mikromcp 1.14.1 → 1.16.0

package/README.md

@@ -12,12 +12,12 @@
 
 [![CI](https://github.com/AliKarami/MikroMCP/actions/workflows/ci.yml/badge.svg)](https://github.com/AliKarami/MikroMCP/actions/workflows/ci.yml)
 [![Release](https://github.com/AliKarami/MikroMCP/actions/workflows/release.yml/badge.svg)](https://github.com/AliKarami/MikroMCP/actions/workflows/release.yml)
-[![Version](https://img.shields.io/badge/version-v1.14.1-2DD4BF)](package.json)
+[![Version](https://img.shields.io/badge/version-v1.16.0-2DD4BF)](package.json)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 [![Node.js >= 22](https://img.shields.io/badge/node-%3E%3D22-339933)](package.json)
 [![RouterOS 7.x](https://img.shields.io/badge/RouterOS-7.x-293239)](https://help.mikrotik.com/docs/display/ROS/REST+API)
 [![MCP Server](https://img.shields.io/badge/MCP-server-6f42c1)](https://modelcontextprotocol.io)
-[![Tools](https://img.shields.io/badge/MCP%20tools-132-0f766e)](https://github.com/AliKarami/MikroMCP/wiki/Available-Tools)
+[![Tools](https://img.shields.io/badge/MCP%20tools-133-0f766e)](https://github.com/AliKarami/MikroMCP/wiki/Available-Tools)
 [![MikroMCP MCP server](https://glama.ai/mcp/servers/AliKarami/MikroMCP/badges/score.svg)](https://glama.ai/mcp/servers/AliKarami/MikroMCP)
 
 MikroMCP exists because raw router CLI access is the wrong abstraction for AI agents. RouterOS is powerful, but asking an LLM to improvise shell commands against production network gear is risky. MikroMCP gives agents a controlled tool surface: strict schemas, idempotent writes, dry-run previews, per-router circuit breakers, retry policies, RBAC, audit logs, snapshots, and rollback-aware change workflows.
@@ -54,7 +54,7 @@ That's the whole setup for a single-router stdio deployment. For standalone bina
 | 🤖 **AI-agent fit**        | Human-readable responses plus structured JSON content for reasoning, chaining, and automation; server advertises an `instructions` string on MCP initialize so clients self-configure; optional [`routerId` resolved via `MIKROMCP_DEFAULT_ROUTER`](https://github.com/AliKarami/MikroMCP/wiki/Configuration) for single-router setups; [usage skill](docs/wiki/Using-the-Skill.md) for safe, guided tool use in Claude Code |
 | 🧩 **MCP compatibility**   | stdio for desktop clients, Streamable HTTP and legacy SSE for remote or service-style clients         |
 
-**132 typed tools** in total — browse the full catalog with parameters, defaults, and copy-paste example prompts in **[Available Tools](https://github.com/AliKarami/MikroMCP/wiki/Available-Tools)**.
+**133 typed tools** in total — browse the full catalog with parameters, defaults, and copy-paste example prompts in **[Available Tools](https://github.com/AliKarami/MikroMCP/wiki/Available-Tools)**.
 
 ---
 
@@ -140,7 +140,7 @@ AI assistants can use MikroMCP to:
 
 ### What is MikroMCP?
 
-MikroMCP is an open-source [Model Context Protocol](https://modelcontextprotocol.io) (MCP) server that exposes MikroTik RouterOS as 132 typed, auditable tools — letting AI assistants inspect, diagnose, and safely operate routers in natural language instead of improvising CLI commands.
+MikroMCP is an open-source [Model Context Protocol](https://modelcontextprotocol.io) (MCP) server that exposes MikroTik RouterOS as 133 typed, auditable tools — letting AI assistants inspect, diagnose, and safely operate routers in natural language instead of improvising CLI commands.
 
 ### MikroMCP vs RouterOS API
 
@@ -189,7 +189,7 @@ The README stays intentionally short. Everything below is documented in depth in
 | [Connecting to Claude Desktop](https://github.com/AliKarami/MikroMCP/wiki/Connecting-to-Claude-Desktop) | Register MikroMCP in Claude Desktop                      |
 | [Connecting to AI Assistants](https://github.com/AliKarami/MikroMCP/wiki/Connecting-to-AI-Assistants) | Claude Code, Cursor, Codex, HTTP/Docker/systemd            |
 | [Using the Skill](docs/wiki/Using-the-Skill.md)                                                        | Install the MikroMCP usage skill so your assistant drives the tools safely |
-| [Available Tools](https://github.com/AliKarami/MikroMCP/wiki/Available-Tools)                         | All 132 tools — parameters and example prompts             |
+| [Available Tools](https://github.com/AliKarami/MikroMCP/wiki/Available-Tools)                         | All 133 tools — parameters and example prompts             |
 | [Architecture](https://github.com/AliKarami/MikroMCP/wiki/Architecture)                               | System layers, request pipeline, auth model                |
 | [Error Handling](https://github.com/AliKarami/MikroMCP/wiki/Error-Handling)                           | Error categories, retry engine, circuit breaker            |
 | [Security](https://github.com/AliKarami/MikroMCP/wiki/Security)                                       | Threat model, hardening checklist, vulnerability reporting |

package/config/identities.example.yaml

@@ -19,6 +19,8 @@
 #
 # allowedRouters:  [] means all routers are accessible.
 # allowedToolPatterns: [] means all tools are accessible. Supports * wildcard.
+#   Fleet tools (bulk_read, bulk_execute) must match by their own name too;
+#   they also check each tool they fan out.
 
 identities:
   # CI pipeline: operator access to specific routers, limited tool set

package/dist/main.js

@@ -2,7 +2,7 @@
 
 // src/main.ts
 import { config as loadDotenv } from "dotenv";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 import { homedir as homedir4 } from "os";
 
