@tiny-fish/cli 0.37.1-next.298 → 0.37.1-next.300

package/dist/commands/connect.js

@@ -8,7 +8,7 @@ import { installWebSkill } from '../lib/skill-install.js';
 import { ConnectInterruptedError, ConnectStepError, createConnectTelemetry, finishSetupCommand, requireCommandSupport, runGuarded, settle, SignInTimeoutError, spawnStepError, stageDurationOf, withStageDuration, spawnRemoval, } from '../lib/connect-runtime.js';
 import { cursorInstallDeeplink, cursorMcpPath, readCursorTinyfishEntry, writeCursorMcpConfig, } from '../lib/cursor-config.js';
 import { runConnectAll } from '../lib/connect-all.js';
-import { ALL_HARNESSES, AuthMode, RELOAD_ACTION } from '../lib/harness-detect.js';
+import { ALL_HARNESSES, AuthMode, HARNESS_DISPLAY_NAMES, RELOAD_ACTION, } from '../lib/harness-detect.js';
 import { detectHumanInitiated } from '../lib/harness.js';
 import { TINYFISH_API_KEY_VAR } from '../lib/constants.js';
 import { emitNotice } from '../lib/notice.js';
@@ -506,10 +506,28 @@ export async function connectOpenClaw(options) {
         }
     });
 }
-/** Writes mcp.json directly — no `cursor mcp add` exists. */
-export async function connectCursor(options) {
+const CONFIG_FILE_HARNESSES = {
+    cursor: {
+        skillTarget: CURSOR_SKILL_TARGET,
+        registeredUrl: () => readCursorTinyfishEntry().url,
+        write: writeCursorMcpConfig,
+        configPath: cursorMcpPath,
+        tryLaunch: launchCursorDeeplink,
+        copy: {
+            verified: "TinyFish is connected and verified (health+auth). Reload the Cursor window (or restart cursor-agent) and it's live.",
+            authFailed: (reason) => `TinyFish is configured, but the authenticated check failed (${reason}). ` +
+                'Fix: rotate/re-enter your key with `tinyfish auth login`, then re-run: tinyfish connect cursor',
+            launched: 'Cursor should pop a TinyFish install confirmation — approve it, then sign in when prompted.',
+            reload: 'TinyFish is connected. Reload the Cursor window, then approve/sign in under Settings → MCP.',
+        },
+    },
+};
+/** Writes the harness's MCP config file itself; no `mcp add` exists. */
+async function connectConfigFileHarness(harness, options) {
+    const spec = CONFIG_FILE_HARNESSES[harness];
+    const displayName = HARNESS_DISPLAY_NAMES[harness];
     let fallbackAttemptId;
-    const registeredUrl = readCursorTinyfishEntry().url;
+    const registeredUrl = spec.registeredUrl();
     if (registeredUrl) {
         try {
             const registered = new URL(registeredUrl);
@@ -525,7 +543,7 @@ export async function connectCursor(options) {
             requested.searchParams.sort();
             if (registered.toString() === requested.toString() &&
                 registeredSource === CONNECT_SOURCE &&
-                registeredClient === 'cursor' &&
+                registeredClient === harness &&
                 z.uuid().safeParse(registeredId).success) {
                 fallbackAttemptId = registeredId ?? undefined;
             }
@@ -534,12 +552,12 @@ export async function connectCursor(options) {
             // A hand-edited invalid URL is repaired below with a fresh attempt id.
         }
     }
-    const telemetry = createConnectTelemetry(options.mcpUrl, 'cursor', {
+    const telemetry = createConnectTelemetry(options.mcpUrl, harness, {
         ...options,
         fallbackAttemptId,
     });
     // Never degraded: no sign-in command to be missing. False, not absent, so a `= false`
-    // filter still catches Cursor.
