@usex/mikrotik-mcp 3.4.0 → 3.5.0

package/dist/cli.js

@@ -3,7 +3,7 @@
 var __require = import.meta.require;
 
 // src/cli.ts
-import { existsSync as existsSync2 } from "fs";
+import { existsSync as existsSync3 } from "fs";
 
 // src/config.ts
 import { readFileSync } from "fs";
@@ -13,6 +13,7 @@ import { z } from "zod";
 var DEFAULT_DASHBOARD_DB = join(homedir(), ".mikrotik-mcp", "events.db");
 var DEFAULT_SNAPSHOT_DB = join(homedir(), ".mikrotik-mcp", "snapshots.db");
 var DEFAULT_BACKUP_DIR = join(homedir(), ".mikrotik-mcp", "backups");
+var DEFAULT_CONFIG_HISTORY_DIR = join(homedir(), ".mikrotik-mcp", "config-history");
 var DEFAULT_CONFIG_FILE = join(homedir(), ".mikrotik-mcp", "config.json");
 var TransportSchema = z.enum(["stdio", "sse", "streamable-http"]);
 var McpServerSettingsSchema = z.object({
@@ -1051,6 +1052,16 @@ function looksLikeError(result) {
   const t = result.toLowerCase();
   return t.includes("failure:") || t.includes("syntax error") || t.includes("bad command") || t.includes("bad parameter") || t.includes("expected end of command") || t.includes("invalid value") || t.includes("input does not match") || t.includes("ambiguous value") || t.startsWith("error");
 }
+function placeBeforeError(result, placeBefore) {
+  if (!placeBefore)
+    return;
+  const t = result.toLowerCase();
+  if (!t.includes("place-before") || !(t.includes("does not exist") || t.includes("not found"))) {
+    return;
+  }
+  const detail = placeBefore.startsWith("*") ? `A '*N' value is an internal .id (hexadecimal, reassigned over time), NOT the row number \u2014 list the rules first and use a CURRENT .id, or pass a bare ordinal position instead (e.g. '${placeBefore.slice(1)}').` : "Pass a bare ordinal position (e.g. '0') or a current internal .id ('*N') from a list call.";
+  return `place_before '${placeBefore}' does not exist on the device. ${detail}`;
+}
 function commandUnsupported(result) {
   const t = result.toLowerCase();
   return t.includes("bad command name") || t.includes("no such command") || t.includes("no such command prefix") || t.includes("invalid command name");
@@ -1086,6 +1097,67 @@ function parseKeyValues(text) {
   }
   return out;
 }
+function parseSize(s) {
+  if (!s)
+    return;
+  const m = s.trim().match(/^([\d.]+)\s*([KMGT]i?B|B)?$/i);
+  if (!m)
+    return;
+  const val = Number.parseFloat(m[1]);
+  if (!Number.isFinite(val))
+    return;
+  const mult = {
+    B: 1,
+    KIB: 1024,
+    MIB: 1024 ** 2,
+    GIB: 1024 ** 3,
+    TIB: 1024 ** 4,
+    KB: 1000,
+    MB: 1e6,
+    GB: 1e9,
+    TB: 1000000000000
+  };
+  return val * (mult[(m[2] ?? "B").toUpperCase()] ?? 1);
+}
+function parsePercent(s) {
+  if (!s)
+    return;
+  const m = s.trim().match(/^([\d.]+)\s*%?$/);
+  if (!m)
+    return;
+  const v = Number.parseFloat(m[1]);
+  return Number.isFinite(v) ? v : undefined;
+}
+function usedPct(total, free) {
+  if (total == null || free == null || total <= 0)
+    return;
+  return Math.max(0, Math.min(100, (total - free) / total * 100));
+}
+function parseSystemResource(text) {
+  const r = parseKeyValues(text);
+  const totalMemory = parseSize(r["total-memory"]);
+  const freeMemory = parseSize(r["free-memory"]);
+  const totalHdd = parseSize(r["total-hdd-space"]);
+  const freeHdd = parseSize(r["free-hdd-space"]);
+  const cpuLoad = parsePercent(r["cpu-load"]);
+  const cpuCount = Number.parseInt(r["cpu-count"] ?? "", 10);
+  const out = {
+    version: r.version || undefined,
+    boardName: r["board-name"] || undefined,
+    architecture: r["architecture-name"] || undefined,
+    cpuCount: Number.isFinite(cpuCount) ? cpuCount : undefined,
+    cpuLoad,
+    freeMemory,
+    totalMemory,
+    memUsedPct: usedPct(totalMemory, freeMemory),
+    freeHdd,
+    totalHdd,
+    hddUsedPct: usedPct(totalHdd, freeHdd),
+    uptime: r.uptime || undefined
+  };
+  const gotMetric = out.cpuLoad != null || out.totalMemory != null || out.totalHdd != null || out.version != null || out.uptime != null;
+  return gotMetric ? out : null;
+}
 function parseFlagLegend(text) {
   const out = {};
   const line = text.split(`
@@ -5176,7 +5248,7 @@ var firewallFilterTools = [
       disabled: z17.boolean().default(false),
       log: z17.boolean().default(false),
       log_prefix: z17.string().optional(),
-      place_before: z17.string().optional().describe('Rule number or ID (*N) to insert before e.g. "0" or "*3"')
+      place_before: z17.string().optional().describe('Insert before this position. Either a bare ordinal/row number (e.g. "0", "13") OR a ' + 'CURRENT internal .id ("*N") from list_filter_rules. Note: a "*N" .id is hexadecimal ' + 'and reassigned over time \u2014 it is NOT the row number, so "*13" \u2260 the 13th rule.')
     },
     async handler(a, ctx) {
       ctx.info(`Creating firewall filter rule: chain=${a.chain}, action=${a.action}`);
@@ -5190,7 +5262,8 @@ var firewallFilterTools = [
 
