@yadsh/dsh-qa-surface 0.8.0 → 0.10.0

package/lib/index.js

@@ -41,23 +41,27 @@ import { ConfigSchema, resolveConfig } from "./config.js";
 import { createQaAccountRemotes } from "./account-remotes.js";
 import { QaAdminService } from "./admin/service.js";
 import { QaQualityStore } from "./admin/quality-store.js";
-import { createSessionLogReader } from "./admin/session-log.js";
+import { createSessionEraser, createSessionLogReader, } from "./admin/session-log.js";
 import { createQaPersonalSkillRemotes, QaPersonalSkillsHost, } from "./personal-skills/index.js";
 import { QaApprovalGate } from "./approvals.js";
 import { QaAttestationError, qaAttestationFailureMessage, } from "./attestation.js";
+import { QaFileDeleteGate } from "./qa-tools/file-delete-gate.js";
 import { QaQuestionGate } from "./questions.js";
 import { QaSessionOwnership } from "./session-ownership.js";
 import { entryRedirectRow } from "./entry-redirect.js";
+import { qaKioskDeployment } from "./ui-mode.js";
 import { registerQaNavigationRoute } from "./host-route.js";
 import { makeLaunchTokenSource } from "./launch-token.js";
 import { QaIntegrationPrincipalBindings } from "./integration-principals.js";
 import { QaPolicyAdmission } from "./secure-session.js";
 import { QaAccessService } from "./access/service.js";
+import { createQaSlashRemotes } from "./slash/remotes.js";
 import { QaPromptNotes } from "./prompt-notes.js";
 import { QaTools } from "./qa-tools/index.js";
 import { QaProvenanceHost } from "./provenance/host-store.js";
 import { defaultLegacyProvenanceFilePath, defaultQaProvenanceDirectoryPath, FileQaProvenanceSnapshotStore, } from "./provenance/snapshot-store.js";
-import { readSourceFilePreview, QaSourcePreviewError, } from "./provenance/file-preview.js";
+import { previewConvertibleDocument } from "./provenance/document-preview.js";
+import { listWorkspaceDirectory, readSourceFilePreview, readWorkspaceFile, QaSourcePreviewError, } from "./provenance/file-preview.js";
 import { existingQaUserWorkspace, prepareQaUserWorkspace, } from "./user-workspace.js";
 export const name = "qa-surface";
 export const inject = [
@@ -113,6 +117,7 @@ let QaSurface = (() => {
     let _adminUpdateUser_decorators;
     let _adminConversations_decorators;
     let _adminConversation_decorators;
+    let _adminDeleteConversation_decorators;
     let _adminFeedback_decorators;
     let _adminRateMessage_decorators;
     let _adminReviewQueue_decorators;
@@ -128,6 +133,9 @@ let QaSurface = (() => {
     let _answerQuestion_decorators;
     let _cancelQuestion_decorators;
     let _readSourceFile_decorators;
+    let _listWorkspaceFiles_decorators;
+    let _readWorkspaceFile_decorators;
+    let _previewWorkspaceDocument_decorators;
     let _skillsList_decorators;
     let _skillsGet_decorators;
     let _skillsCreate_decorators;
@@ -135,6 +143,8 @@ let QaSurface = (() => {
     let _skillsRemove_decorators;
     let _skillsValidate_decorators;
     let _skillsTools_decorators;
+    let _slashCatalog_decorators;
+    let _slashExecute_decorators;
     return class QaSurface extends _classSuper {
         static {
             const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
@@ -164,6 +174,7 @@ let QaSurface = (() => {
             _adminUpdateUser_decorators = [Remote("adminUpdateUser")];
             _adminConversations_decorators = [Remote("adminConversations")];
             _adminConversation_decorators = [Remote("adminConversation")];
+            _adminDeleteConversation_decorators = [Remote("adminDeleteConversation")];
             _adminFeedback_decorators = [Remote("adminFeedback")];
             _adminRateMessage_decorators = [Remote("adminRateMessage")];
             _adminReviewQueue_decorators = [Remote("adminReviewQueue")];
@@ -179,6 +190,9 @@ let QaSurface = (() => {
             _answerQuestion_decorators = [Remote("answerQuestion")];
             _cancelQuestion_decorators = [Remote("cancelQuestion")];
             _readSourceFile_decorators = [Remote("readSourceFile")];
+            _listWorkspaceFiles_decorators = [Remote("listWorkspaceFiles")];
+            _readWorkspaceFile_decorators = [Remote("readWorkspaceFile")];
+            _previewWorkspaceDocument_decorators = [Remote("previewWorkspaceDocument")];
             _skillsList_decorators = [Remote("skillsList")];
             _skillsGet_decorators = [Remote("skillsGet")];
             _skillsCreate_decorators = [Remote("skillsCreate")];
@@ -186,6 +200,8 @@ let QaSurface = (() => {
             _skillsRemove_decorators = [Remote("skillsRemove")];
