@yadsh/dsh-qa-surface 0.9.0 → 0.10.0

package/lib/qa-tools/catalog.js

@@ -1,4 +1,5 @@
 import { defineTool } from "@deepseek-ai/dsh-tools";
+import { createFileDeleteTool } from "./file-delete.js";
 /**
  * Deterministic catalog identity. The durable activation marker is derived from
  * the session log rather than stored, so this version is not compared against a
@@ -7,7 +8,7 @@ import { defineTool } from "@deepseek-ai/dsh-tools";
  *
  * Bump it whenever the catalog's tool set or their schemas change.
  */
-export const QA_TOOL_CATALOG_VERSION = "1";
+export const QA_TOOL_CATALOG_VERSION = "2";
 function createSelfcheckTool(deps) {
     return defineTool({
         name: "qa_tools_selfcheck",
@@ -79,6 +80,11 @@ export function createQaToolCatalog(deps) {
             group: "diagnostics",
             tags: ["activation", "diagnostics"],
         },
+        {
+            definition: createFileDeleteTool(),
+            group: "workspace",
+            tags: ["files", "destructive"],
+        },
     ];
 }
 /** QA tool names, in catalog order; the admission gate treats them as dynamic. */

package/lib/qa-tools/catalog.js.map

@@ -1 +1 @@
-{"version":3,"file":"catalog.js","sourceRoot":"","sources":["../../src/qa-tools/catalog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAIpD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAc3C,SAAS,mBAAmB,CAC1B,IAA0B;IAE1B,OAAO,UAAU,CAAC;QAChB,IAAI,EAAE,oBAAoB;QAC1B,WAAW,EACT,gKAAgK;QAClK,UAAU,EAAE;YACV,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,IAAI;gBACd,IAAI,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC;gBAC3B,WAAW,EACT,kGAAkG;aACrG;SACF;QACD,MAAM,EAAE;YACN,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,oBAAoB,EAAE,KAAK;gBAC3B,UAAU,EAAE;oBACV,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;oBAClD,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;oBAClD,YAAY,EAAE;wBACZ,IAAI,EAAE,OAAO;wBACb,QAAQ,EAAE,IAAI;wBACd,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;qBAC1B;oBACD,WAAW,EAAE;wBACX,IAAI,EAAE,OAAO;wBACb,QAAQ,EAAE,IAAI;wBACd,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;qBAC1B;oBACD,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE;oBAC3C,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE;iBACjD;aACF;YACD,MAAM,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;gBACtB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC;gBACrC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxE,MAAM,IAAI,GACR,IAAI,CAAC,MAAM,KAAK,SAAS;oBACvB,CAAC,CAAC,mBAAmB,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,UAAU,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,GAAG;oBAC7H,CAAC,CAAC,MAAM;wBACN,CAAC,CAAC,gCAAgC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,GAAG;wBACpG,CAAC,CAAC,kCAAkC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,mBAAmB,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC;gBACvH,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAClC,CAAC;SACF;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;YAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;YACzB,MAAM,WAAW,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACvE,OAAO;gBACL,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,YAAY,EAAE,CAAC,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;gBACtC,WAAW,EAAE,CAAC,GAAG,WAAW,CAAC;gBAC7B,MAAM,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC;gBAC9B,WAAW,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;aACnE,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAA0B;IAE1B,OAAO;QACL;YACE,UAAU,EAAE,mBAAmB,CAAC,IAAI,CAAC;YACrC,KAAK,EAAE,aAAa;YACpB,IAAI,EAAE,CAAC,YAAY,EAAE,aAAa,CAAC;SACpC;KACF,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,WAAW,CAAC,OAAoC;IAC9D,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAoC;IAEpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,UAAU,IAAI,OAAO,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC;QACxC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,iDAAiD,IAAI,GAAG,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;AACH,CAAC"}
+{"version":3,"file":"catalog.js","sourceRoot":"","sources":["../../src/qa-tools/catalog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAGxD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAc3C,SAAS,mBAAmB,CAC1B,IAA0B;IAE1B,OAAO,UAAU,CAAC;QAChB,IAAI,EAAE,oBAAoB;QAC1B,WAAW,EACT,gKAAgK;QAClK,UAAU,EAAE;YACV,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,IAAI;gBACd,IAAI,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC;gBAC3B,WAAW,EACT,kGAAkG;aACrG;SACF;QACD,MAAM,EAAE;YACN,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,oBAAoB,EAAE,KAAK;gBAC3B,UAAU,EAAE;oBACV,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;oBAClD,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;oBAClD,YAAY,EAAE;wBACZ,IAAI,EAAE,OAAO;wBACb,QAAQ,EAAE,IAAI;wBACd,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;qBAC1B;oBACD,WAAW,EAAE;wBACX,IAAI,EAAE,OAAO;wBACb,QAAQ,EAAE,IAAI;wBACd,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;qBAC1B;oBACD,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE;oBAC3C,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE;iBACjD;aACF;YACD,MAAM,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;gBACtB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC;gBACrC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxE,MAAM,IAAI,GACR,IAAI,CAAC,MAAM,KAAK,SAAS;oBACvB,CAAC,CAAC,mBAAmB,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,UAAU,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,GAAG;oBAC7H,CAAC,CAAC,MAAM;wBACN,CAAC,CAAC,gCAAgC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,GAAG;wBACpG,CAAC,CAAC,kCAAkC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,mBAAmB,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC;gBACvH,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAClC,CAAC;SACF;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;YAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;YACzB,MAAM,WAAW,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACvE,OAAO;gBACL,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,YAAY,EAAE,CAAC,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;gBACtC,WAAW,EAAE,CAAC,GAAG,WAAW,CAAC;gBAC7B,MAAM,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC;gBAC9B,WAAW,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;aACnE,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAA0B;IAE1B,OAAO;QACL;YACE,UAAU,EAAE,mBAAmB,CAAC,IAAI,CAAC;YACrC,KAAK,EAAE,aAAa;YACpB,IAAI,EAAE,CAAC,YAAY,EAAE,aAAa,CAAC;SACpC;QACD;YACE,UAAU,EAAE,oBAAoB,EAAE;YAClC,KAAK,EAAE,WAAW;YAClB,IAAI,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC;SAC/B;KACF,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,WAAW,CAAC,OAAoC;IAC9D,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAoC;IAEpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,UAAU,IAAI,OAAO,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC;QACxC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,iDAAiD,IAAI,GAAG,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;AACH,CAAC"}

