feat(api, web): enhance agent installation process with invited status and policy support

- Updated the agent enrollment process to include an 'invited' status, allowing for better tracking of agent states.
- Implemented support for install links that can now include an `install_link_id`, facilitating the transition from invited to pending status upon enrollment.
- Enhanced the MikroTik installation script to include the `EvofwInstallLinkId` for better tracking and management.
- Added new API endpoints for fetching agent policies and serving MikroTik-specific installation scripts.
- Improved the web UI to reflect the new agent statuses and provide copyable installation commands for agents.

Co-authored-by: Cursor <[email protected]>

apps/api/src/agent-scripts/install.sh

@@ -43,8 +43,13 @@ CLIENT_TOKEN="$(gen_token)"
 HOSTNAME="$(hostname -f 2>/dev/null || hostname)"
 CP_URL="${EVOFW_CP_URL%/}"
 
-ENROLL_BODY=$(printf '{"name":"%s","hostname":"%s","platform":"%s","token":"%s","client_version":"install.sh/1"}' \
-  "$EVOFW_CLIENT_NAME" "$HOSTNAME" "$PLATFORM" "$CLIENT_TOKEN")
+if [[ -n "${EVOFW_INSTALL_LINK_ID:-}" ]]; then
+  ENROLL_BODY=$(printf '{"name":"%s","hostname":"%s","platform":"%s","token":"%s","client_version":"install.sh/1","install_link_id":"%s"}' \
+    "$EVOFW_CLIENT_NAME" "$HOSTNAME" "$PLATFORM" "$CLIENT_TOKEN" "$EVOFW_INSTALL_LINK_ID")
+else
+  ENROLL_BODY=$(printf '{"name":"%s","hostname":"%s","platform":"%s","token":"%s","client_version":"install.sh/1"}' \
+    "$EVOFW_CLIENT_NAME" "$HOSTNAME" "$PLATFORM" "$CLIENT_TOKEN")
+fi
 
 ENROLL_TMP=$(mktemp)
 trap 'rm -f "$ENROLL_TMP"' EXIT

apps/api/src/agent-scripts/mikrotik-install.rsc

@@ -1,46 +1,84 @@
-# EvoFirewall MikroTik install (RouterOS 7+)
-# Usage: import after setting globals, or paste into terminal.
-# Required globals before import (or edit below):
-#   :global EvofwCpUrl "https://fw.example.com"
-#   :global EvofwSeed "YOUR_SEED"
-#   :global EvofwName "mt-01"
+# EvoFirewall MikroTik install (RouterOS 7.21+)
+# Short-link sets EvofwCpUrl / EvofwSeed / EvofwName / EvofwInstallLinkId before body.
+# Legacy: set globals, then /import file-name=mikrotik-install.rsc
+#
+# Blacklist: drop EVOFW_DENY on input+forward
+# Whitelist: accept EVOFW_ALLOW + drop others on forward only (input stays open for Winbox/SSH)
 
 :global EvofwCpUrl
 :global EvofwSeed
 :global EvofwName
+:global EvofwInstallLinkId
 
-:if ([:typeof $EvofwCpUrl] = "nothing") do={ :error "EvofwCpUrl required" }
-:if ([:typeof $EvofwSeed] = "nothing") do={ :error "EvofwSeed required" }
-:if ([:typeof $EvofwName] = "nothing") do={ :set EvofwName [/system identity get name] }
+:if ([:typeof $EvofwCpUrl] = "nothing" || [:len $EvofwCpUrl] = 0) do={ :error "EvofwCpUrl required" }
+:if ([:typeof $EvofwSeed] = "nothing" || [:len $EvofwSeed] = 0) do={ :error "EvofwSeed required" }
+:if ([:typeof $EvofwName] = "nothing" || [:len $EvofwName] = 0) do={ :set EvofwName [/system identity get name] }
 
 :local token ("evofw_" . [/certificate scep-server nonce generate])
 :if ([:len $token] < 20) do={
-  :set token ("evofw_" . [:tostr [/system clock get time]] . [:tostr [/system resource get cpu-load]])
+  :set token ("evofw_" . [:tostr [/system clock get time]] . [:tostr [/system resource get cpu-load]] . [:tostr [/system resource get free-memory]])
 }
 
-:local body ("{\"name\":\"" . $EvofwName . "\",\"hostname\":\"" . [/system identity get name] . "\",\"platform\":\"mikrotik\",\"token\":\"" . $token . "\",\"client_version\":\"rsc/1\"}")
+:local body ("{\"name\":\"" . $EvofwName . "\",\"hostname\":\"" . [/system identity get name] . "\",\"platform\":\"mikrotik\",\"token\":\"" . $token . "\",\"client_version\":\"rsc/1\"")
+:if ([:typeof $EvofwInstallLinkId] != "nothing" && [:len $EvofwInstallLinkId] > 0) do={
+  :set body ($body . ",\"install_link_id\":\"" . $EvofwInstallLinkId . "\"")
+}
+:set body ($body . "}")
 
-/tool fetch url=($EvofwCpUrl . "/v1/agent/enroll") http-method=post http-header-field=("Content-Type: application/json,X-EvoFW-Seed: " . $EvofwSeed) http-data=$body keep-result=no
+:do {
+  /tool fetch url=($EvofwCpUrl . "/v1/agent/enroll") http-method=post http-header-field=("Content-Type: application/json,X-EvoFW-Seed: " . $EvofwSeed) http-data=$body keep-result=no
+} on-error={
+  :error "evofw: enroll failed — check EvofwCpUrl / EvofwSeed / connectivity"
+}
 
-# Persist credentials for scheduler script
-/system script remove [find name="evofw-env"]
-/system script add name=evofw-env source=(" :global EvofwCpUrl \"" . $EvofwCpUrl . "\"; :global EvofwToken \"" . $token . "\" ")
+# Persist credentials
+:do { /system script remove [find name="evofw-env"] } on-error={}
+/system script add name=evofw-env policy=read,write,policy,test source=(" :global EvofwCpUrl \"" . $EvofwCpUrl . "\"; :global EvofwToken \"" . $token . "\" ")
 
