@tiny-fish/cli 0.29.1-next.237 → 0.29.1-next.240

package/dist/commands/connect.d.ts

@@ -2,7 +2,7 @@ import { Command } from "commander";
 import { type TakeHoistedCliInstall } from "../lib/cli-install.js";
 import { type AgentClient, type ConnectAuthMode } from "../lib/connect-runtime.js";
 export declare const DEFAULT_MCP_URL = "https://agent.tinyfish.ai/mcp";
-interface NativeConnectOptions {
+export interface NativeConnectOptions {
     apiKey?: string;
     mcpUrl: string;
     launch: boolean;
@@ -48,4 +48,3 @@ export declare function connectCursor(options: {
 }): Promise<void>;
 export declare function launchAgent(client: AgentClient): void;
 export declare function registerConnect(program: Command): void;
-export {};

package/dist/commands/connect.js

@@ -446,34 +446,38 @@ function launchCursorDeeplink(mcpUrl) {
     const result = openExternalUrl(cursorInstallDeeplink(mcpUrl));
     return !result.error && result.status === 0;
 }
-export function launchAgent(client) {
-    if (client === "claude-code") {
-        launchNativeMcpClient(CLAUDE_CODE);
-    }
-    else if (client === "codex") {
-        launchNativeMcpClient(CODEX);
-    }
-    else if (client === "hermes") {
-        launchNativeMcpClient(HERMES);
-    }
-    else if (client === "opencode") {
-        launchNativeMcpClient(OPENCODE);
-    }
-    else if (client === "grok") {
-        launchNativeMcpClient(GROK);
-    }
-    else if (client === "openclaw") {
-        launchOpenClawWalkthrough();
-    }
-    else if (client === "cursor") {
-        // Cursor has no chat CLI to launch.
+// A new client fails to compile until wired here.
+const AGENT_LAUNCHERS = {
+    "claude-code": () => launchNativeMcpClient(CLAUDE_CODE),
+    codex: () => launchNativeMcpClient(CODEX),
+    grok: () => launchNativeMcpClient(GROK),
+    hermes: () => launchNativeMcpClient(HERMES),
+    opencode: () => launchNativeMcpClient(OPENCODE),
+    openclaw: launchOpenClawWalkthrough,
+    // Cursor has no chat CLI to launch.
+    cursor: () => {
         throw new Error("Cursor has no launchable walkthrough. Open Cursor and start chatting.");
-    }
-    else {
-        const unhandled = client;
-        throw new Error(`No launch support for client: ${String(unhandled)}`);
-    }
+    },
+};
+export function launchAgent(client) {
+    AGENT_LAUNCHERS[client]();
 }
+// A new client fails to compile until wired here.
+const CLIENT_CONNECTORS = {
+    "claude-code": connectClaudeCode,
+    codex: connectCodex,
+    grok: connectGrok,
+    hermes: connectHermes,
+    opencode: connectOpencode,
+    openclaw: connectOpenClaw,
+    // `connect cursor --launch` still connects; it just cannot launch after.
+    cursor: async (options) => {
+        await connectCursor(options);
+        if (options.launch) {
+            errLine("Cursor has no launchable walkthrough. Open Cursor and start chatting.");
+        }
+    },
+};
 export function registerConnect(program) {
     program
         .command("connect")
@@ -568,31 +572,9 @@ export function registerConnect(program) {
             keyAuthOnly: !detectHumanInitiated() && !!validatedApiKey(options.apiKey),
             verbose: options.verbose ?? false,
         };
-        if (client === "claude-code") {
-            await connectClaudeCode(connectOptions);
-        }
-        else if (client === "codex") {
-            await connectCodex(connectOptions);
-        }
-        else if (client === "grok") {
-            await connectGrok(connectOptions);
-        }
-        else if (client === "hermes") {
-            await connectHermes(connectOptions);
-        }
-        else if (client === "opencode") {
-            await connectOpencode(connectOptions);
-        }
-        else if (client === "openclaw") {
-            await connectOpenClaw(connectOptions);
-        }
-        else if (client === "cursor") {
-            // `connect <client> --launch` is the shape every doc uses; connect anyway, then say
-            // why nothing launched rather than throwing away a working install.
-            await connectCursor(connectOptions);
-            if (connectOptions.launch) {
-                errLine("Cursor has no launchable walkthrough. Open Cursor and start chatting.");
-            }
+        const connector = CLIENT_CONNECTORS[client];
+        if (connector) {
+            await connector(connectOptions);
         }
         else {
             throw new Error("Unsupported client: " +

