@f5-sales-demo/xcsh 22.13.2 → 22.14.0

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@f5-sales-demo/xcsh",
-	"version": "22.13.2",
+	"version": "22.14.0",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://github.com/f5-sales-demo/xcsh",
 	"author": "Can Boluk",
@@ -68,13 +68,13 @@
 	},
 	"dependencies": {
 		"@agentclientprotocol/sdk": "1.4.0",
-		"@f5-sales-demo/pi-agent-core": "22.13.2",
-		"@f5-sales-demo/pi-ai": "22.13.2",
-		"@f5-sales-demo/pi-natives": "22.13.2",
-		"@f5-sales-demo/pi-resource-management": "22.13.2",
-		"@f5-sales-demo/pi-tui": "22.13.2",
-		"@f5-sales-demo/pi-utils": "22.13.2",
-		"@f5-sales-demo/xcsh-stats": "22.13.2",
+		"@f5-sales-demo/pi-agent-core": "22.14.0",
+		"@f5-sales-demo/pi-ai": "22.14.0",
+		"@f5-sales-demo/pi-natives": "22.14.0",
+		"@f5-sales-demo/pi-resource-management": "22.14.0",
+		"@f5-sales-demo/pi-tui": "22.14.0",
+		"@f5-sales-demo/pi-utils": "22.14.0",
+		"@f5-sales-demo/xcsh-stats": "22.14.0",
 		"@mozilla/readability": "^0.6",
 		"@resvg/resvg-wasm": "2.6.2",
 		"@sinclair/typebox": "0.34.52",

package/src/cli/args.ts

@@ -28,6 +28,7 @@ export interface Args {
 	allowPath?: string[];
 	provider?: string;
 	context?: string;
+	contextSource?: "local" | "global";
 	model?: string;
 	smol?: string;
 	slow?: string;
@@ -100,6 +101,9 @@ const APPLY: Record<LaunchFlagName, (result: Args, value: string | true) => void
 	provider: (r, v) => {
 		r.provider = v as string;
 	},
+	"context-source": (r, v) => {
+		r.contextSource = v as "local" | "global";
+	},
 	context: (r, v) => {
 		r.context = v as string;
 	},

package/src/cli/flag-spec.ts

@@ -46,6 +46,7 @@ export const LAUNCH_FLAGS = defineFlags({
 	slow: { arity: "value", description: "Slow/reasoning model for thorough analysis (or PI_SLOW_MODEL env)" },
 	plan: { arity: "value", description: "Plan model for architectural planning (or PI_PLAN_MODEL env)" },
 	provider: { arity: "value", description: "Provider to use (legacy; prefer --model)" },
+	"context-source": { arity: "value", description: "Context storage source", options: ["local", "global"] },
 	context: { arity: "value", description: "Bind this session to a named F5 XC context" },
 	"api-key": { arity: "value", description: "API key (defaults to env vars)" },
 	"system-prompt": { arity: "value", description: "System prompt (default: coding assistant prompt)" },

package/src/cli.ts

@@ -53,6 +53,8 @@ if (Bun.stringWidth("\x1b[0m\x1b]8;;\x07") !== 0) {
 process.title = APP_NAME;
 
 const commands: CommandEntry[] = [
+	{ name: "context", load: () => import("./commands/context").then(m => m.default) },
+	{ name: "blindfold", load: () => import("./commands/blindfold").then(m => m.default) },
 	{ name: "remote-control", load: () => import("./commands/remote-control").then(m => m.default) },
 	{ name: "apply", load: () => import("./commands/apply").then(m => m.default) },
 	{ name: "launch", load: () => import("./commands/launch").then(m => m.default) },
@@ -217,6 +219,17 @@ if (process.env.XCSH_SMOKE_TEST_QMD === "1") {
 	}
 }
 
