@tiny-fish/cli 0.30.2-next.264 → 0.30.2-next.266

package/dist/commands/connect.js

@@ -16,7 +16,7 @@ import { SIGN_IN_PROBES } from '../lib/registration-detect.js';
 import { errLine, warnLine } from '../lib/output.js';
 import { z } from 'zod';
 import { verifyMcpAuth } from '../lib/verify.js';
-import { DEFAULT_MCP_URL, isDefaultEndpoint } from '../lib/mcp-endpoint.js';
+import { apiBaseFromMcpUrl, DEFAULT_MCP_URL } from '../lib/mcp-endpoint.js';
 function removeExistingRegistration(client, removal, verbose) {
     const result = spawnRemoval(client.command, removal.args);
     if (result.status === 0)
@@ -48,9 +48,43 @@ function exportApiKey(apiKey, displayName, deferOutro) {
     }
     return true;
 }
+/** Undefined leaves the client on its keyless path, if any. */
+function resolveKeyedAdd(client, storedKey, keyAuthSupported, deferOutro) {
+    if (!storedKey || !keyAuthSupported || !client.keyAuth)
+        return undefined;
+    const keyed = { key: storedKey, spec: client.keyAuth };
+    // Before the removals: a failed export must not strand the old registration.
+    if (keyed.spec.envVar && !exportApiKey(keyed.key, client.displayName, deferOutro)) {
+        return undefined;
+    }
+    return keyed;
+}
+/** No sign-in to degrade to, so the install stops. */
+function refuseKeylessInstall(client, keyAuthSupported) {
+    const noSignIn = `TinyFish does not sign in to ${client.displayName} any other way`;
+    const rerun = `re-run: tinyfish connect ${client.connectClient}`;
+    if (!client.keyAuth) {
+        throw new ConnectStepError(`${client.displayName} cannot take a TinyFish API key, and ${noSignIn}. ` +
+            `Run: tinyfish connect ${client.connectClient}`, 'key_auth_unsupported');
+    }
+    if (!keyAuthSupported) {
+        throw new ConnectStepError(`This ${client.displayName} install cannot take a TinyFish API key, and ${noSignIn}. ` +
+            `Update it, then ${rerun}`, 'harness_too_old');
+    }
+    throw new ConnectStepError(`Connecting ${client.displayName} needs a TinyFish API key, and ${noSignIn}. ` +
+        `Run: tinyfish auth login, then ${rerun}`, 'invalid_config');
+}
+/** Resolved before the removals, so a refusal strands no registration. */
+function keylessAddArgs(client, keyAuthSupported, oauthResource) {
+    if (!client.addArgs)
+        refuseKeylessInstall(client, keyAuthSupported);
+    const addArgs = client.addArgs;
+    return (mcpUrl) => addArgs(mcpUrl, oauthResource);
+}
 /** Runs before any write: a refused key strands nothing. */
-async function verifyKeyBeforeSeeding(apiKey, displayName) {
-    const verified = await verifyMcpAuth(apiKey);
+async function verifyKeyBeforeSeeding(apiKey, displayName, mcpUrl) {
+    // One host serves `/mcp` and `/v1`, so `--url` decides where the key is checked.
+    const verified = await verifyMcpAuth(apiKey, apiBaseFromMcpUrl(mcpUrl));
     if (verified.ok)
         return;
     // No status means the network failed, not the key.
@@ -128,15 +162,12 @@ async function connectNativeMcpClient(client, options) {
         state.harnessDegraded = !!client.loginArgs && !optionalSupported;
         // Prod MCP accepts X-API-Key, so a stored key replaces the browser OAuth hop.
         const storedKey = validatedApiKey(options.apiKey);
-        let keyedAdd = storedKey && keyAuthSupported && client.keyAuth
-            ? { key: storedKey, spec: client.keyAuth }
-            : undefined;
-        // Before the removals: a failed export must not strand the old registration.
-        if (keyedAdd?.spec.envVar &&
-            !exportApiKey(keyedAdd.key, client.displayName, options.deferOutro)) {
-            keyedAdd = undefined;
-        }
+        const keyedAdd = resolveKeyedAdd(client, storedKey, keyAuthSupported, options.deferOutro);
         const useKeyAuth = !!keyedAdd;
+        // Refuses here when key-required; others keep their OAuth argv.
+        const buildAddArgs = keyedAdd
+            ? (mcpUrl) => keyedAdd.spec.addArgs(mcpUrl, keyedAdd.key)
+            : keylessAddArgs(client, keyAuthSupported, options.mcpUrl);
         if (options.keyAuthOnly && !useKeyAuth) {
             // All native clients have keyAuth; missing flags mean an old install.
             if (client.keyAuth) {
@@ -146,9 +177,9 @@ async function connectNativeMcpClient(client, options) {
             throw new ConnectStepError(`${client.displayName} cannot take a TinyFish API key, and signing in needs a ` +
                 `terminal. Run: tinyfish connect ${client.connectClient}`, 'key_auth_unsupported');
         }
-        // Off-default endpoints skip it: the check hits BASE_URL, not `--url`.
-        if (keyedAdd?.spec.seedKey && isDefaultEndpoint(options.mcpUrl)) {
-            await verifyKeyBeforeSeeding(keyedAdd.key, client.displayName);
+        // Verify first: a revoked key in a foreign .env is unrecoverable.
+        if (keyedAdd?.spec.seedKey) {
+            await verifyKeyBeforeSeeding(keyedAdd.key, client.displayName, options.mcpUrl);
         }
         telemetry.track('checkpoint', { phase: 'prerequisite_ok' });
         state.stage = 'registration_cleanup';
@@ -166,9 +197,7 @@ async function connectNativeMcpClient(client, options) {
             loginArgs && !probeAuthenticated ? 'registration' : 'registration_or_authentication';
         errLine(`Adding TinyFish to ${client.displayName}...`);
         // Header keys ride argv (/proc/<pid>/cmdline); these CLIs take headers no other way.
-        const addArgs = keyedAdd
-            ? keyedAdd.spec.addArgs(mcpUrl.toString(), keyedAdd.key)
-            : client.addArgs(mcpUrl.toString(), options.mcpUrl);
+        const addArgs = buildAddArgs(mcpUrl.toString());
         // Capturing an inline-OAuth add hides the sign-in URL and hangs.
         const interactiveAdd = !(client.nonInteractiveAdd || keyedAdd);
         // After the removals: an interrupt there leaves no key behind.

