@tikoci/centrs 0.1.9-next.0 → 0.1.9-next.23

package/src/mcp/safety.ts

@@ -19,6 +19,11 @@ import {
 import { CentrsError } from "../errors.ts";
 import type { McpWritePolicy } from "../mcp.ts";
 import { parseCommentKv } from "../resolver/comment-kv.ts";
+import {
+	assertNoTargetCredentials,
+	assertNoTargetPassword,
+	redactTargetInput,
+} from "../resolver/target.ts";
 import type { CentrsMcpConfig } from "./config.ts";
 
 export interface RegisteredTarget {
@@ -68,10 +73,16 @@ export function resolveRegisteredTarget(
 	cdb: LoadedCdb,
 	target: string,
 ): RegisteredTarget {
+	// Before the lookup, whose refusal echoes the target (#478).
+	assertNoTargetPassword(target);
 	let entry: DevicesShowItem;
 	try {
 		entry = showDevice({ cdb, target }).data.entry;
 	} catch (error) {
+		// Preserve registered identities; mask credential-shaped lookup failures.
+		if (redactTargetInput(target) !== target) {
+			assertNoTargetCredentials(target);
+		}
 		if (error instanceof CentrsError && error.code === "cdb/not-found-target") {
 			throw new CentrsError({
 				code: "cdb/target-not-registered",

package/src/mcp/tools.ts

@@ -36,6 +36,7 @@ import {
 import type { CommentKvUpdate } from "../resolver/comment-kv.ts";
 import { parseBbox, parseNear } from "../resolver/geo.ts";
 import { parseDuration } from "../resolver/settings.ts";
+import { redactTargetInput } from "../resolver/target.ts";
 import { retrieveEnvelope } from "../retrieve.ts";
 import {
 	buildRetrieveFanoutErrorEnvelope,
@@ -89,7 +90,9 @@ function mcpErrorEnvelope(
 		warnings: [],
 		tips: [],
 		meta: {
-			target: context.target ? { input: context.target } : {},
+			target: context.target
+				? { input: redactTargetInput(context.target) }
+				: {},
 			via: null,
 			settings: {},
 			operation: { kind: "mcp", tool },

package/src/offline-gate.ts

@@ -25,6 +25,15 @@
  * module never reports success on its behalf. `verdict: "warn"` is an
  * ABSTENTION, not a rejection, and passes through for the same reason.
  *
+ * **One warning is refused by code: {@link REFUSED_WARNING_CODES}.** It is not
+ * an abstention but a known device behaviour. A `}` or `]` that closes nothing
+ * at the top level makes RouterOS accept the script and silently stop reading
+ * there, so `/system identity set name=a}` sets `a` and `:put 1};:put 2` runs
+ * one command (#504, CHR 7.24.5 and 7.23.8). `explain` reports it as a warning
+ * because nothing is rejected; the gate refuses it because the script the
+ * device would run is not the one that was written. The list is explicit and
+ * stays small: a code joins it only for the same reason.
+ *
  * `--validate=false` disables BOTH stages — one flag, one meaning. That was
  * settled with the `--raw` precedence layer on GH#154 and is why callers gate
  * this on the same resolved `validate` setting as the device stage; the escape
@@ -39,11 +48,20 @@
  */
 
 import { CentrsError } from "./errors.ts";
-import { type ExplainDiagnostic, explainCommand } from "./explain.ts";
+import {
+	DISCARDED_CLOSE_CODE,
+	type ExplainDiagnostic,
+	explainCommand,
+} from "./explain.ts";
 
 /** Validator identity for `meta.validation` and error context. */
 export const OFFLINE_GATE_SOURCE = "offline explain (canonicalizer)";
 
+/** Warning codes the gate refuses as it refuses an error (module header). */
+export const REFUSED_WARNING_CODES: ReadonlySet<string> = new Set([
+	DISCARDED_CLOSE_CODE,
+]);
+
 /** Which stage of the two-stage gate produced a verdict. */
 export type ValidationStageName = "offline" | "device";
 
