@f5xc-salesdemos/xcsh 18.68.0 → 18.70.0

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@f5xc-salesdemos/xcsh",
-	"version": "18.68.0",
+	"version": "18.70.0",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://github.com/f5xc-salesdemos/xcsh",
 	"author": "Can Boluk",
@@ -48,12 +48,12 @@
 	"dependencies": {
 		"@agentclientprotocol/sdk": "0.16.1",
 		"@mozilla/readability": "^0.6",
-		"@f5xc-salesdemos/xcsh-stats": "18.68.0",
-		"@f5xc-salesdemos/pi-agent-core": "18.68.0",
-		"@f5xc-salesdemos/pi-ai": "18.68.0",
-		"@f5xc-salesdemos/pi-natives": "18.68.0",
-		"@f5xc-salesdemos/pi-tui": "18.68.0",
-		"@f5xc-salesdemos/pi-utils": "18.68.0",
+		"@f5xc-salesdemos/xcsh-stats": "18.70.0",
+		"@f5xc-salesdemos/pi-agent-core": "18.70.0",
+		"@f5xc-salesdemos/pi-ai": "18.70.0",
+		"@f5xc-salesdemos/pi-natives": "18.70.0",
+		"@f5xc-salesdemos/pi-tui": "18.70.0",
+		"@f5xc-salesdemos/pi-utils": "18.70.0",
 		"@sinclair/typebox": "^0.34",
 		"@xterm/headless": "^6.0",
 		"ajv": "^8.18",

package/src/internal-urls/build-info.generated.ts

@@ -17,17 +17,17 @@ export interface BuildInfo {
 }
 
 export const BUILD_INFO: BuildInfo = {
-	"version": "18.68.0",
-	"commit": "27ddc863792ce7bba1ab75066abeca95cafca4d4",
-	"shortCommit": "27ddc86",
+	"version": "18.70.0",
+	"commit": "34f16142c582f937c72feae361239b82a67657df",
+	"shortCommit": "34f1614",
 	"branch": "main",
-	"tag": "v18.68.0",
-	"commitDate": "2026-05-18T17:51:04Z",
-	"buildDate": "2026-05-18T18:22:44.227Z",
+	"tag": "v18.70.0",
+	"commitDate": "2026-05-19T06:13:53Z",
+	"buildDate": "2026-05-19T06:39:53.619Z",
 	"dirty": false,
 	"prNumber": "",
 	"repoUrl": "https://github.com/f5xc-salesdemos/xcsh",
 	"repoSlug": "f5xc-salesdemos/xcsh",
-	"commitUrl": "https://github.com/f5xc-salesdemos/xcsh/commit/27ddc863792ce7bba1ab75066abeca95cafca4d4",
-	"releaseUrl": "https://github.com/f5xc-salesdemos/xcsh/releases/tag/v18.68.0"
+	"commitUrl": "https://github.com/f5xc-salesdemos/xcsh/commit/34f16142c582f937c72feae361239b82a67657df",
+	"releaseUrl": "https://github.com/f5xc-salesdemos/xcsh/releases/tag/v18.70.0"
 };