+if (process.env.XCSH_MEASURE_DOCUMENTATION_REQUESTS) {
+	try {
+		const { runDocumentationMeasurement } = await import("./documentation-measurement");
+		process.stdout.write(`${await runDocumentationMeasurement(process.env.XCSH_MEASURE_DOCUMENTATION_REQUESTS)}\n`);
+		process.exit(0);
+	} catch (error) {
+		process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+		process.exit(1);
+	}
+}
+
 if (process.env.XCSH_MEASURE_TERRAFORM_REQUESTS) {
 	try {
 		const { runTerraformMeasurement } = await import("./terraform-measurement");

package/src/commands/blindfold.ts

@@ -0,0 +1,80 @@
+import { Args, Command, Flags } from "@f5-sales-demo/pi-utils/cli";
+import { Settings } from "../config/settings";
+import { BLINDFOLD_OPERATIONS, type BlindfoldOperation, BlindfoldService } from "../services/blindfold";
+import { ContextService } from "../services/xcsh-context";
+
+export default class Blindfold extends Command {
+	static description = "Encrypt secrets natively and create or rotate tenant TLS certificates";
+	static args = {
+		operation: Args.string({
+			required: true,
+			options: [...BLINDFOLD_OPERATIONS],
+			description: "public-key, policy, encrypt, certificate, create, or replace",
+		}),
+	};
+	static flags = {
+		input: Flags.string({ description: "Secret file to encrypt" }),
+		cert: Flags.string({ description: "PEM certificate chain" }),
+		key: Flags.string({ description: "PEM private key" }),
+		bundle: Flags.string({ description: "PKCS#12 .p12/.pfx bundle" }),
+		name: Flags.string({ description: "Certificate resource name" }),
+		namespace: Flags.string({ char: "n", description: "Certificate namespace; defaults to XCSH_NAMESPACE" }),
+		policy: Flags.string({ description: "Secret policy namespace/name", default: "shared/ves-io-allow-volterra" }),
+		"passphrase-env": Flags.string({
+			description: "Name of an environment variable containing the input passphrase",
+		}),
+		"context-name": Flags.string({ description: "Expected active context; fail if different" }),
+		"output-file": Flags.string({ description: "Create a new encrypted artifact or public material file (0600)" }),
+		"result-file": Flags.string({ description: "Create a new JSON report (0600)" }),
+		"dry-run": Flags.string({ description: "Validate without tenant writes", options: ["client"] }),
+		json: Flags.boolean({ description: "Print the public JSON report" }),
+	};
+	async run(): Promise<void> {
+		const { args, flags } = await this.parse(Blindfold);
+		let context: ContextService | undefined;
+		const controller = new AbortController();
+		const cancel = () => controller.abort();
+		process.once("SIGINT", cancel);
+		try {
+			await Settings.init({ cwd: process.cwd() });
+			context = await ContextService.getOrInit(undefined, process.cwd());
+			const env = {
+				...(Settings.instance.get("bash.environment") as Record<string, string> | undefined),
+				...process.env,
+			};
+			const service = new BlindfoldService({
+				env,
+				emit: content => {
+					if (!flags.json && !flags["output-file"]) process.stdout.write(content);
+				},
+			});
+			const report = await service.run(
+				{
+					operation: args.operation as BlindfoldOperation,
+					input: flags.input,
+					cert: flags.cert,
+					key: flags.key,
+					bundle: flags.bundle,
+					name: flags.name,
+					namespace: flags.namespace,
+					policy: flags.policy,
+					passphraseEnv: flags["passphrase-env"],
+					contextName: flags["context-name"],
+					outputFile: flags["output-file"],
+					resultFile: flags["result-file"],
+					dryRun: flags["dry-run"] as "client" | undefined,
+				},
+				{ signal: controller.signal },
+			);
+			if (flags.json || flags["output-file"] || ["create", "replace"].includes(report.operation))
+				process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+			context.stopRevalidation();
+		} catch (error) {
+			process.stderr.write(`Blindfold: ${error instanceof Error ? error.message : "operation failed"}\n`);
+			process.exitCode = 1;
+		} finally {
+			context?.stopRevalidation();
+			process.removeListener("SIGINT", cancel);
+		}
+	}
+}