-/system script remove [find name="evofw-sync"]
+# Filter rules (idempotent by comment)
+:do { /ip firewall filter remove [find comment~"^evofw-"] } on-error={}
+
+/ip firewall filter add chain=input action=drop src-address-list=EVOFW_DENY comment=evofw-bl-drop-input disabled=no
+/ip firewall filter add chain=forward action=drop src-address-list=EVOFW_DENY comment=evofw-bl-drop-forward disabled=no
+/ip firewall filter add chain=forward action=accept src-address-list=EVOFW_ALLOW comment=evofw-wl-accept-forward disabled=yes
+/ip firewall filter add chain=forward action=drop comment=evofw-wl-drop-forward disabled=yes
+
+# Sync: fetch policy.rsc → import address-lists + toggle mode
+:do { /system script remove [find name="evofw-sync"] } on-error={}
 /system script add name=evofw-sync policy=read,write,policy,test source={
   :global EvofwCpUrl
   :global EvofwToken
-  :if ([:typeof $EvofwCpUrl] = "nothing" || [:typeof $EvofwToken] = "nothing") do={ /system script run evofw-env }
-  :local tmp [/file get [find name="evofw-policy.json"] name]
-  /tool fetch url=($EvofwCpUrl . "/v1/agent/policy") http-header-field=("Authorization: Bearer " . $EvofwToken) dst-path=evofw-policy.json
-  # Address-lists: EVOFW_DENY / EVOFW_ALLOW — operator should map filter rules once:
-  # /ip firewall filter add chain=input src-address-list=EVOFW_DENY action=drop comment=evofw
-  # whitelist: policy drop + accept EVOFW_ALLOW
-  :log info "evofw: policy fetched — apply address-lists via controller export or manual parse"
-  /tool fetch url=($EvofwCpUrl . "/v1/agent/heartbeat") http-method=post http-header-field=("Authorization: Bearer " . $EvofwToken . ",Content-Type: application/json") http-data="{\"source\":\"mikrotik\"}" keep-result=no
+  :if ([:typeof $EvofwCpUrl] = "nothing" || [:typeof $EvofwToken] = "nothing") do={
+    /system script run evofw-env
+  }
+  :if ([:typeof $EvofwCpUrl] = "nothing" || [:typeof $EvofwToken] = "nothing") do={
+    :log error "evofw: missing EvofwCpUrl/EvofwToken"
+    :error "evofw env missing"
+  }
+  :do {
+    /tool fetch url=($EvofwCpUrl . "/v1/agent/policy.rsc") http-header-field=("Authorization: Bearer " . $EvofwToken) dst-path=evofw-policy.rsc
+    /import file-name=evofw-policy.rsc
+  } on-error={
+    :log warning "evofw: policy sync failed (pending approval or network)"
+  }
+  :local denyCnt [:len [/ip firewall address-list find list=EVOFW_DENY]]
+  :local allowCnt [:len [/ip firewall address-list find list=EVOFW_ALLOW]]
+  :local cnt ($denyCnt + $allowCnt)
+  :local report ("{\"status\":\"ok\",\"prefix_count\":" . $cnt . ",\"kernel_method\":\"address-list\",\"source\":\"mikrotik\"}")
+  :do {
+    /tool fetch url=($EvofwCpUrl . "/v1/agent/apply-report") http-method=post http-header-field=("Authorization: Bearer " . $EvofwToken . ",Content-Type: application/json") http-data=$report keep-result=no
+  } on-error={}
+  :do {
+    /tool fetch url=($EvofwCpUrl . "/v1/agent/heartbeat") http-method=post http-header-field=("Authorization: Bearer " . $EvofwToken . ",Content-Type: application/json") http-data="{\"source\":\"mikrotik\"}" keep-result=no
+  } on-error={}
+  :log info ("evofw: sync done deny=" . $denyCnt . " allow=" . $allowCnt)
 }
 
-/system scheduler remove [find name="evofw-sync"]
-/system scheduler add name=evofw-sync interval=1m on-event=evofw-sync
+:do { /system scheduler remove [find name="evofw-sync"] } on-error={}
+/system scheduler add name=evofw-sync interval=1m on-event=evofw-sync policy=read,write,policy,test
 
-:put ("EvoFirewall enrolled as " . $EvofwName . " — approve in UI, ensure filter rules for EVOFW_* lists")
+:do { /system script run evofw-sync } on-error={
+  :log info "evofw: initial sync skipped (approve agent in UI)"
+}
+
+:put ("EvoFirewall enrolled as " . $EvofwName . " — approve in UI; scheduler evofw-sync every 1m")

apps/api/src/app.ts

@@ -19,7 +19,7 @@ import { refreshAllLists } from './services/lists/refresh.js'
 import { repos } from '@evofw/db'
 import {
   isValidInstallSlug,
-  resolveAndRenderInstallScript,
+  resolveAndRenderInstall,
 } from './services/install-links.js'
 
 export interface BuildAppOptions {
@@ -85,13 +85,13 @@ export async function buildApp(opts: BuildAppOptions = {}) {
     ) {
       const link = repos.getInstallLinkBySlug(app.db, segment)
       if (link) {
-        const script = resolveAndRenderInstallScript(
+        const { body, contentType } = resolveAndRenderInstall(
           app.db,
           link,
           config.publicBaseUrl,
           config.enrollSeed,
         )
-        return reply.type('text/x-shellscript').send(script)
+        return reply.type(contentType).send(body)
       }
     }
 

apps/api/src/plugins/auth.ts

@@ -58,6 +58,7 @@ function isAgentPath(url: string): boolean {
   const path = url.split('?')[0] ?? url
   return (
     path === '/v1/agent/policy' ||
+    path === '/v1/agent/policy.rsc' ||
     path === '/v1/agent/apply-report' ||
     path === '/v1/agent/heartbeat'
   )

apps/api/src/routes/agent.ts

@@ -7,8 +7,9 @@ import { enrollBodySchema, applyReportBodySchema } from '@evofw/shared'
 import type { AppConfig } from '../config.js'
 import { hashToken } from '../plugins/auth.js'
 import { evaluateAgentPolicy } from '../services/policy/evaluate.js'
+import { renderMikrotikPolicyRsc } from '../services/policy/mikrotik-rsc.js'
 import { AppError } from '../plugins/error-handler.js'
-import { resolveAndRenderInstallScript } from '../services/install-links.js'
+import { resolveAndRenderInstall } from '../services/install-links.js'
 
 const __dirname = dirname(fileURLToPath(import.meta.url))
 const scriptsDir = join(__dirname, '../agent-scripts')
@@ -29,13 +30,13 @@ export const agentRoutes: FastifyPluginAsync<{ config: AppConfig }> = async (
     async (req, reply) => {
       const link = repos.getInstallLink(app.db, req.params.id)
       if (!link) throw new AppError('NOT_FOUND', 'Install link not found', 404)
-      const script = resolveAndRenderInstallScript(
+      const { body, contentType } = resolveAndRenderInstall(
         app.db,
         link,
         config.publicBaseUrl,
         config.enrollSeed,
       )
-      return reply.type('text/x-shellscript').send(script)
+      return reply.type(contentType).send(body)
     },
   )
 
@@ -60,12 +61,52 @@ export const agentRoutes: FastifyPluginAsync<{ config: AppConfig }> = async (
       throw new AppError('UNAUTHORIZED', 'Invalid enroll seed', 401)
     }
     const body = enrollBodySchema.parse(req.body)
-    const id = crypto.randomUUID()
     const tokenHash = hashToken(body.token)
-    const existing = repos.getAgentByTokenHash(app.db, tokenHash)
-    if (existing) {
+    const existingByToken = repos.getAgentByTokenHash(app.db, tokenHash)
+    if (existingByToken) {
       throw new AppError('CONFLICT', 'Token already enrolled', 409)
     }
+
+    if (body.install_link_id) {
+      const link = repos.getInstallLink(app.db, body.install_link_id)
+      if (!link) {
+        throw new AppError('NOT_FOUND', 'Install link not found', 404)
+      }
+      if (link.revokedAt) {
+        throw new AppError('GONE', 'Install link revoked', 410)
+      }
+      if (!link.agentId) {
+        throw new AppError('CONFLICT', 'Install link has no agent', 409)
+      }
+      const invited = repos.getAgent(app.db, link.agentId)
+      if (!invited) {
+        throw new AppError('NOT_FOUND', 'Agent not found', 404)
+      }
+      if (invited.status !== 'invited' && invited.status !== 'pending') {
+        throw new AppError(
+          'CONFLICT',
+          `Agent status is ${invited.status}`,
+          409,
+        )
+      }
+      const agent = repos.updateAgent(app.db, invited.id, {
+        name: body.name,
+        hostname: body.hostname ?? null,
+        platform: body.platform ?? invited.platform,
+        tokenPrefix: body.token.slice(0, 12),
+        tokenHash,
+        status: 'pending',
+        clientVersion: body.client_version ?? null,
+      })
+      return reply.code(201).send({
+        client_id: agent!.id,
+        id: agent!.id,
+        status: agent!.status,
+        name: agent!.name,
+      })
+    }
+
+    const id = crypto.randomUUID()
     const agent = repos.insertAgent(app.db, {
       id,
       name: body.name,
@@ -114,6 +155,16 @@ export const agentRoutes: FastifyPluginAsync<{ config: AppConfig }> = async (
     }
   })
 
