ciscollm-cli 1.0.1 → 1.0.3

package/dist/core/agent/HierarchicalAgentManager.js

@@ -0,0 +1,70 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HierarchicalAgentManager = void 0;
+class HierarchicalAgentManager {
+    static agents = [
+        {
+            role: 'CORE',
+            description: 'Handles core routing tables, dynamic routing protocols (OSPF, BGP, RIP), static routes, and IP SLAs.',
+            allowedPattern: [
+                /^(no\s+)?ip\s+route\s+/i,
+                /^(no\s+)?router\s+(ospf|bgp|rip|eigrp)/i,
+                /^(no\s+)?network\s+/i,
+                /^(no\s+)?neighbor\s+/i,
+                /^show\s+ip\s+route/i,
+                /^show\s+ip\s+ospf/i,
+                /^show\s+ip\s+bgp/i
+            ]
+        },
+        {
+            role: 'DISTRIBUTION',
+            description: 'Handles VLAN databases, trunking protocols, authentication (AAA), ACL firewalls, and NAT mappings.',
+            allowedPattern: [
+                /^(no\s+)?vlan\s+\d+/i,
+                /^(no\s+)?access-list\s+/i,
+                /^(no\s+)?ip\s+access-list\s+/i,
+                /^(no\s+)?ip\s+access-group\s+/i,
+                /^(no\s+)?crypto\s+key\s+/i,
+                /^(no\s+)?aaa\s+/i,
+                /^(no\s+)?ip\s+nat\s+/i,
+                /^show\s+vlan/i,
+                /^show\s+access-lists/i
+            ]
+        },
+        {
+            role: 'ACCESS',
+            description: 'Handles physical port assignments, loopbacks, speed/duplex, interface shut/no shut, port descriptions, and interface IPs.',
+            allowedPattern: [
+                /^(no\s+)?interface\s+/i,
+                /^(no\s+)?ip\s+address\s+/i,
+                /^(no\s+)?description\s+/i,
+                /^(no\s+)?shutdown/i,
+                /^(no\s+)?speed\s+/i,
+                /^(no\s+)?duplex\s+/i,
+                /^show\s+ip\s+interface/i,
+                /^show\s+interfaces/i
+            ]
+        }
+    ];
+    static routeCommand(command) {
+        const clean = command.trim();
+        for (const agent of this.agents) {
+            for (const pattern of agent.allowedPattern) {
+                if (pattern.test(clean)) {
+                    return agent.role;
+                }
+            }
+        }
+        return 'ACCESS';
+    }
+    static getHierarchicalAgentPrompt() {
+        return `You are operating as a Hierarchical Network Swarm. Tasks are segregated into three agent layers:
+- CORE AGENT (Core Routing, OSPF, BGP, Static Routes)
+- DISTRIBUTION AGENT (VLANs, ACLs, Security policies, NAT)
+- ACCESS AGENT (User ports, Interfaces, Speed/Duplex, IP Assignment)
+
+Always specify in your thoughts which agent layer is executing the command (e.g. "[AccessAgent] Modifying interface GigabitEthernet0/1").`;
+    }
+}
+exports.HierarchicalAgentManager = HierarchicalAgentManager;
+//# sourceMappingURL=HierarchicalAgentManager.js.map

package/dist/core/agent/HierarchicalAgentManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"HierarchicalAgentManager.js","sourceRoot":"","sources":["../../../src/core/agent/HierarchicalAgentManager.ts"],"names":[],"mappings":";;;AAQA,MAAa,wBAAwB;IACzB,MAAM,CAAC,MAAM,GAAuB;QACxC;YACI,IAAI,EAAE,MAAM;YACZ,WAAW,EAAE,sGAAsG;YACnH,cAAc,EAAE;gBACZ,yBAAyB;gBACzB,yCAAyC;gBACzC,sBAAsB;gBACtB,uBAAuB;gBACvB,qBAAqB;gBACrB,oBAAoB;gBACpB,mBAAmB;aACtB;SACJ;QACD;YACI,IAAI,EAAE,cAAc;YACpB,WAAW,EAAE,oGAAoG;YACjH,cAAc,EAAE;gBACZ,sBAAsB;gBACtB,0BAA0B;gBAC1B,+BAA+B;gBAC/B,gCAAgC;gBAChC,2BAA2B;gBAC3B,kBAAkB;gBAClB,uBAAuB;gBACvB,eAAe;gBACf,uBAAuB;aAC1B;SACJ;QACD;YACI,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,2HAA2H;YACxI,cAAc,EAAE;gBACZ,wBAAwB;gBACxB,2BAA2B;gBAC3B,0BAA0B;gBAC1B,oBAAoB;gBACpB,oBAAoB;gBACpB,qBAAqB;gBACrB,yBAAyB;gBACzB,qBAAqB;aACxB;SACJ;KACJ,CAAC;IAGK,MAAM,CAAC,YAAY,CAAC,OAAe;QACtC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAE7B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAC9B,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;gBACzC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;oBACtB,OAAO,KAAK,CAAC,IAAI,CAAC;gBACtB,CAAC;YACL,CAAC;QACL,CAAC;QAGD,OAAO,QAAQ,CAAC;IACpB,CAAC;IAGM,MAAM,CAAC,0BAA0B;QACpC,OAAO;;;;;0IAK2H,CAAC;IACvI,CAAC;;AAtEL,4DAuEC"}

package/dist/core/agent/MultiAgentCoordinator.d.ts

@@ -1,12 +1,16 @@
 import { BaseSession } from '../../infrastructure/protocols/BaseSession';
-import { SessionState } from '../../shared/types';
+import { NetworkTopology, SessionState } from '../../shared/types';
 export declare class MultiAgentCoordinator {
     private sessions;
+    private topology;
     registerSession(deviceId: string, session: BaseSession): void;
     connectAll(): Promise<void>;
     executeCommand(deviceId: string, command: string): Promise<string>;
     getSessions(): Map<string, BaseSession>;
     getSession(deviceId: string): BaseSession | undefined;
     getAllStates(): Record<string, SessionState>;
+    discoverTopology(): Promise<NetworkTopology>;
+    getTopology(): NetworkTopology;
+    private deduplicateLinks;
     disconnectAll(): Promise<void>;
 }

