@usex/mikrotik-mcp 3.42.0 → 3.43.0

package/dist/shared/{library-5cjmn0n7.js → library-hjde13aa.js}

@@ -4,327 +4,9 @@ var __require = import.meta.require;
 // src/tools/address-list.ts
 import { z as z3 } from "zod";
 
-// src/config.ts
+// src/ssh/client.ts
 import { readFileSync } from "fs";
-import { homedir } from "os";
-import { join, resolve } from "path";
-import { z } from "zod";
-var DEFAULT_DASHBOARD_DB = join(homedir(), ".mikrotik-mcp", "events.db");
-var DEFAULT_SNAPSHOT_DB = join(homedir(), ".mikrotik-mcp", "snapshots.db");
-var DEFAULT_BACKUP_DIR = join(homedir(), ".mikrotik-mcp", "backups");
-var DEFAULT_CONFIG_HISTORY_DIR = join(homedir(), ".mikrotik-mcp", "config-history");
-var DEFAULT_CONFIG_FILE = join(homedir(), ".mikrotik-mcp", "config.json");
-var TransportSchema = z.enum(["stdio", "sse", "streamable-http"]);
-var McpServerSettingsSchema = z.object({
-  transport: TransportSchema.default("stdio"),
-  host: z.string().default("0.0.0.0"),
-  port: z.coerce.number().int().positive().default(8000),
-  allowedHosts: z.string().default(""),
-  allowedOrigins: z.string().default(""),
-  corsOrigins: z.string().default(""),
-  toolPageSize: z.coerce.number().int().min(0).default(0),
-  appViews: z.boolean().default(true)
-});
-var JumpHostSchema = z.object({
-  host: z.string(),
-  port: z.coerce.number().int().positive().default(22),
-  username: z.string().default("admin"),
-  password: z.string().optional(),
-  keyFilename: z.string().optional(),
-  privateKey: z.string().optional(),
-  keyPassphrase: z.string().optional(),
-  timeoutMs: z.coerce.number().int().positive().optional()
-});
-var DeviceConfigSchema = z.object({
-  host: z.string().default("127.0.0.1"),
-  username: z.string().default("admin"),
-  password: z.string().default(""),
-  port: z.coerce.number().int().positive().default(22),
-  keyFilename: z.string().optional(),
-  privateKey: z.string().optional(),
-  keyPassphrase: z.string().optional(),
-  timeoutMs: z.coerce.number().int().positive().default(1e4),
-  jumpVia: z.string().optional(),
-  jumpHost: JumpHostSchema.optional(),
-  mac: z.string().optional(),
-  sourceMac: z.string().optional(),
-  macHost: z.string().optional(),
-  macPort: z.coerce.number().int().positive().optional(),
-  description: z.string().optional()
-});
-var S3ConfigSchema = z.object({
-  accessKeyId: z.string().optional(),
-  secretAccessKey: z.string().optional(),
-  sessionToken: z.string().optional(),
-  region: z.string().optional(),
-  endpoint: z.string().optional(),
-  bucket: z.string().optional(),
-  prefix: z.string().default(""),
-  presignExpiresIn: z.coerce.number().int().positive().default(3600)
-});
-var DashboardConfigSchema = z.object({
-  enabled: z.boolean().default(false),
-  host: z.string().default("0.0.0.0"),
-  port: z.coerce.number().int().positive().default(9090),
-  dbPath: z.string().default(DEFAULT_DASHBOARD_DB),
-  maxEvents: z.coerce.number().int().positive().default(1e5),
-  captureBody: z.boolean().default(true),
-  redactInput: z.boolean().default(false),
-  maxBodyBytes: z.coerce.number().int().nonnegative().default(16384),
-  token: z.string().optional()
-});
-var ToolFilterSchema = z.object({
-  enabledModules: z.array(z.string()).default([]),
-  disabledModules: z.array(z.string()).default([]),
-  enabledGroups: z.array(z.string()).default([]),
-  disabledGroups: z.array(z.string()).default([])
-});
-var MikrotikConfigSchema = z.object({
-  devices: z.record(z.string(), DeviceConfigSchema).default(() => ({ default: DeviceConfigSchema.parse({}) })),
-  defaultDevice: z.string().default("default"),
-  mcp: McpServerSettingsSchema.default(() => McpServerSettingsSchema.parse({})),
-  s3: S3ConfigSchema.optional(),
-  dashboard: DashboardConfigSchema.default(() => DashboardConfigSchema.parse({})),
-  readOnly: z.boolean().default(false),
-  tools: ToolFilterSchema.default(() => ToolFilterSchema.parse({})),
-  backupDir: z.string().optional()
-});
-function env(...names) {
-  for (const n of names) {
-    const v = process.env[n];
-    if (v !== undefined && v !== "")
-      return v;
-  }
-  return;
-}
-function parseFlags(argv) {
-  const out = {};
-  for (let i = 0;i < argv.length; i++) {
-    const arg = argv[i];
-    if (!arg.startsWith("--"))
-      continue;
-    const eq = arg.indexOf("=");
-    if (eq !== -1) {
-      out[arg.slice(2, eq)] = arg.slice(eq + 1);
-    } else {
-      const key = arg.slice(2);
-      const next = argv[i + 1];
-      if (next !== undefined && !next.startsWith("--")) {
-        out[key] = next;
-        i++;
-      } else {
-        out[key] = "true";
-      }
-    }
-  }
-  return out;
-}
-function parseDevicesSource(raw, fromFile) {
-  let json;
-  try {
-    json = JSON.parse(fromFile ? readFileSync(raw, "utf8") : raw);
-  } catch (e) {
-    throw new Error(`Failed to load MikroTik devices from ${fromFile ? `file ${raw}` : "MIKROTIK_DEVICES"}: ${e instanceof Error ? e.message : String(e)}`);
-  }
-  const obj = json;
-  const structured = obj.devices !== undefined;
-  const devices = obj.devices ?? obj;
-  const defaultDevice = typeof obj.defaultDevice === "string" ? obj.defaultDevice : undefined;
-  const s3 = structured && obj.s3 && typeof obj.s3 === "object" ? obj.s3 : undefined;
-  const dashboard = structured && obj.dashboard && typeof obj.dashboard === "object" ? obj.dashboard : undefined;
-  const tools = structured && obj.tools && typeof obj.tools === "object" ? obj.tools : undefined;
-  const mcp = structured && obj.mcp && typeof obj.mcp === "object" ? obj.mcp : undefined;
-  return { devices, defaultDevice, s3, dashboard, tools, mcp };
-}
-var configSource = { path: DEFAULT_CONFIG_FILE, fromFile: false };
-function loadConfig(argv = process.argv.slice(2)) {
-  const flags = parseFlags(argv);
-  const pick = (flag, ...envNames) => flags[flag] ?? env(...envNames);
-  const jumpHostName = pick("jump-host", "MIKROTIK_JUMP_HOST");
-  const jumpHost = jumpHostName ? {
-    host: jumpHostName,
-    port: pick("jump-port", "MIKROTIK_JUMP_PORT"),
-    username: pick("jump-username", "MIKROTIK_JUMP_USERNAME"),
-    password: pick("jump-password", "MIKROTIK_JUMP_PASSWORD"),
-    keyFilename: pick("jump-key-filename", "MIKROTIK_JUMP_KEY_FILENAME"),
-    keyPassphrase: pick("jump-key-passphrase", "MIKROTIK_JUMP_KEY_PASSPHRASE")
-  } : undefined;
-  const single = {
-    host: pick("host", "MIKROTIK_HOST"),
-    username: pick("username", "MIKROTIK_USERNAME"),
-    password: pick("password", "MIKROTIK_PASSWORD"),
-    port: pick("port", "MIKROTIK_PORT"),
-    keyFilename: pick("key-filename", "MIKROTIK_KEY_FILENAME"),
-    privateKey: pick("private-key", "MIKROTIK_PRIVATE_KEY"),
-    keyPassphrase: pick("key-passphrase", "MIKROTIK_KEY_PASSPHRASE"),
-    timeoutMs: pick("timeout-ms", "MIKROTIK_TIMEOUT_MS"),
-    jumpHost,
-    mac: pick("mac", "MIKROTIK_MAC"),
-    sourceMac: pick("source-mac", "MIKROTIK_SOURCE_MAC"),
-    macHost: pick("mac-host", "MIKROTIK_MAC_HOST"),
-    macPort: pick("mac-port", "MIKROTIK_MAC_PORT")
-  };
-  const hasSingle = Object.values(single).some((v) => v !== undefined);
-  const devices = {};
-  let defaultDevice;
-  if (hasSingle) {
-    devices.default = single;
-    defaultDevice = "default";
-  }
-  const configFile = pick("config", "MIKROTIK_CONFIG_FILE");
-  configSource = configFile ? { path: resolve(configFile), fromFile: true } : { path: DEFAULT_CONFIG_FILE, fromFile: false };
-  const devicesInline = flags.devices ?? env("MIKROTIK_DEVICES");
-  let fileS3 = {};
-  let fileDashboard = {};
-  let fileTools;
-  let fileMcp;
-  if (configFile || devicesInline) {
-    const src = configFile ? parseDevicesSource(configFile, true) : parseDevicesSource(devicesInline, false);
-    for (const [name, dc] of Object.entries(src.devices))
-      devices[name] = dc;
-    if (src.defaultDevice)
-      defaultDevice = src.defaultDevice;
-    else if (!defaultDevice)
-      defaultDevice = Object.keys(src.devices)[0];
-    fileS3 = src.s3;
-    fileDashboard = src.dashboard;
-    fileTools = src.tools;
-    fileMcp = src.mcp;
-  }
-  const s3 = {
-    accessKeyId: pick("s3-access-key-id", "S3_ACCESS_KEY_ID", "AWS_ACCESS_KEY_ID"),
-    secretAccessKey: pick("s3-secret-access-key", "S3_SECRET_ACCESS_KEY", "AWS_SECRET_ACCESS_KEY"),
-    sessionToken: pick("s3-session-token", "S3_SESSION_TOKEN", "AWS_SESSION_TOKEN"),
-    region: pick("s3-region", "S3_REGION", "AWS_REGION"),
-    endpoint: pick("s3-endpoint", "S3_ENDPOINT", "AWS_ENDPOINT"),
-    bucket: pick("s3-bucket", "S3_BUCKET", "AWS_BUCKET"),
-    prefix: pick("s3-prefix", "MIKROTIK_S3_PREFIX"),
-    presignExpiresIn: pick("s3-presign-expires-in", "MIKROTIK_S3_PRESIGN_EXPIRES_IN"),
-    ...fileS3
-  };
-  const appViewsRaw = pick("app-views", "MIKROTIK_MCP__APP_VIEWS");
-  const appViewsEnv = appViewsRaw === undefined ? undefined : !/^(0|false|no|off)$/i.test(appViewsRaw);
-  const mcp = {
-    transport: pick("transport", "MIKROTIK_MCP__TRANSPORT", "MCP_TRANSPORT"),
-    host: pick("mcp-host", "MIKROTIK_MCP__HOST"),
-    port: pick("mcp-port", "MIKROTIK_MCP__PORT"),
-    allowedHosts: pick("mcp-allowed-hosts", "MIKROTIK_MCP__ALLOWED_HOSTS"),
-    allowedOrigins: pick("mcp-allowed-origins", "MIKROTIK_MCP__ALLOWED_ORIGINS"),
-    corsOrigins: pick("mcp-cors-origins", "MIKROTIK_MCP__CORS_ORIGINS"),
-    toolPageSize: pick("tool-page-size", "MIKROTIK_MCP__TOOL_PAGE_SIZE"),
