@tiny-fish/cli 0.39.1-next.309 → 0.40.0

package/dist/lib/registration-detect.js

@@ -8,9 +8,19 @@ import { HARNESS_PROBE_TIMEOUT_MS } from './constants.js';
 import { errLine } from './output.js';
 import { readCursorTinyfishEntry } from './cursor-config.js';
 import { readOmpTinyfishEntry } from './omp-config.js';
+import { readPiTinyfishEntry } from './pi-config.js';
 import { readHermesKey, resolveHermesHome } from './hermes-env.js';
 import { readHermesEntry } from './hermes-config.js';
 import { detectInstalledHarnesses, harnessConfigPath, harnessDisplayPath, AuthMode, Registered, } from './harness-detect.js';
+const NOT_REGISTERED = Object.freeze({
+    registered: Registered.No,
+    authMode: AuthMode.Unknown,
+});
+const unverified = (reason) => ({
+    registered: Registered.Unknown,
+    authMode: AuthMode.Unknown,
+    reason,
+});
 // A list, verified against codex 0.146. A name-keyed map was accepted here too, but every
 // field is optional, so that arm parsed *any* object-of-objects: a wrapper like
 // `{"servers": {...}}` decoded as one entry named `servers` and reported TinyFish absent.
@@ -151,15 +161,11 @@ function parseMcpGet(output) {
 function fromMcpGet(command) {
     const probe = runProbe(command, ['mcp', 'get', 'tinyfish']);
     if (probe.outcome === 'unavailable') {
-        return { registered: Registered.Unknown, authMode: AuthMode.Unknown, reason: probe.reason };
+        return unverified(probe.reason);
     }
     if (probe.exitCode !== 0) {
         if (UNSUPPORTED_SUBCOMMAND.test(probe.output)) {
-            return {
-                registered: Registered.Unknown,
-                authMode: AuthMode.Unknown,
-                reason: `\`${command} mcp get\` is unsupported by this version`,
-            };
+            return unverified(`\`${command} mcp get\` is unsupported by this version`);
         }
         // The roster is free; `mcp list` health-checks every server.
         const scoped = tinyfishServerName(probe.output);
@@ -178,13 +184,9 @@ function fromMcpGet(command) {
             return plugin;
         // A broken CLI also exits nonzero, and reading that as absence earns a spurious repair.
         if (!NO_SUCH_SERVER.test(probe.output)) {
-            return {
-                registered: Registered.Unknown,
-                authMode: AuthMode.Unknown,
-                reason: `\`${command} mcp get\` failed without reporting the server as absent`,
-            };
+            return unverified(`\`${command} mcp get\` failed without reporting the server as absent`);
         }
-        return { registered: Registered.No, authMode: AuthMode.Unknown };
+        return NOT_REGISTERED;
     }
     return parseMcpGet(probe.output);
 }
@@ -218,7 +220,7 @@ function readCodexEntry() {
 }
 // `mcp add` exits 0 whether or not its inline OAuth finished, so `not_logged_in` is the only
 // evidence of an abandoned sign-in; every other state, older Codex included, is unknown.
-export function codexOauthCompleted() {
+function codexOauthCompleted() {
     const read = readCodexEntry();
     if ('reason' in read)
         return undefined;
@@ -255,10 +257,10 @@ function envKeyVerdict(envVar) {
 function probeCodex() {
     const read = readCodexEntry();
     if ('reason' in read)
-        return { registered: Registered.Unknown, authMode: AuthMode.Unknown, reason: read.reason };
+        return unverified(read.reason);
     const entry = read.entry;
     if (!entry)
-        return { registered: Registered.No, authMode: AuthMode.Unknown };
+        return NOT_REGISTERED;
     const codexUrl = entry.transport?.url;
     // Read from this entry: codex emits `bearer_token_env_var` on every HTTP server, so testing
     // the whole payload reports api-key for TinyFish because some other server carries a key.
