packet-tracer-skill 0.2.1 → 0.2.3

package/scripts/intent_parser.py

@@ -28,7 +28,7 @@ CAPABILITY_PATTERNS = {
     "management_vlan": [r"\bmanagement vlan\b", r"\bvlan 99\b", r"\bdefault-gateway\b"],
     "telnet": [r"\btelnet\b", r"\bvty\b", r"\btransport input telnet\b"],
     "wireless_ap": [r"\bssid\b", r"\bwifi\b", r"\bwpa\b", r"\bwpa2\b", r"\bwireless\b", r"\baccess point\b", r"\bap\b"],
-    "wireless_mutation": [r"\bset\s+[A-Za-z0-9_ -]+?\s+ssid\b", r"\bsecurity\s+(?:wpa|wpa2|wep|open|802\.1x)\b", r"\bpassphrase\b", r"\bchannel\s+\d+\b"],
+    "wireless_mutation": [r"\bset\s+[A-Za-z0-9_ -]+?\s+ssid\b", r"\bsecurity\s+(?:wpa|wpa2|wpa-enterprise|wpa2-enterprise|wep|open|802\.1x)\b", r"\bpassphrase\b", r"\bchannel\s+\d+\b"],
     "wireless_client": [r"\btablet\b", r"\blaptop\b", r"\bsmartphone\b", r"\bassociate\b", r"\bjoin\b"],
     "wireless_client_association": [r"\bassociate\b", r"\bjoin\b"],
     "tablet": [r"\btablet\b"],
@@ -38,13 +38,95 @@ CAPABILITY_PATTERNS = {
     "ospf": [r"\bospf\b"],
     "eigrp": [r"\beigrp\b"],
     "rip": [r"\brip\b"],
+    "ospfv2": [r"\bospfv2\b", r"\bospf v2\b", r"\bsingle-area ospf\b", r"\brouter ospf\b"],
+    "eigrp_ipv4": [r"\beigrp ipv4\b", r"\bipv4 eigrp\b", r"\brouter eigrp\b"],
+    "ripv2": [r"\bripv2\b", r"\brip v2\b", r"\brip version 2\b", r"\brouter rip\b"],
+    "static_route": [r"\bstatic route\b", r"\bstatic-route\b", r"\bip route\b"],
+    "default_route": [r"\bdefault route\b", r"\bdefault-route\b", r"\b0\.0\.0\.0/0\b"],
+    "dhcp_relay": [r"\bdhcp relay\b", r"\bdhcp-relay\b", r"\bhelper-address\b", r"\bip helper\b"],
+    "nat_static": [r"\bstatic nat\b", r"\bnat static\b"],
+    "nat_dynamic": [r"\bdynamic nat\b", r"\bnat dynamic\b"],
+    "pat": [r"\bpat\b", r"\boverload\b"],
+    "ssh_ios": [r"\bssh\b", r"\bip ssh\b", r"\bcrypto key\b"],
+    "ntp_ios": [r"\bntp\b", r"\bntp server\b"],
+    "syslog_ios": [r"\bsyslog\b", r"\blogging host\b"],
+    "ipv6_slaac": [r"\bslaac\b", r"\bipv6\s+slaac\b"],
+    "dhcpv6_stateful": [r"\bdhcpv6\b", r"\bstateful dhcpv6\b", r"\bipv6 stateful\b"],
+    "dhcpv6_stateless": [r"\bstateless dhcpv6\b", r"\bipv6 stateless\b"],
+    "ipv6_prefix_delegation": [r"\bprefix delegation\b", r"\bipv6 prefix\b"],
+    "ipv6_dns_aaaa": [r"\baaaa\b", r"\bipv6 dns\b"],
+    "ipv6_tunneling": [r"\bipv6ip\b", r"\bipv6 tunnel\b", r"\bipv6 tunneling\b"],
+    "isatap": [r"\bisatap\b"],
+    "ospfv3": [r"\bospfv3\b", r"\bipv6 ospf\b"],
+    "eigrp_ipv6": [r"\bipv6 eigrp\b", r"\beigrp ipv6\b"],
+    "ripng": [r"\bripng\b", r"\bipv6 rip\b"],
+    "hsrp": [r"\bhsrp\b"],
     "nat": [r"\bnat\b"],
     "acl": [r"\bacl\b", r"\baccess-list\b"],
+    "dhcp_snooping": [r"\bdhcp snooping\b"],
+    "dai": [r"\bdai\b", r"\bdynamic arp inspection\b"],
+    "dot1x": [r"\bdot1x\b", r"\b802\.1x\b", r"\bnac\b"],
+    "lldp": [r"\blldp\b"],
+    "rep": [r"\brep\b"],
+    "snmp": [r"\bsnmp\b"],
+    "netflow": [r"\bnetflow\b"],
+    "span": [r"\bmonitor\s+session\b", r"\bspan\b", r"\brspan\b"],
+    "qos": [r"\bqos policy\b", r"\bqos class\b", r"\bclass-map\b", r"\bpolicy-map\b", r"\bquality of service\b"],
+    "port_security": [r"\bport security\b", r"\bport-security\b"],
+    "bgp": [r"\bbgp\b", r"\brouter bgp\b", r"\bremote-as\b"],
+    "stp": [r"\bstp\b", r"\bspanning tree\b", r"\bspanning-tree\b", r"\bpvst\b"],
+    "rstp": [r"\brstp\b", r"\brapid-pvst\b", r"\brapid pvst\b", r"\brapid spanning\b"],
+    "etherchannel": [r"\betherchannel\b", r"\bport-channel\b", r"\bchannel-group\b"],
+    "lacp": [r"\blacp\b"],
+    "pagp": [r"\bpagp\b"],
+    "vtp": [r"\bvtp\b"],
+    "dtp": [r"\bdtp\b", r"\bdynamic desirable\b", r"\bdynamic auto\b"],
     "vpn": [r"\bvpn\b", r"\bsite-to-site\b", r"\bipsec\b", r"\btunnel\b"],
     "ipsec": [r"\bipsec\b", r"\bike\b", r"\bphase 1\b", r"\bphase 2\b"],
     "gre": [r"\bgre\b", r"\bgre tunnel\b"],
     "ppp": [r"\bppp\b", r"\bchap\b", r"\bpap\b"],
+    "security_edge": [r"\bsecurity edge\b", r"\bsecurity appliance\b", r"\bfirewall\b", r"\basa\b"],
+    "asa_acl_nat": [r"\basa acl\b", r"\basa nat\b", r"\basa acl nat\b"],
+    "asa_service_policy": [r"\basa service policy\b", r"\bservice policy\b"],
+    "clientless_vpn": [r"\bclientless vpn\b"],
+    "cbac": [r"\bcbac\b"],
+    "zfw": [r"\bzfw\b", r"\bzone based firewall\b", r"\bzone-based firewall\b"],
+    "sniffer": [r"\bsniffer\b"],
     "multilayer_switching": [r"\bmultilayer switch\b", r"\blayer 3 switch\b", r"\b3560\b", r"\bsvi\b"],
+    "wlc": [r"\bwlc\b", r"\bwireless lan controller\b"],
+    "wpa_enterprise": [r"\bwpa enterprise\b", r"\bwpa2 enterprise\b", r"\bwpa-enterprise\b", r"\bwpa2-enterprise\b", r"\b802\.1x wireless\b"],
+    "wep": [r"\bwep\b"],
+    "guest_wifi": [r"\bguest wifi\b", r"\bguest wlan\b"],
+    "beamforming": [r"\bbeamforming\b"],
+    "meraki": [r"\bmeraki\b"],
+    "cellular_5g": [r"\b5g\b", r"\bcellular\b", r"\bcell tower\b"],
+    "bluetooth": [r"\bbluetooth\b"],
+    "network_controller": [r"\bnetwork controller\b", r"\bnetcon\b"],
+    "python_programming": [r"\bpython programming\b", r"\bpython app\b"],
+    "javascript_programming": [r"\bjavascript\b", r"\bjs app\b"],
+    "blockly_programming": [r"\bblockly\b"],
+    "tcp_udp_app": [r"\btcp test app\b", r"\budp test app\b", r"\btcp app\b", r"\budp app\b"],
+    "vm_iox": [r"\biox\b", r"\bvm\b", r"\bvirtual machine\b"],
+    "voip": [r"\bvoip\b"],
+    "ip_phone": [r"\bip phone\b", r"\bphone\b"],
+    "call_manager": [r"\bcall manager\b", r"\btelephony\b"],
+    "linksys_voice": [r"\blinksys voice\b"],
+    "mqtt": [r"\bmqtt\b"],
+    "real_http": [r"\breal http\b"],
+    "real_websocket": [r"\bwebsocket\b", r"\breal websocket\b"],
+    "visual_scripting": [r"\bvisual scripting\b"],
+    "ptp": [r"\bptp\b", r"\bprecision time protocol\b"],
+    "profinet": [r"\bprofinet\b"],
+    "l2nat": [r"\bl2nat\b", r"\bl2 nat\b"],
+    "cyberobserver": [r"\bcyberobserver\b"],
+    "industrial_firewall": [r"\bindustrial firewall\b", r"\bisa3000\b"],
