@tikoci/centrs 0.1.9-next.24 → 0.1.9-next.27

package/src/devices.ts

@@ -19,6 +19,7 @@ import {
 	decryptWinBoxCdb,
 	type EncryptedWinBoxCdbFile,
 	encodeOpenWinBoxCdb,
+	encryptWinBoxCdb,
 	parseWinBoxCdb,
 	type WinBoxCdbEntry,
 	type WinBoxCdbField,
@@ -112,6 +113,7 @@ export interface DevicesGroupSummary {
 
 export type DevicesCommand =
 	| "init"
+	| "encrypt"
 	| "list"
 	| "show"
 	| "groups"
@@ -165,7 +167,7 @@ export interface LoadedCdb {
 	entries: readonly WinBoxCdbEntry[];
 	settings: DevicesSettings;
 	warnings: readonly DevicesWarning[];
-	/** True when the source file on disk was encrypted (writes are blocked). */
+	/** True when the source file on disk was encrypted. */
 	encrypted: boolean;
 }
 
@@ -232,7 +234,7 @@ function isAlreadyExistsError(cause: unknown): boolean {
 }
 
 /**
- * Create an empty open CDB at `path` without clobbering an existing file.
+ * Create an empty CDB at `path` without clobbering an existing file.
  * The bytes are written to a private temp file first and then hard-linked
  * into place: `link` fails with EEXIST instead of replacing, and `path` never
  * exists half-written, so a concurrent creator that loses the race reads a
@@ -242,14 +244,20 @@ function isAlreadyExistsError(cause: unknown): boolean {
  * file. Mode `0o600` keeps the CDB (device credentials) unreadable by other
  * local users instead of falling back to the process umask default.
  */
-async function createEmptyCdbNoClobber(path: string): Promise<boolean> {
+async function createEmptyCdbNoClobber(
+	path: string,
+	password?: string,
+): Promise<boolean> {
 	await mkdir(dirname(path), { recursive: true });
 	const tempPath = `${path}.init.${randomUUID()}`;
 	const handle = await open(tempPath, "wx", 0o600);
 	try {
 		try {
 			await handle.chmod(0o600);
-			await handle.write(encodeOpenWinBoxCdb([]));
+			const bytes = encodeOpenWinBoxCdb([]);
+			await handle.write(
+				password === undefined ? bytes : encryptWinBoxCdb(bytes, password),
+			);
 			await handle.sync();
 		} finally {
 			await handle.close();
@@ -270,11 +278,19 @@ export interface DevicesInitData {
 	cdbFile: string;
 	/** False when a readable CDB was already there; nothing was written. */
 	created: boolean;
+	/** Actual mode of the newly created or verified existing CDB. */
+	encrypted: boolean;
 	recordCount: number;
 }
 
+export interface InitCdbOptions extends LoadCdbOptions {
+	/** Require encryption; an existing open CDB is refused, never converted. */
+	encrypt?: boolean;
+}
+
 /**
- * `devices init` (#376): create an empty open CDB at the resolved path, the
+ * `devices init`: create an empty CDB (open by default, encrypted with
+ * `encrypt: true`) at the resolved path, the
  * explicit counterpart of the default path's first-run auto-create. Never
  * clobbers: like `git init`, re-running on an existing, readable CDB succeeds
  * with a `cdb/file-exists` warning and writes nothing, so a workspace bootstrap
@@ -282,15 +298,29 @@ export interface DevicesInitData {
  * (not a CDB, or encrypted without a password) fails with the load error.
  */
 export async function initCdb(
-	options: LoadCdbOptions,
+	options: InitCdbOptions,
 ): Promise<CentrsSuccessEnvelope<DevicesInitData, DevicesOperationMeta>> {
 	const settings = resolveDevicesSettings(options);
 	const cdbFile = settings.cdbFile.value;
+	if (options.encrypt) requireEncryptionPassword(settings);
 	const existingResult = async () => {
 		const existing = await loadCdb(options);
+		if (options.encrypt && !existing.encrypted) {
+			throw new CentrsError({
+				code: "input/invalid-command",
+				summary: `An open CDB already exists at ${cdbFile}; encrypted initialization wrote nothing.`,
+				remediation: `Run \`centrs devices encrypt --cdb-file ${cdbFile}\` to convert the existing CDB explicitly.`,
+				context: { cdbFile },
+			});
+		}
 		return {
 			ok: true as const,
-			data: { cdbFile, created: false, recordCount: existing.entries.length },
+			data: {
+				cdbFile,
+				created: false,
+				encrypted: existing.encrypted,
+				recordCount: existing.entries.length,
+			},
 			warnings: [
 				...existing.warnings,
 				{
@@ -310,7 +340,10 @@ export async function initCdb(
 	}
 	let created: boolean;
 	try {
-		created = await createEmptyCdbNoClobber(cdbFile);
+		created = await createEmptyCdbNoClobber(
+			cdbFile,
+			options.encrypt ? settings.cdbPassword.value : undefined,
+		);
 	} catch (cause) {
 		throw new CentrsError({
 			code: "cdb/create-failed",
@@ -326,13 +359,113 @@ export async function initCdb(
 	}
 	return {
 		ok: true,
-		data: { cdbFile, created: true, recordCount: 0 },
+		data: {
+			cdbFile,
+			created: true,
+			encrypted: options.encrypt === true,
+			recordCount: 0,
+		},
 		warnings: [],
 		tips: [],
 		meta: devicesMeta("init", settings),
 	};
 }
 
