@yadsh/dsh-qa-surface 0.3.0 → 0.4.0

package/docs/ARCHITECTURE.md

@@ -1,66 +0,0 @@
-# Architecture
-
-The Host half validates the Loader configuration, registers the `qa-surface`
-settings namespace and owns one narrow GET/HEAD route for the configured QA
-path. Published DSH releases return 404 for unknown frontend paths, so the
-route redirects navigation through the canonical `/` index with an encoded
-same-origin path marker. It also exposes one typed
-`secureSession(sessionId)` operation whose policy is read only from Host
-settings. The entry delegates that operation to `QaPolicyAdmission`
-(`secure-session.ts`), the Host-side admission boundary. It does not serve
-HTML, create another server, replace the frontend fallback, or touch
-API/plugin routes. The browser removes the
-marker and restores the requested path with `history.replaceState` before
-route matching. The Host creates no sessions itself.
-
-The browser half registers `QaSurface` in the root-scoped `shell.overlay` list.
-`QaRouteController` keeps that entry dormant outside the configured path and
-reversibly observes `pushState`, `replaceState` and `popstate`.
-
-`QaSessionController` is the only browser-side DSH session-coupled module. It uses
-`connection.api.sessions.create/selectModel` for creation policy and the public
-`SessionFace` for prompt, cancel and snapshots; the shared client contracts and
-the idle state live in `client/types.ts`. Its supporting modules are pure
-helpers: `client/wait-for.ts` waits on observable stores, `client/chat-index.ts`
-(`QaChatIndex`) keeps the browser-local chat index and persisted active
-session in storage, and `client/attestation.ts` parses Host reason markers and
-validates proofs against the deployed lockdown config. `QaTranscriptAdapter`
-projects session snapshots to plugin-local messages. "New chat" enters a
-draft that materializes an attested session only when the first prompt is
-sent, and the chat list orders by the host's `updatedAt`. The log is
-append-only and there is no truncation seam, so regeneration prompts a
-hidden instruction and projects the follow-up turns as variants of one
-question; the same projection flattens tool activity into the sources
-drawer (web targets, searches, files read). Subagent delegation, when the
-deployment opts it in, renders launches and settlement notices inline, and
-the agents drawer opens a child session as a read-only live transcript: the
-binding skips attestation and every send path stays closed. By default it excludes
-reasoning, tool arguments and tool results. When explicitly enabled, it
-correlates assistant blocks, paired tool results, running calls and turn
-timings into one plugin-local work group per turn; `QaWorkGroup` owns
-disclosure state and collapses the group when the turn completes. System
-context and raw failures remain excluded.
-
-In locked mode the Host operation verifies immutable session composition,
-refuses to adopt a non-QA session with user history, validates the named
-permission preset, installs `ToolRestriction.allow`, installs an agent-scoped
-monotonic execution guard, selects the permission preset, and returns only a
-sanitized proof. The controller remains non-writable until every proof field
-matches its Host-delivered config and repeats the check before prompt
-admission. No private RPC handler, slash command, direct provider API, or DSH
-core patch is used.
-
-This narrows a QA agent's effective session/tool policy, but a route overlay on
-a shared privileged Host is not an authorization boundary for other DSH
-clients. Strong isolation requires a dedicated process/profile, restricted
-identity and network boundary.
-
-All interaction colors come from the company interaction palette
-("Цвета взаимодействия"), defined once as the `QA_BRAND_PALETTE` object at the
-top of `styles.ts` and emitted as `--dsh-qa-*` custom properties on the
-overlay root; surfaces and typography keep using the themed `--dsw-alias-*`
-tokens so light and dark hosts stay coherent.
-
-The overlay locks document scrolling and contains keyboard focus while active.
-It does not locate AppFrame through generated CSS classes and does not dispose
-global DSH runtime services when the route changes.