@@ -279,14 +281,10 @@ function probeCodex() {
 function probeCursor() {
     const entry = readCursorTinyfishEntry();
     if (entry.error) {
-        return {
-            registered: Registered.Unknown,
-            authMode: AuthMode.Unknown,
-            reason: 'mcp.json exists but could not be read or parsed',
-        };
+        return unverified('mcp.json exists but could not be read or parsed');
     }
     if (!entry.present)
-        return { registered: Registered.No, authMode: AuthMode.Unknown };
+        return NOT_REGISTERED;
     return {
         registered: Registered.Yes,
         authMode: entry.hasApiKeyHeader ? AuthMode.ApiKey : AuthMode.Unknown,
@@ -298,12 +296,29 @@ function probeCursor() {
 function probeOmp() {
     const entry = readOmpTinyfishEntry();
     if (!entry) {
-        return {
-            registered: Registered.Unknown,
-            authMode: AuthMode.Unknown,
-            reason: '`omp config path` did not report a config directory',
-        };
+        return unverified('`omp config path` did not report a config directory');
+    }
+    if (entry.error) {
+        return unverified('mcp.json exists but could not be read or parsed');
     }
+    if (!entry.present)
+        return NOT_REGISTERED;
+    // A hand-written `${VAR}` header resolves like Codex's env-var key.
+    const keyVerdict = entry.keyTemplateVar
+        ? envKeyVerdict(entry.keyTemplateVar)
+        : entry.keyMatchesCliKey
+            ? { keyMatchesCliKey: true }
+            : {};
+    return {
+        registered: Registered.Yes,
+        authMode: entry.hasApiKeyHeader ? AuthMode.ApiKey : AuthMode.Unknown,
+        ...(entry.url ? { registeredUrl: entry.url } : {}),
+        ...keyVerdict,
+    };
+}
+// Whether anything reads the entry is the pi-adapter check's question, not this one.
+function probePi() {
+    const entry = readPiTinyfishEntry();
     if (entry.error) {
         return {
             registered: Registered.Unknown,
@@ -313,7 +328,6 @@ function probeOmp() {
     }
     if (!entry.present)
         return { registered: Registered.No, authMode: AuthMode.Unknown };
-    // A hand-written `${VAR}` header resolves like Codex's env-var key.
     const keyVerdict = entry.keyTemplateVar
         ? envKeyVerdict(entry.keyTemplateVar)
         : entry.keyMatchesCliKey
@@ -342,34 +356,23 @@ function fromMcpList(command, output, registeredMode, urlPattern) {
         };
     }
     if (!MCP_LIST_HEADER.test(output)) {
-        return {
-            registered: Registered.Unknown,
-            authMode: AuthMode.Unknown,
-            reason: `could not interpret \`${command} mcp list\` output`,
-        };
+        return unverified(`could not interpret \`${command} mcp list\` output`);
     }
-    return { registered: Registered.No, authMode: AuthMode.Unknown };
+    return NOT_REGISTERED;
 }
 // `hermes mcp list` only pretty-prints this file, so connect's gate reads it too.
 function probeHermes() {
-    const home = resolveHermesHome();
-    if (!home) {
-        return {
-            registered: Registered.Unknown,
-            authMode: AuthMode.Unknown,
-            reason: '`hermes dump` did not report a home directory',
-        };
+    const resolved = resolveHermesHome();
+    if (typeof resolved !== 'string') {
+        return unverified('`hermes dump` did not report a home directory');
     }
+    const home = resolved;
     const entry = readHermesEntry(home);
     if (entry.state === 'unreadable' || entry.state === 'unparseable') {
-        return {
-            registered: Registered.Unknown,
-            authMode: AuthMode.Unknown,
-            reason: `Hermes' config.yaml could not be ${entry.state === 'unreadable' ? 'read' : 'parsed'}`,
-        };
+        return unverified(`Hermes' config.yaml could not be ${entry.state === 'unreadable' ? 'read' : 'parsed'}`);
     }
     if (entry.state === 'absent')
-        return { registered: Registered.No, authMode: AuthMode.Unknown };
+        return NOT_REGISTERED;
     // `mcp add` saves a disabled entry on a failed connect, which connect refuses too.
     const enabled = entry.state === 'enabled' ? {} : { connected: false };
     // The .env key is Hermes-wide; the header template ties it here.
