vibelet 1.2.183 → 1.2.185

package/dist/vibelet.mjs

@@ -12369,7 +12369,7 @@ function canUseSystemdUserManager({ spawnSyncImpl = node_child_process__WEBPACK_
 
 /***/ }),
 
-/***/ 636:
+/***/ 2629:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __nccwpck_require__) => {
 
 
@@ -12422,6 +12422,112 @@ var websocket_server = __nccwpck_require__(3261);
 
 /* harmony default export */ const wrapper = (websocket);
 
+;// CONCATENATED MODULE: ./bin/terminal-process-tree.mjs
+
+
+const TAKEOVER_STOP_TIMEOUT_MS = 3000;
+
+function terminal_process_tree_sendSignal(child, signal) {
+  if (!child.pid || child.exitCode !== null || child.signalCode !== null) return;
+  try {
+    process.kill(child.pid, signal);
+  } catch {
+    // Already exited.
+  }
+}
+
+function isPidAlive(pid) {
+  if (!pid) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function collectProcessTreePids(rootPid) {
+  if (!rootPid) return [];
+  let rows;
+  try {
+    rows = (0,external_node_child_process_.execFileSync)('ps', ['-axo', 'pid=,ppid='], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+    });
+  } catch {
+    return [rootPid];
+  }
+  const childrenByParent = new Map();
+  for (const line of rows.split('\n')) {
+    const [pidText, ppidText] = line.trim().split(/\s+/);
+    const pid = Number(pidText);
+    const ppid = Number(ppidText);
+    if (!Number.isFinite(pid) || !Number.isFinite(ppid)) continue;
+    const children = childrenByParent.get(ppid) ?? [];
+    children.push(pid);
+    childrenByParent.set(ppid, children);
+  }
+  const out = [];
+  const visit = (pid) => {
+    out.push(pid);
+    for (const childPid of childrenByParent.get(pid) ?? []) {
+      visit(childPid);
+    }
+  };
+  visit(rootPid);
+  return out;
+}
+
+function sendSignalToPids(pids, signal) {
+  for (const pid of [...pids].reverse()) {
+    try {
+      process.kill(pid, signal);
+    } catch {
+      // Already exited.
+    }
+  }
+}
+
+async function waitForProcessTreeExit(pids, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  while ([...pids].some(isPidAlive)) {
+    const remainingMs = deadline - Date.now();
+    if (remainingMs <= 0) return false;
+    await new Promise((resolve) => setTimeout(resolve, Math.min(remainingMs, 10)));
+  }
+  return true;
+}
+
+async function waitForExitOrTimeout(childExit, timeoutMs) {
+  let timer;
+  const timeout = new Promise((resolve) => {
+    timer = setTimeout(() => resolve(null), timeoutMs);
+  });
+  const result = await Promise.race([childExit, timeout]);
+  clearTimeout(timer);
+  return result;
+}
+
+async function stopNativeChild(
+  child,
+  childExit,
+  { interruptTimeoutMs = TAKEOVER_STOP_TIMEOUT_MS, terminateTimeoutMs = 1000, killTimeoutMs = 1000 } = {},
+) {
+  if (child.exitCode !== null || child.signalCode !== null) return true;
+  const trackedPids = new Set(collectProcessTreePids(child.pid));
+  terminal_process_tree_sendSignal(child, 'SIGINT');
+  await waitForExitOrTimeout(childExit, interruptTimeoutMs);
+  if (await waitForProcessTreeExit(trackedPids, 0)) return true;
+
+  for (const pid of collectProcessTreePids(child.pid)) trackedPids.add(pid);
+  sendSignalToPids(trackedPids, 'SIGTERM');
+  if (await waitForProcessTreeExit(trackedPids, terminateTimeoutMs)) return true;
+
+  for (const pid of collectProcessTreePids(child.pid)) trackedPids.add(pid);
+  sendSignalToPids(trackedPids, 'SIGKILL');
+  return waitForProcessTreeExit(trackedPids, killTimeoutMs);
+}
+
 ;// CONCATENATED MODULE: ./bin/terminal-wrapper.mjs
 
