@yadsh/dsh-qa-surface 0.7.4 → 0.9.0

package/lib/types/client/types.d.ts

@@ -1,7 +1,7 @@
 import type { ClientRemote } from "@deepseek-ai/dsh-api-gateway/client";
 import type { ISessions, SessionFace } from "@deepseek-ai/dsh-api-session-controller/client";
 import type { UiConversation } from "@deepseek-ai/dsh-client-ui-conversation/client";
-import type { QaAccountProfileInput, QaAccountSession, QaAccountStartersInput, QaAccountStarter, QaAccountUserPublic, QaAccessAdminSnapshot, QaApprovalDecision, QaClaimResult, QaLockdownProof, QaOwnershipEntry, QaPendingApproval, QaPendingQuestion, QaQuestionAnswerItem, QaSessionState, QaSkillDocument, QaSkillDraftInput, QaSkillRemoval, QaSkillSummary, QaSkillToolDescriptor, QaSkillValidation, QaSourceFilePreview, QaTurnSources, QaWhoamiResult, QaCapabilitySelection, QaCurrentAccess, QaSessionAccess, QaSkillActivationRecord, QaSkillAssignmentOverride, QaSubrole, QaUserAccess, QaAdminAuditEvent, QaAdminOverview, QaAdminPage, QaAdminUserDetail, QaAdminUserRow, QaAdminUserUpdate, QaAuditQuery, QaConversationDetail, QaConversationQuery, QaConversationReview, QaConversationReviewInput, QaConversationSummary, QaFeedbackQuery, QaFeedbackRow, QaMessageFeedback, QaMessageFeedbackInput, QaQualityMetrics, QaReviewQueueItem, QaReviewQueueRow, QaUserQuery } from "../types.js";
+import type { QaAccountProfileInput, QaAccountSession, QaAccountStartersInput, QaAccountStarter, QaAccountUserPublic, QaAccessAdminSnapshot, QaApprovalDecision, QaClaimResult, QaLockdownProof, QaOwnershipEntry, QaPendingApproval, QaPendingQuestion, QaQuestionAnswerItem, QaSessionState, QaSkillDocument, QaSkillDraftInput, QaSkillRemoval, QaSkillSummary, QaSkillToolDescriptor, QaSkillValidation, QaSourceFilePreview, QaTurnSources, QaWhoamiResult, QaCapabilitySelection, QaCurrentAccess, QaSessionAccess, QaSkillActivationRecord, QaSkillAssignmentOverride, QaSubrole, QaUserAccess, QaAdminAuditEvent, QaAdminOverview, QaAdminPage, QaAdminUserDetail, QaAdminUserRow, QaAdminUserUpdate, QaAuditQuery, QaConversationDetail, QaConversationDeletion, QaConversationQuery, QaConversationReview, QaConversationReviewInput, QaConversationSummary, QaFeedbackQuery, QaFeedbackRow, QaMessageFeedback, QaMessageFeedbackInput, QaQualityMetrics, QaReviewQueueItem, QaReviewQueueRow, QaSlashCatalog, QaSlashExecution, QaSlashSubmitAttachment, QaUserQuery } from "../types.js";
 /** Wire content one prompt carries: text plus base64 image uploads. */
 export type QaPromptContent = Parameters<SessionFace["prompt"]>[0];
 /** DSH session runtime surface the QA controller is allowed to touch. */
@@ -58,6 +58,11 @@ export interface QaAdminApi {
     updateUser(token: string, userId: string, update: QaAdminUserUpdate): Promise<RemoteResult<QaAdminUserDetail>>;
     conversations(token: string, query: QaConversationQuery, cursor: string | null, limit: number | null): Promise<RemoteResult<QaAdminPage<QaConversationSummary>>>;
     conversation(token: string, conversationId: string): Promise<RemoteResult<QaConversationDetail>>;
+    /**
+     * Remove the conversation from the deployment, stored logs included. Only an
+     * administrator may call it; the sidebar's own delete is unrelated.
+     */
+    deleteConversation(token: string, conversationId: string): Promise<RemoteResult<QaConversationDeletion>>;
     feedback(token: string, query: QaFeedbackQuery, cursor: string | null, limit: number | null): Promise<RemoteResult<QaAdminPage<QaFeedbackRow>>>;
     /** The signed-in user's own verdict on one of their assistant messages. */
     rateMessage(token: string, conversationId: string, messageId: string, input: QaMessageFeedbackInput): Promise<RemoteResult<QaMessageFeedback>>;
@@ -107,6 +112,16 @@ export interface QaSourceApi {
         readonly error: unknown;
     }>;
 }
+/**
+ * The slash half of the Host namespace. The catalog comes back already cut
+ * down by the deployment policy and the chat's role; `execute` takes the raw
+ * line, because admission re-derives the name from it rather than trusting
+ * anything the browser says about which entry it means.
+ */
+export interface QaSlashApi {
+    catalog(token: string, sessionId: string): Promise<RemoteResult<QaSlashCatalog>>;
+    execute(token: string, sessionId: string, line: string, attachments: readonly QaSlashSubmitAttachment[]): Promise<RemoteResult<QaSlashExecution>>;
+}
 /** A source API with the account token already bound at the call site. */
 export type QaBoundSourceApi = {
     sources(sessionId: string): Promise<{

