@f5-sales-demo/xcsh 20.4.0 → 20.4.2

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@f5-sales-demo/xcsh",
-	"version": "20.4.0",
+	"version": "20.4.2",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://github.com/f5-sales-demo/xcsh",
 	"author": "Can Boluk",
@@ -60,13 +60,13 @@
 	"dependencies": {
 		"@agentclientprotocol/sdk": "1.3.0",
 		"@mozilla/readability": "^0.6",
-		"@f5-sales-demo/xcsh-stats": "20.4.0",
-		"@f5-sales-demo/pi-agent-core": "20.4.0",
-		"@f5-sales-demo/pi-ai": "20.4.0",
-		"@f5-sales-demo/pi-natives": "20.4.0",
-		"@f5-sales-demo/pi-resource-management": "20.4.0",
-		"@f5-sales-demo/pi-tui": "20.4.0",
-		"@f5-sales-demo/pi-utils": "20.4.0",
+		"@f5-sales-demo/xcsh-stats": "20.4.2",
+		"@f5-sales-demo/pi-agent-core": "20.4.2",
+		"@f5-sales-demo/pi-ai": "20.4.2",
+		"@f5-sales-demo/pi-natives": "20.4.2",
+		"@f5-sales-demo/pi-resource-management": "20.4.2",
+		"@f5-sales-demo/pi-tui": "20.4.2",
+		"@f5-sales-demo/pi-utils": "20.4.2",
 		"@sinclair/typebox": "^0.34",
 		"@xterm/headless": "^6.0",
 		"ajv": "^8.20",

package/src/browser/chat-conformance.json

@@ -245,6 +245,10 @@
               "const": "token-expiring",
               "type": "string"
             },
+            {
+              "const": "provider-auth",
+              "type": "string"
+            },
             {
               "const": "provider-4xx",
               "type": "string"

package/src/browser/chat-handler.ts

@@ -12,6 +12,7 @@ import {
 	normalizeHostToolDefinitions,
 	RpcHostToolBridge,
 } from "../host-tools";
+import { LITELLM_LOGIN_MODEL_CHOICES } from "../modes/controllers/login-model";
 import { extractReferences } from "../references";
 import type { AgentSession, AgentSessionEvent } from "../session/agent-session";
 import {
@@ -31,9 +32,11 @@ import {
 	isChatStop,
 	isConfigure,
 	isListCommands,
+	isListModels,
 	isListSkills,
 	isSetHostTools,
 	isTransportChatRequest,
+	type ModelsList,
 	type PageContextSnapshot,
 	type SetHostTools,
 	type SetHostToolsAck,
@@ -84,6 +87,11 @@ export class ChatHandler {
 	// Only one pending request at a time (newest wins — a third prompt while one is
 	// queued replaces it, so the user's latest intent always runs next).
 	#pendingRequest: ChatRequest | null = null;
+	// A request can arrive after chat_done but before AgentSession clears its short
+	// prompt-in-flight tail. There is then no active chat whose finally block can
+	// replay the queue, so that orphaned queue needs its own idle drain.
+	#pendingReplayScheduled = false;
+	#disposed = false;
 	// Transport-neutral host-tool bridge (A1): maps `set_host_tools` definitions to
 	// AgentTools whose execute() round-trips a `host_tool_call` back to the WS client
 	// and awaits the correlated `host_tool_result`. Reused verbatim from the stdio RPC
@@ -119,6 +127,9 @@ export class ChatHandler {
 			// Skills enumeration (#2311): the pane asks for the loaded skills to populate
 			// the composer's Skills submenu.
 			else if (isListSkills(msg)) this.#handleListSkills();
+			// Model enumeration is separate from credential configuration: the pane can
+			// select among models xcsh already knows without asking for another token.
+			else if (isListModels(msg)) this.#handleListModels();
 			// Slash-command enumeration: the pane asks for the session's file-based
 			// commands to populate the composer's `/` menu.
 			else if (isListCommands(msg)) this.#handleListCommands();
@@ -127,6 +138,7 @@ export class ChatHandler {
 		});
 
 		this.#server.onDisconnected(() => {
+			this.#disposed = true;
 			this.#pendingRequest = null; // abandon any queued prompt — the bridge is gone
 			// Fail any in-flight host-tool call — the client that would answer it is gone.
 			this.#hostToolBridge.rejectAllPending("bridge disconnected before host tool completed");
@@ -158,6 +170,7 @@ export class ChatHandler {
 				ok: true,
 				detail: "xcsh is finishing the current request — yours is queued and will run next.",
 			});
+			this.#scheduleOrphanedPendingReplay();
 			return;
 		}
 
@@ -205,14 +218,14 @@ export class ChatHandler {
 			data: img.data,
 			mimeType: img.mimeType,
 		}));
-		// "Search the web" toggle → add Anthropic's server-side web-search tool for this
-		// turn only. The gateway executes it and returns cited results; source URLs the
-		// model writes inline flow to the pane's Sources chips via extractReferences.
-		const serverTools = req.web_search
-			? [{ type: "web_search_20250305", name: "web_search", max_uses: 5 }]
-			: undefined;
-
 		try {
+			// Select the native provider-side descriptor from the ACTIVE model on every
+			// turn. This must happen after a model switch and before prompt() transmits a
+			// payload; an unsupported API is rejected locally instead of receiving another
+			// provider's raw tool shape.
+			const serverTools = req.web_search
+				? officeWebSearchServerTools(this.#session.model?.api ?? "unconfigured")
+				: undefined;
 			chat.promptAt = Date.now();
 			await this.#session.prompt(prompt, { expandPromptTemplates: false, synthetic: false, images, serverTools });
 		} catch (err: unknown) {
@@ -234,6 +247,43 @@ export class ChatHandler {
 		}
 	}
 
+	/**
+	 * Drain a queue created during AgentSession's terminal streaming tail. Normal
+	 * mid-turn queues are replayed by the active chat's finally block; this path is
+	 * only scheduled when no active chat exists to own that replay.
+	 */
+	#scheduleOrphanedPendingReplay(): void {
+		if (this.#pendingReplayScheduled || this.#disposed || !this.#pendingRequest || this.#activeChats.size > 0) {
+			return;
+		}
+		this.#pendingReplayScheduled = true;
+		void this.#replayPendingAfterIdle();
+	}
+
+	async #replayPendingAfterIdle(): Promise<void> {
+		try {
+			await this.#session.waitForIdle();
+			// waitForIdle can resolve in AgentSession's prompt finally just before its
+			// prompt-in-flight counter is decremented. Yield one task so isStreaming is
+			// the settled state rather than that terminal edge.
+			await new Promise<void>(resolve => setTimeout(resolve, 0));
+		} catch {
+			// A disposing session can reject its idle wait. Teardown owns any terminal
+			// frame and clears the pending request; never replay into that session.
+			this.#pendingReplayScheduled = false;
+			return;
+		}
+		this.#pendingReplayScheduled = false;
+		if (this.#disposed || !this.#pendingRequest || this.#activeChats.size > 0) return;
+		if (this.#session.isStreaming) {
+			this.#scheduleOrphanedPendingReplay();
+			return;
+		}
+		const pending = this.#pendingRequest;
+		this.#pendingRequest = null;
+		void this.#handleChatRequest(pending);
+	}
+
 	#handleSessionEvent(chat: ActiveChat, event: AgentSessionEvent): void {
 		if (chat.terminalSent) return;
 
