@tiny-fish/cli 0.18.1-next.170 → 0.18.1-next.173

package/dist/commands/auth.js

@@ -1,7 +1,7 @@
 import { spawn } from "child_process";
 import * as readline from "readline";
 import { Option } from "commander";
-import { clearConfig, getDashboardUrl, loadConfig, maskKey, saveConfig, validateKeyFormat, } from "../lib/auth.js";
+import { CONNECT_ATTEMPT_ENV, clearConfig, getDashboardUrl, loadConfig, maskKey, savePendingConnectAttempt, saveConfig, validateKeyFormat, } from "../lib/auth.js";
 import { err, errLine, out, outLine } from "../lib/output.js";
 /**
  * Read a key from stdin without echoing it to the terminal.
@@ -66,6 +66,13 @@ async function readKeyFromStdinOrPrompt() {
     }
     return readKeyHidden("Paste your API key: ");
 }
+// Sign-in and the connect that follows are separate copied commands, so a page-minted id
+// handed to this process has to outlive it.
+function parkSeedAttempt() {
+    const seed = process.env[CONNECT_ATTEMPT_ENV];
+    if (seed)
+        savePendingConnectAttempt(seed);
+}
 export function registerAuth(program) {
     const auth = program.command("auth").description("Manage your TinyFish API key");
     auth
@@ -110,6 +117,7 @@ export function registerAuth(program) {
             process.exit(1);
         }
         saveConfig(key);
+        parkSeedAttempt();
         out({ status: "ok", message: "API key saved", key_preview: maskKey(key) });
     });
     auth
@@ -127,6 +135,7 @@ export function registerAuth(program) {
             process.exit(1);
         }
         saveConfig(key);
+        parkSeedAttempt();
         out({ status: "ok", message: "API key saved", key_preview: maskKey(key) });
     });
     auth

package/dist/commands/connect.js

@@ -1,7 +1,7 @@
 import { randomUUID } from "node:crypto";
 import * as path from "node:path";
 import spawn from "cross-spawn";
-import { CONNECT_SOURCE, loadConfig, persistApiKeyToEnvironment, resolvedApiKey, saveConnectContext, validateKeyFormat, validatedApiKey, writeConfig, } from "../lib/auth.js";
+import { CONNECT_ATTEMPT_ENV, CONNECT_SOURCE, isAttemptId, loadConfig, persistApiKeyToEnvironment, resolvedApiKey, saveConnectContext, takePendingConnectAttempt, validateKeyFormat, validatedApiKey, writeConfig, } from "../lib/auth.js";
 import { CLI_VERSION, TINYFISH_CLI_PACKAGE } from "../lib/constants.js";
 import { cursorInstallDeeplink, cursorMcpPath, writeCursorMcpConfig, } from "../lib/cursor-config.js";
 import { runConnectAll } from "../lib/connect-all.js";
@@ -287,9 +287,24 @@ const OPENCLAW = {
         unavailableMessage: OPENCLAW_SKILL_UNAVAILABLE_MESSAGE,
     },
 };
+/**
+ * One page-minted id seeds one install attempt, so `tinyfish onboard` connecting three agents
+ * does not report three installs under it. Later connects in the run fall back to a random id.
+ */
+function takeSeedAttemptId() {
+    const fromEnv = process.env[CONNECT_ATTEMPT_ENV];
+    // Both sources are read-and-clear, and the delete lands before any subprocess inherits it.
+    delete process.env[CONNECT_ATTEMPT_ENV];
+    const parked = takePendingConnectAttempt();
+    return fromEnv && isAttemptId(fromEnv) ? fromEnv : parked;
+}
 function createConnectTelemetry(mcpUrl, client, opts) {
-    // A setup-page id (via --url) joins "copied the command" to this install attempt.
-    const attemptId = opts?.attemptId ?? randomUUID();
+    // Consumed even when --url already supplied an id: leaving it behind would let a stale
+    // seed reach the agent this connect launches, or the next connect on this machine.
+    const seeded = takeSeedAttemptId();
+    // A setup-page id (via --url, the env var, or one parked by login) joins "copied the
+    // command" to this install attempt.
+    const attemptId = opts?.attemptId ?? seeded ?? randomUUID();
     const endpoint = new URL("/api/cli/connect-event", mcpUrl).toString();
     const pending = [];
     async function deliver(body) {