package/src/pipeline-report/benchmark.ts

@@ -0,0 +1,405 @@
+/**
+ * pipeline-report/benchmark.ts
+ *
+ * Autoresearch benchmark harness for the pipeline report.
+ * Generates a real pipeline report against the live Salesforce org
+ * and scores it deterministically across 6 quality dimensions.
+ *
+ * Primary metric: report_quality_score (0–100, higher is better)
+ *
+ * OFF LIMITS to autoresearch modifications — this is the ground-truth evaluator.
+ */
+
+import { loadSalesforceContext } from "../internal-urls/salesforce-context";
+import { loadProfile } from "../internal-urls/user-profile";
+import { generatePipelineReport } from "./generator";
+import { renderPipelineReport } from "./renderer";
+import type { PipelineReportData } from "./types";
+
+// ─── Fiscal quarter helpers ───────────────────────────────────────────
+// F5 fiscal year starts November 1. Quarters:
+//   Q1: Nov–Jan   Q2: Feb–Apr   Q3: May–Jul   Q4: Aug–Oct
+
+function fiscalQuarterDates(): { start: string; end: string } {
+	const now = new Date();
+	const m = now.getMonth(); // 0-indexed
+	const y = now.getFullYear();
+
+	let start: Date;
+	let end: Date;
+
+	if (m >= 10) {
+		// Nov–Dec → Q1 starts this year Nov, ends Jan next year
+		start = new Date(y, 10, 1);
+		end = new Date(y + 1, 1, 0);
+	} else if (m === 0) {
+		// Jan → still Q1 (Nov prev year – Jan this year)
+		start = new Date(y - 1, 10, 1);
+		end = new Date(y, 1, 0);
+	} else if (m <= 3) {
+		// Feb–Apr → Q2
+		start = new Date(y, 1, 1);
+		end = new Date(y, 4, 0);
+	} else if (m <= 6) {
+		// May–Jul → Q3
+		start = new Date(y, 4, 1);
+		end = new Date(y, 7, 0);
+	} else {
+		// Aug–Oct → Q4
+		start = new Date(y, 7, 1);
+		end = new Date(y, 10, 0);
+	}
+
+	const fmt = (d: Date) => d.toISOString().split("T")[0]!;
+	return { start: fmt(start), end: fmt(end) };
+}
+
+// ─── Scoring helpers ──────────────────────────────────────────────────
+
+interface DimScore {
+	score: number;
+	max: number;
+	notes: string[];
+}
+
+function scoreSectionPresence(report: string): DimScore {
+	const checks: Array<{ re: RegExp; label: string; pts: number }> = [
+		{ re: /^# F5 Distributed Cloud Pipeline Report/m, label: "report header", pts: 2 },
+		{ re: /\*\*Generated:\*\*/m, label: "generated timestamp", pts: 2 },
+		{ re: /\*\*Quarter:\*\*/m, label: "quarter range", pts: 2 },
+		{ re: /\*\*Summary:\*\*/m, label: "executive summary", pts: 3 },
+		{ re: /Closed.*Booked/m, label: "booked section", pts: 3 },
+		{ re: /Open Pipeline.*Net New/m, label: "net new section", pts: 3 },
+		{ re: /Open Pipeline.*Renewals/m, label: "renewals section", pts: 3 },
+		{ re: /Forecast Summary/m, label: "forecast summary", pts: 3 },
+		{ re: /\*\*Line items:\*\*/m, label: "line item count", pts: 1 },
+		{ re: /\*\*SKUs:\*\*/m, label: "SKU count", pts: 1 },
+		{ re: /\*\*Model:\*\*/m, label: "value model description", pts: 1 },
+	];
+	let score = 0;
+	let max = 0;
+	const notes: string[] = [];
+	for (const c of checks) {
+		max += c.pts;
+		if (c.re.test(report)) {
+			score += c.pts;
+		} else {
+			notes.push(`Missing: ${c.label}`);
+		}
+	}
+	return { score, max, notes };
+}
+
+function scoreDollarFormatting(report: string): DimScore {
+	const notes: string[] = [];
+	let score = 0;
+	const max = 20;
+
+	// Compact dollar amounts in summaries ($1.2M, $45K)
+	if (/\$[\d,.]+[MK]\b/.test(report)) {
+		score += 5;
+	} else {
+		notes.push("No compact dollar amounts ($XM/$XK) in summary lines");
+	}
+
+	// Precise dollar amounts in tables (1,234.56)
+	if (/[\d,]+\.\d{2}/.test(report)) {
+		score += 5;
+	} else {
+		notes.push("No precise dollar amounts (X,XXX.XX) in tables");
+	}
+
+	// Em-dash (—) for zero values instead of literal $0
+	if (/\|\s*—\s*\|/.test(report)) {
+		score += 3;
+	}
+
+	// No unformatted large numbers in table context
+	const rawLarge = [...(report.matchAll(/(?<!\$)(?<!\d[,.])\b\d{5,}\b(?!\.\d{2})(?![MK%])/g) ?? [])].filter(m => {
+		const ctx = report.slice(Math.max(0, m.index! - 20), m.index! + m[0].length + 20);
+		return ctx.includes("|");
+	});
+	if (rawLarge.length === 0) {
+		score += 4;
+	} else {
+		notes.push(`${rawLarge.length} unformatted large number(s) in table context`);
+	}
+
+	// No undefined/null/NaN in output
+	const badValues = (report.match(/\bundefined\b|\bnull\b|\bNaN\b/g) ?? []).length;
+	if (badValues === 0) {
+		score += 3;
+	} else {
+		notes.push(`${badValues} occurrence(s) of undefined/null/NaN in output`);
