// Devseis Security Assistant: chat about endpoint security with the Devseis model running on the device (WebLLM),
// grounded in the Devseis knowledge base (library/knowledge.json), plus audits: the phone check on phones, the desktop
// app (or its report file) on computers. Conversations are stored only in this browser.
import { Knowledge, chatMessages, auditBrief, chatProblems, searchWithAudit } from '../app/renderer/knowledge.js';
import { Library, findingPrompt, findingTemplate, summaryPrompt, summaryTemplate, aiPrompt, aiTemplate, writeAnswer, ANSWER_SCHEMAS } from '../app/renderer/auditor-core.js';
import { buildReportHtml } from '../app/renderer/report.js';
import { detectDevice } from '../mobile/detect.js';
const WEBLLM_URL = 'https://esm.run/@mlc-ai/web-llm@0.2.85';
const STORE = 'devseis.chats.v1';
const $ = id => document.getElementById(id);
const esc = s => String(s ?? '').replace(/[&<>"']/g, c => ({ '&': '&', '<': '<', '>': '>', '"': '"', "'": ''' }[c]));
const state = { kb: null, device: null, config: null, engine: null, enginePromise: null, modelLabel: '', busy: false, chats: [], current: null, libData: null };
// ---------- storage ----------
function loadChats() { try { return JSON.parse(localStorage.getItem(STORE)) || []; } catch { return []; } }
function saveChats() { try { localStorage.setItem(STORE, JSON.stringify(state.chats.slice(0, 50))); } catch { /* private mode or full */ } }
function newChat() {
const chat = { id: Date.now().toString(36), title: 'New conversation', messages: [], audit: null };
state.chats.unshift(chat); state.current = chat; saveChats(); render(); return chat;
}
// ---------- model ----------
// The model never blocks a question: until it is ready, answers come straight from the knowledge base.
// It downloads in the background after the user agrees once (about 1 GB), and starts by itself when already stored.
const AI_CONSENT = 'devseis.aiConsent';
let webllmPromise = null;
const loadWebllm = () => (webllmPromise ||= import(WEBLLM_URL));
async function modelChoice() {
if (!('gpu' in navigator)) throw new Error('This browser has no WebGPU');
const adapter = await navigator.gpu.requestAdapter();
if (!adapter) throw new Error('No WebGPU graphics adapter');
const quant = adapter.features.has('shader-f16') ? 'q4f16_1' : 'q4f32_1';
const webllm = await loadWebllm();
const base = webllm.prebuiltAppConfig.model_list.find(m => m.model_id === `Qwen2.5-1.5B-Instruct-${quant}-MLC`);
const v = state.config?.chat?.version;
const custom = v ? { ...base, model: `https://huggingface.co/Devseis/endpoint-auditor-1.5b-${quant}-MLC/resolve/${v}/`, model_id: `devseis-assistant-1.5b-${v}-${quant}` } : null;
const appConfig = { ...webllm.prebuiltAppConfig, model_list: custom ? [...webllm.prebuiltAppConfig.model_list, custom] : webllm.prebuiltAppConfig.model_list };
return { webllm, base, custom, appConfig, v };
}
// Is the model already stored on this device (no download needed)?
