@tiny-fish/cli 0.29.1-next.240 → 0.29.1-next.242

package/dist/commands/connect.js

@@ -199,7 +199,7 @@ function runPostInstallSteps(client, options, state, telemetry, signInDeferred)
             });
         }
         // Before auth: a failed sign-in must not lose the harness record.
-        saveConnectContext(client.connectClient, telemetry.attemptId);
+        saveConnectContext(client.connectClient, telemetry.attemptId, state.authMode);
         attempt("authentication", () => {
             // A set timeout means headless; never shell an interactive login.
             ensureCliAuthenticated(client.connectClient, options.apiKey, {

package/dist/commands/doctor.js

@@ -130,6 +130,14 @@ function registrationVerdict(status, mcpUrl, keyAuth, cliKeyMissing) {
         // Widening past api-key would warn every healthy oauth install.
         if (status.authMode === AuthMode.ApiKey)
             return keyedVerdict(status, keyAuth, cliKeyMissing);
+        // Recorded, not verified: it never feeds provesHarnessReach.
+        if (status.recordedAuthMode) {
+            return {
+                status: "pass",
+                detail: `registered, auth mode ${status.recordedAuthMode} ` +
+                    "(recorded at connect; this harness does not report its headers)",
+            };
+        }
         // A probe that had to explain itself to reach `yes` is the only thing that explains `unknown`.
         const because = status.reason ? ` (${status.reason})` : "";
         return { status: "pass", detail: `registered, auth mode ${status.authMode}${because}` };
@@ -258,6 +266,7 @@ export async function runDoctor(options) {
         detected: status.detected,
         registered: status.registered,
         auth_mode: status.authMode,
+        ...(status.recordedAuthMode ? { recorded_auth_mode: status.recordedAuthMode } : {}),
         proves_harness_reach: provesHarnessReach(status, keyAuths[i], healthOk, options.mcpUrl),
     }));
     const body = {

package/dist/lib/auth.d.ts

@@ -3,8 +3,11 @@ export declare function configDir(): string;
 /** Install channel baked onto connect context; the connect flow is always CLI-driven. */
 export declare const CONNECT_SOURCE = "tinyfish_cli";
 export declare const CONNECT_ATTEMPT_ENV = "TINYFISH_CONNECT_ATTEMPT_ID";
-interface ConnectEntry {
+/** Mirrors ConnectAuthMode; duplicated to keep auth.ts free of connect-runtime imports. */
+export type RecordedAuthMode = "api-key" | "oauth" | "deferred";
+export interface ConnectEntry {
     attempt_id: string;
+    auth_mode?: RecordedAuthMode;
 }
 interface PendingConnectAttempt {
     id: string;
@@ -27,7 +30,8 @@ export declare function takePendingConnectAttempt(): string | undefined;
 /** Throwing variant for callers with their own cleanup (connect's telemetry flush). */
 export declare function writeConfig(apiKey: string): void;
 export declare function saveConfig(apiKey: string): void;
-export declare function saveConnectContext(client: string, attemptId: string): void;
+/** `authMode` omitted rewrites the entry without one: a reconnect that degraded must not keep a stale key claim. */
+export declare function saveConnectContext(client: string, attemptId: string, authMode?: RecordedAuthMode): void;
 interface EnvironmentOptions {
     platform?: typeof process.platform;
     shell?: string;

package/dist/lib/auth.js

@@ -19,6 +19,7 @@ export const CONNECT_SOURCE = "tinyfish_cli";
 // An env var, not a flag: released CLIs ignore an unknown one, and the installer's PATH
 // prepend means a copied command can still run a CLI far older than the page that wrote it.
 export const CONNECT_ATTEMPT_ENV = "TINYFISH_CONNECT_ATTEMPT_ID";
+const RECORDED_AUTH_MODES = ["api-key", "oauth", "deferred"];
 export function loadConfig() {
     try {
         const raw = JSON.parse(fs.readFileSync(configFile(), "utf8"));
@@ -45,9 +46,15 @@ function parseConnectMap(value) {
         return undefined;
     const out = {};
     for (const [client, entry] of Object.entries(value)) {
-        const attemptId = entry?.attempt_id;
-        if (typeof attemptId === "string")
-            out[client] = { attempt_id: attemptId };
+        const record = entry;
+        const attemptId = record?.attempt_id;
+        if (typeof attemptId !== "string")
+            continue;
+        const authMode = record?.auth_mode;
+        out[client] =
+            typeof authMode === "string" && RECORDED_AUTH_MODES.includes(authMode)
+                ? { attempt_id: attemptId, auth_mode: authMode }
+                : { attempt_id: attemptId };
     }
     return Object.keys(out).length > 0 ? out : undefined;
 }
@@ -118,11 +125,15 @@ export function saveConfig(apiKey) {
         process.exit(1);
     }
 }
-export function saveConnectContext(client, attemptId) {
+/** `authMode` omitted rewrites the entry without one: a reconnect that degraded must not keep a stale key claim. */
+export function saveConnectContext(client, attemptId, authMode) {
+    const entry = authMode
+        ? { attempt_id: attemptId, auth_mode: authMode }
+        : { attempt_id: attemptId };
     try {
         updateConfig((config) => ({
             ...config,
-            connect: { ...config.connect, [client]: { attempt_id: attemptId } },
+            connect: { ...config.connect, [client]: entry },
         }));
     }
     catch (e) {

