@f5-sales-demo/xcsh 20.3.2 → 20.4.0

package/src/commands/validate.ts

@@ -0,0 +1,20 @@
+import { Command } from "@f5-sales-demo/pi-utils/cli";
+import { runResourceCli } from "../cli/resource-cli";
+import { manifestInputFlags } from "./resource-flags";
+
+export default class Validate extends Command {
+	static description = "Validate manifests locally without API credentials";
+	static flags = manifestInputFlags;
+
+	async run(): Promise<void> {
+		const { flags } = await this.parse(Validate);
+		await runResourceCli({
+			operation: "validate",
+			filenames: flags.filename,
+			namespace: flags.namespace,
+			outputFormat: flags.output as "json" | "yaml" | "table" | "wide",
+			recursive: flags.recursive,
+			resultFile: flags["result-file"],
+		});
+	}
+}

package/src/internal-urls/build-info.generated.ts

@@ -17,17 +17,17 @@ export interface BuildInfo {
 }
 
 export const BUILD_INFO: BuildInfo = {
-	"version": "20.3.2",
-	"commit": "f886c6fe86e2f1d038a581e21f24aab6260b59b5",
-	"shortCommit": "f886c6f",
+	"version": "20.4.0",
+	"commit": "cc173f02925c0e4cb6085e8d15058baa34e2fafb",
+	"shortCommit": "cc173f0",
 	"branch": "main",
-	"tag": "v20.3.2",
-	"commitDate": "2026-08-04T15:39:32Z",
-	"buildDate": "2026-08-04T16:14:10.597Z",
+	"tag": "v20.4.0",
+	"commitDate": "2026-08-04T21:59:37Z",
+	"buildDate": "2026-08-04T22:31:30.038Z",
 	"dirty": true,
 	"prNumber": "",
 	"repoUrl": "https://github.com/f5-sales-demo/xcsh",
 	"repoSlug": "f5-sales-demo/xcsh",
-	"commitUrl": "https://github.com/f5-sales-demo/xcsh/commit/f886c6fe86e2f1d038a581e21f24aab6260b59b5",
-	"releaseUrl": "https://github.com/f5-sales-demo/xcsh/releases/tag/v20.3.2"
+	"commitUrl": "https://github.com/f5-sales-demo/xcsh/commit/cc173f02925c0e4cb6085e8d15058baa34e2fafb",
+	"releaseUrl": "https://github.com/f5-sales-demo/xcsh/releases/tag/v20.4.0"
 };

package/src/locales/ar.json

@@ -267,7 +267,7 @@
 	"welcome.modelProvider": "مزود النموذج",
 	"welcome.plugins": "الإضافات",
 	"welcome.pluginSetupHint": "شغّل: /plugin setup",
-	"welcome.updateHint": "شغّل: xcsh update",
+	"welcome.updateHint": "شغّل: xcsh self-update",
 	"welcome.newVersion": "إصدار جديد",
 	"welcome.connectionFailed": "— فشل الاتصال",
 	"welcome.runLoginReconnect": "شغّل /login لإعادة الاتصال",

package/src/locales/de.json

@@ -267,7 +267,7 @@
 	"welcome.modelProvider": "Modellanbieter",
 	"welcome.plugins": "Plugins",
 	"welcome.pluginSetupHint": "ausführen: /plugin setup",
-	"welcome.updateHint": "ausführen: xcsh update",
+	"welcome.updateHint": "ausführen: xcsh self-update",
 	"welcome.newVersion": "neue Version",
 	"welcome.connectionFailed": "— Verbindung fehlgeschlagen",
 	"welcome.runLoginReconnect": "Führen Sie /login aus, um die Verbindung wiederherzustellen",

package/src/locales/en.json

@@ -288,7 +288,7 @@
 	"welcome.modelProvider": "Model Provider",
 	"welcome.plugins": "Plugins",
 	"welcome.pluginSetupHint": "run: /plugin setup",
-	"welcome.updateHint": "run: xcsh update",
+	"welcome.updateHint": "run: xcsh self-update",
 	"welcome.newVersion": "new version",
 	"welcome.connectionFailed": "— connection failed",
 	"welcome.runLoginReconnect": "Run /login to reconnect",

package/src/locales/es.json

@@ -267,7 +267,7 @@
 	"welcome.modelProvider": "Proveedor de modelo",
 	"welcome.plugins": "Plugins",
 	"welcome.pluginSetupHint": "ejecutar: /plugin setup",
-	"welcome.updateHint": "ejecutar: xcsh update",
+	"welcome.updateHint": "ejecutar: xcsh self-update",
 	"welcome.newVersion": "nueva versión",
 	"welcome.connectionFailed": "— conexión fallida",
 	"welcome.runLoginReconnect": "Ejecute /login para reconectar",

