@yadsh/dsh-qa-surface 0.7.4 → 0.9.0

package/lib/types/slash/policy.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Admission policy for one half of the slash catalog.
+ *
+ * The policy is name-based because the persisted config is: an operator writes
+ * `generate-tkp`, never an internal id, and the same name means the same thing
+ * on every Host restart. Names that cannot be a native skill or command name
+ * are refused at config resolution rather than silently ignored at admission,
+ * so a typo surfaces while the deployment is being configured.
+ */
+import type { QaSlashPolicyMode } from "../types.js";
+/** Every accepted policy mode, in the order the settings card lists them. */
+export declare const QA_SLASH_MODES: readonly QaSlashPolicyMode[];
+/** Longest name either registry accepts in practice; keeps host echoes bounded. */
+export declare const QA_SLASH_NAME_MAX = 200;
+export interface QaSlashPolicy {
+    readonly mode: QaSlashPolicyMode;
+    readonly allow: readonly string[];
+}
+export declare function isQaSlashPolicyMode(value: unknown): value is QaSlashPolicyMode;
+/**
+ * Normalize one allow-list: trimmed, deduplicated, order-preserving. Refuses
+ * a name that neither registry could ever carry, and refuses `all` alongside a
+ * non-empty list, which would be two answers to one question.
+ */
+export declare function normalizeSlashAllow(values: readonly string[], label: string): readonly string[];
+/** Whether the policy admits this native name. */
+export declare function allowsSlashName(policy: QaSlashPolicy, name: string): boolean;
+/** The admitted subset, in the order the native registry returned it. */
+export declare function filterBySlashPolicy<T extends {
+    readonly name: string;
+}>(entries: readonly T[], policy: QaSlashPolicy): readonly T[];
+/**
+ * Intersect an already-admitted list with a second name set (the session's
+ * role grant). An empty set means "no second opinion" — the role system keeps
+ * its own switch, and a deployment that never enabled it grants nothing here.
+ */
+export declare function intersectSlashNames<T extends {
+    readonly name: string;
+}>(entries: readonly T[], names: readonly string[] | undefined): readonly T[];
+//# sourceMappingURL=policy.d.ts.map

package/lib/types/slash/remotes.d.ts

@@ -0,0 +1,35 @@
+import type { Context } from "@deepseek-ai/cordis";
+import type { PluginLogger } from "@yadsh/dsh-plugin-log";
+import type { QaSlashCatalog, QaSlashExecution, QaSlashSubmitAttachment, ResolvedQaSurfaceConfig } from "../types.js";
+/**
+ * Host-side bodies of the slash remotes. The `@Remote`-decorated signatures
+ * stay on the `QaSurface` service class (typert code generation reads the class
+ * shape); this context owns everything behind them.
+ *
+ * The division of labour is the whole feature in one sentence: QA decides what
+ * the palette may show and whether a line may run, and the native registries
+ * decide what a skill and a command *mean*. Nothing here reads a SKILL.md,
+ * injects instructions or re-implements a registry.
+ */
+export interface QaSlashRemotes {
+    /** The catalog this browser may render, already policy-filtered. */
+    catalog(token: string, sessionId: string): Promise<QaSlashCatalog>;
+    /** Run one human command line through the native command runtime. */
+    execute(token: string, sessionId: string, line: string, attachments: readonly QaSlashSubmitAttachment[]): Promise<QaSlashExecution>;
+}
+export interface QaSlashRemotesOptions {
+    readonly ctx: Context;
+    readonly getConfig: () => ResolvedQaSurfaceConfig;
+    readonly logger: PluginLogger;
+    /**
+     * Ownership and role check for the current QA session. Runs only while the
+     * deployment gates QA users with accounts; it throws on refusal, which is
+     * what makes a foreign session unreadable instead of merely unowned.
+     *
+     * @returns the role's user-skill grant, or `undefined` when the access
+     * system has no opinion about this session's skills.
