@usex/mikrotik-mcp 3.19.0 → 3.21.0

package/dist/cli.js

@@ -617,7 +617,7 @@ class MikroTikMacTelnetClient {
       return false;
     }
   }
-  async run(command) {
+  async run(command, _opts = {}) {
     if (!this.console || !this.console.isReady) {
       throw new Error("Not connected to MikroTik device (MAC-Telnet)");
     }
@@ -694,7 +694,7 @@ class MikroTikSSHClient {
       }).connect(cfg);
     });
   }
-  run(command) {
+  run(command, opts = {}) {
     if (!this.client) {
       return Promise.reject(new Error("Not connected to MikroTik device"));
     }
@@ -707,11 +707,30 @@ class MikroTikSSHClient {
         }
         const stdout = [];
         const stderrBuf = [];
-        stream.on("close", () => {
+        let settled = false;
+        let timer;
+        const finish = () => {
+          if (settled)
+            return;
+          settled = true;
+          if (timer)
+            clearTimeout(timer);
           const out = decodeOutput(Buffer.concat(stdout));
           const error = decodeOutput(Buffer.concat(stderrBuf));
           resolve2(error && !out ? error : out);
-        }).on("data", (d) => stdout.push(d)).stderr.on("data", (d) => stderrBuf.push(d));
+        };
+        if (opts.maxMs && opts.maxMs > 0) {
+          timer = setTimeout(() => {
+            try {
+              stream.signal("INT");
+            } catch {}
+            try {
+              stream.close();
+            } catch {}
+            finish();
+          }, opts.maxMs);
+        }
+        stream.on("close", finish).on("data", (d) => stdout.push(d)).stderr.on("data", (d) => stderrBuf.push(d));
       });
     });
   }
@@ -782,7 +801,6 @@ import { z as z3 } from "zod";
 
 // src/ssh/safe-mode.ts
 var PROMPT_RE = /\[.+?@.+?\] (?:<SAFE> )?> ?$/m;
-var NORMAL_PROMPT_RE = /\[.+?@.+?\] > ?$/m;
 var ANSI_RE = /\x1B(?:\[[0-9;]*[mA-HJ-MSTfhilnprsu]|[()][0-9A-Za-z]|\[?\?\d+[hl])/g;
 function stripAnsi(text) {
   return text.replace(ANSI_RE, "");
@@ -793,13 +811,17 @@ function isSafeModeActivated(response) {
     return true;
   return /safe mode[^\n]*\b(?:success|taken|enabled|active)\b/i.test(response);
 }
-function isSafeModeReleased(response) {
+function lastNonEmptyLine(response) {
   const lines = response.replace(/\r/g, "").split(`
 `).map((l) => l.trimEnd()).filter(Boolean);
-  const last = lines.at(-1) ?? "";
-  return NORMAL_PROMPT_RE.test(last) && !last.includes("<SAFE>");
+  return lines.at(-1) ?? "";
+}
+function classifyPrompt(response) {
+  const last = lastNonEmptyLine(response);
+  if (!PROMPT_RE.test(last))
+    return "unknown";
+  return last.includes("<SAFE>") ? "safe" : "released";
 }
-
 class SafeModeManager {
   deviceName;
   ssh = null;
@@ -874,13 +896,30 @@ class SafeModeManager {
     return this.lock(async () => {
       if (!this.active || !this.channel)
         return "Safe mode is not active. Nothing to commit.";
+      this.channel.write(`
+`);
+      const probe = await this.readSettledPrompt();
+      const before = classifyPrompt(probe);
+      if (before === "released") {
+        this.cleanup();
+        return "Safe mode already exited \u2014 your changes are committed. Safe mode DISABLED.";
+      }
+      if (before === "unknown") {
+        return "Could not read a prompt to determine Safe Mode state. The session is left open so " + "nothing is reverted \u2014 call get_safe_mode_status, retry commit_safe_mode, or " + `rollback_safe_mode. Last output: ${probe.slice(-160)}`;
+      }
       this.channel.write(CTRL_X);
-      const response = await this.readUntilPrompt(15000, (c) => isSafeModeReleased(c));
-      if (!isSafeModeReleased(response)) {
