mikromcp 1.14.0 → 1.14.1

package/README.md

@@ -12,7 +12,7 @@
 
 [![CI](https://github.com/AliKarami/MikroMCP/actions/workflows/ci.yml/badge.svg)](https://github.com/AliKarami/MikroMCP/actions/workflows/ci.yml)
 [![Release](https://github.com/AliKarami/MikroMCP/actions/workflows/release.yml/badge.svg)](https://github.com/AliKarami/MikroMCP/actions/workflows/release.yml)
-[![Version](https://img.shields.io/badge/version-v1.14.0-2DD4BF)](package.json)
+[![Version](https://img.shields.io/badge/version-v1.14.1-2DD4BF)](package.json)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 [![Node.js >= 22](https://img.shields.io/badge/node-%3E%3D22-339933)](package.json)
 [![RouterOS 7.x](https://img.shields.io/badge/RouterOS-7.x-293239)](https://help.mikrotik.com/docs/display/ROS/REST+API)

package/dist/main.js

@@ -3270,6 +3270,7 @@ var wifiTools = [listWifiTool, listWifiClientsTool, manageWifiTool];
 
 // src/domain/tools/wireguard-tools.ts
 import { z as z13 } from "zod";
+import { isIP } from "net";
 var log11 = createLogger("wireguard-tools");
 var listWgInputSchema = z13.object({
   routerId,
@@ -3363,6 +3364,7 @@ var listPeersTool = {
             "interface",
             "public-key",
             "endpoint-address",
+            "endpoint-port",
             "allowed-address",
             "disabled"
           ])
@@ -3381,20 +3383,71 @@ var listPeersTool = {
     }
   }
 };
+function parsePeerEndpoint(endpoint) {
+  if (/\s/.test(endpoint) || endpoint.includes("%")) return void 0;
+  if (isIP(endpoint) === 6) return { "endpoint-address": endpoint };
+  const ipv6 = /^\[([^\]]+)\](?::(\d+))?$/.exec(endpoint);
+  const host = /^([^:]+)(?::(\d+))?$/.exec(endpoint);
+  const match = ipv6 ?? host;
+  if (!match) return void 0;
+  const [, address, port] = match;
+  if (ipv6) {
+    if (isIP(address) !== 6) return void 0;
+  } else if (isIP(address) !== 4) {
+    const hostname = address.endsWith(".") ? address.slice(0, -1) : address;
+    if (hostname.length > 253 || /^[\d.]+$/.test(hostname) || !hostname.split(".").every((label) => /^[a-z\d_](?:[a-z\d_-]{0,61}[a-z\d_])?$/i.test(label))) {
+      return void 0;
+    }
+  }
+  if (port !== void 0 && (Number(port) < 1 || Number(port) > 65535)) return void 0;
+  return {
+    "endpoint-address": address,
+    ...port === void 0 ? {} : { "endpoint-port": String(Number(port)) }
+  };
+}
+var peerEndpointSchema = z13.string().transform((endpoint, ctx) => {
+  const fields = parsePeerEndpoint(endpoint);
+  if (fields) return fields;
+  ctx.addIssue({
+    code: z13.ZodIssueCode.custom,
+    message: "Use IPv4:port, hostname:port or [IPv6]:port with port 1\u201365535, or an address without a port"
+  });
+  return z13.NEVER;
+});
+function canonicalPeerAddress(value) {
+  const address = String(value ?? "");
+  if (isIP(address) === 6) return new URL(`http://[${address}]/`).hostname;
+  return address.toLowerCase().replace(/\.$/, "");
+}
+function canonicalAllowedAddresses(value) {
+  const addresses = String(value ?? "").split(",").map((item) => {
+    const cidr2 = item.trim();
+    const [address, prefix] = cidr2.split("/");
+    const family = isIP(address);
+    if (!family || prefix !== void 0 && !/^\d+$/.test(prefix)) return cidr2;
+    const bits = family === 4 ? 32 : 128;
+    const length = Number(prefix ?? bits);
+    if (length > bits || cidr2.split("/").length > 2) return cidr2;
+    return `${canonicalPeerAddress(address)}/${length}`;
+  });
+  return [...new Set(addresses)].sort().join(",");
+}
 var managePeerInputSchema = z13.object({
   routerId,
   action: z13.enum(["add", "remove"]).describe("Action to perform"),
   interface: z13.string().describe("WireGuard interface name (e.g. wg0)"),
   publicKey: z13.string().min(1).describe("Peer public key in base64 format (44 characters)"),
   allowedAddress: z13.string().optional().describe("Allowed IP address/CIDR for this peer (e.g. 10.0.0.2/32)"),
-  endpoint: z13.string().optional().describe("Peer endpoint as IP:port (e.g. 1.2.3.4:51820)"),
+  endpoint: z13.string().optional().describe(
+    "Add only: IPv4:port, hostname:port or [IPv6]:port (port 1\u201365535); hostname labels may contain underscores. Address-only IPv4/hostname/IPv6 (bare or bracketed) leaves the RouterOS port default unchanged, which may not allow initiation. Ignored for remove; omit for a roaming peer."
+  ),
   comment: z13.string().max(255).optional().describe("Optional comment"),
   dryRun
 }).strict();
 var managePeerTool = {
   name: "manage_wireguard_peer",
   title: "Manage WireGuard Peer",
-  description: "Add or remove a WireGuard peer. Idempotent by public key: add returns already_exists if a peer with the same public key already exists on the interface.",
+  description: "Add or remove a WireGuard peer. Add returns already_exists when the public key and explicitly requested endpoint/allowed addresses match; different settings produce CONFLICT without changing the peer. Omitted settings are left unchanged.",
