agent-dir 0.4.0 → 0.5.0

package/README.md

@@ -6,7 +6,7 @@
 
 > **`agent-dir` turns a trusted local project directory into a controlled, authenticated MCP endpoint for AI agents.**
 
-`agent-dir` is a cross-platform TypeScript CLI that exposes a local project to an AI agent through an authenticated MCP server. It provides controlled file access, targeted file patches, and explicitly allowlisted development commands, with optional tunneling through [Wormhole](https://wormhole.bar/).
+`agent-dir` is a cross-platform TypeScript CLI that exposes a local project to an AI agent through an authenticated MCP server. It provides controlled file access, targeted file patches, and explicitly allowlisted development commands, with optional tunneling through [Wormhole](https://wormhole.bar/) or [Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/).
 
 > **Security:** this is a remote-control development tool. Only expose directories you trust, keep the authentication token private, and allow only commands you actually need.
 
@@ -14,7 +14,7 @@
 
 - Node.js 24 LTS or newer
 - npm
-- Wormhole CLI if remote access is needed
+- Wormhole CLI or `cloudflared` CLI if remote access is needed
 
 Node.js 24 is the supported LTS baseline. The project currently tracks TypeScript 7 and Biome 2.5.
 
@@ -37,6 +37,22 @@ For remote MCP access with Wormhole:
 agent-dir . --tunnel wormhole --subdomain my-project-x7k4m2
 ```
 
+For a stable hostname on your own Cloudflare-managed domain, configure a Cloudflare Tunnel route to the Agent Dir port. Cloudflare Tunnel is the default for profiles that have a `tunnels.cloudflared` entry. Use `-c` to select it explicitly or `-w` to override it with Wormhole:
+
+```bash
+agent-dir scriptr       # profile default (Cloudflare when configured)
+agent-dir scriptr -c    # explicitly use Cloudflare Tunnel
+agent-dir scriptr -w    # explicitly use Wormhole
+```
+
+For a one-off run, the equivalent long option remains available:
+
+```bash
+agent-dir . --tunnel cloudflared --hostname mcp.example.com
+```
+
+Agent Dir starts `cloudflared tunnel run`, monitors its connection, and restarts the process if it disconnects. The `--hostname` value is the public URL displayed by Agent Dir; Cloudflare DNS routing and the named tunnel's ingress configuration must already exist. See [Cloudflare Tunnel setup](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/get-started/).
+
 ### Wormhole domains
 
 When using a custom Wormhole subdomain, choose a distinctive name such as `my-project-x7k4m2`. Avoid generic names such as `project`, `test`, `dev`, or `scriptr` to reduce collisions and make the public endpoint less predictable.
@@ -49,7 +65,7 @@ The Wormhole URL is only the transport endpoint. `agent-dir` authentication is e
 
 ## First-run setup
 
-On the first interactive run, when no `agent-dir` config exists, the CLI walks you through creating your first saved profile. It asks for the profile name, directory, port, tunnel, optional Wormhole subdomain, optional npm scripts, optional allowed commands, and telemetry preference. The generated authentication token is saved with the profile.
+On the first interactive run, when no `agent-dir` config exists, the CLI walks you through creating a saved profile. After the profile name, directory, and port, it asks whether to configure Cloudflare Tunnel first; if enabled, it collects the public hostname and Cloudflare connector token. The Cloudflare connector token is entered without being echoed to the terminal. It then asks whether to configure Wormhole as well and optionally collects a custom subdomain. You can enable either provider, both, or neither. Cloudflare is the default when both are configured. The generated Agent Dir MCP bearer token is saved separately from the Cloudflare connector token.
 
 Telemetry is optional and stays local. During setup, `agent-dir` explains the available levels: **none**, **anonymous**, **basic**, **detailed**, and **diagnostic**. Telemetry is disabled by default if you choose the default option. The same choices can later be changed with `agent-dir telemetry enable|disable`.
 
@@ -73,7 +89,7 @@ Non-interactive invocations and invocations with explicit launch options do not
 
 ## Profiles
 
-Profiles save settings you use repeatedly: project directory, tunnel, Wormhole subdomain, port, npm scripts, allowed non-npm commands, blocked command prefixes, and whether dedicated Git MCP tools are enabled. Dedicated Git tools are enabled automatically when `git` is in the allowed command list, or explicitly with `--git`; use `--no-git` to disable them for a run.
+Profiles save settings you use repeatedly: project directory, tunnel, Wormhole subdomain or Cloudflare hostname, port, npm scripts, allowed non-npm commands, blocked command prefixes, and whether dedicated Git MCP tools are enabled. Dedicated Git tools are enabled automatically when `git` is in the allowed command list, or explicitly with `--git`; use `--no-git` to disable them for a run.
 
