@tiny-fish/cli 0.30.2-next.266 → 0.30.2-next.268

package/dist/commands/connect.js

@@ -148,6 +148,124 @@ async function runMissingHarnessFallback(displayName, connectClient, state, tele
     errLine('The TinyFish CLI is installed and working.');
     errLine('Using a different agent? Run: tinyfish connect --all');
 }
+/** Resolved before the removals, so a refusal strands no registration. */
+async function prepareInstallAuth(client, options, keyAuthSupported) {
+    // Prod MCP accepts X-API-Key, so a stored key replaces the browser OAuth hop.
+    const storedKey = validatedApiKey(options.apiKey);
+    const keyedAdd = resolveKeyedAdd(client, storedKey, keyAuthSupported, options.deferOutro);
+    // Refuses here when key-required; others keep their OAuth argv.
+    const buildAddArgs = keyedAdd
+        ? (mcpUrl) => keyedAdd.spec.addArgs(mcpUrl, keyedAdd.key)
+        : keylessAddArgs(client, keyAuthSupported, options.mcpUrl);
+    if (options.keyAuthOnly && !keyedAdd) {
+        // All native clients have keyAuth; missing flags mean an old install.
+        if (client.keyAuth) {
+            throw new ConnectStepError(`This ${client.displayName} install cannot take a TinyFish API key, and signing in ` +
+                `needs a terminal. Update it, then re-run: tinyfish connect ${client.connectClient}`, 'harness_too_old');
+        }
+        throw new ConnectStepError(`${client.displayName} cannot take a TinyFish API key, and signing in needs a ` +
+            `terminal. Run: tinyfish connect ${client.connectClient}`, 'key_auth_unsupported');
+    }
+    // Verify first: a revoked key in a foreign .env is unrecoverable.
+    if (keyedAdd?.spec.seedKey) {
+        await verifyKeyBeforeSeeding(keyedAdd.key, client.displayName, options.mcpUrl);
+    }
+    return { keyedAdd, buildAddArgs };
+}
+/** Returns the seeded-credential note when a key was written into a user-owned file. */
+function performMcpAdd(client, options, plan, attemptId) {
+    const { keyedAdd, buildAddArgs } = plan;
+    const mcpUrl = new URL(options.mcpUrl);
+    mcpUrl.searchParams.set('source', CONNECT_SOURCE);
+    mcpUrl.searchParams.set('client', client.connectClient);
+    mcpUrl.searchParams.set('connect_attempt_id', attemptId);
+    errLine(`Adding TinyFish to ${client.displayName}...`);
+    // Header keys ride argv (/proc/<pid>/cmdline); these CLIs take headers no other way.
+    const addArgs = buildAddArgs(mcpUrl.toString());
+    // Capturing an inline-OAuth add hides the sign-in URL and hangs.
+    const interactiveAdd = !(client.nonInteractiveAdd || keyedAdd);
+    // After the removals: an interrupt there leaves no key behind.
+    const seeded = keyedAdd?.spec.seedKey?.(keyedAdd.key);
+    const addOptions = interactiveAdd
+        ? { stdio: 'inherit', timeout: options.authTimeoutMs }
+        : seeded
+            ? {
+                encoding: 'utf8',
+                // Without it, the 1 MiB default overflows into a misread Ctrl+C.
+                maxBuffer: STEP_MAX_BUFFER,
+                // The unattended path had no bound at all before; captureStdio's is the floor.
+                timeout: options.authTimeoutMs ?? SKILL_INSTALL_TIMEOUT_MS,
+                input: seeded.stdinInput,
+                env: seeded.env,
+            }
+            : captureStdio(options.verbose ?? false);
+    const addResult = spawn.sync(client.command, addArgs, addOptions);
+    // Rolls back first: signInStepError throws on a Ctrl+C.
+    const failAdd = (build) => {
+        seeded?.rollback();
+        const error = build();
+        replay(capturedOutput(addResult));
+        throw error;
+    };
+    if (addResult.error || addResult.status !== 0) {
+        failAdd(() => signInStepError(`Could not add TinyFish to ${client.displayName}`, addResult, interactiveAdd && options.authTimeoutMs !== undefined));
+    }
+    const registration = seeded?.confirmRegistered();
+    if (registration && !registration.ok) {
+        failAdd(() => new ConnectStepError(`${client.displayName} reported success but TinyFish is not enabled there` +
+            `${registration.detail ? `: ${registration.detail}` : ''}.`, 'invalid_config'));
+    }
+    return seeded?.note;
+}
+function performLoginStep(client, pendingLogin, options) {
+    errLine('Signing in to TinyFish...');
+    const loginResult = spawn.sync(client.command, [...pendingLogin], {
+        stdio: 'inherit',
+        timeout: options.authTimeoutMs,
+    });
+    if (loginResult.error || loginResult.status !== 0) {
+        throw signInStepError(`Could not authenticate TinyFish in ${client.displayName}`, loginResult, options.authTimeoutMs !== undefined);
+    }
+}
+function announceAuthNotes(useKeyAuth, degradedNotes, seededNote) {
+    if (useKeyAuth) {
+        errLine(degradedNotes?.keyed ?? 'Using your stored TinyFish API key — no browser sign-in needed.');
+        // Every other credential the CLI writes into a user-owned file says so too.
+        if (seededNote)
+            errLine(seededNote);
+    }
+    else if (degradedNotes) {
+        // Printed here, not with the closing line, so a `--launch` run sees it before the handover.
+        errLine(degradedNotes.deferred);
+    }
+}
+function completeAuthFlow(client, options, state, telemetry, ctx) {
+    const { useKeyAuth, loginDegraded, loginArgs, probeAuthenticated } = ctx;
+    // Codex runs OAuth inside `mcp add` and exits 0 either way, so the recorded state decides
+    // whether the login step below still runs. Unknown keeps the pre-probe behaviour.
+    const addSignedIn = probeAuthenticated?.();
+    if (addSignedIn)
+        telemetry.track('checkpoint', { phase: 'oauth_done' });
+    announceAuthNotes(useKeyAuth, loginDegraded ? client.degradedAuthNotes : undefined, ctx.seededNote);
+    // A probed client signs in again only when its inline OAuth is known to have been abandoned.
+    const retryLogin = probeAuthenticated ? addSignedIn === false : true;
+    const pendingLogin = !useKeyAuth && retryLogin ? loginArgs : undefined;
+    let signInDeferred = !useKeyAuth && !addSignedIn && !pendingLogin;
+    if (pendingLogin) {
+        state.stage = 'client_oauth';
+        performLoginStep(client, pendingLogin, options);
+        if (probeAuthenticated?.() === false)
+            signInDeferred = true;
+        else
+            telemetry.track('checkpoint', { phase: 'oauth_done' });
+    }
+    const authMode = useKeyAuth
+        ? AuthMode.ApiKey
+        : signInDeferred
+            ? 'deferred'
+            : AuthMode.OAuth;
+    return { authMode, signInDeferred };
+}
 async function connectNativeMcpClient(client, options) {
     const telemetry = createConnectTelemetry(options.mcpUrl, client.connectClient, options);
     const state = { stage: 'prerequisite_check', settled: false };
@@ -160,118 +278,27 @@ async function connectNativeMcpClient(client, options) {
         const { optionalSupported, keyAuthSupported, harnessVersion } = support;
         telemetry.setHarnessVersion(harnessVersion);
         state.harnessDegraded = !!client.loginArgs && !optionalSupported;
-        // Prod MCP accepts X-API-Key, so a stored key replaces the browser OAuth hop.