 ${details}` : `Firewall filter rule created with ID: ${result}`;
         }
-        return `Failed to create firewall filter rule: ${result}`;
+        const hint = placeBeforeError(result, a.place_before);
+        return `Failed to create firewall filter rule: ${hint ?? result}`;
       }
       const count = await executeMikrotikCommand("/ip firewall filter print detail count-only", ctx);
       const c = count.trim();
@@ -5486,7 +5559,8 @@ var firewallNatTools = [
 
 ${details}` : `NAT rule created with ID: ${result}`;
         }
-        return `Failed to create NAT rule: ${result}`;
+        const hint = placeBeforeError(result, a.place_before);
+        return `Failed to create NAT rule: ${hint ?? result}`;
       }
       const count = await executeMikrotikCommand("/ip firewall nat print detail count-only", ctx);
       const c = count.trim();
@@ -19610,9 +19684,9 @@ var moduleCatalog = [
 var allToolModules = moduleCatalog.map((m) => m.tools);
 
 // src/observability/dashboard.ts
-import { readFileSync as readFileSync5 } from "fs";
+import { readFileSync as readFileSync6 } from "fs";
 import { homedir as homedir2, networkInterfaces } from "os";
-import { join as join5 } from "path";
+import { join as join6 } from "path";
 var {serve } = globalThis.Bun;
 import { z as z93 } from "zod";
 
@@ -19709,6 +19783,108 @@ function createConfigAdmin(deps) {
   return { applyConfig, keepConfig, rollback, pendingId: () => pending?.id ?? null };
 }
 