+    // filter still catches these harnesses.
     const state = {
         stage: 'prerequisite_check',
         settled: false,
@@ -549,11 +567,11 @@ export async function connectCursor(options) {
         telemetry.track('started');
         telemetry.track('checkpoint', { phase: 'prerequisite_ok' });
         state.stage = 'skill_install';
-        installWebSkill(CURSOR_SKILL_TARGET, { verbose: options.verbose ?? false });
+        installWebSkill(spec.skillTarget, { verbose: options.verbose ?? false });
         telemetry.track('checkpoint', { phase: 'skill_installed' });
         // Auth first: a key lets the config carry an X-API-Key header, removing the sign-in hand-back.
         state.stage = 'authentication';
-        ensureCliAuthenticated('cursor', options.apiKey);
+        ensureCliAuthenticated(harness, options.apiKey);
         telemetry.track('checkpoint', { phase: 'authenticated' });
         const resolvedKey = validatedApiKey(options.apiKey);
         // ensureCliAuthenticated leaves a key stored, and `auth status` exits 0 on a malformed one.
@@ -561,45 +579,48 @@ export async function connectCursor(options) {
             errLine('Ignoring the stored API key: invalid format. Run: tinyfish auth login');
         }
         state.stage = 'registration';
-        errLine('Adding TinyFish to Cursor...');
+        errLine(`Adding TinyFish to ${displayName}...`);
         const mcpUrl = new URL(options.mcpUrl);
         mcpUrl.searchParams.set('source', CONNECT_SOURCE);
-        mcpUrl.searchParams.set('client', 'cursor');
+        mcpUrl.searchParams.set('client', harness);
         mcpUrl.searchParams.set('connect_attempt_id', telemetry.attemptId);
-        const result = writeCursorMcpConfig(mcpUrl.toString(), resolvedKey);
+        const result = spec.write(mcpUrl.toString(), resolvedKey);
         if (result.status === 'corrupt_skip') {
             // The message fallback would leak the config path; tag instead.
-            throw new ConnectStepError(`Could not update ${cursorMcpPath()}: existing file could not be read or is not valid JSON (${result.error}). ` +
-                `Fix the file, then re-run: tinyfish connect cursor`, 'invalid_config', { failureDetail: 'cursor_mcp_json_corrupt' });
+            throw new ConnectStepError(`Could not update ${spec.configPath()}: existing file could not be read or is not valid JSON (${result.error}). ` +
+                `Fix the file, then re-run: tinyfish connect ${harness}`, 'invalid_config', { failureDetail: `${harness}_mcp_json_corrupt` });
         }
         if (result.backupPath) {
-            errLine(`Backed up existing Cursor MCP config to ${result.backupPath}`);
+            errLine(`Backed up existing ${displayName} MCP config to ${result.backupPath}`);
         }
         if (result.repaired) {
             errLine('Repaired the existing TinyFish entry (updated auth/config to current).');
         }
         telemetry.track('checkpoint', { phase: 'registered' });
-        saveConnectContext('cursor', telemetry.attemptId);
+        saveConnectContext(harness, telemetry.attemptId);
         if (resolvedKey) {
             // Deeplink would embed the key in a URL (process args, LaunchServices logs) — reload instead.
