@vibelet/cli 1.2.158 → 1.2.160

package/dist/vibelet.mjs

@@ -11252,12 +11252,12 @@ module.exports = __WEBPACK_EXTERNAL_createRequire(import.meta.url)("zlib");
 // EXPORTS
 __nccwpck_require__.d(__webpack_exports__, {
   vD: () => (/* reexport */ clearTunnelState),
-  QQ: () => (/* reexport */ getAliveTunnel),
+  M: () => (/* reexport */ getAliveManagedQuickTunnel),
   DH: () => (/* reexport */ startTunnel),
-  HM: () => (/* reexport */ stopTunnel)
+  HW: () => (/* reexport */ stopManagedQuickTunnel)
 });
 
-// UNUSED EXPORTS: isProcessAlive, loadTunnelState, readCloudflaredLog, saveTunnelState
+// UNUSED EXPORTS: getAliveTunnel, isProcessAlive, isQuickTunnelProcessCommand, loadTunnelState, readCloudflaredLog, saveTunnelState, stopTunnel
 
 // EXTERNAL MODULE: external "node:child_process"
 var external_node_child_process_ = __nccwpck_require__(1421);
@@ -11479,6 +11479,139 @@ function extractQuickTunnelUrl(logContent) {
   return match?.[0] ?? null;
 }
 
+function isQuickTunnelUrl(url) {
+  if (typeof url !== 'string' || !url.trim()) return false;
+  try {
+    return new URL(url).hostname.toLowerCase().endsWith('.trycloudflare.com');
+  } catch {
+    return false;
+  }
+}
+
+function normalizeOriginUrl(url) {
+  if (typeof url !== 'string' || !url.trim()) return null;
+  try {
+    const parsed = new URL(url);
+    const hostname = parsed.hostname.toLowerCase();
+    if (
+      parsed.protocol !== 'http:' ||
+      !['localhost', '127.0.0.1', '[::1]'].includes(hostname) ||
+      !parsed.port ||
+      parsed.pathname !== '/' ||
+      parsed.username ||
+      parsed.password ||
+      parsed.search ||
+      parsed.hash
+    ) {
+      return null;
+    }
+    return parsed.href;
+  } catch {
+    return null;
+  }
+}
+
+function extractUrlArgs(commandLine) {
+  const matches = String(commandLine).matchAll(/(?:^|\s)--url(?:=|\s+)(?:"([^"]+)"|'([^']+)'|([^\s"']+))/giu);
+  return [...matches].map((match) => match[1] || match[2] || match[3]).filter(Boolean);
+}
+
+function isQuickTunnelProcessCommand(commandLine, { originUrl = '' } = {}) {
+  if (typeof commandLine !== 'string' || !commandLine.trim()) return false;
+
+  const referencesCloudflared =
+    /(?:^|[\\/\s"'=])cloudflared(?:\.exe)?(?=$|[\s"'])/iu.test(commandLine) ||
+    /[\\/]cloudflared[\\/]lib[\\/]cloudflared\.js(?=$|[\s"'])/iu.test(commandLine) ||
+    /(?:^|\s)--package(?:=|\s+)cloudflared(?=$|\s)/iu.test(commandLine);
+  if (!referencesCloudflared) return false;
+  if (!/(?:^|\s)tunnel(?=$|\s)/iu.test(commandLine)) return false;
+  // Named Tunnels use `cloudflared tunnel ... run`; never treat one as a
+  // Vibelet-managed Quick Tunnel even if an unrelated --url flag is present.
+  if (/(?:^|\s)run(?=$|\s)/iu.test(commandLine)) return false;
+
+  const expectedOriginUrl = originUrl ? normalizeOriginUrl(originUrl) : null;
+  if (originUrl && !expectedOriginUrl) return false;
+  return extractUrlArgs(commandLine).some((candidate) => {
+    const normalizedCandidate = normalizeOriginUrl(candidate);
+    if (!normalizedCandidate) return false;
+    return !expectedOriginUrl || normalizedCandidate === expectedOriginUrl;
+  });
+}
+
+function readProcessCommandLine(pid, { platform = process.platform, spawnSyncImpl = external_node_child_process_.spawnSync } = {}) {
+  if (!Number.isInteger(pid) || pid <= 0) return '';
+
+  if (platform === 'win32') {
+    const result = spawnSyncImpl(
+      'powershell.exe',
+      [
+        '-NoProfile',
+        '-NonInteractive',
+        '-Command',
+        `(Get-CimInstance Win32_Process -Filter "ProcessId = ${pid}").CommandLine`,
+      ],
+      { encoding: 'utf8', timeout: 1_500, windowsHide: true },
+    );
+    return result.status === 0 ? String(result.stdout || '').trim() : '';
+  }
+
+  const result = spawnSyncImpl('ps', ['-ww', '-p', String(pid), '-o', 'command='], {
+    encoding: 'utf8',
+    timeout: 1_500,
+    windowsHide: true,
+  });
+  return result.status === 0 ? String(result.stdout || '').trim() : '';
+}
+
+function extractCloudflaredMetricsBaseUrl(logContent) {
+  if (typeof logContent !== 'string' || logContent.length === 0) {
+    return null;
+  }
+  const match = logContent.match(
+    /Starting metrics server on (?:https?:\/\/)?(127\.0\.0\.1|localhost|\[::1\]):(\d+)\/metrics\b/iu,
+  );
+  if (!match) return null;
+  return `http://${match[1]}:${match[2]}`;
+}
+
+async function probeCloudflaredReadiness(logContent, { fetchFn = globalThis.fetch, timeoutMs = 1000 } = {}) {
+  const metricsBaseUrl = extractCloudflaredMetricsBaseUrl(logContent);
+  if (!metricsBaseUrl || typeof fetchFn !== 'function') return false;
+
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const response = await fetchFn(`${metricsBaseUrl}/ready`, { signal: controller.signal });
+    return response.ok;
+  } catch {
+    return false;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+async function probeQuickTunnelPublicHealth(state, { fetchFn = globalThis.fetch, timeoutMs = 1_500 } = {}) {
+  if (!isQuickTunnelUrl(state?.url) || typeof fetchFn !== 'function') return false;
+
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const healthUrl = new URL('/health', state.url);
+    healthUrl.searchParams.set('_vibelet_reuse_probe', String(Date.now()));
+    const response = await fetchFn(healthUrl, {
+      headers: { 'cache-control': 'no-cache' },
+      signal: controller.signal,
+    });
+    if (!response.ok) return false;
+    const payload = await response.json().catch(() => null);
+    return payload?.status === 'ok';
+  } catch {
+    return false;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
 function getNpmFallbackCommand(platform = process.platform) {
   return platform === 'win32' ? 'npx.cmd' : 'npx';
 }
@@ -11683,18 +11816,22 @@ function formatCloudflaredFailureMessage({ launchSpec, logContent = '', logPath,
 
   if (phase === 'timeout') {
     const summary = summarizeCloudflaredLog(logContent);
+    const waitTarget = extractQuickTunnelUrl(logContent) ? 'tunnel readiness' : 'tunnel URL';
     if (summary) {
-      return `Timed out waiting for tunnel URL (${Math.round((launchSpec?.urlTimeoutMs ?? 30_000) / 1000)}s)${launchSuffix}.\nRecent stderr:\n${summary}`;
+      return `Timed out waiting for ${waitTarget} (${Math.round((launchSpec?.urlTimeoutMs ?? 30_000) / 1000)}s)${launchSuffix}.\nRecent stderr:\n${summary}`;
     }
-    return `Timed out waiting for tunnel URL (${Math.round((launchSpec?.urlTimeoutMs ?? 30_000) / 1000)}s)${launchSuffix}. Check network/proxy settings and ${logPath}.`;
+    return `Timed out waiting for ${waitTarget} (${Math.round((launchSpec?.urlTimeoutMs ?? 30_000) / 1000)}s)${launchSuffix}. Check network/proxy settings and ${logPath}.`;
   }
 
   const summary = summarizeCloudflaredLog(logContent);
+  const exitTarget = extractQuickTunnelUrl(logContent)
+    ? 'before the tunnel became ready'
+    : 'before producing a tunnel URL';
   if (summary) {
-    return `cloudflared exited before producing a tunnel URL${launchSuffix}.\nRecent stderr:\n${summary}`;
+    return `cloudflared exited ${exitTarget}${launchSuffix}.\nRecent stderr:\n${summary}`;
   }
 