@@ -61,8 +79,8 @@ export interface OfflineGateFinding {
 export interface OfflineGateResult {
 	/**
 	 * `pass` — the analyzer read the whole input. `warn` — it ABSTAINED on part
-	 * of it (an unresolved menu, say). Both proceed to the device stage; only
-	 * `fail` throws.
+	 * of it (an unresolved menu, say). Both proceed to the device stage; a
+	 * `fail`, or a warning in {@link REFUSED_WARNING_CODES}, throws.
 	 */
 	verdict: "pass" | "warn";
 	/** Warning-severity diagnostics, kept so a caller can surface the abstention. */
@@ -95,25 +113,28 @@ export function assertOfflineSyntax(
 ): OfflineGateResult {
 	const analysis = explainCommand(command);
 	const errors = analysis.diagnostics.filter(
-		(diagnostic) => diagnostic.severity === "error",
+		(diagnostic) =>
+			diagnostic.severity === "error" ||
+			REFUSED_WARNING_CODES.has(diagnostic.code),
 	);
 	const warnings = analysis.diagnostics
 		.filter((diagnostic) => diagnostic.severity === "warning")
 		.map(findingOf);
 
-	if (analysis.verdict !== "fail") {
+	if (errors.length === 0) {
 		return { verdict: analysis.verdict === "warn" ? "warn" : "pass", warnings };
 	}
 
-	// A `fail` verdict always carries at least one error diagnostic, but read it
-	// defensively: an empty list would otherwise produce an error that says
-	// nothing about what was wrong, which is worse than a generic summary.
 	const findings = errors.map(findingOf);
 	const first = findings[0];
 	throw new CentrsError({
 		code: "validation/syntax",
 		summary: first
-			? `RouterOS syntax rejected by offline analysis: ${first.message}`
+			? `${
+					REFUSED_WARNING_CODES.has(first.code)
+						? "Refused by offline analysis"
+						: "RouterOS syntax rejected by offline analysis"
+				}: ${first.message}`
 			: "RouterOS syntax rejected by offline analysis.",
 		remediation:
 			"Run `centrs explain '<command>'` to see the offending bytes in context, " +

package/src/protocols/btest-session.ts

@@ -72,6 +72,7 @@ import {
 } from "./btest.ts";
 import {
 	bytesToBigIntBE,
+	type EcSrp5Shared,
 	ecSrp5ClientConfirm,
 	ecSrp5ClientShared,
 	ecSrp5Id,
@@ -676,11 +677,13 @@ async function runClientEcSrp5(
 
 	const challenge = parseServerChallenge(await readAuthFrame(channel));
 	const validator = ecSrp5Id(username, password, challenge.salt);
-	const shared = ecSrp5ClientShared(
-		keypair.privateKey,
-		challenge.serverPublicKey,
-		keypair.publicKey,
-		validator,
+	const shared = btestShared(
+		ecSrp5ClientShared(
+			keypair.privateKey,
+			challenge.serverPublicKey,
+			keypair.publicKey,
+			validator,
+		),
 	);
 	const clientCc = ecSrp5ClientConfirm(shared);
 	await channel.write(encodeConfirmation(clientCc));
@@ -782,11 +785,13 @@ async function runServerEcSrp5(
 	);
 	await channel.write(encodeServerChallenge(serverPublicKey, salt));
 
-	const shared = ecSrp5ServerShared(
-		keypair.privateKey,
-		validatorScalar,
-		hello.publicKey,
-		serverPublicKey,
+	const shared = btestShared(
+		ecSrp5ServerShared(
+			keypair.privateKey,
+			validatorScalar,
+			hello.publicKey,
+			serverPublicKey,
+		),
 	);
 	const clientCc = await readAuthFrame(channel);
 	const expectedCc = ecSrp5ClientConfirm(shared);
@@ -799,6 +804,21 @@ async function runServerEcSrp5(
 	return hello.username;
 }
 