 
@@ -12430,10 +12536,13 @@ var websocket_server = __nccwpck_require__(3261);
 
 
 
+
+
+
 const terminalControlTokenPath = (0,external_node_path_.join)((0,external_node_os_.homedir)(), '.vibelet', 'runtime', 'terminal-control-token');
 
-const TAKEOVER_STOP_TIMEOUT_MS = 3000;
-const TAKEOVER_MODE_SETTLE_TIMEOUT_MS = TAKEOVER_STOP_TIMEOUT_MS + 2000;
+const terminal_wrapper_TAKEOVER_STOP_TIMEOUT_MS = 3000;
+const TAKEOVER_MODE_SETTLE_TIMEOUT_MS = terminal_wrapper_TAKEOVER_STOP_TIMEOUT_MS + 2000;
 const SWITCHBACK_RESTORE_NOTICE_MS = 1200;
 const SWITCHBACK_BUSY_RETRY_DELAY_MS = 750;
 const TERMINAL_CONTROL_RECONNECT_DELAY_MS = 1000;
@@ -12765,94 +12874,6 @@ function waitForChildExit(child) {
   });
 }
 
-function sendSignal(child, signal) {
-  if (!child.pid || child.exitCode !== null || child.signalCode !== null) return;
-  try {
-    process.kill(child.pid, signal);
-  } catch {
-    // Already exited.
-  }
-}
-
-function isPidAlive(pid) {
-  if (!pid) return false;
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-function collectProcessTreePids(rootPid) {
-  if (!rootPid) return [];
-  let rows;
-  try {
-    rows = (0,external_node_child_process_.execFileSync)('ps', ['-axo', 'pid=,ppid='], {
-      encoding: 'utf8',
-      stdio: ['ignore', 'pipe', 'ignore'],
-    });
-  } catch {
-    return [rootPid];
-  }
-  const childrenByParent = new Map();
-  for (const line of rows.split('\n')) {
-    const [pidText, ppidText] = line.trim().split(/\s+/);
-    const pid = Number(pidText);
-    const ppid = Number(ppidText);
-    if (!Number.isFinite(pid) || !Number.isFinite(ppid)) continue;
-    const children = childrenByParent.get(ppid) ?? [];
-    children.push(pid);
-    childrenByParent.set(ppid, children);
-  }
-  const out = [];
-  const visit = (pid) => {
-    out.push(pid);
-    for (const childPid of childrenByParent.get(pid) ?? []) {
-      visit(childPid);
-    }
-  };
-  visit(rootPid);
-  return out;
-}
-
-function sendSignalToProcessTree(child, signal) {
-  if (!child.pid || child.exitCode !== null || child.signalCode !== null) return;
-  const pids = collectProcessTreePids(child.pid);
-  for (const pid of pids.reverse()) {
-    try {
-      process.kill(pid, signal);
-    } catch {
-      // Already exited.
-    }
-  }
-}
-
-async function waitForExitOrTimeout(childExit, timeoutMs) {
-  let timer;
-  const timeout = new Promise((resolve) => {
-    timer = setTimeout(() => resolve(null), timeoutMs);
-  });
-  const result = await Promise.race([childExit, timeout]);
-  clearTimeout(timer);
-  return result;
-}
-
-async function stopNativeChild(
-  child,
-  childExit,
-  { interruptTimeoutMs = TAKEOVER_STOP_TIMEOUT_MS, terminateTimeoutMs = 1000, killTimeoutMs = 1000 } = {},
-) {
-  if (child.exitCode !== null || child.signalCode !== null) return true;
-  sendSignal(child, 'SIGINT');
-  if (await waitForExitOrTimeout(childExit, interruptTimeoutMs)) return true;
-  sendSignalToProcessTree(child, 'SIGTERM');
-  if (await waitForExitOrTimeout(childExit, terminateTimeoutMs)) return true;
-  sendSignalToProcessTree(child, 'SIGKILL');
-  if (await waitForExitOrTimeout(childExit, killTimeoutMs)) return true;
-  return !isPidAlive(child.pid);
-}
-
 function waitMs(ms) {
   return new Promise((resolve) => {
     setTimeout(resolve, ms);
@@ -14083,6 +14104,72 @@ async function tryUpdateRunningDaemonRelay({
 }
 
