@tiny-fish/cli 0.52.5-next.436 → 0.52.5-next.437

package/README.md

@@ -26,11 +26,12 @@ anything. Terminals without raw-key support get a numbered prompt instead.
 Try Search without an account; run `tinyfish auth login` and reconnect to unlock all tools:
 
 ```bash
-npx -y @tiny-fish/cli@latest connect opencode --launch
 npx -y @tiny-fish/cli@latest connect hermes --launch
 npx -y @tiny-fish/cli@latest connect omp --launch
 ```
 
+`connect opencode` signs you in to a TinyFish account instead: it opens your browser, or prints a sign-in link when an agent runs it.
+
 Without a terminal (agents, CI), bare `connect` behaves exactly like `tinyfish connect --all`
 and says so on its first line: harnesses that can take your API key (via `TINYFISH_API_KEY` or
 `--api-key`) connect first, then the first harness that needs a browser sign-in opens your

package/dist/lib/connect-all-auth.js

@@ -1,6 +1,6 @@
 import { NATIVE_BY_HARNESS } from './connect-clients.js';
 import { harnessSpec } from './harness/harness-spec.js';
-import { ConnectInterruptedError, ConnectStepError, SignInTimeoutError, } from './connect-runtime.js';
+import { ConnectInterruptedError, ConnectStepError, SignInTimeoutError, probeSupportVariant, } from './connect-runtime.js';
 import { ALL_HARNESSES, HARNESS_DISPLAY_NAMES as DISPLAY_NAMES, } from './harness/harness-detect.js';
 import { errLine } from './output.js';
 // Must undercut agent tool-call budgets (Claude Code Bash defaults to 120s).
@@ -23,6 +23,19 @@ const BROWSER_SIGN_IN = new Set(ALL_HARNESSES.filter((harness) => {
 }));
 // Derived: these refuse a keyless install, so no sign-in helps.
 const KEY_REQUIRED = new Set(ALL_HARNESSES.filter((harness) => !!harnessSpec(harness).keyRequired));
+/** OpenCode 2.x prints a sign-in link and exits, so it waits on no browser. */
+function printsSignInLink(harness) {
+    const native = NATIVE_BY_HARNESS.get(harness);
+    if (!native?.detachedLoginVariant)
+        return false;
+    try {
+        return probeSupportVariant(native) === native.detachedLoginVariant;
+    }
+    catch {
+        // Routing only: connect itself reports the probe failure.
+        return false;
+    }
+}
 function headlessGate(base, oauthBudget, fixCommand) {
     const { harness } = base;
     // A CLI-login sign-in is interactive-only — unboundable headless.
@@ -33,6 +46,8 @@ function headlessGate(base, oauthBudget, fixCommand) {
             spentBrowserSlot: false,
         };
     }
+    if (printsSignInLink(harness))
+        return { headlessAuth: true, spentBrowserSlot: false };
     let spentBrowserSlot = false;
     if (BROWSER_SIGN_IN.has(harness)) {
         // One browser sign-in per run; the rest wait for a re-run.

package/dist/lib/connect-clients.d.ts

@@ -39,7 +39,7 @@ interface SeededInstall {
         tag?: string;
     };
 }
-interface BaseMcpClient extends SupportedCommand, Pick<HarnessSpec, 'skillAgent' | 'nonInteractiveAdd' | 'signInHint' | 'degradedAuthNotes' | 'postConnectNote' | 'verifyListed'> {
+interface BaseMcpClient extends SupportedCommand, Pick<HarnessSpec, 'skillAgent' | 'nonInteractiveAdd' | 'signInHint' | 'detachedLoginVariant' | 'cliKeyOptional' | 'degradedAuthNotes' | 'postConnectNote' | 'verifyListed'> {
     connectClient: Exclude<AgentClient, 'openclaw'>;
     /** Replaces `addArgs` when a stored key is available: key auth removes the OAuth hop. */
     keyAuth?: {
@@ -49,7 +49,6 @@ interface BaseMcpClient extends SupportedCommand, Pick<HarnessSpec, 'skillAgent'
         /** Writes into the harness's store, so connect verifies the key first. */
         seedKey?: (apiKey: string) => SeededInstall;
     };
-    keylessAddArgs?: (mcpUrl: string) => string[];
     prepareKeylessInstall?: () => DirectInstall;
     loginArgs?: string[];
     removals: {

