@f5-sales-demo/xcsh 19.102.4 → 19.102.6

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@f5-sales-demo/xcsh",
-	"version": "19.102.4",
+	"version": "19.102.6",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://github.com/f5-sales-demo/xcsh",
 	"author": "Can Boluk",
@@ -57,13 +57,13 @@
 	"dependencies": {
 		"@agentclientprotocol/sdk": "1.3.0",
 		"@mozilla/readability": "^0.6",
-		"@f5-sales-demo/xcsh-stats": "19.102.4",
-		"@f5-sales-demo/pi-agent-core": "19.102.4",
-		"@f5-sales-demo/pi-ai": "19.102.4",
-		"@f5-sales-demo/pi-natives": "19.102.4",
-		"@f5-sales-demo/pi-resource-management": "19.102.4",
-		"@f5-sales-demo/pi-tui": "19.102.4",
-		"@f5-sales-demo/pi-utils": "19.102.4",
+		"@f5-sales-demo/xcsh-stats": "19.102.6",
+		"@f5-sales-demo/pi-agent-core": "19.102.6",
+		"@f5-sales-demo/pi-ai": "19.102.6",
+		"@f5-sales-demo/pi-natives": "19.102.6",
+		"@f5-sales-demo/pi-resource-management": "19.102.6",
+		"@f5-sales-demo/pi-tui": "19.102.6",
+		"@f5-sales-demo/pi-utils": "19.102.6",
 		"@sinclair/typebox": "^0.34",
 		"@xterm/headless": "^6.0",
 		"ajv": "^8.20",

package/src/internal-urls/build-info.generated.ts

@@ -17,17 +17,17 @@ export interface BuildInfo {
 }
 
 export const BUILD_INFO: BuildInfo = {
-	"version": "19.102.4",
-	"commit": "5beee843e5cd185c015cf2ca04edf5dde54eadb8",
-	"shortCommit": "5beee84",
+	"version": "19.102.6",
+	"commit": "983ca4f8d682745db27c890d634cb459fc7e3e32",
+	"shortCommit": "983ca4f",
 	"branch": "main",
-	"tag": "v19.102.4",
-	"commitDate": "2026-07-30T20:21:22Z",
-	"buildDate": "2026-07-30T20:45:02.127Z",
+	"tag": "v19.102.6",
+	"commitDate": "2026-07-31T01:44:23Z",
+	"buildDate": "2026-07-31T02:07:47.614Z",
 	"dirty": true,
 	"prNumber": "",
 	"repoUrl": "https://github.com/f5-sales-demo/xcsh",
 	"repoSlug": "f5-sales-demo/xcsh",
-	"commitUrl": "https://github.com/f5-sales-demo/xcsh/commit/5beee843e5cd185c015cf2ca04edf5dde54eadb8",
-	"releaseUrl": "https://github.com/f5-sales-demo/xcsh/releases/tag/v19.102.4"
+	"commitUrl": "https://github.com/f5-sales-demo/xcsh/commit/983ca4f8d682745db27c890d634cb459fc7e3e32",
+	"releaseUrl": "https://github.com/f5-sales-demo/xcsh/releases/tag/v19.102.6"
 };

package/src/prompts/system/workspace-boundary.md

@@ -1,15 +1,8 @@
 <workspace-boundary>
-This session may be scoped to a single customer. Treat the working directory as the scope of the
-work: what the task needs is inside it, and another customer's material is not yours to open here.
-- You **MUST NOT** range across the filesystem hunting for files, examples, or precedent. Search
-  within the working directory. Your own skills and plugins, and paths the operator granted
-  explicitly (`--allow-path`, `sandbox.allowRead`), are legitimate — and are not licence to browse
-  anywhere else.
-- Subdirectories may themselves be separate customers. Reachable does not mean in scope: work in
-  the one the task names, state the crossing when the task genuinely spans more than one, and
-  **MUST NOT** merge two customers' material into one artifact.
-- A sandbox confines this session's file access, but its boundary is the working directory, not the
-  customer subdirectory: nothing refuses a sibling, so the rule above is yours to keep. When the
-  sandbox is active a path outside the working directory is refused — that is the boundary working,
-  not a tool failure. Say what you needed and why, and **MUST NOT** reach the same path another way.
+Separate tenants may sit side by side — as subdirectories of the working directory, and anywhere
+else you can reach when filesystem isolation is off. Reaching something is not the same as it being
+in scope; keeping tenants apart is your judgment.
+- Work in the one the task names, and say so when the task genuinely spans more than one.
+- You **MUST NOT** open another tenant's material for context, examples, or precedent when the task
+  did not ask for it, and **MUST NOT** merge two tenants' material into one artifact.
 </workspace-boundary>

package/src/sandbox/containment.ts

@@ -203,6 +203,12 @@ const COMMAND_BEARING_CONFIG = [
 	// was measured working with its config.yml read-only.
 	path.join(".config", "glab-cli", "aliases.yml"),
 	path.join("Library", "Application Support", "glab-cli", "aliases.yml"),
+	// Build configuration that redirects a later build. Protected by *omission* while home was denied —
+	// the cache carve-outs grant `.cargo/registry` rather than `.cargo` — so #2637 had to name them. A
+	// write here is persistence, not theft: the operator's next build runs what it says. Reads are fine.
+	path.join(".cargo", "config.toml"),
+	path.join(".gradle", "init.gradle"),
+	path.join(".gradle", "init.d"),
 ];
 
