@usex/mikrotik-mcp 3.54.0 → 3.56.0

package/dist/shared/{library-hk90ad18.js → library-ymtf9zyk.js}

@@ -337,7 +337,8 @@ var DeviceConfigSchema = z.object({
   sourceMac: z.string().optional(),
   macHost: z.string().optional(),
   macPort: z.coerce.number().int().positive().optional(),
-  description: z.string().optional()
+  description: z.string().optional(),
+  disabled: z.boolean().optional()
 });
 var S3ConfigSchema = z.object({
   accessKeyId: z.string().optional(),
@@ -581,13 +582,17 @@ function setConfig(cfg) {
 function getConfig() {
   return active;
 }
+function isEnabled(dc) {
+  return !dc.disabled;
+}
 function listDevices() {
-  return { names: Object.keys(active.devices), default: active.defaultDevice };
+  const names = Object.entries(active.devices).filter(([, dc]) => isEnabled(dc)).map(([k]) => k);
+  return { names, default: active.defaultDevice };
 }
 function deviceKeyForLabel(name) {
   const target = name.trim().toLowerCase();
   for (const [key, dc] of Object.entries(active.devices)) {
-    if (dc.description && dc.description.trim().toLowerCase() === target)
+    if (isEnabled(dc) && dc.description && dc.description.trim().toLowerCase() === target)
       return key;
   }
   return;
@@ -596,6 +601,8 @@ function deviceLabels() {
   const seen = new Set;
   const out = [];
   for (const [key, dc] of Object.entries(active.devices)) {
+    if (!isEnabled(dc))
+      continue;
     const label = dc.description?.trim();
     if (label && label !== key && !(label in active.devices) && !seen.has(label)) {
       seen.add(label);
@@ -606,13 +613,17 @@ function deviceLabels() {
 }
 function resolveDeviceName(name) {
   if (name) {
-    if (name in active.devices)
+    if (name in active.devices && isEnabled(active.devices[name]))
       return name;
     const byLabel = deviceKeyForLabel(name);
     if (byLabel)
       return byLabel;
   }
-  return active.defaultDevice in active.devices ? active.defaultDevice : Object.keys(active.devices)[0] ?? active.defaultDevice;
+  if (active.defaultDevice in active.devices && isEnabled(active.devices[active.defaultDevice])) {
+    return active.defaultDevice;
+  }
+  const firstEnabled = Object.entries(active.devices).find(([, dc]) => isEnabled(dc));
+  return firstEnabled ? firstEnabled[0] : active.defaultDevice;
 }
 function deviceTarget(dc) {
   if (!dc)
@@ -620,7 +631,7 @@ function deviceTarget(dc) {
   return dc.mac ? `MAC ${dc.mac}` : `${dc.host}:${dc.port ?? 22}`;
 }
 function deviceDirectory() {
-  return Object.entries(active.devices).map(([key, dc]) => ({
+  return Object.entries(active.devices).filter(([, dc]) => isEnabled(dc)).map(([key, dc]) => ({
     key,
     label: dc.description?.trim() || undefined,
     target: deviceTarget(dc),
@@ -640,6 +651,9 @@ function getDevice(name) {
   const dc = active.devices[key];
   if (!dc)
     throw new Error(`No device configuration available for '${key}'.`);
+  if (dc.disabled) {
+    throw new Error(`Device '${key}' is disabled. Enable it from the dashboard or config file.`);
+  }
   return dc;
 }
 
@@ -1743,7 +1757,7 @@ function parseKvTokens(chunk) {
   return out;
 }
 var INDEX_LINE = /^\s*(\d+)\s+(.*)$/;
-var LEADING_FLAGS = /^([A-Z]+)(?=\s|$)/;
+var LEADING_FLAGS = /^([A-Z][A-Za-z]*)(?=\s|$)/;
 function unionColumns(rows) {
   const seen = new Set;
   const cols = [];
@@ -8243,7 +8257,7 @@ var cache = null;
 async function gateway() {
   if (cache)
     return cache;
-  const { moduleCatalog } = await import("./library-84y0nvhr.js");
