@tiny-fish/cli 0.21.1-next.194 → 0.21.1-next.196

package/README.md

@@ -80,6 +80,9 @@ Brings both halves of an install current: the global `@tiny-fish/cli` package an
 `use-tinyfish` skill. Use this rather than remembering `npm i -g @tiny-fish/cli@latest` and
 `skills update -g` separately.
 
+Successful steps are summarised in one line each. Add `--verbose` to see the full npm and skills
+output; a failing step prints its output either way.
+
 The skill step refreshes only the TinyFish skill, and only for the agents you ran
 `tinyfish connect` against. Other global skills, and agents you never connected, are left alone.
 The refresh overwrites your copy of the skill, including any local edits to it. Restart your

package/dist/commands/connect.js

@@ -144,7 +144,8 @@ function connectedLine(client, signInDeferred) {
 function runPostInstallSteps(client, options, state, telemetry, signInDeferred) {
     try {
         state.stage = "cli_install";
-        installTinyFishCli();
+        // Verbose on purpose: first-run setup must not go silent.
+        installTinyFishCli({ verbose: true });
         telemetry.track("checkpoint", { phase: "cli_installed" });
         state.stage = "skill_install";
         installWebSkill(client);
@@ -207,7 +208,7 @@ export async function connectOpenClaw(options) {
         telemetry.track("checkpoint", { phase: "prerequisite_ok" });
         if (options.installCli !== false) {
             state.stage = "cli_install";
-            installTinyFishCli();
+            installTinyFishCli({ verbose: true });
             telemetry.track("checkpoint", { phase: "cli_installed" });
         }
         state.stage = "skill_install";

package/dist/commands/doctor.js

@@ -15,9 +15,12 @@ function provesHarnessReach(status, keyAuth, healthOk, mcpUrl) {
         return false;
     if (pointsElsewhere(status.registeredUrl, mcpUrl))
         return false;
-    return (status.registered === Registered.Yes &&
-        status.authMode === AuthMode.ApiKey &&
-        keyAuth?.ok === true);
+    if (status.registered !== Registered.Yes)
+        return false;
+    if (status.connected === true)
+        return true;
+    // The harness's own key must have verified; the CLI's verdict says nothing about it.
+    return status.authMode === AuthMode.ApiKey && keyAuth?.ok === true;
 }
 // Reports the version, never judges it: staleness is the server's call via X-TF-Notice.
 function checkCliVersion() {
@@ -57,9 +60,12 @@ function pointsElsewhere(registeredUrl, mcpUrl) {
         return "an unparseable endpoint";
     }
 }
-function keyedVerdict(keyAuth) {
-    if (!keyAuth)
-        return { status: "warn", detail: "registered, API key present but unverified" };
+function keyedVerdict(status, keyAuth) {
+    if (!keyAuth) {
+        // A bare warn beside exit 0 reads as a pass.
+        const because = status.keyReason ?? "its key is not readable here";
+        return { status: "warn", detail: `registered, but ${because}, so its reach is unproven` };
+    }
     if (keyAuth.ok) {
         return {
             status: "pass",
@@ -67,6 +73,13 @@ function keyedVerdict(keyAuth) {
         };
     }
     if (keyAuth.status === 401) {
+        // Resolved in doctor's shell, not codex's, so a 401 proves nothing.
+        if (status.keyIsIndirect) {
+            return {
+                status: "warn",
+                detail: "registered, but the key doctor resolved for it is rejected",
+            };
+        }
         return { status: "fail", detail: "registered, but TinyFish rejects its API key" };
     }
     // Only 401 blames the key; connect would loop on the rest.
@@ -90,9 +103,20 @@ function registrationVerdict(status, mcpUrl, keyAuth) {
                 detail: `registered, but points at ${elsewhere} rather than ${endpointOf(mcpUrl)}`,
             };
         }
+        // Ordered before the key check: the harness's own verdict wins.
+        if (status.connected === false) {
+            return {
+                status: "warn",
+                detail: "registered, but the harness reports it cannot reach TinyFish; sign in again there",
+            };
+        }
+        // Symmetric with provesHarnessReach, which already reads a handshake as decisive.
+        if (status.connected === true) {
+            return { status: "pass", detail: "registered, and the harness reports it reaches TinyFish" };
+        }
         // Widening past api-key would warn every healthy oauth install.
         if (status.authMode === AuthMode.ApiKey)
-            return keyedVerdict(keyAuth);
+            return keyedVerdict(status, keyAuth);
         // A probe that had to explain itself to reach `yes` is the only thing that explains `unknown`.
         const because = status.reason ? ` (${status.reason})` : "";
         return { status: "pass", detail: `registered, auth mode ${status.authMode}${because}` };

