@usex/mikrotik-mcp 3.54.0 → 3.56.0

package/dist/cli.js

@@ -96,7 +96,7 @@ import {
   toggleAaaEntity,
   updateAaaEntity,
   writeBackup
-} from "./shared/cli-njttbdf8.js";
+} from "./shared/cli-thhk9f7n.js";
 
 // src/cli.ts
 import { existsSync as existsSync2 } from "fs";
@@ -1559,6 +1559,7 @@ function devicesPayload(store) {
       authMode: dc.mac ? "mac-telnet" : dc.keyFilename || dc.privateKey ? "key" : dc.password ? "password" : "none",
       isDefault: name === cfg.defaultDevice,
       description: dc.description,
+      disabled: !!dc.disabled,
       jumpVia: dc.jumpVia,
       jumpHost: dc.jumpHost ? { host: dc.jumpHost.host, port: dc.jumpHost.port } : undefined,
       status: getDeviceStatus(name),
@@ -2373,6 +2374,42 @@ async function runDashboard(cfg, transportLabel) {
     if (url.pathname === "/api/devices") {
       return json3(devicesPayload(db));
     }
+    if (url.pathname === "/api/devices/toggle" && req.method === "POST") {
+      const b = await readJson(req);
+      if (typeof b?.device !== "string" || typeof b?.disabled !== "boolean") {
+        return json3({ error: "device (string) and disabled (boolean) are required" }, 400);
+      }
+      const cfg2 = getConfig();
+      if (!(b.device in cfg2.devices))
+        return json3({ error: `unknown device: ${b.device}` }, 404);
+      const dc = cfg2.devices[b.device];
+      const next = {
+        ...cfg2,
+        devices: {
+          ...cfg2.devices,
+          [b.device]: { ...dc, disabled: b.disabled || undefined }
+        }
+      };
+      setConfig(next);
+      let persisted = true;
+      let warning;
+      try {
+        atomicWrite(getConfigSource().path, serializeConfig(next));
+      } catch (e) {
+        persisted = false;
+        warning = `applied live but not saved to disk: ${e instanceof Error ? e.message : String(e)}`;
+      }
+      if (persisted) {
+        recordVersion(getConfig(), "auto", Date.now(), `device ${b.disabled ? "disabled" : "enabled"}: ${b.device}`);
+      }
+      return json3({
+        ok: true,
+        persisted,
+        requiresReconnect: true,
+        warning,
+        ...devicesPayload(db)
+      });
+    }
     if (url.pathname === "/api/topology") {
       return json3(topologyPayload());
     }

package/dist/index.d.ts

@@ -47,7 +47,7 @@ interface UiLink {
 }
 declare function setConfig(cfg: MikrotikConfig): void;
 declare function getConfig(): MikrotikConfig;
-/** Names of every configured device, plus which one is the default. */
+/** Names of every ENABLED configured device, plus which one is the default. */
 declare function listDevices(): {
 	names: string[];
 	default: string;
@@ -55,6 +55,7 @@ declare function listDevices(): {
 /**
 * Resolve a (possibly undefined) device name to a concrete, existing config key.
 * Accepts a config key OR a device's free-text label; falls back to the default.
+* Only resolves to enabled devices.
 *
 * Matching is EXACT (key first, then label) — never fuzzy/substring — so a name
 * like "Ali Home" can never collapse onto a different device such as "home".
@@ -71,7 +72,7 @@ interface DeviceDirectoryEntry {
 /**
 * Return the connection config for a device by key or label (or the default when
 * `name` is undefined). Throws if an explicit name matches neither a key nor a
-* label.
+* label, or if the device is disabled.
 */
 declare function getDevice(name?: string): DeviceConfig;
 /** Options threaded into every tool registration. */

package/dist/index.js

@@ -22,7 +22,7 @@ import {
   resolveDeviceName,
   selectToolModules,
   setConfig
-} from "./shared/library-hk90ad18.js";
+} from "./shared/library-ymtf9zyk.js";
 // src/server.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";

