@yawlabs/tailscale-mcp 0.22.0 → 0.23.1

package/README.md

@@ -152,7 +152,7 @@ Profile names are case-insensitive and ignore surrounding whitespace (`Core` sel
 
 Comma-separated group names. Overrides `TAILSCALE_PROFILE` when both are set — use this when the presets aren't quite right.
 
-Valid group names: `status`, `devices`, `acl`, `dns`, `keys`, `users`, `tailnet`, `webhooks`, `posture`, `audit`, `invites`, `services`, `log-streaming`. The `local-cli` group is also available, but only when `TAILSCALE_LOCAL_CLI=1` is set — see [Local CLI integration](#local-cli-integration-opt-in).
+Valid group names: `status`, `devices`, `acl`, `dns`, `keys`, `users`, `tailnet`, `org-tailnets`, `webhooks`, `posture`, `audit`, `invites`, `services`, `log-streaming`. The `local-cli` group is also available, but only when `TAILSCALE_LOCAL_CLI=1` is set — see [Local CLI integration](#local-cli-integration-opt-in).
 
 ### Option 3: `TAILSCALE_READONLY` (drop mutations)
 
@@ -172,13 +172,13 @@ Set to `1` or `true` to drop every tool without `readOnlyHint: true`. Stacks wit
 The server logs the active filter to stderr on startup:
 
 ```
-@yawlabs/tailscale-mcp v0.12.0 ready (20 tools, profile=minimal, readonly)
+@yawlabs/tailscale-mcp v0.22.0 ready (20 tools, profile=minimal, readonly)
 ```
 
 When both `TAILSCALE_PROFILE` and `TAILSCALE_TOOLS` are set, `TAILSCALE_TOOLS` wins. The banner marks the profile as overridden so the precedence is obvious at a glance — no need to guess which filter actually applied:
 
 ```
-@yawlabs/tailscale-mcp v0.12.0 ready (22 tools, profile=core (overridden by TAILSCALE_TOOLS), groups=devices,acl)
+@yawlabs/tailscale-mcp v0.22.0 ready (22 tools, profile=core (overridden by TAILSCALE_TOOLS), groups=devices,acl)
 ```
 
 The "(overridden)" marker only fires for substantive profiles (`minimal` / `core`); `profile=full` is a no-op preset, so it's shown without the marker when `TAILSCALE_TOOLS` is also set.
@@ -286,7 +286,7 @@ Names are case-sensitive, matching `TAILSCALE_TOOLS`.
 The startup banner shows what applied:
 
 ```
-@yawlabs/tailscale-mcp v0.19.0 ready (59 tools, write=devices,keys)
+@yawlabs/tailscale-mcp v0.22.0 ready (59 tools, write=devices,keys)
 ```
 
 ## Requiring approval on irreversible tools
@@ -417,7 +417,7 @@ Requirements: the `tailscale` binary has to be findable. It's looked up on `PATH
 
 The MCP server doesn't need root to run these — they're all diagnostic, not state-mutating. Operations that would need elevation (`tailscale up`, `set --advertise-routes`, `lock sign`) are deliberately not exposed.
 
-When opt-in is on, the startup banner reflects it: `@yawlabs/tailscale-mcp v0.13.3 ready (103 tools, local-cli=on)` — the 6 local CLI tools are additive on top of the default 97.
+When opt-in is on, the startup banner reflects it: `@yawlabs/tailscale-mcp v0.22.0 ready (103 tools, local-cli=on)` — the 6 local CLI tools are additive on top of the default 97.
 
 ## Resources (4)
 
@@ -732,17 +732,17 @@ This shows a read-only banner in the Tailscale Admin Console pointing to your re
 
 ## Running on oam.js (optional)
 
-[oam.js](https://oamjs.org) runs this server unmodified, and the `tailscale-mcp` command only ever uses the **latest oam release, currently 0.18.0**. Verified against the published oam 0.18.0: full MCP handshake, all 97 admin-API tools plus `tailscale_tool_groups`, all 4 resources, identical error responses, and a clean stdout protocol stream — from the shipped bundle *and* straight from the TypeScript source with no build step.
+[oam.js](https://oamjs.org) runs this server unmodified, and the `tailscale-mcp` command only ever uses the **latest oam release, currently 0.19.1**. Verified against the published oam 0.19.1: full MCP handshake, all 97 admin-API tools plus `tailscale_tool_groups`, all 4 resources, identical error responses, and a clean stdout protocol stream — from the shipped bundle *and* straight from the TypeScript source with no build step.
 
