dsh-ensp 0.4.0 → 0.5.0

package/README.en.md

@@ -128,6 +128,17 @@ npm run docs          # regenerate docs/SCENARIOS.md
 npm run docs:check    # check whether it is stale
 ```
 
+### Knowledge points
+
+A scenario gives direction, not commands, so the vocabulary of the lab has to come from somewhere. `src/core/knowledge.json` holds knowledge points filed by topic: each scenario ends with a few question-and-answer pairs on the same subject, covering things like which LSA belongs to which area, which attribute decides a BGP path, and which port role only MSTP has.
+
+```bash
+ensp preset ospf-lsa-types          # the detail ends with a knowledge section
+ensp preset --knowledge LSA         # search the index by keyword
+```
+
+The points come from a certification question bank, re-filed by topic. The bank's own tags are unreliable, so a question about OSPF LSA types can also carry a security tag; each question is scored against topic keywords and kept only under the best match. Questions phrased as "which of the following is wrong" are dropped, because once the distractors are stripped what remains is a false statement. The bank itself is not shipped: `knowledge.json` keeps only the stem and the correct option text.
+
 ### Device image check
 
 Some models have a catalogue entry without a shipped image, most notably `USG6000V` (its component has to be selected during eNSP installation). Such models can be placed on the canvas and saved to a `.topo`, but eNSP renders the topology and then quits, which shows up as consoles that never answer.
@@ -254,7 +265,7 @@ ensp status
 }
 ```
 
-14 tools are provided: `ensp_status`, `ensp_build_topology`, `ensp_open`, `ensp_start`, `ensp_stop`, `ensp_apply`, `ensp_apply_dir`, `ensp_query`, `ensp_probe`, `ensp_doctor`, `ensp_verify`, `ensp_scenarios`, `ensp_scenario` and `ensp_preset_config`.
+15 tools are provided: `ensp_status`, `ensp_build_topology`, `ensp_open`, `ensp_start`, `ensp_stop`, `ensp_apply`, `ensp_apply_dir`, `ensp_query`, `ensp_probe`, `ensp_doctor`, `ensp_verify`, `ensp_scenarios`, `ensp_scenario`, `ensp_knowledge` and `ensp_preset_config`.
 
 ## Requirements
 

package/README.md

@@ -123,6 +123,17 @@ ensp up ospf-single.topo
 
 场景清单与蓝图均可生成、可校验。`docs/SCENARIOS.md` 由 `src/core/presets.mjs` 与 `src/core/labs.mjs` 渲染，`npm run docs:check` 在两者不一致时返回非零，CI 亦执行该检查。
 
+### 知识点
+
+场景说明只给方向，命令由使用者补全，因此需要知道该场景涉及的术语。`src/core/knowledge.json` 收录按主题归类的知识点：每个场景在末尾附上同主题的若干「问题 + 答案」，涵盖 LSA 类型归属、BGP 选路属性、MSTP 端口角色等。
+
+```bash
+ensp preset ospf-lsa-types          # 详情末尾带知识点小节
+ensp preset --knowledge LSA         # 按关键词检索知识点
+```
+
+知识点来自认证题库，按主题重新归类：题目的原始标签并不可靠，同一道 OSPF 题可能同时被标为安全，因此按正文关键词评分后只归入最匹配的主题，并剔除「以下错误的是」这类去掉干扰项后只剩错误陈述的题目。题库原文不随包分发，`knowledge.json` 只保留题干与正确选项文本。
+
 ```bash
 npm run docs          # 重新生成 docs/SCENARIOS.md
 npm run docs:check    # 只检查是否过期
@@ -254,7 +265,7 @@ ensp status
 }
 ```
 
-提供 14 个工具：`ensp_status`、`ensp_build_topology`、`ensp_open`、`ensp_start`、`ensp_stop`、`ensp_apply`、`ensp_apply_dir`、`ensp_query`、`ensp_probe`、`ensp_doctor`、`ensp_verify`、`ensp_scenarios`、`ensp_scenario`、`ensp_preset_config`。
+提供 15 个工具：`ensp_status`、`ensp_build_topology`、`ensp_open`、`ensp_start`、`ensp_stop`、`ensp_apply`、`ensp_apply_dir`、`ensp_query`、`ensp_probe`、`ensp_doctor`、`ensp_verify`、`ensp_scenarios`、`ensp_scenario`、`ensp_knowledge`、`ensp_preset_config`。
 
 ## 环境要求
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-ensp",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Automate Huawei eNSP labs: generate .topo files, start and stop devices, and push configuration one command at a time with per-command error reporting.",
   "keywords": [
     "dsh",
@@ -47,7 +47,8 @@
     "test": "node --test tests/core.test.mjs",
     "probe": "node src/cli/ensp.mjs probe",
     "docs": "node scripts/gen-scenarios-doc.mjs",
-    "docs:check": "node scripts/gen-scenarios-doc.mjs --check"
+    "docs:check": "node scripts/gen-scenarios-doc.mjs --check",
+    "knowledge": "node scripts/gen-knowledge.mjs"
   },
   "engines": {
     "node": ">=18"

