kennel 0.2.27 → 0.2.29

package/dist/core/runtime.js

@@ -22005,7 +22005,7 @@ import {
   sep as sep7
 } from "node:path";
 
-// node_modules/.bun/@raggle-ai+barkdown@0.7.0+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/react.js
+// node_modules/.bun/@raggle-ai+barkdown@0.7.1+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/react.js
 var import_jsx_runtime6 = __toESM(require_jsx_runtime(), 1);
 var import_react6 = __toESM(require_react(), 1);
 
@@ -22182,7 +22182,7 @@ var defaultSchema = {
     "var"
   ]
 };
-// node_modules/.bun/@raggle-ai+barkdown@0.7.0+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/react.js
+// node_modules/.bun/@raggle-ai+barkdown@0.7.1+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/react.js
 var runtime = __toESM(require_jsx_runtime(), 1);
 
 // node_modules/.bun/gemoji@8.1.0/node_modules/gemoji/index.js
@@ -35279,7 +35279,7 @@ var gemoji = [
   }
 ];
 
-// node_modules/.bun/@raggle-ai+barkdown@0.7.0+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/emoji.js
+// node_modules/.bun/@raggle-ai+barkdown@0.7.1+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/emoji.js
 var shortcodeToEmoji = new Map(gemoji.flatMap((entry) => entry.names.map((name) => [
   name,
   {
@@ -35288,36 +35288,36 @@ var shortcodeToEmoji = new Map(gemoji.flatMap((entry) => entry.names.map((name)
   }
 ])));
 
-// node_modules/.bun/@raggle-ai+barkdown@0.7.0+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/link.js
+// node_modules/.bun/@raggle-ai+barkdown@0.7.1+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/link.js
 var import_jsx_runtime = __toESM(require_jsx_runtime(), 1);
 
-// node_modules/.bun/@raggle-ai+barkdown@0.7.0+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/rehype-collapsible-headings.js
+// node_modules/.bun/@raggle-ai+barkdown@0.7.1+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/rehype-collapsible-headings.js
 var HEADING_TAGS = new Set(["h1", "h2", "h3", "h4", "h5", "h6"]);
 
-// node_modules/.bun/@raggle-ai+barkdown@0.7.0+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/react-collapsible-sections.js
+// node_modules/.bun/@raggle-ai+barkdown@0.7.1+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/react-collapsible-sections.js
 var import_jsx_runtime3 = __toESM(require_jsx_runtime(), 1);
 var import_react3 = __toESM(require_react(), 1);
 
-// node_modules/.bun/@raggle-ai+barkdown@0.7.0+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/react-heading-copy.js
+// node_modules/.bun/@raggle-ai+barkdown@0.7.1+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/react-heading-copy.js
 var import_jsx_runtime2 = __toESM(require_jsx_runtime(), 1);
 var import_react = __toESM(require_react(), 1);
 
-// node_modules/.bun/@raggle-ai+barkdown@0.7.0+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/use-copy-to-clipboard.js
+// node_modules/.bun/@raggle-ai+barkdown@0.7.1+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/use-copy-to-clipboard.js
 var import_react2 = __toESM(require_react(), 1);
 
-// node_modules/.bun/@raggle-ai+barkdown@0.7.0+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/rehype-heading-lines.js
+// node_modules/.bun/@raggle-ai+barkdown@0.7.1+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/rehype-heading-lines.js
 var HEADING_TAGS2 = new Set(["h1", "h2", "h3", "h4", "h5", "h6"]);
 
-// node_modules/.bun/@raggle-ai+barkdown@0.7.0+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/react-mermaid.js
+// node_modules/.bun/@raggle-ai+barkdown@0.7.1+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/react-mermaid.js
 var import_jsx_runtime4 = __toESM(require_jsx_runtime(), 1);
 var import_react4 = __toESM(require_react(), 1);
 var renderQueue = Promise.resolve();
 
-// node_modules/.bun/@raggle-ai+barkdown@0.7.0+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/react-media.js
+// node_modules/.bun/@raggle-ai+barkdown@0.7.1+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/react-media.js
 var import_jsx_runtime5 = __toESM(require_jsx_runtime(), 1);
 var import_react5 = __toESM(require_react(), 1);
 
