@f5-sales-demo/xcsh 19.61.2 → 19.61.4

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@f5-sales-demo/xcsh",
-	"version": "19.61.2",
+	"version": "19.61.4",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://github.com/f5-sales-demo/xcsh",
 	"author": "Can Boluk",
@@ -56,13 +56,13 @@
 	"dependencies": {
 		"@agentclientprotocol/sdk": "0.16.1",
 		"@mozilla/readability": "^0.6",
-		"@f5-sales-demo/xcsh-stats": "19.61.2",
-		"@f5-sales-demo/pi-agent-core": "19.61.2",
-		"@f5-sales-demo/pi-ai": "19.61.2",
-		"@f5-sales-demo/pi-natives": "19.61.2",
-		"@f5-sales-demo/pi-resource-management": "19.61.2",
-		"@f5-sales-demo/pi-tui": "19.61.2",
-		"@f5-sales-demo/pi-utils": "19.61.2",
+		"@f5-sales-demo/xcsh-stats": "19.61.4",
+		"@f5-sales-demo/pi-agent-core": "19.61.4",
+		"@f5-sales-demo/pi-ai": "19.61.4",
+		"@f5-sales-demo/pi-natives": "19.61.4",
+		"@f5-sales-demo/pi-resource-management": "19.61.4",
+		"@f5-sales-demo/pi-tui": "19.61.4",
+		"@f5-sales-demo/pi-utils": "19.61.4",
 		"@sinclair/typebox": "^0.34",
 		"@xterm/headless": "^6.0",
 		"ajv": "^8.20",

package/src/browser/ttft-spans.ts

@@ -28,6 +28,17 @@ export function chatSpans(id: string, entryAt: number, promptAt: number, firstDe
 	];
 }
 
+/**
+ * Build the session-build span: the heavy `createAgentSession` step (model
+ * registry load, discovery, extension/plugin loading, context bootstrap) that
+ * runs between `worker_boot` (ends at bridge-listen) and `chat_handler`. Without
+ * this stage the cost is silently absorbed into total ttft_ms, hiding plugin/
+ * discovery regressions from the bench and the diagnostics panel.
+ */
+export function sessionBuildSpan(sid: string, cold: boolean, ms: number): SpanFrame {
+	return { type: "span", stage: "session_build", ms: clamp(ms), sid, cold };
+}
+
 /** Build the per-session cold-start spans, tagged with the session id + authoritative cold. */
 export function coldStartSpans(
 	sid: string,

package/src/commands/worker.ts

@@ -19,7 +19,7 @@ import { ChatHandler } from "../browser/chat-handler";
 import { startBridgeServer } from "../browser/extension-bridge";
 import { createExtensionBridgeTools, EXTENSION_AGENT_TOOL_NAMES } from "../browser/extension-bridge-tools";
 import { setSharedBridgeServer } from "../browser/provider";
-import { coldStartSpans, type SpanFrame } from "../browser/ttft-spans";
+import { coldStartSpans, type SpanFrame, sessionBuildSpan } from "../browser/ttft-spans";
 import { initializeWithSettings } from "../discovery";
 import { createAgentSession } from "../sdk";
 import { activateTenantContext } from "../services/session-context-binding";
@@ -162,11 +162,22 @@ export default class Worker extends Command {
 			for (const s of coldStartBuffer) bridge.send(s);
 			coldStartSent = true;
 		};
+		// TTFT: the session_build span (createAgentSession seam) is computed after the
+		// bridge is listening but possibly before the extension connects — buffer it and
+		// flush on connect, same as the cold-start spans.
+		let sessionBuildFrame: SpanFrame | null = null;
+		let sessionBuildSent = false;
+		const flushSessionBuild = (): void => {
+			if (sessionBuildSent || !clientConnected || !sessionBuildFrame) return;
+			bridge.send(sessionBuildFrame);
+			sessionBuildSent = true;
+		};
 		// onConnected (raw WS open) is the deliberate flush trigger: no hello hook is exposed
 		// today, and the bridge's origin check already gates opens to the extension.
 		bridge.onConnected(() => {
 			clientConnected = true;
 			flushColdStart();
+			flushSessionBuild();
 		});
 
 		if (coldSpawn && process.env.XCSH_SESSION_ID && Number.isFinite(spawnAtEnv)) {
@@ -218,6 +229,7 @@ export default class Worker extends Command {
 		// session:createAgentSession — the heavy step between bridge-ready and
 		// session-ready (model registry, tools, context bootstrap). Wrapped as a span
 		// (parity with main.ts:892) so PI_TIMING reveals the per-tab session-load split.
+		const sessionBuildStart = Date.now();
 		const { session } = await logger.time("session:createAgentSession", createAgentSession, {
 			cwd,
 			hasUI: false,
@@ -232,6 +244,32 @@ export default class Worker extends Command {
 			// sets XCSH_BENCH_EXTENSION (absolute path). Inert for normal workers.
 			...(process.env.XCSH_BENCH_EXTENSION ? { additionalExtensionPaths: [process.env.XCSH_BENCH_EXTENSION] } : {}),
 		});
+		// TTFT: emit the session_build stage (createAgentSession seam) as a WS span so the
+		// bench and diagnostics panel stop hiding plugin/discovery/registry-load cost inside
+		// total ttft_ms. Buffered + flushed on connect (parity with cold-start spans).
+		sessionBuildFrame = sessionBuildSpan(
+			process.env.XCSH_SESSION_ID ?? "",
+			coldSpawn,
+			Date.now() - sessionBuildStart,
+		);
+		flushSessionBuild();
+
+		// TTFT Phase 3 hermeticity: the bench-instant stand-in provider is registered while
+		// createAgentSession loads the bench extension (additionalExtensionPaths), which is
+		// AFTER the default-model role is resolved — so the worker would otherwise fall back
+		// to a real provider and the benchmark would measure live network TTFT, not xcsh
+		// overhead. In bench mode, explicitly select bench-instant now that it is registered.
+		// Gated on XCSH_BENCH_EXTENSION → completely inert for a normal `xcsh worker`.
+		if (process.env.XCSH_BENCH_EXTENSION) {
+			const benchModel = session.modelRegistry.find("bench-instant", "bench-instant");
+			if (benchModel) {
+				await session.setModel(benchModel);
+			} else {
+				console.error(
+					"[xcsh worker] BENCH ERROR: bench-instant model not registered — benchmark would measure a real provider",
+				);
+			}
+		}
 
 		const chatHandler = new ChatHandler(bridge, session);
 		chatHandler.attach();

package/src/config/auto-config.ts

@@ -16,6 +16,7 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { $env, logger, readProviderFromModelsYml } from "@f5-sales-demo/pi-utils";
+import { DEFAULT_MODEL_ROLE } from "./settings-schema";
 
