@tiny-fish/cli 0.42.0 → 0.42.1-next.336

package/dist/commands/connect.d.ts

@@ -23,14 +23,16 @@ export interface NativeConnectOptions {
     /** Targeted connects only: --all keeps its per-harness failed row. */
     fallbackWhenMissing?: boolean;
 }
-/** Skill install only: no key handoff, sign-in wait, or post-install callback to honour. */
-export declare function connectOpenClaw(options: Omit<NativeConnectOptions, 'keyAuthOnly' | 'authTimeoutMs' | 'onPostInstallFailed'>): Promise<void>;
+/** Skill install only: no key handoff or post-install callback to honour. */
+export declare function connectOpenClaw(options: Omit<NativeConnectOptions, 'keyAuthOnly' | 'onPostInstallFailed'>): Promise<void>;
 /** Writes mcp.json directly — no `cursor mcp add` exists. */
 export declare function connectCursor(options: {
     apiKey?: string;
     mcpUrl: string;
     attemptId?: string;
     verbose?: boolean;
+    authTimeoutMs?: number;
+    onPostInstallFailed?: () => void;
 }): Promise<void>;
 export declare function launchAgent(client: AgentClient): Promise<void>;
 export declare function connectHarness(harness: AgentClient, options: NativeConnectOptions): Promise<ConnectAuthMode | undefined>;

package/dist/commands/connect.js

@@ -451,7 +451,7 @@ function trackPostInstallFailure(displayName, state, telemetry, error) {
     errLine(`The ${displayName} MCP connection succeeded, but a finishing step ` +
         `(${state.stage}) failed: ${error instanceof Error ? error.message : String(error)}`);
 }
-/** Skill install only: no key handoff, sign-in wait, or post-install callback to honour. */
+/** Skill install only: no key handoff or post-install callback to honour. */
 export async function connectOpenClaw(options) {
     const telemetry = createConnectTelemetry(options.mcpUrl, 'openclaw', options);
     // Skill install, no MCP server — never degraded, and false keeps it inside a `= false` filter.
@@ -483,7 +483,10 @@ export async function connectOpenClaw(options) {
         telemetry.track('checkpoint', { phase: 'skill_installed' });
         // Stores the key before probing, so a passed --api-key never reaches an interactive login.
         state.stage = 'authentication';
-        ensureCliAuthenticated('openclaw', options.apiKey);
+        // A set timeout means headless; never shell an interactive login.
+        ensureCliAuthenticated('openclaw', options.apiKey, {
+            interactiveLogin: options.authTimeoutMs === undefined,
+        });
         telemetry.track('checkpoint', { phase: 'authenticated' });
         saveConnectContext('openclaw', telemetry.attemptId);
         // For openclaw the skill install and auth ARE functional; only the walkthrough is cosmetic.
@@ -586,6 +589,28 @@ const CONFIG_FILE_HARNESSES = {
         },
     },
 };
+/** Cosmetic and post-settle: a skill failure must not fail the connection. */
+function installSkillPostSettle(spec, displayName, state, telemetry, options) {
+    if (!spec.skillTarget.skillAgent)
+        return false;
+    state.stage = 'skill_install';
+    try {
+        installWebSkill(spec.skillTarget, { verbose: options.verbose ?? false });
+        telemetry.track('checkpoint', { phase: 'skill_installed' });
+        return false;
+    }
+    catch (error) {
+        trackPostInstallFailure(displayName, state, telemetry, error);
+        return true;
+    }
+}
+/** Prints last: the outro must own the final line. */
+function reportPostInstallFailure(harness, failed, onPostInstallFailed) {
+    if (!failed)
+        return;
+    errLine(finishSetupHint(harness));
+    onPostInstallFailed?.();
+}
 /** Writes the harness's MCP config file itself; no `mcp add` exists. */
 async function connectConfigFileHarness(harness, options) {
     const spec = CONFIG_FILE_HARNESSES[harness];
@@ -630,12 +655,12 @@ async function connectConfigFileHarness(harness, options) {
     await runGuarded(state, telemetry, async () => {
         telemetry.track('started');
         telemetry.track('checkpoint', { phase: 'prerequisite_ok' });
-        state.stage = 'skill_install';
-        installWebSkill(spec.skillTarget, { verbose: options.verbose ?? false });
-        telemetry.track('checkpoint', { phase: 'skill_installed' });
         // Auth first: a key lets the config carry an X-API-Key header, removing the sign-in hand-back.
         state.stage = 'authentication';
-        ensureCliAuthenticated(harness, options.apiKey);
+        // A set timeout means headless; never shell an interactive login.
+        ensureCliAuthenticated(harness, options.apiKey, {
+            interactiveLogin: options.authTimeoutMs === undefined,
+        });
         telemetry.track('checkpoint', { phase: 'authenticated' });
         const resolvedKey = validatedApiKey(options.apiKey);
         // ensureCliAuthenticated leaves a key stored, and `auth status` exits 0 on a malformed one.
@@ -662,6 +687,8 @@ async function connectConfigFileHarness(harness, options) {
         }
         telemetry.track('checkpoint', { phase: 'registered' });
         saveConnectContext(harness, telemetry.attemptId);
+        settle(state, telemetry, 'completed', { authMode: resolvedKey ? AuthMode.ApiKey : 'deferred' });
+        const postInstallFailed = installSkillPostSettle(spec, displayName, state, telemetry, options);
         if (resolvedKey) {
             // Deeplink would embed the key in a URL (process args, LaunchServices logs) — reload instead.
             const verify = await verifyMcpAuth(resolvedKey);
@@ -681,7 +708,7 @@ async function connectConfigFileHarness(harness, options) {
         const note = spec.postConnectNote?.();
         if (note)
             errLine(note);
-        settle(state, telemetry, 'completed', { authMode: resolvedKey ? AuthMode.ApiKey : 'deferred' });
+        reportPostInstallFailure(harness, postInstallFailed, options.onPostInstallFailed);
     });
 }
 /** Writes mcp.json directly — no `cursor mcp add` exists. */

