magmascript 3.2.4__tar.gz → 3.3.0__tar.gz

{magmascript-3.2.4 → magmascript-3.3.0}/PKG-INFO

@@ -1,13 +1,11 @@
 Metadata-Version: 2.4
 Name: magmascript
-Version: 3.2.4
+Version: 3.3.0
 Summary: Scripting toolkit with domain-first subcommands
 Author: Jake McCoy
 License-Expression: MIT
 Project-URL: Homepage, https://magmacrunch.com/ware/magmascript/
-Project-URL: Documentation, https://github.com/magmacrunch-media/magmascript/wiki
-Project-URL: Repository, https://github.com/magmacrunch-media/magmascript
-Project-URL: Changelog, https://github.com/magmacrunch-media/magmascript/blob/main/CHANGELOG.md
+Project-URL: Documentation, https://magmacrunch.com/ware/magmascript/
 Project-URL: Funding, https://github.com/sponsors/magmacrunch-media
 Keywords: mcp,scripting,cli,magmacrunch
 Classifier: Development Status :: 3 - Alpha
@@ -421,7 +419,7 @@ this ground was scorched at line 3 (garrisoned at line 1)
 
 `floorplan` is the only new reserved word; everything else is a shadowable
 builtin, so existing scripts are unaffected. Full reference on the
-[Asthenosphere wiki page](https://github.com/magmacrunch-media/magmascript/wiki/Asthenosphere).
+[Asthenosphere wiki page](wiki/Asthenosphere.md).
 
 ### REPL
 
@@ -678,24 +676,24 @@ gh_workflows             # GitHub commands
 
 ## Documentation
 
-Full documentation on the [Wiki](https://github.com/magmacrunch-media/magmascript/wiki):
-- [MagmaScript Language](https://github.com/magmacrunch-media/magmascript/wiki/MagmaScript-Language)
-- [Configuration](https://github.com/magmacrunch-media/magmascript/wiki/Configuration)
-- [MCP Domain](https://github.com/magmacrunch-media/magmascript/wiki/MCP-Domain)
-- [Pi Domain](https://github.com/magmacrunch-media/magmascript/wiki/Pi-Domain)
-- [MC1 Domain](https://github.com/magmacrunch-media/magmascript/wiki/MC1-Domain)
-- [Mac Domain](https://github.com/magmacrunch-media/magmascript/wiki/Mac-Domain)
-- [GitHub Domain](https://github.com/magmacrunch-media/magmascript/wiki/GitHub-Domain)
-- [Scores Domain](https://github.com/magmacrunch-media/magmascript/wiki/Scores-Domain)
-- [Rights Domain](https://github.com/magmacrunch-media/magmascript/wiki/Rights-Domain)
-- [Archive Domain](https://github.com/magmacrunch-media/magmascript/wiki/Archive-Domain)
-- [Last.fm Domain](https://github.com/magmacrunch-media/magmascript/wiki/Last.fm-Domain)
-- [MusicBrainz Domain](https://github.com/magmacrunch-media/magmascript/wiki/MusicBrainz-Domain)
-- [Search Domain](https://github.com/magmacrunch-media/magmascript/wiki/Search-Domain)
-- [Media Domain](https://github.com/magmacrunch-media/magmascript/wiki/Media-Domain)
-- [Example Scripts](https://github.com/magmacrunch-media/magmascript/wiki/Example-Scripts)
-- [Asthenosphere](https://github.com/magmacrunch-media/magmascript/wiki/Asthenosphere)
-- [Architecture](https://github.com/magmacrunch-media/magmascript/wiki/Architecture)
+Full documentation on the [Wiki](wiki/):
+- [MagmaScript Language](wiki/MagmaScript-Language.md)
+- [Configuration](wiki/Configuration.md)
+- [MCP Domain](wiki/MCP-Domain.md)
+- [Pi Domain](wiki/Pi-Domain.md)
+- [MC1 Domain](wiki/MC1-Domain.md)
+- [Mac Domain](wiki/Mac-Domain.md)
+- [GitHub Domain](wiki/GitHub-Domain.md)
+- [Scores Domain](wiki/Scores-Domain.md)
+- [Rights Domain](wiki/Rights-Domain.md)
+- [Archive Domain](wiki/Archive-Domain.md)
+- [Last.fm Domain](wiki/Last.fm-Domain.md)
+- [MusicBrainz Domain](wiki/MusicBrainz-Domain.md)
+- [Search Domain](wiki/Search-Domain.md)
+- [Media Domain](wiki/Media-Domain.md)
+- [Example Scripts](wiki/Example-Scripts.md)
+- [Asthenosphere](wiki/Asthenosphere.md)
+- [Architecture](wiki/Architecture.md)
 