package/docs/COMPATIBILITY.md

@@ -1,14 +0,0 @@
-# Compatibility
-
-| Plugin version | Tested DSH release | Required public contracts                                                                                                                                                              |
-| -------------- | ------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| 0.1.x          | 0.1.5-rc.2         | `shell.overlay`, Typert remote, `agentPresets.composedPreset`, `permissionPresets`, agent-scoped `tools.restrict/guard`, `workspaceRegistry`, session/model APIs, `webServer.register` |
-
-DSH is developer-preview software. Compatibility-sensitive calls are isolated
-in `QaSessionController`, `QaTranscriptAdapter`, `QaConfigController` and
-`QaRouteController`; Host lockdown coupling is isolated in
-`QaSurface.secureSession`. The Host navigation adapter also works around this tested
-release's exact-index static serving: `/qa` is redirected through `/`, then the
-client restores the original pathname. Missing settings fall back to default
-browser config; missing required client services prevent the browser plugin
-from being injected rather than patching DSH internals.

package/docs/CONFIGURATION.md

@@ -1,199 +0,0 @@
-# Configuration reference
-
-Defaults and constraints are documented in the root README. Important runtime
-rules are:
-
-- `route.path` starts with `/`, has trailing slashes removed, and cannot claim
-  `/`, `/api` or `/plugins`;
-- `fixed` requires `fixedSessionId`;
-- `provider` and `model` are either both absent or both present;
-- `maxContentWidth` is an integer from 480 through 1600 and caps the
-  user-resizable transcript/composer width; each QA route persists its chosen
-  width in browser storage;
-- duplicate/blank suggested questions are removed;
-- approval and question policies are fixed to safe blocking behavior;
-- reasoning and tool details are opt-in through `ui.showReasoning` and
-  `ui.showToolActivity`; enable them only where those contents are appropriate
-  for the QA audience;
-- accounts default to disabled; when enabled, `sessionTtlDays` is an integer
-  from 1 through 365, and other users' chats stay hidden unless an admin view
-  explicitly enables `accounts.showOtherUsersChats`;
-- lockdown defaults to enabled and requires a non-empty permission preset;
-- the preset must resolve on the Host to exactly `read-only` + `never`;
-- permission, slash-command, settings, rename, delete and arbitrary-open
-  capability flags cannot be enabled;
-- `showReset` requires the independent `allowSessionReset` opt-in;
-- the tool policy is an allow-list; unknown configured tool names fail closed.
-  A name only resolves while its tool is actually mounted: MCP tools
-  (`mcp__<server>__*`) exist only while their server is reachable, so keep
-  them out of the allow list on hosts that cannot reach the server. Tools
-  mounted by an agent preset live in that preset's ancestor scope; the Host
-  validates and restricts the complete agent-scoped view, not just globals.
-
-## Pinning chats to a directory
-
-By default a QA chat is created against the Host working directory. Two
-mutually exclusive pins anchor every new chat (and its subagents) to the
-deployment's own directory:
-
-- `session.cwd: "D:/qa-docs"` - an absolute directory used directly as the
-  session cwd; no registration needed. Attestation compares the session's
-  recorded cwd case- and separator-insensitively on Windows.
-- `session.workspaceId: "<uuid>"` - a registered DSH workspace (created in
-  the web UI or via the workspace API; the id is a generated uuid, not the
-  path). Sessions attach to the workspace, so they group under it in the
-  host UI. When the id does not resolve, attestation refuses with
-  `reason: workspace-unavailable` instead of an opaque mismatch.
-
-With `lockdown.enforceFixedWorkspace: true` (the default) a chat created
-anywhere else refuses to attest, so the QA audience can never pull the
-assistant out of the pinned directory.
-
-Browser persistence stores only the DSH session id under
-`<storageKey>:v1:<route>:session`, plus — when `ui.showSessionList` is
-enabled — a per-browser chat index under `<storageKey>:v1:<route>:chats`
-(session ids only, capped at 50). Transcript content, credentials and tool
-results remain in the Host-owned DSH Session and are never copied to browser
-storage.
-
-When either work-detail flag is enabled, the QA transcript groups reasoning,
-intermediate assistant progress, and tool rows by DSH turn. Running work is
-expanded. Completed work is collapsed behind a duration summary and can be
-reopened; each tool row can separately reveal its formatted input and output.
-These controls change presentation only and never widen the Host allow-list.
-
-The browser cannot override lockdown settings. Before binding and immediately
-before every prompt, it requests a Host attestation for the selected session.
