@tiny-fish/cli 0.30.2-next.257 → 0.30.2-next.258

package/dist/lib/auth.js

@@ -1,38 +1,38 @@
-import * as fs from "fs";
-import * as os from "os";
-import * as path from "path";
-import spawn from "cross-spawn";
-import { err, errLine } from "./output.js";
-import { TINYFISH_API_KEY_VAR } from "./constants.js";
-const KEY_PREFIXES = ["sk-tinyfish-", "sk-mino-"];
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import spawn from 'cross-spawn';
+import { err, errLine } from './output.js';
+import { TINYFISH_API_KEY_VAR } from './constants.js';
+const KEY_PREFIXES = ['sk-tinyfish-', 'sk-mino-'];
 const MIN_KEY_LENGTH = 20;
-export { DASHBOARD_URL, getDashboardUrl } from "./constants.js";
+export { DASHBOARD_URL, getDashboardUrl } from './constants.js';
 export function configDir() {
     // os.homedir() is cross-platform; process.env.HOME is undefined on Windows
-    return path.join(os.homedir(), ".tinyfish");
+    return path.join(os.homedir(), '.tinyfish');
 }
 function configFile() {
-    return path.join(configDir(), "config.json");
+    return path.join(configDir(), 'config.json');
 }
 /** Install channel baked onto connect context; the connect flow is always CLI-driven. */
-export const CONNECT_SOURCE = "tinyfish_cli";
+export const CONNECT_SOURCE = 'tinyfish_cli';
 // An env var, not a flag: released CLIs ignore an unknown one, and the installer's PATH
 // prepend means a copied command can still run a CLI far older than the page that wrote it.
-export const CONNECT_ATTEMPT_ENV = "TINYFISH_CONNECT_ATTEMPT_ID";
-const RECORDED_AUTH_MODES = ["api-key", "oauth", "deferred"];
+export const CONNECT_ATTEMPT_ENV = 'TINYFISH_CONNECT_ATTEMPT_ID';
+const RECORDED_AUTH_MODES = ['api-key', 'oauth', 'deferred'];
 export function loadConfig() {
     try {
-        const raw = JSON.parse(fs.readFileSync(configFile(), "utf8"));
-        if (raw === null || typeof raw !== "object" || Array.isArray(raw))
+        const raw = JSON.parse(fs.readFileSync(configFile(), 'utf8'));
+        if (raw === null || typeof raw !== 'object' || Array.isArray(raw))
             return {};
         const obj = raw;
         const config = {};
-        if (typeof obj["api_key"] === "string")
-            config.api_key = obj["api_key"];
-        const connect = parseConnectMap(obj["connect"]);
+        if (typeof obj['api_key'] === 'string')
+            config.api_key = obj['api_key'];
+        const connect = parseConnectMap(obj['connect']);
         if (connect)
             config.connect = connect;
-        const pending = parsePendingAttempt(obj["pending_connect_attempt"]);
+        const pending = parsePendingAttempt(obj['pending_connect_attempt']);
         if (pending)
             config.pending_connect_attempt = pending;
         return config;
@@ -42,17 +42,17 @@ export function loadConfig() {
     }
 }
 function parseConnectMap(value) {
-    if (value === null || typeof value !== "object" || Array.isArray(value))
+    if (value === null || typeof value !== 'object' || Array.isArray(value))
         return undefined;
     const out = {};
     for (const [client, entry] of Object.entries(value)) {
         const record = entry;
         const attemptId = record?.attempt_id;
-        if (typeof attemptId !== "string")
+        if (typeof attemptId !== 'string')
             continue;
         const authMode = record?.auth_mode;
         out[client] =
-            typeof authMode === "string" && RECORDED_AUTH_MODES.includes(authMode)
+            typeof authMode === 'string' && RECORDED_AUTH_MODES.includes(authMode)
                 ? { attempt_id: attemptId, auth_mode: authMode }
                 : { attempt_id: attemptId };
     }
@@ -60,7 +60,7 @@ function parseConnectMap(value) {
 }
 function parsePendingAttempt(value) {
     const entry = value;
-    if (typeof entry?.id !== "string" || typeof entry.ts !== "number")
+    if (typeof entry?.id !== 'string' || typeof entry.ts !== 'number')
         return undefined;
