@usex/mikrotik-mcp 3.59.0 → 4.0.0

package/dist/shared/{cli-jq168zrj.js → cli-athwegwy.js}

@@ -436,7 +436,22 @@ function parseDevicesSource(raw, fromFile) {
   const mcp = structured && obj.mcp && typeof obj.mcp === "object" ? obj.mcp : undefined;
   const ssh = structured && obj.ssh && typeof obj.ssh === "object" ? obj.ssh : undefined;
   const memory = structured && obj.memory && typeof obj.memory === "object" ? obj.memory : undefined;
-  return { devices, defaultDevice, s3, dashboard, tools, mcp, ssh, memory };
+  const readOnly = structured && typeof obj.readOnly === "boolean" ? obj.readOnly : undefined;
+  const disableUpdateCheck = structured && typeof obj.disableUpdateCheck === "boolean" ? obj.disableUpdateCheck : undefined;
+  const backupDir = structured && typeof obj.backupDir === "string" ? obj.backupDir : undefined;
+  return {
+    devices,
+    defaultDevice,
+    s3,
+    dashboard,
+    tools,
+    mcp,
+    ssh,
+    memory,
+    readOnly,
+    disableUpdateCheck,
+    backupDir
+  };
 }
 var configSource = { path: DEFAULT_CONFIG_FILE, fromFile: false };
 function getConfigSource() {
@@ -445,6 +460,13 @@ function getConfigSource() {
 function loadConfig(argv = process.argv.slice(2)) {
   const flags = parseFlags(argv);
   const pick = (flag, ...envNames) => flags[flag] ?? env(...envNames);
+  const overlay = (file, over) => {
+    const out = { ...file };
+    for (const [k, v] of Object.entries(over))
+      if (v !== undefined)
+        out[k] = v;
+    return out;
+  };
   const jumpHostName = pick("jump-host", "MIKROTIK_JUMP_HOST");
   const jumpHost = jumpHostName ? {
     host: jumpHostName,
@@ -485,6 +507,9 @@ function loadConfig(argv = process.argv.slice(2)) {
   let fileMcp;
   let fileSsh;
   let fileMemory;
+  let fileReadOnly;
+  let fileDisableUpdateCheck;
+  let fileBackupDir;
   if (configFile || devicesInline) {
     const src = configFile ? parseDevicesSource(configFile, true) : parseDevicesSource(devicesInline, false);
     for (const [name, dc] of Object.entries(src.devices))
@@ -499,8 +524,11 @@ function loadConfig(argv = process.argv.slice(2)) {
     fileMcp = src.mcp;
     fileSsh = src.ssh;
     fileMemory = src.memory;
+    fileReadOnly = src.readOnly;
+    fileDisableUpdateCheck = src.disableUpdateCheck;
+    fileBackupDir = src.backupDir;
   }
-  const s3 = {
+  const s3 = overlay(fileS3, {
     accessKeyId: pick("s3-access-key-id", "S3_ACCESS_KEY_ID", "AWS_ACCESS_KEY_ID"),
     secretAccessKey: pick("s3-secret-access-key", "S3_SECRET_ACCESS_KEY", "AWS_SECRET_ACCESS_KEY"),
     sessionToken: pick("s3-session-token", "S3_SESSION_TOKEN", "AWS_SESSION_TOKEN"),
@@ -508,12 +536,11 @@ function loadConfig(argv = process.argv.slice(2)) {
     endpoint: pick("s3-endpoint", "S3_ENDPOINT", "AWS_ENDPOINT"),
     bucket: pick("s3-bucket", "S3_BUCKET", "AWS_BUCKET"),
     prefix: pick("s3-prefix", "MIKROTIK_S3_PREFIX"),
-    presignExpiresIn: pick("s3-presign-expires-in", "MIKROTIK_S3_PRESIGN_EXPIRES_IN"),
-    ...fileS3
-  };
+    presignExpiresIn: pick("s3-presign-expires-in", "MIKROTIK_S3_PRESIGN_EXPIRES_IN")
+  });
   const appViewsRaw = pick("app-views", "MIKROTIK_MCP__APP_VIEWS");
   const appViewsEnv = appViewsRaw === undefined ? undefined : !/^(0|false|no|off)$/i.test(appViewsRaw);
-  const mcp = {
+  const mcp = overlay(fileMcp, {
     transport: pick("transport", "MIKROTIK_MCP__TRANSPORT", "MCP_TRANSPORT"),
     host: pick("mcp-host", "MIKROTIK_MCP__HOST"),
     port: pick("mcp-port", "MIKROTIK_MCP__PORT"),
@@ -521,22 +548,22 @@ function loadConfig(argv = process.argv.slice(2)) {
     allowedOrigins: pick("mcp-allowed-origins", "MIKROTIK_MCP__ALLOWED_ORIGINS"),
     corsOrigins: pick("mcp-cors-origins", "MIKROTIK_MCP__CORS_ORIGINS"),
     toolPageSize: pick("tool-page-size", "MIKROTIK_MCP__TOOL_PAGE_SIZE"),
-    appViews: appViewsEnv,
-    ...fileMcp
-  };
+    appViews: appViewsEnv
+  });
   const isTruthy = (v) => /^(1|true|yes|on)$/i.test(v ?? "");
-  const readOnly = isTruthy(pick("read-only", "MIKROTIK_READ_ONLY"));
-  const disableUpdateCheck = isTruthy(pick("disable-update-check", "MIKROTIK_DISABLE_UPDATE_CHECK"));
+  const boolFileFlag = (flagVal, fileVal) => flagVal !== undefined ? isTruthy(flagVal) : fileVal;
+  const readOnly = boolFileFlag(pick("read-only", "MIKROTIK_READ_ONLY"), fileReadOnly);
+  const disableUpdateCheck = boolFileFlag(pick("disable-update-check", "MIKROTIK_DISABLE_UPDATE_CHECK"), fileDisableUpdateCheck);
+  const backupDir = pick("backup-dir", "MIKROTIK_BACKUP_DIR") ?? fileBackupDir;
   const csv = (v) => v === undefined ? undefined : v.split(",").map((s) => s.trim()).filter(Boolean);
-  const tools = {
+  const tools = overlay(fileTools, {
     enabledModules: csv(pick("tools-enabled-modules", "MIKROTIK_TOOLS__ENABLED_MODULES")),
     disabledModules: csv(pick("tools-disabled-modules", "MIKROTIK_TOOLS__DISABLED_MODULES")),
     enabledGroups: csv(pick("tools-enabled-groups", "MIKROTIK_TOOLS__ENABLED_GROUPS")),
-    disabledGroups: csv(pick("tools-disabled-groups", "MIKROTIK_TOOLS__DISABLED_GROUPS")),
-    ...fileTools
-  };
+    disabledGroups: csv(pick("tools-disabled-groups", "MIKROTIK_TOOLS__DISABLED_GROUPS"))
+  });
   const boolOpt = (v) => v === undefined ? undefined : isTruthy(v);
-  const dashboard = {
+  const dashboard = overlay(fileDashboard, {
     enabled: boolOpt(pick("dashboard", "MIKROTIK_DASHBOARD__ENABLED", "MIKROTIK_DASHBOARD")),
     host: pick("dashboard-host", "MIKROTIK_DASHBOARD__HOST"),
