@f5-sales-demo/xcsh 19.55.1 → 19.56.1

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@f5-sales-demo/xcsh",
-	"version": "19.55.1",
+	"version": "19.56.1",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://github.com/f5-sales-demo/xcsh",
 	"author": "Can Boluk",
@@ -55,13 +55,13 @@
 	"dependencies": {
 		"@agentclientprotocol/sdk": "0.16.1",
 		"@mozilla/readability": "^0.6",
-		"@f5-sales-demo/xcsh-stats": "19.55.1",
-		"@f5-sales-demo/pi-agent-core": "19.55.1",
-		"@f5-sales-demo/pi-ai": "19.55.1",
-		"@f5-sales-demo/pi-natives": "19.55.1",
-		"@f5-sales-demo/pi-resource-management": "19.55.1",
-		"@f5-sales-demo/pi-tui": "19.55.1",
-		"@f5-sales-demo/pi-utils": "19.55.1",
+		"@f5-sales-demo/xcsh-stats": "19.56.1",
+		"@f5-sales-demo/pi-agent-core": "19.56.1",
+		"@f5-sales-demo/pi-ai": "19.56.1",
+		"@f5-sales-demo/pi-natives": "19.56.1",
+		"@f5-sales-demo/pi-resource-management": "19.56.1",
+		"@f5-sales-demo/pi-tui": "19.56.1",
+		"@f5-sales-demo/pi-utils": "19.56.1",
 		"@sinclair/typebox": "^0.34",
 		"@xterm/headless": "^6.0",
 		"ajv": "^8.20",

package/src/browser/extension-bridge.ts

@@ -105,11 +105,15 @@ export class BridgeServer {
 	#onMessage: Array<(msg: Record<string, unknown>) => void> = [];
 	/** Heartbeat interval that sends pings to keep the MV3 service worker alive (sweep + chat). */
 	#heartbeat: ReturnType<typeof setInterval> | null = null;
-	/** Stable per-process session id, advertised to the extension on `hello`. */
-	#sessionId = `sess-${crypto.randomUUID()}`;
 	/** Provider of this process's tenant identity, answering the `hello` handshake. */
 	#sessionInfo:
-		| (() => { tenant: string | null; env: string | null; apiUrl: string | null; contextBound: boolean })
+		| (() => {
+				tenant: string | null;
+				env: string | null;
+				apiUrl: string | null;
+				contextBound: boolean;
+				sessionId: string | null;
+		  })
 		| null = null;
 
 	/** The port the WebSocket server is listening on (0 = not bound). */
@@ -140,25 +144,33 @@ export class BridgeServer {
 		this.#onMessage.push(cb);
 	}
 
-	/** This process's stable session id (advertised on the `hello` handshake). */
-	get sessionId(): string {
-		return this.#sessionId;
-	}
-
 	/** Set the tenant-identity provider that answers the extension's `hello`
 	 * handshake with `{ tenant, env, apiUrl }` for THIS xcsh process/context. */
 	setSessionInfo(
-		cb: () => { tenant: string | null; env: string | null; apiUrl: string | null; contextBound: boolean },
+		cb: () => {
+			tenant: string | null;
+			env: string | null;
+			apiUrl: string | null;
+			contextBound: boolean;
+			sessionId: string | null;
+		},
 	): void {
 		this.#sessionInfo = cb;
 	}
 
 	/** Push a tenant change to all connected panels (e.g. after `/context activate`). */
 	broadcastTenantChanged(): void {
-		const info = this.#sessionInfo?.() ?? { tenant: null, env: null, apiUrl: null, contextBound: false };
+		const info = this.#sessionInfo?.() ?? {
+			tenant: null,
+			env: null,
+			apiUrl: null,
+			contextBound: false,
+			sessionId: null,
+		};
 		for (const c of this.#clients.values()) {
 			try {
-				c.send(JSON.stringify({ type: "tenant_changed", sessionId: this.#sessionId, ...info }));
+				// `sessionId` (the tab-correlation key) comes from `info`, matching hello_ack.
+				c.send(JSON.stringify({ type: "tenant_changed", ...info }));
 			} catch {
 				/* client may have dropped */
 			}
@@ -253,12 +265,18 @@ export class BridgeServer {
 			ws.send(JSON.stringify({ type: "pong" }));
 		} else if (msg.type === "hello") {
 			// Identity handshake: tell the extension which tenant this process serves.
-			const info = this.#sessionInfo?.() ?? { tenant: null, env: null, apiUrl: null, contextBound: false };
+			const info = this.#sessionInfo?.() ?? {
+				tenant: null,
+				env: null,
+				apiUrl: null,
+				contextBound: false,
+				sessionId: null,
+			};
 			const { EXTENSION_CONTRACT_VERSION } = require("./capabilities.generated");
 			ws.send(
 				JSON.stringify({
 					type: "hello_ack",
-					sessionId: this.#sessionId,
+					sessionId: info.sessionId,
 					contractVersion: EXTENSION_CONTRACT_VERSION,
 					tenant: info.tenant,
 					env: info.env,

