@yadsh/dsh-qa-surface 0.9.0 → 0.10.0

package/lib/types/client/admin/shared.d.ts

@@ -17,6 +17,8 @@ export declare function useAdminResource<T>(load: () => Promise<RemoteResult<T>>
     readonly error: string | undefined;
     readonly loading: boolean;
     reload: () => Promise<void>;
+    /** Adopt a value this page already holds, without re-asking the Host. */
+    apply: (value: T) => void;
 };
 /** A status chip; the modifier class carries the semantic colour. */
 export declare function Badge(props: {

package/lib/types/client/base64.d.ts

@@ -1,5 +1,5 @@
 /**
- * Browser-side binary-to-base64. Chunked so `String.fromCharCode` never
+ * Browser-side base64. Encoding is chunked so `String.fromCharCode` never
  * crosses the engine's argument limit on large attachments.
  */
 /**
@@ -7,4 +7,16 @@
  * @returns the canonical base64 text (no `data:` prefix, no padding tricks).
  */
 export declare function bytesToBase64(bytes: Uint8Array): string;
+/**
+ * Decode base64 the Host sent for a file the panel could not read as text.
+ *
+ * A malformed body is tolerated rather than thrown on: the caller is about to
+ * hand the bytes to a download or an image tag, and a partial file is a better
+ * outcome than losing the panel to an exception. `atob` still rejects input
+ * that is not base64 at all; the caller keeps that refusal.
+ *
+ * @param value - base64 text, with or without a data-URL prefix.
+ * @returns the decoded bytes.
+ */
+export declare function base64ToBytes(value: string): Uint8Array;
 //# sourceMappingURL=base64.d.ts.map

package/lib/types/client/components/QaAgentsDrawer.d.ts

@@ -5,7 +5,8 @@ export interface QaSubagentRow {
     readonly title: string;
     readonly running: boolean;
     readonly completed: boolean;
-    readonly meta: string;
+    /** Muted facts rendered after the title, one span per part. */
+    readonly meta: readonly string[];
 }
 /**
  * Direct subagent children of the open chat, running first. Reads the host

package/lib/types/client/components/QaFilesPanel.d.ts

@@ -1,15 +1,27 @@
 import type { QaChatFileGroup } from "../chat-files.js";
+import type { QaBoundSourceApi } from "../types.js";
 export interface QaFilesPanelProps {
     readonly groups: readonly QaChatFileGroup[];
     /** Resolve an image attachment to an object URL; images render inert without it. */
     readonly resolveImage?: (attachmentId: string) => Promise<string>;
     /** Scroll the transcript to the group's user message. */
     readonly onJumpToMessage: (messageId: string) => void;
+    /**
+     * The chat whose workspace the panel browses. Both this and `api` are absent
+     * in hosts that only render the attachment roster, where the workspace
+     * section is left out rather than shown as a refusal.
+     */
+    readonly sessionId?: string;
+    readonly api?: QaBoundSourceApi;
 }
 /**
- * The chat's attachment roster: one section per sending message, newest
- * first. Rows mirror the transcript's handles — the browser never reads a
- * file back, and the images are the same object URLs the message showed.
+ * The chat's attachment roster plus, when the Host is reachable, the chat's
+ * own workspace: one section per sending message, newest first, and above it
+ * the file browser the conversation worked in.
+ *
+ * Rows mirror the transcript's handles — the browser never reads an attachment
+ * back, and the images are the same object URLs the message showed — while the
+ * workspace section reads through the Host's fenced listing and file reads.
  */
-export declare function QaFilesPanel({ groups, resolveImage, onJumpToMessage, }: QaFilesPanelProps): import("react/jsx-runtime").JSX.Element;
+export declare function QaFilesPanel({ groups, resolveImage, onJumpToMessage, sessionId, api, }: QaFilesPanelProps): import("react/jsx-runtime").JSX.Element;
 //# sourceMappingURL=QaFilesPanel.d.ts.map