+// src/observability/config-history.ts
+import {
+  existsSync as existsSync2,
+  mkdirSync as mkdirSync4,
+  readFileSync as readFileSync5,
+  readdirSync as readdirSync2,
+  rmSync as rmSync2,
+  statSync as statSync2,
+  writeFileSync as writeFileSync3
+} from "fs";
+import { join as join5 } from "path";
+var AUTO_RETENTION = 50;
+function historyDir() {
+  return process.env.MIKROTIK_CONFIG_HISTORY_DIR || DEFAULT_CONFIG_HISTORY_DIR;
+}
+function idToFile(id) {
+  if (!/^v\d+$/.test(id))
+    throw new Error(`invalid version id: ${id}`);
+  return `${id}.json`;
+}
+function listVersions() {
+  const dir = historyDir();
+  if (!existsSync2(dir))
+    return [];
+  const out = [];
+  for (const f of readdirSync2(dir)) {
+    if (!/^v\d+\.json$/.test(f))
+      continue;
+    try {
+      const raw = readFileSync5(join5(dir, f), "utf8");
+      const parsed = JSON.parse(raw);
+      out.push({
+        id: f.replace(/\.json$/, ""),
+        ts: parsed.ts,
+        kind: parsed.kind === "checkpoint" ? "checkpoint" : "auto",
+        label: parsed.label,
+        bytes: Buffer.byteLength(JSON.stringify(parsed.config ?? {}, null, 2), "utf8")
+      });
+    } catch {}
+  }
+  return out.sort((a, b) => b.ts - a.ts);
+}
+function readVersion(id) {
+  const raw = readFileSync5(join5(historyDir(), idToFile(id)), "utf8");
+  return JSON.parse(raw);
+}
+function deleteVersion(id) {
+  const p = join5(historyDir(), idToFile(id));
+  if (!existsSync2(p))
+    return false;
+  rmSync2(p);
+  return true;
+}
+function recordVersion(config, kind, now, label) {
+  const dir = historyDir();
+  mkdirSync4(dir, { recursive: true });
+  let ts = now;
+  while (existsSync2(join5(dir, `v${ts}.json`)))
+    ts++;
+  const body = { ts, kind, label, config };
+  writeFileSync3(join5(dir, `v${ts}.json`), `${JSON.stringify(body, null, 2)}
+`, "utf8");
+  pruneAuto(dir);
+  return {
+    id: `v${ts}`,
+    ts,
+    kind,
+    label,
+    bytes: Buffer.byteLength(JSON.stringify(config ?? {}, null, 2), "utf8")
+  };
+}
+function pruneAuto(dir) {
+  const autos = listVersions().filter((v) => v.kind === "auto");
+  if (autos.length <= AUTO_RETENTION)
+    return;
+  for (const v of autos.slice(AUTO_RETENTION)) {
+    try {
+      rmSync2(join5(dir, `${v.id}.json`));
+    } catch {}
+  }
+}
+function isEmpty2() {
+  const dir = historyDir();
+  if (!existsSync2(dir))
+    return true;
+  return !readdirSync2(dir).some((f) => /^v\d+\.json$/.test(f));
+}
+function historyBytes() {
+  const dir = historyDir();
+  if (!existsSync2(dir))
+    return 0;
+  let total = 0;
+  for (const f of readdirSync2(dir)) {
+    if (!/^v\d+\.json$/.test(f))
+      continue;
+    try {
+      total += statSync2(join5(dir, f)).size;
+    } catch {}
+  }
+  return total;
+}
+
 // src/observability/topology.ts
 function normMac(mac2) {
   if (!mac2)
@@ -19863,6 +20039,7 @@ function buildTopology(input) {
 }
 
