@f5-sales-demo/xcsh 21.1.0 → 21.2.0

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@f5-sales-demo/xcsh",
-	"version": "21.1.0",
+	"version": "21.2.0",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://github.com/f5-sales-demo/xcsh",
 	"author": "Can Boluk",
@@ -61,13 +61,13 @@
 	},
 	"dependencies": {
 		"@agentclientprotocol/sdk": "1.3.0",
-		"@f5-sales-demo/pi-agent-core": "21.1.0",
-		"@f5-sales-demo/pi-ai": "21.1.0",
-		"@f5-sales-demo/pi-natives": "21.1.0",
-		"@f5-sales-demo/pi-resource-management": "21.1.0",
-		"@f5-sales-demo/pi-tui": "21.1.0",
-		"@f5-sales-demo/pi-utils": "21.1.0",
-		"@f5-sales-demo/xcsh-stats": "21.1.0",
+		"@f5-sales-demo/pi-agent-core": "21.2.0",
+		"@f5-sales-demo/pi-ai": "21.2.0",
+		"@f5-sales-demo/pi-natives": "21.2.0",
+		"@f5-sales-demo/pi-resource-management": "21.2.0",
+		"@f5-sales-demo/pi-tui": "21.2.0",
+		"@f5-sales-demo/pi-utils": "21.2.0",
+		"@f5-sales-demo/xcsh-stats": "21.2.0",
 		"@mozilla/readability": "^0.6",
 		"@sinclair/typebox": "^0.34",
 		"@xterm/headless": "^6.0",

package/src/browser/capabilities.generated.ts

@@ -15,13 +15,33 @@ export interface ExtensionToolDef {
 	readonly flags?: ExtensionToolFlags;
 }
 
+export type ExtensionInteractionMode =
+	| "educational"
+	| "presentation"
+	| "configuration"
+	| "screenshot"
+	| "annotation";
+
+export interface ExtensionChatPromptHints {
+	readonly role: string;
+	readonly grounding: string;
+	readonly referenceLinks: string;
+	readonly toolUse: string;
+	readonly modes: Readonly<Record<ExtensionInteractionMode, string>>;
+}
+
+export interface ExtensionFeatures {
+	readonly chat: { readonly promptHints: ExtensionChatPromptHints; readonly [key: string]: unknown };
+	readonly [key: string]: unknown;
+}
+
 export interface ExtensionCapabilities {
 	readonly version: string;
 	readonly contractVersion: string;
 	readonly multiPortDiscovery?: boolean;
 	readonly protocol: string;
 	readonly tools: readonly ExtensionToolDef[];
-	readonly features: Record<string, unknown>;
+	readonly features: ExtensionFeatures;
 }
 
 export const EXTENSION_CAPABILITIES: ExtensionCapabilities = {

package/src/browser/chat-handler.ts

@@ -21,6 +21,7 @@ import {
 import { LITELLM_LOGIN_MODEL_CHOICES } from "../modes/controllers/login-model";
 import { extractReferences } from "../references";
 import type { AgentSession, AgentSessionEvent } from "../session/agent-session";
+import { EXTENSION_CAPABILITIES } from "./capabilities.generated";
 import {
 	type ChatDelta,
 	type ChatDone,
@@ -689,14 +690,6 @@ export function classifyChatErrorReason(message: string): ChatErrorReason {
 	return "provider-5xx";
 }
 
-const MODE_INSTRUCTIONS: Record<InteractionMode, string> = {
-	educational: "Explain concepts and settings in depth. Help the user understand what they're looking at and why.",
-	presentation: "Guide a structured walkthrough. Narrate each step clearly for a live audience.",
-	configuration: "Help the user build or modify F5 XC configuration. Be precise and action-oriented.",
-	screenshot: "Focus on capturing annotated screenshots that document the current state.",
-	annotation: "Create on-page teaching annotations that highlight key elements and explain their purpose.",
-};
-
 /** Bases a user-attached context path must fall under. Confines grants to the user's
  *  own space (home, the project cwd, temp, external volumes, /opt) and thereby blocks
  *  a client from widening the sandbox to system/credential dirs (`/etc`, `/var`,
@@ -779,11 +772,22 @@ export function composeChatPrompt(
 	const profile = hostProfile(host);
 	parts.push(profile.systemPrompt);
 
