@yadsh/dsh-qa-surface 0.4.0 → 0.5.0

package/lib/types/client/project-session-state.d.ts

@@ -1,6 +1,6 @@
 import type { SessionFace } from "@deepseek-ai/dsh-api-session-controller/client";
 import type { ConversationSnapshot } from "@deepseek-ai/dsh-client-ui-conversation/client";
-import type { QaSessionState, QaSubagentView, QaTurnSources, ResolvedQaSurfaceConfig } from "../types.js";
+import type { QaPendingApproval, QaPendingQuestion, QaSessionState, QaSubagentView, QaTurnSources, ResolvedQaSurfaceConfig } from "../types.js";
 /** Everything the bound-chat projection reads; the computation is pure. */
 export interface QaBoundProjectionInput {
     readonly connected: boolean;
@@ -9,6 +9,13 @@ export interface QaBoundProjectionInput {
     readonly conversationSnapshot: ConversationSnapshot | undefined;
     /** Turn bundles with the Host provenance already merged in (Host wins). */
     readonly sourceBundles: readonly QaTurnSources[];
+    /**
+     * Tool calls and questions the Host parked for the operator. They are
+     * host-side state, not part of the session snapshot, so the controller polls
+     * them separately.
+     */
+    readonly approvals: readonly QaPendingApproval[];
+    readonly questions: readonly QaPendingQuestion[];
     readonly operationError: string | null;
     readonly policyReady: boolean;
     readonly admissionPending: boolean;

package/lib/types/client/questions.d.ts

@@ -0,0 +1,45 @@
+import type { QaPendingQuestion, QaQuestionAnswerItem } from "../types.js";
+import type { QaQuestionApi } from "./types.js";
+/**
+ * The operator's side of a parked `ask_user_question` call.
+ *
+ * Like a parked approval, the request lives on the Host: it survives a reload,
+ * and the surface learns about it by asking while a turn runs. Unlike an
+ * approval, an answer is a whole form — every question of the request, with the
+ * operator's selections and free text — so the bridge forwards the form and
+ * re-reads the list afterwards.
+ */
+export declare class QaHostQuestionBridge {
+    private readonly questionApi;
+    private questions;
+    private signature;
+    private refreshing;
+    private answering;
+    /** Bumped on reset so a stale in-flight response never lands. */
+    private generation;
+    constructor(questionApi: QaQuestionApi | undefined);
+    /** Leave the chat: a chat switch drops the previous chat's requests. */
+    reset(): void;
+    /** The last list this bridge saw; empty when the deployment refuses them. */
+    list(): readonly QaPendingQuestion[];
+    /** Whether this page can ask the Host about questions at all. */
+    get available(): boolean;
+    /**
+     * Re-read the chat's pending questions; a changed list republishes through
+     * the callback. Overlapping calls coalesce, and a response that outlives its
+     * chat is dropped.
+     */
+    refresh(sessionId: string, token: string, onChanged: () => void): Promise<void>;
+    /** Send the operator's answers to one request and re-read the list. */
+    answer(sessionId: string, token: string, requestId: string, answers: readonly QaQuestionAnswerItem[]): Promise<void>;
+    /** Close one request without answering it. */
+    cancel(sessionId: string, token: string, requestId: string): Promise<void>;
+    /**
+     * Run one write against a request, then re-read the list it belonged to. A
+     * refusal is not an error: the request was already settled (the turn was
+     * stopped, the call went away), so the refresh — not the write — is what the
+     * surface shows.
+     */
+    private settle;
+}
+//# sourceMappingURL=questions.d.ts.map

package/lib/types/client/types.d.ts

@@ -1,7 +1,7 @@
 import type { ClientRemote } from "@deepseek-ai/dsh-api-gateway/client";
 import type { ISessions, SessionFace } from "@deepseek-ai/dsh-api-session-controller/client";
 import type { UiConversation } from "@deepseek-ai/dsh-client-ui-conversation/client";
-import type { QaAccountProfileInput, QaAccountSession, QaAccountUserPublic, QaClaimResult, QaLockdownProof, QaOwnershipEntry, QaSessionState, QaSourceFilePreview, QaTurnSources, QaWhoamiResult } from "../types.js";
+import type { QaAccountProfileInput, QaAccountSession, QaAccountUserPublic, QaApprovalDecision, QaClaimResult, QaLockdownProof, QaOwnershipEntry, QaPendingApproval, QaPendingQuestion, QaQuestionAnswerItem, QaSessionState, QaSourceFilePreview, QaTurnSources, QaWhoamiResult } from "../types.js";
 /** Wire content one prompt carries: text plus base64 image uploads. */
 export type QaPromptContent = Parameters<SessionFace["prompt"]>[0];
 /** DSH session runtime surface the QA controller is allowed to touch. */
@@ -87,6 +87,53 @@ export type QaBoundSourceApi = {
         readonly error: unknown;
     }>;
 };
+/**
+ * Approval remotes of this plugin's namespace. Read-only listing plus the one
+ * write: the operator's answer to a parked tool call.
+ */
+export interface QaApprovalApi {
+    pendingApprovals(token: string, sessionId: string): Promise<{
+        readonly ok: true;
+        readonly value: readonly QaPendingApproval[];
+    } | {
+        readonly ok: false;
+        readonly error: unknown;
+    }>;
+    answerApproval(token: string, sessionId: string, requestId: string, decision: QaApprovalDecision): Promise<{
+        readonly ok: true;
+        readonly value: boolean;
+    } | {
+        readonly ok: false;
+        readonly error: unknown;
+    }>;
+}
+/**
+ * Question remotes of this plugin's namespace: the parked `ask_user_question`
+ * requests of one chat, the operator's answers, and closing one unanswered.
+ */
+export interface QaQuestionApi {
+    pendingQuestions(token: string, sessionId: string): Promise<{
+        readonly ok: true;
+        readonly value: readonly QaPendingQuestion[];
+    } | {
+        readonly ok: false;
+        readonly error: unknown;
+    }>;
+    answerQuestion(token: string, sessionId: string, requestId: string, answers: readonly QaQuestionAnswerItem[]): Promise<{
+        readonly ok: true;
+        readonly value: boolean;
+    } | {
+        readonly ok: false;
+        readonly error: unknown;
+    }>;
+    cancelQuestion(token: string, sessionId: string, requestId: string): Promise<{
+        readonly ok: true;
+        readonly value: boolean;
+    } | {
+        readonly ok: false;
+        readonly error: unknown;
+    }>;
+}
 /** Account remotes exposed by the plugin's own typert namespace. */
 export interface QaAccountsApi {
     accountsWhoami(token: string): Promise<RemoteResult<QaWhoamiResult>>;

