packet-tracer-skill 0.2.1 → 0.2.3

package/scripts/pkt_editor.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import copy
+import hashlib
 import json
 import re
 from pathlib import Path
@@ -189,6 +190,88 @@ def inventory_iot(root: ET.Element) -> dict[str, dict[str, object]]:
     return result
 
 
+def _script_language(app_name: str, file_name: str, content: str) -> str:
+    lowered = " ".join([app_name.lower(), file_name.lower(), content[:500].lower()])
+    if file_name.lower().endswith(".py") or "python" in lowered:
+        return "python"
+    if file_name.lower().endswith(".js") or "javascript" in lowered:
+        return "javascript"
+    if file_name.lower().endswith(".visual") or "<xml" in lowered or "blockly" in lowered:
+        return "visual"
+    return "unknown"
+
+
+def _script_feature_tags(app_name: str, file_name: str, content: str) -> list[str]:
+    lowered = " ".join([app_name.lower(), file_name.lower(), content.lower()])
+    tags: set[str] = set()
+    if "mqtt" in lowered:
+        tags.add("mqtt")
+    if "realhttp" in lowered or "real http" in lowered:
+        tags.add("real_http")
+    if "realws" in lowered or "websocket" in lowered:
+        tags.add("real_websocket")
+    language = _script_language(app_name, file_name, content)
+    if language == "python":
+        tags.add("python_programming")
+    if language == "javascript":
+        tags.add("javascript_programming")
+    if language == "visual":
+        tags.add("blockly_programming")
+    if "tcp" in lowered or "udp" in lowered:
+        tags.add("tcp_udp_app")
+    return sorted(tags)
+
+
+def _file_text(file_node: ET.Element) -> str:
+    return file_node.findtext("./FILE_CONTENT/TEXT", default="")
+
+
+def inventory_programming(root: ET.Element) -> dict[str, dict[str, object]]:
+    result: dict[str, dict[str, object]] = {}
+    for device in root.findall(".//DEVICES/DEVICE"):
+        device_name = device.findtext("./ENGINE/NAME", default="")
+        apps: list[dict[str, object]] = []
+        for directory in device.findall(".//FILE[@class='CDirectory']"):
+            app_name = directory.findtext("NAME", default="").strip()
+            if not app_name:
+                continue
+            files: list[dict[str, object]] = []
+            app_tags: set[str] = set()
+            for file_node in directory.findall(".//FILE[@class='CFile']"):
+                file_name = file_node.findtext("NAME", default="").strip()
+                content = _file_text(file_node)
+                if not file_name or not content:
+                    continue
+                language = _script_language(app_name, file_name, content)
+                feature_tags = _script_feature_tags(app_name, file_name, content)
+                app_tags.update(feature_tags)
+                files.append(
+                    {
+                        "name": file_name,
+                        "language": language,
+                        "content_length": len(content),
+                        "content_sha256": hashlib.sha256(content.encode("utf-8")).hexdigest(),
+                        "feature_tags": feature_tags,
+                    }
+                )
+            if files:
+                apps.append(
+                    {
+                        "app_name": app_name,
+                        "file_count": len(files),
+                        "feature_tags": sorted(app_tags),
+                        "files": files,
+                    }
+                )
+        if apps:
+            result[device_name] = {
+                "app_count": len(apps),
+                "feature_tags": sorted({tag for app in apps for tag in list(app.get("feature_tags", []))}),
+                "apps": apps,
+            }
+    return result
+
+
 def inventory_vlans(root: ET.Element) -> dict[str, list[dict[str, str]]]:
     result: dict[str, list[dict[str, str]]] = {}
     for device in root.findall(".//DEVICES/DEVICE"):
@@ -277,6 +360,184 @@ def inventory_management(root: ET.Element) -> dict[str, dict[str, object]]:
     return result
 
 
+def inventory_routing(root: ET.Element) -> dict[str, dict[str, object]]:
+    result: dict[str, dict[str, object]] = {}
+    for device in root.findall(".//DEVICES/DEVICE"):
+        name = device.findtext("./ENGINE/NAME", default="")
+        running = "\n".join(line.text or "" for line in device.findall("./ENGINE/RUNNINGCONFIG/LINE"))
+        if not running:
+            continue
+        capabilities: set[str] = set()
+        if re.search(r"(?mi)^\s*ipv6\s+unicast-routing\s*$", running) or re.search(r"(?mi)^\s*ipv6\s+(?:enable|address)\b", running):
