@f5-sales-demo/xcsh 19.102.7 → 19.103.0

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@f5-sales-demo/xcsh",
-	"version": "19.102.7",
+	"version": "19.103.0",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://github.com/f5-sales-demo/xcsh",
 	"author": "Can Boluk",
@@ -57,13 +57,13 @@
 	"dependencies": {
 		"@agentclientprotocol/sdk": "1.3.0",
 		"@mozilla/readability": "^0.6",
-		"@f5-sales-demo/xcsh-stats": "19.102.7",
-		"@f5-sales-demo/pi-agent-core": "19.102.7",
-		"@f5-sales-demo/pi-ai": "19.102.7",
-		"@f5-sales-demo/pi-natives": "19.102.7",
-		"@f5-sales-demo/pi-resource-management": "19.102.7",
-		"@f5-sales-demo/pi-tui": "19.102.7",
-		"@f5-sales-demo/pi-utils": "19.102.7",
+		"@f5-sales-demo/xcsh-stats": "19.103.0",
+		"@f5-sales-demo/pi-agent-core": "19.103.0",
+		"@f5-sales-demo/pi-ai": "19.103.0",
+		"@f5-sales-demo/pi-natives": "19.103.0",
+		"@f5-sales-demo/pi-resource-management": "19.103.0",
+		"@f5-sales-demo/pi-tui": "19.103.0",
+		"@f5-sales-demo/pi-utils": "19.103.0",
 		"@sinclair/typebox": "^0.34",
 		"@xterm/headless": "^6.0",
 		"ajv": "^8.20",

package/scripts/capture-ax-fixture.ts

@@ -4,7 +4,7 @@
 import puppeteer from "puppeteer";
 
 const CHROME = process.env.CHROME_PATH;
-const BASE = process.env.XCSH_CONSOLE_URL ?? "https://nferreira.staging.volterra.us";
+const BASE = process.env.XCSH_CONSOLE_URL ?? "https://example.staging.volterra.us";
 const NS = process.env.XCSH_NS ?? "demo";
 const OUT = "test/browser/fixtures/xc-http-lb-create.ax.json";
 

package/scripts/capture-login-fixture.ts

@@ -13,7 +13,7 @@
 import puppeteer from "puppeteer";
 
 const CHROME = process.env.CHROME_PATH;
-const BASE = process.env.XCSH_API_URL ?? "https://nferreira.staging.volterra.us";
+const BASE = process.env.XCSH_API_URL ?? "https://example.staging.volterra.us";
 const PROFILE = "/tmp/xc-login-capture-profile";
 const LOGIN_OUT = "test/browser/fixtures/xc-login-wall.html";
 

package/scripts/extension-uat-harness.ts

@@ -15,7 +15,7 @@
  */
 import { type BridgeServer, startBridgeServer } from "../src/browser/extension-bridge";
 
-const BASE = process.env.XCSH_API_URL ?? "https://nferreira.staging.volterra.us";
+const BASE = process.env.XCSH_API_URL ?? "https://example.staging.volterra.us";
 const ROUTE = `${BASE}/web/workspaces/web-app-and-api-protection/namespaces/demo/manage/load_balancers/http_loadbalancers`;
 
 let server: BridgeServer;

package/scripts/generate-api-spec-index.ts

@@ -97,6 +97,25 @@ const REPO = "f5-sales-demo/api-specs-enriched";
 const outputPath = path.resolve(import.meta.dir, "../src/internal-urls/api-spec-index.generated.ts");
 const catalogOutputPath = path.resolve(import.meta.dir, "../src/internal-urls/api-catalog-index.generated.ts");
 
+/**
+ * Upstream specs use ACME as a placeholder tenant, company and hostname. STYLE_GUIDE.md bans it:
+ * it is not trademark-cleared, and in TLS content the name already belongs to RFC 8555. Rewrite it
+ * to the `Example` pattern here rather than in the emitted file, so a regeneration cannot bring it
+ * back (#2650).
+ *
+ * `_acme-challenge` is the RFC 8555 DNS-01 record label, not the placeholder, and must survive.
+ */
+function sanitizePlaceholders(text: string): string {
+	// The sentinel must contain no form of the word being rewritten, or the rewrite eats it.
+	const CHALLENGE = " RFC8555_DNS01 ";
+	return text
+		.replace(/_acme-challenge/gi, CHALLENGE)
+		.replace(/ACME/g, "Example")
+		.replace(/Acme/g, "Example")
+		.replace(/acme/g, "example")
+		.replaceAll(CHALLENGE, "_acme-challenge");
+}
+
 const MAX_RETRIES = 3;
 const INITIAL_BACKOFF_MS = 2000;
 