package/dist/core/agent/MultiAgentCoordinator.js

@@ -1,17 +1,27 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MultiAgentCoordinator = void 0;
+const TopologyDiscovery_1 = require("../topology/TopologyDiscovery");
+const chalk_1 = __importDefault(require("chalk"));
 class MultiAgentCoordinator {
     sessions = new Map();
+    topology = {
+        discoveredAt: new Date(0).toISOString(),
+        nodes: [],
+        links: []
+    };
     registerSession(deviceId, session) {
         this.sessions.set(deviceId, session);
     }
     async connectAll() {
-        console.log(`[MultiAgentCoordinator]: Establishing connections to ${this.sessions.size} devices in parallel...`);
+        console.log(chalk_1.default.cyan(`❯ Establishing parallel connections to ${this.sessions.size} target device(s)...`));
         const promises = Array.from(this.sessions.entries()).map(async ([id, session]) => {
             try {
                 await session.connect();
-                console.log(`[MultiAgentCoordinator]: Device "${id}" connected successfully.`);
+                console.log(chalk_1.default.green(`✔ Device "${id}" connected successfully.`));
             }
             catch (err) {
                 throw new Error(`Device "${id}" failed to connect: ${err.message}`);
@@ -39,15 +49,64 @@ class MultiAgentCoordinator {
         }
         return states;
     }
+    async discoverTopology() {
+        const links = [];
+        const nodeSet = new Set(Array.from(this.sessions.keys()));
+        for (const [deviceId, session] of this.sessions.entries()) {
+            try {
+                const cdpOutput = await session.execute('show cdp neighbors');
+                const parsed = TopologyDiscovery_1.TopologyDiscovery.parseCdpNeighbors(deviceId, cdpOutput);
+                parsed.forEach(link => nodeSet.add(link.remoteDeviceId));
+                links.push(...parsed);
+            }
+            catch {
+                // CDP may be disabled; try LLDP in the same iteration.
+            }
+            try {
+                const lldpOutput = await session.execute('show lldp neighbors');
+                const parsed = TopologyDiscovery_1.TopologyDiscovery.parseLldpNeighbors(deviceId, lldpOutput);
+                parsed.forEach(link => nodeSet.add(link.remoteDeviceId));
+                links.push(...parsed);
+            }
+            catch {
+                // LLDP may be unavailable on some platforms.
+            }
+        }
+        const dedupedLinks = this.deduplicateLinks(links);
+        this.topology = {
+            discoveredAt: new Date().toISOString(),
+            nodes: Array.from(nodeSet),
+            links: dedupedLinks
+        };
+        return this.topology;
+    }
+    getTopology() {
+        return this.topology;
+    }
+    deduplicateLinks(links) {
+        const seen = new Set();
+        const deduped = [];
+        for (const link of links) {
+            const endpointA = `${link.localDeviceId}|${link.localInterface}`;
+            const endpointB = `${link.remoteDeviceId}|${link.remoteInterface}`;
+            const normalized = [endpointA, endpointB].sort().join('<->');
+            if (seen.has(normalized)) {
+                continue;
+            }
+            seen.add(normalized);
+            deduped.push(link);
+        }
+        return deduped;
+    }
     async disconnectAll() {
-        console.log('[MultiAgentCoordinator]: Terminating all device connection channels...');
+        console.log(chalk_1.default.cyan('❯ Terminating all connection channels...'));
         for (const [id, session] of this.sessions.entries()) {
             try {
                 await session.disconnect();
-                console.log(`[MultiAgentCoordinator]: Device "${id}" disconnected cleanly.`);
+                console.log(chalk_1.default.green(`✔ Device "${id}" disconnected cleanly.`));
             }
             catch (err) {
-                console.error(`[MultiAgentCoordinator Warning]: Device "${id}" failed to close cleanly: ${err.message}`);
+                console.warn(chalk_1.default.yellow(`⚠ Device "${id}" failed to close cleanly: ${err.message}`));
             }
         }
         this.sessions.clear();

