@tiny-fish/cli 0.10.1 → 0.10.2-next.131

package/dist/commands/connect.js

@@ -1,14 +1,14 @@
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import * as path from "node:path";
 import spawn from "cross-spawn";
-import { CONNECT_SOURCE, persistApiKeyToEnvironment, saveConfig, saveConnectContext, validateKeyFormat, } from "../lib/auth.js";
+import { CONNECT_SOURCE, loadConfig, persistApiKeyToEnvironment, saveConnectContext, validateKeyFormat, writeConfig, } from "../lib/auth.js";
 import { CLI_VERSION } from "../lib/constants.js";
 import { errLine } from "../lib/output.js";
 const DEFAULT_MCP_URL = "https://agent.tinyfish.ai/mcp";
 const NON_INTERACTIVE_TIMEOUT_MS = 10_000;
 const SKILL_INSTALL_TIMEOUT_MS = 120_000;
 const HERMES_SEED_TIMEOUT_MS = 120_000;
-const TELEMETRY_TIMEOUT_MS = 500;
+const TELEMETRY_TIMEOUT_MS = 2_000;
 const MCP_LOGIN_UNAVAILABLE_MESSAGE = "This Claude Code installation does not expose `claude mcp login`, which is required for " +
     "one-command MCP authentication. Update Claude Code and retry, or authenticate TinyFish " +
     "manually from /mcp.";
@@ -32,6 +32,72 @@ export const OPENCLAW_ONBOARDING_PROMPT = "I just installed the TinyFish skill.
     "want to search and wait for my reply before using TinyFish Search. Show me the results, ask " +
     "which result I want to read, and wait before using TinyFish Fetch. Then ask what browser task " +
     "I want to complete and wait before using TinyFish Agent. Never skip ahead or choose for me.";
+/** Ctrl+C/SIGTERM killed a setup child — abandonment, not error. */
+class ConnectInterruptedError extends Error {
+}
+function throwIfInterrupted(result) {
+    if (result.signal === "SIGINT" || result.signal === "SIGTERM") {
+        throw new ConnectInterruptedError("Setup interrupted");
+    }
+}
+/** Terminal events exactly once, whichever of flow or signal handler wins. */
+function settle(state, telemetry, stage, detail) {
+    if (state.settled)
+        return;
+    state.settled = true;
+    telemetry.track(stage, detail);
+}
+// Without a parent handler, terminal Ctrl+C kills this process inside spawn.sync
+// before the child result exists — no aborted event, no flush. With one, the parent
+// survives; raw-mode children still surface via throwIfInterrupted, and cooked-mode
+// stages (npm/npx/OAuth waits) land here.
+// 128 + signal number
+const SIGNAL_EXIT_CODES = { SIGHUP: 129, SIGINT: 130, SIGTERM: 143 };
+function installSignalGuard(state, telemetry) {
+    const onSignal = (signal) => {
+        if (state.settled) {
+            process.exit(SIGNAL_EXIT_CODES[signal]);
+        }
+        settle(state, telemetry, "aborted", { failedStage: state.stage });
+        errLine("Setup interrupted — run the command again to finish.");
+        void telemetry.flush().finally(() => process.exit(SIGNAL_EXIT_CODES[signal]));
+    };
+    const signals = ["SIGINT", "SIGTERM", "SIGHUP"];
+    const handlers = signals.map((s) => {
+        const handler = () => onSignal(s);
+        process.on(s, handler);
+        return [s, handler];
+    });
+    return () => {
+        for (const [s, handler] of handlers)
+            process.off(s, handler);
+    };
+}
+/** Shared terminal handling: interrupted → aborted (or completed post-install), else failed. */
+async function runGuarded(state, telemetry, body) {
+    const uninstallSignalGuard = installSignalGuard(state, telemetry);
+    try {
+        body();
+    }
+    catch (error) {
+        if (error instanceof ConnectInterruptedError) {
+            if (state.stage === "walkthrough_launch") {
+                settle(state, telemetry, "completed");
+                return;
+            }
+            settle(state, telemetry, "aborted", { failedStage: state.stage });
+            errLine("Setup interrupted — run the command again to finish.");
+            process.exitCode = 130;