@@ -552,7 +571,7 @@ const output = [
 	.filter(l => l !== undefined)
 	.join("\n");
 
-await Bun.write(outputPath, output);
+await Bun.write(outputPath, sanitizePlaceholders(output));
 
 const outputSize = (Buffer.byteLength(output) / 1024 / 1024).toFixed(1);
 console.log(
@@ -596,7 +615,7 @@ if (catalog) {
 		"",
 	].join("\n");
 
-	await Bun.write(catalogOutputPath, catalogOutput);
+	await Bun.write(catalogOutputPath, sanitizePlaceholders(catalogOutput));
 	const catalogSize = (Buffer.byteLength(catalogOutput) / 1024 / 1024).toFixed(1);
 	console.log(
 		`Generated ${path.relative(process.cwd(), catalogOutputPath)} (${categories.length} categories, ${catalogSize} MB)`,

package/scripts/generate-console-catalog.ts

@@ -6,6 +6,22 @@ import * as path from "node:path";
 const repoRoot = path.resolve(import.meta.dir, "..");
 const outputPath = path.join(repoRoot, "src/internal-urls/console-catalog.generated.ts");
 
+/**
+ * The catalog is captured from a live console, so it carries whatever tenant the operator who
+ * captured it was signed in to — typically a personal staging tenant named after them. That is a
+ * real identifier and must not be committed to a public repository (#2659). Rewrite it at the write
+ * site so a re-capture cannot reintroduce it.
+ */
+function sanitizeTenantHosts(text: string): string {
+	return (
+		text
+			.replace(/\b[a-z0-9][a-z0-9-]*\.staging\.volterra\.us\b/gi, "example.staging.volterra.us")
+			// Catalog prose names the tenant too ("on the live <name> staging tenant"). Matched by shape
+			// rather than by the person's name, so this file never has to carry the identifier it removes.
+			.replace(/\b(?!example\b)[A-Za-z][\w.-]*(?=\s+staging\s+tenant\b)/g, "example")
+	);
+}
+
 function resolveCatalogRoot(): string | null {
 	const fromEnv = process.env.CONSOLE_CATALOG_DIR;
 	if (fromEnv && fs.existsSync(path.join(fromEnv, "catalog"))) return fromEnv;
@@ -82,7 +98,7 @@ const output = [
 	"",
 ].join("\n");
 
-await Bun.write(outputPath, output);
+await Bun.write(outputPath, sanitizeTenantHosts(output));
 console.log(
 	`Wrote ${outputPath} (workflows=${Object.keys(data.workflows).length}, resources=${Object.keys(data.resources).length})`,
 );

package/scripts/uat-matrix-modalities.ts

@@ -259,7 +259,7 @@ export async function runJson(p: CrudPhrase, cfg: MatrixConfig): Promise<Cell> {
 			detail: "skip_crud_test=true",
 		};
 	}
-	const ns = p.api_namespace || "r-mordasiewicz";
+	const ns = p.api_namespace || "example-corp";
 	const verifyPath =
 		p.namespace_scoped === false
 			? `/api/web/namespaces/${p.resource_name}`