package/dist/lib/connect-all.js

@@ -4,7 +4,7 @@ import { connectClaudeCode, connectCodex, connectCursor, connectGrok, connectHer
 import { loadConfig, validatedApiKey } from "./auth.js";
 import { TINYFISH_API_KEY_VAR } from "./constants.js";
 import { installTinyFishCli, } from "./cli-install.js";
-import { NATIVE_MCP_CLIENTS } from "./connect-clients.js";
+import { HARNESS_CAPABILITIES, NATIVE_BY_HARNESS } from "./connect-clients.js";
 import { ensureCliAuthenticated, TINYFISH_CLI_NOT_FOUND_MESSAGE } from "./connect-auth.js";
 import { commandNotFound, ConnectInterruptedError, ConnectStepError, SignInTimeoutError, finishSetupCommand, throwIfInterrupted, } from "./connect-runtime.js";
 import { pickHarnesses } from "./connect-picker.js";
@@ -15,9 +15,6 @@ import { removeCursorMcpServer, planCursorWrite } from "./cursor-config.js";
 import { errLine, outLine, setErrIndent } from "./output.js";
 import { sendSetupCompleted } from "./setup-telemetry.js";
 import { verifyMcpAuth, verifyMcpHealth } from "./verify.js";
-// `codex mcp add` succeeds unauthenticated; OAuth lands at first tool use.
-// TODO(PF-3580): connect now probes Codex sign-in, so this over-warns a signed-in install.
-const AUTH_DEFERRED_AT_INSTALL = new Set(["codex"]);
 // A probe that exits non-zero is an install so old the subcommand is missing entirely.
 const TOO_OLD_REASONS = new Set([
     "harness_too_old",
@@ -29,26 +26,16 @@ const NO_BROWSER_REASONS = new Set([
     "harness_not_installed",
     "command_not_found",
 ]);
-const AUTH_CHECK_CAPABLE = new Set(["cursor", "openclaw"]);
 const STEP_INDENT = "  ";
 // Must undercut agent tool-call budgets (Claude Code Bash defaults to 120s).
 const OAUTH_SIGN_IN_TIMEOUT_MS = 90_000;
 // Derived: these block `connect` on a browser sign-in when keyless.
-const BROWSER_SIGN_IN = new Set(NATIVE_MCP_CLIENTS.filter((client) => client.loginArgs || client.oauthInAdd)
-    .map((client) => client.connectClient)
-    .filter((client) => ALL_HARNESSES.includes(client))
-    .map((client) => client));
-// Descriptor-derived so a harness that cannot carry a key is skipped, not failed, when headless.
-// Cursor and OpenClaw hold the key themselves rather than handing it to a harness `mcp add`.
-const KEY_AUTH_CAPABLE = new Set([
-    ...NATIVE_MCP_CLIENTS.filter((client) => !!client.keyAuth)
-        .map((client) => client.connectClient)
-        .filter((client) => ALL_HARNESSES.includes(client))
-        // Second map only narrows connectClient to Harness; the filter above is the real gate.
-        .map((client) => client),
-    "cursor",
-    "openclaw",
-]);
+const BROWSER_SIGN_IN = new Set(ALL_HARNESSES.filter((harness) => {
+    const native = NATIVE_BY_HARNESS.get(harness);
+    return !!native?.loginArgs || !!native?.oauthInAdd;
+}));
+// Derived: a native add carries the key, or the CLI holds it itself.
+const KEY_AUTH_CAPABLE = new Set(ALL_HARNESSES.filter((harness) => !!NATIVE_BY_HARNESS.get(harness)?.keyAuth || HARNESS_CAPABILITIES[harness].keyHeldByCli));
 // Real removal commands — harness id is not the binary name.
 const UNINSTALL_POINTERS = {
     "claude-code": "claude mcp remove tinyfish --scope user",
@@ -59,8 +46,25 @@ const UNINSTALL_POINTERS = {
     // OpenCode ships no `mcp remove`, so the only removal is editing the config it wrote.
     opencode: "remove the tinyfish entry from ~/.config/opencode/opencode.json",
 };
+// A new harness fails to compile until wired here.
+const HARNESS_CONNECTORS = {
+    "claude-code": connectClaudeCode,
+    codex: connectCodex,
+    grok: connectGrok,
+    hermes: connectHermes,
+    opencode: connectOpencode,
+    // Without the key the child shells an interactive `tinyfish auth login`.
+    openclaw: async (base) => {
+        await connectOpenClaw(base);
+        return undefined;
+    },
+    cursor: async (base) => {
+        await connectCursor({ apiKey: base.apiKey, mcpUrl: base.mcpUrl, verbose: base.verbose });
+        return undefined;
+    },
+};
 async function runHarnessConnect(harness, opts, keyAuthOnly, authTimeoutMs, hoistedCliInstall, onPostInstallFailed, deferOutro) {
-    const base = {
+    return HARNESS_CONNECTORS[harness]({
         apiKey: opts.apiKey,
         mcpUrl: opts.mcpUrl,
         launch: false,
