@f5-sales-demo/xcsh 20.4.5 → 20.4.6

package/CHANGELOG.md

@@ -16,6 +16,8 @@
 
 - Prevalidated manifest batches before mutation, preserved strict create and update semantics, rejected unsupported server dry-run, and returned automation-grade exit codes for resource operations ([#2930](https://github.com/f5-sales-demo/xcsh/issues/2930))
 - Prevented sandbox false refusals from path-like Bash and Python source text while limiting account and data containers to discovery protection and preserving xcsh-private runtime isolation ([#2931](https://github.com/f5-sales-demo/xcsh/issues/2931))
+- Validated matching chat-completion POST routes during LiteLLM discovery so Open WebUI model-management endpoints cannot be mistaken for inference endpoints ([#2996](https://github.com/f5-sales-demo/xcsh/issues/2996))
+- Returned non-zero status from headless text and JSON sessions when the model turn fails or is aborted, while disposing each session exactly once ([#2996](https://github.com/f5-sales-demo/xcsh/issues/2996))
 
 ## [20.3.0] - 2026-08-04
 

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@f5-sales-demo/xcsh",
-	"version": "20.4.5",
+	"version": "20.4.6",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://github.com/f5-sales-demo/xcsh",
 	"author": "Can Boluk",
@@ -60,13 +60,13 @@
 	"dependencies": {
 		"@agentclientprotocol/sdk": "1.3.0",
 		"@mozilla/readability": "^0.6",
-		"@f5-sales-demo/xcsh-stats": "20.4.5",
-		"@f5-sales-demo/pi-agent-core": "20.4.5",
-		"@f5-sales-demo/pi-ai": "20.4.5",
-		"@f5-sales-demo/pi-natives": "20.4.5",
-		"@f5-sales-demo/pi-resource-management": "20.4.5",
-		"@f5-sales-demo/pi-tui": "20.4.5",
-		"@f5-sales-demo/pi-utils": "20.4.5",
+		"@f5-sales-demo/xcsh-stats": "20.4.6",
+		"@f5-sales-demo/pi-agent-core": "20.4.6",
+		"@f5-sales-demo/pi-ai": "20.4.6",
+		"@f5-sales-demo/pi-natives": "20.4.6",
+		"@f5-sales-demo/pi-resource-management": "20.4.6",
+		"@f5-sales-demo/pi-tui": "20.4.6",
+		"@f5-sales-demo/pi-utils": "20.4.6",
 		"@sinclair/typebox": "^0.34",
 		"@xterm/headless": "^6.0",
 		"ajv": "^8.20",

package/src/cli/args.ts

@@ -8,6 +8,7 @@ import { parseEffort } from "../thinking";
 import {
 	flagNameForChar,
 	flagSpec,
+	LAUNCH_FLAGS,
 	type LaunchFlagName,
 	normalizeFlagTokens,
 	takesValue,
@@ -19,9 +20,9 @@ export type Mode = "text" | "json" | "rpc" | "acp";
 export interface Args {
 	cwd?: string;
 	allowHome?: boolean;
-	/** Disable the session filesystem sandbox (widen to unrestricted access). */
+	/** Disable the session filesystem discovery guard; OS-user permissions are unchanged. */
 	noSandbox?: boolean;
-	/** Extra directories the session may read AND write, beyond its CWD subtree (repeatable). */
+	/** Extra directories whose entries the session may discover (repeatable). */
 	allowPath?: string[];
 	provider?: string;
 	context?: string;
@@ -375,8 +376,8 @@ ${chalk.bold("Available Tools (default-enabled unless noted):")}
   ask           - Ask user questions (interactive mode only)
 
 ${chalk.bold("Sandbox Options:")}
-  --no-sandbox               Disable session filesystem isolation (allow access outside the CWD)
-  --allow-path <path>        Grant read+write access to an extra directory (repeatable)
+  --no-sandbox               ${LAUNCH_FLAGS["no-sandbox"].description}
+  --allow-path <path>        ${LAUNCH_FLAGS["allow-path"].description}
 
 ${chalk.bold("Plugin Options:")}
   --plugin-dir <path>        Load plugin from directory (repeatable)

package/src/cli/flag-spec.ts

@@ -53,11 +53,11 @@ export const LAUNCH_FLAGS = defineFlags({
 	"allow-home": { arity: "boolean", description: "Allow starting in ~ without auto-switching to a temp dir" },
 	"no-sandbox": {
 		arity: "boolean",
-		description: "Disable session filesystem isolation (allow access outside the CWD)",
+		description: "Disable the session filesystem discovery guard",
 	},
 	"allow-path": {
 		arity: "repeatable-value",
-		description: "Grant read+write access to an extra directory (repeatable)",
+		description: "Allow directory discovery at an additional path (repeatable)",
 	},
 	mode: {
 		arity: "value",