package/scripts/gen-knowledge.mjs

@@ -0,0 +1,161 @@
+/**
+ * Regenerate `src/core/knowledge.json` from a certification question bank.
+ *
+ * The bank is not part of this package: it is copyrighted material, and most of
+ * its questions are three-sentence reading exercises rather than facts. What the
+ * package does ship is the index this script produces, so the transformation has
+ * to be reproducible and reviewable by anyone who has the bank.
+ *
+ * Usage:
+ *   node scripts/gen-knowledge.mjs <bank.json>
+ *
+ * The bank is expected as an array of
+ * `{ n, type, stem, options: [{key, text}], answer, analysis, topics }`.
+ *
+ * Two rules shape the output, and both exist because the obvious version of this
+ * script produced a worse index:
+ *
+ * 1. **One topic per question.** The bank's own tags are unreliable: a question
+ *    about OSPF LSA types carries `ospf` and `security` both, and honouring every
+ *    tag files the same fact under two headings. Score the text against topic
+ *    keywords and keep the best match.
+ * 2. **Drop "which is wrong" questions.** Once the distractors are removed, the
+ *    surviving string is a false statement, which is worse than no material.
+ */
+
+import { readFileSync, writeFileSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
+import path from 'node:path'
+
+/** Topic tag -> the scenarios that teach it. */
+const TOPIC_SCENARIOS = {
+  ospf: ['ospf-single', 'ospf-multi-area', 'ospf-stub-nssa', 'ospf-lsa-types', 'ospf-virtual-link', 'ospf-troubleshooting'],
+  bgp: ['bgp-ebgp-ibgp', 'bgp-route-reflector', 'bgp-attributes', 'bgp-aggregation', 'bgp-troubleshooting'],
+  isis: ['isis-multi-level'],
+  switching: [
+    'vlan-access',
+    'trunk-interconnect',
+    'stp-rstp',
+    'mstp-load-balance',
+    'link-aggregation',
+    'super-vlan',
+    'port-security',
+    'port-isolation',
+    'stack-istack',
+  ],
+  multicast: ['multicast-pim-sm'],
+  mpls: ['mpls-basic', 'mpls-l3vpn'],
+  ipv6: ['ipv6', 'ospfv3-ipv6'],
+  qos: ['qos-basics'],
+  reliability: ['vrrp-basics', 'bfd-fast-convergence', 'firewall-hrp', 'dual-homed-isp'],
+  security: ['acl-filter', 'aaa-local', 'ipsec-vpn', 'firewall-zones', 'firewall-hrp', 'arp-security', 'dhcp-snooping'],
+}
+
+/** Keywords that decide which topic a question belongs to. */
+const TOPIC_TERMS = {
+  ospf: ['ospf', 'lsa', 'abr', 'asbr', 'nssa', 'stub', 'router-id'],
+  bgp: ['bgp', 'as-path', 'ibgp', 'ebgp', 'community', 'aggregator', 'med', 'local-preference'],
+  isis: ['is-is', 'isis', 'level-1', 'level-2', 'dis', 'lsp', 'att'],
+  switching: ['vlan', 'mstp', 'rstp', 'stp', 'eth-trunk', '端口隔离', '端口安全', '堆叠', '根桥', 'bpdu'],
+  multicast: ['pim', 'igmp', '组播', 'rpf', 'spt'],
+  mpls: ['mpls', 'ldp', 'lsr', '标签', 'vpn-instance'],
+  ipv6: ['ipv6', 'ospfv3', 'slaac'],
+  qos: ['qos', '队列', '拥塞', '流量监管', '优先级映射'],
+  reliability: ['vrrp', 'bfd', 'hrp', '双机热备', '主备'],
+  security: ['acl', '安全区域', 'security-policy', 'ipsec', 'ike', 'aaa', 'radius', '防火墙', 'nat'],
+}
+
+/** A question phrased this way keeps only a false statement once stripped. */
+const NEGATIVE = /错误的是|不正确的是|不属于|不支持|不能|无需/
+
+/** Points kept per topic. Enough to cover the vocabulary, short enough to read. */
+const MAX_POINTS = 8
+
+/** A question must score at least this many keyword hits to be filed at all. */
+const MIN_SCORE = 2
+
+const clean = (s) => String(s ?? '').replace(/\s+/g, ' ').trim()
+const clip = (s, n) => (s.length <= n ? s : s.slice(0, n - 1).replace(/[，,、；;：: .]*$/, '') + '…')
+
+/**
+ * The answer as readable text.
+ *
+ * A bare key list (`A,C`) teaches nothing, so every chosen option is spelled out.
+ * Returns '' when the answer is not machine-readable, which is the case for the
+ * drag-and-drop and fill-in-the-blank questions.
+ */
+function answerText(q) {
+  const keys = clean(q.answer).toUpperCase().match(/[A-Z]/g)
+  if (!keys || !q.options?.length) return q.type === '判断题' ? clean(q.answer) : ''
+  const picked = q.options.filter((o) => keys.includes(String(o.key).toUpperCase()))
+  if (!picked.length) return ''
+  return picked.map((o) => `${o.key}. ${clip(clean(o.text), 70)}`).join(' / ')
+}
+
+/**
+ * Build the index.
+ *
+ * @param {Array<object>} bank
+ * @returns {object}
+ */
+export function buildIndex(bank) {
+  const perTopic = {}
+  for (const q of bank) {
+    const answer = answerText(q)
+    if (!answer) continue
+    const stem = clean(q.stem)
+    if (NEGATIVE.test(stem)) continue
+    const hay = (stem + ' ' + clean(q.analysis)).toLowerCase()
+    let best = null
+    let bestScore = 0
+    for (const [topic, terms] of Object.entries(TOPIC_TERMS)) {
+      const score = terms.reduce((sum, t) => sum + (hay.split(t).length - 1), 0)
+      if (score > bestScore) {
+        bestScore = score
+        best = topic
+      }
+    }
+    if (!best || bestScore < MIN_SCORE) continue
+    ;(perTopic[best] ||= []).push({ n: q.n, q: clip(stem, 90), a: answer, score: bestScore })
+  }
+
+  const topics = {}
+  for (const [topic, rows] of Object.entries(perTopic)) {
+    // Highest keyword score first, then the shortest stem: a one-line question
+    // states a fact, while a long one describes a scene.
+    const ranked = rows.slice().sort((a, b) => b.score - a.score || a.q.length - b.q.length)
+    const seen = new Set()
+    const points = []
+    for (const r of ranked) {
+      const key = r.q.slice(0, 40) + '|' + r.a.slice(0, 30)
+      if (seen.has(key)) continue
+      seen.add(key)
+      points.push({ n: r.n, q: r.q, a: r.a })
+      if (points.length >= MAX_POINTS) break
+    }
+    topics[topic] = { scenarios: TOPIC_SCENARIOS[topic], points }
+  }
+
+  return {
+    generatedFrom: 'HCIP H12-821 单选/多选/判断题',
+    sourceQuestions: bank.length,
+    topics,
+  }
+}
+
+const invokedDirectly =
+  process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)
+
+if (invokedDirectly) {
+  const bankPath = process.argv[2]
+  if (!bankPath) {
+    console.error('usage: node scripts/gen-knowledge.mjs <bank.json>')
+    process.exit(2)
+  }
+  const bank = JSON.parse(readFileSync(bankPath, 'utf8'))
+  const index = buildIndex(bank)
+  const target = path.join(path.dirname(fileURLToPath(import.meta.url)), '..', 'src', 'core', 'knowledge.json')
+  writeFileSync(target, JSON.stringify(index, null, 1) + '\n', 'utf8')
+  const total = Object.values(index.topics).reduce((sum, t) => sum + t.points.length, 0)
+  console.log(`wrote src/core/knowledge.json (${total} points from ${bank.length} questions)`)
+}