package/lib/types/config-resolvers/shared.d.ts

@@ -1,5 +1,12 @@
 /** Trim an optional string; a blank value collapses to null. */
 export declare function optionalText(value: string | null | undefined): string | null;
+/**
+ * Whether a configured directory is absolute. The rule reads a drive-letter
+ * path as absolute on every platform, like `session.cwd` does: a deployment
+ * profile is authored on one machine and may be read on another, so a
+ * Windows-style root is not a mistake to reject on a POSIX host.
+ */
+export declare function isAbsoluteDirectoryPath(value: string): boolean;
 /**
  * Shared numeric guard for operator-tuned limits: the value has to be a safe
  * integer inside [min, max], and every rejection carries the same message.

package/lib/types/index.d.ts

@@ -1,7 +1,7 @@
 import { TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
 import type { Context } from "@deepseek-ai/cordis";
 import type { QaTurnSources } from "./provenance/types.js";
-import type { QaAccountProfileInput, QaAccountSession, QaAccountUserPublic, QaClaimResult, QaLockdownProof, QaOwnershipEntry, QaSurfaceConfig, ResolvedQaSurfaceConfig, QaSourceFilePreview, QaWhoamiResult } from "./types.js";
+import type { QaAccountProfileInput, QaAccountSession, QaAccountUserPublic, QaApprovalDecision, QaClaimResult, QaLockdownProof, QaOwnershipEntry, QaPendingApproval, QaPendingQuestion, QaQuestionAnswerItem, QaSurfaceConfig, ResolvedQaSurfaceConfig, QaSourceFilePreview, QaWhoamiResult } from "./types.js";
 export declare const name = "qa-surface";
 export declare const inject: string[];
 import { QA_SURFACE_SETTINGS_NAMESPACE } from "./shared/settings.js";
@@ -19,6 +19,8 @@ export declare class QaSurface extends TypertRemoteService {
     private source;
     private readonly logger;
     private readonly admission;
+    private readonly approvals;
+    private readonly userQuestions;
     private readonly provenance;
     private readonly notes;
     /** Account-remote bodies; the wire signatures stay on this class. */
@@ -74,9 +76,33 @@ export declare class QaSurface extends TypertRemoteService {
      */
     createSession(token: string): Promise<string>;
     /** Pin and attest the effective policy. The browser supplies identity only. */
-    secureSession(token: string, sessionId: string): QaLockdownProof;
+    secureSession(token: string, sessionId: string): Promise<QaLockdownProof>;
     /** Return canonical Host snapshots; replay is rebuilt from qa/sources events. */
-    sources(token: string, sessionId: string): readonly QaTurnSources[];
+    sources(token: string, sessionId: string): Promise<readonly QaTurnSources[]>;
+    /**
+     * The tool calls of one chat that wait for the operator. Read-only: a
+     * deployment with blocked approvals answers with an empty list.
+     */
+    pendingApprovals(token: string, sessionId: string): Promise<readonly QaPendingApproval[]>;
+    /**
+     * Apply the operator's answer to one parked call. The id must belong to a
+     * request of this chat; an answer that lost the race (the turn was stopped,
+     * the agent went away) is refused with `false`.
+     */
+    answerApproval(token: string, sessionId: string, requestId: string, decision: QaApprovalDecision): Promise<boolean>;
+    /**
+     * The questions of one chat that wait for the operator. Read-only: a
+     * deployment with unsupported questions answers with an empty list.
+     */
+    pendingQuestions(token: string, sessionId: string): Promise<readonly QaPendingQuestion[]>;
+    /**
+     * Apply the operator's answers to one parked question request. Every question
+     * of the request must be present in `answers`; one the browser omits reads as
+     * a skip.
+     */
+    answerQuestion(token: string, sessionId: string, requestId: string, answers: readonly QaQuestionAnswerItem[]): Promise<boolean>;
+    /** Close a parked question request without answering it. */
+    cancelQuestion(token: string, sessionId: string, requestId: string): Promise<boolean>;
     /** Narrow read-only preview capability for files already present as sources. */
     readSourceFile(token: string, sessionId: string, sourcePath: string): Promise<QaSourceFilePreview>;
     private refreshRoute;

