@f5-sales-demo/xcsh 19.81.0 → 19.81.1

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@f5-sales-demo/xcsh",
-	"version": "19.81.0",
+	"version": "19.81.1",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://github.com/f5-sales-demo/xcsh",
 	"author": "Can Boluk",
@@ -56,13 +56,13 @@
 	"dependencies": {
 		"@agentclientprotocol/sdk": "0.16.1",
 		"@mozilla/readability": "^0.6",
-		"@f5-sales-demo/xcsh-stats": "19.81.0",
-		"@f5-sales-demo/pi-agent-core": "19.81.0",
-		"@f5-sales-demo/pi-ai": "19.81.0",
-		"@f5-sales-demo/pi-natives": "19.81.0",
-		"@f5-sales-demo/pi-resource-management": "19.81.0",
-		"@f5-sales-demo/pi-tui": "19.81.0",
-		"@f5-sales-demo/pi-utils": "19.81.0",
+		"@f5-sales-demo/xcsh-stats": "19.81.1",
+		"@f5-sales-demo/pi-agent-core": "19.81.1",
+		"@f5-sales-demo/pi-ai": "19.81.1",
+		"@f5-sales-demo/pi-natives": "19.81.1",
+		"@f5-sales-demo/pi-resource-management": "19.81.1",
+		"@f5-sales-demo/pi-tui": "19.81.1",
+		"@f5-sales-demo/pi-utils": "19.81.1",
 		"@sinclair/typebox": "^0.34",
 		"@xterm/headless": "^6.0",
 		"ajv": "^8.20",

package/src/browser/capabilities.generated.ts

@@ -26,7 +26,7 @@ export interface ExtensionCapabilities {
 
 export const EXTENSION_CAPABILITIES: ExtensionCapabilities = {
 	"version": "0.1.0",
-	"contractVersion": "1.10.0",
+	"contractVersion": "1.11.0",
 	"multiPortDiscovery": true,
 	"protocol": "tool_request/result",
 	"tools": [
@@ -786,6 +786,29 @@ export const EXTENSION_CAPABILITIES: ExtensionCapabilities = {
 		}
 	],
 	"features": {
+		"handshake": {
+			"serveKind": [
+				"office",
+				"browser"
+			],
+			"officePortRange": [
+				19242,
+				19261
+			],
+			"officeWssPortRange": [
+				19342,
+				19361
+			],
+			"browserPortRange": [
+				19222,
+				19241
+			],
+			"browserWssPortRange": [
+				19322,
+				19341
+			],
+			"description": "hello_ack advertises serveKind — how the bridge was STARTED (office-serve vs Chrome worker), distinct from the client's announced host. `xcsh office serve` binds the dedicated office port range and advertises serveKind:\"office\"; the Chrome worker binds the browser range and advertises \"browser\". The Office pane scans only the office wss range AND filters on serveKind:\"office\", so it can never adopt a Chrome worker (a serveKind absent/null is treated as ineligible)."
+		},
 		"explainMode": {
 			"tool": "set_explain_mode",
 			"default": false,
@@ -855,6 +878,6 @@ export const EXTENSION_CAPABILITIES: ExtensionCapabilities = {
 	}
 };
 
-export const EXTENSION_CONTRACT_VERSION = "1.10.0";
+export const EXTENSION_CONTRACT_VERSION = "1.11.0";
 
 export const EXTENSION_TOOL_NAMES: readonly string[] = ["ping","capabilities","reload","debug_exec","detach","set_bridge_port","navigate","login","scroll_to","resize_window","tabs_list","tabs_create","tabs_close","click","click_element","click_xy","type_text","form_input","key_press","select_option","label_select","file_upload","read_ax","get_page_text","query_dom","find","wait_for","assert_text","screenshot","read_console","read_network","diag_suspension","diag_bridges","diag_activation","diag_ttft","capture_login_flow","wait_for_api_response","get_page_context","javascript_tool","browser_batch","set_explain_mode","annotate"];