     port: pick("dashboard-port", "MIKROTIK_DASHBOARD__PORT"),
@@ -545,20 +572,17 @@ function loadConfig(argv = process.argv.slice(2)) {
     captureBody: boolOpt(pick("dashboard-capture-body", "MIKROTIK_DASHBOARD__CAPTURE_BODY")),
     redactInput: boolOpt(pick("dashboard-redact-input", "MIKROTIK_DASHBOARD__REDACT_INPUT")),
     maxBodyBytes: pick("dashboard-max-body-bytes", "MIKROTIK_DASHBOARD__MAX_BODY_BYTES"),
-    token: pick("dashboard-token", "MIKROTIK_DASHBOARD__TOKEN"),
-    ...fileDashboard
-  };
-  const ssh = {
+    token: pick("dashboard-token", "MIKROTIK_DASHBOARD__TOKEN")
+  });
+  const ssh = overlay(fileSsh, {
     keepAlive: boolOpt(pick("ssh-keep-alive", "MIKROTIK_SSH__KEEP_ALIVE")),
     keepAliveInterval: pick("ssh-keepalive-interval", "MIKROTIK_SSH__KEEPALIVE_INTERVAL"),
-    idleTimeout: pick("ssh-idle-timeout", "MIKROTIK_SSH__IDLE_TIMEOUT"),
-    ...fileSsh
-  };
-  const memory = {
+    idleTimeout: pick("ssh-idle-timeout", "MIKROTIK_SSH__IDLE_TIMEOUT")
+  });
+  const memory = overlay(fileMemory, {
     enabled: boolOpt(pick("memory-enabled", "MIKROTIK_MEMORY__ENABLED")),
-    dbPath: pick("memory-db", "MIKROTIK_MEMORY__DB_PATH"),
-    ...fileMemory
-  };
+    dbPath: pick("memory-db", "MIKROTIK_MEMORY__DB_PATH")
+  });
   const hasS3 = !!(s3.accessKeyId || s3.bucket || s3.endpoint);
   const raw = {
     devices: Object.keys(devices).length ? devices : { default: {} },
@@ -567,6 +591,7 @@ function loadConfig(argv = process.argv.slice(2)) {
     dashboard,
     readOnly,
     disableUpdateCheck,
+    backupDir,
     tools,
     ssh,
     memory,
@@ -1208,6 +1233,8 @@ function stripAnsi(text) {
   return text.replace(ANSI_RE, "");
 }
 var CTRL_X = "\x18";
+var IDLE_TIMEOUT_MS = 15000;
+var HARD_CAP_MS = 120000;
 function isSafeModeActivated(response) {
   if (response.includes("<SAFE>"))
     return true;
@@ -1283,7 +1310,7 @@ class SafeModeManager {
 `);
       const { text, timedOut } = await this.readUntilPrompt();
       if (timedOut) {
-        throw new Error(`Safe Mode shell did not return a prompt within 15s (command: ${command}). The interactive ` + "session appears wedged \u2014 some RouterOS builds/terminals don't support Safe Mode over SSH. " + "Apply the change with the direct write tools instead (verify each with a read).");
+        throw new Error(`Safe Mode shell went silent for ${IDLE_TIMEOUT_MS / 1000}s (command: ${command}). The ` + "interactive session appears wedged \u2014 some RouterOS builds/terminals don't support Safe " + "Mode over SSH. Apply the change with the direct write tools instead (verify each with a read).");
       }
       return this.extractOutput(text, command);
     });
@@ -1337,25 +1364,32 @@ class SafeModeManager {
   status() {
     return this.active ? "Safe mode is ACTIVE. Changes are pending \u2014 they are NOT yet persisted. " + "Call commit_safe_mode to persist or rollback_safe_mode to revert." : "Safe mode is NOT active. Changes take effect and persist immediately.";
   }
-  readUntilPrompt(timeoutMs = 15000, isDone = (c) => PROMPT_RE.test(c)) {
+  readUntilPrompt(idleMs = IDLE_TIMEOUT_MS, isDone = (c) => PROMPT_RE.test(c), hardCapMs = HARD_CAP_MS) {
     const channel = this.channel;
     if (!channel)
       return Promise.resolve({ text: "", timedOut: false });
     return new Promise((resolve2) => {
       let buf = "";
-      let timer;
+      let idleTimer;
+      const hardTimer = setTimeout(() => finish(stripAnsi(buf), true), hardCapMs);
+      function armIdle2() {
+        clearTimeout(idleTimer);
+        idleTimer = setTimeout(() => finish(stripAnsi(buf), true), idleMs);
+      }
       function onData(chunk) {
         buf += decodeOutput(chunk);
+        armIdle2();
         const cleaned = stripAnsi(buf);
         if (isDone(cleaned))
           finish(cleaned, false);
       }
       function finish(result, timedOut) {
-        clearTimeout(timer);
+        clearTimeout(idleTimer);
+        clearTimeout(hardTimer);
         channel.removeListener("data", onData);
         resolve2({ text: result, timedOut });
       }
-      timer = setTimeout(() => finish(stripAnsi(buf), true), timeoutMs);
+      armIdle2();
       channel.on("data", onData);
     });
   }
@@ -5264,7 +5298,7 @@ var changePlanTools = [
       const enabled2 = await safe.enable();
       if (enabled2.startsWith("Error"))
         throw new Error(enabled2);
-      const APPLY_BUDGET_MS = 90000;
+      const APPLY_BUDGET_MS = 180000;
       const startedAt = Date.now();
       const overBudget = () => Date.now() - startedAt > APPLY_BUDGET_MS;
       const applyAndDiff = async () => {
@@ -8208,7 +8242,7 @@ var rawCommandTools = [
       if (!cmd)
         return "Provide a RouterOS command to run.";
       ctx.info(`Running raw RouterOS command: ${cmd}`);
-      const result = await executeMikrotikCommand(cmd, ctx);
+      const result = await executeMikrotikCommand(cmd, ctx, { maxMs: 30000 });
       if (looksLikeError(result))
         return `RouterOS command error: ${result}`;
       return result.trim() ? result : "(command completed with no output)";
@@ -8330,7 +8364,7 @@ var cache = null;
 async function gateway() {
   if (cache)
     return cache;
-  const { moduleCatalog } = await import("./cli-2dyvnv9v.js");
+  const { moduleCatalog } = await import("./cli-cjrk8g04.js");
   const forIndex = [];
   const byName = new Map;
   for (const mod of moduleCatalog) {
@@ -10527,7 +10561,30 @@ ${results.join(`
 
