@f5-sales-demo/xcsh 19.51.4 → 19.51.5

package/CHANGELOG.md

@@ -2,6 +2,11 @@
 
 ## [Unreleased]
 
+## [19.51.5] - 2026-06-26
+
+### Fixed
+- Sign + notarize the embedded native addon (`pi_natives.*.node`) in `build-sign-macos` **before** it is embedded into the compiled binary. xcsh extracts the embedded `.node` to `~/.xcsh/natives/<ver>/` at runtime; previously that extracted copy was ad-hoc-signed, so managed/MDM Macs blocked the `dlopen` ("could not verify it is free of malware"). The addon is now Developer-ID-signed with hardened runtime and notarized, so Gatekeeper's online check passes it without manual approval.
+
 ## [19.51.4] - 2026-06-26
 
 ### Added

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@f5-sales-demo/xcsh",
-	"version": "19.51.4",
+	"version": "19.51.5",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://github.com/f5-sales-demo/xcsh",
 	"author": "Can Boluk",
@@ -54,13 +54,13 @@
 	"dependencies": {
 		"@agentclientprotocol/sdk": "0.16.1",
 		"@mozilla/readability": "^0.6",
-		"@f5-sales-demo/xcsh-stats": "19.51.3",
-		"@f5-sales-demo/pi-agent-core": "19.51.3",
-		"@f5-sales-demo/pi-ai": "19.51.3",
-		"@f5-sales-demo/pi-natives": "19.51.3",
-		"@f5-sales-demo/pi-resource-management": "19.51.3",
-		"@f5-sales-demo/pi-tui": "19.51.3",
-		"@f5-sales-demo/pi-utils": "19.51.3",
+		"@f5-sales-demo/xcsh-stats": "19.51.4",
+		"@f5-sales-demo/pi-agent-core": "19.51.4",
+		"@f5-sales-demo/pi-ai": "19.51.4",
+		"@f5-sales-demo/pi-natives": "19.51.4",
+		"@f5-sales-demo/pi-resource-management": "19.51.4",
+		"@f5-sales-demo/pi-tui": "19.51.4",
+		"@f5-sales-demo/pi-utils": "19.51.4",
 		"@sinclair/typebox": "^0.34",
 		"@xterm/headless": "^6.0",
 		"ajv": "^8.20",

package/src/internal-urls/build-info.generated.ts

@@ -17,17 +17,17 @@ export interface BuildInfo {
 }
 
 export const BUILD_INFO: BuildInfo = {
-	"version": "19.51.3",
-	"commit": "8a28cb0c84322756aee28ea0aec6e27fa17b92fb",
-	"shortCommit": "8a28cb0",
+	"version": "19.51.4",
+	"commit": "4219192c5e072c0d7d4a54148b38b27b47d520f8",
+	"shortCommit": "4219192",
 	"branch": "main",
-	"tag": "v19.51.4",
-	"commitDate": "2026-06-26T23:17:20Z",
-	"buildDate": "2026-06-26T23:52:22.272Z",
+	"tag": "v19.51.5",
+	"commitDate": "2026-06-27T00:31:04Z",
+	"buildDate": "2026-06-27T01:00:15.899Z",
 	"dirty": true,
 	"prNumber": "",
 	"repoUrl": "https://github.com/f5-sales-demo/xcsh",
 	"repoSlug": "f5-sales-demo/xcsh",
-	"commitUrl": "https://github.com/f5-sales-demo/xcsh/commit/8a28cb0c84322756aee28ea0aec6e27fa17b92fb",
-	"releaseUrl": "https://github.com/f5-sales-demo/xcsh/releases/tag/v19.51.3"
+	"commitUrl": "https://github.com/f5-sales-demo/xcsh/commit/4219192c5e072c0d7d4a54148b38b27b47d520f8",
+	"releaseUrl": "https://github.com/f5-sales-demo/xcsh/releases/tag/v19.51.4"
 };

package/src/modes/components/context-add-wizard.ts

@@ -1,6 +1,6 @@
 import { Container, Input, matchesKey, Spacer, Text, TruncatedText } from "@f5-sales-demo/pi-tui";
 import type { XCSHContext } from "../../services/xcsh-context";
-import { deriveTenantFromUrl } from "../../services/xcsh-env";
+import { deriveTenantFromUrl, isSensitiveEnvKey, XCSH_CONSOLE_PASSWORD, XCSH_USERNAME } from "../../services/xcsh-env";
 import { theme } from "../theme/theme";
 import { matchesAppInterrupt } from "../utils/keybinding-matchers";
 import { DynamicBorder } from "./dynamic-border";
@@ -28,18 +28,57 @@ export function validateWizardName(name: string): string | null {
 	return null;
 }
 
