@tiny-fish/cli 0.34.1-next.282 → 0.34.1-next.285

package/README.md

@@ -57,8 +57,8 @@ interactive walkthrough with one command:
 npx -y @tiny-fish/cli@latest connect codex --launch --api-key sk-tinyfish-...
 ```
 
-One-command OAuth requires a Codex release whose `codex mcp add` command supports
-`--oauth-resource`. Update Codex if support is unavailable, or add TinyFish manually with
+One-command OAuth requires a Codex release whose `codex mcp add` command supports `--url`, plus
+`codex mcp login`. Update Codex if support is unavailable, or add TinyFish manually with
 `codex mcp add`.
 
 With `--api-key`, Codex reads the key from `TINYFISH_API_KEY` instead of signing in — the command

package/dist/commands/connect.js

@@ -75,11 +75,10 @@ function refuseKeylessInstall(client, keyAuthSupported) {
         `Run: tinyfish auth login, then ${rerun}`, 'invalid_config', { failureDetail: 'keyless_install_refused' });
 }
 /** Resolved before the removals, so a refusal strands no registration. */
-function keylessAddArgs(client, keyAuthSupported, oauthResource) {
+function keylessAddArgs(client, keyAuthSupported) {
     if (!client.addArgs)
         refuseKeylessInstall(client, keyAuthSupported);
-    const addArgs = client.addArgs;
-    return (mcpUrl) => addArgs(mcpUrl, oauthResource);
+    return client.addArgs;
 }
 /** Runs before any write: a refused key strands nothing. */
 async function verifyKeyBeforeSeeding(apiKey, displayName, mcpUrl) {
@@ -157,7 +156,7 @@ async function prepareInstallAuth(client, options, keyAuthSupported) {
     // Refuses here when key-required; others keep their OAuth argv.
     const buildAddArgs = keyedAdd
         ? (mcpUrl) => keyedAdd.spec.addArgs(mcpUrl, keyedAdd.key)
-        : keylessAddArgs(client, keyAuthSupported, options.mcpUrl);
+        : keylessAddArgs(client, keyAuthSupported);
     if (options.keyAuthOnly && !keyedAdd) {
         // All native clients have keyAuth; missing flags mean an old install.
         if (client.keyAuth) {
@@ -346,6 +345,16 @@ async function runPostInstallSteps(client, options, state, telemetry, signInDefe
                 telemetry.track('checkpoint', { phase: 'skill_installed' });
             });
         }
+        const extraPostInstall = client.extraPostInstall;
+        if (extraPostInstall) {
+            await attempt('plugin_install', () => {
+                extraPostInstall({
+                    apiKey: validatedApiKey(options.apiKey),
+                    verbose: options.verbose ?? false,
+                });
+                telemetry.track('checkpoint', { phase: 'plugin_installed' });
+            });
+        }
         // Before auth: a failed sign-in must not lose the harness record.
         saveConnectContext(client.connectClient, telemetry.attemptId, state.authMode);
         await attempt('authentication', () => {

package/dist/commands/doctor.js

@@ -217,7 +217,9 @@ function repairsFor(checks, statuses) {
     for (const status of statuses) {
         // `unknown` earns nothing: connect would contradict the check's detail.
         // A registered entry that still fails earns one too.
-        const brokenRegistration = checks.some((c) => c.harness === status.harness && c.status === 'fail');
+        // `connected: false` is the harness's own no; it only warns, so it earns a repair here.
+        const brokenRegistration = status.connected === false ||
+            checks.some((c) => c.harness === status.harness && c.status === 'fail');
         if (!status.detected || (status.registered !== Registered.No && !brokenRegistration))
             continue;
         repairs.push({

package/dist/lib/connect-clients.d.ts

@@ -69,11 +69,16 @@ interface BaseMcpClient extends SupportedCommand {
     detachedLaunch?: () => WalkthroughOutcome;
     /** Printed after a successful connect, on both the launch and non-launch paths. */
     postConnectNote?: string;
+    /** Post-install like the skill step: failures warn, never fail the attempt. */
+    extraPostInstall?: (options: {
+        apiKey?: string;
+        verbose: boolean;
+    }) => void;
 }
 /** Keyless installs use this argv; the harness signs itself in. */
 export interface OauthCapableMcpClient extends BaseMcpClient {
     keyRequired?: false;
-    addArgs: (mcpUrl: string, oauthResource: string) => string[];
+    addArgs: (mcpUrl: string) => string[];
 }
 /** No sign-in exists here, so connect refuses a keyless install (Hermes). */
 export interface KeyRequiredMcpClient extends BaseMcpClient {

package/dist/lib/connect-clients.js

@@ -7,6 +7,7 @@ import { ConnectStepError, spawnStepError, } from './connect-runtime.js';
 import { TINYFISH_API_KEY_VAR } from './constants.js';
 import { HERMES_KEY_VAR, captureHermesKeyRestore, hermesEnvPath, resolveHermesHome, writeHermesKey, } from './hermes-env.js';
 import { hermesConfigPath, readHermesEntry } from './hermes-config.js';
+import { installHermesPlugin, setHermesWebBackends } from './hermes-plugin.js';
 const HERMES_SEED_TIMEOUT_MS = 120_000;
 // An old install is only one reason a flag can go unseen, so no message asserts the cause.