package/dist/commands/upgrade.d.ts

@@ -1,6 +1,6 @@
 import { Command } from "commander";
 /** Returns the version now installed, so the caller reports exactly what the user was told. */
-export declare function runUpgrade(): string | null;
+export declare function runUpgrade(verbose?: boolean): string | null;
 /** `runUpgrade` plus its outcome telemetry, which must never change what the upgrade does. */
-export declare function runUpgradeCommand(): Promise<void>;
+export declare function runUpgradeCommand(verbose?: boolean): Promise<void>;
 export declare function registerUpgrade(program: Command): void;

package/dist/commands/upgrade.js

@@ -26,13 +26,16 @@ function attempt(label, run) {
     }
 }
 /** Returns the version now installed, so the caller reports exactly what the user was told. */
-export function runUpgrade() {
+export function runUpgrade(verbose = false) {
     errLine("Upgrading TinyFish...");
+    let refreshed = false;
     try {
         // Both steps always run: neither artifact should stay stale because the other failed.
         const failures = [
-            attempt("update the TinyFish CLI", installTinyFishCli),
-            attempt("refresh the TinyFish web skill", updateWebSkill),
+            attempt("update the TinyFish CLI", () => installTinyFishCli({ verbose })),
+            attempt("refresh the TinyFish web skill", () => {
+                refreshed = updateWebSkill({ verbose });
+            }),
         ].filter((failure) => failure !== undefined);
         if (failures.length > 0)
             throw new Error(`tinyfish upgrade failed: ${failures.join("; ")}`);
@@ -45,9 +48,9 @@ export function runUpgrade() {
         return null;
     }
     const version = installedCliVersion();
-    errLine(version
-        ? `TinyFish CLI ${version} is up to date. Restart your agent to pick up the refreshed skill.`
-        : "TinyFish is up to date. Restart your agent to pick up the refreshed skill.");
+    const upToDate = version ? `TinyFish CLI ${version} is up to date.` : "TinyFish is up to date.";
+    // Only a rewritten skill needs an agent restart.
+    errLine(refreshed ? `${upToDate} Restart your agent to pick up the refreshed skill.` : upToDate);
     return version;
 }
 /** The version now on disk. Only the upgrade's own npm call knows what "latest" resolved to. */
@@ -67,7 +70,7 @@ function globalCliVersion() {
     }
 }
 /** `runUpgrade` plus its outcome telemetry, which must never change what the upgrade does. */
-export async function runUpgradeCommand() {
+export async function runUpgradeCommand(verbose = false) {
     // This command is the upgrade, so a trailing "an update is available" would be noise.
     suppressNotice();
     let reported = false;
@@ -90,7 +93,7 @@ export async function runUpgradeCommand() {
     });
     let outcome = "updated";
     try {
-        printedVersion = runUpgrade();
+        printedVersion = runUpgrade(verbose);
         if (process.exitCode === SIGNAL_EXIT_CODES.SIGINT)
             outcome = "interrupted";
     }
@@ -108,7 +111,8 @@ export function registerUpgrade(program) {
     program
         .command("upgrade")
         .description("Update the TinyFish CLI and the use-tinyfish skill to the latest versions")
-        .action(async () => {
-        await runUpgradeCommand();
+        .option("--verbose", "Print the full npm and skills output instead of only on failure")
+        .action(async (options) => {
+        await runUpgradeCommand(Boolean(options.verbose));
     });
 }