-// node_modules/.bun/@raggle-ai+barkdown@0.7.0+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/react.js
+// node_modules/.bun/@raggle-ai+barkdown@0.7.1+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/react.js
 var markdownSchema = {
   ...defaultSchema,
   tagNames: [
@@ -35505,11 +35505,11 @@ function markdownMetadata(content) {
     title: metadata?.title ?? leadingHeading(body)
   };
 }
-// node_modules/.bun/@raggle-ai+barkdown@0.7.0+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/node.js
+// node_modules/.bun/@raggle-ai+barkdown@0.7.1+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/node.js
 import { readdir, readFile } from "node:fs/promises";
 import { relative, resolve as resolve2, sep } from "node:path";
 
-// node_modules/.bun/@raggle-ai+barkdown@0.7.0+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/documents.js
+// node_modules/.bun/@raggle-ai+barkdown@0.7.1+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/documents.js
 var extensions = new Set([
   ".htm",
   ".html",
@@ -35529,7 +35529,7 @@ function documentKind(path) {
   return;
 }
 
-// node_modules/.bun/@raggle-ai+barkdown@0.7.0+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/node.js
+// node_modules/.bun/@raggle-ai+barkdown@0.7.1+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/node.js
 var skipped = new Set([".git", ".turbo", "dist", "node_modules"]);
 async function readFolder(root) {
   const folder = resolve2(root);

package/dist/package/preview.d.ts

@@ -7,7 +7,7 @@
  * sources, while staying type-checked against that source of truth.
  */
 export declare function share(input: string[]): Promise<void>;
-export declare function startLanShare(target: {
+export declare function startPreviewShare(target: {
     root: string;
     target?: string;
 }): Promise<import("kennel-preview/terminal").PreviewShare>;

package/dist/package/preview.js

@@ -297,7 +297,7 @@ function previewTerminal(url, target, startShare) {
 `));
   };
   const shareFolder = async () => {
-    status = "Preparing a password-protected Wi-Fi link…";
+    status = "Preparing a private Tailscale link…";
     render();
     try {
       share ??= startShare();
@@ -310,18 +310,17 @@ function previewTerminal(url, target, startShare) {
       }
       if (finished)
         return;
-      status = `Wi-Fi link: ${active.url}
+      status = `Tailscale link: ${active.url}
   Username: ${active.username} · Password: ${active.password}
-  Password required. Send the password separately. Same Wi-Fi only.
-  Self-signed HTTPS (24 hours): expect a certificate warning.
-  Verify SHA-256 before trusting the certificate:
-  ${active.fingerprint}
+  Password required. Send the password separately.
+  Connect Tailscale on your phone to the same tailnet.
+  Trusted HTTPS; no certificate installation required.
   Keep this command running. Ctrl+C stops sharing.`;
       render();
       try {
         await copyPreviewLink(active.url);
         status += `
-  Wi-Fi link copied to clipboard (without the password).`;
+  Tailscale link copied to clipboard (without the password).`;
       } catch (error) {
         status += `
   Could not copy link: ${terminalText(error instanceof Error ? error.message : String(error))}`;
@@ -348,7 +347,7 @@ function previewTerminal(url, target, startShare) {
     }
     if (share) {
       share.then((active) => active.close()).catch((error) => {
-        console.error(`  Wi-Fi share stopped: ${error instanceof Error ? error.message : error}`);
+        console.error(`  Could not stop the Tailscale share: ${error instanceof Error ? error.message : error}`);
       }).finally(() => resolveClosed());
     } else
       resolveClosed();
@@ -6342,7 +6341,7 @@ async function hotViewer(options) {
   const reuse = async () => {
     const terminal = previewTerminal(viewerUrl, options, async () => {
       await Promise.resolve().then(() => init_share());
-      return startLanShare(options);
+      return startPreviewShare(options);
     });
     if (options.open)
       openPreview(viewerUrl);
@@ -6401,7 +6400,7 @@ async function hotViewer(options) {
   });
   const terminal = previewTerminal(viewerUrl, options, async () => {
     await Promise.resolve().then(() => init_share());
-    return startLanShare(options);
+    return startPreviewShare(options);
   });
   terminal.closed.then(() => {
     if (child.exitCode === null && child.signalCode === null)
@@ -20831,7 +20830,7 @@ var init_gemoji = __esm(() => {
   ];
 });
 