+	}
+
+	return { score, max, notes };
+}
+
+function scoreDateFormatting(report: string): DimScore {
+	const notes: string[] = [];
+	let score = 0;
+	const max = 10;
+
+	// Generated timestamp: human-readable, not raw ISO
+	const generatedMatch = report.match(/\*\*Generated:\*\*\s*(.+)/);
+	if (generatedMatch) {
+		const d = generatedMatch[1]!.trim();
+		if (/^\d{4}-\d{2}-\d{2}T/.test(d)) {
+			notes.push("Generated date uses raw ISO 8601 (should be locale string)");
+		} else {
+			score += 3;
+		}
+	}
+
+	// Quarter line present and reasonably readable
+	const quarterMatch = report.match(/\*\*Quarter:\*\*\s*(.+)/);
+	if (quarterMatch) {
+		score += quarterMatch[1]!.includes("-") ? 3 : 4;
+	}
+
+	// No raw ISO timestamps (2026-05-18T...) in the report body
+	const rawTs = (report.match(/\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}/g) ?? []).length;
+	if (rawTs === 0) {
+		score += 3;
+	} else {
+		notes.push(`${rawTs} raw ISO timestamp(s) in report body`);
+	}
+
+	return { score, max, notes };
+}
+
+function scoreTableQuality(report: string): DimScore {
+	const notes: string[] = [];
+	let score = 0;
+	const max = 15;
+
+	const tables = report.match(/\|.+\|[\n\r]+\|[-:|]+\|/g) ?? [];
+	if (tables.length === 0) {
+		notes.push("No properly formatted markdown tables found");
+		return { score: 0, max, notes };
+	}
+	score += 3;
+
+	// All tables have separator rows (already implied by regex, this checks alignment chars)
+	const hasRightAlign = /---:\|/.test(report);
+	if (hasRightAlign) {
+		score += 3;
+	} else {
+		notes.push("No right-aligned columns (amounts should be right-aligned with ---:|)");
+	}
+
+	// Tables have left-aligned label columns
+	if (/:---\|/.test(report)) {
+		score += 3;
+	}
+
+	// Territory grouping separators (bold em-dash rows)
+	if (/\*\*.*—.*\*\*/.test(report)) {
+		score += 3;
+	}
+
+	// Total rows (bold)
+	if (/\|\s*\*\*Total\*\*\s*\|/.test(report)) {
+		score += 3;
+	} else {
+		notes.push("No bold Total rows in tables");
+	}
+
+	return { score, max, notes };
+}
+
+function scoreDataDensity(data: PipelineReportData, report: string): DimScore {
+	const notes: string[] = [];
+	let score = 0;
+	const max = 20;
+
+	if (data.lineItemCount > 0) {
+		score += 4;
+	} else {
+		notes.push("Zero line items processed");
+	}
+
+	const totalAccounts = data.netNew.accounts.length + data.booked.accounts.length + data.renewals.accounts.length;
+	if (totalAccounts > 0) {
+		score += 4;
+	} else {
+		notes.push("No accounts in any section");
+	}
+
+	const fc = data.forecast;
+	const fcCount = [fc.commit, fc.bestCase, fc.pipeline].filter(v => v > 0).length;
+	score += Math.min(5, fcCount * 2);
+	if (fcCount === 0) {
+		notes.push("No forecast category amounts populated");
+	}
+
+	if (data.skusFound.length > 0) {
+		score += 3;
+	} else {
+		notes.push("No SKUs discovered");
+	}
+
+	// Anomaly detection running (even 0 anomalies means the engine ran)
+	score += 2;
+	if (data.anomalies.length > 0 && /Data Quality/.test(report)) {
+		score += 2;
+	}
+
+	return { score, max, notes };
+}
+
+function scoreInformationValue(report: string): DimScore {
+	const notes: string[] = [];
+	let score = 0;
+	const max = 10;
+
+	// Quota total callouts (actionable for sales professionals)
+	if (/Quota Total/i.test(report)) {
+		score += 3;
+	} else {
+		notes.push("No quota total callouts");
+	}
+
+	// Forecast category breakdown visible (Commit, Best Case, Pipeline)
+	if (/Commit/m.test(report) && /Best Case/m.test(report)) {
+		score += 2;
+	}
+
+	// Platform vs Point product split (critical for overlay SE reporting)
+	if (/Platform.*Distributed Cloud/m.test(report) || /Point.*Shape/m.test(report)) {
+		score += 3;
+	} else {
+		notes.push("Platform/Point product split not visible");
+	}
+
+	// Territory context present
+	if (/Territories:/m.test(report) || /Territory/m.test(report)) {
+		score += 2;
+	}
+
+	return { score, max, notes };
+}
+
+// ─── Main ─────────────────────────────────────────────────────────────
+
+const profile = await loadProfile();
+const sfContext = await loadSalesforceContext();
+
+if (!profile.identifiers?.salesforceId) {
+	console.error("ERROR: No salesforceId in user profile. Run: xcsh://salesforce?refresh=true");
+	process.exit(1);
+}
+
+if (!sfContext) {
+	console.error("ERROR: No cached Salesforce context. Run: xcsh://salesforce?refresh=true");
+	process.exit(1);
+}