package/scripts/uat-matrix.ts

@@ -122,10 +122,10 @@ function applyLimitFilter<T>(items: T[], args: Args, idOf: (t: T) => string): T[
 function cfgFromEnv(args: Args): MatrixConfig {
 	return {
 		xcshBin: process.env.XCSH_BIN ?? "xcsh",
-		apiUrl: process.env.XCSH_API_URL ?? "https://nferreira.staging.volterra.us",
+		apiUrl: process.env.XCSH_API_URL ?? "https://example.staging.volterra.us",
 		apiToken: process.env.XCSH_API_TOKEN ?? "",
 		consoleNamespace: process.env.XCSH_NAMESPACE ?? "demo",
-		tenant: (process.env.XCSH_API_URL ?? "https://nferreira.staging.volterra.us")
+		tenant: (process.env.XCSH_API_URL ?? "https://example.staging.volterra.us")
 			.replace(/^https?:\/\//, "")
 			.split(".")[0]!,
 		observable: args.observable,
@@ -189,7 +189,7 @@ async function listNames(ns: string, apiPath: string, prefix: string, cfg: Matri
 }
 
 async function cleanup(cfg: MatrixConfig): Promise<void> {
-	console.log("\n[cleanup] deleting uat-* (demo) and ar-test-* (r-mordasiewicz) resources, parents first...");
+	console.log("\n[cleanup] deleting uat-* (demo) and ar-test-* (example-corp) resources, parents first...");
 	for (const ap of DEMO_CLEANUP_PATHS) {
 		for (const name of await listNames(cfg.consoleNamespace, ap, "uat-", cfg)) {
 			const code = await apiDelete(`/api/config/namespaces/${cfg.consoleNamespace}/${ap}/${name}`, cfg);
@@ -197,8 +197,8 @@ async function cleanup(cfg: MatrixConfig): Promise<void> {
 		}
 	}
 	for (const ap of AR_CLEANUP_PATHS) {
-		for (const name of await listNames("r-mordasiewicz", ap, "ar-test-", cfg)) {
-			await apiDelete(`/api/config/namespaces/r-mordasiewicz/${ap}/${name}`, cfg);
+		for (const name of await listNames("example-corp", ap, "ar-test-", cfg)) {
+			await apiDelete(`/api/config/namespaces/example-corp/${ap}/${name}`, cfg);
 		}
 	}
 	console.log("[cleanup] done");

package/src/browser/chat-conformance.json

@@ -669,7 +669,7 @@
         "v": 1,
         "capturedAt": 1719000000000,
         "tabId": 7,
-        "url": "https://acme.console.ves.volterra.io/web/namespaces/default/http_loadbalancers/lb1",
+        "url": "https://example-corp.console.ves.volterra.io/web/namespaces/default/http_loadbalancers/lb1",
         "path": "/web/namespaces/default/http_loadbalancers/lb1",
         "title": "lb1 — Distributed Cloud",
         "ax": {
@@ -707,7 +707,7 @@
           "v": 1,
           "capturedAt": 1719000000000,
           "tabId": 7,
-          "url": "https://acme.console.ves.volterra.io/web/namespaces/default/http_loadbalancers/lb1",
+          "url": "https://example-corp.console.ves.volterra.io/web/namespaces/default/http_loadbalancers/lb1",
           "path": "/web/namespaces/default/http_loadbalancers/lb1",
           "title": "lb1 — Distributed Cloud",
           "ax": {
@@ -922,7 +922,7 @@
             "v": 1,
             "capturedAt": 1719000000000,
             "tabId": 7,
-            "url": "https://acme.console.ves.volterra.io/web/namespaces/default/http_loadbalancers/lb1",
+            "url": "https://example-corp.console.ves.volterra.io/web/namespaces/default/http_loadbalancers/lb1",
             "path": "/web/namespaces/default/http_loadbalancers/lb1",
             "title": "lb1 — Distributed Cloud",
             "ax": {
@@ -967,7 +967,7 @@
             "v": 1,
             "capturedAt": 1719000000000,
             "tabId": 7,
-            "url": "https://acme.console.ves.volterra.io/web/namespaces/default/http_loadbalancers/lb1",
+            "url": "https://example-corp.console.ves.volterra.io/web/namespaces/default/http_loadbalancers/lb1",
             "path": "/web/namespaces/default/http_loadbalancers/lb1",
             "title": "lb1 — Distributed Cloud",
             "ax": {
@@ -1027,7 +1027,7 @@
           "v": 2,
           "capturedAt": 1719000000000,
           "tabId": 7,
-          "url": "https://acme.console.ves.volterra.io/web/namespaces/default/http_loadbalancers/lb1",
+          "url": "https://example-corp.console.ves.volterra.io/web/namespaces/default/http_loadbalancers/lb1",
           "path": "/web/namespaces/default/http_loadbalancers/lb1",
           "title": "lb1 — Distributed Cloud",
           "ax": {

