@tiny-fish/cli 0.37.1-next.300 → 0.37.1-next.302

package/README.md

@@ -19,7 +19,7 @@ npx -y @tiny-fish/cli@latest connect
 ```
 
 It detects the agent configs on your machine (Claude Code, Codex, Cursor, Grok, Hermes,
-OpenClaw, OpenCode) and opens a checklist with everything pre-selected. Press enter to connect
+omp, OpenClaw, OpenCode) and opens a checklist with everything pre-selected. Press enter to connect
 them all, or use the arrow keys and space to narrow the set first; `q` cancels without touching
 anything. Terminals without raw-key support get a numbered prompt instead.
 

package/dist/commands/auth.js

@@ -128,7 +128,10 @@ export function registerAuth(program) {
         // Read from stdin pipe (CI/CD) or hidden TTY prompt (interactive)
         const key = await readKeyFromStdinOrPrompt();
         if (!key) {
-            err('API key cannot be empty');
+            // `echo $KEY | tinyfish auth set` with KEY unset pipes a blank line, not a key.
+            err(process.stdin.isTTY
+                ? 'API key cannot be empty'
+                : "No key received on stdin. Example: echo 'sk-tinyfish-...' | tinyfish auth set");
             process.exit(1);
         }
         if (!validateKeyFormat(key)) {

package/dist/commands/connect.js

@@ -1,6 +1,6 @@
 import spawn from 'cross-spawn';
 import { CONNECT_SOURCE, persistApiKeyToEnvironment, saveConnectContext, validateKeyFormat, validatedApiKey, } from '../lib/auth.js';
-import { CURSOR_SKILL_TARGET, OPENCLAW, OPENCLAW_SKILL_INSTALL_ARGS, NATIVE_BY_HARNESS, launchNativeMcpClient, launchOpenClawWalkthrough, openExternalUrl, } from '../lib/connect-clients.js';
+import { CURSOR_SKILL_TARGET, OPENCLAW, OPENCLAW_SKILL_INSTALL_ARGS, NATIVE_BY_HARNESS, launchNativeMcpClient, launchOmpWalkthrough, launchOpenClawWalkthrough, openExternalUrl, } from '../lib/connect-clients.js';
 import { captureStdio, capturedOutput, HoistedFailureReportedError, installTinyFishCli, replay, SKILL_INSTALL_TIMEOUT_MS, STEP_MAX_BUFFER, } from '../lib/cli-install.js';
 import { ensureCliAuthenticated } from '../lib/connect-auth.js';
 import { createStdinPrompt, runCliFallback } from '../lib/connect-fallback.js';
@@ -8,6 +8,7 @@ import { installWebSkill } from '../lib/skill-install.js';
 import { ConnectInterruptedError, ConnectStepError, createConnectTelemetry, finishSetupCommand, requireCommandSupport, runGuarded, settle, SignInTimeoutError, spawnStepError, stageDurationOf, withStageDuration, spawnRemoval, } from '../lib/connect-runtime.js';
 import { cursorInstallDeeplink, cursorMcpPath, readCursorTinyfishEntry, writeCursorMcpConfig, } from '../lib/cursor-config.js';
 import { runConnectAll } from '../lib/connect-all.js';
+import { ompMcpPath, readOmpTinyfishEntry, writeOmpMcpConfig } from '../lib/omp-config.js';
 import { ALL_HARNESSES, AuthMode, HARNESS_DISPLAY_NAMES, RELOAD_ACTION, } from '../lib/harness-detect.js';
 import { detectHumanInitiated } from '../lib/harness.js';
 import { TINYFISH_API_KEY_VAR } from '../lib/constants.js';
@@ -16,6 +17,7 @@ import { SIGN_IN_PROBES } from '../lib/registration-detect.js';
 import { errLine, warnLine } from '../lib/output.js';
 import { z } from 'zod';
 import { verifyMcpAuth } from '../lib/verify.js';
+import { gateApiKey } from '../lib/connect-preflight.js';
 import { apiBaseFromMcpUrl, DEFAULT_MCP_URL } from '../lib/mcp-endpoint.js';
 function removeExistingRegistration(client, removal, verbose) {
     const result = spawnRemoval(client.command, removal.args);
@@ -506,6 +508,9 @@ export async function connectOpenClaw(options) {
         }
     });
 }
+// Only interactive omp wires the OAuth handler; headless cannot sign in.
