@aristanetworks/eos-mcp-server 0.6.1-beta → 0.8.0-beta

package/CHANGELOG.md

@@ -2,7 +2,26 @@
 
 ## Unreleased
 
+## 0.8.0-beta
+
+0.7.0-beta was not published to npm, so upgrading from 0.6.1-beta picks up both this section and the 0.7.0-beta section below.
+
+- **Breaking:** `eos_ping` replaces `destination` with `destinations`, an array of 1 to `diagnostics.maxDestinationsPerRequest` (default 16) unique IP literals. Use `destinations: ["<ip>"]` for a single ping; the old field is rejected with guidance. Duplicates are compared by canonical address, so different IPv6 spellings of one address are rejected, while an IPv4 address and its IPv4-mapped IPv6 form stay distinct. Destinations run concurrently within the existing diagnostic concurrency, each with its own reservation. Results always contain one entry per host and destination, each carrying `destination`, and `summary` counts those entries rather than devices. All destinations are validated before dispatch, and `maxProbesPerRequest` now counts hosts × destinations × count. Server info reports `limits.diagnostics.max_destinations_per_request`. See [ADR 0005](docs/adr/0005-multi-destination-ping.md).
+- Routes diagnostics through a per-kind `DiagnosticDefinition` (prepare, probe cost, interpret), so the executor no longer contains ping-specific logic.
+- Documents the Codex `supports_parallel_tool_calls = true` opt-in in the README's Codex configuration examples. Without it, Codex runs independent EOS tool calls serially.
+- Refreshes locked dependencies with `npm audit fix`, including `@modelcontextprotocol/sdk` 1.32.2 and its HTTP-transport dependencies. One advisory remains: zod's memory exhaustion when validating oversized constrained collections is fixed only in zod 4, which needs a separate migration.
+
+## 0.7.0-beta
+
+- Refactors diagnostic queueing and reservation transitions into separate paths, makes pre-/post-dispatch error handling explicit, and shares audit hashing and snapshot normalization. Ledger formats, schema versions, and safety policy are unchanged; adds coverage for queued journal failure without invalidating already-completed work.
+- Retains uncertain diagnostic capacity for correlated malformed text results instead of mistaking validation failure for completion. Offline inspection now reads integrity, schema, reservations, and audit in one SQLite transaction, preventing mixed before/after release snapshots.
+- Adds offline `release-diagnostics` with exact ID scope, a private bounded fencing-attestation file, explicit confirmation, exclusive ledger ownership, and atomic audit-plus-release. Records actual OS identity separately from the claimed verifier and checks content digests; it does not verify fencing truth or expose an MCP reset. Schema 1 migrates transactionally to schema 2, preserving unresolved work; `inspect-diagnostics` exposes read-only audit history. Exact committed retries are no-ops; changed attestation reuse is rejected.
+- Validates JSON-RPC 2.0 response IDs and exclusive result/error envelopes before accepting output or retrying read-only JSON fallback. Missing/stale acknowledgements retain uncertain diagnostic capacity. New ledger reservations persist the exact wire RPC ID before dispatch; offline inspection distinguishes legacy records without one. IDs provide correlation, not an EOS status token or retry/deduplication guarantee.
+- Adds `eos_ping`: bounded IPv4/IPv6 diagnostics executed on inventory hosts/groups, optional VRF/source IP, normalized loss/RTT and reachability findings, and opt-in original EOS text. Requires inherited `mcp_diagnostics_allowed: true`; read denial still vetoes execution. No configuration changes, automatic retries, or SSH/shell fallback.
+- Fixes read-only auto output fallback for EOS code 1003 (`unconverted command`) and aligns optional read integration hostnames with the checked-in unprefixed topology. Ping's single-execution text path still never retries.
+- Adds configurable `diagnostics` limits/timeouts with sensible defaults, ledger-scoped admission across simultaneous calls, and indefinite fail-closed reservations when device completion is unknown. Reports permission in inventory views, effective limits and live reservation state in server info, and a structured `diagnostic_capacity_uncertain` error when uncertainty exhausts capacity. Reservations are committed before dispatch to a private, inventory-keyed SQLite ledger and survive restart as uncertain. A crash-released ownership lock prevents competing owners; storage errors fail closed. Adds optional `diagnostics.stateFile` and offline, read-only `inspect-diagnostics`. Offline operator-attested release is available; a machine-verified native remote deadline/completion facility remains unresolved; post-dispatch RPC interruption errors do not prove completion. Qualified on cEOS 4.34.3M; traceroute and packet capture remain future work.
 - Publishes the package to npm as `@aristanetworks/eos-mcp-server` (#14). The installed command is still `eos-mcp-server`. The release workflow publishes through npm trusted publishing, and prerelease tags go to the `next` dist-tag. The release tarball is now named `aristanetworks-eos-mcp-server-<version>.tgz`.
+- Upgrading from a `.tgz` install: run `npm uninstall -g eos-mcp-server` before `npm install -g @aristanetworks/eos-mcp-server`. Both packages provide the same `eos-mcp-server` command.
 
 ## 0.6.1-beta
 

package/README.md

@@ -1,11 +1,14 @@
-# eos-mcp-server BETA
+# eos-mcp-server
 
-Read-only MCP server for Arista EOS eAPI (JSON-RPC over HTTPS).
+[![Project status: Beta](https://img.shields.io/badge/status-beta-orange.svg)](https://github.com/aristanetworks/eos-mcp-server/releases)
+[![npm version](https://img.shields.io/npm/v/%40aristanetworks%2Feos-mcp-server.svg)](https://www.npmjs.com/package/@aristanetworks/eos-mcp-server)
+
+Read-only (non-configuring) MCP server for Arista EOS eAPI (JSON-RPC over HTTPS).
 
 > **Beta status:** this project is under active development.
 > **Support:** best-effort only. This open source project is not currently supported by Arista TAC.
 
-This server provides a set of **read-only** tools. It never exposes configuration-changing operations. The server can:
+This server never exposes configuration-changing operations. It provides read-only inspection and explicitly authorized, bounded **active diagnostics**. Non-configuring does not mean passive or harmless: diagnostics generate traffic. The server can:
 
 - introspect its own runtime and inventory
 - list inventory hosts/groups
@@ -14,8 +17,9 @@ This server provides a set of **read-only** tools. It never exposes configuratio
 - retrieve bounded logging output for troubleshooting
 - collect a fixed set of device facts
 - retrieve running configuration
+- run bounded ping diagnostics on EOS devices, including group fan-out
 
-> **Security note:** LLMs have occasionally tried to bypass the MCP server and make configuration changes through other means (for example, SSH). As a best practice, use AAA and scope the authentication credentials used by this server to read-only access.
+> **Security note:** LLMs have occasionally tried to bypass the MCP server and make configuration changes through other means (for example, SSH). As a best practice, use AAA and scope the authentication credentials used by this server to the intended inspection and diagnostic commands only.
 
