@tikoci/centrs 0.1.9-next.24 → 0.1.9

package/src/explain/catalog.ts

@@ -9,7 +9,7 @@
  * Union of two first-order sources (#228):
  *
  * 1. MikroTik's published CLI Reference (`https://manual.mikrotik.com/docs/cli-reference/`),
- *    1,099 pages, 1,106 entries — first-order about the definition
+ *    1,109 pages, 1,116 entries — first-order about the definition
  *    structs and their build-time gates. Since #285 every page is a leaf whose
  *    slug is the CLI path, so no spelling has to be rewritten to be looked up.
  * 2. 8 pinned restraml `/console/inspect` trees
@@ -28,9 +28,9 @@
  *
  * | Kind | Total | `both` | `inspect` | `published` |
  * | ---- | ----- | ------ | --------- | ----------- |
- * | `menu` | 568 | 457 | 67 | 44 |
- * | `command` | 477 | 436 | 0 | 41 |
- * | `settings` | 121 | 112 | 0 | 9 |
+ * | `menu` | 571 | 457 | 67 | 47 |
+ * | `command` | 483 | 436 | 0 | 47 |
+ * | `settings` | 122 | 112 | 0 | 10 |
  *
  * Zero navigation-vs-command contradictions between the two sources. Generation
  * aborts if that ever stops holding, rather than picking a winner. Where a path
@@ -49,9 +49,9 @@
  *
  * **Gates conjoin down a path, so read them with {@link effectiveGates}, not
  * row by row.** A row states only what the publication stated at that entry.
- * Read row-wise, 1 published-only path looks ungated; read with
+ * Read row-wise, 7 published-only paths look ungated; read with
  * ancestry, the residue carrying no published explanation for its absence at
- * all is 1.
+ * all is 7.
  *
  * Tree COMMANDS are not enumerated — those are the generic CRUD leaves
  * `verbs.ts` already owns. The command rows here are the published,
@@ -91,7 +91,7 @@ export interface CatalogEntry {
  * `path|kind|provenance|package|conditions|syscap` — with trailing empty
  * columns trimmed. Lower-cased, slash-led and sorted by path.
  *
- * Text rather than ~1,166 object literals so that one path is one line in a
+ * Text rather than ~1,176 object literals so that one path is one line in a
  * review diff, and so the formatter has nothing to re-wrap.
  */
 const ROWS = `
@@ -101,6 +101,7 @@ const ROWS = `
 /app/remove|command|both|container||app
 /app/restart|command|both|container||app
 /app/settings|settings|both|container||app
+/app/settings/remove-certificate|command|published|container||app
 /app/setup|command|both|container||app
 /app/update|command|both|container||app
 /beep|command|both
@@ -160,9 +161,9 @@ const ROWS = `
 /cmr/alert|menu|both|cmr
 /cmr/alert/show-devices|command|both|cmr
 /cmr/alert/test|command|both|cmr
-/cmr/client|settings|both||!smips, !powerpc
-/cmr/client/forget|command|both||!smips, !powerpc
-/cmr/client/pair|command|both||!smips, !powerpc
+/cmr/client|settings|both||!smips
+/cmr/client/forget|command|both||!smips
+/cmr/client/pair|command|both||!smips
 /cmr/client/push-button|command|both
 /cmr/device|menu|both|cmr
 /cmr/device/apptraffic|command|both|cmr
@@ -485,6 +486,12 @@ const ROWS = `
 /interface/wifi/dashboard/show-logs|command|both
 /interface/wifi/datapath|menu|both
 /interface/wifi/devel|command|both
+/interface/wifi/easymesh|settings|published
+/interface/wifi/easymesh/bss|menu|published
+/interface/wifi/easymesh/dpp-trigger|command|published
+/interface/wifi/easymesh/sta|menu|published
+/interface/wifi/easymesh/topology|menu|published
+/interface/wifi/easymesh/wps-push-button|command|published
 /interface/wifi/flat-snoop|command|both
 /interface/wifi/frequency-scan|command|both
 /interface/wifi/interworking|menu|both
@@ -1095,6 +1102,9 @@ const ROWS = `
 /system/resource/cpu|menu|both
 /system/resource/hardware|menu|both||!powerpc, !smips
 /system/resource/hardware/authorize|command|both||!powerpc, !smips
+/system/resource/hardware/power-cycle|command|published||!powerpc, !smips|usb-hub
+/system/resource/hardware/power-reset|command|published||!powerpc, !smips, !i386
+/system/resource/hardware/reset-overcurrent|command|published||!powerpc, !smips|usb-hub
 /system/resource/hardware/usb-power-reset|command|both||!powerpc, !smips, i386
 /system/resource/hardware/usb-settings|settings|both||!powerpc, !smips
 /system/resource/irq|menu|both
@@ -1373,8 +1383,8 @@ export interface CatalogGate {
  * parent's `syscap` applies even though the child entry states none: the gates
  * up a path CONJOIN, they do not override.
  *
- * Read row-wise, 1 published-only path looks ungated; read with
- * ancestry the residue is 1. The gap between the two is the
+ * Read row-wise, 7 published-only paths look ungated; read with
+ * ancestry the residue is 7. The gap between the two is the
  * conjunction, and it is what a caller has to reproduce: a child's silence about
  * a gate is not the absence of one. #228's finding — that a published-only path
  * almost always explains its own absence — is about the ancestry-aware number.