package/dist/shared/{cli-xt3qvpz0.js → cli-0ctwspf1.js}

@@ -4,7 +4,7 @@ import {
   allToolModules,
   moduleCatalog,
   selectToolModules
-} from "./cli-njttbdf8.js";
+} from "./cli-thhk9f7n.js";
 export {
   selectToolModules,
   moduleCatalog,

package/dist/shared/{cli-njttbdf8.js → cli-thhk9f7n.js}

@@ -337,7 +337,8 @@ var DeviceConfigSchema = z.object({
   sourceMac: z.string().optional(),
   macHost: z.string().optional(),
   macPort: z.coerce.number().int().positive().optional(),
-  description: z.string().optional()
+  description: z.string().optional(),
+  disabled: z.boolean().optional()
 });
 var S3ConfigSchema = z.object({
   accessKeyId: z.string().optional(),
@@ -584,13 +585,17 @@ function setConfig(cfg) {
 function getConfig() {
   return active;
 }
+function isEnabled(dc) {
+  return !dc.disabled;
+}
 function listDevices() {
-  return { names: Object.keys(active.devices), default: active.defaultDevice };
+  const names = Object.entries(active.devices).filter(([, dc]) => isEnabled(dc)).map(([k]) => k);
+  return { names, default: active.defaultDevice };
 }
 function deviceKeyForLabel(name) {
   const target = name.trim().toLowerCase();
   for (const [key, dc] of Object.entries(active.devices)) {
-    if (dc.description && dc.description.trim().toLowerCase() === target)
+    if (isEnabled(dc) && dc.description && dc.description.trim().toLowerCase() === target)
       return key;
   }
   return;
@@ -599,6 +604,8 @@ function deviceLabels() {
   const seen = new Set;
   const out = [];
   for (const [key, dc] of Object.entries(active.devices)) {
+    if (!isEnabled(dc))
+      continue;
     const label = dc.description?.trim();
     if (label && label !== key && !(label in active.devices) && !seen.has(label)) {
       seen.add(label);
@@ -609,13 +616,17 @@ function deviceLabels() {
 }
 function resolveDeviceName(name) {
   if (name) {
-    if (name in active.devices)
+    if (name in active.devices && isEnabled(active.devices[name]))
       return name;
     const byLabel = deviceKeyForLabel(name);
     if (byLabel)
       return byLabel;
   }
-  return active.defaultDevice in active.devices ? active.defaultDevice : Object.keys(active.devices)[0] ?? active.defaultDevice;
+  if (active.defaultDevice in active.devices && isEnabled(active.devices[active.defaultDevice])) {
+    return active.defaultDevice;
+  }
+  const firstEnabled = Object.entries(active.devices).find(([, dc]) => isEnabled(dc));
+  return firstEnabled ? firstEnabled[0] : active.defaultDevice;
 }
 function deviceTarget(dc) {
   if (!dc)
@@ -623,7 +634,7 @@ function deviceTarget(dc) {
   return dc.mac ? `MAC ${dc.mac}` : `${dc.host}:${dc.port ?? 22}`;
 }
 function deviceDirectory() {
-  return Object.entries(active.devices).map(([key, dc]) => ({
+  return Object.entries(active.devices).filter(([, dc]) => isEnabled(dc)).map(([key, dc]) => ({
     key,
     label: dc.description?.trim() || undefined,
     target: deviceTarget(dc),
@@ -643,6 +654,9 @@ function getDevice(name) {
   const dc = active.devices[key];
   if (!dc)
     throw new Error(`No device configuration available for '${key}'.`);
+  if (dc.disabled) {
+    throw new Error(`Device '${key}' is disabled. Enable it from the dashboard or config file.`);
+  }
   return dc;
 }
 