 /** Current config schema version. Bump when the generated format changes. */
 export const CURRENT_CONFIG_VERSION = 2;
@@ -118,47 +119,68 @@ export function readLiteLLMConfig(modelsPath: string): LiteLLMConfig | undefined
 	return { baseUrl: resolvedBaseUrl, apiKey: resolvedApiKey };
 }
 
-/** Generate config.yml with sensible defaults for LiteLLM. */
+/**
+ * The default model role is baked into the binary (settings-schema `modelRoles`
+ * default) so a fresh install needs NO config.yml. Re-exported here for the
+ * healer and tests; there is a single source of truth in settings-schema.
+ */
+export const DEFAULT_MODEL_ROLE_VALUE = DEFAULT_MODEL_ROLE;
+
+/**
+ * Generate config.yml for the LiteLLM proxy.
+ *
+ * The default model role is NOT written here — it ships in the binary
+ * (settings-schema), so we never persist a model id that can go stale (the
+ * failure mode behind the invalid-model / catalog-walk bugs). This only carries
+ * settings that differ from the built-in schema defaults.
+ */
 export function generateConfigYml(): string {
 	return [
 		"# Auto-generated by xcsh for LiteLLM proxy",
-		"modelRoles:",
-		"  default: anthropic/claude-opus-4-6",
-		"",
+		"# The default model role ships in the binary — none is written here.",
 		"providers:",
 		"  image: openai",
 		"  webSearch: anthropic",
 		"",
-		"generate_image:",
-		"  enabled: true",
-		"",
-		"inspect_image:",
-		"  enabled: true",
-		"",
-		"images:",
-		"  blockImages: false",
-		"  autoResize: true",
-		"",
-		"terminal:",
-		"  showImages: true",
-		"",
 	].join("\n");
 }
 
 /**
- * Ensure config.yml has a modelRoles.default entry.
- * Existing configs from earlier versions may be missing this, causing xcsh
- * to fall through to the "first available model" fallback which picks stale
- * cached models that the proxy can't serve.
+ * Provider prefixes that are never valid as a persisted runtime default.
+ * `bench-instant` is the TTFT benchmark stand-in provider — it only registers
+ * when XCSH_BENCH_EXTENSION is set, so a `bench-instant/*` default in a normal
+ * worker is unresolvable and drops xcsh into the "first available model"
+ * fallback (which can pick a model the F5 proxy can't serve).
+ */
+const UNRESOLVABLE_DEFAULT_PROVIDER_PREFIXES = ["bench-instant/"];
+
+/**
+ * Repair a config.yml whose `modelRoles.default` can never resolve at runtime
+ * (e.g. `bench-instant/bench-instant` leaked from a benchmark run) by rewriting
+ * it to the binary default. Left unhealed, such a default triggers the
+ * catalog-wide fallback that surfaced as the AWS-SSO / invalid-model errors.
+ *
+ * A config.yml with NO `modelRoles:` needs no healing — the binary provides the
+ * default. We deliberately do not add one, to avoid persisting a stale id.
  */
 export function healConfigYmlModelRoles(configPath: string): void {
 	try {
 		const content = fs.readFileSync(configPath, "utf-8");
-		if (content.includes("modelRoles:")) return; // Already has modelRoles
-		// Prepend modelRoles section
-		const healed = `modelRoles:\n  default: anthropic/claude-opus-4-6\n\n${content}`;
-		fs.writeFileSync(configPath, healed);
-		logger.debug("Healed config.yml: added default modelRoles", { configPath });
+		if (!content.includes("modelRoles:")) return; // binary default applies
+		const defaultLine = /^(\s*)default:\s*(\S+)\s*$/m;
+		const match = content.match(defaultLine);
+		if (match) {
+			const [, indent, value] = match;
+			if (UNRESOLVABLE_DEFAULT_PROVIDER_PREFIXES.some(prefix => value.startsWith(prefix))) {
+				const healed = content.replace(defaultLine, `${indent}default: ${DEFAULT_MODEL_ROLE_VALUE}`);
+				fs.writeFileSync(configPath, healed);
+				logger.debug("Healed config.yml: replaced unresolvable default modelRole", {
+					configPath,
+					previous: value,
+					replacement: DEFAULT_MODEL_ROLE_VALUE,
+				});
+			}
+		}
 	} catch {
 		// Best-effort — don't block startup
 	}

package/src/config/model-registry.ts

@@ -774,6 +774,8 @@ export class ModelRegistry {
 	#customProviderApiKeys: Map<string, string> = new Map();
 	#keylessProviders: Set<string> = new Set();
 	#discoverableProviders: DiscoveryProviderConfig[] = [];
+	/** Provider ids explicitly configured in models.yml (empty until a config is loaded). */
+	#configuredProviderIds: Set<string> = new Set();
 	#customModelOverlays: CustomModelOverlay[] = [];
 	#providerOverrides: Map<string, ProviderOverride> = new Map();
 	#modelOverrides: Map<string, Map<string, ModelOverride>> = new Map();
@@ -923,6 +925,7 @@ export class ModelRegistry {
 		this.#configError = configError;
 		this.#keylessProviders = keylessProviders;
 		this.#discoverableProviders = discoverableProviders;
+		this.#configuredProviderIds = configuredProviders;
 		this.#customModelOverlays = customModels;
 		this.#providerOverrides = overrides;
 		this.#modelOverrides = modelOverrides;
@@ -1993,6 +1996,16 @@ export class ModelRegistry {
 		return this.#models.filter(model => this.#isModelAvailable(model));
 	}
 
+	/**
+	 * Provider ids explicitly configured in models.yml.
+	 * Empty when no config has been loaded (e.g. a fresh install before `/login`).
+	 * Used to keep automatic model selection scoped to providers the user has
+	 * actually set up, rather than probing the entire bundled catalog.
+	 */
+	getConfiguredProviderIds(): Set<string> {
+		return new Set(this.#configuredProviderIds);
+	}
+
 	getDiscoverableProviders(): string[] {
 		const disabledProviders = getDisabledProviderIdsFromSettings();
 		return this.#discoverableProviders