+    "coaxial": [r"\bcoaxial\b"],
+    "cable_dsl": [r"\bcable modem\b", r"\bdsl\b", r"\bdsl modem\b"],
+    "central_office": [r"\bcentral office\b"],
+    "cell_tower": [r"\bcell tower\b"],
+    "power_distribution": [r"\bpower distribution\b"],
+    "hot_swappable": [r"\bhot swappable\b", r"\bhot-swappable\b"],
+    "ios_license": [r"\bios license\b", r"\blicense\b", r"\bios15\b", r"\bios 15\b"],
 }
 
 DEVICE_SYNONYMS = {
@@ -97,6 +179,15 @@ NATURAL_DEVICE_ALIASES = {
 NETWORK_STYLE_PATTERNS = {
     "campus": [r"\bcampus\b", r"\bkampus\b", r"\bsobeli\b", r"\bdepart", r"\bdepartment\b"],
     "branch": [r"\bbranch\b", r"\bfilial\b"],
+    "ipv6_routing": [r"\bipv6\b", r"\bslaac\b", r"\bdhcpv6\b", r"\bospfv3\b", r"\bhsrp\b"],
+    "ipv4_routing_management": [r"\bospfv2\b", r"\bospf v2\b", r"\beigrp ipv4\b", r"\bripv2\b", r"\brip version 2\b", r"\bstatic route\b", r"\bdefault route\b", r"\bdhcp relay\b", r"\bnat\b", r"\bpat\b", r"\bip ssh\b", r"\bntp server\b", r"\blogging host\b"],
+    "l2_security_monitoring": [r"\bdhcp snooping\b", r"\bdai\b", r"\bdot1x\b", r"\b802\.1x\b", r"\bsnmp\b", r"\bnetflow\b", r"\bspan\b", r"\brspan\b", r"\bquality of service\b", r"\blldp\b", r"\brep\b", r"\bport security\b", r"\bport-security\b"],
+    "l2_resiliency_routing": [r"\bbgp\b", r"\bstp\b", r"\brstp\b", r"\bspanning tree\b", r"\bspanning-tree\b", r"\betherchannel\b", r"\bport-channel\b", r"\bchannel-group\b", r"\blacp\b", r"\bpagp\b", r"\bvtp\b", r"\bdtp\b"],
+    "wireless_advanced": [r"\bwlc\b", r"\bwireless lan controller\b", r"\bmeraki\b", r"\bbluetooth\b", r"\b5g\b", r"\bcellular\b", r"\bwpa enterprise\b", r"\bwpa2 enterprise\b", r"\bwep\b", r"\bguest wifi\b", r"\bguest wlan\b", r"\bbeamforming\b"],
+    "automation_controller": [r"\bnetwork controller\b", r"\bnetcon\b", r"\bblockly\b", r"\bjavascript\b", r"\bpython programming\b", r"\biox\b"],
+    "voice_collaboration": [r"\bvoip\b", r"\bip phone\b", r"\bcall manager\b", r"\btelephony\b"],
+    "industrial_iot": [r"\bmqtt\b", r"\bwebsocket\b", r"\bprofinet\b", r"\bl2nat\b", r"\bptp\b", r"\bcyberobserver\b", r"\bindustrial\b"],
+    "physical_media_device": [r"\bcoaxial\b", r"\bcable modem\b", r"\bdsl modem\b", r"\bcentral office\b", r"\bcell tower\b", r"\bpower distribution\b"],
     "small_office": [r"\bsmall office\b", r"\bhome\b", r"\bofis\b"],
     "wireless_branch": [r"\bwireless\b", r"\bwifi\b", r"\bssid\b"],
     "wan_security": [r"\bwan\b", r"\bgre\b", r"\bppp\b", r"\bipsec\b", r"\bvpn\b", r"\bsecurity edge\b", r"\bfirewall\b", r"\basa\b"],
@@ -136,6 +227,8 @@ SECURITY_TO_AUTH = {
     "wpa": ("2", "2"),
     "wpa2": ("4", "4"),
     "802.1x": ("5", "5"),
+    "wpa-enterprise": ("5", "5"),
+    "wpa2-enterprise": ("5", "5"),
 }
 
 TRANSLITERATION_TABLE = str.maketrans(
@@ -163,7 +256,11 @@ TRANSLITERATION_TABLE = str.maketrans(
 
 
 def _command_segments(prompt: str) -> list[str]:
-    parts = re.split(r"(?=\b(?:device|connect|link|set|enable|associate|change|update|rename|apply)\b)", prompt, flags=re.IGNORECASE)
+    parts = re.split(
+        r"(?=(?<!-)\b(?:device|connect|link|set|enable|associate|change|update|rename|apply)\b)",
+        prompt,
+        flags=re.IGNORECASE,
+    )
     return [part.strip() for part in parts if part.strip()]
 
 
@@ -235,6 +332,7 @@ class IntentPlan:
     management_ops: list[dict[str, object]] = field(default_factory=list)
     verification_ops: list[dict[str, object]] = field(default_factory=list)
     iot_ops: list[dict[str, object]] = field(default_factory=list)
+    programming_ops: list[dict[str, object]] = field(default_factory=list)
 
     def all_operations(self) -> list[dict[str, object]]:
         merged: list[dict[str, object]] = []
@@ -248,6 +346,7 @@ class IntentPlan:
             self.management_ops,
             self.verification_ops,
             self.iot_ops,
+            self.programming_ops,
         ]:
             merged.extend(bucket)
         return merged
@@ -389,7 +488,7 @@ def _extract_service_requirements(capabilities: list[str], prompt: str) -> dict[
     for service in ["dhcp", "dns", "http", "https", "ftp", "tftp", "ntp", "email", "syslog", "aaa"]:
         if service in lowered:
             requirements["services"].append(service)
-    for security in ["acl", "telnet", "wpa2", "wpa", "wep", "nat", "vpn", "ipsec", "gre", "ppp", "ssh"]:
+    for security in ["acl", "telnet", "wpa2", "wpa", "wep", "nat", "vpn", "ipsec", "gre", "ppp", "security_edge", "ssh"]:
         if security in lowered:
             requirements["security"].append(security)
     return requirements
@@ -503,6 +602,122 @@ def _extract_switch_ops(prompt: str) -> list[dict[str, object]]:
                     "native": int(native) if native else None,
                 }
             )
+    dhcp_snooping_pattern = re.compile(r"set\s+([A-Za-z0-9_-]+)\s+dhcp\s+snooping\s+vlan\s+(\d+)(?:\s+trust\s+([A-Za-z0-9/._-]+))?", flags=re.IGNORECASE)
+    dai_pattern = re.compile(r"set\s+([A-Za-z0-9_-]+)\s+dai\s+vlan\s+(\d+)(?:\s+trust\s+([A-Za-z0-9/._-]+))?", flags=re.IGNORECASE)
+    port_security_pattern = re.compile(
+        r"set\s+([A-Za-z0-9_-]+)\s+port-security\s+([A-Za-z0-9/._-]+)(?:\s+max\s+(\d+))?(?:\s+violation\s+(protect|restrict|shutdown))?",
+        flags=re.IGNORECASE,
+    )
+    lldp_pattern = re.compile(r"set\s+([A-Za-z0-9_-]+)\s+lldp(?:\s+(?:enable|run))?", flags=re.IGNORECASE)
+    rep_pattern = re.compile(r"set\s+([A-Za-z0-9_-]+)\s+rep\s+segment\s+(\d+)\s+interface\s+([A-Za-z0-9/._-]+)", flags=re.IGNORECASE)
+    span_pattern = re.compile(
+        r"set\s+([A-Za-z0-9_-]+)\s+(?:r?span)\s+(\d+)\s+source\s+([A-Za-z0-9/._-]+)\s+destination\s+([A-Za-z0-9/._-]+)",
+        flags=re.IGNORECASE,
+    )
+    dot1x_pattern = re.compile(
+        r"set\s+([A-Za-z0-9_-]+)\s+dot1x\s+interface\s+([A-Za-z0-9/._-]+)\s+mode\s+(auto|force-authorized|force-unauthorized)"
+        r"(?:\s+radius\s+(\d+\.\d+\.\d+\.\d+)\s+key\s+([A-Za-z0-9._-]+))?",
