@f5-sales-demo/xcsh 20.3.3 → 20.4.1

package/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 # Changelog
 
+## [20.4.0] - 2026-08-04
+
+### Breaking Changes
+
+- Renamed the executable updater from `xcsh update` to `xcsh self-update`; `xcsh update -f` now performs strict manifest-based resource updates ([#2930](https://github.com/f5-sales-demo/xcsh/issues/2930))
+
+### Added
+
+- Added deterministic, headless `apply`, `create`, `update`, `get`, `delete`, `diff`, `export`, and `validate` commands with file/stdin/directory manifests, reusable exports, stable aggregate JSON reports, and direct environment-based F5 XC authentication without an LLM turn ([#2930](https://github.com/f5-sales-demo/xcsh/issues/2930))
+
+### Fixed
+
+- Prevalidated manifest batches before mutation, preserved strict create and update semantics, rejected unsupported server dry-run, and returned automation-grade exit codes for resource operations ([#2930](https://github.com/f5-sales-demo/xcsh/issues/2930))
+- Prevented sandbox false refusals from path-like Bash and Python source text while limiting account and data containers to discovery protection and preserving xcsh-private runtime isolation ([#2931](https://github.com/f5-sales-demo/xcsh/issues/2931))
+
 ## [20.3.0] - 2026-08-04
 
 ### Added

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@f5-sales-demo/xcsh",
-	"version": "20.3.3",
+	"version": "20.4.1",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://github.com/f5-sales-demo/xcsh",
 	"author": "Can Boluk",
@@ -60,13 +60,13 @@
 	"dependencies": {
 		"@agentclientprotocol/sdk": "1.3.0",
 		"@mozilla/readability": "^0.6",
-		"@f5-sales-demo/xcsh-stats": "20.3.3",
-		"@f5-sales-demo/pi-agent-core": "20.3.3",
-		"@f5-sales-demo/pi-ai": "20.3.3",
-		"@f5-sales-demo/pi-natives": "20.3.3",
-		"@f5-sales-demo/pi-resource-management": "20.3.3",
-		"@f5-sales-demo/pi-tui": "20.3.3",
-		"@f5-sales-demo/pi-utils": "20.3.3",
+		"@f5-sales-demo/xcsh-stats": "20.4.1",
+		"@f5-sales-demo/pi-agent-core": "20.4.1",
+		"@f5-sales-demo/pi-ai": "20.4.1",
+		"@f5-sales-demo/pi-natives": "20.4.1",
+		"@f5-sales-demo/pi-resource-management": "20.4.1",
+		"@f5-sales-demo/pi-tui": "20.4.1",
+		"@f5-sales-demo/pi-utils": "20.4.1",
 		"@sinclair/typebox": "^0.34",
 		"@xterm/headless": "^6.0",
 		"ajv": "^8.20",

package/src/browser/chat-conformance.json

@@ -245,6 +245,10 @@
               "const": "token-expiring",
               "type": "string"
             },
+            {
+              "const": "provider-auth",
+              "type": "string"
+            },
             {
               "const": "provider-4xx",
               "type": "string"

