@f5-sales-demo/xcsh 21.45.2 → 21.45.3

package/src/internal-urls/build-info.generated.ts

@@ -17,17 +17,17 @@ export interface BuildInfo {
 }
 
 export const BUILD_INFO: BuildInfo = {
-	"version": "21.45.2",
-	"commit": "03750851e444f62aa128f72454749f7ab824afdd",
-	"shortCommit": "0375085",
+	"version": "21.45.3",
+	"commit": "f2bcda523f9298bf318b85466aff6e44e8ff5872",
+	"shortCommit": "f2bcda5",
 	"branch": "main",
-	"tag": "v21.45.2",
-	"commitDate": "2026-09-25T14:32:18Z",
-	"buildDate": "2026-09-25T15:08:16.358Z",
+	"tag": "v21.45.3",
+	"commitDate": "2026-09-25T15:11:11Z",
+	"buildDate": "2026-09-25T15:52:20.005Z",
 	"dirty": true,
 	"prNumber": "",
 	"repoUrl": "https://github.com/f5-sales-demo/xcsh",
 	"repoSlug": "f5-sales-demo/xcsh",
-	"commitUrl": "https://github.com/f5-sales-demo/xcsh/commit/03750851e444f62aa128f72454749f7ab824afdd",
-	"releaseUrl": "https://github.com/f5-sales-demo/xcsh/releases/tag/v21.45.2"
+	"commitUrl": "https://github.com/f5-sales-demo/xcsh/commit/f2bcda523f9298bf318b85466aff6e44e8ff5872",
+	"releaseUrl": "https://github.com/f5-sales-demo/xcsh/releases/tag/v21.45.3"
 };

package/src/locales/en.json

@@ -159,11 +159,12 @@
 	"commands.fork.description": "Create a new fork from a previous message",
 	"commands.tree.description": "Navigate session tree (switch branches)",
 	"commands.login.description": "Login with OAuth provider",
-	"commands.login.inlineHint": "[provider|redirect URL]",
+	"commands.login.inlineHint": "[provider|redirect URL|copy]",
 	"commands.login.alreadyInProgressFor": "OAuth login already in progress for {provider}. Paste the redirect URL with /login <url>.",
 	"commands.login.alreadyInProgress": "OAuth login already in progress. Paste the redirect URL with /login <url>.",
 	"commands.login.callbackReceived": "OAuth callback received; completing login…",
 	"commands.login.noCallbackWaiting": "No OAuth login is waiting for a manual callback.",
+	"commands.login.noUrlToCopy": "No OAuth sign-in URL is waiting to copy.",
 	"commands.logout.description": "Logout from OAuth provider",
 	"commands.mcp.description": "Manage MCP servers (add, list, remove, test)",
 	"commands.mcp.sub.add.description": "Add a new MCP server",

package/src/modes/components/auth-link-presenter.ts

@@ -1,33 +1,60 @@
-import { type Container, Text } from "@f5-sales-demo/pi-tui";
-import { recoveryUrlHyperlink } from "../../tui/hyperlink";
+import { type Component, type Container, TERMINAL, Text, visibleWidth, wrapTextWithAnsi } from "@f5-sales-demo/pi-tui";
+import { recoveryUrlHyperlink, safeRecoveryUrl } from "../../tui/hyperlink";
 import { theme } from "../theme/theme";
 
 type AuthLinkContainer = Pick<Container, "addChild">;
 
+/** Wrap plain glyphs first, then attach the complete target to each physical row. */
+class RecoveryLinkText implements Component {
+	constructor(
+		private readonly url: string,
+		private readonly label: string,
+	) {}
+	invalidate(): void {}
+
+	render(width: number): string[] {
+		const margin = width >= 3 ? " " : "";
+		const contentWidth = Math.max(1, width - margin.length * 2);
+		return wrapTextWithAnsi(this.label, contentWidth).map(segment => {
+			const linked = theme.fg("accent", recoveryUrlHyperlink(this.url, segment));
+			const line = `${margin}${linked}${margin}`;
+			return line + " ".repeat(Math.max(0, width - visibleWidth(line)));
+		});
+	}
+}
+
 export interface AuthLinkPresenterOptions {
 	platform?: NodeJS.Platform;
 }
 