 ## Support This Project
 

{magmascript-3.2.4 → magmascript-3.3.0}/README.md

@@ -383,7 +383,7 @@ this ground was scorched at line 3 (garrisoned at line 1)
 
 `floorplan` is the only new reserved word; everything else is a shadowable
 builtin, so existing scripts are unaffected. Full reference on the
-[Asthenosphere wiki page](https://github.com/magmacrunch-media/magmascript/wiki/Asthenosphere).
+[Asthenosphere wiki page](wiki/Asthenosphere.md).
 
 ### REPL
 
@@ -640,24 +640,24 @@ gh_workflows             # GitHub commands
 
 ## Documentation
 
-Full documentation on the [Wiki](https://github.com/magmacrunch-media/magmascript/wiki):
-- [MagmaScript Language](https://github.com/magmacrunch-media/magmascript/wiki/MagmaScript-Language)
-- [Configuration](https://github.com/magmacrunch-media/magmascript/wiki/Configuration)
-- [MCP Domain](https://github.com/magmacrunch-media/magmascript/wiki/MCP-Domain)
-- [Pi Domain](https://github.com/magmacrunch-media/magmascript/wiki/Pi-Domain)
-- [MC1 Domain](https://github.com/magmacrunch-media/magmascript/wiki/MC1-Domain)
-- [Mac Domain](https://github.com/magmacrunch-media/magmascript/wiki/Mac-Domain)
-- [GitHub Domain](https://github.com/magmacrunch-media/magmascript/wiki/GitHub-Domain)
-- [Scores Domain](https://github.com/magmacrunch-media/magmascript/wiki/Scores-Domain)
-- [Rights Domain](https://github.com/magmacrunch-media/magmascript/wiki/Rights-Domain)
-- [Archive Domain](https://github.com/magmacrunch-media/magmascript/wiki/Archive-Domain)
-- [Last.fm Domain](https://github.com/magmacrunch-media/magmascript/wiki/Last.fm-Domain)
-- [MusicBrainz Domain](https://github.com/magmacrunch-media/magmascript/wiki/MusicBrainz-Domain)
-- [Search Domain](https://github.com/magmacrunch-media/magmascript/wiki/Search-Domain)
-- [Media Domain](https://github.com/magmacrunch-media/magmascript/wiki/Media-Domain)
-- [Example Scripts](https://github.com/magmacrunch-media/magmascript/wiki/Example-Scripts)
-- [Asthenosphere](https://github.com/magmacrunch-media/magmascript/wiki/Asthenosphere)
-- [Architecture](https://github.com/magmacrunch-media/magmascript/wiki/Architecture)
+Full documentation on the [Wiki](wiki/):
+- [MagmaScript Language](wiki/MagmaScript-Language.md)
+- [Configuration](wiki/Configuration.md)
+- [MCP Domain](wiki/MCP-Domain.md)
+- [Pi Domain](wiki/Pi-Domain.md)
+- [MC1 Domain](wiki/MC1-Domain.md)
+- [Mac Domain](wiki/Mac-Domain.md)
+- [GitHub Domain](wiki/GitHub-Domain.md)
+- [Scores Domain](wiki/Scores-Domain.md)
+- [Rights Domain](wiki/Rights-Domain.md)
+- [Archive Domain](wiki/Archive-Domain.md)
+- [Last.fm Domain](wiki/Last.fm-Domain.md)
+- [MusicBrainz Domain](wiki/MusicBrainz-Domain.md)
+- [Search Domain](wiki/Search-Domain.md)
+- [Media Domain](wiki/Media-Domain.md)
+- [Example Scripts](wiki/Example-Scripts.md)
+- [Asthenosphere](wiki/Asthenosphere.md)
+- [Architecture](wiki/Architecture.md)
 
 ## Support This Project
 

{magmascript-3.2.4 → magmascript-3.3.0}/magmascript/domains/mc1/client.py

@@ -5,9 +5,11 @@ Supports SSH (remote) execution mode for managing MC1.
 