-        const storedKey = validatedApiKey(options.apiKey);
-        const keyedAdd = resolveKeyedAdd(client, storedKey, keyAuthSupported, options.deferOutro);
-        const useKeyAuth = !!keyedAdd;
-        // Refuses here when key-required; others keep their OAuth argv.
-        const buildAddArgs = keyedAdd
-            ? (mcpUrl) => keyedAdd.spec.addArgs(mcpUrl, keyedAdd.key)
-            : keylessAddArgs(client, keyAuthSupported, options.mcpUrl);
-        if (options.keyAuthOnly && !useKeyAuth) {
-            // All native clients have keyAuth; missing flags mean an old install.
-            if (client.keyAuth) {
-                throw new ConnectStepError(`This ${client.displayName} install cannot take a TinyFish API key, and signing in ` +
-                    `needs a terminal. Update it, then re-run: tinyfish connect ${client.connectClient}`, 'harness_too_old');
-            }
-            throw new ConnectStepError(`${client.displayName} cannot take a TinyFish API key, and signing in needs a ` +
-                `terminal. Run: tinyfish connect ${client.connectClient}`, 'key_auth_unsupported');
-        }
-        // Verify first: a revoked key in a foreign .env is unrecoverable.
-        if (keyedAdd?.spec.seedKey) {
-            await verifyKeyBeforeSeeding(keyedAdd.key, client.displayName, options.mcpUrl);
-        }
+        const plan = await prepareInstallAuth(client, options, keyAuthSupported);
+        const useKeyAuth = !!plan.keyedAdd;
         telemetry.track('checkpoint', { phase: 'prerequisite_ok' });
         state.stage = 'registration_cleanup';
         for (const removal of client.removals)
             removeExistingRegistration(client, removal, options.verbose ?? false);
-        const mcpUrl = new URL(options.mcpUrl);
-        mcpUrl.searchParams.set('source', CONNECT_SOURCE);
-        mcpUrl.searchParams.set('client', client.connectClient);
-        mcpUrl.searchParams.set('connect_attempt_id', telemetry.attemptId);
         // Undefining `loginArgs` reuses the deferred-auth path codex/hermes already take.
         const loginDegraded = state.harnessDegraded === true;
         const loginArgs = loginDegraded ? undefined : client.loginArgs;
         // A probed client authenticates inside `mcp add` too, so a failure there is either.
         state.stage =
             loginArgs && !probeAuthenticated ? 'registration' : 'registration_or_authentication';
-        errLine(`Adding TinyFish to ${client.displayName}...`);
-        // Header keys ride argv (/proc/<pid>/cmdline); these CLIs take headers no other way.
-        const addArgs = buildAddArgs(mcpUrl.toString());
-        // Capturing an inline-OAuth add hides the sign-in URL and hangs.
-        const interactiveAdd = !(client.nonInteractiveAdd || keyedAdd);
-        // After the removals: an interrupt there leaves no key behind.
-        const seeded = keyedAdd?.spec.seedKey?.(keyedAdd.key);
-        const addOptions = interactiveAdd
-            ? { stdio: 'inherit', timeout: options.authTimeoutMs }
-            : seeded
-                ? {
-                    encoding: 'utf8',
-                    // Without it, the 1 MiB default overflows into a misread Ctrl+C.
-                    maxBuffer: STEP_MAX_BUFFER,
-                    // The unattended path had no bound at all before; captureStdio's is the floor.
-                    timeout: options.authTimeoutMs ?? SKILL_INSTALL_TIMEOUT_MS,
-                    input: seeded.stdinInput,
-                    env: seeded.env,
-                }
-                : captureStdio(options.verbose ?? false);
-        const addResult = spawn.sync(client.command, addArgs, addOptions);
-        // Rolls back first: signInStepError throws on a Ctrl+C.
-        const failAdd = (build) => {
-            seeded?.rollback();
-            const error = build();
-            replay(capturedOutput(addResult));
-            throw error;
-        };
-        if (addResult.error || addResult.status !== 0) {
-            failAdd(() => signInStepError(`Could not add TinyFish to ${client.displayName}`, addResult, interactiveAdd && options.authTimeoutMs !== undefined));
-        }
-        const registration = seeded?.confirmRegistered();
-        if (registration && !registration.ok) {
-            failAdd(() => new ConnectStepError(`${client.displayName} reported success but TinyFish is not enabled there` +
-                `${registration.detail ? `: ${registration.detail}` : ''}.`, 'invalid_config'));
-        }
+        const seededNote = performMcpAdd(client, options, plan, telemetry.attemptId);
         telemetry.track('checkpoint', { phase: 'registered' });
-        // Codex runs OAuth inside `mcp add` and exits 0 either way, so the recorded state decides
-        // whether the login step below still runs. Unknown keeps the pre-probe behaviour.
-        const addSignedIn = probeAuthenticated?.();
-        if (addSignedIn)
-            telemetry.track('checkpoint', { phase: 'oauth_done' });
-        const degradedNotes = loginDegraded ? client.degradedAuthNotes : undefined;
-        if (useKeyAuth) {
-            errLine(degradedNotes?.keyed ?? 'Using your stored TinyFish API key — no browser sign-in needed.');
-            // Every other credential the CLI writes into a user-owned file says so too.
-            if (seeded)
-                errLine(seeded.note);
-        }
-        else if (degradedNotes) {
-            // Printed here, not with the closing line, so a `--launch` run sees it before the handover.
-            errLine(degradedNotes.deferred);
-        }
-        // A probed client signs in again only when its inline OAuth is known to have been abandoned.
