fix(tailscale): align tool coverage and outputs with the Tailscale API by waleedlatif1 · Pull Request #5366 · simstudioai/sim

waleedlatif1 · 2026-07-02T07:03:56Z

Summary

Fixed list_users reading profilePicURL instead of the API's actual profilePicUrl field — was always returning null
Added nodeId (API's preferred device identifier), keyExpiryDisabled, and expires to device outputs
Fixed the set_acl If-Match header to be quoted per the Tailscale API spec
Added 4 new tools to close real coverage gaps: set_acl (write policy back, not just read), expire_device_key, suspend_user, delete_user (proper offboarding — the existing flow only deauthorized devices, never touched the user account)
Added wandConfig to the dnsServers/searchPaths block fields per repo convention
Expanded TailscaleBlockMeta skills/templates for ACL management and key-expiry incident response

Validated every one of the 24 tools' endpoints, methods, required/optional params, and response field extraction against the live Tailscale OpenAPI spec and Go SDK source. Two independent passes confirmed full API alignment and that no backwards-incompatible field removals were made.

Type of Change

Bug fix
New feature (additive tool coverage)

Testing

Tested manually. Verified against live Tailscale OpenAPI spec + Go client source. bun run lint and bun run type-check clean.

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

vercel · 2026-07-02T07:04:03Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jul 2, 2026 5:14pm

cursor · 2026-07-02T07:04:07Z

PR Summary

High Risk
New and fixed paths touch tailnet ACL policy writes, user lifecycle, and immediate device key revocation—high-impact security operations if misused or buggy.

Overview
Expands the Tailscale integration with four new operations—Set ACL, Expire Device Key, Suspend User, and Delete User—wired through new tools, the block dropdown, params, and the tool registry so workflows can write ACLs, cut compromised devices off, and complete user offboarding beyond device-only steps.

API alignment fixes include mapping profilePicUrl in list users, surfacing nodeId, keyExpiryDisabled, and expires on device list/get outputs, quoting the If-Match header on Set ACL, listing auth keys with ?all=true, and dropping magicDNS from the list-DNS-nameservers response where it does not belong.

The Tailscale block gains wandConfig on DNS nameserver and search-path fields, plus updated templates/skills for ACL drift remediation, full offboarding, policy-as-code ACL updates, and compromised-device lockdown.

^{Reviewed by Cursor Bugbot for commit 7f43c6e. Configure here.}

greptile-apps · 2026-07-02T07:09:51Z

Greptile Summary

This PR fixes API alignment bugs and adds four new Tailscale tools (expire_device_key, suspend_user, delete_user, set_acl) to close coverage gaps in device security and user offboarding workflows.

Bug fixes: corrects profilePicUrl field casing in list_users, adds nodeId/keyExpiryDisabled/expires to device outputs, and properly quotes the If-Match ETag header in set_acl per the Tailscale API spec.
New tools: expire_device_key (force node-key re-auth), suspend_user/delete_user (proper account offboarding), and set_acl (write ACL policy back with ETag-guarded optimistic concurrency); all four tools use correct Tailscale API endpoints and methods.
Block config: registers the new operations with correct condition/required guards, adds wandConfig to the DNS nameserver and search-path fields, and expands TailscaleBlockMeta with ACL management and key-expiry incident-response templates.

Confidence Score: 3/5

The new tools and bug-fixes are well-implemented, but two unaddressed changes alter the observable behaviour of existing tools in ways not mentioned in the PR description.