+  app.get('/v1/agent/policy.rsc', async (req, reply) => {
+    const agentId = req.agentId!
+    const policy = evaluateAgentPolicy(app.db, agentId)
+    repos.updateAgent(app.db, agentId, {
+      lastSeenAt: new Date().toISOString(),
+      lastSeenIp: req.ip,
+    })
+    return reply.type('text/plain').send(renderMikrotikPolicyRsc(policy))
+  })
+
   app.post('/v1/agent/apply-report', async (req) => {
     const agentId = req.agentId!
     const body = applyReportBodySchema.parse(req.body)

apps/api/src/routes/control.ts

@@ -29,10 +29,15 @@ import {
 import {
   mapInstallLink,
   randomToken,
+  buildInstallUrls,
 } from '../services/install-links.js'
+import { hashToken } from '../plugins/auth.js'
 import type { AppConfig } from '../config.js'
 
-function mapAgent(a: NonNullable<ReturnType<typeof repos.getAgent>>) {
+function mapAgent(
+  a: NonNullable<ReturnType<typeof repos.getAgent>>,
+  opts?: { installCurl?: string | null; installLinkId?: string | null },
+) {
   return {
     id: a.id,
     name: a.name,
@@ -55,6 +60,8 @@ function mapAgent(a: NonNullable<ReturnType<typeof repos.getAgent>>) {
     created_at: a.createdAt,
     approved_at: a.approvedAt,
     revoked_at: a.revokedAt,
+    install_curl: opts?.installCurl ?? null,
+    install_link_id: opts?.installLinkId ?? null,
   }
 }
 
@@ -148,20 +155,49 @@ export const controlRoutes: FastifyPluginAsync<{ config: AppConfig }> = async (
 
   app.post('/install-links', async (req, reply) => {
     const body = createInstallLinkBodySchema.parse(req.body)
-    const id = randomToken(10)
+    const linkId = randomToken(10)
     const slug = randomToken(16)
-    if (repos.getInstallLink(app.db, id) || repos.getInstallLinkBySlug(app.db, slug)) {
+    if (
+      repos.getInstallLink(app.db, linkId) ||
+      repos.getInstallLinkBySlug(app.db, slug)
+    ) {
       throw new AppError('CONFLICT', 'Retry create (id collision)', 409)
     }
-    const row = repos.insertInstallLink(app.db, {
-      id,
-      slug,
-      clientName: body.name.trim(),
-      platform: body.platform ?? 'linux',
-      createdAt: new Date().toISOString(),
-      useCount: 0,
-    })
-    return reply.code(201).send(mapInstallLink(row!, config.publicBaseUrl))
+
+    const agentId = crypto.randomUUID()
+    const inviteToken = `invite:${agentId}`
+    const now = new Date().toISOString()
+    const name = body.name.trim()
+    const platform = body.platform ?? 'linux'
+
+    app.sqlite.transaction(() => {
+      repos.insertAgent(app.db, {
+        id: agentId,
+        name,
+        hostname: null,
+        platform,
+        tokenPrefix: inviteToken.slice(0, 12),
+        tokenHash: hashToken(inviteToken),
+        status: 'invited',
+        policyMode: 'blacklist',
+        policyGeneration: 1,
+        clientVersion: null,
+        settingsJson: '{}',
+        createdAt: now,
+      })
+      repos.insertInstallLink(app.db, {
+        id: linkId,
+        slug,
+        clientName: name,
+        platform,
+        agentId,
+        createdAt: now,
+        useCount: 0,
+      })
+    })()
+
+    const row = repos.getInstallLink(app.db, linkId)!
+    return reply.code(201).send(mapInstallLink(row, config.publicBaseUrl))
   })
 
   app.delete<{ Params: { id: string } }>(
@@ -175,9 +211,27 @@ export const controlRoutes: FastifyPluginAsync<{ config: AppConfig }> = async (
   )
 
   // Agents
-  app.get('/agents', async () => ({
-    items: repos.listAgents(app.db).map(mapAgent),
-  }))
+  app.get('/agents', async () => {
+    const all = repos.listAgents(app.db)
+    return {
+      items: all.map((a) => {
+        const link = repos.getInstallLinkByAgentId(app.db, a.id)
+        if (!link || link.revokedAt) {
+          return mapAgent(a)
+        }
+        const urls = buildInstallUrls(
+          config.publicBaseUrl,
+          link.id,
+          link.slug,
+          link.platform === 'mikrotik' ? 'mikrotik' : 'linux',
+        )
+        return mapAgent(a, {
+          installCurl: urls.curl.by_slug,
+          installLinkId: link.id,
+        })
+      }),
+    }
+  })
 
   app.get<{ Params: { id: string } }>('/agents/:id', async (req) => {
     const a = repos.getAgent(app.db, req.params.id)

apps/api/src/services/install-links.test.ts

@@ -24,7 +24,7 @@ describe('install-links', () => {
     await app.close()
   })
 
-  it('creates link and serves scripts by id and slug', async () => {
+  it('creates invited agent and serves scripts by id and slug', async () => {
     const app = await appPromise
     await app.ready()
 
@@ -37,12 +37,27 @@ describe('install-links', () => {
     const body = created.json() as {
       id: string
       slug: string
+      agent_id: string
       curl: { by_id: string; by_slug: string }
     }
     expect(body.id).toBeTruthy()
     expect(body.slug).toBeTruthy()
+    expect(body.agent_id).toBeTruthy()
     expect(body.curl.by_id).toContain(`/agent-install/${body.id}`)
 
+    const agents = await app.inject({ method: 'GET', url: '/api/v1/agents' })
+    expect(agents.statusCode).toBe(200)
+    const list = agents.json() as {
+      items: {
+        id: string
+        status: string
+        install_curl?: string | null
+      }[]
+    }
+    const invited = list.items.find((a) => a.id === body.agent_id)
+    expect(invited?.status).toBe('invited')
+    expect(invited?.install_curl).toContain(body.slug)
+
     const byId = await app.inject({
       method: 'GET',
       url: `/agent-install/${body.id}`,
@@ -50,7 +65,7 @@ describe('install-links', () => {
     expect(byId.statusCode).toBe(200)
     expect(byId.headers['content-type']).toContain('text/x-shellscript')
     expect(byId.body).toContain("EVOFW_CLIENT_NAME='web-01'")
-    expect(byId.body).toContain("EVOFW_SEED='test-seed'")
+    expect(byId.body).toContain(`EVOFW_INSTALL_LINK_ID='${body.id}'`)
 