@@ -377,8 +427,8 @@ export class ChatHandler {
 	 * SQLite credential store. Mirrors #handleSetHostTools's try/ack-or-nack shape;
 	 * never throws out of the handler (a nack keeps a waiting client from hanging).
 	 *
-	 * The baked production role identifies the concrete provider, model, and effort,
-	 * so the bridge follows the same LiteLLM default as every other xcsh entry point. */
+	 * A curated model route identifies the concrete provider, model, effort, and
+	 * provider-specific gateway path. The pane supplies only a gateway root. */
 	async #handleConfigure(msg: Configure): Promise<void> {
 		try {
 			const registry = this.#session.modelRegistry;
@@ -386,9 +436,21 @@ export class ChatHandler {
 			if (!defaultModel) {
 				throw new Error("Invalid baked default model selector");
 			}
-			const { provider, id: defaultModelId, thinkingLevel } = defaultModel;
+			const currentChoice = LITELLM_LOGIN_MODEL_CHOICES.find(
+				choice => choice.provider === this.#session.model?.provider && choice.modelId === this.#session.model.id,
+			);
+			const modelId = msg.model ?? currentChoice?.modelId ?? defaultModel.id;
+			const choice = LITELLM_LOGIN_MODEL_CHOICES.find(candidate => candidate.modelId === modelId);
+			const matchingProviders = (["anthropic", "litellm"] as const).filter(candidate =>
+				registry.find(candidate, modelId),
+			);
+			const provider = choice?.provider ?? (matchingProviders.length === 1 ? matchingProviders[0] : undefined);
+			if (!provider) {
+				throw new Error(`No unambiguous Office model route for ${modelId}`);
+			}
+			const thinkingLevel = choice?.thinkingLevel ?? defaultModel.thinkingLevel;
 
-			if (msg.baseUrl) {
+			if (msg.baseUrl && msg.token) {
 				// SSRF guard: only an `https:` gateway URL may be dialed. Validate BEFORE
 				// registerProvider so a bad URL becomes a configure_error nack (never a
 				// silently-ignored frame that hangs the client). We deliberately do NOT
@@ -400,7 +462,8 @@ export class ChatHandler {
 				// THEIR OWN gateway with THEIR OWN token over a loopback-only, TLS,
 				// Origin-checked bridge (extension-bridge `isAllowedBridgeOrigin`), https is
 				// enforced here, and the token is session-only (never persisted to disk).
-				const baseUrl = requireHttpsUrl(msg.baseUrl);
+				const gatewayRoot = requireHttpsUrl(msg.baseUrl);
+				const baseUrl = providerGatewayBaseUrl(gatewayRoot, provider);
 
 				// baseUrl + apiKey, no models[] → sets the in-memory runtime API key AND
 				// overrides the existing provider models' baseUrl/headers (reusing their
@@ -414,14 +477,11 @@ export class ChatHandler {
 					},
 					"office-configure",
 				);
-			} else {
+			} else if (msg.token) {
 				// Key-only: reuse the baked F5 gateway; set just the non-persistent runtime key.
 				registry.authStorage.setRuntimeApiKey(provider, msg.token);
 			}
 
-			const currentDefaultModelId =
-				this.#session.model?.provider === provider ? this.#session.model.id : defaultModelId;
-			const modelId = msg.model ?? currentDefaultModelId;
 			const model = registry.find(provider, modelId);
 			if (!model) {
 				throw new Error(`No model ${provider}/${modelId} available`);
@@ -464,6 +524,23 @@ export class ChatHandler {
 		this.#server.send({ type: "skills", skills: toSkillSummaries(this.#session.skills) } satisfies SkillsList);
 	}
 
+	/** Reply with the curated Office models that resolve in the live registry. */
+	#handleListModels(): void {
+		const models = LITELLM_LOGIN_MODEL_CHOICES.filter(choice =>
+			this.#session.modelRegistry.find(choice.provider, choice.modelId),
+		).map(choice => ({ id: choice.modelId, label: choice.label }));
+		const current = this.#session.model?.id;
+		// A ready Office session normally always has an active model. During an
+		// unconfigured startup there is no truthful `current` value to advertise, so
+		// leave the selector empty until the next connection instead of inventing one.
+		if (!current) return;
+		this.#server.send({
+			type: "models",
+			current,
+			models,
+		} satisfies ModelsList);
+	}
+
 	/** Reply to `list_commands` with the session's file-based slash commands (name +
 	 *  description) so the pane can populate the composer's `/` menu. Pure read — the
 	 *  commands are already discovered; the template bodies never cross the wire. */
@@ -487,6 +564,7 @@ export class ChatHandler {
 	}
 
 	dispose(): void {
+		this.#disposed = true;
 		this.#pendingRequest = null; // abandon any queued prompt — don't replay into a dead session
 		// Fail any in-flight host-tool call — the session is going away.
 		this.#hostToolBridge.rejectAllPending("bridge disconnected before host tool completed");
@@ -502,11 +580,37 @@ export class ChatHandler {
 	}
 }
 
-/** SSRF guard for the `configure` frame's optional gateway `baseUrl`: the URL must
- * parse and use `https:`. Returns the ORIGINAL string unchanged on success (no
- * normalization — the operator's exact gateway path is preserved); throws (→ becomes
- * a `configure_error` nack) for a malformed or non-https URL. Loopback/private hosts
- * are intentionally NOT blocked — the target is an operator-chosen internal gateway. */
+/** Native provider-side web-search descriptors supported by the Office surface.
+ * Ordinary xcsh and Office host tools do not use this seam; they remain function
+ * tools and are preserved by the agent's payload composer. */
+export function officeWebSearchServerTools(modelApi: string): Record<string, unknown>[] {
+	switch (modelApi) {
+		case "anthropic-messages":
+			return [{ type: "web_search_20250305", name: "web_search", max_uses: 5 }];
+		case "openai-completions":
+			return [{ type: "web_search_preview" }];
+		default:
+			throw new Error(`Office web search is unsupported for model API ${modelApi}`);
+	}
+}
+
+const OFFICE_GATEWAY_PROVIDER_PATHS = {
+	anthropic: "/anthropic",
+	litellm: "/api/v1",
+} as const;
+
+/** Derive the selected provider's API base from a normalized gateway root. */
+export function providerGatewayBaseUrl(
+	gatewayRoot: string,
+	provider: keyof typeof OFFICE_GATEWAY_PROVIDER_PATHS,
+): string {
+	return `${gatewayRoot}${OFFICE_GATEWAY_PROVIDER_PATHS[provider]}`;
+}
+
+/** SSRF guard and backward-compatible root normalizer for the `configure` frame's
+ * optional gateway URL. Saved full-path URLs are reduced to their HTTPS origin;
+ * the selected model then determines the provider path. Loopback/private hosts are
+ * intentionally allowed because the target is an operator-chosen internal gateway. */
 export function requireHttpsUrl(raw: string): string {
 	let parsed: URL;
 	try {
@@ -517,7 +621,7 @@ export function requireHttpsUrl(raw: string): string {
 	if (parsed.protocol !== "https:") {
 		throw new Error(`configure baseUrl must use https (got "${parsed.protocol}")`);
 	}
-	return raw;
+	return parsed.origin;
 }
 
