@f5-sales-demo/xcsh 20.3.2 → 20.4.0

package/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 # Changelog
 
+## [20.4.0] - 2026-08-04
+
+### Breaking Changes
+
+- Renamed the executable updater from `xcsh update` to `xcsh self-update`; `xcsh update -f` now performs strict manifest-based resource updates ([#2930](https://github.com/f5-sales-demo/xcsh/issues/2930))
+
+### Added
+
+- Added deterministic, headless `apply`, `create`, `update`, `get`, `delete`, `diff`, `export`, and `validate` commands with file/stdin/directory manifests, reusable exports, stable aggregate JSON reports, and direct environment-based F5 XC authentication without an LLM turn ([#2930](https://github.com/f5-sales-demo/xcsh/issues/2930))
+
+### Fixed
+
+- Prevalidated manifest batches before mutation, preserved strict create and update semantics, rejected unsupported server dry-run, and returned automation-grade exit codes for resource operations ([#2930](https://github.com/f5-sales-demo/xcsh/issues/2930))
+- Prevented sandbox false refusals from path-like Bash and Python source text while limiting account and data containers to discovery protection and preserving xcsh-private runtime isolation ([#2931](https://github.com/f5-sales-demo/xcsh/issues/2931))
+
 ## [20.3.0] - 2026-08-04
 
 ### Added

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@f5-sales-demo/xcsh",
-	"version": "20.3.2",
+	"version": "20.4.0",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://github.com/f5-sales-demo/xcsh",
 	"author": "Can Boluk",
@@ -60,13 +60,13 @@
 	"dependencies": {
 		"@agentclientprotocol/sdk": "1.3.0",
 		"@mozilla/readability": "^0.6",
-		"@f5-sales-demo/xcsh-stats": "20.3.2",
-		"@f5-sales-demo/pi-agent-core": "20.3.2",
-		"@f5-sales-demo/pi-ai": "20.3.2",
-		"@f5-sales-demo/pi-natives": "20.3.2",
-		"@f5-sales-demo/pi-resource-management": "20.3.2",
-		"@f5-sales-demo/pi-tui": "20.3.2",
-		"@f5-sales-demo/pi-utils": "20.3.2",
+		"@f5-sales-demo/xcsh-stats": "20.4.0",
+		"@f5-sales-demo/pi-agent-core": "20.4.0",
+		"@f5-sales-demo/pi-ai": "20.4.0",
+		"@f5-sales-demo/pi-natives": "20.4.0",
+		"@f5-sales-demo/pi-resource-management": "20.4.0",
+		"@f5-sales-demo/pi-tui": "20.4.0",
+		"@f5-sales-demo/pi-utils": "20.4.0",
 		"@sinclair/typebox": "^0.34",
 		"@xterm/headless": "^6.0",
 		"ajv": "^8.20",