package/src/browser/capabilities.json

@@ -1,6 +1,6 @@
 {
   "version": "0.1.0",
-  "contractVersion": "1.10.0",
+  "contractVersion": "1.11.0",
   "multiPortDiscovery": true,
   "protocol": "tool_request/result",
   "tools": [
@@ -703,6 +703,14 @@
     }
   ],
   "features": {
+    "handshake": {
+      "serveKind": ["office", "browser"],
+      "officePortRange": [19242, 19261],
+      "officeWssPortRange": [19342, 19361],
+      "browserPortRange": [19222, 19241],
+      "browserWssPortRange": [19322, 19341],
+      "description": "hello_ack advertises serveKind — how the bridge was STARTED (office-serve vs Chrome worker), distinct from the client's announced host. `xcsh office serve` binds the dedicated office port range and advertises serveKind:\"office\"; the Chrome worker binds the browser range and advertises \"browser\". The Office pane scans only the office wss range AND filters on serveKind:\"office\", so it can never adopt a Chrome worker (a serveKind absent/null is treated as ineligible)."
+    },
     "explainMode": {
       "tool": "set_explain_mode",
       "default": false,

package/src/browser/chat-conformance.json

@@ -1,5 +1,5 @@
 {
-  "contractVersion": "1.10.0",
+  "contractVersion": "1.11.0",
   "schemas": {
     "chat_request": {
       "type": "object",

package/src/browser/extension-bridge.ts

@@ -69,10 +69,37 @@ export function resolvePort(port?: number): number {
 	return DEFAULT_PORT;
 }
 
-/** Inclusive loopback discovery range for auto-selected bridge ports. */
+/** Inclusive loopback discovery range for auto-selected bridge ports (Chrome worker). */
 export const PORT_RANGE_START = 19222;
 export const PORT_RANGE_END = 19241;
 
+/**
+ * Dedicated loopback ws range for `xcsh office serve` bridges — DISJOINT from the
+ * Chrome worker range above. Its paired wss listeners land at +{@link WSS_PORT_OFFSET}
+ * (19342–19361). Giving office-serve its own range means a Chrome worker and an
+ * office bridge can never contend for a port, so the office pane (which scans only
+ * the office wss range) can never adopt a Chrome worker. The Chrome fleet's range
+ * is UNCHANGED — zero blast radius on browser automation.
+ */
+export const OFFICE_PORT_RANGE_START = 19242;
+export const OFFICE_PORT_RANGE_END = 19261;
+
+/** An inclusive port range for auto-select. */
+export interface PortRange {
+	start: number;
+	end: number;
+}
+
+/** The Chrome-worker auto-select range (the default). */
+export const CHROME_PORT_RANGE: PortRange = { start: PORT_RANGE_START, end: PORT_RANGE_END };
+
+/** The office-serve auto-select range. */
+export const OFFICE_PORT_RANGE: PortRange = { start: OFFICE_PORT_RANGE_START, end: OFFICE_PORT_RANGE_END };
+
+/** How a bridge was STARTED — its intrinsic scope (distinct from the connecting
+ * client's announced host). Echoed in hello_ack so the office pane can filter. */
+export type ServeKind = "office" | "browser";
+
 /**
  * Fixed offset from a bound ws port to its paired `wss` port. The wss listener is
  * ADDITIVE: when the bridge binds ws port P (in {@link PORT_RANGE_START}–{@link
@@ -140,12 +167,14 @@ export interface BridgeListenOpts {
 	skipOriginCheck?: boolean;
 	/** When present, an additive `wss` listener is started on port + {@link WSS_PORT_OFFSET}. */
 	tls?: BridgeTls;
+	/** Auto-select range for {@link startBridgeServer}; defaults to {@link CHROME_PORT_RANGE}. */
+	range?: PortRange;
 }
 
-/** Every port in the discovery range, lowest first. */
-export function portCandidates(): number[] {
+/** Every port in the given range (default {@link CHROME_PORT_RANGE}), lowest first. */
+export function portCandidates(range: PortRange = CHROME_PORT_RANGE): number[] {
 	const out: number[] = [];
-	for (let p = PORT_RANGE_START; p <= PORT_RANGE_END; p++) out.push(p);
+	for (let p = range.start; p <= range.end; p++) out.push(p);
 	return out;
 }
 