-  return `cloudflared exited before producing a tunnel URL${launchSuffix}. Check ${logPath}.`;
+  return `cloudflared exited ${exitTarget}${launchSuffix}. Check ${logPath}.`;
 }
 
 function isProcessAlive(pid) {
@@ -11714,9 +11851,15 @@ function loadTunnelState({ tunnelStatePath }) {
   }
 }
 
-function saveTunnelState({ tunnelStatePath, pid, url }) {
+function saveTunnelState({ tunnelStatePath, pid, url, managerId, originUrl }) {
   (0,external_node_fs_.mkdirSync)((0,external_node_path_.dirname)(tunnelStatePath), { recursive: true });
-  (0,external_node_fs_.writeFileSync)(tunnelStatePath, `${JSON.stringify({ pid, url }, null, 2)}\n`, 'utf8');
+  const state = {
+    pid,
+    url,
+    ...(managerId ? { managerId } : {}),
+    ...(originUrl ? { originUrl } : {}),
+  };
+  (0,external_node_fs_.writeFileSync)(tunnelStatePath, `${JSON.stringify(state, null, 2)}\n`, 'utf8');
 }
 
 function clearTunnelState({ tunnelStatePath }) {
@@ -11735,6 +11878,147 @@ function stopTunnel({ tunnelStatePath, isAlive = isProcessAlive, killProcess = p
   clearTunnelState({ tunnelStatePath });
 }
 
+function waitForProcessExit(pid, { isAlive = isProcessAlive, timeoutMs = 5_000, pollIntervalMs = 50 } = {}) {
+  const deadline = Date.now() + timeoutMs;
+  const waitBuffer = new Int32Array(new SharedArrayBuffer(4));
+  while (Date.now() < deadline) {
+    if (!isAlive(pid)) return true;
+    Atomics.wait(waitBuffer, 0, 0, Math.min(pollIntervalMs, Math.max(1, deadline - Date.now())));
+  }
+  return !isAlive(pid);
+}
+
+function tunnelStateIdentityMatches(left, right) {
+  if (!left || !right) return false;
+  return (
+    left.pid === right.pid &&
+    left.url === right.url &&
+    left.managerId === right.managerId &&
+    normalizeOriginUrl(left.originUrl) === normalizeOriginUrl(right.originUrl)
+  );
+}
+
+/**
+ * Stop a tracked Quick Tunnel only after both its persisted state and live
+ * command line identify it as the same Vibelet-managed process. An unverifiable
+ * live PID is deliberately left untouched so a Named Tunnel (or a reused PID)
+ * can never be terminated from stale tunnel state.
+ */
+function stopManagedQuickTunnel({
+  tunnelStatePath,
+  managerId,
+  isAlive = isProcessAlive,
+  getProcessCommandLine = readProcessCommandLine,
+  killProcess = process.kill,
+  waitForExit = waitForProcessExit,
+}) {
+  const state = loadTunnelState({ tunnelStatePath });
+  if (!state) return { status: 'absent', state: null };
+  if (
+    !Number.isInteger(state.pid) ||
+    state.pid <= 0 ||
+    !isQuickTunnelUrl(state.url) ||
+    (state.managerId && state.managerId !== managerId)
+  ) {
+    return { status: 'not-managed-quick', state };
+  }
+
+  if (!isAlive(state.pid)) {
+    clearTunnelState({ tunnelStatePath });
+    return { status: 'stale-state-cleared', state };
+  }
+
+  // Legacy state did not record an owner or the exact origin. Even when its
+  // PID currently belongs to a Quick Tunnel, that is not enough to prove it
+  // is the same process (the PID may have been reused). Leave live legacy
+  // state untouched and require a newly written, fully identified state file
+  // before allowing any signal.
+  if (!state.managerId || !normalizeOriginUrl(state.originUrl)) {
+    return { status: 'identity-unverified', state };
+  }
+
+  let commandLine = '';
+  try {
+    commandLine = getProcessCommandLine(state.pid);
+  } catch {
+    // Process inspection is best-effort. Never kill when identity cannot be
+    // proven.
+  }
+  if (!isQuickTunnelProcessCommand(commandLine, { originUrl: state.originUrl || '' })) {
+    return { status: 'identity-unverified', state };
+  }
+
+  try {
+    killProcess(state.pid, 'SIGTERM');
+  } catch {
+    if (isAlive(state.pid)) {
+      return { status: 'stop-failed', state };
+    }
+  }
+
+  let exited = false;
+  try {
+    exited = waitForExit(state.pid, { isAlive });
+  } catch {
+    // A failed exit check can never justify clearing process state.
+  }
+  if (!exited) {
+    return { status: 'stop-failed', state };
+  }
+
+  const latestState = loadTunnelState({ tunnelStatePath });
+  if (latestState && !tunnelStateIdentityMatches(latestState, state)) {
+    // Another manager invocation replaced the state while the old process was
+    // draining. Never erase the new process identity.
+    return { status: 'stop-failed', state };
+  }
+  clearTunnelState({ tunnelStatePath });
+  return { status: 'stopped', state };
+}
+
+/**
+ * Return a reusable Quick Tunnel only when its persisted owner/origin, live
+ * command line, and public health endpoint all identify the same working
+ * process. PID liveness alone is never sufficient because PIDs can be reused
+ * by a Named Tunnel or an unrelated process.
+ */
+async function getAliveManagedQuickTunnel({
+  tunnelStatePath,
+  managerId,
+  isAlive = isProcessAlive,
+  getProcessCommandLine = readProcessCommandLine,
+  readinessProbe = probeQuickTunnelPublicHealth,
+}) {
+  const state = loadTunnelState({ tunnelStatePath });
+  if (
+    !state ||
+    !Number.isInteger(state.pid) ||
+    state.pid <= 0 ||
+    !isQuickTunnelUrl(state.url) ||
+    state.managerId !== managerId ||
+    !normalizeOriginUrl(state.originUrl) ||
+    !isAlive(state.pid)
+  ) {
+    return null;
+  }
+
+  let commandLine = '';
+  try {
+    commandLine = getProcessCommandLine(state.pid);
+  } catch {
+    return null;
+  }
+  if (!isQuickTunnelProcessCommand(commandLine, { originUrl: state.originUrl })) {
+    return null;
+  }
+
+  try {
+    return (await readinessProbe(state)) ? state : null;
+  } catch {
+    return null;
+  }
+}
+
 function getAliveTunnel({ tunnelStatePath, isAlive = isProcessAlive }) {
   const state = loadTunnelState({ tunnelStatePath });
   if (state?.pid && state?.url && isAlive(state.pid)) {
@@ -11759,6 +12043,8 @@ async function startTunnel({
   updateStatePath,
   resolveLaunchSpec = resolvePreferredCloudflaredLaunchSpec,
   resolveFallbackLaunchSpec = resolveCloudflaredLaunchSpec,
+  readinessProbe = probeCloudflaredReadiness,
+  managerId,
 }) {
   if (!['auto', 'quic', 'http2'].includes(protocol)) {
     throw new Error(`Unsupported cloudflared protocol: ${protocol}`);
@@ -11800,10 +12086,11 @@ async function startTunnel({
     const stdoutLogFd = (0,external_node_fs_.openSync)(logPath, 'a');
     const stderrLogFd = (0,external_node_fs_.openSync)(logPath, 'a');
     let child;
+    const originUrl = `http://localhost:${port}`;
     try {
       child = (0,external_node_child_process_.spawn)(
         launchSpec.command,
-        [...launchSpec.args, 'tunnel', '--protocol', effectiveProtocol, '--url', `http://localhost:${port}`],
+        [...launchSpec.args, 'tunnel', '--no-autoupdate', '--protocol', effectiveProtocol, '--url', originUrl],
         {
           detached: true,
           stdio: ['ignore', stdoutLogFd, stderrLogFd],
@@ -11851,6 +12138,7 @@ async function startTunnel({
     let url = null;
     let settled = false;
     let childExited = false;
+    let readinessProbeInFlight = false;
     let poll;
     let timeout;
 
