@yadsh/dsh-qa-surface 0.3.0 → 0.5.0

package/lib/user-workspace.js

@@ -0,0 +1,246 @@
+import { chmodSync, lstatSync, mkdirSync, readdirSync, realpathSync, statSync, } from "node:fs";
+import path from "node:path";
+/** Stable, non-workspace child used to keep account directories out of sight. */
+export const QA_USER_WORKSPACES_DIRECTORY = ".qa-users";
+/** Conservative fixed budgets; there is deliberately no browser override. */
+export const QA_USER_WORKSPACE_MAX_BYTES = 256 * 1024 * 1024;
+export const QA_USER_WORKSPACE_MAX_WRITE_BYTES = 10 * 1024 * 1024;
+const USER_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu;
+const PATH_DENIAL = "QA workspace boundary: path is outside this user's directory.";
+const QUOTA_DENIAL = "QA workspace boundary: storage quota exceeded.";
+function samePath(left, right) {
+    return process.platform === "win32"
+        ? left.toLowerCase() === right.toLowerCase()
+        : left === right;
+}
+export function pathIsInside(target, root) {
+    const relative = path.relative(root, target);
+    return (relative === "" ||
+        (!relative.startsWith(`..${path.sep}`) &&
+            relative !== ".." &&
+            !path.isAbsolute(relative)));
+}
+/**
+ * Resolve the deepest existing ancestor, preserving the missing suffix. This
+ * catches symlink escapes for reads and for files which a write is about to
+ * create.
+ */
+export function canonicalCandidate(input) {
+    const resolved = path.resolve(input);
+    const suffix = [];
+    let cursor = resolved;
+    for (;;) {
+        try {
+            return path.resolve(realpathSync.native(cursor), ...suffix);
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+            const parent = path.dirname(cursor);
+            if (parent === cursor)
+                throw error;
+            suffix.unshift(path.basename(cursor));
+            cursor = parent;
+        }
+    }
+}
+function assertPlainDirectory(input) {
+    const stat = lstatSync(input);
+    if (stat.isSymbolicLink() || !stat.isDirectory()) {
+        throw new Error(`QA user workspace must be a real directory: ${input}`);
+    }
+}
+/**
+ * Materialize `<registered workspace>/.qa-users/<account UUID>` without
+ * registering the child as a DSH Workspace. Both directory levels reject
+ * symlinks, and their real paths must stay below the configured workspace.
+ */
+export function prepareQaUserWorkspace(workspaceRoot, userId) {
+    if (!USER_ID_PATTERN.test(userId)) {
+        throw new Error("QA account id is not safe for a workspace directory");
+    }
+    const canonicalWorkspace = realpathSync.native(workspaceRoot);
+    const usersRoot = path.join(canonicalWorkspace, QA_USER_WORKSPACES_DIRECTORY);
+    mkdirSync(usersRoot, { recursive: true, mode: 0o700 });
+    assertPlainDirectory(usersRoot);
+    if (process.platform !== "win32")
+        chmodSync(usersRoot, 0o700);
+    const canonicalUsersRoot = realpathSync.native(usersRoot);
+    if (!pathIsInside(canonicalUsersRoot, canonicalWorkspace)) {
+        throw new Error("QA user-workspace root escapes the configured workspace");
+    }
+    const userRoot = path.join(canonicalUsersRoot, userId);
+    mkdirSync(userRoot, { recursive: true, mode: 0o700 });
+    assertPlainDirectory(userRoot);
+    if (process.platform !== "win32")
+        chmodSync(userRoot, 0o700);
+    const canonicalUserRoot = realpathSync.native(userRoot);
+    if (!pathIsInside(canonicalUserRoot, canonicalUsersRoot) ||
+        !samePath(path.dirname(canonicalUserRoot), canonicalUsersRoot)) {
+        throw new Error("QA user workspace escapes its account directory");
+    }
+    return canonicalUserRoot;
+}
+/** Resolve an already provisioned account directory for admission checks. */
+export function existingQaUserWorkspace(workspaceRoot, userId) {
+    if (!USER_ID_PATTERN.test(userId)) {
+        throw new Error("QA account id is not safe for a workspace directory");
+    }