+	const promptHints = EXTENSION_CAPABILITIES.features.chat.promptHints;
+
 	// Browser hosts ALSO get an interaction mode + the page-context block. Document
 	// hosts get NEITHER: Office sends no page context and has no browser modes; its
 	// tools + document state arrive at runtime via set_host_tools.
 	if (profile.kind === "browser") {
-		parts.push(`[Chat mode: ${mode}] ${MODE_INSTRUCTIONS[mode]}`);
+		parts.push(
+			[
+				"[Published extension chat contract]",
+				promptHints.role,
+				promptHints.grounding,
+				promptHints.referenceLinks,
+				promptHints.toolUse,
+			].join("\n"),
+		);
+		parts.push(`[Chat mode: ${mode}] ${promptHints.modes[mode]}`);
 		if (context) composeBrowserPageContext(parts, context);
 	}
 

package/src/browser/extension-contract.ts

@@ -46,3 +46,65 @@ export function extractRequestedTools(source: string): string[] {
 	while ((m = re.exec(source)) !== null) out.add(m[1]);
 	return [...out];
 }
+
+interface ToolReferenceManifest {
+	readonly contractVersion: string;
+	readonly tools: readonly {
+		readonly name: string;
+		readonly summary: string;
+		readonly category: string;
+		readonly params: Readonly<Record<string, unknown>>;
+		readonly flags?: {
+			readonly readOnly?: boolean;
+			readonly mutates?: boolean;
+			readonly requiresExplainMode?: boolean;
+		};
+	}[];
+}
+
+function compareText(left: string, right: string): number {
+	return left < right ? -1 : left > right ? 1 : 0;
+}
+
+/** Stable JSON with object keys sorted recursively and array order preserved. */
+function canonicalJson(value: unknown): string {
+	if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+	if (value !== null && typeof value === "object") {
+		const entries = Object.entries(value as Record<string, unknown>).sort(([left], [right]) =>
+			compareText(left, right),
+		);
+		return `{${entries.map(([key, entry]) => `${JSON.stringify(key)}:${canonicalJson(entry)}`).join(",")}}`;
+	}
+	return JSON.stringify(value) ?? "null";
+}
+
+/** Render the complete extension tool surface as deterministic Markdown. */
+export function renderToolReference(manifest: ToolReferenceManifest): string {
+	const categories = new Map<string, ToolReferenceManifest["tools"][number][]>();
+	for (const tool of manifest.tools) {
+		const tools = categories.get(tool.category) ?? [];
+		tools.push(tool);
+		categories.set(tool.category, tools);
+	}
+
+	const lines = [
+		"# Chrome Extension Tool Signatures",
+		"",
+		`Generated from extension capability contract \`${manifest.contractVersion}\`.`,
+	];
+	for (const category of [...categories.keys()].sort(compareText)) {
+		lines.push("", `## ${category}`);
+		for (const tool of (categories.get(category) ?? []).sort((left, right) => compareText(left.name, right.name))) {
+			lines.push(
+				"",
+				`### \`${tool.name}\``,
+				"",
+				tool.summary,
+				"",
+				`- Parameters: \`${canonicalJson(tool.params)}\``,
+				`- Semantic flags: \`${canonicalJson(tool.flags ?? {})}\``,
+			);
+		}
+	}
+	return `${lines.join("\n")}\n`;
+}

package/src/internal-urls/build-info.generated.ts

@@ -17,17 +17,17 @@ export interface BuildInfo {
 }
 
 export const BUILD_INFO: BuildInfo = {
-	"version": "21.1.0",
-	"commit": "5c6e84a195bcf81ba561bf85c5ecf7a47d8c62c1",
-	"shortCommit": "5c6e84a",
+	"version": "21.2.0",
+	"commit": "d217f62f68fae54fe18d88c7d90a8f7dc4703c0d",
+	"shortCommit": "d217f62",
 	"branch": "main",
-	"tag": "v21.1.0",
-	"commitDate": "2026-08-28T19:03:09+00:00",
-	"buildDate": "2026-08-28T19:42:43.325Z",
+	"tag": "v21.2.0",
+	"commitDate": "2026-08-30T03:18:04+00:00",
+	"buildDate": "2026-08-30T03:46:25.618Z",
 	"dirty": true,
 	"prNumber": "",
 	"repoUrl": "https://github.com/f5-sales-demo/xcsh",
 	"repoSlug": "f5-sales-demo/xcsh",
-	"commitUrl": "https://github.com/f5-sales-demo/xcsh/commit/5c6e84a195bcf81ba561bf85c5ecf7a47d8c62c1",
-	"releaseUrl": "https://github.com/f5-sales-demo/xcsh/releases/tag/v21.1.0"
+	"commitUrl": "https://github.com/f5-sales-demo/xcsh/commit/d217f62f68fae54fe18d88c7d90a8f7dc4703c0d",
+	"releaseUrl": "https://github.com/f5-sales-demo/xcsh/releases/tag/v21.2.0"
 };