             const verify = await verifyMcpAuth(resolvedKey);
             if (verify.ok) {
-                errLine("TinyFish is connected and verified (health+auth). Reload the Cursor window (or restart cursor-agent) and it's live.");
+                errLine(spec.copy.verified);
             }
             else {
-                errLine(`TinyFish is configured, but the authenticated check failed (${verify.reason ?? 'unknown'}). ` +
-                    'Fix: rotate/re-enter your key with `tinyfish auth login`, then re-run: tinyfish connect cursor');
+                errLine(spec.copy.authFailed(verify.reason ?? 'unknown'));
             }
         }
-        else if (detectHumanInitiated() && launchCursorDeeplink(mcpUrl.toString())) {
-            errLine('Cursor should pop a TinyFish install confirmation — approve it, then sign in when prompted.');
+        else if (detectHumanInitiated() && spec.tryLaunch(mcpUrl.toString())) {
+            errLine(spec.copy.launched);
         }
         else {
-            errLine('TinyFish is connected. Reload the Cursor window, then approve/sign in under Settings → MCP.');
+            errLine(spec.copy.reload);
         }
         settle(state, telemetry, 'completed', { authMode: resolvedKey ? AuthMode.ApiKey : 'deferred' });
     });
 }
+/** Writes mcp.json directly — no `cursor mcp add` exists. */
+export async function connectCursor(options) {
+    await connectConfigFileHarness('cursor', options);
+}
 /** Best-effort: false when no handler/open fails — caller falls back to reload copy. */
 function launchCursorDeeplink(mcpUrl) {
     const result = openExternalUrl(cursorInstallDeeplink(mcpUrl));

package/dist/lib/cursor-config.d.ts

@@ -1,27 +1,14 @@
-export declare function cursorConfigDir(): string;
+import { type McpJsonServerEntry, type McpJsonWriteResult } from './mcp-json-config.js';
+export type CursorMcpWriteResult = McpJsonWriteResult;
+export type CursorTinyfishEntry = McpJsonServerEntry;
 export declare function cursorMcpPath(): string;
-export interface CursorMcpWriteResult {
-    status: 'written' | 'unchanged' | 'corrupt_skip';
-    backupPath?: string;
-    error?: string;
-    /** A pre-existing tinyfish entry was replaced — a repair, not a fresh install. */
-    repaired?: boolean;
-}
 /** Dry-run description of the pending write; touches nothing. */
 export declare function planCursorWrite(mcpUrl: string, apiKey?: string): string;
-export interface CursorTinyfishEntry {
-    present: boolean;
-    hasApiKeyHeader: boolean;
-    /** Registered endpoint, so a caller can tell "registered" from "registered at the right place". */
-    url?: string;
-    keyMatchesCliKey?: boolean;
-    error?: string;
-}
 /** Reports the header's shape, never its value. */
 export declare function readCursorTinyfishEntry(): CursorTinyfishEntry;
 /** Merges only the `tinyfish` key; skips unreadable/corrupt files rather than clobber. */
 export declare function writeCursorMcpConfig(mcpUrl: string, apiKey?: string): CursorMcpWriteResult;
-/** Cursor deeplink format: cursor://anysphere.cursor-deeplink/mcp/install?name=$NAME&config=$BASE64 */
-export declare function cursorInstallDeeplink(mcpUrl: string): string;
 /** Removes only the `tinyfish` key. */
 export declare function removeCursorMcpServer(): CursorMcpWriteResult;
+/** Cursor deeplink format: cursor://anysphere.cursor-deeplink/mcp/install?name=$NAME&config=$BASE64 */
+export declare function cursorInstallDeeplink(mcpUrl: string): string;

package/dist/lib/cursor-config.js

@@ -1,148 +1,32 @@
-import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
-import { matchesCliKey } from './auth.js';
-// The one config file the CLI writes directly — hence backup/merge rigor.
-const TINYFISH_SERVER_KEY = 'tinyfish';
-export function cursorConfigDir() {
-    return path.join(os.homedir(), '.cursor');
-}
+import { buildTinyfishServerEntry, planWrite, readTinyfishEntry, removeServer, writeMcpConfig, } from './mcp-json-config.js';
+const CURSOR_TARGET = {
+    serverKey: 'tinyfish',
+    dir: () => path.join(os.homedir(), '.cursor'),
+    file: () => path.join(os.homedir(), '.cursor', 'mcp.json'),
+};
 export function cursorMcpPath() {
-    return path.join(cursorConfigDir(), 'mcp.json');
-}
-function isPlainRecord(value) {
-    return value !== null && typeof value === 'object' && !Array.isArray(value);
-}
-// Footgun: the key lands plaintext in mcp.json (0600) — per-device keys are the GA hardening.