     const bySlug = await app.inject({
       method: 'GET',
@@ -59,4 +74,125 @@ describe('install-links', () => {
     expect(bySlug.statusCode).toBe(200)
     expect(bySlug.body).toContain("EVOFW_CP_URL='https://fw.example.com'")
   })
+
+  it('enroll with install_link_id updates invited agent to pending', async () => {
+    const app = await appPromise
+    await app.ready()
+
+    const created = await app.inject({
+      method: 'POST',
+      url: '/api/v1/install-links',
+      payload: { name: 'web-02', platform: 'linux' },
+    })
+    const link = created.json() as { id: string; agent_id: string }
+
+    const enroll = await app.inject({
+      method: 'POST',
+      url: '/v1/agent/enroll',
+      headers: {
+        'content-type': 'application/json',
+        'x-evofw-seed': 'test-seed',
+      },
+      payload: {
+        name: 'web-02',
+        hostname: 'host-02',
+        platform: 'linux',
+        token: 'evofw_test_token_1234567890abcd',
+        install_link_id: link.id,
+      },
+    })
+    expect(enroll.statusCode).toBe(201)
+    const enrolled = enroll.json() as { id: string; status: string }
+    expect(enrolled.id).toBe(link.agent_id)
+    expect(enrolled.status).toBe('pending')
+
+    const agents = await app.inject({ method: 'GET', url: '/api/v1/agents' })
+    const list = agents.json() as { items: { id: string; status: string }[] }
+    const row = list.items.find((a) => a.id === link.agent_id)
+    expect(row?.status).toBe('pending')
+  })
+
+  it('mikrotik install link serves RSC and fetch/import one-liner', async () => {
+    const app = await appPromise
+    await app.ready()
+
+    const created = await app.inject({
+      method: 'POST',
+      url: '/api/v1/install-links',
+      payload: { name: 'mt-01', platform: 'mikrotik' },
+    })
+    expect(created.statusCode).toBe(201)
+    const body = created.json() as {
+      id: string
+      slug: string
+      agent_id: string
+      curl: { by_id: string; by_slug: string }
+    }
+    expect(body.curl.by_id).toContain('/tool fetch url=')
+    expect(body.curl.by_id).toContain('/import file-name=evofw-install.rsc')
+    expect(body.curl.by_id).not.toContain('| bash')
+
+    const byId = await app.inject({
+      method: 'GET',
+      url: `/agent-install/${body.id}`,
+    })
+    expect(byId.statusCode).toBe(200)
+    expect(byId.headers['content-type']).toContain('text/plain')
+    expect(byId.body).toContain(':global EvofwCpUrl "https://fw.example.com"')
+    expect(byId.body).toContain(`:global EvofwInstallLinkId "${body.id}"`)
+    expect(byId.body).toContain('evofw-bl-drop-input')
+    expect(byId.body).toContain('/v1/agent/policy.rsc')
+  })
+
+  it('approved agent can fetch policy.rsc with address-list commands', async () => {
+    const app = await appPromise
+    await app.ready()
+
+    const created = await app.inject({
+      method: 'POST',
+      url: '/api/v1/install-links',
+      payload: { name: 'mt-policy', platform: 'mikrotik' },
+    })
+    const link = created.json() as { id: string; agent_id: string }
+    const token = 'evofw_mt_policy_token_abcdefghij'
+
+    const enroll = await app.inject({
+      method: 'POST',
+      url: '/v1/agent/enroll',
+      headers: {
+        'content-type': 'application/json',
+        'x-evofw-seed': 'test-seed',
+      },
+      payload: {
+        name: 'mt-policy',
+        platform: 'mikrotik',
+        token,
+        install_link_id: link.id,
+      },
+    })
+    expect(enroll.statusCode).toBe(201)
+
+    await app.inject({
+      method: 'POST',
+      url: `/api/v1/agents/${link.agent_id}/approve`,
+    })
+
+    // add a deny override so policy has a CIDR
+    await app.inject({
+      method: 'POST',
+      url: `/api/v1/agents/${link.agent_id}/overrides`,
+      payload: { action: 'deny', cidr: '203.0.113.0/24' },
+    })
+
+    const rsc = await app.inject({
+      method: 'GET',
+      url: '/v1/agent/policy.rsc',
+      headers: { authorization: `Bearer ${token}` },
+    })
+    expect(rsc.statusCode).toBe(200)
+    expect(rsc.headers['content-type']).toContain('text/plain')
+    expect(rsc.body).toContain('address-list')
+    expect(rsc.body).toContain('EVOFW_DENY')
+    expect(rsc.body).toContain('203.0.113.0/24')
+  })
 })

apps/api/src/services/install-links.ts

@@ -42,10 +42,31 @@ export function isValidInstallSlug(segment: string): boolean {
   return SLUG_RE.test(segment)
 }
 
-export function buildInstallUrls(baseUrl: string, id: string, slug: string) {
+export type InstallPlatform = 'linux' | 'mikrotik'
+
+function mikrotikFetchImport(url: string): string {
+  return `/tool fetch url="${url}" dst-path=evofw-install.rsc; /import file-name=evofw-install.rsc`
+}
+
+export function buildInstallUrls(
+  baseUrl: string,
+  id: string,
+  slug: string,
+  platform: InstallPlatform = 'linux',
+) {
   const base = baseUrl.replace(/\/$/, '')
   const byId = `${base}/agent-install/${id}`
   const bySlug = `${base}/${slug}`
+  if (platform === 'mikrotik') {
+    return {
+      by_id: byId,
+      by_slug: bySlug,
+      curl: {
+        by_id: mikrotikFetchImport(byId),
+        by_slug: mikrotikFetchImport(bySlug),
+      },
+    }
+  }
   return {
     by_id: byId,
     by_slug: bySlug,
@@ -60,12 +81,14 @@ export function mapInstallLink(
   row: NonNullable<ReturnType<typeof repos.getInstallLink>>,
   baseUrl: string,
 ) {
-  const urls = buildInstallUrls(baseUrl, row.id, row.slug)
+  const platform = (row.platform === 'mikrotik' ? 'mikrotik' : 'linux') as InstallPlatform
+  const urls = buildInstallUrls(baseUrl, row.id, row.slug, platform)
   return {
     id: row.id,
     slug: row.slug,
     client_name: row.clientName,
-    platform: row.platform as 'linux' | 'mikrotik',
+    platform,
+    agent_id: row.agentId ?? null,
     created_at: row.createdAt,
     revoked_at: row.revokedAt,
     last_used_at: row.lastUsedAt,
@@ -79,6 +102,14 @@ function loadInstallSh(): string {
   return readFileSync(join(scriptsDir, 'install.sh'), 'utf-8')
 }
 
+function loadMikrotikInstallRsc(): string {
+  return readFileSync(join(scriptsDir, 'mikrotik-install.rsc'), 'utf-8')
+}
+
+function escapeRosString(s: string): string {
+  return s.replace(/\\/g, '\\\\').replace(/"/g, '\\"')
+}
+
 /**
  * Self-contained install script: env exports + full install.sh body.
  */
@@ -87,6 +118,7 @@ export function renderInstallScript(opts: {
   seed: string
   clientName: string
   platform: string
+  installLinkId: string
 }): string {
   const cp = opts.cpUrl.replace(/\/$/, '')
   const escape = (s: string) => s.replace(/'/g, `'\\''`)
@@ -98,6 +130,7 @@ export function renderInstallScript(opts: {
     `export EVOFW_SEED='${escape(opts.seed)}'`,
     `export EVOFW_CLIENT_NAME='${escape(opts.clientName)}'`,
     `export EVOFW_PLATFORM='${escape(opts.platform)}'`,
+    `export EVOFW_INSTALL_LINK_ID='${escape(opts.installLinkId)}'`,
     '',
   ].join('\n')
 
@@ -106,22 +139,73 @@ export function renderInstallScript(opts: {
   return `${header}${body}`
 }
 