+    const canonicalWorkspace = realpathSync.native(workspaceRoot);
+    const usersRoot = path.join(canonicalWorkspace, QA_USER_WORKSPACES_DIRECTORY);
+    const userRoot = path.join(usersRoot, userId);
+    assertPlainDirectory(usersRoot);
+    assertPlainDirectory(userRoot);
+    const canonicalUsersRoot = realpathSync.native(usersRoot);
+    const canonicalUserRoot = realpathSync.native(userRoot);
+    if (!pathIsInside(canonicalUsersRoot, canonicalWorkspace) ||
+        !pathIsInside(canonicalUserRoot, canonicalUsersRoot) ||
+        !samePath(path.dirname(canonicalUserRoot), canonicalUsersRoot)) {
+        throw new Error("QA user workspace escapes the configured workspace");
+    }
+    return canonicalUserRoot;
+}
+function record(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+function requestedPaths(execution) {
+    const args = record(execution.arguments);
+    if (args === undefined)
+        return [];
+    switch (execution.name) {
+        case "read":
+        case "read_image":
+        case "write":
+        case "edit": {
+            return typeof args.file_path === "string" ? [args.file_path] : [];
+        }
+        case "glob":
+        case "grep": {
+            return [typeof args.path === "string" ? args.path : "."];
+        }
+        case "str_replace_editor": {
+            return typeof args.path === "string" ? [args.path] : [];
+        }
+        default:
+            return [];
+    }
+}
+/**
+ * Whether the named path is only read. Directory-wide tools stay confined even
+ * for reads: the attachment store is shared by every account, and only the
+ * exact file an upload produced is meant to be reachable.
+ */
+function readsSharedRoot(execution) {
+    if (execution.name === "read" ||
+        execution.name === "read_image" ||
+        execution.name === "glob" ||
+        execution.name === "grep") {
+        return true;
+    }
+    return (execution.name === "str_replace_editor" &&
+        record(execution.arguments)?.command === "view");
+}
+function readsSingleFile(execution) {
+    if (execution.name === "read" || execution.name === "read_image")
+        return true;
+    return (execution.name === "str_replace_editor" &&
+        record(execution.arguments)?.command === "view");
+}
+function directoryBytes(root, stopAfter) {
+    let total = 0;
+    const pending = [root];
+    while (pending.length > 0 && total <= stopAfter) {
+        const current = pending.pop();
+        for (const entry of readdirSync(current, { withFileTypes: true })) {
+            const candidate = path.join(current, entry.name);
+            if (entry.isSymbolicLink())
+                continue;
+            if (entry.isDirectory())
+                pending.push(candidate);
+            else if (entry.isFile())
+                total += statSync(candidate).size;
+            if (total > stopAfter)
+                break;
+        }
+    }
+    return total;
+}
+function requestedWriteBytes(execution) {
+    const args = record(execution.arguments);
+    if (args === undefined)
+        return 0;
+    const values = [args.content, args.new_string, args.new_str];
+    return values.reduce((total, value) => total + (typeof value === "string" ? Buffer.byteLength(value) : 0), 0);
+}
+/**
+ * Monotonic guard used in addition to DSH's workspace-write sandbox. It
+ * fences model-controlled file paths for both reads and writes, rejects tools
+ * whose implementation can walk above cwd, and enforces bounded scratch use.
+ *
+ * `attachmentRoot` is the one deliberate read exemption: an uploaded file is
+ * an immutable content-addressed copy the deployment stores outside every
+ * workspace, and the model reaches it exactly as the harness intends (the
+ * prompt carries the stored path). Reads of a single such file are allowed;
+ * directory-wide tools stay confined because the store is shared by every
+ * account, and writes are never exempted.