 ```bash
 agent-dir config add my-project \
@@ -85,10 +101,40 @@ agent-dir config add my-project \
   --blacklist "git commit,git push --force"
 ```
 
-Then:
+Profiles can store both tunnel configurations at once. The Cloudflare connector token is separate from the Agent Dir MCP bearer token (`--token`); store it under `tunnels.cloudflared.token` or pass `--cloudflared-token` when creating the profile. Config files are stored at `~/.config/agent-dir/config.json` with owner-only permissions.
+
+```json
+{
+  "directory": "~/src/my-project",
+  "port": 3002,
+  "tunnel": "cloudflared",
+  "defaultTunnel": "cloudflared",
+  "tunnels": {
+    "wormhole": { "subdomain": "my-project-x7k4m2" },
+    "cloudflared": {
+      "hostname": "mcp.example.com",
+      "token": "CLOUDFLARE_TUNNEL_TOKEN"
+    }
+  }
+}
+```
+
+When creating a profile from the CLI, pass `--hostname` and optionally `--cloudflared-token`. **Avoid passing secrets as command-line arguments where possible**: they may be exposed in shell history or process listings. Prefer the interactive setup prompt for the connector token. To configure both providers, include both `--subdomain` and `--hostname`, and set the default using `--tunnel cloudflared` (or `-c`). `agent-dir config show` redacts configured tunnel tokens.
+
+For Cloudflare, save the hostname instead of a Wormhole subdomain:
+
+```bash
+agent-dir config add scriptr-mcp \
+  --directory ~/src/my-project \
+  --tunnel cloudflared \
+  --hostname mcp.example.com \
+  --npm typecheck,lint,test
+```
+
+Then start the saved profile:
 
