@tiny-fish/cli 0.30.2-next.266 → 0.30.2-next.267

package/dist/commands/connect.js

@@ -148,6 +148,124 @@ async function runMissingHarnessFallback(displayName, connectClient, state, tele
     errLine('The TinyFish CLI is installed and working.');
     errLine('Using a different agent? Run: tinyfish connect --all');
 }
+/** Resolved before the removals, so a refusal strands no registration. */
+async function prepareInstallAuth(client, options, keyAuthSupported) {
+    // Prod MCP accepts X-API-Key, so a stored key replaces the browser OAuth hop.
+    const storedKey = validatedApiKey(options.apiKey);
+    const keyedAdd = resolveKeyedAdd(client, storedKey, keyAuthSupported, options.deferOutro);
+    // Refuses here when key-required; others keep their OAuth argv.
+    const buildAddArgs = keyedAdd
+        ? (mcpUrl) => keyedAdd.spec.addArgs(mcpUrl, keyedAdd.key)
+        : keylessAddArgs(client, keyAuthSupported, options.mcpUrl);
+    if (options.keyAuthOnly && !keyedAdd) {
+        // All native clients have keyAuth; missing flags mean an old install.
+        if (client.keyAuth) {
+            throw new ConnectStepError(`This ${client.displayName} install cannot take a TinyFish API key, and signing in ` +
+                `needs a terminal. Update it, then re-run: tinyfish connect ${client.connectClient}`, 'harness_too_old');
+        }
+        throw new ConnectStepError(`${client.displayName} cannot take a TinyFish API key, and signing in needs a ` +
+            `terminal. Run: tinyfish connect ${client.connectClient}`, 'key_auth_unsupported');
+    }
+    // Verify first: a revoked key in a foreign .env is unrecoverable.
+    if (keyedAdd?.spec.seedKey) {
+        await verifyKeyBeforeSeeding(keyedAdd.key, client.displayName, options.mcpUrl);
+    }
+    return { keyedAdd, buildAddArgs };
+}
+/** Returns the seeded-credential note when a key was written into a user-owned file. */
+function performMcpAdd(client, options, plan, attemptId) {
+    const { keyedAdd, buildAddArgs } = plan;
+    const mcpUrl = new URL(options.mcpUrl);
+    mcpUrl.searchParams.set('source', CONNECT_SOURCE);
+    mcpUrl.searchParams.set('client', client.connectClient);
+    mcpUrl.searchParams.set('connect_attempt_id', attemptId);
+    errLine(`Adding TinyFish to ${client.displayName}...`);
+    // Header keys ride argv (/proc/<pid>/cmdline); these CLIs take headers no other way.
+    const addArgs = buildAddArgs(mcpUrl.toString());
+    // Capturing an inline-OAuth add hides the sign-in URL and hangs.
+    const interactiveAdd = !(client.nonInteractiveAdd || keyedAdd);
+    // After the removals: an interrupt there leaves no key behind.
+    const seeded = keyedAdd?.spec.seedKey?.(keyedAdd.key);
+    const addOptions = interactiveAdd
+        ? { stdio: 'inherit', timeout: options.authTimeoutMs }
+        : seeded
+            ? {
+                encoding: 'utf8',
+                // Without it, the 1 MiB default overflows into a misread Ctrl+C.
+                maxBuffer: STEP_MAX_BUFFER,
+                // The unattended path had no bound at all before; captureStdio's is the floor.
+                timeout: options.authTimeoutMs ?? SKILL_INSTALL_TIMEOUT_MS,
+                input: seeded.stdinInput,
+                env: seeded.env,
+            }
+            : captureStdio(options.verbose ?? false);
+    const addResult = spawn.sync(client.command, addArgs, addOptions);
+    // Rolls back first: signInStepError throws on a Ctrl+C.