package/src/internal-urls/extension-tools.generated.ts

@@ -0,0 +1,4 @@
+// Auto-generated by scripts/generate-extension-capabilities.ts - DO NOT EDIT
+// Source: src/browser/capabilities.json (the Chrome extension's published contract).
+
+export const EXTENSION_TOOL_REFERENCE = "# Chrome Extension Tool Signatures\n\nGenerated from extension capability contract `2.1.0`.\n\n## annotation\n\n### `annotate`\n\nDraw an overlay annotation (fingerprint/highlight). No-op unless explain mode is on.\n\n- Parameters: `{\"properties\":{\"h\":{\"type\":\"number\"},\"kind\":{\"type\":\"string\"},\"ref\":{\"type\":\"string\"},\"w\":{\"type\":\"number\"},\"x\":{\"type\":\"number\"},\"y\":{\"type\":\"number\"}},\"required\":[\"kind\"],\"type\":\"object\"}`\n- Semantic flags: `{\"requiresExplainMode\":true}`\n\n### `set_explain_mode`\n\nEnter/leave explain mode — the gate for all on-page annotation overlays.\n\n- Parameters: `{\"properties\":{\"enabled\":{\"type\":\"boolean\"}},\"type\":\"object\"}`\n- Semantic flags: `{}`\n\n## interaction\n\n### `click`\n\nDeterministic click of an AX-ref element (layout-engine coords + hit-test).\n\n- Parameters: `{\"properties\":{\"ref\":{\"type\":\"string\"}},\"required\":[\"ref\"],\"type\":\"object\"}`\n- Semantic flags: `{\"mutates\":true}`\n\n### `click_element`\n\nClick the element returned by a JS expression (polls; occlusion-safe).\n\n- Parameters: `{\"properties\":{\"js\":{\"type\":\"string\"},\"wait_ms\":{\"type\":\"number\"}},\"required\":[\"js\"],\"type\":\"object\"}`\n- Semantic flags: `{\"mutates\":true}`\n\n### `click_xy`\n\nTrusted click at explicit viewport coordinates.\n\n- Parameters: `{\"properties\":{\"x\":{\"type\":\"number\"},\"y\":{\"type\":\"number\"}},\"required\":[\"x\",\"y\"],\"type\":\"object\"}`\n- Semantic flags: `{\"mutates\":true}`\n\n### `file_upload`\n\nUpload files (base64 data URIs) to a file input by AX ref.\n\n- Parameters: `{\"properties\":{\"files\":{\"items\":{\"type\":\"string\"},\"type\":\"array\"},\"ref\":{\"type\":\"string\"}},\"required\":[\"ref\",\"files\"],\"type\":\"object\"}`\n- Semantic flags: `{\"mutates\":true}`\n\n### `form_input`\n\nSet a form field value by AX ref.\n\n- Parameters: `{\"properties\":{\"ref\":{\"type\":\"string\"},\"value\":{\"type\":\"string\"}},\"required\":[\"ref\",\"value\"],\"type\":\"object\"}`\n- Semantic flags: `{\"mutates\":true}`\n\n### `key_press`\n\nDispatch a key press.\n\n- Parameters: `{\"properties\":{\"key\":{\"type\":\"string\"}},\"required\":[\"key\"],\"type\":\"object\"}`\n- Semantic flags: `{\"mutates\":true}`\n\n### `label_select`\n\nType into a CDK-portal typeahead and click the matching option.\n\n- Parameters: `{\"properties\":{\"label_value\":{\"type\":\"string\"},\"selector\":{\"type\":\"string\"},\"value\":{\"type\":\"string\"},\"wait_ms\":{\"type\":\"number\"}},\"required\":[\"selector\",\"value\"],\"type\":\"object\"}`\n- Semantic flags: `{\"mutates\":true}`\n\n### `select_option`\n\nSelect an option in a native <select> by AX ref.\n\n- Parameters: `{\"properties\":{\"ref\":{\"type\":\"string\"},\"value\":{\"type\":\"string\"}},\"required\":[\"ref\",\"value\"],\"type\":\"object\"}`\n- Semantic flags: `{\"mutates\":true}`\n\n### `type_text`\n\nType text into the focused element (trusted input).