@tiny-fish/cli 0.47.2-next.375 → 0.47.2-next.377

package/dist/commands/profile.js

@@ -3,9 +3,9 @@ import * as os from 'os';
 import * as path from 'path';
 import { createRequire } from 'module';
 import { z } from 'zod';
-import { getApiKey } from '../lib/auth.js';
+import { getResolvedApiKey, rejectedKeyHint } from '../lib/auth.js';
 import { deriveChromeKey, listAuthRelevantHostKeys, openCookiesDb, readCookiesForHost, } from '../lib/chrome-cookies.js';
-import { profileCreate, profileUpload } from '../lib/client.js';
+import { profileCreate, profileGet, profileList, profileUpload } from '../lib/client.js';
 import { err, errLine, handleApiError, out, outLine } from '../lib/output.js';
 // ── Helpers ───────────────────────────────────────────────────────────────────
 const chromeLocalStateSchema = z.object({
@@ -19,7 +19,7 @@ function getChromeRoot() {
     if (platform === 'linux') {
         return path.join(os.homedir(), '.config', 'google-chrome');
     }
-    // Windows guard — handled in withCookiesDb
+    // Windows guard — handled in resolveCookiesPath
     return '';
 }
 function sanitizeChromeProfile(profile) {
@@ -28,14 +28,53 @@ function sanitizeChromeProfile(profile) {
     }
     return profile;
 }
+class ChromePathOutsideError extends Error {
+    constructor() {
+        super('Chrome data path resolves outside the Chrome data directory');
+    }
+}
 function assertChromePathContained(targetPath) {
     const chromeRoot = fs.realpathSync(getChromeRoot());
     const resolvedTarget = fs.realpathSync(targetPath);
     const relative = path.relative(chromeRoot, resolvedTarget);
     if (relative === '..' || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
-        throw new Error('Chrome data path resolves outside the Chrome data directory');
+        throw new ChromePathOutsideError();
     }
 }
+function isContainedCookiesFile(cookiesPath) {
+    try {
+        if (!fs.lstatSync(cookiesPath).isFile())
+            return false;
+        assertChromePathContained(cookiesPath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function listChromeProfilesWithCookies(chromeRoot) {
+    try {
+        return (fs
+            .readdirSync(chromeRoot, { withFileTypes: true })
+            .filter((entry) => entry.isDirectory())
+            .map((entry) => entry.name)
+            // nosemgrep: path-join-resolve-traversal -- readdir names, result containment-checked
+            .filter((name) => isContainedCookiesFile(path.join(chromeRoot, name, 'Cookies')))
+            .sort());
+    }
+    catch {
+        return [];
+    }
+}
+function availableProfilesHint(chromeRoot) {
+    const names = listChromeProfilesWithCookies(chromeRoot);
+    return names.length > 0
+        ? `Available Chrome profiles: ${names.join(', ')}.`
+        : 'No Chrome profiles with a Cookies file were found.';
+}
+function chromeProfileError(chromeRoot, reason) {
+    return new Error(`${reason} Use --chrome-profile to select a profile. ${availableProfilesHint(chromeRoot)}`);
+}
 function getChromeCookiesPath(requestedProfile) {
     const chromeRoot = getChromeRoot();
     if (requestedProfile !== undefined) {
@@ -49,26 +88,28 @@ function getChromeCookiesPath(requestedProfile) {
         if (error.code === 'ENOENT') {
             return path.join(chromeRoot, 'Default', 'Cookies');
         }
-        throw error;
+        throw chromeProfileError(chromeRoot, 'Could not read Chrome profile state.');
     }
+    let lastUsed;
     try {
         assertChromePathContained(localStatePath);
+        lastUsed = chromeLocalStateSchema.parse(JSON.parse(fs.readFileSync(localStatePath, 'utf8')))
+            .profile?.last_used;
     }
     catch (error) {
-        if (error.code === 'ENOENT') {
-            throw new Error('Could not read Chrome profile state. Use --chrome-profile to select a profile.');
-        }
-        throw error;
+        const reason = error instanceof ChromePathOutsideError
+            ? `${error.message}.`
+            : 'Could not read Chrome profile state.';
+        throw chromeProfileError(chromeRoot, reason);
     }
+    // Chrome writes last_used only after a profile switch.
+    if (!lastUsed)
+        return path.join(chromeRoot, 'Default', 'Cookies');
     try {
-        const localState = chromeLocalStateSchema.parse(JSON.parse(fs.readFileSync(localStatePath, 'utf8')));
-        const lastUsed = localState.profile?.last_used;
-        if (!lastUsed)
-            throw new Error('missing last-used profile');
         return path.join(chromeRoot, sanitizeChromeProfile(lastUsed), 'Cookies');
     }
     catch {
-        throw new Error('Could not read Chrome profile state. Use --chrome-profile to select a profile.');
+        throw chromeProfileError(chromeRoot, 'Chrome profile state names an invalid profile.');
     }
 }
 function validateDomain(domain) {
@@ -77,16 +118,22 @@ function validateDomain(domain) {
         process.exit(1);
     }
 }
-// Opens a private copy of Chrome's cookie DB, derives the decryption key, and calls fn.
-function withCookiesDb(chromeProfile, fn) {
+// Local checks only; must not touch the keychain or read cookies.
+function resolveCookiesPath(chromeProfile) {
     if (process.platform === 'win32') {
         throw new Error('Cookie extraction is not supported on Windows yet');
     }
     const cookiesPath = getChromeCookiesPath(chromeProfile);
     if (!fs.existsSync(cookiesPath)) {
-        throw new Error(`Chrome cookies file not found at ${cookiesPath}. Use --chrome-profile to select another Chrome profile.`);