package/src/cli/ensp.mjs

@@ -35,6 +35,7 @@ import { doctor, formatDoctor, modelsOf } from '../core/doctor.mjs'
 import { runAcceptance, formatAcceptance, hasChecks, planFor } from '../core/acceptance.mjs'
 import { pushConfig } from '../core/provision.mjs'
 import { SCENARIOS, SCENARIO_IDS, byLevel, renderScenario, searchScenarios } from '../core/presets.mjs'
+import { knowledgeFor, renderKnowledge, searchKnowledge } from '../core/knowledge.mjs'
 import {
   LAB_IDS,
   buildScenarioTopology,
@@ -320,6 +321,23 @@ async function cmdStatus({ flags }) {
 async function cmdPreset({ positional, flags }) {
   const id = positional[0]
 
+  if (flags.knowledge) {
+    const hits = searchKnowledge(String(flags.knowledge))
+    if (flags.json) {
+      console.log(JSON.stringify(hits, null, 2))
+      return hits.length ? 0 : 1
+    }
+    if (!hits.length) {
+      console.log(C.yellow('no knowledge point matched') + ` "${flags.knowledge}"`)
+      return 1
+    }
+    for (const h of hits) {
+      console.log(`${C.bold('#' + h.n)} ${C.dim('[' + h.topic + ']')} ${h.q}`)
+      console.log(`   答: ${h.a}`)
+    }
+    return 0
+  }
+
   if (flags.search) {
     const hits = searchScenarios(String(flags.search))
     if (flags.json) {
@@ -392,7 +410,10 @@ async function cmdPreset({ positional, flags }) {
     }
 
     const text = renderScenario(id)
-    console.log(flags.json ? JSON.stringify(SCENARIOS[id], null, 2) : text)
+    const points = knowledgeFor(id)
+    console.log(flags.json ? JSON.stringify({ ...SCENARIOS[id], knowledge: points }, null, 2) : text)
+    const knowledge = renderKnowledge(id)
+    if (knowledge) console.log(knowledge)
     if (hasLab(id)) {
       console.log(C.dim(`\n可生成拓扑: ensp preset ${id} --topo ${id}.topo`))
     }

package/src/core/console.mjs

@@ -166,6 +166,7 @@ export class ConsoleSession {
   #prompt = null
   #hostname = null
   #closed = false
+  #closeReason = null
   #waiters = new Set()
 
   /**
@@ -182,10 +183,12 @@ export class ConsoleSession {
     })
     socket.on('close', () => {
       this.#closed = true
+      this.#closeReason ??= 'the console connection was closed by the device'
       for (const waiter of this.#waiters) waiter()
     })
-    socket.on('error', () => {
+    socket.on('error', (err) => {
       this.#closed = true
+      this.#closeReason ??= `console error: ${err?.message ?? err}`
       for (const waiter of this.#waiters) waiter()
     })
   }
@@ -218,6 +221,11 @@ export class ConsoleSession {
     return this.#closed
   }
 
+  /** @returns {string|null} why the console closed, when it closed unexpectedly. */
+  get closeReason() {
+    return this.#closeReason
+  }
+
   /**
    * Wait until `predicate()` is true, a new chunk arrives, or the timeout fires.
    * @param {() => boolean} predicate
@@ -350,6 +358,20 @@ export class ConsoleSession {
     // the previous line so the caller sees what paging disabled would have shown.
     if (pages > 0) output = stitchPages(output)
 
+    // A console that closed mid-command produced no output, and no output looks
+    // exactly like a command that succeeded and printed nothing. Report the
+    // closed socket instead of handing the caller a silent empty success.
+    if (this.#closed) {
+      return {
+        command,
+        ok: false,
+        error: this.#closeReason || 'the console connection closed before the reply arrived',
+        prompt: this.#prompt,
+        view: this.view,
+        output,
+      }
+    }
+
     const errorMatch = output.match(ERROR_RE)
     const prompt = this.#prompt
     return {

package/src/core/index.mjs

@@ -123,6 +123,13 @@ export {
   searchScenarios,
 } from './presets.mjs'
 
+export {
+  knowledgeTopics,
+  knowledgeFor,
+  searchKnowledge,
+  renderKnowledge,
+} from './knowledge.mjs'
+
 export {
   resolveEnspExe,
   resolveVBoxManage,