 /** Classify an upstream/provider error into the closed public reason vocabulary.
@@ -535,6 +639,9 @@ export function classifyChatErrorReason(message: string): ChatErrorReason {
 	) {
 		return "provider-5xx";
 	}
+	if (/\b(?:401|403)\b|\bunauthorized\b|\bforbidden\b|\bapi key\b|\bauthentication\b|\bcredentials?\b/.test(m)) {
+		return "provider-auth";
+	}
 	if (/\b4\d\d\b|forbidden|unauthorized|invalid model|bad request|not found|too many requests|rate limit/.test(m)) {
 		return "provider-4xx";
 	}

package/src/browser/chat-protocol.ts

@@ -89,8 +89,8 @@ interface ChatRequestBase {
 	 *  grants them to the filesystem sandbox for the session and tells the model they
 	 *  are available to read on demand. */
 	contextPaths?: string[];
-	/** When true, the engine adds Anthropic's server-side web-search tool to this
-	 *  turn's request (the "Search the web" composer toggle). */
+	/** When true, the engine adds the active model API's native server-side
+	 *  web-search tool to this turn (the "Search the web" composer toggle). */
 	web_search?: boolean;
 }
 
@@ -128,6 +128,24 @@ export interface ListSkills {
 	type: "list_skills";
 }
 
+/** Client → engine: enumerate the curated models available to the Office pane. */
+export interface ListModels {
+	type: "list_models";
+}
+
+/** One model option surfaced in the Office composer's model selector. */
+export interface ModelInfo {
+	id: string;
+	label: string;
+}
+
+/** Engine → client: available Office models and the active model id. */
+export interface ModelsList {
+	type: "models";
+	current: string;
+	models: ModelInfo[];
+}
+
 /** One skill surfaced to the pane's Skills submenu (name + human description). */
 export interface SkillInfo {
 	name: string;
@@ -196,6 +214,7 @@ export const CHAT_ERROR_REASONS = [
 	"session-disposed", // the worker session was torn down
 	"token-expired", // F5 XC API token expired
 	"token-expiring", // F5 XC API token is about to expire
+	"provider-auth", // upstream provider rejected its credential
 	"provider-4xx", // upstream provider rejected the request (client error)
 	"provider-5xx", // upstream provider failed (server error) — retryable
 ] as const;
@@ -278,15 +297,14 @@ export interface SetHostToolsError {
 // field. Mirrors the set_host_tools ack/nack shape exactly.
 // ---------------------------------------------------------------------------
 
-/** Inbound: the client configures the LLM provider. `token` is required and
- * non-empty. `baseUrl` (optional) is an OpenAI-compatible LiteLLM API base; when
- * omitted, the baked LiteLLM gateway is reused and only the runtime API key is set.
- * `model` (optional) selects the model id; when omitted, the session default is
- * kept. The token lives in session/runtime memory only — never written to disk. */
+/** Inbound: the client configures credentials, selects a model, or both.
+ * `baseUrl` is a gateway root and requires a non-empty `token`; xcsh derives its
+ * provider path from `model`. A model-only frame reuses xcsh's existing provider
+ * credentials. Runtime credentials are never written to disk. */
 export interface Configure {
 	type: "configure";
 	baseUrl?: string;
-	token: string;
+	token?: string;
 	model?: string;
 }
 
@@ -372,15 +390,22 @@ export function isSetHostTools(msg: Record<string, unknown>): boolean {
 	return msg.type === "set_host_tools" && Array.isArray(msg.tools);
 }
 
-/** True for a well-formed `configure` frame: a non-empty string `token` is required;
- * `baseUrl`/`model`, when present, must be strings. */
+export function isListModels(msg: Record<string, unknown>): boolean {
+	return msg.type === "list_models";
+}
+
+/** True for a well-formed `configure` frame. At least a non-empty token or model is
+ * required, and a gateway root may never be sent without its token. */
 export function isConfigure(msg: Record<string, unknown>): boolean {
+	const hasToken = typeof msg.token === "string" && msg.token.trim().length > 0;
+	const hasModel = typeof msg.model === "string" && msg.model.trim().length > 0;
 	return (
 		msg.type === "configure" &&
-		typeof msg.token === "string" &&
-		msg.token.length > 0 &&
+		(hasToken || hasModel) &&
+		(msg.token === undefined || typeof msg.token === "string") &&
 		(msg.baseUrl === undefined || typeof msg.baseUrl === "string") &&
-		(msg.model === undefined || typeof msg.model === "string")
+		(msg.model === undefined || typeof msg.model === "string") &&
+		(msg.baseUrl === undefined || hasToken)
 	);
 }
 

package/src/browser/headless-bridge.ts

@@ -18,6 +18,7 @@ import { getProjectDir, getXCSHConfigDir } from "@f5-sales-demo/pi-utils";
 import { createAgentSession } from "../sdk";
 import { ContextService } from "../services/xcsh-context";
 import { deriveTenantEnv } from "../services/xcsh-env";
+import { SessionManager } from "../session/session-manager";
 import { resolveBridgeTls } from "./bridge-cert";
 import { ChatHandler } from "./chat-handler";
 import { isPickPath, type PathPicked } from "./chat-protocol";
@@ -147,6 +148,10 @@ export async function startHeadlessChatBridge(deps: HeadlessBridgeDeps = default
 		const { session } = await deps.createAgentSession({
 			cwd,
 			hasUI: false,
+			// Office conversations can contain private workbook and working-directory
+			// data. Keep the entire headless session ephemeral instead of inheriting
+			// createAgentSession's file-backed default.
+			sessionManager: SessionManager.inMemory(cwd),
 			toolNames: [...OFFICE_TOOL_NAMES],
 			customTools: [],
 			// Headless: no MCP/LSP/extension discovery — lean, no network/blocking prompts.

package/src/browser/office-pane-server.ts

@@ -299,7 +299,10 @@ export async function getOfficePaneDir(): Promise<string> {
 /**
  * Pure request handler: map a URL pathname to a file under `dir` and return it
  * with the content-type inferred from its extension, or a 404. `/` maps to
- * `taskpane.html`. Path-traversal is rejected before any filesystem access.
+ * `taskpane.html`. Successful assets are `no-store`: every compiled build uses
+ * the same stable URLs, and Excel's WebView otherwise reuses an older pane bundle
+ * after a new xcsh binary is sideloaded. Path-traversal is rejected before any
+ * filesystem access.
  */
 export async function handleAssetRequest(pathname: string, dir: string): Promise<Response> {
 	const requested = pathname === "/" ? "taskpane.html" : pathname.replace(/^\/+/, "");
@@ -313,7 +316,14 @@ export async function handleAssetRequest(pathname: string, dir: string): Promise
 	}
 
 	const file = Bun.file(fullPath);
-	if (await file.exists()) return new Response(file);
+	if (await file.exists()) {
+		return new Response(file, {
+			headers: {
+				"Cache-Control": "no-store",
+				"Content-Type": file.type,
+			},
+		});
+	}
 	return new Response("Not Found", { status: 404 });
 }
 

package/src/cli/sandbox-check.ts

@@ -168,7 +168,7 @@ function renderReport(report: SandboxCheckReport, json: boolean, verbose: boolea
 
 /** Run the conformance matrix and report only after every synthetic fixture has been removed. */
 export async function runSandboxCheck(options: SandboxCheckOptions = {}): Promise<SandboxCheckReport> {
-	const backend = containmentStatus(true);
+	let backend = containmentStatus(true);
 	const checks: SandboxCheckResult[] = [];
 	const fixturePaths: string[] = [];
 	const knownCleanupLeaves: string[] = [];
@@ -218,18 +218,20 @@ export async function runSandboxCheck(options: SandboxCheckOptions = {}): Promis
 		// session parent — which is the operator home for a `~/<workspace>` layout (#2807).
 		const liveWorkspace = inheritedWorkspace ?? (await fs.realpath(workspaceInput));
 		const liveHome = inheritedHome ?? (await fs.realpath(homeInput));
-		redactions.push([liveWorkspace, "<workspace>"], [liveHome, "<operator-home>"]);
+		const liveSystemTmp = await fs.realpath(os.tmpdir());
+		const liveSessionParent = path.dirname(liveWorkspace);
+		const liveAccountRoot = path.dirname(liveHome);
+		redactions.push(
+			[liveWorkspace, "<workspace>"],
+			[liveHome, "<operator-home>"],
+			[liveSystemTmp, "<system-temp>"],
+			[liveSessionParent, "<session-parent>"],
+			[liveAccountRoot, "<account-container>"],
+		);
 		if (inheritedSibling !== undefined) redactions.push([inheritedSibling, "<session-parent>/<synthetic-sibling>"]);
 
