@tiny-fish/cli 0.23.1-next.204 → 0.23.1-next.206

package/dist/commands/connect.js

@@ -1,6 +1,6 @@
 import spawn from "cross-spawn";
 import { CONNECT_SOURCE, persistApiKeyToEnvironment, saveConnectContext, validateKeyFormat, validatedApiKey, } from "../lib/auth.js";
-import { CLAUDE_CODE, CODEX, GROK, HERMES, OPENCLAW, OPENCLAW_SKILL_INSTALL_ARGS, OPENCODE, launchNativeMcpClient, launchOpenClawWalkthrough, openExternalUrl, } from "../lib/connect-clients.js";
+import { CLAUDE_CODE, CODEX, CURSOR_SKILL_TARGET, GROK, HERMES, OPENCLAW, OPENCLAW_SKILL_INSTALL_ARGS, OPENCODE, launchNativeMcpClient, launchOpenClawWalkthrough, openExternalUrl, } from "../lib/connect-clients.js";
 import { ensureCliAuthenticated, installTinyFishCli, installWebSkill, SKILL_INSTALL_TIMEOUT_MS, UPGRADE_HINT, } from "../lib/connect-install.js";
 import { ConnectInterruptedError, ConnectStepError, createConnectTelemetry, requireCommandSupport, runGuarded, settle, spawnStepError, throwIfInterrupted, NON_INTERACTIVE_TIMEOUT_MS, } from "../lib/connect-runtime.js";
 import { cursorInstallDeeplink, cursorMcpPath, writeCursorMcpConfig, } from "../lib/cursor-config.js";
@@ -266,6 +266,9 @@ export async function connectCursor(options) {
     await runGuarded(state, telemetry, async () => {
         telemetry.track("started");
         telemetry.track("checkpoint", { phase: "prerequisite_ok" });
+        state.stage = "skill_install";
+        installWebSkill(CURSOR_SKILL_TARGET);
+        telemetry.track("checkpoint", { phase: "skill_installed" });
         // Auth first: a key lets the config carry an X-API-Key header, removing the sign-in hand-back.
         state.stage = "authentication";
         ensureCliAuthenticated("cursor", options.apiKey);