package/src/config/settings-schema.ts

@@ -152,6 +152,14 @@ export interface ModelTagsSettings {
 const EMPTY_STRING_ARRAY: string[] = [];
 const EMPTY_STRING_RECORD: Record<string, string> = {};
 const DEFAULT_CYCLE_ORDER: string[] = ["smol", "default", "slow"];
+/**
+ * Binary-baked default model role. Ships in the binary so a fresh install needs
+ * NO `~/.xcsh/agent/config.yml` — `/login` only supplies the (PII) proxy URL + key.
+ * The gateway serves the id `claude-opus-4-8`; its catalog entry carries the
+ * `context-1m-2025-08-07` beta for 1M context.
+ */
+export const DEFAULT_MODEL_ROLE = "anthropic/claude-opus-4-8";
+const DEFAULT_MODEL_ROLES: Record<string, string> = { default: DEFAULT_MODEL_ROLE };
 const EMPTY_MODEL_TAGS_RECORD: ModelTagsSettings = {};
 export const DEFAULT_BASH_INTERCEPTOR_RULES: BashInterceptorRule[] = [
 	{
@@ -245,7 +253,7 @@ export const SETTINGS_SCHEMA = {
 
 	disabledExtensions: { type: "array", default: EMPTY_STRING_ARRAY },
 
-	modelRoles: { type: "record", default: EMPTY_STRING_RECORD },
+	modelRoles: { type: "record", default: DEFAULT_MODEL_ROLES },
 
 	modelTags: { type: "record", default: EMPTY_MODEL_TAGS_RECORD },
 

package/src/internal-urls/build-info.generated.ts

@@ -17,17 +17,17 @@ export interface BuildInfo {
 }
 
 export const BUILD_INFO: BuildInfo = {
-	"version": "19.61.2",
-	"commit": "b6923d7302a3f43d8b9600ed4bddd6e26f16fad6",
-	"shortCommit": "b6923d7",
+	"version": "19.61.4",
+	"commit": "8697bc5fee06350b861c8c8bf7bbac1f00f85408",
+	"shortCommit": "8697bc5",
 	"branch": "main",
-	"tag": "v19.61.2",
-	"commitDate": "2026-07-07T05:10:31Z",
-	"buildDate": "2026-07-07T05:33:53.753Z",
+	"tag": "v19.61.4",
+	"commitDate": "2026-07-07T16:14:37Z",
+	"buildDate": "2026-07-07T16:40:48.327Z",
 	"dirty": true,
 	"prNumber": "",
 	"repoUrl": "https://github.com/f5-sales-demo/xcsh",
 	"repoSlug": "f5-sales-demo/xcsh",
-	"commitUrl": "https://github.com/f5-sales-demo/xcsh/commit/b6923d7302a3f43d8b9600ed4bddd6e26f16fad6",
-	"releaseUrl": "https://github.com/f5-sales-demo/xcsh/releases/tag/v19.61.2"
+	"commitUrl": "https://github.com/f5-sales-demo/xcsh/commit/8697bc5fee06350b861c8c8bf7bbac1f00f85408",
+	"releaseUrl": "https://github.com/f5-sales-demo/xcsh/releases/tag/v19.61.4"
 };