     return isAttemptId(entry.id) ? { id: entry.id, ts: entry.ts } : undefined;
 }
@@ -146,24 +146,24 @@ export function saveConnectContext(client, attemptId, authMode) {
 export function connectContextState(client) {
     let raw;
     try {
-        raw = fs.readFileSync(configFile(), "utf8");
+        raw = fs.readFileSync(configFile(), 'utf8');
     }
     catch (e) {
-        return e.code === "ENOENT" ? "absent" : "unreadable";
+        return e.code === 'ENOENT' ? 'absent' : 'unreadable';
     }
     try {
         const parsed = JSON.parse(raw);
-        const entry = parsed && typeof parsed === "object" ? parsed.connect?.[client] : undefined;
-        return entry ? "present" : "absent";
+        const entry = parsed && typeof parsed === 'object' ? parsed.connect?.[client] : undefined;
+        return entry ? 'present' : 'absent';
     }
     catch {
-        return "unreadable";
+        return 'unreadable';
     }
 }
 /** Kept marker after uninstall makes doctor offer to reinstall the harness. */
 export function clearConnectContext(client) {
     // Read-first: writing through an unreadable config would rewrite it as {}.
-    if (connectContextState(client) !== "present")
+    if (connectContextState(client) !== 'present')
         return;
     try {
         updateConfig((config) => {
@@ -181,40 +181,40 @@ export function clearConnectContext(client) {
 }
 export function persistApiKeyToEnvironment(apiKey, options = {}) {
     const platform = options.platform ?? process.platform;
-    if (platform === "win32") {
-        const result = spawn.sync("setx", [TINYFISH_API_KEY_VAR, apiKey], { stdio: "ignore" });
+    if (platform === 'win32') {
+        const result = spawn.sync('setx', [TINYFISH_API_KEY_VAR, apiKey], { stdio: 'ignore' });
         if (result.error || result.status !== 0) {
-            throw new Error("Could not set TINYFISH_API_KEY in the Windows user environment", {
+            throw new Error('Could not set TINYFISH_API_KEY in the Windows user environment', {
                 cause: result.error,
             });
         }
         return;
     }
     const home = os.homedir();
-    const shell = path.basename(options.shell ?? process.env["SHELL"] ?? "");
-    const fish = shell === "fish";
-    const macBashProfile = [".bash_profile", ".bash_login", ".profile"]
+    const shell = path.basename(options.shell ?? process.env['SHELL'] ?? '');
+    const fish = shell === 'fish';
+    const macBashProfile = ['.bash_profile', '.bash_login', '.profile']
         .map((name) => path.join(home, name)) // nosemgrep: path-join-resolve-traversal -- fixed filenames under os.homedir()
-        .find((candidate) => fs.existsSync(candidate)) ?? path.join(home, ".bash_profile");
-    const profile = shell === "zsh"
-        ? path.join(home, ".zshrc")
-        : shell === "bash"
-            ? platform === "darwin"
+        .find((candidate) => fs.existsSync(candidate)) ?? path.join(home, '.bash_profile');
+    const profile = shell === 'zsh'
+        ? path.join(home, '.zshrc')
+        : shell === 'bash'
+            ? platform === 'darwin'
                 ? macBashProfile
-                : path.join(home, ".bashrc")
+                : path.join(home, '.bashrc')
             : fish
-                ? path.join(home, ".config", "fish", "config.fish")
-                : path.join(home, ".profile");
+                ? path.join(home, '.config', 'fish', 'config.fish')
+                : path.join(home, '.profile');
     const quotedKey = `'${apiKey.replaceAll("'", "'\\''")}'`;
     const prefix = fish ? `set -gx ${TINYFISH_API_KEY_VAR} ` : `export ${TINYFISH_API_KEY_VAR}=`;
     const assignment = `${prefix}${quotedKey}`;
-    const existing = fs.existsSync(profile) ? fs.readFileSync(profile, "utf8") : "";
+    const existing = fs.existsSync(profile) ? fs.readFileSync(profile, 'utf8') : '';
     // Drops prior assignments, so repeated logins do not stack stale keys.