+            capabilities.add("ipv6_slaac")
+        if re.search(r"(?mi)^\s*ipv6\s+dhcp\s+pool\b", running) or re.search(r"(?mi)^\s*ipv6\s+dhcp\s+server\b", running):
+            capabilities.add("dhcpv6_stateful")
+        if re.search(r"(?mi)^\s*ipv6\s+ospf\b", running) or re.search(r"(?mi)^\s*ipv6\s+router\s+ospf\b", running):
+            capabilities.add("ospfv3")
+        if re.search(r"(?mi)^\s*ipv6\s+eigrp\b", running) or re.search(r"(?mi)^\s*ipv6\s+router\s+eigrp\b", running):
+            capabilities.add("eigrp_ipv6")
+        if re.search(r"(?mi)^\s*ipv6\s+rip\b", running):
+            capabilities.add("ripng")
+        if re.search(r"(?mi)^\s*standby\s+\d+\s+ipv6\b", running):
+            capabilities.add("hsrp")
+        if re.search(r"(?mi)^\s*interface\s+Tunnel\d+\b", running) or re.search(r"(?mi)^\s*tunnel\s+(?:source|destination|mode\s+gre)\b", running):
+            capabilities.add("gre")
+        if re.search(r"(?mi)^\s*encapsulation\s+ppp\b", running):
+            capabilities.add("ppp")
+        if re.search(r"(?mi)^\s*crypto\s+ipsec\s+transform-set\b", running) or re.search(r"(?mi)^\s*crypto\s+map\b", running):
+            capabilities.add("ipsec")
+        if re.search(r"(?mi)^\s*crypto\s+map\b", running):
+            capabilities.add("vpn")
+        if re.search(r"(?mi)^\s*ip\s+inspect\s+name\b", running):
+            capabilities.add("cbac")
+        if (
+            re.search(r"(?mi)^zone\s+security\b", running)
+            or re.search(r"(?mi)^zone-pair\s+security\b", running)
+            or re.search(r"(?mi)^class-map\s+type\s+inspect\b", running)
+            or re.search(r"(?mi)^policy-map\s+type\s+inspect\b", running)
+        ):
+            capabilities.add("zfw")
+        if capabilities:
+            result[name] = {"capabilities": sorted(capabilities)}
+    return result
+
+
+def inventory_ipv4_routing_management(root: ET.Element) -> dict[str, dict[str, object]]:
+    result: dict[str, dict[str, object]] = {}
+    for device in root.findall(".//DEVICES/DEVICE"):
+        name = device.findtext("./ENGINE/NAME", default="")
+        running = "\n".join(line.text or "" for line in device.findall("./ENGINE/RUNNINGCONFIG/LINE"))
+        if not running:
+            continue
+        capabilities: set[str] = set()
+        if re.search(r"(?mi)^\s*router\s+ospf\s+\d+\s*$", running):
+            capabilities.add("ospfv2")
+        if re.search(r"(?mi)^\s*router\s+eigrp\s+\d+\s*$", running):
+            capabilities.add("eigrp_ipv4")
+        if re.search(r"(?mi)^\s*router\s+rip\s*$", running):
+            capabilities.add("ripv2")
+        if re.search(r"(?mi)^\s*ip\s+route\s+\S+\s+\S+\s+\S+", running):
+            capabilities.add("static_route")
+        if re.search(r"(?mi)^\s*ip\s+route\s+0\.0\.0\.0\s+0\.0\.0\.0\s+\S+", running):
+            capabilities.add("default_route")
+        if re.search(r"(?mi)^\s*ip\s+helper-address\s+\d+\.\d+\.\d+\.\d+\s*$", running):
+            capabilities.add("dhcp_relay")
+        if re.search(r"(?mi)^\s*ip\s+nat\s+inside\s+source\s+static\b", running):
+            capabilities.update({"nat_static", "nat"})
+        if re.search(r"(?mi)^\s*ip\s+nat\s+inside\s+source\s+(?:list|route-map)\b", running):
+            capabilities.update({"nat_dynamic", "nat"})
+        if re.search(r"(?mi)^\s*ip\s+nat\s+inside\s+source\s+list\s+\S+\s+interface\s+\S+\s+overload\b", running):
+            capabilities.update({"pat", "nat"})
+        if re.search(r"(?mi)^\s*ip\s+ssh\b", running) or re.search(r"(?mi)^\s*crypto\s+key\s+generate\s+rsa\b", running):
+            capabilities.add("ssh_ios")
+        if re.search(r"(?mi)^\s*ntp\s+server\s+\d+\.\d+\.\d+\.\d+\s*$", running):
+            capabilities.add("ntp_ios")
+        if re.search(r"(?mi)^\s*logging\s+host\s+\d+\.\d+\.\d+\.\d+\s*$", running):
+            capabilities.add("syslog_ios")
+        if capabilities:
+            result[name] = {"capabilities": sorted(capabilities)}
+    return result
+
+
+def inventory_l2_security_monitoring(root: ET.Element) -> dict[str, dict[str, object]]:
+    result: dict[str, dict[str, object]] = {}
+    for device in root.findall(".//DEVICES/DEVICE"):
+        name = device.findtext("./ENGINE/NAME", default="")
+        running = "\n".join(line.text or "" for line in device.findall("./ENGINE/RUNNINGCONFIG/LINE"))
+        if not running:
+            continue
+        capabilities: set[str] = set()
+        if re.search(r"(?mi)^\s*ip\s+dhcp\s+snooping\b", running):