+/**
+ * Personalized MikroTik RSC: globals + mikrotik-install.rsc body.
+ */
+export function renderMikrotikInstallScript(opts: {
+  cpUrl: string
+  seed: string
+  clientName: string
+  installLinkId: string
+}): string {
+  const cp = opts.cpUrl.replace(/\/$/, '')
+  const header = [
+    '# EvoFirewall short install link — globals pre-set (RouterOS 7.21+)',
+    `:global EvofwCpUrl "${escapeRosString(cp)}"`,
+    `:global EvofwSeed "${escapeRosString(opts.seed)}"`,
+    `:global EvofwName "${escapeRosString(opts.clientName)}"`,
+    `:global EvofwInstallLinkId "${escapeRosString(opts.installLinkId)}"`,
+    '',
+  ].join('\n')
+  return `${header}${loadMikrotikInstallRsc()}`
+}
+
+export type ResolvedInstall = {
+  body: string
+  contentType: string
+}
+
+/** @deprecated use resolveAndRenderInstall */
 export function resolveAndRenderInstallScript(
   db: Db,
   link: NonNullable<ReturnType<typeof repos.getInstallLink>>,
   publicBaseUrl: string,
   enrollSeedFallback: string,
 ): string {
+  return resolveAndRenderInstall(db, link, publicBaseUrl, enrollSeedFallback)
+    .body
+}
+
+export function resolveAndRenderInstall(
+  db: Db,
+  link: NonNullable<ReturnType<typeof repos.getInstallLink>>,
+  publicBaseUrl: string,
+  enrollSeedFallback: string,
+): ResolvedInstall {
   if (link.revokedAt) {
     throw new AppError('GONE', 'Install link revoked', 410)
   }
-  const seed =
-    repos.getSetting(db, 'enroll_seed') || enrollSeedFallback
+  const seed = repos.getSetting(db, 'enroll_seed') || enrollSeedFallback
   repos.touchInstallLink(db, link.id)
-  return renderInstallScript({
-    cpUrl: publicBaseUrl,
-    seed,
-    clientName: link.clientName,
-    platform: link.platform,
-  })
+  if (link.platform === 'mikrotik') {
+    return {
+      body: renderMikrotikInstallScript({
+        cpUrl: publicBaseUrl,
+        seed,
+        clientName: link.clientName,
+        installLinkId: link.id,
+      }),
+      contentType: 'text/plain',
+    }
+  }
+  return {
+    body: renderInstallScript({
+      cpUrl: publicBaseUrl,
+      seed,
+      clientName: link.clientName,
+      platform: link.platform,
+      installLinkId: link.id,
+    }),
+    contentType: 'text/x-shellscript',
+  }
 }

apps/api/src/services/policy/mikrotik-rsc.test.ts

@@ -0,0 +1,64 @@
+import { describe, it, expect } from 'vitest'
+import { renderMikrotikPolicyRsc, isIpv4Cidr } from './mikrotik-rsc.js'
+import type { EvaluatedPolicy } from './evaluate.js'
+
+function basePolicy(
+  overrides: Partial<EvaluatedPolicy> = {},
+): EvaluatedPolicy {
+  return {
+    generation: 3,
+    hash: 'sha256:abc',
+    policyMode: 'blacklist',
+    denyCidrs: ['1.2.3.0/24', '2001:db8::/32', '10.0.0.1/32'],
+    allowCidrs: ['8.8.8.8/32', 'fe80::1/128'],
+    syncIntervalSec: 60,
+    ...overrides,
+  }
+}
+
+describe('mikrotik-rsc', () => {
+  it('isIpv4Cidr skips IPv6', () => {
+    expect(isIpv4Cidr('1.2.3.0/24')).toBe(true)
+    expect(isIpv4Cidr('2001:db8::/32')).toBe(false)
+  })
+
+  it('renders blacklist: lists + BL enabled / WL disabled', () => {
+    const rsc = renderMikrotikPolicyRsc(basePolicy())
+    expect(rsc).toContain('# evofw hash=sha256:abc mode=blacklist gen=3')
+    expect(rsc).toContain(
+      '/ip firewall address-list remove [find list=EVOFW_DENY]',
+    )
+    expect(rsc).toContain(
+      '/ip firewall address-list remove [find list=EVOFW_ALLOW]',
+    )
+    expect(rsc).toContain(
+      'add list=EVOFW_DENY address=1.2.3.0/24 comment=evofw',
+    )
+    expect(rsc).toContain(
+      'add list=EVOFW_DENY address=10.0.0.1/32 comment=evofw',
+    )
+    expect(rsc).not.toContain('2001:db8')
+    expect(rsc).toContain(
+      'add list=EVOFW_ALLOW address=8.8.8.8/32 comment=evofw',
+    )
+    expect(rsc).toContain(
+      'set [find comment=evofw-bl-drop-input] disabled=no',
+    )
+    expect(rsc).toContain(
+      'set [find comment=evofw-wl-accept-forward] disabled=yes',
+    )
+  })
+
+  it('renders whitelist: WL enabled / BL disabled', () => {
+    const rsc = renderMikrotikPolicyRsc(
+      basePolicy({ policyMode: 'whitelist' }),
+    )
+    expect(rsc).toContain('mode=whitelist')
+    expect(rsc).toContain(
+      'set [find comment=evofw-bl-drop-forward] disabled=yes',
+    )
+    expect(rsc).toContain(
+      'set [find comment=evofw-wl-drop-forward] disabled=no',
+    )
+  })
+})

apps/api/src/services/policy/mikrotik-rsc.ts

@@ -0,0 +1,52 @@
+import type { EvaluatedPolicy } from './evaluate.js'
+
+/** Skip IPv6 (contains ':') — same as Linux agent. */
+export function isIpv4Cidr(cidr: string): boolean {
+  const t = cidr.trim()
+  return t.length > 0 && !t.includes(':')
+}
+
+function escAddress(cidr: string): string {
+  // CIDRs are alphanumeric + . / - ; quote if anything odd
+  const t = cidr.trim()
+  if (/^[0-9./-]+$/.test(t)) return t
+  return `"${t.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`
+}
+
+/**
+ * RouterOS 7.x script: rebuild EVOFW_* address-lists and toggle filter mode.
+ * Device: /tool fetch → /import (no JSON parse on router).
+ */
+export function renderMikrotikPolicyRsc(policy: EvaluatedPolicy): string {
+  const isBl = policy.policyMode === 'blacklist'
+  const blDisabled = isBl ? 'no' : 'yes'
+  const wlDisabled = isBl ? 'yes' : 'no'
+
+  const lines: string[] = [
+    `# evofw hash=${policy.hash} mode=${policy.policyMode} gen=${policy.generation}`,
+    '/ip firewall address-list remove [find list=EVOFW_DENY]',
+    '/ip firewall address-list remove [find list=EVOFW_ALLOW]',
+  ]
+
+  for (const c of policy.denyCidrs) {
+    if (!isIpv4Cidr(c)) continue
+    lines.push(
+      `/ip firewall address-list add list=EVOFW_DENY address=${escAddress(c)} comment=evofw`,
+    )
+  }
+  for (const c of policy.allowCidrs) {
+    if (!isIpv4Cidr(c)) continue
+    lines.push(
+      `/ip firewall address-list add list=EVOFW_ALLOW address=${escAddress(c)} comment=evofw`,
+    )
+  }
+
+  lines.push(
+    `:do { /ip firewall filter set [find comment=evofw-bl-drop-input] disabled=${blDisabled} } on-error={}`,
+    `:do { /ip firewall filter set [find comment=evofw-bl-drop-forward] disabled=${blDisabled} } on-error={}`,
+    `:do { /ip firewall filter set [find comment=evofw-wl-accept-forward] disabled=${wlDisabled} } on-error={}`,
+    `:do { /ip firewall filter set [find comment=evofw-wl-drop-forward] disabled=${wlDisabled} } on-error={}`,
+  )
+
+  return `${lines.join('\n')}\n`
+}

apps/web/src/components/agents/add-agent-sheet.tsx

@@ -1,5 +1,5 @@
 import { useEffect, useState } from 'react'
-import { useMutation } from '@tanstack/react-query'
+import { useMutation, useQueryClient } from '@tanstack/react-query'
 import { toast } from 'sonner'
 import { Copy } from 'lucide-react'
 import { apiFetch } from '@/lib/api'
@@ -23,6 +23,7 @@ import {
   SheetHeader,
   SheetTitle,
 } from '@evofw/ui/components/sheet'
+import { useCopyToClipboard } from '@/hooks/use-copy-to-clipboard'
 