package/src/internal-urls/terraform-index.generated.ts

@@ -269,9 +269,9 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 			category: "load-balancing",
 			description:
 				"Advertise_policy object controls how and where a service represented by a given virtual_host object is advertised to consumers. configuration",
-			required: ["name", "namespace", "address", "protocol", "skip_xff_append"],
+			required: ["name", "address", "protocol", "skip_xff_append"],
 			minimal_config:
-				'resource "xcsh_advertise_policy" "example" {\n  name      = "example-advertise-policy"\n  namespace = "staging"\n\n  address         = "example-value"\n  protocol        = "example-value"\n  skip_xff_append = true\n}',
+				'resource "xcsh_advertise_policy" "example" {\n  name      = "example-advertise-policy"\n  namespace = "system"\n\n  address         = "example-value"\n  protocol        = "example-value"\n  skip_xff_append = true\n}',
 			dependencies: {
 				requires: [],
 			},
@@ -293,7 +293,7 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 			description: "New Alert Receiver object",
 			required: ["name", "namespace", "receiver_choice"],
 			minimal_config:
-				'resource "xcsh_alert_receiver" "example" {\n  name      = "example-alert-receiver"\n  namespace = "staging"\n}',
+				'resource "xcsh_alert_receiver" "example" {\n  name      = "example-alert-receiver"\n  namespace = "system"\n}',
 			dependencies: {
 				requires: [],
 			},
@@ -302,9 +302,9 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 		api_crawler: {
 			category: "api-security",
 			description: "API Crawler resource",
-			required: ["name", "namespace"],
+			required: ["name"],
 			minimal_config:
-				'resource "xcsh_api_crawler" "example" {\n  name      = "example-api-crawler"\n  namespace = "staging"\n}',
+				'resource "xcsh_api_crawler" "example" {\n  name      = "example-api-crawler"\n  namespace = "system"\n}',
 			dependencies: {
 				requires: [],
 			},
@@ -315,7 +315,7 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 			description: "API Definition",
 			required: ["name", "namespace"],
 			minimal_config:
-				'resource "xcsh_api_definition" "example" {\n  name      = "example-api-definition"\n  namespace = "staging"\n}',
+				'resource "xcsh_api_definition" "example" {\n  name      = "example-api-definition"\n  namespace = "system"\n}',
 			dependencies: {
 				requires: ["namespace"],
 			},
@@ -326,7 +326,7 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 			description: "API discovery creates a new object in the storage backend for metadata.namespace",
 			required: ["name", "namespace", "user_defined_api_discovery_policy"],
 			minimal_config:
-				'resource "xcsh_api_discovery" "example" {\n  name      = "example-api-discovery"\n  namespace = "staging"\n}',
+				'resource "xcsh_api_discovery" "example" {\n  name      = "example-api-discovery"\n  namespace = "system"\n}',
 			dependencies: {
 				requires: [],
 			},
@@ -335,9 +335,9 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 		api_testing: {
 			category: "api-security",
 			description: "API Testing resource",
-			required: ["name", "namespace", "custom_header_value"],
+			required: ["name", "custom_header_value"],
 			minimal_config:
-				'resource "xcsh_api_testing" "example" {\n  name      = "example-api-testing"\n  namespace = "staging"\n\n  custom_header_value = "example-value"\n}',
+				'resource "xcsh_api_testing" "example" {\n  name      = "example-api-testing"\n  namespace = "system"\n\n  custom_header_value = "example-value"\n}',
 			dependencies: {
 				requires: [],
 			},
@@ -356,9 +356,9 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 		app_api_group: {
 			category: "api-security",
 			description: "App_api_group creates a new object in the storage backend for metadata.namespace",
-			required: ["name", "namespace"],
+			required: ["name"],
 			minimal_config:
-				'resource "xcsh_app_api_group" "example" {\n  name      = "example-app-api-group"\n  namespace = "staging"\n}',
+				'resource "xcsh_app_api_group" "example" {\n  name      = "example-app-api-group"\n  namespace = "system"\n}',
 			dependencies: {
 				requires: [],
 			},
@@ -378,9 +378,9 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 		app_setting: {
 			category: "applications",
 			description: "App setting configuration in namespace metadata.namespace",
-			required: ["name", "namespace"],
+			required: ["name"],
 			minimal_config:
-				'resource "xcsh_app_setting" "example" {\n  name      = "example-app-setting"\n  namespace = "staging"\n}',
+				'resource "xcsh_app_setting" "example" {\n  name      = "example-app-setting"\n  namespace = "system"\n}',
 			dependencies: {
 				requires: [],
 			},
@@ -389,9 +389,9 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 		app_type: {
 			category: "applications",
 			description: "App type will create the configuration in namespace metadata.namespace",
-			required: ["name", "namespace"],
+			required: ["name"],
 			minimal_config:
-				'resource "xcsh_app_type" "example" {\n  name      = "example-app-type"\n  namespace = "staging"\n}',
+				'resource "xcsh_app_type" "example" {\n  name      = "example-app-type"\n  namespace = "system"\n}',
 			dependencies: {
 				requires: [],
 			},
@@ -433,9 +433,9 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 		aws_tgw_site: {
 			category: "sites",
 			description: "Deploying F5 sites connected via AWS Transit Gateway",
-			required: ["name", "namespace"],
+			required: ["name"],
 			minimal_config:
-				'resource "xcsh_aws_tgw_site" "example" {\n  name      = "example-aws-tgw-site"\n  namespace = "staging"\n}',
+				'resource "xcsh_aws_tgw_site" "example" {\n  name      = "example-aws-tgw-site"\n  namespace = "system"\n}',
 			dependencies: {
 				requires: [],
 			},
@@ -444,9 +444,9 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 		aws_vpc_site: {
 			category: "sites",
 			description: "Deploying F5 sites within AWS VPC environments",
-			required: ["name", "namespace", "address", "aws_region", "disk_size", "instance_type", "ssh_key"],
+			required: ["name", "address", "aws_region", "disk_size", "instance_type", "ssh_key"],
 			minimal_config:
-				'resource "xcsh_aws_vpc_site" "example" {\n  name      = "example-aws-vpc-site"\n  namespace = "staging"\n\n  aws_region    = "example-value"\n  instance_type = "example-value"\n  ssh_key       = "example-value"\n  address       = "example-value"\n  disk_size     = 1\n}',
+				'resource "xcsh_aws_vpc_site" "example" {\n  name      = "example-aws-vpc-site"\n  namespace = "system"\n\n  aws_region    = "example-value"\n  instance_type = "example-value"\n  ssh_key       = "example-value"\n  address       = "example-value"\n  disk_size     = 1\n}',
 			dependencies: {
 				requires: [],
 			},
@@ -455,9 +455,9 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 		azure_vnet_site: {
 			category: "sites",
 			description: "Deploying F5 sites within Azure Virtual Network environments",
-			required: ["name", "namespace", "machine_type", "resource_group", "ssh_key"],
+			required: ["name", "machine_type", "resource_group", "ssh_key"],
 			minimal_config:
-				'resource "xcsh_azure_vnet_site" "example" {\n  name      = "example-Azure-vnet-site"\n  namespace = "staging"\n\n  machine_type   = "example-value"\n  resource_group = "example-value"\n  ssh_key        = "example-value"\n}',
+				'resource "xcsh_azure_vnet_site" "example" {\n  name      = "example-Azure-vnet-site"\n  namespace = "system"\n\n  machine_type   = "example-value"\n  resource_group = "example-value"\n  ssh_key        = "example-value"\n}',
 			dependencies: {
 				requires: [],
 			},
@@ -467,8 +467,8 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 			category: "networking",
 			description:
 				"Bgp object is the configuration for peering with external bgp servers. it is created by users in system namespace. configuration",
