@usex/mikrotik-mcp 3.20.0 → 3.22.0

package/dist/cli.js

@@ -617,7 +617,7 @@ class MikroTikMacTelnetClient {
       return false;
     }
   }
-  async run(command) {
+  async run(command, _opts = {}) {
     if (!this.console || !this.console.isReady) {
       throw new Error("Not connected to MikroTik device (MAC-Telnet)");
     }
@@ -694,7 +694,7 @@ class MikroTikSSHClient {
       }).connect(cfg);
     });
   }
-  run(command) {
+  run(command, opts = {}) {
     if (!this.client) {
       return Promise.reject(new Error("Not connected to MikroTik device"));
     }
@@ -707,11 +707,30 @@ class MikroTikSSHClient {
         }
         const stdout = [];
         const stderrBuf = [];
-        stream.on("close", () => {
+        let settled = false;
+        let timer;
+        const finish = () => {
+          if (settled)
+            return;
+          settled = true;
+          if (timer)
+            clearTimeout(timer);
           const out = decodeOutput(Buffer.concat(stdout));
           const error = decodeOutput(Buffer.concat(stderrBuf));
           resolve2(error && !out ? error : out);
-        }).on("data", (d) => stdout.push(d)).stderr.on("data", (d) => stderrBuf.push(d));
+        };
+        if (opts.maxMs && opts.maxMs > 0) {
+          timer = setTimeout(() => {
+            try {
+              stream.signal("INT");
+            } catch {}
+            try {
+              stream.close();
+            } catch {}
+            finish();
+          }, opts.maxMs);
+        }
+        stream.on("close", finish).on("data", (d) => stdout.push(d)).stderr.on("data", (d) => stderrBuf.push(d));
       });
     });
   }
@@ -875,31 +894,39 @@ class SafeModeManager {
   }
   commit() {
     return this.lock(async () => {
-      if (!this.active || !this.channel)
-        return "Safe mode is not active. Nothing to commit.";
-      this.channel.write(`
-`);
-      const probe = await this.readSettledPrompt();
-      const before = classifyPrompt(probe);
+      if (!this.active || !this.channel) {
+        return { ok: true, message: "Safe mode is not active. Nothing to commit." };
+      }
+      const before = await this.probeMode();
       if (before === "released") {
         this.cleanup();
-        return "Safe mode already exited \u2014 your changes are committed. Safe mode DISABLED.";
+        return {
+          ok: true,
+          message: "Safe mode already exited \u2014 your changes are committed. Safe mode DISABLED."
+        };
       }
       if (before === "unknown") {
-        return "Could not read a prompt to determine Safe Mode state. The session is left open so " + "nothing is reverted \u2014 call get_safe_mode_status, retry commit_safe_mode, or " + `rollback_safe_mode. Last output: ${probe.slice(-160)}`;
+        return {
+          ok: false,
+          message: "Could not read a prompt to determine Safe Mode state. The session is left open so " + "nothing is reverted \u2014 call get_safe_mode_status, retry commit_safe_mode, or rollback_safe_mode."
+        };
       }
       this.channel.write(CTRL_X);
-      this.channel.write(`
-`);
-      const after = await this.readSettledPrompt();
-      switch (classifyPrompt(after)) {
+      const after = await this.probeMode();
+      switch (after) {
         case "released":
           this.cleanup();
-          return "Changes committed successfully. Safe mode DISABLED.";
+          return { ok: true, message: "Changes committed successfully. Safe mode DISABLED." };
         case "safe":
-          return "Commit not completed \u2014 the device is still in Safe Mode. Your changes remain held " + "in memory (not reverted); call commit_safe_mode again to retry, or rollback_safe_mode " + "to discard them.";
+          return {
+            ok: false,
+            message: "Commit NOT completed \u2014 the device is still in Safe Mode (the Ctrl+X commit did not " + "take). Your changes remain held in memory and are NOT yet saved; call commit_safe_mode " + "again to retry, or rollback_safe_mode to discard them. If retries keep failing, this " + "RouterOS build may not accept an interactive Safe Mode commit over SSH \u2014 apply the " + "change without Safe Mode instead."
