@tiny-fish/cli 0.1.8-next.71 → 0.1.8-next.72

package/README.md

@@ -172,10 +172,18 @@ tinyfish vault connection remove <connectionId>
 # List credential items. If empty right after connecting, sync first.
 tinyfish vault item sync
 tinyfish vault item list
-# → each item has an `itemId` (e.g. cred:conn-123:Personal:item-abc123).
+# → each item has an `itemId` (e.g. cred:conn-123:Personal:item-abc123) — that's
+#   what --credential-item-id takes below.
+
+# Consume vault credentials in a run (uses all enabled items)
+tinyfish agent run "log in and export the invoices" --url https://example.com --use-vault
+
+# ...or scope to specific items by their itemId from `vault item list`
+tinyfish agent run "..." --url https://example.com --use-vault \
+  --credential-item-id cred:conn-123:Personal:item-abc123
 ```
 
-Credential items are sourced from the connected provider — the CLI has no freeform credential create/edit (mirrors the API).
+`--credential-item-id` requires `--use-vault`. Omit it to use all enabled items. The IDs are the `itemId` values from `tinyfish vault item list` (run `vault item sync` first if the list is empty after connecting). Credential items are sourced from the connected provider — the CLI has no freeform credential create/edit (mirrors the API).
 
 ### Output format
 

package/dist/commands/run.js

@@ -116,6 +116,8 @@ export function registerRun(agentCmd) {
         .option("--max-steps <n>", `Maximum tool-call steps before stopping (1-${MAX_STEPS_LIMIT})`)
         .option("--mode <mode>", "Agent behavior mode (default|strict)")
         .option("--session-id <uuid>", "Caller-provided UUID for idempotency / parallel-safe --sync")
+        .option("--use-vault", "Consume vault credentials in this run")
+        .option("--credential-item-id <id>", "Scope vault to a specific credential item ID (repeat for multiple; get IDs from `vault item list`; requires --use-vault)", (v, acc) => [...acc, v], [])
         .option("--pretty", "Human-readable output")
         .argument("[goal]", "Goal to automate")
         .addHelpText("after", "\nToken scope note:\n  CLI runs use your personal API key. MCP runs use the MCP token.\n  These are different namespaces; getting an MCP run ID with the CLI returns 404 by design.\n")
@@ -153,6 +155,12 @@ export function registerRun(agentCmd) {
             err({ error: 'Goal cannot be empty' });
             process.exit(1);
         }
+        // The server rejects credential_item_ids without use_vault (400); fail fast here.
+        const hasCredentialItemIds = opts.credentialItemId.length > 0;
+        if (hasCredentialItemIds && !opts.useVault) {
+            err({ error: "--credential-item-id requires --use-vault" });
+            process.exit(1);
+        }
         const outputSchema = await loadOutputSchema(opts);
         const browserProfile = parseChoice(opts.browserProfile, VALID_BROWSER_PROFILES, "--browser-profile");
         const mode = parseChoice(opts.mode, VALID_MODES, "--mode");
@@ -166,6 +174,8 @@ export function registerRun(agentCmd) {
             ...(browserProfile !== undefined ? { browser_profile: browserProfile } : {}),
             ...(mode !== undefined || maxSteps !== undefined ? { agent_config: { mode, max_steps: maxSteps } } : {}),
             ...(sessionId !== undefined ? { session_id: sessionId } : {}),
+            ...(opts.useVault ? { use_vault: true } : {}),
+            ...(hasCredentialItemIds ? { credential_item_ids: opts.credentialItemId } : {}),
         };
         if (opts.async) {
             let result;

package/dist/commands/vault.js

@@ -141,7 +141,7 @@ export function registerVault(program) {
     itemCmd
         .command("list")
         .description("List vault credential items across all connections. Each item's `itemId` " +
-        "is what you pass to `agent run --credential-item-ids`. If the list is empty " +
+        "is what you pass to `agent run --credential-item-id`. If the list is empty " +
         "after connecting, run `vault item sync` first.")
         .option("--pretty", "Human-readable output")
         .action(async (opts) => {

package/dist/lib/types.d.ts

@@ -8,6 +8,8 @@ export interface CliAgentRunParams extends AgentRunParams {
     };
     browser_profile?: BrowserProfile;
     session_id?: string;
+    use_vault?: boolean;
+    credential_item_ids?: string[];
 }
 export type VaultProvider = "1password" | "bitwarden";
 export interface VaultConnection {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiny-fish/cli",
-  "version": "0.1.8-next.71",
+  "version": "0.1.8-next.72",
   "description": "TinyFish CLI — run web automations from your terminal",
   "type": "module",
   "bin": {