@tiny-fish/cli 0.30.2-next.256 → 0.30.2-next.258

package/dist/lib/constants.js

@@ -1,35 +1,35 @@
-import { createRequire } from "module";
+import { createRequire } from 'module';
 const _require = createRequire(import.meta.url);
-const _pkg = _require("../../package.json");
+const _pkg = _require('../../package.json');
 export const CLI_VERSION = _pkg.version;
 /** Unversioned: the install site appends `@latest`, the version read must not. */
-export const TINYFISH_CLI_PACKAGE = "@tiny-fish/cli";
+export const TINYFISH_CLI_PACKAGE = '@tiny-fish/cli';
 // How we identify ourselves to other tools; `skills` echoes it back.
-export const CLI_AGENT_IDENTITY = "tinyfish-cli";
+export const CLI_AGENT_IDENTITY = 'tinyfish-cli';
 /** The descriptor hands this name to harnesses; the probes resolve it. */
-export const TINYFISH_API_KEY_VAR = "TINYFISH_API_KEY";
+export const TINYFISH_API_KEY_VAR = 'TINYFISH_API_KEY';
 /** Base URL for the TinyFish API. Override with TINYFISH_API_URL for staging/self-hosted. */
-const apiUrlOverride = process.env["TINYFISH_API_URL"]?.trim() || undefined;
+const apiUrlOverride = process.env['TINYFISH_API_URL']?.trim() || undefined;
 if (apiUrlOverride) {
     let parsed;
     try {
         parsed = new URL(apiUrlOverride);
     }
     catch {
-        process.stderr.write("Error: TINYFISH_API_URL must be a valid https URL\n");
+        process.stderr.write('Error: TINYFISH_API_URL must be a valid https URL\n');
         process.exit(1);
     }
-    const loopbackHttp = parsed.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(parsed.hostname);
-    if (parsed.protocol !== "https:" && !loopbackHttp) {
-        process.stderr.write(`Error: TINYFISH_API_URL must use https:// (got protocol "${parsed.protocol || "unknown"}")\n`);
+    const loopbackHttp = parsed.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(parsed.hostname);
+    if (parsed.protocol !== 'https:' && !loopbackHttp) {
+        process.stderr.write(`Error: TINYFISH_API_URL must use https:// (got protocol "${parsed.protocol || 'unknown'}")\n`);
         process.exit(1);
     }
 }
-export const BASE_URL = apiUrlOverride ?? "https://agent.tinyfish.ai";
+export const BASE_URL = apiUrlOverride ?? 'https://agent.tinyfish.ai';
 // Left undefined, the SDK sends Search and Fetch to their own hosts, which are the ones
 // behind the API gateway.
 export const API_URL_OVERRIDE = apiUrlOverride;
-const DEFAULT_DASHBOARD_SOURCE = "cli";
+const DEFAULT_DASHBOARD_SOURCE = 'cli';
 const DASHBOARD_SOURCE_PATTERN = /^[a-z0-9][a-z0-9_-]{0,63}$/;
 function normalizeDashboardSource(source) {
     const normalized = source?.trim().toLowerCase();
@@ -41,7 +41,7 @@ function normalizeDashboardSource(source) {
 /** URL where users can create and manage API keys */
 export function getDashboardUrl(source = DEFAULT_DASHBOARD_SOURCE) {
     const url = new URL(`${BASE_URL}/api-keys`);
-    url.searchParams.set("source", normalizeDashboardSource(source));
+    url.searchParams.set('source', normalizeDashboardSource(source));
     return url.toString();
 }
 export const DASHBOARD_URL = getDashboardUrl();

package/dist/lib/cursor-config.d.ts

@@ -1,7 +1,7 @@
 export declare function cursorConfigDir(): string;
 export declare function cursorMcpPath(): string;
 export interface CursorMcpWriteResult {
-    status: "written" | "unchanged" | "corrupt_skip";
+    status: 'written' | 'unchanged' | 'corrupt_skip';
     backupPath?: string;
     error?: string;
     /** A pre-existing tinyfish entry was replaced — a repair, not a fresh install. */