 // src/tools/firewall-nat.ts
 import { z as z29 } from "zod";
+
+// src/tools/_resolve-rule-id.ts
+function ruleResolver(scope) {
+  return async function resolveRuleId(ruleId, ctx) {
+    if (/^\d+$/.test(ruleId)) {
+      const id = `*${ruleId}`;
+      const byId = await executeMikrotikCommand(`${scope} print count-only where .id=${id}`, ctx);
+      if (byId.trim() !== "0")
+        return id;
+      const idsRaw = await executeMikrotikCommand(`:foreach i in=[${scope} find] do={:put $i}`, ctx);
+      if (isEmpty(idsRaw))
+        return null;
+      const ids = idsRaw.trim().split(/\r?\n/).map((l) => l.trim()).filter(Boolean);
+      const pos = Number.parseInt(ruleId, 10);
+      return pos >= 0 && pos < ids.length ? ids[pos] : null;
+    }
+    const count = await executeMikrotikCommand(`${scope} print count-only where .id=${ruleId}`, ctx);
+    return count.trim() !== "0" ? ruleId : null;
+  };
+}
+
+// src/tools/firewall-nat.ts
 var isDigits2 = (s) => /^\d+$/.test(s);
+var resolveNatRuleId = ruleResolver("/ip firewall nat");
 async function updateNatRule(a, ctx) {
   ctx.info(`Updating NAT rule: rule_id=${a.rule_id}`);
   const updates = [];
@@ -10603,11 +10660,14 @@ async function updateNatRule(a, ctx) {
   }
   if (updates.length === 0)
     return "No updates specified.";
-  const cmd = `/ip firewall nat set ${a.rule_id} ${updates.join(" ")}`;
+  const id = await resolveNatRuleId(a.rule_id, ctx);
+  if (!id)
+    return `NAT rule '${a.rule_id}' not found.`;
+  const cmd = `/ip firewall nat set ${id} ${updates.join(" ")}`;
   const result = await executeMikrotikCommand(cmd, ctx);
   if (looksLikeError(result))
     return `Failed to update NAT rule: ${result}`;
-  const details = await executeMikrotikCommand(`/ip firewall nat print detail where .id=${a.rule_id}`, ctx);
+  const details = await executeMikrotikCommand(`/ip firewall nat print detail where .id=${id}`, ctx);
   return `NAT rule updated successfully:
 
 ${details}`;
@@ -10785,8 +10845,11 @@ ${result}`;
     },
     async handler(a, ctx) {
       ctx.info(`Getting NAT rule details: rule_id=${a.rule_id}`);
-      const result = await executeMikrotikCommand(`/ip firewall nat print detail where .id=${a.rule_id}`, ctx);
-      return isEmpty(result) ? `NAT rule with ID '${a.rule_id}' not found.` : `NAT RULE DETAILS:
+      const id = await resolveNatRuleId(a.rule_id, ctx);
+      if (!id)
+        return `NAT rule '${a.rule_id}' not found.`;
+      const result = await executeMikrotikCommand(`/ip firewall nat print detail where .id=${id}`, ctx);
+      return isEmpty(result) ? `NAT rule '${a.rule_id}' not found.` : `NAT RULE DETAILS:
 