-Any unproved agent preset, workspace, model, permission bundle or tool policy
-disables Send with the generic message `Настройки помощника недоступны.`
-Detailed mismatch facts are written only to Host logs; the
-browser console additionally prints one line with a stable coarse reason code
-(`reason: unknown-tools`, `workspace-unavailable`, `composition-mismatch`, `permission-preset`,
-`adoption-refused`, `proof-mismatch` or `attestation-failed`) plus an operator
-hint, so a refused surface can be diagnosed without Host log access.
-
-The built-in branding, controls, status messages and accessibility labels are
-Russian. The default quick questions are rendered directly above the composer
-only while the current chat is empty. Set `suggestedQuestions: []` to hide
-them, or provide a deployment-specific list to replace them.
-
-When adding tools, update the deployment's reviewed capability inventory as
-part of the same change. The package's
-[default inventory](../capability-policy.json) is intentionally empty, matching
-the default `toolPolicy.allow`.
-
-## Structured sources
-
-The `sources` block controls provenance independently from Activity rendering.
-The defaults collect parent and subagent results, persist a `qa/sources` event,
-hide discovery-only candidates, group visible evidence by kind, and promote at
-most five substantive `web_search` results when no fetch occurs. URL tracking
-parameters and overlapping file ranges are normalized during deduplication.
-
-`sources.filePreview` is a narrow read capability, not a filesystem browser.
-The Host serves only a path already present in the attested session's canonical
-evidence bundle, resolves symlinks with `realpath`, rejects root escape, and
-applies `maxBytes` plus `maxMarkdownRenderBytes`. Markdown uses the client's
-HTML-free renderer; relative links and executable raw HTML are not activated.
-
-Set `sources.display.showOriginBadges: true` while auditing inheritance. Local
-subagent sources carry run/session origins automatically. An opaque provider
-can call the internal `qa_report_sources` tool; if it does not, and
-`markIncompleteOpaqueRuns` remains enabled, the bundle is explicitly marked
-incomplete.
-
-See [Structured sources migration](SOURCES-MIGRATION.md) before removing an
-older prompt-authored bibliography convention.
-
-## Accounts and the QA gate
-
-`accounts.enabled: true` mounts the login/registration gate in front of the
-QA surface and turns on server-side session ownership:
-
-- The store lives at `$DSH_HOME/qa-accounts.json` (created on first use). It
-  holds scrypt password hashes, a persisted HMAC secret for the account
-  tokens, and the session ownership map. The path is not configurable and no
-  secret ever reaches `describe()`.
-- `accounts.allowRegistration` (default true) controls self-service signup
-  in the gate; the first account ever registered becomes `admin`.
-- `accounts.sessionTtlDays` (default 30) is the account token lifetime. The
-  token is an HMAC-signed value the browser keeps in `localStorage`; logout
-  or expiry returns the browser to the gate, and the Host re-derives the
-  identity on every attestation.
-- `accounts.showOtherUsersChats` (default false) lets admins load and display
-  chats owned by other QA accounts. It has no effect for ordinary users.
-- Session ownership is first come, first served: attesting or bulk-claiming
-  an unowned session binds it to the caller's account (this is how existing
-  per-browser chats migrate on the first login). Sessions owned by another
-  user are refused with the coarse `session-owned-elsewhere` reason and
-  hidden from the sidebar; admins are not refused.
-- Manage accounts with the bundled CLI (no hand-editing of the JSON):
-
-  ```sh
-  qa-accounts list
-  qa-accounts add user@example.com --password-stdin --role user
-  qa-accounts set-role user@example.com admin
-  qa-accounts disable user@example.com   # blocks logins, revokes live tokens
-  qa-accounts revoke user@example.com    # invalidates every issued token
-  ```
-
-  `disable` bumps the account's token version, so all outstanding tokens die
-  server-side; `enable` requires a fresh sign-in. After a secret rotation
-  suspicion, `revoke` is the single-step response.
-
-- Honest boundary: accounts identify QA users and gate the QA surface and
-  its remotes. They do not fence the harness: every QA user also holds the
-  host launch-token cookie, with which the full root UI stays technically
-  reachable. Keep the network scoping advice from the deployment kit.
