@yadsh/dsh-qa-surface 0.2.0 → 0.4.0

package/lib/types/thinking-phrases.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Phrases the running indicator cycles through. The list deliberately mixes
+ * Russian idiom with workshop imagery: a turn that keeps reshuffling the same
+ * thought in new words reads as alive, while a frozen one reads as stuck.
+ *
+ * Operators replace the list through `thinkingPhrases`; this module holds the
+ * canonical default so the config schema, the resolver and the browser all
+ * read one list.
+ */
+export declare const DEFAULT_THINKING_PHRASES: readonly string[];
+/**
+ * Phrase shown `elapsedMs` into a running turn. The list is operator supplied,
+ * so an empty one falls back to the default: the indicator always needs a
+ * label.
+ */
+export declare function thinkingPhrase(elapsedMs: number, phrases?: readonly string[]): string;
+//# sourceMappingURL=thinking-phrases.d.ts.map

package/lib/types/types.d.ts

@@ -1,7 +1,117 @@
+import type { QaTurnSources } from "./provenance/types.js";
 export type QaSessionPolicy = "browser-persistent" | "new-on-load" | "fixed";
-export type QaSandboxMode = "read-only";
+export type QaSandboxMode = "read-only" | "workspace-write";
 export type QaApprovalPolicy = "never";
 export type QaToolPolicyMode = "allow-list";
+export type QaAccountRole = "user" | "admin";
+/** The account fields projected to browsers; never includes credentials. */
+export interface QaAccountUserPublic {
+    readonly id: string;
+    readonly email: string;
+    readonly displayName: string;
+    readonly role: QaAccountRole;
+    readonly createdAt: string;
+    readonly lastLoginAt: string | null;
+    readonly disabled: boolean;
+    /** Self-declared identity the QA prompt renders; empty until edited. */
+    readonly profile: QaAccountProfile;
+}
+/** One external system the deployment collects a handle for. */
+export interface QaAccountIdentityField {
+    /** Stable lowercase key: the profile's storage key and the prompt's label. */
+    readonly key: string;
+    /** Operator copy shown in the profile form. */
+    readonly label: string;
+}
+/**
+ * What one account says about itself. Every value is the owner's own wording,
+ * which is why the prompt renders it as self-declared rather than as a
+ * verified directory attribute.
+ */
+export interface QaAccountProfile {
+    /** Full name as the user writes it; empty when unset. */
+    readonly fullName: string;
+    /** External-system handles, keyed by the declared field key. */
+    readonly identities: Readonly<Record<string, string>>;
+    /** Free-form guidance about how the user wants answers; empty when unset. */
+    readonly instructions: string;
+    /** ISO timestamp of the last edit; null while the profile is untouched. */
+    readonly updatedAt: string | null;
+}
+/** Full-replace profile write: an absent value clears the stored one. */
+export interface QaAccountProfileInput {
+    readonly fullName: string;
+    readonly identities: Readonly<Record<string, string>>;
+    readonly instructions: string;
+}
+/** One successful login/registration: the bearer token plus the user. */
+export interface QaAccountSession {
+    readonly token: string;
+    readonly user: QaAccountUserPublic;
+}
+export type QaWhoamiResult = {
+    readonly authenticated: false;
+} | {
+    readonly authenticated: true;
+    readonly user: QaAccountUserPublic;
+};
+/** Bulk ownership claim outcome for one browser's local chat index. */
+export interface QaClaimResult {
+    readonly claimed: number;
+    /** Ids already owned by a different user; the browser drops them. */
+    readonly conflicts: readonly string[];
+}
+/**
+ * One chat-ownership entry as the admin views see it: the session, its owner
+ * and the owner's display name resolved at read time (a disabled account
+ * still names its chats).