+    const failAdd = (build) => {
+        seeded?.rollback();
+        const error = build();
+        replay(capturedOutput(addResult));
+        throw error;
+    };
+    if (addResult.error || addResult.status !== 0) {
+        failAdd(() => signInStepError(`Could not add TinyFish to ${client.displayName}`, addResult, interactiveAdd && options.authTimeoutMs !== undefined));
+    }
+    const registration = seeded?.confirmRegistered();
+    if (registration && !registration.ok) {
+        failAdd(() => new ConnectStepError(`${client.displayName} reported success but TinyFish is not enabled there` +
+            `${registration.detail ? `: ${registration.detail}` : ''}.`, 'invalid_config'));
+    }
+    return seeded?.note;
+}
+function performLoginStep(client, pendingLogin, options) {
+    errLine('Signing in to TinyFish...');
+    const loginResult = spawn.sync(client.command, [...pendingLogin], {
+        stdio: 'inherit',
+        timeout: options.authTimeoutMs,
+    });
+    if (loginResult.error || loginResult.status !== 0) {
+        throw signInStepError(`Could not authenticate TinyFish in ${client.displayName}`, loginResult, options.authTimeoutMs !== undefined);
+    }
+}
+function announceAuthNotes(useKeyAuth, degradedNotes, seededNote) {
+    if (useKeyAuth) {
+        errLine(degradedNotes?.keyed ?? 'Using your stored TinyFish API key — no browser sign-in needed.');
+        // Every other credential the CLI writes into a user-owned file says so too.
+        if (seededNote)
+            errLine(seededNote);
+    }
+    else if (degradedNotes) {
+        // Printed here, not with the closing line, so a `--launch` run sees it before the handover.
+        errLine(degradedNotes.deferred);
+    }
+}
+function completeAuthFlow(client, options, state, telemetry, ctx) {
+    const { useKeyAuth, loginDegraded, loginArgs, probeAuthenticated } = ctx;
+    // Codex runs OAuth inside `mcp add` and exits 0 either way, so the recorded state decides
+    // whether the login step below still runs. Unknown keeps the pre-probe behaviour.
+    const addSignedIn = probeAuthenticated?.();
+    if (addSignedIn)
+        telemetry.track('checkpoint', { phase: 'oauth_done' });
+    announceAuthNotes(useKeyAuth, loginDegraded ? client.degradedAuthNotes : undefined, ctx.seededNote);
+    // A probed client signs in again only when its inline OAuth is known to have been abandoned.
+    const retryLogin = probeAuthenticated ? addSignedIn === false : true;
+    const pendingLogin = !useKeyAuth && retryLogin ? loginArgs : undefined;
+    let signInDeferred = !useKeyAuth && !addSignedIn && !pendingLogin;
+    if (pendingLogin) {
+        state.stage = 'client_oauth';
+        performLoginStep(client, pendingLogin, options);
+        if (probeAuthenticated?.() === false)
+            signInDeferred = true;
+        else
+            telemetry.track('checkpoint', { phase: 'oauth_done' });
+    }
+    const authMode = useKeyAuth
+        ? AuthMode.ApiKey
+        : signInDeferred
+            ? 'deferred'
+            : AuthMode.OAuth;
+    return { authMode, signInDeferred };
+}
 async function connectNativeMcpClient(client, options) {
     const telemetry = createConnectTelemetry(options.mcpUrl, client.connectClient, options);
     const state = { stage: 'prerequisite_check', settled: false };
@@ -160,118 +278,27 @@ async function connectNativeMcpClient(client, options) {
         const { optionalSupported, keyAuthSupported, harnessVersion } = support;
         telemetry.setHarnessVersion(harnessVersion);
         state.harnessDegraded = !!client.loginArgs && !optionalSupported;
-        // Prod MCP accepts X-API-Key, so a stored key replaces the browser OAuth hop.
-        const storedKey = validatedApiKey(options.apiKey);
-        const keyedAdd = resolveKeyedAdd(client, storedKey, keyAuthSupported, options.deferOutro);
-        const useKeyAuth = !!keyedAdd;
-        // Refuses here when key-required; others keep their OAuth argv.
-        const buildAddArgs = keyedAdd
-            ? (mcpUrl) => keyedAdd.spec.addArgs(mcpUrl, keyedAdd.key)
-            : keylessAddArgs(client, keyAuthSupported, options.mcpUrl);
-        if (options.keyAuthOnly && !useKeyAuth) {
-            // All native clients have keyAuth; missing flags mean an old install.
-            if (client.keyAuth) {
-                throw new ConnectStepError(`This ${client.displayName} install cannot take a TinyFish API key, and signing in ` +
-                    `needs a terminal. Update it, then re-run: tinyfish connect ${client.connectClient}`, 'harness_too_old');
-            }
-            throw new ConnectStepError(`${client.displayName} cannot take a TinyFish API key, and signing in needs a ` +
-                `terminal. Run: tinyfish connect ${client.connectClient}`, 'key_auth_unsupported');
-        }
-        // Verify first: a revoked key in a foreign .env is unrecoverable.