async function modelCached() {
try {
const { webllm, base, custom, appConfig } = await modelChoice();
return await webllm.hasModelInCache((custom || base).model_id, appConfig);
} catch { return false; }
}
function getEngine() {
if (state.engine !== null || state.enginePromise) return state.enginePromise || Promise.resolve(state.engine);
state.loading = true; state.progress = 0; aiChip(); render();
state.enginePromise = (async () => {
const { webllm, base, custom, appConfig, v } = await modelChoice();
const initProgressCallback = r => {
state.progress = r.progress || 0;
const mb = /([\d.]+)MB fetched/.exec(r.text || '');
status(state.cachedStart ? `Starting the AI assistant… ${Math.round(state.progress * 100)}%`
: `Downloading the AI assistant (one time, about 1 GB): ${Math.round(state.progress * 100)}%${mb ? ` · ${Math.round(+mb[1])} MB` : ''} · you can keep chatting meanwhile`, state.progress);
aiChip();
};
let engine, label;
if (custom) {
try { engine = await webllm.CreateMLCEngine(custom.model_id, { appConfig, initProgressCallback }); label = `Devseis assistant ${v} (1.5B)`; } catch (e) { console.warn('Devseis model failed, using base', e); }
}
if (!engine) { engine = await webllm.CreateMLCEngine(base.model_id, { appConfig, initProgressCallback }); label = 'Qwen2.5 1.5B (base, until the Devseis model loads)'; }
state.modelLabel = label; $('modelName').textContent = label; status('');
return engine;
})().then(e => { state.engine = e; state.loading = false; aiChip(); render(); return e; },
err => { state.engine = false; state.loading = false; state.modelLabel = `Not available: ${err.message}`; $('modelName').textContent = 'Knowledge base only'; status(''); aiChip(); render(); return false; });
return state.enginePromise;
}
function enableAi() {
try { localStorage.setItem(AI_CONSENT, 'yes'); } catch { /* ignore */ }
state.consent = true;
getEngine();
}
// Small status chip in the header: what the assistant is running on right now.
function aiChip() {
const chip = $('aiChip');
if (!chip) return;
if (state.engine) { chip.textContent = '✨ AI ready'; chip.title = state.modelLabel; chip.dataset.state = 'ready'; }
else if (state.loading) { chip.textContent = `⬇ AI ${Math.round((state.progress || 0) * 100)}%`; chip.title = 'The AI assistant is getting ready'; chip.dataset.state = 'loading'; }
else if (state.engine === false) { chip.textContent = '📚 Knowledge base'; chip.title = state.modelLabel; chip.dataset.state = 'off'; }
else { chip.textContent = '⚡ Enable AI'; chip.title = 'Download the AI assistant (about 1 GB, one time)'; chip.dataset.state = 'off'; }
}
// Instant answer straight from the knowledge base, formatted for reading.
function quickAnswer(passages) {
if (!passages.length) return 'The Devseis knowledge base has nothing on that question. I cover device security, ISO 27001, GDPR and the EU AI Act.';
const top = passages[0];
const body = top.text.startsWith(top.title) ? top.text.slice(top.title.length).replace(/^[.:]\s*/, '') : top.text;
const text = body.replace(/\s\((\d+)\)\s/g, '\n$1. ')
.replace(/(^|\s)(How to fix on [A-Za-z]+|How to verify|Related controls|Why it matters|Risk if missing|Requirement|An auditor looks for|On endpoints|Where to look):/g, '\n\n**$2:**')
.replace(/^\s+/, '');
return `**${top.title}** [1]\n\n${text}`;
}
function status(text, fraction) {
$('statusBar').classList.toggle('hidden', !text);
$('statusText').textContent = text;
$('statusFill').style.width = `${Math.round((fraction || 0) * 100)}%`;
}
// ---------- rendering ----------
function markdown(text, passages, msgIndex) {
const lines = esc(text).split('\n');
let html = '', list = null;
const close = () => { if (list) { html += ``; list = null; } };
for (const line of lines) {
const ol = /^\s*\d+\.\s+(.*)$/.exec(line), ul = /^\s*[-•]\s+(.*)$/.exec(line);
if (ol || ul) {
const tag = ol ? 'ol' : 'ul';
if (list !== tag) { close(); html += `<${tag}>`; list = tag; }
html += `${(ol || ul)[1]} `;
} else { close(); if (line.trim()) html += `${line}
`; }
}
close();
return html.replace(/\*\*(.+?)\*\*/g, '$1 ').replace(/`([^`]+)`/g, '$1')
.replace(/\[(\d+)\]/g, (m, n) => passages && passages[n - 1] ? `${n} ` : '');
}
function auditCard(audit) {
const s = audit.summary, assessed = s.Compliant + s['Non-Compliant'];
const pct = assessed ? Math.round(100 * s.Compliant / assessed) : 0;
const colours = { Compliant: 'var(--ok)', 'Non-Compliant': 'var(--accent)', Pending: 'var(--warn)', NotApplicable: 'var(--muted)', Error: '#8250df' };
const gaps = audit.results.filter(r => r.status === 'Non-Compliant').slice(0, 5);
return `AUDIT REPORT · ${esc(audit.host.os_name)} ${esc(audit.host.os_version)} · ${esc(String(audit.audit.started_at).slice(0, 10))}
${pct}%
${s.Compliant} of ${assessed} assessed checks compliant
${Object.entries(s).filter(([, v]) => v).map(([k, v]) => `${v} ${k} `).join('')}
${gaps.length ? `
Top gaps: ${gaps.map(g => esc(g.name)).join(', ')}
` : ''}
What should I fix first?
