Probe Agent¶

The Probe Agent performs active liveness checks and parallel CLI execution across multiple devices. It is the only Ops subagent that directly accesses live network devices.

Feature Claims

ID	Claim	Status
C-NE-24	`execute_cli_parallel` validates commands against the whitelist before execution	🔶 Env-Blocked
C-NE-25	Device names are restricted to `[a-zA-Z0-9_\-.]`; invalid characters are rejected	⬜ Pending

When to Use¶

"Are all core routers reachable?"
"Run show ip route on every device"
"Check OSPF neighbor state across the network"

The orchestrator routes these requests to Probe because they require live SSH connections.

Tool: execute_cli_parallel¶

Runs a CLI command on multiple devices simultaneously using Nornir.

execute_cli_parallel(
    command: str,           # CLI command to execute
    devices: list[str],     # Target device names (from netops.devices)
    timeout: int = 30       # Per-device timeout in seconds
)

Safety Model¶

Before any SSH connection is made, three checks are enforced:

Device name validation — Names must match [a-zA-Z0-9_\-.]. This prevents injection attacks through crafted hostnames.
Whitelist check — The command must exist in the commands table for the target device's platform. Commands not in the whitelist are rejected.
Blacklist check — Even whitelisted commands are rejected if they match any pattern in blacklisted_commands.yaml.

User request: "Run 'reload' on R1"
    → Whitelist: not in commands table → REJECTED
    → (even if whitelisted, blacklist regex "reload" would also reject)

Pipe Commands¶

Commands containing | (pipe) require pipe_allowed = true in the commands table entry. This prevents accidental shell injection through piped output.

Example Usage¶

Via the Ops orchestrator:

olav --agent ops "Check if all BGP neighbors are established across the network"

The orchestrator delegates to Probe, which:

Queries netops.devices for all device names
Runs show ip bgp summary on each device in parallel
Returns aggregated results with per-device status