 // src/cli/index.ts
@@ -398,6 +398,13 @@ function loggableParams(tool, params) {
     return { routerId: params.routerId, params: "<withheld: redaction failed>" };
   }
 }
+function isEffectiveDryRun(tool, params) {
+  try {
+    return tool.inputSchema.parse(params).dryRun === true;
+  } catch {
+    return params.dryRun === true;
+  }
+}
 function snapshotPathsFor(tool, params) {
   return typeof tool.snapshotPaths === "function" ? tool.snapshotPaths(params) : tool.snapshotPaths ?? [];
 }
@@ -2666,7 +2673,7 @@ var runCommandInputSchema = z10.object({
 var runCommandTool = {
   name: "run_command",
   title: "Run Command",
-  description: "Execute an arbitrary RouterOS console command via SSH. Guarded by an allow/deny policy (built-in deny list blocks destructive commands; tighten via cmdAllow in routers.yaml or MIKROMCP_CMD_ALLOW). Prefer dedicated tools (reboot, etc.) where available. Output capped at 4000 characters.",
+  description: "Execute an arbitrary RouterOS console command via SSH. Guarded by an allow/deny policy (built-in deny list blocks destructive commands; tighten via cmdAllow in routers.yaml or MIKROMCP_CMD_ALLOW). Prefer dedicated tools (reboot, etc.) where available. Output capped at 4000 characters. Journaled for audit like every write (see list_journal), but never snapshotted: arbitrary commands touch unknown config sections, so it cannot be rolled back via rollback_change \u2014 prefer a dedicated tool when one exists, and note the manual undo command in your own records.",
   inputSchema: runCommandInputSchema,
   annotations: {
     readOnlyHint: false,
@@ -2725,6 +2732,26 @@ var systemOpsTools = [
 
 // src/domain/tools/bridge-tools.ts
 import { z as z11 } from "zod";
+
+// src/domain/tools/interface-name.ts
+var NEW_INTERFACE_NAME_MAX = 64;
+var NEW_INTERFACE_NAME_PATTERN = /^[a-zA-Z0-9_.-]+$/;
+function assertNewInterfaceName(name, opts) {
+  const tooLong = name.length > NEW_INTERFACE_NAME_MAX;
+  if (!tooLong && NEW_INTERFACE_NAME_PATTERN.test(name)) return;
+  throw new MikroMCPError({
+    category: "VALIDATION" /* VALIDATION */,
+    code: opts.code,
+    message: tooLong ? `${opts.kind} name is ${name.length} chars; ${opts.action} allows at most ${NEW_INTERFACE_NAME_MAX}.` : `${opts.kind} name "${name}" uses characters ${opts.action} does not allow (permitted: letters, digits, dot, hyphen, underscore).`,
+    details: { name },
+    recoverability: {
+      retryable: false,
+      suggestedAction: `Use a name of letters, digits, dot, hyphen or underscore, at most ${NEW_INTERFACE_NAME_MAX} chars.`
+    }
+  });
+}
+
+// src/domain/tools/bridge-tools.ts
 var log9 = createLogger("bridge-tools");
 var listBridgesInputSchema = z11.object({
   routerId,
@@ -2865,7 +2892,9 @@ var listBridgePortsTool = {
 var manageBridgeInputSchema = z11.object({
   routerId,
   action: z11.enum(["create", "remove"]).describe("Action to perform"),
-  name: z11.string().regex(/^[a-zA-Z0-9_-]+$/).max(15).describe("Bridge interface name"),
+  name: z11.string().min(1).describe(
+    "Bridge interface name, taken verbatim for remove; create accepts letters, digits, dot, hyphen, underscore, up to 64 chars"
+  ),
   comment: z11.string().max(255).optional().describe("Optional comment"),
   disabled: z11.boolean().default(false).describe("Whether the bridge should be disabled"),
   dryRun
@@ -2893,6 +2922,11 @@ var manageBridgeTool = {
         filter: { name: parsed.name }
       });
       if (parsed.action === "create") {
+        assertNewInterfaceName(parsed.name, {
+          kind: "Bridge",
+          action: "create",
+          code: "BRIDGE_NAME_INVALID"
+        });
         if (existing.length > 0) {
           return {
             content: `Bridge "${parsed.name}" already exists. No changes made.`,
@@ -6326,7 +6360,6 @@ var containerTools = [listContainersTool, manageContainerTool];
 
 // src/domain/tools/change-management-tools.ts
 import { z as z25 } from "zod";
-import { readFileSync as readFileSync2 } from "fs";
 
 // src/domain/snapshot/snapshot-engine.ts
 import { mkdir, writeFile, readFile } from "fs/promises";
@@ -8047,8 +8080,10 @@ async function loadSnapshot(filePath) {
 }
 
 // src/domain/snapshot/write-journal.ts
+import { randomBytes as randomBytes2 } from "crypto";
+import { readdirSync, readFileSync as readFileSync2 } from "fs";
 import { appendFile as appendFile2, mkdir as mkdir2 } from "fs/promises";
-import { dirname } from "path";
+import { basename, dirname, extname, join as join3 } from "path";
 import { nanoid as nanoid2 } from "nanoid";
 