package/dist/commands/run.js

@@ -124,6 +124,194 @@ async function loadOutputSchema(opts) {
     }
     return parseOutputSchema(fileContents, '--output-schema-file');
 }
+function validateRunInvocation(goal, opts) {
+    if (!opts.url) {
+        err({ error: "required option '--url <url>' not specified" });
+        process.exit(1);
+    }
+    if (opts.sync && opts.async) {
+        err({ error: '--sync and --async are mutually exclusive' });
+        process.exit(1);
+    }
+    // Normalise URL: accept bare hostnames by prepending https://.
+    // The server requires a valid URL — it does not auto-prefix.
+    let normalizedUrl = opts.url;
+    try {
+        new URL(opts.url);
+    }
+    catch {
+        try {
+            new URL(`https://${opts.url}`);
+            normalizedUrl = `https://${opts.url}`;
+        }
+        catch {
+            err({
+                error: `Invalid --url "${opts.url}". Provide a valid URL, e.g. https://example.com or example.com`,
+            });
+            process.exit(1);
+        }
+    }
+    if (!goal.trim()) {
+        err({ error: 'Goal cannot be empty' });
+        process.exit(1);
+    }
+    // The server rejects credential_item_ids without use_vault (400); fail fast here.
+    if (opts.credentialItemId.length > 0 && !opts.useVault) {
+        err({ error: '--credential-item-id requires --use-vault' });
+        process.exit(1);
+    }
+    // The server rejects profile_id without use_profile (400); fail fast here.
+    if (opts.profileId !== undefined && !opts.useProfile) {
+        err({ error: '--profile-id requires --use-profile' });
+        process.exit(1);
+    }
+    return normalizedUrl;
+}
+function buildAgentConfig(opts) {
+    const mode = parseChoice(opts.mode, VALID_MODES, '--mode');
+    const cursorStyle = parseChoice(opts.cursorStyle, VALID_CURSOR_STYLES, '--cursor-style');
+    const maxSteps = parsePositiveInteger(opts.maxSteps, '--max-steps', MAX_STEPS_LIMIT);
+    const maxDurationSeconds = parsePositiveInteger(opts.maxDurationSeconds, '--max-duration-seconds');
+    if (mode === undefined &&
+        cursorStyle === undefined &&
+        maxSteps === undefined &&
+        maxDurationSeconds === undefined) {
+        return undefined;
+    }
+    return {
+        ...(mode !== undefined ? { mode } : {}),
+        ...(cursorStyle !== undefined ? { cursor_style: cursorStyle } : {}),
+        ...(maxSteps !== undefined ? { max_steps: maxSteps } : {}),
+        ...(maxDurationSeconds !== undefined ? { max_duration_seconds: maxDurationSeconds } : {}),
+    };
+}
+function buildCaptureConfig(opts) {
+    if (opts.captureElements === undefined &&
+        opts.captureSnapshots === undefined &&
+        opts.captureScreenshots === undefined &&
+        opts.captureRecording === undefined &&
+        opts.captureHtml === undefined) {
+        return undefined;
+    }
+    return {
+        ...(opts.captureElements !== undefined ? { elements: opts.captureElements } : {}),
+        ...(opts.captureSnapshots !== undefined ? { snapshots: opts.captureSnapshots } : {}),
+        ...(opts.captureScreenshots !== undefined ? { screenshots: opts.captureScreenshots } : {}),
+        ...(opts.captureRecording !== undefined ? { recording: opts.captureRecording } : {}),
+        ...(opts.captureHtml !== undefined ? { html: opts.captureHtml } : {}),
+    };
+}
+async function buildRunRequest(goal, normalizedUrl, opts) {
+    const outputSchema = await loadOutputSchema(opts);
+    const browserProfile = parseChoice(opts.browserProfile, VALID_BROWSER_PROFILES, '--browser-profile');
+    const agentConfig = buildAgentConfig(opts);
+    const captureConfig = buildCaptureConfig(opts);
+    const sessionId = parseSessionId(opts.sessionId);
+    const webhookUrl = parseHttpsUrl(opts.webhookUrl, '--webhook-url');
+    return {
+        goal,
+        url: normalizedUrl,