package/src/explain/pasted-prompt.ts

@@ -0,0 +1,198 @@
+import { buildTip, type Tip } from "../core/envelope.ts";
+import { type Segment, segmentStatements } from "./segment.ts";
+
+/**
+ * Pasted console-prompt repair (#370).
+ *
+ * Recognizes two grounded prompt shapes at the start of a *statement* (not a
+ * raw line, so prompt-looking text inside strings and comments stays legal):
+ *
+ * - `[user@host] <menu>> <command>` — e.g. `[admin@MikroTik] > /ip/address print`
+ *   at the root, or `[admin@MikroTik] /ip/address> add …` inside a menu, the
+ *   shape the manual's Console page shows; a HotLock prompt doubles the `>`
+ * - `/menu/path> <command>` — e.g. `/interface/lte> monitor lte1`
+ *
+ * Segmentation already split the document on real statement boundaries with
+ * string/comment awareness, so testing each segment's start is a lexical
+ * position, not a line-start regex. A prompt-looking line inside a multiline
+ * string is interior to its segment and never at a segment start; comment
+ * lines never become segments at all.
+ *
+ * Severity / envelope behavior (chosen, documented here per #370 scope):
+ * the tip is ADVISORY only and never changes `data.verdict`. The bracket
+ * shape already fails via `invalid-at-sign` (the `@` is a hard fault); the
+ * menu shape stays `warn` (abstention — offline cannot prove the menu
+ * exists on any given device). Output banners (`Flags:`, `Columns:`) and
+ * bare `>` forms are deliberately NOT detected here; they are separately
+ * grounded cases, not automatic extensions.
+ *
+ * The stripped candidate is offered as repair TEXT only and is never adopted
+ * or executed: tips carry no execution semantics. For the menu shape the
+ * candidate is the literal text after `>` (it runs in that menu's context
+ * on the device, not from the root).
+ *
+ * The candidate is the prompt-stripped tail of the ORIGINAL input — separators,
+ * blocks and newlines preserved verbatim — bounded by the next pasted prompt
+ * or the end of input, so each prompt in a transcript gets its own repair.
+ * Reconstructing from segment texts would flatten `{ ... }` blocks and drop
+ * whatever follows them. The slice needs analyzed-byte offsets as JS indices,
+ * which hold only when the segmentation reports `ascii`; otherwise the
+ * per-segment candidate stands (narrow, never wrong).
+ *
+ * No two adjacent quantifiers in BRACKET_PROMPT_RE can match the same bytes
+ * (the user part stops at the first `@`; the menu's leading space lives inside
+ * its optional group), so a near-miss fails in linear time.
+ */
+const BRACKET_PROMPT_RE =
+	/^\[[^[\]\r\n@]*@[^[\]\r\n]*\](?:\s*(\/[A-Za-z0-9_\-/]*))?\s*>>?\s*([\s\S]*)$/;
+const MENU_PROMPT_RE = /^(\/[A-Za-z0-9_\-/]+)\s*>>?\s*([\s\S]*)$/;
+
+export interface PastedPromptHit {
+	shape: "bracket" | "menu";
+	menu?: string;
+	candidate: string;
+}
+
+interface StrippedPrompt {
+	shape: "bracket" | "menu";
+	menu?: string;
+	/** Length of the prompt prefix within the segment text. */
+	promptEnd: number;
+	candidate: string;
+}
+
+/** True when re-segmenting `text` reports an unbalanced delimiter. */
+function hasUnbalancedDelimiters(text: string): boolean {
+	try {
+		return segmentStatements(text).defects.some(
+			(d) => d.code === "unbalanced-close" || d.code === "unclosed",
+		);
+	} catch {
+		return true;
+	}
+}
+
+export function detectPastedPrompts(input: string): PastedPromptHit[] {
+	const hits: PastedPromptHit[] = [];
+	let segments: Segment[];
+	let ascii: boolean;
+	try {
+		const result = segmentStatements(input);
+		segments = result.segments;
+		ascii = result.ascii;
+	} catch {
+		return hits;
+	}
+	// Per-segment prompt match. A bare prompt with no command ("prompt-empty")
+	// earns no hit but still bounds the previous hit's region.