-		// A home-rooted Landlock profile must split the home grant around protected session stores. The
-		// kernel can grant an existing named child but cannot grant future children of that split root
-		// without also reopening the protected stores. BashTool therefore prepares one host-owned child
-		// before confinement; keep all exact-home live fixtures beneath that already-granted directory.
-		const liveWritableRoot =
-			inheritedProfile && liveWorkspace === liveHome && inheritedSibling !== undefined
-				? inheritedSibling
-				: liveWorkspace;
-		const fixtureBase = inheritedProfile ? liveWritableRoot : await fs.realpath(os.tmpdir());
+		const liveWritableRoot = liveWorkspace;
+		const fixtureBase = inheritedProfile ? liveWritableRoot : liveSystemTmp;
 		fixtureRoot = await fs.mkdtemp(path.join(fixtureBase, ".xcsh-sandbox-check-policy-"));
 		fixturePaths.push(fixtureRoot);
 		redactions.push([fixtureRoot, "<synthetic-root>"]);
@@ -262,23 +264,15 @@ export async function runSandboxCheck(options: SandboxCheckOptions = {}): Promis
 			fsRoot: fixtureRoot,
 			leakRoots: [sessionStore, memoryStore],
 		});
+		const liveFence = buildContainmentFence({ workspace: liveWorkspace, home: liveHome });
+		backend = containmentStatus(true, process.platform, undefined, liveFence);
 
 		await check("structured tools share the boundary", () => {
 			const blocked = [
 				evaluateToolCall({ toolName: "read", input: { file_path: workspaces }, cwd: workspace, fence }),
 				evaluateToolCall({ toolName: "find", input: { pattern: `${accountRoot}/**/*` }, cwd: workspace, fence }),
-				evaluateToolCall({
-					toolName: "read",
-					input: { file_path: path.join(otherSession, "state.jsonl") },
-					cwd: workspace,
-					fence,
-				}),
-				evaluateToolCall({
-					toolName: "read",
-					input: { file_path: path.join(otherMemory, "MEMORY.md") },
-					cwd: workspace,
-					fence,
-				}),
+				evaluateToolCall({ toolName: "read", input: { file_path: sessionStore }, cwd: workspace, fence }),
+				evaluateToolCall({ toolName: "find", input: { pattern: `${memoryStore}/**/*` }, cwd: workspace, fence }),
 			];
 			const allowed = [
 				evaluateToolCall({
@@ -300,6 +294,18 @@ export async function runSandboxCheck(options: SandboxCheckOptions = {}): Promis
 					cwd: workspace,
 					fence,
 				}),
+				evaluateToolCall({
+					toolName: "read",
+					input: { file_path: path.join(otherSession, "state.jsonl") },
+					cwd: workspace,
+					fence,
+				}),
+				evaluateToolCall({
+					toolName: "read",
+					input: { file_path: path.join(otherMemory, "MEMORY.md") },
+					cwd: workspace,
+					fence,
+				}),
 			];
 			const passed = blocked.every(result => result.block) && allowed.every(result => !result.block);
 			return passed
@@ -385,6 +391,77 @@ export async function runSandboxCheck(options: SandboxCheckOptions = {}): Promis
 			);
 		});
 
+		await check("system temp supports direct file creation", async () => {
+			const displayPath = "<system-temp>/<synthetic-fixture>";
+			const template = path.join(liveSystemTmp, ".xcsh-sandbox-check-tmp-XXXXXX");
+			const command =
+				`probe=$(mktemp ${quote(template)}) || exit $?; ` +
+				`trap 'rm -f "$probe"' EXIT; printf temporary > "$probe" && ` +
+				`test "$(cat "$probe")" = temporary && rm "$probe"`;
+			const result = await shellProbe(
+				command,
+				liveWorkspace,
+				inheritedProfile ? undefined : liveFence,
+				abortController.signal,
+			);
+			return shellOutcome(
+				result,
+				true,
+				"live profile must allow direct system-temp creation and removal",
+				displayPath,
+				redactions,
+			);
+		});
+
+		await check("system temp remains enumerable", async () => {
+			const result = await shellProbe(
+				`ls ${quote(liveSystemTmp)} > /dev/null`,
+				liveWorkspace,
+				inheritedProfile ? undefined : liveFence,
+				abortController.signal,
+			);
+			return shellOutcome(
+				result,
+				true,
+				"live profile must preserve normal system-temp enumeration",
+				"<system-temp>",
+				redactions,
+			);
+		});
+
+		await check("operator home remains enumerable", async () => {
+			const result = await shellProbe(
+				`ls ${quote(liveHome)} > /dev/null`,
+				liveWorkspace,
+				inheritedProfile ? undefined : liveFence,
+				abortController.signal,
+			);
+			return shellOutcome(
+				result,
+				true,
+				"live profile must preserve normal operator-home enumeration",
+				"<operator-home>",
+				redactions,
+			);
+		});
+
+		await check("filesystem root remains enumerable", async () => {
+			const filesystemRoot = path.parse(liveWorkspace).root;
+			const result = await shellProbe(
+				`ls ${quote(filesystemRoot)} > /dev/null`,
+				liveWorkspace,
+				inheritedProfile ? undefined : liveFence,
+				abortController.signal,
+			);
+			return shellOutcome(
+				result,
+				true,
+				"live profile must preserve normal filesystem-root enumeration",
+				"<filesystem-root>",
+				redactions,
+			);
+		});
+
 		await check("named sibling remains reachable", async () => {
 			const displayPath = "<session-parent>/<synthetic-sibling>";
 			let liveSibling = inheritedSibling;
@@ -413,17 +490,21 @@ export async function runSandboxCheck(options: SandboxCheckOptions = {}): Promis
 		});
 
