@tiny-fish/cli 0.39.0 → 0.39.1-next.311

package/dist/commands/connect.d.ts

@@ -23,20 +23,8 @@ export interface NativeConnectOptions {
     /** Targeted connects only: --all keeps its per-harness failed row. */
     fallbackWhenMissing?: boolean;
 }
-export declare function connectOpenClaw(options: {
-    apiKey?: string;
-    mcpUrl: string;
-    launch: boolean;
-    cliInstall?: boolean;
-    attemptId?: string;
-    /** Set by `--all`: the CLI install already ran once, upfront. */
-    hoistedCliInstall?: TakeHoistedCliInstall;
-    verbose?: boolean;
-    /** Set by `--all`: repeated outro lines print once, after the summary. */
-    deferOutro?: (line: string) => void;
-    /** Targeted connects only: --all keeps its per-harness failed row. */
-    fallbackWhenMissing?: boolean;
-}): Promise<void>;
+/** Skill install only: no key handoff, sign-in wait, or post-install callback to honour. */
+export declare function connectOpenClaw(options: Omit<NativeConnectOptions, 'keyAuthOnly' | 'authTimeoutMs' | 'onPostInstallFailed'>): Promise<void>;
 /** Writes mcp.json directly — no `cursor mcp add` exists. */
 export declare function connectCursor(options: {
     apiKey?: string;