+          };
         default:
-          return "Commit status unclear \u2014 no prompt seen after exiting Safe Mode. The session is left " + "open so nothing is reverted; verify with get_safe_mode_status or retry commit_safe_mode. " + `Last output: ${after.slice(-160)}`;
+          return {
+            ok: false,
+            message: "Commit status unclear \u2014 no prompt seen after the commit. The session is left open so " + "nothing is reverted; verify with get_safe_mode_status or retry commit_safe_mode."
+          };
       }
     });
   }
@@ -936,32 +963,17 @@ class SafeModeManager {
       channel.on("data", onData);
     });
   }
-  readSettledPrompt(quietMs = 450, maxMs = 8000) {
-    const channel = this.channel;
-    if (!channel)
-      return Promise.resolve("");
-    return new Promise((resolve2) => {
-      let buf = "";
-      let quiet;
-      let hard;
-      function done() {
-        clearTimeout(hard);
-        if (quiet)
-          clearTimeout(quiet);
-        channel.removeListener("data", onData);
-        resolve2(stripAnsi(buf));
-      }
-      function onData(chunk) {
-        buf += decodeOutput(chunk);
-        if (PROMPT_RE.test(lastNonEmptyLine(stripAnsi(buf)))) {
-          if (quiet)
-            clearTimeout(quiet);
-          quiet = setTimeout(done, quietMs);
-        }
-      }
-      hard = setTimeout(done, maxMs);
-      channel.on("data", onData);
+  async probeMode() {
+    if (!this.channel)
+      return "unknown";
+    const token = "__MCP_SAFEMODE_PROBE__";
+    this.channel.write(`:put "${token}"
+`);
+    const out = await this.readUntilPrompt(8000, (cleaned) => {
+      const i = cleaned.lastIndexOf(token);
+      return i >= 0 && PROMPT_RE.test(cleaned.slice(i));
     });
+    return classifyPrompt(out);
   }
   extractOutput(raw, command) {
     const text = raw.replace(/\r\n/g, `
@@ -1010,7 +1022,7 @@ function getSafeModeManager(deviceName) {
 }
 
 // src/core/connector.ts
-async function runOnce(command, deviceName) {
+async function runOnce(command, deviceName, opts) {
   const name = resolveDeviceName(deviceName);
   const dc = getDevice(deviceName);
   const client = createDeviceClient(dc);
@@ -1018,12 +1030,12 @@ async function runOnce(command, deviceName) {
     if (!await client.connect()) {
       throw new Error(connectErrorMessage(name, dc, client.lastError));
     }
-    return await client.run(command);
+    return await client.run(command, opts);
   } finally {
     client.disconnect();
   }
 }
-async function executeMikrotikCommand(command, ctx) {
+async function executeMikrotikCommand(command, ctx, opts) {
   const deviceName = resolveDeviceName(ctx.device);
   const safe = getSafeModeManager(deviceName);
   if (safe.isActive) {
@@ -1031,7 +1043,7 @@ async function executeMikrotikCommand(command, ctx) {
     return safe.execute(command);
   }
   ctx.info(`[${deviceName}] Executing MikroTik command: ${command}`);
-  return runOnce(command, ctx.device);
+  return runOnce(command, ctx.device, opts);
 }
 
 // src/core/registry.ts
@@ -1124,6 +1136,16 @@ function isEmpty(result) {
   const t = result.trim();
   return t === "" || t === "no such item" || t === "no such item (4)";
 }
+function flattenLiveOutput(text) {
+  return text.split(`
+`).map((line) => {
+    const segs = line.split("\r").filter((s) => s.trim() !== "");
+    return segs.length ? segs[segs.length - 1] : "";
+  }).join(`
+`).replace(/\n{3,}/g, `
+
+`).trim();
+}
 function extractCreatedId(output) {
   const star = output.match(/\*[0-9A-Fa-f]+/);
   if (star)
@@ -2603,11 +2625,19 @@ async function restoreLocalBackup(device, name, confirm) {
       return fail("device stopped responding after applying \u2014 rolled back to avoid a lock-out", applied);
     }
     const committed = await safe.commit();
+    if (!committed.ok) {
+      return {
+        ok: false,