package/dist/lib/cursor-config.js

@@ -1,29 +1,29 @@
-import * as fs from "fs";
-import * as os from "os";
-import * as path from "path";
-import { matchesCliKey } from "./auth.js";
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import { matchesCliKey } from './auth.js';
 // The one config file the CLI writes directly — hence backup/merge rigor.
-const TINYFISH_SERVER_KEY = "tinyfish";
+const TINYFISH_SERVER_KEY = 'tinyfish';
 export function cursorConfigDir() {
-    return path.join(os.homedir(), ".cursor");
+    return path.join(os.homedir(), '.cursor');
 }
 export function cursorMcpPath() {
-    return path.join(cursorConfigDir(), "mcp.json");
+    return path.join(cursorConfigDir(), 'mcp.json');
 }
 function isPlainRecord(value) {
-    return value !== null && typeof value === "object" && !Array.isArray(value);
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
 }
 // Footgun: the key lands plaintext in mcp.json (0600) — per-device keys are the GA hardening.
 function buildTinyfishServerEntry(mcpUrl, apiKey) {
-    return apiKey ? { url: mcpUrl, headers: { "X-API-Key": apiKey } } : { url: mcpUrl };
+    return apiKey ? { url: mcpUrl, headers: { 'X-API-Key': apiKey } } : { url: mcpUrl };
 }
 function parseMcpJson(raw) {
     try {
         const parsed = JSON.parse(raw);
         if (!isPlainRecord(parsed))
-            return { ok: false, error: "mcp.json root is not a JSON object" };
-        if ("mcpServers" in parsed && !isPlainRecord(parsed.mcpServers)) {
-            return { ok: false, error: "mcp.json mcpServers is not a JSON object" };
+            return { ok: false, error: 'mcp.json root is not a JSON object' };
+        if ('mcpServers' in parsed && !isPlainRecord(parsed.mcpServers)) {
+            return { ok: false, error: 'mcp.json mcpServers is not a JSON object' };
         }
         return { ok: true, value: parsed };
     }
@@ -35,10 +35,10 @@ function parseMcpJson(raw) {
 function readExisting() {
     let raw;
     try {
-        raw = fs.readFileSync(cursorMcpPath(), "utf8");
+        raw = fs.readFileSync(cursorMcpPath(), 'utf8');
     }
     catch (e) {
-        if (e?.code === "ENOENT")
+        if (e?.code === 'ENOENT')
             return { parsed: {} };
         return { error: e instanceof Error ? e.message : String(e) };
     }
@@ -51,12 +51,12 @@ function readExisting() {
 export function planCursorWrite(mcpUrl, apiKey) {
     const existing = readExisting();
     const filePath = cursorMcpPath();
-    if ("error" in existing) {
+    if ('error' in existing) {
         return `${filePath}: existing file is corrupt (${existing.error}) — would skip and leave it untouched`;
     }
     const authNote = apiKey
-        ? " with an API-key header — the key is stored in plaintext in that file (value not shown here)"
-        : "";
+        ? ' with an API-key header — the key is stored in plaintext in that file (value not shown here)'
+        : '';
     const servers = existing.parsed.mcpServers;
     const current = isPlainRecord(servers) ? servers[TINYFISH_SERVER_KEY] : undefined;
     if (JSON.stringify(current) === JSON.stringify(buildTinyfishServerEntry(mcpUrl, apiKey))) {
@@ -69,7 +69,7 @@ export function planCursorWrite(mcpUrl, apiKey) {
 /** Reports the header's shape, never its value. */
 export function readCursorTinyfishEntry() {
     const existing = readExisting();
-    if ("error" in existing)
+    if ('error' in existing)
         return { present: false, hasApiKeyHeader: false, error: existing.error };
     const servers = existing.parsed.mcpServers;
     const entry = isPlainRecord(servers) ? servers[TINYFISH_SERVER_KEY] : undefined;
@@ -79,13 +79,13 @@ export function readCursorTinyfishEntry() {
     // Header names are case-insensitive, and this file is hand-editable — matching only the