package/dist/commands/doctor.js

@@ -7,7 +7,7 @@ import { detectHumanInitiated } from "../lib/harness.js";
 import { err, errLine, out, outLine } from "../lib/output.js";
 import { detectRegistrations } from "../lib/registration-detect.js";
 import { verifyMcpAuth, verifyMcpHealth } from "../lib/verify.js";
-import { connectClaudeCode, connectCodex, connectCursor, connectHermes, connectOpenClaw, connectOpencode, DEFAULT_MCP_URL, } from "./connect.js";
+import { connectClaudeCode, connectCodex, connectCursor, connectGrok, connectHermes, connectOpenClaw, connectOpencode, DEFAULT_MCP_URL, } from "./connect.js";
 // A green auth mode with a red auth call proves nothing, so the call's verdict gates the claim.
 function provesHarnessReach(status, keyAuth, healthOk, mcpUrl) {
     // An endpoint doctor could not reach proves nothing about a harness pointed at it.
@@ -63,10 +63,14 @@ function pointsElsewhere(registeredUrl, mcpUrl) {
         return "an unparseable endpoint";
     }
 }
+/** Either it reads the CLI's key at runtime or it holds a copy: the CLI's own verdict covers both. */
+function runsOnCliCredential(status) {
+    return status.usesCliKey === true || status.keyMatchesCliKey === true;
+}
 function keyedVerdict(status, keyAuth, cliKeyMissing) {
     if (!keyAuth) {
         // Its auth is the CLI credential; a warn would exit 0.
-        if (status.usesCliKey) {
+        if (runsOnCliCredential(status)) {
             return cliKeyMissing
                 ? {
                     status: "fail",
@@ -79,7 +83,7 @@ function keyedVerdict(status, keyAuth, cliKeyMissing) {
                     };
         }
         // A bare warn beside exit 0 reads as a pass.
-        const because = status.keyReason ?? "its key is not readable here";
+        const because = status.keyReason ?? "the CLI cannot verify a key it does not hold";
         return { status: "warn", detail: `registered, but ${because}, so its reach is unproven` };
     }
     if (keyAuth.ok) {
@@ -89,13 +93,6 @@ function keyedVerdict(status, keyAuth, cliKeyMissing) {
         };
     }
     if (keyAuth.status === 401) {
-        // Resolved in doctor's shell, not codex's, so a 401 proves nothing.
-        if (status.keyIsIndirect) {
-            return {
-                status: "warn",
-                detail: "registered, but the key doctor resolved for it is rejected",
-            };
-        }
         return { status: "fail", detail: "registered, but TinyFish rejects its API key" };
     }
     // Only 401 blames the key; connect would loop on the rest.
@@ -192,20 +189,14 @@ function isDefaultEndpoint(mcpUrl) {
         return false;
     }
 }
-function verifyHarnessKey(status, cliKey, cliAuth, mcpUrl) {
+function verifyHarnessKey(status, cliAuth, mcpUrl) {
     if (!isDefaultEndpoint(mcpUrl))
         return undefined;
     // `pointsElsewhere` already fails; a second reason only misleads.
     if (pointsElsewhere(status.registeredUrl, mcpUrl))
         return undefined;
-    // A harness with no key of its own reads the CLI's.
-    if (status.usesCliKey)
-        return cliAuth;
-    if (!status.apiKey)
-        return undefined;
-    if (status.apiKey === cliKey && cliAuth)
-        return cliAuth;
-    return verifyMcpAuth(status.apiKey);
+    // The CLI never holds a harness's key, so only its own credential can be verified.
+    return runsOnCliCredential(status) ? cliAuth : undefined;
 }
 // Only Cursor's repair is a pure local file write; every other one needs a browser sign-in.
 const UNATTENDED_SAFE = new Set(["cursor"]);
@@ -252,7 +243,7 @@ export async function runDoctor(options) {
     const [connectivity, cliAuthResult, keyAuths] = await Promise.all([
         checkConnectivity(options.mcpUrl),
         cliAuth,
-        Promise.all(statuses.map((status) => verifyHarnessKey(status, credential.key, cliAuth, options.mcpUrl))),
+        Promise.all(statuses.map((status) => verifyHarnessKey(status, cliAuth, options.mcpUrl))),
     ]);
     const checks = [
         checkCliVersion(),
@@ -300,6 +291,7 @@ const CONNECTORS = {
     "claude-code": (opts) => connectClaudeCode({ ...opts, launch: false }),
     codex: (opts) => connectCodex({ ...opts, launch: false }),
     cursor: (opts) => connectCursor(opts),
+    grok: (opts) => connectGrok({ ...opts, launch: false }),
     hermes: (opts) => connectHermes({ ...opts, launch: false }),
     openclaw: (opts) => connectOpenClaw({ ...opts, launch: false }),
     opencode: (opts) => connectOpencode({ ...opts, launch: false }),

package/dist/lib/auth.d.ts

@@ -36,8 +36,6 @@ export declare function persistApiKeyToEnvironment(apiKey: string, options?: Env
 export declare function clearConfig(): boolean;
 /** The one rule that is ours to enforce: the key becomes an HTTP header, so CR/LF cannot pass. */
 export declare function isHeaderSafe(key: string): boolean;
-/** No length rule: short real keys must survive. */
-export declare function hasKeyPrefix(key: string): boolean;
 export declare function validateKeyFormat(key: string): boolean;
 export declare function maskKey(key: string): string;
 export type KeySource = "explicit" | "env" | "config" | "none";
@@ -51,6 +49,8 @@ export interface UnresolvedKey {
 }
 /** Key for optional paths (telemetry, auth probes) — absent is a valid answer, so never exits. */
 export declare function resolvedApiKey(explicitApiKey?: string): string | undefined;
+/** Answers "is this the CLI's own key" without the value leaving the caller; see sdk/cli/CLAUDE.md. */
+export declare function matchesCliKey(value: string | undefined): boolean;
 /** resolvedApiKey for keys that reach a config file or the wire — loadConfig() is unvalidated on read. */
 export declare function validatedApiKey(explicitApiKey?: string): string | undefined;
 /**

