mikromcp 1.15.0 → 1.16.0

package/README.md

@@ -12,7 +12,7 @@
 
 [![CI](https://github.com/AliKarami/MikroMCP/actions/workflows/ci.yml/badge.svg)](https://github.com/AliKarami/MikroMCP/actions/workflows/ci.yml)
 [![Release](https://github.com/AliKarami/MikroMCP/actions/workflows/release.yml/badge.svg)](https://github.com/AliKarami/MikroMCP/actions/workflows/release.yml)
-[![Version](https://img.shields.io/badge/version-v1.15.0-2DD4BF)](package.json)
+[![Version](https://img.shields.io/badge/version-v1.16.0-2DD4BF)](package.json)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 [![Node.js >= 22](https://img.shields.io/badge/node-%3E%3D22-339933)](package.json)
 [![RouterOS 7.x](https://img.shields.io/badge/RouterOS-7.x-293239)](https://help.mikrotik.com/docs/display/ROS/REST+API)

package/config/identities.example.yaml

@@ -19,6 +19,8 @@
 #
 # allowedRouters:  [] means all routers are accessible.
 # allowedToolPatterns: [] means all tools are accessible. Supports * wildcard.
+#   Fleet tools (bulk_read, bulk_execute) must match by their own name too;
+#   they also check each tool they fan out.
 
 identities:
   # CI pipeline: operator access to specific routers, limited tool set

package/dist/main.js

@@ -2,7 +2,7 @@
 
 // src/main.ts
 import { config as loadDotenv } from "dotenv";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 import { homedir as homedir4 } from "os";
 
 // src/cli/index.ts
@@ -6360,7 +6360,6 @@ var containerTools = [listContainersTool, manageContainerTool];
 
 // src/domain/tools/change-management-tools.ts
 import { z as z25 } from "zod";
-import { readFileSync as readFileSync2 } from "fs";
 
 // src/domain/snapshot/snapshot-engine.ts
 import { mkdir, writeFile, readFile } from "fs/promises";
@@ -8081,8 +8080,10 @@ async function loadSnapshot(filePath) {
 }
 
 // src/domain/snapshot/write-journal.ts
+import { randomBytes as randomBytes2 } from "crypto";
+import { readdirSync, readFileSync as readFileSync2 } from "fs";
 import { appendFile as appendFile2, mkdir as mkdir2 } from "fs/promises";
-import { dirname } from "path";
+import { basename, dirname, extname, join as join3 } from "path";
 import { nanoid as nanoid2 } from "nanoid";
 
