@tikoci/centrs 0.1.7 → 0.1.8

package/src/errors.ts

@@ -5,7 +5,16 @@
  */
 export const ERROR_DETAILS_BASE_URL = "https://tikoci.github.io/centrs/errors/";
 
+/**
+ * Remediation for a device-stage `:parse` rejection. It does not claim the
+ * syntax is wrong: RouterOS rejects an absent menu (unknown path, package not
+ * installed) in the same words, and #361 tracks telling those apart.
+ */
+export const SYNTAX_REJECTED_REMEDIATION =
+	"RouterOS refused to parse this command; its own words are in `Device said`. Check the syntax with `centrs explain '<command>'`. A menu that does not exist on this device (an unknown path, or a package that is not installed) is rejected the same way.";
+
 export type CentrsErrorCode =
+	| `wait/${string}`
 	| `auth/${string}`
 	| `cdb/${string}`
 	| `discover/${string}`
@@ -120,34 +129,134 @@ export function asCentrsError(
 	});
 }
 
+/**
+ * The one text renderer for an error, shared by every command (GH#362).
+ *
+ * Order: header, where (`At:`), the device's own words (`Device said:`), `Fix:`,
+ * `Details:`. Where and the device's words print without `--verbose`: they are
+ * what lets a caller recover from a remediation that names the wrong cause.
+ * `--verbose` adds the full `context` object. A command that has more to say
+ * (warnings, tips) appends to this output; it never re-derives the header.
+ */
 export function formatCentrsErrorText(
 	error: CentrsError | SerializedCentrsError,
 	options: { verbose?: boolean } = {},
 ): string {
 	const serialized = serializeCentrsError(error);
-	const lines = [`[${serialized.code}] ${serialized.summary}`];
+	const lines = errorFields(serialized);
+	if (options.verbose && serialized.context) {
+		lines.push("");
+		lines.push(terminalSafe(JSON.stringify(serialized.context, null, 2)));
+	}
+	return lines.join("\n");
+}
+
+/**
+ * The same fields as `formatCentrsErrorText`, on one line joined by ` — `, for
+ * output that must stay line-per-record (`api --stream --format text`).
+ * `--verbose` adds nothing here: a context block cannot be one line.
+ */
+export function formatCentrsErrorLine(
+	error: CentrsError | SerializedCentrsError,
+): string {
+	return errorFields(serializeCentrsError(error)).map(oneLine).join(" — ");
+}
+
+function errorFields(serialized: SerializedCentrsError): string[] {
+	const lines = [`[${serialized.code}] ${terminalSafe(serialized.summary)}`];
 
 	if (serialized.position) {
 		// RouterOS's authoritative byte column (1-based); see RouterOsErrorPosition.
 		lines.push(
 			`At: line ${serialized.position.line}, column ${serialized.position.column} (RouterOS byte offset)`,
 		);
+	} else {
+		const offline = offlineSpanText(serialized.context);
+		if (offline) lines.push(offline);
+	}
+
+	const deviceSaid = deviceSaidText(serialized);
+	if (deviceSaid) {
+		lines.push(`Device said: ${terminalSafe(deviceSaid)}`);
 	}
 
 	if (serialized.remediation) {
-		lines.push(`Fix: ${serialized.remediation}`);
+		lines.push(`Fix: ${terminalSafe(serialized.remediation)}`);
 	}
 
 	if (serialized.detailsUrl) {
 		lines.push(`Details: ${serialized.detailsUrl}`);
 	}
 
-	if (options.verbose && serialized.context) {
-		lines.push("");
-		lines.push(JSON.stringify(serialized.context, null, 2));
-	}
+	return lines;
+}
 