+            capabilities.add("dhcp_snooping")
+        if re.search(r"(?mi)^\s*ip\s+arp\s+inspection\b", running):
+            capabilities.add("dai")
+        if re.search(r"(?mi)^\s*(?:aaa\s+new-model|radius-server\s+host|authentication\s+port-control|dot1x\b)", running):
+            capabilities.add("dot1x")
+        if re.search(r"(?mi)^\s*lldp\s+run\b", running):
+            capabilities.add("lldp")
+        if re.search(r"(?mi)^\s*rep\s+segment\b", running):
+            capabilities.add("rep")
+        if re.search(r"(?mi)^\s*snmp-server\b", running):
+            capabilities.add("snmp")
+        if re.search(r"(?mi)^\s*ip\s+flow-export\b", running) or re.search(r"(?mi)^\s*ip\s+flow\s+(?:ingress|egress)\b", running):
+            capabilities.add("netflow")
+        if re.search(r"(?mi)^\s*monitor\s+session\b", running):
+            capabilities.add("span")
+        if re.search(r"(?mi)^\s*(?:mls\s+qos|auto\s+qos|class-map|policy-map|service-policy)\b", running):
+            capabilities.add("qos")
+        if re.search(r"(?mi)^\s*switchport\s+port-security\b", running):
+            capabilities.add("port_security")
+        if capabilities:
+            result[name] = {"capabilities": sorted(capabilities)}
+    return result
+
+
+def inventory_l2_resiliency_routing(root: ET.Element) -> dict[str, dict[str, object]]:
+    result: dict[str, dict[str, object]] = {}
+    for device in root.findall(".//DEVICES/DEVICE"):
+        name = device.findtext("./ENGINE/NAME", default="")
+        running = "\n".join(line.text or "" for line in device.findall("./ENGINE/RUNNINGCONFIG/LINE"))
+        if not running:
+            continue
+        capabilities: set[str] = set()
+        if re.search(r"(?mi)^\s*router\s+bgp\s+\d+\s*$", running) or re.search(r"(?mi)^\s*neighbor\s+\S+\s+remote-as\s+\d+\s*$", running):
+            capabilities.add("bgp")
+        if re.search(r"(?mi)^\s*spanning-tree\b", running):
+            capabilities.add("stp")
+        if re.search(r"(?mi)^\s*spanning-tree\s+mode\s+(?:rapid-pvst|rstp)\b", running) or re.search(r"(?mi)\brapid-pvst\b", running):
+            capabilities.add("rstp")
+        if re.search(r"(?mi)^\s*interface\s+Port-channel\d+\b", running) or re.search(r"(?mi)^\s*channel-group\s+\d+\s+mode\b", running):
+            capabilities.add("etherchannel")
+        if re.search(r"(?mi)^\s*channel-group\s+\d+\s+mode\s+(?:active|passive)\b", running):
+            capabilities.add("lacp")
+        if re.search(r"(?mi)^\s*channel-group\s+\d+\s+mode\s+(?:desirable|auto)\b", running):
+            capabilities.add("pagp")
+        if re.search(r"(?mi)^\s*vtp\s+(?:domain|mode|version)\b", running):
+            capabilities.add("vtp")
+        if re.search(r"(?mi)^\s*switchport\s+mode\s+dynamic\s+(?:desirable|auto)\b", running) or re.search(r"(?mi)^\s*switchport\s+nonegotiate\b", running):
+            capabilities.add("dtp")
+        if capabilities:
+            result[name] = {"capabilities": sorted(capabilities)}
+    return result
+
+
+def inventory_voice(root: ET.Element) -> dict[str, dict[str, object]]:
+    result: dict[str, dict[str, object]] = {}
+    for device in root.findall(".//DEVICES/DEVICE"):
+        name = device.findtext("./ENGINE/NAME", default="")
+        device_type = _device_type(device)
+        model = device.find("./ENGINE/TYPE").get("model", "") if device.find("./ENGINE/TYPE") is not None else ""
+        running = "\n".join(line.text or "" for line in device.findall("./ENGINE/RUNNINGCONFIG/LINE"))
+        capabilities: set[str] = set()
+        details: dict[str, object] = {"device_type": device_type, "model": model}
+        if device_type in {"IpPhone", "HomeVoip", "AnalogPhone"}:
+            capabilities.add("voip")
+            if device_type == "IpPhone":
+                capabilities.add("ip_phone")
+        if running:
+            extensions = sorted(dict.fromkeys(re.findall(r"(?mi)^\s*number\s+([A-Za-z0-9*+#.-]+)\s*$", running)))
+            ephones = sorted(dict.fromkeys(re.findall(r"(?mi)^ephone\s+(\d+)\s*$", running)), key=int)
+            dial_peers = sorted(dict.fromkeys(re.findall(r"(?mi)^dial-peer\s+voice\s+(\d+)\b", running)), key=int)
+            source_match = re.search(r"(?mi)^\s*ip\s+source-address\s+(\d+\.\d+\.\d+\.\d+)\s+port\s+(\d+)\s*$", running)
+            if re.search(r"(?mi)^telephony-service\s*$", running) or extensions or ephones:
+                capabilities.update({"voip", "call_manager", "ip_phone"})
+            if dial_peers:
+                capabilities.add("voip")
+            if extensions:
+                details["extensions"] = extensions
+            if ephones:
+                details["ephones"] = ephones
+            if dial_peers:
+                details["dial_peers"] = dial_peers
+            if source_match:
+                details["source_address"] = source_match.group(1)
+                details["source_port"] = int(source_match.group(2))
+        if capabilities:
+            details["capabilities"] = sorted(capabilities)
+            result[name] = details
+    return result
+
+
 def inventory_topology_summary(root: ET.Element) -> dict[str, object]:
     devices = inventory_devices(root)
     counts: dict[str, int] = {}
@@ -303,6 +564,12 @@ def inventory_root(root: ET.Element) -> dict[str, object]:
         "dhcp_pools": inventory_dhcp_pools(root),
         "acl_names": inventory_acl_names(root),
         "management": inventory_management(root),
+        "routing": inventory_routing(root),
+        "ipv4_routing_management": inventory_ipv4_routing_management(root),
+        "l2_security_monitoring": inventory_l2_security_monitoring(root),
+        "l2_resiliency_routing": inventory_l2_resiliency_routing(root),
+        "voice": inventory_voice(root),
+        "programming": inventory_programming(root),
         "topology_summary": inventory_topology_summary(root),
     }
 
@@ -702,6 +969,105 @@ def _apply_switch_op(device: ET.Element, operation: dict[str, object]) -> None:
         for target in _config_targets(device):
             _append_config_block(target, f"interface {operation['port']}", body)
         return
+    elif operation["op"] == "set_dhcp_snooping":
+        for target in _config_targets(device):
+            _append_unique_config_lines(target, ["ip dhcp snooping", f"ip dhcp snooping vlan {operation['vlan']}"])
+            if operation.get("trust_port"):
+                _append_config_block(target, f"interface {operation['trust_port']}", [" ip dhcp snooping trust"])
+        return
+    elif operation["op"] == "set_dai":
+        for target in _config_targets(device):
+            _append_unique_config_lines(target, ["ip dhcp snooping", f"ip dhcp snooping vlan {operation['vlan']}", f"ip arp inspection vlan {operation['vlan']}"])
+            if operation.get("trust_port"):
+                _append_config_block(target, f"interface {operation['trust_port']}", [" ip arp inspection trust", " ip dhcp snooping trust"])
+        return
+    elif operation["op"] == "set_port_security":
+        body = [" switchport mode access", " switchport port-security"]
+        if operation.get("maximum"):
+            body.append(f" switchport port-security maximum {operation['maximum']}")
+        if operation.get("violation"):
+            body.append(f" switchport port-security violation {operation['violation']}")
+        for target in _config_targets(device):
+            _append_config_block(target, f"interface {operation['port']}", body)
+        return
+    elif operation["op"] == "set_lldp":
+        for target in _config_targets(device):
+            _append_unique_config_lines(target, ["lldp run"])
+        return
+    elif operation["op"] == "set_rep":
+        for target in _config_targets(device):
+            _append_config_block(target, f"interface {operation['interface']}", [f" rep segment {operation['segment']}"])
+        return
+    elif operation["op"] == "set_span":
+        for target in _config_targets(device):
+            _append_unique_config_lines(
+                target,
+                [
+                    f"monitor session {operation['session']} source interface {operation['source']}",
+                    f"monitor session {operation['session']} destination interface {operation['destination']}",
+                ],
+            )
+        return
+    elif operation["op"] == "set_dot1x":
+        global_lines = ["aaa new-model", "dot1x system-auth-control"]
+        if operation.get("radius_host") and operation.get("radius_key"):
+            global_lines.append(f"radius-server host {operation['radius_host']} key {operation['radius_key']}")
+        mode = str(operation.get("mode") or "auto")
+        for target in _config_targets(device):
+            _append_unique_config_lines(target, global_lines)
+            _append_config_block(
+                target,
+                f"interface {operation['interface']}",
+                [f" authentication port-control {mode}", " dot1x pae authenticator"],
+            )
+        return
+    elif operation["op"] == "set_qos_policy":
+        action = str(operation.get("action") or "priority")
