@tiny-fish/cli 0.18.1-next.172 → 0.18.1-next.173

package/dist/commands/auth.js

@@ -1,7 +1,7 @@
 import { spawn } from "child_process";
 import * as readline from "readline";
 import { Option } from "commander";
-import { clearConfig, getDashboardUrl, loadConfig, maskKey, saveConfig, validateKeyFormat, } from "../lib/auth.js";
+import { CONNECT_ATTEMPT_ENV, clearConfig, getDashboardUrl, loadConfig, maskKey, savePendingConnectAttempt, saveConfig, validateKeyFormat, } from "../lib/auth.js";
 import { err, errLine, out, outLine } from "../lib/output.js";
 /**
  * Read a key from stdin without echoing it to the terminal.
@@ -66,6 +66,13 @@ async function readKeyFromStdinOrPrompt() {
     }
     return readKeyHidden("Paste your API key: ");
 }
+// Sign-in and the connect that follows are separate copied commands, so a page-minted id
+// handed to this process has to outlive it.
+function parkSeedAttempt() {
+    const seed = process.env[CONNECT_ATTEMPT_ENV];
+    if (seed)
+        savePendingConnectAttempt(seed);
+}
 export function registerAuth(program) {
     const auth = program.command("auth").description("Manage your TinyFish API key");
     auth
@@ -110,6 +117,7 @@ export function registerAuth(program) {
             process.exit(1);
         }
         saveConfig(key);
+        parkSeedAttempt();
         out({ status: "ok", message: "API key saved", key_preview: maskKey(key) });
     });
     auth
@@ -127,6 +135,7 @@ export function registerAuth(program) {
             process.exit(1);
         }
         saveConfig(key);
+        parkSeedAttempt();
         out({ status: "ok", message: "API key saved", key_preview: maskKey(key) });
     });
     auth

package/dist/commands/connect.js

@@ -1,7 +1,7 @@
 import { randomUUID } from "node:crypto";
 import * as path from "node:path";
 import spawn from "cross-spawn";
-import { CONNECT_SOURCE, loadConfig, persistApiKeyToEnvironment, resolvedApiKey, saveConnectContext, validateKeyFormat, validatedApiKey, writeConfig, } from "../lib/auth.js";
+import { CONNECT_ATTEMPT_ENV, CONNECT_SOURCE, isAttemptId, loadConfig, persistApiKeyToEnvironment, resolvedApiKey, saveConnectContext, takePendingConnectAttempt, validateKeyFormat, validatedApiKey, writeConfig, } from "../lib/auth.js";
 import { CLI_VERSION, TINYFISH_CLI_PACKAGE } from "../lib/constants.js";
 import { cursorInstallDeeplink, cursorMcpPath, writeCursorMcpConfig, } from "../lib/cursor-config.js";
 import { runConnectAll } from "../lib/connect-all.js";
@@ -287,9 +287,24 @@ const OPENCLAW = {
         unavailableMessage: OPENCLAW_SKILL_UNAVAILABLE_MESSAGE,
     },
 };
+/**
+ * One page-minted id seeds one install attempt, so `tinyfish onboard` connecting three agents
+ * does not report three installs under it. Later connects in the run fall back to a random id.
+ */
+function takeSeedAttemptId() {
+    const fromEnv = process.env[CONNECT_ATTEMPT_ENV];
+    // Both sources are read-and-clear, and the delete lands before any subprocess inherits it.
+    delete process.env[CONNECT_ATTEMPT_ENV];
+    const parked = takePendingConnectAttempt();
+    return fromEnv && isAttemptId(fromEnv) ? fromEnv : parked;
+}
 function createConnectTelemetry(mcpUrl, client, opts) {
-    // A setup-page id (via --url) joins "copied the command" to this install attempt.
-    const attemptId = opts?.attemptId ?? randomUUID();
+    // Consumed even when --url already supplied an id: leaving it behind would let a stale
+    // seed reach the agent this connect launches, or the next connect on this machine.
+    const seeded = takeSeedAttemptId();
+    // A setup-page id (via --url, the env var, or one parked by login) joins "copied the
+    // command" to this install attempt.
+    const attemptId = opts?.attemptId ?? seeded ?? randomUUID();
     const endpoint = new URL("/api/cli/connect-event", mcpUrl).toString();
     const pending = [];
     async function deliver(body) {

package/dist/lib/auth.d.ts

@@ -2,14 +2,28 @@ export { DASHBOARD_URL, getDashboardUrl } from "./constants.js";
 export declare function configDir(): string;
 /** Install channel baked onto connect context; the connect flow is always CLI-driven. */
 export declare const CONNECT_SOURCE = "tinyfish_cli";
+export declare const CONNECT_ATTEMPT_ENV = "TINYFISH_CONNECT_ATTEMPT_ID";
 interface ConnectEntry {
     attempt_id: string;
 }
+interface PendingConnectAttempt {
+    id: string;
+    ts: number;
+}
 interface TinyfishConfig {
     api_key?: string;
     connect?: Record<string, ConnectEntry>;
+    pending_connect_attempt?: PendingConnectAttempt;
 }
 export declare function loadConfig(): TinyfishConfig;
+export declare function isAttemptId(value: string): boolean;
+/**
+ * Park a page-minted attempt id for the connect that follows in a later process:
+ * `auth login` and the connect it leads to are separate copied commands.
+ */
+export declare function savePendingConnectAttempt(attemptId: string): void;
+/** Read-and-clear: one parked id seeds one install attempt, expired or not. */
+export declare function takePendingConnectAttempt(): string | undefined;
 /** Throwing variant for callers with their own cleanup (connect's telemetry flush). */
 export declare function writeConfig(apiKey: string): void;
 export declare function saveConfig(apiKey: string): void;