+const OMP_KEYLESS_COPY = 'TinyFish is configured in omp. Open omp and sign in to TinyFish when prompted, or run ' +
+    '`/mcp reauth tinyfish` there.';
 const CONFIG_FILE_HARNESSES = {
     cursor: {
         skillTarget: CURSOR_SKILL_TARGET,
@@ -521,6 +526,22 @@ const CONFIG_FILE_HARNESSES = {
             reload: 'TinyFish is connected. Reload the Cursor window, then approve/sign in under Settings → MCP.',
         },
     },
+    omp: {
+        // No skill exists for omp; installWebSkill returns without one.
+        skillTarget: { displayName: HARNESS_DISPLAY_NAMES.omp },
+        registeredUrl: () => readOmpTinyfishEntry()?.url,
+        write: writeOmpMcpConfig,
+        configPath: ompMcpPath,
+        // No install deeplink exists; the keyless copy carries the sign-in.
+        tryLaunch: () => false,
+        copy: {
+            verified: "TinyFish is connected and verified (health+auth). Restart omp and it's live.",
+            authFailed: (reason) => `TinyFish is configured, but the authenticated check failed (${reason}). ` +
+                'Fix: rotate/re-enter your key with `tinyfish auth login`, then re-run: tinyfish connect omp',
+            launched: OMP_KEYLESS_COPY,
+            reload: OMP_KEYLESS_COPY,
+        },
+    },
 };
 /** Writes the harness's MCP config file itself; no `mcp add` exists. */
 async function connectConfigFileHarness(harness, options) {
@@ -628,6 +649,7 @@ function launchCursorDeeplink(mcpUrl) {
 }
 /** Total over the non-native harnesses: a new one fails to compile until wired here. */
 const LAUNCH_OVERRIDES = {
+    omp: launchOmpWalkthrough,
     openclaw: launchOpenClawWalkthrough,
     // Cursor has no chat CLI to launch.
     cursor: () => {
@@ -654,6 +676,20 @@ const CONNECTOR_OVERRIDES = {
         }
         return undefined;
     },
+    omp: async (options) => {
+        await connectConfigFileHarness('omp', options);
+        if (options.launch) {
+            try {
+                await launchOmpWalkthrough();
+            }
+            catch (error) {
+                // Post-settle, like the native walkthrough step: never fail the connect.
+                errLine(error instanceof Error ? error.message : String(error));
+                errLine(finishSetupHint('omp'));
+            }
+        }
+        return undefined;
+    },
 };
 function requireNative(harness) {
     const client = NATIVE_BY_HARNESS.get(harness);
@@ -746,13 +782,24 @@ async function connectSingleClient(client, options, mcpUrl, attemptId) {
     if (!ALL_HARNESSES.includes(client)) {
         throw new Error('Unsupported client: ' + client + '. Supported clients: ' + ALL_HARNESSES.join(', '));
     }
+    const gate = await gateApiKey({
+        apiKey: options.apiKey,
+        mcpUrl,
+        retryCommand: `tinyfish connect ${client}`,
+        mode: 'single',
+        attemptId,
+    });
+    if (gate === 'blocked') {
+        process.exitCode = 1;
+        return;
+    }
     await connectHarness(client, connectOptions);
 }
 export function registerConnect(program) {
     program
         .command('connect')
         .description('Connect TinyFish to an AI agent')
-        .argument('[client]', 'Agent client to connect (claude-code, codex, cursor, grok, hermes, openclaw, or opencode); omit to pick from the agents detected on this machine')
+        .argument('[client]', 'Agent client to connect (claude-code, codex, cursor, grok, hermes, omp, openclaw, or opencode); omit to pick from the agents detected on this machine')
         .option('--all', 'Detect and connect every supported harness found on this machine')
         .option('--dry-run', 'Print planned writes per harness without touching anything (--all only)')