-        const retryLogin = probeAuthenticated ? addSignedIn === false : true;
-        const pendingLogin = !useKeyAuth && retryLogin ? loginArgs : undefined;
-        let signInDeferred = !useKeyAuth && !addSignedIn && !pendingLogin;
-        if (pendingLogin) {
-            state.stage = 'client_oauth';
-            errLine('Signing in to TinyFish...');
-            const loginResult = spawn.sync(client.command, pendingLogin, {
-                stdio: 'inherit',
-                timeout: options.authTimeoutMs,
-            });
-            if (loginResult.error || loginResult.status !== 0) {
-                throw signInStepError(`Could not authenticate TinyFish in ${client.displayName}`, loginResult, options.authTimeoutMs !== undefined);
-            }
-            if (probeAuthenticated?.() === false)
-                signInDeferred = true;
-            else
-                telemetry.track('checkpoint', { phase: 'oauth_done' });
-        }
-        const authMode = useKeyAuth
-            ? AuthMode.ApiKey
-            : signInDeferred
-                ? 'deferred'
-                : AuthMode.OAuth;
+        const { authMode, signInDeferred } = completeAuthFlow(client, options, state, telemetry, {
+            useKeyAuth,
+            loginDegraded,
+            loginArgs,
+            probeAuthenticated,
+            seededNote,
+        });
         state.authMode = authMode;
         // Registration/OAuth make MCP work; later steps are cosmetic and must not fail the attempt.
         settle(state, telemetry, 'completed', { authMode });
@@ -611,6 +638,89 @@ const CLIENT_CONNECTORS = {
         }
     },
 };
+function parseMcpUrlOption(options) {
+    let mcpUrl = options.url ?? DEFAULT_MCP_URL;
+    if (mcpUrl.startsWith('-')) {
+        throw new Error(`Invalid --url value: ${mcpUrl}`);
+    }
+    let parsedUrl;
+    try {
+        parsedUrl = new URL(mcpUrl);
+    }
+    catch {
+        throw new Error(`Invalid --url value: ${mcpUrl}`);
+    }
+    if (!['http:', 'https:'].includes(parsedUrl.protocol)) {
+        throw new Error(`Invalid --url value: ${mcpUrl}`);
+    }
+    // Page-minted attempt id rides in on --url. Strip before the URL becomes the MCP
+    // base — registration re-stamps it, and nothing else may carry it.
+    const pageAttemptId = parsedUrl.searchParams.get('connect_attempt_id');
+    let attemptId;
+    if (pageAttemptId !== null) {
+        parsedUrl.searchParams.delete('connect_attempt_id');
+        mcpUrl = parsedUrl.toString();
+        if (z.uuid().safeParse(pageAttemptId).success)
+            attemptId = pageAttemptId;
+    }
+    return { mcpUrl, attemptId };
+}
+async function connectAllPath(options, mcpUrl) {
+    if (options.launch) {
+        throw new Error('--launch is not supported with --all. Connect a single client to launch it.');
+    }
+    const exitCode = await runConnectAll({
+        apiKey: options.apiKey,
+        mcpUrl,
+        dryRun: options.dryRun ?? false,
+        uninstall: options.uninstall ?? false,
+        noLaunch: options.skipLaunch === true,
+        verbose: options.verbose ?? false,
+    });
+    // Preserve the 130 runGuarded set on Ctrl+C.
+    if (!process.exitCode)
+        process.exitCode = exitCode;
+}
+async function connectPickPath(options, mcpUrl) {
+    if (options.launch) {
+        throw new Error('--launch is not supported with --all. Connect a single client to launch it.');
+    }
+    const humanInitiated = detectHumanInitiated();
+    if (!humanInitiated) {
+        errLine('No terminal detected: connecting every detected harness (same as tinyfish connect --all).');
+    }
+    const exitCode = await runConnectAll({
+        apiKey: options.apiKey,
+        mcpUrl,
+        dryRun: false,
+        uninstall: false,
+        pick: humanInitiated,
+        verbose: options.verbose ?? false,
+    });
+    // Preserve the 130 runGuarded set on Ctrl+C.
+    if (!process.exitCode)
+        process.exitCode = exitCode;
+}
+async function connectSingleClient(client, options, mcpUrl, attemptId) {
+    const connectOptions = {
+        apiKey: options.apiKey,
+        mcpUrl,
+        launch: options.launch ?? false,
+        attemptId,
+        // A key that the install cannot use leaves only a browser hop no agent can finish.
+        keyAuthOnly: !detectHumanInitiated() && !!validatedApiKey(options.apiKey),
+        // Only here: a missing harness rescues via the CLI (PF-3707).
+        fallbackWhenMissing: true,
+        verbose: options.verbose ?? false,
+    };
+    const connector = CLIENT_CONNECTORS[client];
+    if (!connector) {
+        throw new Error('Unsupported client: ' +
+            client +
+            '. Supported clients: claude-code, codex, cursor, grok, hermes, openclaw, opencode');
+    }
+    await connector(connectOptions);
+}
 export function registerConnect(program) {
     program
         .command('connect')
@@ -628,94 +738,22 @@ export function registerConnect(program) {
         if (options.apiKey && !validateKeyFormat(options.apiKey)) {
             throw new Error('Invalid --api-key value');
         }
-        let mcpUrl = options.url ?? DEFAULT_MCP_URL;
-        if (mcpUrl.startsWith('-')) {
-            throw new Error(`Invalid --url value: ${mcpUrl}`);
-        }
-        let parsedUrl;
-        try {
-            parsedUrl = new URL(mcpUrl);
-        }
-        catch {
-            throw new Error(`Invalid --url value: ${mcpUrl}`);
-        }
-        if (!['http:', 'https:'].includes(parsedUrl.protocol)) {
-            throw new Error(`Invalid --url value: ${mcpUrl}`);
-        }
-        // Page-minted attempt id rides in on --url. Strip before the URL becomes the MCP
-        // base — registration re-stamps it, and nothing else may carry it.
-        const pageAttemptId = parsedUrl.searchParams.get('connect_attempt_id');
-        let attemptId;
-        if (pageAttemptId !== null) {
-            parsedUrl.searchParams.delete('connect_attempt_id');
-            mcpUrl = parsedUrl.toString();
-            if (z.uuid().safeParse(pageAttemptId).success)
-                attemptId = pageAttemptId;
-        }
+        const { mcpUrl, attemptId } = parseMcpUrlOption(options);
         if (options.all) {
             if (client) {
                 throw new Error('Pass either a client or --all, not both.');
             }
-            if (options.launch) {
-                throw new Error('--launch is not supported with --all. Connect a single client to launch it.');
-            }
-            const exitCode = await runConnectAll({
-                apiKey: options.apiKey,
-                mcpUrl,
-                dryRun: options.dryRun ?? false,
-                uninstall: options.uninstall ?? false,
-                noLaunch: options.skipLaunch === true,
-                verbose: options.verbose ?? false,
-            });
-            // Preserve the 130 runGuarded set on Ctrl+C.
-            if (!process.exitCode)
-                process.exitCode = exitCode;
+            await connectAllPath(options, mcpUrl);
             return;
         }
         if (options.dryRun || options.uninstall || options.skipLaunch) {
             throw new Error('--dry-run, --uninstall and --skip-launch are only supported with --all.');
         }
         if (!client) {
-            if (options.launch) {
-                throw new Error('--launch is not supported with --all. Connect a single client to launch it.');
-            }
-            const humanInitiated = detectHumanInitiated();
-            if (!humanInitiated) {
-                errLine('No terminal detected: connecting every detected harness (same as tinyfish connect --all).');
-            }
-            const exitCode = await runConnectAll({
-                apiKey: options.apiKey,
-                mcpUrl,
-                dryRun: false,
-                uninstall: false,
-                pick: humanInitiated,
-                verbose: options.verbose ?? false,
-            });
-            // Preserve the 130 runGuarded set on Ctrl+C.
