@f5-sales-demo/xcsh 20.5.0 → 20.6.0

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@f5-sales-demo/xcsh",
-	"version": "20.5.0",
+	"version": "20.6.0",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://github.com/f5-sales-demo/xcsh",
 	"author": "Can Boluk",
@@ -44,6 +44,7 @@
 		"fmt": "biome format --write . && bun run format-prompts",
 		"format-prompts": "bun scripts/format-prompts.ts",
 		"mermaid:gallery": "bun scripts/mermaid-gallery.ts",
+		"uat:auth-profiles": "bun scripts/auth-profile-rpc-uat.ts",
 		"generate-docs-index": "bun scripts/generate-docs-index.ts",
 		"generate-api-spec-index": "bun scripts/generate-api-spec-index.ts",
 		"generate-branding-index": "bun scripts/generate-branding-index.ts",
@@ -60,13 +61,13 @@
 	"dependencies": {
 		"@agentclientprotocol/sdk": "1.3.0",
 		"@mozilla/readability": "^0.6",
-		"@f5-sales-demo/xcsh-stats": "20.5.0",
-		"@f5-sales-demo/pi-agent-core": "20.5.0",
-		"@f5-sales-demo/pi-ai": "20.5.0",
-		"@f5-sales-demo/pi-natives": "20.5.0",
-		"@f5-sales-demo/pi-resource-management": "20.5.0",
-		"@f5-sales-demo/pi-tui": "20.5.0",
-		"@f5-sales-demo/pi-utils": "20.5.0",
+		"@f5-sales-demo/xcsh-stats": "20.6.0",
+		"@f5-sales-demo/pi-agent-core": "20.6.0",
+		"@f5-sales-demo/pi-ai": "20.6.0",
+		"@f5-sales-demo/pi-natives": "20.6.0",
+		"@f5-sales-demo/pi-resource-management": "20.6.0",
+		"@f5-sales-demo/pi-tui": "20.6.0",
+		"@f5-sales-demo/pi-utils": "20.6.0",
 		"@sinclair/typebox": "^0.34",
 		"@xterm/headless": "^6.0",
 		"ajv": "^8.20",

package/src/browser/chat-handler.ts

@@ -436,10 +436,10 @@ export class ChatHandler {
 			if (!defaultModel) {
 				throw new Error("Invalid baked default model selector");
 			}
-			const currentChoice = LITELLM_LOGIN_MODEL_CHOICES.find(
-				choice => choice.provider === this.#session.model?.provider && choice.modelId === this.#session.model.id,
-			);
-			const modelId = msg.model ?? currentChoice?.modelId ?? defaultModel.id;
+			// An omitted model means the baked Office default, never whichever model a
+			// previous CLI/global session happened to leave active. An explicit pane
+			// selection still wins through msg.model.
+			const modelId = msg.model ?? defaultModel.id;
 			const choice = LITELLM_LOGIN_MODEL_CHOICES.find(candidate => candidate.modelId === modelId);
 			const matchingProviders = (["anthropic", "litellm"] as const).filter(candidate =>
 				registry.find(candidate, modelId),

package/src/browser/headless-bridge.ts

@@ -15,6 +15,8 @@
  * NOT browser-safe (node/bun): runs inside the full xcsh binary, never the pane.
  */
 import { getProjectDir, getXCSHConfigDir } from "@f5-sales-demo/pi-utils";
+import { parseModelString } from "../config/model-resolver";
+import { DEFAULT_MODEL_ROLE } from "../config/settings-schema";
 import { createAgentSession } from "../sdk";
 import { ContextService } from "../services/xcsh-context";
 import { deriveTenantEnv } from "../services/xcsh-env";
@@ -141,6 +143,10 @@ export async function startHeadlessChatBridge(deps: HeadlessBridgeDeps = default
 	// selectProvider() reuses a dead bridge. The caller (startOfficeServe) treats
 	// the rethrow as a non-fatal "pane only" fallback.
 	try {
+		const officeDefault = parseModelString(DEFAULT_MODEL_ROLE);
+		if (!officeDefault) {
+			throw new Error("Invalid baked Office default model selector");
+		}
 		// Create ONE headless Office session with the full CLI-parity builtin set
 		// (OFFICE_TOOL_NAMES: bash/read/write/edit/grep/inspect_image/… — NO browser tools, which
 		// would be hallucinated in a document task pane). The document's own tools
@@ -148,6 +154,11 @@ export async function startHeadlessChatBridge(deps: HeadlessBridgeDeps = default
 		const { session } = await deps.createAgentSession({
 			cwd,
 			hasUI: false,
+			// Office must open on the production GPT profile regardless of a stale
+			// global/default role or resumable session. A saved pane model is applied
+			// afterward by its explicit configure frame and remains authoritative.
+			modelPattern: DEFAULT_MODEL_ROLE,
+			thinkingLevel: officeDefault.thinkingLevel,
 			// Office conversations can contain private workbook and working-directory
 			// data. Keep the entire headless session ephemeral instead of inheriting
 			// createAgentSession's file-backed default.