package/lib/qa-tools/file-delete-gate.js

@@ -0,0 +1,60 @@
+/** The one QA tool whose every call is parked for the operator. */
+export const QA_FILE_DELETE_TOOL = "file_delete";
+/** Why the gate answers `ask` before the chain can decide alone. */
+export const QA_FILE_DELETE_ASK_REASON = "deleting a workspace file requires operator confirmation";
+/**
+ * The inner half of `file_delete`'s safety: the decision that composes the
+ * approval flow around one destructive tool.
+ *
+ * Installed WITHOUT `prepend`, deliberately. The approval gate sits outside
+ * every other `tools/pre-execute` listener and resolves the decision the rest
+ * of the chain produced — an `ask` from an inner gate is what it parks for
+ * the operator. This listener is that inner gate: for a `file_delete` call
+ * from an attested QA session it answers `ask` on its own, without asking
+ * the chain, so the interactive approval card appears for every deletion,
+ * whatever the deployment's other policies would have said. The operator's
+ * answer becomes the decision, and on a deployment with
+ * `interaction.approvals: blocked` the approval gate keeps its fail-closed
+ * behavior and refuses the call — nothing is ever deleted without a person.
+ *
+ * Any other tool, and any caller this deployment did not attest, is handed
+ * back to the chain untouched.
+ */
+export class QaFileDeleteGate {
+    ctx;
+    ownership;
+    disposers = [];
+    constructor(ctx, ownership) {
+        this.ctx = ctx;
+        this.ownership = ownership;
+    }
+    /** Sit inside the approval gate; registration order is the composition. */
+    install() {
+        this.ownership.install(this.ctx);
+        this.disposers.push(this.ctx.on("tools/pre-execute", (execution, next) => this.handle(execution, next)));
+    }
+    /** Detach the listener. Wired as an effect, like every other gate. */
+    dispose() {
+        for (const dispose of this.disposers.splice(0))
+            dispose();
+    }
+    async handle(execution, next) {
+        if (execution.name !== QA_FILE_DELETE_TOOL)
+            return next();
+        if (!this.attested(execution))
+            return next();
+        return { kind: "ask", reason: QA_FILE_DELETE_ASK_REASON };
+    }
+    /**
+     * Whether this deployment attested the chat the call belongs to, delegated
+     * children included. The same ownership service the approval gate reads,
+     * so one chat is parked under exactly one surface.
+     */
+    attested(execution) {
+        const session = execution.agent?.session;
+        if (session === undefined)
+            return false;
+        return this.ownership.rootOf(String(session.id)) !== undefined;
+    }
+}
+//# sourceMappingURL=file-delete-gate.js.map

