@yadsh/dsh-qa-surface 0.8.0 → 0.10.0

package/lib/types/client/slash/slash-router.d.ts

@@ -0,0 +1,67 @@
+import type { QaSlashCatalogEntry } from "../../types.js";
+/**
+ * Where one composer draft should go.
+ *
+ * The composer used to have a single path — `sendPrompt` — with a guard that
+ * turned every `/`-leading line away. That guard is now the `disabled` case
+ * below, and everything else is decided here, in one place, from the draft and
+ * the catalog alone. Keeping it pure is what makes the ambiguous, unknown and
+ * withheld cases testable without a browser or a Host.
+ */
+export type QaSlashRoute = 
+/**
+ * Ordinary text: the model gets it, exactly as before this feature. It may
+ * still name a skill this deployment withholds — the turn runs, and the
+ * surface says so rather than letting the user believe it took effect.
+ */
+{
+    readonly kind: "prompt";
+    readonly withheld?: readonly string[];
+}
+/** A user-invocable skill: the native prompt path carries the gesture. */
+ | {
+    readonly kind: "skill";
+    readonly entry: QaSlashCatalogEntry;
+}
+/** A human command: the Host's command runtime answers it, the model never sees it. */
+ | {
+    readonly kind: "command";
+    readonly entry: QaSlashCatalogEntry;
+}
+/** Nothing by that name is offered here. */
+ | {
+    readonly kind: "unknown";
+    readonly name: string;
+}
+/** A skill and a command share the name; only the user may choose. */
+ | {
+    readonly kind: "ambiguous";
+    readonly name: string;
+    readonly entries: readonly QaSlashCatalogEntry[];
+}
+/** The catalog could not be read, so no `/name` can be classified. */
+ | {
+    readonly kind: "unavailable";
+    readonly name: string;
+}
+/** The deployment runs with the slash interface off. */
+ | {
+    readonly kind: "disabled";
+};
+export interface ResolveSlashRouteInput {
+    readonly text: string;
+    readonly enabled: boolean;
+    readonly catalogReady: boolean;
+    readonly entries: readonly QaSlashCatalogEntry[];
+    /** User-invocable skills this deployment withholds from this chat. */
+    readonly deniedSkills: readonly string[];
+    /**
+     * The entry the user picked in the palette, while the draft still reads as
+     * its invocation. A picked identity outranks name resolution: when a skill
+     * and a command share a name, the user already answered the only question
+     * the router would otherwise have to guess at.
+     */
+    readonly picked?: string | null;
+}
+export declare function resolveSlashRoute(input: ResolveSlashRouteInput): QaSlashRoute;
+//# sourceMappingURL=slash-router.d.ts.map

package/lib/types/client/slash/useSlashNavigation.d.ts

@@ -0,0 +1,47 @@
+import type { QaSlashCatalogEntry, QaSlashView } from "../../types.js";
+export interface QaSlashNavigation {
+    /** True while the palette is on screen. */
+    readonly open: boolean;
+    readonly query: string;
+    /** The rows the palette renders, best match first. */
+    readonly rows: readonly QaSlashCatalogEntry[];
+    /** Index into `rows`; -1 when there is nothing to select. */
+    readonly active: number;
+    readonly activeId: string | null;
+    /** Move the selection by one row, wrapping at both ends. */
+    readonly move: (delta: number) => void;
+    /** Point the selection at one row, as a tap does. */
+    readonly hover: (index: number) => void;
+    /** Insert the active row's invocation into the draft. */
+    readonly pickActive: () => void;
+    /** Insert one row, as a click or a tap does. */
+    readonly pick: (entry: QaSlashCatalogEntry) => void;
+    /** Dismiss the palette for this draft. */
+    readonly dismiss: () => void;
+    /** The identity the user picked, while the draft still reads as its call. */
+    readonly picked: QaSlashCatalogEntry | undefined;
+}
+export interface UseSlashNavigationOptions {
+    readonly draft: string;
+    readonly slash: QaSlashView;
+    readonly maxVisible: number;
+    readonly fuzzySearch: boolean;
+    /** Set the draft to `text` and put the caret at its end. */
+    readonly setDraft: (text: string) => void;
+    /** Monotonic token; a change re-opens a palette the user had dismissed. */
+    readonly reopen: number;
+}
+/**
+ * Palette state for one composer draft.
+ *
+ * The palette is a pure function of the draft: it is open while the draft is
+ * `/` plus a name still being typed, and closes the moment the user types a
+ * space and starts writing arguments. Nothing has to be kept in sync — which
+ * is also why switching chats (the composer is keyed by chat and remounts)
+ * cannot leave a palette behind.
+ *
+ * Selection is one index over the filtered rows; the arrow keys, the mouse and
+ * the touch screen all move the same number.
+ */
+export declare function useSlashNavigation(options: UseSlashNavigationOptions): QaSlashNavigation;
+//# sourceMappingURL=useSlashNavigation.d.ts.map

