@f5-sales-demo/xcsh 19.51.4 → 19.51.6

package/CHANGELOG.md

@@ -2,6 +2,11 @@
 
 ## [Unreleased]
 
+## [19.51.5] - 2026-06-26
+
+### Fixed
+- Sign + notarize the embedded native addon (`pi_natives.*.node`) in `build-sign-macos` **before** it is embedded into the compiled binary. xcsh extracts the embedded `.node` to `~/.xcsh/natives/<ver>/` at runtime; previously that extracted copy was ad-hoc-signed, so managed/MDM Macs blocked the `dlopen` ("could not verify it is free of malware"). The addon is now Developer-ID-signed with hardened runtime and notarized, so Gatekeeper's online check passes it without manual approval.
+
 ## [19.51.4] - 2026-06-26
 
 ### Added

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@f5-sales-demo/xcsh",
-	"version": "19.51.4",
+	"version": "19.51.6",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://github.com/f5-sales-demo/xcsh",
 	"author": "Can Boluk",
@@ -54,13 +54,13 @@
 	"dependencies": {
 		"@agentclientprotocol/sdk": "0.16.1",
 		"@mozilla/readability": "^0.6",
-		"@f5-sales-demo/xcsh-stats": "19.51.3",
-		"@f5-sales-demo/pi-agent-core": "19.51.3",
-		"@f5-sales-demo/pi-ai": "19.51.3",
-		"@f5-sales-demo/pi-natives": "19.51.3",
-		"@f5-sales-demo/pi-resource-management": "19.51.3",
-		"@f5-sales-demo/pi-tui": "19.51.3",
-		"@f5-sales-demo/pi-utils": "19.51.3",
+		"@f5-sales-demo/xcsh-stats": "19.51.4",
+		"@f5-sales-demo/pi-agent-core": "19.51.4",
+		"@f5-sales-demo/pi-ai": "19.51.4",
+		"@f5-sales-demo/pi-natives": "19.51.4",
+		"@f5-sales-demo/pi-resource-management": "19.51.4",
+		"@f5-sales-demo/pi-tui": "19.51.4",
+		"@f5-sales-demo/pi-utils": "19.51.6",
 		"@sinclair/typebox": "^0.34",
 		"@xterm/headless": "^6.0",
 		"ajv": "^8.20",

package/src/browser/extension-bridge.ts

@@ -1,8 +1,5 @@
 import { randomUUID } from "node:crypto";
-import * as fs from "node:fs";
-import * as os from "node:os";
-import * as path from "node:path";
-import type { Socket, UnixSocketListener } from "bun";
+import type { Server, ServerWebSocket } from "bun";
 
 export interface ToolResult {
 	content: unknown;
@@ -59,21 +56,36 @@ export class PendingRequests {
 
 const DEFAULT_TIMEOUT_MS = 30_000;
 
-type BridgeData = { buf: string };
+/** Default loopback port for the extension WebSocket bridge. */
+export const DEFAULT_PORT = 19222;
+
+/** Resolve the bridge port from an explicit value, then `XCSH_BRIDGE_PORT`, then the default. */
+export function resolvePort(port?: number): number {
+	if (typeof port === "number" && Number.isFinite(port) && port > 0) return port;
+	const env = Number(process.env.XCSH_BRIDGE_PORT);
+	if (Number.isFinite(env) && env > 0) return env;
+	return DEFAULT_PORT;
+}
 
 /**
- * Unix-socket server bridging xcsh to the Chrome extension's native-messaging
- * host. Speaks newline-delimited JSON: requests `{type:"tool_request",...}`,
- * replies `{type:"tool_result",...}`, plus `{type:"ping"|"pong"}`. Tracks a
- * single connected client and correlates replies via {@link PendingRequests}.
+ * Loopback WebSocket server bridging xcsh to the Chrome extension. Speaks JSON
+ * over WS frames: requests `{type:"tool_request",...}`, replies
+ * `{type:"tool_result",...}`, plus `{type:"ping"|"pong"}`. Tracks a single
+ * connected client (a new connection replaces the prior one) and correlates
+ * replies via {@link PendingRequests}.
  */
 export class BridgeServer {
 	#pending = new PendingRequests();
-	#listener: UnixSocketListener<BridgeData> | null = null;
-	#client: Socket<BridgeData> | null = null;
+	#server: Server<undefined> | null = null;
+	#client: ServerWebSocket<undefined> | null = null;
 	#onConnected: Array<() => void> = [];
 	#onDisconnected: Array<() => void> = [];
 