+
+const userId = profile.identifiers.salesforceId;
+const partnerId = profile.partner?.id;
+const userIds = partnerId ? [userId, partnerId] : [userId];
+const { start, end } = fiscalQuarterDates();
+
+// Stale cutoff: 12 months ago to include non-stale pipeline beyond current quarter
+const staleDate = new Date();
+staleDate.setFullYear(staleDate.getFullYear() - 1);
+const staleCutoff = staleDate.toISOString().split("T")[0]!;
+
+const partnerName = profile.partner?.name;
+const selfName = [profile.givenName, profile.familyName].filter(Boolean).join(" ").trim();
+const teamMemberNames = partnerName && selfName ? [selfName, partnerName] : undefined;
+
+const options = {
+	userIds,
+	orgAlias: sfContext.orgAlias,
+	quarterStart: start,
+	quarterEnd: end,
+	staleCutoff,
+	confirmedTerritories: profile.territories ?? sfContext.confirmedTerritories ?? sfContext.territories,
+	teamMemberNames,
+};
+
+// ─── Generate and time ────────────────────────────────────────────────
+
+const genStart = performance.now();
+const data = await generatePipelineReport(options);
+const generateMs = Math.round(performance.now() - genStart);
+
+const renderStart = performance.now();
+const report = renderPipelineReport(data, sfContext.instanceUrl);
+const renderMs = Math.round(performance.now() - renderStart);
+
+const totalMs = generateMs + renderMs;
+
+// ─── Score ────────────────────────────────────────────────────────────
+
+const sections = scoreSectionPresence(report);
+const dollars = scoreDollarFormatting(report);
+const dates = scoreDateFormatting(report);
+const tables = scoreTableQuality(report);
+const density = scoreDataDensity(data, report);
+const infoVal = scoreInformationValue(report);
+
+const rawScore = sections.score + dollars.score + dates.score + tables.score + density.score + infoVal.score;
+const rawMax = sections.max + dollars.max + dates.max + tables.max + density.max + infoVal.max;
+const qualityScore = Math.round((rawScore / rawMax) * 100);
+
+const dataCompletenessPct = Math.round(
+	([
+		data.generated,
+		data.quarter.start,
+		data.quarter.end,
+		data.lineItemCount > 0,
+		data.skusFound.length > 0,
+		data.netNew.accounts.length > 0 || data.booked.accounts.length > 0,
+		data.forecast.commit > 0 || data.forecast.bestCase > 0 || data.forecast.pipeline > 0,
+		data.territories.length > 0,
+	].filter(Boolean).length /
+		8) *
+		100,
+);
+
+// Baseline generator makes 3 queries: net new + booked (parallel) + renewals (sequential)
+const queryCount = 3;
+
+const totalAccounts = data.netNew.accounts.length + data.booked.accounts.length + data.renewals.accounts.length;
+
+// ─── Output METRIC lines ──────────────────────────────────────────────
+
+console.log(`METRIC report_quality_score=${qualityScore}`);
+console.log(`METRIC query_count=${queryCount}`);
+console.log(`METRIC total_time_ms=${totalMs}`);
+console.log(`METRIC generate_time_ms=${generateMs}`);
+console.log(`METRIC render_time_ms=${renderMs}`);
+console.log(`METRIC data_completeness_pct=${dataCompletenessPct}`);
+console.log(`METRIC section_score=${sections.score}`);
+console.log(`METRIC dollar_format_score=${dollars.score}`);
+console.log(`METRIC date_format_score=${dates.score}`);
+console.log(`METRIC table_alignment_score=${tables.score}`);
+console.log(`METRIC data_density_score=${density.score}`);
+console.log(`METRIC info_value_score=${infoVal.score}`);
+console.log(`METRIC line_item_count=${data.lineItemCount}`);
+console.log(`METRIC account_count=${totalAccounts}`);
+console.log(`METRIC report_length=${report.length}`);
+console.log(
+	`ASI scoring_breakdown={"sections":${sections.score}/${sections.max},"dollars":${dollars.score}/${dollars.max},"dates":${dates.score}/${dates.max},"tables":${tables.score}/${tables.max},"density":${density.score}/${density.max},"infoValue":${infoVal.score}/${infoVal.max},"total":${rawScore}/${rawMax}}`,
+);
+
+const allNotes = [
+	...sections.notes.map(n => `[sections] ${n}`),
+	...dollars.notes.map(n => `[dollars] ${n}`),
+	...dates.notes.map(n => `[dates] ${n}`),
+	...tables.notes.map(n => `[tables] ${n}`),
+	...density.notes.map(n => `[density] ${n}`),
+	...infoVal.notes.map(n => `[info-value] ${n}`),
+];
+
+if (allNotes.length > 0) {
+	console.log(`ASI deduction_notes=${JSON.stringify(allNotes)}`);
+	console.log("");
+	console.log("Deduction notes:");
+	for (const note of allNotes) {
+		console.log(`  - ${note}`);
+	}
+}