+ */
+export function qaUserWorkspaceDenial(execution, root, attachmentRoot, readPolicy = {}) {
+    const args = record(execution.arguments);
+    if (args?.sandbox_permissions !== undefined ||
+        (execution.name === "edit" &&
+            (args?.replace_all === true || args?.replaceAll === true))) {
+        return PATH_DENIAL;
+    }
+    if (execution.name === "bash" ||
+        execution.name === "shell" ||
+        execution.name.startsWith("terminal_") ||
+        execution.name.startsWith("job_") ||
+        execution.name === "run_code" ||
+        execution.name === "lsp" ||
+        execution.name === "apply_patch") {
+        return PATH_DENIAL;
+    }
+    const readsShared = readsSharedRoot(execution);
+    const readsOneFile = readsSingleFile(execution);
+    try {
+        const sharedReadOnlyRoots = (readPolicy.sharedReadOnlyRoots ?? []).map(canonicalCandidate);
+        for (const requested of requestedPaths(execution)) {
+            const absolute = path.isAbsolute(requested)
+                ? requested
+                : path.resolve(root, requested);
+            const canonical = canonicalCandidate(absolute);
+            if (pathIsInside(canonical, root))
+                continue;
+            if (readsShared &&
+                sharedReadOnlyRoots.some((readRoot) => pathIsInside(canonical, readRoot))) {
+                continue;
+            }
+            // Resolved only for a path the fence would otherwise refuse, so the
+            // common case pays no extra filesystem walk.
+            if (readsOneFile &&
+                attachmentRoot !== undefined &&
+                pathIsInside(canonical, canonicalCandidate(attachmentRoot))) {
+                continue;
+            }
+            return PATH_DENIAL;
+        }
+        if (execution.name === "write" ||
+            execution.name === "edit" ||
+            (execution.name === "str_replace_editor" &&
+                record(execution.arguments)?.command !== "view")) {
+            const requested = requestedWriteBytes(execution);
+            if (requested > QA_USER_WORKSPACE_MAX_WRITE_BYTES ||
+                directoryBytes(root, QA_USER_WORKSPACE_MAX_BYTES) + requested >
+                    QA_USER_WORKSPACE_MAX_BYTES) {
+                return QUOTA_DENIAL;
+            }
+        }
+        return undefined;
+    }
+    catch {
+        return PATH_DENIAL;
+    }
+}
+//# sourceMappingURL=user-workspace.js.map

package/lib/user-workspace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-workspace.js","sourceRoot":"","sources":["../src/user-workspace.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,SAAS,EACT,SAAS,EACT,WAAW,EACX,YAAY,EACZ,QAAQ,GACT,MAAM,SAAS,CAAC;AACjB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,iFAAiF;AACjF,MAAM,CAAC,MAAM,4BAA4B,GAAG,WAAW,CAAC;AAExD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAC7D,MAAM,CAAC,MAAM,iCAAiC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAElE,MAAM,eAAe,GACnB,6EAA6E,CAAC;AAChF,MAAM,WAAW,GACf,+DAA+D,CAAC;AAClE,MAAM,YAAY,GAAG,gDAAgD,CAAC;AAYtE,SAAS,QAAQ,CAAC,IAAY,EAAE,KAAa;IAC3C,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO;QACjC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE;QAC5C,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,IAAY;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7C,OAAO,CACL,QAAQ,KAAK,EAAE;QACf,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;YACpC,QAAQ,KAAK,IAAI;YACjB,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAC9B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,MAAM,GAAG,QAAQ,CAAC;IACtB,SAAS,CAAC;QACR,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;YACpE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACpC,IAAI,MAAM,KAAK,MAAM;gBAAE,MAAM,KAAK,CAAC;YACnC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YACtC,MAAM,GAAG,MAAM,CAAC;QAClB,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,+CAA+C,KAAK,EAAE,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,aAAqB,EACrB,MAAc;IAEd,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,kBAAkB,GAAG,YAAY,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,4BAA4B,CAAC,CAAC;IAC9E,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAChC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC9D,MAAM,kBAAkB,GAAG,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1D,IAAI,CAAC,YAAY,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;IACvD,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC/B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC7D,MAAM,iBAAiB,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxD,IACE,CAAC,YAAY,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;QACpD,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,kBAAkB,CAAC,EAC9D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,uBAAuB,CACrC,aAAqB,EACrB,MAAc;IAEd,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,kBAAkB,GAAG,YAAY,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,4BAA4B,CAAC,CAAC;IAC9E,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC9C,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAChC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC/B,MAAM,kBAAkB,GAAG,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1D,MAAM,iBAAiB,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxD,IACE,CAAC,YAAY,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;QACrD,CAAC,YAAY,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;QACpD,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,kBAAkB,CAAC,EAC9D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,SAA8B;IACpD,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAClC,QAAQ,SAAS,CAAC,IAAI,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC;QACZ,KAAK,YAAY,CAAC;QAClB,KAAK,OAAO,CAAC;QACb,KAAK,MAAM,EAAE,CAAC;YACZ,OAAO,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,CAAC;QACD,KAAK,MAAM,CAAC;QACZ,KAAK,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3D,CAAC;QACD,KAAK,oBAAoB,EAAE,CAAC;YAC1B,OAAO,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,CAAC;QACD;YACE,OAAO,EAAE,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,SAA8B;IACrD,IACE,SAAS,CAAC,IAAI,KAAK,MAAM;QACzB,SAAS,CAAC,IAAI,KAAK,YAAY;QAC/B,SAAS,CAAC,IAAI,KAAK,MAAM;QACzB,SAAS,CAAC,IAAI,KAAK,MAAM,EACzB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CACL,SAAS,CAAC,IAAI,KAAK,oBAAoB;QACvC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,MAAM,CAChD,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,SAA8B;IACrD,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM,IAAI,SAAS,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IAC9E,OAAO,CACL,SAAS,CAAC,IAAI,KAAK,oBAAoB;QACvC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,MAAM,CAChD,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,SAAiB;IACrD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC;IACvB,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,IAAI,SAAS,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAG,CAAC;QAC/B,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAClE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACjD,IAAI,KAAK,CAAC,cAAc,EAAE;gBAAE,SAAS;YACrC,IAAI,KAAK,CAAC,WAAW,EAAE;gBAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;iBAC5C,IAAI,KAAK,CAAC,MAAM,EAAE;gBAAE,KAAK,IAAI,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC;YAC3D,IAAI,KAAK,GAAG,SAAS;gBAAE,MAAM;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,mBAAmB,CAAC,SAA8B;IACzD,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7D,OAAO,MAAM,CAAC,MAAM,CAClB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