package/dist/lib/connect-install.d.ts

@@ -3,7 +3,11 @@ import { type AgentClient } from "./connect-runtime.js";
 export declare const SKILL_INSTALL_TIMEOUT_MS = 120000;
 export declare const TINYFISH_CLI_NOT_FOUND_MESSAGE = "TinyFish CLI installed but is not available on PATH. Open a new terminal and retry.";
 export declare const UPGRADE_HINT = "Run `tinyfish upgrade` any time to update the CLI and skill.";
-export declare function installTinyFishCli(): void;
+/** Quiet captures subprocess output and replays it only on failure. */
+export type InstallOptions = {
+    verbose: boolean;
+};
+export declare function installTinyFishCli({ verbose }: InstallOptions): void;
 export declare function installWebSkill(client: NativeMcpClient): void;
 /**
  * Refresh the skill we installed, for the harnesses we installed it in.
@@ -12,6 +16,8 @@ export declare function installWebSkill(client: NativeMcpClient): void;
  * only in prose, it repairs a copy whose lock entry lost its hash, and it cannot spread the
  * skill to agents the user never connected (`update` re-adds with no --agent, which targets
  * every agent on the machine).
+ *
+ * Returns whether a skill was actually rewritten.
  */
-export declare function updateWebSkill(): void;
+export declare function updateWebSkill({ verbose }: InstallOptions): boolean;
 export declare function ensureCliAuthenticated(source: AgentClient, apiKey?: string): void;

