@tiny-fish/cli 0.27.1-next.228 → 0.28.1-next.233

package/dist/commands/auth.js

@@ -2,6 +2,7 @@ import { spawn } from "child_process";
 import * as readline from "readline";
 import { Option } from "commander";
 import { CONNECT_ATTEMPT_ENV, clearConfig, getDashboardUrl, loadConfig, maskKey, savePendingConnectAttempt, saveConfig, validateKeyFormat, } from "../lib/auth.js";
+import { TINYFISH_API_KEY_VAR } from "../lib/constants.js";
 import { err, errLine, out, outLine } from "../lib/output.js";
 /**
  * Read a key from stdin without echoing it to the terminal.
@@ -143,7 +144,7 @@ export function registerAuth(program) {
         .description("Show which API key is active and its source")
         .option("--pretty", "Human-readable output")
         .action((opts) => {
-        const envKey = process.env.TINYFISH_API_KEY;
+        const envKey = process.env[TINYFISH_API_KEY_VAR];
         if (envKey) {
             const authenticated = validateKeyFormat(envKey);
             const result = { source: "env", key_preview: maskKey(envKey), authenticated };

package/dist/commands/connect.js

@@ -9,7 +9,9 @@ import { cursorInstallDeeplink, cursorMcpPath, readCursorTinyfishEntry, writeCur
 import { runConnectAll } from "../lib/connect-all.js";
 import { AuthMode } from "../lib/harness-detect.js";
 import { detectHumanInitiated } from "../lib/harness.js";
+import { TINYFISH_API_KEY_VAR } from "../lib/constants.js";
 import { emitNotice } from "../lib/notice.js";
+import { SIGN_IN_PROBES } from "../lib/registration-detect.js";
 import { errLine } from "../lib/output.js";
 import { z } from "zod";
 import { verifyMcpAuth } from "../lib/verify.js";
@@ -38,7 +40,7 @@ function exportApiKey(apiKey, displayName, deferOutro) {
             "signing in instead.");
         return false;
     }
-    process.env["TINYFISH_API_KEY"] = apiKey;
+    process.env[TINYFISH_API_KEY_VAR] = apiKey;
     if (deferOutro) {
         deferOutro("Exported TINYFISH_API_KEY to your shell profile — restart your agents (or open a new " +
             "terminal) before use.");
@@ -52,6 +54,7 @@ function exportApiKey(apiKey, displayName, deferOutro) {
 async function connectNativeMcpClient(client, options) {
     const telemetry = createConnectTelemetry(options.mcpUrl, client.connectClient, options);
     const state = { stage: "prerequisite_check", settled: false };
+    const probeAuthenticated = SIGN_IN_PROBES[client.connectClient];
     await runGuarded(state, telemetry, () => {
         telemetry.track("started");
         const { optionalSupported, keyAuthSupported, harnessVersion } = requireCommandSupport(client);
@@ -63,7 +66,7 @@ async function connectNativeMcpClient(client, options) {
             ? { key: storedKey, spec: client.keyAuth }
             : undefined;
         // Before the removals: a failed export must not strand the old registration.
-        if (keyedAdd?.spec.viaEnv &&
+        if (keyedAdd?.spec.envVar &&
             !exportApiKey(keyedAdd.key, client.displayName, options.deferOutro)) {
             keyedAdd = undefined;
         }
@@ -90,7 +93,7 @@ async function connectNativeMcpClient(client, options) {
         const loginArgs = loginDegraded ? undefined : client.loginArgs;
         // A probed client authenticates inside `mcp add` too, so a failure there is either.
         state.stage =
-            loginArgs && !client.probeAuthenticated ? "registration" : "registration_or_authentication";
+            loginArgs && !probeAuthenticated ? "registration" : "registration_or_authentication";
         errLine(`Adding TinyFish to ${client.displayName}...`);
         // Header keys ride argv (/proc/<pid>/cmdline); these CLIs take headers no other way.
         const addArgs = keyedAdd
@@ -109,7 +112,7 @@ async function connectNativeMcpClient(client, options) {
         telemetry.track("checkpoint", { phase: "registered" });
         // Codex runs OAuth inside `mcp add` and exits 0 either way, so the recorded state decides
         // whether the login step below still runs. Unknown keeps the pre-probe behaviour.
-        const addSignedIn = client.probeAuthenticated?.();
+        const addSignedIn = probeAuthenticated?.();
         if (addSignedIn)
             telemetry.track("checkpoint", { phase: "oauth_done" });
         const degradedNotes = loginDegraded ? client.degradedAuthNotes : undefined;
@@ -121,7 +124,7 @@ async function connectNativeMcpClient(client, options) {
             errLine(degradedNotes.deferred);
         }
         // A probed client signs in again only when its inline OAuth is known to have been abandoned.
-        const retryLogin = client.probeAuthenticated ? addSignedIn === false : true;
+        const retryLogin = probeAuthenticated ? addSignedIn === false : true;
         const pendingLogin = !useKeyAuth && retryLogin ? loginArgs : undefined;
         let signInDeferred = !useKeyAuth && !addSignedIn && !pendingLogin;
         if (pendingLogin) {
@@ -131,7 +134,7 @@ async function connectNativeMcpClient(client, options) {
             if (loginResult.error || loginResult.status !== 0) {
                 throw spawnStepError(`Could not authenticate TinyFish in ${client.displayName}`, loginResult);
             }
-            if (client.probeAuthenticated?.() === false)
+            if (probeAuthenticated?.() === false)
                 signInDeferred = true;
             else
                 telemetry.track("checkpoint", { phase: "oauth_done" });