 /**
  * Create agent install invite — Sheet.
@@ -44,12 +45,9 @@ interface AddAgentSheetProps {
   onOpenChange: (open: boolean) => void
 }
 
-async function copyText(text: string) {
-  await navigator.clipboard.writeText(text)
-  toast.success('Скопировано')
-}
-
 export function AddAgentSheet({ open, onOpenChange }: AddAgentSheetProps) {
+  const qc = useQueryClient()
+  const { copyToClipboard } = useCopyToClipboard()
   const [name, setName] = useState('web-01')
   const [platform, setPlatform] = useState<Platform>('linux')
   const [created, setCreated] = useState<InstallLink | null>(null)
@@ -70,13 +68,20 @@ export function AddAgentSheet({ open, onOpenChange }: AddAgentSheetProps) {
       }),
     onSuccess: (link) => {
       setCreated(link)
-      toast.success('Ссылка создана')
+      toast.success('Агент создан')
+      void qc.invalidateQueries({ queryKey: ['agents'] })
     },
     onError: (e: Error) => toast.error(e.message),
   })
 
   const canCreate = Boolean(name.trim()) && !create.isPending
 
+  function handleCopy(text: string) {
+    if (!text) return
+    copyToClipboard(text)
+    toast.success('Скопировано')
+  }
+
   return (
     <Sheet open={open} onOpenChange={onOpenChange}>
       <SheetContent className="flex flex-col gap-0 overflow-hidden sm:max-w-md">
@@ -86,8 +91,8 @@ export function AddAgentSheet({ open, onOpenChange }: AddAgentSheetProps) {
           </SheetTitle>
           <SheetDescription>
             {created
-              ? 'Скопируйте one-liner и выполните на хосте. Затем одобрите агента в списке.'
-              : 'Создайте короткую install-ссылку с именем клиента.'}
+              ? 'Агент уже в списке (Invited). Скопируйте one-liner и выполните на хосте.'
+              : 'Создайте агента и короткую install-ссылку.'}
           </SheetDescription>
         </SheetHeader>
 
@@ -139,9 +144,7 @@ export function AddAgentSheet({ open, onOpenChange }: AddAgentSheetProps) {
                       variant="outline"
                       size="sm"
                       className="self-start"
-                      onClick={() =>
-                        void copyText(created.curl?.by_id ?? '')
-                      }
+                      onClick={() => handleCopy(created.curl?.by_id ?? '')}
                     >
                       <Copy data-icon="inline-start" />
                       Копировать
@@ -159,9 +162,7 @@ export function AddAgentSheet({ open, onOpenChange }: AddAgentSheetProps) {
                       variant="outline"
                       size="sm"
                       className="self-start"
-                      onClick={() =>
-                        void copyText(created.curl?.by_slug ?? '')
-                      }
+                      onClick={() => handleCopy(created.curl?.by_slug ?? '')}
                     >
                       <Copy data-icon="inline-start" />
                       Копировать
@@ -182,7 +183,7 @@ export function AddAgentSheet({ open, onOpenChange }: AddAgentSheetProps) {
                   setCreated(null)
                 }}
               >
-                Ещё ссылка
+                Ещё агент
               </Button>
               <Button onClick={() => onOpenChange(false)}>Готово</Button>
             </>
@@ -191,11 +192,8 @@ export function AddAgentSheet({ open, onOpenChange }: AddAgentSheetProps) {
               <Button variant="outline" onClick={() => onOpenChange(false)}>
                 Отмена
               </Button>
-              <Button
-                disabled={!canCreate}
-                onClick={() => create.mutate()}
-              >
-                Создать ссылку
+              <Button disabled={!canCreate} onClick={() => create.mutate()}>
+                Создать
               </Button>
             </>
           )}

apps/web/src/components/status-badge.tsx

@@ -16,6 +16,7 @@ const STATUS_VARIANT: Record<string, BadgeVariant> = {
   allow: 'success-light',
   pending_push: 'secondary',
   pending: 'warning-light',
+  invited: 'info-light',
   warning: 'warning-light',
   degraded: 'warning-light',
   conflict: 'destructive-light',
@@ -54,6 +55,7 @@ const STATUS_LABELS: Record<string, string> = {
   synced: 'Синхронизировано',
   pending_push: 'Ожидает отправки',
   pending: 'Pending',
+  invited: 'Invited',
   approved: 'Approved',
   revoked: 'Revoked',
   enabled: 'Включён',

apps/web/src/hooks/use-copy-to-clipboard.ts

@@ -0,0 +1,35 @@
+import { useState } from "react"
+
+export function useCopyToClipboard({
+  timeout = 2000,
+  onCopy,
+}: {
+  timeout?: number
+  onCopy?: () => void
+} = {}) {
+  const [isCopied, setIsCopied] = useState(false)
+
+  const copyToClipboard = (value: string) => {
+    if (typeof window === "undefined" || !navigator.clipboard.writeText) {
+      return
+    }
+
+    if (!value) return
+
+    navigator.clipboard.writeText(value).then(() => {
+      setIsCopied(true)
+
+      if (onCopy) {
+        onCopy()
+      }
+
+      if (timeout !== 0) {
+        setTimeout(() => {
+          setIsCopied(false)
+        }, timeout)
+      }
+    }, console.error)
+  }
+
+  return { isCopied, copyToClipboard }
+}

apps/web/src/routes/_auth/agents/index.tsx

@@ -1,7 +1,7 @@
 import { createFileRoute, Link } from '@tanstack/react-router'
 import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
 import { toast } from 'sonner'
-import { Check, Plus, Trash2 } from 'lucide-react'
+import { Check, Copy, Plus, Trash2 } from 'lucide-react'
 import { useCallback, useMemo, useState } from 'react'
 import type { ColumnDef } from '@tanstack/react-table'
 import type { Filter, FilterFieldConfig } from '@/components/reui/filters'
@@ -20,15 +20,21 @@ import { ConfirmDialog } from '@/components/confirm-dialog'
 import { AddAgentSheet } from '@/components/agents/add-agent-sheet'
 import { agentsQueryOptions } from '@/queries'
 import { apiFetch } from '@/lib/api'
+import { useCopyToClipboard } from '@/hooks/use-copy-to-clipboard'
 import { Button } from '@evofw/ui/components/button'
+import {
+  Tooltip,
+  TooltipContent,
+  TooltipTrigger,
+} from '@evofw/ui/components/tooltip'
 import type { Agent } from '@evofw/shared'
 
