@tiny-fish/cli 0.28.1-next.233 → 0.28.2-next.236

package/README.md

@@ -24,9 +24,11 @@ them all, or use the arrow keys and space to narrow the set first; `q` cancels w
 anything. Terminals without raw-key support get a numbered prompt instead.
 
 Without a terminal (agents, CI), bare `connect` behaves exactly like `tinyfish connect --all`
-and says so on its first line: every detected harness that can authenticate headlessly (via
-`TINYFISH_API_KEY` or `--api-key`) is connected, the rest are skipped with a fix command.
-`tinyfish connect --all` itself is unchanged and skips the picker; `--dry-run`, `--uninstall`
+and says so on its first line: harnesses that can take your API key (via `TINYFISH_API_KEY` or
+`--api-key`) connect first, then the first harness that needs a browser sign-in opens your
+browser and waits up to 90 seconds for you to finish it. Any further sign-ins are reported as
+waiting on you, with the single-harness command that finishes each one.
+`tinyfish connect --all` itself skips the picker; `--dry-run`, `--uninstall`
 and `--skip-launch` still require it.
 
 ### Connect Claude Code

package/dist/commands/connect.d.ts

@@ -9,6 +9,8 @@ interface NativeConnectOptions {
     attemptId?: string;
     /** Headless: refuse rather than fall back to an unfinishable browser sign-in. */
     keyAuthOnly?: boolean;
+    /** Headless --all: bounds sign-in spawns and bars interactive CLI login. */
+    authTimeoutMs?: number;
     /** Internal only: false leaves the global npm tree untouched. */
     cliInstall?: boolean;
     /** Set by `--all`: the CLI install already ran once, upfront. */

package/dist/commands/connect.js

@@ -4,7 +4,7 @@ import { CLAUDE_CODE, CODEX, CURSOR_SKILL_TARGET, GROK, HERMES, OPENCLAW, OPENCL
 import { captureStdio, capturedOutput, HoistedFailureReportedError, installTinyFishCli, replay, } from "../lib/cli-install.js";
 import { ensureCliAuthenticated } from "../lib/connect-auth.js";
 import { installWebSkill } from "../lib/skill-install.js";
-import { ConnectInterruptedError, ConnectStepError, createConnectTelemetry, finishSetupCommand, requireCommandSupport, runGuarded, settle, spawnStepError, throwIfInterrupted, NON_INTERACTIVE_TIMEOUT_MS, } from "../lib/connect-runtime.js";
+import { ConnectInterruptedError, ConnectStepError, createConnectTelemetry, finishSetupCommand, requireCommandSupport, runGuarded, settle, SignInTimeoutError, spawnStepError, throwIfInterrupted, NON_INTERACTIVE_TIMEOUT_MS, } from "../lib/connect-runtime.js";
 import { cursorInstallDeeplink, cursorMcpPath, readCursorTinyfishEntry, writeCursorMcpConfig, } from "../lib/cursor-config.js";
 import { runConnectAll } from "../lib/connect-all.js";
 import { AuthMode } from "../lib/harness-detect.js";
@@ -51,6 +51,13 @@ function exportApiKey(apiKey, displayName, deferOutro) {
     }
     return true;
 }
+/** A bounded spawn's timeout means the sign-in never finished. */
+function signInStepError(message, result, bounded) {
+    const error = spawnStepError(message, result);
+    return bounded && error.failureReason === "timeout"
+        ? new SignInTimeoutError(error.message, error.cause)