 // src/observability/health.ts
+var LOG_TAG = "mikrotik-mcp";
 var HISTORY_CAP = 60;
 var statuses = new Map;
 var histories = new Map;
@@ -19886,39 +20063,6 @@ function pushHistory(name, sample) {
     arr.splice(0, arr.length - HISTORY_CAP);
   histories.set(name, arr);
 }
-function parseSize(s) {
-  if (!s)
-    return;
-  const m = s.trim().match(/^([\d.]+)\s*([KMGT]i?B|B)?$/i);
-  if (!m)
-    return;
-  const val = Number.parseFloat(m[1]);
-  if (!Number.isFinite(val))
-    return;
-  const mult = {
-    B: 1,
-    KIB: 1024,
-    MIB: 1024 ** 2,
-    GIB: 1024 ** 3,
-    TIB: 1024 ** 4,
-    KB: 1000,
-    MB: 1e6,
-    GB: 1e9,
-    TB: 1000000000000
-  };
-  return val * (mult[(m[2] ?? "B").toUpperCase()] ?? 1);
-}
-function parsePercent(s) {
-  if (!s)
-    return;
-  const m = s.trim().match(/^([\d.]+)\s*%?$/);
-  return m ? Number.parseFloat(m[1]) : undefined;
-}
-function usedPct(total, free) {
-  if (total == null || free == null || total <= 0)
-    return;
-  return Math.max(0, Math.min(100, (total - free) / total * 100));
-}
 async function probeDevice(name, dc) {
   const client = createDeviceClient({
     ...dc,
@@ -19936,41 +20080,41 @@ async function probeDevice(name, dc) {
         error: client.lastError ?? "connection failed"
       };
     } else {
-      const identity = parseKeyValues(await client.run("/system identity print")).name;
-      const r = parseKeyValues(await client.run("/system resource print"));
+      const rawResource = await client.run("/system resource print");
       const checkedAt = Date.now();
       const latencyMs = checkedAt - t0;
-      const totalMemory = parseSize(r["total-memory"]);
-      const freeMemory = parseSize(r["free-memory"]);
-      const totalHdd = parseSize(r["total-hdd-space"]);
-      const freeHdd = parseSize(r["free-hdd-space"]);
-      const cpuLoad = parsePercent(r["cpu-load"]);
-      const memUsedPct = usedPct(totalMemory, freeMemory);
-      const hddUsedPct = usedPct(totalHdd, freeHdd);
-      const cpuCount = Number.parseInt(r["cpu-count"] ?? "", 10);
+      const sys = parseSystemResource(rawResource);
+      if (!sys) {
+        logger.warn(`[${LOG_TAG}] '${name}' is reachable but '/system resource print' returned no ` + `parseable metrics. Raw output: ${JSON.stringify(rawResource.slice(0, 200))}`);
+      }
+      let identity;
+      try {
+        identity = parseKeyValues(await client.run("/system identity print")).name || undefined;
+      } catch {}
       status = {
         reachable: true,
         checkedAt,
         latencyMs,
         identity,
-        version: r.version,
-        boardName: r["board-name"] || undefined,
-        architecture: r["architecture-name"] || undefined,
-        cpuCount: Number.isFinite(cpuCount) ? cpuCount : undefined,
-        cpuLoad,
-        freeMemory,
-        totalMemory,
-        memUsedPct,
-        freeHdd,
-        totalHdd,
-        hddUsedPct,
-        uptime: r.uptime || undefined
+        version: sys?.version,
+        boardName: sys?.boardName,
+        architecture: sys?.architecture,
+        cpuCount: sys?.cpuCount,
+        cpuLoad: sys?.cpuLoad,
+        freeMemory: sys?.freeMemory,
+        totalMemory: sys?.totalMemory,
+        memUsedPct: sys?.memUsedPct,
+        freeHdd: sys?.freeHdd,
+        totalHdd: sys?.totalHdd,
+        hddUsedPct: sys?.hddUsedPct,
+        uptime: sys?.uptime,
+        error: sys ? undefined : "reachable, but no system metrics returned"
       };
       pushHistory(name, {
         ts: checkedAt,
-        cpuLoad: cpuLoad ?? null,
-        memUsedPct: memUsedPct ?? null,
-        hddUsedPct: hddUsedPct ?? null,
+        cpuLoad: sys?.cpuLoad ?? null,
+        memUsedPct: sys?.memUsedPct ?? null,
+        hddUsedPct: sys?.hddUsedPct ?? null,
         latencyMs
       });
       try {
@@ -20023,7 +20167,7 @@ function stopHealthChecks() {
 }
 