package/lib/types/provenance/reported.d.ts

@@ -1,5 +1,13 @@
 import { canonicalizeUrl } from "./normalize.js";
 import type { QaReportedSource, QaSourceOrigin, QaSourceReference } from "./types.js";
+export interface ReportedSourceOptions {
+    /**
+     * Whether a reported source must carry an address to be recorded. With
+     * `false`, a source the model wrote without a usable path or URL keeps its
+     * own type, title and snippet instead of being dropped.
+     */
+    readonly validate?: boolean;
+}
 /** Normalize a source explicitly reported by a delegated provider. */
-export declare function normalizeReportedSource(source: QaReportedSource, origin: QaSourceOrigin, workspaceRoot?: string, urlOptions?: Parameters<typeof canonicalizeUrl>[1]): QaSourceReference | null;
+export declare function normalizeReportedSource(source: QaReportedSource, origin: QaSourceOrigin, workspaceRoot?: string, urlOptions?: Parameters<typeof canonicalizeUrl>[1], options?: ReportedSourceOptions): QaSourceReference | null;
 //# sourceMappingURL=reported.d.ts.map

package/lib/types/questions.d.ts

@@ -0,0 +1,83 @@
+import type { Agent } from "@deepseek-ai/dsh-agent";
+import type { Context } from "@deepseek-ai/cordis";
+import type { PluginLogger } from "@yadsh/dsh-plugin-log";
+import type { QaSessionOwnership } from "./session-ownership.js";
+import type { QaPendingQuestion, QaQuestionAnswerItem } from "./types.js";
+/**
+ * The harness user-questions contract this seam reads and writes, declared
+ * structurally on purpose: the plugin neither mounts the service nor depends on
+ * its package, so it stays loadable in a deployment that composes no questions
+ * at all. Shapes follow `@deepseek-ai/dsh-user-questions` `src/types.ts` at the
+ * tested harness release (`AskUserQuestionItem` / `AskUserQuestionAnswer`).
+ */
+export interface QaQuestionOption {
+    readonly label: string;
+    readonly description?: string;
+}
+export interface QaQuestionItem {
+    readonly id: string;
+    readonly question: string;
+    readonly detail?: string;
+    readonly header?: string;
+    readonly options?: readonly QaQuestionOption[];
+    readonly multiSelect?: boolean;
+}
+export interface QaQuestionRequest {
+    readonly questions: readonly QaQuestionItem[];
+    readonly agent?: Agent;
+    readonly signal?: AbortSignal;
+}
+/** What the answerer waterfall accepts as its value. */
+export interface QaQuestionAnswer {
+    readonly answers: readonly QaQuestionAnswerItem[];
+}
+/** What the model reads when the deployment does not answer questions. */
+export declare const QA_QUESTIONS_UNSUPPORTED = "questions are not answered in this assistant view; ask the user in plain text instead";
+/**
+ * User questions in the QA view.
+ *
+ * `ask_user_question` reaches the browser through the harness answerer
+ * waterfall, and the stock DSH web bundle mounts its own answerer in every
+ * page. Behind the QA overlay that answerer is unreachable, so a question asked
+ * of a QA chat would sit in front of nobody. This gate claims the request for
+ * attested chats before the generic browser bridge sees it:
+ *
+ * - `interaction.questions: interactive` parks the request until the operator
+ *   answers or closes it in the QA view, and the answer becomes the waterfall's
+ *   value.
+ * - `unsupported` (default) refuses with a reason the model can act on, rather
+ *   than letting the turn stall on a card no one can see.
+ *
+ * Nothing is ever answered on the operator's behalf, and a request from a
+ * session this deployment did not attest is handed back to the chain untouched.
+ */
+export declare class QaQuestionGate {
+    private readonly ctx;
+    private readonly interactive;
+    private readonly ownership;
+    private readonly logger;
+    private readonly pending;
+    private readonly disposers;
+    constructor(ctx: Context, interactive: () => boolean, ownership: QaSessionOwnership, logger: PluginLogger);
+    /** Claim question requests for the chats this deployment answers. */
+    install(): void;
+    /** Questions of one chat, oldest first: what the QA view renders. */
+    list(sessionId: string): readonly QaPendingQuestion[];
+    /**
+     * Apply the operator's answers; an unknown or foreign id is refused. The
+     * parked request is authoritative: a label the question never offered is
+     * dropped, and a free-text answer replaces the choice in a single-select
+     * rather than accompanying it, so the model only ever reads a real answer.
+     */
+    answer(sessionId: string, requestId: string, answers: readonly QaQuestionAnswerItem[]): boolean;
+    /** Close a request without answering it. */
+    cancel(sessionId: string, requestId: string): boolean;
+    /** Detach the listener and fail every parked request. Wired as an effect. */
+    dispose(): void;
+    private handle;
+    /** Park one request until the operator answers it, or the turn ends. */
+    private park;
+    /** Fail the questions one session's agent owns; a disposed agent cannot ask. */
+    private settleOwner;
+}
+//# sourceMappingURL=questions.d.ts.map