+        for target in _config_targets(device):
+            _append_unique_config_lines(target, ["mls qos"])
+            _append_config_block(
+                target,
+                f"class-map match-any {operation['class_map']}",
+                [f" match {operation['match']}"],
+            )
+            _append_config_block(
+                target,
+                f"policy-map {operation['policy_map']}",
+                [f" class {operation['class_map']}", f"  {action}"],
+            )
+            _append_config_block(
+                target,
+                f"interface {operation['interface']}",
+                [f" service-policy {operation['direction']} {operation['policy_map']}"],
+            )
+        return
+    elif operation["op"] == "set_stp":
+        lines = [f"spanning-tree mode {operation['mode']}"]
+        if operation.get("vlan") and operation.get("root"):
+            lines.append(f"spanning-tree vlan {operation['vlan']} root {operation['root']}")
+        for target in _config_targets(device):
+            _append_unique_config_lines(target, lines)
+        return
+    elif operation["op"] == "set_etherchannel":
+        channel = int(operation["channel"])
+        mode = str(operation.get("mode") or "active")
+        interfaces = [str(interface) for interface in operation.get("interfaces", []) if str(interface).strip()]
+        for target in _config_targets(device):
+            for interface_name in interfaces:
+                _append_config_block(target, f"interface {interface_name}", [f" channel-group {channel} mode {mode}"])
+            _append_config_block(target, f"interface Port-channel{channel}", [" no shutdown"])
+        return
+    elif operation["op"] == "set_vtp":
+        lines = [f"vtp domain {operation['domain']}", f"vtp mode {operation['mode']}"]
+        if operation.get("version"):
+            lines.append(f"vtp version {operation['version']}")
+        for target in _config_targets(device):
+            _append_unique_config_lines(target, lines)
+        return
+    elif operation["op"] == "set_dtp":
+        for target in _config_targets(device):
+            _append_config_block(target, f"interface {operation['interface']}", [f" switchport mode {operation['mode']}"])
+        return
     else:
         return
 
@@ -742,6 +1108,257 @@ def _apply_router_op(device: ET.Element, operation: dict[str, object]) -> None:
         for target in _config_targets(device):
             _append_config_block(target, f"interface {operation['interface']}", [f" ip access-group {operation['acl_name']} {operation['direction']}"])
         return
+    elif operation["op"] == "enable_ipv6_unicast_routing":
+        for target in _config_targets(device):
+            _append_unique_config_lines(target, ["ipv6 unicast-routing"])
+        return
+    elif operation["op"] == "set_ipv6_address":
+        for target in _config_targets(device):
+            _append_unique_config_lines(target, ["ipv6 unicast-routing"])
+            _append_config_block(
+                target,
+                f"interface {operation['interface']}",
+                [f" ipv6 address {operation['address']}/{operation['prefix']}", " no shutdown"],
+            )
+        return
+    elif operation["op"] == "set_ipv6_slaac":
+        body = [" ipv6 enable", " no shutdown"]
+        if operation.get("prefix") and operation.get("prefix_len"):
+            body.insert(1, f" ipv6 nd prefix {operation['prefix']}/{operation['prefix_len']}")
+        for target in _config_targets(device):
+            _append_unique_config_lines(target, ["ipv6 unicast-routing"])
+            _append_config_block(target, f"interface {operation['interface']}", body)
+        return
+    elif operation["op"] == "set_dhcpv6_pool":
+        pool_body = [f" address prefix {operation['prefix']}/{operation['prefix_len']}"]
+        if operation.get("dns"):
+            pool_body.append(f" dns-server {operation['dns']}")
+        if operation.get("domain"):
+            pool_body.append(f" domain-name {operation['domain']}")
+        interface_body = [f" ipv6 dhcp server {operation['name']}", " ipv6 nd managed-config-flag", " no shutdown"]
+        for target in _config_targets(device):
+            _append_unique_config_lines(target, ["ipv6 unicast-routing"])
+            _append_config_block(target, f"ipv6 dhcp pool {operation['name']}", pool_body)
+            _append_config_block(target, f"interface {operation['interface']}", interface_body)
+        return
+    elif operation["op"] == "set_ospfv3_interface":
