tapline-host 1.5.0 → 1.6.0

package/dist/api.js

@@ -0,0 +1,154 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+/** The most a call's JSON may be. */
+export const MAX_API_BODY = 1024 * 1024;
+export function safeEqual(a, b) {
+    const left = Buffer.from(a, "utf8");
+    const right = Buffer.from(b, "utf8");
+    if (left.length !== right.length)
+        return false;
+    return timingSafeEqual(left, right);
+}
+/** An address as one spelling: no brackets, lower case, and an IPv4-mapped IPv6 address as plain IPv4. */
+export function normalizeAddress(address) {
+    const plain = address.toLowerCase().replace(/^\[|\]$/g, "");
+    return plain.startsWith("::ffff:") && plain.includes(".") ? plain.slice("::ffff:".length) : plain;
+}
+/**
+ * The host's proof that it holds the token: an HMAC of the caller's fresh challenge and of the address and port the request
+ * arrived on, keyed by the token. They are in it so that a listener on another port, or on another address with the same
+ * port (::1 against 127.0.0.1), can't relay the probe to the real host and hand its proof back: a proof made for one
+ * endpoint never verifies for another. The token itself never leaves; thincall.ts computes the same value from the socket
+ * it connected to and sends the token only to a host that proves it for that endpoint.
+ */
+export function hostProof(token, challenge, address, port) {
+    return createHmac("sha256", token).update(`tapline-proof-v1\n${challenge}\n${normalizeAddress(address)}\n${port}`).digest("hex");
+}
+export function toApiAnswer(result) {
+    const parts = [];
+    let image;
+    for (const block of result.content) {
+        if (block.type === "text")
+            parts.push(block.text);
+        else if (block.type === "image" && image === undefined)
+            image = { mimeType: block.mimeType, dataBase64: block.data };
+    }
+    return { text: parts.join("\n"), isError: result.isError === true, ...(image !== undefined ? { image } : {}) };
+}
+function plain(res, status, text) {
+    res.writeHead(status, { "content-type": "text/plain; charset=utf-8" });
+    res.end(`${text}\n`);
+}
+function clientOf(req) {
+    const raw = req.headers["x-agent-client"];
+    const value = (Array.isArray(raw) ? raw[0] : raw)?.replace(/[^\w .@/-]/g, "").slice(0, 60);
+    return value !== undefined && value !== "" ? value : undefined;
+}
+/** Answers `/api/<tool>`; false for any other path. Checks run in the order this computer, method, token. */
+export function handleApi(req, res, context) {
+    const path = new URL(req.url ?? "/", "http://host").pathname;
+    if (!path.startsWith("/api/"))
+        return false;
+    if (!context.loopback) {
+        plain(res, 403, "Only from this computer.");
+        return true;
+    }
+    if (context.handler === undefined) {
+        plain(res, 404, 'The thin call is served by "tapline host" only, not by an agent\'s MCP server.');
+        return true;
+    }
+    if (req.method !== "POST") {
+        // A thin call asks who it is talking to before it sends the token: only a host that holds the token can answer.
+        const challenge = req.headers["x-tapline-challenge"];
+        const port = req.socket.localPort;
+        const address = req.socket.localAddress;
+        const proof = typeof challenge === "string" && port !== undefined && address !== undefined && /^[0-9a-f]{16,128}$/.test(challenge)
+            ? hostProof(context.token, challenge, address, port)
+            : undefined;
+        res.writeHead(405, { "content-type": "text/plain; charset=utf-8", ...(proof !== undefined ? { "x-tapline-proof": proof } : {}) });
+        res.end("POST only.\n");
+        return true;
+    }
+    const auth = req.headers.authorization;
+    if (typeof auth !== "string" || !auth.startsWith("Bearer ") || !safeEqual(auth.slice(7).trim(), context.token)) {
+        plain(res, 401, "Bearer token required.");
+        return true;
+    }
+    const handler = context.handler;
+    let tool;
+    try {
+        tool = decodeURIComponent(path.slice("/api/".length));
+    }
+    catch {
+        tool = "";
+    }
+    const client = clientOf(req);
+    const chunks = [];
+    let size = 0;
+    let tooLong = false;
+    let gone = false;
+    // A client that leaves before its answer is cancelled: queued work for it is never started.
+    const cancel = new AbortController();
+    res.on("close", () => {
+        if (!res.writableEnded)
+            cancel.abort();
+    });
+    // A peer that drops mid-body or resets: stop quietly, never throw an unhandled error event.
+    req.on("error", () => {
+        gone = true;
+        cancel.abort();
+        if (!res.writableEnded)
+            res.destroy();
+    });
+    req.on("aborted", () => {
+        gone = true;
+        cancel.abort();
+    });
+    req.on("data", (chunk) => {
+        size += chunk.length;
+        if (size > MAX_API_BODY)
+            tooLong = true;
+        else
+            chunks.push(chunk);
+    });
+    req.on("end", () => {
+        if (gone || (req.destroyed && !req.complete))
+            return;
+        let args;
+        try {
+            const text = Buffer.concat(chunks).toString("utf8").trim();
+            const parsed = tooLong ? undefined : text === "" ? {} : JSON.parse(text);
+            if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed))
+                args = parsed;
+        }
+        catch {
+            args = undefined;
+        }
+        if (args === undefined) {
+            plain(res, 400, "Body: a JSON object of at most 1 MB.");
+            return;
+        }
+        handler(tool, args, client, cancel.signal).then((result) => {
+            if (cancel.signal.aborted)
+                return; // nobody is waiting for the answer
+            if (result === undefined) {
+                plain(res, 404, `Unknown tool "${tool}".`);
+                return;
+            }
+            res.writeHead(200, { "content-type": "application/json; charset=utf-8" });
+            res.end(JSON.stringify(toApiAnswer(result)));
+        }, (error) => {
+            if (cancel.signal.aborted)
+                return;
+            if (res.headersSent) {
+                res.end();
+                return;
+            }
+            // Same shape as a tool's own failure, so a caller reads one kind of answer.
+            const message = error instanceof Error ? error.message : String(error);
+            res.writeHead(200, { "content-type": "application/json; charset=utf-8" });
+            res.end(JSON.stringify({ text: `Error internal: ${message}`, isError: true }));
+        });
+    });
+    return true;
+}
+//# sourceMappingURL=api.js.map

