@stim-cli/server 1.17.0 → 1.17.2

package/README.md

@@ -13,7 +13,8 @@ The design is in
 ## Commands
 
 ```bash
-stim-server [--port <n>]          # serve paired clients, port 7787 by default
+stim-server [--port <n>] [--loopback-only]
+                                  # serve paired clients, port 7787 by default
 stim-server pair [--port <n>] [--control]
                                   # print a single-use pairing payload
 stim-server devices [list]        # list pairings, approvals, requests and hosted sessions
@@ -28,6 +29,13 @@ stim-server service install|status|update|rollback|uninstall
                                   # run stim-server as a macOS LaunchAgent, see below
 ```
 
+`--loopback-only` makes the server listen on `127.0.0.1` only and refuse any request
+that names a remote peer (`X-Forwarded-For`, as `tailscale serve --https` adds), so
+phones and other Macs cannot connect; `/health` then reports `loopbackOnly: true`.
+Without it, the server also listens on this Mac's Tailscale addresses while Tailscale
+runs (see [Tailscale](#tailscale)). Stim Desktop starts its own server with the flag
+unless it serves phones.
+
 `--env KEY=VALUE` and `--path-prepend <dir>` (each repeatable) apply to the
 serving command: see [Run as a service](#run-as-a-service).
 
@@ -57,7 +65,7 @@ app (checked at most every 5 seconds), or `null` when the check fails. Stim
 Desktop uses it to find a running server and show its route. A request through `tailscale serve` or on a Tailscale address
 without an `Origin` or `Sec-Fetch-Site` header, which a web page's request
 carries, gets only `{ "server": "stim-server", "version", "protocol" }`, which Stim
-Desktop's Build machines list uses to find stim-server on the other Macs of the
+Desktop's Remote Macs list uses to find stim-server on the other Macs of the
 tailnet. A request from this Mac with a `Host` other than `127.0.0.1` or
 `localhost` gets HTTP 426, like any other plain HTTP request.
 
@@ -91,7 +99,7 @@ A person on the worker runs the command generated for their client Mac:
 ```bash
 stim-server setup --client <node-id> --ticket <43-base64url-characters> --expires <ISO-time> \
   --build --device-host [--port <n>] [--label <name>] \
-  [--env KEY=VALUE]... [--path-prepend <dir>]... [--yes] [--json]
+  [--env KEY=VALUE]... [--path-prepend <dir>]... [--yes] [--json] [--verbose]
 ```
 
 If the server is not installed globally, use `npx --yes --package @stim-cli/server@<version> stim-server`
@@ -144,8 +152,17 @@ unreadable routes refuse with a remedy. Tool checks print fixes for Xcode,
 simulator runtimes, CocoaPods, JDK, Android SDK and the Stim build; they install
 nothing. Android and CocoaPods checks are not needed for hosting alone.
 
-Plain progress goes to stdout; errors use `stim-server: <message>` on stderr.
-`--json` sends progress to stderr and prints one final payload with `ok`,
+In a terminal, setup prints a banner, then one line per step with a green check,
+a yellow arrow while a step runs, or a red cross; `NO_COLOR`, `TERM=dumb` and a
+non-terminal give plain `[ok]`, `[failed]` and `[pending]` marks, no colors and no
+in-place line. The y/N questions stay, one line each. The run ends with a
+headline such as "janics-mac-mini is ready to build for Janic's MacBook Pro", one
+line per approved capability, a `Fix` line for each skipped permission or missing
+tool, and one `To undo` line. `--verbose` prints every step with its detail, the
+install, service and route notes, and the long summary with the undo commands, as
+earlier releases did. Plain progress goes to stdout; errors use
+`stim-server: <message>` on stderr (when stdout is a terminal, the refusal appears on stdout only).
+`--json` sends the long (verbose) progress to stderr, without the banner, and prints one final payload with `ok`,
 `label`, `port`, `route` (state, DNS name, HTTPS port), `server` (version and
 Stim build), `managed`, separate `granted` request ids and client identities,
 `permissions`, `tools` and `warnings`. Final permission values are `granted`,
@@ -172,7 +189,7 @@ with detail `interrupted`, completes the journal, releases the setup claim,
 and exits 1. A typed N also exits 1; a question timeout follows ticket expiry
 and exits 2.
 
-The summary lists what is ready and the undo commands:
+The `To undo` line (or the `--verbose` summary) lists the undo commands:
 
 ```bash
 stim-server devices revoke <build-request-id>
@@ -199,8 +216,9 @@ same tailnet or with the Mac shared to the phone's user.
 addresses, never on every interface. It re-reads the Tailscale state in the
 background, so a server that started before Tailscale was up, or while it did
 not answer, starts listening on the Tailscale addresses once it runs, and stops
-when it goes away. In Stim Desktop, choose **Set up connection** in Settings >
-Phones to create and verify the private route without a terminal command. A
+when it goes away. In Stim Desktop, the Pair a Phone wizard (Settings > Phones) creates and
+verifies the private route without a terminal command; with the Phone app flag
+off, **Set up connection** on Settings > Server does. A
 missing or unreadable route keeps Desktop pairing unavailable; HTTPS setup may
 require Tailscale browser approval. Existing routes stay unchanged.
 
@@ -284,7 +302,7 @@ registration check. `hello` reports
 the capabilities and actions of the connection's device when it connects; a
 connection sees a new grant after it reconnects. Under Stim Host, an approved
 `hello` also carries the same `host` grants as `/health`, which `stim doctor`
-reports for hosting machines.
+reports for remote Macs.
 
 Every method other than `hello` needs `read`. A device with only `build`
 gets `forbidden` for all of them.
@@ -335,7 +353,7 @@ bundle, Android APK or prebuilt macOS app, stream the iOS simulator, Android emu
 iOS and Android apps connect back to Metro on the client Mac. Automatic placement remains in [#2266](https://github.com/appandflow/stim/issues/2266).
 
 The Stim client can name expected hosts with
-`stim settings set hosting.machines '["<mac>"]'` and request access with
+`stim settings set remote.machines '["<mac>"]'` and request access with
 `stim doctor --fix`. It stores a separate private credential in
 `$STIM_HOME/device-host-machines.json`, pins the worker's tailnet node, and
 reports approval under `deviceHosts` in doctor JSON. Plain doctor makes no
@@ -824,8 +842,8 @@ manifest requests are not launch proof; development remains `unverified` until
 the workspace observes the app's own bundle delivery.
 Approved clients use `stim ios|android --remote auto` for automatic device placement.
 They stay local while there is a free slot, no queued device run, normal memory
-pressure, no budget refusal and load below `offload.maxLoadPerCore`. Otherwise
-they rank compatible offers from `hosting.machines` and select a host, or wait
+pressure, no budget refusal and load below `server.maxLoadPerCore`. Otherwise
+they rank compatible offers from `remote.machines` and select a host, or wait
 locally if none admits. A reserve refusal after an offer fails with
 `STIM_HOSTING_REFUSED` and asks to retry; it does not re-place the built app.
 Automatic native macOS placement remains separate work.
@@ -938,7 +956,7 @@ before replacement. Automatic placement remains in
 ## Run as a service
 
 `stim-server service install` runs stim-server as a per-user LaunchAgent on
-macOS, so a build machine or a phone-serving Mac keeps it running without a
+macOS, so a remote Mac or a phone-serving Mac keeps it running without a
 terminal:
 
 ```bash
@@ -1079,18 +1097,18 @@ and uninstall of one label run one at a time.
 installed and, when `install` created it, the serve route. Logs, pairings and the host app stay; other labels may use the app. Use `--label` and `--port` to run a
 second service beside the first, for example with another `STIM_HOME`.
 
-To set up a build machine: install Stim and stim-server on the Mac, run
+To set up a remote Mac: install Stim and stim-server on the Mac, run
 `stim-server service install --serve` (with the pins its toolchain needs), set
-`offload.workerRoot` there, and on each client run
-`stim settings set offload.machines '["<mac>"]'` and `stim doctor --fix`.
-Approve the request on the build machine with
+`server.workerRoot` there, and on each client run
+`stim settings set remote.machines '["<mac>"]'` and `stim doctor --fix`.
+Approve the request on the remote Mac with
 `stim-server devices grant <id> --build`.
 