+        process_id = operation["process_id"]
+        for target in _config_targets(device):
+            _append_unique_config_lines(target, ["ipv6 unicast-routing"])
+            _append_config_block(target, f"interface {operation['interface']}", [f" ipv6 ospf {process_id} area {operation['area']}", " no shutdown"])
+            _append_config_block(target, f"ipv6 router ospf {process_id}", [])
+        return
+    elif operation["op"] == "set_eigrp_ipv6_interface":
+        asn = operation["asn"]
+        for target in _config_targets(device):
+            _append_unique_config_lines(target, ["ipv6 unicast-routing", "no ipv6 cef"])
+            _append_config_block(target, f"interface {operation['interface']}", [f" ipv6 eigrp {asn}", " no shutdown"])
+            _append_config_block(target, f"ipv6 router eigrp {asn}", [" no shutdown"])
+        return
+    elif operation["op"] == "set_ripng_interface":
+        for target in _config_targets(device):
+            _append_unique_config_lines(target, ["ipv6 unicast-routing"])
+            _append_config_block(target, f"interface {operation['interface']}", [f" ipv6 rip {operation['process_name']} enable", " no shutdown"])
+        return
+    elif operation["op"] == "set_hsrp_ipv6":
+        body = [" standby version 2", f" standby {operation['group']} ipv6 {operation['virtual_ipv6']}"]
+        if operation.get("priority"):
+            body.append(f" standby {operation['group']} priority {operation['priority']}")
+            body.append(f" standby {operation['group']} preempt")
+        for target in _config_targets(device):
+            _append_unique_config_lines(target, ["ipv6 unicast-routing"])
+            _append_config_block(target, f"interface {operation['interface']}", body)
+        return
+    elif operation["op"] == "set_ospfv2_network":
+        for target in _config_targets(device):
+            _append_config_block(
+                target,
+                f"router ospf {operation['process_id']}",
+                [f" network {operation['network']} {operation['wildcard']} area {operation['area']}"],
+            )
+        return
+    elif operation["op"] == "set_eigrp_ipv4_network":
+        body = [f" network {operation['network']} {operation['wildcard']}"]
+        if operation.get("no_auto_summary"):
+            body.append(" no auto-summary")
+        for target in _config_targets(device):
+            _append_config_block(target, f"router eigrp {operation['asn']}", body)
+        return
+    elif operation["op"] == "set_ripv2_network":
+        body = [" version 2", f" network {operation['network']}"]
+        if operation.get("no_auto_summary"):
+            body.append(" no auto-summary")
+        for target in _config_targets(device):
+            _append_config_block(target, "router rip", body)
+        return
+    elif operation["op"] == "set_static_route":
+        for target in _config_targets(device):
+            _append_unique_config_lines(target, [f"ip route {operation['network']} {_prefix_to_mask(int(operation['prefix']))} {operation['next_hop']}"])
+        return
+    elif operation["op"] == "set_dhcp_relay":
+        for target in _config_targets(device):
+            _append_config_block(target, f"interface {operation['interface']}", [f" ip helper-address {operation['helper']}"])
+        return
+    elif operation["op"] == "set_nat_interface":
+        for target in _config_targets(device):
+            _append_config_block(target, f"interface {operation['interface']}", [f" ip nat {operation['role']}"])
+        return
+    elif operation["op"] == "set_nat_static":
+        for target in _config_targets(device):
+            _append_unique_config_lines(target, [f"ip nat inside source static {operation['inside_local']} {operation['inside_global']}"])
+        return
+    elif operation["op"] == "set_pat_overload":
+        suffix = " overload" if operation.get("overload") else ""
+        for target in _config_targets(device):
+            _append_unique_config_lines(target, [f"ip nat inside source list {operation['acl']} interface {operation['interface']}{suffix}"])
+        return
+    elif operation["op"] == "set_ssh_ios":
+        lines = [
+            f"ip domain-name {operation['domain']}",
+            f"username {operation['username']} password {operation['password']}",
+            f"crypto key generate rsa modulus {operation['modulus']}",
+            "ip ssh version 2",
+        ]
+        for target in _config_targets(device):
+            _append_unique_config_lines(target, lines)
+        return