-function buildTinyfishServerEntry(mcpUrl, apiKey) {
-    return apiKey ? { url: mcpUrl, headers: { 'X-API-Key': apiKey } } : { url: mcpUrl };
-}
-function parseMcpJson(raw) {
-    try {
-        const parsed = JSON.parse(raw);
-        if (!isPlainRecord(parsed))
-            return { ok: false, error: 'mcp.json root is not a JSON object' };
-        if ('mcpServers' in parsed && !isPlainRecord(parsed.mcpServers)) {
-            return { ok: false, error: 'mcp.json mcpServers is not a JSON object' };
-        }
-        return { ok: true, value: parsed };
-    }
-    catch (e) {
-        return { ok: false, error: e instanceof Error ? e.message : String(e) };
-    }
-}
-// Non-ENOENT read failures count as corruption: skip, never clobber.
-function readExisting() {
-    let raw;
-    try {
-        raw = fs.readFileSync(cursorMcpPath(), 'utf8');
-    }
-    catch (e) {
-        if (e?.code === 'ENOENT')
-            return { parsed: {} };
-        return { error: e instanceof Error ? e.message : String(e) };
-    }
-    const parsed = parseMcpJson(raw);
-    if (!parsed.ok)
-        return { error: parsed.error };
-    return { raw, parsed: parsed.value };
+    return CURSOR_TARGET.file();
 }
 /** Dry-run description of the pending write; touches nothing. */
 export function planCursorWrite(mcpUrl, apiKey) {
-    const existing = readExisting();
-    const filePath = cursorMcpPath();
-    if ('error' in existing) {
-        return `${filePath}: existing file is corrupt (${existing.error}) — would skip and leave it untouched`;
-    }
-    const authNote = apiKey
-        ? ' with an API-key header — the key is stored in plaintext in that file (value not shown here)'
-        : '';
-    const servers = existing.parsed.mcpServers;
-    const current = isPlainRecord(servers) ? servers[TINYFISH_SERVER_KEY] : undefined;
-    if (JSON.stringify(current) === JSON.stringify(buildTinyfishServerEntry(mcpUrl, apiKey))) {
-        return `${filePath}: already has the tinyfish MCP entry — no change`;
-    }
-    return existing.raw === undefined
-        ? `${filePath}: would create with a "tinyfish" MCP server entry${authNote}`
-        : `${filePath}: would back up to a timestamped copy, then merge in the "tinyfish" MCP server entry${authNote}`;
+    return planWrite(CURSOR_TARGET, mcpUrl, apiKey);
 }
 /** Reports the header's shape, never its value. */
 export function readCursorTinyfishEntry() {
-    const existing = readExisting();
-    if ('error' in existing)
-        return { present: false, hasApiKeyHeader: false, error: existing.error };
-    const servers = existing.parsed.mcpServers;
-    const entry = isPlainRecord(servers) ? servers[TINYFISH_SERVER_KEY] : undefined;
-    if (!isPlainRecord(entry))
-        return { present: false, hasApiKeyHeader: false };
-    const headers = entry.headers;
-    // Header names are case-insensitive, and this file is hand-editable — matching only the
-    // casing we write would understate auth mode for a user who typed it differently.
-    const keyHeader = isPlainRecord(headers)
-        ? Object.entries(headers).find((entry) => entry[0].toLowerCase() === 'x-api-key' && typeof entry[1] === 'string')
-        : undefined;
-    return {
-        present: true,
-        hasApiKeyHeader: keyHeader !== undefined,
-        ...(matchesCliKey(keyHeader?.[1]) ? { keyMatchesCliKey: true } : {}),
-        ...(typeof entry.url === 'string' ? { url: entry.url } : {}),
-    };
-}
-// Backup, then atomic temp+rename; pid avoids same-millisecond backup collisions.