 /**
  * Agents list — ResourcePage (Frame + tabs + Filters + DataGrid).
  * Preview: https://reui.io/preview/base/data-grid-filtering-2
+ * Copyable install: https://reui.io/preview/base/settings-14
  * Empty: https://reui.io/preview/base/empty-state-7
  * Create Sheet: https://reui.io/preview/base/sheet-1 · sheet-8
- * Docs: https://reui.io/blocks · https://reui.io/components/sheet
  */
 export const Route = createFileRoute('/_auth/agents/')({
   component: AgentsPage,
@@ -37,6 +43,7 @@ export const Route = createFileRoute('/_auth/agents/')({
 function AgentsPage() {
   const qc = useQueryClient()
   const agentsQ = useQuery(agentsQueryOptions())
+  const { copyToClipboard } = useCopyToClipboard()
   const [createOpen, setCreateOpen] = useState(false)
   const [filters, setFilters] = useState<Filter[]>([])
   const [activeTab, setActiveTab] = useState('all')
@@ -88,6 +95,7 @@ function AgentsPage() {
         label: 'Статус',
         type: 'select',
         options: [
+          { value: 'invited', label: 'invited' },
           { value: 'approved', label: 'approved' },
           { value: 'pending', label: 'pending' },
           { value: 'revoked', label: 'revoked' },
@@ -118,6 +126,15 @@ function AgentsPage() {
     return item.status === tabId
   }, [])
 
+  const handleCopyCurl = useCallback(
+    (curl: string) => {
+      if (!curl) return
+      copyToClipboard(curl)
+      toast.success('Скопировано')
+    },
+    [copyToClipboard],
+  )
+
   const columns: ColumnDef<Agent>[] = useMemo(
     () => [
       {
@@ -152,6 +169,39 @@ function AgentsPage() {
         ),
         cell: ({ row }) => <StatusBadge status={row.original.status} />,
       },
+      {
+        id: 'install',
+        enableSorting: false,
+        header: ({ column }) => (
+          <DataGridColumnHeader column={column} title="Install" />
+        ),
+        cell: ({ row }) => {
+          const curl = row.original.install_curl
+          if (!curl) {
+            return <DataGridMutedCell>—</DataGridMutedCell>
+          }
+          return (
+            <Tooltip>
+              <TooltipTrigger
+                render={
+                  <Button
+                    size="sm"
+                    variant="outline"
+                    className="max-w-[14rem] font-mono text-xs"
+                    onClick={() => handleCopyCurl(curl)}
+                  />
+                }
+              >
+                <Copy data-icon="inline-start" className="size-3.5" />
+                <span className="truncate">{curl}</span>
+              </TooltipTrigger>
+              <TooltipContent className="max-w-sm break-all font-mono text-xs">
+                {curl}
+              </TooltipContent>
+            </Tooltip>
+          )
+        },
+      },
       {
         accessorKey: 'policy_mode',
         header: ({ column }) => (
@@ -217,7 +267,7 @@ function AgentsPage() {
         },
       },
     ],
-    [approve, revoke],
+    [approve, revoke, handleCopyCurl],
   )
 
   const addButton = (
@@ -231,7 +281,7 @@ function AgentsPage() {
     <PageShell>
       <PageHeader
         title="Агенты"
-        description="Linux / MikroTik — short install, approve, policy mode"
+        description="Linux / MikroTik — invite, install, approve"
         actions={addButton}
       />
 
@@ -248,8 +298,9 @@ function AgentsPage() {
         getFilterFieldValue={getFilterFieldValue}
         tabs={[
           { id: 'all', label: 'Все' },
-          { id: 'approved', label: 'Approved' },
+          { id: 'invited', label: 'Invited' },
           { id: 'pending', label: 'Pending' },
+          { id: 'approved', label: 'Approved' },
           { id: 'revoked', label: 'Revoked' },
         ]}
         activeTab={activeTab}
@@ -262,7 +313,7 @@ function AgentsPage() {
         emptyState={{
           title: 'Нет агентов',
           description:
-            'Создайте install-ссылку, выполните curl на хосте и одобрите запрос.',
+            'Создайте агента — он появится в списке как Invited с командой установки.',
           action: addButton,
         }}
       />
@@ -275,7 +326,7 @@ function AgentsPage() {
           if (!open) setDeleteId(null)
         }}
         title="Удалить агента?"
-        description="Агент и связанные назначения будут удалены."
+        description="Агент, install-ссылка и связанные назначения будут удалены."
         onConfirm={() => {
           if (deleteId) remove.mutate(deleteId)
         }}

apps/web/tsconfig.json

@@ -15,7 +15,6 @@
     "noUnusedLocals": false,
     "noUnusedParameters": false,
     "noFallthroughCasesInSwitch": true,
-    "baseUrl": ".",
     "paths": {
       "@/*": ["./src/*"],
       "@evofw/ui/*": ["../../packages/ui/src/*"],

docs/agents.md

@@ -2,17 +2,25 @@
 
 ## Short install (рекомендуется)
 
-В UI `/agents` → **Добавить агента** создаёт install-ссылку. На хосте:
+В UI `/agents` → **Добавить агента**:
 
+1. Создаётся агент со статусом **Invited** (сразу виден в таблице) + install-ссылка.
+2. Скопируйте one-liner (колонка Install или Sheet):
+
+**Linux:**
 ```bash
 curl -fsSL https://<cp>/agent-install/<id> | bash
-# или короткий slug:
-curl -fsSL https://<cp>/<slug> | bash
 ```
 
-Скрипт уже содержит `EVOFW_CP_URL`, `EVOFW_SEED`, `EVOFW_CLIENT_NAME`. После enroll одобрите агента во вкладке Pending.
+**MikroTik:**
+```
+/tool fetch url="https://<cp>/agent-install/<id>" dst-path=evofw-install.rsc; /import file-name=evofw-install.rsc
+```
 
-API (auth): `POST /api/v1/install-links` `{ "name": "web-01", "platform": "linux" }`.
+3. После enroll статус станет **Pending** — одобрите агента (Approve).
+4. **Approved** — агент синхронизирует политику.
+
+API (auth): `POST /api/v1/install-links` `{ "name": "web-01", "platform": "linux" | "mikrotik" }`.
 