package/dist/lib/connect-install.js

@@ -14,17 +14,37 @@ export const UPGRADE_HINT = "Run `tinyfish upgrade` any time to update the CLI a
 const SKILLS_CLI_PACKAGE = "skills@1.5.15";
 const TINYFISH_WEB_SKILL_SOURCE = "tinyfish-io/tinyfish-cookbook";
 const TINYFISH_WEB_SKILL = "use-tinyfish";
-export function installTinyFishCli() {
-    errLine("Installing the TinyFish CLI...");
+// spawnSync caps piped output at 1 MiB by default.
+const STEP_MAX_BUFFER = 10 * 1024 * 1024;
+function captureStdio(verbose) {
+    return verbose
+        ? { stdio: "inherit", timeout: SKILL_INSTALL_TIMEOUT_MS }
+        : { encoding: "utf8", maxBuffer: STEP_MAX_BUFFER, timeout: SKILL_INSTALL_TIMEOUT_MS };
+}
+/** Inherited stdio leaves these null; only piped runs yield text. */
+function capturedOutput(result) {
+    return `${asText(result.stdout)}${asText(result.stderr)}`;
+}
+function asText(stream) {
+    return typeof stream === "string" ? stream : "";
+}
+/** A verbose run captured nothing, so this is a no-op. */
+function replay(output) {
+    if (output.trim())
+        errLine(output.trimEnd());
+}
+export function installTinyFishCli({ verbose }) {
+    if (verbose)
+        errLine("Installing the TinyFish CLI...");
     // Without the prefix, a curl install upgrades npm's global tree and never the PATH binary.
     const root = installRoot();
     const prefixArgs = root ? ["--prefix", root.prefix] : [];
-    const result = spawn.sync("npm", ["install", "--global", ...prefixArgs, TINYFISH_CLI_INSTALL_SPEC], {
-        stdio: "inherit",
-        timeout: SKILL_INSTALL_TIMEOUT_MS,
-    });
+    const result = spawn.sync("npm", ["install", "--global", ...prefixArgs, TINYFISH_CLI_INSTALL_SPEC], captureStdio(verbose));
     if (result.error || result.status !== 0) {
-        throw spawnStepError("Could not install the TinyFish CLI", result);
+        // Built first: it runs the interrupt check, and abandonment must not replay.
+        const error = spawnStepError("Could not install the TinyFish CLI", result);
+        replay(capturedOutput(result));
+        throw error;
     }
 }
 /** `skills add` is an unconditional overwrite, so it doubles as the refresh path. */
@@ -53,6 +73,8 @@ function skillSpawnEnv() {
 // Safe to match on because SKILLS_CLI_PACKAGE is pinned.
 const SKILL_UPDATE_FAILURE_PATTERN = /Failed to (?:update|check|fetch)/;
 const SKILL_NOT_INSTALLED_PATTERN = /No installed skills found matching/;
+// Nothing was rewritten, so nothing needs an agent restart.
+const SKILL_ALREADY_CURRENT_PATTERN = /All global skills are up to date/;
 // A lock entry with no recorded hash is untrackable, so `skills` reports it as skipped rather
 // than failed. Left undetected that reads as "up to date" while nothing was refreshed.
 const SKILL_UNCHECKABLE_PATTERN = /cannot be checked automatically/;
@@ -65,6 +87,7 @@ export function installWebSkill(client) {
     const result = spawn.sync("npx", skillAddArgs([client.skillAgent]), {
         encoding: "utf8",
         env: skillSpawnEnv(),
+        maxBuffer: STEP_MAX_BUFFER,
         timeout: SKILL_INSTALL_TIMEOUT_MS,
     });
     const output = `${result.stdout ?? ""}${result.stderr ?? ""}`;
@@ -81,8 +104,10 @@ export function installWebSkill(client) {
  * only in prose, it repairs a copy whose lock entry lost its hash, and it cannot spread the
  * skill to agents the user never connected (`update` re-adds with no --agent, which targets
  * every agent on the machine).
+ *
+ * Returns whether a skill was actually rewritten.
  */
-export function updateWebSkill() {
+export function updateWebSkill({ verbose }) {
     // One entry per `tinyfish connect <client>`, persisted by PF-3169.
     const connected = loadConfig().connect ?? {};
     const skillAgents = NATIVE_MCP_CLIENTS
@@ -90,71 +115,82 @@ export function updateWebSkill() {
         .map((client) => client.skillAgent);
     const hasOpenClaw = Boolean(connected["openclaw"]);
     // Installs predating PF-3169 recorded nothing; ask `skills` to refresh what it tracks.
-    if (skillAgents.length === 0 && !hasOpenClaw) {
-        refreshWebSkillByHash();
-        return;
+    if (skillAgents.length === 0 && !hasOpenClaw)
+        return refreshWebSkillByHash(verbose);
+    let refreshed = false;
+    if (skillAgents.length > 0) {
+        reinstallWebSkill(skillAgents, verbose);
+        refreshed = true;
     }
-    if (skillAgents.length > 0)
-        reinstallWebSkill(skillAgents);