+	const stripped: (StrippedPrompt | "prompt-empty" | null)[] = segments.map(
+		(segment) => {
+			const text = segment.text;
+			if (text.length === 0) return null;
+			const bracket = BRACKET_PROMPT_RE.exec(text);
+			if (bracket !== null) {
+				const menu = bracket[1];
+				const group = bracket[2] ?? "";
+				return group.trim().length > 0
+					? {
+							shape: "bracket",
+							...(menu && menu !== "/" ? { menu } : {}),
+							promptEnd: text.length - group.length,
+							candidate: group.trim(),
+						}
+					: "prompt-empty";
+			}
+			const menu = MENU_PROMPT_RE.exec(text);
+			if (menu !== null) {
+				const group = menu[2] ?? "";
+				return group.trim().length > 0
+					? {
+							shape: "menu",
+							menu: menu[1],
+							promptEnd: text.length - group.length,
+							candidate: group.trim(),
+						}
+					: "prompt-empty";
+			}
+			return null;
+		},
+	);
+	for (let i = 0; i < segments.length; i++) {
+		const hit = stripped[i];
+		if (hit === null || hit === undefined || hit === "prompt-empty") continue;
+		let candidate = hit.candidate;
+		if (ascii) {
+			const segment = segments[i];
+			let end = input.length;
+			for (let j = i + 1; j < segments.length; j++) {
+				if (stripped[j] !== null && stripped[j] !== undefined) {
+					end = segments[j]?.start ?? end;
+					break;
+				}
+			}
+			const sliced = input
+				.slice((segment?.start ?? 0) + hit.promptEnd, end)
+				.trim();
+			// The slice must not cross the prompt's enclosing container: it is
+			// kept only when it re-segments balanced, else the narrow
+			// per-segment candidate stands (`{ /menu> cmd }` would otherwise
+			// offer `cmd }`).
+			if (sliced.length > 0 && !hasUnbalancedDelimiters(sliced))
+				candidate = sliced;
+		}
+		hits.push({
+			shape: hit.shape,
+			...(hit.menu ? { menu: hit.menu } : {}),
+			candidate,
+		});
+	}
+	return hits;
+}
+
+/**
+ * A markdown code span that survives backticks in `text`: the fence is one
+ * longer than the longest backtick run inside, padded when `text` starts or
+ * ends with one (CommonMark code spans).
+ */
+function codeSpan(text: string): string {
+	const fence = "`".repeat(longestBacktickRun(text) + 1);
+	const pad = text.startsWith("`") || text.endsWith("`") ? " " : "";
+	return `${fence}${pad}${text}${pad}${fence}`;
+}
+
+/**
+ * A fenced code block for multi-line text: a code span would render its
+ * newlines as spaces, and `:put 1` NEWLINE `:put 2` is not `:put 1 :put 2`.
+ */
+function codeBlock(text: string): string {
+	const fence = "`".repeat(Math.max(3, longestBacktickRun(text) + 1));
+	return `${fence}\n${text}\n${fence}`;
+}
+
+function longestBacktickRun(text: string): number {
+	let longest = 0;
+	for (const run of text.match(/`+/g) ?? [])
+		longest = Math.max(longest, run.length);
+	return longest;
+}
+
+export function pastedPromptTips(input: string): Tip[] {
+	return detectPastedPrompts(input).map((hit) => {
+		const where = hit.menu ? ` (typed at ${codeSpan(hit.menu)})` : "";
+		const fix = /[\r\n]/.test(hit.candidate)
+			? `Drop the pasted prompt and try this${where} instead — this input was not executed:\n\n${codeBlock(hit.candidate)}`
+			: `Drop the pasted prompt and try ${codeSpan(hit.candidate)}${where} instead — this input was not executed.`;
+		if (hit.shape === "menu")
+			return buildTip(
+				"tip/explain-pasted-prompt",
+				`This looks like a pasted ${codeSpan(hit.menu ?? "")} menu prompt, not a command to run from the root.`,
+				fix,
+			);
+		const prompt = hit.menu ? `[user@host] ${hit.menu}>` : "[user@host] >";
+		return buildTip(
+			"tip/explain-pasted-prompt",
+			`This looks like a pasted console transcript (${codeSpan(prompt)}), not a command to run.`,
+			fix,
+		);
+	});
+}