 ## Remote update
 
 A Mac this one approved for builds (`--build`) or device hosting
 (`--device-host`) can update this Mac's `stim-server service` over its tailnet
-connection, so the build machine keeps up with the client without ssh. A
+connection, so the remote Mac keeps up with the client without ssh. A
 server that offers it lists `server-update` in its `hello` features. A paired
 phone, a `read` or `control` device and a connection from this Mac cannot. The
 methods need that approval, not `read`:
@@ -1126,8 +1144,8 @@ of an existing hosted session still answers during the drain.
 
 Stim Desktop starts these updates through its own local stim-server with two
 methods that only the local Desktop control connection may call:
-`machines.update.start` takes `{ "machine" }`, an approved `offload.machines`
-or `hosting.machines` entry. It connects to that machine's pinned node with
+`machines.update.start` takes `{ "machine" }`, an approved `remote.machines`
+entry. It connects to that machine's pinned node with
 the stored credential and asks it for this server's npm release. When this
 server runs from a Stim checkout, it instead packs the checkout's workspace
 packages as `npm pack` would and sends them. `machines.update.status` takes
@@ -1160,7 +1178,7 @@ closes its connections and cancels its builds.
   average per CPU), `builds` (this Mac's own Stim runs in prebuild, pods or
   compile that it did not offload, plus the offloaded builds it runs), `maxBuilds` (its
   `concurrency.maxBuilds`, 0 when unlimited), `maxLoadPerCore` (its
-  `offload.maxLoadPerCore`, default 2), and `declined`: why it would refuse a
+  `server.maxLoadPerCore`, default 2), and `declined`: why it would refuse a
   build now, or null. It declines while it runs its limit of offloaded builds,
   while the worker root's volume has less than 10 GiB free, while `builds`
   reaches a non-zero `maxBuilds`, or while `loadPerCore` is at or above
@@ -1197,7 +1215,7 @@ closes its connections and cancels its builds.
   `assemble<variant>` for `abi` with ccache under the area's Stim home. A
   Gradle daemon leaves the build's process group, so no claim or slot tracks
   it. An Android build keeps the client's daemon warm, with Gradle's idle
-  timeout set to `offload.gradleDaemonIdleMinutes` (default 30; 0 stops it
+  timeout set to `server.gradleDaemonIdleMinutes` (default 30; 0 stops it
   when the build ends), and stops it when the build gets SIGTERM. Gradle
   fixes a daemon's idle timeout when the daemon starts, so a new value
   applies to the next daemon. Once no build of that client runs, stim-server
@@ -1269,7 +1287,7 @@ closes its connections and cancels its builds.
   is cancelled; one left by a server that crashed stays under
   `repos/<repo>/out/` until you delete it.
 
-The worker root is `offload.workerRoot` in this Mac's Stim settings, or
+The worker root is `server.workerRoot` in this Mac's Stim settings, or
 `$STIM_HOME/build-worker`. Each client gets `<root>/<device id>/`, with its
 blobs, caches (`CP_HOME_DIR`, `CP_CACHE_DIR`, the pnpm store and
 `GRADLE_USER_HOME` and SwiftPM) and one area
@@ -1712,10 +1730,10 @@ Events are `{ "event", "subscription", ... }`.
   one result for 60 seconds, shared by every connection: a request while the
   commands run waits for them, and `measuredAt` says when they started. The
   commands fail after 150 seconds. Servers that predate it answer
-  `unknown-method`. It also carries `buildMachines`, the `buildMachines` list
+  `unknown-method`. It also carries `buildMachines`, the `remoteMachines` list
   of `stim doctor --json --platform ios` (never with `--fix`), so a phone can
-  show whether each build machine takes builds. The server runs doctor only
-  when `offload.machines` names a machine, else the list is empty; it runs it
+  show whether each remote Mac takes builds. The server runs doctor only
+  when `remote.machines` names a machine, else the list is empty; it runs it
   in the registered workspace that ran doctor for iOS most recently, because
   doctor judges a machine against an app. Like a doctor run from a terminal,
   that records the run for the workspace. `buildMachines` is null with
@@ -1727,7 +1745,7 @@ Events are `{ "event", "subscription", ... }`.
   at a time, and sets `buildMachinesPending` while that background run has not
   settled a result yet, or the settled one is 60 seconds old or older. A client
   that wants the refreshed result asks `machine.details` again. It also
-  carries `buildClients`, the builds this Mac ran as a build machine, one entry
+  carries `buildClients`, the builds this Mac ran for other Macs, one entry
   per client Mac read from the `build` records of the audit log, with `id`,
   `name`, `builds`, `failed`, `buildMs`, `lastAt` and the same three counts
   for `today`, most recent client first, with `today` on this Mac's local

package/dist/{protocol-wBQmYsnp.mjs → protocol-Btu-PwQS.mjs}

@@ -1398,7 +1398,7 @@ function protocolJsonSchema() {
 					statsError: { type: "string" },
 					buildMachines: {
 						type: ["array", "null"],
-						description: "`buildMachines` from `stim doctor --json --platform ios`.",
+						description: "`remoteMachines` from `stim doctor --json --platform ios`.",
 						items: { type: "object" }
 					},
 					buildMachinesError: { type: "string" },
@@ -1406,7 +1406,7 @@ function protocolJsonSchema() {
 					buildMachinesPending: { type: "boolean" },
 					buildClients: {
 						type: "array",
-						description: "The builds this Mac ran for each client as a build machine, from the audit log.",
+						description: "The builds this Mac ran for each client, from the audit log.",
 						items: {
 							type: "object",
 							required: [

package/dist/protocol.mjs

@@ -1,3 +1,3 @@
-import { t as protocolJsonSchema } from "./protocol-wBQmYsnp.mjs";
+import { t as protocolJsonSchema } from "./protocol-Btu-PwQS.mjs";
 export * from "@stim-cli/core/protocol";
 export { protocolJsonSchema };

package/dist/protocol.schema.json

@@ -2119,7 +2119,7 @@
             "array",
             "null"
           ],
-          "description": "`buildMachines` from `stim doctor --json --platform ios`.",
+          "description": "`remoteMachines` from `stim doctor --json --platform ios`.",
           "items": {
             "type": "object"
           }
@@ -2135,7 +2135,7 @@
         },
         "buildClients": {
           "type": "array",
-          "description": "The builds this Mac ran for each client as a build machine, from the audit log.",
+          "description": "The builds this Mac ran for each client, from the audit log.",
           "items": {
             "type": "object",
             "required": [

