@usex/mikrotik-mcp 5.5.0 → 5.6.0

package/dist/shared/{cli-cvq8pxvn.js → cli-gyqfq9j6.js}

@@ -42,6 +42,7 @@ var logger = {
 
 // src/ssh/client.ts
 var RUN_IDLE_TIMEOUT_MS = 60000;
+var RUN_HARD_TIMEOUT_MS = 120000;
 function decodeOutput(data) {
   if (!data || data.length === 0)
     return "";
@@ -158,11 +159,14 @@ class MikroTikSSHClient {
         let settled = false;
         let timer;
         let idleTimer;
+        let hardTimer;
         const clearTimers = () => {
           if (timer)
             clearTimeout(timer);
           if (idleTimer)
             clearTimeout(idleTimer);
+          if (hardTimer)
+            clearTimeout(hardTimer);
         };
         const finish = () => {
           if (settled)
@@ -204,6 +208,14 @@ class MikroTikSSHClient {
             } catch {}
             finish();
           }, opts.maxMs);
+        } else {
+          hardTimer = setTimeout(() => {
+            try {
+              stream.signal("INT");
+            } catch {}
+            const got = Buffer.concat(stdout).length;
+            fail(new Error(`MikroTik command exceeded the ${RUN_HARD_TIMEOUT_MS / 1000}s hard timeout and was ` + `aborted (${got} bytes received, output discarded as incomplete). ` + `Command: ${command.slice(0, 120)}`));
+          }, RUN_HARD_TIMEOUT_MS);
         }
         stream.on("close", finish).on("data", (d) => {
           stdout.push(d);
@@ -769,20 +781,36 @@ function deviceLabels() {
   }
   return out;
 }
-function resolveDeviceName(name) {
-  if (name) {
-    if (name in active.devices && isEnabled(active.devices[name]))
-      return name;
-    const byLabel = deviceKeyForLabel(name);
-    if (byLabel)
-      return byLabel;
-  }
+function defaultDeviceKey() {
   if (active.defaultDevice in active.devices && isEnabled(active.devices[active.defaultDevice])) {
     return active.defaultDevice;
   }
   const firstEnabled = Object.entries(active.devices).find(([, dc]) => isEnabled(dc));
   return firstEnabled ? firstEnabled[0] : active.defaultDevice;
 }
+function tryResolveDeviceName(name) {
+  if (!name)
+    return;
+  if (name in active.devices && isEnabled(active.devices[name]))
+    return name;
+  return deviceKeyForLabel(name);
+}
+function resolveDeviceName(name) {
+  if (!name)
+    return defaultDeviceKey();
+  const resolved = tryResolveDeviceName(name);
+  if (resolved)
+    return resolved;
+  throw new Error(unknownDeviceMessage(name));
+}
+function unknownDeviceMessage(name) {
+  const enabled = listDevices().names;
+  const disabled = name in active.devices && !isEnabled(active.devices[name]);
+  if (disabled) {
+    return `Device '${name}' is disabled. Enable it from the dashboard or config file. Enabled devices: ${enabled.join(", ")}`;
+  }
+  return `Unknown device '${name}'. Enabled devices: ${enabled.join(", ") || "(none)"}. ` + "Call list_mikrotik_devices for the authoritative current set \u2014 this was NOT run against " + "the default device.";
+}
 function deviceTarget(dc) {
   if (!dc)
     return "?";
@@ -802,9 +830,6 @@ function resolvedTarget(name) {
   return { key, label: dc?.description?.trim() || undefined, target: deviceTarget(dc) };
 }
 function getDevice(name) {
-  if (name && !(name in active.devices) && !deviceKeyForLabel(name)) {
-    throw new Error(`Unknown device '${name}'. Configured devices: ${Object.keys(active.devices).join(", ")}`);
-  }
   const key = resolveDeviceName(name);
   const dc = active.devices[key];
   if (!dc)
@@ -2209,6 +2234,27 @@ function parseDetailRecords(lines) {
   flush();
   return rows;
 }
+function filterDetailBlocks(text, predicate) {
+  const lines = text.split(/\r?\n/);
+  const firstRecord = lines.findIndex((l) => INDEX_LINE.test(l));
+  if (firstRecord === -1)
+    return text;
+  const preamble = lines.slice(0, firstRecord);
+  const blocks = [];
+  for (const line of lines.slice(firstRecord)) {
+    if (INDEX_LINE.test(line) || blocks.length === 0)
+      blocks.push([]);
+    blocks[blocks.length - 1].push(line);
+  }
+  const kept = blocks.filter((block) => {
+    const [row] = parseDetailRecords(block);
+    return row ? predicate(row) : false;
+  });
+  if (kept.length === 0)
+    return "";
+  return [...preamble, ...kept.flat()].join(`
+`);
+}
 function parseColumnarRecords(lines) {
   const headerIdx = lines.findIndex((l) => /\S/.test(l) && !l.includes("=") && /^[\s#]*[#A-Z]/.test(l) && /[A-Z]/.test(l));
   if (headerIdx === -1)
@@ -2579,8 +2625,20 @@ function portConflictError(result, port) {
   if (!/configured elsewhere/i.test(result))
     return;
   const other = result.match(/\*\d+\s*=\s*([A-Za-z][\w-]*)/)?.[1];
-  const which = port != null ? `port ${port}` : "that port";
-  return other ? `${which} is already used by the '${other}' service \u2014 two services can't share a port. Pick a different port, or change/disable '${other}' first (disable_ip_service / set_ip_service).` : `${which} is already in use elsewhere \u2014 two items can't share it. Pick a different port, or free it on the conflicting item first.`;
+  if (port == null) {
+    return `the device rejected this change with 'configured elsewhere' \u2014 the command targeted more ` + `than one row, or the value is owned by another item${other ? ` (RouterOS named '${other}')` : ""}. No port was being changed, so this is not a port collision.`;