 const SUPPORT_CHECK_DEBUG_HINT = ' Set TINYFISH_DEBUG=1 and retry to print the help output TinyFish read.';
@@ -20,10 +21,15 @@ const CLAUDE_CODE_DEFERRED_AUTH_NOTE = 'TinyFish is registered in Claude Code bu
     'one-command sign-in (`claude mcp login`). Open Claude Code and run `/mcp` to sign in to ' +
     'TinyFish. `claude update` gets you one-command sign-in. Already have a TinyFish API key? ' +
     'Run `tinyfish connect claude-code --api-key <key>` instead.';
-const CODEX_OAUTH_RESOURCE_UNAVAILABLE_MESSAGE = 'Could not confirm this Codex installation supports one-command MCP authentication: `codex ' +
-    'mcp add --help` did not list `--oauth-resource`. Update Codex and retry, or add TinyFish ' +
-    'manually with `codex mcp add`.' +
+const CODEX_MCP_URL_UNAVAILABLE_MESSAGE = 'Could not confirm this Codex installation supports remote MCP servers: `codex mcp add ' +
+    '--help` did not list `--url`. Update Codex and retry, or add TinyFish manually with ' +
+    '`codex mcp add`.' +
     SUPPORT_CHECK_DEBUG_HINT;
+const CODEX_KEYED_FALLBACK_NOTE = 'Using your stored TinyFish API key: this Codex cannot report whether an OAuth sign-in ' +
+    'finished, so no browser sign-in is attempted.';
+const CODEX_DEFERRED_AUTH_NOTE = 'TinyFish is registered in Codex but not signed in: this Codex predates reliable sign-in ' +
+    'reporting. Run `codex mcp login tinyfish` to sign in, or update Codex with ' +
+    '`npm install -g @openai/codex@latest` for one-command sign-in.';
 const HERMES_OAUTH_UNAVAILABLE_MESSAGE = 'Could not confirm this Hermes installation supports one-command MCP authentication: `hermes ' +
     'mcp add --help` did not list `--auth oauth`. Update Hermes and retry, or add TinyFish ' +
     'manually with `hermes mcp add`.' +
@@ -173,21 +179,28 @@ export const CODEX = {
     displayName: 'Codex',
     supportCheck: {
         args: ['mcp', 'add', '--help'],
-        patterns: [/--oauth-resource(?:\s|<)/],
+        patterns: [/--url(?:[\s<=]|$)/m],
+        // Codex before ~0.142 reports `o_auth` for a server it never signed in to, so the
+        // sign-in probe lies; `--oauth-resource` is the only marker separating the two.
+        optionalPatterns: [/--oauth-resource(?:[\s<=]|$)/m],
         keyAuthPattern: /(?:^|\s)--bearer-token-env-var(?:[\s<=]|$)/m,
-        unavailableMessage: CODEX_OAUTH_RESOURCE_UNAVAILABLE_MESSAGE,
+        unavailableMessage: CODEX_MCP_URL_UNAVAILABLE_MESSAGE,
+    },
+    degradedAuthNotes: {
+        keyed: CODEX_KEYED_FALLBACK_NOTE,
+        deferred: CODEX_DEFERRED_AUTH_NOTE,
     },
     // Codex has no `--header`; the MCP server takes a key as `Bearer sk-…`.
-    // Omitting `--oauth-resource` is what keeps `mcp add` from running OAuth.
     keyAuth: {
         envVar: TINYFISH_API_KEY_VAR,
         addArgs: (mcpUrl) => [...urlAddArgs(mcpUrl), '--bearer-token-env-var', TINYFISH_API_KEY_VAR],
     },
     detachedLaunch: launchCodexWalkthrough,
-    // Retry only: running it after a finished inline OAuth is a second browser hop.
     loginArgs: ['mcp', 'login', 'tinyfish'],
     removals: [{ args: ['mcp', 'remove', 'tinyfish'], label: 'TinyFish registration from Codex' }],
-    addArgs: (mcpUrl, oauthResource) => [...urlAddArgs(mcpUrl), '--oauth-resource', oauthResource],
+    // `--oauth-resource` duplicates the resource Codex discovers; Clerk rejects both.