+ */
+export interface QaOwnershipEntry {
+    readonly sessionId: string;
+    readonly userId: string;
+    readonly displayName: string;
+    readonly claimedAt: string;
+}
+export interface QaSourcesConfig {
+    readonly enabled?: boolean;
+    readonly collect?: {
+        readonly parentAgent?: boolean;
+        readonly subagents?: boolean;
+        readonly persistTurnEvent?: boolean;
+    };
+    readonly display?: {
+        readonly sidebar?: boolean;
+        readonly footer?: boolean;
+        readonly groupByKind?: boolean;
+        readonly showDiscovered?: boolean;
+        readonly showOriginBadges?: boolean;
+        readonly maxInitiallyVisiblePerGroup?: number;
+    };
+    readonly webSearch?: {
+        readonly promoteSearchResultsWithoutFetch?: boolean;
+        readonly maxPromotedPerSearch?: number;
+    };
+    readonly dedupe?: {
+        readonly normalizeUrls?: boolean;
+        readonly stripTrackingParams?: boolean;
+        readonly mergeFileRanges?: boolean;
+    };
+    readonly filePreview?: {
+        readonly enabled?: boolean;
+        readonly markdownRenderedByDefault?: boolean;
+        readonly allowRawToggle?: boolean;
+        readonly maxBytes?: number;
+        readonly maxMarkdownRenderBytes?: number;
+    };
+    readonly subagents?: {
+        readonly inheritSources?: boolean;
+        readonly enableReportToolFallback?: boolean;
+        readonly markIncompleteOpaqueRuns?: boolean;
+    };
+    readonly legacy?: {
+        readonly parseAssistantSourcesBlock?: boolean;
+    };
+}
 export interface QaSurfaceConfig {
     readonly enabled?: boolean;
     readonly route?: {
@@ -37,10 +147,16 @@ export interface QaSurfaceConfig {
         readonly showToolActivity?: boolean;
         readonly showReasoning?: boolean;
         readonly renderMarkdown?: boolean;
-        readonly maxContentWidth?: number;
+        /** Floor for the visitor-resizable transcript/composer width; the page caps it. */
+        readonly minContentWidth?: number;
         readonly showSessionList?: boolean;
     };
     readonly suggestedQuestions?: readonly string[];
+    /**
+     * Phrases the running indicator cycles through. An empty list restores the
+     * built-in phrases: the indicator always carries a label.
+     */
+    readonly thinkingPhrases?: readonly string[];
     readonly interaction?: {
         readonly approvals?: "blocked";
         readonly questions?: "unsupported";
@@ -68,6 +184,59 @@ export interface QaSurfaceConfig {
     readonly embedding?: {
         readonly frameAncestors?: string | null;
     };
+    readonly accounts?: {
+        /** Opt-in; the QA gate stays off until the deployment turns this on. */
+        readonly enabled?: boolean;
+        readonly allowRegistration?: boolean;
+        readonly sessionTtlDays?: number;
+        /** Let admins see chats owned by other QA accounts. */
+        readonly showOtherUsersChats?: boolean;
+        /**
+         * Give every account a private cwd below the configured workspaceId.
+         * The child directory is not registered as a separate DSH workspace.
+         */
+        readonly perUserWorkspace?: boolean;
+        /** Self-declared profile: storage, the owner's form, and prompt injection. */
+        readonly profile?: {
+            readonly enabled?: boolean;
+            /** Render the profile into the QA agent's system prompt. */
+            readonly inject?: boolean;
+            /** External systems to collect a handle for; empty declares none. */
+            readonly identities?: readonly {
+                readonly key?: string;
+                readonly label?: string;
+            }[];
+            /** Character cap on the user's free-form agent guidance. */
+            readonly instructionsMaxLength?: number;
+        };
+    };
+    readonly entry?: {
+        /** Inject the root → /qa redirect for non-loopback hostnames. */
+        readonly redirectNonLoopback?: boolean;
+        /** Cookie-less /qa navigations go through the one-time ?token= exchange. */
+        readonly cookieBootstrap?: boolean;
+    };
+    readonly sources?: QaSourcesConfig;
+    readonly attachments?: QaAttachmentsConfig;
+}
+/** What a QA visitor may attach to one message. */
+export interface QaAttachmentsConfig {
+    /** Offer text files (md, txt, log, …) next to images; off = images only. */
+    readonly textFiles?: boolean;
+    /**
+     * Line count above which pasted plain text becomes an attached file instead
+     * of landing in the input field. Zero never converts.