package/dist/lib/auth.js

@@ -193,7 +193,7 @@ export function isHeaderSafe(key) {
     return true;
 }
 /** No length rule: short real keys must survive. */
-export function hasKeyPrefix(key) {
+function hasKeyPrefix(key) {
     return KEY_PREFIXES.some((p) => key.startsWith(p));
 }
 export function validateKeyFormat(key) {
@@ -219,6 +219,10 @@ function lookupApiKey(explicitApiKey) {
 export function resolvedApiKey(explicitApiKey) {
     return lookupApiKey(explicitApiKey).value;
 }
+/** Answers "is this the CLI's own key" without the value leaving the caller; see sdk/cli/CLAUDE.md. */
+export function matchesCliKey(value) {
+    return value !== undefined && value === resolvedApiKey();
+}
 /** resolvedApiKey for keys that reach a config file or the wire — loadConfig() is unvalidated on read. */
 export function validatedApiKey(explicitApiKey) {
     const key = resolvedApiKey(explicitApiKey);

package/dist/lib/connect-all.js

@@ -1,6 +1,6 @@
 import * as readline from "node:readline/promises";
 import spawn from "cross-spawn";
-import { connectClaudeCode, connectCodex, connectCursor, connectHermes, connectOpenClaw, connectOpencode, } from "../commands/connect.js";
+import { connectClaudeCode, connectCodex, connectCursor, connectGrok, connectHermes, connectOpenClaw, connectOpencode, } from "../commands/connect.js";
 import { validatedApiKey } from "./auth.js";
 import { NATIVE_MCP_CLIENTS } from "./connect-clients.js";
 import { ensureCliAuthenticated, installTinyFishCli, TINYFISH_CLI_NOT_FOUND_MESSAGE, } from "./connect-install.js";
@@ -16,6 +16,7 @@ const DISPLAY_NAMES = {
     "claude-code": "Claude Code",
     codex: "Codex",
     cursor: "Cursor",
+    grok: "Grok",
     hermes: "Hermes",
     openclaw: "OpenClaw",
     opencode: "OpenCode",
@@ -26,7 +27,6 @@ const AUTH_DEFERRED_AT_INSTALL = new Set(["codex"]);
 const AUTH_CHECK_CAPABLE = new Set(["cursor", "openclaw"]);
 // Descriptor-derived so a harness that cannot carry a key is skipped, not failed, when headless.
 // Cursor and OpenClaw hold the key themselves rather than handing it to a harness `mcp add`.
-// `--all` only reaches harnesses it can detect; Grok has a keyAuth but no detection yet.
 const KEY_AUTH_CAPABLE = new Set([
     ...NATIVE_MCP_CLIENTS.filter((client) => !!client.keyAuth)
         .map((client) => client.connectClient)
@@ -40,6 +40,7 @@ const KEY_AUTH_CAPABLE = new Set([
 const UNINSTALL_POINTERS = {
     "claude-code": "claude mcp remove tinyfish --scope user",
     codex: "codex mcp remove tinyfish",
+    grok: "grok mcp remove tinyfish",
     hermes: "hermes mcp remove tinyfish",
     openclaw: "openclaw skills uninstall @tinyfish/tinyfish --global",
     // OpenCode ships no `mcp remove`, so the only removal is editing the config it wrote.
@@ -60,8 +61,14 @@ async function runHarnessConnect(harness, opts, keyAuthOnly) {
     }
     if (harness === "opencode")
         return connectOpencode(base);
-    await connectCursor({ apiKey: opts.apiKey, mcpUrl: opts.mcpUrl });
-    return undefined;
+    if (harness === "grok")
+        return connectGrok(base);
+    if (harness === "cursor") {
+        await connectCursor({ apiKey: opts.apiKey, mcpUrl: opts.mcpUrl });
+        return undefined;
+    }
+    // Explicit: a new harness reaching an untested branch must fail, not write Cursor's config.
+    throw new Error(`No installer is wired for ${harness}`);
 }
 async function verifyHarness(harness, mcpUrl, keyed, apiKey) {
     const health = await verifyMcpHealth(mcpUrl);