+  }
+  return other ? `port ${port} is already used by the '${other}' service \u2014 two services can't share a port. Pick a different port, or change/disable '${other}' first (disable_ip_service / set_ip_service).` : `port ${port} is already in use elsewhere \u2014 two items can't share it. Pick a different port, or free it on the conflicting item first.`;
+}
+function interfaceValueError(result, fields) {
+  if (!/input does not match any value of interface/i.test(result))
+    return;
+  const sent = fields.filter((f) => f.value !== undefined && f.value !== "");
+  if (sent.length === 0)
+    return;
+  const which = sent.map((f) => `${f.name}='${f.value ?? ""}'`).join(", ");
+  const listHint = sent.map((f) => `${f.name}_list`).join(" / ");
+  return `the device rejected an interface value (${which}) \u2014 it is not the name of an interface ` + `on this router. If you meant an interface LIST (e.g. WAN, LAN), use ${listHint} instead; ` + "list_interfaces shows the valid interface names.";
 }
 function commandUnsupported(result) {
   const t = result.toLowerCase();
@@ -4399,6 +4457,18 @@ function gatingDecision(requires, multiDevice) {
   }
   return { prefix: `[unavailable on this device: ${unmet}]` };
 }
+var HTML_ENTITIES = /&(amp|lt|gt|quot|#0?39|apos);/i;
+function htmlEscapedArgument(args) {
+  for (const [key, value] of Object.entries(args)) {
+    if (typeof value !== "string")
+      continue;
+    const hit = value.match(HTML_ENTITIES);
+    if (!hit)
+      continue;
+    return `'${key}' contains HTML-escaped text (${hit[0]}). RouterOS stores it literally, so the ` + `value would be saved with "${hit[0]}" in it and every later exact lookup ` + `(e.g. [find comment="\u2026"]) would fail to match. Send the character itself ` + `(&, <, >, ", ') \u2014 quoting and escaping for the console is handled automatically.`;
+  }
+  return;
+}
 function defineTool(def) {
   return {
     name: def.name,
@@ -4432,6 +4502,21 @@ function defineTool(def) {
       const callback = async (args) => {
         const { device, reason, ...rest } = args;
         const deviceName = typeof device === "string" ? device : undefined;
+        if (!def.noDevice && deviceName !== undefined && !tryResolveDeviceName(deviceName)) {
+          const text = `Error: ${unknownDeviceMessage(deviceName)}`;
+          logger.error(text);
+          sendLog?.("error", text);
+          return { content: [{ type: "text", text }], isError: true };
+        }
+        if (risk !== "READ") {
+          const escaped = htmlEscapedArgument(rest);
+          if (escaped) {
+            const text = `Error: ${escaped}`;
+            logger.error(text);
+            sendLog?.("error", text);
+            return { content: [{ type: "text", text }], isError: true };
+          }
+        }
         const policy = getAccessPolicy();
         if (policy.enabled) {
           const resolvedDevice = def.noDevice ? undefined : resolveDeviceName(deviceName);
@@ -8434,7 +8519,12 @@ var complianceAuditTools = [
           results.push({ device: resolved, report, text });
           for (const e of report.evaluatedChecks) {
             if (e.result.status === "fail" || e.result.status === "warn") {
-              failTally.set(e.check.id, (failTally.get(e.check.id) ?? 0) + 1);
+              const prev = failTally.get(e.check.id);
+              failTally.set(e.check.id, {
+                count: (prev?.count ?? 0) + 1,
+                label: e.result.label,
+                status: prev?.status === "fail" ? "fail" : e.result.status
+              });
             }
           }
         } catch (err) {
@@ -8480,11 +8570,12 @@ Error: ${err instanceof Error ? err.message : String(err)}`
         lines.push("");
       }
       if (failTally.size > 0) {
-        const sorted = [...failTally.entries()].sort((a2, b) => b[1] - a2[1]).slice(0, 10);
+        const sorted = [...failTally.entries()].sort((a2, b) => b[1].count - a2[1].count).slice(0, 10);
         lines.push("\u2500\u2500 MOST COMMON FAILURES \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
-        for (const [id, count] of sorted) {
+        for (const [id, { count, label, status }] of sorted) {
           const check = ALL_CHECKS.find((c) => c.id === id);
-          lines.push(`  ${String(count).padStart(2)}/${targets.length} devices  ${id.padEnd(30)}  ${check?.title ?? ""}`);
+          const want = check?.title ? `  (should be: ${check.title})` : "";
+          lines.push(`  ${String(count).padStart(2)}/${targets.length} devices  ${status.toUpperCase().padEnd(4)}  ${id.padEnd(30)}  ${label}${want}`);
         }
         lines.push("");
       }
@@ -11010,7 +11101,7 @@ var cache2 = null;
 async function gateway() {
   if (cache2)
     return cache2;
-  const { moduleCatalog } = await import("./cli-qqwjbjnv.js");
+  const { moduleCatalog } = await import("./cli-h41j14aw.js");
   const forIndex = [];
   const byName = new Map;
   for (const mod of moduleCatalog) {
@@ -16514,20 +16605,36 @@ Management access may be partially restricted \u2014 review immediately.`;
 import { z as z35 } from "zod";
 
