omniwire 2.5.0 → 2.6.0

package/dist/mcp/server.js

@@ -61,19 +61,133 @@ function multiResultJson(results) {
         ...(r.stderr ? { stderr: r.stderr.slice(0, 500) } : {}),
     }))));
 }
+// -- VPN namespace wrapper -- routes ONLY the command through VPN, mesh stays intact
+// Uses Linux network namespaces: creates isolated netns, moves VPN tunnel into it,
+// runs command inside namespace. Main namespace (WireGuard mesh, SSH) is untouched.
+function buildVpnWrappedCmd(vpnSpec, innerCmd) {
+    const ns = `ow-vpn-${Date.now().toString(36)}`;
+    const escaped = innerCmd.replace(/'/g, "'\\''");
+    // Parse spec: "mullvad", "mullvad:se", "openvpn:/path/to.conf", "wg:wg-vpn"
+    const [provider, param] = vpnSpec.includes(':') ? [vpnSpec.split(':')[0], vpnSpec.split(':').slice(1).join(':')] : [vpnSpec, ''];
+    if (provider === 'mullvad') {
+        // Mullvad supports split tunneling natively via `mullvad-exclude`
+        // OR we can use its SOCKS5 proxy (10.64.0.1:1080) when connected
+        // Best approach: use mullvad split-tunnel + namespace for full isolation
+        const relayCmd = param ? `mullvad relay set location ${param} 2>/dev/null;` : '';
+        // Check if mullvad is already connected; if not, connect (split-tunnel safe)
+        return `${relayCmd} mullvad status | grep -q Connected || mullvad connect 2>/dev/null; sleep 1; ` +
+            // Create netns, veth pair, route traffic through mullvad's tun
+            `ip netns add ${ns} 2>/dev/null; ` +
+            `ip link add veth-${ns} type veth peer name veth-${ns}-ns; ` +
+            `ip link set veth-${ns}-ns netns ${ns}; ` +
+            `ip addr add 172.30.${Math.floor(Math.random() * 254) + 1}.1/30 dev veth-${ns}; ` +
+            `ip link set veth-${ns} up; ` +
+            `ip netns exec ${ns} ip addr add 172.30.${Math.floor(Math.random() * 254) + 1}.2/30 dev veth-${ns}-ns; ` +
+            `ip netns exec ${ns} ip link set veth-${ns}-ns up; ` +
+            `ip netns exec ${ns} ip link set lo up; ` +
+            // Use mullvad SOCKS proxy for the namespace (simpler, no route table manipulation)
+            `ip netns exec ${ns} bash -c 'export ALL_PROXY=socks5://10.64.0.1:1080; ${escaped}'; ` +
+            `_rc=$?; ip netns del ${ns} 2>/dev/null; ip link del veth-${ns} 2>/dev/null; exit $_rc`;
+    }
+    if (provider === 'openvpn') {
+        const configPath = param || '/etc/openvpn/client.conf';
+        // Run OpenVPN inside a network namespace — only the command sees the tunnel
+        return `ip netns add ${ns} 2>/dev/null; ` +
+            `ip netns exec ${ns} ip link set lo up; ` +
+            `ip netns exec ${ns} openvpn --config "${configPath}" --daemon --log /tmp/${ns}.log --writepid /tmp/${ns}.pid; ` +
+            `sleep 4; ` + // wait for tunnel
+            `ip netns exec ${ns} bash -c '${escaped}'; ` +
+            `_rc=$?; kill $(cat /tmp/${ns}.pid 2>/dev/null) 2>/dev/null; ip netns del ${ns} 2>/dev/null; rm -f /tmp/${ns}.log /tmp/${ns}.pid; exit $_rc`;
+    }
+    if (provider === 'wg' || provider === 'wireguard') {
+        const iface = param || 'wg-vpn';
+        // Move WireGuard VPN interface into namespace — mesh wg0 stays in main ns
+        return `ip netns add ${ns} 2>/dev/null; ` +
+            `ip link add ${iface}-${ns} type wireguard; ` +
+            `wg setconf ${iface}-${ns} /etc/wireguard/${iface}.conf 2>/dev/null; ` +
+            `ip link set ${iface}-${ns} netns ${ns}; ` +
+            `ip netns exec ${ns} ip link set lo up; ` +
+            `ip netns exec ${ns} ip addr add 10.66.0.2/32 dev ${iface}-${ns}; ` +
+            `ip netns exec ${ns} ip link set ${iface}-${ns} up; ` +
+            `ip netns exec ${ns} ip route add default dev ${iface}-${ns}; ` +
+            `ip netns exec ${ns} bash -c '${escaped}'; ` +
+            `_rc=$?; ip netns del ${ns} 2>/dev/null; exit $_rc`;
+    }
+    // Fallback: just run the command (no VPN wrapping)
+    return innerCmd;
+}
 // -- Agentic state -- shared across tool calls in the same MCP session --------
 const resultStore = new Map(); // key -> value store for chaining
+const bgTasks = new Map();
+function bgId() { return `bg-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 6)}`; }
+function dispatchBg(node, label, fn) {
+    const id = bgId();
+    const task = { id, node, label, startedAt: Date.now(), promise: fn() };
+    task.promise.then((r) => { task.result = r; });
+    bgTasks.set(id, task);
+    return okBrief(`BACKGROUND ${id} dispatched on ${node}: ${label}`);
