@tiny-fish/cli 0.29.1 → 0.29.2-next.246

package/dist/commands/doctor.js

@@ -6,6 +6,7 @@ import { ALL_HARNESSES, AuthMode, Registered } from "../lib/harness-detect.js";
 import { detectHumanInitiated } from "../lib/harness.js";
 import { err, errLine, out, outLine } from "../lib/output.js";
 import { detectRegistrations } from "../lib/registration-detect.js";
+import { sendDoctorCompleted } from "../lib/setup-telemetry.js";
 import { verifyMcpAuth, verifyMcpHealth } from "../lib/verify.js";
 import { connectClaudeCode, connectCodex, connectCursor, connectGrok, connectHermes, connectOpenClaw, connectOpencode, DEFAULT_MCP_URL, } from "./connect.js";
 // A green auth mode with a red auth call proves nothing, so the call's verdict gates the claim.
@@ -351,6 +352,30 @@ export async function applyRepairs(repairs, options) {
     }
     return outcomes;
 }
+/** Aggregate counts only; check `detail` text and per-harness rows never leave the machine. */
+function telemetryPayload(report, offered, outcomes, options) {
+    const count = (status) => report.checks.filter((check) => check.status === status).length;
+    return {
+        schema_version: report.schema_version,
+        cli_version: report.cli_version,
+        ok_harnesses: report.ok_harnesses,
+        ok_cli: report.ok_cli,
+        checks_pass: count("pass"),
+        checks_fail: count("fail"),
+        checks_warn: count("warn"),
+        checks_skip: count("skip"),
+        // From the pre-repair report; the verdicts above describe the machine after it.
+        repairs_offered: offered.length,
+        repair_actions: [...new Set(offered.map((repair) => repair.action))],
+        repairs_attempted: outcomes.filter((outcome) => outcome.status !== "skipped").length,
+        repairs_succeeded: outcomes.filter((outcome) => outcome.status === "repaired").length,
+        fix_mode: !options.fix ? "none" : options.yes ? "fix_yes" : "fix",
+        // --harness scopes detection, so the counts above cover that harness alone.
+        harness_scope: options.harness ?? "all",
+        // Same signal cli_connect_stage carries, so agent and human doctor runs split.
+        is_human_initiated: detectHumanInitiated(),
+    };
+}
 export function registerDoctor(program) {
     program
         .command("doctor")
@@ -373,10 +398,14 @@ export function registerDoctor(program) {
             ...(options.harness ? { harness: options.harness } : {}),
         };
         let report;
+        let offered;
+        let outcomes = [];
         try {
             report = await runDoctor(doctorOptions);
+            offered = report.repairs;
             if (doctorOptions.fix && report.repairs.length > 0) {
-                for (const outcome of await applyRepairs(report.repairs, doctorOptions)) {
+                outcomes = await applyRepairs(report.repairs, doctorOptions);
+                for (const outcome of outcomes) {
                     const reason = outcome.reason ? ` (${outcome.reason})` : "";
                     errLine(`${outcome.status}: ${outcome.repair.command}${reason}`);
                 }
@@ -399,5 +428,8 @@ export function registerDoctor(program) {
         else
             out(report);
         process.exitCode = exitCodeFor(report.checks);
+        // After the exit code is set: telemetry never decides how doctor exits.
+        const resolved = apiKeyStatus();
+        await sendDoctorCompleted(doctorOptions.mcpUrl, telemetryPayload(report, offered, outcomes, doctorOptions), "key" in resolved ? resolved.key : undefined);
     });
 }

package/dist/commands/profile.d.ts

@@ -1,7 +1,8 @@
 import { Command } from "commander";
+import { type DecryptStats } from "../lib/chrome-cookies.js";
 import type { CookieRecord } from "../lib/types.js";
-export declare function extractChromeCookies(domain: string): Promise<CookieRecord[]>;
-export declare function extractAllChromeCookies(): Promise<CookieRecord[]>;
+export declare function extractChromeCookies(domain: string, stats?: DecryptStats): CookieRecord[];
+export declare function extractAllChromeCookies(stats?: DecryptStats): CookieRecord[];
 type TldtsParse = (host: string, opts: {
     allowPrivateDomains: boolean;
 }) => {

