Juniper Junos OS

Junos OS — Juniper SRX, MX, vEX, vMX, EX.

Shorthand expansion

Junos’s CLI accepts contractions natively (sh int br → show interfaces brief). Transit AI expands the first token before checking it against the permit list:

Alias	Canonical
`sh`, `sho`, `shw`	`show`
`p`	`ping`
`tr`	`traceroute`
`mon`	`monitor`

Allowed (head)

show — operational status (show interfaces, show route, show bgp summary, etc.)
ping, traceroute
monitor — monitor traffic, monitor interface
file list — directory listing (file copy/delete/rename blocked)
op — operator scripts (conventionally read-only)
help — interactive help

Blocked (head)

Shell escape (highest priority):

start shell — drops to the underlying FreeBSD shell. Fully bypasses the permit list.

System state changes:

request system — reboot, halt, snapshot, software install
request — any other request *
restart, reboot, reload, reset

Configuration mode + commits:

configure, commit
edit, rollback, load, save
copy, file (copy|delete|rename|create)

Routing-engine state:

clear — counters, ARP, BGP sessions, etc.
test — runs config tests; can side-effect

Session control:

quit, exit, logout

Pipe stages

Allowed: display set, display xml, display json, display inheritance, match, except, find, count, last, last N, no-more, trim

Blocked: save, compare, commit, request

Notes

set cli screen-length 0 is sent automatically at connect time so the AI’s command output capture doesn’t stall on ---(more)--- pager prompts. This isn’t a permit-list decision — it’s a session setup detail.
Junos’s “operational mode” verbs map cleanly to the permit list; “config mode” entry is blocked at the first word, so anything past that point never even reaches the list.