package/lib/types/config-resolvers/slash-commands.d.ts

@@ -0,0 +1,20 @@
+import type { QaSurfaceConfig, ResolvedQaSlashCommands } from "../types.js";
+/** Palette ceilings; a palette longer than the viewport is unusable on mobile. */
+export declare const QA_SLASH_MAX_VISIBLE_MIN = 1;
+export declare const QA_SLASH_MAX_VISIBLE_MAX = 100;
+/**
+ * Resolve the slash interface policy.
+ *
+ * The master switch lives in lockdown, so it arrives as a neighbor rather than
+ * being re-read here — one owner per decision. Two consequences are deliberate:
+ *
+ * - An upgrade from a deployment that had already set
+ *   `lockdown.allowSlashCommands: true` but knows nothing about this section
+ *   keeps working: skills fall back to `all` (every user-invocable skill the
+ *   session already exposed) and commands stay denied. The flag is reported as
+ *   `legacyDefaults` so the Host can say so once, out loud.
+ * - A deployment that declares the section and leaves the switch off changes
+ *   nothing at all: the resolved policy is inert until the switch is on.
+ */
+export declare function resolveSlashCommands(input: QaSurfaceConfig, allowSlashCommands: boolean): ResolvedQaSlashCommands;
+//# sourceMappingURL=slash-commands.d.ts.map

