@yadsh/dsh-qa-surface 0.8.0 → 0.9.0

package/lib/types/slash/matcher.d.ts

@@ -0,0 +1,51 @@
+/**
+ * One matcher for both halves of the slash catalog.
+ *
+ * Upstream matches skills with `startsWith` and commands fuzzily, so the same
+ * query behaves differently depending on which registry answers it. QA always
+ * ranks with the ladder below, in this order:
+ *
+ *   exact → prefix → name-token boundary → substring → ordered subsequence
+ *
+ * so `/tkp` finds `generate-tkp` through the token boundary and `/contract`
+ * finds both `contract-analysis` (prefix) and `review-contract` (token).
+ *
+ * Dependency-free on purpose: inlined into the browser bundle.
+ */
+/** How a name matched; lower is a stronger claim on the top of the list. */
+export declare const SLASH_MATCH_EXACT = 0;
+export declare const SLASH_MATCH_PREFIX = 1;
+export declare const SLASH_MATCH_TOKEN = 2;
+export declare const SLASH_MATCH_SUBSTRING = 3;
+export declare const SLASH_MATCH_SUBSEQUENCE = 4;
+export interface QaSlashMatch {
+    readonly rank: number;
+    /** Where the match starts; earlier wins inside one rank. */
+    readonly index: number;
+}
+export interface QaSlashMatchOptions {
+    /**
+     * Whether the two weakest rungs run. Turning them off keeps the matcher
+     * predictable for deployments that read the palette as an index.
+     */
+    readonly fuzzy?: boolean;
+}
+/**
+ * Rank one name against a palette query. An empty query matches everything at
+ * the prefix rung, which keeps the unfiltered catalog in catalog order.
+ */
+export declare function matchSlashName(name: string, query: string, options?: QaSlashMatchOptions): QaSlashMatch | undefined;
+/**
+ * Order two ranked names; the caller has already ruled out `undefined`. Ties
+ * fall back to the name, so equal-rank rows keep catalog order and the list
+ * never reshuffles between two renders of the same query.
+ */
+export declare function compareSlashMatches(leftName: string, left: QaSlashMatch, rightName: string, right: QaSlashMatch): number;
+/**
+ * The matching entries in rank order. Identity of the input entries is
+ * preserved, so a caller can render them without a lookup.
+ */
+export declare function rankSlashEntries<T extends {
+    readonly name: string;
+}>(entries: readonly T[], query: string, options?: QaSlashMatchOptions): readonly T[];
+//# sourceMappingURL=matcher.d.ts.map

package/lib/types/slash/parser.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Composer input classification for the slash interface.
+ *
+ * The grammars are mirrors, not inventions: a command line is what the native
+ * command runtime parses (`/name` at byte zero, name then end-of-input or
+ * whitespace, everything after kept verbatim as `rawInput`), and a skill
+ * gesture is what `dsh-tool-skill` recognises (any whitespace-bounded `/name`
+ * token with the public skill-name grammar). A line that matches neither is
+ * ordinary prose and must keep behaving exactly as it did before this feature.
+ *
+ * Deliberately dependency-free: this module is inlined into the browser
+ * bundle, where the Host's config surface must not follow it.
+ */
+export interface QaSlashLine {
+    readonly name: string;
+    /** Exact text after the name, including the separator whitespace. */
+    readonly args: string;
+}
+/**
+ * Parse a command-shaped line. `undefined` means the line is not one — either
+ * it is not slash-led at all, or the token after the slash is not a command
+ * name (`/usr/bin/env` stays a path, not a call).
+ */
+export declare function parseSlashLine(input: string): QaSlashLine | undefined;
+/** The palette filter of a draft, or `undefined` when the palette is closed. */
+export declare function slashPaletteQuery(input: string): string | undefined;
+/**
+ * Every whitespace-bounded `/name` gesture in the text, first-seen order and
+ * deduplicated. The Host owns invocation; this list exists only so the QA
+ * surface can warn about a gesture its own policy withholds before the turn
+ * is submitted.
