@tikoci/centrs 0.1.9-next.23 → 0.1.9-next.24

package/src/core/envelope.ts

@@ -185,10 +185,17 @@ export interface EnvelopeValidationMeta {
 	 * `stages[]` then says which stage was not reached and why (GH#435).
 	 */
 	result?: "passed" | "failed" | "skipped";
-	/** Syntax gate status for commands that use RouterOS `:parse`. */
+	/**
+	 * The syntax verdict (`:parse` or the offline analyzer). Present only when a
+	 * stage gave one; absent means no stage was asked (#535).
+	 */
 	syntax?: boolean;
-	/** Semantic `/console/inspect` gate status, or not-applicable for script mode. */
-	semantic?: boolean | "not-applicable";
+	/**
+	 * The name-level verdict (`/console/inspect` or a console `:parse` `bad
+	 * parameter`). Present only when a stage gave one; absent means no stage was
+	 * asked, including for script input, which has no names to check (#535).
+	 */
+	semantic?: boolean;
 	availableAttributes?: readonly string[];
 	/**
 	 * Per-stage detail for the gate described in

package/src/core/error-catalog.ts

@@ -431,6 +431,11 @@ export const errorCatalog: readonly ErrorCatalogEntry[] = [
 		code: "routeros/mac-telnet-unsupported-auth",
 		summary: "The device requested an unsupported MAC-Telnet auth mode.",
 	},
+	{
+		code: "routeros/permission-denied",
+		summary:
+			"RouterOS refused the command because the user's group lacks a policy it needs.",
+	},
 	{
 		code: "routeros/protocol-not-implemented",
 		summary: "The requested protocol is planned but not implemented yet.",
@@ -563,6 +568,11 @@ export const errorCatalog: readonly ErrorCatalogEntry[] = [
 		code: "transport/dns",
 		summary: "The device host name could not be resolved.",
 	},
+	{
+		code: "transport/edge-auth-failed",
+		summary:
+			"An HTTP layer in front of RouterOS (auth proxy, tunnel edge, WAF) refused the request before RouterOS answered it.",
+	},
 	{
 		code: "transport/host-key-mismatch",
 		summary: "The device's SSH host key did not match the known key.",
@@ -652,6 +662,11 @@ export const errorCatalog: readonly ErrorCatalogEntry[] = [
 		summary:
 			"The command or mode cannot fan out across multiple targets (e.g. terminal, --listen/--stream).",
 	},
+	{
+		code: "usage/invalid-cursor",
+		summary:
+			"An explain --cursor is not a byte offset inside the input being analyzed.",
+	},
 	{
 		code: "usage/invalid-method",
 		summary: "The -X/--method value is not a supported HTTP method.",

package/src/core/execute-command.ts

@@ -104,11 +104,64 @@ export function isWriteShaped(command: CanonicalExecuteCommand): boolean {
 		if (Object.keys(command.attributes).some(isFileOutputAttribute)) {
 			return true;
 		}
+		if (isBareMenuNavigation(command)) {
+			return false;
+		}
 		return !READ_ONLY_EXECUTE_VERBS.has(command.verb.toLowerCase());
 	}
 	return scriptContainsWriteShapedCommand(command.input);
 }
 
+/**
+ * A truly bare known-menu path (`/system/identity`, no attributes or queries)
+ * is console navigation — a no-op read, not a command — so it needs no write
+ * confirmation. The APIs refuse it (`no such command`) and the consoles
+ * navigate silently; neither mutates.
+ *
+ * This is narrower than the script branch on purpose. There, `/ip firewall
+ * filter` stays write-shaped (#387): a later line may carry a relative verb,
+ * so navigation fails closed. Here structured mode proves the input is a
+ * single path token (any second word without `=` — including a second line —
+ * falls back to script), so no follow-up is possible. The carve-out still
+ * fails closed three ways: anything the menu table does not carry stays gated,
+ * a verb in the known-mutator list stays gated even if the table ever
+ * mis-tags its path, and any attribute or query (including `;`-smuggled text,
+ * which lands in the verb or an attribute, never in a clean menu reading)
+ * keeps the gate shut. The gate is shared, so bare menus also stop tripping
+ * `cdb/write-not-permitted` on `mcp=ro` targets (and stop needing
+ * `confirm:true` on `mcp=rw` ones), and `explain`'s `writeShaped` flips to
+ * false for these inputs — harmless in all three, since the input is a
+ * no-op read either way.
+ */
+function isBareMenuNavigation(command: CanonicalExecuteCommand): boolean {
+	if (
+		Object.keys(command.attributes).length > 0 ||
+		command.queries.length > 0
+	) {
+		return false;
+	}
+	if (KNOWN_WRITE_EXECUTE_VERBS.has(command.verb.toLowerCase())) {
+		return false;
+	}
+	const segments = `${command.path}/${command.verb}`.split("/").filter(Boolean);
+	if (segments.length < 2) {
+		return false;
+	}
+	return isKnownMenuPath(segments);
+}
+
+/**
+ * Whether `execute` was asked to run a bare menu path (see
+ * {@link isBareMenuNavigation}). The envelope carries a steering tip for it:
+ * navigation runs — the gate no longer stops it — but it answers nothing, so
+ * the tip names the read that does.
+ */
+export function isBareMenuPathCommand(
+	command: CanonicalExecuteCommand,
+): boolean {
+	return command.mode === "structured" && isBareMenuNavigation(command);
+}
+
 /**
  * The attributes that turn an otherwise read-only command into a device write.
  *

