@tiny-fish/cli 0.34.1-next.284 → 0.34.1-next.286

package/README.md

@@ -57,8 +57,8 @@ interactive walkthrough with one command:
 npx -y @tiny-fish/cli@latest connect codex --launch --api-key sk-tinyfish-...
 ```
 
-One-command OAuth requires a Codex release whose `codex mcp add` command supports
-`--oauth-resource`. Update Codex if support is unavailable, or add TinyFish manually with
+One-command OAuth requires a Codex release whose `codex mcp add` command supports `--url`, plus
+`codex mcp login`. Update Codex if support is unavailable, or add TinyFish manually with
 `codex mcp add`.
 
 With `--api-key`, Codex reads the key from `TINYFISH_API_KEY` instead of signing in — the command

package/dist/commands/connect.js

@@ -75,11 +75,10 @@ function refuseKeylessInstall(client, keyAuthSupported) {
         `Run: tinyfish auth login, then ${rerun}`, 'invalid_config', { failureDetail: 'keyless_install_refused' });
 }
 /** Resolved before the removals, so a refusal strands no registration. */
-function keylessAddArgs(client, keyAuthSupported, oauthResource) {
+function keylessAddArgs(client, keyAuthSupported) {
     if (!client.addArgs)
         refuseKeylessInstall(client, keyAuthSupported);
-    const addArgs = client.addArgs;
-    return (mcpUrl) => addArgs(mcpUrl, oauthResource);
+    return client.addArgs;
 }
 /** Runs before any write: a refused key strands nothing. */
 async function verifyKeyBeforeSeeding(apiKey, displayName, mcpUrl) {
@@ -157,7 +156,7 @@ async function prepareInstallAuth(client, options, keyAuthSupported) {
     // Refuses here when key-required; others keep their OAuth argv.
     const buildAddArgs = keyedAdd
         ? (mcpUrl) => keyedAdd.spec.addArgs(mcpUrl, keyedAdd.key)
-        : keylessAddArgs(client, keyAuthSupported, options.mcpUrl);
+        : keylessAddArgs(client, keyAuthSupported);
     if (options.keyAuthOnly && !keyedAdd) {
         // All native clients have keyAuth; missing flags mean an old install.
         if (client.keyAuth) {

package/dist/commands/doctor.js

@@ -217,7 +217,9 @@ function repairsFor(checks, statuses) {
     for (const status of statuses) {
         // `unknown` earns nothing: connect would contradict the check's detail.
         // A registered entry that still fails earns one too.
-        const brokenRegistration = checks.some((c) => c.harness === status.harness && c.status === 'fail');
+        // `connected: false` is the harness's own no; it only warns, so it earns a repair here.
+        const brokenRegistration = status.connected === false ||
+            checks.some((c) => c.harness === status.harness && c.status === 'fail');
         if (!status.detected || (status.registered !== Registered.No && !brokenRegistration))
             continue;
         repairs.push({

package/dist/lib/connect-all-uninstall.js

@@ -3,6 +3,7 @@ import { NATIVE_BY_HARNESS, openclawSkillUninstall } from './connect-clients.js'
 import { ConnectInterruptedError, spawnRemoval } from './connect-runtime.js';
 import { removeCursorMcpServer, planCursorWrite } from './cursor-config.js';
 import { HERMES_KEY_VAR, hermesEnvPath, removeHermesKey, resolveHermesHome } from './hermes-env.js';
+import { clearHermesWebBackends, HERMES_PLUGIN_SHA } from './hermes-plugin.js';
 import { HARNESS_DISPLAY_NAMES as DISPLAY_NAMES } from './harness-detect.js';
 import { errLine } from './output.js';
 // OpenCode ships no `mcp remove`, so the only removal is editing the config it wrote.