 // src/tools/_resolve-rule-id.ts
+var VALID_ID = /^(?:\*[0-9a-fA-F]+|\d+)$/;
+function isValidItemId(id) {
+  return VALID_ID.test(id.trim());
+}
+async function listItemIds(scope, ctx) {
+  const idsRaw = await executeMikrotikCommand(`:foreach i in=[${scope} find] do={:put $i}`, ctx);
+  if (isEmpty(idsRaw))
+    return [];
+  return idsRaw.trim().split(/\r?\n/).map((l) => l.trim()).filter(Boolean);
+}
 function ruleResolver(scope) {
   return async function resolveRuleId(ruleId, ctx) {
-    if (/^\d+$/.test(ruleId)) {
-      const idsRaw = await executeMikrotikCommand(`:foreach i in=[${scope} find] do={:put $i}`, ctx);
-      if (isEmpty(idsRaw))
+    const id = ruleId.trim();
+    if (!isValidItemId(id))
+      return null;
+    if (/^\d+$/.test(id)) {
+      const ids = await listItemIds(scope, ctx);
+      if (ids.length === 0)
         return null;
-      const ids = idsRaw.trim().split(/\r?\n/).map((l) => l.trim()).filter(Boolean);
-      const pos = Number.parseInt(ruleId, 10);
+      const pos = Number.parseInt(id, 10);
       return pos >= 0 && pos < ids.length ? ids[pos] : null;
     }
-    const count = await executeMikrotikCommand(`${scope} print count-only where .id=${ruleId}`, ctx);
-    return count.trim() !== "0" ? ruleId : null;
+    const count = await executeMikrotikCommand(`${scope} print count-only where .id=${id}`, ctx);
+    return count.trim() !== "0" ? id : null;
   };
 }
+function notFoundMessage(what, id, listTool) {
+  const shape = isValidItemId(id) ? "" : ` '${id}' is not a valid reference \u2014 pass the \`.id\` from ${listTool} (e.g. "*1F") or a bare row position (e.g. "3").`;
+  return `${what} '${id}' not found.${shape}`;
+}
 
 // src/tools/firewall-filter.ts
 var isDigits = (s) => /^\d+$/.test(s);
@@ -16620,8 +16727,13 @@ async function updateFilterRule(a, ctx) {
     return `Firewall filter rule '${a.rule_id}' not found.`;
   const cmd = `/ip firewall filter set ${id} ${updates.join(" ")}`;
   const result = await executeMikrotikCommand(cmd, ctx);
-  if (looksLikeError(result))
-    return `Failed to update firewall filter rule: ${result}`;
+  if (looksLikeError(result)) {
+    const hint = interfaceValueError(result, [
+      { name: "in_interface", value: a.in_interface },
+      { name: "out_interface", value: a.out_interface }
+    ]);
+    return `Failed to update firewall filter rule: ${hint ?? result}`;
+  }
   const details = await executeMikrotikCommand(`/ip firewall filter print detail where .id=${id}`, ctx);
   return `Firewall filter rule updated successfully:
 
@@ -16710,7 +16822,10 @@ var firewallFilterTools = [
       const result = await executeMikrotikCommand(cmd, ctx);
       const trimmed = result.trim();
       if (looksLikeError(trimmed)) {
-        const hint = placeBeforeError(trimmed, a.place_before);
+        const hint = placeBeforeError(trimmed, a.place_before) ?? interfaceValueError(trimmed, [
+          { name: "in_interface", value: a.in_interface },
+          { name: "out_interface", value: a.out_interface }
+        ]);
         return `Failed to create firewall filter rule: ${hint ?? trimmed}`;
       }
       const createdId = extractCreatedId(trimmed);
@@ -16758,18 +16873,31 @@ ${details}`;
         filters.push(`src-address~"${a.src_address_filter}"`);
       if (a.dst_address_filter)
         filters.push(`dst-address~"${a.dst_address_filter}"`);
-      if (a.protocol_filter)
-        filters.push(`protocol=${a.protocol_filter}`);
-      if (a.interface_filter) {
-        filters.push(`(in-interface~"${a.interface_filter}" or out-interface~"${a.interface_filter}")`);
-      }
       if (a.disabled_only)
         filters.push("disabled=yes");
       if (a.invalid_only)
         filters.push("invalid=yes");
       if (a.dynamic_only)
         filters.push("dynamic=yes");
-      const result = await executeMikrotikCommand(`/ip firewall filter print detail${whereClause(filters)}`, ctx);
+      const raw = await executeMikrotikCommand(`/ip firewall filter print detail${whereClause(filters)}`, ctx);
+      const protocolWanted = a.protocol_filter?.toLowerCase();
+      const interfaceWanted = a.interface_filter?.toLowerCase();
+      const result = protocolWanted || interfaceWanted ? filterDetailBlocks(raw, (row) => {
+        if (protocolWanted && (row.protocol ?? "").toLowerCase() !== protocolWanted) {
+          return false;
+        }
+        if (interfaceWanted) {
+          const hit = [
+            row["in-interface"],
+            row["out-interface"],
+            row["in-interface-list"],
+            row["out-interface-list"]
+          ].some((v) => (v ?? "").toLowerCase().includes(interfaceWanted));
+          if (!hit)
+            return false;
+        }
+        return true;
+      }) : raw;
       return isEmpty(result) ? "No firewall filter rules found matching the criteria." : `FIREWALL FILTER RULES:
 