package/dist/core/agent/MultiAgentCoordinator.js.map

@@ -1 +1 @@
-{"version":3,"file":"MultiAgentCoordinator.js","sourceRoot":"","sources":["../../../src/core/agent/MultiAgentCoordinator.ts"],"names":[],"mappings":";;;AAGA,MAAa,qBAAqB;IACtB,QAAQ,GAA6B,IAAI,GAAG,EAAE,CAAC;IAEhD,eAAe,CAAC,QAAgB,EAAE,OAAoB;QACzD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IAEM,KAAK,CAAC,UAAU;QACnB,OAAO,CAAC,GAAG,CAAC,wDAAwD,IAAI,CAAC,QAAQ,CAAC,IAAI,yBAAyB,CAAC,CAAC;QACjH,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE;YAC7E,IAAI,CAAC;gBACD,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;gBACxB,OAAO,CAAC,GAAG,CAAC,oCAAoC,EAAE,2BAA2B,CAAC,CAAC;YACnF,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,WAAW,EAAE,wBAAwB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACxE,CAAC;QACL,CAAC,CAAC,CAAC;QACH,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAEM,KAAK,CAAC,cAAc,CAAC,QAAgB,EAAE,OAAe;QACzD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,WAAW,QAAQ,kDAAkD,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC;IAEM,WAAW;QACd,OAAO,IAAI,CAAC,QAAQ,CAAC;IACzB,CAAC;IAEM,UAAU,CAAC,QAAgB;QAC9B,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAEM,YAAY;QACf,MAAM,MAAM,GAAiC,EAAE,CAAC;QAChD,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;YAClD,MAAM,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QACpC,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;IAEM,KAAK,CAAC,aAAa;QACtB,OAAO,CAAC,GAAG,CAAC,wEAAwE,CAAC,CAAC;QACtF,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;YAClD,IAAI,CAAC;gBACD,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;gBAC3B,OAAO,CAAC,GAAG,CAAC,oCAAoC,EAAE,yBAAyB,CAAC,CAAC;YACjF,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAChB,OAAO,CAAC,KAAK,CAAC,4CAA4C,EAAE,8BAA8B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7G,CAAC;QACL,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IAC1B,CAAC;CACJ;AAxDD,sDAwDC"}
+{"version":3,"file":"MultiAgentCoordinator.js","sourceRoot":"","sources":["../../../src/core/agent/MultiAgentCoordinator.ts"],"names":[],"mappings":";;;;;;AAEA,qEAAkE;AAClE,kDAA0B;AAE1B,MAAa,qBAAqB;IACtB,QAAQ,GAA6B,IAAI,GAAG,EAAE,CAAC;IAC/C,QAAQ,GAAoB;QAChC,YAAY,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;QACvC,KAAK,EAAE,EAAE;QACT,KAAK,EAAE,EAAE;KACZ,CAAC;IAEK,eAAe,CAAC,QAAgB,EAAE,OAAoB;QACzD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IAEM,KAAK,CAAC,UAAU;QACnB,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,0CAA0C,IAAI,CAAC,QAAQ,CAAC,IAAI,sBAAsB,CAAC,CAAC,CAAC;QAC5G,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE;YAC7E,IAAI,CAAC;gBACD,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;gBACxB,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,aAAa,EAAE,2BAA2B,CAAC,CAAC,CAAC;YACzE,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,WAAW,EAAE,wBAAwB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACxE,CAAC;QACL,CAAC,CAAC,CAAC;QACH,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAEM,KAAK,CAAC,cAAc,CAAC,QAAgB,EAAE,OAAe;QACzD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,WAAW,QAAQ,kDAAkD,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC;IAEM,WAAW;QACd,OAAO,IAAI,CAAC,QAAQ,CAAC;IACzB,CAAC;IAEM,UAAU,CAAC,QAAgB;QAC9B,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAEM,YAAY;QACf,MAAM,MAAM,GAAiC,EAAE,CAAC;QAChD,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;YAClD,MAAM,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QACpC,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;IAEM,KAAK,CAAC,gBAAgB;QACzB,MAAM,KAAK,GAAmB,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAE1D,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;YACxD,IAAI,CAAC;gBACD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;gBAC9D,MAAM,MAAM,GAAG,qCAAiB,CAAC,iBAAiB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;gBACxE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;gBACzD,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACL,uDAAuD;YAC3D,CAAC;YAED,IAAI,CAAC;gBACD,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;gBAChE,MAAM,MAAM,GAAG,qCAAiB,CAAC,kBAAkB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;gBAC1E,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;gBACzD,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACL,6CAA6C;YACjD,CAAC;QACL,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAElD,IAAI,CAAC,QAAQ,GAAG;YACZ,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACtC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;YAC1B,KAAK,EAAE,YAAY;SACtB,CAAC;QAEF,OAAO,IAAI,CAAC,QAAQ,CAAC;IACzB,CAAC;IAEM,WAAW;QACd,OAAO,IAAI,CAAC,QAAQ,CAAC;IACzB,CAAC;IAEO,gBAAgB,CAAC,KAAqB;QAC1C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,MAAM,OAAO,GAAmB,EAAE,CAAC;QAEnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACvB,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACjE,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACnE,MAAM,UAAU,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC7D,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBACvB,SAAS;YACb,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACrB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;QAED,OAAO,OAAO,CAAC;IACnB,CAAC;IAEM,KAAK,CAAC,aAAa;QACtB,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC,CAAC;QACpE,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;YAClD,IAAI,CAAC;gBACD,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;gBAC3B,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,aAAa,EAAE,yBAAyB,CAAC,CAAC,CAAC;YACvE,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAChB,OAAO,CAAC,IAAI,CAAC,eAAK,CAAC,MAAM,CAAC,aAAa,EAAE,8BAA8B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC3F,CAAC;QACL,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IAC1B,CAAC;CACJ;AAtHD,sDAsHC"}

package/dist/core/agent/PromptEngine.d.ts

@@ -1,3 +1,3 @@
 export declare class PromptEngine {
-    static getSystemPrompt(stateInfo: string, commandReferenceHints?: string, strictReferenceMode?: boolean): string;
+    static getSystemPrompt(stateInfo: string, commandReferenceHints?: string, strictReferenceMode?: boolean, topologyInfo?: string): string;
 }

