@usex/mikrotik-mcp 5.8.0 → 5.9.0

package/dist/index.d.ts

@@ -212,6 +212,8 @@ interface RegisterableTool {
 	annotations: ToolAnnotations;
 	inputSchema?: ZodRawShape;
 	description: string;
+	/** Server-only tools do not participate in device access checks. */
+	noDevice?: boolean;
 	/** Present when the tool renders an MCP App view. */
 	ui?: UiLink;
 	/** Device requirements, if the tool declared any. */

package/dist/index.js

@@ -62,7 +62,7 @@ import {
   updateSummaryLine,
   allToolModules2,
   selectToolModules2
-} from "./shared/library-srhzw8ym.js";
+} from "./shared/library-dyeaqzj6.js";
 
 // node_modules/ajv/dist/compile/codegen/code.js
 var require_code = __commonJS(function(exports) {

package/dist/shared/{library-srhzw8ym.js → library-dyeaqzj6.js}

@@ -11089,6 +11089,12 @@ function toolUiMeta(ui) {
   return meta;
 }
 
+// src/core/tool-pattern.ts
+function globMatch(pattern, name) {
+  const rx = new RegExp(`^${pattern.toLowerCase().replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*")}$`);
+  return rx.test(name.toLowerCase());
+}
+
 // src/core/access.ts
 var RISK_ORDER = [
   "READ",
@@ -11104,10 +11110,6 @@ var RISK_RANK = {
   DESTRUCTIVE: 2,
   DANGEROUS: 3
 };
-function globMatch(pattern, name) {
-  const rx = new RegExp(`^${pattern.toLowerCase().replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*")}$`);
-  return rx.test(name.toLowerCase());
-}
 function matchesAny(patterns, name) {
   return (patterns ?? []).some((p) => globMatch(p, name));
 }
@@ -11137,7 +11139,20 @@ function evaluateAccess(policy, req) {
       reason: `Tool '${req.tool}' is outside the active access scope${where}. ` + `Allowed: ${s.tools.join(", ")}.`
     };
   }
+  if ((s.toolAllowGroups ?? []).some((group) => !matchesAny(group, req.tool))) {
+    return {
+      allowed: false,
+      rule: "tool",
+      reason: `Tool '${req.tool}' does not satisfy every configured and session tool allow-list${where}.`
+    };
+  }
   if (req.device !== undefined) {
+    if (s.noDevices)
+      return {
+        allowed: false,
+        rule: "device",
+        reason: `No devices remain in the intersection of the configured and session access scopes${where}.`
+      };
     if ((s.denyDevices ?? []).some((d) => d.toLowerCase() === req.device.toLowerCase())) {
       return {
         allowed: false,
@@ -11176,7 +11191,14 @@ function narrowScope(base, requested) {
     return b.filter((x) => lower.has(x.toLowerCase()));
   };
   out.devices = intersect(base.devices, requested.devices);
+  if (base.noDevices || requested.noDevices || base.devices?.length && requested.devices?.length && !out.devices?.length)
+    out.noDevices = true;
   out.tools = requested.tools && requested.tools.length > 0 ? requested.tools : base.tools;
+  const groups = [...base.toolAllowGroups ?? [], ...requested.toolAllowGroups ?? []];
+  if (base.tools?.length && requested.tools?.length)
+    groups.push(base.tools);
+  if (groups.length)
+    out.toolAllowGroups = [...new Map(groups.map((g) => [JSON.stringify(g), g])).values()];
   out.denyDevices = [...new Set([...base.denyDevices ?? [], ...requested.denyDevices ?? []])];
   out.denyTools = [...new Set([...base.denyTools ?? [], ...requested.denyTools ?? []])];
   if (out.denyDevices.length === 0)
@@ -11211,14 +11233,17 @@ function adoptConfiguredPolicy() {
 }
 onConfigChanged(adoptConfiguredPolicy);
 adoptConfiguredPolicy();
-function getAccessPolicy() {
+function previewAccessPolicy(policy) {
   if (!sessionNarrowing)
-    return basePolicy;
+    return policy;
   return {
     enabled: true,
-    scope: narrowScope(basePolicy.scope, sessionNarrowing)
+    scope: narrowScope(policy.scope, sessionNarrowing)
   };
 }
+function getAccessPolicy() {
+  return previewAccessPolicy(basePolicy);
+}
 function narrowSession(requested) {
   sessionNarrowing = sessionNarrowing ? narrowScope(sessionNarrowing, requested) : narrowScope(basePolicy.scope, requested);
   return getAccessPolicy().scope;
@@ -12466,6 +12491,7 @@ function defineTool2(def) {
     description: def.description,
     annotations: def.annotations,
     inputSchema: def.inputSchema,
+    noDevice: def.noDevice,
     ui: def.ui,
     requires: def.requires,
     handler: def.handler,
@@ -22843,7 +22869,7 @@ var cache2 = null;
 async function gateway() {
   if (cache2)
     return cache2;
-  const { moduleCatalog } = await import("./library-hsq1a106.js");
+  const { moduleCatalog } = await import("./library-rkr0yp3t.js");
   const forIndex = [];
   const byName = new Map;
   for (const mod of moduleCatalog) {
@@ -34258,7 +34284,7 @@ ${DATASET_NOTE}`;
 function renderScope(scope) {
   const lines = [];
   lines.push(`  max risk    : ${scope.maxRisk ?? "(no ceiling)"}`);
-  lines.push(`  devices     : ${scope.devices && scope.devices.length > 0 ? scope.devices.join(", ") : "(all configured)"}`);
+  lines.push(`  devices     : ${scope.noDevices ? "(none: scopes do not overlap)" : scope.devices && scope.devices.length > 0 ? scope.devices.join(", ") : "(all configured)"}`);
   if (scope.denyDevices && scope.denyDevices.length > 0) {
     lines.push(`  denied devs : ${scope.denyDevices.join(", ")}`);
   }
@@ -34266,6 +34292,8 @@ function renderScope(scope) {
   if (scope.denyTools && scope.denyTools.length > 0) {
     lines.push(`  denied tools: ${scope.denyTools.join(", ")}`);
   }
+  for (const group of scope.toolAllowGroups ?? [])
+    lines.push(`  also match  : ${group.join(", ")}`);
   lines.push(`  expires     : ${scope.expiresAt ? new Date(scope.expiresAt).toISOString() : "(never)"}`);
   if (scope.label)
     lines.push(`  label       : ${scope.label}`);
@@ -44819,7 +44847,7 @@ var riskByTool = null;
 async function riskIndex() {
   if (riskByTool)
     return riskByTool;
-  const { moduleCatalog } = await import("./library-hsq1a106.js");
+  const { moduleCatalog } = await import("./library-rkr0yp3t.js");
   const index = new Map;
   for (const mod of moduleCatalog) {
     for (const tool of mod.tools)

package/dist/shared/{library-hsq1a106.js → library-rkr0yp3t.js}

@@ -3,7 +3,7 @@ import {
   moduleCatalog2,
   allToolModules2,
   selectToolModules2
-} from "./library-srhzw8ym.js";
+} from "./library-dyeaqzj6.js";
 export {
   allToolModules2 as allToolModules,
   moduleCatalog2 as moduleCatalog,