@tiny-fish/cli 0.1.8-next.70 → 0.1.8-next.72

package/README.md

@@ -150,6 +150,41 @@ tinyfish browser session create --url https://agentql.com
 tinyfish browser session create --pretty
 ```
 
+### Vault
+
+Connect a credential provider (1Password / Bitwarden), then have runs consume those credentials.
+
+Provider secrets are read from the environment, never passed as flags — the same model as `TINYFISH_API_KEY`. This keeps tokens out of shell history and process listings.
+
+```bash
+# Connect 1Password (token from env)
+TINYFISH_VAULT_TOKEN=<service-account-token> \
+  tinyfish vault connection add --provider 1password
+
+# Connect Bitwarden (client secret + master password from env; client ID is a flag)
+TINYFISH_VAULT_CLIENT_SECRET=<secret> TINYFISH_VAULT_MASTER_PASSWORD=<password> \
+  tinyfish vault connection add --provider bitwarden --client-id <client-id>
+
+# List / disconnect connections
+tinyfish vault connection list
+tinyfish vault connection remove <connectionId>
+
+# List credential items. If empty right after connecting, sync first.
+tinyfish vault item sync
+tinyfish vault item list
+# → each item has an `itemId` (e.g. cred:conn-123:Personal:item-abc123) — that's
+#   what --credential-item-id takes below.
+
+# Consume vault credentials in a run (uses all enabled items)
+tinyfish agent run "log in and export the invoices" --url https://example.com --use-vault
+
+# ...or scope to specific items by their itemId from `vault item list`
+tinyfish agent run "..." --url https://example.com --use-vault \
+  --credential-item-id cred:conn-123:Personal:item-abc123
+```
+
+`--credential-item-id` requires `--use-vault`. Omit it to use all enabled items. The IDs are the `itemId` values from `tinyfish vault item list` (run `vault item sync` first if the list is empty after connecting). Credential items are sourced from the connected provider — the CLI has no freeform credential create/edit (mirrors the API).
+
 ### Output format
 
 By default all commands output newline-delimited JSON to stdout — pipe-friendly for agents and scripts. Add `--pretty` for human-readable output.

package/dist/commands/run.js

@@ -116,6 +116,8 @@ export function registerRun(agentCmd) {
         .option("--max-steps <n>", `Maximum tool-call steps before stopping (1-${MAX_STEPS_LIMIT})`)
         .option("--mode <mode>", "Agent behavior mode (default|strict)")
         .option("--session-id <uuid>", "Caller-provided UUID for idempotency / parallel-safe --sync")
+        .option("--use-vault", "Consume vault credentials in this run")
+        .option("--credential-item-id <id>", "Scope vault to a specific credential item ID (repeat for multiple; get IDs from `vault item list`; requires --use-vault)", (v, acc) => [...acc, v], [])
         .option("--pretty", "Human-readable output")
         .argument("[goal]", "Goal to automate")
         .addHelpText("after", "\nToken scope note:\n  CLI runs use your personal API key. MCP runs use the MCP token.\n  These are different namespaces; getting an MCP run ID with the CLI returns 404 by design.\n")
@@ -153,6 +155,12 @@ export function registerRun(agentCmd) {
             err({ error: 'Goal cannot be empty' });
             process.exit(1);
         }
+        // The server rejects credential_item_ids without use_vault (400); fail fast here.
+        const hasCredentialItemIds = opts.credentialItemId.length > 0;
+        if (hasCredentialItemIds && !opts.useVault) {
+            err({ error: "--credential-item-id requires --use-vault" });
+            process.exit(1);
+        }
         const outputSchema = await loadOutputSchema(opts);
         const browserProfile = parseChoice(opts.browserProfile, VALID_BROWSER_PROFILES, "--browser-profile");
         const mode = parseChoice(opts.mode, VALID_MODES, "--mode");
@@ -166,6 +174,8 @@ export function registerRun(agentCmd) {
             ...(browserProfile !== undefined ? { browser_profile: browserProfile } : {}),
             ...(mode !== undefined || maxSteps !== undefined ? { agent_config: { mode, max_steps: maxSteps } } : {}),
             ...(sessionId !== undefined ? { session_id: sessionId } : {}),
+            ...(opts.useVault ? { use_vault: true } : {}),
+            ...(hasCredentialItemIds ? { credential_item_ids: opts.credentialItemId } : {}),
         };
         if (opts.async) {
             let result;

package/dist/commands/vault.d.ts

@@ -0,0 +1,2 @@
+import { Command } from "commander";
+export declare function registerVault(program: Command): void;

package/dist/commands/vault.js

@@ -0,0 +1,177 @@
+import { getApiKey } from "../lib/auth.js";
+import { vaultConnect, vaultConnections, vaultDisconnect, vaultItems, vaultSync, } from "../lib/client.js";
+import { err, handleApiError, out, outLine } from "../lib/output.js";
+const VALID_PROVIDERS = ["1password", "bitwarden"];
+// Provider secrets are read from the environment, never flags — same model as
+// the API key (TINYFISH_API_KEY). This keeps tokens out of shell history and
+// process listings, and needs no interactive prompt (agent-safe).