-			required: ["name", "namespace"],
-			minimal_config: 'resource "xcsh_bgp" "example" {\n  name      = "example-bgp"\n  namespace = "staging"\n}',
+			required: ["name"],
+			minimal_config: 'resource "xcsh_bgp" "example" {\n  name      = "example-bgp"\n  namespace = "system"\n}',
 			dependencies: {
 				requires: [],
 			},
@@ -477,9 +477,9 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 		bgp_asn_set: {
 			category: "networking",
 			description: "Bgp_asn_set creates a new object in the storage backend for metadata.namespace",
-			required: ["name", "namespace"],
+			required: ["name"],
 			minimal_config:
-				'resource "xcsh_bgp_asn_set" "example" {\n  name      = "example-bgp-asn-set"\n  namespace = "staging"\n\n  as_numbers = [1]\n}',
+				'resource "xcsh_bgp_asn_set" "example" {\n  name      = "example-bgp-asn-set"\n  namespace = "system"\n\n  as_numbers = [1]\n}',
 			dependencies: {
 				requires: [],
 			},
@@ -588,9 +588,9 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 		cloud_credentials: {
 			category: "authentication",
 			description: "Api to create cloud_credentials object. configuration",
-			required: ["name", "namespace"],
+			required: ["name"],
 			minimal_config:
-				'resource "xcsh_cloud_credentials" "example" {\n  name      = "example-cloud-credentials"\n  namespace = "staging"\n}',
+				'resource "xcsh_cloud_credentials" "example" {\n  name      = "example-cloud-credentials"\n  namespace = "system"\n}',
 			dependencies: {
 				requires: [],
 			},
@@ -599,9 +599,9 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 		cloud_elastic_ip: {
 			category: "cloud-resources",
 			description: "Cloud Elastic IP creates Cloud Elastic IP object Object is attached to a site",
-			required: ["name", "namespace", "item_count"],
+			required: ["name", "item_count"],
 			minimal_config:
-				'resource "xcsh_cloud_elastic_ip" "example" {\n  name      = "example-cloud-elastic-ip"\n  namespace = "staging"\n\n  item_count = 1\n}',
+				'resource "xcsh_cloud_elastic_ip" "example" {\n  name      = "example-cloud-elastic-ip"\n  namespace = "system"\n\n  item_count = 1\n}',
 			dependencies: {
 				requires: [],
 			},
@@ -651,9 +651,9 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 		code_base_integration: {
 			category: "integrations",
 			description: "Integration details",
-			required: ["name", "namespace"],
+			required: ["name"],
 			minimal_config:
-				'resource "xcsh_code_base_integration" "example" {\n  name      = "example-code-base-integration"\n  namespace = "staging"\n}',
+				'resource "xcsh_code_base_integration" "example" {\n  name      = "example-code-base-integration"\n  namespace = "system"\n}',
 			dependencies: {
 				requires: [],
 			},
@@ -706,9 +706,9 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 		dc_cluster_group: {
 			category: "networking",
 			description: "DC Cluster group in given namespace",
-			required: ["name", "namespace"],
+			required: ["name"],
 			minimal_config:
-				'resource "xcsh_dc_cluster_group" "example" {\n  name      = "example-dc-cluster-group"\n  namespace = "staging"\n}',
+				'resource "xcsh_dc_cluster_group" "example" {\n  name      = "example-dc-cluster-group"\n  namespace = "system"\n}',
 			dependencies: {
 				requires: [],
 			},
@@ -717,9 +717,9 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 		discovery: {
 			category: "applications",
 			description: "Api to create discovery object for a site or virtual site in system namespace. configuration",
-			required: ["name", "namespace"],
+			required: ["name"],
 			minimal_config:
-				'resource "xcsh_discovery" "example" {\n  name      = "example-discovery"\n  namespace = "staging"\n}',
+				'resource "xcsh_discovery" "example" {\n  name      = "example-discovery"\n  namespace = "system"\n}',
 			dependencies: {
 				requires: [],
 			},
@@ -740,9 +740,9 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 		dns_domain: {
 			category: "dns",
 			description: "DNS Domain in a given namespace. If one already exist it will give a error",
-			required: ["name", "namespace", "dnssec_mode"],
+			required: ["name", "dnssec_mode"],
 			minimal_config:
-				'resource "xcsh_dns_domain" "example" {\n  name      = "example-dns-domain"\n  namespace = "staging"\n\n  dnssec_mode = "DNSSEC_DISABLE"\n}',
+				'resource "xcsh_dns_domain" "example" {\n  name      = "example-dns-domain"\n  namespace = "system"\n\n  dnssec_mode = "DNSSEC_DISABLE"\n}',
 			dependencies: {
 				requires: [],
 			},
@@ -751,9 +751,9 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 		dns_lb_health_check: {
 			category: "dns",
 			description: "DNS Load Balancer Health Check in a given namespace. If one already exist it will give a error",
-			required: ["name", "namespace"],
+			required: ["name"],
 			minimal_config:
-				'resource "xcsh_dns_lb_health_check" "example" {\n  name      = "example-dns-lb-health-check"\n  namespace = "staging"\n}',
+				'resource "xcsh_dns_lb_health_check" "example" {\n  name      = "example-dns-lb-health-check"\n  namespace = "system"\n}',
 			dependencies: {
 				requires: [],
 			},
@@ -762,9 +762,9 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 		dns_lb_pool: {
 			category: "dns",
 			description: "DNS Load Balancer Pool in a given namespace. If one already exist it will give a error",
-			required: ["name", "namespace", "load_balancing_mode"],
+			required: ["name", "load_balancing_mode"],
 			minimal_config:
-				'resource "xcsh_dns_lb_pool" "example" {\n  name      = "example-dns-lb-pool"\n  namespace = "staging"\n\n  load_balancing_mode = "ROUND_ROBIN"\n}',
+				'resource "xcsh_dns_lb_pool" "example" {\n  name      = "example-dns-lb-pool"\n  namespace = "system"\n\n  load_balancing_mode = "ROUND_ROBIN"\n}',
 			dependencies: {
 				requires: [],
 			},
@@ -795,9 +795,9 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 		dns_zone: {
 			category: "dns",
 			description: "DNS Zone in a given namespace. If one already exist it will give a error",
-			required: ["name", "namespace"],
+			required: ["name"],
 			minimal_config:
-				'resource "xcsh_dns_zone" "example" {\n  name      = "example-dns-zone"\n  namespace = "staging"\n}',
+				'resource "xcsh_dns_zone" "example" {\n  name      = "example-dns-zone"\n  namespace = "system"\n}',
 			dependencies: {
 				requires: [],
 			},
@@ -806,9 +806,9 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 		endpoint: {
 			category: "load-balancing",
 			description: "Endpoint will create the object in the storage backend for namespace metadata.namespace",
-			required: ["name", "namespace", "health_check_port", "port", "protocol"],
+			required: ["name", "health_check_port", "port", "protocol"],
 			minimal_config:
-				'resource "xcsh_endpoint" "example" {\n  name      = "example-endpoint"\n  namespace = "staging"\n\n  health_check_port = 1\n  port              = 1\n  protocol          = "example-value"\n}',
+				'resource "xcsh_endpoint" "example" {\n  name      = "example-endpoint"\n  namespace = "system"\n\n  health_check_port = 1\n  port              = 1\n  protocol          = "example-value"\n}',
 			dependencies: {
 				requires: [],
 			},
@@ -851,9 +851,9 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 		fast_acl_rule: {
 			category: "security",
 			description: "New Fast ACL rule, has specification to match source IP, source port and action to apply",
-			required: ["name", "namespace"],
+			required: ["name"],
 			minimal_config:
-				'resource "xcsh_fast_acl_rule" "example" {\n  name      = "example-fast-acl-rule"\n  namespace = "staging"\n}',
+				'resource "xcsh_fast_acl_rule" "example" {\n  name      = "example-fast-acl-rule"\n  namespace = "system"\n}',
 			dependencies: {
 				requires: [],
 			},
@@ -875,14 +875,13 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 			description: "Fleet will create a fleet object in 'system' namespace of the user",
 			required: [
 				"name",