package/dist/core/agent/PromptEngine.js

@@ -2,54 +2,70 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PromptEngine = void 0;
 class PromptEngine {
-    static getSystemPrompt(stateInfo, commandReferenceHints = 'Reference status: not loaded.', strictReferenceMode = false) {
-        return `You are a Senior Network Automation Engineer Agent executing operations on Cisco Enterprise Hardware (Switches & Routers).
-Your objective is to accomplish the user's network configuration and troubleshooting goals safely, using step-by-step tool calls.
-
-=========================================
-CURRENT CONNECTED DEVICES & MODE CONTEXT:
-=========================================
-${stateInfo}
-
-=========================================
-CF COMMAND REFERENCE (cf_command_ref.pdf):
-=========================================
-The following hints were extracted from the official command reference and ranked for the current request. Prefer these exact command forms and syntax whenever relevant.
-Strict reference enforcement: ${strictReferenceMode ? 'ENABLED (unsupported commands will be blocked)' : 'DISABLED (advisory mode)'}
-${commandReferenceHints}
-
-=========================================
-CISCO IOS SHELL (IOS.sh) AUTOMATION GUIDE:
-=========================================
-1. Capabilities: The connected Cisco devices support Cisco IOS Shell. You can utilize:
-   - Variables: E.g., "TARGET_IP=10.0.1.5", and reference them as "$TARGET_IP" in commands.
-   - Loop Constructs: E.g., "for i in 1 2; do ping 10.0.1.$i; done" to check connectivity.
-   - Piping & Output Filtering: E.g., "| include GigabitEthernet" or "| grep ip" to filter CLI outputs.
-   - Functions: E.g., "my_ping() { ping 10.0.1.1; }" to bind commands.
-2. Activation:
-   - Session-wide: Execute "terminal shell" in Privileged EXEC mode (Switch#).
-   - Global Config: Execute "shell processing full" in Global Configuration mode (Switch(config)#).
-   - Use the specialized tool "enable_ios_shell" to activate the shell instead of running raw activation commands.
-
-=========================================
-OPERATIONAL COMPLIANCE RULES:
-=========================================
-1. Navigational Awareness: Verify the current device access level (e.g., USER_EXEC ">", PRIVILEGED_EXEC "#", GLOBAL_CONFIG "(config)#", INTERFACE_CONFIG "(config-if)#"). Change modes appropriately before running commands (e.g., issue "enable", "configure terminal").
-2. Multi-Device Scope: When multiple target devices are connected, you must specify the "device" parameter in all tool calls to designate the destination.
-3. Chaining Constraint: Issue commands step-by-step. Do not combine multiple unrelated configuration actions into a single tool call.
-4. Validation Requirement: Always verify any configuration changes immediately by calling "execute_ios_command" with inspection commands (e.g., "show running-config", "show ip interface brief") or by executing a "ping_test".
-5. Error Diagnostics: If a command fails or returns error markers (e.g., "% Unrecognized command", "% Invalid input"), stop. Do not repeat failed commands. Troubleshooting the cause (such as port state, interface context, or syntax) and correct it.
-6. Language Policy: All reasoning blocks, arguments, tool calls, and output explanations must be written strictly in English.
-
-=========================================
-RESPONSE FORMAT PROTOCOL (CRITICAL):
-=========================================
-- You MUST always populate the "content" field of your response with a detailed, step-by-step Chain-of-Thought (CoT) reasoning block BEFORE proposing any tool calls.
-- You MUST format your thoughts by explicitly structuring them into these three sections:
-  1. CURRENT STATE ANALYSIS: [What is the current device status, context, and access level?]
-  2. TECHNICAL PLAN: [What is the detailed sequential plan, variables, loops, or shell configurations needed to achieve the goal?]
-  3. NEXT ACTION DETAILS: [What specific tool are you calling right now, what arguments/commands are you sending, and why?]
-- NEVER return an empty or whitespace-only "content" string when generating tool calls. The user must see your structured thoughts before execution occurs.
+    static getSystemPrompt(stateInfo, commandReferenceHints = 'Reference status: not loaded.', strictReferenceMode = false, topologyInfo = 'Topology not discovered yet.') {
+        return `You are a Senior Network Automation Engineer Agent executing operations on Cisco Enterprise Hardware (Switches & Routers).
+Your objective is to accomplish the user's network configuration and troubleshooting goals safely, using step-by-step tool calls.
+
+=========================================
+HIERARCHICAL NETWORK SWARM & RBAC:
+=========================================
+You operate as a Hierarchical Network Agent Swarm to focus execution and reduce context overhead:
+1. CORE AGENT: Manages core routing tables, dynamic routing protocols (OSPF, BGP, RIP), static routes, and IP SLAs.
+2. DISTRIBUTION AGENT: Manages VLAN databases, trunking protocols, authentication (AAA), ACL firewalls, and NAT mappings.
+3. ACCESS AGENT: Manages physical port assignments, speed/duplex, interface shut/no shut, port descriptions, and interface IPs.
+Specify which layer is performing the action in your thoughts (e.g., "[CORE AGENT] Configuring static route").
+Your actions are monitored by a Context-Aware Pre-Execution Validator and restricted by your current RBAC Role.
+
+=========================================
+CURRENT CONNECTED DEVICES & MODE CONTEXT:
+=========================================
+${stateInfo}
+
+=========================================
+CF COMMAND REFERENCE (cf_command_ref.pdf):
+=========================================
+The following hints were extracted from the official command reference and ranked for the current request. Prefer these exact command forms and syntax whenever relevant.
+Strict reference enforcement: ${strictReferenceMode ? 'ENABLED (unsupported commands will be blocked)' : 'DISABLED (advisory mode)'}
+${commandReferenceHints}
+
+=========================================
+DISCOVERED NETWORK TOPOLOGY MAP:
+=========================================
+${topologyInfo}
+Interpret the map as network-wide intent context. Prefer plans that keep end-to-end reachability and avoid asymmetric intermediate states.
+
+=========================================
+CISCO IOS SHELL (IOS.sh) AUTOMATION GUIDE:
+=========================================
+1. Capabilities: The connected Cisco devices support Cisco IOS Shell. You can utilize:
+   - Variables: E.g., "TARGET_IP=10.0.1.5", and reference them as "$TARGET_IP" in commands.
+   - Loop Constructs: E.g., "for i in 1 2; do ping 10.0.1.$i; done" to check connectivity.
+   - Piping & Output Filtering: E.g., "| include GigabitEthernet" or "| grep ip" to filter CLI outputs.
+   - Functions: E.g., "my_ping() { ping 10.0.1.1; }" to bind commands.
+2. Activation:
+   - Session-wide: Execute "terminal shell" in Privileged EXEC mode (Switch#).
+   - Global Config: Execute "shell processing full" in Global Configuration mode (Switch(config)#).
+   - Use the specialized tool "enable_ios_shell" to activate the shell instead of running raw activation commands.
+
+=========================================
+OPERATIONAL COMPLIANCE RULES:
+=========================================
+1. Navigational Awareness: Verify the current device access level (e.g., USER_EXEC ">", PRIVILEGED_EXEC "#", GLOBAL_CONFIG "(config)#", INTERFACE_CONFIG "(config-if)#"). Change modes appropriately before running commands (e.g., issue "enable", "configure terminal").
+2. Multi-Device Scope: When multiple target devices are connected, you must specify the "device" parameter in all tool calls to designate the destination.
+3. Chaining Constraint: Issue commands step-by-step. Do not combine multiple unrelated configuration actions into a single tool call.
+4. Validation Discipline: Use at most one inspection pass before a configuration block. Do not repeat show commands unless the device state changed or a command failed. After the configuration block completes, verify once with an inspection command or a ping_test, then stop if the verification is clean.
+5. Error Diagnostics: If a command fails or returns error markers (e.g., "% Unrecognized command", "% Invalid input"), stop. Do not repeat failed commands. Troubleshoot the cause (such as port state, interface context, or syntax) and correct it before retrying.
+6. Language Policy: All reasoning blocks, arguments, tool calls, and output explanations must be written strictly in English.
+
+=========================================
+RESPONSE FORMAT PROTOCOL (CRITICAL):
+=========================================
+- You MUST always populate the "content" field of your response with a detailed, step-by-step Chain-of-Thought (CoT) reasoning block BEFORE proposing any tool calls.
+- You MUST format your thoughts by explicitly structuring them into these three sections:
+  1. CURRENT STATE ANALYSIS: [What is the current device status, context, and access level?]
+  2. TECHNICAL PLAN: [What is the detailed sequential plan, variables, loops, or shell configurations needed to achieve the goal?]
+  3. NEXT ACTION DETAILS: [What specific tool are you calling right now, what arguments/commands are you sending, and why?]
+- NEVER return an empty or whitespace-only "content" string when generating tool calls. The user must see your structured thoughts before execution occurs.
 - When you are done and no additional tool call is required, your final response must be a direct user-facing outcome summary with concrete results and next actions (if any). Do not end with meta statements such as "I should" or "I will".`;
     }
 }

