@f5-sales-demo/xcsh 21.5.3 → 21.5.6

package/CHANGELOG.md

@@ -36,6 +36,9 @@
 
 ### Fixed
 
+- Made npm, Bun, and default installer commands execute the exact matching compiled release so
+  licensed Corporate Vertex authentication is available without exposing build credentials in
+  published source ([#3557](https://github.com/f5-sales-demo/xcsh/issues/3557)).
 - Isolated post-publication npm verification in a job-local writable prefix and failed immediately
   for non-registry installation errors
   ([#3375](https://github.com/f5-sales-demo/xcsh/issues/3375)).

package/bin/xcsh.ts

@@ -0,0 +1,19 @@
+#!/usr/bin/env bun
+
+import packageJson from "../package.json" with { type: "json" };
+import { ensureReleaseBinary, getPackageDistributionChannel, runReleaseBinary } from "../src/npm-binary-bootstrap";
+
+async function main(): Promise<void> {
+	const binaryPath = await ensureReleaseBinary({ version: packageJson.version });
+	const result = await runReleaseBinary(binaryPath, process.argv.slice(2), getPackageDistributionChannel(import.meta.dir));
+	if (result.signalCode) {
+		process.kill(process.pid, result.signalCode);
+		return;
+	}
+	process.exitCode = result.exitCode;
+}
+
+main().catch(error => {
+	console.error(`xcsh: ${error instanceof Error ? error.message : String(error)}`);
+	process.exitCode = 1;
+});

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@f5-sales-demo/xcsh",
-	"version": "21.5.3",
+	"version": "21.5.6",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://github.com/f5-sales-demo/xcsh",
 	"author": "Can Boluk",
@@ -28,7 +28,7 @@
 	"main": "./src/index.ts",
 	"types": "./src/index.ts",
 	"bin": {
-		"xcsh": "src/cli.ts"
+		"xcsh": "bin/xcsh.ts"
 	},
 	"scripts": {
 		"prebuild": "bun ../../scripts/check-installed-dependencies.ts",
@@ -61,13 +61,13 @@
 	},
 	"dependencies": {
 		"@agentclientprotocol/sdk": "1.3.0",
-		"@f5-sales-demo/pi-agent-core": "21.5.3",
-		"@f5-sales-demo/pi-ai": "21.5.3",
-		"@f5-sales-demo/pi-natives": "21.5.3",
-		"@f5-sales-demo/pi-resource-management": "21.5.3",
-		"@f5-sales-demo/pi-tui": "21.5.3",
-		"@f5-sales-demo/pi-utils": "21.5.3",
-		"@f5-sales-demo/xcsh-stats": "21.5.3",
+		"@f5-sales-demo/pi-agent-core": "21.5.6",
+		"@f5-sales-demo/pi-ai": "21.5.6",
+		"@f5-sales-demo/pi-natives": "21.5.6",
+		"@f5-sales-demo/pi-resource-management": "21.5.6",
+		"@f5-sales-demo/pi-tui": "21.5.6",
+		"@f5-sales-demo/pi-utils": "21.5.6",
+		"@f5-sales-demo/xcsh-stats": "21.5.6",
 		"@mozilla/readability": "^0.6",
 		"@sinclair/typebox": "^0.34",
 		"@xterm/headless": "^6.0",
@@ -90,6 +90,7 @@
 		"bun": ">=1.3.7"
 	},
 	"files": [
+		"bin",
 		"src",
 		"README.md",
 		"CHANGELOG.md"

package/src/cli/update-cli.ts

@@ -124,12 +124,21 @@ function detectInstallMethod(binPath: string, bunBinDir: string | undefined): In
 	return "binary";
 }
 
-function resolveUpdateMethod(ompPath: string, bunBinDir: string | undefined): InstallMethod {
+function resolveUpdateMethod(
+	ompPath: string,
+	bunBinDir: string | undefined,
+	distributionChannel = process.env.XCSH_DISTRIBUTION_CHANNEL,
+): InstallMethod {
+	if (distributionChannel === "bun" || distributionChannel === "npm") return distributionChannel;
 	return detectInstallMethod(ompPath, bunBinDir);
 }
 