@@ -12,7 +13,9 @@ export function planText(harness, mcpUrl, apiKey) {
         return planCursorWrite(mcpUrl, apiKey);
     // Only the keyed path seeds the .env; a keyless Hermes install writes nothing.
     if (harness === 'hermes' && apiKey) {
-        return `would run \`tinyfish connect hermes\` (harness-owned MCP write; the CLI writes ${HERMES_KEY_VAR} to Hermes' .env)`;
+        return (`would run \`tinyfish connect hermes\` (harness-owned MCP write; the CLI writes ` +
+            `${HERMES_KEY_VAR} to Hermes' .env, installs the tinyfish plugin at ` +
+            `${HERMES_PLUGIN_SHA.slice(0, 12)}, and points its web backends at tinyfish)`);
     }
     return `would run \`tinyfish connect ${harness}\` (harness-owned MCP write; no local file touched by the CLI)`;
 }
@@ -24,7 +27,9 @@ export function uninstallPlanText(harness) {
         return `would print \`${uninstallPointer(harness)}\` (no removal command exists)`;
     }
     // Hermes alone leaves a seeded key behind; `mcp remove` never clears it.
-    const envNote = harness === 'hermes' ? ` and clear ${HERMES_KEY_VAR} from Hermes' .env` : '';
+    const envNote = harness === 'hermes'
+        ? ` and clear ${HERMES_KEY_VAR} from Hermes' .env plus its tinyfish web backends`
+        : '';
     return `would run \`${uninstallPointer(harness)}\`${envNote}`;
 }
 /** Undefined: no harness-CLI removal exists (opencode). */
@@ -36,7 +41,8 @@ function uninstallRuns(harness) {
     const native = NATIVE_BY_HARNESS.get(harness);
     if (!native || native.removals.length === 0)
         return undefined;
-    return { command: native.command, runs: native.removals.map((r) => r.args) };
+    const extra = native.uninstallExtra ? [native.uninstallExtra.args] : [];
+    return { command: native.command, runs: [...native.removals.map((r) => r.args), ...extra] };
 }
 /** Derived from the same args the spawn runs, so the advice cannot drift. */
 function uninstallPointer(harness) {
@@ -48,9 +54,29 @@ function uninstallPointer(harness) {
     const joiner = process.platform === 'win32' ? ' && ' : ' ; ';
     return removal.runs.map((args) => `${removal.command} ${args.join(' ')}`).join(joiner);
 }
-/** `mcp remove` leaves this behind; a stale value gets silently reused. */
-function clearHermesEnvKey() {
+/** `mcp remove` clears neither the key nor the backends we wrote. */
+function clearHermesLocalState() {
     const home = resolveHermesHome();
+    const advisories = [clearHermesEnvKey(home), clearHermesBackends(home)].filter((advisory) => advisory !== undefined);
+    return advisories.length > 0 ? advisories.join(' ') : undefined;
+}
+/** Backends left naming an absent provider would break Hermes' web tools. */
+function clearHermesBackends(home) {
+    // The key clearer already reported the unresolved home.
+    if (!home)
+        return undefined;
+    try {
+        clearHermesWebBackends(home);
+        return undefined;
+    }
+    catch (e) {
+        const detail = e instanceof Error ? e.message : String(e);
+        return (`could not unset Hermes' tinyfish web backends (${detail}). Run \`hermes config unset ` +
+            'web.search_backend`, `web.extract_backend` and `web.backend` by hand.');
+    }
+}
+/** `mcp remove` leaves this behind; a stale value gets silently reused. */
+function clearHermesEnvKey(home) {
     const retry = 're-run `tinyfish connect --all --uninstall`';
     if (!home) {
         return (`could not locate Hermes' home, so ${HERMES_KEY_VAR} may still be set in its .env. ` +
@@ -177,7 +203,7 @@ export function uninstallHarness(harness, configPath, verbose, binaryOnPath) {
     // Clearing a key the entry still references would break a working install.
     const removed = !result.removalFailed &&
         (result.outcome === 'uninstalled' || result.outcome === 'uninstall_noop');
-    const advisory = removed ? clearHermesEnvKey() : hermesKeyKeptAdvisory();
+    const advisory = removed ? clearHermesLocalState() : hermesKeyKeptAdvisory();
     if (!advisory)
         return result;
     // Appended, never replacing: an advisory must not hide the removal's message.