+}
 // -----------------------------------------------------------------------------
 export function createOmniWireServer(manager, transfer) {
     const server = new McpServer({
         name: 'omniwire',
-        version: '2.5.0',
+        version: '2.6.0',
     });
+    // -- Auto-inject `background` param into every tool -------------------------
+    const origTool = server.tool.bind(server);
+    server.tool = (name, desc, schema, handler) => {
+        // Skip bg meta-tool itself
+        if (name === 'omniwire_bg')
+            return origTool(name, desc, schema, handler);
+        const augSchema = { ...schema, background: z.boolean().optional().describe('Run in background. Returns task ID immediately — poll with omniwire_bg.') };
+        const wrappedHandler = async (args) => {
+            if (args.background) {
+                const lbl = args.label ?? args.command?.slice(0, 60) ?? name;
+                const nd = args.node ?? args.src_node ?? 'omniwire';
+                return dispatchBg(nd, lbl, () => handler(args));
+            }
+            return handler(args);
+        };
+        return origTool(name, desc, augSchema, wrappedHandler);
+    };
+    // ---------------------------------------------------------------------------
     const shells = new ShellManager(manager);
     const realtime = new RealtimeChannel(manager);
     const tunnels = new TunnelManager(manager);
+    // --- Tool 0: omniwire_bg (background task manager) ---
+    origTool('omniwire_bg', 'Poll, list, or retrieve results from background tasks dispatched with background=true on any tool.', {
+        action: z.enum(['list', 'poll', 'result']).describe('list=show all tasks, poll=check if done, result=get output'),
+        task_id: z.string().optional().describe('Task ID (required for poll/result)'),
+    }, async ({ action, task_id }) => {
+        if (action === 'list') {
+            if (bgTasks.size === 0)
+                return okBrief('No background tasks.');
+            const lines = [...bgTasks.values()].map((bg) => {
+                const status = bg.result ? 'DONE' : 'RUNNING';
+                const elapsed = Date.now() - bg.startedAt;
+                return `${bg.id}  ${status}  ${bg.node}  ${t(elapsed)}  ${bg.label}`;
+            });
+            return okBrief(lines.join('\n'));
+        }
+        if (!task_id)
+            return fail('task_id required for poll/result');
+        const task = bgTasks.get(task_id);
+        if (!task)
+            return fail(`task ${task_id} not found`);
+        if (action === 'poll') {
+            const status = task.result ? 'DONE' : 'RUNNING';
+            const elapsed = Date.now() - task.startedAt;
+            return okBrief(`${task_id} ${status} (${t(elapsed)}) ${task.label}`);
+        }
+        if (action === 'result') {
+            if (!task.result)
+                return okBrief(`${task_id} still RUNNING (${t(Date.now() - task.startedAt)})`);
+            return task.result;
+        }
+        return fail('invalid action');
+    });
     // --- Tool 1: omniwire_exec ---
-    server.tool('omniwire_exec', 'Execute a command on a mesh node. Supports retry, assertions, JSON output, and result storage for agentic chaining.', {
+    server.tool('omniwire_exec', 'Execute a command on a mesh node. Set background=true for async. Set via_vpn to route through VPN (Mullvad/OpenVPN/WireGuard) for anonymous scanning. Supports retry, assert, JSON, store_as, {{key}}.', {
         node: z.string().optional().describe('Target node id (windows, contabo, hostinger, thinkpad). Auto-selects if omitted.'),
         command: z.string().optional().describe('Shell command to run. Use {{key}} to interpolate stored results from previous calls.'),
         timeout: z.number().optional().describe('Timeout in seconds (default 30)'),
@@ -83,7 +197,8 @@ export function createOmniWireServer(manager, transfer) {
         retry: z.number().optional().describe('Retry N times on failure (with 1s delay between). Default 0.'),
         assert: z.string().optional().describe('Grep pattern to assert in stdout. If not found, returns error. Use for validation in agentic chains.'),
         store_as: z.string().optional().describe('Store trimmed stdout under this key. Retrieve in subsequent calls via {{key}} in command.'),
-    }, async ({ node, command, timeout, script, label, format, retry, assert: assertPattern, store_as }) => {