+        ...(outputSchema !== undefined ? { output_schema: outputSchema } : {}),
+        ...(browserProfile !== undefined ? { browser_profile: browserProfile } : {}),
+        ...(agentConfig !== undefined ? { agent_config: agentConfig } : {}),
+        ...(captureConfig !== undefined ? { capture_config: captureConfig } : {}),
+        ...(webhookUrl !== undefined ? { webhook_url: webhookUrl } : {}),
+        ...(opts.useProfile !== undefined ? { use_profile: opts.useProfile } : {}),
+        ...(opts.profileId !== undefined ? { profile_id: opts.profileId } : {}),
+        ...(sessionId !== undefined ? { session_id: sessionId } : {}),
+        ...(opts.useVault ? { use_vault: true } : {}),
+        ...(opts.credentialItemId.length > 0 ? { credential_item_ids: opts.credentialItemId } : {}),
+    };
+}
+async function runAsyncPath(req, apiKey, pretty) {
+    let result;
+    try {
+        result = await runAsync(req, apiKey);
+    }
+    catch (e) {
+        handleApiError(e);
+    }
+    checkRunResult(result, false); // async = PENDING is expected
+    const asyncResultWithUrl = {
+        ...result,
+        status: RunStatus.PENDING,
+        run_url: `${BASE_URL}/runs/${result.run_id}`,
+    };
+    if (pretty) {
+        outLine(`Run submitted\nID:     ${asyncResultWithUrl.run_id}\nURL:    ${asyncResultWithUrl.run_url}`);
+    }
+    else {
+        out(asyncResultWithUrl);
+    }
+}
+async function runSyncPath(req, apiKey, pretty) {
+    errLine('Waiting for result...');
+    let result;
+    try {
+        result = await runSync(req, apiKey);
+    }
+    catch (e) {
+        handleApiError(e);
+    }
+    checkRunResult(result);
+    const syncResultWithUrl = {
+        ...result,
+        run_url: `${BASE_URL}/runs/${result.run_id}`,
+    };
+    if (pretty) {
+        outLine(`Status: ${syncResultWithUrl.status}\n\n${JSON.stringify(syncResultWithUrl.result ?? {}, null, 2)}`);
+    }
+    else {
+        out(syncResultWithUrl);
+    }
+}
+// Default: SSE stream — Ctrl+C cancels the active run.
+async function runStreamPath(req, apiKey, pretty) {
+    const controller = new AbortController();
+    let siginted = false;
+    let capturedRunId = null;
+    const onSigint = () => {
+        siginted = true;
+        controller.abort();
+    };
+    process.once('SIGINT', onSigint);
+    let streamFailed = false;
+    try {
+        for await (const event of runStream(req, apiKey, controller.signal)) {
+            if (!handleStreamEvent(event, pretty, (id) => {
+                capturedRunId = id;
+            })) {
+                streamFailed = true;
+                break;
+            }
+            if (event.type === EventType.COMPLETE) {
+                break;
+            }
+        }
+    }
+    catch (e) {
+        if (controller.signal.aborted && siginted) {
+            let cancelled = false;
+            if (capturedRunId) {
+                try {
+                    await cancelRun(capturedRunId, apiKey);
+                    cancelled = true;
+                }
+                catch {
+                    /* ignore */
+                }
+            }
+            process.stderr.write(cancelled ? '\nRun cancelled.\n' : '\n');
+            process.exit(130);
+        }
+        handleApiError(e);
+    }
+    finally {
+        process.removeListener('SIGINT', onSigint);
+    }
+    if (streamFailed)
+        process.exit(1);
+}
 export function registerRun(agentCmd) {
     const runCmd = agentCmd
         .command('run')
@@ -159,187 +347,18 @@ export function registerRun(agentCmd) {
             runCmd.help();
             return;
         }
-        if (!opts.url) {
-            err({ error: "required option '--url <url>' not specified" });
-            process.exit(1);
-        }
-        if (opts.sync && opts.async) {
-            err({ error: '--sync and --async are mutually exclusive' });
-            process.exit(1);
-        }
