@f5-sales-demo/xcsh 19.105.2 → 19.105.4

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 ## [Unreleased]
 
+### Fixed
+
+- Regenerated stale same-version release PRs when newer commits have merged into `main` ([#2727](https://github.com/f5-sales-demo/xcsh/issues/2727))
+
+## [19.105.3] - 2026-07-31
+
+### Fixed
+
+- Removed Biome findings from generated Site CLI transport descriptions ([#2715](https://github.com/f5-sales-demo/xcsh/issues/2715))
+- Restricted LiteLLM `models.yml` setup, auto-fix, discovery-upgrade, and backup writes to owner-only permissions ([#2713](https://github.com/f5-sales-demo/xcsh/issues/2713))
+- Fixed `--no-tools` print requests forcing inactive `todo_write` through eager-todo enforcement ([#2711](https://github.com/f5-sales-demo/xcsh/issues/2711))
+
 ## [19.105.1] - 2026-07-31
 
 ### Fixed

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@f5-sales-demo/xcsh",
-	"version": "19.105.2",
+	"version": "19.105.4",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://github.com/f5-sales-demo/xcsh",
 	"author": "Can Boluk",
@@ -57,13 +57,13 @@
 	"dependencies": {
 		"@agentclientprotocol/sdk": "1.3.0",
 		"@mozilla/readability": "^0.6",
-		"@f5-sales-demo/xcsh-stats": "19.105.2",
-		"@f5-sales-demo/pi-agent-core": "19.105.2",
-		"@f5-sales-demo/pi-ai": "19.105.2",
-		"@f5-sales-demo/pi-natives": "19.105.2",
-		"@f5-sales-demo/pi-resource-management": "19.105.2",
-		"@f5-sales-demo/pi-tui": "19.105.2",
-		"@f5-sales-demo/pi-utils": "19.105.2",
+		"@f5-sales-demo/xcsh-stats": "19.105.4",
+		"@f5-sales-demo/pi-agent-core": "19.105.4",
+		"@f5-sales-demo/pi-ai": "19.105.4",
+		"@f5-sales-demo/pi-natives": "19.105.4",
+		"@f5-sales-demo/pi-resource-management": "19.105.4",
+		"@f5-sales-demo/pi-tui": "19.105.4",
+		"@f5-sales-demo/pi-utils": "19.105.4",
 		"@sinclair/typebox": "^0.34",
 		"@xterm/headless": "^6.0",
 		"ajv": "^8.20",

package/src/config/auto-config.ts

@@ -20,6 +20,8 @@ import { DEFAULT_MODEL_ROLE } from "./settings-schema";
 
 /** Current config schema version. Bump when the generated format changes. */
 export const CURRENT_CONFIG_VERSION = 2;
+const LITELLM_CONFIG_DIR_MODE = 0o700;
+const LITELLM_MODELS_FILE_MODE = 0o600;
 
 // ---------------------------------------------------------------------------
 // Detection
@@ -83,13 +85,13 @@ export function generateModelsYml(baseUrl: string, options?: GenerateModelsYmlOp
 
 /** Persist models.yml with owner-only permissions because it may contain a literal proxy credential. */
 export async function writeLiteLLMModelsYml(filePath: string, content: string): Promise<void> {
-	await fs.promises.mkdir(path.dirname(filePath), { recursive: true, mode: 0o700 });
+	await fs.promises.mkdir(path.dirname(filePath), { recursive: true, mode: LITELLM_CONFIG_DIR_MODE });
 	try {
-		await fs.promises.chmod(filePath, 0o600);
+		await fs.promises.chmod(filePath, LITELLM_MODELS_FILE_MODE);
 	} catch (error) {
 		if (!isEnoent(error)) throw error;
 	}
-	await fs.promises.writeFile(filePath, content, { encoding: "utf-8", mode: 0o600 });
+	await fs.promises.writeFile(filePath, content, { encoding: "utf-8", mode: LITELLM_MODELS_FILE_MODE });
 }
 
 export interface LiteLLMConfig {
@@ -217,15 +219,13 @@ export function readApiKeyLiteral(modelsPath: string): string | undefined {
 	return undefined;
 }
 
-/** Create a .bak backup of a file if it exists. Returns true if backed up. */
-function backupIfExists(filePath: string): boolean {
+/** Create an owner-only .bak backup of models.yml. Returns true if backed up. */
+function backupModelsConfigIfExists(filePath: string): boolean {
+	const backupPath = `${filePath}.bak`;
 	try {
-		if (fs.existsSync(filePath)) {
-			fs.copyFileSync(filePath, `${filePath}.bak`);
-			return true;
-		}
+		return safeWriteModelsConfig(backupPath, fs.readFileSync(filePath));
 	} catch (err) {
-		logger.warn("Failed to create backup", { filePath, err });
+		if (!isEnoent(err)) logger.warn("Failed to create backup", { filePath, err });
 	}
 	return false;
 }
@@ -242,6 +242,23 @@ function safeWrite(filePath: string, content: string): boolean {
 	}
 }
 