package/dist/commands/profile.js

@@ -3,6 +3,7 @@ import * as os from "os";
 import * as path from "path";
 import { createRequire } from "module";
 import { getApiKey } from "../lib/auth.js";
+import { deriveChromeKey, listAuthRelevantHostKeys, openCookiesDb, readCookiesForHost, } from "../lib/chrome-cookies.js";
 import { profileCreate, profileUpload } from "../lib/client.js";
 import { err, errLine, handleApiError, out, outLine } from "../lib/output.js";
 // ── UserFacingError ───────────────────────────────────────────────────────────
@@ -32,13 +33,8 @@ function validateDomain(domain) {
         process.exit(1);
     }
 }
-// Chrome-internal timestamp (microseconds since 1601-01-01) → Unix seconds
-const CHROME_EPOCH_DELTA_SECONDS = 11644473600;
-function chromeTimeToUnix(chromeMicros) {
-    return Math.floor(chromeMicros / 1e6) - CHROME_EPOCH_DELTA_SECONDS;
-}
-// Sets up chrome-cookies-secure in a temp dir and calls fn; cleans up after.
-async function withCookiesDb(fn) {
+// Opens a private copy of Chrome's cookie DB, derives the decryption key, and calls fn.
+function withCookiesDb(fn) {
     if (process.platform === "win32") {
         throw new UserFacingError("Cookie extraction is not supported on Windows yet");
     }
@@ -46,17 +42,32 @@ async function withCookiesDb(fn) {
     if (!fs.existsSync(cookiesPath)) {
         throw new UserFacingError(`Chrome cookies file not found at ${cookiesPath}. Is Google Chrome installed?`);
     }
-    // chrome-cookies-secure expects a profile directory and appends "/Cookies".
-    // Copy the file into a temp dir so we avoid the Chrome file lock.
+    // Copy the DB out of the profile directory so we avoid the Chrome file lock.
     const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "tinyfish-chrome-cookies-"));
+    let db;
     try {
-        fs.copyFileSync(cookiesPath, path.join(tmpDir, "Cookies"));
-        // chrome-cookies-secure is a CommonJS module — use createRequire to load it
-        const require = createRequire(import.meta.url);
-        const chromeCookies = require("chrome-cookies-secure");
-        return await fn(tmpDir, chromeCookies);
+        const dbPath = path.join(tmpDir, "Cookies"); // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
+        fs.copyFileSync(cookiesPath, dbPath);
+        // Committed rows can sit in Cookies-wal until Chrome checkpoints.
+        for (const ext of ["-wal", "-shm"]) {
+            if (fs.existsSync(cookiesPath + ext))
+                fs.copyFileSync(cookiesPath + ext, dbPath + ext);
+        }
+        try {
+            db = openCookiesDb(dbPath);
+        }
+        catch (e) {
+            throw new UserFacingError(`Failed to read Chrome cookies database: ${e instanceof Error ? e.message : String(e)}`);
+        }
+        return fn(db, deriveChromeKey());
     }
     finally {
+        try {
+            db?.close();
+        }
+        catch {
+            // Ignore
+        }
         try {
             fs.rmSync(tmpDir, { recursive: true, force: true });
         }
@@ -65,61 +76,21 @@ async function withCookiesDb(fn) {
         }
     }
 }
-// Extract cookies for a single domain using an already-open cookies DB.
-async function extractDomain(tmpDir, chromeCookies, domain) {
-    // "puppeteer" format returns an array with capitalized boolean fields and
-    // Chrome-internal microsecond timestamps — convert to our CookieRecord shape.
-    const raw = await chromeCookies.getCookiesPromised(`https://${domain}`, "puppeteer", tmpDir);
-    return raw.map((c) => ({
-        name: c.name,
-        value: c.value,
-        domain: c.domain,
-        path: c.path,
-        secure: c.Secure ?? false,
-        httpOnly: c.HttpOnly ?? false,
-        ...(c.expires && c.expires > 0 ? { expires: chromeTimeToUnix(c.expires) } : {}),
-    }));
-}
 // Exported for testing
-export async function extractChromeCookies(domain) {
-    return withCookiesDb((tmpDir, chromeCookies) => extractDomain(tmpDir, chromeCookies, domain));
+export function extractChromeCookies(domain, stats) {
+    return withCookiesDb((db, key) => readCookiesForHost(db, key, domain, stats));
 }
 // Exported for testing
-export async function extractAllChromeCookies() {
-    return withCookiesDb(async (tmpDir, chromeCookies) => {
-        const { DatabaseSync } = createRequire(import.meta.url)("node:sqlite");
-        let sqliteDb = null;
+export function extractAllChromeCookies(stats) {
+    return withCookiesDb((db, key) => {
         let hostKeys;
         try {
-            sqliteDb = new DatabaseSync(path.join(tmpDir, "Cookies")); // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