The four new tools are clean and the field-alignment fixes are correct. However, two existing-tool changes introduced in this PR carry real downstream risk: adding ?all=true to list_auth_keys silently returns revoked and expired keys to every existing workflow that calls that tool (previously only active keys were returned), and removing magicDNS from list_dns_nameservers output contract breaks any workflow that reads output.magicDNS. Both were raised in the previous review round and have not been addressed.

apps/sim/tools/tailscale/list_auth_keys.ts and apps/sim/tools/tailscale/list_dns_nameservers.ts

Important Files Changed

Filename	Overview
apps/sim/tools/tailscale/set_acl.ts	New tool implementing ACL write-back; ETag normalization, string body handling, and error paths are all correct.
apps/sim/tools/tailscale/expire_device_key.ts	New tool that correctly POSTs to /device/{id}/expire and skips body parsing on success (endpoint returns empty 200); interface definition issue flagged in a previous review round.
apps/sim/tools/tailscale/suspend_user.ts	New tool correctly POSTs to /users/{userId}/suspend; error handling and response shape follow existing patterns.
apps/sim/tools/tailscale/delete_user.ts	New tool correctly POSTs to /users/{userId}/delete; mirrors the suspend_user structure cleanly.
apps/sim/tools/tailscale/list_auth_keys.ts	Added ?all=true silently changes the response to include revoked/expired keys; behavior change flagged in a prior review round and not yet addressed.
apps/sim/tools/tailscale/list_dns_nameservers.ts	Removed magicDNS from both the TypeScript type and output definition; breaking schema change flagged in a prior review round and not yet addressed.
apps/sim/tools/tailscale/list_users.ts	Bug fix: reads profilePicUrl (correct API field) instead of profilePicURL, resolving the always-null return.
apps/sim/tools/tailscale/get_device.ts	Adds nodeId, keyExpiryDisabled, and expires fields to both success and error output shapes; API-aligned and backwards-compatible.
apps/sim/tools/tailscale/list_devices.ts	Same nodeId/keyExpiryDisabled/expires additions applied consistently to each mapped device object and the output schema.
apps/sim/blocks/blocks/tailscale.ts	Registers four new operations with correct condition/required guards, wandConfig additions for DNS fields, and updated BlockMeta skills/templates.

_{Reviews (5): Last reviewed commit: "fix(tailscale): list_auth_keys now retur..." | Re-trigger Greptile}

waleedlatif1 · 2026-07-02T07:28:11Z

Fixed — TailscaleExpireDeviceKeyResponse now extends ToolResponse to match delete_user/suspend_user. Pushed in fdf867f.

waleedlatif1 · 2026-07-02T07:33:09Z

@greptile

waleedlatif1 · 2026-07-02T07:33:10Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit fdf867f. Configure here.}

waleedlatif1 · 2026-07-02T16:58:40Z

@greptile

waleedlatif1 · 2026-07-02T16:58:41Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 6fd8469. Configure here.}

- fix list_users profilePicUrl field name (API returns lowercase, was always null) - add nodeId, keyExpiryDisabled, expires to device outputs - quote the If-Match header value on ACL updates per API spec - add set_acl, expire_device_key, suspend_user, delete_user tools - add wandConfig to dnsServers/searchPaths block fields - expand BlockMeta skills/templates for ACL and key-expiry workflows

The GET /tailnet/{tailnet}/dns/nameservers response only returns {dns: string[]} per the API spec — magicDNS is not part of this endpoint's response and was always silently false.

Matches the pattern used by the other new tools in this PR (delete_user, suspend_user).

GET /tailnet/{tailnet}/keys silently scopes to the caller's own keys unless all=true is passed, contradicting the tool's stated purpose of listing all auth keys in the tailnet.

waleedlatif1 · 2026-07-02T17:24:06Z

@greptile

waleedlatif1 · 2026-07-02T17:24:07Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 7f43c6e. Configure here.}

waleedlatif1 · 2026-07-02T17:33:14Z

Good catch — fixed. Restored magicDNS to list_dns_nameservers' output so the contract stays stable for any existing workflow reference, but documented honestly that it's a static false (this endpoint genuinely doesn't return MagicDNS status — confirmed against the live OpenAPI spec) and pointed users to Get DNS Preferences for the real value. Pushed in 080afb6.

waleedlatif1 · 2026-07-02T17:52:19Z

@greptile

waleedlatif1 · 2026-07-02T17:52:20Z

@cursor review

cursor

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 7f43c6e. Configure here.}

cursor · 2026-07-02T17:54:06Z

      success: true,
      output: {
        dns: data.dns ?? [],
-        magicDNS: data.magicDNS ?? false,


List DNS drops magicDNS output

Medium Severity

The list_dns_nameservers tool no longer returns magicDNS, but the Tailscale block still exposes magicDNS as a block output and the PR stated no backwards-incompatible field removals. Workflows that read magicDNS after List DNS Nameservers now get a missing value instead of the prior always-false field.