 ${result}`;
     }
@@ -10868,13 +10931,13 @@ ${result}`;
     inputSchema: { rule_id: z29.string() },
     async handler(a, ctx) {
       ctx.info(`Removing NAT rule: rule_id=${a.rule_id}`);
-      const count = await executeMikrotikCommand(`/ip firewall nat print count-only where .id=${a.rule_id}`, ctx);
-      if (count.trim() === "0")
-        return `NAT rule with ID '${a.rule_id}' not found.`;
-      const result = await executeMikrotikCommand(`/ip firewall nat remove ${a.rule_id}`, ctx);
+      const id = await resolveNatRuleId(a.rule_id, ctx);
+      if (!id)
+        return `NAT rule '${a.rule_id}' not found.`;
+      const result = await executeMikrotikCommand(`/ip firewall nat remove ${id}`, ctx);
       if (looksLikeError(result))
         return `Failed to remove NAT rule: ${result}`;
-      return `NAT rule with ID '${a.rule_id}' removed successfully.`;
+      return `NAT rule '${a.rule_id}' (${id}) removed successfully.`;
     }
   }),
   defineTool({
@@ -10888,13 +10951,13 @@ ${result}`;
     },
     async handler(a, ctx) {
       ctx.info(`Moving NAT rule: rule_id=${a.rule_id} to position ${a.destination}`);
-      const count = await executeMikrotikCommand(`/ip firewall nat print count-only where .id=${a.rule_id}`, ctx);
-      if (count.trim() === "0")
-        return `NAT rule with ID '${a.rule_id}' not found.`;
-      const result = await executeMikrotikCommand(`/ip firewall nat move ${a.rule_id} destination=${a.destination}`, ctx);
+      const id = await resolveNatRuleId(a.rule_id, ctx);
+      if (!id)
+        return `NAT rule '${a.rule_id}' not found.`;
+      const result = await executeMikrotikCommand(`/ip firewall nat move ${id} destination=${a.destination}`, ctx);
       if (looksLikeError(result))
         return `Failed to move NAT rule: ${result}`;
-      return `NAT rule with ID '${a.rule_id}' moved to position ${a.destination}.`;
+      return `NAT rule '${a.rule_id}' (${id}) moved to position ${a.destination}.`;
     }
   }),
   defineTool({
@@ -10922,6 +10985,7 @@ ${result}`;
 // src/tools/firewall-mangle.ts
 import { z as z30 } from "zod";
 var isDigits3 = (s) => /^\d+$/.test(s);
+var resolveMangleRuleId = ruleResolver("/ip firewall mangle");
 async function updateMangleRule(a, ctx) {
   ctx.info(`Updating mangle rule: rule_id=${a.rule_id}`);
   const updates = [];
@@ -11007,11 +11071,14 @@ async function updateMangleRule(a, ctx) {
   }
   if (updates.length === 0)
     return "No updates specified.";
-  const cmd = `/ip firewall mangle set ${a.rule_id} ${updates.join(" ")}`;
+  const id = await resolveMangleRuleId(a.rule_id, ctx);
+  if (!id)
+    return `Mangle rule '${a.rule_id}' not found.`;
+  const cmd = `/ip firewall mangle set ${id} ${updates.join(" ")}`;
   const result = await executeMikrotikCommand(cmd, ctx);
   if (looksLikeError(result))
     return `Failed to update mangle rule: ${result}`;
-  const details = await executeMikrotikCommand(`/ip firewall mangle print detail where .id=${a.rule_id}`, ctx);
+  const details = await executeMikrotikCommand(`/ip firewall mangle print detail where .id=${id}`, ctx);
   return `Mangle rule updated successfully:
 
 ${details}`;
@@ -11186,8 +11253,11 @@ ${result}`;
     },
     async handler(a, ctx) {
       ctx.info(`Getting mangle rule details: rule_id=${a.rule_id}`);
-      const result = await executeMikrotikCommand(`/ip firewall mangle print detail where .id=${a.rule_id}`, ctx);
-      return isEmpty(result) ? `Mangle rule with ID '${a.rule_id}' not found.` : `MANGLE RULE DETAILS:
+      const id = await resolveMangleRuleId(a.rule_id, ctx);
+      if (!id)
+        return `Mangle rule '${a.rule_id}' not found.`;
+      const result = await executeMikrotikCommand(`/ip firewall mangle print detail where .id=${id}`, ctx);
+      return isEmpty(result) ? `Mangle rule '${a.rule_id}' not found.` : `MANGLE RULE DETAILS:
 
 ${result}`;
     }
@@ -11278,13 +11348,13 @@ ${result}`;
     inputSchema: { rule_id: z30.string() },
     async handler(a, ctx) {
       ctx.info(`Removing mangle rule: rule_id=${a.rule_id}`);
-      const count = await executeMikrotikCommand(`/ip firewall mangle print count-only where .id=${a.rule_id}`, ctx);
-      if (count.trim() === "0")
-        return `Mangle rule with ID '${a.rule_id}' not found.`;
-      const result = await executeMikrotikCommand(`/ip firewall mangle remove ${a.rule_id}`, ctx);
+      const id = await resolveMangleRuleId(a.rule_id, ctx);
+      if (!id)
+        return `Mangle rule '${a.rule_id}' not found.`;
+      const result = await executeMikrotikCommand(`/ip firewall mangle remove ${id}`, ctx);
       if (looksLikeError(result))
         return `Failed to remove mangle rule: ${result}`;
-      return `Mangle rule with ID '${a.rule_id}' removed successfully.`;
+      return `Mangle rule '${a.rule_id}' (${id}) removed successfully.`;
     }
   }),
   defineTool({
@@ -11298,13 +11368,13 @@ ${result}`;
     },
     async handler(a, ctx) {
       ctx.info(`Moving mangle rule: rule_id=${a.rule_id} to position ${a.destination}`);
-      const count = await executeMikrotikCommand(`/ip firewall mangle print count-only where .id=${a.rule_id}`, ctx);
-      if (count.trim() === "0")
-        return `Mangle rule with ID '${a.rule_id}' not found.`;
-      const result = await executeMikrotikCommand(`/ip firewall mangle move ${a.rule_id} destination=${a.destination}`, ctx);
+      const id = await resolveMangleRuleId(a.rule_id, ctx);
+      if (!id)
+        return `Mangle rule '${a.rule_id}' not found.`;
+      const result = await executeMikrotikCommand(`/ip firewall mangle move ${id} destination=${a.destination}`, ctx);
       if (looksLikeError(result))
         return `Failed to move mangle rule: ${result}`;
-      return `Mangle rule with ID '${a.rule_id}' moved to position ${a.destination}.`;
+      return `Mangle rule '${a.rule_id}' (${id}) moved to position ${a.destination}.`;
     }
   }),
   defineTool({
@@ -13440,6 +13510,7 @@ ${result}`;
 // src/tools/ipv6-firewall-filter.ts
 import { z as z44 } from "zod";
 var isDigits4 = (s) => /^\d+$/.test(s);
+var resolveRuleId = ruleResolver("/ipv6 firewall filter");
 async function updateFilterRule2(a, ctx) {
   ctx.info(`Updating IPv6 firewall filter rule: rule_id=${a.rule_id}`);
   const updates = [];
@@ -13508,11 +13579,14 @@ async function updateFilterRule2(a, ctx) {
   }
   if (updates.length === 0)
     return "No updates specified.";
-  const cmd = `/ipv6 firewall filter set ${a.rule_id} ${updates.join(" ")}`;
+  const id = await resolveRuleId(a.rule_id, ctx);
+  if (!id)
+    return `IPv6 firewall filter rule '${a.rule_id}' not found.`;
+  const cmd = `/ipv6 firewall filter set ${id} ${updates.join(" ")}`;
   const result = await executeMikrotikCommand(cmd, ctx);
   if (looksLikeError(result))
     return `Failed to update IPv6 firewall filter rule: ${result}`;
-  const details = await executeMikrotikCommand(`/ipv6 firewall filter print detail where .id=${a.rule_id}`, ctx);
+  const details = await executeMikrotikCommand(`/ipv6 firewall filter print detail where .id=${id}`, ctx);
   return `IPv6 firewall filter rule updated successfully:
 