 from __future__ import annotations
 
+import re
 import subprocess
 
 from magmascript.core.config import Config, get_config
+from magmascript.core.exceptions import MagmascriptError, SSHError
 from magmascript.core.runner import CommandRunner
 from magmascript.domains.mc1.tools import (
     MC1PowerSettings,
@@ -18,6 +20,8 @@ from magmascript.domains.mc1.tools import (
     parse_system_info,
 )
 
+_MAC_RE = re.compile(r"^[0-9A-Fa-f]{2}(?::[0-9A-Fa-f]{2}){5}$")
+
 
 class MC1Client:
     """Direct client for MC1 Windows PC management.
@@ -32,6 +36,10 @@ class MC1Client:
         self._user = cfg.mc1.user
         self._local = local
         self._runner = CommandRunner(cfg.mc1.host, cfg.mc1.user, local=local)
+        # Wake-on-LAN relays through the Pi, which shares MC1's broadcast
+        # domain. See wake_on_lan for why that is not optional.
+        self._pi_host = cfg.pi.host
+        self._pi_user = cfg.pi.user
 
     # ------------------------------------------------------------------
     # Service management
@@ -141,26 +149,107 @@ class MC1Client:
     # Wake-on-LAN
     # ------------------------------------------------------------------
 
-    def wake_on_lan(self, mac_address: str) -> str:
-        """Send Wake-on-LAN magic packet to MC1.
+    def wake_on_lan(self, mac_address: str, *, relay: bool = True) -> str:
+        """Send Wake-on-LAN magic packets to MC1 by every available route.
+
+        A magic packet is addressed to 255.255.255.255:9, which is **never
+        routed**, so a direct send reaches MC1 only from MC1's own subnet and
+        silently reaches nothing from anywhere else. The Pi is always on that
+        subnet and is reachable over the tailnet from anywhere, so it is used as
+        a relay as well. Both are sent rather than guessing which network this
+        machine is on, because the loser costs about a second and there is no
+        location test to get wrong.
+
+        This is the same fix the Mac's ~/bin/wake-mc1 got on 2026-10-09, after
+        being direct-only meant waking MC1 from away did nothing while the same
+        command worked at home.
 
-        This runs the `wakeonlan` command on the Pi (or local machine).
-        The MAC address should be MC1's ethernet adapter MAC.
+        Note `wakeonlan` exits 0 whenever the datagram left the host, which says
+        nothing about where it went. So this reports the routes that ACCEPTED a
+        packet and never claims MC1 is awake. It does not poll; nothing here can
+        confirm a wake.
 
         Args:
-            mac_address: Ethernet MAC address (e.g. "A0:AD:9F:A4:72:97" or "A0-AD-9F-A4-72-97")
+            mac_address: Ethernet MAC, ":" or "-" separated
+                (e.g. "A0:AD:9F:A4:72:97" or "A0-AD-9F-A4-72-97").
+            relay: Set False to send direct only and skip the Pi.
 
         Returns:
-            Success message
+            A message naming each route tried and whether it took the packet.
+
+        Raises:
+            ValueError: if mac_address is not six hex octets.
+            MagmascriptError: if no route accepted the packet.
         """
-        # Normalize MAC address format (wakeonlan accepts both : and - separators)
-        normalized_mac = mac_address.replace("-", ":")
-        subprocess.run(
-            ["wakeonlan", normalized_mac],
-            capture_output=True,
-            timeout=10,
-        )
-        return f"✓ Wake-on-LAN packet sent to {normalized_mac}"
+        # wakeonlan accepts both separators, so normalise before validating.
+        mac = mac_address.replace("-", ":")
+        if not _MAC_RE.match(mac):
+            raise ValueError(
+                f"not a MAC address: {mac_address!r} "
+                "(expected six hex octets, e.g. A0:AD:9F:A4:72:97)"
+            )
+
+        lines: list[str] = []
+        accepted = 0
+
+        if self._wol_direct(mac):
+            lines.append("  direct broadcast sent (reaches MC1 only from its own subnet)")
+            accepted += 1
+        else:
+            lines.append("  direct broadcast FAILED (is wakeonlan installed here?)")
+
+        if relay:
+            if not self._pi_host:
+                lines.append(
+                    "  relay SKIPPED: no [pi] host configured, so this is "
+                    "home-only. Set pi.host in ~/.config/magmascript/config.toml"
+                )
+            elif self._wol_relay(mac):
+                lines.append(
+                    f"  relayed via {self._pi_host} (reaches MC1 from any network)"
+                )
+                accepted += 1
+            else:
+                lines.append(f"  relay via {self._pi_host} FAILED")
+
+        report = "\n".join(lines)
+        if not accepted:
+            raise MagmascriptError(
+                f"no route accepted a Wake-on-LAN packet for {mac}:\n{report}"
+            )
+        return f"Wake-on-LAN packet for {mac}:\n{report}"
+
+    @staticmethod
+    def _wol_direct(mac: str) -> bool:
+        """Broadcast on this machine's own subnet.
+
+        False rather than raising when `wakeonlan` is missing, which it is on
+        Windows, so the relay can still carry the packet.
+        """
+        try:
+            result = subprocess.run(
+                ["wakeonlan", mac],
+                capture_output=True,
+                timeout=10,
+                check=False,  # the exit status is the return value, not an error
+            )
+        except (OSError, subprocess.SubprocessError):
+            return False
+        return result.returncode == 0
+
+    def _wol_relay(self, mac: str) -> bool:
+        """Run `wakeonlan` on the Pi, which shares MC1's broadcast domain.
+
+        `mac` is interpolated into a command a remote shell parses, so it must
+        already have passed _MAC_RE.
+        """
+        try:
+            CommandRunner(self._pi_host, self._pi_user).run(
+                f"wakeonlan {mac}", timeout=15
+            )
+        except SSHError:
+            return False
+        return True
 