package/src/browser/chat-handler.ts

@@ -12,6 +12,7 @@ import {
 	normalizeHostToolDefinitions,
 	RpcHostToolBridge,
 } from "../host-tools";
+import { LITELLM_LOGIN_MODEL_CHOICES } from "../modes/controllers/login-model";
 import { extractReferences } from "../references";
 import type { AgentSession, AgentSessionEvent } from "../session/agent-session";
 import {
@@ -31,9 +32,11 @@ import {
 	isChatStop,
 	isConfigure,
 	isListCommands,
+	isListModels,
 	isListSkills,
 	isSetHostTools,
 	isTransportChatRequest,
+	type ModelsList,
 	type PageContextSnapshot,
 	type SetHostTools,
 	type SetHostToolsAck,
@@ -84,6 +87,11 @@ export class ChatHandler {
 	// Only one pending request at a time (newest wins — a third prompt while one is
 	// queued replaces it, so the user's latest intent always runs next).
 	#pendingRequest: ChatRequest | null = null;
+	// A request can arrive after chat_done but before AgentSession clears its short
+	// prompt-in-flight tail. There is then no active chat whose finally block can
+	// replay the queue, so that orphaned queue needs its own idle drain.
+	#pendingReplayScheduled = false;
+	#disposed = false;
 	// Transport-neutral host-tool bridge (A1): maps `set_host_tools` definitions to
 	// AgentTools whose execute() round-trips a `host_tool_call` back to the WS client
 	// and awaits the correlated `host_tool_result`. Reused verbatim from the stdio RPC
@@ -119,6 +127,9 @@ export class ChatHandler {
 			// Skills enumeration (#2311): the pane asks for the loaded skills to populate
 			// the composer's Skills submenu.
 			else if (isListSkills(msg)) this.#handleListSkills();
+			// Model enumeration is separate from credential configuration: the pane can
+			// select among models xcsh already knows without asking for another token.
+			else if (isListModels(msg)) this.#handleListModels();
 			// Slash-command enumeration: the pane asks for the session's file-based
 			// commands to populate the composer's `/` menu.
 			else if (isListCommands(msg)) this.#handleListCommands();
@@ -127,6 +138,7 @@ export class ChatHandler {
 		});
 
 		this.#server.onDisconnected(() => {
+			this.#disposed = true;
 			this.#pendingRequest = null; // abandon any queued prompt — the bridge is gone
 			// Fail any in-flight host-tool call — the client that would answer it is gone.
 			this.#hostToolBridge.rejectAllPending("bridge disconnected before host tool completed");
@@ -158,6 +170,7 @@ export class ChatHandler {
 				ok: true,
 				detail: "xcsh is finishing the current request — yours is queued and will run next.",
 			});
+			this.#scheduleOrphanedPendingReplay();
 			return;
 		}
 
@@ -205,14 +218,14 @@ export class ChatHandler {
 			data: img.data,
 			mimeType: img.mimeType,
 		}));
-		// "Search the web" toggle → add Anthropic's server-side web-search tool for this
-		// turn only. The gateway executes it and returns cited results; source URLs the
-		// model writes inline flow to the pane's Sources chips via extractReferences.
-		const serverTools = req.web_search
-			? [{ type: "web_search_20250305", name: "web_search", max_uses: 5 }]
-			: undefined;
-
 		try {
+			// Select the native provider-side descriptor from the ACTIVE model on every
+			// turn. This must happen after a model switch and before prompt() transmits a
+			// payload; an unsupported API is rejected locally instead of receiving another
+			// provider's raw tool shape.
+			const serverTools = req.web_search
+				? officeWebSearchServerTools(this.#session.model?.api ?? "unconfigured")
+				: undefined;
 			chat.promptAt = Date.now();
 			await this.#session.prompt(prompt, { expandPromptTemplates: false, synthetic: false, images, serverTools });
 		} catch (err: unknown) {
@@ -234,6 +247,43 @@ export class ChatHandler {
 		}
 	}
 
+	/**
+	 * Drain a queue created during AgentSession's terminal streaming tail. Normal
+	 * mid-turn queues are replayed by the active chat's finally block; this path is
+	 * only scheduled when no active chat exists to own that replay.
+	 */
+	#scheduleOrphanedPendingReplay(): void {
+		if (this.#pendingReplayScheduled || this.#disposed || !this.#pendingRequest || this.#activeChats.size > 0) {
+			return;
+		}
+		this.#pendingReplayScheduled = true;
+		void this.#replayPendingAfterIdle();
+	}
+
+	async #replayPendingAfterIdle(): Promise<void> {
+		try {
+			await this.#session.waitForIdle();
+			// waitForIdle can resolve in AgentSession's prompt finally just before its
+			// prompt-in-flight counter is decremented. Yield one task so isStreaming is
+			// the settled state rather than that terminal edge.
+			await new Promise<void>(resolve => setTimeout(resolve, 0));
+		} catch {
+			// A disposing session can reject its idle wait. Teardown owns any terminal
+			// frame and clears the pending request; never replay into that session.
+			this.#pendingReplayScheduled = false;
+			return;
+		}
+		this.#pendingReplayScheduled = false;
+		if (this.#disposed || !this.#pendingRequest || this.#activeChats.size > 0) return;
+		if (this.#session.isStreaming) {
+			this.#scheduleOrphanedPendingReplay();
+			return;
+		}
+		const pending = this.#pendingRequest;
+		this.#pendingRequest = null;
+		void this.#handleChatRequest(pending);
+	}
+
 	#handleSessionEvent(chat: ActiveChat, event: AgentSessionEvent): void {
 		if (chat.terminalSent) return;
 