package/src/core/knowledge.json

@@ -0,0 +1,412 @@
+{
+ "generatedFrom": "HCIP H12-821 单选/多选/判断题",
+ "sourceQuestions": 486,
+ "topics": {
+  "bgp": {
+   "scenarios": [
+    "bgp-ebgp-ibgp",
+    "bgp-route-reflector",
+    "bgp-attributes",
+    "bgp-aggregation",
+    "bgp-troubleshooting"
+   ],
+   "points": [
+    {
+     "n": 313,
+     "q": "在BGP中非客户机角色既不是RR也不是客户机的IBGP设备，在AS内部非客户机与RR之间，以及所有的非客户机之间必须建立全连接关系",
+     "a": "A. 正确"
+    },
+    {
+     "n": 163,
+     "q": "在BGP中MED属性是一种度量值，用于向外部对等体指出进入本AS的首选路径。以下关于该属性的描述，正确的是哪些项?",
+     "a": "A. MED属性值越小则BGP路由越优 / C. 在IBGP对等体之间传递路由时，MED值会被保留并传递，除非部署了策略，否则MED值在传递过程中不发生改变也不会丢失 / D. MED被传递给EBGP对等体后，对等体在其AS内传递路由时，携带该MED值"
+    },
+    {
+     "n": 262,
+     "q": "在配置EBGP时，缺省情况下EBGP连接允许的最大跳数为1，即只能在物理直连链路上建立EBGP连接。",
+     "a": "A. 正确"
+    },
+    {
+     "n": 380,
+     "q": "BGP设备与对等体建立邻居关系后，会通告路由给邻居。以下关于BGP通告路由的描述，正确的是哪些项?",
+     "a": "A. 当存在多条到达同一目的地址的有效路由时，BGP设备只将最优路由发布给对等体 / C. 从EBGP对等体获取的路由，会发布给所有对等体 / D. 从IBGP对等体获取的路由，不会发送给IBGP对等体"
+    },
+    {
+     "n": 340,
+     "q": "在BGP中MED属性仅在相邻两个AS之间传递，收到此属性的AS一方不会再将其通告给任何其他第三方AS，同时，缺省情况下路由器只比较来自同一相邻AS的BGP路由的MED值，也就说如…",
+     "a": "A. 正确"
+    },
+    {
+     "n": 224,
+     "q": "如图所示，R1通告BGP路由给EBGP对等体，以下关于该过程的描述，正确的是哪些项?",
+     "a": "A. R2收到该路由传递给R3时，会保持路由的Next_Hop属性值不变 / B. 该路由中包含了这条路由的Origin属性 / C. R1只发送增量更新路由"
+    },
+    {
+     "n": 176,
+     "q": "在BGP网络中，建立EBGP邻居关系时，要使非直连的EBGP邻居正常建立，则必须包含以下哪些配置?",
+     "a": "A. peer connectinterface / B. peer as-number / C. peer ebgp-max-hop"
+    },
+    {
+     "n": 383,
+     "q": "以下哪些项属于BGP可选过渡属性?",
+     "a": "A. Aggregator / B. Community"
+    }
+   ]
+  },
+  "security": {
+   "scenarios": [
+    "acl-filter",
+    "aaa-local",
+    "ipsec-vpn",
+    "firewall-zones",
+    "firewall-hrp",
+    "arp-security",
+    "dhcp-snooping"
+   ],
+   "points": [
+    {
+     "n": 147,
+     "q": "ACL是路由常用匹配工具之一，并根据ACL规则功能的不同将ACL划分成多种类型，且每类ACL编号的取值范围不同。其中，编号范围为4000~4999，表示的是以下哪—类型ACL?",
+     "a": "C. 二层ACL"
+    },
+    {
+     "n": 195,
+     "q": "一台路由器收到报文后按照ACL匹配流程进行匹配时，匹配结果只有两种:“匹配”或“不匹配”。那么以下场景中,其返回匹配结果为“匹配”的是哪些项?",
+     "a": "B. 匹配了ACL，但匹配动作为“permit\" / C. 匹配了ACL，但匹配动作为“deny\""
+    },
+    {
+     "n": 247,
+     "q": "路由器配置访问控制列表时，可以通过ACL编号标识ACL，也可以通过名称来标识ACL。其中，配置命名型ACL时，需手工指定ACL的名字和ACL的编号。",
+     "a": "B. 错误"
+    },
+    {
+     "n": 235,
+     "q": "在路由器上配置ACL时，可通过指定一个唯一的数字标识该ACL，或通过名称代替编号来标识ACL。其中，命名型ACI一旦创建成功，用户便无法修改，只能删除该ACL，重新配置",
+     "a": "B. 错误"
+    },
+    {
+     "n": 93,
+     "q": "ACL是路由常用匹配工具之一，并根据ACL规则功能的不同将ACL划分成多种类型，且每类ACL编号的取值范围不同。其中，编号范围为4000~4999，表示的是以下哪一类型ACL?",
+     "a": "B. 二层ACL"
+    },
+    {
+     "n": 2,
+     "q": "在华为路由器上，若未配置ACL或配置了ACL但没有配置规则，那么它们返回ACL的匹配结果均为不匹配.",
+     "a": "A. TURE"
+    },
+    {
+     "n": 53,
+     "q": "使用ACL进行路由匹配时，不管是基本ACL还是高级ACL，或者是用户ACL，缺省情况下它们的ACL规则步长均为10。",
+     "a": "B. FALSE"
+    },
+    {
+     "n": 213,
+     "q": "某企业部署完IPSec后发现业务不通，经管理员排查发现没有数据流触发IKE协商，那么以下哪些原因可能导致该情况发生?",
+     "a": "A. 路由不可达 / B. ACL与保护数据流不匹配 / C. 域间安全策略配置错误 / D. IPSec策略未正确应用到相关接口"
+    }
+   ]
+  },
+  "ospf": {
+   "scenarios": [
+    "ospf-single",
+    "ospf-multi-area",
+    "ospf-stub-nssa",
+    "ospf-lsa-types",
+    "ospf-virtual-link",
+    "ospf-troubleshooting"
+   ],
+   "points": [
+    {
+     "n": 186,
+     "q": "某企业网络中，运行OSPF路由协议实现网络通信，已知某路由器角色仅为ABR，那么该设备可能产生以下哪些类型的LSA?",
+     "a": "A. Network Summary LSA / D. ASBR Summary LSA"
+    },
+    {
+     "n": 470,
+     "q": "以下关于配置OSPFStub区域注意事项的描述，正确的是哪一项?",
+     "a": "D. 如果将一个区域配置成为Stub区域，则该区域中的所有路由器都要配置Stub区域属性"
+    },
+    {
+     "n": 55,
+     "q": "某企业OSPF网络的NSSA区域引入了大量外部路由，现用户要求减少非特殊区域的LSA数量，那么该企业工程呵在NSSA区域中的ABR上，对由7类LSA转化成的5类LSA进行路由汇总。",
+     "a": "A. TURE"
+    },
+    {
+     "n": 382,
+     "q": "以下哪些方法能够相对降低OSPF路由计算负荷?",
+     "a": "A. 对普通区域路由手动汇总 / C. 部署Stub区域 / E. 划分OSPF非骨干区域"