package/dist/commands/upgrade.js

@@ -1,6 +1,7 @@
 import spawn from "cross-spawn";
 import { resolvedApiKey } from "../lib/auth.js";
 import { CLI_VERSION, TINYFISH_CLI_PACKAGE } from "../lib/constants.js";
+import { suppressNotice } from "../lib/notice.js";
 import { errLine } from "../lib/output.js";
 import { sendUpgradeCompleted, telemetryDisabled, } from "../lib/setup-telemetry.js";
 import { installSignalGuard, SIGNAL_EXIT_CODES } from "../lib/signals.js";
@@ -55,6 +56,8 @@ function installedCliVersion() {
 }
 /** `runUpgrade` plus its outcome telemetry, which must never change what the upgrade does. */
 export async function runUpgradeCommand() {
+    // This command is the upgrade, so a trailing "an update is available" would be noise.
+    suppressNotice();
     let reported = false;
     // Read on the failed path too: a failed skill refresh still leaves an upgraded CLI, so
     // `outcome` reports whether every step ran and `to_version` whether the binary moved.

package/dist/index.js

@@ -1,55 +1,6 @@
 #!/usr/bin/env node
-import { createRequire } from "module";
-import { Command } from "commander";
-import { registerAuth } from "./commands/auth.js";
-import { registerBatch } from "./commands/batch.js";
-import { registerFetch } from "./commands/fetch.js";
-import { registerBrowser } from "./commands/browser.js";
-import { registerProfile } from "./commands/profile.js";
-import { registerVault } from "./commands/vault.js";
-import { registerWallet } from "./commands/wallet.js";
-import { registerRun } from "./commands/run.js";
-import { registerRuns } from "./commands/runs.js";
-import { registerConfigureClaude } from "./commands/config-claude.js";
-import { registerSearch } from "./commands/search.js";
-import { registerConnect } from "./commands/connect.js";
-import { registerDoctor } from "./commands/doctor.js";
-import { registerUpgrade } from "./commands/upgrade.js";
-import { registerOnboard } from "./commands/onboard.js";
-const { version } = createRequire(import.meta.url)("../package.json");
-const program = new Command();
-program
-    .name("tinyfish")
-    .description("TinyFish CLI — run web automations from your terminal or agent.")
-    .version(version, "-V, --version", "Show version")
-    .helpOption("-h, --help", "Show help")
-    .addHelpCommand(false)
-    .enablePositionalOptions()
-    .option("--debug", "Print HTTP requests and responses to stderr (or set TINYFISH_DEBUG=1)")
-    .hook("preAction", (cmd) => {
-    if (cmd.opts().debug) {
-        process.env["TINYFISH_DEBUG"] = "1";
-    }
-});
-registerAuth(program);
-registerOnboard(program);
-registerConnect(program);
-registerDoctor(program);
-registerUpgrade(program);
-registerConfigureClaude(program);
-registerBrowser(program);
-registerProfile(program);
-registerVault(program);
-registerWallet(program);
-const agentCmd = program
-    .command("agent")
-    .description("Agent automation commands")
-    .enablePositionalOptions();
-const runCmd = registerRun(agentCmd);
-registerRuns(runCmd);
-registerBatch(agentCmd);
-registerSearch(program);
-registerFetch(program);
+import { buildProgram } from "./program.js";
+const { program } = buildProgram();
 // Await parseAsync so async command handlers complete before the process exits
 program.parseAsync(process.argv).catch((e) => {
     process.stderr.write(JSON.stringify({ error: e instanceof Error ? e.message : String(e) }) + "\n");

package/dist/lib/auth.d.ts

@@ -2,14 +2,28 @@ export { DASHBOARD_URL, getDashboardUrl } from "./constants.js";
 export declare function configDir(): string;
 /** Install channel baked onto connect context; the connect flow is always CLI-driven. */
 export declare const CONNECT_SOURCE = "tinyfish_cli";
+export declare const CONNECT_ATTEMPT_ENV = "TINYFISH_CONNECT_ATTEMPT_ID";
 interface ConnectEntry {
     attempt_id: string;
 }
+interface PendingConnectAttempt {
+    id: string;
+    ts: number;
+}
 interface TinyfishConfig {
     api_key?: string;
     connect?: Record<string, ConnectEntry>;
+    pending_connect_attempt?: PendingConnectAttempt;
 }
 export declare function loadConfig(): TinyfishConfig;
+export declare function isAttemptId(value: string): boolean;
+/**
+ * Park a page-minted attempt id for the connect that follows in a later process:
+ * `auth login` and the connect it leads to are separate copied commands.
+ */
+export declare function savePendingConnectAttempt(attemptId: string): void;
+/** Read-and-clear: one parked id seeds one install attempt, expired or not. */
+export declare function takePendingConnectAttempt(): string | undefined;
 /** Throwing variant for callers with their own cleanup (connect's telemetry flush). */
 export declare function writeConfig(apiKey: string): void;
 export declare function saveConfig(apiKey: string): void;