+        : error;
+}
 async function connectNativeMcpClient(client, options) {
     const telemetry = createConnectTelemetry(options.mcpUrl, client.connectClient, options);
     const state = { stage: "prerequisite_check", settled: false };
@@ -100,12 +107,13 @@ async function connectNativeMcpClient(client, options) {
             ? keyedAdd.spec.addArgs(mcpUrl.toString(), keyedAdd.key)
             : client.addArgs(mcpUrl.toString(), options.mcpUrl);
         // Capturing an inline-OAuth add hides the sign-in URL and hangs.
-        const addResult = spawn.sync(client.command, addArgs, client.nonInteractiveAdd || keyedAdd
-            ? captureStdio(options.verbose ?? false)
-            : { stdio: "inherit" });
+        const interactiveAdd = !(client.nonInteractiveAdd || keyedAdd);
+        const addResult = spawn.sync(client.command, addArgs, interactiveAdd
+            ? { stdio: "inherit", timeout: options.authTimeoutMs }
+            : captureStdio(options.verbose ?? false));
         if (addResult.error || addResult.status !== 0) {
             // Built first: its interrupt check must run before any replay.
-            const error = spawnStepError(`Could not add TinyFish to ${client.displayName}`, addResult);
+            const error = signInStepError(`Could not add TinyFish to ${client.displayName}`, addResult, interactiveAdd && options.authTimeoutMs !== undefined);
             replay(capturedOutput(addResult));
             throw error;
         }
@@ -130,9 +138,12 @@ async function connectNativeMcpClient(client, options) {
         if (pendingLogin) {
             state.stage = "client_oauth";
             errLine("Signing in to TinyFish...");
-            const loginResult = spawn.sync(client.command, pendingLogin, { stdio: "inherit" });
+            const loginResult = spawn.sync(client.command, pendingLogin, {
+                stdio: "inherit",
+                timeout: options.authTimeoutMs,
+            });
             if (loginResult.error || loginResult.status !== 0) {
-                throw spawnStepError(`Could not authenticate TinyFish in ${client.displayName}`, loginResult);
+                throw signInStepError(`Could not authenticate TinyFish in ${client.displayName}`, loginResult, options.authTimeoutMs !== undefined);
             }
             if (probeAuthenticated?.() === false)
                 signInDeferred = true;
@@ -190,7 +201,10 @@ function runPostInstallSteps(client, options, state, telemetry, signInDeferred)
         // Before auth: a failed sign-in must not lose the harness record.
         saveConnectContext(client.connectClient, telemetry.attemptId);
         attempt("authentication", () => {
-            ensureCliAuthenticated(client.connectClient, options.apiKey);
+            // A set timeout means headless; never shell an interactive login.
+            ensureCliAuthenticated(client.connectClient, options.apiKey, {
+                interactiveLogin: options.authTimeoutMs === undefined,
+            });
             telemetry.track("checkpoint", { phase: "authenticated" });
         });
         if (client.postConnectNote)