         .option('--uninstall', 'Remove TinyFish entries written by connect --all')

package/dist/commands/doctor.d.ts

@@ -1,17 +1,4 @@
 import type { Command } from 'commander';
-import { type DoctorRepair, type DoctorReport } from '../lib/doctor-report.js';
-import { type Harness } from '../lib/harness-detect.js';
-export interface DoctorOptions {
-    mcpUrl: string;
-    harness?: Harness;
-    fix?: boolean;
-    yes?: boolean;
-}
+import { type DoctorOptions, type DoctorReport } from '../lib/doctor-report.js';
 export declare function runDoctor(options: DoctorOptions): Promise<DoctorReport>;
-export interface RepairOutcome {
-    repair: DoctorRepair;
-    status: 'repaired' | 'skipped' | 'failed';
-    reason?: string;
-}
-export declare function applyRepairs(repairs: DoctorRepair[], options: DoctorOptions): Promise<RepairOutcome[]>;
 export declare function registerDoctor(program: Command): void;

package/dist/commands/doctor.js

@@ -1,17 +1,16 @@
-import spawn from 'cross-spawn';
 import { apiKeyStatus } from '../lib/auth.js';
 import { CLI_VERSION } from '../lib/constants.js';
 import { DOCTOR_COULD_NOT_RUN, DOCTOR_INVALID_INPUT, DOCTOR_SCHEMA_VERSION, doctorReportSchema, exitCodeFor, renderPretty, verdictFor, } from '../lib/doctor-report.js';
+import { applyRepairs, repairsFor } from '../lib/doctor-repairs.js';
+import { couldNotRunPayload, telemetryKey, telemetryPayload } from '../lib/doctor-telemetry.js';
 import { ALL_HARNESSES, AuthMode, Registered } from '../lib/harness-detect.js';
-import { detectHumanInitiated } from '../lib/harness.js';
 import { err, errLine, out, outLine } from '../lib/output.js';
 import { detectRegistrations } from '../lib/registration-detect.js';
-import { doctorErrorClass, sendDoctorCompleted, } from '../lib/setup-telemetry.js';
+import { sendDoctorCompleted } from '../lib/setup-telemetry.js';
 import { verifyMcpAuth, verifyMcpHealth } from '../lib/verify.js';
 import { resolveHermesHome } from '../lib/hermes-env.js';
 import { hermesWebBackendsOurs, readHermesPluginStatus, } from '../lib/hermes-plugin.js';
 import { DEFAULT_MCP_URL, endpointOf, isDefaultEndpoint } from '../lib/mcp-endpoint.js';
-import { connectHarness } from './connect.js';
 // A green auth mode with a red auth call proves nothing, so the call's verdict gates the claim.
 function provesHarnessReach(status, keyAuth, healthOk, mcpUrl) {
     // An endpoint doctor could not reach proves nothing about a harness pointed at it.
@@ -270,57 +269,6 @@ function checkHermesPlugin(status) {
     }
     return { ...check, ...hermesPluginVerdict(home) };
 }
-// Only Cursor's repair is a pure local file write; every other one needs a browser sign-in.
-const UNATTENDED_SAFE = new Set(['cursor']);
-function repairsFor(checks, statuses) {
-    const repairs = [];
-    // A revoked-but-well-formed key passes the credential check and fails the call; both need login.
-    const credentialBroken = checks.some((c) => (c.id === 'cli-credential' || c.id === 'cli-auth-call') && c.status === 'fail');
-    // connect writes the stored key, so replace a dead one first.
-    if (credentialBroken) {
-        repairs.push({
-            for: 'cli-credential-invalid',
-            action: 'auth-login',
-            harness: null,
-            command: 'tinyfish auth login',
-            unattended_safe: false,
-        });
-    }
-    const authCallPassed = checks.some((c) => c.id === 'cli-auth-call' && c.status === 'pass');
-    for (const status of statuses) {
-        // `unknown` earns nothing: connect would contradict the check's detail.
-        // A registered entry that still fails earns one too.
-        // `connected: false` is the harness's own no; it only warns, so it earns a repair here.