-/** Present a browser authorization target without exposing its long URL as visible terminal text. */
+/** Present a browser authorization target with exact links on every wrapped row. */
 export function presentAuthLink(
 	container: AuthLinkContainer,
 	url: string,
 	options: AuthLinkPresenterOptions = {},
 ): void {
+	const target = safeRecoveryUrl(url);
+	if (!target) {
+		container.addChild(new Text(theme.fg("warning", "Sign-in URL unavailable: invalid HTTP(S) target."), 1, 0));
+		return;
+	}
 	const platform = options.platform ?? process.platform;
 	const clickHint = platform === "darwin" ? "Cmd+click to open" : "Ctrl+click to open";
-	const hyperlink = recoveryUrlHyperlink(url, "Open sign-in page");
-	container.addChild(new Text(`${theme.fg("accent", hyperlink)} ${theme.fg("dim", `(${clickHint})`)}`, 1, 0));
-	if (hyperlink === "Open sign-in page") container.addChild(new Text(theme.fg("accent", url), 1, 0));
-	container.addChild(
-		new Text(theme.fg("dim", "The full URL remains visible when terminal hyperlinks are unavailable."), 1, 0),
-	);
+	const hyperlink = recoveryUrlHyperlink(target, "Open sign-in page");
+	container.addChild(new RecoveryLinkText(target, "Open sign-in page"));
+	container.addChild(new Text(theme.fg("dim", `(${clickHint})`), 1, 0));
+	if (!TERMINAL.hyperlinks || hyperlink === "Open sign-in page") {
+		container.addChild(new RecoveryLinkText(target, target));
+		container.addChild(new Text(theme.fg("dim", "The full URL is visible above for manual recovery."), 1, 0));
+	}
 }
 
 /** Render device verification details so they remain usable without hyperlink or clipboard support. */
 export function presentDeviceCode(container: AuthLinkContainer, url: string, userCode: string): void {
-	const hyperlink = recoveryUrlHyperlink(url, url);
-	container.addChild(new Text(theme.fg("accent", hyperlink), 1, 0));
+	const target = safeRecoveryUrl(url);
+	if (target) container.addChild(new RecoveryLinkText(target, target));
+	else
+		container.addChild(new Text(theme.fg("warning", "Verification URL unavailable: invalid HTTP(S) target."), 1, 0));
 	container.addChild(new Text(theme.fg("warning", `One-time code: ${theme.bold(userCode)}`), 1, 0));
 	container.addChild(
 		new Text(theme.fg("dim", "Press c at the prompt to copy; the code remains readable above."), 1, 0),

package/src/modes/controllers/selector-controller.ts

@@ -40,7 +40,7 @@ import { createContextEnv } from "../../services/context-env";
 import { type SessionInfo, SessionManager } from "../../session/session-manager";
 import { FileSessionStorage } from "../../session/session-storage";
 import { isSearchProviderPreference, setPreferredImageProvider, setPreferredSearchProvider } from "../../tools";
-import { applyHyperlinkSetting } from "../../tui/hyperlink";
+import { applyHyperlinkSetting, safeRecoveryUrl } from "../../tui/hyperlink";
 import { setSessionTerminalTitle } from "../../utils/title-generator";
 import { AgentDashboard } from "../components/agent-dashboard";
 import { AssistantMessageComponent } from "../components/assistant-message";
@@ -1980,6 +1980,8 @@ export class SelectorController {
 			CALLBACK_SERVER_PROVIDERS.has(providerId as OAuthProvider) || providerId === "openai-codex";
 		const shouldOpenBrowser = providerId !== "openai-codex" || openAICodexMethod === "browser";
 		let endAuthorizationWait: (() => void) | undefined;
+		let authorizationUrl: string | undefined;
+		let authorizationKind: "browser" | "device" = "browser";
 
