@f5-sales-demo/xcsh 20.0.3 → 20.0.4

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## [Unreleased]
 
+## [20.0.4] - 2026-08-01
+
+### Fixed
+
+- Reset model bash tool calls to the session working directory so a command-local `cd` cannot silently relocate later calls ([#2724](https://github.com/f5-sales-demo/xcsh/issues/2724))
+
 ## [20.0.3] - 2026-08-01
 
 ### Fixed

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@f5-sales-demo/xcsh",
-	"version": "20.0.3",
+	"version": "20.0.4",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://github.com/f5-sales-demo/xcsh",
 	"author": "Can Boluk",
@@ -57,13 +57,13 @@
 	"dependencies": {
 		"@agentclientprotocol/sdk": "1.3.0",
 		"@mozilla/readability": "^0.6",
-		"@f5-sales-demo/xcsh-stats": "20.0.3",
-		"@f5-sales-demo/pi-agent-core": "20.0.3",
-		"@f5-sales-demo/pi-ai": "20.0.3",
-		"@f5-sales-demo/pi-natives": "20.0.3",
-		"@f5-sales-demo/pi-resource-management": "20.0.3",
-		"@f5-sales-demo/pi-tui": "20.0.3",
-		"@f5-sales-demo/pi-utils": "20.0.3",
+		"@f5-sales-demo/xcsh-stats": "20.0.4",
+		"@f5-sales-demo/pi-agent-core": "20.0.4",
+		"@f5-sales-demo/pi-ai": "20.0.4",
+		"@f5-sales-demo/pi-natives": "20.0.4",
+		"@f5-sales-demo/pi-resource-management": "20.0.4",
+		"@f5-sales-demo/pi-tui": "20.0.4",
+		"@f5-sales-demo/pi-utils": "20.0.4",
 		"@sinclair/typebox": "^0.34",
 		"@xterm/headless": "^6.0",
 		"ajv": "^8.20",

package/src/exec/bash-executor.ts

@@ -64,7 +64,7 @@ export interface BashResult {
 	outputLines: number;
 	outputBytes: number;
 	artifactId?: string;
-	/** Actual working directory after the command ran (persistent shell only). */
+	/** Actual working directory after the command ran; direct operator-shell callers may persist it. */
 	newCwd?: string;
 }
 

package/src/internal-urls/build-info.generated.ts

@@ -17,17 +17,17 @@ export interface BuildInfo {
 }
 
 export const BUILD_INFO: BuildInfo = {
-	"version": "20.0.3",
-	"commit": "eb145863a59404dfa28bf93241e5dde4f206bbfc",
-	"shortCommit": "eb14586",
+	"version": "20.0.4",
+	"commit": "c1606427884c61f77f5f1fbf1c4ab7511920061b",
+	"shortCommit": "c160642",
 	"branch": "main",
-	"tag": "v20.0.3",
-	"commitDate": "2026-08-01T05:30:12Z",
-	"buildDate": "2026-08-01T05:59:20.955Z",
+	"tag": "v20.0.4",
+	"commitDate": "2026-08-01T06:54:53Z",
+	"buildDate": "2026-08-01T07:20:58.905Z",
 	"dirty": true,
 	"prNumber": "",
 	"repoUrl": "https://github.com/f5-sales-demo/xcsh",
 	"repoSlug": "f5-sales-demo/xcsh",
-	"commitUrl": "https://github.com/f5-sales-demo/xcsh/commit/eb145863a59404dfa28bf93241e5dde4f206bbfc",
-	"releaseUrl": "https://github.com/f5-sales-demo/xcsh/releases/tag/v20.0.3"
+	"commitUrl": "https://github.com/f5-sales-demo/xcsh/commit/c1606427884c61f77f5f1fbf1c4ab7511920061b",
+	"releaseUrl": "https://github.com/f5-sales-demo/xcsh/releases/tag/v20.0.4"
 };

package/src/internal-urls/fleet-resolve.ts

@@ -149,13 +149,10 @@ export interface CwdEventSource {
 }
 
 /**
- * A getter for the working directory the *session* is in, not the one the process
- * started in.
+ * A getter for the working directory the *session* is rooted in, not the one the process started in.
  *
- * The bash tool keeps its own cwd and updates it on `cd`, emitting `cwd:changed`
- * (`tools/bash.ts`); `process.chdir` is never called for it. Classifying against
- * `process.cwd()` would therefore keep reporting the startup repository, so a
- * `content` grant could survive after moving into a `developer` repository.
+ * Model bash calls reset to this root, so a command-local `cd` must not emit this event. The event is
+ * reserved for an explicit session relocation; `process.chdir` is never used for either case.
  */
 export function createLiveCwdGetter(initialCwd: string, events?: CwdEventSource): () => string {
 	let current = initialCwd;

package/src/modes/components/status-line.ts

@@ -212,7 +212,7 @@ export class StatusLineComponent implements Component {
 		this.#invalidateGitCaches();
 	}
 