-            if (!process.exitCode)
-                process.exitCode = exitCode;
+            await connectPickPath(options, mcpUrl);
             return;
         }
-        const connectOptions = {
-            apiKey: options.apiKey,
-            mcpUrl,
-            launch: options.launch ?? false,
-            attemptId,
-            // A key that the install cannot use leaves only a browser hop no agent can finish.
-            keyAuthOnly: !detectHumanInitiated() && !!validatedApiKey(options.apiKey),
-            // Only here: a missing harness rescues via the CLI (PF-3707).
-            fallbackWhenMissing: true,
-            verbose: options.verbose ?? false,
-        };
-        const connector = CLIENT_CONNECTORS[client];
-        if (connector) {
-            await connector(connectOptions);
-        }
-        else {
-            throw new Error('Unsupported client: ' +
-                client +
-                '. Supported clients: claude-code, codex, cursor, grok, hermes, openclaw, opencode');
-        }
+        await connectSingleClient(client, options, mcpUrl, attemptId);
         // Deferred to here so the notice lands after install output, not interleaved with it.
         emitNotice();
     });

package/dist/lib/connect-all.js

@@ -63,17 +63,17 @@ const HARNESS_CONNECTORS = {
         return undefined;
     },
 };
-async function runHarnessConnect(harness, opts, keyAuthOnly, authTimeoutMs, hoistedCliInstall, onPostInstallFailed, deferOutro) {
+async function runHarnessConnect(harness, opts, extras) {
     return HARNESS_CONNECTORS[harness]({
         apiKey: opts.apiKey,
         mcpUrl: opts.mcpUrl,
         launch: false,
-        keyAuthOnly,
-        authTimeoutMs,
-        hoistedCliInstall,
-        onPostInstallFailed,
+        keyAuthOnly: extras.keyAuthOnly,
+        authTimeoutMs: extras.authTimeoutMs,
+        hoistedCliInstall: extras.hoistedCliInstall,
+        onPostInstallFailed: extras.onPostInstallFailed,
         verbose: opts.verbose,
-        deferOutro,
+        deferOutro: extras.deferOutro,
     });
 }
 /** Undefined means Ctrl+C: the caller stops the whole run. */
@@ -168,89 +168,80 @@ function hermesKeyKeptAdvisory() {
     return (`left ${HERMES_KEY_VAR} in Hermes' .env because the entry was not removed. ` +
         'Run the command above, then re-run `tinyfish connect --all --uninstall` to clear it.');
 }
-function uninstallHarness(harness, configPath, verbose, binaryOnPath) {
-    const result = removeHarnessRegistration(harness, configPath, verbose, binaryOnPath);
-    if (harness !== 'hermes')
-        return result;
-    // Clearing a key the entry still references would break a working install.
-    const removed = !result.removalFailed &&
-        (result.outcome === 'uninstalled' || result.outcome === 'uninstall_noop');
-    const advisory = removed ? clearHermesEnvKey() : hermesKeyKeptAdvisory();
-    if (!advisory)
-        return result;
-    // Appended, never replacing: an advisory must not hide the removal's message.
-    return {
-        ...result,
-        errorMessage: result.errorMessage ? `${result.errorMessage} ${advisory}` : advisory,
-    };
-}
-function removeHarnessRegistration(harness, configPath, verbose, binaryOnPath) {
-    const detection = { harness, detected: true, configPath, installed: false };
-    if (harness !== 'cursor') {
-        const removal = uninstallRuns(harness);
-        if (!removal) {
-            return { ...detection, outcome: 'uninstall_pointer', fixCommand: uninstallPointer(harness) };
-        }
-        // Stale config: the harness binary is gone, so its removal command cannot run.
-        // openclaw is exempt — its removal runs through npx, not the harness binary.
-        if (harness !== 'openclaw' && !binaryOnPath) {
-            return {
-                ...detection,
-                outcome: 'uninstall_pointer',
-                errorMessage: `no \`${removal.command}\` binary on PATH — nothing to run.`,
-                fixCommand: `Reinstall ${DISPLAY_NAMES[harness]} first, then: ${uninstallPointer(harness)}`,
-            };
-        }
-        // Absent marker = never connected here, so a non-zero removal exit is a no-op.
-        // Unreadable config cannot prove that, so it keeps the pointer.
-        const connectedBefore = connectContextState(harness) !== 'absent';
-        let removed = false;
-        try {
-            for (const args of removal.runs) {
-                const result = spawnRemoval(removal.command, args, removal.timeoutMs);
-                if (result.status !== 0 && verbose) {
-                    const details = result.stderr?.trim() || result.error?.message || `exit ${result.status}`;
-                    errLine(`${removal.command} ${args.join(' ')}: ${details}`);
-                }
-                // Same binary: a spawn-level failure (ENOENT, EPERM) repeats identically.
-                if (result.error) {
-                    return {
-                        ...detection,
-                        outcome: 'uninstalled',
-                        removalFailed: true,
-                        errorMessage: `could not run \`${removal.command} ${args.join(' ')}\` (${result.error.message}) — nothing removed.`,
-                        fixCommand: uninstallPointer(harness),
-                    };
-                }
-                // Non-zero is ambiguous (nothing registered vs real failure) — the pointer covers both.
-                if (result.status === 0)
-                    removed = true;
+function runRemovalCommands(detection, removal, verbose) {
+    const { harness } = detection;
+    let removed = false;
+    try {
+        for (const args of removal.runs) {
+            const result = spawnRemoval(removal.command, args, removal.timeoutMs);
+            if (result.status !== 0 && verbose) {
+                const details = result.stderr?.trim() || result.error?.message || `exit ${result.status}`;
+                errLine(`${removal.command} ${args.join(' ')}: ${details}`);
             }
-        }
-        catch (e) {
-            if (e instanceof ConnectInterruptedError) {
+            // Same binary: a spawn-level failure (ENOENT, EPERM) repeats identically.
+            if (result.error) {
                 return {
                     ...detection,
-                    outcome: 'interrupted',
-                    fixCommand: 'tinyfish connect --all --uninstall',
+                    outcome: 'uninstalled',
+                    removalFailed: true,
+                    errorMessage: `could not run \`${removal.command} ${args.join(' ')}\` (${result.error.message}) — nothing removed.`,
+                    fixCommand: uninstallPointer(harness),
                 };
             }
-            throw e;
+            // Non-zero is ambiguous (nothing registered vs real failure) — the pointer covers both.
+            if (result.status === 0)
+                removed = true;
         }
-        if (removed) {
-            // Kept marker makes doctor emit a registration-lost repair that undoes this.
-            clearConnectContext(harness);
-            return { ...detection, outcome: 'uninstalled' };
+    }
+    catch (e) {
+        if (e instanceof ConnectInterruptedError) {
+            return {
+                ...detection,
+                outcome: 'interrupted',
+                fixCommand: 'tinyfish connect --all --uninstall',
+            };
         }
-        if (!connectedBefore)
-            return { ...detection, outcome: 'uninstall_noop' };
+        throw e;
+    }
+    return { kind: 'continue', removed };
+}
+function uninstallViaCommands(detection, verbose, binaryOnPath) {
+    const { harness } = detection;
+    const removal = uninstallRuns(harness);
+    if (!removal) {
+        return { ...detection, outcome: 'uninstall_pointer', fixCommand: uninstallPointer(harness) };
+    }
+    // Stale config: the harness binary is gone, so its removal command cannot run.