+/**
+ * The shared secret as btest hashes it: `z` without its leading zero bytes
+ * (OpenSSL `BN_bn2bin`), where MAC-Telnet's `mtwei.c` pads it to 32
+ * (`BN_bn2binpad`), so the shared math in `ec-srp5.ts` keeps 32 bytes.
+ *
+ * Grounded on CHR 7.24.5 `/tool/bandwidth-server`: over 800 client handshakes,
+ * every one whose `z` began with 0x00 (9) failed with the padded form and no
+ * other did. Stripped, 600 of 600 verified, 4 of them with a leading zero.
+ */
+export function btestShared(shared: EcSrp5Shared): EcSrp5Shared {
+	let start = 0;
+	while (start < shared.z.length - 1 && shared.z[start] === 0) start++;
+	return start === 0 ? shared : { j: shared.j, z: shared.z.subarray(start) };
+}
+
 function ecSrp5RandomSalt(): Uint8Array {
 	return crypto.getRandomValues(new Uint8Array(16));
 }

package/src/protocols/mac-telnet-console.ts

@@ -639,6 +639,22 @@ const BARE_BAD_PARAMETER =
 const BARE_SYNTAX =
 	/^[ \t]*(?:syntax error|bad command name|(?:expected|missing) [a-z]+(?: [a-z]+)*)[^\n]*\(line \d+ column \d+\)/im;
 
+/**
+ * Whether the printed value of `:parse` carries a rejection, by the same
+ * position-anchored grammar {@link classifyParseResult} throws on. For probes
+ * and censuses that need the verdict as a boolean. On the schema-5 corpus it
+ * agrees with the upstream `response_class` on every one of 5,640 channel and
+ * legacy observations (#498).
+ */
+export function isParseRejection(output: string): boolean {
+	return (
+		WRAPPED_BAD_PARAMETER.test(output) ||
+		BARE_BAD_PARAMETER.test(output) ||
+		WRAPPED_BAD_COMMAND.test(output) ||
+		BARE_SYNTAX.test(output)
+	);
+}
+
 /**
  * Classify the printed value of `:put [:parse "<cli>"]`. Grounded on CHR 7.23.3
  * (see GH#230): `:parse` *never* throws — it returns a value whose text carries

package/src/resolver/cdb.ts

@@ -44,6 +44,11 @@ import {
 	parseDuration,
 	type ResolvedSetting,
 } from "./settings.ts";
+import {
+	assertNoTargetCredentials,
+	assertNoTargetPassword,
+	redactTargetInput,
+} from "./target.ts";
 
 const ENV_CDB_FILE = "CENTRS_CDB_FILE";
 const ENV_CDB_PASSWORD = "CENTRS_CDB_PASSWORD";
@@ -161,6 +166,8 @@ export async function resolveCdb(
 	if (!input.targetInput) {
 		return undefined;
 	}
+	// Before any lookup: a CDB miss echoes the target it was given (#478).
+	assertNoTargetPassword(input.targetInput);
 
 	const settings = resolveDevicesSettings({
 		cdbFile: input.cdbFile,
@@ -225,6 +232,10 @@ export async function resolveCdb(
 			...(defaults ? { defaults } : {}),
 		};
 	} catch (error) {
+		// Preserve registered identities; mask credential-shaped lookup failures.
+		if (redactTargetInput(input.targetInput) !== input.targetInput) {
+			assertNoTargetCredentials(input.targetInput);
+		}
 		if (error instanceof CentrsError && error.code === "cdb/not-found-target") {
 			// A `__default__` record supplies fallback credentials even when the
 			// target has no record of its own. On the CLI/API this fills creds for
@@ -366,7 +377,8 @@ export function resolutionFromEntry(
  * ambiguity path). See `commands/devices/README.md` (Identity model).
  */
 export function identityFromComment(comment: string, target: string): string {
-	return parseCommentKv(comment).lookups.identity ?? target;
+	// The record's target is shown as its handle; never with a password (#478).
+	return parseCommentKv(comment).lookups.identity ?? redactTargetInput(target);
 }
 