+ */
+export declare function skillGestures(input: string): readonly string[];
+/** The invocation a submitted draft carries, once its route is decided. */
+export interface QaSlashInvocation {
+    readonly name: string;
+    /** Text after the name with its separator whitespace removed. */
+    readonly args: string;
+}
+/**
+ * The invocation a draft names, independent of the catalog. Used for the
+ * routing decision and for the "unknown command" refusal, both of which must
+ * work while the catalog itself is unavailable.
+ */
+export declare function slashInvocation(input: string): QaSlashInvocation | undefined;
+//# sourceMappingURL=parser.d.ts.map

package/lib/types/slash/policy.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Admission policy for one half of the slash catalog.
+ *
+ * The policy is name-based because the persisted config is: an operator writes
+ * `generate-tkp`, never an internal id, and the same name means the same thing
+ * on every Host restart. Names that cannot be a native skill or command name
+ * are refused at config resolution rather than silently ignored at admission,
+ * so a typo surfaces while the deployment is being configured.
+ */
+import type { QaSlashPolicyMode } from "../types.js";
+/** Every accepted policy mode, in the order the settings card lists them. */
+export declare const QA_SLASH_MODES: readonly QaSlashPolicyMode[];
+/** Longest name either registry accepts in practice; keeps host echoes bounded. */
+export declare const QA_SLASH_NAME_MAX = 200;
+export interface QaSlashPolicy {
+    readonly mode: QaSlashPolicyMode;
+    readonly allow: readonly string[];
+}
+export declare function isQaSlashPolicyMode(value: unknown): value is QaSlashPolicyMode;
+/**
+ * Normalize one allow-list: trimmed, deduplicated, order-preserving. Refuses
+ * a name that neither registry could ever carry, and refuses `all` alongside a
+ * non-empty list, which would be two answers to one question.
+ */
+export declare function normalizeSlashAllow(values: readonly string[], label: string): readonly string[];
+/** Whether the policy admits this native name. */
+export declare function allowsSlashName(policy: QaSlashPolicy, name: string): boolean;
+/** The admitted subset, in the order the native registry returned it. */
+export declare function filterBySlashPolicy<T extends {
+    readonly name: string;
+}>(entries: readonly T[], policy: QaSlashPolicy): readonly T[];
+/**
+ * Intersect an already-admitted list with a second name set (the session's
+ * role grant). An empty set means "no second opinion" — the role system keeps
+ * its own switch, and a deployment that never enabled it grants nothing here.
+ */
+export declare function intersectSlashNames<T extends {
+    readonly name: string;
+}>(entries: readonly T[], names: readonly string[] | undefined): readonly T[];
+//# sourceMappingURL=policy.d.ts.map

package/lib/types/slash/remotes.d.ts

@@ -0,0 +1,35 @@
+import type { Context } from "@deepseek-ai/cordis";
+import type { PluginLogger } from "@yadsh/dsh-plugin-log";
+import type { QaSlashCatalog, QaSlashExecution, QaSlashSubmitAttachment, ResolvedQaSurfaceConfig } from "../types.js";
+/**
+ * Host-side bodies of the slash remotes. The `@Remote`-decorated signatures
+ * stay on the `QaSurface` service class (typert code generation reads the class
+ * shape); this context owns everything behind them.
+ *
+ * The division of labour is the whole feature in one sentence: QA decides what
+ * the palette may show and whether a line may run, and the native registries
+ * decide what a skill and a command *mean*. Nothing here reads a SKILL.md,
+ * injects instructions or re-implements a registry.