\n\n- Parameters: `{\"properties\":{\"text\":{\"type\":\"string\"}},\"required\":[\"text\"],\"type\":\"object\"}`\n- Semantic flags: `{\"mutates\":true}`\n\n## meta\n\n### `capabilities`\n\nReturn this self-describing capability manifest (tools + features + versions).\n\n- Parameters: `{\"properties\":{},\"type\":\"object\"}`\n- Semantic flags: `{\"readOnly\":true}`\n\n### `debug_exec`\n\nDiagnostic: probe in-page bridge availability.\n\n- Parameters: `{\"properties\":{},\"type\":\"object\"}`\n- Semantic flags: `{\"readOnly\":true}`\n\n### `detach`\n\nDetach the debugger from the target tab.\n\n- Parameters: `{\"properties\":{},\"type\":\"object\"}`\n- Semantic flags: `{\"mutates\":true}`\n\n### `ping`\n\nLiveness check; returns { ok, version }.\n\n- Parameters: `{\"properties\":{},\"type\":\"object\"}`\n- Semantic flags: `{\"readOnly\":true}`\n\n### `reload`\n\nReload the extension (re-reads dist/ from disk).\n\n- Parameters: `{\"properties\":{},\"type\":\"object\"}`\n- Semantic flags: `{\"mutates\":true}`\n\n### `set_bridge_port`\n\nSet the WebSocket bridge port (persists across reload; enables multi-session on different ports).\n\n- Parameters: `{\"properties\":{\"port\":{\"type\":\"number\"}},\"required\":[\"port\"],\"type\":\"object\"}`\n- Semantic flags: `{\"mutates\":true}`\n\n## navigation\n\n### `navigate`\n\nNavigate the console tab to a scoped https URL.\n\n- Parameters: `{\"properties\":{\"url\":{\"type\":\"string\"}},\"required\":[\"url\"],\"type\":\"object\"}`\n- Semantic flags: `{\"mutates\":true}`\n\n### `resize_window`\n\nResize the browser window.\n\n- Parameters: `{\"properties\":{\"height\":{\"type\":\"number\"},\"width\":{\"type\":\"number\"}},\"required\":[\"width\",\"height\"],\"type\":\"object\"}`\n- Semantic flags: `{\"mutates\":true}`\n\n### `scroll_to`\n\nScroll an AX-ref element into view.\n\n- Parameters: `{\"properties\":{\"ref\":{\"type\":\"string\"}},\"required\":[\"ref\"],\"type\":\"object\"}`\n- Semantic flags: `{\"mutates\":true}`\n\n### `tabs_close`\n\nClose a tab by id.\n\n- Parameters: `{\"properties\":{\"tabId\":{\"type\":\"number\"}},\"required\":[\"tabId\"],\"type\":\"object\"}`\n- Semantic flags: `{\"mutates\":true}`\n\n### `tabs_create`\n\nOpen a new tab at a scoped URL.\n\n- Parameters: `{\"properties\":{\"url\":{\"type\":\"string\"}},\"required\":[\"url\"],\"type\":\"object\"}`\n- Semantic flags: `{\"mutates\":true}`\n\n### `tabs_list`\n\nList scoped console tabs.\n\n- Parameters: `{\"properties\":{},\"type\":\"object\"}`\n- Semantic flags: `{}`\n\n## read\n\n### `assert_text`\n\nAssert an element contains expected text.\n\n- Parameters: `{\"properties\":{\"context\":{\"type\":\"string\"},\"expected\":{\"type\":\"string\"},\"selector\":{\"type\":\"string\"}},\"required\":[\"selector\",\"expected\"],\"type\":\"object\"}`\n- Semantic flags: `{\"readOnly\":true}`\n\n### `diag_activation`\n\nDiagnostic: per-gate tab-activation readiness timings (bridge/worker/page), cold/warm.\n\n- Parameters: `{\"properties\":{},\"type\":\"object\"}`\n- Semantic flags: `{}`\n\n### `diag_bridges`\n\nList discovered xcsh bridge health without tenant, environment, or session identifiers.