package/src/cli/resource-cli.ts

@@ -0,0 +1,134 @@
+import * as fs from "node:fs/promises";
+import {
+	formatManifestOutput,
+	formatResourceOperationReport,
+	ResourceClient,
+	type ResourceOperation,
+	type ResourceOperationReport,
+	readManifestInputs,
+	runResourceOperation,
+} from "@f5-sales-demo/pi-resource-management";
+import { kindResolver } from "../resource-management/index";
+
+export interface ResourceCliArgs {
+	operation: ResourceOperation;
+	filenames?: string[];
+	kind?: string;
+	name?: string;
+	all?: boolean;
+	namespace?: string;
+	outputFormat?: "json" | "yaml" | "table" | "wide";
+	recursive?: boolean;
+	dryRun?: "client";
+	resultFile?: string;
+	outputFile?: string;
+}
+
+export interface ResourceEnvironment {
+	apiUrl?: string;
+	apiToken?: string;
+	defaultNamespace?: string;
+}
+
+export function resolveResourceEnvironment(
+	env: Readonly<Record<string, string | undefined>> = process.env,
+): ResourceEnvironment {
+	return {
+		apiUrl: env.XCSH_API_URL,
+		apiToken: env.XCSH_API_TOKEN,
+		defaultNamespace: env.XCSH_NAMESPACE,
+	};
+}
+
+export function exitCodeForResourceReport(report: ResourceOperationReport): 0 | 1 | 2 {
+	if (report.success) return 0;
+	const failures = report.results.filter(result => result.status === "error" || result.status === "skipped");
+	return failures.length > 0 && failures.every(result => result.error?.kind === "validation") ? 2 : 1;
+}
+
+export function formatResourceCliOutput(
+	report: ResourceOperationReport,
+	format: "json" | "yaml" | "table" | "wide",
+): string {
+	if (report.operation === "export" && (format === "json" || format === "yaml")) {
+		const manifests = report.results.flatMap(result => (result.manifest ? [result.manifest] : []));
+		return formatManifestOutput(manifests, format);
+	}
+	return formatResourceOperationReport(report, format);
+}
+
+export async function runResourceCli(args: ResourceCliArgs): Promise<void> {
+	const env = resolveResourceEnvironment();
+	let report: ResourceOperationReport;
+
+	try {
+		const manifestOperation = ["apply", "create", "update", "get", "delete", "diff", "validate"].includes(
+			args.operation,
+		);
+		let inputs =
+			manifestOperation && (args.filenames?.length ?? 0) > 0
+				? await readManifestInputs(args.filenames ?? [], args.recursive ?? false)
+				: undefined;
+
+		if (args.operation === "delete" && !inputs && args.kind && args.name) {
+			const namespace = args.namespace ?? env.defaultNamespace;
+			const rawObject = { kind: args.kind, metadata: { name: args.name, namespace }, spec: {} };
+			inputs = [
+				{
+					index: 0,
+					sourcePath: "command-line",
+					manifest: {
+						kind: args.kind,
+						metadata: { name: args.name, namespace },
+						spec: {},
+						rawObject,
+					},
+				},
+			];
+		}
+
+		const requiresApi = args.operation !== "validate";
+		const client =
+			requiresApi && env.apiUrl && env.apiToken
+				? new ResourceClient({
+						apiUrl: env.apiUrl,
+						apiToken: env.apiToken,
+						namespace: env.defaultNamespace ?? "",
+					})
+				: undefined;
+
+		report = await runResourceOperation({
+			operation: args.operation,
+			kindResolver,
+			client,
+			inputs,
+			kind: args.kind,
+			name: args.name,
+			all: args.all,
+			namespaceOverride: args.namespace,
+			defaultNamespace: env.defaultNamespace,
+			dryRun: args.dryRun,
+		});
+	} catch (error) {
+		report = {
+			schemaVersion: 1,
+			operation: args.operation,
+			success: false,
+			counts: { total: 1, succeeded: 0, failed: 1, error: 1 },
+			results: [
+				{
+					index: 0,
+					status: "error",
+					error: { kind: "validation", message: error instanceof Error ? error.message : String(error) },
+				},
+			],
+		};
+	}
+
+	const json = `${JSON.stringify(report, null, 2)}\n`;
+	if (args.resultFile) await fs.writeFile(args.resultFile, json, "utf8");
+	const output = `${formatResourceCliOutput(report, args.outputFormat ?? "table")}\n`;
+	if (args.outputFile) await fs.writeFile(args.outputFile, output, "utf8");
+	else process.stdout.write(output);
+	process.exitCode = exitCodeForResourceReport(report);
+}

package/src/cli/sandbox-check.ts

@@ -12,6 +12,7 @@ import {
 	SANDBOX_CHECK_NAMED_SIBLING_ENV,
 	SANDBOX_OPERATOR_HOME_ENV,
 	SANDBOX_SESSION_ROOT_ENV,
+	sandboxCheckSiblingRoot,
 } from "../sandbox/session-fence";
 import type { ToolSession } from "../tools";
 import { BashTool } from "../tools/bash";
@@ -220,7 +221,15 @@ export async function runSandboxCheck(options: SandboxCheckOptions = {}): Promis
 		redactions.push([liveWorkspace, "<workspace>"], [liveHome, "<operator-home>"]);
 		if (inheritedSibling !== undefined) redactions.push([inheritedSibling, "<session-parent>/<synthetic-sibling>"]);
 
