@tiny-fish/cli 0.30.2-next.259 → 0.30.2-next.264

package/dist/commands/batch.js

@@ -65,167 +65,166 @@ function parseCsv(content) {
         return { url: urlField.value, goal: goalField.value };
     });
 }
-// ── register ──────────────────────────────────────────────────────────────────
+async function batchRunAction(opts) {
+    // Read CSV file
+    let csvContent;
+    try {
+        csvContent = fs.readFileSync(opts.input, 'utf8');
+    }
+    catch {
+        err({ error: `Cannot read file: ${opts.input}` });
+        process.exit(1);
+    }
+    // Parse CSV — throws on any malformed input
+    let runs;
+    try {
+        runs = parseCsv(csvContent);
+    }
+    catch (e) {
+        err({
+            error: String(e instanceof Error ? e.message : e),
+            recommended_action: 'Fix the CSV file and try again',
+        });
+        process.exit(1);
+    }
+    const apiKey = getApiKey();
+    const response = await submitBatch({ runs }, apiKey).catch(handleApiError);
+    // Surface application-level errors from the API before persisting
+    if (response.error)
+        handleApiError(response.error);
+    const runIds = response.run_ids;
+    if (!runIds || runIds.length === 0) {
+        err({
+            error: 'Batch submission returned no run IDs',
+            recommended_action: 'Check the API key and try again',
+        });
+        process.exit(1);
+    }
+    const submitted = runIds.length;
+    const batchId = randomUUID();
+    const createdAt = new Date().toISOString();
+    const batch = {
+        batch_id: batchId,
+        run_ids: runIds,
+        total: runs.length,
+        submitted,
+        created_at: createdAt,
+    };
+    saveBatch(batch);
+    const resultsUrl = `${BASE_URL}/runs`;
+    if (opts.pretty) {
+        outLine('Batch submitted');
+        outLine(`ID:        ${batchId}`);
+        outLine(`Total:     ${runs.length}`);
+        outLine(`Submitted: ${submitted}`);
+        outLine(`Runs URL:  ${resultsUrl}`);
+    }
+    else {
+        out({
+            data: { batch_id: batchId, total: runs.length, submitted, results_url: resultsUrl },
+        });
+    }
+}
+function batchListAction(opts) {
+    const batches = loadBatches();
+    if (opts.pretty) {
+        if (batches.length === 0) {
+            outLine('No batches found.');
+            return;
+        }
+        outLine(`${'BATCH ID'.padEnd(38)}  ${'TOTAL'.padEnd(6)}  ${'SUBMITTED'.padEnd(9)}  CREATED AT`);
+        outLine(`${'-'.repeat(38)}  ${'-'.repeat(6)}  ${'-'.repeat(9)}  ${'-'.repeat(24)}`);
+        for (const b of batches) {
+            outLine(`${b.batch_id.padEnd(38)}  ${String(b.total).padEnd(6)}  ${String(b.submitted).padEnd(9)}  ${b.created_at}`);
+        }
+    }
+    else {
+        out(batches);
+    }
+}
+async function batchGetAction(batchId, opts) {
+    const batch = findBatch(batchId);
+    if (!batch) {
+        err({ error: `Batch not found: ${batchId}` });
+        process.exit(1);
+    }
+    const apiKey = getApiKey();
+    const response = await getBatchRuns(batch.run_ids, apiKey).catch(handleApiError);
+    if (opts.pretty) {
+        outLine(`Batch:     ${batchId}`);
+        outLine(`Total:     ${batch.total}`);
+        outLine(`Found:     ${response.data.length}`);
+        if (response.not_found && response.not_found.length > 0) {
+            outLine(`Not found: ${response.not_found.length}`);
+        }
+        for (const run of response.data) {
+            outLine('');
+            outLine(`Run:    ${run.run_id}`);
+            outLine(`Status: ${run.status}${run.num_of_steps != null ? `  (${run.num_of_steps} steps)` : ''}`);
+            outLine(`Goal:   ${run.goal}`);
+            if (run.result != null) {
+                outLine(`Result: ${JSON.stringify(run.result, null, 2).replace(/\n/g, '\n        ')}`);
+            }
+            else if (run.error) {
+                outLine(`Error:  ${JSON.stringify(run.error)}`);
+            }
+        }
+    }