package/src/commands/manager.ts

@@ -6,7 +6,7 @@
  * override `XCSH_MANAGER_SOCK`) for NDJSON control frames — one JSON object per
  * line — validated by the pure `manager-core` protocol:
  *
- *   {"type":"provision","sessionId":"tab-7","tenant":"acme|staging"}
+ *   {"type":"provision","sessionId":"tab-7","tenant":"example-corp|staging"}
  *        → spawn a worker for that sessionId (idempotent). The registry is keyed
  *          on sessionId, so two tabs of the SAME tenant get two workers.
  *   {"type":"release","sessionId":"tab-7"}  → kill + forget that session's worker

package/src/discovery/start-folder.ts

@@ -0,0 +1,108 @@
+/**
+ * What kind of directory this xcsh instance was started in.
+ *
+ * The binary maps to a session by its start folder, and those folders are not the same
+ * kind of thing. Some are GitHub checkouts where version control is the point. Some hold
+ * tenant automations, lab state, credentials and troubleshooting captures that must never
+ * reach a repository. Without this distinction the agent will helpfully offer to `git init`
+ * the second kind.
+ *
+ * `classifyRepo` in ../internal-urls/fleet-resolve.ts cannot answer it: it collapses "not a
+ * repository at all" and "a repository in an unrecognised org" into the same unclassified
+ * verdict, which is precisely the distinction needed here.
+ */
+import { parseGitHubRepo } from "../modes/components/status-line/git-utils";
+import * as git from "../utils/git";
+
+export type StartFolderKind =
+	/** In a repository with a GitHub remote. Git and GitHub work are both in scope. */
+	| "github"
+	/** In a repository, but not one on GitHub. Version control is fine; GitHub actions are not. */
+	| "git"
+	/** Not in a repository. May hold secrets, so publishing it is never volunteered. */
+	| "plain";
+
+export interface StartFolder {
+	readonly kind: StartFolderKind;
+	/** `owner/repo`, present only when `kind` is `"github"`. */
+	readonly slug?: string;
+	/**
+	 * The start folder is itself git-ignored: inside a repository, but deliberately
+	 * excluded from it. Set only when it is — absent reads as "not ignored".
+	 */
+	readonly ignored?: true;
+}
+
+/** Injected so the branches are testable without a real repository on disk. */
+export interface StartFolderDeps {
+	/** Repository root for `cwd`, or null when `cwd` is not in one. */
+	repoRoot(cwd: string, signal?: AbortSignal): Promise<string | null>;
+	/** URL of the `origin` remote, or null when there is none. */
+	originUrl(cwd: string, signal?: AbortSignal): Promise<string | null>;
+	/** Whether `cwd` itself is excluded by gitignore rules. */
+	isIgnored(cwd: string, signal?: AbortSignal): Promise<boolean>;
+}
+
+export const defaultStartFolderDeps: StartFolderDeps = {
+	repoRoot: (cwd, signal) => git.repo.root(cwd, signal),
+	// `remote.url` reports "no such remote" as undefined; this interface uses null for
+	// absent throughout, so normalise here rather than accepting both downstream.
+	originUrl: async (cwd, signal) => (await git.remote.url(cwd, "origin", signal)) ?? null,
+	isIgnored: (cwd, signal) => git.repo.ignored(cwd, signal),
+};
+
+/**
+ * The decision, with the probing already done.
+ *
+ * `parseGitHubRepo` owns what counts as a GitHub remote — it handles https, scp-style ssh
+ * and `git://`, and rejects look-alike hosts. Re-deriving that here would be a second
+ * definition to keep in step.
+ */
+export function classifyStartFolder(repoRoot: string | null, originUrl: string | null, ignored = false): StartFolder {
+	if (!repoRoot) return { kind: "plain" };
+	const slug = originUrl ? parseGitHubRepo(originUrl) : null;
+	const base: StartFolder = slug ? { kind: "github", slug } : { kind: "git" };
+	// The kind stays accurate — the repository is real — and the exclusion rides alongside
+	// it, rather than pretending a checkout is not a checkout.
+	return ignored ? { ...base, ignored: true } : base;
+}
+
+/**
+ * Probe `cwd` and classify it, failing in the safe direction at every step.
+ *
+ * "Safe" means withholding scope, never inventing it. If we cannot tell whether this is a
+ * repository, we say it is not — so a broken probe costs a suggestion rather than leaking a
+ * secret. If we know it IS a repository but cannot read the remote, we say `git`: claiming
+ * `plain` there would be false and would suppress legitimate version-control work, while
+ * `git` is true and still withholds GitHub.
+ */
+export async function resolveStartFolder(
+	cwd: string,
+	deps: StartFolderDeps = defaultStartFolderDeps,
+	signal?: AbortSignal,
+): Promise<StartFolder> {
+	let root: string | null;
+	try {
+		root = await deps.repoRoot(cwd, signal);
+	} catch {
+		return { kind: "plain" };
+	}
+	if (!root) return { kind: "plain" };
+
+	let origin: string | null = null;
+	try {
+		origin = await deps.originUrl(cwd, signal);
+	} catch {
+		// Repository confirmed, remote unknown — see above.
+	}
+
+	let ignored = false;
+	try {
+		ignored = await deps.isIgnored(cwd, signal);
+	} catch {
+		// `check-ignore` reports "not ignored" as exit 1, not as a failure, so a throw here
+		// means git itself is broken — and `repoRoot` already succeeded. Treat it as not
+		// ignored rather than cautioning in every repository on a broken probe.
+	}
+	return classifyStartFolder(root, origin, ignored);
+}

