@tiny-fish/cli 0.42.1 → 0.44.0

package/dist/lib/output.js

@@ -41,6 +41,7 @@ export function errLine(line) {
 }
 const WARN_ON = '\x1b[33m';
 const WARN_OFF = '\x1b[39m';
+const VAULT_RECONNECT_REQUIRED = 'VAULT_RECONNECT_REQUIRED';
 /** Advisory stderr line, yellow on a terminal and plain everywhere else so piped output stays clean. */
 export function warnLine(line) {
     const text = sanitizeLine(line);
@@ -57,9 +58,14 @@ export function handleApiError(e) {
         const payload = { error: e.message, status: e.status };
         if (e.code)
             payload.code = e.code;
-        if (e.status === 401)
+        if (e.code === VAULT_RECONNECT_REQUIRED) {
+            payload.hint =
+                'Reconnect the provider with `tinyfish vault connection add --provider 1password` or `tinyfish vault connection add --provider bitwarden --client-id <client-id>`. Vault secrets are read from TINYFISH_VAULT_TOKEN, TINYFISH_VAULT_CLIENT_SECRET, and TINYFISH_VAULT_MASTER_PASSWORD.';
+        }
+        else if (e.status === 401) {
             payload.hint =
                 'Clear the TINYFISH_API_KEY environment variable, run `tinyfish auth login`, then try again.';
+        }
         err(payload);
     }
     else if (e instanceof Error) {

package/dist/lib/registration-detect.js

@@ -326,9 +326,14 @@ function probeOmp() {
         : entry.keyMatchesCliKey
             ? { keyMatchesCliKey: true }
             : {};
+    let authMode = AuthMode.Unknown;
+    if (entry.hasApiKeyHeader)
+        authMode = AuthMode.ApiKey;
+    else if (entry.keyless)
+        authMode = AuthMode.Keyless;
     return {
         registered: Registered.Yes,
-        authMode: entry.hasApiKeyHeader ? AuthMode.ApiKey : AuthMode.Unknown,
+        authMode,
         ...(entry.url ? { registeredUrl: entry.url } : {}),
         ...keyVerdict,
     };
@@ -391,16 +396,19 @@ function probeHermes() {
     if (entry.state === 'absent')
         return NOT_REGISTERED;
     // `mcp add` saves a disabled entry on a failed connect, which connect refuses too.
-    const enabled = entry.state === 'enabled' ? {} : { connected: false };
+    const details = entry.state === 'enabled' ? {} : { connected: false };
+    const registeredUrl = entry.url ? { registeredUrl: entry.url } : {};
     // The .env key is Hermes-wide; the header template ties it here.
     const storedKey = entry.usesKeyHeader ? readHermesKey(home) : undefined;
     if (!storedKey) {
-        return { registered: Registered.Yes, authMode: AuthMode.OAuth, ...enabled };
+        const authMode = entry.keyless ? AuthMode.Keyless : AuthMode.OAuth;
+        return { registered: Registered.Yes, authMode, ...details, ...registeredUrl };
     }
     return {
         registered: Registered.Yes,
         authMode: AuthMode.ApiKey,
-        ...enabled,
+        ...details,
+        ...registeredUrl,
         ...(matchesCliKey(storedKey) ? { keyMatchesCliKey: true } : {}),
     };
 }

package/dist/lib/setup-telemetry.d.ts

@@ -163,6 +163,12 @@ declare const doctorCompletedPayloadSchema: z.ZodObject<{
         detected: z.ZodBoolean;
         registered: z.ZodEnum<typeof Registered>;
         auth_mode: z.ZodEnum<typeof AuthMode>;
+        recorded_auth_mode: z.ZodOptional<z.ZodEnum<{
+            keyless: "keyless";
+            "api-key": "api-key";
+            oauth: "oauth";
+            deferred: "deferred";
+        }>>;
         proves_harness_reach: z.ZodBoolean;
     }, z.core.$strip>>;
     duration_ms: z.ZodInt;
@@ -266,6 +272,12 @@ declare const doctorPayloadSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
         detected: z.ZodBoolean;
         registered: z.ZodEnum<typeof Registered>;
         auth_mode: z.ZodEnum<typeof AuthMode>;
+        recorded_auth_mode: z.ZodOptional<z.ZodEnum<{
+            keyless: "keyless";
+            "api-key": "api-key";
+            oauth: "oauth";
+            deferred: "deferred";
+        }>>;
         proves_harness_reach: z.ZodBoolean;
     }, z.core.$strip>>;
     duration_ms: z.ZodInt;