 // src/observability/audit-log.ts
@@ -8156,6 +8157,72 @@ function recordAttempt(args) {
   });
   return id;
 }
+function parseJournal(raw) {
+  const entries = [];
+  for (const line of raw.split("\n")) {
+    if (!line.trim()) continue;
+    try {
+      const entry = JSON.parse(line);
+      if (entry && typeof entry === "object" && !Array.isArray(entry)) {
+        entries.push(entry);
+      }
+    } catch {
+      continue;
+    }
+  }
+  return entries;
+}
+var SEGMENT_STAMP = /^\d{8}T\d{6}Z-[0-9a-z]+$/;
+function journalSegmentName(journalPath, now, suffix = randomBytes2(6).toString("hex")) {
+  const ext = extname(journalPath);
+  const stamp2 = now.toISOString().replace(/[-:]/g, "").replace(/\.\d+Z$/, "Z");
+  return join3(dirname(journalPath), `${basename(journalPath, ext)}.${stamp2}-${suffix}${ext}`);
+}
+function journalSegmentPaths(journalPath) {
+  const ext = extname(journalPath);
+  const prefix = `${basename(journalPath, ext)}.`;
+  let names;
+  try {
+    names = readdirSync(dirname(journalPath));
+  } catch {
+    return [];
+  }
+  return names.filter(
+    (n) => n.startsWith(prefix) && n.endsWith(ext) && SEGMENT_STAMP.test(n.slice(prefix.length, n.length - ext.length))
+  ).sort().map((n) => join3(dirname(journalPath), n));
+}
+function journalSegmentRotatedAt(segmentPath) {
+  const stamp2 = /\.(\d{4})(\d{2})(\d{2})T(\d{2})(\d{2})(\d{2})Z-[0-9a-z]+\.[^.]+$/.exec(
+    segmentPath
+  );
+  if (!stamp2) return NaN;
+  const [, y, mo, d, h, mi, se] = stamp2;
+  return Date.parse(`${y}-${mo}-${d}T${h}:${mi}:${se}Z`);
+}
+function readIfExists(path) {
+  try {
+    return readFileSync2(path, "utf-8");
+  } catch (err) {
+    if (err.code === "ENOENT") return "";
+    throw err;
+  }
+}
+function readJournalEntries(journalPath) {
+  const current = parseJournal(readIfExists(journalPath));
+  const segments2 = journalSegmentPaths(journalPath).flatMap((p) => parseJournal(readIfExists(p)));
+  const seen = /* @__PURE__ */ new Set();
+  const entries = [...segments2, ...current].filter((e) => {
+    const key2 = `${String(e.id)}\0${String(e.phase)}`;
+    if (seen.has(key2)) return false;
+    seen.add(key2);
+    return true;
+  });
+  const time = (e) => {
+    const t = typeof e.ts === "string" ? Date.parse(e.ts) : NaN;
+    return Number.isFinite(t) ? t : Number.POSITIVE_INFINITY;
+  };
+  return entries.map((e, i) => ({ e, i, t: time(e) })).sort((a, b) => a.t - b.t || a.i - b.i).map(({ e }) => e);
+}
 function recordOutcome(args) {
   void appendLine(args.journalPath, {
     id: args.journalId,
@@ -9046,47 +9113,6 @@ function unionVlanBlob(currentWire, targetWire) {
   return dumpBlob([...rows.entries()].sort((a, b) => a[0] - b[0]).map(([, row]) => row));
 }
 
