packet-tracer-skill 0.2.0 → 0.2.2

package/scripts/intent_parser.py

@@ -28,7 +28,7 @@ CAPABILITY_PATTERNS = {
     "management_vlan": [r"\bmanagement vlan\b", r"\bvlan 99\b", r"\bdefault-gateway\b"],
     "telnet": [r"\btelnet\b", r"\bvty\b", r"\btransport input telnet\b"],
     "wireless_ap": [r"\bssid\b", r"\bwifi\b", r"\bwpa\b", r"\bwpa2\b", r"\bwireless\b", r"\baccess point\b", r"\bap\b"],
-    "wireless_mutation": [r"\bset\s+[A-Za-z0-9_ -]+?\s+ssid\b", r"\bsecurity\s+(?:wpa|wpa2|wep|open|802\.1x)\b", r"\bpassphrase\b", r"\bchannel\s+\d+\b"],
+    "wireless_mutation": [r"\bset\s+[A-Za-z0-9_ -]+?\s+ssid\b", r"\bsecurity\s+(?:wpa|wpa2|wpa-enterprise|wpa2-enterprise|wep|open|802\.1x)\b", r"\bpassphrase\b", r"\bchannel\s+\d+\b"],
     "wireless_client": [r"\btablet\b", r"\blaptop\b", r"\bsmartphone\b", r"\bassociate\b", r"\bjoin\b"],
     "wireless_client_association": [r"\bassociate\b", r"\bjoin\b"],
     "tablet": [r"\btablet\b"],
@@ -38,13 +38,75 @@ CAPABILITY_PATTERNS = {
     "ospf": [r"\bospf\b"],
     "eigrp": [r"\beigrp\b"],
     "rip": [r"\brip\b"],
+    "ipv6_slaac": [r"\bslaac\b", r"\bipv6\s+slaac\b"],
+    "dhcpv6_stateful": [r"\bdhcpv6\b", r"\bstateful dhcpv6\b", r"\bipv6 stateful\b"],
+    "dhcpv6_stateless": [r"\bstateless dhcpv6\b", r"\bipv6 stateless\b"],
+    "ipv6_prefix_delegation": [r"\bprefix delegation\b", r"\bipv6 prefix\b"],
+    "ipv6_dns_aaaa": [r"\baaaa\b", r"\bipv6 dns\b"],
+    "ipv6_tunneling": [r"\bipv6ip\b", r"\bipv6 tunnel\b", r"\bipv6 tunneling\b"],
+    "isatap": [r"\bisatap\b"],
+    "ospfv3": [r"\bospfv3\b", r"\bipv6 ospf\b"],
+    "eigrp_ipv6": [r"\bipv6 eigrp\b", r"\beigrp ipv6\b"],
+    "ripng": [r"\bripng\b", r"\bipv6 rip\b"],
+    "hsrp": [r"\bhsrp\b"],
     "nat": [r"\bnat\b"],
     "acl": [r"\bacl\b", r"\baccess-list\b"],
+    "dhcp_snooping": [r"\bdhcp snooping\b"],
+    "dai": [r"\bdai\b", r"\bdynamic arp inspection\b"],
+    "dot1x": [r"\bdot1x\b", r"\b802\.1x\b", r"\bnac\b"],
+    "lldp": [r"\blldp\b"],
+    "rep": [r"\brep\b"],
+    "snmp": [r"\bsnmp\b"],
+    "netflow": [r"\bnetflow\b"],
+    "span": [r"\bspan\b", r"\brspan\b"],
+    "qos": [r"\bqos policy\b", r"\bqos class\b", r"\bclass-map\b", r"\bpolicy-map\b", r"\bquality of service\b"],
+    "port_security": [r"\bport security\b", r"\bport-security\b"],
     "vpn": [r"\bvpn\b", r"\bsite-to-site\b", r"\bipsec\b", r"\btunnel\b"],
     "ipsec": [r"\bipsec\b", r"\bike\b", r"\bphase 1\b", r"\bphase 2\b"],
     "gre": [r"\bgre\b", r"\bgre tunnel\b"],
     "ppp": [r"\bppp\b", r"\bchap\b", r"\bpap\b"],
+    "security_edge": [r"\bsecurity edge\b", r"\bsecurity appliance\b", r"\bfirewall\b", r"\basa\b"],
+    "asa_acl_nat": [r"\basa acl\b", r"\basa nat\b", r"\basa acl nat\b"],
+    "asa_service_policy": [r"\basa service policy\b", r"\bservice policy\b"],
+    "clientless_vpn": [r"\bclientless vpn\b"],
+    "cbac": [r"\bcbac\b"],
+    "zfw": [r"\bzfw\b", r"\bzone based firewall\b", r"\bzone-based firewall\b"],
+    "sniffer": [r"\bsniffer\b"],
     "multilayer_switching": [r"\bmultilayer switch\b", r"\blayer 3 switch\b", r"\b3560\b", r"\bsvi\b"],
+    "wlc": [r"\bwlc\b", r"\bwireless lan controller\b"],
+    "wpa_enterprise": [r"\bwpa enterprise\b", r"\bwpa2 enterprise\b", r"\bwpa-enterprise\b", r"\bwpa2-enterprise\b", r"\b802\.1x wireless\b"],
+    "wep": [r"\bwep\b"],
+    "guest_wifi": [r"\bguest wifi\b", r"\bguest wlan\b"],
+    "beamforming": [r"\bbeamforming\b"],
+    "meraki": [r"\bmeraki\b"],
+    "cellular_5g": [r"\b5g\b", r"\bcellular\b", r"\bcell tower\b"],
+    "bluetooth": [r"\bbluetooth\b"],
+    "network_controller": [r"\bnetwork controller\b", r"\bnetcon\b"],
+    "python_programming": [r"\bpython programming\b", r"\bpython app\b"],
+    "javascript_programming": [r"\bjavascript\b", r"\bjs app\b"],
+    "blockly_programming": [r"\bblockly\b"],
+    "tcp_udp_app": [r"\btcp test app\b", r"\budp test app\b", r"\btcp app\b", r"\budp app\b"],
+    "vm_iox": [r"\biox\b", r"\bvm\b", r"\bvirtual machine\b"],
+    "voip": [r"\bvoip\b"],
+    "ip_phone": [r"\bip phone\b", r"\bphone\b"],
+    "call_manager": [r"\bcall manager\b", r"\btelephony\b"],
+    "linksys_voice": [r"\blinksys voice\b"],
+    "mqtt": [r"\bmqtt\b"],
+    "real_http": [r"\breal http\b"],