-            // Only import domains with auth-relevant cookies — skips tracking/analytics junk.
-            // A domain qualifies if it has any HttpOnly cookie (session/auth indicator) or
-            // a cookie whose name suggests authentication.
-            const rows = sqliteDb
-                .prepare(`SELECT DISTINCT host_key FROM cookies
-           WHERE is_httponly = 1
-              OR name LIKE '%session%'
-              OR name LIKE '%token%'
-              OR name LIKE '%auth%'
-              OR name LIKE '%sid%'
-              OR name LIKE '%login%'
-              OR name LIKE '%user%'
-              OR name LIKE '%account%'`)
-                .all();
-            hostKeys = rows.map((r) => r.host_key);
+            hostKeys = listAuthRelevantHostKeys(db);
         }
         catch (e) {
             throw new UserFacingError(`Failed to read Chrome cookies database: ${e instanceof Error ? e.message : String(e)}`);
         }
-        finally {
-            try {
-                sqliteDb?.close();
-            }
-            catch {
-                // Ignore
-            }
-        }
-        // 2. Canonicalize host_keys → registrable domains (mirrors frontend/app/lib/services/domain-utils.ts)
+        // Canonicalize host_keys → registrable domains (mirrors frontend/app/lib/services/domain-utils.ts)
         const require = createRequire(import.meta.url);
         const { parse } = require("tldts");
         const registrableDomains = new Set();
@@ -130,26 +101,19 @@ export async function extractAllChromeCookies() {
                 registrableDomains.add(result.domain.toLowerCase());
         }
         errLine(`Scanning ${registrableDomains.size} domains from Chrome...`);
-        // 3. Extract per-domain and concat
+        // hostKeyCandidates drops public-suffix parents, so registrable domains
+        // have disjoint host_key sets and need no cross-domain dedup.
         const all = [];
         for (const domain of registrableDomains) {
+            // One bad domain must not discard the whole import.
             try {
-                const cookies = await extractDomain(tmpDir, chromeCookies, domain);
-                all.push(...cookies);
+                all.push(...readCookiesForHost(db, key, domain, stats));
             }
             catch {
-                // skip domains chrome-cookies-secure can't parse (IPs, .local, etc.)
+                errLine(`Skipping ${domain}: could not read its cookies`);
             }
         }
-        // 4. Dedup by name+domain+path
-        const seen = new Set();
-        return all.filter((c) => {
-            const key = `${c.name}\t${c.domain}\t${c.path}`;
-            if (seen.has(key))
-                return false;
-            seen.add(key);
-            return true;
-        });
+        return all;
     });
 }
 // Exported for testing
@@ -254,13 +218,21 @@ export function registerProfile(program) {
         try {
             // Extract cookies before creating profile to avoid orphan profiles
             // if extraction fails (Windows, no Chrome, no cookies).
+            const stats = { keyringSkipped: 0 };
             const cookies = opts.allDomains
-                ? await extractAllChromeCookies()
-                : await extractChromeCookies(opts.domain);
+                ? extractAllChromeCookies(stats)
+                : extractChromeCookies(opts.domain, stats);
+            // Warn even on partial success — surviving plaintext rows can mask
+            // that every auth cookie was keyring-encrypted and skipped.
+            if (stats.keyringSkipped > 0) {
+                errLine(`Skipped ${stats.keyringSkipped} keyring-encrypted cookies (not supported on Linux yet).`);
+            }
             if (cookies.length === 0) {
-                throw new UserFacingError(opts.allDomains
-                    ? "No Chrome cookies found. Is Google Chrome installed and have you logged in to any sites?"
-                    : `No Chrome cookies found for ${opts.domain}. Are you logged in to this site in Chrome?`);
+                throw new UserFacingError(stats.keyringSkipped > 0
+                    ? "Chrome on Linux encrypts cookies with the system keyring, which is not supported yet."
+                    : opts.allDomains
+                        ? "No Chrome cookies found. Is Google Chrome installed and have you logged in to any sites?"
+                        : `No Chrome cookies found for ${opts.domain}. Are you logged in to this site in Chrome?`);
             }
             if (profileId === undefined) {
                 const name = opts.allDomains ? "chrome-import" : opts.domain;