+        flags=re.IGNORECASE,
+    )
+    qos_pattern = re.compile(
+        r"set\s+([A-Za-z0-9_-]+)\s+qos\s+class-map\s+([A-Za-z0-9_-]+)\s+match\s+(.+?)\s+policy-map\s+([A-Za-z0-9_-]+)\s+class\s+\2\s+(priority|bandwidth\s+\d+|police\s+\d+)"
+        r"\s+service-policy\s+(input|output)\s+([A-Za-z0-9/._-]+)(?=\s+set\s+|$)",
+        flags=re.IGNORECASE,
+    )
+    stp_pattern = re.compile(
+        r"set\s+([A-Za-z0-9_-]+)\s+stp\s+mode\s+([A-Za-z0-9_-]+)(?:\s+vlan\s+(\d+)\s+root\s+(primary|secondary))?",
+        flags=re.IGNORECASE,
+    )
+    etherchannel_pattern = re.compile(
+        r"set\s+([A-Za-z0-9_-]+)\s+etherchannel\s+(\d+)\s+mode\s+(active|passive|desirable|auto|on)\s+interfaces\s+(.+?)(?=\s+set\s+|$)",
+        flags=re.IGNORECASE,
+    )
+    vtp_pattern = re.compile(
+        r"set\s+([A-Za-z0-9_-]+)\s+vtp\s+domain\s+([A-Za-z0-9_.-]+)\s+mode\s+(server|client|transparent)(?:\s+version\s+(\d+))?",
+        flags=re.IGNORECASE,
+    )
+    dtp_pattern = re.compile(
+        r"set\s+([A-Za-z0-9_-]+)\s+dtp\s+interface\s+([A-Za-z0-9/._-]+)\s+mode\s+(dynamic\s+desirable|dynamic\s+auto|trunk|access)",
+        flags=re.IGNORECASE,
+    )
+    for segment in _command_segments(prompt):
+        for device, vlan_id, trust_port in dhcp_snooping_pattern.findall(segment):
+            ops.append({"op": "set_dhcp_snooping", "device": device, "vlan": int(vlan_id), "trust_port": trust_port or None})
+        for device, vlan_id, trust_port in dai_pattern.findall(segment):
+            ops.append({"op": "set_dai", "device": device, "vlan": int(vlan_id), "trust_port": trust_port or None})
+        for device, port, maximum, violation in port_security_pattern.findall(segment):
+            ops.append(
+                {
+                    "op": "set_port_security",
+                    "device": device,
+                    "port": port,
+                    "maximum": int(maximum) if maximum else None,
+                    "violation": violation.lower() if violation else None,
+                }
+            )
+        for device in lldp_pattern.findall(segment):
+            ops.append({"op": "set_lldp", "device": device})
+        for device, segment_id, interface_name in rep_pattern.findall(segment):
+            ops.append({"op": "set_rep", "device": device, "segment": int(segment_id), "interface": interface_name})
+        for device, session, source, destination in span_pattern.findall(segment):
+            ops.append({"op": "set_span", "device": device, "session": int(session), "source": source, "destination": destination})
+        for device, interface_name, mode, radius_host, radius_key in dot1x_pattern.findall(segment):
+            ops.append(
+                {
+                    "op": "set_dot1x",
+                    "device": device,
+                    "interface": interface_name,
+                    "mode": mode.lower(),
+                    "radius_host": radius_host or None,
+                    "radius_key": radius_key or None,
+                }
+            )
+        for device, class_map, match_expr, policy_map, action, direction, interface_name in qos_pattern.findall(segment):
+            ops.append(
+                {
+                    "op": "set_qos_policy",
+                    "device": device,
+                    "class_map": class_map,
+                    "match": match_expr.strip(),
+                    "policy_map": policy_map,
+                    "action": action.lower(),
+                    "direction": direction.lower(),
+                    "interface": interface_name,
+                }
+            )
+        for device, mode, vlan_id, root_priority in stp_pattern.findall(segment):
+            ops.append(
+                {
+                    "op": "set_stp",
+                    "device": device,
+                    "mode": mode.lower(),
+                    "vlan": int(vlan_id) if vlan_id else None,
+                    "root": root_priority.lower() if root_priority else None,
+                }
+            )
+        for device, channel, mode, interfaces_text in etherchannel_pattern.findall(segment):
+            interfaces = [value for value in re.findall(r"[A-Za-z]+[A-Za-z]*[0-9/._-]+", interfaces_text) if value.lower() != "set"]
+            ops.append(
+                {
+                    "op": "set_etherchannel",
+                    "device": device,
+                    "channel": int(channel),
+                    "mode": mode.lower(),
+                    "interfaces": interfaces,
+                }
+            )
+        for device, domain, mode, version in vtp_pattern.findall(segment):
+            ops.append(
+                {
+                    "op": "set_vtp",
+                    "device": device,
+                    "domain": domain,
+                    "mode": mode.lower(),
+                    "version": int(version) if version else None,
+                }
+            )
+        for device, interface_name, mode in dtp_pattern.findall(segment):
+            ops.append({"op": "set_dtp", "device": device, "interface": interface_name, "mode": mode.lower()})
     return ops
 
 
@@ -570,6 +785,319 @@ def _extract_router_ops(prompt: str) -> list[dict[str, object]]:
     for segment in _command_segments(prompt):
         for acl_name, direction, device, interface_name in acl_apply_pattern.findall(segment):
             ops.append({"op": "apply_acl", "device": device.strip(), "acl_name": acl_name, "direction": direction.lower(), "interface": interface_name})
+    ipv6_unicast_pattern = re.compile(r"set\s+([A-Za-z0-9_-]+)\s+ipv6\s+unicast-routing", flags=re.IGNORECASE)
+    ipv6_address_pattern = re.compile(
+        r"set\s+([A-Za-z0-9_-]+)\s+(?:interface\s+)?([A-Za-z0-9/._-]+)\s+ipv6\s+([0-9A-Fa-f:]+)/(\d+)",
+        flags=re.IGNORECASE,
+    )
+    ipv6_slaac_pattern = re.compile(
+        r"set\s+([A-Za-z0-9_-]+)\s+slaac\s+on\s+([A-Za-z0-9/._-]+)(?:\s+prefix\s+([0-9A-Fa-f:]+)/(\d+))?",