@@ -11865,35 +12153,43 @@ async function startTunnel({
     }
 
     timeout = setTimeout(() => {
-      if (!url) {
-        try {
-          process.kill(pid, 'SIGTERM');
-        } catch {
-          // ignore
-        }
-        settle(
-          rejectStart,
-          new Error(
-            formatCloudflaredFailureMessage({
-              launchSpec,
-              logContent: readCloudflaredLog(logPath),
-              logPath,
-              phase: 'timeout',
-            }),
-          ),
-        );
+      try {
+        process.kill(pid, 'SIGTERM');
+      } catch {
+        // ignore
       }
+      settle(
+        rejectStart,
+        new Error(
+          formatCloudflaredFailureMessage({
+            launchSpec,
+            logContent: readCloudflaredLog(logPath),
+            logPath,
+            phase: 'timeout',
+          }),
+        ),
+      );
     }, launchSpec.urlTimeoutMs);
 
-    poll = setInterval(() => {
+    poll = setInterval(async () => {
+      if (readinessProbeInFlight || settled) return;
       try {
         const content = (0,external_node_fs_.readFileSync)(logPath, 'utf8');
         const tunnelUrl = extractQuickTunnelUrl(content);
         if (tunnelUrl) {
           url = tunnelUrl;
-          saveTunnelState({ tunnelStatePath, pid, url });
-          settle(resolveStart, { pid, url });
-          return;
+          readinessProbeInFlight = true;
+          let ready = false;
+          try {
+            ready = await readinessProbe(content);
+          } finally {
+            readinessProbeInFlight = false;
+          }
+          if (ready && !settled) {
+            saveTunnelState({ tunnelStatePath, pid, url, managerId, originUrl: managerId ? originUrl : undefined });
+            settle(resolveStart, { pid, url });
+            return;
+          }
         }
         if (childExited) {
           settle(
@@ -11915,15 +12211,8 @@ async function startTunnel({
 
     child.once('exit', () => {
       childExited = true;
-      if (!url) {
+      if (!settled) {
         const content = readCloudflaredLog(logPath);
-        const tunnelUrl = extractQuickTunnelUrl(content);
-        if (tunnelUrl) {
-          url = tunnelUrl;
-          saveTunnelState({ tunnelStatePath, pid, url });
-          settle(resolveStart, { pid, url });
-          return;
-        }
         settle(
           rejectStart,
           new Error(
@@ -13535,6 +13824,174 @@ function parseAccessTargetArg(argv, fail, env = process.env) {
 }
 
 
+/***/ }),
+
+/***/ 3869:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __nccwpck_require__) => {
+
+/* harmony export */ __nccwpck_require__.d(__webpack_exports__, {
+/* harmony export */   BT: () => (/* binding */ tryUpdateRunningDaemonRelay),
+/* harmony export */   T7: () => (/* binding */ createRelayConfigStore),
+/* harmony export */   kS: () => (/* binding */ prepareManagedQuickTunnel),
+/* harmony export */   zj: () => (/* binding */ retireTrackedQuickTunnel)
+/* harmony export */ });
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __nccwpck_require__(3024);
+/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __nccwpck_require__(6760);
+/* harmony import */ var _cloudflared_tunnel_manager_mjs__WEBPACK_IMPORTED_MODULE_2__ = __nccwpck_require__(2755);
+
+
+
+
+const TUNNEL_MANAGER_ID = 'vibelet-cli';
+
+function createRelayConfigStore(relayConfigPath) {
+  return {
+    load() {
+      try {
+        const data = JSON.parse((0,node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync)(relayConfigPath, 'utf8'));
+        return data.relayUrl || '';
+      } catch {
+        return '';
+      }
+    },
+    save(relayUrl) {
+      (0,node_fs__WEBPACK_IMPORTED_MODULE_0__.mkdirSync)((0,node_path__WEBPACK_IMPORTED_MODULE_1__.dirname)(relayConfigPath), { recursive: true });
+      (0,node_fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync)(relayConfigPath, `${JSON.stringify({ relayUrl }, null, 2)}\n`, 'utf8');
+    },
+    clear() {
+      (0,node_fs__WEBPACK_IMPORTED_MODULE_0__.rmSync)(relayConfigPath, { force: true });
+    },
+  };
+}
+
+function retireTrackedQuickTunnel({
+  tunnelStatePath,
+  isAlive,
+  required = false,
+  fail,
+  writeStdout = (message) => process.stdout.write(message),
+  writeStderr = (message) => process.stderr.write(message),
+}) {
+  const retirement = (0,_cloudflared_tunnel_manager_mjs__WEBPACK_IMPORTED_MODULE_2__/* .stopManagedQuickTunnel */ .HW)({
+    tunnelStatePath,
+    isAlive,
+    managerId: TUNNEL_MANAGER_ID,
+  });
+  if (retirement.status === 'stopped') {
+    writeStdout(`Stopped obsolete managed Quick Tunnel: ${retirement.state.url} (pid ${retirement.state.pid}).\n`);
+  } else if (retirement.status === 'stale-state-cleared') {
+    writeStdout('Cleared stale managed Quick Tunnel state.\n');
+  } else if (
+    retirement.status === 'identity-unverified' ||
+    retirement.status === 'stop-failed' ||
+    retirement.status === 'not-managed-quick'
+  ) {
+    const stateSummary = retirement.state
+      ? `${retirement.state.url || 'unknown URL'} (pid ${retirement.state.pid || 'unknown'})`
+      : 'unknown tracked process';
+    const message =
+      retirement.status === 'stop-failed'
+        ? `Tracked Quick Tunnel ${stateSummary} did not exit after a verified stop request; its state was preserved.`
+        : `Tracked tunnel ${stateSummary} was left running because its Vibelet Quick Tunnel identity could not be safely verified.`;
+    if (required) {
+      fail(
+        'Refusing to replace an unverified tracked tunnel.',
+        `${message}\nInspect the tracked process and tunnel.json before retrying --force.`,
+      );
+    } else {
+      writeStderr(`${message}\n`);
+    }
+  }
+  return retirement;
+}
+
+async function prepareManagedQuickTunnel({
+  force,
+  port,
+  logDir,
+  tunnelStatePath,
+  protocol,
+  updateStatePath,
+  isAlive,
+  fail,
+  writeStdout = (message) => process.stdout.write(message),
+  writeStderr = (message) => process.stderr.write(message),
+}) {
+  const existing = force
+    ? null
+    : await (0,_cloudflared_tunnel_manager_mjs__WEBPACK_IMPORTED_MODULE_2__/* .getAliveManagedQuickTunnel */ .M)({
+        tunnelStatePath,
+        isAlive,
+        managerId: TUNNEL_MANAGER_ID,
+      });
+  if (existing) {
+    writeStdout(`Reusing tunnel: ${existing.url} (pid ${existing.pid})\n`);
+    return { failed: false, relayUrl: existing.url };
+  }
+
+  // A non-ready tracked Quick Tunnel must be retired with the same strict
+  // identity proof as --force before its state can be replaced.
+  retireTrackedQuickTunnel({
+    tunnelStatePath,
+    isAlive,
+    required: true,
+    fail,
+    writeStdout,
+    writeStderr,
+  });
+  writeStdout('Starting Cloudflare Tunnel...\n');
+  try {
+    const tunnel = await (0,_cloudflared_tunnel_manager_mjs__WEBPACK_IMPORTED_MODULE_2__/* .startTunnel */ .DH)({
+      port,
+      logDir,
+      tunnelStatePath,
+      protocol,
+      updateStatePath,
+      managerId: TUNNEL_MANAGER_ID,
+    });
+    writeStdout(`Tunnel ready: ${tunnel.url}\n`);
+    return { failed: false, relayUrl: tunnel.url };
+  } catch (error) {
+    (0,_cloudflared_tunnel_manager_mjs__WEBPACK_IMPORTED_MODULE_2__/* .clearTunnelState */ .vD)({ tunnelStatePath });
+    const message = error instanceof Error ? error.message : String(error);
+    writeStderr(`${message}\n`);
+    writeStderr(
+      'Continuing with LAN/local pairing. Use `npx vibelet --access=remote --force` after fixing Cloudflare Tunnel, or pass `--access=https://<url>` for a custom tunnel.\n',
+    );
+    return { failed: true, relayUrl: '' };
+  }
+}
+
+async function tryUpdateRunningDaemonRelay({
+  port,
+  relayUrl,
+  probeHealth,
+  fetchFn = globalThis.fetch,
+  writeStderr = (message) => process.stderr.write(message),
+}) {
+  try {
+    const response = await fetchFn(`http://127.0.0.1:${port}/connection/relay`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ relayUrl }),
+      signal: AbortSignal.timeout(2_000),
+    });
+    if (!response.ok) {
+      if (response.status !== 404) {
+        const payload = await response.text().catch(() => '');
+        writeStderr(
+          `Running daemon declined live relay refresh (${response.status})${payload ? `: ${payload.trim()}` : ''}.\n`,
+        );
+      }
+      return null;
+    }
+    return await probeHealth(1_500);
+  } catch {
+    return null;
+  }
+}
+
+
 /***/ }),
 