 // src/observability/store.ts
-import { mkdirSync as mkdirSync4 } from "fs";
+import { mkdirSync as mkdirSync5 } from "fs";
 import { dirname as dirname4 } from "path";
 function rowToEvent(r) {
   return {
@@ -20181,7 +20325,7 @@ class SqliteEventStore {
 async function openSqliteStore(path) {
   if (path !== ":memory:") {
     try {
-      mkdirSync4(dirname4(path), { recursive: true });
+      mkdirSync5(dirname4(path), { recursive: true });
     } catch {}
   }
   const { Database } = await import("bun:sqlite");
@@ -20290,7 +20434,7 @@ function json(body, status = 200) {
 }
 function dashboardHtml() {
   try {
-    return readFileSync5(join5(UI_DIST_DIR, "observability.html"), "utf8");
+    return readFileSync6(join6(UI_DIST_DIR, "observability.html"), "utf8");
   } catch {
     return `<!doctype html><meta charset=utf-8><body style="font:14px system-ui;padding:24px;background:#0b0d10;color:#e8eaed">
 <h2>MikroTik MCP \u2014 Observability Dashboard</h2>
@@ -20516,13 +20660,96 @@ async function configRoutes(req, url, admin) {
   }
   if (p === "/api/config/keep" && req.method === "POST") {
     const body = await readJson(req);
-    return json({ kept: admin.keepConfig(String(body?.pendingId ?? "")) });
+    const kept = admin.keepConfig(String(body?.pendingId ?? ""));
+    if (kept)
+      recordVersion(getConfig(), "auto", Date.now());
+    return json({ kept });
   }
   if (p === "/api/config/rollback" && req.method === "POST") {
     const body = await readJson(req);
     const rolledBack = admin.rollback(String(body?.pendingId ?? ""));
     return json({ rolledBack, config: redact(getConfig()) });
   }
+  if (p === "/api/config/history" && req.method === "GET") {
+    const current = JSON.stringify(redact(getConfig()), null, 2);
+    const versions = listVersions().map((v) => {
+      let added = 0;
+      let removed = 0;
+      try {
+        const vc = JSON.stringify(redact(readVersion(v.id).config), null, 2);
+        const d = diffLines(vc, current);
+        added = d.summary.added;
+        removed = d.summary.removed;
+      } catch {}
+      return { ...v, drift: { added, removed } };
+    });
+    return json({ versions, bytes: historyBytes(), retention: AUTO_RETENTION });
+  }
+  if (p === "/api/config/history/get" && req.method === "GET") {
+    const id = url.searchParams.get("id");
+    if (!id)
+      return json({ error: "id required" }, 400);
+    try {
+      const v = readVersion(id);
+      return json({
+        ts: v.ts,
+        kind: v.kind,
+        label: v.label,
+        config: JSON.stringify(redact(v.config), null, 2)
+      });
+    } catch {
+      return json({ error: "not found" }, 404);
+    }
+  }
+  if (p === "/api/config/history/diff" && req.method === "GET") {
+    const id = url.searchParams.get("id");
+    if (!id)
+      return json({ error: "id required" }, 400);
+    try {
+      const before = JSON.stringify(redact(readVersion(id).config), null, 2);
+      const after = JSON.stringify(redact(getConfig()), null, 2);
+      const d = diffLines(before, after, { fromLabel: "this version", toLabel: "current" });