@@ -377,8 +427,8 @@ export class ChatHandler {
 	 * SQLite credential store. Mirrors #handleSetHostTools's try/ack-or-nack shape;
 	 * never throws out of the handler (a nack keeps a waiting client from hanging).
 	 *
-	 * The baked production role identifies the concrete provider, model, and effort,
-	 * so the bridge follows the same LiteLLM default as every other xcsh entry point. */
+	 * A curated model route identifies the concrete provider, model, effort, and
+	 * provider-specific gateway path. The pane supplies only a gateway root. */
 	async #handleConfigure(msg: Configure): Promise<void> {
 		try {
 			const registry = this.#session.modelRegistry;
@@ -386,9 +436,21 @@ export class ChatHandler {
 			if (!defaultModel) {
 				throw new Error("Invalid baked default model selector");
 			}
-			const { provider, id: defaultModelId, thinkingLevel } = defaultModel;
+			const currentChoice = LITELLM_LOGIN_MODEL_CHOICES.find(
+				choice => choice.provider === this.#session.model?.provider && choice.modelId === this.#session.model.id,
+			);
+			const modelId = msg.model ?? currentChoice?.modelId ?? defaultModel.id;
+			const choice = LITELLM_LOGIN_MODEL_CHOICES.find(candidate => candidate.modelId === modelId);
+			const matchingProviders = (["anthropic", "litellm"] as const).filter(candidate =>
+				registry.find(candidate, modelId),
+			);
+			const provider = choice?.provider ?? (matchingProviders.length === 1 ? matchingProviders[0] : undefined);
+			if (!provider) {
+				throw new Error(`No unambiguous Office model route for ${modelId}`);
+			}
+			const thinkingLevel = choice?.thinkingLevel ?? defaultModel.thinkingLevel;
 
-			if (msg.baseUrl) {
+			if (msg.baseUrl && msg.token) {
 				// SSRF guard: only an `https:` gateway URL may be dialed. Validate BEFORE
 				// registerProvider so a bad URL becomes a configure_error nack (never a
 				// silently-ignored frame that hangs the client). We deliberately do NOT
@@ -400,7 +462,8 @@ export class ChatHandler {
 				// THEIR OWN gateway with THEIR OWN token over a loopback-only, TLS,
 				// Origin-checked bridge (extension-bridge `isAllowedBridgeOrigin`), https is
 				// enforced here, and the token is session-only (never persisted to disk).
-				const baseUrl = requireHttpsUrl(msg.baseUrl);
+				const gatewayRoot = requireHttpsUrl(msg.baseUrl);
+				const baseUrl = providerGatewayBaseUrl(gatewayRoot, provider);
 
 				// baseUrl + apiKey, no models[] → sets the in-memory runtime API key AND
 				// overrides the existing provider models' baseUrl/headers (reusing their
@@ -414,14 +477,11 @@ export class ChatHandler {
 					},
 					"office-configure",
 				);
-			} else {
+			} else if (msg.token) {
 				// Key-only: reuse the baked F5 gateway; set just the non-persistent runtime key.
 				registry.authStorage.setRuntimeApiKey(provider, msg.token);
 			}
 