 /***/ 1010:
@@ -13612,6 +14069,7 @@ function describeLaunchctlResult(result) {
 /* harmony export */   SF: () => (/* binding */ selectWebUiConnectionTarget),
 /* harmony export */   YP: () => (/* binding */ createCompactPairingPayload),
 /* harmony export */   dE: () => (/* binding */ findUnsafeCleartextHosts),
+/* harmony export */   mp: () => (/* binding */ applyRelayUrlToPairingPayload),
 /* harmony export */   uR: () => (/* binding */ formatConnectionSummary)
 /* harmony export */ });
 /* unused harmony exports normalizeHostValue, isIpv4Host, isTailscaleHost, isSharedIpv4Host, isLocalNetworkHost, isLoopbackHost, isPlainLocalHostname, isTrustedCleartextHost, parseCommaSeparatedHosts, isQuickTunnelHost, buildLegacyConnection, formatConnectionSourceLabel, buildConnectionHttpUrl, isPreferredWebUiHost, encodePairingPayloadForUrlFragment */
@@ -13779,6 +14237,65 @@ function normalizePairingConnections(pairingPayload) {
   ]);
 }
 
+/**
+ * Overlay a freshly selected relay on a pairing payload without requiring the
+ * daemon process that issued the nonce to restart. This keeps active sessions
+ * alive while still propagating a rotated Quick Tunnel URL through the QR/code.
+ * Stable direct paths are retained as fallbacks; obsolete relay paths are
+ * removed.
+ */
+function applyRelayUrlToPairingPayload(pairingPayload, relayUrl) {
+  const connections = normalizePairingConnections(pairingPayload);
+  const directConnections = connections.filter((target) => target.kind !== 'relay');
+  const normalizedRelayUrl = typeof relayUrl === 'string' ? relayUrl.trim() : '';
+
+  if (!normalizedRelayUrl) {
+    const [preferredDirect, ...fallbackDirect] = directConnections;
+    if (!preferredDirect) {
+      return { ...pairingPayload, connections: [] };
+    }
+    return {
+      ...pairingPayload,
+      canonicalHost: preferredDirect.host,
+      port: preferredDirect.port,
+      fallbackHosts: fallbackDirect
+        .filter((target) => target.port === preferredDirect.port)
+        .map((target) => target.host),
+      connections: directConnections,
+    };
+  }
+
+  let parsed;
+  try {
+    parsed = new URL(normalizedRelayUrl);
+  } catch {
+    return pairingPayload;
+  }
+  const secure = parsed.protocol === 'https:';
+  const relayPort = parsed.port ? Number(parsed.port) : secure ? 443 : 80;
+  if (!parsed.hostname || !Number.isInteger(relayPort) || relayPort <= 0 || relayPort > 65_535) {
+    return pairingPayload;
+  }
+  const relayHost = normalizeHostValue(parsed.hostname);
+  const quickTunnel = isQuickTunnelHost(relayHost);
+  const relayConnection = {
+    kind: 'relay',
+    host: relayHost,
+    port: relayPort,
+    ...(secure ? { secure: true } : {}),
+    source: quickTunnel ? 'quick_tunnel' : 'configured_relay',
+    stability: quickTunnel ? 'ephemeral' : 'stable',
+  };
+
+  return {
+    ...pairingPayload,
+    canonicalHost: relayHost,
+    port: relayPort,
+    fallbackHosts: undefined,
+    connections: [relayConnection, ...directConnections],
+  };
+}
+
 function createCompactPairingPayload(pairingPayload) {
   const connections = normalizePairingConnections(pairingPayload);
   const compactPayload = {
@@ -13880,10 +14397,13 @@ function buildWebUiUrl(target, pairingPayload) {
 
 /* harmony export */ __nccwpck_require__.d(__webpack_exports__, {
 /* harmony export */   Ne: () => (/* binding */ shouldRefuseRuntimeDowngrade),
+/* harmony export */   Pg: () => (/* binding */ shouldRetireManagedQuickTunnel),
 /* harmony export */   ZN: () => (/* binding */ shouldReuseHealthyDaemon),
+/* harmony export */   gm: () => (/* binding */ shouldManageQuickTunnel),
 /* harmony export */   iX: () => (/* binding */ doesHealthSupportTerminalControl),
 /* harmony export */   nW: () => (/* binding */ doesHealthMatchRequestedConnectionConfig)
 /* harmony export */ });
+/* unused harmony export isQuickTunnelRelayUrl */
 function compareSemverTriple(a, b) {
   const pa = String(a)
     .split('.')
@@ -13913,10 +14433,15 @@ function shouldRefuseRuntimeDowngrade({ cliVersion, runtimeVersion, runtimeEntry
   return compareSemverTriple(cliVersion, runtimeVersion) < 0;
 }
 
-function shouldReuseHealthyDaemon({ command, daemonHealthy, hasExplicitConfigOverrides }) {
+function shouldReuseHealthyDaemon({
+  command,
+  daemonHealthy,
+  hasExplicitConfigOverrides,
+  canApplyConnectionConfigWithoutRestart = false,
+}) {
   if (!daemonHealthy) return false;
   if (command !== 'default' && command !== 'start') return false;
-  return !hasExplicitConfigOverrides;
+  return !hasExplicitConfigOverrides || canApplyConnectionConfigWithoutRestart;
 }
 
 function doesHealthSupportTerminalControl(health) {
@@ -13947,6 +14472,41 @@ function isQuickTunnelHost(host) {
   return normalizeHostValue(host.replace(/^https?:\/\//, '').replace(/\/.*$/, '')).endsWith('.trycloudflare.com');
 }
 
+function isQuickTunnelRelayUrl(relayUrl) {
+  if (typeof relayUrl !== 'string' || !relayUrl.trim()) return false;
+  try {
+    return normalizeHostValue(new URL(relayUrl).hostname).endsWith('.trycloudflare.com');
+  } catch {
+    return isQuickTunnelHost(relayUrl);
+  }
+}
+
+/**
+ * A saved stable relay is an explicit connection choice and must survive an
+ * ordinary start/restart. Quick Tunnel URLs remain managed because their
+ * process and hostname are ephemeral, while --force explicitly requests a new
+ * managed tunnel.
+ */
+function shouldManageQuickTunnel({
+  startCommand,
+  localMode = false,
+  relayArg = null,
+  hostArg = null,
+  fallbackHostsArg = null,
+  savedRelayUrl = '',
+  force = false,
+}) {
+  if (!startCommand || localMode || relayArg !== null || hostArg || fallbackHostsArg) {
+    return false;
+  }
+  if (force) return true;
+  return !savedRelayUrl || isQuickTunnelRelayUrl(savedRelayUrl);
+}
+
+function shouldRetireManagedQuickTunnel({ startCommand, manageQuickTunnel }) {
+  return Boolean(startCommand && !manageQuickTunnel);
+}
+
 function hasRemoteAdvertisementInLocalMode(health) {
   const hosts = [
     typeof health.canonicalHost === 'string' ? health.canonicalHost : '',
@@ -14058,14 +14618,16 @@ __nccwpck_require__.a(__webpack_module__, async (__webpack_handle_async_dependen
 /* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_4__ = __nccwpck_require__(6760);
 /* harmony import */ var node_url__WEBPACK_IMPORTED_MODULE_5__ = __nccwpck_require__(3136);
 /* harmony import */ var qrcode__WEBPACK_IMPORTED_MODULE_6__ = __nccwpck_require__(7514);
-/* harmony import */ var _vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_14__ = __nccwpck_require__(6927);
+/* harmony import */ var _vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_15__ = __nccwpck_require__(6927);
 /* harmony import */ var _cloudflared_tunnel_manager_mjs__WEBPACK_IMPORTED_MODULE_7__ = __nccwpck_require__(2755);
-/* harmony import */ var _vibelet_launchd_mjs__WEBPACK_IMPORTED_MODULE_11__ = __nccwpck_require__(1010);
-/* harmony import */ var _linux_systemd_mjs__WEBPACK_IMPORTED_MODULE_8__ = __nccwpck_require__(4217);
-/* harmony import */ var _vibelet_stop_logic_mjs__WEBPACK_IMPORTED_MODULE_12__ = __nccwpck_require__(6274);
-/* harmony import */ var _vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_10__ = __nccwpck_require__(4);
-/* harmony import */ var _terminal_wrapper_mjs__WEBPACK_IMPORTED_MODULE_9__ = __nccwpck_require__(1427);
-/* harmony import */ var _vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_13__ = __nccwpck_require__(7721);
+/* harmony import */ var _vibelet_cloudflare_runtime_mjs__WEBPACK_IMPORTED_MODULE_8__ = __nccwpck_require__(3869);
+/* harmony import */ var _vibelet_launchd_mjs__WEBPACK_IMPORTED_MODULE_12__ = __nccwpck_require__(1010);
+/* harmony import */ var _linux_systemd_mjs__WEBPACK_IMPORTED_MODULE_9__ = __nccwpck_require__(4217);
+/* harmony import */ var _vibelet_stop_logic_mjs__WEBPACK_IMPORTED_MODULE_13__ = __nccwpck_require__(6274);
+/* harmony import */ var _vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_11__ = __nccwpck_require__(4);
+/* harmony import */ var _terminal_wrapper_mjs__WEBPACK_IMPORTED_MODULE_10__ = __nccwpck_require__(1427);
+/* harmony import */ var _vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_14__ = __nccwpck_require__(7721);
+
 