package/dist/commands/connect.js

@@ -1,11 +1,11 @@
 import spawn from 'cross-spawn';
 import { CONNECT_SOURCE, persistApiKeyToEnvironment, saveConnectContext, validateKeyFormat, validatedApiKey, } from '../lib/auth.js';
 import { CURSOR_SKILL_TARGET, OPENCLAW, openclawSkillInstallArgs, NATIVE_BY_HARNESS, launchNativeMcpClient, launchOmpWalkthrough, launchOpenClawWalkthrough, openExternalUrl, } from '../lib/connect-clients.js';
-import { captureStdio, capturedOutput, HoistedFailureReportedError, installTinyFishCli, replay, SKILL_INSTALL_TIMEOUT_MS, STEP_MAX_BUFFER, } from '../lib/cli-install.js';
+import { captureStdio, capturedOutput, installTinyFishCli, replay, SKILL_INSTALL_TIMEOUT_MS, STEP_MAX_BUFFER, } from '../lib/cli-install.js';
 import { ensureCliAuthenticated } from '../lib/connect-auth.js';
 import { createStdinPrompt, runCliFallback } from '../lib/connect-fallback.js';
 import { installWebSkill } from '../lib/skill-install.js';
-import { ConnectInterruptedError, ConnectStepError, createConnectTelemetry, finishSetupCommand, requireCommandSupport, runGuarded, settle, SignInTimeoutError, spawnStepError, stageDurationOf, withStageDuration, spawnRemoval, } from '../lib/connect-runtime.js';
+import { ConnectInterruptedError, ConnectStepError, HoistedFailureReportedError, createConnectTelemetry, finishSetupCommand, requireCommandSupport, runGuarded, settle, SignInTimeoutError, spawnStepError, stageDurationOf, withStageDuration, spawnRemoval, } from '../lib/connect-runtime.js';
 import { cursorInstallDeeplink, cursorMcpPath, readCursorTinyfishEntry, writeCursorMcpConfig, } from '../lib/cursor-config.js';
 import { runConnectAll } from '../lib/connect-all.js';
 import { ompMcpPath, readOmpTinyfishEntry, writeOmpMcpConfig } from '../lib/omp-config.js';
@@ -62,14 +62,16 @@ function resolveKeyedAdd(client, storedKey, keyAuthSupported, deferOutro) {
     return keyed;
 }
 /** No sign-in to degrade to, so the install stops. */
-function refuseKeylessInstall(client, keyAuthSupported) {
-    const noSignIn = `TinyFish does not sign in to ${client.displayName} any other way`;
+function refuseKeylessInstall(client, keyAuthSupported, headless = false) {
+    const noSignIn = headless
+        ? 'signing in needs a terminal'
+        : `TinyFish does not sign in to ${client.displayName} any other way`;
     const rerun = `re-run: tinyfish connect ${client.connectClient}`;
     if (!client.keyAuth) {
         throw new ConnectStepError(`${client.displayName} cannot take a TinyFish API key, and ${noSignIn}. ` +
             `Run: tinyfish connect ${client.connectClient}`, 'key_auth_unsupported');
     }
-    if (!keyAuthSupported) {
+    if (!keyAuthSupported || headless) {
         throw new ConnectStepError(`This ${client.displayName} install cannot take a TinyFish API key, and ${noSignIn}. ` +
             `Update it, then ${rerun}`, 'harness_too_old');
     }
@@ -159,15 +161,8 @@ async function prepareInstallAuth(client, options, keyAuthSupported) {
     const buildAddArgs = keyedAdd
         ? (mcpUrl) => keyedAdd.spec.addArgs(mcpUrl, keyedAdd.key)
         : keylessAddArgs(client, keyAuthSupported);
-    if (options.keyAuthOnly && !keyedAdd) {
-        // All native clients have keyAuth; missing flags mean an old install.
-        if (client.keyAuth) {
-            throw new ConnectStepError(`This ${client.displayName} install cannot take a TinyFish API key, and signing in ` +
-                `needs a terminal. Update it, then re-run: tinyfish connect ${client.connectClient}`, 'harness_too_old');
-        }
-        throw new ConnectStepError(`${client.displayName} cannot take a TinyFish API key, and signing in needs a ` +
-            `terminal. Run: tinyfish connect ${client.connectClient}`, 'key_auth_unsupported');
-    }
+    if (options.keyAuthOnly && !keyedAdd)
+        refuseKeylessInstall(client, keyAuthSupported, true);
     // Verify first: a revoked key in a foreign .env is unrecoverable.
     if (keyedAdd?.spec.seedKey) {
         await verifyKeyBeforeSeeding(keyedAdd.key, client.displayName, options.mcpUrl);
@@ -447,6 +442,7 @@ function trackPostInstallFailure(displayName, state, telemetry, error) {
     errLine(`The ${displayName} MCP connection succeeded, but a finishing step ` +
         `(${state.stage}) failed: ${error instanceof Error ? error.message : String(error)}`);
 }
+/** Skill install only: no key handoff, sign-in wait, or post-install callback to honour. */
 export async function connectOpenClaw(options) {