package/dist/commands/onboard.js

@@ -1,7 +1,7 @@
 import * as readline from "readline/promises";
 import { getApiKey, saveConfig } from "../lib/auth.js";
 import { fetchContentGet, searchQuery } from "../lib/client.js";
-import { BASE_URL } from "../lib/constants.js";
+import { BASE_URL, TINYFISH_API_KEY_VAR } from "../lib/constants.js";
 import { errLine, handleApiError, outLine } from "../lib/output.js";
 import { connectClaudeCode, connectCodex, connectHermes, connectOpenClaw, connectOpencode, launchAgent, } from "./connect.js";
 const EXAMPLE_QUERIES = [
@@ -213,8 +213,8 @@ export function registerOnboard(program) {
         "Run `tinyfish connect <client> --launch` later to add one directly.")
         .action(async (query) => {
         const apiKey = getApiKey();
-        const persistEnvKey = Boolean(process.env["TINYFISH_API_KEY"]);
-        delete process.env["TINYFISH_API_KEY"];
+        const persistEnvKey = Boolean(process.env[TINYFISH_API_KEY_VAR]);
+        delete process.env[TINYFISH_API_KEY_VAR];
         try {
             const interactive = Boolean(process.stdin.isTTY && process.stderr.isTTY);
             const selectedQuery = await chooseQuery(query, interactive);