package/lib/types/client/styles.d.ts

@@ -1,4 +1,26 @@
 /** Every `--dsh-qa-*` custom property the root rule declares. */
 export declare const QA_BRAND_TOKEN_NAMES: readonly string[];
 export declare const QA_SURFACE_STYLES: string;
+/**
+ * Everything the QA surface paints, as one sheet for one `<style>` tag — the
+ * kiosk form, with no host-hiding rules: in the kiosk composition the native
+ * shell never mounts, so the sheet carries nothing aimed at it.
+ *
+ * The shared audit components keep their own stylesheet in
+ * `@yadsh/dsh-audit-ui`; it is folded in here so the surface is self-contained
+ * — the audit dialog must look right whether or not the audit plugin's own
+ * client bundle happens to have injected the same rules into the document.
+ *
+ * The math styles and their fonts come from the bundled KaTeX copy the same
+ * way: the data-URI fonts resolve whatever the Host page loads, and identical
+ * rules from its own KaTeX stylesheet are harmless.
+ */
+export declare const QA_ROOT_STYLES: string;
+/**
+ * The overlay-composition sheet: the same rules as {@link QA_ROOT_STYLES}
+ * plus the host-column mask. Deployed into hosts without the kiosk patches,
+ * where the surface still covers a mounted native shell and the mask is what
+ * a deleted overlay element uncovers — a blank page instead of the shell.
+ */
+export declare const QA_OVERLAY_STYLES: string;
 //# sourceMappingURL=styles.d.ts.map