+    // openclaw is exempt — its removal runs through npx, not the harness binary.
+    if (harness !== 'openclaw' && !binaryOnPath) {
         return {
             ...detection,
             outcome: 'uninstall_pointer',
-            errorMessage: 'could not confirm removal (command exited non-zero; there may have been nothing to remove).',
-            fixCommand: `Retry by hand: ${uninstallPointer(harness)}`,
+            errorMessage: `no \`${removal.command}\` binary on PATH — nothing to run.`,
+            fixCommand: `Reinstall ${DISPLAY_NAMES[harness]} first, then: ${uninstallPointer(harness)}`,
         };
     }
+    // Absent marker = never connected here, so a non-zero removal exit is a no-op.
+    // Unreadable config cannot prove that, so it keeps the pointer.
+    const connectedBefore = connectContextState(harness) !== 'absent';
+    const ran = runRemovalCommands(detection, removal, verbose);
+    if (!('kind' in ran))
+        return ran;
+    if (ran.removed) {
+        // Kept marker makes doctor emit a registration-lost repair that undoes this.
+        clearConnectContext(harness);
+        return { ...detection, outcome: 'uninstalled' };
+    }
+    if (!connectedBefore)
+        return { ...detection, outcome: 'uninstall_noop' };
+    return {
+        ...detection,
+        outcome: 'uninstall_pointer',
+        errorMessage: 'could not confirm removal (command exited non-zero; there may have been nothing to remove).',
+        fixCommand: `Retry by hand: ${uninstallPointer(harness)}`,
+    };
+}
+function uninstallCursor(detection) {
     let result;
     try {
         result = removeCursorMcpServer();
@@ -273,9 +264,117 @@ function removeHarnessRegistration(harness, configPath, verbose, binaryOnPath) {
     clearConnectContext('cursor');
     return { ...detection, outcome: 'uninstalled' };
 }
-async function processHarness(detection, opts, prompt, oauthBudget, hoistedCliInstall, deferOutro) {
-    const { harness, configPath, detected } = detection;
-    const base = { harness, detected, configPath, installed: false };
+function removeHarnessRegistration(harness, configPath, verbose, binaryOnPath) {
+    const detection = { harness, detected: true, configPath, installed: false };
+    if (harness === 'cursor')
+        return uninstallCursor(detection);
+    return uninstallViaCommands(detection, verbose, binaryOnPath);
+}
+function uninstallHarness(harness, configPath, verbose, binaryOnPath) {
+    const result = removeHarnessRegistration(harness, configPath, verbose, binaryOnPath);
+    if (harness !== 'hermes')
+        return result;
+    // Clearing a key the entry still references would break a working install.
+    const removed = !result.removalFailed &&
+        (result.outcome === 'uninstalled' || result.outcome === 'uninstall_noop');
+    const advisory = removed ? clearHermesEnvKey() : hermesKeyKeptAdvisory();
+    if (!advisory)
+        return result;
+    // Appended, never replacing: an advisory must not hide the removal's message.
+    return {
+        ...result,
+        errorMessage: result.errorMessage ? `${result.errorMessage} ${advisory}` : advisory,
+    };
+}
+function headlessGate(base, oauthBudget, fixCommand) {
+    const { harness } = base;
+    // A CLI-login sign-in is interactive-only — unboundable headless.
+    if (HARNESS_CAPABILITIES[harness].signInViaCliLogin) {
+        return {
+            result: { ...base, outcome: 'auth_pending', fixCommand },
+            headlessAuth: false,
+            spentBrowserSlot: false,
+        };
+    }
+    let spentBrowserSlot = false;
+    if (BROWSER_SIGN_IN.has(harness)) {
+        // One browser sign-in per run; the rest wait for a re-run.
+        if (oauthBudget.spent) {
+            return {
+                result: { ...base, outcome: 'auth_pending', fixCommand },
+                headlessAuth: false,
+                spentBrowserSlot: false,
+            };
+        }
+        oauthBudget.spent = true;
+        spentBrowserSlot = true;
+        errLine(`${DISPLAY_NAMES[harness]} needs a browser sign-in — finish it when your browser ` +
+            `opens; waiting up to ${OAUTH_SIGN_IN_TIMEOUT_MS / 1000} seconds.`);
+    }
+    return { headlessAuth: true, spentBrowserSlot };
+}
+/** Null: proceed. A result: settle with it. */
+async function awaitSignInPrompt(base, prompt, fixCommand) {
+    errLine(`step: waiting for browser sign-in to TinyFish for ${DISPLAY_NAMES[base.harness]}`);
+    try {
+        await prompt(`Press enter to open the browser and sign in to TinyFish for ${DISPLAY_NAMES[base.harness]}... `);
+        return null;
+    }
+    catch (error) {
+        // Ctrl+C stops the run; Ctrl+D only skips this harness.
+        if (error instanceof ConnectInterruptedError) {
+            errLine('Setup interrupted — run the command again to finish.');
+            process.exitCode = 130;
+            return { ...base, outcome: 'interrupted', fixCommand };
+        }
+        return { ...base, outcome: 'no_tty_auth_skip', fixCommand };
+    }
+}
+function mapConnectError(base, e, oauthBudget, spentBrowserSlot, fixCommand) {
+    if (e instanceof SignInTimeoutError) {
+        return {
+            ...base,
+            outcome: 'auth_pending',
+            errorMessage: 'sign-in did not finish in time',
+            fixCommand,
+        };
+    }
+    // A pre-browser failure must not burn the run's only browser slot.
+    if (spentBrowserSlot &&
+        e instanceof ConnectStepError &&
+        NO_BROWSER_REASONS.has(e.failureReason)) {
+        oauthBudget.spent = false;
+    }
+    // Detection saw a name on PATH; the probe proved nothing is behind it.
+    if (e instanceof ConnectStepError && e.failureReason === 'harness_not_installed') {
+        return { ...base, detected: false, outcome: 'not_installed' };
+    }
+    // Both reasons carry the same "flag not listed" message; the upgrade nudge is in it.
+    if (e instanceof ConnectStepError && TOO_OLD_REASONS.has(e.failureReason)) {
+        return { ...base, outcome: 'harness_too_old', errorMessage: e.message, fixCommand };
+    }
+    return {
+        ...base,
+        outcome: 'failed',
+        errorMessage: e instanceof Error ? e.message : String(e),
+        fixCommand,
+    };
+}
+async function authGate(base, oauthBudget, fixCommand, ctx) {
+    if (!ctx.isTTY && !ctx.keyed) {
+        return headlessGate(base, oauthBudget, fixCommand);
+    }
+    // Key-required harnesses refuse below; offering a browser sign-in would mislead.