package/dist/commands/upgrade.js

@@ -118,10 +118,10 @@ export async function runUpgradeCommand(verbose = false, scope = 'both') {
 export function registerUpgrade(program) {
     program
         .command('upgrade')
-        .description('Update the TinyFish CLI and the use-tinyfish skill to the latest versions')
-        .option('--verbose', 'Print the full npm and skills output instead of only on failure')
+        .description('Update the TinyFish CLI and refresh its bundled use-tinyfish skill')
+        .option('--verbose', 'Print the full npm output instead of only on failure')
         .option('--cli-only', 'Update only the TinyFish CLI, leaving the skill untouched')
-        .option('--skill-only', 'Refresh only the use-tinyfish skill, leaving the CLI untouched')
+        .option('--skill-only', "Rewrite the skill from the installed CLI's bundle, skipping npm")
         .action(async (options) => {
         if (options.cliOnly && options.skillOnly) {
             throw new Error('Pass either --cli-only or --skill-only, not both.');

package/dist/lib/doctor-repairs.js

@@ -1,11 +1,9 @@
 import spawn from 'cross-spawn';
 import { connectHarness } from '../commands/connect.js';
-import { ALL_HARNESSES, Registered } from './harness-detect.js';
-import { harnessSpec } from './harness-spec.js';
+import { OAUTH_SIGN_IN_TIMEOUT_MS } from './connect-all-auth.js';
+import { Registered } from './harness-detect.js';
 import { detectHumanInitiated } from './harness.js';
 import { errLine } from './output.js';
-// Config-file repairs are local writes; the rest need browser sign-in.
-const UNATTENDED_SAFE = new Set(ALL_HARNESSES.filter((harness) => harnessSpec(harness).cliWritesConfig));
 export function repairsFor(checks, statuses) {
     const repairs = [];
     // A revoked-but-well-formed key passes the credential check and fails the call; both need login.
@@ -38,8 +36,8 @@ export function repairsFor(checks, statuses) {
             action: 'connect',
             harness: status.harness,
             command: `tinyfish connect ${status.harness}`,
-            // A dead well-formed key passes the format check.
-            unattended_safe: UNATTENDED_SAFE.has(status.harness) && authCallPassed,
+            // Every harness takes a key, so a live one is the only gate.
+            unattended_safe: authCallPassed,
         });
     }
     // connect hermes reinstalls the plugin; a second row would double it.
@@ -50,7 +48,7 @@ export function repairsFor(checks, statuses) {
             action: 'connect',
             harness: 'hermes',
             command: 'tinyfish connect hermes',
-            unattended_safe: false,
+            unattended_safe: authCallPassed,
         });
     }
     return repairs;
@@ -72,11 +70,20 @@ function runAuthLogin() {
     }
 }
 /** Dispatches on `action`, never on a null harness: that conflation made the credential fix a no-op. */
-async function runRepair(repair, mcpUrl) {
+async function runRepair(repair, options, unattended) {
     if (repair.action === 'auth-login')
         return runAuthLogin();
-    if (repair.harness)
-        await connectHarness(repair.harness, { mcpUrl, launch: false });
+    if (!repair.harness)
+        return;
+    await connectHarness(repair.harness, {
+        mcpUrl: options.mcpUrl,
+        launch: false,
+        // Unattended: refuse a keyless install, bound the spawns.
+        keyAuthOnly: unattended || undefined,
+        authTimeoutMs: unattended ? OAUTH_SIGN_IN_TIMEOUT_MS : undefined,
+        // Doctor is the CLI; reinstalling it to fix a harness is circular.
+        cliInstall: unattended ? false : undefined,
+    });
 }
 export async function applyRepairs(repairs, options) {
     const interactive = detectHumanInitiated();
@@ -94,12 +101,14 @@ export async function applyRepairs(repairs, options) {
             outcomes.push({
                 repair,
                 status: 'skipped',
-                reason: 'needs a browser sign-in, which has no unattended path',
+                reason: repair.action === 'auth-login'
+                    ? 'needs a browser sign-in, which has no unattended path'
+                    : 'credential missing or failing; run tinyfish auth login',
             });
             continue;
         }
         try {
-            await runRepair(repair, options.mcpUrl);
+            await runRepair(repair, options, !interactive);
             outcomes.push({ repair, status: 'repaired' });
         }
         catch (e) {

