@tiny-fish/cli 0.52.1 → 0.52.2-next.425

package/dist/lib/connect-native.js

@@ -108,7 +108,7 @@ function signInStepError(message, result, bounded) {
         : error;
 }
 /** Resolved before the removals, so a refusal strands no registration. */
-async function prepareInstallAuth(client, options, keyAuthSupported) {
+async function prepareInstallAuth(client, options, keyAuthSupported, matchedVariant) {
     // Prod MCP accepts X-API-Key, so a stored key replaces the browser OAuth hop.
     const storedKey = validatedApiKey(options.apiKey);
     const keyedAdd = resolveKeyedAdd(client, storedKey, keyAuthSupported, options.keyAuthOnly === true, options.deferOutro);
@@ -135,7 +135,15 @@ async function prepareInstallAuth(client, options, keyAuthSupported) {
     if (keyedAdd?.spec.seedKey) {
         await verifyKeyBeforeSeeding(keyedAdd.key, client.displayName, options.mcpUrl);
     }
-    return { keyedAdd, keyless, buildAddArgs, directInstall };
+    return {
+        keyedAdd,
+        keyless,
+        buildAddArgs: withVariant(buildAddArgs, matchedVariant),
+        directInstall,
+    };
+}
+function withVariant(build, variant) {
+    return build && variant ? (mcpUrl) => [...build(mcpUrl), variant] : build;
 }
 /** Inherit for an inline-OAuth add; capture otherwise, piping prompts when seeded. */
 function addSpawnOptions(options, interactiveAdd, seeded) {
@@ -264,10 +272,10 @@ export async function connectNativeMcpClient(client, options) {
         const support = await requireSupportOrRescue(client, client.connectClient, state, telemetry, options);
         if (!support)
             return;
-        const { optionalSupported, keyAuthSupported, harnessVersion } = support;
+        const { optionalSupported, keyAuthSupported, matchedVariant, harnessVersion } = support;
         telemetry.setHarnessVersion(harnessVersion);
         state.harnessDegraded = !!client.loginArgs && !optionalSupported;
-        const plan = await prepareInstallAuth(client, options, keyAuthSupported);
+        const plan = await prepareInstallAuth(client, options, keyAuthSupported, matchedVariant);
         const useKeyAuth = !!plan.keyedAdd;
         const useKeyless = plan.keyless;
         if (useKeyless)

package/dist/lib/harness/harness-spec.d.ts

@@ -295,6 +295,7 @@ export declare const HARNESS_SPECS: {
             args: string[];
             patterns: RegExp[];
             keyAuthPattern: RegExp;
+            variants: string[];
             timeoutMs: number;
             unavailableMessage: string;
         };

package/dist/lib/harness/harness-spec.js

@@ -224,6 +224,8 @@ export const HARNESS_SPECS = {
             args: ['mcp', 'add', '--help'],
             patterns: [/--url(?:\s|$)/m],
             keyAuthPattern: HEADER_FLAG,
+            // 2.x writes ./opencode.json without it, leaking the key (PF-6613).
+            variants: ['--global'],
             // Native binary; a win32 first launch outlasted 10s in CI.
             timeoutMs: 30_000,
             unavailableMessage: OPENCODE_MCP_ADD_UNAVAILABLE_MESSAGE,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiny-fish/cli",
-  "version": "0.52.1",
+  "version": "0.52.2-next.425",
   "description": "TinyFish CLI — run web automations from your terminal",
   "type": "module",
   "bin": {