@@ -70,35 +74,7 @@ async function runHarnessConnect(harness, opts, keyAuthOnly, authTimeoutMs, hois
         onPostInstallFailed,
         verbose: opts.verbose,
         deferOutro,
-    };
-    if (harness === "claude-code")
-        return connectClaudeCode(base);
-    if (harness === "codex")
-        return connectCodex(base);
-    if (harness === "hermes")
-        return connectHermes(base);
-    if (harness === "openclaw") {
-        // Without the key the child shells an interactive `tinyfish auth login`.
-        await connectOpenClaw({
-            apiKey: opts.apiKey,
-            mcpUrl: opts.mcpUrl,
-            launch: false,
-            hoistedCliInstall,
-            verbose: opts.verbose,
-            deferOutro,
-        });
-        return undefined;
-    }
-    if (harness === "opencode")
-        return connectOpencode(base);
-    if (harness === "grok")
-        return connectGrok(base);
-    if (harness === "cursor") {
-        await connectCursor({ apiKey: opts.apiKey, mcpUrl: opts.mcpUrl, verbose: opts.verbose });
-        return undefined;
-    }
-    // Explicit: a new harness reaching an untested branch must fail, not write Cursor's config.
-    throw new Error(`No installer is wired for ${harness}`);
+    });
 }
 /** Undefined means Ctrl+C: the caller stops the whole run. */
 function runHoistedCliInstall(verbose) {
@@ -117,7 +93,7 @@ function runHoistedCliInstall(verbose) {
 async function verifyHarness(harness, mcpUrl, keyed, apiKey) {
     const health = await verifyMcpHealth(mcpUrl);
     // The own-OAuth harnesses are auth-checkable only in key mode (key-authed config).
-    const capable = AUTH_CHECK_CAPABLE.has(harness) || keyed;
+    const capable = HARNESS_CAPABILITIES[harness].canVerifyAuth || keyed;
     if (!capable || !health.ok)
         return health;
     if (!apiKey)
@@ -186,9 +162,10 @@ async function processHarness(detection, opts, prompt, oauthBudget, hoistedCliIn
     let headlessAuth = false;
     let spentBrowserSlot = false;
     if (!isTTY && !keyed) {
-        // OpenClaw signs in through the CLI's own interactive login — unboundable.
-        if (harness === "openclaw")
+        // A CLI-login sign-in is interactive-only — unboundable headless.
+        if (HARNESS_CAPABILITIES[harness].signInViaCliLogin) {
             return { ...base, outcome: "auth_pending", fixCommand };
+        }
         if (BROWSER_SIGN_IN.has(harness)) {
             // One browser sign-in per run; the rest wait for a re-run.
             if (oauthBudget.spent)
@@ -233,6 +210,10 @@ async function processHarness(detection, opts, prompt, oauthBudget, hoistedCliIn
         if (spentBrowserSlot && e instanceof ConnectStepError && NO_BROWSER_REASONS.has(e.failureReason)) {
             oauthBudget.spent = false;
         }
+        // Detection saw a name on PATH; the probe proved nothing is behind it.
+        if (e instanceof ConnectStepError && e.failureReason === "harness_not_installed") {
+            return { ...base, detected: false, outcome: "not_detected" };
+        }
         // Both reasons carry the same "flag not listed" message; the upgrade nudge is in it.
         if (e instanceof ConnectStepError && TOO_OLD_REASONS.has(e.failureReason)) {
             return {
@@ -291,9 +272,6 @@ function summaryLine(result, uninstall) {
             ? `… ${name} — ${result.errorMessage}. Finish it in a terminal: ${result.fixCommand}`
             : `… ${name} — needs a browser sign-in. Run in a terminal: ${result.fixCommand}`;
     }
-    if (result.outcome === "deselected") {
-        return `… ${name} — skipped, not selected. Fix: ${result.fixCommand}`;
-    }
     if (result.outcome === "uninstall_pointer") {
         return `… ${name} — not removed automatically (config is owned by ${name}). Run: ${result.fixCommand}`;
     }
@@ -320,7 +298,7 @@ function summaryLine(result, uninstall) {
             `Fix: ${finishSetupCommand(result.harness)}`);
     }
     // A keyed install has no sign-in left, so the deferred-auth warning would contradict it.
-    const authDeferred = AUTH_DEFERRED_AT_INSTALL.has(result.harness) && !result.keyAuthed;
+    const authDeferred = HARNESS_CAPABILITIES[result.harness].authDeferredAtInstall && !result.keyAuthed;
     const verifyLabel = result.verifyDepth ? `verified: ${result.verifyDepth}` : "not verified";