+        flags=re.IGNORECASE,
+    )
+    dhcpv6_pattern = re.compile(
+        r"set\s+([A-Za-z0-9_-]+)\s+dhcpv6\s+pool\s+([A-Za-z0-9_-]+)\s+prefix\s+([0-9A-Fa-f:]+)/(\d+)\s+interface\s+([A-Za-z0-9/._-]+)"
+        r"(?:\s+dns\s+([0-9A-Fa-f:]+))?(?:\s+domain\s+([A-Za-z0-9._-]+))?",
+        flags=re.IGNORECASE,
+    )
+    ospfv3_pattern = re.compile(r"set\s+([A-Za-z0-9_-]+)\s+ospfv3\s+(\d+)\s+area\s+(\d+)\s+interface\s+([A-Za-z0-9/._-]+)", flags=re.IGNORECASE)
+    eigrp_ipv6_pattern = re.compile(r"set\s+([A-Za-z0-9_-]+)\s+eigrp\s+ipv6\s+(\d+)\s+interface\s+([A-Za-z0-9/._-]+)", flags=re.IGNORECASE)
+    ripng_pattern = re.compile(r"set\s+([A-Za-z0-9_-]+)\s+ripng\s+([A-Za-z0-9_-]+)\s+interface\s+([A-Za-z0-9/._-]+)", flags=re.IGNORECASE)
+    hsrp_pattern = re.compile(
+        r"set\s+([A-Za-z0-9_-]+)\s+hsrp\s+(\d+)\s+ipv6\s+([0-9A-Fa-f:]+)\s+interface\s+([A-Za-z0-9/._-]+)(?:\s+priority\s+(\d+))?",
+        flags=re.IGNORECASE,
+    )
+    ospfv2_pattern = re.compile(
+        r"set\s+([A-Za-z0-9_-]+)\s+ospfv2\s+(\d+)\s+network\s+(\d+\.\d+\.\d+\.\d+)\s+wildcard\s+(\d+\.\d+\.\d+\.\d+)\s+area\s+(\d+)",
+        flags=re.IGNORECASE,
+    )
+    eigrp_ipv4_pattern = re.compile(
+        r"set\s+([A-Za-z0-9_-]+)\s+eigrp\s+ipv4\s+(\d+)\s+network\s+(\d+\.\d+\.\d+\.\d+)\s+wildcard\s+(\d+\.\d+\.\d+\.\d+)(?:\s+(no-auto-summary))?",
+        flags=re.IGNORECASE,
+    )
+    ripv2_pattern = re.compile(
+        r"set\s+([A-Za-z0-9_-]+)\s+rip\s+version\s+2\s+network\s+(\d+\.\d+\.\d+\.\d+)(?:\s+(no-auto-summary))?",
+        flags=re.IGNORECASE,
+    )
+    static_route_pattern = re.compile(
+        r"set\s+([A-Za-z0-9_-]+)\s+static-route\s+(\d+\.\d+\.\d+\.\d+)/(\d+)\s+via\s+(\d+\.\d+\.\d+\.\d+)",
+        flags=re.IGNORECASE,
+    )
+    dhcp_relay_pattern = re.compile(
+        r"set\s+([A-Za-z0-9_-]+)\s+dhcp-relay\s+interface\s+([A-Za-z0-9/._-]+)\s+helper\s+(\d+\.\d+\.\d+\.\d+)",
+        flags=re.IGNORECASE,
+    )
+    nat_inside_outside_pattern = re.compile(
+        r"set\s+([A-Za-z0-9_-]+)\s+nat\s+(inside|outside)\s+interface\s+([A-Za-z0-9/._-]+)",
+        flags=re.IGNORECASE,
+    )
+    nat_static_pattern = re.compile(
+        r"set\s+([A-Za-z0-9_-]+)\s+nat\s+static\s+(\d+\.\d+\.\d+\.\d+)\s+(\d+\.\d+\.\d+\.\d+)",
+        flags=re.IGNORECASE,
+    )
+    pat_pattern = re.compile(
+        r"set\s+([A-Za-z0-9_-]+)\s+pat\s+acl\s+([A-Za-z0-9_-]+)\s+interface\s+([A-Za-z0-9/._-]+)(?:\s+(overload))?",
+        flags=re.IGNORECASE,
+    )
+    ssh_ios_pattern = re.compile(
+        r"set\s+([A-Za-z0-9_-]+)\s+ssh\s+domain\s+([A-Za-z0-9._-]+)\s+username\s+([A-Za-z0-9._-]+)\s+password\s+([A-Za-z0-9._-]+)(?:\s+modulus\s+(\d+))?",
+        flags=re.IGNORECASE,
+    )
+    ntp_ios_pattern = re.compile(r"set\s+([A-Za-z0-9_-]+)\s+ntp\s+server\s+(\d+\.\d+\.\d+\.\d+)", flags=re.IGNORECASE)
+    syslog_ios_pattern = re.compile(r"set\s+([A-Za-z0-9_-]+)\s+syslog\s+server\s+(\d+\.\d+\.\d+\.\d+)", flags=re.IGNORECASE)
+    bgp_pattern = re.compile(
+        r"set\s+([A-Za-z0-9_-]+)\s+bgp\s+(\d+)\s+neighbor\s+(\d+\.\d+\.\d+\.\d+)\s+remote-as\s+(\d+)"
+        r"(?:\s+network\s+(\d+\.\d+\.\d+\.\d+)\s+mask\s+(\d+\.\d+\.\d+\.\d+))?",
+        flags=re.IGNORECASE,
+    )
+    snmp_pattern = re.compile(r"set\s+([A-Za-z0-9_-]+)\s+snmp\s+community\s+([A-Za-z0-9_-]+)\s+(ro|rw)", flags=re.IGNORECASE)
+    netflow_pattern = re.compile(
+        r"set\s+([A-Za-z0-9_-]+)\s+netflow\s+destination\s+(\d+\.\d+\.\d+\.\d+)\s+(\d+)(?:\s+version\s+(\d+))?(?:\s+interface\s+([A-Za-z0-9/._-]+)\s+(ingress|egress))?",
+        flags=re.IGNORECASE,
+    )
+    gre_tunnel_pattern = re.compile(
+        r"set\s+([A-Za-z0-9_-]+)\s+gre\s+tunnel\s+([A-Za-z0-9/._-]+)\s+source\s+([A-Za-z0-9/._:-]+)\s+destination\s+([A-Za-z0-9/._:-]+)"
+        r"(?:\s+ip\s+(\d+\.\d+\.\d+\.\d+)/(\d+))?",
+        flags=re.IGNORECASE,
+    )
+    ppp_pattern = re.compile(
+        r"set\s+([A-Za-z0-9_-]+)\s+ppp\s+interface\s+([A-Za-z0-9/._-]+)(?:\s+authentication\s+(chap|pap))?",
+        flags=re.IGNORECASE,
+    )
+    ipsec_transform_pattern = re.compile(
+        r"set\s+([A-Za-z0-9_-]+)\s+ipsec\s+transform-set\s+([A-Za-z0-9_-]+)\s+([A-Za-z0-9_-]+)\s+([A-Za-z0-9_-]+)",
+        flags=re.IGNORECASE,
+    )
+    crypto_map_pattern = re.compile(
+        r"set\s+([A-Za-z0-9_-]+)\s+crypto\s+map\s+([A-Za-z0-9_-]+)\s+(\d+)\s+peer\s+(\d+\.\d+\.\d+\.\d+)\s+transform-set\s+([A-Za-z0-9_-]+)\s+match\s+([A-Za-z0-9_-]+)(?:\s+interface\s+([A-Za-z0-9/._-]+))?",
+        flags=re.IGNORECASE,
+    )
+    cbac_pattern = re.compile(
+        r"set\s+([A-Za-z0-9_-]+)\s+cbac\s+inspect\s+([A-Za-z0-9_-]+)\s+protocol\s+([A-Za-z0-9_-]+)\s+interface\s+([A-Za-z0-9/._-]+)\s+direction\s+(in|out)",
+        flags=re.IGNORECASE,
+    )
+    zfw_zone_interface_pattern = re.compile(
+        r"set\s+([A-Za-z0-9_-]+)\s+zfw\s+zone\s+([A-Za-z0-9_-]+)\s+interface\s+([A-Za-z0-9/._-]+)",
+        flags=re.IGNORECASE,
+    )
+    zfw_zone_pair_pattern = re.compile(
+        r"set\s+([A-Za-z0-9_-]+)\s+zfw\s+zone-pair\s+([A-Za-z0-9_-]+)\s+source\s+([A-Za-z0-9_-]+)\s+destination\s+([A-Za-z0-9_-]+)\s+policy\s+([A-Za-z0-9_-]+)",
+        flags=re.IGNORECASE,
+    )
+    zfw_policy_pattern = re.compile(
+        r"set\s+([A-Za-z0-9_-]+)\s+zfw\s+class-map\s+([A-Za-z0-9_-]+)\s+match\s+protocol\s+([A-Za-z0-9_-]+)\s+policy-map\s+([A-Za-z0-9_-]+)\s+action\s+(inspect|pass|drop)",
+        flags=re.IGNORECASE,
+    )
+    telephony_service_pattern = re.compile(
+        r'set\s+"?([^"]+?)"?\s+telephony\s+service\s+source-address\s+(\d+\.\d+\.\d+\.\d+)\s+port\s+(\d+)'
+        r"(?:\s+max-ephones\s+(\d+))?(?:\s+max-dn\s+(\d+))?",
+        flags=re.IGNORECASE,
+    )
+    ephone_dn_pattern = re.compile(r'set\s+"?([^"]+?)"?\s+ephone-dn\s+(\d+)\s+number\s+([A-Za-z0-9*+#.-]+)', flags=re.IGNORECASE)
+    ephone_pattern = re.compile(
+        r'set\s+"?([^"]+?)"?\s+ephone\s+(\d+)\s+mac\s+([0-9A-Fa-f.:-]+)\s+button\s+([0-9:]+)',
