@tiny-fish/cli 0.18.1-next.173 → 0.19.0

package/dist/commands/connect.js

@@ -8,6 +8,7 @@ import { runConnectAll } from "../lib/connect-all.js";
 import { detectHumanInitiated } from "../lib/harness.js";
 import { emitNotice } from "../lib/notice.js";
 import { errLine, sanitizeLine } from "../lib/output.js";
+import { codexOauthCompleted } from "../lib/registration-detect.js";
 import { z } from "zod";
 import { installSignalGuard } from "../lib/signals.js";
 import { postConnectEvent, telemetryDisabled } from "../lib/setup-telemetry.js";
@@ -192,6 +193,9 @@ const CODEX = {
         unavailableMessage: CODEX_OAUTH_RESOURCE_UNAVAILABLE_MESSAGE,
     },
     launchWalkthrough: launchCodexWalkthrough,
+    probeAuthenticated: codexOauthCompleted,
+    // Retry only: running it after a finished inline OAuth is a second browser hop.
+    loginArgs: ["mcp", "login", "tinyfish"],
     removals: [{ args: ["mcp", "remove", "tinyfish"], label: "TinyFish registration from Codex" }],
     addArgs: (mcpUrl, oauthResource) => [
         "mcp",
@@ -627,7 +631,9 @@ async function connectNativeMcpClient(client, options) {
         // Undefining `loginArgs` reuses the deferred-auth path codex/hermes already take.
         const loginDegraded = !!client.loginArgs && !optionalSupported;
         const loginArgs = loginDegraded ? undefined : client.loginArgs;
-        state.stage = loginArgs ? "registration" : "registration_or_authentication";
+        // A probed client authenticates inside `mcp add` too, so a failure there is either.
+        state.stage =
+            loginArgs && !client.probeAuthenticated ? "registration" : "registration_or_authentication";
         errLine(`Adding TinyFish to ${client.displayName}...`);
         const addResult = spawn.sync(client.command, [
             ...client.addArgs(mcpUrl.toString(), options.mcpUrl),
@@ -644,6 +650,11 @@ async function connectNativeMcpClient(client, options) {
             });
         }
         telemetry.track("checkpoint", { phase: "registered" });
+        // Codex runs OAuth inside `mcp add` and exits 0 either way, so the recorded state decides
+        // whether the login step below still runs. Unknown keeps the pre-probe behaviour.
+        const addSignedIn = client.probeAuthenticated?.();
+        if (addSignedIn)
+            telemetry.track("checkpoint", { phase: "oauth_done" });
         const degradedNotes = loginDegraded ? client.degradedAuthNotes : undefined;
         if (useKeyAuth) {
             errLine(degradedNotes?.keyed ?? "Using your stored TinyFish API key — no browser sign-in needed.");
@@ -652,10 +663,13 @@ async function connectNativeMcpClient(client, options) {
             // Printed here, not with the closing line, so a `--launch` run sees it before the handover.
             errLine(degradedNotes.deferred);
         }
-        if (loginArgs && !useKeyAuth) {
+        // A probed client signs in again only when its inline OAuth is known to have been abandoned.
+        const retryLogin = client.probeAuthenticated ? addSignedIn === false : true;
+        const pendingLogin = !useKeyAuth && retryLogin ? loginArgs : undefined;
+        if (pendingLogin) {
             state.stage = "client_oauth";
             errLine("Signing in to TinyFish...");
-            const loginResult = spawn.sync(client.command, loginArgs, {
+            const loginResult = spawn.sync(client.command, pendingLogin, {
                 stdio: "inherit",
             });
             if (loginResult.error || loginResult.status !== 0) {
@@ -668,7 +682,7 @@ async function connectNativeMcpClient(client, options) {
         }
         // Registration/OAuth make MCP work; later steps are cosmetic and must not fail the attempt.
         settle(state, telemetry, "completed");
-        runPostInstallSteps(client, options, state, telemetry, !loginArgs && !useKeyAuth);
+        runPostInstallSteps(client, options, state, telemetry, !useKeyAuth && !addSignedIn && !pendingLogin);
     });
 }
 function connectedLine(client, signInDeferred) {

package/dist/lib/connect-all.js

@@ -18,6 +18,7 @@ const DISPLAY_NAMES = {
     opencode: "OpenCode",
 };
 // `codex mcp add` succeeds unauthenticated; OAuth lands at first tool use.
+// TODO(PF-3580): connect now probes Codex sign-in, so this over-warns a signed-in install.
 const AUTH_DEFERRED_AT_INSTALL = new Set(["codex"]);
 // Harnesses that drive their own OAuth at install — a stored TinyFish key says nothing
 // about their session, so it must never unlock a headless run for them.