+	/** The port the WebSocket server is listening on (0 = not bound). */
+	get port(): number {
+		return this.#server?.port ?? 0;
+	}
+
 	get connected(): boolean {
 		return this.#client !== null;
 	}
@@ -86,44 +98,47 @@ export class BridgeServer {
 		this.#onDisconnected.push(cb);
 	}
 
-	/** Bind the server to a Unix socket path. Called by {@link startBridgeServer}. */
-	listen(socketPath: string): void {
-		this.#listener = Bun.listen<BridgeData>({
-			unix: socketPath,
-			socket: {
-				open: socket => {
-					socket.data = { buf: "" };
-					this.#client = socket;
+	/** Bind the WebSocket server to a loopback port. Called by {@link startBridgeServer}. */
+	listen(port: number, opts?: { skipOriginCheck?: boolean }): void {
+		this.#server = Bun.serve({
+			port,
+			hostname: "127.0.0.1",
+			fetch: (req, server) => {
+				// Validate the Origin header: only the xcsh Chrome extension may connect.
+				// This restores the access-control guarantee that the Unix socket's 0o600
+				// permissions previously provided.
+				if (!opts?.skipOriginCheck) {
+					const origin = req.headers.get("origin") ?? "";
+					const { EXTENSION_ID } = require("../cli/chrome-cli");
+					if (origin !== `chrome-extension://${EXTENSION_ID}`) {
+						return new Response("Forbidden", { status: 403 });
+					}
+				}
+				if (server.upgrade(req)) return undefined;
+				return new Response("xcsh bridge: WebSocket only", { status: 426 });
+			},
+			websocket: {
+				open: ws => {
+					// One client at a time: close any prior connection on a new connect.
+					if (this.#client && this.#client !== ws) this.#client.close();
+					this.#client = ws;
 					for (const cb of this.#onConnected) cb();
 				},
-				data: (socket, chunk) => {
-					this.#onData(socket, chunk);
-				},
-				close: socket => {
-					this.#onClose(socket);
+				message: (ws, message) => {
+					this.#handleMessage(ws, message);
 				},
-				error: socket => {
-					this.#onClose(socket);
+				close: ws => {
+					this.#onClose(ws);
 				},
 			},
 		});
 	}
 
-	#onData(socket: Socket<BridgeData>, chunk: Buffer): void {
-		socket.data.buf += chunk.toString("utf8");
-		let idx = socket.data.buf.indexOf("\n");
-		while (idx !== -1) {
-			const line = socket.data.buf.slice(0, idx);
-			socket.data.buf = socket.data.buf.slice(idx + 1);
-			if (line.length > 0) this.#handleLine(socket, line);
-			idx = socket.data.buf.indexOf("\n");
-		}
-	}
-
-	#handleLine(socket: Socket<BridgeData>, line: string): void {
+	#handleMessage(ws: ServerWebSocket<undefined>, message: string | Buffer): void {
+		const text = typeof message === "string" ? message : message.toString("utf8");
 		let msg: { type?: string; id?: string; content?: unknown; is_error?: boolean };
 		try {
-			msg = JSON.parse(line);
+			msg = JSON.parse(text);
 		} catch {
 			return;
 		}
@@ -133,50 +148,42 @@ export class BridgeServer {
 				is_error: msg.is_error === true,
 			});
 		} else if (msg.type === "ping") {
-			this.#write(socket, { type: "pong" });
+			ws.send(JSON.stringify({ type: "pong" }));
 		}
 	}
 
-	#onClose(socket: Socket<BridgeData>): void {
-		if (this.#client !== socket) return;
+	#onClose(ws: ServerWebSocket<undefined>): void {
+		if (this.#client !== ws) return;
 		this.#client = null;
 		this.#pending.rejectAll(new Error("bridge client disconnected"));
 		for (const cb of this.#onDisconnected) cb();
 	}
 
-	#write(socket: Socket<BridgeData>, msg: unknown): void {
-		socket.write(`${JSON.stringify(msg)}\n`);
-	}
-
 	/** Send a `tool_request` to the connected client and await its `tool_result`. */
 	request(tool: string, params: unknown, timeoutMs: number = DEFAULT_TIMEOUT_MS): Promise<ToolResult> {
 		const client = this.#client;
 		if (!client) return Promise.reject(new Error("bridge: no client connected"));
 		const { id, promise } = this.#pending.create(timeoutMs);
-		this.#write(client, { type: "tool_request", id, tool, params });
+		client.send(JSON.stringify({ type: "tool_request", id, tool, params }));
 		return promise;
 	}
 
 	async close(): Promise<void> {
 		this.#pending.rejectAll(new Error("bridge server closed"));
-		this.#client?.end();
+		this.#client?.close();
 		this.#client = null;
-		this.#listener?.stop(true);
-		this.#listener = null;
+		this.#server?.stop(true);
+		this.#server = null;
 	}
 }
 