-type WizardStep = "url" | "token" | "name" | "validating" | "namespace" | "confirm" | "activate";
+type WizardStep =
+	| "url"
+	| "token"
+	| "name"
+	| "validating"
+	| "namespace"
+	| "username"
+	| "password"
+	| "confirm"
+	| "activate";
 
 interface WizardState {
 	url: string;
 	token: string;
 	name: string;
 	namespace: string;
+	/** Web-console login username (optional) — stored as the XCSH_USERNAME env var. */
+	username: string;
+	/** Web-console login password (optional) — stored as the XCSH_CONSOLE_PASSWORD env var. */
+	password: string;
+}
+
+/**
+ * Build the XCSHContext the wizard will persist from its collected state.
+ *
+ * The optional web-console credentials become generic env vars (XCSH_USERNAME /
+ * XCSH_CONSOLE_PASSWORD); any secret-looking key (the password) is auto-marked
+ * sensitive so it is masked in `/context show` and redacted on export. Exported
+ * so the persistence shape is unit-testable without driving the TUI.
+ */
+export function buildWizardContext(state: WizardState): XCSHContext {
+	const context: XCSHContext = {
+		name: state.name,
+		apiUrl: state.url,
+		apiToken: state.token,
+		defaultNamespace: state.namespace,
+	};
+	const env: Record<string, string> = {};
+	if (state.username) env[XCSH_USERNAME] = state.username;
+	if (state.password) env[XCSH_CONSOLE_PASSWORD] = state.password;
+	if (Object.keys(env).length > 0) {
+		context.env = env;
+		const sensitiveKeys = Object.keys(env).filter(isSensitiveEnvKey);
+		if (sensitiveKeys.length > 0) context.sensitiveKeys = sensitiveKeys;
+	}
+	return context;
 }
 
 export class ContextAddWizard extends Container {
 	#currentStep: WizardStep = "url";
-	#state: WizardState = { url: "", token: "", name: "", namespace: "default" };
+	#state: WizardState = { url: "", token: "", name: "", namespace: "default", username: "", password: "" };
 	#contentContainer: Container;
 	#inputField: Input | null = null;
 	#selectedIndex = 0;
@@ -104,6 +143,12 @@ export class ContextAddWizard extends Container {
 			case "namespace":
 				this.#renderNamespaceStep();
 				break;
+			case "username":
+				this.#renderUsernameStep();
+				break;
+			case "password":
+				this.#renderPasswordStep();
+				break;
 			case "confirm":
 				this.#renderConfirmStep();
 				break;
@@ -139,6 +184,7 @@ export class ContextAddWizard extends Container {
 		this.#contentContainer.addChild(new Spacer(1));
 
 		this.#inputField = new Input();
+		this.#inputField.setMasked(true);
 		this.#inputField.setValue(this.#state.token);
 		this.#contentContainer.addChild(this.#inputField);
 		this.#contentContainer.addChild(new Spacer(1));
@@ -288,8 +334,41 @@ export class ContextAddWizard extends Container {
 		this.#contentContainer.addChild(new Text(theme.fg("muted", "[Enter to continue, Esc to go back]"), 0, 0));
 	}
 