-    appViews: appViewsEnv,
-    ...fileMcp
-  };
-  const isTruthy = (v) => /^(1|true|yes|on)$/i.test(v ?? "");
-  const readOnly = isTruthy(pick("read-only", "MIKROTIK_READ_ONLY"));
-  const csv = (v) => v === undefined ? undefined : v.split(",").map((s) => s.trim()).filter(Boolean);
-  const tools = {
-    enabledModules: csv(pick("tools-enabled-modules", "MIKROTIK_TOOLS__ENABLED_MODULES")),
-    disabledModules: csv(pick("tools-disabled-modules", "MIKROTIK_TOOLS__DISABLED_MODULES")),
-    enabledGroups: csv(pick("tools-enabled-groups", "MIKROTIK_TOOLS__ENABLED_GROUPS")),
-    disabledGroups: csv(pick("tools-disabled-groups", "MIKROTIK_TOOLS__DISABLED_GROUPS")),
-    ...fileTools
-  };
-  const boolOpt = (v) => v === undefined ? undefined : isTruthy(v);
-  const dashboard = {
-    enabled: boolOpt(pick("dashboard", "MIKROTIK_DASHBOARD__ENABLED", "MIKROTIK_DASHBOARD")),
-    host: pick("dashboard-host", "MIKROTIK_DASHBOARD__HOST"),
-    port: pick("dashboard-port", "MIKROTIK_DASHBOARD__PORT"),
-    dbPath: pick("dashboard-db", "MIKROTIK_DASHBOARD__DB_PATH"),
-    maxEvents: pick("dashboard-max-events", "MIKROTIK_DASHBOARD__MAX_EVENTS"),
-    captureBody: boolOpt(pick("dashboard-capture-body", "MIKROTIK_DASHBOARD__CAPTURE_BODY")),
-    redactInput: boolOpt(pick("dashboard-redact-input", "MIKROTIK_DASHBOARD__REDACT_INPUT")),
-    maxBodyBytes: pick("dashboard-max-body-bytes", "MIKROTIK_DASHBOARD__MAX_BODY_BYTES"),
-    token: pick("dashboard-token", "MIKROTIK_DASHBOARD__TOKEN"),
-    ...fileDashboard
-  };
-  const hasS3 = !!(s3.accessKeyId || s3.bucket || s3.endpoint);
-  const raw = {
-    devices: Object.keys(devices).length ? devices : { default: {} },
-    defaultDevice: defaultDevice ?? "default",
-    mcp,
-    dashboard,
-    readOnly,
-    tools,
-    ...hasS3 ? { s3 } : {}
-  };
-  const pruned = JSON.parse(JSON.stringify(raw));
-  const parsed = MikrotikConfigSchema.parse(pruned);
-  if (!parsed.devices[parsed.defaultDevice]) {
-    parsed.defaultDevice = Object.keys(parsed.devices)[0] ?? "default";
-  }
-  return parsed;
-}
-
-// src/core/runtime.ts
-var active = MikrotikConfigSchema.parse({});
-function setConfig(cfg) {
-  active = cfg;
-}
-function getConfig() {
-  return active;
-}
-function listDevices() {
-  return { names: Object.keys(active.devices), default: active.defaultDevice };
-}
-function deviceKeyForLabel(name) {
-  const target = name.trim().toLowerCase();
-  for (const [key, dc] of Object.entries(active.devices)) {
-    if (dc.description && dc.description.trim().toLowerCase() === target)
-      return key;
-  }
-  return;
-}
-function deviceLabels() {
-  const seen = new Set;
-  const out = [];
-  for (const [key, dc] of Object.entries(active.devices)) {
-    const label = dc.description?.trim();
-    if (label && label !== key && !(label in active.devices) && !seen.has(label)) {
-      seen.add(label);
-      out.push(label);
-    }
-  }
-  return out;
-}
-function resolveDeviceName(name) {
-  if (name) {
-    if (name in active.devices)
-      return name;
-    const byLabel = deviceKeyForLabel(name);
-    if (byLabel)
-      return byLabel;
-  }
-  return active.defaultDevice in active.devices ? active.defaultDevice : Object.keys(active.devices)[0] ?? active.defaultDevice;
-}
-function deviceTarget(dc) {
-  if (!dc)
-    return "?";
-  return dc.mac ? `MAC ${dc.mac}` : `${dc.host}:${dc.port ?? 22}`;
-}
-function deviceDirectory() {
-  return Object.entries(active.devices).map(([key, dc]) => ({
-    key,
-    label: dc.description?.trim() || undefined,
-    target: deviceTarget(dc),
-    isDefault: key === active.defaultDevice
-  }));
-}
-function resolvedTarget(name) {
-  const key = resolveDeviceName(name);
-  const dc = active.devices[key];
-  return { key, label: dc?.description?.trim() || undefined, target: deviceTarget(dc) };
-}
-function getDevice(name) {
-  if (name && !(name in active.devices) && !deviceKeyForLabel(name)) {
-    throw new Error(`Unknown device '${name}'. Configured devices: ${Object.keys(active.devices).join(", ")}`);
-  }
-  const key = resolveDeviceName(name);
-  const dc = active.devices[key];
-  if (!dc)
-    throw new Error(`No device configuration available for '${key}'.`);
-  return dc;
-}
+import { Client } from "ssh2";
 
 // src/logger.ts
 import { stderr } from "process";
@@ -358,600 +40,940 @@ var logger = {
   error: (m) => emit("error", m)
 };
 
-// src/mac-telnet/console.ts
-import { MacTelnetSession } from "@tikoci/centrs/protocols";
-var ESC = "\x1B";
-var enc = new TextEncoder;
-var ANSI_CSI = new RegExp(`${ESC}\\[[0-9;?]*[ -/]*[@-~]`, "g");
-var ANSI_ESC2 = new RegExp(`${ESC}[@-_]`, "g");
-var ROUTEROS_PROMPT_RE = /\[[^\]@\r\n]+@[^\]\r\n]*\][^\r\n]*>\s*$/;
-var TICK_INTERVAL_MS = 15;
-var LICENSE_RE = /do you want to see the software license/i;
-function emulateScreen(text) {
-  const clean = text.replace(ANSI_CSI, "").replace(ANSI_ESC2, "");
-  const lines = [[]];
-  let row = 0;
-  let col = 0;
-  for (const ch of clean) {
-    const code = ch.charCodeAt(0);
-    if (ch === `
-`) {
-      row += 1;
-      if (!lines[row])
-        lines[row] = [];
-      col = 0;
-    } else if (ch === "\r") {
-      col = 0;
-    } else if (code === 8) {
-      col = Math.max(0, col - 1);
-    } else if (code >= 32 && code !== 127) {
-      const line = lines[row];
-      line[col] = ch;
-      col += 1;
-    }
-  }
-  return lines.map((line) => Array.from(line, (c) => c ?? " ").join("").replace(/\s+$/, ""));
-}
-function extractCommandOutput(raw, command) {
-  const lines = emulateScreen(raw);
-  let start = 1;
-  if (command !== undefined && lines.length > 0) {
-    const first = lines[0] ?? "";
-    const promptMatch = first.match(/^\[[^\]\r\n]*\][^\r\n]*?>\s?/);
-    const echoedOnFirst = promptMatch ? first.slice(promptMatch[0].length) : first;
-    let consumed = echoedOnFirst.length;
-    while (consumed < command.length && start < lines.length) {
-      consumed += (lines[start] ?? "").length;
-      start += 1;
-    }
-  }
-  const body = lines.slice(start);
-  while (body.length > 0) {
-    const last = body[body.length - 1];
-    if (last.length === 0 || ROUTEROS_PROMPT_RE.test(last)) {
-      body.pop();
-      continue;
-    }
-    break;
-  }
-  return body.join(`
-`);
-}
-
-class MacTelnetConsole {
-  options;
-  session;
-  buffer = "";
-  ready = false;
-  closed = false;
-  closeError;
-  waiter;
-  tickTimer;
-  readyWaiters = [];
-  decoder = new TextDecoder;
-  probeTail = "";
-  constructor(options) {
-    this.options = {
-      rows: 9999,
-      cols: 512,
-      primeTimeoutMs: 30000,
-      commandTimeoutMs: 15000,
-      settleMs: 150,
-      acceptLicense: true,
-      ...options
-    };
-    const createSession = options.createSession ?? ((init) => new MacTelnetSession(init));
-    this.session = createSession({
-      sink: options.sink,
-      sourceMac: options.sourceMac,
-      destinationMac: options.destinationMac,
-      username: options.username,
-      password: options.password,
-      sessionKey: options.sessionKey,
-      terminalType: "vt102",
-      terminalWidth: this.options.cols,
-      terminalHeight: this.options.rows,
-      onReady: () => this.onReady(),
-      onData: (bytes) => this.onData(bytes),
-      onClose: (error) => this.onClose(error)
-    });
-  }
-  handlePacket(bytes) {
-    try {
-      this.session.handlePacket(bytes);
-    } catch (error) {
-      this.onClose(error instanceof Error ? error : new Error("Failed to process a MAC-Telnet datagram."));
-    }
-  }
-  async open() {
-    this.tickTimer = setInterval(() => {
-      try {
-        this.session.tick(Date.now());
-      } catch {}
-    }, TICK_INTERVAL_MS);
-    this.tickTimer.unref?.();
-    this.session.start();
-    await this.waitReady(this.options.primeTimeoutMs);
-    await this.waitFor((buffer) => this.endsWithPrompt(buffer) || LICENSE_RE.test(buffer), this.options.primeTimeoutMs, "waiting for the RouterOS console prompt");
-    if (this.options.acceptLicense && LICENSE_RE.test(this.buffer)) {
-      this.buffer = "";
-      this.session.sendInput(enc.encode("n\r"));
-      await this.waitFor((buffer) => this.endsWithPrompt(buffer), this.options.primeTimeoutMs, "waiting for the prompt after the license screen");
-    }
-    this.buffer = "";
-    this.session.sendInput(enc.encode("\r"));
-    await this.waitFor((buffer) => this.endsWithPrompt(buffer), this.options.commandTimeoutMs, "waiting for a clean prompt");
-    this.buffer = "";
+// src/ssh/client.ts
+var RUN_IDLE_TIMEOUT_MS = 60000;
+function decodeOutput(data) {
+  if (!data || data.length === 0)
+    return "";
+  const encodings = ["utf-8", "windows-1252", "latin1"];
+  for (const encoding of encodings) {
+    try {
+      return new TextDecoder(encoding, { fatal: true }).decode(data);
+    } catch {}
   }
-  async run(cli) {
-    this.assertOpen();
-    this.buffer = "";
-    this.session.sendInput(enc.encode(`${cli}\r`));
-    await this.waitFor((buffer) => this.endsWithPrompt(buffer), this.options.commandTimeoutMs, `running over mac-telnet: ${cli}`);
-    const raw = this.buffer;
-    return { output: extractCommandOutput(raw, cli), raw };
+  return new TextDecoder("utf-8").decode(data);
+}
+
+class MikroTikSSHClient {
+  client = null;
+  bastions = [];
+  opts;
+  lastError;
+  constructor(opts) {