package/lib/types/client/components/QaHeader.d.ts

@@ -17,10 +17,9 @@ export interface QaHeaderProps {
     readonly logoUrl: string | null;
     /** The derived conversation title; null hides the heading. */
     readonly title: string | null;
-    /** A subagent view replaces the mode caption with its return control. */
+    /** A subagent view shows its return control in the title row. */
     readonly viewingSubagent: boolean;
     readonly onCloseSubagent: () => void;
-    readonly agentPreset: string | null;
     readonly roleSelector?: ReactNode;
     readonly administration?: {
         readonly onOpen: () => void;
@@ -36,6 +35,13 @@ export interface QaHeaderProps {
     readonly sourcesOpen: boolean;
     readonly onOpenSources: () => void;
     readonly fileCount: number;
+    /**
+     * Whether the files tab has anything to open: attachments, or the chat's own
+     * workspace when the deployment lets the panel read files. The count stays
+     * the attachment number, so an empty chat with a readable workspace shows no
+     * badge but still opens.
+     */
+    readonly filesEnabled: boolean;
     readonly filesOpen: boolean;
     readonly onOpenFiles: () => void;
     /**
@@ -53,5 +59,5 @@ export interface QaHeaderProps {
     readonly resetDisabled: boolean;
     readonly onReset: () => void;
 }
-export declare function QaHeader({ logoUrl, title, viewingSubagent, onCloseSubagent, agentPreset, roleSelector, administration, agentCount, agentsOpen, onToggleAgents, sourcesVisible, sourcesCount, sourcesComplete, sourcesOpen, onOpenSources, fileCount, filesOpen, onOpenFiles, settings, panelLauncher, showReset, resetDisabled, onReset, }: QaHeaderProps): import("react/jsx-runtime").JSX.Element;
+export declare function QaHeader({ logoUrl, title, viewingSubagent, onCloseSubagent, roleSelector, administration, agentCount, agentsOpen, onToggleAgents, sourcesVisible, sourcesCount, sourcesComplete, sourcesOpen, onOpenSources, fileCount, filesEnabled, filesOpen, onOpenFiles, settings, panelLauncher, showReset, resetDisabled, onReset, }: QaHeaderProps): import("react/jsx-runtime").JSX.Element;
 //# sourceMappingURL=QaHeader.d.ts.map

package/lib/types/client/components/QaModal.d.ts

@@ -11,11 +11,12 @@ export interface QaModalProps {
     readonly footer?: ReactNode;
     readonly wide?: boolean;
     /**
-     * Panel size: `wide` fits prose that must not wrap mid-sentence, and
+     * Panel size: `wide` fits prose that must not wrap mid-sentence,
      * `settings` the sectioned user-settings dialog, which needs both a
-     * comfortable height and a two-column body.
+     * comfortable height and a two-column body, and `document` a file
+     * preview the reader expanded out of the rail.
      */
-    readonly size?: "default" | "wide" | "settings";
+    readonly size?: "default" | "wide" | "settings" | "document";
 }
 /**
  * The shared QA dialog shell: backdrop, panel, head with the close control,

package/lib/types/client/components/QaWidthHandle.d.ts

@@ -19,8 +19,12 @@ export declare const QA_HANDLE_FREE_BAND = 40;
  * at every width; the stylesheet caps it once more by the live side gutter.
  */
 export declare const QA_BLEED_MAX_WIDTH: number;
-export declare function readQaContentWidth(storage: Pick<Storage, "getItem">, key: string): number | null;
-export declare function writeQaContentWidth(storage: Pick<Storage, "setItem">, key: string, width: number): void;
+/**
+ * A stored positive width, or null when the browser has none (first visit,
+ * denied storage, corrupt value). Shared by every draggable width.
+ */
+export declare function readQaStoredWidth(storage: Pick<Storage, "getItem">, key: string): number | null;
+export declare function writeQaStoredWidth(storage: Pick<Storage, "setItem">, key: string, width: number): void;
 /**
  * Resolve the centered content width for the currently available column. The
  * operator sets only the floor; the column is the ceiling, so the content may
@@ -52,5 +56,47 @@ export declare function useQaContentWidth({ active, root, storage, storageKey, m
     readonly onEnd: () => void;
 };
 export type UseQaContentWidthResult = ReturnType<typeof useQaContentWidth>;
+/** Drag clamp for the chat-list sidebar, borrowed from the DSH frame. */
+export declare const QA_SIDEBAR_MIN_WIDTH = 264;
+export declare const QA_SIDEBAR_MAX_WIDTH = 420;
+/** The width the sidebar keeps until its first drag: today's fixed width. */
+export declare const QA_SIDEBAR_DEFAULT_WIDTH = 264;
+/** Integer pixels, no snapping and no step, like the DSH frame clamp. */
+export declare function clampQaSidebarWidth(px: number): number;
+/** Resolve the sidebar width for this browser: the stored drag or the default. */
+export declare function resolveQaSidebarWidth(stored: number | null): number;
+interface QaSidebarHandleProps {
+    readonly onStart: () => number;
+    readonly onDrag: (width: number) => void;
+    readonly onCommit: (width: number) => void;
+    readonly onEnd: () => void;
+}
+/**
+ * The invisible strip on the sidebar's border, like the DSH frame's handle: an
+ * 8px hit target straddling the edge, found by the cursor alone. One-sided —
+ * the pointer delta is the width delta — and pointer-captured, so the drag
+ * keeps tracking outside the strip and never selects text.
+ */
+export declare function QaSidebarHandle(props: QaSidebarHandleProps): import("react/jsx-runtime").JSX.Element;
+interface UseQaSidebarWidthOptions {
+    /** Whether the expanded sidebar is mounted (the collapsed rail has none). */
+    readonly active: boolean;
+    readonly root: RefObject<HTMLElement | null>;
+    readonly storage: Pick<Storage, "getItem" | "setItem">;
+    readonly storageKey: string;
+}
+/**
+ * Sidebar counterpart of `useQaContentWidth`: the width never enters React
+ * state — the drag writes the custom property straight onto the nav element,
+ * so the memoized sidebar does not re-render per frame — and only the
+ * committed value reaches storage, which the next mount restores.
+ */
+export declare function useQaSidebarWidth({ active, root, storage, storageKey, }: UseQaSidebarWidthOptions): {
+    readonly onStart: () => number;
+    readonly onDrag: (width: number) => void;
+    readonly onCommit: (width: number) => void;
+    readonly onEnd: () => void;
+};
+export type UseQaSidebarWidthResult = ReturnType<typeof useQaSidebarWidth>;
 export {};
 //# sourceMappingURL=QaWidthHandle.d.ts.map