-				"namespace",
 				"enable_default_fleet_config_download",
 				"fleet_label",
 				"operating_system_version",
 				"volterra_software_version",
 			],
 			minimal_config:
-				'resource "xcsh_fleet" "example" {\n  name      = "example-fleet"\n  namespace = "staging"\n\n  fleet_label                          = "example-value"\n  enable_default_fleet_config_download = true\n  operating_system_version             = "example-value"\n  volterra_software_version            = "example-value"\n}',
+				'resource "xcsh_fleet" "example" {\n  name      = "example-fleet"\n  namespace = "system"\n\n  fleet_label                          = "example-value"\n  enable_default_fleet_config_download = true\n  operating_system_version             = "example-value"\n  volterra_software_version            = "example-value"\n}',
 			dependencies: {
 				requires: [],
 			},
@@ -913,9 +912,9 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 		gcp_vpc_site: {
 			category: "sites",
 			description: "Deploying F5 sites within Google Cloud VPC environments",
-			required: ["name", "namespace", "address", "disk_size", "gcp_region", "instance_type", "ssh_key"],
+			required: ["name", "address", "disk_size", "gcp_region", "instance_type", "ssh_key"],
 			minimal_config:
-				'resource "xcsh_gcp_vpc_site" "example" {\n  name      = "example-gcp-vpc-site"\n  namespace = "staging"\n\n  gcp_region    = "example-value"\n  instance_type = "example-value"\n  ssh_key       = "example-value"\n  address       = "example-value"\n  disk_size     = 1\n}',
+				'resource "xcsh_gcp_vpc_site" "example" {\n  name      = "example-gcp-vpc-site"\n  namespace = "system"\n\n  gcp_region    = "example-value"\n  instance_type = "example-value"\n  ssh_key       = "example-value"\n  address       = "example-value"\n  disk_size     = 1\n}',
 			dependencies: {
 				requires: [],
 			},
@@ -937,7 +936,7 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 			description: "New Global Log Receiver object",
 			required: ["name", "namespace", "log_type", "receiver_choice"],
 			minimal_config:
-				'resource "xcsh_global_log_receiver" "example" {\n  name      = "example-global-log-receiver"\n  namespace = "staging"\n}',
+				'resource "xcsh_global_log_receiver" "example" {\n  name      = "example-global-log-receiver"\n  namespace = "system"\n}',
 			dependencies: {
 				requires: [],
 			},
@@ -1039,7 +1038,7 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 			description: "K8s_cluster will create the object in the storage backend for namespace metadata.namespace",
 			required: ["name", "namespace"],
 			minimal_config:
-				'resource "xcsh_k8s_cluster" "example" {\n  name      = "example-k8s-cluster"\n  namespace = "staging"\n}',
+				'resource "xcsh_k8s_cluster" "example" {\n  name      = "example-k8s-cluster"\n  namespace = "system"\n}',
 			dependencies: {
 				requires: [],
 			},
@@ -1048,9 +1047,9 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 		k8s_cluster_role: {
 			category: "kubernetes",
 			description: "K8s_cluster_role will create the object in the storage backend for namespace metadata.namespace",
-			required: ["name", "namespace"],
+			required: ["name"],
 			minimal_config:
-				'resource "xcsh_k8s_cluster_role" "example" {\n  name      = "example-k8s-cluster-role"\n  namespace = "staging"\n}',
+				'resource "xcsh_k8s_cluster_role" "example" {\n  name      = "example-k8s-cluster-role"\n  namespace = "system"\n}',
 			dependencies: {
 				requires: [],
 			},
@@ -1060,9 +1059,9 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 			category: "kubernetes",
 			description:
 				"K8s_cluster_role_binding will create the object in the storage backend for namespace metadata.namespace",
-			required: ["name", "namespace"],
+			required: ["name"],
 			minimal_config:
-				'resource "xcsh_k8s_cluster_role_binding" "example" {\n  name      = "example-k8s-cluster-role-binding"\n  namespace = "staging"\n}',
+				'resource "xcsh_k8s_cluster_role_binding" "example" {\n  name      = "example-k8s-cluster-role-binding"\n  namespace = "system"\n}',
 			dependencies: {
 				requires: [],
 			},
@@ -1094,9 +1093,9 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 		log_receiver: {
 			category: "monitoring",
 			description: "New Log Receiver object",
-			required: ["name", "namespace"],
+			required: ["name"],
 			minimal_config:
-				'resource "xcsh_log_receiver" "example" {\n  name      = "example-log-receiver"\n  namespace = "staging"\n}',
+				'resource "xcsh_log_receiver" "example" {\n  name      = "example-log-receiver"\n  namespace = "system"\n}',
 			dependencies: {
 				requires: [],
 			},
@@ -1140,9 +1139,9 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 		nat_policy: {
 			category: "security",
 			description: "Nat policy create specification configures nat policy with multiple rules,. configuration",
-			required: ["name", "namespace"],
+			required: ["name"],
 			minimal_config:
-				'resource "xcsh_nat_policy" "example" {\n  name      = "example-nat-policy"\n  namespace = "staging"\n}',
+				'resource "xcsh_nat_policy" "example" {\n  name      = "example-nat-policy"\n  namespace = "system"\n}',
 			dependencies: {
 				requires: [],
 			},
@@ -1151,9 +1150,9 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 		network_connector: {
 			category: "networking",
 			description: "Network connector is created by users in system namespace. configuration",
-			required: ["name", "namespace"],
+			required: ["name"],
 			minimal_config:
-				'resource "xcsh_network_connector" "example" {\n  name      = "example-network-connector"\n  namespace = "staging"\n}',
+				'resource "xcsh_network_connector" "example" {\n  name      = "example-network-connector"\n  namespace = "system"\n}',
 			dependencies: {
 				requires: [],
 			},
@@ -1164,7 +1163,7 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 			description: "Network firewall is created by users in system namespace. configuration",
 			required: ["name", "namespace"],
 			minimal_config:
-				'resource "xcsh_network_firewall" "example" {\n  name      = "example-network-firewall"\n  namespace = "staging"\n}',
+				'resource "xcsh_network_firewall" "example" {\n  name      = "example-network-firewall"\n  namespace = "system"\n}',
 			dependencies: {
 				requires: [],
 			},
@@ -1174,9 +1173,9 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 			category: "networking",
 			description:
 				"Network interface represents configuration of a network device. it is created by users in system namespace. configuration",
-			required: ["name", "namespace"],
+			required: ["name"],
 			minimal_config:
-				'resource "xcsh_network_interface" "example" {\n  name      = "example-network-interface"\n  namespace = "staging"\n}',
+				'resource "xcsh_network_interface" "example" {\n  name      = "example-network-interface"\n  namespace = "system"\n}',
 			dependencies: {
 				requires: [],
 			},
@@ -1196,9 +1195,9 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 		network_policy_rule: {
 			category: "security",
 			description: "Network policy rule with configured parameters in specified namespace",
-			required: ["name", "namespace"],
+			required: ["name"],
 			minimal_config:
-				'resource "xcsh_network_policy_rule" "example" {\n  name      = "example-network-policy-rule"\n  namespace = "staging"\n}',
+				'resource "xcsh_network_policy_rule" "example" {\n  name      = "example-network-policy-rule"\n  namespace = "system"\n}',
 			dependencies: {
 				requires: [],
 			},
@@ -1218,9 +1217,9 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 		nfv_service: {
 			category: "networking",
 			description: "New NFV service with configured parameters",
-			required: ["name", "namespace"],
+			required: ["name"],
 			minimal_config:
-				'resource "xcsh_nfv_service" "example" {\n  name      = "example-nfv-service"\n  namespace = "staging"\n}',
