@yawlabs/tailscale-mcp 0.17.0 → 0.18.0

package/README.md

@@ -5,7 +5,7 @@
 [![GitHub stars](https://img.shields.io/github/stars/YawLabs/tailscale-mcp)](https://github.com/YawLabs/tailscale-mcp/stargazers)
 [![Release](https://img.shields.io/badge/release-local-blue)](./release.sh)
 
-**Ask your agent questions about your tailnet and have it act on the answers.** 94 admin-API tools + 6 optional local-CLI diagnostics + 4 resources spanning the [Tailscale v2 API](https://tailscale.com/api) — devices, ACLs, DNS, keys and trust credentials, users, invites, webhooks, log streaming, posture, services, and organization tailnets. Backed by 1100+ unit tests and an opt-in live-tailnet integration suite.
+**Ask your agent questions about your tailnet and have it act on the answers.** 96 admin-API tools + 6 optional local-CLI diagnostics + 4 resources spanning the [Tailscale v2 API](https://tailscale.com/api) — devices, ACLs, DNS, keys and trust credentials, users, invites, webhooks, log streaming, posture, services, and organization tailnets. Backed by 1100+ unit tests and an opt-in live-tailnet integration suite.
 
 Built and maintained by [Yaw Labs](https://yaw.sh).
 
@@ -104,7 +104,7 @@ That's it. Now ask your agent:
 
 ## Too many tools? Subset them.
 
-94 tools is a lot. If you've already got a dozen MCP servers and your client is feeling heavy, trim what this one exposes. Three knobs, combinable:
+96 tools is a lot. If you've already got a dozen MCP servers and your client is feeling heavy, trim what this one exposes. Three knobs, combinable:
 
 ### Option 1: `TAILSCALE_PROFILE` (preset, easiest)
 
@@ -118,8 +118,8 @@ That's it. Now ask your agent:
 ```
 
 - **`minimal`** (20 tools) — `status`, `devices`, `audit`. Observe the tailnet, read the audit log.
-- **`core`** (49 tools) — adds `acl`, `dns`, `keys`, `users`. The day-to-day admin surface.
-- **`full`** (94 tools, default) — everything. Same as omitting the env var.
+- **`core`** (51 tools) — adds `acl`, `dns`, `keys`, `users`. The day-to-day admin surface.
+- **`full`** (96 tools, default) — everything. Same as omitting the env var.
 
 ### Option 2: `TAILSCALE_TOOLS` (explicit group list)
 
@@ -227,7 +227,7 @@ Set `TAILSCALE_LOCAL_CLI=1` (in your shell or `.mcp.json` `env` block) to add si
 
 Requirements: the `tailscale` binary must be in `PATH`. If it's installed somewhere unusual, set `TAILSCALE_BINARY` to its absolute path. The MCP server doesn't need root to run these — they're all diagnostic, not state-mutating. Operations that would need elevation (`tailscale up`, `set --advertise-routes`, `lock sign`) are deliberately not exposed.
 
-When opt-in is on, the startup banner reflects it: `@yawlabs/tailscale-mcp v0.13.3 ready (100 tools, local-cli=on)` — the 6 local CLI tools are additive on top of the default 94.
+When opt-in is on, the startup banner reflects it: `@yawlabs/tailscale-mcp v0.13.3 ready (102 tools, local-cli=on)` — the 6 local CLI tools are additive on top of the default 96.
 
 ## Resources (4)
 
@@ -240,7 +240,7 @@ MCP Resources expose read-only data clients can browse without a tool call.
 | ACL Policy | `tailscale://tailnet/acl` | Full ACL policy (HuJSON preserved) |
 | DNS Config | `tailscale://tailnet/dns` | Nameservers, search paths, split DNS, MagicDNS |
 
-## Tools (94 + 6 opt-in)
+## Tools (96 + 6 opt-in)
 
 <details>
 <summary><strong>Status</strong> (1 tool)</summary>
@@ -308,7 +308,7 @@ MCP Resources expose read-only data clients can browse without a tool call.
 </details>
 
 <details>
-<summary><strong>Keys / Trust Credentials</strong> (7 tools) — covers auth keys, OAuth clients, federated identities, and OAuth apps</summary>
+<summary><strong>Keys / Trust Credentials</strong> (9 tools) — covers auth keys, OAuth clients, federated identities, and OAuth apps</summary>
 
 | Tool | Description |
 |------|-------------|
@@ -319,6 +319,8 @@ MCP Resources expose read-only data clients can browse without a tool call.
 | `tailscale_update_key` | Update a key's description, scopes, tags, or federated claim settings |
 | `tailscale_create_oauth_app` | Create an OAuth App for third-party device provisioning (Tailscale alpha) |
 | `tailscale_get_oauth_app` | Get an OAuth App's name, redirect URIs, and scopes |
+| `tailscale_list_oauth_apps` | List every OAuth App registered in the tailnet |
+| `tailscale_delete_oauth_app` | Delete an OAuth App, revoking its ability to provision devices |
 
 </details>
 
@@ -531,18 +533,18 @@ This shows a read-only banner in the Tailscale Admin Console pointing to your re
 
 ## Requirements
 
-- Node.js 20+ to run the server (22+ to develop — the test script passes a glob to `node --test`, supported from Node 21)
+- Node.js 20.11+ to run the server (22+ to develop — the test script passes a glob to `node --test`, supported from Node 21)
 - A Tailscale API key or OAuth client credentials
 
 ## Running on oam.js (optional)
 
-[oam.js](https://oamjs.org) runs this server unmodified. Verified against oam 0.9.0: full MCP handshake, all 94 tools, all 4 resources, identical error messages, and a clean stdout protocol stream — from the shipped bundle *and* straight from the TypeScript source with no build step.
+[oam.js](https://oamjs.org) runs this server unmodified. Verified against oam 0.9.0: full MCP handshake, all 96 tools, all 4 resources, identical error messages, and a clean stdout protocol stream — from the shipped bundle *and* straight from the TypeScript source with no build step.
 
 **oam 0.9.0 is the minimum.** Older releases ran `child_process.execFile` arguments through a shell, re-splitting them on whitespace and executing shell metacharacters inside an argument. This server shells out to the `tailscale` binary across its local-CLI tools, so that was a reachable bug rather than a theoretical one. The launcher enforces the floor: given an older oam it falls back to Node and says so on stderr, and `TAILSCALE_MCP_RUNTIME=oam` turns that into a hard error.