     const cleaned = existing
-        .split("\n")
+        .split('\n')
         .filter((line) => !line.startsWith(prefix))
-        .join("\n");
-    const updated = `${cleaned}${cleaned && !cleaned.endsWith("\n") ? "\n" : ""}${assignment}\n`;
+        .join('\n');
+    const updated = `${cleaned}${cleaned && !cleaned.endsWith('\n') ? '\n' : ''}${assignment}\n`;
     fs.mkdirSync(path.dirname(profile), { recursive: true });
     fs.writeFileSync(profile, updated, { mode: 0o600 });
     fs.chmodSync(profile, 0o600);
@@ -250,19 +250,19 @@ export function validateKeyFormat(key) {
 }
 export function maskKey(key) {
     if (key.length <= 8)
-        return "***";
-    return key.slice(0, 12) + "..." + key.slice(-4);
+        return '***';
+    return key.slice(0, 12) + '...' + key.slice(-4);
 }
 // The one flag/env/config precedence chain; `source` says which place a caller must name.
 function lookupApiKey(explicitApiKey) {
     if (explicitApiKey)
-        return { value: explicitApiKey, source: "explicit" };
+        return { value: explicitApiKey, source: 'explicit' };
     const envKey = process.env[TINYFISH_API_KEY_VAR];
     if (envKey)
-        return { value: envKey, source: "env" };
+        return { value: envKey, source: 'env' };
     // No try/catch: loadConfig swallows its own errors and returns {}.
     const stored = loadConfig().api_key;
-    return stored ? { value: stored, source: "config" } : { source: "none" };
+    return stored ? { value: stored, source: 'config' } : { source: 'none' };
 }
 /** Key for optional paths (telemetry, auth probes) — absent is a valid answer, so never exits. */
 export function resolvedApiKey(explicitApiKey) {
@@ -283,19 +283,19 @@ export function validatedApiKey(explicitApiKey) {
  */
 export function apiKeyStatus() {
     const { value, source } = lookupApiKey();
-    if (!value || source === "none") {
-        return { error: "No API key found. Run: tinyfish auth login", source: "none" };
+    if (!value || source === 'none') {
+        return { error: 'No API key found. Run: tinyfish auth login', source: 'none' };
     }
     // Shape is the server's call. A local prefix rule turns a key format we have not shipped
     // support for yet into a hard failure the user cannot work around, and the 401 says more.
     if (!isHeaderSafe(value)) {
-        return { error: "The API key contains control characters and cannot be sent", source };
+        return { error: 'The API key contains control characters and cannot be sent', source };
     }
     return { key: value, source };
 }
 export function getApiKey() {
     const resolved = apiKeyStatus();
-    if ("key" in resolved)
+    if ('key' in resolved)
         return resolved.key;
     err({ error: resolved.error });
     process.exit(1);

package/dist/lib/batch-store.d.ts

@@ -1,4 +1,4 @@
-import type { LocalBatch } from "./types.js";
+import type { LocalBatch } from './types.js';
 export declare function loadBatches(): LocalBatch[];
 /** Appends `batch` to the persistent store. Reads existing entries first. */
 export declare function saveBatch(batch: LocalBatch): void;

package/dist/lib/batch-store.js

@@ -1,19 +1,19 @@
-import * as fs from "fs";
-import { configDir } from "./auth.js";
+import * as fs from 'fs';
+import { configDir } from './auth.js';
 function batchesFile() {
     return `${configDir()}/batches.json`;
 }
 export function loadBatches() {
     const file = batchesFile();
     try {
-        const raw = JSON.parse(fs.readFileSync(file, "utf8"));
+        const raw = JSON.parse(fs.readFileSync(file, 'utf8'));
         if (Array.isArray(raw))
             return raw;
         return [];
     }
     catch (e) {
         // File does not exist — treat as empty store (expected on first use)
-        if (typeof e === "object" && e !== null && e.code === "ENOENT")
+        if (typeof e === 'object' && e !== null && e.code === 'ENOENT')
             return [];
         // Any other error (corrupt JSON, permission denied) — rethrow rather than
         // silently returning [] and risking saveBatch() overwriting the store.