\n\n- Parameters: `{\"properties\":{},\"type\":\"object\"}`\n- Semantic flags: `{}`\n\n### `diag_suspension`\n\nDiagnostic: SW-lifecycle event buffer + suspension summary (Phase 0a).\n\n- Parameters: `{\"properties\":{},\"type\":\"object\"}`\n- Semantic flags: `{}`\n\n### `diag_ttft`\n\nDiagnostic: init→first-token timeline (per-stage ms, total, dominant, cold/warm).\n\n- Parameters: `{\"properties\":{},\"type\":\"object\"}`\n- Semantic flags: `{}`\n\n### `find`\n\nFind AX nodes matching a locator.\n\n- Parameters: `{\"properties\":{\"selector\":{\"type\":\"string\"}},\"required\":[\"selector\"],\"type\":\"object\"}`\n- Semantic flags: `{\"readOnly\":true}`\n\n### `get_page_context`\n\nReturn a snapshot of the active console page (url, AX tree, captured XC API body) for chat grounding.\n\n- Parameters: `{\"properties\":{},\"type\":\"object\"}`\n- Semantic flags: `{\"readOnly\":true}`\n\n### `get_page_text`\n\nReturn the page text.\n\n- Parameters: `{\"properties\":{},\"type\":\"object\"}`\n- Semantic flags: `{\"readOnly\":true}`\n\n### `query_dom`\n\nDirect DOM.querySelector at wire speed — bypasses Runtime.evaluate for simple CSS selectors.\n\n- Parameters: `{\"properties\":{\"selector\":{\"type\":\"string\"}},\"required\":[\"selector\"],\"type\":\"object\"}`\n- Semantic flags: `{\"readOnly\":true}`\n\n### `read_ax`\n\nRead the accessibility tree of the page.\n\n- Parameters: `{\"properties\":{},\"type\":\"object\"}`\n- Semantic flags: `{\"readOnly\":true}`\n\n### `read_console`\n\nRead buffered console messages, optionally filtered by pattern.\n\n- Parameters: `{\"properties\":{\"pattern\":{\"type\":\"string\"}},\"type\":\"object\"}`\n- Semantic flags: `{\"readOnly\":true}`\n\n### `read_network`\n\nRead buffered network events, optionally filtered by pattern.\n\n- Parameters: `{\"properties\":{\"pattern\":{\"type\":\"string\"}},\"type\":\"object\"}`\n- Semantic flags: `{\"readOnly\":true}`\n\n### `screenshot`\n\nCapture a screenshot (base64 PNG).\n\n- Parameters: `{\"properties\":{},\"type\":\"object\"}`\n- Semantic flags: `{\"readOnly\":true}`\n\n### `wait_for`\n\nWait for an AX node matching a locator to appear.\n\n- Parameters: `{\"properties\":{\"context\":{\"type\":\"string\"},\"selector\":{\"type\":\"string\"},\"timeoutMs\":{\"type\":\"number\"}},\"required\":[\"selector\"],\"type\":\"object\"}`\n- Semantic flags: `{\"readOnly\":true}`\n\n### `wait_for_api_response`\n\nWait for a network response whose URL matches a pattern.\n\n- Parameters: `{\"properties\":{\"pattern\":{\"type\":\"string\"},\"timeout_ms\":{\"type\":\"number\"}},\"type\":\"object\"}`\n- Semantic flags: `{\"readOnly\":true}`\n\n## script\n\n### `browser_batch`\n\nRun a batch of { tool, params } actions in sequence.\n\n- Parameters: `{\"properties\":{\"actions\":{\"items\":{\"properties\":{\"params\":{},\"tool\":{\"type\":\"string\"}},\"required\":[\"tool\"],\"type\":\"object\"},\"type\":\"array\"}},\"required\":[\"actions\"],\"type\":\"object\"}`\n- Semantic flags: `{\"mutates\":true}`\n\n### `javascript_tool`\n\nEvaluate arbitrary JS in the page (length-capped).\n\n- Parameters: `{\"properties\":{\"code\":{\"type\":\"string\"}},\"required\":[\"code\"],\"type\":\"object\"}`\n- Semantic flags: `{\"mutates\":true}`\n";

