@tiny-fish/cli 0.21.1-next.194 → 0.21.1-next.195

package/dist/commands/doctor.js

@@ -15,9 +15,12 @@ function provesHarnessReach(status, keyAuth, healthOk, mcpUrl) {
         return false;
     if (pointsElsewhere(status.registeredUrl, mcpUrl))
         return false;
-    return (status.registered === Registered.Yes &&
-        status.authMode === AuthMode.ApiKey &&
-        keyAuth?.ok === true);
+    if (status.registered !== Registered.Yes)
+        return false;
+    if (status.connected === true)
+        return true;
+    // The harness's own key must have verified; the CLI's verdict says nothing about it.
+    return status.authMode === AuthMode.ApiKey && keyAuth?.ok === true;
 }
 // Reports the version, never judges it: staleness is the server's call via X-TF-Notice.
 function checkCliVersion() {
@@ -57,9 +60,12 @@ function pointsElsewhere(registeredUrl, mcpUrl) {
         return "an unparseable endpoint";
     }
 }
-function keyedVerdict(keyAuth) {
-    if (!keyAuth)
-        return { status: "warn", detail: "registered, API key present but unverified" };
+function keyedVerdict(status, keyAuth) {
+    if (!keyAuth) {
+        // A bare warn beside exit 0 reads as a pass.
+        const because = status.keyReason ?? "its key is not readable here";
+        return { status: "warn", detail: `registered, but ${because}, so its reach is unproven` };
+    }
     if (keyAuth.ok) {
         return {
             status: "pass",
@@ -67,6 +73,13 @@ function keyedVerdict(keyAuth) {
         };
     }
     if (keyAuth.status === 401) {
+        // Resolved in doctor's shell, not codex's, so a 401 proves nothing.
+        if (status.keyIsIndirect) {
+            return {
+                status: "warn",
+                detail: "registered, but the key doctor resolved for it is rejected",
+            };
+        }
         return { status: "fail", detail: "registered, but TinyFish rejects its API key" };
     }
     // Only 401 blames the key; connect would loop on the rest.
@@ -90,9 +103,20 @@ function registrationVerdict(status, mcpUrl, keyAuth) {
                 detail: `registered, but points at ${elsewhere} rather than ${endpointOf(mcpUrl)}`,
             };
         }
+        // Ordered before the key check: the harness's own verdict wins.
+        if (status.connected === false) {
+            return {
+                status: "warn",
+                detail: "registered, but the harness reports it cannot reach TinyFish; sign in again there",
+            };
+        }
+        // Symmetric with provesHarnessReach, which already reads a handshake as decisive.
+        if (status.connected === true) {
+            return { status: "pass", detail: "registered, and the harness reports it reaches TinyFish" };
+        }
         // Widening past api-key would warn every healthy oauth install.
         if (status.authMode === AuthMode.ApiKey)
-            return keyedVerdict(keyAuth);
+            return keyedVerdict(status, keyAuth);
         // A probe that had to explain itself to reach `yes` is the only thing that explains `unknown`.
         const because = status.reason ? ` (${status.reason})` : "";
         return { status: "pass", detail: `registered, auth mode ${status.authMode}${because}` };

package/dist/lib/registration-detect.d.ts

@@ -9,6 +9,11 @@ export interface RegistrationStatus {
     registeredUrl?: string;
     /** For doctor to verify; never for the report. */
     apiKey?: string;
+    /** From the environment, not the config, so a 401 is ambiguous. */
+    keyIsIndirect?: boolean;
+    connected?: boolean;
+    /** Why a keyed registration's key could not be read; not `reason`. */
+    keyReason?: string;
     reason?: string;
 }
 export declare function codexOauthCompleted(): boolean | undefined;