     // casing we write would understate auth mode for a user who typed it differently.
     const keyHeader = isPlainRecord(headers)
-        ? Object.entries(headers).find((entry) => entry[0].toLowerCase() === "x-api-key" && typeof entry[1] === "string")
+        ? Object.entries(headers).find((entry) => entry[0].toLowerCase() === 'x-api-key' && typeof entry[1] === 'string')
         : undefined;
     return {
         present: true,
         hasApiKeyHeader: keyHeader !== undefined,
         ...(matchesCliKey(keyHeader?.[1]) ? { keyMatchesCliKey: true } : {}),
-        ...(typeof entry.url === "string" ? { url: entry.url } : {}),
+        ...(typeof entry.url === 'string' ? { url: entry.url } : {}),
     };
 }
 // Backup, then atomic temp+rename; pid avoids same-millisecond backup collisions.
@@ -98,7 +98,7 @@ function commitServers(filePath, existing, servers) {
     }
     const next = { ...existing.parsed, mcpServers: servers };
     const tmpPath = `${filePath}.tmp-${process.pid}`;
-    fs.writeFileSync(tmpPath, JSON.stringify(next, null, 2) + "\n", { mode: 0o600 });
+    fs.writeFileSync(tmpPath, JSON.stringify(next, null, 2) + '\n', { mode: 0o600 });
     try {
         fs.renameSync(tmpPath, filePath);
     }
@@ -106,20 +106,20 @@ function commitServers(filePath, existing, servers) {
         fs.rmSync(tmpPath, { force: true });
         throw e;
     }
-    return { status: "written", backupPath };
+    return { status: 'written', backupPath };
 }
 /** Merges only the `tinyfish` key; skips unreadable/corrupt files rather than clobber. */
 export function writeCursorMcpConfig(mcpUrl, apiKey) {
     const filePath = cursorMcpPath();
     const existing = readExisting();
-    if ("error" in existing)
-        return { status: "corrupt_skip", error: existing.error };
+    if ('error' in existing)
+        return { status: 'corrupt_skip', error: existing.error };
     const servers = isPlainRecord(existing.parsed.mcpServers)
         ? { ...existing.parsed.mcpServers }
         : {};
     const nextEntry = buildTinyfishServerEntry(mcpUrl, apiKey);
     if (JSON.stringify(servers[TINYFISH_SERVER_KEY]) === JSON.stringify(nextEntry)) {
-        return { status: "unchanged" };
+        return { status: 'unchanged' };
     }
     const repaired = TINYFISH_SERVER_KEY in servers;
     servers[TINYFISH_SERVER_KEY] = nextEntry;
@@ -127,22 +127,22 @@ export function writeCursorMcpConfig(mcpUrl, apiKey) {
 }
 /** Cursor deeplink format: cursor://anysphere.cursor-deeplink/mcp/install?name=$NAME&config=$BASE64 */
 export function cursorInstallDeeplink(mcpUrl) {
-    const config = Buffer.from(JSON.stringify(buildTinyfishServerEntry(mcpUrl))).toString("base64");
+    const config = Buffer.from(JSON.stringify(buildTinyfishServerEntry(mcpUrl))).toString('base64');
     return `cursor://anysphere.cursor-deeplink/mcp/install?name=${TINYFISH_SERVER_KEY}&config=${encodeURIComponent(config)}`;
 }
 /** Removes only the `tinyfish` key. */
 export function removeCursorMcpServer() {
     const filePath = cursorMcpPath();
     const existing = readExisting();
-    if ("error" in existing)
-        return { status: "corrupt_skip", error: existing.error };
+    if ('error' in existing)
+        return { status: 'corrupt_skip', error: existing.error };
     if (existing.raw === undefined)
-        return { status: "unchanged" };
+        return { status: 'unchanged' };
     const servers = isPlainRecord(existing.parsed.mcpServers)
         ? { ...existing.parsed.mcpServers }
         : {};
     if (!(TINYFISH_SERVER_KEY in servers))
-        return { status: "unchanged" };
+        return { status: 'unchanged' };
     delete servers[TINYFISH_SERVER_KEY];
     return commitServers(filePath, existing, servers);
 }