package/dist/{stim-server-CP50F1Y_.mjs → stim-server-CJIlV28Y.mjs}

@@ -1,4 +1,4 @@
-import { n as protocol_exports } from "./protocol-wBQmYsnp.mjs";
+import { n as protocol_exports } from "./protocol-Btu-PwQS.mjs";
 import { createRequire } from "node:module";
 import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
 import { basename, delimiter, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
@@ -33,6 +33,8 @@ function parseEnvironment(output) {
 * The login shell's environment, as Stim Desktop captures it: a process started by launchd lacks the
 * PATH entries and variables such as ANDROID_HOME that the shell profile sets. The shell writes to a
 * file because a background process started by a profile can keep a pipe open after the shell exits.
+* It runs in its own session: an interactive shell on the caller's terminal takes over the foreground process group,
+* and the caller is then stopped with SIGTTOU at its next terminal write.
 */
 function loginShellEnvironment() {
 	const dir = mkdtempSync(join(tmpdir(), "stim-server-env-"));
@@ -45,6 +47,7 @@ function loginShellEnvironment() {
 			file
 		], {
 			stdio: "ignore",
+			detached: true,
 			timeout: 15e3,
 			killSignal: "SIGKILL"
 		});
@@ -845,15 +848,27 @@ function answersAs(health, expected) {
 	return !health.stimBuild || !expected.stimBuild || health.stimBuild === expected.stimBuild;
 }
 const packageNames = (entries) => entries.map((entry) => isJsonObject(entry) ? `${String(entry.name)}@${String(entry.version)}` : "?").join(", ");
-/** Why `npm audit signatures --json` output does not vouch for every installed package, or null when it does. */
-function signatureProblem(output) {
+const lastLines = (text) => text.trim().split("\n").slice(-8).join("\n");
+/**
+* Why `npm audit signatures --json` output does not vouch for every installed package, or null when it does. When npm
+* fails it prints `{"error":{"summary","detail"}}` on stdout, or only text on stderr; the message carries that error.
+*/
+function signatureProblem(output, stderr = "") {
 	let report;
 	try {
 		report = JSON.parse(output);
 	} catch {
-		return "npm audit signatures did not print a JSON report";
+		report = null;
+	}
+	if (isJsonObject(report) && isJsonObject(report.error)) {
+		const { summary, detail } = report.error;
+		const text = [summary, detail].filter((part) => typeof part === "string" && part.trim() !== "");
+		if (text.length) return `npm audit signatures failed: ${text.map((part) => part.trim()).join(" ")}`;
+	}
+	if (!isJsonObject(report) || !Array.isArray(report.invalid) || !Array.isArray(report.missing)) {
+		const error = lastLines(stderr);
+		return `npm audit signatures did not print a JSON report${error ? `:\n${error}` : ""}`;
 	}
-	if (!isJsonObject(report) || !Array.isArray(report.invalid) || !Array.isArray(report.missing)) return "npm audit signatures did not print a JSON report";
 	if (report.invalid.length) return `npm found invalid registry signatures or attestations: ${packageNames(report.invalid)}`;
 	if (report.missing.length) return `npm found packages without registry signatures: ${packageNames(report.missing)}`;
 	return null;
@@ -1104,6 +1119,10 @@ function findTailscale(env) {
 	for (const dir of (env.PATH ?? "").split(delimiter)) if (dir && executable(join(dir, "tailscale"))) return join(dir, "tailscale");
 	return executable(MAC_APP_BINARY) ? MAC_APP_BINARY : null;
 }
+function tailscaleInstall(env, isExecutable = executable) {
+	if (isExecutable(MAC_APP_BINARY)) return "app";
+	return (env.PATH ?? "").split(delimiter).some((dir) => dir && isExecutable(join(dir, "tailscale"))) ? "cli" : "none";
+}
 function parseTailscaleStatus(value) {
 	if (!isJsonObject(value) || typeof value.BackendState !== "string") return {
 		state: "unavailable",
@@ -1897,7 +1916,6 @@ function serverBuild(script) {
 	}
 }
 const describeBuild = (build) => `stim-server ${build.version}${build.stimBuild ? ` (Stim build ${build.stimBuild})` : ""}`;
-const lastLines = (text) => text.trim().split("\n").slice(-8).join("\n");
 function sameFile(a, b) {
 	try {
 		return realpathSync(a) === realpathSync(b);
@@ -1928,6 +1946,32 @@ function installedIntegrity(staging) {
 		return null;
 	}
 }
+/**
+* The uploaded package files by package name, as `file:` specs. npm `audit signatures` skips a node only when its
+* dependent's spec is a file spec (npm lib/utils/verify-signatures.js), so the staging project lists every uploaded
+* package as a direct dependency and overrides every edge to it with `$name`.
+*/
+async function localPackageSpecs(dir, names) {
+	const specs = {};
+	for (const file of names) {
+		const path = join(dir, file);
+		const manifest = await run$2("/usr/bin/tar", [
+			"-xzOf",
+			path,
+			"package/package.json"
+		], process.env, 6e4);
+		let name;
+		try {
+			name = JSON.parse(manifest.stdout).name;
+		} catch {
+			name = null;
+		}
+		if (!manifest.ok || typeof name !== "string" || !name) throw new ServiceError(`${path} is not an npm package file.${manifest.ok ? "" : `\n${lastLines(manifest.stderr)}`}`);
+		if (specs[name]) throw new ServiceError(`${dir} has more than one package file for ${name}.`);
+		specs[name] = `file:${path}`;
+	}
+	return specs;
+}
 async function installServer(versions, source, node, log) {
 	mkdirSync(versions, { recursive: true });
 	for (const entry of readdirSync(versions)) if (entry.startsWith(".install-")) rmSync(join(versions, entry), {
@@ -1941,6 +1985,7 @@ async function installServer(versions, source, node, log) {
 		const registry = [`--registry=${REGISTRY}`, `--@stim-cli:registry=${REGISTRY}`];
 		let files = [];
 		let specs;
+		let localPackages = null;
 		if ("release" in source) specs = [`${SERVER_PACKAGE}@${source.release}`];
 		else {
 			const names = readdirSync(source.from).filter((name) => name.endsWith(".tgz"));
@@ -1949,9 +1994,16 @@ async function installServer(versions, source, node, log) {
 				name,
 				sha256: createHash("sha256").update(readFileSync(join(source.from, name))).digest("hex")
 			}));
-			specs = names.map((name) => join(source.from, name));
-		}
-		writeFileSync(join(staging, "package.json"), "{ \"private\": true }\n");
+			specs = [];
+			localPackages = await localPackageSpecs(source.from, names);
+		}
+		const overrides = localPackages && Object.fromEntries(Object.keys(localPackages).map((name) => [name, `$${name}`]));
+		const project = localPackages ? {
+			private: true,
+			dependencies: localPackages,
+			overrides
+		} : { private: true };
+		writeFileSync(join(staging, "package.json"), `${JSON.stringify(project, null, 2)}\n`);
 		log(`Installing ${"release" in source ? `${SERVER_PACKAGE}@${source.release} from ${REGISTRY}` : `${files.length} package file(s) from ${source.from}`}.`);
 		const installed = await run$2(npm, [
 			"install",
@@ -1966,14 +2018,15 @@ async function installServer(versions, source, node, log) {
 			...specs
 		], env, NPM_TIMEOUT_MS);
 		if (!installed.ok) throw new ServiceError(`npm install failed:\n${lastLines(installed.stderr)}`);
-		const problem = signatureProblem((await run$2(npm, [
+		const audit = await run$2(npm, [
 			"audit",
 			"signatures",
 			"--json",
 			"--prefix",
 			staging,
 			...registry
-		], env, NPM_TIMEOUT_MS)).stdout);
+		], env, NPM_TIMEOUT_MS);
+		const problem = signatureProblem(audit.stdout, audit.stderr);
 		if (problem) throw new ServiceError(`${problem}. Not switching to it.`);
 		const script = join(staging, ...SERVER_SCRIPT);
 		const build = existsSync(script) ? serverBuild(script) : null;
@@ -2534,8 +2587,8 @@ function nonEmptyDir(path) {
 	}
 }
 function gradleDaemonIdleMs() {
-	const definition = settingDefinition("offload.gradleDaemonIdleMinutes");
-	const value = loadConfig()?.offload?.gradleDaemonIdleMinutes;
+	const definition = settingDefinition("server.gradleDaemonIdleMinutes");
+	const value = loadConfig()?.server?.gradleDaemonIdleMinutes;
 	return (typeof value === "number" && settingValueError(definition, value) === null ? value : definition.default) * 6e4;
 }
 const GRADLE_DAEMON = "org.gradle.launcher.daemon.bootstrap.GradleDaemon";
@@ -3258,6 +3311,106 @@ var BuildSession = class {
 	}
 };
 //#endregion
+//#region src/setup-output.ts
+function setupDisplayFor(stdoutIsTty, env, raw) {
+	return {
+		tty: stdoutIsTty,
+		color: stdoutIsTty && !env.NO_COLOR && env.TERM !== "dumb",
+		raw
+	};
+}
+const BANNER = [
+	"      _   _",
+	"  ___| |_(_)_ __ ___        ___  ___ _ ____   _____ _ __",
+	" / __| __| | '_ ` _ \\ ____ / __|/ _ \\ '__\\ \\ / / _ \\ '__|",
+	" \\__ \\ |_| | | | | | |____|\\__ \\  __/ |   \\ V /  __/ |",
+	" |___/\\__|_|_| |_| |_|     |___/\\___|_|    \\_/ \\___|_|"
+];
+const CHECK = String.fromCharCode(10003);
+const CROSS = String.fromCharCode(10007);
+const ARROW = String.fromCharCode(8594);
+const CODES = {
+	green: 32,
+	yellow: 33,
+	red: 31,
+	dim: 2,
+	bold: 1
+};
+const WAITING = /* @__PURE__ */ new Set([
+	"approve",
+	"permissions.screenRecording",
+	"permissions.deviceControl"
+]);
+var SetupPrinter = class {
+	transient = false;
+	write;
+	display;
+	verbose;
+	constructor(write, display, verbose) {
+		this.write = write;