+    "real_websocket": [r"\bwebsocket\b", r"\breal websocket\b"],
+    "visual_scripting": [r"\bvisual scripting\b"],
+    "ptp": [r"\bptp\b", r"\bprecision time protocol\b"],
+    "profinet": [r"\bprofinet\b"],
+    "l2nat": [r"\bl2nat\b", r"\bl2 nat\b"],
+    "cyberobserver": [r"\bcyberobserver\b"],
+    "industrial_firewall": [r"\bindustrial firewall\b", r"\bisa3000\b"],
+    "coaxial": [r"\bcoaxial\b"],
+    "cable_dsl": [r"\bcable modem\b", r"\bdsl\b", r"\bdsl modem\b"],
+    "central_office": [r"\bcentral office\b"],
+    "cell_tower": [r"\bcell tower\b"],
+    "power_distribution": [r"\bpower distribution\b"],
+    "hot_swappable": [r"\bhot swappable\b", r"\bhot-swappable\b"],
+    "ios_license": [r"\bios license\b", r"\blicense\b", r"\bios15\b", r"\bios 15\b"],
 }
 
 DEVICE_SYNONYMS = {
@@ -97,6 +159,13 @@ NATURAL_DEVICE_ALIASES = {
 NETWORK_STYLE_PATTERNS = {
     "campus": [r"\bcampus\b", r"\bkampus\b", r"\bsobeli\b", r"\bdepart", r"\bdepartment\b"],
     "branch": [r"\bbranch\b", r"\bfilial\b"],
+    "ipv6_routing": [r"\bipv6\b", r"\bslaac\b", r"\bdhcpv6\b", r"\bospfv3\b", r"\bhsrp\b"],
+    "l2_security_monitoring": [r"\bdhcp snooping\b", r"\bdai\b", r"\bdot1x\b", r"\b802\.1x\b", r"\bsnmp\b", r"\bnetflow\b", r"\bspan\b", r"\brspan\b", r"\bquality of service\b", r"\blldp\b", r"\brep\b", r"\bport security\b", r"\bport-security\b"],
+    "wireless_advanced": [r"\bwlc\b", r"\bwireless lan controller\b", r"\bmeraki\b", r"\bbluetooth\b", r"\b5g\b", r"\bcellular\b", r"\bwpa enterprise\b", r"\bwpa2 enterprise\b", r"\bwep\b", r"\bguest wifi\b", r"\bguest wlan\b", r"\bbeamforming\b"],
+    "automation_controller": [r"\bnetwork controller\b", r"\bnetcon\b", r"\bblockly\b", r"\bjavascript\b", r"\bpython programming\b", r"\biox\b"],
+    "voice_collaboration": [r"\bvoip\b", r"\bip phone\b", r"\bcall manager\b", r"\btelephony\b"],
+    "industrial_iot": [r"\bmqtt\b", r"\bwebsocket\b", r"\bprofinet\b", r"\bl2nat\b", r"\bptp\b", r"\bcyberobserver\b", r"\bindustrial\b"],
+    "physical_media_device": [r"\bcoaxial\b", r"\bcable modem\b", r"\bdsl modem\b", r"\bcentral office\b", r"\bcell tower\b", r"\bpower distribution\b"],
     "small_office": [r"\bsmall office\b", r"\bhome\b", r"\bofis\b"],
     "wireless_branch": [r"\bwireless\b", r"\bwifi\b", r"\bssid\b"],
     "wan_security": [r"\bwan\b", r"\bgre\b", r"\bppp\b", r"\bipsec\b", r"\bvpn\b", r"\bsecurity edge\b", r"\bfirewall\b", r"\basa\b"],
@@ -136,6 +205,8 @@ SECURITY_TO_AUTH = {
     "wpa": ("2", "2"),
     "wpa2": ("4", "4"),
     "802.1x": ("5", "5"),
+    "wpa-enterprise": ("5", "5"),
+    "wpa2-enterprise": ("5", "5"),
 }
 
 TRANSLITERATION_TABLE = str.maketrans(
@@ -389,7 +460,7 @@ def _extract_service_requirements(capabilities: list[str], prompt: str) -> dict[
     for service in ["dhcp", "dns", "http", "https", "ftp", "tftp", "ntp", "email", "syslog", "aaa"]:
         if service in lowered:
             requirements["services"].append(service)
-    for security in ["acl", "telnet", "wpa2", "wpa", "wep", "nat", "vpn", "ipsec", "gre", "ppp", "ssh"]:
+    for security in ["acl", "telnet", "wpa2", "wpa", "wep", "nat", "vpn", "ipsec", "gre", "ppp", "security_edge", "ssh"]:
         if security in lowered:
             requirements["security"].append(security)
     return requirements
@@ -503,6 +574,39 @@ def _extract_switch_ops(prompt: str) -> list[dict[str, object]]:
                     "native": int(native) if native else None,
                 }
             )
+    dhcp_snooping_pattern = re.compile(r"set\s+([A-Za-z0-9_-]+)\s+dhcp\s+snooping\s+vlan\s+(\d+)(?:\s+trust\s+([A-Za-z0-9/._-]+))?", flags=re.IGNORECASE)
+    dai_pattern = re.compile(r"set\s+([A-Za-z0-9_-]+)\s+dai\s+vlan\s+(\d+)(?:\s+trust\s+([A-Za-z0-9/._-]+))?", flags=re.IGNORECASE)
+    port_security_pattern = re.compile(
+        r"set\s+([A-Za-z0-9_-]+)\s+port-security\s+([A-Za-z0-9/._-]+)(?:\s+max\s+(\d+))?(?:\s+violation\s+(protect|restrict|shutdown))?",
+        flags=re.IGNORECASE,
+    )
+    lldp_pattern = re.compile(r"set\s+([A-Za-z0-9_-]+)\s+lldp(?:\s+(?:enable|run))?", flags=re.IGNORECASE)
+    rep_pattern = re.compile(r"set\s+([A-Za-z0-9_-]+)\s+rep\s+segment\s+(\d+)\s+interface\s+([A-Za-z0-9/._-]+)", flags=re.IGNORECASE)