+  const { moduleCatalog } = await import("./library-jve65pzw.js");
   const forIndex = [];
   const byName = new Map;
   for (const mod of moduleCatalog) {
@@ -9268,10 +9282,44 @@ function covers(key, aVal, bVal) {
     return cidrContains(aVal, bVal);
   return false;
 }
+var INTERFACE_LIST_PAIRS = [
+  ["in-interface-list", "in-interface"],
+  ["out-interface-list", "out-interface"]
+];
+var _ifaceLists;
+function interfaceListCovers(aKey, aVal, bKey, bVal) {
+  if (!_ifaceLists)
+    return;
+  for (const [listKey, ifaceKey] of INTERFACE_LIST_PAIRS) {
+    if (aKey === listKey && bKey === ifaceKey) {
+      const negated = aVal.startsWith("!");
+      const listName = negated ? aVal.slice(1) : aVal;
+      const members = _ifaceLists.get(listName);
+      if (!members)
+        return;
+      const isMember = members.has(bVal);
+      return negated ? !isMember : isMember;
+    }
+  }
+  return;
+}
 function aCoversB(a, b) {
   for (const [k, v] of Object.entries(a.match)) {
     const bv = b.match[k];
-    if (bv === undefined || !covers(k, v, bv))
+    if (bv !== undefined) {
+      if (!covers(k, v, bv))
+        return false;
+      continue;
+    }
+    let crossCovered = false;
+    for (const [bk, bval] of Object.entries(b.match)) {
+      const result = interfaceListCovers(k, v, bk, bval);
+      if (result === true) {
+        crossCovered = true;
+        break;
+      }
+    }
+    if (!crossCovered)
       return false;
   }
   return true;
@@ -9448,6 +9496,7 @@ function grade2(score) {
   return "critical";
 }
 function auditFirewall(input) {
+  _ifaceLists = input.interfaceLists;
   const findings = [];
   if (input.filter)
     findings.push(...auditFilter(input.filter));
@@ -9496,6 +9545,25 @@ async function fetchRules(path, ctx) {
     return [];
   return parseRecords(out).rows;
 }
+async function fetchInterfaceListMembers(ctx) {
+  const out = await executeMikrotikCommand("/interface list member print detail", ctx);
+  const members = new Map;
+  if (looksLikeError(out) || isEmpty(out))
+    return members;
+  for (const row of parseRecords(out).rows) {
+    const list = row.list;
+    const iface = row.interface;
+    if (!list || !iface)
+      continue;
+    let set = members.get(list);
+    if (!set) {
+      set = new Set;
+      members.set(list, set);
+    }
+    set.add(iface);
+  }
+  return members;
+}
 var firewallAuditTools = [
   defineTool({
     name: "firewall_audit",
@@ -9510,10 +9578,16 @@ var firewallAuditTools = [
     async handler(a, ctx) {
       const device = resolveDeviceName(ctx.device);
       ctx.info(`Auditing firewall for '${device}'`);
-      const filter = rulesFromRows(await fetchRules("/ip firewall filter", ctx));
-      const nat = a.include_nat ? rulesFromRows(await fetchRules("/ip firewall nat", ctx)) : undefined;
-      const mangle = a.include_mangle ? rulesFromRows(await fetchRules("/ip firewall mangle", ctx)) : undefined;
-      const report = auditFirewall({ filter, nat, mangle });
+      const [filterRows, natRows, mangleRows, interfaceLists] = await Promise.all([
+        fetchRules("/ip firewall filter", ctx),
+        a.include_nat ? fetchRules("/ip firewall nat", ctx) : Promise.resolve(undefined),
+        a.include_mangle ? fetchRules("/ip firewall mangle", ctx) : Promise.resolve(undefined),
+        fetchInterfaceListMembers(ctx)
+      ]);
+      const filter = rulesFromRows(filterRows);
+      const nat = natRows ? rulesFromRows(natRows) : undefined;
+      const mangle = mangleRows ? rulesFromRows(mangleRows) : undefined;