package/lib/types/secure-session.d.ts

@@ -32,7 +32,7 @@ export declare class QaPolicyAdmission {
      * one set answers for the whole chat.
      */
     private readonly attested;
-    private readonly workspaceRoots;
+    private readonly workspaceAccess;
     private readonly disposeWorkspaceGuard;
     constructor(ctx: Context, config: () => ResolvedQaSurfaceConfig, logger: PluginLogger, accounts?: QaAccountsGate | undefined);
     /**
@@ -43,7 +43,26 @@ export declare class QaPolicyAdmission {
      * closed — attachments then only work where reads are not fenced per user.
      */
     private attachmentRoot;
-    secureSession(token: string, sessionId: string): QaLockdownProof;
+    /**
+     * The live agent for one session, resuming a Session the Host has not
+     * materialized in this process.
+     *
+     * DSH builds an agent on demand: a session's journal opens straight from
+     * persistence (`session/page` reads the durable log), and only Agent-bound
+     * operations — a prompt, a model selection, renaming, an upload — resolve or
+     * resume one. So a chat from an earlier Host run has a readable transcript
+     * and no agent at all, and attestation, which pins the tool policy ON that
+     * agent, is the first thing here that needs one. Refusing instead would make
+     * every restored chat unopenable until something else in the Host happened
+     * to wake it.
+     *
+     * The resume composes the session's OWN recorded preset — the same
+     * composition a stock prompt would produce — so a session composed outside
+     * the QA preset still lands on the mismatch refusals below ("composition
+     * mismatch"), and the adoption and permission checks stay the gate.
+     */
+    private liveAgent;
+    secureSession(token: string, sessionId: string): Promise<QaLockdownProof>;
     /**
      * Whether one session went through this boundary. The provenance note is
      * written only for attested sessions, which is what keeps a deployment's

package/lib/types/session-ownership.d.ts

@@ -0,0 +1,30 @@
+import type { Context } from "@deepseek-ai/cordis";
+/**
+ * Which sessions belong to this deployment.
+ *
+ * The admission boundary attests chat roots. A delegated child never appears
+ * there — its scope chain does not reach the chat's own agent context — so it
+ * inherits its chat from the session that created it. Both interactive seams
+ * (tool approvals and user questions) read ownership from here, which is what
+ * keeps one chat answered by exactly one surface.
+ */
+export declare class QaSessionOwnership {
+    private readonly isAttested;
+    /** Child session → the attested chat that owns it. */
+    private readonly inherited;
+    private disposeListener;
+    private installed;
+    constructor(isAttested: (sessionId: string) => boolean);
+    /** Listen for the children of an attested chat; safe to call from each seam. */
+    install(ctx: Context): void;
+    /** The attested chat behind a session: itself, or the root it inherited. */
+    rootOf(sessionId: string): string | undefined;
+    /**
+     * Drop one session's inheritance. Called when its agent is gone; the chat's
+     * own claim needs no bookkeeping here, because it resolves through the
+     * admission's attested set, which owns that lifetime.
+     */
+    forget(sessionId: string): void;
+    dispose(): void;
+}
+//# sourceMappingURL=session-ownership.d.ts.map