-
-## Entry redirect
-
-`entry.redirectNonLoopback: true` (default) injects one script into the
-served root `index.html`: browsers whose URL host is not loopback
-(`localhost`, `127.0.0.1`, `::1`, `*.localhost`) continue into the QA route,
-so LAN visitors never see the full harness root. The check is client-side on
-`location.hostname` on purpose - behind a local reverse proxy every request
-looks loopback to the server. The navigation hand-off `/?__dsh_qa_route=…`
-is never redirected (that would loop), `/?ui=admin` bypasses the redirect
-and is remembered for the browser, and `/?ui=qa` clears the bypass.
-
-`entry.cookieBootstrap: true` (default) additionally lets the `/qa` route
-itself bootstrap the host cookie: a browser without any `dsh-auth-` cookie is
-sent to the one-time `/?token=…` exchange (relative redirect, token resolved
-from the host connection service) before the marker hand-off. This makes the
-transparent entry work without the deploy proxy; with the proxy in front,
-either side may perform the exchange and the other becomes a no-op.
-
-## Configuration channel over the LAN
-
-The browser normally reads the effective configuration from the Host-owned
-`qa-surface` settings namespace. DSH pins settings RPCs to loopback, so a
-browser served over the LAN always sees that namespace as unavailable. In
-that case the client calls the plugin's `qaSurface/describe` Host Remote and
-uses the returned effective configuration; a rejected call falls back to the
-client defaults with the same `unavailable` status as before. Only one
-describe request runs per page load, and a settled answer survives scope
-updates — the namespace (when readable) stays the authority and keeps
-delivering live changes.
-
-Host-side enforcement never depended on the browser's read path: `secureSession`
-attestation re-derives everything from the Host-owned configuration on every
-bind and every prompt.
-
-## Skill catalog scope
-
-The deployment's agent preset controls which skills the QA assistant sees.
-The shipped `qa-research` preset mounts the skill filesystem with
-`includeDefaultRoots: false`: project-root skills (for example the harness
-checkout's own `.dsh/skills`) and user-home skills stay out of the catalog,
-and skills enter only through plugin providers or an explicit
-`customSkillDirs` list in the preset. Keep the QA catalog to exactly the
-skills the audience is meant to use.
-
-## Deleting chats
-
-The sidebar delete control removes a chat from this browser's index only;
-the Host session stays on disk. Deleting the chat that is currently open
-continues in a fresh attested session when `lockdown.allowSessionReset` is
-enabled. There is no Host session-deletion API in DSH 0.1.x for the plugin
-to call.

package/docs/EMBEDDING.md

@@ -1,13 +0,0 @@
-# Embedding and reverse proxies
-
-Serve `/qa` through the normal DSH origin so it shares the established browser
-connection, authentication and trust policy. The plugin's narrow navigation
-route redirects GET/HEAD requests through DSH's canonical `/` document; the
-client immediately restores `/qa` before mounting. Reverse proxies must pass
-the configured QA path to DSH instead of replacing it with a separately hosted
-page.
-
-Iframe embedding is disabled or allowed by deployment headers, not by this
-plugin. Configure an explicit CSP `frame-ancestors` allowlist at a trusted
-reverse proxy and keep the DSH API same-origin. Do not enable wildcard CORS or
-expose settings/session APIs without the deployment's authentication layer.

package/docs/SOURCES-MIGRATION.md

@@ -1,28 +0,0 @@
-# Structured sources migration
-
-`dsh-qa-surface` now treats `QaTurnSources` as the only canonical provenance
-model. Assistant prose is never parsed for a `Sources` or `Источники` section,
-and the default `sources.legacy.parseAssistantSourcesBlock` remains `false`.
-
-## Deployment steps
-
-1. Keep the QA agent's existing read-only retrieval tools in
-   `lockdown.toolPolicy.allow`.
-2. Leave `sources.collect.persistTurnEvent: true` so completed turns append a
-   replayable `qa/sources` snapshot.
-3. Remove prompt instructions that ask the assistant to manually write a
-   bibliography. The plugin contributes its own scoped guidance after QA
-   attestation.