+      return json({ summary: d.summary, unified: d.unified });
+    } catch {
+      return json({ error: "not found" }, 404);
+    }
+  }
+  if (p === "/api/config/history/checkpoint" && req.method === "POST") {
+    const b = await readJson(req);
+    const label = b?.label?.trim() || "checkpoint";
+    return json({ ok: true, version: recordVersion(getConfig(), "checkpoint", Date.now(), label) });
+  }
+  if (p === "/api/config/history/restore" && req.method === "POST") {
+    const b = await readJson(req);
+    if (!b?.id)
+      return json({ error: "id required" }, 400);
+    let target;
+    try {
+      target = readVersion(b.id);
+    } catch {
+      return json({ error: "not found" }, 404);
+    }
+    const v = validateConfig(target.config);
+    if (!v.ok || !v.value)
+      return json({ ok: false, errors: v.errors }, 400);
+    recordVersion(getConfig(), "auto", Date.now(), "before restore");
+    setConfig(v.value);
+    let persisted = true;
+    try {
+      atomicWrite(getConfigSource().path, serializeConfig(v.value));
+    } catch {
+      persisted = false;
+    }
+    const label = target.label ? `restored "${target.label}"` : `restored ${b.id}`;
+    recordVersion(getConfig(), "auto", Date.now(), label);
+    return json({ ok: true, persisted, restored: b.id, config: redact(getConfig()) });
+  }
+  if (p === "/api/config/history/delete" && req.method === "POST") {
+    const b = await readJson(req);
+    if (!b?.id)
+      return json({ error: "id required" }, 400);
+    return deleteVersion(b.id) ? json({ ok: true }) : json({ error: "not found" }, 404);
+  }
   return null;
 }
 async function captureRoutes(req, url) {
@@ -20663,7 +20890,7 @@ async function featureRoutes(req, url) {
     const raw = b?.dir?.trim();
     if (!raw)
       return json({ error: "dir required" }, 400);
-    const dir = raw === "~" || raw.startsWith("~/") ? join5(homedir2(), raw.slice(1)) : raw;
+    const dir = raw === "~" || raw.startsWith("~/") ? join6(homedir2(), raw.slice(1)) : raw;
     const next = { ...getConfig(), backupDir: dir };
     setConfig(next);
     try {
@@ -20676,6 +20903,7 @@ async function featureRoutes(req, url) {
         warning: `applied live but not saved: ${e instanceof Error ? e.message : String(e)}`
       });
     }
+    recordVersion(getConfig(), "auto", Date.now(), "backup path changed");
     return json({ ok: true, dir: backupDir(), persisted: true });
   }
   if (p === "/api/backups/get" && req.method === "GET") {
@@ -20766,13 +20994,19 @@ async function runDashboard(cfg, transportLabel) {
     transport: transportLabel
   });
   startHealthChecks(30000);
+  try {
+    if (isEmpty2())
+      recordVersion(getConfig(), "auto", Date.now(), "baseline");
+  } catch (e) {
+    logger.warn(`[${SERVER_TAG}] could not seed config history baseline: ${String(e)}`);
+  }
   const configAdmin = createConfigAdmin({
     getConfig,
     setConfig,
     source: getConfigSource,
     readFile: (pth) => {
       try {
-        return readFileSync5(pth, "utf8");
+        return readFileSync6(pth, "utf8");