     const telemetry = createConnectTelemetry(options.mcpUrl, 'openclaw', options);
     // Skill install, no MCP server — never degraded, and false keeps it inside a `= false` filter.
@@ -462,15 +458,9 @@ export async function connectOpenClaw(options) {
             return;
         telemetry.setHarnessVersion(support.harnessVersion);
         telemetry.track('checkpoint', { phase: 'prerequisite_ok' });
-        if (options.hoistedCliInstall) {
-            state.stage = 'cli_install';
-            // A carried first-take failure fails openclaw like the inline install.
-            takeHoistedCliInstall(options.hoistedCliInstall, telemetry);
-        }
-        else if (options.cliInstall !== false) {
+        if (options.cliInstall !== false) {
             state.stage = 'cli_install';
-            installTinyFishCli({ verbose: options.verbose ?? false, announce: true });
-            telemetry.track('checkpoint', { phase: 'cli_installed' });
+            runCliInstallStep(options, telemetry);
         }
         state.stage = 'skill_install';
         errLine('Installing the TinyFish skill in OpenClaw...');
@@ -707,17 +697,8 @@ export async function connectHarness(harness, options) {
 }
 function parseMcpUrlOption(options) {
     let mcpUrl = options.url ?? DEFAULT_MCP_URL;
-    if (mcpUrl.startsWith('-')) {
-        throw new Error(`Invalid --url value: ${mcpUrl}`);
-    }
-    let parsedUrl;
-    try {
-        parsedUrl = new URL(mcpUrl);
-    }
-    catch {
-        throw new Error(`Invalid --url value: ${mcpUrl}`);
-    }
-    if (!['http:', 'https:'].includes(parsedUrl.protocol)) {
+    const parsedUrl = URL.parse(mcpUrl);
+    if (mcpUrl.startsWith('-') || !parsedUrl || !['http:', 'https:'].includes(parsedUrl.protocol)) {
         throw new Error(`Invalid --url value: ${mcpUrl}`);
     }
     // Page-minted attempt id rides in on --url. Strip before the URL becomes the MCP
@@ -732,10 +713,16 @@ function parseMcpUrlOption(options) {
     }
     return { mcpUrl, attemptId };
 }
-async function connectAllPath(options, mcpUrl, attemptId) {
+/** Bare `connect` offers the picker; `--all` takes the dry-run/uninstall/skip-launch flags. */
+async function connectManyPath(options, mcpUrl, attemptId) {
     if (options.launch) {
         throw new Error('--launch is not supported with --all. Connect a single client to launch it.');
     }
+    const pick = !options.all;
+    const humanInitiated = pick && detectHumanInitiated();
+    if (pick && !humanInitiated) {
+        errLine('No terminal detected: connecting every detected harness (same as tinyfish connect --all).');
+    }
     const exitCode = await runConnectAll({
         apiKey: options.apiKey,
         mcpUrl,
@@ -743,26 +730,6 @@ async function connectAllPath(options, mcpUrl, attemptId) {
         dryRun: options.dryRun ?? false,
         uninstall: options.uninstall ?? false,
         noLaunch: options.skipLaunch === true,
-        verbose: options.verbose ?? false,
-    });
-    // Preserve the 130 runGuarded set on Ctrl+C.
-    if (!process.exitCode)
-        process.exitCode = exitCode;
-}
-async function connectPickPath(options, mcpUrl, attemptId) {
-    if (options.launch) {
-        throw new Error('--launch is not supported with --all. Connect a single client to launch it.');
-    }
-    const humanInitiated = detectHumanInitiated();
-    if (!humanInitiated) {
-        errLine('No terminal detected: connecting every detected harness (same as tinyfish connect --all).');
-    }
-    const exitCode = await runConnectAll({
-        apiKey: options.apiKey,
-        mcpUrl,
-        attemptId,
-        dryRun: false,
-        uninstall: false,
         pick: humanInitiated,
         verbose: options.verbose ?? false,
     });
@@ -820,14 +787,14 @@ export function registerConnect(program) {
             if (client) {
                 throw new Error('Pass either a client or --all, not both.');
             }
-            await connectAllPath(options, mcpUrl, attemptId);
+            await connectManyPath(options, mcpUrl, attemptId);
             return;
         }
         if (options.dryRun || options.uninstall || options.skipLaunch) {
             throw new Error('--dry-run, --uninstall and --skip-launch are only supported with --all.');
         }
         if (!client) {
-            await connectPickPath(options, mcpUrl, attemptId);
+            await connectManyPath(options, mcpUrl, attemptId);
             return;
         }
         await connectSingleClient(client, options, mcpUrl, attemptId);