     // OpenClaw keeps its skill under its own CLI, so it needs its own refresh.
     if (hasOpenClaw)
-        reinstallOpenClawSkill();
+        refreshed = reinstallOpenClawSkill(verbose) || refreshed;
+    return refreshed;
 }
-function reinstallOpenClawSkill() {
-    errLine("Refreshing the TinyFish skill in OpenClaw...");
-    const result = spawn.sync("openclaw", OPENCLAW_SKILL_INSTALL_ARGS, {
-        stdio: "inherit",
-        timeout: SKILL_INSTALL_TIMEOUT_MS,
-    });
+function reinstallOpenClawSkill(verbose) {
+    if (verbose)
+        errLine("Refreshing the TinyFish skill in OpenClaw...");
+    const result = spawn.sync("openclaw", OPENCLAW_SKILL_INSTALL_ARGS, captureStdio(verbose));
     // OpenClaw may have been removed since connect; a stale context entry must not fail an
     // upgrade that otherwise succeeded.
     if (commandNotFound(result.error)) {
         errLine("OpenClaw is not on PATH, so its TinyFish skill was left unchanged.");
-        return;
+        return false;
     }
     if (result.error || result.status !== 0) {
         throwIfInterrupted(result);
+        replay(capturedOutput(result));
         throw new Error("Could not refresh the TinyFish skill in OpenClaw", { cause: result.error });
     }
+    return true;
 }
-function reinstallWebSkill(skillAgents) {
-    errLine(`Refreshing the TinyFish web skill for ${skillAgents.join(", ")}...`);
+function reinstallWebSkill(skillAgents, verbose) {
+    if (verbose)
+        errLine(`Refreshing the TinyFish web skill for ${skillAgents.join(", ")}...`);
     const result = spawn.sync("npx", skillAddArgs(skillAgents), {
         encoding: "utf8",
         env: skillSpawnEnv(),
+        maxBuffer: STEP_MAX_BUFFER,
         timeout: SKILL_INSTALL_TIMEOUT_MS,
     });
-    const output = `${result.stdout ?? ""}${result.stderr ?? ""}`;
-    if (output.trim())
-        errLine(output.trimEnd());
-    if (result.error || result.status !== 0 || SKILL_INSTALL_FAILURE_PATTERN.test(output)) {
+    const output = capturedOutput(result);
+    const failed = Boolean(result.error) || result.status !== 0 || SKILL_INSTALL_FAILURE_PATTERN.test(output);
+    if (failed)
         throwIfInterrupted(result);
+    if (verbose || failed)
+        replay(output);
+    if (failed)
         throw new Error("Could not refresh the TinyFish web skill", { cause: result.error });
-    }
 }
 /** Fallback when no harness is recorded: ask `skills` to refresh whatever it tracks. */
-function refreshWebSkillByHash() {
-    errLine("Refreshing the TinyFish web skill...");
+function refreshWebSkillByHash(verbose) {
+    if (verbose)
+        errLine("Refreshing the TinyFish web skill...");
     const result = spawn.sync("npx", ["-y", SKILLS_CLI_PACKAGE, "update", TINYFISH_WEB_SKILL, "--global", "--yes"], {
         encoding: "utf8",
         env: skillSpawnEnv(),
+        maxBuffer: STEP_MAX_BUFFER,
         timeout: SKILL_INSTALL_TIMEOUT_MS,
     });
-    // Piped rather than inherited so the output can be inspected; echoed back for the user.
-    const output = `${result.stdout ?? ""}${result.stderr ?? ""}`;
-    if (output.trim())
-        errLine(output.trimEnd());
-    if (result.error || result.status !== 0 || SKILL_UPDATE_FAILURE_PATTERN.test(output)) {
+    // Piped so prose-only failures can be matched; skills exits 0 anyway.
+    const output = capturedOutput(result);
+    const unchecked = SKILL_UNCHECKABLE_PATTERN.test(output);
+    const failed = Boolean(result.error) || result.status !== 0 || SKILL_UPDATE_FAILURE_PATTERN.test(output);
+    if (failed)
         throwIfInterrupted(result);
+    if (verbose || failed || unchecked)
+        replay(output);
+    if (failed)
         throw new Error("Could not refresh the TinyFish web skill", { cause: result.error });
-    }
-    if (SKILL_UNCHECKABLE_PATTERN.test(output)) {
+    if (unchecked) {
         errLine("Run `tinyfish connect <client>` to reinstall the skill and restore update tracking.");
         throw new Error("The TinyFish web skill cannot be checked for updates");
     }
     if (SKILL_NOT_INSTALLED_PATTERN.test(output)) {
         errLine("No use-tinyfish skill installed. Run `tinyfish connect <client>` to add it.");
+        return false;
     }
+    return !SKILL_ALREADY_CURRENT_PATTERN.test(output);
 }
 export function ensureCliAuthenticated(source, apiKey) {
     const envKey = apiKey ?? process.env["TINYFISH_API_KEY"];