package/src/commands/context.ts

@@ -0,0 +1,119 @@
+import * as fs from "node:fs";
+import { getProjectDir, getXCSHConfigDir } from "@f5-sales-demo/pi-utils";
+import { Args, CliUsageError, Command, Flags } from "@f5-sales-demo/pi-utils/cli";
+import { Settings } from "../config/settings";
+import { CONTEXT_ACTIONS, type ContextAction, executeContextOperation } from "../services/context-operations";
+import { ContextError, ContextService } from "../services/xcsh-context";
+
+export default class Context extends Command {
+	static description = "Manage saved F5 XC contexts without menus or model inference";
+	static args = {
+		action: Args.string({ options: CONTEXT_ACTIONS }),
+		target: Args.string({ description: "Explicit context name (import: file or - for stdin)" }),
+		value: Args.string({ description: "Create URL, rename name, link global name, or environment action" }),
+		values: Args.string({ multiple: true, description: "Environment assignments or names" }),
+	};
+	static flags = {
+		json: Flags.boolean({ description: "Emit structured JSON" }),
+		source: Flags.string({ options: ["local", "global"], default: "global" }),
+		url: Flags.string({ description: "Replacement HTTPS tenant endpoint" }),
+		namespace: Flags.string({ description: "Saved default namespace" }),
+		"token-stdin": Flags.boolean({ description: "Read a replacement API token from stdin" }),
+		confirm: Flags.boolean({ description: "Required for deletion" }),
+		overwrite: Flags.boolean({ description: "Replace conflicting global contexts during import" }),
+		"include-token": Flags.boolean({ description: "Explicitly include secrets in exported bundle" }),
+	};
+	async run(): Promise<void> {
+		const { args, flags } = await this.parse(Context);
+		const action = (args.action ?? "list") as ContextAction;
+		const target = args.target ? { name: args.target, source: flags.source as "local" | "global" } : undefined;
+		if (!["list", "import", "export"].includes(action) && !target)
+			throw new CliUsageError(`context ${action} requires a target`);
+		if (action === "create" && (!(args.value ?? flags.url) || !flags["token-stdin"]))
+			throw new CliUsageError("context create requires NAME URL --token-stdin");
+		if (action === "edit" && !flags.url && !flags["token-stdin"] && flags.namespace === undefined)
+			throw new CliUsageError("context edit requires --url, --namespace or --token-stdin");
+		if ((action === "rename" || action === "link") && !args.value)
+			throw new CliUsageError(`context ${action} requires a second name`);
+		if (action === "delete" && !flags.confirm) throw new CliUsageError("context delete requires --confirm");
+		if (action === "import" && !args.target) throw new CliUsageError("context import requires FILE or -");
+		if (flags["token-stdin"] && !["create", "edit"].includes(action))
+			throw new CliUsageError("--token-stdin applies only to create/edit");
+		if (flags["include-token"] && action !== "export")
+			throw new CliUsageError("--include-token applies only to export");
+		if (flags.overwrite && action !== "import") throw new CliUsageError("--overwrite applies only to import");
+		if (args.values?.length && action !== "env") throw new CliUsageError("Unexpected arguments");
+		if (args.value && !["create", "rename", "link", "env"].includes(action))
+			throw new CliUsageError("Unexpected argument");
+		let env: Record<string, string> | undefined;
+		let unset: string[] | undefined;
+		if (action === "env" && args.value) {
+			if (args.value === "set") {
+				if (!args.values?.length) throw new CliUsageError("context env NAME set requires KEY=VALUE");
+				env = {};
+				for (const assignment of args.values) {
+					const index = assignment.indexOf("=");
+					if (index < 1) throw new CliUsageError("Expected KEY=VALUE");
+					env[assignment.slice(0, index)] = assignment.slice(index + 1);
+				}
+			} else if (args.value === "unset") {
+				if (!args.values?.length) throw new CliUsageError("context env NAME unset requires keys");
+				unset = args.values;
+			} else if (args.value !== "list") throw new CliUsageError("context env action must be list, set or unset");
+		}
+		try {
+			let bundle: unknown;
+			if (action === "import") {
+				const bytes =
+					args.target === "-"
+						? await new Response(Bun.stdin.stream()).text()
+						: fs.readFileSync(args.target!, "utf8");
+				try {
+					bundle = JSON.parse(bytes);
+				} catch {
+					throw new Error("Import must contain valid JSON.");
+				}
+			}
+			const apiToken = flags["token-stdin"]
+				? (await new Response(Bun.stdin.stream()).text()).replace(/\r?\n$/, "")
+				: undefined;
+			if (apiToken !== undefined && (!apiToken || /[\r\n]/.test(apiToken)))
+				throw new CliUsageError("Token stdin must contain one non-empty line.");
+			await Settings.init({ cwd: getProjectDir(), inMemory: true });
+			const service = ContextService.init(getXCSHConfigDir());
+			const result = await executeContextOperation(
+				service,
+				{
+					action,
+					target,
+					newName: args.value,
+					apiUrl: flags.url ?? (action === "create" ? args.value : undefined),
+					apiToken,
+					namespace: flags.namespace,
+					confirm: flags.confirm,
+					includeToken: flags["include-token"],
+					overwrite: flags.overwrite,
+					bundle,
+					env,
+					unset,
+				},
+				getProjectDir(),
+			);
+			if (result && typeof result === "object" && "status" in result && result.status !== "connected")
+				process.exitCode = 1;
+			if (flags.json || action === "export") process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+			else if (Array.isArray(result))
+				for (const choice of result)
+					process.stdout.write(
+						`${choice.target.name} (${choice.target.source}) · ${choice.context?.apiUrl ?? choice.error}\n`,
+					);
+			else process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+		} catch (error) {
+			if (error instanceof CliUsageError) throw error;
+			process.stderr.write(
+				`Error: ${error instanceof ContextError ? error.message : "Context operation failed. Check the target, input and file permissions."}\n`,
+			);
+			process.exitCode = 1;
+		}
+	}
+}