+        throw chromeProfileError(getChromeRoot(), `Chrome cookies file not found at ${cookiesPath}.`);
     }
     assertChromePathContained(cookiesPath);
+    return cookiesPath;
+}
+// Opens a private copy of Chrome's cookie DB, derives the decryption key, and calls fn.
+function withCookiesDb(cookiesPath, fn) {
+    // Recheck: the preflight await lets the path be swapped.
+    assertChromePathContained(cookiesPath);
     // Copy the DB out of the profile directory so we avoid the Chrome file lock.
     const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'tinyfish-chrome-cookies-'));
     let db;
@@ -124,11 +171,11 @@ function withCookiesDb(chromeProfile, fn) {
         }
     }
 }
-function extractChromeCookies(domain, chromeProfile, stats) {
-    return withCookiesDb(chromeProfile, (db, key) => readCookiesForHost(db, key, domain, stats));
+function extractChromeCookies(domain, cookiesPath, stats) {
+    return withCookiesDb(cookiesPath, (db, key) => readCookiesForHost(db, key, domain, stats));
 }
-function extractAllChromeCookies(chromeProfile, stats) {
-    return withCookiesDb(chromeProfile, (db, key) => {
+function extractAllChromeCookies(cookiesPath, stats) {
+    return withCookiesDb(cookiesPath, (db, key) => {
         let hostKeys;
         try {
             hostKeys = listAuthRelevantHostKeys(db);
@@ -214,13 +261,13 @@ function printPrettyProfileUpload(result) {
     outLine(`Cookies uploaded: ${result.cookie_count}`);
     outLine(`Domains updated:  ${result.domains_updated.join(', ')}`);
 }
-function extractCookiesOrThrow(opts) {
+function extractCookiesOrThrow(opts, cookiesPath) {
     // Extract cookies before creating profile to avoid orphan profiles
     // if extraction fails (Windows, no Chrome, no cookies).
     const stats = { keyringSkipped: 0 };
     const cookies = opts.allDomains
-        ? extractAllChromeCookies(opts.chromeProfile, stats)
-        : extractChromeCookies(opts.domain, opts.chromeProfile, stats);
+        ? extractAllChromeCookies(cookiesPath, stats)
+        : extractChromeCookies(opts.domain, cookiesPath, stats);
     // Warn even on partial success — surviving plaintext rows can mask
     // that every auth cookie was keyring-encrypted and skipped.
     if (stats.keyringSkipped > 0) {
@@ -235,6 +282,13 @@ function extractCookiesOrThrow(opts) {
     }
     return cookies;
 }
+// Fails a bad key or profile before the keychain prompt.
+async function verifyImportTarget(profileId, apiKey) {
+    if (profileId === undefined)
+        await profileList(apiKey);
+    else
+        await profileGet(profileId, apiKey);
+}
 // Exported for testing
 export async function uploadAllDomains(profileId, cookies, apiKey) {
     // Batch upload — never split a canonical domain across chunks
@@ -270,7 +324,7 @@ export function registerProfile(program) {
         .requiredOption('--name <name>', 'Profile name')
         .option('--pretty', 'Human-readable output')
         .action(async (opts) => {
-        const apiKey = getApiKey();
+        const { key: apiKey, source } = getResolvedApiKey();
         try {
             const response = await profileCreate(opts.name, apiKey);
             if (opts.pretty) {
@@ -281,7 +335,7 @@ export function registerProfile(program) {
             }
         }
         catch (error) {
-            handleApiError(error);
+            handleApiError(error, rejectedKeyHint(source));
         }
     });
     profileCmd
@@ -289,7 +343,7 @@ export function registerProfile(program) {
         .description('Import Chrome cookies into a profile. Use --domain for a single domain or --all-domains for every domain in your Chrome profile. Exactly one must be provided.')
         .option('--domain <domain>', 'Domain to import cookies for (e.g. github.com)')
         .option('--all-domains', 'Import cookies for all registrable domains (e.g. github.com) found in your Chrome profile. IPs and non-resolvable hostnames (e.g. localhost) are skipped.')
-        .option('--chrome-profile <name>', 'Chrome profile directory (auto-detects the last-used profile by default)')
+        .option('--chrome-profile <name>', 'Chrome profile directory, e.g. "Profile 1" (default: last-used profile, else Default)')
         .option('--profile-id <id>', 'Profile ID to import cookies into (creates new profile if omitted)')
         .option('--pretty', 'Human-readable output')
         .action(async (opts) => {
@@ -302,13 +356,15 @@ export function registerProfile(program) {
             err({ error: 'Provide exactly one of --domain or --all-domains' });
             process.exit(1);
         }
-        const apiKey = getApiKey();
+        const { key: apiKey, source } = getResolvedApiKey();
         if (opts.domain) {
             validateDomain(opts.domain);
         }
         let profileId = opts.profileId;
         try {
-            const cookies = extractCookiesOrThrow(opts);
+            const cookiesPath = resolveCookiesPath(opts.chromeProfile);
+            await verifyImportTarget(profileId, apiKey);
+            const cookies = extractCookiesOrThrow(opts, cookiesPath);
             if (profileId === undefined) {
                 const name = opts.allDomains ? 'chrome-import' : opts.domain;
                 const created = await profileCreate(name, apiKey);
@@ -329,7 +385,7 @@ export function registerProfile(program) {
             }
         }
         catch (error) {
-            handleApiError(error);
+            handleApiError(error, rejectedKeyHint(source));
         }
     });
 }