       } catch {
         return null;
       }
@@ -20956,8 +21190,8 @@ function corsHeaders(origin, configured) {
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 
 // src/prompts/index.ts
-import { readFileSync as readFileSync6, readdirSync as readdirSync2 } from "fs";
-import { join as join6 } from "path";
+import { readFileSync as readFileSync7, readdirSync as readdirSync3 } from "fs";
+import { join as join7 } from "path";
 import { z as z94 } from "zod";
 function parseFrontmatter(raw) {
   const match = raw.match(/^---\n([\s\S]*?)\n---\n?([\s\S]*)$/);
@@ -21020,7 +21254,7 @@ function substitute(body, vars) {
 function registerPrompts(server) {
   let files;
   try {
-    files = readdirSync2(PROMPTS_DIR).filter((f) => f.endsWith(".md"));
+    files = readdirSync3(PROMPTS_DIR).filter((f) => f.endsWith(".md"));
   } catch {
     return 0;
   }
@@ -21028,7 +21262,7 @@ function registerPrompts(server) {
   for (const file of files) {
     let parsed;
     try {
-      parsed = parseFrontmatter(readFileSync6(join6(PROMPTS_DIR, file), "utf8"));
+      parsed = parseFrontmatter(readFileSync7(join7(PROMPTS_DIR, file), "utf8"));
     } catch (e) {
       logger.warn(`Skipping prompt ${file}: ${String(e)}`);
       continue;
@@ -21060,7 +21294,7 @@ function registerPrompts(server) {
 // package.json
 var package_default = {
   name: "@usex/mikrotik-mcp",
-  version: "3.4.0",
+  version: "3.5.0",
   description: "MCP server for MikroTik RouterOS \u2014 660+ tools over SSH for firewall, NAT, routing, DHCP, DNS, WireGuard, wireless, QoS and more.",
   keywords: [
     "ai",
@@ -21142,18 +21376,24 @@ var package_default = {
   },
   devDependencies: {
     "@resvg/resvg-js": "^2.6.2",
+    "@tailwindcss/vite": "^4.3.1",
     "@types/bun": "latest",
-    "@types/node": "^26.0.0",
+    "@types/node": "^26.0.1",
     "@types/react": "^19.2.17",
     "@types/react-dom": "^19.2.3",
     "@types/ssh2": "^1.15.5",
     "@types/update-notifier": "^6.0.8",
     bunup: "^0.16.32",
+    "class-variance-authority": "^0.7.1",
+    clsx: "^2.1.1",
     gsap: "^3.15.0",
     prettier: "^3.8.4",
     react: "^19.2.7",
     "react-dom": "^19.2.7",
+    recharts: "^3.9.0",
     "release-it": "^20.2.0",
+    "tailwind-merge": "^3.6.0",
+    tailwindcss: "^4.3.1",
     vite: "npm:@voidzero-dev/vite-plus-core@latest",
     "vite-plus": "latest"
   },
@@ -21402,7 +21642,7 @@ OBSERVABILITY DASHBOARD  (optional; real-time feed + analytics of every tool cal
                                                            (MIKROTIK_DASHBOARD__TOKEN)
 `;
 function warnIfPlaintextPasswordInContainer(anyPassword) {
-  const inContainer = existsSync2("/.dockerenv") || process.env.container === "docker";
+  const inContainer = existsSync3("/.dockerenv") || process.env.container === "docker";
   if (inContainer && anyPassword) {
     logger.warn("Security notice: running inside a container with a plaintext password in the environment. " + "Environment variables are visible via 'docker inspect'. Prefer Docker secrets / a key file. See SECURITY.md.");
   }