+    this.opts = { port: 22, timeoutMs: 1e4, ...opts };
   }
-  close() {
-    if (this.tickTimer) {
-      clearInterval(this.tickTimer);
-      this.tickTimer = undefined;
+  async connect() {
+    this.lastError = undefined;
+    try {
+      const hops = [];
+      for (let j = this.opts.jump;j; j = j.jump)
+        hops.unshift(j);
+      const sequence = [...hops, this.opts];
+      let sock;
+      for (let i = 0;i < hops.length; i++) {
+        const hop = hops[i];
+        const client = await this.openClient(hop, sock);
+        this.bastions.push(client);
+        const next = sequence[i + 1];
+        const hopTimeout = hop.timeoutMs ?? this.opts.timeoutMs ?? 1e4;
+        sock = await this.forwardOut(client, next.host, next.port ?? 22, hopTimeout);
+      }
+      this.client = await this.openClient(this.opts, sock);
+      return true;
+    } catch (e) {
+      this.lastError = e instanceof Error ? e.message : String(e);
+      logger.error(`Failed to connect to MikroTik: ${this.lastError}`);
+      this.disconnect();
+      return false;
     }
-    if (!this.closed)
-      this.session.end();
-  }
-  get isReady() {
-    return this.ready && !this.closed;
   }
-  onReady() {
-    this.ready = true;
-    for (const w of this.readyWaiters.splice(0))
-      w.resolve();
+  openClient(o, sock) {
+    return new Promise((resolve, reject) => {
+      const client = new Client;
+      const cfg = {
+        host: o.host,
+        port: o.port ?? 22,
+        username: o.username,
+        readyTimeout: o.timeoutMs ?? 1e4
+      };
+      if (sock)
+        cfg.sock = sock;
+      if (o.keepAliveInterval)
+        cfg.keepaliveInterval = o.keepAliveInterval;
+      if (o.keepAliveCountMax)
+        cfg.keepaliveCountMax = o.keepAliveCountMax;
+      if (o.privateKey) {
+        cfg.privateKey = o.privateKey;
+      } else if (o.keyFilename) {
+        try {
+          cfg.privateKey = readFileSync(o.keyFilename);
+        } catch (e) {
+          reject(new Error(`could not read key file ${o.keyFilename}: ${e instanceof Error ? e.message : String(e)}`));
+          return;
+        }
+      }
+      if (cfg.privateKey && o.keyPassphrase)
+        cfg.passphrase = o.keyPassphrase;
+      if (o.password)
+        cfg.password = o.password;
+      client.on("ready", () => resolve(client)).on("error", (err) => reject(err)).connect(cfg);
+    });
   }
-  onData(bytes) {
-    const chunk = this.decoder.decode(bytes, { stream: true });
-    const combined = `${this.probeTail}${chunk}`;
-    this.answerSizeProbe(combined);
-    this.probeTail = combined.slice(-3);
-    this.buffer += chunk;
-    this.checkWaiter();
+  forwardOut(via, host, port, timeoutMs) {
+    return new Promise((resolve, reject) => {
+      let settled = false;
+      const enableHint = "If the jump router runs RouterOS, enable SSH TCP forwarding on it " + "(`/ip ssh set forwarding-enabled=local`, or `both`) and confirm the bastion can reach the target.";
+      const timer = setTimeout(() => {
+        if (settled)
+          return;
+        settled = true;
+        reject(new Error(`jump host did not open a tunnel to ${host}:${port} within ${Math.round(timeoutMs / 1000)}s. ${enableHint}`));
+      }, timeoutMs);
+      via.forwardOut("127.0.0.1", 0, host, port, (err, stream) => {
+        if (settled)
+          return;
+        settled = true;
+        clearTimeout(timer);
+        if (err) {
+          reject(new Error(`jump host could not open a tunnel to ${host}:${port}: ${err.message}. ${enableHint}`));
+        } else {
+          resolve(stream);
+        }
+      });
+    });
   }
-  onClose(error) {
-    this.closed = true;
-    this.closeError = error;
-    if (this.tickTimer) {
-      clearInterval(this.tickTimer);
-      this.tickTimer = undefined;
-    }
-    const failure = error ?? new Error("The MAC-Telnet console session closed.");
-    for (const w of this.readyWaiters.splice(0))
-      w.reject(failure);
-    if (this.waiter) {
-      const waiter = this.waiter;
-      this.waiter = undefined;
-      clearTimeout(waiter.timeout);
-      if (waiter.settle)
-        clearTimeout(waiter.settle);
-      waiter.reject(failure);
+  run(command, opts = {}) {
+    if (!this.client) {
+      return Promise.reject(new Error("Not connected to MikroTik device"));
     }
+    const openChannel = this.client.exec.bind(this.client);
+    return new Promise((resolve, reject) => {
+      openChannel(command, (err, stream) => {
+        if (err) {
+          reject(err);
+          return;
+        }
+        const stdout = [];
+        const stderrBuf = [];
+        let settled = false;
+        let timer;
+        let idleTimer;
+        const clearTimers = () => {
+          if (timer)
+            clearTimeout(timer);
+          if (idleTimer)
+            clearTimeout(idleTimer);
+        };
+        const finish = () => {
+          if (settled)
+            return;
+          settled = true;
+          clearTimers();
+          const out = decodeOutput(Buffer.concat(stdout));
+          const error = decodeOutput(Buffer.concat(stderrBuf));
+          resolve(error && !out ? error : out);
+        };
+        const fail = (e) => {
+          if (settled)
+            return;
+          settled = true;
+          clearTimers();
+          try {
+            stream.close();
+          } catch {}
+          reject(e);
+        };
+        const armIdle = () => {
+          if (idleTimer)
+            clearTimeout(idleTimer);
+          idleTimer = setTimeout(() => {
+            try {
+              stream.signal("INT");
+            } catch {}
+            fail(new Error(`MikroTik command produced no output for ${RUN_IDLE_TIMEOUT_MS / 1000}s and the SSH ` + "channel never closed \u2014 it appears wedged (often a malformed or unbalanced command). " + `Aborted to avoid hanging the connection. Command: ${command.slice(0, 120)}`));
+          }, RUN_IDLE_TIMEOUT_MS);
+        };
+        armIdle();
+        if (opts.maxMs && opts.maxMs > 0) {
+          timer = setTimeout(() => {
+            try {
+              stream.signal("INT");
+            } catch {}
+            try {
+              stream.close();
+            } catch {}
+            finish();
+          }, opts.maxMs);
+        }
+        stream.on("close", finish).on("data", (d) => {
+          stdout.push(d);
+          armIdle();
+        }).stderr.on("data", (d) => {
+          stderrBuf.push(d);
+          armIdle();
+        });
+      });
+    });
   }
-  answerSizeProbe(chunk) {
-    if (chunk.includes(`${ESC}[6n`)) {
-      this.session.sendInput(enc.encode(`${ESC}[${this.options.rows};${this.options.cols}R`));
-    }
-    if (chunk.includes(`${ESC}Z`) || chunk.includes(`${ESC}[c`)) {
-      this.session.sendInput(enc.encode(`${ESC}[?6c`));
+  uploadFile(remotePath, data) {
+    if (!this.client) {
+      return Promise.reject(new Error("Not connected to MikroTik device"));
     }
+    const openSftp = this.client.sftp.bind(this.client);
+    return new Promise((resolve, reject) => {
+      openSftp((err, sftp) => {
+        if (err) {
+          reject(new Error(`SFTP subsystem unavailable: ${err.message}`));
+          return;
+        }
+        sftp.writeFile(remotePath, data, (werr) => {
+          try {
+            sftp.end();
+          } catch {}
+          if (werr)
+            reject(new Error(`SFTP write failed: ${werr.message}`));
+          else
+            resolve();
+        });
+      });
+    });
   }
-  endsWithPrompt(buffer) {
-    const lines = emulateScreen(buffer).filter((line) => line.length > 0);
-    return ROUTEROS_PROMPT_RE.test(lines[lines.length - 1] ?? "");
-  }
-  waitReady(timeoutMs) {
-    if (this.ready)
-      return Promise.resolve();
-    if (this.closed) {
-      return Promise.reject(this.closeError ?? new Error("The MAC-Telnet session closed before login completed."));
+  downloadFile(remotePath) {
+    if (!this.client) {
+      return Promise.reject(new Error("Not connected to MikroTik device"));
     }
-    return new Promise((resolve2, reject) => {
-      let timer;
-      const entry = {
-        resolve: () => {
-          clearTimeout(timer);
-          resolve2();
-        },
-        reject: (error) => {
-          clearTimeout(timer);
-          reject(error);
-        }
-      };
-      timer = setTimeout(() => {
-        this.readyWaiters = this.readyWaiters.filter((w) => w !== entry);
-        reject(new Error("MAC-Telnet login did not complete \u2014 no console response from the device. " + "Confirm the device is reachable over mac-telnet (mac-server interface list) and the credentials are correct."));
-      }, timeoutMs);
-      this.readyWaiters.push(entry);
+    const openSftp = this.client.sftp.bind(this.client);
+    return new Promise((resolve, reject) => {
+      openSftp((err, sftp) => {
+        if (err) {
+          reject(new Error(`SFTP subsystem unavailable: ${err.message}`));
+          return;
+        }
+        sftp.readFile(remotePath, (rerr, data) => {
+          try {
+            sftp.end();
+          } catch {}
+          if (rerr)
+            reject(new Error(`SFTP read failed: ${rerr.message}`));
+          else
+            resolve(data);
+        });
+      });
     });
   }
-  waitFor(predicate, timeoutMs, label) {
-    if (this.closed) {