+		this.display = display;
+		this.verbose = verbose;
+	}
+	paint(code, text) {
+		return this.display.color ? `\u001b[${CODES[code]}m${text}\u001b[0m` : text;
+	}
+	mark(state) {
+		const { color } = this.display;
+		if (state === "ok") return color ? this.paint("green", CHECK) : "[ok]";
+		if (state === "failed") return color ? this.paint("red", CROSS) : "[failed]";
+		if (state === "running") return color ? this.paint("yellow", ARROW) : "[..]";
+		return color ? this.paint("yellow", "!") : `[${state}]`;
+	}
+	clear() {
+		if (!this.transient) return;
+		this.display.raw("\r\x1B[2K");
+		this.transient = false;
+	}
+	line(text) {
+		this.clear();
+		this.write(text);
+	}
+	banner() {
+		if (!this.display.tty) return;
+		this.write(this.paint("bold", BANNER.join("\n")));
+		this.write("");
+	}
+	step(step) {
+		if (this.verbose) {
+			const { state, title, detail, fix } = step;
+			this.line(`[${state}] ${title}${detail ? `: ${detail}` : ""}${fix ? `\nFix: ${fix}` : ""}`);
+			return;
+		}
+		if (step.state === "running") {
+			if (!step.running) return;
+			if (this.display.tty && this.display.color) {
+				this.clear();
+				this.display.raw(`${this.mark("running")} ${step.running}`);
+				this.transient = true;
+			} else if (WAITING.has(step.id) || this.display.tty) this.line(`${this.mark("running")} ${step.running}`);
+			return;
+		}
+		if (step.hidden) {
+			this.clear();
+			return;
+		}
+		const text = step.text ?? `${step.title}${step.detail ? `: ${step.detail}` : ""}`;
+		this.line(`${this.mark(step.state)} ${text}`);
+	}
+	result(lines) {
+		this.clear();
+		for (const { state, text } of lines) this.write(`${this.mark(state)} ${text}`);
+	}
+	headline(state, text) {
+		this.clear();
+		this.write("");
+		this.write(`${this.mark(state)} ${this.paint(state === "ok" ? "green" : state === "failed" ? "red" : "yellow", text)}`);
+	}
+	dim(text) {
+		this.line(this.paint("dim", text));
+	}
+};
+//#endregion
 //#region src/setup-journal.ts
 function writeSetupJournal(hash, journal) {
 	const file = setupJournalFile(hash);
@@ -3324,7 +3477,8 @@ function parseSetupArgs(args, now) {
 				multiple: true
 			},
 			yes: { type: "boolean" },
-			json: { type: "boolean" }
+			json: { type: "boolean" },
+			verbose: { type: "boolean" }
 		}
 	});
 	if (!values.client?.trim()) throw new SetupRefusal("--client takes a tailnet node id.");
@@ -3353,7 +3507,8 @@ function parseSetupArgs(args, now) {
 		env,
 		pathPrepend,
 		yes: values.yes === true,
-		json: values.json === true
+		json: values.json === true,
+		verbose: values.verbose === true
 	};
 }
 function selectGrants(records, match) {
@@ -3394,6 +3549,11 @@ function setupVersionDecision(current, desired, managed) {
 	if (managed && compareVersions(current, desired) < 0) return "update";
 	return compareVersions(current.replace(/-.*/, ""), SETUP_MIN_VERSION) < 0 ? "too-old" : "reuse";
 }
+function tailscaleRefusal(install) {
+	if (install === "none") return "Install Tailscale on this Mac and sign in to the same tailnet: https://tailscale.com/download/mac";
+	if (install === "app") return "Turn on Tailscale from its menu bar icon on this Mac, then run this again.";
+	return "Run tailscale up on this Mac, then run this again.";
+}
 function setupExitCode(journal) {
 	if (journal.steps.some((s) => s.state === "failed")) return 1;
 	if (journal.granted.length === 0) return 2;
@@ -3456,6 +3616,7 @@ function defaultSetupDeps() {
 		now: Date.now,
 		sleep,
 		tty: process.stdin.isTTY === true,
+		display: setupDisplayFor(process.stdout.isTTY === true, process.env, (text) => void process.stdout.write(text)),
 		stdout: (line) => console.log(line),
 		stderr: (line) => console.error(line),
 		confirm: (question, timeoutMs) => confirmSetup(createInterface({
@@ -3488,7 +3649,7 @@ function defaultSetupDeps() {
 			if (process.platform !== "darwin") throw new SetupRefusal("setup runs only on macOS.");
 			if (compareVersions(process.versions.node, "22.12.0") < 0) throw new SetupRefusal("setup needs Node 22.12 or later.");
 			const status = await readRawTailscaleStatus(binary(), process.env);
-			if (!isJsonObject(status) || !isJsonObject(status.Self) || typeof status.Self.DNSName !== "string" || !status.Self.DNSName) throw new SetupRefusal("Start Tailscale on this Mac: tailscale up.");
+			if (!isJsonObject(status) || !isJsonObject(status.Self) || typeof status.Self.DNSName !== "string" || !status.Self.DNSName) throw new SetupRefusal(tailscaleRefusal(tailscaleInstall(process.env)));
 			if (!isJsonObject(status.Peer) || !Object.values(status.Peer).some((p) => isJsonObject(p) && p.ID === options.nodeId)) throw new SetupRefusal("That Mac is not on this tailnet");
 			if (!(await run$2("launchctl", ["print", `gui/${process.getuid?.()}`])).ok) throw new SetupRefusal("Log in to a GUI session on this Mac before running setup.");
 			return { dnsName: status.Self.DNSName.replace(/\.$/, "") };
@@ -3518,7 +3679,6 @@ function defaultSetupDeps() {
 		records: (now) => [...readBuildClients(now), ...readDeviceHostClients(now)],
 		grant: grantDevice,
 		panes: hostPermissionPanes,
-		permissions: readHostPermissions,
 		requestPermissions: requestHostPermissions,
 		async openPane(pane) {
 			const result = await run$2("/usr/bin/open", [`x-apple.systempreferences:com.apple.preference.security?${pane}`]);
@@ -3552,28 +3712,30 @@ function requireApprovalMode(deps, options) {
 async function checkPermissions(deps, options, host, desktop, output, report) {
 	const wait = (work) => interruptible(work, deps.signal);
 	const panes = await wait(deps.panes());
-	for (const [key, field, title, pane, feature] of [[
+	for (const [key, field, title, pane, feature, label] of [[
 		"screenRecording",
 		"screenRecording",
 		panes.screen,
 		"Privacy_ScreenCapture",
-		"viewing hosted simulators"
+		"viewing hosted simulators",
+		"Screen recording"
 	], [
 		"deviceControl",
 		"accessibility",
 		panes.control,
 		"Privacy_Accessibility",
-		"controlling hosted simulators"
+		"controlling hosted simulators",
+		"Device control"
 	]]) {
 		const id = `permissions.${key}`;
-		const read = async () => desktop ? (await wait(deps.health(options.port)))?.host ?? null : wait(deps.permissions(host.executable));
+		const read = async () => (await wait(deps.health(options.port)))?.host ?? null;
 		let permissions = await read();
 		if (permissions?.[field]) {
 			output.permissions[key] = "granted";
-			report(id, "ok", title);
+			report(id, "ok", title, "Already granted.", void 0, { text: `${label} permission already granted` });
 			continue;
 		}
-		report(id, "running", title, `Click Allow for ${desktop ? "the app serving this port" : host.name}. Prompts appear on this Mac's screen. Press s in a terminal to skip.`);
+		report(id, "running", title, `Click Allow for ${desktop ? "the app serving this port" : host.name}. Prompts appear on this Mac's screen. Press s in a terminal to skip.`, void 0, { running: `${label} permission: click Allow for ${desktop ? "the app serving this port" : host.name} on this Mac's screen (press s to skip)` });
 		if (!desktop) await wait(deps.requestPermissions(host.app));
 		const start = deps.now();
 		let opened = false, skipped = false;
@@ -3589,10 +3751,87 @@ async function checkPermissions(deps, options, host, desktop, output, report) {
 			permissions = await read();
 		}
 		output.permissions[key] = permissions?.[field] ? "granted" : skipped ? "skipped" : "denied";
-		report(id, permissions?.[field] ? "ok" : skipped ? "skipped" : "pending", title, permissions?.[field] ? "Granted." : `${skipped ? "skipped" : "pending"}: ${feature} will not work.`, `System Settings > Privacy & Security > ${title}`);
+		report(id, permissions?.[field] ? "ok" : skipped ? "skipped" : "pending", title, permissions?.[field] ? "Granted." : `${skipped ? "skipped" : "pending"}: ${feature} will not work.`, `System Settings > Privacy & Security > ${title}`, { text: permissions?.[field] ? `${label} permission granted` : `${label} permission ${skipped ? "skipped" : "not granted"}: ${feature} will not work` });
 	}
 }
-function summarizeSetup(output, options, log) {
+function toolChecks(tools, stimBuild) {
+	return [
+		[
+			"Xcode",
+			!!tools.xcode && !!tools.simulatorSdk,
+			tools.xcode ?? "Missing Xcode or iOS SDK",
+			"Install Xcode from the App Store; sudo xcodebuild -runFirstLaunch"
+		],
+		[
+			"iOS runtime",
+			tools.runtimes.length > 0,
+			tools.runtimes.join(", ") || "No iOS simulator runtime",
+			"xcodebuild -downloadPlatform iOS"
+		],
+		[
+			"CocoaPods",
+			!!tools.cocoapods,
+			tools.cocoapods ?? "Missing CocoaPods",
+			"brew install cocoapods; or gem install bundler"
+		],
+		[
+			"JDK",
+			!!tools.jdk,
+			tools.jdk ?? "Missing JDK",
+			"brew install --cask zulu@17"
+		],
+		[
+			"Android SDK",
+			!!tools.androidSdk?.platforms.length && !!tools.androidSdk.buildTools.length && !!tools.androidSdk.ndk.length,
+			tools.androidSdk ? JSON.stringify(tools.androidSdk) : "Missing Android SDK",
+			"Install Android Studio or set ANDROID_HOME"
+		],
+		[
+			"Stim build",
+			!!stimBuild && stimBuild === tools.stimBuild,
