@tiny-fish/cli 0.1.8 → 0.2.0-next.77

package/README.md

@@ -150,6 +150,41 @@ tinyfish browser session create --url https://agentql.com
 tinyfish browser session create --pretty
 ```
 
+### Vault
+
+Connect a credential provider (1Password / Bitwarden), then have runs consume those credentials.
+
+Provider secrets are read from the environment, never passed as flags — the same model as `TINYFISH_API_KEY`. This keeps tokens out of shell history and process listings.
+
+```bash
+# Connect 1Password (token from env)
+TINYFISH_VAULT_TOKEN=<service-account-token> \
+  tinyfish vault connection add --provider 1password
+
+# Connect Bitwarden (client secret + master password from env; client ID is a flag)
+TINYFISH_VAULT_CLIENT_SECRET=<secret> TINYFISH_VAULT_MASTER_PASSWORD=<password> \
+  tinyfish vault connection add --provider bitwarden --client-id <client-id>
+
+# List / disconnect connections
+tinyfish vault connection list
+tinyfish vault connection remove <connectionId>
+
+# List credential items. If empty right after connecting, sync first.
+tinyfish vault item sync
+tinyfish vault item list
+# → each item has an `itemId` (e.g. cred:conn-123:Personal:item-abc123) — that's
+#   what --credential-item-id takes below.
+
+# Consume vault credentials in a run (uses all enabled items)
+tinyfish agent run "log in and export the invoices" --url https://example.com --use-vault
+
+# ...or scope to specific items by their itemId from `vault item list`
+tinyfish agent run "..." --url https://example.com --use-vault \
+  --credential-item-id cred:conn-123:Personal:item-abc123
+```
+
+`--credential-item-id` requires `--use-vault`. Omit it to use all enabled items. The IDs are the `itemId` values from `tinyfish vault item list` (run `vault item sync` first if the list is empty after connecting). Credential items are sourced from the connected provider — the CLI has no freeform credential create/edit (mirrors the API).
+
 ### Output format
 
 By default all commands output newline-delimited JSON to stdout — pipe-friendly for agents and scripts. Add `--pretty` for human-readable output.

package/dist/commands/fetch.js

@@ -1,7 +1,7 @@
 import { InvalidArgumentError } from "commander";
 import { getApiKey } from "../lib/auth.js";
 import { fetchContentGet } from "../lib/client.js";
-import { handleApiError, out, outLine } from "../lib/output.js";
+import { err, handleApiError, out, outLine } from "../lib/output.js";
 const MIN_PER_URL_TIMEOUT_MS = 1;
 const MAX_PER_URL_TIMEOUT_MS = 110000;
 function parsePerUrlTimeoutMs(value) {
@@ -26,6 +26,12 @@ function printPrettyFetch(response) {
                 outLine(`  Title: ${result.title}`);
             if (result.final_url && result.final_url !== result.url)
                 outLine(`  Final URL: ${result.final_url}`);
+            if (result.not_modified)
+                outLine(`  Not Modified: true`);
+            if (result.etag)
+                outLine(`  ETag: ${result.etag}`);
+            if (result.last_modified)
+                outLine(`  Last-Modified: ${result.last_modified}`);
             outLine("");
         }
     }
@@ -55,8 +61,18 @@ export function registerFetch(program) {
         .option("--links", "Include extracted links")
         .option("--image-links", "Include extracted image links")
         .option("--per-url-timeout-ms <milliseconds>", "Per-URL timeout budget in milliseconds", parsePerUrlTimeoutMs)
+        .option("--if-none-match <etag>", "ETag validator for a conditional GET (single URL only)")
+        .option("--if-modified-since <http-date>", "Last-Modified validator for a conditional GET (single URL only)")
+        .option("--include-etag-and-last-modified", "Include etag / last_modified validators on each result")
         .option("--pretty", "Human-readable output")
         .action(async (urls, opts) => {
+        if ((opts.ifNoneMatch !== undefined || opts.ifModifiedSince !== undefined) &&
+            urls.length > 1) {
+            err({
+                error: "--if-none-match and --if-modified-since can only be used with a single URL, not a batch",
+            });
+            process.exit(1);
+        }
         const apiKey = getApiKey();
         try {
             const response = await fetchContentGet({
@@ -67,6 +83,13 @@ export function registerFetch(program) {
                 ...(opts.perUrlTimeoutMs !== undefined
                     ? { per_url_timeout_ms: opts.perUrlTimeoutMs }
                     : {}),
+                ...(opts.ifNoneMatch !== undefined ? { if_none_match: opts.ifNoneMatch } : {}),
+                ...(opts.ifModifiedSince !== undefined
+                    ? { if_modified_since: opts.ifModifiedSince }
+                    : {}),