package/src/prompts/tools/xcsh-api.md

@@ -19,3 +19,6 @@ Response format:
 GET requests auto-retry once on transient errors (429/503) after 1s backoff. POST/PUT/DELETE are never retried.
 API calls to the same F5 XC tenant reuse a single TLS connection — sequential calls are faster than parallel calls.
 **Namespace discovery**: When asked about resources in a namespace, you **MUST** use `paths: ["*"]` to auto-discover and batch all namespace resource types in ONE call. Do NOT enumerate types individually.
+
+**Relationship queries**: When the batch response says "Inventory complete" and includes a `Resource relationships:` section, the specs and relationships are already fully fetched. Answer directly from that data. Do NOT make additional GET calls to read individual resources you already have from the batch.
+**Tenant-wide queries**: When asked about resources across ALL namespaces (e.g. "show all LBs in the entire tenant"), use `paths: ["*"]` with `params: {namespace: "*"}` to batch every namespace in ONE call. Do NOT list namespaces first — the wildcard handles discovery automatically.

package/src/tools/xcsh-api.ts

@@ -84,7 +84,7 @@ export class XcshApiTool implements AgentTool<typeof xcshApiSchema, XcshApiToolD
 	#contextEnv: ContextEnv;
 	#lastApiBase = "";
 	#listablePathsCache: string[] | null = null;
-	#autoExpandDone = false;
+	#expandedNamespaces = new Set<string>();
 
 	constructor(session: ToolSession) {
 		this.description = prompt.render(xcshApiDescription);
@@ -158,6 +158,79 @@ export class XcshApiTool implements AgentTool<typeof xcshApiSchema, XcshApiToolD
 		}
 	}
 
+	/** Batch ALL non-system namespaces in one tool call for tenant-wide queries. */
+	async #executeMultiNamespaceBatch(
+		paths: string[],
+		apiBase: string,
+		apiToken: string,
+		signal?: AbortSignal,
+	): Promise<XcshApiResult> {
+		const headers = { Authorization: `APIToken ${apiToken}`, Accept: "application/json" };
+		const timeoutSignal = AbortSignal.timeout(90_000);
+		const fetchSignal = signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal;
+		const startMs = performance.now();
+
+		// Discover all accessible namespaces
+		let allNs: string[] = [];
+		try {
+			const nsResp = await fetch(`${apiBase}/api/web/namespaces`, {
+				method: "GET",
+				headers,
+				signal: fetchSignal,
+			});
+			if (nsResp.ok) {
+				const nsData = (await nsResp.json()) as { items?: Array<Record<string, unknown>> };
+				allNs = (nsData.items ?? [])
+					.map(item => (typeof item.name === "string" ? item.name : null))
+					.filter(
+						(name): name is string =>
+							name !== null &&
+							!name.startsWith("ves-io") &&
+							!name.startsWith("system") &&
+							!name.startsWith("shared"),
+					);
+			}
+		} catch {
+			// Fall back to default namespace only
+			const def = this.#contextEnv.get("F5XC_NAMESPACE") ?? "default";
+			allNs = [def];
+		}
+
+		// Batch each namespace and combine results
+		const nsSections: string[] = [];
+		for (const ns of allNs) {
+			const nsParams = { namespace: ns };
+			this.#expandedNamespaces.add(ns);
+			const result = await this.#executeBatch(paths, nsParams, apiBase, apiToken, signal);
+			const text = result.content[0]?.type === "text" ? (result.content[0] as { text: string }).text : "";
+			if (text.includes("resource type")) {
+				nsSections.push(`\n=== Namespace: ${ns} ===\n${text}`);
+			}
+		}
+
+		const durationMs = Math.round(performance.now() - startMs);
+		const combined =
+			nsSections.length > 0
+				? nsSections.join("\n") +
+					"\n\nTenant-wide inventory complete. All namespaces, specs, and relationships shown above. No further API calls needed."
+				: "No resources found across accessible namespaces.";
+
+		return {
+			content: [{ type: "text", text: combined }],
+			details: {
+				status: 200,
+				url: apiBase,
+				method: "GET",
+				requestId: crypto.randomUUID(),
+				durationMs,
+				contextName: this.#contextEnv.getContextName(),
+				batchSize: paths.length * allNs.length,
+				batchSuccessCount: nsSections.length,
+				batchTotalItems: 0,
+			},
+		};
+	}
+
 	async #executeBatch(
 		paths: string[],
 		params: Record<string, string> | undefined,
@@ -293,17 +366,23 @@ export class XcshApiTool implements AgentTool<typeof xcshApiSchema, XcshApiToolD
 