-        return "Commit may not have completed: the device did not return to a normal prompt " + `after exiting Safe Mode. Session left open \u2014 retry commit_safe_mode. Response: ${response.slice(-200)}`;
+      this.channel.write(`
+`);
+      const after = await this.readSettledPrompt();
+      switch (classifyPrompt(after)) {
+        case "released":
+          this.cleanup();
+          return "Changes committed successfully. Safe mode DISABLED.";
+        case "safe":
+          return "Commit not completed \u2014 the device is still in Safe Mode. Your changes remain held " + "in memory (not reverted); call commit_safe_mode again to retry, or rollback_safe_mode " + "to discard them.";
+        default:
+          return "Commit status unclear \u2014 no prompt seen after exiting Safe Mode. The session is left " + "open so nothing is reverted; verify with get_safe_mode_status or retry commit_safe_mode. " + `Last output: ${after.slice(-160)}`;
       }
-      this.cleanup();
-      return "Changes committed successfully. Safe mode DISABLED.";
     });
   }
   rollback() {
@@ -916,6 +955,33 @@ class SafeModeManager {
       channel.on("data", onData);
     });
   }
+  readSettledPrompt(quietMs = 450, maxMs = 8000) {
+    const channel = this.channel;
+    if (!channel)
+      return Promise.resolve("");
+    return new Promise((resolve2) => {
+      let buf = "";
+      let quiet;
+      let hard;
+      function done() {
+        clearTimeout(hard);
+        if (quiet)
+          clearTimeout(quiet);
+        channel.removeListener("data", onData);
+        resolve2(stripAnsi(buf));
+      }
+      function onData(chunk) {
+        buf += decodeOutput(chunk);
+        if (PROMPT_RE.test(lastNonEmptyLine(stripAnsi(buf)))) {
+          if (quiet)
+            clearTimeout(quiet);
+          quiet = setTimeout(done, quietMs);
+        }
+      }
+      hard = setTimeout(done, maxMs);
+      channel.on("data", onData);
+    });
+  }
   extractOutput(raw, command) {
     const text = raw.replace(/\r\n/g, `
 `).replace(/\r/g, `
@@ -963,7 +1029,7 @@ function getSafeModeManager(deviceName) {
 }
 
 // src/core/connector.ts
-async function runOnce(command, deviceName) {
+async function runOnce(command, deviceName, opts) {
   const name = resolveDeviceName(deviceName);
   const dc = getDevice(deviceName);
   const client = createDeviceClient(dc);
@@ -971,12 +1037,12 @@ async function runOnce(command, deviceName) {
     if (!await client.connect()) {
       throw new Error(connectErrorMessage(name, dc, client.lastError));
     }
-    return await client.run(command);
+    return await client.run(command, opts);
   } finally {
     client.disconnect();
   }
 }
-async function executeMikrotikCommand(command, ctx) {
+async function executeMikrotikCommand(command, ctx, opts) {
   const deviceName = resolveDeviceName(ctx.device);
   const safe = getSafeModeManager(deviceName);
   if (safe.isActive) {
@@ -984,7 +1050,7 @@ async function executeMikrotikCommand(command, ctx) {
     return safe.execute(command);
   }
   ctx.info(`[${deviceName}] Executing MikroTik command: ${command}`);
-  return runOnce(command, ctx.device);
+  return runOnce(command, ctx.device, opts);
 }
 
 // src/core/registry.ts
@@ -1006,7 +1072,7 @@ function createContext(sendLog, device) {
 }
 
 // src/core/routeros.ts
-var BARE_SAFE = /^[\w.\-:/,*@]+$/;
+var BARE_SAFE = /^[\w.\-:/,*@!]+$/;
 function quoteValue(value) {
   if (typeof value === "number" || typeof value === "boolean")
     return String(value);
@@ -1077,6 +1143,16 @@ function isEmpty(result) {
   const t = result.trim();
   return t === "" || t === "no such item" || t === "no such item (4)";
 }
+function flattenLiveOutput(text) {
+  return text.split(`
+`).map((line) => {