-**oam 0.18.0 is the minimum.** A floor matters here: releases before 0.9.0 ran `child_process.execFile` arguments through a shell, re-splitting them on whitespace and executing shell metacharacters inside an argument, and this server shells out to the `tailscale` binary across its local-CLI tools, so that was a reachable bug rather than a theoretical one.
+**oam 0.19.1 is the minimum.** A floor matters here: releases before 0.9.0 ran `child_process.execFile` arguments through a shell, re-splitting them on whitespace and executing shell metacharacters inside an argument, and this server shells out to the `tailscale` binary across its local-CLI tools, so that was a reachable bug rather than a theoretical one.
 
 How the `tailscale-mcp` command (`bin/tailscale-mcp.mjs`) picks a runtime:
 
-- **`TAILSCALE_MCP_RUNTIME=auto`** (the default) — if a client already launched it with `oam run` on oam 0.18.0 or newer, the server runs in that process. Otherwise it uses `OAM_BIN` when that is 0.18.0 or newer, else asks every oam binary it can find — `OAM_INSTALL_DIR` when that is set, then `%LOCALAPPDATA%\oam\bin` and `~/.oam/bin` on Windows, `~/.oam/bin` elsewhere, then `PATH` — for its version and uses the newest at or above the floor (on a tie the installed copy wins). With none, it runs on Node. An oam host older than 0.18.0 never serves the server itself: it hands off to the newest usable oam, or to Node on `PATH`, or exits with an error when there is neither. Whenever it looks for an oam, stderr names an `OAM_BIN` that was passed over and why; the oam binaries it found and passed over are named, each with its reason, only when no usable oam turns up.
+- **`TAILSCALE_MCP_RUNTIME=auto`** (the default) — if a client already launched it with `oam run` on oam 0.19.1 or newer, the server runs in that process. Otherwise it uses `OAM_BIN` when that is 0.19.1 or newer, else asks every oam binary it can find — `OAM_INSTALL_DIR` when that is set, then `%LOCALAPPDATA%\oam\bin` and `~/.oam/bin` on Windows, `~/.oam/bin` elsewhere, then `PATH` — for its version and uses the newest at or above the floor (on a tie the installed copy wins). With none, it runs on Node. An oam host older than 0.19.1 never serves the server itself: it hands off to the newest usable oam, or to Node on `PATH`, or exits with an error when there is neither. Whenever it looks for an oam, stderr names an `OAM_BIN` that was passed over and why; the oam binaries it found and passed over are named, each with its reason, only when no usable oam turns up.
 - **`TAILSCALE_MCP_RUNTIME=oam`** — the same, but exit with an error instead of falling back to Node. The error names the remedy for what it actually found: `oam self-update` for an oam older than the floor, a check of the binary for one that would not run, and installing oam only when none was found (and on linux-arm64, which oam publishes no build for, not even then).
 - **`TAILSCALE_MCP_RUNTIME=node`** — always Node: in-process under `npx`, handed off to Node on `PATH` when a client launches the command with `oam run`.
 
-The value is case-insensitive; anything else is warned about on stderr and treated as `auto`. On Windows only `oam.exe` counts: an `oam.cmd` / `oam.bat` shim is never run, and it is named on stderr only when no usable oam turns up.
+The value is case-insensitive and surrounding whitespace is ignored; anything else is warned about on stderr and treated as `auto`. On Windows only `oam.exe` counts: an `oam.cmd` / `oam.bat` shim is never run, and it is named on stderr only when no usable oam turns up.
 