package/dist/lib/chrome-cookies.d.ts

@@ -1,4 +1,4 @@
-import type { CookieRecord } from "./types.js";
+import type { CookieRecord } from './types.js';
 export interface CookiesDb {
     prepare(sql: string): {
         all(...params: string[]): unknown[];

package/dist/lib/chrome-cookies.js

@@ -1,7 +1,7 @@
-import { execFileSync } from "node:child_process";
-import { createDecipheriv, pbkdf2Sync } from "node:crypto";
-import { createRequire } from "node:module";
-import { z } from "zod";
+import { execFileSync } from 'node:child_process';
+import { createDecipheriv, pbkdf2Sync } from 'node:crypto';
+import { createRequire } from 'node:module';
+import { z } from 'zod';
 // Reads Chrome's `Cookies` SQLite DB and decrypts values with the Safe Storage key.
 // Scheme per platform (Windows is unsupported and guarded by the caller):
 //   macOS — password from the login keychain, pbkdf2(pw, "saltysalt", 1003, 16, sha1)
@@ -9,50 +9,50 @@ import { z } from "zod";
 // Values are AES-128-CBC with a 16-space IV, prefixed "v10"/"v11", and modern Chrome
 // prepends a 32-byte domain hash to the plaintext.
 const KEY_LENGTH = 16;
-const SALT = "saltysalt";
-const CBC_IV = Buffer.alloc(KEY_LENGTH, " ");
+const SALT = 'saltysalt';
+const CBC_IV = Buffer.alloc(KEY_LENGTH, ' ');
 const DOMAIN_HASH_LENGTH = 32;
-const SUPPORTED_PREFIXES = ["v10", "v11"];
+const SUPPORTED_PREFIXES = ['v10', 'v11'];
 // Chrome-internal timestamp (microseconds since 1601-01-01) → Unix seconds
 const CHROME_EPOCH_DELTA_SECONDS = 11644473600;
 export function openCookiesDb(dbPath) {
     // node:sqlite is stable on the Node >=24 floor in `engines`; createRequire avoids
     // needing @types/node >=22 for the import type.
-    const { DatabaseSync } = createRequire(import.meta.url)("node:sqlite");
+    const { DatabaseSync } = createRequire(import.meta.url)('node:sqlite');
     return new DatabaseSync(dbPath);
 }
 export function deriveChromeKey() {
-    if (process.platform !== "darwin") {
-        return pbkdf2Sync("peanuts", SALT, 1, KEY_LENGTH, "sha1");
+    if (process.platform !== 'darwin') {
+        return pbkdf2Sync('peanuts', SALT, 1, KEY_LENGTH, 'sha1');
     }
     let password;
     try {
-        password = execFileSync("/usr/bin/security", ["find-generic-password", "-w", "-s", "Chrome Safe Storage", "-a", "Chrome"], 
+        password = execFileSync('/usr/bin/security', ['find-generic-password', '-w', '-s', 'Chrome Safe Storage', '-a', 'Chrome'], 
         // stderr is dropped so `security` diagnostics never pollute our JSON output.
-        { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+        { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
     }
     catch {
         // Deliberately not chaining the cause — it can carry keychain material.
         throw new Error('Could not read Chrome\'s encryption key from the macOS keychain. Approve the Keychain prompt ("Always Allow") and retry.');
     }
-    return pbkdf2Sync(password, SALT, 1003, KEY_LENGTH, "sha1");
+    return pbkdf2Sync(password, SALT, 1003, KEY_LENGTH, 'sha1');
 }
 // Returns null when the row cannot be decrypted — a wrong-key decrypt yields garbage,
 // which would silently upload broken cookies.
 export function decryptCookieValue(encrypted, key, stats) {
-    const prefix = Buffer.from(encrypted.subarray(0, 3)).toString("latin1");
+    const prefix = Buffer.from(encrypted.subarray(0, 3)).toString('latin1');
     if (!SUPPORTED_PREFIXES.includes(prefix))
         return null;
     // Off macOS the key is Chrome's v10 "peanuts" fallback; v11 rows are
     // keyring-encrypted and would decrypt to garbage with it.