-// node_modules/.bun/@raggle-ai+barkdown@0.7.0+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/emoji.js
+// node_modules/.bun/@raggle-ai+barkdown@0.7.1+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/emoji.js
 var shortcodeToEmoji;
 var init_emoji = __esm(() => {
   init_gemoji();
@@ -20844,32 +20843,32 @@ var init_emoji = __esm(() => {
   ])));
 });
 
-// node_modules/.bun/@raggle-ai+barkdown@0.7.0+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/link.js
+// node_modules/.bun/@raggle-ai+barkdown@0.7.1+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/link.js
 var import_jsx_runtime;
 var init_link = __esm(() => {
   import_jsx_runtime = __toESM(require_jsx_runtime(), 1);
 });
 
-// node_modules/.bun/@raggle-ai+barkdown@0.7.0+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/rehype-collapsible-headings.js
+// node_modules/.bun/@raggle-ai+barkdown@0.7.1+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/rehype-collapsible-headings.js
 var HEADING_TAGS;
 var init_rehype_collapsible_headings = __esm(() => {
   HEADING_TAGS = new Set(["h1", "h2", "h3", "h4", "h5", "h6"]);
 });
 
-// node_modules/.bun/@raggle-ai+barkdown@0.7.0+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/react-heading-copy.js
+// node_modules/.bun/@raggle-ai+barkdown@0.7.1+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/react-heading-copy.js
 var import_jsx_runtime2, import_react;
 var init_react_heading_copy = __esm(() => {
   import_jsx_runtime2 = __toESM(require_jsx_runtime(), 1);
   import_react = __toESM(require_react(), 1);
 });
 
-// node_modules/.bun/@raggle-ai+barkdown@0.7.0+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/use-copy-to-clipboard.js
+// node_modules/.bun/@raggle-ai+barkdown@0.7.1+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/use-copy-to-clipboard.js
 var import_react2;
 var init_use_copy_to_clipboard = __esm(() => {
   import_react2 = __toESM(require_react(), 1);
 });
 
-// node_modules/.bun/@raggle-ai+barkdown@0.7.0+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/react-collapsible-sections.js
+// node_modules/.bun/@raggle-ai+barkdown@0.7.1+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/react-collapsible-sections.js
 var import_jsx_runtime3, import_react3;
 var init_react_collapsible_sections = __esm(() => {
   init_react_heading_copy();
@@ -20878,16 +20877,16 @@ var init_react_collapsible_sections = __esm(() => {
   import_react3 = __toESM(require_react(), 1);
 });
 
-// node_modules/.bun/@raggle-ai+barkdown@0.7.0+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/rehype-heading-lines.js
+// node_modules/.bun/@raggle-ai+barkdown@0.7.1+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/rehype-heading-lines.js
 var HEADING_TAGS2;
 var init_rehype_heading_lines = __esm(() => {
   HEADING_TAGS2 = new Set(["h1", "h2", "h3", "h4", "h5", "h6"]);
 });
 
-// node_modules/.bun/@raggle-ai+barkdown@0.7.0+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/mermaid.js
+// node_modules/.bun/@raggle-ai+barkdown@0.7.1+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/mermaid.js
 var init_mermaid = () => {};
 
-// node_modules/.bun/@raggle-ai+barkdown@0.7.0+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/react-mermaid.js
+// node_modules/.bun/@raggle-ai+barkdown@0.7.1+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/react-mermaid.js
 var import_jsx_runtime4, import_react4, renderQueue;
 var init_react_mermaid = __esm(() => {
   init_mermaid();
@@ -20896,14 +20895,14 @@ var init_react_mermaid = __esm(() => {
   renderQueue = Promise.resolve();
 });
 
-// node_modules/.bun/@raggle-ai+barkdown@0.7.0+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/react-media.js
+// node_modules/.bun/@raggle-ai+barkdown@0.7.1+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/react-media.js
 var import_jsx_runtime5, import_react5;
 var init_react_media = __esm(() => {
   import_jsx_runtime5 = __toESM(require_jsx_runtime(), 1);
   import_react5 = __toESM(require_react(), 1);
 });
 