 ### Sandboxing (opt-in)
 
@@ -767,14 +767,14 @@ The sandbox applies to the CLI subcommands too, and with the filesystem denied `
 }
 ```
 
-**Measure startup on your own hardware.** An MCP client cold-starts this server once per session, so startup is the cost that actually gets paid, and on the machine this was measured on node won it — 437ms vs 1554ms for `oam run` over 10 warmed runs (an earlier 5-run round showed 326ms vs 427ms; the box was busy, so treat the magnitude as noisy and the direction as the finding). Those runs used an oam that predates the 0.18.0 floor and have not been repeated since, so do not read them as a current ranking.
+**Measure startup on your own hardware.** An MCP client cold-starts this server once per session, so startup is the cost that actually gets paid, and on the machine this was measured on node won it — 437ms vs 1554ms for `oam run` over 10 warmed runs (an earlier 5-run round showed 326ms vs 427ms; the box was busy, so treat the magnitude as noisy and the direction as the finding). Those runs were taken with an oam older than 0.18.0 and have not been repeated since, so do not read them as a current ranking.
 
 The published `tailscale-mcp` command prefers the newest usable oam it finds (see above). Without oam that costs almost nothing: discovery is file-existence checks only, never a subprocess, and the fallback runs the server inside the Node process npm already started. With oam installed, though, the command boots Node, runs `--version` on every oam binary it found to pick the newest, and only then boots oam, so it is always slower than pointing your client at a runtime directly — the config above for oam, `node /path/to/tailscale-mcp/dist/index.js` for Node. `TAILSCALE_MCP_RUNTIME=node` skips oam entirely.
 
 Two places oam *does* win for this repo, both opt-in and neither touching the npm package:
 
 - **`npm run check:oam`** — type-checks via `oam check` (tsgo, TypeScript 7 native). Measured 4015ms against 7680ms for `tsc --noEmit`, same clean result. `npx tsc --noEmit` remains the portable default.
-- **`npm run build:binary:oam`** — builds the standalone binary via `oam compile` instead of Node SEA. Measured ~57.7 MB against ~73.6 MB for the Node SEA carrier *before* its blob is injected. Writes `bin/<platform>-<arch>/` (or `bin/$TAILSCALE_MCP_BINARY_TARGET/` for a cross-build), while `npm run build:binary` adds a `-glibc` / `-musl` suffix on Linux; `scripts/stage-release-asset.mjs` looks in both and stages the newer build — run one or the other per target. If you redistribute that binary it embeds oam's runtime, so ship oam's `LICENSE`, `NOTICE` and `THIRD_PARTY_LICENSES.md` with it. A cross-build (`TAILSCALE_MCP_BINARY_TARGET=<platform>-<arch>`) downloads the target's oam release binary as its carrier and checks it against the release's signed `RELEASE-MANIFEST`, verified with `ssh-keygen -Y verify` (OpenSSH 8.1+) against oam's release keys in `scripts/oam-release-keys/`; it aborts when the signature, the manifest or the checksum does not check out. An `OAM_VERSION` older than v0.18.0, released before oam signed its releases, is checked against its `SHA256SUMS` only once that file matches the digest pinned for the tag in `scripts/oam-release-keys/presigning-sums`.
+- **`npm run build:binary:oam`** — builds the standalone binary via `oam compile` (~57.7 MB measured). Writes `bin/<platform>-<arch>/` (or `bin/$TAILSCALE_MCP_BINARY_TARGET/` for a cross-build), which `scripts/stage-release-asset.mjs` then stages under the public asset name. If you redistribute that binary it embeds oam's runtime, so ship oam's `LICENSE`, `NOTICE` and `THIRD_PARTY_LICENSES.md` with it. A cross-build (`TAILSCALE_MCP_BINARY_TARGET=<platform>-<arch>`) downloads the target's oam release binary as its carrier and checks it against the release's signed `RELEASE-MANIFEST`, verified with `ssh-keygen -Y verify` (OpenSSH 8.1+) against oam's release keys in `scripts/oam-release-keys/`; it aborts when the signature, the manifest or the checksum does not check out. An `OAM_VERSION` below v0.18.0, released before oam signed its releases, is checked against its `SHA256SUMS` only once that file matches the digest pinned for the tag in `scripts/oam-release-keys/presigning-sums`.
 