package/dist/lib/auth.js

@@ -15,6 +15,9 @@ function configFile() {
 }
 /** Install channel baked onto connect context; the connect flow is always CLI-driven. */
 export const CONNECT_SOURCE = "tinyfish_cli";
+// An env var, not a flag: released CLIs ignore an unknown one, and the installer's PATH
+// prepend means a copied command can still run a CLI far older than the page that wrote it.
+export const CONNECT_ATTEMPT_ENV = "TINYFISH_CONNECT_ATTEMPT_ID";
 export function loadConfig() {
     try {
         const raw = JSON.parse(fs.readFileSync(configFile(), "utf8"));
@@ -27,6 +30,9 @@ export function loadConfig() {
         const connect = parseConnectMap(obj["connect"]);
         if (connect)
             config.connect = connect;
+        const pending = parsePendingAttempt(obj["pending_connect_attempt"]);
+        if (pending)
+            config.pending_connect_attempt = pending;
         return config;
     }
     catch {
@@ -44,16 +50,63 @@ function parseConnectMap(value) {
     }
     return Object.keys(out).length > 0 ? out : undefined;
 }
-/** Throwing variant for callers with their own cleanup (connect's telemetry flush). */
-export function writeConfig(apiKey) {
-    const dir = configDir();
+function parsePendingAttempt(value) {
+    const entry = value;
+    if (typeof entry?.id !== "string" || typeof entry.ts !== "number")
+        return undefined;
+    return isAttemptId(entry.id) ? { id: entry.id, ts: entry.ts } : undefined;
+}
+export function isAttemptId(value) {
+    return /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value);
+}
+/**
+ * The one read-modify-write of the config file. Every caller goes through it so the
+ * loadConfig whitelist stays the single definition of what survives a write. Throws;
+ * callers own their failure policy, which differs per command.
+ */
+function updateConfig(change) {
     // 0o700: only owner can read/write/execute the directory
-    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
-    const existing = loadConfig();
+    fs.mkdirSync(configDir(), { recursive: true, mode: 0o700 });
     // 0o600: only owner can read/write the config file (key is sensitive)
-    fs.writeFileSync(configFile(), JSON.stringify({ ...existing, api_key: apiKey }), {
-        mode: 0o600,
-    });
+    fs.writeFileSync(configFile(), JSON.stringify(change(loadConfig())), { mode: 0o600 });
+}
+/**
+ * Park a page-minted attempt id for the connect that follows in a later process:
+ * `auth login` and the connect it leads to are separate copied commands.
+ */
+export function savePendingConnectAttempt(attemptId) {
+    if (!isAttemptId(attemptId))
+        return;
+    try {
+        updateConfig((config) => ({
+            ...config,
+            pending_connect_attempt: { id: attemptId, ts: Date.now() },
+        }));
+    }
+    catch {
+        // Attribution is never worth failing a sign-in for.
+    }
+}
+// Older than this and the id belongs to some abandoned setup, not the connect running now.
+const PENDING_ATTEMPT_MAX_AGE_MS = 24 * 60 * 60 * 1000;
+/** Read-and-clear: one parked id seeds one install attempt, expired or not. */
+export function takePendingConnectAttempt() {
+    const pending = loadConfig().pending_connect_attempt;
+    if (!pending)
+        return undefined;
+    try {
+        updateConfig(({ pending_connect_attempt: _cleared, ...rest }) => rest);
+    }
+    catch {
+        // An id still on disk would be claimed twice, and a double-counted install is worse
+        // than a missed join.
+        return undefined;
+    }
+    return Date.now() - pending.ts <= PENDING_ATTEMPT_MAX_AGE_MS ? pending.id : undefined;
+}
+/** Throwing variant for callers with their own cleanup (connect's telemetry flush). */
+export function writeConfig(apiKey) {
+    updateConfig((config) => ({ ...config, api_key: apiKey }));
 }
 export function saveConfig(apiKey) {
     try {
@@ -65,12 +118,11 @@ export function saveConfig(apiKey) {
     }
 }
 export function saveConnectContext(client, attemptId) {
-    const dir = configDir();
     try {
-        fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
-        const existing = loadConfig();
-        const connect = { ...existing.connect, [client]: { attempt_id: attemptId } };
-        fs.writeFileSync(configFile(), JSON.stringify({ ...existing, connect }), { mode: 0o600 });
+        updateConfig((config) => ({
+            ...config,
+            connect: { ...config.connect, [client]: { attempt_id: attemptId } },
+        }));
     }
     catch (e) {
         // Best-effort attribution marker: a write failure must not fail a connect that has
@@ -119,12 +171,12 @@ export function persistApiKeyToEnvironment(apiKey, options = {}) {
     fs.chmodSync(profile, 0o600);
 }
 export function clearConfig() {
-    const config = loadConfig();
-    if (!config.api_key)
+    if (!loadConfig().api_key)
         return false;
-    delete config.api_key;
     try {
-        fs.writeFileSync(configFile(), JSON.stringify(config), { mode: 0o600 });
+        // The parked id goes too: the next person to sign in on this machine is not the one
+        // whose copy minted it.
+        updateConfig(({ api_key: _key, pending_connect_attempt: _attempt, ...rest }) => rest);
         return true;
     }
     catch {