-			const currentDefaultModelId =
-				this.#session.model?.provider === provider ? this.#session.model.id : defaultModelId;
-			const modelId = msg.model ?? currentDefaultModelId;
 			const model = registry.find(provider, modelId);
 			if (!model) {
 				throw new Error(`No model ${provider}/${modelId} available`);
@@ -464,6 +524,23 @@ export class ChatHandler {
 		this.#server.send({ type: "skills", skills: toSkillSummaries(this.#session.skills) } satisfies SkillsList);
 	}
 
+	/** Reply with the curated Office models that resolve in the live registry. */
+	#handleListModels(): void {
+		const models = LITELLM_LOGIN_MODEL_CHOICES.filter(choice =>
+			this.#session.modelRegistry.find(choice.provider, choice.modelId),
+		).map(choice => ({ id: choice.modelId, label: choice.label }));
+		const current = this.#session.model?.id;
+		// A ready Office session normally always has an active model. During an
+		// unconfigured startup there is no truthful `current` value to advertise, so
+		// leave the selector empty until the next connection instead of inventing one.
+		if (!current) return;
+		this.#server.send({
+			type: "models",
+			current,
+			models,
+		} satisfies ModelsList);
+	}
+
 	/** Reply to `list_commands` with the session's file-based slash commands (name +
 	 *  description) so the pane can populate the composer's `/` menu. Pure read — the
 	 *  commands are already discovered; the template bodies never cross the wire. */
@@ -487,6 +564,7 @@ export class ChatHandler {
 	}
 
 	dispose(): void {
+		this.#disposed = true;
 		this.#pendingRequest = null; // abandon any queued prompt — don't replay into a dead session
 		// Fail any in-flight host-tool call — the session is going away.
 		this.#hostToolBridge.rejectAllPending("bridge disconnected before host tool completed");
@@ -502,11 +580,37 @@ export class ChatHandler {
 	}
 }
 
-/** SSRF guard for the `configure` frame's optional gateway `baseUrl`: the URL must
- * parse and use `https:`. Returns the ORIGINAL string unchanged on success (no
- * normalization — the operator's exact gateway path is preserved); throws (→ becomes
- * a `configure_error` nack) for a malformed or non-https URL. Loopback/private hosts
- * are intentionally NOT blocked — the target is an operator-chosen internal gateway. */
+/** Native provider-side web-search descriptors supported by the Office surface.
+ * Ordinary xcsh and Office host tools do not use this seam; they remain function
+ * tools and are preserved by the agent's payload composer. */
+export function officeWebSearchServerTools(modelApi: string): Record<string, unknown>[] {
+	switch (modelApi) {
+		case "anthropic-messages":
+			return [{ type: "web_search_20250305", name: "web_search", max_uses: 5 }];
+		case "openai-completions":
+			return [{ type: "web_search_preview" }];
+		default:
+			throw new Error(`Office web search is unsupported for model API ${modelApi}`);
+	}
+}
+
+const OFFICE_GATEWAY_PROVIDER_PATHS = {
+	anthropic: "/anthropic",
+	litellm: "/api/v1",
+} as const;
+
+/** Derive the selected provider's API base from a normalized gateway root. */
+export function providerGatewayBaseUrl(
+	gatewayRoot: string,
+	provider: keyof typeof OFFICE_GATEWAY_PROVIDER_PATHS,
+): string {
+	return `${gatewayRoot}${OFFICE_GATEWAY_PROVIDER_PATHS[provider]}`;
+}
+
+/** SSRF guard and backward-compatible root normalizer for the `configure` frame's
+ * optional gateway URL. Saved full-path URLs are reduced to their HTTPS origin;
+ * the selected model then determines the provider path. Loopback/private hosts are
+ * intentionally allowed because the target is an operator-chosen internal gateway. */
 export function requireHttpsUrl(raw: string): string {
 	let parsed: URL;
 	try {
@@ -517,7 +621,7 @@ export function requireHttpsUrl(raw: string): string {
 	if (parsed.protocol !== "https:") {
 		throw new Error(`configure baseUrl must use https (got "${parsed.protocol}")`);
 	}
-	return raw;
+	return parsed.origin;
 }
 