+    span_pattern = re.compile(
+        r"set\s+([A-Za-z0-9_-]+)\s+(?:r?span)\s+(\d+)\s+source\s+([A-Za-z0-9/._-]+)\s+destination\s+([A-Za-z0-9/._-]+)",
+        flags=re.IGNORECASE,
+    )
+    for segment in _command_segments(prompt):
+        for device, vlan_id, trust_port in dhcp_snooping_pattern.findall(segment):
+            ops.append({"op": "set_dhcp_snooping", "device": device, "vlan": int(vlan_id), "trust_port": trust_port or None})
+        for device, vlan_id, trust_port in dai_pattern.findall(segment):
+            ops.append({"op": "set_dai", "device": device, "vlan": int(vlan_id), "trust_port": trust_port or None})
+        for device, port, maximum, violation in port_security_pattern.findall(segment):
+            ops.append(
+                {
+                    "op": "set_port_security",
+                    "device": device,
+                    "port": port,
+                    "maximum": int(maximum) if maximum else None,
+                    "violation": violation.lower() if violation else None,
+                }
+            )
+        for device in lldp_pattern.findall(segment):
+            ops.append({"op": "set_lldp", "device": device})
+        for device, segment_id, interface_name in rep_pattern.findall(segment):
+            ops.append({"op": "set_rep", "device": device, "segment": int(segment_id), "interface": interface_name})
+        for device, session, source, destination in span_pattern.findall(segment):
+            ops.append({"op": "set_span", "device": device, "session": int(session), "source": source, "destination": destination})
     return ops
 
 
@@ -570,6 +674,91 @@ def _extract_router_ops(prompt: str) -> list[dict[str, object]]:
     for segment in _command_segments(prompt):
         for acl_name, direction, device, interface_name in acl_apply_pattern.findall(segment):
             ops.append({"op": "apply_acl", "device": device.strip(), "acl_name": acl_name, "direction": direction.lower(), "interface": interface_name})
+    ipv6_unicast_pattern = re.compile(r"set\s+([A-Za-z0-9_-]+)\s+ipv6\s+unicast-routing", flags=re.IGNORECASE)
+    ipv6_address_pattern = re.compile(
+        r"set\s+([A-Za-z0-9_-]+)\s+(?:interface\s+)?([A-Za-z0-9/._-]+)\s+ipv6\s+([0-9A-Fa-f:]+)/(\d+)",
+        flags=re.IGNORECASE,
+    )
+    ipv6_slaac_pattern = re.compile(
+        r"set\s+([A-Za-z0-9_-]+)\s+slaac\s+on\s+([A-Za-z0-9/._-]+)(?:\s+prefix\s+([0-9A-Fa-f:]+)/(\d+))?",
+        flags=re.IGNORECASE,
+    )
+    dhcpv6_pattern = re.compile(
+        r"set\s+([A-Za-z0-9_-]+)\s+dhcpv6\s+pool\s+([A-Za-z0-9_-]+)\s+prefix\s+([0-9A-Fa-f:]+)/(\d+)\s+interface\s+([A-Za-z0-9/._-]+)"
+        r"(?:\s+dns\s+([0-9A-Fa-f:]+))?(?:\s+domain\s+([A-Za-z0-9._-]+))?",
+        flags=re.IGNORECASE,
+    )
+    ospfv3_pattern = re.compile(r"set\s+([A-Za-z0-9_-]+)\s+ospfv3\s+(\d+)\s+area\s+(\d+)\s+interface\s+([A-Za-z0-9/._-]+)", flags=re.IGNORECASE)
+    eigrp_ipv6_pattern = re.compile(r"set\s+([A-Za-z0-9_-]+)\s+eigrp\s+ipv6\s+(\d+)\s+interface\s+([A-Za-z0-9/._-]+)", flags=re.IGNORECASE)
+    ripng_pattern = re.compile(r"set\s+([A-Za-z0-9_-]+)\s+ripng\s+([A-Za-z0-9_-]+)\s+interface\s+([A-Za-z0-9/._-]+)", flags=re.IGNORECASE)
+    hsrp_pattern = re.compile(
+        r"set\s+([A-Za-z0-9_-]+)\s+hsrp\s+(\d+)\s+ipv6\s+([0-9A-Fa-f:]+)\s+interface\s+([A-Za-z0-9/._-]+)(?:\s+priority\s+(\d+))?",
+        flags=re.IGNORECASE,
+    )
+    snmp_pattern = re.compile(r"set\s+([A-Za-z0-9_-]+)\s+snmp\s+community\s+([A-Za-z0-9_-]+)\s+(ro|rw)", flags=re.IGNORECASE)
+    netflow_pattern = re.compile(
+        r"set\s+([A-Za-z0-9_-]+)\s+netflow\s+destination\s+(\d+\.\d+\.\d+\.\d+)\s+(\d+)(?:\s+version\s+(\d+))?(?:\s+interface\s+([A-Za-z0-9/._-]+)\s+(ingress|egress))?",
+        flags=re.IGNORECASE,
+    )
+    for segment in _command_segments(prompt):
+        for device in ipv6_unicast_pattern.findall(segment):
+            ops.append({"op": "enable_ipv6_unicast_routing", "device": device})
+        for device, interface_name, address, prefix in ipv6_address_pattern.findall(segment):
+            ops.append({"op": "set_ipv6_address", "device": device, "interface": interface_name, "address": address, "prefix": int(prefix)})
