@f5-sales-demo/xcsh 19.103.4 → 19.104.0

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 ## [Unreleased]
 
+## [19.104.0] - 2026-07-31
+
+### Added
+
+- Added a post-login LiteLLM model chooser for GPT-5.6 Sol and Claude Opus 5 with High reasoning; authenticated users can switch later with `/model`
+
+### Fixed
+
+- Restricted LiteLLM credential configuration files to owner-only permissions
+
 ## [19.51.5] - 2026-06-26
 
 ### Fixed

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@f5-sales-demo/xcsh",
-	"version": "19.103.4",
+	"version": "19.104.0",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://github.com/f5-sales-demo/xcsh",
 	"author": "Can Boluk",
@@ -57,13 +57,13 @@
 	"dependencies": {
 		"@agentclientprotocol/sdk": "1.3.0",
 		"@mozilla/readability": "^0.6",
-		"@f5-sales-demo/xcsh-stats": "19.103.4",
-		"@f5-sales-demo/pi-agent-core": "19.103.4",
-		"@f5-sales-demo/pi-ai": "19.103.4",
-		"@f5-sales-demo/pi-natives": "19.103.4",
-		"@f5-sales-demo/pi-resource-management": "19.103.4",
-		"@f5-sales-demo/pi-tui": "19.103.4",
-		"@f5-sales-demo/pi-utils": "19.103.4",
+		"@f5-sales-demo/xcsh-stats": "19.104.0",
+		"@f5-sales-demo/pi-agent-core": "19.104.0",
+		"@f5-sales-demo/pi-ai": "19.104.0",
+		"@f5-sales-demo/pi-natives": "19.104.0",
+		"@f5-sales-demo/pi-resource-management": "19.104.0",
+		"@f5-sales-demo/pi-tui": "19.104.0",
+		"@f5-sales-demo/pi-utils": "19.104.0",
 		"@sinclair/typebox": "^0.34",
 		"@xterm/headless": "^6.0",
 		"ajv": "^8.20",

package/src/config/auto-config.ts

@@ -15,7 +15,7 @@
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { $env, logger, readProviderFromModelsYml } from "@f5-sales-demo/pi-utils";
+import { $env, isEnoent, logger, readProviderFromModelsYml } from "@f5-sales-demo/pi-utils";
 import { DEFAULT_MODEL_ROLE } from "./settings-schema";
 
 /** Current config schema version. Bump when the generated format changes. */
@@ -81,6 +81,17 @@ export function generateModelsYml(baseUrl: string, options?: GenerateModelsYmlOp
 	return lines.join("\n");
 }
 
+/** Persist models.yml with owner-only permissions because it may contain a literal proxy credential. */
+export async function writeLiteLLMModelsYml(filePath: string, content: string): Promise<void> {
+	await fs.promises.mkdir(path.dirname(filePath), { recursive: true, mode: 0o700 });
+	try {
+		await fs.promises.chmod(filePath, 0o600);
+	} catch (error) {
+		if (!isEnoent(error)) throw error;
+	}
+	await fs.promises.writeFile(filePath, content, { encoding: "utf-8", mode: 0o600 });
+}
+
 export interface LiteLLMConfig {
 	baseUrl: string;
 	apiKey: string;

package/src/internal-urls/build-info.generated.ts

@@ -17,17 +17,17 @@ export interface BuildInfo {
 }
 
 export const BUILD_INFO: BuildInfo = {
-	"version": "19.103.4",
-	"commit": "6645553ffbc502c2516e744745247a4876580191",
-	"shortCommit": "6645553",
+	"version": "19.104.0",
+	"commit": "f07ee3a993f88e57cd1b44eb586f1ea527b63e27",
+	"shortCommit": "f07ee3a",
 	"branch": "main",
-	"tag": "v19.103.4",
-	"commitDate": "2026-07-31T13:09:45Z",
-	"buildDate": "2026-07-31T13:41:54.471Z",
+	"tag": "v19.104.0",
+	"commitDate": "2026-07-31T13:40:17Z",
+	"buildDate": "2026-07-31T14:12:51.834Z",
 	"dirty": true,
 	"prNumber": "",
 	"repoUrl": "https://github.com/f5-sales-demo/xcsh",
 	"repoSlug": "f5-sales-demo/xcsh",
-	"commitUrl": "https://github.com/f5-sales-demo/xcsh/commit/6645553ffbc502c2516e744745247a4876580191",
-	"releaseUrl": "https://github.com/f5-sales-demo/xcsh/releases/tag/v19.103.4"
+	"commitUrl": "https://github.com/f5-sales-demo/xcsh/commit/f07ee3a993f88e57cd1b44eb586f1ea527b63e27",
+	"releaseUrl": "https://github.com/f5-sales-demo/xcsh/releases/tag/v19.104.0"
 };