 ## Contents
 
@@ -24,6 +28,7 @@ This server provides a set of **read-only** tools. It never exposes configuratio
 - [Install and get started](#install-and-get-started)
 - [Server config file](#server-config-file)
 - [Connect to an MCP client](#connect-to-an-mcp-client)
+- [Skills](#skills)
 - [CLI usage](#cli-usage)
 - [MCP tool reference](#mcp-tool-reference)
 - [Inventory formats](#inventory-formats)
@@ -39,6 +44,7 @@ Implemented MCP tools:
 - `eos_get_server_info`
 - `eos_list_inventory`
 - `eos_probe_devices`
+- `eos_ping`
 - `eos_run_show`
 - `eos_show_logging`
 - `eos_get_facts`
@@ -50,45 +56,75 @@ Implemented local CLI commands:
 - `validate-inventory`
 - `print-server-info`
 - `probe`
+- `inspect-diagnostics` (offline, read-only ledger inspection)
+- `release-diagnostics` (offline, explicitly attested and audited operator release)
 
 ## Requirements
 
 - Node.js 24+
 - Arista EOS devices reachable via eAPI over HTTPS
-- EOS 4.20 or later
+- EOS 4.20 or later for existing read operations; `eos_ping` is qualified on cEOS 4.34.3M
 - Inventory in one of the supported YAML formats
 
 ## Install and get started
 
-1. Install the package globally from npm:
+The package is published on npm as [`@aristanetworks/eos-mcp-server`](https://www.npmjs.com/package/@aristanetworks/eos-mcp-server). The package provides the `eos-mcp-server` command.
+
+### npx or global install?
+
+Both run the same package. They differ in when the version changes and whether the npm registry must be reachable when the server starts.
+
+| Use                                                                                       | When                                                                                                                                                                                                          |
+| ----------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `npx -y @aristanetworks/eos-mcp-server`                                                   | You're trying the server out, or mainly run it from an MCP client. Nothing to install, and it picks up the latest release when it launches.                                                                   |
+| `npx -y @aristanetworks/eos-mcp-server@<version>`                                         | You want a reproducible setup, such as an MCP config shared with a team. Everyone runs the same version until you change it.                                                                                  |
+| `npm install -g @aristanetworks/eos-mcp-server`                                           | You run the CLI often, want to control when upgrades happen, or the npm registry isn't always reachable. The command starts without a registry lookup and stays on one version until you run `npm update -g`. |
+| `.tgz` from a [GitHub release](https://github.com/aristanetworks/eos-mcp-server/releases) | The machine can't reach the npm registry at all.                                                                                                                                                              |
 
-   ```bash
-   npm install -g @aristanetworks/eos-mcp-server
-   ```
+### Run with npx (recommended)
 
-   Prereleases are published under the `next` tag (`npm install -g @aristanetworks/eos-mcp-server@next`). Each [GitHub release](https://github.com/aristanetworks/eos-mcp-server/releases) also attaches the package as a `.tgz`, which you can install with `npm install -g ./aristanetworks-eos-mcp-server-<version>.tgz`.
+No install step is needed. `npx` downloads the package on first use and caches it:
+
+```bash
+npx -y @aristanetworks/eos-mcp-server --help
+```
 
-2. Confirm that the command is available:
+The [MCP client examples](#connect-to-an-mcp-client) below use `npx`. `-y` skips npm's install confirmation prompt, which an MCP client can't answer. Without a version, npx checks the registry for the latest release each time it launches the server. To pin a specific release, append a version, for example `@aristanetworks/eos-mcp-server@0.8.0-beta`.
 
-   ```bash
-   eos-mcp-server --help
-   ```
+### Or install globally
 
-The global install places `eos-mcp-server` on your `PATH`. To remove it later:
+A global install puts `eos-mcp-server` on your `PATH`, starts without a registry lookup, and stays on the installed version until you update it:
 
 ```bash
-npm uninstall -g @aristanetworks/eos-mcp-server
+npm install -g @aristanetworks/eos-mcp-server
+eos-mcp-server --help
 ```
 
-Next, create an inventory, provide the device password, and validate connectivity:
+Update it later with `npm update -g @aristanetworks/eos-mcp-server`, or remove it with `npm uninstall -g @aristanetworks/eos-mcp-server`.
+
+Prereleases are published under the `next` tag (`@aristanetworks/eos-mcp-server@next`). Each [GitHub release](https://github.com/aristanetworks/eos-mcp-server/releases) also attaches the package as a `.tgz`, for offline installs: `npm install -g ./aristanetworks-eos-mcp-server-<version>.tgz`.
+
+### Upgrading from a `.tgz` install
+
+Versions up to 0.6.1-beta were distributed as `.tgz` files under the unscoped package name `eos-mcp-server`. Both packages provide the same `eos-mcp-server` command, so remove the old package before switching to npm. Otherwise the global install can fail with a conflict, or the old version keeps running:
+
+```bash
+npm uninstall -g eos-mcp-server
+```
+
+### Validate your inventory
+
+Create an inventory, provide the device password, and validate connectivity:
 
 ```bash
 export EOS_MCP_PASSWORD='replace-with-device-password'
 
-eos-mcp-server validate-inventory --inventory inventory.yml
-eos-mcp-server probe --inventory inventory.yml --target leaf1
+npx -y @aristanetworks/eos-mcp-server validate-inventory --inventory inventory.yml
+npx -y @aristanetworks/eos-mcp-server probe --inventory inventory.yml --target leaf1
 ```
 
+With a global install, run `eos-mcp-server` in place of `npx -y @aristanetworks/eos-mcp-server`. The [CLI usage](#cli-usage) examples later in this README use the shorter `eos-mcp-server` form.
+
 See [Quickstart](docs/QUICKSTART.md) for a complete inventory example and MCP client setup. For building or contributing from source, see the [developer workflow](docs/DEVELOPMENT.md).
 