+    else {
+        out({ batch_id: batchId, ...response });
+    }
+}
+async function batchCancelAction(batchId, opts) {
+    const batch = findBatch(batchId);
+    if (!batch) {
+        err({ error: `Batch not found: ${batchId}` });
+        process.exit(1);
+    }
+    const apiKey = getApiKey();
+    const response = await cancelBatchRuns(batch.run_ids, apiKey).catch(handleApiError);
+    if (opts.pretty) {
+        const cancelled = response.results.filter((r) => r.status === 'CANCELLED').length;
+        outLine(`Batch ${batchId}: ${cancelled}/${response.results.length} run(s) cancelled.`);
+        if (response.results.length > 0) {
+            outLine('');
+            outLine(`${'RUN ID'.padEnd(36)}  ${'STATUS'.padEnd(10)}  CANCELLED AT`);
+            outLine(`${'-'.repeat(36)}  ${'-'.repeat(10)}  ${'-'.repeat(24)}`);
+            for (const r of response.results) {
+                outLine(`${r.run_id.padEnd(36)}  ${r.status.padEnd(10)}  ${r.cancelled_at ?? '-'}`);
+            }
+        }
+        if (response.not_found && response.not_found.length > 0) {
+            outLine(`\nNot found: ${response.not_found.join(', ')}`);
+        }
+    }
+    else {
+        out(response);
+    }
+}
 export function registerBatch(agentCmd) {
     const batchCmd = agentCmd
         .command('batch')
         .description('Batch run operations')
         .enablePositionalOptions();
-    // ── batch run ───────────────────────────────────────────────────────────────
     batchCmd
         .command('run')
         .description('Submit a batch of runs from a CSV file (columns: url,goal)')
         .requiredOption('--input <file>', 'Path to CSV file with columns: url,goal')
         .option('--pretty', 'Human-readable output')
-        .action(async (opts) => {
-        // Read CSV file
-        let csvContent;
-        try {
-            csvContent = fs.readFileSync(opts.input, 'utf8');
-        }
-        catch {
-            err({ error: `Cannot read file: ${opts.input}` });
-            process.exit(1);
-        }
-        // Parse CSV — throws on any malformed input
-        let runs;
-        try {
-            runs = parseCsv(csvContent);
-        }
-        catch (e) {
-            err({
-                error: String(e instanceof Error ? e.message : e),
-                recommended_action: 'Fix the CSV file and try again',
-            });
-            process.exit(1);
-        }
-        const apiKey = getApiKey();
-        const response = await submitBatch({ runs }, apiKey).catch(handleApiError);
-        // Surface application-level errors from the API before persisting
-        if (response.error)
-            handleApiError(response.error);
-        const runIds = response.run_ids;
-        if (!runIds || runIds.length === 0) {
-            err({
-                error: 'Batch submission returned no run IDs',
-                recommended_action: 'Check the API key and try again',
-            });
-            process.exit(1);
-        }
-        const submitted = runIds.length;
-        const batchId = randomUUID();
-        const createdAt = new Date().toISOString();
-        const batch = {
-            batch_id: batchId,
-            run_ids: runIds,
-            total: runs.length,
-            submitted,
-            created_at: createdAt,
-        };
-        saveBatch(batch);
-        const resultsUrl = `${BASE_URL}/runs`;
-        if (opts.pretty) {
-            outLine('Batch submitted');
-            outLine(`ID:        ${batchId}`);
-            outLine(`Total:     ${runs.length}`);
-            outLine(`Submitted: ${submitted}`);
-            outLine(`Runs URL:  ${resultsUrl}`);
-        }
-        else {
-            out({
-                data: { batch_id: batchId, total: runs.length, submitted, results_url: resultsUrl },
-            });
-        }
-    });
-    // ── batch list ──────────────────────────────────────────────────────────────
+        .action(batchRunAction);
     batchCmd