@@ -1762,7 +1776,7 @@ function parseKvTokens(chunk) {
   return out;
 }
 var INDEX_LINE = /^\s*(\d+)\s+(.*)$/;
-var LEADING_FLAGS = /^([A-Z]+)(?=\s|$)/;
+var LEADING_FLAGS = /^([A-Z][A-Za-z]*)(?=\s|$)/;
 function unionColumns(rows) {
   const seen = new Set;
   const cols = [];
@@ -8313,7 +8327,7 @@ var cache = null;
 async function gateway() {
   if (cache)
     return cache;
-  const { moduleCatalog } = await import("./cli-xt3qvpz0.js");
+  const { moduleCatalog } = await import("./cli-0ctwspf1.js");
   const forIndex = [];
   const byName = new Map;
   for (const mod of moduleCatalog) {
@@ -9338,10 +9352,44 @@ function covers(key, aVal, bVal) {
     return cidrContains(aVal, bVal);
   return false;
 }
+var INTERFACE_LIST_PAIRS = [
+  ["in-interface-list", "in-interface"],
+  ["out-interface-list", "out-interface"]
+];
+var _ifaceLists;
+function interfaceListCovers(aKey, aVal, bKey, bVal) {
+  if (!_ifaceLists)
+    return;
+  for (const [listKey, ifaceKey] of INTERFACE_LIST_PAIRS) {
+    if (aKey === listKey && bKey === ifaceKey) {
+      const negated = aVal.startsWith("!");
+      const listName = negated ? aVal.slice(1) : aVal;
+      const members = _ifaceLists.get(listName);
+      if (!members)
+        return;
+      const isMember = members.has(bVal);
+      return negated ? !isMember : isMember;
+    }
+  }
+  return;
+}
 function aCoversB(a, b) {
   for (const [k, v] of Object.entries(a.match)) {
     const bv = b.match[k];
-    if (bv === undefined || !covers(k, v, bv))
+    if (bv !== undefined) {
+      if (!covers(k, v, bv))
+        return false;
+      continue;
+    }
+    let crossCovered = false;
+    for (const [bk, bval] of Object.entries(b.match)) {
+      const result = interfaceListCovers(k, v, bk, bval);
+      if (result === true) {
+        crossCovered = true;
+        break;
+      }
+    }
+    if (!crossCovered)
       return false;
   }
   return true;
@@ -9518,6 +9566,7 @@ function grade2(score) {
   return "critical";
 }
 function auditFirewall(input) {
+  _ifaceLists = input.interfaceLists;
   const findings = [];
   if (input.filter)
     findings.push(...auditFilter(input.filter));
@@ -9566,6 +9615,25 @@ async function fetchRules(path, ctx) {
     return [];
   return parseRecords(out).rows;
 }
+async function fetchInterfaceListMembers(ctx) {
+  const out = await executeMikrotikCommand("/interface list member print detail", ctx);
+  const members = new Map;
+  if (looksLikeError(out) || isEmpty(out))
+    return members;
+  for (const row of parseRecords(out).rows) {
+    const list = row.list;
+    const iface = row.interface;
+    if (!list || !iface)
+      continue;
+    let set = members.get(list);
+    if (!set) {
+      set = new Set;
+      members.set(list, set);
+    }
+    set.add(iface);
+  }
+  return members;
+}
 var firewallAuditTools = [
   defineTool({
     name: "firewall_audit",
@@ -9580,10 +9648,16 @@ var firewallAuditTools = [
     async handler(a, ctx) {
       const device = resolveDeviceName(ctx.device);
       ctx.info(`Auditing firewall for '${device}'`);
-      const filter = rulesFromRows(await fetchRules("/ip firewall filter", ctx));
