* feat(tinyfish): add TinyFish web agent, search, and fetch integration
Adds the TinyFish integration: eight tools across the Agent, Search, and
Fetch APIs, a block wiring them, the brand icon, and hosted-key support.
Agent runs are metered on the step count TinyFish reports. Search and Fetch
are free, so their hosted key costs nothing to run. The async run and its
run read/cancel/list companions carry no hosting config — their charge
accrues after the request returns and cannot be metered — so they always
require the caller's own key.
* fix(tinyfish): address review findings
- Add tinyfish to PROVIDER_SECTIONS. The sectioned BYOK renderer drops any
provider missing from a section, so the key field never rendered. Export
PROVIDERS/PROVIDER_SECTIONS and assert they agree, so the next provider to
miss a section fails CI instead of vanishing.
- Replace the `any` payload params with raw snake_case wire types. This caught
two real gaps: `status` could reach the output undefined, and `error` could
be null where ToolResponse.error is `string | undefined`.
- Reject an already-parsed array output schema, which a `json` block input can
produce, and name malformed schema JSON instead of leaking a SyntaxError.
- Count Fetch rate-limit usage from the submitted URLs rather than the returned
arrays, so a URL in neither array cannot undercount.
- Make "List runs" a literal canvas clause; a blank goal filter lists everything.
- Regenerate the docs manifest for the new integration page.
* chore(byok): audit that every hosted provider is fully wired
Adds check:byok-providers. A hosted tool names its provider once in
hosting.byokProviderId, but the id must also reach the zod enum, the settings
PROVIDERS row, and a PROVIDER_SECTIONS section. Only the union is compiler-
enforced; the rest fail silently, which is how TinyFish shipped with no
settings row in the first place. Also flags drift between the two
BYOKProviderId declarations.
Correct the Search and Fetch rate-limit rationale: TinyFish documents both
ceilings per API key, not per account, so the numbered key pool does raise the
total. Records why a free product is still worth hosting — the endpoints
require a key, so hosting is what removes the signup.
Waleed
1465e94574