package/src/core/fanout.ts

@@ -94,6 +94,7 @@ export const NOT_SENT_TRANSPORT_CODES: readonly string[] = [
 	"transport/auth-failed",
 	"transport/connection-refused",
 	"transport/dns",
+	"transport/edge-auth-failed",
 	"transport/host-key-mismatch",
 	"transport/insecure-trust",
 	"transport/local-tool-missing",
@@ -106,15 +107,24 @@ export const NOT_SENT_TRANSPORT_CODES: readonly string[] = [
  * #448: a write whose request was already sent when a transport failure ended
  * it may have run on the router. It is never retried, and its error envelope
  * says the outcome is unknown rather than implying nothing happened.
+ *
+ * #549: the same warning covers a dispatched multi-statement write refused
+ * with `routeros/permission-denied`, which can be partly applied — statements
+ * before the refused one already ran. A single refused statement did not run
+ * (#541), so it stays silent; the caller passes whether the dispatch carried
+ * more than one statement.
  */
 export function sentWriteWarnings(
 	write: boolean,
 	error: unknown,
 	trace: ValidationTrace | undefined,
+	multiStatement = false,
 ): Warning[] {
 	if (!write || !trace?.dispatched) return [];
-	if (
-		!(error instanceof CentrsError) ||
+	if (!(error instanceof CentrsError)) return [];
+	if (error.code === "routeros/permission-denied") {
+		if (!multiStatement) return [];
+	} else if (
 		!error.code.startsWith("transport/") ||
 		NOT_SENT_TRANSPORT_CODES.includes(error.code)
 	) {

package/src/core/inspect.ts

@@ -39,12 +39,11 @@ export interface InspectBackend {
 
 /**
  * The `/console/inspect` request modes (lsp's `InspectRequest`). Only `child`
- * and `completion` are wired today (the two the {@link InspectBackend} seam
+ * and `completion` are wired here (the two the {@link InspectBackend} seam
  * exposes), plus `input` for completion over CLI text
- * ({@link inspectWhereBooleans}); `highlight` (token-level error detection),
- * `syntax` (parse tree) and the `.query`/`.proplist` request fields are the
- * documented extension point for value-level validation — widen the adapter
- * seam when adding them.
+ * ({@link inspectWhereBooleans}). The protocol adapter also supports
+ * `highlight` and `syntax` for live explain, which sends `syntax` for argument
+ * paths only (`src/explain-live-facets.ts`).
  */
 export type InspectRequestKind =
 	| "child"