package/dist/lib/chrome-cookies.d.ts

@@ -0,0 +1,15 @@
+import type { CookieRecord } from "./types.js";
+export interface CookiesDb {
+    prepare(sql: string): {
+        all(...params: string[]): unknown[];
+    };
+    close(): void;
+}
+export declare function openCookiesDb(dbPath: string): CookiesDb;
+export declare function deriveChromeKey(): Buffer;
+export interface DecryptStats {
+    keyringSkipped: number;
+}
+export declare function decryptCookieValue(encrypted: Uint8Array, key: Buffer, stats?: DecryptStats): string | null;
+export declare function listAuthRelevantHostKeys(db: CookiesDb): string[];
+export declare function readCookiesForHost(db: CookiesDb, key: Buffer, host: string, stats?: DecryptStats): CookieRecord[];

package/dist/lib/chrome-cookies.js

@@ -0,0 +1,164 @@
+import { execFileSync } from "node:child_process";
+import { createDecipheriv, pbkdf2Sync } from "node:crypto";
+import { createRequire } from "node:module";
+import { z } from "zod";
+// Reads Chrome's `Cookies` SQLite DB and decrypts values with the Safe Storage key.
+// Scheme per platform (Windows is unsupported and guarded by the caller):
+//   macOS — password from the login keychain, pbkdf2(pw, "saltysalt", 1003, 16, sha1)
+//   Linux — hardcoded "peanuts" password, 1 pbkdf2 iteration (Chrome's v10 fallback)
+// Values are AES-128-CBC with a 16-space IV, prefixed "v10"/"v11", and modern Chrome
+// prepends a 32-byte domain hash to the plaintext.
+const KEY_LENGTH = 16;
+const SALT = "saltysalt";
+const CBC_IV = Buffer.alloc(KEY_LENGTH, " ");
+const DOMAIN_HASH_LENGTH = 32;
+const SUPPORTED_PREFIXES = ["v10", "v11"];
+// Chrome-internal timestamp (microseconds since 1601-01-01) → Unix seconds
+const CHROME_EPOCH_DELTA_SECONDS = 11644473600;
+export function openCookiesDb(dbPath) {
+    // node:sqlite is stable on the Node >=24 floor in `engines`; createRequire avoids
+    // needing @types/node >=22 for the import type.
+    const { DatabaseSync } = createRequire(import.meta.url)("node:sqlite");
+    return new DatabaseSync(dbPath);
+}
+export function deriveChromeKey() {
+    if (process.platform !== "darwin") {
+        return pbkdf2Sync("peanuts", SALT, 1, KEY_LENGTH, "sha1");
+    }
+    let password;
+    try {
+        password = execFileSync("/usr/bin/security", ["find-generic-password", "-w", "-s", "Chrome Safe Storage", "-a", "Chrome"], 
+        // stderr is dropped so `security` diagnostics never pollute our JSON output.
+        { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    }
+    catch {
+        // Deliberately not chaining the cause — it can carry keychain material.
+        throw new Error('Could not read Chrome\'s encryption key from the macOS keychain. Approve the Keychain prompt ("Always Allow") and retry.');
+    }
+    return pbkdf2Sync(password, SALT, 1003, KEY_LENGTH, "sha1");
+}
+// Returns null when the row cannot be decrypted — a wrong-key decrypt yields garbage,
+// which would silently upload broken cookies.
+export function decryptCookieValue(encrypted, key, stats) {
+    const prefix = Buffer.from(encrypted.subarray(0, 3)).toString("latin1");
+    if (!SUPPORTED_PREFIXES.includes(prefix))
+        return null;
+    // Off macOS the key is Chrome's v10 "peanuts" fallback; v11 rows are
+    // keyring-encrypted and would decrypt to garbage with it.
+    if (prefix === "v11" && process.platform !== "darwin") {
+        if (stats)
+            stats.keyringSkipped++;
+        return null;
+    }
+    let decoded;
+    try {
+        const decipher = createDecipheriv("aes-128-cbc", key, CBC_IV);
+        decipher.setAutoPadding(false);
+        decoded = Buffer.concat([decipher.update(encrypted.subarray(3)), decipher.final()]);
+    }
+    catch {
+        return null;
+    }
+    if (decoded.length === 0)
+        return null;
+    const padding = decoded[decoded.length - 1];
+    // A zero final byte means a legacy row with no padding and no domain-hash prefix.
+    if (!padding)
+        return decoded.toString("utf8");
