@usex/mikrotik-mcp 5.9.0 → 5.11.0

package/README.md

@@ -46,6 +46,12 @@ Then just ask:
 
 ## Highlights
 
+- **MCP App workspaces** — 13 host-themed views, with dedicated investigation,
+  round-trip, service-health, L2 fabric, operations and report workspaces alongside
+  the existing device, interface, firewall and record views. Responsive grids,
+  named path interfaces, expandable evidence and colored JSON keep results readable
+  inside compatible MCP clients. New report views never execute or replay tools.
+  [View guide](docs/mcp-app-workspaces.md)
 - **Round-trip path lab** — model explicit forward/reverse static IPv4 paths across
   fresh snapshots, with per-hop evidence and declared asymmetry. NAT or unsupported
   state stops with UNKNOWN; modelled forwarding is not live connectivity.

package/dist/cli.js

@@ -16764,7 +16764,7 @@ function poolStatus() {
 }
 
 // src/ssh/safe-mode.ts
-var PROMPT_RE = /\[.+?@.+?\] (?:<SAFE> )?> ?$/m;
+var PROMPT_RE = /\[[^\r\n\]]+@[^\r\n\]]+\][ \t]+(?:\/[^\r\n<>]*[ \t]*)?(?:<SAFE>(?:[ \t]*>)?|>)[ \t]*$/;
 var ANSI_RE = /\x1B(?:\[[0-9;]*[mA-HJ-MSTfhilnprsu]|[()][0-9A-Za-z]|\[?\?\d+[hl])/g;
 function stripAnsi(text) {
   return text.replace(ANSI_RE, "");
@@ -16832,8 +16832,9 @@ class SafeModeManager {
         this.cleanup();
         return `Error: Timed out waiting for MikroTik shell prompt. Got: ${JSON.stringify(initial.slice(0, 300))}`;
       }
+      const activation = this.readUntilPrompt(1e4, (c) => isSafeModeActivated(c));
       this.channel.write(CTRL_X);
-      const response = (await this.readUntilPrompt(1e4, (c) => isSafeModeActivated(c))).text;
+      const response = (await activation).text;
       if (!isSafeModeActivated(response)) {
         this.cleanup();
         return `Error: Safe mode did not activate. Response: ${JSON.stringify(response.slice(0, 300))}`;
@@ -16850,11 +16851,12 @@ class SafeModeManager {
       if (!this.active || !this.channel) {
         throw new Error("Safe mode session is not active.");
       }
+      const response = this.readUntilPrompt();
       this.channel.write(`${command}
 `);
-      const { text, timedOut } = await this.readUntilPrompt();
+      const { text, timedOut } = await response;
       if (timedOut) {
-        throw new Error(`Safe Mode shell went silent for ${IDLE_TIMEOUT_MS / 1000}s (command: ${command}). The ` + "interactive session appears wedged \u2014 some RouterOS builds/terminals don't support Safe " + "Mode over SSH. Apply the change with the direct write tools instead (verify each with a read).");
+        throw new Error(`Safe Mode command did not return a recognized prompt before the timeout (command: ${command}). ` + "Execution may have occurred; do not retry the write blindly. Inspect the session " + "and roll back if its state cannot be verified.");
       }
       return this.extractOutput(text, command);
     });
@@ -16961,12 +16963,17 @@ class SafeModeManager {
     if (!this.channel)
       return "unknown";
     const token = "__MCP_SAFEMODE_PROBE__";
+    const response = this.readUntilPrompt(8000, (cleaned) => {
+      const lines = cleaned.replace(/\r/g, `
+`).split(`
+`);
+      const i = lines.findIndex((line) => line.trim() === token);
+      return i >= 0 && PROMPT_RE.test(lines.slice(i + 1).join(`
+`));
+    });
     this.channel.write(`:put "${token}"
 `);
-    const out = (await this.readUntilPrompt(8000, (cleaned) => {
-      const i = cleaned.lastIndexOf(token);
-      return i >= 0 && PROMPT_RE.test(cleaned.slice(i));
-    })).text;
+    const out = (await response).text;
     return classifyPrompt(out);
   }
   extractOutput(raw, command) {
@@ -16984,6 +16991,11 @@ class SafeModeManager {
           pastEcho = true;
         continue;
       }
+      if (stripped.endsWith(command.trim())) {
+        const prefix = stripped.slice(0, -command.trim().length).trimEnd();
+        if (PROMPT_RE.test(prefix))
+          continue;
+      }
       if (PROMPT_RE.test(stripped))
         break;
       result.push(line);
@@ -17656,12 +17668,117 @@ function indicatesFailure(text) {
   return /^Failed\b/.test(firstLine) || /\(line \d+ column \d+\)/.test(text);
 }
 