 ## Server config file
@@ -114,6 +150,18 @@ maxShowCommandsPerRequest: 5
 maxLoggingMessagesPerRequest: 1000
 maxResponseSizeBytes: 1048576
 eapiVersion: latest
+diagnostics:
+  # Optional: otherwise use the private, inventory-keyed XDG state directory.
+  # stateFile: ./private/diagnostics.sqlite
+  defaultPingCount: 3
+  maxPingCount: 10
+  maxProbesPerRequest: 100
+  maxDestinationsPerRequest: 16
+  deviceConcurrency: 5
+  pingReplyTimeoutMs: 1000
+  commandTimeoutMs: 30000
+  httpTimeoutMs: 35000
+  overallOperationTimeoutMs: 60000
 secretEnvPrefixes:
   - EOS_MCP_
 defaultConnection:
@@ -126,6 +174,7 @@ Supported config fields:
 
 - `inventory`
 - `actor`
+- `logFile`
 - `caFile`
 - `readTimeoutMs`
 - `overallOperationTimeoutMs`
@@ -135,30 +184,41 @@ Supported config fields:
 - `maxLoggingMessagesPerRequest`
 - `maxResponseSizeBytes`
 - `eapiVersion`
+- `diagnostics` — optional limits/timeouts mapping; see [Network diagnostics](docs/DIAGNOSTICS.md#settings-and-defaults)
 - `secretEnvPrefixes`
 - `defaultConnection.ansibleUser`
 - `defaultConnection.ansibleHttpapiPort`
 - `defaultConnection.mcpValidateCerts`
 - `defaultConnection.mcpPasswordEnv`
 
-`readTimeoutMs` applies to each device eAPI request. `overallOperationTimeoutMs`, when set, bounds the whole tool call and aborts in-flight device requests once the limit is reached. `maxLoggingMessagesPerRequest` caps `eos_show_logging.message_count` and defaults to 1000. `maxResponseSizeBytes` limits both the buffered HTTP response from each device and the final serialized read-tool result. `eapiVersion` selects the eAPI JSON output schema sent as the `runCmds` `version` parameter: `latest` (the default) returns the current schema for each command, and `1` pins the original schema for consumers that depend on it. It only affects JSON output, so `eos_get_running_config` and `eos_show_logging` are unchanged.
+For read tools, `readTimeoutMs` applies to each device eAPI request. `overallOperationTimeoutMs`, when set, bounds the whole read-tool call and aborts in-flight device requests once the limit is reached. `maxLoggingMessagesPerRequest` caps `eos_show_logging.message_count` and defaults to 1000. `maxResponseSizeBytes` limits both the buffered HTTP response from each device and the final serialized result of device read operations. `eapiVersion` selects the eAPI JSON output schema sent as the `runCmds` `version` parameter: `latest` (the default) returns the current schema for each command, and `1` pins the original schema for consumers that depend on it. It only affects JSON output, so `eos_get_running_config` and `eos_show_logging` are unchanged.
+
+`eos_ping` uses its own configurable `diagnostics` timeouts and server-wide concurrency, while sharing `maxReadTargets` and `maxResponseSizeBytes`. Omitted diagnostic settings retain the defaults shown above; invalid or contradictory settings fail validation. Ping requires explicit inventory permission and has no automatic retries. Unknown remote completion retains capacity indefinitely; inspect the running server's `eos_get_server_info.diagnostics.capacity`. Reservations and their wire request IDs are committed before dispatch; response IDs/protocol envelopes are validated before output is accepted. Uncertain attempts survive restarts in a private SQLite ledger, with one active server per ledger. Exhausted uncertain capacity returns `diagnostic_capacity_uncertain`; restarting with the same ledger does not clear it. Use `inspect-diagnostics` for offline inspection and audit history. `release-diagnostics` permits only an offline operator-attested release backed by independent fencing evidence and explicit reservation IDs; it is never an MCP tool or automatic reset. A verified remote kill mechanism is not implemented; do not delete or relocate state to bypass uncertainty. See [Network diagnostics](docs/DIAGNOSTICS.md), including the distinction between a reply timeout, command budget, and remote process termination.
+
+`actor` and `logFile` remain sanitized runtime metadata and do not enable a general tool-call audit log. Offline operator releases have a separate mandatory ledger audit, including the actual OS account and the claimed accountable verifier.
 
 `defaultConnection.mcpPasswordEnv` is a fallback password source. A host or inherited inventory value for `mcp_password_env` or `ansible_password` overrides it. Setting both `mcp_password_env` and `ansible_password` for the same host remains invalid.
 
 ## Connect to an MCP client
 
-These examples assume you've already installed `eos-mcp-server` per [Install and get started](#install-and-get-started) above, and have an inventory file (and optionally a [server config file](#server-config-file)) ready.
+These examples assume you have an inventory file (and optionally a [server config file](#server-config-file)) ready. They launch the server with `npx`, so nothing needs to be installed first. If you [installed globally](#or-install-globally), use `eos-mcp-server` as the command and drop `-y @aristanetworks/eos-mcp-server` from the arguments.
 
 ### Generic stdio example
 
-If `eos-mcp-server` is installed on your `PATH`, point it at just an inventory file:
+Point the server at just an inventory file:
 
 ```json
 {
   "mcpServers": {
     "eos": {
-      "command": "eos-mcp-server",
-      "args": ["serve", "--inventory", "/absolute/path/to/inventory.yml"]
+      "command": "npx",
+      "args": [
+        "-y",
+        "@aristanetworks/eos-mcp-server",
+        "serve",
+        "--inventory",
+        "/absolute/path/to/inventory.yml"
+      ]
     }
   }
 }
@@ -170,33 +230,39 @@ Or use a [server config file](#server-config-file) if you want to set additional
 {
   "mcpServers": {
     "eos": {
-      "command": "eos-mcp-server",
-      "args": ["serve", "--config", "/absolute/path/to/eos-mcp-server.yml"]
+      "command": "npx",
+      "args": [
+        "-y",
+        "@aristanetworks/eos-mcp-server",
+        "serve",
+        "--config",
+        "/absolute/path/to/eos-mcp-server.yml"
+      ]
     }
   }
 }
 ```
 
-If you built the project locally instead of installing the package, replace `"command": "eos-mcp-server"` with `"command": "node"` and put `/absolute/path/to/eos-mcp-server/dist/index.js` first in `args`.
+If you built the project locally instead, use `"command": "node"` and put `/absolute/path/to/eos-mcp-server/dist/index.js` first in `args`, in place of `-y` and the package name.
 