 
 ### Sandboxing (opt-in)
 
-Set `TAILSCALE_MCP_SANDBOX=1` to run under oam's `--permission` model: network restricted to `api.tailscale.com` and `login.tailscale.com`, filesystem denied. Child-process stays granted because the local-CLI tools shell out to the `tailscale` binary, which is also why `PATH` remains in the environment allow-list.
+Set `TAILSCALE_MCP_SANDBOX=1` to run under oam's `--permission` model: network restricted to `api.tailscale.com` -- the only host the bundle contacts, including the OAuth token exchange -- and filesystem denied. Child-process stays granted because the local-CLI tools shell out to the `tailscale` binary, which is also why `PATH` remains in the environment allow-list.
 
 It is opt-in rather than default because a wrong grant does not fail loudly. oam denies a non-granted environment variable by making it **absent** from `process.env` rather than throwing, so an under-granted `TAILSCALE_API_KEY` reads as "unauthenticated" rather than "denied". The env allow-list in the launcher is derived from what the shipped bundle actually reads -- if you add a new `process.env` lookup, extend that list with it.
 

package/bin/tailscale-mcp.mjs

@@ -24,7 +24,8 @@
  *
  * THE `--permission` SANDBOX (oam 0.9.0+, opt-in)
  * `TAILSCALE_MCP_SANDBOX=1` runs the server under oam's permission model:
- * network limited to the control-plane hosts, filesystem denied.
+ * network limited to the one host the bundle actually calls
+ * (api.tailscale.com), filesystem denied.
  *
  * Child-process is granted unconditionally because the local-CLI tools shell out
  * to the `tailscale` binary; that is also why PATH stays in the env grant, since
@@ -49,6 +50,7 @@
  *   TAILSCALE_MCP_RUNTIME=oam    require oam; fail loudly if it is missing
  *   TAILSCALE_MCP_RUNTIME=node   never use oam
  *   TAILSCALE_MCP_RUNTIME=auto   prefer oam, silently fall back (default)
+ *   anything else                warns on stderr, then behaves as auto
  *   TAILSCALE_MCP_SANDBOX=1      run oam under --permission (oam 0.9.0+)
  *   OAM_BIN=/path/to/oam     explicit binary, checked before any discovery
  */
@@ -85,7 +87,7 @@ function findOam() {
   //    point deliberately at a dev build.
   //
   //    Both forms are checked on Windows: the installer defaults to
-  //    %LOCALAPPDATA%oamin there, but oam's docs name ~/.oam/bin first and
+  //    %LOCALAPPDATA%\oam\bin there, but oam's docs name ~/.oam/bin first and
   //    OAM_INSTALL_DIR can pick either, so checking one silently misses a real
   //    install.
   const installed = [join(homedir(), ".oam", "bin", exe)];
@@ -98,13 +100,16 @@ function findOam() {
 
   // 3. PATH, resolved manually rather than by spawning `which`/`where`, which
   //    would cost a subprocess on every launch just to decide whether to spawn.
-  const pathExt = isWin ? (process.env.PATHEXT ?? ".EXE").split(";").filter(Boolean) : [""];
+  // Windows: `.exe` ONLY -- deliberately narrower than PATHEXT. Node refuses to
+  // run a .cmd/.bat through execFile/spawn without `shell: true` (EINVAL, and
+  // for spawn it throws SYNCHRONOUSLY rather than emitting 'error'), so walking
+  // the full PATHEXT list would hand back a path this launcher cannot execute.
+  // Discovery has to agree with execution. A skipped shim is still reported --
+  // see findOamShim.
   for (const dir of (process.env.PATH ?? "").split(delimiter)) {
     if (!dir) continue;
-    for (const ext of isWin ? pathExt : [""]) {
-      const candidate = join(dir, isWin ? `oam${ext.toLowerCase()}` : "oam");
-      if (existsSync(candidate)) return candidate;
-    }
+    const candidate = join(dir, exe);
+    if (existsSync(candidate)) return candidate;
   }
 
   return null;
@@ -153,7 +158,16 @@ function atLeast(v, min) {
 function sandboxFlags() {
   if (process.env.TAILSCALE_MCP_SANDBOX !== "1") return [];
 
-  const hosts = ["api.tailscale.com","login.tailscale.com"];
+  // ONE host, deliberately. Every outbound request the bundle makes targets
+  // api.tailscale.com: BASE_URL, the OAuth token exchange, and the absolute-URL
+  // allow-list that refuses to send credentials anywhere else. login.tailscale.com
+  // was granted here as well until an audit found no code path that contacts it
+  // -- console.tailscale.com appears in error TEXT, never as a request target.
+  // An unused grant is the one kind of over-permission nothing ever surfaces:
+  // removing it cannot break a call that was never made, and keeping it widens
+  // the sandbox for no behaviour. launcher.test.ts pins this list exactly so a
+  // future host lands as a reviewed diff rather than a quiet widening.
+  const hosts = ["api.tailscale.com"];
 
   const netFlag = `--allow-net=${hosts.join(",")}`;
 
@@ -163,13 +177,73 @@ function sandboxFlags() {
   // meant the local-CLI tool group silently failed to register under the
   // sandbox even though --allow-child-process is granted below precisely so
   // those tools can shell out.
-  const env = ["PATH","TAILSCALE_API_KEY","TAILSCALE_BINARY","TAILSCALE_DEBUG","TAILSCALE_EXTRA_POSTURE_PROVIDERS","TAILSCALE_EXTRA_WEBHOOK_EVENTS","TAILSCALE_LOCAL_CLI","TAILSCALE_MAX_CONCURRENT","TAILSCALE_OAUTH_CLIENT_ID","TAILSCALE_OAUTH_CLIENT_SECRET","TAILSCALE_OAUTH_TAILNET","TAILSCALE_PROFILE","TAILSCALE_READONLY","TAILSCALE_REQUEST_BUDGET_MS","TAILSCALE_RETRY_BASE_DELAY_MS","TAILSCALE_TAILNET","TAILSCALE_TOOLS"];
+  const env = [
+    "PATH",
+    "TAILSCALE_API_KEY",
+    "TAILSCALE_BINARY",
+    "TAILSCALE_DEBUG",
+    "TAILSCALE_EXTRA_POSTURE_PROVIDERS",
+    "TAILSCALE_EXTRA_WEBHOOK_EVENTS",
+    "TAILSCALE_LOCAL_CLI",
+    "TAILSCALE_MAX_CONCURRENT",
+    "TAILSCALE_OAUTH_CLIENT_ID",
+    "TAILSCALE_OAUTH_CLIENT_SECRET",
+    "TAILSCALE_OAUTH_TAILNET",
+    "TAILSCALE_PROFILE",
+    "TAILSCALE_READONLY",
+    "TAILSCALE_REQUEST_BUDGET_MS",
+    "TAILSCALE_RETRY_BASE_DELAY_MS",
+    "TAILSCALE_TAILNET",
+    "TAILSCALE_TOOLS",
+  ];
 
   const flags = ["--permission", netFlag, `--allow-env=${env.join(",")}`];
   flags.push("--allow-child-process");
   return flags;
 }
 
+/**
+ * Write a diagnostic to stderr synchronously, so a following process.exit
+ * cannot truncate it.