-// node_modules/.bun/@raggle-ai+barkdown@0.7.0+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/react.js
+// node_modules/.bun/@raggle-ai+barkdown@0.7.1+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/react.js
 var import_jsx_runtime6, import_react6, runtime, markdownSchema;
 var init_react = __esm(() => {
   init_rehype_sanitize();
@@ -20954,7 +20953,7 @@ var init_react = __esm(() => {
   };
 });
 
-// node_modules/.bun/@raggle-ai+barkdown@0.7.0+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/index.js
+// node_modules/.bun/@raggle-ai+barkdown@0.7.1+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/index.js
 var init_dist2 = __esm(() => {
   init_react();
   init_link();
@@ -28070,7 +28069,7 @@ var init_markdown = __esm(() => {
   init_dist2();
 });
 
-// node_modules/.bun/@raggle-ai+barkdown@0.7.0+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/documents.js
+// node_modules/.bun/@raggle-ai+barkdown@0.7.1+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/documents.js
 function documentKind(path) {
   const extension = path.slice(path.lastIndexOf(".")).toLowerCase();
   if (extension === ".htm" || extension === ".html")
@@ -28093,7 +28092,7 @@ var init_documents = __esm(() => {
   ]);
 });
 
-// node_modules/.bun/@raggle-ai+barkdown@0.7.0+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/node.js
+// node_modules/.bun/@raggle-ai+barkdown@0.7.1+22117d1132b05fb8/node_modules/@raggle-ai/barkdown/dist/node.js
 import { readdir, readFile as readFile2 } from "node:fs/promises";
 import { relative as relative2, resolve as resolve3, sep } from "node:path";
 async function readFolder(root) {
@@ -40703,7 +40702,7 @@ async function viewer(input) {
     const viewerUrl = popUrl(displayHost, options.port, options);
     const terminal = previewTerminal(viewerUrl, options, async () => {
       await Promise.resolve().then(() => init_share());
-      return startLanShare(options);
+      return startPreviewShare(options);
     });
     if (options.open)
       openPreview(viewerUrl);
@@ -40734,7 +40733,7 @@ async function viewer(input) {
     const viewerUrl = popUrl(displayHost, options.port, options);
     const terminal = previewTerminal(viewerUrl, options, async () => {
       await Promise.resolve().then(() => init_share());
-      return startLanShare(options);
+      return startPreviewShare(options);
     });
     if (options.open)
       openPreview(viewerUrl);
@@ -40763,57 +40762,15 @@ var init_viewer = __esm(() => {
 });
 