-		const fixtureBase = inheritedProfile ? liveWorkspace : await fs.realpath(os.tmpdir());
+		// A home-rooted Landlock profile must split the home grant around protected session stores. The
+		// kernel can grant an existing named child but cannot grant future children of that split root
+		// without also reopening the protected stores. BashTool therefore prepares one host-owned child
+		// before confinement; keep all exact-home live fixtures beneath that already-granted directory.
+		const liveWritableRoot =
+			inheritedProfile && liveWorkspace === liveHome && inheritedSibling !== undefined
+				? inheritedSibling
+				: liveWorkspace;
+		const fixtureBase = inheritedProfile ? liveWritableRoot : await fs.realpath(os.tmpdir());
 		fixtureRoot = await fs.mkdtemp(path.join(fixtureBase, ".xcsh-sandbox-check-policy-"));
 		fixturePaths.push(fixtureRoot);
 		redactions.push([fixtureRoot, "<synthetic-root>"]);
@@ -257,14 +266,7 @@ export async function runSandboxCheck(options: SandboxCheckOptions = {}): Promis
 		await check("structured tools share the boundary", () => {
 			const blocked = [
 				evaluateToolCall({ toolName: "read", input: { file_path: workspaces }, cwd: workspace, fence }),
-				evaluateToolCall({
-					toolName: "write",
-					input: { file_path: path.join(otherHome, "new.txt") },
-					cwd: workspace,
-					fence,
-				}),
 				evaluateToolCall({ toolName: "find", input: { pattern: `${accountRoot}/**/*` }, cwd: workspace, fence }),
-				evaluateToolCall({ toolName: "grep", input: { path: otherHome }, cwd: workspace, fence }),
 				evaluateToolCall({
 					toolName: "read",
 					input: { file_path: path.join(otherSession, "state.jsonl") },
@@ -277,20 +279,29 @@ export async function runSandboxCheck(options: SandboxCheckOptions = {}): Promis
 					cwd: workspace,
 					fence,
 				}),
+			];
+			const allowed = [
+				evaluateToolCall({
+					toolName: "write",
+					input: { file_path: path.join(otherHome, "new.txt") },
+					cwd: workspace,
+					fence,
+				}),
+				evaluateToolCall({ toolName: "grep", input: { path: otherHome }, cwd: workspace, fence }),
 				evaluateToolCall({
 					toolName: "python",
 					input: { code: `import os; os.listdir(${JSON.stringify(accountRoot)})` },
 					cwd: workspace,
 					fence,
 				}),
+				evaluateToolCall({
+					toolName: "write",
+					input: { file_path: path.join(configDir, "config") },
+					cwd: workspace,
+					fence,
+				}),
 			];
-			const ownConfig = evaluateToolCall({
-				toolName: "write",
-				input: { file_path: path.join(configDir, "config") },
-				cwd: workspace,
-				fence,
-			});
-			const passed = blocked.every(result => result.block) && !ownConfig.block;
+			const passed = blocked.every(result => result.block) && allowed.every(result => !result.block);
 			return passed
 				? { passed: true }
 				: {
@@ -299,11 +310,61 @@ export async function runSandboxCheck(options: SandboxCheckOptions = {}): Promis
 					};
 		});
 