 /**
- * Resolve the default socket path (`~/.xcsh/chrome-bridge.sock`), ensure the
- * directory exists, remove any stale socket, start the {@link BridgeServer},
- * and tighten the socket permissions to owner-only (0600).
+ * Start the {@link BridgeServer} on the resolved loopback port (explicit arg,
+ * then `XCSH_BRIDGE_PORT`, then {@link DEFAULT_PORT}). The WebSocket transport
+ * needs no filesystem setup — Chrome connects directly to `ws://127.0.0.1:<port>`.
  */
-export async function startBridgeServer(socketPath?: string): Promise<BridgeServer> {
-	const resolved = socketPath ?? path.join(os.homedir(), ".xcsh", "chrome-bridge.sock");
-	fs.mkdirSync(path.dirname(resolved), { recursive: true });
-	fs.rmSync(resolved, { force: true });
+export async function startBridgeServer(port?: number, opts?: { skipOriginCheck?: boolean }): Promise<BridgeServer> {
 	const server = new BridgeServer();
-	server.listen(resolved);
-	fs.chmodSync(resolved, 0o600);
+	server.listen(resolvePort(port), opts);
 	return server;
 }

package/src/browser/provider.ts

@@ -130,17 +130,6 @@ export async function selectProvider(
 
 	if (forced === "cdp") return new CdpBrowserProvider(settings);
 
-	// Transparent, idempotent native-host install: ensure the native-messaging
-	// manifest is present + correct on every init so the extension can connect.
-	// Removes the need for a manual `xcsh chrome setup` step. Best-effort — any
-	// failure surfaces as the actionable "extension not connected" error below.
-	try {
-		const { ensureNativeHostInstalled } = await import("../cli/chrome-cli");
-		ensureNativeHostInstalled();
-	} catch {
-		/* best-effort; never block init on setup */
-	}
-
 	try {
 		const server = opts?.bridgeServer ?? (await startBridgeServer());
 		const deadline = Date.now() + probeMs;
@@ -152,13 +141,13 @@ export async function selectProvider(
 		}
 		if (forced === "extension") {
 			// Don't tear down the bridge or fall back — fail with an actionable
-			// install path. The native host is auto-installed above, so a no-connect
-			// almost always means the extension itself isn't installed/enabled.
+			// install path. A no-connect almost always means the extension itself
+			// isn't installed/enabled (the bridge listens on loopback already).
 			const { WEB_STORE_URL } = await import("../cli/chrome-cli");
 			throw new Error(
 				`The xcsh Chrome extension is not connected, so deterministic console automation cannot run. ` +
 					`Install it from the Chrome Web Store and keep it enabled:\n  ${WEB_STORE_URL}\n` +
-					`Then reload Chrome and retry. (Waited ${probeMs}ms; the native-messaging host was auto-installed.)`,
+					`Then reload Chrome and retry. (Waited ${probeMs}ms.)`,
 			);
 		}
 		await server.close();

package/src/cli/chrome-cli.ts

@@ -1,22 +1,19 @@
 /**
  * Chrome CLI command handlers.
  *
- * Backs both `xcsh chrome [status|relaunch]` and the `/chrome` REPL slash
+ * Backs both `xcsh chrome [status|relaunch|setup]` and the `/chrome` REPL slash
  * command. `renderStatus` is a pure formatter so it can be unit-tested without
  * touching Chrome, settings, or the network.
  */
 
-import * as fs from "node:fs";
-import * as os from "node:os";
-import * as path from "node:path";
 import { acquirePage, type BrowserProviderStatus, CdpBrowserProvider } from "../browser";
+import { resolvePort } from "../browser/extension-bridge";
 
 type Settings = { get(key: string): unknown };
 
 export type ChromeAction = "status" | "relaunch" | "setup";
 
 export const EXTENSION_ID = "klajkjdoehjidngligegnpknogmjjhkc";
-export const EXTENSION_IDS = [EXTENSION_ID];
 
 /**
  * Baked-in Chrome Web Store URL for the xcsh console-automation extension.
@@ -25,141 +22,6 @@ export const EXTENSION_IDS = [EXTENSION_ID];
  */
 export const WEB_STORE_URL = `https://chromewebstore.google.com/detail/${EXTENSION_ID}`;
 
