@tiny-fish/cli 0.8.1-next.119 → 0.8.1-next.121

package/dist/commands/connect.js

@@ -138,9 +138,38 @@ const OPENCLAW = {
         unavailableMessage: OPENCLAW_SKILL_UNAVAILABLE_MESSAGE,
     },
 };
-function createConnectTelemetry(mcpUrl, client) {
+// TinyFish-owned domains plus loopback are the only origins the API key may be sent to.
+// `--url` accepts any http(s) URL, so a user-supplied origin must never receive the key.
+const TRUSTED_TELEMETRY_HOST_SUFFIXES = [".tinyfish.ai", ".tinyfish.io"];
+const TRUSTED_TELEMETRY_LOOPBACK_HOSTS = ["localhost", "127.0.0.1", "[::1]"];
+function isTrustedTelemetryOrigin(endpoint) {
+    let url;
+    try {
+        url = new URL(endpoint);
+    }
+    catch {
+        return false;
+    }
+    const host = url.hostname.toLowerCase();
+    // Loopback may use http for local dev; every other trusted origin must be https so the
+    // key is never sent over cleartext.
+    if (TRUSTED_TELEMETRY_LOOPBACK_HOSTS.includes(host))
+        return true;
+    if (url.protocol !== "https:")
+        return false;
+    return TRUSTED_TELEMETRY_HOST_SUFFIXES.some((suffix) => host === suffix.slice(1) || host.endsWith(suffix));
+}
+function createConnectTelemetry(mcpUrl, client, apiKey) {
     const attemptId = randomUUID();
     const endpoint = new URL("/api/cli/connect-event", mcpUrl).toString();
+    const telemetryKey = apiKey ?? process.env["TINYFISH_API_KEY"];
+    const headers = { "content-type": "application/json" };
+    // Attach the key so the endpoint can attribute the event to the signed-in user, but only
+    // when it is well-formed AND the endpoint is a trusted TinyFish origin. A user-supplied
+    // --url pointing elsewhere gets anonymous telemetry, never the key.
+    if (telemetryKey && validateKeyFormat(telemetryKey) && isTrustedTelemetryOrigin(endpoint)) {
+        headers["x-api-key"] = telemetryKey;
+    }
     let enabled = true;
     return {
         attemptId,
@@ -150,7 +179,7 @@ function createConnectTelemetry(mcpUrl, client) {
             try {
                 const response = await fetch(endpoint, {
                     method: "POST",
-                    headers: { "content-type": "application/json" },
+                    headers,
                     body: JSON.stringify({
                         attempt_id: attemptId,
                         client,
@@ -309,7 +338,7 @@ function launchOpenClawWalkthrough() {
     return true;
 }
 async function connectNativeMcpClient(client, options) {
-    const telemetry = createConnectTelemetry(options.mcpUrl, client.connectClient);
+    const telemetry = createConnectTelemetry(options.mcpUrl, client.connectClient, options.apiKey);
     let failureStage = "prerequisite_check";
     try {
         await telemetry.track("started");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiny-fish/cli",
-  "version": "0.8.1-next.119",
+  "version": "0.8.1-next.121",
   "description": "TinyFish CLI — run web automations from your terminal",
   "type": "module",
   "bin": {