+     */
+    readonly pastedTextLines?: number;
+    /** Byte ceiling for one attached file; the composer refuses anything larger. */
+    readonly maxFileBytes?: number;
+    /**
+     * Pending attachments (images plus text files) allowed on one message. The
+     * Host keeps its own authority over assembled image batches.
+     */
+    readonly maxPending?: number;
+    /** Accepted text-file extensions, lowercase and without the dot. */
+    readonly extensions?: readonly string[];
 }
 export interface ResolvedQaSurfaceConfig {
     readonly enabled: boolean;
@@ -102,10 +271,11 @@ export interface ResolvedQaSurfaceConfig {
         readonly showToolActivity: boolean;
         readonly showReasoning: boolean;
         readonly renderMarkdown: boolean;
-        readonly maxContentWidth: number;
+        readonly minContentWidth: number;
         readonly showSessionList: boolean;
     };
     readonly suggestedQuestions: readonly string[];
+    readonly thinkingPhrases: readonly string[];
     readonly interaction: {
         readonly approvals: "blocked";
         readonly questions: "unsupported";
@@ -133,6 +303,78 @@ export interface ResolvedQaSurfaceConfig {
     readonly embedding: {
         readonly frameAncestors: string | null;
     };
+    readonly accounts: {
+        readonly enabled: boolean;
+        readonly allowRegistration: boolean;
+        readonly sessionTtlDays: number;
+        readonly showOtherUsersChats: boolean;
+        readonly perUserWorkspace: boolean;
+        readonly profile: {
+            readonly enabled: boolean;
+            readonly inject: boolean;
+            readonly identities: readonly QaAccountIdentityField[];
+            readonly instructionsMaxLength: number;
+        };
+    };
+    readonly entry: {
+        readonly redirectNonLoopback: boolean;
+        readonly cookieBootstrap: boolean;
+    };
+    readonly sources: {
+        readonly enabled: boolean;
+        readonly collect: {
+            readonly parentAgent: boolean;
+            readonly subagents: boolean;
+            readonly persistTurnEvent: boolean;
+        };
+        readonly display: {
+            readonly sidebar: boolean;
+            readonly footer: boolean;
+            readonly groupByKind: boolean;
+            readonly showDiscovered: boolean;
+            readonly showOriginBadges: boolean;
+            readonly maxInitiallyVisiblePerGroup: number;
+        };
+        readonly webSearch: {
+            readonly promoteSearchResultsWithoutFetch: boolean;
+            readonly maxPromotedPerSearch: number;
+        };
+        readonly dedupe: {
+            readonly normalizeUrls: boolean;
+            readonly stripTrackingParams: boolean;
+            readonly mergeFileRanges: boolean;
+        };
+        readonly filePreview: {
+            readonly enabled: boolean;
+            readonly markdownRenderedByDefault: boolean;
+            readonly allowRawToggle: boolean;
+            readonly maxBytes: number;
+            readonly maxMarkdownRenderBytes: number;
+        };
+        readonly subagents: {
+            readonly inheritSources: boolean;
+            readonly enableReportToolFallback: boolean;
+            readonly markIncompleteOpaqueRuns: boolean;
+        };
+        readonly legacy: {
+            readonly parseAssistantSourcesBlock: boolean;
+        };
+    };
+    readonly attachments: {
+        readonly textFiles: boolean;
+        readonly pastedTextLines: number;
+        readonly maxFileBytes: number;
+        readonly maxPending: number;
+        readonly extensions: readonly string[];
+    };
+}
+export interface QaSourceFilePreview {
+    readonly path: string;
+    readonly content: string;
+    readonly size: number;
+    readonly truncated: boolean;
+    readonly markdown: boolean;
+    readonly renderableMarkdown: boolean;
 }
 /** Host-attested facts required before the QA composer may become writable. */
 export interface QaLockdownProof {
@@ -141,7 +383,7 @@ export interface QaLockdownProof {
     readonly agentPresetMatches: boolean;
     readonly workspaceMatches: boolean;
     readonly modelMatches: boolean;
-    readonly sandboxIsReadOnly: boolean;
+    readonly sandboxModeMatches: boolean;
     readonly approvalIsNever: boolean;
     readonly permissionPreset: string;
     readonly toolPolicyLoaded: boolean;
@@ -154,6 +396,13 @@ export type QaMessage = {
     readonly status: "committed";
     readonly timestamp?: number;
     readonly images?: readonly QaImageView[];
+    /** Durable files the user attached to this message, in prompt order. */
+    readonly files?: readonly QaFileView[];
+    /**
+     * Chat owner's display name, set only for an admin reading a foreign
+     * chat; the owner themself sees their messages unlabeled.