+        for device, interface_name, prefix_address, prefix_len in ipv6_slaac_pattern.findall(segment):
+            ops.append(
+                {
+                    "op": "set_ipv6_slaac",
+                    "device": device,
+                    "interface": interface_name,
+                    "prefix": prefix_address or None,
+                    "prefix_len": int(prefix_len) if prefix_len else None,
+                }
+            )
+        for device, name, prefix_address, prefix_len, interface_name, dns, domain in dhcpv6_pattern.findall(segment):
+            ops.append(
+                {
+                    "op": "set_dhcpv6_pool",
+                    "device": device,
+                    "name": name,
+                    "prefix": prefix_address,
+                    "prefix_len": int(prefix_len),
+                    "interface": interface_name,
+                    "dns": dns or None,
+                    "domain": domain or None,
+                }
+            )
+        for device, process_id, area, interface_name in ospfv3_pattern.findall(segment):
+            ops.append({"op": "set_ospfv3_interface", "device": device, "process_id": int(process_id), "area": int(area), "interface": interface_name})
+        for device, asn, interface_name in eigrp_ipv6_pattern.findall(segment):
+            ops.append({"op": "set_eigrp_ipv6_interface", "device": device, "asn": int(asn), "interface": interface_name})
+        for device, process_name, interface_name in ripng_pattern.findall(segment):
+            ops.append({"op": "set_ripng_interface", "device": device, "process_name": process_name, "interface": interface_name})
+        for device, group, virtual_ipv6, interface_name, priority in hsrp_pattern.findall(segment):
+            ops.append(
+                {
+                    "op": "set_hsrp_ipv6",
+                    "device": device,
+                    "group": int(group),
+                    "virtual_ipv6": virtual_ipv6,
+                    "interface": interface_name,
+                    "priority": int(priority) if priority else None,
+                }
+            )
+        for device, community, mode in snmp_pattern.findall(segment):
+            ops.append({"op": "set_snmp_community", "device": device, "community": community, "mode": mode.lower()})
+        for device, destination, port, version, interface_name, direction in netflow_pattern.findall(segment):
+            ops.append(
+                {
+                    "op": "set_netflow",
+                    "device": device,
+                    "destination": destination,
+                    "port": int(port),
+                    "version": int(version) if version else 9,
+                    "interface": interface_name or None,
+                    "direction": direction.lower() if direction else None,
+                }
+            )
     return ops
 
 
@@ -630,14 +819,31 @@ def _extract_management_ops(prompt: str) -> list[dict[str, object]]:
 def _extract_wireless_ops(prompt: str) -> list[dict[str, object]]:
     ops: list[dict[str, object]] = []
     ssid_pattern = re.compile(
-        r"set\s+([A-Za-z0-9_ -]+?)\s+ssid\s+([A-Za-z0-9._-]+)(?:\s+security\s+([A-Za-z0-9.-]+))?(?:\s+passphrase\s+([A-Za-z0-9._-]+))?(?:\s+channel\s+(\d+))?",
+        r"set\s+([A-Za-z0-9_ -]+?)\s+ssid\s+([A-Za-z0-9._-]+)"
+        r"(?:\s+security\s+(wpa2?\s+enterprise|wpa2?-enterprise|wpa2?-psk|802\.1x|wep|open|wpa2?|wpa))?"
+        r"(?:\s+passphrase\s+([A-Za-z0-9._-]+))?"
+        r"(?:\s+radius\s+(\d+\.\d+\.\d+\.\d+)\s+secret\s+([A-Za-z0-9._-]+))?"
+        r"(?:\s+channel\s+(\d+))?",
         flags=re.IGNORECASE,
     )
     for segment in _command_segments(prompt):
-        for device, ssid, security, passphrase, channel in ssid_pattern.findall(segment):
-            security_key = (security or "open").lower()
+        for device, ssid, security, passphrase, radius_server, radius_secret, channel in ssid_pattern.findall(segment):
+            security_key = (security or "open").lower().replace(" ", "-")
             auth_type, encrypt_type = SECURITY_TO_AUTH.get(security_key, ("0", "0"))