+        via_vpn: z.string().optional().describe('Route command through VPN. Values: "mullvad" (auto), "mullvad:se" (country), "openvpn:/path/to.conf", "wg:wg-vpn". Connects VPN before exec, verifies IP changed.'),
+    }, async ({ node, command, timeout, script, label, format, retry, assert: assertPattern, store_as, via_vpn }) => {
         if (!command && !script) {
             return fail('either command or script is required');
         }
@@ -91,7 +206,6 @@ export function createOmniWireServer(manager, transfer) {
         const timeoutSec = timeout ?? 30;
         const maxRetries = retry ?? 0;
         const useJson = format === 'json';
-        // Interpolate stored results: {{key}} -> value
         let resolvedCmd = command;
         if (resolvedCmd) {
             resolvedCmd = resolvedCmd.replace(/\{\{(\w+)\}\}/g, (_, key) => resultStore.get(key) ?? `{{${key}}}`);
@@ -106,17 +220,19 @@ export function createOmniWireServer(manager, transfer) {
                 ? `timeout ${timeoutSec} bash -c '${resolvedCmd.replace(/'/g, "'\\''")}'`
                 : resolvedCmd;
         }
-        // Execute with retry
+        // VPN routing: wrap command in network namespace so only THIS command goes through VPN.
+        // The mesh (WireGuard, SSH) stays on the real interface — zero disruption.
+        if (via_vpn) {
+            effectiveCmd = buildVpnWrappedCmd(via_vpn, effectiveCmd);
+        }
         let result = await manager.exec(nodeId, effectiveCmd);
         for (let attempt = 0; attempt < maxRetries && result.code !== 0; attempt++) {
             await new Promise((r) => setTimeout(r, 1000));
             result = await manager.exec(nodeId, effectiveCmd);
         }
-        // Store result if requested
         if (store_as && result.code === 0) {
             resultStore.set(store_as, result.stdout.trim());
         }
-        // Assert pattern in output
         if (assertPattern && result.code === 0) {
             const regex = new RegExp(assertPattern);
             if (!regex.test(result.stdout)) {
@@ -684,7 +800,177 @@ tags: ${meshNode.tags.join(', ')}`;
         const result = await manager.exec(node, cmd);
         return ok(node, result.durationMs, result.code === 0 ? result.stdout : result.stderr, `net ${action}`);
     });
-    // --- Tool 30: omniwire_clipboard ---
+    // --- Tool 30: omniwire_vpn ---
+    server.tool('omniwire_vpn', 'Manage VPN on mesh nodes (Mullvad/OpenVPN/WireGuard). SAFE: uses split-tunneling or network namespaces — mesh connectivity (WireGuard, SSH) is never disrupted. Use via_vpn on omniwire_exec to route individual commands through VPN.', {
+        action: z.enum(['connect', 'disconnect', 'status', 'list', 'ip', 'rotate', 'full-on', 'full-off']).describe('connect=start VPN (split-tunnel, mesh safe), disconnect=stop, status=current state, list=servers/relays, ip=public IP, rotate=new exit, full-on=node-wide VPN with mesh exclusions, full-off=restore default routing'),
+        node: z.string().optional().describe('Node to manage VPN on (default: contabo)'),
+        provider: z.enum(['mullvad', 'openvpn', 'wireguard', 'tailscale']).optional().describe('VPN provider (default: auto-detect)'),
+        server: z.string().optional().describe('Server/relay to connect to. Mullvad: country code (us, de, se) or relay name. OpenVPN: config file path. WireGuard: interface name. Tailscale: exit node hostname.'),
+        config: z.string().optional().describe('OpenVPN config file path (for openvpn provider)'),
+    }, async ({ action, node, provider, server: vpnServer, config }) => {
+        const nodeId = node ?? 'contabo';
+        // Auto-detect provider (prefer mullvad > tailscale > openvpn > wireguard)
+        const detectCmd = 'command -v mullvad >/dev/null && echo mullvad || (command -v tailscale >/dev/null && echo tailscale || (command -v openvpn >/dev/null && echo openvpn || (command -v wg >/dev/null && echo wireguard || echo none)))';
+        const detected = provider ?? (await manager.exec(nodeId, detectCmd)).stdout.trim();
+        if (action === 'ip') {
+            const result = await manager.exec(nodeId, 'curl -s --max-time 5 https://am.i.mullvad.net/json 2>/dev/null || curl -s --max-time 5 https://ipinfo.io/json 2>/dev/null || curl -s --max-time 5 https://ifconfig.me');
+            return ok(nodeId, result.durationMs, result.stdout, 'public IP');
+        }
+        if (detected === 'mullvad') {
+            // Mullvad split-tunnel: excludes mesh interfaces (wg0, tailscale0) from VPN routing.