+// src/core/report-views.ts
+var REPORT_VIEW_TOOLS = {
+  investigations: [
+    "create_investigation",
+    "get_investigation",
+    "list_investigations",
+    "inspect_flow_path",
+    "list_client_flow_candidates"
+  ],
+  "round-trip": ["trace_round_trip"],
+  "service-health": [
+    "create_service_contract",
+    "list_service_contracts",
+    "list_service_probe_targets",
+    "run_service_contract",
+    "service_contract_history",
+    "audit_service_contracts"
+  ],
+  fabric: ["map_l2_fabric", "locate_host_port"],
+  operations: [
+    "plan_changes",
+    "apply_plan",
+    "begin_transaction",
+    "add_transaction_step",
+    "verify_transaction",
+    "commit_transaction",
+    "abort_transaction",
+    "plan_rollout",
+    "rollout_status",
+    "config_check_drift",
+    "diff_config_snapshots",
+    "get_access_scope",
+    "safe_mode_status",
+    "packet_capture_status"
+  ],
+  reports: [
+    "diagnose",
+    "trace_path",
+    "correlate_events",
+    "suggest_fix",
+    "run_compliance_audit",
+    "audit_fleet",
+    "audit_known_vulnerabilities",
+    "audit_certificate_expiry",
+    "audit_firewall_hardening",
+    "audit_firewall_default_deny",
+    "audit_address_list_enforcement",
+    "audit_kernel_ip_hardening",
+    "audit_ipv6_firewall_baseline",
+    "audit_ssh_hardening",
+    "audit_ip_service_exposure",
+    "audit_connection_tracking_helpers",
+    "audit_management_plane_exposure",
+    "audit_account_hygiene",
+    "audit_certificate_hygiene",
+    "audit_network_segmentation",
+    "audit_dns_resolver_exposure",
+    "run_security_hardening_audit",
+    "run_capsman_audit",
+    "audit_capsman_coverage",
+    "report_weak_signal_clients",
+    "audit_capsman_load",
+    "audit_capsman_ft",
+    "audit_capsman_ha",
+    "simulate_packet",
+    "simulate_change",
+    "simulate_suite",
+    "explain_rule_reachability",
+    "run_policy_check",
+    "check_policy_snapshot",
+    "explain_policy_finding",
+    "explain_device",
+    "explain_section",
+    "diff_explanations",
+    "flow_top_talkers",
+    "analyze_flows",
+    "forecast_link_saturation"
+  ]
+};
+var REPORT_VIEW_META = "mikrotik/reportView";
+var byTool = new Map(Object.entries(REPORT_VIEW_TOOLS).flatMap(([kind, names]) => names.map((name) => [name, kind])));
+function reportViewForTool(name) {
+  return byTool.get(name);
+}
+function buildReportView(kind, tool, title, device, raw, structured) {
+  let data = structured;
+  if (data === undefined) {
+    try {
+      data = JSON.parse(raw);
+    } catch {
+      data = null;
+    }
+  }
+  return {
+    __mikrotikView: "report",
+    kind,
+    tool,
+    title,
+    device: device ?? "default",
+    raw,
+    data,
+    generatedAt: new Date().toISOString()
+  };
+}
+
 // src/core/ui-meta.ts
 var UI_META_KEY = "ui";
 var UI_RESOURCE_URI_LEGACY_KEY = "ui/resourceUri";
 var OPENAI_OUTPUT_TEMPLATE_KEY = "openai/outputTemplate";
 function uiViewUri(id) {
-  return `ui://mikrotik/${id}.html`;
+  return `ui://mikrotik/${id}.html?v=2`;
 }
 function toolUiMeta(ui) {
   const meta = {
@@ -19418,6 +19535,9 @@ var UI_OUTPUT_SCHEMA = object({}).passthrough();
 function effectiveUi(def) {
   if (def.ui)
     return { ui: def.ui, auto: false };
+  const report = reportViewForTool(def.name);
+  if (report)
+    return { ui: { resourceUri: uiViewUri(report), visibility: ["model"] }, auto: true };
   if (def.annotations.readOnlyHint === true && AUTO_RECORDS_VERB.test(def.name)) {
     return { ui: { resourceUri: uiViewUri("records"), visibility: ["model", "app"] }, auto: true };
   }
@@ -19597,10 +19717,9 @@ function defineTool(def) {
             return { content: [{ type: "text", text: out.text }], isError: true };
           }
           if (auto && !out.structuredContent) {