             _skillsValidate_decorators = [Remote("skillsValidate")];
             _skillsTools_decorators = [Remote("skillsTools")];
+            _slashCatalog_decorators = [Remote("slashCatalog")];
+            _slashExecute_decorators = [Remote("slashExecute")];
             __esDecorate(this, null, _accountsRegister_decorators, { kind: "method", name: "accountsRegister", static: false, private: false, access: { has: obj => "accountsRegister" in obj, get: obj => obj.accountsRegister }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _accountsLogin_decorators, { kind: "method", name: "accountsLogin", static: false, private: false, access: { has: obj => "accountsLogin" in obj, get: obj => obj.accountsLogin }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _accountsWhoami_decorators, { kind: "method", name: "accountsWhoami", static: false, private: false, access: { has: obj => "accountsWhoami" in obj, get: obj => obj.accountsWhoami }, metadata: _metadata }, null, _instanceExtraInitializers);
@@ -212,6 +228,7 @@ let QaSurface = (() => {
             __esDecorate(this, null, _adminUpdateUser_decorators, { kind: "method", name: "adminUpdateUser", static: false, private: false, access: { has: obj => "adminUpdateUser" in obj, get: obj => obj.adminUpdateUser }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _adminConversations_decorators, { kind: "method", name: "adminConversations", static: false, private: false, access: { has: obj => "adminConversations" in obj, get: obj => obj.adminConversations }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _adminConversation_decorators, { kind: "method", name: "adminConversation", static: false, private: false, access: { has: obj => "adminConversation" in obj, get: obj => obj.adminConversation }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _adminDeleteConversation_decorators, { kind: "method", name: "adminDeleteConversation", static: false, private: false, access: { has: obj => "adminDeleteConversation" in obj, get: obj => obj.adminDeleteConversation }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _adminFeedback_decorators, { kind: "method", name: "adminFeedback", static: false, private: false, access: { has: obj => "adminFeedback" in obj, get: obj => obj.adminFeedback }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _adminRateMessage_decorators, { kind: "method", name: "adminRateMessage", static: false, private: false, access: { has: obj => "adminRateMessage" in obj, get: obj => obj.adminRateMessage }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _adminReviewQueue_decorators, { kind: "method", name: "adminReviewQueue", static: false, private: false, access: { has: obj => "adminReviewQueue" in obj, get: obj => obj.adminReviewQueue }, metadata: _metadata }, null, _instanceExtraInitializers);
@@ -227,6 +244,9 @@ let QaSurface = (() => {
             __esDecorate(this, null, _answerQuestion_decorators, { kind: "method", name: "answerQuestion", static: false, private: false, access: { has: obj => "answerQuestion" in obj, get: obj => obj.answerQuestion }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _cancelQuestion_decorators, { kind: "method", name: "cancelQuestion", static: false, private: false, access: { has: obj => "cancelQuestion" in obj, get: obj => obj.cancelQuestion }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _readSourceFile_decorators, { kind: "method", name: "readSourceFile", static: false, private: false, access: { has: obj => "readSourceFile" in obj, get: obj => obj.readSourceFile }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _listWorkspaceFiles_decorators, { kind: "method", name: "listWorkspaceFiles", static: false, private: false, access: { has: obj => "listWorkspaceFiles" in obj, get: obj => obj.listWorkspaceFiles }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _readWorkspaceFile_decorators, { kind: "method", name: "readWorkspaceFile", static: false, private: false, access: { has: obj => "readWorkspaceFile" in obj, get: obj => obj.readWorkspaceFile }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _previewWorkspaceDocument_decorators, { kind: "method", name: "previewWorkspaceDocument", static: false, private: false, access: { has: obj => "previewWorkspaceDocument" in obj, get: obj => obj.previewWorkspaceDocument }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _skillsList_decorators, { kind: "method", name: "skillsList", static: false, private: false, access: { has: obj => "skillsList" in obj, get: obj => obj.skillsList }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _skillsGet_decorators, { kind: "method", name: "skillsGet", static: false, private: false, access: { has: obj => "skillsGet" in obj, get: obj => obj.skillsGet }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _skillsCreate_decorators, { kind: "method", name: "skillsCreate", static: false, private: false, access: { has: obj => "skillsCreate" in obj, get: obj => obj.skillsCreate }, metadata: _metadata }, null, _instanceExtraInitializers);