-        const brokenRegistration = status.connected === false ||
-            checks.some((c) => c.harness === status.harness && c.id !== 'hermes-plugin' && c.status === 'fail');
-        if (!status.detected || (status.registered !== Registered.No && !brokenRegistration))
-            continue;
-        repairs.push({
-            for: status.registered === Registered.Yes
-                ? `${status.harness}-registration-broken`
-                : status.connectedBefore
-                    ? `${status.harness}-registration-lost`
-                    : `${status.harness}-not-connected`,
-            action: 'connect',
-            harness: status.harness,
-            command: `tinyfish connect ${status.harness}`,
-            // A dead well-formed key passes the format check.
-            unattended_safe: UNATTENDED_SAFE.has(status.harness) && authCallPassed,
-        });
-    }
-    // connect hermes reinstalls the plugin; a second row would double it.
-    const pluginBroken = checks.some((c) => c.id === 'hermes-plugin' && c.status === 'fail');
-    if (pluginBroken && !repairs.some((repair) => repair.harness === 'hermes')) {
-        repairs.push({
-            for: 'hermes-plugin-broken',
-            action: 'connect',
-            harness: 'hermes',
-            command: 'tinyfish connect hermes',
-            unattended_safe: false,
-        });
-    }
-    return repairs;
-}
 export async function runDoctor(options) {
     const statuses = detectRegistrations(options.harness ? [options.harness] : undefined);
     const credential = checkCredential();
@@ -359,124 +307,6 @@ export async function runDoctor(options) {
     // Nothing to scrub: every string above is authored here or enumerated at its source.
     return doctorReportSchema.parse(body);
 }
-// Shell out rather than import the login flow: `auth login` owns its own browser and prompts.
-// Re-invoke this same entry script, never a global `tinyfish` — under `npx` there is no such
-// binary on PATH, and npx is the install-nothing path doctor exists to serve.
-function runAuthLogin() {
-    const entry = process.argv[1];
-    if (!entry)
-        throw new Error('Could not locate the TinyFish CLI entry point to re-invoke');
-    const result = spawn.sync(process.execPath, [entry, 'auth', 'login', '--source', 'doctor'], {
-        stdio: 'inherit',
-    });
-    if (result.error)
-        throw new Error('Could not run `tinyfish auth login`', { cause: result.error });
-    if (result.status !== 0) {
-        throw new Error(`\`tinyfish auth login\` exited ${result.status ?? 'unknown'}`);
-    }
-}
-/** Dispatches on `action`, never on a null harness: that conflation made the credential fix a no-op. */
-async function runRepair(repair, mcpUrl) {
-    if (repair.action === 'auth-login')
-        return runAuthLogin();
-    if (repair.harness)
-        await connectHarness(repair.harness, { mcpUrl, launch: false });
-}
-export async function applyRepairs(repairs, options) {
-    const interactive = detectHumanInitiated();
-    const outcomes = [];
-    for (const repair of repairs) {
-        if (!interactive && !options.yes) {
-            outcomes.push({
-                repair,
-                status: 'skipped',
-                reason: 'no terminal; re-run with --yes to repair unattended',
-            });
-            continue;
-        }
-        if (!interactive && !repair.unattended_safe) {
-            outcomes.push({
-                repair,
-                status: 'skipped',
-                reason: 'needs a browser sign-in, which has no unattended path',
-            });
-            continue;
-        }
-        try {
-            await runRepair(repair, options.mcpUrl);
-            outcomes.push({ repair, status: 'repaired' });
-        }
-        catch (e) {
-            // Connect quotes absolute config paths in its errors, so the raw text stays behind
-            // --debug and the user is told where to find it rather than handed a generic dead end.
-            if (process.env['TINYFISH_DEBUG']) {
-                errLine(e instanceof Error ? (e.stack ?? e.message) : String(e));
-            }
-            outcomes.push({
-                repair,
-                status: 'failed',
-                reason: `\`${repair.command}\` failed; re-run it directly, or --debug for the raw error`,
-            });
-        }
-    }
-    return outcomes;
-}
-/** Mirrors the route's cap; over it the payload would 400 and never be retried. */
-const MAX_DURATION_MS = 3_600_000;
-function fixModeOf(options) {
-    return !options.fix ? 'none' : options.yes ? 'fix_yes' : 'fix';
-}
-/** Enumerated fields only; check `detail` text never leaves the machine. */
-function telemetryPayload(report, offered, outcomes, options, durationMs) {
-    const count = (status) => report.checks.filter((check) => check.status === status).length;
-    const failed = report.checks.filter((check) => check.status === 'fail');
-    return {
-        outcome: 'completed',
-        schema_version: report.schema_version,
-        cli_version: report.cli_version,
-        ok_harnesses: report.ok_harnesses,
-        ok_cli: report.ok_cli,
-        checks_pass: count('pass'),
-        checks_fail: count('fail'),
-        checks_warn: count('warn'),
-        checks_skip: count('skip'),
-        // From the pre-repair report; the verdicts above describe the machine after it.