 ${result}`;
@@ -16779,7 +16907,7 @@ ${result}`;
     name: "get_filter_rule",
     title: "Get Firewall Filter Rule",
     annotations: READ,
-    description: "Gets the full detail of one IPv4 firewall FILTER rule (`/ip firewall filter`) by id \u2014 " + "every matcher, action, counter and flag. For IPv6 use get_ipv6_filter_rule. " + 'rule_id: preferably the `.id` from list_filter_rules e.g. "*1F". A bare number like "3" ' + "is tried as `.id=*3` first, then as the positional row index if no `.id` matches.",
+    description: "Gets the full detail of one IPv4 firewall FILTER rule (`/ip firewall filter`) by id \u2014 " + "every matcher, action, counter and flag. For IPv6 use get_ipv6_filter_rule. " + 'rule_id: preferably the `.id` from list_filter_rules e.g. "*1F". A bare number like "3" ' + "is read as the positional ROW INDEX and resolved to whatever `.id` currently sits there \u2014 " + "it is never treated as `.id=*3`, since a `*N` id is hex and reassigned over time. Row " + "positions shift whenever a rule is added, removed or moved, so prefer the `.id`.",
     inputSchema: {
       rule_id: z35.string().describe('Rule .id e.g. "*1F", or bare position number e.g. "3"')
     },
@@ -16887,10 +17015,23 @@ ${result}`;
       const id = await resolveFilterRuleId(a.rule_id, ctx);
       if (!id)
         return `Firewall filter rule '${a.rule_id}' not found.`;
+      const before = await listItemIds("/ip firewall filter", ctx);
       const result = await executeMikrotikCommand(`/ip firewall filter move ${id} destination=${a.destination}`, ctx);
       if (looksLikeError(result))
         return `Failed to move firewall filter rule: ${result}`;
-      return `Firewall filter rule '${a.rule_id}' (${id}) moved to position ${a.destination}.`;
+      const after = await listItemIds("/ip firewall filter", ctx);
+      const from = before.indexOf(id);
+      const to = after.indexOf(id);
+      if (to === -1) {
+        return `Firewall filter rule ${id} moved, but it could not be located afterwards \u2014 verify with list_filter_rules.`;
+      }
+      if (to === a.destination) {
+        return `Firewall filter rule '${a.rule_id}' (${id}) moved to position ${to}.`;
+      }
+      if (to === from) {
+        return `NO CHANGE: firewall filter rule '${a.rule_id}' (${id}) is still at position ${to} \u2014 ` + `RouterOS ignored the move to ${a.destination}. Destination is 0-based and counts ` + `ALL rules in the menu (${after.length} total), not just this rule's chain; a ` + "destination at or past the end, or equal to the current position, does nothing.";
+      }
+      return `Firewall filter rule '${a.rule_id}' (${id}) moved from position ${from} to ${to} ` + `(requested ${a.destination} \u2014 RouterOS places the rule BEFORE the item currently at ` + "the destination index, so the final index can differ when moving downward).";
     }
   }),
   defineTool({
@@ -18630,6 +18771,7 @@ ${result}`;
 