package/dist/lib/harness-spec.d.ts

@@ -1,4 +1,4 @@
-/** The `skills` CLI's own agent names, not ours. */
+/** Our skill-path slugs, inherited from the `skills` CLI era. */
 export type SkillAgent = 'claude-code' | 'codex' | 'command-code' | 'cursor' | 'hermes-agent' | 'opencode' | 'pi';
 export interface HarnessSupportCheck {
     args: string[];

package/dist/lib/install-root.d.ts

@@ -11,5 +11,7 @@ export type InstallRoot = {
  */
 export declare function resolveInstallRoot(packageRoot: string, platform: typeof process.platform, onDisk?: (candidate: string) => boolean): InstallRoot | null;
 export declare function installRoot(): InstallRoot | null;
+/** This package's own dir under a prefix's node_modules. */
+export declare function installedPackageDir(nodeModules: string): string;
 /** The version on disk under a prefix, which is the only account of what `@latest` resolved to. */
 export declare function readInstalledVersion(nodeModules: string): string | null;

package/dist/lib/install-root.js

@@ -37,10 +37,14 @@ export function installRoot() {
     const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
     return resolveInstallRoot(packageRoot, process.platform);
 }
+/** This package's own dir under a prefix's node_modules. */
+export function installedPackageDir(nodeModules) {
+    return path.join(nodeModules, ...TINYFISH_CLI_PACKAGE.split('/'));
+}
 /** The version on disk under a prefix, which is the only account of what `@latest` resolved to. */
 export function readInstalledVersion(nodeModules) {
     try {
-        const manifest = fs.readFileSync(path.join(nodeModules, ...TINYFISH_CLI_PACKAGE.split('/'), 'package.json'), 'utf8');
+        const manifest = fs.readFileSync(path.join(installedPackageDir(nodeModules), 'package.json'), 'utf8');
         return JSON.parse(manifest).version ?? null;
     }
     catch {

package/dist/lib/skill-install.d.ts

@@ -1,18 +1,8 @@
 import { type InstallOptions } from './cli-install.js';
 import { type SkillAgent } from './connect-clients.js';
-export declare const SKILLS_CLI_PACKAGE = "skills@1.5.15";
 export declare function installWebSkill(client: {
     skillAgent?: SkillAgent;
     displayName: string;
 }, { verbose }: Pick<InstallOptions, 'verbose'>): void;
-/**
- * Refresh the skill we installed, for the harnesses we installed it in.
- *
- * Reinstalling beats `skills update`: it reports failure through the exit code instead of
- * only in prose, it repairs a copy whose lock entry lost its hash, and it cannot spread the
- * skill to agents the user never connected (`update` re-adds with no --agent, which targets
- * every agent on the machine).
- *
- * Returns whether a skill was actually rewritten.
- */
+/** Rewrite the vendored skill where connect recorded installs; true iff bytes changed. */
 export declare function updateWebSkill({ verbose }: InstallOptions): boolean;

