@tiny-fish/cli 0.37.1-next.300 → 0.37.1-next.302

package/dist/lib/connect-preflight.js

@@ -0,0 +1,67 @@
+import { apiKeyStatus, configFile, validateKeyFormat } from './auth.js';
+import { TINYFISH_API_KEY_VAR } from './constants.js';
+import { apiBaseFromMcpUrl } from './mcp-endpoint.js';
+import { errLine, warnLine } from './output.js';
+import { sendSetupBlocked, } from './setup-telemetry.js';
+import { verifyMcpAuth } from './verify.js';
+function sourceAdvice(source) {
+    switch (source) {
+        case 'env':
+            return `The key came from ${TINYFISH_API_KEY_VAR}, which overrides a saved key — fix or unset that export.`;
+        case 'explicit':
+            return 'The key came from --api-key.';
+        default:
+            return `The key came from ${configFile()}. Save a working one: tinyfish auth login, or pipe a key to tinyfish auth set.`;
+    }
+}
+async function block(detail, options) {
+    errLine(`${detail.message} Nothing was installed.`);
+    errLine(sourceAdvice(detail.source));
+    errLine(`Then re-run: ${options.retryCommand}`);
+    await sendSetupBlocked(options.mcpUrl, {
+        blockReason: detail.reason,
+        keySource: detail.source,
+        ...(detail.status === undefined ? {} : { status: detail.status }),
+        mode: options.mode,
+        attemptId: options.attemptId,
+    }, detail.key);
+    return 'blocked';
+}
+/**
+ * Checks the key every harness would install with, once, before anything is written.
+ * A bad key otherwise fails all seven installs the slow way, and Hermes refuses outright.
+ */
+export async function gateApiKey(options) {
+    const status = apiKeyStatus(options.apiKey);
+    // No key at all is a valid answer: the OAuth harnesses still connect without one.
+    if (status.source === 'none')
+        return 'ok';
+    const source = status.source;
+    if (!('key' in status)) {
+        return block({ reason: 'key_unreadable', source, message: `${status.error}.` }, options);
+    }
+    // Downstream this key is dropped as unusable, which reads as "no key" and silently
+    // downgrades every install to a browser sign-in Hermes cannot take.
+    if (!validateKeyFormat(status.key)) {
+        return block({
+            reason: 'key_malformed',
+            source,
+            message: 'Your TinyFish API key is not shaped like one (expected sk-tinyfish-... or sk-mino-...).',
+        }, options);
+    }
+    const verified = await verifyMcpAuth(status.key, apiBaseFromMcpUrl(options.mcpUrl));
+    if (verified.ok)
+        return 'ok';
+    // No status means the network failed, and an outage must not block a whole setup.
+    if (verified.status === undefined) {
+        warnLine(`Could not check your TinyFish API key (${verified.code ?? 'unknown'}); continuing.`);
+        return 'ok';
+    }
+    return block({
+        reason: 'key_rejected',
+        source,
+        message: `Your TinyFish API key was rejected (${verified.code ?? 'unknown'}).`,
+        key: status.key,
+        status: verified.status,
+    }, options);
+}

package/dist/lib/doctor-repairs.d.ts

@@ -0,0 +1,9 @@
+import type { DoctorCheck, DoctorOptions, DoctorRepair } from './doctor-report.js';
+import type { RegistrationStatus } from './registration-detect.js';
+export declare function repairsFor(checks: DoctorCheck[], statuses: RegistrationStatus[]): DoctorRepair[];
+export interface RepairOutcome {
+    repair: DoctorRepair;
+    status: 'repaired' | 'skipped' | 'failed';
+    reason?: string;
+}
+export declare function applyRepairs(repairs: DoctorRepair[], options: DoctorOptions): Promise<RepairOutcome[]>;