package/src/commands/manager-core.ts

@@ -1,7 +1,8 @@
 /** Pure worker-registry + control-protocol logic for the manager. No I/O. */
 
 export interface WorkerRec {
-	tenantKey: string; // "tenant|env"
+	sessionId: string; // per-tab session key, e.g. "tab-7"
+	tenant: string; // "tenant|env" — carried for the worker's context env, not the key
 	port: number;
 	pid: number;
 	lastSeen: number; // epoch ms
@@ -10,28 +11,31 @@ export interface WorkerRec {
 export type Registry = Map<string, WorkerRec>;
 
 export type ControlMsg =
-	| { type: "provision"; tenantKey: string }
-	| { type: "release"; tenantKey: string }
+	| { type: "provision"; sessionId: string; tenant: string }
+	| { type: "release"; sessionId: string }
 	| { type: "status" };
 
-function isTenantKey(v: unknown): v is string {
+function isTenant(v: unknown): v is string {
 	return typeof v === "string" && /^[^|]+\|[^|]+$/.test(v);
 }
+function isNonEmpty(v: unknown): v is string {
+	return typeof v === "string" && v.length > 0;
+}
 
 /** Validate an inbound control frame; null if malformed (fail closed). */
 export function parseControlMsg(raw: unknown): ControlMsg | null {
 	if (!raw || typeof raw !== "object") return null;
 	const m = raw as Record<string, unknown>;
 	if (m.type === "status") return { type: "status" };
-	if ((m.type === "provision" || m.type === "release") && isTenantKey(m.tenantKey)) {
-		return { type: m.type, tenantKey: m.tenantKey };
-	}
+	if (m.type === "provision" && isNonEmpty(m.sessionId) && isTenant(m.tenant))
+		return { type: "provision", sessionId: m.sessionId, tenant: m.tenant };
+	if (m.type === "release" && isNonEmpty(m.sessionId)) return { type: "release", sessionId: m.sessionId };
 	return null;
 }
 
-/** Idempotency: only provision when there is no live worker for the key. */
-export function needsProvision(reg: Registry, tenantKey: string): boolean {
-	return !reg.has(tenantKey);
+/** Idempotency: only provision when there is no live worker for the sessionId. */
+export function needsProvision(reg: Registry, sessionId: string): boolean {
+	return !reg.has(sessionId);
 }
 
 /** Lowest free port in the range not already held by a worker. */
@@ -41,9 +45,9 @@ export function pickPort(reg: Registry, range: number[]): number | null {
 	return null;
 }
 
-/** Keys whose worker has been idle longer than idleMs. */
+/** sessionIds whose worker has been idle longer than idleMs. */
 export function staleKeys(reg: Registry, now: number, idleMs: number): string[] {
 	const out: string[] = [];
-	for (const w of reg.values()) if (now - w.lastSeen > idleMs) out.push(w.tenantKey);
+	for (const w of reg.values()) if (now - w.lastSeen > idleMs) out.push(w.sessionId);
 	return out;
 }

package/src/commands/manager.ts

@@ -1,14 +1,16 @@
 /**
  * Manager mode — `xcsh manager`.
  *
- * A detached, long-lived control server that owns the fleet of per-tenant
+ * A detached, long-lived control server that owns the fleet of per-tab
  * `xcsh worker` processes. It listens on a UNIX SOCKET (`~/.xcsh/manager.sock`,
  * override `XCSH_MANAGER_SOCK`) for NDJSON control frames — one JSON object per
  * line — validated by the pure `manager-core` protocol:
  *
- *   {"type":"provision","tenantKey":"acme|staging"}  → spawn a worker (idempotent)
- *   {"type":"release","tenantKey":"acme|staging"}     → kill + forget the worker
- *   {"type":"status"}                                 → accepted; no-op sink
+ *   {"type":"provision","sessionId":"tab-7","tenant":"acme|staging"}
+ *        → spawn a worker for that sessionId (idempotent). The registry is keyed
+ *          on sessionId, so two tabs of the SAME tenant get two workers.
+ *   {"type":"release","sessionId":"tab-7"}  → kill + forget that session's worker
+ *   {"type":"status"}                        → accepted; no-op sink
  *
  * All registry/port/idempotency/idle policy is the pure `manager-core`; this file
  * is the thin I/O shell (socket, spawn, kill, timer) around it. A background sweep
@@ -74,8 +76,52 @@ export function workerArgv(): string[] {
 	return reexecArgv("worker");
 }
 