package/lib/qa-tools/file-delete-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-delete-gate.js","sourceRoot":"","sources":["../../src/qa-tools/file-delete-gate.ts"],"names":[],"mappings":"AAKA,mEAAmE;AACnE,MAAM,CAAC,MAAM,mBAAmB,GAAG,aAAa,CAAC;AAEjD,oEAAoE;AACpE,MAAM,CAAC,MAAM,yBAAyB,GACpC,0DAA0D,CAAC;AAE7D;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,gBAAgB;IAIR,GAAG;IACH,SAAS;IAJX,SAAS,GAAmB,EAAE,CAAC;IAEhD,YACmB,GAAY,EACZ,SAA6B;mBAD7B,GAAG;yBACH,SAAS;IACzB,CAAC;IAEJ,2EAA2E;IAC3E,OAAO;QACL,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,SAAS,CAAC,IAAI,CACjB,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,mBAAmB,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,CACnD,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAC7B,CACF,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,OAAO;QACL,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;YAAE,OAAO,EAAE,CAAC;IAC5D,CAAC;IAEO,KAAK,CAAC,MAAM,CAClB,SAA8B,EAC9B,IAAoC;QAEpC,IAAI,SAAS,CAAC,IAAI,KAAK,mBAAmB;YAAE,OAAO,IAAI,EAAE,CAAC;QAC1D,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QAC7C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IAC5D,CAAC;IAED;;;;OAIG;IACK,QAAQ,CAAC,SAA8B;QAC7C,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC;QACzC,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACxC,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;IACjE,CAAC;CACF"}