 // packages/preview/src/protected-share.ts
-import { execFile as execFile6 } from "node:child_process";
-import { createHash as createHash6, randomBytes, timingSafeEqual, X509Certificate } from "node:crypto";
-import { mkdtemp, readFile as readFile11, rm as rm2 } from "node:fs/promises";
-import { createServer as createServer3 } from "node:https";
-import { isIP as isIP2 } from "node:net";
-import { tmpdir as tmpdir2 } from "node:os";
-import { join as join5 } from "node:path";
-import { promisify } from "node:util";
-async function previewCertificate(host) {
-  if (!isIP2(host))
-    throw new Error("The Wi-Fi share requires an IP address");
-  const directory = await mkdtemp(join5(tmpdir2(), "kennel-preview-tls-"));
-  const keyFile = join5(directory, "key.pem");
-  const certFile = join5(directory, "cert.pem");
-  try {
-    await run("openssl", [
-      "req",
-      "-x509",
-      "-newkey",
-      "rsa:2048",
-      "-nodes",
-      "-days",
-      "1",
-      "-keyout",
-      keyFile,
-      "-out",
-      certFile,
-      "-subj",
-      "/CN=Kennel Wi-Fi preview",
-      "-addext",
-      `subjectAltName=IP:${host}`
-    ]);
-    const [key, cert] = await Promise.all([readFile11(keyFile), readFile11(certFile)]);
-    return { key, cert, fingerprint: new X509Certificate(cert).fingerprint256 };
-  } catch (error) {
-    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
-      throw new Error("Password-protected sharing requires OpenSSL on PATH");
-    }
-    throw error;
-  } finally {
-    await rm2(directory, { recursive: true, force: true });
-  }
-}
-async function startProtectedShare(host, handle) {
-  const { key, cert, fingerprint } = await previewCertificate(host);
+import { createHash as createHash6, randomBytes, timingSafeEqual } from "node:crypto";
+import { createServer as createServer3 } from "node:http";
+async function startProtectedShare(handle) {
   const username = "kennel";
   const password = randomBytes(12).toString("base64url");
   const authorization = `Basic ${Buffer.from(`${username}:${password}`).toString("base64")}`;
   const expected = createHash6("sha256").update(authorization).digest();
   const attempts = new Map;
-  const server = createServer3({ key, cert, minVersion: "TLSv1.2" }, (request, response) => {
+  const server = createServer3((request, response) => {
     response.setHeader("Cache-Control", "no-store");
     response.setHeader("X-Content-Type-Options", "nosniff");
     const address = request.socket.remoteAddress ?? "unknown";
@@ -40849,7 +40806,7 @@ async function startProtectedShare(host, handle) {
   try {
     await new Promise((done, fail) => {
       server.once("error", fail);
-      server.listen(0, host, () => {
+      server.listen(0, "127.0.0.1", () => {
         server.off("error", fail);
         done();
       });
@@ -40857,14 +40814,58 @@ async function startProtectedShare(host, handle) {
     const address = server.address();
     if (!address || typeof address === "string")
       throw new Error("No Wi-Fi server address");
-    return { port: address.port, username, password, authorization, cert, fingerprint, close };
+    return { port: address.port, username, password, authorization, close };
+  } catch (error) {
+    await close();
+    throw error;
+  }
+}
+var init_protected_share = () => {};
+
+// packages/preview/src/tailscale-share.ts
+import { execFile as execFile6 } from "node:child_process";
+import { promisify } from "node:util";
+async function serveConfig() {
+  const { stdout } = await run("tailscale", ["serve", "status", "--json"]);
+  return JSON.parse(stdout);
+}
+async function tailscaleHostname() {
+  const { stdout } = await run("tailscale", ["status", "--json"]);
+  const status = JSON.parse(stdout);
+  const host = status.Self?.DNSName?.replace(/\.$/, "");
+  if (status.BackendState !== "Running" || !host || !host.endsWith(".ts.net")) {
+    throw new Error("Connect Tailscale on this Mac, then share again. The phone must use the same tailnet.");
+  }
+  return host;
+}
+async function startTailscaleProxy(host, port) {
+  const authority = `${host}:${port}`;
+  const target = `http://127.0.0.1:${port}`;
+  const before = await serveConfig();
+  if (before.TCP?.[String(port)] || before.Web?.[authority] || before.AllowFunnel?.[authority]) {
+    throw new Error("This Tailscale port is already configured. Share again to select another port.");
+  }
+  const close = async () => {
+    const current = await serveConfig();
+    const handlers = current.Web?.[authority]?.Handlers;
+    if (handlers?.["/"]?.Proxy === target && Object.keys(handlers).length === 1) {
+      await run("tailscale", ["serve", `--https=${port}`, "off"]);
+    }
+  };
+  try {
+    await run("tailscale", ["serve", "--bg", "--yes", `--https=${port}`, target], { timeout: 30000 });
+    const current = await serveConfig();
+    if (current.AllowFunnel?.[authority] || current.Web?.[authority]?.Handlers?.["/"]?.Proxy !== target) {
+      throw new Error("Tailscale did not create the expected private HTTPS proxy");
+    }
+    return { origin: `https://${authority}`, close };
   } catch (error) {
     await close();
     throw error;
   }
 }
 var run;
-var init_protected_share = __esm(() => {
+var init_tailscale_share = __esm(() => {
   run = promisify(execFile6);
 });
 
