Vyos

Internal refactor (vyos.ts split into core + 6 per-family modules + thin entry; no behavior change) plus a new @shrug/vyos-firewall method report: renders firewall posture from a show snapshot — base-chain hook defaults, interface→ruleset segment map, WAN exposure, per-ruleset detail, and an Attention section flagging permissive default-action=accept chains. Parser is order-independent and total over unknown lines.

Add typed NAT and static-route per-resource models. NAT: syncNat/ensureNat/removeNat manage one direction's rule list (nat source|destination) declaratively as one unit; rules model protocol/source/destination(address,port,group)/interfaces/translation(+masquerade)/exclude/disable/log + raw[]. Static routes: syncStaticRoute/ensureStaticRoute/removeStaticRoute manage one prefix (route vs route6 auto-selected) with next-hops(distance/disable/interface)/interface-routes/blackhole/dhcp-interface + raw[]; instance name slugifies '/'. Both cleartext, reachable preflight on the mutators. 96 unit tests; live round-trip verified.

Add typed firewall per-resource model: syncFirewall/ensureFirewall/removeFirewall manage a named ruleset (firewall name ) declaratively as one unit — reconciles to exactly the desired rules (omitted rules removed), idempotent, dryRun-able. Cleartext firewallRuleset resource; rules model action/protocol/state/source/destination(+groups)/interfaces/jump-target/log plus a raw[] escape hatch. reachable preflight on the new mutators. 66 unit tests; live-verified round-trip.

v2026.07.10.8 — per-resource models: wireguard (sync/ensure/remove, whole-record vaulted) and interface (sync/ensure, scoped reconcile that never wipes the subtree). Additive.

v2026.07.10.6 — first typed per-resource methods: syncRouterAdvert/ensureRouterAdvert/removeRouterAdvert (declarative IPv6 RA/SLAAC, idempotent reconcile). buildConfigScript now gates commit on the real compare diff (net-zero staged changes are a true no-op). Additive.

v2026.07.10.5 — secrets (opt-in vault flag on apply), read-only diff/compare method, structured show (native 'show configuration json' -> queryable configTree), sshExec IdentitiesOnly fix; relocated to self-contained package. Additive, back-compatible.

v2026.07.10.2 addresses the v1 adversarial-review issues: per-method structured logging; idempotent apply (existsActive delete-guards, sessionChanged commit-guard, dryRun mode); a reachable pre-flight check (labels [live], appliesTo [apply]); vbash script redacted by default (storeScript opt-in); and vyos_test.ts with 20 unit tests via an injectable SSH seam. The apply/run write-then-throw diagnostic-record behavior is retained intentionally.