+ *
+ * Not a bare writeSync: that call can short-write (it returns a byte count) and
+ * on macOS it can throw EAGAIN, because Node makes a piped stderr non-blocking
+ * there rather than blocking the write. Loop over the remaining bytes, and if
+ * stderr turns out to be unusable give up quietly -- failing to print a
+ * diagnostic is not worth crashing a stdio server over.
+ */
+async function errSync(message) {
+  const { writeSync } = await import("node:fs");
+  const buf = Buffer.from(message);
+  let off = 0;
+  for (let attempts = 0; off < buf.length && attempts < 1000; attempts++) {
+    try {
+      off += writeSync(2, buf, off, buf.length - off);
+    } catch (err) {
+      if (err?.code !== "EAGAIN") return;
+      // Pipe is full and the reader has not drained yet -- retry.
+    }
+  }
+}
+
+/**
+ * An oam-named .cmd/.bat on PATH: a real install in a shape this launcher
+ * cannot spawn. Reported rather than ignored, because "no oam binary was found"
+ * reads as "install oam" -- the one thing that will not help. Windows only;
+ * there is no such shim concept on POSIX.
+ */
+function findOamShim() {
+  if (!isWin) return null;
+  for (const dir of (process.env.PATH ?? "").split(delimiter)) {
+    if (!dir) continue;
+    for (const ext of [".cmd", ".bat"]) {
+      const candidate = join(dir, `oam${ext}`);
+      if (existsSync(candidate)) return candidate;
+    }
+  }
+  return null;
+}
+
 /** Run the server in THIS process. The zero-overhead fallback. */
 async function runInProcess() {
   // A server may gate its bootstrap on being the process ENTRY POINT --
@@ -186,14 +260,43 @@ async function runInProcess() {
   await import(SERVER_URL.href);
 }
 
-const mode = (process.env.TAILSCALE_MCP_RUNTIME ?? "auto").toLowerCase();
+// Every value below is compared against `mode` after lowercasing, so an
+// unrecognized one matched nothing and fell through to the auto branch --
+// `TAILSCALE_MCP_RUNTIME=nod` silently PREFERRED oam on a box that has it,
+// which is the opposite of what was asked for. Same handling as index.ts gives
+// an unknown subcommand: auto is still the right landing place, it just stops
+// being silent. An empty value is treated as unset, since `FOO=$UNSET` in a
+// wrapper script is how it usually gets there.
+const RUNTIMES = ["auto", "node", "oam"];
+const requested = process.env.TAILSCALE_MCP_RUNTIME;
+const mode = (requested ?? "auto").toLowerCase();
+if (requested && !RUNTIMES.includes(mode)) {
+  // Echo what was SET, not the lowercased form, so the typo is recognisable in
+  // the host's log next to the config line that produced it.
+  await errSync(
+    `tailscale-mcp: unrecognized TAILSCALE_MCP_RUNTIME "${requested}" -- known values: ${RUNTIMES.join(", ")}. Using auto.\n`,
+  );
+}
 
 if (mode === "node") {
   await runInProcess();
 } else {
   const oam = findOam();
+  // Read the version ONCE, and only when discovery found something: the
+  // gate below has to tell "too old" apart from "could not be read at all",
+  // and re-probing inside the branch would cost a second subprocess.
+  const found = oam ? oamVersion(oam) : null;
 
   if (!oam) {
+    // An oam-named .cmd/.bat on PATH is a real install in a shape this
+    // launcher cannot spawn. Naming it turns "no oam binary was found" --
+    // which reads as "install oam", the one thing that will not help --
+    // into something the user can act on.
+    const oamShim = findOamShim();
+    const shimNote = oamShim
+      ? `Found ${oamShim}, but Node cannot execute a .cmd/.bat directly.\n` +
+        "Install the native oam binary, or point OAM_BIN at one.\n"
+      : "";
     if (mode === "oam") {
       // Explicitly demanded, so this is a real misconfiguration. writeSync
       // because stderr is async for TTYs/pipes on Windows and process.exit
@@ -201,75 +304,153 @@ if (mode === "node") {
       const { writeSync } = await import("node:fs");
       writeSync(
         2,
-        "tailscale-mcp: TAILSCALE_MCP_RUNTIME=oam but no oam binary was found.\n" +
+        "tailscale-mcp: TAILSCALE_MCP_RUNTIME=oam but no runnable oam binary was found.\n" +
+          shimNote +
           "Install from https://oamjs.org, set OAM_BIN=/path/to/oam, or use TAILSCALE_MCP_RUNTIME=node.\n",
       );
       process.exit(1);
     }
+    // auto: falling back is correct, but silence is how someone never learns
+    // their oam install is a shape this launcher skips.
+    if (oamShim) await errSync(`tailscale-mcp: ${shimNote}Using Node instead.\n`);
     await runInProcess();
-  } else if (!atLeast(oamVersion(oam), OAM_MIN)) {
-    // Discovery itself stays stat-only; this is the first subprocess, and it
-    // runs only once we have already decided to spawn oam anyway. Measured 26ms
-    // median (n=12, windows-arm64), paid once per MCP session.
+  } else if (!atLeast(found, OAM_MIN)) {
     const min = OAM_MIN.join(".");
+    // Two different causes reach this branch and they need different
+    // remedies. `found === null` is NOT "old": oamVersion returns null when
+    // the binary could not be run at all (not executable, wrong arch, a
+    // .cmd/.bat Node refuses, deleted between the stat and the probe) or
+    // when its --version output did not parse. Telling that user to
+    // `oam self-update` sends them after the one cause it definitely is not.