package/dist/api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAiB1D,qCAAqC;AACrC,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,GAAG,IAAI,CAAC;AAExC,MAAM,UAAU,SAAS,CAAC,CAAS,EAAE,CAAS;IAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACrC,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC/C,OAAO,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACtC,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC5D,OAAO,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACpG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa,EAAE,SAAiB,EAAE,OAAe,EAAE,IAAY;IACvF,OAAO,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,MAAM,CAAC,qBAAqB,SAAS,KAAK,gBAAgB,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnI,CAAC;AASD,MAAM,UAAU,WAAW,CAAC,MAAsB;IAChD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,KAAyB,CAAC;IAC9B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;aAC7C,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,KAAK,SAAS;YAAE,KAAK,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;IACvH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACjH,CAAC;AAWD,SAAS,KAAK,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAY;IAC9D,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;IACvE,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,QAAQ,CAAC,GAAoB;IACpC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC3F,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACjE,CAAC;AAED,6GAA6G;AAC7G,MAAM,UAAU,SAAS,CAAC,GAAoB,EAAE,GAAmB,EAAE,OAA0B;IAC7F,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC;IAC7D,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QACtB,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,0BAA0B,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAClC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,gFAAgF,CAAC,CAAC;QAClG,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1B,gHAAgH;QAChH,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;QACrD,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC;QAClC,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC;QACxC,MAAM,KAAK,GACT,OAAO,SAAS,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,IAAI,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC;YAClH,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC;YACpD,CAAC,CAAC,SAAS,CAAC;QAChB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAClI,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IACvC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/G,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAChC,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,4FAA4F;IAC5F,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QACnB,IAAI,CAAC,GAAG,CAAC,aAAa;YAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IACzC,CAAC,CAAC,CAAC;IACH,4FAA4F;IAC5F,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QACnB,IAAI,GAAG,IAAI,CAAC;QACZ,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,GAAG,CAAC,aAAa;YAAE,GAAG,CAAC,OAAO,EAAE,CAAC;IACxC,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;QACrB,IAAI,GAAG,IAAI,CAAC;QACZ,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QAC/B,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;QACrB,IAAI,IAAI,GAAG,YAAY;YAAE,OAAO,GAAG,IAAI,CAAC;;YACnC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;QACjB,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO;QACrD,IAAI,IAAyC,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3D,MAAM,MAAM,GAAY,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAClF,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,IAAI,GAAG,MAAiC,CAAC;QACxH,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,GAAG,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,sCAAsC,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QACD,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAC7C,CAAC,MAAM,EAAE,EAAE;YACT,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO,CAAC,mCAAmC;YACtE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,IAAI,IAAI,CAAC,CAAC;gBAC3C,OAAO;YACT,CAAC;YACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,CAAC,CAAC;YAC1E,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC/C,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;YACjB,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO;YAClC,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;gBACpB,GAAG,CAAC,GAAG,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YACD,4EAA4E;YAC5E,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,CAAC,CAAC;YAC1E,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,mBAAmB,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAsB,CAAC,CAAC,CAAC;QACrG,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/audit.d.ts