+function requireEncryptionPassword(settings: DevicesSettings): void {
+	if (
+		!settings.cdbPassword.provided ||
+		settings.cdbPassword.value.length === 0
+	) {
+		throw new CentrsError({
+			code: "cdb/password-required",
+			summary: "CDB encryption requires a non-empty password.",
+			remediation:
+				"Pass --cdb-password or set CENTRS_CDB_PASSWORD to a non-empty CDB password.",
+		});
+	}
+}
+
+export interface EncryptCdbOptions extends LoadCdbOptions {
+	/**
+	 * Skip the plaintext pre-conversion snapshot. Existing backups are still
+	 * retained untouched; without the snapshot a forgotten password is final.
+	 */
+	skipBackup?: boolean;
+}
+
+export interface DevicesEncryptData {
+	cdbFile: string;
+	encrypted: true;
+	/** False when the CDB was already encrypted and the password verified. */
+	changed: boolean;
+	recordCount: number;
+	/** Plaintext pre-conversion snapshot; absent when unchanged or `skipBackup`. */
+	backupPath?: string;
+}
+
+/**
+ * Explicitly convert an existing open CDB with a fresh salt and atomic replacement.
+ * Retain all backups: converting the active file does not protect old plaintext.
+ * Close WinBox and other writers first; this is not a cross-process transaction (#581).
+ * Already-encrypted files are verified with the supplied password and left untouched.
+ * `skipBackup` omits the new plaintext snapshot; it never deletes older backups.
+ */
+export async function encryptCdb(
+	options: EncryptCdbOptions,
+): Promise<CentrsSuccessEnvelope<DevicesEncryptData, DevicesOperationMeta>> {
+	const settings = resolveDevicesSettings(options);
+	requireEncryptionPassword(settings);
+	const cdbFile = settings.cdbFile.value;
+	// Pin even the default path so conversion never implicitly creates a file.
+	const cdb = await loadCdb({ ...options, cdbFile });
+	let backupPath: string | undefined;
+	if (!cdb.encrypted) {
+		try {
+			const written = await writeWinBoxCdb(
+				cdbFile,
+				cdb.entries.map((entry) => entry.record),
+				{
+					encryptWith: { password: settings.cdbPassword.value },
+					backupRetention: -1,
+					skipBackup: options.skipBackup === true,
+				},
+			);
+			backupPath = written.backupPath;
+		} catch (cause) {
+			throw new CentrsError({
+				code: "cdb/encrypt-failed",
+				summary: `Could not encrypt the CDB at ${cdbFile}.`,
+				remediation:
+					"Check directory permissions and available disk space; retain the original and any backups before retrying.",
+				context: { cdbFile },
+				cause,
+			});
+		}
+	}
+	return {
+		ok: true,
+		data: {
+			cdbFile,
+			encrypted: true,
+			changed: !cdb.encrypted,
+			recordCount: cdb.entries.length,
+			...(backupPath ? { backupPath } : {}),
+		},
+		warnings: [
+			...cdb.warnings.filter(
+				(warning) => warning.code !== "cdb/password-not-needed",
+			),
+			{
+				code: "cdb/plaintext-backups",
+				message:
+					"Backups may contain plaintext credentials. Encryption protects only the active CDB; no backups were deleted or encrypted.",
+			},
+		],
+		tips: [],
+		meta: devicesMeta("encrypt", settings),
+	};
+}
+
 export async function loadCdb(options: LoadCdbOptions): Promise<LoadedCdb> {
 	const settings = resolveDevicesSettings(options);
 	const warnings: DevicesWarning[] = [];
@@ -1859,6 +1992,18 @@ function renderText(envelope: DevicesEnvelope<unknown>): string {
 					? `created ${data.cdbFile}`
 					: `exists ${data.cdbFile} (${data.recordCount} record(s))`,
 			);
+			lines.push(`encrypted:     ${data.encrypted}`);
+			break;
+		}
+		case "encrypt": {
+			const data = envelope.data as DevicesEncryptData;
+			lines.push(
+				data.changed
+					? `encrypted ${data.cdbFile}`
+					: `verified encrypted ${data.cdbFile} (unchanged)`,
+			);
+			lines.push(`records:       ${data.recordCount}`);
+			if (data.backupPath) lines.push(`backup:        ${data.backupPath}`);
 			break;
 		}
 		case "list":