 
+/***/ }),
+
+/***/ 4162:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __nccwpck_require__) => {
+
+/* harmony export */ __nccwpck_require__.d(__webpack_exports__, {
+/* harmony export */   n: () => (/* binding */ printCliHelp)
+/* harmony export */ });
+function printCliHelp({ packageJson, port }) {
+  process.stdout.write(`Vibelet ${packageJson.version}\n\n`);
+  process.stdout.write(`Package names:\n`);
+  process.stdout.write(`  @vibelet/cli\n`);
+  process.stdout.write(`  vibelet\n\n`);
+  process.stdout.write(`Usage:\n`);
+  process.stdout.write(
+    `  npx ${packageJson.name}           Install/start the daemon, auto-enable remote access, and print a pairing QR code\n`,
+  );
+  process.stdout.write(`  npx ${packageJson.name} start     Same as above\n`);
+  process.stdout.write(
+    `  npx ${packageJson.name} --access=local   Use LAN/local pairing only; skip Cloudflare and Tailscale\n`,
+  );
+  process.stdout.write(`  npx ${packageJson.name} --access=remote --force  Force a new Cloudflare Tunnel URL\n`);
+  process.stdout.write(`  npx ${packageJson.name} --access=https://<url>  Use a custom tunnel URL for remote access\n`);
+  process.stdout.write(`  npx ${packageJson.name} --access=<host>  Set the primary LAN/Tailscale host/IP address\n`);
+  process.stdout.write(
+    `  npx ${packageJson.name} --tailcat  Enable userspace Tailcat direct access (keeps existing fallbacks)\n`,
+  );
+  process.stdout.write(`  npx ${packageJson.name} --no-tailcat  Disable previously enabled Tailcat access\n`);
+  process.stdout.write(`  npx ${packageJson.name} --port <port>  Start or query the daemon on a custom port\n`);
+  process.stdout.write(
+    `  npx ${packageJson.name} --claude-driver tui  Drive the interactive Claude TUI (subscription) instead of \`claude -p\`\n`,
+  );
+  process.stdout.write(`  npx ${packageJson.name} --access=<host>,<fallbacks>  Set fallback LAN/Tailscale hosts\n`);
+  process.stdout.write(`  npx ${packageJson.name} stop      Stop the daemon\n`);
+  process.stdout.write(`  npx ${packageJson.name} restart   Restart the daemon\n`);
+  process.stdout.write(`  npx ${packageJson.name} status    Show service and daemon status\n`);
+  process.stdout.write(`  npx ${packageJson.name} logs      Print recent daemon logs\n`);
+  process.stdout.write(`  npx ${packageJson.name} reset     Reset pairings and print a fresh QR code\n`);
+  process.stdout.write(`  npx ${packageJson.name} claude [...args]  Start Claude Code with Vibelet App takeover\n`);
+  process.stdout.write(`  npx ${packageJson.name} codex [...args]   Start Codex with Vibelet App takeover\n`);
+  process.stdout.write(`  npx ${packageJson.name} --help    Show this help text\n`);
+  process.stdout.write(`  npx ${packageJson.name} --version Show the installed CLI version\n`);
+  process.stdout.write(`\n`);
+  process.stdout.write(`You can also invoke the published alias with:\n`);
+  process.stdout.write(`  npx ${packageJson.name === 'vibelet' ? '@vibelet/cli' : 'vibelet'}\n`);
+  process.stdout.write(`  vibelet\n\n`);
+  process.stdout.write(`Remote access:\n`);
+  process.stdout.write(`  # Remote access is on by default for start/reset/restart\n`);
+  process.stdout.write(`  npx ${packageJson.name}\n\n`);
+  process.stdout.write(`  # Want LAN/local-only pairing for this run?\n`);
+  process.stdout.write(`  npx ${packageJson.name} --access=local\n\n`);
+  process.stdout.write(`  # Need a fresh Cloudflare Tunnel URL?\n`);
+  process.stdout.write(`  npx ${packageJson.name} --access=remote --force\n\n`);
+  process.stdout.write(`  # Or bring your own tunnel and pass the URL manually:\n`);
+  process.stdout.write(`  npx cloudflared tunnel --protocol auto --url http://localhost:${port}\n`);
+  process.stdout.write(`  ngrok http ${port}\n`);
+  process.stdout.write(`  npx ${packageJson.name} --access=https://<your-tunnel-url>\n\n`);
+  process.stdout.write(`  # Tailscale (P2P VPN, no tunnel needed)\n`);
+  process.stdout.write(`  npx ${packageJson.name} --access=<tailscale-ip>\n\n`);
+  process.stdout.write(`\nTailcat direct access:\n`);
+  process.stdout.write(`  npx ${packageJson.name} --tailcat\n`);
+  process.stdout.write(`  # Tailcat runs inside Vibelet and does not change system VPN, DNS, or routes.\n\n`);
+  process.stdout.write(`Legacy aliases still work: --local, --relay, --host, --fallback-hosts, --remote, --tunnel.\n`);
+}
+
+
 /***/ }),
 