package/dist/lib/connect-all.js

@@ -26,6 +26,8 @@ const NO_BROWSER_REASONS = new Set([
     "harness_not_installed",
     "command_not_found",
 ]);
+// Naming a harness the user does not have is the noise PF-3708 cut.
+const HIDDEN_ONCE_SOMETHING_WORKED = new Set(["deselected", "not_detected", "not_installed"]);
 const STEP_INDENT = "  ";
 // Must undercut agent tool-call budgets (Claude Code Bash defaults to 120s).
 const OAUTH_SIGN_IN_TIMEOUT_MS = 90_000;
@@ -140,11 +142,11 @@ function uninstallHarness(harness, configPath) {
 async function processHarness(detection, opts, prompt, oauthBudget, hoistedCliInstall, deferOutro) {
     const { harness, configPath, detected } = detection;
     const base = { harness, detected, configPath, installed: false };
-    if (!detected)
-        return { ...base, outcome: "not_detected" };
-    if (!opts.uninstall && isStaleConfig(detection)) {
-        return { ...base, outcome: "stale_config", fixCommand: `tinyfish connect ${harness}` };
-    }
+    const noWork = noWorkOutcome(detection, opts.uninstall);
+    if (noWork === "not_detected")
+        return { ...base, outcome: noWork };
+    if (noWork)
+        return { ...base, outcome: noWork, fixCommand: `tinyfish connect ${harness}` };
     // dryRun first: --dry-run --uninstall must plan, never reach removeCursorMcpServer().
     if (opts.dryRun) {
         const plan = opts.uninstall
@@ -212,7 +214,7 @@ async function processHarness(detection, opts, prompt, oauthBudget, hoistedCliIn
         }
         // Detection saw a name on PATH; the probe proved nothing is behind it.
         if (e instanceof ConnectStepError && e.failureReason === "harness_not_installed") {
-            return { ...base, detected: false, outcome: "not_detected" };
+            return { ...base, detected: false, outcome: "not_installed" };
         }
         // Both reasons carry the same "flag not listed" message; the upgrade nudge is in it.
         if (e instanceof ConnectStepError && TOO_OLD_REASONS.has(e.failureReason)) {
@@ -249,6 +251,12 @@ async function processHarness(detection, opts, prompt, oauthBudget, hoistedCliIn
 }
 function summaryLine(result, uninstall) {
     const name = DISPLAY_NAMES[result.harness];
+    if (result.outcome === "not_installed") {
+        const next = uninstall
+            ? "nothing to remove"
+            : `Install ${name}, then run: tinyfish connect ${result.harness}`;
+        return `- ${name} — not installed (\`${HARNESS_COMMANDS[result.harness]}\` is on PATH but does not run). ${next}`;
+    }
     if (!result.detected) {
         const next = uninstall
             ? "nothing to remove"
@@ -315,13 +323,21 @@ function renderSummary(results, uninstall) {
     // Ids, not display names: they double as the `connect` argument.
     const skipped = results.filter((r) => r.outcome === "deselected").map((r) => r.harness);
     const lines = results
-        .filter((r) => r.outcome !== "deselected" && r.outcome !== "not_detected")
+        .filter((r) => !HIDDEN_ONCE_SOMETHING_WORKED.has(r.outcome))
         .map((r) => summaryLine(r, uninstall));
     if (skipped.length === 0)
         return lines;
     lines.push("", `Skipped (not selected): ${skipped.join(", ")}`);
     return lines;
 }
+/** The states processHarness settles without work; stepTotal must agree with it. */
+function noWorkOutcome(d, uninstall) {
+    if (!d.detected)
+        return "not_detected";
+    if (!uninstall && isStaleConfig(d))
+        return "stale_config";
+    return undefined;
+}
 /** A config-writing connect needs no binary; every other harness spawns one. */
 function isStaleConfig(detection) {
     return (detection.detected &&
@@ -490,8 +506,8 @@ export async function runConnectAll(opts) {
     const outro = new Set();
     const results = [];
     const oauthBudget = { spent: false };
-    // Mirrors processHarness's own short-circuits: absent has no work, stale only when removing.
-    const stepped = (d) => !deselected.has(d.harness) && d.detected && (opts.uninstall || !isStaleConfig(d));
+    // Shares processHarness's no-work states so stepTotal cannot desync.
+    const stepped = (d) => !deselected.has(d.harness) && !noWorkOutcome(d, opts.uninstall);
     const stepTotal = detections.filter(stepped).length;
     let step = 0;
     for (const detection of detections) {