-export function _resolveUpdateMethodForTest(ompPath: string, bunBinDir: string | undefined): InstallMethod {
-	return resolveUpdateMethod(ompPath, bunBinDir);
+export function _resolveUpdateMethodForTest(
+	ompPath: string,
+	bunBinDir: string | undefined,
+	distributionChannel?: string,
+): InstallMethod {
+	return resolveUpdateMethod(ompPath, bunBinDir, distributionChannel);
 }
 async function resolveUpdateTarget(): Promise<UpdateTarget> {
 	const bunBinDir = await getBunGlobalBinDir();

package/src/cli.ts

@@ -181,4 +181,22 @@ if (process.env.XCSH_SMOKE_TEST_SPECS === "1") {
 	process.exit(domainCount > 0 && categoryCount > 0 ? 0 : 1);
 }
 
+// Post-publication verification exercises the licensed build inputs without
+// printing the client, authorization URL, state, challenge, or any credential.
+if (process.env.XCSH_SMOKE_TEST_VERTEX_AUTH === "1") {
+	try {
+		const { createVertexAuthorizationUrl } = await import("@f5-sales-demo/pi-ai/utils/oauth/google-antigravity");
+		const url = new URL(createVertexAuthorizationUrl("release-verification-state", "release-verification-challenge"));
+		const ready =
+			url.protocol === "https:" &&
+			url.searchParams.get("code_challenge_method") === "S256" &&
+			Boolean(url.searchParams.get("client_id"));
+		console.log(ready ? "vertex-auth: ready" : "vertex-auth: unavailable");
+		process.exit(ready ? 0 : 1);
+	} catch {
+		console.log("vertex-auth: unavailable");
+		process.exit(1);
+	}
+}
+
 await runCli(process.argv.slice(2));

package/src/internal-urls/build-info.generated.ts

@@ -17,17 +17,17 @@ export interface BuildInfo {
 }
 
 export const BUILD_INFO: BuildInfo = {
-	"version": "21.5.3",
-	"commit": "2982b9c7546bc3bb1dc9cfbfd89111ef3192f477",
-	"shortCommit": "2982b9c",
+	"version": "21.5.6",
+	"commit": "d3cadfbd84e1ec85fc4f48619ffdabe334164c90",
+	"shortCommit": "d3cadfb",
 	"branch": "main",
-	"tag": "v21.5.3",
-	"commitDate": "2026-09-01T21:00:39+00:00",
-	"buildDate": "2026-09-01T21:40:07.382Z",
+	"tag": "v21.5.6",
+	"commitDate": "2026-09-02T00:45:22+00:00",
+	"buildDate": "2026-09-02T01:15:05.987Z",
 	"dirty": true,
 	"prNumber": "",
 	"repoUrl": "https://github.com/f5-sales-demo/xcsh",
 	"repoSlug": "f5-sales-demo/xcsh",
-	"commitUrl": "https://github.com/f5-sales-demo/xcsh/commit/2982b9c7546bc3bb1dc9cfbfd89111ef3192f477",
-	"releaseUrl": "https://github.com/f5-sales-demo/xcsh/releases/tag/v21.5.3"
+	"commitUrl": "https://github.com/f5-sales-demo/xcsh/commit/d3cadfbd84e1ec85fc4f48619ffdabe334164c90",
+	"releaseUrl": "https://github.com/f5-sales-demo/xcsh/releases/tag/v21.5.6"
 };