package/lib/types/index.d.ts

@@ -1,7 +1,7 @@
 import { TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
 import type { Context } from "@deepseek-ai/cordis";
 import type { QaTurnSources } from "./provenance/types.js";
-import type { QaAccountProfileInput, QaAccountSession, QaAccountStartersInput, QaAccountUserPublic, QaApprovalDecision, QaClaimResult, QaLockdownProof, QaOwnershipEntry, QaPendingApproval, QaPendingQuestion, QaQuestionAnswerItem, QaSurfaceConfig, ResolvedQaSurfaceConfig, QaSkillDocument, QaSkillDraftInput, QaSkillRemoval, QaSkillSummary, QaSkillToolDescriptor, QaSkillValidation, QaSourceFilePreview, QaWhoamiResult, QaPrincipal, QaAccessAdminSnapshot, QaAdminAuditEvent, QaAdminOverview, QaAdminPage, QaAdminUserDetail, QaAdminUserRow, QaAdminUserUpdate, QaAuditQuery, QaCapabilitySelection, QaConversationDetail, QaConversationQuery, QaConversationReview, QaConversationReviewInput, QaConversationSummary, QaCurrentAccess, QaFeedbackQuery, QaFeedbackRow, QaMessageFeedback, QaMessageFeedbackInput, QaQualityMetrics, QaReviewQueueItem, QaReviewQueueRow, QaSessionAccess, QaSkillActivationRecord, QaSkillAssignmentOverride, QaSubrole, QaUserAccess, QaUserQuery } from "./types.js";
+import type { QaAccountProfileInput, QaAccountSession, QaAccountStartersInput, QaAccountUserPublic, QaApprovalDecision, QaClaimResult, QaLockdownProof, QaOwnershipEntry, QaPendingApproval, QaPendingQuestion, QaQuestionAnswerItem, QaSurfaceConfig, ResolvedQaSurfaceConfig, QaSkillDocument, QaSkillDraftInput, QaSkillRemoval, QaSkillSummary, QaSkillToolDescriptor, QaSkillValidation, QaSourceFilePreview, QaWhoamiResult, QaPrincipal, QaAccessAdminSnapshot, QaAdminAuditEvent, QaAdminOverview, QaAdminPage, QaAdminUserDetail, QaAdminUserRow, QaAdminUserUpdate, QaAuditQuery, QaCapabilitySelection, QaConversationDetail, QaConversationDeletion, QaConversationQuery, QaConversationReview, QaConversationReviewInput, QaConversationSummary, QaCurrentAccess, QaFeedbackQuery, QaFeedbackRow, QaMessageFeedback, QaMessageFeedbackInput, QaQualityMetrics, QaReviewQueueItem, QaReviewQueueRow, QaSessionAccess, QaSlashCatalog, QaSlashExecution, QaSlashSubmitAttachment, QaSkillActivationRecord, QaSkillAssignmentOverride, QaSubrole, QaUserAccess, QaUserQuery } from "./types.js";
 export declare const name = "qa-surface";
 export declare const inject: string[];
 import { QA_SURFACE_SETTINGS_NAMESPACE } from "./shared/settings.js";
@@ -38,6 +38,12 @@ export declare class QaSurface extends TypertRemoteService {
     private readonly personalSkills;
     /** Personal-skill remote bodies; the wire signatures stay on this class. */
     private readonly skillRemotes;
+    /**
+     * Slash-catalog and command-admission bodies. Admission, not execution:
+     * the native skill and command runtimes stay the only things that know what
+     * a `/name` means.
+     */
+    private readonly slashRemotes;
     private readonly launchToken;
     /** Root session principals attested for their owner, never for admin viewing. */
     private readonly integrationPrincipals;
@@ -52,6 +58,25 @@ export declare class QaSurface extends TypertRemoteService {
     constructor(ctx: Context, entry?: QaSurfaceConfig);
     /** The quality store, opening its file the first time anyone needs it. */
     private quality;
+    /**
+     * The standing scope of the preset QA chats run under, so an administrator's
+     * capability catalog is read the way a chat reads it. Everything a preset
+     * mounts — its skill catalog, its tool family — is registered in that scope,
+     * and a global-only read showed the operator an almost empty page. Resolving
+     * the preset composes it but starts no agent, no session and no turn;
+     * without a pinned preset there is nothing to borrow, and the read stays
+     * global.
+     */
+    private qaPresetScope;
+    /**
+     * Drop what the quality layer kept about chats that no longer exist in the
+     * Harness. The ownership sweep calls this with the ids it reclaimed: the
+     * record it removes is one thing the deployment held about a chat, and
+     * ratings, reviews and queue entries are the rest. Failure is logged and
+     * swallowed — housekeeping runs inside a review read, and a store that
+     * cannot be opened must not fail the page that triggered it.
+     */
+    private dropVanishedChats;
     /** Resolve browser authentication to the caller only; never accepts an id. */
     principalForToken(token: string): QaPrincipal | undefined;
     /** Resolve only a directly QA-owned root session; delegated children fail closed. */
@@ -59,6 +84,21 @@ export declare class QaSurface extends TypertRemoteService {
     /** Admit tools that independently enforce the same QA principal boundary. */
     registerPrincipalScopedTools(names: readonly string[]): () => void;
     getConfig(): ResolvedQaSurfaceConfig;
+    /**
+     * Ownership plus the role's user-skill grant for one slash read.
+     *
+     * Ownership comes first and for the same reason the rest of the plugin does
+     * it: a catalog names the skills a chat can reach, and a foreign browser has
+     * no business enumerating that. With accounts off there is no identity to
+     * check and the deployment's lockdown is the boundary, exactly as it is for
+     * every other remote.
+     *
+     * The grant mirrors `installQaSkillPolicy` to the letter — an empty
+     * `userSkills` list means the role keeps no separate user list, not that it
+     * grants nothing — so the palette can never offer a skill the typed gesture
+     * would refuse, nor hide one it would accept.
+     */
+    private slashSessionGrant;
     /**
      * Self-service signup; the first account ever created becomes admin. The
      * display name derives from the email: the generated client enforces exact
@@ -68,7 +108,11 @@ export declare class QaSurface extends TypertRemoteService {
     accountsLogin(email: string, password: string): QaAccountSession;
     /** Identity probe; safe to call with an empty or expired token. */
     accountsWhoami(token: string): QaWhoamiResult;
-    /** Migrate a browser's local chat index into server-side ownership. */
+    /**
+     * Migrate a browser's local chat index into server-side ownership. The
+     * access service owns the filter: a delegated session in that index is not a
+     * chat and is never claimed.
+     */
     accountsClaimSessions(token: string, sessionIds: readonly string[]): QaClaimResult;
     /** The token user's owned session ids; the sidebar list authority. */
     accountsOwnedSessions(token: string): {
@@ -135,6 +179,12 @@ export declare class QaSurface extends TypertRemoteService {
     adminConversations(token: string, query: QaConversationQuery, cursor: string | null, limit: number | null): Promise<QaAdminPage<QaConversationSummary>>;
     /** One conversation with its messages, tool calls and review state. */
     adminConversation(token: string, conversationId: string): Promise<QaConversationDetail>;
+    /**
+     * Remove one conversation from the deployment. Admin-only, audited, and the
+     * only path that deletes what a person wrote — the sidebar's own delete
+     * stays what it always was, a per-browser row.
+     */
+    adminDeleteConversation(token: string, conversationId: string): Promise<QaConversationDeletion>;
     adminFeedback(token: string, query: QaFeedbackQuery, cursor: string | null, limit: number | null): Promise<QaAdminPage<QaFeedbackRow>>;
     /**
      * Rate one of the caller's own assistant messages. The token names the only
@@ -212,7 +262,38 @@ export declare class QaSurface extends TypertRemoteService {
     skillsTools(token: string): {
         readonly tools: readonly QaSkillToolDescriptor[];
     };
+    /**
+     * The slash entries this browser may offer for one chat: the session's
+     * user-invocable skills and its agent's effective commands, already cut down
+     * by the deployment policy and by the chat's role. The browser filters and
+     * ranks this list; it never widens it.
+     *
+     * Enabled is reported rather than assumed, so a page that loaded before the
+     * operator flipped the master switch learns the truth instead of showing an
+     * empty palette forever.
+     */
+    slashCatalog(token: string, sessionId: string): Promise<QaSlashCatalog>;
+    /**
+     * Run one human command line. The line is the whole request — the browser
+     * sends no name, no kind and no descriptor, so there is nothing for it to
+     * forge; admission re-derives the name and re-checks the policy against the
+     * deployment's own config.
+     *
+     * A command never becomes a model message: the native runtime answers it and
+     * writes `command/run`/`command/done` into the session log, which is where
+     * the transcript row is read from.
+     */
+    slashExecute(token: string, sessionId: string, line: string, attachments: readonly QaSlashSubmitAttachment[]): Promise<QaSlashExecution>;
     private refreshRoute;
+    /**
+     * A deployment that set `lockdown.allowSlashCommands: true` before this
+     * section existed keeps the behaviour it asked for — skills at `all`,
+     * commands denied — and is told so once per configuration change, because
+     * "skills appeared after the upgrade" is otherwise indistinguishable from a
+     * defect. Commands are never part of that fallback: an upgrade must not hand
+     * the user a control-plane command nobody named.
+     */
+    private warnLegacySlashDefaults;
     /**
      * The document pipeline moved out of this plugin into `@yadsh/dsh-documents`.
      * A deployment whose profile still carries the old `documents` section would