-	return lines.join("\n");
+const DEVICE_SAID_MAX = 240;
+
+/**
+ * Control characters other than tab and newline, C1 included. Summaries and
+ * `detail` carry router-supplied text; an ESC or CR in it would drive the
+ * terminal. `JSON.stringify` escapes C0 but not C1, so serialized excerpts need
+ * this too. `--json` keeps the raw value.
+ */
+// biome-ignore lint/suspicious/noControlCharactersInRegex: matching them is the point.
+const TERMINAL_CONTROL = /[\u0000-\u0008\u000b-\u001f\u007f-\u009f]/g;
+
+function terminalSafe(text: string): string {
+	return text.replace(TERMINAL_CONTROL, " ");
+}
+
+/** Compact records also replace tab/newline so external text cannot add rows. */
+export function terminalSafeLine(text: string): string {
+	return terminalSafe(text).replace(/[\t\n]/g, " ");
+}
+
+function oneLine(text: string): string {
+	return text.replace(/\s+/g, " ").trim();
+}
+
+/**
+ * RouterOS's own verdict, from `context.detail`: the raw `:parse` return or the
+ * trap / REST message, as `mapRouterOsError` and `classifyParseResult` store it.
+ * Collapsed to one line and capped. Omitted when the summary already quotes it,
+ * so a trap message is not printed twice. `--json` keeps it unabridged.
+ */
+function deviceSaidText(error: SerializedCentrsError): string | undefined {
+	const detail = error.context?.["detail"];
+	if (typeof detail !== "string") return undefined;
+	const said = oneLine(detail);
+	if (said.length === 0 || oneLine(error.summary).includes(said))
+		return undefined;
+	return said.length > DEVICE_SAID_MAX
+		? `${said.slice(0, DEVICE_SAID_MAX)}…`
+		: said;
+}
+
+/**
+ * The offline gate's rejected byte range (`context.span`, 0-based, end-exclusive,
+ * into `context.command`). Labelled as offline analysis so it is never mistaken
+ * for a RouterOS-reported position (see `src/offline-gate.ts`).
+ */
+function offlineSpanText(
+	context: Record<string, unknown> | undefined,
+): string | undefined {
+	const span = context?.["span"];
+	if (
+		!span ||
+		typeof span !== "object" ||
+		typeof (span as { start?: unknown }).start !== "number" ||
+		typeof (span as { end?: unknown }).end !== "number"
+	) {
+		return undefined;
+	}
+	const { start, end } = span as { start: number; end: number };
+	const command = context?.["command"];
+	const excerpt =
+		typeof command === "string" && end > start
+			? `: ${terminalSafe(JSON.stringify(new TextDecoder().decode(new TextEncoder().encode(command).subarray(start, end))))}`
+			: "";
+	// Half-open, exactly as `context.span` carries it.
+	return `At: bytes [${start}, ${end}) (offline analysis)${excerpt}`;
 }
 
 export function serializeUnknownError(error: unknown): unknown {

package/src/execute-fanout.ts

@@ -38,7 +38,12 @@ import {
 	summarizeFanout,
 } from "./core/fanout.ts";
 import { toYaml } from "./core/yaml.ts";
-import { CentrsError, serializeCentrsError } from "./errors.ts";
+import {
+	CentrsError,
+	formatCentrsErrorText,
+	serializeCentrsError,
+	terminalSafeLine,
+} from "./errors.ts";
 import {
 	buildExecuteErrorEnvelopeFromResolved,
 	type ExecuteEnvelope,
@@ -428,11 +433,7 @@ export function renderExecuteFanoutEnvelope(
 		return toYaml(envelope);
 	}
 	if (!envelope.ok) {
-		const lines = [`[${envelope.error.code}] ${envelope.error.summary}`];
-		if (envelope.error.remediation) {
-			lines.push(`Fix: ${envelope.error.remediation}`);
-		}
-		return lines.join("\n");
+		return formatCentrsErrorText(envelope.error, options);
 	}
 	const operation = envelope.meta.operation;
 	const { total, ok, failed } = envelope.data.summary;
@@ -453,10 +454,14 @@ export function renderExecuteFanoutEnvelope(
 			);
 		} else {
 			lines.push(
-				`  [${index}] FAIL  ${label} [${target.error.code}] ${target.error.summary}`,
+				terminalSafeLine(
+					`  [${index}] FAIL  ${label} [${target.error.code}] ${target.error.summary}`,
+				),
 			);
 			if (options.verbose && target.error.remediation) {
-				lines.push(`        Fix: ${target.error.remediation}`);
+				lines.push(
+					terminalSafeLine(`        Fix: ${target.error.remediation}`),
+				);
 			}
 		}
 	}