 /** Classify an upstream/provider error into the closed public reason vocabulary.
@@ -535,6 +639,9 @@ export function classifyChatErrorReason(message: string): ChatErrorReason {
 	) {
 		return "provider-5xx";
 	}
+	if (/\b(?:401|403)\b|\bunauthorized\b|\bforbidden\b|\bapi key\b|\bauthentication\b|\bcredentials?\b/.test(m)) {
+		return "provider-auth";
+	}
 	if (/\b4\d\d\b|forbidden|unauthorized|invalid model|bad request|not found|too many requests|rate limit/.test(m)) {
 		return "provider-4xx";
 	}

package/src/browser/chat-protocol.ts

@@ -89,8 +89,8 @@ interface ChatRequestBase {
 	 *  grants them to the filesystem sandbox for the session and tells the model they
 	 *  are available to read on demand. */
 	contextPaths?: string[];
-	/** When true, the engine adds Anthropic's server-side web-search tool to this
-	 *  turn's request (the "Search the web" composer toggle). */
+	/** When true, the engine adds the active model API's native server-side
+	 *  web-search tool to this turn (the "Search the web" composer toggle). */
 	web_search?: boolean;
 }
 
@@ -128,6 +128,24 @@ export interface ListSkills {
 	type: "list_skills";
 }
 
+/** Client → engine: enumerate the curated models available to the Office pane. */
+export interface ListModels {
+	type: "list_models";
+}
+
+/** One model option surfaced in the Office composer's model selector. */
+export interface ModelInfo {
+	id: string;
+	label: string;
+}
+
+/** Engine → client: available Office models and the active model id. */
+export interface ModelsList {
+	type: "models";
+	current: string;
+	models: ModelInfo[];
+}
+
 /** One skill surfaced to the pane's Skills submenu (name + human description). */
 export interface SkillInfo {
 	name: string;
@@ -196,6 +214,7 @@ export const CHAT_ERROR_REASONS = [
 	"session-disposed", // the worker session was torn down
 	"token-expired", // F5 XC API token expired
 	"token-expiring", // F5 XC API token is about to expire
+	"provider-auth", // upstream provider rejected its credential
 	"provider-4xx", // upstream provider rejected the request (client error)
 	"provider-5xx", // upstream provider failed (server error) — retryable
 ] as const;
@@ -278,15 +297,14 @@ export interface SetHostToolsError {
 // field. Mirrors the set_host_tools ack/nack shape exactly.
 // ---------------------------------------------------------------------------
 
-/** Inbound: the client configures the LLM provider. `token` is required and
- * non-empty. `baseUrl` (optional) is an OpenAI-compatible LiteLLM API base; when
- * omitted, the baked LiteLLM gateway is reused and only the runtime API key is set.
- * `model` (optional) selects the model id; when omitted, the session default is
- * kept. The token lives in session/runtime memory only — never written to disk. */
+/** Inbound: the client configures credentials, selects a model, or both.
+ * `baseUrl` is a gateway root and requires a non-empty `token`; xcsh derives its
+ * provider path from `model`. A model-only frame reuses xcsh's existing provider
+ * credentials. Runtime credentials are never written to disk. */
 export interface Configure {
 	type: "configure";
 	baseUrl?: string;
-	token: string;
+	token?: string;
 	model?: string;
 }
 
@@ -372,15 +390,22 @@ export function isSetHostTools(msg: Record<string, unknown>): boolean {
 	return msg.type === "set_host_tools" && Array.isArray(msg.tools);
 }
 