package/src/locales/fr.json

@@ -267,7 +267,7 @@
 	"welcome.modelProvider": "Fournisseur de modèle",
 	"welcome.plugins": "Plugins",
 	"welcome.pluginSetupHint": "exécuter : /plugin setup",
-	"welcome.updateHint": "exécuter : xcsh update",
+	"welcome.updateHint": "exécuter : xcsh self-update",
 	"welcome.newVersion": "nouvelle version",
 	"welcome.connectionFailed": "— échec de connexion",
 	"welcome.runLoginReconnect": "Exécutez /login pour vous reconnecter",

package/src/locales/hi.json

@@ -267,7 +267,7 @@
 	"welcome.modelProvider": "मॉडल प्रदाता",
 	"welcome.plugins": "प्लगइन",
 	"welcome.pluginSetupHint": "चलाएँ: /plugin setup",
-	"welcome.updateHint": "चलाएँ: xcsh update",
+	"welcome.updateHint": "चलाएँ: xcsh self-update",
 	"welcome.newVersion": "नया संस्करण",
 	"welcome.connectionFailed": "— कनेक्शन विफल",
 	"welcome.runLoginReconnect": "पुनः कनेक्ट करने के लिए /login चलाएँ",

package/src/locales/it.json

@@ -267,7 +267,7 @@
 	"welcome.modelProvider": "Provider del Modello",
 	"welcome.plugins": "Plugin",
 	"welcome.pluginSetupHint": "esegui: /plugin setup",
-	"welcome.updateHint": "esegui: xcsh update",
+	"welcome.updateHint": "esegui: xcsh self-update",
 	"welcome.newVersion": "nuova versione",
 	"welcome.connectionFailed": "— connessione non riuscita",
 	"welcome.runLoginReconnect": "Esegui /login per riconnetterti",

package/src/locales/ja.json

@@ -267,7 +267,7 @@
 	"welcome.modelProvider": "モデルプロバイダー",
 	"welcome.plugins": "プラグイン",
 	"welcome.pluginSetupHint": "実行: /plugin setup",
-	"welcome.updateHint": "実行: xcsh update",
+	"welcome.updateHint": "実行: xcsh self-update",
 	"welcome.newVersion": "新しいバージョン",
 	"welcome.connectionFailed": "— 接続に失敗しました",
 	"welcome.runLoginReconnect": "/login を実行して再接続してください",

package/src/locales/ko.json

@@ -267,7 +267,7 @@
 	"welcome.modelProvider": "모델 프로바이더",
 	"welcome.plugins": "플러그인",
 	"welcome.pluginSetupHint": "실행: /plugin setup",
-	"welcome.updateHint": "실행: xcsh update",
+	"welcome.updateHint": "실행: xcsh self-update",
 	"welcome.newVersion": "새 버전",
 	"welcome.connectionFailed": "— 연결 실패",
 	"welcome.runLoginReconnect": "/login을 실행하여 재연결하세요",

package/src/locales/pt-br.json

@@ -267,7 +267,7 @@
 	"welcome.modelProvider": "Provedor de Modelo",
 	"welcome.plugins": "Plugins",
 	"welcome.pluginSetupHint": "execute: /plugin setup",
-	"welcome.updateHint": "execute: xcsh update",
+	"welcome.updateHint": "execute: xcsh self-update",
 	"welcome.newVersion": "nova versão",
 	"welcome.connectionFailed": "— falha na conexão",
 	"welcome.runLoginReconnect": "Execute /login para reconectar",

package/src/locales/th.json

@@ -267,7 +267,7 @@
 	"welcome.modelProvider": "ผู้ให้บริการโมเดล",
 	"welcome.plugins": "ปลั๊กอิน",
 	"welcome.pluginSetupHint": "รัน: /plugin setup",
-	"welcome.updateHint": "รัน: xcsh update",
+	"welcome.updateHint": "รัน: xcsh self-update",
 	"welcome.newVersion": "เวอร์ชันใหม่",
 	"welcome.connectionFailed": "— การเชื่อมต่อล้มเหลว",
 	"welcome.runLoginReconnect": "รัน /login เพื่อเชื่อมต่อใหม่",

package/src/locales/zh-cn.json

@@ -267,7 +267,7 @@
 	"welcome.modelProvider": "模型提供商",
 	"welcome.plugins": "插件",
 	"welcome.pluginSetupHint": "运行：/plugin setup",
-	"welcome.updateHint": "运行：xcsh update",
+	"welcome.updateHint": "运行：xcsh self-update",
 	"welcome.newVersion": "新版本",
 	"welcome.connectionFailed": "— 连接失败",
 	"welcome.runLoginReconnect": "运行 /login 重新连接",

package/src/locales/zh-tw.json

@@ -267,7 +267,7 @@
 	"welcome.modelProvider": "模型供應商",
 	"welcome.plugins": "外掛程式",
 	"welcome.pluginSetupHint": "執行：/plugin setup",
-	"welcome.updateHint": "執行：xcsh update",
+	"welcome.updateHint": "執行：xcsh self-update",
 	"welcome.newVersion": "新版本",
 	"welcome.connectionFailed": "— 連線失敗",
 	"welcome.runLoginReconnect": "執行 /login 重新連線",