-const NATIVE_HOST_NAME = "com.xcsh.xcsh.chrome_host";
-
-/**
- * How Chrome should invoke the native-messaging relay. A compiled `xcsh`
- * binary resolves `chrome-host` as a subcommand directly (path=xcsh,
- * args=["chrome-host"]). Under a dev run (`bun src/cli.ts …`) `process.execPath`
- * is `bun`, which needs the entry script path to resolve the subcommand —
- * otherwise Chrome launches `bun chrome-host`, which fails, and the bridge never
- * comes up. This makes the manifest correct for BOTH invocations.
- */
-/** Find a compiled `xcsh` binary on PATH (self-contained; survives Chrome's stripped env). */
-function defaultResolveXcshBin(): string | null {
-	const dirs = (process.env.PATH ?? "").split(path.delimiter).filter(Boolean);
-	for (const dir of dirs) {
-		const candidate = path.join(dir, "xcsh");
-		try {
-			fs.accessSync(candidate, fs.constants.X_OK);
-			return candidate;
-		} catch {
-			/* not on this PATH entry */
-		}
-	}
-	return null;
-}
-
-export function nativeHostInvocation(
-	argv = process.argv,
-	execPath = process.execPath,
-	resolveXcshBin: () => string | null = defaultResolveXcshBin,
-): {
-	binPath: string;
-	args: string[];
-} {
-	const base = path.basename(execPath).toLowerCase();
-	if (base.startsWith("bun")) {
-		// Chrome launches native hosts with a stripped environment; `bun <entry>.ts`
-		// then fails dependency resolution and the host exits immediately ("Native
-		// host has exited"). A compiled, self-contained xcsh binary survives — so
-		// prefer it for the relay whenever one is resolvable on PATH.
-		const xcsh = resolveXcshBin();
-		if (xcsh) return { binPath: xcsh, args: ["chrome-host"] };
-		const script = argv[1];
-		if (script && (script.endsWith(".ts") || script.endsWith(".js"))) {
-			return { binPath: execPath, args: [script, "chrome-host"] };
-		}
-	}
-	return { binPath: execPath, args: ["chrome-host"] };
-}
-
-/**
- * Idempotently ensure the native-messaging host manifest is installed and
- * correct. Safe to call on every console-automation init — it only writes when
- * the manifest is missing or differs, so it's transparent to the user and
- * removes the need to run `xcsh chrome setup` by hand. Returns whether a write
- * occurred and the manifest path.
- */
-export function ensureNativeHostInstalled(opts?: {
-	platform?: NodeJS.Platform;
-	home?: string;
-	argv?: string[];
-	execPath?: string;
-	devExtensionId?: string;
-}): { manifestPath: string; changed: boolean } {
-	const platform = opts?.platform ?? process.platform;
-	const home = opts?.home ?? os.homedir();
-	if (platform === "win32") return { manifestPath: "", changed: false };
-	const { binPath, args } = nativeHostInvocation(opts?.argv, opts?.execPath);
-	const dir = nativeHostDir(platform, home);
-	const manifestPath = path.join(dir, `${NATIVE_HOST_NAME}.json`);
-	// Dev affordance: an unpacked/local extension build loads under a different
-	// (key- or path-derived) id than the published one. Setting
-	// XCSH_DEV_EXTENSION_ID lets the native host also trust that build so you can
-	// iterate locally without editing this file. Ignored in normal use.
-	const devId = (opts?.devExtensionId ?? process.env.XCSH_DEV_EXTENSION_ID)?.trim();
-	const ids = devId && !EXTENSION_IDS.includes(devId) ? [...EXTENSION_IDS, devId] : EXTENSION_IDS;
-	const desired = JSON.stringify(
-		{
-			name: NATIVE_HOST_NAME,
-			description: "xcsh Chrome native-messaging host",
-			path: binPath,
-			args,
-			type: "stdio",
-			allowed_origins: ids.map(id => `chrome-extension://${id}/`),
-		},
-		null,
-		2,
-	);
-	let existing: string | null = null;
-	try {
-		existing = fs.readFileSync(manifestPath, "utf8");
-	} catch {
-		/* missing — will write */
-	}
-	if (existing === desired) return { manifestPath, changed: false };
-	fs.mkdirSync(dir, { recursive: true });
-	fs.writeFileSync(manifestPath, desired);
-	return { manifestPath, changed: true };
-}
-
-function nativeHostDir(platform: NodeJS.Platform, home: string): string {
-	if (platform === "darwin")
-		return path.join(home, "Library", "Application Support", "Google", "Chrome", "NativeMessagingHosts");
-	return path.join(home, ".config", "google-chrome", "NativeMessagingHosts"); // linux (win32 handled separately — out of slice scope; throw)
-}
-
-export function writeNativeHostManifest(opts: {
-	platform?: NodeJS.Platform;
-	home?: string;
-	xcshBinPath: string;
-	extensionIds: string[];
-	write?: (p: string, c: string) => void;
-}): { manifestPath: string } {
-	const platform = opts.platform ?? process.platform;
-	const home = opts.home ?? os.homedir();
-	if (platform === "win32") throw new Error("xcsh chrome setup on Windows is not in the vertical slice");
-	const dir = nativeHostDir(platform, home);
-	const manifestPath = path.join(dir, `${NATIVE_HOST_NAME}.json`);
-	const manifest = {
-		name: NATIVE_HOST_NAME,
-		description: "xcsh Chrome native-messaging host",
-		path: opts.xcshBinPath,
-		args: ["chrome-host"],
-		type: "stdio",
-		allowed_origins: opts.extensionIds.map(id => `chrome-extension://${id}/`),
-	};
-	const write =
-		opts.write ??
-		((p, c) => {
-			fs.mkdirSync(path.dirname(p), { recursive: true });
-			fs.writeFileSync(p, c);
-		});
-	write(manifestPath, JSON.stringify(manifest, null, 2));
-	return { manifestPath };
-}
-
 export function renderStatus(s: BrowserProviderStatus): string {
 	const yn = (b: boolean) => (b ? "yes" : "no");
 	return [
@@ -180,12 +42,12 @@ export async function runChromeCommand(action: ChromeAction, settings: Settings)
 	const provider = new CdpBrowserProvider(settings);
 	if (action === "status") return renderStatus(await provider.status());
 	if (action === "setup") {
-		// Idempotent: only writes when missing/stale. This is also run automatically
-		// on console-automation init, so `xcsh chrome setup` is optional now.
-		const { manifestPath, changed } = ensureNativeHostInstalled();
-		const state = changed ? "Installed" : "Verified (already current)";
+		// The extension connects directly over a loopback WebSocket — no native-messaging
+		// host manifest to install. Report the port so the user can point the extension at it.
+		const port = resolvePort();
 		return (
-			`${state} native-messaging host manifest at ${manifestPath} (extensions ${EXTENSION_IDS.join(", ")}).\n` +
+			`The xcsh Chrome extension connects directly to xcsh over a loopback WebSocket on ` +
+			`ws://127.0.0.1:${port} (override with XCSH_BRIDGE_PORT).\n` +
 			`Install/keep the xcsh Chrome extension from the Web Store, then it can drive your real Chrome:\n  ${WEB_STORE_URL}`
 		);
 	}