package/dist/lib/connect-clients.d.ts

@@ -3,10 +3,17 @@ import { type AgentClient, type SupportedCommand } from "./connect-runtime.js";
 export declare const OPENCLAW_SKILL_INSTALL_ARGS: readonly string[];
 export declare const DEFAULT_ONBOARDING_PROMPT: string;
 export declare const OPENCLAW_ONBOARDING_PROMPT: string;
+/** The `skills` CLI's own agent names — not ours, and not every harness has one. */
+export type SkillAgent = "claude-code" | "codex" | "cursor" | "hermes-agent" | "opencode";
+/** Cursor writes its own MCP config, so it has no descriptor to carry this. */
+export declare const CURSOR_SKILL_TARGET: {
+    readonly skillAgent: "cursor";
+    readonly displayName: "Cursor";
+};
 export interface NativeMcpClient extends SupportedCommand {
     connectClient: Exclude<AgentClient, "openclaw">;
     /** Omitted where the `skills` CLI has no agent for this harness (Grok ships its own plugin). */
-    skillAgent?: "claude-code" | "codex" | "hermes-agent" | "opencode";
+    skillAgent?: SkillAgent;
     /** Replaces `addArgs` when a stored key is available: key auth removes the OAuth hop. */
     keyAuth?: {
         /** Key reaches the client through TINYFISH_API_KEY, not argv. */

package/dist/lib/connect-clients.js

@@ -62,6 +62,8 @@ export const OPENCLAW_ONBOARDING_PROMPT = "I just installed the TinyFish skill.
     "want to search and wait for my reply before using TinyFish Search. Show me the results, ask " +
     "which result I want to read, and wait before using TinyFish Fetch. Then ask what browser task " +
     "I want to complete and wait before using TinyFish Agent. Never skip ahead or choose for me.";
+/** Cursor writes its own MCP config, so it has no descriptor to carry this. */
+export const CURSOR_SKILL_TARGET = { skillAgent: "cursor", displayName: "Cursor" };
 const HEADER_FLAG = /(?:^|\s)--header(?:[\s<=]|$)/m;
 const claudeAddArgs = (mcpUrl) => [
     "mcp",

package/dist/lib/connect-install.d.ts

@@ -1,4 +1,4 @@
-import { type NativeMcpClient } from "./connect-clients.js";
+import { type SkillAgent } from "./connect-clients.js";
 import { type AgentClient } from "./connect-runtime.js";
 export declare const SKILL_INSTALL_TIMEOUT_MS = 120000;
 export declare const TINYFISH_CLI_NOT_FOUND_MESSAGE = "TinyFish CLI installed but is not available on PATH. Open a new terminal and retry.";
@@ -8,7 +8,10 @@ export type InstallOptions = {
     verbose: boolean;
 };
 export declare function installTinyFishCli({ verbose }: InstallOptions): void;
-export declare function installWebSkill(client: NativeMcpClient): void;
+export declare function installWebSkill(client: {
+    skillAgent?: SkillAgent;
+    displayName: string;
+}): void;
 /**
  * Refresh the skill we installed, for the harnesses we installed it in.
  *