+        applied,
+        committed: false,
+        message: `applied ${applied} command(s) but COMMIT FAILED \u2014 not saved: ${committed.message}`
+      };
+    }
     return {
       ok: true,
       applied,
       committed: true,
-      message: `committed ${applied} command(s). ${committed}`
+      message: `committed ${applied} command(s). ${committed.message}`
     };
   } catch (e) {
     await safe.rollback();
@@ -3841,9 +3871,14 @@ DRY-RUN: all changes rolled back. Re-run with confirm=true to commit.`;
 ABORTED: the device stopped responding after applying \u2014 changes rolled back to avoid a lock-out.`;
         }
         const committed = await safe.commit();
+        if (!committed.ok) {
+          return `${header}
+
+COMMIT FAILED \u2014 changes are NOT saved (still pending in Safe Mode). ` + `${committed.message}`;
+        }
         return `${header}
 
-COMMITTED: changes are now permanent. ${committed}`;
+COMMITTED: changes are now permanent. ${committed.message}`;
       } catch (e) {
         await safe.rollback();
         const msg = e instanceof Error ? e.message : String(e);
@@ -5906,8 +5941,12 @@ ${useSafe ? "Safe Mode rolled back \u2014 no changes kept." : "Partial rules rem
         }
         done.push(cmd);
       }
-      if (useSafe)
-        await mgr.commit();
+      if (useSafe) {
+        const c = await mgr.commit();
+        if (!c.ok) {
+          return `Applied ${done.length} rule(s) but Safe Mode COMMIT FAILED \u2014 changes are NOT saved ` + `and will revert: ${c.message}`;
+        }
+      }
       return `Security Shield applied \u2014 ${done.length} rule(s) across ${groups.length} protection(s)${useSafe ? " (committed via Safe Mode)" : ""}. Audit with audit_firewall_hardening; undo with remove_firewall_hardening.`;
     }
   }),
@@ -11406,7 +11445,7 @@ var networkToolTools = [
     async handler(a, ctx) {
       ctx.info(`Pinging ${a.address} (count=${a.count})`);
       const cmd = new Cmd(`/ping ${a.address}`).set("count", a.count).opt("interface", a.interface).opt("src-address", a.src_address).opt("size", a.size).build();
-      const result = await executeMikrotikCommand(cmd, ctx);
+      const result = flattenLiveOutput(await executeMikrotikCommand(cmd, ctx, { maxMs: a.count * 1500 + 6000 }));
       if (looksLikeError(result))
         return `Failed to ping ${a.address}: ${result}`;
       return isEmpty(result) ? `No response from ${a.address}.` : `PING ${a.address}:
@@ -11427,7 +11466,7 @@ ${result}`;
     async handler(a, ctx) {
       ctx.info(`Tracerouting ${a.address} (count=${a.count})`);
       const cmd = new Cmd(`/tool traceroute ${a.address}`).set("count", a.count).flag("use-dns", a.use_dns).build();
-      const result = await executeMikrotikCommand(cmd, ctx);
+      const result = flattenLiveOutput(await executeMikrotikCommand(cmd, ctx, { maxMs: 30000 + a.count * 3000 }));
       if (looksLikeError(result))
         return `Failed to traceroute ${a.address}: ${result}`;
       return isEmpty(result) ? `No route information for ${a.address}.` : `TRACEROUTE ${a.address}:
@@ -11451,7 +11490,7 @@ ${result}`;
     async handler(a, ctx) {
       ctx.info(`Bandwidth test to ${a.address} (duration=${a.duration}s, direction=${a.direction})`);
       const cmd = new Cmd(`/tool bandwidth-test ${a.address}`).set("duration", `${a.duration}s`).set("direction", a.direction).set("protocol", a.protocol).opt("user", a.user).opt("password", a.password).build();
-      const result = await executeMikrotikCommand(cmd, ctx);
+      const result = flattenLiveOutput(await executeMikrotikCommand(cmd, ctx, { maxMs: a.duration * 1000 + 12000 }));
       if (looksLikeError(result))
         return `Failed to run bandwidth test to ${a.address}: ${result}`;
       return isEmpty(result) ? `No bandwidth test results for ${a.address}.` : `BANDWIDTH TEST:
@@ -12103,7 +12142,7 @@ var floodPingTools = [
     async handler(a, ctx) {
       ctx.info(`Flood-pinging ${a.address} (count=${a.count})`);
       const cmd = new Cmd(`/tool flood-ping ${a.address}`).set("count", a.count).opt("size", a.size).opt("interface", a.interface).opt("src-address", a.src_address).build();
-      const result = await executeMikrotikCommand(cmd, ctx);
+      const result = flattenLiveOutput(await executeMikrotikCommand(cmd, ctx, { maxMs: 30000 }));
       if (looksLikeError(result))
         return `Failed to flood-ping ${a.address}: ${result}`;
       return isEmpty(result) ? `No response from ${a.address}.` : `FLOOD PING ${a.address}:
@@ -12767,7 +12806,7 @@ var speedTestTools = [
     async handler(a, ctx) {
       ctx.info(`Speed test to ${a.address} (duration=${a.duration}s, direction=${a.direction})`);
       const cmd = new Cmd(`/tool speed-test address=${a.address}`).set("duration", `${a.duration}s`).set("direction", a.direction).opt("tcp-connection-count", a.tcp_connection_count).opt("user", a.user).opt("password", a.password).build();
-      const result = await executeMikrotikCommand(cmd, ctx);
+      const result = flattenLiveOutput(await executeMikrotikCommand(cmd, ctx, { maxMs: a.duration * 1000 + 15000 }));
       if (looksLikeError(result))
         return `Failed to run speed test to ${a.address}: ${result}`;
       return isEmpty(result) ? `No speed-test results for ${a.address}.` : `SPEED TEST:
@@ -17554,7 +17593,7 @@ var safeModeTools = [
     async handler(_a, ctx) {
       const device = resolveDeviceName(ctx.device);
       ctx.info(`[${device}] Committing safe mode changes`);
-      return getSafeModeManager(device).commit();
+      return (await getSafeModeManager(device).commit()).message;
     }
   }),
   defineTool({
@@ -23922,7 +23961,7 @@ function registerPrompts(server) {
 // package.json
 var package_default = {
   name: "@usex/mikrotik-mcp",
-  version: "3.20.0",
+  version: "3.22.0",
   description: "MCP server for MikroTik RouterOS \u2014 660+ tools over SSH for firewall, NAT, routing, DHCP, DNS, WireGuard, wireless, QoS and more.",
   keywords: [
     "ai",

package/dist/index.d.ts

@@ -26,8 +26,12 @@ type SendLog = (level: "info" | "error", message: string) => void;
 *
 * @param command  Fully-formed RouterOS CLI command (e.g. `/ip address print`).
 * @param ctx      Per-call context carrying the target device.
+* @param opts     `maxMs` caps the one-shot read for interactive/streaming
+*                 commands (ping, bandwidth-test) so they can't hang the tool.
 */
-declare function executeMikrotikCommand(command: string, ctx: ToolContext): Promise<string>;
+declare function executeMikrotikCommand(command: string, ctx: ToolContext, opts?: {
+	maxMs?: number;
+}): Promise<string>;
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { ToolAnnotations } from "@modelcontextprotocol/sdk/types.js";
 import { ZodRawShape } from "zod";
@@ -147,7 +151,9 @@ declare class MikroTikSSHClient {
 	/** Establish the SSH connection. Resolves `true` on success, `false` on failure. */
 	connect(): Promise<boolean>;
 	/** Run a single command on a fresh SSH channel and return its decoded output. */
-	run(command: string): Promise<string>;
+	run(command: string, opts?: {
+		maxMs?: number;
+	}): Promise<string>;
 	/** Open a persistent interactive shell channel (used by Safe Mode). */
 	shell(opts?: {
 		term?: string;
@@ -157,6 +163,16 @@ declare class MikroTikSSHClient {
 	/** Close the SSH connection. Safe to call multiple times. */
 	disconnect(): void;
 }
+/**
+* Outcome of {@link SafeModeManager.commit}. `ok` is true ONLY when Safe Mode is
+* confirmed exited (changes persisted) — callers must check it before telling
+* the user anything was committed, so a failed commit can never masquerade as a
+* success that then silently reverts.