package/src/internal-urls/build-info.generated.ts

@@ -17,17 +17,17 @@ export interface BuildInfo {
 }
 
 export const BUILD_INFO: BuildInfo = {
-	"version": "20.5.0",
-	"commit": "ca0d2541571e7aec828108afcdad8cf197881e04",
-	"shortCommit": "ca0d254",
+	"version": "20.6.0",
+	"commit": "fda51f1e37f9202c495558b6e33c0067e822967e",
+	"shortCommit": "fda51f1",
 	"branch": "main",
-	"tag": "v20.5.0",
-	"commitDate": "2026-08-05T19:40:57Z",
-	"buildDate": "2026-08-05T20:07:18.925Z",
+	"tag": "v20.6.0",
+	"commitDate": "2026-08-06T11:20:36Z",
+	"buildDate": "2026-08-06T11:58:39.606Z",
 	"dirty": true,
 	"prNumber": "",
 	"repoUrl": "https://github.com/f5-sales-demo/xcsh",
 	"repoSlug": "f5-sales-demo/xcsh",
-	"commitUrl": "https://github.com/f5-sales-demo/xcsh/commit/ca0d2541571e7aec828108afcdad8cf197881e04",
-	"releaseUrl": "https://github.com/f5-sales-demo/xcsh/releases/tag/v20.5.0"
+	"commitUrl": "https://github.com/f5-sales-demo/xcsh/commit/fda51f1e37f9202c495558b6e33c0067e822967e",
+	"releaseUrl": "https://github.com/f5-sales-demo/xcsh/releases/tag/v20.6.0"
 };