+				'resource "xcsh_nfv_service" "example" {\n  name      = "example-nfv-service"\n  namespace = "system"\n}',
 			dependencies: {
 				requires: [],
 			},
@@ -1230,9 +1229,9 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 			category: "networking",
 			description:
 				"Api to create nginx service discovery object for a site or virtual site in system namespace. configuration",
-			required: ["name", "namespace"],
+			required: ["name"],
 			minimal_config:
-				'resource "xcsh_nginx_service_discovery" "example" {\n  name      = "example-nginx-service-discovery"\n  namespace = "staging"\n}',
+				'resource "xcsh_nginx_service_discovery" "example" {\n  name      = "example-nginx-service-discovery"\n  namespace = "system"\n}',
 			dependencies: {
 				requires: [],
 			},
@@ -1279,7 +1278,7 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 				"Protocol Inspection Specification in a given namespace. If one already exists it will give an error",
 			required: ["name", "namespace", "enable_disable_compliance_checks", "enable_disable_signatures"],
 			minimal_config:
-				'resource "xcsh_protocol_inspection" "example" {\n  name      = "example-protocol-inspection"\n  namespace = "staging"\n}',
+				'resource "xcsh_protocol_inspection" "example" {\n  name      = "example-protocol-inspection"\n  namespace = "system"\n}',
 			dependencies: {
 				requires: [],
 			},
@@ -1344,9 +1343,9 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 		secret_management_access: {
 			category: "authentication",
 			description: "Secret_management_access creates a new object in storage backend for metadata.namespace",
-			required: ["name", "namespace", "provider_name"],
+			required: ["name", "provider_name"],
 			minimal_config:
-				'resource "xcsh_secret_management_access" "example" {\n  name      = "example-secret-management-access"\n  namespace = "staging"\n\n  provider_name = "example-value"\n}',
+				'resource "xcsh_secret_management_access" "example" {\n  name      = "example-secret-management-access"\n  namespace = "system"\n\n  provider_name = "example-value"\n}',
 			dependencies: {
 				requires: [],
 			},
@@ -1355,9 +1354,9 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 		securemesh_site: {
 			category: "sites",
 			description: "Deploying secure mesh edge sites with distributed security capabilities",
-			required: ["name", "namespace", "address", "volterra_certified_hw"],
+			required: ["name", "address", "volterra_certified_hw"],
 			minimal_config:
-				'resource "xcsh_securemesh_site" "example" {\n  name      = "example-securemesh-site"\n  namespace = "staging"\n\n  volterra_certified_hw = "example-value"\n  worker_nodes          = ["example-value"]\n  address               = "example-value"\n}',
+				'resource "xcsh_securemesh_site" "example" {\n  name      = "example-securemesh-site"\n  namespace = "system"\n\n  volterra_certified_hw = "example-value"\n  worker_nodes          = ["example-value"]\n  address               = "example-value"\n}',
 			dependencies: {
 				requires: [],
 			},
@@ -1366,9 +1365,9 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 		securemesh_site_v2: {
 			category: "sites",
 			description: "Deploying secure mesh edge sites with enhanced security and networking features",
-			required: ["name", "namespace"],
+			required: ["name"],
 			minimal_config:
-				'resource "xcsh_securemesh_site_v2" "example" {\n  name      = "example-securemesh-site-v2"\n  namespace = "staging"\n}',
+				'resource "xcsh_securemesh_site_v2" "example" {\n  name      = "example-securemesh-site-v2"\n  namespace = "system"\n}',
 			dependencies: {
 				requires: [],
 			},
@@ -1421,9 +1420,9 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 		site: {
 			category: "sites",
 			description: "Virtual site object in given namespace",
-			required: ["name", "namespace", "site_type"],
+			required: ["name", "site_type"],
 			minimal_config:
-				'resource "xcsh_site" "example" {\n  name      = "example-site"\n  namespace = "staging"\n\n  site_type = "INVALID"\n}',
+				'resource "xcsh_site" "example" {\n  name      = "example-site"\n  namespace = "system"\n\n  site_type = "INVALID"\n}',
 			dependencies: {
 				requires: [],
 			},
@@ -1432,9 +1431,9 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 		site_mesh_group: {
 			category: "sites",
 			description: "Site Mesh Group in system namespace of user",
-			required: ["name", "namespace"],
+			required: ["name"],
 			minimal_config:
-				'resource "xcsh_site_mesh_group" "example" {\n  name      = "example-site-mesh-group"\n  namespace = "staging"\n}',
+				'resource "xcsh_site_mesh_group" "example" {\n  name      = "example-site-mesh-group"\n  namespace = "system"\n}',
 			dependencies: {
 				requires: [],
 			},
@@ -1483,9 +1482,9 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 		tenant_configuration: {
 			category: "organization",
 			description: "Tenant configuration specification. configuration",
-			required: ["name", "namespace"],
+			required: ["name"],
 			minimal_config:
-				'resource "xcsh_tenant_configuration" "example" {\n  name      = "example-tenant-configuration"\n  namespace = "staging"\n}',
+				'resource "xcsh_tenant_configuration" "example" {\n  name      = "example-tenant-configuration"\n  namespace = "system"\n}',
 			dependencies: {
 				requires: [],
 			},
@@ -1527,9 +1526,9 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 		usb_policy: {
 			category: "security",
 			description: "New USB policy object",
-			required: ["name", "namespace"],
+			required: ["name"],
 			minimal_config:
-				'resource "xcsh_usb_policy" "example" {\n  name      = "example-usb-policy"\n  namespace = "staging"\n}',
+				'resource "xcsh_usb_policy" "example" {\n  name      = "example-usb-policy"\n  namespace = "system"\n}',
 			dependencies: {
 				requires: [],
 			},
@@ -1581,9 +1580,9 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 		virtual_network: {
 			category: "networking",
 			description: "Virtual network in given namespace",
-			required: ["name", "namespace", "legacy_type"],
+			required: ["name", "legacy_type"],
 			minimal_config:
-				'resource "xcsh_virtual_network" "example" {\n  name      = "example-virtual-network"\n  namespace = "staging"\n\n  legacy_type = "VIRTUAL_NETWORK_SITE_LOCAL"\n}',
+				'resource "xcsh_virtual_network" "example" {\n  name      = "example-virtual-network"\n  namespace = "system"\n\n  legacy_type = "VIRTUAL_NETWORK_SITE_LOCAL"\n}',
 			dependencies: {
 				requires: [],
 			},
@@ -1594,7 +1593,7 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 			description: "Virtual site object in given namespace",
 			required: ["name", "namespace", "site_type", "site_selector"],
 			minimal_config:
-				'resource "xcsh_virtual_site" "example" {\n  name      = "example-virtual-site"\n  namespace = "staging"\n\n  site_type = "INVALID"\n}',
+				'resource "xcsh_virtual_site" "example" {\n  name      = "example-virtual-site"\n  namespace = "system"\n\n  site_type = "INVALID"\n}',
 			dependencies: {
 				requires: [],
 			},
@@ -1603,9 +1602,9 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 		voltstack_site: {
 			category: "sites",
 			description: "Deploying Volterra stack sites for edge computing",
-			required: ["name", "namespace", "address", "volterra_certified_hw"],
+			required: ["name", "address", "volterra_certified_hw"],
 			minimal_config:
-				'resource "xcsh_voltstack_site" "example" {\n  name      = "example-voltstack-site"\n  namespace = "staging"\n\n  volterra_certified_hw = "example-value"\n  worker_nodes          = ["example-value"]\n  address               = "example-value"\n}',
+				'resource "xcsh_voltstack_site" "example" {\n  name      = "example-voltstack-site"\n  namespace = "system"\n\n  volterra_certified_hw = "example-value"\n  worker_nodes          = ["example-value"]\n  address               = "example-value"\n}',
 			dependencies: {
 				requires: [],
 			},