-      return Promise.reject(this.closeError ?? new Error(`MAC-Telnet session closed while ${label}.`));
+  shell(opts = {}) {
+    if (!this.client) {
+      return Promise.reject(new Error("Not connected to MikroTik device"));
     }
-    return new Promise((resolve2, reject) => {
-      const timeout = setTimeout(() => {
-        this.waiter = undefined;
-        reject(new Error(`Timed out ${label}. The RouterOS console did not return a prompt in time; ` + "raise the timeout or confirm the device is responsive over mac-telnet."));
-      }, timeoutMs);
-      this.waiter = { predicate, resolve: resolve2, reject, timeout };
-      this.checkWaiter();
+    const openShell = this.client.shell.bind(this.client);
+    return new Promise((resolve, reject) => {
+      openShell({
+        term: opts.term ?? "dumb",
+        cols: opts.cols ?? 220,
+        rows: opts.rows ?? 50
+      }, (err, stream) => err ? reject(err) : resolve(stream));
     });
   }
-  checkWaiter() {
-    const waiter = this.waiter;
-    if (!waiter)
-      return;
-    if (!waiter.predicate(this.buffer)) {
-      if (waiter.settle) {
-        clearTimeout(waiter.settle);
-        waiter.settle = undefined;
-      }
-      return;
+  disconnect() {
+    if (this.client) {
+      try {
+        this.client.end();
+      } catch {}
+      this.client = null;
     }
-    if (waiter.settle)
-      clearTimeout(waiter.settle);
-    waiter.settle = setTimeout(() => {
-      if (this.waiter !== waiter)
-        return;
-      this.waiter = undefined;
-      clearTimeout(waiter.timeout);
-      waiter.resolve();
-    }, this.options.settleMs);
+    for (const b of this.bastions.reverse()) {
+      try {
+        b.end();
+      } catch {}
+    }
+    this.bastions = [];
   }
-  assertOpen() {
-    if (!this.ready || this.closed) {
-      throw new Error("The MAC-Telnet console is not open. Call open() and await it before running commands.");
+}
+
+// src/config.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { homedir } from "os";
+import { join, resolve } from "path";
+import { z } from "zod";
+var DEFAULT_DASHBOARD_DB = join(homedir(), ".mikrotik-mcp", "events.db");
+var DEFAULT_SNAPSHOT_DB = join(homedir(), ".mikrotik-mcp", "snapshots.db");
+var DEFAULT_BACKUP_DIR = join(homedir(), ".mikrotik-mcp", "backups");
+var DEFAULT_CONFIG_HISTORY_DIR = join(homedir(), ".mikrotik-mcp", "config-history");
+var DEFAULT_CONFIG_FILE = join(homedir(), ".mikrotik-mcp", "config.json");
+var TransportSchema = z.enum(["stdio", "sse", "streamable-http"]);
+var McpServerSettingsSchema = z.object({
+  transport: TransportSchema.default("stdio"),
+  host: z.string().default("0.0.0.0"),
+  port: z.coerce.number().int().positive().default(8000),
+  allowedHosts: z.string().default(""),
+  allowedOrigins: z.string().default(""),
+  corsOrigins: z.string().default(""),
+  toolPageSize: z.coerce.number().int().min(0).default(0),
+  appViews: z.boolean().default(true)
+});
+var JumpHostSchema = z.object({
+  host: z.string(),
+  port: z.coerce.number().int().positive().default(22),
+  username: z.string().default("admin"),
+  password: z.string().optional(),
+  keyFilename: z.string().optional(),
+  privateKey: z.string().optional(),
+  keyPassphrase: z.string().optional(),
+  timeoutMs: z.coerce.number().int().positive().optional()
+});
+var DeviceConfigSchema = z.object({
+  host: z.string().default("127.0.0.1"),
+  username: z.string().default("admin"),
+  password: z.string().default(""),
+  port: z.coerce.number().int().positive().default(22),
+  keyFilename: z.string().optional(),
+  privateKey: z.string().optional(),
+  keyPassphrase: z.string().optional(),
+  timeoutMs: z.coerce.number().int().positive().default(1e4),
+  jumpVia: z.string().optional(),
+  jumpHost: JumpHostSchema.optional(),
+  mac: z.string().optional(),
+  sourceMac: z.string().optional(),
+  macHost: z.string().optional(),
+  macPort: z.coerce.number().int().positive().optional(),
+  description: z.string().optional()
+});
+var S3ConfigSchema = z.object({
+  accessKeyId: z.string().optional(),
+  secretAccessKey: z.string().optional(),
+  sessionToken: z.string().optional(),
+  region: z.string().optional(),
+  endpoint: z.string().optional(),
+  bucket: z.string().optional(),
+  prefix: z.string().default(""),
+  presignExpiresIn: z.coerce.number().int().positive().default(3600)
+});
+var DashboardConfigSchema = z.object({
+  enabled: z.boolean().default(false),
+  host: z.string().default("0.0.0.0"),
+  port: z.coerce.number().int().positive().default(9090),
+  dbPath: z.string().default(DEFAULT_DASHBOARD_DB),
+  maxEvents: z.coerce.number().int().positive().default(1e5),
+  captureBody: z.boolean().default(true),
+  redactInput: z.boolean().default(false),
+  maxBodyBytes: z.coerce.number().int().nonnegative().default(16384),
+  token: z.string().optional()
+});
+var SSHConfigSchema = z.object({
+  keepAlive: z.boolean().default(true),
+  keepAliveInterval: z.coerce.number().int().nonnegative().default(1e4),
+  idleTimeout: z.coerce.number().int().positive().default(30000)
+});
+var ToolFilterSchema = z.object({
+  enabledModules: z.array(z.string()).default([]),
+  disabledModules: z.array(z.string()).default([]),
+  enabledGroups: z.array(z.string()).default([]),
+  disabledGroups: z.array(z.string()).default([])
+});
+var MikrotikConfigSchema = z.object({
+  devices: z.record(z.string(), DeviceConfigSchema).default(() => ({ default: DeviceConfigSchema.parse({}) })),
+  defaultDevice: z.string().default("default"),
+  mcp: McpServerSettingsSchema.default(() => McpServerSettingsSchema.parse({})),
+  s3: S3ConfigSchema.optional(),
+  dashboard: DashboardConfigSchema.default(() => DashboardConfigSchema.parse({})),
+  ssh: SSHConfigSchema.default(() => SSHConfigSchema.parse({})),
+  readOnly: z.boolean().default(false),
+  tools: ToolFilterSchema.default(() => ToolFilterSchema.parse({})),
+  backupDir: z.string().optional()
+});
+function env(...names) {
+  for (const n of names) {
+    const v = process.env[n];
+    if (v !== undefined && v !== "")
+      return v;
+  }
+  return;
+}
+function parseFlags(argv) {
+  const out = {};
+  for (let i = 0;i < argv.length; i++) {
+    const arg = argv[i];
+    if (!arg.startsWith("--"))
+      continue;
+    const eq = arg.indexOf("=");
+    if (eq !== -1) {
+      out[arg.slice(2, eq)] = arg.slice(eq + 1);
+    } else {
+      const key = arg.slice(2);
+      const next = argv[i + 1];
+      if (next !== undefined && !next.startsWith("--")) {
+        out[key] = next;
+        i++;
+      } else {
+        out[key] = "true";
+      }
     }
   }
+  return out;
+}
+function parseDevicesSource(raw, fromFile) {
+  let json;
+  try {
+    json = JSON.parse(fromFile ? readFileSync2(raw, "utf8") : raw);
+  } catch (e) {
+    throw new Error(`Failed to load MikroTik devices from ${fromFile ? `file ${raw}` : "MIKROTIK_DEVICES"}: ${e instanceof Error ? e.message : String(e)}`);
+  }
+  const obj = json;
+  const structured = obj.devices !== undefined;
+  const devices = obj.devices ?? obj;
+  const defaultDevice = typeof obj.defaultDevice === "string" ? obj.defaultDevice : undefined;
+  const s3 = structured && obj.s3 && typeof obj.s3 === "object" ? obj.s3 : undefined;
+  const dashboard = structured && obj.dashboard && typeof obj.dashboard === "object" ? obj.dashboard : undefined;
+  const tools = structured && obj.tools && typeof obj.tools === "object" ? obj.tools : undefined;
+  const mcp = structured && obj.mcp && typeof obj.mcp === "object" ? obj.mcp : undefined;
+  const ssh = structured && obj.ssh && typeof obj.ssh === "object" ? obj.ssh : undefined;
+  return { devices, defaultDevice, s3, dashboard, tools, mcp, ssh };
+}
+var configSource = { path: DEFAULT_CONFIG_FILE, fromFile: false };
+function loadConfig(argv = process.argv.slice(2)) {
+  const flags = parseFlags(argv);
+  const pick = (flag, ...envNames) => flags[flag] ?? env(...envNames);
+  const jumpHostName = pick("jump-host", "MIKROTIK_JUMP_HOST");
+  const jumpHost = jumpHostName ? {
+    host: jumpHostName,
+    port: pick("jump-port", "MIKROTIK_JUMP_PORT"),
+    username: pick("jump-username", "MIKROTIK_JUMP_USERNAME"),
+    password: pick("jump-password", "MIKROTIK_JUMP_PASSWORD"),
+    keyFilename: pick("jump-key-filename", "MIKROTIK_JUMP_KEY_FILENAME"),
+    keyPassphrase: pick("jump-key-passphrase", "MIKROTIK_JUMP_KEY_PASSPHRASE")
+  } : undefined;
+  const single = {
+    host: pick("host", "MIKROTIK_HOST"),
+    username: pick("username", "MIKROTIK_USERNAME"),
+    password: pick("password", "MIKROTIK_PASSWORD"),
+    port: pick("port", "MIKROTIK_PORT"),
+    keyFilename: pick("key-filename", "MIKROTIK_KEY_FILENAME"),
+    privateKey: pick("private-key", "MIKROTIK_PRIVATE_KEY"),
+    keyPassphrase: pick("key-passphrase", "MIKROTIK_KEY_PASSPHRASE"),
+    timeoutMs: pick("timeout-ms", "MIKROTIK_TIMEOUT_MS"),
+    jumpHost,
+    mac: pick("mac", "MIKROTIK_MAC"),
+    sourceMac: pick("source-mac", "MIKROTIK_SOURCE_MAC"),
+    macHost: pick("mac-host", "MIKROTIK_MAC_HOST"),
+    macPort: pick("mac-port", "MIKROTIK_MAC_PORT")
+  };
+  const hasSingle = Object.values(single).some((v) => v !== undefined);
+  const devices = {};
+  let defaultDevice;
+  if (hasSingle) {
+    devices.default = single;
+    defaultDevice = "default";
+  }
+  const configFile = pick("config", "MIKROTIK_CONFIG_FILE");