-            const view = buildRecordsView(def.name, def.title, out.text, new Date().toISOString());
-            if (view.rows.length > 0) {
-              out.structuredContent = view;
-            }
+            const report = reportViewForTool(def.name);
+            const view = report ? buildReportView(report, def.name, def.title, deviceName, out.text) : buildRecordsView(def.name, def.title, out.text, new Date().toISOString());
+            out.structuredContent = view;
           }
           const result = {
             content: [{ type: "text", text: out.text }]
@@ -19609,6 +19728,12 @@ function defineTool(def) {
             result.structuredContent = out.structuredContent;
             hasStructured = true;
           }
+          const report = auto && reportViewForTool(def.name);
+          if (report && out.structuredContent?.__mikrotikView !== "report") {
+            result._meta = {
+              [REPORT_VIEW_META]: buildReportView(report, def.name, def.title, deviceName, out.text, out.structuredContent)
+            };
+          }
           if (deviceStamp)
             result.content.push({ type: "text", text: deviceStamp });
           return result;
@@ -19666,7 +19791,7 @@ function defineTool(def) {
         inputSchema,
         annotations: { ...def.annotations, title: def.title },
         ...ui ? { _meta: toolUiMeta(ui) } : {},
-        ...ui && !auto ? { outputSchema: UI_OUTPUT_SCHEMA } : {}
+        ...ui ? { outputSchema: UI_OUTPUT_SCHEMA } : {}
       }, callback);
     }
   };
@@ -24555,6 +24680,36 @@ var UI_VIEWS = [
     id: "aaa",
     name: "MikroTik RADIUS & User Manager",
     description: "Full RADIUS client + built-in User Manager RADIUS server management: servers, users, " + "profiles, limitations, NAS clients, assignments, sessions and settings, with add/edit/remove."
+  },
+  {
+    id: "investigations",
+    name: "MikroTik Client Investigations",
+    description: "Client attachment, router-scoped evidence, exported flow interfaces and unresolved visibility gaps."
+  },
+  {
+    id: "round-trip",
+    name: "MikroTik Round-trip Lab",
+    description: "Forward and return snapshot paths with named interfaces, modelled boundaries and unknown hops. Not live packet proof."
+  },
+  {
+    id: "service-health",
+    name: "MikroTik Service Health",
+    description: "Approved endpoint checks, contract definitions and historical PASS/FAIL/UNKNOWN evidence from the MCP host."
+  },
+  {
+    id: "fabric",
+    name: "MikroTik Layer-2 Fabric",
+    description: "Bridge-port occupancy, attached clients and inferred access/uplink roles."
+  },
+  {
+    id: "operations",
+    name: "MikroTik Change Operations",
+    description: "Read-only presentation of plans, transaction results, rollout progress, scope and drift. No apply/commit controls."
+  },
+  {
+    id: "reports",
+    name: "MikroTik Evidence Reports",
+    description: "Readable diagnostic, compliance, security, simulation and traffic reports with searchable evidence and JSON export."
   }
 ];
 function placeholderHtml(view) {
@@ -30068,7 +30223,7 @@ var cache2 = null;
 async function gateway() {
   if (cache2)
     return cache2;
-  const { moduleCatalog } = await import("./shared/cli-2a9bs005.js");
+  const { moduleCatalog } = await import("./shared/cli-m947aqb2.js");
   const forIndex = [];
   const byName = new Map;
   for (const mod of moduleCatalog) {
@@ -52294,7 +52449,7 @@ var riskByTool = null;
 async function riskIndex() {
   if (riskByTool)
     return riskByTool;
-  const { moduleCatalog } = await import("./shared/cli-2a9bs005.js");
+  const { moduleCatalog } = await import("./shared/cli-m947aqb2.js");
   const index = new Map;
   for (const mod of moduleCatalog) {
     for (const tool of mod.tools)