package/dist/lib/connect-clients.js

@@ -4,7 +4,7 @@ import { detectHumanInitiated } from './harness.js';
 import { harnessConfigPath } from './harness/harness-detect.js';
 import { errLine, sanitizeLine, warnLine } from './output.js';
 import { ConnectInterruptedError, ConnectStepError, spawnStepError, } from './connect-runtime.js';
-import { TINYFISH_ACCESS_MODE_HEADER, TINYFISH_API_KEY_VAR, TINYFISH_KEYLESS_ACCESS_MODE, } from './constants.js';
+import { TINYFISH_API_KEY_VAR } from './constants.js';
 import { HARNESS_SPECS, NATIVE_HARNESSES, harnessSpec, } from './harness/harness-spec.js';
 import { HERMES_KEY_VAR, captureHermesKeyRestore, hermesEnvPath, resolveHermesHome, writeHermesKey, } from './hermes-env.js';
 import { hermesConfigPath, readHermesEntry } from './config/hermes-config.js';
@@ -256,13 +256,6 @@ function specKeyAuth(spec) {
         addArgs: (mcpUrl, apiKey) => [...specAddArgs(spec, mcpUrl), '--header', value(apiKey)],
     };
 }
-function specKeylessAddArgs(spec) {
-    const { header } = spec;
-    if (!spec.keylessFallback || !header)
-        return undefined;
-    const value = `${TINYFISH_ACCESS_MODE_HEADER}${header.sep}${TINYFISH_KEYLESS_ACCESS_MODE}`;
-    return (mcpUrl) => specAddArgs(spec, mcpUrl).concat('--header', value);
-}
 /** Descriptor behaviour the spec cannot hold; every other field is spec data. */
 const HARNESS_OVERRIDES = {
     cline: { launchWalkthrough: launchCline },
@@ -291,9 +284,10 @@ function toNativeClient(harness) {
         skillAgent: spec.skillAgent,
         nonInteractiveAdd: spec.nonInteractiveAdd,
         keyAuth,
-        keylessAddArgs: specKeylessAddArgs(spec),
         prepareKeylessInstall: overrides.prepareKeylessInstall,
         signInHint: spec.signInHint,
+        detachedLoginVariant: spec.detachedLoginVariant,
+        cliKeyOptional: spec.cliKeyOptional,
         degradedAuthNotes: spec.degradedAuthNotes,
         removals: spec.removals ?? [
             {