-        // Normalise URL: accept bare hostnames by prepending https://.
-        // The server requires a valid URL — it does not auto-prefix.
-        let normalizedUrl = opts.url;
-        try {
-            new URL(opts.url);
-        }
-        catch {
-            try {
-                new URL(`https://${opts.url}`);
-                normalizedUrl = `https://${opts.url}`;
-            }
-            catch {
-                err({
-                    error: `Invalid --url "${opts.url}". Provide a valid URL, e.g. https://example.com or example.com`,
-                });
-                process.exit(1);
-            }
-        }
-        if (!goal.trim()) {
-            err({ error: 'Goal cannot be empty' });
-            process.exit(1);
-        }
-        // The server rejects credential_item_ids without use_vault (400); fail fast here.
-        const hasCredentialItemIds = opts.credentialItemId.length > 0;
-        if (hasCredentialItemIds && !opts.useVault) {
-            err({ error: '--credential-item-id requires --use-vault' });
-            process.exit(1);
-        }
-        // The server rejects profile_id without use_profile (400); fail fast here.
-        if (opts.profileId !== undefined && !opts.useProfile) {
-            err({ error: '--profile-id requires --use-profile' });
-            process.exit(1);
-        }
-        const outputSchema = await loadOutputSchema(opts);
-        const browserProfile = parseChoice(opts.browserProfile, VALID_BROWSER_PROFILES, '--browser-profile');
-        const mode = parseChoice(opts.mode, VALID_MODES, '--mode');
-        const cursorStyle = parseChoice(opts.cursorStyle, VALID_CURSOR_STYLES, '--cursor-style');
-        const maxSteps = parsePositiveInteger(opts.maxSteps, '--max-steps', MAX_STEPS_LIMIT);
-        const maxDurationSeconds = parsePositiveInteger(opts.maxDurationSeconds, '--max-duration-seconds');
-        const sessionId = parseSessionId(opts.sessionId);
-        const webhookUrl = parseHttpsUrl(opts.webhookUrl, '--webhook-url');
-        const agentConfig = mode !== undefined ||
-            cursorStyle !== undefined ||
-            maxSteps !== undefined ||
-            maxDurationSeconds !== undefined
-            ? {
-                ...(mode !== undefined ? { mode } : {}),
-                ...(cursorStyle !== undefined ? { cursor_style: cursorStyle } : {}),
-                ...(maxSteps !== undefined ? { max_steps: maxSteps } : {}),
-                ...(maxDurationSeconds !== undefined
-                    ? { max_duration_seconds: maxDurationSeconds }
-                    : {}),
-            }
-            : undefined;
-        const captureConfig = opts.captureElements !== undefined ||
-            opts.captureSnapshots !== undefined ||
-            opts.captureScreenshots !== undefined ||
-            opts.captureRecording !== undefined ||
-            opts.captureHtml !== undefined
-            ? {
-                ...(opts.captureElements !== undefined ? { elements: opts.captureElements } : {}),
-                ...(opts.captureSnapshots !== undefined ? { snapshots: opts.captureSnapshots } : {}),
-                ...(opts.captureScreenshots !== undefined
-                    ? { screenshots: opts.captureScreenshots }
-                    : {}),
-                ...(opts.captureRecording !== undefined ? { recording: opts.captureRecording } : {}),
-                ...(opts.captureHtml !== undefined ? { html: opts.captureHtml } : {}),
-            }
-            : undefined;
+        const normalizedUrl = validateRunInvocation(goal, opts);
+        const req = await buildRunRequest(goal, normalizedUrl, opts);
         const apiKey = getApiKey();
-        const req = {
-            goal,
-            url: normalizedUrl,
-            ...(outputSchema !== undefined ? { output_schema: outputSchema } : {}),
-            ...(browserProfile !== undefined ? { browser_profile: browserProfile } : {}),