package/dist/lib/connect-runtime.js

@@ -33,10 +33,13 @@ export class ConnectStepError extends Error {
 }
 class PrerequisiteError extends ConnectStepError {
 }
+// A maxBuffer overflow is also killed with SIGTERM, and is a failure too.
+const NOT_INTERRUPTIONS = new Set(["ETIMEDOUT", "ENOBUFS"]);
 export function throwIfInterrupted(result) {
     // spawn.sync kills a timed-out child with SIGTERM, so signal alone would misread a slow
     // network as the user walking away. A timeout is a failure and must report as one.
-    if (result.error?.code === "ETIMEDOUT")
+    const code = result.error?.code;
+    if (code && NOT_INTERRUPTIONS.has(code))
         return;
     if (result.signal === "SIGINT" || result.signal === "SIGTERM") {
         throw new ConnectInterruptedError("Setup interrupted");

package/dist/lib/registration-detect.d.ts

@@ -9,6 +9,11 @@ export interface RegistrationStatus {
     registeredUrl?: string;
     /** For doctor to verify; never for the report. */
     apiKey?: string;
+    /** From the environment, not the config, so a 401 is ambiguous. */
+    keyIsIndirect?: boolean;
+    connected?: boolean;
+    /** Why a keyed registration's key could not be read; not `reason`. */
+    keyReason?: string;
     reason?: string;
 }
 export declare function codexOauthCompleted(): boolean | undefined;