package/lib/qa-tools/file-delete.js

@@ -0,0 +1,156 @@
+import { realpath, stat, unlink } from "node:fs/promises";
+import { basename, dirname, isAbsolute, relative, resolve, sep, } from "node:path";
+import { defineTool } from "@deepseek-ai/dsh-tools";
+/**
+ * A typed refusal of one `file_delete` call.
+ *
+ * The message is what the model reads; it names the reason in words and
+ * deliberately never echoes the requested absolute host path, so a refusal
+ * cannot leak the deployment's layout into the conversation.
+ */
+export class QaFileDeleteError extends Error {
+    code;
+    constructor(code, message, options = {}) {
+        super(message, options);
+        this.code = code;
+        this.name = "QaFileDeleteError";
+    }
+}
+const OUTSIDE_WORKSPACE = "file_delete refused this path: it resolves outside the calling session's workspace. Only files inside the workspace can be deleted; pass a path relative to the workspace root.";
+const SYMLINK_ESCAPE = "file_delete refused this path: it escapes the workspace through a symbolic link, and links may not be followed out of the workspace.";
+const NOT_FOUND = "file_delete refused this path: no file exists there. Check the spelling relative to the workspace root, or create the file first.";
+const NOT_A_FILE = "file_delete refused this path: it is a directory, and only a regular file can be deleted.";
+/**
+ * The calling agent's workspace root, resolved on disk.
+ *
+ * A session without a cwd gets a refusal rather than the host process's cwd:
+ * guessing a root would point the fence at whatever directory the Host was
+ * started from, which is exactly where an untrusted chat must not delete.
+ */
+async function workspaceRootOf(exec) {
+    const cwd = exec.agent?.session.header.cwd;
+    if (typeof cwd !== "string" || cwd.trim() === "") {
+        throw new QaFileDeleteError("workspace-unavailable", "file_delete needs the calling session's workspace root, which this execution does not carry, so nothing is deleted.");
+    }
+    try {
+        return await realpath(cwd);
+    }
+    catch {
+        throw new QaFileDeleteError("workspace-unavailable", "file_delete could not resolve the calling session's workspace root on disk, so nothing is deleted.");
+    }
+}
+/**
+ * Whether `target` sits inside `root` once both are canonical. The root
+ * itself counts as inside: it is a directory, and the regular-file check is
+ * what refuses it, with a reason that matches what is actually there.
+ */
+function insideRoot(root, target) {
+    const fromRoot = relative(root, target);
+    return (fromRoot === "" ||
+        (!fromRoot.startsWith(`..${sep}`) &&
+            fromRoot !== ".." &&
+            !isAbsolute(fromRoot)));
+}
+/**
+ * Canonical form of `input`: the deepest existing ancestor resolved with
+ * `fs.realpath`, the missing suffix re-attached. A final entry that does not
+ * exist is still checked against the boundary its existing ancestors really
+ * live behind, so a symlinked directory cannot carry a request out of the
+ * workspace even when the target file is absent.
+ */
+async function canonicalCandidate(input) {
+    const resolved = resolve(input);
+    const suffix = [];
+    let cursor = resolved;
+    for (;;) {
+        try {
+            return resolve(await realpath(cursor), ...suffix);
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+            const parent = dirname(cursor);
+            if (parent === cursor)
+                throw error;
+            suffix.unshift(basename(cursor));
+            cursor = parent;
+        }
+    }
+}
+export function createFileDeleteTool() {
+    return defineTool({
+        name: "file_delete",
+        description: "Delete one regular file inside this session's workspace. Use it to remove scratch files a task produced and no longer needs. Directories, missing paths and anything outside the workspace — including paths that escape through a symbolic link — are refused. Every deletion is confirmed by the operator before it runs.",
+        parameters: {
+            path: {
+                type: "string",
+                required: true,
+                description: "The file to delete. Relative paths start at the workspace root; an absolute path must stay inside it.",
+            },
+        },
+        output: {
+            schema: {
+                type: "object",
+                additionalProperties: false,
+                properties: {
+                    deleted: { type: "boolean", required: true },
+                    path: { type: "string", required: true },
+                },
+            },
+            render: (_args, value) => {
+                const record = value;
+                return [
+                    {
+                        type: "text",
+                        text: `Deleted ${String(record.path)} from the workspace.`,
+                    },
+                ];
+            },
+        },
+        execute: async (args, exec) => {
+            const root = await workspaceRootOf(exec);
+            // Refuse the spelling first: a path that already leaves the root
+            // without any symlink has no reason to touch the filesystem further.
+            const absolute = isAbsolute(args.path)
+                ? resolve(args.path)
+                : resolve(root, args.path);
+            if (!insideRoot(root, absolute)) {
+                throw new QaFileDeleteError("outside-workspace", OUTSIDE_WORKSPACE);
+            }
+            let canonical;
+            try {
+                canonical = await canonicalCandidate(absolute);
+            }
+            catch {
+                throw new QaFileDeleteError("workspace-unavailable", "file_delete could not verify the requested path against the workspace boundary, so nothing is deleted.");
+            }
+            if (!insideRoot(root, canonical)) {
+                // The spelling stayed inside but a symbolic link moved the request
+                // out: the honest reason names the link, not the workspace.
+                throw new QaFileDeleteError("symlink-escape", SYMLINK_ESCAPE);
+            }
+            const info = await stat(canonical).catch((error) => error);
+            if (info instanceof Error) {
+                if (info.code === "ENOENT") {
+                    throw new QaFileDeleteError("not-found", NOT_FOUND);
+                }
+                throw new QaFileDeleteError("workspace-unavailable", "file_delete could not inspect the requested entry, so nothing is deleted.");
+            }
+            if (!info.isFile()) {
+                throw new QaFileDeleteError("not-a-file", NOT_A_FILE);
+            }
+            try {
+                await unlink(absolute);
+            }
+            catch (error) {
+                const code = error.code ?? "unknown";
+                throw new QaFileDeleteError("workspace-unavailable", `file_delete could not delete the file (${String(code)}).`, { cause: error });
+            }
+            return {
+                deleted: true,
+                path: relative(root, absolute).split(sep).join("/"),
+            };
+        },
+    });
+}
+//# sourceMappingURL=file-delete.js.map