package/src/execute-fanout.ts

@@ -60,6 +60,7 @@ import {
 } from "./execute.ts";
 import { plannedProtocols, type RouterOsProtocol } from "./protocols/index.ts";
 import {
+	assertNoMatchInFanout,
 	emptyWriteSelectionError,
 	expandSelection,
 	isDefaultRecordTarget,
@@ -206,6 +207,7 @@ export async function executeFanout(
 	internals: ExecuteFanoutInternals = {},
 	options: ExecuteFanoutOptions = {},
 ): Promise<ExecuteFanoutEnvelope> {
+	assertNoMatchInFanout(request.match);
 	// Validate + canonicalize the command ONCE, before selection expansion: a bad
 	// command shape is an outer error regardless of how many targets resolve, and
 	// write-ness is target-independent.

package/src/execute.ts

@@ -120,6 +120,12 @@ export interface ExecuteRequest {
 	maxResultsBytes?: number;
 	cdbFile?: string;
 	cdbPassword?: string;
+	/**
+	 * `--match` selector for a `<router>` several CDB records share
+	 * (`user=<name>`, `target=<addr>`, or a record type): the same selector
+	 * `devices show --match` takes. Single-target only (#583).
+	 */
+	match?: string;
 	/** Opt-in host ARP resolution for a MAC target (`none` default, or `arp`). */
 	resolve?: string;
 	stdinIsTty?: boolean;
@@ -367,6 +373,7 @@ export async function resolveExecuteRequest(
 					targetInput: request.targetInput,
 					cdbFile: request.cdbFile,
 					cdbPassword: request.cdbPassword,
+					match: request.match,
 				},
 				env,
 				config,

package/src/explain/blocks.ts

@@ -1,8 +1,8 @@
 /**
  * Block / scope-brace classification for `explain` (centrs canonicalizer).
  *
- * Ratified by the phase-0 lab, question Q2 (#185) and promoted from the
- * throwaway probe `.scratch/explain-lab-blocktree.ts`. Q2 asks: can an offline,
+ * Ratified by the phase-0 lab, question Q2 (#185); the lab probe it was
+ * promoted from is history (see #185), not a runnable method. Q2 asks: can an offline,
  * schema-free brace tracker tell a `{…}` SCOPE (`do=`/`else=`/`on-error=`, which
  * IL lowers to `name=;(evl …)`) from a `name={…}` LITERAL value (braces
  * stripped, body kept as RAW text, never lowered)? Descending into a literal