package/src/execute.ts

@@ -10,7 +10,7 @@ import type {
 	ValidationTrace,
 	Warning,
 } from "./core/envelope.ts";
-import { buildTip } from "./core/envelope.ts";
+import { buildTip, notReachedReason } from "./core/envelope.ts";
 import {
 	type CanonicalExecuteCommand,
 	canonicalizeExecuteCommand,
@@ -20,7 +20,12 @@ import { inspectArgumentNames, pathTokens } from "./core/inspect.ts";
 import { mapRouterOsResultError } from "./core/routeros-errors.ts";
 import { routerOsStringLiteral } from "./core/routeros-string.ts";
 import { toYaml } from "./core/yaml.ts";
-import { CentrsError, serializeCentrsError } from "./errors.ts";
+import {
+	CentrsError,
+	formatCentrsErrorText,
+	SYNTAX_REJECTED_REMEDIATION,
+	serializeCentrsError,
+} from "./errors.ts";
 import {
 	assertOfflineSyntax,
 	isOfflineGateRejection,
@@ -623,18 +628,21 @@ function failedValidationMeta(
 		return disabledValidationMeta();
 	}
 	const deviceSource = deviceStageSource(resolved);
-	// Script-shaped input has no `/console/inspect` half to fail, on either
-	// branch below. Reporting `semantic: false` for it would say a semantic gate
-	// ran and said no, which is a different claim from "there was none".
-	const semantic: boolean | "not-applicable" =
-		resolved.canonical.mode === "structured" ? false : "not-applicable";
+	const structured = resolved.canonical.mode === "structured";
+	// A flat summary is present only when its check gave a verdict (GH#435).
+	// Script-shaped input has no semantic half at all: `not-applicable`. For
+	// structured input, a syntax rejection means the name-level check was
+	// never asked, so `semantic` is left out rather than reported `false`.
+	const semanticNotReached = structured
+		? {}
+		: { semantic: "not-applicable" as const };
 	if (isOfflineGateRejection(error)) {
 		return {
 			enabled: true,
 			source: OFFLINE_GATE_SOURCE,
 			result: "failed",
 			syntax: false,
-			semantic,
+			...semanticNotReached,
 			stages: [
 				{ stage: "offline", source: OFFLINE_GATE_SOURCE, result: "failed" },
 				{
@@ -648,31 +656,60 @@ function failedValidationMeta(
 	}
 	// Only a `validation/*` error tells us the DEVICE stage rejected it — and
 	// only then do we know stage 1 passed, because stage 1 runs first and would
-	// have thrown its own (offline-tagged) error otherwise. This builder also
-	// catches everything downstream — a RouterOS fault on the run, a transport
-	// drop — which passed both stages and is served by `trace.validation`. When
-	// neither applies, `stages` is omitted rather than asserting a verdict this
-	// function cannot know.
-	const deviceRejected =
-		error instanceof CentrsError && error.code.startsWith("validation/");
+	// have thrown its own (offline-tagged) error otherwise. Everything downstream
+	// of a passed gate — a RouterOS fault on the run, a transport drop — is
+	// served by `trace.validation` before this function is reached.
+	if (error instanceof CentrsError && error.code.startsWith("validation/")) {
+		// Only a structured `unknown-attribute` (inspect, or `:parse`'s `bad
+		// parameter`) says the syntax was fine and a name was wrong. Every other
+		// device rejection — `syntax`, `unknown-path`, `package-missing`,
+		// `menu-unavailable` — is `:parse` refusing the command itself.
+		const nameRejected =
+			structured && error.code === "validation/unknown-attribute";
+		return {
+			enabled: true,
+			source: deviceSource,
+			result: "failed",
+			...(nameRejected
+				? { syntax: true, semantic: false }
+				: { syntax: false, ...semanticNotReached }),
+			stages: [
+				offlineStagePassed(trace?.offlineVerdict),
+				{ stage: "device", source: deviceSource, result: "failed" },
+			],
+		};
+	}
+	// Anything else stopped the gate before it produced a verdict: a transport or
+	// auth failure, a device error that is not a parse answer, or a refusal
+	// before the gate ran (write confirmation). No `result`, no `syntax` /
+	// `semantic` — no stage said either (GH#435). Without a trace this builder
+	// cannot know whether stage 1 ran, so it leaves that stage out.
+	const reason = notReachedReason(
+		error instanceof CentrsError ? error.code : "internal/unhandled",
+	);
+	const device: EnvelopeValidationStage = {
+		stage: "device",
+		source: deviceSource,
+		result: "skipped",
+		reason,
+	};
+	if (!trace) {
+		return { enabled: true, source: deviceSource, stages: [device] };
+	}
 	return {
 		enabled: true,
 		source: deviceSource,
-		result: "failed",
-		syntax: true,
-		semantic,
-		...(deviceRejected
-			? {
-					stages: [
-						offlineStagePassed(trace?.offlineVerdict),
-						{
-							stage: "device" as const,
-							source: deviceSource,
-							result: "failed" as const,
-						},
-					],
-				}
-			: {}),
+		stages: [
+			trace.offlineVerdict
+				? offlineStagePassed(trace.offlineVerdict)
+				: {
+						stage: "offline",
+						source: OFFLINE_GATE_SOURCE,
+						result: "skipped",
+						reason,
+					},
+			device,
+		],
 	};
 }
 