-        repairs_offered: offered.length,
-        repair_actions: [...new Set(offered.map((repair) => repair.action))],
-        repairs_attempted: outcomes.filter((outcome) => outcome.status !== 'skipped').length,
-        repairs_succeeded: outcomes.filter((outcome) => outcome.status === 'repaired').length,
-        fix_mode: fixModeOf(options),
-        // --harness scopes detection, so the counts above cover that harness alone.
-        harness_scope: options.harness ?? 'all',
-        // Same signal cli_connect_stage carries, so agent and human doctor runs split.
-        is_human_initiated: detectHumanInitiated(),
-        // Two flat arrays rather than one of pairs: PostHog groups by element, not by field.
-        failed_check_ids: [...new Set(failed.map((check) => check.id))],
-        failed_harnesses: [...new Set(failed.map((check) => check.harness).filter((h) => h !== null))],
-        harnesses: report.harnesses,
-        // Clamped, not validated: a --fix parked at a prompt must not fail the parse and drop the run.
-        duration_ms: Math.min(durationMs, MAX_DURATION_MS),
-    };
-}
-/** Both paths send keyless when there is no key; the route records those anonymously. */
-function telemetryKey() {
-    const resolved = apiKeyStatus();
-    return 'key' in resolved ? resolved.key : undefined;
-}
-/** Enumerated outcome and timing only; the raw error stays behind --debug. */
-function couldNotRunPayload(error, options, durationMs) {
-    return {
-        outcome: 'could_not_run',
-        error_class: doctorErrorClass(error),
-        schema_version: DOCTOR_SCHEMA_VERSION,
-        cli_version: CLI_VERSION,
-        fix_mode: fixModeOf(options),
-        harness_scope: options.harness ?? 'all',
-        is_human_initiated: detectHumanInitiated(),
-        // Clamped like the completed row: over the cap the payload would 400 un-retried.
-        duration_ms: Math.min(durationMs, MAX_DURATION_MS),
-    };
-}
 export function registerDoctor(program) {
     program
         .command('doctor')

package/dist/lib/auth.d.ts

@@ -1,5 +1,6 @@
 export { DASHBOARD_URL, getDashboardUrl } from './constants.js';
 export declare function configDir(): string;
+export declare function configFile(): string;
 /** Install channel baked onto connect context; the connect flow is always CLI-driven. */
 export declare const CONNECT_SOURCE = "tinyfish_cli";
 export declare const CONNECT_ATTEMPT_ENV = "TINYFISH_CONNECT_ATTEMPT_ID";
@@ -65,5 +66,5 @@ export declare function validatedApiKey(explicitApiKey?: string): string | undef
  * The diagnosis, not the key: doctor must report a bad credential and say where it came from
  * rather than exit like getApiKey does.
  */
-export declare function apiKeyStatus(): ResolvedKey | UnresolvedKey;
+export declare function apiKeyStatus(explicitApiKey?: string): ResolvedKey | UnresolvedKey;
 export declare function getApiKey(): string;

package/dist/lib/auth.js

@@ -11,7 +11,7 @@ export function configDir() {
     // os.homedir() is cross-platform; process.env.HOME is undefined on Windows
     return path.join(os.homedir(), '.tinyfish');
 }
-function configFile() {
+export function configFile() {
     return path.join(configDir(), 'config.json');
 }
 /** Install channel baked onto connect context; the connect flow is always CLI-driven. */
@@ -283,8 +283,8 @@ export function validatedApiKey(explicitApiKey) {
  * The diagnosis, not the key: doctor must report a bad credential and say where it came from
  * rather than exit like getApiKey does.