package/dist/lib/auth.d.ts

@@ -70,4 +70,7 @@ export declare function validatedApiKey(explicitApiKey?: string): string | undef
  * rather than exit like getApiKey does.
  */
 export declare function apiKeyStatus(explicitApiKey?: string): ResolvedKey | UnresolvedKey;
+export declare function getResolvedApiKey(): ResolvedKey;
 export declare function getApiKey(): string;
+/** 401 repair hint that names where the rejected key came from. */
+export declare function rejectedKeyHint(source: ResolvedKey['source']): string | undefined;

package/dist/lib/auth.js

@@ -319,10 +319,23 @@ export function apiKeyStatus(explicitApiKey) {
     }
     return { key: value, source };
 }
-export function getApiKey() {
+export function getResolvedApiKey() {
     const resolved = apiKeyStatus();
     if ('key' in resolved)
-        return resolved.key;
+        return resolved;
     err({ error: resolved.error });
     process.exit(1);
 }
+export function getApiKey() {
+    return getResolvedApiKey().key;
+}
+/** 401 repair hint that names where the rejected key came from. */
+export function rejectedKeyHint(source) {
+    if (source === 'env') {
+        return `The rejected key came from the ${TINYFISH_API_KEY_VAR} environment variable, which overrides the key saved by \`tinyfish auth login\`. Unset it (check your shell profile) or set it to a valid key, then try again.`;
+    }
+    if (source === 'config') {
+        return 'The rejected key is the one saved by `tinyfish auth login`. Run `tinyfish auth login` to save a new key, then try again.';
+    }
+    return undefined;
+}

