsView, QaAdminUserDetail, QaAdminUserRow, QaAdminUserUpdate, QaAuditQuery, QaConversationDetail, QaConversationDeletion, QaConversationQuery, QaConversationReview, QaConversationReviewInput, QaConversationSummary, QaExpertMemoryDraft, QaExpertMemoryPage, QaExpertMemoryRecord, QaExpertMemoryScope, QaFeedbackQuery, QaFeedbackRow, QaMessageFeedback, QaMessageFeedbackInput, QaQualityMetrics, QaReviewQueueItem, QaReviewQueueRow, QaSlashCatalog, QaSlashExecution, QaSlashSubmitAttachment, QaUserQuery } from "../types.js";
 /** Wire content one prompt carries: text plus base64 image uploads. */
 export type QaPromptContent = Parameters<SessionFace["prompt"]>[0];
 /** DSH session runtime surface the QA controller is allowed to touch. */
@@ -43,6 +43,7 @@ export type QaForkSession = (token: string, sourceId: string, answerSeq: number)
 export type QaQueueStatusRemote = (token?: string, sessionId?: string) => Promise<RemoteResult<QaQueueStatus>>;
 /** Role selector plus administrator mutation channel. */
 export interface QaAccessApi {
+    userModels?(token: string, sessionId: string | null, subroleId: string | null, adminPreview: boolean): Promise<RemoteResult<QaModelOptions>>;
     current(token: string): Promise<RemoteResult<QaCurrentAccess>>;
     session(token: string, sessionId: string): Promise<RemoteResult<QaSessionAccess>>;
     admin(token: string): Promise<RemoteResult<QaAccessAdminSnapshot>>;
@@ -337,6 +338,8 @@ export type QaIntegrationTokenResult<Value> = {
 };
 /** The integration-token section with the account token bound at the call site. */
 export interface QaIntegrationTokenApi {
+    readonly historyStorageKey?: string;
+    setFolder?(tokenId: string, folder: import("../types/accounts.js").QaHistoryFolderTarget | null): Promise<QaIntegrationTokenResult<null>>;
     /**
      * Whether this deployment can mint at all. A token is a credential for the
      * HTTP API, so when that API is off the page explains the state instead of
@@ -351,6 +354,9 @@ export interface QaIntegrationTokenApi {
 }
 /** Account remotes exposed by the plugin's own typert namespace. */
 export interface QaAccountsApi {
+    accountsSetServiceTokenHistoryFolder?(token: string, tokenId: string, folder: import("../types/accounts.js").QaHistoryFolderTarget | null): Promise<RemoteResult<{
+        readonly updated: boolean;
+    }>>;
     accountsSetServiceTokenClarifications?(token: string, tokenId: string, allowed: boolean): Promise<RemoteResult<{
         readonly updated: boolean;
     }>>;
@@ -362,9 +368,7 @@ export interface QaAccountsApi {
     accountsLogin(email: string, password: string): Promise<RemoteResult<QaAccountSession>>;
     accountsRegister(email: string, password: string): Promise<RemoteResult<QaAccountSession>>;
     accountsClaimSessions(token: string, sessionIds: readonly string[]): Promise<RemoteResult<QaClaimResult>>;
-    accountsOwnedSessions(token: string): Promise<RemoteResult<{
-        readonly ids: readonly string[];
-    }>>;
+    accountsOwnedSessions(token: string): Promise<RemoteResult<import("../types/accounts.js").QaOwnedSessionsResult>>;
     accountsListOwnership(token: string): Promise<RemoteResult<{
         readonly entries: readonly QaOwnershipEntry[];
     }>>;
@@ -412,6 +416,10 @@ export type RemoteResult<Value> = {
     readonly ok: false;
     readonly error: unknown;
 };
+export interface QaChatCodeSourceApi {
+    read(token: string, sessionId: string): Promise<RemoteResult<import("../types/code-sources.js").QaChatCodeSources>>;
+    select(token: string, sessionId: string, source: string | null): Promise<RemoteResult<import("../types/code-sources.js").QaChatCodeSources>>;
+}
 /** Minimal persistence contract; backed by `window.localStorage` in the app. */
 export interface StorageLike {
     getItem(key: string): string | null;

package/lib/types/client/use-chat-code-source.d.ts

@@ -0,0 +1,20 @@
+import type { CodeSourcesCatalog } from "@yadsh/dsh-plugin-kit/code-sources";
+import type { QaChatCodeSources } from "../types/code-sources.js";
+import type { QaChatCodeSourceApi } from "./types.js";
+export interface ChatCodeSourceOptions {
+    readonly api?: QaChatCodeSourceApi | undefined;
+    readonly token: string;
+    readonly sessionId: string | null;
+    readonly chatKey: number;
+    readonly catalog: CodeSourcesCatalog;
+}
+/** Server-backed per-chat state. Drafts do not create sessions until their first send. */
+export declare function useChatCodeSource(options: ChatCodeSourceOptions): {
+    value: QaChatCodeSources;
+    pending: boolean;
+    error: string | null;
+    select: (source: string | null) => Promise<boolean>;
+    prepareSession: (sessionId: string) => Promise<void>;
+    blocked: boolean;
+};
+//# sourceMappingURL=use-chat-code-source.d.ts.map