+    },
+    {
+     "n": 439,
+     "q": "以下关于OSPFv3类LSA、4类LSA和5类LSA的描述，正确的是哪一项?",
+     "a": "C. 5类LSA在穿越不同区域后，不会发生改变，而3类LSA会发生变化"
+    },
+    {
+     "n": 339,
+     "q": "NSSA区域的ABR不会向NSSA泛洪4类和5类LSA，会将7类LSA转换成5类LSA泛洪给其他区域。",
+     "a": "A. 正确"
+    },
+    {
+     "n": 157,
+     "q": "在OSPF网络中，为减少某些区域的LSA数量，定义了多种特殊区域，如STUB、NSSA等。那么以下关于STUB区域的描述，正确的是哪些项?",
+     "a": "A. 虚连接不能穿越STUB区域 / C. STUB区域中的所有路由器都必须配置STUB区域属性"
+    },
+    {
+     "n": 266,
+     "q": "某企业办公网络中，运行了OSPF路由协议且划分了多个OSPF区域，为减少路由表规模和优化设备资源利用率，该企业网络工程师可在ASBR上执行路由汇总，减少区域间的三类LSA。",
+     "a": "B. 错误"
+    }
+   ]
+  },
+  "reliability": {
+   "scenarios": [
+    "vrrp-basics",
+    "bfd-fast-convergence",
+    "firewall-hrp",
+    "dual-homed-isp"
+   ],
+   "points": [
+    {
+     "n": 50,
+     "q": "如图所示，通过配置VRRP与BFD联动，当Backup设备通过BFD感知故障发生之后，等待Master Domn_Timer计时器超时后Backup设备会立即切换VRRP状态。",
+     "a": "B. 错误"
+    },
+    {
+     "n": 404,
+     "q": "VRRP协议包括两个版本VRRPV2和VRRPV3，以下关于VRRPV3版本的描述，正确的是哪些项?",
+     "a": "A. VRRPV3适用于IPv4和IPv6两种网络 / C. 设备的缺省优先级为100 / D. 缺省情况下，VRRP通告报文的发送时间间隔为1秒"
+    },
+    {
+     "n": 189,
+     "q": "某企业WLAN网络，为保证业务的可靠性，部署了VRRP双机热备。用户配置完成后，发现主备通道无法建立，导致双机热备份功能异常。那么造成上述故障的原因，可能是以下哪些?",
+     "a": "A. 主备服务报文的重传次数和重传间隔不一致 / C. 主备通道参数配置不匹配 / D. 本端的源IP地址、源端口号和对端的目的IP地址、目的端口号不一致"
+    },
+    {
+     "n": 412,
+     "q": "以下关于VRRP协议版本的描述，正确的是哪些项?",
+     "a": "A. VRRPv2仅适用于IPv4 / C. VRRPv3不支持认证 / D. VRRPv2支持认证"
+    },
+    {
+     "n": 324,
+     "q": "VRRP目前有两个版本，其中VRRPV2仅适用于IPV4网络，VRRPV3仅适用于IPv6网络。",
+     "a": "B. 错误"
+    },
+    {
+     "n": 181,
+     "q": "BFD作为一个快速故障检测机制，可以和多种协议进行联动。那么以下哪些协议支持和BFD进行联动?",
+     "a": "A. 静态路由 / B. BGP / C. OSPF / D. PIM"
+    },
+    {
+     "n": 342,
+     "q": "BFD提供了一个通用的、标准化的、介质无关的、协议无关的快速故障检测机制，如果想要通过该机制检测链路是否连通，两端设备必须都需要支持该特性。",
+     "a": "B. 错误"
+    },
+    {
+     "n": 182,
+     "q": "BFD的单臂回声功能是指通过BFD报文的环回操作检测链路的连通性，那么以下关于该功能的描述，正确的是哪些项?",
+     "a": "A. 单臂回声功能只适用于单跳BFD会话中 / B. 在对端使能了URPF特性的情况下，可能会导致BFD报文在对端被错误地丢弃 / C. 在配置单臂回声功能时，设备缺省使用出接口IP为源IP"
+    }
+   ]
+  },
+  "isis": {
+   "scenarios": [
+    "isis-multi-level"
+   ],
+   "points": [
+    {
+     "n": 14,
+     "q": "四台路由器运行is-is且已经建立邻接关系,区域号和路由器的等级如图中标记,下列说法中正确的有?",
+     "a": "A. R2和R3都会产生ATT置位的Level-1的LSP"
+    },
+    {
+     "n": 264,
+     "q": "在IS-IS网络中，Level-1路由器只能通过Level-1-2路由器接入IS-IS骨干区域从而访问其他区域。",
+     "a": "A. 正确"
+    },
+    {
+     "n": 234,
+     "q": "在IS-IS网络中，区域是根据路由器来划分的，一台路由器只能属于一个区域，因此IS-IS路由器只需要维护当前所在区域的LSDB即可。",
+     "a": "B. 错"
+    },
+    {
+     "n": 199,
+     "q": "在IS-IS网络中，路由器发送LSP报文交换链路状态信息，该报文分为Leve1-1LSP和Leve1-2LSP两种，且有着相同的报文格式。其中，LSP报文中的LSP ID由以下哪…",
+     "a": "A. System ID / B. LSP分片后的编号 / C. 伪节点JD"
+    },
+    {
+     "n": 375,
+     "q": "在广播型网络中，IS-IS协议会选举出一个DIS，而OSPF协议会选举出一个DR。那么以下关于DIS和DR区别的描述，正确的是哪些项?",
+     "a": "B. DIS和DR形成邻接关系的条件不同，IS-IS中的非DIS路由器之间也会建立邻接关系 / C. DIS和DR负责的功能不同，DIS主要用于创建和更新伪节点 / D. DIS和DR选举时间不同，DIS在建立完邻接关系之后选举"
+    },
+    {
+     "n": 173,
+     "q": "某园区网络中，全网运行IS-IS路由协议，现工程师在某一台设备上查看LSDB的详细信息如下所示。那么根据回显信息，以下描述正确的是哪些项?",
+     "a": "B. 该LSP来源的区域号为49.0123 / D. 该LSP源节点的系统lD为0100.0000.1001.00"
+    },
+    {
+     "n": 208,
+     "q": "在lS-IS网络中，每台路由器都可以产生LSP，那么当遇到以下哪些事件时，会触发生成一个新的LSP?",
+     "a": "A. 周期性更新 / B. IS-IS相关接口Up或Down / C. 区域间的IP路由发生变化 / D. 调大IS-IS接口开销值"
+    },
+    {
+     "n": 19,
+     "q": "在广播型IS-IS网络中，需要选举一个DIS来创建和更新伪节点。如图所示为某广播型IS-IS网络，在该场最下会被选举为DIS的是哪一台路由器?",
+     "a": "C. R3"
+    }
+   ]
+  },
+  "switching": {
+   "scenarios": [
+    "vlan-access",
+    "trunk-interconnect",
+    "stp-rstp",
+    "mstp-load-balance",
+    "link-aggregation",
+    "super-vlan",
+    "port-security",
+    "port-isolation",
+    "stack-istack"
+   ],
+   "points": [
+    {
+     "n": 250,
+     "q": "在RSTP网络中，如果一个接口收到一个RSTBPDU，发现自身缓存的RSTBPDU优于收到的RSTBPDU，则会直接丢弃收到的RSTBPDU，不做其他回应。",