package/src/internal-urls/build-info.generated.ts

@@ -17,17 +17,17 @@ export interface BuildInfo {
 }
 
 export const BUILD_INFO: BuildInfo = {
-	"version": "19.102.7",
-	"commit": "a955a498f6c995dae2640639ce70c4c5ec1e62b1",
-	"shortCommit": "a955a49",
+	"version": "19.103.0",
+	"commit": "830a2618bfd67610b3b8bc93dcccd4d3417af10e",
+	"shortCommit": "830a261",
 	"branch": "main",
-	"tag": "v19.102.7",
-	"commitDate": "2026-07-31T02:16:15Z",
-	"buildDate": "2026-07-31T02:41:44.450Z",
+	"tag": "v19.103.0",
+	"commitDate": "2026-07-31T04:44:56Z",
+	"buildDate": "2026-07-31T05:04:35.541Z",
 	"dirty": true,
 	"prNumber": "",
 	"repoUrl": "https://github.com/f5-sales-demo/xcsh",
 	"repoSlug": "f5-sales-demo/xcsh",
-	"commitUrl": "https://github.com/f5-sales-demo/xcsh/commit/a955a498f6c995dae2640639ce70c4c5ec1e62b1",
-	"releaseUrl": "https://github.com/f5-sales-demo/xcsh/releases/tag/v19.102.7"
+	"commitUrl": "https://github.com/f5-sales-demo/xcsh/commit/830a2618bfd67610b3b8bc93dcccd4d3417af10e",
+	"releaseUrl": "https://github.com/f5-sales-demo/xcsh/releases/tag/v19.103.0"
 };