-            ...(agentConfig !== undefined ? { agent_config: agentConfig } : {}),
-            ...(captureConfig !== undefined ? { capture_config: captureConfig } : {}),
-            ...(webhookUrl !== undefined ? { webhook_url: webhookUrl } : {}),
-            ...(opts.useProfile !== undefined ? { use_profile: opts.useProfile } : {}),
-            ...(opts.profileId !== undefined ? { profile_id: opts.profileId } : {}),
-            ...(sessionId !== undefined ? { session_id: sessionId } : {}),
-            ...(opts.useVault ? { use_vault: true } : {}),
-            ...(hasCredentialItemIds ? { credential_item_ids: opts.credentialItemId } : {}),
-        };
         if (opts.async) {
-            let result;
-            try {
-                result = await runAsync(req, apiKey);
-            }
-            catch (e) {
-                handleApiError(e);
-            }
-            checkRunResult(result, false); // async = PENDING is expected
-            const asyncResultWithUrl = {
-                ...result,
-                status: RunStatus.PENDING,
-                run_url: `${BASE_URL}/runs/${result.run_id}`,
-            };
-            if (opts.pretty) {
-                outLine(`Run submitted\nID:     ${asyncResultWithUrl.run_id}\nURL:    ${asyncResultWithUrl.run_url}`);
-            }
-            else {
-                out(asyncResultWithUrl);
-            }
+            await runAsyncPath(req, apiKey, opts.pretty);
             return;
         }
         if (opts.sync) {
-            errLine('Waiting for result...');
-            let result;
-            try {
-                result = await runSync(req, apiKey);
-            }
-            catch (e) {
-                handleApiError(e);
-            }
-            checkRunResult(result);
-            const syncResultWithUrl = {
-                ...result,
-                run_url: `${BASE_URL}/runs/${result.run_id}`,
-            };
-            if (opts.pretty) {
-                outLine(`Status: ${syncResultWithUrl.status}\n\n${JSON.stringify(syncResultWithUrl.result ?? {}, null, 2)}`);
-            }
-            else {
-                out(syncResultWithUrl);
-            }
+            await runSyncPath(req, apiKey, opts.pretty);
             return;
         }
-        // Default: SSE stream — Ctrl+C cancels the active run.
-        const controller = new AbortController();
-        let siginted = false;
-        let capturedRunId = null;
-        const onSigint = () => {
-            siginted = true;
-            controller.abort();
-        };
-        process.once('SIGINT', onSigint);
-        let streamFailed = false;
-        try {
-            for await (const event of runStream(req, apiKey, controller.signal)) {
-                if (!handleStreamEvent(event, opts.pretty, (id) => {
-                    capturedRunId = id;
-                })) {
-                    streamFailed = true;
-                    break;
-                }
-                if (event.type === EventType.COMPLETE) {
-                    break;
-                }
-            }
-        }
-        catch (e) {
-            if (controller.signal.aborted && siginted) {
-                let cancelled = false;
-                if (capturedRunId) {
-                    try {
-                        await cancelRun(capturedRunId, apiKey);
-                        cancelled = true;
-                    }
-                    catch {
-                        /* ignore */
-                    }
-                }
-                process.stderr.write(cancelled ? '\nRun cancelled.\n' : '\n');
-                process.exit(130);
-            }
-            handleApiError(e);
-        }
-        finally {
-            process.removeListener('SIGINT', onSigint);
-        }
-        if (streamFailed)
-            process.exit(1);
+        await runStreamPath(req, apiKey, opts.pretty);
     });
     return runCmd;
 }