package/dist/lib/connect-all.js

@@ -6,7 +6,7 @@ import { TINYFISH_API_KEY_VAR } from "./constants.js";
 import { installTinyFishCli, } from "./cli-install.js";
 import { NATIVE_MCP_CLIENTS } from "./connect-clients.js";
 import { ensureCliAuthenticated, TINYFISH_CLI_NOT_FOUND_MESSAGE } from "./connect-auth.js";
-import { commandNotFound, ConnectInterruptedError, ConnectStepError, finishSetupCommand, throwIfInterrupted, } from "./connect-runtime.js";
+import { commandNotFound, ConnectInterruptedError, ConnectStepError, SignInTimeoutError, finishSetupCommand, throwIfInterrupted, } from "./connect-runtime.js";
 import { pickHarnesses } from "./connect-picker.js";
 import { commandOnPath, detectInstalledHarnesses, HARNESS_COMMANDS, HARNESS_DISPLAY_NAMES as DISPLAY_NAMES, ALL_HARNESSES, } from "./harness-detect.js";
 import { detectHumanInitiated } from "./harness.js";
@@ -23,8 +23,21 @@ const TOO_OLD_REASONS = new Set([
     "harness_too_old",
     "harness_command_unsupported",
 ]);
+// These failures land before any browser could have opened.
+const NO_BROWSER_REASONS = new Set([
+    ...TOO_OLD_REASONS,
+    "harness_not_installed",
+    "command_not_found",
+]);
 const AUTH_CHECK_CAPABLE = new Set(["cursor", "openclaw"]);
 const STEP_INDENT = "  ";
+// Must undercut agent tool-call budgets (Claude Code Bash defaults to 120s).
+const OAUTH_SIGN_IN_TIMEOUT_MS = 90_000;
+// Derived: these block `connect` on a browser sign-in when keyless.
+const BROWSER_SIGN_IN = new Set(NATIVE_MCP_CLIENTS.filter((client) => client.loginArgs || client.oauthInAdd)
+    .map((client) => client.connectClient)
+    .filter((client) => ALL_HARNESSES.includes(client))
+    .map((client) => client));
 // Descriptor-derived so a harness that cannot carry a key is skipped, not failed, when headless.
 // Cursor and OpenClaw hold the key themselves rather than handing it to a harness `mcp add`.
 const KEY_AUTH_CAPABLE = new Set([
@@ -46,12 +59,13 @@ const UNINSTALL_POINTERS = {
     // OpenCode ships no `mcp remove`, so the only removal is editing the config it wrote.
     opencode: "remove the tinyfish entry from ~/.config/opencode/opencode.json",
 };
-async function runHarnessConnect(harness, opts, keyAuthOnly, hoistedCliInstall, onPostInstallFailed, deferOutro) {
+async function runHarnessConnect(harness, opts, keyAuthOnly, authTimeoutMs, hoistedCliInstall, onPostInstallFailed, deferOutro) {
     const base = {
         apiKey: opts.apiKey,
         mcpUrl: opts.mcpUrl,
         launch: false,
         keyAuthOnly,
+        authTimeoutMs,
         hoistedCliInstall,
         onPostInstallFailed,
         verbose: opts.verbose,
@@ -147,7 +161,7 @@ function uninstallHarness(harness, configPath) {
     }
     return { ...detection, outcome: "uninstalled" };
 }
-async function processHarness(detection, opts, prompt, hoistedCliInstall, deferOutro) {
+async function processHarness(detection, opts, prompt, oauthBudget, hoistedCliInstall, deferOutro) {
     const { harness, configPath, detected } = detection;
     const base = { harness, detected, configPath, installed: false };
     if (!detected)
@@ -168,13 +182,23 @@ async function processHarness(detection, opts, prompt, hoistedCliInstall, deferO
     const apiKey = validatedApiKey(opts.apiKey);
     // A key only leaves the own-OAuth set where the harness can actually carry one.
     const keyed = !!apiKey && KEY_AUTH_CAPABLE.has(harness);
+    const fixCommand = `tinyfish connect ${harness}`;
+    let headlessAuth = false;
+    let spentBrowserSlot = false;
     if (!isTTY && !keyed) {
-        return {
-            ...base,
-            outcome: "no_tty_auth_skip",
-            keyUnusable: !!apiKey,
-            fixCommand: `tinyfish connect ${harness}`,
-        };
+        // OpenClaw signs in through the CLI's own interactive login — unboundable.
+        if (harness === "openclaw")
+            return { ...base, outcome: "auth_pending", fixCommand };
+        if (BROWSER_SIGN_IN.has(harness)) {
+            // One browser sign-in per run; the rest wait for a re-run.
+            if (oauthBudget.spent)
+                return { ...base, outcome: "auth_pending", fixCommand };
+            oauthBudget.spent = true;
+            spentBrowserSlot = true;
+            errLine(`${DISPLAY_NAMES[harness]} needs a browser sign-in — finish it when your browser ` +
+                `opens; waiting up to ${OAUTH_SIGN_IN_TIMEOUT_MS / 1000} seconds.`);
+        }
+        headlessAuth = true;
     }
     if (isTTY && !keyed && prompt) {
         errLine(`step: waiting for browser sign-in to TinyFish for ${DISPLAY_NAMES[harness]}`);