-      const nat = a.include_nat ? rulesFromRows(await fetchRules("/ip firewall nat", ctx)) : undefined;
-      const mangle = a.include_mangle ? rulesFromRows(await fetchRules("/ip firewall mangle", ctx)) : undefined;
-      const report = auditFirewall({ filter, nat, mangle });
+      const [filterRows, natRows, mangleRows, interfaceLists] = await Promise.all([
+        fetchRules("/ip firewall filter", ctx),
+        a.include_nat ? fetchRules("/ip firewall nat", ctx) : Promise.resolve(undefined),
+        a.include_mangle ? fetchRules("/ip firewall mangle", ctx) : Promise.resolve(undefined),
+        fetchInterfaceListMembers(ctx)
+      ]);
+      const filter = rulesFromRows(filterRows);
+      const nat = natRows ? rulesFromRows(natRows) : undefined;
+      const mangle = mangleRows ? rulesFromRows(mangleRows) : undefined;
+      const report = auditFirewall({ filter, nat, mangle, interfaceLists });
       const structuredContent = {
         __mikrotikView: "firewall-audit",
         device,
@@ -10048,6 +10122,22 @@ Management access may be partially restricted \u2014 review immediately.`;
 // src/tools/firewall-filter.ts
 import { z as z28 } from "zod";
 var isDigits = (s) => /^\d+$/.test(s);
+async function resolveFilterRuleId(ruleId, ctx) {
+  if (/^\d+$/.test(ruleId)) {
+    const id = `*${ruleId}`;
+    const byId = await executeMikrotikCommand(`/ip firewall filter print count-only where .id=${id}`, ctx);
+    if (byId.trim() !== "0")
+      return id;
+    const idsRaw = await executeMikrotikCommand(`:foreach i in=[/ip firewall filter find] do={:put $i}`, ctx);
+    if (isEmpty(idsRaw))
+      return null;
+    const ids = idsRaw.trim().split(/\r?\n/).map((l) => l.trim()).filter(Boolean);
+    const pos = Number.parseInt(ruleId, 10);
+    return pos >= 0 && pos < ids.length ? ids[pos] : null;
+  }
+  const count = await executeMikrotikCommand(`/ip firewall filter print count-only where .id=${ruleId}`, ctx);
+  return count.trim() !== "0" ? ruleId : null;
+}
 async function updateFilterRule(a, ctx) {
   ctx.info(`Updating firewall filter rule: rule_id=${a.rule_id}`);
   const updates = [];
@@ -10116,7 +10206,9 @@ async function updateFilterRule(a, ctx) {
   }
   if (updates.length === 0)
     return "No updates specified.";
-  const id = /^\d+$/.test(a.rule_id) ? `*${a.rule_id}` : a.rule_id;
+  const id = await resolveFilterRuleId(a.rule_id, ctx);
+  if (!id)
+    return `Firewall filter rule '${a.rule_id}' not found.`;
   const cmd = `/ip firewall filter set ${id} ${updates.join(" ")}`;
   const result = await executeMikrotikCommand(cmd, ctx);
   if (looksLikeError(result))
@@ -10260,7 +10352,7 @@ ${details}`;
         filters.push("invalid=yes");
       if (a.dynamic_only)
         filters.push("dynamic=yes");
-      const result = await executeMikrotikCommand(`/ip firewall filter print${whereClause(filters)}`, ctx);
+      const result = await executeMikrotikCommand(`/ip firewall filter print detail${whereClause(filters)}`, ctx);
       return isEmpty(result) ? "No firewall filter rules found matching the criteria." : `FIREWALL FILTER RULES:
 