 ${details}`;
@@ -13669,8 +13743,11 @@ ${result}`;
     },
     async handler(a, ctx) {
       ctx.info(`Getting IPv6 firewall filter rule details: rule_id=${a.rule_id}`);
-      const result = await executeMikrotikCommand(`/ipv6 firewall filter print detail where .id=${a.rule_id}`, ctx);
-      return isEmpty(result) ? `IPv6 firewall filter rule with ID '${a.rule_id}' not found.` : `IPV6 FIREWALL FILTER RULE DETAILS:
+      const id = await resolveRuleId(a.rule_id, ctx);
+      if (!id)
+        return `IPv6 firewall filter rule '${a.rule_id}' not found.`;
+      const result = await executeMikrotikCommand(`/ipv6 firewall filter print detail where .id=${id}`, ctx);
+      return isEmpty(result) ? `IPv6 firewall filter rule '${a.rule_id}' not found.` : `IPV6 FIREWALL FILTER RULE DETAILS:
 
 ${result}`;
     }
@@ -13746,13 +13823,13 @@ ${result}`;
     inputSchema: { rule_id: z44.string() },
     async handler(a, ctx) {
       ctx.info(`Removing IPv6 firewall filter rule: rule_id=${a.rule_id}`);
-      const count = await executeMikrotikCommand(`/ipv6 firewall filter print count-only where .id=${a.rule_id}`, ctx);
-      if (count.trim() === "0")
-        return `IPv6 firewall filter rule with ID '${a.rule_id}' not found.`;
-      const result = await executeMikrotikCommand(`/ipv6 firewall filter remove ${a.rule_id}`, ctx);
+      const id = await resolveRuleId(a.rule_id, ctx);
+      if (!id)
+        return `IPv6 firewall filter rule '${a.rule_id}' not found.`;
+      const result = await executeMikrotikCommand(`/ipv6 firewall filter remove ${id}`, ctx);
       if (looksLikeError(result))
         return `Failed to remove IPv6 firewall filter rule: ${result}`;
-      return `IPv6 firewall filter rule with ID '${a.rule_id}' removed successfully.`;
+      return `IPv6 firewall filter rule '${a.rule_id}' (${id}) removed successfully.`;
     }
   }),
   defineTool({
@@ -13766,13 +13843,13 @@ ${result}`;
     },
     async handler(a, ctx) {
       ctx.info(`Moving IPv6 firewall filter rule: rule_id=${a.rule_id} to position ${a.destination}`);
-      const count = await executeMikrotikCommand(`/ipv6 firewall filter print count-only where .id=${a.rule_id}`, ctx);
-      if (count.trim() === "0")
-        return `IPv6 firewall filter rule with ID '${a.rule_id}' not found.`;
-      const result = await executeMikrotikCommand(`/ipv6 firewall filter move ${a.rule_id} destination=${a.destination}`, ctx);
+      const id = await resolveRuleId(a.rule_id, ctx);
+      if (!id)
+        return `IPv6 firewall filter rule '${a.rule_id}' not found.`;
+      const result = await executeMikrotikCommand(`/ipv6 firewall filter move ${id} destination=${a.destination}`, ctx);
       if (looksLikeError(result))
         return `Failed to move IPv6 firewall filter rule: ${result}`;
-      return `IPv6 firewall filter rule with ID '${a.rule_id}' moved to position ${a.destination}.`;
+      return `IPv6 firewall filter rule '${a.rule_id}' (${id}) moved to position ${a.destination}.`;
     }
   }),
   defineTool({
@@ -13800,6 +13877,7 @@ ${result}`;
 // src/tools/ipv6-firewall-nat.ts
 import { z as z45 } from "zod";
 var isDigits5 = (s) => /^\d+$/.test(s);
+var resolveRuleId2 = ruleResolver("/ipv6 firewall nat");
 async function updateNatRule2(a, ctx) {
   ctx.info(`Updating IPv6 firewall NAT rule: rule_id=${a.rule_id}`);
   const updates = [];
@@ -13867,11 +13945,14 @@ async function updateNatRule2(a, ctx) {
   }
   if (updates.length === 0)
     return "No updates specified.";
-  const cmd = `/ipv6 firewall nat set ${a.rule_id} ${updates.join(" ")}`;
+  const id = await resolveRuleId2(a.rule_id, ctx);
+  if (!id)
+    return `IPv6 NAT rule '${a.rule_id}' not found.`;
+  const cmd = `/ipv6 firewall nat set ${id} ${updates.join(" ")}`;
   const result = await executeMikrotikCommand(cmd, ctx);
   if (looksLikeError(result))
     return `Failed to update IPv6 firewall NAT rule: ${result}`;
-  const details = await executeMikrotikCommand(`/ipv6 firewall nat print detail where .id=${a.rule_id}`, ctx);
+  const details = await executeMikrotikCommand(`/ipv6 firewall nat print detail where .id=${id}`, ctx);
   return `IPv6 firewall NAT rule updated successfully:
 