-        if (keyedAdd?.spec.seedKey) {
-            await verifyKeyBeforeSeeding(keyedAdd.key, client.displayName, options.mcpUrl);
-        }
+        const plan = await prepareInstallAuth(client, options, keyAuthSupported);
+        const useKeyAuth = !!plan.keyedAdd;
         telemetry.track('checkpoint', { phase: 'prerequisite_ok' });
         state.stage = 'registration_cleanup';
         for (const removal of client.removals)
             removeExistingRegistration(client, removal, options.verbose ?? false);
-        const mcpUrl = new URL(options.mcpUrl);
-        mcpUrl.searchParams.set('source', CONNECT_SOURCE);
-        mcpUrl.searchParams.set('client', client.connectClient);
-        mcpUrl.searchParams.set('connect_attempt_id', telemetry.attemptId);
         // Undefining `loginArgs` reuses the deferred-auth path codex/hermes already take.
         const loginDegraded = state.harnessDegraded === true;
         const loginArgs = loginDegraded ? undefined : client.loginArgs;
         // A probed client authenticates inside `mcp add` too, so a failure there is either.
         state.stage =
             loginArgs && !probeAuthenticated ? 'registration' : 'registration_or_authentication';
-        errLine(`Adding TinyFish to ${client.displayName}...`);
-        // Header keys ride argv (/proc/<pid>/cmdline); these CLIs take headers no other way.
-        const addArgs = buildAddArgs(mcpUrl.toString());
-        // Capturing an inline-OAuth add hides the sign-in URL and hangs.
-        const interactiveAdd = !(client.nonInteractiveAdd || keyedAdd);
-        // After the removals: an interrupt there leaves no key behind.
-        const seeded = keyedAdd?.spec.seedKey?.(keyedAdd.key);
-        const addOptions = interactiveAdd
-            ? { stdio: 'inherit', timeout: options.authTimeoutMs }
-            : seeded
-                ? {
-                    encoding: 'utf8',
-                    // Without it, the 1 MiB default overflows into a misread Ctrl+C.
-                    maxBuffer: STEP_MAX_BUFFER,
-                    // The unattended path had no bound at all before; captureStdio's is the floor.
-                    timeout: options.authTimeoutMs ?? SKILL_INSTALL_TIMEOUT_MS,
-                    input: seeded.stdinInput,
-                    env: seeded.env,
-                }
-                : captureStdio(options.verbose ?? false);
-        const addResult = spawn.sync(client.command, addArgs, addOptions);
-        // Rolls back first: signInStepError throws on a Ctrl+C.
-        const failAdd = (build) => {
-            seeded?.rollback();
-            const error = build();
-            replay(capturedOutput(addResult));
-            throw error;
-        };
-        if (addResult.error || addResult.status !== 0) {
-            failAdd(() => signInStepError(`Could not add TinyFish to ${client.displayName}`, addResult, interactiveAdd && options.authTimeoutMs !== undefined));
-        }
-        const registration = seeded?.confirmRegistered();
-        if (registration && !registration.ok) {
-            failAdd(() => new ConnectStepError(`${client.displayName} reported success but TinyFish is not enabled there` +
-                `${registration.detail ? `: ${registration.detail}` : ''}.`, 'invalid_config'));
-        }
+        const seededNote = performMcpAdd(client, options, plan, telemetry.attemptId);
         telemetry.track('checkpoint', { phase: 'registered' });
-        // Codex runs OAuth inside `mcp add` and exits 0 either way, so the recorded state decides
-        // whether the login step below still runs. Unknown keeps the pre-probe behaviour.
-        const addSignedIn = probeAuthenticated?.();
-        if (addSignedIn)
-            telemetry.track('checkpoint', { phase: 'oauth_done' });
-        const degradedNotes = loginDegraded ? client.degradedAuthNotes : undefined;
-        if (useKeyAuth) {
-            errLine(degradedNotes?.keyed ?? 'Using your stored TinyFish API key — no browser sign-in needed.');
-            // Every other credential the CLI writes into a user-owned file says so too.
-            if (seeded)
-                errLine(seeded.note);
-        }
-        else if (degradedNotes) {
-            // Printed here, not with the closing line, so a `--launch` run sees it before the handover.
-            errLine(degradedNotes.deferred);
-        }
-        // A probed client signs in again only when its inline OAuth is known to have been abandoned.