         .command('list')
         .description('List locally tracked batches')
         .option('--pretty', 'Human-readable output')
-        .action((opts) => {
-        const batches = loadBatches();
-        if (opts.pretty) {
-            if (batches.length === 0) {
-                outLine('No batches found.');
-                return;
-            }
-            outLine(`${'BATCH ID'.padEnd(38)}  ${'TOTAL'.padEnd(6)}  ${'SUBMITTED'.padEnd(9)}  CREATED AT`);
-            outLine(`${'-'.repeat(38)}  ${'-'.repeat(6)}  ${'-'.repeat(9)}  ${'-'.repeat(24)}`);
-            for (const b of batches) {
-                outLine(`${b.batch_id.padEnd(38)}  ${String(b.total).padEnd(6)}  ${String(b.submitted).padEnd(9)}  ${b.created_at}`);
-            }
-        }
-        else {
-            out(batches);
-        }
-    });
-    // ── batch get ───────────────────────────────────────────────────────────────
+        .action(batchListAction);
     batchCmd
         .command('get <batch_id>')
         .description('Get run results for a batch')
         .option('--pretty', 'Human-readable output')
-        .action(async (batchId, opts) => {
-        const batch = findBatch(batchId);
-        if (!batch) {
-            err({ error: `Batch not found: ${batchId}` });
-            process.exit(1);
-        }
-        const apiKey = getApiKey();
-        const response = await getBatchRuns(batch.run_ids, apiKey).catch(handleApiError);
-        if (opts.pretty) {
-            outLine(`Batch:     ${batchId}`);
-            outLine(`Total:     ${batch.total}`);
-            outLine(`Found:     ${response.data.length}`);
-            if (response.not_found && response.not_found.length > 0) {
-                outLine(`Not found: ${response.not_found.length}`);
-            }
-            for (const run of response.data) {
-                outLine('');
-                outLine(`Run:    ${run.run_id}`);
-                outLine(`Status: ${run.status}${run.num_of_steps != null ? `  (${run.num_of_steps} steps)` : ''}`);
-                outLine(`Goal:   ${run.goal}`);
-                if (run.result != null) {
-                    outLine(`Result: ${JSON.stringify(run.result, null, 2).replace(/\n/g, '\n        ')}`);
-                }
-                else if (run.error) {
-                    outLine(`Error:  ${JSON.stringify(run.error)}`);
-                }
-            }
-        }
-        else {
-            out({ batch_id: batchId, ...response });
-        }
-    });
-    // ── batch cancel ─────────────────────────────────────────────────────────────
+        .action(batchGetAction);
     batchCmd
         .command('cancel <batch_id>')
         .description('Cancel all runs in a batch')
         .option('--pretty', 'Human-readable output')
-        .action(async (batchId, opts) => {
-        const batch = findBatch(batchId);
-        if (!batch) {
-            err({ error: `Batch not found: ${batchId}` });
-            process.exit(1);
-        }
-        const apiKey = getApiKey();
-        const response = await cancelBatchRuns(batch.run_ids, apiKey).catch(handleApiError);
-        if (opts.pretty) {
-            const cancelled = response.results.filter((r) => r.status === 'CANCELLED').length;
-            outLine(`Batch ${batchId}: ${cancelled}/${response.results.length} run(s) cancelled.`);
-            if (response.results.length > 0) {
-                outLine('');
-                outLine(`${'RUN ID'.padEnd(36)}  ${'STATUS'.padEnd(10)}  CANCELLED AT`);
-                outLine(`${'-'.repeat(36)}  ${'-'.repeat(10)}  ${'-'.repeat(24)}`);
-                for (const r of response.results) {
-                    outLine(`${r.run_id.padEnd(36)}  ${r.status.padEnd(10)}  ${r.cancelled_at ?? '-'}`);
-                }
-            }
-            if (response.not_found && response.not_found.length > 0) {
-                outLine(`\nNot found: ${response.not_found.join(', ')}`);
-            }
-        }
-        else {