+*/
+interface CommitResult {
+	ok: boolean;
+	message: string;
+}
 declare class SafeModeManager {
 	private readonly deviceName;
 	private ssh;
@@ -173,8 +189,12 @@ declare class SafeModeManager {
 	enable(): Promise<string>;
 	/** Execute a command through the safe-mode persistent shell session. */
 	execute(command: string): Promise<string>;
-	/** Send Ctrl+X again to exit Safe Mode and persist all changes. */
-	commit(): Promise<string>;
+	/**
+	* Send Ctrl+X again to exit Safe Mode and persist all changes. Returns a
+	* structured result so callers NEVER report "committed" on a failed commit —
+	* `ok` is true only when Safe Mode is confirmed exited (changes saved).
+	*/
+	commit(): Promise<CommitResult>;
 	/** Close the session to trigger MikroTik's automatic safe-mode revert. */
 	rollback(): Promise<string>;
 	status(): string;
@@ -186,13 +206,14 @@ declare class SafeModeManager {
 	*/
 	private readUntilPrompt;
 	/**
-	* Read until the output SETTLES: once any prompt is visible, wait for a quiet
-	* gap (`quietMs` with no new bytes) before resolving, or give up at `maxMs`.
-	* Used by commit, where Ctrl+X + Enter can emit a transient `<SAFE>` redraw
-	* followed by the real post-commit prompt — settling on the LAST prompt after
-	* a quiet period is what makes mode detection reliable.
+	* Determine the shell's CURRENT mode definitively by round-tripping a sentinel
+	* command (`:put "<token>"`) and classifying the prompt that follows ITS
+	* output. A real command — not a bare Enter — forces RouterOS to fully process
+	* any pending Ctrl+X and render a prompt that reflects the true mode, so we
+	* never settle on a transient `<SAFE>`→normal redraw and report a commit that
+	* did not actually take. Returns `safe`, `released`, or `unknown` (no prompt).
 	*/
-	private readSettledPrompt;
+	private probeMode;
 	private extractOutput;
 	private cleanup;
 }

package/dist/index.js

@@ -609,7 +609,7 @@ class MikroTikMacTelnetClient {
       return false;
     }
   }
-  async run(command) {
+  async run(command, _opts = {}) {
     if (!this.console || !this.console.isReady) {
       throw new Error("Not connected to MikroTik device (MAC-Telnet)");
     }
@@ -686,7 +686,7 @@ class MikroTikSSHClient {
       }).connect(cfg);
     });
   }
-  run(command) {
+  run(command, opts = {}) {
     if (!this.client) {
       return Promise.reject(new Error("Not connected to MikroTik device"));
     }
@@ -699,11 +699,30 @@ class MikroTikSSHClient {
         }
         const stdout = [];
         const stderrBuf = [];
-        stream.on("close", () => {
+        let settled = false;
+        let timer;
+        const finish = () => {
+          if (settled)
+            return;
+          settled = true;
+          if (timer)
+            clearTimeout(timer);
           const out = decodeOutput(Buffer.concat(stdout));
           const error = decodeOutput(Buffer.concat(stderrBuf));
           resolve2(error && !out ? error : out);
-        }).on("data", (d) => stdout.push(d)).stderr.on("data", (d) => stderrBuf.push(d));
+        };
+        if (opts.maxMs && opts.maxMs > 0) {
+          timer = setTimeout(() => {
+            try {
+              stream.signal("INT");
+            } catch {}
+            try {
+              stream.close();
+            } catch {}
+            finish();
+          }, opts.maxMs);
+        }
+        stream.on("close", finish).on("data", (d) => stdout.push(d)).stderr.on("data", (d) => stderrBuf.push(d));
       });
     });
   }
@@ -861,31 +880,39 @@ class SafeModeManager {
   }
   commit() {
     return this.lock(async () => {
-      if (!this.active || !this.channel)
-        return "Safe mode is not active. Nothing to commit.";
-      this.channel.write(`
-`);
-      const probe = await this.readSettledPrompt();
-      const before = classifyPrompt(probe);
+      if (!this.active || !this.channel) {
+        return { ok: true, message: "Safe mode is not active. Nothing to commit." };
+      }
+      const before = await this.probeMode();
       if (before === "released") {
         this.cleanup();
-        return "Safe mode already exited \u2014 your changes are committed. Safe mode DISABLED.";
+        return {
+          ok: true,
+          message: "Safe mode already exited \u2014 your changes are committed. Safe mode DISABLED."