package/dist/index.js

@@ -62,7 +62,7 @@ import {
   updateSummaryLine,
   allToolModules2,
   selectToolModules2
-} from "./shared/library-dyeaqzj6.js";
+} from "./shared/library-tm6yshkz.js";
 
 // node_modules/ajv/dist/compile/codegen/code.js
 var require_code = __commonJS(function(exports) {

package/dist/shared/{library-rkr0yp3t.js → library-drn9gmjm.js}

@@ -3,7 +3,7 @@ import {
   moduleCatalog2,
   allToolModules2,
   selectToolModules2
-} from "./library-dyeaqzj6.js";
+} from "./library-tm6yshkz.js";
 export {
   allToolModules2 as allToolModules,
   moduleCatalog2 as moduleCatalog,

package/dist/shared/{library-dyeaqzj6.js → library-tm6yshkz.js}

@@ -10181,7 +10181,7 @@ async function runPooled(command, deviceName, opts) {
 }
 
 // src/ssh/safe-mode.ts
-var PROMPT_RE = /\[.+?@.+?\] (?:<SAFE> )?> ?$/m;
+var PROMPT_RE = /\[[^\r\n\]]+@[^\r\n\]]+\][ \t]+(?:\/[^\r\n<>]*[ \t]*)?(?:<SAFE>(?:[ \t]*>)?|>)[ \t]*$/;
 var ANSI_RE = /\x1B(?:\[[0-9;]*[mA-HJ-MSTfhilnprsu]|[()][0-9A-Za-z]|\[?\?\d+[hl])/g;
 function stripAnsi(text) {
   return text.replace(ANSI_RE, "");
@@ -10249,8 +10249,9 @@ class SafeModeManager2 {
         this.cleanup();
         return `Error: Timed out waiting for MikroTik shell prompt. Got: ${JSON.stringify(initial.slice(0, 300))}`;
       }
+      const activation = this.readUntilPrompt(1e4, (c) => isSafeModeActivated(c));
       this.channel.write(CTRL_X);
-      const response = (await this.readUntilPrompt(1e4, (c) => isSafeModeActivated(c))).text;
+      const response = (await activation).text;
       if (!isSafeModeActivated(response)) {
         this.cleanup();
         return `Error: Safe mode did not activate. Response: ${JSON.stringify(response.slice(0, 300))}`;
@@ -10267,11 +10268,12 @@ class SafeModeManager2 {
       if (!this.active || !this.channel) {
         throw new Error("Safe mode session is not active.");
       }
+      const response = this.readUntilPrompt();
       this.channel.write(`${command}
 `);
-      const { text, timedOut } = await this.readUntilPrompt();
+      const { text, timedOut } = await response;
       if (timedOut) {
-        throw new Error(`Safe Mode shell went silent for ${IDLE_TIMEOUT_MS / 1000}s (command: ${command}). The ` + "interactive session appears wedged \u2014 some RouterOS builds/terminals don't support Safe " + "Mode over SSH. Apply the change with the direct write tools instead (verify each with a read).");
+        throw new Error(`Safe Mode command did not return a recognized prompt before the timeout (command: ${command}). ` + "Execution may have occurred; do not retry the write blindly. Inspect the session " + "and roll back if its state cannot be verified.");
       }
       return this.extractOutput(text, command);
     });
@@ -10378,12 +10380,17 @@ class SafeModeManager2 {
     if (!this.channel)
       return "unknown";
     const token = "__MCP_SAFEMODE_PROBE__";
+    const response = this.readUntilPrompt(8000, (cleaned) => {
+      const lines = cleaned.replace(/\r/g, `
+`).split(`
+`);
+      const i = lines.findIndex((line) => line.trim() === token);
+      return i >= 0 && PROMPT_RE.test(lines.slice(i + 1).join(`
+`));
+    });
     this.channel.write(`:put "${token}"
 `);
-    const out = (await this.readUntilPrompt(8000, (cleaned) => {
-      const i = cleaned.lastIndexOf(token);
-      return i >= 0 && PROMPT_RE.test(cleaned.slice(i));
-    })).text;
+    const out = (await response).text;
     return classifyPrompt(out);
   }
   extractOutput(raw, command) {
@@ -10401,6 +10408,11 @@ class SafeModeManager2 {
           pastEcho = true;
         continue;
       }
+      if (stripped.endsWith(command.trim())) {
+        const prefix = stripped.slice(0, -command.trim().length).trimEnd();
+        if (PROMPT_RE.test(prefix))
+          continue;
+      }
       if (PROMPT_RE.test(stripped))
         break;
       result.push(line);
@@ -11073,12 +11085,117 @@ function indicatesFailure(text) {
   return /^Failed\b/.test(firstLine) || /\(line \d+ column \d+\)/.test(text);
 }
 