     # ------------------------------------------------------------------
     # Power management

{magmascript-3.2.4 → magmascript-3.3.0}/magmascript.egg-info/PKG-INFO

@@ -1,13 +1,11 @@
 Metadata-Version: 2.4
 Name: magmascript
-Version: 3.2.4
+Version: 3.3.0
 Summary: Scripting toolkit with domain-first subcommands
 Author: Jake McCoy
 License-Expression: MIT
 Project-URL: Homepage, https://magmacrunch.com/ware/magmascript/
-Project-URL: Documentation, https://github.com/magmacrunch-media/magmascript/wiki
-Project-URL: Repository, https://github.com/magmacrunch-media/magmascript
-Project-URL: Changelog, https://github.com/magmacrunch-media/magmascript/blob/main/CHANGELOG.md
+Project-URL: Documentation, https://magmacrunch.com/ware/magmascript/
 Project-URL: Funding, https://github.com/sponsors/magmacrunch-media
 Keywords: mcp,scripting,cli,magmacrunch
 Classifier: Development Status :: 3 - Alpha
@@ -421,7 +419,7 @@ this ground was scorched at line 3 (garrisoned at line 1)
 
 `floorplan` is the only new reserved word; everything else is a shadowable
 builtin, so existing scripts are unaffected. Full reference on the
-[Asthenosphere wiki page](https://github.com/magmacrunch-media/magmascript/wiki/Asthenosphere).
+[Asthenosphere wiki page](wiki/Asthenosphere.md).
 