package/dist/core/agent/PromptEngine.js.map

@@ -1 +1 @@
-{"version":3,"file":"PromptEngine.js","sourceRoot":"","sources":["../../../src/core/agent/PromptEngine.ts"],"names":[],"mappings":";;;AAAA,MAAa,YAAY;IACf,MAAM,CAAC,eAAe,CACvB,SAAiB,EACjB,wBAAgC,+BAA+B,EAC/D,sBAA+B,KAAK;QAErC,OAAO;;;;;;EAMb,SAAS;;;;;;gCAMqB,mBAAmB,CAAC,CAAC,CAAC,gDAAgD,CAAC,CAAC,CAAC,0BAA0B;EACjI,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;+OAkCwN,CAAC;IAC5O,CAAC;CACJ;AAvDD,oCAuDC"}
+{"version":3,"file":"PromptEngine.js","sourceRoot":"","sources":["../../../src/core/agent/PromptEngine.ts"],"names":[],"mappings":";;;AAAA,MAAa,YAAY;IACf,MAAM,CAAC,eAAe,CACvB,SAAiB,EACjB,wBAAgC,+BAA+B,EAC/D,sBAA+B,KAAK,EACpC,eAAuB,8BAA8B;QAEtD,OAAO;;;;;;;;;;;;;;;;EAgBb,SAAS;;;;;;gCAMqB,mBAAmB,CAAC,CAAC,CAAC,gDAAgD,CAAC,CAAC,CAAC,0BAA0B;EACjI,qBAAqB;;;;;EAKrB,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;+OAmCiO,CAAC;IAC5O,CAAC;CACJ;AAxED,oCAwEC"}

package/dist/core/guardrails/AuditLogger.d.ts

@@ -0,0 +1,15 @@
+export interface AuditLogEntry {
+    timestamp: string;
+    deviceId: string;
+    role: string;
+    thought?: string;
+    command: string;
+    status: 'SUCCESS' | 'FAILED' | 'BLOCKED' | 'ROLLBACK';
+    outputSnippet?: string;
+    reason?: string;
+}
+export declare class AuditLogger {
+    private static logFile;
+    static setLogFile(filePath: string): void;
+    static log(entry: AuditLogEntry): void;
+}

package/dist/core/guardrails/AuditLogger.js

@@ -0,0 +1,66 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuditLogger = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+class AuditLogger {
+    static logFile = path.resolve(process.cwd(), 'audit.log');
+    static setLogFile(filePath) {
+        this.logFile = path.resolve(process.cwd(), filePath);
+    }
+    static log(entry) {
+        const formattedTimestamp = entry.timestamp || new Date().toISOString();
+        const outputCleaned = entry.outputSnippet
+            ? entry.outputSnippet.replace(/\r?\n/g, ' ').substring(0, 100) + '...'
+            : '';
+        const thoughtCleaned = entry.thought
+            ? entry.thought.replace(/\r?\n/g, ' ').substring(0, 150) + '...'
+            : '';
+        const logMessage = `[${formattedTimestamp}] [Device: ${entry.deviceId}] [Role: ${entry.role.toUpperCase()}] [Status: ${entry.status}]
+  Thought: ${thoughtCleaned || 'N/A'}
+  Command: "${entry.command}"
+  Result:  ${outputCleaned || entry.reason || 'N/A'}
+--------------------------------------------------------------------------------\n`;
+        try {
+            fs.appendFileSync(this.logFile, logMessage, 'utf8');
+        }
+        catch (e) {
+            console.error('[AuditLogger Error]: Failed to write to audit log:', e);
+        }
+    }
+}
+exports.AuditLogger = AuditLogger;
+//# sourceMappingURL=AuditLogger.js.map

package/dist/core/guardrails/AuditLogger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuditLogger.js","sourceRoot":"","sources":["../../../src/core/guardrails/AuditLogger.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,uCAAyB;AACzB,2CAA6B;AAa7B,MAAa,WAAW;IACZ,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,WAAW,CAAC,CAAC;IAE3D,MAAM,CAAC,UAAU,CAAC,QAAgB;QACrC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,CAAC;IACzD,CAAC;IAGM,MAAM,CAAC,GAAG,CAAC,KAAoB;QAClC,MAAM,kBAAkB,GAAG,KAAK,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACvE,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa;YACrC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK;YACtE,CAAC,CAAC,EAAE,CAAC;QACT,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO;YAChC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK;YAChE,CAAC,CAAC,EAAE,CAAC;QAET,MAAM,UAAU,GAAG,IAAI,kBAAkB,cAAc,KAAK,CAAC,QAAQ,YAAY,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,KAAK,CAAC,MAAM;aAC9H,cAAc,IAAI,KAAK;cACtB,KAAK,CAAC,OAAO;aACd,aAAa,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK;mFACgC,CAAC;QAE5E,IAAI,CAAC;YACD,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,OAAO,CAAC,KAAK,CAAC,oDAAoD,EAAE,CAAC,CAAC,CAAC;QAC3E,CAAC;IACL,CAAC;;AA5BL,kCA6BC"}