+/** Write models.yml content without ever exposing it through group/world-readable permissions. */
+function safeWriteModelsConfig(filePath: string, content: string | Uint8Array): boolean {
+	try {
+		fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: LITELLM_CONFIG_DIR_MODE });
+		try {
+			fs.chmodSync(filePath, LITELLM_MODELS_FILE_MODE);
+		} catch (err) {
+			if (!isEnoent(err)) throw err;
+		}
+		fs.writeFileSync(filePath, content, { encoding: "utf-8", mode: LITELLM_MODELS_FILE_MODE });
+		return true;
+	} catch (err) {
+		logger.warn("Failed to write LiteLLM models config", { filePath, err });
+		return false;
+	}
+}
+
 /** Remove the model cache database so discovery re-runs fresh. */
 function clearModelCache(modelsPath: string): void {
 	const cacheDbPath = path.join(path.dirname(modelsPath), "models.db");
@@ -367,7 +384,7 @@ export function tryAutoConfigLiteLLM(modelsPath: string): boolean {
 	const baseUrl = getLiteLLMBaseUrl();
 	if (!baseUrl) return false;
 
-	if (!safeWrite(modelsPath, generateModelsYml(baseUrl))) return false;
+	if (!safeWriteModelsConfig(modelsPath, generateModelsYml(baseUrl))) return false;
 	logger.debug("Auto-configured LiteLLM proxy", { modelsPath, baseUrl });
 
 	// Write config.yml if it doesn't exist, or heal it if it's missing modelRoles
@@ -501,10 +518,10 @@ export function autoFixModelsConfig(modelsPath: string): FixResult {
 
 	const existingLiteralKey = readApiKeyLiteral(modelsPath);
 
-	backupIfExists(modelsPath);
+	backupModelsConfigIfExists(modelsPath);
 
 	if (
-		!safeWrite(
+		!safeWriteModelsConfig(
 			modelsPath,
 			generateModelsYml(baseUrl, {
 				...(existingLiteralKey ? { apiKeyLiteral: existingLiteralKey } : {}),
@@ -688,12 +705,12 @@ export async function probeAndUpgradeLiteLLMConfig(
 
 	// Upgrade: backup and regenerate with correct base path, preserving literal keys
 	const existingLiteralKey = readApiKeyLiteral(modelsPath);
-	backupIfExists(modelsPath);
+	backupModelsConfigIfExists(modelsPath);
 	const newContent = generateModelsYml(baseUrl, {
 		apiBasePath: probe.apiBasePath,
 		...(existingLiteralKey ? { apiKeyLiteral: existingLiteralKey } : {}),
 	});
-	if (!safeWrite(modelsPath, newContent)) {
+	if (!safeWriteModelsConfig(modelsPath, newContent)) {
 		return false;
 	}
 

package/src/internal-urls/build-info.generated.ts

@@ -17,17 +17,17 @@ export interface BuildInfo {
 }
 
 export const BUILD_INFO: BuildInfo = {
-	"version": "19.105.2",
-	"commit": "3393e245e239a6aa875c405931a8814b1acb26a4",
-	"shortCommit": "3393e24",
+	"version": "19.105.4",
+	"commit": "c2e7e7b8b1853d1bde35b70e8f34765e895fa54e",
+	"shortCommit": "c2e7e7b",
 	"branch": "main",
-	"tag": "v19.105.2",
-	"commitDate": "2026-07-31T16:38:06Z",
-	"buildDate": "2026-07-31T17:06:38.688Z",
+	"tag": "v19.105.4",
+	"commitDate": "2026-07-31T17:41:55Z",
+	"buildDate": "2026-07-31T18:14:15.917Z",
 	"dirty": true,
 	"prNumber": "",
 	"repoUrl": "https://github.com/f5-sales-demo/xcsh",
 	"repoSlug": "f5-sales-demo/xcsh",
-	"commitUrl": "https://github.com/f5-sales-demo/xcsh/commit/3393e245e239a6aa875c405931a8814b1acb26a4",
-	"releaseUrl": "https://github.com/f5-sales-demo/xcsh/releases/tag/v19.105.2"
+	"commitUrl": "https://github.com/f5-sales-demo/xcsh/commit/c2e7e7b8b1853d1bde35b70e8f34765e895fa54e",
+	"releaseUrl": "https://github.com/f5-sales-demo/xcsh/releases/tag/v19.105.4"
 };

package/src/internal-urls/xcsh-protocol.ts

@@ -668,10 +668,10 @@ export class InternalDocsProtocolHandler implements ProtocolHandler {
 						...(entry.example ? [`- example argument: \`${entry.example}\``] : []),
 						"",
 						entry.transport === "global-get"
-							? "GLOBAL scope: GET .../vpm/debug/global/" + subpath + " — NOT reachable via exec-user."
+							? `GLOBAL scope: GET .../vpm/debug/global/${subpath} — NOT reachable via exec-user.`
 							: entry.transport === "exec"
 								? "Exec tier: privileged and mutating. Do not run speculatively."
-								: 'POST .../vpm/debug/{node}/exec-user with {"command":["' + subpath + '", ...]}.',
+								: `POST .../vpm/debug/{node}/exec-user with {"command":["${subpath}", ...]}.`,
 					].join("\n")
 				: `Unknown Site CLI command: ${subpath}\n\nRead xcsh://sitecli for the full list (build ${build}).`;
 		}

package/src/session/agent-session.ts

@@ -4391,7 +4391,7 @@ export class AgentSession {
 			return undefined;
 		}
 
-		if (!this.#toolRegistry.has("todo_write")) {
+		if (!this.agent.state.tools.some(tool => tool.name === "todo_write")) {
 			logger.warn("Eager todo enforcement skipped because todo_write is unavailable", {
 				activeToolNames: this.agent.state.tools.map(tool => tool.name),
 			});