@tiny-fish/cli 0.44.0 → 0.45.0

package/dist/commands/connect.js

@@ -399,15 +399,12 @@ async function runPostInstallSteps(client, options, state, telemetry, signInDefe
         }
         if (client.extraPostInstall && state.authMode !== AuthMode.Keyless) {
             await attempt('plugin_install', () => {
-                client.extraPostInstall?.({
+                const pluginVersion = client.extraPostInstall?.({
                     apiKey: validatedApiKey(options.apiKey),
                     verbose: options.verbose ?? false,
                     seededHome,
                 });
-                telemetry.track('checkpoint', {
-                    phase: 'plugin_installed',
-                    pluginVersion: client.pluginVersion,
-                });
+                telemetry.track('checkpoint', { phase: 'plugin_installed', pluginVersion });
             });
         }
         if (state.authMode !== AuthMode.Keyless) {

package/dist/commands/doctor.js

@@ -8,16 +8,12 @@ import { err, errLine, out, outLine } from '../lib/output.js';
 import { detectRegistrations } from '../lib/registration-detect.js';
 import { sendDoctorCompleted } from '../lib/setup-telemetry.js';
 import { verifyMcpAuth } from '../lib/verify.js';
-import { HERMES_PLUGIN_VERSION } from '../lib/hermes-plugin.js';
 import { DEFAULT_MCP_URL } from '../lib/mcp-endpoint.js';
-/** Skips mean no Hermes; stamping those buries the drift share. */
+/** Skips mean no Hermes; stamping those buries the installed share. */
 function hermesPluginVersions(result) {
     if (!result || result.check.status === 'skip')
         return {};
-    return {
-        hermes_plugin_expected_version: HERMES_PLUGIN_VERSION,
-        ...(result.observedVersion ? { hermes_plugin_version: result.observedVersion } : {}),
-    };
+    return result.observedVersion ? { hermes_plugin_version: result.observedVersion } : {};
 }
 export async function runDoctor(options) {
     const statuses = detectRegistrations(options.harness ? [options.harness] : undefined);

package/dist/lib/connect-all-uninstall.js

@@ -5,7 +5,7 @@ import { removeCursorMcpServer, planCursorWrite } from './cursor-config.js';
 import { planOmpWrite, removeOmpMcpServer } from './omp-config.js';
 import { piMcpPath, planPiWrite, removePiMcpServer } from './pi-config.js';
 import { HERMES_KEY_VAR, hermesEnvPath, removeHermesKey, resolveHermesHome } from './hermes-env.js';
-import { clearHermesWebBackends, HERMES_PLUGIN_SHA } from './hermes-plugin.js';
+import { clearHermesWebBackends } from './hermes-plugin.js';
 import { HARNESS_DISPLAY_NAMES as DISPLAY_NAMES } from './harness-detect.js';
 import { errLine } from './output.js';
 // OpenCode ships no `mcp remove`, so the only removal is editing the config it wrote.
@@ -19,8 +19,8 @@ export function planText(harness, mcpUrl, apiKey) {
         return planPiWrite(mcpUrl, apiKey);
     if (harness === 'hermes' && apiKey) {
         return (`would run \`tinyfish connect hermes\` (harness-owned MCP write; the CLI writes ` +
-            `${HERMES_KEY_VAR} to Hermes' .env, installs the tinyfish plugin at ` +
-            `${HERMES_PLUGIN_SHA.slice(0, 12)}, and points its web backends at tinyfish)`);
+            `${HERMES_KEY_VAR} to Hermes' .env, installs the tinyfish plugin from npm @latest, ` +
+            `and points its web backends at tinyfish)`);
     }
     if (harness === 'hermes') {
         return 'would run `tinyfish connect hermes` (writes a keyless MCP header; no credential or plugin write)';