+const TOKEN_ENV = "TINYFISH_VAULT_TOKEN";
+const CLIENT_SECRET_ENV = "TINYFISH_VAULT_CLIENT_SECRET";
+const MASTER_PASSWORD_ENV = "TINYFISH_VAULT_MASTER_PASSWORD";
+function requireEnv(name, field, provider) {
+    const value = process.env[name];
+    if (!value) {
+        err({ error: `${provider} requires ${field} via $${name}` });
+        process.exit(1);
+    }
+    return value;
+}
+function buildConnectRequest(opts) {
+    if (!opts.provider || !VALID_PROVIDERS.includes(opts.provider)) {
+        err({ error: `--provider must be one of: ${VALID_PROVIDERS.join(", ")}` });
+        process.exit(1);
+    }
+    if (opts.provider === "1password") {
+        return { provider: "1password", token: requireEnv(TOKEN_ENV, "a service-account token", "1password") };
+    }
+    // bitwarden
+    if (!opts.clientId) {
+        err({ error: "bitwarden requires --client-id" });
+        process.exit(1);
+    }
+    return {
+        provider: "bitwarden",
+        clientId: opts.clientId,
+        clientSecret: requireEnv(CLIENT_SECRET_ENV, "a client secret", "bitwarden"),
+        masterPassword: requireEnv(MASTER_PASSWORD_ENV, "a master password", "bitwarden"),
+        ...(opts.serverUrl ? { serverUrl: opts.serverUrl } : {}),
+    };
+}
+// ── Pretty printers ───────────────────────────────────────────────────────────
+function printConnections(connections) {
+    if (connections.length === 0) {
+        outLine("No vault connections.");
+        return;
+    }
+    for (const c of connections) {
+        outLine(`${c.id}  ${c.provider}  ${c.connectionStatus}  (validated: ${c.lastValidatedAt ?? "never"})`);
+    }
+}
+function printItems(items) {
+    if (items.length === 0) {
+        outLine("No vault items. Connect a provider and run `tinyfish vault item sync`.");
+        return;
+    }
+    for (const item of items) {
+        const totp = item.hasTotp ? " [TOTP]" : "";
+        outLine(`${item.itemId}  ${item.label}  (${item.vaultName})  ${item.domains.join(", ")}${totp}`);
+    }
+}
+function printConnect(result) {
+    outLine("Vault connected");
+    outLine(`Connection ID: ${result.connectionId}`);
+    outLine(`Provider:      ${result.provider}`);
+    outLine(`Items:         ${result.items.length}`);
+}
+function printSync(result) {
+    const { added, updated, removed } = result.sync_summary;
+    outLine(`Synced ${result.items.length} items (added ${added}, updated ${updated}, removed ${removed})`);
+}
+// ── Command registration ──────────────────────────────────────────────────────
+export function registerVault(program) {
+    const vaultCmd = program
+        .command("vault")
+        .description("Vault credential commands")
+        .enablePositionalOptions();
+    const connectionCmd = vaultCmd
+        .command("connection")
+        .description("Manage vault provider connections")
+        .enablePositionalOptions();
+    connectionCmd
+        .command("list")
+        .description("List connected vault providers")
+        .option("--pretty", "Human-readable output")
+        .action(async (opts) => {
+        const apiKey = getApiKey();
+        try {
+            const response = await vaultConnections(apiKey);
+            if (opts.pretty)
+                printConnections(response.connections);
+            else
+                out(response);
+        }
+        catch (error) {
+            handleApiError(error);
+        }
+    });
+    connectionCmd
+        .command("add")
+        .description(`Connect a vault provider. Secrets come from the environment, not flags: ` +
+        `1password reads $${TOKEN_ENV}; bitwarden reads $${CLIENT_SECRET_ENV} and $${MASTER_PASSWORD_ENV}.`)