package/src/cli.ts

@@ -52,7 +52,6 @@ const commands: CommandEntry[] = [
 	{ name: "commit", load: () => import("./commands/commit").then(m => m.default) },
 	{ name: "config", load: () => import("./commands/config").then(m => m.default) },
 	{ name: "chrome", load: () => import("./commands/chrome").then(m => m.default) },
-	{ name: "chrome-host", load: () => import("./commands/chrome-host").then(m => m.default) },
 	{ name: "grep", load: () => import("./commands/grep").then(m => m.default) },
 	{ name: "grievances", load: () => import("./commands/grievances").then(m => m.default) },
 	{ name: "read", load: () => import("./commands/read").then(m => m.default) },
@@ -110,14 +109,7 @@ if (process.env.XCSH_SMOKE_TEST_SPECS === "1") {
 	process.exit(domainCount > 0 && categoryCount > 0 ? 0 : 1);
 }
 
-// The `chrome-host` native-messaging relay is a hot path — Chrome (re)launches it
-// on every (re)connect attempt. Skip language discovery (profile I/O + OS
-// collectors) for it: the relay never needs a locale, and running full init per
-// launch both wastes work and floods logs with "Applied locale" during reconnect
-// churn. Only the user-facing commands need language discovery.
-if (process.argv[2] !== "chrome-host") {
-	const { discoverAndApplyLanguage } = await import("./discovery/language");
-	await discoverAndApplyLanguage();
-}
+const { discoverAndApplyLanguage } = await import("./discovery/language");
+await discoverAndApplyLanguage();
 
 await runCli(process.argv.slice(2));