 ${details}`;
@@ -14022,8 +14103,11 @@ ${result}`;
     },
     async handler(a, ctx) {
       ctx.info(`Getting IPv6 firewall NAT rule details: rule_id=${a.rule_id}`);
-      const result = await executeMikrotikCommand(`/ipv6 firewall nat print detail where .id=${a.rule_id}`, ctx);
-      return isEmpty(result) ? `IPv6 firewall NAT rule with ID '${a.rule_id}' not found.` : `IPV6 FIREWALL NAT RULE DETAILS:
+      const id = await resolveRuleId2(a.rule_id, ctx);
+      if (!id)
+        return `IPv6 firewall NAT rule '${a.rule_id}' not found.`;
+      const result = await executeMikrotikCommand(`/ipv6 firewall nat print detail where .id=${id}`, ctx);
+      return isEmpty(result) ? `IPv6 firewall NAT rule '${a.rule_id}' not found.` : `IPV6 FIREWALL NAT RULE DETAILS:
 
 ${result}`;
     }
@@ -14098,13 +14182,13 @@ ${result}`;
     inputSchema: { rule_id: z45.string() },
     async handler(a, ctx) {
       ctx.info(`Removing IPv6 firewall NAT rule: rule_id=${a.rule_id}`);
-      const count = await executeMikrotikCommand(`/ipv6 firewall nat print count-only where .id=${a.rule_id}`, ctx);
-      if (count.trim() === "0")
-        return `IPv6 firewall NAT rule with ID '${a.rule_id}' not found.`;
-      const result = await executeMikrotikCommand(`/ipv6 firewall nat remove ${a.rule_id}`, ctx);
+      const id = await resolveRuleId2(a.rule_id, ctx);
+      if (!id)
+        return `IPv6 firewall NAT rule '${a.rule_id}' not found.`;
+      const result = await executeMikrotikCommand(`/ipv6 firewall nat remove ${id}`, ctx);
       if (looksLikeError(result))
         return `Failed to remove IPv6 firewall NAT rule: ${result}`;
-      return `IPv6 firewall NAT rule with ID '${a.rule_id}' removed successfully.`;
+      return `IPv6 firewall NAT rule '${a.rule_id}' (${id}) removed successfully.`;
     }
   }),
   defineTool({
@@ -14118,13 +14202,13 @@ ${result}`;
     },
     async handler(a, ctx) {
       ctx.info(`Moving IPv6 firewall NAT rule: rule_id=${a.rule_id} to position ${a.destination}`);
-      const count = await executeMikrotikCommand(`/ipv6 firewall nat print count-only where .id=${a.rule_id}`, ctx);
-      if (count.trim() === "0")
-        return `IPv6 firewall NAT rule with ID '${a.rule_id}' not found.`;
-      const result = await executeMikrotikCommand(`/ipv6 firewall nat move ${a.rule_id} destination=${a.destination}`, ctx);
+      const id = await resolveRuleId2(a.rule_id, ctx);
+      if (!id)
+        return `IPv6 firewall NAT rule '${a.rule_id}' not found.`;
+      const result = await executeMikrotikCommand(`/ipv6 firewall nat move ${id} destination=${a.destination}`, ctx);
       if (looksLikeError(result))
         return `Failed to move IPv6 firewall NAT rule: ${result}`;
-      return `IPv6 firewall NAT rule with ID '${a.rule_id}' moved to position ${a.destination}.`;
+      return `IPv6 firewall NAT rule '${a.rule_id}' (${id}) moved to position ${a.destination}.`;
     }
   }),
   defineTool({
@@ -14152,6 +14236,7 @@ ${result}`;
 // src/tools/ipv6-firewall-mangle.ts
 import { z as z46 } from "zod";
 var isDigits6 = (s) => /^\d+$/.test(s);
+var resolveRuleId3 = ruleResolver("/ipv6 firewall mangle");
 async function updateMangleRule2(a, ctx) {
   ctx.info(`Updating IPv6 firewall mangle rule: rule_id=${a.rule_id}`);
   const updates = [];
@@ -14227,11 +14312,14 @@ async function updateMangleRule2(a, ctx) {
   }
   if (updates.length === 0)
     return "No updates specified.";
-  const cmd = `/ipv6 firewall mangle set ${a.rule_id} ${updates.join(" ")}`;
+  const id = await resolveRuleId3(a.rule_id, ctx);
+  if (!id)
+    return `IPv6 mangle rule '${a.rule_id}' not found.`;
+  const cmd = `/ipv6 firewall mangle set ${id} ${updates.join(" ")}`;
   const result = await executeMikrotikCommand(cmd, ctx);
   if (looksLikeError(result))
     return `Failed to update IPv6 firewall mangle rule: ${result}`;
-  const details = await executeMikrotikCommand(`/ipv6 firewall mangle print detail where .id=${a.rule_id}`, ctx);
+  const details = await executeMikrotikCommand(`/ipv6 firewall mangle print detail where .id=${id}`, ctx);
   return `IPv6 firewall mangle rule updated successfully:
 
 ${details}`;
@@ -14390,8 +14478,11 @@ ${result}`;
     },
     async handler(a, ctx) {
       ctx.info(`Getting IPv6 firewall mangle rule details: rule_id=${a.rule_id}`);
-      const result = await executeMikrotikCommand(`/ipv6 firewall mangle print detail where .id=${a.rule_id}`, ctx);
-      return isEmpty(result) ? `IPv6 firewall mangle rule with ID '${a.rule_id}' not found.` : `IPV6 FIREWALL MANGLE RULE DETAILS:
+      const id = await resolveRuleId3(a.rule_id, ctx);
+      if (!id)
+        return `IPv6 mangle rule '${a.rule_id}' not found.`;
+      const result = await executeMikrotikCommand(`/ipv6 firewall mangle print detail where .id=${id}`, ctx);
+      return isEmpty(result) ? `IPv6 mangle rule '${a.rule_id}' not found.` : `IPV6 FIREWALL MANGLE RULE DETAILS:
 