+     */
+    readonly sessionGrant: (token: string, sessionId: string, agent: unknown) => Promise<readonly string[] | undefined>;
+}
+export declare function createQaSlashRemotes(options: QaSlashRemotesOptions): QaSlashRemotes;
+//# sourceMappingURL=remotes.d.ts.map

package/lib/types/types.d.ts

@@ -20,6 +20,12 @@ export type QaApprovalInteraction = "blocked" | "interactive";
  * refuses the ask outright; `interactive` answers it from the QA view.
  */
 export type QaQuestionInteraction = "unsupported" | "interactive";
+/**
+ * What a deployment may write for the question seam. `enabled` is accepted as
+ * the spelling of `interactive` a feature request asked for; the resolved
+ * config carries one name only.
+ */
+export type QaQuestionInteractionInput = QaQuestionInteraction | "enabled";
 /** The operator's answer to one parked tool call. */
 export type QaApprovalDecision = "allowed-once" | "rejected";
 /** One answered question; `custom` is free text, and may accompany `selected`. */
@@ -36,7 +42,7 @@ export interface QaQuestionAnswerItem {
  */
 export type QaAccountRole = "user" | "reviewer" | "admin";
 /** Administrative permissions a role grants; see `admin/permissions.ts`. */
-export type QaPermission = "users.read" | "users.manage" | "roles.read" | "roles.manage" | "conversations.read.all" | "conversations.read.own" | "reviews.read" | "reviews.write" | "analytics.read" | "audit.read" | "settings.manage";
+export type QaPermission = "users.read" | "users.manage" | "roles.read" | "roles.manage" | "conversations.read.all" | "conversations.read.own" | "conversations.delete" | "reviews.read" | "reviews.write" | "analytics.read" | "audit.read" | "settings.manage";
 /**
  * Tools split by how they become available. `always` is visible from the first
  * model step; `skillGrantable` is a ceiling — the tool only appears once an
@@ -45,6 +51,17 @@ export type QaPermission = "users.read" | "users.manage" | "roles.read" | "roles
 export interface QaToolSelection {
     readonly always: readonly string[];
     readonly skillGrantable: readonly string[];
+    /**
+     * Names this layer takes away, whatever grants them.
+     *
+     * The deployment's pinned tools and the Common layer reach every role, so
+     * without this a system tool could only be withdrawn by editing the profile
+     * and restarting the Host. A denial beats every grant — system, Common, the
+     * role's own list and every skill — and it narrows the ceiling a delegated
+     * assistant is held to, so one checkbox takes a tool away from a role and
+     * from the experts that role may spawn.
+     */
+    readonly deny?: readonly string[];
 }
 /** Tool/skill selection shared by the common layer and one QA subrole. */
 export interface QaCapabilitySelection {
@@ -434,6 +451,16 @@ export interface QaSkillRemoval {
 }
 export interface QaSourcesConfig {
     readonly enabled?: boolean;
+    /**
+     * How much durable provenance the deployment keeps. Every bound counts
+     * turns, shards or days, and zero keeps everything for that bound.
+     */
+    readonly retention?: {
+        readonly maxTurnsPerSession?: number;
+        readonly maxSessions?: number;
+        readonly maxAgeDays?: number;
+        readonly sweepIntervalMinutes?: number;
+    };
     readonly collect?: {
         readonly parentAgent?: boolean;
         readonly subagents?: boolean;
@@ -529,7 +556,7 @@ export interface QaSurfaceConfig {
     readonly thinkingPhrases?: readonly string[];
     readonly interaction?: {
         readonly approvals?: QaApprovalInteraction;
-        readonly questions?: QaQuestionInteraction;
+        readonly questions?: QaQuestionInteractionInput;
     };
     /**
      * QA tool delivery. Dynamic activation keeps the QA tool schemas out of the
@@ -561,7 +588,14 @@ export interface QaSurfaceConfig {
         readonly approvalPolicy?: QaApprovalPolicy;
         readonly permissionPreset?: string;
         readonly allowPermissionChanges?: false;
-        readonly allowSlashCommands?: false;
+        /**
+         * Master switch for the slash interface, and the only capability flag the
+         * resolver lets a deployment turn on. It opens the palette, which then
+         * offers exactly what `slashCommands` admits — human commands stay denied
+         * until the deployment names them. Nothing here widens the tool allow-list,
+         * the sandbox or the approval policy.