 ${result}`;
@@ -10270,15 +10362,17 @@ ${result}`;
     name: "get_filter_rule",
     title: "Get Firewall Filter Rule",
     annotations: READ,
-    description: "Gets the full detail of one IPv4 firewall FILTER rule (`/ip firewall filter`) by id \u2014 " + "every matcher, action, counter and flag. For IPv6 use get_ipv6_filter_rule. " + 'rule_id: the `.id` from list_filter_rules e.g. "*1" or "0".',
+    description: "Gets the full detail of one IPv4 firewall FILTER rule (`/ip firewall filter`) by id \u2014 " + "every matcher, action, counter and flag. For IPv6 use get_ipv6_filter_rule. " + 'rule_id: preferably the `.id` from list_filter_rules e.g. "*1F". A bare number like "3" ' + "is tried as `.id=*3` first, then as the positional row index if no `.id` matches.",
     inputSchema: {
-      rule_id: z28.string().describe('Rule ID from list output e.g. "*1" or "0"')
+      rule_id: z28.string().describe('Rule .id e.g. "*1F", or bare position number e.g. "3"')
     },
     async handler(a, ctx) {
       ctx.info(`Getting firewall filter rule details: rule_id=${a.rule_id}`);
-      const id = /^\d+$/.test(a.rule_id) ? `*${a.rule_id}` : a.rule_id;
+      const id = await resolveFilterRuleId(a.rule_id, ctx);
+      if (!id)
+        return `Firewall filter rule '${a.rule_id}' not found.`;
       const result = await executeMikrotikCommand(`/ip firewall filter print detail where .id=${id}`, ctx);
-      return isEmpty(result) ? `Firewall filter rule with ID '${a.rule_id}' not found.` : `FIREWALL FILTER RULE DETAILS:
+      return isEmpty(result) ? `Firewall filter rule '${a.rule_id}' not found.` : `FIREWALL FILTER RULE DETAILS:
 