 ```bash
-agent-dir my-project
+agent-dir scriptr-mcp
 ```
 
 Manage profiles with:
@@ -122,7 +168,7 @@ Profiles are stored per-user at `~/.config/agent-dir/config.json`, not in the pr
 
 ## Telemetry
 
-Telemetry is **disabled by default** and is local-only. When enabled, events are stored in `~/.config/agent-dir/telemetry.jsonl` with user-only permissions; no telemetry is sent to a remote service.
+Telemetry is **disabled by default** and is local-only. When enabled, events are stored under `~/.config/agent-dir/telemetry/<profile>/session-<id>.jsonl` with user-only permissions. Each profile and process session gets a separate append-only JSONL file; restarting Agent Dir starts a new session file, and historical events are not truncated. Tool events also include rough byte-based token-size estimates, hashed request/input/output fingerprints, repeated-output signals, cumulative output size, and hashed per-file size metadata. These estimates do not reveal Claude's actual token billing or hidden context. File contents, source code, and raw paths are not stored in the added file metrics. No telemetry is sent to a remote service. The previous shared `telemetry.jsonl` file is migrated into the new layout on the next telemetry read/reset and preserved as a legacy archive.
 
 Enable a privacy level with:
 
@@ -146,13 +192,14 @@ Manage telemetry with:
 ```bash
 agent-dir telemetry status
 agent-dir telemetry schema
-agent-dir telemetry show [--follow]
-agent-dir telemetry summary
+agent-dir telemetry show [profile] [session-id] [--follow]
+agent-dir telemetry summary [profile]
 agent-dir telemetry disable
-agent-dir telemetry reset
+agent-dir telemetry reset <profile>
+agent-dir telemetry reset --all
 ```
 
-For the event model, metric definitions, privacy levels, and guidance for interpreting raw and aggregated telemetry, see [Telemetry interpretation](docs/telemetry.md).
+Use `agent-dir telemetry show scriptr` or `agent-dir telemetry summary scriptr` to focus on one profile. `agent-dir telemetry show scriptr <session-id>` filters to a single session. `agent-dir telemetry reset scriptr` removes only that profile’s telemetry; `agent-dir telemetry reset --all` clears all telemetry and resets the configured level. For the event model, metric definitions, privacy levels, and guidance for interpreting raw and aggregated telemetry, see [Telemetry interpretation](docs/telemetry.md).
 
 ## MCP transport and compatibility
 
@@ -426,7 +473,7 @@ The diagnostics tool is deliberately project-independent. It checks conditions s
 
 ## Credits
 
-Remote tunneling support is provided through [Wormhole](https://wormhole.bar/), a project of the Wormhole team. `agent-dir` invokes the Wormhole CLI and does not provide the tunneling service itself.
+Remote tunneling is provided by [Wormhole](https://wormhole.bar/) or [Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/). `agent-dir` invokes the installed CLI and does not provide either tunneling service itself. Cloudflare support expects an already-configured named tunnel.
 
 ## License
 

package/dist/bin/agent-dir.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { createHash, randomBytes } from "node:crypto";
-import { mkdirSync, readFileSync, unlinkSync, watch, writeFileSync } from "node:fs";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { watch } from "node:fs";
 import { createRequire } from "node:module";
 import { resolve } from "node:path";
 import { createInterface } from "node:readline/promises";
@@ -12,6 +12,7 @@ import { hasConfigFile, runFirstTimeSetup, shouldOfferSetup } from "../src/setup
 import { summarizeTelemetry } from "../src/telemetry/aggregate.js";
 import { isTelemetryLevel } from "../src/telemetry/config.js";
 import { formatTelemetrySummary } from "../src/telemetry/format.js";
+import { ensureTelemetryDirectory, migrateLegacyTelemetry, readAllTelemetryEvents, resetTelemetry, TELEMETRY_DIRECTORY, } from "../src/telemetry/storage.js";
 import { startTunnel } from "../src/tunnel.js";
 const require = createRequire(import.meta.url);
 const packageVersion = require("../../package.json").version;
@@ -41,7 +42,11 @@ const { values, positionals } = parseArgs({
         directory: { type: "string", short: "d" },
         port: { type: "string", short: "p" },
         tunnel: { type: "string", short: "t" },
+        wormhole: { type: "boolean", short: "w" },
+        cloudflared: { type: "boolean", short: "c" },
         subdomain: { type: "string", short: "s" },
+        hostname: { type: "string" },
+        "cloudflared-token": { type: "string" },
         npm: { type: "string" },
         command: { type: "string" },
         blacklist: { type: "string" },
@@ -75,7 +80,8 @@ if (command === "setup") {
 if (shouldOfferSetup(await hasConfigFile(), {
     random: values.random,
     noTunnel: values["no-tunnel"],
-    tunnel: values.tunnel,
+    tunnel: values.tunnel ??
+        (values.wormhole ? "wormhole" : values.cloudflared ? "cloudflared" : undefined),
 }) &&
     command !== "config" &&
     command !== "telemetry") {