 /***/ 1010:
@@ -14286,21 +14373,40 @@ function normalizePairingConnections(pairingPayload) {
             typeof target.source === 'string' &&
             typeof target.stability === 'string',
         )
-        .map((target) => ({
-          kind: target.kind === 'relay' ? 'relay' : 'direct',
-          host: normalizeHostValue(target.host),
-          port: Math.floor(Number(target.port)),
-          ...(target.secure === true ? { secure: true } : {}),
-          source: target.source,
-          stability: target.stability,
-        }))
+        .map((target) => {
+          const tailcat =
+            target.tailcat &&
+            typeof target.tailcat.serverAddress === 'string' &&
+            target.tailcat.serverAddress.startsWith('tc') &&
+            target.tailcat.serverAddress.length <= 4096 &&
+            Number.isInteger(target.tailcat.remotePort) &&
+            target.tailcat.remotePort > 0 &&
+            target.tailcat.remotePort <= 65535
+              ? {
+                  serverAddress: target.tailcat.serverAddress,
+                  remotePort: target.tailcat.remotePort,
+                }
+              : null;
+          return {
+            kind: target.kind === 'relay' ? 'relay' : 'direct',
+            host: normalizeHostValue(target.host),
+            port: Math.floor(Number(target.port)),
+            ...(target.secure === true ? { secure: true } : {}),
+            source: target.source,
+            stability: target.stability,
+            ...(tailcat ? { tailcat } : {}),
+          };
+        })
         .filter((target) => target.host && target.port > 0)
     : [];
 