@@ -191,12 +215,24 @@ async function processHarness(detection, opts, prompt, hoistedCliInstall, deferO
     let authMode;
     let postInstallFailed = false;
     try {
-        // Headless: an install too old for key auth must fail, not open a browser.
-        authMode = await runHarnessConnect(harness, opts, !isTTY, hoistedCliInstall, () => {
+        // A keyed install too old for key auth fails, no browser.
+        authMode = await runHarnessConnect(harness, opts, keyed && !isTTY, headlessAuth ? OAUTH_SIGN_IN_TIMEOUT_MS : undefined, hoistedCliInstall, () => {
             postInstallFailed = true;
         }, deferOutro);
     }
     catch (e) {
+        if (e instanceof SignInTimeoutError) {
+            return {
+                ...base,
+                outcome: "auth_pending",
+                errorMessage: "sign-in did not finish in time",
+                fixCommand,
+            };
+        }
+        // A pre-browser failure must not burn the run's only browser slot.
+        if (spentBrowserSlot && e instanceof ConnectStepError && NO_BROWSER_REASONS.has(e.failureReason)) {
+            oauthBudget.spent = false;
+        }
         // Both reasons carry the same "flag not listed" message; the upgrade nudge is in it.
         if (e instanceof ConnectStepError && TOO_OLD_REASONS.has(e.failureReason)) {
             return {
@@ -248,10 +284,12 @@ function summaryLine(result, uninstall) {
         return `… ${name} — ${result.fixCommand}`;
     }
     if (result.outcome === "no_tty_auth_skip") {
-        const why = result.keyUnusable
-            ? `${name} cannot take an API key and there is no terminal to sign in`
-            : "no stored credentials and no terminal to sign in";
-        return `… ${name} — skipped, ${why}. Fix: ${result.fixCommand}`;
+        return `… ${name} — skipped, no stored credentials and no terminal to sign in. Fix: ${result.fixCommand}`;
+    }
+    if (result.outcome === "auth_pending") {
+        return result.errorMessage
+            ? `… ${name} — ${result.errorMessage}. Finish it in a terminal: ${result.fixCommand}`
+            : `… ${name} — needs a browser sign-in. Run in a terminal: ${result.fixCommand}`;
     }
     if (result.outcome === "deselected") {
         return `… ${name} — skipped, not selected. Fix: ${result.fixCommand}`;
@@ -405,6 +443,11 @@ export async function runConnectAll(opts) {
         }
         : undefined;
     const detections = detectInstalledHarnesses();
+    const gateKey = validatedApiKey(opts.apiKey);
+    // Keyed installs first: working tools land before sign-ins can block.
+    if (gateKey) {
+        detections.sort((a, b) => Number(KEY_AUTH_CAPABLE.has(b.harness)) - Number(KEY_AUTH_CAPABLE.has(a.harness)));
+    }
     let deselected = new Set();
     let mode = "all";
     // Before willAttempt/cliNeeded: a cursor-only pick must not hoist the CLI.
@@ -422,9 +465,9 @@ export async function runConnectAll(opts) {
         const chosen = new Set(pick.selection);
         deselected = new Set(offerable.filter((d) => !chosen.has(d.harness)).map((d) => d.harness));
     }
-    const gateKey = validatedApiKey(opts.apiKey);
-    // Mirrors processHarness's skip gate: a skipped harness installs nothing today.
-    const willAttempt = (harness) => !deselected.has(harness) && (isTTY || (!!gateKey && KEY_AUTH_CAPABLE.has(harness)));
+    // Mirrors processHarness's gate: headless, only keyless OpenClaw skips outright.
+    const willAttempt = (harness) => !deselected.has(harness) &&
+        (isTTY || harness !== "openclaw" || (!!gateKey && KEY_AUTH_CAPABLE.has(harness)));
     // Machine-global, so once per invocation; cursor's connect never installs it.
     const cliNeeded = !opts.dryRun &&
         !opts.uninstall &&
@@ -448,6 +491,7 @@ export async function runConnectAll(opts) {
     // A Set dedupes: Codex and Grok defer the same export line.
     const outro = new Set();
     const results = [];
+    const oauthBudget = { spent: false };
     const stepTotal = detections.length - deselected.size;
     let step = 0;
     for (const detection of detections) {
@@ -466,7 +510,7 @@ export async function runConnectAll(opts) {
         let result;
         try {
             setErrIndent(STEP_INDENT);
-            result = await processHarness(detection, opts, prompt, takeHoistedCli, (line) => outro.add(line));
+            result = await processHarness(detection, opts, prompt, oauthBudget, takeHoistedCli, (line) => outro.add(line));
         }
         catch (e) {
             // Isolation: one harness throwing never stops the others.