package/lib/types/client/types.d.ts

@@ -1,7 +1,7 @@
 import type { ClientRemote } from "@deepseek-ai/dsh-api-gateway/client";
 import type { ISessions, SessionFace } from "@deepseek-ai/dsh-api-session-controller/client";
 import type { UiConversation } from "@deepseek-ai/dsh-client-ui-conversation/client";
-import type { QaAccountProfileInput, QaAccountSession, QaAccountStartersInput, QaAccountStarter, QaAccountUserPublic, QaAccessAdminSnapshot, QaApprovalDecision, QaClaimResult, QaLockdownProof, QaOwnershipEntry, QaPendingApproval, QaPendingQuestion, QaQuestionAnswerItem, QaSessionState, QaSkillDocument, QaSkillDraftInput, QaSkillRemoval, QaSkillSummary, QaSkillToolDescriptor, QaSkillValidation, QaSourceFilePreview, QaTurnSources, QaWhoamiResult, QaCapabilitySelection, QaCurrentAccess, QaSessionAccess, QaSkillActivationRecord, QaSkillAssignmentOverride, QaSubrole, QaUserAccess, QaAdminAuditEvent, QaAdminOverview, QaAdminPage, QaAdminUserDetail, QaAdminUserRow, QaAdminUserUpdate, QaAuditQuery, QaConversationDetail, QaConversationQuery, QaConversationReview, QaConversationReviewInput, QaConversationSummary, QaFeedbackQuery, QaFeedbackRow, QaMessageFeedback, QaMessageFeedbackInput, QaQualityMetrics, QaReviewQueueItem, QaReviewQueueRow, QaUserQuery } from "../types.js";
+import type { QaAccountProfileInput, QaAccountSession, QaAccountStartersInput, QaAccountStarter, QaAccountUserPublic, QaAccessAdminSnapshot, QaApprovalDecision, QaClaimResult, QaLockdownProof, QaOwnershipEntry, QaPendingApproval, QaPendingQuestion, QaQuestionAnswerItem, QaSessionState, QaSkillDocument, QaSkillDraftInput, QaSkillRemoval, QaSkillSummary, QaSkillToolDescriptor, QaSkillValidation, QaSourceFilePreview, QaTurnSources, QaWhoamiResult, QaDocumentPreview, QaWorkspaceFile, QaWorkspaceListing, QaCapabilitySelection, QaCurrentAccess, QaSessionAccess, QaSkillActivationRecord, QaSkillAssignmentOverride, QaSubrole, QaUserAccess, QaAdminAuditEvent, QaAdminOverview, QaAdminPage, QaAdminUserDetail, QaAdminUserRow, QaAdminUserUpdate, QaAuditQuery, QaConversationDetail, QaConversationDeletion, QaConversationQuery, QaConversationReview, QaConversationReviewInput, QaConversationSummary, QaFeedbackQuery, QaFeedbackRow, QaMessageFeedback, QaMessageFeedbackInput, QaQualityMetrics, QaReviewQueueItem, QaReviewQueueRow, QaSlashCatalog, QaSlashExecution, QaSlashSubmitAttachment, QaUserQuery } from "../types.js";
 /** Wire content one prompt carries: text plus base64 image uploads. */
 export type QaPromptContent = Parameters<SessionFace["prompt"]>[0];
 /** DSH session runtime surface the QA controller is allowed to touch. */
@@ -58,6 +58,11 @@ export interface QaAdminApi {
     updateUser(token: string, userId: string, update: QaAdminUserUpdate): Promise<RemoteResult<QaAdminUserDetail>>;
     conversations(token: string, query: QaConversationQuery, cursor: string | null, limit: number | null): Promise<RemoteResult<QaAdminPage<QaConversationSummary>>>;
     conversation(token: string, conversationId: string): Promise<RemoteResult<QaConversationDetail>>;
+    /**
+     * Remove the conversation from the deployment, stored logs included. Only an
+     * administrator may call it; the sidebar's own delete is unrelated.
+     */
+    deleteConversation(token: string, conversationId: string): Promise<RemoteResult<QaConversationDeletion>>;
     feedback(token: string, query: QaFeedbackQuery, cursor: string | null, limit: number | null): Promise<RemoteResult<QaAdminPage<QaFeedbackRow>>>;
     /** The signed-in user's own verdict on one of their assistant messages. */
     rateMessage(token: string, conversationId: string, messageId: string, input: QaMessageFeedbackInput): Promise<RemoteResult<QaMessageFeedback>>;
@@ -106,6 +111,44 @@ export interface QaSourceApi {
         readonly ok: false;
         readonly error: unknown;
     }>;
+    /** One directory of the chat's own workspace, for the files panel. */
+    listWorkspaceFiles(token: string, sessionId: string, path: string): Promise<{
+        readonly ok: true;
+        readonly value: QaWorkspaceListing;
+    } | {
+        readonly ok: false;
+        readonly error: unknown;
+    }>;
+    /** One file of that workspace: decoded text, or bytes when it is binary. */
+    readWorkspaceFile(token: string, sessionId: string, path: string): Promise<{
+        readonly ok: true;
+        readonly value: QaWorkspaceFile;
+    } | {
+        readonly ok: false;
+        readonly error: unknown;
+    }>;
+    /**
+     * A Word document of that workspace rendered as PDF by the deployment's
+     * document pipeline; the panel shows the PDF the browser already knows how
+     * to draw instead of uploading the bytes anywhere.
+     */
+    previewWorkspaceDocument(token: string, sessionId: string, path: string): Promise<{
+        readonly ok: true;
+        readonly value: QaDocumentPreview;
+    } | {
+        readonly ok: false;
+        readonly error: unknown;
+    }>;
+}
+/**
+ * The slash half of the Host namespace. The catalog comes back already cut
+ * down by the deployment policy and the chat's role; `execute` takes the raw
+ * line, because admission re-derives the name from it rather than trusting
+ * anything the browser says about which entry it means.
+ */
+export interface QaSlashApi {
+    catalog(token: string, sessionId: string): Promise<RemoteResult<QaSlashCatalog>>;
+    execute(token: string, sessionId: string, line: string, attachments: readonly QaSlashSubmitAttachment[]): Promise<RemoteResult<QaSlashExecution>>;
 }
 /** A source API with the account token already bound at the call site. */
 export type QaBoundSourceApi = {
@@ -123,6 +166,27 @@ export type QaBoundSourceApi = {
         readonly ok: false;
         readonly error: unknown;
     }>;
+    listWorkspaceFiles(sessionId: string, path: string): Promise<{
+        readonly ok: true;
+        readonly value: QaWorkspaceListing;
+    } | {
+        readonly ok: false;
+        readonly error: unknown;
+    }>;
+    readWorkspaceFile(sessionId: string, path: string): Promise<{
+        readonly ok: true;
+        readonly value: QaWorkspaceFile;
+    } | {
+        readonly ok: false;
+        readonly error: unknown;
+    }>;
+    previewWorkspaceDocument(sessionId: string, path: string): Promise<{
+        readonly ok: true;
+        readonly value: QaDocumentPreview;
+    } | {
+        readonly ok: false;
+        readonly error: unknown;
+    }>;
 };
 /**
  * Approval remotes of this plugin's namespace. Read-only listing plus the one