+      const report = auditFirewall({ filter, nat, mangle, interfaceLists });
       const structuredContent = {
         __mikrotikView: "firewall-audit",
         device,
@@ -9978,6 +10052,22 @@ Management access may be partially restricted \u2014 review immediately.`;
 // src/tools/firewall-filter.ts
 import { z as z28 } from "zod";
 var isDigits = (s) => /^\d+$/.test(s);
+async function resolveFilterRuleId(ruleId, ctx) {
+  if (/^\d+$/.test(ruleId)) {
+    const id = `*${ruleId}`;
+    const byId = await executeMikrotikCommand(`/ip firewall filter print count-only where .id=${id}`, ctx);
+    if (byId.trim() !== "0")
+      return id;
+    const idsRaw = await executeMikrotikCommand(`:foreach i in=[/ip firewall filter find] do={:put $i}`, ctx);
+    if (isEmpty(idsRaw))
+      return null;
+    const ids = idsRaw.trim().split(/\r?\n/).map((l) => l.trim()).filter(Boolean);
+    const pos = Number.parseInt(ruleId, 10);
+    return pos >= 0 && pos < ids.length ? ids[pos] : null;
+  }
+  const count = await executeMikrotikCommand(`/ip firewall filter print count-only where .id=${ruleId}`, ctx);
+  return count.trim() !== "0" ? ruleId : null;
+}
 async function updateFilterRule(a, ctx) {
   ctx.info(`Updating firewall filter rule: rule_id=${a.rule_id}`);
   const updates = [];
@@ -10046,7 +10136,9 @@ async function updateFilterRule(a, ctx) {
   }
   if (updates.length === 0)
     return "No updates specified.";
-  const id = /^\d+$/.test(a.rule_id) ? `*${a.rule_id}` : a.rule_id;
+  const id = await resolveFilterRuleId(a.rule_id, ctx);
+  if (!id)
+    return `Firewall filter rule '${a.rule_id}' not found.`;
   const cmd = `/ip firewall filter set ${id} ${updates.join(" ")}`;
   const result = await executeMikrotikCommand(cmd, ctx);
   if (looksLikeError(result))
@@ -10190,7 +10282,7 @@ ${details}`;
         filters.push("invalid=yes");
       if (a.dynamic_only)
         filters.push("dynamic=yes");
-      const result = await executeMikrotikCommand(`/ip firewall filter print${whereClause(filters)}`, ctx);
+      const result = await executeMikrotikCommand(`/ip firewall filter print detail${whereClause(filters)}`, ctx);
       return isEmpty(result) ? "No firewall filter rules found matching the criteria." : `FIREWALL FILTER RULES:
 
 ${result}`;
@@ -10200,15 +10292,17 @@ ${result}`;
     name: "get_filter_rule",
     title: "Get Firewall Filter Rule",
     annotations: READ,
-    description: "Gets the full detail of one IPv4 firewall FILTER rule (`/ip firewall filter`) by id \u2014 " + "every matcher, action, counter and flag. For IPv6 use get_ipv6_filter_rule. " + 'rule_id: the `.id` from list_filter_rules e.g. "*1" or "0".',
+    description: "Gets the full detail of one IPv4 firewall FILTER rule (`/ip firewall filter`) by id \u2014 " + "every matcher, action, counter and flag. For IPv6 use get_ipv6_filter_rule. " + 'rule_id: preferably the `.id` from list_filter_rules e.g. "*1F". A bare number like "3" ' + "is tried as `.id=*3` first, then as the positional row index if no `.id` matches.",
     inputSchema: {
-      rule_id: z28.string().describe('Rule ID from list output e.g. "*1" or "0"')
+      rule_id: z28.string().describe('Rule .id e.g. "*1F", or bare position number e.g. "3"')
     },
     async handler(a, ctx) {
       ctx.info(`Getting firewall filter rule details: rule_id=${a.rule_id}`);
-      const id = /^\d+$/.test(a.rule_id) ? `*${a.rule_id}` : a.rule_id;
+      const id = await resolveFilterRuleId(a.rule_id, ctx);