package/lib/types/types.d.ts

@@ -3,6 +3,25 @@ export type QaSessionPolicy = "browser-persistent" | "new-on-load" | "fixed";
 export type QaSandboxMode = "read-only" | "workspace-write";
 export type QaApprovalPolicy = "never";
 export type QaToolPolicyMode = "allow-list";
+/**
+ * How a tool policy `ask` resolves on an attested QA agent. `blocked` refuses
+ * the call with the surface's own reason; `interactive` parks it until the
+ * operator answers in the QA view.
+ */
+export type QaApprovalInteraction = "blocked" | "interactive";
+/**
+ * How a user-questions request resolves on an attested QA agent. `unsupported`
+ * refuses the ask outright; `interactive` answers it from the QA view.
+ */
+export type QaQuestionInteraction = "unsupported" | "interactive";
+/** The operator's answer to one parked tool call. */
+export type QaApprovalDecision = "allowed-once" | "rejected";
+/** One answered question; `custom` is free text, and may accompany `selected`. */
+export interface QaQuestionAnswerItem {
+    readonly id: string;
+    readonly selected: readonly string[];
+    readonly custom?: string;
+}
 export type QaAccountRole = "user" | "admin";
 /** The account fields projected to browsers; never includes credentials. */
 export interface QaAccountUserPublic {
@@ -107,6 +126,11 @@ export interface QaSourcesConfig {
         readonly inheritSources?: boolean;
         readonly enableReportToolFallback?: boolean;
         readonly markIncompleteOpaqueRuns?: boolean;
+        /**
+         * Whether a source the model writes into `qa_report_sources` must carry a
+         * usable path or URL. Off records the model's own type, title and snippet.
+         */
+        readonly validateReportedSources?: boolean;
     };
     readonly legacy?: {
         readonly parseAssistantSourcesBlock?: boolean;
@@ -158,8 +182,8 @@ export interface QaSurfaceConfig {
      */
     readonly thinkingPhrases?: readonly string[];
     readonly interaction?: {
-        readonly approvals?: "blocked";
-        readonly questions?: "unsupported";
+        readonly approvals?: QaApprovalInteraction;
+        readonly questions?: QaQuestionInteraction;
     };
     readonly lockdown?: {
         readonly enabled?: boolean;
@@ -180,6 +204,8 @@ export interface QaSurfaceConfig {
             readonly mode?: QaToolPolicyMode;
             readonly allow?: readonly string[];
         };
+        /** Shared directories available to read-only filesystem tools. */
+        readonly sharedReadOnlyRoots?: readonly string[];
     };
     readonly embedding?: {
         readonly frameAncestors?: string | null;
@@ -277,8 +303,8 @@ export interface ResolvedQaSurfaceConfig {
     readonly suggestedQuestions: readonly string[];
     readonly thinkingPhrases: readonly string[];
     readonly interaction: {
-        readonly approvals: "blocked";
-        readonly questions: "unsupported";
+        readonly approvals: QaApprovalInteraction;
+        readonly questions: QaQuestionInteraction;
     };
     readonly lockdown: {
         readonly enabled: boolean;
@@ -299,6 +325,7 @@ export interface ResolvedQaSurfaceConfig {
             readonly mode: QaToolPolicyMode;
             readonly allow: readonly string[];
         };
+        readonly sharedReadOnlyRoots: readonly string[];
     };
     readonly embedding: {
         readonly frameAncestors: string | null;
@@ -355,6 +382,7 @@ export interface ResolvedQaSurfaceConfig {
             readonly inheritSources: boolean;
             readonly enableReportToolFallback: boolean;
             readonly markIncompleteOpaqueRuns: boolean;
+            readonly validateReportedSources: boolean;
         };
         readonly legacy: {
             readonly parseAssistantSourcesBlock: boolean;
@@ -516,6 +544,50 @@ export interface QaSubagentView {
     readonly id: string;
     readonly title: string;
 }
+/**
+ * One tool call waiting for the operator. The browser lists these over its own
+ * remote and answers them one by one; nothing here is answered automatically.
+ */
+export interface QaPendingApproval {
+    readonly id: string;
+    /** The chat the request belongs to: a delegated child asks under its root. */
+    readonly sessionId: string;
+    readonly toolName: string;
+    /** The reason the composed gate gave for asking, when it gave one. */
+    readonly reason: string | null;
+    readonly createdAt: number;
+    /** True when a delegated child of the chat made the call. */
+    readonly delegated: boolean;
+}
+/**
+ * One question waiting for the operator, normalized for the form the QA view
+ * renders. The protocol fields are the harness user-questions contract; absent
+ * ones become explicit nulls so the browser never branches on undefined.
+ */
+export interface QaPendingQuestionItem {
+    readonly id: string;
+    readonly question: string;
+    readonly header: string | null;
+    readonly detail: string | null;
+    readonly options: readonly QaPendingQuestionOption[];
+    readonly multiSelect: boolean;
+}
+export interface QaPendingQuestionOption {
+    readonly label: string;
+    readonly description: string | null;
+}
+/**
+ * One user-questions request parked for the operator. A single request carries
+ * every question the model asked in one call, so the card is a form with a
+ * pager, not a list of independent prompts.
+ */
+export interface QaPendingQuestion {
+    readonly id: string;
+    /** The chat the request belongs to. */
+    readonly sessionId: string;
+    readonly questions: readonly QaPendingQuestionItem[];
+    readonly createdAt: number;
+}
 export interface QaSessionState {
     readonly phase: QaSessionPhase;
     readonly sessionId: string | null;
@@ -531,5 +603,9 @@ export interface QaSessionState {
     readonly incompleteSourceOrigins: QaTurnSources["incompleteOrigins"];
     /** Set while the bound session is a subagent watched from the panel. */
     readonly viewingSubagent: QaSubagentView | null;
+    /** Tool calls parked for the operator's answer, oldest first. */
+    readonly approvals: readonly QaPendingApproval[];
+    /** Question requests parked for the operator's answer, oldest first. */
+    readonly questions: readonly QaPendingQuestion[];
 }
 //# sourceMappingURL=types.d.ts.map

package/lib/types/user-workspace.d.ts

@@ -7,6 +7,10 @@ export interface QaToolExecutionLike {
     readonly name: string;
     readonly arguments: unknown;
 }
+export interface QaUserWorkspaceReadPolicy {
+    /** Shared directories exposed only to read-only filesystem tools. */
+    readonly sharedReadOnlyRoots?: readonly string[];
+}
 export declare function pathIsInside(target: string, root: string): boolean;
 /**
  * Resolve the deepest existing ancestor, preserving the missing suffix. This
@@ -34,5 +38,5 @@ export declare function existingQaUserWorkspace(workspaceRoot: string, userId: s
  * directory-wide tools stay confined because the store is shared by every
  * account, and writes are never exempted.
  */
-export declare function qaUserWorkspaceDenial(execution: QaToolExecutionLike, root: string, attachmentRoot?: string): string | undefined;
+export declare function qaUserWorkspaceDenial(execution: QaToolExecutionLike, root: string, attachmentRoot?: string, readPolicy?: QaUserWorkspaceReadPolicy): string | undefined;
 //# sourceMappingURL=user-workspace.d.ts.map