package/lib/types/lockdown-policy.d.ts

@@ -25,4 +25,20 @@ export declare function qaToolPolicyPlan(allow: readonly string[], isMounted: (t
  *   stays as unchecked as any allow-listed one, and no less.
  */
 export declare function qaToolDenial(allowed: ReadonlySet<string>, toolName: string, dynamicNames?: readonly string[]): string | undefined;
+/**
+ * The conversation-wide ceiling, applied to every agent of an attested chat.
+ *
+ * A scoped restriction and a scoped guard cover the scope that owns them and
+ * that scope's descendants. A delegated child is composed from the parent's
+ * PRESET, so the parent agent's own layers never enter the child's chain: the
+ * child is bounded by its preset `toolFilter` alone, and an expert can
+ * therefore hold — and call — a tool the subrole never granted the chat. This
+ * check is the ceiling the whole conversation shares: the subrole's reach,
+ * visible tools plus the grantable ones, so a skill may still hand a tool to a
+ * delegated assistant, but nothing may exceed what the role could ever grant.
+ * @param ceiling - names reachable anywhere in this conversation.
+ * @param toolName - the tool the model is trying to call.
+ * @returns the denial reason, or `undefined` when the call is within reach.
+ */
+export declare function qaCeilingDenial(ceiling: ReadonlySet<string>, toolName: string): string | undefined;
 //# sourceMappingURL=lockdown-policy.d.ts.map

package/lib/types/personal-skills/service.d.ts

@@ -92,6 +92,11 @@ export declare class QaPersonalSkills {
      * The skills one session cwd exposes to DSH. A file the parser rejects, or
      * one whose name disagrees with its directory, is reported in the editor and
      * never handed to the model as a half-valid skill.
+     *
+     * This is the model-facing discovery path, so it degrades to empty instead
+     * of throwing: a provider that throws marks the whole catalog snapshot
+     * incomplete, and the harness then withholds the available-skills section
+     * from every session — not just this account's skills.
      */
     discover(cwd: string): readonly QaStoredSkill[];
     /** Re-read one skill of a session cwd, re-checking the same boundary. */