package/src/internal-urls/console-catalog.generated.ts

@@ -396,7 +396,7 @@ export const CONSOLE_CATALOG_DATA: ConsoleCatalogData = {
 		"health-check/create":
 			'schema: "urn:xcsh:console:workflow:v1"\nid: "health-check-create"\nlabel: "Create Health Check"\nresource: "health-check"\noperation: "create"\n\npreconditions:\n  - "user_logged_in"\n  - "namespace_selected"\n  - "role_minimum: admin"\n\nparams:\n  namespace:\n    required: true\n    description: "Target namespace"\n    example: "demo"\n  name:\n    required: true\n    description: "Health check name (lowercase alphanumeric and hyphens)"\n    example: "example-health-check"\n  health_check_type:\n    required: false\n    description: "Health check protocol type"\n    example: "HTTP HealthCheck"\n    default: "HTTP HealthCheck"\n  timeout:\n    required: false\n    type: "number"\n    description: "Timeout for each health check probe in seconds"\n    example: 3\n    default: 3\n  interval:\n    required: false\n    type: "number"\n    description: "Interval between health check probes in seconds"\n    example: 15\n    default: 15\n  unhealthy_threshold:\n    required: false\n    type: "number"\n    description: "Number of consecutive failures before marking unhealthy"\n    example: 1\n    default: 1\n  healthy_threshold:\n    required: false\n    type: "number"\n    description: "Number of consecutive successes before marking healthy"\n    example: 3\n    default: 3\n\nsteps:\n  - id: "navigate-to-list"\n    action: "navigate"\n    url: "/web/workspaces/web-app-and-api-protection/namespaces/{namespace}/manage/load_balancers/health_checks"\n    wait_for: "text(\'Health Checks\')"\n    description: "Navigate to Health Checks list page within Web App & API Protection workspace"\n\n  - id: "click-add-tab"\n    action: "click"\n    selector: "text(\'Add Health Check\')"\n    wait_for: "textbox[name=\'Name\']"\n    description: "Click the Add Health Check tab to open the inline create form"\n    note: "This is a tab element, not a button"\n\n  - id: "fill-name"\n    action: "fill"\n    selector: "textbox[name=\'Name\']"\n    value: "{name}"\n    description: "Enter the health check name in the Name textbox"\n\n  - id: "select-type"\n    condition: "params.health_check_type is set"\n    action: "select"\n    selector: "listbox"\n    context: "Health Check Parameters section"\n    value: "{health_check_type}"\n    description: "Select the health check type (HTTP HealthCheck or TCP HealthCheck)"\n\n  - id: "set-timeout"\n    condition: "params.timeout is set"\n    action: "fill"\n    selector: "spinbutton[name=\'Timeout\']"\n    value: "{timeout}"\n    description: "Set the health check timeout value"\n\n  - id: "set-interval"\n    condition: "params.interval is set"\n    action: "fill"\n    selector: "spinbutton[name=\'Interval\']"\n    value: "{interval}"\n    description: "Set the health check interval value"\n\n  - id: "set-unhealthy-threshold"\n    condition: "params.unhealthy_threshold is set"\n    action: "fill"\n    selector: "spinbutton[name=\'Unhealthy Threshold\']"\n    value: "{unhealthy_threshold}"\n    description: "Set the unhealthy threshold value"\n\n  - id: "set-healthy-threshold"\n    condition: "params.healthy_threshold is set"\n    action: "fill"\n    selector: "spinbutton[name=\'Healthy Threshold\']"\n    value: "{healthy_threshold}"\n    description: "Set the healthy threshold value"\n\n  - id: "save"\n    action: "click"\n    selector: "[class*=\'save-bt\']"\n    wait_for: "text(\'{name}\')"\n    wait_timeout_ms: 60000\n    description: "Click the Add Health Check button to save. The \'button\' role disambiguates the footer save button from the same-named tab, so no section context is needed. The wait_for confirms the new resource\'s name appears in the list, which is the creation verification."\n\npostconditions:\n  - "resource_list_page_visible"\n  - "resource_name_in_list: {name}"\n\nmetadata:\n  confidence: "validated"\n  discovered_at: "2026-06-15"\n  validated_at: "2026-06-18"\n  console_version: "2025.06"\n  estimated_duration_seconds: 25\n  notes: "Selectors use aria/text-based patterns validated against live console. No data-testid attributes exist. Has Show Advanced Fields toggle for additional parameters."\n',