+        .requiredOption("--provider <provider>", `Vault provider (${VALID_PROVIDERS.join("|")})`)
+        .option("--client-id <id>", "Bitwarden client ID (non-secret)")
+        .option("--server-url <url>", "Self-hosted Bitwarden server URL")
+        .option("--pretty", "Human-readable output")
+        .action(async (opts) => {
+        const apiKey = getApiKey();
+        const req = buildConnectRequest(opts);
+        try {
+            const response = await vaultConnect(req, apiKey);
+            if (opts.pretty)
+                printConnect(response);
+            else
+                out(response);
+        }
+        catch (error) {
+            handleApiError(error);
+        }
+    });
+    connectionCmd
+        .command("remove")
+        .description("Disconnect a vault provider and delete its stored credentials")
+        .argument("<connectionId>", "Connection ID to disconnect")
+        .option("--pretty", "Human-readable output")
+        .action(async (connectionId, opts) => {
+        const apiKey = getApiKey();
+        try {
+            const response = await vaultDisconnect(connectionId, apiKey);
+            if (opts.pretty)
+                outLine(`Disconnected ${response.connectionId}`);
+            else
+                out(response);
+        }
+        catch (error) {
+            handleApiError(error);
+        }
+    });
+    const itemCmd = vaultCmd
+        .command("item")
+        .description("Inspect vault credential items")
+        .enablePositionalOptions();
+    itemCmd
+        .command("list")
+        .description("List vault credential items across all connections. Each item's `itemId` " +
+        "is what you pass to `agent run --credential-item-id`. If the list is empty " +
+        "after connecting, run `vault item sync` first.")
+        .option("--pretty", "Human-readable output")
+        .action(async (opts) => {
+        const apiKey = getApiKey();
+        try {
+            const response = await vaultItems(apiKey);
+            if (opts.pretty)
+                printItems(response.items);
+            else
+                out(response);
+        }
+        catch (error) {
+            handleApiError(error);
+        }
+    });
+    itemCmd
+        .command("sync")
+        .description("Re-sync credential items from connected providers")
+        .option("--pretty", "Human-readable output")
+        .action(async (opts) => {
+        const apiKey = getApiKey();
+        try {
+            const response = await vaultSync(apiKey);
+            if (opts.pretty)
+                printSync(response);
+            else
+                out(response);
+        }
+        catch (error) {
+            handleApiError(error);
+        }
+    });
+}

package/dist/index.js

@@ -6,6 +6,7 @@ import { registerBatch } from "./commands/batch.js";
 import { registerFetch } from "./commands/fetch.js";
 import { registerBrowser } from "./commands/browser.js";
 import { registerProfile } from "./commands/profile.js";
+import { registerVault } from "./commands/vault.js";
 import { registerRun } from "./commands/run.js";
 import { registerRuns } from "./commands/runs.js";
 import { registerConfigureClaude } from "./commands/config-claude.js";
@@ -29,6 +30,7 @@ registerAuth(program);
 registerConfigureClaude(program);
 registerBrowser(program);
 registerProfile(program);
+registerVault(program);
 const agentCmd = program
     .command("agent")
     .description("Agent automation commands")

package/dist/lib/client.d.ts

@@ -1,5 +1,5 @@