package/src/explain/pathresolve.ts

@@ -1,8 +1,8 @@
 /**
  * Offline path resolution for `explain` (centrs canonicalizer).
  *
- * Ratified by the phase-0 lab, questions Q3 and Q4 (#185), promoted from the
- * throwaway probe `.scratch/explain-lab-pathresolve.ts`. Two surfaces:
+ * Ratified by the phase-0 lab, questions Q3 and Q4 (#185); the lab probe
+ * it was promoted from is history (see #185), not a runnable method. Two surfaces:
  *
  *   resolveStatements  (Q4) — the fully-qualified canonical path of every
  *                       statement in source order, tracking the persistent menu

package/src/explain/segment.ts

@@ -1,8 +1,8 @@
 /**
  * Statement segmenter for `explain` (centrs canonicalizer).
  *
- * Ratified by the phase-0 lab, question Q1 (#185) and promoted from the
- * throwaway probe `.scratch/explain-lab-segmenter.ts`. This is the first walker
+ * Ratified by the phase-0 lab, question Q1 (#185); the lab probe it was
+ * promoted from is history (see #185), not a runnable method. This is the first walker
  * stage: a schema-free, device-free splitter of multi-statement RouterOS input
  * into top-level statements, matching `(evl …)` sibling adjacency in `:parse`
  * IL. It never throws; structural surprises are reported as located

package/src/explain/symbols.ts

@@ -1,8 +1,8 @@
 /**
  * Symbol scope resolution for `explain` (centrs canonicalizer).
  *
- * Ratified by the phase-0 lab, question Q13 (#185) and promoted from the
- * throwaway probe `.scratch/explain-lab-symbols.ts`. Q13 asks whether an
+ * Ratified by the phase-0 lab, question Q13 (#185); the lab probe it was
+ * promoted from is history (see #185), not a runnable method. Q13 asks whether an
  * offline, schema-free reader can reproduce the class the console assigns to
  * every variable occurrence — `variable-local` / `-global` / `-auto` /
  * `-parameter` / `-undefined` in `/console/inspect request=highlight`.

package/src/explain/verbsplit.ts

@@ -1,8 +1,8 @@
 /**
  * Verb / menu boundary resolution for `explain` (centrs canonicalizer).
  *
- * Ratified by the phase-0 lab, question Q6 (#185) and promoted from the
- * throwaway probe `.scratch/explain-lab-verbsplit.ts`. Q6 asks the residual the
+ * Ratified by the phase-0 lab, question Q6 (#185); the lab probe it was
+ * promoted from is history (see #185), not a runnable method. Q6 asks the residual the
  * path resolver (Q3/Q4) deliberately left open: within a statement's leading
  * path run, where does the MENU end and the VERB begin — and when must offline
  * refuse to guess? `pathresolve.ts` reports a greedy full-run `path` plus the