+	#renderUsernameStep(): void {
+		this.#contentContainer.addChild(new Text(theme.fg("contentAccent", "Step 6: Web-Console Username")));
+		this.#contentContainer.addChild(new Spacer(1));
+		this.#contentContainer.addChild(new Text("Enter the web-console login username (optional):", 0, 0));
+		this.#contentContainer.addChild(new Spacer(1));
+
+		this.#inputField = new Input();
+		this.#inputField.setValue(this.#state.username);
+		this.#contentContainer.addChild(this.#inputField);
+		this.#contentContainer.addChild(new Spacer(1));
+
+		this.#contentContainer.addChild(
+			new Text(theme.fg("muted", "[Enter to continue (empty to skip), Esc to go back]"), 0, 0),
+		);
+	}
+
+	#renderPasswordStep(): void {
+		this.#contentContainer.addChild(new Text(theme.fg("contentAccent", "Step 7: Web-Console Password")));
+		this.#contentContainer.addChild(new Spacer(1));
+		this.#contentContainer.addChild(new Text("Enter the web-console login password (optional):", 0, 0));
+		this.#contentContainer.addChild(new Spacer(1));
+
+		this.#inputField = new Input();
+		this.#inputField.setMasked(true);
+		this.#inputField.setValue(this.#state.password);
+		this.#contentContainer.addChild(this.#inputField);
+		this.#contentContainer.addChild(new Spacer(1));
+
+		this.#contentContainer.addChild(
+			new Text(theme.fg("muted", "[Enter to continue (empty to skip), Esc to go back]"), 0, 0),
+		);
+	}
+
 	#renderConfirmStep(): void {
-		this.#contentContainer.addChild(new Text(theme.fg("contentAccent", "Step 6: Confirm")));
+		this.#contentContainer.addChild(new Text(theme.fg("contentAccent", "Step 8: Confirm")));
 		this.#contentContainer.addChild(new Spacer(1));
 
 		// Summary table
@@ -298,6 +377,12 @@ export class ContextAddWizard extends Container {
 		const masked = this.#state.token.length > 4 ? `${"*".repeat(8)}${this.#state.token.slice(-4)}` : "****";
 		this.#contentContainer.addChild(new Text(`Token: ${masked}`, 0, 0));
 		this.#contentContainer.addChild(new Text(`Namespace: ${this.#state.namespace}`, 0, 0));
+		if (this.#state.username) {
+			this.#contentContainer.addChild(new Text(`Username: ${this.#state.username}`, 0, 0));
+		}
+		if (this.#state.password) {
+			this.#contentContainer.addChild(new Text(`Console Password: ${"*".repeat(8)}`, 0, 0));
+		}
 		this.#contentContainer.addChild(new Spacer(1));
 
 		this.#contentContainer.addChild(new Text("Save this context?", 0, 0));
@@ -318,7 +403,7 @@ export class ContextAddWizard extends Container {
 	}
 
 	#renderActivateStep(): void {
-		this.#contentContainer.addChild(new Text(theme.fg("contentAccent", "Step 7: Activate")));
+		this.#contentContainer.addChild(new Text(theme.fg("contentAccent", "Step 9: Activate")));
 		this.#contentContainer.addChild(new Spacer(1));
 		this.#contentContainer.addChild(new Text("Activate this context now?", 0, 0));
 		this.#contentContainer.addChild(new Spacer(1));
@@ -436,6 +521,19 @@ export class ContextAddWizard extends Container {
 			}
 			case "namespace": {
 				this.#state.namespace = value || "default";
+				this.#currentStep = "username";
+				break;
+			}
+			case "username": {
+				// Trimmed: usernames never carry meaningful surrounding whitespace.
+				this.#state.username = value;
+				this.#currentStep = "password";
+				break;
+			}
+			case "password": {
+				// Preserve the password exactly as typed — do NOT use the trimmed
+				// `value`, since a password may legitimately contain whitespace.
+				this.#state.password = this.#inputField.getValue();
 				this.#currentStep = "confirm";
 				this.#selectedIndex = 0;
 				break;
@@ -477,12 +575,7 @@ export class ContextAddWizard extends Container {
 				return;
 			}
 			case "activate": {
-				const context: XCSHContext = {
-					name: this.#state.name,
-					apiUrl: this.#state.url,
-					apiToken: this.#state.token,
-					defaultNamespace: this.#state.namespace,
-				};
+				const context = buildWizardContext(this.#state);
 				this.#onCompleteCallback(context, this.#selectedIndex === 0);
 				return;
 			}
@@ -521,9 +614,15 @@ export class ContextAddWizard extends Container {
 			case "namespace":
 				this.#currentStep = "name";
 				break;
-			case "confirm":
+			case "username":
 				this.#currentStep = "namespace";
 				break;
+			case "password":
+				this.#currentStep = "username";
+				break;
+			case "confirm":
+				this.#currentStep = "password";
+				break;
 			case "activate":
 				this.#currentStep = "confirm";
 				break;