package/dist/lib/doctor-repairs.js

@@ -0,0 +1,119 @@
+import spawn from 'cross-spawn';
+import { connectHarness } from '../commands/connect.js';
+import { ALL_HARNESSES, Registered } from './harness-detect.js';
+import { harnessSpec } from './harness-spec.js';
+import { detectHumanInitiated } from './harness.js';
+import { errLine } from './output.js';
+// Config-file repairs are local writes; the rest need browser sign-in.
+const UNATTENDED_SAFE = new Set(ALL_HARNESSES.filter((harness) => harnessSpec(harness).cliWritesConfig));
+export function repairsFor(checks, statuses) {
+    const repairs = [];
+    // A revoked-but-well-formed key passes the credential check and fails the call; both need login.
+    const credentialBroken = checks.some((c) => (c.id === 'cli-credential' || c.id === 'cli-auth-call') && c.status === 'fail');
+    // connect writes the stored key, so replace a dead one first.
+    if (credentialBroken) {
+        repairs.push({
+            for: 'cli-credential-invalid',
+            action: 'auth-login',
+            harness: null,
+            command: 'tinyfish auth login',
+            unattended_safe: false,
+        });
+    }
+    const authCallPassed = checks.some((c) => c.id === 'cli-auth-call' && c.status === 'pass');
+    for (const status of statuses) {
+        // `unknown` earns nothing: connect would contradict the check's detail.
+        // A registered entry that still fails earns one too.
+        // `connected: false` is the harness's own no; it only warns, so it earns a repair here.
+        const brokenRegistration = status.connected === false ||
+            checks.some((c) => c.harness === status.harness && c.id !== 'hermes-plugin' && c.status === 'fail');
+        if (!status.detected || (status.registered !== Registered.No && !brokenRegistration))
+            continue;
+        repairs.push({
+            for: status.registered === Registered.Yes
+                ? `${status.harness}-registration-broken`
+                : status.connectedBefore
+                    ? `${status.harness}-registration-lost`
+                    : `${status.harness}-not-connected`,
+            action: 'connect',
+            harness: status.harness,
+            command: `tinyfish connect ${status.harness}`,
+            // A dead well-formed key passes the format check.
+            unattended_safe: UNATTENDED_SAFE.has(status.harness) && authCallPassed,
+        });
+    }
+    // connect hermes reinstalls the plugin; a second row would double it.
+    const pluginBroken = checks.some((c) => c.id === 'hermes-plugin' && c.status === 'fail');
+    if (pluginBroken && !repairs.some((repair) => repair.harness === 'hermes')) {
+        repairs.push({
+            for: 'hermes-plugin-broken',
+            action: 'connect',
+            harness: 'hermes',
+            command: 'tinyfish connect hermes',
+            unattended_safe: false,
+        });
+    }
+    return repairs;
+}
+// Shell out rather than import the login flow: `auth login` owns its own browser and prompts.
+// Re-invoke this same entry script, never a global `tinyfish` — under `npx` there is no such
+// binary on PATH, and npx is the install-nothing path doctor exists to serve.
+function runAuthLogin() {
+    const entry = process.argv[1];
+    if (!entry)
+        throw new Error('Could not locate the TinyFish CLI entry point to re-invoke');
+    const result = spawn.sync(process.execPath, [entry, 'auth', 'login', '--source', 'doctor'], {
+        stdio: 'inherit',
+    });
+    if (result.error)
+        throw new Error('Could not run `tinyfish auth login`', { cause: result.error });
+    if (result.status !== 0) {
+        throw new Error(`\`tinyfish auth login\` exited ${result.status ?? 'unknown'}`);
+    }
+}
+/** Dispatches on `action`, never on a null harness: that conflation made the credential fix a no-op. */
+async function runRepair(repair, mcpUrl) {
+    if (repair.action === 'auth-login')
+        return runAuthLogin();
+    if (repair.harness)
+        await connectHarness(repair.harness, { mcpUrl, launch: false });
+}
+export async function applyRepairs(repairs, options) {
+    const interactive = detectHumanInitiated();
+    const outcomes = [];
+    for (const repair of repairs) {
+        if (!interactive && !options.yes) {
+            outcomes.push({
+                repair,
+                status: 'skipped',
+                reason: 'no terminal; re-run with --yes to repair unattended',
+            });
+            continue;
+        }
+        if (!interactive && !repair.unattended_safe) {
+            outcomes.push({
+                repair,
+                status: 'skipped',
+                reason: 'needs a browser sign-in, which has no unattended path',
+            });
+            continue;
+        }
+        try {
+            await runRepair(repair, options.mcpUrl);
+            outcomes.push({ repair, status: 'repaired' });
+        }
+        catch (e) {
+            // Connect quotes absolute config paths in its errors, so the raw text stays behind
+            // --debug and the user is told where to find it rather than handed a generic dead end.
+            if (process.env['TINYFISH_DEBUG']) {
+                errLine(e instanceof Error ? (e.stack ?? e.message) : String(e));
+            }
+            outcomes.push({
+                repair,
+                status: 'failed',
+                reason: `\`${repair.command}\` failed; re-run it directly, or --debug for the raw error`,
+            });
+        }
+    }
+    return outcomes;
+}