+		// Use a recursive synthetic deny here. The production account root is discovery-only, so testing
+		// against that fence alone would pass even if arbitrary source scanning were accidentally restored.
+		const sourceTextFence: ContainmentFence = {
+			...fence,
+			deny: [...fence.deny, accountRoot],
+		};
+		const pathLikePattern = `${accountRoot}${path.sep}|alpha`;
+		await check("Bash grep pattern remains data (#2931)", () => {
+			const bashResult = evaluateToolCall({
+				toolName: "bash",
+				input: { command: `grep -nE ${JSON.stringify(pathLikePattern)} own.txt` },
+				cwd: workspace,
+				fence: sourceTextFence,
+			});
+			const grepResult = evaluateToolCall({
+				toolName: "grep",
+				input: { pattern: pathLikePattern, path: workspace },
+				cwd: workspace,
+				fence: sourceTextFence,
+			});
+			return !bashResult.block && !grepResult.block
+				? { passed: true }
+				: {
+						passed: false,
+						detail:
+							"Bash and structured grep disagreed on path-like pattern data; path=<synthetic-root>; errno=none",
+					};
+		});
+		await check("Bash Python heredoc remains data (#2931)", () => {
+			const command = [
+				"python3 - <<'PY'",
+				`patterns = {"home path": ${JSON.stringify(`${accountRoot}${path.sep}`)}}`,
+				'print("  scanned for:", list(patterns.values()))',
+				"PY",
+			].join("\n");
+			const result = evaluateToolCall({
+				toolName: "bash",
+				input: { command },
+				cwd: workspace,
+				fence: sourceTextFence,
+			});
+			return !result.block
+				? { passed: true }
+				: {
+						passed: false,
+						detail:
+							"Bash pre-check interpreted Python heredoc source as a path; path=<synthetic-root>; errno=none",
+					};
+		});
+
 		await check("workspace read, write, glob, and recursion", async () => {
 			const displayPath = "<workspace>/<synthetic-fixture>";
 			let liveFixture: string;
 			try {
-				liveFixture = await fs.mkdtemp(path.join(liveWorkspace, ".xcsh-sandbox-check-workspace-"));
+				liveFixture = await fs.mkdtemp(path.join(liveWritableRoot, ".xcsh-sandbox-check-workspace-"));
 				fixturePaths.push(liveFixture);
 				redactions.push([liveFixture, displayPath]);
 				await fs.mkdir(path.join(liveFixture, "nested"));
@@ -329,7 +390,9 @@ export async function runSandboxCheck(options: SandboxCheckOptions = {}): Promis
 			let liveSibling = inheritedSibling;
 			if (liveSibling === undefined) {
 				try {
-					liveSibling = await fs.mkdtemp(path.join(path.dirname(liveWorkspace), ".xcsh-sandbox-check-sibling-"));
+					liveSibling = await fs.mkdtemp(
+						path.join(sandboxCheckSiblingRoot(liveWorkspace, liveHome), ".xcsh-sandbox-check-sibling-"),
+					);
 					fixturePaths.push(liveSibling);
 					nonEnumerableCleanupDirs.add(liveSibling);
 					redactions.push([liveSibling, displayPath]);
@@ -420,12 +483,12 @@ export async function runSandboxCheck(options: SandboxCheckOptions = {}): Promis
 					redactions,
 				);
 			});
-			await check("synthetic other account cannot be entered", async () => {
+			await check("named other account remains reachable", async () => {
 				const result = await shellProbe(`cd ${quote(otherHome)}`, workspace, fence, abortController.signal);
 				return shellOutcome(
 					result,
-					false,
-					"synthetic other account traversal must be refused",
+					true,
+					"named synthetic account traversal must remain available",
 					"<synthetic-other-account>",
 					redactions,
 				);
@@ -465,7 +528,7 @@ export async function runSandboxCheck(options: SandboxCheckOptions = {}): Promis
 				"session parent cannot be enumerated",
 				"explicit grant restores parent enumeration",
 				"account container cannot be enumerated",
-				"synthetic other account cannot be entered",
+				"named other account remains reachable",
 				"cross-session stores cannot be read",
 			]) {
 				add(name, "SKIP", "OS enforcement backend unavailable; path=<probe>; errno=unsupported");

package/src/cli/update-cli.ts

@@ -1,7 +1,7 @@
 /**
  * Update CLI command handler.
  *
- * Handles `xcsh update` to check for and install updates.
+ * Handles `xcsh self-update` to check for and install executable updates.
  * Auto-detects the installation method (npm, brew, bun, or standalone binary)
  * and updates through the appropriate channel.
  */