package/dist/lib/connect-install.js

@@ -1,7 +1,7 @@
 import * as path from "node:path";
 import spawn from "cross-spawn";
 import { loadConfig, persistApiKeyToEnvironment, validateKeyFormat, writeConfig } from "./auth.js";
-import { NATIVE_MCP_CLIENTS, OPENCLAW_SKILL_INSTALL_ARGS, } from "./connect-clients.js";
+import { CURSOR_SKILL_TARGET, NATIVE_MCP_CLIENTS, OPENCLAW_SKILL_INSTALL_ARGS, } from "./connect-clients.js";
 import { commandNotFound, ConnectStepError, spawnStepError, throwIfInterrupted, NON_INTERACTIVE_TIMEOUT_MS, } from "./connect-runtime.js";
 import { TINYFISH_CLI_PACKAGE } from "./constants.js";
 import { installRoot } from "./install-root.js";
@@ -112,13 +112,14 @@ export function installWebSkill(client) {
 export function updateWebSkill({ verbose }) {
     // One entry per `tinyfish connect <client>`, persisted by PF-3169.
     const connected = loadConfig().connect ?? {};
-    const skillAgents = NATIVE_MCP_CLIENTS
-        .filter((client) => connected[client.connectClient])
-        .map((client) => client.skillAgent)
-        .filter((agent) => agent !== undefined);
+    const skillAgents = [
+        ...NATIVE_MCP_CLIENTS.filter((client) => connected[client.connectClient]).map((client) => client.skillAgent),
+        // Cursor is not a NativeMcpClient — it writes its own MCP config.
+        ...(connected["cursor"] ? [CURSOR_SKILL_TARGET.skillAgent] : []),
+    ].filter((agent) => agent !== undefined);
     const hasOpenClaw = Boolean(connected["openclaw"]);
     // Installs predating PF-3169 recorded nothing; ask `skills` to refresh what it tracks. A
-    // skill-less recorded install (Grok, Cursor) may still have one from before, so refresh anyway
+    // skill-less recorded install (Grok) may still have one from before, so refresh anyway
     // — but there having been none is then expected, not an upgrade failure.
     if (skillAgents.length === 0 && !hasOpenClaw) {
         return refreshWebSkillByHash(verbose, Object.keys(connected).length > 0);

package/dist/lib/cursor-config.d.ts

@@ -14,10 +14,10 @@ export interface CursorTinyfishEntry {
     hasApiKeyHeader: boolean;
     /** Registered endpoint, so a caller can tell "registered" from "registered at the right place". */
     url?: string;
-    apiKey?: string;
+    keyMatchesCliKey?: boolean;
     error?: string;
 }
-/** Carries the header value; callers keep it off the report. */
+/** Reports the header's shape, never its value. */
 export declare function readCursorTinyfishEntry(): CursorTinyfishEntry;
 /** Merges only the `tinyfish` key; skips unreadable/corrupt files rather than clobber. */
 export declare function writeCursorMcpConfig(mcpUrl: string, apiKey?: string): CursorMcpWriteResult;

package/dist/lib/cursor-config.js

@@ -1,6 +1,7 @@
 import * as fs from "fs";
 import * as os from "os";
 import * as path from "path";
+import { matchesCliKey } from "./auth.js";
 // The one config file the CLI writes directly — hence backup/merge rigor.
 const TINYFISH_SERVER_KEY = "tinyfish";
 export function cursorConfigDir() {
@@ -65,7 +66,7 @@ export function planCursorWrite(mcpUrl, apiKey) {
         ? `${filePath}: would create with a "tinyfish" MCP server entry${authNote}`
         : `${filePath}: would back up to a timestamped copy, then merge in the "tinyfish" MCP server entry${authNote}`;
 }
-/** Carries the header value; callers keep it off the report. */
+/** Reports the header's shape, never its value. */
 export function readCursorTinyfishEntry() {
     const existing = readExisting();
     if ("error" in existing)
@@ -78,12 +79,12 @@ export function readCursorTinyfishEntry() {
     // Header names are case-insensitive, and this file is hand-editable — matching only the
     // casing we write would understate auth mode for a user who typed it differently.
     const keyHeader = isPlainRecord(headers)
-        ? Object.entries(headers).find(([name, value]) => name.toLowerCase() === "x-api-key" && typeof value === "string")
+        ? Object.entries(headers).find((entry) => entry[0].toLowerCase() === "x-api-key" && typeof entry[1] === "string")
         : undefined;
     return {
         present: true,
         hasApiKeyHeader: keyHeader !== undefined,
-        ...(keyHeader ? { apiKey: keyHeader[1] } : {}),
+        ...(matchesCliKey(keyHeader?.[1]) ? { keyMatchesCliKey: true } : {}),
         ...(typeof entry.url === "string" ? { url: entry.url } : {}),
     };
 }

