@tiny-fish/cli 0.30.1 → 0.30.2-next.256

package/dist/lib/constants.d.ts

@@ -9,3 +9,4 @@ export declare const API_URL_OVERRIDE: string | undefined;
 /** URL where users can create and manage API keys */
 export declare function getDashboardUrl(source?: string): string;
 export declare const DASHBOARD_URL: string;
+export declare const HARNESS_PROBE_TIMEOUT_MS = 15000;

package/dist/lib/constants.js

@@ -45,3 +45,4 @@ export function getDashboardUrl(source = DEFAULT_DASHBOARD_SOURCE) {
     return url.toString();
 }
 export const DASHBOARD_URL = getDashboardUrl();
+export const HARNESS_PROBE_TIMEOUT_MS = 15_000;

package/dist/lib/hermes-env.d.ts

@@ -0,0 +1,6 @@
+export declare const HERMES_PROBE_TIMEOUT_MS = 15000;
+/** Asking Hermes beats reimplementing its profile override, which we'd drift from. */
+export declare function resolveHermesHome(): string | undefined;
+export declare const HERMES_KEY_VAR = "MCP_TINYFISH_API_KEY";
+export declare function writeHermesKey(home: string, key: string): void;
+export declare function removeHermesKey(home: string): boolean;

package/dist/lib/hermes-env.js

@@ -0,0 +1,101 @@
+import os from "node:os";
+import path from "node:path";
+import fs from "node:fs";
+import { randomUUID } from "node:crypto";
+import spawn from "cross-spawn";
+import { HARNESS_PROBE_TIMEOUT_MS } from "./constants.js";
+import { sanitizeLine } from "./output.js";
+// display_hermes_home() abbreviates under $HOME, so the value is not always absolute.
+const HERMES_HOME_LINE = /^\s*hermes_home:\s*(\S.*?)\s*$/m;
+// One value: the next cold-start bump must move both probes together.
+export const HERMES_PROBE_TIMEOUT_MS = HARNESS_PROBE_TIMEOUT_MS;
+/** Asking Hermes beats reimplementing its profile override, which we'd drift from. */
+export function resolveHermesHome() {
+    const result = spawn.sync("hermes", ["dump"], {
+        encoding: "utf8",
+        env: { ...process.env, FORCE_COLOR: "0", NO_COLOR: "1" },
+        timeout: HERMES_PROBE_TIMEOUT_MS,
+    });
+    if (result.error || result.status !== 0)
+        return undefined;
+    const raw = HERMES_HOME_LINE.exec(sanitizeLine(`${result.stdout ?? ""}\n${result.stderr ?? ""}`))?.[1];
+    if (!raw)
+        return undefined;
+    const expanded = raw === "~" || raw.startsWith("~/") ? path.join(os.homedir(), raw.slice(2)) : raw;
+    return path.isAbsolute(expanded) ? expanded : undefined;
+}
+export const HERMES_KEY_VAR = "MCP_TINYFISH_API_KEY";
+const MARKER_HEAD = `# tinyfish-cli: TinyFish MCP key, managed by \`tinyfish connect hermes\``;
+const MARKER_TAIL = "# tinyfish-cli: end";
+// Keys are `sk-tinyfish-<alnum>`; refusing anything else beats shipping unreachable escaping.
+const BARE_SAFE = /^[A-Za-z0-9._\-/:+=]+$/;
+/** Mirrors Hermes' _env_line_defines_key: load_env() parses the export form too. */
+function definesKey(line) {
+    const stripped = line.trim().replace(/^export\s+/, "");
+    return stripped.startsWith(`${HERMES_KEY_VAR}=`);
+}
+function isMarker(line) {
+    return line.trim() === MARKER_HEAD || line.trim() === MARKER_TAIL;
+}
+// utf-8 read keeps the BOM; rewriting it breaks Hermes' first key.
+function readLines(envPath) {
+    if (!fs.existsSync(envPath))
+        return [];
+    return fs.readFileSync(envPath, "utf8").replace(/^\uFEFF/, "").split(/(?<=\n)/);
+}
+// Hermes preserves the original mode so Docker volume mounts survive (config.py:3921-3929).
+function writeAtomic(envPath, lines) {
+    let mode = 0o600;
+    try {
+        mode = fs.statSync(envPath).mode & 0o777;
+    }
+    catch {
+        // No existing file: 0600 is the right default for credentials.
+    }
+    const tmp = `${envPath}.${randomUUID()}.tmp`;
+    try {
+        fs.writeFileSync(tmp, lines.join(""), { encoding: "utf8", mode });
+        // open() applies mode through umask; chmod bypasses it, preserving bits.
+        fs.chmodSync(tmp, mode);
+        fs.renameSync(tmp, envPath);
+    }
+    catch (error) {
+        fs.rmSync(tmp, { force: true });
+        throw error;
+    }
+}
+export function writeHermesKey(home, key) {
+    const clean = key.replace(/[\r\n]/g, "").trim();
+    // An empty key reads as "bad characters" without its own branch.
+    if (!clean)
+        throw new Error("TinyFish API key is empty; nothing to write to Hermes' .env");
+    if (!BARE_SAFE.test(clean)) {
+        throw new Error("TinyFish API key contains characters that cannot be written to a .env file");
+    }
+    const envPath = path.join(home, ".env");
+    fs.mkdirSync(home, { recursive: true });
+    const lines = readLines(envPath);
+    const assignment = `${HERMES_KEY_VAR}=${clean}\n`;
+    const index = lines.findIndex(definesKey);
+    if (index < 0) {
+        if (lines.length && !lines[lines.length - 1].endsWith("\n"))
+            lines[lines.length - 1] += "\n";
+        lines.push(`${MARKER_HEAD}\n`, assignment, `${MARKER_TAIL}\n`);
+        writeAtomic(envPath, lines);
+        return;
+    }
+    lines[index] = assignment;
+    // load_env() is last-wins; a surviving duplicate would beat this value.
+    writeAtomic(envPath, lines.filter((line, i) => i === index || !definesKey(line)));
+}
+export function removeHermesKey(home) {
+    const envPath = path.join(home, ".env");
+    const lines = readLines(envPath);
+    if (!lines.length)
+        return false;
+    const kept = lines.filter((line) => !definesKey(line) && !isMarker(line));
+    if (kept.length === lines.length)
+        return false;
+    writeAtomic(envPath, kept);
+    return true;
+}