package/src/internal-urls/terraform-index.generated.ts

@@ -116,7 +116,7 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 			name: "Sites",
 			slug: "sites",
 			description: "AWS/Azure/GCP VPC sites, SecureMesh, VoltStack, and site mesh groups",
-			resource_count: 12,
+			resource_count: 11,
 			resources: [
 				"aws_tgw_site",
 				"aws_vpc_site",
@@ -126,7 +126,6 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 				"registration",
 				"securemesh_site",
 				"securemesh_site_v2",
-				"site",
 				"site_mesh_group",
 				"virtual_site",
 				"voltstack_site",
@@ -148,22 +147,6 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 				"workload_flavor",
 			],
 		},
-		{
-			name: "Uncategorized",
-			slug: "uncategorized",
-			description: "Resources pending categorization",
-			resource_count: 8,
-			resources: [
-				"application_profiles",
-				"authorization_server",
-				"bot_infrastructure",
-				"domain",
-				"mitigated_domain",
-				"protected_application",
-				"protected_domain",
-				"registration_approval",
-			],
-		},
 		{
 			name: "DNS",
 			slug: "dns",
@@ -179,6 +162,21 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 				"dns_zone",
 			],
 		},
+		{
+			name: "Uncategorized",
+			slug: "uncategorized",
+			description: "Resources pending categorization",
+			resource_count: 7,
+			resources: [
+				"application_profiles",
+				"authorization_server",
+				"bot_infrastructure",
+				"mitigated_domain",
+				"protected_application",
+				"protected_domain",
+				"registration_approval",
+			],
+		},
 		{
 			name: "API Security",
 			slug: "api-security",
@@ -1358,20 +1356,6 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 			},
 			import_syntax: "terraform import xcsh_securemesh_site_v2.example namespace/name",
 		},
-		{
-			name: "site",
-			category: "sites",
-			description: "Virtual site object in given namespace",
-			required: ["name", "namespace", "site_type"],
-			minimal_config: {
-				format: "terraform",
-				source: "_llms-txt/resources/site.txt#minimal-valid-config",
-			},
-			dependencies: {
-				requires: [],
-			},
-			import_syntax: "terraform import xcsh_site.example namespace/name",
-		},
 		{
 			name: "site_mesh_group",
 			category: "sites",
@@ -1539,215 +1523,201 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 			import_syntax: "terraform import xcsh_workload_flavor.example namespace/name",
 		},
 		{
-			name: "application_profiles",
-			category: "uncategorized",
-			description: "Application Profiles in a given namespace. If one already exists it will give an error",
+			name: "dns_compliance_checks",
+			category: "dns",
+			description:
+				"DNS Compliance Checks Specification in a given namespace. If one already exists it will give an error",
 			required: ["name", "namespace"],
 			minimal_config: {
 				format: "terraform",
-				source: "_llms-txt/resources/application_profiles.txt#minimal-valid-config",
+				source: "_llms-txt/resources/dns_compliance_checks.txt#minimal-valid-config",
 			},
 			dependencies: {
 				requires: [],
 			},
-			import_syntax: "terraform import xcsh_application_profiles.example namespace/name",
+			import_syntax: "terraform import xcsh_dns_compliance_checks.example namespace/name",
 		},
 		{
-			name: "authorization_server",
-			category: "uncategorized",
-			description: "Authorization_server creates a new object in the storage backend for metadata.namespace",
-			required: ["name", "namespace", "jwks_uri"],
+			name: "dns_domain",
+			category: "dns",
+			description: "DNS Domain in a given namespace. If one already exist it will give a error",
+			required: ["name", "dnssec_mode"],
 			minimal_config: {
 				format: "terraform",
-				source: "_llms-txt/resources/authorization_server.txt#minimal-valid-config",
+				source: "_llms-txt/resources/dns_domain.txt#minimal-valid-config",
 			},
 			dependencies: {
 				requires: [],
 			},
-			import_syntax: "terraform import xcsh_authorization_server.example namespace/name",
+			import_syntax: "terraform import xcsh_dns_domain.example namespace/name",
 		},
 		{
-			name: "bot_infrastructure",
-			category: "uncategorized",
-			description: "Bot Infrastructure",
-			required: ["name", "namespace", "traffic_type"],
+			name: "dns_lb_health_check",
+			category: "dns",
+			description: "DNS Load Balancer Health Check in a given namespace. If one already exist it will give a error",
+			required: ["name"],
 			minimal_config: {
 				format: "terraform",
-				source: "_llms-txt/resources/bot_infrastructure.txt#minimal-valid-config",
+				source: "_llms-txt/resources/dns_lb_health_check.txt#minimal-valid-config",
 			},
 			dependencies: {
 				requires: [],
 			},
-			import_syntax: "terraform import xcsh_bot_infrastructure.example namespace/name",