package/dist/lib/doctor-report.d.ts

@@ -25,6 +25,7 @@ declare const doctorCheckSchema: z.ZodObject<{
     detail: z.ZodString;
     harness: z.ZodNullable<z.ZodEnum<{
         openclaw: "openclaw";
+        grok: "grok";
         cursor: "cursor";
         codex: "codex";
         hermes: "hermes";
@@ -40,6 +41,7 @@ declare const doctorCheckSchema: z.ZodObject<{
 declare const doctorHarnessSchema: z.ZodObject<{
     harness: z.ZodEnum<{
         openclaw: "openclaw";
+        grok: "grok";
         cursor: "cursor";
         codex: "codex";
         hermes: "hermes";
@@ -59,6 +61,7 @@ declare const doctorRepairSchema: z.ZodObject<{
     }>;
     harness: z.ZodNullable<z.ZodEnum<{
         openclaw: "openclaw";
+        grok: "grok";
         cursor: "cursor";
         codex: "codex";
         hermes: "hermes";
@@ -85,6 +88,7 @@ export declare const doctorReportSchema: z.ZodObject<{
         detail: z.ZodString;
         harness: z.ZodNullable<z.ZodEnum<{
             openclaw: "openclaw";
+            grok: "grok";
             cursor: "cursor";
             codex: "codex";
             hermes: "hermes";
@@ -100,6 +104,7 @@ export declare const doctorReportSchema: z.ZodObject<{
     harnesses: z.ZodArray<z.ZodObject<{
         harness: z.ZodEnum<{
             openclaw: "openclaw";
+            grok: "grok";
             cursor: "cursor";
             codex: "codex";
             hermes: "hermes";
@@ -119,6 +124,7 @@ export declare const doctorReportSchema: z.ZodObject<{
         }>;
         harness: z.ZodNullable<z.ZodEnum<{
             openclaw: "openclaw";
+            grok: "grok";
             cursor: "cursor";
             codex: "codex";
             hermes: "hermes";

package/dist/lib/harness-detect.d.ts

@@ -1,4 +1,4 @@
-export declare const ALL_HARNESSES: readonly ["claude-code", "codex", "cursor", "hermes", "openclaw", "opencode"];
+export declare const ALL_HARNESSES: readonly ["claude-code", "codex", "cursor", "grok", "hermes", "openclaw", "opencode"];
 export type Harness = (typeof ALL_HARNESSES)[number];
 export declare enum Registered {
     Yes = "yes",

package/dist/lib/harness-detect.js

@@ -5,6 +5,7 @@ export const ALL_HARNESSES = [
     "claude-code",
     "codex",
     "cursor",
+    "grok",
     "hermes",
     "openclaw",
     "opencode",
@@ -27,6 +28,7 @@ const CONFIG_DIRS = {
     "claude-code": ".claude",
     codex: ".codex",
     cursor: ".cursor",
+    grok: ".grok",
     hermes: ".hermes",
     openclaw: ".openclaw",
     opencode: ".config/opencode",

package/dist/lib/registration-detect.d.ts

@@ -7,10 +7,8 @@ export interface RegistrationStatus {
     connectedBefore: boolean;
     /** The endpoint the harness is actually pointed at, when the probe exposes it. */
     registeredUrl?: string;
-    /** For doctor to verify; never for the report. */
-    apiKey?: string;
-    /** From the environment, not the config, so a 401 is ambiguous. */
-    keyIsIndirect?: boolean;
+    /** Its key is a copy of the CLI's, so the CLI's own verification covers it. */
+    keyMatchesCliKey?: boolean;
     /** Holds no key; reads the CLI's at runtime. */
     usesCliKey?: boolean;
     connected?: boolean;