package/dist/lib/skill-install.js

@@ -2,55 +2,13 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import spawn from 'cross-spawn';
 import { loadConfig } from './auth.js';
-import { captureStdio, capturedOutput, replay, SKILL_INSTALL_TIMEOUT_MS, STEP_MAX_BUFFER, } from './cli-install.js';
+import { captureStdio, capturedOutput, replay } from './cli-install.js';
 import { CURSOR_SKILL_TARGET, NATIVE_MCP_CLIENTS, OPENCLAW, openclawSkillInstallArgs, } from './connect-clients.js';
 import { ConnectInterruptedError, ConnectStepError, probeSupportVariant, throwIfInterrupted, } from './connect-runtime.js';
-import { CLI_AGENT_IDENTITY } from './constants.js';
+import { WEB_SKILL_NAME } from './constants.js';
+import { installedPackageDir, installRoot } from './install-root.js';
 import { errLine } from './output.js';
-import { skillTargetDir } from './skill-paths.js';
 import { clearSkillLockEntry, writeWebSkill } from './skill-vendor.js';
-// Supports Hermes without node:util.styleText, so the installer still runs on Node 20.11.
-export const SKILLS_CLI_PACKAGE = 'skills@1.5.15';
-const TINYFISH_WEB_SKILL_SOURCE = 'tinyfish-io/tinyfish-cookbook';
-const TINYFISH_WEB_SKILL = 'use-tinyfish';
-/** `skills add` is an unconditional overwrite, so it doubles as the refresh path. */
-function skillAddArgs(skillAgents) {
-    return [
-        '-y',
-        SKILLS_CLI_PACKAGE,
-        'add',
-        TINYFISH_WEB_SKILL_SOURCE,
-        '--skill',
-        TINYFISH_WEB_SKILL,
-        '--global',
-        '--agent',
-        ...skillAgents,
-        '--yes',
-    ];
-}
-// npx resolves from PATH, which a global npm install may not have exported yet.
-function skillSpawnEnv() {
-    return {
-        ...process.env,
-        // `skills` gates its logo art on agent detection.
-        AI_AGENT: CLI_AGENT_IDENTITY,
-        PATH: `${path.dirname(process.execPath)}${path.delimiter}${process.env.PATH ?? ''}`,
-    };
-}
-// The `skills` update flow exits 0 even when it fails, so status alone proves nothing.
-// Safe to match on because SKILLS_CLI_PACKAGE is pinned.
-const SKILL_UPDATE_FAILURE_PATTERN = /Failed to (?:update|check|fetch)/;
-const SKILL_NOT_INSTALLED_PATTERN = /No installed skills found matching/;
-// Nothing was rewritten, so nothing needs an agent restart.
-const SKILL_ALREADY_CURRENT_PATTERN = /All global skills are up to date/;
-// A lock entry with no recorded hash is untrackable, so `skills` reports it as skipped rather
-// than failed. Left undetected that reads as "up to date" while nothing was refreshed.
-const SKILL_UNCHECKABLE_PATTERN = /cannot be checked automatically/;
-/** `add` exits 0 on per-agent failure, so the file it should have written is the verdict. */
-function skillOnDisk(agent) {
-    // SKILL.md, not the dir: `skills` mkdirs before it copies, so a failed copy leaves one.
-    return fs.existsSync(path.join(skillTargetDir(agent), 'SKILL.md'));
-}
 export function installWebSkill(client, { verbose }) {
     if (!client.skillAgent)
         return;
@@ -58,16 +16,16 @@ export function installWebSkill(client, { verbose }) {
     writeWebSkill([client.skillAgent]);
     clearSkillLockEntry({ verbose });
 }
-/**
- * Refresh the skill we installed, for the harnesses we installed it in.
- *
- * Reinstalling beats `skills update`: it reports failure through the exit code instead of
- * only in prose, it repairs a copy whose lock entry lost its hash, and it cannot spread the
- * skill to agents the user never connected (`update` re-adds with no --agent, which targets
- * every agent on the machine).
- *
- * Returns whether a skill was actually rewritten.
- */
+// The running process predates the install it just ran, so its own bundle is stale.
+function freshBundleDir() {
+    const root = installRoot();
+    if (!root)
+        return undefined;
+    const dir = path.join(installedPackageDir(root.nodeModules), 'skill', WEB_SKILL_NAME);
+    // A failed or pre-bundle install has none; fall back to our own copy.
+    return fs.existsSync(path.join(dir, 'SKILL.md')) ? dir : undefined;
+}
+/** Rewrite the vendored skill where connect recorded installs; true iff bytes changed. */
 export function updateWebSkill({ verbose }) {
     // One entry per `tinyfish connect <client>`, persisted by PF-3169.
     const connected = loadConfig().connect ?? {};