@@ -738,7 +775,7 @@ export function renderExecuteEnvelope(
 		case "text":
 			return envelope.ok
 				? renderExecuteSuccessText(envelope, options)
-				: renderExecuteErrorText(envelope, options);
+				: formatCentrsErrorText(envelope.error, options);
 		default:
 			return exhaustiveOutputFormat(format);
 	}
@@ -931,12 +968,16 @@ export async function validateRouterOsScript(
 			code: "validation/syntax",
 			summary:
 				"RouterOS rejected the command syntax during `:parse` preflight.",
-			remediation:
-				"Fix the RouterOS CLI syntax, especially quotes and bracketed expressions, then retry.",
+			remediation: SYNTAX_REJECTED_REMEDIATION,
 			context: {
 				command,
 				validationSource: ":put [:parse ...]",
 				via,
+				// Keep RouterOS's own words from the mapped fault (GH#362).
+				...(error instanceof CentrsError &&
+				typeof error.context?.["detail"] === "string"
+					? { detail: error.context["detail"] }
+					: {}),
 			},
 			...(position ? { position } : {}),
 			cause: error,
@@ -1022,10 +1063,8 @@ function resolveExecuteProtocol(
 	cdb?: CdbResolution,
 	config: Record<string, string | undefined> = {},
 ): ResolvedSetting<RouterOsProtocol> {
-	const defaultVia = isUnresolvedMacTarget(request, env, cdb, config)
-		? "mac-telnet"
-		: "native-api";
-	const via = resolveStringSetting(
+	const defaultVia = defaultExecuteVia(request, env, cdb, config);
+	const resolvedVia = resolveStringSetting(
 		request.via,
 		env,
 		"CENTRS_VIA",
@@ -1035,12 +1074,20 @@ function resolveExecuteProtocol(
 		cdb?.overrides.via,
 		config,
 	);
+	// A URL-derived default names its reason, since native-api is the documented one.
+	const via =
+		resolvedVia?.source.kind === "default" && resolvedVia.value === "rest-api"
+			? {
+					...resolvedVia,
+					source: { kind: "default" as const, key: "via:target-url" },
+				}
+			: resolvedVia;
 	if (!via) {
 		throw new CentrsError({
 			code: "internal/unhandled",
 			summary: "Failed to resolve the default execute protocol.",
 			remediation:
-				"Report this bug; execute should default to native-api or mac-telnet.",
+				"Report this bug; execute should default to native-api, rest-api, or mac-telnet.",
 		});
 	}
 	if (!plannedProtocols.includes(via.value as RouterOsProtocol)) {
@@ -1074,23 +1121,25 @@ function resolveExecuteProtocol(
 	return via as ResolvedSetting<RouterOsProtocol>;
 }
 
