@tiny-fish/cli 0.52.4-next.431 → 0.52.4-next.432

package/dist/lib/connect-native.js

@@ -10,6 +10,7 @@ import { AuthMode, RELOAD_ACTION } from './harness/harness-detect.js';
 import { SIGN_IN_PROBES } from './registration-detect.js';
 import { errLine, warnLine } from './output.js';
 import { verifyMcpAuth } from './verify.js';
+import { dotenvMarkerHead, harnessDotenvPath, writeDotenvKey } from './dotenv-file.js';
 import { apiBaseFromMcpUrl } from './mcp-endpoint.js';
 import { finishSetupHint, requireKeylessMcp, requireSupportOrRescue, runCliInstallStep, trackPostInstallFailure, walkthroughPhase, } from './connect-steps.js';
 function removeExistingRegistration(client, removal, verbose) {
@@ -43,12 +44,35 @@ function exportApiKey(apiKey, displayName, deferOutro) {
     }
     return true;
 }
+/** Best-effort: the profile export still covers terminal launches. */
+function seedHarnessDotenv(client, keyed, deferOutro) {
+    const { envVar } = keyed.spec;
+    const envPath = harnessDotenvPath(client.connectClient);
+    if (!envPath || !envVar)
+        return false;
+    try {
+        // Unlike Hermes, nothing else needs this file group-readable.
+        writeDotenvKey(envPath, envVar, keyed.key, dotenvMarkerHead(client.connectClient), {
+            ownerOnly: true,
+        });
+    }
+    catch (error) {
+        warnLine(`Could not write ${envVar} to ${envPath} (${error instanceof Error ? error.message : String(error)}).`);
+        return false;
+    }
+    const line = `Wrote ${envVar} to ${envPath} — ${client.displayName} reads the key from there.`;
+    (deferOutro ?? errLine)(line);
+    return true;
+}
 function resolveKeyedAdd(client, storedKey, keyAuthSupported, keyAuthOnly, deferOutro) {
     if (!storedKey || !keyAuthSupported || !client.keyAuth)
         return undefined;
     const keyed = { key: storedKey, spec: client.keyAuth };
+    const seededDotenv = seedHarnessDotenv(client, keyed, deferOutro);
     // Before the removals: a failed export must not strand the old registration.
-    if (keyed.spec.envVar && !exportApiKey(keyed.key, client.displayName, deferOutro)) {
+    if (keyed.spec.envVar &&
+        !exportApiKey(keyed.key, client.displayName, deferOutro) &&
+        !seededDotenv) {
         if (keyAuthOnly)
             refuseFailedKeyExport(client);
         errLine(`Signing in to ${client.displayName} instead.`);

package/dist/lib/doctor-checks.js

@@ -116,6 +116,8 @@ function registrationVerdict(status, mcpUrl, keyAuth, cliKeyMissing) {
         }
         // Ordered before the key check: the harness's own verdict wins.
         if (status.connected === false) {
+            if (status.keyReason)
+                return { status: 'warn', detail: `registered, but ${status.keyReason}` };
             return {
                 status: 'warn',
                 detail: 'registered, but the harness reports it cannot reach TinyFish; sign in again there',

package/dist/lib/dotenv-file.d.ts

@@ -1,5 +1,9 @@
+import { type Harness } from './harness/harness-spec.js';
+export declare function harnessDotenvPath(harness: Harness): string | undefined;
 export declare function dotenvMarkerHead(client: string): string;
-export declare function writeDotenvKey(envPath: string, varName: string, key: string, markerHead: string): void;
+export declare function writeDotenvKey(envPath: string, varName: string, key: string, markerHead: string, { ownerOnly }?: {
+    ownerOnly?: boolean;
+}): void;
 export declare function readDotenvKey(envPath: string, varName: string): string | undefined;
 /** Restores the exact line writeDotenvKey replaces, quotes and comment included. */
 export declare function captureDotenvKeyRestore(envPath: string, varName: string, markerHead: string): () => void;