 // src/observability/audit-log.ts
@@ -8117,10 +8152,77 @@ function recordAttempt(args) {
     routerId: args.routerId,
     params: redactParams(args.params),
     snapshotIds: args.snapshotIds,
+    ...args.dryRun ? { dryRun: true } : {},
     phase: "attempt"
   });
   return id;
 }
+function parseJournal(raw) {
+  const entries = [];
+  for (const line of raw.split("\n")) {
+    if (!line.trim()) continue;
+    try {
+      const entry = JSON.parse(line);
+      if (entry && typeof entry === "object" && !Array.isArray(entry)) {
+        entries.push(entry);
+      }
+    } catch {
+      continue;
+    }
+  }
+  return entries;
+}
+var SEGMENT_STAMP = /^\d{8}T\d{6}Z-[0-9a-z]+$/;
+function journalSegmentName(journalPath, now, suffix = randomBytes2(6).toString("hex")) {
+  const ext = extname(journalPath);
+  const stamp2 = now.toISOString().replace(/[-:]/g, "").replace(/\.\d+Z$/, "Z");
+  return join3(dirname(journalPath), `${basename(journalPath, ext)}.${stamp2}-${suffix}${ext}`);
+}
+function journalSegmentPaths(journalPath) {
+  const ext = extname(journalPath);
+  const prefix = `${basename(journalPath, ext)}.`;
+  let names;
+  try {
+    names = readdirSync(dirname(journalPath));
+  } catch {
+    return [];
+  }
+  return names.filter(
+    (n) => n.startsWith(prefix) && n.endsWith(ext) && SEGMENT_STAMP.test(n.slice(prefix.length, n.length - ext.length))
+  ).sort().map((n) => join3(dirname(journalPath), n));
+}
+function journalSegmentRotatedAt(segmentPath) {
+  const stamp2 = /\.(\d{4})(\d{2})(\d{2})T(\d{2})(\d{2})(\d{2})Z-[0-9a-z]+\.[^.]+$/.exec(
+    segmentPath
+  );
+  if (!stamp2) return NaN;
+  const [, y, mo, d, h, mi, se] = stamp2;
+  return Date.parse(`${y}-${mo}-${d}T${h}:${mi}:${se}Z`);
+}
+function readIfExists(path) {
+  try {
+    return readFileSync2(path, "utf-8");
+  } catch (err) {
+    if (err.code === "ENOENT") return "";
+    throw err;
+  }
+}
+function readJournalEntries(journalPath) {
+  const current = parseJournal(readIfExists(journalPath));
+  const segments2 = journalSegmentPaths(journalPath).flatMap((p) => parseJournal(readIfExists(p)));
+  const seen = /* @__PURE__ */ new Set();
+  const entries = [...segments2, ...current].filter((e) => {
+    const key2 = `${String(e.id)}\0${String(e.phase)}`;
+    if (seen.has(key2)) return false;
+    seen.add(key2);
+    return true;
+  });
+  const time = (e) => {
+    const t = typeof e.ts === "string" ? Date.parse(e.ts) : NaN;
+    return Number.isFinite(t) ? t : Number.POSITIVE_INFINITY;
+  };
+  return entries.map((e, i) => ({ e, i, t: time(e) })).sort((a, b) => a.t - b.t || a.i - b.i).map(({ e }) => e);
+}
 function recordOutcome(args) {
   void appendLine(args.journalPath, {
     id: args.journalId,
@@ -9026,6 +9128,104 @@ var applyPlanInputSchema = z25.object({
   steps: z25.array(stepSchema).min(1).max(10).describe("Ordered list of write operations to apply in sequence"),
   confirmationToken: z25.string().optional()
 }).strict();
+function journalEntryWasDryRun(entry) {
+  const params = entry.params ?? {};
+  return entry.dryRun === true || params.dryRun === true;
+}
+var listJournalInputSchema = z25.object({
+  routerId: z25.string().optional().describe("Only entries for this router id"),
+  tool: z25.string().optional().describe("Only entries written by this tool"),
+  limit: z25.number().int().min(1).max(500).default(20).describe("Max entries to return")
+}).strict();
+var listJournalTool = {
+  name: "list_journal",
+  title: "List Write Journal",
+  description: "List recent entries from the server's write journal (write-journal.ndjson): every journaled write with its journalId, timestamp, tool, router, parameters (as redacted at write time), snapshot ids and outcome \u2014 newest first. Read-only. Use it to recover a lost journalId for rollback_change, or to audit what was written when. Only entries with rollbackable: true can be rolled back \u2014 dry runs and writes without snapshots (run_command, plan_changes) cannot.",
+  inputSchema: listJournalInputSchema,
+  annotations: {
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  skipRouterContext: true,
+  async handler(params, context) {
+    const parsed = listJournalInputSchema.parse(params);
+    const journalPath = context.appConfig.journalPath;
+    if (!journalPath) {
+      return {
+        content: "Write journal is disabled (no journal path configured on this server).",
+        structuredContent: { journalEnabled: false, entries: [], total: 0, returned: 0 }
+      };
+    }
+    let journal;
+    try {
+      journal = readJournalEntries(journalPath);
+    } catch (err) {
+      throw new MikroMCPError({
+        category: "INTERNAL" /* INTERNAL */,
+        code: "JOURNAL_READ_FAILED",
+        message: `Could not read the write journal: ${err.message}`,
+        details: { journalPath },
+        recoverability: {
+          retryable: false,
+          suggestedAction: "Check the file's permissions under the MikroMCP data directory."
+        }
+      });
+    }
+    const outcomes = /* @__PURE__ */ new Map();
+    const attempts = [];
+    for (const entry of journal) {
+      if (entry.phase === "attempt") attempts.push(entry);
+      else
+        outcomes.set(entry.id, {
+          phase: entry.phase,
+          outcome: entry.outcome,
+          durationMs: entry.durationMs
+        });
+    }
+    let entries = attempts.map((a) => {
+      const outcome = outcomes.get(a.id);
+      const snapshotIds = Array.isArray(a.snapshotIds) ? a.snapshotIds : [];
+      const dryRun2 = journalEntryWasDryRun(a);
+      return {
+        journalId: a.id,
+        ts: a.ts,
+        tool: a.tool,
+        routerId: a.routerId,
+        identityId: a.identityId,
+        role: a.role,
+        params: a.params ?? {},
+        snapshotIds,
+        dryRun: dryRun2,
+        rollbackable: !dryRun2 && snapshotIds.length > 0,
+        status: outcome ? outcome.phase : "unknown",
+        outcomeCode: outcome?.outcome,
+        durationMs: outcome?.durationMs
+      };
+    }).reverse();
+    if (parsed.routerId) entries = entries.filter((e) => e.routerId === parsed.routerId);
+    if (parsed.tool) entries = entries.filter((e) => e.tool === parsed.tool);
+    const scope = context.identity.allowedRouters;
+    if (scope.length > 0) entries = entries.filter((e) => scope.includes(e.routerId));
+    const total = entries.length;
+    const returned = entries.slice(0, parsed.limit);
+    const header = total === 0 ? "Write journal: no entries." : `Write journal: ${returned.length} of ${total}, newest first.`;
+    const lines = returned.map(
+      (e) => `  ${String(e.journalId)} ${String(e.tool)} ${String(e.routerId)} \u2192 ${e.status}${e.outcomeCode ? ` (${e.outcomeCode})` : ""}${e.dryRun ? " dry-run" : e.rollbackable ? "" : " not-rollbackable"} [${String(e.ts)}]`
+    );
+    return {
+      content: total === 0 ? header : [header, ...lines].join("\n"),
+      structuredContent: {
+        journalEnabled: true,
+        entries: returned,
+        total,
+        returned: returned.length,
+        note: "Pass the journalId of an entry with rollbackable: true to rollback_change to restore that write. Dry runs and entries without snapshots (e.g. run_command) cannot be rolled back."
+      }
+    };
+  }
+};
 var rollbackChangeInputSchema = z25.object({
   routerId,
   journalId: z25.string().describe("Journal entry ID from write-journal.ndjson to roll back"),
@@ -9246,7 +9446,8 @@ function createChangeManagementTools(baseTools2) {
           tool: step.tool,
           routerId: context.routerId,
           params: loggableParams(tool, stepParams),
-          snapshotIds
+          snapshotIds,
+          dryRun: isEffectiveDryRun(tool, stepParams)
         });
         const stepStartMs = Date.now();
         try {
@@ -9299,9 +9500,9 @@ function createChangeManagementTools(baseTools2) {
     }
   };
   function findJournalEntry(journalPath, journalId) {
-    const raw = readFileSync2(journalPath, "utf-8");
-    const lines = raw.split("\n").filter(Boolean);
-    const entry = lines.map((l) => JSON.parse(l)).find((e) => e.id === journalId && e.phase === "attempt");
+    const entry = readJournalEntries(journalPath).find(
+      (e) => e.id === journalId && e.phase === "attempt"
+    );
     if (!entry) {
       throw new MikroMCPError({
         category: "NOT_FOUND" /* NOT_FOUND */,
@@ -9313,7 +9514,10 @@ function createChangeManagementTools(baseTools2) {
         }
       });
     }
-    return { snapshotIds: entry.snapshotIds ?? [] };
+    return {
+      snapshotIds: entry.snapshotIds ?? [],
+      dryRun: journalEntryWasDryRun(entry)
+    };
   }
   const rollbackChangeTool = {
     name: "rollback_change",
@@ -9332,7 +9536,16 @@ function createChangeManagementTools(baseTools2) {
       const journalPath = context.appConfig.journalPath;
       const snapshotDir = context.appConfig.snapshotDir;
       log24.info({ routerId: context.routerId, journalId: parsed.journalId }, "Rolling back change");
-      const { snapshotIds } = findJournalEntry(journalPath, parsed.journalId);
+      const { snapshotIds, dryRun: entryWasDryRun } = findJournalEntry(
+        journalPath,
+        parsed.journalId
+      );
+      if (entryWasDryRun) {
+        return {
+          content: `Journal entry "${parsed.journalId}" was a dry run \u2014 nothing was changed, so there is nothing to roll back.`,
+          structuredContent: { action: "dry_run_entry", journalId: parsed.journalId }
+        };
+      }
       if (snapshotIds.length === 0) {
         return {
           content: `Journal entry "${parsed.journalId}" has no associated snapshots \u2014 cannot rollback automatically.`,
@@ -9387,7 +9600,7 @@ ${warnings.map((w) => `  - ${w}`).join("\n")}` : "";
       };
     }
   };
-  return [planChangesTool, applyPlanTool, rollbackChangeTool];
+  return [planChangesTool, applyPlanTool, rollbackChangeTool, listJournalTool];
 }
 
