CVE-2026-44405 allows SHA-1 signature algorithm in paramiko through
4.0.0. netmiko 4.7.0 still permits paramiko<5.0, so pip resolves to
the vulnerable 4.0.0. Explicitly pinning paramiko>=5.0.0 ensures the
fix commit a448945 is included.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
The Web Wireshark WebSocket endpoint created a WebWiresharkManager but
never called close(), leaving the DockerHTTPClient's ClientSession with
UnixConnector unclosed when users closed the browser tab.
Also switch asyncio.wait in WebSocket proxy from ALL_COMPLETED to
FIRST_COMPLETED to avoid blocking cleanup when one direction disconnects.
Add comprehensive roadmap document for optimizing the gns3/web-wireshark
Docker image size from current 2GB to target 1.5GB (25% reduction).
Key findings:
- 570MB of cleanable files identified (locales, docs, ibus, dev packages)
- Compression analysis shows limited benefit (1-5%) vs file cleanup (25%)
- Detailed implementation plan with safe optimization phases
- Focus on transfer optimization and build-time compression strategies
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Rewrite the packet-analysis document based on actual code:
protocol-oriented analysis with tshark, 40+ supported protocols,
two-tool architecture (skills query + capture analysis), field
validation, and hot reload support.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Document the planned CRUD + PR management API for GNS3 skills
(prompts, fault injection, device skills, packet analysis),
enabling the Web UI to browse, edit, save, and contribute
skill changes back to the upstream repository.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- Register packet_analysis_skills as a LangChain tool for LLM
- LLM can query protocol field definitions before calling packet_analysis
- Follows the same pattern as DeviceSkillsTool and InjectionSkillsTool
- Delete packet_capture_tools.py (analyze_packets with packet_number)
- PacketAnalysisTool is more flexible and can do everything the old tool could
- Update tool registration to use only PacketAnalysisTool
- Cleaner, more unified packet analysis interface
- Add PacketAnalysisTool that accepts user-provided tshark arguments
- LLM constructs tshark commands based on protocol knowledge from skills
- Add PACKET_ANALYSIS_REGISTRY for protocol definitions
- Add load_packet_analysis_protocols() to SkillsLoader
- Add get_packet_analysis_protocol() and list functions to registry
- Register PacketAnalysisTool in teaching and lab automation modes
- Update SkillsManager to reload packet analysis protocols
Related: GNS3-Skills commit 7bc45d2
Close GitHub issues and document as roadmaps instead:
- #2731: user preferences API
- #2732: server settings REST API
- #2733: injection fault tracking
- packet analysis: protocol-oriented analysis architecture
- Remove 5s thread.join() timeout so git clone/pull is not truncated
- Remove _init_complete flag, reset _init_in_progress on failure instead
- Let /reload/skills API retry initialization after network failure
- Raise GIT_HTTP_LOW_SPEED_LIMIT from 1 KB/s to 10 KB/s
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Add missing dependencies for the external skills repository feature:
- PyYAML>=6.0.0: for loading YAML skill files
- GitPython>=3.1.0: for Git operations (clone/pull) on skills repo
These dependencies are required by the SkillsManager and SkillsLoader
classes introduced in commit e68cc17e.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
## Summary
Add a complete fault injection system for GNS3 Copilot, migrate all
skills from local Python files to an external Git repository with
hot reload support, and restructure Copilot API under /copilot/.
## Key Changes
### Fault Injection
- New troubleshooting_injection mode with InjectionSkillsTool
- 368 fault scenarios across 39 protocol categories
- Context-based filtering (LLM must pass topology protocols)
### External Skills Repository
- SkillsManager: Git clone/pull, version tracking, smart updates
- SkillsLoader: YAML skills + Markdown prompts from external repo
- Hot reload via POST /copilot/reload/skills
- Configurable via gns3_server.conf
### Architecture
- API unified under /copilot/ prefix
- SkillsManager moved from Controller to agent module
- Lazy initialization with startup background preload
- Per-command Git timeout, smart update checks
- Forbidden commands hot-reloadable from external repo
- 32 INFO logs downgraded to DEBUG
DeepSeek models (deepseek-v4-flash/pro) enable thinking mode by default,
which returns reasoning_content that must be passed back to the API in
subsequent requests. This causes 400 errors in multi-turn conversations
when the reasoning_content is not properly handled.
This commit disables thinking mode by passing extra_body={"thinking": {"type": "disabled"}}
as an explicit parameter to DeepSeek models, preventing the reasoning_content
field from being generated.
Modified:
- create_base_model(): Add extra_body parameter with thinking mode disabled
- create_title_model(): Add extra_body parameter with thinking mode disabled
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
When importing a project, the round-robin logic would attempt to distribute
nodes across all configured compute resources, including offline ones. This
caused import failures when any remote compute was unreachable.
This fix filters the compute list to only include connected computes before
round-robin distribution. If no remote computes are connected, all nodes
are assigned to the local compute.
This matches the approach used in project._get_disconnected_computes() and
prevents the issue where importing a project fails with:
"Cannot connect to compute 'X' with request POST /projects"
Fixes issue introduced in commit 90e3a8d6 (2017) which added round-robin
load balancing without considering offline compute nodes.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Fix F821 undefined name 'status' error by importing the status
module from fastapi. This resolves build errors when using
status.HTTP_403_FORBIDDEN and status.HTTP_404_NOT_FOUND.
Add exception handling in stop_wrap_console to gracefully handle
ConnectionResetError, BrokenPipeError, and OSError when waiting
for console writer to close.
This prevents 500 errors when stopping QEMU nodes if the console
connection is reset before the writer finishes closing.
Fixes race condition where QEMU process exits and closes connections
before the console writer cleanup completes.