package/lib/types/client/use-history-organization.d.ts

@@ -0,0 +1,8 @@
+import { type QaHistoryOrganization } from "./history-organization.js";
+/** The catalog is keyed on mount, so changing accounts cannot reuse its state. */
+export declare function useHistoryOrganization(key: string): {
+    state: QaHistoryOrganization;
+    update: (next: QaHistoryOrganization) => void;
+    persistenceFailed: boolean;
+};
+//# sourceMappingURL=use-history-organization.d.ts.map

package/lib/types/client/use-model-selection.d.ts

@@ -0,0 +1,24 @@
+import type { QaModelOptions, QaModelPair } from "../types.js";
+import type { QaAccessApi } from "./types.js";
+export declare const qaModelKey: (pair: QaModelPair) => string;
+export interface QaModelSelectionProps {
+    readonly api: NonNullable<QaAccessApi["userModels"]>;
+    readonly token: string;
+    readonly sessionId: string | null;
+    readonly subroleId: string | null;
+    readonly preview: boolean;
+    readonly disabled: boolean;
+    readonly onSelect: (pair: QaModelPair) => Promise<string>;
+}
+/** The existing authenticated selection boundary shared by composer controls. */
+export declare function useQaModelSelection(props: QaModelSelectionProps | undefined): {
+    options: QaModelOptions | undefined;
+    busy: boolean;
+    error: string | undefined;
+    selectedKey: string;
+    select: (key: string) => Promise<boolean>;
+    selected: import("../types.js").QaModelCatalogEntry | undefined;
+    disabled: boolean;
+    reload: () => void;
+};
+//# sourceMappingURL=use-model-selection.d.ts.map

package/lib/types/client/use-qa-file-drop.d.ts

@@ -0,0 +1,12 @@
+import { type RefObject } from "react";
+interface FileDropTarget {
+    readonly element: RefObject<HTMLElement>;
+    readonly fallback?: boolean;
+    readonly canDrop: () => boolean;
+    readonly onFiles: (files: File[]) => void;
+    readonly onActive?: (active: boolean) => void;
+}
+/** Register a QA file receiver; ordinary text and chat drags remain untouched. */
+export declare function useQaFileDrop(target: FileDropTarget): void;
+export {};
+//# sourceMappingURL=use-qa-file-drop.d.ts.map

package/lib/types/code-source-selection.d.ts

@@ -0,0 +1,28 @@
+import { SqliteDatabase } from "@yadsh/dsh-plugin-kit/sqlite";
+import type { CodeSourcesCatalog } from "@yadsh/dsh-plugin-kit/code-sources";
+import type { QaChatCodeSources } from "./types/code-sources.js";
+export interface CodeSourceSession {
+    readonly header: {
+        readonly parentSession?: unknown;
+        readonly isSeeded?: boolean;
+        readonly origin?: unknown;
+    };
+}
+/** Durable chat preference and immutable snapshots for delegated/forked children. */
+export declare class QaCodeSourceSelection {
+    private readonly configured;
+    private readonly session;
+    private readonly busy;
+    readonly storage: SqliteDatabase;
+    constructor(filePath: string, configured: () => CodeSourcesCatalog, session: (id: string) => CodeSourceSession | undefined, busy: (id: string) => boolean);
+    private stored;
+    /** Resolve old/resumed children through their durable lineage when no snapshot exists. */
+    selected(id: string): string | null;
+    catalog(id?: string): CodeSourcesCatalog;
+    view(id: string, owner: boolean): QaChatCodeSources;
+    select(id: string, source: string | null): QaChatCodeSources;
+    inherit(id: string, parent: string, managedParent?: boolean): void;
+    private save;
+    close(): void;
+}
+//# sourceMappingURL=code-source-selection.d.ts.map

package/lib/types/code-sources.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=code-sources.js.map

package/lib/types/code-sources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"code-sources.js","sourceRoot":"","sources":["../../src/types/code-sources.ts"],"names":[],"mappings":""}

package/lib/types/config-resolvers/integration.d.ts

@@ -48,6 +48,12 @@ export declare function normalizeIntegrationBasePath(value: string): string;
  * @param accounts - the resolved accounts domain, for the cross-check.
  * @returns the frozen resolved slice.
  */
-export declare function resolveIntegration(input: QaIntegrationConfig | undefined, accounts: ResolvedQaSurfaceConfig["accounts"]): ResolvedIntegration;
+export declare function resolveIntegration(input: QaIntegrationConfig | undefined, accounts: ResolvedQaSurfaceConfig["accounts"], attachments?: {
+    readonly textFiles: boolean;
+    readonly pastedTextLines: number;
+    readonly maxFileBytes: number;
+    readonly maxPending: number;
+    readonly extensions: readonly string[];
+}): ResolvedIntegration;
 export {};
 //# sourceMappingURL=integration.d.ts.map