 // src/tools/ip-service.ts
 import { z as z43 } from "zod";
+var staticService = (name) => `[find name="${name}" and !dynamic]`;
 var ipServiceTools = [
   defineTool({
     name: "list_ip_services",
@@ -18675,7 +18817,7 @@ ${result}`;
     },
     async handler(a, ctx) {
       ctx.info(`Updating IP service: name=${a.name}`);
-      const cmd = new Cmd(`/ip service set [find name="${a.name}"]`).opt("port", a.port).opt("address", a.address).bool("disabled", a.disabled).opt("certificate", a.certificate).opt("vrf", a.vrf).build();
+      const cmd = new Cmd(`/ip service set ${staticService(a.name)}`).opt("port", a.port).opt("address", a.address).bool("disabled", a.disabled).opt("certificate", a.certificate).opt("vrf", a.vrf).build();
       if (!cmd.includes("=", cmd.indexOf("]")))
         return "No updates specified.";
       const result = await executeMikrotikCommand(cmd, ctx);
@@ -18699,7 +18841,7 @@ ${details}`;
     },
     async handler(a, ctx) {
       ctx.info(`Enabling IP service: name=${a.name}`);
-      const result = await executeMikrotikCommand(`/ip service enable [find name="${a.name}"]`, ctx);
+      const result = await executeMikrotikCommand(`/ip service enable ${staticService(a.name)}`, ctx);
       if (looksLikeError(result))
         return `Failed to enable IP service: ${result}`;
       return `IP service '${a.name}' enabled successfully.`;
@@ -18715,7 +18857,7 @@ ${details}`;
     },
     async handler(a, ctx) {
       ctx.info(`Disabling IP service: name=${a.name}`);
-      const result = await executeMikrotikCommand(`/ip service disable [find name="${a.name}"]`, ctx);
+      const result = await executeMikrotikCommand(`/ip service disable ${staticService(a.name)}`, ctx);
       if (looksLikeError(result))
         return `Failed to disable IP service: ${result}`;
       return `IP service '${a.name}' disabled successfully.`;
@@ -25212,7 +25354,7 @@ var speedTestTools = [
     },
     async handler(a, ctx) {
       ctx.info(`Speed test to ${a.address} (test-duration=${a.duration}s)`);
-      const cmd = new Cmd(`/tool speed-test address=${a.address}`).set("test-duration", `${a.duration}s`).opt("connection-count", a.connection_count).opt("user", a.user).opt("password", a.password).build();
+      const cmd = new Cmd("/tool speed-test").set("address", a.address).set("test-duration", `${a.duration}s`).opt("connection-count", a.connection_count).opt("user", a.user).opt("password", a.password).build();
       const result = flattenLiveOutput(await executeMikrotikCommand(cmd, ctx, { maxMs: a.duration * 1000 + 15000 }));
       if (looksLikeError(result))
         return `Failed to run speed test to ${a.address}: ${result}`;
@@ -29895,10 +30037,11 @@ async function collectRoutes(ctx) {
     dst: r["dst-address"] ?? "",
     gateway: r.gateway ?? "",
     distance: num(r.distance),
-    active: (r.flags ?? "").includes("A") || r.active === "true",
-    dynamic: (r.flags ?? "").includes("D") || r.dynamic === "true"
+    active: (r.flags ?? "").includes("A") || isYes(r.active),
+    dynamic: (r.flags ?? "").includes("D") || isYes(r.dynamic)
   }));
-  const hasDefault = routes.some((r) => r.dst === "0.0.0.0/0" && r.active);
+  const isDefaultDst = (dst) => dst === "0.0.0.0/0" || dst === "0.0.0.0/0*";
+  const hasDefault = routes.some((r) => isDefaultDst(r.dst) && r.active);
   return { routes, count: routes.length, hasDefault };
 }
 async function collectOspfNeighbors(ctx) {
@@ -30409,6 +30552,8 @@ var multiwanTools = [
 
 // src/tools/routes.ts
 import { z as z99 } from "zod";
+var resolveRouteId = ruleResolver("/ip route");
+var routeNotFound = (id) => notFoundMessage("Route", id, "list_routes");
 var RouteType2 = z99.enum(["unicast", "blackhole"]);
 async function addRoute(a, ctx) {
   ctx.info(`Adding route: dst=${a.dst_address}, gateway=${a.gateway}`);
@@ -30431,10 +30576,13 @@ ${details}` : "Route addition completed but unable to verify.";
 }
 async function setRouteDisabled(routeId, disabled, ctx) {
   ctx.info(`Updating route: route_id=${routeId}`);
-  const result = await executeMikrotikCommand(`/ip route set ${routeId} disabled=${yesno(disabled)}`, ctx);
+  const id = await resolveRouteId(routeId, ctx);
+  if (!id)
+    return routeNotFound(routeId);
+  const result = await executeMikrotikCommand(`/ip route set ${id} disabled=${yesno(disabled)}`, ctx);
   if (looksLikeError(result))
     return `Failed to update route: ${result}`;
-  const details = await executeMikrotikCommand(`/ip route print detail where .id=${routeId}`, ctx);
+  const details = await executeMikrotikCommand(`/ip route print detail where .id=${id}`, ctx);
   return `Route updated successfully:
 
 ${details}`;
@@ -30517,8 +30665,11 @@ ${result}`;
     },
     async handler(a, ctx) {
       ctx.info(`Getting route details: route_id=${a.route_id}`);
-      const result = await executeMikrotikCommand(`/ip route print detail where .id=${a.route_id}`, ctx);
-      return isEmpty(result) ? `Route with ID '${a.route_id}' not found.` : `ROUTE DETAILS:
+      const id = await resolveRouteId(a.route_id, ctx);
+      if (!id)
+        return routeNotFound(a.route_id);
+      const result = await executeMikrotikCommand(`/ip route print detail where .id=${id}`, ctx);
+      return isEmpty(result) ? routeNotFound(a.route_id) : `ROUTE DETAILS:
 
 ${result}`;
     }
@@ -30547,7 +30698,10 @@ ${result}`;
     },
     async handler(a, ctx) {
       ctx.info(`Updating route: route_id=${a.route_id}`);
-      const base = `/ip route set ${a.route_id}`;
+      const id = await resolveRouteId(a.route_id, ctx);
+      if (!id)
+        return routeNotFound(a.route_id);
+      const base = `/ip route set ${id}`;
       const cmd = new Cmd(base);
       if (a.dst_address)
         cmd.set("dst-address", a.dst_address);
@@ -30585,8 +30739,8 @@ ${result}`;
       const result = await executeMikrotikCommand(built, ctx);
       if (looksLikeError(result))
         return `Failed to update route: ${result}`;
-      const details = await executeMikrotikCommand(`/ip route print detail where .id=${a.route_id}`, ctx);
-      return `Route updated successfully:
+      const details = await executeMikrotikCommand(`/ip route print detail where .id=${id}`, ctx);
+      return `Route ${id} updated successfully:
 