+    const detail = found
+      ? `${oam} is oam ${found.join(".")}, older than ${min}`
+      : `${oam} could not be run, or did not report a version this launcher understands`;
+    const remedy = found
+      ? "Run `oam self-update`, or use TAILSCALE_MCP_RUNTIME=node.\n"
+      : "Check that it is an executable oam binary for this platform, or use TAILSCALE_MCP_RUNTIME=node.\n";
     if (mode === "oam") {
-      const { writeSync } = await import("node:fs");
-      writeSync(
-        2,
-        `tailscale-mcp: TAILSCALE_MCP_RUNTIME=oam but ${oam} is older than oam ${min}.\n` +
-          `Run \`oam self-update\`, or use TAILSCALE_MCP_RUNTIME=node.\n`,
-      );
+      await errSync(`tailscale-mcp: TAILSCALE_MCP_RUNTIME=oam but ${detail}.\n${remedy}`);
       process.exit(1);
     }
-    // auto: an old oam is a reason to prefer Node, not to fail. Say so, because
-    // a silent downgrade is how someone keeps running an oam they meant to
-    // update. stderr is safe -- MCP frames travel on stdout.
-    process.stderr.write(`tailscale-mcp: oam at ${oam} is older than ${min}; using Node instead.\n`);
+    // auto: neither cause is worth failing over -- prefer Node. Say so,
+    // because a silent downgrade is how someone keeps running an oam they
+    // meant to update, or never learns their oam is unexecutable.
+    await errSync(`tailscale-mcp: ${detail}; using Node instead.\n`);
     await runInProcess();
   } else {
     // `--` separates oam's own flags from the script's argv, so `tailscale-mcp
     // --version` and any host-supplied flags survive the hop unchanged.
-    const child = spawn(oam, [...sandboxFlags(), "run", SERVER_ENTRY, "--", ...process.argv.slice(2)], {
-      // inherit keeps the SAME fds, so MCP's newline-delimited JSON framing on
-      // stdin/stdout is untouched and the host's stdin-close still reaches the
-      // server's shutdown path.
-      stdio: "inherit",
-      env: process.env,
-      windowsHide: true,
-    });
-
-    // If oam cannot be executed at all (deleted between the stat and the spawn,
-    // wrong arch, permission), fall back rather than failing the whole server.
-    // `spawned` prevents falling back AFTER the child started, which would
-    // double-start the server on the same stdio.
-    let spawned = false;
-    child.on("spawn", () => {
-      spawned = true;
-    });
-    child.on("error", (err) => {
-      if (spawned) return;
+    // Every "oam could not be executed" outcome lands here: the synchronous
+    // throw from spawn() and the async 'error' event mean the same thing and
+    // must degrade the same way, so the handling lives in one place.
+    // errSync rather than process.stderr.write because stderr is async for
+    // TTYs and pipes on Windows and the process.exit below truncates pending
+    // writes.
+    const launchFailed = async (err) => {
       if (mode === "oam") {
-        process.stderr.write(`tailscale-mcp: failed to launch oam (${err.message})\n`);
+        await errSync(`tailscale-mcp: failed to launch oam (${err?.message ?? err})\n`);
         process.exit(1);
       }
-      void runInProcess();
-    });
+      await runInProcess();
+    };
+
+    // ONE reporter shared by both launchFailed call sites, so the sync-throw
+    // path and the 'error'-event path cannot drift apart. Either can reject:
+    // runInProcess() is a bare import() that rejects when dist/index.js is
+    // missing, and at ESM top level an unhandled rejection is an uncaught
+    // exception -- the exact failure this handling exists to prevent.
+    const fallbackFailed = (e) => {
+      process.stderr.write(`tailscale-mcp: fallback to Node failed (${e?.message ?? e})\n`);
+      process.exitCode = 1;
+    };
 
-    // Forward termination so the server's own shutdown path runs in the child
-    // rather than the child being orphaned. No-op on Windows, harmless to add.
-    for (const sig of ["SIGINT", "SIGTERM"]) {
-      process.on(sig, () => {
-        if (!child.killed) child.kill(sig);
+    let child = null;
+    try {
+      child = spawn(oam, [...sandboxFlags(), "run", SERVER_ENTRY, "--", ...process.argv.slice(2)], {
+        // inherit keeps the SAME fds, so MCP's newline-delimited JSON framing on
+        // stdin/stdout is untouched and the host's stdin-close still reaches the
+        // server's shutdown path.
+        stdio: "inherit",
+        env: process.env,
+        windowsHide: true,
       });
+    } catch (err) {
+      // spawn() THROWS for some failures instead of emitting 'error', and the
+      // 'error' listener is registered AFTER this call, so it can never observe
+      // one -- an uncaught throw here kills the launcher with a raw stack trace
+      // instead of falling back to Node.
+      await launchFailed(err).catch(fallbackFailed);
     }
 
-    child.on("exit", (code, signal) => {
-      // Mirror the child's fate: a signal death becomes 128+n so callers see a
-      // conventional shell exit status rather than a bare 0.
-      if (signal) {
-        process.exit(128 + (constants.signals[signal] ?? 15));
+    if (child) {
+      // If oam cannot be executed at all (deleted between the stat and the spawn,
+      // wrong arch, permission), fall back rather than failing the whole server.
+      // `spawned` prevents falling back AFTER the child started, which would
+      // double-start the server on the same stdio.
+      let spawned = false;
+      child.on("spawn", () => {
+        spawned = true;
+      });
+      child.on("error", (err) => {
+        if (spawned) return;
+        // Handle the rejection instead of discarding it: a failing in-process
+        // fallback would otherwise escape as an unhandled rejection, replacing
+        // this launcher's diagnostic with a raw stack trace.
+        launchFailed(err).catch(fallbackFailed);
+      });
+
+      // Forward termination so the server's own shutdown path runs in the child
+      // rather than the child being orphaned.
+      //
+      // Registering ANY handler for these suppresses Node's default
+      // terminate-on-signal, so the parent's exit has to be arranged explicitly.
+      // `child.killed` only records that kill() was CALLED, never that the child
+      // is gone, so gating on it swallows every signal after the first and wedges
+      // the launcher with no escape hatch.