package/src/internal-urls/build-info.generated.ts

@@ -17,17 +17,17 @@ export interface BuildInfo {
 }
 
 export const BUILD_INFO: BuildInfo = {
-	"version": "19.51.3",
-	"commit": "8a28cb0c84322756aee28ea0aec6e27fa17b92fb",
-	"shortCommit": "8a28cb0",
+	"version": "19.51.6",
+	"commit": "2a072802e0f6e75cb5f1ada167c64fed52cd39b1",
+	"shortCommit": "2a07280",
 	"branch": "main",
-	"tag": "v19.51.4",
-	"commitDate": "2026-06-26T23:17:20Z",
-	"buildDate": "2026-06-26T23:52:22.272Z",
+	"tag": "v19.51.6",
+	"commitDate": "2026-06-27T02:46:04Z",
+	"buildDate": "2026-06-27T03:14:10.843Z",
 	"dirty": true,
 	"prNumber": "",
 	"repoUrl": "https://github.com/f5-sales-demo/xcsh",
 	"repoSlug": "f5-sales-demo/xcsh",
-	"commitUrl": "https://github.com/f5-sales-demo/xcsh/commit/8a28cb0c84322756aee28ea0aec6e27fa17b92fb",
-	"releaseUrl": "https://github.com/f5-sales-demo/xcsh/releases/tag/v19.51.3"
+	"commitUrl": "https://github.com/f5-sales-demo/xcsh/commit/2a072802e0f6e75cb5f1ada167c64fed52cd39b1",
+	"releaseUrl": "https://github.com/f5-sales-demo/xcsh/releases/tag/v19.51.6"
 };

package/src/modes/components/context-add-wizard.ts

@@ -1,6 +1,6 @@
 import { Container, Input, matchesKey, Spacer, Text, TruncatedText } from "@f5-sales-demo/pi-tui";
 import type { XCSHContext } from "../../services/xcsh-context";
-import { deriveTenantFromUrl } from "../../services/xcsh-env";
+import { deriveTenantFromUrl, isSensitiveEnvKey, XCSH_CONSOLE_PASSWORD, XCSH_USERNAME } from "../../services/xcsh-env";
 import { theme } from "../theme/theme";
 import { matchesAppInterrupt } from "../utils/keybinding-matchers";
 import { DynamicBorder } from "./dynamic-border";
@@ -28,18 +28,57 @@ export function validateWizardName(name: string): string | null {
 	return null;
 }
 
-type WizardStep = "url" | "token" | "name" | "validating" | "namespace" | "confirm" | "activate";
+type WizardStep =
+	| "url"
+	| "token"
+	| "name"
+	| "validating"
+	| "namespace"
+	| "username"
+	| "password"
+	| "confirm"
+	| "activate";
 
 interface WizardState {
 	url: string;
 	token: string;
 	name: string;
 	namespace: string;
+	/** Web-console login username (optional) — stored as the XCSH_USERNAME env var. */
+	username: string;
+	/** Web-console login password (optional) — stored as the XCSH_CONSOLE_PASSWORD env var. */
+	password: string;
+}
+
+/**
+ * Build the XCSHContext the wizard will persist from its collected state.
+ *
+ * The optional web-console credentials become generic env vars (XCSH_USERNAME /
+ * XCSH_CONSOLE_PASSWORD); any secret-looking key (the password) is auto-marked
+ * sensitive so it is masked in `/context show` and redacted on export. Exported
+ * so the persistence shape is unit-testable without driving the TUI.
+ */
+export function buildWizardContext(state: WizardState): XCSHContext {
+	const context: XCSHContext = {
+		name: state.name,
+		apiUrl: state.url,
+		apiToken: state.token,
+		defaultNamespace: state.namespace,
+	};
+	const env: Record<string, string> = {};
+	if (state.username) env[XCSH_USERNAME] = state.username;
+	if (state.password) env[XCSH_CONSOLE_PASSWORD] = state.password;
+	if (Object.keys(env).length > 0) {
+		context.env = env;
+		const sensitiveKeys = Object.keys(env).filter(isSensitiveEnvKey);
+		if (sensitiveKeys.length > 0) context.sensitiveKeys = sensitiveKeys;
+	}
+	return context;
 }
 
 export class ContextAddWizard extends Container {
 	#currentStep: WizardStep = "url";
-	#state: WizardState = { url: "", token: "", name: "", namespace: "default" };
+	#state: WizardState = { url: "", token: "", name: "", namespace: "default", username: "", password: "" };
 	#contentContainer: Container;
 	#inputField: Input | null = null;
 	#selectedIndex = 0;
@@ -104,6 +143,12 @@ export class ContextAddWizard extends Container {
 			case "namespace":
 				this.#renderNamespaceStep();
 				break;
+			case "username":
+				this.#renderUsernameStep();
+				break;
+			case "password":
+				this.#renderPasswordStep();
+				break;
 			case "confirm":
 				this.#renderConfirmStep();
 				break;
@@ -139,6 +184,7 @@ export class ContextAddWizard extends Container {
 		this.#contentContainer.addChild(new Spacer(1));
 
 		this.#inputField = new Input();
+		this.#inputField.setMasked(true);
 		this.#inputField.setValue(this.#state.token);
 		this.#contentContainer.addChild(this.#inputField);
 		this.#contentContainer.addChild(new Spacer(1));
@@ -288,8 +334,41 @@ export class ContextAddWizard extends Container {
 		this.#contentContainer.addChild(new Text(theme.fg("muted", "[Enter to continue, Esc to go back]"), 0, 0));
 	}
 