package/src/config/keybindings.ts

@@ -27,6 +27,7 @@ interface AppKeybindings {
 	"app.model.select": true;
 	"app.model.selectTemporary": true;
 	"app.tools.expand": true;
+	"app.context.actions": true;
 	"app.editor.external": true;
 	"app.message.followUp": true;
 	"app.message.dequeue": true;
@@ -100,6 +101,7 @@ export const KEYBINDINGS = {
 		defaultKeys: "alt+p",
 		description: "Select temporary model for current session",
 	},
+	"app.context.actions": { defaultKeys: "ctrl+o", description: "Open selected context actions in the context picker" },
 	"app.tools.expand": {
 		defaultKeys: "ctrl+o",
 		description: "Expand tools",

package/src/config/settings-schema.ts

@@ -2139,6 +2139,7 @@ export const SETTINGS_SCHEMA = {
 	"bash.environment": { type: "record", default: {} as Record<string, string> },
 
 	/** Sensitive env var key names from the active xcsh context (populated by ContextService) */
+	"xcsh.contextSource": { type: "enum", values: ["local", "global"] as const, default: "global" },
 	"xcsh.sensitiveKeys": { type: "array", default: [] as string[] },
 
 	/** Clear terminal on startup */

package/src/config/settings.ts

@@ -33,6 +33,7 @@ import {
 	setForceSlot,
 	setSymbolPreset,
 } from "../modes/theme/theme";
+import { currentContextExecution } from "../services/context-execution";
 import { AgentStorage } from "../session/agent-storage";
 import { applyHyperlinkSetting } from "../tui/hyperlink";
 import { type EditMode, normalizeEditMode } from "../utils/edit-mode";
@@ -232,6 +233,10 @@ export class Settings {
 	 * Returns the merged value from global + project + overrides, or the default.
 	 */
 	get<P extends SettingPath>(path: P): SettingValue<P> {
+		const execution = currentContextExecution();
+		if (execution && path === "bash.environment") return execution.environment as SettingValue<P>;
+		if (execution && path === "xcsh.sensitiveKeys") return execution.sensitiveKeys as SettingValue<P>;
+		if (execution && path === "xcsh.contextSource") return execution.source as SettingValue<P>;
 		const segments = path.split(".");
 		const value = getByPath(this.#merged, segments);
 		if (value !== undefined) {