 ${details}`;
     }
@@ -30601,13 +30755,16 @@ ${details}`;
     },
     async handler(a, ctx) {
       ctx.info(`Removing route: route_id=${a.route_id}`);
-      const count = await executeMikrotikCommand(`/ip route print count-only where .id=${a.route_id}`, ctx);
-      if (count.trim() === "0")
-        return `Route with ID '${a.route_id}' not found.`;
-      const result = await executeMikrotikCommand(`/ip route remove ${a.route_id}`, ctx);
+      const id = await resolveRouteId(a.route_id, ctx);
+      if (!id)
+        return routeNotFound(a.route_id);
+      const doomed = await executeMikrotikCommand(`/ip route print detail where .id=${id}`, ctx);
+      const result = await executeMikrotikCommand(`/ip route remove ${id}`, ctx);
       if (looksLikeError(result))
         return `Failed to remove route: ${result}`;
-      return `Route with ID '${a.route_id}' removed successfully.`;
+      return `Route ${id} removed successfully. Removed entry was:
+
+${doomed}`;
     }
   }),
   defineTool({
@@ -32135,14 +32292,22 @@ ${result}`;
     name: "add_ospf_interface_template",
     title: "Add OSPF Interface Template",
     annotations: WRITE,
-    description: "Bind interfaces or network prefixes to an OSPF area (`/routing ospf interface-template add`). " + "Match links via `interfaces` (interface or interface-list name) and/or `networks` (prefix, " + "e.g. '10.0.0.0/24'). `type` sets the link model: broadcast (LAN), ptp (point-to-point), " + "ptmp, ptmp-broadcast, nbma, or virtual-link. `passive=true` advertises the subnet without forming OSPF adjacencies " + "(for stub networks). `auth`/`auth_id`/`auth_key` enable per-interface authentication; `hello_interval` " + "e.g. '10s', `dead_interval` e.g. '40s'. " + "Requires the area to already exist (add_ospf_area). " + "Returns the new template id (e.g. '*2') if RouterOS echoes one; use list_ospf_interface_templates to verify.",
+    description: "Bind interfaces or network prefixes to an OSPF area (`/routing ospf interface-template add`). " + "Match links via `interfaces` (interface or interface-list name) and/or `networks` (prefix, " + "e.g. '10.0.0.0/24'). `type` sets the link model: broadcast (LAN), ptp (point-to-point), " + "ptp-unnumbered (point-to-point over an unnumbered link), ptmp, ptmp-broadcast, nbma, or " + "virtual-link. `passive=true` advertises the subnet without forming OSPF adjacencies " + "(for stub networks). `auth`/`auth_id`/`auth_key` enable per-interface authentication; `hello_interval` " + "e.g. '10s', `dead_interval` e.g. '40s'. " + "Requires the area to already exist (add_ospf_area). " + "Returns the new template id (e.g. '*2') if RouterOS echoes one; use list_ospf_interface_templates to verify.",
     inputSchema: {
       area: z107.string().describe("OSPF area name to attach matched interfaces to"),
       interfaces: z107.string().optional().describe("Interface or interface-list name"),
       networks: z107.string().optional().describe('Network prefix(es) to enable OSPF on, e.g. "10.0.0.0/24"'),
       cost: z107.number().int().optional().describe("Output cost / metric"),
       priority: z107.number().int().optional().describe("DR election priority (0 = never DR)"),
-      type: z107.enum(["broadcast", "ptp", "ptmp", "ptmp-broadcast", "nbma", "virtual-link"]).optional(),
+      type: z107.enum([
+        "broadcast",
+        "ptp",
+        "ptp-unnumbered",
+        "ptmp",
+        "ptmp-broadcast",
+        "nbma",
+        "virtual-link"
+      ]).optional(),
       passive: z107.boolean().optional(),
       hello_interval: z107.string().optional().describe('e.g. "10s"'),
       dead_interval: z107.string().optional().describe('e.g. "40s"'),
@@ -34988,7 +35153,7 @@ function resolveTargets(targets) {
   const cfg = getConfig();
   const notes = [];
   if (Array.isArray(targets)) {
-    const unknown = targets.filter((t) => !(resolveDeviceName(t) in cfg.devices));
+    const unknown = targets.filter((t) => !tryResolveDeviceName(t));
     if (unknown.length > 0) {
       return { devices: [], notes, error: `unknown device(s): ${unknown.join(", ")}` };
     }
@@ -35955,7 +36120,7 @@ var riskByTool = null;
 async function riskIndex() {
   if (riskByTool)
     return riskByTool;
-  const { moduleCatalog } = await import("./cli-qqwjbjnv.js");
+  const { moduleCatalog } = await import("./cli-h41j14aw.js");
   const index = new Map;
   for (const mod of moduleCatalog) {
     for (const tool of mod.tools)
@@ -42932,6 +43097,8 @@ ${config}`;
 