  */
-export function apiKeyStatus() {
-    const { value, source } = lookupApiKey();
+export function apiKeyStatus(explicitApiKey) {
+    const { value, source } = lookupApiKey(explicitApiKey);
     if (!value || source === 'none') {
         return { error: 'No API key found. Run: tinyfish auth login', source: 'none' };
     }

package/dist/lib/connect-all-uninstall.js

@@ -2,6 +2,7 @@ import { clearConnectContext, connectContextState } from './auth.js';
 import { NATIVE_BY_HARNESS, openclawSkillUninstall } from './connect-clients.js';
 import { ConnectInterruptedError, spawnRemoval } from './connect-runtime.js';
 import { removeCursorMcpServer, planCursorWrite } from './cursor-config.js';
+import { planOmpWrite, removeOmpMcpServer } from './omp-config.js';
 import { HERMES_KEY_VAR, hermesEnvPath, removeHermesKey, resolveHermesHome } from './hermes-env.js';
 import { clearHermesWebBackends, HERMES_PLUGIN_SHA } from './hermes-plugin.js';
 import { HARNESS_DISPLAY_NAMES as DISPLAY_NAMES } from './harness-detect.js';
@@ -11,6 +12,8 @@ const OPENCODE_UNINSTALL_POINTER = 'remove the tinyfish entry from ~/.config/ope
 export function planText(harness, mcpUrl, apiKey) {
     if (harness === 'cursor')
         return planCursorWrite(mcpUrl, apiKey);
+    if (harness === 'omp')
+        return planOmpWrite(mcpUrl, apiKey);
     // Only the keyed path seeds the .env; a keyless Hermes install writes nothing.
     if (harness === 'hermes' && apiKey) {
         return (`would run \`tinyfish connect hermes\` (harness-owned MCP write; the CLI writes ` +
@@ -23,6 +26,9 @@ export function uninstallPlanText(harness) {
     if (harness === 'cursor') {
         return 'would remove the tinyfish entry from ~/.cursor/mcp.json';
     }
+    if (harness === 'omp') {
+        return "would remove the tinyfish entry from omp's mcp.json (located via `omp config path`)";
+    }
     if (!uninstallRuns(harness)) {
         return `would print \`${uninstallPointer(harness)}\` (no removal command exists)`;
     }
@@ -170,10 +176,21 @@ function uninstallViaCommands(detection, verbose, binaryOnPath) {
         fixCommand: `Retry by hand: ${uninstallPointer(harness)}`,
     };
 }
-function uninstallCursor(detection) {
+/** The CLI wrote these mcp.json entries, so it removes them. */
+const MCP_JSON_UNINSTALLS = {
+    cursor: {
+        remove: removeCursorMcpServer,
+        fix: 'Fix ~/.cursor/mcp.json by hand, then re-run: tinyfish connect --all --uninstall',
+    },
+    omp: {
+        remove: removeOmpMcpServer,
+        fix: "Fix omp's mcp.json (at `omp config path`) by hand, then re-run: tinyfish connect --all --uninstall",
+    },
+};
+function uninstallMcpJson(detection, spec) {
     let result;
     try {
-        result = removeCursorMcpServer();
+        result = spec.remove();
     }
     catch (e) {
         result = { status: 'corrupt_skip', error: e instanceof Error ? e.message : String(e) };
@@ -183,20 +200,21 @@ function uninstallCursor(detection) {
             ...detection,
             outcome: 'uninstalled',
             removalFailed: true,
-            errorMessage: `could not update Cursor's mcp.json (${result.error}) — nothing removed.`,
-            fixCommand: 'Fix ~/.cursor/mcp.json by hand, then re-run: tinyfish connect --all --uninstall',
+            errorMessage: `could not update ${DISPLAY_NAMES[detection.harness]}'s mcp.json (${result.error}) — nothing removed.`,
+            fixCommand: spec.fix,
         };
     }
     if (result.status === 'unchanged') {
         return { ...detection, outcome: 'uninstall_noop' };
     }
-    clearConnectContext('cursor');
+    clearConnectContext(detection.harness);
     return { ...detection, outcome: 'uninstalled' };
 }
 export function uninstallHarness(harness, configPath, verbose, binaryOnPath) {
     const detection = { harness, detected: true, configPath, installed: false };