-    if (prefix === "v11" && process.platform !== "darwin") {
+    if (prefix === 'v11' && process.platform !== 'darwin') {
         if (stats)
             stats.keyringSkipped++;
         return null;
     }
     let decoded;
     try {
-        const decipher = createDecipheriv("aes-128-cbc", key, CBC_IV);
+        const decipher = createDecipheriv('aes-128-cbc', key, CBC_IV);
         decipher.setAutoPadding(false);
         decoded = Buffer.concat([decipher.update(encrypted.subarray(3)), decipher.final()]);
     }
@@ -64,7 +64,7 @@ export function decryptCookieValue(encrypted, key, stats) {
     const padding = decoded[decoded.length - 1];
     // A zero final byte means a legacy row with no padding and no domain-hash prefix.
     if (!padding)
-        return decoded.toString("utf8");
+        return decoded.toString('utf8');
     // Wrong-key decrypts yield random bytes; require valid PKCS#7 padding or skip the row.
     if (padding > KEY_LENGTH || decoded.length - padding < DOMAIN_HASH_LENGTH)
         return null;
@@ -72,18 +72,18 @@ export function decryptCookieValue(encrypted, key, stats) {
         if (decoded[i] !== padding)
             return null;
     }
-    return decoded.subarray(DOMAIN_HASH_LENGTH, decoded.length - padding).toString("utf8");
+    return decoded.subarray(DOMAIN_HASH_LENGTH, decoded.length - padding).toString('utf8');
 }
 // A cookie applies to a host when its host_key is the host itself or one of its
 // dot-delimited parents (RFC 6265 §5.1.3), with Chrome's optional leading dot.
 // Public-suffix parents (github.io, co.uk) are dropped — a row there would leak
 // into every registrable domain under the suffix.
 function hostKeyCandidates(host) {
-    const { parse } = createRequire(import.meta.url)("tldts");
-    const labels = host.split(".");
+    const { parse } = createRequire(import.meta.url)('tldts');
+    const labels = host.split('.');
     const parents = labels
         .slice(1, -1)
-        .map((_, i) => labels.slice(i + 1).join("."))
+        .map((_, i) => labels.slice(i + 1).join('.'))
         .filter((p) => parse(p, { allowPrivateDomains: true }).domain);
     return [host, ...parents].flatMap((h) => [h, `.${h}`]);
 }
@@ -126,7 +126,7 @@ export function readCookiesForHost(db, key, host, stats) {
     `SELECT host_key, name, value, encrypted_value, is_secure, is_httponly,
               CAST(expires_utc AS REAL) AS expires_utc
          FROM cookies
-        WHERE path = '/' AND host_key IN (${candidates.map(() => "?").join(", ")})
+        WHERE path = '/' AND host_key IN (${candidates.map(() => '?').join(', ')})
         ORDER BY creation_utc DESC`)
         .all(...candidates);
     // Malformed rows are skipped, matching the decrypt-failure policy.
@@ -141,7 +141,7 @@ export function readCookiesForHost(db, key, host, stats) {
         if (seen.has(row.name))
             continue;
         let value = row.value;
-        if (value === "" && row.encrypted_value.length > 0) {
+        if (value === '' && row.encrypted_value.length > 0) {
             const decrypted = decryptCookieValue(row.encrypted_value, key, stats);
             if (decrypted === null)
                 continue;
@@ -152,7 +152,7 @@ export function readCookiesForHost(db, key, host, stats) {
             name: row.name,
             value,
             domain: row.host_key,
-            path: "/",
+            path: '/',
             secure: row.is_secure === 1,
             httpOnly: row.is_httponly === 1,
             ...(row.expires_utc > 0

package/dist/lib/claude-config.js

@@ -1,45 +1,45 @@
-import * as fs from "fs";
-import * as os from "os";
-import * as path from "path";
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
 // ─── Path helpers ─────────────────────────────────────────────────────────────
 export function claudeDir() {
-    return path.join(os.homedir(), ".claude");