+            return;
+        }
+        settle(state, telemetry, "failed", { failedStage: state.stage });
+        throw error;
+    }
+    finally {
+        uninstallSignalGuard();
+        await telemetry.flush();
+    }
+}
 const CLAUDE_CODE = {
     command: "claude",
     connectClient: "claude-code",
@@ -96,6 +162,7 @@ function launchHermesWalkthrough() {
         timeout: HERMES_SEED_TIMEOUT_MS,
     });
     if (seedResult.error || seedResult.status !== 0) {
+        throwIfInterrupted(seedResult);
         throw new Error("Could not start the TinyFish walkthrough in Hermes", {
             cause: seedResult.error,
         });
@@ -159,44 +226,69 @@ function isTrustedTelemetryOrigin(endpoint) {
         return false;
     return TRUSTED_TELEMETRY_HOST_SUFFIXES.some((suffix) => host === suffix.slice(1) || host.endsWith(suffix));
 }
+function storedApiKey() {
+    try {
+        return loadConfig().api_key;
+    }
+    catch {
+        return undefined;
+    }
+}
 function createConnectTelemetry(mcpUrl, client, apiKey) {
     const attemptId = randomUUID();
     const endpoint = new URL("/api/cli/connect-event", mcpUrl).toString();
-    const telemetryKey = apiKey ?? process.env["TINYFISH_API_KEY"];
+    const telemetryKey = apiKey || process.env["TINYFISH_API_KEY"] || storedApiKey();
     const headers = { "content-type": "application/json" };
-    // Attach the key so the endpoint can attribute the event to the signed-in user, but only
-    // when it is well-formed AND the endpoint is a trusted TinyFish origin. A user-supplied
-    // --url pointing elsewhere gets anonymous telemetry, never the key.
+    // SHA-256 lookup key only — the raw key never rides a telemetry request
+    // (OWASP: keep credentials out of anything logging infra might capture).
     if (telemetryKey && validateKeyFormat(telemetryKey) && isTrustedTelemetryOrigin(endpoint)) {
-        headers["x-api-key"] = telemetryKey;
+        headers["x-api-key-lookup"] = createHash("sha256").update(telemetryKey).digest("hex");
     }
-    let enabled = true;
-    return {
-        attemptId,
-        async track(stage, failedStage) {
-            if (!enabled)
-                return;
+    const pending = [];
+    async function deliver(body) {
+        // One retry: stale keep-alive sockets eat post-install POSTs. 5xx retries;
+        // 4xx never will (schema mismatch, e.g. new stages hitting an old server).
+        for (let attempt = 0; attempt < 2; attempt++) {
             try {
                 const response = await fetch(endpoint, {
                     method: "POST",
                     headers,
-                    body: JSON.stringify({
-                        attempt_id: attemptId,
-                        client,
-                        stage,
-                        failed_stage: failedStage,
-                        runtime_platform: process.platform,
-                        node_version: process.version,
-                        cli_version: CLI_VERSION,
-                    }),
+                    body,
+                    redirect: "error",
                     signal: AbortSignal.timeout(TELEMETRY_TIMEOUT_MS),
                 });
-                if (!response.ok)
-                    enabled = false;
+                if (response.ok)
+                    return;
+                if (response.status < 500) {
+                    if (process.env["TINYFISH_DEBUG"]) {
+                        errLine(`telemetry rejected: HTTP ${response.status}`);
+                    }
+                    return;
+                }
             }
             catch {
-                enabled = false;
+                // best-effort; never blocks setup
             }
+        }
+    }
+    return {
+        attemptId,
+        // Fire-and-forget; awaiting each event stalls setup when telemetry down.