package/lib/user-workspace.js

@@ -132,7 +132,17 @@ function requestedPaths(execution) {
  * for reads: the attachment store is shared by every account, and only the
  * exact file an upload produced is meant to be reachable.
  */
-function isReadOnlyPathTool(execution) {
+function readsSharedRoot(execution) {
+    if (execution.name === "read" ||
+        execution.name === "read_image" ||
+        execution.name === "glob" ||
+        execution.name === "grep") {
+        return true;
+    }
+    return (execution.name === "str_replace_editor" &&
+        record(execution.arguments)?.command === "view");
+}
+function readsSingleFile(execution) {
     if (execution.name === "read" || execution.name === "read_image")
         return true;
     return (execution.name === "str_replace_editor" &&
@@ -176,7 +186,7 @@ function requestedWriteBytes(execution) {
  * directory-wide tools stay confined because the store is shared by every
  * account, and writes are never exempted.
  */
-export function qaUserWorkspaceDenial(execution, root, attachmentRoot) {
+export function qaUserWorkspaceDenial(execution, root, attachmentRoot, readPolicy = {}) {
     const args = record(execution.arguments);
     if (args?.sandbox_permissions !== undefined ||
         (execution.name === "edit" &&
@@ -189,12 +199,13 @@ export function qaUserWorkspaceDenial(execution, root, attachmentRoot) {
         execution.name.startsWith("job_") ||
         execution.name === "run_code" ||
         execution.name === "lsp" ||
-        execution.name === "apply_patch" ||
-        execution.name.startsWith("dsh_git_")) {
+        execution.name === "apply_patch") {
         return PATH_DENIAL;
     }
-    const readsOnly = isReadOnlyPathTool(execution);
+    const readsShared = readsSharedRoot(execution);
+    const readsOneFile = readsSingleFile(execution);
     try {
+        const sharedReadOnlyRoots = (readPolicy.sharedReadOnlyRoots ?? []).map(canonicalCandidate);
         for (const requested of requestedPaths(execution)) {
             const absolute = path.isAbsolute(requested)
                 ? requested
@@ -202,9 +213,13 @@ export function qaUserWorkspaceDenial(execution, root, attachmentRoot) {
             const canonical = canonicalCandidate(absolute);
             if (pathIsInside(canonical, root))
                 continue;
+            if (readsShared &&
+                sharedReadOnlyRoots.some((readRoot) => pathIsInside(canonical, readRoot))) {
+                continue;
+            }
             // Resolved only for a path the fence would otherwise refuse, so the
             // common case pays no extra filesystem walk.
-            if (readsOnly &&
+            if (readsOneFile &&
                 attachmentRoot !== undefined &&
                 pathIsInside(canonical, canonicalCandidate(attachmentRoot))) {
                 continue;