package/lib/types/provenance/host-store.d.ts

@@ -35,11 +35,28 @@ export declare class QaProvenanceHost {
     constructor(ctx: Context, config: () => ResolvedQaSurfaceConfig, store?: QaProvenanceSnapshotStore, onPersistenceError?: (error: unknown) => void);
     dispose(): void;
     /**
-     * Drop every per-session record of one chat. Long-lived servers outlive
-     * their sessions by weeks; without this the collector, snapshot, call and
-     * lineage maps grow with every chat and turn forever.
+     * Drop the in-memory per-session records of one chat. Long-lived servers
+     * outlive their sessions by weeks; without this the collector, snapshot,
+     * call and lineage maps grow with every chat and turn forever. The durable
+     * snapshot file is intentionally kept: `session/disposed` also fires for
+     * runtime teardown of a chat that still exists and will be reopened, and
+     * its stored turns are what let the transcript show sources after a Host
+     * restart. Growth of the file is bounded by the snapshot store's caps.
      */
     private forget;
+    private forgetById;
+    /**
+     * Drop everything kept about one chat, in memory and in storage alike.
+     *
+     * Unlike {@link forget}, which runs on every teardown of a chat that still
+     * exists and deliberately keeps its stored turns, this is for a chat that is
+     * gone: nothing will reopen it, so the durable shard goes with it. The
+     * administrative deletion calls this in the same act that removes the
+     * session's logs.
+     *
+     * @param sessionId - the chat whose collected sources are dropped.
+     */
+    dropSession(sessionId: string): void;
     private forgetAll;
     bundles(sessionId: string): readonly QaTurnSources[];
     sourceAllowed(sessionId: string, path: string): boolean;

package/lib/types/provenance/retention.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Retention contract for durable provenance.
+ *
+ * This module is deliberately free of Node imports: the resolved default
+ * config reaches the browser bundle through `resolve-config`, and a single
+ * `node:fs` import here would break that bundle at runtime.
+ */
+/**
+ * What a sharded provenance store keeps. Every bound counts turns, shards or
+ * days; zero means "keep everything" for that bound.
+ */
+export interface QaProvenanceRetention {
+    /** Newest turns kept per chat. */
+    readonly maxTurnsPerSession: number;
+    /** Chats kept, most recently written first. */
+    readonly maxSessions: number;
+    /** Chats untouched for longer than this are dropped. */
+    readonly maxAgeDays: number;
+    /** How often a write may trigger the directory sweep. */
+    readonly sweepIntervalMinutes: number;
+}
+/**
+ * Defaults sized for a QA deployment: one chat is worth a few hundred turns, a
+ * fortnight of chats is worth keeping, and an untouched month is finished.
+ */
+export declare const DEFAULT_QA_PROVENANCE_RETENTION: QaProvenanceRetention;
+/** Bounds the configuration validator enforces, mirrored for the CLI. */
+export declare const QA_PROVENANCE_RETENTION_LIMITS: Readonly<{
+    maxTurnsPerSession: {
+        min: number;
+        max: number;
+    };
+    maxSessions: {
+        min: number;
+        max: number;
+    };
+    maxAgeDays: {
+        min: number;
+        max: number;
+    };
+    sweepIntervalMinutes: {
+        min: number;
+        max: number;
+    };
+}>;
+//# sourceMappingURL=retention.d.ts.map