package/dist/commands/profile.d.ts

@@ -1,8 +1,5 @@
 import { Command } from 'commander';
-import { type DecryptStats } from '../lib/chrome-cookies.js';
 import type { CookieRecord, ProfileUploadResponse } from '../lib/types.js';
-export declare function extractChromeCookies(domain: string, stats?: DecryptStats): CookieRecord[];
-export declare function extractAllChromeCookies(stats?: DecryptStats): CookieRecord[];
 type TldtsParse = (host: string, opts: {
     allowPrivateDomains: boolean;
 }) => {

package/dist/commands/profile.js

@@ -6,15 +6,6 @@ import { getApiKey } from '../lib/auth.js';
 import { deriveChromeKey, listAuthRelevantHostKeys, openCookiesDb, readCookiesForHost, } from '../lib/chrome-cookies.js';
 import { profileCreate, profileUpload } from '../lib/client.js';
 import { err, errLine, handleApiError, out, outLine } from '../lib/output.js';
-// ── UserFacingError ───────────────────────────────────────────────────────────
-// Thrown by helpers to signal a terminal error that should be printed and exit 1
-// without going through handleApiError (which would print a second error line).
-class UserFacingError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = 'UserFacingError';
-    }
-}
 // ── Helpers ───────────────────────────────────────────────────────────────────
 function getChromeCookiesPath() {
     const platform = process.platform;
@@ -36,11 +27,11 @@ function validateDomain(domain) {
 // Opens a private copy of Chrome's cookie DB, derives the decryption key, and calls fn.
 function withCookiesDb(fn) {
     if (process.platform === 'win32') {
-        throw new UserFacingError('Cookie extraction is not supported on Windows yet');
+        throw new Error('Cookie extraction is not supported on Windows yet');
     }
     const cookiesPath = getChromeCookiesPath();
     if (!fs.existsSync(cookiesPath)) {
-        throw new UserFacingError(`Chrome cookies file not found at ${cookiesPath}. Is Google Chrome installed?`);
+        throw new Error(`Chrome cookies file not found at ${cookiesPath}. Is Google Chrome installed?`);
     }
     // Copy the DB out of the profile directory so we avoid the Chrome file lock.
     const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'tinyfish-chrome-cookies-'));
@@ -57,7 +48,7 @@ function withCookiesDb(fn) {
             db = openCookiesDb(dbPath);
         }
         catch (e) {
-            throw new UserFacingError(`Failed to read Chrome cookies database: ${e instanceof Error ? e.message : String(e)}`);
+            throw new Error(`Failed to read Chrome cookies database: ${e instanceof Error ? e.message : String(e)}`);
         }
         return fn(db, deriveChromeKey());
     }
@@ -76,19 +67,17 @@ function withCookiesDb(fn) {
         }
     }
 }
-// Exported for testing
-export function extractChromeCookies(domain, stats) {
+function extractChromeCookies(domain, stats) {
     return withCookiesDb((db, key) => readCookiesForHost(db, key, domain, stats));
 }
-// Exported for testing
-export function extractAllChromeCookies(stats) {
+function extractAllChromeCookies(stats) {
     return withCookiesDb((db, key) => {
         let hostKeys;
         try {
             hostKeys = listAuthRelevantHostKeys(db);
         }
         catch (e) {
-            throw new UserFacingError(`Failed to read Chrome cookies database: ${e instanceof Error ? e.message : String(e)}`);
+            throw new Error(`Failed to read Chrome cookies database: ${e instanceof Error ? e.message : String(e)}`);
         }
         // Canonicalize host_keys → registrable domains (mirrors frontend/app/lib/services/domain-utils.ts)
         const require = createRequire(import.meta.url);
@@ -181,7 +170,7 @@ function extractCookiesOrThrow(opts) {
         errLine(`Skipped ${stats.keyringSkipped} keyring-encrypted cookies (not supported on Linux yet).`);
     }
     if (cookies.length === 0) {
-        throw new UserFacingError(stats.keyringSkipped > 0
+        throw new Error(stats.keyringSkipped > 0
             ? 'Chrome on Linux encrypts cookies with the system keyring, which is not supported yet.'
             : opts.allDomains
                 ? 'No Chrome cookies found. Is Google Chrome installed and have you logged in to any sites?'
@@ -281,10 +270,6 @@ export function registerProfile(program) {
             }
         }
         catch (error) {
-            if (error instanceof UserFacingError) {
-                err({ error: error.message });
-                process.exit(1);
-            }
             handleApiError(error);
         }
     });