-    const result = harness === 'cursor'
-        ? uninstallCursor(detection)
+    const mcpJson = MCP_JSON_UNINSTALLS[harness];
+    const result = mcpJson
+        ? uninstallMcpJson(detection, mcpJson)
         : uninstallViaCommands(detection, verbose, binaryOnPath);
     if (harness !== 'hermes')
         return result;

package/dist/lib/connect-all.js

@@ -9,6 +9,7 @@ import { actionable, computeExitCode, reloadHint, renderSummary } from './connec
 import { planText, uninstallHarness, uninstallPlanText } from './connect-all-uninstall.js';
 import { NATIVE_BY_HARNESS } from './connect-clients.js';
 import { createStdinPrompt, runCliFallback } from './connect-fallback.js';
+import { gateApiKey } from './connect-preflight.js';
 import { ConnectInterruptedError } from './connect-runtime.js';
 import { pickHarnesses } from './connect-picker.js';
 import { commandOnPath, detectInstalledHarnesses, HARNESS_COMMANDS, HARNESS_DISPLAY_NAMES as DISPLAY_NAMES, ALL_HARNESSES, } from './harness-detect.js';
@@ -142,7 +143,10 @@ function noWorkOutcome(d, uninstall) {
 }
 /** A config-writing connect needs no binary; every other harness spawns one. */
 function isStaleConfig(detection) {
-    return (detection.detected && !detection.binaryOnPath && !harnessSpec(detection.harness).cliWritesConfig);
+    const spec = harnessSpec(detection.harness);
+    // Cursor's IDE reads mcp.json binary-less; omp's path needs the binary.
+    const binaryless = spec.cliWritesConfig && !spec.configPathFromBinary;
+    return detection.detected && !detection.binaryOnPath && !binaryless;
 }
 async function resolvePick(detections, opts, prompt) {
     let deselected = new Set();
@@ -212,8 +216,13 @@ async function connectLoop(detections, opts, deselected, io) {
         try {
             setErrIndent(STEP_INDENT);
             result = await processHarness(detection, opts, io.prompt, oauthBudget, io.takeHoistedCli, (line) => io.outro.add(line));
+            // A failed harness prints nothing of its own, so its step reads as skipped.
+            if (result.outcome === 'failed' && result.errorMessage)
+                errLine(result.errorMessage);
         }
         catch (e) {
+            const errorMessage = e instanceof Error ? e.message : String(e);
+            errLine(errorMessage);
             // Isolation: one harness throwing never stops the others.
             result = {
                 harness,
@@ -221,7 +230,7 @@ async function connectLoop(detections, opts, deselected, io) {
                 configPath: detection.configPath,
                 installed: false,
                 outcome: 'failed',
-                errorMessage: e instanceof Error ? e.message : String(e),
+                errorMessage,
                 fixCommand: `tinyfish connect ${harness}`,
             };
         }
@@ -295,11 +304,32 @@ async function finishRun(results, opts, isTTY) {
     }
     return exitCode;
 }
+/** Neither path needs a live key, and neither writes a registration. */
+function keyGateApplies(opts) {
+    return !opts.uninstall && !opts.dryRun;
+}
+async function blockedByKeyGate(opts) {
+    if (!keyGateApplies(opts))
+        return false;
+    const pick = opts.pick === true;
+    const gate = await gateApiKey({
+        apiKey: opts.apiKey,
+        mcpUrl: opts.mcpUrl,
+        // The picker path is reached by a bare `tinyfish connect`.
+        retryCommand: pick ? 'tinyfish connect' : 'tinyfish connect --all',
+        mode: pick ? 'pick' : 'all',
+        attemptId: opts.attemptId,
+    });
+    return gate === 'blocked';
+}
 export async function runConnectAll(opts) {
     const isTTY = detectHumanInitiated();
+    // Above the setup event and every write: a blocked run is not a setup attempt.
+    if (await blockedByKeyGate(opts))
+        return 1;
     // Ahead of detection and the hoisted install; either can end the process silently.