Additional Locations (1)

apps/sim/tools/tailscale/types.ts#L128-L133

^{Reviewed by Cursor Bugbot for commit 7f43c6e. Configure here.}

greptile-apps Bot reviewed Jul 2, 2026

View reviewed changes

Comment thread apps/sim/tools/tailscale/expire_device_key.ts Outdated

vercel Bot temporarily deployed to Preview July 2, 2026 07:27 Inactive

vercel Bot temporarily deployed to Preview July 2, 2026 07:28 Inactive

cursor Bot reviewed Jul 2, 2026

View reviewed changes

vercel Bot temporarily deployed to Preview July 2, 2026 16:58 Inactive

cursor Bot reviewed Jul 2, 2026

View reviewed changes

waleedlatif1 added 4 commits July 2, 2026 10:14

fix(tailscale): remove phantom magicDNS field from list_dns_nameservers

31a2477

The GET /tailnet/{tailnet}/dns/nameservers response only returns {dns: string[]} per the API spec — magicDNS is not part of this endpoint's response and was always silently false.

fix(tailscale): extend ToolResponse in expire_device_key response type

ed30673

Matches the pattern used by the other new tools in this PR (delete_user, suspend_user).

fix(tailscale): list_auth_keys now returns all tailnet keys

7f43c6e

GET /tailnet/{tailnet}/keys silently scopes to the caller's own keys unless all=true is passed, contradicting the tool's stated purpose of listing all auth keys in the tailnet.

waleedlatif1 force-pushed the worktree-tailscale-validate branch from 6fd8469 to 7f43c6e Compare July 2, 2026 17:14

vercel Bot temporarily deployed to Preview July 2, 2026 17:14 Inactive

waleedlatif1 merged commit f658e6d into staging Jul 2, 2026
11 checks passed

waleedlatif1 deleted the worktree-tailscale-validate branch July 2, 2026 17:15

cursor Bot reviewed Jul 2, 2026

View reviewed changes

greptile-apps Bot reviewed Jul 2, 2026

View reviewed changes

Comment thread apps/sim/tools/tailscale/list_dns_nameservers.ts

cursor Bot reviewed Jul 2, 2026

View reviewed changes

waleedlatif1 mentioned this pull request Jul 2, 2026

v0.7.21: tools audits and extensions, appsheet integration, hitl fix #5378

Merged

Uh oh!

Conversation

waleedlatif1 commented Jul 2, 2026

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

greptile-apps Bot commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 3/5

Important Files Changed

Uh oh!

Uh oh!

waleedlatif1 commented Jul 2, 2026

Uh oh!

waleedlatif1 commented Jul 2, 2026

Uh oh!

waleedlatif1 commented Jul 2, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

waleedlatif1 commented Jul 2, 2026

Uh oh!

waleedlatif1 commented Jul 2, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

waleedlatif1 commented Jul 2, 2026

Uh oh!

waleedlatif1 commented Jul 2, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

waleedlatif1 commented Jul 2, 2026

Uh oh!

waleedlatif1 commented Jul 2, 2026

Uh oh!

waleedlatif1 commented Jul 2, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot Jul 2, 2026

Choose a reason for hiding this comment

List DNS drops magicDNS output

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercel Bot commented Jul 2, 2026 •

edited

Loading

cursor Bot commented Jul 2, 2026 •

edited

Loading

greptile-apps Bot commented Jul 2, 2026 •

edited

Loading