-// src/middleware/authz.ts
-function matchesPattern(name, pattern) {
-  return globMatch(pattern, name);
-}
-function checkAuthz(identity, toolName, routerId2) {
-  if (identity.allowedRouters.length > 0 && !identity.allowedRouters.includes(routerId2)) {
-    throw new MikroMCPError({
-      category: "PERMISSION_DENIED" /* PERMISSION_DENIED */,
-      code: "ROUTER_NOT_ALLOWED",
-      message: `Identity "${identity.id}" is not allowed to access router "${routerId2}".`,
-      details: { identityId: identity.id, routerId: routerId2, allowedRouters: identity.allowedRouters },
-      recoverability: {
-        retryable: false,
-        suggestedAction: `Add "${routerId2}" to allowedRouters for identity "${identity.id}" in identities.yaml.`
-      }
-    });
-  }
-  checkToolAllowed(identity, toolName);
-}
-function checkToolAllowed(identity, toolName) {
-  if (identity.allowedToolPatterns.length > 0) {
-    const allowed = identity.allowedToolPatterns.some((p) => matchesPattern(toolName, p));
-    if (!allowed) {
-      throw new MikroMCPError({
-        category: "PERMISSION_DENIED" /* PERMISSION_DENIED */,
-        code: "TOOL_NOT_ALLOWED",
-        message: `Identity "${identity.id}" is not allowed to call tool "${toolName}".`,
-        details: {
-          identityId: identity.id,
-          toolName,
-          allowedToolPatterns: identity.allowedToolPatterns
-        },
-        recoverability: {
-          retryable: false,
-          suggestedAction: `Add a matching pattern to allowedToolPatterns for identity "${identity.id}" in identities.yaml.`
-        }
-      });
-    }
-  }
-}
-
 // src/domain/tools/change-management-tools.ts
 var log24 = createLogger("change-management");
 var stepSchema = z25.object({
@@ -9125,7 +9151,6 @@ var listJournalTool = {
   skipRouterContext: true,
   async handler(params, context) {
     const parsed = listJournalInputSchema.parse(params);
-    checkToolAllowed(context.identity, "list_journal");
     const journalPath = context.appConfig.journalPath;
     if (!journalPath) {
       return {
@@ -9133,35 +9158,24 @@ var listJournalTool = {
         structuredContent: { journalEnabled: false, entries: [], total: 0, returned: 0 }
       };
     }
-    let raw;
+    let journal;
     try {
-      raw = readFileSync2(journalPath, "utf-8");
+      journal = readJournalEntries(journalPath);
     } catch (err) {
-      if (err.code === "ENOENT") {
-        raw = "";
-      } else {
-        throw new MikroMCPError({
-          category: "INTERNAL" /* INTERNAL */,
-          code: "JOURNAL_READ_FAILED",
-          message: `Could not read the write journal: ${err.message}`,
-          details: { journalPath },
-          recoverability: {
-            retryable: false,
-            suggestedAction: "Check the file's permissions under the MikroMCP data directory."
-          }
-        });
-      }
+      throw new MikroMCPError({
+        category: "INTERNAL" /* INTERNAL */,
+        code: "JOURNAL_READ_FAILED",
+        message: `Could not read the write journal: ${err.message}`,
+        details: { journalPath },
+        recoverability: {
+          retryable: false,
+          suggestedAction: "Check the file's permissions under the MikroMCP data directory."
+        }
+      });
     }
     const outcomes = /* @__PURE__ */ new Map();
     const attempts = [];
-    for (const line of raw.split("\n")) {
-      if (!line.trim()) continue;
-      let entry;
-      try {
-        entry = JSON.parse(line);
-      } catch {
-        continue;
-      }
+    for (const entry of journal) {
       if (entry.phase === "attempt") attempts.push(entry);
       else
         outcomes.set(entry.id, {
@@ -9486,9 +9500,9 @@ function createChangeManagementTools(baseTools2) {
     }
   };
   function findJournalEntry(journalPath, journalId) {
-    const raw = readFileSync2(journalPath, "utf-8");
-    const lines = raw.split("\n").filter(Boolean);
-    const entry = lines.map((l) => JSON.parse(l)).find((e) => e.id === journalId && e.phase === "attempt");
+    const entry = readJournalEntries(journalPath).find(
+      (e) => e.id === journalId && e.phase === "attempt"
+    );
     if (!entry) {
       throw new MikroMCPError({
         category: "NOT_FOUND" /* NOT_FOUND */,
@@ -13764,13 +13778,54 @@ var log41 = createLogger("backup-tools");
 var createBackupInputSchema = z42.object({
   routerId,
   name: z42.string().default("backup").describe("Backup file name (without extension)"),
-  password: z42.string().optional().describe("Password to encrypt the backup file"),
+  password: z42.string().optional().describe(
+    "Literal password to encrypt the backup. It stays in the conversation history; prefer passwordSecret"
+  ),
+  passwordSecret: z42.string().regex(/^[A-Z0-9_]+$/, "a secret name is the NAME of MIKROMCP_SECRET_<NAME>").optional().describe(
+    "Encrypt with the server's MIKROMCP_SECRET_<NAME> value, bound to this router by its secrets list in routers.yaml. The value never reaches the conversation"
+  ),
   dryRun: z42.boolean().default(false).describe("Preview the backup without creating it")
 }).strict();
+function backupError(code, message, suggestedAction) {
+  return new MikroMCPError({
+    category: "VALIDATION" /* VALIDATION */,
+    code,
+    message,
+    recoverability: { retryable: false, suggestedAction }
+  });
+}
+function resolveBackupPassword(parsed, context) {
+  const name = parsed.passwordSecret;
+  if (name === void 0) return parsed.password;
+  if (parsed.password !== void 0) {
+    throw backupError(
+      "BACKUP_PASSWORD_CONFLICT",
+      "Pass either password or passwordSecret, not both.",
+      "Drop password and keep passwordSecret, so the password stays out of the conversation."
+    );
+  }
+  const bound = context.routerConfig.secrets ?? [];
+  if (!bound.includes(name)) {
+    throw backupError(
+      "BACKUP_SECRET_NOT_BOUND",
+      bound.length ? `Secret ${name} is not bound to router "${context.routerId}" (its routers.yaml secrets list names ${bound.join(", ")}).` : `Router "${context.routerId}" has no secrets list in routers.yaml, so it may use no secret.`,
+      `Add ${name} to the router's \`secrets\` list in routers.yaml if it is meant for it.`
+    );
+  }
+  const value = context.appConfig.configSecrets[name];
+  if (!value) {
+    throw backupError(
+      "BACKUP_SECRET_MISSING",
+      `Secret ${name} is bound to router "${context.routerId}", but MIKROMCP_SECRET_${name} is not set or empty.`,
+      `Set MIKROMCP_SECRET_${name} in the MikroMCP server's environment and restart it.`
+    );
+  }
+  return value;
+}
 var createBackupTool = {
   name: "create_backup",
   title: "Create Backup",
-  description: "Create a binary configuration backup on a MikroTik router. The backup is saved as <name>.backup on the router's filesystem. Supports optional encryption via password and dry-run mode.",
+  description: "Create a binary configuration backup on a MikroTik router. The backup is saved as <name>.backup on the router's filesystem. To encrypt it, prefer passwordSecret (a MIKROMCP_SECRET_<NAME> bound to the router in routers.yaml \u2014 the password never reaches the conversation) over a literal password. Dry run checks that the secret resolves.",
   inputSchema: createBackupInputSchema,
   annotations: {
     readOnlyHint: false,
@@ -13781,25 +13836,34 @@ var createBackupTool = {
   async handler(params, context) {
     const parsed = createBackupInputSchema.parse(params);
     log41.info({ routerId: context.routerId, name: parsed.name }, "Creating backup");
+    const password = resolveBackupPassword(parsed, context);
+    const encrypted = password !== void 0 && password !== "";
+    const how = encrypted ? "encrypted " : "";
     if (parsed.dryRun) {
       return {
-        content: `Dry run: Would create backup "${parsed.name}.backup" on ${context.routerId}.`,
-        structuredContent: { action: "dry_run", name: parsed.name, routerId: context.routerId }
+        content: `Dry run: Would create ${how}backup "${parsed.name}.backup" on ${context.routerId}.`,
+        structuredContent: {
+          action: "dry_run",
+          name: parsed.name,
+          routerId: context.routerId,
+          encrypted
+        }
       };
     }
     try {
       const body = { name: parsed.name };
-      if (parsed.password !== void 0) {
-        body.password = parsed.password;
+      if (password !== void 0) {
+        body.password = password;
       }
       await context.routerClient.execute("system/backup/save", body);
-      log41.info({ routerId: context.routerId, name: parsed.name }, "Backup created");
+      log41.info({ routerId: context.routerId, name: parsed.name, encrypted }, "Backup created");
       return {
-        content: `Backup "${parsed.name}.backup" created on ${context.routerId}.`,
+        content: `Backup "${parsed.name}.backup" created ${how}on ${context.routerId}.`,
         structuredContent: {
           action: "created",
           routerId: context.routerId,
-          filePath: `${parsed.name}.backup`
+          filePath: `${parsed.name}.backup`,
+          encrypted
         }
       };
     } catch (err) {
@@ -16100,7 +16164,7 @@ var swosConfigTools = [getSwosConfigTool, applySwosConfigTool];
 import { z as z49 } from "zod";
 import { createHash as createHash2 } from "crypto";
 import { chmod, mkdir as mkdir3, readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
-import { join as join3, resolve, sep } from "path";
+import { join as join4, resolve, sep } from "path";
 var log48 = createLogger("swos-maintenance-tools");
 var DOWNLOAD_BASE = "https://download.mikrotik.com/swos";
 var FIRMWARE_MIN_BYTES = 16 * 1024;
@@ -16110,7 +16174,7 @@ var RESTORE_TIMEOUT_MS = 6e4;
 var FILE_NAME = /^[A-Za-z0-9][A-Za-z0-9._+-]{0,127}$/;
 var fileName = z49.string().regex(FILE_NAME, "a plain file name inside the server's SwOS folder, no path");
 function swosDir(context) {
-  return join3(context.appConfig.dataDir, "swos");
+  return join4(context.appConfig.dataDir, "swos");
 }
 function sha256(data) {
   return createHash2("sha256").update(data).digest("hex");
@@ -16702,6 +16766,47 @@ var swosMaintenanceTools = [
 // src/domain/tools/fleet-tools.ts
 import { z as z50 } from "zod";
 