   const dedupe = (targets) => {
     const seen = new Set();
     return targets.filter((target) => {
-      const key = `${target.host}:${target.port}:${target.secure === true ? 'secure' : 'plain'}`;
+      const key =
+        target.source === 'tailcat' && target.tailcat
+          ? `tailcat:${target.tailcat.remotePort}`
+          : `${target.host}:${target.port}:${target.secure === true ? 'secure' : 'plain'}`;
       if (seen.has(key)) {
         return false;
       }
@@ -14400,14 +14506,13 @@ function createCompactPairingPayload(pairingPayload) {
   };
   if (pairingPayload.fallbackHosts) compactPayload.f = pairingPayload.fallbackHosts;
   if (connections.length > 0) {
-    compactPayload.o = connections.map((target) => [
-      target.kind,
-      target.host,
-      target.port,
-      target.source,
-      target.stability,
-      target.secure === true,
-    ]);
+    compactPayload.o = connections.map((target) => {
+      const tuple = [target.kind, target.host, target.port, target.source, target.stability, target.secure === true];
+      if (target.tailcat) {
+        tuple.push(target.tailcat.serverAddress, target.tailcat.remotePort);
+      }
+      return tuple;
+    });
   }
   return compactPayload;
 }
@@ -14422,6 +14527,8 @@ function formatConnectionSourceLabel(source) {
       return 'Manual Host';
     case 'tailscale':
       return 'Tailscale';
+    case 'tailcat':
+      return 'Tailcat Direct';
     case 'local_network':
       return 'LAN';
     case 'fallback':
@@ -14490,6 +14597,7 @@ function buildWebUiUrl(target, pairingPayload) {
 /* harmony export */   Ne: () => (/* binding */ shouldRefuseRuntimeDowngrade),
 /* harmony export */   Pg: () => (/* binding */ shouldRetireManagedQuickTunnel),
 /* harmony export */   ZN: () => (/* binding */ shouldReuseHealthyDaemon),
+/* harmony export */   Zg: () => (/* binding */ isTailcatConfigurationMismatch),
 /* harmony export */   gm: () => (/* binding */ shouldManageQuickTunnel),
 /* harmony export */   iX: () => (/* binding */ doesHealthSupportTerminalControl),
 /* harmony export */   nW: () => (/* binding */ doesHealthMatchRequestedConnectionConfig)
@@ -14535,6 +14643,12 @@ function shouldReuseHealthyDaemon({
   return !hasExplicitConfigOverrides || canApplyConnectionConfigWithoutRestart;
 }
 
+function isTailcatConfigurationMismatch({ health, tailcatEnabled }) {
+  if (!health) return false;
+  const reportedEnabled = health?.tailcat?.enabled;
+  return typeof reportedEnabled === 'boolean' ? reportedEnabled !== tailcatEnabled : tailcatEnabled;
+}
+
 function doesHealthSupportTerminalControl(health) {
   if (!health || typeof health !== 'object') return false;
   const terminals = health.terminals;
@@ -14633,9 +14747,15 @@ function doesHealthMatchRequestedConnectionConfig({
   canonicalHost = '',
   fallbackHosts = '',
   localMode = false,
+  tailcatEnabled,
 }) {
   if (!health) return false;
 
+  if (typeof tailcatEnabled === 'boolean') {
+    const runningTailcatEnabled = health.tailcat?.enabled === true;
+    if (runningTailcatEnabled !== tailcatEnabled) return false;
+  }
+
   const currentRelayUrl = typeof health.relayUrl === 'string' ? health.relayUrl : '';
   if (relayUrl) {
     return currentRelayUrl === relayUrl;
@@ -14696,6 +14816,34 @@ async function stopDaemonWithHooks({
 }
 
 
+/***/ }),
+
+/***/ 5798:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __nccwpck_require__) => {
+
+/* harmony export */ __nccwpck_require__.d(__webpack_exports__, {
+/* harmony export */   S: () => (/* binding */ createTailcatConfigStore)
+/* harmony export */ });
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __nccwpck_require__(3024);
+
+
+function createTailcatConfigStore(configPath, dataDirectory) {
+  return {
+    load() {
+      try {
+        return JSON.parse((0,node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync)(configPath, 'utf8')).enabled === true;
+      } catch {
+        return false;
+      }
+    },
+    save(enabled) {
+      (0,node_fs__WEBPACK_IMPORTED_MODULE_0__.mkdirSync)(dataDirectory, { recursive: true });
+      (0,node_fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync)(configPath, `${JSON.stringify({ enabled }, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
+    },
+  };
+}
+
+
 /***/ }),
 