+    return path.join(os.homedir(), '.claude');
 }
 export function claudeSettingsPath() {
-    return path.join(claudeDir(), "settings.json");
+    return path.join(claudeDir(), 'settings.json');
 }
 export function claudeMdPath() {
-    return path.join(claudeDir(), "CLAUDE.md");
+    return path.join(claudeDir(), 'CLAUDE.md');
 }
 // ─── Constants ────────────────────────────────────────────────────────────────
-export const TINYFISH_PERMISSION = "Bash(tinyfish:*)";
+export const TINYFISH_PERMISSION = 'Bash(tinyfish:*)';
 const TINYFISH_WEBFETCH_HOOK = {
-    matcher: "WebFetch",
+    matcher: 'WebFetch',
     hooks: [
         {
-            type: "command",
-            command: "echo '{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"allow\",\"additionalContext\":\"Follow the instructions about which fetch provider to use, listed in your Claude.md file\"}}'",
+            type: 'command',
+            command: 'echo \'{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow","additionalContext":"Follow the instructions about which fetch provider to use, listed in your Claude.md file"}}\'',
         },
     ],
 };
 const TINYFISH_WEBSEARCH_HOOK = {
-    matcher: "WebSearch",
+    matcher: 'WebSearch',
     hooks: [
         {
-            type: "command",
-            command: "echo '{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"allow\",\"additionalContext\":\"Follow the instructions about which search provider to use, listed in your Claude.md file\"}}'",
+            type: 'command',
+            command: 'echo \'{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow","additionalContext":"Follow the instructions about which search provider to use, listed in your Claude.md file"}}\'',
         },
     ],
 };
 const TINYFISH_SUBAGENT_HOOK = {
     hooks: [
         {
-            type: "command",
+            type: 'command',
             command: 'echo \'{"hookSpecificOutput":{"hookEventName":"SubagentStart","additionalContext":"The user prefers TinyFish for web operations. Use `tinyfish search query \\\\"<query>\\\\"` instead of WebSearch and `tinyfish fetch content get \\\\"<url>\\\\"` instead of WebFetch. Run them via the Bash tool. Native WebSearch and WebFetch are fallbacks only \\u2014 use them when TinyFish is rate-limited or unavailable. A PreToolUse hook will remind you if you reach for native tools. Refer to your claude.md for details"}}\'',
         },
     ],
 };
-export const CLAUDE_MD_MARKER = "<!-- tinyfish-configure-claude -->";
+export const CLAUDE_MD_MARKER = '<!-- tinyfish-configure-claude -->';
 export const CLAUDE_MD_BLOCK = `${CLAUDE_MD_MARKER}
 ## WebSearch or Search
 When looking to use Search or WebSearch, always use the TinyFish Web Search tool, run \`tinyfish search query "<query>"\`
@@ -50,38 +50,38 @@ When looking to use Fetch or WebFetch, always use the TinyFish Fetch tool, run \
 Only fall back to native Fetch when you get rate limited by tinyfish (for a minute, then you can try using tinyfish again)
 ${CLAUDE_MD_MARKER}`;
 function isTinyfishPreToolUseHook(entry) {
-    if (typeof entry !== "object" || entry === null)
+    if (typeof entry !== 'object' || entry === null)
         return false;
     const obj = entry;
-    if (obj.matcher !== "WebFetch" && obj.matcher !== "WebSearch")
+    if (obj.matcher !== 'WebFetch' && obj.matcher !== 'WebSearch')
         return false;
     const hooks = obj.hooks;
     if (!Array.isArray(hooks) || hooks.length === 0)
         return false;
     const first = hooks[0];
-    return typeof first.command === "string" && first.command.includes("provider to use");
+    return typeof first.command === 'string' && first.command.includes('provider to use');
 }
 function isTinyfishSubagentHook(entry) {
-    if (typeof entry !== "object" || entry === null)
+    if (typeof entry !== 'object' || entry === null)