package/lib/types/provenance/snapshot-store.d.ts

@@ -1,23 +1,79 @@
+import { type QaProvenanceRetention } from "./retention.js";
 import type { QaTurnSources } from "./types.js";
 export interface QaProvenanceSnapshotStore {
     list(sessionId: string): readonly QaTurnSources[];
     put(bundle: QaTurnSources): void;
+    /**
+     * Drop one session's snapshots. The host store wires this to the session's
+     * disposal, which is what keeps the durable file from growing with every
+     * chat a long-lived server ever served.
+     */
+    drop(sessionId: string): void;
+}
+/**
+ * Retention bounds and their defaults live in a Node-free module: the resolved
+ * default config reaches the browser bundle, and this file does not.
+ */
+export { DEFAULT_QA_PROVENANCE_RETENTION, QA_PROVENANCE_RETENTION_LIMITS, } from "./retention.js";
+export type { QaProvenanceRetention } from "./retention.js";
+/** What one directory sweep did, for the maintenance command and the tests. */
+export interface QaProvenanceSweepResult {
+    readonly scanned: number;
+    readonly droppedByAge: number;
+    readonly droppedByCount: number;
 }
 /** Process-local store used by tests and explicit ephemeral deployments. */
 export declare class MemoryQaProvenanceSnapshotStore implements QaProvenanceSnapshotStore {
     private readonly sessions;
     list(sessionId: string): readonly QaTurnSources[];
     put(bundle: QaTurnSources): void;
+    drop(sessionId: string): void;
 }
-/** Default durable provenance path, deliberately outside Harness journals. */
-export declare function defaultQaProvenanceFilePath(): string;
-/** Atomically persists per-turn QA source snapshots in plugin-owned storage. */
+/** Default durable provenance directory, deliberately outside Harness journals. */
+export declare function defaultQaProvenanceDirectoryPath(): string;
+/** The pre-sharding monolith, migrated on first use and then left alone. */
+export declare function defaultLegacyProvenanceFilePath(): string;
+/**
+ * Durable provenance, one file per chat.
+ *
+ * The read API is per-session and nothing enumerates every chat, so a shard is
+ * exactly the unit a writer touches: a turn rewrites one chat's history rather
+ * than every chat's. Empty turns collapse to their numbers and each shard is
+ * bounded by `QaProvenanceRetention`, so neither a long chat nor a long-lived
+ * deployment can make a single write grow without limit.
+ *
+ * The store is the only writer of its directory, and no cache sits in front of
+ * it: every read goes to disk.
+ */
 export declare class FileQaProvenanceSnapshotStore implements QaProvenanceSnapshotStore {
-    private readonly filePath;
-    constructor(filePath?: string);
+    private readonly directoryPath;
+    private readonly retention;
+    private readonly legacyFilePath;
+    private migrated;
+    private lastSweepAt;
+    constructor(directoryPath?: string, retention?: () => QaProvenanceRetention, legacyFilePath?: string);
     list(sessionId: string): readonly QaTurnSources[];
     put(bundle: QaTurnSources): void;
-    private load;
-    private persist;
+    drop(sessionId: string): void;
+    /**
+     * Drop shards the retention policy no longer covers: untouched for
+     * `maxAgeDays`, then everything past the `maxSessions` most recent ones.
+     *
+     * `keep` names the chat whose shard must survive the sweep — a caller that
+     * swept right after writing it would otherwise be able to delete the very
+     * bundle it just stored.
+     */
+    sweep(keep?: string): QaProvenanceSweepResult;
+    /**
+     * Split the pre-sharding monolith into shards exactly once, then rename it
+     * out of the way. A shard that already exists wins the merge, so a retried
+     * migration cannot lose turns that arrived after the first attempt.
+     */
+    private migrateLegacyOnce;
+    private shardPath;
+    private readShard;
+    private writeShard;
+    private removeShard;
+    private maybeSweep;
 }
 //# sourceMappingURL=snapshot-store.d.ts.map

package/lib/types/questions.d.ts

@@ -33,6 +33,12 @@ export interface QaQuestionAnswer {
 }
 /** What the model reads when the deployment does not answer questions. */
 export declare const QA_QUESTIONS_UNSUPPORTED = "questions are not answered in this assistant view; ask the user in plain text instead";
+/**
+ * The harness tool that produces these requests. A deployment that parks
+ * questions still has to let the attested session call it: this plugin never
+ * adds the name to a tool policy on its own.
+ */
+export declare const QA_ASK_QUESTION_TOOL = "ask_user_question";
 /**
  * User questions in the QA view.
  *
@@ -68,6 +74,11 @@ export declare class QaQuestionGate {
      * parked request is authoritative: a label the question never offered is
      * dropped, and a free-text answer replaces the choice in a single-select
      * rather than accompanying it, so the model only ever reads a real answer.
+     *
+     * The payload arrives over the wire from the browser, so its shape is
+     * untrusted: a non-array, a non-object entry, or a non-array/non-string
+     * selection is folded into the refusal/skip semantics instead of crashing
+     * the gate with a TypeError.
      */
     answer(sessionId: string, requestId: string, answers: readonly QaQuestionAnswerItem[]): boolean;
     /** Close a request without answering it. */
@@ -79,5 +90,7 @@ export declare class QaQuestionGate {
     private park;
     /** Fail the questions one session's agent owns; a disposed agent cannot ask. */
     private settleOwner;
+    /** Fail the questions one agent parked; an idle agent cannot receive them. */
+    private settleAgent;
 }
 //# sourceMappingURL=questions.d.ts.map