package/src/config/auto-config.ts

@@ -312,14 +312,25 @@ export interface ProbeResult {
 	apiBasePath?: string;
 }
 
-/** Candidate paths to probe for the models endpoint (tried in order). */
-const MODELS_ENDPOINT_PATHS = ["/v1/models", "/api/v1/models"];
+/** Candidate OpenAI-compatible API base paths, tried in order. */
+const API_BASE_PATHS = ["/v1", "/api", "/api/v1"];
+
+/**
+ * A route probe deliberately omits the required model and messages. OpenAI-compatible
+ * servers reject that payload before inference with 400 or 422. A 2xx response is also
+ * accepted for permissive proxies; 404/405 and server/auth failures reject the route.
+ */
+function acceptsChatCompletionPost(status: number): boolean {
+	return (status >= 200 && status < 300) || status === 400 || status === 422;
+}
 
 /**
  * Probe a LiteLLM proxy to validate connectivity and discover available models.
  *
- * Tries multiple endpoint paths in order (/v1/models, then /api/v1/models) to
- * handle deployments where a frontend like Open WebUI intercepts /v1/*.
+ * A models GET alone is not enough: Open WebUI also exposes management endpoints such
+ * as /api/v1/models that do not share an inference route. Each candidate must return an
+ * OpenAI-shaped model catalog and accept POST at the matching /chat/completions path.
+ * The POST carries an empty JSON object, so validation happens before model inference.
  *
  * Returns the list of model IDs on success, or an error on failure.
  * Uses a 3-second timeout per endpoint to avoid blocking startup.
@@ -333,11 +344,11 @@ export async function probeLiteLLMConnection(
 	const normalizedUrl = baseUrl.replace(/\/+$/, "");
 	let lastError = "";
 
-	for (const endpointPath of MODELS_ENDPOINT_PATHS) {
-		const url = `${normalizedUrl}${endpointPath}`;
+	for (const apiBasePath of API_BASE_PATHS) {
+		const modelsUrl = `${normalizedUrl}${apiBasePath}/models`;
 		let response: Response;
 		try {
-			response = await fetchImpl(url, {
+			response = await fetchImpl(modelsUrl, {
 				method: "GET",
 				headers: {
 					Accept: "application/json",
@@ -351,7 +362,7 @@ export async function probeLiteLLMConnection(
 		}
 
 		if (!response.ok) {
-			lastError = `HTTP ${response.status} ${response.statusText} from ${url}`;
+			lastError = `HTTP ${response.status} ${response.statusText} from ${modelsUrl}`;
 			continue;
 		}
 
@@ -359,7 +370,7 @@ export async function probeLiteLLMConnection(
 		try {
 			payload = await response.json();
 		} catch {
-			lastError = `Non-JSON response from ${url}`;
+			lastError = `Non-JSON response from ${modelsUrl}`;
 			continue;
 		}
 
@@ -378,13 +389,35 @@ export async function probeLiteLLMConnection(
 			}
 		}
 
-		if (models.length > 0) {
-			// Derive the API base path from the endpoint that worked
-			const apiBasePath = endpointPath.replace(/\/models$/, "");
-			return { reachable: true, models, apiBasePath };
+		if (models.length === 0) {
+			lastError = `No models in response from ${modelsUrl}`;
+			continue;
+		}
+
+		const chatUrl = `${normalizedUrl}${apiBasePath}/chat/completions`;
+		let chatResponse: Response;
+		try {
+			chatResponse = await fetchImpl(chatUrl, {
+				method: "POST",
+				headers: {
+					Accept: "application/json",
+					Authorization: `Bearer ${apiKey}`,
+					"Content-Type": "application/json",
+				},
+				body: "{}",
+				signal: options?.signal ?? AbortSignal.timeout(3000),
+			});
+		} catch (err) {
+			lastError = err instanceof Error ? err.message : String(err);
+			continue;
+		}
+		await chatResponse.body?.cancel();
+		if (!acceptsChatCompletionPost(chatResponse.status)) {
+			lastError = `HTTP ${chatResponse.status} ${chatResponse.statusText} from ${chatUrl}`;
+			continue;
 		}
 