+/**
+ * Acquire the manager control socket, robust across Bun runtimes.
+ *
+ * The single-manager invariant needs three things at once: (1) never clobber a
+ * LIVE manager's socket, (2) reclaim a STALE socket left by a crashed/killed
+ * manager, and (3) survive a concurrent cold-start race. Bun's unix `listen` is
+ * NOT a reliable oracle here — dev `bun run` silently unlinks-and-rebinds a
+ * stale socket, while the COMPILED binary throws EADDRINUSE (xcsh #1846), which
+ * previously crashed the manager and silently killed all automation. So we drive
+ * it explicitly:
+ *
+ *   1. Probe for a live owner. If one answers → we lost; bail ("already-live").
+ *   2. Try to listen. If it binds → done ("bound").
+ *   3. On EADDRINUSE, RE-PROBE: a live answer now means a rival bound between
+ *      our probe and our listen → bail WITHOUT touching its socket. Otherwise
+ *      the file is confirmed stale → unlink it and retry listen once. A still-
+ *      failing retry (or any non-EADDRINUSE error) propagates loudly.
+ *
+ * Effects are injected so the branch logic is unit-tested deterministically
+ * (the compiled-only EADDRINUSE path is unreachable from a dev test otherwise).
+ */
+export async function acquireControlSocket(opts: {
+	sockPath: string;
+	probeLive: (sockPath: string) => Promise<boolean>;
+	listen: () => void;
+	unlink: (sockPath: string) => void;
+	isAddrInUse: (err: unknown) => boolean;
+}): Promise<"bound" | "already-live"> {
+	const { sockPath, probeLive, listen, unlink, isAddrInUse } = opts;
+	if (await probeLive(sockPath)) return "already-live";
+	try {
+		listen();
+		return "bound";
+	} catch (err) {
+		if (!isAddrInUse(err)) throw err;
+		// Bind collided. Distinguish a live rival (lost a cold-start race) from a
+		// stale file left by a crashed manager.
+		if (await probeLive(sockPath)) return "already-live";
+		unlink(sockPath); // confirmed stale → reclaim it
+		listen(); // retry once; a real failure now propagates
+		return "bound";
+	}
+}
+
 export default class Manager extends Command {
-	static description = "Run the detached control server that spawns/reaps per-tenant workers; blocks forever";
+	static description = "Run the detached control server that spawns/reaps per-tab workers; blocks forever";
 
 	async run(): Promise<void> {
 		const sockPath = process.env.XCSH_MANAGER_SOCK ?? join(homedir(), ".xcsh", "manager.sock");
@@ -84,29 +130,30 @@ export default class Manager extends Command {
 		const reg: Registry = new Map();
 		const range = portCandidates();
 
-		const reap = (tenantKey: string): void => {
-			const w = reg.get(tenantKey);
+		const reap = (sessionId: string): void => {
+			const w = reg.get(sessionId);
 			if (!w) return;
 			try {
 				process.kill(w.pid);
 			} catch {
 				/* already gone */
 			}
-			reg.delete(tenantKey);
+			reg.delete(sessionId);
 		};
 
-		const spawnWorker = (tenantKey: string): void => {
+		const spawnWorker = (msg: { sessionId: string; tenant: string }): void => {
 			// Registry-dedupe (pickPort) over only the ports free at the OS level.
 			const port = pickPort(reg, range.filter(isPortFree));
 			if (port === null) {
-				console.error(`[xcsh manager] port range exhausted; cannot provision ${tenantKey}`);
+				console.error(`[xcsh manager] port range exhausted; cannot provision ${msg.sessionId}`);
 				return;
 			}
 			const proc = Bun.spawn([process.execPath, ...workerArgv()], {
 				env: {
 					...process.env,
 					XCSH_BROWSER_PROVIDER: "extension",
-					XCSH_SESSION_TENANT: tenantKey,
+					XCSH_SESSION_ID: msg.sessionId,
+					XCSH_SESSION_TENANT: msg.tenant,
 					XCSH_BRIDGE_PORT: String(port),
 					// Isolate the worker's tenant binding: an ambient XCSH_API_URL in the
 					// manager's env would make sdk.ts skip the XCSH_SESSION_TENANT branch and
@@ -118,16 +165,22 @@ export default class Manager extends Command {
 				stdout: "ignore",
 				stderr: "ignore",
 			});
-			reg.set(tenantKey, { tenantKey, port, pid: proc.pid, lastSeen: Date.now() });
+			reg.set(msg.sessionId, {
+				sessionId: msg.sessionId,
+				tenant: msg.tenant,
+				port,
+				pid: proc.pid,
+				lastSeen: Date.now(),
+			});
 			// Reconcile a dead worker: when THIS process exits (crash, forced-port
 			// EADDRINUSE with no retry, etc.), drop its registry entry so the next
 			// provision respawns instead of finding a zombie. Guard on pid so an
-			// already-respawned entry for the same tenant is never clobbered.
+			// already-respawned entry for the same sessionId is never clobbered.
 			proc.exited.then(() => {
-				const cur = reg.get(tenantKey);
-				if (cur && cur.pid === proc.pid) reg.delete(tenantKey);
+				const cur = reg.get(msg.sessionId);
+				if (cur && cur.pid === proc.pid) reg.delete(msg.sessionId);
 			});
-			console.error(`[xcsh manager] provisioned ${tenantKey} → pid ${proc.pid} on port ${port}`);
+			console.error(`[xcsh manager] provisioned ${msg.sessionId} (${msg.tenant}) → pid ${proc.pid} on port ${port}`);
 		};
 
