@f5-sales-demo/xcsh 19.98.4 → 19.98.6

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@f5-sales-demo/xcsh",
-	"version": "19.98.4",
+	"version": "19.98.6",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://github.com/f5-sales-demo/xcsh",
 	"author": "Can Boluk",
@@ -57,13 +57,13 @@
 	"dependencies": {
 		"@agentclientprotocol/sdk": "1.3.0",
 		"@mozilla/readability": "^0.6",
-		"@f5-sales-demo/xcsh-stats": "19.98.4",
-		"@f5-sales-demo/pi-agent-core": "19.98.4",
-		"@f5-sales-demo/pi-ai": "19.98.4",
-		"@f5-sales-demo/pi-natives": "19.98.4",
-		"@f5-sales-demo/pi-resource-management": "19.98.4",
-		"@f5-sales-demo/pi-tui": "19.98.4",
-		"@f5-sales-demo/pi-utils": "19.98.4",
+		"@f5-sales-demo/xcsh-stats": "19.98.6",
+		"@f5-sales-demo/pi-agent-core": "19.98.6",
+		"@f5-sales-demo/pi-ai": "19.98.6",
+		"@f5-sales-demo/pi-natives": "19.98.6",
+		"@f5-sales-demo/pi-resource-management": "19.98.6",
+		"@f5-sales-demo/pi-tui": "19.98.6",
+		"@f5-sales-demo/pi-utils": "19.98.6",
 		"@sinclair/typebox": "^0.34",
 		"@xterm/headless": "^6.0",
 		"ajv": "^8.20",

package/src/internal-urls/build-info.generated.ts

@@ -17,17 +17,17 @@ export interface BuildInfo {
 }
 
 export const BUILD_INFO: BuildInfo = {
-	"version": "19.98.4",
-	"commit": "c049a0c4d91d1246ef39e74b2aaad17839c240e1",
-	"shortCommit": "c049a0c",
+	"version": "19.98.6",
+	"commit": "9a4b5f250189b2d423b62f15f02c2403c070fb3d",
+	"shortCommit": "9a4b5f2",
 	"branch": "main",
-	"tag": "v19.98.4",
-	"commitDate": "2026-07-28T09:47:36Z",
-	"buildDate": "2026-07-28T10:15:07.707Z",
+	"tag": "v19.98.6",
+	"commitDate": "2026-07-28T11:16:35Z",
+	"buildDate": "2026-07-28T11:40:19.737Z",
 	"dirty": true,
 	"prNumber": "",
 	"repoUrl": "https://github.com/f5-sales-demo/xcsh",
 	"repoSlug": "f5-sales-demo/xcsh",
-	"commitUrl": "https://github.com/f5-sales-demo/xcsh/commit/c049a0c4d91d1246ef39e74b2aaad17839c240e1",
-	"releaseUrl": "https://github.com/f5-sales-demo/xcsh/releases/tag/v19.98.4"
+	"commitUrl": "https://github.com/f5-sales-demo/xcsh/commit/9a4b5f250189b2d423b62f15f02c2403c070fb3d",
+	"releaseUrl": "https://github.com/f5-sales-demo/xcsh/releases/tag/v19.98.6"
 };

package/src/internal-urls/console-catalog.generated.ts

@@ -2,10 +2,10 @@
 
 import type { ConsoleCatalogData } from "./console-catalog-types";
 
-export const CONSOLE_CATALOG_VERSION = "6bc37113b222827033ee81fc8f009344ca11058b";
+export const CONSOLE_CATALOG_VERSION = "9eb4d3c57d88afbc41edb304b88ef3754301bc62";
 