-            out(response);
-        }
-    });
+        .action(batchCancelAction);
 }

package/dist/commands/connect.d.ts

@@ -1,7 +1,6 @@
 import { Command } from 'commander';
 import { type TakeHoistedCliInstall } from '../lib/cli-install.js';
 import { type AgentClient, type ConnectAuthMode } from '../lib/connect-runtime.js';
-export declare const DEFAULT_MCP_URL = "https://agent.tinyfish.ai/mcp";
 export interface NativeConnectOptions {
     apiKey?: string;
     mcpUrl: string;

package/dist/commands/connect.js

@@ -1,11 +1,11 @@
 import spawn from 'cross-spawn';
 import { CONNECT_SOURCE, persistApiKeyToEnvironment, saveConnectContext, validateKeyFormat, validatedApiKey, } from '../lib/auth.js';
 import { CLAUDE_CODE, CODEX, CURSOR_SKILL_TARGET, GROK, HERMES, OPENCLAW, OPENCLAW_SKILL_INSTALL_ARGS, OPENCODE, launchNativeMcpClient, launchOpenClawWalkthrough, openExternalUrl, } from '../lib/connect-clients.js';
-import { captureStdio, capturedOutput, HoistedFailureReportedError, installTinyFishCli, replay, } from '../lib/cli-install.js';
+import { captureStdio, capturedOutput, HoistedFailureReportedError, installTinyFishCli, replay, SKILL_INSTALL_TIMEOUT_MS, STEP_MAX_BUFFER, } from '../lib/cli-install.js';
 import { ensureCliAuthenticated } from '../lib/connect-auth.js';
 import { createStdinPrompt, runCliFallback } from '../lib/connect-fallback.js';
 import { installWebSkill } from '../lib/skill-install.js';
-import { ConnectInterruptedError, ConnectStepError, createConnectTelemetry, finishSetupCommand, requireCommandSupport, runGuarded, settle, SignInTimeoutError, spawnStepError, spawnRemoval, } from '../lib/connect-runtime.js';
+import { ConnectInterruptedError, ConnectStepError, createConnectTelemetry, finishSetupCommand, requireCommandSupport, runGuarded, settle, SignInTimeoutError, spawnStepError, stageDurationOf, withStageDuration, spawnRemoval, } from '../lib/connect-runtime.js';
 import { cursorInstallDeeplink, cursorMcpPath, readCursorTinyfishEntry, writeCursorMcpConfig, } from '../lib/cursor-config.js';
 import { runConnectAll } from '../lib/connect-all.js';
 import { AuthMode, RELOAD_ACTION } from '../lib/harness-detect.js';
@@ -16,7 +16,7 @@ import { SIGN_IN_PROBES } from '../lib/registration-detect.js';
 import { errLine, warnLine } from '../lib/output.js';
 import { z } from 'zod';
 import { verifyMcpAuth } from '../lib/verify.js';
-export const DEFAULT_MCP_URL = 'https://agent.tinyfish.ai/mcp';
+import { DEFAULT_MCP_URL, isDefaultEndpoint } from '../lib/mcp-endpoint.js';
 function removeExistingRegistration(client, removal, verbose) {
     const result = spawnRemoval(client.command, removal.args);
     if (result.status === 0)
@@ -48,6 +48,19 @@ function exportApiKey(apiKey, displayName, deferOutro) {
     }
     return true;
 }
+/** Runs before any write: a refused key strands nothing. */
+async function verifyKeyBeforeSeeding(apiKey, displayName) {
+    const verified = await verifyMcpAuth(apiKey);
+    if (verified.ok)
+        return;
+    // No status means the network failed, not the key.
+    if (verified.status === undefined) {
+        throw new ConnectStepError(`Could not reach TinyFish to check your API key (${verified.code ?? 'unknown'}), so ` +
+            `nothing was written to ${displayName}. Check your connection and retry.`, 'timeout');
+    }
+    throw new ConnectStepError(`Your TinyFish API key was rejected (${verified.code ?? 'unknown'}), so it was not ` +
+        `written to ${displayName}. Run: tinyfish auth login`, 'invalid_config');
+}
 /** A bounded spawn's timeout means the sign-in never finished. */
 function signInStepError(message, result, bounded) {
     const error = spawnStepError(message, result);
@@ -125,7 +138,7 @@ async function connectNativeMcpClient(client, options) {
         }
         const useKeyAuth = !!keyedAdd;
         if (options.keyAuthOnly && !useKeyAuth) {
-            // No keyAuth at all is structural (Hermes); a missing flag is just an old install.
