@f5-sales-demo/xcsh 19.101.3 → 19.102.0

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@f5-sales-demo/xcsh",
-	"version": "19.101.3",
+	"version": "19.102.0",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://github.com/f5-sales-demo/xcsh",
 	"author": "Can Boluk",
@@ -57,13 +57,13 @@
 	"dependencies": {
 		"@agentclientprotocol/sdk": "1.3.0",
 		"@mozilla/readability": "^0.6",
-		"@f5-sales-demo/xcsh-stats": "19.101.3",
-		"@f5-sales-demo/pi-agent-core": "19.101.3",
-		"@f5-sales-demo/pi-ai": "19.101.3",
-		"@f5-sales-demo/pi-natives": "19.101.3",
-		"@f5-sales-demo/pi-resource-management": "19.101.3",
-		"@f5-sales-demo/pi-tui": "19.101.3",
-		"@f5-sales-demo/pi-utils": "19.101.3",
+		"@f5-sales-demo/xcsh-stats": "19.102.0",
+		"@f5-sales-demo/pi-agent-core": "19.102.0",
+		"@f5-sales-demo/pi-ai": "19.102.0",
+		"@f5-sales-demo/pi-natives": "19.102.0",
+		"@f5-sales-demo/pi-resource-management": "19.102.0",
+		"@f5-sales-demo/pi-tui": "19.102.0",
+		"@f5-sales-demo/pi-utils": "19.102.0",
 		"@sinclair/typebox": "^0.34",
 		"@xterm/headless": "^6.0",
 		"ajv": "^8.20",

package/src/internal-urls/build-info.generated.ts

@@ -17,17 +17,17 @@ export interface BuildInfo {
 }
 
 export const BUILD_INFO: BuildInfo = {
-	"version": "19.101.3",
-	"commit": "1ca54a4fefb591d253e4f83fa1a0527ac90303fd",
-	"shortCommit": "1ca54a4",
+	"version": "19.102.0",
+	"commit": "04881cb7c4206c3d7f88c1dbcc47f98dd7872cbf",
+	"shortCommit": "04881cb",
 	"branch": "main",
-	"tag": "v19.101.3",
-	"commitDate": "2026-07-30T04:24:11Z",
-	"buildDate": "2026-07-30T04:53:56.080Z",
+	"tag": "v19.102.0",
+	"commitDate": "2026-07-30T05:42:53Z",
+	"buildDate": "2026-07-30T06:12:50.423Z",
 	"dirty": true,
 	"prNumber": "",
 	"repoUrl": "https://github.com/f5-sales-demo/xcsh",
 	"repoSlug": "f5-sales-demo/xcsh",
-	"commitUrl": "https://github.com/f5-sales-demo/xcsh/commit/1ca54a4fefb591d253e4f83fa1a0527ac90303fd",
-	"releaseUrl": "https://github.com/f5-sales-demo/xcsh/releases/tag/v19.101.3"
+	"commitUrl": "https://github.com/f5-sales-demo/xcsh/commit/04881cb7c4206c3d7f88c1dbcc47f98dd7872cbf",
+	"releaseUrl": "https://github.com/f5-sales-demo/xcsh/releases/tag/v19.102.0"
 };

package/src/prompts/system/system-prompt.md

@@ -196,6 +196,8 @@ Configs you didn't validate become incidents. Assumptions you didn't test fail u
 {{#list environment prefix="- " join="\n"}}{{label}}: {{value}}{{/list}}
 </workstation>
 
+%%WORKSPACE_BOUNDARY%%
+
 {{#if context}}
 ## F5 XC Platform Context
 

package/src/prompts/system/workspace-boundary.md

@@ -0,0 +1,15 @@
+<workspace-boundary>
+This session may be scoped to a single customer. Treat the working directory as the scope of the
+work: what the task needs is inside it, and another customer's material is not yours to open here.
+- You **MUST NOT** range across the filesystem hunting for files, examples, or precedent. Search
+  within the working directory. Your own skills and plugins, and paths the operator granted
+  explicitly (`--allow-path`, `sandbox.allowRead`), are legitimate — and are not licence to browse
+  anywhere else.
+- Subdirectories may themselves be separate customers. Reachable does not mean in scope: work in
+  the one the task names, state the crossing when the task genuinely spans more than one, and
+  **MUST NOT** merge two customers' material into one artifact.
+- A sandbox confines this session's file access, but its boundary is the working directory, not the
+  customer subdirectory: nothing refuses a sibling, so the rule above is yours to keep. When the
+  sandbox is active a path outside the working directory is refused — that is the boundary working,
+  not a tool failure. Say what you needed and why, and **MUST NOT** reach the same path another way.
+</workspace-boundary>

package/src/system-prompt.ts

@@ -26,9 +26,11 @@ import { listXcshPluginSummaries, type XcshPluginSummary } from "./discovery/hel
 import { isApplicableToContext, loadSkills, type Skill } from "./extensibility/skills";
 import customSystemPromptTemplate from "./prompts/system/custom-system-prompt.md" with { type: "text" };
 import systemPromptTemplate from "./prompts/system/system-prompt.md" with { type: "text" };
+import workspaceBoundaryTemplate from "./prompts/system/workspace-boundary.md" with { type: "text" };
 
 /** Sentinel in system-prompt.md replaced with the rendered deprecation guardrails. */
 const DEPRECATION_GUARDRAILS_MARKER = "%%DEPRECATION_GUARDRAILS%%";
+const WORKSPACE_BOUNDARY_MARKER = "%%WORKSPACE_BOUNDARY%%";
 
 let _buildMeta: { version: string; repoSlug: string } | null = null;
 
@@ -816,6 +818,14 @@ export async function buildSystemPrompt(options: BuildSystemPromptOptions = {}):
 	};
 	let rendered = prompt.render(resolvedCustomPrompt ? customSystemPromptTemplate : systemPromptTemplate, data);
 
+	// The workspace boundary is always-on for the same reason: a custom system prompt
+	// swaps in a template with no Workspace section, and the confidentiality guidance
+	// must not be what disappears when an operator customises their prompt.
+	const workspaceBoundary = workspaceBoundaryTemplate.trimEnd();
+	rendered = rendered.includes(WORKSPACE_BOUNDARY_MARKER)
+		? rendered.replace(WORKSPACE_BOUNDARY_MARKER, workspaceBoundary)
+		: `${rendered}\n\n${workspaceBoundary}`;
+
 	// Deprecation guardrails are always-on: replace the section marker in the default
 	// template, or append when the active template has none (e.g. a fully custom system
 	// prompt), so the rules apply on every code path — not only when xcsh:// is consulted.