@tiny-fish/cli 0.21.1-next.196 → 0.22.0

package/dist/commands/doctor.js

@@ -1,7 +1,7 @@
 import spawn from "cross-spawn";
 import { apiKeyStatus } from "../lib/auth.js";
 import { CLI_VERSION } from "../lib/constants.js";
-import { DOCTOR_COULD_NOT_RUN, DOCTOR_SCHEMA_VERSION, doctorReportSchema, exitCodeFor, renderPretty, } from "../lib/doctor-report.js";
+import { DOCTOR_COULD_NOT_RUN, DOCTOR_SCHEMA_VERSION, doctorReportSchema, exitCodeFor, renderPretty, verdictFor, } from "../lib/doctor-report.js";
 import { ALL_HARNESSES, AuthMode, Registered } from "../lib/harness-detect.js";
 import { detectHumanInitiated } from "../lib/harness.js";
 import { err, errLine, out, outLine } from "../lib/output.js";
@@ -30,6 +30,7 @@ function checkCliVersion() {
         status: "pass",
         detail: `${CLI_VERSION}; the server reports staleness via X-TF-Notice`,
         harness: null,
+        scope: "info",
     };
 }
 async function checkConnectivity(mcpUrl) {
@@ -39,7 +40,9 @@ async function checkConnectivity(mcpUrl) {
         title: "MCP endpoint reachable",
         status: health.ok ? "pass" : "fail",
         detail: health.ok ? mcpUrl : (health.code ?? "the endpoint is unreachable"),
+        // Harness-scoped: the CLI's own reachability is `cli-auth-call`'s claim.
         harness: null,
+        scope: "harness",
     };
 }
 // Query strings carry the connect attempt id, so they differ on every healthy install.
@@ -60,8 +63,21 @@ function pointsElsewhere(registeredUrl, mcpUrl) {
         return "an unparseable endpoint";
     }
 }
-function keyedVerdict(status, keyAuth) {
+function keyedVerdict(status, keyAuth, cliKeyMissing) {
     if (!keyAuth) {
+        // Its auth is the CLI credential; a warn would exit 0.
+        if (status.usesCliKey) {
+            return cliKeyMissing
+                ? {
+                    status: "fail",
+                    detail: "registered, but it runs on the CLI credential, which is missing or unusable",
+                }
+                : // Reachable with a key only when `--url` skipped verification.
+                    {
+                        status: "warn",
+                        detail: "registered, but its CLI credential was not verified against this endpoint",
+                    };
+        }
         // A bare warn beside exit 0 reads as a pass.
         const because = status.keyReason ?? "its key is not readable here";
         return { status: "warn", detail: `registered, but ${because}, so its reach is unproven` };
@@ -88,7 +104,7 @@ function keyedVerdict(status, keyAuth) {
     }
     return { status: "warn", detail: "registered, key could not be verified" };
 }
-function registrationVerdict(status, mcpUrl, keyAuth) {
+function registrationVerdict(status, mcpUrl, keyAuth, cliKeyMissing) {
     if (!status.detected)
         return { status: "skip", detail: "harness not installed" };
     if (status.registered === Registered.Unknown) {
@@ -116,7 +132,7 @@ function registrationVerdict(status, mcpUrl, keyAuth) {
         }
         // Widening past api-key would warn every healthy oauth install.
         if (status.authMode === AuthMode.ApiKey)
-            return keyedVerdict(status, keyAuth);