CACf,KAAK,GAAG,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EACpE,CAAC,CACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAA8B,EAC9B,IAAY,EACZ,cAAuB,EACvB,UAAU,GAA8B,EAAE;IAE1C,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACzC,IACE,IAAI,EAAE,mBAAmB,KAAK,SAAS;QACvC,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM;YACxB,CAAC,IAAI,EAAE,WAAW,KAAK,IAAI,IAAI,IAAI,EAAE,UAAU,KAAK,IAAI,CAAC,CAAC,EAC5D,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,IACE,SAAS,CAAC,IAAI,KAAK,MAAM;QACzB,SAAS,CAAC,IAAI,KAAK,OAAO;QAC1B,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QACtC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QACjC,SAAS,CAAC,IAAI,KAAK,UAAU;QAC7B,SAAS,CAAC,IAAI,KAAK,KAAK;QACxB,SAAS,CAAC,IAAI,KAAK,aAAa,EAChC,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,MAAM,WAAW,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,YAAY,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,mBAAmB,GAAG,CAAC,UAAU,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,GAAG,CACpE,kBAAkB,CACnB,CAAC;QACF,KAAK,MAAM,SAAS,IAAI,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;YAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;gBACzC,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAClC,MAAM,SAAS,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YAC/C,IAAI,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC;gBAAE,SAAS;YAC5C,IACE,WAAW;gBACX,mBAAmB,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CACpC,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAC,CAClC,EACD,CAAC;gBACD,SAAS;YACX,CAAC;YACD,oEAAoE;YACpE,6CAA6C;YAC7C,IACE,YAAY;gBACZ,cAAc,KAAK,SAAS;gBAC5B,YAAY,CAAC,SAAS,EAAE,kBAAkB,CAAC,cAAc,CAAC,CAAC,EAC3D,CAAC;gBACD,SAAS;YACX,CAAC;YACD,OAAO,WAAW,CAAC;QACrB,CAAC;QACD,IACE,SAAS,CAAC,IAAI,KAAK,OAAO;YAC1B,SAAS,CAAC,IAAI,KAAK,MAAM;YACzB,CAAC,SAAS,CAAC,IAAI,KAAK,oBAAoB;gBACtC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,MAAM,CAAC,EAClD,CAAC;YACD,MAAM,SAAS,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;YACjD,IACE,SAAS,GAAG,iCAAiC;gBAC7C,cAAc,CAAC,IAAI,EAAE,2BAA2B,CAAC,GAAG,SAAS;oBAC3D,2BAA2B,EAC7B,CAAC;gBACD,OAAO,YAAY,CAAC;YACtB,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAC;IACrB,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yadsh/dsh-qa-surface",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "description": "A focused end-user QA surface backed by native DeepSeek Harness sessions",
   "repository": {
     "type": "git",
@@ -53,8 +53,10 @@
         "@deepseek-ai/dsh-api-session-controller",
         "@deepseek-ai/dsh-agent-presets",
         "@deepseek-ai/dsh-client-connection",
+        "@deepseek-ai/dsh-client-file-upload",
         "@deepseek-ai/dsh-client-ui-layout",
         "@deepseek-ai/dsh-client-ui-settings",
+        "@deepseek-ai/dsh-client-ui-settings-plugins",
         "@deepseek-ai/dsh-client-ui-theme"
       ],
       "platform": "web"
@@ -68,9 +70,6 @@
     "compatibility.json",
     "capability-policy.json",
     "README.md",
-    "CHANGELOG.md",
-    "docs/*.md",
-    "SPEC-dsh-qa-surface.md",
     "LICENSE"
   ],
   "keywords": [
@@ -78,9 +77,12 @@
     "deepseek-harness",
     "dsh",
     "dsh-plugin",
+    "cordis",
     "qa",
     "chat",
-    "web-ui"
+    "web-ui",
+    "testing",
+    "quality-assurance"
   ],
   "license": "MIT",
   "engines": {
@@ -100,9 +102,11 @@
     "@deepseek-ai/dsh-client-ui-layout": ">=0.1.5-rc.2 <0.2.0",
     "@deepseek-ai/dsh-client-ui-renderer": ">=0.1.5-rc.2 <0.2.0",
     "@deepseek-ai/dsh-client-ui-settings": ">=0.1.5-rc.2 <0.2.0",
+    "@deepseek-ai/dsh-client-ui-settings-plugins": ">=0.1.5-rc.2 <0.2.0",
     "@deepseek-ai/dsh-client-ui-slots": ">=0.1.5-rc.2 <0.2.0",
     "@deepseek-ai/dsh-client-ui-theme": ">=0.1.5-rc.2 <0.2.0",
     "@deepseek-ai/dsh-host-webserver": ">=0.1.5-rc.2 <0.2.0",