package/lib/types/client/components/QaWorkspaceBrowser.d.ts

@@ -0,0 +1,15 @@
+import type { QaBoundSourceApi } from "../types.js";
+export interface QaWorkspaceBrowserProps {
+    readonly sessionId: string;
+    readonly api: QaBoundSourceApi;
+}
+/**
+ * The chat's own workspace, browsable from the files rail.
+ *
+ * One directory at a time: the Host lists a directory, the panel descends into
+ * its children and never travels by path, so a link in a listing cannot walk
+ * the visitor out of the chat's tree. Opening a file reads exactly that file —
+ * text inline, anything else as a downloadable handle.
+ */
+export declare function QaWorkspaceBrowser({ sessionId, api, }: QaWorkspaceBrowserProps): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=QaWorkspaceBrowser.d.ts.map

package/lib/types/client/index.d.ts

@@ -6,7 +6,7 @@ declare module "@deepseek-ai/cordis" {
     }
 }
 export declare const inject: string[];
-/** Register the route-aware, full-frame QA entry in the additive overlay slot. */
+/** Register the route-aware, full-frame QA entry: root owner in the kiosk, additive overlay slot otherwise. */
 export declare function apply(ctx: Context): Promise<() => Promise<void>>;
 export { QaConfigController } from "./QaConfigController.js";
 export { QaAccountsController } from "./QaAccountsController.js";

package/lib/types/client/kiosk.d.ts

@@ -0,0 +1,34 @@
+/**
+ * The QA kiosk presentation mode, as the client half of the plugin sees it.
+ *
+ * The harness publishes the deployment's UI mode into every served document
+ * ahead of the first application script (the index prelude injected for
+ * `DSH_UI_MODE=qa`): `window.DSH_UI_MODE` and, alongside it, the QA base path
+ * the server-side route policy serves the application under. The mode — not
+ * `location.pathname` — is what the client branches on: the route policy owns
+ * which paths carry a document at all, and a client that keyed off the
+ * pathname would re-introduce exactly the paths the policy closed.
+ *
+ * A document without the globals (a host without the kiosk patches, a plugin
+ * bundle served into an overlay deployment) reads as the overlay
+ * presentation: the `shell.overlay` registration this plugin has always
+ * used. That keeps one plugin build compatible with both compositions.
+ */
+/**
+ * Whether one URL pathname lives on a surface: the surface path itself or any
+ * child of it. A plain prefix check would also match `/qadmin` or `/qa-test`.
+ */
+export declare function matchesSurface(pathname: string, surface: string): boolean;
+/**
+ * Whether this browser was served by a QA kiosk deployment.
+ * @param target - the global object; overridable for tests.
+ */
+export declare function qaKioskMode(target?: Readonly<Record<string, unknown>>): boolean;
+/**
+ * The QA surface's base path of a kiosk deployment, normalized: single
+ * leading slash, no trailing slash. A malformed value falls back to the
+ * default rather than disabling the mode.
+ * @param target - the global object; overridable for tests.
+ */
+export declare function qaKioskBasePath(target?: Readonly<Record<string, unknown>>): string;
+//# sourceMappingURL=kiosk.d.ts.map