package/dist/lib/doctor-report.d.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { AuthMode, Registered } from './harness-detect.js';
+import { AuthMode, type Harness, Registered } from './harness-detect.js';
 /** Bumped whenever a consumer could misread the payload; the cookbook skill releases separately. */
 export declare const DOCTOR_SCHEMA_VERSION = 3;
 declare const checkStatusSchema: z.ZodEnum<{
@@ -25,6 +25,7 @@ declare const doctorCheckSchema: z.ZodObject<{
     detail: z.ZodString;
     harness: z.ZodNullable<z.ZodEnum<{
         openclaw: "openclaw";
+        omp: "omp";
         grok: "grok";
         cursor: "cursor";
         codex: "codex";
@@ -41,6 +42,7 @@ declare const doctorCheckSchema: z.ZodObject<{
 declare const doctorHarnessSchema: z.ZodObject<{
     harness: z.ZodEnum<{
         openclaw: "openclaw";
+        omp: "omp";
         grok: "grok";
         cursor: "cursor";
         codex: "codex";
@@ -66,6 +68,7 @@ declare const doctorRepairSchema: z.ZodObject<{
     }>;
     harness: z.ZodNullable<z.ZodEnum<{
         openclaw: "openclaw";
+        omp: "omp";
         grok: "grok";
         cursor: "cursor";
         codex: "codex";
@@ -93,6 +96,7 @@ export declare const doctorReportSchema: z.ZodObject<{
         detail: z.ZodString;
         harness: z.ZodNullable<z.ZodEnum<{
             openclaw: "openclaw";
+            omp: "omp";
             grok: "grok";
             cursor: "cursor";
             codex: "codex";
@@ -109,6 +113,7 @@ export declare const doctorReportSchema: z.ZodObject<{
     harnesses: z.ZodArray<z.ZodObject<{
         harness: z.ZodEnum<{
             openclaw: "openclaw";
+            omp: "omp";
             grok: "grok";
             cursor: "cursor";
             codex: "codex";
@@ -134,6 +139,7 @@ export declare const doctorReportSchema: z.ZodObject<{
         }>;
         harness: z.ZodNullable<z.ZodEnum<{
             openclaw: "openclaw";
+            omp: "omp";
             grok: "grok";
             cursor: "cursor";
             codex: "codex";
@@ -151,6 +157,12 @@ export type DoctorCheck = z.infer<typeof doctorCheckSchema>;
 export type DoctorHarness = z.infer<typeof doctorHarnessSchema>;
 export type DoctorRepair = z.infer<typeof doctorRepairSchema>;
 export type DoctorReport = z.infer<typeof doctorReportSchema>;
+export interface DoctorOptions {
+    mcpUrl: string;
+    harness?: Harness;
+    fix?: boolean;
+    yes?: boolean;
+}
 /** Doctor itself broke, which is a different claim from "your setup is broken". */
 export declare const DOCTOR_COULD_NOT_RUN = 2;
 /** The invocation was wrong, not the machine; exit 2 stays "doctor broke". */