package/src/modes/components/index.ts

@@ -15,6 +15,7 @@ export * from "./hook-input";
 export * from "./hook-message";
 export * from "./hook-selector";
 export * from "./keybinding-hints";
+export * from "./litellm-model-selector";
 export * from "./login-dialog";
 export * from "./model-selector";
 export * from "./oauth-selector";

package/src/modes/components/litellm-model-selector.ts

@@ -0,0 +1,40 @@
+import { Container, type SelectItem, SelectList, Spacer, Text } from "@f5-sales-demo/pi-tui";
+import type { LiteLLMLoginModelChoice } from "../controllers/login-model";
+import { getSelectListTheme } from "../theme/theme";
+import { DynamicBorder } from "./dynamic-border";
+
+export class LiteLLMModelSelectorComponent extends Container {
+	#selectList: SelectList;
+
+	constructor(
+		choices: readonly LiteLLMLoginModelChoice[],
+		onSelect: (choice: LiteLLMLoginModelChoice) => void,
+		onCancel: () => void,
+	) {
+		super();
+
+		const items: SelectItem[] = choices.map(choice => ({
+			value: `${choice.provider}/${choice.modelId}`,
+			label: choice.label,
+			description: choice.description,
+		}));
+
+		this.addChild(new DynamicBorder());
+		this.addChild(new Spacer(1));
+		this.addChild(new Text("Select your default model:", 1, 0));
+		this.addChild(new Spacer(1));
+		this.#selectList = new SelectList(items, items.length, getSelectListTheme());
+		this.#selectList.onSelect = item => {
+			const choice = choices.find(candidate => `${candidate.provider}/${candidate.modelId}` === item.value);
+			if (choice) onSelect(choice);
+		};
+		this.#selectList.onCancel = onCancel;
+		this.addChild(this.#selectList);
+		this.addChild(new Spacer(1));
+		this.addChild(new DynamicBorder());
+	}
+
+	getSelectList(): SelectList {
+		return this.#selectList;
+	}
+}

package/src/modes/controllers/login-model.ts

@@ -1,32 +1,66 @@
+import { ThinkingLevel } from "@f5-sales-demo/pi-agent-core";
 import type { Model } from "@f5-sales-demo/pi-ai";
 
+export interface LiteLLMLoginModelChoice {
+	label: string;
+	description: string;
+	provider: "anthropic" | "litellm";
+	modelId: "claude-opus-5" | "gpt-5.6-sol";
+	thinkingLevel: ThinkingLevel;
+}
+
+export const LITELLM_LOGIN_MODEL_CHOICES: readonly LiteLLMLoginModelChoice[] = [
+	{
+		label: "GPT-5.6 Sol",
+		description: "OpenAI-compatible model with high reasoning",
+		provider: "litellm",
+		modelId: "gpt-5.6-sol",
+		thinkingLevel: ThinkingLevel.High,
+	},
+	{
+		label: "Claude Opus 5",
+		description: "Anthropic Messages model with high reasoning",
+		provider: "anthropic",
+		modelId: "claude-opus-5",
+		thinkingLevel: ThinkingLevel.High,
+	},
+];
+
+export function getAvailableLiteLLMLoginModelChoices(availableModelIds: readonly string[]): LiteLLMLoginModelChoice[] {
+	const available = new Set(availableModelIds);
+	return LITELLM_LOGIN_MODEL_CHOICES.filter(choice => available.has(choice.modelId));
+}
+
 /**
  * Minimal session surface needed to apply a model after a successful login.
  * Kept structural so the login flow can call it without pulling in the full
  * AgentSession type, and so it stays trivially unit-testable.
  */
 interface ModelApplicableSession {
-	model: Model | undefined;
 	modelRegistry: { getAll(): Model[] };
-	setModel(model: Model, role: "default", options?: { selector?: string }): Promise<void>;
+	setModel(model: Model, role: "default", options: { selector: string; thinkingLevel: ThinkingLevel }): Promise<void>;
+	setThinkingLevel(level: ThinkingLevel): void;
 }
 