+    if (ctx.isTTY && !ctx.keyed && ctx.prompt && !KEY_REQUIRED.has(base.harness)) {
+        const settled = await awaitSignInPrompt(base, ctx.prompt, fixCommand);
+        if (settled)
+            return { result: settled, headlessAuth: false, spentBrowserSlot: false };
+    }
+    return { headlessAuth: false, spentBrowserSlot: false };
+}
+/** The non-connect settlements: undetected, stale, dry-run, uninstall. */
+function settleWithoutConnect(detection, opts, base) {
+    const { harness, configPath } = detection;
     const noWork = noWorkOutcome(detection, opts.uninstall);
     if (noWork === 'not_detected')
         return { ...base, outcome: noWork };
@@ -288,94 +387,47 @@ async function processHarness(detection, opts, prompt, oauthBudget, hoistedCliIn
             : planText(harness, opts.mcpUrl, validatedApiKey(opts.apiKey));
         return { ...base, outcome: 'dry_run', fixCommand: plan };
     }
-    if (opts.uninstall)
+    if (opts.uninstall) {
         return uninstallHarness(harness, configPath, opts.verbose ?? false, detection.binaryOnPath);
+    }
+    return undefined;
+}
+async function processHarness(detection, opts, prompt, oauthBudget, hoistedCliInstall, deferOutro) {
+    const { harness, configPath, detected } = detection;
+    const base = { harness, detected, configPath, installed: false };
+    const settled = settleWithoutConnect(detection, opts, base);
+    if (settled)
+        return settled;
     const isTTY = detectHumanInitiated();
     const apiKey = validatedApiKey(opts.apiKey);
     // A key only leaves the own-OAuth set where the harness can actually carry one.
     const keyed = !!apiKey && KEY_AUTH_CAPABLE.has(harness);
     const fixCommand = `tinyfish connect ${harness}`;
-    let headlessAuth = false;
-    let spentBrowserSlot = false;
-    if (!isTTY && !keyed) {
-        // A CLI-login sign-in is interactive-only — unboundable headless.
-        if (HARNESS_CAPABILITIES[harness].signInViaCliLogin) {
-            return { ...base, outcome: 'auth_pending', fixCommand };
-        }
-        if (BROWSER_SIGN_IN.has(harness)) {
-            // One browser sign-in per run; the rest wait for a re-run.
-            if (oauthBudget.spent)
-                return { ...base, outcome: 'auth_pending', fixCommand };
-            oauthBudget.spent = true;
-            spentBrowserSlot = true;
-            errLine(`${DISPLAY_NAMES[harness]} needs a browser sign-in — finish it when your browser ` +
-                `opens; waiting up to ${OAUTH_SIGN_IN_TIMEOUT_MS / 1000} seconds.`);
-        }
-        headlessAuth = true;
-    }
-    // Key-required harnesses refuse below; offering a browser sign-in would mislead.
-    if (isTTY && !keyed && prompt && !KEY_REQUIRED.has(harness)) {
-        errLine(`step: waiting for browser sign-in to TinyFish for ${DISPLAY_NAMES[harness]}`);
-        try {
-            await prompt(`Press enter to open the browser and sign in to TinyFish for ${DISPLAY_NAMES[harness]}... `);
-        }
-        catch (error) {
-            // Ctrl+C stops the run; Ctrl+D only skips this harness.
-            if (error instanceof ConnectInterruptedError) {
-                errLine('Setup interrupted — run the command again to finish.');
-                process.exitCode = 130;
-                return { ...base, outcome: 'interrupted', fixCommand };
-            }
-            return { ...base, outcome: 'no_tty_auth_skip', fixCommand };
-        }
-    }
+    const gate = await authGate(base, oauthBudget, fixCommand, { prompt, isTTY, keyed });
+    if (gate.result)
+        return gate.result;
+    const { headlessAuth, spentBrowserSlot } = gate;
     // runGuarded swallows Ctrl+C and sets exitCode 130 instead of throwing.
     const interruptedBefore = process.exitCode === 130;
     let authMode;
     let postInstallFailed = false;
     try {
         // A keyed install too old for key auth fails, no browser.
-        authMode = await runHarnessConnect(harness, opts, keyed && !isTTY, headlessAuth ? OAUTH_SIGN_IN_TIMEOUT_MS : undefined, hoistedCliInstall, () => {
-            postInstallFailed = true;
-        }, deferOutro);
+        authMode = await runHarnessConnect(harness, opts, {
+            keyAuthOnly: keyed && !isTTY,
+            authTimeoutMs: headlessAuth ? OAUTH_SIGN_IN_TIMEOUT_MS : undefined,
+            hoistedCliInstall,
+            onPostInstallFailed: () => {
+                postInstallFailed = true;
+            },
+            deferOutro,
+        });
     }
     catch (e) {
-        if (e instanceof SignInTimeoutError) {
-            return {
-                ...base,
-                outcome: 'auth_pending',
-                errorMessage: 'sign-in did not finish in time',
-                fixCommand,
-            };
-        }
-        // A pre-browser failure must not burn the run's only browser slot.
-        if (spentBrowserSlot &&
-            e instanceof ConnectStepError &&
-            NO_BROWSER_REASONS.has(e.failureReason)) {
-            oauthBudget.spent = false;
-        }
-        // Detection saw a name on PATH; the probe proved nothing is behind it.
-        if (e instanceof ConnectStepError && e.failureReason === 'harness_not_installed') {
-            return { ...base, detected: false, outcome: 'not_installed' };
-        }
-        // Both reasons carry the same "flag not listed" message; the upgrade nudge is in it.
-        if (e instanceof ConnectStepError && TOO_OLD_REASONS.has(e.failureReason)) {
-            return {
-                ...base,
-                outcome: 'harness_too_old',
-                errorMessage: e.message,
-                fixCommand: `tinyfish connect ${harness}`,
-            };
-        }
-        return {
-            ...base,
-            outcome: 'failed',
-            errorMessage: e instanceof Error ? e.message : String(e),
-            fixCommand: `tinyfish connect ${harness}`,
-        };
+        return mapConnectError(base, e, oauthBudget, spentBrowserSlot, fixCommand);
     }
     if (!interruptedBefore && process.exitCode === 130) {
-        return { ...base, outcome: 'interrupted', fixCommand: `tinyfish connect ${harness}` };
+        return { ...base, outcome: 'interrupted', fixCommand };
     }
     // The probe, not the flag, decides: a harness that degraded to OAuth is not key-authed.