+  configSource = configFile ? { path: resolve(configFile), fromFile: true } : { path: DEFAULT_CONFIG_FILE, fromFile: false };
+  const devicesInline = flags.devices ?? env("MIKROTIK_DEVICES");
+  let fileS3 = {};
+  let fileDashboard = {};
+  let fileTools;
+  let fileMcp;
+  let fileSsh;
+  if (configFile || devicesInline) {
+    const src = configFile ? parseDevicesSource(configFile, true) : parseDevicesSource(devicesInline, false);
+    for (const [name, dc] of Object.entries(src.devices))
+      devices[name] = dc;
+    if (src.defaultDevice)
+      defaultDevice = src.defaultDevice;
+    else if (!defaultDevice)
+      defaultDevice = Object.keys(src.devices)[0];
+    fileS3 = src.s3;
+    fileDashboard = src.dashboard;
+    fileTools = src.tools;
+    fileMcp = src.mcp;
+    fileSsh = src.ssh;
+  }
+  const s3 = {
+    accessKeyId: pick("s3-access-key-id", "S3_ACCESS_KEY_ID", "AWS_ACCESS_KEY_ID"),
+    secretAccessKey: pick("s3-secret-access-key", "S3_SECRET_ACCESS_KEY", "AWS_SECRET_ACCESS_KEY"),
+    sessionToken: pick("s3-session-token", "S3_SESSION_TOKEN", "AWS_SESSION_TOKEN"),
+    region: pick("s3-region", "S3_REGION", "AWS_REGION"),
+    endpoint: pick("s3-endpoint", "S3_ENDPOINT", "AWS_ENDPOINT"),
+    bucket: pick("s3-bucket", "S3_BUCKET", "AWS_BUCKET"),
+    prefix: pick("s3-prefix", "MIKROTIK_S3_PREFIX"),
+    presignExpiresIn: pick("s3-presign-expires-in", "MIKROTIK_S3_PRESIGN_EXPIRES_IN"),
+    ...fileS3
+  };
+  const appViewsRaw = pick("app-views", "MIKROTIK_MCP__APP_VIEWS");
+  const appViewsEnv = appViewsRaw === undefined ? undefined : !/^(0|false|no|off)$/i.test(appViewsRaw);
+  const mcp = {
+    transport: pick("transport", "MIKROTIK_MCP__TRANSPORT", "MCP_TRANSPORT"),
+    host: pick("mcp-host", "MIKROTIK_MCP__HOST"),
+    port: pick("mcp-port", "MIKROTIK_MCP__PORT"),
+    allowedHosts: pick("mcp-allowed-hosts", "MIKROTIK_MCP__ALLOWED_HOSTS"),
+    allowedOrigins: pick("mcp-allowed-origins", "MIKROTIK_MCP__ALLOWED_ORIGINS"),
+    corsOrigins: pick("mcp-cors-origins", "MIKROTIK_MCP__CORS_ORIGINS"),
+    toolPageSize: pick("tool-page-size", "MIKROTIK_MCP__TOOL_PAGE_SIZE"),
+    appViews: appViewsEnv,
+    ...fileMcp
+  };
+  const isTruthy = (v) => /^(1|true|yes|on)$/i.test(v ?? "");
+  const readOnly = isTruthy(pick("read-only", "MIKROTIK_READ_ONLY"));
+  const csv = (v) => v === undefined ? undefined : v.split(",").map((s) => s.trim()).filter(Boolean);
+  const tools = {
+    enabledModules: csv(pick("tools-enabled-modules", "MIKROTIK_TOOLS__ENABLED_MODULES")),
+    disabledModules: csv(pick("tools-disabled-modules", "MIKROTIK_TOOLS__DISABLED_MODULES")),
+    enabledGroups: csv(pick("tools-enabled-groups", "MIKROTIK_TOOLS__ENABLED_GROUPS")),
+    disabledGroups: csv(pick("tools-disabled-groups", "MIKROTIK_TOOLS__DISABLED_GROUPS")),
+    ...fileTools
+  };
+  const boolOpt = (v) => v === undefined ? undefined : isTruthy(v);
+  const dashboard = {
+    enabled: boolOpt(pick("dashboard", "MIKROTIK_DASHBOARD__ENABLED", "MIKROTIK_DASHBOARD")),
+    host: pick("dashboard-host", "MIKROTIK_DASHBOARD__HOST"),
+    port: pick("dashboard-port", "MIKROTIK_DASHBOARD__PORT"),
+    dbPath: pick("dashboard-db", "MIKROTIK_DASHBOARD__DB_PATH"),
+    maxEvents: pick("dashboard-max-events", "MIKROTIK_DASHBOARD__MAX_EVENTS"),
+    captureBody: boolOpt(pick("dashboard-capture-body", "MIKROTIK_DASHBOARD__CAPTURE_BODY")),
+    redactInput: boolOpt(pick("dashboard-redact-input", "MIKROTIK_DASHBOARD__REDACT_INPUT")),
+    maxBodyBytes: pick("dashboard-max-body-bytes", "MIKROTIK_DASHBOARD__MAX_BODY_BYTES"),
+    token: pick("dashboard-token", "MIKROTIK_DASHBOARD__TOKEN"),
+    ...fileDashboard
+  };
+  const ssh = {
+    keepAlive: boolOpt(pick("ssh-keep-alive", "MIKROTIK_SSH__KEEP_ALIVE")),
+    keepAliveInterval: pick("ssh-keepalive-interval", "MIKROTIK_SSH__KEEPALIVE_INTERVAL"),
+    idleTimeout: pick("ssh-idle-timeout", "MIKROTIK_SSH__IDLE_TIMEOUT"),
+    ...fileSsh
+  };
+  const hasS3 = !!(s3.accessKeyId || s3.bucket || s3.endpoint);
+  const raw = {
+    devices: Object.keys(devices).length ? devices : { default: {} },
+    defaultDevice: defaultDevice ?? "default",
+    mcp,
+    dashboard,
+    readOnly,
+    tools,
+    ssh,
+    ...hasS3 ? { s3 } : {}
+  };
+  const pruned = JSON.parse(JSON.stringify(raw));
+  const parsed = MikrotikConfigSchema.parse(pruned);
+  if (!parsed.devices[parsed.defaultDevice]) {
+    parsed.defaultDevice = Object.keys(parsed.devices)[0] ?? "default";
+  }
+  return parsed;
 }
 
-// src/mac-telnet/client.ts
-import {
-  DEFAULT_MAC_TELNET_BROADCAST,
-  isBroadcastHost,
-  MAC_TELNET_PORT,
-  createUdpMacTelnetTransport,
-  formatMac,
-  listBroadcastInterfaces,
-  parseMac,
-  resolveMacTelnetRoute
-} from "@tikoci/centrs/protocols";
-
-class MikroTikMacTelnetClient {
-  transport = null;
-  console = null;
-  opts;
-  lastError;
-  routeHint;
-  constructor(opts) {
-    this.opts = {
-      port: MAC_TELNET_PORT,
-      timeoutMs: 1e4,
-      ...opts
-    };
+// src/core/runtime.ts
+var active = MikrotikConfigSchema.parse({});
+function setConfig(cfg) {
+  active = cfg;
+}
+function getConfig() {
+  return active;
+}
+function listDevices() {
+  return { names: Object.keys(active.devices), default: active.defaultDevice };
+}
+function deviceKeyForLabel(name) {
+  const target = name.trim().toLowerCase();
+  for (const [key, dc] of Object.entries(active.devices)) {
+    if (dc.description && dc.description.trim().toLowerCase() === target)
+      return key;
   }
-  async connect() {
-    this.lastError = undefined;
-    try {
-      const destinationMac = parseMac(this.opts.mac);
-      const explicitSourceMac = this.opts.sourceMac ? parseMac(this.opts.sourceMac) : undefined;
-      const host = this.opts.host ?? DEFAULT_MAC_TELNET_BROADCAST;
-      const askedDiscovery = host === DEFAULT_MAC_TELNET_BROADCAST && !explicitSourceMac;
-      const candidates = askedDiscovery ? listBroadcastInterfaces() : [];
-      const candidatesText = candidates.length ? candidates.map((i) => `${i.name}(${formatMac(i.mac)}\u2192${i.broadcast})`).join(", ") : "NONE \u2014 no usable non-internal IPv4 interface found (is this host on the device's LAN?)";
-      if (askedDiscovery)
-        logger.info(`[mac-telnet] discovery candidates: ${candidatesText}`);
-      logger.info(`[mac-telnet] resolving route to ${this.opts.mac}\u2026`);
-      const route = await resolveMacTelnetRoute({
-        destinationMac,
-        host,
-        port: this.opts.port,
-        timeoutMs: this.opts.timeoutMs,
-        explicitSourceMac
-      });
-      const discoveryFailed = askedDiscovery && route.host === DEFAULT_MAC_TELNET_BROADCAST;
-      this.routeHint = discoveryFailed ? "no local interface got a reply from the device during discovery \u2014 MAC-Telnet is Layer-2 " + "only, so the machine running this MCP server MUST be on the SAME Ethernet/Wi-Fi segment as " + "the device (it cannot cross any router or the internet). Likely: this host is not on that " + "segment, mac-server is disabled on the device's facing interface (`/tool mac-server`), or a " + "host firewall is dropping the UDP 20561 reply. " + `Interfaces tried: ${candidatesText}. ` + "To pin it, set the device's `macHost` to the LAN's directed broadcast (e.g. 192.168.88.255) " + "and `sourceMac` to the real MAC of the interface on that LAN." : undefined;
-      logger.info(`[mac-telnet] route: source ${formatMac(route.sourceMac)} \u2192 ${route.host} ` + `(${explicitSourceMac ? "explicit" : discoveryFailed ? "DISCOVERY FAILED \u2014 limited broadcast" : "discovered"})`);
-      const transport = createUdpMacTelnetTransport({
-        host: route.host,
-        port: this.opts.port,
-        broadcast: isBroadcastHost(route.host)
-      });
-      this.transport = transport;
-      await transport.ready();
-      logger.info(`[mac-telnet] socket ready; starting login (this can take ~10\u201330s)\u2026`);
-      const console = new MacTelnetConsole({
-        sink: transport,
-        sourceMac: route.sourceMac,
-        destinationMac,
-        username: this.opts.username,
-        password: this.opts.password ?? "",
-        primeTimeoutMs: Math.max(this.opts.timeoutMs, 30000),
-        commandTimeoutMs: Math.max(this.opts.timeoutMs, 15000)
-      });
-      this.console = console;
-      transport.onMessage((bytes) => console.handlePacket(bytes));
-      await console.open();
-      return true;
-    } catch (e) {
-      const base = e instanceof Error ? e.message : String(e);
-      this.lastError = this.routeHint ? `${base} (${this.routeHint})` : base;
-      logger.error(`Failed to connect to MikroTik over MAC-Telnet: ${this.lastError}`);
-      this.disconnect();
-      return false;
+  return;
+}
+function deviceLabels() {
+  const seen = new Set;
+  const out = [];
+  for (const [key, dc] of Object.entries(active.devices)) {
+    const label = dc.description?.trim();
+    if (label && label !== key && !(label in active.devices) && !seen.has(label)) {
+      seen.add(label);
+      out.push(label);
     }
   }
-  async run(command, _opts = {}) {
-    if (!this.console || !this.console.isReady) {
-      throw new Error("Not connected to MikroTik device (MAC-Telnet)");
-    }
-    const { output } = await this.console.run(command);
-    return output;
+  return out;
+}
+function resolveDeviceName(name) {