 		// Phase 2: fetch individual resource specs for items in non-empty types.
 		// With 42-path batch, this is ~12 items total — adds ~3s, not 100s like the 136-path era.
-		// Gives the model detailed config (WAF rules, policy rules, etc.) so Q4 doesn't need follow-ups.
-		const specCache = new Map<string, string>();
+		// Store raw spec objects for semantic summary generation
+		const rawSpecs = new Map<string, Record<string, unknown>>();
 		const specItems: Array<{ typePath: string; name: string }> = [];
+		// Only fetch specs for types that carry relationship data (LBs, pools, firewalls,
+		// healthchecks). Excludes system-generated objects (routes, virtual_hosts, etc.)
+		// that inflate the item count and don't add relationship info.
+		const SPEC_TYPES = /loadbalancer|origin_pool|app_firewall|healthcheck/i;
 		for (const r of relevantData) {
+			const typeName = r.path.split("/").pop() ?? "";
+			if (!SPEC_TYPES.test(typeName)) continue;
 			const items = (r.parsed?.items as Array<Record<string, unknown>> | undefined) ?? [];
 			for (const item of items) {
 				const name = typeof item.name === "string" ? item.name : null;
-				if (name && items.length <= 10) specItems.push({ typePath: r.path, name });
+				if (name && items.length <= 15) specItems.push({ typePath: r.path, name });
 			}
 		}
-		if (specItems.length > 0 && specItems.length <= 20 && !fetchSignal.aborted) {
+		if (specItems.length > 0 && specItems.length <= 40 && !fetchSignal.aborted) {
 			for (let i = 0; i < specItems.length; i += CONCURRENCY) {
 				const chunk = specItems.slice(i, i + CONCURRENCY);
 				await Promise.all(
@@ -315,17 +394,7 @@ export class XcshApiTool implements AgentTool<typeof xcshApiSchema, XcshApiToolD
 								const data = (await resp.json()) as Record<string, unknown>;
 								const spec = data.spec as Record<string, unknown> | undefined;
 								if (spec) {
-									// Compact top-level spec summary
-									const summary = Object.entries(spec)
-										.filter(([, v]) => v != null && v !== "" && !(Array.isArray(v) && v.length === 0))
-										.slice(0, 3)
-										.map(([k, v]) => {
-											if (typeof v === "object" && !Array.isArray(v)) return k;
-											if (Array.isArray(v)) return `${k}[${v.length}]`;
-											return `${k}=${String(v).slice(0, 30)}`;
-										})
-										.join(", ");
-									specCache.set(`${typePath}/${name}`, summary);
+									rawSpecs.set(`${typePath}/${name}`, spec);
 								}
 							}
 						} catch {
@@ -339,48 +408,102 @@ export class XcshApiTool implements AgentTool<typeof xcshApiSchema, XcshApiToolD
 