-4. For an opaque subagent provider, expose the inherited
-   `qa_report_sources` tool and ask the provider to call it before completion.
-   Local DSH subagents require no reporting prompt.
-5. Start with `sources.display.showDiscovered: false`; enable it only for
-   provenance debugging.
-
-Historical sessions without `qa/sources` remain readable: the Host reconstructs
-bundles from durable structured tool metadata when available. Historical
-assistant-authored source prose remains ordinary answer text and is not trusted
-as provenance.
-
-The `qa/sources` event is a required plugin-owned session event. Keep
-`dsh-qa-surface` loaded in any Host that restores sessions containing it.

package/docs/SOURCES-PROVENANCE-AUDIT.md

@@ -1,88 +0,0 @@
-# Sources / provenance implementation audit
-
-Date: 2026-09-11  
-Pinned DSH development API: `0.1.5-rc.2`
-
-This note records the Phase 0 findings for
-`SPEC-dsh-qa-surface-sources-provenance.md`. It is intentionally tied to the
-versions in this repository rather than to DSH `master`.
-
-## Existing QA data path
-
-- `QaSessionController` binds the client `UiConversation` snapshot.
-- `QaTranscriptAdapter` reads the `chat.legacy` projection.
-- The former Sources drawer inferred one row from selected tool names and raw
-  arguments. It counted a search query as a source and did not retain turn,
-  line-range, evidence, or origin data.
-- `ToolResultNode.meta` is available in the client projection. DSH documents it
-  as the tool-private, JSON-safe result presentation payload persisted on the
-  corresponding `tool/result` event.
-
-## Structured metadata available in the pinned version
-
-`@deepseek-ai/dsh-tools` exports the provider-neutral result shapes needed by
-the first implementation slice:
-
-- `ReadResultView`: `path`, numbered `lines`, `offset`, `totalLines`, `lang`;
-- `SearchResultView`: grouped grep matches or path discovery;
-- `WebSearchResultView`: structured `sources[]` and truncation state;
-- `WebFetchResultView`: final redirect URL, status, and truncation state;
-- generic call `FileLocation` values.
-
-The QA extractor layer therefore consumes `ToolResultNode.meta` first and uses
-tool arguments only as a compatibility fallback for direct read/fetch calls.
-It does not parse assistant prose.
-
-## Replay and persistence
-
-The completed implementation rebuilds collectors from persisted
-`tool/call`/`tool/result.meta` events and writes one materialized `qa/sources`
-snapshot at `agent/turn-stopping`. The type is declaration-merged into
-`SessionEventMap`.
-
-The pinned DSH exports its live `KNOWN_SESSION_EVENT_TYPES` set. As already
-demonstrated by the repository's `dsh-session-scope` plugin, registering the
-plugin event there is the supported compatibility mechanism when
-`Session.append` cannot mark an extension event ignorable. Registration is
-effect-scoped and removed on plugin disposal. A Host that owns sessions with
-these events must load `dsh-qa-surface`, just as it must load any plugin that
-owns a required durable event vocabulary.
-
-## Subagent lifecycle
-
-The pinned `@deepseek-ai/dsh-subagent` does expose process-local
-`subagent/start` and `subagent/end` events. Both carry `runId`, `provider`, child
-session `id`, and `local`; the terminal payload additionally carries
-`stopReason` and optional `lastAssistantMessage`. Scoped dispatch is keyed by
-the delegating parent.
-
-The Host now maintains that lineage registry, uses the child header or causal
-`AgentRegistry.currentInitiator()` attribution, bubbles nested local-child
-sources to the original root turn, and retains run/session origin fields.
-Opaque providers can call `qa_report_sources`; an unreported opaque run sets
-`complete=false` with an `incompleteOrigins` entry.
-
-## File preview reuse
-
-The new `readSourceFile` Remote is limited to evidence paths in canonical
-bundles, re-attests the session, resolves both root and target with `realpath`,
-rejects traversal/symlink escape, caps bytes, and exposes no write/list API.