+  if (name) {
+    if (name in active.devices)
+      return name;
+    const byLabel = deviceKeyForLabel(name);
+    if (byLabel)
+      return byLabel;
   }
-  disconnect() {
-    try {
-      this.console?.close();
-    } catch {}
-    try {
-      this.transport?.close();
-    } catch {}
-    this.console = null;
-    this.transport = null;
+  return active.defaultDevice in active.devices ? active.defaultDevice : Object.keys(active.devices)[0] ?? active.defaultDevice;
+}
+function deviceTarget(dc) {
+  if (!dc)
+    return "?";
+  return dc.mac ? `MAC ${dc.mac}` : `${dc.host}:${dc.port ?? 22}`;
+}
+function deviceDirectory() {
+  return Object.entries(active.devices).map(([key, dc]) => ({
+    key,
+    label: dc.description?.trim() || undefined,
+    target: deviceTarget(dc),
+    isDefault: key === active.defaultDevice
+  }));
+}
+function resolvedTarget(name) {
+  const key = resolveDeviceName(name);
+  const dc = active.devices[key];
+  return { key, label: dc?.description?.trim() || undefined, target: deviceTarget(dc) };
+}
+function getDevice(name) {
+  if (name && !(name in active.devices) && !deviceKeyForLabel(name)) {
+    throw new Error(`Unknown device '${name}'. Configured devices: ${Object.keys(active.devices).join(", ")}`);
   }
+  const key = resolveDeviceName(name);
+  const dc = active.devices[key];
+  if (!dc)
+    throw new Error(`No device configuration available for '${key}'.`);
+  return dc;
 }
 
-// src/ssh/client.ts
-import { readFileSync as readFileSync2 } from "fs";
-import { Client } from "ssh2";
-var RUN_IDLE_TIMEOUT_MS = 60000;
-function decodeOutput(data) {
-  if (!data || data.length === 0)
-    return "";
-  const encodings = ["utf-8", "windows-1252", "latin1"];
-  for (const encoding of encodings) {
-    try {
-      return new TextDecoder(encoding, { fatal: true }).decode(data);
-    } catch {}
+// src/mac-telnet/console.ts
+import { MacTelnetSession } from "@tikoci/centrs/protocols";
+var ESC = "\x1B";
+var enc = new TextEncoder;
+var ANSI_CSI = new RegExp(`${ESC}\\[[0-9;?]*[ -/]*[@-~]`, "g");
+var ANSI_ESC2 = new RegExp(`${ESC}[@-_]`, "g");
+var ROUTEROS_PROMPT_RE = /\[[^\]@\r\n]+@[^\]\r\n]*\][^\r\n]*>\s*$/;
+var TICK_INTERVAL_MS = 15;
+var LICENSE_RE = /do you want to see the software license/i;
+function emulateScreen(text) {
+  const clean = text.replace(ANSI_CSI, "").replace(ANSI_ESC2, "");
+  const lines = [[]];
+  let row = 0;
+  let col = 0;
+  for (const ch of clean) {
+    const code = ch.charCodeAt(0);
+    if (ch === `
+`) {
+      row += 1;
+      if (!lines[row])
+        lines[row] = [];
+      col = 0;
+    } else if (ch === "\r") {
+      col = 0;
+    } else if (code === 8) {
+      col = Math.max(0, col - 1);
+    } else if (code >= 32 && code !== 127) {
+      const line = lines[row];
+      line[col] = ch;
+      col += 1;
+    }
+  }
+  return lines.map((line) => Array.from(line, (c) => c ?? " ").join("").replace(/\s+$/, ""));
+}
+function extractCommandOutput(raw, command) {
+  const lines = emulateScreen(raw);
+  let start = 1;
+  if (command !== undefined && lines.length > 0) {
+    const first = lines[0] ?? "";
+    const promptMatch = first.match(/^\[[^\]\r\n]*\][^\r\n]*?>\s?/);
+    const echoedOnFirst = promptMatch ? first.slice(promptMatch[0].length) : first;
+    let consumed = echoedOnFirst.length;
+    while (consumed < command.length && start < lines.length) {
+      consumed += (lines[start] ?? "").length;
+      start += 1;
+    }
   }
-  return new TextDecoder("utf-8").decode(data);
+  const body = lines.slice(start);
+  while (body.length > 0) {
+    const last = body[body.length - 1];
+    if (last.length === 0 || ROUTEROS_PROMPT_RE.test(last)) {
+      body.pop();
+      continue;
+    }
+    break;
+  }
+  return body.join(`
+`);
 }
 
-class MikroTikSSHClient {
-  client = null;
-  bastions = [];
-  opts;
-  lastError;
-  constructor(opts) {
-    this.opts = { port: 22, timeoutMs: 1e4, ...opts };
+class MacTelnetConsole {
+  options;
+  session;
+  buffer = "";
+  ready = false;
+  closed = false;
+  closeError;
+  waiter;
+  tickTimer;
+  readyWaiters = [];
+  decoder = new TextDecoder;
+  probeTail = "";
+  constructor(options) {
+    this.options = {
+      rows: 9999,
+      cols: 512,
+      primeTimeoutMs: 30000,
+      commandTimeoutMs: 15000,
+      settleMs: 150,
+      acceptLicense: true,
+      ...options
+    };
+    const createSession = options.createSession ?? ((init) => new MacTelnetSession(init));
+    this.session = createSession({
+      sink: options.sink,
+      sourceMac: options.sourceMac,
+      destinationMac: options.destinationMac,
+      username: options.username,
+      password: options.password,
+      sessionKey: options.sessionKey,
+      terminalType: "vt102",
+      terminalWidth: this.options.cols,
+      terminalHeight: this.options.rows,
+      onReady: () => this.onReady(),
+      onData: (bytes) => this.onData(bytes),
+      onClose: (error) => this.onClose(error)
+    });
   }
-  async connect() {
-    this.lastError = undefined;
+  handlePacket(bytes) {
     try {
-      const hops = [];
-      for (let j = this.opts.jump;j; j = j.jump)
-        hops.unshift(j);
-      const sequence = [...hops, this.opts];
-      let sock;
-      for (let i = 0;i < hops.length; i++) {
-        const hop = hops[i];
-        const client = await this.openClient(hop, sock);
-        this.bastions.push(client);
-        const next = sequence[i + 1];
-        const hopTimeout = hop.timeoutMs ?? this.opts.timeoutMs ?? 1e4;
-        sock = await this.forwardOut(client, next.host, next.port ?? 22, hopTimeout);
-      }
-      this.client = await this.openClient(this.opts, sock);
-      return true;
-    } catch (e) {
-      this.lastError = e instanceof Error ? e.message : String(e);
-      logger.error(`Failed to connect to MikroTik: ${this.lastError}`);
-      this.disconnect();
-      return false;
+      this.session.handlePacket(bytes);
+    } catch (error) {
+      this.onClose(error instanceof Error ? error : new Error("Failed to process a MAC-Telnet datagram."));
     }
   }
-  openClient(o, sock) {
-    return new Promise((resolve2, reject) => {
-      const client = new Client;
-      const cfg = {
-        host: o.host,
-        port: o.port ?? 22,
-        username: o.username,
-        readyTimeout: o.timeoutMs ?? 1e4
-      };
-      if (sock)
-        cfg.sock = sock;
-      if (o.privateKey) {
-        cfg.privateKey = o.privateKey;
-      } else if (o.keyFilename) {
-        try {
-          cfg.privateKey = readFileSync2(o.keyFilename);
-        } catch (e) {
-          reject(new Error(`could not read key file ${o.keyFilename}: ${e instanceof Error ? e.message : String(e)}`));
-          return;
-        }
-      }
-      if (cfg.privateKey && o.keyPassphrase)
-        cfg.passphrase = o.keyPassphrase;
-      if (o.password)
-        cfg.password = o.password;
-      client.on("ready", () => resolve2(client)).on("error", (err) => reject(err)).connect(cfg);
-    });
+  async open() {
+    this.tickTimer = setInterval(() => {
+      try {
+        this.session.tick(Date.now());
+      } catch {}
+    }, TICK_INTERVAL_MS);
+    this.tickTimer.unref?.();
+    this.session.start();
+    await this.waitReady(this.options.primeTimeoutMs);
+    await this.waitFor((buffer) => this.endsWithPrompt(buffer) || LICENSE_RE.test(buffer), this.options.primeTimeoutMs, "waiting for the RouterOS console prompt");
+    if (this.options.acceptLicense && LICENSE_RE.test(this.buffer)) {
+      this.buffer = "";
+      this.session.sendInput(enc.encode("n\r"));
+      await this.waitFor((buffer) => this.endsWithPrompt(buffer), this.options.primeTimeoutMs, "waiting for the prompt after the license screen");
+    }
+    this.buffer = "";
+    this.session.sendInput(enc.encode("\r"));
+    await this.waitFor((buffer) => this.endsWithPrompt(buffer), this.options.commandTimeoutMs, "waiting for a clean prompt");
+    this.buffer = "";
   }
-  forwardOut(via, host, port, timeoutMs) {
-    return new Promise((resolve2, reject) => {
-      let settled = false;
-      const enableHint = "If the jump router runs RouterOS, enable SSH TCP forwarding on it " + "(`/ip ssh set forwarding-enabled=local`, or `both`) and confirm the bastion can reach the target.";
-      const timer = setTimeout(() => {
-        if (settled)
-          return;
-        settled = true;
-        reject(new Error(`jump host did not open a tunnel to ${host}:${port} within ${Math.round(timeoutMs / 1000)}s. ${enableHint}`));
-      }, timeoutMs);
-      via.forwardOut("127.0.0.1", 0, host, port, (err, stream) => {
-        if (settled)
-          return;
-        settled = true;
-        clearTimeout(timer);
-        if (err) {
-          reject(new Error(`jump host could not open a tunnel to ${host}:${port}: ${err.message}. ${enableHint}`));
-        } else {
-          resolve2(stream);
-        }
-      });
-    });
+  async run(cli) {
+    this.assertOpen();
+    this.buffer = "";
+    this.session.sendInput(enc.encode(`${cli}\r`));
+    await this.waitFor((buffer) => this.endsWithPrompt(buffer), this.options.commandTimeoutMs, `running over mac-telnet: ${cli}`);
+    const raw = this.buffer;
+    return { output: extractCommandOutput(raw, cli), raw };
   }
-  run(command, opts = {}) {
-    if (!this.client) {