package/dist/lib/client.js

@@ -2,7 +2,7 @@ import { APIStatusError, agentRunAsyncResponseSchema, agentRunResponseSchema, ag
 import { CONNECT_SOURCE, loadConfig } from "./auth.js";
 import { API_URL_OVERRIDE, CLI_VERSION } from "./constants.js";
 import { detectHarness, detectHumanInitiated } from "./harness.js";
-import { surfaceNotice } from "./notice.js";
+import { captureNotice } from "./notice.js";
 import { ApiError } from "./output.js";
 import { z } from "zod";
 // Install-level connect context (PF-3169). A known caller is credited only to its own
@@ -73,7 +73,7 @@ class TinyFishCliClient extends TinyFish {
             method: "DELETE",
             headers: this._buildHeaders(),
         });
-        surfaceNotice(response.headers);
+        captureNotice(response.headers);
         if (!response.ok) {
             let message = response.statusText;
             try {
@@ -96,7 +96,7 @@ function createSdkClient(apiKey, timeout) {
         ...(API_URL_OVERRIDE !== undefined ? { baseURL: API_URL_OVERRIDE } : {}),
         maxRetries: 0,
         // Fires per HTTP attempt, but maxRetries is 0 and the notice latches once per invocation.
-        onResponse: ({ headers }) => surfaceNotice(headers),
+        onResponse: ({ headers }) => captureNotice(headers),
         ...(timeout !== undefined ? { timeout } : {}),
     });
 }

package/dist/lib/notice.d.ts

@@ -1,8 +1,11 @@
+import type { Command } from "commander";
 /** Test-only: the capture slot and the once-per-invocation latch are module state. */
 export declare function resetNoticeState(): void;
 /** Records the first notice seen; printing is deferred so it lands at the end of a command. */
 export declare function captureNotice(headers: Headers): void;
 /** Advisory only, never changes stdout, the exit code, or control flow. */
 export declare function emitNotice(): void;
-/** For callers where the response is the end of the command, such as one-shot API calls. */
-export declare function surfaceNotice(headers: Headers): void;
+/** For commands that are the fix themselves, such as `upgrade`, where the nudge is noise. */
+export declare function suppressNotice(): void;
+/** postAction covers clean completions, the exit hook covers the process.exit and rejection paths, the latch keeps it to one. */
+export declare function installNoticeEmit(program: Command): () => void;

package/dist/lib/notice.js

@@ -1,7 +1,6 @@
-// Surfaces the advisory X-TF-Notice header the server attaches to outdated clients (PF-3301).
 import { CLI_VERSION } from "./constants.js";
 import { detectHumanInitiated } from "./harness.js";
-import { err, errLine, sanitizeLine } from "./output.js";
+import { err, sanitizeLine, warnLine } from "./output.js";
 const NOTICE_HEADER = "x-tf-notice";
 const LEVEL_HEADER = "x-tf-notice-level";
 const MAX_LENGTH = 300;
@@ -41,13 +40,20 @@ export function emitNotice() {
     printed = true;
     const { message, level } = captured;
     if (detectHumanInitiated()) {
-        errLine(message);
+        warnLine(message);
         return;
     }
     err({ notice: agentMessage(level), ...(level ? { level } : {}) });
 }
-/** For callers where the response is the end of the command, such as one-shot API calls. */
-export function surfaceNotice(headers) {
-    captureNotice(headers);
-    emitNotice();
+/** For commands that are the fix themselves, such as `upgrade`, where the nudge is noise. */
+export function suppressNotice() {
+    captured = undefined;
+    printed = true;
+}
+/** postAction covers clean completions, the exit hook covers the process.exit and rejection paths, the latch keeps it to one. */
+export function installNoticeEmit(program) {
+    const backstop = () => emitNotice();
+    program.hook("postAction", () => emitNotice());
+    process.once("exit", backstop);
+    return () => process.removeListener("exit", backstop);
 }