 // src/tools/wireguard.ts
 import { z as z138 } from "zod";
+var resolvePeerId = ruleResolver("/interface wireguard peers");
+var peerNotFound = (id) => notFoundMessage("WireGuard peer", id, "list_wireguard_peers");
 var wireguardTools = [
   defineTool({
     name: "create_wireguard_interface",
@@ -43056,17 +43223,26 @@ ${details}`;
     name: "remove_wireguard_interface",
     title: "Remove WireGuard Interface",
     annotations: DESTRUCTIVE,
-    description: "Permanently deletes a WireGuard tunnel interface (`/interface wireguard remove`) by name." + " Verifies existence first with count-only; removing the interface also removes all its associated peers." + " For removing only a specific peer without touching the interface use remove_wireguard_peer.",
+    description: "Permanently deletes a WireGuard tunnel interface (`/interface wireguard remove`) by name," + " together with every peer bound to it. Verifies existence first with count-only." + " For removing only a specific peer without touching the interface use remove_wireguard_peer." + " Reports how many peers were removed alongside the interface.",
     inputSchema: { name: z138.string() },
     async handler(a, ctx) {
       ctx.info(`Removing WireGuard interface: name=${a.name}`);
       const count = await executeMikrotikCommand(`/interface wireguard print count-only where name="${a.name}"`, ctx);
       if (count.trim() === "0")
         return `WireGuard interface '${a.name}' not found.`;
+      const peerCount = (await executeMikrotikCommand(`/interface wireguard peers print count-only where interface="${a.name}"`, ctx)).trim();
+      if (peerCount !== "0" && !looksLikeError(peerCount)) {
+        const peerResult = await executeMikrotikCommand(`/interface wireguard peers remove [find interface="${a.name}"]`, ctx);
+        if (looksLikeError(peerResult)) {
+          return `Failed to remove the peers bound to '${a.name}': ${peerResult}
+` + "The interface was NOT removed \u2014 removing it now would orphan those peers.";
+        }
+      }
       const result = await executeMikrotikCommand(`/interface wireguard remove [find name="${a.name}"]`, ctx);
       if (looksLikeError(result))
         return `Failed to remove WireGuard interface: ${result}`;
-      return `WireGuard interface '${a.name}' removed successfully.`;
+      const peers = peerCount === "0" ? "no peers were bound to it" : `${peerCount} peer(s) removed`;
+      return `WireGuard interface '${a.name}' removed successfully (${peers}).`;
     }
   }),
   defineTool({
@@ -43173,8 +43349,11 @@ ${result}`;
     },
     async handler(a, ctx) {
       ctx.info(`Getting WireGuard peer details: peer_id=${a.peer_id}`);
-      const result = await executeMikrotikCommand(`/interface wireguard peers print detail where .id=${a.peer_id}`, ctx);
-      return isEmpty(result) ? `WireGuard peer with ID '${a.peer_id}' not found.` : `WIREGUARD PEER DETAILS:
+      const id = await resolvePeerId(a.peer_id, ctx);
+      if (!id)
+        return peerNotFound(a.peer_id);
+      const result = await executeMikrotikCommand(`/interface wireguard peers print detail where .id=${id}`, ctx);
+      return isEmpty(result) ? peerNotFound(a.peer_id) : `WIREGUARD PEER DETAILS:
 