package/dist/lib/doctor-report.d.ts

@@ -1,5 +1,5 @@
-import { z } from "zod";
-import { AuthMode, Registered } from "./harness-detect.js";
+import { z } from 'zod';
+import { AuthMode, Registered } from './harness-detect.js';
 /** Bumped whenever a consumer could misread the payload; the cookbook skill releases separately. */
 export declare const DOCTOR_SCHEMA_VERSION = 3;
 declare const checkStatusSchema: z.ZodEnum<{

package/dist/lib/doctor-report.js

@@ -1,11 +1,11 @@
-import { z } from "zod";
-import { ALL_HARNESSES, AuthMode, Registered } from "./harness-detect.js";
+import { z } from 'zod';
+import { ALL_HARNESSES, AuthMode, Registered } from './harness-detect.js';
 /** Bumped whenever a consumer could misread the payload; the cookbook skill releases separately. */
 export const DOCTOR_SCHEMA_VERSION = 3;
-const checkStatusSchema = z.enum(["pass", "fail", "warn", "skip"]);
+const checkStatusSchema = z.enum(['pass', 'fail', 'warn', 'skip']);
 const harnessSchema = z.enum(ALL_HARNESSES);
 // Not derived from `harness`: connectivity is harness-null yet harness-scoped.
-const checkScopeSchema = z.enum(["harness", "cli", "info"]);
+const checkScopeSchema = z.enum(['harness', 'cli', 'info']);
 const doctorCheckSchema = z.object({
     id: z.string(),
     title: z.string(),
@@ -20,20 +20,20 @@ const doctorHarnessSchema = z.object({
     registered: z.enum(Registered),
     auth_mode: z.enum(AuthMode),
     // Additive under schema 3: what connect wrote when the harness cannot echo it back.
-    recorded_auth_mode: z.enum(["api-key", "oauth", "deferred"]).optional(),
+    recorded_auth_mode: z.enum(['api-key', 'oauth', 'deferred']).optional(),
     proves_harness_reach: z.boolean(),
 });
 // `action` is what `--fix` dispatches on, not the harness field: keying off a null harness
 // conflated "run auth login" with a non-executable repair and the credential fix never ran.
 const doctorRepairSchema = z.object({
     for: z.string(),
-    action: z.enum(["connect", "auth-login"]),
+    action: z.enum(['connect', 'auth-login']),
     harness: harnessSchema.nullable(),
     command: z.string(),
     unattended_safe: z.boolean(),
 });
 function hasFailure(checks, scope) {
-    return checks.some((check) => check.scope === scope && check.status === "fail");
+    return checks.some((check) => check.scope === scope && check.status === 'fail');
 }
 // One `ok` could not answer both questions, and answered neither.
 export const doctorReportSchema = z
@@ -48,20 +48,20 @@ export const doctorReportSchema = z
     repairs: z.array(doctorRepairSchema),
 })
     // Claiming ok while that scope failed is worse than no report.
-    .refine((report) => !report.ok_harnesses || !hasFailure(report.checks, "harness"), {
-    message: "ok_harnesses cannot be true while a harness check has failed",
-    path: ["ok_harnesses"],
+    .refine((report) => !report.ok_harnesses || !hasFailure(report.checks, 'harness'), {
+    message: 'ok_harnesses cannot be true while a harness check has failed',
+    path: ['ok_harnesses'],
 })
-    .refine((report) => !report.ok_cli || !hasFailure(report.checks, "cli"), {
-    message: "ok_cli cannot be true while a CLI check has failed",
-    path: ["ok_cli"],
+    .refine((report) => !report.ok_cli || !hasFailure(report.checks, 'cli'), {
+    message: 'ok_cli cannot be true while a CLI check has failed',
+    path: ['ok_cli'],
 });
-const GLYPHS = { pass: "✓", fail: "✗", warn: "⚠", skip: "…" };
+const GLYPHS = { pass: '✓', fail: '✗', warn: '⚠', skip: '…' };
 /** Doctor itself broke, which is a different claim from "your setup is broken". */
 export const DOCTOR_COULD_NOT_RUN = 2;
 /** Skips never fail the run; a skip means not applicable, not broken. */
 export function verdictFor(checks) {
-    return { ok_harnesses: !hasFailure(checks, "harness"), ok_cli: !hasFailure(checks, "cli") };
+    return { ok_harnesses: !hasFailure(checks, 'harness'), ok_cli: !hasFailure(checks, 'cli') };
 }
 /** Harness scope only: the caller asked about its agent, not us. */
 export function exitCodeFor(checks) {
@@ -71,25 +71,25 @@ export function exitCodeFor(checks) {
 function footnotes(report) {
     const notes = [];
     // Alongside exit 1 this is noise; something did fail.
-    if (hasFailure(report.checks, "cli") && report.ok_harnesses) {
+    if (hasFailure(report.checks, 'cli') && report.ok_harnesses) {
         notes.push("The CLI's own credential is broken; that does not affect the exit code.");
     }
     // Per-harness rows, not the scope: connectivity is harness-scoped and never skips.
     const harnessChecks = report.checks.filter((c) => c.harness !== null);
-    if (harnessChecks.length > 0 && harnessChecks.every((c) => c.status === "skip")) {
-        notes.push("No harness was checked here, so a green harness verdict proves nothing.");
+    if (harnessChecks.length > 0 && harnessChecks.every((c) => c.status === 'skip')) {
+        notes.push('No harness was checked here, so a green harness verdict proves nothing.');
     }
     return notes;
 }
 export function renderPretty(report) {
-    const lines = report.checks.map((c) => `${GLYPHS[c.status]} ${c.title}${c.detail ? ` — ${c.detail}` : ""}`);
+    const lines = report.checks.map((c) => `${GLYPHS[c.status]} ${c.title}${c.detail ? ` — ${c.detail}` : ''}`);
     if (report.repairs.length > 0) {
-        lines.push("", "Repairs:");
+        lines.push('', 'Repairs:');
         for (const repair of report.repairs)
             lines.push(`  ${repair.command}`);
     }
     const notes = footnotes(report);
     if (notes.length > 0)
-        lines.push("", ...notes);
-    return lines.join("\n");
+        lines.push('', ...notes);
+    return lines.join('\n');
 }