 /**
- * After a successful `/login`, make the freshly-configured provider immediately
- * usable by setting it as the session's default model — but only when the session
- * has no model yet, so we never override a model the user already chose.
+ * After a successful `/login`, apply the model the user explicitly selected as
+ * the active and persisted default model, including its thinking level.
  *
- * Returns true when a model was applied. The login wizard auto-selects a model id
- * from the provider's /models list; resolving it here (post-registry-refresh) is
- * what lets the LLM readiness gate lift without a manual `/model` step.
+ * Returns true when the exact provider/model pair resolves after registry refresh.
  */
 export async function applyModelAfterLogin(
 	session: ModelApplicableSession,
-	selectedModelId: string | undefined,
+	choice: LiteLLMLoginModelChoice,
 ): Promise<boolean> {
-	if (session.model || !selectedModelId) return false;
-	const resolved = session.modelRegistry.getAll().find(m => m.id === selectedModelId);
+	const resolved = session.modelRegistry
+		.getAll()
+		.find(model => model.provider === choice.provider && model.id === choice.modelId);
 	if (!resolved) return false;
-	await session.setModel(resolved, "default", { selector: resolved.id });
+	const selector = `${choice.provider}/${choice.modelId}`;
+	await session.setModel(resolved, "default", {
+		selector,
+		thinkingLevel: choice.thinkingLevel,
+	});
+	session.setThinkingLevel(choice.thinkingLevel);
 	return true;
 }

package/src/modes/controllers/selector-controller.ts

@@ -13,6 +13,7 @@ import {
 	healConfigYmlModelRoles,
 	probeLiteLLMConnection,
 	readLiteLLMConfig,
+	writeLiteLLMModelsYml,
 } from "../../config/auto-config";
 import { getRoleInfo } from "../../config/model-registry";
 import { formatModelSelectorValue } from "../../config/model-resolver";
@@ -46,6 +47,7 @@ import { AssistantMessageComponent } from "../components/assistant-message";
 import { ExtensionDashboard } from "../components/extensions";
 import { GutterBlock } from "../components/gutter-block";
 import { HistorySearchComponent } from "../components/history-search";
+import { LiteLLMModelSelectorComponent } from "../components/litellm-model-selector";
 import { ModelSelectorComponent } from "../components/model-selector";
 import { OAuthSelectorComponent } from "../components/oauth-selector";
 import { PluginSelectorComponent } from "../components/plugin-selector";
@@ -58,7 +60,7 @@ import { ToolExecutionComponent } from "../components/tool-execution";
 import { TreeSelectorComponent } from "../components/tree-selector";
 import { UserMessageSelectorComponent } from "../components/user-message-selector";
 import type { SessionObserverRegistry } from "../session-observer-registry";
-import { applyModelAfterLogin } from "./login-model";
+import { applyModelAfterLogin, getAvailableLiteLLMLoginModelChoices, LITELLM_LOGIN_MODEL_CHOICES } from "./login-model";
 
 const CALLBACK_SERVER_PROVIDERS = new Set<OAuthProvider>([
 	"anthropic",
@@ -472,6 +474,69 @@ export class SelectorController {
 		});
 	}
 
+	async #showLiteLLMLoginModelSelector(availableModelIds: readonly string[]): Promise<boolean> {
+		const choices = getAvailableLiteLLMLoginModelChoices(availableModelIds);
+		const available = new Set(choices.map(choice => choice.modelId));
+		const unavailable = LITELLM_LOGIN_MODEL_CHOICES.filter(choice => !available.has(choice.modelId));
+
+		if (unavailable.length > 0) {
+			this.ctx.chatContainer.addChild(
+				new Text(
+					theme.fg(
+						"warning",
+						`Unavailable from this proxy: ${unavailable.map(choice => choice.label).join(", ")}`,
+					),
+					1,
+					0,
+				),
+			);
+		}
+
+		if (choices.length === 0) {
+			this.ctx.showError("LiteLLM login succeeded, but neither GPT-5.6 Sol nor Claude Opus 5 is available.");
+			return false;
+		}
+
+		const { promise, resolve } = Promise.withResolvers<boolean>();
+		let applying = false;
+		this.showSelector(done => {
+			const selector = new LiteLLMModelSelectorComponent(
+				choices,
+				choice => {
+					if (applying) return;
+					applying = true;
+					void (async () => {
+						try {
+							const applied = await applyModelAfterLogin(this.ctx.session, choice);
+							if (!applied) {
+								this.ctx.showError(`Model unavailable after refresh: ${choice.provider}/${choice.modelId}`);
+								applying = false;
+								return;
+							}
+							this.ctx.statusLine.invalidate();
+							this.ctx.updateEditorBorderColor();
+							done();
+							resolve(true);
+							this.ctx.ui.requestRender();
+						} catch (error) {
+							this.ctx.showError(error instanceof Error ? error.message : String(error));
+							applying = false;
+						}
+					})();
+				},
+				() => {
+					if (applying) return;
+					done();
+					resolve(false);
+					this.ctx.ui.requestRender();
+				},
+			);
+			return { component: selector, focus: selector.getSelectList() };
+		});
+
+		return promise;
+	}
+
 	async showPluginSelector(mode: "install" | "uninstall" = "install"): Promise<void> {
 		const mgr = new MarketplaceManager({
 			marketplacesRegistryPath: getMarketplacesRegistryPath(),
@@ -927,8 +992,7 @@ export class SelectorController {
 				apiBasePath: probe.apiBasePath,
 				apiKeyLiteral: result.apiKey,
 			});
-			fs.mkdirSync(path.dirname(modelsPath), { recursive: true });
-			fs.writeFileSync(modelsPath, yml);
+			await writeLiteLLMModelsYml(modelsPath, yml);
 
