@yawlabs/tailscale-mcp 0.22.0 → 0.23.0

package/README.md

@@ -152,7 +152,7 @@ Profile names are case-insensitive and ignore surrounding whitespace (`Core` sel
 
 Comma-separated group names. Overrides `TAILSCALE_PROFILE` when both are set — use this when the presets aren't quite right.
 
-Valid group names: `status`, `devices`, `acl`, `dns`, `keys`, `users`, `tailnet`, `webhooks`, `posture`, `audit`, `invites`, `services`, `log-streaming`. The `local-cli` group is also available, but only when `TAILSCALE_LOCAL_CLI=1` is set — see [Local CLI integration](#local-cli-integration-opt-in).
+Valid group names: `status`, `devices`, `acl`, `dns`, `keys`, `users`, `tailnet`, `org-tailnets`, `webhooks`, `posture`, `audit`, `invites`, `services`, `log-streaming`. The `local-cli` group is also available, but only when `TAILSCALE_LOCAL_CLI=1` is set — see [Local CLI integration](#local-cli-integration-opt-in).
 
 ### Option 3: `TAILSCALE_READONLY` (drop mutations)
 
@@ -172,13 +172,13 @@ Set to `1` or `true` to drop every tool without `readOnlyHint: true`. Stacks wit
 The server logs the active filter to stderr on startup:
 
 ```
-@yawlabs/tailscale-mcp v0.12.0 ready (20 tools, profile=minimal, readonly)
+@yawlabs/tailscale-mcp v0.22.0 ready (20 tools, profile=minimal, readonly)
 ```
 
 When both `TAILSCALE_PROFILE` and `TAILSCALE_TOOLS` are set, `TAILSCALE_TOOLS` wins. The banner marks the profile as overridden so the precedence is obvious at a glance — no need to guess which filter actually applied:
 
 ```
-@yawlabs/tailscale-mcp v0.12.0 ready (22 tools, profile=core (overridden by TAILSCALE_TOOLS), groups=devices,acl)
+@yawlabs/tailscale-mcp v0.22.0 ready (22 tools, profile=core (overridden by TAILSCALE_TOOLS), groups=devices,acl)
 ```
 
 The "(overridden)" marker only fires for substantive profiles (`minimal` / `core`); `profile=full` is a no-op preset, so it's shown without the marker when `TAILSCALE_TOOLS` is also set.
@@ -286,7 +286,7 @@ Names are case-sensitive, matching `TAILSCALE_TOOLS`.
 The startup banner shows what applied:
 
 ```
-@yawlabs/tailscale-mcp v0.19.0 ready (59 tools, write=devices,keys)
+@yawlabs/tailscale-mcp v0.22.0 ready (59 tools, write=devices,keys)
 ```
 
 ## Requiring approval on irreversible tools
@@ -417,7 +417,7 @@ Requirements: the `tailscale` binary has to be findable. It's looked up on `PATH
 
 The MCP server doesn't need root to run these — they're all diagnostic, not state-mutating. Operations that would need elevation (`tailscale up`, `set --advertise-routes`, `lock sign`) are deliberately not exposed.
 
-When opt-in is on, the startup banner reflects it: `@yawlabs/tailscale-mcp v0.13.3 ready (103 tools, local-cli=on)` — the 6 local CLI tools are additive on top of the default 97.
+When opt-in is on, the startup banner reflects it: `@yawlabs/tailscale-mcp v0.22.0 ready (103 tools, local-cli=on)` — the 6 local CLI tools are additive on top of the default 97.
 
 ## Resources (4)
 

package/bin/tailscale-mcp.mjs

@@ -401,7 +401,7 @@ function sandboxFlags() {
   // TEMP), TMP its POSIX-style twin, APPDATA and LOCALAPPDATA where Windows
   // programs keep per-user state, and HOME the POSIX home directory. Granting a
   // name that is not set is harmless: it stays absent. WSL_DISTRO_NAME is the
-  // server's own: local-cli.ts reads it to recognise WSL when the CLI is
+  // server's own: local-cli-runner.ts reads it to recognise WSL when the CLI is
   // missing, and its fallback, /proc/version, is a file read the sandbox denies.
   const env = [
     "APPDATA",