package/dist/lib/client.d.ts

@@ -1,5 +1,5 @@
 import { type AgentRunAsyncResponse, type AgentRunResponse, type AgentRunWithStreamingResponse, type BrowserSession, type FetchGetContentsParams, type FetchResponse, type Run, type RunListParams, type RunListResponse, type SearchQueryParams, type SearchQueryResponse, type WalletResponse } from '@tiny-fish/sdk';
-import type { BatchCancelResponse, BatchGetResponse, BatchRunRequest, BatchRunResponse, CancelRunResponse, CliAgentRunParams, CliBrowserSessionCreateParams, CookieRecord, ProfileCreateResponse, ProfileUploadResponse, RunStepsResponse, VaultConnectRequest, VaultConnectResponse, VaultConnectionsListResponse, VaultDisconnectResponse, VaultItemsListResponse, VaultItemsSyncResponse } from './types.js';
+import type { BatchCancelResponse, BatchGetResponse, BatchRunRequest, BatchRunResponse, CancelRunResponse, CliAgentRunParams, CliBrowserSessionCreateParams, CookieRecord, ProfileCreateResponse, ProfileSummary, ProfileUploadResponse, RunStepsResponse, VaultConnectRequest, VaultConnectResponse, VaultConnectionsListResponse, VaultDisconnectResponse, VaultItemsListResponse, VaultItemsSyncResponse } from './types.js';
 type ConnectMap = Record<string, {
     attempt_id: string;
 }> | undefined;
@@ -21,6 +21,8 @@ export declare function submitBatch(req: BatchRunRequest, apiKey: string): Promi
 export declare function getBatchRuns(runIds: string[], apiKey: string): Promise<BatchGetResponse>;
 export declare function cancelBatchRuns(runIds: string[], apiKey: string): Promise<BatchCancelResponse>;
 export declare function profileCreate(name: string, apiKey: string): Promise<ProfileCreateResponse>;
+export declare function profileGet(profileId: string, apiKey: string): Promise<ProfileSummary>;
+export declare function profileList(apiKey: string): Promise<ProfileSummary[]>;
 export declare function profileUpload(profileId: string, cookies: CookieRecord[], apiKey: string): Promise<ProfileUploadResponse>;
 export declare function vaultConnections(apiKey: string): Promise<VaultConnectionsListResponse>;
 export declare function vaultConnect(req: VaultConnectRequest, apiKey: string): Promise<VaultConnectResponse>;

package/dist/lib/client.js

@@ -372,6 +372,8 @@ const profileCreateResponseSchema = z.object({
     name: z.string(),
     created_at: z.string(),
 });
+const profileSummarySchema = z.object({ id: z.string(), name: z.string() });
+const profileListResponseSchema = z.object({ profiles: z.array(profileSummarySchema) });
 const profileUploadResponseSchema = z.object({
     profile_id: z.string().optional(),
     cookie_count: z.number(),
@@ -386,6 +388,19 @@ export function profileCreate(name, apiKey) {
         return parseWithSchema(profileCreateResponseSchema, response, 'Invalid profile create response');
     });
 }
+export function profileGet(profileId, apiKey) {
+    return sdk(apiKey, async (client) => {
+        const response = await client.get(`/v1/profiles/${encodeURIComponent(profileId)}`);
+        return parseWithSchema(profileSummarySchema, response, 'Invalid profile response');
+    });
+}
+export function profileList(apiKey) {
+    return sdk(apiKey, async (client) => {
+        const response = await client.get('/v1/profiles');
+        return parseWithSchema(profileListResponseSchema, response, 'Invalid profile list response')
+            .profiles;
+    });
+}
 export function profileUpload(profileId, cookies, apiKey) {
     return sdk(apiKey, async (client) => {
         const response = await client.post(`/v1/profiles/${encodeURIComponent(profileId)}/upload`, { json: { cookies } });

package/dist/lib/output.d.ts

@@ -15,6 +15,6 @@ export declare function errLine(line: string): void;
 /** Advisory stderr line, yellow on a terminal and plain everywhere else so piped output stays clean. */
 export declare function warnLine(line: string): void;
 export declare function err(data: unknown): void;
-export declare function handleApiError(e: unknown): never;
+export declare function handleApiError(e: unknown, unauthorizedHint?: string): never;
 /** Undefined, not a throw: callers hand the value to a Zod safeParse. */
 export declare function parseJson(text: string): unknown;

package/dist/lib/output.js

@@ -53,7 +53,7 @@ export function err(data) {
     const serialized = JSON.stringify(payload) ?? 'undefined';
     process.stderr.write(sanitizeLine(serialized) + '\n');
 }
-export function handleApiError(e) {
+export function handleApiError(e, unauthorizedHint) {
     if (e instanceof ApiError) {
         const payload = { error: e.message, status: e.status };
         if (e.code)
@@ -64,7 +64,8 @@ export function handleApiError(e) {
         }
         else if (e.status === 401) {
             payload.hint =
-                'Clear the TINYFISH_API_KEY environment variable, run `tinyfish auth login`, then try again.';
+                unauthorizedHint ??
+                    'Clear the TINYFISH_API_KEY environment variable, run `tinyfish auth login`, then try again.';
         }
         err(payload);
     }

package/dist/lib/types.d.ts

@@ -150,6 +150,10 @@ export interface ProfileCreateResponse {
     name: string;
     created_at: string;
 }
+export interface ProfileSummary {
+    id: string;
+    name: string;
+}
 export interface CookieRecord {
     name: string;
     value: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiny-fish/cli",
-  "version": "0.47.2-next.375",
+  "version": "0.47.2-next.377",
   "description": "TinyFish CLI — run web automations from your terminal",
   "type": "module",
   "bin": {