+			`${stimBuild ?? "unknown"} (setup: ${tools.stimBuild ?? "unknown"})`,
+			"Install This Mac's Build from Stim Desktop > Settings > Remote Macs"
+		]
+	];
+}
+const capabilityNoun = (capability) => capability === "build" ? "builds" : "hosted simulators";
+function approvalQuestion(concise, name, capability, nodeId) {
+	if (!concise) {
+		const verb = capability === "build" ? "build on this Mac" : "host simulators on this Mac";
+		return `${name} (node ${nodeId.slice(0, 4)}...) asks to ${verb}. Approve? [y/N] `;
+	}
+	return `Approve ${name} to ${capability === "build" ? "build here (runs its project code" : "host simulators here (runs its app code"} on this Mac)? [y/N] `;
+}
+function serverText(desktop, decision, version) {
+	if (desktop) return `using the app's stim-server ${version}`;
+	return `stim-server ${version} ${decision === "reuse" ? "already installed" : "installed"}`;
+}
+function approvalView(complete) {
+	return complete ? { hidden: true } : { text: "no approval before the ticket expired: builds or hosted simulators will not work" };
+}
+function printSuccess(output, options, concise) {
+	const { printer, gaps, exit } = concise;
+	const machine = output.route.dnsName?.split(".")[0] ?? output.label;
+	const client = output.granted[0]?.client.name ?? options.nodeId;
+	const names = {
+		build: "build",
+		"device-host": "host simulators"
+	};
+	const what = options.capabilities.map((c) => names[c]).join(" and ");
+	if (exit === 0) printer.headline("ok", `${machine} is ready to ${what} for ${client}`);
+	else if (exit === 1) printer.headline("failed", "Setup did not finish");
+	else if (exit === 2) printer.headline("pending", "No request was approved before the ticket expired");
+	else printer.headline("pending", `${machine} is set up, with gaps`);
+	printer.result(output.granted.map((g) => ({
+		state: "ok",
+		text: `${capabilityNoun(g.capability)}: approved for ${g.client.name} (request ${g.id})`
+	})));
+	for (const gap of gaps) printer.line(`  Fix (${gap.subject}): ${gap.fix}`);
+	const undo = [...output.granted.map((g) => `stim-server devices revoke ${g.id}`), ...output.managed && output.granted.length ? [`stim-server service uninstall --label ${output.label}`] : []];
+	if (undo.length) printer.dim(`To undo: ${undo.join("; ")}`);
+}
+function summarizeSetup(output, options, log, concise) {
+	if (concise) return printSuccess(output, options, concise);
 	for (const capability of options.capabilities) if (!output.granted.some((g) => g.capability === capability)) output.warnings.push(`${capability === "build" ? "Builds" : "Hosted simulators"} have no approval.`);
 	if (options.capabilities.includes("device-host")) {
 		for (const [key, feature] of [["screenRecording", "Viewing hosted simulators"], ["deviceControl", "Controlling hosted simulators"]]) if (output.permissions[key] !== "granted") output.warnings.push(`${feature} requires a macOS permission grant.`);
@@ -3644,6 +3883,17 @@ async function runSetup(args, version, deps) {
 		warnings: []
 	};
 	const log = (line) => (json ? deps.stderr : deps.stdout)(line);
+	const verbose = args.includes("--verbose");
+	const display = deps.display ?? {
+		tty: false,
+		color: false,
+		raw: () => {}
+	};
+	const printer = new SetupPrinter(log, display, json || verbose);
+	const concise = !json && !verbose;
+	const chatter = concise ? () => {} : log;
+	const gaps = [];
+	if (!json) printer.banner();
 	const wait = (work) => interruptible(work, deps.signal);
 	let release;
 	let active = "args";
@@ -3656,7 +3906,7 @@ async function runSetup(args, version, deps) {
 			throw error;
 		}
 	};
-	const step = (id, state, title, detail, fix) => {
+	const step = (id, state, title, detail, fix, view = {}) => {
 		if (deps.signal?.aborted && state !== "failed") throw new SetupRefusal("interrupted");
 		active = id;
 		const value = {
@@ -3670,7 +3920,14 @@ async function runSetup(args, version, deps) {
 		if (index < 0) journal.steps.push(value);
 		else journal.steps[index] = value;
 		save();
-		log(`${state === "ok" ? "[ok]" : state === "failed" ? "[failed]" : `[${state}]`} ${title}${detail ? `: ${detail}` : ""}${fix ? `\nFix: ${fix}` : ""}`);
+		if (fix && state !== "ok" && state !== "running") gaps.push({
+			subject: title,
+			fix
+		});
+		printer.step({
+			...value,
+			...view
+		});
 	};
 	try {
 		options = parseSetupArgs(args, deps.now());
@@ -3693,14 +3950,14 @@ async function runSetup(args, version, deps) {
 		requireApprovalMode(deps, options);
 		release = deps.claim();
 		deps.prune(deps.now());
-		step("preflight", "ok", "Preflight");
+		step("preflight", "ok", "Preflight", void 0, void 0, { hidden: true });
 		const opts = options;
 		let installed = null;
 		let host;
 		let script = "";
 		let desktop = false;
 		await deps.withInstallClaim(opts.label, async () => {
-			step("server", "running", "stim-server");
+			step("server", "running", "stim-server", void 0, void 0, { running: "Checking stim-server" });
 			installed = await wait(deps.installed(opts.label));
 			if (installed && installed.port !== opts.port) throw new SetupRefusal(`${opts.label} uses port ${installed.port}; rerun with that --port or another --label.`);
 			const health = await wait(deps.health(opts.port));
@@ -3718,7 +3975,7 @@ async function runSetup(args, version, deps) {
 					script: installed.script,
 					node: installed.node,
 					port: installed.port
-				}, { release: version }, log))) log(note);
+				}, { release: version }, chatter))) chatter(note);
 				installed = await wait(deps.installed(opts.label));
 				const updated = await wait(deps.health(opts.port));
 				if (!updated) throw new SetupRefusal("The updated server is not answering.");
@@ -3728,7 +3985,7 @@ async function runSetup(args, version, deps) {
 				};
 				script = installed?.script ?? "";
 			} else if (decision === "install") {
-				const target = await wait(deps.install(deps.versions(opts.label), { release: version }, deps.node, log));
+				const target = await wait(deps.install(deps.versions(opts.label), { release: version }, deps.node, chatter));
 				script = target.script;
 				output.server = target.build;
 			} else {
@@ -3738,10 +3995,10 @@ async function runSetup(args, version, deps) {
 				};
 				script = installed?.script ?? "";
 			}
-			step("server", "ok", `stim-server ${output.server.version}`, desktop ? "Using the existing server; permissions are that app's." : decision === "reuse" ? "Already installed; never downgrades." : "Installed exact release.");
-			step("host", "running", "Stim Host");
+			step("server", "ok", `stim-server ${output.server.version}`, desktop ? "Using the existing server; permissions are that app's." : decision === "reuse" ? "Already installed; never downgrades." : "Installed exact release.", void 0, { text: serverText(desktop, decision, output.server.version) });
+			step("host", "running", "Stim Host", void 0, void 0, { running: "Installing Stim Host" });
 			host = await wait(deps.installHost());
-			step("host", "ok", "Stim Host", host.app);
+			step("host", "ok", "Stim Host", host.app, void 0, { text: "Stim Host installed" });
 			if (installed?.host) {
 				const app = dirname(dirname(dirname(installed.host)));
 				host = {
@@ -3751,7 +4008,7 @@ async function runSetup(args, version, deps) {
 					name: basename(app, ".app")
 				};
 			}
-			step("service", "running", "Service");
+			step("service", "running", "Service", void 0, void 0, { running: "Starting the service" });
 			if (!desktop) {
 				for (const note of await wait(deps.installJob({
 					...opts,
@@ -3760,14 +4017,14 @@ async function runSetup(args, version, deps) {
 					script,
 					host,
 					requestPermissions: false
-				}))) log(note);
+				}))) chatter(note);
 				const ready = await wait(deps.health(opts.port));
 				if (!ready || ready.startup && ready.startup.state !== "ready") throw new SetupRefusal("The installed server is not ready; check service status.");
 			}
-			step("service", "ok", "Service", desktop ? "Reusing app server; no LaunchAgent installed." : `${opts.label} running.`);
+			step("service", "ok", "Service", desktop ? "Reusing app server; no LaunchAgent installed." : `${opts.label} running.`, void 0, { text: desktop ? "reusing the app server (no LaunchAgent)" : `LaunchAgent ${opts.label} running` });
 		});
 		const previous = desktop ? null : await wait(deps.installed(opts.label));
-		step("route", "running", "Tailnet route");
+		step("route", "running", "Tailnet route", void 0, void 0, { running: "Checking the tailnet route" });
 		const route = await wait(deps.route(opts.port));
 		output.route.state = route.state;
 		output.route.port = route.port;
@@ -3800,8 +4057,8 @@ async function runSetup(args, version, deps) {
 			}
 			throw error;
 		}
-		step("route", "ok", "Tailnet route", `${preflight.dnsName}: https port ${verified.port}`);
-		step("approve", "running", "Access approval", `Waiting until ${opts.expiresAt}.`);
+		step("route", "ok", "Tailnet route", `${preflight.dnsName}: https port ${verified.port}`, void 0, { text: `tailnet route https ${verified.port} (no Funnel)` });