-
-## Implemented scope
-
-- canonical source and turn-bundle types;
-- URL/path/range normalization;
-- extractor registry with read, grep discovery, web search, and web fetch;
-- evidence promotion, deduplication, ranking, and a default display threshold;
-- bounded structured web-search promotion (five results by default);
-- Host per-turn collectors and materialized/replayable `qa/sources` events;
-- local and nested subagent inheritance plus opaque-provider reporting;
-- structured Jira, Confluence, knowledge and reported-source adapters;
-- one canonical snapshot used by grouped drawer and answer footer;
-- source details, origin/partial badges and completeness state;
-- safe local-file preview, rendered/raw Markdown, range chips and exact raw
-  line highlighting;
-- configuration and tests for the feature surface.
-
-Optional inline citation rendering (SPEC Phase 5) remains intentionally out of
-the MVP, as specified.

package/docs/SPEC-dsh-qa-surface-accounts.md

@@ -1,219 +0,0 @@
-# SPEC — dsh-qa-surface accounts and entry routing
-
-Status: implemented (this document is the design record).
-Scope: `plugins/dsh-qa-surface` plus the external `qa-deploy` kit
-(proxy + launcher). The DSH harness itself is not modified.
-
-## Goals
-
-1. A LAN visitor who opens the server root lands on the QA surface, not the
-   full harness UI; the loopback operator keeps the harness root as-is.
-2. A LAN visitor without the host browser-auth cookie is transparently sent
-   through the one-time `?token=` exchange and returned to `/qa` without ever
-   handling the launch token manually.
-3. QA users identify themselves with an email + password account. Existing
-   per-browser chats migrate to the account on first login. Session ownership
-   is enforced server-side on the plugin's admission boundary.
-
-## Non-goals / honest boundary
-
-- The host launch token remains a master key: `/api` RPC requires the
-  host-auth cookie (`rpc-host.ts` rejects 401 without it), so every QA user
-  must hold it, and with it the full harness UI is technically reachable.
-  Accounts gate the QA surface and the plugin's own remotes server-side; they
-  do not isolate a determined user from the harness. This is documented in the
-  deployment kit and the disclaimer stays visible in the UI.
-- No email verification (no SMTP): the email is an identifier, not a contact
-  channel.
-- No admin UI for user management in this phase; the first registered account
-  becomes `admin`, later roles change via the accounts file.
-
-## Wire design: explicit account token, not cookies
-
-Typert remotes receive only `(endpoint, payload, signal)` — the HTTP request
-never reaches a remote method (`packages/client/connection/src/rpc-host.ts`,
-`rpcFetchHandler`), so a cookie-based gate inside remotes is impossible
-without harness changes. Named plugin routes do see `req`/`res`, but keeping
-auth on a parallel HTTP surface would leave the existing typert remotes
-unguarded.
-
-Therefore the account credential is an explicit first argument on every
-gated remote, and login/register return it in the value:
-
-- `accountsLogin(email, password)` → `{ token, user }`
-- `accountsRegister(email, password, displayName?)` → `{ token, user }`
-- `accountsWhoami(token)` → `{ authenticated: true, user } | { authenticated: false }`
-- `accountsClaimSessions(token, sessionIds)` → `{ claimed, conflicts }`
-- `accountsOwnedSessions(token)` → `{ ids }`
-- `accountsListOwnership(token)` → `{ entries: [{ sessionId, userId,
-displayName, claimedAt }] }` — admin-only (`admin-required` refusal for
-  ordinary accounts, `auth-required` for anonymous)
-- `secureSession(token, sessionId)` — now requires a valid token when
-  accounts are enabled
-- `sources(token, sessionId)`, `readSourceFile(token, sessionId, path)` — same
-
-The token is an HMAC-SHA256-signed `v1.<payload>.<sig>` string
-(payload `{ uid, exp }`) keyed by a secret generated once and persisted in
-the accounts file. The browser keeps it in `localStorage` under the
-deployment's per-route key. Login/register failures are coarse (same message
-for unknown email and wrong password); registration rejects duplicate emails;
-a per-store in-memory counter rate-limits auth attempts.