package/lib/types/client/markdown/blocks.d.ts

@@ -9,6 +9,13 @@
  * blocks, setext inside lists, link reference definitions spanning lines) stay
  * out. Raw HTML never becomes a block: a tag line is a paragraph whose inline
  * pass leaves the tag as literal text.
+ *
+ * Math follows the Host transcript's settled grammar: display TeX is a
+ * `$$`-delimited block (a fence on its own lines or one line
+ * `$$…$$`) or a ```math fence, and nothing else — the `\(…\)` and `\[…\]`
+ * delimiters stay literal text, exactly as the Host renders them. Footnote
+ * definitions (`[^id]: …`) are collected the way GitHub's dialect does, with
+ * lazy and indented continuation lines.
  */
 /** `#`-through-`######` heading levels. */
 export type HeadingDepth = 1 | 2 | 3 | 4 | 5 | 6;
@@ -46,6 +53,9 @@ export type MarkdownBlock = {
     readonly align: readonly TableAlign[];
     readonly head: readonly string[];
     readonly rows: readonly (readonly string[])[];
+} | {
+    readonly kind: "math";
+    readonly text: string;
 } | {
     readonly kind: "rule";
 };
@@ -54,6 +64,8 @@ export interface ParsedMarkdown {
     readonly blocks: readonly MarkdownBlock[];
     /** Link/image definitions by upper-cased identifier. */
     readonly definitions: ReadonlyMap<string, string>;
+    /** Footnote bodies by upper-cased identifier; first definition wins. */
+    readonly footnotes: ReadonlyMap<string, readonly MarkdownBlock[]>;
 }
 /** Split one table row into trimmed cells, honoring escaped pipes. */
 export declare function splitTableRow(line: string): string[];
@@ -67,8 +79,9 @@ export declare function parseMarkdown(text: string): ParsedMarkdown;
  * Parse the blocks of one container (document, quote, or list item).
  * @param lines - Container lines, already de-indented by the caller.
  * @param definitions - Document-wide definition accumulator.
+ * @param footnotes - Document-wide footnote accumulator.
  * @param depth - Container nesting depth.
  * @returns The container's blocks.
  */
-export declare function parseBlocks(lines: readonly string[], definitions: Map<string, string>, depth: number): MarkdownBlock[];
+export declare function parseBlocks(lines: readonly string[], definitions: Map<string, string>, footnotes: Map<string, readonly MarkdownBlock[]>, depth: number): MarkdownBlock[];
 //# sourceMappingURL=blocks.d.ts.map

package/lib/types/client/markdown/inline.d.ts

@@ -1,10 +1,13 @@
 /**
  * GFM inline grammar for the chat renderer: code spans, emphasis, links,
- * images, autolinks, and the two line-break flavors. Emphasis follows the
- * CommonMark intent (a closer must match its opener's delimiter run, `_` never
- * opens inside a word) rather than the full delimiter-stack algorithm — the
- * shapes this grammar cannot express are the pathological ones, and they
- * degrade to literal text instead of mangling the sentence.
+ * images, autolinks, TeX math, footnotes, and the two line-break flavors.
+ * Emphasis follows the CommonMark intent (a closer must match its opener's
+ * delimiter run, `_` never opens inside a word) rather than the full
+ * delimiter-stack algorithm — the shapes this grammar cannot express are the
+ * pathological ones, and they degrade to literal text instead of mangling the
+ * sentence. Math follows the Host transcript: `$…$` and `$$…$$` spans, with
+ * maximal-munch dollar runs and whitespace padding stripped only when both
+ * ends carry it.
  */
 /** One inline node; `children` nodes nest. */
 export type MarkdownInline = {
@@ -28,13 +31,26 @@ export type MarkdownInline = {
     readonly kind: "image";
     readonly src: string;
     readonly alt: string;
+} | {
+    readonly kind: "inlineMath";
+    readonly value: string;
+} | {
+    readonly kind: "footnoteRef";
+    readonly id: string;
 };
+/** The reference targets one inline pass resolves against. */
+export interface InlineTargets {
+    /** Link/image definitions by upper-cased identifier. */
+    readonly definitions: ReadonlyMap<string, string>;
+    /** Footnote identifiers that have a definition, by upper-cased label. */
+    readonly footnotes: ReadonlyMap<string, unknown>;
+}
 /**
  * Parse the inline content of one leaf block.
  * @param text - Raw inline Markdown, newlines included.
- * @param definitions - Link/image definitions collected by the block pass.
+ * @param targets - The definitions and footnotes this pass resolves against.
  * @param depth - Inline nesting depth.
  * @returns The inline nodes in document order.
  */
-export declare function parseInline(text: string, definitions: ReadonlyMap<string, string>, depth?: number): MarkdownInline[];
+export declare function parseInline(text: string, targets: ReadonlyMap<string, string> | InlineTargets, depth?: number): MarkdownInline[];
 //# sourceMappingURL=inline.d.ts.map

package/lib/types/client/markdown/katex-css.d.ts

@@ -0,0 +1,11 @@
+/**
+ * `katex/dist/katex.min.css` with every font inlined as a woff2 data URI.
+ * Generated by `scripts/generate-katex-css.mjs` from the pinned `katex`
+ * devDependency — do not edit by hand; regenerate after a `katex` upgrade.
+ *
+ * The QA overlay is a self-contained client bundle, so the math styles and
+ * their fonts travel inside it: nothing here may reference an external file,
+ * and a data URI cannot collide with the Host's own KaTeX font declarations.
+ */
+export declare const KATEX_CSS: string;
+//# sourceMappingURL=katex-css.d.ts.map