+// src/middleware/authz.ts
+function matchesPattern(name, pattern) {
+  return globMatch(pattern, name);
+}
+function checkAuthz(identity, toolName, routerId2) {
+  if (identity.allowedRouters.length > 0 && !identity.allowedRouters.includes(routerId2)) {
+    throw new MikroMCPError({
+      category: "PERMISSION_DENIED" /* PERMISSION_DENIED */,
+      code: "ROUTER_NOT_ALLOWED",
+      message: `Identity "${identity.id}" is not allowed to access router "${routerId2}".`,
+      details: { identityId: identity.id, routerId: routerId2, allowedRouters: identity.allowedRouters },
+      recoverability: {
+        retryable: false,
+        suggestedAction: `Add "${routerId2}" to allowedRouters for identity "${identity.id}" in identities.yaml.`
+      }
+    });
+  }
+  checkToolAllowed(identity, toolName);
+}
+function checkToolAllowed(identity, toolName) {
+  if (identity.allowedToolPatterns.length > 0) {
+    const allowed = identity.allowedToolPatterns.some((p) => matchesPattern(toolName, p));
+    if (!allowed) {
+      throw new MikroMCPError({
+        category: "PERMISSION_DENIED" /* PERMISSION_DENIED */,
+        code: "TOOL_NOT_ALLOWED",
+        message: `Identity "${identity.id}" is not allowed to call tool "${toolName}".`,
+        details: {
+          identityId: identity.id,
+          toolName,
+          allowedToolPatterns: identity.allowedToolPatterns
+        },
+        recoverability: {
+          retryable: false,
+          suggestedAction: `Add a matching pattern to allowedToolPatterns for identity "${identity.id}" in identities.yaml.`
+        }
+      });
+    }
+  }
+}
+
 // src/config/secrets.ts
 function getCredentials(router) {
   const { source, envPrefix, vaultPath } = router.credentials;
@@ -17517,6 +17622,7 @@ async function executeToolCall(tool, args, deps) {
     try {
       const identity = getCurrentIdentity() ?? getStdioIdentity(config.stdioIdentity, identityRegistry);
       if (tool.skipRouterContext) {
+        checkToolAllowed(identity, tool.name);
         const fleetContext = {
           routerClient: fleetUnavailable("routerClient"),
           deviceClient: fleetUnavailable("deviceClient"),
@@ -17696,9 +17802,9 @@ Journal ID: ${journalId} (pass to rollback_change to undo).`;
 }
 