package/lib/user-workspace.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-workspace.js","sourceRoot":"","sources":["../src/user-workspace.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,SAAS,EACT,SAAS,EACT,WAAW,EACX,YAAY,EACZ,QAAQ,GACT,MAAM,SAAS,CAAC;AACjB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,iFAAiF;AACjF,MAAM,CAAC,MAAM,4BAA4B,GAAG,WAAW,CAAC;AAExD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAC7D,MAAM,CAAC,MAAM,iCAAiC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAElE,MAAM,eAAe,GACnB,6EAA6E,CAAC;AAChF,MAAM,WAAW,GACf,+DAA+D,CAAC;AAClE,MAAM,YAAY,GAAG,gDAAgD,CAAC;AAOtE,SAAS,QAAQ,CAAC,IAAY,EAAE,KAAa;IAC3C,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO;QACjC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE;QAC5C,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,IAAY;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7C,OAAO,CACL,QAAQ,KAAK,EAAE;QACf,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;YACpC,QAAQ,KAAK,IAAI;YACjB,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAC9B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,MAAM,GAAG,QAAQ,CAAC;IACtB,SAAS,CAAC;QACR,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;YACpE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACpC,IAAI,MAAM,KAAK,MAAM;gBAAE,MAAM,KAAK,CAAC;YACnC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YACtC,MAAM,GAAG,MAAM,CAAC;QAClB,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,+CAA+C,KAAK,EAAE,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,aAAqB,EACrB,MAAc;IAEd,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,kBAAkB,GAAG,YAAY,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,4BAA4B,CAAC,CAAC;IAC9E,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAChC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC9D,MAAM,kBAAkB,GAAG,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1D,IAAI,CAAC,YAAY,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;IACvD,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC/B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC7D,MAAM,iBAAiB,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxD,IACE,CAAC,YAAY,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;QACpD,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,kBAAkB,CAAC,EAC9D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,uBAAuB,CACrC,aAAqB,EACrB,MAAc;IAEd,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,kBAAkB,GAAG,YAAY,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,4BAA4B,CAAC,CAAC;IAC9E,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC9C,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAChC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC/B,MAAM,kBAAkB,GAAG,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1D,MAAM,iBAAiB,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxD,IACE,CAAC,YAAY,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;QACrD,CAAC,YAAY,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;QACpD,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,kBAAkB,CAAC,EAC9D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,SAA8B;IACpD,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAClC,QAAQ,SAAS,CAAC,IAAI,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC;QACZ,KAAK,YAAY,CAAC;QAClB,KAAK,OAAO,CAAC;QACb,KAAK,MAAM,EAAE,CAAC;YACZ,OAAO,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,CAAC;QACD,KAAK,MAAM,CAAC;QACZ,KAAK,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3D,CAAC;QACD,KAAK,oBAAoB,EAAE,CAAC;YAC1B,OAAO,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,CAAC;QACD;YACE,OAAO,EAAE,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,SAA8B;IACxD,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM,IAAI,SAAS,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IAC9E,OAAO,CACL,SAAS,CAAC,IAAI,KAAK,oBAAoB;QACvC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,MAAM,CAChD,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,SAAiB;IACrD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC;IACvB,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,IAAI,SAAS,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAG,CAAC;QAC/B,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAClE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACjD,IAAI,KAAK,CAAC,cAAc,EAAE;gBAAE,SAAS;YACrC,IAAI,KAAK,CAAC,WAAW,EAAE;gBAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;iBAC5C,IAAI,KAAK,CAAC,MAAM,EAAE;gBAAE,KAAK,IAAI,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC;YAC3D,IAAI,KAAK,GAAG,SAAS;gBAAE,MAAM;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,mBAAmB,CAAC,SAA8B;IACzD,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7D,OAAO,MAAM,CAAC,MAAM,CAClB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CACf,KAAK,GAAG,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EACpE,CAAC,CACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAA8B,EAC9B,IAAY,EACZ,cAAuB;IAEvB,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACzC,IACE,IAAI,EAAE,mBAAmB,KAAK,SAAS;QACvC,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM;YACxB,CAAC,IAAI,EAAE,WAAW,KAAK,IAAI,IAAI,IAAI,EAAE,UAAU,KAAK,IAAI,CAAC,CAAC,EAC5D,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,IACE,SAAS,CAAC,IAAI,KAAK,MAAM;QACzB,SAAS,CAAC,IAAI,KAAK,OAAO;QAC1B,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QACtC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QACjC,SAAS,CAAC,IAAI,KAAK,UAAU;QAC7B,SAAS,CAAC,IAAI,KAAK,KAAK;QACxB,SAAS,CAAC,IAAI,KAAK,aAAa;QAChC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EACrC,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,MAAM,SAAS,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAChD,IAAI,CAAC;QACH,KAAK,MAAM,SAAS,IAAI,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;YAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;gBACzC,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAClC,MAAM,SAAS,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YAC/C,IAAI,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC;gBAAE,SAAS;YAC5C,oEAAoE;YACpE,6CAA6C;YAC7C,IACE,SAAS;gBACT,cAAc,KAAK,SAAS;gBAC5B,YAAY,CAAC,SAAS,EAAE,kBAAkB,CAAC,cAAc,CAAC,CAAC,EAC3D,CAAC;gBACD,SAAS;YACX,CAAC;YACD,OAAO,WAAW,CAAC;QACrB,CAAC;QACD,IACE,SAAS,CAAC,IAAI,KAAK,OAAO;YAC1B,SAAS,CAAC,IAAI,KAAK,MAAM;YACzB,CAAC,SAAS,CAAC,IAAI,KAAK,oBAAoB;gBACtC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,MAAM,CAAC,EAClD,CAAC;YACD,MAAM,SAAS,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;YACjD,IACE,SAAS,GAAG,iCAAiC;gBAC7C,cAAc,CAAC,IAAI,EAAE,2BAA2B,CAAC,GAAG,SAAS;oBAC3D,2BAA2B,EAC7B,CAAC;gBACD,OAAO,YAAY,CAAC;YACtB,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAC;IACrB,CAAC;AACH,CAAC"}