package/dist/lib/doctor-report.d.ts

@@ -51,6 +51,11 @@ declare const doctorHarnessSchema: z.ZodObject<{
     detected: z.ZodBoolean;
     registered: z.ZodEnum<typeof Registered>;
     auth_mode: z.ZodEnum<typeof AuthMode>;
+    recorded_auth_mode: z.ZodOptional<z.ZodEnum<{
+        "api-key": "api-key";
+        oauth: "oauth";
+        deferred: "deferred";
+    }>>;
     proves_harness_reach: z.ZodBoolean;
 }, z.core.$strip>;
 declare const doctorRepairSchema: z.ZodObject<{
@@ -114,6 +119,11 @@ export declare const doctorReportSchema: z.ZodObject<{
         detected: z.ZodBoolean;
         registered: z.ZodEnum<typeof Registered>;
         auth_mode: z.ZodEnum<typeof AuthMode>;
+        recorded_auth_mode: z.ZodOptional<z.ZodEnum<{
+            "api-key": "api-key";
+            oauth: "oauth";
+            deferred: "deferred";
+        }>>;
         proves_harness_reach: z.ZodBoolean;
     }, z.core.$strip>>;
     repairs: z.ZodArray<z.ZodObject<{

package/dist/lib/doctor-report.js

@@ -19,6 +19,8 @@ const doctorHarnessSchema = z.object({
     detected: z.boolean(),
     registered: z.enum(Registered),
     auth_mode: z.enum(AuthMode),
+    // Additive under schema 3: what connect wrote when the harness cannot echo it back.
+    recorded_auth_mode: z.enum(["api-key", "oauth", "deferred"]).optional(),
     proves_harness_reach: z.boolean(),
 });
 // `action` is what `--fix` dispatches on, not the harness field: keying off a null harness

package/dist/lib/registration-detect.d.ts

@@ -1,3 +1,4 @@
+import { type RecordedAuthMode } from "./auth.js";
 import type { AgentClient } from "./connect-runtime.js";
 import { AuthMode, type Harness, Registered } from "./harness-detect.js";
 export interface RegistrationStatus {
@@ -15,6 +16,8 @@ export interface RegistrationStatus {
     connected?: boolean;
     /** Why a keyed registration's key could not be read; not `reason`. */
     keyReason?: string;
+    /** What connect wrote, for harnesses whose CLI never echoes it back. Recorded, not verified. */
+    recordedAuthMode?: RecordedAuthMode;
     reason?: string;
 }
 export declare function codexOauthCompleted(): boolean | undefined;

package/dist/lib/registration-detect.js

@@ -458,10 +458,12 @@ export function detectRegistrations(harnesses) {
     return detectInstalledHarnesses()
         .filter((detection) => !harnesses || harnesses.includes(detection.harness))
         .map((detection) => {
+        const recordedAuthMode = connect[detection.harness]?.auth_mode;
         const base = {
             harness: detection.harness,
             detected: detection.detected,
             connectedBefore: detection.harness in connect,
+            ...(recordedAuthMode ? { recordedAuthMode } : {}),
         };
         // Undetected means nothing to probe: no spawn cost, and no misleading "unknown".
         if (!detection.detected) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiny-fish/cli",
-  "version": "0.29.1-next.240",
+  "version": "0.29.1-next.242",
   "description": "TinyFish CLI — run web automations from your terminal",
   "type": "module",
   "bin": {