 
 
@@ -14097,11 +14659,11 @@ const runtimeDir = (0,node_path__WEBPACK_IMPORTED_MODULE_4__.join)(vibeletDir, '
 const runtimeCurrentDir = (0,node_path__WEBPACK_IMPORTED_MODULE_4__.join)(runtimeDir, 'current');
 const runtimeMetadataPath = (0,node_path__WEBPACK_IMPORTED_MODULE_4__.join)(runtimeCurrentDir, 'runtime.json');
 const runtimeDaemonEntryPath = (0,node_path__WEBPACK_IMPORTED_MODULE_4__.join)(runtimeCurrentDir, 'dist', 'index.cjs');
-const runtimeTerminalControlTokenPath = _terminal_wrapper_mjs__WEBPACK_IMPORTED_MODULE_9__/* .terminalControlTokenPath */ .gJ;
+const runtimeTerminalControlTokenPath = _terminal_wrapper_mjs__WEBPACK_IMPORTED_MODULE_10__/* .terminalControlTokenPath */ .gJ;
 const stdoutLogPath = (0,node_path__WEBPACK_IMPORTED_MODULE_4__.join)(logDir, 'daemon.stdout.log');
 const stderrLogPath = (0,node_path__WEBPACK_IMPORTED_MODULE_4__.join)(logDir, 'daemon.stderr.log');
 const pidFilePath = (0,node_path__WEBPACK_IMPORTED_MODULE_4__.join)(vibeletDir, 'daemon.pid');
-const relayConfigPath = (0,node_path__WEBPACK_IMPORTED_MODULE_4__.join)(vibeletDir, 'relay.json');
+const relayConfig = (0,_vibelet_cloudflare_runtime_mjs__WEBPACK_IMPORTED_MODULE_8__/* .createRelayConfigStore */ .T7)((0,node_path__WEBPACK_IMPORTED_MODULE_4__.join)(vibeletDir, 'relay.json'));
 const tunnelStatePath = (0,node_path__WEBPACK_IMPORTED_MODULE_4__.join)(vibeletDir, 'tunnel.json');
 const cloudflaredUpdateStatePath = (0,node_path__WEBPACK_IMPORTED_MODULE_4__.join)(vibeletDir, 'cloudflared-update.json');
 const updateCheckPath = (0,node_path__WEBPACK_IMPORTED_MODULE_4__.join)(vibeletDir, 'update-check.json');
@@ -14254,7 +14816,7 @@ function ensureRuntimeInstalled() {
   const runtimeMetadata = readRuntimeMetadata();
 
   if (
-    (0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_10__/* .shouldRefuseRuntimeDowngrade */ .Ne)({
+    (0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_11__/* .shouldRefuseRuntimeDowngrade */ .Ne)({
       cliVersion: packageJson.version,
       runtimeVersion: runtimeMetadata?.version,
       runtimeEntryExists: (0,node_fs__WEBPACK_IMPORTED_MODULE_1__.existsSync)(runtimeDaemonEntryPath),
@@ -14458,7 +15020,7 @@ function createDarwinBackend() {
   }
 
   function bootoutService() {
-    return (0,_vibelet_launchd_mjs__WEBPACK_IMPORTED_MODULE_11__/* .bootoutLaunchdService */ .B)({
+    return (0,_vibelet_launchd_mjs__WEBPACK_IMPORTED_MODULE_12__/* .bootoutLaunchdService */ .B)({
       launchctl,
       launchDomain,
       label,
@@ -14547,7 +15109,7 @@ ${envSection}
         if (result.status !== 0) {
           fail(
             'Failed to bootstrap vibelet launch agent.',
-            [(0,_vibelet_launchd_mjs__WEBPACK_IMPORTED_MODULE_11__/* .describeLaunchctlResult */ .N)(bootoutResult.result), (0,_vibelet_launchd_mjs__WEBPACK_IMPORTED_MODULE_11__/* .describeLaunchctlResult */ .N)(result)].filter(Boolean).join('\n'),
+            [(0,_vibelet_launchd_mjs__WEBPACK_IMPORTED_MODULE_12__/* .describeLaunchctlResult */ .N)(bootoutResult.result), (0,_vibelet_launchd_mjs__WEBPACK_IMPORTED_MODULE_12__/* .describeLaunchctlResult */ .N)(result)].filter(Boolean).join('\n'),
           );
         }
       }
@@ -14563,7 +15125,7 @@ ${envSection}
     stop() {
       const bootoutResult = bootoutService();
       if (!bootoutResult.ok) {
-        fail('Failed to unload vibelet launch agent.', (0,_vibelet_launchd_mjs__WEBPACK_IMPORTED_MODULE_11__/* .describeLaunchctlResult */ .N)(bootoutResult.result));
+        fail('Failed to unload vibelet launch agent.', (0,_vibelet_launchd_mjs__WEBPACK_IMPORTED_MODULE_12__/* .describeLaunchctlResult */ .N)(bootoutResult.result));
       }
       // bootout returns before launchd actually finishes unloading. Poll
       // until the service is gone so a follow-up install() doesn't see a
@@ -14594,10 +15156,10 @@ function createLinuxBackend() {
     return [result?.stderr, result?.stdout].filter(Boolean).join('\n').trim();
   }
 
-  let useSystemd = (0,_linux_systemd_mjs__WEBPACK_IMPORTED_MODULE_8__/* .canUseSystemdUserManager */ .X)();
+  let useSystemd = (0,_linux_systemd_mjs__WEBPACK_IMPORTED_MODULE_9__/* .canUseSystemdUserManager */ .X)();
 
   function demoteToDetachedIfSystemdUnavailable(result) {
-    if (!(0,_linux_systemd_mjs__WEBPACK_IMPORTED_MODULE_8__/* .isSystemdUserManagerUnavailable */ .a)(resultOutput(result))) {
+    if (!(0,_linux_systemd_mjs__WEBPACK_IMPORTED_MODULE_9__/* .isSystemdUserManagerUnavailable */ .a)(resultOutput(result))) {
       return false;
     }
     useSystemd = false;
@@ -14896,9 +15458,18 @@ function isDaemonStartCommand(command) {
   return command === 'default' || command === 'start' || command === 'restart' || command === 'reset';
 }
 