 		const abort = new AbortController();
 		let closeAuthFrame: (() => void) | undefined;
@@ -1997,10 +1999,22 @@ export class SelectorController {
 			});
 			input.onEscape = cancel;
 			input.onSubmit = () => {
-				const value = input
-					.getValue()
-					.trim()
-					.replace(/^\/login\s+/, "");
+				const typed = input.getValue().trim();
+				if (authorizationKind !== "device" && authorizationUrl && /^(?:c|copy)$/iu.test(typed)) {
+					const url = authorizationUrl;
+					input.setValue("");
+					void reviewClipboardAction(this.ctx, {
+						title: "sign-in URL copy",
+						identity: `login:${providerId}:authorization-url`,
+						label: "Current sign-in URL",
+						success: "Sign-in URL copied to the local clipboard.",
+						reopen: "Enter c at the login prompt to review it again.",
+						current: () => !abort.signal.aborted && authFrame?.input === input && authorizationUrl === url,
+						resolveText: () => (authorizationUrl === url ? url : undefined),
+					});
+					return;
+				}
+				const value = typed.replace(/^\/login\s+/, "");
 				if (value) manualInput.submit(value);
 				input.setValue("");
 			};
@@ -2030,11 +2044,21 @@ export class SelectorController {
 				kind?: "browser" | "device";
 				userCode?: string;
 			}) => {
+				authorizationUrl = safeRecoveryUrl(info.url);
+				authorizationKind = info.kind ?? "browser";
+				if (useManualInput) {
+					manualInput.clearAuthorizationUrl(providerId);
+					if (authorizationUrl) manualInput.setAuthorizationUrl(providerId, authorizationUrl);
+				}
 				const frame = showAuthFrame();
 				frame.content.clear();
 				if (info.kind === "device" && info.userCode) presentDeviceCode(frame.content, info.url, info.userCode);
 				else presentAuthLink(frame.content, info.url);
 				if (info.instructions) frame.content.addChild(new Text(theme.fg("muted", info.instructions), 0, 0));
+				if (info.kind !== "device" && authorizationUrl)
+					frame.content.addChild(
+						new Text(theme.fg("dim", "Type c at the prompt to copy the exact sign-in URL."), 0, 0),
+					);
 				if (useManualInput) frame.content.addChild(new Text(theme.fg("dim", MANUAL_LOGIN_TIP), 0, 0));
 				this.ctx.ui.requestRender();
 				if (shouldOpenBrowser)
@@ -2055,17 +2079,24 @@ export class SelectorController {
 				};
 				input.onSubmit = () => {
 					const value = input.getValue();
-					if (prompt.copyText && /^(?:c|copy)$/i.test(value.trim())) {
+					const copyText = prompt.copyText ?? (authorizationKind === "device" ? undefined : authorizationUrl);
+					if (copyText && /^(?:c|copy)$/i.test(value.trim())) {
+						const copyingCode = Boolean(prompt.copyText);
 						void reviewClipboardAction(this.ctx, {
 							title: "login recovery copy",
 							identity: `login:${providerId}:prompt`,
-							label: "One-time login recovery value",
-							success: "One-time login recovery value copied to the local clipboard.",
+							label: copyingCode ? "One-time login recovery value" : "Current sign-in URL",
+							success: copyingCode
+								? "One-time login recovery value copied to the local clipboard."
+								: "Sign-in URL copied to the local clipboard.",
 							reopen: "Enter copy at the login prompt to review it again.",
-							current: () => !abort.signal.aborted && frame.input === input,
-							resolveText: () => prompt.copyText,
+							current: () =>
+								!abort.signal.aborted &&
+								frame.input === input &&
+								(copyingCode || authorizationUrl === copyText),
+							resolveText: () => (copyingCode || authorizationUrl === copyText ? copyText : undefined),
 						}).then(outcome => {
-							if (outcome === "copied" || outcome === "requested") {
+							if (copyingCode && (outcome === "copied" || outcome === "requested")) {
 								restoreWaiting();
 								resolve("");
 							} else {
@@ -2108,6 +2139,7 @@ export class SelectorController {
 			} else this.ctx.showError(`Login failed: ${error instanceof Error ? error.message : String(error)}`);
 		} finally {
 			closeAuthFrame?.();
+			manualInput.clearAuthorizationUrl(providerId);
 			if (useManualInput) {
 				manualInput.clear(`Manual OAuth input cleared for ${providerId}`);
 			}
@@ -2161,7 +2193,15 @@ export class SelectorController {
 				try {
 					await authStorage.login("google-vertex", {
 						onAuth: info => {
+							const authorizationUrl = safeRecoveryUrl(info.url);
+							this.ctx.oauthManualInput.clearAuthorizationUrl("google-vertex");
+							if (authorizationUrl)
+								this.ctx.oauthManualInput.setAuthorizationUrl("google-vertex", authorizationUrl);
 							presentAuthLink(this.ctx.chatContainer, info.url);
+							if (authorizationUrl)
+								this.ctx.chatContainer.addChild(
+									new Text(theme.fg("dim", "Tip: Use /login copy to copy the exact sign-in URL."), 1, 0),
+								);
 							this.ctx.chatContainer.addChild(new Text(theme.fg("dim", VERTEX_MANUAL_LOGIN_TIP), 1, 0));
 							if (!isHeadlessTerminal(runtime.environment)) {
 								const launch = this.#launchHttpUrl(info.url);
@@ -2182,6 +2222,7 @@ export class SelectorController {
 						onManualCodeInput: () => this.ctx.oauthManualInput.waitForInput("google-vertex"),
 					});
 				} finally {
+					this.ctx.oauthManualInput.clearAuthorizationUrl("google-vertex");
 					endAuthorizationWait?.();
 				}
 				accessToken = await authStorage.getApiKey("google-vertex");