+     "a": "B. 错误"
+    },
+    {
+     "n": 216,
+     "q": "在RSTP网络中，针对STP的不足，对端口角色进行了改进。那么RSTP可以包含以下哪些角色?",
+     "a": "A. Backup端 / B. 指定端口 / C. Alternate端 / D. 根端口"
+    },
+    {
+     "n": 137,
+     "q": "针对STP的不足，RSTP改变了配置BPDU的格式，充分利用了STP报文中的以下哪一字段，明确了端口角色?",
+     "a": "A. Flag"
+    },
+    {
+     "n": 167,
+     "q": "在RSTP网络中，新增了多种保护功能，如:根保护、环路保护、防TC-BPDU攻击等。那么以下关于RSTP新增保护功能的描述，正确的是哪些项?",
+     "a": "A. 某开启了根保护功能的指定接口收到优先级更高的RST BPDU时，一段时间内将无法转发报文 / C. 若设备开启BPDU保护功能后，会影响边缘端口的属性 / D. 启用防TC-BPDU攻击功能后，对于其他超出阈值的TC BPDU报文，定时器到期后设备只对其统一处理一次"
+    },
+    {
+     "n": 405,
+     "q": "某大型商场为防止广播域过大，导致网络性能变差，配置了VLAN Pool。网络工程师执行命令display vlan pool name STA的回显如下。那么以下关于该配置信息的…",
+     "a": "B. VLAN Pool的名称为STA / D. 加入到VLAN Pool的VLAN ID为2和4"
+    },
+    {
+     "n": 325,
+     "q": "在STP网络中，为了避免环路，指定端口选举完成后必须等待足够长的时间，使全网的端口状态全部确定后才能进行转发，针对STP上述问题，RSTP通过P/A机制加快了下游端口进人Forw…",
+     "a": "A. 正确"
+    },
+    {
+     "n": 236,
+     "q": "在STP网络中，若拓扑发生变更，必须先将拓扑变化信息传递给根桥，再由根桥向下泛洪拓扑变更信息。",
+     "a": "A. 对"
+    },
+    {
+     "n": 193,
+     "q": "若一个MST域内有多台交换机，那么在部署MSTP时，需要确保以下哪些参数必须一致?",
+     "a": "A. 域名 / B. VLAN与生成树实例的映射关系 / C. 都运行了MSTP功能 / D. MSTP修订级别"
+    }
+   ]
+  },
+  "multicast": {
+   "scenarios": [
+    "multicast-pim-sm"
+   ],
+   "points": [
+    {
+     "n": 345,
+     "q": "工程师配置组播协议之前，必须先使能IP组播路由功能，使能IP组播路由功能是配置一切组播功能的前提",
+     "a": "A. 正确"
+    },
+    {
+     "n": 223,
+     "q": "RPF检查是组播中一个极为重要的机制，可以确保转发路径的正确性和唯一性。正常情况下，RPF检查会从以下哪些路由表项中选出最优路由?",
+     "a": "A. MBGP路由表 / B. 单播路由表 / D. 组播静态路由表"
+    },
+    {
+     "n": 393,
+     "q": "作为IP传输三种方式之一，IP组播通信指的是IP报文从一个源发出，被转发到一组特定的接收者。以下关于IP组播技术的描述，正确的是哪些项?",
+     "a": "B. 相比广播，可以防止信息泛滥 / C. 相比广播，IP组播可以有效地节约网络带宽"
+    },
+    {
+     "n": 427,
+     "q": "以下关于IGMP SSM Mapping的描述，正确的是哪些项?",
+     "a": "A. SSM组播组的地址是232.0.0.0个232.255.255.255 / C. IGMP SSM Mapping通过静态的将组播源与组播组进行绑定，使得IGMPv1与IGMPv2的组成员也能接入SSM组播网络"
+    },
+    {
+     "n": 120,
+     "q": "IGMP有三个版本，不同版本支持的特性有所区别。以下哪一项是所有版本均支持的特性?",
+     "a": "C. 成员报告报文"
+    },
+    {
+     "n": 142,
+     "q": "在IPv4地址空间中，D类地址被用于组播。在D类地址范围内，以下哪一项属于为路由协议预留的永久组播地址?",
+     "a": "C. 224.0.0.0-224.0.0.255"
+    },
+    {
+     "n": 168,
+     "q": "IGMP组表项在组播转发中起到了重要的作用，某管理员通过命令查看一个组播表项信息如下。以下关于该表项的描述，正确的是哪些项?",
+     "a": "B. Expires代表了该组的老化时间 / C. 该表项是由用户主机发送的IGMP加入报文触发创建的 / D. 225.1.1.2是用户加入的组地址"
+    },
+    {
+     "n": 122,
+     "q": "某工程师在配置组播协议时未经过版本比对，结果设备配置的IGMP Snooping版本比用户主机的IGMP版本低。此时会发生以下哪一种情况?",
+     "a": "B. 用户无法收到组播数据，因为设备在收到IGMP Report报文后，只会向路由器端口转发，不会生成成员端口和转发表项"
+    }
+   ]
+  },
+  "ipv6": {
+   "scenarios": [
+    "ipv6",
+    "ospfv3-ipv6"
+   ],
+   "points": [
+    {
+     "n": 169,
+     "q": "IPv6在设计的时候考虑到IPv4的弊端，进行了改良和更新。相较于IPv4协议，IPv6协议具有以下哪些优势?",
+     "a": "A. IPv6协议内置支持通过地址自动配置方式使主机自动发现网络并获取IPv6地址 / B. 可实现QoS / C. 支持IPSec的认证和加密"
+    },
+    {
+     "n": 255,
+     "q": "在IPv6网络中，为了减少中间转发设备的处理压力，中间转发设备不对IPv6报文进行分片，报文的分片只在源节点进行",
+     "a": "A. 正确"
+    },
+    {
+     "n": 253,
+     "q": "某WLAN网络中，AC与AP为三层组网，且AC与AP均采用IPv6地址。此时AP可通过DHCPv6服务器响应报文中所携带的Option43字段来获取AC的IPv6地址fcO0:1…",
+     "a": "B. 错误"
+    },
+    {
+     "n": 220,
+     "q": "以下关于IPv6地址表示方法的描述，正确的是哪些项?",
+     "a": "A. 在一个IPv6地址中只能使用一次双冒号\"….\" / B. 每组中的前导“O”都可以省略"
+    },
+    {
+     "n": 374,
+     "q": "IPv6是网络层协议的第二代标准协议，也被称为lpng。以下关于它和IPv4比较的描述，正确的是哪些项?",
+     "a": "A. IPv6地址长度比IPV4大得多，拥有的地址规模也更为庞大 / D. IPv4没有安全件设计，而IPv6中支持到的安全"
+    }
+   ]
+  },
+  "mpls": {
+   "scenarios": [
+    "mpls-basic",
+    "mpls-l3vpn"
+   ],
+   "points": [
+    {
+     "n": 424,
+     "q": "作为网络管理员,可以使用下列哪些协议用于网络设备配置?",
+     "a": "B. SNMP / C. NETCONF / D. SSH"
+    },
+    {
+     "n": 436,
+     "q": "MPLS VPN网络一般由运营商搭建)VPN用户购买VPN服务来实现用户网络之间的数据互通。在MPLS VPN网络中存在诸多设备角色，其中以下哪一项设备角色是运营商网络中的骨干路…",
+     "a": "D. Provider"
+    }
+   ]
+  }
+ }
+}