         return false;
     const hooks = entry.hooks;
     if (!Array.isArray(hooks) || hooks.length === 0)
         return false;
     const first = hooks[0];
-    return typeof first.command === "string" && first.command.includes("TinyFish");
+    return typeof first.command === 'string' && first.command.includes('TinyFish');
 }
 // ─── settings.json I/O ───────────────────────────────────────────────────────
 export function readSettingsJson() {
     try {
-        const raw = fs.readFileSync(claudeSettingsPath(), "utf8");
+        const raw = fs.readFileSync(claudeSettingsPath(), 'utf8');
         const parsed = JSON.parse(raw);
-        if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)) {
+        if (parsed !== null && typeof parsed === 'object' && !Array.isArray(parsed)) {
             return parsed;
         }
-        throw new Error("settings.json root is not a JSON object");
+        throw new Error('settings.json root is not a JSON object');
     }
     catch (e) {
-        if (typeof e === "object" && e !== null && e.code === "ENOENT") {
+        if (typeof e === 'object' && e !== null && e.code === 'ENOENT') {
             return {};
         }
         throw e;
@@ -89,7 +89,7 @@ export function readSettingsJson() {
 }
 export function writeSettingsJson(settings) {
     fs.mkdirSync(claudeDir(), { recursive: true });
-    fs.writeFileSync(claudeSettingsPath(), JSON.stringify(settings, null, 2) + "\n");
+    fs.writeFileSync(claudeSettingsPath(), JSON.stringify(settings, null, 2) + '\n');
 }
 // ─── settings.json merge / remove ─────────────────────────────────────────────
 export function mergeSettings(existing) {
@@ -119,7 +119,7 @@ export function removeFromSettings(existing) {
             result.permissions = { ...permissions, allow: filtered };
         }
         else {
-            const rest = Object.fromEntries(Object.entries(permissions).filter(([k]) => k !== "allow"));
+            const rest = Object.fromEntries(Object.entries(permissions).filter(([k]) => k !== 'allow'));
             result.permissions = Object.keys(rest).length > 0 ? rest : undefined;
         }
     }
@@ -140,11 +140,11 @@ export function removeFromSettings(existing) {
 // ─── CLAUDE.md I/O ────────────────────────────────────────────────────────────
 export function readClaudeMd() {
     try {
-        return fs.readFileSync(claudeMdPath(), "utf8");
+        return fs.readFileSync(claudeMdPath(), 'utf8');
     }
     catch (e) {
-        if (typeof e === "object" && e !== null && e.code === "ENOENT") {
-            return "";
+        if (typeof e === 'object' && e !== null && e.code === 'ENOENT') {
+            return '';
         }
         throw e;
     }
@@ -155,9 +155,9 @@ export function writeClaudeMd(content) {
 }
 // ─── CLAUDE.md merge / remove ─────────────────────────────────────────────────
 function escapeRegExp(s) {
-    return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
-const MARKER_REGEX = new RegExp(`${escapeRegExp(CLAUDE_MD_MARKER)}[\\s\\S]*?${escapeRegExp(CLAUDE_MD_MARKER)}`, "m");
+const MARKER_REGEX = new RegExp(`${escapeRegExp(CLAUDE_MD_MARKER)}[\\s\\S]*?${escapeRegExp(CLAUDE_MD_MARKER)}`, 'm');
 const LEGACY_REGEX = /## Web(?:Search|Seach) or Search[\s\S]*?(?:tinyfish fetch[^\n]*\n(?:[^\n]*tinyfish[^\n]*\n)*[^\n]*)\n*/m;
 export function hasMarker(content) {
     return content.includes(CLAUDE_MD_MARKER);
@@ -170,22 +170,22 @@ export function mergeClaudeMd(existing) {
         return { content: existing.replace(MARKER_REGEX, CLAUDE_MD_BLOCK), replaced: true };
     }
     if (hasLegacyBlock(existing)) {
-        const cleaned = existing.replace(LEGACY_REGEX, "").trim();
-        const content = cleaned.length > 0 ? CLAUDE_MD_BLOCK + "\n\n" + cleaned + "\n" : CLAUDE_MD_BLOCK + "\n";
+        const cleaned = existing.replace(LEGACY_REGEX, '').trim();