package/dist/commands/run.js

@@ -172,34 +172,26 @@ function buildAgentConfig(opts) {
     const cursorStyle = parseChoice(opts.cursorStyle, VALID_CURSOR_STYLES, '--cursor-style');
     const maxSteps = parsePositiveInteger(opts.maxSteps, '--max-steps', MAX_STEPS_LIMIT);
     const maxDurationSeconds = parsePositiveInteger(opts.maxDurationSeconds, '--max-duration-seconds');
-    if (mode === undefined &&
-        cursorStyle === undefined &&
-        maxSteps === undefined &&
-        maxDurationSeconds === undefined) {
-        return undefined;
-    }
-    return {
-        ...(mode !== undefined ? { mode } : {}),
-        ...(cursorStyle !== undefined ? { cursor_style: cursorStyle } : {}),
-        ...(maxSteps !== undefined ? { max_steps: maxSteps } : {}),
-        ...(maxDurationSeconds !== undefined ? { max_duration_seconds: maxDurationSeconds } : {}),
-    };
+    return compact({
+        mode,
+        cursor_style: cursorStyle,
+        max_steps: maxSteps,
+        max_duration_seconds: maxDurationSeconds,
+    });
+}
+/** Drops undefined fields; undefined when nothing is left. */
+function compact(obj) {
+    const kept = Object.fromEntries(Object.entries(obj).filter(([, v]) => v !== undefined));
+    return Object.keys(kept).length ? kept : undefined;
 }
 function buildCaptureConfig(opts) {
-    if (opts.captureElements === undefined &&
-        opts.captureSnapshots === undefined &&
-        opts.captureScreenshots === undefined &&
-        opts.captureRecording === undefined &&
-        opts.captureHtml === undefined) {
-        return undefined;
-    }
-    return {
-        ...(opts.captureElements !== undefined ? { elements: opts.captureElements } : {}),
-        ...(opts.captureSnapshots !== undefined ? { snapshots: opts.captureSnapshots } : {}),
-        ...(opts.captureScreenshots !== undefined ? { screenshots: opts.captureScreenshots } : {}),
-        ...(opts.captureRecording !== undefined ? { recording: opts.captureRecording } : {}),
-        ...(opts.captureHtml !== undefined ? { html: opts.captureHtml } : {}),
-    };
+    return compact({
+        elements: opts.captureElements,
+        snapshots: opts.captureSnapshots,
+        screenshots: opts.captureScreenshots,
+        recording: opts.captureRecording,
+        html: opts.captureHtml,
+    });
 }
 async function buildRunRequest(goal, normalizedUrl, opts) {
     const outputSchema = await loadOutputSchema(opts);
@@ -224,13 +216,7 @@ async function buildRunRequest(goal, normalizedUrl, opts) {
     };
 }
 async function runAsyncPath(req, apiKey, pretty) {
-    let result;
-    try {
-        result = await runAsync(req, apiKey);
-    }
-    catch (e) {
-        handleApiError(e);
-    }
+    const result = await runAsync(req, apiKey).catch(handleApiError);
     checkRunResult(result, false); // async = PENDING is expected
     const asyncResultWithUrl = {
         ...result,
@@ -246,13 +232,7 @@ async function runAsyncPath(req, apiKey, pretty) {
 }
 async function runSyncPath(req, apiKey, pretty) {
     errLine('Waiting for result...');
-    let result;
-    try {
-        result = await runSync(req, apiKey);
-    }
-    catch (e) {
-        handleApiError(e);
-    }
+    const result = await runSync(req, apiKey).catch(handleApiError);
     checkRunResult(result);
     const syncResultWithUrl = {
         ...result,