package/dist/lib/setup-telemetry.js

@@ -265,6 +265,7 @@ const doctorCompletedPayloadSchema = z.object({
         detected: z.boolean(),
         registered: z.enum(Registered),
         auth_mode: z.enum(AuthMode),
+        recorded_auth_mode: z.enum(['api-key', 'keyless', 'oauth', 'deferred']).optional(),
         proves_harness_reach: z.boolean(),
     }))
         .max(16),

package/dist/lib/verify.d.ts

@@ -9,6 +9,6 @@ export interface VerifyResult {
     status?: number;
 }
 /** Reachability check. Verify failure is a warning, never install failure. */
-export declare function verifyMcpHealth(mcpUrl: string): Promise<VerifyResult>;
+export declare function verifyMcpHealth(mcpUrl: string, keyless?: boolean): Promise<VerifyResult>;
 /** Authenticated check — where the CLI holds the key (Cursor, OpenClaw, Hermes). */
 export declare function verifyMcpAuth(apiKey: string, apiBaseUrl?: string): Promise<VerifyResult>;

package/dist/lib/verify.js

@@ -1,6 +1,16 @@
 import { listRuns } from './client.js';
+import { TINYFISH_ACCESS_MODE_HEADER, TINYFISH_KEYLESS_ACCESS_MODE } from './constants.js';
 import { ApiError } from './output.js';
+import { z } from 'zod';
 const VERIFY_TIMEOUT_MS = 5_000;
+const keylessInitializeSchema = z.object({
+    jsonrpc: z.literal('2.0'),
+    id: z.literal(1),
+    result: z.object({
+        capabilities: z.object({}),
+        serverInfo: z.object({ name: z.literal('tinyfish') }),
+    }),
+});
 // `fetch` collapses every network fault to "fetch failed" and hides the cause on `e.cause`.
 function networkCode(e) {
     const cause = e?.cause;
@@ -32,24 +42,34 @@ function authCode(e) {
         return 'rate limited';
     return e.status >= 500 ? 'TinyFish returned a server error' : `the API returned HTTP ${e.status}`;
 }
+function failedHealth(reason) {
+    return { depth: 'health', ok: false, reason, code: reason };
+}
 /** Reachability check. Verify failure is a warning, never install failure. */
-export async function verifyMcpHealth(mcpUrl) {
+export async function verifyMcpHealth(mcpUrl, keyless = false) {
     try {
         const response = await fetch(mcpUrl, {
-            method: 'GET',
+            method: keyless ? 'POST' : 'GET',
+            ...(keyless
+                ? {
+                    headers: {
+                        [TINYFISH_ACCESS_MODE_HEADER]: TINYFISH_KEYLESS_ACCESS_MODE,
+                        'Content-Type': 'application/json',
+                        Accept: 'application/json, text/event-stream',
+                    },
+                    body: '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18"}}',
+                }
+                : {}),
             // Redirect (captive portal, typo'd --url) is not healthy.
             redirect: 'error',
             signal: AbortSignal.timeout(VERIFY_TIMEOUT_MS),
         });
         // MCP rejects bare GET with 4xx — still proves endpoint routed.
-        if (response.status >= 500) {
-            return {
-                depth: 'health',
-                ok: false,
-                reason: `endpoint returned HTTP ${response.status}`,
-                code: `the endpoint returned HTTP ${response.status}`,
-            };
+        if (response.status >= 500 || (keyless && response.status !== 200)) {
+            return failedHealth(`endpoint returned HTTP ${response.status}`);
         }
+        if (keyless && !keylessInitializeSchema.safeParse(await response.json()).success)
+            return failedHealth('endpoint returned an invalid MCP initialize response');
         return { depth: 'health', ok: true };
     }
     catch (e) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiny-fish/cli",
-  "version": "0.42.1",
+  "version": "0.44.0",
   "description": "TinyFish CLI — run web automations from your terminal",
   "type": "module",
   "bin": {
@@ -35,7 +35,7 @@
     "format:check": "oxfmt --check ."
   },
   "dependencies": {
-    "@tiny-fish/sdk": "^0.6.0",
+    "@tiny-fish/sdk": "^0.7.0",
     "commander": "^12.0.0",
     "cross-spawn": "^7.0.6",
     "tldts": "^6.1.86",