+        };
       }
       if (before === "unknown") {
-        return "Could not read a prompt to determine Safe Mode state. The session is left open so " + "nothing is reverted \u2014 call get_safe_mode_status, retry commit_safe_mode, or " + `rollback_safe_mode. Last output: ${probe.slice(-160)}`;
+        return {
+          ok: false,
+          message: "Could not read a prompt to determine Safe Mode state. The session is left open so " + "nothing is reverted \u2014 call get_safe_mode_status, retry commit_safe_mode, or rollback_safe_mode."
+        };
       }
       this.channel.write(CTRL_X);
-      this.channel.write(`
-`);
-      const after = await this.readSettledPrompt();
-      switch (classifyPrompt(after)) {
+      const after = await this.probeMode();
+      switch (after) {
         case "released":
           this.cleanup();
-          return "Changes committed successfully. Safe mode DISABLED.";
+          return { ok: true, message: "Changes committed successfully. Safe mode DISABLED." };
         case "safe":
-          return "Commit not completed \u2014 the device is still in Safe Mode. Your changes remain held " + "in memory (not reverted); call commit_safe_mode again to retry, or rollback_safe_mode " + "to discard them.";
+          return {
+            ok: false,
+            message: "Commit NOT completed \u2014 the device is still in Safe Mode (the Ctrl+X commit did not " + "take). Your changes remain held in memory and are NOT yet saved; call commit_safe_mode " + "again to retry, or rollback_safe_mode to discard them. If retries keep failing, this " + "RouterOS build may not accept an interactive Safe Mode commit over SSH \u2014 apply the " + "change without Safe Mode instead."
+          };
         default:
-          return "Commit status unclear \u2014 no prompt seen after exiting Safe Mode. The session is left " + "open so nothing is reverted; verify with get_safe_mode_status or retry commit_safe_mode. " + `Last output: ${after.slice(-160)}`;
+          return {
+            ok: false,
+            message: "Commit status unclear \u2014 no prompt seen after the commit. The session is left open so " + "nothing is reverted; verify with get_safe_mode_status or retry commit_safe_mode."
+          };
       }
     });
   }
@@ -922,32 +949,17 @@ class SafeModeManager {
       channel.on("data", onData);
     });
   }
-  readSettledPrompt(quietMs = 450, maxMs = 8000) {
-    const channel = this.channel;
-    if (!channel)
-      return Promise.resolve("");
-    return new Promise((resolve2) => {
-      let buf = "";
-      let quiet;
-      let hard;
-      function done() {
-        clearTimeout(hard);
-        if (quiet)
-          clearTimeout(quiet);
-        channel.removeListener("data", onData);
-        resolve2(stripAnsi(buf));
-      }
-      function onData(chunk) {
-        buf += decodeOutput(chunk);
-        if (PROMPT_RE.test(lastNonEmptyLine(stripAnsi(buf)))) {
-          if (quiet)
-            clearTimeout(quiet);
-          quiet = setTimeout(done, quietMs);
-        }
-      }
-      hard = setTimeout(done, maxMs);
-      channel.on("data", onData);
+  async probeMode() {
+    if (!this.channel)
+      return "unknown";
+    const token = "__MCP_SAFEMODE_PROBE__";
+    this.channel.write(`:put "${token}"
+`);
+    const out = await this.readUntilPrompt(8000, (cleaned) => {
+      const i = cleaned.lastIndexOf(token);
+      return i >= 0 && PROMPT_RE.test(cleaned.slice(i));
     });
+    return classifyPrompt(out);
   }
   extractOutput(raw, command) {
     const text = raw.replace(/\r\n/g, `
@@ -996,7 +1008,7 @@ function getSafeModeManager(deviceName) {
 }
 
 // src/core/connector.ts
-async function runOnce(command, deviceName) {
+async function runOnce(command, deviceName, opts) {
   const name = resolveDeviceName(deviceName);
   const dc = getDevice(deviceName);
   const client = createDeviceClient(dc);
@@ -1004,12 +1016,12 @@ async function runOnce(command, deviceName) {