@@ -90,7 +96,8 @@ if (shouldOfferSetup(await hasConfigFile(), {
 if (command === "telemetry") {
     const action = positionals[1];
     const currentLevel = config.telemetry?.level ?? "none";
-    const telemetryFile = resolve(`${process.env.HOME ?? "."}/.config/agent-dir/telemetry.jsonl`);
+    const telemetryProfile = positionals[2];
+    const telemetrySession = positionals[3];
     if (action === "status") {
         console.log(`Telemetry: ${currentLevel === "none" ? "disabled" : "enabled"}`);
         console.log(`Level: ${currentLevel}`);
@@ -138,12 +145,13 @@ if (command === "telemetry") {
         process.exit(0);
     }
     if (action === "summary") {
-        console.log(formatTelemetrySummary(summarizeTelemetry(readTelemetryEvents(telemetryFile)), currentLevel));
+        console.log(formatTelemetrySummary(summarizeTelemetry(readAllTelemetryEvents().filter((event) => !telemetryProfile || event.configId === telemetryProfile)), currentLevel));
         process.exit(0);
     }
     if (action === "show") {
         const printEvents = () => {
-            const events = readTelemetryEvents(telemetryFile);
+            const events = readAllTelemetryEvents().filter((event) => (!telemetryProfile || event.configId === telemetryProfile) &&
+                (!telemetrySession || event.sessionId === telemetrySession));
             const grouped = new Map();
             for (const event of events) {
                 const configId = isRecord(event) && typeof event.configId === "string" ? event.configId : "unknown";
@@ -170,17 +178,8 @@ if (command === "telemetry") {
         };
         printEvents();
         if (values.follow) {
-            mkdirSync(resolve(`${process.env.HOME ?? "."}/.config/agent-dir`), {
-                recursive: true,
-                mode: 0o700,
-            });
-            try {
-                readFileSync(telemetryFile);
-            }
-            catch {
-                writeFileSync(telemetryFile, "", { encoding: "utf8", mode: 0o600 });
-            }
-            const watcher = watch(telemetryFile, () => {
+            ensureTelemetryDirectory();
+            const watcher = watch(TELEMETRY_DIRECTORY, { recursive: true }, () => {
                 process.stdout.write("\x1b[2J\x1b[H");
                 printEvents();
             });
@@ -195,16 +194,21 @@ if (command === "telemetry") {
         process.exit(0);
     }
     if (action === "reset") {
-        delete config.telemetry;
-        await saveConfig(config);
-        try {
-            unlinkSync(telemetryFile);
+        if (values.all && telemetryProfile)
+            fail("Use either a profile name or --all, not both.");
+        if (!values.all && !telemetryProfile)
+            fail("Usage: agent-dir telemetry reset <profile> | --all");
+        if (values.all) {
+            delete config.telemetry;
+            await saveConfig(config);
+            resetTelemetry(undefined, true);
+            console.log("✓ Telemetry settings reset and all recorded data was cleared.");
         }
-        catch (error) {
-            if (isRecord(error) && error.code !== "ENOENT")
-                throw error;
+        else {
+            migrateLegacyTelemetry();
+            resetTelemetry(telemetryProfile);
+            console.log(`✓ Telemetry data cleared for profile: ${telemetryProfile}`);
         }
-        console.log("✓ Telemetry reset to defaults and all recorded data was cleared.");
         process.exit(0);
     }
     fail("Usage: agent-dir telemetry {status|enable|disable|schema|show|summary|reset}");
@@ -223,6 +227,8 @@ if (command === "config") {
         const profile = structuredClone(config.profiles[name]);
         if (profile.token)
             profile.token = "<configured>";
+        if (profile.tunnels?.cloudflared?.token)
+            profile.tunnels.cloudflared.token = "<configured>";
         console.log(JSON.stringify(profile, null, 2));
         process.exit(0);
     }
@@ -283,8 +289,21 @@ if (command === "config") {
             fail("Usage: agent-dir config add <name> [options]");
         if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(name))
             fail("Profile names may contain letters, numbers, dots, underscores, and hyphens.");
-        const tunnel = values.tunnel ?? "none";
-        if (tunnel !== "none" && tunnel !== "wormhole")
+        if (values.wormhole && values.cloudflared)
+            fail("Choose only one of -w or -c.");
+        if ((values.wormhole || values.cloudflared) && values.tunnel)
+            fail("Use either -w/-c or --tunnel, not both.");
+        const tunnel = values.wormhole
+            ? "wormhole"
+            : values.cloudflared
+                ? "cloudflared"
+                : (values.tunnel ??
+                    (values.hostname
+                        ? "cloudflared"
+                        : values.subdomain || values.random
+                            ? "wormhole"
+                            : "none"));
+        if (tunnel !== "none" && tunnel !== "wormhole" && tunnel !== "cloudflared")
