docs(tinyfish): fix the npx swap wording, changelog the self-review fixes

Author: londondavila

plugins/tinyfish/CHANGELOG.md

@@ -7,6 +7,10 @@
 - Skill: `/tinyfish:feedback` quotes the title as well as the body: `--title "$title" --body-file "$body_file"`. The summary is derived from the user's free-form text too, so backticks or `$(…)` in it were evaluated by the filing shell. Also prohibits `eval` and constructed command strings.
 - Plugin README lists `~/.grok` among the config directories doctor reads; the CLI added a grok harness.
 - Skill: `/tinyfish:doctor` scopes the Cursor `unattended_safe` caveat to `2` and `3`; the CLI still gates `connect cursor` on its own authenticated call.
+- Skill: `/tinyfish:doctor` reads reach off `proves_harness_reach` rather than off `auth_mode`. A harness whose own client reports a live connection is wire evidence — Claude Code on OAuth included — and the skill was telling the agent to report it as unverified presence.
+- Skill: `/tinyfish:doctor` says to prefix `repairs[].command`; the CLI emits bare `tinyfish …`, which is not on PATH on the npx-only installs the skill is written for.
+- Skill: `/tinyfish:feedback` writes the title to a file like the body. A `title=…` assignment evaluates backticks and `$(…)` exactly as the command line does, so quoting the expansion alone moved the injection upstream rather than closing it.
+- Plugin README: `doctor` reports every run to TinyFish, not only when a repair runs, and diagnosis makes authenticated calls rather than only reading config.
 
 ## 1.2.3 (2026-08-17)
 

plugins/tinyfish/skills/doctor/SKILL.md

@@ -85,8 +85,8 @@ healthy sibling will answer cheerfully while the broken one stays broken.
 ## 3. Repair
 
 Run only commands that appear in `repairs[]`, and show `command` before running it. They
-arrive as bare `tinyfish …`; with no global install, run them as
-`npx -y @tiny-fish/cli@latest <command without the leading `tinyfish`>`. Keep
+arrive as bare `tinyfish …`, which is not on PATH under `npx` — swap that leading word for
+`npx -y @tiny-fish/cli@latest` when there is no global install. Keep
 the order they arrive in: `action: auth-login` comes before `action: connect` because
 `connect` writes whichever key is stored, so a dead one has to be replaced first.
 

skills-src/doctor.md

@@ -85,8 +85,8 @@ healthy sibling will answer cheerfully while the broken one stays broken.
 ## 3. Repair
 
 Run only commands that appear in `repairs[]`, and show `command` before running it. They
-arrive as bare `tinyfish …`; with no global install, run them as
-`npx -y @tiny-fish/cli@latest <command without the leading `tinyfish`>`. Keep
+arrive as bare `tinyfish …`, which is not on PATH under `npx` — swap that leading word for
+`npx -y @tiny-fish/cli@latest` when there is no global install. Keep
 the order they arrive in: `action: auth-login` comes before `action: connect` because
 `connect` writes whichever key is stored, so a dead one has to be replaced first.
 

skills/tinyfish-doctor/SKILL.md

@@ -85,8 +85,8 @@ healthy sibling will answer cheerfully while the broken one stays broken.
 ## 3. Repair
 
 Run only commands that appear in `repairs[]`, and show `command` before running it. They
-arrive as bare `tinyfish …`; with no global install, run them as
-`npx -y @tiny-fish/cli@latest <command without the leading `tinyfish`>`. Keep
+arrive as bare `tinyfish …`, which is not on PATH under `npx` — swap that leading word for
+`npx -y @tiny-fish/cli@latest` when there is no global install. Keep
 the order they arrive in: `action: auth-login` comes before `action: connect` because
 `connect` writes whichever key is stored, so a dead one has to be replaced first.