 import { type AgentRunAsyncResponse, type AgentRunResponse, type AgentRunWithStreamingResponse, type FetchGetContentsParams, type FetchResponse, type BrowserSession, type Run, type RunListParams, type RunListResponse, type SearchQueryParams, type SearchQueryResponse } from "@tiny-fish/sdk";
-import type { BatchCancelResponse, BatchGetResponse, BatchRunRequest, BatchRunResponse, CancelRunResponse, CliAgentRunParams, CliBrowserSessionCreateParams, CookieRecord, ProfileCreateResponse, ProfileUploadResponse, RunStepsResponse } from "./types.js";
+import type { BatchCancelResponse, BatchGetResponse, BatchRunRequest, BatchRunResponse, CancelRunResponse, CliAgentRunParams, CliBrowserSessionCreateParams, CookieRecord, ProfileCreateResponse, ProfileUploadResponse, RunStepsResponse, VaultConnectRequest, VaultConnectResponse, VaultConnectionsListResponse, VaultDisconnectResponse, VaultItemsListResponse, VaultItemsSyncResponse } from "./types.js";
 export declare function runSync(req: CliAgentRunParams, apiKey: string): Promise<AgentRunResponse>;
 export declare function runAsync(req: CliAgentRunParams, apiKey: string): Promise<AgentRunAsyncResponse>;
 export declare function runStream(req: CliAgentRunParams, apiKey: string, signal?: AbortSignal): AsyncGenerator<AgentRunWithStreamingResponse>;
@@ -15,3 +15,8 @@ export declare function getBatchRuns(runIds: string[], apiKey: string): Promise<
 export declare function cancelBatchRuns(runIds: string[], apiKey: string): Promise<BatchCancelResponse>;
 export declare function profileCreate(name: string, apiKey: string): Promise<ProfileCreateResponse>;
 export declare function profileUpload(profileId: string, cookies: CookieRecord[], apiKey: string): Promise<ProfileUploadResponse>;
+export declare function vaultConnections(apiKey: string): Promise<VaultConnectionsListResponse>;
+export declare function vaultConnect(req: VaultConnectRequest, apiKey: string): Promise<VaultConnectResponse>;
+export declare function vaultDisconnect(connectionId: string, apiKey: string): Promise<VaultDisconnectResponse>;
+export declare function vaultItems(apiKey: string): Promise<VaultItemsListResponse>;
+export declare function vaultSync(apiKey: string): Promise<VaultItemsSyncResponse>;

package/dist/lib/client.js

@@ -11,6 +11,30 @@ class TinyFishCliClient extends TinyFish {
             "User-Agent": `${base["User-Agent"] ?? ""} @tiny-fish/cli/${CLI_VERSION}`.trim(),
         };
     }
+    // The SDK base client only exposes get/post/postStream; DELETE is needed for
+    // disconnecting a vault connection. ponytail: raw fetch, no retry/timeout —
+    // matches the CLI's maxRetries:0; reuse the SDK request helper if more DELETE
+    // routes appear.
+    async del(path) {
+        const response = await fetch(`${this.baseURL}${path}`, {
+            method: "DELETE",
+            headers: this._buildHeaders(),
+        });
+        if (!response.ok) {
+            let message = response.statusText;
+            try {
+                const body = (await response.json());
+                message = body?.error?.message ?? body?.message ?? message;
+            }
+            catch {
+                // Non-JSON body — keep statusText
+            }
+            throw new ApiError(response.status, message);
+        }
+        if (response.status === 204)
+            return undefined;
+        return (await response.json());
+    }
 }
 function createSdkClient(apiKey, timeout) {
     return new TinyFishCliClient({
@@ -307,3 +331,99 @@ export async function profileUpload(profileId, cookies, apiKey) {
         rethrowSdkError(error);
     }
 }
+// ── Vault ───────────────────────────────────────────────────────────────────
+// /v1/vault/* returns camelCase fields (unlike the snake_case rest of the API).