package/dist/lib/client.d.ts

@@ -7,7 +7,7 @@ export declare function buildConnectHeaders(connect: ConnectMap, caller: string
 export declare function runSync(req: CliAgentRunParams, apiKey: string): Promise<AgentRunResponse>;
 export declare function runAsync(req: CliAgentRunParams, apiKey: string): Promise<AgentRunAsyncResponse>;
 export declare function runStream(req: CliAgentRunParams, apiKey: string, signal?: AbortSignal): AsyncGenerator<AgentRunWithStreamingResponse>;
-export declare function listRuns(opts: RunListParams, apiKey: string, timeout?: number): Promise<RunListResponse>;
+export declare function listRuns(opts: RunListParams, apiKey: string, timeout?: number, baseUrl?: string): Promise<RunListResponse>;
 export declare function getRun(runId: string, apiKey: string): Promise<Run>;
 export declare function getRunSteps(runId: string, apiKey: string): Promise<RunStepsResponse>;
 export declare function searchQuery(params: SearchQueryParams, apiKey: string): Promise<SearchQueryResponse>;

package/dist/lib/client.js

@@ -93,10 +93,12 @@ class TinyFishCliClient extends TinyFish {
         return (await response.json());
     }
 }
-function createSdkClient(apiKey, timeout) {
+function createSdkClient(apiKey, timeout, baseUrl) {
+    // An explicit base outranks the env default.
+    const resolvedBase = baseUrl ?? API_URL_OVERRIDE;
     return new TinyFishCliClient({
         apiKey,
-        ...(API_URL_OVERRIDE !== undefined ? { baseURL: API_URL_OVERRIDE } : {}),
+        ...(resolvedBase !== undefined ? { baseURL: resolvedBase } : {}),
         maxRetries: 0,
         // Fires per HTTP attempt, but maxRetries is 0 and the notice latches once per invocation.
         onResponse: ({ headers }) => captureNotice(headers),
@@ -263,9 +265,9 @@ export async function* runStream(req, apiKey, signal) {
         }
     }
 }
-export async function listRuns(opts, apiKey, timeout) {
+export async function listRuns(opts, apiKey, timeout, baseUrl) {
     try {
-        return await createSdkClient(apiKey, timeout).runs.list(opts);
+        return await createSdkClient(apiKey, timeout, baseUrl).runs.list(opts);
     }
     catch (error) {
         rethrowSdkError(error);