package/dist/lib/registration-detect.js

@@ -76,10 +76,23 @@ function runProbe(command, args) {
 }
 // A plugin registers its server as `plugin:<plugin>:<server>`, which `mcp get tinyfish` misses.
 // The optional prefix must end in `:`, so `not-tinyfish` is not a match.
-const MCP_LIST_TINYFISH_LINE = /^((?:\S*:)?tinyfish):\s+(https?:\S+)/m;
+const MCP_LIST_TINYFISH_LINE = /^((?:\S*:)?tinyfish):\s+(https?:\S+)(.*)$/m;
+const SERVER_NAMED_TINYFISH = /^(?:\S*:)?tinyfish$/;
 // A bare substring also matches `not-tinyfish` and any row quoting a tinyfish URL, so the name
 // is required to be the first word on its line, after whatever status glyph the CLI prints.
 const LISTED_AS_TINYFISH = /^[^\w]*tinyfish(?![\w-])/m;
+// Claude Code reports its own live handshake; a config file cannot.
+const MCP_GET_STATUS = /^\s*Status:\s*(.+)$/m;
+// `mcp get <missing>` names every configured server, with no health check.
+const CONFIGURED_SERVERS = /Configured servers:\s*(.+)$/m;
+/** Ordered: "Connected · tools fetch failed" carries both words; the failure wins. */
+function connectionState(status) {
+    if (/fail|error|needs auth|not configured/i.test(status))
+        return false;
+    if (/\bconnected\b/i.test(status))
+        return true;
+    return undefined;
+}
 /** The plugin ships its own MCP server, so a working install can carry no `tinyfish` entry. */
 function fromPluginRegistration(command) {
     const probe = runProbe(command, ["mcp", "list"]);
@@ -88,12 +101,37 @@ function fromPluginRegistration(command) {
     const match = MCP_LIST_TINYFISH_LINE.exec(probe.output);
     if (!match)
         return undefined;
+    const connected = connectionState(match[3] ?? "");
     // `mcp list` prints no headers, so the credential behind it is unproven, never assumed.
     return {
         registered: Registered.Yes,
         authMode: AuthMode.Unknown,
         registeredUrl: match[2],
-        reason: `registered as ${match[1]}, which \`mcp get tinyfish\` does not resolve`,
+        ...(connected === undefined ? {} : { connected }),
+        reason: `registered as ${match[1]}`,
+    };
+}
+/** Names can contain spaces, so each candidate is matched whole. */
+function tinyfishServerName(output) {
+    const listed = CONFIGURED_SERVERS.exec(output)?.[1];
+    return listed
+        ?.split(",")
+        .map((name) => name.trim())
+        .find((name) => SERVER_NAMED_TINYFISH.test(name));
+}
+function parseMcpGet(output, keyAuthPattern) {
+    // Positive evidence only: whether `mcp get` echoes headers at all is unverified, so absence
+    // of the pattern is `unknown`, never proof of OAuth.
+    const url = /^\s*URL:\s*(\S+)/m.exec(output)?.[1];
+    const key = extractableKey(API_KEY_HEADER_VALUE.exec(output)?.[1]);
+    const status = MCP_GET_STATUS.exec(output)?.[1];
+    const connected = status === undefined ? undefined : connectionState(status);
+    return {
+        registered: Registered.Yes,
+        authMode: keyAuthPattern.test(output) ? AuthMode.ApiKey : AuthMode.Unknown,
+        ...(url ? { registeredUrl: url } : {}),
+        ...(key ? { apiKey: key } : {}),
+        ...(connected === undefined ? {} : { connected }),
     };
 }
 // claude-code only. Codex cannot use this: its `mcp get` exits 0 on a missing server.
@@ -110,6 +148,17 @@ function fromMcpGet(command, keyAuthPattern) {
                 reason: `\`${command} mcp get\` is unsupported by this version`,
             };
         }
+        // The roster is free; `mcp list` health-checks every server.
+        const scoped = tinyfishServerName(probe.output);
+        if (scoped) {
+            const rescoped = runProbe(command, ["mcp", "get", scoped]);
+            if (rescoped.outcome === "ran" && rescoped.exitCode === 0) {
+                return {
+                    ...parseMcpGet(rescoped.output, keyAuthPattern),
+                    reason: `registered as ${scoped}`,
+                };
+            }
+        }
         // Positive evidence from `mcp list` outranks anything inferred from a failed `mcp get`.
         const plugin = fromPluginRegistration(command);
         if (plugin)
@@ -124,16 +173,7 @@ function fromMcpGet(command, keyAuthPattern) {
         }
         return { registered: Registered.No, authMode: AuthMode.Unknown };
     }
-    // Positive evidence only: whether `mcp get` echoes headers at all is unverified, so absence
-    // of the pattern is `unknown`, never proof of OAuth.
-    const url = /^\s*URL:\s*(\S+)/m.exec(probe.output)?.[1];
-    const key = extractableKey(API_KEY_HEADER_VALUE.exec(probe.output)?.[1]);
-    return {
-        registered: Registered.Yes,
-        authMode: keyAuthPattern.test(probe.output) ? AuthMode.ApiKey : AuthMode.Unknown,
-        ...(url ? { registeredUrl: url } : {}),
-        ...(key ? { apiKey: key } : {}),
-    };
+    return parseMcpGet(probe.output, keyAuthPattern);
 }
 // `codex mcp get <missing>` prints an error and exits 0, so presence must never be read from
 // its exit code; `mcp list --json` is the only trustworthy read-back.
@@ -175,6 +215,22 @@ export function codexOauthCompleted() {
         return false;
     return undefined;
 }
+// This reaches the pasted report, so its shape is checked first.
+const ENV_VAR_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** Codex stores a variable name, not a value, so resolve it. */
+function codexEnvKey(envVar) {
+    if (!ENV_VAR_NAME.test(envVar)) {
+        return { keyReason: "its key comes from an unusable variable name" };
+    }
+    const key = extractableKey(process.env[envVar]);
+    if (key)
+        return { apiKey: key, keyIsIndirect: true };
+    return {
+        keyReason: process.env[envVar]
+            ? `$${envVar} does not hold a TinyFish key here`
+            : `$${envVar} is not set here`,
+    };
+}
 function probeCodex() {
     const read = readCodexEntry();
     if ("reason" in read)
@@ -183,16 +239,18 @@ function probeCodex() {
     if (!entry)
         return { registered: Registered.No, authMode: AuthMode.Unknown };
     const codexUrl = entry.transport?.url;
+    // Read from this entry: codex emits `bearer_token_env_var` on every HTTP server, so testing
+    // the whole payload reports api-key for TinyFish because some other server carries a key.
+    const envVar = entry.auth_status === "o_auth" ? undefined : entry.transport?.bearer_token_env_var;
     return {
         registered: Registered.Yes,
-        // Read from this entry: codex emits `bearer_token_env_var` on every HTTP server, so testing
-        // the whole payload reports api-key for TinyFish because some other server carries a key.
         authMode: entry.auth_status === "o_auth"
             ? AuthMode.OAuth
-            : entry.transport?.bearer_token_env_var
+            : envVar
                 ? AuthMode.ApiKey
                 : AuthMode.Unknown,
         ...(codexUrl ? { registeredUrl: codexUrl } : {}),
+        ...(envVar ? codexEnvKey(envVar) : {}),
     };
 }
 function probeCursor() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiny-fish/cli",
-  "version": "0.21.1-next.194",
+  "version": "0.21.1-next.196",
   "description": "TinyFish CLI — run web automations from your terminal",
   "type": "module",
   "bin": {