package/dist/lib/connect-clients.d.ts

@@ -65,9 +65,7 @@ interface BaseMcpClient extends SupportedCommand, Pick<HarnessSpec, 'skillAgent'
         apiKey?: string;
         verbose: boolean;
         seededHome?: string;
-    }) => void;
-    /** Pin `extraPostInstall` installs, reported on the plugin_installed checkpoint. */
-    pluginVersion?: string;
+    }) => string | undefined;
     /** Extra --uninstall row beyond `removals`; never runs pre-add. */
     uninstallExtra?: {
         args: string[];

package/dist/lib/connect-clients.js

@@ -8,7 +8,7 @@ import { TINYFISH_ACCESS_MODE_HEADER, TINYFISH_API_KEY_VAR, TINYFISH_KEYLESS_ACC
 import { HARNESS_SPECS, NATIVE_HARNESSES, harnessSpec, } from './harness-spec.js';
 import { HERMES_KEY_VAR, captureHermesKeyRestore, hermesEnvPath, resolveHermesHome, writeHermesKey, } from './hermes-env.js';
 import { hermesConfigPath, readHermesEntry } from './hermes-config.js';
-import { HERMES_PLUGIN_VERSION, installHermesPlugin, removeHermesMcpEntry, setHermesWebBackends, writeHermesMcpEntry, } from './hermes-plugin.js';
+import { installHermesPlugin, removeHermesMcpEntry, setHermesWebBackends, writeHermesMcpEntry, } from './hermes-plugin.js';
 const HERMES_SEED_TIMEOUT_MS = 120_000;
 const OPENCLAW_SKILL = '@tinyfish/tinyfish';
 // --force makes this an unconditional overwrite, so the same call installs and refreshes.
@@ -205,8 +205,9 @@ function installHermesWebPlugin({ apiKey, verbose, seededHome, }) {
     }
     // Reuses the seed's home: a second `hermes dump` can disagree with the first.
     const home = seededHome ?? requireHermesHome();
-    installHermesPlugin(home, apiKey, { verbose });
+    const pluginVersion = installHermesPlugin(home, apiKey, { verbose });
     setHermesWebBackends(home);
+    return pluginVersion;
 }
 // OpenCode's TUI takes a positional as a project directory, so a bare `opencode "<prompt>"`
 // would be read as a folder. The `--prompt` flag seeds the interactive TUI with a first message
@@ -275,7 +276,6 @@ const HARNESS_OVERRIDES = {
     hermes: {
         launchWalkthrough: launchHermesWalkthrough,
         extraPostInstall: installHermesWebPlugin,
-        pluginVersion: HERMES_PLUGIN_VERSION,
         seedKey: seedHermesKey,
         prepareKeylessInstall: prepareHermesKeylessInstall,
     },
@@ -310,7 +310,6 @@ function toNativeClient(harness) {
         detachedLaunch: overrides.detachedLaunch,
         postConnectNote: spec.postConnectNote,
         extraPostInstall: overrides.extraPostInstall,
-        pluginVersion: overrides.pluginVersion,
         uninstallExtra: spec.uninstallExtra,
     };
     if (spec.keyRequired) {

package/dist/lib/doctor-report.d.ts

@@ -165,7 +165,6 @@ export declare const doctorReportSchema: z.ZodObject<{
         unattended_safe: z.ZodBoolean;
     }, z.core.$strip>>;
     hermes_plugin_version: z.ZodOptional<z.ZodString>;
-    hermes_plugin_expected_version: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type CheckStatus = z.infer<typeof checkStatusSchema>;
 export type CheckScope = z.infer<typeof checkScopeSchema>;

package/dist/lib/doctor-report.js

@@ -48,7 +48,6 @@ export const doctorReportSchema = z
     repairs: z.array(doctorRepairSchema),
     // Unbounded like cli_version: a throw here exits 2 unnecessarily.
     hermes_plugin_version: z.string().optional(),
-    hermes_plugin_expected_version: z.string().optional(),
 })
     // Claiming ok while that scope failed is worse than no report.
     .refine((report) => !report.ok_harnesses || !hasFailure(report.checks, 'harness'), {