 ${result}`;
     }
@@ -10353,14 +10447,13 @@ ${result}`;
     inputSchema: { rule_id: z28.string() },
     async handler(a, ctx) {
       ctx.info(`Removing firewall filter rule: rule_id=${a.rule_id}`);
-      const id = /^\d+$/.test(a.rule_id) ? `*${a.rule_id}` : a.rule_id;
-      const count = await executeMikrotikCommand(`/ip firewall filter print count-only where .id=${id}`, ctx);
-      if (count.trim() === "0")
-        return `Firewall filter rule with ID '${a.rule_id}' not found.`;
+      const id = await resolveFilterRuleId(a.rule_id, ctx);
+      if (!id)
+        return `Firewall filter rule '${a.rule_id}' not found.`;
       const result = await executeMikrotikCommand(`/ip firewall filter remove ${id}`, ctx);
       if (looksLikeError(result))
         return `Failed to remove firewall filter rule: ${result}`;
-      return `Firewall filter rule with ID '${a.rule_id}' removed successfully.`;
+      return `Firewall filter rule '${a.rule_id}' (${id}) removed successfully.`;
     }
   }),
   defineTool({
@@ -10374,14 +10467,13 @@ ${result}`;
     },
     async handler(a, ctx) {
       ctx.info(`Moving firewall filter rule: rule_id=${a.rule_id} to position ${a.destination}`);
-      const id = /^\d+$/.test(a.rule_id) ? `*${a.rule_id}` : a.rule_id;
-      const count = await executeMikrotikCommand(`/ip firewall filter print count-only where .id=${id}`, ctx);
-      if (count.trim() === "0")
-        return `Firewall filter rule with ID '${a.rule_id}' not found.`;
+      const id = await resolveFilterRuleId(a.rule_id, ctx);
+      if (!id)
+        return `Firewall filter rule '${a.rule_id}' not found.`;
       const result = await executeMikrotikCommand(`/ip firewall filter move ${id} destination=${a.destination}`, ctx);
       if (looksLikeError(result))
         return `Failed to move firewall filter rule: ${result}`;
-      return `Firewall filter rule with ID '${a.rule_id}' moved to position ${a.destination}.`;
+      return `Firewall filter rule '${a.rule_id}' (${id}) moved to position ${a.destination}.`;
     }
   }),
   defineTool({
@@ -20657,13 +20749,27 @@ function analyzeRootCause(data) {
     }
   }
   if (downInterfaces.length === 0 && errorInterfaces.length === 0) {
+    if (data.interfaces.length === 0) {
+      evidence.push({
+        dimension: "interfaces",
+        severity: "warning",
+        summary: "Interface data unavailable \u2014 the device returned no parseable interface records. " + "Run `/interface print detail` manually to verify."
+      });
+    } else {
+      evidence.push({
+        dimension: "interfaces",
+        severity: "ok",
+        summary: `All ${data.interfaces.length} interfaces healthy`
+      });
+    }
+  }
+  if (data.routeCount === 0) {
     evidence.push({
-      dimension: "interfaces",
-      severity: "ok",
-      summary: `All ${data.interfaces.length} interfaces healthy`
+      dimension: "routing",
+      severity: "warning",
+      summary: "Route data unavailable \u2014 the device returned no parseable route records. " + "Run `/ip route print detail` manually to verify."
     });
-  }
-  if (!data.defaultRouteExists) {
+  } else if (!data.defaultRouteExists) {
     evidence.push({
       dimension: "routing",
       severity: "critical",
@@ -20676,7 +20782,7 @@ function analyzeRootCause(data) {
       summary: `Default route present, ${data.routeCount} total routes`
     });
   }
-  const ospfDown = data.ospfNeighbors.filter((n) => n.state.toLowerCase() !== "full");
+  const ospfDown = data.ospfNeighbors.filter((n) => (n.id || n.address) && n.state.toLowerCase() !== "full");
   for (const n of ospfDown) {
     evidence.push({
       dimension: "routing",
@@ -20685,7 +20791,7 @@ function analyzeRootCause(data) {
       reference: n.id
     });
   }
-  const bgpDown = data.bgpPeers.filter((p) => !p.state.toLowerCase().includes("established"));
+  const bgpDown = data.bgpPeers.filter((p) => (p.id || p.address) && !p.state.toLowerCase().includes("established"));
   for (const p of bgpDown) {
     evidence.push({
       dimension: "routing",
@@ -20788,7 +20894,13 @@ function analyzeRootCause(data) {
       summary: "No DNS servers configured"
     });
   }
-  if (data.cpuLoad > 90) {
+  if (data.cpuLoad === 0 && data.memoryUsedPct === 0 && !data.rosVersion && !data.uptime) {
+    evidence.push({
+      dimension: "resources",
+      severity: "warning",