package/lib/types/forms/errors.d.ts

@@ -1,9 +1,10 @@
-import type { QaFormFieldError, QaFormResult } from "./types.js";
+import type { QaFormFieldError, QaFormResult, QaFormSchemaIssue } from "./types.js";
 export declare class QaFormError extends Error {
     readonly code: string;
     readonly revision?: number | undefined;
     readonly fields?: QaFormFieldError[] | undefined;
-    constructor(code: string, message: string, revision?: number | undefined, fields?: QaFormFieldError[] | undefined);
+    readonly schemaIssues?: QaFormSchemaIssue[] | undefined;
+    constructor(code: string, message: string, revision?: number | undefined, fields?: QaFormFieldError[] | undefined, schemaIssues?: QaFormSchemaIssue[] | undefined);
 }
 /** Deliberately redact unexpected storage/Host exceptions at the wire boundary. */
 export declare function formFailure(error: unknown): QaFormResult<never>;

package/lib/types/forms/gate.d.ts

@@ -1,12 +1,13 @@
 import type { Context } from "@deepseek-ai/cordis";
 import type { ToolExecution } from "@deepseek-ai/dsh-tools";
 import type { QaFormService } from "./service.js";
-import type { QaFormRecord, QaFormSubmission } from "./types.js";
-type Outcome = QaFormSubmission | {
+import type { QaFormRecord, QaFormSubmission, QaFormValidation } from "./types.js";
+type CollectionOutcome = QaFormSubmission | {
     status: "paused";
     form_id: string;
     reason: string;
 };
+type Outcome = CollectionOutcome | QaFormValidation;
 /** A parked tool call is transient. Never reconstruct one from a saved draft. */
 export declare class QaFormGate {
     readonly service: () => QaFormService;
@@ -22,6 +23,7 @@ export declare class QaFormGate {
     install(ctx: Context): void;
     waiting(id: string): boolean;
     touch(session: string): void;
+    private clientReady;
     hasSession(session: string): boolean;
     request(raw: unknown, exec: ToolExecution): Promise<Outcome>;
     notify(record: QaFormRecord, pause?: boolean): void;

package/lib/types/forms/schema-errors.d.ts

@@ -0,0 +1,7 @@
+import type { z } from "zod";
+import { QaFormError } from "./errors.js";
+import type { QaFormSchemaIssue } from "./types.js";
+/** Report locations and constraints, never copy input values into diagnostics. */
+export declare function formSchemaError(issues: QaFormSchemaIssue[]): QaFormError;
+export declare function formSchemaIssues(issues: z.ZodError["issues"]): QaFormSchemaIssue[];
+//# sourceMappingURL=schema-errors.d.ts.map

package/lib/types/forms/types.d.ts

@@ -106,6 +106,19 @@ export interface QaFormFieldError {
     code: string;
     message: string;
 }
+export interface QaFormSchemaIssue {
+    path: string;
+    code: string;
+    message: string;
+}
+export interface QaFormValidation {
+    status: "validated";
+    valid: boolean;
+    interactive_client_ready: boolean;
+    file_upload_available: boolean;
+    policy: Readonly<QaFormPolicy>;
+    issues: QaFormSchemaIssue[];
+}
 export interface QaFormSubmission {
     status: "submitted";
     form_id: string;
@@ -182,6 +195,7 @@ export type QaFormResult<T> = {
         message: string;
         form_revision?: number;
         field_errors?: QaFormFieldError[];
+        schema_errors?: QaFormSchemaIssue[];
     };
 };
 /**

