@f5xc-salesdemos/xcsh 19.46.1 → 19.47.0

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@f5xc-salesdemos/xcsh",
-	"version": "19.46.1",
+	"version": "19.47.0",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://github.com/f5xc-salesdemos/xcsh",
 	"author": "Can Boluk",
@@ -54,13 +54,13 @@
 	"dependencies": {
 		"@agentclientprotocol/sdk": "0.16.1",
 		"@mozilla/readability": "^0.6",
-		"@f5xc-salesdemos/xcsh-stats": "19.46.1",
-		"@f5xc-salesdemos/pi-agent-core": "19.46.1",
-		"@f5xc-salesdemos/pi-ai": "19.46.1",
-		"@f5xc-salesdemos/pi-natives": "19.46.1",
-		"@f5xc-salesdemos/pi-resource-management": "19.46.1",
-		"@f5xc-salesdemos/pi-tui": "19.46.1",
-		"@f5xc-salesdemos/pi-utils": "19.46.1",
+		"@f5xc-salesdemos/xcsh-stats": "19.47.0",
+		"@f5xc-salesdemos/pi-agent-core": "19.47.0",
+		"@f5xc-salesdemos/pi-ai": "19.47.0",
+		"@f5xc-salesdemos/pi-natives": "19.47.0",
+		"@f5xc-salesdemos/pi-resource-management": "19.47.0",
+		"@f5xc-salesdemos/pi-tui": "19.47.0",
+		"@f5xc-salesdemos/pi-utils": "19.47.0",
 		"@sinclair/typebox": "^0.34",
 		"@xterm/headless": "^6.0",
 		"ajv": "^8.20",

package/src/internal-urls/build-info-runtime.ts

@@ -210,6 +210,7 @@ export function renderAboutDoc(info: RuntimeBuildInfo, context: ContextStatus |
 		"",
 		"SE specialization: F5 XC API integration (xcsh_api, api-catalog, api-spec),",
 		"F5 XC federated product docs (llms.txt hierarchy),",
+		"F5 XC console browser automation (catalog_workflow_runner, xcsh://console/ workflow catalog),",
 		"user/computer profiling (xcsh://user, xcsh://computer),",
 		"SE-specific subagents (deal-analyst, status-operator, cli-operator, github-ops).",
 		"",

package/src/internal-urls/build-info.generated.ts

@@ -17,17 +17,17 @@ export interface BuildInfo {
 }
 
 export const BUILD_INFO: BuildInfo = {
-	"version": "19.46.1",
-	"commit": "5db3ce656a0f4ecb720afb48aa38d0398cf2f1d2",
-	"shortCommit": "5db3ce6",
+	"version": "19.47.0",
+	"commit": "ae8522ac0882900baeef7e16bb63110c859dd522",
+	"shortCommit": "ae8522a",
 	"branch": "main",
-	"tag": "v19.46.1",
-	"commitDate": "2026-06-25T17:55:26Z",
-	"buildDate": "2026-06-25T18:25:34.872Z",
+	"tag": "v19.47.0",
+	"commitDate": "2026-06-25T18:51:19Z",
+	"buildDate": "2026-06-25T19:19:29.242Z",
 	"dirty": true,
 	"prNumber": "",
 	"repoUrl": "https://github.com/f5xc-salesdemos/xcsh",
 	"repoSlug": "f5xc-salesdemos/xcsh",
-	"commitUrl": "https://github.com/f5xc-salesdemos/xcsh/commit/5db3ce656a0f4ecb720afb48aa38d0398cf2f1d2",
-	"releaseUrl": "https://github.com/f5xc-salesdemos/xcsh/releases/tag/v19.46.1"
+	"commitUrl": "https://github.com/f5xc-salesdemos/xcsh/commit/ae8522ac0882900baeef7e16bb63110c859dd522",
+	"releaseUrl": "https://github.com/f5xc-salesdemos/xcsh/releases/tag/v19.47.0"
 };

package/src/prompts/system/system-prompt.md

@@ -21,7 +21,8 @@ presentations, technical discovery questions, POC/proof-of-concept validation pl
 account planning, and competitive positioning.
 
