@usex/mikrotik-mcp 3.32.2 → 3.34.0

package/dist/shared/{library-bj9xrcg0.js → library-aa58hkb4.js}

@@ -25,6 +25,16 @@ var McpServerSettingsSchema = z.object({
   toolPageSize: z.coerce.number().int().min(0).default(0),
   appViews: z.boolean().default(true)
 });
+var JumpHostSchema = z.object({
+  host: z.string(),
+  port: z.coerce.number().int().positive().default(22),
+  username: z.string().default("admin"),
+  password: z.string().optional(),
+  keyFilename: z.string().optional(),
+  privateKey: z.string().optional(),
+  keyPassphrase: z.string().optional(),
+  timeoutMs: z.coerce.number().int().positive().optional()
+});
 var DeviceConfigSchema = z.object({
   host: z.string().default("127.0.0.1"),
   username: z.string().default("admin"),
@@ -34,6 +44,8 @@ var DeviceConfigSchema = z.object({
   privateKey: z.string().optional(),
   keyPassphrase: z.string().optional(),
   timeoutMs: z.coerce.number().int().positive().default(1e4),
+  jumpVia: z.string().optional(),
+  jumpHost: JumpHostSchema.optional(),
   mac: z.string().optional(),
   sourceMac: z.string().optional(),
   macHost: z.string().optional(),
@@ -128,6 +140,15 @@ var configSource = { path: DEFAULT_CONFIG_FILE, fromFile: false };
 function loadConfig(argv = process.argv.slice(2)) {
   const flags = parseFlags(argv);
   const pick = (flag, ...envNames) => flags[flag] ?? env(...envNames);
+  const jumpHostName = pick("jump-host", "MIKROTIK_JUMP_HOST");
+  const jumpHost = jumpHostName ? {
+    host: jumpHostName,
+    port: pick("jump-port", "MIKROTIK_JUMP_PORT"),
+    username: pick("jump-username", "MIKROTIK_JUMP_USERNAME"),
+    password: pick("jump-password", "MIKROTIK_JUMP_PASSWORD"),
+    keyFilename: pick("jump-key-filename", "MIKROTIK_JUMP_KEY_FILENAME"),
+    keyPassphrase: pick("jump-key-passphrase", "MIKROTIK_JUMP_KEY_PASSPHRASE")
+  } : undefined;
   const single = {
     host: pick("host", "MIKROTIK_HOST"),
     username: pick("username", "MIKROTIK_USERNAME"),
@@ -137,6 +158,7 @@ function loadConfig(argv = process.argv.slice(2)) {
     privateKey: pick("private-key", "MIKROTIK_PRIVATE_KEY"),
     keyPassphrase: pick("key-passphrase", "MIKROTIK_KEY_PASSPHRASE"),
     timeoutMs: pick("timeout-ms", "MIKROTIK_TIMEOUT_MS"),
+    jumpHost,
     mac: pick("mac", "MIKROTIK_MAC"),
     sourceMac: pick("source-mac", "MIKROTIK_SOURCE_MAC"),
     macHost: pick("mac-host", "MIKROTIK_MAC_HOST"),
@@ -703,45 +725,72 @@ function decodeOutput(data) {
 