+         */
+        readonly allowSlashCommands?: boolean;
         readonly allowSettingsMutation?: false;
         readonly allowSessionReset?: boolean;
         readonly allowSessionRename?: false;
@@ -574,6 +608,12 @@ export interface QaSurfaceConfig {
         /** Shared directories available to read-only filesystem tools. */
         readonly sharedReadOnlyRoots?: readonly string[];
     };
+    /**
+     * Slash interface policy. Admission only: the QA surface never implements a
+     * skill or command registry, it decides which native ones reach the palette.
+     * Inert while `lockdown.allowSlashCommands` is off.
+     */
+    readonly slashCommands?: QaSlashCommandsConfig;
     readonly embedding?: {
         readonly frameAncestors?: string | null;
     };
@@ -582,6 +622,21 @@ export interface QaSurfaceConfig {
         readonly enabled?: boolean;
         readonly allowRegistration?: boolean;
         readonly sessionTtlDays?: number;
+        /**
+         * Login/registration attempts accepted per rolling minute, store-wide.
+         * The limit backs the password checks, so the default stays tight.
+         */
+        readonly maxAuthAttemptsPerMinute?: number;
+        /**
+         * What happens to ownership records of chats the Harness no longer knows.
+         * A record is a chat's auth boundary, so only vanished chats are ever
+         * swept, and only after `ownershipGraceHours`.
+         */
+        readonly retention?: {
+            readonly pruneVanishedSessions?: boolean;
+            readonly ownershipGraceHours?: number;
+            readonly sweepIntervalMinutes?: number;
+        };
         /** Let admins see chats owned by other QA accounts. */
         readonly showOtherUsersChats?: boolean;
         /**
@@ -701,7 +756,7 @@ export interface ResolvedQaSurfaceConfig {
         readonly approvalPolicy: QaApprovalPolicy;
         readonly permissionPreset: string;
         readonly allowPermissionChanges: false;
-        readonly allowSlashCommands: false;
+        readonly allowSlashCommands: boolean;
         readonly allowSettingsMutation: false;
         readonly allowSessionReset: boolean;
         readonly allowSessionRename: false;
@@ -713,6 +768,7 @@ export interface ResolvedQaSurfaceConfig {
         };
         readonly sharedReadOnlyRoots: readonly string[];
     };
+    readonly slashCommands: ResolvedQaSlashCommands;
     readonly embedding: {
         readonly frameAncestors: string | null;
     };
@@ -720,8 +776,15 @@ export interface ResolvedQaSurfaceConfig {
         readonly enabled: boolean;
         readonly allowRegistration: boolean;
         readonly sessionTtlDays: number;
+        /** Login/registration attempts accepted per rolling minute, store-wide. */
+        readonly maxAuthAttemptsPerMinute: number;
         readonly showOtherUsersChats: boolean;
         readonly perUserWorkspace: boolean;
+        readonly retention: {
+            readonly pruneVanishedSessions: boolean;
+            readonly ownershipGraceHours: number;
+            readonly sweepIntervalMinutes: number;
+        };
         readonly profile: {
             readonly enabled: boolean;
             readonly inject: boolean;
@@ -757,6 +820,12 @@ export interface ResolvedQaSurfaceConfig {
     };
     readonly sources: {
         readonly enabled: boolean;
+        readonly retention: {
+            readonly maxTurnsPerSession: number;
+            readonly maxSessions: number;
+            readonly maxAgeDays: number;
+            readonly sweepIntervalMinutes: number;
+        };
         readonly collect: {
             readonly parentAgent: boolean;
             readonly subagents: boolean;
@@ -804,6 +873,163 @@ export interface ResolvedQaSurfaceConfig {
         readonly extensions: readonly string[];
     };
 }