package/dist/lib/harness-detect.js

@@ -1,35 +1,35 @@
-import * as fs from "fs";
-import * as os from "os";
-import * as path from "path";
-import which from "which";
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import which from 'which';
 export const ALL_HARNESSES = [
-    "claude-code",
-    "codex",
-    "cursor",
-    "grok",
-    "hermes",
-    "openclaw",
-    "opencode",
+    'claude-code',
+    'codex',
+    'cursor',
+    'grok',
+    'hermes',
+    'openclaw',
+    'opencode',
 ];
 export const HARNESS_DISPLAY_NAMES = {
-    "claude-code": "Claude Code",
-    codex: "Codex",
-    cursor: "Cursor",
-    grok: "Grok",
-    hermes: "Hermes",
-    openclaw: "OpenClaw",
-    opencode: "OpenCode",
+    'claude-code': 'Claude Code',
+    codex: 'Codex',
+    cursor: 'Cursor',
+    grok: 'Grok',
+    hermes: 'Hermes',
+    openclaw: 'OpenClaw',
+    opencode: 'OpenCode',
 };
 /** MCP config is read at startup, so a running harness needs this to see TinyFish. */
 export const RELOAD_ACTION = {
-    "claude-code": "restart it",
-    codex: "restart it",
+    'claude-code': 'restart it',
+    codex: 'restart it',
     // docs.x.ai/build/features/mcp-servers: `r` in /mcps rereads the config.
-    grok: "run /mcps and press r",
-    hermes: "restart it",
-    openclaw: "restart it",
-    opencode: "restart it",
-    cursor: "reload the window",
+    grok: 'run /mcps and press r',
+    hermes: 'restart it',
+    openclaw: 'restart it',
+    opencode: 'restart it',
+    cursor: 'reload the window',
 };
 // Values are the wire contract; the report schema derives from these.
 export var Registered;
@@ -45,24 +45,24 @@ export var AuthMode;
     AuthMode["Unknown"] = "unknown";
 })(AuthMode || (AuthMode = {}));
 const CONFIG_DIRS = {
-    "claude-code": ".claude",
-    codex: ".codex",
-    cursor: ".cursor",
-    grok: ".grok",
-    hermes: ".hermes",
-    openclaw: ".openclaw",
-    opencode: ".config/opencode",
+    'claude-code': '.claude',
+    codex: '.codex',
+    cursor: '.cursor',
+    grok: '.grok',
+    hermes: '.hermes',
+    openclaw: '.openclaw',
+    opencode: '.config/opencode',
 };
 // Harness id is not the binary name (cursor-agent).
 // TODO(PF-3668): a same-named non-harness binary still reads as installed.
 export const HARNESS_COMMANDS = {
-    "claude-code": "claude",
-    codex: "codex",
-    cursor: "cursor-agent",
-    grok: "grok",
-    hermes: "hermes",
-    openclaw: "openclaw",
-    opencode: "opencode",
+    'claude-code': 'claude',
+    codex: 'codex',
+    cursor: 'cursor-agent',
+    grok: 'grok',
+    hermes: 'hermes',
+    openclaw: 'openclaw',
+    opencode: 'opencode',
 };
 // cross-spawn resolves the same way, so detection cannot disagree with the spawn.
 export function commandOnPath(command) {