+            // SSH connections over WireGuard mesh are preserved — only non-mesh traffic goes through Mullvad.
+            const splitSetup = 'mullvad split-tunnel set state on 2>/dev/null; mullvad lan set allow 2>/dev/null;';
+            switch (action) {
+                case 'connect': {
+                    const relay = vpnServer ? `mullvad relay set location ${vpnServer} && ` : '';
+                    const result = await manager.exec(nodeId, `${splitSetup} ${relay}mullvad connect && sleep 2 && mullvad status && echo "--- mesh check ---" && ip route get 10.10.0.1 2>/dev/null | head -1`);
+                    return ok(nodeId, result.durationMs, result.stdout, `mullvad connect${vpnServer ? ` ${vpnServer}` : ''}`);
+                }
+                case 'disconnect': {
+                    const result = await manager.exec(nodeId, 'mullvad disconnect && mullvad status');
+                    return ok(nodeId, result.durationMs, result.stdout, 'mullvad disconnect');
+                }
+                case 'status': {
+                    const result = await manager.exec(nodeId, 'mullvad status && echo "---split-tunnel---" && mullvad split-tunnel get 2>/dev/null && echo "---public-ip---" && curl -s --max-time 5 https://am.i.mullvad.net/json 2>/dev/null | grep -E "ip|country|mullvad"');
+                    return ok(nodeId, result.durationMs, result.stdout, 'mullvad status');
+                }
+                case 'list': {
+                    const result = await manager.exec(nodeId, 'mullvad relay list 2>&1 | head -60');
+                    return ok(nodeId, result.durationMs, result.stdout, 'mullvad relays');
+                }
+                case 'rotate': {
+                    const result = await manager.exec(nodeId, `${splitSetup} mullvad disconnect && sleep 1 && mullvad relay set tunnel-protocol wireguard && mullvad connect && sleep 2 && mullvad status && echo "---ip---" && curl -s --max-time 5 https://am.i.mullvad.net/json | grep -E "ip|country|mullvad_exit"`);
+                    return ok(nodeId, result.durationMs, result.stdout, 'mullvad rotate');
+                }
+            }
+        }
+        if (detected === 'openvpn') {
+            const configPath = config ?? vpnServer ?? '/etc/openvpn/client.conf';
+            switch (action) {
+                case 'connect': {
+                    const result = await manager.exec(nodeId, `openvpn --config "${configPath}" --daemon --log /tmp/openvpn.log && sleep 3 && ip addr show tun0 2>/dev/null | grep inet && curl -s --max-time 5 https://ifconfig.me`);
+                    return ok(nodeId, result.durationMs, result.stdout, 'openvpn connect');
+                }
+                case 'disconnect': {
+                    const result = await manager.exec(nodeId, 'pkill openvpn 2>/dev/null; sleep 1; pgrep openvpn >/dev/null && echo "still running" || echo "disconnected"');
+                    return ok(nodeId, result.durationMs, result.stdout, 'openvpn disconnect');
+                }
+                case 'status': {
+                    const result = await manager.exec(nodeId, 'pgrep -a openvpn 2>/dev/null || echo "not running"; ip addr show tun0 2>/dev/null | grep inet || echo "no tunnel"; tail -5 /tmp/openvpn.log 2>/dev/null');
+                    return ok(nodeId, result.durationMs, result.stdout, 'openvpn status');
+                }
+                case 'list': {
+                    const result = await manager.exec(nodeId, 'ls /etc/openvpn/*.conf /etc/openvpn/*.ovpn /etc/openvpn/client/*.conf /etc/openvpn/client/*.ovpn 2>/dev/null || echo "no configs found"');
+                    return ok(nodeId, result.durationMs, result.stdout, 'openvpn configs');
+                }
+                case 'rotate': {
+                    const result = await manager.exec(nodeId, `pkill openvpn 2>/dev/null; sleep 1; openvpn --config "${configPath}" --daemon --log /tmp/openvpn.log && sleep 3 && curl -s --max-time 5 https://ifconfig.me`);
