@tiny-fish/cli 0.45.2-next.357 → 0.45.2-next.359

package/README.md

@@ -19,7 +19,7 @@ npx -y @tiny-fish/cli@latest connect
 ```
 
 It detects the agent configs on your machine (Claude Code, Codex, Cursor, Grok, Hermes,
-omp, OpenClaw, OpenCode) and opens a checklist with everything pre-selected. Press enter to connect
+Kilo Code, omp, OpenClaw, OpenCode) and opens a checklist with everything pre-selected. Press enter to connect
 them all, or use the arrow keys and space to narrow the set first; `q` cancels without touching
 anything. Terminals without raw-key support get a numbered prompt instead.
 

package/dist/commands/connect.js

@@ -15,7 +15,7 @@ function applyConfigDir(client, configDir) {
     if (client !== 'cline') {
         throw new Error('--config-dir is supported only by `tinyfish connect cline`.');
     }
-    const resolved = path.resolve(configDir);
+    const resolved = path.resolve(configDir); // nosemgrep: path-join-resolve-traversal -- the operator's own --config-dir, statted below
     let isDir = false;
     try {
         isDir = fs.statSync(resolved).isDirectory();

package/dist/lib/config/mcp-json-config.d.ts

@@ -10,6 +10,8 @@ export interface McpJsonTarget {
     };
     /** Cline nests url and headers under this key; every other harness is flat. */
     transportKey?: string;
+    /** Read-side only; OpenCode and its Kilo fork nest servers under `mcp`. */
+    serversKey?: string;
 }
 export interface McpJsonWriteResult {
     status: 'written' | 'unchanged' | 'corrupt_skip';

package/dist/lib/config/mcp-json-config.js

@@ -76,7 +76,7 @@ export function readTinyfishEntry(target) {
     if ('error' in existing) {
         return { present: false, hasApiKeyHeader: false, error: existing.error };
     }
-    const servers = existing.parsed.mcpServers;
+    const servers = existing.parsed[target.serversKey ?? 'mcpServers'];
     const entry = isPlainRecord(servers) ? servers[target.serverKey] : undefined;
     if (!isPlainRecord(entry))
         return { present: false, hasApiKeyHeader: false };

package/dist/lib/config/opencode-config.d.ts

@@ -0,0 +1,9 @@
+import { type Harness } from '../harness-detect.js';
+import { type McpJsonServerEntry } from './mcp-json-config.js';
+export type OpencodeStyleHarness = 'kilo' | 'opencode';
+/** Narrows before any path is built, so a future removal-less harness cannot borrow these. */
+export declare function isOpencodeStyle(harness: Harness): harness is OpencodeStyleHarness;
+/** The file on disk, else the `.jsonc` default so messages still name something. */
+export declare function opencodeStyleConfigPath(harness: OpencodeStyleHarness): string;
+/** Reports the header's shape, never its value. JSONC comments read as unparseable. */
+export declare function readOpencodeStyleEntry(harness: OpencodeStyleHarness): McpJsonServerEntry;

package/dist/lib/config/opencode-config.js

@@ -0,0 +1,34 @@
+// OpenCode and its Kilo fork share a config file the CLI reads but never writes.