package/src/modes/oauth-manual-input.ts

@@ -6,11 +6,25 @@ type PendingInput = {
 
 export class OAuthManualInputManager {
 	#pending?: PendingInput;
+	#authorization?: { providerId: string; url: string };
+
+	setAuthorizationUrl(providerId: string, url: string): void {
+		this.#authorization = { providerId, url };
+	}
+
+	get authorizationUrl(): string | undefined {
+		return this.#pending?.providerId === this.#authorization?.providerId ? this.#authorization?.url : undefined;
+	}
+
+	clearAuthorizationUrl(providerId: string): void {
+		if (this.#authorization?.providerId === providerId) this.#authorization = undefined;
+	}
 
 	waitForInput(providerId: string): Promise<string> {
 		if (this.#pending) {
 			this.clear("Manual OAuth input superseded by a new login");
 		}
+		if (this.#authorization?.providerId !== providerId) this.#authorization = undefined;
 
 		const { promise, resolve, reject } = Promise.withResolvers<string>();
 		this.#pending = { providerId, resolve, reject };
@@ -21,11 +35,13 @@ export class OAuthManualInputManager {
 		if (!this.#pending) return false;
 		const { resolve } = this.#pending;
 		this.#pending = undefined;
+		this.#authorization = undefined;
 		resolve(input);
 		return true;
 	}
 
 	clear(reason = "Manual OAuth input cleared"): void {
+		this.#authorization = undefined;
 		if (!this.#pending) return;
 		const { reject } = this.#pending;
 		this.#pending = undefined;