package/dist/lib/connect-native.js

@@ -4,6 +4,7 @@ import { KEYLESS_ONBOARDING_PROMPT, launchNativeMcpClient, } from './connect-cli
 import { captureStdio, capturedOutput, replay, SKILL_INSTALL_TIMEOUT_MS, STEP_MAX_BUFFER, } from './cli-install.js';
 import { ensureCliAuthenticated } from './connect-auth.js';
 import { installWebSkill } from './skill-install.js';
+import { waitForSignInUrl } from './sign-in-url.js';
 import { ConnectInterruptedError, ConnectStepError, createConnectTelemetry, runGuarded, settle, SignInTimeoutError, spawnRemoval, spawnStepError, } from './connect-runtime.js';
 import { DASHBOARD_URL, TINYFISH_API_KEY_VAR } from './constants.js';
 import { strayProjectKeyFiles } from './config/opencode-config.js';
@@ -194,20 +195,12 @@ async function prepareInstallAuth(client, options, keyAuthSupported, matchedVari
     // Prod MCP accepts X-API-Key, so a stored key replaces the browser OAuth hop.
     const storedKey = validatedApiKey(options.apiKey);
     const keyedAdd = resolveKeyedAdd(client, storedKey, keyAuthSupported, options.keyAuthOnly === true, options.deferOutro);
-    const keylessArgs = !storedKey ? client.keylessAddArgs : undefined;
     const directInstall = !storedKey ? client.prepareKeylessInstall?.() : undefined;
-    let keyless = !!directInstall;
+    const keyless = !!directInstall;
     let buildAddArgs;
     if (keyedAdd) {
         buildAddArgs = (mcpUrl) => keyedAdd.spec.addArgs(mcpUrl, keyedAdd.key);
     }
-    else if (keylessArgs && keyAuthSupported) {
-        buildAddArgs = keylessArgs;
-        keyless = true;
-    }
-    else if (keylessArgs && options.authTimeoutMs !== undefined) {
-        refuseKeylessInstall(client, false, true);
-    }
     else if (!directInstall) {
         buildAddArgs = keylessAddArgs(client, keyAuthSupported);
     }
@@ -302,6 +295,24 @@ function performLoginStep(client, pendingLogin, options) {
         throw signInStepError(`Could not authenticate TinyFish in ${client.displayName}`, loginResult, options.authTimeoutMs !== undefined);
     }
 }
+// Upper bound only: the URL normally prints within two seconds.
+const SIGN_IN_URL_WAIT_MS = 15_000;
+// 2.x's service lags `mcp add` by under a second (measured on 2.1.4).
+const STALE_REGISTRATION_RETRIES = 3;
+const STALE_REGISTRATION_DELAY_MS = 1_000;
+/** Relays the sign-in link; the harness service finishes it after we exit. */
+async function printDetachedLoginUrl(client, pendingLogin) {
+    errLine('Starting TinyFish sign-in...');
+    let run = await waitForSignInUrl(client.command, pendingLogin, SIGN_IN_URL_WAIT_MS);
+    for (let retry = 0; retry < STALE_REGISTRATION_RETRIES && run.output.includes('Integration not found'); retry++) {
+        await new Promise((resolve) => setTimeout(resolve, STALE_REGISTRATION_DELAY_MS));
+        run = await waitForSignInUrl(client.command, pendingLogin, SIGN_IN_URL_WAIT_MS);
+    }
+    if (!run.url) {
+        throw signInStepError(`Could not start TinyFish sign-in in ${client.displayName}`, run.result, true);
+    }
+    errLine(`Sign in to TinyFish: ${run.url}`);
+}
 function announceAuthNotes(useKeyAuth, degradedNotes, seededNote) {
     if (useKeyAuth) {
         errLine(degradedNotes?.keyed ?? 'Using your stored TinyFish API key — no browser sign-in needed.');
@@ -314,7 +325,20 @@ function announceAuthNotes(useKeyAuth, degradedNotes, seededNote) {
         errLine(degradedNotes.deferred);
     }
 }
-function completeAuthFlow(client, options, state, telemetry, ctx) {
+/** Returns whether sign-in is still deferred afterwards. */
+async function runPendingLogin(client, pendingLogin, run) {
+    run.state.stage = 'client_oauth';
+    if (run.ctx.detachedLogin) {
+        await printDetachedLoginUrl(client, pendingLogin);
+        return true;
+    }
+    performLoginStep(client, pendingLogin, run.options);
+    if (run.ctx.probeAuthenticated?.() === false)
+        return true;
+    run.telemetry.track('checkpoint', { phase: 'oauth_done' });
+    return false;
+}
