@usex/mikrotik-mcp 3.60.0 → 4.0.0

package/dist/cli.js

@@ -106,7 +106,7 @@ import {
   updateAaaEntity,
   updateSummaryLine,
   writeBackup
-} from "./shared/cli-ghatyv7e.js";
+} from "./shared/cli-athwegwy.js";
 
 // src/cli.ts
 import { existsSync as existsSync2 } from "fs";
@@ -1564,9 +1564,14 @@ function configPayload() {
     devices: cfg.devices,
     defaultDevice: cfg.defaultDevice,
     mcp: cfg.mcp,
+    s3: cfg.s3,
     dashboard: cfg.dashboard,
+    ssh: cfg.ssh,
     readOnly: cfg.readOnly,
-    s3: cfg.s3
+    tools: cfg.tools,
+    memory: cfg.memory,
+    backupDir: cfg.backupDir,
+    disableUpdateCheck: cfg.disableUpdateCheck
   });
 }
 function sseResponse(transportLabel) {

package/dist/index.d.ts

@@ -308,10 +308,20 @@ declare class SafeModeManager {
 	rollback(): Promise<string>;
 	status(): string;
 	/**
-	* Read from the channel until `isDone(cleaned)` is satisfied or the timeout
-	* elapses. Defaults to "any RouterOS prompt appeared". Mode transitions pass a
+	* Read from the channel until `isDone(cleaned)` is satisfied or the shell goes
+	* SILENT. Defaults to "any RouterOS prompt appeared". Mode transitions pass a
 	* stricter predicate so they wait for the prompt that reflects the NEW state
 	* (safe-mode marker present/absent), not merely the first prompt-shaped line.
+	*
+	* The timeout is an IDLE timeout, not a total budget: every data chunk resets
+	* it, so a legitimately slow-but-streaming command (`/terse` on a large
+	* config can emit for tens of seconds) never trips it — only a genuine wedge,
+	* where no byte has arrived for `idleMs`, does. A separate hard cap (`hardCapMs`)
+	* bounds the pathological "dribbles a byte forever" case so the read can't hang
+	* indefinitely. Either expiry resolves with `timedOut: true` so callers can tell
+	* "the prompt appeared" from "the shell stopped answering" — the latter means the
+	* interactive Safe-Mode session is wedged and must abort rather than letting every
+	* subsequent command burn its own timeout.
 	*/
 	private readUntilPrompt;
 	/**

package/dist/index.js

@@ -29,7 +29,7 @@ import {
   selectToolModules,
   setConfig,
   updateSummaryLine
-} from "./shared/library-7j22z9a8.js";
+} from "./shared/library-f5kwsqv2.js";
 // src/server.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";