     if (authDeferred || result.verifyOk === false) {
         const reason = authDeferred
@@ -330,10 +308,25 @@ function summaryLine(result, uninstall) {
     }
     return `✓ ${name} — installed, ${verifyLabel}`;
 }
-/** Cursor's connect writes its config file; every other harness spawns its binary. */
-// TODO(PF-3668): 4th cursor carve-out here; fold them into one harness capability table.
+/** Absent and unpicked harnesses are noise once something real happened. */
+function renderSummary(results, uninstall) {
+    if (!results.some(actionable))
+        return results.map((r) => summaryLine(r, uninstall));
+    // Ids, not display names: they double as the `connect` argument.
+    const skipped = results.filter((r) => r.outcome === "deselected").map((r) => r.harness);
+    const lines = results
+        .filter((r) => r.outcome !== "deselected" && r.outcome !== "not_detected")
+        .map((r) => summaryLine(r, uninstall));
+    if (skipped.length === 0)
+        return lines;
+    lines.push("", `Skipped (not selected): ${skipped.join(", ")}`);
+    return lines;
+}
+/** A config-writing connect needs no binary; every other harness spawns one. */
 function isStaleConfig(detection) {
-    return detection.detected && !detection.binaryOnPath && detection.harness !== "cursor";
+    return (detection.detected &&
+        !detection.binaryOnPath &&
+        !HARNESS_CAPABILITIES[detection.harness].cliWritesConfig);
 }
 /** A stale config dir is a detection signal with nothing behind it. */
 function actionable(result) {
@@ -465,13 +458,18 @@ export async function runConnectAll(opts) {
         const chosen = new Set(pick.selection);
         deselected = new Set(offerable.filter((d) => !chosen.has(d.harness)).map((d) => d.harness));
     }
-    // Mirrors processHarness's gate: headless, only keyless OpenClaw skips outright.
+    // Mirrors processHarness's gate: headless, only keyless CLI-login harnesses skip.
     const willAttempt = (harness) => !deselected.has(harness) &&
-        (isTTY || harness !== "openclaw" || (!!gateKey && KEY_AUTH_CAPABLE.has(harness)));
-    // Machine-global, so once per invocation; cursor's connect never installs it.
+        (isTTY ||
+            !HARNESS_CAPABILITIES[harness].signInViaCliLogin ||
+            (!!gateKey && KEY_AUTH_CAPABLE.has(harness)));
+    // Machine-global, so once per invocation; config-writing connects never install it.
     const cliNeeded = !opts.dryRun &&
         !opts.uninstall &&
-        detections.some((d) => d.detected && d.binaryOnPath && d.harness !== "cursor" && willAttempt(d.harness));
+        detections.some((d) => d.detected &&
+            d.binaryOnPath &&
+            !HARNESS_CAPABILITIES[d.harness].cliWritesConfig &&
+            willAttempt(d.harness));
     let takeHoistedCli;
     if (cliNeeded) {
         errLine("First: the TinyFish CLI, shared by every harness.");
@@ -492,7 +490,9 @@ export async function runConnectAll(opts) {
     const outro = new Set();
     const results = [];
     const oauthBudget = { spent: false };
-    const stepTotal = detections.length - deselected.size;
+    // Mirrors processHarness's own short-circuits: absent has no work, stale only when removing.
+    const stepped = (d) => !deselected.has(d.harness) && d.detected && (opts.uninstall || !isStaleConfig(d));
+    const stepTotal = detections.filter(stepped).length;
     let step = 0;
     for (const detection of detections) {
         const { harness } = detection;
@@ -505,6 +505,9 @@ export async function runConnectAll(opts) {
             });
             continue;
         }
+        // The pad loop below records these; announcing them is the noise this command had.
+        if (!stepped(detection))
+            continue;
         step += 1;
         errLine(`step ${step} of ${stepTotal} — ${DISPLAY_NAMES[harness]}`);
         let result;
@@ -550,8 +553,8 @@ export async function runConnectAll(opts) {
     }
     outLine("");
     outLine("TinyFish setup summary:");
-    for (const result of results)
-        outLine(summaryLine(result, opts.uninstall));
+    for (const line of renderSummary(results, opts.uninstall))
+        outLine(line);
     // Before the launch handover: anything printed after it is never seen.
     for (const line of outro)
         errLine(line);