package/src/npm-binary-bootstrap.ts

@@ -0,0 +1,185 @@
+import { chmod, mkdir, open, rename, rm, stat } from "node:fs/promises";
+import { homedir, tmpdir } from "node:os";
+import { join } from "node:path";
+
+const RELEASE_REPOSITORY = "f5-sales-demo/xcsh";
+const LOCK_STALE_AFTER_MS = 5 * 60_000;
+const LOCK_WAIT_TIMEOUT_MS = 3 * 60_000;
+
+type FetchLike = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
+
+export interface EnsureReleaseBinaryOptions {
+	version: string;
+	platform?: NodeJS.Platform;
+	arch?: string;
+	cacheRoot?: string;
+	fetchImpl?: FetchLike;
+}
+
+export interface ReleaseBinaryResult {
+	exitCode: number;
+	signalCode?: NodeJS.Signals;
+}
+
+function unsupportedPlatform(platform: string, arch: string): never {
+	throw new Error(
+		`Unsupported xcsh platform: ${platform}/${arch}. Install a supported compiled release from https://github.com/${RELEASE_REPOSITORY}/releases.`,
+	);
+}
+
+export function getReleaseAsset(platform: string, arch: string): string {
+	if (platform === "linux" && (arch === "x64" || arch === "arm64")) return `xcsh-linux-${arch}`;
+	if (platform === "darwin" && (arch === "x64" || arch === "arm64")) return `xcsh-darwin-${arch}`;
+	if (platform === "win32" && arch === "x64") return "xcsh-windows-x64.exe";
+	return unsupportedPlatform(platform, arch);
+}
+
+export function getReleaseDownloadUrl(version: string, asset: string): string {
+	if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(version)) {
+		throw new Error(`Invalid xcsh package version: ${version}`);
+	}
+	return `https://github.com/${RELEASE_REPOSITORY}/releases/download/v${version}/${asset}`;
+}
+
+export function getPackageDistributionChannel(moduleDirectory: string): "bun" | "npm" {
+	const normalized = moduleDirectory.replaceAll("\\", "/").toLowerCase();
+	return normalized.includes("/.bun/") ? "bun" : "npm";
+}
+
+export function getDefaultReleaseCacheRoot(platform: NodeJS.Platform = process.platform): string {
+	if (process.env.XCSH_RELEASE_CACHE_DIR) return process.env.XCSH_RELEASE_CACHE_DIR;
+	if (platform === "win32") {
+		return join(process.env.LOCALAPPDATA || process.env.TEMP || tmpdir(), "xcsh", "releases");
+	}
+	return join(process.env.XDG_CACHE_HOME || join(homedir(), ".cache"), "xcsh", "releases");
+}
+
+export function releaseValidationEnvironment(environment: NodeJS.ProcessEnv): NodeJS.ProcessEnv {
+	const validationEnvironment = { ...environment };
+	delete validationEnvironment.XCSH_SMOKE_TEST_SPECS;
+	delete validationEnvironment.XCSH_SMOKE_TEST_VERTEX_AUTH;
+	return validationEnvironment;
+}
+
+async function validateReleaseBinary(
+	binaryPath: string,
+	version: string,
+): Promise<{ valid: boolean; actual?: string }> {
+	try {
+		if (process.platform !== "win32") await chmod(binaryPath, 0o755);
+		const child = Bun.spawn([binaryPath, "--version"], {
+			stdin: "ignore",
+			stdout: "pipe",
+			stderr: "pipe",
+			env: releaseValidationEnvironment(process.env),
+		});
+		const [exitCode, stdout] = await Promise.all([child.exited, new Response(child.stdout).text()]);
+		if (exitCode !== 0) return { valid: false };
+		const actual = stdout.match(/(?:xcsh\/)?(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)/)?.[1];
+		return { valid: actual === version, actual };
+	} catch {
+		return { valid: false };
+	}
+}
+
+async function cachedBinaryIsValid(binaryPath: string, version: string): Promise<boolean> {
+	return (await validateReleaseBinary(binaryPath, version)).valid;
+}
+
+async function lockIsStale(lockPath: string): Promise<boolean> {
+	try {
+		const lockStat = await stat(lockPath);