+ */
+export interface QaSlashRemotes {
+    /** The catalog this browser may render, already policy-filtered. */
+    catalog(token: string, sessionId: string): Promise<QaSlashCatalog>;
+    /** Run one human command line through the native command runtime. */
+    execute(token: string, sessionId: string, line: string, attachments: readonly QaSlashSubmitAttachment[]): Promise<QaSlashExecution>;
+}
+export interface QaSlashRemotesOptions {
+    readonly ctx: Context;
+    readonly getConfig: () => ResolvedQaSurfaceConfig;
+    readonly logger: PluginLogger;
+    /**
+     * Ownership and role check for the current QA session. Runs only while the
+     * deployment gates QA users with accounts; it throws on refusal, which is
+     * what makes a foreign session unreadable instead of merely unowned.
+     *
+     * @returns the role's user-skill grant, or `undefined` when the access
+     * system has no opinion about this session's skills.
+     */
+    readonly sessionGrant: (token: string, sessionId: string, agent: unknown) => Promise<readonly string[] | undefined>;
+}
+export declare function createQaSlashRemotes(options: QaSlashRemotesOptions): QaSlashRemotes;
+//# sourceMappingURL=remotes.d.ts.map

package/lib/types/types.d.ts

@@ -20,6 +20,12 @@ export type QaApprovalInteraction = "blocked" | "interactive";
  * refuses the ask outright; `interactive` answers it from the QA view.
  */
 export type QaQuestionInteraction = "unsupported" | "interactive";
+/**
+ * What a deployment may write for the question seam. `enabled` is accepted as
+ * the spelling of `interactive` a feature request asked for; the resolved
+ * config carries one name only.
+ */
+export type QaQuestionInteractionInput = QaQuestionInteraction | "enabled";
 /** The operator's answer to one parked tool call. */
 export type QaApprovalDecision = "allowed-once" | "rejected";
 /** One answered question; `custom` is free text, and may accompany `selected`. */
@@ -36,7 +42,7 @@ export interface QaQuestionAnswerItem {
  */
 export type QaAccountRole = "user" | "reviewer" | "admin";
 /** Administrative permissions a role grants; see `admin/permissions.ts`. */
-export type QaPermission = "users.read" | "users.manage" | "roles.read" | "roles.manage" | "conversations.read.all" | "conversations.read.own" | "reviews.read" | "reviews.write" | "analytics.read" | "audit.read" | "settings.manage";
+export type QaPermission = "users.read" | "users.manage" | "roles.read" | "roles.manage" | "conversations.read.all" | "conversations.read.own" | "conversations.delete" | "reviews.read" | "reviews.write" | "analytics.read" | "audit.read" | "settings.manage";
 /**
  * Tools split by how they become available. `always` is visible from the first
  * model step; `skillGrantable` is a ceiling — the tool only appears once an
@@ -550,7 +556,7 @@ export interface QaSurfaceConfig {
     readonly thinkingPhrases?: readonly string[];
     readonly interaction?: {
         readonly approvals?: QaApprovalInteraction;
-        readonly questions?: QaQuestionInteraction;
+        readonly questions?: QaQuestionInteractionInput;
     };
     /**
      * QA tool delivery. Dynamic activation keeps the QA tool schemas out of the
@@ -582,7 +588,14 @@ export interface QaSurfaceConfig {
         readonly approvalPolicy?: QaApprovalPolicy;
         readonly permissionPreset?: string;
         readonly allowPermissionChanges?: false;
-        readonly allowSlashCommands?: false;
+        /**
+         * Master switch for the slash interface, and the only capability flag the
+         * resolver lets a deployment turn on. It opens the palette, which then
+         * offers exactly what `slashCommands` admits — human commands stay denied
+         * until the deployment names them. Nothing here widens the tool allow-list,
+         * the sandbox or the approval policy.
+         */
+        readonly allowSlashCommands?: boolean;
         readonly allowSettingsMutation?: false;
         readonly allowSessionReset?: boolean;
         readonly allowSessionRename?: false;
@@ -595,6 +608,12 @@ export interface QaSurfaceConfig {
         /** Shared directories available to read-only filesystem tools. */
         readonly sharedReadOnlyRoots?: readonly string[];
     };
+    /**
+     * Slash interface policy. Admission only: the QA surface never implements a
+     * skill or command registry, it decides which native ones reach the palette.
