@tiny-fish/cli 0.29.1-next.241 → 0.29.1-next.242

package/dist/commands/connect.js

@@ -199,7 +199,7 @@ function runPostInstallSteps(client, options, state, telemetry, signInDeferred)
             });
         }
         // Before auth: a failed sign-in must not lose the harness record.
-        saveConnectContext(client.connectClient, telemetry.attemptId);
+        saveConnectContext(client.connectClient, telemetry.attemptId, state.authMode);
         attempt("authentication", () => {
             // A set timeout means headless; never shell an interactive login.
             ensureCliAuthenticated(client.connectClient, options.apiKey, {

package/dist/commands/doctor.js

@@ -130,6 +130,14 @@ function registrationVerdict(status, mcpUrl, keyAuth, cliKeyMissing) {
         // Widening past api-key would warn every healthy oauth install.
         if (status.authMode === AuthMode.ApiKey)
             return keyedVerdict(status, keyAuth, cliKeyMissing);
+        // Recorded, not verified: it never feeds provesHarnessReach.
+        if (status.recordedAuthMode) {
+            return {
+                status: "pass",
+                detail: `registered, auth mode ${status.recordedAuthMode} ` +
+                    "(recorded at connect; this harness does not report its headers)",
+            };
+        }
         // A probe that had to explain itself to reach `yes` is the only thing that explains `unknown`.
         const because = status.reason ? ` (${status.reason})` : "";
         return { status: "pass", detail: `registered, auth mode ${status.authMode}${because}` };
@@ -258,6 +266,7 @@ export async function runDoctor(options) {
         detected: status.detected,
         registered: status.registered,
         auth_mode: status.authMode,
+        ...(status.recordedAuthMode ? { recorded_auth_mode: status.recordedAuthMode } : {}),
         proves_harness_reach: provesHarnessReach(status, keyAuths[i], healthOk, options.mcpUrl),
     }));
     const body = {

package/dist/lib/auth.d.ts

@@ -3,8 +3,11 @@ export declare function configDir(): string;
 /** Install channel baked onto connect context; the connect flow is always CLI-driven. */
 export declare const CONNECT_SOURCE = "tinyfish_cli";
 export declare const CONNECT_ATTEMPT_ENV = "TINYFISH_CONNECT_ATTEMPT_ID";
-interface ConnectEntry {
+/** Mirrors ConnectAuthMode; duplicated to keep auth.ts free of connect-runtime imports. */
+export type RecordedAuthMode = "api-key" | "oauth" | "deferred";
+export interface ConnectEntry {
     attempt_id: string;
+    auth_mode?: RecordedAuthMode;
 }
 interface PendingConnectAttempt {
     id: string;
@@ -27,7 +30,8 @@ export declare function takePendingConnectAttempt(): string | undefined;
 /** Throwing variant for callers with their own cleanup (connect's telemetry flush). */
 export declare function writeConfig(apiKey: string): void;
 export declare function saveConfig(apiKey: string): void;
-export declare function saveConnectContext(client: string, attemptId: string): void;
+/** `authMode` omitted rewrites the entry without one: a reconnect that degraded must not keep a stale key claim. */
+export declare function saveConnectContext(client: string, attemptId: string, authMode?: RecordedAuthMode): void;
 interface EnvironmentOptions {
     platform?: typeof process.platform;
     shell?: string;

package/dist/lib/auth.js

@@ -19,6 +19,7 @@ export const CONNECT_SOURCE = "tinyfish_cli";
 // An env var, not a flag: released CLIs ignore an unknown one, and the installer's PATH
 // prepend means a copied command can still run a CLI far older than the page that wrote it.
 export const CONNECT_ATTEMPT_ENV = "TINYFISH_CONNECT_ATTEMPT_ID";
+const RECORDED_AUTH_MODES = ["api-key", "oauth", "deferred"];
 export function loadConfig() {
     try {
         const raw = JSON.parse(fs.readFileSync(configFile(), "utf8"));
@@ -45,9 +46,15 @@ function parseConnectMap(value) {
         return undefined;
     const out = {};
     for (const [client, entry] of Object.entries(value)) {
-        const attemptId = entry?.attempt_id;
-        if (typeof attemptId === "string")
-            out[client] = { attempt_id: attemptId };
+        const record = entry;
+        const attemptId = record?.attempt_id;
+        if (typeof attemptId !== "string")
+            continue;
+        const authMode = record?.auth_mode;
+        out[client] =
+            typeof authMode === "string" && RECORDED_AUTH_MODES.includes(authMode)
+                ? { attempt_id: attemptId, auth_mode: authMode }
+                : { attempt_id: attemptId };
     }
     return Object.keys(out).length > 0 ? out : undefined;
 }
@@ -118,11 +125,15 @@ export function saveConfig(apiKey) {
         process.exit(1);
     }
 }
-export function saveConnectContext(client, attemptId) {
+/** `authMode` omitted rewrites the entry without one: a reconnect that degraded must not keep a stale key claim. */
+export function saveConnectContext(client, attemptId, authMode) {
+    const entry = authMode
+        ? { attempt_id: attemptId, auth_mode: authMode }
+        : { attempt_id: attemptId };
     try {
         updateConfig((config) => ({
             ...config,
-            connect: { ...config.connect, [client]: { attempt_id: attemptId } },
+            connect: { ...config.connect, [client]: entry },
         }));
     }
     catch (e) {