package/lib/types/client/markdown/math.d.ts

@@ -0,0 +1,23 @@
+/**
+ * TeX-to-React via KaTeX, mirroring the Host transcript's math pipeline: the
+ * same two-arm error chain (strict render, `strict: 'ignore'` retry, error
+ * span) so a formula renders identically here and in DSH's own message. KaTeX
+ * emits an HTML string; the browser's HTML parser turns it into a tree this
+ * module maps onto React elements — the output is a static span/MathML/SVG
+ * vocabulary with no raw author HTML, the same trust the fenced-code
+ * highlighter's tree gets.
+ *
+ * React has no MathML support, so the `.katex-mathml` subtree's elements land
+ * in the HTML namespace; the visual arm is the `.katex-html` span tree and
+ * the MathML arm serves assistive technology, which reads it by tag name.
+ */
+import type { ReactNode } from "react";
+/**
+ * Render TeX source to React elements through KaTeX.
+ * @param value - The TeX source (a math node's raw content).
+ * @param displayMode - Display (block) versus inline rendering.
+ * @returns KaTeX's element tree, or the error span when the source does not
+ * parse even under `strict: 'ignore'`.
+ */
+export declare function renderTexToReact(value: string, displayMode: boolean): ReactNode;
+//# sourceMappingURL=math.d.ts.map

package/lib/types/client/markdown/render.d.ts

@@ -7,7 +7,8 @@ import { type MarkdownSourceContext } from "./source-chip.js";
  * instead of a plain link or code token.
  * @param text - Assistant-authored markdown.
  * @param context - Source resolution handed down by the owning message.
- * @returns The document's blocks.
+ * @returns The document's blocks, plus the footnote section when the document
+ * references a defined footnote.
  */
 export declare function renderMarkdown(text: string, context: MarkdownSourceContext): ReactNode[];
 //# sourceMappingURL=render.d.ts.map

package/lib/types/client/settings/sections/notes.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Model notes: the ambient plugin messages the injector writes into a QA chat
+ * (who the user is, the source-provenance rules, delegation naming). Each note
+ * has a switch and an optional wording override; an empty template keeps the
+ * built-in text, so the fields double as a wording editor and a mute switch.
+ */
+import { type ConfigProps } from "./common.js";
+/** The ambient notes the Host writes into QA chats as hidden user messages. */
+export declare function NotesSection(props: ConfigProps): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=notes.d.ts.map

package/lib/types/client/settings/sections.d.ts

@@ -18,6 +18,7 @@ export { BrandingSection } from "./sections/branding.js";
 export { EmbeddingSection } from "./sections/embedding.js";
 export { InterfaceSection } from "./sections/interface.js";
 export { LockdownSection } from "./sections/lockdown.js";
+export { NotesSection } from "./sections/notes.js";
 export { SessionSection } from "./sections/session.js";
 export { SlashSection } from "./sections/slash.js";
 export { SourcesSection } from "./sections/sources.js";

package/lib/types/client/settlement.d.ts

@@ -13,7 +13,10 @@ export declare function parseSettlement(text: string): SettledSubagent | undefin
 export interface SettlementView {
     readonly title: string;
     readonly body: string;
-    /** Muted correlation line above the body; absent when the title says it all. */
+    /**
+     * Muted correlation lines above the body, one fact per line; absent when
+     * the title says it all.
+     */
     readonly meta?: string;
 }
 /**

package/lib/types/client/styles.d.ts

@@ -2,12 +2,25 @@
 export declare const QA_BRAND_TOKEN_NAMES: readonly string[];
 export declare const QA_SURFACE_STYLES: string;
 /**
- * Everything the QA overlay paints, as one sheet for one `<style>` tag.
+ * Everything the QA surface paints, as one sheet for one `<style>` tag — the
+ * kiosk form, with no host-hiding rules: in the kiosk composition the native
+ * shell never mounts, so the sheet carries nothing aimed at it.
  *
  * The shared audit components keep their own stylesheet in
- * `@yadsh/dsh-audit-ui`; it is folded in here so the overlay is self-contained
+ * `@yadsh/dsh-audit-ui`; it is folded in here so the surface is self-contained
  * — the audit dialog must look right whether or not the audit plugin's own
  * client bundle happens to have injected the same rules into the document.
+ *
+ * The math styles and their fonts come from the bundled KaTeX copy the same
+ * way: the data-URI fonts resolve whatever the Host page loads, and identical
+ * rules from its own KaTeX stylesheet are harmless.
+ */
+export declare const QA_ROOT_STYLES: string;
+/**
+ * The overlay-composition sheet: the same rules as {@link QA_ROOT_STYLES}
+ * plus the host-column mask. Deployed into hosts without the kiosk patches,
+ * where the surface still covers a mounted native shell and the mask is what
+ * a deleted overlay element uncovers — a blank page instead of the shell.
  */
 export declare const QA_OVERLAY_STYLES: string;
 //# sourceMappingURL=styles.d.ts.map