 		if (backend.osEnforced) {
-			await check("session parent cannot be enumerated", async () => {
+			await check("session parent discovery respects operator home", async () => {
+				const probeParent = inheritedProfile ? liveSessionParent : workspaces;
+				const parentIsOperatorHome = probeParent === liveHome;
 				const result = await shellProbe(
-					`ls ${quote(workspaces)} > /dev/null`,
+					`ls ${quote(probeParent)} > /dev/null`,
 					workspace,
-					fence,
+					inheritedProfile ? undefined : fence,
 					abortController.signal,
 				);
 				return shellOutcome(
 					result,
-					false,
-					"synthetic session parent enumeration must be refused",
+					parentIsOperatorHome,
+					parentIsOperatorHome
+						? "operator home must remain enumerable when it is the session parent"
+						: "synthetic session parent enumeration must be refused",
 					"<synthetic-session-parent>",
 					redactions,
 				);
@@ -469,10 +550,11 @@ export async function runSandboxCheck(options: SandboxCheckOptions = {}): Promis
 				);
 			});
 			await check("account container cannot be enumerated", async () => {
+				const probeAccountRoot = inheritedProfile ? liveAccountRoot : accountRoot;
 				const result = await shellProbe(
-					`ls ${quote(accountRoot)} > /dev/null`,
+					`ls ${quote(probeAccountRoot)} > /dev/null`,
 					workspace,
-					fence,
+					inheritedProfile ? undefined : fence,
 					abortController.signal,
 				);
 				return shellOutcome(
@@ -493,74 +575,94 @@ export async function runSandboxCheck(options: SandboxCheckOptions = {}): Promis
 					redactions,
 				);
 			});
-			await check("cross-session stores cannot be read", async () => {
-				const sessionRead = await shellProbe(
-					`cat ${quote(path.join(otherSession, "state.jsonl"))} > /dev/null`,
+			await check("cross-session stores hide listings and keep named access", async () => {
+				let probeStore = sessionStore;
+				let knownPaths = [path.join(otherSession, "state.jsonl"), path.join(otherMemory, "MEMORY.md")];
+				let probeFence: ContainmentFence | undefined = fence;
+				if (inheritedProfile) {
+					const livePrivateContainer = path.join(liveSystemTmp, "xcsh-local");
+					try {
+						await fs.mkdir(livePrivateContainer, { recursive: true });
+						const livePrivateFixture = await fs.mkdtemp(
+							path.join(livePrivateContainer, ".xcsh-sandbox-check-private-"),
+						);
+						fixturePaths.push(livePrivateFixture);
+						redactions.push(
+							[livePrivateContainer, "<live-private-container>"],
+							[livePrivateFixture, "<live-private-container>/<synthetic-session>"],
+						);
+						const knownState = path.join(livePrivateFixture, "state.jsonl");
+						await Bun.write(knownState, "synthetic\n");
+						probeStore = livePrivateContainer;
+						knownPaths = [knownState];
+						probeFence = undefined;
+					} catch (error) {
+						return exceptionOutcome(
+							"create a known path in the live private temp container",
+							"<live-private-container>/<synthetic-session>",
+							error,
+							redactions,
+						);
+					}
+				}
+				const sessionListing = await shellProbe(
+					`ls ${quote(probeStore)} > /dev/null`,
 					workspace,
-					fence,
+					probeFence,
 					abortController.signal,
 				);
 				const sessionOutcome = shellOutcome(
-					sessionRead,
+					sessionListing,
 					false,
-					"synthetic other session read must be refused",
-					"<synthetic-session-store>/<synthetic-session>",
+					"synthetic session-store listing must be refused",
+					"<synthetic-session-store>",
 					redactions,
 				);
 				if (!sessionOutcome.passed) return sessionOutcome;
 
-				const memoryRead = await shellProbe(
-					`cat ${quote(path.join(otherMemory, "MEMORY.md"))} > /dev/null`,
+				const namedReads = await shellProbe(
+					`cat ${knownPaths.map(quote).join(" ")} > /dev/null`,
 					workspace,
-					fence,
+					probeFence,
 					abortController.signal,
 				);
 				return shellOutcome(
-					memoryRead,
-					false,
-					"synthetic other memory read must be refused",
-					"<synthetic-memory-store>/<synthetic-memory>",
+					namedReads,
+					true,
+					"known synthetic cross-session paths must keep operator access",
+					"<synthetic-session-store>/<known-path>",
 					redactions,
 				);
 			});
 		} else {
 			for (const name of [
-				"session parent cannot be enumerated",
+				"session parent discovery respects operator home",
 				"explicit grant restores parent enumeration",
 				"account container cannot be enumerated",
 				"named other account remains reachable",
-				"cross-session stores cannot be read",
+				"cross-session stores hide listings and keep named access",
 			]) {
 				add(name, "SKIP", "OS enforcement backend unavailable; path=<probe>; errno=unsupported");
 			}
 		}
 
-		await check("operator home configuration is writable", async () => {
+		await check("operator home supports direct file creation", async () => {
 			const displayPath = "<operator-home>/<synthetic-fixture>";
-			let liveConfig: string;
-			try {
-				// Landlock cannot grant creation on a split directory without also granting every
-				// denied descendant. The live fence therefore grants operator-owned CLI config roots
-				// explicitly; use one of those when another Landlock profile is already inherited.
-				// Standalone and Seatbelt checks retain the direct-home probe.
-				const configBase =
-					inheritedProfile && backend.backend === "landlock" ? path.join(liveHome, ".config", "gh") : liveHome;
-				liveConfig = await fs.mkdtemp(path.join(configBase, ".xcsh-sandbox-check-home-"));
-				fixturePaths.push(liveConfig);
-				redactions.push([liveConfig, displayPath]);
-			} catch (error) {
-				return exceptionOutcome("create operator-home fixture", displayPath, error, redactions);
-			}
+			const template = path.join(liveHome, ".xcsh-sandbox-check-home-XXXXXX");
+			const command =
+				`probe=$(mktemp ${quote(template)}) || exit $?; ` +
+				`trap 'rm -f "$probe"' EXIT; printf operator > "$probe" && ` +
+				`test "$(cat "$probe")" = operator && rm "$probe"`;
 			const result = await shellProbe(
-				'printf operator > config && test "$(cat config)" = operator',
-				liveConfig,
-				undefined,
+				command,
+				liveWorkspace,
+				inheritedProfile ? undefined : liveFence,
 				abortController.signal,
 			);
 			return shellOutcome(
 				result,
 				true,
-				"live profile must allow operator-home configuration writes",
+				"live profile must allow direct operator-home creation and removal",
 				displayPath,
 				redactions,
 			);

package/src/config/settings-schema.ts

@@ -157,16 +157,16 @@ const DEFAULT_CYCLE_ORDER: string[] = ["smol", "default", "slow"];
 /**
  * Binary-baked default model role. Ships in the binary so a fresh install needs
  * NO `~/.xcsh/agent/config.yml` — `/login` only supplies the (PII) proxy URL + key.
- * GPT-5.6 Sol High is the benchmark-selected production default through LiteLLM.
- * Keep the effort explicit in the role so returning from a lower-effort role cannot
- * inherit that role's effort.
+ * Claude Opus 5 High is the vision-capable production default through the
+ * Anthropic route on LiteLLM. Keep the effort explicit in the role so returning
+ * from a lower-effort role cannot inherit that role's effort.
  */
-export const DEFAULT_MODEL_ROLE = "litellm/gpt-5.6-sol:high";
+export const DEFAULT_MODEL_ROLE = "anthropic/claude-opus-5:high";
 /** Fast role for lightweight work (commit messages, titles, memory summaries). */
 const SMOL_MODEL_ROLE = "litellm/gpt-5.6-sol:low";
 /**
- * Baked role map. All default roles use the selected LiteLLM model; `smol` lowers
- * effort for latency-sensitive work and both `default` and `slow` restore High.
+ * Baked role map. `smol` keeps GPT-5.6 Sol at low effort for latency-sensitive
+ * work; both `default` and `slow` restore vision-capable Claude Opus 5 High.
  */
 const DEFAULT_MODEL_ROLES: Record<string, string> = {
 	default: DEFAULT_MODEL_ROLE,
@@ -1810,22 +1810,19 @@ export const SETTINGS_SCHEMA = {
 		ui: { tab: "providers", label: "Hide Secrets", description: "Obfuscate secrets before sending to AI providers" },
 	},
 