+    "@deepseek-ai/dsh-llm": ">=0.1.5-rc.2 <0.2.0",
     "@deepseek-ai/dsh-permission-presets": ">=0.1.5-rc.2 <0.2.0",
     "@deepseek-ai/dsh-session": ">=0.1.5-rc.2 <0.2.0",
     "@deepseek-ai/dsh-settings": ">=0.1.5-rc.2 <0.2.0",
@@ -115,7 +119,7 @@
   },
   "dependencies": {
     "zod": "^4.4.3",
-    "@yadsh/dsh-plugin-log": "^0.2.1"
+    "@yadsh/dsh-plugin-log": "^0.3.0"
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "4.0.2",
@@ -131,9 +135,11 @@
     "@deepseek-ai/dsh-client-ui-layout": "0.1.5-rc.2",
     "@deepseek-ai/dsh-client-ui-renderer": "0.1.5-rc.2",
     "@deepseek-ai/dsh-client-ui-settings": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-client-ui-settings-plugins": "0.1.5-rc.2",
     "@deepseek-ai/dsh-client-ui-slots": "0.1.5-rc.2",
     "@deepseek-ai/dsh-client-ui-theme": "0.1.5-rc.2",
     "@deepseek-ai/dsh-host-webserver": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-llm": "0.1.5-rc.2",
     "@deepseek-ai/dsh-permission-presets": "0.1.5-rc.2",
     "@deepseek-ai/dsh-session": "0.1.5-rc.2",
     "@deepseek-ai/dsh-settings": "0.1.5-rc.2",
@@ -155,8 +161,9 @@
     "tsdown": "^0.22.14",
     "typescript": "^7.0.2",
     "vitest": "^4.1.11",
-    "@yadsh/dsh-plugin-scripts": "^0.0.0",
-    "@yadsh/dsh-config": "^0.0.0"
+    "@yadsh/dsh-config": "^0.0.0",
+    "@yadsh/dsh-plugin-kit": "^0.1.0",
+    "@yadsh/dsh-plugin-scripts": "^0.0.0"
   },
   "publishConfig": {
     "access": "public",

package/CHANGELOG.md

@@ -1,176 +0,0 @@
-## 0.3.0 (2026-09-12)
-
-### 🚀 Features
-
-- Optional QA accounts and entry routing. `accounts.enabled` mounts a ([dc2f582](https://github.com/xarleyn/dsh-plugins/commit/dc2f582))
-  full-frame login/registration gate (email + password, coarse audience-safe
-  refusals, per-store rate limiting, self-registration toggle) backed by
-  `$DSH_HOME/qa-accounts.json`: scrypt password hashes, a persisted HMAC secret
-  for stateful-expiry account tokens, and a session ownership map. Ownership is
-  first come, first served - attesting or bulk-claiming an unowned session binds
-  it to the caller (the migration path for existing per-browser chats on first
-  login); sessions owned by another user refuse attestation with
-  `session-owned-elsewhere` and stay hidden from the sidebar, admins are not
-  refused. The identity rides as an explicit token argument into the gated
-  `qaSurface` remotes (the typert carrier never exposes HTTP requests), the
-  policy admission checks it before any session fact is revealed
-  (`auth-required` reopens the gate on expiry), and the account chip with
-  logout lives in the sidebar footer. `entry.redirectNonLoopback` injects a
-  guarded head script through the `webserver/index-inject` event that continues
-  non-loopback hostnames into the QA route - the navigation-marker hand-off is
-  never redirected (no loops), `/?ui=admin` persists an operator bypass and
-  `/?ui=qa` clears it. Accounts are an identity layer for the QA surface, not a
-  harness boundary: QA users still hold the shared host launch-token cookie.
-
-  Follow-ups adopted from a review of the independent dsh-auth-gate plugin: a
-  proxy-side deny list for the privileged config-plane RPC methods behind the
-  deploy proxy's Host/Origin rewrite, a plugin-side launch-token bridge
-  (`entry.cookieBootstrap`) that performs the one-time host-cookie exchange on
-  the `/qa` route itself, a `qa-accounts` bin CLI (list/add/set-role/disable/
-  enable/revoke) so account administration never requires hand-editing the
-  JSON file, and per-account state — a `disabled` flag refusing logins with
-  `account-disabled` plus a `tokenVersion` burned into tokens that
-  `disable`/`revoke` bump, making logout and lockout server-side facts.