@@ -26,6 +26,7 @@ export declare const auditResultSchema: z.ZodObject<{
             disabled: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
             selected: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
             checked: z.ZodOptional<z.ZodNullable<z.ZodUnion<readonly [z.ZodBoolean, z.ZodString]>>>;
+            row: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
         }, z.core.$strip>>>;
         where: z.ZodOptional<z.ZodObject<{
             frame: z.ZodOptional<z.ZodObject<{

package/dist/bin.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/bin.js

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+// The `tapline` command. A thin call must start in about 50 ms, so this file loads nothing at the top: `call` goes
+// to thincall.ts (node: modules only) and every other command loads cli.ts (the host, MCP, qrcode, zod) lazily.
+const argv = process.argv.slice(2);
+async function start() {
+    if (argv[0] === "call") {
+        const { runThinCall } = await import("./thincall.js");
+        process.exitCode = await runThinCall(argv.slice(1));
+        return;
+    }
+    const { runMain } = await import("./cli.js");
+    runMain(argv);
+}
+start().catch((error) => {
+    process.stderr.write(`tapline: ${error instanceof Error ? error.message : String(error)}\n`);
+    process.exit(1);
+});
+export {};
+//# sourceMappingURL=bin.js.map

package/dist/bin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bin.js","sourceRoot":"","sources":["../src/bin.ts"],"names":[],"mappings":";AACA,mHAAmH;AACnH,gHAAgH;AAChH,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAEnC,KAAK,UAAU,KAAK;IAClB,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QACvB,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;QACtD,OAAO,CAAC,QAAQ,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,OAAO;IACT,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IAC7C,OAAO,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;IAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/brief.d.ts

@@ -0,0 +1,41 @@
+import type { TreeElement } from "./protocol.js";
+/** The most lines a brief answer shows of a change block, or of a new screen (AGENT-TOOLS 1.13 §13.4). */
+export declare const BRIEF_MAX_LINES = 12;
+export interface BriefInput {
+    /** The answer's first line. */
+    first: string;
+    /** The `Place: …` line, when known (task 12 supplies it). */
+    place?: string;
+    /** `Same screen. Changes:`, shown above the block (not counted in the 12). */
+    label?: string;
+    /** The change block's lines, in order. */
+    changes: string[];
+    /** A new screen: its lines replace the change block. */
+    screen?: {
+        headers: string[];
+        actionable: string[];
+        newText: string[];
+    };
+    /** Never cut: `Alert:`, `Network:`, `Keyboard:`, `Place:`, `Note:`, `Error`, `Reflex:` lines and the off-screen count. */
+    fixed: string[];
+}
+/** A cut change block keeps `+` text lines ahead of `~` and `↕` lines; the rest keep their order. */
+export declare function orderForCut(changes: string[]): string[];
+/** Builds the brief answer's lines. `…<n> more: look shows them.` ends a cut block. */
+export declare function briefLines(input: BriefInput): string[];
+/**
+ * Pressable elements count as actionable: buttons, inputs, switches, links, tabs, list rows, radios, checkboxes,
+ * and any element that takes a tap, a toggle or typing (AGENT-TOOLS 1.13.1 item 1).
+ */
+export declare function isActionable(element: TreeElement): boolean;
+/**
+ * A new screen in brief: its headers, its actionable elements and the text that wasn't in the list the agent had
+ * (`previous`). One line each, as a full list writes them, so refs keep working.
+ */
+export declare function briefScreen(elements: TreeElement[], previous: TreeElement[], options?: {
+    eyes?: boolean;
+}): {
+    headers: string[];
+    actionable: string[];
+    newText: string[];
+};