+            return keyedVerdict(status, keyAuth, cliKeyMissing);
         // A probe that had to explain itself to reach `yes` is the only thing that explains `unknown`.
         const because = status.reason ? ` (${status.reason})` : "";
         return { status: "pass", detail: `registered, auth mode ${status.authMode}${because}` };
@@ -126,12 +142,13 @@ function registrationVerdict(status, mcpUrl, keyAuth) {
         ? { status: "fail", detail: "connected previously but TinyFish is no longer registered" }
         : { status: "warn", detail: "installed but TinyFish was never connected" };
 }
-function checkRegistration(status, mcpUrl, keyAuth) {
+function checkRegistration(status, mcpUrl, keyAuth, cliKeyMissing) {
     return {
         id: "harness-registration",
         title: `${status.harness} registration`,
         harness: status.harness,
-        ...registrationVerdict(status, mcpUrl, keyAuth),
+        scope: "harness",
+        ...registrationVerdict(status, mcpUrl, keyAuth, cliKeyMissing),
     };
 }
 function checkCredential() {
@@ -142,6 +159,7 @@ function checkCredential() {
         status: "key" in resolved ? "pass" : "fail",
         detail: "key" in resolved ? `key present from ${resolved.source}` : resolved.error,
         harness: null,
+        scope: "cli",
     };
     return "key" in resolved ? { check, key: resolved.key } : { check };
 }
@@ -153,6 +171,7 @@ function checkAuthCall(auth) {
             status: "skip",
             detail: "no credential to test",
             harness: null,
+            scope: "cli",
         };
     }
     return {
@@ -161,6 +180,7 @@ function checkAuthCall(auth) {
         status: auth.ok ? "pass" : "fail",
         detail: auth.ok ? "listRuns succeeded" : (auth.code ?? "the authenticated call failed"),
         harness: null,
+        scope: "cli",
     };
 }
 // `verifyMcpAuth` hits BASE_URL; a sandbox key 401s against prod.
@@ -178,8 +198,8 @@ function verifyHarnessKey(status, cliKey, cliAuth, mcpUrl) {
     // `pointsElsewhere` already fails; a second reason only misleads.
     if (pointsElsewhere(status.registeredUrl, mcpUrl))
         return undefined;
-    // OpenClaw's skill shells this CLI, so its verdict stands in.
-    if (status.harness === "openclaw")
+    // A harness with no key of its own reads the CLI's.
+    if (status.usesCliKey)
         return cliAuth;
     if (!status.apiKey)
         return undefined;
@@ -237,7 +257,7 @@ export async function runDoctor(options) {
     const checks = [
         checkCliVersion(),
         connectivity,
-        ...statuses.map((status, i) => checkRegistration(status, options.mcpUrl, keyAuths[i])),
+        ...statuses.map((status, i) => checkRegistration(status, options.mcpUrl, keyAuths[i], !credential.key)),
         credential.check,
         checkAuthCall(cliAuthResult),
     ];
@@ -252,7 +272,7 @@ export async function runDoctor(options) {
     const body = {
         schema_version: DOCTOR_SCHEMA_VERSION,
         cli_version: CLI_VERSION,
-        ok: exitCodeFor(checks) === 0,
+        ...verdictFor(checks),
         checks,
         harnesses,
         repairs: repairsFor(checks, statuses),