 // src/middleware/fleet-confirmation.ts
-import { createHmac as createHmac2, createHash as createHash5, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { createHmac as createHmac2, createHash as createHash5, randomBytes as randomBytes3, timingSafeEqual as timingSafeEqual2 } from "crypto";
 var CONFIRMATION_TTL_MS2 = 5 * 60 * 1e3;
-var processSecret = randomBytes2(32).toString("hex");
+var processSecret = randomBytes3(32).toString("hex");
 var usedTokens2 = /* @__PURE__ */ new Map();
 function fingerprint(args) {
   const sortedRouters = [...args.routerIds].sort();
@@ -18391,8 +18497,9 @@ var RouterConfigSchema = z52.object({
   }).optional(),
   cmdAllow: z52.array(z52.string()).optional(),
   cmdDeny: z52.array(z52.string()).optional(),
-  // SwOS only: the MIKROMCP_SECRET_<NAME> values a switch config applied to
-  // this switch may reference. Without the list it may reference none.
+  // The MIKROMCP_SECRET_<NAME> values this device may use: a switch config
+  // applied to a SwOS switch, create_backup's passwordSecret on RouterOS.
+  // Without the list it may use none.
   secrets: z52.array(
     z52.string().regex(/^[A-Z0-9_]+$/, "a secret name is the NAME of MIKROMCP_SECRET_<NAME>")
   ).optional(),
@@ -18420,13 +18527,6 @@ var RouterConfigSchema = z52.object({
         message: "rosVersion is required for RouterOS devices"
       });
     }
-    if (config.secrets) {
-      ctx.addIssue({
-        code: z52.ZodIssueCode.custom,
-        path: ["secrets"],
-        message: "secrets binds switch config secrets and applies to SwOS devices only"
-      });
-    }
     return;
   }
   if (config.tls?.enabled) {
@@ -18599,7 +18699,7 @@ var ConnectionPool = class {
 };
 