+     * Inert while `lockdown.allowSlashCommands` is off.
+     */
+    readonly slashCommands?: QaSlashCommandsConfig;
     readonly embedding?: {
         readonly frameAncestors?: string | null;
     };
@@ -737,7 +756,7 @@ export interface ResolvedQaSurfaceConfig {
         readonly approvalPolicy: QaApprovalPolicy;
         readonly permissionPreset: string;
         readonly allowPermissionChanges: false;
-        readonly allowSlashCommands: false;
+        readonly allowSlashCommands: boolean;
         readonly allowSettingsMutation: false;
         readonly allowSessionReset: boolean;
         readonly allowSessionRename: false;
@@ -749,6 +768,7 @@ export interface ResolvedQaSurfaceConfig {
         };
         readonly sharedReadOnlyRoots: readonly string[];
     };
+    readonly slashCommands: ResolvedQaSlashCommands;
     readonly embedding: {
         readonly frameAncestors: string | null;
     };
@@ -853,6 +873,163 @@ export interface ResolvedQaSurfaceConfig {
         readonly extensions: readonly string[];
     };
 }
+/** Which native registry one unified entry came from. */
+export type QaSlashEntryKind = "skill" | "command";
+/** How one half of the catalog admits native entries. */
+export type QaSlashPolicyMode = "deny-all" | "allow-list" | "all";
+export interface QaSlashPolicyConfig {
+    readonly mode?: QaSlashPolicyMode;
+    readonly allow?: readonly string[];
+}
+export interface QaSlashPaletteConfig {
+    readonly enabled?: boolean;
+    /** Run the two weakest matcher rungs (substring, subsequence). */
+    readonly fuzzySearch?: boolean;
+    readonly maxVisible?: number;
+    readonly showDescriptions?: boolean;
+    readonly showKindBadge?: boolean;
+}
+export interface QaSlashCommandsConfig {
+    readonly skills?: QaSlashPolicyConfig;
+    readonly commands?: QaSlashPolicyConfig;
+    readonly palette?: QaSlashPaletteConfig;
+}
+export interface ResolvedQaSlashCommands {
+    /** Mirror of `lockdown.allowSlashCommands`; the one master switch. */
+    readonly enabled: boolean;
+    readonly skills: {
+        readonly mode: QaSlashPolicyMode;
+        readonly allow: readonly string[];
+    };
+    readonly commands: {
+        readonly mode: QaSlashPolicyMode;
+        readonly allow: readonly string[];
+    };
+    readonly palette: {
+        readonly enabled: boolean;
+        readonly fuzzySearch: boolean;
+        readonly maxVisible: number;
+        readonly showDescriptions: boolean;
+        readonly showKindBadge: boolean;
+    };
+    /**
+     * True when the deployment turned the master switch on without declaring a
+     * `slashCommands` section: skills then admit every user-invocable skill the
+     * session already exposes, commands stay denied. The Host logs it once, so
+     * an upgrade cannot silently widen anything.
+     */
+    readonly legacyDefaults: boolean;
+}
+/**
+ * One palette row. `id` is the routing identity: skill and command may share a
+ * name, so identity is `skill:<name>` or `command:<name>` and never the bare
+ * name the two halves would collide on.
+ */
+export interface QaSlashCatalogEntry {
+    readonly id: string;
+    readonly kind: QaSlashEntryKind;
+    readonly name: string;
+    readonly description: string;
+    /** Skill-only: the native `whenToUse`, rendered as secondary copy. */
+    readonly whenToUse?: string;
+    /** Skill-only: whether the model is also offered this skill. */
+    readonly modelInvocable?: boolean;
+    /** Command-only: the advertised argument shape. */
+    readonly inputHint?: string;
+    /** Command-only: whether the executor admits composer attachments. */
+    readonly acceptsAttachments?: boolean;
+}
+/**
+ * Whether the command half of the catalog could be read. `inactive` is the
+ * ordinary state of a cold chat: the native command registry resolves through
+ * a live Agent, and a chat with none answers with no commands rather than an
+ * error — the palette then offers skills alone.