+			import_syntax: "terraform import xcsh_dns_lb_health_check.example namespace/name",
 		},
 		{
-			name: "domain",
-			category: "uncategorized",
-			description: "Allowed domain",
-			required: ["name", "namespace", "allowed_domain"],
+			name: "dns_lb_pool",
+			category: "dns",
+			description: "DNS Load Balancer Pool in a given namespace. If one already exist it will give a error",
+			required: ["name", "load_balancing_mode"],
 			minimal_config: {
 				format: "terraform",
-				source: "_llms-txt/resources/domain.txt#minimal-valid-config",
+				source: "_llms-txt/resources/dns_lb_pool.txt#minimal-valid-config",
 			},
 			dependencies: {
 				requires: [],
 			},
-			import_syntax: "terraform import xcsh_domain.example namespace/name",
+			import_syntax: "terraform import xcsh_dns_lb_pool.example namespace/name",
 		},
 		{
-			name: "mitigated_domain",
-			category: "uncategorized",
-			description: "Mitigated Domain",
-			required: ["name", "namespace", "mitigated_domain"],
+			name: "dns_load_balancer",
+			category: "dns",
+			description: "DNS Load Balancer in a given namespace. If one already exist it will give a error",
+			required: ["name"],
 			minimal_config: {
 				format: "terraform",
-				source: "_llms-txt/resources/mitigated_domain.txt#minimal-valid-config",
+				source: "_llms-txt/resources/dns_load_balancer.txt#minimal-valid-config",
 			},
 			dependencies: {
 				requires: [],
 			},
-			import_syntax: "terraform import xcsh_mitigated_domain.example namespace/name",
+			import_syntax: "terraform import xcsh_dns_load_balancer.example namespace/name",
 		},
 		{
-			name: "protected_application",
-			category: "uncategorized",
-			description: "Applications protected by Bot Defense",
-			required: ["name", "namespace", "region"],
+			name: "dns_proxy",
+			category: "dns",
+			description: "DNS Proxy in a given namespace. If one already exists it will give an error",
+			required: ["name", "transport_type"],
 			minimal_config: {
 				format: "terraform",
-				source: "_llms-txt/resources/protected_application.txt#minimal-valid-config",
+				source: "_llms-txt/resources/dns_proxy.txt#minimal-valid-config",
 			},
 			dependencies: {
 				requires: [],
 			},
-			import_syntax: "terraform import xcsh_protected_application.example namespace/name",
+			import_syntax: "terraform import xcsh_dns_proxy.example namespace/name",
 		},
 		{
-			name: "protected_domain",
-			category: "uncategorized",
-			description: "Domain to protect",
-			required: ["name", "namespace", "protected_domain"],
+			name: "dns_zone",
+			category: "dns",
+			description: "DNS Zone in a given namespace. If one already exist it will give a error",
+			required: ["name"],
 			minimal_config: {
 				format: "terraform",
-				source: "_llms-txt/resources/protected_domain.txt#minimal-valid-config",
+				source: "_llms-txt/resources/dns_zone.txt#minimal-valid-config",
 			},
 			dependencies: {
 				requires: [],
 			},
-			import_syntax: "terraform import xcsh_protected_domain.example namespace/name",
+			import_syntax: "terraform import xcsh_dns_zone.example namespace/name",
 		},
 		{
-			name: "registration_approval",
+			name: "application_profiles",
 			category: "uncategorized",
-			description: "Request for admission approval. configuration",
-			required: ["name", "namespace"],
-			minimal_config: {
-				format: "terraform",
-				source: "_llms-txt/resources/registration_approval.txt#minimal-valid-config",
-			},
-			dependencies: {
-				requires: [],
-			},
-			import_syntax: "terraform import xcsh_registration_approval.example namespace/name",
-		},
-		{
-			name: "dns_compliance_checks",
-			category: "dns",
-			description:
-				"DNS Compliance Checks Specification in a given namespace. If one already exists it will give an error",
+			description: "Application Profiles in a given namespace. If one already exists it will give an error",
 			required: ["name", "namespace"],
 			minimal_config: {
 				format: "terraform",
-				source: "_llms-txt/resources/dns_compliance_checks.txt#minimal-valid-config",
+				source: "_llms-txt/resources/application_profiles.txt#minimal-valid-config",
 			},
 			dependencies: {
 				requires: [],
 			},
-			import_syntax: "terraform import xcsh_dns_compliance_checks.example namespace/name",
+			import_syntax: "terraform import xcsh_application_profiles.example namespace/name",
 		},
 		{
-			name: "dns_domain",
-			category: "dns",
-			description: "DNS Domain in a given namespace. If one already exist it will give a error",
-			required: ["name", "dnssec_mode"],
+			name: "authorization_server",
+			category: "uncategorized",
+			description: "Authorization_server creates a new object in the storage backend for metadata.namespace",
+			required: ["name", "namespace", "jwks_uri"],