 /**

package/src/resolver/index.ts

@@ -97,6 +97,7 @@ export {
 	SUPPORTED_DESCRIPTOR_VERSION,
 } from "./quickchr-provider.ts";
 export {
+	emptyWriteSelectionError,
 	expandSelection,
 	isDefaultRecordTarget,
 	type SelectionExpansion,
@@ -130,10 +131,13 @@ export {
 	toCoreSource,
 } from "./settings.ts";
 export {
+	assertNoTargetCredentials,
+	assertNoTargetPassword,
 	defaultPortForScheme,
 	parseHostCandidate,
 	type ResolvedAuth,
 	type ResolvedTarget,
+	redactTargetInput,
 	resolveAuth,
 	resolveTarget,
 	type TargetResolveInput,

package/src/resolver/selection.ts

@@ -47,6 +47,11 @@ import {
 	matchesNear,
 	type NearPredicate,
 } from "./geo.ts";
+import {
+	assertNoTargetCredentials,
+	assertNoTargetPassword,
+	redactTargetInput,
+} from "./target.ts";
 
 /** One `--where attr=value` device-class clause (exact-match, AND-combined). */
 export interface SelectionWhereClause {
@@ -106,10 +111,36 @@ export interface SelectionExpansion {
 	/** Members ordered by record index; literals appended in positional order. */
 	targets: readonly SelectionMember[];
 	warnings: readonly ResolverWarning[];
-	/** True when nothing matched (an empty/unknown selection is not an error). */
+	/** True when nothing matched (an error only for a write; see {@link emptyWriteSelectionError}). */
 	empty: boolean;
 }
 
+/**
+ * An empty selection for a write-shaped fan-out (#460). A read over it is
+ * `ok: true` with the expansion's warning, so a poller over an occasionally
+ * empty group stays quiet. A write is an error, as RouterOS refuses an empty
+ * CMR selection (`no devices selected`): a misspelled group must not look like
+ * a successful bulk write. The code is the expansion's own empty warning.
+ */
+export function emptyWriteSelectionError(
+	expansion: Pick<SelectionExpansion, "warnings">,
+	action: string,
+): CentrsError {
+	const warning = expansion.warnings.findLast(
+		(w) => w.code === "cdb/empty-group" || w.code === "cdb/empty-selection",
+	);
+	return new CentrsError({
+		code:
+			warning?.code === "cdb/empty-group"
+				? "cdb/empty-group"
+				: "cdb/empty-selection",
+		summary: `${warning?.message ?? "The target selection matched no CDB records."} Nothing ran: a write-shaped ${action} must select at least one router.`,
+		remediation:
+			"Check the selector against `centrs devices list` and `centrs devices groups` (groups and `--where` values match as written), then re-run. A read over the same selection succeeds with a warning instead.",
+		context: { ...warning?.context, write: true },
+	});
+}
+
 /** True when a resolved target is the reserved credential-fallback record. */
 export function isDefaultRecordTarget(target: string): boolean {
 	return target === DEFAULT_RECORD_TARGET;
@@ -249,10 +280,15 @@ export async function expandSelection(
 	const literals: SelectionMember[] = [];
 	const seenLiteral = new Set<string>();
 	for (const positional of selection.positionals) {
+		assertNoTargetPassword(positional);
 		try {
 			const shown = showDevice({ cdb, target: positional });
 			indices.add(shown.data.entry.cdbRecordIndex);
 		} catch (error) {
+			// Preserve registered identities; mask credential-shaped lookup failures.
+			if (redactTargetInput(positional) !== positional) {
+				assertNoTargetCredentials(positional);
+			}
 			if (
 				error instanceof CentrsError &&
 				error.code === "cdb/not-found-target"

package/src/resolver/target.ts

@@ -104,11 +104,12 @@ export function resolveTarget(
 			summary: "No host could be resolved for `retrieve`.",
 			remediation:
 				"Pass a target positional like `centrs retrieve 192.0.2.10 /system/resource --via rest-api` or set `--host` / `CENTRS_HOST`.",
-			context: { targetInput: input.targetInput },
+			context: { targetInput: redactTargetInput(input.targetInput) },
 		});
 	}
 
 	const rawCandidate = hostSetting.value.trim();
+	assertNoTargetCredentials(rawCandidate);
 	const macCandidate = normalizeMac(rawCandidate);
 