package/src/cli.ts

@@ -50,9 +50,15 @@ if (Bun.stringWidth("\x1b[0m\x1b]8;;\x07") !== 0) {
 process.title = APP_NAME;
 
 const commands: CommandEntry[] = [
+	{ name: "apply", load: () => import("./commands/apply").then(m => m.default) },
 	{ name: "launch", load: () => import("./commands/launch").then(m => m.default) },
 	{ name: "agents", load: () => import("./commands/agents").then(m => m.default) },
 	{ name: "commit", load: () => import("./commands/commit").then(m => m.default) },
+	{ name: "create", load: () => import("./commands/create").then(m => m.default) },
+	{ name: "delete", load: () => import("./commands/delete").then(m => m.default) },
+	{ name: "diff", load: () => import("./commands/diff").then(m => m.default) },
+	{ name: "export", load: () => import("./commands/export").then(m => m.default) },
+	{ name: "get", load: () => import("./commands/get").then(m => m.default) },
 	{ name: "config", load: () => import("./commands/config").then(m => m.default) },
 	{ name: "chrome", load: () => import("./commands/chrome").then(m => m.default) },
 	{ name: "chrome-host", load: () => import("./commands/native-host").then(m => m.default) },
@@ -76,6 +82,8 @@ const commands: CommandEntry[] = [
 	{ name: "update", load: () => import("./commands/update").then(m => m.default) },
 	{ name: "worker", load: () => import("./commands/worker").then(m => m.default) },
 	{ name: "search", load: () => import("./commands/web-search").then(m => m.default), aliases: ["q"] },
+	{ name: "self-update", load: () => import("./commands/self-update").then(m => m.default) },
+	{ name: "validate", load: () => import("./commands/validate").then(m => m.default) },
 ];
 
 async function showHelp(config: import("@f5-sales-demo/pi-utils/cli").CliConfig): Promise<void> {

package/src/commands/apply.ts

@@ -0,0 +1,21 @@
+import { Command } from "@f5-sales-demo/pi-utils/cli";
+import { runResourceCli } from "../cli/resource-cli";
+import { manifestResourceFlags } from "./resource-flags";
+
+export default class Apply extends Command {
+	static description = "Apply manifests by creating, updating, or preserving resources";
+	static flags = manifestResourceFlags;
+
+	async run(): Promise<void> {
+		const { flags } = await this.parse(Apply);
+		await runResourceCli({
+			operation: "apply",
+			filenames: flags.filename,
+			namespace: flags.namespace,
+			outputFormat: flags.output as "json" | "yaml" | "table" | "wide",
+			recursive: flags.recursive,
+			dryRun: flags["dry-run"] as "client" | undefined,
+			resultFile: flags["result-file"],
+		});
+	}
+}

package/src/commands/create.ts

@@ -0,0 +1,21 @@
+import { Command } from "@f5-sales-demo/pi-utils/cli";
+import { runResourceCli } from "../cli/resource-cli";
+import { manifestResourceFlags } from "./resource-flags";
+
+export default class Create extends Command {
+	static description = "Create resources from manifests and fail if they already exist";
+	static flags = manifestResourceFlags;
+
+	async run(): Promise<void> {
+		const { flags } = await this.parse(Create);
+		await runResourceCli({
+			operation: "create",
+			filenames: flags.filename,
+			namespace: flags.namespace,
+			outputFormat: flags.output as "json" | "yaml" | "table" | "wide",
+			recursive: flags.recursive,
+			dryRun: flags["dry-run"] as "client" | undefined,
+			resultFile: flags["result-file"],
+		});
+	}
+}