+		step("approve", "running", "Access approval", `Waiting until ${opts.expiresAt}.`, void 0, { running: `Waiting for approval until ${opts.expiresAt}` });
 		const declined = /* @__PURE__ */ new Set();
 		requireApprovalMode(deps, opts);
 		while (deps.now() < Date.parse(opts.expiresAt)) {
@@ -3813,15 +4070,17 @@ async function runSetup(args, version, deps) {
 				now: deps.now()
 			});
 			for (const { capability, record, approved } of grants) {
-				const verb = capability === "build" ? "build on this Mac" : "host simulators on this Mac";
 				if (!approved && !opts.yes && !deps.tty) throw new SetupRefusal("To approve requests, rerun with --yes or in a terminal.");
 				if (!approved && !opts.yes) {
-					log(capability === "build" ? "This runs its project code on this Mac to build." : "This runs its native app code in session-owned simulators on this Mac.");
-					const yes = await wait(deps.confirm(`${record.name} (node ${opts.nodeId.slice(0, 4)}...) asks to ${verb}. Approve? [y/N] `, Math.max(1, Date.parse(opts.expiresAt) - deps.now())));
+					printer.clear();
+					if (!concise) log(capability === "build" ? "This runs its project code on this Mac to build." : "This runs its native app code in session-owned simulators on this Mac.");
+					const question = approvalQuestion(concise, record.name, capability, opts.nodeId);
+					const yes = await wait(deps.confirm(question, Math.max(1, Date.parse(opts.expiresAt) - deps.now())));
 					if (deps.now() >= Date.parse(opts.expiresAt)) break;
 					if (!yes) {
 						declined.add(capability);
-						deps.stderr(`stim-server: ${capability} approval refused.`);
+						printer.clear();
+						if (!(concise && display.tty)) deps.stderr(`stim-server: ${capability} approval refused.`);
 						step(`approve.${capability}`, "failed", `${capability} refused`, "No approval given.");
 						continue;
 					}
@@ -3840,55 +4099,18 @@ async function runSetup(args, version, deps) {
 						name: record.name
 					}
 				});
-				step(`approve.${capability}`, "ok", `${approved ? "Already approved" : "Approved"} ${record.name} (${opts.nodeId}) for ${capability === "build" ? "builds" : "hosted simulators"}`, `request ${record.id}`);
+				step(`approve.${capability}`, "ok", `${approved ? "Already approved" : "Approved"} ${record.name} (${opts.nodeId}) for ${capability === "build" ? "builds" : "hosted simulators"}`, `request ${record.id}`, void 0, { text: `${approved ? "already approved" : "approved"} ${record.name} for ${capabilityNoun(capability)}` });
 			}
 			if (opts.capabilities.every((c) => declined.has(c) || journal.granted.some((g) => g.capability === c))) break;
 			await wait(deps.sleep(Math.min(1e3, Math.max(0, Date.parse(opts.expiresAt) - deps.now()))));
 		}
-		step("approve", journal.granted.length === opts.capabilities.length ? "ok" : "pending", "Access approval", journal.granted.length === opts.capabilities.length ? "Chosen capabilities approved." : "Missing approval: builds or hosted simulators will not work. Generate a new command after expiry.");
+		step("approve", journal.granted.length === opts.capabilities.length ? "ok" : "pending", "Access approval", journal.granted.length === opts.capabilities.length ? "Chosen capabilities approved." : "Missing approval: builds or hosted simulators will not work. Generate a new command after expiry.", void 0, approvalView(journal.granted.length === opts.capabilities.length));
 		if (journal.granted.length) {
 			if (opts.capabilities.includes("device-host")) await checkPermissions(deps, opts, host, desktop, output, step);
-			step("tools", "running", "Tools");
+			step("tools", "running", "Tools", void 0, void 0, { running: "Checking build tools" });
 			const tools = await wait(deps.toolchain(opts));
 			if (!tools) throw new SetupRefusal("Could not read the local build toolchain.");
-			const checks = [
-				[
-					"Xcode",
-					!!tools.xcode && !!tools.simulatorSdk,
-					tools.xcode ?? "Missing Xcode or iOS SDK",
-					"Install Xcode from the App Store; sudo xcodebuild -runFirstLaunch"
-				],
-				[
-					"iOS runtime",
-					tools.runtimes.length > 0,
-					tools.runtimes.join(", ") || "No iOS simulator runtime",
-					"xcodebuild -downloadPlatform iOS"
-				],
-				[
-					"CocoaPods",
-					!!tools.cocoapods,
-					tools.cocoapods ?? "Missing CocoaPods",
-					"brew install cocoapods; or gem install bundler"
-				],
-				[
-					"JDK",
-					!!tools.jdk,
-					tools.jdk ?? "Missing JDK",
-					"brew install --cask zulu@17"
-				],
-				[
-					"Android SDK",
-					!!tools.androidSdk?.platforms.length && !!tools.androidSdk.buildTools.length && !!tools.androidSdk.ndk.length,
-					tools.androidSdk ? JSON.stringify(tools.androidSdk) : "Missing Android SDK",
-					"Install Android Studio or set ANDROID_HOME"
-				],
-				[
-					"Stim build",
-					!!output.server.stimBuild && output.server.stimBuild === tools.stimBuild,
-					`${output.server.stimBuild ?? "unknown"} (setup: ${tools.stimBuild ?? "unknown"})`,
-					"Install This Mac's Build from Stim Desktop > Settings > Build machines"
-				]
-			];
+			const checks = toolChecks(tools, output.server.stimBuild);
 			for (const [tool, present, detail, fix] of checks) {
 				const needed = opts.capabilities.includes("build") || tool === "Xcode" || tool === "iOS runtime" || tool === "Stim build";
 				output.tools.push({
@@ -3897,9 +4119,12 @@ async function runSetup(args, version, deps) {
 					detail,
 					fix
 				});
-				step(`tools.${tool}`, present || !needed ? "ok" : "pending", tool, !needed ? "Not needed for hosted simulators." : present ? detail : `${detail}; ${opts.capabilities.includes("build") ? "builds requiring this tool" : "hosted simulators"} will not work.`, present || !needed ? void 0 : fix);
+				step(`tools.${tool}`, present || !needed ? "ok" : "pending", tool, !needed ? "Not needed for hosted simulators." : present ? detail : `${detail}; ${opts.capabilities.includes("build") ? "builds requiring this tool" : "hosted simulators"} will not work.`, present || !needed ? void 0 : fix, { hidden: present || !needed });
 			}
-			step("tools", "ok", "Tools", "Checked; installs nothing.");
+			step("tools", "ok", "Tools", "Checked; installs nothing.", void 0, {
+				text: "build tools ready",
+				hidden: output.tools.some((t) => t.state === "missing")
+			});
 		}
 	} catch (error) {
 		const message = deps.signal?.aborted ? "interrupted" : error instanceof Error ? error.message : String(error);
@@ -3908,11 +4133,13 @@ async function runSetup(args, version, deps) {
 			step(active, expired ? "pending" : "failed", expired ? "Ticket expired" : "Setup refused", message, error instanceof SetupRefusal ? error.fix : void 0);
 		} catch (writeError) {
 			const detail = `Could not write the setup journal: ${writeError.message}`;
+			printer.clear();
 			deps.stderr(`stim-server: ${detail}`);
 			output.warnings.push(detail);
 		}
 		const code = error.code;
-		deps.stderr(`stim-server: ${code ? `${code}: ` : ""}${message}`);
+		printer.clear();
+		if (!(concise && display.tty)) deps.stderr(`stim-server: ${code ? `${code}: ` : ""}${message}`);
 		output.warnings.push(message);
 	} finally {
 		try {
@@ -3935,11 +4162,16 @@ async function runSetup(args, version, deps) {
 					detail: message
 				});
 				journal.exit = setupExitCode(journal);
+				printer.clear();
 				deps.stderr(`stim-server: ${message}`);
 				output.warnings.push(message);
 			}
 			output.ok = journal.exit === 0;
-			if (options) summarizeSetup(output, options, log);
+			if (options) summarizeSetup(output, options, log, concise ? {
+				printer,
+				gaps,
+				exit: journal.exit
+			} : void 0);
 			if (json) deps.stdout(JSON.stringify(output));
 		} finally {
 			release?.();
@@ -5179,11 +5411,14 @@ var AgentDeviceDriver = class {
 	listening(proxy) {
 		return new Promise((resolve, reject) => {
 			let output = "";
+			let errors = "";
 			const timer = setTimeout(() => finish(/* @__PURE__ */ new Error("The agent-device proxy did not report a listening address.")), this.options.startTimeoutMs);
 			const finish = (result) => {
 				clearTimeout(timer);
 				proxy.stdout?.off("data", onData);
-				proxy.off("exit", onExit);
+				proxy.stderr?.off("data", onError);
+				proxy.stderr?.resume();
+				proxy.off("close", onExit);
 				proxy.off("error", finish);
 				if (result instanceof Error) reject(result);
 				else resolve(result);
@@ -5193,10 +5428,13 @@ var AgentDeviceDriver = class {
 				const match = LISTENING.exec(output);
 				if (match) finish(new URL(match[1]));
 			};
-			const onExit = (code) => finish(/* @__PURE__ */ new Error(`The agent-device proxy exited with ${String(code)} before it was ready.`));
+			const onExit = (code) => finish(/* @__PURE__ */ new Error(`The agent-device proxy exited with ${String(code)} before it was ready.${errors.trim() ? ` ${errors.trim()}` : ""}`));
+			const onError = (chunk) => {
+				errors = (errors + chunk.toString()).slice(-400);
+			};
 			proxy.stdout?.on("data", onData);
-			proxy.stderr?.resume();
-			proxy.once("exit", onExit);
+			proxy.stderr?.on("data", onError);
+			proxy.once("close", onExit);
 			proxy.once("error", finish);
 		});
 	}