+// src/core/report-views.ts
+var REPORT_VIEW_TOOLS = {
+  investigations: [
+    "create_investigation",
+    "get_investigation",
+    "list_investigations",
+    "inspect_flow_path",
+    "list_client_flow_candidates"
+  ],
+  "round-trip": ["trace_round_trip"],
+  "service-health": [
+    "create_service_contract",
+    "list_service_contracts",
+    "list_service_probe_targets",
+    "run_service_contract",
+    "service_contract_history",
+    "audit_service_contracts"
+  ],
+  fabric: ["map_l2_fabric", "locate_host_port"],
+  operations: [
+    "plan_changes",
+    "apply_plan",
+    "begin_transaction",
+    "add_transaction_step",
+    "verify_transaction",
+    "commit_transaction",
+    "abort_transaction",
+    "plan_rollout",
+    "rollout_status",
+    "config_check_drift",
+    "diff_config_snapshots",
+    "get_access_scope",
+    "safe_mode_status",
+    "packet_capture_status"
+  ],
+  reports: [
+    "diagnose",
+    "trace_path",
+    "correlate_events",
+    "suggest_fix",
+    "run_compliance_audit",
+    "audit_fleet",
+    "audit_known_vulnerabilities",
+    "audit_certificate_expiry",
+    "audit_firewall_hardening",
+    "audit_firewall_default_deny",
+    "audit_address_list_enforcement",
+    "audit_kernel_ip_hardening",
+    "audit_ipv6_firewall_baseline",
+    "audit_ssh_hardening",
+    "audit_ip_service_exposure",
+    "audit_connection_tracking_helpers",
+    "audit_management_plane_exposure",
+    "audit_account_hygiene",
+    "audit_certificate_hygiene",
+    "audit_network_segmentation",
+    "audit_dns_resolver_exposure",
+    "run_security_hardening_audit",
+    "run_capsman_audit",
+    "audit_capsman_coverage",
+    "report_weak_signal_clients",
+    "audit_capsman_load",
+    "audit_capsman_ft",
+    "audit_capsman_ha",
+    "simulate_packet",
+    "simulate_change",
+    "simulate_suite",
+    "explain_rule_reachability",
+    "run_policy_check",
+    "check_policy_snapshot",
+    "explain_policy_finding",
+    "explain_device",
+    "explain_section",
+    "diff_explanations",
+    "flow_top_talkers",
+    "analyze_flows",
+    "forecast_link_saturation"
+  ]
+};
+var REPORT_VIEW_META = "mikrotik/reportView";
+var byTool = new Map(Object.entries(REPORT_VIEW_TOOLS).flatMap(([kind, names]) => names.map((name) => [name, kind])));
+function reportViewForTool(name) {
+  return byTool.get(name);
+}
+function buildReportView(kind, tool, title, device, raw, structured) {
+  let data = structured;
+  if (data === undefined) {
+    try {
+      data = JSON.parse(raw);
+    } catch {
+      data = null;
+    }
+  }
+  return {
+    __mikrotikView: "report",
+    kind,
+    tool,
+    title,
+    device: device ?? "default",
+    raw,
+    data,
+    generatedAt: new Date().toISOString()
+  };
+}
+
 // src/core/ui-meta.ts
 var UI_META_KEY = "ui";
 var UI_RESOURCE_URI_LEGACY_KEY = "ui/resourceUri";
 var OPENAI_OUTPUT_TEMPLATE_KEY = "openai/outputTemplate";
 function uiViewUri(id) {
-  return `ui://mikrotik/${id}.html`;
+  return `ui://mikrotik/${id}.html?v=2`;
 }
 function toolUiMeta(ui) {
   const meta = {
@@ -12411,6 +12528,9 @@ var UI_OUTPUT_SCHEMA = object({}).passthrough();
 function effectiveUi(def) {
   if (def.ui)
     return { ui: def.ui, auto: false };
+  const report = reportViewForTool(def.name);
+  if (report)
+    return { ui: { resourceUri: uiViewUri(report), visibility: ["model"] }, auto: true };
   if (def.annotations.readOnlyHint === true && AUTO_RECORDS_VERB.test(def.name)) {
     return { ui: { resourceUri: uiViewUri("records"), visibility: ["model", "app"] }, auto: true };
   }
@@ -12590,10 +12710,9 @@ function defineTool2(def) {
             return { content: [{ type: "text", text: out.text }], isError: true };
           }
           if (auto && !out.structuredContent) {