package/lib/types/config-resolvers/notes.d.ts

@@ -0,0 +1,10 @@
+import type { QaNotesConfig, ResolvedQaSurfaceConfig } from "../types.js";
+type ResolvedNotes = ResolvedQaSurfaceConfig["notes"];
+/**
+ * The ambient model notes. Notes are advisory text, not capability: the
+ * default is the current behavior (every note on, built-in wording), and an
+ * empty template always resolves to the built-in text.
+ */
+export declare function resolveNotes(input: QaNotesConfig | undefined): ResolvedNotes;
+export {};
+//# sourceMappingURL=notes.d.ts.map

package/lib/types/config-resolvers/slash-commands.d.ts

@@ -0,0 +1,20 @@
+import type { QaSurfaceConfig, ResolvedQaSlashCommands } from "../types.js";
+/** Palette ceilings; a palette longer than the viewport is unusable on mobile. */
+export declare const QA_SLASH_MAX_VISIBLE_MIN = 1;
+export declare const QA_SLASH_MAX_VISIBLE_MAX = 100;
+/**
+ * Resolve the slash interface policy.
+ *
+ * The master switch lives in lockdown, so it arrives as a neighbor rather than
+ * being re-read here — one owner per decision. Two consequences are deliberate:
+ *
+ * - An upgrade from a deployment that had already set
+ *   `lockdown.allowSlashCommands: true` but knows nothing about this section
+ *   keeps working: skills fall back to `all` (every user-invocable skill the
+ *   session already exposed) and commands stay denied. The flag is reported as
+ *   `legacyDefaults` so the Host can say so once, out loud.
+ * - A deployment that declares the section and leaves the switch off changes
+ *   nothing at all: the resolved policy is inert until the switch is on.
+ */
+export declare function resolveSlashCommands(input: QaSurfaceConfig, allowSlashCommands: boolean): ResolvedQaSlashCommands;
+//# sourceMappingURL=slash-commands.d.ts.map