   inputSchema: managePeerInputSchema,
   annotations: {
     readOnlyHint: false,
@@ -3410,11 +3463,44 @@ var managePeerTool = {
       "Managing WireGuard peer"
     );
     try {
+      const endpointFields = parsed.action === "add" && parsed.endpoint !== void 0 ? peerEndpointSchema.parse(parsed.endpoint) : {};
       const existing = await context.routerClient.get("interface/wireguard/peers", {
         filter: { interface: parsed.interface, "public-key": parsed.publicKey }
       });
       if (parsed.action === "add") {
         if (existing.length > 0) {
+          const rec2 = existing[0];
+          const requestedFields = {
+            ...endpointFields,
+            ...parsed.allowedAddress === void 0 ? {} : { "allowed-address": parsed.allowedAddress }
+          };
+          const mismatched = Object.entries(requestedFields).filter(([property, desired]) => {
+            if (property === "endpoint-address") {
+              return canonicalPeerAddress(rec2[property]) !== canonicalPeerAddress(desired);
+            }
+            if (property === "allowed-address") {
+              return canonicalAllowedAddresses(rec2[property]) !== canonicalAllowedAddresses(desired);
+            }
+            return !sameValue(rec2[property], desired);
+          });
+          if (mismatched.length > 0) {
+            throw new MikroMCPError({
+              category: "CONFLICT" /* CONFLICT */,
+              code: "WIREGUARD_PEER_CONFLICT",
+              message: `WireGuard peer already exists on "${parsed.interface}" with different requested settings.`,
+              details: {
+                existing: Object.fromEntries(
+                  mismatched.map(([property]) => [property, rec2[property]])
+                ),
+                requested: Object.fromEntries(mismatched)
+              },
+              recoverability: {
+                retryable: false,
+                suggestedAction: "Inspect the peer with list_wireguard_peers, then remove it before adding different settings.",
+                alternativeTools: ["list_wireguard_peers", "manage_wireguard_peer"]
+              }
+            });
+          }
           return {
             content: `WireGuard peer with this public key already exists on "${parsed.interface}". No changes made.`,
             structuredContent: { action: "already_exists", peer: existing[0] }
@@ -3424,8 +3510,12 @@ var managePeerTool = {
           const diff = [
             { property: "interface", before: null, after: parsed.interface },
             { property: "public-key", before: null, after: parsed.publicKey },
-            ...parsed.allowedAddress ? [{ property: "allowed-address", before: null, after: parsed.allowedAddress }] : [],
-            ...parsed.endpoint ? [{ property: "endpoint-address", before: null, after: parsed.endpoint }] : []
+            ...parsed.allowedAddress !== void 0 ? [{ property: "allowed-address", before: null, after: parsed.allowedAddress }] : [],
+            ...Object.entries(endpointFields).map(([property, after]) => ({
+              property,
+              before: null,
+              after
+            }))
           ];
           return {
             content: `Dry run: Would add WireGuard peer on "${parsed.interface}".`,
@@ -3434,10 +3524,10 @@ var managePeerTool = {
         }
         const body = {
           interface: parsed.interface,
-          "public-key": parsed.publicKey
+          "public-key": parsed.publicKey,
+          ...endpointFields
         };
-        if (parsed.allowedAddress) body["allowed-address"] = parsed.allowedAddress;
-        if (parsed.endpoint) body["endpoint-address"] = parsed.endpoint;
+        if (parsed.allowedAddress !== void 0) body["allowed-address"] = parsed.allowedAddress;
         if (parsed.comment) body.comment = parsed.comment.replace(/[\x00-\x1f\x7f]/g, "");
         const created = await context.routerClient.create("interface/wireguard/peers", body);
         log11.info({ interface: parsed.interface, id: created[".id"] }, "WireGuard peer added");
@@ -12236,7 +12326,7 @@ var manageIpServiceInputSchema = z37.object({
 var manageIpServiceTool = {
   name: "manage_ip_service",
   title: "Manage IP Service",
-  description: "Enable or disable a RouterOS IP service (api, api-ssl, ssh, telnet, www, www-ssl, winbox, ftp). Port number changes are intentionally not supported to prevent accidental lockout.",
+  description: "Enable or disable a RouterOS IP service (api, api-ssl, ssh, telnet, www, www-ssl, winbox, ftp). Port number changes are intentionally not supported to prevent accidental lockout. MikroMCP reaches RouterOS through the REST API on www-ssl (or www for plaintext): disabling the service its connection uses cuts MikroMCP off from the router, including any later call to re-enable it.",
   inputSchema: manageIpServiceInputSchema,
   annotations: {
     readOnlyHint: false,
@@ -18308,7 +18398,7 @@ var ConnectionPool = class {
 };
 