package/dist/brief.js

@@ -0,0 +1,78 @@
+import { actionsOf, formatElement, roleOf } from "./format.js";
+/** The most lines a brief answer shows of a change block, or of a new screen (AGENT-TOOLS 1.13 §13.4). */
+export const BRIEF_MAX_LINES = 12;
+/** Lines that close an answer; the others (`Alert:`, `Keyboard:`, `Network:`, `Place:`, the off-screen count) stand above the block. */
+const TAIL = /^(Note\b|Error\b|Reflex:)/;
+/** A `+` line for a text element: `+ e12 text "Wrong password" …`. */
+const ADDED_TEXT = /^\+ (?:e\d+ )?text(?: |$)/;
+/** A cut change block keeps `+` text lines ahead of `~` and `↕` lines; the rest keep their order. */
+export function orderForCut(changes) {
+    return [...changes.filter((line) => ADDED_TEXT.test(line)), ...changes.filter((line) => !ADDED_TEXT.test(line))];
+}
+/** The line that ends a cut block. */
+function moreLine(count) {
+    return `…${count} more: look shows them.`;
+}
+/** At most `BRIEF_MAX_LINES` of `lines` (already in cut order), then how many were left out. */
+function cut(lines) {
+    if (lines.length <= BRIEF_MAX_LINES)
+        return lines;
+    return [...lines.slice(0, BRIEF_MAX_LINES), moreLine(lines.length - BRIEF_MAX_LINES)];
+}
+/** Builds the brief answer's lines. `…<n> more: look shows them.` ends a cut block. */
+export function briefLines(input) {
+    const out = [input.first];
+    if (input.place !== undefined)
+        out.push(input.place);
+    const above = input.fixed.filter((line) => !TAIL.test(line));
+    const below = input.fixed.filter((line) => TAIL.test(line));
+    if (input.screen !== undefined) {
+        // New text first: it is what says an action failed ("Wrong password"), so a cut never takes it.
+        out.push(...above, ...cut([...input.screen.newText, ...input.screen.headers, ...input.screen.actionable]));
+    }
+    else {
+        if (input.label !== undefined)
+            out.push(input.label);
+        out.push(...above);
+        out.push(...cut(input.changes.length > BRIEF_MAX_LINES ? orderForCut(input.changes) : input.changes));
+    }
+    out.push(...below);
+    return out;
+}
+/** Roles a person can act on; list rows, radios and checkboxes count with them (AGENT-TOOLS 1.13.1 item 1). */
+const ACTIONABLE_ROLES = new Set(["button", "input", "switch", "link", "tab", "cell", "radio", "checkbox"]);
+/**
+ * Pressable elements count as actionable: buttons, inputs, switches, links, tabs, list rows, radios, checkboxes,
+ * and any element that takes a tap, a toggle or typing (AGENT-TOOLS 1.13.1 item 1).
+ */
+export function isActionable(element) {
+    const role = roleOf(element);
+    if (role !== null && ACTIONABLE_ROLES.has(role))
+        return true;
+    return actionsOf(element).some((action) => action === "tap" || action === "toggle" || action === "type");
+}
+function textOfElement(element) {
+    return (element.text ?? "").trim();
+}
+/**
+ * A new screen in brief: its headers, its actionable elements and the text that wasn't in the list the agent had
+ * (`previous`). One line each, as a full list writes them, so refs keep working.
+ */
+export function briefScreen(elements, previous, options = {}) {
+    const seen = new Set(previous.map(textOfElement).filter((text) => text !== ""));
+    const line = (element) => formatElement(element, { eyes: options.eyes === true });
+    const headers = [];
+    const actionable = [];
+    const newText = [];
+    for (const element of elements) {
+        const role = roleOf(element);
+        if (role === "header")
+            headers.push(line(element));
+        else if (isActionable(element))
+            actionable.push(line(element));
+        else if (role === "text" && textOfElement(element) !== "" && !seen.has(textOfElement(element)))
+            newText.push(line(element));
+    }
+    return { headers, actionable, newText };
+}
+//# sourceMappingURL=brief.js.map