+ */
+export type QaSlashCommandSurface = "ready" | "unavailable" | "inactive";
+export interface QaSlashCatalog {
+    /** False while `lockdown.allowSlashCommands` is off. */
+    readonly enabled: boolean;
+    readonly entries: readonly QaSlashCatalogEntry[];
+    readonly commandSurface: QaSlashCommandSurface;
+    /**
+     * User-invocable skills of this chat that the deployment or the chat's role
+     * withheld from the palette. Naming them is what lets the browser warn about
+     * a `/name` typed inside an ordinary prompt — the native gesture path never
+     * consults this list, so it is a courtesy, not an authorization.
+     */
+    readonly deniedSkills: readonly string[];
+}
+/**
+ * One composer attachment offered to a human command. The same two shapes the
+ * prompt path uses — an image rides inline, a file rides its staged receipt —
+ * because the native executor admits both through one attachment store.
+ */
+export type QaSlashSubmitAttachment = {
+    readonly type: "image";
+    readonly mediaType: QaImageMediaType;
+    readonly data: string;
+    readonly name?: string;
+} | {
+    readonly type: "file";
+    readonly receiptId: string;
+};
+/** Why a command line was refused before, or instead of, running. */
+export type QaSlashRefusal = "slash-disabled" | "unknown-command" | "not-allowed" | "attachments-unsupported" | "inactive-session";
+export type QaSlashCommandOutcome = {
+    readonly kind: "success";
+    readonly text?: string;
+    /** Earlier authoritative event this result is presented from. */
+    readonly sourceEventSeq?: number;
+} | {
+    readonly kind: "error";
+    readonly text: string;
+};
+/**
+ * The result of one admitted command. `refused` is an admission decision and
+ * costs nothing; `executed` means the native runtime ran the handler and the
+ * lifecycle is already in the session log, which is what the transcript row
+ * projects.
+ */
+export type QaSlashExecution = {
+    readonly kind: "executed";
+    readonly commandId: string;
+    readonly outcome: QaSlashCommandOutcome;
+} | {
+    readonly kind: "refused";
+    readonly reason: QaSlashRefusal;
+    /** Host-authored detail; the browser renders its own copy for `reason`. */
+    readonly message: string;
+};
+/** One entry of the palette the browser is filtering. */
+export interface QaSlashView {
+    readonly enabled: boolean;
+    readonly state: "idle" | "loading" | "ready" | "error";
+    readonly entries: readonly QaSlashCatalogEntry[];
+    readonly commandSurface: QaSlashCommandSurface;
+    readonly deniedSkills: readonly string[];
+    /** Set when the catalog could not be read; ordinary prompts keep working. */
+    readonly error: string | null;
+    /**
+     * Bumped when the surface must re-open a palette the user had dismissed —
+     * an ambiguous `/name` is the case that needs it. The composer watches the
+     * counter rather than the message, so a refusal can be re-stated.
+     */
+    readonly reopen: number;
+}
+/**
+ * One human command line projected into the transcript. Commands never enter
+ * the model conversation, so this row is their only visible trace; it is a
+ * control row, not an assistant bubble.
+ */
+export interface QaCommandActivity {
+    readonly commandId: string;
+    readonly name: string;
+    /** Verbatim text after the name, with its separator whitespace removed. */
+    readonly args?: string;
+    readonly state: "running" | "success" | "error";
+    readonly resultText?: string;
+    readonly sourceEventSeq?: number;
+}
 export interface QaSourceFilePreview {
     readonly path: string;
     readonly content: string;
@@ -927,6 +1104,11 @@ export type QaMessage = QaUserMessage | {
     readonly text: string;
     readonly status: "info" | "error";
     readonly timestamp?: number;
+    /**
+     * Set on a human command row. Commands stay out of the model
+     * conversation, so this projection is the only trace the user sees.