package/dist/lib/harness.js

@@ -12,22 +12,22 @@ const hasVarWithPrefix = (env, prefix) => Object.keys(env).some((key) => key.sta
 // frontend/app/api/cli/connect-event/route.ts, or connect telemetry buckets it as `other`.
 // First match wins. Base agents (claude-code) go last so embedding wrappers win.
 const HARNESS_FINGERPRINTS = [
-    { name: "openclaw", matches: (env) => hasVarWithPrefix(env, "OPENCLAW_MCP_") },
-    { name: "grok", matches: (env) => env["GROK_AGENT"] === "1" },
+    { name: 'openclaw', matches: (env) => hasVarWithPrefix(env, 'OPENCLAW_MCP_') },
+    { name: 'grok', matches: (env) => env['GROK_AGENT'] === '1' },
     // Cursor's VS Code host sets CURSOR_* broadly; CURSOR_AGENT=1 flags the
     // agent specifically, so gate on it rather than the prefix.
-    { name: "cursor", matches: (env) => env["CURSOR_AGENT"] === "1" },
+    { name: 'cursor', matches: (env) => env['CURSOR_AGENT'] === '1' },
     // Antigravity is Google's successor to the (deprecated) gemini-cli.
-    { name: "antigravity", matches: (env) => env["ANTIGRAVITY_AGENT"] === "1" },
+    { name: 'antigravity', matches: (env) => env['ANTIGRAVITY_AGENT'] === '1' },
     // CODEX_CI seen in probe; CODEX_SANDBOX* appear under seatbelt. Match the
     // prefix so we catch a Codex run regardless of which of its vars are set.
-    { name: "codex", matches: (env) => hasVarWithPrefix(env, "CODEX_") },
-    { name: "hermes", matches: (env) => hasVarWithPrefix(env, "HERMES_") },
+    { name: 'codex', matches: (env) => hasVarWithPrefix(env, 'CODEX_') },
+    { name: 'hermes', matches: (env) => hasVarWithPrefix(env, 'HERMES_') },
     // Exact key, not a prefix: opencode writes OPENCODE=1 at startup, reads every OPENCODE_* as config.
-    { name: "opencode", matches: (env) => Boolean(env["OPENCODE"]) },
+    { name: 'opencode', matches: (env) => Boolean(env['OPENCODE']) },
     {
-        name: "claude-code",
-        matches: (env) => env["CLAUDECODE"] === "1" || Boolean(env["CLAUDE_CODE_ENTRYPOINT"]),
+        name: 'claude-code',
+        matches: (env) => env['CLAUDECODE'] === '1' || Boolean(env['CLAUDE_CODE_ENTRYPOINT']),
     },
 ];
 /** Returns the detected harness name, or null when none match. */