package/lib/types/index.d.ts

@@ -1,12 +1,14 @@
+import type { QaChatCodeSources } from "./types/code-sources.js";
 import type { QaChatAccess, QaChatGrant, QaChatMode, QaChatAuthor, QaChatJson } from "./chat-sharing/types.js";
 import type { SessionPageRequest, SessionFollowRequest, SessionPromptRequest, SessionPromptValue, SessionAttachmentRequest, SessionAttachmentValue, SessionRenameRequest, SessionRenameValue, SessionCancelValue, SessionUpdateQueueRequest, SessionUpdateQueueValue, SessionSearchRequest, SessionSelectModelRequest, SessionSelectModelValue } from "@deepseek-ai/dsh-api-session-controller/types";
 import { TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
 import type { Context } from "@deepseek-ai/cordis";
 import type { QaSurfaceConfigRefs } from "./config.js";
 import type { QaFormCommand, QaFormResult, QaFormView } from "./forms/types.js";
+import type { QaModelOptions } from "./types.js";
 import type { QaAccountNotificationsInput } from "./types.js";
 import type { QaTurnSources } from "./provenance/types.js";
-import type { QaAccountProfileInput, QaAccountSession, QaAccountStartersInput, QaAccountUserPublic, QaApprovalDecision, QaClaimResult, QaDocumentPreview, QaSpreadsheetPreviewSelection, QaDocumentWorkflowStatus, QaIssuedServiceToken, QaLockdownProof, QaOwnershipEntry, QaPasswordResetRequest, QaPendingApproval, QaPendingQuestion, QaQuestionAnswerItem, QaQueueStatus, QaServiceTokenCreateInput, QaServiceTokenSummary, ResolvedQaSurfaceConfig, QaAdminSkillScope, QaAdminSkillsView, QaExpertMemoryDraft, QaExpertMemoryPage, QaExpertMemoryRecord, QaExpertMemoryScope, QaSkillDocument, QaSkillDraftInput, QaSkillRemoval, QaSkillSummary, QaSkillToolDescriptor, QaSkillValidation, QaSourceFilePreview, QaWhoamiResult, QaWorkspaceFile, QaWorkspaceFileChunk, QaWorkspaceListing, QaPrincipal, QaAccessAdminSnapshot, QaAdminAuditEvent, QaAdminOverview, QaAdminPage, QaAdminUserDetail, QaAdminUserRow, QaAdminUserUpdate, QaAuditQuery, QaCapabilitySelection, QaConversationDetail, QaConversationDeletion, QaConversationQuery, QaConversationReview, QaConversationReviewInput, QaConversationSummary, QaCurrentAccess, QaFeedbackHarvestEntry, QaFeedbackHarvestResult, QaFeedbackQuery, QaFeedbackRow, QaMessageFeedback, QaMessageFeedbackInput, QaModelCatalogEntry, QaModelPair, QaQualityMetrics, QaReviewQueueItem, QaReviewQueueRow, QaSessionAccess, QaSlashCatalog, QaSlashExecution, QaSlashSubmitAttachment, QaSkillActivationRecord, QaSkillAssignmentOverride, QaSubrole, QaUserAccess, QaUserQuery } from "./types.js";
+import type { QaAccountProfileInput, QaAccountSession, QaAccountStartersInput, QaAccountUserPublic, QaApprovalDecision, QaClaimResult, QaDocumentPreview, QaSpreadsheetPreviewSelection, QaDocumentWorkflowStatus, QaIssuedServiceToken, QaHistoryFolderTarget, QaOwnedSessionsResult, QaLockdownProof, QaOwnershipEntry, QaPasswordResetRequest, QaPendingApproval, QaPendingQuestion, QaQuestionAnswerItem, QaQueueStatus, QaServiceTokenCreateInput, QaServiceTokenSummary, ResolvedQaSurfaceConfig, QaAdminSkillScope, QaAdminSkillsView, QaExpertMemoryDraft, QaExpertMemoryPage, QaExpertMemoryRecord, QaExpertMemoryScope, QaSkillDocument, QaSkillDraftInput, QaSkillRemoval, QaSkillSummary, QaSkillToolDescriptor, QaSkillValidation, QaSourceFilePreview, QaWhoamiResult, QaWorkspaceFile, QaWorkspaceFileChunk, QaWorkspaceListing, QaPrincipal, QaAccessAdminSnapshot, QaAdminAuditEvent, QaAdminOverview, QaAdminPage, QaAdminUserDetail, QaAdminUserRow, QaAdminUserUpdate, QaAuditQuery, QaCapabilitySelection, QaConversationDetail, QaConversationDeletion, QaConversationQuery, QaConversationReview, QaConversationReviewInput, QaConversationSummary, QaCurrentAccess, QaFeedbackHarvestEntry, QaFeedbackHarvestResult, QaFeedbackQuery, QaFeedbackRow, QaMessageFeedback, QaMessageFeedbackInput, QaModelCatalogEntry, QaModelPair, QaQualityMetrics, QaReviewQueueItem, QaReviewQueueRow, QaSessionAccess, QaSlashCatalog, QaSlashExecution, QaSlashSubmitAttachment, QaSkillActivationRecord, QaSkillAssignmentOverride, QaSubrole, QaUserAccess, QaUserQuery } from "./types.js";
 export declare const name = "qa-surface";
 export declare const inject: string[];
 import { QA_SURFACE_SETTINGS_NAMESPACE } from "./shared/settings.js";
@@ -19,6 +21,8 @@ declare module "@deepseek-ai/cordis" {
 }
 /** Host companion: validates config, owns the admission boundary and the route. */
 export declare class QaSurface extends TypertRemoteService {
+    private sourceSelections?;
+    private codeSourceStore;