@@ -393,16 +396,12 @@ function probeOpenClaw() {
         entries = fs.readdirSync(skillsDir);
     }
     catch {
-        return {
-            registered: Registered.Unknown,
-            authMode: AuthMode.Unknown,
-            reason: `no global skills directory at ${harnessDisplayPath('openclaw')}/skills; OpenClaw layout is unverified`,
-        };
+        return unverified(`no global skills directory at ${harnessDisplayPath('openclaw')}/skills; OpenClaw layout is unverified`);
     }
     // A bare substring also matched a skill merely named `not-tinyfish-thing`.
     return entries.some((name) => SKILL_DIR_IS_TINYFISH.test(name))
         ? { registered: Registered.Yes, authMode: AuthMode.ApiKey, usesCliKey: true }
-        : { registered: Registered.No, authMode: AuthMode.Unknown };
+        : NOT_REGISTERED;
 }
 // `opencode mcp list` prints no headers, so a key-authed registration is indistinguishable.
 function probeOpencode() {
@@ -410,7 +409,7 @@ function probeOpencode() {
     const probe = runProbe('opencode', args);
     if (probe.outcome !== 'ran' || probe.exitCode !== 0) {
         const reason = probeReason('opencode', args, probe);
-        return { registered: Registered.Unknown, authMode: AuthMode.Unknown, reason };
+        return unverified(reason);
     }
     return fromMcpList('opencode', probe.output, AuthMode.Unknown, OPENCODE_ROW_URL);
 }
@@ -440,11 +439,7 @@ function fromGrokPlugin() {
     // repair that double-registers a working one. Anything but a list is unknown, not absent.
     const shape = grokPluginSchema.safeParse(listed);
     if (!shape.success) {
-        return {
-            registered: Registered.Unknown,
-            authMode: AuthMode.Unknown,
-            reason: '`grok plugin list --json` returned an unexpected shape',
-        };
+        return unverified('`grok plugin list --json` returned an unexpected shape');
     }
     if (!shape.data.some((plugin) => plugin.name === 'tinyfish'))
         return undefined;
@@ -477,36 +472,24 @@ function probeGrok() {
     const args = ['mcp', 'list', '--json'];
     const probe = runProbe('grok', args);
     if (probe.outcome === 'unavailable') {
-        return { registered: Registered.Unknown, authMode: AuthMode.Unknown, reason: probe.reason };
+        return unverified(probe.reason);
     }
     if (probe.exitCode !== 0) {
         if (UNSUPPORTED_SUBCOMMAND.test(probe.output)) {
-            return {
-                registered: Registered.Unknown,
-                authMode: AuthMode.Unknown,
-                reason: 'this Grok build has no `mcp list --json`',
-            };
+            return unverified('this Grok build has no `mcp list --json`');
         }
-        return {
-            registered: Registered.Unknown,
-            authMode: AuthMode.Unknown,
-            reason: probeReason('grok', args, probe),
-        };
+        return unverified(probeReason('grok', args, probe));
     }
     let entries;
     try {
         entries = grokListSchema.parse(JSON.parse(probe.stdout));
     }
     catch {
-        return {
-            registered: Registered.Unknown,
-            authMode: AuthMode.Unknown,
-            reason: '`grok mcp list --json` did not return the expected shape',
-        };
+        return unverified('`grok mcp list --json` did not return the expected shape');
     }
     const entry = entries.find((server) => server.name === 'tinyfish');
     if (!entry)
-        return fromGrokPlugin() ?? { registered: Registered.No, authMode: AuthMode.Unknown };
+        return fromGrokPlugin() ?? NOT_REGISTERED;
     return {
         registered: Registered.Yes,
         ...grokKeyAuth(entry.headers ?? {}),
@@ -522,6 +505,7 @@ const PROBES = {
     omp: probeOmp,
     openclaw: probeOpenClaw,
     opencode: probeOpencode,
+    pi: probePi,
 };
 /** Never throws; a failed probe is `unknown` with a reason, so no caller can read it as healthy. */
 export function detectRegistrations(harnesses) {
@@ -549,12 +533,7 @@ export function detectRegistrations(harnesses) {
             if (process.env['TINYFISH_DEBUG']) {
                 errLine(`probe ${detection.harness} threw: ${e instanceof Error ? e.message : String(e)}`);
             }
-            return {
-                ...base,
-                registered: Registered.Unknown,
-                authMode: AuthMode.Unknown,
-                reason: 'the probe failed unexpectedly',
-            };
+            return { ...base, ...unverified('the probe failed unexpectedly') };
         }
     });
 }

package/dist/lib/setup-telemetry.d.ts

@@ -6,9 +6,6 @@ import { AuthMode, Registered } from './harness-detect.js';
  * opts out — a privacy switch must not fail closed on `true`.