package/src/explain/catalog.ts

@@ -9,7 +9,7 @@
  * Union of two first-order sources (#228):
  *
  * 1. MikroTik's published CLI Reference (`https://manual.mikrotik.com/docs/cli-reference/`),
- *    1,099 pages, 1,106 entries — first-order about the definition
+ *    1,109 pages, 1,116 entries — first-order about the definition
  *    structs and their build-time gates. Since #285 every page is a leaf whose
  *    slug is the CLI path, so no spelling has to be rewritten to be looked up.
  * 2. 8 pinned restraml `/console/inspect` trees
@@ -28,9 +28,9 @@
  *
  * | Kind | Total | `both` | `inspect` | `published` |
  * | ---- | ----- | ------ | --------- | ----------- |
- * | `menu` | 568 | 457 | 67 | 44 |
- * | `command` | 477 | 436 | 0 | 41 |
- * | `settings` | 121 | 112 | 0 | 9 |
+ * | `menu` | 571 | 457 | 67 | 47 |
+ * | `command` | 483 | 436 | 0 | 47 |
+ * | `settings` | 122 | 112 | 0 | 10 |
  *
  * Zero navigation-vs-command contradictions between the two sources. Generation
  * aborts if that ever stops holding, rather than picking a winner. Where a path
@@ -49,9 +49,9 @@
  *
  * **Gates conjoin down a path, so read them with {@link effectiveGates}, not
  * row by row.** A row states only what the publication stated at that entry.
- * Read row-wise, 1 published-only path looks ungated; read with
+ * Read row-wise, 7 published-only paths look ungated; read with
  * ancestry, the residue carrying no published explanation for its absence at
- * all is 1.
+ * all is 7.
  *
  * Tree COMMANDS are not enumerated — those are the generic CRUD leaves
  * `verbs.ts` already owns. The command rows here are the published,
@@ -91,7 +91,7 @@ export interface CatalogEntry {
  * `path|kind|provenance|package|conditions|syscap` — with trailing empty
  * columns trimmed. Lower-cased, slash-led and sorted by path.
  *
- * Text rather than ~1,166 object literals so that one path is one line in a
+ * Text rather than ~1,176 object literals so that one path is one line in a
  * review diff, and so the formatter has nothing to re-wrap.
  */
 const ROWS = `
@@ -101,6 +101,7 @@ const ROWS = `
 /app/remove|command|both|container||app
 /app/restart|command|both|container||app
 /app/settings|settings|both|container||app
+/app/settings/remove-certificate|command|published|container||app
 /app/setup|command|both|container||app
 /app/update|command|both|container||app
 /beep|command|both
@@ -160,9 +161,9 @@ const ROWS = `
 /cmr/alert|menu|both|cmr
 /cmr/alert/show-devices|command|both|cmr
 /cmr/alert/test|command|both|cmr
-/cmr/client|settings|both||!smips, !powerpc
-/cmr/client/forget|command|both||!smips, !powerpc
-/cmr/client/pair|command|both||!smips, !powerpc
+/cmr/client|settings|both||!smips
+/cmr/client/forget|command|both||!smips
+/cmr/client/pair|command|both||!smips
 /cmr/client/push-button|command|both
 /cmr/device|menu|both|cmr
 /cmr/device/apptraffic|command|both|cmr
@@ -485,6 +486,12 @@ const ROWS = `
 /interface/wifi/dashboard/show-logs|command|both
 /interface/wifi/datapath|menu|both
 /interface/wifi/devel|command|both
+/interface/wifi/easymesh|settings|published
+/interface/wifi/easymesh/bss|menu|published
+/interface/wifi/easymesh/dpp-trigger|command|published
+/interface/wifi/easymesh/sta|menu|published
+/interface/wifi/easymesh/topology|menu|published
+/interface/wifi/easymesh/wps-push-button|command|published
 /interface/wifi/flat-snoop|command|both
 /interface/wifi/frequency-scan|command|both
 /interface/wifi/interworking|menu|both
@@ -1095,6 +1102,9 @@ const ROWS = `
 /system/resource/cpu|menu|both
 /system/resource/hardware|menu|both||!powerpc, !smips
 /system/resource/hardware/authorize|command|both||!powerpc, !smips
+/system/resource/hardware/power-cycle|command|published||!powerpc, !smips|usb-hub
+/system/resource/hardware/power-reset|command|published||!powerpc, !smips, !i386
+/system/resource/hardware/reset-overcurrent|command|published||!powerpc, !smips|usb-hub
 /system/resource/hardware/usb-power-reset|command|both||!powerpc, !smips, i386
 /system/resource/hardware/usb-settings|settings|both||!powerpc, !smips
 /system/resource/irq|menu|both
@@ -1373,8 +1383,8 @@ export interface CatalogGate {
  * parent's `syscap` applies even though the child entry states none: the gates
  * up a path CONJOIN, they do not override.
  *
- * Read row-wise, 1 published-only path looks ungated; read with
- * ancestry the residue is 1. The gap between the two is the
+ * Read row-wise, 7 published-only paths look ungated; read with
+ * ancestry the residue is 7. The gap between the two is the
  * conjunction, and it is what a caller has to reproduce: a child's silence about
  * a gate is not the absence of one. #228's finding — that a published-only path
  * almost always explains its own absence — is about the ancestry-aware number.