package/src/core/routeros-errors.ts

@@ -107,6 +107,31 @@ function cleanToken(token: string): string {
  * rules here; keep the most specific patterns above broader ones.
  */
 export const routerOsErrorRules: readonly RouterOsErrorRule[] = [
+	{
+		code: "routeros/permission-denied",
+		description:
+			"RouterOS refused the command because the user's group lacks a policy it needs.",
+		// Grounded on CHR 7.25. REST answers HTTP 500 with this as `detail`:
+		// `not enough permissions (9)` for a write without `write`, and
+		// `std failure: not allowed (9)` for any request (even a GET) when the
+		// group has `rest-api` but not `api` (fixed in 7.26beta3). The native API traps with the
+		// first string; `/execute as-string` returns it as text with a
+		// `(<path>; line N)` suffix. In a multi-statement script the refusal is
+		// the last line, after earlier statements' stdout (#549: `:put
+		// "p5-first"; /system/identity/set …` as a read-only user returns HTTP
+		// 200 with ret `p5-first\r\nnot enough permissions (9)
+		// (/system/identity/set; line 1)`, identical on native-api), so the
+		// trailed form matches too — with the location suffix required, so a
+		// script that merely prints the bare phrase stays ordinary output.
+		test: /not enough permissions|not allowed \(9\)/i,
+		resultTest:
+			/^(?:not enough permissions \(9\)(?: \(\/[^\s();]+; line \d+\))?|[\s\S]*\r?\nnot enough permissions \(9\) \(\/[^\s();]+; line \d+\))$/i,
+		build: (_match, raw) => ({
+			summary: `RouterOS refused the command for lack of permission: ${raw.trim()}`,
+			remediation:
+				"Grant the missing policy to the RouterOS user's group (`/user/group`): `read` for reads, `write` for changes. If every REST request fails with `not allowed (9)`, the group has `rest-api` without `api`; before RouterOS 7.26beta3, REST needs both. Retrying will not help.",
+		}),
+	},
 	{
 		code: "routeros/unknown-path",
 		description:

package/src/execute-cmr.ts

@@ -1002,8 +1002,7 @@ function devicePassed(
 		source: CMR_VALIDATION_SOURCE,
 		result: "passed",
 		syntax: true,
-		semantic:
-			resolved.canonical.mode === "structured" ? true : "not-applicable",
+		...(resolved.canonical.mode === "structured" ? { semantic: true } : {}),
 		stages: passedStages(
 			offline ?? { verdict: "pass", warnings: [] },
 			CMR_VALIDATION_SOURCE,
@@ -1023,12 +1022,7 @@ function deviceRejected(
 		enabled: true,
 		source: CMR_VALIDATION_SOURCE,
 		result: "failed",
-		...(nameRejected
-			? { syntax: true, semantic: false }
-			: {
-					syntax: false,
-					...(structured ? {} : { semantic: "not-applicable" as const }),
-				}),
+		...(nameRejected ? { syntax: true, semantic: false } : { syntax: false }),
 		stages: [
 			offlineStagePassed(offline?.verdict),
 			{ stage: "device", source: CMR_VALIDATION_SOURCE, result: "failed" },

package/src/execute.ts

@@ -27,6 +27,7 @@ import { buildTip, notReachedReason } from "./core/envelope.ts";
 import {
 	type CanonicalExecuteCommand,
 	canonicalizeExecuteCommand,
+	isBareMenuPathCommand,
 	isWriteShaped,
 } from "./core/execute-command.ts";
 import { sentWriteWarnings } from "./core/fanout.ts";
@@ -40,6 +41,7 @@ import {
 	SYNTAX_REJECTED_REMEDIATION,
 	serializeCentrsError,
 } from "./errors.ts";
+import { countExecutableStatements } from "./explain/segment.ts";
 import {
 	assertOfflineSyntax,
 	isOfflineGateRejection,
@@ -162,6 +164,7 @@ export type ExecuteErrorEnvelope = CentrsErrorEnvelope<ExecuteOperationMeta>;
 export {
 	type CanonicalExecuteCommand,
 	canonicalizeExecuteCommand,
+	isBareMenuPathCommand,
 	isWriteShaped,
 };
 