package/dist/shared/{cli-ghatyv7e.js → cli-athwegwy.js}

@@ -436,7 +436,22 @@ function parseDevicesSource(raw, fromFile) {
   const mcp = structured && obj.mcp && typeof obj.mcp === "object" ? obj.mcp : undefined;
   const ssh = structured && obj.ssh && typeof obj.ssh === "object" ? obj.ssh : undefined;
   const memory = structured && obj.memory && typeof obj.memory === "object" ? obj.memory : undefined;
-  return { devices, defaultDevice, s3, dashboard, tools, mcp, ssh, memory };
+  const readOnly = structured && typeof obj.readOnly === "boolean" ? obj.readOnly : undefined;
+  const disableUpdateCheck = structured && typeof obj.disableUpdateCheck === "boolean" ? obj.disableUpdateCheck : undefined;
+  const backupDir = structured && typeof obj.backupDir === "string" ? obj.backupDir : undefined;
+  return {
+    devices,
+    defaultDevice,
+    s3,
+    dashboard,
+    tools,
+    mcp,
+    ssh,
+    memory,
+    readOnly,
+    disableUpdateCheck,
+    backupDir
+  };
 }
 var configSource = { path: DEFAULT_CONFIG_FILE, fromFile: false };
 function getConfigSource() {
@@ -445,6 +460,13 @@ function getConfigSource() {
 function loadConfig(argv = process.argv.slice(2)) {
   const flags = parseFlags(argv);
   const pick = (flag, ...envNames) => flags[flag] ?? env(...envNames);
+  const overlay = (file, over) => {
+    const out = { ...file };
+    for (const [k, v] of Object.entries(over))
+      if (v !== undefined)
+        out[k] = v;
+    return out;
+  };
   const jumpHostName = pick("jump-host", "MIKROTIK_JUMP_HOST");
   const jumpHost = jumpHostName ? {
     host: jumpHostName,
@@ -485,6 +507,9 @@ function loadConfig(argv = process.argv.slice(2)) {
   let fileMcp;
   let fileSsh;
   let fileMemory;
+  let fileReadOnly;
+  let fileDisableUpdateCheck;
+  let fileBackupDir;
   if (configFile || devicesInline) {
     const src = configFile ? parseDevicesSource(configFile, true) : parseDevicesSource(devicesInline, false);
     for (const [name, dc] of Object.entries(src.devices))
@@ -499,8 +524,11 @@ function loadConfig(argv = process.argv.slice(2)) {
     fileMcp = src.mcp;
     fileSsh = src.ssh;
     fileMemory = src.memory;
+    fileReadOnly = src.readOnly;
+    fileDisableUpdateCheck = src.disableUpdateCheck;
+    fileBackupDir = src.backupDir;
   }
-  const s3 = {
+  const s3 = overlay(fileS3, {
     accessKeyId: pick("s3-access-key-id", "S3_ACCESS_KEY_ID", "AWS_ACCESS_KEY_ID"),
     secretAccessKey: pick("s3-secret-access-key", "S3_SECRET_ACCESS_KEY", "AWS_SECRET_ACCESS_KEY"),
     sessionToken: pick("s3-session-token", "S3_SESSION_TOKEN", "AWS_SESSION_TOKEN"),
@@ -508,12 +536,11 @@ function loadConfig(argv = process.argv.slice(2)) {
     endpoint: pick("s3-endpoint", "S3_ENDPOINT", "AWS_ENDPOINT"),
     bucket: pick("s3-bucket", "S3_BUCKET", "AWS_BUCKET"),
     prefix: pick("s3-prefix", "MIKROTIK_S3_PREFIX"),
-    presignExpiresIn: pick("s3-presign-expires-in", "MIKROTIK_S3_PRESIGN_EXPIRES_IN"),
-    ...fileS3
-  };
+    presignExpiresIn: pick("s3-presign-expires-in", "MIKROTIK_S3_PRESIGN_EXPIRES_IN")
+  });
   const appViewsRaw = pick("app-views", "MIKROTIK_MCP__APP_VIEWS");
   const appViewsEnv = appViewsRaw === undefined ? undefined : !/^(0|false|no|off)$/i.test(appViewsRaw);
-  const mcp = {
+  const mcp = overlay(fileMcp, {
     transport: pick("transport", "MIKROTIK_MCP__TRANSPORT", "MCP_TRANSPORT"),
     host: pick("mcp-host", "MIKROTIK_MCP__HOST"),
     port: pick("mcp-port", "MIKROTIK_MCP__PORT"),
@@ -521,22 +548,22 @@ function loadConfig(argv = process.argv.slice(2)) {
     allowedOrigins: pick("mcp-allowed-origins", "MIKROTIK_MCP__ALLOWED_ORIGINS"),
     corsOrigins: pick("mcp-cors-origins", "MIKROTIK_MCP__CORS_ORIGINS"),
     toolPageSize: pick("tool-page-size", "MIKROTIK_MCP__TOOL_PAGE_SIZE"),
-    appViews: appViewsEnv,
-    ...fileMcp
-  };
+    appViews: appViewsEnv
+  });
   const isTruthy = (v) => /^(1|true|yes|on)$/i.test(v ?? "");
-  const readOnly = isTruthy(pick("read-only", "MIKROTIK_READ_ONLY"));
-  const disableUpdateCheck = isTruthy(pick("disable-update-check", "MIKROTIK_DISABLE_UPDATE_CHECK"));
+  const boolFileFlag = (flagVal, fileVal) => flagVal !== undefined ? isTruthy(flagVal) : fileVal;
+  const readOnly = boolFileFlag(pick("read-only", "MIKROTIK_READ_ONLY"), fileReadOnly);
+  const disableUpdateCheck = boolFileFlag(pick("disable-update-check", "MIKROTIK_DISABLE_UPDATE_CHECK"), fileDisableUpdateCheck);
+  const backupDir = pick("backup-dir", "MIKROTIK_BACKUP_DIR") ?? fileBackupDir;
   const csv = (v) => v === undefined ? undefined : v.split(",").map((s) => s.trim()).filter(Boolean);
-  const tools = {
+  const tools = overlay(fileTools, {
     enabledModules: csv(pick("tools-enabled-modules", "MIKROTIK_TOOLS__ENABLED_MODULES")),
     disabledModules: csv(pick("tools-disabled-modules", "MIKROTIK_TOOLS__DISABLED_MODULES")),
     enabledGroups: csv(pick("tools-enabled-groups", "MIKROTIK_TOOLS__ENABLED_GROUPS")),
-    disabledGroups: csv(pick("tools-disabled-groups", "MIKROTIK_TOOLS__DISABLED_GROUPS")),
-    ...fileTools
-  };
+    disabledGroups: csv(pick("tools-disabled-groups", "MIKROTIK_TOOLS__DISABLED_GROUPS"))
+  });
   const boolOpt = (v) => v === undefined ? undefined : isTruthy(v);
-  const dashboard = {
+  const dashboard = overlay(fileDashboard, {
     enabled: boolOpt(pick("dashboard", "MIKROTIK_DASHBOARD__ENABLED", "MIKROTIK_DASHBOARD")),
     host: pick("dashboard-host", "MIKROTIK_DASHBOARD__HOST"),
     port: pick("dashboard-port", "MIKROTIK_DASHBOARD__PORT"),
@@ -545,20 +572,17 @@ function loadConfig(argv = process.argv.slice(2)) {
     captureBody: boolOpt(pick("dashboard-capture-body", "MIKROTIK_DASHBOARD__CAPTURE_BODY")),
     redactInput: boolOpt(pick("dashboard-redact-input", "MIKROTIK_DASHBOARD__REDACT_INPUT")),
     maxBodyBytes: pick("dashboard-max-body-bytes", "MIKROTIK_DASHBOARD__MAX_BODY_BYTES"),
-    token: pick("dashboard-token", "MIKROTIK_DASHBOARD__TOKEN"),
-    ...fileDashboard
-  };
-  const ssh = {