 // src/domain/tools/ipsec-tools.ts
@@ -11860,8 +12073,8 @@ function sanitizeComment3(comment) {
 var manageVlanInputSchema = z35.object({
   routerId,
   action: z35.enum(["add", "remove", "enable", "disable"]).describe("Action to perform"),
-  name: z35.string().regex(/^[a-zA-Z0-9_-]+$/).max(15).describe(
-    "VLAN interface name \u2014 idempotency key (alphanumeric, hyphens, underscores, max 15 chars)"
+  name: z35.string().min(1).describe(
+    "VLAN interface name \u2014 idempotency key, taken verbatim for remove/enable/disable; add accepts letters, digits, dot, hyphen, underscore, up to 64 chars"
   ),
   vlanId: z35.number().int().min(1).max(4094).optional().describe("VLAN ID (1-4094; required for add)"),
   parentInterface: z35.string().optional().describe("Parent interface name (e.g., ether1, bridge1; required for add)"),
@@ -11898,6 +12111,11 @@ var manageVlanTool = {
         (v) => sameValue(v.name, parsed.name)
       );
       if (parsed.action === "add") {
+        assertNewInterfaceName(parsed.name, {
+          kind: "VLAN",
+          action: "add",
+          code: "VLAN_NAME_INVALID"
+        });
         if (parsed.vlanId === void 0) {
           throw new MikroMCPError({
             category: "VALIDATION" /* VALIDATION */,
@@ -12042,9 +12260,12 @@ var vlanTools = [manageVlanTool];
 // src/domain/tools/dhcp-client-tools.ts
 import { z as z36 } from "zod";
 var log35 = createLogger("dhcp-client-tools");
+function findClient(clients, target, byNameToo = true) {
+  return clients.find((c) => sameValue(c.interface, target)) ?? (byNameToo ? clients.find((c) => sameValue(c.name, target)) : void 0);
+}
 var listDhcpClientsInputSchema = z36.object({
   routerId,
-  interface: z36.string().optional().describe("Filter by interface name (exact match)"),
+  interface: z36.string().optional().describe("Filter by interface or display name (exact match)"),
   status: z36.enum(["bound", "searching", "requesting", "init", "all"]).default("all").describe("Filter by DHCP client status"),
   limit,
   offset
@@ -12070,7 +12291,9 @@ var listDhcpClientsTool = {
       });
       let filtered = allClients;
       if (parsed.interface) {
-        filtered = filtered.filter((c) => c.interface === parsed.interface);
+        filtered = filtered.filter(
+          (c) => sameValue(c.interface, parsed.interface) || sameValue(c.name, parsed.interface)
+        );
       }
       if (parsed.status !== "all") {
         filtered = filtered.filter((c) => c.status === parsed.status);
@@ -12083,7 +12306,7 @@ var listDhcpClientsTool = {
           clients,
           total,
           parsed.offset,
-          (c) => compactFields(c, ["interface", "status", "address", "gateway", "disabled"])
+          (c) => compactFields(c, ["interface", "name", "status", "address", "gateway", "disabled"])
         ),
         structuredContent: {
           routerId: context.routerId,
@@ -12102,7 +12325,9 @@ var listDhcpClientsTool = {
 var manageDhcpClientInputSchema = z36.object({
   routerId,
   action: z36.enum(["add", "remove", "enable", "disable"]).describe("Action to perform"),
-  interface: z36.string().describe("Interface name \u2014 idempotency key (e.g. ether1, ether2)"),
+  interface: z36.string().describe(
+    "Interface name \u2014 idempotency key (e.g. ether1); for remove/enable/disable a client's display name also matches"
+  ),
   usePeerDns: z36.boolean().default(true).describe("Use DNS servers provided by DHCP server (add only)"),
   usePeerNtp: z36.boolean().default(false).describe("Use NTP servers provided by DHCP server (add only)"),
   addDefaultRoute: z36.boolean().default(true).describe("Add default route from DHCP (add only)"),
@@ -12132,8 +12357,10 @@ var manageDhcpClientTool = {
         limit: void 0,
         offset: void 0
       });
-      const existing = allClients.find(
-        (c) => c.interface === parsed.interface
+      const existing = findClient(
+        allClients,
+        parsed.interface,
+        parsed.action !== "add"
       );
       if (parsed.action === "add") {
         if (existing) {
@@ -12174,9 +12401,19 @@ var manageDhcpClientTool = {
       }
       if (parsed.action === "remove") {
         if (!existing) {
+          const candidates = allClients.map((c) => ({
+            interface: c.interface,
+            name: c.name,
+            status: c.status
+          }));
+          const names = candidates.map((c) => c.name ?? c.interface).slice(0, 5).join(", ");
           return {
-            content: `No DHCP client found on "${parsed.interface}". Nothing to remove.`,
-            structuredContent: { action: "not_found", interface: parsed.interface }
+            content: `No DHCP client found on "${parsed.interface}". Nothing to remove.` + (names ? ` Existing clients: ${names}.` : ""),
+            structuredContent: {
+              action: "not_found",
+              interface: parsed.interface,
+              clients: candidates
+            }
           };
         }
         if (parsed.dryRun) {
@@ -12184,7 +12421,7 @@ var manageDhcpClientTool = {
             content: `Dry run: Would remove DHCP client on "${parsed.interface}".`,
             structuredContent: {
               action: "dry_run",
-              diff: [{ property: "interface", before: parsed.interface, after: null }]
+              diff: [{ property: "interface", before: existing.interface, after: null }]
             }
           };
         }
@@ -13541,13 +13778,54 @@ var log41 = createLogger("backup-tools");
 var createBackupInputSchema = z42.object({
   routerId,
   name: z42.string().default("backup").describe("Backup file name (without extension)"),
-  password: z42.string().optional().describe("Password to encrypt the backup file"),
+  password: z42.string().optional().describe(
+    "Literal password to encrypt the backup. It stays in the conversation history; prefer passwordSecret"
+  ),
+  passwordSecret: z42.string().regex(/^[A-Z0-9_]+$/, "a secret name is the NAME of MIKROMCP_SECRET_<NAME>").optional().describe(
+    "Encrypt with the server's MIKROMCP_SECRET_<NAME> value, bound to this router by its secrets list in routers.yaml. The value never reaches the conversation"
+  ),
   dryRun: z42.boolean().default(false).describe("Preview the backup without creating it")
 }).strict();
+function backupError(code, message, suggestedAction) {
+  return new MikroMCPError({
+    category: "VALIDATION" /* VALIDATION */,
+    code,
+    message,
+    recoverability: { retryable: false, suggestedAction }
+  });
+}
+function resolveBackupPassword(parsed, context) {
+  const name = parsed.passwordSecret;
+  if (name === void 0) return parsed.password;