+    // Wrong-key decrypts yield random bytes; require valid PKCS#7 padding or skip the row.
+    if (padding > KEY_LENGTH || decoded.length - padding < DOMAIN_HASH_LENGTH)
+        return null;
+    for (let i = decoded.length - padding; i < decoded.length; i++) {
+        if (decoded[i] !== padding)
+            return null;
+    }
+    return decoded.subarray(DOMAIN_HASH_LENGTH, decoded.length - padding).toString("utf8");
+}
+// A cookie applies to a host when its host_key is the host itself or one of its
+// dot-delimited parents (RFC 6265 §5.1.3), with Chrome's optional leading dot.
+// Public-suffix parents (github.io, co.uk) are dropped — a row there would leak
+// into every registrable domain under the suffix.
+function hostKeyCandidates(host) {
+    const { parse } = createRequire(import.meta.url)("tldts");
+    const labels = host.split(".");
+    const parents = labels
+        .slice(1, -1)
+        .map((_, i) => labels.slice(i + 1).join("."))
+        .filter((p) => parse(p, { allowPrivateDomains: true }).domain);
+    return [host, ...parents].flatMap((h) => [h, `.${h}`]);
+}
+const hostKeyRowSchema = z.object({ host_key: z.string() });
+const cookieRowSchema = z.object({
+    host_key: z.string(),
+    name: z.string(),
+    value: z.string(),
+    encrypted_value: z.instanceof(Uint8Array),
+    is_secure: z.number(),
+    is_httponly: z.number(),
+    expires_utc: z.number(),
+});
+// Only hosts with auth-relevant cookies — skips tracking/analytics junk. A host
+// qualifies via any HttpOnly cookie or an auth-suggesting cookie name.
+export function listAuthRelevantHostKeys(db) {
+    const rows = db
+        .prepare(`SELECT DISTINCT host_key FROM cookies
+       WHERE is_httponly = 1
+          OR name LIKE '%session%'
+          OR name LIKE '%token%'
+          OR name LIKE '%auth%'
+          OR name LIKE '%sid%'
+          OR name LIKE '%login%'
+          OR name LIKE '%user%'
+          OR name LIKE '%account%'`)
+        .all();
+    return rows.flatMap((row) => {
+        const parsed = hostKeyRowSchema.safeParse(row);
+        return parsed.success ? [parsed.data.host_key] : [];
+    });
+}
+export function readCookiesForHost(db, key, host, stats) {
+    const candidates = hostKeyCandidates(host);
+    const rawRows = db
+        .prepare(
+    // Only root-path cookies are requested, matching the "/" request path this has
+    // always used. expires_utc is cast to REAL because Chrome's microsecond epoch
+    // exceeds Number.MAX_SAFE_INTEGER, which node:sqlite rejects as an exact integer.
+    `SELECT host_key, name, value, encrypted_value, is_secure, is_httponly,
+              CAST(expires_utc AS REAL) AS expires_utc
+         FROM cookies
+        WHERE path = '/' AND host_key IN (${candidates.map(() => "?").join(", ")})
+        ORDER BY creation_utc DESC`)
+        .all(...candidates);
+    // Malformed rows are skipped, matching the decrypt-failure policy.
+    const rows = rawRows.flatMap((raw) => {
+        const parsed = cookieRowSchema.safeParse(raw);
+        return parsed.success ? [parsed.data] : [];
+    });
+    const cookies = [];
+    const seen = new Set();
+    for (const row of rows) {
+        // Newest row wins for a repeated name, matching chrome-cookies-secure.
+        if (seen.has(row.name))
+            continue;
+        let value = row.value;
+        if (value === "" && row.encrypted_value.length > 0) {
+            const decrypted = decryptCookieValue(row.encrypted_value, key, stats);
+            if (decrypted === null)
+                continue;
+            value = decrypted;
+        }
+        seen.add(row.name);
+        cookies.push({
+            name: row.name,
+            value,
+            domain: row.host_key,
+            path: "/",
+            secure: row.is_secure === 1,
+            httpOnly: row.is_httponly === 1,
+            ...(row.expires_utc > 0
+                ? { expires: Math.floor(row.expires_utc / 1e6) - CHROME_EPOCH_DELTA_SECONDS }
+                : {}),
+        });
+    }
+    return cookies.reverse();
+}