@@ -181,6 +210,10 @@ export class BridgeServer {
 	/** The client host learned from the `hello` handshake (null until a client
 	 * announces one; the Chrome extension omits it → stays null → chrome profile). */
 	#clientHost: ClientHost | null = null;
+	/** How THIS bridge was started (its intrinsic scope). Defaults to "browser" (the
+	 * Chrome worker); office-serve calls {@link setServeKind}("office"). Echoed in
+	 * hello_ack so the office pane's discovery filter never adopts a Chrome worker. */
+	#serveKind: ServeKind = "browser";
 	/** Provider of this process's tenant identity, answering the `hello` handshake. */
 	#sessionInfo:
 		| (() => {
@@ -213,6 +246,17 @@ export class BridgeServer {
 		return this.#clientHost;
 	}
 
+	/** How this bridge was started ("browser" by default; "office" for office-serve). */
+	get serveKind(): ServeKind {
+		return this.#serveKind;
+	}
+
+	/** Declare this bridge's intrinsic scope. Called once at startup by the host
+	 * bootstrap (office-serve → "office"; the Chrome worker → "browser"). */
+	setServeKind(kind: ServeKind): void {
+		this.#serveKind = kind;
+	}
+
 	/** Number of connected extension clients (channels). */
 	get connectedCount(): number {
 		return this.#clients.size;
@@ -412,6 +456,7 @@ export class BridgeServer {
 					apiUrl: info.apiUrl,
 					contextBound: info.contextBound,
 					host: this.#clientHost,
+					serveKind: this.#serveKind,
 					pid: process.pid,
 					wssPort: this.wssPort,
 					canConfigureProvider: true,
@@ -488,8 +533,9 @@ export async function startBridgeServer(port?: number, opts?: BridgeListenOpts):
 		}
 		return server;
 	}
-	for (const candidate of portCandidates()) {
+	const range = opts?.range ?? CHROME_PORT_RANGE;
+	for (const candidate of portCandidates(range)) {
 		if (server.listen(candidate, opts)) return server;
 	}
-	throw new Error(`no free xcsh bridge port in ${PORT_RANGE_START}-${PORT_RANGE_END} — is another app on the range?`);
+	throw new Error(`no free xcsh bridge port in ${range.start}-${range.end} — is another app on the range?`);
 }

package/src/browser/headless-bridge.ts

@@ -20,7 +20,7 @@ import { ContextService } from "../services/xcsh-context";
 import { deriveTenantEnv } from "../services/xcsh-env";
 import { resolveBridgeTls } from "./bridge-cert";
 import { ChatHandler } from "./chat-handler";
-import { type BridgeServer, startBridgeServer } from "./extension-bridge";
+import { type BridgeServer, OFFICE_PORT_RANGE, startBridgeServer } from "./extension-bridge";
 import { OFFICE_TOOL_NAMES } from "./extension-bridge-tools";
 import { setSharedBridgeServer } from "./provider";
 
@@ -110,7 +110,13 @@ export async function startHeadlessChatBridge(deps: HeadlessBridgeDeps = default
 	// Provision the wss cert before binding (warm boot = on-disk cache hit);
 	// `undefined` (offline) → the bridge starts ws-only.
 	const tls = await deps.resolveBridgeTls();
-	const bridge = await deps.startBridgeServer(undefined, tls ? { tls } : undefined);
+	// Office-serve binds the DEDICATED office range (disjoint from the Chrome worker
+	// range) so the two can never collide on a port.
+	const bridge = await deps.startBridgeServer(undefined, { ...(tls ? { tls } : {}), range: OFFICE_PORT_RANGE });
+	// Advertise this bridge's intrinsic scope UNCONDITIONALLY so the office pane's
+	// discovery filter (requireServeKind:"office") can adopt it and never a Chrome
+	// worker — the starvation-guard the port-isolation UAT pins.
+	bridge.setServeKind("office");
 	// Reuse this bridge for any in-process selectProvider() (no conflicting second bridge).
 	deps.setSharedBridgeServer(bridge);
 	bridge.setSessionInfo(sessionInfoForOfficeServe);

package/src/browser/host-profiles.ts

@@ -45,7 +45,8 @@ export interface HostProfile {
  * chat (not the CLI TUI). Tells the LLM it's in a Chrome side panel alongside the
  * F5 XC console, what tools it has, and how to behave differently from the CLI.
  */
-export const CHROME_CHAT_SYSTEM_PROMPT = `[System: You are xcsh, an AI assistant for the F5 Distributed Cloud console, running as a Chrome browser side panel — not a terminal CLI.
+export const CHROME_CHAT_SYSTEM_PROMPT = `<system-directive>
+You are still xcsh, the F5 Distributed Cloud technical coworker defined in your role above; this session is a Chrome side panel alongside the F5 XC console — an additional surface, not a new identity. Keep your xcsh/F5 purpose and adopt this browser context on top of it.
 