+/** Which native registry one unified entry came from. */
+export type QaSlashEntryKind = "skill" | "command";
+/** How one half of the catalog admits native entries. */
+export type QaSlashPolicyMode = "deny-all" | "allow-list" | "all";
+export interface QaSlashPolicyConfig {
+    readonly mode?: QaSlashPolicyMode;
+    readonly allow?: readonly string[];
+}
+export interface QaSlashPaletteConfig {
+    readonly enabled?: boolean;
+    /** Run the two weakest matcher rungs (substring, subsequence). */
+    readonly fuzzySearch?: boolean;
+    readonly maxVisible?: number;
+    readonly showDescriptions?: boolean;
+    readonly showKindBadge?: boolean;
+}
+export interface QaSlashCommandsConfig {
+    readonly skills?: QaSlashPolicyConfig;
+    readonly commands?: QaSlashPolicyConfig;
+    readonly palette?: QaSlashPaletteConfig;
+}
+export interface ResolvedQaSlashCommands {
+    /** Mirror of `lockdown.allowSlashCommands`; the one master switch. */
+    readonly enabled: boolean;
+    readonly skills: {
+        readonly mode: QaSlashPolicyMode;
+        readonly allow: readonly string[];
+    };
+    readonly commands: {
+        readonly mode: QaSlashPolicyMode;
+        readonly allow: readonly string[];
+    };
+    readonly palette: {
+        readonly enabled: boolean;
+        readonly fuzzySearch: boolean;
+        readonly maxVisible: number;
+        readonly showDescriptions: boolean;
+        readonly showKindBadge: boolean;
+    };
+    /**
+     * True when the deployment turned the master switch on without declaring a
+     * `slashCommands` section: skills then admit every user-invocable skill the
+     * session already exposes, commands stay denied. The Host logs it once, so
+     * an upgrade cannot silently widen anything.
+     */
+    readonly legacyDefaults: boolean;
+}
+/**
+ * One palette row. `id` is the routing identity: skill and command may share a
+ * name, so identity is `skill:<name>` or `command:<name>` and never the bare
+ * name the two halves would collide on.
+ */
+export interface QaSlashCatalogEntry {
+    readonly id: string;
+    readonly kind: QaSlashEntryKind;
+    readonly name: string;
+    readonly description: string;
+    /** Skill-only: the native `whenToUse`, rendered as secondary copy. */
+    readonly whenToUse?: string;
+    /** Skill-only: whether the model is also offered this skill. */
+    readonly modelInvocable?: boolean;
+    /** Command-only: the advertised argument shape. */
+    readonly inputHint?: string;
+    /** Command-only: whether the executor admits composer attachments. */
+    readonly acceptsAttachments?: boolean;
+}
+/**
+ * Whether the command half of the catalog could be read. `inactive` is the
+ * ordinary state of a cold chat: the native command registry resolves through
+ * a live Agent, and a chat with none answers with no commands rather than an
+ * error — the palette then offers skills alone.
+ */
+export type QaSlashCommandSurface = "ready" | "unavailable" | "inactive";
+export interface QaSlashCatalog {
+    /** False while `lockdown.allowSlashCommands` is off. */
+    readonly enabled: boolean;
+    readonly entries: readonly QaSlashCatalogEntry[];
+    readonly commandSurface: QaSlashCommandSurface;
+    /**
+     * User-invocable skills of this chat that the deployment or the chat's role
+     * withheld from the palette. Naming them is what lets the browser warn about
+     * a `/name` typed inside an ordinary prompt — the native gesture path never
+     * consults this list, so it is a courtesy, not an authorization.
+     */
+    readonly deniedSkills: readonly string[];
+}
+/**
+ * One composer attachment offered to a human command. The same two shapes the
+ * prompt path uses — an image rides inline, a file rides its staged receipt —
+ * because the native executor admits both through one attachment store.