+                    return ok(nodeId, result.durationMs, result.stdout, 'openvpn rotate');
+                }
+            }
+        }
+        if (detected === 'wireguard') {
+            const iface = vpnServer ?? 'wg-vpn';
+            switch (action) {
+                case 'connect': {
+                    const result = await manager.exec(nodeId, `wg-quick up ${iface} 2>&1 && sleep 1 && wg show ${iface} | head -10 && curl -s --max-time 5 https://ifconfig.me`);
+                    return ok(nodeId, result.durationMs, result.stdout, `wg up ${iface}`);
+                }
+                case 'disconnect': {
+                    const result = await manager.exec(nodeId, `wg-quick down ${iface} 2>&1`);
+                    return ok(nodeId, result.durationMs, result.stdout, `wg down ${iface}`);
+                }
+                case 'status': {
+                    const result = await manager.exec(nodeId, 'wg show all 2>/dev/null || echo "no WireGuard interfaces"');
+                    return ok(nodeId, result.durationMs, result.stdout, 'wg status');
+                }
+                case 'list': {
+                    const result = await manager.exec(nodeId, 'ls /etc/wireguard/*.conf 2>/dev/null | sed "s|/etc/wireguard/||;s|\\.conf||" || echo "no configs"');
+                    return ok(nodeId, result.durationMs, result.stdout, 'wg interfaces');
+                }
+                case 'rotate': {
+                    const result = await manager.exec(nodeId, `wg-quick down ${iface} 2>/dev/null; sleep 1; wg-quick up ${iface} 2>&1 && sleep 1 && curl -s --max-time 5 https://ifconfig.me`);
+                    return ok(nodeId, result.durationMs, result.stdout, `wg rotate ${iface}`);
+                }
+            }
+        }
+        if (detected === 'tailscale') {
+            switch (action) {
+                case 'connect': {
+                    const exitNode = vpnServer ? `--exit-node=${vpnServer}` : '';
+                    const result = await manager.exec(nodeId, `tailscale up --accept-routes ${exitNode} 2>&1 && sleep 2 && tailscale status | head -15`);
+                    return ok(nodeId, result.durationMs, result.stdout, `tailscale connect${vpnServer ? ` via ${vpnServer}` : ''}`);
+                }
+                case 'disconnect': {
+                    const result = await manager.exec(nodeId, 'tailscale up --exit-node= 2>&1 && tailscale status | head -5');
+                    return ok(nodeId, result.durationMs, result.stdout, 'tailscale clear exit-node');
+                }
+                case 'status': {
+                    const result = await manager.exec(nodeId, 'tailscale status 2>&1 && echo "---ip---" && tailscale ip -4 2>/dev/null && echo "---exit---" && tailscale exit-node status 2>/dev/null');
+                    return ok(nodeId, result.durationMs, result.stdout, 'tailscale status');
+                }
+                case 'list': {
+                    const result = await manager.exec(nodeId, 'tailscale exit-node list 2>&1 | head -40');
+                    return ok(nodeId, result.durationMs, result.stdout, 'tailscale exit nodes');
+                }
+                case 'rotate': {
+                    const result = await manager.exec(nodeId, `tailscale up --exit-node= 2>/dev/null; sleep 1; ${vpnServer ? `tailscale up --exit-node=${vpnServer}` : 'tailscale up'} 2>&1 && sleep 2 && curl -s --max-time 5 https://ifconfig.me`);
+                    return ok(nodeId, result.durationMs, result.stdout, 'tailscale rotate');
+                }
+                case 'full-on': {
+                    const exitNode = vpnServer ?? '';
+                    if (!exitNode)
+                        return fail('server param required for full-on (tailscale exit node hostname)');