-      return Promise.reject(new Error("Not connected to MikroTik device"));
+  close() {
+    if (this.tickTimer) {
+      clearInterval(this.tickTimer);
+      this.tickTimer = undefined;
+    }
+    if (!this.closed)
+      this.session.end();
+  }
+  get isReady() {
+    return this.ready && !this.closed;
+  }
+  onReady() {
+    this.ready = true;
+    for (const w of this.readyWaiters.splice(0))
+      w.resolve();
+  }
+  onData(bytes) {
+    const chunk = this.decoder.decode(bytes, { stream: true });
+    const combined = `${this.probeTail}${chunk}`;
+    this.answerSizeProbe(combined);
+    this.probeTail = combined.slice(-3);
+    this.buffer += chunk;
+    this.checkWaiter();
+  }
+  onClose(error) {
+    this.closed = true;
+    this.closeError = error;
+    if (this.tickTimer) {
+      clearInterval(this.tickTimer);
+      this.tickTimer = undefined;
+    }
+    const failure = error ?? new Error("The MAC-Telnet console session closed.");
+    for (const w of this.readyWaiters.splice(0))
+      w.reject(failure);
+    if (this.waiter) {
+      const waiter = this.waiter;
+      this.waiter = undefined;
+      clearTimeout(waiter.timeout);
+      if (waiter.settle)
+        clearTimeout(waiter.settle);
+      waiter.reject(failure);
     }
-    const openChannel = this.client.exec.bind(this.client);
-    return new Promise((resolve2, reject) => {
-      openChannel(command, (err, stream) => {
-        if (err) {
-          reject(err);
-          return;
-        }
-        const stdout = [];
-        const stderrBuf = [];
-        let settled = false;
-        let timer;
-        let idleTimer;
-        const clearTimers = () => {
-          if (timer)
-            clearTimeout(timer);
-          if (idleTimer)
-            clearTimeout(idleTimer);
-        };
-        const finish = () => {
-          if (settled)
-            return;
-          settled = true;
-          clearTimers();
-          const out = decodeOutput(Buffer.concat(stdout));
-          const error = decodeOutput(Buffer.concat(stderrBuf));
-          resolve2(error && !out ? error : out);
-        };
-        const fail = (e) => {
-          if (settled)
-            return;
-          settled = true;
-          clearTimers();
-          try {
-            stream.close();
-          } catch {}
-          reject(e);
-        };
-        const armIdle = () => {
-          if (idleTimer)
-            clearTimeout(idleTimer);
-          idleTimer = setTimeout(() => {
-            try {
-              stream.signal("INT");
-            } catch {}
-            fail(new Error(`MikroTik command produced no output for ${RUN_IDLE_TIMEOUT_MS / 1000}s and the SSH ` + "channel never closed \u2014 it appears wedged (often a malformed or unbalanced command). " + `Aborted to avoid hanging the connection. Command: ${command.slice(0, 120)}`));
-          }, RUN_IDLE_TIMEOUT_MS);
-        };
-        armIdle();
-        if (opts.maxMs && opts.maxMs > 0) {
-          timer = setTimeout(() => {
-            try {
-              stream.signal("INT");
-            } catch {}
-            try {
-              stream.close();
-            } catch {}
-            finish();
-          }, opts.maxMs);
-        }
-        stream.on("close", finish).on("data", (d) => {
-          stdout.push(d);
-          armIdle();
-        }).stderr.on("data", (d) => {
-          stderrBuf.push(d);
-          armIdle();
-        });
-      });
-    });
   }
-  uploadFile(remotePath, data) {
-    if (!this.client) {
-      return Promise.reject(new Error("Not connected to MikroTik device"));
+  answerSizeProbe(chunk) {
+    if (chunk.includes(`${ESC}[6n`)) {
+      this.session.sendInput(enc.encode(`${ESC}[${this.options.rows};${this.options.cols}R`));
+    }
+    if (chunk.includes(`${ESC}Z`) || chunk.includes(`${ESC}[c`)) {
+      this.session.sendInput(enc.encode(`${ESC}[?6c`));
     }
-    const openSftp = this.client.sftp.bind(this.client);
-    return new Promise((resolve2, reject) => {
-      openSftp((err, sftp) => {
-        if (err) {
-          reject(new Error(`SFTP subsystem unavailable: ${err.message}`));
-          return;
-        }
-        sftp.writeFile(remotePath, data, (werr) => {
-          try {
-            sftp.end();
-          } catch {}
-          if (werr)
-            reject(new Error(`SFTP write failed: ${werr.message}`));
-          else
-            resolve2();
-        });
-      });
-    });
   }
-  downloadFile(remotePath) {
-    if (!this.client) {
-      return Promise.reject(new Error("Not connected to MikroTik device"));
+  endsWithPrompt(buffer) {
+    const lines = emulateScreen(buffer).filter((line) => line.length > 0);
+    return ROUTEROS_PROMPT_RE.test(lines[lines.length - 1] ?? "");
+  }
+  waitReady(timeoutMs) {
+    if (this.ready)
+      return Promise.resolve();
+    if (this.closed) {
+      return Promise.reject(this.closeError ?? new Error("The MAC-Telnet session closed before login completed."));
     }
-    const openSftp = this.client.sftp.bind(this.client);
     return new Promise((resolve2, reject) => {
-      openSftp((err, sftp) => {
-        if (err) {
-          reject(new Error(`SFTP subsystem unavailable: ${err.message}`));
-          return;
+      let timer;
+      const entry = {
+        resolve: () => {
+          clearTimeout(timer);
+          resolve2();
+        },
+        reject: (error) => {
+          clearTimeout(timer);
+          reject(error);
         }
-        sftp.readFile(remotePath, (rerr, data) => {
-          try {
-            sftp.end();
-          } catch {}
-          if (rerr)
-            reject(new Error(`SFTP read failed: ${rerr.message}`));
-          else
-            resolve2(data);
-        });
-      });
+      };
+      timer = setTimeout(() => {
+        this.readyWaiters = this.readyWaiters.filter((w) => w !== entry);
+        reject(new Error("MAC-Telnet login did not complete \u2014 no console response from the device. " + "Confirm the device is reachable over mac-telnet (mac-server interface list) and the credentials are correct."));
+      }, timeoutMs);
+      this.readyWaiters.push(entry);
     });
   }
-  shell(opts = {}) {
-    if (!this.client) {
-      return Promise.reject(new Error("Not connected to MikroTik device"));
+  waitFor(predicate, timeoutMs, label) {
+    if (this.closed) {
+      return Promise.reject(this.closeError ?? new Error(`MAC-Telnet session closed while ${label}.`));
     }
-    const openShell = this.client.shell.bind(this.client);
     return new Promise((resolve2, reject) => {
-      openShell({
-        term: opts.term ?? "dumb",
-        cols: opts.cols ?? 220,
-        rows: opts.rows ?? 50
-      }, (err, stream) => err ? reject(err) : resolve2(stream));
+      const timeout = setTimeout(() => {
+        this.waiter = undefined;
+        reject(new Error(`Timed out ${label}. The RouterOS console did not return a prompt in time; ` + "raise the timeout or confirm the device is responsive over mac-telnet."));
+      }, timeoutMs);
+      this.waiter = { predicate, resolve: resolve2, reject, timeout };
+      this.checkWaiter();
     });
   }
-  disconnect() {
-    if (this.client) {
-      try {
-        this.client.end();
-      } catch {}
-      this.client = null;
+  checkWaiter() {
+    const waiter = this.waiter;
+    if (!waiter)
+      return;
+    if (!waiter.predicate(this.buffer)) {
+      if (waiter.settle) {
+        clearTimeout(waiter.settle);
+        waiter.settle = undefined;
+      }
+      return;
     }
-    for (const b of this.bastions.reverse()) {
-      try {
-        b.end();
-      } catch {}
+    if (waiter.settle)
+      clearTimeout(waiter.settle);
+    waiter.settle = setTimeout(() => {
+      if (this.waiter !== waiter)
+        return;
+      this.waiter = undefined;
+      clearTimeout(waiter.timeout);
+      waiter.resolve();
+    }, this.options.settleMs);
+  }
+  assertOpen() {
+    if (!this.ready || this.closed) {
+      throw new Error("The MAC-Telnet console is not open. Call open() and await it before running commands.");
     }
-    this.bastions = [];
+  }
+}
+
+// src/mac-telnet/client.ts
+import {
+  DEFAULT_MAC_TELNET_BROADCAST,
+  isBroadcastHost,
+  MAC_TELNET_PORT,
+  createUdpMacTelnetTransport,
+  formatMac,
+  listBroadcastInterfaces,
+  parseMac,
+  resolveMacTelnetRoute
+} from "@tikoci/centrs/protocols";
+
+class MikroTikMacTelnetClient {
+  transport = null;
+  console = null;
+  opts;
+  lastError;
+  routeHint;
+  constructor(opts) {
+    this.opts = {
+      port: MAC_TELNET_PORT,
+      timeoutMs: 1e4,
+      ...opts
+    };
+  }
+  async connect() {
+    this.lastError = undefined;
+    try {
+      const destinationMac = parseMac(this.opts.mac);
+      const explicitSourceMac = this.opts.sourceMac ? parseMac(this.opts.sourceMac) : undefined;
+      const host = this.opts.host ?? DEFAULT_MAC_TELNET_BROADCAST;
+      const askedDiscovery = host === DEFAULT_MAC_TELNET_BROADCAST && !explicitSourceMac;
+      const candidates = askedDiscovery ? listBroadcastInterfaces() : [];
+      const candidatesText = candidates.length ? candidates.map((i) => `${i.name}(${formatMac(i.mac)}\u2192${i.broadcast})`).join(", ") : "NONE \u2014 no usable non-internal IPv4 interface found (is this host on the device's LAN?)";
+      if (askedDiscovery)
+        logger.info(`[mac-telnet] discovery candidates: ${candidatesText}`);