-function commitServers(filePath, existing, servers) {
-    fs.mkdirSync(cursorConfigDir(), { recursive: true, mode: 0o700 });
-    let backupPath;
-    if (existing.raw !== undefined) {
-        backupPath = `${filePath}.bak-${Date.now()}-${process.pid}`;
-        fs.writeFileSync(backupPath, existing.raw, { mode: 0o600 });
-    }
-    const next = { ...existing.parsed, mcpServers: servers };
-    const tmpPath = `${filePath}.tmp-${process.pid}`;
-    fs.writeFileSync(tmpPath, JSON.stringify(next, null, 2) + '\n', { mode: 0o600 });
-    try {
-        fs.renameSync(tmpPath, filePath);
-    }
-    catch (e) {
-        fs.rmSync(tmpPath, { force: true });
-        throw e;
-    }
-    return { status: 'written', backupPath };
+    return readTinyfishEntry(CURSOR_TARGET);
 }
 /** Merges only the `tinyfish` key; skips unreadable/corrupt files rather than clobber. */
 export function writeCursorMcpConfig(mcpUrl, apiKey) {
-    const filePath = cursorMcpPath();
-    const existing = readExisting();
-    if ('error' in existing)
-        return { status: 'corrupt_skip', error: existing.error };
-    const servers = isPlainRecord(existing.parsed.mcpServers)
-        ? { ...existing.parsed.mcpServers }
-        : {};
-    const nextEntry = buildTinyfishServerEntry(mcpUrl, apiKey);
-    if (JSON.stringify(servers[TINYFISH_SERVER_KEY]) === JSON.stringify(nextEntry)) {
-        return { status: 'unchanged' };
-    }
-    const repaired = TINYFISH_SERVER_KEY in servers;
-    servers[TINYFISH_SERVER_KEY] = nextEntry;
-    return { ...commitServers(filePath, existing, servers), repaired };
+    return writeMcpConfig(CURSOR_TARGET, mcpUrl, apiKey);
+}
+/** Removes only the `tinyfish` key. */
+export function removeCursorMcpServer() {
+    return removeServer(CURSOR_TARGET);
 }
 /** Cursor deeplink format: cursor://anysphere.cursor-deeplink/mcp/install?name=$NAME&config=$BASE64 */
 export function cursorInstallDeeplink(mcpUrl) {
     const config = Buffer.from(JSON.stringify(buildTinyfishServerEntry(mcpUrl))).toString('base64');
-    return `cursor://anysphere.cursor-deeplink/mcp/install?name=${TINYFISH_SERVER_KEY}&config=${encodeURIComponent(config)}`;
-}
-/** Removes only the `tinyfish` key. */
-export function removeCursorMcpServer() {
-    const filePath = cursorMcpPath();
-    const existing = readExisting();
-    if ('error' in existing)
-        return { status: 'corrupt_skip', error: existing.error };
-    if (existing.raw === undefined)
-        return { status: 'unchanged' };
-    const servers = isPlainRecord(existing.parsed.mcpServers)
-        ? { ...existing.parsed.mcpServers }
-        : {};
-    if (!(TINYFISH_SERVER_KEY in servers))
-        return { status: 'unchanged' };
-    delete servers[TINYFISH_SERVER_KEY];
-    return commitServers(filePath, existing, servers);
+    return `cursor://anysphere.cursor-deeplink/mcp/install?name=${CURSOR_TARGET.serverKey}&config=${encodeURIComponent(config)}`;
 }

package/dist/lib/harness.js

@@ -14,6 +14,8 @@ const hasVarWithPrefix = (env, prefix) => Object.keys(env).some((key) => key.sta
 // First match wins. Base agents (claude-code) go last so embedding wrappers win.
 const HARNESS_FINGERPRINTS = [
     { name: 'openclaw', matches: (env) => hasVarWithPrefix(env, 'OPENCLAW_MCP_') },
+    // omp hardcodes CLAUDECODE=1, so it must precede claude-code.
+    { name: 'omp', matches: (env) => env['OMPCODE'] === '1' },
     { name: 'grok', matches: (env) => env['GROK_AGENT'] === '1' },
     // Cursor's VS Code host sets CURSOR_* broadly; CURSOR_AGENT=1 flags the
     // agent specifically, so gate on it rather than the prefix.