+    token: pick("dashboard-token", "MIKROTIK_DASHBOARD__TOKEN")
+  });
+  const ssh = overlay(fileSsh, {
     keepAlive: boolOpt(pick("ssh-keep-alive", "MIKROTIK_SSH__KEEP_ALIVE")),
     keepAliveInterval: pick("ssh-keepalive-interval", "MIKROTIK_SSH__KEEPALIVE_INTERVAL"),
-    idleTimeout: pick("ssh-idle-timeout", "MIKROTIK_SSH__IDLE_TIMEOUT"),
-    ...fileSsh
-  };
-  const memory = {
+    idleTimeout: pick("ssh-idle-timeout", "MIKROTIK_SSH__IDLE_TIMEOUT")
+  });
+  const memory = overlay(fileMemory, {
     enabled: boolOpt(pick("memory-enabled", "MIKROTIK_MEMORY__ENABLED")),
-    dbPath: pick("memory-db", "MIKROTIK_MEMORY__DB_PATH"),
-    ...fileMemory
-  };
+    dbPath: pick("memory-db", "MIKROTIK_MEMORY__DB_PATH")
+  });
   const hasS3 = !!(s3.accessKeyId || s3.bucket || s3.endpoint);
   const raw = {
     devices: Object.keys(devices).length ? devices : { default: {} },
@@ -567,6 +591,7 @@ function loadConfig(argv = process.argv.slice(2)) {
     dashboard,
     readOnly,
     disableUpdateCheck,
+    backupDir,
     tools,
     ssh,
     memory,
@@ -1208,6 +1233,8 @@ function stripAnsi(text) {
   return text.replace(ANSI_RE, "");
 }
 var CTRL_X = "\x18";
+var IDLE_TIMEOUT_MS = 15000;
+var HARD_CAP_MS = 120000;
 function isSafeModeActivated(response) {
   if (response.includes("<SAFE>"))
     return true;
@@ -1283,7 +1310,7 @@ class SafeModeManager {
 `);
       const { text, timedOut } = await this.readUntilPrompt();
       if (timedOut) {
-        throw new Error(`Safe Mode shell did not return a prompt within 15s (command: ${command}). The interactive ` + "session appears wedged \u2014 some RouterOS builds/terminals don't support Safe Mode over SSH. " + "Apply the change with the direct write tools instead (verify each with a read).");
+        throw new Error(`Safe Mode shell went silent for ${IDLE_TIMEOUT_MS / 1000}s (command: ${command}). The ` + "interactive session appears wedged \u2014 some RouterOS builds/terminals don't support Safe " + "Mode over SSH. Apply the change with the direct write tools instead (verify each with a read).");
       }
       return this.extractOutput(text, command);
     });
@@ -1337,25 +1364,32 @@ class SafeModeManager {
   status() {
     return this.active ? "Safe mode is ACTIVE. Changes are pending \u2014 they are NOT yet persisted. " + "Call commit_safe_mode to persist or rollback_safe_mode to revert." : "Safe mode is NOT active. Changes take effect and persist immediately.";
   }
-  readUntilPrompt(timeoutMs = 15000, isDone = (c) => PROMPT_RE.test(c)) {
+  readUntilPrompt(idleMs = IDLE_TIMEOUT_MS, isDone = (c) => PROMPT_RE.test(c), hardCapMs = HARD_CAP_MS) {
     const channel = this.channel;
     if (!channel)
       return Promise.resolve({ text: "", timedOut: false });
     return new Promise((resolve2) => {
       let buf = "";
-      let timer;
+      let idleTimer;
+      const hardTimer = setTimeout(() => finish(stripAnsi(buf), true), hardCapMs);
+      function armIdle2() {
+        clearTimeout(idleTimer);
+        idleTimer = setTimeout(() => finish(stripAnsi(buf), true), idleMs);
+      }
       function onData(chunk) {
         buf += decodeOutput(chunk);
+        armIdle2();
         const cleaned = stripAnsi(buf);
         if (isDone(cleaned))
           finish(cleaned, false);
       }
       function finish(result, timedOut) {
-        clearTimeout(timer);
+        clearTimeout(idleTimer);
+        clearTimeout(hardTimer);
         channel.removeListener("data", onData);
         resolve2({ text: result, timedOut });
       }
-      timer = setTimeout(() => finish(stripAnsi(buf), true), timeoutMs);
+      armIdle2();
       channel.on("data", onData);
     });
   }
@@ -5264,7 +5298,7 @@ var changePlanTools = [
       const enabled2 = await safe.enable();
       if (enabled2.startsWith("Error"))
         throw new Error(enabled2);
-      const APPLY_BUDGET_MS = 90000;
+      const APPLY_BUDGET_MS = 180000;
       const startedAt = Date.now();
       const overBudget = () => Date.now() - startedAt > APPLY_BUDGET_MS;
       const applyAndDiff = async () => {
@@ -8330,7 +8364,7 @@ var cache = null;
 async function gateway() {
   if (cache)
     return cache;
-  const { moduleCatalog } = await import("./cli-7yjsmkwg.js");
+  const { moduleCatalog } = await import("./cli-cjrk8g04.js");
   const forIndex = [];
   const byName = new Map;
   for (const mod of moduleCatalog) {
@@ -22181,7 +22215,7 @@ ${result}`;
     name: "check_route_path",
     title: "Check IPv4 Route Path",
     annotations: READ,
-    description: "Resolves which nexthop RouterOS would use for a given IPv4 destination " + '\u2014 answers "which gateway will this packet take?" without sending any traffic. ' + "Version-aware: uses `/ip route check` on v6, falls back to " + "`/ip route print where dst-address in <dest> active=yes` on v7+ where the check " + "command was removed. Optionally scoped by `routing_table` (v7) / `routing_mark` (v6) " + "for policy-routing table lookups. " + "For listing all known routes use list_routes; for a named-table view use get_routing_table. " + "Returns the resolved nexthop and interface detail.",
+    description: "Resolves which nexthop RouterOS would use for a given IPv4 destination " + '\u2014 answers "which gateway will this packet take?" without sending any traffic. ' + "Version-aware: uses `/ip route check` on v6, falls back to " + "`/ip route print where <dest> in dst-address active=yes` on v7+ where the check " + "command was removed. Optionally scoped by `routing_table` (v7) / `routing_mark` (v6) " + "for policy-routing table lookups. " + "For listing all known routes use list_routes; for a named-table view use get_routing_table. " + "Returns the resolved nexthop and interface detail.",
     inputSchema: {
       destination: z88.string(),
       routing_table: z88.string().optional().describe('Policy-routing table name (v7) or routing-mark (v6), e.g. "VPN"')
@@ -22196,7 +22230,7 @@ ${result}`;
 