 ## Linux (legacy one-liner)
 
@@ -24,15 +32,36 @@ curl -fsSL https://<cp>/v1/agent/install.sh | \
   bash
 ```
 
+Создаёт нового агента со статусом Pending (без Invited).
+
 Файлы: `/etc/evofw/agent.conf`, `/usr/local/sbin/evofw-firewall.sh`, timer `evofw-firewall.timer` (default 1min).
 
 Backend auto-detect: nft → ipset → iptables.
 
 Whitelist: nft chain policy drop + allow set. Blacklist: policy accept + deny set.
 
-## MikroTik
+## MikroTik (RouterOS 7.21+)
 
-Скачайте `/v1/agent/mikrotik-install.rsc`, задайте globals `EvofwCpUrl`, `EvofwSeed`, `EvofwName`, import. Scheduler каждую минуту тянет policy. Настройте filter на address-list `EVOFW_DENY` / `EVOFW_ALLOW`.
+В UI `/agents` → **Добавить агента** → platform **MikroTik**. Скопируйте one-liner:
+
+```
+/tool fetch url="https://<cp>/agent-install/<id>" dst-path=evofw-install.rsc; /import file-name=evofw-install.rsc
+```
+
+Или короткий slug: `https://<cp>/<slug>`.
+
+Install RSC:
+
+1. Enroll (с `install_link_id` → агент Invited → Pending).
+2. Создаёт filter-правила `evofw-*` и address-list `EVOFW_DENY` / `EVOFW_ALLOW`.
+3. Scheduler `evofw-sync` каждую минуту: `GET /v1/agent/policy.rsc` → `/import` (списки + режим).
+
+**Blacklist:** `drop` по `EVOFW_DENY` в `input` и `forward`.  
+**Whitelist:** `accept` по `EVOFW_ALLOW` + catch-all `drop` только в `forward` (input не закрывается — Winbox/SSH).
+
+Legacy: скачайте `/v1/agent/mikrotik-install.rsc`, задайте globals `EvofwCpUrl`, `EvofwSeed`, `EvofwName`, опционально `EvofwInstallLinkId`, затем `/import`.
+
+Одобрите агента в UI — после Approve sync начнёт применять политику.
 
 ## Force sync
 

packages/db/migrations/004_agent_invited.sql

@@ -0,0 +1,64 @@
+-- Allow invited agents (created in UI before enroll) + link install invites to agents.
+-- Rebuild agents to widen status CHECK (FK temporarily off).
+
+PRAGMA foreign_keys = OFF;
+
+CREATE TABLE agents_v2 (
+  id TEXT PRIMARY KEY,
+  name TEXT NOT NULL,
+  hostname TEXT,
+  platform TEXT NOT NULL DEFAULT 'linux',
+  token_prefix TEXT NOT NULL,
+  token_hash TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'pending',
+  policy_mode TEXT NOT NULL DEFAULT 'blacklist',
+  policy_generation INTEGER NOT NULL DEFAULT 1,
+  last_seen_at TEXT,
+  last_seen_ip TEXT,
+  last_apply_at TEXT,
+  last_apply_status TEXT,
+  last_apply_error TEXT,
+  last_apply_prefix_count INTEGER DEFAULT 0,
+  last_apply_packets_dropped INTEGER NOT NULL DEFAULT 0,
+  last_apply_packets_accepted INTEGER NOT NULL DEFAULT 0,
+  last_apply_kernel_method TEXT,
+  client_version TEXT,
+  settings_json TEXT NOT NULL DEFAULT '{}',
+  created_by_user_id TEXT,
+  created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+  approved_at TEXT,
+  revoked_at TEXT,
+  CHECK (status IN ('invited', 'pending', 'approved', 'revoked')),
+  CHECK (platform IN ('linux', 'mikrotik')),
+  CHECK (policy_mode IN ('blacklist', 'whitelist')),
+  CHECK (length(trim(name)) > 0)
+);
+
+INSERT INTO agents_v2 (
+  id, name, hostname, platform, token_prefix, token_hash, status, policy_mode,
+  policy_generation, last_seen_at, last_seen_ip, last_apply_at, last_apply_status,
+  last_apply_error, last_apply_prefix_count, last_apply_packets_dropped,
+  last_apply_packets_accepted, last_apply_kernel_method, client_version,
+  settings_json, created_by_user_id, created_at, approved_at, revoked_at
+)
+SELECT
+  id, name, hostname, platform, token_prefix, token_hash, status, policy_mode,
+  policy_generation, last_seen_at, last_seen_ip, last_apply_at, last_apply_status,
+  last_apply_error, last_apply_prefix_count, last_apply_packets_dropped,
+  last_apply_packets_accepted, last_apply_kernel_method, client_version,
+  settings_json, created_by_user_id, created_at, approved_at, revoked_at
+FROM agents;
+
+DROP TABLE agents;
+ALTER TABLE agents_v2 RENAME TO agents;
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_agents_token_hash ON agents (token_hash);
+CREATE INDEX IF NOT EXISTS idx_agents_status ON agents (status);
+
+PRAGMA foreign_keys = ON;
+
+-- Bind install links to agents
+ALTER TABLE agent_install_links ADD COLUMN agent_id TEXT REFERENCES agents (id) ON DELETE CASCADE;
+
+CREATE INDEX IF NOT EXISTS idx_agent_install_links_agent
+  ON agent_install_links (agent_id);

packages/db/src/repositories/index.ts

@@ -459,6 +459,20 @@ export function getInstallLinkBySlug(db: Db, slug: string) {
     .get()
 }
 
+export function getInstallLinkByAgentId(db: Db, agentId: string) {
+  return db
+    .select()
+    .from(agentInstallLinks)
+    .where(
+      and(
+        eq(agentInstallLinks.agentId, agentId),
+        sql`${agentInstallLinks.revokedAt} IS NULL`,
+      ),
+    )
+    .orderBy(desc(agentInstallLinks.createdAt))
+    .get()
+}
+
 export function insertInstallLink(
   db: Db,
   row: typeof agentInstallLinks.$inferInsert,
@@ -538,6 +552,7 @@ export const repos = {
   listInstallLinks,
   getInstallLink,
   getInstallLinkBySlug,
+  getInstallLinkByAgentId,
   insertInstallLink,
   revokeInstallLink,
   touchInstallLink,

packages/db/src/schema.ts

@@ -18,7 +18,7 @@ export const agents = sqliteTable(
     platform: text('platform').notNull().default('linux'), // linux | mikrotik
     tokenPrefix: text('token_prefix').notNull(),
     tokenHash: text('token_hash').notNull(),
-    status: text('status').notNull().default('pending'), // pending | approved | revoked
+    status: text('status').notNull().default('pending'), // invited | pending | approved | revoked
     policyMode: text('policy_mode').notNull().default('blacklist'), // blacklist | whitelist
     policyGeneration: integer('policy_generation').notNull().default(1),
     lastSeenAt: text('last_seen_at'),
@@ -202,6 +202,7 @@ export const agentInstallLinks = sqliteTable(
     slug: text('slug').notNull(),
     clientName: text('client_name').notNull(),
     platform: text('platform').notNull().default('linux'), // linux | mikrotik
+    agentId: text('agent_id').references(() => agents.id, { onDelete: 'cascade' }),
     createdAt: text('created_at')
       .notNull()
       .default(sql`(strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))`),
@@ -211,6 +212,7 @@ export const agentInstallLinks = sqliteTable(
   },
   (t) => ({
     slugIdx: uniqueIndex('idx_agent_install_links_slug').on(t.slug),
+    agentIdx: index('idx_agent_install_links_agent').on(t.agentId),
   }),
 )
 

packages/shared/src/contracts.ts

@@ -1,7 +1,12 @@
 import { z } from 'zod'
 
 export const agentPlatformSchema = z.enum(['linux', 'mikrotik'])
-export const agentStatusSchema = z.enum(['pending', 'approved', 'revoked'])
+export const agentStatusSchema = z.enum([
+  'invited',
+  'pending',
+  'approved',
+  'revoked',
+])
 export const policyModeSchema = z.enum(['blacklist', 'whitelist'])
 export const policyActionSchema = z.enum(['allow', 'deny'])
 export const ipListTypeSchema = z.enum([
@@ -34,6 +39,8 @@ export const agentSchema = z.object({
   created_at: z.string(),
   approved_at: z.string().nullable().optional(),
   revoked_at: z.string().nullable().optional(),
+  install_curl: z.string().nullable().optional(),
+  install_link_id: z.string().nullable().optional(),
 })
 
 export const ipListSchema = z.object({
@@ -151,6 +158,7 @@ export const enrollBodySchema = z.object({
   platform: agentPlatformSchema.optional().default('linux'),
   token: z.string().min(16),
   client_version: z.string().optional(),
+  install_link_id: z.string().optional(),
 })
 
 export const applyReportBodySchema = z.object({
@@ -192,6 +200,7 @@ export const installLinkSchema = z.object({
   slug: z.string(),
   client_name: z.string(),
   platform: agentPlatformSchema,
+  agent_id: z.string().nullable().optional(),
   created_at: z.string(),
   revoked_at: z.string().nullable().optional(),
   last_used_at: z.string().nullable().optional(),