@@ -608,6 +611,22 @@ export function buildExecuteErrorEnvelope(
 	};
 }
 
+/**
+ * Whether the dispatch carried more than one statement (#549). Mirrors
+ * `runCommand`: the consoles run the raw CLI text whatever the canonical mode,
+ * while REST/native run structured input as one path-POST/talk sentence — a
+ * `;` inside a structured value never separates there, so the refusal means
+ * nothing ran. Executed control scopes count too: `:if … do={ A; B }` applies
+ * A before a refused B, while stored bodies never run at dispatch.
+ */
+function isMultiStatementDispatch(resolved: ResolvedExecuteRequest): boolean {
+	const runsRawText =
+		resolved.via.value === "mac-telnet" ||
+		resolved.via.value === "ssh" ||
+		resolved.canonical.mode === "script";
+	return runsRawText && countExecutableStatements(resolved.command) > 1;
+}
+
 export function buildExecuteErrorEnvelopeFromResolved(
 	resolved: ResolvedExecuteRequest,
 	error: unknown,
@@ -633,6 +652,7 @@ export function buildExecuteErrorEnvelopeFromResolved(
 				isWriteShaped(resolved.canonical),
 				centrsError,
 				trace,
+				isMultiStatementDispatch(resolved),
 			),
 		],
 		tips: resolvedExecuteTips(resolved),
@@ -664,20 +684,15 @@ function failedValidationMeta(
 	}
 	const deviceSource = deviceStageSource(resolved);
 	const structured = resolved.canonical.mode === "structured";
-	// A flat summary is present only when its check gave a verdict (GH#435).
-	// Script-shaped input has no semantic half at all: `not-applicable`. For
-	// structured input, a syntax rejection means the name-level check was
-	// never asked, so `semantic` is left out rather than reported `false`.
-	const semanticNotReached = structured
-		? {}
-		: { semantic: "not-applicable" as const };
+	// A flat summary is present only when a stage gave that verdict (#535). A
+	// syntax rejection means the name-level check was never asked, so
+	// `semantic` is left out rather than reported `false`.
 	if (isOfflineGateRejection(error)) {
 		return {
 			enabled: true,
 			source: OFFLINE_GATE_SOURCE,
 			result: "failed",
 			syntax: false,
-			...semanticNotReached,
 			stages: [
 				{ stage: "offline", source: OFFLINE_GATE_SOURCE, result: "failed" },
 				{
@@ -705,9 +720,7 @@ function failedValidationMeta(
 			enabled: true,
 			source: deviceSource,
 			result: "failed",
-			...(nameRejected
-				? { syntax: true, semantic: false }
-				: { syntax: false, ...semanticNotReached }),
+			...(nameRejected ? { syntax: true, semantic: false } : { syntax: false }),
 			stages: [
 				offlineStagePassed(trace?.offlineVerdict),
 				{ stage: "device", source: deviceSource, result: "failed" },
@@ -781,15 +794,14 @@ export function offlineStagePassed(
  * `validate=false`. Both stages are listed as `skipped` rather than omitted:
  * the constitution's rule is that a gated surface always reports each stage, so
  * a consumer reading `stages` never has to special-case the disabled shape.
- * `reason` is left off — `enabled: false` already says why.
+ * `reason` is left off — `enabled: false` already says why. No stage answered,
+ * so there is no `syntax` / `semantic` summary (#535).
  */
 export function disabledValidationMeta(): EnvelopeValidationMeta {
 	return {
 		enabled: false,
 		source: "disabled",
 		result: "skipped",
-		syntax: false,
-		semantic: false,
 		stages: [
 			{ stage: "offline", source: OFFLINE_GATE_SOURCE, result: "skipped" },
 			{ stage: "device", source: "device preflight", result: "skipped" },
@@ -862,7 +874,6 @@ async function validateExecuteCommand(
 			source: ":put [:parse]",
 			result: "passed",
 			syntax: true,
-			semantic: "not-applicable",
 			stages: passedStages(offline, ":put [:parse]"),
 		};
 	}
@@ -929,8 +940,7 @@ async function validateConsoleParseCommand(
 		source: `:put [:parse ...] over ${resolved.via.value}`,
 		result: "passed",
 		syntax: true,
-		semantic:
-			resolved.canonical.mode === "structured" ? true : "not-applicable",
+		...(resolved.canonical.mode === "structured" ? { semantic: true } : {}),
 		stages: passedStages(
 			offline,
 			`:put [:parse ...] over ${resolved.via.value}`,
@@ -1452,20 +1462,38 @@ function executeRequestSummary(
  * downstream auth error.
  */
 export function resolvedExecuteTips(resolved: ResolvedExecuteRequest): Tip[] {
+	const tips: Tip[] = [];
 	if (
 		resolved.via.value === "mac-telnet" &&
 		resolved.auth.username === undefined &&
 		!resolved.auth.passwordProvided
 	) {
-		return [
+		tips.push(
 			buildTip(
 				"tip/mac-telnet-no-credentials",
 				"No username or password was resolved for this mac-telnet target.",
 				"mac-telnet logs in with RouterOS credentials over MTWEI (MD5 is refused): pass --username/--password, set CENTRS_USERNAME/CENTRS_PASSWORD, or add a CDB record for this device.",
 			),
-		];
+		);
+	}
+	// A bare menu path runs — the write gate no longer stops it — but it
+	// answers nothing: consoles navigate silently and the APIs refuse it with
+	// `no such command`. Name the read that does answer. `canonical` is
+	// always resolved in production; the guard keeps hermetic stubs total.
+	if (
+		resolved.canonical !== undefined &&
+		isBareMenuPathCommand(resolved.canonical)
+	) {
+		const menu = `${resolved.canonical.path}/${resolved.canonical.verb}`;
+		tips.push(
+			buildTip(
+				"tip/execute-bare-menu-path",
+				`"${menu}" is a menu path, not a command: consoles navigate to it (no output) and the APIs refuse it with "no such command".`,
+				`Append a verb such as "${menu}/print", or read rows with "centrs retrieve <router> ${menu}".`,
+			),
+		);
 	}
-	return [];
+	return tips;
 }
 