 class MikroTikSSHClient {
   client = null;
+  bastions = [];
   opts;
   lastError;
   constructor(opts) {
     this.opts = { port: 22, timeoutMs: 1e4, ...opts };
   }
-  connect() {
+  async connect() {
     this.lastError = undefined;
-    return new Promise((resolve2) => {
+    try {
+      const hops = [];
+      for (let j = this.opts.jump;j; j = j.jump)
+        hops.unshift(j);
+      const sequence = [...hops, this.opts];
+      let sock;
+      for (let i = 0;i < hops.length; i++) {
+        const client = await this.openClient(hops[i], sock);
+        this.bastions.push(client);
+        const next = sequence[i + 1];
+        sock = await this.forwardOut(client, next.host, next.port ?? 22);
+      }
+      this.client = await this.openClient(this.opts, sock);
+      return true;
+    } catch (e) {
+      this.lastError = e instanceof Error ? e.message : String(e);
+      logger.error(`Failed to connect to MikroTik: ${this.lastError}`);
+      this.disconnect();
+      return false;
+    }
+  }
+  openClient(o, sock) {
+    return new Promise((resolve2, reject) => {
       const client = new Client;
       const cfg = {
-        host: this.opts.host,
-        port: this.opts.port,
-        username: this.opts.username,
-        readyTimeout: this.opts.timeoutMs
+        host: o.host,
+        port: o.port ?? 22,
+        username: o.username,
+        readyTimeout: o.timeoutMs ?? 1e4
       };
-      if (this.opts.privateKey) {
-        cfg.privateKey = this.opts.privateKey;
-      } else if (this.opts.keyFilename) {
+      if (sock)
+        cfg.sock = sock;
+      if (o.privateKey) {
+        cfg.privateKey = o.privateKey;
+      } else if (o.keyFilename) {
         try {
-          cfg.privateKey = readFileSync2(this.opts.keyFilename);
+          cfg.privateKey = readFileSync2(o.keyFilename);
         } catch (e) {
-          this.lastError = `could not read key file ${this.opts.keyFilename}: ${e instanceof Error ? e.message : String(e)}`;
-          logger.error(`Failed to read SSH key file ${this.opts.keyFilename}: ${String(e)}`);
-          resolve2(false);
+          reject(new Error(`could not read key file ${o.keyFilename}: ${e instanceof Error ? e.message : String(e)}`));
           return;
         }
       }
-      if (cfg.privateKey && this.opts.keyPassphrase)
-        cfg.passphrase = this.opts.keyPassphrase;
-      if (this.opts.password)
-        cfg.password = this.opts.password;
-      client.on("ready", () => {
-        this.client = client;
-        resolve2(true);
-      }).on("error", (err) => {
-        this.lastError = err.message;
-        logger.error(`Failed to connect to MikroTik: ${err.message}`);
-        resolve2(false);
-      }).connect(cfg);
+      if (cfg.privateKey && o.keyPassphrase)
+        cfg.passphrase = o.keyPassphrase;
+      if (o.password)
+        cfg.password = o.password;
+      client.on("ready", () => resolve2(client)).on("error", (err) => reject(err)).connect(cfg);
+    });
+  }
+  forwardOut(via, host, port) {
+    return new Promise((resolve2, reject) => {
+      via.forwardOut("127.0.0.1", 0, host, port, (err, stream) => {
+        if (err) {
+          reject(new Error(`jump host could not open a tunnel to ${host}:${port}: ${err.message}. ` + "If the jump router runs RouterOS, enable SSH TCP forwarding on it: " + "/ip ssh set forwarding-enabled=local (or both)."));
+        } else {
+          resolve2(stream);
+        }
+      });
     });
   }
   run(command, opts = {}) {
@@ -860,6 +909,12 @@ class MikroTikSSHClient {
       } catch {}
       this.client = null;
     }
+    for (const b of this.bastions.reverse()) {
+      try {
+        b.end();
+      } catch {}
+    }
+    this.bastions = [];
   }
 }
 