     static inject: string[];
     static Config: import("@deepseek-ai/schemastery").default<QaSurfaceConfigRefs>;
     private readonly source;
@@ -126,6 +130,11 @@ export declare class QaSurface extends TypertRemoteService {
      * @param sessionId - the chat the work is delegated from.
      */
     modelPolicyForSession(sessionId: string): QaModelPair | undefined;
+    /** Shared source catalogue consumed by preset-mounted Git tools at call time. */
+    getCodeSources(sessionId?: string): ResolvedQaSurfaceConfig["codeSources"];
+    getSelectedCodeSource(sessionId: string): string | null;
+    chatCodeSources(token: string, sessionId: string): Promise<QaChatCodeSources>;
+    chatSelectCodeSource(token: string, sessionId: string, source: string | null): Promise<QaChatCodeSources>;
     getConfig(): ResolvedQaSurfaceConfig;
     /**
      * Ownership plus the role's user-skill grant for one slash read.
@@ -172,9 +181,7 @@ export declare class QaSurface extends TypertRemoteService {
      */
     accountsClaimSessions(token: string, sessionIds: readonly string[]): QaClaimResult;
     /** The token user's owned session ids; the sidebar list authority. */
-    accountsOwnedSessions(token: string): {
-        readonly ids: readonly string[];
-    };
+    accountsOwnedSessions(token: string): QaOwnedSessionsResult;
     /**
      * Every chat-ownership entry with owner display names; the cross-user view
      * admin browsers group the sidebar by. Ordinary accounts are refused with
@@ -229,6 +236,9 @@ export declare class QaSurface extends TypertRemoteService {
     accountsSetServiceTokenClarifications(token: string, tokenId: string, allowed: boolean): {
         readonly updated: boolean;
     };
+    accountsSetServiceTokenHistoryFolder(token: string, tokenId: string, folder: QaHistoryFolderTarget | null): {
+        readonly updated: boolean;
+    };
     /**
      * Serve the effective QA configuration to the browser. The DSH gateway pins
      * settings RPCs to loopback, so a browser served over the LAN always sees
@@ -241,8 +251,30 @@ export declare class QaSurface extends TypertRemoteService {
      * Report server admission. Global reads expose counts only; a chat's FIFO
      * position requires that account's current read access to the chat. The
      * scheduler gates every root turn, including native and integration sends.
+     *
+     * Both arguments are part of the wire contract: the gateway client counts
+     * declared parameters rather than TypeScript optionals, so a call that omits
+     * them is refused on the browser before the Host ever sees it. An empty
+     * session id is the global read — the shape every initial send asks for,
+     * while its draft chat has no session to name yet.
+     */
+    queueStatus(token: string, sessionId: string): QaQueueStatus;
+    /**
+     * The ceiling this read answers against: the chat's own account chain when
+     * the read names a chat, the caller's account chain when it does not (the
+     * pre-send check carries a token but no chat yet), and the deployment's
+     * number whenever accounts are off or nobody matches. `undefined` is the
+     * scheduler's signal to fall back to that number, so the branch is a value
+     * rather than a flag.
+     */
+    private queueCeiling;
+    /**
+     * The ceiling override one arriving turn fills against, or `undefined` when
+     * the deployment default governs it: without accounts every turn shares the
+     * one number, and an unowned session (an integration or an admin preview)
+     * stays in that shared pool whatever its role might say.
      */
-    queueStatus(token?: string, sessionId?: string): QaQueueStatus;
+    private queueSlotsOverride;
     /**
      * Create a QA session from Host-owned inputs. With account workspaces on,
      * cwd is `<configured workspace>/.qa-users/<account UUID>` and the child is
@@ -261,6 +293,7 @@ export declare class QaSurface extends TypertRemoteService {
     accessUpdateSubrole(token: string, id: string, input: QaSubrole): Promise<QaSubrole>;
     /** The pairs this Host can serve, for the surface that writes a policy. */
     accessModelCatalog(token: string): Promise<readonly QaModelCatalogEntry[]>;
+    accessUserModels(token: string, sessionId: string | null, subroleId: string | null, adminPreview: boolean): Promise<QaModelOptions>;
     accessDeleteSubrole(token: string, id: string, replacementId: string | null): {
         readonly deleted: boolean;
     };