-            ops.append({"op": "set_wireless_ssid", "device": device.strip(), "ssid": ssid, "security": security_key, "auth_type": auth_type, "encrypt_type": encrypt_type, "passphrase": passphrase or "", "channel": int(channel) if channel else 1})
+            operation = {
+                "op": "set_wireless_ssid",
+                "device": device.strip(),
+                "ssid": ssid,
+                "security": security_key,
+                "auth_type": auth_type,
+                "encrypt_type": encrypt_type,
+                "passphrase": passphrase or "",
+                "channel": int(channel) if channel else 1,
+            }
+            if radius_server:
+                operation["radius_server"] = radius_server
+                operation["radius_secret"] = radius_secret or ""
+            ops.append(operation)
     assoc_pattern = re.compile(r"associate\s+([A-Za-z0-9_ -]+?)\s+to\s+([A-Za-z0-9_ -]+?)\s+ssid\s+([A-Za-z0-9._-]+)(?:\s+(dhcp|static))?", flags=re.IGNORECASE)
     for segment in _command_segments(prompt):
         for client, ap, ssid, ip_mode in assoc_pattern.findall(segment):
@@ -739,6 +945,22 @@ def parse_intent(prompt: str) -> IntentPlan:
     host_link_intent = _extract_host_link_intent(normalized_prompt)
     host_vlan_assignment = _extract_host_vlan_assignment(normalized_prompt)
     network_style = _extract_network_style(normalized_prompt)
+    if (
+        network_style == "wireless_advanced"
+        and "server_aaa" in capability_set
+        and re.search(r"\bradius\b", lowered)
+        and not re.search(r"\b(?:aaa|acs|server aaa|aaa server)\b", lowered)
+    ):
+        capability_set.discard("server_aaa")
+    if re.search(r"\bqos\b", lowered) and (
+        re.search(r"\b(?:snmp|netflow|span|rspan|lldp|rep|dai|dot1x|802\.1x|dhcp snooping|port-security|port security)\b", lowered)
+        or network_style == "l2_security_monitoring"
+    ):
+        capability_set.add("qos")
+    if "dhcp_snooping" in capability_set and not re.search(r"\b(?:dhcp\s+pool|server\s+dhcp|dhcp\s+server|default-router)\b", lowered):
+        capability_set.discard("dhcp_pool")
+        capability_set.discard("router_dhcp")
+        capability_set.discard("server_dhcp")
     department_count = _extract_department_count(normalized_prompt)
     per_department_devices = _extract_per_department_devices(normalized_prompt)
 
@@ -793,12 +1015,61 @@ def parse_intent(prompt: str) -> IntentPlan:
         capability_set.update({"wireless_client", "wireless_client_association"})
     if any(op["op"] == "set_wireless_ssid" for op in wireless_ops):
         capability_set.update({"wireless_ap", "wireless_mutation"})
+        for op in wireless_ops:
+            if op.get("op") != "set_wireless_ssid":
+                continue
+            security = str(op.get("security") or "")
+            if security == "wep":
+                capability_set.add("wep")
+            if security in {"wpa-enterprise", "wpa2-enterprise", "802.1x"} or op.get("radius_server"):
+                capability_set.add("wpa_enterprise")
+    elif network_style == "wireless_advanced":
+        capability_set.discard("wireless_ap")
+        capability_set.discard("wireless_mutation")
     if end_device_ops:
         capability_set.add("end_device_mutation")
     if iot_ops:
         capability_set.update({"iot", "iot_registration"})
-    if capability_set & {"vpn", "ipsec", "gre", "ppp"}:
+    switch_op_names = {str(op.get("op")) for op in switch_ops}
+    if "set_dhcp_snooping" in switch_op_names:
+        capability_set.add("dhcp_snooping")
+    if "set_dai" in switch_op_names:
+        capability_set.add("dai")
+    if "set_lldp" in switch_op_names:
+        capability_set.add("lldp")
+    if "set_rep" in switch_op_names:
+        capability_set.add("rep")
+    if "set_span" in switch_op_names:
+        capability_set.add("span")
+    if "set_port_security" in switch_op_names:
+        capability_set.add("port_security")
+    router_op_names = {str(op.get("op")) for op in router_ops}
+    if "set_snmp_community" in router_op_names:
+        capability_set.add("snmp")
+    if "set_netflow" in router_op_names:
+        capability_set.add("netflow")
+    if router_op_names & {"enable_ipv6_unicast_routing", "set_ipv6_address", "set_ipv6_slaac"}:
+        capability_set.add("ipv6_slaac")
