@f5-sales-demo/xcsh 19.105.6 → 19.105.7

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## [Unreleased]
 
+## [19.105.7] - 2026-07-31
+
+### Fixed
+
+- Fixed exact `provider/model` searches in `/model` and restricted global agent configuration writes to owner-only permissions ([#2741](https://github.com/f5-sales-demo/xcsh/issues/2741))
+
 ## [19.105.6] - 2026-07-31
 
 ### Breaking Changes

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@f5-sales-demo/xcsh",
-	"version": "19.105.6",
+	"version": "19.105.7",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://github.com/f5-sales-demo/xcsh",
 	"author": "Can Boluk",
@@ -57,13 +57,13 @@
 	"dependencies": {
 		"@agentclientprotocol/sdk": "1.3.0",
 		"@mozilla/readability": "^0.6",
-		"@f5-sales-demo/xcsh-stats": "19.105.6",
-		"@f5-sales-demo/pi-agent-core": "19.105.6",
-		"@f5-sales-demo/pi-ai": "19.105.6",
-		"@f5-sales-demo/pi-natives": "19.105.6",
-		"@f5-sales-demo/pi-resource-management": "19.105.6",
-		"@f5-sales-demo/pi-tui": "19.105.6",
-		"@f5-sales-demo/pi-utils": "19.105.6",
+		"@f5-sales-demo/xcsh-stats": "19.105.7",
+		"@f5-sales-demo/pi-agent-core": "19.105.7",
+		"@f5-sales-demo/pi-ai": "19.105.7",
+		"@f5-sales-demo/pi-natives": "19.105.7",
+		"@f5-sales-demo/pi-resource-management": "19.105.7",
+		"@f5-sales-demo/pi-tui": "19.105.7",
+		"@f5-sales-demo/pi-utils": "19.105.7",
 		"@sinclair/typebox": "^0.34",
 		"@xterm/headless": "^6.0",
 		"ajv": "^8.20",

package/src/config/agent-config-file.ts

@@ -0,0 +1,34 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { isEnoent } from "@f5-sales-demo/pi-utils";
+
+const AGENT_CONFIG_DIR_MODE = 0o700;
+const AGENT_CONFIG_FILE_MODE = 0o600;
+
+export function hardenAgentConfigFileSync(filePath: string): void {
+	try {
+		fs.chmodSync(filePath, AGENT_CONFIG_FILE_MODE);
+	} catch (error) {
+		if (!isEnoent(error)) throw error;
+	}
+}
+
+export async function hardenAgentConfigFile(filePath: string): Promise<void> {
+	try {
+		await fs.promises.chmod(filePath, AGENT_CONFIG_FILE_MODE);
+	} catch (error) {
+		if (!isEnoent(error)) throw error;
+	}
+}
+
+export function writeAgentConfigFileSync(filePath: string, content: string): void {
+	fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: AGENT_CONFIG_DIR_MODE });
+	hardenAgentConfigFileSync(filePath);
+	fs.writeFileSync(filePath, content, { encoding: "utf-8", mode: AGENT_CONFIG_FILE_MODE });
+}
+
+export async function writeAgentConfigFile(filePath: string, content: string): Promise<void> {
+	await fs.promises.mkdir(path.dirname(filePath), { recursive: true, mode: AGENT_CONFIG_DIR_MODE });
+	await hardenAgentConfigFile(filePath);
+	await fs.promises.writeFile(filePath, content, { encoding: "utf-8", mode: AGENT_CONFIG_FILE_MODE });
+}

package/src/config/auto-config.ts

@@ -16,6 +16,7 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { $env, isEnoent, logger, readProviderFromModelsYml } from "@f5-sales-demo/pi-utils";
+import { hardenAgentConfigFileSync, writeAgentConfigFileSync } from "./agent-config-file";
 import { DEFAULT_MODEL_ROLE } from "./settings-schema";
 
 /** Current config schema version. Bump when the generated format changes. */
@@ -189,6 +190,7 @@ const UNRESOLVABLE_DEFAULT_PROVIDER_PREFIXES = ["bench-instant/"];
  */
 export function healConfigYmlModelRoles(configPath: string): void {
 	try {
+		hardenAgentConfigFileSync(configPath);
 		const content = fs.readFileSync(configPath, "utf-8");
 		if (!content.includes("modelRoles:")) return; // binary default applies
 		const defaultLine = /^(\s*)default:\s*(\S+)\s*$/m;
@@ -197,7 +199,7 @@ export function healConfigYmlModelRoles(configPath: string): void {
 			const [, indent, value] = match;
 			if (UNRESOLVABLE_DEFAULT_PROVIDER_PREFIXES.some(prefix => value.startsWith(prefix))) {
 				const healed = content.replace(defaultLine, `${indent}default: ${DEFAULT_MODEL_ROLE_VALUE}`);
-				fs.writeFileSync(configPath, healed);
+				writeAgentConfigFileSync(configPath, healed);
 				logger.debug("Healed config.yml: replaced unresolvable default modelRole", {
 					configPath,
 					previous: value,
@@ -244,8 +246,7 @@ function backupModelsConfigIfExists(filePath: string): boolean {
 /** Safely write a file, creating parent directories. */
 function safeWrite(filePath: string, content: string): boolean {
 	try {
-		fs.mkdirSync(path.dirname(filePath), { recursive: true });
-		fs.writeFileSync(filePath, content, "utf-8");
+		writeAgentConfigFileSync(filePath, content);
 		return true;
 	} catch (err) {
 		logger.warn("Failed to write config file", { filePath, err });

package/src/config/settings.ts

@@ -35,6 +35,7 @@ import {
 } from "../modes/theme/theme";
 import { AgentStorage } from "../session/agent-storage";
 import { type EditMode, normalizeEditMode } from "../utils/edit-mode";
+import { hardenAgentConfigFile, writeAgentConfigFile } from "./agent-config-file";
 import { withFileLock } from "./file-lock";
 import {
 	type BashInterceptorRule,
@@ -421,6 +422,7 @@ export class Settings {
 