package/dist/lib/auth.js

@@ -3,6 +3,7 @@ import * as os from "os";
 import * as path from "path";
 import spawn from "cross-spawn";
 import { err, errLine } from "./output.js";
+import { TINYFISH_API_KEY_VAR } from "./constants.js";
 const KEY_PREFIXES = ["sk-tinyfish-", "sk-mino-"];
 const MIN_KEY_LENGTH = 20;
 export { DASHBOARD_URL, getDashboardUrl } from "./constants.js";
@@ -133,7 +134,7 @@ export function saveConnectContext(client, attemptId) {
 export function persistApiKeyToEnvironment(apiKey, options = {}) {
     const platform = options.platform ?? process.platform;
     if (platform === "win32") {
-        const result = spawn.sync("setx", ["TINYFISH_API_KEY", apiKey], { stdio: "ignore" });
+        const result = spawn.sync("setx", [TINYFISH_API_KEY_VAR, apiKey], { stdio: "ignore" });
         if (result.error || result.status !== 0) {
             throw new Error("Could not set TINYFISH_API_KEY in the Windows user environment", {
                 cause: result.error,
@@ -157,14 +158,14 @@ export function persistApiKeyToEnvironment(apiKey, options = {}) {
                 ? path.join(home, ".config", "fish", "config.fish")
                 : path.join(home, ".profile");
     const quotedKey = `'${apiKey.replaceAll("'", "'\\''")}'`;
-    const assignment = fish
-        ? `set -gx TINYFISH_API_KEY ${quotedKey}`
-        : `export TINYFISH_API_KEY=${quotedKey}`;
-    const matcher = fish
-        ? /^set -gx TINYFISH_API_KEY .*(?:\r?\n|$)/gm
-        : /^export TINYFISH_API_KEY=.*(?:\r?\n|$)/gm;
+    const prefix = fish ? `set -gx ${TINYFISH_API_KEY_VAR} ` : `export ${TINYFISH_API_KEY_VAR}=`;
+    const assignment = `${prefix}${quotedKey}`;
     const existing = fs.existsSync(profile) ? fs.readFileSync(profile, "utf8") : "";
-    const cleaned = existing.replace(matcher, "");
+    // Drops prior assignments, so repeated logins do not stack stale keys.
+    const cleaned = existing
+        .split("\n")
+        .filter((line) => !line.startsWith(prefix))
+        .join("\n");
     const updated = `${cleaned}${cleaned && !cleaned.endsWith("\n") ? "\n" : ""}${assignment}\n`;
     fs.mkdirSync(path.dirname(profile), { recursive: true });
     fs.writeFileSync(profile, updated, { mode: 0o600 });
@@ -208,7 +209,7 @@ export function maskKey(key) {
 function lookupApiKey(explicitApiKey) {
     if (explicitApiKey)
         return { value: explicitApiKey, source: "explicit" };
-    const envKey = process.env["TINYFISH_API_KEY"];
+    const envKey = process.env[TINYFISH_API_KEY_VAR];
     if (envKey)
         return { value: envKey, source: "env" };
     // No try/catch: loadConfig swallows its own errors and returns {}.

package/dist/lib/connect-all.js

@@ -2,6 +2,7 @@ import * as readline from "node:readline/promises";
 import spawn from "cross-spawn";
 import { connectClaudeCode, connectCodex, connectCursor, connectGrok, connectHermes, connectOpenClaw, connectOpencode, } from "../commands/connect.js";
 import { loadConfig, validatedApiKey } from "./auth.js";
+import { TINYFISH_API_KEY_VAR } from "./constants.js";
 import { installTinyFishCli, } from "./cli-install.js";
 import { NATIVE_MCP_CLIENTS } from "./connect-clients.js";
 import { ensureCliAuthenticated, TINYFISH_CLI_NOT_FOUND_MESSAGE } from "./connect-auth.js";
@@ -330,7 +331,7 @@ async function runCliFallback(opts, prompt) {
         outLine("Retry: npx @tiny-fish/cli connect --all");
         return 1;
     }
-    const apiKey = opts.apiKey ?? process.env["TINYFISH_API_KEY"];
+    const apiKey = opts.apiKey ?? process.env[TINYFISH_API_KEY_VAR];
     if (!prompt && !apiKey) {
         outLine("Retry in a terminal: npx @tiny-fish/cli connect --all");
         return 1;

package/dist/lib/connect-auth.js

@@ -1,10 +1,11 @@
 import spawn from "cross-spawn";
+import { TINYFISH_API_KEY_VAR } from "./constants.js";
 import { persistApiKeyToEnvironment, validateKeyFormat, writeConfig } from "./auth.js";
 import { commandNotFound, ConnectStepError, spawnStepError, throwIfInterrupted, NON_INTERACTIVE_TIMEOUT_MS, } from "./connect-runtime.js";
 import { errLine } from "./output.js";
 export const TINYFISH_CLI_NOT_FOUND_MESSAGE = "TinyFish CLI installed but is not available on PATH. Open a new terminal and retry.";
 export function ensureCliAuthenticated(source, apiKey) {
-    const envKey = apiKey ?? process.env["TINYFISH_API_KEY"];
+    const envKey = apiKey ?? process.env[TINYFISH_API_KEY_VAR];
     if (envKey) {
         if (!validateKeyFormat(envKey)) {
             throw new ConnectStepError("TINYFISH_API_KEY has invalid format", "invalid_config");