package/dist/lib/doctor-telemetry.js

@@ -41,9 +41,6 @@ export function telemetryPayload(report, offered, outcomes, options, durationMs)
         ...(report.hermes_plugin_version
             ? { hermes_plugin_version: report.hermes_plugin_version }
             : {}),
-        ...(report.hermes_plugin_expected_version
-            ? { hermes_plugin_expected_version: report.hermes_plugin_expected_version }
-            : {}),
     };
 }
 /** Both paths send keyless when there is no key; the route records those anonymously. */

package/dist/lib/hermes-plugin.d.ts

@@ -1,9 +1,8 @@
 import { z } from 'zod';
 import { type InstallOptions } from './cli-install.js';
-export declare const HERMES_PLUGIN_SHA = "496cd63fefd982bbaa8a85ce78ef2270d700984f";
-export declare const HERMES_PLUGIN_VERSION = "0.1.0";
-export declare const HERMES_PLUGIN_MANUAL_INSTALL = "hermes plugins install tinyfish-io/tinyfish-web-agent-integrations/hermes --ref 496cd63fefd982bbaa8a85ce78ef2270d700984f --enable";
-export declare function installHermesPlugin(home: string, apiKey: string, { verbose }: Pick<InstallOptions, 'verbose'>): void;
+export declare const HERMES_PLUGIN_PACKAGE = "@tiny-fish/hermes";
+export declare const HERMES_PLUGIN_MANUAL_INSTALL = "hermes plugins install tinyfish-io/tinyfish-web-agent-integrations/hermes --enable";
+export declare function installHermesPlugin(home: string, apiKey: string, { verbose }: Pick<InstallOptions, 'verbose'>): string | undefined;
 /** Absent `enabled` reads as enabled, so never write this field-by-field. */
 export declare function writeHermesMcpEntry(home: string, mcpUrl: string, mode?: 'api-key' | 'keyless'): void;
 /** Retracts our row; an absent `enabled` reads as enabled, so a partial one is live. */