package/dist/lib/connect-clients.d.ts

@@ -1,4 +1,5 @@
 import spawn from "cross-spawn";
+import type { Harness } from "./harness-detect.js";
 import { type AgentClient, type SupportedCommand } from "./connect-runtime.js";
 export declare const OPENCLAW_SKILL_INSTALL_ARGS: readonly string[];
 export declare const DEFAULT_ONBOARDING_PROMPT: string;
@@ -54,6 +55,23 @@ export declare const HERMES: NativeMcpClient;
 export declare const OPENCODE: NativeMcpClient;
 /** Every native MCP client. Derive from this, so a new harness cannot be missed. */
 export declare const NATIVE_MCP_CLIENTS: readonly NativeMcpClient[];
+/** Native descriptor by harness id; Cursor and OpenClaw have none. */
+export declare const NATIVE_BY_HARNESS: Map<"openclaw" | "grok" | "cursor" | "codex" | "hermes" | "opencode" | "claude-code", NativeMcpClient>;
 export declare const OPENCLAW: SupportedCommand;
+/** Traits with no native descriptor to live on (Cursor and OpenClaw included). */
+export interface HarnessCapabilities {
+    /** Sign-in is the CLI's own interactive `tinyfish auth login`. */
+    signInViaCliLogin: boolean;
+    /** Stored-key auth verification works against this harness's config. */
+    canVerifyAuth: boolean;
+    /** The CLI holds or writes the key; no harness `mcp add` carries it. */
+    keyHeldByCli: boolean;
+    /** Connect writes the MCP config file; no harness binary is spawned. */
+    cliWritesConfig: boolean;
+    /** `mcp add` succeeds unauthenticated; OAuth lands at first tool use. */
+    authDeferredAtInstall: boolean;
+}
+/** Required booleans: a new harness or new flag fails to compile undecided. */
+export declare const HARNESS_CAPABILITIES: Record<Harness, HarnessCapabilities>;
 export declare function launchNativeMcpClient(client: NativeMcpClient): void;
 export declare function launchOpenClawWalkthrough(): void;