 ${v6Result}`;
       }
-      const where = [`dst-address in ${a.destination}`, "active=yes"];
+      const where = [`${a.destination} in dst-address`, "active=yes"];
       if (table && table !== "main")
         where.push(`routing-table=${quoteValue(table)}`);
       const v7Cmd = `/ip route print detail where ${where.join(" ")}`;
@@ -24991,13 +25025,15 @@ async function fetchLatestRelease() {
     throw new Error(`GitHub API ${res.status}`);
   const gh = await res.json();
   const latestVersion = gh.tag_name.replace(/^v/, "");
+  const cmp = compareVersions(latestVersion, VERSION);
   const data = {
     version: latestVersion,
     name: gh.name || `v${latestVersion}`,
     body: gh.body || "",
     publishedAt: gh.published_at,
     url: gh.html_url,
-    isNewer: compareVersions(latestVersion, VERSION) > 0,
+    isNewer: cmp > 0,
+    isAhead: cmp < 0,
     currentVersion: VERSION
   };
   memoryCache = { data, fetchedAt: Date.now() };
@@ -25105,14 +25141,18 @@ var serverPulseTools = [
       const sep = "\u2500".repeat(50);
       sections.push(`SERVER PULSE \u2014 ${SERVER_TITLE} v${VERSION}`, sep, "Package:    @usex/mikrotik-mcp", `Version:    ${VERSION}`, `Uptime:     ${formatUptime(uptime)}`, `Website:    ${WEBSITE_URL}`);
       if (result.release) {
-        const freshness = assessFreshness(VERSION, result.release.version);
-        const label = freshnessLabel(freshness);
         const age = timeAgo(result.release.publishedAt);
-        sections.push("", `UPDATE STATUS: ${label}`, sep, `Current:    v${VERSION}`, `Latest:     v${result.release.version} (${result.release.name})`, `Published:  ${age}`, `Freshness:  ${freshness.toUpperCase()}`);
-        if (result.release.isNewer) {
-          sections.push("", ">>> A newer version is available! <<<");
+        if (result.release.isAhead) {
+          sections.push("", "UPDATE STATUS: AHEAD OF LATEST RELEASE", sep, `Current:    v${VERSION}`, `Published:  v${result.release.version} (${result.release.name})`, `Released:   ${age}`, `Freshness:  DEV BUILD`, "", "You are running ahead of the latest published release.");
         } else {
-          sections.push("", "You are running the latest version.");
+          const freshness = assessFreshness(VERSION, result.release.version);
+          const label = freshnessLabel(freshness);
+          sections.push("", `UPDATE STATUS: ${label}`, sep, `Current:    v${VERSION}`, `Latest:     v${result.release.version} (${result.release.name})`, `Published:  ${age}`, `Freshness:  ${freshness.toUpperCase()}`);
+          if (result.release.isNewer) {
+            sections.push("", ">>> A newer version is available! <<<");
+          } else {
+            sections.push("", "You are running the latest version.");
+          }
         }
         if (result.release.isNewer) {
           sections.push("", "UPGRADE", sep);