+        flags=re.IGNORECASE,
+    )
+    dial_peer_pattern = re.compile(
+        r'set\s+"?([^"]+?)"?\s+dial-peer\s+voice\s+(\d+)\s+destination-pattern\s+(\S+)\s+session-target\s+ipv4:(\d+\.\d+\.\d+\.\d+)',
+        flags=re.IGNORECASE,
+    )
+    for segment in _command_segments(prompt):
+        for device in ipv6_unicast_pattern.findall(segment):
+            ops.append({"op": "enable_ipv6_unicast_routing", "device": device})
+        for device, interface_name, address, prefix in ipv6_address_pattern.findall(segment):
+            ops.append({"op": "set_ipv6_address", "device": device, "interface": interface_name, "address": address, "prefix": int(prefix)})
+        for device, interface_name, prefix_address, prefix_len in ipv6_slaac_pattern.findall(segment):
+            ops.append(
+                {
+                    "op": "set_ipv6_slaac",
+                    "device": device,
+                    "interface": interface_name,
+                    "prefix": prefix_address or None,
+                    "prefix_len": int(prefix_len) if prefix_len else None,
+                }
+            )
+        for device, name, prefix_address, prefix_len, interface_name, dns, domain in dhcpv6_pattern.findall(segment):
+            ops.append(
+                {
+                    "op": "set_dhcpv6_pool",
+                    "device": device,
+                    "name": name,
+                    "prefix": prefix_address,
+                    "prefix_len": int(prefix_len),
+                    "interface": interface_name,
+                    "dns": dns or None,
+                    "domain": domain or None,
+                }
+            )
+        for device, process_id, area, interface_name in ospfv3_pattern.findall(segment):
+            ops.append({"op": "set_ospfv3_interface", "device": device, "process_id": int(process_id), "area": int(area), "interface": interface_name})
+        for device, asn, interface_name in eigrp_ipv6_pattern.findall(segment):
+            ops.append({"op": "set_eigrp_ipv6_interface", "device": device, "asn": int(asn), "interface": interface_name})
+        for device, process_name, interface_name in ripng_pattern.findall(segment):
+            ops.append({"op": "set_ripng_interface", "device": device, "process_name": process_name, "interface": interface_name})
+        for device, group, virtual_ipv6, interface_name, priority in hsrp_pattern.findall(segment):
+            ops.append(
+                {
+                    "op": "set_hsrp_ipv6",
+                    "device": device,
+                    "group": int(group),
+                    "virtual_ipv6": virtual_ipv6,
+                    "interface": interface_name,
+                    "priority": int(priority) if priority else None,
+                }
+            )
+        for device, process_id, network, wildcard, area in ospfv2_pattern.findall(segment):
+            ops.append({"op": "set_ospfv2_network", "device": device, "process_id": int(process_id), "network": network, "wildcard": wildcard, "area": int(area)})
+        for device, asn, network, wildcard, no_auto in eigrp_ipv4_pattern.findall(segment):
+            ops.append({"op": "set_eigrp_ipv4_network", "device": device, "asn": int(asn), "network": network, "wildcard": wildcard, "no_auto_summary": bool(no_auto)})
+        for device, network, no_auto in ripv2_pattern.findall(segment):
+            ops.append({"op": "set_ripv2_network", "device": device, "network": network, "no_auto_summary": bool(no_auto)})
+        for device, network, prefix, next_hop in static_route_pattern.findall(segment):
+            ops.append({"op": "set_static_route", "device": device, "network": network, "prefix": int(prefix), "next_hop": next_hop})
+        for device, interface_name, helper in dhcp_relay_pattern.findall(segment):
+            ops.append({"op": "set_dhcp_relay", "device": device, "interface": interface_name, "helper": helper})
+        for device, role, interface_name in nat_inside_outside_pattern.findall(segment):
+            ops.append({"op": "set_nat_interface", "device": device, "role": role.lower(), "interface": interface_name})
+        for device, inside_local, inside_global in nat_static_pattern.findall(segment):
+            ops.append({"op": "set_nat_static", "device": device, "inside_local": inside_local, "inside_global": inside_global})
+        for device, acl, interface_name, overload in pat_pattern.findall(segment):
+            ops.append({"op": "set_pat_overload", "device": device, "acl": acl, "interface": interface_name, "overload": bool(overload)})
+        for device, domain, username, password, modulus in ssh_ios_pattern.findall(segment):
+            ops.append({"op": "set_ssh_ios", "device": device, "domain": domain, "username": username, "password": password, "modulus": int(modulus) if modulus else 1024})
+        for device, server in ntp_ios_pattern.findall(segment):
+            ops.append({"op": "set_ntp_server", "device": device, "server": server})
+        for device, server in syslog_ios_pattern.findall(segment):
+            ops.append({"op": "set_syslog_server", "device": device, "server": server})
+        for device, asn, neighbor, remote_as, network, mask in bgp_pattern.findall(segment):
+            ops.append(
+                {
+                    "op": "set_bgp_neighbor",
+                    "device": device,
+                    "asn": int(asn),
+                    "neighbor": neighbor,
+                    "remote_as": int(remote_as),
+                    "network": network or None,
+                    "mask": mask or None,
+                }
+            )
+        for device, community, mode in snmp_pattern.findall(segment):
+            ops.append({"op": "set_snmp_community", "device": device, "community": community, "mode": mode.lower()})
+        for device, destination, port, version, interface_name, direction in netflow_pattern.findall(segment):