@@ -40872,7 +40873,6 @@ var init_protected_share = __esm(() => {
 import { dirname as dirname12, resolve as resolve15 } from "node:path";
 import { existsSync as existsSync7, realpathSync as realpathSync4 } from "node:fs";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
-import { get } from "node:https";
 function splitShareArgs(input) {
   const options = {
     folder: undefined,
@@ -40941,84 +40941,65 @@ async function runningViewerRoot(port = plainViewerPort) {
   }
   return;
 }
-async function startLanShare(target) {
+async function startPreviewShare(target) {
   const root = realpathSync4(target.root);
   const web = resolve15(dirname12(fileURLToPath4(import.meta.url)), "../../web");
   if (!existsSync7(resolve15(web, "index.html"))) {
     throw new Error("Kennel web app not found. Run the CLI build first.");
   }
-  const host = lanHost2();
+  const host = await tailscaleHostname();
   await Promise.resolve().then(() => init_server4());
   process.env.KENNEL_VIEWER_HOSTS = [process.env.KENNEL_VIEWER_HOSTS, host].filter(Boolean).join(",");
   const api = createKennelApi({
     root,
-    host: "0.0.0.0",
+    host: "127.0.0.1",
     remoteAccess: true,
     restrictToRoot: true,
     lockedFile: target.target ? realpathSync4(target.target) : undefined,
     webRoot: web
   });
   let shared;
+  let proxy;
   const close = async () => {
     try {
-      await api.close();
+      await proxy?.close();
     } finally {
-      await shared?.close();
+      try {
+        await shared?.close();
+      } finally {
+        await api.close();
+      }
     }
   };
   try {
-    shared = await startProtectedShare(host, (request, response) => {
+    shared = await startProtectedShare((request, response) => {
       api.handle(request, response);
     });
-    const url = new URL(popUrl(host, String(shared.port), {
+    proxy = await startTailscaleProxy(host, shared.port);
+    const path = new URL(popUrl(host, String(shared.port), {
       dryRun: false,
-      host: "0.0.0.0",
+      host: "127.0.0.1",
       hot: false,
-      lan: true,
+      lan: false,
       open: false,
       root,
       port: String(shared.port),
       tailscale: false,
       watch: false,
       target: target.target
-    }));
-    url.protocol = "https:";
-    const { cert, authorization } = shared;
-    const health = await new Promise((done, fail) => {
-      const request = get(new URL("/api/health", url), {
-        ca: cert,
-        agent: false,
-        headers: { Authorization: authorization }
-      }, (response) => {
-        let body = "";
-        response.setEncoding("utf8");
-        response.on("error", fail);
-        response.on("data", (chunk) => {
-          body += chunk;
-        });
-        response.on("end", () => {
-          try {
-            if (response.statusCode !== 200)
-              throw new Error("The Wi-Fi server did not respond");
-            done(JSON.parse(body));
-          } catch (error) {
-            fail(error);
-          }
-        });
-      });
-      request.setTimeout(5000, () => request.destroy(new Error("The Wi-Fi server did not respond")));
-      request.on("error", fail);
+    })).pathname;
+    const url = new URL(path, proxy.origin);
+    const response = await fetch(new URL("/api/health", url), {
+      headers: { Authorization: shared.authorization },
+      signal: AbortSignal.timeout(30000)
     });
+    if (!response.ok)
+      throw new Error("The Tailscale share did not respond");
+    const health = await response.json();
     if (health.viewer !== "kennel-core" || health.root !== root) {
-      throw new Error("The Wi-Fi server is not serving the selected folder");
+      throw new Error("The Tailscale share is not serving the selected folder");
     }
-    return {
-      url: url.href,
-      username: shared.username,
-      password: shared.password,
-      fingerprint: shared.fingerprint,
-      close
-    };
+    return { url: url.href, username: shared.username, password: shared.password, close };
   } catch (error) {
     await close();
     throw error;
@@ -41049,6 +41030,7 @@ var plainViewerPort = "5180";
 var init_share = __esm(() => {
   init_viewer();
   init_protected_share();
+  init_tailscale_share();
 });
 init_share();
 