@@ -234,6 +254,8 @@ let QaSurface = (() => {
             __esDecorate(this, null, _skillsRemove_decorators, { kind: "method", name: "skillsRemove", static: false, private: false, access: { has: obj => "skillsRemove" in obj, get: obj => obj.skillsRemove }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _skillsValidate_decorators, { kind: "method", name: "skillsValidate", static: false, private: false, access: { has: obj => "skillsValidate" in obj, get: obj => obj.skillsValidate }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _skillsTools_decorators, { kind: "method", name: "skillsTools", static: false, private: false, access: { has: obj => "skillsTools" in obj, get: obj => obj.skillsTools }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _slashCatalog_decorators, { kind: "method", name: "slashCatalog", static: false, private: false, access: { has: obj => "slashCatalog" in obj, get: obj => obj.slashCatalog }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _slashExecute_decorators, { kind: "method", name: "slashExecute", static: false, private: false, access: { has: obj => "slashExecute" in obj, get: obj => obj.slashExecute }, metadata: _metadata }, null, _instanceExtraInitializers);
             if (_metadata) Object.defineProperty(this, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
         }
         static inject = inject;
@@ -242,6 +264,7 @@ let QaSurface = (() => {
         logger;
         admission;
         approvals;
+        fileDeleteGate;
         userQuestions;
         provenance;
         notes;
@@ -260,6 +283,12 @@ let QaSurface = (() => {
         personalSkills;
         /** Personal-skill remote bodies; the wire signatures stay on this class. */
         skillRemotes;
+        /**
+         * Slash-catalog and command-admission bodies. Admission, not execution:
+         * the native skill and command runtimes stay the only things that know what
+         * a `/name` means.
+         */
+        slashRemotes;
         launchToken;
         /** Root session principals attested for their owner, never for admin viewing. */
         integrationPrincipals = new QaIntegrationPrincipalBindings();
@@ -292,7 +321,14 @@ let QaSurface = (() => {
                 config: () => this.getConfig(),
                 logger: this.logger,
                 dynamicToolNames: () => this.tools?.catalogToolNames() ?? [],
+                presetScope: () => this.qaPresetScope(),
                 sessionLog,
+                // The record the sweep reclaims is the authorization boundary, not the
+                // whole of what the deployment kept about a chat: the quality rows a
+                // conversation owns outlive it unless they are dropped here.
+                onVanishedSessions: (sessionIds) => {
+                    this.dropVanishedChats(sessionIds);
+                },
             });
             this.personalSkills = new QaPersonalSkillsHost({
                 ctx,
@@ -305,6 +341,10 @@ let QaSurface = (() => {
                 roles: () => this.access.roles,
                 access: () => this.access,
                 sessionLog,
+                // Deletion is the console's alone: the sidebar's delete stays a
+                // per-browser row, and only an administrator removes the chat itself.
+                sessionFiles: createSessionEraser(),
+                dropSources: (sessionId) => this.provenance.dropSession(sessionId),
                 logger: this.logger,
             });
             this.skillRemotes = createQaPersonalSkillRemotes({
@@ -313,6 +353,12 @@ let QaSurface = (() => {
                 skills: this.personalSkills.service,
                 accounts: this.accountRemotes,
             });
+            this.slashRemotes = createQaSlashRemotes({
+                ctx,
+                getConfig: () => this.getConfig(),
+                logger: this.logger,
+                sessionGrant: (token, sessionId, agent) => this.slashSessionGrant(token, sessionId, agent),
+            });
             this.admission = new QaPolicyAdmission(ctx, () => this.getConfig(), this.logger, 
             // Identity half of admission; no-ops while accounts stay disabled.