  */
 export declare function telemetryDisabled(): boolean;
-export declare function isTrustedTelemetryOrigin(endpoint: string): boolean;
-/** SHA-256 lookup key only, and only to trusted origins — the raw key never rides telemetry. */
-export declare function telemetryHeaders(endpoint: string, apiKey?: string): Record<string, string>;
 /**
  * The one POST to `/api/cli/connect-event`, and the only place its security-relevant
  * properties live: trusted-origin key gating, `redirect: "error"`, the 2s cap, notice
@@ -32,6 +29,7 @@ declare const harnessResultSchema: z.ZodObject<{
         codex: "codex";
         hermes: "hermes";
         opencode: "opencode";
+        pi: "pi";
         "claude-code": "claude-code";
     }>;
     detected: z.ZodBoolean;
@@ -66,6 +64,7 @@ export declare const setupCompletedPayloadSchema: z.ZodObject<{
             codex: "codex";
             hermes: "hermes";
             opencode: "opencode";
+            pi: "pi";
             "claude-code": "claude-code";
         }>;
         detected: z.ZodBoolean;
@@ -84,7 +83,7 @@ export declare const setupCompletedPayloadSchema: z.ZodObject<{
     }>>;
     connect_attempt_id: z.ZodOptional<z.ZodUUID>;
 }, z.core.$strip>;
-export type SetupCompletedPayload = z.infer<typeof setupCompletedPayloadSchema>;
+type SetupCompletedPayload = z.infer<typeof setupCompletedPayloadSchema>;
 export type HarnessResult = z.infer<typeof harnessResultSchema>;
 export type SetupMode = NonNullable<SetupCompletedPayload['mode']>;
 export type UpgradeOutcome = 'updated' | 'failed' | 'interrupted';
@@ -93,12 +92,11 @@ export type UpgradeScope = 'both' | 'cli' | 'skill';
 /** `toVersion` is null when the run was interrupted or the installed version could not be read. */
 export declare function sendUpgradeCompleted(fromVersion: string, toVersion: string | null, outcome: UpgradeOutcome, scope: UpgradeScope, apiKey?: string): Promise<void>;
 export declare function sendSetupCompleted(mcpUrl: string, harnesses: HarnessResult[], apiKey?: string, mode?: SetupMode, attemptId?: string): Promise<void>;
-export declare const DOCTOR_HARNESS_SCOPES: readonly ["all", ...("openclaw" | "omp" | "grok" | "cursor" | "codex" | "hermes" | "opencode" | "claude-code")[]];
 export declare const DOCTOR_ERROR_CLASSES: readonly ["command_not_found", "timeout", "spawn_error", "nonzero_exit", "unexpected_error"];
 export type DoctorErrorClass = (typeof DOCTOR_ERROR_CLASSES)[number];
 /** Derived, not read: the catch is generic, so only the code is trustworthy. */
 export declare function doctorErrorClass(error: unknown): DoctorErrorClass;
-export declare const doctorCompletedPayloadSchema: z.ZodObject<{
+declare const doctorCompletedPayloadSchema: z.ZodObject<{
     outcome: z.ZodLiteral<"completed">;
     schema_version: z.ZodInt;
     cli_version: z.ZodString;
@@ -128,6 +126,7 @@ export declare const doctorCompletedPayloadSchema: z.ZodObject<{
         codex: "codex";
         hermes: "hermes";
         opencode: "opencode";
+        pi: "pi";
         "claude-code": "claude-code";
         all: "all";
     }>;
@@ -141,6 +140,7 @@ export declare const doctorCompletedPayloadSchema: z.ZodObject<{
         codex: "codex";
         hermes: "hermes";
         opencode: "opencode";
+        pi: "pi";
         "claude-code": "claude-code";
     }>>;
     harnesses: z.ZodArray<z.ZodObject<{
@@ -152,6 +152,7 @@ export declare const doctorCompletedPayloadSchema: z.ZodObject<{
             codex: "codex";
             hermes: "hermes";