package/dist/lib/mcp-json-config.d.ts

@@ -0,0 +1,30 @@
+export interface McpJsonTarget {
+    serverKey: string;
+    /** Functions so paths resolve at call time. */
+    dir(): string;
+    file(): string;
+}
+export interface McpJsonWriteResult {
+    status: 'written' | 'unchanged' | 'corrupt_skip';
+    backupPath?: string;
+    error?: string;
+    /** A pre-existing entry was replaced — a repair, not a fresh install. */
+    repaired?: boolean;
+}
+export declare function buildTinyfishServerEntry(mcpUrl: string, apiKey?: string): Record<string, unknown>;
+/** Dry-run description of the pending write; touches nothing. */
+export declare function planWrite(target: McpJsonTarget, mcpUrl: string, apiKey?: string): string;
+export interface McpJsonServerEntry {
+    present: boolean;
+    hasApiKeyHeader: boolean;
+    /** Registered endpoint, so a caller can tell "registered" from "registered at the right place". */
+    url?: string;
+    keyMatchesCliKey?: boolean;
+    error?: string;
+}
+/** Reports the header's shape, never its value. */
+export declare function readTinyfishEntry(target: McpJsonTarget): McpJsonServerEntry;
+/** Merges only the target's key; skips unreadable/corrupt files rather than clobber. */
+export declare function writeMcpConfig(target: McpJsonTarget, mcpUrl: string, apiKey?: string): McpJsonWriteResult;
+/** Removes only the target's key. */
+export declare function removeServer(target: McpJsonTarget): McpJsonWriteResult;

package/dist/lib/mcp-json-config.js

@@ -0,0 +1,132 @@
+import * as fs from 'fs';
+import { matchesCliKey } from './auth.js';
+function isPlainRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+// Footgun: the key lands plaintext in mcp.json (0600) — per-device keys are the GA hardening.
+export function buildTinyfishServerEntry(mcpUrl, apiKey) {
+    return apiKey ? { url: mcpUrl, headers: { 'X-API-Key': apiKey } } : { url: mcpUrl };
+}
+function parseMcpJson(raw) {
+    try {
+        const parsed = JSON.parse(raw);
+        if (!isPlainRecord(parsed))
+            return { ok: false, error: 'mcp.json root is not a JSON object' };
+        if ('mcpServers' in parsed && !isPlainRecord(parsed.mcpServers)) {
+            return { ok: false, error: 'mcp.json mcpServers is not a JSON object' };
+        }
+        return { ok: true, value: parsed };
+    }
+    catch (e) {
+        return { ok: false, error: e instanceof Error ? e.message : String(e) };
+    }
+}
+// Non-ENOENT read failures count as corruption: skip, never clobber.
+function readExisting(target) {
+    let raw;
+    try {
+        raw = fs.readFileSync(target.file(), 'utf8');
+    }
+    catch (e) {
+        if (e?.code === 'ENOENT')
+            return { parsed: {} };
+        return { error: e instanceof Error ? e.message : String(e) };
+    }
+    const parsed = parseMcpJson(raw);
+    if (!parsed.ok)
+        return { error: parsed.error };
+    return { raw, parsed: parsed.value };
+}
+/** Dry-run description of the pending write; touches nothing. */
+export function planWrite(target, mcpUrl, apiKey) {
+    const existing = readExisting(target);
+    const filePath = target.file();
+    if ('error' in existing) {
+        return `${filePath}: existing file is corrupt (${existing.error}) — would skip and leave it untouched`;
+    }
+    const authNote = apiKey
+        ? ' with an API-key header — the key is stored in plaintext in that file (value not shown here)'
+        : '';
+    const servers = existing.parsed.mcpServers;
+    const current = isPlainRecord(servers) ? servers[target.serverKey] : undefined;
+    if (JSON.stringify(current) === JSON.stringify(buildTinyfishServerEntry(mcpUrl, apiKey))) {
+        return `${filePath}: already has the ${target.serverKey} MCP entry — no change`;
+    }
+    return existing.raw === undefined
+        ? `${filePath}: would create with a "${target.serverKey}" MCP server entry${authNote}`
+        : `${filePath}: would back up to a timestamped copy, then merge in the "${target.serverKey}" MCP server entry${authNote}`;
+}
+/** Reports the header's shape, never its value. */
+export function readTinyfishEntry(target) {
+    const existing = readExisting(target);
+    if ('error' in existing)
+        return { present: false, hasApiKeyHeader: false, error: existing.error };
+    const servers = existing.parsed.mcpServers;
+    const entry = isPlainRecord(servers) ? servers[target.serverKey] : undefined;
+    if (!isPlainRecord(entry))
+        return { present: false, hasApiKeyHeader: false };
+    const headers = entry.headers;
+    // Header names are case-insensitive, and this file is hand-editable — matching only the
+    // casing we write would understate auth mode for a user who typed it differently.