+    elif operation["op"] == "set_ntp_server":
+        for target in _config_targets(device):
+            _append_unique_config_lines(target, [f"ntp server {operation['server']}"])
+        return
+    elif operation["op"] == "set_syslog_server":
+        for target in _config_targets(device):
+            _append_unique_config_lines(target, [f"logging host {operation['server']}"])
+        return
+    elif operation["op"] == "set_bgp_neighbor":
+        body = [f" neighbor {operation['neighbor']} remote-as {operation['remote_as']}"]
+        if operation.get("network") and operation.get("mask"):
+            body.append(f" network {operation['network']} mask {operation['mask']}")
+        for target in _config_targets(device):
+            _append_config_block(target, f"router bgp {operation['asn']}", body)
+        return
+    elif operation["op"] == "set_snmp_community":
+        for target in _config_targets(device):
+            _append_unique_config_lines(target, [f"snmp-server community {operation['community']} {operation['mode']}"])
+        return
+    elif operation["op"] == "set_netflow":
+        global_lines = [
+            f"ip flow-export destination {operation['destination']} {operation['port']}",
+            f"ip flow-export version {operation['version']}",
+        ]
+        for target in _config_targets(device):
+            _append_unique_config_lines(target, global_lines)
+            if operation.get("interface") and operation.get("direction"):
+                _append_config_block(target, f"interface {operation['interface']}", [f" ip flow {operation['direction']}"])
+        return
+    elif operation["op"] == "set_gre_tunnel":
+        body = []
+        if operation.get("ip") and operation.get("prefix"):
+            body.append(f" ip address {operation['ip']} {_prefix_to_mask(int(operation['prefix']))}")
+        body.extend(
+            [
+                f" tunnel source {operation['source']}",
+                f" tunnel destination {operation['destination']}",
+                " tunnel mode gre ip",
+                " no shutdown",
+            ]
+        )
+        for target in _config_targets(device):
+            _append_config_block(target, f"interface {operation['interface']}", body)
+        return
+    elif operation["op"] == "set_ppp_interface":
+        body = [" encapsulation ppp"]
+        if operation.get("authentication"):
+            body.append(f" ppp authentication {operation['authentication']}")
+        body.append(" no shutdown")
+        for target in _config_targets(device):
+            _append_config_block(target, f"interface {operation['interface']}", body)
+        return
+    elif operation["op"] == "set_ipsec_transform_set":
+        for target in _config_targets(device):
+            _append_unique_config_lines(
+                target,
+                [f"crypto ipsec transform-set {operation['name']} {operation['encryption']} {operation['integrity']}"],
+            )
+        return
+    elif operation["op"] == "set_crypto_map":
+        for target in _config_targets(device):
+            _append_config_block(
+                target,
+                f"crypto map {operation['map_name']} {operation['sequence']} ipsec-isakmp",
+                [
+                    f" set peer {operation['peer']}",
+                    f" set transform-set {operation['transform_set']}",
+                    f" match address {operation['acl_name']}",
+                ],
+            )
+            if operation.get("interface"):
+                _append_config_block(target, f"interface {operation['interface']}", [f" crypto map {operation['map_name']}"])
+        return
+    elif operation["op"] == "set_cbac_inspect":
+        for target in _config_targets(device):
+            _append_unique_config_lines(target, [f"ip inspect name {operation['name']} {operation['protocol']}"])
+            _append_config_block(target, f"interface {operation['interface']}", [f" ip inspect {operation['name']} {operation['direction']}"])
+        return
+    elif operation["op"] == "set_zfw_zone_interface":
+        for target in _config_targets(device):
+            _append_config_block(target, f"zone security {operation['zone']}", [])
+            _append_config_block(target, f"interface {operation['interface']}", [f" zone-member security {operation['zone']}"])
+        return
+    elif operation["op"] == "set_zfw_zone_pair":
+        for target in _config_targets(device):
+            _append_config_block(
+                target,