             opencode: "opencode";
+            pi: "pi";
             "claude-code": "claude-code";
         }>;
         detected: z.ZodBoolean;
@@ -163,7 +164,7 @@ export declare const doctorCompletedPayloadSchema: z.ZodObject<{
     hermes_plugin_version: z.ZodOptional<z.ZodString>;
     hermes_plugin_expected_version: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
-export declare const doctorCouldNotRunPayloadSchema: z.ZodObject<{
+declare const doctorCouldNotRunPayloadSchema: z.ZodObject<{
     outcome: z.ZodLiteral<"could_not_run">;
     error_class: z.ZodEnum<{
         timeout: "timeout";
@@ -187,6 +188,7 @@ export declare const doctorCouldNotRunPayloadSchema: z.ZodObject<{
         codex: "codex";
         hermes: "hermes";
         opencode: "opencode";
+        pi: "pi";
         "claude-code": "claude-code";
         all: "all";
     }>;
@@ -223,6 +225,7 @@ declare const doctorPayloadSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
         codex: "codex";
         hermes: "hermes";
         opencode: "opencode";
+        pi: "pi";
         "claude-code": "claude-code";
         all: "all";
     }>;
@@ -236,6 +239,7 @@ declare const doctorPayloadSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
         codex: "codex";
         hermes: "hermes";
         opencode: "opencode";
+        pi: "pi";
         "claude-code": "claude-code";
     }>>;
     harnesses: z.ZodArray<z.ZodObject<{
@@ -247,6 +251,7 @@ declare const doctorPayloadSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
             codex: "codex";
             hermes: "hermes";
             opencode: "opencode";
+            pi: "pi";
             "claude-code": "claude-code";
         }>;
         detected: z.ZodBoolean;
@@ -281,6 +286,7 @@ declare const doctorPayloadSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
         codex: "codex";
         hermes: "hermes";
         opencode: "opencode";
+        pi: "pi";
         "claude-code": "claude-code";
         all: "all";
     }>;

package/dist/lib/setup-telemetry.js

@@ -20,7 +20,7 @@ export function telemetryDisabled() {
 // `--url` accepts any http(s) URL, so a user-supplied origin must never receive the key.
 const TRUSTED_TELEMETRY_HOST_SUFFIXES = ['.tinyfish.ai', '.tinyfish.io'];
 const TRUSTED_TELEMETRY_LOOPBACK_HOSTS = ['localhost', '127.0.0.1', '[::1]'];
-export function isTrustedTelemetryOrigin(endpoint) {
+function isTrustedTelemetryOrigin(endpoint) {
     let url;
     try {
         url = new URL(endpoint);
@@ -38,7 +38,7 @@ export function isTrustedTelemetryOrigin(endpoint) {
     return TRUSTED_TELEMETRY_HOST_SUFFIXES.some((suffix) => host === suffix.slice(1) || host.endsWith(suffix));
 }
 /** SHA-256 lookup key only, and only to trusted origins — the raw key never rides telemetry. */
-export function telemetryHeaders(endpoint, apiKey) {
+function telemetryHeaders(endpoint, apiKey) {
     const headers = { 'content-type': 'application/json' };
     if (apiKey && validateKeyFormat(apiKey) && isTrustedTelemetryOrigin(endpoint)) {
         headers['x-api-key-lookup'] = createHash('sha256').update(apiKey).digest('hex');
@@ -210,7 +210,7 @@ export async function sendSetupCompleted(mcpUrl, harnesses, apiKey, mode, attemp
     }
     await postConnectEvent({ endpoint, body, attempts: 2, label: 'setup', apiKey });
 }
-export const DOCTOR_HARNESS_SCOPES = ['all', ...ALL_HARNESSES];
+const DOCTOR_HARNESS_SCOPES = ['all', ...ALL_HARNESSES];
 // Mirrors the route's cap; drops what the route would 400 un-retried.