package/dist/lib/registration-detect.js

@@ -4,11 +4,10 @@ import spawn from "cross-spawn";
 import { z } from "zod";
 import { loadConfig, matchesCliKey } from "./auth.js";
 import { NATIVE_BY_HARNESS } from "./connect-clients.js";
+import { HARNESS_PROBE_TIMEOUT_MS } from "./constants.js";
 import { errLine } from "./output.js";
 import { readCursorTinyfishEntry } from "./cursor-config.js";
 import { detectInstalledHarnesses, harnessConfigPath, harnessDisplayPath, AuthMode, Registered, } from "./harness-detect.js";
-// 6s tripped on a cold `hermes mcp list`, measured at 6.34s.
-const PROBE_TIMEOUT_MS = 15_000;
 // A list, verified against codex 0.146. A name-keyed map was accepted here too, but every
 // field is optional, so that arm parsed *any* object-of-objects: a wrapper like
 // `{"servers": {...}}` decoded as one entry named `servers` and reported TinyFish absent.
@@ -43,7 +42,7 @@ function spawnFailureReason(command, code) {
 function runProbe(command, args) {
     const result = spawn.sync(command, args, {
         encoding: "utf8",
-        timeout: PROBE_TIMEOUT_MS,
+        timeout: HARNESS_PROBE_TIMEOUT_MS,
         // Belt and braces only: agents export FORCE_COLOR, and `NO_COLOR` does not fully silence
         // OpenCode, so the strip below stays load-bearing rather than a fallback.
         env: { ...process.env, NO_COLOR: "1", FORCE_COLOR: "0" },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiny-fish/cli",
-  "version": "0.30.1",
+  "version": "0.30.2-next.256",
   "description": "TinyFish CLI — run web automations from your terminal",
   "type": "module",
   "bin": {