+            // All native clients have keyAuth; missing flags mean an old install.
             if (client.keyAuth) {
                 throw new ConnectStepError(`This ${client.displayName} install cannot take a TinyFish API key, and signing in ` +
                     `needs a terminal. Update it, then re-run: tinyfish connect ${client.connectClient}`, 'harness_too_old');
@@ -133,6 +146,10 @@ async function connectNativeMcpClient(client, options) {
             throw new ConnectStepError(`${client.displayName} cannot take a TinyFish API key, and signing in needs a ` +
                 `terminal. Run: tinyfish connect ${client.connectClient}`, 'key_auth_unsupported');
         }
+        // Off-default endpoints skip it: the check hits BASE_URL, not `--url`.
+        if (keyedAdd?.spec.seedKey && isDefaultEndpoint(options.mcpUrl)) {
+            await verifyKeyBeforeSeeding(keyedAdd.key, client.displayName);
+        }
         telemetry.track('checkpoint', { phase: 'prerequisite_ok' });
         state.stage = 'registration_cleanup';
         for (const removal of client.removals)
@@ -154,14 +171,36 @@ async function connectNativeMcpClient(client, options) {
             : client.addArgs(mcpUrl.toString(), options.mcpUrl);
         // Capturing an inline-OAuth add hides the sign-in URL and hangs.
         const interactiveAdd = !(client.nonInteractiveAdd || keyedAdd);
-        const addResult = spawn.sync(client.command, addArgs, interactiveAdd
+        // After the removals: an interrupt there leaves no key behind.
+        const seeded = keyedAdd?.spec.seedKey?.(keyedAdd.key);
+        const addOptions = interactiveAdd
             ? { stdio: 'inherit', timeout: options.authTimeoutMs }
-            : captureStdio(options.verbose ?? false));
-        if (addResult.error || addResult.status !== 0) {
-            // Built first: its interrupt check must run before any replay.
-            const error = signInStepError(`Could not add TinyFish to ${client.displayName}`, addResult, interactiveAdd && options.authTimeoutMs !== undefined);
+            : seeded
+                ? {
+                    encoding: 'utf8',
+                    // Without it, the 1 MiB default overflows into a misread Ctrl+C.
+                    maxBuffer: STEP_MAX_BUFFER,
+                    // The unattended path had no bound at all before; captureStdio's is the floor.
+                    timeout: options.authTimeoutMs ?? SKILL_INSTALL_TIMEOUT_MS,
+                    input: seeded.stdinInput,
+                    env: seeded.env,
+                }
+                : captureStdio(options.verbose ?? false);
+        const addResult = spawn.sync(client.command, addArgs, addOptions);
+        // Rolls back first: signInStepError throws on a Ctrl+C.
+        const failAdd = (build) => {
+            seeded?.rollback();
+            const error = build();
             replay(capturedOutput(addResult));
             throw error;
+        };
+        if (addResult.error || addResult.status !== 0) {
+            failAdd(() => signInStepError(`Could not add TinyFish to ${client.displayName}`, addResult, interactiveAdd && options.authTimeoutMs !== undefined));
+        }
+        const registration = seeded?.confirmRegistered();
+        if (registration && !registration.ok) {
+            failAdd(() => new ConnectStepError(`${client.displayName} reported success but TinyFish is not enabled there` +
+                `${registration.detail ? `: ${registration.detail}` : ''}.`, 'invalid_config'));
         }
         telemetry.track('checkpoint', { phase: 'registered' });
         // Codex runs OAuth inside `mcp add` and exits 0 either way, so the recorded state decides
@@ -172,6 +211,9 @@ async function connectNativeMcpClient(client, options) {
         const degradedNotes = loginDegraded ? client.degradedAuthNotes : undefined;
         if (useKeyAuth) {
             errLine(degradedNotes?.keyed ?? 'Using your stored TinyFish API key — no browser sign-in needed.');
+            // Every other credential the CLI writes into a user-owned file says so too.