package/lib/types/integration/http.d.ts

@@ -4,8 +4,6 @@ import type { PluginLogger } from "@yadsh/dsh-plugin-log";
 import type { ResolvedQaSurfaceConfig } from "../types.js";
 import { type QaAskRequest } from "./contract.js";
 import type { QaIntegrationService } from "./service.js";
-/** The bridge's own ceiling: five attachments per question. */
-export declare const QA_INTEGRATION_MAX_FILES = 5;
 export interface QaIntegrationRouteOptions {
     config: ResolvedQaSurfaceConfig;
     service: QaIntegrationService;
@@ -59,7 +57,7 @@ interface MultipartBody {
  * @param boundary - the boundary parameter of the content type.
  * @returns text fields and file parts, in the order they appeared.
  */
-export declare function parseMultipart(body: Buffer, boundary: string): MultipartBody;
+export declare function parseMultipart(body: Buffer, boundary: string, maxAttachments?: number): MultipartBody;
 /**
  * Read the whole request body under a byte ceiling.
  * @param request - the incoming request.

package/lib/types/integration/service.d.ts

@@ -1,5 +1,6 @@
 import type { PluginLogger } from "@yadsh/dsh-plugin-log";
 import type { QaAccounts } from "../accounts/store.js";
+import type { QaHistoryFolderTarget } from "../types/accounts.js";
 import { type QaServiceTokenScope } from "../accounts/service-token.js";
 import type { QaSourceReference } from "../provenance/types.js";
 import type { ResolvedQaSurfaceConfig } from "../types.js";
@@ -31,6 +32,7 @@ export declare const QA_INTEGRATION_MAX_CITATIONS = 5;
 export declare function sourceCitations(sources: readonly QaSourceReference[]): readonly string[];
 /** Who a presented credential turned out to be. */
 export interface QaIntegrationIdentity {
+    readonly historyFolder?: QaHistoryFolderTarget;
     readonly allowClarifications: boolean;
     readonly tokenId: string;
     readonly userId: string;

package/lib/types/personal-skills/shared-seed.d.ts

@@ -0,0 +1,12 @@
+import type { PluginLogger } from "@yadsh/dsh-plugin-log";
+import type { ResolvedQaSurfaceConfig } from "../types.js";
+import { type QaSkillRoots } from "./paths.js";
+/**
+ * Promote an operator-selected subset of a read-only catalog into the shared
+ * store. Copy complete directories, including resources, before publishing a
+ * skill. Neither a restart, an updated seed nor an editor deletion restores
+ * the original bytes: a hidden per-name receipt survives rename and removal.
+ * Existing shared directories always belong to the operator and win as-is.
+ */
+export declare function seedSharedSkills(roots: QaSkillRoots, seed: ResolvedQaSurfaceConfig["accounts"]["skills"]["sharedSeed"], logger: PluginLogger): boolean;
+//# sourceMappingURL=shared-seed.d.ts.map

package/lib/types/prompt-notes.d.ts

@@ -32,6 +32,7 @@ export declare const QA_DOCUMENTS_NOTE = "dsh-qa-surface:attached-documents";
 /** Note name carrying the deployment's rule about where an answer comes from. */
 export declare const QA_SOURCE_PRIORITY_NOTE = "dsh-qa-surface:source-priority";
 export declare const QA_BRANCH_NOTE = "dsh-qa-surface:chat-branch";
+export declare const QA_CODE_SOURCES_NOTE = "dsh-qa-surface:code-sources";
 /**
  * Built-in note texts. Each is the fallback for its settings template
  * (`notes.*.template`); the placeholders mark the parts the injector
@@ -40,8 +41,8 @@ export declare const QA_BRANCH_NOTE = "dsh-qa-surface:chat-branch";
 export declare const QA_IDENTITY_NOTE_TEMPLATE = "{identity}\n\n{instructions}";
 export declare const QA_SOURCES_NOTE_TEMPLATE = "Source provenance is collected automatically from your tool calls; the QA surface lists what it collected beside the answer. Do not append a manual Sources/\u0418\u0441\u0442\u043E\u0447\u043D\u0438\u043A\u0438 bibliography of your own.";
 export declare const QA_SOURCES_FALLBACK_TEMPLATE = "A delegated run whose provider cannot expose tool events must call {reportTool} before finishing.";
-export declare const QA_DELEGATION_NOTE_TEMPLATE = "When you start a background subagent, give the delegation a short vivid name in its description field: two or three words in the user's language that say what the run is for (\u00AB\u0421\u0432\u0435\u0440\u043A\u0430 \u043E\u0442\u0447\u0451\u0442\u043E\u0432\u00BB, \"Log triage\"). The QA surface shows that description as the subagent's display name in the operator's panel and completion notices.";
-export declare const QA_DOCUMENTS_NOTE_TEMPLATE = "A document a chat user attached is a path on disk, not text: read it with the deployment's document pipeline \u2014 `document_inspect` says what a DOCX or PDF is, `document_to_markdown` extracts its text, `document_from_url` stores the text of an attachment that only exists behind a URL. For XLSX, CSV, TSV, ODS or FODS, `spreadsheet_inspect` lists all sheets and detects text delimiter/encoding, `spreadsheet_read` reads pages, and `spreadsheet_create` creates a file in the selected format. CSV/TSV have one Data sheet with string fields; reuse detected delimiter and encoding when paging. XLSX/ODS/FODS support multiple sheets. Inspect all sheet names before selecting data; formula values are saved caches, not recalculated results. The plain file reader refuses those formats as binary, so that refusal is expected and is not a hint to go looking for the file somewhere else. When the pipeline itself refuses a path, report the refusal and the path it named instead of trying another reader.";
+export declare const QA_DELEGATION_NOTE_TEMPLATE: string;
+export declare const QA_DOCUMENTS_NOTE_TEMPLATE: string;
 export declare const QA_SOURCE_PRIORITY_NOTE_TEMPLATE = "Answer from the source that owns the question: read what the conversation and its attachments already carry, then search the product documentation and ask the domain expert, and only then look in memory. Recalled memory is background from earlier sessions \u2014 a miss there is not evidence that no source exists, and it is not where a document, a page or a product fact should be looked up.";
 export interface QaIdentityRenderInput {
     /** The owner's account address; the one fact accounts always provide. */
@@ -71,6 +72,7 @@ export interface QaPromptNote {
     readonly text: string;
 }
 export interface QaPromptNotesOptions {
+    readonly codeSources?: (sessionId: string) => import("@yadsh/dsh-plugin-kit/code-sources").CodeSourcesCatalog;
     readonly config: () => ResolvedQaSurfaceConfig;
     /** The live accounts store, or undefined while accounts are disabled. */
     readonly accounts: () => QaAccounts | undefined;
@@ -116,6 +118,8 @@ export declare class QaPromptNotes {
     dispose(): void;
     /** Append every note whose text this step does not already carry. */
     private inject;
+    /** Keep Git and file lookups on the same configured tree, including in children. */
+    private codeSourceNotes;
     /** Who is asking: the owner's name, handles and their own instructions. */
     private identityNotes;
     /** What the deployment expects around the sources the surface collects. */