package/dist/lib/hermes-env.js

@@ -1,37 +1,37 @@
-import os from "node:os";
-import path from "node:path";
-import fs from "node:fs";
-import { randomUUID } from "node:crypto";
-import spawn from "cross-spawn";
-import { HARNESS_PROBE_TIMEOUT_MS } from "./constants.js";
-import { sanitizeLine } from "./output.js";
+import os from 'node:os';
+import path from 'node:path';
+import fs from 'node:fs';
+import { randomUUID } from 'node:crypto';
+import spawn from 'cross-spawn';
+import { HARNESS_PROBE_TIMEOUT_MS } from './constants.js';
+import { sanitizeLine } from './output.js';
 // display_hermes_home() abbreviates under $HOME, so the value is not always absolute.
 const HERMES_HOME_LINE = /^\s*hermes_home:\s*(\S.*?)\s*$/m;
 // One value: the next cold-start bump must move both probes together.
 export const HERMES_PROBE_TIMEOUT_MS = HARNESS_PROBE_TIMEOUT_MS;
 /** Asking Hermes beats reimplementing its profile override, which we'd drift from. */
 export function resolveHermesHome() {
-    const result = spawn.sync("hermes", ["dump"], {
-        encoding: "utf8",
-        env: { ...process.env, FORCE_COLOR: "0", NO_COLOR: "1" },
+    const result = spawn.sync('hermes', ['dump'], {
+        encoding: 'utf8',
+        env: { ...process.env, FORCE_COLOR: '0', NO_COLOR: '1' },
         timeout: HERMES_PROBE_TIMEOUT_MS,
     });
     if (result.error || result.status !== 0)
         return undefined;
-    const raw = HERMES_HOME_LINE.exec(sanitizeLine(`${result.stdout ?? ""}\n${result.stderr ?? ""}`))?.[1];
+    const raw = HERMES_HOME_LINE.exec(sanitizeLine(`${result.stdout ?? ''}\n${result.stderr ?? ''}`))?.[1];
     if (!raw)
         return undefined;
-    const expanded = raw === "~" || raw.startsWith("~/") ? path.join(os.homedir(), raw.slice(2)) : raw;
+    const expanded = raw === '~' || raw.startsWith('~/') ? path.join(os.homedir(), raw.slice(2)) : raw;
     return path.isAbsolute(expanded) ? expanded : undefined;
 }
-export const HERMES_KEY_VAR = "MCP_TINYFISH_API_KEY";
+export const HERMES_KEY_VAR = 'MCP_TINYFISH_API_KEY';
 const MARKER_HEAD = `# tinyfish-cli: TinyFish MCP key, managed by \`tinyfish connect hermes\``;
-const MARKER_TAIL = "# tinyfish-cli: end";
+const MARKER_TAIL = '# tinyfish-cli: end';
 // Keys are `sk-tinyfish-<alnum>`; refusing anything else beats shipping unreachable escaping.
 const BARE_SAFE = /^[A-Za-z0-9._\-/:+=]+$/;
 /** Mirrors Hermes' _env_line_defines_key: load_env() parses the export form too. */
 function definesKey(line) {
-    const stripped = line.trim().replace(/^export\s+/, "");
+    const stripped = line.trim().replace(/^export\s+/, '');
     return stripped.startsWith(`${HERMES_KEY_VAR}=`);
 }
 function isMarker(line) {
@@ -41,7 +41,10 @@ function isMarker(line) {
 function readLines(envPath) {
     if (!fs.existsSync(envPath))
         return [];
-    return fs.readFileSync(envPath, "utf8").replace(/^\uFEFF/, "").split(/(?<=\n)/);
+    return fs
+        .readFileSync(envPath, 'utf8')
+        .replace(/^\uFEFF/, '')
+        .split(/(?<=\n)/);
 }
 // Hermes preserves the original mode so Docker volume mounts survive (config.py:3921-3929).
 function writeAtomic(envPath, lines) {
@@ -54,7 +57,7 @@ function writeAtomic(envPath, lines) {
     }
     const tmp = `${envPath}.${randomUUID()}.tmp`;
     try {
-        fs.writeFileSync(tmp, lines.join(""), { encoding: "utf8", mode });
+        fs.writeFileSync(tmp, lines.join(''), { encoding: 'utf8', mode });
         // open() applies mode through umask; chmod bypasses it, preserving bits.
         fs.chmodSync(tmp, mode);
         fs.renameSync(tmp, envPath);
@@ -65,21 +68,21 @@ function writeAtomic(envPath, lines) {
     }
 }
 export function writeHermesKey(home, key) {
-    const clean = key.replace(/[\r\n]/g, "").trim();
+    const clean = key.replace(/[\r\n]/g, '').trim();
     // An empty key reads as "bad characters" without its own branch.
     if (!clean)
         throw new Error("TinyFish API key is empty; nothing to write to Hermes' .env");
     if (!BARE_SAFE.test(clean)) {
-        throw new Error("TinyFish API key contains characters that cannot be written to a .env file");
+        throw new Error('TinyFish API key contains characters that cannot be written to a .env file');
     }
-    const envPath = path.join(home, ".env");
+    const envPath = path.join(home, '.env');
     fs.mkdirSync(home, { recursive: true });
     const lines = readLines(envPath);
     const assignment = `${HERMES_KEY_VAR}=${clean}\n`;
     const index = lines.findIndex(definesKey);
     if (index < 0) {
-        if (lines.length && !lines[lines.length - 1].endsWith("\n"))
-            lines[lines.length - 1] += "\n";
+        if (lines.length && !lines[lines.length - 1].endsWith('\n'))
+            lines[lines.length - 1] += '\n';
         lines.push(`${MARKER_HEAD}\n`, assignment, `${MARKER_TAIL}\n`);
         writeAtomic(envPath, lines);
         return;
@@ -89,7 +92,7 @@ export function writeHermesKey(home, key) {
     writeAtomic(envPath, lines.filter((line, i) => i === index || !definesKey(line)));
 }
 export function removeHermesKey(home) {
-    const envPath = path.join(home, ".env");
+    const envPath = path.join(home, '.env');
     const lines = readLines(envPath);
     if (!lines.length)
         return false;