package/dist/brief.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"brief.js","sourceRoot":"","sources":["../src/brief.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAG/D,0GAA0G;AAC1G,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAiBlC,wIAAwI;AACxI,MAAM,IAAI,GAAG,2BAA2B,CAAC;AAEzC,sEAAsE;AACtE,MAAM,UAAU,GAAG,2BAA2B,CAAC;AAE/C,qGAAqG;AACrG,MAAM,UAAU,WAAW,CAAC,OAAiB;IAC3C,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACnH,CAAC;AAED,sCAAsC;AACtC,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,IAAI,KAAK,yBAAyB,CAAC;AAC5C,CAAC;AAED,gGAAgG;AAChG,SAAS,GAAG,CAAC,KAAe;IAC1B,IAAI,KAAK,CAAC,MAAM,IAAI,eAAe;QAAE,OAAO,KAAK,CAAC;IAClD,OAAO,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC;AACxF,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,UAAU,CAAC,KAAiB;IAC1C,MAAM,GAAG,GAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;QAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5D,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/B,gGAAgG;QAChG,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,EAAE,GAAG,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC7G,CAAC;SAAM,CAAC;QACN,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;YAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACrD,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;QACnB,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IACxG,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;IACnB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+GAA+G;AAC/G,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;AAEjI;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,OAAoB;IAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,IAAI,KAAK,IAAI,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,MAAM,CAAC,CAAC;AAC3G,CAAC;AAED,SAAS,aAAa,CAAC,OAAoB;IACzC,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CACzB,QAAuB,EACvB,QAAuB,EACvB,UAA8B,EAAE;IAEhC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;IAChF,MAAM,IAAI,GAAG,CAAC,OAAoB,EAAU,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC,CAAC;IACvG,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAC7B,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;aAC9C,IAAI,YAAY,CAAC,OAAO,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;aAC1D,IAAI,IAAI,KAAK,MAAM,IAAI,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9H,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AAC1C,CAAC"}

package/dist/cli.d.ts

@@ -1,2 +1,42 @@
 #!/usr/bin/env node
-export {};
+import { type RuntimeOptions } from "./runtime.js";
+/** The command line's words and options, in one place so a test can read them without starting a host. */
+export declare function parseCli(argv: string[]): {
+    values: {
+        port?: string | undefined;
+        host?: string | undefined;
+        scheme?: string | undefined;
+        screenshots?: string | undefined;
+        viewer?: string | undefined;
+        "metro-port"?: string | undefined;
+        "https-port"?: string | undefined;
+        stop?: boolean | undefined;
+        wait?: string | undefined;
+        since?: string | undefined;
+        junit?: string | undefined;
+        "update-references"?: boolean | undefined;
+        "no-log"?: boolean | undefined;
+        policy?: string | undefined;
+        "no-policy"?: boolean | undefined;
+        "no-dialog"?: boolean | undefined;
+        brief?: boolean | undefined;
+        "ux-rules"?: string | undefined;
+        accounts?: string | undefined;
+        maps?: string | undefined;
+        "viewer-link"?: boolean | undefined;
+        project?: string | undefined;
+        "dry-run"?: boolean | undefined;
+        app?: boolean | undefined;
+        "no-install"?: boolean | undefined;
+        help?: boolean | undefined;
+    };
+    positionals: string[];
+};
+/** What `mcp` and the standalone host both take, from the parsed options (`--brief` and the rest). */
+export declare function runtimeOptionsOf(values: ReturnType<typeof parseCli>["values"], options: {
+    port?: string;
+    host?: string;
+}): RuntimeOptions;
+export declare function main(argv: string[]): Promise<number>;
+/** Runs the command line and exits with its code (a negative code means a host keeps running). */
+export declare function runMain(argv: string[]): void;