             {
@@ -340,8 +386,15 @@ let QaSurface = (() => {
             const ownership = new QaSessionOwnership((sessionId) => this.admission.knowsSession(sessionId));
             this.approvals = new QaApprovalGate(ctx, () => this.getConfig().interaction.approvals === "interactive", ownership, this.logger);
             this.userQuestions = new QaQuestionGate(ctx, () => this.getConfig().interaction.questions === "interactive", ownership, this.logger);
+            // The destructive tool of the QA catalog composes the same approval flow
+            // around itself: registered without `prepend`, it sits inside the approval
+            // gate and answers `ask` for every file_delete call of an attested chat,
+            // so the interactive card parks it for the operator (or the blocked
+            // configuration refuses it — nothing is deleted without a person).
+            this.fileDeleteGate = new QaFileDeleteGate(ctx, ownership);
             this.approvals.install();
             this.userQuestions.install();
+            this.fileDeleteGate.install();
             // The identity note and the provenance rule ride the conversation as
             // durable context messages, delegated experts included: the QA preset's
             // complete persona closes the system prompt to plugins, the conversation
@@ -361,11 +414,13 @@ let QaSurface = (() => {
             ctx.effect(() => async () => this.logger.close(), "dsh-qa-surface.logger");
             ctx.effect(() => () => this.admission.dispose(), "dsh-qa-surface.lockdown-policies");
             ctx.effect(() => () => this.approvals.dispose(), "dsh-qa-surface.approvals");
+            ctx.effect(() => () => this.fileDeleteGate.dispose(), "dsh-qa-surface.file-delete-gate");
             ctx.effect(() => () => this.userQuestions.dispose(), "dsh-qa-surface.user-questions");
             ctx.effect(() => () => this.provenance.dispose(), "dsh-qa-surface.provenance");
             ctx.effect(() => () => this.notes.dispose(), "dsh-qa-surface.prompt-notes");
             ctx.effect(() => () => this.personalSkills.dispose(), "dsh-qa-surface.personal-skills");
             this.warnDocumentsMoved();
+            this.warnLegacySlashDefaults();
             // The QA tool catalog is attached per agent, never at boot: nothing here
             // reaches the model until a managed agent loads the activation skill.
             this.tools = new QaTools(ctx, {
@@ -377,12 +432,17 @@ let QaSurface = (() => {
             });
             ctx.effect(() => () => this.tools.dispose(), "dsh-qa-surface.qa-tools");
             // The root index gains one head script: non-loopback hostnames continue
-            // into /qa, the loopback operator keeps the full harness UI.
-            ctx.on("webserver/index-inject", (table) => {
-                const row = entryRedirectRow(this.getConfig());
-                if (row !== undefined)
-                    table.push(row);
-            });
+            // into /qa, the loopback operator keeps the full harness UI. Not in the
+            // kiosk composition: there the index itself is served under /qa, so the
+            // script would meet its own target on every load and reload the page in
+            // a loop, and the server policy already routes the site root into /qa.
+            if (!qaKioskDeployment()) {
+                ctx.on("webserver/index-inject", (table) => {
+                    const row = entryRedirectRow(this.getConfig());
+                    if (row !== undefined)
+                        table.push(row);
+                });
+            }
             ctx.inject(["settings"], (settingsCtx) => {
                 settingsCtx.settings.installSection(ctx, QA_SURFACE_SETTINGS_NAMESPACE, ConfigSchema, entry, {
                     setSource: (source) => {
@@ -392,6 +452,7 @@ let QaSurface = (() => {
                         const config = this.getConfig();
                         this.refreshRoute();
                         this.warnDocumentsMoved();
+                        this.warnLegacySlashDefaults();
                         this.logger.info("config.updated", {
                             enabled: config.enabled,
                             route: config.route.path,
@@ -417,6 +478,11 @@ let QaSurface = (() => {
                 enabled: resolvedEntry.enabled,
                 route: resolvedEntry.route.path,
                 sessionPolicy: resolvedEntry.session.policy,
+                // What the two parked-interaction seams resolve to on this deployment:
+                // the attestation path warns per session when the question seam and the
+                // tool policy disagree, and this is the config they are read against.