package/dist/lib/doctor-telemetry.d.ts

@@ -0,0 +1,9 @@
+import { type DoctorOptions, type DoctorRepair, type DoctorReport } from './doctor-report.js';
+import type { RepairOutcome } from './doctor-repairs.js';
+import { type DoctorCompletedPayload, type DoctorCouldNotRunPayload } from './setup-telemetry.js';
+/** Enumerated fields only; check `detail` text never leaves the machine. */
+export declare function telemetryPayload(report: DoctorReport, offered: DoctorRepair[], outcomes: RepairOutcome[], options: DoctorOptions, durationMs: number): DoctorCompletedPayload;
+/** Both paths send keyless when there is no key; the route records those anonymously. */
+export declare function telemetryKey(): string | undefined;
+/** Enumerated outcome and timing only; the raw error stays behind --debug. */
+export declare function couldNotRunPayload(error: unknown, options: DoctorOptions, durationMs: number): DoctorCouldNotRunPayload;

package/dist/lib/doctor-telemetry.js

@@ -0,0 +1,61 @@
+import { apiKeyStatus } from './auth.js';
+import { CLI_VERSION } from './constants.js';
+import { DOCTOR_SCHEMA_VERSION, } from './doctor-report.js';
+import { detectHumanInitiated } from './harness.js';
+import { doctorErrorClass, } from './setup-telemetry.js';
+/** Mirrors the route's cap; over it the payload would 400 and never be retried. */
+const MAX_DURATION_MS = 3_600_000;
+function fixModeOf(options) {
+    return !options.fix ? 'none' : options.yes ? 'fix_yes' : 'fix';
+}
+/** Enumerated fields only; check `detail` text never leaves the machine. */
+export function telemetryPayload(report, offered, outcomes, options, durationMs) {
+    const count = (status) => report.checks.filter((check) => check.status === status).length;
+    const failed = report.checks.filter((check) => check.status === 'fail');
+    return {
+        outcome: 'completed',
+        schema_version: report.schema_version,
+        cli_version: report.cli_version,
+        ok_harnesses: report.ok_harnesses,
+        ok_cli: report.ok_cli,
+        checks_pass: count('pass'),
+        checks_fail: count('fail'),
+        checks_warn: count('warn'),
+        checks_skip: count('skip'),
+        // From the pre-repair report; the verdicts above describe the machine after it.
+        repairs_offered: offered.length,
+        repair_actions: [...new Set(offered.map((repair) => repair.action))],
+        repairs_attempted: outcomes.filter((outcome) => outcome.status !== 'skipped').length,
+        repairs_succeeded: outcomes.filter((outcome) => outcome.status === 'repaired').length,
+        fix_mode: fixModeOf(options),
+        // --harness scopes detection, so the counts above cover that harness alone.
+        harness_scope: options.harness ?? 'all',
+        // Same signal cli_connect_stage carries, so agent and human doctor runs split.
+        is_human_initiated: detectHumanInitiated(),
+        // Two flat arrays rather than one of pairs: PostHog groups by element, not by field.
+        failed_check_ids: [...new Set(failed.map((check) => check.id))],
+        failed_harnesses: [...new Set(failed.map((check) => check.harness).filter((h) => h !== null))],
+        harnesses: report.harnesses,
+        // Clamped, not validated: a --fix parked at a prompt must not fail the parse and drop the run.
+        duration_ms: Math.min(durationMs, MAX_DURATION_MS),
+    };
+}
+/** Both paths send keyless when there is no key; the route records those anonymously. */
+export function telemetryKey() {
+    const resolved = apiKeyStatus();
+    return 'key' in resolved ? resolved.key : undefined;
+}
+/** Enumerated outcome and timing only; the raw error stays behind --debug. */
+export function couldNotRunPayload(error, options, durationMs) {
+    return {
+        outcome: 'could_not_run',
+        error_class: doctorErrorClass(error),
+        schema_version: DOCTOR_SCHEMA_VERSION,
+        cli_version: CLI_VERSION,
+        fix_mode: fixModeOf(options),
+        harness_scope: options.harness ?? 'all',
+        is_human_initiated: detectHumanInitiated(),
+        // Clamped like the completed row: over the cap the payload would 400 un-retried.
+        duration_ms: Math.min(durationMs, MAX_DURATION_MS),
+    };
+}