@@ -41057,5 +41039,5 @@ export {
   runningViewerRoot,
   share,
   splitShareArgs,
-  startLanShare
+  startPreviewShare
 };

package/dist/site/terminal.js

@@ -86,7 +86,7 @@ function previewTerminal(url, target, startShare) {
 `));
   };
   const shareFolder = async () => {
-    status = "Preparing a password-protected Wi-Fi link…";
+    status = "Preparing a private Tailscale link…";
     render();
     try {
       share ??= startShare();
@@ -99,18 +99,17 @@ function previewTerminal(url, target, startShare) {
       }
       if (finished)
         return;
-      status = `Wi-Fi link: ${active.url}
+      status = `Tailscale link: ${active.url}
   Username: ${active.username} · Password: ${active.password}
-  Password required. Send the password separately. Same Wi-Fi only.
-  Self-signed HTTPS (24 hours): expect a certificate warning.
-  Verify SHA-256 before trusting the certificate:
-  ${active.fingerprint}
+  Password required. Send the password separately.
+  Connect Tailscale on your phone to the same tailnet.
+  Trusted HTTPS; no certificate installation required.
   Keep this command running. Ctrl+C stops sharing.`;
       render();
       try {
         await copyPreviewLink(active.url);
         status += `
-  Wi-Fi link copied to clipboard (without the password).`;
+  Tailscale link copied to clipboard (without the password).`;
       } catch (error) {
         status += `
   Could not copy link: ${terminalText(error instanceof Error ? error.message : String(error))}`;
@@ -137,7 +136,7 @@ function previewTerminal(url, target, startShare) {
     }
     if (share) {
       share.then((active) => active.close()).catch((error) => {
-        console.error(`  Wi-Fi share stopped: ${error instanceof Error ? error.message : error}`);
+        console.error(`  Could not stop the Tailscale share: ${error instanceof Error ? error.message : error}`);
       }).finally(() => resolveClosed());
     } else
       resolveClosed();
@@ -209,8 +208,8 @@ function previewTerminal(url, target, startShare) {
 // packages/cli/src/site/terminal.ts
 function previewTerminal2(url, target) {
   return previewTerminal(url, target, async () => {
-    const { startLanShare } = await import(new URL("../package/preview.js", import.meta.url).href);
-    return startLanShare(target);
+    const { startPreviewShare } = await import(new URL("../package/preview.js", import.meta.url).href);
+    return startPreviewShare(target);
   });
 }
 export {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kennel",
-  "version": "0.2.27",
+  "version": "0.2.29",
   "description": "Open-source pop-up previews for AI output: markdown, HTML artifacts, email, images, code, tables, notes, and calendars, from the terminal or your agent session.",
   "type": "module",
   "license": "MIT",
@@ -67,7 +67,7 @@
     "effect": "^3.19.7",
     "esbuild": "^0.27.0",
     "kennel-mcp": "https://registry.npmjs.org/%40raggle-ai%2fkennel-mcp/-/kennel-mcp-0.1.8.tgz",
-    "kennel-plugins": "0.1.11",
+    "kennel-plugins": "0.1.12",
     "koffi": "^3.3.1",
     "lucide-react": "^0.562.0",
     "radix-ui": "^1.6.7",

package/web/assets/{abnfDiagram-VRR7QNED-CIyEzNaJ.js → abnfDiagram-VRR7QNED-Bn80ZKWr.js}

