@usex/mikrotik-mcp 4.10.0 → 4.12.0

package/README.md

@@ -349,6 +349,10 @@ On top of the per-scope tools, the server ships higher-level workflows:
   CRL, segmentation, DNS) plus an orchestrator. Every audit is read-only; every
   fix defaults to dry-run and snapshots + Safe-Modes before writing, remediating
   by explicit `finding_id`.
+- **[Port-Scan Detection](docs/port-scan-detection.md)** — detect (never block) six
+  port-scan signatures (psd, Nmap FIN/NULL/Xmas, SYN/FIN, SYN/RST) by tagging the
+  source, inside a trust-excluding `detect-portscan` jump-gate; explicit signature
+  selection, trust-list pre-flight, snapshot + Safe-Mode apply.
 - **[Packet Capture Studio](docs/packet-capture.md)** — stream mirrored packets to
   the host as TZSP, decode them live in the dashboard, and export `.pcap`.
 - **[Discovery](docs/discovery.md)** — `bun run discover` lists MikroTik devices on
@@ -380,6 +384,7 @@ source** (`bun run gen:schemas`) so they can never drift:
 | **[Config Snapshots](docs/config-snapshots.md)**              | `/export` snapshots + time-travel diff                                |
 | **[Firewall Audit](docs/firewall-audit.md)**                  | Shadowed/broad/dead rules, risk-scored                                |
 | **[Security Hardening](docs/security-hardening.md)**          | Per-category audit+remediate, fix by finding_id, snapshot + Safe-Mode |
+| **[Port-Scan Detection](docs/port-scan-detection.md)**        | Detect+tag six scan signatures behind a trust-excluding jump-gate     |
 | **[Packet Capture Studio](docs/packet-capture.md)**           | Live TZSP capture + pcap export                                       |
 | **[Discovery](docs/discovery.md)**                            | `bun run discover`, MNDP neighbours, topology map                     |
 | **[Config Studio](docs/config-studio.md)**                    | Edit config in the dashboard with autocomplete                        |

package/dist/cli.js

@@ -106,12 +106,13 @@ import {
   updateAaaEntity,
   updateSummaryLine,
   writeBackup
-} from "./shared/cli-vfm5c52q.js";
+} from "./shared/cli-07emrpkr.js";
 
 // src/cli.ts
 import { existsSync as existsSync2 } from "fs";
 
 // src/observability/dashboard.ts
+import { spawn } from "child_process";
 import { readFileSync as readFileSync2 } from "fs";
 import { homedir, networkInterfaces } from "os";
 import { dirname as dirname4, join as join2 } from "path";
@@ -1473,6 +1474,24 @@ var JSON_HEADERS3 = { "content-type": "application/json; charset=utf-8" };
 function json3(body, status = 200) {
   return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS3 });
 }
+function restartProcess() {
+  let ok = false;
+  try {
+    const child = spawn(process.execPath, process.argv.slice(1), {
+      cwd: process.cwd(),
+      env: { ...process.env, MIKROTIK_RESTART_DELAY_MS: "1500" },
+      detached: true,
+      stdio: "inherit"
+    });
+    child.unref();
+    ok = true;
+    logger.warn("Dashboard requested a restart \u2014 relaunched a fresh server process; this one is exiting.");
+  } catch (e) {
+    logger.error(`Restart relaunch failed: ${e instanceof Error ? e.message : String(e)}. Exiting anyway.`);
+  }
+  setTimeout(() => process.exit(0), 500);
+  return ok;
+}
 function dashboardHtml() {
   try {
     return readFileSync2(join2(UI_DIST_DIR, "observability.html"), "utf8");
@@ -1771,6 +1790,28 @@ async function configRoutes(req, url, admin) {
     const rolledBack = admin.rollback(String(body?.pendingId ?? ""));
     return json3({ rolledBack, config: redact(getConfig()) });
   }
+  if (p === "/api/reload" && req.method === "POST") {
+    const body = await readJson(req);
+    if (body?.hard === true) {
+      const relaunched = restartProcess();
+      return json3({
+        ok: true,
+        mode: "restart",
+        note: relaunched ? "Restarting now \u2014 a fresh server process was launched and will bind the same port(s) in ~1.5s. Reconnect shortly." : "Could not self-relaunch; the process is exiting. It only comes back if a supervisor respawns it."
+      });
+    }
+    try {
+      const cfg = loadConfig();
+      setConfig(cfg);
+      const devices = Object.keys(cfg.devices);
+      logger.info(`Config reloaded from source \u2014 ${devices.length} device(s): ${devices.join(", ")}`);
+      return json3({ ok: true, mode: "config", count: devices.length, devices });
+    } catch (e) {
+      const error = e instanceof Error ? e.message : String(e);
+      logger.error(`Config reload failed: ${error}`);
+      return json3({ ok: false, error }, 500);
+    }
+  }
   if (p === "/api/config/history" && req.method === "GET") {
     const current = JSON.stringify(redact(getConfig()), null, 2);
     const versions = listVersions().map((v) => {
@@ -3236,6 +3277,11 @@ async function main() {
   if (command === "auth-check") {
     process.exit(await authCheck());
   }
+  const restartDelayMs = Number.parseInt(process.env.MIKROTIK_RESTART_DELAY_MS ?? "", 10);
+  if (Number.isFinite(restartDelayMs) && restartDelayMs > 0) {
+    logger.info(`Restart: waiting ${restartDelayMs}ms for the previous process to release its ports\u2026`);
+    await new Promise((resolve) => setTimeout(resolve, restartDelayMs));
+  }
   const cfg = loadConfig();
   setConfig(cfg);
   await printBanner();

package/dist/index.js

@@ -29,7 +29,7 @@ import {
   selectToolModules,
   setConfig,
   updateSummaryLine
-} from "./shared/library-vpg7d53z.js";
+} from "./shared/library-pczgrhdt.js";
 // src/server.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";