package/lib/types/secure-session.d.ts

@@ -1,6 +1,7 @@
 import type { Agent } from "@deepseek-ai/dsh-agent";
 import type { Context } from "@deepseek-ai/cordis";
 import type { PluginLogger } from "@yadsh/dsh-plugin-log";
+import { type QaSessionFacts } from "./accounts/store.js";
 import type { QaResolvedSessionPolicy } from "./access/service.js";
 import type { QaLockdownProof, ResolvedQaSurfaceConfig } from "./types.js";
 /**
@@ -9,7 +10,7 @@ import type { QaLockdownProof, ResolvedQaSurfaceConfig } from "./types.js";
  * pair or throw the coarse `QaAttestationError`; see {@link QaAccounts}.
  */
 export interface QaAccountsGate {
-    enforceSessionAccess(token: string, sessionId: string): {
+    enforceSessionAccess(token: string, sessionId: string, facts?: QaSessionFacts): {
         readonly id: string;
     } | undefined;
     userWorkspace(userId: string, registeredWorkspacePath: string): string;
@@ -47,7 +48,17 @@ export declare class QaPolicyAdmission {
      */
     private readonly attested;
     private readonly workspaceAccess;
+    /**
+     * Every name reachable anywhere in one QA conversation, keyed by session id.
+     *
+     * The chat's agent and the agents delegated from it share one entry —
+     * children inherit it when their session is created — because the ceiling is
+     * a property of the conversation, not of one scope. See
+     * {@link qaCeilingDenial} for why a scoped restriction cannot express it.
+     */
+    private readonly ceilings;
     private readonly disposeWorkspaceGuard;
+    private readonly disposeCeilingGuard;
     constructor(ctx: Context, config: () => ResolvedQaSurfaceConfig, logger: PluginLogger, accounts?: QaAccountsGate | undefined, 
     /**
      * Names the QA tool catalog attached to one agent after its activation
@@ -100,6 +111,21 @@ export declare class QaPolicyAdmission {
      * mismatch"), and the adoption and permission checks stay the gate.
      */
     private liveAgent;
+    /**
+     * The Host-registered facts of one session, for the accounts gate's bounded
+     * auto-claim. A session this process has not materialized (a chat of an
+     * earlier Host run, reached before its agent exists) yields no facts and
+     * keeps the historical unbounded claim.
+     */
+    private sessionFacts;
+    /**
+     * Account identity and ownership are checked before any policy work: an
+     * invalid token must not learn whether a session exists or how the
+     * deployment composes. Independent of lockdown — a deployment may gate
+     * users without pinning the policy, and the gate itself no-ops while
+     * accounts are disabled.
+     */
+    private accessOwner;
     secureSession(token: string, sessionId: string): Promise<QaLockdownProof>;
     /**
      * Mask one agent down to the policy's tool names, for the account-free path

package/lib/types/slash/catalog.d.ts

@@ -0,0 +1,56 @@
+/**
+ * The unified presentation model behind the palette.
+ *
+ * Two native catalogs arrive here — the session's user-invocable skills and
+ * the session agent's effective commands — and leave as one list of entries
+ * whose identity is `skill:<name>` / `command:<name>`. The prefix is the whole
+ * point: both registries may publish a `plan`, and a palette that keyed rows
+ * by bare name would let one of them silently replace the other.
+ *
+ * Pure on purpose. Nothing here reads a session, a service or a file: the host
+ * remote gathers the native inputs, this module decides what the palette sees,
+ * and the tests drive it with plain arrays.
+ */
+import type { QaSlashCatalogEntry, QaSlashCommandSurface } from "../types.js";
+import { type QaSlashPolicy } from "./policy.js";
+export declare const QA_SLASH_SKILL_PREFIX = "skill:";
+export declare const QA_SLASH_COMMAND_PREFIX = "command:";
+/** One user-invocable skill, as the skills registry published it. */
+export interface QaSlashNativeSkill {
+    readonly name: string;
+    readonly description: string;
+    readonly whenToUse?: string;
+    /** Whether the model is also offered this skill. */
+    readonly modelInvocable?: boolean;
+}
+/** One effective command descriptor, as the command registry published it. */
+export interface QaSlashNativeCommand {
+    readonly name: string;
+    readonly description: string;
+    readonly inputHint?: string;
+    readonly acceptsAttachments?: boolean;
+}
+export interface BuildSlashCatalogOptions {
+    readonly skills: readonly QaSlashNativeSkill[];
+    readonly commands: readonly QaSlashNativeCommand[];
+    readonly skillPolicy: QaSlashPolicy;
+    readonly commandPolicy: QaSlashPolicy;
+    /**
+     * The session role's own user-skill grant, when the access system is on.
+     * `undefined` means the role system has no opinion, which is its state on a
+     * deployment that never enabled roles — not "grant nothing".
+     */
+    readonly grantedSkills?: readonly string[] | undefined;
+    readonly commandSurface: QaSlashCommandSurface;
+    /** Native entries arrive alphabetically; this makes the order explicit. */
+    readonly localeCompare?: (left: string, right: string) => number;
+}
+/** The routing identity of one native name; never the bare name. */
+export declare function slashEntryId(kind: QaSlashCatalogEntry["kind"], name: string): string;
+/**
+ * Build the palette the browser is allowed to show. Skills lead, commands
+ * follow: the two kinds stay contiguous so the palette can group them without
+ * re-sorting, and a name collision keeps both rows.
+ */
+export declare function buildSlashCatalog(options: BuildSlashCatalogOptions): readonly QaSlashCatalogEntry[];
+//# sourceMappingURL=catalog.d.ts.map