 The source stays runtime-agnostic on purpose: no `oam:` imports anywhere, and tests stay on `node:test`. That is what keeps the Node fallback real rather than nominal. Note that any `oam` invocation writes a bytecode cache to `oam/` in the working directory — already in `.gitignore`.
 

package/bin/tailscale-mcp.mjs

@@ -105,7 +105,7 @@
  * shipped bundle; keep it in step.
  *
  * MINIMUM OAM VERSION
- * The latest oam release, 0.18.0 -- bump OAM_MIN when oam ships a newer one.
+ * The latest oam release, 0.19.1 -- bump OAM_MIN when oam ships a newer one.
  * Only the current oam is used and verified; an older one is passed over for a
  * newer oam, or for Node. The floor is not cosmetic: before 0.9.0
  * `child_process.execFile` ran its arguments through a SHELL, `exec` accepted
@@ -138,7 +138,7 @@ import { delimiter, join } from "node:path";
 import { fileURLToPath } from "node:url";
 
 /** The latest oam release, and the oldest one used. See MINIMUM OAM VERSION above. */
-const OAM_MIN = [0, 18, 0];
+const OAM_MIN = [0, 19, 1];
 
 /**
  * The oldest Node this package supports, matching package.json `engines.node`.
@@ -353,6 +353,15 @@ function fallbackInProcess(hostOam) {
   return hostOam === undefined || atLeast(parseVersion(hostOam), OAM_MIN);
 }
 
+/**
+ * True when an on/off opt-in is set: "1" or "true", any case, surrounding
+ * whitespace ignored -- cmd.exe's `set FOO=1 && ...` stores "1 ". The same rule
+ * as envFlagOn in src/env-flag.ts; this file is plain .mjs and cannot import it.
+ */
+function envFlagOn(value) {
+  return /^(1|true)$/i.test((value ?? "").trim());
+}
+
 /**
  * The `--permission` grant list, or [] when the sandbox is not requested.
  *
@@ -360,7 +369,7 @@ function fallbackInProcess(hostOam) {
  * not after it. `oam run --permission file.js` is rejected outright, which is a
  * good failure but only because it is loud -- ordering here is load-bearing.
  *
- * Net grants, since oam 0.18.0 (the floor): an entry without a port admits that
+ * Net grants, as of oam 0.18.0: an entry without a port admits that
  * host on every port, and a `host:port` entry admits that port alone -- for
  * fetch and https.request exactly as for sockets. Up to 0.17.1 a port-scoped
  * entry admitted no HTTP request at all, which is why this used to be a bare
@@ -370,7 +379,7 @@ function fallbackInProcess(hostOam) {
  * it produces silent misbehaviour, not a clear denial.
  */
 function sandboxFlags() {
-  if (process.env.TAILSCALE_MCP_SANDBOX !== "1") return [];
+  if (!envFlagOn(process.env.TAILSCALE_MCP_SANDBOX)) return [];
 
   // ONE host, deliberately. Every outbound request the bundle makes targets
   // api.tailscale.com: BASE_URL, the OAuth token exchange, and the absolute-URL
@@ -401,7 +410,7 @@ function sandboxFlags() {
   // TEMP), TMP its POSIX-style twin, APPDATA and LOCALAPPDATA where Windows
   // programs keep per-user state, and HOME the POSIX home directory. Granting a
   // name that is not set is harmless: it stays absent. WSL_DISTRO_NAME is the
-  // server's own: local-cli.ts reads it to recognise WSL when the CLI is
+  // server's own: local-cli-runner.ts reads it to recognise WSL when the CLI is
   // missing, and its fallback, /proc/version, is a file read the sandbox denies.
   const env = [
     "APPDATA",
@@ -858,11 +867,12 @@ if (nodeFloorMessage) {
 // which is the opposite of what was asked for. Same handling as index.ts gives
 // an unknown subcommand: auto is still the right landing place, it just stops
 // being silent. An empty value is treated as unset, since `FOO=$UNSET` in a