+const vaultProviderSchema = z.enum(["1password", "bitwarden"]);
+const vaultFieldMetadataSchema = z.object({
+    fieldId: z.string(),
+    label: z.string(),
+    type: z.enum(["STRING", "CONCEALED", "OTP"]),
+});
+const vaultItemSchema = z.object({
+    itemId: z.string(),
+    connectionId: z.string().nullable(),
+    label: z.string(),
+    vaultName: z.string(),
+    domains: z.array(z.string()),
+    fieldMetadata: z.array(vaultFieldMetadataSchema),
+    hasTotp: z.boolean(),
+});
+const vaultConnectionSchema = z.object({
+    id: z.string(),
+    provider: vaultProviderSchema,
+    connectionStatus: z.string(),
+    lastValidatedAt: z.string().nullable(),
+});
+const vaultConnectionsListResponseSchema = z.object({
+    connections: z.array(vaultConnectionSchema),
+});
+const vaultConnectResponseSchema = z.object({
+    connectionId: z.string(),
+    connected: z.literal(true),
+    provider: vaultProviderSchema,
+    items: z.array(z.unknown()), // server returns snake_case items; CLI only uses .length
+});
+const vaultDisconnectResponseSchema = z.object({
+    disconnected: z.literal(true),
+    connectionId: z.string(),
+});
+const vaultItemsListResponseSchema = z.object({
+    items: z.array(vaultItemSchema),
+});
+const vaultItemsSyncResponseSchema = z.object({
+    items: z.array(z.unknown()), // server returns snake_case items; CLI only uses sync_summary
+    sync_summary: z.object({
+        added: z.number(),
+        updated: z.number(),
+        removed: z.number(),
+    }),
+});
+export async function vaultConnections(apiKey) {
+    try {
+        const response = await createSdkClient(apiKey).get("/v1/vault/connections");
+        return parseWithSchema(vaultConnectionsListResponseSchema, response, "Invalid vault connections response");
+    }
+    catch (error) {
+        rethrowSdkError(error);
+    }
+}
+export async function vaultConnect(req, apiKey) {
+    try {
+        const response = await createSdkClient(apiKey).post("/v1/vault/connections", {
+            json: req,
+        });
+        return parseWithSchema(vaultConnectResponseSchema, response, "Invalid vault connect response");
+    }
+    catch (error) {
+        rethrowSdkError(error);
+    }
+}
+export async function vaultDisconnect(connectionId, apiKey) {
+    try {
+        const response = await createSdkClient(apiKey).del(`/v1/vault/connections/${encodeURIComponent(connectionId)}`);
+        return parseWithSchema(vaultDisconnectResponseSchema, response, "Invalid vault disconnect response");
+    }
+    catch (error) {
+        rethrowSdkError(error);
+    }
+}
+export async function vaultItems(apiKey) {
+    try {
+        const response = await createSdkClient(apiKey).get("/v1/vault/items");
+        return parseWithSchema(vaultItemsListResponseSchema, response, "Invalid vault items response");
+    }
+    catch (error) {
+        rethrowSdkError(error);
+    }
+}
+export async function vaultSync(apiKey) {
+    try {
+        const response = await createSdkClient(apiKey).post("/v1/vault/items/sync", {
+            json: {},
+        });
+        return parseWithSchema(vaultItemsSyncResponseSchema, response, "Invalid vault sync response");
+    }
+    catch (error) {
+        rethrowSdkError(error);
+    }
+}

package/dist/lib/types.d.ts

@@ -8,6 +8,63 @@ export interface CliAgentRunParams extends AgentRunParams {
     };
     browser_profile?: BrowserProfile;
     session_id?: string;
+    use_vault?: boolean;
+    credential_item_ids?: string[];
+}
+export type VaultProvider = "1password" | "bitwarden";
+export interface VaultConnection {
+    id: string;
+    provider: VaultProvider;
+    connectionStatus: string;
+    lastValidatedAt: string | null;
+}
+export interface VaultFieldMetadata {
+    fieldId: string;
+    label: string;
+    type: "STRING" | "CONCEALED" | "OTP";
+}
+export interface VaultItem {
+    itemId: string;
+    connectionId: string | null;
+    label: string;
+    vaultName: string;
+    domains: string[];
+    fieldMetadata: VaultFieldMetadata[];
+    hasTotp: boolean;
+}
+export type VaultConnectRequest = {
+    provider: "1password";
+    token: string;
+} | {
+    provider: "bitwarden";
+    clientId: string;
+    clientSecret: string;
+    masterPassword: string;
+    serverUrl?: string;
+};
+export interface VaultConnectionsListResponse {
+    connections: VaultConnection[];
+}
+export interface VaultConnectResponse {
+    connectionId: string;
+    connected: true;
+    provider: VaultProvider;
+    items: unknown[];
+}
+export interface VaultDisconnectResponse {
+    disconnected: true;
+    connectionId: string;
+}
+export interface VaultItemsListResponse {
+    items: VaultItem[];
+}
+export interface VaultItemsSyncResponse {
+    items: unknown[];
+    sync_summary: {
+        added: number;
+        updated: number;
+        removed: number;
+    };
 }
 export interface RunStep {
     id: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiny-fish/cli",
-  "version": "0.1.8-next.70",
+  "version": "0.1.8-next.72",
   "description": "TinyFish CLI — run web automations from your terminal",
   "type": "module",
   "bin": {