             fail(`Unsupported tunnel provider: ${tunnel}`);
         const profile = {
             directory: resolve(values.directory ?? "."),
@@ -294,6 +313,28 @@ if (command === "config") {
         };
         if (values.subdomain)
             profile.subdomain = values.subdomain;
+        if (values.hostname)
+            profile.hostname = values.hostname;
+        if (values.subdomain || values.hostname || values.random) {
+            profile.tunnels = {
+                ...(values.subdomain || values.random
+                    ? {
+                        wormhole: {
+                            ...(values.subdomain ? { subdomain: values.subdomain } : { random: true }),
+                        },
+                    }
+                    : {}),
+                ...(values.hostname
+                    ? {
+                        cloudflared: {
+                            hostname: values.hostname,
+                            ...(values["cloudflared-token"] ? { token: values["cloudflared-token"] } : {}),
+                        },
+                    }
+                    : {}),
+            };
+            profile.defaultTunnel = tunnel;
+        }
         const npm = parseList(values.npm);
         if (npm !== undefined)
             profile.npm = { allowedScripts: npm };
@@ -308,6 +349,9 @@ if (command === "config") {
         if (profile.tunnel === "wormhole" && !profile.subdomain && !values.random) {
             fail("Wormhole profiles require --subdomain <name>, or use --random.");
         }
+        if (profile.tunnel === "cloudflared" && !profile.hostname) {
+            fail("Cloudflared profiles require --hostname <host> (a hostname already routed to your named Cloudflare Tunnel).");
+        }
         config.profiles[name] = profile;
         await saveConfig(config);
         console.log(`✓ Saved profile '${name}'.`);
@@ -323,17 +367,37 @@ if (command && command !== "config" && !profile && command.startsWith("-")) {
 const positionalDirectory = profile ? positionals[1] : positionals[0];
 const directory = resolve(values.directory ?? profile?.directory ?? positionalDirectory ?? ".");
 const port = parsePort(values.port, profile?.port ?? 3002);
-const tunnelValue = values["no-tunnel"] ? "none" : (values.tunnel ?? profile?.tunnel ?? "none");
-if (tunnelValue !== "none" && tunnelValue !== "wormhole") {
+if (values.wormhole && values.cloudflared)
+    fail("Choose only one of -w or -c.");
+if ((values.wormhole || values.cloudflared) && values.tunnel)
+    fail("Use either -w/-c or --tunnel, not both.");
+const configuredDefault = profile?.defaultTunnel ??
+    (profile?.tunnels?.cloudflared ? "cloudflared" : (profile?.tunnel ?? "none"));
+const tunnelValue = values["no-tunnel"]
+    ? "none"
+    : values.wormhole
+        ? "wormhole"
+        : values.cloudflared
+            ? "cloudflared"
+            : (values.tunnel ?? configuredDefault);
+if (tunnelValue !== "none" && tunnelValue !== "wormhole" && tunnelValue !== "cloudflared") {
     fail(`Unsupported tunnel provider: ${tunnelValue}`);
 }
 const tunnel = tunnelValue;
-const randomTunnel = values.random === true;
-const subdomain = randomTunnel ? undefined : (values.subdomain ?? profile?.subdomain);
+const randomTunnel = values.random === true ||
+    (values.subdomain === undefined && profile?.tunnels?.wormhole?.random === true);
+const subdomain = randomTunnel
+    ? undefined
+    : (values.subdomain ?? profile?.tunnels?.wormhole?.subdomain ?? profile?.subdomain);
+const hostname = values.hostname ?? profile?.tunnels?.cloudflared?.hostname ?? profile?.hostname;
+const cloudflaredToken = values["cloudflared-token"] ?? profile?.tunnels?.cloudflared?.token;
 if (tunnel === "wormhole" && !subdomain && !randomTunnel) {
     fail("Wormhole requires --subdomain <name>, or use --random.");
 }
-if (randomTunnel && tunnel === "none") {
+if (tunnel === "cloudflared" && !hostname) {
+    fail("Cloudflared requires --hostname <host> (a hostname already routed to your named Cloudflare Tunnel).");
+}
+if (randomTunnel && tunnel !== "wormhole") {
     fail("--random requires --tunnel wormhole.");
 }
 const token = values.token ?? profile?.token ?? randomBytes(24).toString("hex");
@@ -358,6 +422,7 @@ const telemetryConfigId = profile
         port,
         tunnel,
         subdomain,
+        hostname,
         randomTunnel,
         npm: commandConfig.npm?.allowedScripts ?? [],
         commands: commandConfig.commands ?? [],
@@ -377,6 +442,8 @@ if (profile && command)
     bannerOptions.profileName = command;
 if (subdomain)
     bannerOptions.subdomain = subdomain;
+if (hostname)
+    bannerOptions.hostname = hostname;
 if (npmScripts)
     bannerOptions.npmScripts = npmScripts;
 if (allowedCommands)
@@ -386,6 +453,7 @@ if (commandConfig.blacklistedCommands?.length) {
 }
 bannerOptions.gitEnabled = commandConfig.git ?? commandConfig.commands?.includes("git") ?? false;
 printBanner(bannerOptions);
+const telemetrySessionId = randomUUID();
 const server = await startServer({
     root: directory,