 const versionSchema = z
     .string()
@@ -237,7 +237,7 @@ export function doctorErrorClass(error) {
         return 'timeout';
     return code ? 'spawn_error' : 'unexpected_error';
 }
-export const doctorCompletedPayloadSchema = z.object({
+const doctorCompletedPayloadSchema = z.object({
     outcome: z.literal('completed'),
     schema_version: z.int().positive(),
     cli_version: z.string().max(32),
@@ -274,7 +274,7 @@ export const doctorCompletedPayloadSchema = z.object({
     hermes_plugin_expected_version: versionSchema.optional(),
 });
 // Detection threw, so there is no report to aggregate: enumerated outcome and timing only.
-export const doctorCouldNotRunPayloadSchema = z.object({
+const doctorCouldNotRunPayloadSchema = z.object({
     outcome: z.literal('could_not_run'),
     error_class: z.enum(DOCTOR_ERROR_CLASSES),
     schema_version: z.int().positive(),

package/dist/lib/skill-install.d.ts

@@ -1,5 +1,6 @@
 import { type InstallOptions } from './cli-install.js';
 import { type SkillAgent } from './connect-clients.js';
+export declare const SKILLS_CLI_PACKAGE = "skills@1.5.15";
 export declare function installWebSkill(client: {
     skillAgent?: SkillAgent;
     displayName: string;

package/dist/lib/skill-install.js

@@ -1,14 +1,15 @@
+import * as fs from 'node:fs';
+import * as os from 'node:os';
 import * as path from 'node:path';
 import spawn from 'cross-spawn';
-import { z } from 'zod';
 import { loadConfig } from './auth.js';
 import { captureStdio, capturedOutput, replay, SKILL_INSTALL_TIMEOUT_MS, STEP_MAX_BUFFER, } from './cli-install.js';
 import { CURSOR_SKILL_TARGET, NATIVE_MCP_CLIENTS, OPENCLAW, openclawSkillInstallArgs, } from './connect-clients.js';
-import { ConnectInterruptedError, ConnectStepError, probeSupportVariant, spawnFailureDetail, spawnStepError, throwIfInterrupted, } from './connect-runtime.js';
+import { ConnectInterruptedError, ConnectStepError, probeSupportVariant, spawnStepError, throwIfInterrupted, } from './connect-runtime.js';
 import { CLI_AGENT_IDENTITY } from './constants.js';
-import { errLine } from './output.js';
+import { errLine, sanitizeLine } from './output.js';
 // Supports Hermes without node:util.styleText, so the installer still runs on Node 20.11.
-const SKILLS_CLI_PACKAGE = 'skills@1.5.15';
+export const SKILLS_CLI_PACKAGE = 'skills@1.5.15';
 const TINYFISH_WEB_SKILL_SOURCE = 'tinyfish-io/tinyfish-cookbook';
 const TINYFISH_WEB_SKILL = 'use-tinyfish';
 /** `skills add` is an unconditional overwrite, so it doubles as the refresh path. */
@@ -44,35 +45,34 @@ const SKILL_ALREADY_CURRENT_PATTERN = /All global skills are up to date/;
 // A lock entry with no recorded hash is untrackable, so `skills` reports it as skipped rather
 // than failed. Left undetected that reads as "up to date" while nothing was refreshed.
 const SKILL_UNCHECKABLE_PATTERN = /cannot be checked automatically/;
-const skillListSchema = z.array(z.object({ name: z.string() }));
-// `add` exits 0 on per-skill failure; the piped list is the verdict.