package/dist/core/guardrails/CommandFirewall.js

@@ -47,6 +47,24 @@ class CommandFirewall {
     }
     checkCommand(command, currentInterfaceContext) {
         const normalized = command.toLowerCase().trim();
+        if (normalized.startsWith('no ip route 0.0.0.0') || normalized.startsWith('no ip route 0.0.0.0 0.0.0.0')) {
+            return {
+                dangerous: true,
+                reason: 'Attempting to remove the default static route (0.0.0.0/0) which may sever SSH/telnet connectivity.'
+            };
+        }
+        if (normalized.startsWith('no aaa new-model') || normalized.startsWith('crypto key zeroize')) {
+            return {
+                dangerous: true,
+                reason: 'Attempting to disable AAA security or zeroize crypto keys, which can lock out admin access.'
+            };
+        }
+        if (normalized.startsWith('no access-list') || normalized.startsWith('no ip access-group')) {
+            return {
+                dangerous: true,
+                reason: 'Attempting to remove or disable an access-list which could expose or lock the management interface.'
+            };
+        }
         const matchedDestructive = constants_1.DESTRUCTIVE_TOKENS.find(token => normalized.startsWith(token) || normalized.includes(` ${token}`));
         if (matchedDestructive) {
             return {
@@ -89,6 +107,12 @@ class CommandFirewall {
             p.startsWith(interfaceName));
     }
     async verifyWithHuman(command, reason) {
+        const isNonInteractive = process.env.CISCOLLM_NON_INTERACTIVE === 'true';
+        if (isNonInteractive) {
+            console.warn('\n' + chalk_1.default.bold.red(`⚠️  [GUARDRAIL BLOCK]: Non-interactive mode active. Automatically rejecting high-risk command: "${command}"`));
+            console.warn(`- Protection Rule Match:      ${chalk_1.default.cyan(reason)}\n`);
+            return false;
+        }
         const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
         return new Promise((resolve) => {
             console.warn('\n' + chalk_1.default.bold.red('⚠️  [GUARDRAIL WARNING]: High-Risk Command Blocked'));

package/dist/core/guardrails/CommandFirewall.js.map

@@ -1 +1 @@
-{"version":3,"file":"CommandFirewall.js","sourceRoot":"","sources":["../../../src/core/guardrails/CommandFirewall.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,mDAAqC;AACrC,kDAA0B;AAC1B,sDAA0F;AAE1F,MAAa,eAAe;IAChB,mBAAmB,CAAW;IAEtC,YAAY,sBAAgC,wCAA4B;QACpE,IAAI,CAAC,mBAAmB,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IACpF,CAAC;IAGM,YAAY,CAAC,OAAe,EAAE,uBAAsC;QACvE,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;QAGhD,MAAM,kBAAkB,GAAG,8BAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CACvD,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC,CACnE,CAAC;QACF,IAAI,kBAAkB,EAAE,CAAC;YACrB,OAAO;gBACH,SAAS,EAAE,IAAI;gBACf,MAAM,EAAE,kCAAkC,kBAAkB,IAAI;aACnE,CAAC;QACN,CAAC;QAGD,MAAM,cAAc,GAAG,oCAAoC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACjF,IAAI,cAAc,EAAE,CAAC;YACjB,MAAM,iBAAiB,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;YAEjE,IAAI,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBACzE,OAAO;oBACH,SAAS,EAAE,IAAI;oBACf,MAAM,EAAE,0DAA0D,cAAc,CAAC,CAAC,CAAC,EAAE;iBACxF,CAAC;YACN,CAAC;QACL,CAAC;QAGD,IAAI,uBAAuB,EAAE,CAAC;YAC1B,MAAM,UAAU,GAAG,uBAAuB,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;YAChE,IAAI,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/B,IAAI,UAAU,KAAK,UAAU,EAAE,CAAC;oBAC5B,OAAO;wBACH,SAAS,EAAE,IAAI;wBACf,MAAM,EAAE,0DAA0D,uBAAuB,EAAE;qBAC9F,CAAC;gBACN,CAAC;gBACD,IAAI,UAAU,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC/E,OAAO;wBACH,SAAS,EAAE,IAAI;wBACf,MAAM,EAAE,oEAAoE,uBAAuB,EAAE;qBACxG,CAAC;gBACN,CAAC;YACL,CAAC;QACL,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAChC,CAAC;IAEO,WAAW,CAAC,aAAqB;QAErC,OAAO,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CACrC,CAAC,KAAK,aAAa;YACnB,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC;YAC3B,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAC9B,CAAC;IACN,CAAC;IAGM,KAAK,CAAC,eAAe,CAAC,OAAe,EAAE,MAAc;QACxD,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAEtF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC3B,OAAO,CAAC,IAAI,CAAC,IAAI,GAAG,eAAK,CAAC,IAAI,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC,CAAC;YAC1F,OAAO,CAAC,IAAI,CAAC,eAAK,CAAC,IAAI,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC,CAAC;YAC7F,OAAO,CAAC,IAAI,CAAC,iCAAiC,eAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC;YACnF,OAAO,CAAC,IAAI,CAAC,iCAAiC,eAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACpE,OAAO,CAAC,IAAI,CAAC,eAAK,CAAC,IAAI,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC,CAAC;YAE7F,EAAE,CAAC,QAAQ,CAAC,eAAK,CAAC,IAAI,CAAC,KAAK,CAAC,iEAAiE,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE;gBACxG,EAAE,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAChB,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,CAAC;YAC1C,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;IACP,CAAC;CACJ;AApFD,0CAoFC"}
+{"version":3,"file":"CommandFirewall.js","sourceRoot":"","sources":["../../../src/core/guardrails/CommandFirewall.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,mDAAqC;AACrC,kDAA0B;AAC1B,sDAA0F;AAE1F,MAAa,eAAe;IAChB,mBAAmB,CAAW;IAEtC,YAAY,sBAAgC,wCAA4B;QACpE,IAAI,CAAC,mBAAmB,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IACpF,CAAC;IAGM,YAAY,CAAC,OAAe,EAAE,uBAAsC;QACvE,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;QAGhD,IAAI,UAAU,CAAC,UAAU,CAAC,qBAAqB,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,6BAA6B,CAAC,EAAE,CAAC;YACvG,OAAO;gBACH,SAAS,EAAE,IAAI;gBACf,MAAM,EAAE,oGAAoG;aAC/G,CAAC;QACN,CAAC;QAGD,IAAI,UAAU,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC3F,OAAO;gBACH,SAAS,EAAE,IAAI;gBACf,MAAM,EAAE,6FAA6F;aACxG,CAAC;QACN,CAAC;QAGD,IAAI,UAAU,CAAC,UAAU,CAAC,gBAAgB,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;YACzF,OAAO;gBACH,SAAS,EAAE,IAAI;gBACf,MAAM,EAAE,qGAAqG;aAChH,CAAC;QACN,CAAC;QAED,MAAM,kBAAkB,GAAG,8BAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CACvD,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC,CACnE,CAAC;QACF,IAAI,kBAAkB,EAAE,CAAC;YACrB,OAAO;gBACH,SAAS,EAAE,IAAI;gBACf,MAAM,EAAE,kCAAkC,kBAAkB,IAAI;aACnE,CAAC;QACN,CAAC;QAED,MAAM,cAAc,GAAG,oCAAoC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACjF,IAAI,cAAc,EAAE,CAAC;YACjB,MAAM,iBAAiB,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;YAEjE,IAAI,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBACzE,OAAO;oBACH,SAAS,EAAE,IAAI;oBACf,MAAM,EAAE,0DAA0D,cAAc,CAAC,CAAC,CAAC,EAAE;iBACxF,CAAC;YACN,CAAC;QACL,CAAC;QAED,IAAI,uBAAuB,EAAE,CAAC;YAC1B,MAAM,UAAU,GAAG,uBAAuB,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;YAChE,IAAI,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/B,IAAI,UAAU,KAAK,UAAU,EAAE,CAAC;oBAC5B,OAAO;wBACH,SAAS,EAAE,IAAI;wBACf,MAAM,EAAE,0DAA0D,uBAAuB,EAAE;qBAC9F,CAAC;gBACN,CAAC;gBACD,IAAI,UAAU,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC/E,OAAO;wBACH,SAAS,EAAE,IAAI;wBACf,MAAM,EAAE,oEAAoE,uBAAuB,EAAE;qBACxG,CAAC;gBACN,CAAC;YACL,CAAC;QACL,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAChC,CAAC;IAEO,WAAW,CAAC,aAAqB;QACrC,OAAO,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CACrC,CAAC,KAAK,aAAa;YACnB,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC;YAC3B,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAC9B,CAAC;IACN,CAAC;IAEM,KAAK,CAAC,eAAe,CAAC,OAAe,EAAE,MAAc;QACxD,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,MAAM,CAAC;QACzE,IAAI,gBAAgB,EAAE,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,IAAI,GAAG,eAAK,CAAC,IAAI,CAAC,GAAG,CAAC,mGAAmG,OAAO,GAAG,CAAC,CAAC,CAAC;YACnJ,OAAO,CAAC,IAAI,CAAC,iCAAiC,eAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACtE,OAAO,KAAK,CAAC;QACjB,CAAC;QAED,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAEtF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC3B,OAAO,CAAC,IAAI,CAAC,IAAI,GAAG,eAAK,CAAC,IAAI,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC,CAAC;YAC1F,OAAO,CAAC,IAAI,CAAC,eAAK,CAAC,IAAI,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC,CAAC;YAC7F,OAAO,CAAC,IAAI,CAAC,iCAAiC,eAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC;YACnF,OAAO,CAAC,IAAI,CAAC,iCAAiC,eAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACpE,OAAO,CAAC,IAAI,CAAC,eAAK,CAAC,IAAI,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC,CAAC;YAE7F,EAAE,CAAC,QAAQ,CAAC,eAAK,CAAC,IAAI,CAAC,KAAK,CAAC,iEAAiE,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE;gBACxG,EAAE,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAChB,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,CAAC;YAC1C,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;IACP,CAAC;CACJ;AA9GD,0CA8GC"}