-// wrapper script is how it usually gets there.
+// wrapper script is how it usually gets there, and surrounding whitespace is
+// dropped first: cmd.exe's `set TAILSCALE_MCP_RUNTIME=node && ...` stores "node ".
 const RUNTIMES = ["auto", "node", "oam"];
 const requested = process.env.TAILSCALE_MCP_RUNTIME;
-const mode = (requested ?? "auto").toLowerCase();
-if (requested && !RUNTIMES.includes(mode)) {
+const mode = (requested?.trim() || "auto").toLowerCase();
+if (requested?.trim() && !RUNTIMES.includes(mode)) {
   // Echo what was SET, not the lowercased form, so the typo is recognisable in
   // the host's log next to the config line that produced it.
   errSync(
@@ -876,6 +886,14 @@ const hostOam = process.versions.oam;
 // "would the spawn carry --permission" cannot drift from what the spawn below
 // actually passes.
 const sandbox = sandboxFlags();
+// A security opt-in that did not take must not be silent: "yes" or "on" reads as
+// a request for the sandbox, and serving unsandboxed without a word would hide it.
+const sandboxRaw = (process.env.TAILSCALE_MCP_SANDBOX ?? "").trim();
+if (sandbox.length === 0 && sandboxRaw !== "") {
+  errSync(
+    `tailscale-mcp: TAILSCALE_MCP_SANDBOX="${process.env.TAILSCALE_MCP_SANDBOX}" is not 1 or true -- the sandbox is NOT enabled.\n`,
+  );
+}
 const plan = runtimePlan({ mode, hostOam, sandbox: sandbox.length > 0 });
 
 if (plan === "in-process") {

package/dist/index.js

@@ -31350,6 +31350,15 @@ var StdioServerTransport = class {
   }
 };
 
+// src/env-flag.ts
+function envFlagOn(value) {
+  return /^(1|true)$/i.test((value ?? "").trim());
+}
+function securityOptInWarning(name, value) {
+  if (envFlagOn(value) || (value ?? "").trim() === "") return null;
+  return `${name}=${JSON.stringify(value)} is not 1 or true, so it is NOT enabled.`;
+}
+
 // src/api.ts
 var BASE_URL = "https://api.tailscale.com/api/v2";
 var REQUEST_TIMEOUT_MS = 3e4;
@@ -31646,7 +31655,7 @@ async function withConcurrencyLimit(fn) {
   }
 }
 function debugLog(...parts) {
-  if (process.env.TAILSCALE_DEBUG === "1" || process.env.TAILSCALE_DEBUG === "true") {
+  if (envFlagOn(process.env.TAILSCALE_DEBUG)) {
     console.error("[tailscale-mcp]", ...parts);
   }
 }
@@ -32026,7 +32035,7 @@ function parseGroupList(value) {
   return parsed.length > 0 ? parsed : null;
 }
 function parseReadonlyFlag(value) {
-  return value === "1" || value === "true";
+  return envFlagOn(value);
 }
 function filterTools(groups, options) {
   const validNames = new Set(Object.keys(groups));
@@ -33263,7 +33272,7 @@ var userTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      userId: external_exports.string().describe("The user ID")
+      userId: external_exports.string().trim().min(1).describe("The user ID")
     }),
     handler: async (input) => {
       return apiGet(`/users/${encPath(input.userId)}`);
@@ -33280,7 +33289,7 @@ var userTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      userId: external_exports.string().describe("The user ID to approve")
+      userId: external_exports.string().trim().min(1).describe("The user ID to approve")
     }),
     handler: async (input) => {
       return apiPost(`/users/${encPath(input.userId)}/approve`);
@@ -33297,7 +33306,10 @@ var userTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      userId: external_exports.string().describe("The user ID to suspend")
+      // `.trim().min(1)`, not a bare string: a whitespace-only user id encodes
+      // to "%20" and suspend returns a 404 that reads like the user is already
+      // gone when it is not (rationale: tailnets.ts delete_tailnet).
+      userId: external_exports.string().trim().min(1).describe("The user ID to suspend")
     }),
     handler: async (input) => {
       return apiPost(`/users/${encPath(input.userId)}/suspend`);
@@ -33314,7 +33326,7 @@ var userTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      userId: external_exports.string().describe("The user ID to restore")