 // src/version.ts
-var VERSION2 = "1.15.0";
+var VERSION2 = "1.16.0";
 
 // src/mcp/server.ts
 var SERVER_INSTRUCTIONS = [
@@ -18987,8 +19087,8 @@ ${issues}`);
 };
 
 // src/domain/snapshot/retention.ts
-import { readdir, stat, unlink } from "fs/promises";
-import { join as join4 } from "path";
+import { readdir, readFile as readFile3, rename, stat, unlink } from "fs/promises";
+import { join as join5 } from "path";
 var log56 = createLogger("snapshot-retention");
 async function pruneSnapshots(snapshotDir, maxAgeDays) {
   const cutoffMs = Date.now() - maxAgeDays * 864e5;
@@ -19000,7 +19100,7 @@ async function pruneSnapshots(snapshotDir, maxAgeDays) {
     return 0;
   }
   for (const routerDir of routerDirs) {
-    const dirPath = join4(snapshotDir, routerDir);
+    const dirPath = join5(snapshotDir, routerDir);
     let files;
     try {
       files = await readdir(dirPath);
@@ -19008,7 +19108,7 @@ async function pruneSnapshots(snapshotDir, maxAgeDays) {
       continue;
     }
     for (const file of files) {
-      const filePath = join4(dirPath, file);
+      const filePath = join5(dirPath, file);
       try {
         const info = await stat(filePath);
         if (info.isFile() && info.mtimeMs < cutoffMs) {
@@ -19025,6 +19125,41 @@ async function pruneSnapshots(snapshotDir, maxAgeDays) {
   }
   return removed;
 }
+var JOURNAL_ROTATE_AFTER_MS = 864e5;
+async function rotateAndPruneJournal(journalPath, maxAgeDays, now = /* @__PURE__ */ new Date()) {
+  const cutoffMs = now.getTime() - maxAgeDays * 864e5;
+  let removed = 0;
+  for (const segment of journalSegmentPaths(journalPath)) {
+    try {
+      if (journalSegmentRotatedAt(segment) < cutoffMs && (await stat(segment)).mtimeMs < cutoffMs) {
+        await unlink(segment);
+        removed++;
+      }
+    } catch (err) {
+      if (err.code !== "ENOENT") {
+        log56.warn({ err, segment }, "Failed to prune a write-journal segment");
+      }
+    }
+  }
+  if (removed > 0) {
+    log56.info({ removed, maxAgeDays }, "Pruned expired write-journal segments");
+  }
+  let rotated = false;
+  try {
+    const oldest = parseJournal(await readFile3(journalPath, "utf-8")).find(
+      (e) => typeof e.ts === "string" && Number.isFinite(Date.parse(e.ts))
+    );
+    if (oldest && Date.parse(oldest.ts) <= now.getTime() - JOURNAL_ROTATE_AFTER_MS) {
+      await rename(journalPath, journalSegmentName(journalPath, now));
+      rotated = true;
+    }
+  } catch (err) {
+    if (err.code !== "ENOENT") {
+      log56.warn({ err, journalPath }, "Failed to rotate the write journal");
+    }
+  }
+  return { rotated, removed };
+}
 