     if (!await client.connect()) {
       throw new Error(connectErrorMessage(name, dc, client.lastError));
     }
-    return await client.run(command);
+    return await client.run(command, opts);
   } finally {
     client.disconnect();
   }
 }
-async function executeMikrotikCommand(command, ctx) {
+async function executeMikrotikCommand(command, ctx, opts) {
   const deviceName = resolveDeviceName(ctx.device);
   const safe = getSafeModeManager(deviceName);
   if (safe.isActive) {
@@ -1017,7 +1029,7 @@ async function executeMikrotikCommand(command, ctx) {
     return safe.execute(command);
   }
   ctx.info(`[${deviceName}] Executing MikroTik command: ${command}`);
-  return runOnce(command, ctx.device);
+  return runOnce(command, ctx.device, opts);
 }
 // src/core/registry.ts
 import { z as z2 } from "zod";
@@ -1109,6 +1121,16 @@ function isEmpty(result) {
   const t = result.trim();
   return t === "" || t === "no such item" || t === "no such item (4)";
 }
+function flattenLiveOutput(text) {
+  return text.split(`
+`).map((line) => {
+    const segs = line.split("\r").filter((s) => s.trim() !== "");
+    return segs.length ? segs[segs.length - 1] : "";
+  }).join(`
+`).replace(/\n{3,}/g, `
+
+`).trim();
+}
 function extractCreatedId(output) {
   const star = output.match(/\*[0-9A-Fa-f]+/);
   if (star)
@@ -2615,11 +2637,19 @@ async function restoreLocalBackup(device, name, confirm) {
       return fail("device stopped responding after applying \u2014 rolled back to avoid a lock-out", applied);
     }
     const committed = await safe.commit();
+    if (!committed.ok) {
+      return {
+        ok: false,
+        applied,
+        committed: false,
+        message: `applied ${applied} command(s) but COMMIT FAILED \u2014 not saved: ${committed.message}`
+      };
+    }
     return {
       ok: true,
       applied,
       committed: true,
-      message: `committed ${applied} command(s). ${committed}`
+      message: `committed ${applied} command(s). ${committed.message}`
     };
   } catch (e) {
     await safe.rollback();
@@ -3853,9 +3883,14 @@ DRY-RUN: all changes rolled back. Re-run with confirm=true to commit.`;
 ABORTED: the device stopped responding after applying \u2014 changes rolled back to avoid a lock-out.`;
         }
         const committed = await safe.commit();
+        if (!committed.ok) {
+          return `${header}
+
+COMMIT FAILED \u2014 changes are NOT saved (still pending in Safe Mode). ` + `${committed.message}`;
+        }
         return `${header}
 
-COMMITTED: changes are now permanent. ${committed}`;
+COMMITTED: changes are now permanent. ${committed.message}`;
       } catch (e) {
         await safe.rollback();
         const msg = e instanceof Error ? e.message : String(e);
@@ -5918,8 +5953,12 @@ ${useSafe ? "Safe Mode rolled back \u2014 no changes kept." : "Partial rules rem
         }
         done.push(cmd);
       }
-      if (useSafe)
-        await mgr.commit();
+      if (useSafe) {
+        const c = await mgr.commit();
+        if (!c.ok) {
+          return `Applied ${done.length} rule(s) but Safe Mode COMMIT FAILED \u2014 changes are NOT saved ` + `and will revert: ${c.message}`;
+        }
+      }
       return `Security Shield applied \u2014 ${done.length} rule(s) across ${groups.length} protection(s)${useSafe ? " (committed via Safe Mode)" : ""}. Audit with audit_firewall_hardening; undo with remove_firewall_hardening.`;
     }
   }),
@@ -11418,7 +11457,7 @@ var networkToolTools = [
     async handler(a, ctx) {
       ctx.info(`Pinging ${a.address} (count=${a.count})`);
       const cmd = new Cmd(`/ping ${a.address}`).set("count", a.count).opt("interface", a.interface).opt("src-address", a.src_address).opt("size", a.size).build();
-      const result = await executeMikrotikCommand(cmd, ctx);
+      const result = flattenLiveOutput(await executeMikrotikCommand(cmd, ctx, { maxMs: a.count * 1500 + 6000 }));
       if (looksLikeError(result))
         return `Failed to ping ${a.address}: ${result}`;