+      userId: external_exports.string().trim().min(1).describe("The user ID to restore")
     }),
     handler: async (input) => {
       return apiPost(`/users/${encPath(input.userId)}/restore`);
@@ -33331,7 +33343,7 @@ var userTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      userId: external_exports.string().describe("The user ID"),
+      userId: external_exports.string().trim().min(1).describe("The user ID"),
       role: external_exports.enum(USER_ROLES).describe("The new role to assign")
     }),
     handler: async (input) => {
@@ -33374,7 +33386,7 @@ var inviteTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      deviceId: external_exports.string().describe(`The device ID to list invites for. ${DEVICE_ID_HINT}`)
+      deviceId: external_exports.string().trim().min(1).describe(`The device ID to list invites for. ${DEVICE_ID_HINT}`)
     }),
     handler: async (input) => {
       return apiGet(`/device/${encPath(input.deviceId)}/device-invites`);
@@ -33391,7 +33403,7 @@ var inviteTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      deviceId: external_exports.string().describe(`The device ID to create an invite for. ${DEVICE_ID_HINT}`),
+      deviceId: external_exports.string().trim().min(1).describe(`The device ID to create an invite for. ${DEVICE_ID_HINT}`),
       multiUse: external_exports.boolean().optional().describe("Whether the invite can be used more than once (default: false)"),
       allowExitNode: external_exports.boolean().optional().describe("Whether the invited device can be used as an exit node (default: false)"),
       email: external_exports.email().optional().describe("Email address to send the invite to")
@@ -33418,7 +33430,7 @@ var inviteTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      inviteId: external_exports.string().describe("The device invite ID")
+      inviteId: external_exports.string().trim().min(1).describe("The device invite ID")
     }),
     handler: async (input) => {
       return apiGet(`/device-invites/${encPath(input.inviteId)}`);
@@ -33435,7 +33447,10 @@ var inviteTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      inviteId: external_exports.string().describe("The device invite ID to delete")
+      inviteId: external_exports.string().trim().min(1).describe("The device invite ID to delete")
+      // `.trim().min(1)`, not a bare string: a whitespace-only inviteId encodes
+      // to "%20" and this irreversible delete returns a 404 that reads like the
+      // invite is already gone (rationale: tailnets.ts delete_tailnet).
     }),
     handler: async (input) => {
       return apiDelete(`/device-invites/${encPath(input.inviteId)}`);
@@ -33509,7 +33524,7 @@ var inviteTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      inviteId: external_exports.string().describe("The user invite ID")
+      inviteId: external_exports.string().trim().min(1).describe("The user invite ID")
     }),
     handler: async (input) => {
       return apiGet(`/user-invites/${encPath(input.inviteId)}`);
@@ -33526,7 +33541,10 @@ var inviteTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      inviteId: external_exports.string().describe("The user invite ID to delete")
+      inviteId: external_exports.string().trim().min(1).describe("The user invite ID to delete")
+      // `.trim().min(1)`, not a bare string: a whitespace-only inviteId encodes
+      // to "%20" and this irreversible delete returns a 404 that reads like the
+      // invite is already gone (rationale: tailnets.ts delete_tailnet).
     }),
     handler: async (input) => {
       return apiDelete(`/user-invites/${encPath(input.inviteId)}`);
@@ -33544,7 +33562,7 @@ var inviteTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      inviteId: external_exports.string().describe("The device invite ID to resend")
+      inviteId: external_exports.string().trim().min(1).describe("The device invite ID to resend")