 // src/cli/serve.ts
 var log57 = createLogger("main");
@@ -19032,6 +19167,7 @@ async function runServe() {
   const config = loadAppConfig();
   log57.info({ transport: config.transport, logLevel: config.logLevel }, "Starting MikroMCP server");
   void pruneSnapshots(config.snapshotDir, config.retention.snapshotMaxAgeDays);
+  void rotateAndPruneJournal(config.journalPath, config.retention.snapshotMaxAgeDays);
   const identityRegistry = new IdentityRegistry(config.identitiesPath);
   if (config.transport === "http") {
     const hasLimitedRoles = identityRegistry.getIdentities().some((i) => i.role === "readonly" || i.role === "operator");
@@ -19077,7 +19213,7 @@ import { existsSync as existsSync3, readFileSync as readFileSync7 } from "fs";
 import { homedir as homedir2 } from "os";
 import * as net from "net";
 import chalk from "chalk";
-var localVersion = "1.15.0";
+var localVersion = "1.16.0";
 var results = [];
 function ok(msg) {
   console.log(chalk.green("\u2705 ") + msg);
@@ -19168,7 +19304,16 @@ function checkEnvVars(routers, transport2) {
   }
   const secretNames = Object.keys(process.env).filter((k) => k.startsWith("MIKROMCP_SECRET_"));
   for (const router of routers) {
-    if (router.deviceType !== "swos") continue;
+    if (router.deviceType !== "swos") {
+      for (const name of router.secrets ?? []) {
+        if (!process.env[`MIKROMCP_SECRET_${name}`]) {
+          warn(
+            `${router.id} binds secret ${name}, but MIKROMCP_SECRET_${name} is not set or empty \u2014 create_backup with passwordSecret ${name} will be refused`
+          );
+        }
+      }
+      continue;
+    }
     if (router.secrets) {
       for (const name of router.secrets) {
         if (!process.env[`MIKROMCP_SECRET_${name}`]) {
@@ -19474,18 +19619,18 @@ async function runDoctor() {
 