 /***/ 4566:
@@ -14709,15 +14857,19 @@ __nccwpck_require__.a(__webpack_module__, async (__webpack_handle_async_dependen
 /* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_4__ = __nccwpck_require__(6760);
 /* harmony import */ var node_url__WEBPACK_IMPORTED_MODULE_5__ = __nccwpck_require__(3136);
 /* harmony import */ var qrcode__WEBPACK_IMPORTED_MODULE_6__ = __nccwpck_require__(7514);
-/* harmony import */ var _vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_15__ = __nccwpck_require__(6927);
+/* harmony import */ var _vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_17__ = __nccwpck_require__(6927);
 /* harmony import */ var _cloudflared_tunnel_manager_mjs__WEBPACK_IMPORTED_MODULE_7__ = __nccwpck_require__(2755);
 /* harmony import */ var _vibelet_cloudflare_runtime_mjs__WEBPACK_IMPORTED_MODULE_8__ = __nccwpck_require__(3869);
-/* harmony import */ var _vibelet_launchd_mjs__WEBPACK_IMPORTED_MODULE_12__ = __nccwpck_require__(1010);
+/* harmony import */ var _vibelet_launchd_mjs__WEBPACK_IMPORTED_MODULE_13__ = __nccwpck_require__(1010);
 /* harmony import */ var _linux_systemd_mjs__WEBPACK_IMPORTED_MODULE_9__ = __nccwpck_require__(4217);
-/* harmony import */ var _vibelet_stop_logic_mjs__WEBPACK_IMPORTED_MODULE_13__ = __nccwpck_require__(6274);
-/* harmony import */ var _vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_11__ = __nccwpck_require__(4);
-/* harmony import */ var _terminal_wrapper_mjs__WEBPACK_IMPORTED_MODULE_10__ = __nccwpck_require__(636);
-/* harmony import */ var _vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_14__ = __nccwpck_require__(7721);
+/* harmony import */ var _vibelet_stop_logic_mjs__WEBPACK_IMPORTED_MODULE_14__ = __nccwpck_require__(6274);
+/* harmony import */ var _vibelet_help_mjs__WEBPACK_IMPORTED_MODULE_16__ = __nccwpck_require__(4162);
+/* harmony import */ var _vibelet_tailcat_config_mjs__WEBPACK_IMPORTED_MODULE_10__ = __nccwpck_require__(5798);
+/* harmony import */ var _vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_12__ = __nccwpck_require__(4);
+/* harmony import */ var _terminal_wrapper_mjs__WEBPACK_IMPORTED_MODULE_11__ = __nccwpck_require__(2629);
+/* harmony import */ var _vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_15__ = __nccwpck_require__(7721);
+
+
 
 
 