+function retireTrackedQuickTunnel({ required = false } = {}) {
+  return (0,_vibelet_cloudflare_runtime_mjs__WEBPACK_IMPORTED_MODULE_8__/* .retireTrackedQuickTunnel */ .zj)({
+    tunnelStatePath,
+    isAlive: isProcessAlive,
+    required,
+    fail,
+  });
+}
+
 async function stopRunningDaemon(backend) {
   try {
-    await (0,_vibelet_stop_logic_mjs__WEBPACK_IMPORTED_MODULE_12__/* .stopDaemonWithHooks */ .v)({
+    await (0,_vibelet_stop_logic_mjs__WEBPACK_IMPORTED_MODULE_13__/* .stopDaemonWithHooks */ .v)({
       requestShutdown,
       backendStop: () => backend.stop(),
       waitForDaemonExit,
@@ -14911,7 +15482,7 @@ async function stopRunningDaemon(backend) {
 async function ensureDaemonForTerminalControl(backend) {
   const healthyDaemon = await probeHealth(1_500);
   const tokenReady = (0,node_fs__WEBPACK_IMPORTED_MODULE_1__.existsSync)(runtimeTerminalControlTokenPath);
-  const terminalControlReady = healthyDaemon && tokenReady && (0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_10__/* .doesHealthSupportTerminalControl */ .iX)(healthyDaemon);
+  const terminalControlReady = healthyDaemon && tokenReady && (0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_11__/* .doesHealthSupportTerminalControl */ .iX)(healthyDaemon);
   if (terminalControlReady) {
     return healthyDaemon;
   }
@@ -14919,7 +15490,7 @@ async function ensureDaemonForTerminalControl(backend) {
   if (healthyDaemon && !terminalControlReady) {
     const activeSessions = typeof healthyDaemon.activeSessions === 'number' ? healthyDaemon.activeSessions : 0;
     if (activeSessions > 0) {
-      const reason = (0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_10__/* .doesHealthSupportTerminalControl */ .iX)(healthyDaemon)
+      const reason = (0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_11__/* .doesHealthSupportTerminalControl */ .iX)(healthyDaemon)
         ? 'terminal-control token is missing'
         : 'the running daemon does not advertise terminal-control support';
       process.stderr.write(
@@ -14938,7 +15509,7 @@ async function ensureDaemonForTerminalControl(backend) {
 }
 
 function validateExplicitCleartextHosts({ hostArg, fallbackHostsArg }) {
-  const unsafeHosts = (0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_13__/* .findUnsafeCleartextHosts */ .dE)({ hostArg, fallbackHostsArg });
+  const unsafeHosts = (0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_14__/* .findUnsafeCleartextHosts */ .dE)({ hostArg, fallbackHostsArg });
   if (unsafeHosts.length === 0) {
     return;
   }
@@ -14948,8 +15519,8 @@ function validateExplicitCleartextHosts({ hostArg, fallbackHostsArg }) {
 }
 
 async function printPairingQr(pairingPayload) {
-  const payload = JSON.stringify((0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_13__/* .createCompactPairingPayload */ .YP)(pairingPayload));
-  const deepLink = (0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_13__/* .buildPairingDeepLink */ .N7)(payload);
+  const payload = JSON.stringify((0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_14__/* .createCompactPairingPayload */ .YP)(pairingPayload));
+  const deepLink = (0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_14__/* .buildPairingDeepLink */ .N7)(payload);
   (0,node_fs__WEBPACK_IMPORTED_MODULE_1__.mkdirSync)(vibeletDir, { recursive: true });
   await qrcode__WEBPACK_IMPORTED_MODULE_6__.toFile(pairingQrPngPath, payload, {
     type: 'png',
@@ -14972,12 +15543,16 @@ async function printPairingQr(pairingPayload) {
 
 // ─── Commands ───────────────────────────────────────────────────────────────────
 
-async function printPairingSummary(existingHealth = null) {
+async function printPairingSummary(existingHealth = null, { relayUrlOverride = null } = {}) {
   const health = existingHealth ?? (await waitForHealth());
-  const pairingPayload = await postJson('/pair/open');
-  const connections = (0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_13__/* .normalizePairingConnections */ .No)(pairingPayload);
+  const daemonPairingPayload = await postJson('/pair/open');
+  const pairingPayload =
+    relayUrlOverride === null
+      ? daemonPairingPayload
+      : (0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_14__/* .applyRelayUrlToPairingPayload */ .mp)(daemonPairingPayload, relayUrlOverride);
+  const connections = (0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_14__/* .normalizePairingConnections */ .No)(pairingPayload);
   const [preferredConnection, ...otherConnections] = connections;
-  const webUiConnection = (0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_13__/* .selectWebUiConnectionTarget */ .SF)(connections);
+  const webUiConnection = (0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_14__/* .selectWebUiConnectionTarget */ .SF)(connections);
 
   process.stdout.write(`Vibelet daemon is ready.\n\n`);
   process.stdout.write(`Device: ${health.displayName}\n`);
@@ -14985,16 +15560,16 @@ async function printPairingSummary(existingHealth = null) {
   process.stdout.write(`Host: ${pairingPayload.canonicalHost}\n`);
   process.stdout.write(`Port: ${pairingPayload.port}\n`);
   if (preferredConnection) {
-    process.stdout.write(`Preferred path: ${(0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_13__/* .formatConnectionSummary */ .uR)(preferredConnection)}\n`);
+    process.stdout.write(`Preferred path: ${(0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_14__/* .formatConnectionSummary */ .uR)(preferredConnection)}\n`);
   }
   if (otherConnections.length > 0) {
     process.stdout.write(`Other paths:\n`);
     otherConnections.forEach((target) => {
-      process.stdout.write(`  - ${(0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_13__/* .formatConnectionSummary */ .uR)(target)}\n`);
+      process.stdout.write(`  - ${(0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_14__/* .formatConnectionSummary */ .uR)(target)}\n`);
     });
   }
   if (webUiConnection) {
-    process.stdout.write(`Web UI: ${(0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_13__/* .buildWebUiUrl */ .Gv)(webUiConnection, (0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_13__/* .createCompactPairingPayload */ .YP)(pairingPayload))}\n`);
+    process.stdout.write(`Web UI: ${(0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_14__/* .buildWebUiUrl */ .Gv)(webUiConnection, (0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_14__/* .createCompactPairingPayload */ .YP)(pairingPayload))}\n`);
   }
   process.stdout.write(`Paired devices: ${health.pairedDevices}\n`);
   await printPairingQr(pairingPayload);
@@ -15051,7 +15626,7 @@ function printHelp() {
 }
 
 function parseNamedArg(name, errorHint) {
-  return (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_14__/* .parseNamedArg */ .nE)(process.argv, name, errorHint, fail);
+  return (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_15__/* .parseNamedArg */ .nE)(process.argv, name, errorHint, fail);
 }
 
 function parseRelayArg() {
@@ -15109,28 +15684,10 @@ function parseCommandArg(argv) {
   return 'default';
 }
 
-function loadRelayConfig() {
-  try {
-    const data = JSON.parse((0,node_fs__WEBPACK_IMPORTED_MODULE_1__.readFileSync)(relayConfigPath, 'utf8'));
-    return data.relayUrl || '';
-  } catch {
-    return '';
-  }
-}
-
-function saveRelayConfig(relayUrl) {
-  (0,node_fs__WEBPACK_IMPORTED_MODULE_1__.mkdirSync)(vibeletDir, { recursive: true });
-  (0,node_fs__WEBPACK_IMPORTED_MODULE_1__.writeFileSync)(relayConfigPath, JSON.stringify({ relayUrl }, null, 2) + '\n', 'utf8');
-}
-
-function clearRelayConfig() {
-  (0,node_fs__WEBPACK_IMPORTED_MODULE_1__.rmSync)(relayConfigPath, { force: true });
-}
-
 // ─── Tunnel management ──────────────────────────────────────────────────────────
 
-function getTunnelManagerOptions() {
-  return { tunnelStatePath, isAlive: isProcessAlive };
+async function tryUpdateRunningDaemonRelay(relayUrl) {
+  return await (0,_vibelet_cloudflare_runtime_mjs__WEBPACK_IMPORTED_MODULE_8__/* .tryUpdateRunningDaemonRelay */ .BT)({ port, relayUrl, probeHealth });
 }
 
 async function main() {
@@ -15164,10 +15721,10 @@ async function main() {
     return;
   }
 
-  if ((0,_terminal_wrapper_mjs__WEBPACK_IMPORTED_MODULE_9__/* .isTerminalAgentCommand */ .$c)(command)) {
+  if ((0,_terminal_wrapper_mjs__WEBPACK_IMPORTED_MODULE_10__/* .isTerminalAgentCommand */ .$c)(command)) {
     const backend = resolveBackend();
     await ensureDaemonForTerminalControl(backend);
-    process.exitCode = await (0,_terminal_wrapper_mjs__WEBPACK_IMPORTED_MODULE_9__/* .runManagedNativeTerminal */ .WA)({
+    process.exitCode = await (0,_terminal_wrapper_mjs__WEBPACK_IMPORTED_MODULE_10__/* .runManagedNativeTerminal */ .WA)({
       agent: command,
       args: process.argv.slice(3),
       port,
@@ -15176,26 +15733,26 @@ async function main() {
     return;
   }
 