package/dist/lib/connect-clients.d.ts

@@ -74,11 +74,16 @@ interface BaseMcpClient extends SupportedCommand {
         apiKey?: string;
         verbose: boolean;
     }) => void;
+    /** Extra --uninstall row beyond `removals`; never runs pre-add. */
+    uninstallExtra?: {
+        args: string[];
+        label: string;
+    };
 }
 /** Keyless installs use this argv; the harness signs itself in. */
 export interface OauthCapableMcpClient extends BaseMcpClient {
     keyRequired?: false;
-    addArgs: (mcpUrl: string, oauthResource: string) => string[];
+    addArgs: (mcpUrl: string) => string[];
 }
 /** No sign-in exists here, so connect refuses a keyless install (Hermes). */
 export interface KeyRequiredMcpClient extends BaseMcpClient {

package/dist/lib/connect-clients.js

@@ -7,7 +7,7 @@ import { ConnectStepError, spawnStepError, } from './connect-runtime.js';
 import { TINYFISH_API_KEY_VAR } from './constants.js';
 import { HERMES_KEY_VAR, captureHermesKeyRestore, hermesEnvPath, resolveHermesHome, writeHermesKey, } from './hermes-env.js';
 import { hermesConfigPath, readHermesEntry } from './hermes-config.js';
-import { installHermesPlugin, setHermesWebBackends } from './hermes-plugin.js';
+import { HERMES_PLUGIN_NAME, installHermesPlugin, setHermesWebBackends } from './hermes-plugin.js';
 const HERMES_SEED_TIMEOUT_MS = 120_000;
 // An old install is only one reason a flag can go unseen, so no message asserts the cause.
 const SUPPORT_CHECK_DEBUG_HINT = ' Set TINYFISH_DEBUG=1 and retry to print the help output TinyFish read.';
@@ -21,10 +21,15 @@ const CLAUDE_CODE_DEFERRED_AUTH_NOTE = 'TinyFish is registered in Claude Code bu
     'one-command sign-in (`claude mcp login`). Open Claude Code and run `/mcp` to sign in to ' +
     'TinyFish. `claude update` gets you one-command sign-in. Already have a TinyFish API key? ' +
     'Run `tinyfish connect claude-code --api-key <key>` instead.';
-const CODEX_OAUTH_RESOURCE_UNAVAILABLE_MESSAGE = 'Could not confirm this Codex installation supports one-command MCP authentication: `codex ' +
-    'mcp add --help` did not list `--oauth-resource`. Update Codex and retry, or add TinyFish ' +
-    'manually with `codex mcp add`.' +
+const CODEX_MCP_URL_UNAVAILABLE_MESSAGE = 'Could not confirm this Codex installation supports remote MCP servers: `codex mcp add ' +
+    '--help` did not list `--url`. Update Codex and retry, or add TinyFish manually with ' +
+    '`codex mcp add`.' +
     SUPPORT_CHECK_DEBUG_HINT;
+const CODEX_KEYED_FALLBACK_NOTE = 'Using your stored TinyFish API key: this Codex cannot report whether an OAuth sign-in ' +
+    'finished, so no browser sign-in is attempted.';
+const CODEX_DEFERRED_AUTH_NOTE = 'TinyFish is registered in Codex but not signed in: this Codex predates reliable sign-in ' +
+    'reporting. Run `codex mcp login tinyfish` to sign in, or update Codex with ' +
+    '`npm install -g @openai/codex@latest` for one-command sign-in.';
 const HERMES_OAUTH_UNAVAILABLE_MESSAGE = 'Could not confirm this Hermes installation supports one-command MCP authentication: `hermes ' +
     'mcp add --help` did not list `--auth oauth`. Update Hermes and retry, or add TinyFish ' +
     'manually with `hermes mcp add`.' +
@@ -174,21 +179,28 @@ export const CODEX = {
     displayName: 'Codex',
     supportCheck: {
         args: ['mcp', 'add', '--help'],
-        patterns: [/--oauth-resource(?:\s|<)/],
+        patterns: [/--url(?:[\s<=]|$)/m],
+        // Codex before ~0.142 reports `o_auth` for a server it never signed in to, so the
+        // sign-in probe lies; `--oauth-resource` is the only marker separating the two.
+        optionalPatterns: [/--oauth-resource(?:[\s<=]|$)/m],
         keyAuthPattern: /(?:^|\s)--bearer-token-env-var(?:[\s<=]|$)/m,
-        unavailableMessage: CODEX_OAUTH_RESOURCE_UNAVAILABLE_MESSAGE,
+        unavailableMessage: CODEX_MCP_URL_UNAVAILABLE_MESSAGE,
+    },
+    degradedAuthNotes: {
+        keyed: CODEX_KEYED_FALLBACK_NOTE,
+        deferred: CODEX_DEFERRED_AUTH_NOTE,
     },
     // Codex has no `--header`; the MCP server takes a key as `Bearer sk-…`.