+                approvals: resolvedEntry.interaction.approvals,
+                questions: resolvedEntry.interaction.questions,
             });
         }
         /** The quality store, opening its file the first time anyone needs it. */
@@ -424,6 +490,44 @@ let QaSurface = (() => {
             this.qualityStore ??= new QaQualityStore();
             return this.qualityStore;
         }
+        /**
+         * The standing scope of the preset QA chats run under, so an administrator's
+         * capability catalog is read the way a chat reads it. Everything a preset
+         * mounts — its skill catalog, its tool family — is registered in that scope,
+         * and a global-only read showed the operator an almost empty page. Resolving
+         * the preset composes it but starts no agent, no session and no turn;
+         * without a pinned preset there is nothing to borrow, and the read stays
+         * global.
+         */
+        async qaPresetScope() {
+            const preset = this.getConfig().session.agentPreset;
+            if (preset === null || preset === undefined)
+                return undefined;
+            return await this.ctx.agentPresets.standingKeyFor(preset);
+        }
+        /**
+         * Drop what the quality layer kept about chats that no longer exist in the
+         * Harness. The ownership sweep calls this with the ids it reclaimed: the
+         * record it removes is one thing the deployment held about a chat, and
+         * ratings, reviews and queue entries are the rest. Failure is logged and
+         * swallowed — housekeeping runs inside a review read, and a store that
+         * cannot be opened must not fail the page that triggered it.
+         */
+        dropVanishedChats(sessionIds) {
+            try {
+                const rows = this.quality().dropConversations(sessionIds);
+                this.logger.info("quality.vanished-conversations-dropped", {
+                    conversations: sessionIds.length,
+                    rows,
+                    sessionIds: sessionIds.slice(0, 20),
+                });
+            }
+            catch (error) {
+                this.logger.error("quality.vanished-conversations-drop-failed", {
+                    message: error instanceof Error ? error.message : String(error),
+                });
+            }
+        }
         /** Resolve browser authentication to the caller only; never accepts an id. */
         principalForToken(token) {
             const accounts = this.accountRemotes.resolve(this.getConfig());
@@ -450,6 +554,36 @@ let QaSurface = (() => {
         getConfig() {
             return resolveConfig(this.source());
         }
+        /**
+         * Ownership plus the role's user-skill grant for one slash read.
+         *
+         * Ownership comes first and for the same reason the rest of the plugin does
+         * it: a catalog names the skills a chat can reach, and a foreign browser has
+         * no business enumerating that. With accounts off there is no identity to
+         * check and the deployment's lockdown is the boundary, exactly as it is for
+         * every other remote.
+         *
+         * The grant mirrors `installQaSkillPolicy` to the letter — an empty
+         * `userSkills` list means the role keeps no separate user list, not that it
+         * grants nothing — so the palette can never offer a skill the typed gesture
+         * would refuse, nor hide one it would accept.
+         */
+        async slashSessionGrant(token, sessionId, agent) {
+            const accounts = this.accountRemotes.resolve(this.getConfig());
+            if (accounts === undefined)
+                return undefined;
+            if (agent === undefined) {
+                // A cold chat has no capability snapshot to read, but it still has an
+                // owner, and that is what the catalog read must respect.
+                this.accountRemotes.run(() => this.access.session(token, sessionId));
+                return undefined;
+            }
+            const resolved = await this.access.policyForSession(token, sessionId, agent);
+            if (resolved === undefined)
+                return undefined;
+            const { policy } = resolved;
+            return policy.userSkills.length === 0 ? policy.skills : policy.userSkills;
+        }
         /**
          * Self-service signup; the first account ever created becomes admin. The
          * display name derives from the email: the generated client enforces exact
@@ -658,6 +792,14 @@ let QaSurface = (() => {
         adminConversation(token, conversationId) {
             return this.accountRemotes.runAsync(() => this.admin.conversation(token, conversationId));
         }
+        /**
+         * Remove one conversation from the deployment. Admin-only, audited, and the
+         * only path that deletes what a person wrote — the sidebar's own delete
+         * stays what it always was, a per-browser row.