package/src/explain/pasted-prompt.ts

@@ -0,0 +1,198 @@
+import { buildTip, type Tip } from "../core/envelope.ts";
+import { type Segment, segmentStatements } from "./segment.ts";
+
+/**
+ * Pasted console-prompt repair (#370).
+ *
+ * Recognizes two grounded prompt shapes at the start of a *statement* (not a
+ * raw line, so prompt-looking text inside strings and comments stays legal):
+ *
+ * - `[user@host] <menu>> <command>` — e.g. `[admin@MikroTik] > /ip/address print`
+ *   at the root, or `[admin@MikroTik] /ip/address> add …` inside a menu, the
+ *   shape the manual's Console page shows; a HotLock prompt doubles the `>`
+ * - `/menu/path> <command>` — e.g. `/interface/lte> monitor lte1`
+ *
+ * Segmentation already split the document on real statement boundaries with
+ * string/comment awareness, so testing each segment's start is a lexical
+ * position, not a line-start regex. A prompt-looking line inside a multiline
+ * string is interior to its segment and never at a segment start; comment
+ * lines never become segments at all.
+ *
+ * Severity / envelope behavior (chosen, documented here per #370 scope):
+ * the tip is ADVISORY only and never changes `data.verdict`. The bracket
+ * shape already fails via `invalid-at-sign` (the `@` is a hard fault); the
+ * menu shape stays `warn` (abstention — offline cannot prove the menu
+ * exists on any given device). Output banners (`Flags:`, `Columns:`) and
+ * bare `>` forms are deliberately NOT detected here; they are separately
+ * grounded cases, not automatic extensions.
+ *
+ * The stripped candidate is offered as repair TEXT only and is never adopted
+ * or executed: tips carry no execution semantics. For the menu shape the
+ * candidate is the literal text after `>` (it runs in that menu's context
+ * on the device, not from the root).
+ *
+ * The candidate is the prompt-stripped tail of the ORIGINAL input — separators,
+ * blocks and newlines preserved verbatim — bounded by the next pasted prompt
+ * or the end of input, so each prompt in a transcript gets its own repair.
+ * Reconstructing from segment texts would flatten `{ ... }` blocks and drop
+ * whatever follows them. The slice needs analyzed-byte offsets as JS indices,
+ * which hold only when the segmentation reports `ascii`; otherwise the
+ * per-segment candidate stands (narrow, never wrong).
+ *
+ * No two adjacent quantifiers in BRACKET_PROMPT_RE can match the same bytes
+ * (the user part stops at the first `@`; the menu's leading space lives inside
+ * its optional group), so a near-miss fails in linear time.
+ */
+const BRACKET_PROMPT_RE =
+	/^\[[^[\]\r\n@]*@[^[\]\r\n]*\](?:\s*(\/[A-Za-z0-9_\-/]*))?\s*>>?\s*([\s\S]*)$/;
+const MENU_PROMPT_RE = /^(\/[A-Za-z0-9_\-/]+)\s*>>?\s*([\s\S]*)$/;
+
+export interface PastedPromptHit {
+	shape: "bracket" | "menu";
+	menu?: string;
+	candidate: string;
+}
+
+interface StrippedPrompt {
+	shape: "bracket" | "menu";
+	menu?: string;
+	/** Length of the prompt prefix within the segment text. */
+	promptEnd: number;
+	candidate: string;
+}
+
+/** True when re-segmenting `text` reports an unbalanced delimiter. */
+function hasUnbalancedDelimiters(text: string): boolean {
+	try {
+		return segmentStatements(text).defects.some(
+			(d) => d.code === "unbalanced-close" || d.code === "unclosed",
+		);
+	} catch {
+		return true;
+	}
+}
+
+export function detectPastedPrompts(input: string): PastedPromptHit[] {
+	const hits: PastedPromptHit[] = [];
+	let segments: Segment[];
+	let ascii: boolean;
+	try {
+		const result = segmentStatements(input);
+		segments = result.segments;
+		ascii = result.ascii;
+	} catch {
+		return hits;
+	}
+	// Per-segment prompt match. A bare prompt with no command ("prompt-empty")
+	// earns no hit but still bounds the previous hit's region.
