vibelet 1.2.183 → 1.2.185

package/README.md

@@ -40,6 +40,10 @@ vibelet --help       # Show help
 vibelet --version    # Show CLI version
 ```
 
+The printed `Web UI` link uses `http://localhost:<port>` for a stable, browser-trusted
+same-machine connection. When another advertised route is available, the CLI also
+prints `Web UI (other devices)` for LAN or remote browsers.
+
 ## Options
 
 ```bash
@@ -49,6 +53,8 @@ vibelet --access=https://<your-tunnel-url>   # Use your own tunnel URL
 vibelet --access=<tailscale-or-lan-host>     # Use a direct private-network host
 vibelet --access=<host>,<fallback1>          # Add fallback private-network hosts
 vibelet --access=                            # Clear saved relay URL
+vibelet --tailcat                            # Enable account-free Tailcat direct access
+vibelet --no-tailcat                         # Disable previously enabled Tailcat access
 ```
 
 Remote access is enabled by default for `vibelet`, `vibelet start`, `vibelet restart`, and `vibelet reset`. Use `--access=local` when you want a LAN-only QR code for that run. Legacy aliases still work: `--local`, `--relay`, `--host`, `--fallback-hosts`, `--remote`, and `--tunnel`.
@@ -61,6 +67,38 @@ modified. Versions older than 2026.5.2 temporarily stay on HTTP/2 because their
 automatic QUIC fallback can delay tunnel readiness for minutes. Update metadata
 is stored in `~/.vibelet/cloudflared-update.json`.
 
+## Tailcat direct access
+
+Tailcat gives Vibelet a userspace, end-to-end WireGuard-encrypted connection
+without requiring a Tailscale account, root/admin access, an inbound port, or
+changes to the computer's VPN, DNS, and routes. Enable it on the computer:
+
+```bash
+npx vibelet --tailcat
+```
+
+Then scan the newly printed QR code with a Vibelet app build that includes
+Tailcat support. The app races the eligible connection paths and uses the first
+healthy one. Tailcat bootstraps through DERP and upgrades to a direct P2P UDP
+path when NAT traversal succeeds; if it cannot become direct, DERP can remain
+the encrypted relay. LAN, Tailscale, and Cloudflare targets stay available as
+Vibelet fallbacks.
+
+The `--tailcat` choice is stored in `~/.vibelet/tailcat.json` and reused by
+later starts and restarts. Turn it off with:
+
+```bash
+npx vibelet --no-tailcat
+```
+
+Seeing `127.0.0.1:39876` in the mobile app is expected: it is the app-local
+loopback forwarder, not the remote computer's address. Its upstream connection
+is the encrypted Tailcat path. Use `npx vibelet status` to check whether the
+Tailcat sidecar is enabled and running, and `npx vibelet logs` if startup fails.
+Make sure both devices can make outbound HTTPS connections; direct P2P also
+benefits from outbound UDP. Never share a pairing QR code or a raw `tc...`
+connection token publicly.
+
 ## Release
 
 ```bash