package/lib/types/index.d.ts

@@ -1,7 +1,7 @@
 import { TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
 import type { Context } from "@deepseek-ai/cordis";
 import type { QaTurnSources } from "./provenance/types.js";
-import type { QaAccountProfileInput, QaAccountSession, QaAccountStartersInput, QaAccountUserPublic, QaApprovalDecision, QaClaimResult, QaLockdownProof, QaOwnershipEntry, QaPendingApproval, QaPendingQuestion, QaQuestionAnswerItem, QaSurfaceConfig, ResolvedQaSurfaceConfig, QaSkillDocument, QaSkillDraftInput, QaSkillRemoval, QaSkillSummary, QaSkillToolDescriptor, QaSkillValidation, QaSourceFilePreview, QaWhoamiResult, QaPrincipal, QaAccessAdminSnapshot, QaAdminAuditEvent, QaAdminOverview, QaAdminPage, QaAdminUserDetail, QaAdminUserRow, QaAdminUserUpdate, QaAuditQuery, QaCapabilitySelection, QaConversationDetail, QaConversationQuery, QaConversationReview, QaConversationReviewInput, QaConversationSummary, QaCurrentAccess, QaFeedbackQuery, QaFeedbackRow, QaMessageFeedback, QaMessageFeedbackInput, QaQualityMetrics, QaReviewQueueItem, QaReviewQueueRow, QaSessionAccess, QaSkillActivationRecord, QaSkillAssignmentOverride, QaSubrole, QaUserAccess, QaUserQuery } from "./types.js";
+import type { QaAccountProfileInput, QaAccountSession, QaAccountStartersInput, QaAccountUserPublic, QaApprovalDecision, QaClaimResult, QaDocumentPreview, QaLockdownProof, QaOwnershipEntry, QaPendingApproval, QaPendingQuestion, QaQuestionAnswerItem, QaSurfaceConfig, ResolvedQaSurfaceConfig, QaSkillDocument, QaSkillDraftInput, QaSkillRemoval, QaSkillSummary, QaSkillToolDescriptor, QaSkillValidation, QaSourceFilePreview, QaWhoamiResult, QaWorkspaceFile, QaWorkspaceListing, QaPrincipal, QaAccessAdminSnapshot, QaAdminAuditEvent, QaAdminOverview, QaAdminPage, QaAdminUserDetail, QaAdminUserRow, QaAdminUserUpdate, QaAuditQuery, QaCapabilitySelection, QaConversationDetail, QaConversationDeletion, QaConversationQuery, QaConversationReview, QaConversationReviewInput, QaConversationSummary, QaCurrentAccess, QaFeedbackQuery, QaFeedbackRow, QaMessageFeedback, QaMessageFeedbackInput, QaQualityMetrics, QaReviewQueueItem, QaReviewQueueRow, QaSessionAccess, QaSlashCatalog, QaSlashExecution, QaSlashSubmitAttachment, QaSkillActivationRecord, QaSkillAssignmentOverride, QaSubrole, QaUserAccess, QaUserQuery } from "./types.js";
 export declare const name = "qa-surface";
 export declare const inject: string[];
 import { QA_SURFACE_SETTINGS_NAMESPACE } from "./shared/settings.js";
@@ -20,6 +20,7 @@ export declare class QaSurface extends TypertRemoteService {
     private readonly logger;
     private readonly admission;
     private readonly approvals;
+    private readonly fileDeleteGate;
     private readonly userQuestions;
     private readonly provenance;
     private readonly notes;
@@ -38,6 +39,12 @@ export declare class QaSurface extends TypertRemoteService {
     private readonly personalSkills;
     /** Personal-skill remote bodies; the wire signatures stay on this class. */
     private readonly skillRemotes;
+    /**
+     * Slash-catalog and command-admission bodies. Admission, not execution:
+     * the native skill and command runtimes stay the only things that know what
+     * a `/name` means.
+     */
+    private readonly slashRemotes;
     private readonly launchToken;
     /** Root session principals attested for their owner, never for admin viewing. */
     private readonly integrationPrincipals;
@@ -52,6 +59,25 @@ export declare class QaSurface extends TypertRemoteService {
     constructor(ctx: Context, entry?: QaSurfaceConfig);
     /** The quality store, opening its file the first time anyone needs it. */
     private quality;
+    /**
+     * The standing scope of the preset QA chats run under, so an administrator's
+     * capability catalog is read the way a chat reads it. Everything a preset
+     * mounts — its skill catalog, its tool family — is registered in that scope,
+     * and a global-only read showed the operator an almost empty page. Resolving
+     * the preset composes it but starts no agent, no session and no turn;
+     * without a pinned preset there is nothing to borrow, and the read stays
+     * global.
+     */
+    private qaPresetScope;
+    /**
+     * Drop what the quality layer kept about chats that no longer exist in the
+     * Harness. The ownership sweep calls this with the ids it reclaimed: the
+     * record it removes is one thing the deployment held about a chat, and
+     * ratings, reviews and queue entries are the rest. Failure is logged and
+     * swallowed — housekeeping runs inside a review read, and a store that
+     * cannot be opened must not fail the page that triggered it.
+     */
+    private dropVanishedChats;
     /** Resolve browser authentication to the caller only; never accepts an id. */
     principalForToken(token: string): QaPrincipal | undefined;
     /** Resolve only a directly QA-owned root session; delegated children fail closed. */
@@ -59,6 +85,21 @@ export declare class QaSurface extends TypertRemoteService {
     /** Admit tools that independently enforce the same QA principal boundary. */
     registerPrincipalScopedTools(names: readonly string[]): () => void;
     getConfig(): ResolvedQaSurfaceConfig;
+    /**
+     * Ownership plus the role's user-skill grant for one slash read.
+     *
+     * Ownership comes first and for the same reason the rest of the plugin does
+     * it: a catalog names the skills a chat can reach, and a foreign browser has
+     * no business enumerating that. With accounts off there is no identity to
+     * check and the deployment's lockdown is the boundary, exactly as it is for
+     * every other remote.
+     *
+     * The grant mirrors `installQaSkillPolicy` to the letter — an empty
+     * `userSkills` list means the role keeps no separate user list, not that it
+     * grants nothing — so the palette can never offer a skill the typed gesture