-  const accessTarget = (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_14__/* .parseAccessTargetArg */ .tY)(process.argv, fail);
-  if (accessTarget && (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_14__/* .hasLegacyAccessArgs */ .NT)(process.argv, process.env)) {
+  const accessTarget = (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_15__/* .parseAccessTargetArg */ .tY)(process.argv, fail);
+  if (accessTarget && (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_15__/* .hasLegacyAccessArgs */ .NT)(process.argv, process.env)) {
     fail(
       'Do not combine --access with legacy access flags.',
       'Use one form, for example `--access=local`, `--access=remote`, `--access=https://...`, or `--access=<host>`.',
     );
   }
   if (!accessTarget) {
-    (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_14__/* .consumeFlag */ .PC)(process.argv, 'remote') ||
-      (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_14__/* .consumeFlag */ .PC)(process.argv, 'tunnel') ||
-      (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_14__/* .readNpmConfigFlag */ .AW)('remote') ||
-      (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_14__/* .readNpmConfigFlag */ .AW)('tunnel');
+    (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_15__/* .consumeFlag */ .PC)(process.argv, 'remote') ||
+      (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_15__/* .consumeFlag */ .PC)(process.argv, 'tunnel') ||
+      (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_15__/* .readNpmConfigFlag */ .AW)('remote') ||
+      (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_15__/* .readNpmConfigFlag */ .AW)('tunnel');
   }
   const localFlag =
     accessTarget?.kind === 'local' ||
     (!accessTarget &&
-      ((0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_14__/* .consumeFlag */ .PC)(process.argv, 'local') ||
-        (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_14__/* .readNpmConfigFlag */ .AW)('local') ||
+      ((0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_15__/* .consumeFlag */ .PC)(process.argv, 'local') ||
+        (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_15__/* .readNpmConfigFlag */ .AW)('local') ||
         isTruthyEnvFlag(process.env.VIBELET_LOCAL_ONLY)));
-  const forceFlag = (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_14__/* .consumeFlag */ .PC)(process.argv, 'force') || (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_14__/* .readNpmConfigFlag */ .AW)('force');
+  const forceFlag = (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_15__/* .consumeFlag */ .PC)(process.argv, 'force') || (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_15__/* .readNpmConfigFlag */ .AW)('force');
   const relayArg =
     accessTarget?.kind === 'relay'
       ? accessTarget.relayUrl
@@ -15219,14 +15776,32 @@ async function main() {
   let managedTunnelFailed = false;
   command = parseCommandArg(process.argv);
   const startCommand = isDaemonStartCommand(command);
+  const savedRelayUrl = relayConfig.load();
   // --remote/--tunnel remain accepted for compatibility, but startup commands
   // now default to managed remote access unless another connection target wins.
-  const shouldManageTunnel = startCommand && !localFlag && relayArg === null && !hostArg && !fallbackHostsArg;
+  const shouldManageTunnel = (0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_11__/* .shouldManageQuickTunnel */ .gm)({
+    startCommand,
+    localMode: localFlag,
+    relayArg,
+    hostArg,
+    fallbackHostsArg,
+    savedRelayUrl,
+    force: forceFlag,
+  });
   const cloudflaredProtocol = process.env.VIBELET_CLOUDFLARED_PROTOCOL?.trim() || 'http2';
   if (!['auto', 'quic', 'http2'].includes(cloudflaredProtocol)) {
     fail(`Unsupported VIBELET_CLOUDFLARED_PROTOCOL: ${cloudflaredProtocol}. Use auto, quic, or http2.`);
   }
 
+  if (
+    (0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_11__/* .shouldRetireManagedQuickTunnel */ .Pg)({
+      startCommand,
+      manageQuickTunnel: shouldManageTunnel,
+    })
+  ) {
+    retireTrackedQuickTunnel();
+  }
+
   if (localFlag) {
     process.env.VIBELET_LOCAL_ONLY = '1';
   } else {
@@ -15234,47 +15809,35 @@ async function main() {
   }
 
   if (shouldManageTunnel) {
-    const existing = forceFlag ? null : (0,_cloudflared_tunnel_manager_mjs__WEBPACK_IMPORTED_MODULE_7__/* .getAliveTunnel */ .QQ)(getTunnelManagerOptions());
-    if (existing) {
-      process.stdout.write(`Reusing tunnel: ${existing.url} (pid ${existing.pid})\n`);
-      saveRelayConfig(existing.url);
-    } else {
-      if (forceFlag) (0,_cloudflared_tunnel_manager_mjs__WEBPACK_IMPORTED_MODULE_7__/* .stopTunnel */ .HM)(getTunnelManagerOptions());
-      process.stdout.write('Starting Cloudflare Tunnel...\n');
-      try {
-        const tunnel = await (0,_cloudflared_tunnel_manager_mjs__WEBPACK_IMPORTED_MODULE_7__/* .startTunnel */ .DH)({
-          port,
-          logDir,
-          tunnelStatePath,
-          protocol: cloudflaredProtocol,
-          updateStatePath: cloudflaredUpdateStatePath,
-        });
-        process.stdout.write(`Tunnel ready: ${tunnel.url}\n`);
-        saveRelayConfig(tunnel.url);
-      } catch (err) {
-        managedTunnelFailed = true;
-        (0,_cloudflared_tunnel_manager_mjs__WEBPACK_IMPORTED_MODULE_7__/* .clearTunnelState */ .vD)({ tunnelStatePath });
-        clearRelayConfig();
-        const message = err instanceof Error ? err.message : String(err);
-        process.stderr.write(`${message}\n`);
-        process.stderr.write(
-          'Continuing with LAN/local pairing. Use `npx vibelet --access=remote --force` after fixing Cloudflare Tunnel, or pass `--access=https://<url>` for a custom tunnel.\n',
-        );
-      }
+    const managedTunnel = await (0,_vibelet_cloudflare_runtime_mjs__WEBPACK_IMPORTED_MODULE_8__/* .prepareManagedQuickTunnel */ .kS)({
+      force: forceFlag,
+      port,
+      logDir,
+      tunnelStatePath,
+      protocol: cloudflaredProtocol,
+      updateStatePath: cloudflaredUpdateStatePath,
+      isAlive: isProcessAlive,
+      fail,
+    });
+    managedTunnelFailed = managedTunnel.failed;
+    if (managedTunnel.relayUrl) {
+      relayConfig.save(managedTunnel.relayUrl);
+    } else if (managedTunnel.failed) {
+      relayConfig.clear();
     }
   }
 