+            if (seeded)
+                errLine(seeded.note);
         }
         else if (degradedNotes) {
             // Printed here, not with the closing line, so a `--launch` run sees it before the handover.
@@ -285,20 +327,26 @@ async function runPostInstallSteps(client, options, state, telemetry, signInDefe
         options.onPostInstallFailed?.();
     }
 }
+/** Fails on a carried failure; only the first take reports anything. */
+function takeHoistedCliInstall(take, telemetry) {
+    const { outcome, firstTake } = take();
+    if (!outcome.ok) {
+        // Late takers fail too; only the first reports the install.
+        if (!firstTake)
+            throw new HoistedFailureReportedError(outcome.error.message);
+        throw withStageDuration(outcome.error, outcome.durationMs);
+    }
+    if (firstTake) {
+        telemetry.track('checkpoint', {
+            phase: 'cli_installed',
+            stageDurationMs: outcome.durationMs,
+        });
+    }
+}
 /** Consumes the `--all` hoist when present; installs inline otherwise. */
 function runCliInstallStep(options, telemetry) {
     if (options.hoistedCliInstall) {
-        const { outcome, firstTake } = options.hoistedCliInstall();
-        if (!outcome.ok) {
-            // Late takers fail too; only the first reports the install.
-            throw firstTake ? outcome.error : new HoistedFailureReportedError(outcome.error.message);
-        }
-        if (firstTake) {
-            telemetry.track('checkpoint', {
-                phase: 'cli_installed',
-                stageDurationMs: outcome.durationMs,
-            });
-        }
+        takeHoistedCliInstall(options.hoistedCliInstall, telemetry);
         return;
     }
     installTinyFishCli({ verbose: options.verbose ?? false, announce: true });
@@ -319,6 +367,7 @@ function trackPostInstallFailure(displayName, state, telemetry, error) {
         telemetry.track('post_install_failed', {
             failedStage: state.stage,
             failureReason: error instanceof ConnectStepError ? error.failureReason : 'unexpected_error',
+            stageDurationMs: stageDurationOf(error),
         });
     }
     errLine(`The ${displayName} MCP connection succeeded, but a finishing step ` +
@@ -356,16 +405,8 @@ export async function connectOpenClaw(options) {
         telemetry.track('checkpoint', { phase: 'prerequisite_ok' });
         if (options.hoistedCliInstall) {
             state.stage = 'cli_install';
-            const { outcome, firstTake } = options.hoistedCliInstall();
-            // A carried failure fails openclaw exactly like the inline install.
-            if (!outcome.ok)
-                throw outcome.error;
-            if (firstTake) {
-                telemetry.track('checkpoint', {
-                    phase: 'cli_installed',
-                    stageDurationMs: outcome.durationMs,
-                });
-            }
+            // A carried first-take failure fails openclaw like the inline install.
+            takeHoistedCliInstall(options.hoistedCliInstall, telemetry);
         }
         else if (options.cliInstall !== false) {
             state.stage = 'cli_install';

package/dist/commands/doctor.js

@@ -8,7 +8,8 @@ import { err, errLine, out, outLine } from '../lib/output.js';
 import { detectRegistrations } from '../lib/registration-detect.js';
 import { sendDoctorCompleted } from '../lib/setup-telemetry.js';
 import { verifyMcpAuth, verifyMcpHealth } from '../lib/verify.js';
-import { connectClaudeCode, connectCodex, connectCursor, connectGrok, connectHermes, connectOpenClaw, connectOpencode, DEFAULT_MCP_URL, } from './connect.js';
+import { DEFAULT_MCP_URL, endpointOf, isDefaultEndpoint } from '../lib/mcp-endpoint.js';
+import { connectClaudeCode, connectCodex, connectCursor, connectGrok, connectHermes, connectOpenClaw, connectOpencode, } from './connect.js';
 // A green auth mode with a red auth call proves nothing, so the call's verdict gates the claim.
 function provesHarnessReach(status, keyAuth, healthOk, mcpUrl) {
     // An endpoint doctor could not reach proves nothing about a harness pointed at it.