+    if "set_dhcpv6_pool" in router_op_names:
+        capability_set.add("dhcpv6_stateful")
+    if "set_ospfv3_interface" in router_op_names:
+        capability_set.add("ospfv3")
+    if "set_eigrp_ipv6_interface" in router_op_names:
+        capability_set.add("eigrp_ipv6")
+    if "set_ripng_interface" in router_op_names:
+        capability_set.add("ripng")
+    if "set_hsrp_ipv6" in router_op_names:
+        capability_set.add("hsrp")
+    if capability_set & {"vpn", "ipsec", "gre", "ppp", "security_edge"}:
         network_style = network_style or "wan_security"
+    if capability_set & {"ipv6_slaac", "dhcpv6_stateful", "dhcpv6_stateless", "ospfv3", "eigrp_ipv6", "ripng", "hsrp"}:
+        network_style = network_style or "ipv6_routing"
+    if capability_set & {"dhcp_snooping", "dai", "dot1x", "lldp", "rep", "snmp", "netflow", "span", "qos", "port_security"}:
+        network_style = network_style or "l2_security_monitoring"
+    if capability_set & {"wlc", "wpa_enterprise", "wep", "guest_wifi", "beamforming", "meraki", "cellular_5g", "bluetooth"}:
+        network_style = "wireless_advanced"
+    if capability_set & {"mqtt", "real_http", "real_websocket", "visual_scripting", "ptp", "profinet", "l2nat", "cyberobserver", "industrial_firewall"}:
+        network_style = "industrial_iot"
 
     capabilities = sorted(capability_set)
 

package/scripts/pkt_editor.py

@@ -277,6 +277,64 @@ def inventory_management(root: ET.Element) -> dict[str, dict[str, object]]:
     return result
 
 
+def inventory_routing(root: ET.Element) -> dict[str, dict[str, object]]:
+    result: dict[str, dict[str, object]] = {}
+    for device in root.findall(".//DEVICES/DEVICE"):
+        name = device.findtext("./ENGINE/NAME", default="")
+        running = "\n".join(line.text or "" for line in device.findall("./ENGINE/RUNNINGCONFIG/LINE"))
+        if not running:
+            continue
+        capabilities: set[str] = set()
+        if re.search(r"(?mi)^\s*ipv6\s+unicast-routing\s*$", running) or re.search(r"(?mi)^\s*ipv6\s+(?:enable|address)\b", running):
+            capabilities.add("ipv6_slaac")
+        if re.search(r"(?mi)^\s*ipv6\s+dhcp\s+pool\b", running) or re.search(r"(?mi)^\s*ipv6\s+dhcp\s+server\b", running):
+            capabilities.add("dhcpv6_stateful")
+        if re.search(r"(?mi)^\s*ipv6\s+ospf\b", running) or re.search(r"(?mi)^\s*ipv6\s+router\s+ospf\b", running):
+            capabilities.add("ospfv3")
+        if re.search(r"(?mi)^\s*ipv6\s+eigrp\b", running) or re.search(r"(?mi)^\s*ipv6\s+router\s+eigrp\b", running):
+            capabilities.add("eigrp_ipv6")
+        if re.search(r"(?mi)^\s*ipv6\s+rip\b", running):
+            capabilities.add("ripng")
+        if re.search(r"(?mi)^\s*standby\s+\d+\s+ipv6\b", running):
+            capabilities.add("hsrp")
+        if capabilities:
+            result[name] = {"capabilities": sorted(capabilities)}
+    return result
+
+
+def inventory_l2_security_monitoring(root: ET.Element) -> dict[str, dict[str, object]]:
+    result: dict[str, dict[str, object]] = {}
+    for device in root.findall(".//DEVICES/DEVICE"):
+        name = device.findtext("./ENGINE/NAME", default="")
+        running = "\n".join(line.text or "" for line in device.findall("./ENGINE/RUNNINGCONFIG/LINE"))
+        if not running:
+            continue
+        capabilities: set[str] = set()
+        if re.search(r"(?mi)^\s*ip\s+dhcp\s+snooping\b", running):
+            capabilities.add("dhcp_snooping")
+        if re.search(r"(?mi)^\s*ip\s+arp\s+inspection\b", running):
+            capabilities.add("dai")
+        if re.search(r"(?mi)^\s*(?:aaa\s+new-model|radius-server\s+host|authentication\s+port-control|dot1x\b)", running):
+            capabilities.add("dot1x")
+        if re.search(r"(?mi)^\s*lldp\s+run\b", running):
+            capabilities.add("lldp")
+        if re.search(r"(?mi)^\s*rep\s+segment\b", running):
+            capabilities.add("rep")
+        if re.search(r"(?mi)^\s*snmp-server\b", running):
+            capabilities.add("snmp")
+        if re.search(r"(?mi)^\s*ip\s+flow-export\b", running) or re.search(r"(?mi)^\s*ip\s+flow\s+(?:ingress|egress)\b", running):
+            capabilities.add("netflow")