package/dist/lib/connect-clients.d.ts

@@ -18,8 +18,8 @@ export interface NativeMcpClient extends SupportedCommand {
     nonInteractiveAdd?: true;
     /** Replaces `addArgs` when a stored key is available: key auth removes the OAuth hop. */
     keyAuth?: {
-        /** Key reaches the client through TINYFISH_API_KEY, not argv. */
-        viaEnv?: boolean;
+        /** Which variable the client reads the key from. */
+        envVar?: string;
         addArgs: (mcpUrl: string, apiKey: string) => string[];
     };
     /** Shown when a keyless install leaves sign-in to the harness. */
@@ -30,8 +30,6 @@ export interface NativeMcpClient extends SupportedCommand {
         keyed: string;
         deferred: string;
     };
-    /** Did the OAuth inside `mcp add` finish? undefined when the client cannot say. */
-    probeAuthenticated?: () => boolean | undefined;
     removals: {
         args: string[];
         label: string;

package/dist/lib/connect-clients.js

@@ -1,7 +1,7 @@
 import spawn from "cross-spawn";
 import { errLine, sanitizeLine } from "./output.js";
 import { spawnStepError, } from "./connect-runtime.js";
-import { codexOauthCompleted } from "./registration-detect.js";
+import { TINYFISH_API_KEY_VAR } from "./constants.js";
 const HERMES_SEED_TIMEOUT_MS = 120_000;
 // An old install is only one reason a flag can go unseen, so no message asserts the cause.
 const SUPPORT_CHECK_DEBUG_HINT = " Set TINYFISH_DEBUG=1 and retry to print the help output TinyFish read.";
@@ -151,11 +151,10 @@ export const CODEX = {
     // Codex has no `--header`; the MCP server takes a key as `Bearer sk-…`.
     // Omitting `--oauth-resource` is what keeps `mcp add` from running OAuth.
     keyAuth: {
-        viaEnv: true,
-        addArgs: (mcpUrl) => [...urlAddArgs(mcpUrl), "--bearer-token-env-var", "TINYFISH_API_KEY"],
+        envVar: TINYFISH_API_KEY_VAR,
+        addArgs: (mcpUrl) => [...urlAddArgs(mcpUrl), "--bearer-token-env-var", TINYFISH_API_KEY_VAR],
     },
     launchWalkthrough: launchCodexWalkthrough,
-    probeAuthenticated: codexOauthCompleted,
     // Retry only: running it after a finished inline OAuth is a second browser hop.
     loginArgs: ["mcp", "login", "tinyfish"],
     removals: [{ args: ["mcp", "remove", "tinyfish"], label: "TinyFish registration from Codex" }],
@@ -183,11 +182,11 @@ export const GROK = {
     // X-API-Key is dropped whenever the server advertises OAuth metadata; Bearer is not.
     // Grok expands `${VAR}` in headers at load, so the key stays out of argv and config.toml.
     keyAuth: {
-        viaEnv: true,
+        envVar: TINYFISH_API_KEY_VAR,
         addArgs: (mcpUrl) => [
             ...grokAddArgs(mcpUrl),
             "--header",
-            "Authorization: Bearer ${TINYFISH_API_KEY}",
+            `Authorization: Bearer \${${TINYFISH_API_KEY_VAR}}`,
         ],
     },
     signInHint: GROK_SIGN_IN_HINT,

package/dist/lib/connect-runtime.js

@@ -2,7 +2,7 @@ import { randomUUID } from "node:crypto";
 import spawn from "cross-spawn";
 import { CONNECT_ATTEMPT_ENV, isAttemptId, resolvedApiKey, takePendingConnectAttempt, } from "./auth.js";
 import { CLI_VERSION } from "./constants.js";
-import { detectHumanInitiated } from "./harness.js";
+import { detectHarness, detectHumanInitiated } from "./harness.js";
 import { errLine, sanitizeLine } from "./output.js";
 import { postConnectEvent, telemetryDisabled } from "./setup-telemetry.js";
 import { installSignalGuard } from "./signals.js";
@@ -241,6 +241,8 @@ export function createConnectTelemetry(mcpUrl, client, opts) {
                 cli_version: CLI_VERSION,
                 // Same signal the usage events carry, so TTY and headless connects can be split.
                 is_human_initiated: detectHumanInitiated(),
+                // "none", not absent — absent has to keep meaning "CLI too old".
+                calling_harness: detectHarness() ?? "none",
             })).catch((error) => {
                 // postConnectEvent is total, so this only fires if something inside deliver starts
                 // throwing. Same channel postConnectEvent uses for its own failures.