 		"health-check/delete":
-			'schema: "urn:xcsh:console:workflow:v1"\nid: "health-check-delete"\nlabel: "Delete Health Check"\nresource: "health-check"\noperation: "delete"\n\npreconditions:\n  - "user_logged_in"\n  - "namespace_selected"\n  - "role_minimum: admin"\n  - "resource_exists: {name}"\n\nparams:\n  namespace:\n    required: true\n    description: "Namespace containing the health check"\n    example: "demo"\n  name:\n    required: true\n    description: "Name of the health check to delete"\n    example: "example-health-check"\n\n# Selectors discovered against the live console 2026-06-22. The console has NO\n# data-testid attributes; it uses ves-e2e-test. The per-row actions menu is a\n# shared CrudComponent: a kebab button opens a listbox whose options include\n# Delete, which opens a confirmation dialog with Cancel / Delete buttons.\nsteps:\n  - id: "navigate-to-list"\n    action: "navigate"\n    url: "/web/workspaces/web-app-and-api-protection/namespaces/{namespace}/manage/load_balancers/health_checks"\n    wait_for: "text(\'Health Checks\')"\n    description: "Navigate to the Health Check list page (Web App & API Protection workspace)"\n\n  - id: "scroll-actions-into-view"\n    action: "scroll"\n    selector: "row:has-text(\'{name}\') >> [ves-e2e-test=\'row-action-dropdown\']"\n    context: "row containing {name}"\n    description: "The data table is wider than the viewport and the Actions column sits off-screen-right; scroll the row\'s actions button into view before clicking. Avoids enlarging the window."\n    note: "For a multi-row list, scope to the datatable-body-row whose cells contain {name}; for a single-row list the first row-action-dropdown is the target."\n\n  - id: "open-row-actions"\n    action: "click"\n    selector: "row:has-text(\'{name}\') >> [ves-e2e-test=\'row-action-dropdown\']"\n    context: "row containing {name}"\n    wait_for: "option:text(\'Delete\')"\n    description: "Click the row kebab to open the actions listbox. Requires a trusted (CDP) click — synthetic JS clicks fire outside Angular\'s zone and never render the overlay."\n\n  - id: "click-delete"\n    action: "click"\n    selector: "option:text(\'Delete\')"\n    wait_for: "button:text(\'Delete\')"\n    description: "Click the Delete option (ves-e2e-test=\'row-action-item-delete\') to open the confirmation dialog."\n\n  - id: "confirm-delete"\n    action: "click"\n    selector: "button:text(\'Delete\')"\n    context: "confirmation dialog"\n    wait_for: "text(\'Health Checks\')"\n    wait_timeout_ms: 15000\n    description: "Click the dialog\'s Delete button to confirm. Cancel via button:text(\'Cancel\') aborts without deleting."\n\n  - id: "verify-on-list"\n    action: "assert"\n    selector: "text(\'Health Checks\')"\n    expected_text: "Health Checks"\n    description: "Confirm the list page is shown after deletion (assert requires expected_text). Deletion itself is verified independently by the API cross-check."\n\npostconditions:\n  - "resource_removed_from_list"\n  - "list_page_visible"\n\nmetadata:\n  confidence: "validated"\n  discovered_at: "2026-06-22"\n  console_version: "2025.06"\n  estimated_duration_seconds: 15\n  selector_scheme: "ves-e2e-test + aria (no data-testid exists)"\n  notes: "Validated end-to-end on the live nferreira staging tenant 2026-06-22 (UI delete confirmed; list row removed and API GET returned 404)."\n',
+			'schema: "urn:xcsh:console:workflow:v1"\nid: "health-check-delete"\nlabel: "Delete Health Check"\nresource: "health-check"\noperation: "delete"\n\npreconditions:\n  - "user_logged_in"\n  - "namespace_selected"\n  - "role_minimum: admin"\n  - "resource_exists: {name}"\n\nparams:\n  namespace:\n    required: true\n    description: "Namespace containing the health check"\n    example: "demo"\n  name:\n    required: true\n    description: "Name of the health check to delete"\n    example: "example-health-check"\n\n# Selectors discovered against the live console 2026-06-22. The console has NO\n# data-testid attributes; it uses ves-e2e-test. The per-row actions menu is a\n# shared CrudComponent: a kebab button opens a listbox whose options include\n# Delete, which opens a confirmation dialog with Cancel / Delete buttons.