package/dist/lib/doctor-report.d.ts

@@ -1,13 +1,18 @@
 import { z } from "zod";
 import { AuthMode, Registered } from "./harness-detect.js";
 /** Bumped whenever a consumer could misread the payload; the cookbook skill releases separately. */
-export declare const DOCTOR_SCHEMA_VERSION = 2;
+export declare const DOCTOR_SCHEMA_VERSION = 3;
 declare const checkStatusSchema: z.ZodEnum<{
     pass: "pass";
     fail: "fail";
     warn: "warn";
     skip: "skip";
 }>;
+declare const checkScopeSchema: z.ZodEnum<{
+    cli: "cli";
+    harness: "harness";
+    info: "info";
+}>;
 declare const doctorCheckSchema: z.ZodObject<{
     id: z.ZodString;
     title: z.ZodString;
@@ -26,6 +31,11 @@ declare const doctorCheckSchema: z.ZodObject<{
         opencode: "opencode";
         "claude-code": "claude-code";
     }>>;
+    scope: z.ZodEnum<{
+        cli: "cli";
+        harness: "harness";
+        info: "info";
+    }>;
 }, z.core.$strip>;
 declare const doctorHarnessSchema: z.ZodObject<{
     harness: z.ZodEnum<{
@@ -61,7 +71,8 @@ declare const doctorRepairSchema: z.ZodObject<{
 export declare const doctorReportSchema: z.ZodObject<{
     schema_version: z.ZodInt;
     cli_version: z.ZodString;
-    ok: z.ZodBoolean;
+    ok_harnesses: z.ZodBoolean;
+    ok_cli: z.ZodBoolean;
     checks: z.ZodArray<z.ZodObject<{
         id: z.ZodString;
         title: z.ZodString;
@@ -80,6 +91,11 @@ export declare const doctorReportSchema: z.ZodObject<{
             opencode: "opencode";
             "claude-code": "claude-code";
         }>>;
+        scope: z.ZodEnum<{
+            cli: "cli";
+            harness: "harness";
+            info: "info";
+        }>;
     }, z.core.$strip>>;
     harnesses: z.ZodArray<z.ZodObject<{
         harness: z.ZodEnum<{
@@ -114,6 +130,7 @@ export declare const doctorReportSchema: z.ZodObject<{
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export type CheckStatus = z.infer<typeof checkStatusSchema>;
+export type CheckScope = z.infer<typeof checkScopeSchema>;
 export type DoctorCheck = z.infer<typeof doctorCheckSchema>;
 export type DoctorHarness = z.infer<typeof doctorHarnessSchema>;
 export type DoctorRepair = z.infer<typeof doctorRepairSchema>;
@@ -121,6 +138,11 @@ export type DoctorReport = z.infer<typeof doctorReportSchema>;
 /** Doctor itself broke, which is a different claim from "your setup is broken". */
 export declare const DOCTOR_COULD_NOT_RUN = 2;
 /** Skips never fail the run; a skip means not applicable, not broken. */
+export declare function verdictFor(checks: DoctorCheck[]): {
+    ok_harnesses: boolean;
+    ok_cli: boolean;
+};
+/** Harness scope only: the caller asked about its agent, not us. */
 export declare function exitCodeFor(checks: DoctorCheck[]): 0 | 1;
 export declare function renderPretty(report: DoctorReport): string;
 export {};