+                f"zone-pair security {operation['pair_name']} source {operation['source']} destination {operation['destination']}",
+                [f" service-policy type inspect {operation['policy']}"],
+            )
+        return
+    elif operation["op"] == "set_zfw_policy":
+        for target in _config_targets(device):
+            _append_config_block(
+                target,
+                f"class-map type inspect match-any {operation['class_map']}",
+                [f" match protocol {operation['protocol']}"],
+            )
+            _append_config_block(
+                target,
+                f"policy-map type inspect {operation['policy_map']}",
+                [f" class type inspect {operation['class_map']}", f"  {operation['action']}"],
+            )
+        return
+    elif operation["op"] == "set_telephony_service":
+        body = [" no auto-reg-ephone"]
+        if operation.get("max_ephones"):
+            body.append(f" max-ephones {operation['max_ephones']}")
+        if operation.get("max_dn"):
+            body.append(f" max-dn {operation['max_dn']}")
+        body.append(f" ip source-address {operation['source_address']} port {operation['port']}")
+        for target in _config_targets(device):
+            _append_config_block(target, "telephony-service", body)
+        return
+    elif operation["op"] == "set_ephone_dn":
+        for target in _config_targets(device):
+            _append_config_block(target, f"ephone-dn {operation['dn_id']}", [f" number {operation['number']}"])
+        return
+    elif operation["op"] == "set_ephone":
+        for target in _config_targets(device):
+            _append_config_block(
+                target,
+                f"ephone {operation['ephone_id']}",
+                [f" mac-address {operation['mac']}", f" button {operation['button']}"],
+            )
+        return
+    elif operation["op"] == "set_dial_peer_voice":
+        for target in _config_targets(device):
+            _append_config_block(
+                target,
+                f"dial-peer voice {operation['peer_id']} voip",
+                [
+                    f" destination-pattern {operation['destination_pattern']}",
+                    f" session target ipv4:{operation['session_target']}",
+                ],
+            )
+        return
     else:
         return
     for target in _config_targets(device):
@@ -977,6 +1594,39 @@ def _apply_iot_op(device: ET.Element, operation: dict[str, object]) -> None:
             return
 
 
+def _find_script_file(device: ET.Element, app_name: str, file_name: str) -> ET.Element:
+    app_matches = [
+        directory
+        for directory in device.findall(".//FILE[@class='CDirectory']")
+        if directory.findtext("NAME", default="").strip() == app_name
+    ]
+    if not app_matches:
+        device_name = device.findtext("./ENGINE/NAME", default="")
+        raise ValueError(f"Script app {app_name!r} was not found on device {device_name!r}.")
+    file_matches: list[ET.Element] = []
+    for directory in app_matches:
+        file_matches.extend(
+            file_node
+            for file_node in directory.findall(".//FILE[@class='CFile']")
+            if file_node.findtext("NAME", default="").strip() == file_name
+        )
+    if not file_matches:
+        raise ValueError(f"Script file {file_name!r} was not found in app {app_name!r}.")
+    if len(file_matches) > 1:
+        raise ValueError(f"Script file {file_name!r} in app {app_name!r} is ambiguous.")
+    return file_matches[0]
+
+
+def _apply_programming_op(device: ET.Element, operation: dict[str, object]) -> None:
+    if operation["op"] != "set_script_file_content":
+        return
+    file_node = _find_script_file(device, str(operation["app_name"]), str(operation["file_name"]))
+    content_node = file_node.find("FILE_CONTENT")
+    if content_node is None:
+        content_node = ET.SubElement(file_node, "FILE_CONTENT", {"class": "CTextFileContent"})
+    _ensure_text(content_node, "TEXT", str(operation["content"]))
+
+
 def apply_plan_operations(root: ET.Element, plan: IntentPlan) -> ET.Element:
     updated = copy.deepcopy(root)
     port_mem_map = _link_port_mem_map(updated)
@@ -1025,6 +1675,7 @@ def apply_plan_operations(root: ET.Element, plan: IntentPlan) -> ET.Element:
         (plan.end_device_ops, _apply_end_device_op),
         (plan.management_ops, _apply_management_op),
         (plan.iot_ops, _apply_iot_op),
+        (plan.programming_ops, _apply_programming_op),
     ]:
         for operation in bucket:
             device = _find_device(updated, str(operation["device"]))