package/dist/lib/connect-all.js

@@ -40,6 +40,8 @@ const BROWSER_SIGN_IN = new Set(ALL_HARNESSES.filter((harness) => {
     const native = NATIVE_BY_HARNESS.get(harness);
     return !!native?.loginArgs || !!native?.oauthInAdd;
 }));
+// Derived: these refuse a keyless install, so no sign-in helps.
+const KEY_REQUIRED = new Set(ALL_HARNESSES.filter((harness) => !!NATIVE_BY_HARNESS.get(harness)?.keyRequired));
 // Derived: a native add carries the key, or the CLI holds it itself.
 const KEY_AUTH_CAPABLE = new Set(ALL_HARNESSES.filter((harness) => !!NATIVE_BY_HARNESS.get(harness)?.keyAuth || HARNESS_CAPABILITIES[harness].keyHeldByCli));
 // OpenCode ships no `mcp remove`, so the only removal is editing the config it wrote.
@@ -311,7 +313,8 @@ async function processHarness(detection, opts, prompt, oauthBudget, hoistedCliIn
         }
         headlessAuth = true;
     }
-    if (isTTY && !keyed && prompt) {
+    // Key-required harnesses refuse below; offering a browser sign-in would mislead.
+    if (isTTY && !keyed && prompt && !KEY_REQUIRED.has(harness)) {
         errLine(`step: waiting for browser sign-in to TinyFish for ${DISPLAY_NAMES[harness]}`);
         try {
             await prompt(`Press enter to open the browser and sign in to TinyFish for ${DISPLAY_NAMES[harness]}... `);

package/dist/lib/connect-clients.d.ts

@@ -34,7 +34,7 @@ export interface SeededInstall {
         detail?: string;
     };
 }
-export interface NativeMcpClient extends SupportedCommand {
+interface BaseMcpClient extends SupportedCommand {
     connectClient: Exclude<AgentClient, 'openclaw'>;
     /** Omitted where the `skills` CLI has no agent for this harness (Grok ships its own plugin). */
     skillAgent?: SkillAgent;
@@ -62,7 +62,6 @@ export interface NativeMcpClient extends SupportedCommand {
         args: string[];
         label: string;
     }[];
-    addArgs: (mcpUrl: string, oauthResource: string) => string[];
     /** Blocking terminal walkthrough; runs only behind the TTY gate. */
     launchWalkthrough?: () => void;
     /** Own window, never inherits stdio; reports its own outcome. */
@@ -70,6 +69,21 @@ export interface NativeMcpClient extends SupportedCommand {
     /** Printed after a successful connect, on both the launch and non-launch paths. */
     postConnectNote?: string;
 }
+/** Keyless installs use this argv; the harness signs itself in. */
+export interface OauthCapableMcpClient extends BaseMcpClient {
+    keyRequired?: false;
+    addArgs: (mcpUrl: string, oauthResource: string) => string[];
+}
+/** No sign-in exists here, so connect refuses a keyless install (Hermes). */
+export interface KeyRequiredMcpClient extends BaseMcpClient {
+    keyRequired: true;
+    keyAuth: NonNullable<BaseMcpClient['keyAuth']>;
+    /** Restoring any of these three would restore the OAuth fallback. */
+    addArgs?: never;
+    oauthInAdd?: never;
+    loginArgs?: never;
+}
+export type NativeMcpClient = OauthCapableMcpClient | KeyRequiredMcpClient;
 export declare const CLAUDE_CODE: NativeMcpClient;
 /**
  * `cmd` re-parses its command line after `/c`, so an unquoted `&` in the query string ends the
@@ -84,7 +98,7 @@ export declare function hermesRegistrationEnabled(home: string): {
     ok: boolean;
     detail?: string;
 };
-export declare const HERMES: NativeMcpClient;
+export declare const HERMES: KeyRequiredMcpClient;
 export declare const OPENCODE: NativeMcpClient;
 /** Every native MCP client. Derive from this, so a new harness cannot be missed. */
 export declare const NATIVE_MCP_CLIENTS: readonly NativeMcpClient[];