package/dist/lib/constants.d.ts

@@ -2,6 +2,8 @@ export declare const CLI_VERSION: string;
 /** Unversioned: the install site appends `@latest`, the version read must not. */
 export declare const TINYFISH_CLI_PACKAGE = "@tiny-fish/cli";
 export declare const CLI_AGENT_IDENTITY = "tinyfish-cli";
+/** The descriptor hands this name to harnesses; the probes resolve it. */
+export declare const TINYFISH_API_KEY_VAR = "TINYFISH_API_KEY";
 export declare const BASE_URL: string;
 export declare const API_URL_OVERRIDE: string | undefined;
 /** URL where users can create and manage API keys */

package/dist/lib/constants.js

@@ -6,6 +6,8 @@ export const CLI_VERSION = _pkg.version;
 export const TINYFISH_CLI_PACKAGE = "@tiny-fish/cli";
 // How we identify ourselves to other tools; `skills` echoes it back.
 export const CLI_AGENT_IDENTITY = "tinyfish-cli";
+/** The descriptor hands this name to harnesses; the probes resolve it. */
+export const TINYFISH_API_KEY_VAR = "TINYFISH_API_KEY";
 /** Base URL for the TinyFish API. Override with TINYFISH_API_URL for staging/self-hosted. */
 const apiUrlOverride = process.env["TINYFISH_API_URL"]?.trim() || undefined;
 if (apiUrlOverride) {

package/dist/lib/harness.js

@@ -8,6 +8,8 @@
 // one. OpenClaw drives Claude Code via `sdk-cli`, so its env carries both
 // CLAUDECODE=1 and OPENCLAW_MCP_*; it must be checked before claude-code.
 const hasVarWithPrefix = (env, prefix) => Object.keys(env).some((key) => key.startsWith(prefix));
+// A new name here must also join KNOWN_CALLING_HARNESSES in
+// frontend/app/api/cli/connect-event/route.ts, or connect telemetry buckets it as `other`.
 // First match wins. Base agents (claude-code) go last so embedding wrappers win.
 const HARNESS_FINGERPRINTS = [
     { name: "openclaw", matches: (env) => hasVarWithPrefix(env, "OPENCLAW_MCP_") },

package/dist/lib/registration-detect.d.ts

@@ -1,3 +1,4 @@
+import type { AgentClient } from "./connect-runtime.js";
 import { AuthMode, type Harness, Registered } from "./harness-detect.js";
 export interface RegistrationStatus {
     harness: Harness;
@@ -17,5 +18,7 @@ export interface RegistrationStatus {
     reason?: string;
 }
 export declare function codexOauthCompleted(): boolean | undefined;
+/** Per-harness sign-in probes; connect composes these rather than the descriptor carrying them. */
+export declare const SIGN_IN_PROBES: Partial<Record<AgentClient, () => boolean | undefined>>;
 /** Never throws; a failed probe is `unknown` with a reason, so no caller can read it as healthy. */
 export declare function detectRegistrations(harnesses?: Harness[]): RegistrationStatus[];