 CRITICAL: ALWAYS respond with TEXT FIRST. Do NOT jump straight to tool calls. The user sees a chat panel and expects a conversational text response, not silence while tools run in the background. For questions ("what page am I on?", "what is this?"), answer with text using the page context below — no tools needed. Only use tools when the user explicitly asks you to DO something (create, navigate, click, modify).
 
@@ -79,7 +80,8 @@ SAFETY — NEVER DO THESE:
 - NEVER kill, stop, or manage processes on port 19222 — that is YOUR OWN bridge. Killing it kills you.
 - NEVER run lsof, fuser, kill, or pkill on the bridge port. You ARE the bridge.
 - NEVER use bash/shell tools to manage xcsh processes, ports, or the debugger connection.
-- NEVER run commands that would terminate your own process or the WebSocket server.]
+- NEVER run commands that would terminate your own process or the WebSocket server.
+</system-directive>
 
 `;
 
@@ -88,7 +90,8 @@ SAFETY — NEVER DO THESE:
  * via host tools (arriving at runtime over the bridge), thinking in cells,
  * ranges, and formula dependencies.
  */
-const EXCEL_CHAT_SYSTEM_PROMPT = `[System: You are xcsh, an AI assistant running as a task pane inside Microsoft Excel — not a terminal CLI. You help the user with the OPEN workbook using the Excel host tools available to you.
+const EXCEL_CHAT_SYSTEM_PROMPT = `<system-directive>
+You are still xcsh, the F5 Distributed Cloud technical coworker defined in your role above. This session reaches you through a Microsoft Excel task pane instead of the terminal — an additional surface, not a new identity. Help the F5 SE with the OPEN workbook (often demo data, MEDDPICC sheets, account plans, pricing models) using the Excel host tools available to you. Keep your xcsh/F5 purpose AND adopt the Excel context on top of it.
 
 CRITICAL: ALWAYS respond with TEXT FIRST — the user sees a chat pane and expects a conversational reply, not silence while tools run. Answer questions from the data you read; only WRITE to the workbook when the user asks you to.
 
@@ -106,7 +109,8 @@ TOOLS: Discover the workbook before you answer, then reach for the tool that mat
 BEHAVIOR:
 - Respond concisely with markdown. The task pane is narrow — avoid long code blocks.
 - Read the workbook to answer questions about its data; do not guess.
-- Make edits only when asked, one clear change at a time, and say what you changed and where.]
+- Make edits only when asked, one clear change at a time, and say what you changed and where.
+</system-directive>
 
 `;
 
@@ -114,7 +118,8 @@ BEHAVIOR:
  * PowerPoint task-pane self-awareness prompt. The assistant works the OPEN
  * presentation via host tools, thinking in slides, shapes, and the slide master.
  */
-const POWERPOINT_CHAT_SYSTEM_PROMPT = `[System: You are xcsh, an AI assistant running as a task pane inside Microsoft PowerPoint — not a terminal CLI. You help the user with the OPEN presentation using the PowerPoint host tools available to you.
+const POWERPOINT_CHAT_SYSTEM_PROMPT = `<system-directive>
+You are still xcsh, the F5 Distributed Cloud technical coworker defined in your role above. This session reaches you through a Microsoft PowerPoint task pane instead of the terminal — an additional surface, not a new identity. Help the F5 SE with the OPEN presentation (often a customer deck, demo walkthrough, or QBR) using the PowerPoint host tools available to you. Keep your xcsh/F5 purpose AND adopt the PowerPoint context on top of it.
 
 CRITICAL: ALWAYS respond with TEXT FIRST — the user sees a chat pane and expects a conversational reply, not silence while tools run. Answer questions from what you read; only edit the deck when the user asks you to.
 