package/src/internal-urls/xcsh-protocol.ts

@@ -44,6 +44,7 @@ import { type ConsoleFieldMetadataData, EMPTY_CONSOLE_FIELD_METADATA } from "./c
 import { type ConsoleResolver, createConsoleResolver } from "./console-resolve";
 import { EMBEDDED_DOC_FILENAMES, EMBEDDED_DOCS } from "./docs-index.generated";
 import extensionApiContent from "./extension-api.md" with { type: "text" };
+import { EXTENSION_TOOL_REFERENCE } from "./extension-tools.generated";
 import { createFleetResolver, type FleetDeps, type FleetResolver } from "./fleet-resolve";
 import { createPluginResolver, type GetPluginRoots, type PluginResolver } from "./plugin-resolve";
 import { createRegistryResolver, type RegistryResolver, type RegistryResolverDeps } from "./registry-resolve";
@@ -66,6 +67,7 @@ const CHANGES_HOST = "changes";
 const SOURCE_HOST = "source";
 const FLEET_HOST = "fleet";
 const SITECLI_HOST = "sitecli";
+const EXTENSION_CONTENT = `${extensionApiContent.trimEnd()}\n\n---\n\n${EXTENSION_TOOL_REFERENCE}`;
 const EMPTY_INDEX: ApiSpecIndex = { version: "unavailable", timestamp: "", domains: [] };
 const EMPTY_CATALOG_INDEX: ApiCatalogIndex = {
 	version: "unavailable",
@@ -490,15 +492,14 @@ export class InternalDocsProtocolHandler implements ProtocolHandler {
 		return this.#readDoc(filename, url);
 	}
 
-	/** Serve the Chrome extension bridge tool API reference. The hand-written
-	 * guidance (extension-api.md) is imported at compile time and served on demand
-	 * at `xcsh://extension`. */
+	/** Serve the Chrome extension bridge guidance plus generated tool signatures.
+	 * Both are imported at compile time and served on demand at `xcsh://extension`. */
 	#resolveExtension(url: InternalUrl): InternalResource {
 		return {
 			url: url.href,
-			content: extensionApiContent,
+			content: EXTENSION_CONTENT,
 			contentType: "text/markdown",
-			size: Buffer.byteLength(extensionApiContent, "utf-8"),
+			size: Buffer.byteLength(EXTENSION_CONTENT, "utf-8"),
 			sourcePath: `${SCHEME_PREFIX}${EXTENSION_HOST}`,
 		};
 	}

package/src/prompts/internal-urls/containment.md

@@ -61,6 +61,10 @@ Without a runtime backend, Bash child-process reads cannot enforce protected-con
 xcsh-private-root denial. Structured tools still enforce those rules, and ordinary work remains
 unrestricted. The persistent `python` kernel is likewise unfenced beyond its explicit `cwd` check.
 
+On Windows, mounted drive letters other than the workspace drive lose root enumeration in structured
+tools. A UNC share that is not mapped to a drive letter cannot be enumerated and is outside this
+courtesy boundary; map it to a drive or grant a known path explicitly when it belongs to the task.
+
 Treat the boundary as a statement of intent rather than a guarantee, and do not go looking for paths
 outside the session directory on the assumption that something would stop you.
 {{/if}}

package/src/sandbox/containment.ts

@@ -352,12 +352,11 @@ function resolveGrants(roots: readonly string[] | undefined, home: string): Set<
  * kernel backend, so this exact-enumeration rule is enforced for structured tools but cannot confine a
  * Bash child process.
  *
- * **Unverified on Windows.** The probe below cannot run on the platforms this fleet uses, so what is
- * tested is the exact-enumeration protection, not discovery — see the test, which injects the list.
+ * Native Windows UAT exercises this production probe against a real second mounted volume.
  *
  * UNC paths (`\\server\share`) have no enumerable root and are not covered.
  */
-function otherFilesystemRoots(fsRoot: string): string[] {
+export function otherFilesystemRoots(fsRoot: string): string[] {
 	if (process.platform !== "win32") return [];
 	const roots: string[] = [];
 	for (let letter = "A".charCodeAt(0); letter <= "Z".charCodeAt(0); letter++) {
@@ -532,8 +531,16 @@ export function buildContainmentFence(options: ContainmentOptions): ContainmentF
 		if (resolved === fsRoot) continue; // never the root the workspace lives on
 		// A directory containing home is normally too broad to protect because it would hide unrelated
 		// operational entries. Account containers are the deliberate exception: their listing is the
-		// discovery surface, while every named account remains reachable (#2788, #2931).
-		if (home !== undefined && pathIsWithin(resolved, home) && !accountRoots.has(resolved)) continue;
+		// discovery surface, while every named account remains reachable (#2788, #2931). A separate
+		// Windows drive is also an exception: only its exact listing is hidden, so home and every named
+		// descendant retain their normal access.
+		if (
+			!rootScoped.has(resolved) &&
+			home !== undefined &&
+			pathIsWithin(resolved, home) &&
+			!accountRoots.has(resolved)
+		)
+			continue;
 		// The session workspace and explicit read/full grants retain enumeration. A write-only grant does
 		// not imply permission to learn directory entries.
 		if (resolved === workspace) continue;