package/dist/index.js

@@ -33263,7 +33263,7 @@ var userTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      userId: external_exports.string().describe("The user ID")
+      userId: external_exports.string().trim().min(1).describe("The user ID")
     }),
     handler: async (input) => {
       return apiGet(`/users/${encPath(input.userId)}`);
@@ -33280,7 +33280,7 @@ var userTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      userId: external_exports.string().describe("The user ID to approve")
+      userId: external_exports.string().trim().min(1).describe("The user ID to approve")
     }),
     handler: async (input) => {
       return apiPost(`/users/${encPath(input.userId)}/approve`);
@@ -33297,7 +33297,10 @@ var userTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      userId: external_exports.string().describe("The user ID to suspend")
+      // `.trim().min(1)`, not a bare string: a whitespace-only user id encodes
+      // to "%20" and suspend returns a 404 that reads like the user is already
+      // gone when it is not (rationale: tailnets.ts delete_tailnet).
+      userId: external_exports.string().trim().min(1).describe("The user ID to suspend")
     }),
     handler: async (input) => {
       return apiPost(`/users/${encPath(input.userId)}/suspend`);
@@ -33314,7 +33317,7 @@ var userTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      userId: external_exports.string().describe("The user ID to restore")
+      userId: external_exports.string().trim().min(1).describe("The user ID to restore")
     }),
     handler: async (input) => {
       return apiPost(`/users/${encPath(input.userId)}/restore`);
@@ -33331,7 +33334,7 @@ var userTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      userId: external_exports.string().describe("The user ID"),
+      userId: external_exports.string().trim().min(1).describe("The user ID"),
       role: external_exports.enum(USER_ROLES).describe("The new role to assign")
     }),
     handler: async (input) => {
@@ -33374,7 +33377,7 @@ var inviteTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      deviceId: external_exports.string().describe(`The device ID to list invites for. ${DEVICE_ID_HINT}`)
+      deviceId: external_exports.string().trim().min(1).describe(`The device ID to list invites for. ${DEVICE_ID_HINT}`)
     }),
     handler: async (input) => {
       return apiGet(`/device/${encPath(input.deviceId)}/device-invites`);
@@ -33391,7 +33394,7 @@ var inviteTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      deviceId: external_exports.string().describe(`The device ID to create an invite for. ${DEVICE_ID_HINT}`),
+      deviceId: external_exports.string().trim().min(1).describe(`The device ID to create an invite for. ${DEVICE_ID_HINT}`),
       multiUse: external_exports.boolean().optional().describe("Whether the invite can be used more than once (default: false)"),
       allowExitNode: external_exports.boolean().optional().describe("Whether the invited device can be used as an exit node (default: false)"),
       email: external_exports.email().optional().describe("Email address to send the invite to")
@@ -33418,7 +33421,7 @@ var inviteTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      inviteId: external_exports.string().describe("The device invite ID")
+      inviteId: external_exports.string().trim().min(1).describe("The device invite ID")
     }),
     handler: async (input) => {
       return apiGet(`/device-invites/${encPath(input.inviteId)}`);
@@ -33435,7 +33438,10 @@ var inviteTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      inviteId: external_exports.string().describe("The device invite ID to delete")
+      inviteId: external_exports.string().trim().min(1).describe("The device invite ID to delete")
+      // `.trim().min(1)`, not a bare string: a whitespace-only inviteId encodes
+      // to "%20" and this irreversible delete returns a 404 that reads like the
+      // invite is already gone (rationale: tailnets.ts delete_tailnet).
     }),
     handler: async (input) => {
       return apiDelete(`/device-invites/${encPath(input.inviteId)}`);
@@ -33509,7 +33515,7 @@ var inviteTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      inviteId: external_exports.string().describe("The user invite ID")
+      inviteId: external_exports.string().trim().min(1).describe("The user invite ID")
     }),
     handler: async (input) => {
       return apiGet(`/user-invites/${encPath(input.inviteId)}`);
@@ -33526,7 +33532,10 @@ var inviteTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      inviteId: external_exports.string().describe("The user invite ID to delete")
+      inviteId: external_exports.string().trim().min(1).describe("The user invite ID to delete")
+      // `.trim().min(1)`, not a bare string: a whitespace-only inviteId encodes
+      // to "%20" and this irreversible delete returns a 404 that reads like the
+      // invite is already gone (rationale: tailnets.ts delete_tailnet).
     }),
     handler: async (input) => {
       return apiDelete(`/user-invites/${encPath(input.inviteId)}`);
@@ -33544,7 +33553,7 @@ var inviteTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      inviteId: external_exports.string().describe("The device invite ID to resend")
+      inviteId: external_exports.string().trim().min(1).describe("The device invite ID to resend")
     }),
     handler: async (input) => {
       return apiPost(`/device-invites/${encPath(input.inviteId)}/resend`);
@@ -33562,7 +33571,7 @@ var inviteTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      inviteId: external_exports.string().describe("The user invite ID to resend")
+      inviteId: external_exports.string().trim().min(1).describe("The user invite ID to resend")
     }),
     handler: async (input) => {
       return apiPost(`/user-invites/${encPath(input.inviteId)}/resend`);
@@ -33863,7 +33872,7 @@ var keyTools = [
 // src/tools/local-cli.ts
 import * as net2 from "node:net";
 