   // --access= clears saved relay; --access=https://... saves it; omitted uses saved value.
   if (relayArg !== null) {
     if (relayArg) {
-      saveRelayConfig(relayArg);
+      relayConfig.save(relayArg);
     } else {
-      clearRelayConfig();
+      relayConfig.clear();
     }
   }
   const shouldIgnoreSavedRelay =
     relayArg === null && (localFlag || Boolean(hostArg) || Boolean(fallbackHostsArg) || managedTunnelFailed);
-  const relayUrl = relayArg !== null ? relayArg : shouldIgnoreSavedRelay ? '' : loadRelayConfig();
+  const relayUrl = relayArg !== null ? relayArg : shouldIgnoreSavedRelay ? '' : relayConfig.load();
   if (relayUrl) {
     process.env.VIBELET_RELAY_URL = relayUrl;
   } else {
@@ -15298,12 +15861,10 @@ async function main() {
     // Always try graceful HTTP shutdown first — gives the daemon time to
     // close sessions and flush logs before the service manager kills it.
     await stopRunningDaemon(backend);
-    // Also stop tunnel if running
-    const tunnelState = (0,_cloudflared_tunnel_manager_mjs__WEBPACK_IMPORTED_MODULE_7__/* .getAliveTunnel */ .QQ)(getTunnelManagerOptions());
-    if (tunnelState) {
-      (0,_cloudflared_tunnel_manager_mjs__WEBPACK_IMPORTED_MODULE_7__/* .stopTunnel */ .HM)(getTunnelManagerOptions());
-      process.stdout.write('Tunnel stopped.\n');
-    }
+    // Stop only a tunnel whose persisted owner, origin, and live command all
+    // prove it is the Vibelet-managed Quick Tunnel. Named/external tunnels are
+    // deliberately left alone.
+    retireTrackedQuickTunnel();
     process.stdout.write('Daemon stopped.\n');
     return;
   }
@@ -15311,11 +15872,15 @@ async function main() {
   if (command === 'status') {
     process.stdout.write(`Service (${backend.name}): ${backend.statusLabel()}\n`);
     process.stdout.write(`Runtime: ${(0,node_fs__WEBPACK_IMPORTED_MODULE_1__.existsSync)(runtimeDaemonEntryPath) ? runtimeDaemonEntryPath : 'not installed'}\n`);
-    const tunnelState = (0,_cloudflared_tunnel_manager_mjs__WEBPACK_IMPORTED_MODULE_7__/* .getAliveTunnel */ .QQ)(getTunnelManagerOptions());
+    const tunnelState = await (0,_cloudflared_tunnel_manager_mjs__WEBPACK_IMPORTED_MODULE_7__/* .getAliveManagedQuickTunnel */ .M)({
+      tunnelStatePath,
+      isAlive: isProcessAlive,
+      managerId: 'vibelet-cli',
+    });
     if (tunnelState) {
       process.stdout.write(`Tunnel: ${tunnelState.url} (pid ${tunnelState.pid})\n`);
     }
-    const savedRelay = loadRelayConfig();
+    const savedRelay = relayConfig.load();
     if (savedRelay) {
       process.stdout.write(`Relay: ${savedRelay}\n`);
     }
@@ -15364,14 +15929,14 @@ async function main() {
   if (command === 'reset') {
     const healthyDaemon = await probeHealth(1_500);
     const hasExplicitConfigOverrides =
-      !(0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_10__/* .doesHealthMatchRequestedConnectionConfig */ .nW)({
+      !(0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_11__/* .doesHealthMatchRequestedConnectionConfig */ .nW)({
         health: healthyDaemon,
         relayUrl,
         canonicalHost: hostArg || '',
         fallbackHosts: fallbackHostsArg || '',
         localMode: localFlag,
       }) &&
-      (localFlag || Boolean(relayUrl) || Boolean(hostArg) || Boolean(fallbackHostsArg));
+      (localFlag || relayArg !== null || Boolean(relayUrl) || Boolean(hostArg) || Boolean(fallbackHostsArg));
     const shouldReplaceDetachedDaemon =
       !healthyDaemon && !backend.handlesProcessLifecycle && backend.isServiceInstalled();
     if (shouldReplaceDetachedDaemon || (healthyDaemon && hasExplicitConfigOverrides)) {
@@ -15391,20 +15956,44 @@ async function main() {
     fail(`Unknown command: ${command}`);
   }
 
-  const healthyDaemon = await probeHealth(1_500);
-  const hasExplicitConfigOverrides =
-    !(0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_10__/* .doesHealthMatchRequestedConnectionConfig */ .nW)({
+  let healthyDaemon = await probeHealth(1_500);
+  let hasExplicitConfigOverrides =
+    !(0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_11__/* .doesHealthMatchRequestedConnectionConfig */ .nW)({
       health: healthyDaemon,
       relayUrl,
       canonicalHost: hostArg || '',
       fallbackHosts: fallbackHostsArg || '',
       localMode: localFlag,
     }) &&
-    (localFlag || Boolean(relayUrl) || Boolean(hostArg) || Boolean(fallbackHostsArg));
-  const existingHealth = (0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_10__/* .shouldReuseHealthyDaemon */ .ZN)({
+    (localFlag ||
+      shouldManageTunnel ||
+      relayArg !== null ||
+      Boolean(relayUrl) ||
+      Boolean(hostArg) ||
+      Boolean(fallbackHostsArg));
+  const relayOverrideRequested =
+    !localFlag && !hostArg && !fallbackHostsArg && (shouldManageTunnel || relayArg !== null || Boolean(savedRelayUrl));
+  const canApplyConnectionConfigWithoutRestart = Boolean(
+    healthyDaemon && relayOverrideRequested && hasExplicitConfigOverrides,
+  );
+  if (healthyDaemon && hasExplicitConfigOverrides && canApplyConnectionConfigWithoutRestart) {
+    const refreshedHealth = await tryUpdateRunningDaemonRelay(relayUrl);
+    if (refreshedHealth) {
+      healthyDaemon = refreshedHealth;
+      hasExplicitConfigOverrides = !(0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_11__/* .doesHealthMatchRequestedConnectionConfig */ .nW)({
+        health: healthyDaemon,
+        relayUrl,
+        canonicalHost: '',
+        fallbackHosts: '',
+        localMode: false,
+      });
+    }
+  }
+  const existingHealth = (0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_11__/* .shouldReuseHealthyDaemon */ .ZN)({
     command,
     daemonHealthy: Boolean(healthyDaemon),
     hasExplicitConfigOverrides,
+    canApplyConnectionConfigWithoutRestart,
   })
     ? healthyDaemon
     : null;
@@ -15418,7 +16007,7 @@ async function main() {
     const runningDriver = normalizeDriver(existingHealth.claudeDriverMode);
     const driverMismatch = requestedDriver !== null && runningDriver !== requestedDriver;
     const needsRestart = Boolean(isOutdated) || driverMismatch;
-    if (needsRestart && activeSessions === 0) {
+    if (needsRestart && activeSessions === 0 && !canApplyConnectionConfigWithoutRestart) {
       process.stdout.write(
         isOutdated
           ? `Daemon is running v${runningVersion}, CLI is v${packageJson.version}. Restarting daemon to upgrade...\n`
@@ -15433,29 +16022,47 @@ async function main() {
       return;
     }
     if (isOutdated) {
-      process.stdout.write(
-        `Daemon is running v${runningVersion}, CLI is v${packageJson.version}, but ${activeSessions} active session(s) would be interrupted.\n`,
-      );
-      process.stdout.write('Run `npx vibelet restart` once those sessions are idle to upgrade the daemon.\n');
+      if (canApplyConnectionConfigWithoutRestart) {
+        process.stdout.write(
+          `Daemon is running v${runningVersion}, CLI is v${packageJson.version}; the upgrade was deferred so this relay change cannot restart the running daemon.\n`,
+        );
+        process.stdout.write('Run `npx vibelet restart` later to upgrade the daemon explicitly.\n');
+      } else {
+        process.stdout.write(
+          `Daemon is running v${runningVersion}, CLI is v${packageJson.version}, but ${activeSessions} active session(s) would be interrupted.\n`,
+        );
+        process.stdout.write('Run `npx vibelet restart` once those sessions are idle to upgrade the daemon.\n');
+      }
     } else if (driverMismatch) {
+      if (canApplyConnectionConfigWithoutRestart) {
+        process.stdout.write(
+          `Daemon driver switch to "${requestedDriver}" was deferred so this relay change cannot restart the running daemon.\n`,
+        );
+      } else {
+        process.stdout.write(
+          `Daemon is using the "${runningDriver}" Claude driver; you requested "${requestedDriver}", but ${activeSessions} active session(s) would be interrupted.\n`,
+        );
+      }
       process.stdout.write(
-        `Daemon is using the "${runningDriver}" Claude driver; you requested "${requestedDriver}", but ${activeSessions} active session(s) would be interrupted.\n`,
-      );
-      process.stdout.write(
-        `Run \`npx vibelet restart --claude-driver ${requestedDriver}\` once those sessions are idle to switch.\n`,
+        `Run \`npx vibelet restart --claude-driver ${requestedDriver}\` later to switch explicitly.\n`,
       );
     } else {
       process.stdout.write('Vibelet daemon is already running.\n');
       process.stdout.write('Reusing the current runtime so active sessions stay alive.\n');
       process.stdout.write('Run `npx vibelet restart` to force a full restart.\n\n');
     }
-    await printPairingSummary(existingHealth);
+    await printPairingSummary(existingHealth, {
+      relayUrlOverride: relayOverrideRequested ? relayUrl : null,
+    });
     return;
   }
 
   const shouldReplaceDetachedDaemon =
     !healthyDaemon && !backend.handlesProcessLifecycle && backend.isServiceInstalled();
-  if (shouldReplaceDetachedDaemon || (healthyDaemon && hasExplicitConfigOverrides)) {
+  if (
+    shouldReplaceDetachedDaemon ||
+    (healthyDaemon && hasExplicitConfigOverrides && !canApplyConnectionConfigWithoutRestart)
+  ) {
     await stopRunningDaemon(backend);
   }