 ${result}`;
     }
@@ -43192,6 +43371,7 @@ ${result}`;
 ` + '  Pass "" for endpoint_address or preshared_key to clear them.',
     inputSchema: {
       peer_id: z138.string().describe('"*N" or "N" from list output e.g. "*2"'),
+      public_key: z138.string().optional().describe("The peer's base64 public key \u2014 re-key a peer in place instead of removing and " + "re-adding it (which would lose the rest of its configuration)."),
       allowed_address: z138.string().optional(),
       endpoint_address: z138.string().optional(),
       endpoint_port: z138.number().int().optional(),
@@ -43210,15 +43390,18 @@ ${result}`;
     },
     async handler(a, ctx) {
       ctx.info(`Updating WireGuard peer: peer_id=${a.peer_id}`);
-      const base = `/interface wireguard peers set ${a.peer_id}`;
-      const cmd = new Cmd(base).raw(a.allowed_address !== undefined ? `allowed-address=${quoteValue(a.allowed_address)}` : null).raw(a.endpoint_address !== undefined ? a.endpoint_address === "" ? "!endpoint-address" : `endpoint-address=${quoteValue(a.endpoint_address)}` : null).opt("endpoint-port", a.endpoint_port).raw(a.preshared_key !== undefined ? a.preshared_key === "" ? "!preshared-key" : `preshared-key=${quoteValue(a.preshared_key)}` : null).raw(a.persistent_keepalive !== undefined ? `persistent-keepalive=${a.persistent_keepalive}` : null).opt("name", a.name).opt("private-key", a.private_key).bool("responder", a.responder).raw(a.client_address !== undefined ? a.client_address === "" ? "!client-address" : `client-address=${quoteValue(a.client_address)}` : null).raw(a.client_dns !== undefined ? a.client_dns === "" ? "!client-dns" : `client-dns=${quoteValue(a.client_dns)}` : null).raw(a.client_endpoint !== undefined ? a.client_endpoint === "" ? "!client-endpoint" : `client-endpoint=${quoteValue(a.client_endpoint)}` : null).opt("client-keepalive", a.client_keepalive).opt("client-listen-port", a.client_listen_port).raw(a.comment !== undefined ? `comment=${quoteValue(a.comment)}` : null).bool("disabled", a.disabled).build();
+      const id = await resolvePeerId(a.peer_id, ctx);
+      if (!id)
+        return peerNotFound(a.peer_id);
+      const base = `/interface wireguard peers set ${id}`;
+      const cmd = new Cmd(base).raw(a.public_key !== undefined ? `public-key=${quoteValue(a.public_key)}` : null).raw(a.allowed_address !== undefined ? `allowed-address=${quoteValue(a.allowed_address)}` : null).raw(a.endpoint_address !== undefined ? a.endpoint_address === "" ? "!endpoint-address" : `endpoint-address=${quoteValue(a.endpoint_address)}` : null).opt("endpoint-port", a.endpoint_port).raw(a.preshared_key !== undefined ? a.preshared_key === "" ? "!preshared-key" : `preshared-key=${quoteValue(a.preshared_key)}` : null).raw(a.persistent_keepalive !== undefined ? `persistent-keepalive=${a.persistent_keepalive}` : null).opt("name", a.name).opt("private-key", a.private_key).bool("responder", a.responder).raw(a.client_address !== undefined ? a.client_address === "" ? "!client-address" : `client-address=${quoteValue(a.client_address)}` : null).raw(a.client_dns !== undefined ? a.client_dns === "" ? "!client-dns" : `client-dns=${quoteValue(a.client_dns)}` : null).raw(a.client_endpoint !== undefined ? a.client_endpoint === "" ? "!client-endpoint" : `client-endpoint=${quoteValue(a.client_endpoint)}` : null).opt("client-keepalive", a.client_keepalive).opt("client-listen-port", a.client_listen_port).raw(a.comment !== undefined ? `comment=${quoteValue(a.comment)}` : null).bool("disabled", a.disabled).build();
       if (cmd === base)
         return "No updates specified.";
       const result = await executeMikrotikCommand(cmd, ctx);
       if (looksLikeError(result))
         return `Failed to update WireGuard peer: ${result}`;
-      const details = await executeMikrotikCommand(`/interface wireguard peers print detail where .id=${a.peer_id}`, ctx);
-      return `WireGuard peer updated successfully:
+      const details = await executeMikrotikCommand(`/interface wireguard peers print detail where .id=${id}`, ctx);
+      return `WireGuard peer ${id} updated successfully:
 
 ${details}`;
     }
@@ -43236,13 +43419,16 @@ ${details}`;
     },
     async handler(a, ctx) {
       ctx.info(`Removing WireGuard peer: peer_id=${a.peer_id}`);
-      const count = await executeMikrotikCommand(`/interface wireguard peers print count-only where .id=${a.peer_id}`, ctx);
-      if (count.trim() === "0")
-        return `WireGuard peer with ID '${a.peer_id}' not found.`;
-      const result = await executeMikrotikCommand(`/interface wireguard peers remove ${a.peer_id}`, ctx);
+      const id = await resolvePeerId(a.peer_id, ctx);
+      if (!id)
+        return peerNotFound(a.peer_id);
+      const doomed = await executeMikrotikCommand(`/interface wireguard peers print detail where .id=${id}`, ctx);
+      const result = await executeMikrotikCommand(`/interface wireguard peers remove ${id}`, ctx);
       if (looksLikeError(result))
         return `Failed to remove WireGuard peer: ${result}`;
-      return `WireGuard peer '${a.peer_id}' removed successfully.`;
+      return `WireGuard peer ${id} removed successfully. Removed entry was:
+
+${doomed}`;
     }
   }),
   defineTool({
@@ -43258,10 +43444,13 @@ ${details}`;
     },
     async handler(a, ctx) {
       ctx.info(`Enabling WireGuard peer: peer_id=${a.peer_id}`);
-      const result = await executeMikrotikCommand(`/interface wireguard peers enable ${a.peer_id}`, ctx);
+      const id = await resolvePeerId(a.peer_id, ctx);
+      if (!id)
+        return peerNotFound(a.peer_id);
+      const result = await executeMikrotikCommand(`/interface wireguard peers enable ${id}`, ctx);
       if (looksLikeError(result))
         return `Failed to enable WireGuard peer: ${result}`;
-      return `WireGuard peer '${a.peer_id}' enabled successfully.`;
+      return `WireGuard peer ${id} enabled successfully.`;
     }
   }),
   defineTool({
@@ -43277,10 +43466,13 @@ ${details}`;
     },
     async handler(a, ctx) {
       ctx.info(`Disabling WireGuard peer: peer_id=${a.peer_id}`);
-      const result = await executeMikrotikCommand(`/interface wireguard peers disable ${a.peer_id}`, ctx);
+      const id = await resolvePeerId(a.peer_id, ctx);
+      if (!id)
+        return peerNotFound(a.peer_id);
+      const result = await executeMikrotikCommand(`/interface wireguard peers disable ${id}`, ctx);
       if (looksLikeError(result))
         return `Failed to disable WireGuard peer: ${result}`;
-      return `WireGuard peer '${a.peer_id}' disabled successfully.`;
+      return `WireGuard peer ${id} disabled successfully.`;
     }
   }),
   defineTool({