 	// L2 transports (mac-telnet) address the device by **MAC** directly — no IP
@@ -127,11 +128,13 @@ export function resolveTarget(
 		if (!mac) {
 			throw new CentrsError({
 				code: "target/mac-required",
-				summary: `mac-telnet needs a MAC address target; got "${input.targetInput ?? cdb?.target ?? rawCandidate}".`,
+				summary: `mac-telnet needs a MAC address target; got "${redactTargetInput(input.targetInput ?? cdb?.target ?? rawCandidate)}".`,
 				remediation:
 					"Pass the device MAC (aa:bb:cc:dd:ee:ff), or pin an IP transport with `--via native-api`/`rest-api` (add `--resolve arp` for a MAC).",
 				context: {
-					target: input.targetInput ?? cdb?.target ?? rawCandidate,
+					target: redactTargetInput(
+						input.targetInput ?? cdb?.target ?? rawCandidate,
+					),
 					via,
 				},
 			});
@@ -178,7 +181,7 @@ export function resolveTarget(
 		const deliveryHost = deliveryHostSetting?.value.trim() || "255.255.255.255";
 		const port = macPortSetting?.value ?? MAC_TELNET_PORT;
 		return {
-			input: input.targetInput,
+			input: redactTargetInput(input.targetInput),
 			host: deliveryHost,
 			mac,
 			port,
@@ -290,7 +293,7 @@ export function resolveTarget(
 	};
 
 	return {
-		input: input.targetInput,
+		input: redactTargetInput(input.targetInput),
 		// WHATWG keeps an IPv6 hostname bracketed; sockets and ssh need the bare
 		// address (`baseUrl` re-brackets it).
 		host: parsedUrl.hostname.replace(/^\[(.*)\]$/, "$1"),
@@ -471,6 +474,91 @@ export function resolveAuth(
 	};
 }
 