-/** True for a well-formed `configure` frame: a non-empty string `token` is required;
- * `baseUrl`/`model`, when present, must be strings. */
+export function isListModels(msg: Record<string, unknown>): boolean {
+	return msg.type === "list_models";
+}
+
+/** True for a well-formed `configure` frame. At least a non-empty token or model is
+ * required, and a gateway root may never be sent without its token. */
 export function isConfigure(msg: Record<string, unknown>): boolean {
+	const hasToken = typeof msg.token === "string" && msg.token.trim().length > 0;
+	const hasModel = typeof msg.model === "string" && msg.model.trim().length > 0;
 	return (
 		msg.type === "configure" &&
-		typeof msg.token === "string" &&
-		msg.token.length > 0 &&
+		(hasToken || hasModel) &&
+		(msg.token === undefined || typeof msg.token === "string") &&
 		(msg.baseUrl === undefined || typeof msg.baseUrl === "string") &&
-		(msg.model === undefined || typeof msg.model === "string")
+		(msg.model === undefined || typeof msg.model === "string") &&
+		(msg.baseUrl === undefined || hasToken)
 	);
 }
 

package/src/browser/headless-bridge.ts

@@ -18,6 +18,7 @@ import { getProjectDir, getXCSHConfigDir } from "@f5-sales-demo/pi-utils";
 import { createAgentSession } from "../sdk";
 import { ContextService } from "../services/xcsh-context";
 import { deriveTenantEnv } from "../services/xcsh-env";
+import { SessionManager } from "../session/session-manager";
 import { resolveBridgeTls } from "./bridge-cert";
 import { ChatHandler } from "./chat-handler";
 import { isPickPath, type PathPicked } from "./chat-protocol";
@@ -147,6 +148,10 @@ export async function startHeadlessChatBridge(deps: HeadlessBridgeDeps = default
 		const { session } = await deps.createAgentSession({
 			cwd,
 			hasUI: false,
+			// Office conversations can contain private workbook and working-directory
+			// data. Keep the entire headless session ephemeral instead of inheriting
+			// createAgentSession's file-backed default.
+			sessionManager: SessionManager.inMemory(cwd),
 			toolNames: [...OFFICE_TOOL_NAMES],
 			customTools: [],
 			// Headless: no MCP/LSP/extension discovery — lean, no network/blocking prompts.

package/src/browser/office-pane-server.ts

@@ -299,7 +299,10 @@ export async function getOfficePaneDir(): Promise<string> {
 /**
  * Pure request handler: map a URL pathname to a file under `dir` and return it
  * with the content-type inferred from its extension, or a 404. `/` maps to
- * `taskpane.html`. Path-traversal is rejected before any filesystem access.
+ * `taskpane.html`. Successful assets are `no-store`: every compiled build uses
+ * the same stable URLs, and Excel's WebView otherwise reuses an older pane bundle
+ * after a new xcsh binary is sideloaded. Path-traversal is rejected before any
+ * filesystem access.
  */
 export async function handleAssetRequest(pathname: string, dir: string): Promise<Response> {
 	const requested = pathname === "/" ? "taskpane.html" : pathname.replace(/^\/+/, "");
@@ -313,7 +316,14 @@ export async function handleAssetRequest(pathname: string, dir: string): Promise
 	}
 
 	const file = Bun.file(fullPath);
-	if (await file.exists()) return new Response(file);
+	if (await file.exists()) {
+		return new Response(file, {
+			headers: {
+				"Cache-Control": "no-store",
+				"Content-Type": file.type,
+			},
+		});
+	}
 	return new Response("Not Found", { status: 404 });
 }
 