-    // Omitting `--oauth-resource` is what keeps `mcp add` from running OAuth.
     keyAuth: {
         envVar: TINYFISH_API_KEY_VAR,
         addArgs: (mcpUrl) => [...urlAddArgs(mcpUrl), '--bearer-token-env-var', TINYFISH_API_KEY_VAR],
     },
     detachedLaunch: launchCodexWalkthrough,
-    // Retry only: running it after a finished inline OAuth is a second browser hop.
     loginArgs: ['mcp', 'login', 'tinyfish'],
     removals: [{ args: ['mcp', 'remove', 'tinyfish'], label: 'TinyFish registration from Codex' }],
-    addArgs: (mcpUrl, oauthResource) => [...urlAddArgs(mcpUrl), '--oauth-resource', oauthResource],
+    // `--oauth-resource` duplicates the resource Codex discovers; Clerk rejects both.
+    // `mcp add` still runs OAuth inline, so `loginArgs` stays a retry.
+    addArgs: urlAddArgs,
 };
 const grokAddArgs = (mcpUrl) => [
     'mcp',
@@ -320,6 +332,10 @@ export const HERMES = {
     },
     removals: [{ args: ['mcp', 'remove', 'tinyfish'], label: 'TinyFish registration from Hermes' }],
     extraPostInstall: installHermesWebPlugin,
+    uninstallExtra: {
+        args: ['plugins', 'uninstall', HERMES_PLUGIN_NAME],
+        label: 'TinyFish web plugin from Hermes',
+    },
     launchWalkthrough: launchHermesWalkthrough,
     postConnectNote: 'Restart your Hermes session to pick up TinyFish — Hermes discovers MCP servers at startup.',
 };

package/dist/lib/hermes-plugin.d.ts

@@ -1,6 +1,9 @@
 import { type InstallOptions } from './cli-install.js';
 export declare const HERMES_PLUGIN_SHA = "496cd63fefd982bbaa8a85ce78ef2270d700984f";
+export declare const HERMES_PLUGIN_NAME = "tinyfish";
 export declare const HERMES_PLUGIN_MANUAL_INSTALL = "hermes plugins install tinyfish-io/tinyfish-web-agent-integrations/hermes --ref 496cd63fefd982bbaa8a85ce78ef2270d700984f --enable";
 export declare function installHermesPlugin(home: string, apiKey: string, { verbose }: Pick<InstallOptions, 'verbose'>): void;
 /** After install only: backends must never name an absent provider. */
 export declare function setHermesWebBackends(home: string): void;
+/** Ours-only unsets: a user-chosen backend value survives the uninstall. */
+export declare function clearHermesWebBackends(home: string): void;

package/dist/lib/hermes-plugin.js

@@ -4,11 +4,13 @@ import * as path from 'node:path';
 import { pathToFileURL } from 'node:url';
 import spawn from 'cross-spawn';
 import { capturedOutput, replay, SKILL_INSTALL_TIMEOUT_MS, STEP_MAX_BUFFER, } from './cli-install.js';
-import { commandNotFound, ConnectStepError, spawnStepError } from './connect-runtime.js';
+import { commandNotFound, ConnectStepError, spawnStepError, throwIfInterrupted, } from './connect-runtime.js';
 import { HARNESS_PROBE_TIMEOUT_MS } from './constants.js';
 import { errLine } from './output.js';
 // Bump per CLI release.
 export const HERMES_PLUGIN_SHA = '496cd63fefd982bbaa8a85ce78ef2270d700984f';
+// Manifest `name:`, not the repo subdir; `plugins uninstall` keys on it.