+  if (parsed.password !== void 0) {
+    throw backupError(
+      "BACKUP_PASSWORD_CONFLICT",
+      "Pass either password or passwordSecret, not both.",
+      "Drop password and keep passwordSecret, so the password stays out of the conversation."
+    );
+  }
+  const bound = context.routerConfig.secrets ?? [];
+  if (!bound.includes(name)) {
+    throw backupError(
+      "BACKUP_SECRET_NOT_BOUND",
+      bound.length ? `Secret ${name} is not bound to router "${context.routerId}" (its routers.yaml secrets list names ${bound.join(", ")}).` : `Router "${context.routerId}" has no secrets list in routers.yaml, so it may use no secret.`,
+      `Add ${name} to the router's \`secrets\` list in routers.yaml if it is meant for it.`
+    );
+  }
+  const value = context.appConfig.configSecrets[name];
+  if (!value) {
+    throw backupError(
+      "BACKUP_SECRET_MISSING",
+      `Secret ${name} is bound to router "${context.routerId}", but MIKROMCP_SECRET_${name} is not set or empty.`,
+      `Set MIKROMCP_SECRET_${name} in the MikroMCP server's environment and restart it.`
+    );
+  }
+  return value;
+}
 var createBackupTool = {
   name: "create_backup",
   title: "Create Backup",
-  description: "Create a binary configuration backup on a MikroTik router. The backup is saved as <name>.backup on the router's filesystem. Supports optional encryption via password and dry-run mode.",
+  description: "Create a binary configuration backup on a MikroTik router. The backup is saved as <name>.backup on the router's filesystem. To encrypt it, prefer passwordSecret (a MIKROMCP_SECRET_<NAME> bound to the router in routers.yaml \u2014 the password never reaches the conversation) over a literal password. Dry run checks that the secret resolves.",
   inputSchema: createBackupInputSchema,
   annotations: {
     readOnlyHint: false,
@@ -13558,25 +13836,34 @@ var createBackupTool = {
   async handler(params, context) {
     const parsed = createBackupInputSchema.parse(params);
     log41.info({ routerId: context.routerId, name: parsed.name }, "Creating backup");
+    const password = resolveBackupPassword(parsed, context);
+    const encrypted = password !== void 0 && password !== "";
+    const how = encrypted ? "encrypted " : "";
     if (parsed.dryRun) {
       return {
-        content: `Dry run: Would create backup "${parsed.name}.backup" on ${context.routerId}.`,
-        structuredContent: { action: "dry_run", name: parsed.name, routerId: context.routerId }
+        content: `Dry run: Would create ${how}backup "${parsed.name}.backup" on ${context.routerId}.`,
+        structuredContent: {
+          action: "dry_run",
+          name: parsed.name,
+          routerId: context.routerId,
+          encrypted
+        }
       };
     }
     try {
       const body = { name: parsed.name };
-      if (parsed.password !== void 0) {
-        body.password = parsed.password;
+      if (password !== void 0) {
+        body.password = password;
       }
       await context.routerClient.execute("system/backup/save", body);
-      log41.info({ routerId: context.routerId, name: parsed.name }, "Backup created");
+      log41.info({ routerId: context.routerId, name: parsed.name, encrypted }, "Backup created");
       return {
-        content: `Backup "${parsed.name}.backup" created on ${context.routerId}.`,
+        content: `Backup "${parsed.name}.backup" created ${how}on ${context.routerId}.`,
         structuredContent: {
           action: "created",
           routerId: context.routerId,
-          filePath: `${parsed.name}.backup`
+          filePath: `${parsed.name}.backup`,
+          encrypted
         }
       };
     } catch (err) {
@@ -15877,7 +16164,7 @@ var swosConfigTools = [getSwosConfigTool, applySwosConfigTool];
 import { z as z49 } from "zod";
 import { createHash as createHash2 } from "crypto";
 import { chmod, mkdir as mkdir3, readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
-import { join as join3, resolve, sep } from "path";
+import { join as join4, resolve, sep } from "path";
 var log48 = createLogger("swos-maintenance-tools");
 var DOWNLOAD_BASE = "https://download.mikrotik.com/swos";
 var FIRMWARE_MIN_BYTES = 16 * 1024;
@@ -15887,7 +16174,7 @@ var RESTORE_TIMEOUT_MS = 6e4;
 var FILE_NAME = /^[A-Za-z0-9][A-Za-z0-9._+-]{0,127}$/;
 var fileName = z49.string().regex(FILE_NAME, "a plain file name inside the server's SwOS folder, no path");
 function swosDir(context) {
-  return join3(context.appConfig.dataDir, "swos");
+  return join4(context.appConfig.dataDir, "swos");
 }
 function sha256(data) {
   return createHash2("sha256").update(data).digest("hex");
@@ -16496,6 +16783,9 @@ function checkAuthz(identity, toolName, routerId2) {
       }
     });
   }
+  checkToolAllowed(identity, toolName);
+}
+function checkToolAllowed(identity, toolName) {
   if (identity.allowedToolPatterns.length > 0) {
     const allowed = identity.allowedToolPatterns.some((p) => matchesPattern(toolName, p));
     if (!allowed) {
@@ -17332,6 +17622,7 @@ async function executeToolCall(tool, args, deps) {
     try {
       const identity = getCurrentIdentity() ?? getStdioIdentity(config.stdioIdentity, identityRegistry);
       if (tool.skipRouterContext) {
+        checkToolAllowed(identity, tool.name);
         const fleetContext = {
           routerClient: fleetUnavailable("routerClient"),
           deviceClient: fleetUnavailable("deviceClient"),
@@ -17410,6 +17701,7 @@ async function executeToolCall(tool, args, deps) {
         }
       }
       toolContext.snapshots = snapshots;
+      const dryRun2 = !tool.annotations.readOnlyHint && isEffectiveDryRun(tool, handlerArgs);
       if (!tool.annotations.readOnlyHint && config.journalPath) {
         const { confirmationToken: _token, ...journalArgs } = loggedArgs;
         journalId = recordAttempt({
@@ -17419,7 +17711,8 @@ async function executeToolCall(tool, args, deps) {
           tool: tool.name,
           routerId: routerId2,
           params: journalArgs,
-          snapshotIds
+          snapshotIds,
+          dryRun: dryRun2
         });
       }
       const runHandler = () => tool.handler(handlerArgs, toolContext);
@@ -17433,6 +17726,11 @@ async function executeToolCall(tool, args, deps) {
           phase: "success",
           durationMs: Date.now() - startMs
         });
+        if (!dryRun2 && snapshotIds.length > 0) {
+          result.structuredContent = { ...result.structuredContent, journalId };
+          result.content += `
+Journal ID: ${journalId} (pass to rollback_change to undo).`;
+        }
       }
       if (shouldAudit) {
         auditLog(
@@ -17504,9 +17802,9 @@ async function executeToolCall(tool, args, deps) {
 }
 