+                ...(opts.includeEtagAndLastModified !== undefined
+                    ? { include_etag_and_last_modified: opts.includeEtagAndLastModified }
+                    : {}),
             }, apiKey);
             if (opts.pretty) {
                 printPrettyFetch(response);

package/dist/commands/profile.d.ts

@@ -1,2 +1,14 @@
 import { Command } from "commander";
+import type { CookieRecord } from "../lib/types.js";
+export declare function extractChromeCookies(domain: string): Promise<CookieRecord[]>;
+export declare function extractAllChromeCookies(): Promise<CookieRecord[]>;
+type TldtsParse = (host: string, opts: {
+    allowPrivateDomains: boolean;
+}) => {
+    domain?: string;
+};
+export declare function groupByCanonicalDomain(cookies: CookieRecord[], parse: TldtsParse): Map<string, CookieRecord[]>;
+export declare const MAX_COOKIES_PER_UPLOAD = 3000;
+export declare function buildChunks(groups: Map<string, CookieRecord[]>): CookieRecord[][];
 export declare function registerProfile(program: Command): void;
+export {};

package/dist/commands/profile.js

@@ -23,14 +23,11 @@ function getChromeCookiesPath() {
     if (platform === "linux") {
         return path.join(os.homedir(), ".config", "google-chrome", "Default", "Cookies");
     }
-    // Windows guard — handled in extractChromeCookies
+    // Windows guard — handled in withCookiesDb
     return "";
 }
 function validateDomain(domain) {
-    if (domain.includes("/") ||
-        domain.includes("://") ||
-        /\s/.test(domain) ||
-        /:\d/.test(domain)) {
+    if (domain.includes("/") || domain.includes("://") || /\s/.test(domain) || /:\d/.test(domain)) {
         err({ error: "domain must be a plain hostname (e.g. github.com)" });
         process.exit(1);
     }
@@ -40,7 +37,8 @@ const CHROME_EPOCH_DELTA_SECONDS = 11644473600;
 function chromeTimeToUnix(chromeMicros) {
     return Math.floor(chromeMicros / 1e6) - CHROME_EPOCH_DELTA_SECONDS;
 }
-async function extractChromeCookies(domain) {
+// Sets up chrome-cookies-secure in a temp dir and calls fn; cleans up after.
+async function withCookiesDb(fn) {
     if (process.platform === "win32") {
         throw new UserFacingError("Cookie extraction is not supported on Windows yet");
     }
@@ -56,20 +54,7 @@ async function extractChromeCookies(domain) {
         // chrome-cookies-secure is a CommonJS module — use createRequire to load it
         const require = createRequire(import.meta.url);
         const chromeCookies = require("chrome-cookies-secure");
-        // "puppeteer" format returns an array with capitalized boolean fields and
-        // Chrome-internal microsecond timestamps — convert to our CookieRecord shape.
-        const raw = await chromeCookies.getCookiesPromised(`https://${domain}`, "puppeteer", tmpDir);
-        return raw.map((c) => ({
-            name: c.name,
-            value: c.value,
-            domain: c.domain,
-            path: c.path,
-            secure: c.Secure ?? false,
-            httpOnly: c.HttpOnly ?? false,
-            ...(c.expires && c.expires > 0
-                ? { expires: chromeTimeToUnix(c.expires) }
-                : {}),
-        }));
+        return await fn(tmpDir, chromeCookies);
     }
     finally {
         try {
@@ -80,6 +65,132 @@ async function extractChromeCookies(domain) {
         }
     }
 }
+// Extract cookies for a single domain using an already-open cookies DB.
+async function extractDomain(tmpDir, chromeCookies, domain) {
+    // "puppeteer" format returns an array with capitalized boolean fields and
+    // Chrome-internal microsecond timestamps — convert to our CookieRecord shape.
+    const raw = await chromeCookies.getCookiesPromised(`https://${domain}`, "puppeteer", tmpDir);
+    return raw.map((c) => ({
+        name: c.name,
+        value: c.value,
+        domain: c.domain,
+        path: c.path,
+        secure: c.Secure ?? false,
+        httpOnly: c.HttpOnly ?? false,
+        ...(c.expires && c.expires > 0 ? { expires: chromeTimeToUnix(c.expires) } : {}),
+    }));
+}
+// Exported for testing
+export async function extractChromeCookies(domain) {
+    return withCookiesDb((tmpDir, chromeCookies) => extractDomain(tmpDir, chromeCookies, domain));
+}
+// Exported for testing
+export async function extractAllChromeCookies() {
+    return withCookiesDb(async (tmpDir, chromeCookies) => {
+        const { DatabaseSync } = createRequire(import.meta.url)("node:sqlite");
+        let sqliteDb = null;
+        let hostKeys;
+        try {
+            sqliteDb = new DatabaseSync(path.join(tmpDir, "Cookies")); // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
+            // Only import domains with auth-relevant cookies — skips tracking/analytics junk.
