@f5xc-salesdemos/xcsh 18.19.0 → 18.19.2

package/CHANGELOG.md

@@ -8,6 +8,7 @@
 ### Fixed
 
 - Fixed gutter width propagation in the fallback tool renderer: `#formatToolExecution()` now receives the actual available width at render-time and uses it for line truncation instead of a hardcoded 80-column limit. On narrow terminals (<82 cols) this prevents content wider than the gutter-adjusted viewport; on wide terminals it allows longer output lines. ([#117](https://github.com/f5xc-salesdemos/xcsh/issues/117))
+- Fixed `resolveConfigValue` returning literal env var names (e.g. `"LITELLM_API_KEY"`) as API keys when the env var is unset, causing 401 errors on first launch. The resolver now rejects unresolved `ALL_CAPS_WITH_UNDERSCORES` patterns, matching the existing guard in `resolveYamlApiKeyConfig`. ([#241](https://github.com/f5xc-salesdemos/xcsh/issues/241))
 
 
 ### Changed

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@f5xc-salesdemos/xcsh",
-	"version": "18.19.0",
+	"version": "18.19.2",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://github.com/f5xc-salesdemos/xcsh",
 	"author": "Can Boluk",
@@ -47,12 +47,12 @@
 	"dependencies": {
 		"@agentclientprotocol/sdk": "0.16.1",
 		"@mozilla/readability": "^0.6",
-		"@f5xc-salesdemos/xcsh-stats": "18.19.0",
-		"@f5xc-salesdemos/pi-agent-core": "18.19.0",
-		"@f5xc-salesdemos/pi-ai": "18.19.0",
-		"@f5xc-salesdemos/pi-natives": "18.19.0",
-		"@f5xc-salesdemos/pi-tui": "18.19.0",
-		"@f5xc-salesdemos/pi-utils": "18.19.0",
+		"@f5xc-salesdemos/xcsh-stats": "18.19.2",
+		"@f5xc-salesdemos/pi-agent-core": "18.19.2",
+		"@f5xc-salesdemos/pi-ai": "18.19.2",
+		"@f5xc-salesdemos/pi-natives": "18.19.2",
+		"@f5xc-salesdemos/pi-tui": "18.19.2",
+		"@f5xc-salesdemos/pi-utils": "18.19.2",
 		"@sinclair/typebox": "^0.34",
 		"@xterm/headless": "^6.0",
 		"ajv": "^8.18",

package/src/config/resolve-config-value.ts

@@ -6,6 +6,14 @@
 
 import { executeShell } from "@f5xc-salesdemos/pi-natives";
 
+/**
+ * Matches strings that look like environment variable names: ALL_CAPS_WITH_UNDERSCORES.
+ * Used to prevent sending literal env var names (e.g. "LITELLM_API_KEY") as Bearer
+ * tokens when the env var is unset. Same pattern as resolveYamlApiKeyConfig in
+ * model-registry.ts.
+ */
+const ENV_VAR_NAME_RE = /^[A-Z][A-Z0-9]*(?:_[A-Z][A-Z0-9]*)+$/;
+
 /** Cache for successful shell command results (persists for process lifetime). */
 const commandResultCache = new Map<string, string>();
 
@@ -15,14 +23,22 @@ const commandInFlight = new Map<string, Promise<string | undefined>>();
 /**
  * Resolve a config value (API key, header value, etc.) to an actual value.
  * - If starts with "!", executes the rest as a shell command and uses stdout (cached)
- * - Otherwise checks environment variable first, then treats as literal (not cached)
+ * - Otherwise checks environment variable first
+ * - If the env var is unset and the config string looks like an env var name
+ *   (ALL_CAPS_WITH_UNDERSCORES), returns undefined to prevent leaking literal
+ *   names as Bearer tokens (see issue #241)
+ * - Otherwise treats the config string as a literal value
  */
 export async function resolveConfigValue(config: string): Promise<string | undefined> {
 	if (config.startsWith("!")) {
 		return await executeCommand(config);
 	}
 	const envValue = process.env[config];
-	return envValue || config;
+	if (envValue) return envValue;
+	// Reject unresolved env var names to prevent sending literal names as API keys.
+	// Actual literal API keys (sk-ant-..., UUIDs, etc.) won't match this pattern.
+	if (ENV_VAR_NAME_RE.test(config)) return undefined;
+	return config;
 }
 
 async function executeCommand(commandConfig: string): Promise<string | undefined> {

package/src/internal-urls/build-info.generated.ts

@@ -17,17 +17,17 @@ export interface BuildInfo {
 }
 
 export const BUILD_INFO: BuildInfo = {
-	"version": "18.19.0",
-	"commit": "fe4ea3cc7fa01646c63e42957272bbf427c1e9e8",
-	"shortCommit": "fe4ea3c",
+	"version": "18.19.2",
+	"commit": "aadf3b16536d2269c1e1ff2ee1aefa406c1f4ecc",
+	"shortCommit": "aadf3b1",
 	"branch": "main",
-	"tag": "v18.19.0",
-	"commitDate": "2026-04-27T07:01:24Z",
-	"buildDate": "2026-04-27T07:23:45.386Z",
+	"tag": "v18.19.2",
+	"commitDate": "2026-04-27T21:44:40Z",
+	"buildDate": "2026-04-27T22:06:55.819Z",
 	"dirty": false,
 	"prNumber": "",
 	"repoUrl": "https://github.com/f5xc-salesdemos/xcsh",
 	"repoSlug": "f5xc-salesdemos/xcsh",
-	"commitUrl": "https://github.com/f5xc-salesdemos/xcsh/commit/fe4ea3cc7fa01646c63e42957272bbf427c1e9e8",
-	"releaseUrl": "https://github.com/f5xc-salesdemos/xcsh/releases/tag/v18.19.0"
+	"commitUrl": "https://github.com/f5xc-salesdemos/xcsh/commit/aadf3b16536d2269c1e1ff2ee1aefa406c1f4ecc",
+	"releaseUrl": "https://github.com/f5xc-salesdemos/xcsh/releases/tag/v18.19.2"
 };