 			// Create/heal config.yml for model defaults
 			const configPath = path.join(path.dirname(modelsPath), "config.yml");
@@ -940,11 +1004,24 @@ export class SelectorController {
 			// Force online refresh so the registry re-probes the new proxy
 			// instead of serving stale data from the in-process SQLite cache.
 			await this.ctx.session.modelRegistry.refresh("online");
+			const modelSelected = await this.#showLiteLLMLoginModelSelector(probe.models);
 
 			this.ctx.chatContainer.addChild(new Spacer(1));
 			this.ctx.chatContainer.addChild(
 				new Text(theme.fg("success", `LiteLLM configuration saved to ${modelsPath}`), 1, 0),
 			);
+			this.ctx.chatContainer.addChild(
+				new Text(
+					theme.fg(
+						modelSelected ? "dim" : "warning",
+						modelSelected
+							? "Use /model to switch models without logging in again."
+							: "No model selected. Use /model to choose one without logging in again.",
+					),
+					1,
+					0,
+				),
+			);
 			this.ctx.ui.requestRender();
 		} catch (error: unknown) {
 			this.ctx.showError(`LiteLLM login failed: ${error instanceof Error ? error.message : String(error)}`);
@@ -1143,29 +1220,17 @@ export class SelectorController {
 
 				// Auto-retry once on network errors
 				if (!probe.reachable && probe.error && !/\b(401|403|Unauthorized|Forbidden)\b/i.test(probe.error)) {
-					await new Promise(resolve => setTimeout(resolve, 1000));
+					await Bun.sleep(1000);
 					probe = await probeLiteLLMConnection(baseUrl, apiKey);
 				}
 
 				if (probe.reachable) {
-					// Auto-select best model
-					const preferenceOrder = ["claude-opus", "claude-sonnet", "claude", "gpt-4", "gpt"];
-					let selectedModel: string | undefined;
-					for (const pref of preferenceOrder) {
-						selectedModel = probe.models.find(m => m.toLowerCase().includes(pref));
-						if (selectedModel) break;
-					}
-					if (!selectedModel && probe.models.length > 0) {
-						selectedModel = probe.models[0];
-					}
-
 					// Save config
 					const yml = generateModelsYml(baseUrl, {
 						apiBasePath: probe.apiBasePath,
 						apiKeyLiteral: apiKey,
 					});
-					fs.mkdirSync(path.dirname(modelsPath), { recursive: true, mode: 0o700 });
-					fs.writeFileSync(modelsPath, yml, { mode: 0o600 });
+					await writeLiteLLMModelsYml(modelsPath, yml);
 
 					const configPath = path.join(path.dirname(modelsPath), "config.yml");
 					if (!fs.existsSync(configPath)) {
@@ -1174,10 +1239,13 @@ export class SelectorController {
 					healConfigYmlModelRoles(configPath);
 
 					await this.ctx.session.modelRegistry.refresh("online");
-					// Make the freshly-configured provider usable immediately so the LLM
-					// readiness gate lifts without requiring a manual /model selection.
-					await applyModelAfterLogin(this.ctx.session, selectedModel);
+					const modelSelected = await this.#showLiteLLMLoginModelSelector(probe.models);
 					await this.ctx.refreshWelcomeAfterLogin();
+					this.ctx.showStatus(
+						modelSelected
+							? "LiteLLM configured. Use /model to switch models without logging in again."
+							: "LiteLLM configured. Use /model to select a model.",
+					);
 					probeSuccess = true;
 				} else {
 					const errorMsg = probe.error ?? "connection failed";