package/dist/lib/connect-clients.js

@@ -291,6 +291,7 @@ export const HERMES = {
     connectClient: 'hermes',
     skillAgent: 'hermes-agent',
     displayName: 'Hermes',
+    keyRequired: true,
     supportCheck: {
         args: ['mcp', 'add', '--help'],
         patterns: [/--auth\s+\{[^}]*oauth[^}]*\}/],
@@ -303,9 +304,6 @@ export const HERMES = {
         seedKey: seedHermesKey,
     },
     removals: [{ args: ['mcp', 'remove', 'tinyfish'], label: 'TinyFish registration from Hermes' }],
-    // Hermes completes OAuth while adding the server; a separate `mcp login` would authenticate twice.
-    oauthInAdd: true,
-    addArgs: (mcpUrl) => [...urlAddArgs(mcpUrl), '--auth', 'oauth'],
     launchWalkthrough: launchHermesWalkthrough,
     postConnectNote: 'Restart your Hermes session to pick up TinyFish — Hermes discovers MCP servers at startup.',
 };

package/dist/lib/mcp-endpoint.d.ts

@@ -1,4 +1,6 @@
 export declare const DEFAULT_MCP_URL = "https://agent.tinyfish.ai/mcp";
 export declare function endpointOf(url: string): string;
-/** `verifyMcpAuth` hits BASE_URL, so a sandbox key would 401 against prod. */
+/** One host serves `/mcp` and `/v1`, so origin is the API base. */
+export declare function apiBaseFromMcpUrl(mcpUrl: string): string | undefined;
+/** doctor reuses the CLI's own BASE_URL check; off-default endpoints cannot. */
 export declare function isDefaultEndpoint(mcpUrl: string): boolean;

package/dist/lib/mcp-endpoint.js

@@ -4,7 +4,16 @@ export function endpointOf(url) {
     const parsed = new URL(url);
     return `${parsed.origin}${parsed.pathname.replace(/\/$/, '')}`;
 }
-/** `verifyMcpAuth` hits BASE_URL, so a sandbox key would 401 against prod. */
+/** One host serves `/mcp` and `/v1`, so origin is the API base. */
+export function apiBaseFromMcpUrl(mcpUrl) {
+    try {
+        return new URL(mcpUrl).origin;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** doctor reuses the CLI's own BASE_URL check; off-default endpoints cannot. */
 export function isDefaultEndpoint(mcpUrl) {
     try {
         return endpointOf(mcpUrl) === endpointOf(DEFAULT_MCP_URL);

package/dist/lib/verify.d.ts

@@ -11,4 +11,4 @@ export interface VerifyResult {
 /** Reachability check. Verify failure is a warning, never install failure. */
 export declare function verifyMcpHealth(mcpUrl: string): Promise<VerifyResult>;
 /** Authenticated check — where the CLI holds the key (Cursor, OpenClaw, Hermes). */
-export declare function verifyMcpAuth(apiKey: string): Promise<VerifyResult>;
+export declare function verifyMcpAuth(apiKey: string, apiBaseUrl?: string): Promise<VerifyResult>;

package/dist/lib/verify.js

@@ -62,10 +62,10 @@ export async function verifyMcpHealth(mcpUrl) {
     }
 }
 /** Authenticated check — where the CLI holds the key (Cursor, OpenClaw, Hermes). */
-export async function verifyMcpAuth(apiKey) {
+export async function verifyMcpAuth(apiKey, apiBaseUrl) {
     try {
         // Bound it: the SDK default is 600s, and a warning-only check must never hang an install.
-        await listRuns({ limit: 1 }, apiKey, VERIFY_TIMEOUT_MS);
+        await listRuns({ limit: 1 }, apiKey, VERIFY_TIMEOUT_MS, apiBaseUrl);
         return { depth: 'health+auth', ok: true };
     }
     catch (e) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiny-fish/cli",
-  "version": "0.30.2-next.264",
+  "version": "0.30.2-next.266",
   "description": "TinyFish CLI — run web automations from your terminal",
   "type": "module",
   "bin": {