 ### REPL
 
@@ -678,24 +676,24 @@ gh_workflows             # GitHub commands
 
 ## Documentation
 
-Full documentation on the [Wiki](https://github.com/magmacrunch-media/magmascript/wiki):
-- [MagmaScript Language](https://github.com/magmacrunch-media/magmascript/wiki/MagmaScript-Language)
-- [Configuration](https://github.com/magmacrunch-media/magmascript/wiki/Configuration)
-- [MCP Domain](https://github.com/magmacrunch-media/magmascript/wiki/MCP-Domain)
-- [Pi Domain](https://github.com/magmacrunch-media/magmascript/wiki/Pi-Domain)
-- [MC1 Domain](https://github.com/magmacrunch-media/magmascript/wiki/MC1-Domain)
-- [Mac Domain](https://github.com/magmacrunch-media/magmascript/wiki/Mac-Domain)
-- [GitHub Domain](https://github.com/magmacrunch-media/magmascript/wiki/GitHub-Domain)
-- [Scores Domain](https://github.com/magmacrunch-media/magmascript/wiki/Scores-Domain)
-- [Rights Domain](https://github.com/magmacrunch-media/magmascript/wiki/Rights-Domain)
-- [Archive Domain](https://github.com/magmacrunch-media/magmascript/wiki/Archive-Domain)
-- [Last.fm Domain](https://github.com/magmacrunch-media/magmascript/wiki/Last.fm-Domain)
-- [MusicBrainz Domain](https://github.com/magmacrunch-media/magmascript/wiki/MusicBrainz-Domain)
-- [Search Domain](https://github.com/magmacrunch-media/magmascript/wiki/Search-Domain)
-- [Media Domain](https://github.com/magmacrunch-media/magmascript/wiki/Media-Domain)
-- [Example Scripts](https://github.com/magmacrunch-media/magmascript/wiki/Example-Scripts)
-- [Asthenosphere](https://github.com/magmacrunch-media/magmascript/wiki/Asthenosphere)
-- [Architecture](https://github.com/magmacrunch-media/magmascript/wiki/Architecture)
+Full documentation on the [Wiki](wiki/):
+- [MagmaScript Language](wiki/MagmaScript-Language.md)
+- [Configuration](wiki/Configuration.md)
+- [MCP Domain](wiki/MCP-Domain.md)
+- [Pi Domain](wiki/Pi-Domain.md)
+- [MC1 Domain](wiki/MC1-Domain.md)
+- [Mac Domain](wiki/Mac-Domain.md)
+- [GitHub Domain](wiki/GitHub-Domain.md)
+- [Scores Domain](wiki/Scores-Domain.md)
+- [Rights Domain](wiki/Rights-Domain.md)
+- [Archive Domain](wiki/Archive-Domain.md)
+- [Last.fm Domain](wiki/Last.fm-Domain.md)
+- [MusicBrainz Domain](wiki/MusicBrainz-Domain.md)
+- [Search Domain](wiki/Search-Domain.md)
+- [Media Domain](wiki/Media-Domain.md)
+- [Example Scripts](wiki/Example-Scripts.md)
+- [Asthenosphere](wiki/Asthenosphere.md)
+- [Architecture](wiki/Architecture.md)
 
 ## Support This Project
 

{magmascript-3.2.4 → magmascript-3.3.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "magmascript"
-version = "3.2.4"
+version = "3.3.0"
 description = "Scripting toolkit with domain-first subcommands"
 readme = "README.md"
 license = "MIT"
@@ -48,10 +48,20 @@ all = [
 magmascript = "magmascript.cli:main"
 
 [project.urls]
+# EVERY LINK HERE HAS TO BE PUBLIC, because this is what PyPI puts on the
+# project page for anyone who finds the package. The repository went private on
+# 2026-10-03, which 404'd three of the five: Documentation (it pointed at the
+# wiki, and a private repo's wiki is turned off entirely), Repository, and
+# Changelog, which was a blob link into the repo.
+#
+# They are removed rather than repointed. There is no public repository or
+# changelog to send anyone to, and an absent link is better than one that 404s
+# from the package's own front page.
+#
+# NOTE a published release's metadata is frozen. Fixing this file only affects
+# the NEXT release; the pages for 3.2.4 and earlier keep the dead links.
 Homepage = "https://magmacrunch.com/ware/magmascript/"
-Documentation = "https://github.com/magmacrunch-media/magmascript/wiki"
-Repository = "https://github.com/magmacrunch-media/magmascript"
-Changelog = "https://github.com/magmacrunch-media/magmascript/blob/main/CHANGELOG.md"
+Documentation = "https://magmacrunch.com/ware/magmascript/"
 Funding = "https://github.com/sponsors/magmacrunch-media"
 
 [tool.setuptools.packages.find]

{magmascript-3.2.4 → magmascript-3.3.0}/tests/test_mc1.py

@@ -156,3 +156,125 @@ class TestRegistration:
         from magmascript.core.config import load_config
 