+      if (!id)
+        return `Firewall filter rule '${a.rule_id}' not found.`;
       const result = await executeMikrotikCommand(`/ip firewall filter print detail where .id=${id}`, ctx);
-      return isEmpty(result) ? `Firewall filter rule with ID '${a.rule_id}' not found.` : `FIREWALL FILTER RULE DETAILS:
+      return isEmpty(result) ? `Firewall filter rule '${a.rule_id}' not found.` : `FIREWALL FILTER RULE DETAILS:
 
 ${result}`;
     }
@@ -10283,14 +10377,13 @@ ${result}`;
     inputSchema: { rule_id: z28.string() },
     async handler(a, ctx) {
       ctx.info(`Removing firewall filter rule: rule_id=${a.rule_id}`);
-      const id = /^\d+$/.test(a.rule_id) ? `*${a.rule_id}` : a.rule_id;
-      const count = await executeMikrotikCommand(`/ip firewall filter print count-only where .id=${id}`, ctx);
-      if (count.trim() === "0")
-        return `Firewall filter rule with ID '${a.rule_id}' not found.`;
+      const id = await resolveFilterRuleId(a.rule_id, ctx);
+      if (!id)
+        return `Firewall filter rule '${a.rule_id}' not found.`;
       const result = await executeMikrotikCommand(`/ip firewall filter remove ${id}`, ctx);
       if (looksLikeError(result))
         return `Failed to remove firewall filter rule: ${result}`;
-      return `Firewall filter rule with ID '${a.rule_id}' removed successfully.`;
+      return `Firewall filter rule '${a.rule_id}' (${id}) removed successfully.`;
     }
   }),
   defineTool({
@@ -10304,14 +10397,13 @@ ${result}`;
     },
     async handler(a, ctx) {
       ctx.info(`Moving firewall filter rule: rule_id=${a.rule_id} to position ${a.destination}`);
-      const id = /^\d+$/.test(a.rule_id) ? `*${a.rule_id}` : a.rule_id;
-      const count = await executeMikrotikCommand(`/ip firewall filter print count-only where .id=${id}`, ctx);
-      if (count.trim() === "0")
-        return `Firewall filter rule with ID '${a.rule_id}' not found.`;
+      const id = await resolveFilterRuleId(a.rule_id, ctx);
+      if (!id)
+        return `Firewall filter rule '${a.rule_id}' not found.`;
       const result = await executeMikrotikCommand(`/ip firewall filter move ${id} destination=${a.destination}`, ctx);
       if (looksLikeError(result))
         return `Failed to move firewall filter rule: ${result}`;
-      return `Firewall filter rule with ID '${a.rule_id}' moved to position ${a.destination}.`;
+      return `Firewall filter rule '${a.rule_id}' (${id}) moved to position ${a.destination}.`;
     }
   }),
   defineTool({
@@ -20587,13 +20679,27 @@ function analyzeRootCause(data) {
     }
   }
   if (downInterfaces.length === 0 && errorInterfaces.length === 0) {
+    if (data.interfaces.length === 0) {
+      evidence.push({
+        dimension: "interfaces",
+        severity: "warning",
+        summary: "Interface data unavailable \u2014 the device returned no parseable interface records. " + "Run `/interface print detail` manually to verify."
+      });
+    } else {
+      evidence.push({
+        dimension: "interfaces",
+        severity: "ok",
+        summary: `All ${data.interfaces.length} interfaces healthy`
+      });
+    }
+  }
+  if (data.routeCount === 0) {
     evidence.push({
-      dimension: "interfaces",
-      severity: "ok",
-      summary: `All ${data.interfaces.length} interfaces healthy`
+      dimension: "routing",
+      severity: "warning",
+      summary: "Route data unavailable \u2014 the device returned no parseable route records. " + "Run `/ip route print detail` manually to verify."