 		// Compact response: names only for discovery, no full JSON blobs
 		const sections: string[] = [];
-		// Categorize: app/security types are prominent, infrastructure types are secondary.
-		// Pattern-based categorization using naming conventions, not hardcoded type lists.
-		// META_EXCLUDE: meta-policy types (rule sets, data policy) are secondary to direct app resources.
-		const APP_KEYWORDS =
-			/loadbalancer|pool|firewall|_policys|setting|type|mitigation|identification|network|route|host|definition|rate_limiter|prefix_set|cdn|waf|api_/i;
-		const META_EXCLUDE = /policy_set|policy_rule|data_polic/i;
+		// Split types into core (relationship-bearing, with specs) and secondary.
+		// Core types get detailed per-resource output with spec summaries.
+		// Secondary types get a compact count to reduce batch response noise.
+		// Shorter, focused output helps the model find relationship data directly.
 		const getTypeName = (r: BatchEntry) => r.path.split("/").pop() ?? r.path;
-		const appTypes = relevantData.filter(r => {
-			const n = getTypeName(r);
-			return APP_KEYWORDS.test(n) && !META_EXCLUDE.test(n);
-		});
-		const infraTypes = relevantData.filter(r => {
-			const n = getTypeName(r);
-			return !APP_KEYWORDS.test(n) || META_EXCLUDE.test(n);
-		});
-
-		// Numbered list format with explicit stop signal
-		if (appTypes.length > 0) {
-			sections.push(`Namespace resource inventory (${appTypes.length} resource types with data):\n`);
+		const coreTypes = relevantData.filter(r => SPEC_TYPES.test(getTypeName(r)));
+		const secondaryTypes = relevantData.filter(r => !SPEC_TYPES.test(getTypeName(r)));
+
+		if (coreTypes.length > 0) {
+			sections.push(`Namespace resource inventory (${coreTypes.length} core types):\n`);
 			let idx = 1;
-			for (const r of appTypes) {
+			for (const r of coreTypes) {
 				const typeName = getTypeName(r);
 				const items = (r.parsed?.items as Array<Record<string, unknown>> | undefined) ?? [];
-				const itemSummaries = items.map(item => {
-					const name = typeof item.name === "string" ? item.name : "?";
-					const desc = typeof item.description === "string" && item.description ? ` (${item.description})` : "";
-					const disabled = item.disabled === true ? " [DISABLED]" : "";
-					const spec = specCache.get(`${r.path}/${name}`);
-					const specStr = spec ? ` \u2014 ${spec}` : "";
-					return `${name}${desc}${disabled}${specStr}`;
-				});
-				const nameStr = itemSummaries.length > 0 ? itemSummaries.join(", ") : `${r.itemCount} item(s)`;
-				sections.push(`${idx}. ${typeName}: ${nameStr}`);
+				if (items.length === 0) {
+					sections.push(`${idx}. ${typeName}: ${r.itemCount} item(s)`);
+				} else {
+					sections.push(`${idx}. ${typeName} (${items.length}):`);
+					for (const item of items) {
+						const name = typeof item.name === "string" ? item.name : "?";
+						const disabled = item.disabled === true ? " [DISABLED]" : "";
+						sections.push(`   - ${name}${disabled}`);
+					}
+				}
 				idx++;
 			}
 		}
 
-		if (infraTypes.length > 0) {
-			sections.push(`\n(+${infraTypes.length} infrastructure/policy-meta types omitted)`);
+		if (secondaryTypes.length > 0) {
+			const secondaryCount = secondaryTypes.reduce((sum, r) => sum + (r.itemCount ?? 0), 0);
+			sections.push(
+				`\n(+${secondaryTypes.length} other types with ${secondaryCount} items: ${secondaryTypes.map(r => getTypeName(r)).join(", ")})`,
+			);
 		}
 