+      summary: "System resource data unavailable \u2014 CPU 0%, memory 0%, no version or uptime. " + "The `/system resource print` output may not have been parsed correctly."
+    });
+  } else if (data.cpuLoad > 90) {
     evidence.push({
       dimension: "resources",
       severity: "critical",
@@ -20807,24 +20919,26 @@ function analyzeRootCause(data) {
       summary: `CPU load: ${data.cpuLoad}%`
     });
   }
-  if (data.memoryUsedPct > 90) {
-    evidence.push({
-      dimension: "resources",
-      severity: "critical",
-      summary: `Memory critically low: ${data.memoryUsedPct}% used`
-    });
-  } else if (data.memoryUsedPct > 75) {
-    evidence.push({
-      dimension: "resources",
-      severity: "warning",
-      summary: `Memory pressure: ${data.memoryUsedPct}% used`
-    });
-  } else {
-    evidence.push({
-      dimension: "resources",
-      severity: "ok",
-      summary: `Memory: ${data.memoryUsedPct}% used`
-    });
+  if (data.rosVersion || data.uptime || data.cpuLoad > 0 || data.memoryUsedPct > 0) {
+    if (data.memoryUsedPct > 90) {
+      evidence.push({
+        dimension: "resources",
+        severity: "critical",
+        summary: `Memory critically low: ${data.memoryUsedPct}% used`
+      });
+    } else if (data.memoryUsedPct > 75) {
+      evidence.push({
+        dimension: "resources",
+        severity: "warning",
+        summary: `Memory pressure: ${data.memoryUsedPct}% used`
+      });
+    } else {
+      evidence.push({
+        dimension: "resources",
+        severity: "ok",
+        summary: `Memory: ${data.memoryUsedPct}% used`
+      });
+    }
   }
   const errorLogs = data.relevantLogs.filter((l) => l.topics.includes("error") || l.topics.includes("critical") || l.topics.includes("warning"));
   const firewallLogs = data.relevantLogs.filter((l) => l.topics.includes("firewall"));
@@ -20861,14 +20975,24 @@ function analyzeRootCause(data) {
       summary: "No concerning log entries in the last 10 minutes"
     });
   }
+  const isServerBinding = (t) => /-(in|server)$/.test(t.type) || t.name.startsWith("<");
   const downTunnels = data.tunnelInterfaces.filter((t) => !t.running && !t.disabled);
   for (const t of downTunnels) {
-    evidence.push({
-      dimension: "vpn",
-      severity: "critical",
-      summary: `Tunnel ${t.name} (${t.type}) is down`,
-      reference: t.name
-    });
+    if (isServerBinding(t)) {
+      evidence.push({
+        dimension: "vpn",
+        severity: "info",
+        summary: `Server binding ${t.name} (${t.type}) is idle \u2014 no active client session`,
+        reference: t.name
+      });
+    } else {
+      evidence.push({
+        dimension: "vpn",
+        severity: "critical",
+        summary: `Tunnel ${t.name} (${t.type}) is down`,
+        reference: t.name
+      });
+    }
   }
   if (data.tunnelInterfaces.length > 0 && downTunnels.length === 0) {
     evidence.push({
@@ -20878,6 +21002,19 @@ function analyzeRootCause(data) {
     });
   }
   correlateRootCauses(data, evidence, rootCauses);
+  if (data.ping && data.ping.lossPct === 0) {
+    const contradicted = new Set([
+      "Missing default route",
+      "Missing source NAT / masquerade",
+      "Interface link failure"
+    ]);
+    for (const rc of rootCauses) {
+      if (contradicted.has(rc.cause) && rc.confidence !== "low") {
+        rc.confidence = "low";
+        rc.explanation += " (Note: ping to the target succeeded with 0% loss, which contradicts this hypothesis.)";
+      }
+    }
+  }
   rootCauses.sort((a, b) => CONFIDENCE_RANK[a.confidence] - CONFIDENCE_RANK[b.confidence]);
   const dimensionSummary = ALL_DIMENSIONS.map((dim) => {
     const dimEvidence = evidence.filter((e) => e.dimension === dim);
@@ -21016,14 +21153,15 @@ function correlateRootCauses(data, evidence, causes) {
       });
     }
   }
-  const downTunnels = data.tunnelInterfaces.filter((t) => !t.running && !t.disabled);
-  if (downTunnels.length > 0) {
+  const isServerTunnel = (t) => /-(in|server)$/.test(t.type) || t.name.startsWith("<");
+  const realDownTunnels = data.tunnelInterfaces.filter((t) => !t.running && !t.disabled && !isServerTunnel(t));
+  if (realDownTunnels.length > 0) {
     causes.push({
       cause: "VPN/tunnel interface down",
-      explanation: `Tunnel(s) ${downTunnels.map((t) => `${t.name} (${t.type})`).join(", ")} are down. ` + "Traffic destined for remote networks over these tunnels will be black-holed.",