 ### Claude Code
 
 With just an inventory file:
 
 ```bash
-claude mcp add eos -- eos-mcp-server serve --inventory /absolute/path/to/inventory.yml
+claude mcp add eos -- npx -y @aristanetworks/eos-mcp-server serve --inventory /absolute/path/to/inventory.yml
 ```
 
 Or with a [server config file](#server-config-file) for additional options:
 
 ```bash
-claude mcp add eos -- eos-mcp-server serve --config /absolute/path/to/eos-mcp-server.yml
+claude mcp add eos -- npx -y @aristanetworks/eos-mcp-server serve --config /absolute/path/to/eos-mcp-server.yml
 ```
 
 Add `-s user` before `eos` in either command to make the server available across all your projects instead of just the current one:
 
 ```bash
-claude mcp add -s user eos -- eos-mcp-server serve --inventory /absolute/path/to/inventory.yml
+claude mcp add -s user eos -- npx -y @aristanetworks/eos-mcp-server serve --inventory /absolute/path/to/inventory.yml
 ```
 
 ### Codex
@@ -208,8 +274,9 @@ With just an inventory file:
 
 ```toml
 [mcp_servers.eos]
-command = "eos-mcp-server"
-args = ["serve", "--inventory", "/absolute/path/to/inventory.yml"]
+supports_parallel_tool_calls = true
+command = "npx"
+args = ["-y", "@aristanetworks/eos-mcp-server", "serve", "--inventory", "/absolute/path/to/inventory.yml"]
 env_vars = ["EOS_MCP_PASSWORD"]
 ```
 
@@ -217,24 +284,42 @@ Or with a [server config file](#server-config-file) for additional options:
 
 ```toml
 [mcp_servers.eos]
-command = "eos-mcp-server"
-args = ["serve", "--config", "/absolute/path/to/eos-mcp-server.yml"]
+supports_parallel_tool_calls = true
+command = "npx"
+args = ["-y", "@aristanetworks/eos-mcp-server", "serve", "--config", "/absolute/path/to/eos-mcp-server.yml"]
 env_vars = ["EOS_MCP_PASSWORD"]
 ```
 
+Set `supports_parallel_tool_calls = true` under `[mcp_servers.eos]` to let
+Codex dispatch independent tool calls, including pings, concurrently. Without
+this opt-in, tools that omit the MCP read-only annotation may run serially even
+when requested together. Reload Codex after changing the setting. The server
+still enforces its configured diagnostic concurrency and packet limits.
+A single `eos_ping` call with several `destinations` already runs them
+concurrently on the server, so this setting matters for other independent
+calls, such as show commands on different devices or pings that need different
+VRFs, sources, or counts.
+
 `serve` is optional because it is the default command, but is shown explicitly
-here for clarity. You can also add the server with:
+here for clarity. After exporting the password, you can also add the server and
+pass its current value through with the Codex CLI:
 
 ```bash
-codex mcp add eos -- eos-mcp-server serve --inventory /absolute/path/to/inventory.yml
+export EOS_MCP_PASSWORD='replace-with-device-password'
+
+codex mcp add eos \
+  --env EOS_MCP_PASSWORD="$EOS_MCP_PASSWORD" \
+  -- npx -y @aristanetworks/eos-mcp-server serve \
+  --inventory /absolute/path/to/inventory.yml
 ```
 
-Then add `env_vars = ["EOS_MCP_PASSWORD"]` to the generated
-`[mcp_servers.eos]` table.
+The `--env` form stores the expanded value in the generated Codex configuration.
+To have Codex read the variable from its environment each time it starts the
+server, use `env_vars = ["EOS_MCP_PASSWORD"]` as in the TOML examples above.
 
 ### Passing secrets to the MCP server
 
-Prefer exporting secrets in the environment that launches the MCP client:
+To export secrets in the environment that launches the MCP client use:
 
 ```bash
 export EOS_MCP_PASSWORD='super-secret'
@@ -244,6 +329,30 @@ For Codex, `env_vars = ["EOS_MCP_PASSWORD"]` forwards that exported variable to
 the server. Other MCP clients may support per-server `env` blocks. Avoid
 committing secret values to client config files when possible.
 
+## Skills
+
+The [`skills/`](skills/) folder holds community-created skills for everyday network operations workflows. Each skill is a `SKILL.md` file that teaches an AI assistant, such as Claude Code or Codex, how to carry out one workflow with this server's read-only tools: which `show` commands to run, how to read the output, what to investigate next, and how to report results.
+
+The current skills cover:
+
+- **Health checks:** BGP, EVPN and EVPN multicast, interfaces, Port-Channels/LACP, VLANs, routing tables and VRFs, IGMP snooping, and PIM.
+- **Validation:** ISIS Segment Routing, RFC 9721 EVPN IP mobility, and MCS/CVX configuration.
+- **Troubleshooting:** multicast flows that are missing, dropping, or corrupted; PTP grandmaster and connectivity problems; Segment Routing faults; and MCS mounts and agents.
+
+See [`skills/README.md`](skills/README.md) for the full list and for how to load the skills into Claude Code or Codex. Skills aren't included in the npm package, so clone this repository to use them.
+
+### Contribute a skill
+
+If you have a workflow you run by hand, such as a check you do after a change window, a runbook for a recurring problem, or an audit for a feature your network depends on, consider contributing it as a skill so other network engineers can use it too.
+
+1. Add `skills/<skill-name>/SKILL.md` with `name`, `description`, `trigger`, and `allowed-tools` frontmatter. The existing skills are good templates.
+2. Keep it **read-only**, and keep it **generic**: no site-specific hostnames, group names, or inventory layouts.
+3. Document the EOS commands the skill runs, the JSON fields it relies on, and what to check when something looks wrong.
+4. Add a row for the skill to the table in [`skills/README.md`](skills/README.md).
+5. Open a pull request that changes only files under `skills/`.
+
+Pull requests that touch only `skills/` can be accepted without a contributor license agreement. They are licensed under Apache-2.0. See [CONTRIBUTING.md](CONTRIBUTING.md) for details, and [Writing a new skill](skills/README.md#writing-a-new-skill) for the full guidelines. Improvements to existing skills are welcome too, such as coverage for another EOS feature, a better diagnostic drill-down, or a fix for output that changed between EOS releases.
+
 ## Inventory formats
 
 The server supports exactly one inventory file loaded at startup. The inventory is not watched for changes — to pick up inventory edits, restart the server. Most MCP clients will do this automatically when you restart the client or re-launch the MCP connection.
@@ -326,6 +435,8 @@ still using their individual credentials.
   - `mcp_platform: arista_eos`
 - `mcp_read_allowed` defaults to `true` for eligible EOS hosts. Set it to `false` — inherited like any other variable — to explicitly deny read access to a host or group.
 - Read operations fail closed if the resolved target contains ineligible or read-denied hosts.
+- `mcp_diagnostics_allowed` defaults to `false`. Set this inherited boolean to `true` to permit `eos_ping`; read denial still vetoes diagnostics. A mixed-permission group fails before any dispatch.
+- A diagnostic destination is distinct from the inventory target and may be an address outside inventory.
 
 ## Connection and authentication
 
@@ -407,7 +518,7 @@ caFile: /path/to/ca.pem
 
 ## CLI usage
 
-If no subcommand is provided, the CLI defaults to `serve`.
+If no subcommand is provided, the CLI defaults to `serve`. These examples use the globally installed `eos-mcp-server` command; with npx, run `npx -y @aristanetworks/eos-mcp-server` in its place.
 
 ### `serve`
 
@@ -441,6 +552,29 @@ eos-mcp-server print-server-info --inventory inventory.yml
 eos-mcp-server print-server-info --config eos-mcp-server.yml --json
 ```
 