+ */
+export type QaSlashSubmitAttachment = {
+    readonly type: "image";
+    readonly mediaType: QaImageMediaType;
+    readonly data: string;
+    readonly name?: string;
+} | {
+    readonly type: "file";
+    readonly receiptId: string;
+};
+/** Why a command line was refused before, or instead of, running. */
+export type QaSlashRefusal = "slash-disabled" | "unknown-command" | "not-allowed" | "attachments-unsupported" | "inactive-session";
+export type QaSlashCommandOutcome = {
+    readonly kind: "success";
+    readonly text?: string;
+    /** Earlier authoritative event this result is presented from. */
+    readonly sourceEventSeq?: number;
+} | {
+    readonly kind: "error";
+    readonly text: string;
+};
+/**
+ * The result of one admitted command. `refused` is an admission decision and
+ * costs nothing; `executed` means the native runtime ran the handler and the
+ * lifecycle is already in the session log, which is what the transcript row
+ * projects.
+ */
+export type QaSlashExecution = {
+    readonly kind: "executed";
+    readonly commandId: string;
+    readonly outcome: QaSlashCommandOutcome;
+} | {
+    readonly kind: "refused";
+    readonly reason: QaSlashRefusal;
+    /** Host-authored detail; the browser renders its own copy for `reason`. */
+    readonly message: string;
+};
+/** One entry of the palette the browser is filtering. */
+export interface QaSlashView {
+    readonly enabled: boolean;
+    readonly state: "idle" | "loading" | "ready" | "error";
+    readonly entries: readonly QaSlashCatalogEntry[];
+    readonly commandSurface: QaSlashCommandSurface;
+    readonly deniedSkills: readonly string[];
+    /** Set when the catalog could not be read; ordinary prompts keep working. */
+    readonly error: string | null;
+    /**
+     * Bumped when the surface must re-open a palette the user had dismissed —
+     * an ambiguous `/name` is the case that needs it. The composer watches the
+     * counter rather than the message, so a refusal can be re-stated.
+     */
+    readonly reopen: number;
+}
+/**
+ * One human command line projected into the transcript. Commands never enter
+ * the model conversation, so this row is their only visible trace; it is a
+ * control row, not an assistant bubble.
+ */
+export interface QaCommandActivity {
+    readonly commandId: string;
+    readonly name: string;
+    /** Verbatim text after the name, with its separator whitespace removed. */
+    readonly args?: string;
+    readonly state: "running" | "success" | "error";
+    readonly resultText?: string;
+    readonly sourceEventSeq?: number;
+}
 export interface QaSourceFilePreview {
     readonly path: string;
     readonly content: string;
@@ -878,6 +1104,11 @@ export type QaMessage = QaUserMessage | {
     readonly text: string;
     readonly status: "info" | "error";
     readonly timestamp?: number;
+    /**
+     * Set on a human command row. Commands stay out of the model
+     * conversation, so this projection is the only trace the user sees.