package/lib/types/qa-tools/catalog.d.ts

@@ -1,6 +1,8 @@
+import type { CodeFilesOptions } from "./code-files.js";
 import type { Agent } from "@deepseek-ai/dsh-agent";
 import type { QaToolDescriptor } from "./types.js";
 import type { QaFormGate } from "../forms/gate.js";
+import { type QaSubagentToolsOptions } from "./subagent-tools.js";
 /**
  * Deterministic catalog identity. The durable activation marker is derived from
  * the session log rather than stored, so this version is not compared against a
@@ -9,9 +11,10 @@ import type { QaFormGate } from "../forms/gate.js";
  *
  * Bump it whenever the catalog's tool set or their schemas change.
  */
-export declare const QA_TOOL_CATALOG_VERSION = "4";
+export declare const QA_TOOL_CATALOG_VERSION = "6";
 /** What the catalog's definitions read, beyond the execution record. */
-export interface QaToolsSelfcheckDeps {
+export interface QaToolsSelfcheckDeps extends CodeFilesOptions {
+    readonly subagents?: QaSubagentToolsOptions;
     readonly forms?: QaFormGate;
     readonly formProjection?: (submission: import("../forms/types.js").QaFormSubmission, sessionId: string) => Promise<unknown>;
     readonly catalogVersion: string;

package/lib/types/qa-tools/code-files.d.ts

@@ -0,0 +1,59 @@
+import { type CodeSource, type CodeSourcesCatalog } from "@yadsh/dsh-plugin-kit/code-sources";
+export interface CodeExecution {
+    readonly agent?: {
+        readonly session?: {
+            readonly id?: unknown;
+            readonly header?: {
+                readonly cwd?: unknown;
+            };
+        };
+    };
+}
+export interface CodeFilesOptions {
+    readonly codeSources?: ((exec?: CodeExecution) => CodeSourcesCatalog) | undefined;
+    readonly codeReadRoots?: (() => readonly string[]) | undefined;
+}
+export interface CodeScope {
+    readonly source: CodeSource;
+    readonly root: string;
+}
+/** Selection and authorization are separate, including after following root links. */
+export declare function codeScope(options: CodeFilesOptions, exec: CodeExecution, requested?: unknown): Promise<CodeScope>;
+export declare function boundedInteger(value: unknown, fallback: number, max: number): number;
+/** Read a bounded window, with the selected identity on every result. */
+export declare function readCode(scope: CodeScope, args: {
+    path?: unknown;
+    from?: unknown;
+    lines?: unknown;
+}): Promise<{
+    source: string;
+    label: string;
+    root: string;
+    path: string;
+    absolutePath: string;
+    from: number;
+    to: number;
+    totalLines: number;
+    text: string;
+    truncated: boolean;
+}>;
+/** Literal search in one tree; entry, file, content, time and output budgets are fixed. */
+export declare function searchCode(scope: CodeScope, args: {
+    query?: unknown;
+    path?: unknown;
+    limit?: unknown;
+}): Promise<{
+    source: string;
+    label: string;
+    root: string;
+    query: string;
+    hits: {
+        path: string;
+        line: number;
+        text: string;
+    }[];
+    filesScanned: number;
+    skipped: number;
+    truncated: boolean;
+}>;
+//# sourceMappingURL=code-files.d.ts.map

package/lib/types/qa-tools/code-tools.d.ts

@@ -0,0 +1,7 @@
+import { type ToolDefinition } from "@deepseek-ai/dsh-tools";
+import { type CodeFilesOptions } from "./code-files.js";
+/** Discovery reports availability in this session without granting new roots. */
+export declare function createCodeSourcesTool(options: CodeFilesOptions): ToolDefinition;
+export declare function createCodeReadTool(options: CodeFilesOptions): ToolDefinition;
+export declare function createCodeSearchTool(options: CodeFilesOptions): ToolDefinition;
+//# sourceMappingURL=code-tools.d.ts.map