+     * would refuse, nor hide one it would accept.
+     */
+    private slashSessionGrant;
     /**
      * Self-service signup; the first account ever created becomes admin. The
      * display name derives from the email: the generated client enforces exact
@@ -139,6 +180,12 @@ export declare class QaSurface extends TypertRemoteService {
     adminConversations(token: string, query: QaConversationQuery, cursor: string | null, limit: number | null): Promise<QaAdminPage<QaConversationSummary>>;
     /** One conversation with its messages, tool calls and review state. */
     adminConversation(token: string, conversationId: string): Promise<QaConversationDetail>;
+    /**
+     * Remove one conversation from the deployment. Admin-only, audited, and the
+     * only path that deletes what a person wrote — the sidebar's own delete
+     * stays what it always was, a per-browser row.
+     */
+    adminDeleteConversation(token: string, conversationId: string): Promise<QaConversationDeletion>;
     adminFeedback(token: string, query: QaFeedbackQuery, cursor: string | null, limit: number | null): Promise<QaAdminPage<QaFeedbackRow>>;
     /**
      * Rate one of the caller's own assistant messages. The token names the only
@@ -189,6 +236,43 @@ export declare class QaSurface extends TypertRemoteService {
      * the per-account scratch directory — could never be opened in the panel.
      */
     readSourceFile(token: string, sessionId: string, sourcePath: string): Promise<QaSourceFilePreview>;
+    /**
+     * List one directory of the chat's own workspace for the files panel.
+     *
+     * Browsing is deliberately narrower than the source preview: it stays inside
+     * the chat's own directory tree, so a visitor can look at what their
+     * conversation produced and at nothing else of the deployment.
+     * `readWorkspaceFile` opens one entry of such a listing.
+     */
+    listWorkspaceFiles(token: string, sessionId: string, path: string): Promise<QaWorkspaceListing>;
+    /**
+     * Read one file of the chat's workspace: text when it decodes as UTF-8, bytes
+     * when it does not, so a document the agent produced can be downloaded while
+     * a note previews inline. The readable roots are the ones the model itself
+     * may read; unlike the source preview this does not require the file to be
+     * recorded evidence, because the panel is browsing a tree rather than
+     * reopening a cited source.
+     */
+    readWorkspaceFile(token: string, sessionId: string, path: string): Promise<QaWorkspaceFile>;
+    /**
+     * Render one Word document of the chat's workspace as a PDF for the panel.
+     *
+     * The conversion is the document pipeline's own, reached through the service
+     * `@yadsh/dsh-documents` publishes for its Host siblings — the panel gets the
+     * same providers, limits and refusals the `document_*` tools see, and a
+     * deployment without that plugin refuses instead of showing a guess. The
+     * produced PDF is read back here and travels as base64, so the audience never
+     * reaches an unfenced byte route.
+     */
+    previewWorkspaceDocument(token: string, sessionId: string, path: string): Promise<QaDocumentPreview>;
+    /**
+     * Shared admission facts of both browse methods: the preview switch is what
+     * opens the panel's file reading at all, and the chat's cwd is the tree that
+     * browsing is confined to.
+     */
+    private browseContext;
+    /** One browse refusal, logged with its coarse reason and rethrown for the wire. */
+    private browseRefusal;
     /** Every personal skill of the token's account, sorted by name. */
     skillsList(token: string): {
         readonly skills: readonly QaSkillSummary[];
@@ -216,7 +300,38 @@ export declare class QaSurface extends TypertRemoteService {
     skillsTools(token: string): {
         readonly tools: readonly QaSkillToolDescriptor[];
     };
+    /**
+     * The slash entries this browser may offer for one chat: the session's
+     * user-invocable skills and its agent's effective commands, already cut down
+     * by the deployment policy and by the chat's role. The browser filters and
+     * ranks this list; it never widens it.
+     *
+     * Enabled is reported rather than assumed, so a page that loaded before the
+     * operator flipped the master switch learns the truth instead of showing an
+     * empty palette forever.
+     */
+    slashCatalog(token: string, sessionId: string): Promise<QaSlashCatalog>;
+    /**
+     * Run one human command line. The line is the whole request — the browser
+     * sends no name, no kind and no descriptor, so there is nothing for it to
+     * forge; admission re-derives the name and re-checks the policy against the
+     * deployment's own config.
+     *
+     * A command never becomes a model message: the native runtime answers it and
+     * writes `command/run`/`command/done` into the session log, which is where
+     * the transcript row is read from.
+     */
+    slashExecute(token: string, sessionId: string, line: string, attachments: readonly QaSlashSubmitAttachment[]): Promise<QaSlashExecution>;
     private refreshRoute;
+    /**
+     * A deployment that set `lockdown.allowSlashCommands: true` before this
+     * section existed keeps the behaviour it asked for — skills at `all`,
+     * commands denied — and is told so once per configuration change, because
+     * "skills appeared after the upgrade" is otherwise indistinguishable from a
+     * defect. Commands are never part of that fallback: an upgrade must not hand
+     * the user a control-plane command nobody named.
+     */
+    private warnLegacySlashDefaults;
     /**
      * The document pipeline moved out of this plugin into `@yadsh/dsh-documents`.
      * A deployment whose profile still carries the old `documents` section would