+    const segs = line.split("\r").filter((s) => s.trim() !== "");
+    return segs.length ? segs[segs.length - 1] : "";
+  }).join(`
+`).replace(/\n{3,}/g, `
+
+`).trim();
+}
 function extractCreatedId(output) {
   const star = output.match(/\*[0-9A-Fa-f]+/);
   if (star)
@@ -6317,6 +6393,12 @@ async function updateNatRule(a, ctx) {
   put("protocol", a.protocol);
   put("in-interface", a.in_interface);
   put("out-interface", a.out_interface);
+  put("in-interface-list", a.in_interface_list);
+  put("out-interface-list", a.out_interface_list);
+  put("src-address-list", a.src_address_list);
+  put("dst-address-list", a.dst_address_list);
+  put("connection-mark", a.connection_mark);
+  put("connection-nat-state", a.connection_nat_state);
   put("to-addresses", a.to_addresses);
   put("to-ports", a.to_ports);
   if (a.comment !== undefined)
@@ -6353,8 +6435,14 @@ var firewallNatTools = [
       src_port: z23.string().optional(),
       dst_port: z23.string().optional(),
       protocol: z23.string().optional(),
-      in_interface: z23.string().optional(),
+      in_interface: z23.string().optional().describe('Negatable, e.g. "!ether1"'),
       out_interface: z23.string().optional(),
+      in_interface_list: z23.string().optional().describe('Interface list, e.g. "WAN" or "!LAN"'),
+      out_interface_list: z23.string().optional(),
+      src_address_list: z23.string().optional().describe('Match src in a named list; negate "!name"'),
+      dst_address_list: z23.string().optional().describe('Match dst in a named list; negate "!name"'),
+      connection_mark: z23.string().optional(),
+      connection_nat_state: z23.string().optional().describe('"srcnat" / "dstnat" / "!dstnat"'),
       to_addresses: z23.string().optional().describe('Single IP or range e.g. "10.0.0.1" or "10.0.0.1-10.0.0.10"'),
       to_ports: z23.string().optional().describe('Single port or range e.g. "8080" or "8080-8090"'),
       comment: z23.string().optional(),
@@ -6394,7 +6482,7 @@ var firewallNatTools = [
       } else if (a.chain === "dstnat" && !dstnatActions.includes(a.action)) {
         return `Error: Invalid action '${a.action}' for dstnat. Must be one of: ${dstnatActions.join(", ")}`;
       }
-      const cmd = new Cmd("/ip firewall nat add").set("chain", a.chain).set("action", a.action).opt("src-address", a.src_address).opt("dst-address", a.dst_address).opt("src-port", a.src_port).opt("dst-port", a.dst_port).opt("protocol", a.protocol).opt("in-interface", a.in_interface).opt("out-interface", a.out_interface).opt("to-addresses", a.to_addresses).opt("to-ports", a.to_ports).opt("comment", a.comment).flag("disabled", a.disabled).flag("log", a.log).opt("log-prefix", a.log ? a.log_prefix : undefined).opt("place-before", a.place_before).build();
+      const cmd = new Cmd("/ip firewall nat add").set("chain", a.chain).set("action", a.action).opt("src-address", a.src_address).opt("dst-address", a.dst_address).opt("src-port", a.src_port).opt("dst-port", a.dst_port).opt("protocol", a.protocol).opt("in-interface", a.in_interface).opt("out-interface", a.out_interface).opt("in-interface-list", a.in_interface_list).opt("out-interface-list", a.out_interface_list).opt("src-address-list", a.src_address_list).opt("dst-address-list", a.dst_address_list).opt("connection-mark", a.connection_mark).opt("connection-nat-state", a.connection_nat_state).opt("to-addresses", a.to_addresses).opt("to-ports", a.to_ports).opt("comment", a.comment).flag("disabled", a.disabled).flag("log", a.log).opt("log-prefix", a.log ? a.log_prefix : undefined).opt("place-before", a.place_before).build();
       const result = await executeMikrotikCommand(cmd, ctx);
       const trimmed = result.trim();