+        track(stage, detail) {
+            pending.push(deliver(JSON.stringify({
+                attempt_id: attemptId,
+                client,
+                stage,
+                failed_stage: detail?.failedStage,
+                phase: detail?.phase,
+                runtime_platform: process.platform,
+                node_version: process.version,
+                cli_version: CLI_VERSION,
+            })));
+        },
+        // Awaited in finally so in-flight events land before exit.
+        async flush() {
+            await Promise.all(pending);
         },
     };
 }
@@ -211,6 +303,7 @@ function requireCommandSupport(client) {
         });
     }
     if (result.error || result.status !== 0) {
+        throwIfInterrupted(result);
         throw new Error(client.supportCheck.unavailableMessage, { cause: result.error });
     }
     const output = `${result.stdout ?? ""}\n${result.stderr ?? ""}`;
@@ -228,6 +321,7 @@ function installTinyFishCli() {
         timeout: SKILL_INSTALL_TIMEOUT_MS,
     });
     if (result.error || result.status !== 0) {
+        throwIfInterrupted(result);
         throw new Error("Could not install the TinyFish CLI", { cause: result.error });
     }
 }
@@ -253,6 +347,7 @@ function installWebSkill(client) {
         timeout: SKILL_INSTALL_TIMEOUT_MS,
     });
     if (result.error || result.status !== 0) {
+        throwIfInterrupted(result);
         throw new Error(`Could not install the TinyFish web skill in ${client.displayName}`, {
             cause: result.error,
         });
@@ -264,7 +359,8 @@ function ensureCliAuthenticated(source, apiKey) {
         if (!validateKeyFormat(envKey)) {
             throw new Error("TINYFISH_API_KEY has invalid format");
         }
-        saveConfig(envKey);
+        // Throwing variant: a write failure must reach connect's catch/flush, not exit(1) past it.
+        writeConfig(envKey);
         persistApiKeyToEnvironment(envKey);
         return;
     }
@@ -285,6 +381,7 @@ function ensureCliAuthenticated(source, apiKey) {
         throw new Error(TINYFISH_CLI_NOT_FOUND_MESSAGE, { cause: loginResult.error });
     }
     if (loginResult.error || loginResult.status !== 0) {
+        throwIfInterrupted(loginResult);
         throw new Error("Could not authenticate the TinyFish CLI", { cause: loginResult.error });
     }
 }
@@ -295,6 +392,7 @@ function removeExistingRegistration(client, removal) {
     });
     if (result.status === 0)
         return;
+    throwIfInterrupted(result);
     const details = result.stderr?.trim() || result.error?.message || "unknown error";
     if (/No MCP server named "tinyfish"/i.test(details))
         return;
@@ -339,62 +437,66 @@ function launchOpenClawWalkthrough() {
 }
 async function connectNativeMcpClient(client, options) {
     const telemetry = createConnectTelemetry(options.mcpUrl, client.connectClient, options.apiKey);
-    let failureStage = "prerequisite_check";
-    try {
-        await telemetry.track("started");
+    const state = { stage: "prerequisite_check", settled: false };
+    await runGuarded(state, telemetry, () => {
+        telemetry.track("started");
         requireCommandSupport(client);
-        failureStage = "registration_cleanup";
+        telemetry.track("checkpoint", { phase: "prerequisite_ok" });
+        state.stage = "registration_cleanup";
         for (const removal of client.removals)
             removeExistingRegistration(client, removal);
         const mcpUrl = new URL(options.mcpUrl);
         mcpUrl.searchParams.set("source", CONNECT_SOURCE);
         mcpUrl.searchParams.set("client", client.connectClient);
         mcpUrl.searchParams.set("connect_attempt_id", telemetry.attemptId);
-        failureStage = client.loginArgs ? "registration" : "registration_or_authentication";
+        state.stage = client.loginArgs ? "registration" : "registration_or_authentication";
         errLine(`Adding TinyFish to ${client.displayName}...`);
         const addResult = spawn.sync(client.command, client.addArgs(mcpUrl.toString(), options.mcpUrl), {
             stdio: "inherit",
         });
         if (addResult.error || addResult.status !== 0) {