+/** An authority with userinfo: `user@host`, `user:pass@host`, with or without a scheme. */
+const URL_USERINFO = /^\s*([a-z][a-z0-9+.-]*:\/\/)?[^/@\s]*@/i;
+/** Leading whitespace and an optional `scheme://`, kept by redaction. */
+const TARGET_PREFIX = /^\s*(?:[a-z][a-z0-9+.-]*:\/\/)?/i;
+
+/**
+ * Where credentials could sit: a `:` before the LAST `@`, or explicit URL
+ * userinfo. Display also masks a percent-encoded colon; lookup validation
+ * allows that ambiguous spelling until CDB lookup has run. Bare `user@host`
+ * remains a CDB identity candidate. Index arithmetic, so a password holding `/`, `?` or
+ * `#` (which ends a URL authority early, CodeRabbit on PR #479) still counts,
+ * and nothing can backtrack (CodeQL js/polynomial-redos).
+ */
+function targetCredentialsSpan(
+	value: string,
+	includeEncodedColon = true,
+): { start: number; at: number } | undefined {
+	const at = value.lastIndexOf("@");
+	if (at < 0) return undefined;
+	const prefix = TARGET_PREFIX.exec(value)?.[0] ?? "";
+	const start = prefix.length;
+	const urlUserinfo = prefix.includes("://") && URL_USERINFO.test(value);
+	const userinfo = value.slice(start, at);
+	return userinfo.includes(":") ||
+		(includeEncodedColon && /%3a/i.test(userinfo)) ||
+		urlUserinfo
+		? { start, at }
+		: undefined;
+}
+
+/**
+ * A target string with any `user:pass@` or explicit URL userinfo replaced by
+ * `***@`, for display (#478).
+ * A target is echoed in `meta.target.input` and in error messages, so the
+ * password part must never reach them, not even when the target is refused.
+ * Everything up to the last `@` goes, so an odd password cannot slip past.
+ * Other targets, including a CDB identity like `rtr@site`, pass unchanged.
+ * An encoded colon is masked conservatively without changing lookup input.
+ */
+export function redactTargetInput(value: string): string;
+export function redactTargetInput(
+	value: string | undefined,
+): string | undefined;
+export function redactTargetInput(
+	value: string | undefined,
+): string | undefined {
+	if (value === undefined) return value;
+	const span = targetCredentialsSpan(value);
+	return span
+		? `${value.slice(0, span.start)}***${value.slice(span.at)}`
+		: value;
+}
+
+function targetCredentialsError(value: string): CentrsError {
+	const target = redactTargetInput(value);
+	return new CentrsError({
+		code: "input/invalid-target",
+		summary: `A target must not carry credentials (\`user[:password]@\`): ${target}`,
+		remediation:
+			"Drop the `user:password@` part and pass the credentials with `--username` and `--password` (or `CENTRS_USERNAME`/`CENTRS_PASSWORD`, or a CDB record); give the target as `host[:port]` or `http(s)://host[:port]`.",
+		context: { target },
+	});
+}
+
+/**
+ * Refuse a target that may hold a password, BEFORE any lookup whose miss would
+ * echo it (#478): `resolveCdb`, the MCP allowlist, the fan-out selection. A
+ * bare `user@host` is left to the lookup; a CDB identity may contain `@`.
+ * Explicit URL userinfo is always refused, including percent-encoded forms.
+ */
+export function assertNoTargetPassword(value: string): void {
+	if (targetCredentialsSpan(value, false)) throw targetCredentialsError(value);
+}
+
+/**
+ * centrs never reads credentials from a target (#478): `user:pass@host` used
+ * to be accepted with its credentials ignored, and echoed the password back.
+ * After lookup, refuse any userinfo in the host to dial, from any source.
+ */
+export function assertNoTargetCredentials(value: string): void {
+	if (targetCredentialsSpan(value) || URL_USERINFO.test(value)) {
+		throw targetCredentialsError(value);
+	}
+}
+
 export function parseHostCandidate(value: string): URL {
 	const hasScheme = /^https?:\/\//i.test(value);
 	// A bare IPv6 literal (`2001:db8::1`) has no port; URL needs it bracketed.
@@ -484,7 +572,7 @@ export function parseHostCandidate(value: string): URL {
 	if (hasScheme && url.pathname !== "/" && url.pathname !== "") {
 		throw new CentrsError({
 			code: "input/invalid-target",
-			summary: `Target URL must not include a path. Received: ${value}`,
+			summary: `Target URL must not include a path. Received: ${redactTargetInput(value)}`,
 			remediation:
 				"Pass only the RouterOS host or base URL, then provide the RouterOS menu path as the second positional argument.",
 		});
@@ -500,12 +588,12 @@ function invalidTargetError(value: string, cause: unknown): CentrsError {
 	const quickchrGuess = /^quickchr:(.+)$/i.exec(value)?.[1];
 	return new CentrsError({
 		code: "input/invalid-target",
-		summary: `Target is not a known device or a valid host: ${value}`,
+		summary: `Target is not a known device or a valid host: ${redactTargetInput(value)}`,
 		remediation:
 			quickchrGuess !== undefined
 				? `Select a quickchr VM with the flag: \`--quickchr ${quickchrGuess}\` (there is no \`quickchr:\` target prefix).`
 				: "Pass a CDB target or identity (see `centrs devices list`), an IP or hostname with optional `:port`, or an `http(s)://host[:port]` base URL.",
-		context: { target: value },
+		context: { target: redactTargetInput(value) },
 		cause,
 	});
 }

package/src/retrieve-fanout.ts

@@ -59,6 +59,7 @@ import {
 	expandSelection,
 	isDefaultRecordTarget,
 	loadEnvFileDefaults,
+	redactTargetInput,
 	type SelectionExpansion,
 	type SelectionMember,
 	type SelectionResolveInput,
@@ -97,6 +98,8 @@ export interface RetrieveFanoutOperationMeta {
 	concurrency: number;
 	summary: FanoutSummary;
 	request: RetrieveRequestSummary;
+	/** Hoisted from the targets when every target used the same login (#461). */
+	auth?: { username?: string; passwordProvided: boolean };
 	selection: RetrieveSelectionSummary;
 }
 
@@ -143,7 +146,7 @@ function summarizeSelection(
 		where: selection.where.map((clause) => `${clause.key}=${clause.value}`),
 		all: selection.all,
 		default: selection.default,
-		positionals: selection.positionals,
+		positionals: selection.positionals.map((value) => redactTargetInput(value)),
 		quickchr: selection.quickchr,
 	};
 }