package/dist/lib/connect-auth.d.ts

@@ -1,3 +1,5 @@
 import { type AgentClient } from "./connect-runtime.js";
 export declare const TINYFISH_CLI_NOT_FOUND_MESSAGE = "TinyFish CLI installed but is not available on PATH. Open a new terminal and retry.";
-export declare function ensureCliAuthenticated(source: AgentClient | "cli", apiKey?: string): void;
+export declare function ensureCliAuthenticated(source: AgentClient | "cli", apiKey?: string, opts?: {
+    interactiveLogin?: boolean;
+}): void;

package/dist/lib/connect-auth.js

@@ -4,7 +4,7 @@ import { persistApiKeyToEnvironment, validateKeyFormat, writeConfig } from "./au
 import { commandNotFound, ConnectStepError, spawnStepError, throwIfInterrupted, NON_INTERACTIVE_TIMEOUT_MS, } from "./connect-runtime.js";
 import { errLine } from "./output.js";
 export const TINYFISH_CLI_NOT_FOUND_MESSAGE = "TinyFish CLI installed but is not available on PATH. Open a new terminal and retry.";
-export function ensureCliAuthenticated(source, apiKey) {
+export function ensureCliAuthenticated(source, apiKey, opts) {
     const envKey = apiKey ?? process.env[TINYFISH_API_KEY_VAR];
     if (envKey) {
         if (!validateKeyFormat(envKey)) {
@@ -30,6 +30,9 @@ export function ensureCliAuthenticated(source, apiKey) {
     if (authStatus.error) {
         throw spawnStepError("Could not read TinyFish CLI auth status", authStatus);
     }
+    if (opts?.interactiveLogin === false) {
+        throw new Error("The TinyFish CLI is not signed in. Run: tinyfish auth login");
+    }
     errLine("Signing in to the TinyFish CLI...");
     const loginResult = spawn.sync("tinyfish", ["auth", "login", "--source", source], {
         stdio: "inherit",

package/dist/lib/connect-clients.d.ts

@@ -25,6 +25,8 @@ export interface NativeMcpClient extends SupportedCommand {
     /** Shown when a keyless install leaves sign-in to the harness. */
     signInHint?: string;
     loginArgs?: string[];
+    /** Keyless `mcp add` itself blocks on the browser OAuth. */
+    oauthInAdd?: boolean;
     /** Replaces the `loginArgs` step when `supportCheck.optionalPatterns` miss. */
     degradedAuthNotes?: {
         keyed: string;

package/dist/lib/connect-clients.js

@@ -228,6 +228,7 @@ export const HERMES = {
     // No `keyAuth`: `hermes mcp add` has no --header, and `--auth header` prompts interactively.
     removals: [{ args: ["mcp", "remove", "tinyfish"], label: "TinyFish registration from Hermes" }],
     // Hermes completes OAuth while adding the server; a separate `mcp login` would authenticate twice.
+    oauthInAdd: true,
     addArgs: (mcpUrl) => [...urlAddArgs(mcpUrl), "--auth", "oauth"],
     launchWalkthrough: launchHermesWalkthrough,
 };

package/dist/lib/connect-runtime.d.ts

@@ -19,11 +19,15 @@ export declare class ConnectStepError extends Error {
         cause?: unknown;
     });
 }
+/** A bounded sign-in wait elapsed — unfinished, not broken. */
+export declare class SignInTimeoutError extends ConnectStepError {
+    constructor(message: string, cause?: unknown);
+}
 export declare function throwIfInterrupted(result: {
     signal?: string | null;
     error?: Error;
 }): void;
-interface SpawnStepResult {
+export interface SpawnStepResult {
     status?: number | null;
     signal?: string | null;
     error?: Error;

package/dist/lib/connect-runtime.js

@@ -37,6 +37,12 @@ export class ConnectStepError extends Error {
 }
 class PrerequisiteError extends ConnectStepError {
 }
+/** A bounded sign-in wait elapsed — unfinished, not broken. */
+export class SignInTimeoutError extends ConnectStepError {
+    constructor(message, cause) {
+        super(message, "timeout", { cause });
+    }
+}
 // A maxBuffer overflow is also killed with SIGTERM, and is a failure too.
 const NOT_INTERRUPTIONS = new Set(["ETIMEDOUT", "ENOBUFS"]);
 export function throwIfInterrupted(result) {
@@ -107,6 +113,11 @@ export async function runGuarded(state, telemetry, body) {
             process.exitCode = 130;
             return;
         }
+        // An elapsed sign-in wait is abandonment, not breakage.
+        if (error instanceof SignInTimeoutError) {
+            settle(state, telemetry, "aborted", { failedStage: state.stage, failureReason: "timeout" });
+            throw error;
+        }
         settle(state, telemetry, "failed", {
             failedStage: state.stage,
             failureReason: error instanceof ConnectStepError ? error.failureReason : "unexpected_error",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiny-fish/cli",
-  "version": "0.28.1-next.233",
+  "version": "0.28.2-next.236",
   "description": "TinyFish CLI — run web automations from your terminal",
   "type": "module",
   "bin": {