package/dist/lib/setup-telemetry.d.ts

@@ -75,4 +75,40 @@ export type UpgradeScope = "both" | "cli" | "skill";
 /** `toVersion` is null when the run was interrupted or the installed version could not be read. */
 export declare function sendUpgradeCompleted(fromVersion: string, toVersion: string | null, outcome: UpgradeOutcome, scope: UpgradeScope, apiKey?: string): Promise<void>;
 export declare function sendSetupCompleted(mcpUrl: string, harnesses: HarnessResult[], apiKey?: string, mode?: SetupMode): Promise<void>;
+export declare const DOCTOR_HARNESS_SCOPES: readonly ["all", "claude-code", "codex", "cursor", "grok", "hermes", "openclaw", "opencode"];
+export declare const doctorCompletedPayloadSchema: z.ZodObject<{
+    schema_version: z.ZodInt;
+    cli_version: z.ZodString;
+    ok_harnesses: z.ZodBoolean;
+    ok_cli: z.ZodBoolean;
+    checks_pass: z.ZodInt;
+    checks_fail: z.ZodInt;
+    checks_warn: z.ZodInt;
+    checks_skip: z.ZodInt;
+    repairs_offered: z.ZodInt;
+    repair_actions: z.ZodArray<z.ZodEnum<{
+        connect: "connect";
+        "auth-login": "auth-login";
+    }>>;
+    repairs_attempted: z.ZodInt;
+    repairs_succeeded: z.ZodInt;
+    fix_mode: z.ZodEnum<{
+        none: "none";
+        fix: "fix";
+        fix_yes: "fix_yes";
+    }>;
+    harness_scope: z.ZodEnum<{
+        openclaw: "openclaw";
+        grok: "grok";
+        cursor: "cursor";
+        codex: "codex";
+        hermes: "hermes";
+        opencode: "opencode";
+        "claude-code": "claude-code";
+        all: "all";
+    }>;
+    is_human_initiated: z.ZodBoolean;
+}, z.core.$strip>;
+export type DoctorCompletedPayload = z.infer<typeof doctorCompletedPayloadSchema>;
+export declare function sendDoctorCompleted(mcpUrl: string, payload: DoctorCompletedPayload, apiKey?: string): Promise<void>;
 export {};