+	const stripped: (StrippedPrompt | "prompt-empty" | null)[] = segments.map(
+		(segment) => {
+			const text = segment.text;
+			if (text.length === 0) return null;
+			const bracket = BRACKET_PROMPT_RE.exec(text);
+			if (bracket !== null) {
+				const menu = bracket[1];
+				const group = bracket[2] ?? "";
+				return group.trim().length > 0
+					? {
+							shape: "bracket",
+							...(menu && menu !== "/" ? { menu } : {}),
+							promptEnd: text.length - group.length,
+							candidate: group.trim(),
+						}
+					: "prompt-empty";
+			}
+			const menu = MENU_PROMPT_RE.exec(text);
+			if (menu !== null) {
+				const group = menu[2] ?? "";
+				return group.trim().length > 0
+					? {
+							shape: "menu",
+							menu: menu[1],
+							promptEnd: text.length - group.length,
+							candidate: group.trim(),
+						}
+					: "prompt-empty";
+			}
+			return null;
+		},
+	);
+	for (let i = 0; i < segments.length; i++) {
+		const hit = stripped[i];
+		if (hit === null || hit === undefined || hit === "prompt-empty") continue;
+		let candidate = hit.candidate;
+		if (ascii) {
+			const segment = segments[i];
+			let end = input.length;
+			for (let j = i + 1; j < segments.length; j++) {
+				if (stripped[j] !== null && stripped[j] !== undefined) {
+					end = segments[j]?.start ?? end;
+					break;
+				}
+			}
+			const sliced = input
+				.slice((segment?.start ?? 0) + hit.promptEnd, end)
+				.trim();
+			// The slice must not cross the prompt's enclosing container: it is
+			// kept only when it re-segments balanced, else the narrow
+			// per-segment candidate stands (`{ /menu> cmd }` would otherwise
+			// offer `cmd }`).
+			if (sliced.length > 0 && !hasUnbalancedDelimiters(sliced))
+				candidate = sliced;
+		}
+		hits.push({
+			shape: hit.shape,
+			...(hit.menu ? { menu: hit.menu } : {}),
+			candidate,
+		});
+	}
+	return hits;
+}
+
+/**
+ * A markdown code span that survives backticks in `text`: the fence is one
+ * longer than the longest backtick run inside, padded when `text` starts or
+ * ends with one (CommonMark code spans).
+ */
+function codeSpan(text: string): string {
+	const fence = "`".repeat(longestBacktickRun(text) + 1);
+	const pad = text.startsWith("`") || text.endsWith("`") ? " " : "";
+	return `${fence}${pad}${text}${pad}${fence}`;
+}
+
+/**
+ * A fenced code block for multi-line text: a code span would render its
+ * newlines as spaces, and `:put 1` NEWLINE `:put 2` is not `:put 1 :put 2`.
+ */
+function codeBlock(text: string): string {
+	const fence = "`".repeat(Math.max(3, longestBacktickRun(text) + 1));
+	return `${fence}\n${text}\n${fence}`;
+}
+
+function longestBacktickRun(text: string): number {
+	let longest = 0;
+	for (const run of text.match(/`+/g) ?? [])
+		longest = Math.max(longest, run.length);
+	return longest;
+}
+
+export function pastedPromptTips(input: string): Tip[] {
+	return detectPastedPrompts(input).map((hit) => {
+		const where = hit.menu ? ` (typed at ${codeSpan(hit.menu)})` : "";
+		const fix = /[\r\n]/.test(hit.candidate)
+			? `Drop the pasted prompt and try this${where} instead — this input was not executed:\n\n${codeBlock(hit.candidate)}`
+			: `Drop the pasted prompt and try ${codeSpan(hit.candidate)}${where} instead — this input was not executed.`;
+		if (hit.shape === "menu")
+			return buildTip(
+				"tip/explain-pasted-prompt",
+				`This looks like a pasted ${codeSpan(hit.menu ?? "")} menu prompt, not a command to run from the root.`,
+				fix,
+			);
+		const prompt = hit.menu ? `[user@host] ${hit.menu}>` : "[user@host] >";
+		return buildTip(
+			"tip/explain-pasted-prompt",
+			`This looks like a pasted console transcript (${codeSpan(prompt)}), not a command to run.`,
+			fix,
+		);
+	});
+}