-function isUnresolvedMacTarget(
+/**
+ * Execute's default transport when no tier pins `via`, decided from the
+ * *effective* target (host > CENTRS_HOST > CDB target > positional), not the
+ * positional alone — an IP supplied via --host/CENTRS_HOST must default to
+ * native-api even when the positional was a MAC. An unresolved MAC defaults to
+ * mac-telnet, and an explicit `http(s)://` base URL names the REST service, so
+ * its scheme and port are honored rather than dropped for native-api (#426).
+ */
+function defaultExecuteVia(
 	request: ExecuteRequest,
 	env: Record<string, string | undefined>,
 	cdb?: CdbResolution,
 	config: Record<string, string | undefined> = {},
-): boolean {
-	if (
-		request.via !== undefined ||
-		env["CENTRS_VIA"] !== undefined ||
-		config["CENTRS_VIA"] !== undefined
-	) {
-		return false;
+): RouterOsProtocol {
+	// A quickchr target's endpoint comes from its descriptor, so no host
+	// setting may steer its transport.
+	if (request.quickchr !== undefined) {
+		return "native-api";
 	}
-	// Decide the default transport from the *effective* target (host >
-	// CENTRS_HOST > CDB target > positional), not the positional alone — an IP
-	// supplied via --host/CENTRS_HOST must default to native-api even when the
-	// positional was a MAC.
 	const candidate = effectiveHostCandidate({
 		host: request.host,
 		targetInput: request.targetInput,
@@ -1098,7 +1147,13 @@ function isUnresolvedMacTarget(
 		env,
 		config,
 	});
-	return candidate ? isMacAddress(candidate) : false;
+	if (candidate === undefined) {
+		return "native-api";
+	}
+	if (isMacAddress(candidate)) {
+		return "mac-telnet";
+	}
+	return /^https?:\/\//i.test(candidate) ? "rest-api" : "native-api";
 }
 
 function resolveFormat(
@@ -1367,20 +1422,6 @@ function renderExecuteSuccessText(
 	return lines.join("\n");
 }
 
-function renderExecuteErrorText(
-	envelope: ExecuteErrorEnvelope,
-	options: { verbose?: boolean },
-): string {
-	const lines = [`[${envelope.error.code}] ${envelope.error.summary}`];
-	if (envelope.error.remediation) {
-		lines.push(`Fix: ${envelope.error.remediation}`);
-	}
-	if (options.verbose && envelope.error.context) {
-		lines.push("", JSON.stringify(envelope.error.context, null, 2));
-	}
-	return lines.join("\n");
-}
-
 function syntaxCause(error: unknown): unknown {
 	if (error instanceof CentrsError) {
 		return error.causeData ?? error.context ?? error.toJSON();