\nsteps:\n  - id: "navigate-to-list"\n    action: "navigate"\n    url: "/web/workspaces/web-app-and-api-protection/namespaces/{namespace}/manage/load_balancers/health_checks"\n    wait_for: "text(\'Health Checks\')"\n    description: "Navigate to the Health Check list page (Web App & API Protection workspace)"\n\n  - id: "scroll-actions-into-view"\n    action: "scroll"\n    selector: "row:has-text(\'{name}\') >> [ves-e2e-test=\'row-action-dropdown\']"\n    context: "row containing {name}"\n    description: "The data table is wider than the viewport and the Actions column sits off-screen-right; scroll the row\'s actions button into view before clicking. Avoids enlarging the window."\n    note: "For a multi-row list, scope to the datatable-body-row whose cells contain {name}; for a single-row list the first row-action-dropdown is the target."\n\n  - id: "open-row-actions"\n    action: "click"\n    selector: "row:has-text(\'{name}\') >> [ves-e2e-test=\'row-action-dropdown\']"\n    context: "row containing {name}"\n    wait_for: "option:text(\'Delete\')"\n    description: "Click the row kebab to open the actions listbox. Requires a trusted (CDP) click — synthetic JS clicks fire outside Angular\'s zone and never render the overlay."\n\n  - id: "click-delete"\n    action: "click"\n    selector: "option:text(\'Delete\')"\n    wait_for: "button:text(\'Delete\')"\n    description: "Click the Delete option (ves-e2e-test=\'row-action-item-delete\') to open the confirmation dialog."\n\n  - id: "confirm-delete"\n    action: "click"\n    selector: "button:text(\'Delete\')"\n    context: "confirmation dialog"\n    wait_for: "text(\'Health Checks\')"\n    wait_timeout_ms: 15000\n    description: "Click the dialog\'s Delete button to confirm. Cancel via button:text(\'Cancel\') aborts without deleting."\n\n  - id: "verify-on-list"\n    action: "assert"\n    selector: "text(\'Health Checks\')"\n    expected_text: "Health Checks"\n    description: "Confirm the list page is shown after deletion (assert requires expected_text). Deletion itself is verified independently by the API cross-check."\n\npostconditions:\n  - "resource_removed_from_list"\n  - "list_page_visible"\n\nmetadata:\n  confidence: "validated"\n  discovered_at: "2026-06-22"\n  console_version: "2025.06"\n  estimated_duration_seconds: 15\n  selector_scheme: "ves-e2e-test + aria (no data-testid exists)"\n  notes: "Validated end-to-end on the live example staging tenant 2026-06-22 (UI delete confirmed; list row removed and API GET returned 404)."\n',
 		"health-check/read":
 			"schema: urn:xcsh:console:workflow:v1\nid: health-check-read\nlabel: Read Health Checks\nresource: health-check\noperation: read\nparams:\n  namespace:\n    required: true\n    example: demo\n  name:\n    required: true\n    example: example-health-check\nsteps:\n  - id: navigate-to-list\n    action: navigate\n    url: /web/workspaces/web-app-and-api-protection/namespaces/{namespace}/manage/load_balancers/health_checks\n    wait_for: text('Health Checks')\n    description: Navigate to Health Checks list page\n  - id: scroll-actions-into-view\n    action: scroll\n    selector: row:has-text('{name}') >> [ves-e2e-test='row-action-dropdown']\n    description: Scroll the Actions column into view for the target row\n  - id: open-row-actions\n    action: click\n    selector: row:has-text('{name}') >> [ves-e2e-test='row-action-dropdown']\n    wait_for: option:text('Manage Configuration')\n    description: Open the row kebab menu\n    note: F5 XC rows have no clickable name → detail page; Read opens the config via the kebab\n  - id: open-configuration\n    action: click\n    selector: option:text('Manage Configuration')\n    wait_for: button:text('Edit Configuration')\n    wait_timeout_ms: 15000\n    description: Open the read-only Manage Configuration view\n    note: The config opens read-only (Form/JSON tabs); the agent reads field values via get_page_text/javascript_tool. The\n      'Edit Configuration' button confirms the view loaded.\nmetadata:\n  confidence: inferred\n  discovered_at: 2026-06-24\n  console_version: \"2025.06\"\n  notes: Auto-generated by scripts/generate-workflows.ts from api-specs-enriched field metadata.\n",
 		"health-check/update":