package/src/commands/delete.ts

@@ -0,0 +1,32 @@
+import { Args, Command, Flags } from "@f5-sales-demo/pi-utils/cli";
+import { runResourceCli } from "../cli/resource-cli";
+import { targetResourceFlags } from "./resource-flags";
+
+export default class Delete extends Command {
+	static description = "Delete resources identified by manifests or kind and name";
+	static args = {
+		kind: Args.string({ description: "Resource kind" }),
+		name: Args.string({ description: "Resource name" }),
+	};
+	static flags = {
+		...targetResourceFlags,
+		filename: Flags.string({ char: "f", description: "Manifest file, directory, or - for stdin", multiple: true }),
+		recursive: Flags.boolean({ char: "R", description: "Read manifest directories recursively", default: false }),
+		"dry-run": Flags.string({ description: "Validate deletion without mutation", options: ["client"] }),
+	};
+
+	async run(): Promise<void> {
+		const { args, flags } = await this.parse(Delete);
+		await runResourceCli({
+			operation: "delete",
+			filenames: flags.filename,
+			kind: args.kind,
+			name: args.name,
+			namespace: flags.namespace,
+			outputFormat: flags.output as "json" | "yaml" | "table" | "wide",
+			recursive: flags.recursive,
+			dryRun: flags["dry-run"] as "client" | undefined,
+			resultFile: flags["result-file"],
+		});
+	}
+}

package/src/commands/diff.ts

@@ -0,0 +1,20 @@
+import { Command } from "@f5-sales-demo/pi-utils/cli";
+import { runResourceCli } from "../cli/resource-cli";
+import { manifestInputFlags } from "./resource-flags";
+
+export default class Diff extends Command {
+	static description = "Compare manifests with live resources without mutation";
+	static flags = manifestInputFlags;
+
+	async run(): Promise<void> {
+		const { flags } = await this.parse(Diff);
+		await runResourceCli({
+			operation: "diff",
+			filenames: flags.filename,
+			namespace: flags.namespace,
+			outputFormat: flags.output as "json" | "yaml" | "table" | "wide",
+			recursive: flags.recursive,
+			resultFile: flags["result-file"],
+		});
+	}
+}

package/src/commands/export.ts

@@ -0,0 +1,36 @@
+import { Args, Command, Flags } from "@f5-sales-demo/pi-utils/cli";
+import { runResourceCli } from "../cli/resource-cli";
+import { targetResourceFlags } from "./resource-flags";
+
+export default class Export extends Command {
+	static description = "Export live resources as manifests";
+	static args = {
+		kind: Args.string({ description: "Resource kind" }),
+		name: Args.string({ description: "Resource name" }),
+	};
+	static flags = {
+		...targetResourceFlags,
+		output: Flags.string({
+			char: "o",
+			description: "Manifest output format",
+			options: ["json", "yaml"],
+			default: "yaml",
+		}),
+		all: Flags.boolean({ description: "Export every supported resource kind", default: false }),
+		file: Flags.string({ char: "f", description: "Write formatted output to a file" }),
+	};
+
+	async run(): Promise<void> {
+		const { args, flags } = await this.parse(Export);
+		await runResourceCli({
+			operation: "export",
+			kind: args.kind,
+			name: args.name,
+			all: flags.all,
+			namespace: flags.namespace,
+			outputFormat: flags.output as "json" | "yaml" | "table" | "wide",
+			resultFile: flags["result-file"],
+			outputFile: flags.file,
+		});
+	}
+}

package/src/commands/get.ts

@@ -0,0 +1,30 @@
+import { Args, Command, Flags } from "@f5-sales-demo/pi-utils/cli";
+import { runResourceCli } from "../cli/resource-cli";
+import { targetResourceFlags } from "./resource-flags";
+
+export default class Get extends Command {
+	static description = "Get or list live resources";
+	static args = {
+		kind: Args.string({ description: "Resource kind" }),
+		name: Args.string({ description: "Resource name" }),
+	};
+	static flags = {
+		...targetResourceFlags,
+		filename: Flags.string({ char: "f", description: "Manifest file, directory, or - for stdin", multiple: true }),
+		recursive: Flags.boolean({ char: "R", description: "Read manifest directories recursively", default: false }),
+	};
+
+	async run(): Promise<void> {
+		const { args, flags } = await this.parse(Get);
+		await runResourceCli({
+			operation: "get",
+			filenames: flags.filename,
+			kind: args.kind,
+			name: args.name,
+			namespace: flags.namespace,
+			outputFormat: flags.output as "json" | "yaml" | "table" | "wide",
+			recursive: flags.recursive,
+			resultFile: flags["result-file"],
+		});
+	}
+}