package/dist/lib/dotenv-file.js

@@ -1,9 +1,14 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { randomUUID } from 'node:crypto';
+import { harnessSpec } from './harness/harness-spec.js';
+import { harnessConfigPath } from './harness/harness-detect.js';
 const MARKER_TAIL = '# tinyfish-cli: end';
 // Keys are `sk-tinyfish-<alnum>`; refusing anything else beats shipping unreachable escaping.
 const BARE_SAFE = /^[A-Za-z0-9._\-/:+=]+$/;
+export function harnessDotenvPath(harness) {
+    return harnessSpec(harness).keyDotenv ? path.join(harnessConfigPath(harness), '.env') : undefined;
+}
 export function dotenvMarkerHead(client) {
     return `# tinyfish-cli: TinyFish MCP key, managed by \`tinyfish connect ${client}\``;
 }
@@ -28,7 +33,7 @@ function readLines(envPath) {
         .split(/(?<=\n)/);
 }
 // Hermes preserves the original mode so Docker volume mounts survive (config.py:3921-3929).
-function writeAtomic(envPath, lines) {
+function writeAtomic(envPath, lines, ownerOnly = false) {
     let mode = 0o600;
     try {
         mode = fs.statSync(envPath).mode & 0o777;
@@ -36,6 +41,8 @@ function writeAtomic(envPath, lines) {
     catch {
         // No existing file: 0600 is the right default for credentials.
     }
+    if (ownerOnly)
+        mode &= 0o700;
     const tmp = `${envPath}.${randomUUID()}.tmp`;
     try {
         fs.writeFileSync(tmp, lines.join(''), { encoding: 'utf8', mode });
@@ -48,7 +55,7 @@ function writeAtomic(envPath, lines) {
         throw error;
     }
 }
-export function writeDotenvKey(envPath, varName, key, markerHead) {
+export function writeDotenvKey(envPath, varName, key, markerHead, { ownerOnly = false } = {}) {
     const clean = key.replace(/[\r\n]/g, '').trim();
     // An empty key reads as "bad characters" without its own branch.
     if (!clean)
@@ -64,12 +71,12 @@ export function writeDotenvKey(envPath, varName, key, markerHead) {
         if (lines.length && !lines[lines.length - 1].endsWith('\n'))
             lines[lines.length - 1] += '\n';
         lines.push(`${markerHead}\n`, assignment, `${MARKER_TAIL}\n`);
-        writeAtomic(envPath, lines);
+        writeAtomic(envPath, lines, ownerOnly);
         return;
     }
     lines[index] = assignment;
     // Dotenv loaders are last-wins; a surviving duplicate would beat this value.
-    writeAtomic(envPath, lines.filter((line, i) => i === index || !definesKey(line, varName)));
+    writeAtomic(envPath, lines.filter((line, i) => i === index || !definesKey(line, varName)), ownerOnly);
 }
 export function readDotenvKey(envPath, varName) {
     const line = readLines(envPath).find((l) => definesKey(l, varName));

package/dist/lib/harness/harness-detect.js

@@ -5,6 +5,7 @@ import which from 'which';
 import { ALL_HARNESSES, harnessSpec } from './harness-spec.js';
 import { clineConfigDir } from '../config/cline-config.js';
 import { piAgentDir, piBinaryIsPi } from '../config/pi-config.js';
+import { agentHome } from '../skill-paths.js';
 export { ALL_HARNESSES };
 export const HARNESS_DISPLAY_NAMES = Object.fromEntries(ALL_HARNESSES.map((harness) => [harness, harnessSpec(harness).displayName]));
 export const RELOAD_ACTION = Object.fromEntries(ALL_HARNESSES.map((harness) => [harness, harnessSpec(harness).reloadAction]));
@@ -34,9 +35,10 @@ export function commandOnPath(command) {
         return false;
     }
 }
-// PI_CODING_AGENT_DIR and CLINE_DIR move these dirs; a guessed path would be written unread.
+// Env vars move these dirs; a guessed path would go unread.
 const CONFIG_PATH_RESOLVERS = {
     cline: clineConfigDir,
+    codex: () => agentHome('CODEX_HOME', harnessSpec('codex').configDir),
     pi: piAgentDir,
 };
 export function harnessConfigPath(harness) {

package/dist/lib/harness/harness-spec.d.ts

@@ -48,6 +48,8 @@ export interface HarnessSpec {
     };
     /** Keyed adds append this flag plus the env var name (Codex). */
     keyEnvFlag?: string;
+    /** The harness loads `<config dir>/.env` at launch (Codex). */
+    keyDotenv?: boolean;
     /** Keyed adds append these flags; the key itself is seeded elsewhere (Hermes). */
     keyAddFlags?: string[];
     /** No sign-in exists here, so connect refuses a keyless install (Hermes). */
@@ -156,6 +158,7 @@ export declare const HARNESS_SPECS: {
         };
         urlStyle: "flag";
         keyEnvFlag: string;
+        keyDotenv: true;
         degradedAuthNotes: {
             keyed: string;
             deferred: string;

package/dist/lib/harness/harness-spec.js

@@ -78,6 +78,8 @@ export const HARNESS_SPECS = {
         urlStyle: 'flag',
         // Codex has no `--header`; the MCP server takes a key as `Bearer sk-…`.
         keyEnvFlag: '--bearer-token-env-var',
+        // GUI launches skip the shell profile; unset variable drops the server.
+        keyDotenv: true,
         degradedAuthNotes: { keyed: CODEX_KEYED_FALLBACK_NOTE, deferred: CODEX_DEFERRED_AUTH_NOTE },
         // `--oauth-resource` duplicates the resource Codex discovers; Clerk rejects both.
         // `mcp add` still runs OAuth inline, so `loginArgs` stays a retry.