+async function completeAuthFlow(client, options, state, telemetry, ctx) {
     const { useKeyAuth, useKeyless, loginDegraded, loginArgs, probeAuthenticated } = ctx;
     if (useKeyless) {
         errLine('Using keyless TinyFish Search — no account or browser sign-in needed.');
@@ -329,15 +353,9 @@ function completeAuthFlow(client, options, state, telemetry, ctx) {
     // A probed client signs in again only when its inline OAuth is known to have been abandoned.
     const retryLogin = probeAuthenticated ? addSignedIn === false : true;
     const pendingLogin = !useKeyAuth && retryLogin ? loginArgs : undefined;
-    let signInDeferred = !useKeyAuth && !addSignedIn && !pendingLogin;
-    if (pendingLogin) {
-        state.stage = 'client_oauth';
-        performLoginStep(client, pendingLogin, options);
-        if (probeAuthenticated?.() === false)
-            signInDeferred = true;
-        else
-            telemetry.track('checkpoint', { phase: 'oauth_done' });
-    }
+    const signInDeferred = pendingLogin
+        ? await runPendingLogin(client, pendingLogin, { options, state, telemetry, ctx })
+        : !useKeyAuth && !addSignedIn;
     const authMode = useKeyAuth
         ? AuthMode.ApiKey
         : signInDeferred
@@ -380,11 +398,12 @@ export async function connectNativeMcpClient(unpinned, options) {
         for (const stray of twoPointX ? strayProjectKeyFiles() : []) {
             warnLine(opencodeStrayKeyNote(stray, DASHBOARD_URL));
         }
-        const { authMode, signInDeferred } = completeAuthFlow(client, options, state, telemetry, {
+        const { authMode, signInDeferred } = await completeAuthFlow(client, options, state, telemetry, {
             useKeyAuth,
             useKeyless,
             loginDegraded,
             loginArgs,
+            detachedLogin: !!client.detachedLoginVariant && matchedVariant === client.detachedLoginVariant,
             probeAuthenticated,
             seededNote,
         });
@@ -411,6 +430,28 @@ function connectedLine(client, signInDeferred) {
     return (`TinyFish is connected. Open ${client.displayName}; if it is already running, ` +
         `${RELOAD_ACTION[client.connectClient]} to pick up the tools.`);
 }
+/** Right after OAuth, a key prompt or failure reads as a second sign-in. */
+function offerCliSignIn(client, options, telemetry) {
+    try {
+        ensureCliAuthenticated(client.connectClient, options.apiKey, { interactiveLogin: false });
+        telemetry.track('checkpoint', { phase: 'authenticated' });
+    }
+    catch (error) {
+        if (error instanceof ConnectInterruptedError)
+            throw error;
+        errLine('To use TinyFish from the terminal too, run: tinyfish auth login');
+    }
+}
+function authenticateCli(client, options, state, telemetry) {
+    if (client.cliKeyOptional && state.authMode !== AuthMode.ApiKey) {
+        offerCliSignIn(client, options, telemetry);
+        return;
+    }
+    ensureCliAuthenticated(client.connectClient, options.apiKey, {
+        interactiveLogin: options.authTimeoutMs === undefined,
+    });
+    telemetry.track('checkpoint', { phase: 'authenticated' });
+}
 // Runs after `completed` settled: steps fail alone, the rest still run.
 async function runPostInstallSteps(client, options, state, telemetry, signInDeferred, seededHome) {
     let failed = false;
@@ -450,12 +491,7 @@ async function runPostInstallSteps(client, options, state, telemetry, signInDefe
             });
         }
         if (state.authMode !== AuthMode.Keyless) {
-            await attempt('authentication', () => {
-                ensureCliAuthenticated(client.connectClient, options.apiKey, {
-                    interactiveLogin: options.authTimeoutMs === undefined,
-                });
-                telemetry.track('checkpoint', { phase: 'authenticated' });
-            });
+            await attempt('authentication', () => authenticateCli(client, options, state, telemetry));
         }
         if (client.postConnectNote)
             errLine(client.postConnectNote);