@@ -11000,12 +11238,12 @@ function part(outcome, label) {
 }
 const iosDoctorRanAt = ([, record]) => Date.parse(record.doctorRuns?.ios?.at ?? "") || 0;
 /**
-* Where `machine.details` runs `stim doctor` for the build machines: null when `offload.machines` names none, else
+* Where `machine.details` runs `stim doctor` for the remote Macs: null when `remote.machines` names none, else
 * the registered workspace that still exists and ran doctor for iOS most recently, or the first one; `cwd` is null
 * when no registered workspace exists. Doctor refuses outside a project, and judges a machine against that app.
 */
 function doctorWorkspace(config, exists) {
-	const machines = config?.offload?.machines;
+	const machines = config?.remote?.machines;
 	if (!Array.isArray(machines) || machines.length === 0) return null;
 	return { cwd: Object.entries(config?.projects ?? {}).filter(([path]) => exists(path)).reduce((best, entry) => best === null || iosDoctorRanAt(entry) > iosDoctorRanAt(best) ? entry : best, null)?.[0] ?? null };
 }
@@ -11015,10 +11253,10 @@ async function runDoctor(run, cwd) {
 		buildMachines: null,
 		buildMachinesError: error
 	};
-	const machines = payload.buildMachines;
+	const machines = payload.remoteMachines;
 	if (!Array.isArray(machines)) return {
 		buildMachines: null,
-		buildMachinesError: "This stim does not report build machines; update it."
+		buildMachinesError: "This stim does not report remote Macs; update it."
 	};
 	return { buildMachines: machines.filter((entry) => isObject(entry) && typeof entry.machine === "string" && typeof entry.state === "string") };
 }
@@ -11029,7 +11267,7 @@ const isObject = (value) => value !== null && typeof value === "object" && !Arra
 * and the rest of `machine.details` has nothing to do with it. `snapshot` never awaits doctor. It returns the last
 * settled result immediately (with `buildMachinesPending: true` alongside it once that result is `ttlMs` old or
 * older), starting at most one background run to refresh it; while no result has ever settled, it returns
-* `buildMachines: null` with `buildMachinesPending: true`. `offload.machines` naming no machine, or `doctor` being
+* `buildMachines: null` with `buildMachinesPending: true`. `remote.machines` naming no machine, or `doctor` being
 * an error or an unresolved workspace, answers synchronously and never starts a run.
 */
 var BuildMachinesCache = class {
@@ -11127,7 +11365,7 @@ async function loadMachineDetails(run, audit, readStats) {
 /**
 * The gc/stats part of one `machine.details` result shared by every connection: a request while a load runs joins
 * it, and a finished load answers for `ttlMs` after it settled, so phones cannot make the Mac run `stim gc` back
-* to back. Build machines are cached and refreshed separately by `BuildMachinesCache`, never joined into this
+* to back. Remote Macs are cached and refreshed separately by `BuildMachinesCache`, never joined into this
 * promise, so a re-poll observes its progress instead of the gc/stats snapshot from whenever this last loaded.
 */
 var MachineDetailsCache = class {
@@ -12425,7 +12663,7 @@ const failed = (code, message) => ({ error: {
 	message
 } });
 /**
-* Asks an approved build machine or device host to update its stim-server to what this Mac runs: the same npm
+* Asks an approved remote Mac or device host to update its stim-server to what this Mac runs: the same npm
 * release, or this checkout's own packed build. It connects with the credential `stim doctor --fix` stored for that
 * machine and sends the token only to the node it pinned.
 */
@@ -14756,6 +14994,10 @@ async function startServer(options) {
 			return;
 		}
 		const peer = peerAddress(request);
+		if (options.loopbackOnly && peer !== null) {
+			socket.end("HTTP/1.1 403 Forbidden\r\nConnection: close\r\nContent-Length: 0\r\n\r\n");
+			return;
+		}
 		if (limiter.blocked(peer ?? "local")) {
 			socket.end("HTTP/1.1 429 Too Many Requests\r\nConnection: close\r\nContent-Length: 0\r\n\r\n");
 			return;
@@ -14797,7 +15039,8 @@ async function startServer(options) {
 			},
 			tailscale: healthTailscale(tailscale),
 			route,
-			nativeViewerOpened
+			nativeViewerOpened,
+			...options.loopbackOnly ? { loopbackOnly: true } : {}
 		};
 		response.writeHead(startup.state === "ready" ? 200 : 503, { "content-type": "application/json" }).end(JSON.stringify(body));
 	};
@@ -14844,6 +15087,10 @@ async function startServer(options) {
 	};
 	async function listenOn(host) {
 		const server = createServer$1((request, response) => {
+			if (options.loopbackOnly && peerAddress(request) !== null) {
+				response.writeHead(403, { "content-type": "text/plain" }).end("This stim-server serves this Mac only.\n");
+				return;
+			}
 			if (localHealthRequest(request)) {
 				answerHealth(response);
 				return;
@@ -14912,7 +15159,7 @@ async function startServer(options) {
 	const monitor = options.tailscaleMonitor;
 	const listenFailures = /* @__PURE__ */ new Set();
 	const reconcile = async (snapshot) => {
-		const tailnet = snapshot.state.state === "running" ? snapshot.state.ips : [];
+		const tailnet = snapshot.state.state === "running" && !options.loopbackOnly ? snapshot.state.ips : [];
 		const wanted = /* @__PURE__ */ new Set([...options.hosts, ...tailnet]);
 		for (const [host, listener] of servers) {
 			if (wanted.has(host)) continue;
@@ -15064,12 +15311,13 @@ function watchTailscale(options) {
 //#endregion
 //#region bin/stim-server.ts
 const USAGE = `Usage:
-  stim-server [--port <n>] [--env KEY=VALUE]... [--path-prepend <dir>]...
+  stim-server [--port <n>] [--loopback-only] [--env KEY=VALUE]... [--path-prepend <dir>]...
                                     serve paired clients (default port ${DEFAULT_PORT});
+                                    --loopback-only serves this Mac only (127.0.0.1, no remote peers);
                                     --env and --path-prepend apply after the login shell's environment
   stim-server setup --client <node-id> --ticket <t> --expires <iso>
                     [--build] [--device-host] [--port <n>] [--label <name>]
-                    [--env KEY=VALUE]... [--path-prepend <dir>]... [--yes] [--json]
+                    [--env KEY=VALUE]... [--path-prepend <dir>]... [--yes] [--json] [--verbose]
                                     worker-side approval for this node and ticket until expiry
   stim-server service install [--port <n>] [--label <name>] [--serve]
                               [--env KEY=VALUE]... [--path-prepend <dir>]...
@@ -15115,7 +15363,7 @@ function routeNote(route, port) {
 function macName(tailscale) {
 	return tailscale.state === "running" && tailscale.hostName || hostname();
 }
-async function serve(port, extraEnv, pathPrepend) {
+async function serve(port, extraEnv, pathPrepend, loopbackOnly) {
 	const captureHost = hostFromExecutable(process.env.STIM_HOST_EXECUTABLE);
 	const login = loginShellEnvironment();
 	if (!login) console.error("stim-server: could not read the login shell environment; using this process environment.");
@@ -15141,6 +15389,7 @@ async function serve(port, extraEnv, pathPrepend) {
 			name: macName(tailscale),
 			host: captureHost,
 			hosts: ["127.0.0.1"],
+			...loopbackOnly ? { loopbackOnly: true } : {},
 			port,
 			stimCli: stim.cli,
 			stimVersion: stim.version,
@@ -15171,13 +15420,13 @@ async function serve(port, extraEnv, pathPrepend) {
 		}
 		if (note) console.error(note);
 	};
-	await announce(tailscaleBinary, tailscale);
-	monitor.onChange((snapshot, previous) => {
+	if (!loopbackOnly) monitor.onChange((snapshot, previous) => {
 		const { state } = snapshot;
 		if (state.state === "running") console.log("Tailscale is running.");
 		else if (previous.state.state === "running") console.error("Tailscale stopped.");
 		if (state.state === "running" || previous.state.state === "running") announce(snapshot.binary, state);
 	});
+	if (!loopbackOnly) await announce(tailscaleBinary, tailscale);
 	const shutdown = () => {
 		monitor.stop();
 		server.close().catch((error) => {
@@ -15308,6 +15557,7 @@ async function main() {
 		allowPositionals: true,
 		options: {
 			port: { type: "string" },
+			"loopback-only": { type: "boolean" },
 			json: { type: "boolean" },
 			control: { type: "boolean" },
 			read: { type: "boolean" },
@@ -15350,7 +15600,8 @@ async function main() {
 	}
 	if ((values.label !== void 0 || values.serve) && !service) fail(`--label and --serve apply only to \`service\`.\n${USAGE}`);
 	if ((values.release !== void 0 || values.from !== void 0) && !service) fail(`--release and --from apply only to \`service update\`.\n${USAGE}`);
-	if (command === void 0) return serve(port, extraEnv, pathPrepend);
+	if (values["loopback-only"] && command !== void 0) fail(`--loopback-only applies only to serving.\n${USAGE}`);
+	if (command === void 0) return serve(port, extraEnv, pathPrepend, values["loopback-only"] === true);
 	const grant = command === "devices" && sub === "grant";
 	if (values.read && !grant) fail(`--read applies only to \`devices grant\`.\n${USAGE}`);
 	if (values.build && !grant) fail(`--build applies only to \`devices grant\`.\n${USAGE}`);