package/dist/cli.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
+import { realpathSync, writeFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
 import { spawn } from "node:child_process";
-import { writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { parseArgs } from "node:util";
 import { toString as qrText } from "qrcode";
@@ -11,6 +12,7 @@ import { formatLogs } from "./format.js";
 import { runInit } from "./init.js";
 import { runReport } from "./report.js";
 import { runMcp } from "./mcp.js";
+import { createRuntime } from "./runtime.js";
 import { createPairCode, forgetLink, pairingLink } from "./pairing.js";
 import { failureWithDiff, junitXml } from "./script.js";
 import { TaplineHost } from "./server.js";
@@ -22,7 +24,10 @@ Usage: tapline <command> [options]
 
 Commands:
   mcp      Run the host plus an MCP server on stdio (for Claude Code and other agents)
-  host     Run the host in the foreground and log connections and app logs
+  host     Run a standalone host in the foreground: apps connect to it, and it serves the live view and
+           "tapline call" (it takes the options of mcp)
+  call     Send one tool call to a running "tapline host": tapline call <tool> '<json>' [--client NAME] [--json]
+           (exit 0: an answer, 2: a refusal, 3: no host reachable)
   pair     Print a pairing link and QR code for a phone (needs --scheme)
   info     Show this computer's address and how to add Tapline to an app
   doctor   Check the setup (Node, the Wi-Fi address, Tailscale if used, token, ports, firewall);
@@ -48,11 +53,22 @@ Options:
   --screenshots <inline|file>
                  For mcp: put screenshots in the tool result (default), or save them in
                  ~/.tapline/shots and return the path (or TAPLINE_SCREENSHOTS)
+  --client <name>  For call: the agent's name, so its report and journey stay its own (default: the parent process id)
+  --json         For call: print {"text", "image_path"} instead of the text
   --no-log       For mcp: don't write the action log (~/.tapline/log/actions-YYYY-MM-DD.jsonl)
   --policy <file>  For mcp: the safety policy (JSON: words that need a person's OK, words that are blocked)
   --no-policy    For mcp: no confirmation and nothing blocked (a test device with test data)
+  --no-dialog    For mcp: don't ask a person's OK in the host's dialog, only in the live view (for a host that
+                 passes dialogs to the model instead of showing them to a person)
+  --brief        For mcp and host: actions answer briefly (a call's brief: false overrides it); look is never brief
   --ux-rules <file>  For mcp: the user's UX house rules for ux_check and journeys (JSON: text rules to judge,
                  {"max_taps_to_goal": N}, {"way_back": true})
+  --accounts <file>  For mcp and host: test accounts (JSON; the tool types an account's username and password so the
+                 agent never sees them). The file must sit outside any git repo, or be ignored by it.
+                 A password stays out of pictures only while its field is secure (a "show password" toggle shows it).
+                 Keep the file outside the folders the agent may read
+  --maps <dir>   For mcp and host: keep each app's map (its places, roads and links) in <dir>/<app id>/ instead of
+                 ~/.tapline/maps/<app id>/, so a team and both tools can share one folder with a project
   --viewer-link  For mcp: the viewer tool gives the agent the live view's link (benchmarks, scripts); by
                  default it opens the live view in a browser here and keeps the link (its key) from the agent
                  (or TAPLINE_VIEWER_LINK=1)
@@ -99,43 +115,37 @@ async function printPairing(config, url, scheme) {
     out.write(`\nScan with the phone's camera, then tap Connect in the app (valid 10 minutes, works once):\n\n${qr}\n`);
     out.write(`${link}\n\nTo unpair the phone, open ${forgetLink(scheme)} on it.\n`);
 }
-async function runHost(config, scheme) {
-    const host = new TaplineHost({
-        token: config.token,
-        port: config.port,
-        portFallback: config.portFallback,
-        hosts: config.hosts,
-    });
+/**
+ * The standalone host: apps connect to it, it serves the live viewer (a person's OK is given there) and the thin