+      //
+      // Escalation is driven by a TIMER, not by counting signals. Counting is
+      // ambiguous: a supervisor routinely sends SIGINT then SIGTERM milliseconds
+      // apart, and a terminal Ctrl-C reaches the whole process group, so reading
+      // "a second signal" as impatience hard-kills a child that is already
+      // shutting down cleanly. A timer makes the count irrelevant -- ONE press is
+      // enough, and a wedged child dies on schedule. setTimeout is monotonic, so
+      // a wall-clock step cannot mis-gate the window either.
+      //
+      // POSIX vs Windows, and why we do NOT forward on Windows.
+      // On POSIX child.kill(sig) delivers a real, catchable signal, so forwarding
+      // is what lets the child run its shutdown. On Windows there are no POSIX
+      // signals: child.kill IGNORES the name and calls TerminateProcess -- an
+      // immediate hard kill (verified: a child with a SIGTERM handler never runs
+      // it and dies with code=null, signal=SIGTERM). Forwarding there ABORTS the
+      // graceful shutdown the console's own Ctrl-C just started, skipping the
+      // child's process.on("exit") cleanup. The console has already notified the
+      // child, so on Windows the timer below is the only kill we issue.
+      const ESCALATE_AFTER_MS = 2000;
+      let escalation = null;
+      for (const sig of ["SIGINT", "SIGTERM"]) {
+        process.on(sig, () => {
+          // No try/catch: kill() on an already-exited child returns false, it does
+          // not throw. It throws only for a signal the platform does not know,
+          // which SIGINT/SIGTERM/SIGKILL never are.
+          if (!isWin) child.kill(sig);
+          if (escalation) return; // already counting down; further signals are noise
+          escalation = setTimeout(() => {
+            // Still here after its grace window. Stop waiting on it.
+            child.kill("SIGKILL");
+            process.exit(128 + (constants.signals[sig] ?? 15));
+          }, ESCALATE_AFTER_MS);
+        });
       }
-      process.exit(code ?? 0);
-    });
+
+      child.on("exit", (code, signal) => {
+        if (escalation) clearTimeout(escalation);
+        // Mirror the child's fate: a signal death becomes 128+n so callers see a
+        // conventional shell exit status rather than a bare 0.
+        if (signal) {
+          process.exit(128 + (constants.signals[signal] ?? 15));
+        }
+        process.exit(code ?? 0);
+      });
+    }
   }
 }

package/dist/index.js

@@ -31035,6 +31035,11 @@ async function getOAuthAccessToken(clientId, clientSecret) {
   })();
   return oauthRefreshPromise;
 }
+function invalidateOAuthTokenOnUnauthorized(authorizationHeader) {
+  if (!oauthToken) return;
+  if (authorizationHeader !== `Bearer ${oauthToken.access_token}`) return;
+  oauthToken = null;
+}
 async function getAuthHeader() {
   const config2 = getAuthConfig();
   if (config2.kind === "apiKey") {
@@ -31130,14 +31135,17 @@ function getRetryBaseDelayMs() {
 }
 async function withConcurrencyLimit(fn) {
   const limit = getConcurrencyLimit();
-  if (limit === 0) return fn();
+  if (limit === 0) return fn(0);
+  let queuedForMs = 0;
   if (inFlight >= limit) {
+    const queueStartedAt = Date.now();
     await new Promise((resolve) => concurrencyQueue.push(resolve));
+    queuedForMs = Date.now() - queueStartedAt;
   } else {
     inFlight++;
   }
   try {
-    return await fn();
+    return await fn(queuedForMs);
   } finally {
     const next = concurrencyQueue.shift();
     if (next) {
@@ -31188,6 +31196,15 @@ function describeTransportError(err, method, attemptTimeoutMs) {
   }
   return `${method} request failed: ${String(err)}`;
 }
+function describeBudgetExhaustion(budgetMs, queuedForMs, lastTransportError) {
+  if (lastTransportError) {
+    return `${lastTransportError}; request budget of ${budgetMs}ms exhausted before next attempt could begin.`;
+  }
+  if (queuedForMs > 0) {
+    return `Request budget of ${budgetMs}ms exhausted before attempt could begin: ${queuedForMs}ms of it was spent waiting for a free slot under TAILSCALE_MAX_CONCURRENT, so no request was ever sent. Raise TAILSCALE_MAX_CONCURRENT or TAILSCALE_REQUEST_BUDGET_MS -- this is queueing, not a network fault.`;
+  }
+  return `Request budget of ${budgetMs}ms exhausted before attempt could begin.`;
+}
 async function apiRequest(method, path, body, options) {
   const headers = {};
   if (options?.accept) {
@@ -31217,7 +31234,7 @@ async function apiRequest(method, path, body, options) {
   debugLog(`${method} ${url2}`);
   const isRetryable = RETRYABLE_METHODS.has(method.toUpperCase());
   const requestBudgetMs = getRequestBudgetMs();
-  return withConcurrencyLimit(async () => {
+  return withConcurrencyLimit(async (queuedForMs) => {
     headers.Authorization = await getAuthHeader();
     let res;
     let lastTransportError;
@@ -31227,7 +31244,7 @@ async function apiRequest(method, path, body, options) {
         return {
           ok: false,
           status: 0,
-          error: lastTransportError ? `${lastTransportError}; request budget of ${requestBudgetMs}ms exhausted before next attempt could begin.` : `Request budget of ${requestBudgetMs}ms exhausted before attempt could begin.`
+          error: describeBudgetExhaustion(requestBudgetMs, queuedForMs, lastTransportError)
         };
       }
       const attemptTimeoutMs = Math.min(REQUEST_TIMEOUT_MS, remaining);
@@ -31268,6 +31285,9 @@ async function apiRequest(method, path, body, options) {
     const etag = response.headers.get("etag") || void 0;
     const elapsed = Date.now() - startedAt;
     debugLog(`  <- ${response.status} (${elapsed}ms)`);
+    if (response.status === 401) {
+      invalidateOAuthTokenOnUnauthorized(headers.Authorization);
+    }
     try {
       if (options?.acceptRaw) {
         const rawBody = await response.text();
@@ -31442,6 +31462,18 @@ function filterTools(groups, options) {
 }
 
 // src/tools/acl.ts
+var ETAG_FOOTER_MARKER = "// ETag: ";
+function stripEtagFooter(body) {
+  const lines = body.split("\n");
+  let cut = lines.length;
+  for (let i = lines.length - 1; i >= 0; i--) {
+    const line = lines[i].trim();
+    if (line === "") continue;
+    if (!line.startsWith("//")) break;
+    if (line.startsWith(ETAG_FOOTER_MARKER)) cut = i;
+  }
+  return lines.slice(0, cut).join("\n");
+}
 var aclTools = [
   {
     name: "tailscale_get_acl",
@@ -31462,12 +31494,12 @@ var aclTools = [
       if (res.ok && res.etag) {
         const footer = [
           "",
-          `// ETag: ${res.etag}`,
+          `${ETAG_FOOTER_MARKER}${res.etag}`,
           "// Pass this ETag to tailscale_update_acl when updating the policy.",
           "// (HuJSON treats // as a comment \u2014 safe to leave in or strip before re-submitting.)",
           ""
         ].join("\n");
-        return { ...res, rawBody: `${res.rawBody ?? ""}${footer}` };
+        return { ...res, rawBody: `${stripEtagFooter(res.rawBody ?? "")}${footer}` };
       }
       return res;
     }
@@ -31478,7 +31510,10 @@ var aclTools = [
     annotations: {
       title: "Update ACL policy",
       readOnlyHint: false,
-      destructiveHint: false,
+      // Overwrites the whole policy file in one call, and a bad push can lock
+      // every device out of the tailnet -- the widest blast radius of any write
+      // here, so clients must gate it rather than auto-approve it.