 export const CONSOLE_CATALOG_DATA: ConsoleCatalogData = {
-	version: "6bc37113b222827033ee81fc8f009344ca11058b",
+	version: "9eb4d3c57d88afbc41edb304b88ef3754301bc62",
 	workflows: {
 		"address-allocator/create":
 			'schema: urn:xcsh:console:workflow:v1\nid: address-allocator-create\nlabel: Create IP Address Allocators\nresource: address-allocator\noperation: create\npreconditions:\n  - user_logged_in\n  - namespace_selected\n  - "role_minimum: admin"\nparams:\n  namespace:\n    required: true\n    description: Target namespace\n    example: demo\n  name:\n    required: true\n    description: IP Address Allocators name (lowercase alphanumeric and hyphens)\n    example: example-address-allocator\n  address_allocator_mode:\n    required: true\n    description: Address Allocator Mode\n  allocation_unit:\n    required: false\n    description: Allocation Unit\n    default: 0\n  address_pool:\n    required: false\n    description: Address Pool\n    default: value\n  address_allocation_scheme:\n    required: false\n    description: "Server-required: Field should be not nil"\n    default: value\nsteps:\n  - id: navigate-to-list\n    action: navigate\n    url: /web/workspaces/multi-cloud-network-connect/manage/networking/legacy_network_configuration/address_allocators\n    wait_for: text(\'IP Address Allocators\')\n    description: Navigate to IP Address Allocators list page\n  - id: click-add-tab\n    action: click\n    selector: text(\'Add IP Address Allocator\')\n    wait_for: textbox[name=\'Name\']\n    description: Click Add IP Address Allocator to open the create form\n  - id: fill-name\n    action: fill\n    selector: textbox[name=\'Name\']\n    value: "{name}"\n    description: Enter Name\n  - id: select-address_allocator_mode\n    action: select\n    selector: listbox\n    context: Address Allocator Mode section\n    value: "{address_allocator_mode}"\n    description: Select Address Allocator Mode\n  - id: fill-allocation_unit\n    action: fill\n    selector: spinbutton[name=\'Allocation Unit\']\n    value: "{allocation_unit}"\n    description: Set Allocation Unit\n  - id: fill-address_pool\n    action: fill\n    selector: ngx-datatable input.form-control\n    context: Address Pool table\n    value: "{address_pool}"\n    description: Enter Address Pool in the existing table row (no Add Item needed — the table ships one empty row)\n  - id: select-address_allocation_scheme\n    action: select\n    selector: listbox\n    context: Address Allocation Scheme section\n    value: "{address_allocation_scheme}"\n    description: Select Address Allocation Scheme\n  - id: save\n    action: click\n    selector: "[class*=\'save-bt\'],[class*=\'submit-button\']"\n    context: footer\n    wait_for: text(\'{name}\')\n    wait_timeout_ms: 30000\n    description: Save/submit the form (union selector matches save-bt OR submit-button)\npostconditions:\n  - resource_list_page_visible\n  - "resource_name_in_list: {name}"\nmetadata:\n  confidence: inferred\n  discovered_at: 2026-06-24\n  console_version: "2025.06"\n  notes: Auto-generated by scripts/generate-workflows.ts from api-specs-enriched field metadata.\n',

package/src/sandbox/enforce.ts

@@ -151,6 +151,21 @@ function deny(policy: SandboxPolicy, resolved: string, access: SandboxAccess): T
 	return { block: true, reason: policy.describe(resolved, access) };
 }
 
+/**
+ * `$HOME` and `${HOME}` are spellings of `~`, which `looksLikePath` already treats as a
+ * path (#2534). Three ways to name one file, only one of them checked, is an oversight
+ * rather than a policy: `cat ~/.ssh/id_rsa` was blocked while `cat $HOME/.ssh/id_rsa`
+ * was not. Rewriting to `~` here means detection AND resolution both see the real path,
+ * so the denial names the file rather than a literal dollar sign.
+ *
+ * `\b` keeps `$HOMEBREW_PREFIX` and friends out of it.
+ */
+const HOME_EXPANSION = /^\$(?:HOME\b|\{HOME\})/;
+
+function normalizeHomeExpansion(token: string): string {
+	return HOME_EXPANSION.test(token) ? token.replace(HOME_EXPANSION, "~") : token;
+}
+
 function looksLikePath(token: string): boolean {
 	return path.isAbsolute(token) || token.startsWith("~") || /(^|[/\\])\.\.([/\\]|$)/.test(token);
 }
@@ -224,7 +239,8 @@ const OPTION_VALUE_FORMS: readonly RegExp[] = [
  */
 function codePathOccurrences(command: string): PathOccurrence[] {
 	const found: PathOccurrence[] = [];
-	const add = (token: string, at: number, access?: SandboxAccess): void => {
+	const add = (raw: string, at: number, access?: SandboxAccess): void => {
+		const token = normalizeHomeExpansion(raw);
 		if (token.length > 0 && looksLikePath(token)) found.push({ token, at, access });
 	};
 	// Set when the previous token was nothing but a redirection operator, so this one is its operand.
@@ -306,11 +322,26 @@ function codePathCandidates(command: string): PathCandidate[] {
  * `-exec` run — is not blanked, so it is still scanned. When the command cannot be lexed
  * confidently, the floor stands alone.
  */
-function shellPathCandidates(command: string): PathCandidate[] {
+/**
+ * A redirect target the shell will certainly open, whose path cannot be resolved here —
+ * `printf x >"$TARGET"`. Unlike an operand, there is no reading under which this is data
+ * rather than a file, so it cannot be waved through (#2534).
+ */
+interface UnresolvableTarget {
+	text: string;
+	access: SandboxAccess;
+}
+
+interface ShellScan {
+	candidates: PathCandidate[];
+	unresolvable: UnresolvableTarget[];
+}
+
+function shellPathCandidates(command: string): ShellScan {
 	const lexed = lexShellCommand(command);
 	// Unbalanced quotes mean every word boundary is a guess: neither the blanking nor the write
 	// marking below can be trusted, so fall back to the floor, checked as reads.
-	if (lexed.unterminated) return codePathCandidates(command);
+	if (lexed.unterminated) return { candidates: codePathCandidates(command), unresolvable: [] };
 