+     */
+    readonly author?: string;
 } | {
     readonly id: string;
     readonly role: "assistant";
@@ -162,6 +411,10 @@ export type QaMessage = {
     readonly timestamp?: number;
     /** Host turn this answer belongs to; groups regenerations into variants. */
     readonly turn?: number;
+    /** Canonical evidence snapshot shared with this answer's source drawer. */
+    readonly sources?: readonly QaSource[];
+    readonly sourcesComplete?: boolean;
+    readonly incompleteSourceOrigins?: QaTurnSources["incompleteOrigins"];
     /** Host-recorded response timing, present on finalized messages only. */
     readonly stats?: {
         /** step start → final message. */
@@ -186,7 +439,8 @@ export type QaMessage = {
     readonly id: string;
     readonly role: "work";
     readonly turn: number;
-    readonly status: "running" | "complete";
+    /** "error" marks a turn the host ended with a provider failure. */
+    readonly status: "running" | "complete" | "error";
     readonly startedAt?: number;
     readonly endedAt?: number;
     readonly items: readonly QaWorkItem[];
@@ -211,21 +465,14 @@ export type QaWorkItem = {
     readonly endedAt?: number;
 };
 export type QaSessionPhase = "idle" | "creating" | "ready" | "running" | "reconnecting" | "blocked" | "error";
-/** One tool-derived source shown in the sources drawer. */
-export interface QaSource {
-    readonly id: string;
-    readonly kind: "web" | "search" | "file";
-    /** URL, filesystem path or search query as the model supplied it. */
-    readonly target: string;
-    readonly title: string;
-    readonly snippet: string;
-    /** The tool's full text output, capped for the detail pane. */
-    readonly output: string;
-}
+export type { QaSourceEvidence, QaSourceKind, QaSourceLocation, QaSourceOrigin, QaSourceReference, QaTurnSources, } from "./provenance/types.js";
+/** Transitional UI name; the drawer now consumes the canonical source object. */
+export type QaSource = import("./provenance/types.js").QaSourceReference;
 /** Raster formats the attachment path accepts (mirrors the host contract). */
 export type QaImageMediaType = "image/png" | "image/jpeg" | "image/webp" | "image/gif";
 /** One image pending in the composer, browser-owned until the prompt lands. */
 export interface QaImageDraft {
+    readonly kind: "image";
     readonly id: string;
     readonly mediaType: QaImageMediaType;
     readonly name: string;
@@ -234,11 +481,36 @@ export interface QaImageDraft {
     /** Local object URL for the preview thumbnail. */
     readonly previewUrl: string;
 }
+/**
+ * One file pending in the composer. The bytes stay in the browser until the
+ * prompt is sent: an image can ride the prompt inline, but a file must be
+ * staged through the Host upload route first and then cited by its receipt.
+ */
+export interface QaFileDraft {
+    readonly kind: "file";
+    readonly id: string;
+    readonly name: string;
+    readonly bytes: number;
+    /** Verbatim payload; a pasted blob is a File built from the pasted text. */
+    readonly blob: Blob;
+}
+/** Anything the composer may hold before the prompt is sent. */
+export type QaAttachmentDraft = QaImageDraft | QaFileDraft;
 /** A durable image attached to a sent message. */
 export interface QaImageView {
     readonly attachmentId: string;
     readonly mediaType: QaImageMediaType;
 }
+/**
+ * A durable file attached to a sent message. The browser never reads these
+ * bytes back (the attachment route serves images); the row shows the handle
+ * the model resolves, and the Host keeps the verbatim copy.