+            // A domain qualifies if it has any HttpOnly cookie (session/auth indicator) or
+            // a cookie whose name suggests authentication.
+            const rows = sqliteDb
+                .prepare(`SELECT DISTINCT host_key FROM cookies
+           WHERE is_httponly = 1
+              OR name LIKE '%session%'
+              OR name LIKE '%token%'
+              OR name LIKE '%auth%'
+              OR name LIKE '%sid%'
+              OR name LIKE '%login%'
+              OR name LIKE '%user%'
+              OR name LIKE '%account%'`)
+                .all();
+            hostKeys = rows.map((r) => r.host_key);
+        }
+        catch (e) {
+            throw new UserFacingError(`Failed to read Chrome cookies database: ${e instanceof Error ? e.message : String(e)}`);
+        }
+        finally {
+            try {
+                sqliteDb?.close();
+            }
+            catch {
+                // Ignore
+            }
+        }
+        // 2. Canonicalize host_keys → registrable domains (mirrors frontend/app/lib/services/domain-utils.ts)
+        const require = createRequire(import.meta.url);
+        const { parse } = require("tldts");
+        const registrableDomains = new Set();
+        for (const hk of hostKeys) {
+            const cleaned = hk.startsWith(".") ? hk.slice(1) : hk;
+            const result = parse(cleaned, { allowPrivateDomains: true });
+            if (result.domain)
+                registrableDomains.add(result.domain.toLowerCase());
+        }
+        errLine(`Scanning ${registrableDomains.size} domains from Chrome...`);
+        // 3. Extract per-domain and concat
+        const all = [];
+        for (const domain of registrableDomains) {
+            try {
+                const cookies = await extractDomain(tmpDir, chromeCookies, domain);
+                all.push(...cookies);
+            }
+            catch {
+                // skip domains chrome-cookies-secure can't parse (IPs, .local, etc.)
+            }
+        }
+        // 4. Dedup by name+domain+path
+        const seen = new Set();
+        return all.filter((c) => {
+            const key = `${c.name}\t${c.domain}\t${c.path}`;
+            if (seen.has(key))
+                return false;
+            seen.add(key);
+            return true;
+        });
+    });
+}
+// Exported for testing
+export function groupByCanonicalDomain(cookies, parse) {
+    const groups = new Map();
+    for (const c of cookies) {
+        const cleaned = c.domain.startsWith(".") ? c.domain.slice(1) : c.domain;
+        const cd = parse(cleaned, { allowPrivateDomains: true }).domain?.toLowerCase() ?? cleaned;
+        const bucket = groups.get(cd) ?? [];
+        bucket.push(c);
+        groups.set(cd, bucket);
+    }
+    return groups;
+}
+// Exported for testing
+export const MAX_COOKIES_PER_UPLOAD = 3000;
+// Exported for testing
+export function buildChunks(groups) {
+    const chunks = [];
+    let current = [];
+    for (const group of groups.values()) {
+        // A group that alone exceeds the cap is its own chunk (never split a canonical domain)
+        if (group.length > MAX_COOKIES_PER_UPLOAD) {
+            if (current.length > 0) {
+                chunks.push(current);
+                current = [];
+            }
+            chunks.push(group);
+        }
+        else if (current.length + group.length > MAX_COOKIES_PER_UPLOAD) {
+            chunks.push(current);
+            current = [...group];
+        }
+        else {
+            current.push(...group);
+        }
+    }
+    if (current.length > 0)
+        chunks.push(current);
+    return chunks;
+}
 // ── Pretty printers ───────────────────────────────────────────────────────────
 function printPrettyProfileCreate(profile) {
     outLine("Profile created");
@@ -120,26 +231,69 @@ export function registerProfile(program) {
     });
     profileCmd
         .command("import-cookies")
-        .description("Import Chrome cookies for a domain into a profile")
-        .requiredOption("--domain <domain>", "Domain to import cookies for (e.g. github.com)")
+        .description("Import Chrome cookies into a profile. Use --domain for a single domain or --all-domains for every domain in your Chrome profile. Exactly one must be provided.")
+        .option("--domain <domain>", "Domain to import cookies for (e.g. github.com)")
+        .option("--all-domains", "Import cookies for all registrable domains (e.g. github.com) found in your Chrome profile. IPs and non-resolvable hostnames (e.g. localhost) are skipped.")