 // src/middleware/fleet-confirmation.ts
-import { createHmac as createHmac2, createHash as createHash5, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { createHmac as createHmac2, createHash as createHash5, randomBytes as randomBytes3, timingSafeEqual as timingSafeEqual2 } from "crypto";
 var CONFIRMATION_TTL_MS2 = 5 * 60 * 1e3;
-var processSecret = randomBytes2(32).toString("hex");
+var processSecret = randomBytes3(32).toString("hex");
 var usedTokens2 = /* @__PURE__ */ new Map();
 function fingerprint(args) {
   const sortedRouters = [...args.routerIds].sort();
@@ -17610,7 +17908,7 @@ var listRoutersInputSchema = z50.object({
 var listRoutersTool = {
   name: "list_routers",
   title: "List Routers",
-  description: "List the routers configured in the registry (routers.yaml): id, host, port, TLS status, tags, ROS version, and which is the default. Read-only reflection of local config \u2014 no RouterOS API call, no credentials in the response. Use it to discover valid routerId values and tags for targeting other tools (including bulk_read and bulk_execute).",
+  description: "List the routers configured in the registry (routers.yaml): id, host, port, TLS status, tags, ROS version, and which is the default. Read-only reflection of local config \u2014 no RouterOS API call, no credentials in the response. rosVersion is what routers.yaml states and may lag a router upgrade \u2014 ask get_system_status for the live version. Use it to discover valid routerId values and tags for targeting other tools (including bulk_read and bulk_execute).",
   inputSchema: listRoutersInputSchema,
   annotations: {
     readOnlyHint: true,
@@ -17653,9 +17951,17 @@ var listRoutersTool = {
         "isDefault"
       ])}`
     );
+    const hasRouterOS = rows.some((r) => r.deviceType === "routeros");
     return {
       content: total === 0 ? header : [header, ...lines].join("\n"),
-      structuredContent: { routers: rows, total, returned: total }
+      structuredContent: {
+        routers: rows,
+        total,
+        returned: total,
+        ...hasRouterOS ? {
+          note: "rosVersion comes from routers.yaml and may be stale; use get_system_status for the live version."
+        } : {}
+      }
     };
   }
 };
@@ -17814,7 +18120,8 @@ async function fanOut(req) {
           tool: input2.toolName,
           routerId: router.id,
           params: loggedParams,
-          snapshotIds
+          snapshotIds,
+          dryRun: isEffectiveDryRun(targetTool, toolParams)
         });
       }
       const cb = getOrCreateBreaker(context.circuitBreakers, router.id, context.appConfig);
@@ -18190,8 +18497,9 @@ var RouterConfigSchema = z52.object({
   }).optional(),
   cmdAllow: z52.array(z52.string()).optional(),
   cmdDeny: z52.array(z52.string()).optional(),
-  // SwOS only: the MIKROMCP_SECRET_<NAME> values a switch config applied to
-  // this switch may reference. Without the list it may reference none.
+  // The MIKROMCP_SECRET_<NAME> values this device may use: a switch config
+  // applied to a SwOS switch, create_backup's passwordSecret on RouterOS.
+  // Without the list it may use none.
   secrets: z52.array(
     z52.string().regex(/^[A-Z0-9_]+$/, "a secret name is the NAME of MIKROMCP_SECRET_<NAME>")
   ).optional(),
@@ -18219,13 +18527,6 @@ var RouterConfigSchema = z52.object({
         message: "rosVersion is required for RouterOS devices"
       });
     }
-    if (config.secrets) {
-      ctx.addIssue({
-        code: z52.ZodIssueCode.custom,
-        path: ["secrets"],
-        message: "secrets binds switch config secrets and applies to SwOS devices only"
-      });
-    }
     return;
   }
   if (config.tls?.enabled) {
@@ -18398,7 +18699,7 @@ var ConnectionPool = class {
 };
 