package/dist/lib/harness-spec.d.ts

@@ -68,6 +68,8 @@ export interface HarnessSpec {
     keyHeldByCli: boolean;
     /** Connect writes the MCP config file; no harness binary is spawned. */
     cliWritesConfig: boolean;
+    /** Binary resolves the config path; absent binary, nothing reads it. */
+    configPathFromBinary?: true;
     /** `mcp add` succeeds unauthenticated; OAuth lands at first tool use. */
     authDeferredAtInstall: boolean;
 }
@@ -199,6 +201,18 @@ export declare const HARNESS_SPECS: {
         cliWritesConfig: false;
         authDeferredAtInstall: false;
     };
+    omp: {
+        command: string;
+        displayName: string;
+        configDir: string;
+        reloadAction: string;
+        configPathFromBinary: true;
+        signInViaCliLogin: false;
+        canVerifyAuth: true;
+        keyHeldByCli: true;
+        cliWritesConfig: true;
+        authDeferredAtInstall: false;
+    };
     openclaw: {
         command: string;
         displayName: string;
@@ -252,4 +266,4 @@ export type NonNativeHarness = {
     [K in Harness]: 'urlStyle' extends keyof (typeof HARNESS_SPECS)[K] ? never : K;
 }[Harness];
 /** Native MCP harnesses carry add-generation fields; the rest override connect. */
-export declare const NATIVE_HARNESSES: ("openclaw" | "grok" | "cursor" | "codex" | "hermes" | "opencode" | "claude-code")[];
+export declare const NATIVE_HARNESSES: ("openclaw" | "omp" | "grok" | "cursor" | "codex" | "hermes" | "opencode" | "claude-code")[];

package/dist/lib/harness-spec.js

@@ -183,6 +183,18 @@ export const HARNESS_SPECS = {
         cliWritesConfig: false,
         authDeferredAtInstall: false,
     },
+    omp: {
+        command: 'omp',
+        displayName: 'omp',
+        configDir: '.omp',
+        reloadAction: 'restart it',
+        configPathFromBinary: true,
+        signInViaCliLogin: false,
+        canVerifyAuth: true,
+        keyHeldByCli: true,
+        cliWritesConfig: true,
+        authDeferredAtInstall: false,
+    },
     openclaw: {
         command: 'openclaw',
         displayName: 'OpenClaw',

package/dist/lib/mcp-json-config.d.ts

@@ -20,6 +20,8 @@ export interface McpJsonServerEntry {
     /** Registered endpoint, so a caller can tell "registered" from "registered at the right place". */
     url?: string;
     keyMatchesCliKey?: boolean;
+    /** Whole-value `${VAR}` template: the variable name, never a key. */
+    keyTemplateVar?: string;
     error?: string;
 }
 /** Reports the header's shape, never its value. */

package/dist/lib/mcp-json-config.js

@@ -56,6 +56,8 @@ export function planWrite(target, mcpUrl, apiKey) {
         ? `${filePath}: would create with a "${target.serverKey}" MCP server entry${authNote}`
         : `${filePath}: would back up to a timestamped copy, then merge in the "${target.serverKey}" MCP server entry${authNote}`;
 }
+// omp expands `${VAR}` / `${VAR:-default}` header values at load.
+const ENV_TEMPLATE_VALUE = /^\$\{([A-Za-z_][A-Za-z0-9_]*)(?::-[^}]*)?\}$/;
 /** Reports the header's shape, never its value. */
 export function readTinyfishEntry(target) {
     const existing = readExisting(target);
@@ -71,10 +73,12 @@ export function readTinyfishEntry(target) {
     const keyHeader = isPlainRecord(headers)
         ? Object.entries(headers).find((entry) => entry[0].toLowerCase() === 'x-api-key' && typeof entry[1] === 'string')
         : undefined;
+    const templateVar = keyHeader ? ENV_TEMPLATE_VALUE.exec(keyHeader[1])?.[1] : undefined;
     return {
         present: true,
         hasApiKeyHeader: keyHeader !== undefined,
         ...(matchesCliKey(keyHeader?.[1]) ? { keyMatchesCliKey: true } : {}),
+        ...(templateVar ? { keyTemplateVar: templateVar } : {}),
         ...(typeof entry.url === 'string' ? { url: entry.url } : {}),
     };
 }