package/dist/core/guardrails/PreExecutionValidator.d.ts

@@ -0,0 +1,9 @@
+import { NetworkTopology } from '../../shared/types';
+export interface ValidationResult {
+    safe: boolean;
+    warnLevel: 'INFO' | 'WARNING' | 'CRITICAL';
+    reason?: string;
+}
+export declare class PreExecutionValidator {
+    static validateCommand(command: string, deviceId: string, topology: NetworkTopology, currentInterfaceContext: string | null): ValidationResult;
+}

package/dist/core/guardrails/PreExecutionValidator.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PreExecutionValidator = void 0;
+class PreExecutionValidator {
+    static validateCommand(command, deviceId, topology, currentInterfaceContext) {
+        const normalized = command.toLowerCase().trim();
+        if (normalized.startsWith('no ip route 0.0.0.0') || normalized.startsWith('no ip route 0.0.0.0 0.0.0.0')) {
+            return {
+                safe: false,
+                warnLevel: 'CRITICAL',
+                reason: `Command attempts to remove the default gateway route. This will disconnect remote SSH/Telnet sessions.`
+            };
+        }
+        if (normalized.startsWith('router ospf') || normalized.startsWith('router bgp') || normalized.startsWith('router rip')) {
+            return {
+                safe: true,
+                warnLevel: 'WARNING',
+                reason: `Entering dynamic routing configuration mode. Incorrect network declarations can disrupt routing convergence across the backbone.`
+            };
+        }
+        const interfaceMatch = /^interface\s+([A-Za-z0-9\/\.\-]+)/i.exec(command.trim());
+        let targetedInterface = interfaceMatch ? interfaceMatch[1].toLowerCase().trim() : null;
+        if (currentInterfaceContext && !targetedInterface) {
+            targetedInterface = currentInterfaceContext.toLowerCase().trim();
+        }
+        if (targetedInterface && normalized.includes('shutdown')) {
+            const connectedLink = topology.links.find(link => (link.localDeviceId.toLowerCase() === deviceId.toLowerCase() && link.localInterface.toLowerCase() === targetedInterface) ||
+                (link.remoteDeviceId.toLowerCase() === deviceId.toLowerCase() && link.remoteInterface.toLowerCase() === targetedInterface));
+            if (connectedLink) {
+                const neighborId = connectedLink.localDeviceId.toLowerCase() === deviceId.toLowerCase()
+                    ? connectedLink.remoteDeviceId
+                    : connectedLink.localDeviceId;
+                return {
+                    safe: false,
+                    warnLevel: 'CRITICAL',
+                    reason: `Interface "${targetedInterface}" is actively connected to neighbor device "${neighborId}" via ${connectedLink.protocol.toUpperCase()}. Shutting it down will break network topology adjacency.`
+                };
+            }
+        }
+        if (targetedInterface && (normalized.startsWith('no ip address') || normalized.startsWith('ip address'))) {
+            const connectedLink = topology.links.find(link => (link.localDeviceId.toLowerCase() === deviceId.toLowerCase() && link.localInterface.toLowerCase() === targetedInterface) ||
+                (link.remoteDeviceId.toLowerCase() === deviceId.toLowerCase() && link.remoteInterface.toLowerCase() === targetedInterface));
+            if (connectedLink && normalized.startsWith('no ip address')) {
+                return {
+                    safe: false,
+                    warnLevel: 'CRITICAL',
+                    reason: `Removing IP address from "${targetedInterface}", which is an active network uplink to neighbor "${connectedLink.localDeviceId === deviceId ? connectedLink.remoteDeviceId : connectedLink.localDeviceId}".`
+                };
+            }
+        }
+        return {
+            safe: true,
+            warnLevel: 'INFO'
+        };
+    }
+}
+exports.PreExecutionValidator = PreExecutionValidator;
+//# sourceMappingURL=PreExecutionValidator.js.map

