@tiny-fish/cli 0.34.1-next.284 → 0.34.1-next.285

package/README.md

@@ -57,8 +57,8 @@ interactive walkthrough with one command:
 npx -y @tiny-fish/cli@latest connect codex --launch --api-key sk-tinyfish-...
 ```
 
-One-command OAuth requires a Codex release whose `codex mcp add` command supports
-`--oauth-resource`. Update Codex if support is unavailable, or add TinyFish manually with
+One-command OAuth requires a Codex release whose `codex mcp add` command supports `--url`, plus
+`codex mcp login`. Update Codex if support is unavailable, or add TinyFish manually with
 `codex mcp add`.
 
 With `--api-key`, Codex reads the key from `TINYFISH_API_KEY` instead of signing in — the command

package/dist/commands/connect.js

@@ -75,11 +75,10 @@ function refuseKeylessInstall(client, keyAuthSupported) {
         `Run: tinyfish auth login, then ${rerun}`, 'invalid_config', { failureDetail: 'keyless_install_refused' });
 }
 /** Resolved before the removals, so a refusal strands no registration. */
-function keylessAddArgs(client, keyAuthSupported, oauthResource) {
+function keylessAddArgs(client, keyAuthSupported) {
     if (!client.addArgs)
         refuseKeylessInstall(client, keyAuthSupported);
-    const addArgs = client.addArgs;
-    return (mcpUrl) => addArgs(mcpUrl, oauthResource);
+    return client.addArgs;
 }
 /** Runs before any write: a refused key strands nothing. */
 async function verifyKeyBeforeSeeding(apiKey, displayName, mcpUrl) {
@@ -157,7 +156,7 @@ async function prepareInstallAuth(client, options, keyAuthSupported) {
     // Refuses here when key-required; others keep their OAuth argv.
     const buildAddArgs = keyedAdd
         ? (mcpUrl) => keyedAdd.spec.addArgs(mcpUrl, keyedAdd.key)
-        : keylessAddArgs(client, keyAuthSupported, options.mcpUrl);
+        : keylessAddArgs(client, keyAuthSupported);
     if (options.keyAuthOnly && !keyedAdd) {
         // All native clients have keyAuth; missing flags mean an old install.
         if (client.keyAuth) {

package/dist/commands/doctor.js

@@ -217,7 +217,9 @@ function repairsFor(checks, statuses) {
     for (const status of statuses) {
         // `unknown` earns nothing: connect would contradict the check's detail.
         // A registered entry that still fails earns one too.
-        const brokenRegistration = checks.some((c) => c.harness === status.harness && c.status === 'fail');
+        // `connected: false` is the harness's own no; it only warns, so it earns a repair here.
+        const brokenRegistration = status.connected === false ||
+            checks.some((c) => c.harness === status.harness && c.status === 'fail');
         if (!status.detected || (status.registered !== Registered.No && !brokenRegistration))
             continue;
         repairs.push({

package/dist/lib/connect-clients.d.ts

@@ -78,7 +78,7 @@ interface BaseMcpClient extends SupportedCommand {
 /** Keyless installs use this argv; the harness signs itself in. */
 export interface OauthCapableMcpClient extends BaseMcpClient {
     keyRequired?: false;
-    addArgs: (mcpUrl: string, oauthResource: string) => string[];
+    addArgs: (mcpUrl: string) => string[];
 }
 /** No sign-in exists here, so connect refuses a keyless install (Hermes). */
 export interface KeyRequiredMcpClient extends BaseMcpClient {

package/dist/lib/connect-clients.js

@@ -21,10 +21,15 @@ const CLAUDE_CODE_DEFERRED_AUTH_NOTE = 'TinyFish is registered in Claude Code bu
     'one-command sign-in (`claude mcp login`). Open Claude Code and run `/mcp` to sign in to ' +
     'TinyFish. `claude update` gets you one-command sign-in. Already have a TinyFish API key? ' +
     'Run `tinyfish connect claude-code --api-key <key>` instead.';
-const CODEX_OAUTH_RESOURCE_UNAVAILABLE_MESSAGE = 'Could not confirm this Codex installation supports one-command MCP authentication: `codex ' +
-    'mcp add --help` did not list `--oauth-resource`. Update Codex and retry, or add TinyFish ' +
-    'manually with `codex mcp add`.' +
+const CODEX_MCP_URL_UNAVAILABLE_MESSAGE = 'Could not confirm this Codex installation supports remote MCP servers: `codex mcp add ' +
+    '--help` did not list `--url`. Update Codex and retry, or add TinyFish manually with ' +
+    '`codex mcp add`.' +
     SUPPORT_CHECK_DEBUG_HINT;
+const CODEX_KEYED_FALLBACK_NOTE = 'Using your stored TinyFish API key: this Codex cannot report whether an OAuth sign-in ' +
+    'finished, so no browser sign-in is attempted.';
+const CODEX_DEFERRED_AUTH_NOTE = 'TinyFish is registered in Codex but not signed in: this Codex predates reliable sign-in ' +
+    'reporting. Run `codex mcp login tinyfish` to sign in, or update Codex with ' +
+    '`npm install -g @openai/codex@latest` for one-command sign-in.';
 const HERMES_OAUTH_UNAVAILABLE_MESSAGE = 'Could not confirm this Hermes installation supports one-command MCP authentication: `hermes ' +
     'mcp add --help` did not list `--auth oauth`. Update Hermes and retry, or add TinyFish ' +
     'manually with `hermes mcp add`.' +
@@ -174,21 +179,28 @@ export const CODEX = {
     displayName: 'Codex',
     supportCheck: {
         args: ['mcp', 'add', '--help'],
-        patterns: [/--oauth-resource(?:\s|<)/],
+        patterns: [/--url(?:[\s<=]|$)/m],
+        // Codex before ~0.142 reports `o_auth` for a server it never signed in to, so the
+        // sign-in probe lies; `--oauth-resource` is the only marker separating the two.