package/lib/qa-tools/file-delete.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-delete.js","sourceRoot":"","sources":["../../src/qa-tools/file-delete.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EACL,QAAQ,EACR,OAAO,EACP,UAAU,EACV,QAAQ,EACR,OAAO,EACP,GAAG,GACJ,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AA4BpD;;;;;;GAMG;AACH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAE/B,IAAI;IADf,YACW,IAAyB,EAClC,OAAe,EACf,OAAO,GAAiB,EAAE;QAE1B,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;oBAJf,IAAI;QAKb,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAaD,MAAM,iBAAiB,GACrB,iLAAiL,CAAC;AACpL,MAAM,cAAc,GAClB,sIAAsI,CAAC;AACzI,MAAM,SAAS,GACb,mIAAmI,CAAC;AACtI,MAAM,UAAU,GACd,2FAA2F,CAAC;AAE9F;;;;;;GAMG;AACH,KAAK,UAAU,eAAe,CAAC,IAA2B;IACxD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC;IAC3C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACjD,MAAM,IAAI,iBAAiB,CACzB,uBAAuB,EACvB,qHAAqH,CACtH,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAiB,CACzB,uBAAuB,EACvB,oGAAoG,CACrG,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,IAAY,EAAE,MAAc;IAC9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,OAAO,CACL,QAAQ,KAAK,EAAE;QACf,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC;YAC/B,QAAQ,KAAK,IAAI;YACjB,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CACzB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,kBAAkB,CAAC,KAAa;IAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,MAAM,GAAG,QAAQ,CAAC;IACtB,SAAS,CAAC;QACR,IAAI,CAAC;YACH,OAAO,OAAO,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;YACpE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;YAC/B,IAAI,MAAM,KAAK,MAAM;gBAAE,MAAM,KAAK,CAAC;YACnC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YACjC,MAAM,GAAG,MAAM,CAAC;QAClB,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB;IAClC,OAAO,UAAU,CAAC;QAChB,IAAI,EAAE,aAAa;QACnB,WAAW,EACT,6TAA6T;QAC/T,UAAU,EAAE;YACV,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,IAAI;gBACd,WAAW,EACT,uGAAuG;aAC1G;SACF;QACD,MAAM,EAAE;YACN,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,oBAAoB,EAAE,KAAK;gBAC3B,UAAU,EAAE;oBACV,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE;oBAC5C,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;iBACzC;aACF;YACD,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;gBACvB,MAAM,MAAM,GAAG,KAA8C,CAAC;gBAC9D,OAAO;oBACL;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,WAAW,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB;qBAC3D;iBACF,CAAC;YACJ,CAAC;SACF;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;YAC5B,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;YACzC,iEAAiE;YACjE,qEAAqE;YACrE,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;gBACpC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;gBACpB,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7B,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,CAAC;YACtE,CAAC;YACD,IAAI,SAAiB,CAAC;YACtB,IAAI,CAAC;gBACH,SAAS,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YACjD,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,iBAAiB,CACzB,uBAAuB,EACvB,wGAAwG,CACzG,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;gBACjC,mEAAmE;gBACnE,4DAA4D;gBAC5D,MAAM,IAAI,iBAAiB,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;YAChE,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CACtC,CAAC,KAAc,EAAyB,EAAE,CACxC,KAA8B,CACjC,CAAC;YACF,IAAI,IAAI,YAAY,KAAK,EAAE,CAAC;gBAC1B,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC3B,MAAM,IAAI,iBAAiB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;gBACtD,CAAC;gBACD,MAAM,IAAI,iBAAiB,CACzB,uBAAuB,EACvB,2EAA2E,CAC5E,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;gBACnB,MAAM,IAAI,iBAAiB,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;YACxD,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;YACzB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,IAAI,SAAS,CAAC;gBAChE,MAAM,IAAI,iBAAiB,CACzB,uBAAuB,EACvB,0CAA0C,MAAM,CAAC,IAAI,CAAC,IAAI,EAC1D,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;aACpD,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/lib/resolve-config.js