+     */
+    readonly command?: QaCommandActivity;
     /** Collapsible settlement row (subagent finished/stopped/failed). */
     readonly notice?: {
         readonly title: string;
@@ -1088,6 +1270,8 @@ export interface QaSessionState {
     readonly approvals: readonly QaPendingApproval[];
     /** Question requests parked for the operator's answer, oldest first. */
     readonly questions: readonly QaPendingQuestion[];
+    /** Slash palette state, keyed to the chat this snapshot describes. */
+    readonly slash: QaSlashView;
 }
 /** Minimal server-trusted identity exposed to principal-scoped plugins. */
 export interface QaPrincipal {
@@ -1173,7 +1357,7 @@ export interface QaReviewQueueItem {
     readonly feedbackId?: string;
 }
 /** Administrative actions recorded in the audit trail. */
-export type QaAdminAuditAction = "user.created" | "user.updated" | "user.enabled" | "user.disabled" | "authorization.changed" | "subrole.assignment.changed" | "subrole.created" | "subrole.updated" | "subrole.deleted" | "common_capabilities.updated" | "conversation.reviewed" | "review.updated" | "review.queued" | "admin.settings.updated";
+export type QaAdminAuditAction = "user.created" | "user.updated" | "user.enabled" | "user.disabled" | "authorization.changed" | "subrole.assignment.changed" | "subrole.created" | "subrole.updated" | "subrole.deleted" | "common_capabilities.updated" | "conversation.reviewed" | "conversation.deleted" | "review.updated" | "review.queued" | "admin.settings.updated";
 export interface QaAdminAuditEvent {
     readonly id: string;
     readonly timestamp: string;
@@ -1266,6 +1450,17 @@ export interface QaConversationDetail {
     readonly reviews: readonly QaConversationReview[];
     readonly queueItems: readonly QaReviewQueueItem[];
 }
+/** What one administrative deletion removed, for the console to report. */
+export interface QaConversationDeletion {
+    readonly conversationId: string;
+    /**
+     * Every session whose stored log is gone, the chat first: a conversation's
+     * subagent sessions are part of it and are removed with it.
+     */
+    readonly sessions: readonly string[];
+    /** Quality rows dropped with the conversation. */
+    readonly qualityRows: number;
+}
 /**
  * Server-side filter for the conversation list. Every field is optional and
  * accepts an explicit null: the wire carries whatever the browser has, and an

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yadsh/dsh-qa-surface",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "A focused end-user QA surface backed by native DeepSeek Harness sessions",
   "repository": {
     "type": "git",
@@ -16,7 +16,8 @@
   "types": "./lib/types/index.d.ts",
   "bin": {
     "qa-accounts": "./lib/cli.js",
-    "qa-repair-sessions": "./scripts/repair-session-events.mjs"
+    "qa-repair-sessions": "./scripts/repair-session-events.mjs",
+    "qa-attach-sessions": "./scripts/attach-workspace-sessions.mjs"
   },
   "exports": {
     ".": {
@@ -76,6 +77,7 @@
     "lib/**/*.js.map",
     "lib/**/*.d.ts",
     "scripts/repair-session-events.mjs",
+    "scripts/attach-workspace-sessions.mjs",
     "cordis.patch.yml",
     "compatibility.json",
     "capability-policy.json",
@@ -131,7 +133,9 @@
   "dependencies": {
     "yaml": "^2.9.0",
     "zod": "^4.4.3",
-    "@yadsh/dsh-plugin-kit": "^0.2.0",
+    "@yadsh/dsh-audit-ui": "^0.1.0",
+    "@yadsh/dsh-audit-core": "^0.1.0",
+    "@yadsh/dsh-plugin-kit": "^0.3.0",
     "@yadsh/dsh-plugin-log": "^0.4.0"
   },
   "devDependencies": {