     // Not on the picker path: an explicit cancel is not a setup.
-    if (!opts.uninstall && !opts.dryRun && !opts.pick) {
+    if (keyGateApplies(opts) && !opts.pick) {
         // validatedApiKey falls back to env/config; opts.apiKey alone splits the run's two ends.
         await sendSetupStarted(opts.mcpUrl, opts.attemptId, validatedApiKey(opts.apiKey));
     }
@@ -377,6 +407,7 @@ export const FIRST_TASK_PROMPT = 'My TinyFish setup just finished — verify it
 const LAUNCHERS = [
     { harness: 'cursor', args: [FIRST_TASK_PROMPT] },
     { harness: 'claude-code', args: [FIRST_TASK_PROMPT] },
+    { harness: 'omp', args: [FIRST_TASK_PROMPT] },
 ];
 async function launchFirstTask(results) {
     const candidates = LAUNCHERS.filter((l) => results.some((r) => r.harness === l.harness && r.installed) &&

package/dist/lib/connect-clients.d.ts

@@ -95,11 +95,12 @@ export declare function hermesRegistrationEnabled(home: string): {
 };
 export declare const NATIVE_MCP_CLIENTS: readonly NativeMcpClient[];
 /** Native descriptor by harness id; Cursor and OpenClaw have none. */
-export declare const NATIVE_BY_HARNESS: Map<"openclaw" | "grok" | "cursor" | "codex" | "hermes" | "opencode" | "claude-code", NativeMcpClient>;
+export declare const NATIVE_BY_HARNESS: Map<"openclaw" | "omp" | "grok" | "cursor" | "codex" | "hermes" | "opencode" | "claude-code", NativeMcpClient>;
 export declare const OPENCLAW: SupportedCommand;
 /** "printed" = handed to the user to paste; the walkthrough was never started for them. */
 export type WalkthroughOutcome = 'launched' | 'printed';
 /** Awaited before the handover; track+flush must land pre-block. */
 type OnWalkthroughDecided = (outcome: WalkthroughOutcome) => void | Promise<void>;
 export declare function launchNativeMcpClient(client: NativeMcpClient, onDecided?: OnWalkthroughDecided): Promise<WalkthroughOutcome>;
+export declare function launchOmpWalkthrough(onDecided?: OnWalkthroughDecided): Promise<WalkthroughOutcome>;
 export declare function launchOpenClawWalkthrough(onDecided?: OnWalkthroughDecided): Promise<WalkthroughOutcome>;

package/dist/lib/connect-clients.js

@@ -293,6 +293,10 @@ export async function launchNativeMcpClient(client, onDecided) {
         ? client.launchWalkthrough()
         : handOverTerminal(client.command, [DEFAULT_ONBOARDING_PROMPT], client.displayName), onDecided);
 }
+// Via deliverWalkthrough: handOverTerminal alone would wedge a headless --launch.
+export function launchOmpWalkthrough(onDecided) {
+    return deliverWalkthrough('omp', 'omp', DEFAULT_ONBOARDING_PROMPT, () => handOverTerminal('omp', [DEFAULT_ONBOARDING_PROMPT], 'omp'), onDecided);
+}
 export function launchOpenClawWalkthrough(onDecided) {
     return deliverWalkthrough('OpenClaw', 'openclaw', OPENCLAW_ONBOARDING_PROMPT, () => handOverTerminal('openclaw', ['chat', '--message', OPENCLAW_ONBOARDING_PROMPT], 'OpenClaw'), onDecided);
 }

package/dist/lib/connect-preflight.d.ts

@@ -0,0 +1,15 @@
+import { type SetupBlockedMode } from './setup-telemetry.js';
+export type PreflightOutcome = 'ok' | 'blocked';
+interface PreflightOptions {
+    apiKey?: string;
+    mcpUrl: string;
+    retryCommand: string;
+    mode: SetupBlockedMode;
+    attemptId?: string;
+}
+/**
+ * Checks the key every harness would install with, once, before anything is written.
+ * A bad key otherwise fails all seven installs the slow way, and Hermes refuses outright.
+ */
+export declare function gateApiKey(options: PreflightOptions): Promise<PreflightOutcome>;
+export {};