fix(tailscale): omit a cleared auth key expiry, fix flow logs typo, and include the oldest uncovered IndexNow run

.github/workflows/ci.yml

@@ -671,10 +671,11 @@ jobs:
       # push: a push that never deployed, or whose submission failed, would otherwise drop its
       # changed URLs for good. The check-runs lookup asks for this one check per commit, so it
       # stays small and counts every attempt of a re-run; a lookup that errors counts as no
-      # success. With no success in view, the base is the oldest run in view, so URLs that no
-      # submission ever covered are sent now. The diff needs only the two trees, so that one
-      # commit is fetched alone; an all-zero `before` (the branch's first push) has no base,
-      # which the script skips.
+      # success. With no success in view, the base is the first parent of the oldest run in view,
+      # so URLs that no submission ever covered, that run's own included, are sent now; a failed
+      # parent lookup fails the step, so the next run retries from the same base. The diff
+      # needs only the two trees, so that one commit is fetched alone; an all-zero `before` (the
+      # branch's first push) has no base, which the script skips.
       - name: Submit changed URLs to IndexNow
         env:
           GH_TOKEN: ${{ github.token }}
@@ -691,7 +692,10 @@ jobs:
             fi
           done < <(gh api "repos/$GITHUB_REPOSITORY/actions/workflows/ci.yml/runs?branch=main&event=push&per_page=30" \
             --jq ".workflow_runs[] | select(.id < $GITHUB_RUN_ID) | .head_sha")
-          BASE_SHA="${BASE_SHA:-${OLDEST_SHA:-$PUSH_BEFORE}}"
+          if [[ -z "$BASE_SHA" && -n "$OLDEST_SHA" ]]; then
+            BASE_SHA="$(gh api "repos/$GITHUB_REPOSITORY/commits/$OLDEST_SHA" --jq '.parents[0].sha // empty')"
+          fi
+          BASE_SHA="${BASE_SHA:-$PUSH_BEFORE}"
           echo "Submitting URLs changed in $BASE_SHA..$GITHUB_SHA"
           if [[ ! "$BASE_SHA" =~ ^0+$ ]]; then
             git fetch --no-tags --depth=1 origin "$BASE_SHA"

apps/docs/content/docs/integrations/tailscale.mdx

@@ -1138,7 +1138,7 @@ Get tailnet settings
 |   ↳ `devicesKeyDurationDays` | number | The \[key expiry\]\(/docs/features/access-control/key-expiry\) duration for devices on this tailnet |
 |   ↳ `usersApprovalOn` | boolean | Whether \[user approval\]\(/docs/features/access-control/user-approval\) is enabled for this tailnet |
 |   ↳ `usersRoleAllowedToJoinExternalTailnets` | string | Which user roles are allowed to \[join external tailnets\]\(/docs/features/sharing/how-to/invite-any-user\) |
-|   ↳ `networkFlowLoggingOn` | boolean | Whether \[network flog logs\]\(/docs/features/logging/network-flow-logs\) are enabled for the tailnet |
+|   ↳ `networkFlowLoggingOn` | boolean | Whether \[network flow logs\]\(/docs/features/logging/network-flow-logs\) are enabled for the tailnet |
 |   ↳ `regionalRoutingOn` | boolean | Whether \[regional routing\]\(/docs/features/route-selection#regional-routing\) is enabled for the tailnet |
 |   ↳ `routeSelection` | string | The \[route selection\]\(/docs/features/route-selection\) algorithm used by the tailnet: * `active-passive-failover` - Active-passive failover \(formerly known as "Failover"\) * `regional-routing` - Regional routing * `regional-routing-failover` - Regional routing with in-region failover * `magicroute` - MagicRoute A PATCH request must not specify both the `regionalRoutingOn` and `routeSelection` fields |
 |   ↳ `postureIdentityCollectionOn` | boolean | Whether \[identity collection\]\(/docs/features/access-control/device-management/how-to/manage-identity\) is enabled for \[device posture\]\(/docs/features/device-posture\) integrations for the tailnet |
@@ -1173,7 +1173,7 @@ Update selected tailnet settings
 |   ↳ `devicesKeyDurationDays` | number | The \[key expiry\]\(/docs/features/access-control/key-expiry\) duration for devices on this tailnet |
 |   ↳ `usersApprovalOn` | boolean | Whether \[user approval\]\(/docs/features/access-control/user-approval\) is enabled for this tailnet |
 |   ↳ `usersRoleAllowedToJoinExternalTailnets` | string | Which user roles are allowed to \[join external tailnets\]\(/docs/features/sharing/how-to/invite-any-user\) |
-|   ↳ `networkFlowLoggingOn` | boolean | Whether \[network flog logs\]\(/docs/features/logging/network-flow-logs\) are enabled for the tailnet |
+|   ↳ `networkFlowLoggingOn` | boolean | Whether \[network flow logs\]\(/docs/features/logging/network-flow-logs\) are enabled for the tailnet |
 |   ↳ `regionalRoutingOn` | boolean | Whether \[regional routing\]\(/docs/features/route-selection#regional-routing\) is enabled for the tailnet |
 |   ↳ `routeSelection` | string | The \[route selection\]\(/docs/features/route-selection\) algorithm used by the tailnet: * `active-passive-failover` - Active-passive failover \(formerly known as "Failover"\) * `regional-routing` - Regional routing * `regional-routing-failover` - Regional routing with in-region failover * `magicroute` - MagicRoute A PATCH request must not specify both the `regionalRoutingOn` and `routeSelection` fields |
 |   ↳ `postureIdentityCollectionOn` | boolean | Whether \[identity collection\]\(/docs/features/access-control/device-management/how-to/manage-identity\) is enabled for \[device posture\]\(/docs/features/device-posture\) integrations for the tailnet |

apps/sim/blocks/blocks/tailscale.ts

@@ -752,6 +752,7 @@ export const TailscaleBlock: BlockConfig = {
           ...params,
           dns: params.dnsServers,
           description: params.authKeyDescription,
+          expirySeconds: undefined,
           name: params.name ?? '',
           role: params.operation === 'list_users' ? params.roleFilter || undefined : params.role,
         }

apps/sim/tools/tailscale/get_tailnet_settings.ts

@@ -117,7 +117,7 @@ export const tailscaleGetTailnetSettingsTool: ToolConfig<
         networkFlowLoggingOn: {
           type: 'boolean',
           description:
-            'Whether [network flog logs](/docs/features/logging/network-flow-logs) are enabled for the tailnet',
+            'Whether [network flow logs](/docs/features/logging/network-flow-logs) are enabled for the tailnet',
           nullable: true,
         },
         regionalRoutingOn: {

apps/sim/tools/tailscale/update_tailnet_settings.ts

@@ -134,7 +134,7 @@ export const tailscaleUpdateTailnetSettingsTool: ToolConfig<
         networkFlowLoggingOn: {
           type: 'boolean',
           description:
-            'Whether [network flog logs](/docs/features/logging/network-flow-logs) are enabled for the tailnet',
+            'Whether [network flow logs](/docs/features/logging/network-flow-logs) are enabled for the tailnet',
           nullable: true,
         },
         regionalRoutingOn: {