package/lib/types/client/types.d.ts

@@ -1,7 +1,7 @@
 import type { ClientRemote } from "@deepseek-ai/dsh-api-gateway/client";
 import type { ISessions, SessionFace } from "@deepseek-ai/dsh-api-session-controller/client";
 import type { UiConversation } from "@deepseek-ai/dsh-client-ui-conversation/client";
-import type { QaAccountProfileInput, QaAccountSession, QaAccountStartersInput, QaAccountStarter, QaAccountUserPublic, QaAccessAdminSnapshot, QaApprovalDecision, QaClaimResult, QaLockdownProof, QaOwnershipEntry, QaPendingApproval, QaPendingQuestion, QaQuestionAnswerItem, QaSessionState, QaSkillDocument, QaSkillDraftInput, QaSkillRemoval, QaSkillSummary, QaSkillToolDescriptor, QaSkillValidation, QaSourceFilePreview, QaTurnSources, QaWhoamiResult, QaCapabilitySelection, QaCurrentAccess, QaSessionAccess, QaSkillActivationRecord, QaSkillAssignmentOverride, QaSubrole, QaUserAccess, QaAdminAuditEvent, QaAdminOverview, QaAdminPage, QaAdminUserDetail, QaAdminUserRow, QaAdminUserUpdate, QaAuditQuery, QaConversationDetail, QaConversationDeletion, QaConversationQuery, QaConversationReview, QaConversationReviewInput, QaConversationSummary, QaFeedbackQuery, QaFeedbackRow, QaMessageFeedback, QaMessageFeedbackInput, QaQualityMetrics, QaReviewQueueItem, QaReviewQueueRow, QaSlashCatalog, QaSlashExecution, QaSlashSubmitAttachment, QaUserQuery } from "../types.js";
+import type { QaAccountProfileInput, QaAccountSession, QaAccountStartersInput, QaAccountStarter, QaAccountUserPublic, QaAccessAdminSnapshot, QaApprovalDecision, QaClaimResult, QaLockdownProof, QaOwnershipEntry, QaPendingApproval, QaPendingQuestion, QaQuestionAnswerItem, QaSessionState, QaSkillDocument, QaSkillDraftInput, QaSkillRemoval, QaSkillSummary, QaSkillToolDescriptor, QaSkillValidation, QaSourceFilePreview, QaTurnSources, QaWhoamiResult, QaDocumentPreview, QaWorkspaceFile, QaWorkspaceListing, QaCapabilitySelection, QaCurrentAccess, QaSessionAccess, QaSkillActivationRecord, QaSkillAssignmentOverride, QaSubrole, QaUserAccess, QaAdminAuditEvent, QaAdminOverview, QaAdminPage, QaAdminUserDetail, QaAdminUserRow, QaAdminUserUpdate, QaAuditQuery, QaConversationDetail, QaConversationDeletion, QaConversationQuery, QaConversationReview, QaConversationReviewInput, QaConversationSummary, QaFeedbackQuery, QaFeedbackRow, QaMessageFeedback, QaMessageFeedbackInput, QaQualityMetrics, QaReviewQueueItem, QaReviewQueueRow, QaSlashCatalog, QaSlashExecution, QaSlashSubmitAttachment, QaUserQuery } from "../types.js";
 /** Wire content one prompt carries: text plus base64 image uploads. */
 export type QaPromptContent = Parameters<SessionFace["prompt"]>[0];
 /** DSH session runtime surface the QA controller is allowed to touch. */
@@ -111,6 +111,34 @@ export interface QaSourceApi {
         readonly ok: false;
         readonly error: unknown;
     }>;
+    /** One directory of the chat's own workspace, for the files panel. */
+    listWorkspaceFiles(token: string, sessionId: string, path: string): Promise<{
+        readonly ok: true;
+        readonly value: QaWorkspaceListing;
+    } | {
+        readonly ok: false;
+        readonly error: unknown;
+    }>;
+    /** One file of that workspace: decoded text, or bytes when it is binary. */
+    readWorkspaceFile(token: string, sessionId: string, path: string): Promise<{
+        readonly ok: true;
+        readonly value: QaWorkspaceFile;
+    } | {
+        readonly ok: false;
+        readonly error: unknown;
+    }>;
+    /**
+     * A Word document of that workspace rendered as PDF by the deployment's
+     * document pipeline; the panel shows the PDF the browser already knows how
+     * to draw instead of uploading the bytes anywhere.
+     */
+    previewWorkspaceDocument(token: string, sessionId: string, path: string): Promise<{
+        readonly ok: true;
+        readonly value: QaDocumentPreview;
+    } | {
+        readonly ok: false;
+        readonly error: unknown;
+    }>;
 }
 /**
  * The slash half of the Host namespace. The catalog comes back already cut
@@ -138,6 +166,27 @@ export type QaBoundSourceApi = {
         readonly ok: false;
         readonly error: unknown;
     }>;
+    listWorkspaceFiles(sessionId: string, path: string): Promise<{
+        readonly ok: true;
+        readonly value: QaWorkspaceListing;
+    } | {
+        readonly ok: false;
+        readonly error: unknown;
+    }>;
+    readWorkspaceFile(sessionId: string, path: string): Promise<{
+        readonly ok: true;
+        readonly value: QaWorkspaceFile;
+    } | {
+        readonly ok: false;
+        readonly error: unknown;
+    }>;
+    previewWorkspaceDocument(sessionId: string, path: string): Promise<{
+        readonly ok: true;
+        readonly value: QaDocumentPreview;
+    } | {
+        readonly ok: false;
+        readonly error: unknown;
+    }>;
 };
 /**
  * Approval remotes of this plugin's namespace. Read-only listing plus the one