package/dist/commands/runs.js

@@ -1,3 +1,4 @@
+import { setTimeout as sleep } from 'node:timers/promises';
 import { RunStatus } from '@tiny-fish/sdk';
 import { getApiKey } from '../lib/auth.js';
 import { cancelRun, getRun, getRunSteps, listRuns } from '../lib/client.js';
@@ -16,6 +17,7 @@ function formatStep(step, index) {
     const meta = [step.status, step.duration].filter(Boolean).join(', ');
     return `${String(index + 1).padStart(2, ' ')}. ${action}${meta ? ` (${meta})` : ''}`;
 }
+const MAX_TIMER_MS = 2 ** 31 - 1;
 function parsePositiveInt(value, flag, defaultMs, minMs = 1) {
     if (value === undefined)
         return defaultMs;
@@ -27,56 +29,24 @@ function parsePositiveInt(value, flag, defaultMs, minMs = 1) {
         process.exit(1);
     }
     const parsed = Number(value);
-    if (parsed < minMs) {
-        err({ error: `Invalid ${flag} "${value}". Must be an integer >= ${minMs}ms.` });
+    // Node timers take a signed 32-bit delay; larger overflows to 1ms or throws.
+    if (parsed < minMs || parsed > MAX_TIMER_MS) {
+        err({
+            error: `Invalid ${flag} "${value}". Must be an integer between ${minMs} and ${MAX_TIMER_MS}ms.`,
+        });
         process.exit(1);
     }
     return parsed;
 }
-function withDeadline(promise, deadline, signal) {
-    return new Promise((resolve, reject) => {
-        const remaining = deadline - Date.now();
-        if (remaining <= 0) {
-            reject(new Error('watch deadline exceeded'));
-            return;
-        }
-        if (signal.aborted) {
-            reject(new Error('watch aborted'));
-            return;
-        }
-        const timer = setTimeout(() => reject(new Error('watch deadline exceeded')), remaining);
-        const onAbort = () => {
-            clearTimeout(timer);
-            reject(new Error('watch aborted'));
-        };
-        signal.addEventListener('abort', onAbort, { once: true });
-        promise.then((v) => {
-            clearTimeout(timer);
-            signal.removeEventListener('abort', onAbort);
-            resolve(v);
-        }, (e) => {
-            clearTimeout(timer);
-            signal.removeEventListener('abort', onAbort);
-            reject(e);
-        });
-    });
-}
-function sleep(ms, signal) {
-    return new Promise((resolve, reject) => {
-        if (signal.aborted) {
-            reject(new Error('aborted'));
-            return;
-        }
-        const timer = setTimeout(() => {
-            signal.removeEventListener('abort', onAbort);
-            resolve();
-        }, ms);
-        const onAbort = () => {
-            clearTimeout(timer);
-            reject(new Error('aborted'));
-        };
-        signal.addEventListener('abort', onAbort, { once: true });
+/** The SDK calls take no signal, so the race is the only cancel. */
+function withSignal(promise, signal) {
+    if (signal.aborted)
+        return Promise.reject(signal.reason);
+    const done = new AbortController();
+    const aborted = new Promise((_, reject) => {
+        signal.addEventListener('abort', () => reject(signal.reason), { signal: done.signal });
     });
+    return Promise.race([promise, aborted]).finally(() => done.abort());
 }
 async function runsListAction(opts) {
     // Validate --status
@@ -193,18 +163,20 @@ async function runsWatchAction(runId, opts) {
     };
     process.once('SIGINT', onSigint);
     const deadline = Date.now() + timeoutMs;
+    const timedOut = AbortSignal.timeout(timeoutMs);
+    const signal = AbortSignal.any([controller.signal, timedOut]);
     const seen = new Set();
     try {
-        const initial = await withDeadline(getRun(runId, apiKey), deadline, controller.signal);
+        const initial = await withSignal(getRun(runId, apiKey), signal);
         if (TERMINAL_STATUSES.includes(initial.status)) {
             err({
                 error: `Run ${runId} is already ${initial.status}; nothing to watch. Use 'tinyfish agent run steps ${runId}' for the trace.`,
             });
             process.exit(1);
         }
-        while (!controller.signal.aborted) {
+        while (!signal.aborted) {
             // One API call per tick — the steps endpoint also returns the run's current status.
-            const tick = await withDeadline(getRunSteps(runId, apiKey), deadline, controller.signal);
+            const tick = await withSignal(getRunSteps(runId, apiKey), signal);
             let nextIndex = seen.size;
             for (const step of tick.steps) {
                 if (seen.has(step.id))
@@ -228,22 +200,16 @@ async function runsWatchAction(runId, opts) {
                 err({ error: `Watch timed out after ${timeoutMs}ms (run still ${tick.status}).` });
                 process.exit(1);
             }
-            try {
-                await sleep(intervalMs, controller.signal);
-            }
-            catch {
-                return; // aborted
-            }
+            await sleep(intervalMs, undefined, { signal });
         }
     }
     catch (e) {
-        if (e instanceof Error && e.message === 'watch deadline exceeded') {
+        if (timedOut.aborted) {
             err({ error: `Watch timed out after ${timeoutMs}ms.` });
             process.exit(1);
         }
-        if (e instanceof Error && e.message === 'watch aborted') {
-            return; // SIGINT handler already triggered process.exit(130)
-        }
+        if (controller.signal.aborted)
+            return; // SIGINT handler already exited 130
         handleApiError(e);
     }
     finally {