     const keyAuthed = authMode ? authMode === 'api-key' : keyed;
@@ -391,20 +443,21 @@ async function processHarness(detection, opts, prompt, oauthBudget, hoistedCliIn
         postInstallFailed,
     };
 }
-function summaryLine(result, uninstall) {
+function absentSummaryLine(result, uninstall) {
     const name = DISPLAY_NAMES[result.harness];
+    const next = uninstall
+        ? 'nothing to remove'
+        : `Install ${name}, then run: tinyfish connect ${result.harness}`;
     if (result.outcome === 'not_installed') {
-        const next = uninstall
-            ? 'nothing to remove'
-            : `Install ${name}, then run: tinyfish connect ${result.harness}`;
         return `- ${name} — not installed (\`${HARNESS_COMMANDS[result.harness]}\` is on PATH but does not run). ${next}`;
     }
     if (!result.detected) {
-        const next = uninstall
-            ? 'nothing to remove'
-            : `Install ${name}, then run: tinyfish connect ${result.harness}`;
         return `- ${name} — not detected (no \`${HARNESS_COMMANDS[result.harness]}\` on PATH, no ${result.configPath}). ${next}`;
     }
+    return undefined;
+}
+function skippedSummaryLine(result) {
+    const name = DISPLAY_NAMES[result.harness];
     if (result.outcome === 'stale_config') {
         return `… ${name} — config at ${result.configPath} but no \`${HARNESS_COMMANDS[result.harness]}\` on PATH, skipped. Install ${name}, then run: ${result.fixCommand}`;
     }
@@ -422,6 +475,19 @@ function summaryLine(result, uninstall) {
             ? `… ${name} — ${result.errorMessage}. Finish it in a terminal: ${result.fixCommand}`
             : `… ${name} — needs a browser sign-in. Run in a terminal: ${result.fixCommand}`;
     }
+    if (result.outcome === 'interrupted') {
+        return `✗ ${name} — interrupted before finishing. Fix: ${result.fixCommand}`;
+    }
+    if (result.outcome === 'harness_too_old') {
+        return `… ${name} — needs a newer ${name}: ${result.errorMessage} Fix, once upgraded: ${result.fixCommand}`;
+    }
+    if (result.outcome === 'failed') {
+        return `✗ ${name} — install failed: ${result.errorMessage}. Fix: ${result.fixCommand}`;
+    }
+    return undefined;
+}
+function uninstallSummaryLine(result) {
+    const name = DISPLAY_NAMES[result.harness];
     if (result.outcome === 'uninstall_pointer') {
         // errorMessage set = a removal was attempted or impossible; absent = no removal command exists.
         return result.errorMessage
@@ -439,15 +505,10 @@ function summaryLine(result, uninstall) {
             return `⚠ ${name} — removed, but ${result.errorMessage}`;
         return `✗ ${name} — ${result.errorMessage} Fix: ${result.fixCommand}`;
     }
-    if (result.outcome === 'interrupted') {
-        return `✗ ${name} — interrupted before finishing. Fix: ${result.fixCommand}`;
-    }
-    if (result.outcome === 'harness_too_old') {
-        return `… ${name} — needs a newer ${name}: ${result.errorMessage} Fix, once upgraded: ${result.fixCommand}`;
-    }
-    if (result.outcome === 'failed') {
-        return `✗ ${name} — install failed: ${result.errorMessage}. Fix: ${result.fixCommand}`;
-    }
+    return undefined;
+}
+function installedSummaryLine(result) {
+    const name = DISPLAY_NAMES[result.harness];
     // The summary is what users read; stderr hints scroll away.
     if (result.postInstallFailed) {
         return (`⚠ ${name} — installed, but a finishing step failed. ` +
@@ -464,6 +525,12 @@ function summaryLine(result, uninstall) {
     }
     return `✓ ${name} — installed, ${verifyLabel}`;
 }
+function summaryLine(result, uninstall) {
+    return (absentSummaryLine(result, uninstall) ??
+        skippedSummaryLine(result) ??
+        uninstallSummaryLine(result) ??
+        installedSummaryLine(result));
+}
 /** One line for every harness: seven near-identical paragraphs is what this replaces. */
 function reloadHint(results) {
     const byAction = new Map();
@@ -529,16 +596,7 @@ function computeExitCode(results) {
         return 0;
     return attempted.some((r) => r.outcome === 'installed') ? 0 : 1;
 }
-export async function runConnectAll(opts) {
-    const isTTY = detectHumanInitiated();
-    // Open interface holds stdin raw; hermes' input() then wedges.
-    const prompt = isTTY ? createStdinPrompt() : undefined;
-    const detections = detectInstalledHarnesses();
-    const gateKey = validatedApiKey(opts.apiKey);
-    // Keyed installs first: working tools land before sign-ins can block.
-    if (gateKey) {
-        detections.sort((a, b) => Number(KEY_AUTH_CAPABLE.has(b.harness)) - Number(KEY_AUTH_CAPABLE.has(a.harness)));
-    }
+async function resolvePick(detections, opts, prompt) {
     let deselected = new Set();
     let mode = 'all';
     // Before willAttempt/cliNeeded: a cursor-only pick must not hoist the CLI.
@@ -549,18 +607,15 @@ export async function runConnectAll(opts) {
         const pick = await pickHarnesses(offerable, connected, { prompt });
         mode = pick.mode;
         if (pick.selection === 'cancel') {
-            // Before summary and telemetry: an explicit nothing is not a setup.
-            outLine('Nothing installed. Run: tinyfish connect --all or tinyfish connect <client>');
-            return 0;
+            return { deselected, mode, cancelled: true };
         }
         const chosen = new Set(pick.selection);
         deselected = new Set(offerable.filter((d) => !chosen.has(d.harness)).map((d) => d.harness));
     }
-    // Mirrors processHarness's gate: headless, only keyless CLI-login harnesses skip.
-    const willAttempt = (harness) => !deselected.has(harness) &&
-        (isTTY ||
-            !HARNESS_CAPABILITIES[harness].signInViaCliLogin ||
-            (!!gateKey && KEY_AUTH_CAPABLE.has(harness)));
+    return { deselected, mode, cancelled: false };
+}
+/** 'interrupted' stops the whole run; undefined means no hoist was needed. */
+function hoistCliIfNeeded(detections, opts, willAttempt) {
     // Machine-global, so once per invocation; config-writing connects never install it.
     const cliNeeded = !opts.dryRun &&
         !opts.uninstall &&
@@ -568,24 +623,21 @@ export async function runConnectAll(opts) {
             d.binaryOnPath &&
             !HARNESS_CAPABILITIES[d.harness].cliWritesConfig &&
             willAttempt(d.harness));
-    let takeHoistedCli;
-    if (cliNeeded) {
-        errLine('First: the TinyFish CLI, shared by every harness.');
-        const outcome = runHoistedCliInstall(opts.verbose ?? false);
-        if (!outcome) {
-            errLine('Setup interrupted — run the command again to finish.');
-            return 130;
-        }
-        let taken = false;
-        // Every harness gets the outcome; only the first take reports it.
-        takeHoistedCli = () => {
-            const firstTake = !taken;
-            taken = true;
-            return { outcome, firstTake };
-        };
-    }
-    // A Set dedupes: Codex and Grok defer the same export line.
-    const outro = new Set();
+    if (!cliNeeded)
+        return undefined;
+    errLine('First: the TinyFish CLI, shared by every harness.');
+    const outcome = runHoistedCliInstall(opts.verbose ?? false);
+    if (!outcome)
+        return 'interrupted';
+    let taken = false;
+    // Every harness gets the outcome; only the first take reports it.
+    return () => {
+        const firstTake = !taken;
+        taken = true;
+        return { outcome, firstTake };
+    };
+}
+async function connectLoop(detections, opts, deselected, io) {
     const results = [];
     const oauthBudget = { spent: false };
     // Shares processHarness's no-work states so stepTotal cannot desync.