@@ -14750,11 +14902,12 @@ const runtimeDir = (0,node_path__WEBPACK_IMPORTED_MODULE_4__.join)(vibeletDir, '
 const runtimeCurrentDir = (0,node_path__WEBPACK_IMPORTED_MODULE_4__.join)(runtimeDir, 'current');
 const runtimeMetadataPath = (0,node_path__WEBPACK_IMPORTED_MODULE_4__.join)(runtimeCurrentDir, 'runtime.json');
 const runtimeDaemonEntryPath = (0,node_path__WEBPACK_IMPORTED_MODULE_4__.join)(runtimeCurrentDir, 'dist', 'index.cjs');
-const runtimeTerminalControlTokenPath = _terminal_wrapper_mjs__WEBPACK_IMPORTED_MODULE_10__/* .terminalControlTokenPath */ .gJ;
+const runtimeTerminalControlTokenPath = _terminal_wrapper_mjs__WEBPACK_IMPORTED_MODULE_11__/* .terminalControlTokenPath */ .gJ;
 const stdoutLogPath = (0,node_path__WEBPACK_IMPORTED_MODULE_4__.join)(logDir, 'daemon.stdout.log');
 const stderrLogPath = (0,node_path__WEBPACK_IMPORTED_MODULE_4__.join)(logDir, 'daemon.stderr.log');
 const pidFilePath = (0,node_path__WEBPACK_IMPORTED_MODULE_4__.join)(vibeletDir, 'daemon.pid');
 const relayConfig = (0,_vibelet_cloudflare_runtime_mjs__WEBPACK_IMPORTED_MODULE_8__/* .createRelayConfigStore */ .T7)((0,node_path__WEBPACK_IMPORTED_MODULE_4__.join)(vibeletDir, 'relay.json'));
+const tailcatConfig = (0,_vibelet_tailcat_config_mjs__WEBPACK_IMPORTED_MODULE_10__/* .createTailcatConfigStore */ .S)((0,node_path__WEBPACK_IMPORTED_MODULE_4__.join)(vibeletDir, 'tailcat.json'), vibeletDir);
 const tunnelStatePath = (0,node_path__WEBPACK_IMPORTED_MODULE_4__.join)(vibeletDir, 'tunnel.json');
 const cloudflaredUpdateStatePath = (0,node_path__WEBPACK_IMPORTED_MODULE_4__.join)(vibeletDir, 'cloudflared-update.json');
 const updateCheckPath = (0,node_path__WEBPACK_IMPORTED_MODULE_4__.join)(vibeletDir, 'update-check.json');
@@ -14907,7 +15060,7 @@ function ensureRuntimeInstalled() {
   const runtimeMetadata = readRuntimeMetadata();
 
   if (
-    (0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_11__/* .shouldRefuseRuntimeDowngrade */ .Ne)({
+    (0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_12__/* .shouldRefuseRuntimeDowngrade */ .Ne)({
       cliVersion: packageJson.version,
       runtimeVersion: runtimeMetadata?.version,
       runtimeEntryExists: (0,node_fs__WEBPACK_IMPORTED_MODULE_1__.existsSync)(runtimeDaemonEntryPath),
@@ -15111,7 +15264,7 @@ function createDarwinBackend() {
   }
 