package/dist/lib/omp-config.d.ts

@@ -0,0 +1,16 @@
+import { type McpJsonServerEntry, type McpJsonTarget, type McpJsonWriteResult } from './mcp-json-config.js';
+/** Tests share one process; the resolver result must not. */
+export declare function resetOmpAgentDirCache(): void;
+/** Profiles move the dir; a guessed path is written unread. */
+export declare function ompAgentDir(): string | undefined;
+/** Undefined means unresolved; connect fails closed via requireOmpTarget. */
+export declare function ompMcpTarget(): McpJsonTarget | undefined;
+export declare function ompMcpPath(): string;
+/** Reports the header's shape, never its value; undefined means unresolved. */
+export declare function readOmpTinyfishEntry(): McpJsonServerEntry | undefined;
+/** Merges only the `tinyfish` key; throws when the dir is unresolved. */
+export declare function writeOmpMcpConfig(mcpUrl: string, apiKey?: string): McpJsonWriteResult;
+/** Dry-run description of the pending write; touches nothing. */
+export declare function planOmpWrite(mcpUrl: string, apiKey?: string): string;
+/** Removes only the `tinyfish` key. */
+export declare function removeOmpMcpServer(): McpJsonWriteResult;

package/dist/lib/omp-config.js

@@ -0,0 +1,71 @@
+import * as path from 'path';
+import spawn from 'cross-spawn';
+import { ConnectStepError } from './connect-runtime.js';
+import { HARNESS_PROBE_TIMEOUT_MS } from './constants.js';
+import { planWrite, readTinyfishEntry, removeServer, writeMcpConfig, } from './mcp-json-config.js';
+const UNRESOLVED_REASON = '`omp config path` did not report a config directory';
+// Cached: every later read must agree with the write.
+let cachedAgentDir;
+/** Tests share one process; the resolver result must not. */
+export function resetOmpAgentDirCache() {
+    cachedAgentDir = undefined;
+}
+/** Profiles move the dir; a guessed path is written unread. */
+export function ompAgentDir() {
+    cachedAgentDir ??= { dir: resolveAgentDir() };
+    return cachedAgentDir.dir;
+}
+function resolveAgentDir() {
+    const result = spawn.sync('omp', ['config', 'path'], {
+        encoding: 'utf8',
+        timeout: HARNESS_PROBE_TIMEOUT_MS,
+    });
+    if (result.error || result.status !== 0)
+        return undefined;
+    const dir = (result.stdout ?? '')
+        .split('\n')
+        .map((line) => line.trim())
+        .filter(Boolean)
+        .at(-1);
+    return dir && path.isAbsolute(dir) ? dir : undefined;
+}
+/** Undefined means unresolved; connect fails closed via requireOmpTarget. */
+export function ompMcpTarget() {
+    const dir = ompAgentDir();
+    if (!dir)
+        return undefined;
+    return { serverKey: 'tinyfish', dir: () => dir, file: () => path.join(dir, 'mcp.json') };
+}
+function requireOmpTarget() {
+    const target = ompMcpTarget();
+    if (target)
+        return target;
+    throw new ConnectStepError("Could not locate omp's config directory: `omp config path` did not print one. " +
+        'Check that omp is installed and `omp config path` works, then re-run: tinyfish connect omp', 'invalid_config', { failureDetail: 'omp_agent_dir_unresolved' });
+}
+export function ompMcpPath() {
+    return requireOmpTarget().file();
+}
+/** Reports the header's shape, never its value; undefined means unresolved. */
+export function readOmpTinyfishEntry() {
+    const target = ompMcpTarget();
+    return target ? readTinyfishEntry(target) : undefined;
+}
+/** Merges only the `tinyfish` key; throws when the dir is unresolved. */
+export function writeOmpMcpConfig(mcpUrl, apiKey) {
+    return writeMcpConfig(requireOmpTarget(), mcpUrl, apiKey);
+}
+/** Dry-run description of the pending write; touches nothing. */
+export function planOmpWrite(mcpUrl, apiKey) {
+    const target = ompMcpTarget();
+    if (!target)
+        return `${UNRESOLVED_REASON} — connect omp would fail the same way`;
+    return planWrite(target, mcpUrl, apiKey);
+}
+/** Removes only the `tinyfish` key. */
+export function removeOmpMcpServer() {
+    const target = ompMcpTarget();
+    if (!target)
+        return { status: 'corrupt_skip', error: UNRESOLVED_REASON };
+    return removeServer(target);
+}