@@ -20,6 +21,9 @@ function provesHarnessReach(status, keyAuth, healthOk, mcpUrl) {
         return false;
     if (status.connected === true)
         return true;
+    // Symmetric with registrationVerdict: a harness saying it cannot reach us is decisive.
+    if (status.connected === false)
+        return false;
     // The harness's own key must have verified; the CLI's verdict says nothing about it.
     return status.authMode === AuthMode.ApiKey && keyAuth?.ok === true;
 }
@@ -46,11 +50,6 @@ async function checkConnectivity(mcpUrl) {
         scope: 'harness',
     };
 }
-// Query strings carry the connect attempt id, so they differ on every healthy install.
-function endpointOf(url) {
-    const parsed = new URL(url);
-    return `${parsed.origin}${parsed.pathname.replace(/\/$/, '')}`;
-}
 /** Host alone let `/wrong-path` and plain `http://` through and claim the harness reaches us. */
 function pointsElsewhere(registeredUrl, mcpUrl) {
     if (!registeredUrl)
@@ -189,15 +188,6 @@ function checkAuthCall(auth) {
         scope: 'cli',
     };
 }
-// `verifyMcpAuth` hits BASE_URL; a sandbox key 401s against prod.
-function isDefaultEndpoint(mcpUrl) {
-    try {
-        return endpointOf(mcpUrl) === endpointOf(DEFAULT_MCP_URL);
-    }
-    catch {
-        return false;
-    }
-}
 function verifyHarnessKey(status, cliAuth, mcpUrl) {
     if (!isDefaultEndpoint(mcpUrl))
         return undefined;

package/dist/commands/profile.d.ts

@@ -1,6 +1,6 @@
 import { Command } from 'commander';
 import { type DecryptStats } from '../lib/chrome-cookies.js';
-import type { CookieRecord } from '../lib/types.js';
+import type { CookieRecord, ProfileUploadResponse } from '../lib/types.js';
 export declare function extractChromeCookies(domain: string, stats?: DecryptStats): CookieRecord[];
 export declare function extractAllChromeCookies(stats?: DecryptStats): CookieRecord[];
 type TldtsParse = (host: string, opts: {
@@ -11,5 +11,6 @@ type TldtsParse = (host: string, opts: {
 export declare function groupByCanonicalDomain(cookies: CookieRecord[], parse: TldtsParse): Map<string, CookieRecord[]>;
 export declare const MAX_COOKIES_PER_UPLOAD = 3000;
 export declare function buildChunks(groups: Map<string, CookieRecord[]>): CookieRecord[][];
+export declare function uploadAllDomains(profileId: string, cookies: CookieRecord[], apiKey: string): Promise<ProfileUploadResponse>;
 export declare function registerProfile(program: Command): void;
 export {};

package/dist/commands/profile.js

@@ -168,6 +168,51 @@ function printPrettyProfileUpload(result) {
     outLine(`Cookies uploaded: ${result.cookie_count}`);
     outLine(`Domains updated:  ${result.domains_updated.join(', ')}`);
 }
+function extractCookiesOrThrow(opts) {
+    // Extract cookies before creating profile to avoid orphan profiles
+    // if extraction fails (Windows, no Chrome, no cookies).
+    const stats = { keyringSkipped: 0 };
+    const cookies = opts.allDomains
+        ? extractAllChromeCookies(stats)
+        : extractChromeCookies(opts.domain, stats);
+    // Warn even on partial success — surviving plaintext rows can mask
+    // that every auth cookie was keyring-encrypted and skipped.
+    if (stats.keyringSkipped > 0) {
+        errLine(`Skipped ${stats.keyringSkipped} keyring-encrypted cookies (not supported on Linux yet).`);
+    }
+    if (cookies.length === 0) {
+        throw new UserFacingError(stats.keyringSkipped > 0
+            ? 'Chrome on Linux encrypts cookies with the system keyring, which is not supported yet.'