 	const exemptSpans = lexed.commands.flatMap(simpleCommand => provenExemptWords(simpleCommand));
 	let scanned = command;
@@ -335,13 +366,19 @@ function shellPathCandidates(command: string): PathCandidate[] {
 	// Not gated on `looksLikePath`: that test is for the floor's *guesses* about which fragments of a
 	// command might be filenames. A redirect target is one the shell will certainly open, so a bare
 	// `out.txt` is checked too — it resolves under the cwd, which a read-only cwd does not license.
+	const unresolvable: UnresolvableTarget[] = [];
 	for (const word of lexed.words) {
 		if (word.redirect === undefined || word.redirect === "here-string") continue;
 		for (const access of word.redirect === "read-write" ? WRITE_AND_READ : [word.redirect]) {
-			candidates.push({ token: word.text, access });
+			// `literal` is false when the word carries `$VAR`, a substitution, a glob or a brace
+			// expansion, so `text` is not a stand-in for one filesystem reference. Resolving it
+			// anyway is what let `>"$TARGET"` through: it became the literal string `$TARGET`
+			// under the cwd, which the boundary happily allowed.
+			if (word.literal) candidates.push({ token: word.text, access });
+			else unresolvable.push({ text: word.text, access });
 		}
 	}
-	return candidates;
+	return { candidates, unresolvable };
 }
 
 /** Base directories a search input would actually search, split like the tools do. */
@@ -383,8 +420,25 @@ function evaluateCodeTool(check: ToolCallCheck, fields: string[], shell: boolean
 		// Only bash gets the shell-aware treatment. Python is not shell: lexing `open('/x')` as
 		// shell yields one non-absolute word and would lose the check entirely, and it has no
 		// redirects, so every candidate it produces is a read.
+		const scan: ShellScan = shell
+			? shellPathCandidates(command)
+			: { candidates: codePathCandidates(command), unresolvable: [] };
+		// Refused before any candidate is resolved: there is no path to check, and that is
+		// precisely the problem. The residual this does NOT cover is an expansion in an
+		// operand rather than a redirect target — `cat "$SECRET"` — which cannot be resolved
+		// at this layer at all. That is the Phase 2 OS-sandbox's job; do not read the text
+		// boundary as complete (#2534).
+		for (const target of scan.unresolvable) {
+			return {
+				block: true,
+				reason:
+					`sandbox: refusing to ${target.access} a redirect target this layer cannot resolve: ` +
+					`${target.text}. The shell will open it, but its path comes from an expansion, so the ` +
+					"boundary cannot be checked. Write to an explicit path, or use --allow-path.",
+			};
+		}
 		const seen = new Set<string>();
-		for (const { token, access } of shell ? shellPathCandidates(command) : codePathCandidates(command)) {
+		for (const { token, access } of scan.candidates) {
 			if (!seen.add(`${access}\0${token}`)) continue;
 			const resolved = resolveToCwd(token, base);
 			if (policy.isAllowed(resolved, access)) continue;