 			minimal_config: {
 				format: "terraform",
-				source: "_llms-txt/resources/dns_domain.txt#minimal-valid-config",
+				source: "_llms-txt/resources/authorization_server.txt#minimal-valid-config",
 			},
 			dependencies: {
 				requires: [],
 			},
-			import_syntax: "terraform import xcsh_dns_domain.example namespace/name",
+			import_syntax: "terraform import xcsh_authorization_server.example namespace/name",
 		},
 		{
-			name: "dns_lb_health_check",
-			category: "dns",
-			description: "DNS Load Balancer Health Check in a given namespace. If one already exist it will give a error",
-			required: ["name"],
+			name: "bot_infrastructure",
+			category: "uncategorized",
+			description: "Bot Infrastructure",
+			required: ["name", "namespace", "traffic_type"],
 			minimal_config: {
 				format: "terraform",
-				source: "_llms-txt/resources/dns_lb_health_check.txt#minimal-valid-config",
+				source: "_llms-txt/resources/bot_infrastructure.txt#minimal-valid-config",
 			},
 			dependencies: {
 				requires: [],
 			},
-			import_syntax: "terraform import xcsh_dns_lb_health_check.example namespace/name",
+			import_syntax: "terraform import xcsh_bot_infrastructure.example namespace/name",
 		},
 		{
-			name: "dns_lb_pool",
-			category: "dns",
-			description: "DNS Load Balancer Pool in a given namespace. If one already exist it will give a error",
-			required: ["name", "load_balancing_mode"],
+			name: "mitigated_domain",
+			category: "uncategorized",
+			description: "Mitigated Domain",
+			required: ["name", "namespace", "mitigated_domain"],
 			minimal_config: {
 				format: "terraform",
-				source: "_llms-txt/resources/dns_lb_pool.txt#minimal-valid-config",
+				source: "_llms-txt/resources/mitigated_domain.txt#minimal-valid-config",
 			},
 			dependencies: {
 				requires: [],
 			},
-			import_syntax: "terraform import xcsh_dns_lb_pool.example namespace/name",
+			import_syntax: "terraform import xcsh_mitigated_domain.example namespace/name",
 		},
 		{
-			name: "dns_load_balancer",
-			category: "dns",
-			description: "DNS Load Balancer in a given namespace. If one already exist it will give a error",
-			required: ["name"],
+			name: "protected_application",
+			category: "uncategorized",
+			description: "Applications protected by Bot Defense",
+			required: ["name", "namespace", "region"],
 			minimal_config: {
 				format: "terraform",
-				source: "_llms-txt/resources/dns_load_balancer.txt#minimal-valid-config",
+				source: "_llms-txt/resources/protected_application.txt#minimal-valid-config",
 			},
 			dependencies: {
 				requires: [],
 			},
-			import_syntax: "terraform import xcsh_dns_load_balancer.example namespace/name",
+			import_syntax: "terraform import xcsh_protected_application.example namespace/name",
 		},
 		{
-			name: "dns_proxy",
-			category: "dns",
-			description: "DNS Proxy in a given namespace. If one already exists it will give an error",
-			required: ["name", "transport_type"],
+			name: "protected_domain",
+			category: "uncategorized",
+			description: "Domain to protect",
+			required: ["name", "namespace", "protected_domain"],
 			minimal_config: {
 				format: "terraform",
-				source: "_llms-txt/resources/dns_proxy.txt#minimal-valid-config",
+				source: "_llms-txt/resources/protected_domain.txt#minimal-valid-config",
 			},
 			dependencies: {
 				requires: [],
 			},
-			import_syntax: "terraform import xcsh_dns_proxy.example namespace/name",
+			import_syntax: "terraform import xcsh_protected_domain.example namespace/name",
 		},
 		{
-			name: "dns_zone",
-			category: "dns",
-			description: "DNS Zone in a given namespace. If one already exist it will give a error",
-			required: ["name"],
+			name: "registration_approval",
+			category: "uncategorized",
+			description: "Request for admission approval. configuration",
+			required: ["name", "namespace"],
 			minimal_config: {
 				format: "terraform",
-				source: "_llms-txt/resources/dns_zone.txt#minimal-valid-config",
+				source: "_llms-txt/resources/registration_approval.txt#minimal-valid-config",
 			},
 			dependencies: {
 				requires: [],
 			},
-			import_syntax: "terraform import xcsh_dns_zone.example namespace/name",
+			import_syntax: "terraform import xcsh_registration_approval.example namespace/name",
 		},
 		{
 			name: "api_crawler",

package/src/modes/components/login-prompt-input.ts

@@ -0,0 +1,9 @@
+import type { OAuthPrompt } from "@f5-sales-demo/pi-ai";
+import { Input } from "@f5-sales-demo/pi-tui";
+
+/** Build a login input with the display policy declared by its prompt contract. */
+export function createLoginPromptInput(prompt: Partial<OAuthPrompt>): Input {
+	const input = new Input();
+	input.setMasked(prompt.secret === true);
+	return input;
+}