 Technical depth: network protocols across all OSI layers, API design, security analysis
-(DDoS, SSL/TLS, MITM, traffic forensics), infrastructure as code, and network automation.
+(DDoS, SSL/TLS, MITM, traffic forensics), infrastructure as code, network automation,
+and F5 XC console browser automation.
 These are not separate roles — the SE work requires the technical depth, and the
 technical depth exists to serve the SE work.
 Judgment: earned from production network incidents, security investigations, live

package/src/secrets/index.ts

@@ -1,10 +1,11 @@
 import * as path from "node:path";
-import { isEnoent, logger } from "@f5xc-salesdemos/pi-utils";
+import { isEnoent, logger, SECRET_ENV_PATTERNS } from "@f5xc-salesdemos/pi-utils";
 import { YAML } from "bun";
 import type { SecretEntry } from "./obfuscator";
 import { compileSecretRegex } from "./regex";
 
 export { deobfuscateSessionContext, obfuscateMessages, type SecretEntry, SecretObfuscator } from "./obfuscator";
+export { SECRET_ENV_PATTERNS };
 
 /**
  * Load secrets from project-local and global secrets.yml files.
@@ -29,9 +30,6 @@ export async function loadSecrets(cwd: string, agentDir: string): Promise<Secret
 /** Minimum env var value length to consider as a secret. */
 const MIN_ENV_VALUE_LENGTH = 8;
 
-/** Env var name patterns that indicate secret values. */
-export const SECRET_ENV_PATTERNS = /(?:KEY|SECRET|TOKEN|PASSWORD|PASS|AUTH|CREDENTIAL|PRIVATE|OAUTH)(?:_|$)/i;
-
 /**
  * Collect environment variable values that look like secrets.
  * @param options.additionalEnv Extra env records to scan (e.g. bash.environment settings from profile).

package/src/services/xcsh-context-command.ts

@@ -8,19 +8,18 @@ import {
 	isSafeContextName,
 	t,
 } from "@f5xc-salesdemos/pi-utils";
-import { SECRET_ENV_PATTERNS } from "../secrets/index";
 import { expandTilde } from "../tools/path-utils";
 import { ContextError, ContextService, CURRENT_SCHEMA_VERSION } from "./xcsh-context";
 import { formatStatusIcon } from "./xcsh-context-indicators";
 import {
+	AUTH_ENV_KEYS,
 	deriveTenantFromUrl,
+	isSensitiveEnvKey,
 	RESERVED_ENV_KEYS,
 	XCSH_API_TOKEN,
 	XCSH_API_URL,
-	XCSH_CONSOLE_PASSWORD,
 	XCSH_NAMESPACE,
 	XCSH_TENANT,
-	XCSH_USERNAME,
 } from "./xcsh-env";
 import {
 	formatAuthIndicator,
@@ -327,10 +326,6 @@ async function handleActivatePrevious(ctx: CommandContext, service: ContextServi
 	}
 }
 
-function isSensitiveKey(key: string): boolean {
-	return SECRET_ENV_PATTERNS.test(key);
-}
-
 async function handleShow(ctx: CommandContext, service: ContextService, name?: string): Promise<void> {
 	const targetName = name || service.getStatus().activeContextName;
 	if (!targetName) {
@@ -358,11 +353,11 @@ async function handleShow(ctx: CommandContext, service: ContextService, name?: s
 	];
 
 	// Auth-related env vars
-	const authKeys: string[] = [XCSH_USERNAME, XCSH_CONSOLE_PASSWORD];
+	const authKeys: readonly string[] = AUTH_ENV_KEYS;
 	for (const key of authKeys) {
 		const value = context.env?.[key];
 		if (value) {
-			rows.push({ key: sanitize(key), value: isSensitiveKey(key) ? service.maskToken(value) : sanitize(value) });
+			rows.push({ key: sanitize(key), value: isSensitiveEnvKey(key) ? service.maskToken(value) : sanitize(value) });
 		}
 	}
 
@@ -377,7 +372,7 @@ async function handleShow(ctx: CommandContext, service: ContextService, name?: s
 	if (context.env) {
 		for (const [key, value] of Object.entries(context.env)) {
 			if (authKeys.includes(key) || RESERVED_ENV_KEYS.has(key)) continue;
-			rows.push({ key: sanitize(key), value: isSensitiveKey(key) ? service.maskToken(value) : sanitize(value) });
+			rows.push({ key: sanitize(key), value: isSensitiveEnvKey(key) ? service.maskToken(value) : sanitize(value) });
 		}
 	}
 