package/src/slash-commands/builtin-registry.ts

@@ -35,6 +35,7 @@ import { runReviewedAction } from "../modes/components/reviewed-action-dialog";
 import { getLoginOptions } from "../modes/controllers/login-options";
 import { theme } from "../modes/theme/theme";
 import type { InteractiveModeContext } from "../modes/types";
+import { reviewClipboardAction } from "../modes/utils/clipboard-action";
 import { personProfileService } from "../person-profile/service";
 import { resolveRemoteThreadId } from "../remote-control/thread-identity";
 import { createContextEnv } from "../services/context-env";
@@ -893,9 +894,25 @@ const BUILTIN_SLASH_COMMAND_REGISTRY: ReadonlyArray<BuiltinSlashCommandSpec> = [
 		description: t("commands.login.description"),
 		inlineHint: t("commands.login.inlineHint"),
 		allowArgs: true,
-		handle: (command, runtime) => {
+		handle: async (command, runtime) => {
 			const manualInput = runtime.ctx.oauthManualInput;
 			const args = command.args.trim();
+			if (args.toLowerCase() === "copy") {
+				const url = manualInput.authorizationUrl;
+				if (url) {
+					await reviewClipboardAction(runtime.ctx, {
+						title: "sign-in URL copy",
+						identity: `login:${manualInput.pendingProviderId}:authorization-url`,
+						label: "Current sign-in URL",
+						success: "Sign-in URL copied to the local clipboard.",
+						reopen: "Run /login copy while this login is waiting to review it again.",
+						current: () => manualInput.authorizationUrl === url,
+						resolveText: () => manualInput.authorizationUrl,
+					});
+				} else runtime.ctx.showWarning(t("commands.login.noUrlToCopy"));
+				runtime.ctx.editor.setText("");
+				return;
+			}
 			if (args.length > 0) {
 				const matchedProvider = getLoginOptions().find(provider => provider.id === args);
 				if (matchedProvider) {

package/src/tui/hyperlink.ts

@@ -5,6 +5,7 @@ import { settings } from "../config/settings";
 
 const DETECTED_TERMINAL_HYPERLINKS = TERMINAL.hyperlinks;
 let policyGeneration = 0;
+let activeMode: HyperlinkMode = "auto";
 const OSC8_RE = /\x1b\]8;[^\x07\x1b]*(?:\x07|\x1b\\)/gu;
 const UNSAFE_RE = /[\x00-\x1f\x7f-\x9f]/u;
 type HyperlinkMode = "off" | "auto" | "always";
@@ -28,6 +29,7 @@ export function isHyperlinkEnabled(): boolean {
 
 export function applyHyperlinkSetting(mode?: unknown): void {
 	const resolved = mode === "off" || mode === "auto" || mode === "always" ? mode : settings.get("tui.hyperlinks");
+	activeMode = resolved;
 	const enabled = resolveHyperlinkMode(resolved);
 	if (TERMINAL.hyperlinks !== enabled) policyGeneration++;
 	setTerminalHyperlinks(enabled);
@@ -62,8 +64,19 @@ export function urlHyperlink(target: string, label: string): string {
 }
 
 export function recoveryUrlHyperlink(target: string, label: string): string {
+	const uri = safeRecoveryUrl(target);
+	// Authentication links must remain actionable in nested terminals whose
+	// capability detection is incomplete. Preserve the explicit user opt-out.
+	if (activeMode === "off" || !uri) return label;
+	return `\x1b]8;;${uri}\x07${label.replace(OSC8_RE, "")}\x1b]8;;\x07`;
+}
+
+export function safeRecoveryUrl(target: string): string | undefined {
 	const normalized = /^www\./iu.test(target) ? `https://${target}` : target;
-	return wrap(normalized, label);
+	const uri = safeAbsoluteUri(normalized);
+	if (!uri) return undefined;
+	const protocol = new URL(uri).protocol;
+	return protocol === "http:" || protocol === "https:" ? uri : undefined;
 }
 
 export function fileHyperlink(target: string, label: string, cwd = process.cwd()): string {