         .option("--profile-id <id>", "Profile ID to import cookies into (creates new profile if omitted)")
         .option("--pretty", "Human-readable output")
         .action(async (opts) => {
+        // Mutual-exclusivity guard — must provide exactly one of --domain / --all-domains
+        if (!opts.domain && !opts.allDomains) {
+            err({ error: "Provide exactly one of --domain or --all-domains" });
+            process.exit(1);
+        }
+        if (opts.domain && opts.allDomains) {
+            err({ error: "Provide exactly one of --domain or --all-domains" });
+            process.exit(1);
+        }
         const apiKey = getApiKey();
-        validateDomain(opts.domain);
+        if (opts.domain) {
+            validateDomain(opts.domain);
+        }
         let profileId = opts.profileId;
         try {
             // Extract cookies before creating profile to avoid orphan profiles
             // if extraction fails (Windows, no Chrome, no cookies).
-            const cookies = await extractChromeCookies(opts.domain);
+            const cookies = opts.allDomains
+                ? await extractAllChromeCookies()
+                : await extractChromeCookies(opts.domain);
             if (cookies.length === 0) {
-                throw new UserFacingError(`No Chrome cookies found for ${opts.domain}. Are you logged in to this site in Chrome?`);
+                throw new UserFacingError(opts.allDomains
+                    ? "No Chrome cookies found. Is Google Chrome installed and have you logged in to any sites?"
+                    : `No Chrome cookies found for ${opts.domain}. Are you logged in to this site in Chrome?`);
             }
             if (profileId === undefined) {
-                const created = await profileCreate(opts.domain, apiKey);
+                const name = opts.allDomains ? "chrome-import" : opts.domain;
+                const created = await profileCreate(name, apiKey);
                 profileId = created.id;
             }
-            const result = await profileUpload(profileId, cookies, apiKey);
+            let result;
+            if (opts.allDomains) {
+                // Batch upload — never split a canonical domain across chunks
+                const require = createRequire(import.meta.url);
+                const { parse } = require("tldts");
+                const groups = groupByCanonicalDomain(cookies, parse);
+                const chunks = buildChunks(groups);
+                let cookieCount = 0;
+                const domainsUpdated = [];
+                const domainsFailed = [];
+                for (const chunk of chunks) {
+                    const r = await profileUpload(profileId, chunk, apiKey);
+                    cookieCount += r.cookie_count;
+                    domainsUpdated.push(...r.domains_updated);
+                    if (r.domains_failed)
+                        domainsFailed.push(...r.domains_failed);
+                }
+                result = {
+                    profile_id: profileId,
+                    cookie_count: cookieCount,
+                    domains_updated: domainsUpdated,
+                    ...(domainsFailed.length > 0 ? { domains_failed: domainsFailed } : {}),
+                };
+            }
+            else {
+                result = await profileUpload(profileId, cookies, apiKey);
+            }
             if (result.domains_failed && result.domains_failed.length > 0) {
                 errLine(`Warning: failed to update cookies for domains: ${result.domains_failed.join(", ")}`);
             }

package/dist/commands/run.js

@@ -116,6 +116,8 @@ export function registerRun(agentCmd) {
         .option("--max-steps <n>", `Maximum tool-call steps before stopping (1-${MAX_STEPS_LIMIT})`)
         .option("--mode <mode>", "Agent behavior mode (default|strict)")
         .option("--session-id <uuid>", "Caller-provided UUID for idempotency / parallel-safe --sync")
+        .option("--use-vault", "Consume vault credentials in this run")
+        .option("--credential-item-id <id>", "Scope vault to a specific credential item ID (repeat for multiple; get IDs from `vault item list`; requires --use-vault)", (v, acc) => [...acc, v], [])
         .option("--pretty", "Human-readable output")
         .argument("[goal]", "Goal to automate")
         .addHelpText("after", "\nToken scope note:\n  CLI runs use your personal API key. MCP runs use the MCP token.\n  These are different namespaces; getting an MCP run ID with the CLI returns 404 by design.\n")
@@ -153,6 +155,12 @@ export function registerRun(agentCmd) {
             err({ error: 'Goal cannot be empty' });
             process.exit(1);
         }
+        // The server rejects credential_item_ids without use_vault (400); fail fast here.