 			// Migrate from legacy formats if needed
 			await this.#migrateFromLegacy();
+			await hardenAgentConfigFile(this.#configPath!);
 
 			// Load global settings from config.yml
 			this.#global = await this.#loadYaml(this.#configPath!);
@@ -504,7 +506,7 @@ export class Settings {
 		// 3. Write merged settings
 		if (migrated && Object.keys(settings).length > 0) {
 			try {
-				await Bun.write(this.#configPath, YAML.stringify(settings, null, 2));
+				await writeAgentConfigFile(this.#configPath, YAML.stringify(settings, null, 2));
 				logger.debug("Settings: migrated to config.yml", { path: this.#configPath });
 			} catch {}
 		}
@@ -592,7 +594,7 @@ export class Settings {
 
 				// Update our global with any external changes we preserved
 				this.#global = current;
-				await Bun.write(configPath, YAML.stringify(this.#global, null, 2));
+				await writeAgentConfigFile(configPath, YAML.stringify(this.#global, null, 2));
 			});
 		} catch (error) {
 			logger.warn("Settings: save failed", { error: String(error) });

package/src/internal-urls/build-info.generated.ts

@@ -17,17 +17,17 @@ export interface BuildInfo {
 }
 
 export const BUILD_INFO: BuildInfo = {
-	"version": "19.105.6",
-	"commit": "6e89ab2a2b5debd13ff9fd062afcff3b904a3abe",
-	"shortCommit": "6e89ab2",
+	"version": "19.105.7",
+	"commit": "83933f6196f53de668879a65f27dad74176403f5",
+	"shortCommit": "83933f6",
 	"branch": "main",
-	"tag": "v19.105.6",
-	"commitDate": "2026-07-31T20:15:01Z",
-	"buildDate": "2026-07-31T20:37:30.839Z",
+	"tag": "v19.105.7",
+	"commitDate": "2026-07-31T21:30:21Z",
+	"buildDate": "2026-07-31T21:51:19.386Z",
 	"dirty": true,
 	"prNumber": "",
 	"repoUrl": "https://github.com/f5-sales-demo/xcsh",
 	"repoSlug": "f5-sales-demo/xcsh",
-	"commitUrl": "https://github.com/f5-sales-demo/xcsh/commit/6e89ab2a2b5debd13ff9fd062afcff3b904a3abe",
-	"releaseUrl": "https://github.com/f5-sales-demo/xcsh/releases/tag/v19.105.6"
+	"commitUrl": "https://github.com/f5-sales-demo/xcsh/commit/83933f6196f53de668879a65f27dad74176403f5",
+	"releaseUrl": "https://github.com/f5-sales-demo/xcsh/releases/tag/v19.105.7"
 };

package/src/modes/components/model-selector.ts

@@ -539,7 +539,11 @@ export class ModelSelectorComponent extends Container {
 				this.#sortCanonicalModels(fuzzyMatches);
 				this.#filteredCanonicalModels = fuzzyMatches;
 			} else {
-				const fuzzyMatches = fuzzyFilter(baseModels, query, ({ id, provider }) => `${id} ${provider}`);
+				const fuzzyMatches = fuzzyFilter(
+					baseModels,
+					query,
+					({ id, model, provider, selector }) => `${selector} ${id} ${provider} ${model.name}`,
+				);
 				this.#sortModels(fuzzyMatches);
 				this.#filteredModels = fuzzyMatches;
 			}

package/src/modes/controllers/selector-controller.ts

@@ -7,6 +7,7 @@ import type { Component } from "@f5-sales-demo/pi-tui";
 import { Input, Loader, Spacer, Text } from "@f5-sales-demo/pi-tui";
 import { getAgentDbPath, getAgentDir, getConfigDirName, getProjectDir, t } from "@f5-sales-demo/pi-utils";
 import { invalidate as invalidateFsCache } from "../../capability/fs";
+import { writeAgentConfigFileSync } from "../../config/agent-config-file";
 import {
 	generateConfigYml,
 	generateModelsYml,
@@ -997,7 +998,7 @@ export class SelectorController {
 			// Create/heal config.yml for model defaults
 			const configPath = path.join(path.dirname(modelsPath), "config.yml");
 			if (!fs.existsSync(configPath)) {
-				fs.writeFileSync(configPath, generateConfigYml());
+				writeAgentConfigFileSync(configPath, generateConfigYml());
 			}
 			healConfigYmlModelRoles(configPath);
 
@@ -1234,7 +1235,7 @@ export class SelectorController {
 
 					const configPath = path.join(path.dirname(modelsPath), "config.yml");
 					if (!fs.existsSync(configPath)) {
-						fs.writeFileSync(configPath, generateConfigYml());
+						writeAgentConfigFileSync(configPath, generateConfigYml());
 					}
 					healConfigYmlModelRoles(configPath);