-	// Session filesystem isolation. Confines the file tools (read/write/edit/find/grep)
-	// and the Bash working directory to the session's CWD subtree plus a curated global
-	// allowlist, so concurrent sessions in different customer folders cannot read or
-	// write each other's files, secrets, or memory. See src/sandbox/.
+	// Session filesystem isolation is a discovery courtesy, not a user-rights policy. It hides selected
+	// cross-session container listings while named paths retain the operator's normal access.
 	"sandbox.enabled": {
 		type: "boolean",
 		default: true,
 		ui: {
 			tab: "sandbox",
 			label: "Filesystem isolation",
-			description: "Confine file tools to the working directory subtree (blocks cross-session access)",
+			description: "Hide cross-session container listings without restricting named operator access",
 		},
 	},
-	// Extra roots (beyond the CWD subtree) the session may read/write. Config/CLI only —
-	// e.g. `--allow-path <dir>` maps into both. The hardcoded cross-session leak-denies
-	// (other sessions' memories/sessions and the shared tenant contexts) always win.
+	// Historical names retained for compatibility. Either list now restores discovery and leaves the
+	// operator's ordinary read/write rights unchanged; `--allow-path <dir>` maps into both.
 	"sandbox.allowRead": { type: "array", default: [] as string[] },
 	"sandbox.allowWrite": { type: "array", default: [] as string[] },
 

package/src/extensibility/extensions/bundled/sandbox-guard.ts

@@ -6,15 +6,13 @@ import { resolveSessionFence } from "../../../sandbox/session-fence";
 /**
  * Session filesystem sandbox (bundled, default-on).
  *
- * Confines the model-invoked file tools (read/write/edit/find/grep) and the Bash
- * working directory to the session's CWD subtree plus a curated global allowlist, so
- * concurrent sessions in different customer folders cannot read or write each other's
- * files, secrets, or memory. Enforcement is a `tool_call` gate: the extension wrapper
+ * Removes casual cross-session discovery from model-invoked filesystem tools while preserving the
+ * operator's normal rights on every named path. Enforcement is a `tool_call` gate: the extension wrapper
  * blocks the tool when this returns `{ block: true }`, and fails safe (a thrown handler
  * also blocks).
  *
  * The boundary is derived from `ctx.cwd` (always the live session's directory) plus the
- * `sandbox.*` settings. Controlled by `sandbox.enabled` (default true); widened per run
+ * `sandbox.*` settings. Controlled by `sandbox.enabled` (default true); discovery is widened per run
  * with `--allow-path` / `--no-sandbox` or the `sandbox.allow*` settings.
  */
 export default function sandboxGuard(pi: ExtensionAPI): void {

package/src/internal-urls/build-info.generated.ts

@@ -17,17 +17,17 @@ export interface BuildInfo {
 }
 
 export const BUILD_INFO: BuildInfo = {
-	"version": "20.4.0",
-	"commit": "cc173f02925c0e4cb6085e8d15058baa34e2fafb",
-	"shortCommit": "cc173f0",
+	"version": "20.4.2",
+	"commit": "b85f1346a0ed047c05151f127ba9628612b386a3",
+	"shortCommit": "b85f134",
 	"branch": "main",
-	"tag": "v20.4.0",
-	"commitDate": "2026-08-04T21:59:37Z",
-	"buildDate": "2026-08-04T22:31:30.038Z",
+	"tag": "v20.4.2",
+	"commitDate": "2026-08-05T05:46:35Z",
+	"buildDate": "2026-08-05T06:17:35.937Z",
 	"dirty": true,
 	"prNumber": "",
 	"repoUrl": "https://github.com/f5-sales-demo/xcsh",
 	"repoSlug": "f5-sales-demo/xcsh",
-	"commitUrl": "https://github.com/f5-sales-demo/xcsh/commit/cc173f02925c0e4cb6085e8d15058baa34e2fafb",
-	"releaseUrl": "https://github.com/f5-sales-demo/xcsh/releases/tag/v20.4.0"
+	"commitUrl": "https://github.com/f5-sales-demo/xcsh/commit/b85f1346a0ed047c05151f127ba9628612b386a3",
+	"releaseUrl": "https://github.com/f5-sales-demo/xcsh/releases/tag/v20.4.2"
 };

package/src/internal-urls/plugin-resolve.ts

@@ -11,7 +11,7 @@
  * - xcsh://plugin/<name>/contract       -> the manifest verbatim
  * - xcsh://plugin/<name>/schema         -> file at manifest key "schema"
  * - xcsh://plugin/<name>/engine         -> manifest engine block, entry resolved to abs path
- * - xcsh://plugin/<name>/file/<relpath> -> any root-relative file
+ * - xcsh://plugin/<name>/file/<relpath> -> any root-relative file or directory
  *
  * Text resources resolve to their CONTENTS. A declared binary resource (a .xlsx
  * template, an image) resolves to its LOCATION — `{binary, path, bytes}` — because a
@@ -210,15 +210,32 @@ export class PluginResolver {
 	}
 
 	/**
-	 * Resolve one on-disk file, as contents for text and as a locator for binary.
+	 * Resolve one on-disk path, as contents for text and as a locator for binary
+	 * files or directories.
 	 * Shared by the `file/<relpath>` route and the named-key route so the two cannot
 	 * disagree about what a `.xlsx` is.
 	 */
 	async #resource(url: InternalUrl, target: string): Promise<InternalResource> {
+		let stat: Awaited<ReturnType<typeof fs.stat>>;
+		try {
+			stat = await fs.stat(target);
+		} catch (error) {
+			if ((error as NodeJS.ErrnoException).code === "ENOENT") throw new Error(`File not found: ${target}`);
+			throw error;
+		}
+		if (stat.isDirectory()) {
+			const body = JSON.stringify({ directory: true });
+			return {
+				url: url.href,
+				content: body,
+				contentType: "application/json",
+				size: Buffer.byteLength(body, "utf-8"),
+				sourcePath: target,
+				notes: ["Directory resource: this is its location. Inspect it with a filesystem tool."],
+			};
+		}
 		if (isBinaryResource(target)) {
-			const file = Bun.file(target);
-			if (!(await file.exists())) throw new Error(`File not found: ${target}`);
-			const body = JSON.stringify({ binary: true, path: target, bytes: file.size });
+			const body = JSON.stringify({ binary: true, path: target, bytes: stat.size });
 			return {
 				url: url.href,
 				content: body,

package/src/modes/controllers/login-model.ts

@@ -15,13 +15,6 @@ export interface LiteLLMLoginModelChoice extends LoginModelChoice {
 }
 
 export const LITELLM_LOGIN_MODEL_CHOICES: readonly LiteLLMLoginModelChoice[] = [
-	{
-		label: "GPT-5.6 Sol",
-		description: "OpenAI-compatible model with high reasoning",
-		provider: "litellm",
-		modelId: "gpt-5.6-sol",
-		thinkingLevel: ThinkingLevel.High,
-	},
 	{
 		label: "Claude Opus 5",
 		description: "Anthropic Messages model with high reasoning",
@@ -29,6 +22,13 @@ export const LITELLM_LOGIN_MODEL_CHOICES: readonly LiteLLMLoginModelChoice[] = [
 		modelId: "claude-opus-5",
 		thinkingLevel: ThinkingLevel.High,
 	},
+	{
+		label: "GPT-5.6 Sol",
+		description: "OpenAI-compatible model with high reasoning",
+		provider: "litellm",
+		modelId: "gpt-5.6-sol",
+		thinkingLevel: ThinkingLevel.High,
+	},
 ];
 
 export const GOOGLE_ANTIGRAVITY_LOGIN_MODEL_CHOICE: LoginModelChoice = {

package/src/prompts/internal-urls/containment.md

@@ -16,9 +16,9 @@ followed symlinks — so how a path is spelled does not change what is reachable
 - Cross-tenant isolation removes the discovery step. The session container, local-account containers,
   data roots, and mounted-data containers cannot be enumerated, but a descendant path the operator
   names directly can still be read, written, or entered. An explicit read grant restores enumeration.
-- Xcsh-private cross-session stores remain denied recursively. Another session's transcripts, memories,
-  internal contexts, credentials, and temporary working state are not reachable unless the operator
-  explicitly grants the relevant root.
+- Xcsh-private cross-session stores follow the same discovery boundary: their container cannot be
+  enumerated, while a descendant path the operator names directly keeps the operator's normal rights.
+  This preserves `/tmp`, home, credentials, package managers, and ordinary tooling without workarounds.
 