       if (looksLikeError(trimmed)) {
@@ -6492,6 +6580,12 @@ ${result}`;
       protocol: z23.string().optional(),
       in_interface: z23.string().optional(),
       out_interface: z23.string().optional(),
+      in_interface_list: z23.string().optional(),
+      out_interface_list: z23.string().optional(),
+      src_address_list: z23.string().optional().describe('Negate with "!name"'),
+      dst_address_list: z23.string().optional().describe('Negate with "!name"'),
+      connection_mark: z23.string().optional(),
+      connection_nat_state: z23.string().optional(),
       to_addresses: z23.string().optional(),
       to_ports: z23.string().optional(),
       comment: z23.string().optional(),
@@ -6584,10 +6678,33 @@ async function updateMangleRule(a, ctx) {
   put("protocol", a.protocol);
   put("in-interface", a.in_interface);
   put("out-interface", a.out_interface);
+  put("in-interface-list", a.in_interface_list);
+  put("out-interface-list", a.out_interface_list);
+  put("src-address-list", a.src_address_list);
+  put("dst-address-list", a.dst_address_list);
+  put("src-address-type", a.src_address_type);
+  put("dst-address-type", a.dst_address_type);
   put("connection-mark", a.connection_mark);
   put("packet-mark", a.packet_mark);
   put("routing-mark", a.routing_mark);
   put("connection-state", a.connection_state);
+  put("connection-nat-state", a.connection_nat_state);
+  put("connection-type", a.connection_type);
+  put("connection-bytes", a.connection_bytes);
+  put("connection-limit", a.connection_limit);
+  put("connection-rate", a.connection_rate);
+  put("per-connection-classifier", a.per_connection_classifier);
+  put("tcp-flags", a.tcp_flags);
+  put("dscp", a.dscp);
+  put("priority", a.priority);
+  put("packet-size", a.packet_size);
+  put("layer7-protocol", a.layer7_protocol);
+  put("ipsec-policy", a.ipsec_policy);
+  put("nth", a.nth);
+  put("random", a.random);
+  put("time", a.time);
+  put("hotspot", a.hotspot);
+  put("p2p", a.p2p);
   put("new-connection-mark", a.new_connection_mark);
   put("new-packet-mark", a.new_packet_mark);
   put("new-routing-mark", a.new_routing_mark);
@@ -6624,7 +6741,7 @@ var firewallMangleTools = [
     name: "create_mangle_rule",
     title: "Create IPv4 Firewall Mangle Rule",
     annotations: WRITE,
-    description: "Creates an IPv4 mangle rule (`/ip firewall mangle add`) \u2014 the packet-marking and header-modification table, " + "used to mark connections/packets/routing (for policy routing, QoS and per-connection classification) or to change DSCP/TTL/MSS. " + "For accept/drop decisions use create_filter_rule; for address translation use create_nat_rule; for IPv6 mangle use create_ipv6_mangle_rule. " + "chain: prerouting/input/forward/output/postrouting. " + "action: mark-connection/mark-packet/mark-routing/change-dscp/change-ttl/change-mss/add-src-to-address-list/add-dst-to-address-list/fasttrack-connection/route/set-priority/accept/etc. " + "Set the matching new-*-mark field for mark-* actions and keep passthrough=true so later rules can also match the same packet; " + "for add-*-to-address-list set address_list (and optionally address_list_timeout). " + "place_before accepts a rule number or ID (*N) to control insertion position. " + "Returns the created rule's detail including its `.id`.",