package/dist/shared/{cli-7yjsmkwg.js → cli-cjrk8g04.js}

@@ -4,7 +4,7 @@ import {
   allToolModules,
   moduleCatalog,
   selectToolModules
-} from "./cli-ghatyv7e.js";
+} from "./cli-athwegwy.js";
 export {
   selectToolModules,
   moduleCatalog,

package/dist/shared/{library-1hs18tmh.js → library-4fpy49qb.js}

@@ -4,7 +4,7 @@ import {
   allToolModules,
   moduleCatalog,
   selectToolModules
-} from "./library-7j22z9a8.js";
+} from "./library-f5kwsqv2.js";
 export {
   selectToolModules,
   moduleCatalog,

package/dist/shared/{library-7j22z9a8.js → library-f5kwsqv2.js}

@@ -436,12 +436,34 @@ function parseDevicesSource(raw, fromFile) {
   const mcp = structured && obj.mcp && typeof obj.mcp === "object" ? obj.mcp : undefined;
   const ssh = structured && obj.ssh && typeof obj.ssh === "object" ? obj.ssh : undefined;
   const memory = structured && obj.memory && typeof obj.memory === "object" ? obj.memory : undefined;
-  return { devices, defaultDevice, s3, dashboard, tools, mcp, ssh, memory };
+  const readOnly = structured && typeof obj.readOnly === "boolean" ? obj.readOnly : undefined;
+  const disableUpdateCheck = structured && typeof obj.disableUpdateCheck === "boolean" ? obj.disableUpdateCheck : undefined;
+  const backupDir = structured && typeof obj.backupDir === "string" ? obj.backupDir : undefined;
+  return {
+    devices,
+    defaultDevice,
+    s3,
+    dashboard,
+    tools,
+    mcp,
+    ssh,
+    memory,
+    readOnly,
+    disableUpdateCheck,
+    backupDir
+  };
 }
 var configSource = { path: DEFAULT_CONFIG_FILE, fromFile: false };
 function loadConfig(argv = process.argv.slice(2)) {
   const flags = parseFlags(argv);
   const pick = (flag, ...envNames) => flags[flag] ?? env(...envNames);
+  const overlay = (file, over) => {
+    const out = { ...file };
+    for (const [k, v] of Object.entries(over))
+      if (v !== undefined)
+        out[k] = v;
+    return out;
+  };
   const jumpHostName = pick("jump-host", "MIKROTIK_JUMP_HOST");
   const jumpHost = jumpHostName ? {
     host: jumpHostName,
@@ -482,6 +504,9 @@ function loadConfig(argv = process.argv.slice(2)) {
   let fileMcp;
   let fileSsh;
   let fileMemory;
+  let fileReadOnly;
+  let fileDisableUpdateCheck;
+  let fileBackupDir;
   if (configFile || devicesInline) {
     const src = configFile ? parseDevicesSource(configFile, true) : parseDevicesSource(devicesInline, false);
     for (const [name, dc] of Object.entries(src.devices))
@@ -496,8 +521,11 @@ function loadConfig(argv = process.argv.slice(2)) {
     fileMcp = src.mcp;
     fileSsh = src.ssh;
     fileMemory = src.memory;
+    fileReadOnly = src.readOnly;
+    fileDisableUpdateCheck = src.disableUpdateCheck;
+    fileBackupDir = src.backupDir;
   }
-  const s3 = {
+  const s3 = overlay(fileS3, {
     accessKeyId: pick("s3-access-key-id", "S3_ACCESS_KEY_ID", "AWS_ACCESS_KEY_ID"),
     secretAccessKey: pick("s3-secret-access-key", "S3_SECRET_ACCESS_KEY", "AWS_SECRET_ACCESS_KEY"),
     sessionToken: pick("s3-session-token", "S3_SESSION_TOKEN", "AWS_SESSION_TOKEN"),
@@ -505,12 +533,11 @@ function loadConfig(argv = process.argv.slice(2)) {
     endpoint: pick("s3-endpoint", "S3_ENDPOINT", "AWS_ENDPOINT"),
     bucket: pick("s3-bucket", "S3_BUCKET", "AWS_BUCKET"),
     prefix: pick("s3-prefix", "MIKROTIK_S3_PREFIX"),
-    presignExpiresIn: pick("s3-presign-expires-in", "MIKROTIK_S3_PRESIGN_EXPIRES_IN"),
-    ...fileS3
-  };
+    presignExpiresIn: pick("s3-presign-expires-in", "MIKROTIK_S3_PRESIGN_EXPIRES_IN")
+  });
   const appViewsRaw = pick("app-views", "MIKROTIK_MCP__APP_VIEWS");
   const appViewsEnv = appViewsRaw === undefined ? undefined : !/^(0|false|no|off)$/i.test(appViewsRaw);
-  const mcp = {
+  const mcp = overlay(fileMcp, {
     transport: pick("transport", "MIKROTIK_MCP__TRANSPORT", "MCP_TRANSPORT"),
     host: pick("mcp-host", "MIKROTIK_MCP__HOST"),
     port: pick("mcp-port", "MIKROTIK_MCP__PORT"),
@@ -518,22 +545,22 @@ function loadConfig(argv = process.argv.slice(2)) {
     allowedOrigins: pick("mcp-allowed-origins", "MIKROTIK_MCP__ALLOWED_ORIGINS"),
     corsOrigins: pick("mcp-cors-origins", "MIKROTIK_MCP__CORS_ORIGINS"),