package/dist/index.js

@@ -9,6 +9,7 @@ import { z } from "zod";
 var DEFAULT_DASHBOARD_DB = join(homedir(), ".mikrotik-mcp", "events.db");
 var DEFAULT_SNAPSHOT_DB = join(homedir(), ".mikrotik-mcp", "snapshots.db");
 var DEFAULT_BACKUP_DIR = join(homedir(), ".mikrotik-mcp", "backups");
+var DEFAULT_CONFIG_HISTORY_DIR = join(homedir(), ".mikrotik-mcp", "config-history");
 var DEFAULT_CONFIG_FILE = join(homedir(), ".mikrotik-mcp", "config.json");
 var TransportSchema = z.enum(["stdio", "sse", "streamable-http"]);
 var McpServerSettingsSchema = z.object({
@@ -1036,6 +1037,16 @@ function looksLikeError(result) {
   const t = result.toLowerCase();
   return t.includes("failure:") || t.includes("syntax error") || t.includes("bad command") || t.includes("bad parameter") || t.includes("expected end of command") || t.includes("invalid value") || t.includes("input does not match") || t.includes("ambiguous value") || t.startsWith("error");
 }
+function placeBeforeError(result, placeBefore) {
+  if (!placeBefore)
+    return;
+  const t = result.toLowerCase();
+  if (!t.includes("place-before") || !(t.includes("does not exist") || t.includes("not found"))) {
+    return;
+  }
+  const detail = placeBefore.startsWith("*") ? `A '*N' value is an internal .id (hexadecimal, reassigned over time), NOT the row number \u2014 list the rules first and use a CURRENT .id, or pass a bare ordinal position instead (e.g. '${placeBefore.slice(1)}').` : "Pass a bare ordinal position (e.g. '0') or a current internal .id ('*N') from a list call.";
+  return `place_before '${placeBefore}' does not exist on the device. ${detail}`;
+}
 function commandUnsupported(result) {
   const t = result.toLowerCase();
   return t.includes("bad command name") || t.includes("no such command") || t.includes("no such command prefix") || t.includes("invalid command name");
@@ -5249,7 +5260,7 @@ var firewallFilterTools = [
       disabled: z18.boolean().default(false),
       log: z18.boolean().default(false),
       log_prefix: z18.string().optional(),
-      place_before: z18.string().optional().describe('Rule number or ID (*N) to insert before e.g. "0" or "*3"')
+      place_before: z18.string().optional().describe('Insert before this position. Either a bare ordinal/row number (e.g. "0", "13") OR a ' + 'CURRENT internal .id ("*N") from list_filter_rules. Note: a "*N" .id is hexadecimal ' + 'and reassigned over time \u2014 it is NOT the row number, so "*13" \u2260 the 13th rule.')
     },
     async handler(a, ctx) {
       ctx.info(`Creating firewall filter rule: chain=${a.chain}, action=${a.action}`);
@@ -5263,7 +5274,8 @@ var firewallFilterTools = [
 
 ${details}` : `Firewall filter rule created with ID: ${result}`;
         }
-        return `Failed to create firewall filter rule: ${result}`;
+        const hint = placeBeforeError(result, a.place_before);
+        return `Failed to create firewall filter rule: ${hint ?? result}`;
       }
       const count = await executeMikrotikCommand("/ip firewall filter print detail count-only", ctx);
       const c = count.trim();
@@ -5559,7 +5571,8 @@ var firewallNatTools = [
 
 ${details}` : `NAT rule created with ID: ${result}`;
         }
-        return `Failed to create NAT rule: ${result}`;
+        const hint = placeBeforeError(result, a.place_before);
+        return `Failed to create NAT rule: ${hint ?? result}`;
       }
       const count = await executeMikrotikCommand("/ip firewall nat print detail count-only", ctx);
       const c = count.trim();
@@ -19684,7 +19697,7 @@ var allToolModules = moduleCatalog.map((m) => m.tools);
 // package.json
 var package_default = {
   name: "@usex/mikrotik-mcp",
-  version: "3.4.0",
+  version: "3.5.0",
   description: "MCP server for MikroTik RouterOS \u2014 660+ tools over SSH for firewall, NAT, routing, DHCP, DNS, WireGuard, wireless, QoS and more.",
   keywords: [
     "ai",
@@ -19766,18 +19779,24 @@ var package_default = {
   },
   devDependencies: {
     "@resvg/resvg-js": "^2.6.2",
+    "@tailwindcss/vite": "^4.3.1",
     "@types/bun": "latest",
-    "@types/node": "^26.0.0",
+    "@types/node": "^26.0.1",
     "@types/react": "^19.2.17",
     "@types/react-dom": "^19.2.3",
     "@types/ssh2": "^1.15.5",
     "@types/update-notifier": "^6.0.8",
     bunup: "^0.16.32",
+    "class-variance-authority": "^0.7.1",
+    clsx: "^2.1.1",
     gsap: "^3.15.0",
     prettier: "^3.8.4",
     react: "^19.2.7",
     "react-dom": "^19.2.7",
+    recharts: "^3.9.0",
     "release-it": "^20.2.0",
+    "tailwind-merge": "^3.6.0",
+    tailwindcss: "^4.3.1",
     vite: "npm:@voidzero-dev/vite-plus-core@latest",
     "vite-plus": "latest"
   },