package/dist/lib/auth.d.ts

@@ -6,7 +6,7 @@ export declare const CONNECT_SOURCE = "tinyfish_cli";
 export declare const CONNECT_ATTEMPT_ENV = "TINYFISH_CONNECT_ATTEMPT_ID";
 /** Mirrors ConnectAuthMode; duplicated to keep auth.ts free of connect-runtime imports. */
 export type RecordedAuthMode = 'api-key' | 'oauth' | 'deferred';
-export interface ConnectEntry {
+interface ConnectEntry {
     attempt_id: string;
     auth_mode?: RecordedAuthMode;
 }
@@ -43,8 +43,6 @@ interface EnvironmentOptions {
 }
 export declare function persistApiKeyToEnvironment(apiKey: string, options?: EnvironmentOptions): void;
 export declare function clearConfig(): boolean;
-/** The one rule that is ours to enforce: the key becomes an HTTP header, so CR/LF cannot pass. */
-export declare function isHeaderSafe(key: string): boolean;
 export declare function validateKeyFormat(key: string): boolean;
 export declare function maskKey(key: string): string;
 export type KeySource = 'explicit' | 'env' | 'config' | 'none';

package/dist/lib/auth.js

@@ -236,7 +236,7 @@ export function clearConfig() {
     }
 }
 /** The one rule that is ours to enforce: the key becomes an HTTP header, so CR/LF cannot pass. */
-export function isHeaderSafe(key) {
+function isHeaderSafe(key) {
     for (let i = 0; i < key.length; i += 1) {
         if (key.charCodeAt(i) < 0x20)
             return false;