package/src/explain/catalog.ts

@@ -9,10 +9,10 @@
  * Union of two first-order sources (#228):
  *
  * 1. MikroTik's published CLI Reference (`https://manual.mikrotik.com/docs/cli-reference/`),
- *    1,055 pages, 1,062 entries — first-order about the definition
+ *    1,099 pages, 1,106 entries — first-order about the definition
  *    structs and their build-time gates. Since #285 every page is a leaf whose
  *    slug is the CLI path, so no spelling has to be rewritten to be looked up.
- * 2. 6 pinned restraml `/console/inspect` trees
+ * 2. 8 pinned restraml `/console/inspect` trees
  *    (`https://tikoci.github.io/restraml/`) — first-order about the CLI surface:
  *
  * | Tree | Arch | RouterOS | Nodes |
@@ -23,12 +23,14 @@
  * | `7.24.4/extra/deep-inspect.arm64.json` | arm64 | 7.24.4 | 42,691 |
  * | `7.25beta5/extra/deep-inspect.x86.json` | x86 | 7.25beta5 | 41,794 |
  * | `7.25beta5/extra/deep-inspect.arm64.json` | arm64 | 7.25beta5 | 43,150 |
+ * | `7.26beta1/extra/deep-inspect.x86.json` | x86 | 7.26beta1 | 43,294 |
+ * | `7.26beta1/extra/deep-inspect.arm64.json` | arm64 | 7.26beta1 | 44,650 |
  *
  * | Kind | Total | `both` | `inspect` | `published` |
  * | ---- | ----- | ------ | --------- | ----------- |
- * | `menu` | 554 | 445 | 65 | 44 |
- * | `command` | 450 | 409 | 0 | 41 |
- * | `settings` | 116 | 107 | 0 | 9 |
+ * | `menu` | 568 | 457 | 67 | 44 |
+ * | `command` | 477 | 436 | 0 | 41 |
+ * | `settings` | 121 | 112 | 0 | 9 |
  *
  * Zero navigation-vs-command contradictions between the two sources. Generation
  * aborts if that ever stops holding, rather than picking a winner. Where a path
@@ -89,7 +91,7 @@ export interface CatalogEntry {
  * `path|kind|provenance|package|conditions|syscap` — with trailing empty
  * columns trimmed. Lower-cased, slash-led and sorted by path.
  *
- * Text rather than ~1,120 object literals so that one path is one line in a
+ * Text rather than ~1,166 object literals so that one path is one line in a
  * review diff, and so the formatter has nothing to re-wrap.
  */
 const ROWS = `
@@ -154,6 +156,38 @@ const ROWS = `
 /certificate/settings|settings|both
 /certificate/sign|command|both
 /certificate/sign-certificate-request|command|both
+/cmr|settings|both|cmr
+/cmr/alert|menu|both|cmr
+/cmr/alert/show-devices|command|both|cmr
+/cmr/alert/test|command|both|cmr
+/cmr/client|settings|both||!smips, !powerpc
+/cmr/client/forget|command|both||!smips, !powerpc
+/cmr/client/pair|command|both||!smips, !powerpc
+/cmr/client/push-button|command|both
+/cmr/device|menu|both|cmr
+/cmr/device/apptraffic|command|both|cmr
+/cmr/device/dashboard|command|both|cmr
+/cmr/device/pair|command|both|cmr
+/cmr/device/reboot|command|both|cmr
+/cmr/device/run-script|command|both|cmr
+/cmr/device/upgrade|command|both|cmr
+/cmr/device/wifi-logs|command|both|cmr
+/cmr/layout|menu|both|cmr
+/cmr/layout/add-devices|command|both|cmr
+/cmr/layout/link|menu|both|cmr
+/cmr/layout/node|menu|both|cmr
+/cmr/layout/rebuild-links|command|both|cmr
+/cmr/push-button|command|both
+/cmr/upgrade|menu|both|cmr
+/cmr/upgrade/job|menu|both|cmr
+/cmr/upgrade/job/run-next|command|both|cmr
+/cmr/upgrade/job/show-devices|command|both|cmr
+/cmr/upgrade/show-devices|command|both|cmr
+/cmr/upgrade/trigger|command|both|cmr
+/cmr/upgrade/version-check|command|both|cmr
+/cmr/vlan|menu|both|cmr
+/cmr/wifi|menu|both|cmr
+/cmr/wifi/radio|menu|both|cmr
 /console|menu|inspect
 /console/inspect|command|both
 /console/settings|settings|both
@@ -286,6 +320,7 @@ const ROWS = `
 /interface/ethernet/poe/power-cycle|command|published|||(poe or poe-in)