package/src/explain/write.ts

@@ -1,8 +1,8 @@
 /**
  * Offline write-shape inference for `explain` — `structure.containsWrite`.
  *
- * Ratified by the phase-0 lab, question Q16 (#185) and promoted from the
- * throwaway probe `.scratch/explain-lab-q16-write.ts`. Q16 asked what shape the
+ * Ratified by the phase-0 lab, question Q16 (#185); the lab probe it was
+ * promoted from is history (see #185), not a runnable method. Q16 asked what shape the
  * field should have and answered that the spec's sketched **boolean is unsafe**:
  * a fail-closed `true | false | unknown` reaches 100% precision on what it
  * decides (226/226 holdout, 469/469 dev) with zero false negatives, abstaining

package/src/explain.ts

@@ -145,6 +145,7 @@ import { escapeSpans } from "./explain/escape-tokens.ts";
 import { findGroupFaults, type GroupFault } from "./explain/group-faults.ts";
 import { isKnownMenuPath } from "./explain/is-known-menu.ts";
 import { operatorSpans } from "./explain/operator-tokens.ts";
+import { pastedPromptTips } from "./explain/pasted-prompt.ts";
 import { type PathTokenCandidate, pathSpans } from "./explain/path-tokens.ts";
 import {
 	type Resolution,
@@ -2871,6 +2872,7 @@ export function explainEnvelope(
 			"No router was given, so this is the canonicalizer's reading alone.",
 			"Add a router (`centrs explain <router> '<input>'`) for read-only parse, highlight and argument-name evidence; `--schema` and `--complete` then describe paths and complete at the cursor.",
 		),
+		...pastedPromptTips(input),
 		...(options.tips ?? []),
 	];
 	const warnings: Warning[] = [...(options.warnings ?? [])];

package/src/index.ts

@@ -209,6 +209,7 @@ export {
 	addDevice,
 	buildDevicesErrorEnvelope,
 	type DevicesCommand,
+	type DevicesEncryptData,
 	type DevicesEnvelope,
 	type DevicesGroupSummary,
 	type DevicesInitData,
@@ -219,11 +220,15 @@ export {
 	type DevicesOutputFormat,
 	type DevicesShowEnvelopeData,
 	type DevicesShowItem,
+	type DevicesShowItemWithPassword,
 	type DevicesWarning,
 	type DevicesWhereClause,
 	defaultCdbPath,
 	devicesOutputFormats,
+	type EncryptCdbOptions,
 	editInteractiveOnlyError,
+	encryptCdb,
+	type InitCdbOptions,
 	initCdb,
 	type LoadCdbOptions,
 	type LoadedCdb,

package/src/mcp/safety.ts

@@ -11,10 +11,10 @@
  */
 
 import {
-	type DevicesShowItem,
+	type DeviceRecordLookup,
 	type LoadedCdb,
 	loadCdb,
-	showDevice,
+	lookupDeviceRecord,
 } from "../devices.ts";
 import { CentrsError } from "../errors.ts";
 import type { McpWritePolicy } from "../mcp.ts";
@@ -63,7 +63,7 @@ export async function loadAllowlistCdb(
  * MCP-specific framing of "this device is not on the allowlist", pointing at
  * `centrs_devices add` rather than leaking the CLI's `cdb/not-found-target`.
  *
- * Matches with {@link showDevice}, the matcher the core resolver dials with
+ * Matches with {@link lookupDeviceRecord}, the matcher the core resolver dials with
  * (target, `identity=`, `mac=`, `ip=`), so the record whose write policy is
  * checked here is the record the call then runs against (#444). A name that
  * matches more than one record fails `identity/ambiguous` rather than taking
@@ -75,9 +75,9 @@ export function resolveRegisteredTarget(
 ): RegisteredTarget {
 	// Before the lookup, whose refusal echoes the target (#478).
 	assertNoTargetPassword(target);
-	let entry: DevicesShowItem;
+	let found: DeviceRecordLookup;
 	try {
-		entry = showDevice({ cdb, target }).data.entry;
+		found = lookupDeviceRecord({ cdb, target });
 	} catch (error) {
 		// Preserve registered identities; mask credential-shaped lookup failures.
 		if (redactTargetInput(target) !== target) {
@@ -105,11 +105,12 @@ export function resolveRegisteredTarget(
 		}
 		throw error;
 	}
+	const { entry } = found;
 	return {
 		target: entry.target,
 		user: entry.user,
 		group: entry.group,
-		recordIndex: entry.cdbRecordIndex,
+		recordIndex: found.cdbRecordIndex,
 		writePolicy: readWritePolicy(entry.comment),
 	};
 }