+        const content = cleaned.length > 0 ? CLAUDE_MD_BLOCK + '\n\n' + cleaned + '\n' : CLAUDE_MD_BLOCK + '\n';
         return { content, replaced: true };
     }
     if (existing.trim().length === 0) {
-        return { content: CLAUDE_MD_BLOCK + "\n", replaced: false };
+        return { content: CLAUDE_MD_BLOCK + '\n', replaced: false };
     }
-    return { content: CLAUDE_MD_BLOCK + "\n\n" + existing, replaced: false };
+    return { content: CLAUDE_MD_BLOCK + '\n\n' + existing, replaced: false };
 }
 export function removeFromClaudeMd(existing) {
     if (!existing.includes(CLAUDE_MD_MARKER))
         return existing;
     const removed = existing
-        .replace(new RegExp(`${escapeRegExp(CLAUDE_MD_MARKER)}[\\s\\S]*?${escapeRegExp(CLAUDE_MD_MARKER)}\\n*`, "m"), "")
+        .replace(new RegExp(`${escapeRegExp(CLAUDE_MD_MARKER)}[\\s\\S]*?${escapeRegExp(CLAUDE_MD_MARKER)}\\n*`, 'm'), '')
         .trim();
-    return removed.length > 0 ? removed + "\n" : "";
+    return removed.length > 0 ? removed + '\n' : '';
 }
 // ─── Detection ────────────────────────────────────────────────────────────────
 export function isTinyfishConfiguredInSettings(settings) {

package/dist/lib/cli-install.js

@@ -1,8 +1,8 @@
-import spawn from "cross-spawn";
-import { spawnStepError } from "./connect-runtime.js";
-import { TINYFISH_CLI_PACKAGE } from "./constants.js";
-import { installRoot } from "./install-root.js";
-import { errLine } from "./output.js";
+import spawn from 'cross-spawn';
+import { spawnStepError } from './connect-runtime.js';
+import { TINYFISH_CLI_PACKAGE } from './constants.js';
+import { installRoot } from './install-root.js';
+import { errLine } from './output.js';
 export const SKILL_INSTALL_TIMEOUT_MS = 120_000;
 const TINYFISH_CLI_INSTALL_SPEC = `${TINYFISH_CLI_PACKAGE}@latest`;
 // spawnSync caps piped output at 1 MiB by default.
@@ -12,15 +12,15 @@ export class HoistedFailureReportedError extends Error {
 }
 export function captureStdio(verbose) {
     return verbose
-        ? { stdio: "inherit", timeout: SKILL_INSTALL_TIMEOUT_MS }
-        : { encoding: "utf8", maxBuffer: STEP_MAX_BUFFER, timeout: SKILL_INSTALL_TIMEOUT_MS };
+        ? { stdio: 'inherit', timeout: SKILL_INSTALL_TIMEOUT_MS }
+        : { encoding: 'utf8', maxBuffer: STEP_MAX_BUFFER, timeout: SKILL_INSTALL_TIMEOUT_MS };
 }
 /** Inherited stdio leaves these null; only piped runs yield text. */
 export function capturedOutput(result) {
     return `${asText(result.stdout)}${asText(result.stderr)}`;
 }
 function asText(stream) {
-    return typeof stream === "string" ? stream : "";
+    return typeof stream === 'string' ? stream : '';
 }
 /** A verbose run captured nothing, so this is a no-op. */
 export function replay(output) {
@@ -29,14 +29,14 @@ export function replay(output) {
 }
 export function installTinyFishCli({ verbose, announce }) {
     if (announce ?? verbose)
-        errLine("Installing the TinyFish CLI...");
+        errLine('Installing the TinyFish CLI...');
     // Without the prefix, a curl install upgrades npm's global tree and never the PATH binary.
     const root = installRoot();
-    const prefixArgs = root ? ["--prefix", root.prefix] : [];
-    const result = spawn.sync("npm", ["install", "--global", ...prefixArgs, TINYFISH_CLI_INSTALL_SPEC], captureStdio(verbose));
+    const prefixArgs = root ? ['--prefix', root.prefix] : [];
+    const result = spawn.sync('npm', ['install', '--global', ...prefixArgs, TINYFISH_CLI_INSTALL_SPEC], captureStdio(verbose));
     if (result.error || result.status !== 0) {
         // Built first: it runs the interrupt check, and abandonment must not replay.
-        const error = spawnStepError("Could not install the TinyFish CLI", result);
+        const error = spawnStepError('Could not install the TinyFish CLI', result);
         replay(capturedOutput(result));
         throw error;
     }