package/src/core/knowledge.mjs

@@ -0,0 +1,104 @@
+/**
+ * Curriculum knowledge attached to scenarios.
+ *
+ * The scenario presets say what to build and in what order. They deliberately do
+ * not carry commands, because the whole point of the tool is to catch a copied
+ * command that does not fit. What they were missing is the vocabulary the lab is
+ * teaching: which LSA belongs to which area, which attribute wins a BGP decision,
+ * which port role only MSTP has. That is exactly the material a certification
+ * question bank covers.
+ *
+ * This module reads a small generated index instead of the question bank itself:
+ * one topic, the scenarios that teach it, and a list of short question/answer
+ * pairs. Keeping the bank out of the package matters for two reasons. Most of its
+ * questions are three-sentence reading exercises that say nothing, and shipping
+ * a copyrighted question bank inside a GPL package is not a reasonable default.
+ *
+ * @module dsh-ensp/knowledge
+ */
+
+import { readFileSync } from 'node:fs'
+
+let cache = null
+
+/**
+ * Load the generated index, once.
+ *
+ * Read through `new URL` so the path resolves from this module rather than from
+ * whatever directory the caller happens to run in.
+ *
+ * @returns {object}
+ */
+function catalogue() {
+  if (cache) return cache
+  const text = readFileSync(new URL('./knowledge.json', import.meta.url), 'utf8')
+  cache = JSON.parse(text)
+  return cache
+}
+
+/** @returns {string[]} the topics the index covers. */
+export function knowledgeTopics() {
+  return Object.keys(catalogue().topics).sort()
+}
+
+/**
+ * Knowledge points for one scenario.
+ *
+ * A topic can feed several scenarios: `ospf` covers six of them, and each gets the
+ * same points. That repetition is intentional. A learner running the multi-area
+ * lab should not have to know that the material also sits under another scene.
+ *
+ * @param {string} scenarioId
+ * @returns {Array<{topic: string, n: number, q: string, a: string}>}
+ */
+export function knowledgeFor(scenarioId) {
+  const out = []
+  for (const [topic, entry] of Object.entries(catalogue().topics)) {
+    if (!entry.scenarios?.includes(scenarioId)) continue
+    for (const point of entry.points || []) out.push({ topic, ...point })
+  }
+  return out
+}
+
+/**
+ * Search the index by question or answer text.
+ *
+ * Case-insensitive substring match, same contract as {@link searchScenarios} so the
+ * two can be chained in a CLI command without surprising the user.
+ *
+ * @param {string} query
+ * @returns {Array<{topic: string, n: number, q: string, a: string}>}
+ */
+export function searchKnowledge(query) {
+  const needle = String(query ?? '').trim().toLowerCase()
+  if (!needle) return []
+  const out = []
+  for (const [topic, entry] of Object.entries(catalogue().topics)) {
+    for (const point of entry.points || []) {
+      if (`${point.q} ${point.a}`.toLowerCase().includes(needle)) out.push({ topic, ...point })
+    }
+  }
+  return out
+}
+
+/**
+ * Render the knowledge section for a scenario brief.
+ *
+ * Returns an empty string when the scenario has none, so callers can append it
+ * unconditionally.
+ *
+ * @param {string} scenarioId
+ * @param {object} [options]
+ * @param {number} [options.limit=10]
+ * @returns {string}
+ */
+export function renderKnowledge(scenarioId, { limit = 10 } = {}) {
+  const points = knowledgeFor(scenarioId).slice(0, limit)
+  if (!points.length) return ''
+  const lines = ['', '## 知识点（来自认证题库，按主题归类）']
+  for (const p of points) {
+    lines.push(`- ${p.q}`)
+    lines.push(`  答: ${p.a}`)
+  }
+  return lines.join('\n')
+}