 /** Read-only inside home: configuration a tool needs to behave correctly, but must not rewrite. */
@@ -268,9 +274,10 @@ const AGENT_PROFILE_FILES = ["user-profile.json", "computer-profile.json", "sett
  * unforeseen — `/data`, `/scratch`, a bespoke mount.
  */
 const DATA_ROOTS = [
-	"/Users", // macOS home container: other operators' accounts, /Users/Shared
-	"/home", // Linux home container
-	"/root", // Linux superuser home
+	// `/Users` and `/home` are deliberately absent: denying the home container denies this operator's own
+	// home with it, which is the whole of #2637. Other accounts are 0700, so the filesystem already refuses
+	// them; the fence is not here to re-implement file permissions.
+	"/root", // Linux superuser home: not this operator's account
 	"/Volumes", // macOS mounts. Per-container, not per-child: /Volumes/Macintosh HD resolves to /,
 	"/mnt", // which `tooBroadToDeny` then rejects, and the kernel resolves such a path before any
 	"/media", // rule matches it — so denying the container cannot deny the boot volume.
@@ -528,8 +535,22 @@ export function buildContainmentFence(options: ContainmentOptions): ContainmentF
 	// rejects, so `/`, `/usr`, `/tmp` and `$TMPDIR` are never denied and operational paths stay
 	// reachable. And it costs nothing below: the workspace is allowed at greater depth, and
 	// `fenceVerdict` takes the deepest match.
-	if (home !== undefined && home !== workspace) deny.add(home);
+	// Home is never denied, and the walk stops there (#2637).
+	//
+	// This is a professional courtesy, not a prison: an effort to stop *inadvertent* filesystem wandering
+	// between customers, for an operator with senior technical skills and the same rights on this machine
+	// as the agent acting for them. Denying home outright refused `~/git/STYLE_GUIDE.md` and then needed
+	// ~30 carve-outs to make ordinary tooling work again — every one of them evidence the posture was wrong.
+	//
+	// What the walk still covers is the part that matters: every level between the workspace and home. With
+	// the workspace at `~/MEDDPICC/CUSTOMER-A`, `~/MEDDPICC` is denied so the `CUSTOMER-B` sibling is unreachable,
+	// and with `<container>/<tenant>/repo` every level up to home is denied, so the v19.100.1 cross-tenant
+	// regression does not return.
+	//
+	// A session whose folder IS home, or a direct child of it, therefore fences nothing above itself. That
+	// is deliberate: if the operator chooses to work in home, that is their filesystem to lay out.
 	for (let ancestor = path.dirname(workspace); ; ancestor = path.dirname(ancestor)) {
+		if (ancestor === home) break; // the operator's own account is theirs
 		if (tooBroadToDeny(ancestor, fsRoot)) break;
 		deny.add(ancestor);
 		const next = path.dirname(ancestor);
@@ -599,7 +620,7 @@ export function buildContainmentFence(options: ContainmentOptions): ContainmentF
 	}
 
 	// Top-level directories that hold somebody's files. Without these the fence covered only home and
-	// the workspace's ancestors, so with the workspace at `~/MEDDPICC/EQUIFAX` another operator's
+	// the workspace's ancestors, so with the workspace at `~/MEDDPICC/CUSTOMER-A` another operator's
 	// account, an external volume and `/data/globex` were all readable AND writable — measured. The
 	// command-text scan was refusing them on the way in, which is exactly why that scan could not
 	// simply be stood down (#2624).
@@ -629,6 +650,11 @@ export function buildContainmentFence(options: ContainmentOptions): ContainmentF
 		// e.g. /Volumes/Macintosh HD -> /. Skipped for the whole-root list, per the note above.
 		if (!rootScoped.has(resolved) && tooBroadToDeny(resolved, fsRoot)) continue;
 		if (resolved === fsRoot) continue; // never the root the workspace lives on
+		// Never a directory that CONTAINS home, because denying it denies home (#2637). Removing `/Users`
+		// and `/home` from the static list was not enough: the root enumeration re-adds them, since
+		// `Users` is not an operational name. That is what still refused `~/git/STYLE_GUIDE.md` at the
+		// kernel while `fenceVerdict` said allow — the unit tests use synthetic roots and could not see it.
+		if (home !== undefined && pathIsWithin(resolved, home)) continue;
 		// A deny beats an allow at EQUAL depth, so denying a root that IS the workspace or IS something
 		// the operator granted would not be redundant — it would silently revoke the grant. Deeper is
 		// fine and intended: an ancestor deny with the workspace allowed inside it is the normal shape.