package/src/main.ts

@@ -180,7 +180,7 @@ async function runInteractiveMode(
 	if (settings.get("startup.checkUpdate")) {
 		void versionCheckPromise
 			.then(latest => {
-				if (latest) mode.showStatus(`Update available: v${latest} — run: xcsh update`, { dim: true });
+				if (latest) mode.showStatus(`Update available: v${latest} — run: xcsh self-update`, { dim: true });
 			})
 			.catch(() => {});
 	}

package/src/prompts/internal-urls/containment.md

@@ -13,19 +13,20 @@ followed symlinks — so how a path is spelled does not change what is reachable
 - The operator's home and configuration belong to the operator. Shell profiles, SSH and GPG state,
   Git and cloud CLI configuration, xcsh settings, plugins, and skills are readable and writable with
   the operator's normal filesystem rights.
-- Cross-tenant isolation removes the discovery step. The directory containing the session root cannot
-  be enumerated, but a sibling path the operator names directly can still be read, written, or entered.
-  An explicit read grant, including `--allow-path <dir>`, restores enumeration for that directory.
-- Cross-session stores, other operators' accounts, and data roots remain denied. Another session's
-  transcripts, memories, internal contexts, and temporary working state are not reachable through
-  tools, nor are sibling local accounts, unrelated data roots, and mounted data volumes.
+- Cross-tenant isolation removes the discovery step. The session container, local-account containers,
+  data roots, and mounted-data containers cannot be enumerated, but a descendant path the operator
+  names directly can still be read, written, or entered. An explicit read grant restores enumeration.
+- Xcsh-private cross-session stores remain denied recursively. Another session's transcripts, memories,
+  internal contexts, credentials, and temporary working state are not reachable unless the operator
+  explicitly grants the relevant root.
 
-The same boundary answers for every tool. `read`, `write`, `grep`, `find`, `python`, and `bash` consult
-the same rules, so changing tools or spelling a path differently does not widen the session.
+Structured filesystem tools and the `bash` runtime consult the same fence. Bash command text is not
+scanned for path-looking strings; the operating system decides when a process actually opens a path.
+The persistent `python` kernel cannot carry a per-session runtime fence, so only an explicit Python
+`cwd` is checked. Python source and cell text are not scanned.
 
 If parent enumeration is refused, use a known path or ask the operator for an explicit read grant. If
-a cross-session or data-root path is refused, do not try to reach it another way. Say what you needed
-and why.
+an xcsh-private cross-session path is refused, say what you needed and why.
 
 This sandbox is a courtesy for session-context isolation, not a privilege boundary against xcsh or the
 operator. The rule of thumb is that if a file belongs to someone other than the operator you are
@@ -47,14 +48,12 @@ Three things behave differently under this backend, and none of them is a bug to
 {{/if}}
 {{else}}
 On this platform there is **no OS-level backend**, so for `bash` the boundary is enforced only by
-scanning the command text before it runs. That check is best-effort by construction: it reads what you
-wrote rather than what the shell will do, so a path assembled at runtime or reached through an unusual
-spelling may not be caught.
+precise pre-checks for an explicit `cwd`, literal redirections, known write operands, and literal
+directory changes. Command and source text are never scanned for path-looking strings.
 
-The intended rules are the same ones a confined session has: parent enumeration is refused while named
-operator access remains available, operator-owned home and configuration stay readable and writable,
-and cross-session stores, other operators' accounts, and unrelated data roots stay denied. Ordinary
-work remains unrestricted.
+Without a runtime backend, Bash child-process reads cannot enforce protected-container enumeration or
+xcsh-private-root denial. Structured tools still enforce those rules, and ordinary work remains
+unrestricted. The persistent `python` kernel is likewise unfenced beyond its explicit `cwd` check.
 
 Treat the boundary as a statement of intent rather than a guarantee, and do not go looking for paths
 outside the session directory on the assumption that something would stop you.

package/src/resource-management/index.ts

@@ -10,6 +10,7 @@ export type {
 	ApiSpecValidationResourceEntry,
 	DiffEntry,
 	KindResolver,
+	ManifestOperationInput,
 	ManifestValidationResult,
 	OperationResult,
 	ParsedResourceArgs,
@@ -18,6 +19,10 @@ export type {
 	ResourceDiff,
 	ResourceError,
 	ResourceManifest,
+	ResourceOperation,
+	ResourceOperationCounts,
+	ResourceOperationItem,
+	ResourceOperationReport,
 	ValidationError,
 	ValidationWarning,
 } from "@f5-sales-demo/pi-resource-management";
@@ -29,6 +34,7 @@ export {
 	formatOperationResult,
 	formatResourceDetail,
 	formatResourceList,
+	formatResourceOperationReport,
 	formatValidationErrors,
 	KindResolutionError,
 	ManifestFileError,
@@ -37,6 +43,8 @@ export {
 	parseResourceArgs,
 	ResourceClient,
 	readManifestFiles,
+	readManifestInputs,
+	runResourceOperation,
 	validateManifest,
 	validateManifests,
 } from "@f5-sales-demo/pi-resource-management";