     }),
     handler: async (input) => {
       return apiPost(`/device-invites/${encPath(input.inviteId)}/resend`);
@@ -33562,7 +33580,7 @@ var inviteTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      inviteId: external_exports.string().describe("The user invite ID to resend")
+      inviteId: external_exports.string().trim().min(1).describe("The user invite ID to resend")
     }),
     handler: async (input) => {
       return apiPost(`/user-invites/${encPath(input.inviteId)}/resend`);
@@ -33863,7 +33881,7 @@ var keyTools = [
 // src/tools/local-cli.ts
 import * as net2 from "node:net";
 
-// src/local-cli.ts
+// src/local-cli-runner.ts
 import { execFile as execFileCb } from "node:child_process";
 import { existsSync, readFileSync as readFileSync2 } from "node:fs";
 var DEFAULT_TIMEOUT_MS = 3e4;
@@ -33939,7 +33957,8 @@ async function runTailscaleCli(args, options = {}) {
   const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
   await acquireCliSlot();
   return new Promise((resolve) => {
-    execFileImpl(binary, args, { timeout: timeoutMs, maxBuffer: MAX_BUFFER_BYTES }, (err, stdout, stderr) => {
+    const execOptions = { timeout: timeoutMs, maxBuffer: MAX_BUFFER_BYTES, windowsHide: true };
+    execFileImpl(binary, args, execOptions, (err, stdout, stderr) => {
       releaseCliSlot();
       const stdoutStr = stdout == null ? "" : String(stdout);
       const stderrStr = stderr == null ? "" : String(stderr);
@@ -33959,6 +33978,7 @@ async function runTailscaleCli(args, options = {}) {
         if (errno.code === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER") {
           resolve({
             ok: false,
+            kind: "output-limit",
             error: `'${binary} ${args.join(" ")}' exceeded the ${MAX_BUFFER_BYTES / 1024 / 1024} MB output limit and was aborted -- no output was captured. This usually means a very large tailnet; narrow the query if the command supports it.`
           });
           return;
@@ -33966,6 +33986,7 @@ async function runTailscaleCli(args, options = {}) {
         if (errno.killed) {
           resolve({
             ok: false,
+            kind: "timeout",
             error: `'${binary} ${args.join(" ")}' timed out after ${timeoutMs}ms`
           });
           return;
@@ -34029,10 +34050,10 @@ var localCliTools = [
       if (input.peers === false) args.push("--peers=false");
       if (input.activeOnly) args.push("--active");
       const result = await runTailscaleCli(args, { parseJson: true });
-      if (!result.ok && result.error?.includes("output limit")) {
+      if (!result.ok && result.kind === "output-limit") {
         return { ...result, error: `${result.error} Retry with peers:false or activeOnly:true.` };
       }
-      if (!result.ok && result.error?.includes("timed out after")) {
+      if (!result.ok && result.kind === "timeout") {
         return {
           ...result,
           error: `${result.error}. On a large tailnet this is usually the peer map -- retry with peers:false.`
@@ -34416,7 +34437,7 @@ var postureTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      integrationId: external_exports.string().describe("The posture integration ID")
+      integrationId: external_exports.string().trim().min(1).describe("The posture integration ID")
     }),
     handler: async (input) => {
       return apiGet(`/posture/integrations/${encPath(input.integrationId)}`);
@@ -34471,7 +34492,7 @@ var postureTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      integrationId: external_exports.string().describe("The posture integration ID to update"),
+      integrationId: external_exports.string().trim().min(1).describe("The posture integration ID to update"),
       clientId: external_exports.string().optional().describe("Updated client ID for the provider"),
       clientSecret: external_exports.string().optional().describe(
