What the CLI's / MCP's headless backend offers. It implements the viewer
methods as inert no-ops, so viewer/visibility/selection are
deliberately absent here: a viewer node must report noop, not pretend.
network is always true: both headless callers have a real, unrestricted
fetch (no CORS), so a network.fetch bridge is always configured — the
per-request host allow-list check still runs against the graph's actual
grants (see network-request.ts). secrets is exactly the set of env var
names the caller passes (CLI: Object.keys(process.env); MCP: the same —
see flow.ts in @ifc-lite/cli and @ifc-lite/mcp), never guessed here.
openModel is listed because both headless callers implement
FlowHost.openModel (model.openFromSource).
What the CLI's / MCP's headless backend offers. It implements the viewer methods as inert no-ops, so
viewer/visibility/selectionare deliberately absent here: a viewer node must reportnoop, not pretend.networkis alwaystrue: both headless callers have a real, unrestrictedfetch(no CORS), so anetwork.fetchbridge is always configured — the per-request host allow-list check still runs against the graph's actual grants (seenetwork-request.ts).secretsis exactly the set of env var names the caller passes (CLI:Object.keys(process.env); MCP: the same — seeflow.tsin@ifc-lite/cliand@ifc-lite/mcp), never guessed here.openModelis listed because both headless callers implementFlowHost.openModel(model.openFromSource).