package/lib/types/personal-skills/service.d.ts

@@ -92,6 +92,11 @@ export declare class QaPersonalSkills {
      * The skills one session cwd exposes to DSH. A file the parser rejects, or
      * one whose name disagrees with its directory, is reported in the editor and
      * never handed to the model as a half-valid skill.
+     *
+     * This is the model-facing discovery path, so it degrades to empty instead
+     * of throwing: a provider that throws marks the whole catalog snapshot
+     * incomplete, and the harness then withholds the available-skills section
+     * from every session — not just this account's skills.
      */
     discover(cwd: string): readonly QaStoredSkill[];
     /** Re-read one skill of a session cwd, re-checking the same boundary. */

package/lib/types/prompt-notes.d.ts

@@ -14,6 +14,15 @@ export declare const QA_IDENTITY_NOTE = "dsh-qa-surface:user-identity";
 export declare const QA_SOURCES_NOTE = "dsh-qa-surface:structured-sources";
 /** Note name asking the model to name its delegations. */
 export declare const QA_DELEGATION_NOTE = "dsh-qa-surface:delegation-naming";
+/**
+ * Built-in note texts. Each is the fallback for its settings template
+ * (`notes.*.template`); the placeholders mark the parts the injector
+ * substitutes. Unknown or empty placeholders render as empty text.
+ */
+export declare const QA_IDENTITY_NOTE_TEMPLATE = "{identity}\n\n{instructions}";
+export declare const QA_SOURCES_NOTE_TEMPLATE = "Source provenance is collected automatically from your tool calls; the QA surface lists what it collected beside the answer. Do not append a manual Sources/\u0418\u0441\u0442\u043E\u0447\u043D\u0438\u043A\u0438 bibliography of your own.";
+export declare const QA_SOURCES_FALLBACK_TEMPLATE = "A delegated run whose provider cannot expose tool events must call {reportTool} before finishing.";
+export declare const QA_DELEGATION_NOTE_TEMPLATE = "When you start a background subagent, give the delegation a short vivid name in its description field: two or three words in the user's language that say what the run is for (\u00AB\u0421\u0432\u0435\u0440\u043A\u0430 \u043E\u0442\u0447\u0451\u0442\u043E\u0432\u00BB, \"Log triage\"). The QA surface shows that description as the subagent's display name in the operator's panel and completion notices.";
 export interface QaIdentityRenderInput {
     /** The owner's account address; the one fact accounts always provide. */
     readonly email: string;

package/lib/types/provenance/document-preview.d.ts

@@ -0,0 +1,24 @@
+import type { DocumentsFace } from "@yadsh/dsh-documents";
+import type { QaDocumentPreview } from "../types.js";
+import { type QaAllowedFileRequest } from "./file-preview.js";
+/** Look up the document subsystem a sibling Host plugin published. */
+export type DocumentsLookup = () => DocumentsFace | undefined;
+export interface QaDocumentPreviewRequest extends QaAllowedFileRequest {
+    /** The document pipeline, resolved per call so a late provider still counts. */
+    readonly documents: DocumentsLookup;
+    readonly sessionId: string;
+    /** Bytes of the rendered PDF the panel accepts before it gives up. */
+    readonly maxBytes: number;
+}
+/**
+ * Render one Word document as a PDF for the files panel.
+ *
+ * The conversion is the document pipeline's own — the same runtime, providers
+ * and limits the `document_*` tools use — reached through the face that plugin
+ * publishes for its Host siblings; a deployment without the pipeline installed
+ * refuses with `unsupported` rather than growing a second converter here. The
+ * input path passes the same containment check the panel's other reads use, so
+ * a preview cannot read what a listing could not reach.
+ */
+export declare function previewConvertibleDocument({ documents, sessionId, maxBytes, ...file }: QaDocumentPreviewRequest): Promise<QaDocumentPreview>;
+//# sourceMappingURL=document-preview.d.ts.map