+import * as fs from 'fs';
+import * as path from 'path';
+import { harnessConfigPath } from '../harness-detect.js';
+import { harnessSpec } from '../harness-spec.js';
+import { readTinyfishEntry, } from './mcp-json-config.js';
+/** Narrows before any path is built, so a future removal-less harness cannot borrow these. */
+export function isOpencodeStyle(harness) {
+    return harness === 'kilo' || harness === 'opencode';
+}
+/** Both extensions are valid; `mcp add` keeps whichever already exists. */
+const EXTENSIONS = ['.jsonc', '.json'];
+function candidatePaths(harness) {
+    const dir = harnessConfigPath(harness);
+    const stem = harnessSpec(harness).command;
+    return EXTENSIONS.map((ext) => path.join(dir, `${stem}${ext}`)); // nosemgrep: path-join-resolve-traversal -- fixed names from the harness spec
+}
+/** The file on disk, else the `.jsonc` default so messages still name something. */
+export function opencodeStyleConfigPath(harness) {
+    const candidates = candidatePaths(harness);
+    return candidates.find((file) => fs.existsSync(file)) ?? candidates[0];
+}
+function target(harness) {
+    return {
+        serverKey: 'tinyfish',
+        serversKey: 'mcp',
+        dir: () => harnessConfigPath(harness),
+        file: () => opencodeStyleConfigPath(harness),
+    };
+}
+/** Reports the header's shape, never its value. JSONC comments read as unparseable. */
+export function readOpencodeStyleEntry(harness) {
+    return readTinyfishEntry(target(harness));
+}

package/dist/lib/connect-all-uninstall.js

@@ -1,3 +1,4 @@
+import * as path from 'path';
 import { clearConnectContext, connectContextState } from './auth.js';
 import { NATIVE_BY_HARNESS, openclawSkillUninstall } from './connect-clients.js';
 import { ConnectInterruptedError, spawnRemoval } from './connect-runtime.js';
@@ -6,10 +7,9 @@ import { planOmpWrite, removeOmpMcpServer } from './config/omp-config.js';
 import { piMcpPath, planPiWrite, removePiMcpServer } from './config/pi-config.js';
 import { HERMES_KEY_VAR, hermesEnvPath, removeHermesKey, resolveHermesHome } from './hermes-env.js';
 import { clearHermesWebBackends } from './hermes-plugin.js';
-import { HARNESS_DISPLAY_NAMES as DISPLAY_NAMES } from './harness-detect.js';
+import { HARNESS_DISPLAY_NAMES as DISPLAY_NAMES, harnessDisplayPath, } from './harness-detect.js';
+import { isOpencodeStyle, opencodeStyleConfigPath } from './config/opencode-config.js';
 import { errLine } from './output.js';
-// OpenCode ships no `mcp remove`, so the only removal is editing the config it wrote.
-const OPENCODE_UNINSTALL_POINTER = 'remove the tinyfish entry from ~/.config/opencode/opencode.json';
 export function planText(harness, mcpUrl, apiKey) {
     if (harness === 'cursor')
         return planCursorWrite(mcpUrl, apiKey);
@@ -61,8 +61,14 @@ function uninstallRuns(harness) {
 /** Derived from the same args the spawn runs, so the advice cannot drift. */
 function uninstallPointer(harness) {
     const removal = uninstallRuns(harness);
-    if (!removal)
-        return OPENCODE_UNINSTALL_POINTER;
+    // No `mcp remove` ships, so the only removal is editing the config.
+    if (!removal) {
+        const file = isOpencodeStyle(harness)
+            ? `/${path.basename(opencodeStyleConfigPath(harness))}`
+            : "'s MCP config";
+        const where = `${harnessDisplayPath(harness)}${file}`;
+        return `remove the tinyfish entry from ${where}`;
+    }
     // `;` runs every removal but breaks cmd.exe; `&&` is the reverse — see
     // internal-docs/install-command-shell-quirks.md (PS 5.1 stays a known gap).
     const joiner = process.platform === 'win32' ? ' && ' : ' ; ';

package/dist/lib/connect-clients.d.ts

@@ -104,7 +104,7 @@ export declare function hermesRegistrationEnabled(home: string, mode?: 'api-key'
 };
 export declare const NATIVE_MCP_CLIENTS: readonly NativeMcpClient[];
 /** Native descriptor by harness id; Cursor and OpenClaw have none. */
-export declare const NATIVE_BY_HARNESS: Map<"openclaw" | "omp" | "grok" | "cursor" | "codex" | "hermes" | "command-code" | "opencode" | "pi" | "cline" | "claude-code", NativeMcpClient>;
+export declare const NATIVE_BY_HARNESS: Map<"openclaw" | "omp" | "grok" | "cursor" | "codex" | "hermes" | "command-code" | "kilo" | "opencode" | "pi" | "cline" | "claude-code", NativeMcpClient>;
 export declare const OPENCLAW: SupportedCommand;
 /** "printed" = handed to the user to paste; the walkthrough was never started for them. */
 export type WalkthroughOutcome = 'launched' | 'printed';

package/dist/lib/connect-clients.js

@@ -209,12 +209,12 @@ function installHermesWebPlugin({ apiKey, verbose, seededHome, }) {
     setHermesWebBackends(home);
     return pluginVersion;
 }
-// OpenCode's TUI takes a positional as a project directory, so a bare `opencode "<prompt>"`
-// would be read as a folder. The `--prompt` flag seeds the interactive TUI with a first message
+// These TUIs read a positional as a project directory, so a bare `<cmd> "<prompt>"` would be
+// read as a folder. `--prompt` seeds the interactive TUI with a first message
 // (opencode.ai/docs/cli), so the onboarding guide fires just like the other agents.