-	/** Update the displayed working directory (e.g. after a user !cd command). */
+	/** Update the displayed working directory after an operator command or explicit session move. */
 	setCwd(cwd: string): void {
 		this.#cwd = cwd;
 		this.#invalidateGitCaches();

package/src/prompts/tools/bash.md

@@ -2,6 +2,8 @@ Executes bash command in shell session for terminal operations like git, bun, ca
 
 <instruction>
 - You **MUST** use `cwd` parameter to set working directory instead of `cd dir && …`
+- Every call starts in the session working directory, or in `cwd` when provided. A `cd` affects only
+  that call and does not relocate later tool calls.
 - Always provide a `description` parameter: a short, human-readable summary of what the command does (e.g. "Install dependencies", "Run test suite"). This is displayed in compact mode and during execution.
 - Prefer `env: { NAME: "…" }` for multiline, quote-heavy, or untrusted values instead of inlining them into shell syntax; reference them from the command as `$NAME`
 - Quote variable expansions like `"$NAME"` to preserve exact content and avoid shell parsing bugs

package/src/sdk.ts

@@ -1170,8 +1170,8 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 						},
 					}),
 				getPluginRoots: () => listXcshPluginRoots(os.homedir(), cwd).then(r => r.roots),
-				// Classification must follow the session's `cd`, not the process cwd, which
-				// never moves. The bash tool emits `cwd:changed` when it relocates.
+				// Classification follows explicit session relocation events, not command-local `cd` and not the
+				// process cwd. Model bash calls reset to this session root on every invocation (#2724).
 				fleetDeps: { cwd: createLiveCwdGetter(cwd, eventBus) },
 			}),
 		);

package/src/tools/bash.ts

@@ -7,7 +7,7 @@ import type {
 } from "@f5-sales-demo/pi-agent-core";
 import type { Component } from "@f5-sales-demo/pi-tui";
 import { ImageProtocol, TERMINAL, Text } from "@f5-sales-demo/pi-tui";
-import { $env, getProjectDir, isEnoent, prompt, setShellPwd } from "@f5-sales-demo/pi-utils";
+import { $env, getProjectDir, isEnoent, prompt } from "@f5-sales-demo/pi-utils";
 import { Type } from "@sinclair/typebox";
 import { Settings } from "../config/settings";
 import { type BashResult, executeBash } from "../exec/bash-executor";
@@ -516,17 +516,13 @@ export class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
 	/**
 	 * Where this session's boundary is anchored.
 	 *
-	 * **Not the live cwd.** The fence used to be rebuilt from `session.cwd`, which line ~717 replaces
-	 * with whatever PWD the command ended in — so the model could move the boundary with a `cd`. Measured
-	 * on a workspace outside the home tree, which is the layout the sibling-checkout deny exists for:
-	 * with `/work/custA` as the workspace, `/work/custB/secret.env` was denied; `cd /usr` is permitted
-	 * (correctly — `/usr` is not sensitive), and the *next* fence was rooted at `/usr`, where the parent
-	 * deny of `/work` cannot be expressed because `dirname("/usr")` is `/` and denying the root is refused
-	 * as too broad. `/work/custB` then became readable **and** writable. Two tool calls, no exotic
-	 * spelling, and the tenant boundary was gone.
+	 * **Not a command's final PWD.** Every model tool call starts from `session.cwd` and a command-local
+	 * `cd` is discarded when that call ends (#2724). Before that reset existed, writing the final PWD
+	 * back into `session.cwd` also moved this fence: after `cd /usr`, the next boundary was rooted at
+	 * `/usr` and could no longer protect a workspace under `/work` (#2589).
 	 *
-	 * So the anchor is captured once per session and never follows the shell. It is keyed on the session
-	 * object rather than held on this instance because the tool is built by a factory
+	 * The anchor remains captured once per session as a defensive invariant and never follows the shell.
+	 * It is keyed on the session object rather than held on this instance because the tool is built by a factory
 	 * (`bash: s => new BashTool(s)`) and must not depend on how long an instance happens to live.
 	 *
 	 * An *operator* moving the project — startup, or the slash command that calls `setProjectDir` — does
@@ -546,8 +542,8 @@ export class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
 			return this.session.cwd;
 		}
 		if (anchor.project !== project) {
-			// The operator moved the project. Re-anchor there rather than at `session.cwd`, which a
-			// model `cd` may have moved in the meantime.
+			// The operator moved the project. This is an explicit boundary relocation, unlike a model's
+			// command-local `cd`.
 			FENCE_ANCHORS.set(this.session, { root: project, project });
 			return project;
 		}
@@ -787,13 +783,6 @@ export class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
 						}
 					},
 				});
-		// Update working directory if the persistent shell changed it
-		if ("newCwd" in result && result.newCwd && result.newCwd !== this.session.cwd) {
-			this.session.cwd = result.newCwd;
-			setShellPwd(result.newCwd);
-			this.session.eventBus?.emit("cwd:changed", result.newCwd);
-		}
-
 		if (result.cancelled) {
 			if (signal?.aborted) {
 				throw new ToolAbortError(normalizeResultOutput(result) || "Command aborted");