package/dist/lib/registration-detect.js

@@ -2,7 +2,7 @@ import * as fs from "fs";
 import * as path from "path";
 import spawn from "cross-spawn";
 import { z } from "zod";
-import { hasKeyPrefix, loadConfig } from "./auth.js";
+import { loadConfig, matchesCliKey } from "./auth.js";
 import { errLine } from "./output.js";
 import { readCursorTinyfishEntry } from "./cursor-config.js";
 import { detectInstalledHarnesses, harnessConfigPath, harnessDisplayPath, AuthMode, Registered, } from "./harness-detect.js";
@@ -26,10 +26,6 @@ const NO_SUCH_SERVER = /no (?:mcp )?server named/i;
 const API_KEY_HEADER = /x-api-key/i;
 // `claude mcp get` prints the value; `mcp add` masks it.
 const API_KEY_HEADER_VALUE = /^\s*X-API-Key:\s*(\S+)\s*$/im;
-// Charset is the redaction guard: `***`, `[REDACTED]`, dotted masks.
-function extractableKey(value) {
-    return value && hasKeyPrefix(value) && /^[A-Za-z0-9_-]+$/.test(value) ? value : undefined;
-}
 // OpenCode colours its list even through a pipe, putting `\x1b[34m` between the line start and
 // the server name, so an unstripped probe reads a registered harness as absent.
 // eslint-disable-next-line no-control-regex
@@ -119,23 +115,23 @@ function tinyfishServerName(output) {
         .map((name) => name.trim())
         .find((name) => SERVER_NAMED_TINYFISH.test(name));
 }
-function parseMcpGet(output, keyAuthPattern) {
+function parseMcpGet(output) {
     // Positive evidence only: whether `mcp get` echoes headers at all is unverified, so absence
     // of the pattern is `unknown`, never proof of OAuth.
     const url = /^\s*URL:\s*(\S+)/m.exec(output)?.[1];
-    const key = extractableKey(API_KEY_HEADER_VALUE.exec(output)?.[1]);
+    const keyMatchesCliKey = matchesCliKey(API_KEY_HEADER_VALUE.exec(output)?.[1]);
     const status = MCP_GET_STATUS.exec(output)?.[1];
     const connected = status === undefined ? undefined : connectionState(status);
     return {
         registered: Registered.Yes,
-        authMode: keyAuthPattern.test(output) ? AuthMode.ApiKey : AuthMode.Unknown,
+        authMode: API_KEY_HEADER.test(output) ? AuthMode.ApiKey : AuthMode.Unknown,
         ...(url ? { registeredUrl: url } : {}),
-        ...(key ? { apiKey: key } : {}),
+        ...(keyMatchesCliKey ? { keyMatchesCliKey } : {}),
         ...(connected === undefined ? {} : { connected }),
     };
 }
 // claude-code only. Codex cannot use this: its `mcp get` exits 0 on a missing server.
-function fromMcpGet(command, keyAuthPattern) {
+function fromMcpGet(command) {
     const probe = runProbe(command, ["mcp", "get", "tinyfish"]);
     if (probe.outcome === "unavailable") {
         return { registered: Registered.Unknown, authMode: AuthMode.Unknown, reason: probe.reason };
@@ -154,7 +150,7 @@ function fromMcpGet(command, keyAuthPattern) {
             const rescoped = runProbe(command, ["mcp", "get", scoped]);
             if (rescoped.outcome === "ran" && rescoped.exitCode === 0) {
                 return {
-                    ...parseMcpGet(rescoped.output, keyAuthPattern),
+                    ...parseMcpGet(rescoped.output),
                     reason: `registered as ${scoped}`,
                 };
             }
@@ -173,7 +169,7 @@ function fromMcpGet(command, keyAuthPattern) {
         }
         return { registered: Registered.No, authMode: AuthMode.Unknown };
     }
-    return parseMcpGet(probe.output, keyAuthPattern);
+    return parseMcpGet(probe.output);
 }
 // `codex mcp get <missing>` prints an error and exits 0, so presence must never be read from
 // its exit code; `mcp list --json` is the only trustworthy read-back.
@@ -217,17 +213,16 @@ export function codexOauthCompleted() {
 }
 // This reaches the pasted report, so its shape is checked first.
 const ENV_VAR_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
-/** Codex stores a variable name, not a value, so resolve it. */
+/** Codex stores a variable name; resolving it only answers whether it is the CLI's key. */
 function codexEnvKey(envVar) {
     if (!ENV_VAR_NAME.test(envVar)) {
         return { keyReason: "its key comes from an unusable variable name" };
     }
-    const key = extractableKey(process.env[envVar]);
-    if (key)
-        return { apiKey: key, keyIsIndirect: true };