-function launchOpencode(prompt) {
-    handOverTerminal('opencode', ['--prompt', prompt], 'OpenCode');
-}
+const launchWithPromptFlag = (command, displayName) => (prompt) => {
+    handOverTerminal(command, ['--prompt', prompt], displayName);
+};
 // A bare `cline "<prompt>"` is a one-shot act run that auto-approves every tool, so it would
 // bill TinyFish calls unattended and cannot answer the walkthrough's questions. `-i` is the
 // only interactive mode.
@@ -286,7 +286,8 @@ const HARNESS_OVERRIDES = {
         seedKey: seedHermesKey,
         prepareKeylessInstall: prepareHermesKeylessInstall,
     },
-    opencode: { launchWalkthrough: launchOpencode },
+    kilo: { launchWalkthrough: launchWithPromptFlag('kilo', 'Kilo Code') },
+    opencode: { launchWalkthrough: launchWithPromptFlag('opencode', 'OpenCode') },
 };
 function toNativeClient(harness) {
     const spec = harnessSpec(harness);

package/dist/lib/doctor-report.d.ts

@@ -41,6 +41,7 @@ declare const doctorCheckSchema: z.ZodObject<{
         codex: "codex";
         hermes: "hermes";
         "command-code": "command-code";
+        kilo: "kilo";
         opencode: "opencode";
         pi: "pi";
         cline: "cline";
@@ -61,6 +62,7 @@ declare const doctorHarnessSchema: z.ZodObject<{
         codex: "codex";
         hermes: "hermes";
         "command-code": "command-code";
+        kilo: "kilo";
         opencode: "opencode";
         pi: "pi";
         cline: "cline";
@@ -91,6 +93,7 @@ declare const doctorRepairSchema: z.ZodObject<{
         codex: "codex";
         hermes: "hermes";
         "command-code": "command-code";
+        kilo: "kilo";
         opencode: "opencode";
         pi: "pi";
         cline: "cline";
@@ -130,6 +133,7 @@ export declare const doctorReportSchema: z.ZodObject<{
             codex: "codex";
             hermes: "hermes";
             "command-code": "command-code";
+            kilo: "kilo";
             opencode: "opencode";
             pi: "pi";
             cline: "cline";
@@ -150,6 +154,7 @@ export declare const doctorReportSchema: z.ZodObject<{
             codex: "codex";
             hermes: "hermes";
             "command-code": "command-code";
+            kilo: "kilo";
             opencode: "opencode";
             pi: "pi";
             cline: "cline";
@@ -180,6 +185,7 @@ export declare const doctorReportSchema: z.ZodObject<{
             codex: "codex";
             hermes: "hermes";
             "command-code": "command-code";
+            kilo: "kilo";
             opencode: "opencode";
             pi: "pi";
             cline: "cline";

package/dist/lib/harness-spec.d.ts

@@ -1,5 +1,5 @@
 /** Our skill-path slugs, inherited from the `skills` CLI era. */
-export type SkillAgent = 'claude-code' | 'cline' | 'codex' | 'command-code' | 'cursor' | 'hermes-agent' | 'opencode' | 'pi';
+export type SkillAgent = 'claude-code' | 'cline' | 'codex' | 'command-code' | 'cursor' | 'hermes-agent' | 'kilo' | 'opencode' | 'pi';
 export interface HarnessSupportCheck {
     args: string[];
     /** Missing → nothing can work; setup fails. */
@@ -237,6 +237,27 @@ export declare const HARNESS_SPECS: {
         postConnectNote: string;
         keyHeldByCli: true;
     };
+    kilo: {
+        command: string;
+        displayName: string;
+        configDir: string;
+        reloadAction: string;
+        skillAgent: "kilo";
+        nonInteractiveAdd: true;
+        supportCheck: {
+            args: string[];