📄 Write my full report
${auditCard(chat.audit)}
[${n + 1}] ${esc(p.title)} `).join('');
thread.insertAdjacentHTML('beforeend', `
${m.pending ? '
' : markdown(m.content, m.passages, i)}
${!m.pending && sources && !m.noSources ? `
Sources: ${sources}
` : ''}
${m.note ? `
${esc(m.note)}
` : ''}
${m.quick && !m.pending && !m.writing ? (state.engine ? `
✨ Rewrite with AI
`
: (!state.loading && state.engine !== false ? `
⚡ Enable the AI assistant (about 1 GB, one time)
` : '')) : ''}
${esc(c.title)} ✕
`).join('')
|| 'No conversations yet.
';
}
function showSource(msgIndex, n, anchor) {
const m = state.current.messages[msgIndex];
const p = m && m.passages && m.passages[n - 1];
if (!p) return;
const slot = document.querySelector(`#m${msgIndex} .source-slot`);
slot.innerHTML = `[${n}] ${esc(p.title)}
`;
document.querySelectorAll(`#m${msgIndex} .source`).forEach(b => b.classList.toggle('open', b.dataset.n === String(n)));
if (anchor) slot.scrollIntoView({ block: 'nearest' });
}
// ---------- asking ----------
async function ask(question) {
if (state.busy || !question.trim()) return;
const chat = state.current || newChat();
if (chat.title === 'New conversation') chat.title = question.slice(0, 60);
const history = chat.messages.filter(m => !m.pending).slice(-4).map(m => ({ role: m.role, content: m.content }));
chat.messages.push({ role: 'user', content: question });
const reply = { role: 'assistant', content: '', pending: true, passages: [] };
chat.messages.push(reply);
state.busy = true; updateSend(); render();
try {
const os = chat.audit ? chat.audit.host.os_family : (state.device && (state.device.os_family || (state.device.desktop ? desktopOs() : null)));
const passages = searchWithAudit(state.kb, question, chat.audit, { k: 4, os });
reply.passages = passages;
const messages = chatMessages(question, passages, auditBrief(chat.audit), history);
reply.question = question; reply.history = history;
if (state.engine) {
// Show the knowledge-base answer at once; the AI's answer replaces it when its first words arrive.
reply.pending = false; reply.content = quickAnswer(passages); reply.cited = true; reply.quick = true; reply.writing = true;
reply.note = '✨ The AI is writing a fuller answer…';
render();
await aiAnswer(chat, reply, messages, passages);
} else {
reply.content = quickAnswer(passages);
reply.cited = true; reply.quick = true;
reply.note = state.loading ? `Quick answer from the knowledge base. The AI assistant is getting ready (${Math.round((state.progress || 0) * 100)}%); you can ask it to rewrite this when it is ready.`
: state.engine === false ? 'Quick answer from the knowledge base (the AI is not available in this browser).'