       return isEmpty(result) ? `No response from ${a.address}.` : `PING ${a.address}:
@@ -11439,7 +11478,7 @@ ${result}`;
     async handler(a, ctx) {
       ctx.info(`Tracerouting ${a.address} (count=${a.count})`);
       const cmd = new Cmd(`/tool traceroute ${a.address}`).set("count", a.count).flag("use-dns", a.use_dns).build();
-      const result = await executeMikrotikCommand(cmd, ctx);
+      const result = flattenLiveOutput(await executeMikrotikCommand(cmd, ctx, { maxMs: 30000 + a.count * 3000 }));
       if (looksLikeError(result))
         return `Failed to traceroute ${a.address}: ${result}`;
       return isEmpty(result) ? `No route information for ${a.address}.` : `TRACEROUTE ${a.address}:
@@ -11463,7 +11502,7 @@ ${result}`;
     async handler(a, ctx) {
       ctx.info(`Bandwidth test to ${a.address} (duration=${a.duration}s, direction=${a.direction})`);
       const cmd = new Cmd(`/tool bandwidth-test ${a.address}`).set("duration", `${a.duration}s`).set("direction", a.direction).set("protocol", a.protocol).opt("user", a.user).opt("password", a.password).build();
-      const result = await executeMikrotikCommand(cmd, ctx);
+      const result = flattenLiveOutput(await executeMikrotikCommand(cmd, ctx, { maxMs: a.duration * 1000 + 12000 }));
       if (looksLikeError(result))
         return `Failed to run bandwidth test to ${a.address}: ${result}`;
       return isEmpty(result) ? `No bandwidth test results for ${a.address}.` : `BANDWIDTH TEST:
@@ -12115,7 +12154,7 @@ var floodPingTools = [
     async handler(a, ctx) {
       ctx.info(`Flood-pinging ${a.address} (count=${a.count})`);
       const cmd = new Cmd(`/tool flood-ping ${a.address}`).set("count", a.count).opt("size", a.size).opt("interface", a.interface).opt("src-address", a.src_address).build();
-      const result = await executeMikrotikCommand(cmd, ctx);
+      const result = flattenLiveOutput(await executeMikrotikCommand(cmd, ctx, { maxMs: 30000 }));
       if (looksLikeError(result))
         return `Failed to flood-ping ${a.address}: ${result}`;
       return isEmpty(result) ? `No response from ${a.address}.` : `FLOOD PING ${a.address}:
@@ -12779,7 +12818,7 @@ var speedTestTools = [
     async handler(a, ctx) {
       ctx.info(`Speed test to ${a.address} (duration=${a.duration}s, direction=${a.direction})`);
       const cmd = new Cmd(`/tool speed-test address=${a.address}`).set("duration", `${a.duration}s`).set("direction", a.direction).opt("tcp-connection-count", a.tcp_connection_count).opt("user", a.user).opt("password", a.password).build();
-      const result = await executeMikrotikCommand(cmd, ctx);
+      const result = flattenLiveOutput(await executeMikrotikCommand(cmd, ctx, { maxMs: a.duration * 1000 + 15000 }));
       if (looksLikeError(result))
         return `Failed to run speed test to ${a.address}: ${result}`;
       return isEmpty(result) ? `No speed-test results for ${a.address}.` : `SPEED TEST:
@@ -17566,7 +17605,7 @@ var safeModeTools = [
     async handler(_a, ctx) {
       const device = resolveDeviceName(ctx.device);
       ctx.info(`[${device}] Committing safe mode changes`);
-      return getSafeModeManager(device).commit();
+      return (await getSafeModeManager(device).commit()).message;
     }
   }),
   defineTool({
@@ -22322,7 +22361,7 @@ function selectToolModules(filter = {}, catalog = moduleCatalog) {
 // package.json
 var package_default = {
   name: "@usex/mikrotik-mcp",
-  version: "3.20.0",
+  version: "3.22.0",
   description: "MCP server for MikroTik RouterOS \u2014 660+ tools over SSH for firewall, NAT, routing, DHCP, DNS, WireGuard, wireless, QoS and more.",
   keywords: [
     "ai",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@usex/mikrotik-mcp",
-  "version": "3.20.0",
+  "version": "3.22.0",
   "description": "MCP server for MikroTik RouterOS — 660+ tools over SSH for firewall, NAT, routing, DHCP, DNS, WireGuard, wireless, QoS and more.",
   "keywords": [
     "ai",