package/dist/lib/claude-config.d.ts

@@ -1,17 +1,13 @@
-export declare function claudeDir(): string;
 export declare function claudeSettingsPath(): string;
 export declare function claudeMdPath(): string;
 export declare const TINYFISH_PERMISSION = "Bash(tinyfish:*)";
 export declare const CLAUDE_MD_MARKER = "<!-- tinyfish-configure-claude -->";
-export declare const CLAUDE_MD_BLOCK = "<!-- tinyfish-configure-claude -->\n## WebSearch or Search\nWhen looking to use Search or WebSearch, always use the TinyFish Web Search tool, run `tinyfish search query \"<query>\"`\nOnly fall back to native Search when you get rate limited by tinyfish (for a minute, then you can try using tinyfish again)\n\n## WebFetch or Fetch\nWhen looking to use Fetch or WebFetch, always use the TinyFish Fetch tool, run `tinyfish fetch content get \"<url>\"`\nOnly fall back to native Fetch when you get rate limited by tinyfish (for a minute, then you can try using tinyfish again)\n<!-- tinyfish-configure-claude -->";
 export declare function readSettingsJson(): Record<string, unknown>;
 export declare function writeSettingsJson(settings: Record<string, unknown>): void;
 export declare function mergeSettings(existing: Record<string, unknown>): Record<string, unknown>;
 export declare function removeFromSettings(existing: Record<string, unknown>): Record<string, unknown>;
 export declare function readClaudeMd(): string;
 export declare function writeClaudeMd(content: string): void;
-export declare function hasMarker(content: string): boolean;
-export declare function hasLegacyBlock(content: string): boolean;
 export declare function mergeClaudeMd(existing: string): {
     content: string;
     replaced: boolean;

package/dist/lib/claude-config.js

@@ -2,7 +2,7 @@ import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
 // ─── Path helpers ─────────────────────────────────────────────────────────────
-export function claudeDir() {
+function claudeDir() {
     return path.join(os.homedir(), '.claude');
 }
 export function claudeSettingsPath() {
@@ -40,7 +40,7 @@ const TINYFISH_SUBAGENT_HOOK = {
     ],
 };
 export const CLAUDE_MD_MARKER = '<!-- tinyfish-configure-claude -->';
-export const CLAUDE_MD_BLOCK = `${CLAUDE_MD_MARKER}
+const CLAUDE_MD_BLOCK = `${CLAUDE_MD_MARKER}
 ## WebSearch or Search
 When looking to use Search or WebSearch, always use the TinyFish Web Search tool, run \`tinyfish search query "<query>"\`
 Only fall back to native Search when you get rate limited by tinyfish (for a minute, then you can try using tinyfish again)
@@ -159,10 +159,10 @@ function escapeRegExp(s) {
 }
 const MARKER_REGEX = new RegExp(`${escapeRegExp(CLAUDE_MD_MARKER)}[\\s\\S]*?${escapeRegExp(CLAUDE_MD_MARKER)}`, 'm');
 const LEGACY_REGEX = /## Web(?:Search|Seach) or Search[\s\S]*?(?:tinyfish fetch[^\n]*\n(?:[^\n]*tinyfish[^\n]*\n)*[^\n]*)\n*/m;
-export function hasMarker(content) {
+function hasMarker(content) {
     return content.includes(CLAUDE_MD_MARKER);
 }
-export function hasLegacyBlock(content) {
+function hasLegacyBlock(content) {
     return !content.includes(CLAUDE_MD_MARKER) && LEGACY_REGEX.test(content);
 }
 export function mergeClaudeMd(existing) {

package/dist/lib/cli-install.d.ts

@@ -20,7 +20,6 @@ export type TakeHoistedCliInstall = () => {
     outcome: HoistedCliInstall;
     firstTake: boolean;
 };
-export { HoistedFailureReportedError } from './connect-runtime.js';
 export declare function captureStdio(verbose: boolean): {
     stdio: "inherit";
     timeout: number;

package/dist/lib/cli-install.js

@@ -7,7 +7,6 @@ export const SKILL_INSTALL_TIMEOUT_MS = 120_000;
 const TINYFISH_CLI_INSTALL_SPEC = `${TINYFISH_CLI_PACKAGE}@latest`;
 // spawnSync caps piped output at 1 MiB by default.
 export const STEP_MAX_BUFFER = 10 * 1024 * 1024;
-export { HoistedFailureReportedError } from './connect-runtime.js';
 export function captureStdio(verbose) {
     return verbose
         ? { stdio: 'inherit', timeout: SKILL_INSTALL_TIMEOUT_MS }