+ */
+export interface QaFileView {
+    readonly attachmentId: string;
+    readonly name: string;
+    readonly bytes: number;
+}
 /** A subagent transcript opened read-only from the agents panel. */
 export interface QaSubagentView {
     readonly id: string;
@@ -255,6 +527,8 @@ export interface QaSessionState {
     readonly chatsRevision: number;
     /** Tool-derived sources of the current chat (web targets and files read). */
     readonly sources: readonly QaSource[];
+    readonly sourcesComplete: boolean;
+    readonly incompleteSourceOrigins: QaTurnSources["incompleteOrigins"];
     /** Set while the bound session is a subagent watched from the panel. */
     readonly viewingSubagent: QaSubagentView | null;
 }

package/lib/types/user-workspace.d.ts

@@ -0,0 +1,38 @@
+/** Stable, non-workspace child used to keep account directories out of sight. */
+export declare const QA_USER_WORKSPACES_DIRECTORY = ".qa-users";
+/** Conservative fixed budgets; there is deliberately no browser override. */
+export declare const QA_USER_WORKSPACE_MAX_BYTES: number;
+export declare const QA_USER_WORKSPACE_MAX_WRITE_BYTES: number;
+export interface QaToolExecutionLike {
+    readonly name: string;
+    readonly arguments: unknown;
+}
+export declare function pathIsInside(target: string, root: string): boolean;
+/**
+ * Resolve the deepest existing ancestor, preserving the missing suffix. This
+ * catches symlink escapes for reads and for files which a write is about to
+ * create.
+ */
+export declare function canonicalCandidate(input: string): string;
+/**
+ * Materialize `<registered workspace>/.qa-users/<account UUID>` without
+ * registering the child as a DSH Workspace. Both directory levels reject
+ * symlinks, and their real paths must stay below the configured workspace.
+ */
+export declare function prepareQaUserWorkspace(workspaceRoot: string, userId: string): string;
+/** Resolve an already provisioned account directory for admission checks. */
+export declare function existingQaUserWorkspace(workspaceRoot: string, userId: string): string;
+/**
+ * Monotonic guard used in addition to DSH's workspace-write sandbox. It
+ * fences model-controlled file paths for both reads and writes, rejects tools
+ * whose implementation can walk above cwd, and enforces bounded scratch use.
+ *
+ * `attachmentRoot` is the one deliberate read exemption: an uploaded file is
+ * an immutable content-addressed copy the deployment stores outside every
+ * workspace, and the model reaches it exactly as the harness intends (the
+ * prompt carries the stored path). Reads of a single such file are allowed;
+ * directory-wide tools stay confined because the store is shared by every
+ * account, and writes are never exempted.
+ */
+export declare function qaUserWorkspaceDenial(execution: QaToolExecutionLike, root: string, attachmentRoot?: string): string | undefined;
+//# sourceMappingURL=user-workspace.d.ts.map

package/lib/user-workspace.js

@@ -0,0 +1,231 @@
+import { chmodSync, lstatSync, mkdirSync, readdirSync, realpathSync, statSync, } from "node:fs";
+import path from "node:path";
+/** Stable, non-workspace child used to keep account directories out of sight. */
+export const QA_USER_WORKSPACES_DIRECTORY = ".qa-users";
+/** Conservative fixed budgets; there is deliberately no browser override. */
+export const QA_USER_WORKSPACE_MAX_BYTES = 256 * 1024 * 1024;
+export const QA_USER_WORKSPACE_MAX_WRITE_BYTES = 10 * 1024 * 1024;
+const USER_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu;
+const PATH_DENIAL = "QA workspace boundary: path is outside this user's directory.";
+const QUOTA_DENIAL = "QA workspace boundary: storage quota exceeded.";
+function samePath(left, right) {
+    return process.platform === "win32"
+        ? left.toLowerCase() === right.toLowerCase()
+        : left === right;
+}
+export function pathIsInside(target, root) {
+    const relative = path.relative(root, target);
+    return (relative === "" ||
+        (!relative.startsWith(`..${path.sep}`) &&
+            relative !== ".." &&
+            !path.isAbsolute(relative)));
+}
+/**
+ * Resolve the deepest existing ancestor, preserving the missing suffix. This
+ * catches symlink escapes for reads and for files which a write is about to
+ * create.