 		const handleFrame = (line: string): void => {
@@ -142,11 +195,11 @@ export default class Manager extends Command {
 			const msg = parseControlMsg(raw);
 			if (!msg) return; // fail closed on unknown/invalid frames
 			if (msg.type === "provision") {
-				if (needsProvision(reg, msg.tenantKey)) spawnWorker(msg.tenantKey);
-				const w = reg.get(msg.tenantKey);
+				if (needsProvision(reg, msg.sessionId)) spawnWorker(msg);
+				const w = reg.get(msg.sessionId);
 				if (w) w.lastSeen = Date.now(); // touch on every provision (keep-alive)
 			} else if (msg.type === "release") {
-				reap(msg.tenantKey);
+				reap(msg.sessionId);
 			}
 			// "status" is validated but currently a no-op sink.
 		};
@@ -171,39 +224,35 @@ export default class Manager extends Command {
 			},
 		};
 
-		// Single-manager invariant — probe liveness BEFORE binding.
-		//
-		// Two chrome-hosts can cold-start concurrently, both find no socket, and
-		// both spawn a manager. `Bun.listen({unix})` SILENTLY unlinks and rebinds
-		// any existing socket path — it does NOT throw EADDRINUSE even when a live
-		// manager is accepting on it (verified on Bun 1.3.x, in- and cross-process).
-		// So a naive `listen` would clobber the first manager's socket, leaving it
-		// orphaned on an unlinked path (blocking forever, leaking its worker ports)
-		// while a second live manager takes over — breaking "at most one manager".
-		//
-		// Guard by CONNECTING first: if a live manager answers, this process lost
-		// the race and exits WITHOUT touching the socket file (it belongs to the
-		// live manager). If nothing answers, the path is free or a STALE file from
-		// a crashed manager — either way `Bun.listen` safely (re)binds it (its own
-		// unlink-and-rebind reclaims the stale file; no explicit rm needed).
-		let liveOwner = false;
-		try {
-			const probe = await Promise.race([
-				Bun.connect({ unix: sockPath, socket: { data() {} } }),
-				new Promise<never>((_, reject) =>
-					setTimeout(() => reject(new Error("manager liveness probe timeout")), 500),
-				),
-			]);
-			liveOwner = true;
-			probe.end();
-		} catch {
-			/* nothing accepting → free path, or a stale socket file from a crashed manager */
-		}
-		if (liveOwner) {
+		// Single-manager invariant + stale-socket reclamation. A live manager is
+		// never clobbered (we probe first and again on collision); a stale socket
+		// from a crashed/killed manager is reclaimed rather than crashing on
+		// EADDRINUSE. See acquireControlSocket for the full rationale (xcsh #1846).
+		const probeLive = async (p: string): Promise<boolean> => {
+			try {
+				const probe = await Promise.race([
+					Bun.connect({ unix: p, socket: { data() {} } }),
+					new Promise<never>((_, reject) =>
+						setTimeout(() => reject(new Error("manager liveness probe timeout")), 500),
+					),
+				]);
+				probe.end();
+				return true;
+			} catch {
+				return false; // nothing accepting → free path, or a stale socket file
+			}
+		};
+		const outcome = await acquireControlSocket({
+			sockPath,
+			probeLive,
+			listen: () => Bun.listen(socketConfig),
+			unlink: p => fs.rmSync(p, { force: true }),
+			isAddrInUse: err => (err as { code?: string } | null)?.code === "EADDRINUSE",
+		});
+		if (outcome === "already-live") {
 			console.error(`[xcsh manager] another manager already live at ${sockPath}; exiting`);
 			process.exit(0);
 		}
-		Bun.listen(socketConfig);
 		console.error(`[xcsh manager] control socket listening at ${sockPath}`);
 