package/dist/lib/registration-detect.js

@@ -76,10 +76,23 @@ function runProbe(command, args) {
 }
 // A plugin registers its server as `plugin:<plugin>:<server>`, which `mcp get tinyfish` misses.
 // The optional prefix must end in `:`, so `not-tinyfish` is not a match.
-const MCP_LIST_TINYFISH_LINE = /^((?:\S*:)?tinyfish):\s+(https?:\S+)/m;
+const MCP_LIST_TINYFISH_LINE = /^((?:\S*:)?tinyfish):\s+(https?:\S+)(.*)$/m;
+const SERVER_NAMED_TINYFISH = /^(?:\S*:)?tinyfish$/;
 // A bare substring also matches `not-tinyfish` and any row quoting a tinyfish URL, so the name
 // is required to be the first word on its line, after whatever status glyph the CLI prints.
 const LISTED_AS_TINYFISH = /^[^\w]*tinyfish(?![\w-])/m;
+// Claude Code reports its own live handshake; a config file cannot.
+const MCP_GET_STATUS = /^\s*Status:\s*(.+)$/m;
+// `mcp get <missing>` names every configured server, with no health check.
+const CONFIGURED_SERVERS = /Configured servers:\s*(.+)$/m;
+/** Ordered: "Connected · tools fetch failed" carries both words; the failure wins. */
+function connectionState(status) {
+    if (/fail|error|needs auth|not configured/i.test(status))
+        return false;
+    if (/\bconnected\b/i.test(status))
+        return true;
+    return undefined;
+}
 /** The plugin ships its own MCP server, so a working install can carry no `tinyfish` entry. */
 function fromPluginRegistration(command) {
     const probe = runProbe(command, ["mcp", "list"]);
@@ -88,12 +101,37 @@ function fromPluginRegistration(command) {
     const match = MCP_LIST_TINYFISH_LINE.exec(probe.output);
     if (!match)
         return undefined;
+    const connected = connectionState(match[3] ?? "");
     // `mcp list` prints no headers, so the credential behind it is unproven, never assumed.
     return {
         registered: Registered.Yes,
         authMode: AuthMode.Unknown,
         registeredUrl: match[2],
-        reason: `registered as ${match[1]}, which \`mcp get tinyfish\` does not resolve`,
+        ...(connected === undefined ? {} : { connected }),
+        reason: `registered as ${match[1]}`,
+    };
+}
+/** Names can contain spaces, so each candidate is matched whole. */
+function tinyfishServerName(output) {
+    const listed = CONFIGURED_SERVERS.exec(output)?.[1];
+    return listed
+        ?.split(",")
+        .map((name) => name.trim())
+        .find((name) => SERVER_NAMED_TINYFISH.test(name));
+}
+function parseMcpGet(output, keyAuthPattern) {
+    // Positive evidence only: whether `mcp get` echoes headers at all is unverified, so absence
+    // of the pattern is `unknown`, never proof of OAuth.
+    const url = /^\s*URL:\s*(\S+)/m.exec(output)?.[1];
+    const key = extractableKey(API_KEY_HEADER_VALUE.exec(output)?.[1]);
+    const status = MCP_GET_STATUS.exec(output)?.[1];
+    const connected = status === undefined ? undefined : connectionState(status);
+    return {
+        registered: Registered.Yes,
+        authMode: keyAuthPattern.test(output) ? AuthMode.ApiKey : AuthMode.Unknown,
+        ...(url ? { registeredUrl: url } : {}),
+        ...(key ? { apiKey: key } : {}),
+        ...(connected === undefined ? {} : { connected }),
     };
 }
 // claude-code only. Codex cannot use this: its `mcp get` exits 0 on a missing server.
@@ -110,6 +148,17 @@ function fromMcpGet(command, keyAuthPattern) {
                 reason: `\`${command} mcp get\` is unsupported by this version`,
             };
         }
+        // The roster is free; `mcp list` health-checks every server.
+        const scoped = tinyfishServerName(probe.output);
+        if (scoped) {
+            const rescoped = runProbe(command, ["mcp", "get", scoped]);
+            if (rescoped.outcome === "ran" && rescoped.exitCode === 0) {
+                return {
+                    ...parseMcpGet(rescoped.output, keyAuthPattern),
+                    reason: `registered as ${scoped}`,
+                };
+            }
+        }
         // Positive evidence from `mcp list` outranks anything inferred from a failed `mcp get`.
         const plugin = fromPluginRegistration(command);
         if (plugin)
@@ -124,16 +173,7 @@ function fromMcpGet(command, keyAuthPattern) {
         }
         return { registered: Registered.No, authMode: AuthMode.Unknown };
     }
-    // Positive evidence only: whether `mcp get` echoes headers at all is unverified, so absence
-    // of the pattern is `unknown`, never proof of OAuth.
-    const url = /^\s*URL:\s*(\S+)/m.exec(probe.output)?.[1];
-    const key = extractableKey(API_KEY_HEADER_VALUE.exec(probe.output)?.[1]);
-    return {
-        registered: Registered.Yes,
-        authMode: keyAuthPattern.test(probe.output) ? AuthMode.ApiKey : AuthMode.Unknown,
-        ...(url ? { registeredUrl: url } : {}),
-        ...(key ? { apiKey: key } : {}),
-    };
+    return parseMcpGet(probe.output, keyAuthPattern);
 }
 // `codex mcp get <missing>` prints an error and exits 0, so presence must never be read from
 // its exit code; `mcp list --json` is the only trustworthy read-back.
@@ -175,6 +215,22 @@ export function codexOauthCompleted() {
         return false;
     return undefined;
 }
+// This reaches the pasted report, so its shape is checked first.
+const ENV_VAR_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** Codex stores a variable name, not a value, so resolve it. */
+function codexEnvKey(envVar) {
+    if (!ENV_VAR_NAME.test(envVar)) {
+        return { keyReason: "its key comes from an unusable variable name" };
+    }
+    const key = extractableKey(process.env[envVar]);
+    if (key)
+        return { apiKey: key, keyIsIndirect: true };
+    return {
+        keyReason: process.env[envVar]
+            ? `$${envVar} does not hold a TinyFish key here`
+            : `$${envVar} is not set here`,
+    };
+}
 function probeCodex() {
     const read = readCodexEntry();
     if ("reason" in read)
@@ -183,16 +239,18 @@ function probeCodex() {
     if (!entry)
         return { registered: Registered.No, authMode: AuthMode.Unknown };
     const codexUrl = entry.transport?.url;
+    // Read from this entry: codex emits `bearer_token_env_var` on every HTTP server, so testing
+    // the whole payload reports api-key for TinyFish because some other server carries a key.
+    const envVar = entry.auth_status === "o_auth" ? undefined : entry.transport?.bearer_token_env_var;
     return {
         registered: Registered.Yes,
-        // Read from this entry: codex emits `bearer_token_env_var` on every HTTP server, so testing
-        // the whole payload reports api-key for TinyFish because some other server carries a key.
         authMode: entry.auth_status === "o_auth"
             ? AuthMode.OAuth
-            : entry.transport?.bearer_token_env_var
+            : envVar
                 ? AuthMode.ApiKey
                 : AuthMode.Unknown,
         ...(codexUrl ? { registeredUrl: codexUrl } : {}),
+        ...(envVar ? codexEnvKey(envVar) : {}),
     };
 }
 function probeCursor() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiny-fish/cli",
-  "version": "0.21.1-next.194",
+  "version": "0.21.1-next.195",
   "description": "TinyFish CLI — run web automations from your terminal",
   "type": "module",
   "bin": {