-        const retryLogin = probeAuthenticated ? addSignedIn === false : true;
-        const pendingLogin = !useKeyAuth && retryLogin ? loginArgs : undefined;
-        let signInDeferred = !useKeyAuth && !addSignedIn && !pendingLogin;
-        if (pendingLogin) {
-            state.stage = 'client_oauth';
-            errLine('Signing in to TinyFish...');
-            const loginResult = spawn.sync(client.command, pendingLogin, {
-                stdio: 'inherit',
-                timeout: options.authTimeoutMs,
-            });
-            if (loginResult.error || loginResult.status !== 0) {
-                throw signInStepError(`Could not authenticate TinyFish in ${client.displayName}`, loginResult, options.authTimeoutMs !== undefined);
-            }
-            if (probeAuthenticated?.() === false)
-                signInDeferred = true;
-            else
-                telemetry.track('checkpoint', { phase: 'oauth_done' });
-        }
-        const authMode = useKeyAuth
-            ? AuthMode.ApiKey
-            : signInDeferred
-                ? 'deferred'
-                : AuthMode.OAuth;
+        const { authMode, signInDeferred } = completeAuthFlow(client, options, state, telemetry, {
+            useKeyAuth,
+            loginDegraded,
+            loginArgs,
+            probeAuthenticated,
+            seededNote,
+        });
         state.authMode = authMode;
         // Registration/OAuth make MCP work; later steps are cosmetic and must not fail the attempt.
         settle(state, telemetry, 'completed', { authMode });
@@ -611,6 +638,89 @@ const CLIENT_CONNECTORS = {
         }
     },
 };
+function parseMcpUrlOption(options) {
+    let mcpUrl = options.url ?? DEFAULT_MCP_URL;
+    if (mcpUrl.startsWith('-')) {
+        throw new Error(`Invalid --url value: ${mcpUrl}`);
+    }
+    let parsedUrl;
+    try {
+        parsedUrl = new URL(mcpUrl);
+    }
+    catch {
+        throw new Error(`Invalid --url value: ${mcpUrl}`);
+    }
+    if (!['http:', 'https:'].includes(parsedUrl.protocol)) {
+        throw new Error(`Invalid --url value: ${mcpUrl}`);
+    }
+    // Page-minted attempt id rides in on --url. Strip before the URL becomes the MCP
+    // base — registration re-stamps it, and nothing else may carry it.
+    const pageAttemptId = parsedUrl.searchParams.get('connect_attempt_id');
+    let attemptId;
+    if (pageAttemptId !== null) {
+        parsedUrl.searchParams.delete('connect_attempt_id');
+        mcpUrl = parsedUrl.toString();
+        if (z.uuid().safeParse(pageAttemptId).success)
+            attemptId = pageAttemptId;
+    }
+    return { mcpUrl, attemptId };
+}
+async function connectAllPath(options, mcpUrl) {
+    if (options.launch) {
+        throw new Error('--launch is not supported with --all. Connect a single client to launch it.');
+    }
+    const exitCode = await runConnectAll({
+        apiKey: options.apiKey,
+        mcpUrl,
+        dryRun: options.dryRun ?? false,
+        uninstall: options.uninstall ?? false,
+        noLaunch: options.skipLaunch === true,
+        verbose: options.verbose ?? false,
+    });
+    // Preserve the 130 runGuarded set on Ctrl+C.
+    if (!process.exitCode)
+        process.exitCode = exitCode;
+}
+async function connectPickPath(options, mcpUrl) {
+    if (options.launch) {
+        throw new Error('--launch is not supported with --all. Connect a single client to launch it.');
+    }
+    const humanInitiated = detectHumanInitiated();
+    if (!humanInitiated) {
+        errLine('No terminal detected: connecting every detected harness (same as tinyfish connect --all).');
+    }
+    const exitCode = await runConnectAll({
+        apiKey: options.apiKey,
+        mcpUrl,
+        dryRun: false,
+        uninstall: false,
+        pick: humanInitiated,
+        verbose: options.verbose ?? false,
+    });
+    // Preserve the 130 runGuarded set on Ctrl+C.
+    if (!process.exitCode)
+        process.exitCode = exitCode;
+}
+async function connectSingleClient(client, options, mcpUrl, attemptId) {
+    const connectOptions = {
+        apiKey: options.apiKey,
+        mcpUrl,
+        launch: options.launch ?? false,
+        attemptId,
+        // A key that the install cannot use leaves only a browser hop no agent can finish.
+        keyAuthOnly: !detectHumanInitiated() && !!validatedApiKey(options.apiKey),
+        // Only here: a missing harness rescues via the CLI (PF-3707).