package/src/documentation-measurement.ts

@@ -0,0 +1,84 @@
+import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { BUILD_INFO } from "./internal-urls/build-info.generated";
+import { EMBEDDED_DOCUMENTATION_ASSETS } from "./internal-urls/documentation-assets.generated";
+import { createEmbeddedDocumentationRepository } from "./internal-urls/documentation-repository";
+import { createDocumentationResolver } from "./internal-urls/documentation-resolve";
+import type { InternalUrl } from "./internal-urls/types";
+
+function hash(text: string | Uint8Array): string {
+	return createHash("sha256").update(text).digest("hex");
+}
+export function validateDocumentationMeasurementRequests(input: unknown): string[] {
+	if (!Array.isArray(input) || input.length < 1 || input.length > 10000 || input.some(uri => typeof uri !== "string"))
+		throw new Error("Measurement requires one to 10000 request URIs");
+	for (const uri of input) {
+		const u = new URL(uri);
+		if (u.protocol !== "xcsh:" || u.host !== "documentation" || u.username || u.password)
+			throw new Error("Measurement requires general documentation URIs");
+	}
+	return input;
+}
+export async function measureDocumentationRequests(
+	input: unknown,
+	read: (uri: string) => Promise<{ content: string }>,
+) {
+	const results = [];
+	for (const request of validateDocumentationMeasurementRequests(input)) {
+		let response = "",
+			context = "",
+			responseHash = "";
+		const times: number[] = [];
+		for (let n = 0; n < 5; n++) {
+			const start = performance.now();
+			response = (await read(request)).content;
+			times.push(performance.now() - start);
+			context = "";
+			const destination = [...response.matchAll(/^(?:- )?Read: `?(xcsh:\/\/[^`\s]+)`?/gm)][0]?.[1];
+			if (destination) {
+				validateDocumentationMeasurementRequests([destination]);
+				context = (await read(destination)).content;
+			}
+			const currentHash = hash(`${response}\0${context}`);
+			if (!n) responseHash = currentHash;
+			else if (currentHash !== responseHash) throw new Error("Non-deterministic complete retrieval response");
+		}
+		results.push({ request, response, context, response_sha256: responseHash, times_ms: times });
+	}
+	return results;
+}
+export async function runDocumentationMeasurement(requestFile: string): Promise<string> {
+	const assets = EMBEDDED_DOCUMENTATION_ASSETS;
+	if (!assets) throw new Error("Measurement requires embedded documentation");
+	const bytes = await readFile(requestFile);
+	if (bytes.length > 4 * 1024 * 1024) throw new Error("Measurement request file exceeds 4 MiB");
+	const repository = createEmbeddedDocumentationRepository(assets, {
+		cacheRoot: path.join(os.homedir(), ".xcsh/cache/documentation-measurement"),
+	});
+	const start = performance.now();
+	await repository.prime();
+	const materializationMs = performance.now() - start;
+	const resolver = createDocumentationResolver(repository);
+	const results = await measureDocumentationRequests(JSON.parse(bytes.toString()), async uri => {
+		const resource = await resolver.resolve(Object.assign(new URL(uri), { rawHost: "documentation" }) as InternalUrl);
+		if (typeof resource.content !== "string") throw new Error("Measurement requires text resources");
+		return { content: resource.content };
+	});
+	return JSON.stringify({
+		schema_version: 1,
+		installed_resolver: true,
+		regression_only: true,
+		build: BUILD_INFO,
+		release_tag: assets.releaseTag,
+		source_commit: assets.sourceCommit,
+		index_sha256: assets.indexSha256,
+		request_sha256: hash(bytes),
+		platform: os.platform(),
+		arch: os.arch(),
+		repetitions: 5,
+		materialization_ms: materializationMs,
+		results,
+	});
+}