+        const hasCredentialItemIds = opts.credentialItemId.length > 0;
+        if (hasCredentialItemIds && !opts.useVault) {
+            err({ error: "--credential-item-id requires --use-vault" });
+            process.exit(1);
+        }
         const outputSchema = await loadOutputSchema(opts);
         const browserProfile = parseChoice(opts.browserProfile, VALID_BROWSER_PROFILES, "--browser-profile");
         const mode = parseChoice(opts.mode, VALID_MODES, "--mode");
@@ -166,6 +174,8 @@ export function registerRun(agentCmd) {
             ...(browserProfile !== undefined ? { browser_profile: browserProfile } : {}),
             ...(mode !== undefined || maxSteps !== undefined ? { agent_config: { mode, max_steps: maxSteps } } : {}),
             ...(sessionId !== undefined ? { session_id: sessionId } : {}),
+            ...(opts.useVault ? { use_vault: true } : {}),
+            ...(hasCredentialItemIds ? { credential_item_ids: opts.credentialItemId } : {}),
         };
         if (opts.async) {
             let result;

package/dist/commands/vault.d.ts

@@ -0,0 +1,2 @@
+import { Command } from "commander";
+export declare function registerVault(program: Command): void;

package/dist/commands/vault.js

@@ -0,0 +1,177 @@
+import { getApiKey } from "../lib/auth.js";
+import { vaultConnect, vaultConnections, vaultDisconnect, vaultItems, vaultSync, } from "../lib/client.js";
+import { err, handleApiError, out, outLine } from "../lib/output.js";
+const VALID_PROVIDERS = ["1password", "bitwarden"];
+// Provider secrets are read from the environment, never flags — same model as
+// the API key (TINYFISH_API_KEY). This keeps tokens out of shell history and
+// process listings, and needs no interactive prompt (agent-safe).
+const TOKEN_ENV = "TINYFISH_VAULT_TOKEN";
+const CLIENT_SECRET_ENV = "TINYFISH_VAULT_CLIENT_SECRET";
+const MASTER_PASSWORD_ENV = "TINYFISH_VAULT_MASTER_PASSWORD";
+function requireEnv(name, field, provider) {
+    const value = process.env[name];
+    if (!value) {
+        err({ error: `${provider} requires ${field} via $${name}` });
+        process.exit(1);
+    }
+    return value;
+}
+function buildConnectRequest(opts) {
+    if (!opts.provider || !VALID_PROVIDERS.includes(opts.provider)) {
+        err({ error: `--provider must be one of: ${VALID_PROVIDERS.join(", ")}` });
+        process.exit(1);
+    }
+    if (opts.provider === "1password") {
+        return { provider: "1password", token: requireEnv(TOKEN_ENV, "a service-account token", "1password") };
+    }
+    // bitwarden
+    if (!opts.clientId) {
+        err({ error: "bitwarden requires --client-id" });
+        process.exit(1);
+    }
+    return {
+        provider: "bitwarden",
+        clientId: opts.clientId,
+        clientSecret: requireEnv(CLIENT_SECRET_ENV, "a client secret", "bitwarden"),
+        masterPassword: requireEnv(MASTER_PASSWORD_ENV, "a master password", "bitwarden"),
+        ...(opts.serverUrl ? { serverUrl: opts.serverUrl } : {}),
+    };
+}
+// ── Pretty printers ───────────────────────────────────────────────────────────
+function printConnections(connections) {
+    if (connections.length === 0) {
+        outLine("No vault connections.");
+        return;
+    }
+    for (const c of connections) {
+        outLine(`${c.id}  ${c.provider}  ${c.connectionStatus}  (validated: ${c.lastValidatedAt ?? "never"})`);
+    }
+}
+function printItems(items) {
+    if (items.length === 0) {
+        outLine("No vault items. Connect a provider and run `tinyfish vault item sync`.");
+        return;
+    }
+    for (const item of items) {
+        const totp = item.hasTotp ? " [TOTP]" : "";
+        outLine(`${item.itemId}  ${item.label}  (${item.vaultName})  ${item.domains.join(", ")}${totp}`);
+    }
+}
+function printConnect(result) {
+    outLine("Vault connected");
+    outLine(`Connection ID: ${result.connectionId}`);
+    outLine(`Provider:      ${result.provider}`);
+    outLine(`Items:         ${result.items.length}`);
+}
+function printSync(result) {
+    const { added, updated, removed } = result.sync_summary;
+    outLine(`Synced ${result.items.length} items (added ${added}, updated ${updated}, removed ${removed})`);
+}
+// ── Command registration ──────────────────────────────────────────────────────
+export function registerVault(program) {
+    const vaultCmd = program
+        .command("vault")
+        .description("Vault credential commands")
+        .enablePositionalOptions();
+    const connectionCmd = vaultCmd
+        .command("connection")
+        .description("Manage vault provider connections")
+        .enablePositionalOptions();
+    connectionCmd
+        .command("list")
+        .description("List connected vault providers")
+        .option("--pretty", "Human-readable output")
+        .action(async (opts) => {
+        const apiKey = getApiKey();