+    const keyHeader = isPlainRecord(headers)
+        ? Object.entries(headers).find((entry) => entry[0].toLowerCase() === 'x-api-key' && typeof entry[1] === 'string')
+        : undefined;
+    return {
+        present: true,
+        hasApiKeyHeader: keyHeader !== undefined,
+        ...(matchesCliKey(keyHeader?.[1]) ? { keyMatchesCliKey: true } : {}),
+        ...(typeof entry.url === 'string' ? { url: entry.url } : {}),
+    };
+}
+// Backup, then atomic temp+rename; pid avoids same-millisecond backup collisions.
+function commitServers(target, existing, servers) {
+    const filePath = target.file();
+    fs.mkdirSync(target.dir(), { recursive: true, mode: 0o700 });
+    let backupPath;
+    if (existing.raw !== undefined) {
+        backupPath = `${filePath}.bak-${Date.now()}-${process.pid}`;
+        fs.writeFileSync(backupPath, existing.raw, { mode: 0o600 });
+    }
+    const next = { ...existing.parsed, mcpServers: servers };
+    const tmpPath = `${filePath}.tmp-${process.pid}`;
+    fs.writeFileSync(tmpPath, JSON.stringify(next, null, 2) + '\n', { mode: 0o600 });
+    try {
+        fs.renameSync(tmpPath, filePath);
+    }
+    catch (e) {
+        fs.rmSync(tmpPath, { force: true });
+        throw e;
+    }
+    return { status: 'written', backupPath };
+}
+/** Merges only the target's key; skips unreadable/corrupt files rather than clobber. */
+export function writeMcpConfig(target, mcpUrl, apiKey) {
+    const existing = readExisting(target);
+    if ('error' in existing)
+        return { status: 'corrupt_skip', error: existing.error };
+    const servers = isPlainRecord(existing.parsed.mcpServers)
+        ? { ...existing.parsed.mcpServers }
+        : {};
+    const nextEntry = buildTinyfishServerEntry(mcpUrl, apiKey);
+    if (JSON.stringify(servers[target.serverKey]) === JSON.stringify(nextEntry)) {
+        return { status: 'unchanged' };
+    }
+    const repaired = target.serverKey in servers;
+    servers[target.serverKey] = nextEntry;
+    return { ...commitServers(target, existing, servers), repaired };
+}
+/** Removes only the target's key. */
+export function removeServer(target) {
+    const existing = readExisting(target);
+    if ('error' in existing)
+        return { status: 'corrupt_skip', error: existing.error };
+    if (existing.raw === undefined)
+        return { status: 'unchanged' };
+    const servers = isPlainRecord(existing.parsed.mcpServers)
+        ? { ...existing.parsed.mcpServers }
+        : {};
+    if (!(target.serverKey in servers))
+        return { status: 'unchanged' };
+    delete servers[target.serverKey];
+    return commitServers(target, existing, servers);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiny-fish/cli",
-  "version": "0.37.1-next.298",
+  "version": "0.37.1-next.300",
   "description": "TinyFish CLI — run web automations from your terminal",
   "type": "module",
   "bin": {