+        fallbackWhenMissing: true,
+        verbose: options.verbose ?? false,
+    };
+    const connector = CLIENT_CONNECTORS[client];
+    if (!connector) {
+        throw new Error('Unsupported client: ' +
+            client +
+            '. Supported clients: claude-code, codex, cursor, grok, hermes, openclaw, opencode');
+    }
+    await connector(connectOptions);
+}
 export function registerConnect(program) {
     program
         .command('connect')
@@ -628,94 +738,22 @@ export function registerConnect(program) {
         if (options.apiKey && !validateKeyFormat(options.apiKey)) {
             throw new Error('Invalid --api-key value');
         }
-        let mcpUrl = options.url ?? DEFAULT_MCP_URL;
-        if (mcpUrl.startsWith('-')) {
-            throw new Error(`Invalid --url value: ${mcpUrl}`);
-        }
-        let parsedUrl;
-        try {
-            parsedUrl = new URL(mcpUrl);
-        }
-        catch {
-            throw new Error(`Invalid --url value: ${mcpUrl}`);
-        }
-        if (!['http:', 'https:'].includes(parsedUrl.protocol)) {
-            throw new Error(`Invalid --url value: ${mcpUrl}`);
-        }
-        // Page-minted attempt id rides in on --url. Strip before the URL becomes the MCP
-        // base — registration re-stamps it, and nothing else may carry it.
-        const pageAttemptId = parsedUrl.searchParams.get('connect_attempt_id');
-        let attemptId;
-        if (pageAttemptId !== null) {
-            parsedUrl.searchParams.delete('connect_attempt_id');
-            mcpUrl = parsedUrl.toString();
-            if (z.uuid().safeParse(pageAttemptId).success)
-                attemptId = pageAttemptId;
-        }
+        const { mcpUrl, attemptId } = parseMcpUrlOption(options);
         if (options.all) {
             if (client) {
                 throw new Error('Pass either a client or --all, not both.');
             }
-            if (options.launch) {
-                throw new Error('--launch is not supported with --all. Connect a single client to launch it.');
-            }
-            const exitCode = await runConnectAll({
-                apiKey: options.apiKey,
-                mcpUrl,
-                dryRun: options.dryRun ?? false,
-                uninstall: options.uninstall ?? false,
-                noLaunch: options.skipLaunch === true,
-                verbose: options.verbose ?? false,
-            });
-            // Preserve the 130 runGuarded set on Ctrl+C.
-            if (!process.exitCode)
-                process.exitCode = exitCode;
+            await connectAllPath(options, mcpUrl);
             return;
         }
         if (options.dryRun || options.uninstall || options.skipLaunch) {
             throw new Error('--dry-run, --uninstall and --skip-launch are only supported with --all.');
         }
         if (!client) {
-            if (options.launch) {
-                throw new Error('--launch is not supported with --all. Connect a single client to launch it.');
-            }
-            const humanInitiated = detectHumanInitiated();
-            if (!humanInitiated) {
-                errLine('No terminal detected: connecting every detected harness (same as tinyfish connect --all).');
-            }
-            const exitCode = await runConnectAll({
-                apiKey: options.apiKey,
-                mcpUrl,
-                dryRun: false,
-                uninstall: false,
-                pick: humanInitiated,
-                verbose: options.verbose ?? false,
-            });
-            // Preserve the 130 runGuarded set on Ctrl+C.
-            if (!process.exitCode)
-                process.exitCode = exitCode;
+            await connectPickPath(options, mcpUrl);
             return;
         }
-        const connectOptions = {
-            apiKey: options.apiKey,
-            mcpUrl,
-            launch: options.launch ?? false,
-            attemptId,
-            // A key that the install cannot use leaves only a browser hop no agent can finish.
-            keyAuthOnly: !detectHumanInitiated() && !!validatedApiKey(options.apiKey),
-            // Only here: a missing harness rescues via the CLI (PF-3707).
-            fallbackWhenMissing: true,
-            verbose: options.verbose ?? false,
-        };
-        const connector = CLIENT_CONNECTORS[client];
-        if (connector) {
-            await connector(connectOptions);
-        }
-        else {
-            throw new Error('Unsupported client: ' +
-                client +
-                '. Supported clients: claude-code, codex, cursor, grok, hermes, openclaw, opencode');
-        }
+        await connectSingleClient(client, options, mcpUrl, attemptId);
         // Deferred to here so the notice lands after install output, not interleaved with it.
         emitNotice();
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiny-fish/cli",
-  "version": "0.30.2-next.266",
+  "version": "0.30.2-next.267",
   "description": "TinyFish CLI — run web automations from your terminal",
   "type": "module",
   "bin": {