-
-## Server: accounts store and admission
-
-- File: `$DSH_HOME/qa-accounts.json` (env fallback: process cwd). Shape:
-  `{ version, secret, users: [{ id, email, displayName, role, passwordHash,
-createdAt, lastLoginAt }], ownership: { [sessionId]: { userId, claimedAt } } }`.
-  Written atomically (temp file + rename), all mutations synchronous.
-- Passwords: scrypt with per-user salt, timing-safe comparison.
-- Roles: `user` | `admin`. The first registered user becomes `admin`.
-  Admins bypass the ownership refusal (the surface is read-only anyway);
-  non-admins get a coarse `session-owned-elsewhere` attestation refusal for
-  sessions owned by someone else.
-- Claim rule (first come, first served): attesting an _unowned_ session claims
-  it for the requesting user (this is how pre-accounts sessions migrate when
-  an old browser re-opens its `activeId` without a bulk claim). Bulk claims
-  from the client's local index follow the same rule; conflicting ids are
-  reported back and dropped from that browser's index.
-- `QaPolicyAdmission.secureSession` gains an optional accounts gate: when
-  `accounts.enabled`, an invalid/expired token refuses with
-  `auth-required` before any policy work.
-
-## Entry redirect (host-injected script)
-
-The plugin listens to the `webserver/index-inject` event and pushes one
-inline `script` row into the served root `index.html` (config
-`entry.redirectNonLoopback`, default true):
-
-- Skip when the navigation marker (`__dsh_qa_route`) is present — the `/qa`
-  route hands off through `/?__dsh_qa_route=…` and a naive redirect would
-  loop.
-- Skip when `?ui=admin` is set (also persists the choice under the
-  deployment's storage key); `?ui=qa` clears the choice.
-- Skip when the persisted choice is `admin`.
-- Otherwise redirect non-loopback hostnames (`localhost`, `127.0.0.1`,
-  `::1`, `*.localhost`) to `/qa`. The check is client-side on
-  `location.hostname` **on purpose**: behind the qa-deploy proxy every
-  request appears loopback to the server, and the operator convention is
-  "operator uses localhost, QA users use the LAN address".
-
-The script is defensive (try/catch, no dependency on bundle load) and never
-redirects when the plugin is disabled or the flag is off.
-
-## Client: accounts controller and auth gate
-
-- `QaAccountsController` owns the state machine
-  `checking → anonymous → authed`, the token persistence, login/register
-  calls, the one-shot migration claim (local chat index → `claimSessions`)
-  after each successful login/registration, and the owned-session id list
-  that backs the sidebar.
-- `QaSurface` renders a full-frame `QaAuthGate` (login/register tabs, email +
-  password, coarse errors, busy state) instead of the chat while accounts are
-  enabled and the user is anonymous; the session controller is not created
-  until `authed`, so nothing attests or sends before login.
-- `QaSessionController` threads the token into `secureSession`/`sources`/
-  `readSourceFile` calls and merges the owned-session list into the chat
-  index; newly created chats are claimed at creation time. When accounts are
-  disabled the controller behaves exactly as before.
-- An attestation refusal with reason `auth-required` re-opens the gate
-  (token expired/rotated) instead of surfacing the generic configuration
-  error.
-- A small account chip (email, role, logout) lives in the sidebar footer;
-  logout clears the token and returns to the gate.
-
-## Admin ownership views
-
-When `accounts.showOtherUsersChats: true`, the admin sidebar switches from the
-flat list to per-owner sections. The option defaults to false, so admins see
-only their own chats unless the deployment explicitly opts in.
-`accountsListOwnership` returns every ownership entry with the owner's
-display name resolved at read time (disabled accounts still name their
-chats), the controller merges those session ids into the visible list, and
-`QaSidebar` renders one section per owner ordered by its freshest chat, with
-unclaimed chats trailing under "Без владельца". Search filters rows first,
-so empty sections disappear while searching. Ordinary accounts and
-deployments with accounts disabled keep the exact flat list as before.
-
-The same data drives author labels: user messages carry an `author` byline
-with the chat owner's display name, but only for an admin reading a foreign
-chat — the owner themself sees no label, and authorship is chat-level (the
-ownership map), not per-message. Admins replying inside someone else's chat
-are therefore labeled with the chat owner, not with their own name; the
-per-message identity channel (the client-minted `requestId` on
-`session/prompt`) is a possible future refinement.