+### `inspect-diagnostics`
+
+Inspect existing persisted reservations without credentials, device access, ownership takeover, or reset. `diagnostics.stateFile` can select a ledger; otherwise the same canonical inventory identity determines the default path.
+
+```bash
+eos-mcp-server inspect-diagnostics --config eos-mcp-server.yml --json
+eos-mcp-server inspect-diagnostics --inventory inventory.yml --json
+```
+
+Recorded state does not prove remote completion. Preserve the state files on private, persistent local storage; see [Network diagnostics](docs/DIAGNOSTICS.md#offline-inspection-and-operator-recovery).
+
+### `release-diagnostics`
+
+Offline local-state administration only: stop the ledger owner, independently establish that running **and accepted queued** work is fenced against later execution/replay, and prepare a private JSON attestation. This is operator authority, not machine-confirmed EOS completion.
+
+```bash
+eos-mcp-server release-diagnostics --config eos-mcp-server.yml \
+  --reservation-id '<exact-id>' --evidence-file ./evidence.json \
+  --confirm-fenced --json
+```
+
+There is no wildcard or release-all operation. Audit and selected deletions commit atomically; unselected reservations remain held. See the [required workflow and intentionally invalid template](docs/DIAGNOSTICS.md#operator-release-workflow) before use. No device command, credential resolution, or evidence-reference fetch is performed. Protect the CLI and ledger owner's OS privileges; the attestation is not a cryptographic proof of human presence or fencing truth.
+
 ### `probe`
 
 Probe a host or group target using the same logic as the MCP tool.
@@ -462,7 +596,7 @@ Devices: 1/1 succeeded
 
 ### `eos_get_server_info`
 
-Returns a sanitized summary of server runtime, capabilities, limits, TLS/config posture, and inventory summary.
+Returns a sanitized summary of server runtime, capabilities, limits, TLS/config posture, inventory summary, and live active/uncertain diagnostic reservations. Reservation metadata excludes destinations, credentials, and original EOS output.
 
 Input:
 