package/dist/lib/hermes-plugin.js

@@ -9,16 +9,12 @@ import { commandNotFound, ConnectStepError, spawnStepError, throwIfInterrupted,
 import { HARNESS_PROBE_TIMEOUT_MS, TINYFISH_ACCESS_MODE_HEADER, TINYFISH_KEYLESS_ACCESS_MODE, } from './constants.js';
 import { HERMES_HEADER_TEMPLATE, HERMES_MCP_SERVER_KEY } from './hermes-config.js';
 import { errLine, parseJson } from './output.js';
-// Bump per CLI release.
-export const HERMES_PLUGIN_SHA = '496cd63fefd982bbaa8a85ce78ef2270d700984f';
-// Bump with the SHA; the source is `hermes/plugin.yaml` at that commit.
-export const HERMES_PLUGIN_VERSION = '0.1.0';
-// Manifest `name:`, not the repo subdir; `plugins uninstall` keys on it.
-const PLUGIN_SOURCE = 'tinyfish-io/tinyfish-web-agent-integrations/hermes';
-const PLUGIN_REPO_URL = 'https://github.com/tinyfish-io/tinyfish-web-agent-integrations.git';
-export const HERMES_PLUGIN_MANUAL_INSTALL = `hermes plugins install ${PLUGIN_SOURCE} --ref ${HERMES_PLUGIN_SHA} --enable`;
-// Anchored to --ref: another rejected flag would fail the clone path too.
+// Resolved at connect time, so plugin releases need no CLI release.
+export const HERMES_PLUGIN_PACKAGE = '@tiny-fish/hermes';
+// Anchored to --ref: an older Hermes rejects the flag and needs the plain URL.
 const REF_UNSUPPORTED_PATTERN = /unrecognized arguments:[^\n]*--ref/;
+// Tracks the repo head; npm @latest can trail a merge by one publish run.
+export const HERMES_PLUGIN_MANUAL_INSTALL = 'hermes plugins install tinyfish-io/tinyfish-web-agent-integrations/hermes --enable';
 function installSpawnEnv(home, apiKey) {
     // Hermes' install-time requires_env check reads os.environ, not our .env seed.
     return { ...process.env, HERMES_HOME: home, TINYFISH_API_KEY: apiKey };
@@ -42,42 +38,102 @@ function runGit(args) {
         timeout: SKILL_INSTALL_TIMEOUT_MS,
     });
     if (!result.error && result.status === 0)
-        return;
+        return result;
     if (commandNotFound(result.error)) {
-        throw new ConnectStepError('git is required to stage the pinned plugin; install git and run connect again', 'command_not_found');
+        throw new ConnectStepError('git is required to stage the plugin for Hermes; install git and run connect again', 'command_not_found');
     }
     // Built first: its interrupt check must run before any replay.
     const error = spawnStepError('Could not stage the TinyFish Hermes plugin', result);
     replay(capturedOutput(result));
     throw error;
 }
-// Pre-`--ref` Hermes: stage the pin ourselves, mirroring `--ref` internals.
-function installFromClone(env) {
-    const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'tinyfish-hermes-plugin-'));
+function runNpmDownload(tmp) {
+    // --prefix both downloads and extracts, so no tar dependency anywhere.
+    const result = spawn.sync('npm', [
+        'install',
+        `${HERMES_PLUGIN_PACKAGE}@latest`,
+        '--prefix',
+        tmp,
+        // Lifecycle scripts would run arbitrary code with the key in env.
+        '--ignore-scripts',
+        '--no-save',
+        '--no-audit',
+        '--no-fund',
+        '--loglevel=error',
+    ], { encoding: 'utf8', maxBuffer: STEP_MAX_BUFFER, timeout: SKILL_INSTALL_TIMEOUT_MS });
+    if (!result.error && result.status === 0)
+        return;
+    if (commandNotFound(result.error)) {
+        throw new ConnectStepError(`npm is required to download the TinyFish Hermes plugin; to install it yourself run: ${HERMES_PLUGIN_MANUAL_INSTALL}`, 'command_not_found');
+    }
+    // Built first: its interrupt check must run before any replay.
+    const error = spawnStepError(`Could not download ${HERMES_PLUGIN_PACKAGE} from npm; to install it yourself run: ${HERMES_PLUGIN_MANUAL_INSTALL}`, result);
+    replay(capturedOutput(result));
+    throw error;
+}
+function stagedPluginVersion(dir) {
     try {
-        runGit(['clone', '--depth', '1', PLUGIN_REPO_URL, tmp]);
-        runGit(['-C', tmp, 'fetch', '--depth', '1', 'origin', HERMES_PLUGIN_SHA]);
-        runGit(['-C', tmp, 'checkout', '--detach', HERMES_PLUGIN_SHA]);
-        return runPluginInstall([`${pathToFileURL(tmp).href}#hermes`], env);
+        const parsed = JSON.parse(fs.readFileSync(path.join(dir, 'package.json'), 'utf8'));
+        const version = parsed.version;
+        return typeof version === 'string' && version ? version : undefined;
     }
-    finally {
-        fs.rmSync(tmp, { recursive: true, force: true });
+    catch {
+        return undefined;
     }
 }
+// Hermes installs plugins only by git clone, so the payload gets a throwaway repo.
+function stagePluginFromNpm(tmp) {
+    runNpmDownload(tmp);
+    const dir = path.join(tmp, 'node_modules', ...HERMES_PLUGIN_PACKAGE.split('/'));
+    // Empty hooksPath: a global hooks dir or init template must not run here.
+    const hooksDir = path.join(tmp, 'git-hooks');
+    fs.mkdirSync(hooksDir);
+    runGit(['-C', dir, 'init', '--quiet']);
+    runGit(['-C', dir, 'add', '-A']);
+    // Inline identity: fresh machines have no git config and commit fails without it.
+    runGit([
+        '-C',
+        dir,
+        '-c',
+        `core.hooksPath=${hooksDir}`,
+        '-c',
+        'user.name=tinyfish-cli',
+        '-c',
+        'user.email=support@tinyfish.io',
+        'commit',
+        '--quiet',
+        // A global commit.gpgSign would summon a signer this commit must not need.
+        '--no-gpg-sign',
+        '-m',
+        'stage @tiny-fish/hermes for install',
+    ]);
+    const sha = String(runGit(['-C', dir, 'rev-parse', 'HEAD']).stdout ?? '').trim();
+    return { dir, sha, version: stagedPluginVersion(dir) };
+}
 export function installHermesPlugin(home, apiKey, { verbose }) {
     errLine('Installing the TinyFish web plugin in Hermes...');
     const env = installSpawnEnv(home, apiKey);
-    // --ref always: a same-source reinstall without it keeps the previous pin.
-    const primary = runPluginInstall([PLUGIN_SOURCE, '--ref', HERMES_PLUGIN_SHA], env);
-    const result = refUnsupported(primary) ? installFromClone(env) : primary;
-    if (result.error || result.status !== 0) {
-        // A declined security scan exits 1 here, and reconnecting repeats it.
-        const error = spawnStepError(`Could not install the TinyFish web plugin in Hermes; to install it yourself run: ${HERMES_PLUGIN_MANUAL_INSTALL}`, result);
-        replay(capturedOutput(result));
-        throw error;
+    const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'tinyfish-hermes-plugin-'));
+    try {
+        const staged = stagePluginFromNpm(tmp);
+        const url = pathToFileURL(staged.dir).href;
+        // --ref: a prior pinned install rejects an unpinned reinstall of the same name.
+        const primary = runPluginInstall([url, '--ref', staged.sha], env);
+        // A pre---ref Hermes never pins, so the plain URL is safe there.
+        const result = refUnsupported(primary) ? runPluginInstall([url], env) : primary;
+        if (result.error || result.status !== 0) {
+            // A declined security scan exits 1 here, and reconnecting repeats it.
+            const error = spawnStepError(`Could not install the TinyFish web plugin in Hermes; to install it yourself run: ${HERMES_PLUGIN_MANUAL_INSTALL}`, result);
+            replay(capturedOutput(result));
+            throw error;
+        }
+        if (verbose)
+            replay(capturedOutput(result));
+        return staged.version;
+    }
+    finally {
+        fs.rmSync(tmp, { recursive: true, force: true });
     }
-    if (verbose)
-        replay(capturedOutput(result));
 }
 function hermesConfig(args, home) {
     return spawn.sync('hermes', ['config', ...args], {