package/lib/types/qa-tools/docs-tools.d.ts

@@ -1,4 +1,5 @@
 import type { ToolDefinition } from "@deepseek-ai/dsh-tools";
+import { type CodeSourcesCatalog } from "@yadsh/dsh-plugin-kit/code-sources";
 /**
  * `docs_search` and `docs_read` — the documentation surface of the QA catalog.
  *
@@ -73,6 +74,7 @@ interface QaDocsExecution {
  * comes from configuration instead of from the calling chat.
  */
 export interface QaDocsOptions {
+    readonly codeSources?: ((exec?: import("./code-files.js").CodeExecution) => CodeSourcesCatalog) | undefined;
     /** Absolute documentation root, or `""` for `<chat workspace>/docs`. */
     readonly root?: string;
     /**
@@ -112,6 +114,7 @@ export interface QaDocsHit extends QaDocsIdentity {
 }
 /** The outcome of one documentation search. */
 export interface QaDocsSearchResult extends QaDocsIdentity {
+    readonly source?: string;
     readonly query: string;
     /** The directory documentation is read from, relative to the workspace. */
     readonly root: string;
@@ -122,6 +125,7 @@ export interface QaDocsSearchResult extends QaDocsIdentity {
 }
 /** The outcome of one documentation read. */
 export interface QaDocsReadResult extends QaDocsIdentity {
+    readonly source?: string;
     readonly path: string;
     /** Actual read target, kept out of the model-facing rendering. */
     readonly absolutePath: string;

package/lib/types/qa-tools/file-write-gate.d.ts

@@ -0,0 +1,6 @@
+import type { Context } from "@deepseek-ai/cordis";
+import type { QaSessionOwnership } from "../session-ownership.js";
+import type { QaFileWritePolicy } from "../shared/file-write-policy.js";
+/** Global monotonic guard: covers attested roots, children and nested dispatch. */
+export declare function installQaFileWriteGate(ctx: Context, ownership: QaSessionOwnership, policy: () => QaFileWritePolicy): () => void;
+//# sourceMappingURL=file-write-gate.d.ts.map

package/lib/types/qa-tools/index.d.ts

@@ -3,6 +3,9 @@ import type { Context } from "@deepseek-ai/cordis";
 import type { PluginLogger } from "@yadsh/dsh-plugin-log";
 import type { QaToolActivation } from "./types.js";
 export interface QaToolsOptions {
+    readonly subagents?: import("./subagent-tools.js").QaSubagentToolsOptions;
+    readonly codeSources?: import("./code-files.js").CodeFilesOptions["codeSources"];
+    readonly codeReadRoots?: () => readonly string[];
     readonly forms?: import("../forms/gate.js").QaFormGate;
     readonly formsEnabled?: () => boolean;
     readonly formProjection?: (submission: import("../forms/types.js").QaFormSubmission, sessionId: string) => Promise<unknown>;

package/lib/types/qa-tools/subagent-tools.d.ts

@@ -0,0 +1,40 @@
+import type { Context } from "@deepseek-ai/cordis";
+import type { Agent, AgentOptions } from "@deepseek-ai/dsh-agent";
+import { type ContentBlock } from "@deepseek-ai/dsh-llm";
+import type { ToolDefinition } from "@deepseek-ai/dsh-tools";
+import { type QaSessionModelPolicy } from "../access/model-policy.js";
+/** Optional Host service: loading QA does not require a subagent backend. */
+export interface QaSubagentsFace {
+    getProvider(name: string): {
+        readonly capabilities: {
+            readonly agentOptions: boolean;
+            readonly depthLimit: boolean;
+        };
+    } | undefined;
+    resolveMaxDepth(value: undefined): number | undefined;
+    startActivation(spec: {
+        readonly provider: string;
+        readonly label: string;
+        readonly signal: AbortSignal;
+        readonly delivery: "parent";
+        readonly request: {
+            readonly parent: Agent;
+            readonly prompt: ContentBlock[];
+            readonly agentOptions: AgentOptions;
+            readonly maxDepth?: number;
+        };
+    }): Promise<{
+        readonly childId: string;
+    }>;
+}
+export interface QaSubagentToolsOptions {
+    readonly ctx: Context;
+    /** Must reject a caller outside an attested QA conversation. */
+    readonly policy: (agent: Agent) => QaSessionModelPolicy;
+    readonly runtime: () => QaSubagentsFace | undefined;
+}
+/** Only live catalog entries covered by the owner's current model grants. */
+export declare function createQaListSubagentModelsTool(options: QaSubagentToolsOptions): ToolDefinition;
+/** Start a fresh native child, with route authority supplied by QA ownership. */
+export declare function createQaSubagentTool(options: QaSubagentToolsOptions): ToolDefinition;
+//# sourceMappingURL=subagent-tools.d.ts.map