+      logger.info(`[mac-telnet] resolving route to ${this.opts.mac}\u2026`);
+      const route = await resolveMacTelnetRoute({
+        destinationMac,
+        host,
+        port: this.opts.port,
+        timeoutMs: this.opts.timeoutMs,
+        explicitSourceMac
+      });
+      const discoveryFailed = askedDiscovery && route.host === DEFAULT_MAC_TELNET_BROADCAST;
+      this.routeHint = discoveryFailed ? "no local interface got a reply from the device during discovery \u2014 MAC-Telnet is Layer-2 " + "only, so the machine running this MCP server MUST be on the SAME Ethernet/Wi-Fi segment as " + "the device (it cannot cross any router or the internet). Likely: this host is not on that " + "segment, mac-server is disabled on the device's facing interface (`/tool mac-server`), or a " + "host firewall is dropping the UDP 20561 reply. " + `Interfaces tried: ${candidatesText}. ` + "To pin it, set the device's `macHost` to the LAN's directed broadcast (e.g. 192.168.88.255) " + "and `sourceMac` to the real MAC of the interface on that LAN." : undefined;
+      logger.info(`[mac-telnet] route: source ${formatMac(route.sourceMac)} \u2192 ${route.host} ` + `(${explicitSourceMac ? "explicit" : discoveryFailed ? "DISCOVERY FAILED \u2014 limited broadcast" : "discovered"})`);
+      const transport = createUdpMacTelnetTransport({
+        host: route.host,
+        port: this.opts.port,
+        broadcast: isBroadcastHost(route.host)
+      });
+      this.transport = transport;
+      await transport.ready();
+      logger.info(`[mac-telnet] socket ready; starting login (this can take ~10\u201330s)\u2026`);
+      const console = new MacTelnetConsole({
+        sink: transport,
+        sourceMac: route.sourceMac,
+        destinationMac,
+        username: this.opts.username,
+        password: this.opts.password ?? "",
+        primeTimeoutMs: Math.max(this.opts.timeoutMs, 30000),
+        commandTimeoutMs: Math.max(this.opts.timeoutMs, 15000)
+      });
+      this.console = console;
+      transport.onMessage((bytes) => console.handlePacket(bytes));
+      await console.open();
+      return true;
+    } catch (e) {
+      const base = e instanceof Error ? e.message : String(e);
+      this.lastError = this.routeHint ? `${base} (${this.routeHint})` : base;
+      logger.error(`Failed to connect to MikroTik over MAC-Telnet: ${this.lastError}`);
+      this.disconnect();
+      return false;
+    }
+  }
+  async run(command, _opts = {}) {
+    if (!this.console || !this.console.isReady) {
+      throw new Error("Not connected to MikroTik device (MAC-Telnet)");
+    }
+    const { output } = await this.console.run(command);
+    return output;
+  }
+  disconnect() {
+    try {
+      this.console?.close();
+    } catch {}
+    try {
+      this.transport?.close();
+    } catch {}
+    this.console = null;
+    this.transport = null;
   }
 }
 
@@ -1019,6 +1041,115 @@ function connectErrorMessage(name, dc, lastError) {
   return `Failed to connect to MikroTik device '${name}' at ${dc.host}:${dc.port} (auth: ${authMode})${reason}. ` + "Check the host/port are reachable, the SSH service is enabled (/ip service), and the credentials are correct.";
 }
 
+// src/core/connection-pool.ts
+var entries = new Map;
+var connecting = new Map;
+function isPoolEnabled() {
+  return getConfig().ssh.keepAlive;
+}
+function poolConfig() {
+  const cfg = getConfig().ssh;
+  return {
+    keepAliveInterval: cfg.keepAliveInterval,
+    keepAliveCountMax: 3,
+    idleTimeout: cfg.idleTimeout
+  };
+}
+function removeEntry(name) {
+  const entry = entries.get(name);
+  if (!entry)
+    return;
+  if (entry.idleTimer)
+    clearTimeout(entry.idleTimer);
+  entry.dead = true;
+  entry.client.disconnect();
+  entries.delete(name);
+  logger.info(`SSH pool: closed connection to '${name}'`);
+}
+function armIdle(name, entry) {
+  if (entry.idleTimer)
+    clearTimeout(entry.idleTimer);
+  if (entry.inflight > 0 || entry.dead)
+    return;
+  const { idleTimeout } = poolConfig();
+  entry.idleTimer = setTimeout(() => {
+    logger.info(`SSH pool: closing idle connection to '${name}' (${idleTimeout / 1000}s idle)`);
+    removeEntry(name);
+  }, idleTimeout);
+}
+function isConnectionError(msg) {
+  return /not connected|ECONNRESET|EPIPE|socket.*(close|end|destroy)|channel.*(close|open)|timed out.*handshake/i.test(msg);
+}
+async function doConnect(name) {
+  const dc = getDevice(name);
+  const cfg = poolConfig();
+  const client = new MikroTikSSHClient({
+    ...sshOptionsOf(dc),
+    jump: resolveJump(dc),
+    keepAliveInterval: cfg.keepAliveInterval,
+    keepAliveCountMax: cfg.keepAliveCountMax
+  });
+  if (!await client.connect()) {
+    throw new Error(connectErrorMessage(name, dc, client.lastError));
+  }
+  const entry = {
+    client,
+    inflight: 0,
+    idleTimer: undefined,
+    dead: false
+  };
+  entries.set(name, entry);
+  logger.info(`SSH pool: opened persistent connection to '${name}'`);
+  armIdle(name, entry);
+  return entry;
+}
+async function acquire(name) {
+  const existing = entries.get(name);
+  if (existing && !existing.dead)
+    return existing;
+  if (existing)
+    removeEntry(name);
+  const pending = connecting.get(name);
+  if (pending)
+    return pending;
+  const promise = doConnect(name);
+  connecting.set(name, promise);
+  try {
+    return await promise;
+  } catch (e) {
+    removeEntry(name);
+    throw e;
+  } finally {
+    connecting.delete(name);
+  }
+}
+async function runOnEntry(name, command, opts) {
+  const entry = await acquire(name);
+  if (entry.idleTimer) {
+    clearTimeout(entry.idleTimer);
+    entry.idleTimer = undefined;
+  }
+  entry.inflight++;
+  try {
+    return await entry.client.run(command, opts);
+  } finally {
+    entry.inflight--;
+    armIdle(name, entry);
+  }
+}
+async function runPooled(command, deviceName, opts) {
+  try {
+    return await runOnEntry(deviceName, command, opts);
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    if (!isConnectionError(msg))
+      throw e;
+    logger.info(`SSH pool: connection to '${deviceName}' lost (${msg}), reconnecting`);
+    removeEntry(deviceName);
+    return runOnEntry(deviceName, command, opts);
+  }
+}
+
 // src/ssh/safe-mode.ts
 var PROMPT_RE = /\[.+?@.+?\] (?:<SAFE> )?> ?$/m;
 var ANSI_RE = /\x1B(?:\[[0-9;]*[mA-HJ-MSTfhilnprsu]|[()][0-9A-Za-z]|\[?\?\d+[hl])/g;
@@ -1239,6 +1370,9 @@ function getSafeModeManager(deviceName) {
 async function runOnce(command, deviceName, opts) {
   const name = resolveDeviceName(deviceName);
   const dc = getDevice(deviceName);
+  if (!isMacTelnetDevice(dc) && isPoolEnabled()) {
+    return runPooled(command, name, opts);
+  }
   const client = createDeviceClient(dc);
   try {
     if (!await client.connect()) {
@@ -1317,7 +1451,7 @@ function quoteValue(value) {
     return String(value);
   if (value !== "" && BARE_SAFE.test(value))
     return value;
-  const escaped = value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\r/g, "\\r").replace(/\n/g, "\\n").replace(/\t/g, "\\t");
+  const escaped = value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\$/g, "\\$").replace(/\r/g, "\\r").replace(/\n/g, "\\n").replace(/\t/g, "\\t");
   return `"${escaped}"`;
 }
 function yesno(value) {
@@ -6038,7 +6172,7 @@ function expandQuery(tokens) {
   return out;
 }
 function buildToolIndex(tools) {
-  const entries = tools.map((t) => {
+  const entries2 = tools.map((t) => {
     const nameTokens = tokenSet(t.name);
     const titleTokens = tokenSet(t.title);
     const moduleTokens = new Set([...tokenize(t.module), ...tokenize(t.group)]);
@@ -6047,11 +6181,11 @@ function buildToolIndex(tools) {
     return { ...t, nameTokens, titleTokens, moduleTokens, descTokens, allTokens };
   });
   const df = new Map;
-  for (const e of entries) {
+  for (const e of entries2) {
     for (const tok of e.allTokens)
       df.set(tok, (df.get(tok) ?? 0) + 1);
   }
-  return { entries, df, n: entries.length };
+  return { entries: entries2, df, n: entries2.length };
 }
 var FIELD_WEIGHT = { name: 6, title: 3.5, module: 3, desc: 1.5 };
 function idf(df, n, token) {
@@ -6117,7 +6251,7 @@ var cache = null;
 async function gateway() {
   if (cache)
     return cache;
-  const { moduleCatalog } = await import("./library-z22txcv0.js");
+  const { moduleCatalog } = await import("./library-hjh5hy5d.js");
   const forIndex = [];
   const byName = new Map;
   for (const mod of moduleCatalog) {
@@ -25714,4 +25848,4 @@ function selectToolModules(filter = {}, catalog = moduleCatalog) {
   }).map((m) => m.tools);
 }
 
-export { DeviceConfigSchema, MikrotikConfigSchema, loadConfig, setConfig, getConfig, listDevices, deviceLabels, resolveDeviceName, deviceDirectory, getDevice, logger, MikroTikSSHClient, SafeModeManager, getSafeModeManager, executeMikrotikCommand, defineTool, registerTools, PROMPTS_DIR, registerUiResources, moduleCatalog, allToolModules, ALWAYS_ON_MODULES, selectToolModules };
+export { DeviceConfigSchema, MikrotikConfigSchema, loadConfig, logger, MikroTikSSHClient, setConfig, getConfig, listDevices, deviceLabels, resolveDeviceName, deviceDirectory, getDevice, SafeModeManager, getSafeModeManager, executeMikrotikCommand, defineTool, registerTools, PROMPTS_DIR, registerUiResources, moduleCatalog, allToolModules, ALWAYS_ON_MODULES, selectToolModules };