+      explanation: `Tunnel(s) ${realDownTunnels.map((t) => `${t.name} (${t.type})`).join(", ")} are down. ` + "Traffic destined for remote networks over these tunnels will be black-holed.",
       confidence: "high",
       evidence: evidence.filter((e) => e.dimension === "vpn" && e.severity === "critical"),
-      fixes: downTunnels.map((t) => `/interface enable [find name="${t.name}"]`),
+      fixes: realDownTunnels.map((t) => `/interface enable [find name="${t.name}"]`),
       dimensions: ["vpn"]
     });
   }
@@ -21252,7 +21390,7 @@ async function collectRoutes(ctx) {
 }
 async function collectOspfNeighbors(ctx) {
   const raw = await safe("/routing ospf neighbor print detail", ctx);
-  if (!raw)
+  if (!raw || isEmpty(raw))
     return [];
   return parseRecords(raw).rows.map((r) => ({
     id: r["neighbor-id"] ?? r.router ?? "",
@@ -21260,13 +21398,13 @@ async function collectOspfNeighbors(ctx) {
     state: r.state ?? "",
     interface: r.interface ?? "",
     uptime: r.uptime
-  }));
+  })).filter((n) => n.id || n.address);
 }
 async function collectBgpPeers(ctx) {
   const raw = await safe("/routing bgp session print detail", ctx);
-  if (!raw) {
+  if (!raw || isEmpty(raw)) {
     const raw2 = await safe("/routing bgp peer print detail", ctx);
-    if (!raw2)
+    if (!raw2 || isEmpty(raw2))
       return [];
     return parseRecords(raw2).rows.map((r) => ({
       id: r.name ?? "",
@@ -21274,7 +21412,7 @@ async function collectBgpPeers(ctx) {
       state: r.state ?? "",
       interface: r.interface ?? "",
       uptime: r.uptime
-    }));
+    })).filter((p) => p.id || p.address);
   }
   return parseRecords(raw).rows.map((r) => ({
     id: r.name ?? r["remote.address"] ?? "",
@@ -21282,7 +21420,7 @@ async function collectBgpPeers(ctx) {
     state: r.state ?? r.established ?? "",
     interface: r.interface ?? "",
     uptime: r.uptime
-  }));
+  })).filter((p) => p.id || p.address);
 }
 async function collectFirewallRules(target, ctx) {
   const raw = await safe("/ip firewall filter print detail", ctx);
@@ -21382,7 +21520,7 @@ async function collectDiagnosticData(target, ctx, dimensions) {
     arpEntries,
     dhcpLeases,
     dnsResult,
-    dnsSettingsRaw,
+    dnsSettingsParts,
     resourceRaw,
     logs,
     tunnels
@@ -21398,13 +21536,17 @@ async function collectDiagnosticData(target, ctx, dimensions) {
     dims.has("arp_dhcp") ? collectArp(ctx) : Promise.resolve([]),
     dims.has("arp_dhcp") ? collectDhcpLeases(ctx) : Promise.resolve([]),
     dims.has("dns") && !isIpLike(target) ? safe(`[:resolve ${quoteValue(target)}]`, ctx) : Promise.resolve(undefined),
-    dims.has("dns") ? safe("/ip dns print", ctx) : Promise.resolve(""),
+    dims.has("dns") ? Promise.all([
+      safe(":put [/ip dns get servers]", ctx),
+      safe(":put [/ip dns get dynamic-servers]", ctx),
+      safe(":put [/ip dns get allow-remote-requests]", ctx)
+    ]) : Promise.resolve(["", "", ""]),
     dims.has("resources") ? safe("/system resource print", ctx) : Promise.resolve(""),
     dims.has("logs") ? collectLogs(target, ctx) : Promise.resolve([]),
     dims.has("vpn") ? collectTunnels(ctx) : Promise.resolve([])
   ]);
   const ping = pingResult ? parsePingSummary(pingResult) ?? undefined : undefined;
-  const dnsKv = parseKeyValues(dnsSettingsRaw);
+  const [dnsServersRaw, dnsDynamicRaw, dnsAllowRemoteRaw] = dnsSettingsParts;
   const resKv = parseKeyValues(resourceRaw);
   const totalMem = parseSize(resKv["total-memory"]) ?? 0;
   const freeMem = parseSize(resKv["free-memory"]) ?? 0;
@@ -21426,8 +21568,8 @@ async function collectDiagnosticData(target, ctx, dimensions) {
     arpEntries,
     dhcpLeases,
     dnsResolveResult: dnsResult ?? undefined,
-    dnsServers: [dnsKv.servers, dnsKv["dynamic-servers"]].filter(Boolean).join(",") || "",
-    dnsAllowRemote: (dnsKv["allow-remote-requests"] ?? "").toLowerCase() === "yes",
+    dnsServers: [dnsServersRaw.trim(), dnsDynamicRaw.trim()].filter(Boolean).join(",") || "",
+    dnsAllowRemote: dnsAllowRemoteRaw.trim().toLowerCase() === "yes" || dnsAllowRemoteRaw.trim().toLowerCase() === "true",
     cpuLoad: parsePercent(resKv["cpu-load"]) ?? 0,
     memoryUsedPct: memUsedPct,
     uptime: resKv.uptime ?? "",

package/dist/shared/{library-84y0nvhr.js → library-jve65pzw.js}

@@ -4,7 +4,7 @@ import {
   allToolModules,
   moduleCatalog,
   selectToolModules
-} from "./library-hk90ad18.js";
+} from "./library-ymtf9zyk.js";
 export {
   selectToolModules,
   moduleCatalog,