+    // `mcp add` still runs OAuth inline, so `loginArgs` stays a retry.
+    addArgs: urlAddArgs,
 };
 const grokAddArgs = (mcpUrl) => [
     'mcp',
@@ -259,12 +272,16 @@ export function hermesRegistrationEnabled(home) {
     // The tag keeps the path-bearing prose out of telemetry.
     return { ok: false, detail, tag: `hermes_entry_${entry.state}` };
 }
-function seedHermesKey(apiKey) {
+// A plain Error settles unexpected_error; cli_connect_stage is load-bearing.
+function requireHermesHome() {
     const home = resolveHermesHome();
-    // A plain Error settles unexpected_error; cli_connect_stage is load-bearing.
     if (!home) {
         throw new ConnectStepError("Could not determine Hermes' home directory from `hermes dump`", 'invalid_config', { failureDetail: 'hermes_home_undetermined' });
     }
+    return home;
+}
+function seedHermesKey(apiKey) {
+    const home = requireHermesHome();
     const restore = captureHermesKeyRestore(home);
     writeHermesKey(home, apiKey);
     return {
@@ -287,6 +304,15 @@ function rollbackHermesKey(home, restore) {
         warnLine(`Could not restore ${HERMES_KEY_VAR} in ${hermesEnvPath(home)}; check it by hand.`);
     }
 }
+// Hermes is keyRequired; a missing key here is a resolution bug.
+function installHermesWebPlugin({ apiKey, verbose }) {
+    if (!apiKey) {
+        throw new ConnectStepError('No TinyFish API key was available to install the Hermes web plugin', 'invalid_config');
+    }
+    const home = requireHermesHome();
+    installHermesPlugin(home, apiKey, { verbose });
+    setHermesWebBackends(home);
+}
 export const HERMES = {
     command: 'hermes',
     connectClient: 'hermes',
@@ -305,6 +331,7 @@ export const HERMES = {
         seedKey: seedHermesKey,
     },
     removals: [{ args: ['mcp', 'remove', 'tinyfish'], label: 'TinyFish registration from Hermes' }],
+    extraPostInstall: installHermesWebPlugin,
     launchWalkthrough: launchHermesWalkthrough,
     postConnectNote: 'Restart your Hermes session to pick up TinyFish — Hermes discovers MCP servers at startup.',
 };

package/dist/lib/connect-runtime.d.ts

@@ -2,11 +2,11 @@ import { AuthMode } from './harness-detect.js';
 export declare const NON_INTERACTIVE_TIMEOUT_MS = 10000;
 export type AgentClient = 'claude-code' | 'codex' | 'cursor' | 'grok' | 'hermes' | 'openclaw' | 'opencode';
 type ConnectStage = 'started' | 'checkpoint' | 'completed' | 'failed' | 'aborted' | 'post_install_failed';
-export type ConnectFailureStage = 'prerequisite_check' | 'registration_cleanup' | 'registration' | 'registration_or_authentication' | 'client_oauth' | 'cli_install' | 'skill_install' | 'authentication' | 'walkthrough_launch' | 'cli_verification';
+export type ConnectFailureStage = 'prerequisite_check' | 'registration_cleanup' | 'registration' | 'registration_or_authentication' | 'client_oauth' | 'cli_install' | 'skill_install' | 'plugin_install' | 'authentication' | 'walkthrough_launch' | 'cli_verification';
 export declare const CONNECT_FAILURE_REASONS: readonly ["harness_not_installed", "harness_command_unsupported", "harness_too_old", "key_auth_unsupported", "command_not_found", "timeout", "spawn_error", "nonzero_exit", "invalid_config", "user_abandoned", "process_terminated", "unexpected_error"];
 export type ConnectFailureReason = (typeof CONNECT_FAILURE_REASONS)[number];
 export type ConnectAuthMode = Exclude<AuthMode, AuthMode.Unknown> | 'deferred';
-export type ConnectCheckpoint = 'prerequisite_ok' | 'registered' | 'oauth_done' | 'cli_installed' | 'skill_installed' | 'authenticated' | 'cli_verified' | 'walkthrough_launched' | 'walkthrough_prompt_printed';
+export type ConnectCheckpoint = 'prerequisite_ok' | 'registered' | 'oauth_done' | 'cli_installed' | 'skill_installed' | 'plugin_installed' | 'authenticated' | 'cli_verified' | 'walkthrough_launched' | 'walkthrough_prompt_printed';
 export type CliFallbackOutcome = 'cli_verified' | 'cli_install_failed' | 'no_credentials' | 'invalid_credentials' | 'authentication_failed' | 'verification_failed' | 'abandoned';