+      destructiveHint: true,
       idempotentHint: true,
       openWorldHint: true
     },
@@ -31486,8 +31521,16 @@ var aclTools = [
       policy: external_exports.string().describe(
         "The full ACL policy text. Preserve existing formatting, comments, and structure. Only modify the specific parts that need to change."
       ),
-      etag: external_exports.string().describe("The ETag from tailscale_get_acl. Required to prevent concurrent edit conflicts.")
+      etag: external_exports.string().trim().min(1, "etag must not be empty -- an empty ETag would send this overwrite with no concurrency guard.").describe("The ETag from tailscale_get_acl. Required to prevent concurrent edit conflicts.")
     }),
+    // `.trim().min(1)`, not a bare `z.string()`: apiRequest sets If-Match behind
+    // `if (options?.ifMatch)`, so an empty etag is falsy there and the header is
+    // omitted entirely -- the write then overwrites a concurrent admin edit instead
+    // of coming back 412, on the widest-blast-radius write in the package, with
+    // no diagnostic anywhere. `.trim()` is load-bearing for the same reason it is
+    // on tailnets.ts's ids: a bare `.min(1)` accepts " ", which is truthy, so the
+    // header goes out carrying a precondition that cannot match any real ETag --
+    // a confusing 412 instead of a local validation error naming the field.
     handler: async (input) => {
       return apiPost(`/tailnet/${getTailnet()}/acl`, void 0, {
         rawBody: input.policy,
@@ -31805,7 +31848,9 @@ var deviceTools = [
     annotations: {
       title: "Set device routes",
       readOnlyHint: false,
-      destructiveHint: false,
+      // Replace-all: the routes array is the new enabled set, so `[]` silently
+      // withdraws every subnet the device currently routes.
+      destructiveHint: true,
       idempotentHint: true,
       openWorldHint: true
     },
@@ -31890,7 +31935,9 @@ var deviceTools = [
     annotations: {
       title: "Set device tags",
       readOnlyHint: false,
-      destructiveHint: false,
+      // Replace-all: `[]` strips every ACL tag, which can drop the device out of
+      // the policy rules that grant it access.
+      destructiveHint: true,
       idempotentHint: true,
       openWorldHint: true
     },
@@ -31969,7 +32016,7 @@ var deviceTools = [
       const failed = {};
       for (const { deviceId, res } of results) {
         if (res.ok) succeeded.push(deviceId);
-        else failed[deviceId] = { status: res.status, error: res.error ?? `HTTP ${res.status}` };
+        else failed[deviceId] = { status: res.status, error: res.error || `HTTP ${res.status}` };
       }
       const failedCount = Object.keys(failed).length;
       if (failedCount === unique.length) {
@@ -32053,7 +32100,9 @@ var dnsTools = [
     annotations: {
       title: "Set nameservers",
       readOnlyHint: false,
-      destructiveHint: false,
+      // Replace-all: `[]` clears tailnet DNS resolution rather than leaving the
+      // current nameservers in place.
+      destructiveHint: true,
       idempotentHint: true,
       openWorldHint: true
     },
@@ -32085,7 +32134,8 @@ var dnsTools = [
     annotations: {
       title: "Set DNS search paths",
       readOnlyHint: false,
-      destructiveHint: false,
+      // Replace-all: `[]` clears every configured search domain.
+      destructiveHint: true,
       idempotentHint: true,
       openWorldHint: true
     },
@@ -32119,7 +32169,9 @@ var dnsTools = [
     annotations: {
       title: "Set split DNS",
       readOnlyHint: false,
-      destructiveHint: false,
+      // Replace-all (PUT): every domain absent from the map is dropped, so `{}`
+      // clears the whole split DNS config. The PATCH sibling below merges instead.
+      destructiveHint: true,
       idempotentHint: true,
       openWorldHint: true
     },
@@ -32206,7 +32258,9 @@ var dnsTools = [
     annotations: {
       title: "Set DNS configuration (unified)",
       readOnlyHint: false,
-      destructiveHint: false,
+      // Replace-all across every DNS setting at once -- a superset of the wipe
+      // the individual setters above can do.
+      destructiveHint: true,
       idempotentHint: true,
       openWorldHint: true
     },
@@ -32663,6 +32717,48 @@ var keyTools = [
     handler: async (input) => {
       return apiGet(`/tailnet/${getTailnet()}/oauth-apps/${encPath(input.appId)}`);
     }
+  },
+  {
+    name: "tailscale_list_oauth_apps",
+    description: "List the OAuth Apps registered in your tailnet (Tailscale alpha). Returns an `oauthApps` array describing each app (id, name, redirect URIs, scopes). Client secrets are NOT included -- a secret is only returned once, by tailscale_create_oauth_app at creation time. This is how you recover the id of an app you did not record; pass that id to tailscale_delete_oauth_app to revoke it.",
+    annotations: {
+      title: "List OAuth apps",
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: true
+    },
+    // No limit/cursor: the live endpoint takes no parameters and returns the
+    // whole collection. Advertising pagination the API ignores would let a
+    // caller believe it had paged through the list when it had not.