package/dist/lib/doctor-report.d.ts

@@ -43,8 +43,8 @@ declare const doctorHarnessSchema: z.ZodObject<{
     }>;
     auth_mode: z.ZodEnum<{
         unknown: "unknown";
-        oauth: "oauth";
         "api-key": "api-key";
+        oauth: "oauth";
     }>;
     proves_harness_reach: z.ZodBoolean;
 }, z.core.$strip>;
@@ -105,8 +105,8 @@ export declare const doctorReportSchema: z.ZodObject<{
         }>;
         auth_mode: z.ZodEnum<{
             unknown: "unknown";
-            oauth: "oauth";
             "api-key": "api-key";
+            oauth: "oauth";
         }>;
         proves_harness_reach: z.ZodBoolean;
     }, z.core.$strip>>;

package/dist/lib/registration-detect.d.ts

@@ -11,5 +11,6 @@ export interface RegistrationStatus {
     registeredUrl?: string;
     reason?: string;
 }
+export declare function codexOauthCompleted(): boolean | undefined;
 /** Never throws; a failed probe is `unknown` with a reason, so no caller can read it as healthy. */
 export declare function detectRegistrations(harnesses?: Harness[]): RegistrationStatus[];

package/dist/lib/registration-detect.js

@@ -129,19 +129,14 @@ function fromMcpGet(command, keyAuthPattern) {
 }
 // `codex mcp get <missing>` prints an error and exits 0, so presence must never be read from
 // its exit code; `mcp list --json` is the only trustworthy read-back.
-function probeCodex() {
+function readCodexEntry() {
     const probe = runProbe("codex", ["mcp", "list", "--json"]);
-    if (probe.outcome === "unavailable") {
-        return { registered: "unknown", authMode: "unknown", reason: probe.reason };
-    }
+    if (probe.outcome === "unavailable")
+        return { reason: probe.reason };
     // Presence is never inferred from exit code 0, but a nonzero exit means the output cannot
     // be trusted either — that is `unknown`, not "no server".
     if (probe.exitCode !== 0) {
-        return {
-            registered: "unknown",
-            authMode: "unknown",
-            reason: `\`codex mcp list --json\` exited ${probe.exitCode}`,
-        };
+        return { reason: `\`codex mcp list --json\` exited ${probe.exitCode}` };
     }
     let servers;
     try {
@@ -150,26 +145,35 @@ function probeCodex() {
         servers = JSON.parse(probe.stdout);
     }
     catch {
-        return {
-            registered: "unknown",
-            authMode: "unknown",
-            reason: "`codex mcp list --json` returned unparseable output",
-        };
+        return { reason: "`codex mcp list --json` returned unparseable output" };
     }
     // A scalar or a wrapper object decodes fine and then silently reports "no server", which
     // would suggest a spurious repair. Anything but a list is unknown.
     const shape = codexListSchema.safeParse(servers);
-    if (!shape.success) {
-        return {
-            registered: "unknown",
-            authMode: "unknown",
-            reason: "`codex mcp list --json` returned an unexpected shape",
-        };
-    }
-    const entry = shape.data.find((s) => s.name === "tinyfish");
+    if (!shape.success)
+        return { reason: "`codex mcp list --json` returned an unexpected shape" };
+    return { entry: shape.data.find((s) => s.name === "tinyfish") };
+}
+// `mcp add` exits 0 whether or not its inline OAuth finished, so `not_logged_in` is the only
+// evidence of an abandoned sign-in; every other state, older Codex included, is unknown.
+export function codexOauthCompleted() {
+    const read = readCodexEntry();
+    if ("reason" in read)
+        return undefined;
+    const status = read.entry?.auth_status;
+    if (status === "o_auth")
+        return true;
+    if (status === "not_logged_in")
+        return false;
+    return undefined;
+}
+function probeCodex() {
+    const read = readCodexEntry();
+    if ("reason" in read)
+        return { registered: "unknown", authMode: "unknown", reason: read.reason };
+    const entry = read.entry;
     if (!entry)
         return { registered: "no", authMode: "unknown" };
-    // auth_status is the configured auth type, not whether a login succeeded — exactly auth_mode.
     const codexUrl = entry.transport?.url;
     return {
         registered: "yes",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiny-fish/cli",
-  "version": "0.18.1-next.173",
+  "version": "0.19.0",
   "description": "TinyFish CLI — run web automations from your terminal",
   "type": "module",
   "bin": {