 /** Ctrl+C killed a setup child — abandonment, not error. */
 export declare class ConnectInterruptedError extends Error {

package/dist/lib/hermes-plugin.d.ts

@@ -0,0 +1,6 @@
+import { type InstallOptions } from './cli-install.js';
+export declare const HERMES_PLUGIN_SHA = "496cd63fefd982bbaa8a85ce78ef2270d700984f";
+export declare const HERMES_PLUGIN_MANUAL_INSTALL = "hermes plugins install tinyfish-io/tinyfish-web-agent-integrations/hermes --ref 496cd63fefd982bbaa8a85ce78ef2270d700984f --enable";
+export declare function installHermesPlugin(home: string, apiKey: string, { verbose }: Pick<InstallOptions, 'verbose'>): void;
+/** After install only: backends must never name an absent provider. */
+export declare function setHermesWebBackends(home: string): void;

package/dist/lib/hermes-plugin.js

@@ -0,0 +1,99 @@
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { pathToFileURL } from 'node:url';
+import spawn from 'cross-spawn';
+import { capturedOutput, replay, SKILL_INSTALL_TIMEOUT_MS, STEP_MAX_BUFFER, } from './cli-install.js';
+import { commandNotFound, ConnectStepError, spawnStepError } from './connect-runtime.js';
+import { HARNESS_PROBE_TIMEOUT_MS } from './constants.js';
+import { errLine } from './output.js';
+// Bump per CLI release.
+export const HERMES_PLUGIN_SHA = '496cd63fefd982bbaa8a85ce78ef2270d700984f';
+const PLUGIN_SOURCE = 'tinyfish-io/tinyfish-web-agent-integrations/hermes';
+const PLUGIN_REPO_URL = 'https://github.com/tinyfish-io/tinyfish-web-agent-integrations.git';
+export const HERMES_PLUGIN_MANUAL_INSTALL = `hermes plugins install ${PLUGIN_SOURCE} --ref ${HERMES_PLUGIN_SHA} --enable`;
+// Anchored to --ref: another rejected flag would fail the clone path too.
+const REF_UNSUPPORTED_PATTERN = /unrecognized arguments:[^\n]*--ref/;
+function installSpawnEnv(home, apiKey) {
+    // Hermes' install-time requires_env check reads os.environ, not our .env seed.
+    return { ...process.env, HERMES_HOME: home, TINYFISH_API_KEY: apiKey };
+}
+function runPluginInstall(source, env) {
+    // Captured even under --verbose: the fallback matches on stderr.
+    return spawn.sync('hermes', ['plugins', 'install', ...source, '--enable', '--force'], {
+        encoding: 'utf8',
+        maxBuffer: STEP_MAX_BUFFER,
+        timeout: SKILL_INSTALL_TIMEOUT_MS,
+        env,
+    });
+}
+function refUnsupported(result) {
+    return result.status !== 0 && REF_UNSUPPORTED_PATTERN.test(String(result.stderr ?? ''));
+}
+function runGit(args) {
+    const result = spawn.sync('git', args, {
+        encoding: 'utf8',
+        maxBuffer: STEP_MAX_BUFFER,
+        timeout: SKILL_INSTALL_TIMEOUT_MS,
+    });
+    if (!result.error && result.status === 0)
+        return;
+    if (commandNotFound(result.error)) {
+        throw new ConnectStepError('git is required to stage the pinned plugin; install git and run connect again', 'command_not_found');
+    }
+    // Built first: its interrupt check must run before any replay.
+    const error = spawnStepError('Could not stage the TinyFish Hermes plugin', result);
+    replay(capturedOutput(result));
+    throw error;
+}
+// Pre-`--ref` Hermes: stage the pin ourselves, mirroring `--ref` internals.
+function installFromClone(env) {
+    const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'tinyfish-hermes-plugin-'));
+    try {
+        runGit(['clone', '--depth', '1', PLUGIN_REPO_URL, tmp]);
+        runGit(['-C', tmp, 'fetch', '--depth', '1', 'origin', HERMES_PLUGIN_SHA]);
+        runGit(['-C', tmp, 'checkout', '--detach', HERMES_PLUGIN_SHA]);
+        return runPluginInstall([`${pathToFileURL(tmp).href}#hermes`], env);
+    }
+    finally {
+        fs.rmSync(tmp, { recursive: true, force: true });
+    }
+}
+export function installHermesPlugin(home, apiKey, { verbose }) {
+    errLine('Installing the TinyFish web plugin in Hermes...');
+    const env = installSpawnEnv(home, apiKey);
+    // --ref always: a same-source reinstall without it keeps the previous pin.