package/dist/lib/registration-detect.js

@@ -7,6 +7,7 @@ import { NATIVE_BY_HARNESS } from './connect-clients.js';
 import { HARNESS_PROBE_TIMEOUT_MS } from './constants.js';
 import { errLine } from './output.js';
 import { readCursorTinyfishEntry } from './cursor-config.js';
+import { readOmpTinyfishEntry } from './omp-config.js';
 import { readHermesKey, resolveHermesHome } from './hermes-env.js';
 import { readHermesEntry } from './hermes-config.js';
 import { detectInstalledHarnesses, harnessConfigPath, harnessDisplayPath, AuthMode, Registered, } from './harness-detect.js';
@@ -293,6 +294,38 @@ function probeCursor() {
         ...(entry.keyMatchesCliKey ? { keyMatchesCliKey: true } : {}),
     };
 }
+// omp shares Cursor's mcp.json shape; only `omp config path` resolves it.
+function probeOmp() {
+    const entry = readOmpTinyfishEntry();
+    if (!entry) {
+        return {
+            registered: Registered.Unknown,
+            authMode: AuthMode.Unknown,
+            reason: '`omp config path` did not report a config directory',
+        };
+    }
+    if (entry.error) {
+        return {
+            registered: Registered.Unknown,
+            authMode: AuthMode.Unknown,
+            reason: 'mcp.json exists but could not be read or parsed',
+        };
+    }
+    if (!entry.present)
+        return { registered: Registered.No, authMode: AuthMode.Unknown };
+    // A hand-written `${VAR}` header resolves like Codex's env-var key.
+    const keyVerdict = entry.keyTemplateVar
+        ? envKeyVerdict(entry.keyTemplateVar)
+        : entry.keyMatchesCliKey
+            ? { keyMatchesCliKey: true }
+            : {};
+    return {
+        registered: Registered.Yes,
+        authMode: entry.hasApiKeyHeader ? AuthMode.ApiKey : AuthMode.Unknown,
+        ...(entry.url ? { registeredUrl: entry.url } : {}),
+        ...keyVerdict,
+    };
+}
 // Both list commands print this header in every state, including "no servers configured".
 // Exit 0 with output we cannot recognise is not evidence of absence: reporting `no` there would
 // earn a connect repair off a parse failure, which is the bug class this command exists to kill.
@@ -486,6 +519,7 @@ const PROBES = {
     cursor: probeCursor,
     grok: probeGrok,
     hermes: probeHermes,
+    omp: probeOmp,
     openclaw: probeOpenClaw,
     opencode: probeOpencode,
 };