package/lib/types/config-resolvers/notes.d.ts

@@ -0,0 +1,10 @@
+import type { QaNotesConfig, ResolvedQaSurfaceConfig } from "../types.js";
+type ResolvedNotes = ResolvedQaSurfaceConfig["notes"];
+/**
+ * The ambient model notes. Notes are advisory text, not capability: the
+ * default is the current behavior (every note on, built-in wording), and an
+ * empty template always resolves to the built-in text.
+ */
+export declare function resolveNotes(input: QaNotesConfig | undefined): ResolvedNotes;
+export {};
+//# sourceMappingURL=notes.d.ts.map

package/lib/types/index.d.ts

@@ -1,7 +1,7 @@
 import { TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
 import type { Context } from "@deepseek-ai/cordis";
 import type { QaTurnSources } from "./provenance/types.js";
-import type { QaAccountProfileInput, QaAccountSession, QaAccountStartersInput, QaAccountUserPublic, QaApprovalDecision, QaClaimResult, QaLockdownProof, QaOwnershipEntry, QaPendingApproval, QaPendingQuestion, QaQuestionAnswerItem, QaSurfaceConfig, ResolvedQaSurfaceConfig, QaSkillDocument, QaSkillDraftInput, QaSkillRemoval, QaSkillSummary, QaSkillToolDescriptor, QaSkillValidation, QaSourceFilePreview, QaWhoamiResult, QaPrincipal, QaAccessAdminSnapshot, QaAdminAuditEvent, QaAdminOverview, QaAdminPage, QaAdminUserDetail, QaAdminUserRow, QaAdminUserUpdate, QaAuditQuery, QaCapabilitySelection, QaConversationDetail, QaConversationDeletion, QaConversationQuery, QaConversationReview, QaConversationReviewInput, QaConversationSummary, QaCurrentAccess, QaFeedbackQuery, QaFeedbackRow, QaMessageFeedback, QaMessageFeedbackInput, QaQualityMetrics, QaReviewQueueItem, QaReviewQueueRow, QaSessionAccess, QaSlashCatalog, QaSlashExecution, QaSlashSubmitAttachment, QaSkillActivationRecord, QaSkillAssignmentOverride, QaSubrole, QaUserAccess, QaUserQuery } from "./types.js";
+import type { QaAccountProfileInput, QaAccountSession, QaAccountStartersInput, QaAccountUserPublic, QaApprovalDecision, QaClaimResult, QaDocumentPreview, QaLockdownProof, QaOwnershipEntry, QaPendingApproval, QaPendingQuestion, QaQuestionAnswerItem, QaSurfaceConfig, ResolvedQaSurfaceConfig, QaSkillDocument, QaSkillDraftInput, QaSkillRemoval, QaSkillSummary, QaSkillToolDescriptor, QaSkillValidation, QaSourceFilePreview, QaWhoamiResult, QaWorkspaceFile, QaWorkspaceListing, QaPrincipal, QaAccessAdminSnapshot, QaAdminAuditEvent, QaAdminOverview, QaAdminPage, QaAdminUserDetail, QaAdminUserRow, QaAdminUserUpdate, QaAuditQuery, QaCapabilitySelection, QaConversationDetail, QaConversationDeletion, QaConversationQuery, QaConversationReview, QaConversationReviewInput, QaConversationSummary, QaCurrentAccess, QaFeedbackQuery, QaFeedbackRow, QaMessageFeedback, QaMessageFeedbackInput, QaQualityMetrics, QaReviewQueueItem, QaReviewQueueRow, QaSessionAccess, QaSlashCatalog, QaSlashExecution, QaSlashSubmitAttachment, QaSkillActivationRecord, QaSkillAssignmentOverride, QaSubrole, QaUserAccess, QaUserQuery } from "./types.js";
 export declare const name = "qa-surface";
 export declare const inject: string[];
 import { QA_SURFACE_SETTINGS_NAMESPACE } from "./shared/settings.js";
@@ -20,6 +20,7 @@ export declare class QaSurface extends TypertRemoteService {
     private readonly logger;
     private readonly admission;
     private readonly approvals;
+    private readonly fileDeleteGate;
     private readonly userQuestions;
     private readonly provenance;
     private readonly notes;
@@ -235,6 +236,43 @@ export declare class QaSurface extends TypertRemoteService {
      * the per-account scratch directory — could never be opened in the panel.
      */
     readSourceFile(token: string, sessionId: string, sourcePath: string): Promise<QaSourceFilePreview>;
+    /**
+     * List one directory of the chat's own workspace for the files panel.
+     *