+            ops.append(
+                {
+                    "op": "set_netflow",
+                    "device": device,
+                    "destination": destination,
+                    "port": int(port),
+                    "version": int(version) if version else 9,
+                    "interface": interface_name or None,
+                    "direction": direction.lower() if direction else None,
+                }
+            )
+        for device, tunnel_interface, source, destination, ip, prefix in gre_tunnel_pattern.findall(segment):
+            ops.append(
+                {
+                    "op": "set_gre_tunnel",
+                    "device": device,
+                    "interface": tunnel_interface,
+                    "source": source,
+                    "destination": destination,
+                    "ip": ip or None,
+                    "prefix": int(prefix) if prefix else None,
+                }
+            )
+        for device, interface_name, authentication in ppp_pattern.findall(segment):
+            ops.append(
+                {
+                    "op": "set_ppp_interface",
+                    "device": device,
+                    "interface": interface_name,
+                    "authentication": authentication.lower() if authentication else None,
+                }
+            )
+        for device, name, encryption, integrity in ipsec_transform_pattern.findall(segment):
+            ops.append(
+                {
+                    "op": "set_ipsec_transform_set",
+                    "device": device,
+                    "name": name,
+                    "encryption": encryption,
+                    "integrity": integrity,
+                }
+            )
+        for device, map_name, sequence, peer, transform_set, acl_name, interface_name in crypto_map_pattern.findall(segment):
+            ops.append(
+                {
+                    "op": "set_crypto_map",
+                    "device": device,
+                    "map_name": map_name,
+                    "sequence": int(sequence),
+                    "peer": peer,
+                    "transform_set": transform_set,
+                    "acl_name": acl_name,
+                    "interface": interface_name or None,
+                }
+            )
+        for device, name, protocol, interface_name, direction in cbac_pattern.findall(segment):
+            ops.append(
+                {
+                    "op": "set_cbac_inspect",
+                    "device": device,
+                    "name": name,
+                    "protocol": protocol.lower(),
+                    "interface": interface_name,
+                    "direction": direction.lower(),
+                }
+            )
+        for device, zone, interface_name in zfw_zone_interface_pattern.findall(segment):
+            ops.append({"op": "set_zfw_zone_interface", "device": device, "zone": zone, "interface": interface_name})
+        for device, pair_name, source, destination, policy in zfw_zone_pair_pattern.findall(segment):
+            ops.append(
+                {
+                    "op": "set_zfw_zone_pair",
+                    "device": device,
+                    "pair_name": pair_name,
+                    "source": source,
+                    "destination": destination,
+                    "policy": policy,
+                }
+            )
+        for device, class_map, protocol, policy_map, action in zfw_policy_pattern.findall(segment):
+            ops.append(
+                {
+                    "op": "set_zfw_policy",
+                    "device": device,
+                    "class_map": class_map,
+                    "protocol": protocol.lower(),
+                    "policy_map": policy_map,
+                    "action": action.lower(),
+                }
+            )
+        for device, source_address, port, max_ephones, max_dn in telephony_service_pattern.findall(segment):
+            ops.append(
+                {
+                    "op": "set_telephony_service",
+                    "device": device.strip(),
+                    "source_address": source_address,
+                    "port": int(port),
+                    "max_ephones": int(max_ephones) if max_ephones else None,
+                    "max_dn": int(max_dn) if max_dn else None,
+                }
+            )
+        for device, dn_id, number in ephone_dn_pattern.findall(segment):
+            ops.append({"op": "set_ephone_dn", "device": device.strip(), "dn_id": int(dn_id), "number": number})
+        for device, ephone_id, mac, button in ephone_pattern.findall(segment):
+            ops.append({"op": "set_ephone", "device": device.strip(), "ephone_id": int(ephone_id), "mac": mac.upper(), "button": button})
+        for device, peer_id, destination_pattern, session_target in dial_peer_pattern.findall(segment):
+            ops.append(
+                {
+                    "op": "set_dial_peer_voice",
+                    "device": device.strip(),
+                    "peer_id": int(peer_id),
+                    "destination_pattern": destination_pattern,
+                    "session_target": session_target,
+                }
+            )
     return ops
 
 
@@ -630,14 +1158,31 @@ def _extract_management_ops(prompt: str) -> list[dict[str, object]]:
 def _extract_wireless_ops(prompt: str) -> list[dict[str, object]]:
     ops: list[dict[str, object]] = []
     ssid_pattern = re.compile(
-        r"set\s+([A-Za-z0-9_ -]+?)\s+ssid\s+([A-Za-z0-9._-]+)(?:\s+security\s+([A-Za-z0-9.-]+))?(?:\s+passphrase\s+([A-Za-z0-9._-]+))?(?:\s+channel\s+(\d+))?",
+        r"set\s+([A-Za-z0-9_ -]+?)\s+ssid\s+([A-Za-z0-9._-]+)"
+        r"(?:\s+security\s+(wpa2?\s+enterprise|wpa2?-enterprise|wpa2?-psk|802\.1x|wep|open|wpa2?|wpa))?"
+        r"(?:\s+passphrase\s+([A-Za-z0-9._-]+))?"
+        r"(?:\s+radius\s+(\d+\.\d+\.\d+\.\d+)\s+secret\s+([A-Za-z0-9._-]+))?"