+{"version":3,"file":"user-workspace.js","sourceRoot":"","sources":["../src/user-workspace.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,SAAS,EACT,SAAS,EACT,WAAW,EACX,YAAY,EACZ,QAAQ,GACT,MAAM,SAAS,CAAC;AACjB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,iFAAiF;AACjF,MAAM,CAAC,MAAM,4BAA4B,GAAG,WAAW,CAAC;AAExD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAC7D,MAAM,CAAC,MAAM,iCAAiC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAElE,MAAM,eAAe,GACnB,6EAA6E,CAAC;AAChF,MAAM,WAAW,GACf,+DAA+D,CAAC;AAClE,MAAM,YAAY,GAAG,gDAAgD,CAAC;AAYtE,SAAS,QAAQ,CAAC,IAAY,EAAE,KAAa;IAC3C,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO;QACjC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE;QAC5C,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,IAAY;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7C,OAAO,CACL,QAAQ,KAAK,EAAE;QACf,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;YACpC,QAAQ,KAAK,IAAI;YACjB,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAC9B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,MAAM,GAAG,QAAQ,CAAC;IACtB,SAAS,CAAC;QACR,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;YACpE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACpC,IAAI,MAAM,KAAK,MAAM;gBAAE,MAAM,KAAK,CAAC;YACnC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YACtC,MAAM,GAAG,MAAM,CAAC;QAClB,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,+CAA+C,KAAK,EAAE,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,aAAqB,EACrB,MAAc;IAEd,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,kBAAkB,GAAG,YAAY,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,4BAA4B,CAAC,CAAC;IAC9E,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAChC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC9D,MAAM,kBAAkB,GAAG,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1D,IAAI,CAAC,YAAY,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;IACvD,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC/B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC7D,MAAM,iBAAiB,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxD,IACE,CAAC,YAAY,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;QACpD,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,kBAAkB,CAAC,EAC9D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,uBAAuB,CACrC,aAAqB,EACrB,MAAc;IAEd,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,kBAAkB,GAAG,YAAY,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,4BAA4B,CAAC,CAAC;IAC9E,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC9C,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAChC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC/B,MAAM,kBAAkB,GAAG,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1D,MAAM,iBAAiB,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxD,IACE,CAAC,YAAY,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;QACrD,CAAC,YAAY,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;QACpD,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,kBAAkB,CAAC,EAC9D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,SAA8B;IACpD,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAClC,QAAQ,SAAS,CAAC,IAAI,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC;QACZ,KAAK,YAAY,CAAC;QAClB,KAAK,OAAO,CAAC;QACb,KAAK,MAAM,EAAE,CAAC;YACZ,OAAO,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,CAAC;QACD,KAAK,MAAM,CAAC;QACZ,KAAK,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3D,CAAC;QACD,KAAK,oBAAoB,EAAE,CAAC;YAC1B,OAAO,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,CAAC;QACD;YACE,OAAO,EAAE,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,SAA8B;IACrD,IACE,SAAS,CAAC,IAAI,KAAK,MAAM;QACzB,SAAS,CAAC,IAAI,KAAK,YAAY;QAC/B,SAAS,CAAC,IAAI,KAAK,MAAM;QACzB,SAAS,CAAC,IAAI,KAAK,MAAM,EACzB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CACL,SAAS,CAAC,IAAI,KAAK,oBAAoB;QACvC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,MAAM,CAChD,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,SAA8B;IACrD,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM,IAAI,SAAS,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IAC9E,OAAO,CACL,SAAS,CAAC,IAAI,KAAK,oBAAoB;QACvC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,MAAM,CAChD,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,SAAiB;IACrD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC;IACvB,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,IAAI,SAAS,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAG,CAAC;QAC/B,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAClE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACjD,IAAI,KAAK,CAAC,cAAc,EAAE;gBAAE,SAAS;YACrC,IAAI,KAAK,CAAC,WAAW,EAAE;gBAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;iBAC5C,IAAI,KAAK,CAAC,MAAM,EAAE;gBAAE,KAAK,IAAI,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC;YAC3D,IAAI,KAAK,GAAG,SAAS;gBAAE,MAAM;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,mBAAmB,CAAC,SAA8B;IACzD,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7D,OAAO,MAAM,CAAC,MAAM,CAClB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CACf,KAAK,GAAG,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EACpE,CAAC,CACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAA8B,EAC9B,IAAY,EACZ,cAAuB,EACvB,UAAU,GAA8B,EAAE;IAE1C,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACzC,IACE,IAAI,EAAE,mBAAmB,KAAK,SAAS;QACvC,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM;YACxB,CAAC,IAAI,EAAE,WAAW,KAAK,IAAI,IAAI,IAAI,EAAE,UAAU,KAAK,IAAI,CAAC,CAAC,EAC5D,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,IACE,SAAS,CAAC,IAAI,KAAK,MAAM;QACzB,SAAS,CAAC,IAAI,KAAK,OAAO;QAC1B,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QACtC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QACjC,SAAS,CAAC,IAAI,KAAK,UAAU;QAC7B,SAAS,CAAC,IAAI,KAAK,KAAK;QACxB,SAAS,CAAC,IAAI,KAAK,aAAa,EAChC,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,MAAM,WAAW,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,YAAY,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,mBAAmB,GAAG,CAAC,UAAU,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,GAAG,CACpE,kBAAkB,CACnB,CAAC;QACF,KAAK,MAAM,SAAS,IAAI,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;YAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;gBACzC,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAClC,MAAM,SAAS,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YAC/C,IAAI,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC;gBAAE,SAAS;YAC5C,IACE,WAAW;gBACX,mBAAmB,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CACpC,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAC,CAClC,EACD,CAAC;gBACD,SAAS;YACX,CAAC;YACD,oEAAoE;YACpE,6CAA6C;YAC7C,IACE,YAAY;gBACZ,cAAc,KAAK,SAAS;gBAC5B,YAAY,CAAC,SAAS,EAAE,kBAAkB,CAAC,cAAc,CAAC,CAAC,EAC3D,CAAC;gBACD,SAAS;YACX,CAAC;YACD,OAAO,WAAW,CAAC;QACrB,CAAC;QACD,IACE,SAAS,CAAC,IAAI,KAAK,OAAO;YAC1B,SAAS,CAAC,IAAI,KAAK,MAAM;YACzB,CAAC,SAAS,CAAC,IAAI,KAAK,oBAAoB;gBACtC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,MAAM,CAAC,EAClD,CAAC;YACD,MAAM,SAAS,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;YACjD,IACE,SAAS,GAAG,iCAAiC;gBAC7C,cAAc,CAAC,IAAI,EAAE,2BAA2B,CAAC,GAAG,SAAS;oBAC3D,2BAA2B,EAC7B,CAAC;gBACD,OAAO,YAAY,CAAC;YACtB,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAC;IACrB,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yadsh/dsh-qa-surface",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "A focused end-user QA surface backed by native DeepSeek Harness sessions",
   "repository": {
     "type": "git",
@@ -162,8 +162,8 @@
     "typescript": "^7.0.2",
     "vitest": "^4.1.11",
     "@yadsh/dsh-config": "^0.0.0",
-    "@yadsh/dsh-plugin-scripts": "^0.0.0",
-    "@yadsh/dsh-plugin-kit": "^0.1.0"
+    "@yadsh/dsh-plugin-kit": "^0.1.0",
+    "@yadsh/dsh-plugin-scripts": "^0.0.0"
   },
   "publishConfig": {
     "access": "public",