-function failedListVerdict() {
-    const list = spawn.sync('npx', ['-y', SKILLS_CLI_PACKAGE, 'list', '--global', '--json'], {
-        encoding: 'utf8',
-        env: skillSpawnEnv(),
-        maxBuffer: STEP_MAX_BUFFER,
-        timeout: SKILL_INSTALL_TIMEOUT_MS,
-    });
-    const listRan = !list.error && list.status === 0;
-    if (listRan && skillListed(list.stdout ?? ''))
-        return null;
-    // A clean list that omits the skill is not a real exit (PF-3680).
-    const tag = listRan ? 'skill_absent_after_add' : `skill_list_failed ${spawnFailureDetail(list)}`;
-    return { result: list, tag };
+// `skills` writes here for the universal agents, whose own config dirs it never touches.
+function canonicalSkillsDir() {
+    return path.join(os.homedir(), '.agents', 'skills'); // nosemgrep: path-join-resolve-traversal -- fixed dir names under os.homedir()
 }
-// Entry presence is the whole verdict: `agents` names the harnesses `skills` detects,
-// so an install for a harness with no config dir yet lists none (PF-3680).
-function skillListed(stdout) {
-    const parsed = skillListSchema.safeParse(parseJson(stdout));
-    return parsed.success && parsed.data.some((skill) => skill.name === TINYFISH_WEB_SKILL);
+// Where the harness reads. Both of the modes `add` picks land the skill here.
+const SKILL_DIR_BY_AGENT = {
+    'claude-code': () => path.join(agentHome('CLAUDE_CONFIG_DIR', '.claude'), 'skills'),
+    // The env value, not resolveHermesHome(): the child we spawn reads the env.
+    'hermes-agent': () => path.join(agentHome('HERMES_HOME', '.hermes'), 'skills'),
+    codex: canonicalSkillsDir,
+    cursor: canonicalSkillsDir,
+    opencode: canonicalSkillsDir,
+    // `skills` writes pi's here whatever PI_CODING_AGENT_DIR says.
+    pi: () => path.join(os.homedir(), '.pi', 'agent', 'skills'), // nosemgrep: path-join-resolve-traversal -- fixed dir names under os.homedir()
+};
+function agentHome(override, fallback) {
+    return process.env[override]?.trim() || path.join(os.homedir(), fallback); // nosemgrep: path-join-resolve-traversal -- fixed dir names under os.homedir()
 }
-function parseJson(text) {
-    try {
-        return JSON.parse(text);
-    }
-    catch {
-        return undefined;
-    }
+/** `add` exits 0 on per-agent failure, so the file it should have written is the verdict. */
+function skillOnDisk(agent) {
+    // SKILL.md, not the dir: `skills` mkdirs before it copies, so a failed copy leaves one.
+    return fs.existsSync(path.join(SKILL_DIR_BY_AGENT[agent](), TINYFISH_WEB_SKILL, 'SKILL.md'));
+}
+// The route tail-slices to 500, so an over-long tail would cut the tag off the front.
+const SKILL_DETAIL_TAIL_MAX_CHARS = 425;
+function absentDetail(addOutput) {
+    const tail = sanitizeLine(addOutput).trim().slice(-SKILL_DETAIL_TAIL_MAX_CHARS);
+    return tail ? `skill_absent_after_add | ${tail}` : 'skill_absent_after_add';
 }
 export function installWebSkill(client, { verbose }) {
     if (!client.skillAgent)
@@ -82,14 +82,13 @@ export function installWebSkill(client, { verbose }) {
         ...captureStdio(verbose),
         env: skillSpawnEnv(),
     });
+    const output = capturedOutput(add);
     const addFailed = Boolean(add.error) || add.status !== 0;
-    const verdict = addFailed ? null : failedListVerdict();
-    const failed = addFailed ? add : verdict?.result;
-    if (failed) {
+    const absent = !addFailed && !skillOnDisk(client.skillAgent);
+    if (addFailed || absent) {
         // Built first: its interrupt check must run before any replay.
-        const error = spawnStepError(`Could not install the TinyFish web skill in ${client.displayName}`, failed, verdict?.tag);
-        // The add carries the failure prose; the list is JSON only.