 // src/version.ts
-var VERSION2 = "1.14.1";
+var VERSION2 = "1.16.0";
 
 // src/mcp/server.ts
 var SERVER_INSTRUCTIONS = [
@@ -18786,8 +19087,8 @@ ${issues}`);
 };
 
 // src/domain/snapshot/retention.ts
-import { readdir, stat, unlink } from "fs/promises";
-import { join as join4 } from "path";
+import { readdir, readFile as readFile3, rename, stat, unlink } from "fs/promises";
+import { join as join5 } from "path";
 var log56 = createLogger("snapshot-retention");
 async function pruneSnapshots(snapshotDir, maxAgeDays) {
   const cutoffMs = Date.now() - maxAgeDays * 864e5;
@@ -18799,7 +19100,7 @@ async function pruneSnapshots(snapshotDir, maxAgeDays) {
     return 0;
   }
   for (const routerDir of routerDirs) {
-    const dirPath = join4(snapshotDir, routerDir);
+    const dirPath = join5(snapshotDir, routerDir);
     let files;
     try {
       files = await readdir(dirPath);
@@ -18807,7 +19108,7 @@ async function pruneSnapshots(snapshotDir, maxAgeDays) {
       continue;
     }
     for (const file of files) {
-      const filePath = join4(dirPath, file);
+      const filePath = join5(dirPath, file);
       try {
         const info = await stat(filePath);
         if (info.isFile() && info.mtimeMs < cutoffMs) {
@@ -18824,6 +19125,41 @@ async function pruneSnapshots(snapshotDir, maxAgeDays) {
   }
   return removed;
 }
+var JOURNAL_ROTATE_AFTER_MS = 864e5;
+async function rotateAndPruneJournal(journalPath, maxAgeDays, now = /* @__PURE__ */ new Date()) {
+  const cutoffMs = now.getTime() - maxAgeDays * 864e5;
+  let removed = 0;
+  for (const segment of journalSegmentPaths(journalPath)) {
+    try {
+      if (journalSegmentRotatedAt(segment) < cutoffMs && (await stat(segment)).mtimeMs < cutoffMs) {
+        await unlink(segment);
+        removed++;
+      }
+    } catch (err) {
+      if (err.code !== "ENOENT") {
+        log56.warn({ err, segment }, "Failed to prune a write-journal segment");
+      }
+    }
+  }
+  if (removed > 0) {
+    log56.info({ removed, maxAgeDays }, "Pruned expired write-journal segments");
+  }
+  let rotated = false;
+  try {
+    const oldest = parseJournal(await readFile3(journalPath, "utf-8")).find(
+      (e) => typeof e.ts === "string" && Number.isFinite(Date.parse(e.ts))
+    );
+    if (oldest && Date.parse(oldest.ts) <= now.getTime() - JOURNAL_ROTATE_AFTER_MS) {
+      await rename(journalPath, journalSegmentName(journalPath, now));
+      rotated = true;
+    }
+  } catch (err) {
+    if (err.code !== "ENOENT") {
+      log56.warn({ err, journalPath }, "Failed to rotate the write journal");
+    }
+  }
+  return { rotated, removed };
+}
 
 // src/cli/serve.ts
 var log57 = createLogger("main");
@@ -18831,6 +19167,7 @@ async function runServe() {
   const config = loadAppConfig();
   log57.info({ transport: config.transport, logLevel: config.logLevel }, "Starting MikroMCP server");
   void pruneSnapshots(config.snapshotDir, config.retention.snapshotMaxAgeDays);
+  void rotateAndPruneJournal(config.journalPath, config.retention.snapshotMaxAgeDays);
   const identityRegistry = new IdentityRegistry(config.identitiesPath);
   if (config.transport === "http") {
     const hasLimitedRoles = identityRegistry.getIdentities().some((i) => i.role === "readonly" || i.role === "operator");
@@ -18876,7 +19213,7 @@ import { existsSync as existsSync3, readFileSync as readFileSync7 } from "fs";
 import { homedir as homedir2 } from "os";
 import * as net from "net";
 import chalk from "chalk";
-var localVersion = "1.14.1";
+var localVersion = "1.16.0";
 var results = [];
 function ok(msg) {
   console.log(chalk.green("\u2705 ") + msg);
@@ -18967,7 +19304,16 @@ function checkEnvVars(routers, transport2) {
   }
   const secretNames = Object.keys(process.env).filter((k) => k.startsWith("MIKROMCP_SECRET_"));
   for (const router of routers) {
-    if (router.deviceType !== "swos") continue;
+    if (router.deviceType !== "swos") {
+      for (const name of router.secrets ?? []) {
+        if (!process.env[`MIKROMCP_SECRET_${name}`]) {
+          warn(
+            `${router.id} binds secret ${name}, but MIKROMCP_SECRET_${name} is not set or empty \u2014 create_backup with passwordSecret ${name} will be refused`
+          );
+        }
+      }
+      continue;
+    }
     if (router.secrets) {
       for (const name of router.secrets) {
         if (!process.env[`MIKROMCP_SECRET_${name}`]) {
@@ -19273,18 +19619,18 @@ async function runDoctor() {
 