+    if (matchesCliKey(process.env[envVar]))
+        return { keyMatchesCliKey: true };
     return {
         keyReason: process.env[envVar]
-            ? `$${envVar} does not hold a TinyFish key here`
+            ? `$${envVar} holds a key this CLI cannot verify`
             : `$${envVar} is not set here`,
     };
 }
@@ -264,12 +259,11 @@ function probeCursor() {
     }
     if (!entry.present)
         return { registered: Registered.No, authMode: AuthMode.Unknown };
-    const key = extractableKey(entry.apiKey);
     return {
         registered: Registered.Yes,
         authMode: entry.hasApiKeyHeader ? AuthMode.ApiKey : AuthMode.Unknown,
         ...(entry.url ? { registeredUrl: entry.url } : {}),
-        ...(key ? { apiKey: key } : {}),
+        ...(entry.keyMatchesCliKey ? { keyMatchesCliKey: true } : {}),
     };
 }
 // Both list commands print this header in every state, including "no servers configured".
@@ -342,10 +336,60 @@ function probeOpencode() {
     }
     return fromMcpList("opencode", probe.output, AuthMode.Unknown, OPENCODE_ROW_URL);
 }
+// Verified against grok 0.0.60: a list. Header values stay `unknown`; only names are read.
+const grokEntrySchema = z.looseObject({
+    name: z.string().optional(),
+    url: z.string().optional(),
+    headers: z.record(z.string(), z.unknown()).optional(),
+});
+const grokListSchema = z.array(grokEntrySchema);
+// Grok has no `mcp get`; `mcp list --json` is the only machine-readable view.
+function probeGrok() {
+    const probe = runProbe("grok", ["mcp", "list", "--json"]);
+    if (probe.outcome === "unavailable") {
+        return { registered: Registered.Unknown, authMode: AuthMode.Unknown, reason: probe.reason };
+    }
+    if (probe.exitCode !== 0) {
+        if (UNSUPPORTED_SUBCOMMAND.test(probe.output)) {
+            return {
+                registered: Registered.Unknown,
+                authMode: AuthMode.Unknown,
+                reason: "this Grok build has no `mcp list --json`",
+            };
+        }
+        return {
+            registered: Registered.Unknown,
+            authMode: AuthMode.Unknown,
+            reason: `\`grok mcp list --json\` exited ${probe.exitCode}`,
+        };
+    }
+    let entries;
+    try {
+        entries = grokListSchema.parse(JSON.parse(probe.stdout));
+    }
+    catch {
+        return {
+            registered: Registered.Unknown,
+            authMode: AuthMode.Unknown,
+            reason: "`grok mcp list --json` did not return the expected shape",
+        };
+    }
+    const entry = entries.find((server) => server.name === "tinyfish");
+    if (!entry)
+        return { registered: Registered.No, authMode: AuthMode.Unknown };
+    // Grok drops X-API-Key when the server advertises OAuth metadata, so keys ride Authorization.
+    const hasAuthorization = Object.keys(entry.headers ?? {}).some((name) => name.toLowerCase() === "authorization");
+    return {
+        registered: Registered.Yes,
+        authMode: hasAuthorization ? AuthMode.ApiKey : AuthMode.OAuth,
+        ...(entry.url ? { registeredUrl: entry.url } : {}),
+    };
+}
 const PROBES = {
-    "claude-code": () => fromMcpGet("claude", API_KEY_HEADER),
+    "claude-code": () => fromMcpGet("claude"),
     codex: probeCodex,
     cursor: probeCursor,
+    grok: probeGrok,
     hermes: probeHermes,
     openclaw: probeOpenClaw,
     opencode: probeOpencode,

package/dist/lib/setup-telemetry.d.ts

@@ -25,6 +25,7 @@ export declare function postConnectEvent(options: {
 declare const harnessResultSchema: z.ZodObject<{
     harness: z.ZodEnum<{
         openclaw: "openclaw";
+        grok: "grok";
         cursor: "cursor";
         codex: "codex";
         hermes: "hermes";
@@ -43,6 +44,7 @@ export declare const setupCompletedPayloadSchema: z.ZodObject<{
     harnesses: z.ZodArray<z.ZodObject<{
         harness: z.ZodEnum<{
             openclaw: "openclaw";
+            grok: "grok";
             cursor: "cursor";
             codex: "codex";
             hermes: "hermes";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiny-fish/cli",
-  "version": "0.23.1-next.204",
+  "version": "0.23.1-next.206",
   "description": "TinyFish CLI — run web automations from your terminal",
   "type": "module",
   "bin": {