 		// Idle sweep: reap workers untouched for longer than the TTL.

package/src/commands/worker.ts

@@ -32,7 +32,11 @@ export function sessionInfoForWorker(): {
 	env: string | null;
 	apiUrl: string | null;
 	contextBound: boolean;
+	sessionId: string | null;
 } {
+	// The tab session key the manager spawned this worker for; echoed in hello_ack
+	// so the extension can correlate a discovered worker back to the provisioned tab.
+	const sessionId = process.env.XCSH_SESSION_ID ?? null;
 	let apiUrl: string | null = null;
 	let contextBound = false;
 	try {
@@ -45,15 +49,15 @@ export function sessionInfoForWorker(): {
 	apiUrl = apiUrl ?? process.env.XCSH_API_URL ?? null;
 	if (apiUrl) {
 		const key = sessionKeyFromUrl(apiUrl);
-		return { tenant: key?.tenant ?? null, env: key?.env ?? null, apiUrl, contextBound };
+		return { tenant: key?.tenant ?? null, env: key?.env ?? null, apiUrl, contextBound, sessionId };
 	}
 	// Contextless: the worker's assigned tenant is carried in XCSH_SESSION_TENANT.
 	const raw = process.env.XCSH_SESSION_TENANT;
 	if (raw) {
 		const [tenant, env] = raw.split("|");
-		return { tenant: tenant || null, env: env || null, apiUrl: null, contextBound };
+		return { tenant: tenant || null, env: env || null, apiUrl: null, contextBound, sessionId };
 	}
-	return { tenant: null, env: null, apiUrl: null, contextBound };
+	return { tenant: null, env: null, apiUrl: null, contextBound, sessionId };
 }
 
 /** Browser-automation tool set — identical scoping to `main.ts`'s extension path.

package/src/internal-urls/build-info.generated.ts

@@ -17,17 +17,17 @@ export interface BuildInfo {
 }
 
 export const BUILD_INFO: BuildInfo = {
-	"version": "19.55.1",
-	"commit": "48c9f78cdcabe71d95cc97b067c64119f03fb22d",
-	"shortCommit": "48c9f78",
+	"version": "19.56.1",
+	"commit": "5630d1694415b3da8edb73803fdf7ad37467d77d",
+	"shortCommit": "5630d16",
 	"branch": "main",
-	"tag": "v19.55.1",
-	"commitDate": "2026-07-03T01:03:31Z",
-	"buildDate": "2026-07-03T01:25:43.578Z",
+	"tag": "v19.56.1",
+	"commitDate": "2026-07-03T17:49:52Z",
+	"buildDate": "2026-07-03T18:14:31.834Z",
 	"dirty": true,
 	"prNumber": "",
 	"repoUrl": "https://github.com/f5-sales-demo/xcsh",
 	"repoSlug": "f5-sales-demo/xcsh",
-	"commitUrl": "https://github.com/f5-sales-demo/xcsh/commit/48c9f78cdcabe71d95cc97b067c64119f03fb22d",
-	"releaseUrl": "https://github.com/f5-sales-demo/xcsh/releases/tag/v19.55.1"
+	"commitUrl": "https://github.com/f5-sales-demo/xcsh/commit/5630d1694415b3da8edb73803fdf7ad37467d77d",
+	"releaseUrl": "https://github.com/f5-sales-demo/xcsh/releases/tag/v19.56.1"
 };

package/src/main.ts

@@ -837,7 +837,14 @@ export async function runRootCommand(parsed: Args, rawArgs: string[]): Promise<v
 				// Fall back to the env override when no context is active (env-only mode).
 				apiUrl = apiUrl ?? process.env.XCSH_API_URL ?? null;
 				const key = apiUrl ? sessionKeyFromUrl(apiUrl) : null;
-				return { tenant: key?.tenant ?? null, env: key?.env ?? null, apiUrl, contextBound };
+				// Interactive path has no per-tab XCSH_SESSION_ID; workers echo one, this doesn't.
+				return {
+					tenant: key?.tenant ?? null,
+					env: key?.env ?? null,
+					apiUrl,
+					contextBound,
+					sessionId: null,
+				};
 			};
 			bridgeServer.setSessionInfo(readInfo);
 			ContextService.onContextChange(() => bridgeServer?.broadcastTenantChanged());