package/src/commands/resource-flags.ts

@@ -0,0 +1,30 @@
+import { Flags } from "@f5-sales-demo/pi-utils/cli";
+
+export const manifestInputFlags = {
+	filename: Flags.string({ char: "f", description: "Manifest file, directory, or - for stdin", multiple: true }),
+	namespace: Flags.string({ char: "n", description: "Override the resource namespace" }),
+	output: Flags.string({
+		char: "o",
+		description: "Output format",
+		options: ["json", "yaml", "table", "wide"],
+		default: "table",
+	}),
+	recursive: Flags.boolean({ char: "R", description: "Read manifest directories recursively", default: false }),
+	"result-file": Flags.string({ description: "Write the aggregate JSON report to a file" }),
+};
+
+export const manifestResourceFlags = {
+	...manifestInputFlags,
+	"dry-run": Flags.string({ description: "Validate and calculate changes without mutation", options: ["client"] }),
+};
+
+export const targetResourceFlags = {
+	namespace: Flags.string({ char: "n", description: "Override the resource namespace" }),
+	output: Flags.string({
+		char: "o",
+		description: "Output format",
+		options: ["json", "yaml", "table", "wide"],
+		default: "table",
+	}),
+	"result-file": Flags.string({ description: "Write the aggregate JSON report to a file" }),
+};

package/src/commands/self-update.ts

@@ -0,0 +1,18 @@
+/** Check for and install xcsh executable updates. */
+import { Command, Flags } from "@f5-sales-demo/pi-utils/cli";
+import { runUpdateCommand } from "../cli/update-cli";
+import { initTheme } from "../modes/theme/theme";
+
+export default class SelfUpdate extends Command {
+	static description = "Check for and install xcsh executable updates";
+	static flags = {
+		force: Flags.boolean({ char: "f", description: "Force update", default: false }),
+		check: Flags.boolean({ char: "c", description: "Check for updates without installing", default: false }),
+	};
+
+	async run(): Promise<void> {
+		const { flags } = await this.parse(SelfUpdate);
+		await initTheme();
+		await runUpdateCommand({ force: flags.force, check: flags.check });
+	}
+}

package/src/commands/update.ts

@@ -1,21 +1,21 @@
-/**
- * Check for and install updates.
- */
-import { Command, Flags } from "@f5-sales-demo/pi-utils/cli";
-import { runUpdateCommand } from "../cli/update-cli";
-import { initTheme } from "../modes/theme/theme";
+import { Command } from "@f5-sales-demo/pi-utils/cli";
+import { runResourceCli } from "../cli/resource-cli";
+import { manifestResourceFlags } from "./resource-flags";
 
 export default class Update extends Command {
-	static description = "Check for and install updates";
-
-	static flags = {
-		force: Flags.boolean({ char: "f", description: "Force update", default: false }),
-		check: Flags.boolean({ char: "c", description: "Check for updates without installing", default: false }),
-	};
+	static description = "Update existing resources from manifests";
+	static flags = manifestResourceFlags;
 
 	async run(): Promise<void> {
 		const { flags } = await this.parse(Update);
-		await initTheme();
-		await runUpdateCommand({ force: flags.force, check: flags.check });
+		await runResourceCli({
+			operation: "update",
+			filenames: flags.filename,
+			namespace: flags.namespace,
+			outputFormat: flags.output as "json" | "yaml" | "table" | "wide",
+			recursive: flags.recursive,
+			dryRun: flags["dry-run"] as "client" | undefined,
+			resultFile: flags["result-file"],
+		});
 	}
 }