+    description: "Creates an IPv4 mangle rule (`/ip firewall mangle add`) \u2014 the packet-marking and header-modification table, " + "used to mark connections/packets/routing (for policy routing, QoS and per-connection classification) or to change DSCP/TTL/MSS. " + "For accept/drop decisions use create_filter_rule; for address translation use create_nat_rule; for IPv6 mangle use create_ipv6_mangle_rule. " + "chain: prerouting/input/forward/output/postrouting. " + "action: mark-connection/mark-packet/mark-routing/change-dscp/change-ttl/change-mss/add-src-to-address-list/add-dst-to-address-list/fasttrack-connection/route/set-priority/accept/etc. " + "Set the matching new-*-mark field for mark-* actions and keep passthrough=true so later rules can also match the same packet; " + "for add-*-to-address-list set address_list (and optionally address_list_timeout). " + "Full match surface: address-lists (src_address_list/dst_address_list \u2014 negate with a leading '!', e.g. dst_address_list='!IR' to route traffic NOT bound for a list), " + "interface-lists, per_connection_classifier (PCC load-balancing), connection_nat_state, tcp_flags, dscp, layer7_protocol, time, and more. " + "Typical policy-routing rule: chain=prerouting, src_address=<lan>, dst_address_list='!IR', action=mark-routing, new_routing_mark=<table>, then a routing rule/route uses that table. " + "place_before accepts a rule number or ID (*N) to control insertion position. " + "Returns the created rule's detail including its `.id`.",
     inputSchema: {
       chain: z24.enum(["prerouting", "input", "forward", "output", "postrouting"]),
       action: z24.enum([
@@ -6654,12 +6771,35 @@ var firewallMangleTools = [
       src_port: z24.string().optional(),
       dst_port: z24.string().optional(),
       protocol: z24.string().optional(),
-      in_interface: z24.string().optional(),
+      in_interface: z24.string().optional().describe('Negatable, e.g. "!ether1"'),
       out_interface: z24.string().optional(),
+      in_interface_list: z24.string().optional().describe('Interface list, negatable e.g. "!WAN"'),
+      out_interface_list: z24.string().optional(),
+      src_address_list: z24.string().optional().describe('Match src in a named list; negate "!name"'),
+      dst_address_list: z24.string().optional().describe('Match dst in a named list; negate "!name" (e.g. "!IR" routes foreign traffic)'),
+      src_address_type: z24.string().optional().describe('e.g. "local", "unicast", "!local"'),
+      dst_address_type: z24.string().optional(),
       connection_mark: z24.string().optional(),
       packet_mark: z24.string().optional(),
       routing_mark: z24.string().optional(),
-      connection_state: z24.string().optional().describe('e.g. "new", "established,related", "invalid"'),
+      connection_state: z24.string().optional().describe('e.g. "new", "established,related", "!invalid"'),
+      connection_nat_state: z24.string().optional().describe('"srcnat" / "dstnat" / "!dstnat"'),
+      connection_type: z24.string().optional().describe('Helper, e.g. "sip", "ftp"'),
+      connection_bytes: z24.string().optional().describe('e.g. "1000000-0" (>1 MB connections)'),
+      connection_limit: z24.string().optional().describe('e.g. "100,32"'),
+      connection_rate: z24.string().optional().describe('e.g. "100k-1M"'),
+      per_connection_classifier: z24.string().optional().describe('PCC for load balancing, e.g. "both-addresses:2/0"'),
+      tcp_flags: z24.string().optional().describe('RouterOS flag expression e.g. "syn,!ack"'),
+      dscp: z24.string().optional().describe("Match incoming DSCP (0-63)"),
+      priority: z24.string().optional().describe("Match packet/queue priority (0-63)"),
+      packet_size: z24.string().optional().describe('e.g. "1500" or "0-500"'),
+      layer7_protocol: z24.string().optional().describe("Name of an /ip firewall layer7-protocol regex"),
+      ipsec_policy: z24.string().optional().describe('e.g. "in,ipsec" or "out,none"'),
+      nth: z24.string().optional().describe('e.g. "2,1" \u2014 every 2nd packet'),