package/dist/stim-server.mjs

@@ -4,6 +4,6 @@ const encode = (version) => version.split(".", 3).reduce((sum, part) => sum * 1e
 if (encode(process.versions.node) < encode("22.12.0")) {
 	process.stderr.write(`STIM_NODE_UNSUPPORTED: stim-server needs Node 22.12.0 or later; this is Node ${process.versions.node} at ${process.execPath}. To run stim-server where a project pins an older Node, see https://stim.appandflow.com/docs/requirements#older-node-pins\n`);
 	process.exitCode = 1;
-} else import("./stim-server-CP50F1Y_.mjs");
+} else import("./stim-server-CJIlV28Y.mjs");
 //#endregion
 export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stim-cli/server",
-  "version": "1.17.0",
+  "version": "1.17.2",
   "description": "Serves Stim status to paired clients over Tailscale, and runs reload and stop for clients granted control.",
   "license": "MIT",
   "repository": {
@@ -28,8 +28,8 @@
     "./protocol.schema.json": "./dist/protocol.schema.json"
   },
   "dependencies": {
-    "@stim-cli/core": "^1.17.0",
-    "stim": "1.17.0",
+    "@stim-cli/core": "^1.17.2",
+    "stim": "1.17.2",
     "ws": "^8.21.3"
   },
   "devDependencies": {