package/dist/lib/output.d.ts

@@ -8,5 +8,7 @@ export declare function out(data: unknown): void;
 export declare function sanitizeLine(text: string): string;
 export declare function outLine(line: string): void;
 export declare function errLine(line: string): void;
+/** Advisory stderr line, yellow on a terminal and plain everywhere else so piped output stays clean. */
+export declare function warnLine(line: string): void;
 export declare function err(data: unknown): void;
 export declare function handleApiError(e: unknown): never;

package/dist/lib/output.js

@@ -23,6 +23,14 @@ export function outLine(line) {
 export function errLine(line) {
     process.stderr.write(sanitizeLine(line) + "\n");
 }
+const WARN_ON = "\x1b[33m";
+const WARN_OFF = "\x1b[39m";
+/** Advisory stderr line, yellow on a terminal and plain everywhere else so piped output stays clean. */
+export function warnLine(line) {
+    const text = sanitizeLine(line);
+    const colour = Boolean(process.stderr.isTTY) && !process.env["NO_COLOR"];
+    process.stderr.write(colour ? `${WARN_ON}${text}${WARN_OFF}\n` : `${text}\n`);
+}
 export function err(data) {
     const payload = typeof data === "string" ? { error: data } : data;
     const serialized = JSON.stringify(payload) ?? "undefined";

package/dist/program.d.ts

@@ -0,0 +1,6 @@
+import { Command } from "commander";
+/** Split from index.ts so tests can drive the real program instead of hand-assembling one. */
+export declare function buildProgram(): {
+    program: Command;
+    uninstallNotice: () => void;
+};

package/dist/program.js

@@ -0,0 +1,57 @@
+import { createRequire } from "module";
+import { Command } from "commander";
+import { registerAuth } from "./commands/auth.js";
+import { registerBatch } from "./commands/batch.js";
+import { registerFetch } from "./commands/fetch.js";
+import { registerBrowser } from "./commands/browser.js";
+import { registerProfile } from "./commands/profile.js";
+import { registerVault } from "./commands/vault.js";
+import { registerWallet } from "./commands/wallet.js";
+import { registerRun } from "./commands/run.js";
+import { registerRuns } from "./commands/runs.js";
+import { registerConfigureClaude } from "./commands/config-claude.js";
+import { registerSearch } from "./commands/search.js";
+import { registerConnect } from "./commands/connect.js";
+import { registerDoctor } from "./commands/doctor.js";
+import { registerUpgrade } from "./commands/upgrade.js";
+import { registerOnboard } from "./commands/onboard.js";
+import { installNoticeEmit } from "./lib/notice.js";
+/** Split from index.ts so tests can drive the real program instead of hand-assembling one. */
+export function buildProgram() {
+    const { version } = createRequire(import.meta.url)("../package.json");
+    const program = new Command();
+    program
+        .name("tinyfish")
+        .description("TinyFish CLI — run web automations from your terminal or agent.")
+        .version(version, "-V, --version", "Show version")
+        .helpOption("-h, --help", "Show help")
+        .addHelpCommand(false)
+        .enablePositionalOptions()
+        .option("--debug", "Print HTTP requests and responses to stderr (or set TINYFISH_DEBUG=1)")
+        .hook("preAction", (cmd) => {
+        if (cmd.opts().debug) {
+            process.env["TINYFISH_DEBUG"] = "1";
+        }
+    });
+    registerAuth(program);
+    registerOnboard(program);
+    registerConnect(program);
+    registerDoctor(program);
+    registerUpgrade(program);
+    registerConfigureClaude(program);
+    registerBrowser(program);
+    registerProfile(program);
+    registerVault(program);
+    registerWallet(program);
+    const agentCmd = program
+        .command("agent")
+        .description("Agent automation commands")
+        .enablePositionalOptions();
+    const runCmd = registerRun(agentCmd);
+    registerRuns(runCmd);
+    registerBatch(agentCmd);
+    registerSearch(program);
+    registerFetch(program);
+    const uninstallNotice = installNoticeEmit(program);
+    return { program, uninstallNotice };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiny-fish/cli",
-  "version": "0.18.1-next.170",
+  "version": "0.18.1-next.173",
   "description": "TinyFish CLI — run web automations from your terminal",
   "type": "module",
   "bin": {