     toolPageSize: pick("tool-page-size", "MIKROTIK_MCP__TOOL_PAGE_SIZE"),
-    appViews: appViewsEnv,
-    ...fileMcp
-  };
+    appViews: appViewsEnv
+  });
   const isTruthy = (v) => /^(1|true|yes|on)$/i.test(v ?? "");
-  const readOnly = isTruthy(pick("read-only", "MIKROTIK_READ_ONLY"));
-  const disableUpdateCheck = isTruthy(pick("disable-update-check", "MIKROTIK_DISABLE_UPDATE_CHECK"));
+  const boolFileFlag = (flagVal, fileVal) => flagVal !== undefined ? isTruthy(flagVal) : fileVal;
+  const readOnly = boolFileFlag(pick("read-only", "MIKROTIK_READ_ONLY"), fileReadOnly);
+  const disableUpdateCheck = boolFileFlag(pick("disable-update-check", "MIKROTIK_DISABLE_UPDATE_CHECK"), fileDisableUpdateCheck);
+  const backupDir = pick("backup-dir", "MIKROTIK_BACKUP_DIR") ?? fileBackupDir;
   const csv = (v) => v === undefined ? undefined : v.split(",").map((s) => s.trim()).filter(Boolean);
-  const tools = {
+  const tools = overlay(fileTools, {
     enabledModules: csv(pick("tools-enabled-modules", "MIKROTIK_TOOLS__ENABLED_MODULES")),
     disabledModules: csv(pick("tools-disabled-modules", "MIKROTIK_TOOLS__DISABLED_MODULES")),
     enabledGroups: csv(pick("tools-enabled-groups", "MIKROTIK_TOOLS__ENABLED_GROUPS")),
-    disabledGroups: csv(pick("tools-disabled-groups", "MIKROTIK_TOOLS__DISABLED_GROUPS")),
-    ...fileTools
-  };
+    disabledGroups: csv(pick("tools-disabled-groups", "MIKROTIK_TOOLS__DISABLED_GROUPS"))
+  });
   const boolOpt = (v) => v === undefined ? undefined : isTruthy(v);
-  const dashboard = {
+  const dashboard = overlay(fileDashboard, {
     enabled: boolOpt(pick("dashboard", "MIKROTIK_DASHBOARD__ENABLED", "MIKROTIK_DASHBOARD")),
     host: pick("dashboard-host", "MIKROTIK_DASHBOARD__HOST"),
     port: pick("dashboard-port", "MIKROTIK_DASHBOARD__PORT"),
@@ -542,20 +569,17 @@ function loadConfig(argv = process.argv.slice(2)) {
     captureBody: boolOpt(pick("dashboard-capture-body", "MIKROTIK_DASHBOARD__CAPTURE_BODY")),
     redactInput: boolOpt(pick("dashboard-redact-input", "MIKROTIK_DASHBOARD__REDACT_INPUT")),
     maxBodyBytes: pick("dashboard-max-body-bytes", "MIKROTIK_DASHBOARD__MAX_BODY_BYTES"),
-    token: pick("dashboard-token", "MIKROTIK_DASHBOARD__TOKEN"),
-    ...fileDashboard
-  };
-  const ssh = {
+    token: pick("dashboard-token", "MIKROTIK_DASHBOARD__TOKEN")
+  });
+  const ssh = overlay(fileSsh, {
     keepAlive: boolOpt(pick("ssh-keep-alive", "MIKROTIK_SSH__KEEP_ALIVE")),
     keepAliveInterval: pick("ssh-keepalive-interval", "MIKROTIK_SSH__KEEPALIVE_INTERVAL"),
-    idleTimeout: pick("ssh-idle-timeout", "MIKROTIK_SSH__IDLE_TIMEOUT"),
-    ...fileSsh
-  };
-  const memory = {
+    idleTimeout: pick("ssh-idle-timeout", "MIKROTIK_SSH__IDLE_TIMEOUT")
+  });
+  const memory = overlay(fileMemory, {
     enabled: boolOpt(pick("memory-enabled", "MIKROTIK_MEMORY__ENABLED")),
-    dbPath: pick("memory-db", "MIKROTIK_MEMORY__DB_PATH"),
-    ...fileMemory
-  };
+    dbPath: pick("memory-db", "MIKROTIK_MEMORY__DB_PATH")
+  });
   const hasS3 = !!(s3.accessKeyId || s3.bucket || s3.endpoint);
   const raw = {
     devices: Object.keys(devices).length ? devices : { default: {} },
@@ -564,6 +588,7 @@ function loadConfig(argv = process.argv.slice(2)) {
     dashboard,
     readOnly,
     disableUpdateCheck,
+    backupDir,
     tools,
     ssh,
     memory,
@@ -1189,6 +1214,8 @@ function stripAnsi(text) {
   return text.replace(ANSI_RE, "");
 }
 var CTRL_X = "\x18";
+var IDLE_TIMEOUT_MS = 15000;
+var HARD_CAP_MS = 120000;
 function isSafeModeActivated(response) {
   if (response.includes("<SAFE>"))
     return true;
@@ -1264,7 +1291,7 @@ class SafeModeManager {
 `);
       const { text, timedOut } = await this.readUntilPrompt();
       if (timedOut) {
-        throw new Error(`Safe Mode shell did not return a prompt within 15s (command: ${command}). The interactive ` + "session appears wedged \u2014 some RouterOS builds/terminals don't support Safe Mode over SSH. " + "Apply the change with the direct write tools instead (verify each with a read).");