+	#renderUsernameStep(): void {
+		this.#contentContainer.addChild(new Text(theme.fg("contentAccent", "Step 6: Web-Console Username")));
+		this.#contentContainer.addChild(new Spacer(1));
+		this.#contentContainer.addChild(new Text("Enter the web-console login username (optional):", 0, 0));
+		this.#contentContainer.addChild(new Spacer(1));
+
+		this.#inputField = new Input();
+		this.#inputField.setValue(this.#state.username);
+		this.#contentContainer.addChild(this.#inputField);
+		this.#contentContainer.addChild(new Spacer(1));
+
+		this.#contentContainer.addChild(
+			new Text(theme.fg("muted", "[Enter to continue (empty to skip), Esc to go back]"), 0, 0),
+		);
+	}
+
+	#renderPasswordStep(): void {
+		this.#contentContainer.addChild(new Text(theme.fg("contentAccent", "Step 7: Web-Console Password")));
+		this.#contentContainer.addChild(new Spacer(1));
+		this.#contentContainer.addChild(new Text("Enter the web-console login password (optional):", 0, 0));
+		this.#contentContainer.addChild(new Spacer(1));
+
+		this.#inputField = new Input();
+		this.#inputField.setMasked(true);
+		this.#inputField.setValue(this.#state.password);
+		this.#contentContainer.addChild(this.#inputField);
+		this.#contentContainer.addChild(new Spacer(1));
+
+		this.#contentContainer.addChild(
+			new Text(theme.fg("muted", "[Enter to continue (empty to skip), Esc to go back]"), 0, 0),
+		);
+	}
+
 	#renderConfirmStep(): void {
-		this.#contentContainer.addChild(new Text(theme.fg("contentAccent", "Step 6: Confirm")));
+		this.#contentContainer.addChild(new Text(theme.fg("contentAccent", "Step 8: Confirm")));
 		this.#contentContainer.addChild(new Spacer(1));
 
 		// Summary table
@@ -298,6 +377,12 @@ export class ContextAddWizard extends Container {
 		const masked = this.#state.token.length > 4 ? `${"*".repeat(8)}${this.#state.token.slice(-4)}` : "****";
 		this.#contentContainer.addChild(new Text(`Token: ${masked}`, 0, 0));
 		this.#contentContainer.addChild(new Text(`Namespace: ${this.#state.namespace}`, 0, 0));
+		if (this.#state.username) {
+			this.#contentContainer.addChild(new Text(`Username: ${this.#state.username}`, 0, 0));
+		}
+		if (this.#state.password) {
+			this.#contentContainer.addChild(new Text(`Console Password: ${"*".repeat(8)}`, 0, 0));
+		}
 		this.#contentContainer.addChild(new Spacer(1));
 
 		this.#contentContainer.addChild(new Text("Save this context?", 0, 0));
@@ -318,7 +403,7 @@ export class ContextAddWizard extends Container {
 	}
 
 	#renderActivateStep(): void {
-		this.#contentContainer.addChild(new Text(theme.fg("contentAccent", "Step 7: Activate")));
+		this.#contentContainer.addChild(new Text(theme.fg("contentAccent", "Step 9: Activate")));
 		this.#contentContainer.addChild(new Spacer(1));
 		this.#contentContainer.addChild(new Text("Activate this context now?", 0, 0));
 		this.#contentContainer.addChild(new Spacer(1));
@@ -436,6 +521,19 @@ export class ContextAddWizard extends Container {
 			}
 			case "namespace": {
 				this.#state.namespace = value || "default";
+				this.#currentStep = "username";
+				break;
+			}
+			case "username": {
+				// Trimmed: usernames never carry meaningful surrounding whitespace.
+				this.#state.username = value;
+				this.#currentStep = "password";
+				break;
+			}
+			case "password": {
+				// Preserve the password exactly as typed — do NOT use the trimmed
+				// `value`, since a password may legitimately contain whitespace.
+				this.#state.password = this.#inputField.getValue();
 				this.#currentStep = "confirm";
 				this.#selectedIndex = 0;
 				break;
@@ -477,12 +575,7 @@ export class ContextAddWizard extends Container {
 				return;
 			}
 			case "activate": {
-				const context: XCSHContext = {
-					name: this.#state.name,
-					apiUrl: this.#state.url,
-					apiToken: this.#state.token,
-					defaultNamespace: this.#state.namespace,
-				};
+				const context = buildWizardContext(this.#state);
 				this.#onCompleteCallback(context, this.#selectedIndex === 0);
 				return;
 			}
@@ -521,9 +614,15 @@ export class ContextAddWizard extends Container {
 			case "namespace":
 				this.#currentStep = "name";
 				break;
-			case "confirm":
+			case "username":
 				this.#currentStep = "namespace";
 				break;
+			case "password":
+				this.#currentStep = "username";
+				break;
+			case "confirm":
+				this.#currentStep = "password";
+				break;
 			case "activate":
 				this.#currentStep = "confirm";
 				break;