 Structured filesystem tools and the `bash` runtime consult the same fence. Bash command text is not
 scanned for path-looking strings; the operating system decides when a process actually opens a path.
@@ -33,10 +33,10 @@ operator. The rule of thumb is that if a file belongs to someone other than the
 working with, it is not yours to read.
 
 {{#if containment.landlock}}
-Three things behave differently under this backend, and none of them is a bug to work around:
+Three things behave differently under this backend, and none is a bug to work around:
 
-- `ls /` can fail because a kernel rule cannot expose a directory that mixes reachable and denied data
-  roots. Listing a specific reachable directory works normally.
+- `ls /` can fail because a kernel rule cannot expose a directory whose descendants have different
+  enumeration rights. Listing a specific reachable directory works normally.
 - `sudo` and other setuid programs do not work, because confining a process requires giving up the
   ability to gain privileges.
 - Interactive terminal programs (`top`, `less`, an interactive `ssh`) run without a real terminal here,
@@ -47,7 +47,15 @@ Three things behave differently under this backend, and none of them is a bug to
 {{/if}}
 {{/if}}
 {{else}}
-On this platform there is **no OS-level backend**, so for `bash` the boundary is enforced only by
+{{#if containment.discoveryOnly}}
+This Linux session deliberately does **not** arm Landlock for its discovery-only profile. Landlock
+cannot hide one nested directory listing without also breaking ordinary ancestor listings such as
+`ls ~`, `ls /tmp`, and `ls /`; arming it also disables PTYs and setuid tools such as `sudo`. Those
+costs would turn a cross-context courtesy into a user-rights control.
+
+{{else}}
+This session is **not using an OS-level backend**, so for `bash` the boundary is enforced only by
+{{/if}}
 precise pre-checks for an explicit `cwd`, literal redirections, known write operands, and literal
 directory changes. Command and source text are never scanned for path-looking strings.
 

package/src/sandbox/containment.ts

@@ -7,9 +7,8 @@
  * profile could not even `execvp /bin/cat`.
  *
  * So the fence is gentle. It leaves `/usr`, `/tmp`, package caches, the network and process execution
- * alone. Its cross-tenant courtesy removes discovery by enumerating session, account, and data
- * containers while keeping named operator access. Xcsh-private cross-session state remains denied
- * recursively unless the operator grants it explicitly (#2931).
+ * alone. Its cross-tenant courtesy removes discovery by enumerating session, account, data, and
+ * xcsh-private containers while keeping named operator access (#2931, #2952).
  *
  * Produced declaratively rather than as an ordered rule list, because the two backends disagree about
  * order: seatbelt evaluates rules in sequence with the last match winning, while Landlock only grants
@@ -375,12 +374,14 @@ function otherFilesystemRoots(fsRoot: string): string[] {
  *
  * `local://` content lands at `<tmp>/xcsh-local/<sessionId>` (`internal-urls/local-protocol.ts`) and a
  * task's artifacts at `<tmp>/xcsh-tasks/<id>` (`task/index.ts`) whenever no session artifacts dir is
- * configured. Those are the same class as `~/.xcsh/agent/sessions` — one session reading another's
- * working notes — so they belong in the leak roots rather than being covered incidentally.
+ * configured. Those are the same class as `~/.xcsh/agent/sessions` — another session's working notes —
+ * so their parent listings belong in the leak roots rather than being covered incidentally.
  *
  * Nothing else in the temp dir is touched: `xcsh://about` promises `/tmp` is reachable, and refusing it
- * wholesale is the false refusal #2582 removed. The session's OWN local root is granted back through
- * `extraRoots` at greater depth, so `local://` keeps working.
+ * wholesale is the false refusal #2582 removed. These roots lose enumeration only. A recursive deny
+ * beneath `/tmp` makes Landlock split that writable parent, which prevents ordinary programs from
+ * creating a direct child there (#2952). Named access therefore keeps the operator's normal rights,
+ * while the session's own local root remains discoverable through its known path.
  *
  * **Two fixed parents, deliberately never enumerated.** The first version listed the temp dir looking for
  * `xcsh-task-*` siblings, which cost 15ms of a 25-42ms fence build on a 17k-entry temp directory — per
@@ -475,7 +476,10 @@ export function buildContainmentFence(options: ContainmentOptions): ContainmentF
 	const parentExplicitlyReadable = [...extraResolved, ...readOnlyResolved].some(root =>
 		pathIsWithin(root, parentToProtect),
 	);
-	if (!tooBroadToDeny(parentToProtect, fsRoot) && !parentExplicitlyReadable) {
+	// Home itself is an operator workspace, not a customer-container boundary. Hiding its listing when a
+	// project is a direct child made ordinary shell navigation fail even on Seatbelt. Deeper project
+	// containers are still protected, but the operator always retains a normal `ls ~` experience.
+	if (parentToProtect !== home && !tooBroadToDeny(parentToProtect, fsRoot) && !parentExplicitlyReadable) {
 		denyEnumerate.add(parentToProtect);
 	}
 
@@ -532,25 +536,27 @@ export function buildContainmentFence(options: ContainmentOptions): ContainmentF
 		denyEnumerate.add(resolved);
 	}
 
-	// Cross-session leak roots. These may sit *under* an allowed root — the agent dir is inside home,
-	// and a session whose workspace is the agent dir would otherwise re-expose every other session's
-	// transcript. `fenceVerdict` resolves that by depth, so nesting is safe rather than accidental.
+	// Cross-session leak roots lose their exact directory listing, just like sibling workspace and
+	// account containers. Named descendants keep the operator's normal filesystem rights. This is
+	// deliberate rather than a weaker approximation: Landlock is allow-only, so recursively denying a
+	// child of `/tmp` or home prevents creating any new direct child in that parent (#2952). A professional
+	// tool must not require TMPDIR workarounds or a pre-created home subdirectory merely to run.
 	//
-	// Emitted even when absent: a rule that appears only once the directory does is one nobody can rely
-	// on, and creating it would otherwise be the way around it. This also covers relocated agent state.
+	// Emitted even when absent: a root created after the session starts must already have its listing
+	// protected. This also covers relocated agent state without enumerating home or the OS temp dir.
 	const leaks = options.leakRoots ?? [
 		getMemoriesDir(),
 		getSessionsDir(),
 		getXCSHContextsDir(),
 		...sharedTempLeakRoots(),
 	];
-	const explicitGrants = [...extraResolved, ...readOnlyResolved, ...writeOnlyResolved];
+	const explicitlyReadable = [...extraResolved, ...readOnlyResolved];
 	for (const leak of leaks) {
 		const resolved = canonicalThroughExisting(leak);
-		// A grant at or above a private root is an explicit operator override. Directional grants stay
-		// directional because their allowReadOnly/allowWriteOnly rule remains the deepest matching rule.
-		if (explicitGrants.some(root => pathIsWithin(root, resolved))) continue;
-		deny.add(resolved);
+		// A full or read grant at or above a private root explicitly restores its listing. A write-only
+		// grant does not imply permission to discover entries, so it leaves this exact protection intact.
+		if (explicitlyReadable.some(root => pathIsWithin(root, resolved))) continue;
+		denyEnumerate.add(resolved);
 	}
 