package/src/mcp/tools.ts

@@ -63,8 +63,6 @@ export interface McpOperationMeta {
  */
 type McpEnvelope = CentrsEnvelope;
 
-type EnvelopeWithData = CentrsEnvelope<unknown> & { data?: unknown };
-
 /**
  * Build a minimal centrs error envelope for failures that happen in the MCP
  * adapter itself (allowlist rejections, policy denials) — before or instead of
@@ -111,39 +109,6 @@ function requireConfirm(tool: string, confirmed: boolean | undefined): void {
 	}
 }
 
-function redactEntry(entry: unknown): unknown {
-	if (typeof entry !== "object" || entry === null) {
-		return entry;
-	}
-	const { password, ...rest } = entry as Record<string, unknown>;
-	return {
-		...rest,
-		passwordSet: typeof password === "string" ? password.length > 0 : undefined,
-	};
-}
-
-function redactDeviceSecrets(envelope: McpEnvelope): McpEnvelope {
-	if (!envelope.ok) {
-		return envelope;
-	}
-	const withData = envelope as EnvelopeWithData;
-	const data = withData.data;
-	if (typeof data !== "object" || data === null) {
-		return envelope;
-	}
-	const deviceData = data as { entry?: unknown };
-	if (deviceData.entry === undefined) {
-		return envelope;
-	}
-	return {
-		...envelope,
-		data: {
-			...data,
-			entry: redactEntry(deviceData.entry),
-		},
-	};
-}
-
 // --- centrs_explain ---------------------------------------------------------
 
 export const explainInputShape = {
@@ -630,6 +595,9 @@ export async function handleDevices(
 				context: { op: args.op },
 			});
 		}
+		// `show`/`add`/`set` entries come back with the password withheld and
+		// `passwordSet` in its place: core redacts by default and MCP never
+		// passes `showPassword` (#551).
 		switch (args.op) {
 			case "list":
 				return listDevices({
@@ -643,29 +611,25 @@ export async function handleDevices(
 				return listGroups({ cdb, withMembers: true });
 			case "show": {
 				const target = requireDevicesTarget(args, "show");
-				return redactDeviceSecrets(
-					showDevice({ cdb, target, env: config.env }),
-				);
+				return showDevice({ cdb, target, env: config.env });
 			}
 			case "add": {
 				requireConfirm("centrs_devices op=add", args.confirm);
 				const target = requireDevicesTarget(args, "add");
-				return redactDeviceSecrets(
-					await addDevice({
-						cdb,
-						target,
-						recordType: resolveRecordType(args.recordType),
-						user: args.user,
-						password: args.password,
-						group: args.group,
-						profile: args.profile,
-						session: args.session,
-						comment: args.comment,
-						commentKvUpdates: buildGeoUpdates(args),
-						savedPassword: args.savedPassword,
-						force: args.force,
-					}),
-				);
+				return await addDevice({
+					cdb,
+					target,
+					recordType: resolveRecordType(args.recordType),
+					user: args.user,
+					password: args.password,
+					group: args.group,
+					profile: args.profile,
+					session: args.session,
+					comment: args.comment,
+					commentKvUpdates: buildGeoUpdates(args),
+					savedPassword: args.savedPassword,
+					force: args.force,
+				});
 			}
 			case "edit":
 				// The interactive editor has no MCP analogue; modify via op=set.
@@ -673,20 +637,18 @@ export async function handleDevices(
 			case "set": {
 				requireConfirm("centrs_devices op=set", args.confirm);
 				const target = requireDevicesTarget(args, "set");
-				return redactDeviceSecrets(
-					await setDevice({
-						cdb,
-						target,
-						updates: [...buildGeoUpdates(args), ...(args.updates ?? [])],
-						user: args.user,
-						password: args.password,
-						group: args.group,
-						profile: args.profile,
-						session: args.session,
-						savedPassword: args.savedPassword,
-						strict: args.strict,
-					}),
-				);
+				return await setDevice({
+					cdb,
+					target,
+					updates: [...buildGeoUpdates(args), ...(args.updates ?? [])],
+					user: args.user,
+					password: args.password,
+					group: args.group,
+					profile: args.profile,
+					session: args.session,
+					savedPassword: args.savedPassword,
+					strict: args.strict,
+				});
 			}
 			case "remove": {
 				requireConfirm("centrs_devices op=remove", args.confirm);