@@ -495,6 +629,23 @@ Input:
 }
 ```
 
+### `eos_ping`
+
+Runs bounded ping from an inventory host or group to one or more destinations, requiring inherited `mcp_diagnostics_allowed: true`. It generates traffic without changing configuration. Each destination must be a unicast IPv4/IPv6 literal, and duplicates are rejected, including different spellings of the same IPv6 address; use a one-element `destinations` array for a single ping. Destinations run concurrently within the server's diagnostic concurrency, up to 16 per call by default. Optional VRF and source IP apply to every destination and never silently fall back. Count defaults to 3 per destination and is capped at 10 unless changed in settings.
+
+```json
+{
+  "target": "leaf1",
+  "destinations": ["192.0.2.10", "192.0.2.20"],
+  "count": 3,
+  "vrf": "BLUE",
+  "source": "192.0.2.11",
+  "include_raw": false
+}
+```
+
+`count`, `vrf`, `source`, and `include_raw` are optional. Results contain one entry per host and destination, each naming its `destination`; `summary` counts those entries. Results separate execution status from `reachable`/`partial`/`unreachable` findings and include loss/RTT measurements. Zero replies do not establish a cause. See [Network diagnostics](docs/DIAGNOSTICS.md) for all limits, address restrictions, lifecycle caveats, and result semantics. Traceroute and packet capture are not yet implemented.
+
 ### `eos_run_show`
 
 Runs one or more `show` commands.
@@ -624,18 +775,20 @@ This means the target resolved to at least one host that is either not marked as
 
 The read-path tools have been validated against EOS 4.34.3M. The minimum supported EOS version for read operations is 4.20, which is when eAPI JSON-RPC became stable and `show` commands reliably produce structured JSON output.
 
+`eos_ping` has separately been validated on cEOS 4.34.3M. Older EOS versions and physical platforms have not been qualified for this new tool.
+
 ## Design notes
 
-- inventory is the trust boundary
+- inventory is the execution-target trust boundary; diagnostic destinations may be outside inventory
 - reads are fail-closed on ineligible or denied targets
-- the server exposes only documented read-only operations
+- the server exposes only documented non-configuring operations; active diagnostics require explicit opt-in
 
 ## Project docs
 
 Additional design and planning docs in the `docs/` directory:
 
-- `docs/design-overview.md` — design overview for evaluators
 - `docs/DESIGN.md` — detailed design specification
+- `docs/DIAGNOSTICS.md` — ping usage, settings, safety, lifecycle, and extension seam
 - `docs/IMPLEMENTATION_PLAN.md` — implemented scope and maintenance priorities
 - `docs/CHECKPOINT.md` — current implementation status
 - `docs/CODE_WALKTHROUGH.md` — source layout and module guide

package/dist/cli.d.ts

@@ -1,4 +1,4 @@
-export type CommandName = "serve" | "validate-inventory" | "print-server-info" | "probe";
+export type CommandName = "serve" | "validate-inventory" | "print-server-info" | "probe" | "inspect-diagnostics" | "release-diagnostics";
 export interface CliOptions {
     command: CommandName;
     explicitCommand?: boolean;
@@ -10,6 +10,9 @@ export interface CliOptions {
     json?: boolean;
     inventoryOnly?: boolean;
     target?: string;
+    reservationIds?: string[];
+    evidenceFile?: string;
+    confirmFenced?: boolean;
 }
 export declare function parseCliArgs(argv: string[]): CliOptions;
 export declare function printHelp(cli: CliOptions): void;

package/dist/cli.js

@@ -1,6 +1,6 @@
 import { AppError } from "./core/errors.js";
 import { APP_NAME, APP_VERSION } from "./core/version.js";
-const COMMAND_NAMES = new Set(["serve", "validate-inventory", "print-server-info", "probe"]);
+const COMMAND_NAMES = new Set(["serve", "validate-inventory", "print-server-info", "probe", "inspect-diagnostics", "release-diagnostics"]);
 const OPTION_NAMES = new Set([
     "--help",
     "-h",
@@ -11,7 +11,10 @@ const OPTION_NAMES = new Set([
     "--actor",
     "--json",
     "--inventory-only",
-    "--target"
+    "--target",
+    "--reservation-id",
+    "--evidence-file",
+    "--confirm-fenced"
 ]);
 const COMMAND_OPTIONS = {
     "serve": new Set([
@@ -25,7 +28,9 @@ const COMMAND_OPTIONS = {
     ]),
     "validate-inventory": new Set(["--help", "-h", "--version", "-V", "--config", "--inventory", "--inventory-only", "--json"]),
     "print-server-info": new Set(["--help", "-h", "--version", "-V", "--config", "--inventory", "--json"]),
-    "probe": new Set(["--help", "-h", "--version", "-V", "--config", "--inventory", "--target", "--json"])
+    "probe": new Set(["--help", "-h", "--version", "-V", "--config", "--inventory", "--target", "--json"]),
+    "inspect-diagnostics": new Set(["--help", "-h", "--version", "-V", "--config", "--inventory", "--json"]),
+    "release-diagnostics": new Set(["--help", "-h", "--version", "-V", "--config", "--inventory", "--json", "--reservation-id", "--evidence-file", "--confirm-fenced"])
 };
 export function parseCliArgs(argv) {
     let command = "serve";
@@ -93,6 +98,32 @@ export function parseCliArgs(argv) {
                 options.inventoryOnly = true;
                 index += 1;
                 break;
+            case "--reservation-id": {
+                const value = argv[index + 1];
+                if (!value || value.startsWith("-"))
+                    throw new AppError("cli_missing_value", "Missing value for --reservation-id");
+                if (options.reservationIds?.includes(value))
+                    throw new AppError("cli_duplicate_option", "Duplicate reservation ID");
+                (options.reservationIds ??= []).push(value);
+                index += 2;
+                break;
+            }
+            case "--evidence-file": {
+                const value = argv[index + 1];
+                if (!value || value.startsWith("-"))
+                    throw new AppError("cli_missing_value", "Missing value for --evidence-file");
+                if (options.evidenceFile !== undefined)
+                    throw new AppError("cli_duplicate_option", "Duplicate --evidence-file");
+                options.evidenceFile = value;
+                index += 2;