package/src/sdk.ts

@@ -31,7 +31,13 @@ import { loadCapability } from "./capability";
 import { type Rule, ruleCapability } from "./capability/rule";
 import { hasLiteLLMEnv } from "./config/auto-config";
 import { ModelRegistry } from "./config/model-registry";
-import { formatModelString, parseModelPattern, parseModelString, resolveModelRoleValue } from "./config/model-resolver";
+import {
+	defaultModelPerProvider,
+	formatModelString,
+	parseModelPattern,
+	parseModelString,
+	resolveModelRoleValue,
+} from "./config/model-resolver";
 import { loadPromptTemplates as loadPromptTemplatesInternal, type PromptTemplate } from "./config/prompt-templates";
 import { Settings, type SkillsSettings } from "./config/settings";
 import { CursorExecHandlers } from "./cursor";
@@ -1296,8 +1302,26 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 		// Fall back to first available model with a valid API key.
 		// Skip fallback if the user explicitly requested a model via --model that wasn't found.
 		if (!model && !options.modelPattern) {
-			const allModels = modelRegistry.getAll();
-			for (const candidate of allModels) {
+			// Scope automatic selection to providers the user has actually configured
+			// in models.yml. This keeps a stray credential for an unconfigured provider
+			// (e.g. an expired AWS_PROFILE that makes Bedrock look "authenticated") from
+			// ever being selected, and stops us probing the entire bundled catalog. A
+			// fresh install (nothing configured) falls straight through to /login guidance
+			// instead of walking legacy catalog entries the proxy can't serve.
+			const configuredProviders = modelRegistry.getConfiguredProviderIds();
+			const candidates =
+				configuredProviders.size > 0
+					? modelRegistry.getAll().filter(candidate => configuredProviders.has(candidate.provider))
+					: [];
+			// Within a configured provider, prefer its designated default model over raw
+			// catalog order (which begins at legacy ids like claude-3-5-sonnet-20240620).
+			const isProviderDefault = (candidate: Model): boolean =>
+				defaultModelPerProvider[candidate.provider as keyof typeof defaultModelPerProvider] === candidate.id;
+			const orderedCandidates = [
+				...candidates.filter(isProviderDefault),
+				...candidates.filter(candidate => !isProviderDefault(candidate)),
+			];
+			for (const candidate of orderedCandidates) {
 				if (await hasModelApiKey(candidate)) {
 					model = candidate;
 					break;

package/src/session/agent-session.ts

@@ -2658,8 +2658,12 @@ export class AgentSession {
 				);
 			}
 
-			// Validate API key
-			const apiKey = await this.#modelRegistry.getApiKey(this.model, this.sessionId);
+			// Validate API key. Capture the guard-narrowed model into a local: TS narrowing
+			// of the `this.model` getter does not persist into the ttftAttr closure below.
+			const model = this.model;
+			const apiKey = await logger.ttftAttr("ttft.getapikey", () =>
+				this.#modelRegistry.getApiKey(model, this.sessionId),
+			);
 			if (!apiKey) {
 				throw new Error(
 					`No API key found for ${this.model.provider}.\n\n` +
@@ -2674,20 +2678,23 @@ export class AgentSession {
 			}
 
 			// Build messages array (session context, eager todo prelude, then active prompt message)
-			const messages: AgentMessage[] = [];
-			const planReferenceMessage = await this.#buildPlanReferenceMessage?.();
-			if (planReferenceMessage) {
-				messages.push(planReferenceMessage);
-			}
-			const planModeMessage = await this.#buildPlanModeMessage();
-			if (planModeMessage) {
-				messages.push(planModeMessage);
-			}
-			if (options?.prependMessages) {
-				messages.push(...options.prependMessages);
-			}
+			const messages: AgentMessage[] = await logger.ttftAttr("ttft.build-context", async () => {
+				const built: AgentMessage[] = [];
+				const planReferenceMessage = await this.#buildPlanReferenceMessage?.();
+				if (planReferenceMessage) {
+					built.push(planReferenceMessage);
+				}
+				const planModeMessage = await this.#buildPlanModeMessage();
+				if (planModeMessage) {
+					built.push(planModeMessage);
+				}
+				if (options?.prependMessages) {
+					built.push(...options.prependMessages);
+				}
 
-			messages.push(message);
+				built.push(message);
+				return built;
+			});
 
 			// Early bail-out: if a newer abort/prompt cycle started during setup,
 			// return before mutating shared state (nextTurn messages, system prompt).
@@ -2711,12 +2718,12 @@ export class AgentSession {
 				messages.push(...fileMentionMessages);
 			}
 
-			// Emit before_agent_start extension event
+			// Emit before_agent_start extension event. Capture the narrowed runner into a
+			// local: the `this.#extensionRunner` guard does not narrow inside the closure.
 			if (this.#extensionRunner) {
-				const result = await this.#extensionRunner.emitBeforeAgentStart(
-					expandedText,
-					options?.images,
-					this.#baseSystemPrompt,
+				const runner = this.#extensionRunner;
+				const result = await logger.ttftAttr("ttft.before-agent-start-hook", () =>
+					runner.emitBeforeAgentStart(expandedText, options?.images, this.#baseSystemPrompt),
 				);
 				if (result?.messages) {
 					const promptAttribution: "user" | "agent" | undefined =
@@ -2747,7 +2754,9 @@ export class AgentSession {
 			}
 
 			const agentPromptOptions = options?.toolChoice ? { toolChoice: options.toolChoice } : undefined;
-			await this.#promptAgentWithIdleRetry(messages, agentPromptOptions);
+			await logger.ttftAttr("ttft.agent-loop-total", () =>
+				this.#promptAgentWithIdleRetry(messages, agentPromptOptions),
+			);
 			if (!options?.skipPostPromptRecoveryWait) {
 				await this.#waitForPostPromptRecovery();
 			}