package/dist/lib/doctor-report.d.ts

@@ -51,6 +51,11 @@ declare const doctorHarnessSchema: z.ZodObject<{
     detected: z.ZodBoolean;
     registered: z.ZodEnum<typeof Registered>;
     auth_mode: z.ZodEnum<typeof AuthMode>;
+    recorded_auth_mode: z.ZodOptional<z.ZodEnum<{
+        "api-key": "api-key";
+        oauth: "oauth";
+        deferred: "deferred";
+    }>>;
     proves_harness_reach: z.ZodBoolean;
 }, z.core.$strip>;
 declare const doctorRepairSchema: z.ZodObject<{
@@ -114,6 +119,11 @@ export declare const doctorReportSchema: z.ZodObject<{
         detected: z.ZodBoolean;
         registered: z.ZodEnum<typeof Registered>;
         auth_mode: z.ZodEnum<typeof AuthMode>;
+        recorded_auth_mode: z.ZodOptional<z.ZodEnum<{
+            "api-key": "api-key";
+            oauth: "oauth";
+            deferred: "deferred";
+        }>>;
         proves_harness_reach: z.ZodBoolean;
     }, z.core.$strip>>;
     repairs: z.ZodArray<z.ZodObject<{

package/dist/lib/doctor-report.js

@@ -19,6 +19,8 @@ const doctorHarnessSchema = z.object({
     detected: z.boolean(),
     registered: z.enum(Registered),
     auth_mode: z.enum(AuthMode),
+    // Additive under schema 3: what connect wrote when the harness cannot echo it back.
+    recorded_auth_mode: z.enum(["api-key", "oauth", "deferred"]).optional(),
     proves_harness_reach: z.boolean(),
 });
 // `action` is what `--fix` dispatches on, not the harness field: keying off a null harness

package/dist/lib/registration-detect.d.ts

@@ -1,3 +1,4 @@
+import { type RecordedAuthMode } from "./auth.js";
 import type { AgentClient } from "./connect-runtime.js";
 import { AuthMode, type Harness, Registered } from "./harness-detect.js";
 export interface RegistrationStatus {
@@ -15,6 +16,8 @@ export interface RegistrationStatus {
     connected?: boolean;
     /** Why a keyed registration's key could not be read; not `reason`. */
     keyReason?: string;
+    /** What connect wrote, for harnesses whose CLI never echoes it back. Recorded, not verified. */
+    recordedAuthMode?: RecordedAuthMode;
     reason?: string;
 }
 export declare function codexOauthCompleted(): boolean | undefined;

package/dist/lib/registration-detect.js

@@ -458,10 +458,12 @@ export function detectRegistrations(harnesses) {
     return detectInstalledHarnesses()
         .filter((detection) => !harnesses || harnesses.includes(detection.harness))
         .map((detection) => {
+        const recordedAuthMode = connect[detection.harness]?.auth_mode;
         const base = {
             harness: detection.harness,
             detected: detection.detected,
             connectedBefore: detection.harness in connect,
+            ...(recordedAuthMode ? { recordedAuthMode } : {}),
         };
         // Undetected means nothing to probe: no spawn cost, and no misleading "unknown".
         if (!detection.detected) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiny-fish/cli",
-  "version": "0.29.1-next.241",
+  "version": "0.29.1-next.242",
   "description": "TinyFish CLI — run web automations from your terminal",
   "type": "module",
   "bin": {