+            throwIfInterrupted(addResult);
             throw new Error(`Could not add TinyFish to ${client.displayName}`, {
                 cause: addResult.error,
             });
         }
+        telemetry.track("checkpoint", { phase: "registered" });
         if (client.loginArgs) {
-            failureStage = "authentication";
+            state.stage = "client_oauth";
             errLine("Signing in to TinyFish...");
             const loginResult = spawn.sync(client.command, client.loginArgs, {
                 stdio: "inherit",
             });
             if (loginResult.error || loginResult.status !== 0) {
+                throwIfInterrupted(loginResult);
                 throw new Error(`Could not authenticate TinyFish in ${client.displayName}`, {
                     cause: loginResult.error,
                 });
             }
+            telemetry.track("checkpoint", { phase: "oauth_done" });
         }
-        failureStage = "cli_install";
+        state.stage = "cli_install";
         installTinyFishCli();
-        failureStage = "skill_install";
+        telemetry.track("checkpoint", { phase: "cli_installed" });
+        state.stage = "skill_install";
         installWebSkill(client);
-        failureStage = "authentication";
+        telemetry.track("checkpoint", { phase: "skill_installed" });
+        state.stage = "authentication";
         ensureCliAuthenticated(client.connectClient, options.apiKey);
+        telemetry.track("checkpoint", { phase: "authenticated" });
         // Persist once here (skill installed + authenticated) so both success paths, launch
         // or not, record the install; buildConnectHeaders reads it on subsequent requests.
         saveConnectContext(client.connectClient, telemetry.attemptId);
         if (!options.launch) {
             errLine(`TinyFish is connected. Open ${client.displayName} to start using it.`);
-            await telemetry.track("completed");
+            settle(state, telemetry, "completed");
             return;
         }
-        failureStage = "walkthrough_launch";
-        if (!launchNativeMcpClient(client))
-            return;
-        await telemetry.track("completed");
-    }
-    catch (error) {
-        await telemetry.track("failed", failureStage);
-        throw error;
-    }
+        state.stage = "walkthrough_launch";
+        // Install already done; walkthrough Ctrl+C still counts completed.
+        launchNativeMcpClient(client);
+        settle(state, telemetry, "completed");
+    });
 }
 export async function connectClaudeCode(options) {
     await connectNativeMcpClient(CLAUDE_CODE, options);
@@ -407,30 +509,35 @@ export async function connectHermes(options) {
 }
 export async function connectOpenClaw(options) {
     const telemetry = createConnectTelemetry(options.mcpUrl, "openclaw");
-    let failureStage = "prerequisite_check";
-    try {
-        await telemetry.track("started");
+    const state = { stage: "prerequisite_check", settled: false };
+    await runGuarded(state, telemetry, () => {
+        telemetry.track("started");
         requireCommandSupport(OPENCLAW);
+        telemetry.track("checkpoint", { phase: "prerequisite_ok" });
         if (options.installCli !== false) {
-            failureStage = "cli_install";
+            state.stage = "cli_install";
             errLine("Installing the TinyFish CLI...");
             const cliInstallResult = spawn.sync("npm", ["install", "--global", "@tiny-fish/cli@latest"], {
                 stdio: "inherit",
                 timeout: SKILL_INSTALL_TIMEOUT_MS,
             });
             if (cliInstallResult.error || cliInstallResult.status !== 0) {
+                throwIfInterrupted(cliInstallResult);
                 throw new Error("Could not install the TinyFish CLI", { cause: cliInstallResult.error });
             }
+            telemetry.track("checkpoint", { phase: "cli_installed" });
         }
-        failureStage = "skill_install";
+        state.stage = "skill_install";
         errLine("Installing the TinyFish skill in OpenClaw...");