+            : opts.allDomains
+                ? 'No Chrome cookies found. Is Google Chrome installed and have you logged in to any sites?'
+                : `No Chrome cookies found for ${opts.domain}. Are you logged in to this site in Chrome?`);
+    }
+    return cookies;
+}
+// Exported for testing
+export async function uploadAllDomains(profileId, cookies, apiKey) {
+    // Batch upload — never split a canonical domain across chunks
+    const require = createRequire(import.meta.url);
+    const { parse } = require('tldts');
+    const groups = groupByCanonicalDomain(cookies, parse);
+    const chunks = buildChunks(groups);
+    let cookieCount = 0;
+    const domainsUpdated = [];
+    const domainsFailed = [];
+    for (const chunk of chunks) {
+        const r = await profileUpload(profileId, chunk, apiKey);
+        cookieCount += r.cookie_count;
+        domainsUpdated.push(...r.domains_updated);
+        if (r.domains_failed)
+            domainsFailed.push(...r.domains_failed);
+    }
+    return {
+        profile_id: profileId,
+        cookie_count: cookieCount,
+        domains_updated: domainsUpdated,
+        ...(domainsFailed.length > 0 ? { domains_failed: domainsFailed } : {}),
+    };
+}
 export function registerProfile(program) {
     const profileCmd = program
         .command('profile')
@@ -216,56 +261,15 @@ export function registerProfile(program) {
         }
         let profileId = opts.profileId;
         try {
-            // Extract cookies before creating profile to avoid orphan profiles
-            // if extraction fails (Windows, no Chrome, no cookies).
-            const stats = { keyringSkipped: 0 };
-            const cookies = opts.allDomains
-                ? extractAllChromeCookies(stats)
-                : extractChromeCookies(opts.domain, stats);
-            // Warn even on partial success — surviving plaintext rows can mask
-            // that every auth cookie was keyring-encrypted and skipped.
-            if (stats.keyringSkipped > 0) {
-                errLine(`Skipped ${stats.keyringSkipped} keyring-encrypted cookies (not supported on Linux yet).`);
-            }
-            if (cookies.length === 0) {
-                throw new UserFacingError(stats.keyringSkipped > 0
-                    ? 'Chrome on Linux encrypts cookies with the system keyring, which is not supported yet.'
-                    : opts.allDomains
-                        ? 'No Chrome cookies found. Is Google Chrome installed and have you logged in to any sites?'
-                        : `No Chrome cookies found for ${opts.domain}. Are you logged in to this site in Chrome?`);
-            }
+            const cookies = extractCookiesOrThrow(opts);
             if (profileId === undefined) {
                 const name = opts.allDomains ? 'chrome-import' : opts.domain;
                 const created = await profileCreate(name, apiKey);
                 profileId = created.id;
             }
-            let result;
-            if (opts.allDomains) {
-                // Batch upload — never split a canonical domain across chunks
-                const require = createRequire(import.meta.url);
-                const { parse } = require('tldts');
-                const groups = groupByCanonicalDomain(cookies, parse);
-                const chunks = buildChunks(groups);
-                let cookieCount = 0;
-                const domainsUpdated = [];
-                const domainsFailed = [];
-                for (const chunk of chunks) {
-                    const r = await profileUpload(profileId, chunk, apiKey);
-                    cookieCount += r.cookie_count;
-                    domainsUpdated.push(...r.domains_updated);
-                    if (r.domains_failed)
-                        domainsFailed.push(...r.domains_failed);
-                }
-                result = {
-                    profile_id: profileId,
-                    cookie_count: cookieCount,
-                    domains_updated: domainsUpdated,
-                    ...(domainsFailed.length > 0 ? { domains_failed: domainsFailed } : {}),
-                };
-            }
-            else {
-                result = await profileUpload(profileId, cookies, apiKey);
-            }
+            const result = opts.allDomains
+                ? await uploadAllDomains(profileId, cookies, apiKey)
+                : await profileUpload(profileId, cookies, apiKey);
             if (result.domains_failed && result.domains_failed.length > 0) {
                 errLine(`Warning: failed to update cookies for domains: ${result.domains_failed.join(', ')}`);
             }