-
-  Admins get cross-user views over the same ownership map:
-  `qaSurface/accountsListOwnership` (admin-only, `admin-required` refusal
-  otherwise) returns every chat with its owner's resolved display name, the
-  admin sidebar switches to per-owner sections ordered by their freshest chat
-  (unclaimed chats trail under "Без владельца"), and user messages in foreign
-  chats carry an `author` byline naming the chat owner. Ordinary accounts and
-  deployments with accounts disabled keep the flat sidebar and unlabeled
-  messages.
-
-- The chat-history sidebar gained a footer version button that opens an ([d9d5868](https://github.com/xarleyn/dsh-plugins/commit/d9d5868))
-  end-user changelog dialog: a curated per-version summary (new features and
-  fixes in Russian) rendered in a themed modal with Escape/backdrop close.
-  The bundled version and entries are pinned to package.json and the release
-  CHANGELOG by a unit test, so a release cannot ship a stale dialog.
-
-- Rebuild the client on the 0.1.5 surfaces: the transcript projects from the ([458b9c2](https://github.com/xarleyn/dsh-plugins/commit/458b9c2))
-  ui-chat conversation view's legacy slice, chat/model pinning moves to the
-  wire remotes (`agentPresets.select` on the still-blank session, then
-  `session.selectModel`) with the attestation ordering preserved, and
-  history reads go through the session-v3 surface. The supported host range
-  moves to `>=0.1.5-rc.2 <0.2.0`, dropping 0.1.1-rc.2.
-
-- Harden the gated QA experience and make cross-user history explicitly ([2ed2024](https://github.com/xarleyn/dsh-plugins/commit/2ed2024))
-  opt-in. A new `accounts.showOtherUsersChats` setting defaults to `false`, so
-  administrators only see their own chats unless the deployment enables the
-  shared ownership view. Account storage now follows external CLI updates and
-  uses process-scoped temporary writes, while session admission and client state
-  handling avoid stale async results and reset session-bound assets reliably.
-
-  The QA client now presents a dedicated test-interface disclosure, improves
-  chat search and owner matching, keeps row actions from disturbing result
-  layout, distinguishes administrator roles, and removes decorative middle-dot
-  separators from the sidebar, messages, and source details. Its curated 0.3.0
-  history entry is prepared in advance, while the current-version marker is
-  injected from package.json at build time so the release bump promotes it
-  without another source edit.
-
-### ❤️ Thank You
-
-- xarleyn @xarleyn
-
-## 0.2.0 (2026-09-10)
-
-- Added DSH-style symmetric transcript/composer width handles with adaptive
-  defaults, viewport clamping, and per-route browser persistence.
-- Added Host-owned structured source provenance for parent and delegated turns,
-  replayable `qa/sources` snapshots, dedupe/ranking, opaque-provider reporting,
-  grouped source UI, and safe rendered/raw file previews.
-- Updated packed Host/browser smoke coverage for browser authentication,
-  revisioned client batches, scoped Remote injection, and current Typert RPC
-  envelopes.
-
-### 🚀 Features
-
-- Make the QA surface a complete end-user assistant shell: image attachments ([b9af082](https://github.com/xarleyn/dsh-plugins/commit/b9af082))
-  (drag & drop, paste, and a picker with removable previews; base64 prompt
-  parts the Host promotes to durable attachments, rendered back as clickable
-  thumbnails), subagent delegation presentation (launch work items with the
-  durable child id, settlement notices collapsed into titled expandable rows,
-  an agents panel listing the chat's subagents, and live read-only subagent
-  transcripts with a one-click return), source cards with a full-output detail
-  pane, clickable links and an open action, answer regeneration with
-  ChatGPT-style variant switching, message ratings with hover response
-  metadata (duration, TTFT, tokens per second), a data-usage disclaimer
-  plate under the composer, per-browser chat history
-  ordered by host updates with search and a collapsible sidebar, lazy draft
-  chats that create nothing until the first prompt, directory/workspace
-  pinning with a dedicated `workspace-unavailable` refusal, the company
-  interaction palette as `--dsh-qa-*` tokens, and a split of the surface into
-  focused drawer, switcher, and formatting modules.