+    const primary = runPluginInstall([PLUGIN_SOURCE, '--ref', HERMES_PLUGIN_SHA], env);
+    const result = refUnsupported(primary) ? installFromClone(env) : primary;
+    if (result.error || result.status !== 0) {
+        // A declined security scan exits 1 here, and reconnecting repeats it.
+        const error = spawnStepError(`Could not install the TinyFish web plugin in Hermes; to install it yourself run: ${HERMES_PLUGIN_MANUAL_INSTALL}`, result);
+        replay(capturedOutput(result));
+        throw error;
+    }
+    if (verbose)
+        replay(capturedOutput(result));
+}
+function hermesConfig(args, home) {
+    return spawn.sync('hermes', ['config', ...args], {
+        encoding: 'utf8',
+        maxBuffer: STEP_MAX_BUFFER,
+        timeout: HARNESS_PROBE_TIMEOUT_MS,
+        env: { ...process.env, HERMES_HOME: home },
+    });
+}
+function configWrite(home, args) {
+    const result = hermesConfig(args, home);
+    if (!result.error && result.status === 0)
+        return;
+    // Built first: its interrupt check must run before any replay.
+    const error = spawnStepError(`Could not run \`hermes config ${args.join(' ')}\``, result);
+    replay(capturedOutput(result));
+    throw error;
+}
+const HERMES_BACKEND_KEYS = ['web.search_backend', 'web.extract_backend'];
+/** After install only: backends must never name an absent provider. */
+export function setHermesWebBackends(home) {
+    for (const key of HERMES_BACKEND_KEYS)
+        configWrite(home, ['set', key, 'tinyfish']);
+}

package/dist/lib/registration-detect.js

@@ -13,6 +13,12 @@ import { detectInstalledHarnesses, harnessConfigPath, harnessDisplayPath, AuthMo
 // A list, verified against codex 0.146. A name-keyed map was accepted here too, but every
 // field is optional, so that arm parsed *any* object-of-objects: a wrapper like
 // `{"servers": {...}}` decoded as one entry named `servers` and reported TinyFish absent.
+// Codex's wire values, verified against 0.146; anything else stays unknown.
+var CodexAuthStatus;
+(function (CodexAuthStatus) {
+    CodexAuthStatus["OAuth"] = "o_auth";
+    CodexAuthStatus["NotLoggedIn"] = "not_logged_in";
+})(CodexAuthStatus || (CodexAuthStatus = {}));
 const codexEntrySchema = z.looseObject({
     name: z.string().optional(),
     auth_status: z.string().optional(),
@@ -216,9 +222,9 @@ export function codexOauthCompleted() {
     if ('reason' in read)
         return undefined;
     const status = read.entry?.auth_status;
-    if (status === 'o_auth')
+    if (status === CodexAuthStatus.OAuth)
         return true;
-    if (status === 'not_logged_in')
+    if (status === CodexAuthStatus.NotLoggedIn)
         return false;
     return undefined;
 }
@@ -255,10 +261,16 @@ function probeCodex() {
     const codexUrl = entry.transport?.url;
     // Read from this entry: codex emits `bearer_token_env_var` on every HTTP server, so testing
     // the whole payload reports api-key for TinyFish because some other server carries a key.
-    const envVar = entry.auth_status === 'o_auth' ? undefined : entry.transport?.bearer_token_env_var;
+    const envVar = entry.auth_status === CodexAuthStatus.OAuth ? undefined : entry.transport?.bearer_token_env_var;
     return {
         registered: Registered.Yes,
-        authMode: entry.auth_status === 'o_auth' ? AuthMode.OAuth : envVar ? AuthMode.ApiKey : AuthMode.Unknown,
+        authMode: entry.auth_status === CodexAuthStatus.OAuth
+            ? AuthMode.OAuth
+            : envVar
+                ? AuthMode.ApiKey
+                : AuthMode.Unknown,
+        // Codex's own verdict: a stale `oauth_resource` strands installs here.
+        ...(entry.auth_status === CodexAuthStatus.NotLoggedIn && !envVar ? { connected: false } : {}),
         ...(codexUrl ? { registeredUrl: codexUrl } : {}),
         ...(envVar ? envKeyVerdict(envVar) : {}),
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiny-fish/cli",
-  "version": "0.34.1-next.282",
+  "version": "0.34.1-next.285",
   "description": "TinyFish CLI — run web automations from your terminal",
   "type": "module",
   "bin": {