package/lib/types/provenance/file-preview.d.ts

@@ -1,11 +1,13 @@
-import type { QaSourceFilePreview } from "../types.js";
+import type { QaSourceFilePreview, QaWorkspaceFile, QaWorkspaceListing } from "../types.js";
 /**
  * Coarse, wire-safe preview refusal codes. They ride the shared
  * `(reason: <code>)` marker, so the panel can tell "this file is not in a
  * directory the QA read policy opens" from "this file is gone" instead of
  * telling every audience that a present file moved away.
  */
-export type QaSourcePreviewReason = "outside-roots" | "not-evidence" | "unavailable";
+export type QaSourcePreviewReason = "outside-roots" | "not-evidence" | "unavailable"
+/** The panel has no way to render this format at all. */
+ | "unsupported";
 /** Host refusal whose wire message carries the coarse reason marker. */
 export declare class QaSourcePreviewError extends Error {
     readonly reason: QaSourcePreviewReason;
@@ -39,6 +41,32 @@ export interface QaSourceFilePreviewRequest {
     readonly maxBytes: number;
     readonly maxMarkdownRenderBytes: number;
 }
+/** A file request the panel may make: the chat's own tree or a shared root. */
+export interface QaAllowedFileRequest {
+    readonly filePath: string;
+    /** The attested chat's cwd: the anchor a relative request resolves against. */
+    readonly cwd: string;
+    readonly sharedReadOnlyRoots?: readonly string[];
+    readonly attachmentRoot?: string;
+}
+/** One resolved file that passed the read policy. */
+interface QaAllowedFile {
+    /** The path as the caller spelled it, canonicalized against the chat cwd. */
+    readonly canonicalPath: string;
+    /** Its real filesystem path, once symlinks are followed. */
+    readonly canonical: string;
+    readonly size: number;
+}
+/**
+ * Resolve one requested file and check it against the readable roots.
+ *
+ * The roots mirror the per-user execution guard — the chat's own cwd plus the
+ * deployment's shared read-only directories and the attachment store — so a
+ * file the model was explicitly allowed to read stays readable in the panel,
+ * while anything else is refused with the coarse `outside-roots` reason
+ * instead of leaking whether it exists.
+ */
+export declare function resolveAllowedFile({ filePath, cwd, sharedReadOnlyRoots, attachmentRoot, }: QaAllowedFileRequest): Promise<QaAllowedFile>;
 /**
  * Read one evidence file from the roots the QA read policy opens.
  *
@@ -50,4 +78,43 @@ export interface QaSourceFilePreviewRequest {
  * refused as foreign evidence.
  */
 export declare function readSourceFilePreview({ sourcePath, cwd, isEvidence, sharedReadOnlyRoots, attachmentRoot, maxBytes, maxMarkdownRenderBytes, }: QaSourceFilePreviewRequest): Promise<QaSourceFilePreview>;
+/** One directory request from the files panel. */
+export interface QaWorkspaceListRequest {
+    /** The directory to list, absolute or relative to the chat cwd. Empty = root. */
+    readonly dirPath: string;
+    readonly cwd: string;
+    /** Children one listing carries; the rest is reported as truncated. */
+    readonly maxEntries: number;
+}
+/** The advertised type of one file: by extension, else opaque bytes. */
+export declare function mediaTypeOf(path: string): string;
+/**
+ * List one directory of the chat's own workspace.
+ *
+ * Browsing is deliberately narrower than previewing: the panel walks the tree
+ * the chat works in, never the deployment's shared read-only roots, so the
+ * visitor cannot enumerate the deployment from the rail. The request is
+ * confined with the same realpath-then-contain check the preview uses, which
+ * is what makes `..` and symlinked directories harmless.
+ * Symlinked children are omitted rather than followed: a link inside the
+ * workspace may point anywhere, and a tree that silently leaves the chat's
+ * directory is worse than one that hides a link.
+ */
+export declare function listWorkspaceDirectory({ dirPath, cwd, maxEntries, }: QaWorkspaceListRequest): Promise<QaWorkspaceListing>;
+/** One file request from the files panel. */
+export interface QaWorkspaceFileRequest extends QaAllowedFileRequest {
+    readonly maxBytes: number;
+    readonly maxMarkdownRenderBytes: number;
+}
+/**
+ * Read one file of the chat's workspace for the panel: text when it decodes as
+ * UTF-8, base64 bytes when it does not, so a document the agent produced can be
+ * offered for download while a note previews inline.
+ *
+ * Unlike the source preview this is not bound to recorded evidence — the panel
+ * browses what the chat's workspace holds — but it is bound to the same roots
+ * the model itself may read.
+ */
+export declare function readWorkspaceFile({ filePath, cwd, sharedReadOnlyRoots, attachmentRoot, maxBytes, maxMarkdownRenderBytes, }: QaWorkspaceFileRequest): Promise<QaWorkspaceFile>;
+export {};
 //# sourceMappingURL=file-preview.d.ts.map

package/lib/types/provenance/host-store.d.ts

@@ -44,6 +44,19 @@ export declare class QaProvenanceHost {
      * restart. Growth of the file is bounded by the snapshot store's caps.
      */
     private forget;
+    private forgetById;
+    /**
+     * Drop everything kept about one chat, in memory and in storage alike.
+     *
+     * Unlike {@link forget}, which runs on every teardown of a chat that still
+     * exists and deliberately keeps its stored turns, this is for a chat that is
+     * gone: nothing will reopen it, so the durable shard goes with it. The
+     * administrative deletion calls this in the same act that removes the
+     * session's logs.
+     *
+     * @param sessionId - the chat whose collected sources are dropped.
+     */
+    dropSession(sessionId: string): void;
     private forgetAll;
     bundles(sessionId: string): readonly QaTurnSources[];
     sourceAllowed(sessionId: string, path: string): boolean;

package/lib/types/qa-tools/catalog.d.ts

@@ -8,7 +8,7 @@ import type { QaToolDescriptor } from "./types.js";
  *
  * Bump it whenever the catalog's tool set or their schemas change.
  */
-export declare const QA_TOOL_CATALOG_VERSION = "1";
+export declare const QA_TOOL_CATALOG_VERSION = "2";
 /** One QA tool reports the activation state of whichever agent calls it. */
 export interface QaToolsSelfcheckDeps {
     readonly catalogVersion: string;