package/dist/lib/registration-detect.js

@@ -14,6 +14,7 @@ import { readOpencodeStyleEntry } from './config/opencode-config.js';
 import { readPiTinyfishEntry } from './config/pi-config.js';
 import { harnessSpec } from './harness/harness-spec.js';
 import { readHermesKey, resolveHermesHome } from './hermes-env.js';
+import { harnessDotenvPath, readDotenvKey } from './dotenv-file.js';
 import { readHermesEntry } from './config/hermes-config.js';
 import { detectInstalledHarnesses, harnessConfigPath, harnessDisplayPath, AuthMode, Registered, } from './harness/harness-detect.js';
 const NOT_REGISTERED = Object.freeze({
@@ -245,15 +246,30 @@ const ENV_VAR_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
 function declaredKeyEnvVar(harness) {
     return NATIVE_BY_HARNESS.get(harness)?.keyAuth?.envVar;
 }
+/** An unreadable .env reads as unset, not as a failed probe. */
+function readDotenvKeySafe(dotenvPath, envVar) {
+    try {
+        return readDotenvKey(dotenvPath, envVar);
+    }
+    catch {
+        return undefined;
+    }
+}
 /** Codex stores a variable name; resolving it only answers whether it is the CLI's key. */
-function envKeyVerdict(envVar) {
+function envKeyVerdict(envVar, dotenvPath) {
     if (!ENV_VAR_NAME.test(envVar)) {
         return { keyReason: 'its key comes from an unusable variable name' };
     }
-    if (matchesCliKey(process.env[envVar]))
+    const fromDotenv = dotenvPath ? readDotenvKeySafe(dotenvPath, envVar) : undefined;
+    // GUI launches read only the .env; a shell export masks that.
+    if (dotenvPath && !fromDotenv) {
+        return { connected: false, keyReason: `$${envVar} is not in ${dotenvPath}` };
+    }
+    const value = process.env[envVar] || fromDotenv;
+    if (matchesCliKey(value))
         return { keyMatchesCliKey: true };
     return {
-        keyReason: process.env[envVar]
+        keyReason: value
             ? `$${envVar} holds a key this CLI cannot verify`
             : `$${envVar} is not set here`,
     };
@@ -279,7 +295,7 @@ function probeCodex() {
         // Codex's own verdict: a stale `oauth_resource` strands installs here.
         ...(entry.auth_status === CodexAuthStatus.NotLoggedIn && !envVar ? { connected: false } : {}),
         ...(codexUrl ? { registeredUrl: codexUrl } : {}),
-        ...(envVar ? envKeyVerdict(envVar) : {}),
+        ...(envVar ? envKeyVerdict(envVar, harnessDotenvPath('codex')) : {}),
     };
 }
 // No `cline mcp list`, so the settings file is the only registration evidence.

package/dist/lib/skill-paths.d.ts

@@ -1,4 +1,5 @@
 import type { SkillAgent } from './harness/harness-spec.js';
+export declare function agentHome(override: string, fallback: string): string;
 /** Where skills@1.5.15 wrote skill dirs for this agent. */
 export declare function skillRootDir(agent: SkillAgent): string;
 /** Mirrors skills@1.5.15 getSkillLockPath(); missing the XDG branch strands entries. */

package/dist/lib/skill-paths.js

@@ -1,7 +1,7 @@
 import * as os from 'node:os';
 import * as path from 'node:path';
 // Mirrors skills@1.5.15 exactly: it trims and falls back on empty values.
-function agentHome(override, fallback) {
+export function agentHome(override, fallback) {
     return process.env[override]?.trim() || path.join(os.homedir(), fallback); // nosemgrep: path-join-resolve-traversal -- fixed dir names under os.homedir()
 }
 // `skills` writes here for the universal agents, whose own config dirs it never touches.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiny-fish/cli",
-  "version": "0.52.4-next.431",
+  "version": "0.52.4-next.432",
   "description": "TinyFish CLI — run web automations from your terminal",
   "type": "module",
   "bin": {