+    inputSchema: external_exports.object({}),
+    handler: async () => {
+      return apiGet(`/tailnet/${getTailnet()}/oauth-apps`);
+    }
+  },
+  {
+    name: "tailscale_delete_oauth_app",
+    description: "Delete an OAuth App (Tailscale alpha). This is irreversible: the app's client secret stops working immediately and any integration using it loses its device-enrollment path, so no further device can be authorized through it. Devices already enrolled stay in the tailnet, exactly as they do when the auth key that added them is deleted. Use tailscale_list_oauth_apps to find the id.",
+    annotations: {
+      title: "Delete OAuth app",
+      readOnlyHint: false,
+      destructiveHint: true,
+      idempotentHint: true,
+      openWorldHint: true
+    },
+    inputSchema: external_exports.object({
+      // `.trim().min(1)` rather than the bare `.min(1)` on
+      // tailscale_get_oauth_app's appId, for the reason tailnets.ts spells out
+      // on tailscale_delete_tailnet: a bare min(1) accepts " ", which encPath
+      // then sends as the literal segment "%20". On a read that costs a wasted
+      // round-trip; on an irreversible revoke it returns a 404 that reads like
+      // the app is already gone. Trimming at the schema makes it a validation
+      // error instead.
+      appId: external_exports.string().trim().min(1).describe("The OAuth app ID to delete (see tailscale_list_oauth_apps)")
+    }),
+    handler: async (input) => {
+      return apiDelete(`/tailnet/${getTailnet()}/oauth-apps/${encPath(input.appId)}`);
+    }
   }
 ];
 
@@ -32866,8 +32962,8 @@ var logStreamingTools = [
         apiGet(`/tailnet/${getTailnet()}/logging/network/stream`)
       ]);
       const errors = {};
-      if (!configuration.ok) errors.configuration = configuration.error ?? `HTTP ${configuration.status}`;
-      if (!network.ok) errors.network = network.error ?? `HTTP ${network.status}`;
+      if (!configuration.ok) errors.configuration = configuration.error || `HTTP ${configuration.status}`;
+      if (!network.ok) errors.network = network.error || `HTTP ${network.status}`;
       if (!configuration.ok && !network.ok) {
         return {
           ok: false,
@@ -33353,8 +33449,8 @@ function composeTailnetStatusData(devicesRes, settingsRes, extras = {}) {
     settings: settingsRes.ok ? settingsRes.data : null
   };
   const errors = {};
-  if (!devicesRes.ok) errors.devices = devicesRes.error ?? `HTTP ${devicesRes.status}`;
-  if (!settingsRes.ok) errors.settings = settingsRes.error ?? `HTTP ${settingsRes.status}`;
+  if (!devicesRes.ok) errors.devices = devicesRes.error || `HTTP ${devicesRes.status}`;
+  if (!settingsRes.ok) errors.settings = settingsRes.error || `HTTP ${settingsRes.status}`;
   if (Object.keys(errors).length > 0) data.errors = errors;
   return data;
 }
@@ -33486,7 +33582,7 @@ var tailnetTools = [
       const failed = {};
       for (const { contactType, res } of results) {
         if (res.ok) applied[contactType] = res.data;
-        else failed[contactType] = { status: res.status, error: res.error ?? `HTTP ${res.status}` };
+        else failed[contactType] = { status: res.status, error: res.error || `HTTP ${res.status}` };
       }
       const hasFailed = Object.keys(failed).length > 0;
       const hasApplied = Object.keys(applied).length > 0;
@@ -33573,7 +33669,7 @@ var tailnetsTools = [
   },
   {
     name: "tailscale_delete_tailnet",
-    description: "Permanently delete a tailnet. This is IRREVERSIBLE and removes every device, user, ACL, and key in it.\n\nBy default it acts on the tailnet the current credentials point at (TAILSCALE_TAILNET, or TAILSCALE_OAUTH_TAILNET when targeting an API-only tailnet). Pass `tailnet` to name a different one -- e.g. an id returned by tailscale_list_org_tailnets -- which requires credentials scoped to reach it; UNVERIFIED against a live tailnet, so expect a 403/404 if your token cannot. You must always pass `confirmTailnet` matching the effective target exactly; the call is refused locally otherwise. Intended for tearing down API-only tailnets created by tailscale_create_org_tailnet.",
+    description: "Permanently delete a tailnet. This is IRREVERSIBLE and removes every device, user, ACL, and key in it.\n\nBy default it acts on the tailnet the current credentials point at (TAILSCALE_TAILNET, or TAILSCALE_OAUTH_TAILNET when targeting an API-only tailnet). Pass `tailnet` to name a different one -- e.g. an id returned by tailscale_list_org_tailnets -- which requires credentials scoped to reach it; UNVERIFIED against a live tailnet, so expect a 403/404 if your token cannot. You must always pass `confirmTailnet` matching the effective target exactly; the call is refused locally otherwise. That check is a typo guard, not an authorization gate: when you also pass `tailnet` you are supplying both halves of the comparison, so it proves only that they agree -- it is a genuine second look only on the omit-`tailnet` path, where the value has to match the operator's environment. Restricting who may delete at all is TAILSCALE_READONLY / TAILSCALE_TOOLS, which drop this tool from the server entirely. Intended for tearing down API-only tailnets created by tailscale_create_org_tailnet.",
     annotations: {
       title: "Delete tailnet",
       readOnlyHint: false,
@@ -33586,7 +33682,7 @@ var tailnetsTools = [
         "Tailnet to delete (e.g. an id from tailscale_list_org_tailnets). Omit to target the configured tailnet. Requires credentials scoped to reach it."
       ),
       confirmTailnet: external_exports.string().trim().min(1).describe(
-        "Must exactly match the effective target -- `tailnet` when given, otherwise the configured tailnet (TAILSCALE_TAILNET / TAILSCALE_OAUTH_TAILNET). A deliberate second look before an irreversible org-wide delete."
+        "Must exactly match the effective target -- `tailnet` when given, otherwise the configured tailnet (TAILSCALE_TAILNET / TAILSCALE_OAUTH_TAILNET). A typo guard, not an authorization gate: on the explicit-`tailnet` path the caller writes both halves of the comparison, so it proves only self-agreement. It is a real second look only when `tailnet` is omitted and the value has to match the operator's environment."