+        try {
+            const response = await vaultConnections(apiKey);
+            if (opts.pretty)
+                printConnections(response.connections);
+            else
+                out(response);
+        }
+        catch (error) {
+            handleApiError(error);
+        }
+    });
+    connectionCmd
+        .command("add")
+        .description(`Connect a vault provider. Secrets come from the environment, not flags: ` +
+        `1password reads $${TOKEN_ENV}; bitwarden reads $${CLIENT_SECRET_ENV} and $${MASTER_PASSWORD_ENV}.`)
+        .requiredOption("--provider <provider>", `Vault provider (${VALID_PROVIDERS.join("|")})`)
+        .option("--client-id <id>", "Bitwarden client ID (non-secret)")
+        .option("--server-url <url>", "Self-hosted Bitwarden server URL")
+        .option("--pretty", "Human-readable output")
+        .action(async (opts) => {
+        const apiKey = getApiKey();
+        const req = buildConnectRequest(opts);
+        try {
+            const response = await vaultConnect(req, apiKey);
+            if (opts.pretty)
+                printConnect(response);
+            else
+                out(response);
+        }
+        catch (error) {
+            handleApiError(error);
+        }
+    });
+    connectionCmd
+        .command("remove")
+        .description("Disconnect a vault provider and delete its stored credentials")
+        .argument("<connectionId>", "Connection ID to disconnect")
+        .option("--pretty", "Human-readable output")
+        .action(async (connectionId, opts) => {
+        const apiKey = getApiKey();
+        try {
+            const response = await vaultDisconnect(connectionId, apiKey);
+            if (opts.pretty)
+                outLine(`Disconnected ${response.connectionId}`);
+            else
+                out(response);
+        }
+        catch (error) {
+            handleApiError(error);
+        }
+    });
+    const itemCmd = vaultCmd
+        .command("item")
+        .description("Inspect vault credential items")
+        .enablePositionalOptions();
+    itemCmd
+        .command("list")
+        .description("List vault credential items across all connections. Each item's `itemId` " +
+        "is what you pass to `agent run --credential-item-id`. If the list is empty " +
+        "after connecting, run `vault item sync` first.")
+        .option("--pretty", "Human-readable output")
+        .action(async (opts) => {
+        const apiKey = getApiKey();
+        try {
+            const response = await vaultItems(apiKey);
+            if (opts.pretty)
+                printItems(response.items);
+            else
+                out(response);
+        }
+        catch (error) {
+            handleApiError(error);
+        }
+    });
+    itemCmd
+        .command("sync")
+        .description("Re-sync credential items from connected providers")
+        .option("--pretty", "Human-readable output")
+        .action(async (opts) => {
+        const apiKey = getApiKey();
+        try {
+            const response = await vaultSync(apiKey);
+            if (opts.pretty)
+                printSync(response);
+            else
+                out(response);
+        }
+        catch (error) {
+            handleApiError(error);
+        }
+    });
+}

package/dist/index.js

@@ -6,6 +6,7 @@ import { registerBatch } from "./commands/batch.js";
 import { registerFetch } from "./commands/fetch.js";
 import { registerBrowser } from "./commands/browser.js";
 import { registerProfile } from "./commands/profile.js";
+import { registerVault } from "./commands/vault.js";
 import { registerRun } from "./commands/run.js";
 import { registerRuns } from "./commands/runs.js";
 import { registerConfigureClaude } from "./commands/config-claude.js";
@@ -29,6 +30,7 @@ registerAuth(program);
 registerConfigureClaude(program);
 registerBrowser(program);
 registerProfile(program);
+registerVault(program);
 const agentCmd = program
     .command("agent")
     .description("Agent automation commands")

package/dist/lib/client.d.ts

@@ -1,5 +1,5 @@
 import { type AgentRunAsyncResponse, type AgentRunResponse, type AgentRunWithStreamingResponse, type FetchGetContentsParams, type FetchResponse, type BrowserSession, type Run, type RunListParams, type RunListResponse, type SearchQueryParams, type SearchQueryResponse } from "@tiny-fish/sdk";
-import type { BatchCancelResponse, BatchGetResponse, BatchRunRequest, BatchRunResponse, CancelRunResponse, CliAgentRunParams, CliBrowserSessionCreateParams, CookieRecord, ProfileCreateResponse, ProfileUploadResponse, RunStepsResponse } from "./types.js";