-		sections.push("\nInventory complete. Report every numbered item above. No further API calls needed.");
+		// Semantic summary: answer-ready labels from raw specs.
+		// Human-readable labels (WAF=name, no-WAF, pools=[...]) instead of raw fields.
+		// Directly answers relationship queries without follow-up GETs.
+		const summaryLines: string[] = [];
+		const extractRef = (v: unknown): string | null => {
+			if (typeof v === "object" && v !== null && !Array.isArray(v)) {
+				const o = v as Record<string, unknown>;
+				return typeof o.name === "string" ? o.name : null;
+			}
+			return null;
+		};
+		const extractPoolRefs = (pools: unknown): string[] => {
+			if (!Array.isArray(pools)) return [];
+			return (pools as Array<Record<string, unknown>>)
+				.map(item => {
+					if (typeof item?.pool === "object" && item.pool !== null)
+						return (item.pool as Record<string, unknown>).name as string;
+					return extractRef(item);
+				})
+				.filter((n): n is string => n !== null);
+		};
+		for (const [specKey, spec] of rawSpecs) {
+			const parts = specKey.split("/");
+			const rName = parts.at(-1) ?? "";
+			const rType = parts.at(-2) ?? "";
+			const labels: string[] = [];
+			if (/loadbalancer/i.test(rType)) {
+				const waf = extractRef(spec.app_firewall);
+				labels.push(waf ? `WAF=${waf}` : "no-WAF");
+				const pools = extractPoolRefs(spec.default_route_pools);
+				if (pools.length > 0) labels.push(`pools=[${pools.join(",")}]`);
+				if (spec.disable_rate_limit != null) labels.push("no-rate-limit");
+				else if (spec.rate_limit != null) labels.push("has-rate-limit");
+				const domains = Array.isArray(spec.domains) ? (spec.domains as string[]) : [];
+				if (domains.length > 0) labels.push(`domains=[${domains.join(",")}]`);
+			}
+			if (/origin_pool/i.test(rType)) {
+				const hc = Array.isArray(spec.healthcheck)
+					? (spec.healthcheck as Array<Record<string, unknown>>).map(h => extractRef(h)).filter(Boolean)
+					: [];
+				labels.push(hc.length > 0 ? `healthcheck=[${hc.join(",")}]` : "no-healthcheck");
+				const servers = Array.isArray(spec.origin_servers) ? (spec.origin_servers as unknown[]).length : 0;
+				if (servers > 0) labels.push(`${servers} origin(s)`);
+				if (typeof spec.port === "number") labels.push(`port=${spec.port}`);
+			}
+			if (/app_firewall/i.test(rType)) {
+				if (spec.detection_settings != null) labels.push("has-detection-settings");
+				if (spec.monitoring != null) labels.push("monitoring-mode");
+				else if (spec.blocking != null) labels.push("blocking-mode");
+			}
+			if (labels.length > 0) {
+				summaryLines.push(`${rName}: ${labels.join(", ")}`);
+			}
+		}
+		if (summaryLines.length > 0) {
+			sections.push(`\nResource summary:\n${summaryLines.join("\n")}`);
+		}
+
+		sections.push(
+			"\nInventory complete. Resource summary above contains all relationship data. No further API calls needed.",
+		);
 		const batchTotalItems = relevantData.reduce((sum, r) => sum + (r.itemCount ?? 0), 0);
 		const text = sections.join("\n");
 		const batchSize = paths.length;
@@ -457,29 +580,34 @@ export class XcshApiTool implements AgentTool<typeof xcshApiSchema, XcshApiToolD
 			// Wildcard "*" auto-discovers all namespace-scoped list paths from the catalog
 			const resolved = batchPaths.length === 1 && batchPaths[0] === "*" ? this.#loadListablePaths() : batchPaths;
 			if (resolved.length > 0) {
+				const batchNs = params.params?.namespace ?? this.#contextEnv.get("F5XC_NAMESPACE") ?? "";
+				// Wildcard namespace: batch ALL non-system namespaces in one tool call.
+				// Reduces multi-namespace queries from N+1 batch calls to 1.
+				if (batchNs === "*") {
+					return this.#executeMultiNamespaceBatch(resolved, apiBase, apiToken, signal);
+				}
+				if (batchNs) this.#expandedNamespaces.add(batchNs);
 				return this.#executeBatch(resolved, params.params, apiBase, apiToken, signal);
 			}
 		}
-		// Auto-expand: when the model GETs a namespace list endpoint for the first time,
-		// proactively batch ALL namespace list types for maximum discovery efficiency.
-		// Only triggers once per session to avoid redundant batch responses.
+		// Per-namespace auto-expand: when the model GETs a namespace list endpoint,
+		// batch ALL types for that namespace on first access. Each namespace expands once.
 		// File-based cache in #executeBatch prevents redundant API calls across sessions.
-		if (!this.#autoExpandDone && params.method === "GET" && !params.payload) {
+		if (params.method === "GET" && !params.payload) {
 			const listablePaths = this.#loadListablePaths();
 			if (listablePaths.length > 0) {
-				// Normalize: replace actual namespace in path with {namespace} for matching
 				const normalized = params.path.replace(
 					/\/api\/config\/namespaces\/[^/]+\//,
 					"/api/config/namespaces/{namespace}/",
 				);
 				if (listablePaths.includes(params.path) || listablePaths.includes(normalized)) {
-					// Extract namespace from resolved path if params don't already have it
 					const nsMatch = params.path.match(/\/api\/config\/namespaces\/([^/]+)\//);
-					const batchParams =
-						params.params ??
-						(nsMatch?.[1] && nsMatch[1] !== "{namespace}" ? { namespace: nsMatch[1] } : undefined);
-					this.#autoExpandDone = true;
-					return this.#executeBatch(listablePaths, batchParams, apiBase, apiToken, signal);
+					const ns = params.params?.namespace ?? (nsMatch?.[1] && nsMatch[1] !== "{namespace}" ? nsMatch[1] : "");
+					if (ns && !this.#expandedNamespaces.has(ns)) {
+						const batchParams = params.params ?? { namespace: ns };
+						this.#expandedNamespaces.add(ns);
+						return this.#executeBatch(listablePaths, batchParams, apiBase, apiToken, signal);
+					}
 				}
 			}
 		}