package/dist/lib/install-root.js

@@ -1,7 +1,7 @@
-import * as fs from "node:fs";
-import * as path from "node:path";
-import { fileURLToPath } from "node:url";
-import { TINYFISH_CLI_PACKAGE } from "./constants.js";
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { TINYFISH_CLI_PACKAGE } from './constants.js';
 function isDirectory(candidate) {
     try {
         return fs.statSync(candidate).isDirectory();
@@ -17,30 +17,30 @@ function isDirectory(candidate) {
  * installing into their trees would report a success the PATH binary never sees.
  */
 export function resolveInstallRoot(packageRoot, platform, onDisk = isDirectory) {
-    const p = platform === "win32" ? path.win32 : path.posix;
+    const p = platform === 'win32' ? path.win32 : path.posix;
     // npx's win32 cache uses the same bare layout as a global install.
-    if (packageRoot.split(p.sep).includes("_npx"))
+    if (packageRoot.split(p.sep).includes('_npx'))
         return null;
-    const nodeModules = p.resolve(packageRoot, "..", "..");
-    if (p.basename(nodeModules) !== "node_modules")
+    const nodeModules = p.resolve(packageRoot, '..', '..');
+    if (p.basename(nodeModules) !== 'node_modules')
         return null;
     const container = p.dirname(nodeModules);
     // Only win32 puts node_modules directly under the prefix.
-    if (platform !== "win32" && p.basename(container) !== "lib")
+    if (platform !== 'win32' && p.basename(container) !== 'lib')
         return null;
     if (!onDisk(nodeModules))
         return null;
-    return { prefix: platform === "win32" ? container : p.dirname(container), nodeModules };
+    return { prefix: platform === 'win32' ? container : p.dirname(container), nodeModules };
 }
 export function installRoot() {
     // Two levels up from dist/lib/ is the package root, and tsc mirrors src/ into dist/.
-    const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "..");
+    const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
     return resolveInstallRoot(packageRoot, process.platform);
 }
 /** The version on disk under a prefix, which is the only account of what `@latest` resolved to. */
 export function readInstalledVersion(nodeModules) {
     try {
-        const manifest = fs.readFileSync(path.join(nodeModules, ...TINYFISH_CLI_PACKAGE.split("/"), "package.json"), "utf8");
+        const manifest = fs.readFileSync(path.join(nodeModules, ...TINYFISH_CLI_PACKAGE.split('/'), 'package.json'), 'utf8');
         return JSON.parse(manifest).version ?? null;
     }
     catch {