     });
-  }
-  if (!data.defaultRouteExists) {
+  } else if (!data.defaultRouteExists) {
     evidence.push({
       dimension: "routing",
       severity: "critical",
@@ -20606,7 +20712,7 @@ function analyzeRootCause(data) {
       summary: `Default route present, ${data.routeCount} total routes`
     });
   }
-  const ospfDown = data.ospfNeighbors.filter((n) => n.state.toLowerCase() !== "full");
+  const ospfDown = data.ospfNeighbors.filter((n) => (n.id || n.address) && n.state.toLowerCase() !== "full");
   for (const n of ospfDown) {
     evidence.push({
       dimension: "routing",
@@ -20615,7 +20721,7 @@ function analyzeRootCause(data) {
       reference: n.id
     });
   }
-  const bgpDown = data.bgpPeers.filter((p) => !p.state.toLowerCase().includes("established"));
+  const bgpDown = data.bgpPeers.filter((p) => (p.id || p.address) && !p.state.toLowerCase().includes("established"));
   for (const p of bgpDown) {
     evidence.push({
       dimension: "routing",
@@ -20718,7 +20824,13 @@ function analyzeRootCause(data) {
       summary: "No DNS servers configured"
     });
   }
-  if (data.cpuLoad > 90) {
+  if (data.cpuLoad === 0 && data.memoryUsedPct === 0 && !data.rosVersion && !data.uptime) {
+    evidence.push({
+      dimension: "resources",
+      severity: "warning",
+      summary: "System resource data unavailable \u2014 CPU 0%, memory 0%, no version or uptime. " + "The `/system resource print` output may not have been parsed correctly."
+    });
+  } else if (data.cpuLoad > 90) {
     evidence.push({
       dimension: "resources",
       severity: "critical",
@@ -20737,24 +20849,26 @@ function analyzeRootCause(data) {
       summary: `CPU load: ${data.cpuLoad}%`
     });
   }
-  if (data.memoryUsedPct > 90) {
-    evidence.push({
-      dimension: "resources",
-      severity: "critical",
-      summary: `Memory critically low: ${data.memoryUsedPct}% used`
-    });
-  } else if (data.memoryUsedPct > 75) {
-    evidence.push({
-      dimension: "resources",
-      severity: "warning",
-      summary: `Memory pressure: ${data.memoryUsedPct}% used`
-    });
-  } else {
-    evidence.push({
-      dimension: "resources",
-      severity: "ok",
-      summary: `Memory: ${data.memoryUsedPct}% used`
-    });
+  if (data.rosVersion || data.uptime || data.cpuLoad > 0 || data.memoryUsedPct > 0) {
+    if (data.memoryUsedPct > 90) {
+      evidence.push({
+        dimension: "resources",
+        severity: "critical",
+        summary: `Memory critically low: ${data.memoryUsedPct}% used`
+      });
+    } else if (data.memoryUsedPct > 75) {
+      evidence.push({
+        dimension: "resources",
+        severity: "warning",
+        summary: `Memory pressure: ${data.memoryUsedPct}% used`
+      });
+    } else {
+      evidence.push({
+        dimension: "resources",
+        severity: "ok",
+        summary: `Memory: ${data.memoryUsedPct}% used`
+      });
+    }
   }
   const errorLogs = data.relevantLogs.filter((l) => l.topics.includes("error") || l.topics.includes("critical") || l.topics.includes("warning"));
   const firewallLogs = data.relevantLogs.filter((l) => l.topics.includes("firewall"));
@@ -20791,14 +20905,24 @@ function analyzeRootCause(data) {
       summary: "No concerning log entries in the last 10 minutes"
     });
   }