         assert load_config().mc1.host == "9.9.9.9"
+
+
+class TestWakeOnLan:
+    """`mc1 wake` sends by BOTH routes.
+
+    A magic packet goes to 255.255.255.255:9, which is never routed, so a
+    direct send reaches MC1 only from MC1's own subnet. Direct-only is what
+    made the Mac's wake-mc1 silently do nothing from off that subnet, and
+    these are the checks that would have caught it.
+    """
+
+    def _client(self, *, pi_host="10.0.0.9", pi_user="jake"):
+        from magmascript.core.config import Config, MC1Config, PIConfig
+        from magmascript.domains.mc1 import MC1Client
+
+        return MC1Client(
+            Config(
+                mc1=MC1Config(host="1.2.3.4", user="someone"),
+                pi=PIConfig(host=pi_host, user=pi_user),
+            )
+        )
+
+    def _stub(self, monkeypatch, client, *, direct, relay):
+        """Record calls and report the given per-route outcomes."""
+        calls = []
+        monkeypatch.setattr(
+            type(client),
+            "_wol_direct",
+            staticmethod(lambda mac: (calls.append(("direct", mac)), direct)[1]),
+        )
+        monkeypatch.setattr(
+            type(client),
+            "_wol_relay",
+            lambda self, mac: (calls.append(("relay", mac)), relay)[1],
+        )
+        return calls
+
+    def test_sends_both_routes(self, monkeypatch):
+        client = self._client()
+        calls = self._stub(monkeypatch, client, direct=True, relay=True)
+        out = client.wake_on_lan("A0:AD:9F:A4:72:97")
+        assert [c[0] for c in calls] == ["direct", "relay"]
+        assert "direct broadcast sent" in out
+        assert "relayed via 10.0.0.9" in out
+
+    def test_relay_carries_it_when_direct_fails(self, monkeypatch):
+        """The off-LAN case: no local wakeonlan, Pi still delivers."""
+        client = self._client()
+        self._stub(monkeypatch, client, direct=False, relay=True)
+        out = client.wake_on_lan("A0:AD:9F:A4:72:97")
+        assert "direct broadcast FAILED" in out
+        assert "relayed via 10.0.0.9" in out
+
+    def test_direct_carries_it_when_relay_fails(self, monkeypatch):
+        client = self._client()
+        self._stub(monkeypatch, client, direct=True, relay=False)
+        out = client.wake_on_lan("A0:AD:9F:A4:72:97")
+        assert "direct broadcast sent" in out
+        assert "relay via 10.0.0.9 FAILED" in out
+
+    def test_raises_when_no_route_accepts(self, monkeypatch):
+        from magmascript.core.exceptions import MagmascriptError
+
+        client = self._client()
+        self._stub(monkeypatch, client, direct=False, relay=False)
+        try:
+            client.wake_on_lan("A0:AD:9F:A4:72:97")
+        except MagmascriptError as e:
+            assert "no route accepted" in str(e)
+        else:
+            raise AssertionError("expected MagmascriptError when both routes fail")
+
+    def test_unconfigured_pi_is_named_not_silently_skipped(self, monkeypatch):
+        """A missing [pi] host makes this home-only, so it must say so."""
+        client = self._client(pi_host="", pi_user="")
+        calls = self._stub(monkeypatch, client, direct=True, relay=True)
+        out = client.wake_on_lan("A0:AD:9F:A4:72:97")
+        assert [c[0] for c in calls] == ["direct"]
+        assert "relay SKIPPED" in out
+        assert "home-only" in out
+
+    def test_relay_false_skips_the_pi(self, monkeypatch):
+        client = self._client()
+        calls = self._stub(monkeypatch, client, direct=True, relay=True)
+        client.wake_on_lan("A0:AD:9F:A4:72:97", relay=False)
+        assert [c[0] for c in calls] == ["direct"]
+
+    def test_hyphens_are_normalised(self, monkeypatch):
+        client = self._client()
+        calls = self._stub(monkeypatch, client, direct=True, relay=True)
+        client.wake_on_lan("A0-AD-9F-A4-72-97")
+        assert {c[1] for c in calls} == {"A0:AD:9F:A4:72:97"}
+
+    def test_rejects_a_non_mac(self, monkeypatch):
+        client = self._client()
+        calls = self._stub(monkeypatch, client, direct=True, relay=True)
+        for bad in ("", "nope", "A0:AD:9F:A4:72", "A0:AD:9F:A4:72:97:FF", "ZZ:..."):
+            try:
+                client.wake_on_lan(bad)
+            except ValueError:
+                pass
+            else:
+                raise AssertionError(f"expected ValueError for {bad!r}")
+        assert calls == [], "nothing may be sent for a malformed MAC"
+
+    def test_rejects_shell_injection_before_sending(self, monkeypatch):
+        """The relay interpolates the MAC into a command a remote shell parses."""
+        client = self._client()
+        calls = self._stub(monkeypatch, client, direct=True, relay=True)
+        for bad in (
+            "A0:AD:9F:A4:72:97; touch /tmp/pwned",
+            "A0:AD:9F:A4:72:97 && reboot",
+            "$(reboot)",
+            "`reboot`",
+        ):
+            try:
+                client.wake_on_lan(bad)
+            except ValueError:
+                pass
+            else:
+                raise AssertionError(f"expected ValueError for {bad!r}")
+        assert calls == []