v1.1.2 - Safer generation and validation

v1.1.2 - Safer generation and validation

Security

• Validate build and config before writing candidate configurations. Refuse errors and required inconclusive tests; strict mode rejects warnings too.
• Redact credential previews by default. --include-secrets explicitly enables restricted config output; HTML, Markdown, diagnostic and diff reports retain sanitized previews.
• Discard values from quarantined imported lines and never re-emit extraConfig.
• Constrain device IDs and command values, separate optional Cisco hostnames from IDs, check output containment and existing links, and reject case-insensitive filename collisions.
• Render subnet gateway details through DOM text nodes and select severity/status classes from fixed tokens. The exact Socket XSS was already escaped in v1.1.1; this release strengthens those boundaries and adds permanent regressions.

Reliability and workflow

• Unknown model fields fail by default. Use validate --relaxed only for incomplete discovery; structural errors still fail and relaxed validation cannot produce configurations.
• build --allow-invalid creates diagnostic reports without configs. A failed quality gate retains a nonzero exit code.
• Explicit unsupported CLI platforms, including NX-OS, receive no IOS/ASA commands.
• IOS and ASA candidates omit automatic saving. Apply, observed verification and persistence are separate actions.
• Skill instructions distinguish quick answers, labs and audits; label modeled versus observed results and state Packet Tracer .pkt and protocol simulation limits.
• Regenerate all eight example diagrams and add synchronization checks, regression tools and Windows/Ubuntu CI with Node 22/24.

Migration notes

Correct unknown fields and unsafe IDs, resolve required unknown tests, and replace redacted credentials before applying a lab configuration. For explicitly requested secret-bearing candidates, use config or build --include-secrets and protect the resulting files. Reconstruct needed extraConfig behavior using supported fields; unsupported commands are no longer appended automatically. Regenerate existing HTML to receive the current viewer and sanitized previews.

Validation

The identical 47-test suite passes 25 tests on v1.1.1 and all 47 after these changes. All 21 original toolkit scenarios remain passing. Eight example diagrams are synchronized. Headless Edge reproduces the old vulnerable viewer and blocks the tested attacks in v1.1.1 and the improved viewer, with fixed severity classes in the latter.

Local evidence covers Windows/Node 24 and browser fixtures, not live network devices. CI passed on Windows and Ubuntu with Node 22 and 24. Socket re-audit remains pending. CI run. See the before/after report for raw evidence and limits.

Full changelog: v1.1.1 to v1.1.2.

v1.1.1 — Viewer security fix

Security

• Diagram viewer (DOM-XSS): model values were inserted as HTML without escaping in the subnet panel (gateways), the overview (device types, VLAN names) and the class attribute of status pills and diagnostic severities. A crafted *.net.json could run script when its topology.html was opened. All of them are now escaped; rendered examples regenerated. Reported by the Socket audit on skills.sh.

Regenerate existing diagrams with netlab render / netlab build to pick up the fixed viewer.

Full changelog: v1.1.0...v1.1.1

🤖 Generated with Claude Code

v1.1.0 — English-first

The project is now English-first and lives in the whetstone-dev organization.

Added

• Website in web/ (Next.js static export, English and Spanish): explains the skill with the real diagrams from examples/rendered, usage examples and installation. Published to GitHub Pages by .github/workflows/pages.yml: https://whetstone-dev.github.io/network-engineering/
• SKILL.md rule: Claude answers in the user's language even though the skill content is in English.

Changed

• Everything is in English: SKILL.md, the 17 references, templates, JSON Schema descriptions, netlab output (diagnostics, trace, routes, calculators, CLI help), generated documentation, comments and banners in generated configs, the interactive diagram viewer, code comments and repository docs. The website opens in English by default.
• Example data in English: VLANs SALES, IT, MGMT, GUESTS, USERS, SERVERS; sites SITE-A/SITE-B; devices LAP-GUEST, PC-S1, PC-S2; ACL GUESTS-IN. examples/wan-2sedes-ospf-serial.net.json was renamed to examples/wan-2sites-ospf-serial.net.json. All rendered diagrams were regenerated.
• netlab import writes the placeholders <SECRET> and <COMMUNITY> (previously <SECRETO>/<COMUNIDAD>); models imported before keep validating. The default output file is imported-network.net.json.
• The repository moved to the whetstone-dev organization: npx skills add whetstone-dev/network-engineering. GitHub redirects the old URLs.

v1.0.0 — First public release

First public release.

Added

• *.net.json network model as the single source of truth, with a JSON Schema (schemas/network-model.schema.json) for VS Code autocomplete and detection of misspelled fields.
• netlab CLI (native TypeScript on Node.js ≥ 22.18, zero dependencies): validate, build, render, config, docs, mermaid, trace, routes, init, import, diff, schema, catalog and calculators (subnet, vlsm, ipv6, eui64).
• Whole-network validation: cabling and media, interfaces per Packet Tracer model, VLANs, trunks and native VLAN, router-on-a-stick, EtherChannel, per-VLAN STP (root and blocked ports), HSRP, IPv4/IPv6, DHCP with simulated leases, OSPF/OSPFv3/EIGRP/RIP/BGP, static routes, ACLs, NAT/PAT, ASA and IPsec VPN.
• Simulation: routing tables with real AD and metrics (OSPF cost, EIGRP composite metric) and round-trip ping with LPM, ACLs, NAT, HSRP, stateful ASA firewall and IPsec tunnels.
• Config generation: Cisco IOS / IOS XE (VLANs, trunks, ROAS, SVIs, EtherChannel, STP, HSRP, OSPF, OSPFv3, EIGRP, RIP, BGP, DHCP, NAT with VPN exemption, ACLs, SSH, IPsec crypto map), Cisco ASA 8.3+ and GUI instructions for Packet Tracer end devices.
• Self-contained interactive diagram (SVG + JS, no CDN): inspector, physical and L3 views, VLAN filter, search, diagnostics, ping highlighting, STP lights, dark mode, SVG/PNG export and persistent layout.
• Import of show running-config and show cdp neighbors [detail] into a model (secrets are not imported).
• Diff between model versions with a report and a change diagram.
• 17 references (IOS, Packet Tracer, IPv4, IPv6, switching, STP, routing, services, security, wireless, topologies, troubleshooting, labs, analysis, documentation, diagramming, model), templates and 7 validated examples.
• Test suite (node --test) and CI on GitHub Actions.