-
-## Config surface
-
-```yaml
-accounts:
-  enabled: false # opt-in; the qa-deploy profile patch turns it on
-  allowRegistration: true # self-service signup in the gate
-  sessionTtlDays: 30 # account token lifetime
-  showOtherUsersChats: false # opt-in cross-user admin view
-entry:
-  redirectNonLoopback: true # the root → /qa script above
-```
-
-No file paths or secrets are configurable through the schema: the store path
-is derived from `DSH_HOME` internally, and `describe()` (the LAN config
-channel) keeps projecting only client-safe values.
-
-## qa-deploy kit (external repo)
-
-- `run-qa.sh` extracts the launch token from the boot banner
-  (`dsh web: …?token=…`) and starts `proxy.mjs` in front of the harness
-  (default proxy port 8088, `DSH_QA_PROXY=0` to disable). LAN visitors are
-  pointed at the proxy address; the operator keeps the direct loopback URL.
-- `proxy.mjs` gains the transparent exchange: a GET/HEAD page navigation to
-  `/` or `/qa…` without a `dsh-auth-` cookie and without `?token=` gets a 302
-  to `/?token=<TOKEN>`; the harness exchanges it (server-side 303) and the
-  injected script finishes the trip to `/qa`. Everything else passes through
-  unchanged (Host/Origin rewrite, polyfill, WS splice).
-- The profile patch (`profile/cordis.patch.yml`) enables
-  `accounts.enabled`, keeping self-registration on.
-
-## Testing
-
-- Store: scrypt round-trip, duplicate-email rejection, first-user-admin,
-  atomic persistence, token sign/verify/expire, ownership claim/conflict.
-- Admission: token-less refusal when enabled, ownership refusal, admin
-  bypass, unowned auto-claim, disabled passthrough.
-- Entry redirect: script text guards (marker, `ui=admin`/`?ui=qa`,
-  loopback hostnames, disable flag), injection through the index-inject
-  event.
-- Client: controller state machine, migration claim, token threading,
-  auth-required recovery; auth gate rendering in the component suite.
-- Admin views: ownership listing (display-name resolution, admin/anonymous
-  refusals), the visible-id merge, author-label rules, owner section
-  ordering and rendering.
-- Packed verification keeps asserting the standard card shell and now the
-  auth gate markup.
-
-## Follow-ups adopted from dsh-auth-gate (same release)
-
-A review of the independent `dsh-auth-gate` plugin yielded four additions,
-folded into this spec rather than shipped as a separate design:
-
-1. **Proxy-side config-plane deny list** (qa-deploy kit). The deploy proxy
-   rewrites Host/Origin to loopback, which makes the `/api` trust fence treat
-   every proxied request as loopback — including the privileged methods
-   (`settings.*`, `credentials.*`, `host.*`, `llm.*`). The proxy now answers
-   403 for those method prefixes when the caller is not loopback. The QA
-   surface never calls them (its configuration rides `qaSurface/describe`);
-   the operator on the serving machine keeps the full plane.
-2. **Plugin-side launch-token bridge.** The `/qa` route handler defers the
-   marker hand-off for cookie-less browsers: it 302s to a relative
-   `/?token=…` first (token resolved once per process from
-   `connection.authenticatedUrl`, the dsh-auth-gate pattern), so the
-   transparent entry works without the proxy. `entry.cookieBootstrap`
-   (default true) turns it off. Presence of any `dsh-auth-` cookie skips the
-   bridge; a token-less bridge or a disabled flag falls back to the marker
-   hand-off.
-3. **`qa-accounts` management CLI** (`bin` entry). `list`, `add
---password-stdin`, `set-role`, `disable`, `enable`, `revoke` — so account
-   administration never requires hand-editing the JSON file.
-4. **Account state and token revocation.** Accounts gain a `disabled` flag
-   (refused at login with `account-disabled`, invisible to `whoami`) and a
-   `tokenVersion` burned into every token: `disable` and `revoke` bump it,
-   invalidating all live tokens server-side — logout is no longer purely a
-   client-side act.