package/dist/lib/registration-detect.js

@@ -3,6 +3,7 @@ import * as path from "path";
 import spawn from "cross-spawn";
 import { z } from "zod";
 import { loadConfig, matchesCliKey } from "./auth.js";
+import { NATIVE_MCP_CLIENTS } from "./connect-clients.js";
 import { errLine } from "./output.js";
 import { readCursorTinyfishEntry } from "./cursor-config.js";
 import { detectInstalledHarnesses, harnessConfigPath, harnessDisplayPath, AuthMode, Registered, } from "./harness-detect.js";
@@ -70,6 +71,14 @@ function runProbe(command, args) {
         output: `${stdout}${(result.stderr ?? "").replace(ANSI_SGR, "")}`,
     };
 }
+/** Undefined when the probe ran and exited zero. */
+function probeReason(command, args, probe) {
+    if (probe.outcome === "unavailable")
+        return probe.reason;
+    if (probe.exitCode === 0)
+        return undefined;
+    return `\`${command} ${args.join(" ")}\` exited ${probe.exitCode}`;
+}
 // A plugin registers its server as `plugin:<plugin>:<server>`, which `mcp get tinyfish` misses.
 // The optional prefix must end in `:`, so `not-tinyfish` is not a match.
 const MCP_LIST_TINYFISH_LINE = /^((?:\S*:)?tinyfish):\s+(https?:\S+)(.*)$/m;
@@ -174,14 +183,15 @@ function fromMcpGet(command) {
 // `codex mcp get <missing>` prints an error and exits 0, so presence must never be read from
 // its exit code; `mcp list --json` is the only trustworthy read-back.
 function readCodexEntry() {
-    const probe = runProbe("codex", ["mcp", "list", "--json"]);
+    const args = ["mcp", "list", "--json"];
+    const probe = runProbe("codex", args);
     if (probe.outcome === "unavailable")
         return { reason: probe.reason };
     // Presence is never inferred from exit code 0, but a nonzero exit means the output cannot
     // be trusted either — that is `unknown`, not "no server".
-    if (probe.exitCode !== 0) {
-        return { reason: `\`codex mcp list --json\` exited ${probe.exitCode}` };
-    }
+    const failure = probeReason("codex", args, probe);
+    if (failure)
+        return { reason: failure };
     let servers;
     try {
         // stdout only: an update banner on stderr would otherwise break the parse and report a
@@ -211,10 +221,19 @@ export function codexOauthCompleted() {
         return false;
     return undefined;
 }
+/** Per-harness sign-in probes; connect composes these rather than the descriptor carrying them. */
+export const SIGN_IN_PROBES = {
+    codex: codexOauthCompleted,
+};
 // This reaches the pasted report, so its shape is checked first.
 const ENV_VAR_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const NATIVE_BY_HARNESS = new Map(NATIVE_MCP_CLIENTS.map((client) => [client.connectClient, client]));
+/** Undefined unless the descriptor routes this harness's key through a variable. */
+function declaredKeyEnvVar(harness) {
+    return NATIVE_BY_HARNESS.get(harness)?.keyAuth?.envVar;
+}
 /** Codex stores a variable name; resolving it only answers whether it is the CLI's key. */
-function codexEnvKey(envVar) {
+function envKeyVerdict(envVar) {
     if (!ENV_VAR_NAME.test(envVar)) {
         return { keyReason: "its key comes from an unusable variable name" };
     }
@@ -245,7 +264,7 @@ function probeCodex() {
                 ? AuthMode.ApiKey
                 : AuthMode.Unknown,
         ...(codexUrl ? { registeredUrl: codexUrl } : {}),
-        ...(envVar ? codexEnvKey(envVar) : {}),
+        ...(envVar ? envKeyVerdict(envVar) : {}),
     };
 }
 function probeCursor() {
@@ -288,16 +307,11 @@ function fromMcpList(command, output, registeredMode, urlPattern) {
 }
 // connect only ever writes an OAuth Hermes entry, so `oauth` is a fact, not a detection gap.
 function probeHermes() {
-    const probe = runProbe("hermes", ["mcp", "list"]);
-    if (probe.outcome === "unavailable") {
-        return { registered: Registered.Unknown, authMode: AuthMode.Unknown, reason: probe.reason };
-    }
-    if (probe.exitCode !== 0) {
-        return {
-            registered: Registered.Unknown,
-            authMode: AuthMode.Unknown,