+  const isServerBinding = (t) => /-(in|server)$/.test(t.type) || t.name.startsWith("<");
   const downTunnels = data.tunnelInterfaces.filter((t) => !t.running && !t.disabled);
   for (const t of downTunnels) {
-    evidence.push({
-      dimension: "vpn",
-      severity: "critical",
-      summary: `Tunnel ${t.name} (${t.type}) is down`,
-      reference: t.name
-    });
+    if (isServerBinding(t)) {
+      evidence.push({
+        dimension: "vpn",
+        severity: "info",
+        summary: `Server binding ${t.name} (${t.type}) is idle \u2014 no active client session`,
+        reference: t.name
+      });
+    } else {
+      evidence.push({
+        dimension: "vpn",
+        severity: "critical",
+        summary: `Tunnel ${t.name} (${t.type}) is down`,
+        reference: t.name
+      });
+    }
   }
   if (data.tunnelInterfaces.length > 0 && downTunnels.length === 0) {
     evidence.push({
@@ -20808,6 +20932,19 @@ function analyzeRootCause(data) {
     });
   }
   correlateRootCauses(data, evidence, rootCauses);
+  if (data.ping && data.ping.lossPct === 0) {
+    const contradicted = new Set([
+      "Missing default route",
+      "Missing source NAT / masquerade",
+      "Interface link failure"
+    ]);
+    for (const rc of rootCauses) {
+      if (contradicted.has(rc.cause) && rc.confidence !== "low") {
+        rc.confidence = "low";
+        rc.explanation += " (Note: ping to the target succeeded with 0% loss, which contradicts this hypothesis.)";
+      }
+    }
+  }
   rootCauses.sort((a, b) => CONFIDENCE_RANK[a.confidence] - CONFIDENCE_RANK[b.confidence]);
   const dimensionSummary = ALL_DIMENSIONS.map((dim) => {
     const dimEvidence = evidence.filter((e) => e.dimension === dim);
@@ -20946,14 +21083,15 @@ function correlateRootCauses(data, evidence, causes) {
       });
     }
   }
-  const downTunnels = data.tunnelInterfaces.filter((t) => !t.running && !t.disabled);
-  if (downTunnels.length > 0) {
+  const isServerTunnel = (t) => /-(in|server)$/.test(t.type) || t.name.startsWith("<");
+  const realDownTunnels = data.tunnelInterfaces.filter((t) => !t.running && !t.disabled && !isServerTunnel(t));
+  if (realDownTunnels.length > 0) {
     causes.push({
       cause: "VPN/tunnel interface down",
-      explanation: `Tunnel(s) ${downTunnels.map((t) => `${t.name} (${t.type})`).join(", ")} are down. ` + "Traffic destined for remote networks over these tunnels will be black-holed.",
+      explanation: `Tunnel(s) ${realDownTunnels.map((t) => `${t.name} (${t.type})`).join(", ")} are down. ` + "Traffic destined for remote networks over these tunnels will be black-holed.",
       confidence: "high",
       evidence: evidence.filter((e) => e.dimension === "vpn" && e.severity === "critical"),
-      fixes: downTunnels.map((t) => `/interface enable [find name="${t.name}"]`),
+      fixes: realDownTunnels.map((t) => `/interface enable [find name="${t.name}"]`),
       dimensions: ["vpn"]
     });
   }
@@ -21182,7 +21320,7 @@ async function collectRoutes(ctx) {
 }
 async function collectOspfNeighbors(ctx) {
   const raw = await safe("/routing ospf neighbor print detail", ctx);
-  if (!raw)
+  if (!raw || isEmpty(raw))
     return [];
   return parseRecords(raw).rows.map((r) => ({
     id: r["neighbor-id"] ?? r.router ?? "",
@@ -21190,13 +21328,13 @@ async function collectOspfNeighbors(ctx) {