-		lastError = `No models in response from ${url}`;
+		return { reachable: true, models, apiBasePath };
 	}
 
 	return { reachable: false, models: [], error: lastError };

package/src/internal-urls/build-info.generated.ts

@@ -17,17 +17,17 @@ export interface BuildInfo {
 }
 
 export const BUILD_INFO: BuildInfo = {
-	"version": "20.4.5",
-	"commit": "0ccf19916f316fb84d06bd9a5a9ab36bd67d8759",
-	"shortCommit": "0ccf199",
+	"version": "20.4.6",
+	"commit": "ef5e9295b8874494b812b1cc3c04aff523bd679e",
+	"shortCommit": "ef5e929",
 	"branch": "main",
-	"tag": "v20.4.5",
-	"commitDate": "2026-08-05T09:48:31Z",
-	"buildDate": "2026-08-05T10:16:36.684Z",
+	"tag": "v20.4.6",
+	"commitDate": "2026-08-05T18:21:54Z",
+	"buildDate": "2026-08-05T18:50:12.864Z",
 	"dirty": true,
 	"prNumber": "",
 	"repoUrl": "https://github.com/f5-sales-demo/xcsh",
 	"repoSlug": "f5-sales-demo/xcsh",
-	"commitUrl": "https://github.com/f5-sales-demo/xcsh/commit/0ccf19916f316fb84d06bd9a5a9ab36bd67d8759",
-	"releaseUrl": "https://github.com/f5-sales-demo/xcsh/releases/tag/v20.4.5"
+	"commitUrl": "https://github.com/f5-sales-demo/xcsh/commit/ef5e9295b8874494b812b1cc3c04aff523bd679e",
+	"releaseUrl": "https://github.com/f5-sales-demo/xcsh/releases/tag/v20.4.6"
 };

package/src/internal-urls/console-catalog.generated.ts

@@ -2,10 +2,10 @@
 
 import type { ConsoleCatalogData } from "./console-catalog-types";
 
-export const CONSOLE_CATALOG_VERSION = "ff8ed12d3f91d2ba0b3970c6fc7105fc75d7952d";
+export const CONSOLE_CATALOG_VERSION = "5f41f84da613e409e89dd37fd5380a181cce95aa";
 
 export const CONSOLE_CATALOG_DATA: ConsoleCatalogData = {
-	version: "ff8ed12d3f91d2ba0b3970c6fc7105fc75d7952d",
+	version: "5f41f84da613e409e89dd37fd5380a181cce95aa",
 	workflows: {
 		"address-allocator/create":
 			'---\nschema: urn:xcsh:console:workflow:v1\nid: address-allocator-create\nlabel: Create IP Address Allocators\nresource: address-allocator\noperation: create\npreconditions:\n  - user_logged_in\n  - "role_minimum: admin"\nparams:\n  name:\n    required: true\n    description: IP Address Allocators name (lowercase alphanumeric and hyphens)\n    example: example-address-allocator\n  address_allocator_mode:\n    required: true\n    description: Address Allocator Mode\n  allocation_unit:\n    required: false\n    description: Allocation Unit\n    default: 0\n  address_pool:\n    required: false\n    description: Address Pool\n    default: value\n  address_allocation_scheme:\n    required: false\n    description: "Server-required: Field should be not nil"\n    default: value\nsteps:\n  - id: navigate-to-list\n    action: navigate\n    url: /web/workspaces/multi-cloud-network-connect/manage/networking/legacy_network_configuration/address_allocators\n    wait_for: text(\'IP Address Allocators\')\n    description: Navigate to IP Address Allocators list page\n  - id: click-add-tab\n    action: click\n    selector: text(\'Add IP Address Allocator\')\n    wait_for: textbox[name=\'Name\']\n    description: Click Add IP Address Allocator to open the create form\n  - id: fill-name\n    action: fill\n    selector: textbox[name=\'Name\']\n    value: "{name}"\n    description: Enter Name\n  - id: select-address_allocator_mode\n    action: select\n    selector: listbox\n    context: Address Allocator Mode section\n    value: "{address_allocator_mode}"\n    description: Select Address Allocator Mode\n  - id: fill-allocation_unit\n    action: fill\n    selector: spinbutton[name=\'Allocation Unit\']\n    value: "{allocation_unit}"\n    description: Set Allocation Unit\n  - id: fill-address_pool\n    action: fill\n    selector: ngx-datatable input.form-control\n    context: Address Pool table\n    value: "{address_pool}"\n    description: Enter Address Pool in the existing table row (no Add Item needed — the table ships one empty row)\n  - id: select-address_allocation_scheme\n    action: select\n    selector: listbox\n    context: Address Allocation Scheme section\n    value: "{address_allocation_scheme}"\n    description: Select Address Allocation Scheme\n  - id: save\n    action: click\n    selector: "[class*=\'save-bt\'],[class*=\'submit-button\']"\n    context: footer\n    wait_for: text(\'{name}\')\n    wait_timeout_ms: 30000\n    description: Save/submit the form (union selector matches save-bt OR submit-button)\npostconditions:\n  - resource_list_page_visible\n  - "resource_name_in_list: {name}"\nmetadata:\n  confidence: inferred\n  discovered_at: 2026-06-24\n  console_version: "2025.06"\n  notes: Auto-generated by scripts/generate-workflows.ts from api-specs-enriched field metadata.\n',