+import type { BatchCancelResponse, BatchGetResponse, BatchRunRequest, BatchRunResponse, CancelRunResponse, CliAgentRunParams, CliBrowserSessionCreateParams, CookieRecord, ProfileCreateResponse, ProfileUploadResponse, RunStepsResponse, VaultConnectRequest, VaultConnectResponse, VaultConnectionsListResponse, VaultDisconnectResponse, VaultItemsListResponse, VaultItemsSyncResponse } from "./types.js";
 export declare function runSync(req: CliAgentRunParams, apiKey: string): Promise<AgentRunResponse>;
 export declare function runAsync(req: CliAgentRunParams, apiKey: string): Promise<AgentRunAsyncResponse>;
 export declare function runStream(req: CliAgentRunParams, apiKey: string, signal?: AbortSignal): AsyncGenerator<AgentRunWithStreamingResponse>;
@@ -15,3 +15,8 @@ export declare function getBatchRuns(runIds: string[], apiKey: string): Promise<
 export declare function cancelBatchRuns(runIds: string[], apiKey: string): Promise<BatchCancelResponse>;
 export declare function profileCreate(name: string, apiKey: string): Promise<ProfileCreateResponse>;
 export declare function profileUpload(profileId: string, cookies: CookieRecord[], apiKey: string): Promise<ProfileUploadResponse>;
+export declare function vaultConnections(apiKey: string): Promise<VaultConnectionsListResponse>;
+export declare function vaultConnect(req: VaultConnectRequest, apiKey: string): Promise<VaultConnectResponse>;
+export declare function vaultDisconnect(connectionId: string, apiKey: string): Promise<VaultDisconnectResponse>;
+export declare function vaultItems(apiKey: string): Promise<VaultItemsListResponse>;
+export declare function vaultSync(apiKey: string): Promise<VaultItemsSyncResponse>;

package/dist/lib/client.js

@@ -1,14 +1,40 @@
 import { APIStatusError, agentRunAsyncResponseSchema, agentRunResponseSchema, agentRunWithStreamingResponseSchema, fetchResponseSchema, browserSessionSchema, searchQueryResponseSchema, TinyFish, runSchema, runStatusSchema, } from "@tiny-fish/sdk";
-import { BASE_URL } from "./constants.js";
+import { BASE_URL, CLI_VERSION } from "./constants.js";
 import { ApiError } from "./output.js";
 import { z } from "zod";
 class TinyFishCliClient extends TinyFish {
     _buildHeaders() {
+        const base = super._buildHeaders();
         return {
-            ...super._buildHeaders(),
+            ...base,
             "X-TF-Request-Origin": "tinyfish-cli",
+            "User-Agent": `${base["User-Agent"] ?? ""} @tiny-fish/cli/${CLI_VERSION}`.trim(),
         };
     }
+    // The SDK base client only exposes get/post/postStream; DELETE is needed for
+    // disconnecting a vault connection. ponytail: raw fetch, no retry/timeout —
+    // matches the CLI's maxRetries:0; reuse the SDK request helper if more DELETE
+    // routes appear.
+    async del(path) {
+        const response = await fetch(`${this.baseURL}${path}`, {
+            method: "DELETE",
+            headers: this._buildHeaders(),
+        });
+        if (!response.ok) {
+            let message = response.statusText;
+            try {
+                const body = (await response.json());
+                message = body?.error?.message ?? body?.message ?? message;
+            }
+            catch {
+                // Non-JSON body — keep statusText
+            }
+            throw new ApiError(response.status, message);
+        }
+        if (response.status === 204)
+            return undefined;
+        return (await response.json());
+    }
 }
 function createSdkClient(apiKey, timeout) {
     return new TinyFishCliClient({
@@ -305,3 +331,99 @@ export async function profileUpload(profileId, cookies, apiKey) {
         rethrowSdkError(error);
     }
 }
+// ── Vault ───────────────────────────────────────────────────────────────────
+// /v1/vault/* returns camelCase fields (unlike the snake_case rest of the API).
+const vaultProviderSchema = z.enum(["1password", "bitwarden"]);
+const vaultFieldMetadataSchema = z.object({
+    fieldId: z.string(),
+    label: z.string(),
+    type: z.enum(["STRING", "CONCEALED", "OTP"]),
+});
+const vaultItemSchema = z.object({
+    itemId: z.string(),
+    connectionId: z.string().nullable(),
+    label: z.string(),
+    vaultName: z.string(),
+    domains: z.array(z.string()),
+    fieldMetadata: z.array(vaultFieldMetadataSchema),
+    hasTotp: z.boolean(),
+});
+const vaultConnectionSchema = z.object({
+    id: z.string(),
+    provider: vaultProviderSchema,
+    connectionStatus: z.string(),
+    lastValidatedAt: z.string().nullable(),
+});
+const vaultConnectionsListResponseSchema = z.object({
+    connections: z.array(vaultConnectionSchema),
+});
+const vaultConnectResponseSchema = z.object({
+    connectionId: z.string(),
+    connected: z.literal(true),
+    provider: vaultProviderSchema,
+    items: z.array(z.unknown()), // server returns snake_case items; CLI only uses .length
+});
+const vaultDisconnectResponseSchema = z.object({
+    disconnected: z.literal(true),
+    connectionId: z.string(),
+});
+const vaultItemsListResponseSchema = z.object({