package/src/explain/pathresolve.ts

@@ -1,8 +1,8 @@
 /**
  * Offline path resolution for `explain` (centrs canonicalizer).
  *
- * Ratified by the phase-0 lab, questions Q3 and Q4 (#185), promoted from the
- * throwaway probe `.scratch/explain-lab-pathresolve.ts`. Two surfaces:
+ * Ratified by the phase-0 lab, questions Q3 and Q4 (#185); the lab probe
+ * it was promoted from is history (see #185), not a runnable method. Two surfaces:
  *
  *   resolveStatements  (Q4) — the fully-qualified canonical path of every
  *                       statement in source order, tracking the persistent menu

package/src/explain/segment.ts

@@ -1,8 +1,8 @@
 /**
  * Statement segmenter for `explain` (centrs canonicalizer).
  *
- * Ratified by the phase-0 lab, question Q1 (#185) and promoted from the
- * throwaway probe `.scratch/explain-lab-segmenter.ts`. This is the first walker
+ * Ratified by the phase-0 lab, question Q1 (#185); the lab probe it was
+ * promoted from is history (see #185), not a runnable method. This is the first walker
  * stage: a schema-free, device-free splitter of multi-statement RouterOS input
  * into top-level statements, matching `(evl …)` sibling adjacency in `:parse`
  * IL. It never throws; structural surprises are reported as located

package/src/explain/symbols.ts

@@ -1,8 +1,8 @@
 /**
  * Symbol scope resolution for `explain` (centrs canonicalizer).
  *
- * Ratified by the phase-0 lab, question Q13 (#185) and promoted from the
- * throwaway probe `.scratch/explain-lab-symbols.ts`. Q13 asks whether an
+ * Ratified by the phase-0 lab, question Q13 (#185); the lab probe it was
+ * promoted from is history (see #185), not a runnable method. Q13 asks whether an
  * offline, schema-free reader can reproduce the class the console assigns to
  * every variable occurrence — `variable-local` / `-global` / `-auto` /
  * `-parameter` / `-undefined` in `/console/inspect request=highlight`.

package/src/explain/verbsplit.ts

@@ -1,8 +1,8 @@
 /**
  * Verb / menu boundary resolution for `explain` (centrs canonicalizer).
  *
- * Ratified by the phase-0 lab, question Q6 (#185) and promoted from the
- * throwaway probe `.scratch/explain-lab-verbsplit.ts`. Q6 asks the residual the
+ * Ratified by the phase-0 lab, question Q6 (#185); the lab probe it was
+ * promoted from is history (see #185), not a runnable method. Q6 asks the residual the
  * path resolver (Q3/Q4) deliberately left open: within a statement's leading
  * path run, where does the MENU end and the VERB begin — and when must offline
  * refuse to guess? `pathresolve.ts` reports a greedy full-run `path` plus the

package/src/explain/write.ts

@@ -1,8 +1,8 @@
 /**
  * Offline write-shape inference for `explain` — `structure.containsWrite`.
  *
- * Ratified by the phase-0 lab, question Q16 (#185) and promoted from the
- * throwaway probe `.scratch/explain-lab-q16-write.ts`. Q16 asked what shape the
+ * Ratified by the phase-0 lab, question Q16 (#185); the lab probe it was
+ * promoted from is history (see #185), not a runnable method. Q16 asked what shape the
  * field should have and answered that the spec's sketched **boolean is unsafe**:
  * a fail-closed `true | false | unknown` reaches 100% precision on what it
  * decides (226/226 holdout, 469/469 dev) with zero false negatives, abstaining

package/src/explain.ts

@@ -145,6 +145,7 @@ import { escapeSpans } from "./explain/escape-tokens.ts";
 import { findGroupFaults, type GroupFault } from "./explain/group-faults.ts";
 import { isKnownMenuPath } from "./explain/is-known-menu.ts";
 import { operatorSpans } from "./explain/operator-tokens.ts";
+import { pastedPromptTips } from "./explain/pasted-prompt.ts";
 import { type PathTokenCandidate, pathSpans } from "./explain/path-tokens.ts";
 import {
 	type Resolution,
@@ -2871,6 +2872,7 @@ export function explainEnvelope(
 			"No router was given, so this is the canonicalizer's reading alone.",
 			"Add a router (`centrs explain <router> '<input>'`) for read-only parse, highlight and argument-name evidence; `--schema` and `--complete` then describe paths and complete at the cursor.",
 		),
+		...pastedPromptTips(input),
 		...(options.tips ?? []),
 	];
 	const warnings: Warning[] = [...(options.warnings ?? [])];