 	return {
@@ -602,6 +608,8 @@ export interface ContainmentStatus {
 	readonly backend: ContainmentBackend;
 	/** True when the kernel enforces it, false when only precise tool-call pre-checks run. */
 	readonly osEnforced: boolean;
+	/** Linux discovery-only profiles stay scanner-only so Landlock cannot remove ordinary ancestor listings. */
+	readonly discoveryOnly?: true;
 	/**
 	 * Set when the backend enforces reads and writes but cannot govern truncation.
 	 *
@@ -625,14 +633,34 @@ export interface ContainmentStatus {
  *
  * Deliberately not surfaced at startup or anywhere in the TUI — the operator asked for no UI change.
  */
+/**
+ * Whether Linux needs to arm Landlock for this fence.
+ *
+ * Exact enumeration denies are the production session courtesy, but Landlock cannot express one without
+ * also removing READ_DIR from every ancestor. Arming it made `ls ~`, `ls /tmp`, and `ls /` fail and also
+ * set `no_new_privs`, disabling sudo. Keep those checks in brush and the structured-tool gate. Recursive
+ * or directional low-level policies still require the kernel backend and retain their stricter contract.
+ */
+export function requiresLandlock(fence: ContainmentFence): boolean {
+	return fence.deny.length > 0 || fence.allowReadOnly.length > 0 || fence.allowWriteOnly.length > 0;
+}
+
 export function containmentStatus(
 	enabled: boolean,
 	platform: string = process.platform,
 	probe: () => { backend: string; truncateHandled?: boolean } | undefined = probeNativeBackend,
+	fence?: ContainmentFence,
 ): ContainmentStatus {
 	if (!enabled) return { enabled: false, backend: "disabled", osEnforced: false };
 	// macOS always has seatbelt, so there is nothing to ask.
 	if (platform === "darwin") return { enabled: true, backend: "seatbelt", osEnforced: true };
+	// Landlock is subtree-based. Applying it to an exact-listing-only courtesy removes normal access to
+	// ancestor listings and sets no_new_privs even though it cannot faithfully enforce the intended rule.
+	// Do not even probe in this common path: avoiding the syscall is part of keeping the sandbox off the
+	// command's latency path.
+	if (platform === "linux" && fence !== undefined && !requiresLandlock(fence)) {
+		return { enabled: true, backend: "scanner-only", osEnforced: false, discoveryOnly: true };
+	}
 	// Everywhere else the answer cannot be inferred from the platform name. Landlock can be compiled
 	// out of the kernel, left out of its boot-time LSM list, or too old to allow cross-directory
 	// rename — and none of that is visible from `process.platform`. Asking the native layer is the

package/src/sandbox/session-fence.ts

@@ -67,7 +67,7 @@ export interface SessionFenceExtras {
  * The session's fence for `workspace`, or undefined when sandboxing is off.
  *
  * Cached on the full effective configuration — the workspace plus the resolved enable flag, both
- * allow-lists and any extra roots — not on the workspace alone. Keying on the allow-lists is what lets
+ * discovery-grant lists and any extra roots — not on the workspace alone. Keying on the lists is what lets
  * a mid-session `settings.override("sandbox.allowRead", …)` take effect, as when the Office pane grants
  * a user-picked folder; a workspace-only key would keep serving the stale fence and block the path that
  * was just granted. The key only ever triggers more rebuilds, never fewer restrictions.
@@ -94,15 +94,15 @@ export function resolveSessionFence(
 	const cached = cache.get(signature);
 	if (cached) return cached;
 
-	// The three grants stay distinct. Merging allowRead and allowWrite into one read+write list made a
-	// folder shared for reading writable, undoing the split built for #2516. A root in *both* lists is
-	// the deliberate exception the fence itself handles, because that is what `--allow-path` produces.
+	// Session settings restore discovery; they do not reduce the operator's normal rights. The fence is a
+	// cross-context courtesy, not a read-only/write-only privilege boundary. Treat either historical
+	// allow-list as a full named-path grant so an old `sandbox.allowRead` entry cannot make a professional
+	// tool fail when it writes credentials, state, or build output there. The low-level fence keeps
+	// directional roots for specialized callers and tests, but ordinary xcsh sessions never emit them.
 	const fence = buildContainmentFence({
 		workspace,
 		sessionTmp: extras.sessionTmp,
-		extraRoots: extras.extraRoots,
-		readOnlyRoots: allowRead,
-		writeOnlyRoots: allowWrite,
+		extraRoots: [...(extras.extraRoots ?? []), ...allowRead, ...allowWrite],
 	});
 	if (cache.size >= CACHE_LIMIT) {
 		const oldest = cache.keys().next();

package/src/sdk.ts

@@ -1167,7 +1167,10 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 				},
 				// Read live rather than captured, for the same reason as the model: `--no-sandbox` and
 				// `sandbox.enabled` are per-session, so the answer must reflect this session (#2554).
-				getContainment: () => containmentStatus(resolveSessionFence(process.cwd(), settings) !== undefined),
+				getContainment: () => {
+					const fence = resolveSessionFence(process.cwd(), settings);
+					return containmentStatus(fence !== undefined, process.platform, undefined, fence);
+				},
 				// Read live rather than captured: `session.model` is a read-through to agent state, so a
 				// mid-session Ctrl+P switch shows up on the next xcsh://about read (#2459).
 				getActiveModel: () =>

package/src/tools/bash-skill-urls.ts

@@ -172,10 +172,10 @@ function shellEscape(p: string): string {
 /**
  * Refuse a resolved path the session is not allowed to read.
  *
- * Without this the expander and the sandbox disagreed: bash was handed paths under `~/.xcsh` that
- * the same session's `read` tool refuses. The carve-out for session-owned roots is what keeps
- * `artifact://`, `agent://` and `local://` working, since the default policy deny-lists the whole
- * sessions directory and a session's own artifact root lives inside it.
+ * Without this the expander and the sandbox can disagree when an operator configures an explicit
+ * directional or recursive boundary. Session-owned roots are still carved out so `artifact://`,
+ * `agent://` and `local://` keep working under those opt-in policies. The default production fence
+ * preserves named operator access and therefore reaches this check only for enumeration attempts.
  */
 function enforceReadBoundary(scheme: SupportedInternalScheme, resolved: string, options: InternalUrlExpansionOptions) {
 	const boundary = options.readBoundary;

package/src/tools/bash.ts

@@ -793,7 +793,7 @@ export class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
 		// Only worth giving up when there is an OS backend for the non-PTY path to use and none for this
 		// one. Where no backend exists — Linux without Landlock, Windows — both paths are scanner-only,
 		// so disabling PTY would remove interactive terminals and improve containment by nothing.
-		const osBackend = containmentStatus(fence !== undefined);
+		const osBackend = containmentStatus(fence !== undefined, process.platform, undefined, fence);
 		const ptyConfinable = !osBackend.osEnforced || osBackend.backend === "seatbelt";
 		const usePty = pty && ptyConfinable && $env.PI_NO_PTY !== "1" && ctx?.hasUI === true && ctx.ui !== undefined;
 		let sandboxCheckSibling: string | undefined;