: 'Quick answer from the knowledge base. Enable the AI assistant for written answers.';
}
} catch (error) {
reply.content = `Something went wrong: ${error.message}`;
}
reply.pending = false; state.busy = false; saveChats(); updateSend(); render();
}
// Write (or rewrite) an answer with the model; the GPU can be lost (memory pressure, sleep): restart once, else keep the quick answer.
async function aiAnswer(chat, reply, messages, passages) {
const index = chat.messages.indexOf(reply);
let engine = state.engine;
for (let attempt = 0; attempt < 2 && engine; attempt++) {
try {
reply.pending = false;
const stream = await engine.chat.completions.create({ messages, temperature: 0, max_tokens: 700, stream: true });
let last = 0, started = false;
for await (const chunk of stream) {
const delta = chunk.choices[0]?.delta?.content || '';
if (!started && delta) { started = true; reply.content = ''; reply.quick = false; reply.writing = false; reply.note = ''; }
reply.content += delta;
if (Date.now() - last > 120) { last = Date.now(); const el = $(`m${index}`); if (el) el.innerHTML = markdown(clean(reply.content), passages, index); }
}
if (!started) throw new Error('The AI returned no answer');
reply.content = clean(reply.content);
reply.noSources = !/\[\d+\]/.test(reply.content) && /can only help|don't have|do not have|not able to|can't answer|cannot answer|sorry/i.test(reply.content);
reply.cited = /\[\d+\]/.test(reply.content);
if (chatProblems(messages[messages.length - 1].content, reply.content).length) reply.note = 'Some details in this answer could not be matched to the sources. Check them in the sources below before acting.';
return;
} catch (error) {
if (!/lost|Instance reference|GPUDevice|disposed/i.test(error.message)) { console.warn('AI answer failed', error); break; } // keep the quick answer
status('The graphics processor was reset; restarting the AI…', 0.5);
state.engine = null; state.enginePromise = null;
engine = attempt === 0 ? await getEngine() : null;
}
}
reply.content = quickAnswer(passages); reply.cited = true; reply.quick = true; reply.writing = false;
reply.note = 'Quick answer from the knowledge base (the AI could not run just now).';
}
async function rewriteWithAi(index) {
const chat = state.current; const reply = chat && chat.messages[index];
if (!reply || !state.engine || state.busy) return;
state.busy = true; updateSend();
const messages = chatMessages(reply.question, reply.passages, auditBrief(chat.audit), reply.history || []);
try { await aiAnswer(chat, reply, messages, reply.passages); } catch (error) { reply.note = `The AI could not answer: ${error.message}`; }
state.busy = false; saveChats(); updateSend(); render();
}
// Models sometimes emit HTML entities; show plain characters.
function clean(text) { return text.replace(/&/g, '&').replace(/</g, '<').replace(/>/g, '>').replace(/"/g, '"').replace(/'/g, "'"); }
function desktopOs() { const ua = navigator.userAgent; return /Windows/.test(ua) ? 'windows' : /Mac/.test(ua) ? 'macos' : 'linux'; }
// ---------- audits ----------
function openAuditModal() {
const d = state.device || {};
const phone = d.os_family === 'ios' || d.os_family === 'android';
const os = phone ? null : desktopOs();
const osName = { macos: 'Mac', windows: 'Windows', linux: 'Linux' }[os];
$('auditOptions').innerHTML = phone
? `The check runs in this browser: the phone answers what it can, you answer the rest. About 5 minutes.
📱 Start the phone check Your answers and report stay on this phone. A web page can't read a computer's settings, so computers are audited with the free Devseis app. It only reads, changes nothing, and takes about 15 minutes.
💻 Get the desktop app for ${osName}${os === 'windows' ? ' (beta)' : ''} Step-by-step install guide. 📎 I already ran an audit Add the report file (…-evidence.json, saved next to the PDF) and I'll answer from your results. 📱 Check a phone instead Open the phone check on the phone itself. 
${auditCard(chat.audit)}