+      random: z24.string().optional().describe("Match a random N% of packets (1-99)"),
+      time: z24.string().optional().describe('e.g. "8h-16h,mon,tue,wed,thu,fri"'),
+      hotspot: z24.string().optional().describe('e.g. "auth", "!auth", "from-client"'),
+      p2p: z24.string().optional(),
       new_connection_mark: z24.string().optional(),
       new_packet_mark: z24.string().optional(),
       new_routing_mark: z24.string().optional(),
@@ -6678,7 +6818,7 @@ var firewallMangleTools = [
     },
     async handler(a, ctx) {
       ctx.info(`Creating mangle rule: chain=${a.chain}, action=${a.action}`);
-      const cmd = new Cmd("/ip firewall mangle add").set("chain", a.chain).set("action", a.action).opt("src-address", a.src_address).opt("dst-address", a.dst_address).opt("src-port", a.src_port).opt("dst-port", a.dst_port).opt("protocol", a.protocol).opt("in-interface", a.in_interface).opt("out-interface", a.out_interface).opt("connection-mark", a.connection_mark).opt("packet-mark", a.packet_mark).opt("routing-mark", a.routing_mark).opt("connection-state", a.connection_state).opt("new-connection-mark", a.new_connection_mark).opt("new-packet-mark", a.new_packet_mark).opt("new-routing-mark", a.new_routing_mark).opt("new-dscp", a.new_dscp).opt("new-ttl", a.new_ttl).opt("new-mss", a.new_mss).opt("routing-table", a.routing_table).opt("address-list", a.address_list).opt("address-list-timeout", a.address_list_timeout).bool("passthrough", a.passthrough).opt("comment", a.comment).flag("disabled", a.disabled).flag("log", a.log).opt("log-prefix", a.log ? a.log_prefix : undefined).opt("place-before", a.place_before).build();
+      const cmd = new Cmd("/ip firewall mangle add").set("chain", a.chain).set("action", a.action).opt("src-address", a.src_address).opt("dst-address", a.dst_address).opt("src-port", a.src_port).opt("dst-port", a.dst_port).opt("protocol", a.protocol).opt("in-interface", a.in_interface).opt("out-interface", a.out_interface).opt("in-interface-list", a.in_interface_list).opt("out-interface-list", a.out_interface_list).opt("src-address-list", a.src_address_list).opt("dst-address-list", a.dst_address_list).opt("src-address-type", a.src_address_type).opt("dst-address-type", a.dst_address_type).opt("connection-mark", a.connection_mark).opt("packet-mark", a.packet_mark).opt("routing-mark", a.routing_mark).opt("connection-state", a.connection_state).opt("connection-nat-state", a.connection_nat_state).opt("connection-type", a.connection_type).opt("connection-bytes", a.connection_bytes).opt("connection-limit", a.connection_limit).opt("connection-rate", a.connection_rate).opt("per-connection-classifier", a.per_connection_classifier).opt("tcp-flags", a.tcp_flags).opt("dscp", a.dscp).opt("priority", a.priority).opt("packet-size", a.packet_size).opt("layer7-protocol", a.layer7_protocol).opt("ipsec-policy", a.ipsec_policy).opt("nth", a.nth).opt("random", a.random).opt("time", a.time).opt("hotspot", a.hotspot).opt("p2p", a.p2p).opt("new-connection-mark", a.new_connection_mark).opt("new-packet-mark", a.new_packet_mark).opt("new-routing-mark", a.new_routing_mark).opt("new-dscp", a.new_dscp).opt("new-ttl", a.new_ttl).opt("new-mss", a.new_mss).opt("routing-table", a.routing_table).opt("address-list", a.address_list).opt("address-list-timeout", a.address_list_timeout).bool("passthrough", a.passthrough).opt("comment", a.comment).flag("disabled", a.disabled).flag("log", a.log).opt("log-prefix", a.log ? a.log_prefix : undefined).opt("place-before", a.place_before).build();
       const result = await executeMikrotikCommand(cmd, ctx);
       const trimmed = result.trim();
       if (looksLikeError(trimmed)) {
@@ -6772,10 +6912,33 @@ ${result}`;