package/dist/core/guardrails/PreExecutionValidator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PreExecutionValidator.js","sourceRoot":"","sources":["../../../src/core/guardrails/PreExecutionValidator.ts"],"names":[],"mappings":";;;AAQA,MAAa,qBAAqB;IAEvB,MAAM,CAAC,eAAe,CACzB,OAAe,EACf,QAAgB,EAChB,QAAyB,EACzB,uBAAsC;QAEtC,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;QAGhD,IAAI,UAAU,CAAC,UAAU,CAAC,qBAAqB,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,6BAA6B,CAAC,EAAE,CAAC;YACvG,OAAO;gBACH,IAAI,EAAE,KAAK;gBACX,SAAS,EAAE,UAAU;gBACrB,MAAM,EAAE,wGAAwG;aACnH,CAAC;QACN,CAAC;QAGD,IAAI,UAAU,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YACrH,OAAO;gBACH,IAAI,EAAE,IAAI;gBACV,SAAS,EAAE,SAAS;gBACpB,MAAM,EAAE,kIAAkI;aAC7I,CAAC;QACN,CAAC;QAED,MAAM,cAAc,GAAG,oCAAoC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACjF,IAAI,iBAAiB,GAAG,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAEvF,IAAI,uBAAuB,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAChD,iBAAiB,GAAG,uBAAuB,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;QACrE,CAAC;QAED,IAAI,iBAAiB,IAAI,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAEvD,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC7C,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,KAAK,iBAAiB,CAAC;gBACxH,CAAC,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,KAAK,iBAAiB,CAAC,CAC7H,CAAC;YAEF,IAAI,aAAa,EAAE,CAAC;gBAChB,MAAM,UAAU,GAAG,aAAa,CAAC,aAAa,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE;oBACnF,CAAC,CAAC,aAAa,CAAC,cAAc;oBAC9B,CAAC,CAAC,aAAa,CAAC,aAAa,CAAC;gBAElC,OAAO;oBACH,IAAI,EAAE,KAAK;oBACX,SAAS,EAAE,UAAU;oBACrB,MAAM,EAAE,cAAc,iBAAiB,+CAA+C,UAAU,SAAS,aAAa,CAAC,QAAQ,CAAC,WAAW,EAAE,2DAA2D;iBAC3M,CAAC;YACN,CAAC;QACL,CAAC;QAGD,IAAI,iBAAiB,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;YACvG,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC7C,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,KAAK,iBAAiB,CAAC;gBACxH,CAAC,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,KAAK,iBAAiB,CAAC,CAC7H,CAAC;YAEF,IAAI,aAAa,IAAI,UAAU,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBAC1D,OAAO;oBACH,IAAI,EAAE,KAAK;oBACX,SAAS,EAAE,UAAU;oBACrB,MAAM,EAAE,6BAA6B,iBAAiB,qDAAqD,aAAa,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC,aAAa,IAAI;iBACvN,CAAC;YACN,CAAC;QACL,CAAC;QAED,OAAO;YACH,IAAI,EAAE,IAAI;YACV,SAAS,EAAE,MAAM;SACpB,CAAC;IACN,CAAC;CACJ;AA5ED,sDA4EC"}

package/dist/core/rollback/StateDiff.d.ts

@@ -0,0 +1,47 @@
+import { SessionState } from '../../shared/types';
+export interface InterfaceStateSnapshot {
+    name: string;
+    ip: string | null;
+    subnet: string | null;
+    adminShutdown: boolean;
+    lineProtocolUp: boolean;
+    description: string | null;
+}
+export interface RoutingStateSnapshot {
+    network: string;
+    mask: string;
+    nextHop: string | null;
+}
+export interface DeviceStateSnapshot {
+    deviceId: string;
+    timestamp: string;
+    sessionState: SessionState;
+    interfaces: InterfaceStateSnapshot[];
+    routes: RoutingStateSnapshot[];
+    vlans: number[];
+}
+export interface StateDiffResult {
+    modifiedInterfaces: Array<{
+        name: string;
+        changes: Array<{
+            field: string;
+            before: any;
+            after: any;
+        }>;
+    }>;
+    addedRoutes: RoutingStateSnapshot[];
+    removedRoutes: RoutingStateSnapshot[];
+    addedVlans: number[];
+    removedVlans: number[];
+    hostnameChanged: {
+        before: string;
+        after: string;
+    } | null;
+}
+export declare class StateDiff {
+    static diff(before: DeviceStateSnapshot, after: DeviceStateSnapshot): StateDiffResult;
+    /**
+     * Helper to render the diff output as a readable table/string.
+     */
+    static renderDiff(diff: StateDiffResult): string;
+}