package/dist/lib/auth.js

@@ -15,6 +15,9 @@ function configFile() {
 }
 /** Install channel baked onto connect context; the connect flow is always CLI-driven. */
 export const CONNECT_SOURCE = "tinyfish_cli";
+// An env var, not a flag: released CLIs ignore an unknown one, and the installer's PATH
+// prepend means a copied command can still run a CLI far older than the page that wrote it.
+export const CONNECT_ATTEMPT_ENV = "TINYFISH_CONNECT_ATTEMPT_ID";
 export function loadConfig() {
     try {
         const raw = JSON.parse(fs.readFileSync(configFile(), "utf8"));
@@ -27,6 +30,9 @@ export function loadConfig() {
         const connect = parseConnectMap(obj["connect"]);
         if (connect)
             config.connect = connect;
+        const pending = parsePendingAttempt(obj["pending_connect_attempt"]);
+        if (pending)
+            config.pending_connect_attempt = pending;
         return config;
     }
     catch {
@@ -44,16 +50,63 @@ function parseConnectMap(value) {
     }
     return Object.keys(out).length > 0 ? out : undefined;
 }
-/** Throwing variant for callers with their own cleanup (connect's telemetry flush). */
-export function writeConfig(apiKey) {
-    const dir = configDir();
+function parsePendingAttempt(value) {
+    const entry = value;
+    if (typeof entry?.id !== "string" || typeof entry.ts !== "number")
+        return undefined;
+    return isAttemptId(entry.id) ? { id: entry.id, ts: entry.ts } : undefined;
+}
+export function isAttemptId(value) {
+    return /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value);
+}
+/**
+ * The one read-modify-write of the config file. Every caller goes through it so the
+ * loadConfig whitelist stays the single definition of what survives a write. Throws;
+ * callers own their failure policy, which differs per command.
+ */
+function updateConfig(change) {
     // 0o700: only owner can read/write/execute the directory
-    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
-    const existing = loadConfig();
+    fs.mkdirSync(configDir(), { recursive: true, mode: 0o700 });
     // 0o600: only owner can read/write the config file (key is sensitive)
-    fs.writeFileSync(configFile(), JSON.stringify({ ...existing, api_key: apiKey }), {
-        mode: 0o600,
-    });
+    fs.writeFileSync(configFile(), JSON.stringify(change(loadConfig())), { mode: 0o600 });
+}
+/**
+ * Park a page-minted attempt id for the connect that follows in a later process:
+ * `auth login` and the connect it leads to are separate copied commands.
+ */
+export function savePendingConnectAttempt(attemptId) {
+    if (!isAttemptId(attemptId))
+        return;
+    try {
+        updateConfig((config) => ({
+            ...config,
+            pending_connect_attempt: { id: attemptId, ts: Date.now() },
+        }));
+    }
+    catch {
+        // Attribution is never worth failing a sign-in for.
+    }
+}
+// Older than this and the id belongs to some abandoned setup, not the connect running now.
+const PENDING_ATTEMPT_MAX_AGE_MS = 24 * 60 * 60 * 1000;
+/** Read-and-clear: one parked id seeds one install attempt, expired or not. */
+export function takePendingConnectAttempt() {
+    const pending = loadConfig().pending_connect_attempt;
+    if (!pending)
+        return undefined;
+    try {
+        updateConfig(({ pending_connect_attempt: _cleared, ...rest }) => rest);
+    }
+    catch {
+        // An id still on disk would be claimed twice, and a double-counted install is worse
+        // than a missed join.
+        return undefined;
+    }
+    return Date.now() - pending.ts <= PENDING_ATTEMPT_MAX_AGE_MS ? pending.id : undefined;
+}
+/** Throwing variant for callers with their own cleanup (connect's telemetry flush). */
+export function writeConfig(apiKey) {
+    updateConfig((config) => ({ ...config, api_key: apiKey }));
 }
 export function saveConfig(apiKey) {
     try {
@@ -65,12 +118,11 @@ export function saveConfig(apiKey) {
     }
 }
 export function saveConnectContext(client, attemptId) {
-    const dir = configDir();
     try {
-        fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
-        const existing = loadConfig();
-        const connect = { ...existing.connect, [client]: { attempt_id: attemptId } };
-        fs.writeFileSync(configFile(), JSON.stringify({ ...existing, connect }), { mode: 0o600 });
+        updateConfig((config) => ({
+            ...config,
+            connect: { ...config.connect, [client]: { attempt_id: attemptId } },
+        }));
     }
     catch (e) {
         // Best-effort attribution marker: a write failure must not fail a connect that has
@@ -119,12 +171,12 @@ export function persistApiKeyToEnvironment(apiKey, options = {}) {
     fs.chmodSync(profile, 0o600);
 }
 export function clearConfig() {
-    const config = loadConfig();
-    if (!config.api_key)
+    if (!loadConfig().api_key)
         return false;
-    delete config.api_key;
     try {
-        fs.writeFileSync(configFile(), JSON.stringify(config), { mode: 0o600 });
+        // The parked id goes too: the next person to sign in on this machine is not the one
+        // whose copy minted it.
+        updateConfig(({ api_key: _key, pending_connect_attempt: _attempt, ...rest }) => rest);
         return true;
     }
     catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiny-fish/cli",
-  "version": "0.18.1-next.172",
+  "version": "0.18.1-next.173",
   "description": "TinyFish CLI — run web automations from your terminal",
   "type": "module",
   "bin": {