package/lib/types/slash/matcher.d.ts

@@ -0,0 +1,51 @@
+/**
+ * One matcher for both halves of the slash catalog.
+ *
+ * Upstream matches skills with `startsWith` and commands fuzzily, so the same
+ * query behaves differently depending on which registry answers it. QA always
+ * ranks with the ladder below, in this order:
+ *
+ *   exact → prefix → name-token boundary → substring → ordered subsequence
+ *
+ * so `/tkp` finds `generate-tkp` through the token boundary and `/contract`
+ * finds both `contract-analysis` (prefix) and `review-contract` (token).
+ *
+ * Dependency-free on purpose: inlined into the browser bundle.
+ */
+/** How a name matched; lower is a stronger claim on the top of the list. */
+export declare const SLASH_MATCH_EXACT = 0;
+export declare const SLASH_MATCH_PREFIX = 1;
+export declare const SLASH_MATCH_TOKEN = 2;
+export declare const SLASH_MATCH_SUBSTRING = 3;
+export declare const SLASH_MATCH_SUBSEQUENCE = 4;
+export interface QaSlashMatch {
+    readonly rank: number;
+    /** Where the match starts; earlier wins inside one rank. */
+    readonly index: number;
+}
+export interface QaSlashMatchOptions {
+    /**
+     * Whether the two weakest rungs run. Turning them off keeps the matcher
+     * predictable for deployments that read the palette as an index.
+     */
+    readonly fuzzy?: boolean;
+}
+/**
+ * Rank one name against a palette query. An empty query matches everything at
+ * the prefix rung, which keeps the unfiltered catalog in catalog order.
+ */
+export declare function matchSlashName(name: string, query: string, options?: QaSlashMatchOptions): QaSlashMatch | undefined;
+/**
+ * Order two ranked names; the caller has already ruled out `undefined`. Ties
+ * fall back to the name, so equal-rank rows keep catalog order and the list
+ * never reshuffles between two renders of the same query.
+ */
+export declare function compareSlashMatches(leftName: string, left: QaSlashMatch, rightName: string, right: QaSlashMatch): number;
+/**
+ * The matching entries in rank order. Identity of the input entries is
+ * preserved, so a caller can render them without a lookup.
+ */
+export declare function rankSlashEntries<T extends {
+    readonly name: string;
+}>(entries: readonly T[], query: string, options?: QaSlashMatchOptions): readonly T[];
+//# sourceMappingURL=matcher.d.ts.map

package/lib/types/slash/parser.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Composer input classification for the slash interface.
+ *
+ * The grammars are mirrors, not inventions: a command line is what the native
+ * command runtime parses (`/name` at byte zero, name then end-of-input or
+ * whitespace, everything after kept verbatim as `rawInput`), and a skill
+ * gesture is what `dsh-tool-skill` recognises (any whitespace-bounded `/name`
+ * token with the public skill-name grammar). A line that matches neither is
+ * ordinary prose and must keep behaving exactly as it did before this feature.
+ *
+ * Deliberately dependency-free: this module is inlined into the browser
+ * bundle, where the Host's config surface must not follow it.
+ */
+export interface QaSlashLine {
+    readonly name: string;
+    /** Exact text after the name, including the separator whitespace. */
+    readonly args: string;
+}
+/**
+ * Parse a command-shaped line. `undefined` means the line is not one — either
+ * it is not slash-led at all, or the token after the slash is not a command
+ * name (`/usr/bin/env` stays a path, not a call).
+ */
+export declare function parseSlashLine(input: string): QaSlashLine | undefined;
+/** The palette filter of a draft, or `undefined` when the palette is closed. */
+export declare function slashPaletteQuery(input: string): string | undefined;
+/**
+ * Every whitespace-bounded `/name` gesture in the text, first-seen order and
+ * deduplicated. The Host owns invocation; this list exists only so the QA
+ * surface can warn about a gesture its own policy withholds before the turn
+ * is submitted.
+ */
+export declare function skillGestures(input: string): readonly string[];
+/** The invocation a submitted draft carries, once its route is decided. */
+export interface QaSlashInvocation {
+    readonly name: string;
+    /** Text after the name with its separator whitespace removed. */
+    readonly args: string;
+}
+/**
+ * The invocation a draft names, independent of the catalog. Used for the
+ * routing decision and for the "unknown command" refusal, both of which must
+ * work while the catalog itself is unavailable.
+ */
+export declare function slashInvocation(input: string): QaSlashInvocation | undefined;
+//# sourceMappingURL=parser.d.ts.map