package/dist/lib/harness/harness-spec.d.ts

@@ -56,6 +56,10 @@ export interface HarnessSpec {
     keyRequired?: true;
     keylessFallback?: true;
     loginArgs?: string[];
+    /** After this harness's OAuth, connect never prompts for or requires the CLI key. */
+    cliKeyOptional?: true;
+    /** With this support variant, the sign-in callback outlives `loginArgs`. */
+    detachedLoginVariant?: string;
     /** Default: one `mcp remove tinyfish` labeled from displayName. */
     removals?: {
         args: string[];
@@ -295,7 +299,6 @@ export declare const HARNESS_SPECS: {
         reloadAction: string;
         skillAgent: "opencode";
         nonInteractiveAdd: true;
-        keylessFallback: true;
         supportCheck: {
             args: string[];
             patterns: RegExp[];
@@ -310,6 +313,9 @@ export declare const HARNESS_SPECS: {
             sep: "=";
         };
         loginArgs: string[];
+        detachedLoginVariant: string;
+        cliKeyOptional: true;
+        signInHint: string;
         removals: never[];
         postConnectNote: string;
         verifyListed: true;

package/dist/lib/harness/harness-spec.js

@@ -221,7 +221,6 @@ export const HARNESS_SPECS = {
         reloadAction: 'restart it',
         skillAgent: 'opencode',
         nonInteractiveAdd: true,
-        keylessFallback: true,
         supportCheck: {
             args: ['mcp', 'add', '--help'],
             patterns: [/--url(?:\s|$)/m],
@@ -237,6 +236,10 @@ export const HARNESS_SPECS = {
         header: { name: 'X-API-Key', sep: '=' },
         // OpenCode writes its config itself; `mcp auth` is the separate OAuth step.
         loginArgs: ['mcp', 'auth', 'tinyfish'],
+        // 2.x's background service, not `mcp auth`, catches the OAuth callback.
+        detachedLoginVariant: '--global',
+        cliKeyOptional: true,
+        signInHint: 'TinyFish is configured in OpenCode. Open the sign-in link above, then restart OpenCode.',
         // `opencode mcp add` upserts by name and ships no `mcp remove`.
         removals: [],
         postConnectNote: OPENCODE_MODEL_NOTE,

package/dist/lib/sign-in-url.d.ts

@@ -0,0 +1,8 @@
+import type { SpawnStepResult } from './connect-runtime.js';
+export interface SignInUrlRun {
+    url?: string;
+    output: string;
+    result: SpawnStepResult;
+}
+/** Resolves on the first printed URL; SIGKILL, because SIGTERM cancels OpenCode's sign-in. */
+export declare function waitForSignInUrl(command: string, args: readonly string[], timeoutMs: number): Promise<SignInUrlRun>;

package/dist/lib/sign-in-url.js

@@ -0,0 +1,35 @@
+import spawn from 'cross-spawn';
+// Trailing whitespace proves the URL arrived whole, not cut mid-chunk.
+const SIGN_IN_URL = /https:\/\/\S+(?=\s)/;
+/** Resolves on the first printed URL; SIGKILL, because SIGTERM cancels OpenCode's sign-in. */
+export function waitForSignInUrl(command, args, timeoutMs) {
+    return new Promise((resolve) => {
+        const child = spawn(command, [...args], { stdio: ['ignore', 'pipe', 'pipe'] });
+        let output = '';
+        let settled = false;
+        const settle = (result) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            child.kill('SIGKILL');
+            resolve({
+                url: output.match(SIGN_IN_URL)?.[0],
+                output,
+                result: { ...result, stdout: output },
+            });
+        };
+        const timer = setTimeout(() => {
+            settle({ status: null, error: Object.assign(new Error('timed out'), { code: 'ETIMEDOUT' }) });
+        }, timeoutMs);
+        const onData = (chunk) => {
+            output += chunk.toString();
+            if (SIGN_IN_URL.test(output))
+                settle({ status: 0 });
+        };
+        child.stdout?.on('data', onData);
+        child.stderr?.on('data', onData);
+        child.on('error', (error) => settle({ status: null, error }));
+        child.on('close', (status, signal) => settle({ status, signal }));
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiny-fish/cli",
-  "version": "0.52.5-next.436",
+  "version": "0.52.5-next.437",
   "description": "TinyFish CLI — run web automations from your terminal",
   "type": "module",
   "bin": {