 // src/cli/init.ts
 import { input, confirm, select } from "@inquirer/prompts";
-import { randomBytes as randomBytes3 } from "crypto";
+import { randomBytes as randomBytes4 } from "crypto";
 import { existsSync as existsSync4, readFileSync as readFileSync8, writeFileSync, mkdirSync, copyFileSync } from "fs";
 import { homedir as homedir3 } from "os";
-import { join as join5 } from "path";
+import { join as join6 } from "path";
 import { parse as yamlParse, Document, visit } from "yaml";
 import bcrypt2 from "bcryptjs";
 import chalk2 from "chalk";
 function mikromcpDir2() {
-  return join5(homedir3(), ".mikromcp");
+  return join6(homedir3(), ".mikromcp");
 }
 function defaultAuditLogPath() {
-  return join5(mikromcpDir2(), "audit.ndjson");
+  return join6(mikromcpDir2(), "audit.ndjson");
 }
 function toYaml2(obj) {
   const doc = new Document(obj);
@@ -19513,8 +19658,8 @@ function splitTags(val) {
 }
 function findClaudeDesktopConfig() {
   const candidates = [
-    join5(homedir3(), "Library", "Application Support", "Claude", "claude_desktop_config.json"),
-    join5(homedir3(), ".config", "Claude", "claude_desktop_config.json")
+    join6(homedir3(), "Library", "Application Support", "Claude", "claude_desktop_config.json"),
+    join6(homedir3(), ".config", "Claude", "claude_desktop_config.json")
   ];
   return candidates.find((p) => existsSync4(p)) ?? null;
 }
@@ -19634,7 +19779,7 @@ async function collectIdentityInfo() {
     message: "Allowed tool patterns (comma-separated or * for all):",
     default: "*"
   });
-  const rawToken = randomBytes3(32).toString("hex");
+  const rawToken = randomBytes4(32).toString("hex");
   console.log(chalk2.green(`
   Generated token: ${chalk2.bold(rawToken)}`));
   console.log(chalk2.yellow("  \u26A0  Save this token \u2014 it will NOT be shown again.\n"));
@@ -19682,7 +19827,7 @@ async function collectClaudeDesktopPreference() {
   return confirm({ message: "Register with Claude Desktop?", default: true });
 }
 function writeRoutersYaml(data) {
-  const filePath = join5(data.configDir, "routers.yaml");
+  const filePath = join6(data.configDir, "routers.yaml");
   const newEntry = {
     host: data.host,
     port: data.port,
@@ -19709,7 +19854,7 @@ function writeRoutersYaml(data) {
   return true;
 }
 function writeIdentitiesYaml(data) {
-  const filePath = join5(data.configDir, "identities.yaml");
+  const filePath = join6(data.configDir, "identities.yaml");
   const newEntry = {
     token: data.tokenHash,
     role: data.role,
@@ -19731,7 +19876,7 @@ function writeDotEnv(data) {
   const userKey = `${data.envPrefix}_USER`;
   const passKey = `${data.envPrefix}_PASS`;
   const auditLogPath = defaultAuditLogPath();
-  const confirmationSecret = data.transport === "http" ? randomBytes3(32).toString("hex") : "";
+  const confirmationSecret = data.transport === "http" ? randomBytes4(32).toString("hex") : "";
   const lines = [
     "# \u2500\u2500 Router credentials \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500",
     `${userKey}=${data.routerUser}`,
@@ -19743,8 +19888,8 @@ function writeDotEnv(data) {
     `MIKROMCP_TRANSPORT=${data.transport}`,
     "",
     "# \u2500\u2500 Config paths \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500",
-    `MIKROMCP_CONFIG_PATH=${join5(data.configDir, "routers.yaml")}`,
-    `MIKROMCP_IDENTITIES_PATH=${join5(data.configDir, "identities.yaml")}`,
+    `MIKROMCP_CONFIG_PATH=${join6(data.configDir, "routers.yaml")}`,
+    `MIKROMCP_IDENTITIES_PATH=${join6(data.configDir, "identities.yaml")}`,
     "",
     "# \u2500\u2500 Default router \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500",
     "# Router used when a tool call omits routerId (handy for single-router setups).",
@@ -19798,9 +19943,9 @@ function registerClaudeDesktop() {
 async function runInit() {
   console.log(chalk2.bold.cyan("\n\u{1F527}  MikroMCP \u2014 Interactive Setup Wizard\n"));
   const configDir = mikromcpDir2();
-  const envPath = join5(configDir, ".env");
+  const envPath = join6(configDir, ".env");
   const existingFiles = [".env", "routers.yaml", "identities.yaml"].filter(
-    (f2) => existsSync4(join5(configDir, f2))
+    (f2) => existsSync4(join6(configDir, f2))
   );
   if (existingFiles.length > 0) {
     console.log(chalk2.yellow(`  \u26A0  Found existing files in ${configDir}:`));
@@ -19838,12 +19983,12 @@ async function runInit() {
   if (data.writeRoutersYaml) {
     writeRoutersYaml(data);
     summary.push(`routers.yaml written to ${data.configDir}`);
-    console.log(chalk2.green(`  \u2714  ${join5(data.configDir, "routers.yaml")}`));
+    console.log(chalk2.green(`  \u2714  ${join6(data.configDir, "routers.yaml")}`));
   }
   if (data.writeIdentitiesYaml) {
     writeIdentitiesYaml(data);
     summary.push(`identities.yaml written to ${data.configDir}`);
-    console.log(chalk2.green(`  \u2714  ${join5(data.configDir, "identities.yaml")}`));
+    console.log(chalk2.green(`  \u2714  ${join6(data.configDir, "identities.yaml")}`));
   }
   if (data.writeEnv) {
     writeDotEnv(data);
@@ -19893,7 +20038,7 @@ async function runInit() {
 }
 
 // src/cli/index.ts
-var program = new Command().name("mikromcp").description("MikroTik RouterOS MCP server").version("1.15.0");
+var program = new Command().name("mikromcp").description("MikroTik RouterOS MCP server").version("1.16.0");
 program.command("serve", { isDefault: true }).description("Start the MCP server (default)").action(runServe);
 program.command("doctor").description("Check config, connectivity, and permissions").action(runDoctor);
 program.command("init").description("Interactive setup wizard").action(runInit);
@@ -19903,6 +20048,6 @@ program.command("update").description("Update mikromcp to the latest version via
 });
 
 // src/main.ts
-loadDotenv({ path: join6(homedir4(), ".mikromcp", ".env"), override: false, quiet: true });
+loadDotenv({ path: join7(homedir4(), ".mikromcp", ".env"), override: false, quiet: true });
 program.parse();
 //# sourceMappingURL=main.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mikromcp",
-  "version": "1.15.0",
+  "version": "1.16.0",
   "mcpName": "io.github.AliKarami/mikromcp",
   "description": "Production-grade MCP server for MikroTik RouterOS routers and SwOS switches",
   "type": "module",