+ * call, `POST /api/<tool>` (AGENT-TOOLS 1.13 §18.10). It takes the options `mcp` takes.
+ */
+async function runHost(options, scheme) {
     const stamp = () => new Date().toISOString().slice(11, 19);
-    host.on("connect", (s) => {
-        // A phone connected through this host is paired too, as with the MCP server and replay (CodeRabbit, PR #5).
-        markPaired();
-        console.log(`${stamp()} connected    ${s.id} ${s.app.name} ${s.app.version ?? ""} on ${s.device.name ?? s.device.platform}`);
-    });
-    host.on("disconnect", (s, reason) => console.log(`${stamp()} disconnected ${s.id} ${s.app.name}: ${reason}`));
+    let runtime;
+    try {
+        runtime = await createRuntime({ ...options, api: true, log: (message) => console.log(`${stamp()} ${message}`) });
+    }
+    catch (error) {
+        for (const line of (error instanceof Error ? error.message : String(error)).split("\n"))
+            console.error(line);
+        return false;
+    }
+    const { host, config } = runtime;
     host.on("log", (s, entry) => console.log(`${stamp()} [${s.app.name}] ${formatLogs([entry])}`));
-    host.on("warning", (message) => console.warn(`${stamp()} warning: ${message}`));
-    const result = await host.listen();
-    const port = host.boundPort() ?? config.port;
-    const url = hostUrl({ advertisedHost: reachableHost(config, result.listening) }, port);
-    console.log("Tapline host running.\n");
-    console.log(`  Apps connect to ${url}`);
-    for (const note of config.notes)
-        console.log(`\n  Note: ${note}`);
-    for (const { host: h, port: p } of result.listening)
-        console.log(`  listening on ws://${h}:${p}/`);
-    for (const { host: h, error } of result.failed)
-        console.warn(`  could not listen on ${h}: ${error}`);
+    console.log("\nTapline host running.\n");
+    console.log(`  Apps connect to ${runtime.url}`);
+    console.log(`  Agents without an MCP connection: tapline call <tool> '<json>' (port ${runtime.port})`);
     if (scheme !== undefined)
-        await printPairing(config, url, scheme);
+        await printPairing(config, runtime.url, scheme);
     else
-        console.log(`\n  Pair a phone: tapline pair --scheme <your app's scheme> --port ${port}`);
+        console.log(`\n  Pair a phone: tapline pair --scheme <your app's scheme> --port ${runtime.port}`);
     console.log("\nWaiting for apps. Ctrl+C to stop.\n");
     const stop = () => {
-        void host.close().finally(() => process.exit(0));
+        void runtime.close().finally(() => process.exit(0));
     };
     process.once("SIGINT", stop);
     process.once("SIGTERM", stop);
+    return true;
 }
 function portOption(raw, name) {
     if (raw === undefined)
@@ -229,8 +239,9 @@ async function runReplay(config, scripts, waitRaw, junitPath, updateReferences =
         await host.close();
     }
 }
-async function main(argv) {
-    const { values, positionals } = parseArgs({
+/** The command line's words and options, in one place so a test can read them without starting a host. */
+export function parseCli(argv) {
+    return parseArgs({
         args: argv,
         allowPositionals: true,
         options: {
@@ -249,7 +260,11 @@ async function main(argv) {
             "no-log": { type: "boolean" },
             policy: { type: "string" },
             "no-policy": { type: "boolean" },
+            "no-dialog": { type: "boolean" },
+            brief: { type: "boolean" },
             "ux-rules": { type: "string" },
+            accounts: { type: "string" },
+            maps: { type: "string" },
             "viewer-link": { type: "boolean" },
             project: { type: "string" },
             "dry-run": { type: "boolean" },
@@ -258,6 +273,31 @@ async function main(argv) {
             help: { type: "boolean", short: "h" },
         },
     });
+}
+/** What `mcp` and the standalone host both take, from the parsed options (`--brief` and the rest). */
+export function runtimeOptionsOf(values, options) {
+    return {
+        ...options,
+        ...(values.screenshots !== undefined ? { screenshots: values.screenshots } : {}),
+        ...(values.viewer !== undefined ? { viewer: values.viewer } : {}),