+        if re.search(r"(?mi)^\s*monitor\s+session\b", running):
+            capabilities.add("span")
+        if re.search(r"(?mi)^\s*(?:mls\s+qos|auto\s+qos|class-map|policy-map|service-policy)\b", running):
+            capabilities.add("qos")
+        if re.search(r"(?mi)^\s*switchport\s+port-security\b", running):
+            capabilities.add("port_security")
+        if capabilities:
+            result[name] = {"capabilities": sorted(capabilities)}
+    return result
+
+
 def inventory_topology_summary(root: ET.Element) -> dict[str, object]:
     devices = inventory_devices(root)
     counts: dict[str, int] = {}
@@ -303,6 +361,8 @@ def inventory_root(root: ET.Element) -> dict[str, object]:
         "dhcp_pools": inventory_dhcp_pools(root),
         "acl_names": inventory_acl_names(root),
         "management": inventory_management(root),
+        "routing": inventory_routing(root),
+        "l2_security_monitoring": inventory_l2_security_monitoring(root),
         "topology_summary": inventory_topology_summary(root),
     }
 
@@ -702,6 +762,45 @@ def _apply_switch_op(device: ET.Element, operation: dict[str, object]) -> None:
         for target in _config_targets(device):
             _append_config_block(target, f"interface {operation['port']}", body)
         return
+    elif operation["op"] == "set_dhcp_snooping":
+        for target in _config_targets(device):
+            _append_unique_config_lines(target, ["ip dhcp snooping", f"ip dhcp snooping vlan {operation['vlan']}"])
+            if operation.get("trust_port"):
+                _append_config_block(target, f"interface {operation['trust_port']}", [" ip dhcp snooping trust"])
+        return
+    elif operation["op"] == "set_dai":
+        for target in _config_targets(device):
+            _append_unique_config_lines(target, ["ip dhcp snooping", f"ip dhcp snooping vlan {operation['vlan']}", f"ip arp inspection vlan {operation['vlan']}"])
+            if operation.get("trust_port"):
+                _append_config_block(target, f"interface {operation['trust_port']}", [" ip arp inspection trust", " ip dhcp snooping trust"])
+        return
+    elif operation["op"] == "set_port_security":
+        body = [" switchport mode access", " switchport port-security"]
+        if operation.get("maximum"):
+            body.append(f" switchport port-security maximum {operation['maximum']}")
+        if operation.get("violation"):
+            body.append(f" switchport port-security violation {operation['violation']}")
+        for target in _config_targets(device):
+            _append_config_block(target, f"interface {operation['port']}", body)
+        return
+    elif operation["op"] == "set_lldp":
+        for target in _config_targets(device):
+            _append_unique_config_lines(target, ["lldp run"])
+        return
+    elif operation["op"] == "set_rep":
+        for target in _config_targets(device):
+            _append_config_block(target, f"interface {operation['interface']}", [f" rep segment {operation['segment']}"])
+        return
+    elif operation["op"] == "set_span":
+        for target in _config_targets(device):
+            _append_unique_config_lines(
+                target,
+                [
+                    f"monitor session {operation['session']} source interface {operation['source']}",
+                    f"monitor session {operation['session']} destination interface {operation['destination']}",
+                ],
+            )
+        return
     else:
         return
 
@@ -742,6 +841,81 @@ def _apply_router_op(device: ET.Element, operation: dict[str, object]) -> None:
         for target in _config_targets(device):
             _append_config_block(target, f"interface {operation['interface']}", [f" ip access-group {operation['acl_name']} {operation['direction']}"])
         return
+    elif operation["op"] == "enable_ipv6_unicast_routing":
+        for target in _config_targets(device):
+            _append_unique_config_lines(target, ["ipv6 unicast-routing"])
+        return
+    elif operation["op"] == "set_ipv6_address":
+        for target in _config_targets(device):
+            _append_unique_config_lines(target, ["ipv6 unicast-routing"])