package/dist/lib/connect-clients.js

@@ -267,6 +267,8 @@ export const NATIVE_MCP_CLIENTS = [
     HERMES,
     OPENCODE,
 ];
+/** Native descriptor by harness id; Cursor and OpenClaw have none. */
+export const NATIVE_BY_HARNESS = new Map(NATIVE_MCP_CLIENTS.map((client) => [client.connectClient, client]));
 export const OPENCLAW = {
     command: "openclaw",
     displayName: "OpenClaw",
@@ -276,6 +278,59 @@ export const OPENCLAW = {
         unavailableMessage: OPENCLAW_SKILL_UNAVAILABLE_MESSAGE,
     },
 };
+/** Required booleans: a new harness or new flag fails to compile undecided. */
+export const HARNESS_CAPABILITIES = {
+    "claude-code": {
+        signInViaCliLogin: false,
+        canVerifyAuth: false,
+        keyHeldByCli: false,
+        cliWritesConfig: false,
+        authDeferredAtInstall: false,
+    },
+    codex: {
+        signInViaCliLogin: false,
+        canVerifyAuth: false,
+        keyHeldByCli: false,
+        cliWritesConfig: false,
+        // TODO(PF-3580): connect now probes Codex sign-in, so this over-warns a signed-in install.
+        authDeferredAtInstall: true,
+    },
+    cursor: {
+        signInViaCliLogin: false,
+        canVerifyAuth: true,
+        keyHeldByCli: true,
+        cliWritesConfig: true,
+        authDeferredAtInstall: false,
+    },
+    grok: {
+        signInViaCliLogin: false,
+        canVerifyAuth: false,
+        keyHeldByCli: false,
+        cliWritesConfig: false,
+        authDeferredAtInstall: false,
+    },
+    hermes: {
+        signInViaCliLogin: false,
+        canVerifyAuth: false,
+        keyHeldByCli: false,
+        cliWritesConfig: false,
+        authDeferredAtInstall: false,
+    },
+    openclaw: {
+        signInViaCliLogin: true,
+        canVerifyAuth: true,
+        keyHeldByCli: true,
+        cliWritesConfig: false,
+        authDeferredAtInstall: false,
+    },
+    opencode: {
+        signInViaCliLogin: false,
+        canVerifyAuth: false,
+        keyHeldByCli: false,
+        cliWritesConfig: false,
+        authDeferredAtInstall: false,
+    },
+};
 export function launchNativeMcpClient(client) {
     errLine(`Starting the TinyFish walkthrough in ${client.displayName}...`);
     if (client.launchWalkthrough) {

package/dist/lib/connect-runtime.js

@@ -137,7 +137,8 @@ export function requireCommandSupport(client) {
         env: { ...process.env, FORCE_COLOR: "0", NO_COLOR: "1" },
         timeout: NON_INTERACTIVE_TIMEOUT_MS,
     });
-    if (commandNotFound(result.error)) {
+    // 127 is the shell's not-found code; a wrapper shim with no real binary behind it exits that.
+    if (commandNotFound(result.error) || result.status === 127) {
         throw new PrerequisiteError(`${client.displayName} is not installed or not available on PATH.`, "harness_not_installed", { cause: result.error });
     }
     if (result.error || result.status !== 0) {

package/dist/lib/registration-detect.js

@@ -3,7 +3,7 @@ import * as path from "path";
 import spawn from "cross-spawn";
 import { z } from "zod";
 import { loadConfig, matchesCliKey } from "./auth.js";
-import { NATIVE_MCP_CLIENTS } from "./connect-clients.js";
+import { NATIVE_BY_HARNESS } from "./connect-clients.js";
 import { errLine } from "./output.js";
 import { readCursorTinyfishEntry } from "./cursor-config.js";
 import { detectInstalledHarnesses, harnessConfigPath, harnessDisplayPath, AuthMode, Registered, } from "./harness-detect.js";
@@ -227,7 +227,6 @@ export const SIGN_IN_PROBES = {
 };
 // This reaches the pasted report, so its shape is checked first.
 const ENV_VAR_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
-const NATIVE_BY_HARNESS = new Map(NATIVE_MCP_CLIENTS.map((client) => [client.connectClient, client]));
 /** Undefined unless the descriptor routes this harness's key through a variable. */
 function declaredKeyEnvVar(harness) {
     return NATIVE_BY_HARNESS.get(harness)?.keyAuth?.envVar;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiny-fish/cli",
-  "version": "0.29.1-next.237",
+  "version": "0.29.1-next.240",
   "description": "TinyFish CLI — run web automations from your terminal",
   "type": "module",
   "bin": {