-// src/local-cli.ts
+// src/local-cli-runner.ts
 import { execFile as execFileCb } from "node:child_process";
 import { existsSync, readFileSync as readFileSync2 } from "node:fs";
 var DEFAULT_TIMEOUT_MS = 3e4;
@@ -33959,6 +33968,7 @@ async function runTailscaleCli(args, options = {}) {
         if (errno.code === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER") {
           resolve({
             ok: false,
+            kind: "output-limit",
             error: `'${binary} ${args.join(" ")}' exceeded the ${MAX_BUFFER_BYTES / 1024 / 1024} MB output limit and was aborted -- no output was captured. This usually means a very large tailnet; narrow the query if the command supports it.`
           });
           return;
@@ -33966,6 +33976,7 @@ async function runTailscaleCli(args, options = {}) {
         if (errno.killed) {
           resolve({
             ok: false,
+            kind: "timeout",
             error: `'${binary} ${args.join(" ")}' timed out after ${timeoutMs}ms`
           });
           return;
@@ -34029,10 +34040,10 @@ var localCliTools = [
       if (input.peers === false) args.push("--peers=false");
       if (input.activeOnly) args.push("--active");
       const result = await runTailscaleCli(args, { parseJson: true });
-      if (!result.ok && result.error?.includes("output limit")) {
+      if (!result.ok && result.kind === "output-limit") {
         return { ...result, error: `${result.error} Retry with peers:false or activeOnly:true.` };
       }
-      if (!result.ok && result.error?.includes("timed out after")) {
+      if (!result.ok && result.kind === "timeout") {
         return {
           ...result,
           error: `${result.error}. On a large tailnet this is usually the peer map -- retry with peers:false.`
@@ -34416,7 +34427,7 @@ var postureTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      integrationId: external_exports.string().describe("The posture integration ID")
+      integrationId: external_exports.string().trim().min(1).describe("The posture integration ID")
     }),
     handler: async (input) => {
       return apiGet(`/posture/integrations/${encPath(input.integrationId)}`);
@@ -34471,7 +34482,7 @@ var postureTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      integrationId: external_exports.string().describe("The posture integration ID to update"),
+      integrationId: external_exports.string().trim().min(1).describe("The posture integration ID to update"),
       clientId: external_exports.string().optional().describe("Updated client ID for the provider"),
       clientSecret: external_exports.string().optional().describe(
         "Updated client secret for the provider (omit to retain the existing secret). SENSITIVE: passed straight to Tailscale and not echoed back, but MCP clients may log the input value you supply."
@@ -34502,7 +34513,10 @@ var postureTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      integrationId: external_exports.string().describe("The posture integration ID to delete")
+      integrationId: external_exports.string().trim().min(1).describe("The posture integration ID to delete")
+      // `.trim().min(1)`, not a bare string: a whitespace-only integrationId
+      // encodes to "%20" and this irreversible delete returns a 404 that reads
+      // like the integration is already gone (rationale: tailnets.ts delete_tailnet).
     }),
     handler: async (input) => {
       return apiDelete(`/posture/integrations/${encPath(input.integrationId)}`);
@@ -34694,7 +34708,13 @@ var statusTools = [
     handler: async () => {
       const [devicesRes, settingsRes] = await fetchTailnetStatusInputs();
       if (!devicesRes.ok && !settingsRes.ok) {
-        return devicesRes;
+        if (settingsRes.error === devicesRes.error && settingsRes.status === devicesRes.status) {
+          return devicesRes;
+        }
+        return {
+          ...devicesRes,
+          error: `${devicesRes.error || `HTTP ${devicesRes.status}`} (the settings fetch also failed: ${settingsRes.error || `HTTP ${settingsRes.status}`})`
+        };
       }
       const data = composeTailnetStatusData(devicesRes, settingsRes, {
         connected: true,
@@ -35482,7 +35502,7 @@ Install a newer Node (https://nodejs.org/en/download), or point your MCP client'
   );
   process.exit(1);
 }
-var version2 = true ? "0.22.0" : resolveVersionFallback();
+var version2 = true ? "0.23.0" : resolveVersionFallback();
 var subcommand = process.argv[2];
 var USAGE = `Usage: tailscale-mcp [command]
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yawlabs/tailscale-mcp",
-  "version": "0.22.0",
+  "version": "0.23.0",
   "mcpName": "io.github.YawLabs/tailscale-mcp",
   "description": "Tailscale MCP server: admin-API tools for devices, ACLs, DNS, auth keys, users, and audit logs, plus a CLI to validate and deploy ACLs.",
   "license": "MIT",