+            _append_config_block(
+                target,
+                f"interface {operation['interface']}",
+                [f" ipv6 address {operation['address']}/{operation['prefix']}", " no shutdown"],
+            )
+        return
+    elif operation["op"] == "set_ipv6_slaac":
+        body = [" ipv6 enable", " no shutdown"]
+        if operation.get("prefix") and operation.get("prefix_len"):
+            body.insert(1, f" ipv6 nd prefix {operation['prefix']}/{operation['prefix_len']}")
+        for target in _config_targets(device):
+            _append_unique_config_lines(target, ["ipv6 unicast-routing"])
+            _append_config_block(target, f"interface {operation['interface']}", body)
+        return
+    elif operation["op"] == "set_dhcpv6_pool":
+        pool_body = [f" address prefix {operation['prefix']}/{operation['prefix_len']}"]
+        if operation.get("dns"):
+            pool_body.append(f" dns-server {operation['dns']}")
+        if operation.get("domain"):
+            pool_body.append(f" domain-name {operation['domain']}")
+        interface_body = [f" ipv6 dhcp server {operation['name']}", " ipv6 nd managed-config-flag", " no shutdown"]
+        for target in _config_targets(device):
+            _append_unique_config_lines(target, ["ipv6 unicast-routing"])
+            _append_config_block(target, f"ipv6 dhcp pool {operation['name']}", pool_body)
+            _append_config_block(target, f"interface {operation['interface']}", interface_body)
+        return
+    elif operation["op"] == "set_ospfv3_interface":
+        process_id = operation["process_id"]
+        for target in _config_targets(device):
+            _append_unique_config_lines(target, ["ipv6 unicast-routing"])
+            _append_config_block(target, f"interface {operation['interface']}", [f" ipv6 ospf {process_id} area {operation['area']}", " no shutdown"])
+            _append_config_block(target, f"ipv6 router ospf {process_id}", [])
+        return
+    elif operation["op"] == "set_eigrp_ipv6_interface":
+        asn = operation["asn"]
+        for target in _config_targets(device):
+            _append_unique_config_lines(target, ["ipv6 unicast-routing", "no ipv6 cef"])
+            _append_config_block(target, f"interface {operation['interface']}", [f" ipv6 eigrp {asn}", " no shutdown"])
+            _append_config_block(target, f"ipv6 router eigrp {asn}", [" no shutdown"])
+        return
+    elif operation["op"] == "set_ripng_interface":
+        for target in _config_targets(device):
+            _append_unique_config_lines(target, ["ipv6 unicast-routing"])
+            _append_config_block(target, f"interface {operation['interface']}", [f" ipv6 rip {operation['process_name']} enable", " no shutdown"])
+        return
+    elif operation["op"] == "set_hsrp_ipv6":
+        body = [" standby version 2", f" standby {operation['group']} ipv6 {operation['virtual_ipv6']}"]
+        if operation.get("priority"):
+            body.append(f" standby {operation['group']} priority {operation['priority']}")
+            body.append(f" standby {operation['group']} preempt")
+        for target in _config_targets(device):
+            _append_unique_config_lines(target, ["ipv6 unicast-routing"])
+            _append_config_block(target, f"interface {operation['interface']}", body)
+        return
+    elif operation["op"] == "set_snmp_community":
+        for target in _config_targets(device):
+            _append_unique_config_lines(target, [f"snmp-server community {operation['community']} {operation['mode']}"])
+        return
+    elif operation["op"] == "set_netflow":
+        global_lines = [
+            f"ip flow-export destination {operation['destination']} {operation['port']}",
+            f"ip flow-export version {operation['version']}",
+        ]
+        for target in _config_targets(device):
+            _append_unique_config_lines(target, global_lines)
+            if operation.get("interface") and operation.get("direction"):
+                _append_config_block(target, f"interface {operation['interface']}", [f" ip flow {operation['direction']}"])
+        return
     else:
         return
     for target in _config_targets(device):