 function dataFromResult(result: ProtocolExecuteResult): unknown {

package/src/explain/args.ts

@@ -78,7 +78,12 @@
 
 import { isScopeBrace, isScopeBraceIn } from "./blocks.ts";
 import { braceSlotAcceptsBrace, braceSlotTakesArray } from "./brace-slots.ts";
-import { braceStartsStatements } from "./scope-brace.ts";
+import {
+	braceBodyIsScriptLike,
+	braceStartsStatements,
+	isScriptBodyName,
+	scopeNameFromMasked,
+} from "./scope-brace.ts";
 import {
 	type MaskedRange,
 	maskComments,
@@ -353,6 +358,34 @@ function braceValueOwner(
 	return ARGUMENT_NAME.test(name) ? name.toLowerCase() : undefined;
 }
 
+/**
+ * The `name` of a `name= {…}` brace: the token before the gap ends in a glued
+ * `name=` run (#554).
+ *
+ * {@link braceValueOwner} only sees the `=` glued to the brace (`down={`). A
+ * space after the `=` starts a new token, so the brace reads as positional
+ * there — but on CHR 7.25 `down= { :beep }` lowers to `down-script=` exactly
+ * like the glued spelling, while `comment= {1;2}` is a `syntax error` at the
+ * `{`. Only spaces and tabs span the gap: a newline there is a statement
+ * boundary, not a gap, and the name run must start its token, so `=down= {`
+ * and `down = {` own nothing.
+ */
+function spacedBraceOwner(text: string, at: number): string | undefined {
+	let j = at - 1;
+	let gap = 0;
+	while (text[j] === " " || text[j] === "\t") {
+		j--;
+		gap++;
+	}
+	if (gap === 0 || text[j] !== "=") return undefined;
+	const nameEnd = j;
+	j--;
+	while (j >= 0 && /[A-Za-z0-9.-]/.test(text[j] as string)) j--;
+	if (j >= 0 && !/[\s([]/.test(text[j] as string)) return undefined;
+	const name = text.slice(j + 1, nameEnd);
+	return ARGUMENT_NAME.test(name) ? name.toLowerCase() : undefined;
+}
+
 /**
  * Whether a `{` at `at` may open an array literal in this statement.
  *
@@ -1715,6 +1748,22 @@ export function comparesNamedValue(
 	return /^[A-Za-z.]/.test(name) && /[\s(]/.test(text[j] as string);
 }
 