package/src/protocols/adapter.ts

@@ -14,6 +14,7 @@
  * protocol data.
  */
 
+import { assertRestRequestPath } from "../core/menu-path.ts";
 import { mapRouterOsError } from "../core/routeros-errors.ts";
 import { CentrsError } from "../errors.ts";
 import { formatEndpoint } from "./endpoint.ts";
@@ -1336,6 +1337,7 @@ function repliesToRecords(
 }
 
 function joinRestUrl(baseUrl: string, path: string): string {
+	assertRestRequestPath(path);
 	const normalizedPath = path.startsWith("/") ? path : `/${path}`;
 	return `${baseUrl}${normalizedPath}`;
 }

package/src/protocols/btest-session.ts

@@ -72,7 +72,6 @@ import {
 } from "./btest.ts";
 import {
 	bytesToBigIntBE,
-	type EcSrp5Shared,
 	ecSrp5ClientConfirm,
 	ecSrp5ClientShared,
 	ecSrp5Id,
@@ -677,13 +676,11 @@ async function runClientEcSrp5(
 
 	const challenge = parseServerChallenge(await readAuthFrame(channel));
 	const validator = ecSrp5Id(username, password, challenge.salt);
-	const shared = btestShared(
-		ecSrp5ClientShared(
-			keypair.privateKey,
-			challenge.serverPublicKey,
-			keypair.publicKey,
-			validator,
-		),
+	const shared = ecSrp5ClientShared(
+		keypair.privateKey,
+		challenge.serverPublicKey,
+		keypair.publicKey,
+		validator,
 	);
 	const clientCc = ecSrp5ClientConfirm(shared);
 	await channel.write(encodeConfirmation(clientCc));
@@ -785,13 +782,11 @@ async function runServerEcSrp5(
 	);
 	await channel.write(encodeServerChallenge(serverPublicKey, salt));
 
-	const shared = btestShared(
-		ecSrp5ServerShared(
-			keypair.privateKey,
-			validatorScalar,
-			hello.publicKey,
-			serverPublicKey,
-		),
+	const shared = ecSrp5ServerShared(
+		keypair.privateKey,
+		validatorScalar,
+		hello.publicKey,
+		serverPublicKey,
 	);
 	const clientCc = await readAuthFrame(channel);
 	const expectedCc = ecSrp5ClientConfirm(shared);
@@ -804,21 +799,6 @@ async function runServerEcSrp5(
 	return hello.username;
 }
 
-/**
- * The shared secret as btest hashes it: `z` without its leading zero bytes
- * (OpenSSL `BN_bn2bin`), where MAC-Telnet's `mtwei.c` pads it to 32
- * (`BN_bn2binpad`), so the shared math in `ec-srp5.ts` keeps 32 bytes.
- *
- * Grounded on CHR 7.24.5 `/tool/bandwidth-server`: over 800 client handshakes,
- * every one whose `z` began with 0x00 (9) failed with the padded form and no
- * other did. Stripped, 600 of 600 verified, 4 of them with a leading zero.
- */
-export function btestShared(shared: EcSrp5Shared): EcSrp5Shared {
-	let start = 0;
-	while (start < shared.z.length - 1 && shared.z[start] === 0) start++;
-	return start === 0 ? shared : { j: shared.j, z: shared.z.subarray(start) };
-}
-
 function ecSrp5RandomSalt(): Uint8Array {
 	return crypto.getRandomValues(new Uint8Array(16));
 }