+        throw new Error(`Safe Mode shell went silent for ${IDLE_TIMEOUT_MS / 1000}s (command: ${command}). The ` + "interactive session appears wedged \u2014 some RouterOS builds/terminals don't support Safe " + "Mode over SSH. Apply the change with the direct write tools instead (verify each with a read).");
       }
       return this.extractOutput(text, command);
     });
@@ -1318,25 +1345,32 @@ class SafeModeManager {
   status() {
     return this.active ? "Safe mode is ACTIVE. Changes are pending \u2014 they are NOT yet persisted. " + "Call commit_safe_mode to persist or rollback_safe_mode to revert." : "Safe mode is NOT active. Changes take effect and persist immediately.";
   }
-  readUntilPrompt(timeoutMs = 15000, isDone = (c) => PROMPT_RE.test(c)) {
+  readUntilPrompt(idleMs = IDLE_TIMEOUT_MS, isDone = (c) => PROMPT_RE.test(c), hardCapMs = HARD_CAP_MS) {
     const channel = this.channel;
     if (!channel)
       return Promise.resolve({ text: "", timedOut: false });
     return new Promise((resolve2) => {
       let buf = "";
-      let timer;
+      let idleTimer;
+      const hardTimer = setTimeout(() => finish(stripAnsi(buf), true), hardCapMs);
+      function armIdle2() {
+        clearTimeout(idleTimer);
+        idleTimer = setTimeout(() => finish(stripAnsi(buf), true), idleMs);
+      }
       function onData(chunk) {
         buf += decodeOutput(chunk);
+        armIdle2();
         const cleaned = stripAnsi(buf);
         if (isDone(cleaned))
           finish(cleaned, false);
       }
       function finish(result, timedOut) {
-        clearTimeout(timer);
+        clearTimeout(idleTimer);
+        clearTimeout(hardTimer);
         channel.removeListener("data", onData);
         resolve2({ text: result, timedOut });
       }
-      timer = setTimeout(() => finish(stripAnsi(buf), true), timeoutMs);
+      armIdle2();
       channel.on("data", onData);
     });
   }
@@ -5194,7 +5228,7 @@ var changePlanTools = [
       const enabled2 = await safe.enable();
       if (enabled2.startsWith("Error"))
         throw new Error(enabled2);
-      const APPLY_BUDGET_MS = 90000;
+      const APPLY_BUDGET_MS = 180000;
       const startedAt = Date.now();
       const overBudget = () => Date.now() - startedAt > APPLY_BUDGET_MS;
       const applyAndDiff = async () => {
@@ -8260,7 +8294,7 @@ var cache = null;
 async function gateway() {
   if (cache)
     return cache;
-  const { moduleCatalog } = await import("./library-1hs18tmh.js");
+  const { moduleCatalog } = await import("./library-4fpy49qb.js");
   const forIndex = [];
   const byName = new Map;
   for (const mod of moduleCatalog) {
@@ -22111,7 +22145,7 @@ ${result}`;
     name: "check_route_path",
     title: "Check IPv4 Route Path",
     annotations: READ,
-    description: "Resolves which nexthop RouterOS would use for a given IPv4 destination " + '\u2014 answers "which gateway will this packet take?" without sending any traffic. ' + "Version-aware: uses `/ip route check` on v6, falls back to " + "`/ip route print where dst-address in <dest> active=yes` on v7+ where the check " + "command was removed. Optionally scoped by `routing_table` (v7) / `routing_mark` (v6) " + "for policy-routing table lookups. " + "For listing all known routes use list_routes; for a named-table view use get_routing_table. " + "Returns the resolved nexthop and interface detail.",
+    description: "Resolves which nexthop RouterOS would use for a given IPv4 destination " + '\u2014 answers "which gateway will this packet take?" without sending any traffic. ' + "Version-aware: uses `/ip route check` on v6, falls back to " + "`/ip route print where <dest> in dst-address active=yes` on v7+ where the check " + "command was removed. Optionally scoped by `routing_table` (v7) / `routing_mark` (v6) " + "for policy-routing table lookups. " + "For listing all known routes use list_routes; for a named-table view use get_routing_table. " + "Returns the resolved nexthop and interface detail.",
     inputSchema: {
       destination: z88.string(),
       routing_table: z88.string().optional().describe('Policy-routing table name (v7) or routing-mark (v6), e.g. "VPN"')
@@ -22126,7 +22160,7 @@ ${result}`;
 