+/** One top-level `{` in command arguments that is not a proven body. */
+export interface CommandBraceFinding {
+	/** Offset of the `{` in the text passed to the lexer. */
+	at: number;
+	/**
+	 * True when `name={` with a script-like body on a non-root command outside
+	 * `where`, where `name` is not a proven script-body slot (#525). The brace
+	 * may abbreviate one (`down=` for `down-script=`), but telling it from
+	 * `comment=` needs the command's argument list, which is schema — so the
+	 * caller warns instead of rejecting, and the device decides.
+	 */
+	ambiguous: boolean;
+	/** The `name` of `name=`, lower-cased, when `ambiguous` is true. */
+	name?: string;
+}
+
 /**
  * Locate top-level `{...}` values that RouterOS rejects in command arguments.
  *
@@ -1724,15 +1773,21 @@ export function comparesNamedValue(
  * excluded: their brace is a script body, not an array. The caller applies
  * this only to non-root commands; root scripting directives use the
  * `(verb, slot)` table instead.
+ *
+ * A `name={` with a script-like body that is not a proven slot is returned
+ * with `ambiguous: true` rather than as an error (#525), and so is the spaced
+ * `name= {…}` spelling (`down= { :beep }` lowers to `down-script=` on CHR
+ * 7.25). Array-content braces (`comment={1;2}`), positional braces, `where`
+ * comparisons and root slots keep their rejection.
  */
 export function invalidCommandBraceOffsets(
 	text: string,
 	from: number,
 	directiveVerb?: string,
 	range?: MaskedRange,
-): number[] {
+): CommandBraceFinding[] {
 	const structural = maskOf(range) ?? maskComments(text);
-	const offsets: number[] = [];
+	const offsets: CommandBraceFinding[] = [];
 	const stack: string[] = [];
 	let i = Math.max(0, from);
 	let tokenStart: number | null = null;
@@ -1783,7 +1838,54 @@ export function invalidCommandBraceOffsets(
 			tokenStart === null
 				? undefined
 				: braceValueOwner(structural, tokenStart, i);
-		const slot = owner === null ? `#${positionals}` : owner;
+		// A space after the `=` owns the brace the same way the glued `=`
+		// does (#554), so the slot attributes the spaced owner before
+		// falling back to positional: `:put x= { :beep }` reads slot `x`,
+		// not `#0` (which `put` accepts, swallowing the error).
+		const spacedOwner =
+			typeof owner === "string" ? undefined : spacedBraceOwner(structural, i);
+		const slot = owner === null ? (spacedOwner ?? `#${positionals}`) : owner;
+		// A `where` named comparison reads the brace with the property's own
+		// parser and rejects it (`expected <name> value`), so the #525 body
+		// guess must not shield it below — `gateway={ :beep }` included.
+		const inWhereComparison =
+			directiveVerb === undefined &&
+			whereAt !== null &&
+			comparesNamedValue(structural, i, whereAt);
+		// The ambiguity check comes first: `braceStartsStatements` reads an
+		// unproven `name={` with a script-like body as a body too (#525), so
+		// reaching that skip would swallow the warning that marks the guess.
+		// Control scopes (`do={` on a monitor, `:retry … command={`) are not
+		// guesses — the scope table already proves them — so they stay out.
+		// A space after the `=` owns the brace the same way the glued `=`
+		// does (`down= { :beep }` lowers to `down-script=` on CHR 7.25), so
+		// the spaced owner warns under the same gates.
+		const scopeName =
+			directiveVerb === undefined && whereAt === null
+				? range === undefined
+					? scopeNameFromMasked(structural, i)
+					: scopeNameFromMasked(range.masked, range.start + i, range.start)
+				: null;
+		const ambiguousOwner = typeof owner === "string" ? owner : spacedOwner;
+		if (
+			directiveVerb === undefined &&
+			whereAt === null &&
+			scopeName === null &&
+			typeof ambiguousOwner === "string" &&
+			!isScriptBodyName(ambiguousOwner) &&
+			braceBodyIsScriptLike(structural, i, end ?? structural.length)
+		) {
+			offsets.push({ at: i, ambiguous: true, name: ambiguousOwner });
+			i = end ?? i + 1;
+			continue;
+		}
+		// A root directive's slots and a `where` named comparison never take
+		// a script body through an unproven name: `:put x={ :beep }` and
+		// `where gateway={ :beep }` are device rejections, so the brace reads
+		// as a VALUE for the body check and the error below stands (#554).
+		// Proven slots still skip — the gate is only the unproven disjunct.
+		const unprovenName =
+			directiveVerb !== undefined || inWhereComparison ? "value" : "body";
 		if (
 			// Asked of the DOCUMENT when the caller anchored this statement, so the
 			// statement index behind it is the document's one index rather than a
@@ -1791,19 +1893,22 @@ export function invalidCommandBraceOffsets(
 			// subtree, and so was rebuilt once per enclosing level (#322). The floor
 			// makes the two readings the same answer (`scope-brace.ts`).
 			(range === undefined
-				? braceStartsStatements(structural, i)
-				: braceStartsStatements(range.masked, range.start + i, range.start)) ||
+				? braceStartsStatements(structural, i, 0, unprovenName)
+				: braceStartsStatements(
+						range.masked,
+						range.start + i,
+						range.start,
+						unprovenName,
+					)) ||
 			(directiveVerb !== undefined &&
 				slot !== undefined &&
 				braceSlotAcceptsBrace(directiveVerb, slot)) ||
-			(directiveVerb === undefined &&
-				whereAt !== null &&
-				!comparesNamedValue(structural, i, whereAt))
+			(directiveVerb === undefined && whereAt !== null && !inWhereComparison)
 		) {
 			i = end ?? structural.length;
 			continue;
 		}
-		offsets.push(i);
+		offsets.push({ at: i, ambiguous: false });
 		i = end ?? i + 1;
 	}
 	return offsets;