@@ -77,16 +35,17 @@ export function updateWebSkill({ verbose }) {
         ...(connected['cursor'] ? [CURSOR_SKILL_TARGET.skillAgent] : []),
     ].filter((agent) => agent !== undefined);
     const hasOpenClaw = Boolean(connected['openclaw']);
-    // Installs predating PF-3169 recorded nothing; ask `skills` to refresh what it tracks. A
-    // skill-less recorded install (Grok) may still have one from before, so refresh anyway
-    // — but there having been none is then expected, not an upgrade failure.
+    // No recorded skill install means no target dirs; connect is the install path.
     if (skillAgents.length === 0 && !hasOpenClaw) {
-        return refreshWebSkillByHash(verbose, Object.keys(connected).length > 0);
+        errLine('No use-tinyfish skill to refresh. Run `tinyfish connect <client>` to install it.');
+        return false;
     }
     let refreshed = false;
     if (skillAgents.length > 0) {
-        reinstallWebSkill(skillAgents, verbose);
-        refreshed = true;
+        if (verbose)
+            errLine(`Refreshing the TinyFish web skill for ${skillAgents.join(', ')}...`);
+        refreshed = writeWebSkill(skillAgents, { sourceDir: freshBundleDir() });
+        clearSkillLockEntry({ verbose });
     }
     // OpenClaw keeps its skill under its own CLI, so it needs its own refresh.
     if (hasOpenClaw)
@@ -131,59 +90,3 @@ function reinstallOpenClawSkill(verbose) {
     }
     return true;
 }
-function reinstallWebSkill(skillAgents, verbose) {
-    if (verbose)
-        errLine(`Refreshing the TinyFish web skill for ${skillAgents.join(', ')}...`);
-    const result = spawn.sync('npx', skillAddArgs(skillAgents), {
-        encoding: 'utf8',
-        env: skillSpawnEnv(),
-        maxBuffer: STEP_MAX_BUFFER,
-        timeout: SKILL_INSTALL_TIMEOUT_MS,
-    });
-    const output = capturedOutput(result);
-    // Quiet capture stays (#4434); the on-disk check replaced prose matching.
-    const addFailed = Boolean(result.error) || result.status !== 0;
-    const missing = addFailed ? undefined : skillAgents.find((agent) => !skillOnDisk(agent));
-    const failed = addFailed || missing !== undefined;
-    if (failed)
-        throwIfInterrupted(result);
-    if (verbose || failed)
-        replay(output);
-    if (failed) {
-        // Upgrade telemetry carries no detail, so the agent has to ride the message.
-        const scope = missing ? ` for ${missing}` : '';
-        throw new Error(`Could not refresh the TinyFish web skill${scope}`, { cause: result.error });
-    }
-}
-/** Fallback when no skill-bearing harness is recorded: refresh whatever `skills` tracks. */
-function refreshWebSkillByHash(verbose, untrackedIsExpected = false) {
-    if (verbose)
-        errLine('Refreshing the TinyFish web skill...');
-    const result = spawn.sync('npx', ['-y', SKILLS_CLI_PACKAGE, 'update', TINYFISH_WEB_SKILL, '--global', '--yes'], {
-        encoding: 'utf8',
-        env: skillSpawnEnv(),
-        maxBuffer: STEP_MAX_BUFFER,
-        timeout: SKILL_INSTALL_TIMEOUT_MS,
-    });
-    // Piped so prose-only failures can be matched; skills exits 0 anyway.
-    const output = capturedOutput(result);
-    const unchecked = SKILL_UNCHECKABLE_PATTERN.test(output);
-    const failed = Boolean(result.error) || result.status !== 0 || SKILL_UPDATE_FAILURE_PATTERN.test(output);
-    if (failed)
-        throwIfInterrupted(result);
-    if (verbose || failed || unchecked)
-        replay(output);
-    if (failed)
-        throw new Error('Could not refresh the TinyFish web skill', { cause: result.error });
-    if (unchecked) {
-        errLine('Run `tinyfish connect <client>` to reinstall the skill and restore update tracking.');
-        if (untrackedIsExpected)
-            return false;
-        throw new Error('The TinyFish web skill cannot be checked for updates');
-    }
-    if (SKILL_NOT_INSTALLED_PATTERN.test(output)) {
-        errLine('No use-tinyfish skill installed. Run `tinyfish connect <client>` to add it.');
-        return false;
-    }
-    return !SKILL_ALREADY_CURRENT_PATTERN.test(output);
-}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiny-fish/cli",
-  "version": "0.42.0",
+  "version": "0.42.1-next.336",
   "description": "TinyFish CLI — run web automations from your terminal",
   "type": "module",
   "bin": {