package/dist/lib/doctor-report.js

@@ -1,15 +1,18 @@
 import { z } from "zod";
 import { ALL_HARNESSES, AuthMode, Registered } from "./harness-detect.js";
 /** Bumped whenever a consumer could misread the payload; the cookbook skill releases separately. */
-export const DOCTOR_SCHEMA_VERSION = 2;
+export const DOCTOR_SCHEMA_VERSION = 3;
 const checkStatusSchema = z.enum(["pass", "fail", "warn", "skip"]);
 const harnessSchema = z.enum(ALL_HARNESSES);
+// Not derived from `harness`: connectivity is harness-null yet harness-scoped.
+const checkScopeSchema = z.enum(["harness", "cli", "info"]);
 const doctorCheckSchema = z.object({
     id: z.string(),
     title: z.string(),
     status: checkStatusSchema,
     detail: z.string(),
     harness: harnessSchema.nullable(),
+    scope: checkScopeSchema,
 });
 const doctorHarnessSchema = z.object({
     harness: harnessSchema,
@@ -27,27 +30,54 @@ const doctorRepairSchema = z.object({
     command: z.string(),
     unattended_safe: z.boolean(),
 });
+function hasFailure(checks, scope) {
+    return checks.some((check) => check.scope === scope && check.status === "fail");
+}
+// One `ok` could not answer both questions, and answered neither.
 export const doctorReportSchema = z
     .object({
     // Not `z.literal`: a consumer must be able to read a future version and say so.
     schema_version: z.int().positive(),
     cli_version: z.string(),
-    ok: z.boolean(),
+    ok_harnesses: z.boolean(),
+    ok_cli: z.boolean(),
     checks: z.array(doctorCheckSchema),
     harnesses: z.array(doctorHarnessSchema),
     repairs: z.array(doctorRepairSchema),
 })
-    // A report that says ok while a check failed is worse than no report.
-    .refine((report) => !report.ok || report.checks.every((check) => check.status !== "fail"), {
-    message: "ok cannot be true while a check has failed",
-    path: ["ok"],
+    // Claiming ok while that scope failed is worse than no report.
+    .refine((report) => !report.ok_harnesses || !hasFailure(report.checks, "harness"), {
+    message: "ok_harnesses cannot be true while a harness check has failed",
+    path: ["ok_harnesses"],
+})
+    .refine((report) => !report.ok_cli || !hasFailure(report.checks, "cli"), {
+    message: "ok_cli cannot be true while a CLI check has failed",
+    path: ["ok_cli"],
 });
 const GLYPHS = { pass: "✓", fail: "✗", warn: "⚠", skip: "…" };
 /** Doctor itself broke, which is a different claim from "your setup is broken". */
 export const DOCTOR_COULD_NOT_RUN = 2;
 /** Skips never fail the run; a skip means not applicable, not broken. */
+export function verdictFor(checks) {
+    return { ok_harnesses: !hasFailure(checks, "harness"), ok_cli: !hasFailure(checks, "cli") };
+}
+/** Harness scope only: the caller asked about its agent, not us. */
 export function exitCodeFor(checks) {
-    return checks.some((check) => check.status === "fail") ? 1 : 0;
+    return verdictFor(checks).ok_harnesses ? 0 : 1;
+}
+// A red line above exit 0 reads as a contradiction.
+function footnotes(report) {
+    const notes = [];
+    // Alongside exit 1 this is noise; something did fail.
+    if (hasFailure(report.checks, "cli") && report.ok_harnesses) {
+        notes.push("The CLI's own credential is broken; that does not affect the exit code.");
+    }
+    // Per-harness rows, not the scope: connectivity is harness-scoped and never skips.
+    const harnessChecks = report.checks.filter((c) => c.harness !== null);
+    if (harnessChecks.length > 0 && harnessChecks.every((c) => c.status === "skip")) {
+        notes.push("No harness was checked here, so a green harness verdict proves nothing.");
+    }
+    return notes;
 }
 export function renderPretty(report) {
     const lines = report.checks.map((c) => `${GLYPHS[c.status]} ${c.title}${c.detail ? ` — ${c.detail}` : ""}`);
@@ -56,5 +86,8 @@ export function renderPretty(report) {
         for (const repair of report.repairs)
             lines.push(`  ${repair.command}`);
     }
+    const notes = footnotes(report);
+    if (notes.length > 0)
+        lines.push("", ...notes);
     return lines.join("\n");
 }

package/dist/lib/registration-detect.d.ts

@@ -11,6 +11,8 @@ export interface RegistrationStatus {
     apiKey?: string;
     /** From the environment, not the config, so a 401 is ambiguous. */
     keyIsIndirect?: boolean;
+    /** Holds no key; reads the CLI's at runtime. */
+    usesCliKey?: boolean;
     connected?: boolean;
     /** Why a keyed registration's key could not be read; not `reason`. */
     keyReason?: string;

package/dist/lib/registration-detect.js

@@ -324,7 +324,7 @@ function probeOpenClaw() {
     }
     // A bare substring also matched a skill merely named `not-tinyfish-thing`.
     return entries.some((name) => SKILL_DIR_IS_TINYFISH.test(name))
-        ? { registered: Registered.Yes, authMode: AuthMode.ApiKey }
+        ? { registered: Registered.Yes, authMode: AuthMode.ApiKey, usesCliKey: true }
         : { registered: Registered.No, authMode: AuthMode.Unknown };
 }
 // `opencode mcp list` prints no headers, so a key-authed registration is indistinguishable.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiny-fish/cli",
-  "version": "0.21.1-next.196",
+  "version": "0.22.0",
   "description": "TinyFish CLI — run web automations from your terminal",
   "type": "module",
   "bin": {