+ */
+export function canonicalCandidate(input) {
+    const resolved = path.resolve(input);
+    const suffix = [];
+    let cursor = resolved;
+    for (;;) {
+        try {
+            return path.resolve(realpathSync.native(cursor), ...suffix);
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+            const parent = path.dirname(cursor);
+            if (parent === cursor)
+                throw error;
+            suffix.unshift(path.basename(cursor));
+            cursor = parent;
+        }
+    }
+}
+function assertPlainDirectory(input) {
+    const stat = lstatSync(input);
+    if (stat.isSymbolicLink() || !stat.isDirectory()) {
+        throw new Error(`QA user workspace must be a real directory: ${input}`);
+    }
+}
+/**
+ * Materialize `<registered workspace>/.qa-users/<account UUID>` without
+ * registering the child as a DSH Workspace. Both directory levels reject
+ * symlinks, and their real paths must stay below the configured workspace.
+ */
+export function prepareQaUserWorkspace(workspaceRoot, userId) {
+    if (!USER_ID_PATTERN.test(userId)) {
+        throw new Error("QA account id is not safe for a workspace directory");
+    }
+    const canonicalWorkspace = realpathSync.native(workspaceRoot);
+    const usersRoot = path.join(canonicalWorkspace, QA_USER_WORKSPACES_DIRECTORY);
+    mkdirSync(usersRoot, { recursive: true, mode: 0o700 });
+    assertPlainDirectory(usersRoot);
+    if (process.platform !== "win32")
+        chmodSync(usersRoot, 0o700);
+    const canonicalUsersRoot = realpathSync.native(usersRoot);
+    if (!pathIsInside(canonicalUsersRoot, canonicalWorkspace)) {
+        throw new Error("QA user-workspace root escapes the configured workspace");
+    }
+    const userRoot = path.join(canonicalUsersRoot, userId);
+    mkdirSync(userRoot, { recursive: true, mode: 0o700 });
+    assertPlainDirectory(userRoot);
+    if (process.platform !== "win32")
+        chmodSync(userRoot, 0o700);
+    const canonicalUserRoot = realpathSync.native(userRoot);
+    if (!pathIsInside(canonicalUserRoot, canonicalUsersRoot) ||
+        !samePath(path.dirname(canonicalUserRoot), canonicalUsersRoot)) {
+        throw new Error("QA user workspace escapes its account directory");
+    }
+    return canonicalUserRoot;
+}
+/** Resolve an already provisioned account directory for admission checks. */
+export function existingQaUserWorkspace(workspaceRoot, userId) {
+    if (!USER_ID_PATTERN.test(userId)) {
+        throw new Error("QA account id is not safe for a workspace directory");
+    }
+    const canonicalWorkspace = realpathSync.native(workspaceRoot);
+    const usersRoot = path.join(canonicalWorkspace, QA_USER_WORKSPACES_DIRECTORY);
+    const userRoot = path.join(usersRoot, userId);
+    assertPlainDirectory(usersRoot);
+    assertPlainDirectory(userRoot);
+    const canonicalUsersRoot = realpathSync.native(usersRoot);
+    const canonicalUserRoot = realpathSync.native(userRoot);
+    if (!pathIsInside(canonicalUsersRoot, canonicalWorkspace) ||
+        !pathIsInside(canonicalUserRoot, canonicalUsersRoot) ||
+        !samePath(path.dirname(canonicalUserRoot), canonicalUsersRoot)) {
+        throw new Error("QA user workspace escapes the configured workspace");
+    }
+    return canonicalUserRoot;
+}
+function record(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+function requestedPaths(execution) {
+    const args = record(execution.arguments);
+    if (args === undefined)
+        return [];
+    switch (execution.name) {
+        case "read":
+        case "read_image":
+        case "write":
+        case "edit": {
+            return typeof args.file_path === "string" ? [args.file_path] : [];
+        }
+        case "glob":
+        case "grep": {
+            return [typeof args.path === "string" ? args.path : "."];
+        }
+        case "str_replace_editor": {
+            return typeof args.path === "string" ? [args.path] : [];
+        }
+        default:
+            return [];
+    }
+}
+/**
+ * Whether the named path is only read. Directory-wide tools stay confined even
+ * for reads: the attachment store is shared by every account, and only the
+ * exact file an upload produced is meant to be reachable.