+     */
+    readonly command?: QaCommandActivity;
     /** Collapsible settlement row (subagent finished/stopped/failed). */
     readonly notice?: {
         readonly title: string;
@@ -1039,6 +1270,8 @@ export interface QaSessionState {
     readonly approvals: readonly QaPendingApproval[];
     /** Question requests parked for the operator's answer, oldest first. */
     readonly questions: readonly QaPendingQuestion[];
+    /** Slash palette state, keyed to the chat this snapshot describes. */
+    readonly slash: QaSlashView;
 }
 /** Minimal server-trusted identity exposed to principal-scoped plugins. */
 export interface QaPrincipal {
@@ -1124,7 +1357,7 @@ export interface QaReviewQueueItem {
     readonly feedbackId?: string;
 }
 /** Administrative actions recorded in the audit trail. */
-export type QaAdminAuditAction = "user.created" | "user.updated" | "user.enabled" | "user.disabled" | "authorization.changed" | "subrole.assignment.changed" | "subrole.created" | "subrole.updated" | "subrole.deleted" | "common_capabilities.updated" | "conversation.reviewed" | "review.updated" | "review.queued" | "admin.settings.updated";
+export type QaAdminAuditAction = "user.created" | "user.updated" | "user.enabled" | "user.disabled" | "authorization.changed" | "subrole.assignment.changed" | "subrole.created" | "subrole.updated" | "subrole.deleted" | "common_capabilities.updated" | "conversation.reviewed" | "conversation.deleted" | "review.updated" | "review.queued" | "admin.settings.updated";
 export interface QaAdminAuditEvent {
     readonly id: string;
     readonly timestamp: string;
@@ -1217,6 +1450,17 @@ export interface QaConversationDetail {
     readonly reviews: readonly QaConversationReview[];
     readonly queueItems: readonly QaReviewQueueItem[];
 }
+/** What one administrative deletion removed, for the console to report. */
+export interface QaConversationDeletion {
+    readonly conversationId: string;
+    /**
+     * Every session whose stored log is gone, the chat first: a conversation's
+     * subagent sessions are part of it and are removed with it.
+     */
+    readonly sessions: readonly string[];
+    /** Quality rows dropped with the conversation. */
+    readonly qualityRows: number;
+}
 /**
  * Server-side filter for the conversation list. Every field is optional and
  * accepts an explicit null: the wire carries whatever the browser has, and an
@@ -1360,7 +1604,12 @@ export interface QaAdminUserDetail {
     readonly effective: readonly {
         readonly subroleId: string;
         readonly name: string;
+        /** Visible from the first step: system-required, Common and the role. */
         readonly tools: number;
+        /** The role's ceiling for tools a loaded skill requires. */
+        readonly grantableTools: number;
+        /** Tools the profile withdraws, whatever else grants them. */
+        readonly deniedTools: number;
         readonly skills: number;
     }[];
     readonly activity: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yadsh/dsh-qa-surface",
-  "version": "0.7.4",
+  "version": "0.9.0",
   "description": "A focused end-user QA surface backed by native DeepSeek Harness sessions",
   "repository": {
     "type": "git",
@@ -16,7 +16,8 @@
   "types": "./lib/types/index.d.ts",
   "bin": {
     "qa-accounts": "./lib/cli.js",
-    "qa-repair-sessions": "./scripts/repair-session-events.mjs"
+    "qa-repair-sessions": "./scripts/repair-session-events.mjs",
+    "qa-attach-sessions": "./scripts/attach-workspace-sessions.mjs"
   },
   "exports": {
     ".": {
@@ -76,6 +77,7 @@
     "lib/**/*.js.map",
     "lib/**/*.d.ts",
     "scripts/repair-session-events.mjs",
+    "scripts/attach-workspace-sessions.mjs",
     "cordis.patch.yml",
     "compatibility.json",
     "capability-policy.json",
@@ -131,7 +133,10 @@
   "dependencies": {
     "yaml": "^2.9.0",
     "zod": "^4.4.3",
-    "@yadsh/dsh-plugin-log": "^0.3.1"
+    "@yadsh/dsh-audit-ui": "^0.1.0",
+    "@yadsh/dsh-audit-core": "^0.1.0",
+    "@yadsh/dsh-plugin-kit": "^0.3.0",
+    "@yadsh/dsh-plugin-log": "^0.4.0"
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "4.0.2",
@@ -175,8 +180,7 @@
     "typescript": "^7.0.2",
     "vitest": "^4.1.11",
     "@yadsh/dsh-config": "^0.0.0",
-    "@yadsh/dsh-plugin-scripts": "^0.0.0",
-    "@yadsh/dsh-plugin-kit": "^0.1.0"
+    "@yadsh/dsh-plugin-scripts": "^0.0.0"
   },
   "publishConfig": {
     "access": "public",