package/src/dsh/index.mjs

@@ -48,6 +48,7 @@ import { pushConfig, pushConfigMany, queryDevice } from '../core/provision.mjs'
 import { SCENARIOS, SCENARIO_IDS, renderScenario, searchScenarios, byLevel } from '../core/presets.mjs'
 import { doctor, modelsOf } from '../core/doctor.mjs'
 import { runAcceptance, hasChecks } from '../core/acceptance.mjs'
+import { knowledgeFor, searchKnowledge, knowledgeTopics, renderKnowledge } from '../core/knowledge.mjs'
 import { VERSION } from '../core/version.mjs'
 
 /** Declared hard dependency: the tool registry. */
@@ -598,13 +599,55 @@ export function apply(ctx) {
           brief +
           (hasChecks(id)
             ? `\n\n验收: ensp_verify { scenario: "${id}", topology: "${id}.topo" }`
-            : '\n\n验收: 无专门断言，ensp_verify 会逐条跑场景里的验证命令'),
+            : '\n\n验收: 无专门断言，ensp_verify 会逐条跑场景里的验证命令') +
+          renderKnowledge(id),
       }
     },
   })
 
   /* ---------------------------------------------------------- preset config */
 
+  add(tools, {
+    name: 'ensp_knowledge',
+    description:
+      'Look up curriculum knowledge derived from a certification question bank: short ' +
+      'question/answer pairs filed by topic, and the scenarios that teach each topic. ' +
+      'Pass scenario to list what one lab teaches, or query to search the index.',
+    parameters: {
+      query: str('Keyword, e.g. "LSA" or "MED".'),
+      scenario: str('Scenario id, e.g. "ospf-lsa-types".'),
+    },
+    output: {
+      schema: obj({
+        scope: req(str()),
+        count: req(num()),
+        points: req(str()),
+        error: req(str()),
+      }),
+      render(args, value) {
+        return text(value.points || '(no knowledge point matched)')
+      },
+    },
+    async execute({ query, scenario }) {
+      if (scenario) {
+        if (!SCENARIOS[scenario]) throw new Error(`unknown scenario "${scenario}"`)
+        const points = knowledgeFor(scenario)
+        return {
+          scope: scenario,
+          count: points.length,
+          points: points.map((p) => `#${p.n} [${p.topic}] ${p.q}\n  答: ${p.a}`).join('\n'),
+        }
+      }
+      if (!query) throw new Error('pass query or scenario')
+      const points = searchKnowledge(query)
+      return {
+        scope: String(query),
+        count: points.length,
+        points: points.map((p) => `#${p.n} [${p.topic}] ${p.q}\n  答: ${p.a}`).join('\n'),
+      }
+    },
+  })
+
   add(tools, {
     name: 'ensp_preset_config',
     description: 'Return the configuration text for the built-in two-PC lab.',

package/src/mcp/server.mjs

@@ -40,6 +40,7 @@ import {
 import { calibrateAnchors, inspectAnchors, DEFAULT_ANCHORS } from '../core/calibrate.mjs'
 import { doctor, modelsOf } from '../core/doctor.mjs'
 import { runAcceptance, hasChecks, EXPECTATIONS } from '../core/acceptance.mjs'
+import { knowledgeFor, searchKnowledge, knowledgeTopics } from '../core/knowledge.mjs'
 import { pushConfig, pushConfigMany, queryDevice } from '../core/provision.mjs'
 import { SCENARIOS, SCENARIO_IDS, byLevel, renderScenario, searchScenarios } from '../core/presets.mjs'
 import { PACKAGE_NAME, VERSION } from '../core/version.mjs'
@@ -331,6 +332,7 @@ const TOOLS = [
         hasTopology: hasLab(id),
         hasCuratedChecks: hasChecks(id),
         ...(hasLab(id) ? { devices: labDevices(id), addressing: labAddressing(id) } : {}),
+        knowledge: knowledgeFor(id),
       }
     },
   },
@@ -373,6 +375,27 @@ const TOOLS = [
       return runAcceptance({ id: scenario, topology, timeoutMs: timeout, waitMs: wait })
     },
   },
+  {
+    name: 'ensp_knowledge',
+    description:
+      'Search the curriculum knowledge index derived from a certification question bank. ' +
+      'Use it to look up the vocabulary a scenario teaches (which LSA belongs to which area, ' +
+      'which BGP attribute wins, which port role is MSTP only) without leaving the lab. ' +
+      'Returns short question/answer pairs plus the scenarios that teach each topic.',
+    inputSchema: obj({
+      query: { type: 'string', description: 'keyword, e.g. "LSA" or "MED"' },
+      scenario: { type: 'string', description: 'scenario id, to list what that lab teaches' },
+    }),
+    async run({ query, scenario }) {
+      if (scenario) {
+        if (!SCENARIOS[scenario]) throw new Error(`unknown scenario "${scenario}"`)
+        return { scenario, topics: knowledgeTopics(), points: knowledgeFor(scenario) }
+      }
+      if (!query) throw new Error('pass query or scenario')
+      return { query, points: searchKnowledge(query) }
+    },
+  },
+
   {
     name: 'ensp_preset_config',
     description: 'Return the configuration that makes the built-in two-PC lab pass traffic.',