@@ -867,6 +922,43 @@ class MikroTikSSHClient {
 function isMacTelnetDevice(dc) {
   return Boolean(dc.mac);
 }
+function sshOptionsOf(dc) {
+  return {
+    host: dc.host,
+    username: dc.username,
+    password: dc.password,
+    keyFilename: dc.keyFilename,
+    privateKey: dc.privateKey,
+    keyPassphrase: dc.keyPassphrase,
+    port: dc.port,
+    timeoutMs: dc.timeoutMs
+  };
+}
+function resolveJump(dc, seen = new Set) {
+  if (dc.jumpHost) {
+    return {
+      host: dc.jumpHost.host,
+      port: dc.jumpHost.port,
+      username: dc.jumpHost.username,
+      password: dc.jumpHost.password,
+      keyFilename: dc.jumpHost.keyFilename,
+      privateKey: dc.jumpHost.privateKey,
+      keyPassphrase: dc.jumpHost.keyPassphrase,
+      timeoutMs: dc.jumpHost.timeoutMs
+    };
+  }
+  if (!dc.jumpVia)
+    return;
+  if (seen.has(dc.jumpVia)) {
+    throw new Error(`SSH jump-host cycle detected at '${dc.jumpVia}' (a device can't jump through itself).`);
+  }
+  seen.add(dc.jumpVia);
+  const bastion = getDevice(dc.jumpVia);
+  if (isMacTelnetDevice(bastion)) {
+    throw new Error(`Jump host '${dc.jumpVia}' is a MAC-Telnet device; an SSH bastion must be reachable over SSH.`);
+  }
+  return { ...sshOptionsOf(bastion), jump: resolveJump(bastion, seen) };
+}
 function createDeviceClient(dc) {
   if (isMacTelnetDevice(dc)) {
     return new MikroTikMacTelnetClient({
@@ -879,16 +971,7 @@ function createDeviceClient(dc) {
       timeoutMs: dc.timeoutMs
     });
   }
-  return new MikroTikSSHClient({
-    host: dc.host,
-    username: dc.username,
-    password: dc.password,
-    keyFilename: dc.keyFilename,
-    privateKey: dc.privateKey,
-    keyPassphrase: dc.keyPassphrase,
-    port: dc.port,
-    timeoutMs: dc.timeoutMs
-  });
+  return new MikroTikSSHClient({ ...sshOptionsOf(dc), jump: resolveJump(dc) });
 }
 function connectErrorMessage(name, dc, lastError) {
   const reason = lastError ? ` \u2014 ${lastError}` : "";
@@ -4402,40 +4485,39 @@ var changePlanTools = [
         return "No commands provided to apply.";
       const device = resolveDeviceName(ctx.device);
       if (getDevice(ctx.device).mac) {
-        return "Safe Mode (and therefore apply_plan) requires SSH; it is not available on a MAC-Telnet device.";
+        throw new Error("Safe Mode (and therefore apply_plan) requires SSH; it is not available on a MAC-Telnet device.");
       }
       const plan = buildChangePlan(commands);
       const safe = getSafeModeManager(device);
       const enabled2 = await safe.enable();
       if (enabled2.startsWith("Error"))
-        return enabled2;
+        throw new Error(enabled2);
       const APPLY_BUDGET_MS = 90000;
       const startedAt = Date.now();
       const overBudget = () => Date.now() - startedAt > APPLY_BUDGET_MS;
-      try {
-        const before = normalizeExport(await safe.execute("/export terse"));
-        const log = [];
-        for (const step of plan.steps) {
-          if (overBudget()) {
-            await safe.rollback();
-            return `Aborted after ${Math.round((Date.now() - startedAt) / 1000)}s (time budget exceeded) \u2014 ` + "the plan was ROLLED BACK (nothing committed). Safe Mode is slow/unresponsive on this " + "device; apply the change with the direct write tools instead.";
-          }
-          const out = await safe.execute(step.command);
-          if (looksLikeError(out)) {
-            await safe.rollback();
-            return `Step ${step.index} failed and the plan was ROLLED BACK (nothing committed):
-` + `  ${step.command}
-  \u2192 ${out.trim()}`;
+      const applyAndDiff = async () => {
+        try {
+          const before = normalizeExport(await safe.execute("/export terse"));
+          const log = [];
+          for (const step of plan.steps) {
+            if (overBudget()) {
+              throw new Error(`aborted after ${Math.round((Date.now() - startedAt) / 1000)}s (time budget exceeded). ` + "Safe Mode is slow/unresponsive on this device; apply the change with the direct write tools instead");
+            }
+            const out = await safe.execute(step.command);
+            if (looksLikeError(out)) {
+              throw new Error(`step ${step.index} failed:
+  ${step.command}
+  \u2192 ${out.trim()}`);
+            }
+            log.push(`  \u2713 ${step.command}`);
           }
-          log.push(`  \u2713 ${step.command}`);
-        }
-        const after = normalizeExport(await safe.execute("/export terse"));
-        const diff = diffLines(before, after, { fromLabel: "before", toLabel: "after" });
-        const reachable = !looksLikeError(await safe.execute("/system identity print"));
-        const planBody = renderPlan(plan).split(`
+          const after = normalizeExport(await safe.execute("/export terse"));
+          const diff = diffLines(before, after, { fromLabel: "before", toLabel: "after" });
+          const reachable2 = !looksLikeError(await safe.execute("/system identity print"));
+          const planBody = renderPlan(plan).split(`
 `).slice(2).join(`
 `);
-        const header = `APPLY PLAN \u2014 ${device}
+          const header2 = `APPLY PLAN \u2014 ${device}
 