+        r"(?:\s+channel\s+(\d+))?",
         flags=re.IGNORECASE,
     )
     for segment in _command_segments(prompt):
-        for device, ssid, security, passphrase, channel in ssid_pattern.findall(segment):
-            security_key = (security or "open").lower()
+        for device, ssid, security, passphrase, radius_server, radius_secret, channel in ssid_pattern.findall(segment):
+            security_key = (security or "open").lower().replace(" ", "-")
             auth_type, encrypt_type = SECURITY_TO_AUTH.get(security_key, ("0", "0"))
-            ops.append({"op": "set_wireless_ssid", "device": device.strip(), "ssid": ssid, "security": security_key, "auth_type": auth_type, "encrypt_type": encrypt_type, "passphrase": passphrase or "", "channel": int(channel) if channel else 1})
+            operation = {
+                "op": "set_wireless_ssid",
+                "device": device.strip(),
+                "ssid": ssid,
+                "security": security_key,
+                "auth_type": auth_type,
+                "encrypt_type": encrypt_type,
+                "passphrase": passphrase or "",
+                "channel": int(channel) if channel else 1,
+            }
+            if radius_server:
+                operation["radius_server"] = radius_server
+                operation["radius_secret"] = radius_secret or ""
+            ops.append(operation)
     assoc_pattern = re.compile(r"associate\s+([A-Za-z0-9_ -]+?)\s+to\s+([A-Za-z0-9_ -]+?)\s+ssid\s+([A-Za-z0-9._-]+)(?:\s+(dhcp|static))?", flags=re.IGNORECASE)
     for segment in _command_segments(prompt):
         for client, ap, ssid, ip_mode in assoc_pattern.findall(segment):
@@ -724,6 +1269,36 @@ def _extract_iot_ops(prompt: str) -> list[dict[str, object]]:
     return ops
 
 
+def _decode_prompt_string(value: str) -> str:
+    return (
+        value.replace(r"\\", "\0")
+        .replace(r"\"", '"')
+        .replace(r"\n", "\n")
+        .replace(r"\r", "\r")
+        .replace(r"\t", "\t")
+        .replace("\0", "\\")
+    )
+
+
+def _extract_programming_ops(prompt: str) -> list[dict[str, object]]:
+    ops: list[dict[str, object]] = []
+    script_pattern = re.compile(
+        r'set\s+"((?:\\.|[^"\\])*)"\s+script\s+app\s+"((?:\\.|[^"\\])*)"\s+file\s+"((?:\\.|[^"\\])*)"\s+content\s+"((?:\\.|[^"\\])*)"',
+        flags=re.IGNORECASE | re.DOTALL,
+    )
+    for device, app_name, file_name, content in script_pattern.findall(prompt):
+        ops.append(
+            {
+                "op": "set_script_file_content",
+                "device": _decode_prompt_string(device).strip(),
+                "app_name": _decode_prompt_string(app_name).strip(),
+                "file_name": _decode_prompt_string(file_name).strip(),
+                "content": _decode_prompt_string(content),
+            }
+        )
+    return ops
+
+
 def parse_intent(prompt: str) -> IntentPlan:
     pkt_path_match = re.search(r"([A-Za-z]:\\[^\"\n]+?\.pkt)\b", prompt, flags=re.IGNORECASE)
     pkt_path = pkt_path_match.group(1) if pkt_path_match else None
@@ -739,6 +1314,64 @@ def parse_intent(prompt: str) -> IntentPlan:
     host_link_intent = _extract_host_link_intent(normalized_prompt)
     host_vlan_assignment = _extract_host_vlan_assignment(normalized_prompt)
     network_style = _extract_network_style(normalized_prompt)
+    if (
+        network_style == "wireless_advanced"
+        and "server_aaa" in capability_set
+        and re.search(r"\bradius\b", lowered)
+        and not re.search(r"\b(?:aaa|acs|server aaa|aaa server)\b", lowered)
+    ):
+        capability_set.discard("server_aaa")
+    if re.search(r"\bqos\b", lowered) and (
+        re.search(r"\b(?:snmp|netflow|span|rspan|lldp|rep|dai|dot1x|802\.1x|dhcp snooping|port-security|port security)\b", lowered)
+        or network_style == "l2_security_monitoring"
+    ):
+        capability_set.add("qos")
+    if network_style == "automation_controller" or re.search(r"\b(?:network controller|netcon|blockly|iox)\b", lowered):
+        if re.search(r"\bpython\b", lowered):
+            capability_set.add("python_programming")
+        if re.search(r"\b(?:tcp|udp)\b", lowered) and re.search(r"\b(?:app|application|test app)\b", lowered):
+            capability_set.add("tcp_udp_app")
+    if "ospf" in capability_set and not re.search(r"\b(?:ipv6|ospfv3)\b", lowered):
+        capability_set.add("ospfv2")
+    if "eigrp" in capability_set and not re.search(r"\bipv6\b", lowered):
+        capability_set.add("eigrp_ipv4")
+    if "rip" in capability_set and not re.search(r"\b(?:ipv6|ripng)\b", lowered):
+        capability_set.add("ripv2")
+    if "nat" in capability_set:
+        if re.search(r"\bpat\b|\boverload\b", lowered):
+            capability_set.add("pat")
+        if re.search(r"\bstatic\s+nat\b|\bnat\s+static\b", lowered):
+            capability_set.add("nat_static")
+        if re.search(r"\bdynamic\s+nat\b|\bnat\s+dynamic\b", lowered):
+            capability_set.add("nat_dynamic")
+        if network_style == "ipv4_routing_management" and not {"nat_static", "nat_dynamic"} & capability_set:
+            capability_set.update({"nat_static", "nat_dynamic"})
+    if "ssh" in capability_set:
+        capability_set.add("ssh_ios")
+    if "ntp" in capability_set:
+        capability_set.add("ntp_ios")
+    if (
+        "server_syslog" in capability_set
+        and re.search(r"\b(?:server|ftp|email|aaa|dns)\b", lowered)
+        and not re.search(r"\b(?:logging\s+host|set\s+\S+\s+syslog\s+server)\b", lowered)
+    ):
+        capability_set.discard("syslog_ios")
+    if re.search(r"\blogging\s+host\b", lowered):
+        capability_set.add("syslog_ios")
+    if re.search(r"\bdefault\s+route\b|\b0\.0\.0\.0/0\b", lowered):
+        capability_set.update({"static_route", "default_route"})
+    elif re.search(r"\bstatic\s+route\b|\bip\s+route\b", lowered):
+        capability_set.add("static_route")
+    if re.search(r"\bdhcp\s+relay\b|\bdhcp-relay\b|\bhelper-address\b|\bip\s+helper\b", lowered):
+        capability_set.add("dhcp_relay")
+        if not re.search(r"\b(?:dhcp\s+pool|server\s+dhcp|dhcp\s+server|default-router)\b", lowered):
+            capability_set.discard("dhcp_pool")
+            capability_set.discard("router_dhcp")
+            capability_set.discard("server_dhcp")
+    if "dhcp_snooping" in capability_set and not re.search(r"\b(?:dhcp\s+pool|server\s+dhcp|dhcp\s+server|default-router)\b", lowered):
+        capability_set.discard("dhcp_pool")
+        capability_set.discard("router_dhcp")
+        capability_set.discard("server_dhcp")
     department_count = _extract_department_count(normalized_prompt)
     per_department_devices = _extract_per_department_devices(normalized_prompt)
 
@@ -788,17 +1421,173 @@ def parse_intent(prompt: str) -> IntentPlan:
     management_ops = _extract_management_ops(prompt)
     verification_ops = _extract_verification_ops(prompt)
     iot_ops = _extract_iot_ops(prompt)
+    programming_ops = _extract_programming_ops(prompt)
 
     if any(op["op"] == "associate_wireless_client" for op in wireless_ops):
         capability_set.update({"wireless_client", "wireless_client_association"})
     if any(op["op"] == "set_wireless_ssid" for op in wireless_ops):
         capability_set.update({"wireless_ap", "wireless_mutation"})
+        for op in wireless_ops:
+            if op.get("op") != "set_wireless_ssid":
+                continue
+            security = str(op.get("security") or "")
+            if security == "wep":
+                capability_set.add("wep")
+            if security in {"wpa-enterprise", "wpa2-enterprise", "802.1x"} or op.get("radius_server"):
+                capability_set.add("wpa_enterprise")
+    elif network_style == "wireless_advanced":
+        capability_set.discard("wireless_ap")
+        capability_set.discard("wireless_mutation")
     if end_device_ops:
         capability_set.add("end_device_mutation")
     if iot_ops:
         capability_set.update({"iot", "iot_registration"})
-    if capability_set & {"vpn", "ipsec", "gre", "ppp"}:
+        if any(op.get("op") == "set_iot_rule_state" for op in iot_ops):
+            capability_set.add("iot_control")
+    for operation in programming_ops:
+        file_name = str(operation.get("file_name") or "").lower()
+        app_name = str(operation.get("app_name") or "").lower()
+        content = str(operation.get("content") or "").lower()
+        if file_name.endswith(".py") or "python" in app_name:
+            capability_set.add("python_programming")
+        if file_name.endswith(".js") or "javascript" in app_name:
+            capability_set.add("javascript_programming")
+        if file_name.endswith(".visual") or "visual" in app_name or "<xml" in content:
+            capability_set.add("blockly_programming")
+        if "tcp" in " ".join([file_name, app_name, content]) or "udp" in " ".join([file_name, app_name, content]):
+            capability_set.add("tcp_udp_app")
+        if "realhttp" in content or "real http" in app_name:
+            capability_set.add("real_http")
+        if "realws" in content or "websocket" in content or "websocket" in app_name:
+            capability_set.add("real_websocket")
+        if "mqtt" in content or "mqtt" in app_name:
+            capability_set.add("mqtt")
+    if programming_ops and capability_set & {"python_programming", "javascript_programming", "blockly_programming"} and not capability_set & {"real_http", "real_websocket", "mqtt"}:
+        network_style = network_style or "automation_controller"
+    switch_op_names = {str(op.get("op")) for op in switch_ops}
+    if "set_dhcp_snooping" in switch_op_names:
+        capability_set.add("dhcp_snooping")
+    if "set_dai" in switch_op_names:
+        capability_set.add("dai")
+    if "set_lldp" in switch_op_names:
+        capability_set.add("lldp")
+    if "set_rep" in switch_op_names:
+        capability_set.add("rep")
+    if "set_span" in switch_op_names:
+        capability_set.add("span")
+    if "set_port_security" in switch_op_names:
+        capability_set.add("port_security")
+    if "set_dot1x" in switch_op_names:
+        capability_set.add("dot1x")
+    if "set_qos_policy" in switch_op_names:
+        capability_set.add("qos")
+    if "set_stp" in switch_op_names:
+        capability_set.add("stp")
+        for op in switch_ops:
+            if op.get("op") == "set_stp" and re.search(r"(?:rapid|rstp)", str(op.get("mode") or ""), flags=re.IGNORECASE):
+                capability_set.add("rstp")
+    if "set_etherchannel" in switch_op_names:
+        capability_set.add("etherchannel")
+        for op in switch_ops:
+            if op.get("op") != "set_etherchannel":
+                continue
+            mode = str(op.get("mode") or "").lower()
+            if mode in {"active", "passive"}:
+                capability_set.add("lacp")
+            if mode in {"desirable", "auto"}:
+                capability_set.add("pagp")
+    if "set_vtp" in switch_op_names:
+        capability_set.add("vtp")
+    if "set_dtp" in switch_op_names:
+        capability_set.add("dtp")
+    router_op_names = {str(op.get("op")) for op in router_ops}
+    if "set_bgp_neighbor" in router_op_names:
+        capability_set.add("bgp")
+    if "set_snmp_community" in router_op_names:
+        capability_set.add("snmp")
+    if "set_netflow" in router_op_names:
+        capability_set.add("netflow")
+    if "set_gre_tunnel" in router_op_names:
+        capability_set.add("gre")
+    if "set_ppp_interface" in router_op_names:
+        capability_set.add("ppp")
+    if router_op_names & {"set_ipsec_transform_set", "set_crypto_map"}:
+        capability_set.update({"ipsec", "vpn"})
+    if "set_cbac_inspect" in router_op_names:
+        capability_set.update({"cbac", "security_edge"})
+    if router_op_names & {"set_zfw_zone_interface", "set_zfw_zone_pair", "set_zfw_policy"}:
+        capability_set.update({"zfw", "security_edge"})
+        if "set_qos_policy" not in switch_op_names:
+            capability_set.discard("qos")
+        capability_set.discard("server_http")
+        capability_set.discard("server_https")
+    if router_op_names & {"enable_ipv6_unicast_routing", "set_ipv6_address", "set_ipv6_slaac"}:
+        capability_set.add("ipv6_slaac")
+    if "set_dhcpv6_pool" in router_op_names:
+        capability_set.add("dhcpv6_stateful")
+    if "set_ospfv3_interface" in router_op_names:
+        capability_set.add("ospfv3")
+    if "set_eigrp_ipv6_interface" in router_op_names:
+        capability_set.add("eigrp_ipv6")
+    if "set_ripng_interface" in router_op_names:
+        capability_set.add("ripng")
+    if "set_hsrp_ipv6" in router_op_names:
+        capability_set.add("hsrp")
+    if "set_ospfv2_network" in router_op_names:
+        capability_set.add("ospfv2")
+    if "set_eigrp_ipv4_network" in router_op_names:
+        capability_set.add("eigrp_ipv4")
+    if "set_ripv2_network" in router_op_names:
+        capability_set.add("ripv2")
+    if "set_static_route" in router_op_names:
+        capability_set.add("static_route")
+        if any(op.get("op") == "set_static_route" and op.get("network") == "0.0.0.0" and op.get("prefix") == 0 for op in router_ops):
+            capability_set.add("default_route")
+    if "set_dhcp_relay" in router_op_names:
+        capability_set.add("dhcp_relay")
+    if "set_nat_interface" in router_op_names:
+        capability_set.add("nat")
+    if "set_nat_static" in router_op_names:
+        capability_set.update({"nat", "nat_static"})
+    if "set_pat_overload" in router_op_names:
+        capability_set.update({"nat", "pat"})
+    if "set_ssh_ios" in router_op_names:
+        capability_set.update({"ssh", "ssh_ios"})
+    if "set_ntp_server" in router_op_names:
+        capability_set.update({"ntp", "ntp_ios"})
+    if "set_syslog_server" in router_op_names:
+        capability_set.update({"syslog_ios"})
+    if router_op_names & {"set_telephony_service", "set_ephone_dn", "set_ephone", "set_dial_peer_voice"}:
+        capability_set.update({"voip", "call_manager"})
+    if router_op_names & {"set_ephone_dn", "set_ephone"}:
+        capability_set.add("ip_phone")
+    if capability_set & {"vpn", "ipsec", "gre", "ppp", "security_edge"}:
         network_style = network_style or "wan_security"
+    if capability_set & {"ipv6_slaac", "dhcpv6_stateful", "dhcpv6_stateless", "ospfv3", "eigrp_ipv6", "ripng", "hsrp"}:
+        network_style = network_style or "ipv6_routing"
+    if capability_set & {"ospfv2", "eigrp_ipv4", "ripv2", "static_route", "default_route", "dhcp_relay", "nat_static", "nat_dynamic", "pat", "ssh_ios", "ntp_ios", "syslog_ios"}:
+        network_style = network_style or "ipv4_routing_management"
+    if capability_set & {"dhcp_snooping", "dai", "dot1x", "lldp", "rep", "snmp", "netflow", "span", "qos", "port_security"}:
+        network_style = network_style or "l2_security_monitoring"
+    if capability_set & {"bgp", "stp", "rstp", "etherchannel", "lacp", "pagp", "vtp", "dtp"}:
+        network_style = "l2_resiliency_routing"
+    if capability_set & {"wlc", "wpa_enterprise", "wep", "guest_wifi", "beamforming", "meraki", "cellular_5g", "bluetooth"}:
+        network_style = "wireless_advanced"
+    if capability_set & {"coaxial", "cable_dsl", "central_office", "cell_tower", "power_distribution", "hot_swappable", "ios_license"}:
+        network_style = "physical_media_device"
+    if capability_set & {"mqtt", "real_http", "real_websocket", "visual_scripting", "ptp", "profinet", "l2nat", "cyberobserver", "industrial_firewall"}:
+        network_style = "industrial_iot"
+        if capability_set & {"real_http", "real_websocket"}:
+            capability_set.discard("server_http")
+            capability_set.discard("server_https")
+        if not (
+            iot_ops
+            or re.search(r"\b(?:home\s+gateway|smart\s+home|iot\s+registration|iot\s+control|iot\s+rule)\b", lowered)
+            or re.search(r"\bregister\s+.+\s+to\b", lowered)
+        ):
+            capability_set.discard("iot")
+    if capability_set & {"voip", "ip_phone", "call_manager", "linksys_voice"}:
+        network_style = "voice_collaboration"
 
     capabilities = sorted(capability_set)
 
@@ -864,4 +1653,5 @@ def parse_intent(prompt: str) -> IntentPlan:
         management_ops=management_ops,
         verification_ops=verification_ops,
         iot_ops=iot_ops,
+        programming_ops=programming_ops,
     )