+         */
+        adminDeleteConversation(token, conversationId) {
+            return this.accountRemotes.runAsync(() => this.admin.deleteConversation(token, conversationId));
+        }
         adminFeedback(token, query, cursor, limit) {
             return this.accountRemotes.runAsync(() => this.admin.feedback(token, query, cursor ?? undefined, limit ?? undefined));
         }
@@ -796,6 +938,105 @@ let QaSurface = (() => {
                 throw sourcePreviewRefusal(error instanceof QaSourcePreviewError ? error.reason : "unavailable");
             }
         }
+        /**
+         * List one directory of the chat's own workspace for the files panel.
+         *
+         * Browsing is deliberately narrower than the source preview: it stays inside
+         * the chat's own directory tree, so a visitor can look at what their
+         * conversation produced and at nothing else of the deployment.
+         * `readWorkspaceFile` opens one entry of such a listing.
+         */
+        async listWorkspaceFiles(token, sessionId, path) {
+            await this.admission.secureSession(token, sessionId);
+            const { config, cwd } = await this.browseContext(sessionId);
+            try {
+                return await listWorkspaceDirectory({
+                    dirPath: path ?? "",
+                    cwd,
+                    maxEntries: config.sources.filePreview.maxListingEntries,
+                });
+            }
+            catch (error) {
+                throw this.browseRefusal("workspace.list-refused", sessionId, error);
+            }
+        }
+        /**
+         * Read one file of the chat's workspace: text when it decodes as UTF-8, bytes
+         * when it does not, so a document the agent produced can be downloaded while
+         * a note previews inline. The readable roots are the ones the model itself
+         * may read; unlike the source preview this does not require the file to be
+         * recorded evidence, because the panel is browsing a tree rather than
+         * reopening a cited source.
+         */
+        async readWorkspaceFile(token, sessionId, path) {
+            await this.admission.secureSession(token, sessionId);
+            const { config, cwd } = await this.browseContext(sessionId);
+            const attachmentRoot = this.admission.attachmentRoot();
+            try {
+                return await readWorkspaceFile({
+                    filePath: path ?? "",
+                    cwd,
+                    sharedReadOnlyRoots: config.lockdown.sharedReadOnlyRoots,
+                    ...(attachmentRoot === undefined ? {} : { attachmentRoot }),
+                    maxBytes: config.sources.filePreview.maxBytes,
+                    maxMarkdownRenderBytes: config.sources.filePreview.maxMarkdownRenderBytes,
+                });
+            }
+            catch (error) {
+                throw this.browseRefusal("workspace.read-refused", sessionId, error);
+            }
+        }
+        /**
+         * Render one Word document of the chat's workspace as a PDF for the panel.
+         *
+         * The conversion is the document pipeline's own, reached through the service
+         * `@yadsh/dsh-documents` publishes for its Host siblings — the panel gets the
+         * same providers, limits and refusals the `document_*` tools see, and a
+         * deployment without that plugin refuses instead of showing a guess. The
+         * produced PDF is read back here and travels as base64, so the audience never
+         * reaches an unfenced byte route.
+         */
+        async previewWorkspaceDocument(token, sessionId, path) {
+            await this.admission.secureSession(token, sessionId);
+            const { config, cwd } = await this.browseContext(sessionId);
+            const attachmentRoot = this.admission.attachmentRoot();
+            try {
+                return await previewConvertibleDocument({
+                    filePath: path ?? "",
+                    cwd,
+                    sharedReadOnlyRoots: config.lockdown.sharedReadOnlyRoots,
+                    ...(attachmentRoot === undefined ? {} : { attachmentRoot }),
+                    documents: () => this.ctx.get("documents"),
+                    sessionId,
+                    maxBytes: config.sources.filePreview.maxBytes,
+                });
+            }
+            catch (error) {
+                throw this.browseRefusal("workspace.preview-refused", sessionId, error);
+            }
+        }
+        /**
+         * Shared admission facts of both browse methods: the preview switch is what
+         * opens the panel's file reading at all, and the chat's cwd is the tree that
+         * browsing is confined to.