 /interface/ethernet/poe/settings|settings|published|||(poe or poe-in) and poesettings
 /interface/ethernet/pon|menu|both
+/interface/ethernet/pon/monitor|command|both
 /interface/ethernet/reset-counters|command|both
 /interface/ethernet/reset-mac-address|command|both
 /interface/ethernet/switch|menu|both
@@ -327,7 +362,8 @@ const ROWS = `
 /interface/ethernet/switch/reserved-fdb|menu|published|||musicswitch
 /interface/ethernet/switch/reset-counters|command|both
 /interface/ethernet/switch/rule|menu|both|||rbswitch
-/interface/ethernet/switch/rule/reset-counters|command|both|||rbswitch
+/interface/ethernet/switch/rule/reset-counters|command|both|||rbswitch and crs_prestera
+/interface/ethernet/switch/rule/reset-counters-all|command|published|||rbswitch and crs_prestera
 /interface/ethernet/switch/shaper|menu|published|||musicswitch
 /interface/ethernet/switch/stats|settings|published||!smips|musicswitch
 /interface/ethernet/switch/trunk|menu|published|||musicswitch
@@ -442,6 +478,11 @@ const ROWS = `
 /interface/wifi/capsman/remote-cap/upgrade|command|both
 /interface/wifi/channel|menu|both
 /interface/wifi/configuration|menu|both
+/interface/wifi/dashboard|menu|inspect
+/interface/wifi/dashboard/settings|settings|both
+/interface/wifi/dashboard/show|command|both
+/interface/wifi/dashboard/show-clients|command|both
+/interface/wifi/dashboard/show-logs|command|both
 /interface/wifi/datapath|menu|both
 /interface/wifi/devel|command|both
 /interface/wifi/flat-snoop|command|both
@@ -525,6 +566,7 @@ const ROWS = `
 /interface/wireless/sniffer/sniff|command|both|wireless-rep
 /interface/wireless/snooper|settings|both|wireless-rep
 /interface/wireless/snooper/flat-snoop|command|both|wireless-rep
+/interface/wireless/snooper/snoop|command|both|wireless-rep
 /interface/wireless/spectral-scan|command|both|wireless-rep
 /interface/wireless/wds|menu|both|wireless-rep
 /interface/wireless/wds/monitor|command|both|wireless-rep
@@ -984,6 +1026,9 @@ const ROWS = `
 /system/clock/manual|settings|both
 /system/console|menu|both
 /system/console/screen|settings|both||i386
+/system/dashboard|menu|inspect
+/system/dashboard/settings|settings|both
+/system/dashboard/show|command|both
 /system/default-configuration|settings|both
 /system/default-configuration/caps-mode-script|settings|both
 /system/default-configuration/custom-script|settings|both
@@ -1062,10 +1107,9 @@ const ROWS = `
 /system/routerboard/mode-button|settings|both||!i386
 /system/routerboard/reset-button|settings|both||!i386
 /system/routerboard/settings|settings|both||!i386
-/system/routerboard/settings/keep-frequency|command|published||!i386, mipsel
 /system/routerboard/upgrade|command|both||!i386
-/system/routerboard/usb|settings|both||!i386, !i386, !mipsel, !powerpc
-/system/routerboard/usb/power-reset|command|both||!i386, !i386, !mipsel, !powerpc
+/system/routerboard/usb|settings|both||!i386, !i386, !powerpc
+/system/routerboard/usb/power-reset|command|both||!i386, !i386, !powerpc
 /system/routerboard/wps-button|settings|both||!i386
 /system/rtrace|settings|both
 /system/rtrace/start|command|both
@@ -1101,6 +1145,10 @@ const ROWS = `
 /task/terminate|command|both
 /terminal|menu|inspect
 /tool|menu|inspect
+/tool/apptraffic|settings|both||!mmips, !powerpc, !smips
+/tool/apptraffic/stats|menu|both||!mmips, !powerpc, !smips
+/tool/apptraffic/stats/categories|menu|both||!mmips, !powerpc, !smips
+/tool/apptraffic/stats/clear|command|both||!mmips, !powerpc, !smips
 /tool/bandwidth-server|settings|both
 /tool/bandwidth-server/session|menu|both
 /tool/bandwidth-test|command|both