 ${v6Result}`;
       }
-      const where = [`dst-address in ${a.destination}`, "active=yes"];
+      const where = [`${a.destination} in dst-address`, "active=yes"];
       if (table && table !== "main")
         where.push(`routing-table=${quoteValue(table)}`);
       const v7Cmd = `/ip route print detail where ${where.join(" ")}`;
@@ -24920,13 +24954,15 @@ async function fetchLatestRelease() {
     throw new Error(`GitHub API ${res.status}`);
   const gh = await res.json();
   const latestVersion = gh.tag_name.replace(/^v/, "");
+  const cmp = compareVersions(latestVersion, VERSION);
   const data = {
     version: latestVersion,
     name: gh.name || `v${latestVersion}`,
     body: gh.body || "",
     publishedAt: gh.published_at,
     url: gh.html_url,
-    isNewer: compareVersions(latestVersion, VERSION) > 0,
+    isNewer: cmp > 0,
+    isAhead: cmp < 0,
     currentVersion: VERSION
   };
   memoryCache = { data, fetchedAt: Date.now() };
@@ -25034,14 +25070,18 @@ var serverPulseTools = [
       const sep = "\u2500".repeat(50);
       sections.push(`SERVER PULSE \u2014 ${SERVER_TITLE} v${VERSION}`, sep, "Package:    @usex/mikrotik-mcp", `Version:    ${VERSION}`, `Uptime:     ${formatUptime(uptime)}`, `Website:    ${WEBSITE_URL}`);
       if (result.release) {
-        const freshness = assessFreshness(VERSION, result.release.version);
-        const label = freshnessLabel(freshness);
         const age = timeAgo(result.release.publishedAt);
-        sections.push("", `UPDATE STATUS: ${label}`, sep, `Current:    v${VERSION}`, `Latest:     v${result.release.version} (${result.release.name})`, `Published:  ${age}`, `Freshness:  ${freshness.toUpperCase()}`);
-        if (result.release.isNewer) {
-          sections.push("", ">>> A newer version is available! <<<");
+        if (result.release.isAhead) {
+          sections.push("", "UPDATE STATUS: AHEAD OF LATEST RELEASE", sep, `Current:    v${VERSION}`, `Published:  v${result.release.version} (${result.release.name})`, `Released:   ${age}`, `Freshness:  DEV BUILD`, "", "You are running ahead of the latest published release.");
         } else {
-          sections.push("", "You are running the latest version.");
+          const freshness = assessFreshness(VERSION, result.release.version);
+          const label = freshnessLabel(freshness);
+          sections.push("", `UPDATE STATUS: ${label}`, sep, `Current:    v${VERSION}`, `Latest:     v${result.release.version} (${result.release.name})`, `Published:  ${age}`, `Freshness:  ${freshness.toUpperCase()}`);
+          if (result.release.isNewer) {
+            sections.push("", ">>> A newer version is available! <<<");
+          } else {
+            sections.push("", "You are running the latest version.");
+          }
         }
         if (result.release.isNewer) {
           sections.push("", "UPGRADE", sep);