       )
     }),
     // `.trim().min(1)` on both fields, not just `.min(1)`: a bare min(1) accepts
@@ -33604,8 +33700,9 @@ var tailnetsTools = [
         );
       }
       if (input.confirmTailnet !== target) {
+        const source = input.tailnet?.trim() ? "tailnet you named" : "configured tailnet";
         throw new Error(
-          `confirmTailnet ${JSON.stringify(input.confirmTailnet)} does not match the configured tailnet ${JSON.stringify(target)}. Refusing to delete.`
+          `confirmTailnet ${JSON.stringify(input.confirmTailnet)} does not match the ${source} ${JSON.stringify(target)}. Refusing to delete.`
         );
       }
       return apiDelete(`/tailnet/${encPath(target)}`);
@@ -34011,7 +34108,7 @@ async function tailnetStatusResource(uri) {
 }
 async function tailnetDevicesResource(uri) {
   const res = await apiGet(`/tailnet/${getTailnet()}/devices`);
-  const text = res.ok ? JSON.stringify(res.data, null, 2) : JSON.stringify({ error: res.error ?? `HTTP ${res.status}` }, null, 2);
+  const text = res.ok ? JSON.stringify(res.data, null, 2) : JSON.stringify({ error: res.error || `HTTP ${res.status}` }, null, 2);
   return { contents: [{ uri: uri.href, text, mimeType: "application/json" }] };
 }
 async function tailnetAclResource(uri) {
@@ -34019,7 +34116,7 @@ async function tailnetAclResource(uri) {
   if (res.ok) {
     return { contents: [{ uri: uri.href, text: res.rawBody ?? "", mimeType: "application/hujson" }] };
   }
-  const lines = `Error: ${res.error ?? `HTTP ${res.status}`}`.split("\n");
+  const lines = `Error: ${res.error || `HTTP ${res.status}`}`.split("\n");
   const text = `${lines.map((l) => `// ${l}`).join("\n")}
 `;
   return { contents: [{ uri: uri.href, text, mimeType: "application/hujson" }] };
@@ -34038,16 +34135,16 @@ async function tailnetDnsResource(uri) {
     preferences: preferences.ok ? preferences.data : null
   };
   const errors = {};
-  if (!nameservers.ok) errors.nameservers = nameservers.error ?? `HTTP ${nameservers.status}`;
-  if (!searchPaths.ok) errors.searchPaths = searchPaths.error ?? `HTTP ${searchPaths.status}`;
-  if (!splitDns.ok) errors.splitDns = splitDns.error ?? `HTTP ${splitDns.status}`;
-  if (!preferences.ok) errors.preferences = preferences.error ?? `HTTP ${preferences.status}`;
+  if (!nameservers.ok) errors.nameservers = nameservers.error || `HTTP ${nameservers.status}`;
+  if (!searchPaths.ok) errors.searchPaths = searchPaths.error || `HTTP ${searchPaths.status}`;
+  if (!splitDns.ok) errors.splitDns = splitDns.error || `HTTP ${splitDns.status}`;
+  if (!preferences.ok) errors.preferences = preferences.error || `HTTP ${preferences.status}`;
   if (Object.keys(errors).length > 0) data.errors = errors;
   return { contents: [{ uri: uri.href, text: JSON.stringify(data, null, 2), mimeType: "application/json" }] };
 }
 
 // src/index.ts
-var version2 = true ? "0.17.0" : resolveVersionFallback();
+var version2 = true ? "0.18.0" : resolveVersionFallback();
 var subcommand = process.argv[2];
 var cliSubcommandHandled = false;
 if (subcommand === "deploy-acl" || subcommand === "validate-acl") {
@@ -34104,7 +34201,7 @@ if (!cliSubcommandHandled) {
   }
   if (unknownProfile) {
     console.error(
-      `@yawlabs/tailscale-mcp: TAILSCALE_PROFILE="${unknownProfile}" is not a known profile. Valid profiles: minimal, core, full. Falling back to no profile filter.`
+      `@yawlabs/tailscale-mcp: TAILSCALE_PROFILE="${unknownProfile}" is not a known profile. Valid profiles: ${Object.keys(PROFILES).join(", ")}. Falling back to no profile filter.`
     );
   }
   const server = new McpServer({
@@ -34165,7 +34262,7 @@ if (!cliSubcommandHandled) {
     const coreCount = profileCount(PROFILES.core);
     const minimalCount = profileCount(PROFILES.minimal);
     console.error(
-      `@yawlabs/tailscale-mcp: tip \u2014 set TAILSCALE_PROFILE=core (${coreCount} tools) or =minimal (${minimalCount}) to load a smaller tool surface. See README.`
+      `@yawlabs/tailscale-mcp: tip -- set TAILSCALE_PROFILE=core (${coreCount} tools) or =minimal (${minimalCount}) to load a smaller tool surface. See README.`
     );
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yawlabs/tailscale-mcp",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "mcpName": "io.github.YawLabs/tailscale-mcp",
   "description": "Tailscale MCP server for managing your tailnet from AI assistants",
   "license": "MIT",
@@ -33,10 +33,11 @@
     "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",
     "dev": "tsc --watch",
     "start": "node dist/index.js",
-    "test": "npm run build && node --test \"dist/**/*.test.js\"",
+    "test": "npm run build && node --test-timeout=300000 --test \"dist/**/*.test.js\"",
     "test:ci": "npm run test",
-    "lint": "biome check src/",
-    "lint:fix": "biome check --write src/",
+    "test:coverage": "npm run build && node --test-timeout=300000 --experimental-test-coverage --test-coverage-exclude=\"**/*.test.js\" --test-coverage-exclude=\"**/dist/index.js\" --test \"dist/**/*.test.js\"",
+    "lint": "biome check src/ bin/ scripts/ build.mjs",
+    "lint:fix": "biome check --write src/ bin/ scripts/ build.mjs",
     "check:oam": "oam check src/index.ts",
     "build:binary": "node scripts/build-binary.mjs",
     "build:binary:oam": "node scripts/build-binary-oam.mjs",
@@ -59,7 +60,7 @@
     "zod": "^4.3.6"
   },
   "engines": {
-    "node": ">=20"
+    "node": ">=20.11.0"
   },
   "devEngines": {
     "runtime": {