+                break;
+            }
+            case "--confirm-fenced":
+                if (options.confirmFenced !== undefined)
+                    throw new AppError("cli_duplicate_option", "Duplicate --confirm-fenced");
+                options.confirmFenced = true;
+                index += 1;
+                break;
             case "--target": {
                 const value = argv[index + 1];
                 if (!value) {
@@ -124,6 +155,8 @@ Commands:
   validate-inventory    Validate an inventory file
   print-server-info     Print server runtime/config summary
   probe                 Probe device readiness for a target
+  inspect-diagnostics   Inspect persisted reservations and release audit (read-only)
+  release-diagnostics   Offline, audited operator-attested reservation release
 
 Global options:
   --config <path>       Path to server config YAML file
@@ -172,11 +205,37 @@ Options:
   --target <name>       Host or group name to probe (required)
   --json                Output as JSON
   -h, --help            Show this help message`;
+const HELP_INSPECT_DIAGNOSTICS = `Usage: ${APP_NAME} inspect-diagnostics [options]
+
+Read the diagnostic ledger without device access, ownership takeover, or reset.
+Recorded state is not proof of remote completion.
+
+Options:
+  --config <path>       Settings file, including optional diagnostics.stateFile
+  --inventory <path>    Inventory identity used for the default ledger path
+  --json                Output persisted reservations as JSON
+  -h, --help            Show this help message`;
+const HELP_RELEASE_DIAGNOSTICS = `Usage: ${APP_NAME} release-diagnostics [options]
+
+Release only explicit reservations after independently verified fencing.
+Requires exclusive offline ledger ownership. No device commands or MCP reset.
+The evidence is operator authority, not machine-confirmed EOS completion.
+
+Options:
+  --config <path>          Settings file selecting the existing ledger
+  --inventory <path>       Expected canonical inventory identity
+  --reservation-id <id>    Exact reservation to release (repeat for a batch)
+  --evidence-file <path>   Private UTF-8 JSON fencing attestation (max 65536 bytes)
+  --confirm-fenced        Confirm running, queued and replayable work is fenced
+  --json                 Output committed release metadata or error as JSON
+  -h, --help             Show this help message`;
 const COMMAND_HELP = {
     "serve": HELP_SERVE,
     "validate-inventory": HELP_VALIDATE_INVENTORY,
     "print-server-info": HELP_PRINT_SERVER_INFO,
-    "probe": HELP_PROBE
+    "probe": HELP_PROBE,
+    "inspect-diagnostics": HELP_INSPECT_DIAGNOSTICS,
+    "release-diagnostics": HELP_RELEASE_DIAGNOSTICS
 };
 export function printHelp(cli) {
     const helpText = cli.explicitCommand ? COMMAND_HELP[cli.command] : HELP_TOP;

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAI1D,MAAM,aAAa,GAAG,IAAI,GAAG,CAAS,CAAC,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,OAAO,CAAC,CAAC,CAAC;AACrG,MAAM,YAAY,GAAG,IAAI,GAAG,CAAS;IACnC,QAAQ;IACR,IAAI;IACJ,WAAW;IACX,IAAI;IACJ,UAAU;IACV,aAAa;IACb,SAAS;IACT,QAAQ;IACR,kBAAkB;IAClB,UAAU;CACX,CAAC,CAAC;AAEH,MAAM,eAAe,GAA6C;IAChE,OAAO,EAAE,IAAI,GAAG,CAAC;QACf,QAAQ;QACR,IAAI;QACJ,WAAW;QACX,IAAI;QACJ,UAAU;QACV,aAAa;QACb,SAAS;KACV,CAAC;IACF,oBAAoB,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,kBAAkB,EAAE,QAAQ,CAAC,CAAC;IAC3H,mBAAmB,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;IACtG,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;CACvG,CAAC;AAeF,MAAM,UAAU,YAAY,CAAC,IAAc;IACzC,IAAI,OAAO,GAAgB,OAAO,CAAC;IACnC,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACjC,CAAC;IACD,IAAI,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACpC,CAAC;IAED,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,KAAK,KAAK,SAAS,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO,GAAG,KAAoB,CAAC;QAC/B,eAAe,GAAG,IAAI,CAAC;QACvB,KAAK,GAAG,CAAC,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAe,EAAE,OAAO,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAE/F,OAAO,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,GAAG,KAAK,SAAS,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,mBAAmB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACpC,CAAC;QAED,QAAQ,GAAG,EAAE,CAAC;YACZ,KAAK,QAAQ,CAAC;YACd,KAAK,IAAI;gBACP,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;gBACpB,OAAO,OAAO,CAAC;YACjB,KAAK,WAAW,CAAC;YACjB,KAAK,IAAI;gBACP,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;gBACvB,OAAO,OAAO,CAAC;YACjB,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;gBAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,IAAI,QAAQ,CAAC,mBAAmB,EAAE,4BAA4B,CAAC,CAAC;gBACxE,CAAC;gBACD,OAAO,CAAC,UAAU,GAAG,KAAK,CAAC;gBAC3B,KAAK,IAAI,CAAC,CAAC;gBACX,MAAM;YACR,CAAC;YACD,KAAK,aAAa,CAAC,CAAC,CAAC;gBACnB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;gBAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,IAAI,QAAQ,CAAC,mBAAmB,EAAE,+BAA+B,CAAC,CAAC;gBAC3E,CAAC;gBACD,OAAO,CAAC,aAAa,GAAG,KAAK,CAAC;gBAC9B,KAAK,IAAI,CAAC,CAAC;gBACX,MAAM;YACR,CAAC;YACD,KAAK,SAAS,CAAC,CAAC,CAAC;gBACf,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;gBAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,IAAI,QAAQ,CAAC,mBAAmB,EAAE,2BAA2B,CAAC,CAAC;gBACvE,CAAC;gBACD,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC;gBACtB,KAAK,IAAI,CAAC,CAAC;gBACX,MAAM;YACR,CAAC;YACD,KAAK,QAAQ;gBACX,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;gBACpB,KAAK,IAAI,CAAC,CAAC;gBACX,MAAM;YACR,KAAK,kBAAkB;gBACrB,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;gBAC7B,KAAK,IAAI,CAAC,CAAC;gBACX,MAAM;YACR,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;gBAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,IAAI,QAAQ,CAAC,mBAAmB,EAAE,4BAA4B,CAAC,CAAC;gBACxE,CAAC;gBACD,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC;gBACvB,KAAK,IAAI,CAAC,CAAC;gBACX,MAAM;YACR,CAAC;YACD;gBACE,MAAM,IAAI,QAAQ,CAAC,sBAAsB,EAAE,qBAAqB,GAAG,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAoB,EAAE,MAAc;IAC/D,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,QAAQ,CAAC,wBAAwB,EAAE,UAAU,MAAM,6BAA6B,OAAO,EAAE,CAAC,CAAC;IACvG,CAAC;AACH,CAAC;AAED,MAAM,cAAc,GAAG,GAAG,QAAQ,KAAK,WAAW,EAAE,CAAC;AAErD,MAAM,QAAQ,GAAG,GAAG,cAAc;;;