-            reason: `\`hermes mcp list\` exited ${probe.exitCode}`,
-        };
+    const args = ["mcp", "list"];
+    const probe = runProbe("hermes", args);
+    if (probe.outcome !== "ran" || probe.exitCode !== 0) {
+        const reason = probeReason("hermes", args, probe);
+        return { registered: Registered.Unknown, authMode: AuthMode.Unknown, reason };
     }
     return fromMcpList("hermes", probe.output, AuthMode.OAuth);
 }
@@ -323,16 +337,11 @@ function probeOpenClaw() {
 }
 // `opencode mcp list` prints no headers, so a key-authed registration is indistinguishable.
 function probeOpencode() {
-    const probe = runProbe("opencode", ["mcp", "list"]);
-    if (probe.outcome === "unavailable") {
-        return { registered: Registered.Unknown, authMode: AuthMode.Unknown, reason: probe.reason };
-    }
-    if (probe.exitCode !== 0) {
-        return {
-            registered: Registered.Unknown,
-            authMode: AuthMode.Unknown,
-            reason: `\`opencode mcp list\` exited ${probe.exitCode}`,
-        };
+    const args = ["mcp", "list"];
+    const probe = runProbe("opencode", args);
+    if (probe.outcome !== "ran" || probe.exitCode !== 0) {
+        const reason = probeReason("opencode", args, probe);
+        return { registered: Registered.Unknown, authMode: AuthMode.Unknown, reason };
     }
     return fromMcpList("opencode", probe.output, AuthMode.Unknown, OPENCODE_ROW_URL);
 }
@@ -377,9 +386,27 @@ function fromGrokPlugin() {
         reason: "registered by the TinyFish Grok plugin",
     };
 }
+// Grok inherits our env, so a header we wrote round-trips to our own value.
+function grokWroteIt(value, declared) {
+    const ours = process.env[declared];
+    return ours ? value === `Bearer ${ours}` : value === `Bearer \${${declared}}`;
+}
+/** The descriptor names the variable; envKeyVerdict owns every wording for it. */
+function grokKeyAuth(headers) {
+    const authorization = Object.entries(headers).find(([name]) => name.toLowerCase() === "authorization");
+    if (!authorization)
+        return { authMode: AuthMode.OAuth };
+    const declared = declaredKeyEnvVar("grok");
+    const value = typeof authorization[1] === "string" ? authorization[1] : "";
+    if (!declared || !grokWroteIt(value, declared)) {
+        return { authMode: AuthMode.ApiKey, keyReason: "it holds a key this CLI cannot verify" };
+    }
+    return { authMode: AuthMode.ApiKey, ...envKeyVerdict(declared) };
+}
 // Grok has no `mcp get`; `mcp list --json` is the only machine-readable view.
 function probeGrok() {
-    const probe = runProbe("grok", ["mcp", "list", "--json"]);
+    const args = ["mcp", "list", "--json"];
+    const probe = runProbe("grok", args);
     if (probe.outcome === "unavailable") {
         return { registered: Registered.Unknown, authMode: AuthMode.Unknown, reason: probe.reason };
     }
@@ -394,7 +421,7 @@ function probeGrok() {
         return {
             registered: Registered.Unknown,
             authMode: AuthMode.Unknown,
-            reason: `\`grok mcp list --json\` exited ${probe.exitCode}`,
+            reason: probeReason("grok", args, probe),
         };
     }
     let entries;
@@ -411,11 +438,9 @@ function probeGrok() {
     const entry = entries.find((server) => server.name === "tinyfish");
     if (!entry)
         return fromGrokPlugin() ?? { registered: Registered.No, authMode: AuthMode.Unknown };
-    // Grok drops X-API-Key when the server advertises OAuth metadata, so keys ride Authorization.
-    const hasAuthorization = Object.keys(entry.headers ?? {}).some((name) => name.toLowerCase() === "authorization");
     return {
         registered: Registered.Yes,
-        authMode: hasAuthorization ? AuthMode.ApiKey : AuthMode.OAuth,
+        ...grokKeyAuth(entry.headers ?? {}),
         ...(entry.url ? { registeredUrl: entry.url } : {}),
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiny-fish/cli",
-  "version": "0.27.1-next.228",
+  "version": "0.28.1-next.233",
   "description": "TinyFish CLI — run web automations from your terminal",
   "type": "module",
   "bin": {