+                    const result = await manager.exec(nodeId, `tailscale up --exit-node=${exitNode} --exit-node-allow-lan-access 2>&1 && sleep 2 && tailscale status | head -10 && echo "---ip---" && curl -s --max-time 5 https://ifconfig.me`);
+                    return ok(nodeId, result.durationMs, result.stdout, `tailscale full-on via ${exitNode}`);
+                }
+                case 'full-off': {
+                    const result = await manager.exec(nodeId, 'tailscale up --exit-node= 2>&1 && tailscale status | head -5');
+                    return ok(nodeId, result.durationMs, result.stdout, 'tailscale full-off');
+                }
+            }
+        }
+        // full-on / full-off: node-wide VPN with mesh route exclusions
+        if (action === 'full-on') {
+            if (detected === 'mullvad') {
+                const relay = vpnServer ? `mullvad relay set location ${vpnServer};` : '';
+                // Mullvad full mode: enable, but add route exclusions for mesh IPs
+                const result = await manager.exec(nodeId, `${relay} mullvad lan set allow; mullvad split-tunnel set state on; mullvad connect && sleep 2 && ` +
+                    // Preserve ALL mesh routes: wg0 (main mesh), wg1 (B2B), tailscale0 (TS networks)
+                    `ip route add 10.10.0.0/24 dev wg0 2>/dev/null; ` + // WG mesh
+                    `ip route add 10.20.0.0/24 dev wg1 2>/dev/null; ` + // WG B2B
+                    `ip route add 100.64.0.0/10 dev tailscale0 2>/dev/null; ` + // Tailscale CGNAT range
+                    `mullvad status && echo "---mesh-check---" && ping -c1 -W2 10.10.0.1 2>/dev/null && echo "mesh: OK" || echo "mesh: WARN"`);
+                return ok(nodeId, result.durationMs, result.stdout, 'mullvad full-on (mesh preserved)');
+            }
+            if (detected === 'openvpn') {
+                const configPath = config ?? vpnServer ?? '/etc/openvpn/client.conf';
+                // OpenVPN with route-nopull + specific routes — keeps mesh alive
+                const result = await manager.exec(nodeId, `openvpn --config "${configPath}" --daemon --log /tmp/openvpn-full.log ` +
+                    `--route-nopull --route 0.0.0.0 0.0.0.0 vpn_gateway ` +
+                    `--route 10.10.0.0 255.255.255.0 net_gateway ` + // wg0 mesh
+                    `--route 10.20.0.0 255.255.255.0 net_gateway ` + // wg1 B2B
+                    `--route 100.64.0.0 255.192.0.0 net_gateway ` + // tailscale CGNAT
+                    `&& sleep 4 && ip addr show tun0 2>/dev/null | grep inet && curl -s --max-time 5 https://ifconfig.me && ` +
+                    `echo "---mesh---" && ping -c1 -W2 10.10.0.1 2>/dev/null && echo "mesh: OK" || echo "mesh: WARN"`);
+                return ok(nodeId, result.durationMs, result.stdout, 'openvpn full-on (mesh preserved)');
+            }
+            return fail(`full-on not supported for ${detected}. Use mullvad, openvpn, or tailscale.`);
+        }
+        if (action === 'full-off') {
+            if (detected === 'mullvad') {
+                const result = await manager.exec(nodeId, 'mullvad disconnect && mullvad status');
+                return ok(nodeId, result.durationMs, result.stdout, 'mullvad full-off');
+            }
+            if (detected === 'openvpn') {
+                const result = await manager.exec(nodeId, 'pkill openvpn 2>/dev/null; sleep 1; echo "disconnected" && curl -s --max-time 5 https://ifconfig.me');
+                return ok(nodeId, result.durationMs, result.stdout, 'openvpn full-off');
+            }
+            return fail(`full-off not supported for ${detected}`);
+        }
+        return fail(`No VPN provider found on ${nodeId}. Install mullvad, tailscale, openvpn, or wireguard.`);
+    });
+    // --- Tool 31: omniwire_clipboard ---
     server.tool('omniwire_clipboard', 'Copy text between nodes via a shared clipboard buffer.', {
         action: z.enum(['copy', 'paste', 'clear']).describe('Action'),
         content: z.string().optional().describe('Text to copy (for copy action)'),