+ */
+function isReadOnlyPathTool(execution) {
+    if (execution.name === "read" || execution.name === "read_image")
+        return true;
+    return (execution.name === "str_replace_editor" &&
+        record(execution.arguments)?.command === "view");
+}
+function directoryBytes(root, stopAfter) {
+    let total = 0;
+    const pending = [root];
+    while (pending.length > 0 && total <= stopAfter) {
+        const current = pending.pop();
+        for (const entry of readdirSync(current, { withFileTypes: true })) {
+            const candidate = path.join(current, entry.name);
+            if (entry.isSymbolicLink())
+                continue;
+            if (entry.isDirectory())
+                pending.push(candidate);
+            else if (entry.isFile())
+                total += statSync(candidate).size;
+            if (total > stopAfter)
+                break;
+        }
+    }
+    return total;
+}
+function requestedWriteBytes(execution) {
+    const args = record(execution.arguments);
+    if (args === undefined)
+        return 0;
+    const values = [args.content, args.new_string, args.new_str];
+    return values.reduce((total, value) => total + (typeof value === "string" ? Buffer.byteLength(value) : 0), 0);
+}
+/**
+ * Monotonic guard used in addition to DSH's workspace-write sandbox. It
+ * fences model-controlled file paths for both reads and writes, rejects tools
+ * whose implementation can walk above cwd, and enforces bounded scratch use.
+ *
+ * `attachmentRoot` is the one deliberate read exemption: an uploaded file is
+ * an immutable content-addressed copy the deployment stores outside every
+ * workspace, and the model reaches it exactly as the harness intends (the
+ * prompt carries the stored path). Reads of a single such file are allowed;
+ * directory-wide tools stay confined because the store is shared by every
+ * account, and writes are never exempted.
+ */
+export function qaUserWorkspaceDenial(execution, root, attachmentRoot) {
+    const args = record(execution.arguments);
+    if (args?.sandbox_permissions !== undefined ||
+        (execution.name === "edit" &&
+            (args?.replace_all === true || args?.replaceAll === true))) {
+        return PATH_DENIAL;
+    }
+    if (execution.name === "bash" ||
+        execution.name === "shell" ||
+        execution.name.startsWith("terminal_") ||
+        execution.name.startsWith("job_") ||
+        execution.name === "run_code" ||
+        execution.name === "lsp" ||
+        execution.name === "apply_patch" ||
+        execution.name.startsWith("dsh_git_")) {
+        return PATH_DENIAL;
+    }
+    const readsOnly = isReadOnlyPathTool(execution);
+    try {
+        for (const requested of requestedPaths(execution)) {
+            const absolute = path.isAbsolute(requested)
+                ? requested
+                : path.resolve(root, requested);
+            const canonical = canonicalCandidate(absolute);
+            if (pathIsInside(canonical, root))
+                continue;
+            // Resolved only for a path the fence would otherwise refuse, so the
+            // common case pays no extra filesystem walk.
+            if (readsOnly &&
+                attachmentRoot !== undefined &&
+                pathIsInside(canonical, canonicalCandidate(attachmentRoot))) {
+                continue;
+            }
+            return PATH_DENIAL;
+        }
+        if (execution.name === "write" ||
+            execution.name === "edit" ||
+            (execution.name === "str_replace_editor" &&
+                record(execution.arguments)?.command !== "view")) {
+            const requested = requestedWriteBytes(execution);
+            if (requested > QA_USER_WORKSPACE_MAX_WRITE_BYTES ||
+                directoryBytes(root, QA_USER_WORKSPACE_MAX_BYTES) + requested >
+                    QA_USER_WORKSPACE_MAX_BYTES) {
+                return QUOTA_DENIAL;
+            }
+        }
+        return undefined;
+    }
+    catch {
+        return PATH_DENIAL;
+    }
+}
+//# sourceMappingURL=user-workspace.js.map