+        ...(values["no-log"] === true ? { noLog: true } : {}),
+        ...(values.policy !== undefined ? { policy: values.policy } : {}),
+        ...(values["no-policy"] === true ? { noPolicy: true } : {}),
+        ...(values["no-dialog"] === true ? { noDialog: true } : {}),
+        ...(values.brief === true ? { brief: true } : {}),
+        ...(values["ux-rules"] !== undefined ? { uxRules: values["ux-rules"] } : {}),
+        ...(values.accounts !== undefined ? { accounts: values.accounts } : {}),
+        ...(values.maps !== undefined ? { maps: values.maps } : {}),
+        ...(values["viewer-link"] === true ? { viewerLink: true } : {}),
+    };
+}
+export async function main(argv) {
+    // The thin call has its own light entry (bin.ts); this keeps "node dist/cli.js call" working too.
+    if (argv[0] === "call") {
+        const { runThinCall } = await import("./thincall.js");
+        return runThinCall(argv.slice(1));
+    }
+    const { values, positionals } = parseCli(argv);
     const command = positionals[0];
     if (values.help === true || command === undefined || command === "help") {
         process.stdout.write(HELP);
@@ -267,23 +307,12 @@ async function main(argv) {
         ...(values.port !== undefined ? { port: values.port } : {}),
         ...(values.host !== undefined ? { host: values.host } : {}),
     };
+    const runtimeOptions = runtimeOptionsOf(values, options);
     switch (command) {
         case "mcp":
-            return (await runMcp({
-                ...options,
-                ...(values.screenshots !== undefined ? { screenshots: values.screenshots } : {}),
-                ...(values.viewer !== undefined ? { viewer: values.viewer } : {}),
-                ...(values["no-log"] === true ? { noLog: true } : {}),
-                ...(values.policy !== undefined ? { policy: values.policy } : {}),
-                ...(values["no-policy"] === true ? { noPolicy: true } : {}),
-                ...(values["ux-rules"] !== undefined ? { uxRules: values["ux-rules"] } : {}),
-                ...(values["viewer-link"] === true ? { viewerLink: true } : {}),
-            }))
-                ? -1 // keep running
-                : 1;
+            return (await runMcp(runtimeOptions)) ? -1 /* keep running */ : 1;
         case "host":
-            await runHost(await resolveConfig(options), values.scheme);
-            return -1;
+            return (await runHost(runtimeOptions, values.scheme)) ? -1 : 1;
         case "pair": {
             if (values.scheme === undefined) {
                 process.stderr.write(`pair needs the app's URL scheme: tapline pair --scheme myapp\n`);
@@ -298,7 +327,7 @@ async function main(argv) {
             return 0;
         }
         case "doctor": {
-            const results = await runDoctor();
+            const results = await runDoctor(values.accounts !== undefined ? { accountsFile: values.accounts } : {});
             process.stdout.write(`${formatDoctor(results, needsAPerson(results))}\n`);
             let failed = results.some((r) => r.status === "fail");
             if (values.app === true) {
@@ -358,11 +387,25 @@ async function main(argv) {
             return 1;
     }
 }
-main(process.argv.slice(2)).then((code) => {
-    if (code >= 0)
-        process.exit(code);
-}, (error) => {
-    process.stderr.write(`tapline: ${error instanceof Error ? error.message : String(error)}\n`);
-    process.exit(1);
-});
+/** Runs the command line and exits with its code (a negative code means a host keeps running). */
+export function runMain(argv) {
+    main(argv).then((code) => {
+        if (code >= 0)
+            process.exit(code);
+    }, (error) => {
+        process.stderr.write(`tapline: ${error instanceof Error ? error.message : String(error)}\n`);
+        process.exit(1);
+    });
+}
+// "node dist/cli.js ..." still works; the tapline bin is bin.js, which loads this file only for commands other than call.
+const entry = process.argv[1];
+if (entry !== undefined) {
+    try {
+        if (realpathSync(entry) === realpathSync(fileURLToPath(import.meta.url)))
+            runMain(process.argv.slice(2));
+    }
+    catch {
+        // not run as a script
+    }
+}
 //# sourceMappingURL=cli.js.map