 // src/cli/init.ts
 import { input, confirm, select } from "@inquirer/prompts";
-import { randomBytes as randomBytes3 } from "crypto";
+import { randomBytes as randomBytes4 } from "crypto";
 import { existsSync as existsSync4, readFileSync as readFileSync8, writeFileSync, mkdirSync, copyFileSync } from "fs";
 import { homedir as homedir3 } from "os";
-import { join as join5 } from "path";
+import { join as join6 } from "path";
 import { parse as yamlParse, Document, visit } from "yaml";
 import bcrypt2 from "bcryptjs";
 import chalk2 from "chalk";
 function mikromcpDir2() {
-  return join5(homedir3(), ".mikromcp");
+  return join6(homedir3(), ".mikromcp");
 }
 function defaultAuditLogPath() {
-  return join5(mikromcpDir2(), "audit.ndjson");
+  return join6(mikromcpDir2(), "audit.ndjson");
 }
 function toYaml2(obj) {
   const doc = new Document(obj);
@@ -19312,8 +19658,8 @@ function splitTags(val) {
 }
 function findClaudeDesktopConfig() {
   const candidates = [
-    join5(homedir3(), "Library", "Application Support", "Claude", "claude_desktop_config.json"),
-    join5(homedir3(), ".config", "Claude", "claude_desktop_config.json")
+    join6(homedir3(), "Library", "Application Support", "Claude", "claude_desktop_config.json"),
+    join6(homedir3(), ".config", "Claude", "claude_desktop_config.json")
   ];
   return candidates.find((p) => existsSync4(p)) ?? null;
 }
@@ -19433,7 +19779,7 @@ async function collectIdentityInfo() {
     message: "Allowed tool patterns (comma-separated or * for all):",
     default: "*"
   });
-  const rawToken = randomBytes3(32).toString("hex");
+  const rawToken = randomBytes4(32).toString("hex");
   console.log(chalk2.green(`
   Generated token: ${chalk2.bold(rawToken)}`));
   console.log(chalk2.yellow("  \u26A0  Save this token \u2014 it will NOT be shown again.\n"));
@@ -19481,7 +19827,7 @@ async function collectClaudeDesktopPreference() {
   return confirm({ message: "Register with Claude Desktop?", default: true });
 }
 function writeRoutersYaml(data) {
-  const filePath = join5(data.configDir, "routers.yaml");
+  const filePath = join6(data.configDir, "routers.yaml");
   const newEntry = {
     host: data.host,
     port: data.port,
@@ -19508,7 +19854,7 @@ function writeRoutersYaml(data) {
   return true;
 }
 function writeIdentitiesYaml(data) {
-  const filePath = join5(data.configDir, "identities.yaml");
+  const filePath = join6(data.configDir, "identities.yaml");
   const newEntry = {
     token: data.tokenHash,
     role: data.role,
@@ -19530,7 +19876,7 @@ function writeDotEnv(data) {
   const userKey = `${data.envPrefix}_USER`;
   const passKey = `${data.envPrefix}_PASS`;
   const auditLogPath = defaultAuditLogPath();
-  const confirmationSecret = data.transport === "http" ? randomBytes3(32).toString("hex") : "";
+  const confirmationSecret = data.transport === "http" ? randomBytes4(32).toString("hex") : "";
   const lines = [
     "# \u2500\u2500 Router credentials \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500",
     `${userKey}=${data.routerUser}`,
@@ -19542,8 +19888,8 @@ function writeDotEnv(data) {
     `MIKROMCP_TRANSPORT=${data.transport}`,
     "",
     "# \u2500\u2500 Config paths \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500",
-    `MIKROMCP_CONFIG_PATH=${join5(data.configDir, "routers.yaml")}`,
-    `MIKROMCP_IDENTITIES_PATH=${join5(data.configDir, "identities.yaml")}`,
+    `MIKROMCP_CONFIG_PATH=${join6(data.configDir, "routers.yaml")}`,
+    `MIKROMCP_IDENTITIES_PATH=${join6(data.configDir, "identities.yaml")}`,
     "",
     "# \u2500\u2500 Default router \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500",
     "# Router used when a tool call omits routerId (handy for single-router setups).",
@@ -19597,9 +19943,9 @@ function registerClaudeDesktop() {
 async function runInit() {
   console.log(chalk2.bold.cyan("\n\u{1F527}  MikroMCP \u2014 Interactive Setup Wizard\n"));
   const configDir = mikromcpDir2();
-  const envPath = join5(configDir, ".env");
+  const envPath = join6(configDir, ".env");
   const existingFiles = [".env", "routers.yaml", "identities.yaml"].filter(
-    (f2) => existsSync4(join5(configDir, f2))
+    (f2) => existsSync4(join6(configDir, f2))
   );
   if (existingFiles.length > 0) {
     console.log(chalk2.yellow(`  \u26A0  Found existing files in ${configDir}:`));
@@ -19637,12 +19983,12 @@ async function runInit() {
   if (data.writeRoutersYaml) {
     writeRoutersYaml(data);
     summary.push(`routers.yaml written to ${data.configDir}`);
-    console.log(chalk2.green(`  \u2714  ${join5(data.configDir, "routers.yaml")}`));
+    console.log(chalk2.green(`  \u2714  ${join6(data.configDir, "routers.yaml")}`));
   }
   if (data.writeIdentitiesYaml) {
     writeIdentitiesYaml(data);
     summary.push(`identities.yaml written to ${data.configDir}`);
-    console.log(chalk2.green(`  \u2714  ${join5(data.configDir, "identities.yaml")}`));
+    console.log(chalk2.green(`  \u2714  ${join6(data.configDir, "identities.yaml")}`));
   }
   if (data.writeEnv) {
     writeDotEnv(data);
@@ -19692,7 +20038,7 @@ async function runInit() {
 }
 
 // src/cli/index.ts
-var program = new Command().name("mikromcp").description("MikroTik RouterOS MCP server").version("1.14.1");
+var program = new Command().name("mikromcp").description("MikroTik RouterOS MCP server").version("1.16.0");
 program.command("serve", { isDefault: true }).description("Start the MCP server (default)").action(runServe);
 program.command("doctor").description("Check config, connectivity, and permissions").action(runDoctor);
 program.command("init").description("Interactive setup wizard").action(runInit);
@@ -19702,6 +20048,6 @@ program.command("update").description("Update mikromcp to the latest version via
 });
 
 // src/main.ts
-loadDotenv({ path: join6(homedir4(), ".mikromcp", ".env"), override: false, quiet: true });
+loadDotenv({ path: join7(homedir4(), ".mikromcp", ".env"), override: false, quiet: true });
 program.parse();
 //# sourceMappingURL=main.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mikromcp",
-  "version": "1.14.1",
+  "version": "1.16.0",
   "mcpName": "io.github.AliKarami/mikromcp",
   "description": "Production-grade MCP server for MikroTik RouterOS routers and SwOS switches",
   "type": "module",