@@ -611,7 +663,7 @@ export async function runConnectAll(opts) {
         let result;
         try {
             setErrIndent(STEP_INDENT);
-            result = await processHarness(detection, opts, prompt, oauthBudget, takeHoistedCli, (line) => outro.add(line));
+            result = await processHarness(detection, opts, io.prompt, oauthBudget, io.takeHoistedCli, (line) => io.outro.add(line));
         }
         catch (e) {
             // Isolation: one harness throwing never stops the others.
@@ -649,6 +701,86 @@ export async function runConnectAll(opts) {
             fixCommand: `tinyfish connect ${detection.harness}`,
         });
     }
+    return results;
+}
+async function noActionableExit(results, opts, prompt) {
+    if (!opts.dryRun && !opts.uninstall) {
+        try {
+            const outcome = await runCliFallback({
+                apiKey: opts.apiKey,
+                verbose: opts.verbose ?? false,
+                prompt,
+                retryCommand: 'npx @tiny-fish/cli connect --all',
+            });
+            return outcome === 'cli_verified' ? 0 : 1;
+        }
+        catch (error) {
+            if (!(error instanceof ConnectInterruptedError))
+                throw error;
+            errLine('Setup interrupted — run the command again to finish.');
+            process.exitCode = 130;
+            return 130;
+        }
+    }
+    const stale = results.filter((r) => r.outcome === 'stale_config');
+    outLine('');
+    outLine(stale.length > 0
+        ? `No runnable harness found. Reinstall ${stale.map((r) => DISPLAY_NAMES[r.harness]).join(', ')}, or install one of: ${ALL_HARNESSES.join(', ')}`
+        : 'No supported harness found. Install one of: ' + ALL_HARNESSES.join(', '));
+    if (!opts.uninstall)
+        outLine('Then run: npx @tiny-fish/cli connect --all');
+    return 1;
+}
+async function finishRun(results, opts, isTTY) {
+    const exitCode = computeExitCode(results);
+    const interrupted = results.some((r) => r.outcome === 'interrupted');
+    if (exitCode === 0 &&
+        !interrupted &&
+        !opts.dryRun &&
+        !opts.uninstall &&
+        results.some((r) => r.installed)) {
+        outLine('');
+        if (isTTY && !opts.noLaunch && (await launchFirstTask(results))) {
+            return exitCode;
+        }
+        outLine('Now ask your agent: "use TinyFish to find today\'s top Hacker News story"');
+    }
+    return exitCode;
+}
+export async function runConnectAll(opts) {
+    const isTTY = detectHumanInitiated();
+    // Open interface holds stdin raw; hermes' input() then wedges.
+    const prompt = isTTY ? createStdinPrompt() : undefined;
+    const detections = detectInstalledHarnesses();
+    const gateKey = validatedApiKey(opts.apiKey);
+    // Keyed installs first: working tools land before sign-ins can block.
+    if (gateKey) {
+        detections.sort((a, b) => Number(KEY_AUTH_CAPABLE.has(b.harness)) - Number(KEY_AUTH_CAPABLE.has(a.harness)));
+    }
+    const pick = await resolvePick(detections, opts, prompt);
+    if (pick.cancelled) {
+        // Before summary and telemetry: an explicit nothing is not a setup.
+        outLine('Nothing installed. Run: tinyfish connect --all or tinyfish connect <client>');
+        return 0;
+    }
+    const { deselected, mode } = pick;
+    // Mirrors processHarness's gate: headless, only keyless CLI-login harnesses skip.
+    const willAttempt = (harness) => !deselected.has(harness) &&
+        (isTTY ||
+            !HARNESS_CAPABILITIES[harness].signInViaCliLogin ||
+            (!!gateKey && KEY_AUTH_CAPABLE.has(harness)));
+    const hoisted = hoistCliIfNeeded(detections, opts, willAttempt);
+    if (hoisted === 'interrupted') {
+        errLine('Setup interrupted — run the command again to finish.');
+        return 130;
+    }
+    // A Set dedupes: Codex and Grok defer the same export line.
+    const outro = new Set();
+    const results = await connectLoop(detections, opts, deselected, {
+        prompt,
+        takeHoistedCli: hoisted,
+        outro,
+    });
     outLine('');
     outLine('TinyFish setup summary:');
     for (const line of renderSummary(results, opts.uninstall))
@@ -662,32 +794,7 @@ export async function runConnectAll(opts) {
     for (const line of outro)
         errLine(line);
     if (!results.some(actionable)) {
-        if (!opts.dryRun && !opts.uninstall) {
-            try {
-                const outcome = await runCliFallback({
-                    apiKey: opts.apiKey,
-                    verbose: opts.verbose ?? false,
-                    prompt,
-                    retryCommand: 'npx @tiny-fish/cli connect --all',
-                });
-                return outcome === 'cli_verified' ? 0 : 1;
-            }
-            catch (error) {
-                if (!(error instanceof ConnectInterruptedError))
-                    throw error;
-                errLine('Setup interrupted — run the command again to finish.');
-                process.exitCode = 130;
-                return 130;
-            }
-        }
-        const stale = results.filter((r) => r.outcome === 'stale_config');
-        outLine('');
-        outLine(stale.length > 0
-            ? `No runnable harness found. Reinstall ${stale.map((r) => DISPLAY_NAMES[r.harness]).join(', ')}, or install one of: ${ALL_HARNESSES.join(', ')}`
-            : 'No supported harness found. Install one of: ' + ALL_HARNESSES.join(', '));
-        if (!opts.uninstall)
-            outLine('Then run: npx @tiny-fish/cli connect --all');
-        return 1;
+        return noActionableExit(results, opts, prompt);
     }
     if (!opts.dryRun && !opts.uninstall) {
         const harnessTelemetry = results.map((r) => ({
@@ -703,20 +810,7 @@ export async function runConnectAll(opts) {
         // After the summary and before the launch, which is where the user is reading.
         emitNotice();
     }
-    const exitCode = computeExitCode(results);
-    const interrupted = results.some((r) => r.outcome === 'interrupted');
-    if (exitCode === 0 &&
-        !interrupted &&
-        !opts.dryRun &&
-        !opts.uninstall &&
-        results.some((r) => r.installed)) {
-        outLine('');
-        if (isTTY && !opts.noLaunch && (await launchFirstTask(results))) {
-            return exitCode;
-        }
-        outLine('Now ask your agent: "use TinyFish to find today\'s top Hacker News story"');
-    }
-    return exitCode;
+    return finishRun(results, opts, isTTY);
 }
 export const FIRST_TASK_PROMPT = 'My TinyFish setup just finished — verify it with a real run. Use the MCP server named ' +
     '`tinyfish` for every TinyFish tool call; if another TinyFish server is also registered, still ' +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiny-fish/cli",
-  "version": "0.30.2-next.266",
+  "version": "0.30.2-next.268",
   "description": "TinyFish CLI — run web automations from your terminal",
   "type": "module",
   "bin": {