       protocol: z24.string().optional(),
       in_interface: z24.string().optional(),
       out_interface: z24.string().optional(),
+      in_interface_list: z24.string().optional(),
+      out_interface_list: z24.string().optional(),
+      src_address_list: z24.string().optional().describe('Negate with "!name" (e.g. "!IR")'),
+      dst_address_list: z24.string().optional().describe('Negate with "!name" (e.g. "!IR")'),
+      src_address_type: z24.string().optional(),
+      dst_address_type: z24.string().optional(),
       connection_mark: z24.string().optional(),
       packet_mark: z24.string().optional(),
       routing_mark: z24.string().optional(),
       connection_state: z24.string().optional(),
+      connection_nat_state: z24.string().optional(),
+      connection_type: z24.string().optional(),
+      connection_bytes: z24.string().optional(),
+      connection_limit: z24.string().optional(),
+      connection_rate: z24.string().optional(),
+      per_connection_classifier: z24.string().optional(),
+      tcp_flags: z24.string().optional(),
+      dscp: z24.string().optional(),
+      priority: z24.string().optional(),
+      packet_size: z24.string().optional(),
+      layer7_protocol: z24.string().optional(),
+      ipsec_policy: z24.string().optional(),
+      nth: z24.string().optional(),
+      random: z24.string().optional(),
+      time: z24.string().optional(),
+      hotspot: z24.string().optional(),
+      p2p: z24.string().optional(),
       new_connection_mark: z24.string().optional(),
       new_packet_mark: z24.string().optional(),
       new_routing_mark: z24.string().optional(),
@@ -11272,7 +11435,7 @@ var networkToolTools = [
     async handler(a, ctx) {
       ctx.info(`Pinging ${a.address} (count=${a.count})`);
       const cmd = new Cmd(`/ping ${a.address}`).set("count", a.count).opt("interface", a.interface).opt("src-address", a.src_address).opt("size", a.size).build();
-      const result = await executeMikrotikCommand(cmd, ctx);
+      const result = flattenLiveOutput(await executeMikrotikCommand(cmd, ctx, { maxMs: a.count * 1500 + 6000 }));
       if (looksLikeError(result))
         return `Failed to ping ${a.address}: ${result}`;
       return isEmpty(result) ? `No response from ${a.address}.` : `PING ${a.address}:
@@ -11293,7 +11456,7 @@ ${result}`;
     async handler(a, ctx) {
       ctx.info(`Tracerouting ${a.address} (count=${a.count})`);
       const cmd = new Cmd(`/tool traceroute ${a.address}`).set("count", a.count).flag("use-dns", a.use_dns).build();
-      const result = await executeMikrotikCommand(cmd, ctx);
+      const result = flattenLiveOutput(await executeMikrotikCommand(cmd, ctx, { maxMs: 30000 + a.count * 3000 }));
       if (looksLikeError(result))
         return `Failed to traceroute ${a.address}: ${result}`;
       return isEmpty(result) ? `No route information for ${a.address}.` : `TRACEROUTE ${a.address}:
@@ -11317,7 +11480,7 @@ ${result}`;
     async handler(a, ctx) {
       ctx.info(`Bandwidth test to ${a.address} (duration=${a.duration}s, direction=${a.direction})`);
       const cmd = new Cmd(`/tool bandwidth-test ${a.address}`).set("duration", `${a.duration}s`).set("direction", a.direction).set("protocol", a.protocol).opt("user", a.user).opt("password", a.password).build();
-      const result = await executeMikrotikCommand(cmd, ctx);
+      const result = flattenLiveOutput(await executeMikrotikCommand(cmd, ctx, { maxMs: a.duration * 1000 + 12000 }));
       if (looksLikeError(result))
         return `Failed to run bandwidth test to ${a.address}: ${result}`;
       return isEmpty(result) ? `No bandwidth test results for ${a.address}.` : `BANDWIDTH TEST:
@@ -11969,7 +12132,7 @@ var floodPingTools = [
     async handler(a, ctx) {
       ctx.info(`Flood-pinging ${a.address} (count=${a.count})`);
       const cmd = new Cmd(`/tool flood-ping ${a.address}`).set("count", a.count).opt("size", a.size).opt("interface", a.interface).opt("src-address", a.src_address).build();
-      const result = await executeMikrotikCommand(cmd, ctx);
+      const result = flattenLiveOutput(await executeMikrotikCommand(cmd, ctx, { maxMs: 30000 }));
       if (looksLikeError(result))
         return `Failed to flood-ping ${a.address}: ${result}`;
       return isEmpty(result) ? `No response from ${a.address}.` : `FLOOD PING ${a.address}:
@@ -12633,7 +12796,7 @@ var speedTestTools = [
     async handler(a, ctx) {
       ctx.info(`Speed test to ${a.address} (duration=${a.duration}s, direction=${a.direction})`);
       const cmd = new Cmd(`/tool speed-test address=${a.address}`).set("duration", `${a.duration}s`).set("direction", a.direction).opt("tcp-connection-count", a.tcp_connection_count).opt("user", a.user).opt("password", a.password).build();
-      const result = await executeMikrotikCommand(cmd, ctx);
+      const result = flattenLiveOutput(await executeMikrotikCommand(cmd, ctx, { maxMs: a.duration * 1000 + 15000 }));
       if (looksLikeError(result))
         return `Failed to run speed test to ${a.address}: ${result}`;
       return isEmpty(result) ? `No speed-test results for ${a.address}.` : `SPEED TEST:
@@ -23788,7 +23951,7 @@ function registerPrompts(server) {
 // package.json
 var package_default = {
   name: "@usex/mikrotik-mcp",
-  version: "3.19.0",
+  version: "3.21.0",
   description: "MCP server for MikroTik RouterOS \u2014 660+ tools over SSH for firewall, NAT, routing, DHCP, DNS, WireGuard, wireless, QoS and more.",
   keywords: [
     "ai",

package/dist/index.d.ts

@@ -26,8 +26,12 @@ type SendLog = (level: "info" | "error", message: string) => void;
 *
 * @param command  Fully-formed RouterOS CLI command (e.g. `/ip address print`).
 * @param ctx      Per-call context carrying the target device.
+* @param opts     `maxMs` caps the one-shot read for interactive/streaming
+*                 commands (ping, bandwidth-test) so they can't hang the tool.
 */
-declare function executeMikrotikCommand(command: string, ctx: ToolContext): Promise<string>;
+declare function executeMikrotikCommand(command: string, ctx: ToolContext, opts?: {
+	maxMs?: number;
+}): Promise<string>;
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { ToolAnnotations } from "@modelcontextprotocol/sdk/types.js";
 import { ZodRawShape } from "zod";
@@ -147,7 +151,9 @@ declare class MikroTikSSHClient {
 	/** Establish the SSH connection. Resolves `true` on success, `false` on failure. */
 	connect(): Promise<boolean>;
 	/** Run a single command on a fresh SSH channel and return its decoded output. */
-	run(command: string): Promise<string>;
+	run(command: string, opts?: {
+		maxMs?: number;
+	}): Promise<string>;
 	/** Open a persistent interactive shell channel (used by Safe Mode). */
 	shell(opts?: {
 		term?: string;
@@ -185,6 +191,14 @@ declare class SafeModeManager {
 	* (safe-mode marker present/absent), not merely the first prompt-shaped line.
 	*/
 	private readUntilPrompt;
+	/**
+	* Read until the output SETTLES: once any prompt is visible, wait for a quiet
+	* gap (`quietMs` with no new bytes) before resolving, or give up at `maxMs`.
+	* Used by commit, where Ctrl+X + Enter can emit a transient `<SAFE>` redraw
+	* followed by the real post-commit prompt — settling on the LAST prompt after
+	* a quiet period is what makes mode detection reliable.
+	*/
+	private readSettledPrompt;
 	private extractOutput;
 	private cleanup;
 }