 ${result}`;
     }
@@ -14473,13 +14564,13 @@ ${result}`;
     inputSchema: { rule_id: z46.string() },
     async handler(a, ctx) {
       ctx.info(`Removing IPv6 firewall mangle rule: rule_id=${a.rule_id}`);
-      const count = await executeMikrotikCommand(`/ipv6 firewall mangle print count-only where .id=${a.rule_id}`, ctx);
-      if (count.trim() === "0")
-        return `IPv6 firewall mangle rule with ID '${a.rule_id}' not found.`;
-      const result = await executeMikrotikCommand(`/ipv6 firewall mangle remove ${a.rule_id}`, ctx);
+      const id = await resolveRuleId3(a.rule_id, ctx);
+      if (!id)
+        return `IPv6 mangle rule '${a.rule_id}' not found.`;
+      const result = await executeMikrotikCommand(`/ipv6 firewall mangle remove ${id}`, ctx);
       if (looksLikeError(result))
         return `Failed to remove IPv6 firewall mangle rule: ${result}`;
-      return `IPv6 firewall mangle rule with ID '${a.rule_id}' removed successfully.`;
+      return `IPv6 mangle rule '${a.rule_id}' (${id}) removed successfully.`;
     }
   }),
   defineTool({
@@ -14493,13 +14584,13 @@ ${result}`;
     },
     async handler(a, ctx) {
       ctx.info(`Moving IPv6 firewall mangle rule: rule_id=${a.rule_id} to position ${a.destination}`);
-      const count = await executeMikrotikCommand(`/ipv6 firewall mangle print count-only where .id=${a.rule_id}`, ctx);
-      if (count.trim() === "0")
-        return `IPv6 firewall mangle rule with ID '${a.rule_id}' not found.`;
-      const result = await executeMikrotikCommand(`/ipv6 firewall mangle move ${a.rule_id} destination=${a.destination}`, ctx);
+      const id = await resolveRuleId3(a.rule_id, ctx);
+      if (!id)
+        return `IPv6 mangle rule '${a.rule_id}' not found.`;
+      const result = await executeMikrotikCommand(`/ipv6 firewall mangle move ${id} destination=${a.destination}`, ctx);
       if (looksLikeError(result))
         return `Failed to move IPv6 firewall mangle rule: ${result}`;
-      return `IPv6 firewall mangle rule with ID '${a.rule_id}' moved to position ${a.destination}.`;
+      return `IPv6 mangle rule '${a.rule_id}' (${id}) moved to position ${a.destination}.`;
     }
   }),
   defineTool({
@@ -14527,6 +14618,7 @@ ${result}`;
 // src/tools/ipv6-firewall-raw.ts
 import { z as z47 } from "zod";
 var isDigits7 = (s) => /^\d+$/.test(s);
+var resolveRuleId4 = ruleResolver("/ipv6 firewall raw");
 async function updateRawRule(a, ctx) {
   ctx.info(`Updating IPv6 firewall raw rule: rule_id=${a.rule_id}`);
   const updates = [];
@@ -14572,11 +14664,14 @@ async function updateRawRule(a, ctx) {
   }
   if (updates.length === 0)
     return "No updates specified.";
-  const cmd = `/ipv6 firewall raw set ${a.rule_id} ${updates.join(" ")}`;
+  const id = await resolveRuleId4(a.rule_id, ctx);
+  if (!id)
+    return `IPv6 raw rule '${a.rule_id}' not found.`;
+  const cmd = `/ipv6 firewall raw set ${id} ${updates.join(" ")}`;
   const result = await executeMikrotikCommand(cmd, ctx);
   if (looksLikeError(result))
     return `Failed to update IPv6 firewall raw rule: ${result}`;
-  const details = await executeMikrotikCommand(`/ipv6 firewall raw print detail where .id=${a.rule_id}`, ctx);
+  const details = await executeMikrotikCommand(`/ipv6 firewall raw print detail where .id=${id}`, ctx);
   return `IPv6 firewall raw rule updated successfully:
 
 ${details}`;
@@ -14691,7 +14786,10 @@ ${result}`;
     },
     async handler(a, ctx) {
       ctx.info(`Getting IPv6 firewall raw rule details: rule_id=${a.rule_id}`);
-      const result = await executeMikrotikCommand(`/ipv6 firewall raw print detail where .id=${a.rule_id}`, ctx);
+      const id = await resolveRuleId4(a.rule_id, ctx);
+      if (!id)
+        return `IPv6 firewall raw rule with ID '${a.rule_id}' not found.`;
+      const result = await executeMikrotikCommand(`/ipv6 firewall raw print detail where .id=${id}`, ctx);
       return isEmpty(result) ? `IPv6 firewall raw rule with ID '${a.rule_id}' not found.` : `IPV6 FIREWALL RAW RULE DETAILS:
 