package/dist/lib/setup-telemetry.js

@@ -152,3 +152,47 @@ export async function sendSetupCompleted(mcpUrl, harnesses, apiKey, mode) {
     }
     await postConnectEvent({ endpoint, body, attempts: 2, label: "setup", apiKey });
 }
+export const DOCTOR_HARNESS_SCOPES = ["all", ...ALL_HARNESSES];
+// Aggregate only: per-harness rows and check `detail` strings stay local, so nothing
+// user-authored or credential-shaped can ride a doctor run to PostHog.
+// Caps mirror the route's schema: a payload the server would 400 is dropped here instead,
+// because postConnectEvent never retries a 4xx and the event would vanish silently.
+export const doctorCompletedPayloadSchema = z.object({
+    schema_version: z.int().positive(),
+    cli_version: z.string().max(32),
+    ok_harnesses: z.boolean(),
+    ok_cli: z.boolean(),
+    checks_pass: z.int().nonnegative().max(256),
+    checks_fail: z.int().nonnegative().max(256),
+    checks_warn: z.int().nonnegative().max(256),
+    checks_skip: z.int().nonnegative().max(256),
+    /** Offered by the pre-repair report; the verdicts describe the machine after it. */
+    repairs_offered: z.int().nonnegative().max(256),
+    repair_actions: z.array(z.enum(["connect", "auth-login"])).max(8),
+    repairs_attempted: z.int().nonnegative().max(256),
+    repairs_succeeded: z.int().nonnegative().max(256),
+    fix_mode: z.enum(["none", "fix", "fix_yes"]),
+    /** "all" unless --harness scoped the run; the counts above cover only that scope. */
+    harness_scope: z.enum(DOCTOR_HARNESS_SCOPES),
+    is_human_initiated: z.boolean(),
+});
+export async function sendDoctorCompleted(mcpUrl, payload, apiKey) {
+    if (telemetryDisabled())
+        return;
+    let endpoint;
+    let body;
+    try {
+        // Parse inside try — a schema violation must not fail a diagnosis that already ran.
+        const parsed = doctorCompletedPayloadSchema.parse(payload);
+        endpoint = new URL("/api/cli/connect-event", mcpUrl).toString();
+        body = JSON.stringify({ event: "doctor_completed", ...parsed });
+    }
+    catch (e) {
+        if (process.env["TINYFISH_DEBUG"]) {
+            errLine(`doctor telemetry skipped: ${e instanceof Error ? e.message : String(e)}`);
+        }
+        return;
+    }
+    // One attempt: doctor just probed this origin, so a stale keep-alive socket is not the risk.
+    await postConnectEvent({ endpoint, body, attempts: 1, label: "doctor", apiKey });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiny-fish/cli",
-  "version": "0.29.1",
+  "version": "0.29.2-next.246",
   "description": "TinyFish CLI — run web automations from your terminal",
   "type": "module",
   "bin": {
@@ -33,10 +33,10 @@
   },
   "dependencies": {
     "@tiny-fish/sdk": "^0.5.0",
-    "chrome-cookies-secure": "^3.0.2",
     "commander": "^12.0.0",
     "cross-spawn": "^7.0.6",
     "globals": "^17.4.0",
+    "tldts": "^6.1.86",
     "which": "^2.0.2",
     "zod": "^4.3.6"
   },