+            patterns: RegExp[];
+            keyAuthPattern: RegExp;
+            unavailableMessage: string;
+        };
+        urlStyle: "flag";
+        keyRequired: true;
+        header: {
+            name: string;
+            sep: "=";
+        };
+        removals: never[];
+    };
     omp: {
         command: string;
         displayName: string;
@@ -307,4 +328,4 @@ export type NonNativeHarness = {
     [K in Harness]: 'urlStyle' extends keyof (typeof HARNESS_SPECS)[K] ? never : 'keyRequired' extends keyof (typeof HARNESS_SPECS)[K] ? never : K;
 }[Harness];
 /** Native MCP harnesses generate an add; key-only ones generate only the keyed form. */
-export declare const NATIVE_HARNESSES: ("openclaw" | "omp" | "grok" | "cursor" | "codex" | "hermes" | "command-code" | "opencode" | "pi" | "cline" | "claude-code")[];
+export declare const NATIVE_HARNESSES: ("openclaw" | "omp" | "grok" | "cursor" | "codex" | "hermes" | "command-code" | "kilo" | "opencode" | "pi" | "cline" | "claude-code")[];

package/dist/lib/harness-spec.js

@@ -45,6 +45,10 @@ const OPENCODE_MCP_ADD_UNAVAILABLE_MESSAGE = 'Could not confirm this OpenCode in
 const OPENCODE_MODEL_NOTE = 'Note: TinyFish runs on tool calls, so OpenCode needs a model that supports tool use. Image-only ' +
     'models (e.g. Nano Banana Pro) will show "No endpoints found that support tool use" — switch ' +
     "OpenCode's model if the walkthrough can't start.";
+const KILO_MCP_ADD_UNAVAILABLE_MESSAGE = 'Could not confirm this Kilo Code installation supports remote MCP servers: `kilo mcp add ' +
+    '--help` did not list `--url`. Update Kilo Code with `kilo upgrade` and retry, or add ' +
+    'TinyFish manually with `kilo mcp add`.' +
+    SUPPORT_CHECK_DEBUG_HINT;
 const HERMES_RESTART_NOTE = 'Restart your Hermes session to pick up TinyFish — Hermes discovers MCP servers at startup.';
 const CLINE_MCP_ADD_UNAVAILABLE_MESSAGE = 'Could not confirm this Cline installation supports non-interactive MCP setup: `cline mcp add ' +
     '--help` did not list `--transport` and `--yes`. Update Cline with `cline --update` and retry.' +
@@ -218,6 +222,28 @@ export const HARNESS_SPECS = {
         // No canVerifyAuth: keyed already covers auth; true breaks keyless installs.
         keyHeldByCli: true,
     },
+    // Kilo Code forks OpenCode, so the add flags, config shape and list renderer match it.
+    kilo: {
+        command: 'kilo',
+        displayName: 'Kilo Code',
+        configDir: '.config/kilo',
+        reloadAction: 'restart it',
+        skillAgent: 'kilo',
+        nonInteractiveAdd: true,
+        supportCheck: {
+            args: ['mcp', 'add', '--help'],
+            patterns: [/--url(?:\s|$)/m],
+            keyAuthPattern: HEADER_FLAG,
+            unavailableMessage: KILO_MCP_ADD_UNAVAILABLE_MESSAGE,
+        },
+        urlStyle: 'flag',
+        // `kilo mcp auth` exists, but a stored key skips the browser.
+        keyRequired: true,
+        // Kilo takes `--header NAME=VALUE`, not Claude Code's `NAME: VALUE`.
+        header: { name: 'X-API-Key', sep: '=' },
+        // `kilo mcp add` upserts by name and ships no `mcp remove`.
+        removals: [],
+    },
     omp: {
         command: 'omp',
         displayName: 'omp',

package/dist/lib/harness.js

@@ -28,6 +28,8 @@ const HARNESS_FINGERPRINTS = [
     { name: 'hermes', matches: (env) => hasVarWithPrefix(env, 'HERMES_') },
     // COMMANDCODE_SCRATCHPAD lands on every child; a disabled scratchpad leaves no marker.