+    items: z.array(vaultItemSchema),
+});
+const vaultItemsSyncResponseSchema = z.object({
+    items: z.array(z.unknown()), // server returns snake_case items; CLI only uses sync_summary
+    sync_summary: z.object({
+        added: z.number(),
+        updated: z.number(),
+        removed: z.number(),
+    }),
+});
+export async function vaultConnections(apiKey) {
+    try {
+        const response = await createSdkClient(apiKey).get("/v1/vault/connections");
+        return parseWithSchema(vaultConnectionsListResponseSchema, response, "Invalid vault connections response");
+    }
+    catch (error) {
+        rethrowSdkError(error);
+    }
+}
+export async function vaultConnect(req, apiKey) {
+    try {
+        const response = await createSdkClient(apiKey).post("/v1/vault/connections", {
+            json: req,
+        });
+        return parseWithSchema(vaultConnectResponseSchema, response, "Invalid vault connect response");
+    }
+    catch (error) {
+        rethrowSdkError(error);
+    }
+}
+export async function vaultDisconnect(connectionId, apiKey) {
+    try {
+        const response = await createSdkClient(apiKey).del(`/v1/vault/connections/${encodeURIComponent(connectionId)}`);
+        return parseWithSchema(vaultDisconnectResponseSchema, response, "Invalid vault disconnect response");
+    }
+    catch (error) {
+        rethrowSdkError(error);
+    }
+}
+export async function vaultItems(apiKey) {
+    try {
+        const response = await createSdkClient(apiKey).get("/v1/vault/items");
+        return parseWithSchema(vaultItemsListResponseSchema, response, "Invalid vault items response");
+    }
+    catch (error) {
+        rethrowSdkError(error);
+    }
+}
+export async function vaultSync(apiKey) {
+    try {
+        const response = await createSdkClient(apiKey).post("/v1/vault/items/sync", {
+            json: {},
+        });
+        return parseWithSchema(vaultItemsSyncResponseSchema, response, "Invalid vault sync response");
+    }
+    catch (error) {
+        rethrowSdkError(error);
+    }
+}

package/dist/lib/constants.d.ts

@@ -1,3 +1,4 @@
+export declare const CLI_VERSION: string;
 export declare const BASE_URL: string;
 /** URL where users can create and manage API keys */
 export declare function getDashboardUrl(source?: string): string;

package/dist/lib/constants.js

@@ -1,3 +1,7 @@
+import { createRequire } from "module";
+const _require = createRequire(import.meta.url);
+const _pkg = _require("../../package.json");
+export const CLI_VERSION = _pkg.version;
 /** Base URL for the TinyFish API. Override with TINYFISH_API_URL for staging/self-hosted (must be https). */
 const apiUrlOverride = process.env["TINYFISH_API_URL"]?.trim();
 if (apiUrlOverride) {

package/dist/lib/types.d.ts

@@ -8,6 +8,63 @@ export interface CliAgentRunParams extends AgentRunParams {
     };
     browser_profile?: BrowserProfile;
     session_id?: string;
+    use_vault?: boolean;
+    credential_item_ids?: string[];
+}
+export type VaultProvider = "1password" | "bitwarden";
+export interface VaultConnection {
+    id: string;
+    provider: VaultProvider;
+    connectionStatus: string;
+    lastValidatedAt: string | null;
+}
+export interface VaultFieldMetadata {
+    fieldId: string;
+    label: string;
+    type: "STRING" | "CONCEALED" | "OTP";
+}
+export interface VaultItem {
+    itemId: string;
+    connectionId: string | null;
+    label: string;
+    vaultName: string;
+    domains: string[];
+    fieldMetadata: VaultFieldMetadata[];
+    hasTotp: boolean;
+}
+export type VaultConnectRequest = {
+    provider: "1password";
+    token: string;
+} | {
+    provider: "bitwarden";
+    clientId: string;
+    clientSecret: string;
+    masterPassword: string;
+    serverUrl?: string;
+};
+export interface VaultConnectionsListResponse {
+    connections: VaultConnection[];
+}
+export interface VaultConnectResponse {
+    connectionId: string;
+    connected: true;
+    provider: VaultProvider;
+    items: unknown[];
+}
+export interface VaultDisconnectResponse {
+    disconnected: true;
+    connectionId: string;
+}
+export interface VaultItemsListResponse {
+    items: VaultItem[];
+}
+export interface VaultItemsSyncResponse {
+    items: unknown[];
+    sync_summary: {
+        added: number;
+        updated: number;
+        removed: number;
+    };
 }
 export interface RunStep {
     id: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiny-fish/cli",
-  "version": "0.1.8",
+  "version": "0.2.0-next.77",
   "description": "TinyFish CLI — run web automations from your terminal",
   "type": "module",
   "bin": {
@@ -32,7 +32,7 @@
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "@tiny-fish/sdk": "^0.0.7",
+    "@tiny-fish/sdk": "^0.0.11",
     "chrome-cookies-secure": "^3.0.2",
     "commander": "^12.0.0",
     "globals": "^17.4.0",