+export const HERMES_PLUGIN_NAME = 'tinyfish';
 const PLUGIN_SOURCE = 'tinyfish-io/tinyfish-web-agent-integrations/hermes';
 const PLUGIN_REPO_URL = 'https://github.com/tinyfish-io/tinyfish-web-agent-integrations.git';
 export const HERMES_PLUGIN_MANUAL_INSTALL = `hermes plugins install ${PLUGIN_SOURCE} --ref ${HERMES_PLUGIN_SHA} --enable`;
@@ -92,8 +94,26 @@ function configWrite(home, args) {
     throw error;
 }
 const HERMES_BACKEND_KEYS = ['web.search_backend', 'web.extract_backend'];
+// Dispatch falls back to web.backend, and the plugin's own setup can set it.
+const HERMES_OWNED_BACKEND_KEYS = [...HERMES_BACKEND_KEYS, 'web.backend'];
 /** After install only: backends must never name an absent provider. */
 export function setHermesWebBackends(home) {
     for (const key of HERMES_BACKEND_KEYS)
         configWrite(home, ['set', key, 'tinyfish']);
 }
+/** Unset prints empty and exits 0, so a failed read must not read as unset. */
+function configGet(home, key) {
+    const result = hermesConfig(['get', key], home);
+    throwIfInterrupted(result);
+    if (result.error || result.status !== 0) {
+        throw spawnStepError(`Could not read \`hermes config get ${key}\``, result);
+    }
+    return String(result.stdout ?? '').trim() || undefined;
+}
+/** Ours-only unsets: a user-chosen backend value survives the uninstall. */
+export function clearHermesWebBackends(home) {
+    for (const key of HERMES_OWNED_BACKEND_KEYS) {
+        if (configGet(home, key) === 'tinyfish')
+            configWrite(home, ['unset', key]);
+    }
+}

package/dist/lib/registration-detect.js

@@ -13,6 +13,12 @@ import { detectInstalledHarnesses, harnessConfigPath, harnessDisplayPath, AuthMo
 // A list, verified against codex 0.146. A name-keyed map was accepted here too, but every
 // field is optional, so that arm parsed *any* object-of-objects: a wrapper like
 // `{"servers": {...}}` decoded as one entry named `servers` and reported TinyFish absent.
+// Codex's wire values, verified against 0.146; anything else stays unknown.
+var CodexAuthStatus;
+(function (CodexAuthStatus) {
+    CodexAuthStatus["OAuth"] = "o_auth";
+    CodexAuthStatus["NotLoggedIn"] = "not_logged_in";
+})(CodexAuthStatus || (CodexAuthStatus = {}));
 const codexEntrySchema = z.looseObject({
     name: z.string().optional(),
     auth_status: z.string().optional(),
@@ -216,9 +222,9 @@ export function codexOauthCompleted() {
     if ('reason' in read)
         return undefined;
     const status = read.entry?.auth_status;
-    if (status === 'o_auth')
+    if (status === CodexAuthStatus.OAuth)
         return true;
-    if (status === 'not_logged_in')
+    if (status === CodexAuthStatus.NotLoggedIn)
         return false;
     return undefined;
 }
@@ -255,10 +261,16 @@ function probeCodex() {
     const codexUrl = entry.transport?.url;
     // Read from this entry: codex emits `bearer_token_env_var` on every HTTP server, so testing
     // the whole payload reports api-key for TinyFish because some other server carries a key.
-    const envVar = entry.auth_status === 'o_auth' ? undefined : entry.transport?.bearer_token_env_var;
+    const envVar = entry.auth_status === CodexAuthStatus.OAuth ? undefined : entry.transport?.bearer_token_env_var;
     return {
         registered: Registered.Yes,
-        authMode: entry.auth_status === 'o_auth' ? AuthMode.OAuth : envVar ? AuthMode.ApiKey : AuthMode.Unknown,
+        authMode: entry.auth_status === CodexAuthStatus.OAuth
+            ? AuthMode.OAuth
+            : envVar
+                ? AuthMode.ApiKey
+                : AuthMode.Unknown,
+        // Codex's own verdict: a stale `oauth_resource` strands installs here.
+        ...(entry.auth_status === CodexAuthStatus.NotLoggedIn && !envVar ? { connected: false } : {}),
         ...(codexUrl ? { registeredUrl: codexUrl } : {}),
         ...(envVar ? envKeyVerdict(envVar) : {}),
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiny-fish/cli",
-  "version": "0.34.1-next.284",
+  "version": "0.34.1-next.286",
   "description": "TinyFish CLI — run web automations from your terminal",
   "type": "module",
   "bin": {