SAGzB,QAAQ;;;;;;;;;;;;;;OAcV,QAAQ,kDAAkD,CAAC;AAElE,MAAM,UAAU,GAAG,UAAU,QAAQ;;;;;;;;+CAQU,CAAC;AAEhD,MAAM,uBAAuB,GAAG,UAAU,QAAQ;;;;;;;;;;+CAUH,CAAC;AAEhD,MAAM,sBAAsB,GAAG,UAAU,QAAQ;;;;;;;;+CAQF,CAAC;AAEhD,MAAM,UAAU,GAAG,UAAU,QAAQ;;;;;;;;;;+CAUU,CAAC;AAEhD,MAAM,YAAY,GAAgC;IAChD,OAAO,EAAE,UAAU;IACnB,oBAAoB,EAAE,uBAAuB;IAC7C,mBAAmB,EAAE,sBAAsB;IAC3C,OAAO,EAAE,UAAU;CACpB,CAAC;AAEF,MAAM,UAAU,SAAS,CAAC,GAAe;IACvC,MAAM,QAAQ,GAAG,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC5E,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;AAC9B,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAI1D,MAAM,aAAa,GAAG,IAAI,GAAG,CAAS,CAAC,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,CAAC,CAAC,CAAC;AACnJ,MAAM,YAAY,GAAG,IAAI,GAAG,CAAS;IACnC,QAAQ;IACR,IAAI;IACJ,WAAW;IACX,IAAI;IACJ,UAAU;IACV,aAAa;IACb,SAAS;IACT,QAAQ;IACR,kBAAkB;IAClB,UAAU;IACV,kBAAkB;IAClB,iBAAiB;IACjB,kBAAkB;CACnB,CAAC,CAAC;AAEH,MAAM,eAAe,GAA6C;IAChE,OAAO,EAAE,IAAI,GAAG,CAAC;QACf,QAAQ;QACR,IAAI;QACJ,WAAW;QACX,IAAI;QACJ,UAAU;QACV,aAAa;QACb,SAAS;KACV,CAAC;IACF,oBAAoB,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,kBAAkB,EAAE,QAAQ,CAAC,CAAC;IAC3H,mBAAmB,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;IACtG,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;IACtG,qBAAqB,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;IACxG,qBAAqB,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,kBAAkB,CAAC,CAAC;CACpK,CAAC;AAkBF,MAAM,UAAU,YAAY,CAAC,IAAc;IACzC,IAAI,OAAO,GAAgB,OAAO,CAAC;IACnC,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACjC,CAAC;IACD,IAAI,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACpC,CAAC;IAED,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,KAAK,KAAK,SAAS,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO,GAAG,KAAoB,CAAC;QAC/B,eAAe,GAAG,IAAI,CAAC;QACvB,KAAK,GAAG,CAAC,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAe,EAAE,OAAO,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAE/F,OAAO,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,GAAG,KAAK,SAAS,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,mBAAmB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACpC,CAAC;QAED,QAAQ,GAAG,EAAE,CAAC;YACZ,KAAK,QAAQ,CAAC;YACd,KAAK,IAAI;gBACP,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;gBACpB,OAAO,OAAO,CAAC;YACjB,KAAK,WAAW,CAAC;YACjB,KAAK,IAAI;gBACP,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;gBACvB,OAAO,OAAO,CAAC;YACjB,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;gBAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,IAAI,QAAQ,CAAC,mBAAmB,EAAE,4BAA4B,CAAC,CAAC;gBACxE,CAAC;gBACD,OAAO,CAAC,UAAU,GAAG,KAAK,CAAC;gBAC3B,KAAK,IAAI,CAAC,CAAC;gBACX,MAAM;YACR,CAAC;YACD,KAAK,aAAa,CAAC,CAAC,CAAC;gBACnB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;gBAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,IAAI,QAAQ,CAAC,mBAAmB,EAAE,+BAA+B,CAAC,CAAC;gBAC3E,CAAC;gBACD,OAAO,CAAC,aAAa,GAAG,KAAK,CAAC;gBAC9B,KAAK,IAAI,CAAC,CAAC;gBACX,MAAM;YACR,CAAC;YACD,KAAK,SAAS,CAAC,CAAC,CAAC;gBACf,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;gBAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,IAAI,QAAQ,CAAC,mBAAmB,EAAE,2BAA2B,CAAC,CAAC;gBACvE,CAAC;gBACD,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC;gBACtB,KAAK,IAAI,CAAC,CAAC;gBACX,MAAM;YACR,CAAC;YACD,KAAK,QAAQ;gBACX,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;gBACpB,KAAK,IAAI,CAAC,CAAC;gBACX,MAAM;YACR,KAAK,kBAAkB;gBACrB,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;gBAC7B,KAAK,IAAI,CAAC,CAAC;gBACX,MAAM;YACR,KAAK,kBAAkB,CAAC,CAAC,CAAC;gBACxB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;gBAC9B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,MAAM,IAAI,QAAQ,CAAC,mBAAmB,EAAE,oCAAoC,CAAC,CAAC;gBACnH,IAAI,OAAO,CAAC,cAAc,EAAE,QAAQ,CAAC,KAAK,CAAC;oBAAE,MAAM,IAAI,QAAQ,CAAC,sBAAsB,EAAE,0BAA0B,CAAC,CAAC;gBACpH,CAAC,OAAO,CAAC,cAAc,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC5C,KAAK,IAAI,CAAC,CAAC;gBACX,MAAM;YACR,CAAC;YACD,KAAK,iBAAiB,CAAC,CAAC,CAAC;gBACvB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;gBAC9B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,MAAM,IAAI,QAAQ,CAAC,mBAAmB,EAAE,mCAAmC,CAAC,CAAC;gBAClH,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS;oBAAE,MAAM,IAAI,QAAQ,CAAC,sBAAsB,EAAE,2BAA2B,CAAC,CAAC;gBAChH,OAAO,CAAC,YAAY,GAAG,KAAK,CAAC;gBAC7B,KAAK,IAAI,CAAC,CAAC;gBACX,MAAM;YACR,CAAC;YACD,KAAK,kBAAkB;gBACrB,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS;oBAAE,MAAM,IAAI,QAAQ,CAAC,sBAAsB,EAAE,4BAA4B,CAAC,CAAC;gBAClH,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;gBAC7B,KAAK,IAAI,CAAC,CAAC;gBACX,MAAM;YACR,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;gBAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,IAAI,QAAQ,CAAC,mBAAmB,EAAE,4BAA4B,CAAC,CAAC;gBACxE,CAAC;gBACD,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC;gBACvB,KAAK,IAAI,CAAC,CAAC;gBACX,MAAM;YACR,CAAC;YACD;gBACE,MAAM,IAAI,QAAQ,CAAC,sBAAsB,EAAE,qBAAqB,GAAG,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAoB,EAAE,MAAc;IAC/D,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,QAAQ,CAAC,wBAAwB,EAAE,UAAU,MAAM,6BAA6B,OAAO,EAAE,CAAC,CAAC;IACvG,CAAC;AACH,CAAC;AAED,MAAM,cAAc,GAAG,GAAG,QAAQ,KAAK,WAAW,EAAE,CAAC;AAErD,MAAM,QAAQ,GAAG,GAAG,cAAc;;;SAGzB,QAAQ;;;;;;;;;;;;;;;;OAgBV,QAAQ,kDAAkD,CAAC;AAElE,MAAM,UAAU,GAAG,UAAU,QAAQ;;;;;;;;+CAQU,CAAC;AAEhD,MAAM,uBAAuB,GAAG,UAAU,QAAQ;;;;;;;;;;+CAUH,CAAC;AAEhD,MAAM,sBAAsB,GAAG,UAAU,QAAQ;;;;;;;;+CAQF,CAAC;AAEhD,MAAM,UAAU,GAAG,UAAU,QAAQ;;;;;;;;;;+CAUU,CAAC;AAEhD,MAAM,wBAAwB,GAAG,UAAU,QAAQ;;;;;;;;;+CASJ,CAAC;AAEhD,MAAM,wBAAwB,GAAG,UAAU,QAAQ;;;;;;;;;;;;;gDAaH,CAAC;AAEjD,MAAM,YAAY,GAAgC;IAChD,OAAO,EAAE,UAAU;IACnB,oBAAoB,EAAE,uBAAuB;IAC7C,mBAAmB,EAAE,sBAAsB;IAC3C,OAAO,EAAE,UAAU;IACnB,qBAAqB,EAAE,wBAAwB;IAC/C,qBAAqB,EAAE,wBAAwB;CAChD,CAAC;AAEF,MAAM,UAAU,SAAS,CAAC,GAAe;IACvC,MAAM,QAAQ,GAAG,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC5E,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;AAC9B,CAAC"}

package/dist/commands/inspectDiagnostics.d.ts

@@ -0,0 +1,3 @@
+import type { ResolvedServerConfig } from "../config/schema.js";
+/** Offline/read-only: no credentials, device calls, ownership takeover, or capacity reset. */
+export declare function runInspectDiagnostics(config: ResolvedServerConfig, asJson: boolean): Promise<number>;