@@ -741,7 +736,7 @@ async function handleEnvList(ctx: CommandContext, service: ContextService): Prom
 	}
 	const rows: TableRow[] = [];
 	for (const [key, value] of Object.entries(context.env)) {
-		const sensitive = isSensitiveKey(key) || (context.sensitiveKeys ?? []).includes(key);
+		const sensitive = isSensitiveEnvKey(key) || (context.sensitiveKeys ?? []).includes(key);
 		rows.push({ key: sanitize(key), value: sensitive ? service.maskToken(value) : sanitize(value) });
 	}
 	ctx.showStatus(renderXCSHTable(`${contextName} env`, rows), { dim: false });
@@ -766,7 +761,7 @@ async function handleEnvSet(ctx: CommandContext, service: ContextService, args:
 		bodyLines.push(`Set ${keys.length} variable${keys.length > 1 ? "s" : ""} on '${contextName}':`);
 		for (const key of keys) {
 			const lock = result.sensitive.includes(key) ? " (auto-sensitive)" : "";
-			const displayValue = isSensitiveKey(key) ? "***" : vars[key];
+			const displayValue = isSensitiveEnvKey(key) ? "***" : vars[key];
 			bodyLines.push(`  ${key}=${displayValue}${lock}`);
 		}
 		ctx.showStatus(renderContextMessage(contextName, bodyLines.join("\n")), { dim: false });

package/src/services/xcsh-env.ts

@@ -1,24 +1,36 @@
 /**
- * F5 XC environment variable names. Typed `as const` so bracket access like
- * `process.env[XCSH_API_URL]` type-checks correctly. Single source of truth —
- * every consumer imports these instead of repeating the string literal.
+ * F5 XC environment variable names + the reserved-key set. The single source of
+ * truth lives in `@f5xc-salesdemos/pi-utils` (`xcsh-env-names`) so the shell and
+ * the VS Code extension agree on the exact same names; re-exported here for the
+ * shell's existing import paths.
  */
-export const XCSH_API_URL = "XCSH_API_URL" as const;
-export const XCSH_API_TOKEN = "XCSH_API_TOKEN" as const;
-export const XCSH_NAMESPACE = "XCSH_NAMESPACE" as const;
-export const XCSH_TENANT = "XCSH_TENANT" as const;
-export const XCSH_USERNAME = "XCSH_USERNAME" as const;
-export const XCSH_CONSOLE_PASSWORD = "XCSH_CONSOLE_PASSWORD" as const;
-/** Active context profile name. Read-only metadata injected by ContextService. */
-export const XCSH_CONTEXT_NAME = "XCSH_CONTEXT_NAME" as const;
-
-export const RESERVED_ENV_KEYS: ReadonlySet<string> = new Set([
-	XCSH_NAMESPACE,
-	XCSH_API_URL,
+import {
+	AUTH_ENV_KEYS,
+	isSensitiveEnvKey,
+	RESERVED_ENV_KEYS,
+	SECRET_ENV_PATTERNS,
 	XCSH_API_TOKEN,
+	XCSH_API_URL,
+	XCSH_CONSOLE_PASSWORD,
+	XCSH_CONTEXT_NAME,
+	XCSH_NAMESPACE,
 	XCSH_TENANT,
+	XCSH_USERNAME,
+} from "@f5xc-salesdemos/pi-utils";
+
+export {
+	AUTH_ENV_KEYS,
+	isSensitiveEnvKey,
+	RESERVED_ENV_KEYS,
+	SECRET_ENV_PATTERNS,
+	XCSH_API_TOKEN,
+	XCSH_API_URL,
+	XCSH_CONSOLE_PASSWORD,
 	XCSH_CONTEXT_NAME,
-]);
+	XCSH_NAMESPACE,
+	XCSH_TENANT,
+	XCSH_USERNAME,
+};
 
 export const RESERVED_ENV_MESSAGES: Readonly<Record<string, string>> = {
 	[XCSH_NAMESPACE]: `${XCSH_NAMESPACE} is managed by defaultNamespace. Use /context namespace <value> to change it.`,