     { name: 'command-code', matches: (env) => hasVarWithPrefix(env, 'COMMANDCODE_') },
+    // Kilo forks opencode and sets OPENCODE=1 too, so it must precede opencode.
+    { name: 'kilo', matches: (env) => env['KILO'] === '1' },
     // Exact key, not a prefix: opencode writes OPENCODE=1 at startup, reads every OPENCODE_* as config.
     { name: 'opencode', matches: (env) => Boolean(env['OPENCODE']) },
     // Observed: pi launched from Claude Code inherits CLAUDECODE=1.

package/dist/lib/registration-detect.js

@@ -10,7 +10,9 @@ import { readClineTinyfishEntry } from './config/cline-config.js';
 import { readCommandCodeTinyfishEntry } from './config/command-code-config.js';
 import { readCursorTinyfishEntry } from './config/cursor-config.js';
 import { readOmpTinyfishEntry } from './config/omp-config.js';
+import { readOpencodeStyleEntry } from './config/opencode-config.js';
 import { readPiTinyfishEntry } from './config/pi-config.js';
+import { harnessSpec } from './harness-spec.js';
 import { readHermesKey, resolveHermesHome } from './hermes-env.js';
 import { readHermesEntry } from './config/hermes-config.js';
 import { detectInstalledHarnesses, harnessConfigPath, harnessDisplayPath, AuthMode, Registered, } from './harness-detect.js';
@@ -382,8 +384,8 @@ function probePi() {
 // Exit 0 with output we cannot recognise is not evidence of absence: reporting `no` there would
 // earn a connect repair off a parse failure, which is the bug class this command exists to kill.
 const MCP_LIST_HEADER = /mcp servers/i;
-// OpenCode prints the endpoint on the line under the server row; Hermes truncates its column.
-const OPENCODE_ROW_URL = /^[^\w]*tinyfish(?![\w-]).*\n[^\w]*(https?:\S+)/m;
+// OpenCode and its Kilo fork print the endpoint under the row; Hermes truncates its column.
+const MCP_LIST_ROW_URL = /^[^\w]*tinyfish(?![\w-]).*\n[^\w]*(https?:\S+)/m;
 function fromMcpList(command, output, registeredMode, urlPattern) {
     if (LISTED_AS_TINYFISH.test(output)) {
         const url = urlPattern?.exec(output)?.[1];
@@ -444,15 +446,30 @@ function probeOpenClaw() {
         ? { registered: Registered.Yes, authMode: AuthMode.ApiKey, usesCliKey: true }
         : NOT_REGISTERED;
 }
-// `opencode mcp list` prints no headers, so a key-authed registration is indistinguishable.
-function probeOpencode() {
+// `mcp list` prints no headers, so the config file is the only place the key's shape shows.
+function configFileAuth(harness) {
+    const entry = readOpencodeStyleEntry(harness);
+    if (entry.error || !entry.present || !entry.hasApiKeyHeader)
+        return {};
+    return {
+        authMode: AuthMode.ApiKey,
+        ...(entry.keyMatchesCliKey ? { keyMatchesCliKey: true } : {}),
+    };
+}
+// `mcp list` resolves project config too, so it stays the registration source of truth.
+function probeMcpList(harness) {
+    const command = harnessSpec(harness).command;
     const args = ['mcp', 'list'];
-    const probe = runProbe('opencode', args);
+    const probe = runProbe(command, args);
     if (probe.outcome !== 'ran' || probe.exitCode !== 0) {
-        const reason = probeReason('opencode', args, probe);
+        const reason = probeReason(command, args, probe);
         return unverified(reason);
     }
-    return fromMcpList('opencode', probe.output, AuthMode.Unknown, OPENCODE_ROW_URL);
+    const listed = fromMcpList(command, probe.output, AuthMode.Unknown, MCP_LIST_ROW_URL);
+    if (listed.registered !== Registered.Yes)
+        return listed;
+    // A project-scoped entry is listed but absent here, so auth mode stays unknown.