package/dist/lib/setup-telemetry.d.ts

@@ -26,6 +26,7 @@ export declare function postConnectEvent(options: {
 declare const harnessResultSchema: z.ZodObject<{
     harness: z.ZodEnum<{
         openclaw: "openclaw";
+        omp: "omp";
         grok: "grok";
         cursor: "cursor";
         codex: "codex";
@@ -43,10 +44,23 @@ declare const harnessResultSchema: z.ZodObject<{
 }, z.core.$strip>;
 /** First act of a `--all` run; everything upstream of it stays invisible. */
 export declare function sendSetupStarted(mcpUrl: string, attemptId?: string, apiKey?: string): Promise<void>;
+export type SetupBlockReason = 'key_rejected' | 'key_malformed' | 'key_unreadable';
+export type SetupBlockedMode = 'all' | 'pick' | 'single';
+export interface SetupBlockedDetail {
+    blockReason: SetupBlockReason;
+    keySource: 'env' | 'config' | 'explicit';
+    /** Only a server answer has one; a malformed key never reaches the API. */
+    status?: number;
+    mode: SetupBlockedMode;
+    attemptId?: string;
+}
+/** Terminal state for a run the key gate stopped; fires instead of setup_started. */
+export declare function sendSetupBlocked(mcpUrl: string, detail: SetupBlockedDetail, apiKey?: string): Promise<void>;
 export declare const setupCompletedPayloadSchema: z.ZodObject<{
     harnesses: z.ZodArray<z.ZodObject<{
         harness: z.ZodEnum<{
             openclaw: "openclaw";
+            omp: "omp";
             grok: "grok";
             cursor: "cursor";
             codex: "codex";
@@ -79,7 +93,7 @@ export type UpgradeScope = 'both' | 'cli' | 'skill';
 /** `toVersion` is null when the run was interrupted or the installed version could not be read. */
 export declare function sendUpgradeCompleted(fromVersion: string, toVersion: string | null, outcome: UpgradeOutcome, scope: UpgradeScope, apiKey?: string): Promise<void>;
 export declare function sendSetupCompleted(mcpUrl: string, harnesses: HarnessResult[], apiKey?: string, mode?: SetupMode, attemptId?: string): Promise<void>;
-export declare const DOCTOR_HARNESS_SCOPES: readonly ["all", ...("openclaw" | "grok" | "cursor" | "codex" | "hermes" | "opencode" | "claude-code")[]];
+export declare const DOCTOR_HARNESS_SCOPES: readonly ["all", ...("openclaw" | "omp" | "grok" | "cursor" | "codex" | "hermes" | "opencode" | "claude-code")[]];
 export declare const DOCTOR_ERROR_CLASSES: readonly ["command_not_found", "timeout", "spawn_error", "nonzero_exit", "unexpected_error"];
 export type DoctorErrorClass = (typeof DOCTOR_ERROR_CLASSES)[number];
 /** Derived, not read: the catch is generic, so only the code is trustworthy. */
@@ -108,6 +122,7 @@ export declare const doctorCompletedPayloadSchema: z.ZodObject<{
     }>;
     harness_scope: z.ZodEnum<{
         openclaw: "openclaw";
+        omp: "omp";
         grok: "grok";
         cursor: "cursor";
         codex: "codex";
@@ -120,6 +135,7 @@ export declare const doctorCompletedPayloadSchema: z.ZodObject<{
     failed_check_ids: z.ZodArray<z.ZodString>;
     failed_harnesses: z.ZodArray<z.ZodEnum<{
         openclaw: "openclaw";
+        omp: "omp";
         grok: "grok";
         cursor: "cursor";
         codex: "codex";
@@ -130,6 +146,7 @@ export declare const doctorCompletedPayloadSchema: z.ZodObject<{
     harnesses: z.ZodArray<z.ZodObject<{
         harness: z.ZodEnum<{
             openclaw: "openclaw";
+            omp: "omp";
             grok: "grok";
             cursor: "cursor";
             codex: "codex";
@@ -162,6 +179,7 @@ export declare const doctorCouldNotRunPayloadSchema: z.ZodObject<{
     }>;
     harness_scope: z.ZodEnum<{
         openclaw: "openclaw";
+        omp: "omp";
         grok: "grok";
         cursor: "cursor";
         codex: "codex";
@@ -197,6 +215,7 @@ declare const doctorPayloadSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     }>;
     harness_scope: z.ZodEnum<{
         openclaw: "openclaw";
+        omp: "omp";
         grok: "grok";
         cursor: "cursor";
         codex: "codex";
@@ -209,6 +228,7 @@ declare const doctorPayloadSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     failed_check_ids: z.ZodArray<z.ZodString>;
     failed_harnesses: z.ZodArray<z.ZodEnum<{
         openclaw: "openclaw";
+        omp: "omp";
         grok: "grok";
         cursor: "cursor";
         codex: "codex";
@@ -219,6 +239,7 @@ declare const doctorPayloadSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     harnesses: z.ZodArray<z.ZodObject<{
         harness: z.ZodEnum<{
             openclaw: "openclaw";
+            omp: "omp";
             grok: "grok";
             cursor: "cursor";
             codex: "codex";
@@ -250,6 +271,7 @@ declare const doctorPayloadSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     }>;
     harness_scope: z.ZodEnum<{
         openclaw: "openclaw";
+        omp: "omp";
         grok: "grok";
         cursor: "cursor";
         codex: "codex";