+		return Date.now() - lockStat.mtimeMs > LOCK_STALE_AFTER_MS;
+	} catch {
+		return false;
+	}
+}
+
+export async function ensureReleaseBinary(options: EnsureReleaseBinaryOptions): Promise<string> {
+	const platform = options.platform ?? process.platform;
+	const arch = options.arch ?? process.arch;
+	const asset = getReleaseAsset(platform, arch);
+	const cacheRoot = options.cacheRoot ?? getDefaultReleaseCacheRoot(platform);
+	const cacheDirectory = join(cacheRoot, `v${options.version}`, `${platform}-${arch}`);
+	const binaryPath = join(cacheDirectory, asset);
+	const lockPath = `${binaryPath}.lock`;
+	const fetchImpl = options.fetchImpl ?? fetch;
+
+	await mkdir(cacheDirectory, { recursive: true });
+	if (await cachedBinaryIsValid(binaryPath, options.version)) return binaryPath;
+	await rm(binaryPath, { force: true });
+
+	const waitStartedAt = Date.now();
+	let lockHandle: Awaited<ReturnType<typeof open>> | undefined;
+	while (!lockHandle) {
+		try {
+			lockHandle = await open(lockPath, "wx", 0o600);
+		} catch (error) {
+			if ((error as NodeJS.ErrnoException).code !== "EEXIST") throw error;
+			if (await cachedBinaryIsValid(binaryPath, options.version)) return binaryPath;
+			if (await lockIsStale(lockPath)) {
+				await rm(lockPath, { force: true });
+				continue;
+			}
+			if (Date.now() - waitStartedAt >= LOCK_WAIT_TIMEOUT_MS) {
+				throw new Error(`Timed out waiting for the xcsh v${options.version} binary download lock`);
+			}
+			await Bun.sleep(100);
+		}
+	}
+
+	const partialPath = `${binaryPath}.partial-${process.pid}-${crypto.randomUUID()}`;
+	try {
+		if (await cachedBinaryIsValid(binaryPath, options.version)) return binaryPath;
+
+		const downloadUrl = getReleaseDownloadUrl(options.version, asset);
+		const response = await fetchImpl(downloadUrl, { redirect: "follow" });
+		if (!response.ok) {
+			throw new Error(`Failed to download compiled xcsh v${options.version}: HTTP ${response.status}`);
+		}
+		const bytes = await response.arrayBuffer();
+		if (bytes.byteLength === 0) throw new Error(`Downloaded compiled xcsh v${options.version} was empty`);
+		await Bun.write(partialPath, bytes);
+		if (platform !== "win32") await chmod(partialPath, 0o755);
+
+		const validation = await validateReleaseBinary(partialPath, options.version);
+		if (!validation.valid) {
+			const actual = validation.actual ? ` reported version ${validation.actual}` : " could not execute";
+			throw new Error(`Downloaded xcsh${actual}; expected ${options.version}`);
+		}
+
+		await rename(partialPath, binaryPath);
+		return binaryPath;
+	} finally {
+		await rm(partialPath, { force: true });
+		await lockHandle.close();
+		await rm(lockPath, { force: true });
+	}
+}
+
+export async function runReleaseBinary(
+	binaryPath: string,
+	args: string[],
+	distributionChannel: "bun" | "npm" = "npm",
+): Promise<ReleaseBinaryResult> {
+	const child = Bun.spawn([binaryPath, ...args], {
+		stdin: "inherit",
+		stdout: "inherit",
+		stderr: "inherit",
+		env: { ...process.env, XCSH_DISTRIBUTION_CHANNEL: distributionChannel },
+	});
+	const forwardedSignals: NodeJS.Signals[] = ["SIGINT", "SIGTERM", "SIGHUP"];
+	const handlers = new Map<NodeJS.Signals, () => void>();
+	for (const signal of forwardedSignals) {
+		const handler = () => child.kill(signal);
+		handlers.set(signal, handler);
+		process.on(signal, handler);
+	}
+
+	try {
+		const exitCode = await child.exited;
+		return { exitCode, signalCode: (child.signalCode as NodeJS.Signals | null) ?? undefined };
+	} finally {
+		for (const [signal, handler] of handlers) process.off(signal, handler);
+	}
+}