         "Updated client secret for the provider (omit to retain the existing secret). SENSITIVE: passed straight to Tailscale and not echoed back, but MCP clients may log the input value you supply."
@@ -34502,7 +34523,10 @@ var postureTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      integrationId: external_exports.string().describe("The posture integration ID to delete")
+      integrationId: external_exports.string().trim().min(1).describe("The posture integration ID to delete")
+      // `.trim().min(1)`, not a bare string: a whitespace-only integrationId
+      // encodes to "%20" and this irreversible delete returns a 404 that reads
+      // like the integration is already gone (rationale: tailnets.ts delete_tailnet).
     }),
     handler: async (input) => {
       return apiDelete(`/posture/integrations/${encPath(input.integrationId)}`);
@@ -34694,7 +34718,13 @@ var statusTools = [
     handler: async () => {
       const [devicesRes, settingsRes] = await fetchTailnetStatusInputs();
       if (!devicesRes.ok && !settingsRes.ok) {
-        return devicesRes;
+        if (settingsRes.error === devicesRes.error && settingsRes.status === devicesRes.status) {
+          return devicesRes;
+        }
+        return {
+          ...devicesRes,
+          error: `${devicesRes.error || `HTTP ${devicesRes.status}`} (the settings fetch also failed: ${settingsRes.error || `HTTP ${settingsRes.status}`})`
+        };
       }
       const data = composeTailnetStatusData(devicesRes, settingsRes, {
         connected: true,
@@ -35141,10 +35171,10 @@ var webhookTools = [
 
 // src/server-wiring.ts
 function isLocalCliEnabled(env) {
-  return env.TAILSCALE_LOCAL_CLI === "1" || env.TAILSCALE_LOCAL_CLI === "true";
+  return envFlagOn(env.TAILSCALE_LOCAL_CLI);
 }
 function isRequireApprovalEnabled(env) {
-  return env.TAILSCALE_REQUIRE_APPROVAL === "1" || env.TAILSCALE_REQUIRE_APPROVAL === "true";
+  return envFlagOn(env.TAILSCALE_REQUIRE_APPROVAL);
 }
 var FORCED_APPROVAL_TOOLS = [
   "tailscale_delete_device",
@@ -35482,7 +35512,7 @@ Install a newer Node (https://nodejs.org/en/download), or point your MCP client'
   );
   process.exit(1);
 }
-var version2 = true ? "0.22.0" : resolveVersionFallback();
+var version2 = true ? "0.23.1" : resolveVersionFallback();
 var subcommand = process.argv[2];
 var USAGE = `Usage: tailscale-mcp [command]
 
@@ -35555,6 +35585,10 @@ if (!cliSubcommandHandled) {
   if (tailnetMismatch) {
     console.error(`@yawlabs/tailscale-mcp: ${tailnetMismatch}`);
   }
+  const readonlyWarning = securityOptInWarning("TAILSCALE_READONLY", process.env.TAILSCALE_READONLY);
+  if (readonlyWarning) {
+    console.error(`@yawlabs/tailscale-mcp: ${readonlyWarning} Write tools are served.`);
+  }
   if (unknownGroups.length > 0) {
     const validNames = Object.keys(toolGroups);
     const fallbackNote = toolsAllUnknown ? " Every requested group was unknown, so TAILSCALE_TOOLS was ignored and the default tool set was loaded instead." : "";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yawlabs/tailscale-mcp",
-  "version": "0.22.0",
+  "version": "0.23.1",
   "mcpName": "io.github.YawLabs/tailscale-mcp",
   "description": "Tailscale MCP server: admin-API tools for devices, ACLs, DNS, auth keys, users, and audit logs, plus a CLI to validate and deploy ACLs.",
   "license": "MIT",
@@ -58,7 +58,6 @@
     "lint:fix": "node scripts/lint.mjs check --write src/ bin/ scripts/ build.mjs",
     "check:oam": "oam check src/index.ts",
     "check:oam-floor": "node scripts/check-oam-floor.mjs",
-    "build:binary": "node scripts/build-binary.mjs",
     "build:binary:oam": "node scripts/build-binary-oam.mjs",
     "prepublishOnly": "npm run clean && npm run build"
   },
@@ -74,7 +73,6 @@
     "@modelcontextprotocol/sdk": "^1.32.1",
     "@types/node": "^26.0.0",
     "esbuild": "^0.28.1",
-    "postject": "^1.0.0-alpha.6",
     "typescript": "^7.0.2",
     "zod": "^4.3.6"
   },