+         */
+        async browseContext(sessionId) {
+            const config = this.getConfig();
+            if (!config.sources.filePreview.enabled) {
+                throw sourcePreviewRefusal("unavailable");
+            }
+            const agent = this.ctx.agents.get((await import("@deepseek-ai/dsh-session/types")).SessionId(sessionId));
+            const cwd = agent?.session.header.cwd;
+            if (cwd === undefined)
+                throw sourcePreviewRefusal("unavailable");
+            return { config, cwd };
+        }
+        /** One browse refusal, logged with its coarse reason and rethrown for the wire. */
+        browseRefusal(event, sessionId, error) {
+            const reason = error instanceof QaSourcePreviewError ? error.reason : "unavailable";
+            this.logger.debug(event, { sessionId, reason });
+            return sourcePreviewRefusal(reason);
+        }
         /** Every personal skill of the token's account, sorted by name. */
         skillsList(token) {
             return this.skillRemotes.list(token);
@@ -833,11 +1074,46 @@ let QaSurface = (() => {
         skillsTools(token) {
             return this.skillRemotes.tools(token);
         }
+        /**
+         * The slash entries this browser may offer for one chat: the session's
+         * user-invocable skills and its agent's effective commands, already cut down
+         * by the deployment policy and by the chat's role. The browser filters and
+         * ranks this list; it never widens it.
+         *
+         * Enabled is reported rather than assumed, so a page that loaded before the
+         * operator flipped the master switch learns the truth instead of showing an
+         * empty palette forever.
+         */
+        slashCatalog(token, sessionId) {
+            return this.slashRemotes.catalog(token, sessionId);
+        }
+        /**
+         * Run one human command line. The line is the whole request — the browser
+         * sends no name, no kind and no descriptor, so there is nothing for it to
+         * forge; admission re-derives the name and re-checks the policy against the
+         * deployment's own config.
+         *
+         * A command never becomes a model message: the native runtime answers it and
+         * writes `command/run`/`command/done` into the session log, which is where
+         * the transcript row is read from.
+         */
+        slashExecute(token, sessionId, line, attachments) {
+            return this.slashRemotes.execute(token, sessionId, line, attachments);
+        }
         refreshRoute() {
             const config = this.getConfig();
-            const key = config.enabled
-                ? `${config.route.path}:${config.route.matchChildren}`
-                : undefined;
+            // Kiosk: the harness route policy owns the QA paths and serves the
+            // application there directly. This plugin's navigation redirect route
+            // must not register — a named route shadows the fallback seat, so it
+            // would bounce every /qa navigation to /?marker while the policy bounces
+            // / back to /qa: a redirect loop. The kiosk key keeps the transition
+            // machinery honest (dispose on entering kiosk, no re-registration, one
+            // log line per transition).
+            const key = qaKioskDeployment()
+                ? "kiosk"
+                : config.enabled
+                    ? `${config.route.path}:${config.route.matchChildren}`
+                    : undefined;
             if (key === this.routeKey)
                 return;
             this.disposeRoute?.();
@@ -845,11 +1121,33 @@ let QaSurface = (() => {
             this.routeKey = undefined;
             if (key === undefined || this.webServer === undefined)
                 return;
+            if (key === "kiosk") {
+                this.logger.info("route.kiosk", {
+                    message: "DSH_UI_MODE=qa: the navigation redirect route is not registered; the harness route policy serves the QA surface directly",
+                });
+                this.routeKey = key;
+                return;
+            }
             this.disposeRoute = registerQaNavigationRoute(this.webServer, config, {
                 launchToken: this.launchToken,
             });
             this.routeKey = key;
         }
+        /**
+         * A deployment that set `lockdown.allowSlashCommands: true` before this
+         * section existed keeps the behaviour it asked for — skills at `all`,
+         * commands denied — and is told so once per configuration change, because
+         * "skills appeared after the upgrade" is otherwise indistinguishable from a
+         * defect. Commands are never part of that fallback: an upgrade must not hand
+         * the user a control-plane command nobody named.
+         */
+        warnLegacySlashDefaults() {
+            if (!this.getConfig().slashCommands.legacyDefaults)
+                return;
+            this.logger.warn("slash.legacy-defaults", {
+                message: "lockdown.allowSlashCommands=true without a slashCommands section: every user-invocable skill is admitted and no human command is. Declare slashCommands.commands to enable commands explicitly.",
+            });
+        }
         /**
          * The document pipeline moved out of this plugin into `@yadsh/dsh-documents`.
          * A deployment whose profile still carries the old `documents` section would