 ${result}`;
@@ -14745,13 +14843,13 @@ ${result}`;
     inputSchema: { rule_id: z47.string() },
     async handler(a, ctx) {
       ctx.info(`Removing IPv6 firewall raw rule: rule_id=${a.rule_id}`);
-      const count = await executeMikrotikCommand(`/ipv6 firewall raw print count-only where .id=${a.rule_id}`, ctx);
-      if (count.trim() === "0")
+      const id = await resolveRuleId4(a.rule_id, ctx);
+      if (!id)
         return `IPv6 firewall raw rule with ID '${a.rule_id}' not found.`;
-      const result = await executeMikrotikCommand(`/ipv6 firewall raw remove ${a.rule_id}`, ctx);
+      const result = await executeMikrotikCommand(`/ipv6 firewall raw remove ${id}`, ctx);
       if (looksLikeError(result))
         return `Failed to remove IPv6 firewall raw rule: ${result}`;
-      return `IPv6 firewall raw rule with ID '${a.rule_id}' removed successfully.`;
+      return `IPv6 firewall raw rule '${a.rule_id}' (${id}) removed successfully.`;
     }
   }),
   defineTool({
@@ -14765,13 +14863,13 @@ ${result}`;
     },
     async handler(a, ctx) {
       ctx.info(`Moving IPv6 firewall raw rule: rule_id=${a.rule_id} to position ${a.destination}`);
-      const count = await executeMikrotikCommand(`/ipv6 firewall raw print count-only where .id=${a.rule_id}`, ctx);
-      if (count.trim() === "0")
+      const id = await resolveRuleId4(a.rule_id, ctx);
+      if (!id)
         return `IPv6 firewall raw rule with ID '${a.rule_id}' not found.`;
-      const result = await executeMikrotikCommand(`/ipv6 firewall raw move ${a.rule_id} destination=${a.destination}`, ctx);
+      const result = await executeMikrotikCommand(`/ipv6 firewall raw move ${id} destination=${a.destination}`, ctx);
       if (looksLikeError(result))
         return `Failed to move IPv6 firewall raw rule: ${result}`;
-      return `IPv6 firewall raw rule with ID '${a.rule_id}' moved to position ${a.destination}.`;
+      return `IPv6 firewall raw rule '${a.rule_id}' (${id}) moved to position ${a.destination}.`;
     }
   }),
   defineTool({
@@ -22117,7 +22215,7 @@ ${result}`;
     name: "check_route_path",
     title: "Check IPv4 Route Path",
     annotations: READ,
-    description: "Resolves which nexthop RouterOS would use for a given IPv4 destination " + '\u2014 answers "which gateway will this packet take?" without sending any traffic. ' + "Version-aware: uses `/ip route check` on v6, falls back to " + "`/ip route print where dst-address in <dest> active=yes` on v7+ where the check " + "command was removed. Optionally scoped by `routing_table` (v7) / `routing_mark` (v6) " + "for policy-routing table lookups. " + "For listing all known routes use list_routes; for a named-table view use get_routing_table. " + "Returns the resolved nexthop and interface detail.",
+    description: "Resolves which nexthop RouterOS would use for a given IPv4 destination " + '\u2014 answers "which gateway will this packet take?" without sending any traffic. ' + "Version-aware: uses `/ip route check` on v6, falls back to " + "`/ip route print where <dest> in dst-address active=yes` on v7+ where the check " + "command was removed. Optionally scoped by `routing_table` (v7) / `routing_mark` (v6) " + "for policy-routing table lookups. " + "For listing all known routes use list_routes; for a named-table view use get_routing_table. " + "Returns the resolved nexthop and interface detail.",
     inputSchema: {
       destination: z88.string(),
       routing_table: z88.string().optional().describe('Policy-routing table name (v7) or routing-mark (v6), e.g. "VPN"')
@@ -22132,8 +22230,8 @@ ${result}`;
 
 ${v6Result}`;
       }
-      const where = [`dst-address in ${a.destination}`, "active=yes"];
-      if (table)
+      const where = [`${a.destination} in dst-address`, "active=yes"];
+      if (table && table !== "main")
         where.push(`routing-table=${quoteValue(table)}`);
       const v7Cmd = `/ip route print detail where ${where.join(" ")}`;
       const v7Result = await executeMikrotikCommand(v7Cmd, ctx);
@@ -24927,13 +25025,15 @@ async function fetchLatestRelease() {
     throw new Error(`GitHub API ${res.status}`);
   const gh = await res.json();
   const latestVersion = gh.tag_name.replace(/^v/, "");
+  const cmp = compareVersions(latestVersion, VERSION);
   const data = {
     version: latestVersion,
     name: gh.name || `v${latestVersion}`,
     body: gh.body || "",
     publishedAt: gh.published_at,
     url: gh.html_url,
-    isNewer: compareVersions(latestVersion, VERSION) > 0,
+    isNewer: cmp > 0,
+    isAhead: cmp < 0,
     currentVersion: VERSION
   };
   memoryCache = { data, fetchedAt: Date.now() };
@@ -25041,14 +25141,18 @@ var serverPulseTools = [
       const sep = "\u2500".repeat(50);
       sections.push(`SERVER PULSE \u2014 ${SERVER_TITLE} v${VERSION}`, sep, "Package:    @usex/mikrotik-mcp", `Version:    ${VERSION}`, `Uptime:     ${formatUptime(uptime)}`, `Website:    ${WEBSITE_URL}`);
       if (result.release) {
-        const freshness = assessFreshness(VERSION, result.release.version);
-        const label = freshnessLabel(freshness);
         const age = timeAgo(result.release.publishedAt);
-        sections.push("", `UPDATE STATUS: ${label}`, sep, `Current:    v${VERSION}`, `Latest:     v${result.release.version} (${result.release.name})`, `Published:  ${age}`, `Freshness:  ${freshness.toUpperCase()}`);
-        if (result.release.isNewer) {
-          sections.push("", ">>> A newer version is available! <<<");
+        if (result.release.isAhead) {
+          sections.push("", "UPDATE STATUS: AHEAD OF LATEST RELEASE", sep, `Current:    v${VERSION}`, `Published:  v${result.release.version} (${result.release.name})`, `Released:   ${age}`, `Freshness:  DEV BUILD`, "", "You are running ahead of the latest published release.");
         } else {
-          sections.push("", "You are running the latest version.");
+          const freshness = assessFreshness(VERSION, result.release.version);
+          const label = freshnessLabel(freshness);
+          sections.push("", `UPDATE STATUS: ${label}`, sep, `Current:    v${VERSION}`, `Latest:     v${result.release.version} (${result.release.name})`, `Published:  ${age}`, `Freshness:  ${freshness.toUpperCase()}`);
+          if (result.release.isNewer) {
+            sections.push("", ">>> A newer version is available! <<<");
+          } else {
+            sections.push("", "You are running the latest version.");
+          }
         }
         if (result.release.isNewer) {
           sections.push("", "UPGRADE", sep);