-
-### 🩹 Fixes
-
-- Pack the generated Typert host and remote-client entrypoints: the `files` ([0059cb4](https://github.com/xarleyn/dsh-plugins/commit/0059cb4))
-  allowlist only kept declarations under `lib/types/`, so the `./remote` and
-  `./typert` exports previously shipped without their implementation modules
-  and type definitions.
-
-### ❤️ Thank You
-
-- xarleyn @xarleyn
-
-## 0.1.1 (2026-09-06)
-
-### 🩹 Fixes
-
-- Add the dedicated browser QA surface backed by native DeepSeek Harness ([dfdc430](https://github.com/xarleyn/dsh-plugins/commit/dfdc430))
-  sessions.
-
-### 🧱 Updated Dependencies
-
-- Updated @yadsh/dsh-plugin-log to 0.2.1
-
-### ❤️ Thank You
-
-- xarleyn @xarleyn
-
-# Changelog
-
-## 0.1.0 - 2026-09-05
-
-- Added the `/qa` full-screen overlay backed by native DSH sessions.
-- Added persistent, new-on-load and fixed session policies.
-- Added streaming transcript, Stop, New chat, safe Markdown and responsive UI.
-- Added Host settings registration and safety filtering for internal events.
-- Added a narrow Host navigation redirect for DSH releases whose static
-  frontend returns 404 for direct `/qa` requests.
-- Added fail-closed Host policy attestation, the `qa-read-only` permission pin,
-  an inherited-tool allow-list, and a monotonic execution guard.
-- Disabled session reset by default and added capability-regression gates.
-- Refined the QA surface with first-party-style conversation chrome, plain
-  assistant flow, user bubbles, copy actions and a floating two-row composer.
-- Added opt-in reasoning and tool-call details grouped into a live turn work
-  disclosure that collapses to a `Worked for …` summary before the final answer.
-- Added an optional minimal chat-history sidebar (`ui.showSessionList`) with a
-  per-browser localStorage chat index, attested switching and a gated
-  New chat control.
-- Send-time policy attestation now survives a Host that idled the session's
-  agent out: the client re-binds the session (re-materializing the agent) and,
-  when the refused session is still blank, continues in a fresh attested
-  session instead of surfacing an error.
-- Added GFM table, ordered-list and horizontal-rule rendering to the safe
-  Markdown output.
-- Added a two-click chat delete control to the chat-history sidebar; it
-  removes the chat from the per-browser index only (DSH has no
-  session-deletion seam).
-- Added attestation diagnostics: the Host folds a coarse reason code into the
-  refusal and the browser console prints one operator hint instead of a
-  duplicate stack trace.
-- Fixed repeated policy attestation for tools contributed by an agent preset:
-  the applied restriction now retains the exact scoped allow-list instead of
-  accidentally reducing it to global-only tools. Removed the redundant native
-  presentation override so reloads cannot collide with the preset's mode.
-- The browser re-reads the Host configuration when the connection is restored,
-  so an open page survives a Host restart with a changed deployment config.
-- Added LAN serving support: a shipped `deploy/qa-lan.patch.yml` webserver
-  overlay, and a `qaSurface/describe` Host Remote the browser falls back to
-  when the loopback-pinned settings namespace is unavailable, so branding,
-  session pinning and lockdown UI switches keep working over the network.
-- Localized the end-user chat interface into Russian, added rotating playful
-  thinking phrases, and moved the default quick-question chips next to the
-  composer on an empty chat.