+        optionalPatterns: [/--oauth-resource(?:[\s<=]|$)/m],
         keyAuthPattern: /(?:^|\s)--bearer-token-env-var(?:[\s<=]|$)/m,
-        unavailableMessage: CODEX_OAUTH_RESOURCE_UNAVAILABLE_MESSAGE,
+        unavailableMessage: CODEX_MCP_URL_UNAVAILABLE_MESSAGE,
+    },
+    degradedAuthNotes: {
+        keyed: CODEX_KEYED_FALLBACK_NOTE,
+        deferred: CODEX_DEFERRED_AUTH_NOTE,
     },
     // Codex has no `--header`; the MCP server takes a key as `Bearer sk-…`.
-    // Omitting `--oauth-resource` is what keeps `mcp add` from running OAuth.
     keyAuth: {
         envVar: TINYFISH_API_KEY_VAR,
         addArgs: (mcpUrl) => [...urlAddArgs(mcpUrl), '--bearer-token-env-var', TINYFISH_API_KEY_VAR],
     },
     detachedLaunch: launchCodexWalkthrough,
-    // Retry only: running it after a finished inline OAuth is a second browser hop.
     loginArgs: ['mcp', 'login', 'tinyfish'],
     removals: [{ args: ['mcp', 'remove', 'tinyfish'], label: 'TinyFish registration from Codex' }],
-    addArgs: (mcpUrl, oauthResource) => [...urlAddArgs(mcpUrl), '--oauth-resource', oauthResource],
+    // `--oauth-resource` duplicates the resource Codex discovers; Clerk rejects both.
+    // `mcp add` still runs OAuth inline, so `loginArgs` stays a retry.
+    addArgs: urlAddArgs,
 };
 const grokAddArgs = (mcpUrl) => [
     'mcp',

package/dist/lib/registration-detect.js

@@ -13,6 +13,12 @@ import { detectInstalledHarnesses, harnessConfigPath, harnessDisplayPath, AuthMo
 // A list, verified against codex 0.146. A name-keyed map was accepted here too, but every
 // field is optional, so that arm parsed *any* object-of-objects: a wrapper like
 // `{"servers": {...}}` decoded as one entry named `servers` and reported TinyFish absent.
+// Codex's wire values, verified against 0.146; anything else stays unknown.
+var CodexAuthStatus;
+(function (CodexAuthStatus) {
+    CodexAuthStatus["OAuth"] = "o_auth";
+    CodexAuthStatus["NotLoggedIn"] = "not_logged_in";
+})(CodexAuthStatus || (CodexAuthStatus = {}));
 const codexEntrySchema = z.looseObject({
     name: z.string().optional(),
     auth_status: z.string().optional(),
@@ -216,9 +222,9 @@ export function codexOauthCompleted() {
     if ('reason' in read)
         return undefined;
     const status = read.entry?.auth_status;
-    if (status === 'o_auth')
+    if (status === CodexAuthStatus.OAuth)
         return true;
-    if (status === 'not_logged_in')
+    if (status === CodexAuthStatus.NotLoggedIn)
         return false;
     return undefined;
 }
@@ -255,10 +261,16 @@ function probeCodex() {
     const codexUrl = entry.transport?.url;
     // Read from this entry: codex emits `bearer_token_env_var` on every HTTP server, so testing
     // the whole payload reports api-key for TinyFish because some other server carries a key.
-    const envVar = entry.auth_status === 'o_auth' ? undefined : entry.transport?.bearer_token_env_var;
+    const envVar = entry.auth_status === CodexAuthStatus.OAuth ? undefined : entry.transport?.bearer_token_env_var;
     return {
         registered: Registered.Yes,
-        authMode: entry.auth_status === 'o_auth' ? AuthMode.OAuth : envVar ? AuthMode.ApiKey : AuthMode.Unknown,
+        authMode: entry.auth_status === CodexAuthStatus.OAuth
+            ? AuthMode.OAuth
+            : envVar
+                ? AuthMode.ApiKey
+                : AuthMode.Unknown,
+        // Codex's own verdict: a stale `oauth_resource` strands installs here.
+        ...(entry.auth_status === CodexAuthStatus.NotLoggedIn && !envVar ? { connected: false } : {}),
         ...(codexUrl ? { registeredUrl: codexUrl } : {}),
         ...(envVar ? envKeyVerdict(envVar) : {}),
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiny-fish/cli",
-  "version": "0.34.1-next.284",
+  "version": "0.34.1-next.285",
   "description": "TinyFish CLI — run web automations from your terminal",
   "type": "module",
   "bin": {