-        replay(capturedOutput(add));
+        const error = spawnStepError(`Could not install the TinyFish web skill in ${client.displayName}`, add, absent ? absentDetail(output) : undefined);
+        replay(output);
         throw error;
     }
 }
@@ -176,18 +175,18 @@ function reinstallWebSkill(skillAgents, verbose) {
         timeout: SKILL_INSTALL_TIMEOUT_MS,
     });
     const output = capturedOutput(result);
-    // Quiet capture stays (#4434); the list verdict replaced prose matching.
+    // Quiet capture stays (#4434); the on-disk check replaced prose matching.
     const addFailed = Boolean(result.error) || result.status !== 0;
-    const failedList = addFailed ? null : failedListVerdict();
-    const failed = addFailed || failedList !== null;
+    const missing = addFailed ? undefined : skillAgents.find((agent) => !skillOnDisk(agent));
+    const failed = addFailed || missing !== undefined;
     if (failed)
-        throwIfInterrupted(failedList?.result ?? result);
+        throwIfInterrupted(result);
     if (verbose || failed)
         replay(output);
     if (failed) {
-        throw new Error('Could not refresh the TinyFish web skill', {
-            cause: (failedList?.result ?? result).error,
-        });
+        // Upgrade telemetry carries no detail, so the agent has to ride the message.
+        const scope = missing ? ` for ${missing}` : '';
+        throw new Error(`Could not refresh the TinyFish web skill${scope}`, { cause: result.error });
     }
 }
 /** Fallback when no skill-bearing harness is recorded: refresh whatever `skills` tracks. */

package/dist/lib/types.d.ts

@@ -21,14 +21,14 @@ export interface CliAgentRunParams extends AgentRunParams {
     use_vault?: boolean;
     credential_item_ids?: string[];
 }
-export type VaultProvider = '1password' | 'bitwarden';
+type VaultProvider = '1password' | 'bitwarden';
 export interface VaultConnection {
     id: string;
     provider: VaultProvider;
     connectionStatus: string;
     lastValidatedAt: string | null;
 }
-export interface VaultFieldMetadata {
+interface VaultFieldMetadata {
     fieldId: string;
     label: string;
     type: 'STRING' | 'CONCEALED' | 'OTP';
@@ -119,7 +119,7 @@ export interface BatchGetResponse {
     data: Run[];
     not_found: string[] | null;
 }
-export interface BatchCancelResult {
+interface BatchCancelResult {
     run_id: string;
     status: string;
     cancelled_at: string | null;
@@ -157,3 +157,4 @@ export interface ProfileUploadResponse {
     domains_updated: string[];
     domains_failed?: string[];
 }
+export {};

package/dist/program.js

@@ -1,5 +1,5 @@
-import { createRequire } from 'module';
 import { Command } from 'commander';
+import { CLI_VERSION } from './lib/constants.js';
 import { registerAuth } from './commands/auth.js';
 import { registerBatch } from './commands/batch.js';
 import { registerFetch } from './commands/fetch.js';
@@ -18,12 +18,11 @@ import { registerOnboard } from './commands/onboard.js';
 import { installNoticeEmit } from './lib/notice.js';
 /** Split from index.ts so tests can drive the real program instead of hand-assembling one. */
 export function buildProgram() {
-    const { version } = createRequire(import.meta.url)('../package.json');
     const program = new Command();
     program
         .name('tinyfish')
         .description('TinyFish CLI — run web automations from your terminal or agent.')
-        .version(version, '-V, --version', 'Show version')
+        .version(CLI_VERSION, '-V, --version', 'Show version')
         .helpOption('-h, --help', 'Show help')
         .addHelpCommand(false)
         .enablePositionalOptions()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiny-fish/cli",
-  "version": "0.39.1-next.309",
+  "version": "0.40.0",
   "description": "TinyFish CLI — run web automations from your terminal",
   "type": "module",
   "bin": {
@@ -37,7 +37,6 @@
     "@tiny-fish/sdk": "^0.5.0",
     "commander": "^12.0.0",
     "cross-spawn": "^7.0.6",
-    "globals": "^17.4.0",
     "tldts": "^6.1.86",
     "which": "^2.0.2",
     "yaml": "^2.9.0",