     state: r.state ?? "",
     interface: r.interface ?? "",
     uptime: r.uptime
-  }));
+  })).filter((n) => n.id || n.address);
 }
 async function collectBgpPeers(ctx) {
   const raw = await safe("/routing bgp session print detail", ctx);
-  if (!raw) {
+  if (!raw || isEmpty(raw)) {
     const raw2 = await safe("/routing bgp peer print detail", ctx);
-    if (!raw2)
+    if (!raw2 || isEmpty(raw2))
       return [];
     return parseRecords(raw2).rows.map((r) => ({
       id: r.name ?? "",
@@ -21204,7 +21342,7 @@ async function collectBgpPeers(ctx) {
       state: r.state ?? "",
       interface: r.interface ?? "",
       uptime: r.uptime
-    }));
+    })).filter((p) => p.id || p.address);
   }
   return parseRecords(raw).rows.map((r) => ({
     id: r.name ?? r["remote.address"] ?? "",
@@ -21212,7 +21350,7 @@ async function collectBgpPeers(ctx) {
     state: r.state ?? r.established ?? "",
     interface: r.interface ?? "",
     uptime: r.uptime
-  }));
+  })).filter((p) => p.id || p.address);
 }
 async function collectFirewallRules(target, ctx) {
   const raw = await safe("/ip firewall filter print detail", ctx);
@@ -21312,7 +21450,7 @@ async function collectDiagnosticData(target, ctx, dimensions) {
     arpEntries,
     dhcpLeases,
     dnsResult,
-    dnsSettingsRaw,
+    dnsSettingsParts,
     resourceRaw,
     logs,
     tunnels
@@ -21328,13 +21466,17 @@ async function collectDiagnosticData(target, ctx, dimensions) {
     dims.has("arp_dhcp") ? collectArp(ctx) : Promise.resolve([]),
     dims.has("arp_dhcp") ? collectDhcpLeases(ctx) : Promise.resolve([]),
     dims.has("dns") && !isIpLike(target) ? safe(`[:resolve ${quoteValue(target)}]`, ctx) : Promise.resolve(undefined),
-    dims.has("dns") ? safe("/ip dns print", ctx) : Promise.resolve(""),
+    dims.has("dns") ? Promise.all([
+      safe(":put [/ip dns get servers]", ctx),
+      safe(":put [/ip dns get dynamic-servers]", ctx),
+      safe(":put [/ip dns get allow-remote-requests]", ctx)
+    ]) : Promise.resolve(["", "", ""]),
     dims.has("resources") ? safe("/system resource print", ctx) : Promise.resolve(""),
     dims.has("logs") ? collectLogs(target, ctx) : Promise.resolve([]),
     dims.has("vpn") ? collectTunnels(ctx) : Promise.resolve([])
   ]);
   const ping = pingResult ? parsePingSummary(pingResult) ?? undefined : undefined;
-  const dnsKv = parseKeyValues(dnsSettingsRaw);
+  const [dnsServersRaw, dnsDynamicRaw, dnsAllowRemoteRaw] = dnsSettingsParts;
   const resKv = parseKeyValues(resourceRaw);
   const totalMem = parseSize(resKv["total-memory"]) ?? 0;
   const freeMem = parseSize(resKv["free-memory"]) ?? 0;
@@ -21356,8 +21498,8 @@ async function collectDiagnosticData(target, ctx, dimensions) {
     arpEntries,
     dhcpLeases,
     dnsResolveResult: dnsResult ?? undefined,
-    dnsServers: [dnsKv.servers, dnsKv["dynamic-servers"]].filter(Boolean).join(",") || "",
-    dnsAllowRemote: (dnsKv["allow-remote-requests"] ?? "").toLowerCase() === "yes",
+    dnsServers: [dnsServersRaw.trim(), dnsDynamicRaw.trim()].filter(Boolean).join(",") || "",
+    dnsAllowRemote: dnsAllowRemoteRaw.trim().toLowerCase() === "yes" || dnsAllowRemoteRaw.trim().toLowerCase() === "true",
     cpuLoad: parsePercent(resKv["cpu-load"]) ?? 0,
     memoryUsedPct: memUsedPct,
     uptime: resKv.uptime ?? "",