package/dist/lib/setup-telemetry.d.ts

@@ -173,7 +173,6 @@ declare const doctorCompletedPayloadSchema: z.ZodObject<{
     }, z.core.$strip>>;
     duration_ms: z.ZodInt;
     hermes_plugin_version: z.ZodOptional<z.ZodString>;
-    hermes_plugin_expected_version: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 declare const doctorCouldNotRunPayloadSchema: z.ZodObject<{
     outcome: z.ZodLiteral<"could_not_run">;
@@ -282,7 +281,6 @@ declare const doctorPayloadSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     }, z.core.$strip>>;
     duration_ms: z.ZodInt;
     hermes_plugin_version: z.ZodOptional<z.ZodString>;
-    hermes_plugin_expected_version: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
     outcome: z.ZodLiteral<"could_not_run">;
     error_class: z.ZodEnum<{

package/dist/lib/setup-telemetry.js

@@ -272,7 +272,6 @@ const doctorCompletedPayloadSchema = z.object({
     duration_ms: z.int().nonnegative().max(3_600_000),
     /** Bounded here, not on the report: a reject drops only telemetry. */
     hermes_plugin_version: versionSchema.optional(),
-    hermes_plugin_expected_version: versionSchema.optional(),
 });
 // Detection threw, so there is no report to aggregate: enumerated outcome and timing only.
 const doctorCouldNotRunPayloadSchema = z.object({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiny-fish/cli",
-  "version": "0.44.0",
+  "version": "0.45.0",
   "description": "TinyFish CLI — run web automations from your terminal",
   "type": "module",
   "bin": {