@@ -3,6 +3,7 @@ import { resolveAttachments } from "./config-resolvers/attachments.js";
 import { normalizeRoutePath, resolveBasics, } from "./config-resolvers/basics.js";
 import { DEFAULT_QA_SURFACE_CONFIG } from "./config-resolvers/defaults.js";
 import { resolveLockdown } from "./config-resolvers/lockdown.js";
+import { resolveNotes } from "./config-resolvers/notes.js";
 import { resolveSession } from "./config-resolvers/session.js";
 import { resolveSlashCommands } from "./config-resolvers/slash-commands.js";
 import { resolveSources } from "./config-resolvers/sources.js";
@@ -44,6 +45,7 @@ export function resolveConfig(input = {}) {
         sources,
         attachments,
         tools,
+        notes: resolveNotes(input.notes),
     });
 }
 //# sourceMappingURL=resolve-config.js.map

package/lib/resolve-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-config.js","sourceRoot":"","sources":["../src/resolve-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EACL,kBAAkB,EAClB,aAAa,GACd,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAGrD,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,CAAC;AAEzD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,KAAK,GAAoB,EAAE;IAE3B,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5B,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC5C,yEAAyE;IACzE,iEAAiE;IACjE,MAAM,aAAa,GAAG,oBAAoB,CACxC,KAAK,EACL,QAAQ,CAAC,kBAAkB,CAC5B,CAAC;IACF,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC/D,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO;QACP,EAAE;QACF,kBAAkB,EAAE,eAAe,CACjC,KAAK,CAAC,kBAAkB,IAAI,yBAAyB,CAAC,kBAAkB,CACzE;QACD,eAAe,EAAE,aAAa,CAC5B,KAAK,CAAC,eAAe,IAAI,yBAAyB,CAAC,eAAe,CACnE;QACD,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,QAAQ;QACR,aAAa;QACb,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,QAAQ;QACR,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,OAAO;QACP,WAAW;QACX,KAAK;KACN,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"resolve-config.js","sourceRoot":"","sources":["../src/resolve-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EACL,kBAAkB,EAClB,aAAa,GACd,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAGrD,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,CAAC;AAEzD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,KAAK,GAAoB,EAAE;IAE3B,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5B,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC5C,yEAAyE;IACzE,iEAAiE;IACjE,MAAM,aAAa,GAAG,oBAAoB,CACxC,KAAK,EACL,QAAQ,CAAC,kBAAkB,CAC5B,CAAC;IACF,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC/D,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO;QACP,EAAE;QACF,kBAAkB,EAAE,eAAe,CACjC,KAAK,CAAC,kBAAkB,IAAI,yBAAyB,CAAC,kBAAkB,CACzE;QACD,eAAe,EAAE,aAAa,CAC5B,KAAK,CAAC,eAAe,IAAI,yBAAyB,CAAC,eAAe,CACnE;QACD,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,QAAQ;QACR,aAAa;QACb,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,QAAQ;QACR,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,OAAO;QACP,WAAW;QACX,KAAK;QACL,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC;KACjC,CAAC,CAAC;AACL,CAAC"}

package/lib/shared/documents.js

@@ -0,0 +1,22 @@
+/**
+ * Formats the files panel previews by conversion instead of by bytes.
+ *
+ * Shared by the Host half (which owns the conversion) and the browser card
+ * (which decides whether opening a file should ask for one), so the two cannot
+ * drift on what "we can render this" means. Dependency-free on purpose: the
+ * card bundle inlines it.
+ */
+/** OOXML word-processing documents, as the deployment detects them. */
+export const QA_WORD_MEDIA_TYPE = "application/vnd.openxmlformats-officedocument.wordprocessingml.document";
+/** The media type of the PDF a converted document arrives as. */
+export const QA_PDF_MEDIA_TYPE = "application/pdf";
+/**
+ * Whether the panel asks the Host for a converted PDF rather than rendering the
+ * bytes it already holds. Word documents are the whole set: the document
+ * pipeline reads them and renders PDF, while its other inputs are already
+ * previewable (Markdown as text, PDF through the browser's own viewer).
+ */
+export function isConvertibleDocument(mediaType) {
+    return mediaType === QA_WORD_MEDIA_TYPE;
+}
+//# sourceMappingURL=documents.js.map

package/lib/shared/documents.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"documents.js","sourceRoot":"","sources":["../../src/shared/documents.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,uEAAuE;AACvE,MAAM,CAAC,MAAM,kBAAkB,GAC7B,yEAAyE,CAAC;AAE5E,iEAAiE;AACjE,MAAM,CAAC,MAAM,iBAAiB,GAAG,iBAAiB,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAAiB;IACrD,OAAO,SAAS,KAAK,kBAAkB,CAAC;AAC1C,CAAC"}