+    return { ...listed, ...configFileAuth(harness) };
 }
 // Verified against grok 0.0.60: a list. Header values stay `unknown`; only names are read.
 const grokEntrySchema = z.looseObject({
@@ -545,9 +562,10 @@ const PROBES = {
     cursor: probeCursor,
     grok: probeGrok,
     hermes: probeHermes,
+    kilo: () => probeMcpList('kilo'),
     omp: probeOmp,
     openclaw: probeOpenClaw,
-    opencode: probeOpencode,
+    opencode: () => probeMcpList('opencode'),
     pi: probePi,
 };
 /** Never throws; a failed probe is `unknown` with a reason, so no caller can read it as healthy. */

package/dist/lib/setup-telemetry.d.ts

@@ -29,6 +29,7 @@ declare const harnessResultSchema: z.ZodObject<{
         codex: "codex";
         hermes: "hermes";
         "command-code": "command-code";
+        kilo: "kilo";
         opencode: "opencode";
         pi: "pi";
         cline: "cline";
@@ -66,6 +67,7 @@ export declare const setupCompletedPayloadSchema: z.ZodObject<{
             codex: "codex";
             hermes: "hermes";
             "command-code": "command-code";
+            kilo: "kilo";
             opencode: "opencode";
             pi: "pi";
             cline: "cline";
@@ -130,6 +132,7 @@ declare const doctorCompletedPayloadSchema: z.ZodObject<{
         codex: "codex";
         hermes: "hermes";
         "command-code": "command-code";
+        kilo: "kilo";
         opencode: "opencode";
         pi: "pi";
         cline: "cline";
@@ -146,6 +149,7 @@ declare const doctorCompletedPayloadSchema: z.ZodObject<{
         codex: "codex";
         hermes: "hermes";
         "command-code": "command-code";
+        kilo: "kilo";
         opencode: "opencode";
         pi: "pi";
         cline: "cline";
@@ -160,6 +164,7 @@ declare const doctorCompletedPayloadSchema: z.ZodObject<{
             codex: "codex";
             hermes: "hermes";
             "command-code": "command-code";
+            kilo: "kilo";
             opencode: "opencode";
             pi: "pi";
             cline: "cline";
@@ -203,6 +208,7 @@ declare const doctorCouldNotRunPayloadSchema: z.ZodObject<{
         codex: "codex";
         hermes: "hermes";
         "command-code": "command-code";
+        kilo: "kilo";
         opencode: "opencode";
         pi: "pi";
         cline: "cline";
@@ -242,6 +248,7 @@ declare const doctorPayloadSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
         codex: "codex";
         hermes: "hermes";
         "command-code": "command-code";
+        kilo: "kilo";
         opencode: "opencode";
         pi: "pi";
         cline: "cline";
@@ -258,6 +265,7 @@ declare const doctorPayloadSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
         codex: "codex";
         hermes: "hermes";
         "command-code": "command-code";
+        kilo: "kilo";
         opencode: "opencode";
         pi: "pi";
         cline: "cline";
@@ -272,6 +280,7 @@ declare const doctorPayloadSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
             codex: "codex";
             hermes: "hermes";
             "command-code": "command-code";
+            kilo: "kilo";
             opencode: "opencode";
             pi: "pi";
             cline: "cline";
@@ -314,6 +323,7 @@ declare const doctorPayloadSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
         codex: "codex";
         hermes: "hermes";
         "command-code": "command-code";
+        kilo: "kilo";
         opencode: "opencode";
         pi: "pi";
         cline: "cline";

package/dist/lib/skill-paths.js

@@ -19,6 +19,8 @@ const SKILL_DIR_BY_AGENT = {
     // Not the canonical dir: `skills` writes this one under the harness's own config dir.
     'command-code': () => path.join(os.homedir(), '.commandcode', 'skills'), // nosemgrep: path-join-resolve-traversal -- fixed dir names under os.homedir()
     cursor: canonicalSkillsDir,
+    // Verified with `kilo debug skill`: Kilo scans the canonical dir too.
+    kilo: canonicalSkillsDir,
     opencode: canonicalSkillsDir,
     // `skills` writes pi's here whatever PI_CODING_AGENT_DIR says.
     pi: () => path.join(os.homedir(), '.pi', 'agent', 'skills'), // nosemgrep: path-join-resolve-traversal -- fixed dir names under os.homedir()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiny-fish/cli",
-  "version": "0.45.2-next.357",
+  "version": "0.45.2-next.359",
   "description": "TinyFish CLI — run web automations from your terminal",
   "type": "module",
   "bin": {