package/src/cli/resource-cli.ts

@@ -0,0 +1,134 @@
+import * as fs from "node:fs/promises";
+import {
+	formatManifestOutput,
+	formatResourceOperationReport,
+	ResourceClient,
+	type ResourceOperation,
+	type ResourceOperationReport,
+	readManifestInputs,
+	runResourceOperation,
+} from "@f5-sales-demo/pi-resource-management";
+import { kindResolver } from "../resource-management/index";
+
+export interface ResourceCliArgs {
+	operation: ResourceOperation;
+	filenames?: string[];
+	kind?: string;
+	name?: string;
+	all?: boolean;
+	namespace?: string;
+	outputFormat?: "json" | "yaml" | "table" | "wide";
+	recursive?: boolean;
+	dryRun?: "client";
+	resultFile?: string;
+	outputFile?: string;
+}
+
+export interface ResourceEnvironment {
+	apiUrl?: string;
+	apiToken?: string;
+	defaultNamespace?: string;
+}
+
+export function resolveResourceEnvironment(
+	env: Readonly<Record<string, string | undefined>> = process.env,
+): ResourceEnvironment {
+	return {
+		apiUrl: env.XCSH_API_URL,
+		apiToken: env.XCSH_API_TOKEN,
+		defaultNamespace: env.XCSH_NAMESPACE,
+	};
+}
+
+export function exitCodeForResourceReport(report: ResourceOperationReport): 0 | 1 | 2 {
+	if (report.success) return 0;
+	const failures = report.results.filter(result => result.status === "error" || result.status === "skipped");
+	return failures.length > 0 && failures.every(result => result.error?.kind === "validation") ? 2 : 1;
+}
+
+export function formatResourceCliOutput(
+	report: ResourceOperationReport,
+	format: "json" | "yaml" | "table" | "wide",
+): string {
+	if (report.operation === "export" && (format === "json" || format === "yaml")) {
+		const manifests = report.results.flatMap(result => (result.manifest ? [result.manifest] : []));
+		return formatManifestOutput(manifests, format);
+	}
+	return formatResourceOperationReport(report, format);
+}
+
+export async function runResourceCli(args: ResourceCliArgs): Promise<void> {
+	const env = resolveResourceEnvironment();
+	let report: ResourceOperationReport;
+
+	try {
+		const manifestOperation = ["apply", "create", "update", "get", "delete", "diff", "validate"].includes(
+			args.operation,
+		);
+		let inputs =
+			manifestOperation && (args.filenames?.length ?? 0) > 0
+				? await readManifestInputs(args.filenames ?? [], args.recursive ?? false)
+				: undefined;
+
+		if (args.operation === "delete" && !inputs && args.kind && args.name) {
+			const namespace = args.namespace ?? env.defaultNamespace;
+			const rawObject = { kind: args.kind, metadata: { name: args.name, namespace }, spec: {} };
+			inputs = [
+				{
+					index: 0,
+					sourcePath: "command-line",
+					manifest: {
+						kind: args.kind,
+						metadata: { name: args.name, namespace },
+						spec: {},
+						rawObject,
+					},
+				},
+			];
+		}
+
+		const requiresApi = args.operation !== "validate";
+		const client =
+			requiresApi && env.apiUrl && env.apiToken
+				? new ResourceClient({
+						apiUrl: env.apiUrl,
+						apiToken: env.apiToken,
+						namespace: env.defaultNamespace ?? "",
+					})
+				: undefined;
+
+		report = await runResourceOperation({
+			operation: args.operation,
+			kindResolver,
+			client,
+			inputs,
+			kind: args.kind,
+			name: args.name,
+			all: args.all,
+			namespaceOverride: args.namespace,
+			defaultNamespace: env.defaultNamespace,
+			dryRun: args.dryRun,
+		});
+	} catch (error) {
+		report = {
+			schemaVersion: 1,
+			operation: args.operation,
+			success: false,
+			counts: { total: 1, succeeded: 0, failed: 1, error: 1 },
+			results: [
+				{
+					index: 0,
+					status: "error",
+					error: { kind: "validation", message: error instanceof Error ? error.message : String(error) },
+				},
+			],
+		};
+	}
+
+	const json = `${JSON.stringify(report, null, 2)}\n`;
+	if (args.resultFile) await fs.writeFile(args.resultFile, json, "utf8");
+	const output = `${formatResourceCliOutput(report, args.outputFormat ?? "table")}\n`;
+	if (args.outputFile) await fs.writeFile(args.outputFile, output, "utf8");
+	else process.stdout.write(output);
+	process.exitCode = exitCodeForResourceReport(report);
+}