@@ -1 +1 @@
-import{g as p,r as u,d as a}from"./chunk-MOJQB5TN-BSlB5ICN.js";import{p as f}from"./chunk-JWPE2WC7-DotlQGla.js";import{_ as n,l as o}from"./mermaid.core-BIJiZKob.js";import{b as c,M as d}from"./cynefin-VYW2F7L2-D-wd85t1.js";import"./index-DmJQJIC1.js";import"./react-DELVxLrX.js";import"./markdown-BP-54rPU.js";import"./tanstack-CRaSxWtK.js";var v=c().RailroadAbnf.parser.LangiumParser,i=n(e=>{const r=e.alternatives.map(g);return r.length===1?r[0]:{type:"choice",alternatives:r}},"transformAlternation"),g=n(e=>{const r=e.elements.map(y);return r.length===1?r[0]:{type:"sequence",elements:r}},"transformConcatenation"),b=n(e=>{if(e.includes("*")){const[t,s]=e.split("*"),m=t?parseInt(t,10):0,l=s?parseInt(s,10):1/0;return{min:m,max:l}}const r=parseInt(e,10);return{min:r,max:r}},"parseRepeat"),y=n(e=>{const r=A(e.primary);if(!e.repeat)return r;const{min:t,max:s}=b(e.repeat);return t===0&&s===1?{type:"optional",element:r}:{type:"repetition",element:r,min:t,max:s}},"transformElement"),A=n(e=>{switch(e.$type){case"AbnfStringLiteral":return{type:"terminal",value:e.value};case"AbnfNumVal":return{type:"terminal",value:e.value};case"AbnfRuleName":return{type:"nonterminal",name:e.name};case"AbnfGroup":return i(e.element);case"AbnfOptionalGroup":return{type:"optional",element:i(e.element)};default:throw new Error(`Unsupported ABNF primary node: ${e.$type}`)}},"transformPrimary"),P=n(e=>({name:e.name,definition:i(e.definition)}),"transformRule"),h=n(e=>{f(e,a),e.title&&a.setTitle(e.title),e.rules.map(r=>a.addRule(P(r)))},"populateDb"),R={parse:n(e=>{a.clear(),o.debug("[ABNF Parser] Starting Langium parse");const r=v.parse(e);if(r.lexerErrors.length>0||r.parserErrors.length>0)throw new d(r);const t=r.value;o.debug("[ABNF Parser] Parsed rules:",t.rules.length),h(t),o.debug("[ABNF Parser] Parse complete")},"parse"),parser:{yy:a}},C={parser:R,db:a,renderer:u,styles:p};export{C as diagram};
+import{g as p,r as u,d as a}from"./chunk-MOJQB5TN-NHmi6U-6.js";import{p as f}from"./chunk-JWPE2WC7-CB7J3YAt.js";import{_ as n,l as o}from"./mermaid.core-C_STxONh.js";import{b as c,M as d}from"./cynefin-VYW2F7L2-DRgOkHBE.js";import"./index-CSVH3QUs.js";import"./react-DELVxLrX.js";import"./markdown-BP-54rPU.js";import"./tanstack-CRaSxWtK.js";var v=c().RailroadAbnf.parser.LangiumParser,i=n(e=>{const r=e.alternatives.map(g);return r.length===1?r[0]:{type:"choice",alternatives:r}},"transformAlternation"),g=n(e=>{const r=e.elements.map(y);return r.length===1?r[0]:{type:"sequence",elements:r}},"transformConcatenation"),b=n(e=>{if(e.includes("*")){const[t,s]=e.split("*"),m=t?parseInt(t,10):0,l=s?parseInt(s,10):1/0;return{min:m,max:l}}const r=parseInt(e,10);return{min:r,max:r}},"parseRepeat"),y=n(e=>{const r=A(e.primary);if(!e.repeat)return r;const{min:t,max:s}=b(e.repeat);return t===0&&s===1?{type:"optional",element:r}:{type:"repetition",element:r,min:t,max:s}},"transformElement"),A=n(e=>{switch(e.$type){case"AbnfStringLiteral":return{type:"terminal",value:e.value};case"AbnfNumVal":return{type:"terminal",value:e.value};case"AbnfRuleName":return{type:"nonterminal",name:e.name};case"AbnfGroup":return i(e.element);case"AbnfOptionalGroup":return{type:"optional",element:i(e.element)};default:throw new Error(`Unsupported ABNF primary node: ${e.$type}`)}},"transformPrimary"),P=n(e=>({name:e.name,definition:i(e.definition)}),"transformRule"),h=n(e=>{f(e,a),e.title&&a.setTitle(e.title),e.rules.map(r=>a.addRule(P(r)))},"populateDb"),R={parse:n(e=>{a.clear(),o.debug("[ABNF Parser] Starting Langium parse");const r=v.parse(e);if(r.lexerErrors.length>0||r.parserErrors.length>0)throw new d(r);const t=r.value;o.debug("[ABNF Parser] Parsed rules:",t.rules.length),h(t),o.debug("[ABNF Parser] Parse complete")},"parse"),parser:{yy:a}},C={parser:R,db:a,renderer:u,styles:p};export{C as diagram};