     port,
@@ -394,6 +462,7 @@ const server = await startServer({
     telemetry: {
         ...(config.telemetry ?? { level: "none" }),
         ...(telemetryConfigId ? { configId: telemetryConfigId } : {}),
+        sessionId: telemetrySessionId,
         persist: true,
     },
 });
@@ -405,12 +474,15 @@ console.log("    Token        : <configured>");
 if (tunnel !== "none") {
     try {
         tunnelResult = await startTunnel({
-            provider: "wormhole",
+            provider: tunnel,
             port,
+            ...(hostname ? { hostname } : {}),
+            ...(cloudflaredToken ? { cloudflaredToken } : {}),
             token,
             telemetry: {
                 ...(config.telemetry ?? { level: "none" }),
                 ...(telemetryConfigId ? { configId: telemetryConfigId } : {}),
+                sessionId: telemetrySessionId,
                 persist: true,
             },
             random: randomTunnel,
@@ -453,14 +525,3 @@ async function confirmConfigDelete(message, skipPrompt) {
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function readTelemetryEvents(path) {
-    try {
-        return readFileSync(path, "utf8")
-            .split("\n")
-            .filter(Boolean)
-            .map((line) => JSON.parse(line));
-    }
-    catch {
-        return [];
-    }
-}

package/dist/src/config.js

@@ -63,12 +63,42 @@ function isProfile(value) {
         return false;
     if (port < 1 || port > 65_535)
         return false;
-    if (profile.tunnel !== "none" && profile.tunnel !== "wormhole")
+    if (profile.tunnel !== "none" &&
+        profile.tunnel !== "wormhole" &&
+        profile.tunnel !== "cloudflared")
         return false;
     if (profile.subdomain !== undefined && typeof profile.subdomain !== "string")
         return false;
+    if (profile.hostname !== undefined && typeof profile.hostname !== "string")
+        return false;
     if (profile.token !== undefined && typeof profile.token !== "string")
         return false;
+    if (profile.defaultTunnel !== undefined &&
+        !["none", "wormhole", "cloudflared"].includes(String(profile.defaultTunnel)))
+        return false;
+    if (profile.tunnels !== undefined) {
+        if (!profile.tunnels || typeof profile.tunnels !== "object")
+            return false;
+        const tunnels = profile.tunnels;
+        if (tunnels.wormhole !== undefined) {
+            if (!tunnels.wormhole || typeof tunnels.wormhole !== "object")
+                return false;
+            const wormhole = tunnels.wormhole;
+            if (wormhole.subdomain !== undefined && typeof wormhole.subdomain !== "string")
+                return false;
+            if (wormhole.random !== undefined && typeof wormhole.random !== "boolean")
+                return false;
+        }
+        if (tunnels.cloudflared !== undefined) {
+            if (!tunnels.cloudflared || typeof tunnels.cloudflared !== "object")
+                return false;
+            const cloudflared = tunnels.cloudflared;
+            if (typeof cloudflared.hostname !== "string" || !cloudflared.hostname)
+                return false;
+            if (cloudflared.token !== undefined && typeof cloudflared.token !== "string")
+                return false;
+        }
+    }
     if (profile.npm !== undefined) {
         if (!profile.npm || typeof profile.npm !== "object")
             return false;

package/dist/src/logging.d.ts

@@ -6,6 +6,7 @@ export declare function printBanner(options: {
     tunnel: string;
     profileName?: string;
     subdomain?: string;
+    hostname?: string;
     token?: string;
     npmScripts?: string[];
     commands?: string[];

package/dist/src/logging.js

@@ -116,8 +116,12 @@ export function printHelp() {
     writeLine("");
     writeLine("Options:");
     writeLine("  -p, --port <port>          Local server port");
-    writeLine("  -t, --tunnel <provider>    Tunnel provider (none, wormhole)");
+    writeLine("  -t, --tunnel <provider>    Explicit tunnel provider (none, wormhole, cloudflared)");
+    writeLine("  -w, --wormhole             Use Wormhole for this run");
+    writeLine("  -c, --cloudflared          Use Cloudflare Tunnel for this run");
     writeLine("  -s, --subdomain <name>     Wormhole subdomain");
+    writeLine("      --hostname <host>      Hostname routed to a Cloudflare Tunnel");
+    writeLine("      --cloudflared-token <token> Cloudflare Tunnel connector token (stored in config)");
     writeLine("      --directory <path>     Directory to expose");
     writeLine("      --npm <scripts>        Comma-separated allowed npm scripts");
     writeLine("      --command <commands>   Comma-separated allowed commands");
@@ -169,6 +173,8 @@ export function printBanner(options) {
     }
     if (options.subdomain)
         writeLine(`  Domain       https://${options.subdomain}.wormhole.bar`);
+    if (options.hostname)
+        writeLine(`  Domain       https://${options.hostname}`);
     writeLine("");
     writeLine("  MCP");
     writeLine(`    ${color("⚡ /mcp", CYAN)}`);