package/src/commands/chrome-host.ts

@@ -1,97 +0,0 @@
-/**
- * `chrome-host` — native-messaging relay subcommand.
- *
- * Launched by Chrome as the native-messaging host. It is a pure relay between
- * Chrome's stdio (native-messaging framing: 4-byte LE length + JSON) and xcsh's
- * Unix socket at `~/.xcsh/chrome-bridge.sock` (newline-delimited JSON). No
- * business logic lives here.
- */
-import { homedir } from "node:os";
-import { join } from "node:path";
-import { Command } from "@f5-sales-demo/pi-utils/cli";
-import { decodeNm, encodeNm } from "../browser/native-messaging";
-
-const SOCKET_PATH = process.env.XCSH_BRIDGE_SOCKET ?? join(homedir(), ".xcsh", "chrome-bridge.sock");
-
-// Diagnostic relay tracing, OFF unless ~/.xcsh/chrome-host-debug exists. Security:
-// writes to a 0600 file in the user's home, lifecycle + byte-counts ONLY — never
-// message content — and never to stdout (that would corrupt the NM stream).
-function dbg(msg: string): void {
-	try {
-		const fs = require("node:fs");
-		const home = process.env.HOME || homedir();
-		if (!fs.existsSync(join(home, ".xcsh", "chrome-host-debug"))) return;
-		const fd = fs.openSync(join(home, ".xcsh", "chrome-host.log"), "a", 0o600);
-		fs.appendFileSync(fd, `${new Date().toISOString()} pid=${process.pid} ${msg}\n`);
-		fs.closeSync(fd);
-	} catch {
-		/* logging must never break the relay */
-	}
-}
-
-export default class ChromeHost extends Command {
-	static description = "Native-messaging relay between Chrome and the xcsh bridge socket (internal)";
-
-	async run(): Promise<void> {
-		let socket: Awaited<ReturnType<typeof Bun.connect>> | undefined;
-		let socketBuffer = "";
-		dbg(`start sock=${SOCKET_PATH} argc=${process.argv.length}`);
-
-		try {
-			dbg("Bun.connect: begin");
-			socket = await Bun.connect({
-				unix: SOCKET_PATH,
-				socket: {
-					data(_sock, chunk) {
-						// Socket → Chrome: NDJSON lines → native-messaging frames.
-						socketBuffer += new TextDecoder().decode(chunk);
-						let newlineIndex = socketBuffer.indexOf("\n");
-						while (newlineIndex !== -1) {
-							const line = socketBuffer.slice(0, newlineIndex);
-							socketBuffer = socketBuffer.slice(newlineIndex + 1);
-							if (line.length > 0) {
-								dbg(`socket→chrome ${line.length}B`);
-								process.stdout.write(encodeNm(JSON.parse(line)));
-							}
-							newlineIndex = socketBuffer.indexOf("\n");
-						}
-					},
-					close() {
-						dbg("bridge socket closed → exit");
-						process.exit(0);
-					},
-					error() {
-						dbg("bridge socket error → exit");
-						process.exit(0);
-					},
-				},
-			});
-			dbg("Bun.connect: resolved (connected)");
-		} catch (e) {
-			// xcsh not running — write nothing, exit cleanly. The extension retries.
-			dbg(`Bun.connect: threw → exit: ${e instanceof Error ? e.message : String(e)}`);
-			process.exit(0);
-		}
-
-		// Chrome stdin → socket: native-messaging frames → NDJSON lines.
-		dbg("reading chrome stdin");
-		let stdinBuffer: Uint8Array<ArrayBufferLike> = new Uint8Array(0);
-		for await (const chunk of process.stdin) {
-			const bytes = new Uint8Array(chunk);
-			const next = new Uint8Array(stdinBuffer.length + bytes.length);
-			next.set(stdinBuffer, 0);
-			next.set(bytes, stdinBuffer.length);
-			const { messages, rest } = decodeNm(next);
-			stdinBuffer = rest;
-			for (const msg of messages) {
-				dbg(`chrome→socket ${JSON.stringify(msg).length}B`);
-				socket.write(`${JSON.stringify(msg)}\n`);
-			}
-		}
-
-		// Chrome closed stdin — tear down and exit.
-		dbg("chrome stdin EOF → exit");
-		socket.end();
-		process.exit(0);
-	}
-}