 // src/version.ts
-var VERSION2 = "1.14.0";
+var VERSION2 = "1.14.1";
 
 // src/mcp/server.ts
 var SERVER_INSTRUCTIONS = [
@@ -18786,7 +18876,7 @@ import { existsSync as existsSync3, readFileSync as readFileSync7 } from "fs";
 import { homedir as homedir2 } from "os";
 import * as net from "net";
 import chalk from "chalk";
-var localVersion = "1.14.0";
+var localVersion = "1.14.1";
 var results = [];
 function ok(msg) {
   console.log(chalk.green("\u2705 ") + msg);
@@ -19602,7 +19692,7 @@ async function runInit() {
 }
 
 // src/cli/index.ts
-var program = new Command().name("mikromcp").description("MikroTik RouterOS MCP server").version("1.14.0");
+var program = new Command().name("mikromcp").description("MikroTik RouterOS MCP server").version("1.14.1");
 program.command("serve", { isDefault: true }).description("Start the MCP server (default)").action(runServe);
 program.command("doctor").description("Check config, connectivity, and permissions").action(runDoctor);
 program.command("init").description("Interactive setup wizard").action(runInit);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mikromcp",
-  "version": "1.14.0",
+  "version": "1.14.1",
   "mcpName": "io.github.AliKarami/mikromcp",
   "description": "Production-grade MCP server for MikroTik RouterOS routers and SwOS switches",
   "type": "module",