         const skillInstallResult = spawn.sync("openclaw", ["skills", "install", OPENCLAW_SKILL, "--global", "--force", "--acknowledge-clawhub-risk"], { stdio: "inherit" });
         if (skillInstallResult.error || skillInstallResult.status !== 0) {
+            throwIfInterrupted(skillInstallResult);
             throw new Error("Could not install the TinyFish skill in OpenClaw", {
                 cause: skillInstallResult.error,
             });
         }
-        failureStage = "authentication";
+        telemetry.track("checkpoint", { phase: "skill_installed" });
+        state.stage = "authentication";
         const authStatus = spawn.sync("tinyfish", ["auth", "status"], {
             stdio: "ignore",
             timeout: NON_INTERACTIVE_TIMEOUT_MS,
@@ -447,26 +554,24 @@ export async function connectOpenClaw(options) {
                 throw new Error(TINYFISH_CLI_NOT_FOUND_MESSAGE, { cause: loginResult.error });
             }
             if (loginResult.error || loginResult.status !== 0) {
+                throwIfInterrupted(loginResult);
                 throw new Error("Could not authenticate TinyFish for OpenClaw", {
                     cause: loginResult.error,
                 });
             }
         }
+        telemetry.track("checkpoint", { phase: "authenticated" });
         saveConnectContext("openclaw", telemetry.attemptId);
         if (!options.launch) {
             errLine("TinyFish is connected. Open OpenClaw to start using it.");
-            await telemetry.track("completed");
+            settle(state, telemetry, "completed");
             return;
         }
-        failureStage = "walkthrough_launch";
-        if (!launchOpenClawWalkthrough())
-            return;
-        await telemetry.track("completed");
-    }
-    catch (error) {
-        await telemetry.track("failed", failureStage);
-        throw error;
-    }
+        state.stage = "walkthrough_launch";
+        // Install already done; walkthrough Ctrl+C still counts completed.
+        launchOpenClawWalkthrough();
+        settle(state, telemetry, "completed");
+    });
 }
 export function launchAgent(client) {
     if (client === "claude-code") {

package/dist/lib/auth.d.ts

@@ -10,6 +10,8 @@ interface TinyfishConfig {
     connect?: Record<string, ConnectEntry>;
 }
 export declare function loadConfig(): TinyfishConfig;
+/** Throwing variant for callers with their own cleanup (connect's telemetry flush). */
+export declare function writeConfig(apiKey: string): void;
 export declare function saveConfig(apiKey: string): void;
 export declare function saveConnectContext(client: string, attemptId: string): void;
 interface EnvironmentOptions {

package/dist/lib/auth.js

@@ -44,16 +44,20 @@ function parseConnectMap(value) {
     }
     return Object.keys(out).length > 0 ? out : undefined;
 }
-export function saveConfig(apiKey) {
+/** Throwing variant for callers with their own cleanup (connect's telemetry flush). */
+export function writeConfig(apiKey) {
     const dir = configDir();
+    // 0o700: only owner can read/write/execute the directory
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const existing = loadConfig();
+    // 0o600: only owner can read/write the config file (key is sensitive)
+    fs.writeFileSync(configFile(), JSON.stringify({ ...existing, api_key: apiKey }), {
+        mode: 0o600,
+    });
+}
+export function saveConfig(apiKey) {
     try {
-        // 0o700: only owner can read/write/execute the directory
-        fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
-        const existing = loadConfig();
-        // 0o600: only owner can read/write the config file (key is sensitive)
-        fs.writeFileSync(configFile(), JSON.stringify({ ...existing, api_key: apiKey }), {
-            mode: 0o600,
-        });
+        writeConfig(apiKey);
     }
     catch (e) {
         err({ error: `Could not write config: ${e instanceof Error ? e.message : String(e)}` });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiny-fish/cli",
-  "version": "0.10.1",
+  "version": "0.10.2-next.131",
   "description": "TinyFish CLI — run web automations from your terminal",
   "type": "module",
   "bin": {