 ${planBody}
 
@@ -4445,32 +4527,35 @@ ${log.join(`
 
 ` + `EXACT DIFF (+${diff.summary.added}/-${diff.summary.removed}):
 ${diff.unified || "(no config change)"}`;
-        if (!a.confirm) {
-          await safe.rollback();
-          return `${header}
+          return { header: header2, reachable: reachable2 };
+        } catch (e) {
+          await safe.rollback().catch(() => {});
+          const msg = e instanceof Error ? e.message : String(e);
+          throw new Error(`apply_plan failed and was rolled back (nothing committed): ${msg}`);
+        }
+      };
+      const { header, reachable } = await applyAndDiff();
+      if (!a.confirm) {
+        await safe.rollback();
+        return `${header}
 
 DRY-RUN: all changes rolled back. Re-run with confirm=true to commit.`;
-        }
-        if (!reachable) {
-          await safe.rollback();
-          return `${header}
+      }
+      if (!reachable) {
+        await safe.rollback();
+        throw new Error(`${header}
 
-ABORTED: the device stopped responding after applying \u2014 changes rolled back to avoid a lock-out.`;
-        }
-        const committed = await safe.commit();
-        if (!committed.ok) {
-          return `${header}
+ABORTED: the device stopped responding after applying \u2014 changes rolled back to avoid a lock-out.`);
+      }
+      const committed = await safe.commit();
+      if (!committed.ok) {
+        throw new Error(`${header}
 
-COMMIT FAILED \u2014 changes are NOT saved (still pending in Safe Mode). ` + `${committed.message}`;
-        }
-        return `${header}
+COMMIT FAILED \u2014 changes are NOT saved (still pending in Safe Mode). ${committed.message}`);
+      }
+      return `${header}
 
 COMMITTED: changes are now permanent. ${committed.message}`;
-      } catch (e) {
-        await safe.rollback();
-        const msg = e instanceof Error ? e.message : String(e);
-        return `apply_plan failed and was rolled back: ${msg}`;
-      }
     }
   })
 ];
@@ -5847,7 +5932,7 @@ var cache = null;
 async function gateway() {
   if (cache)
     return cache;
-  const { moduleCatalog } = await import("./library-gsvkewg5.js");
+  const { moduleCatalog } = await import("./library-c629x3tn.js");
   const forIndex = [];
   const byName = new Map;
   for (const mod of moduleCatalog) {

package/dist/shared/{library-gsvkewg5.js → library-c629x3tn.js}

@@ -4,7 +4,7 @@ import {
   allToolModules,
   moduleCatalog,
   selectToolModules
-} from "./library-bj9xrcg0.js";
+} from "./library-aa58hkb4.js";
 export {
   selectToolModules,
   moduleCatalog,