@@ -131,7 +136,8 @@ TOOLS: Discover the deck before you answer, then reach for the tool that matches
 BEHAVIOR:
 - Respond concisely with markdown. The task pane is narrow — avoid long code blocks.
 - Read the presentation to answer questions about it; do not guess.
-- Make edits only when asked, one clear change at a time, and say which slide you changed.]
+- Make edits only when asked, one clear change at a time, and say which slide you changed.
+</system-directive>
 
 `;
 
@@ -140,7 +146,8 @@ BEHAVIOR:
  * via host tools, thinking in paragraphs, the selection, comments, and tracked
  * changes.
  */
-const WORD_CHAT_SYSTEM_PROMPT = `[System: You are xcsh, an AI assistant running as a task pane inside Microsoft Word — not a terminal CLI. You help the user with the OPEN document using the Word host tools available to you.
+const WORD_CHAT_SYSTEM_PROMPT = `<system-directive>
+You are still xcsh, the F5 Distributed Cloud technical coworker defined in your role above. This session reaches you through a Microsoft Word task pane instead of the terminal — an additional surface, not a new identity. Help the F5 SE with the OPEN document (often a proposal, SOW, discovery write-up, or technical brief) using the Word host tools available to you. Keep your xcsh/F5 purpose AND adopt the Word context on top of it.
 
 CRITICAL: ALWAYS respond with TEXT FIRST — the user sees a chat pane and expects a conversational reply, not silence while tools run. Answer questions from what you read; only edit the document when the user asks you to.
 
@@ -158,7 +165,8 @@ TOOLS: Discover the document before you answer, then reach for the tool that mat
 BEHAVIOR:
 - Respond concisely with markdown. The task pane is narrow — avoid long code blocks.
 - Read the document to answer questions about it; do not guess.
-- Make edits only when asked, one clear change at a time, and say what you changed.]
+- Make edits only when asked, one clear change at a time, and say what you changed.
+</system-directive>
 
 `;
 

package/src/commands/worker.ts

@@ -152,6 +152,9 @@ export default class Worker extends Command {
 			`[xcsh worker] extension bridge listening on ws://127.0.0.1:${bridge.port}` +
 				(bridge.wssPort ? ` + wss://${LOCALIP_HOST}:${bridge.wssPort}` : ""),
 		);
+		// This is the Chrome-extension worker: advertise "browser" so the office pane's
+		// serveKind filter never adopts it (explicit; "browser" is also the default).
+		bridge.setServeKind("browser");
 		setSharedBridgeServer(bridge);
 		bridge.setSessionInfo(sessionInfoForWorker);
 		ContextService.onContextChange(() => bridge.broadcastTenantChanged());

package/src/internal-urls/build-info.generated.ts

@@ -17,17 +17,17 @@ export interface BuildInfo {
 }
 
 export const BUILD_INFO: BuildInfo = {
-	"version": "19.81.0",
-	"commit": "49eeba707c688fa7aea7e8eb4289762002c87dc9",
-	"shortCommit": "49eeba7",
+	"version": "19.81.1",
+	"commit": "27b80e6050da531bf6f3b60628a89cc63d92cc66",
+	"shortCommit": "27b80e6",
 	"branch": "main",
-	"tag": "v19.81.0",
-	"commitDate": "2026-07-23T07:03:42Z",
-	"buildDate": "2026-07-23T07:33:53.401Z",
+	"tag": "v19.81.1",
+	"commitDate": "2026-07-23T07:58:54Z",
+	"buildDate": "2026-07-23T08:35:35.676Z",
 	"dirty": true,
 	"prNumber": "",
 	"repoUrl": "https://github.com/f5-sales-demo/xcsh",
 	"repoSlug": "f5-sales-demo/xcsh",
-	"commitUrl": "https://github.com/f5-sales-demo/xcsh/commit/49eeba707c688fa7aea7e8eb4289762002c87dc9",
-	"releaseUrl": "https://github.com/f5-sales-demo/xcsh/releases/tag/v19.81.0"
+	"commitUrl": "https://github.com/f5-sales-demo/xcsh/commit/27b80e6050da531bf6f3b60628a89cc63d92cc66",
+	"releaseUrl": "https://github.com/f5-sales-demo/xcsh/releases/tag/v19.81.1"
 };