+     * Browsing is deliberately narrower than the source preview: it stays inside
+     * the chat's own directory tree, so a visitor can look at what their
+     * conversation produced and at nothing else of the deployment.
+     * `readWorkspaceFile` opens one entry of such a listing.
+     */
+    listWorkspaceFiles(token: string, sessionId: string, path: string): Promise<QaWorkspaceListing>;
+    /**
+     * Read one file of the chat's workspace: text when it decodes as UTF-8, bytes
+     * when it does not, so a document the agent produced can be downloaded while
+     * a note previews inline. The readable roots are the ones the model itself
+     * may read; unlike the source preview this does not require the file to be
+     * recorded evidence, because the panel is browsing a tree rather than
+     * reopening a cited source.
+     */
+    readWorkspaceFile(token: string, sessionId: string, path: string): Promise<QaWorkspaceFile>;
+    /**
+     * Render one Word document of the chat's workspace as a PDF for the panel.
+     *
+     * The conversion is the document pipeline's own, reached through the service
+     * `@yadsh/dsh-documents` publishes for its Host siblings — the panel gets the
+     * same providers, limits and refusals the `document_*` tools see, and a
+     * deployment without that plugin refuses instead of showing a guess. The
+     * produced PDF is read back here and travels as base64, so the audience never
+     * reaches an unfenced byte route.
+     */
+    previewWorkspaceDocument(token: string, sessionId: string, path: string): Promise<QaDocumentPreview>;
+    /**
+     * Shared admission facts of both browse methods: the preview switch is what
+     * opens the panel's file reading at all, and the chat's cwd is the tree that
+     * browsing is confined to.
+     */
+    private browseContext;
+    /** One browse refusal, logged with its coarse reason and rethrown for the wire. */
+    private browseRefusal;
     /** Every personal skill of the token's account, sorted by name. */
     skillsList(token: string): {
         readonly skills: readonly QaSkillSummary[];

package/lib/types/prompt-notes.d.ts

@@ -14,6 +14,15 @@ export declare const QA_IDENTITY_NOTE = "dsh-qa-surface:user-identity";
 export declare const QA_SOURCES_NOTE = "dsh-qa-surface:structured-sources";
 /** Note name asking the model to name its delegations. */
 export declare const QA_DELEGATION_NOTE = "dsh-qa-surface:delegation-naming";
+/**
+ * Built-in note texts. Each is the fallback for its settings template
+ * (`notes.*.template`); the placeholders mark the parts the injector
+ * substitutes. Unknown or empty placeholders render as empty text.
+ */
+export declare const QA_IDENTITY_NOTE_TEMPLATE = "{identity}\n\n{instructions}";
+export declare const QA_SOURCES_NOTE_TEMPLATE = "Source provenance is collected automatically from your tool calls; the QA surface lists what it collected beside the answer. Do not append a manual Sources/\u0418\u0441\u0442\u043E\u0447\u043D\u0438\u043A\u0438 bibliography of your own.";
+export declare const QA_SOURCES_FALLBACK_TEMPLATE = "A delegated run whose provider cannot expose tool events must call {reportTool} before finishing.";
+export declare const QA_DELEGATION_NOTE_TEMPLATE = "When you start a background subagent, give the delegation a short vivid name in its description field: two or three words in the user's language that say what the run is for (\u00AB\u0421\u0432\u0435\u0440\u043A\u0430 \u043E\u0442\u0447\u0451\u0442\u043E\u0432\u00BB, \"Log triage\"). The QA surface shows that description as the subagent's display name in the operator's panel and completion notices.";
 export interface QaIdentityRenderInput {
     /** The owner's account address; the one fact accounts always provide. */
     readonly email: string;