-            const view = buildRecordsView(def.name, def.title, out.text, new Date().toISOString());
-            if (view.rows.length > 0) {
-              out.structuredContent = view;
-            }
+            const report = reportViewForTool(def.name);
+            const view = report ? buildReportView(report, def.name, def.title, deviceName, out.text) : buildRecordsView(def.name, def.title, out.text, new Date().toISOString());
+            out.structuredContent = view;
           }
           const result = {
             content: [{ type: "text", text: out.text }]
@@ -12602,6 +12721,12 @@ function defineTool2(def) {
             result.structuredContent = out.structuredContent;
             hasStructured = true;
           }
+          const report = auto && reportViewForTool(def.name);
+          if (report && out.structuredContent?.__mikrotikView !== "report") {
+            result._meta = {
+              [REPORT_VIEW_META]: buildReportView(report, def.name, def.title, deviceName, out.text, out.structuredContent)
+            };
+          }
           if (deviceStamp)
             result.content.push({ type: "text", text: deviceStamp });
           return result;
@@ -12659,7 +12784,7 @@ function defineTool2(def) {
         inputSchema,
         annotations: { ...def.annotations, title: def.title },
         ...ui ? { _meta: toolUiMeta(ui) } : {},
-        ...ui && !auto ? { outputSchema: UI_OUTPUT_SCHEMA } : {}
+        ...ui ? { outputSchema: UI_OUTPUT_SCHEMA } : {}
       }, callback);
     }
   };
@@ -17356,6 +17481,36 @@ var UI_VIEWS = [
     id: "aaa",
     name: "MikroTik RADIUS & User Manager",
     description: "Full RADIUS client + built-in User Manager RADIUS server management: servers, users, " + "profiles, limitations, NAS clients, assignments, sessions and settings, with add/edit/remove."
+  },
+  {
+    id: "investigations",
+    name: "MikroTik Client Investigations",
+    description: "Client attachment, router-scoped evidence, exported flow interfaces and unresolved visibility gaps."
+  },
+  {
+    id: "round-trip",
+    name: "MikroTik Round-trip Lab",
+    description: "Forward and return snapshot paths with named interfaces, modelled boundaries and unknown hops. Not live packet proof."
+  },
+  {
+    id: "service-health",
+    name: "MikroTik Service Health",
+    description: "Approved endpoint checks, contract definitions and historical PASS/FAIL/UNKNOWN evidence from the MCP host."
+  },
+  {
+    id: "fabric",
+    name: "MikroTik Layer-2 Fabric",
+    description: "Bridge-port occupancy, attached clients and inferred access/uplink roles."
+  },
+  {
+    id: "operations",
+    name: "MikroTik Change Operations",
+    description: "Read-only presentation of plans, transaction results, rollout progress, scope and drift. No apply/commit controls."
+  },
+  {
+    id: "reports",
+    name: "MikroTik Evidence Reports",
+    description: "Readable diagnostic, compliance, security, simulation and traffic reports with searchable evidence and JSON export."
   }
 ];
 function placeholderHtml(view) {
@@ -22869,7 +23024,7 @@ var cache2 = null;
 async function gateway() {
   if (cache2)
     return cache2;
-  const { moduleCatalog } = await import("./library-rkr0yp3t.js");
+  const { moduleCatalog } = await import("./library-drn9gmjm.js");
   const forIndex = [];
   const byName = new Map;
   for (const mod of moduleCatalog) {
@@ -44847,7 +45002,7 @@ var riskByTool = null;
 async function riskIndex() {
   if (riskByTool)
     return riskByTool;
-  const { moduleCatalog } = await import("./library-rkr0yp3t.js");
+  const { moduleCatalog } = await import("./library-drn9gmjm.js");
   const index = new Map;
   for (const mod of moduleCatalog) {
     for (const tool of mod.tools)