   function bootoutService() {
-    return (0,_vibelet_launchd_mjs__WEBPACK_IMPORTED_MODULE_12__/* .bootoutLaunchdService */ .B)({
+    return (0,_vibelet_launchd_mjs__WEBPACK_IMPORTED_MODULE_13__/* .bootoutLaunchdService */ .B)({
       launchctl,
       launchDomain,
       label,
@@ -15136,6 +15289,7 @@ function createDarwinBackend() {
     if (process.env.VIBELET_CANONICAL_HOST) envVars.VIBELET_CANONICAL_HOST = process.env.VIBELET_CANONICAL_HOST;
     if (process.env.VIBELET_FALLBACK_HOSTS) envVars.VIBELET_FALLBACK_HOSTS = process.env.VIBELET_FALLBACK_HOSTS;
     if (process.env.VIBELET_LOCAL_ONLY) envVars.VIBELET_LOCAL_ONLY = process.env.VIBELET_LOCAL_ONLY;
+    if (process.env.VIBELET_TAILCAT) envVars.VIBELET_TAILCAT = process.env.VIBELET_TAILCAT;
     if (process.env.VIBE_CLAUDE_DRIVER) envVars.VIBE_CLAUDE_DRIVER = process.env.VIBE_CLAUDE_DRIVER;
     if (process.env.CODEX_PATH) envVars.CODEX_PATH = process.env.CODEX_PATH;
     if (process.env.CLAUDE_PATH) envVars.CLAUDE_PATH = process.env.CLAUDE_PATH;
@@ -15200,7 +15354,7 @@ ${envSection}
         if (result.status !== 0) {
           fail(
             'Failed to bootstrap vibelet launch agent.',
-            [(0,_vibelet_launchd_mjs__WEBPACK_IMPORTED_MODULE_12__/* .describeLaunchctlResult */ .N)(bootoutResult.result), (0,_vibelet_launchd_mjs__WEBPACK_IMPORTED_MODULE_12__/* .describeLaunchctlResult */ .N)(result)].filter(Boolean).join('\n'),
+            [(0,_vibelet_launchd_mjs__WEBPACK_IMPORTED_MODULE_13__/* .describeLaunchctlResult */ .N)(bootoutResult.result), (0,_vibelet_launchd_mjs__WEBPACK_IMPORTED_MODULE_13__/* .describeLaunchctlResult */ .N)(result)].filter(Boolean).join('\n'),
           );
         }
       }
@@ -15216,7 +15370,7 @@ ${envSection}
     stop() {
       const bootoutResult = bootoutService();
       if (!bootoutResult.ok) {
-        fail('Failed to unload vibelet launch agent.', (0,_vibelet_launchd_mjs__WEBPACK_IMPORTED_MODULE_12__/* .describeLaunchctlResult */ .N)(bootoutResult.result));
+        fail('Failed to unload vibelet launch agent.', (0,_vibelet_launchd_mjs__WEBPACK_IMPORTED_MODULE_13__/* .describeLaunchctlResult */ .N)(bootoutResult.result));
       }
       // bootout returns before launchd actually finishes unloading. Poll
       // until the service is gone so a follow-up install() doesn't see a
@@ -15272,7 +15426,7 @@ RestartSec=3
 StandardOutput=append:${stdoutLogPath}
 StandardError=append:${stderrLogPath}
 Environment=PATH=${servicePath}
-Environment=VIBE_PORT=${port}${process.env.VIBELET_RELAY_URL ? `\nEnvironment=VIBELET_RELAY_URL=${process.env.VIBELET_RELAY_URL}` : ''}${process.env.VIBELET_CANONICAL_HOST ? `\nEnvironment=VIBELET_CANONICAL_HOST=${process.env.VIBELET_CANONICAL_HOST}` : ''}${process.env.VIBELET_FALLBACK_HOSTS ? `\nEnvironment=VIBELET_FALLBACK_HOSTS=${process.env.VIBELET_FALLBACK_HOSTS}` : ''}${process.env.VIBELET_LOCAL_ONLY ? `\nEnvironment=VIBELET_LOCAL_ONLY=${process.env.VIBELET_LOCAL_ONLY}` : ''}${process.env.VIBE_CLAUDE_DRIVER ? `\nEnvironment=VIBE_CLAUDE_DRIVER=${process.env.VIBE_CLAUDE_DRIVER}` : ''}${process.env.CODEX_PATH ? `\nEnvironment=CODEX_PATH=${process.env.CODEX_PATH}` : ''}${process.env.CLAUDE_PATH ? `\nEnvironment=CLAUDE_PATH=${process.env.CLAUDE_PATH}` : ''}
+Environment=VIBE_PORT=${port}${process.env.VIBELET_RELAY_URL ? `\nEnvironment=VIBELET_RELAY_URL=${process.env.VIBELET_RELAY_URL}` : ''}${process.env.VIBELET_CANONICAL_HOST ? `\nEnvironment=VIBELET_CANONICAL_HOST=${process.env.VIBELET_CANONICAL_HOST}` : ''}${process.env.VIBELET_FALLBACK_HOSTS ? `\nEnvironment=VIBELET_FALLBACK_HOSTS=${process.env.VIBELET_FALLBACK_HOSTS}` : ''}${process.env.VIBELET_LOCAL_ONLY ? `\nEnvironment=VIBELET_LOCAL_ONLY=${process.env.VIBELET_LOCAL_ONLY}` : ''}${process.env.VIBELET_TAILCAT ? `\nEnvironment=VIBELET_TAILCAT=${process.env.VIBELET_TAILCAT}` : ''}${process.env.VIBE_CLAUDE_DRIVER ? `\nEnvironment=VIBE_CLAUDE_DRIVER=${process.env.VIBE_CLAUDE_DRIVER}` : ''}${process.env.CODEX_PATH ? `\nEnvironment=CODEX_PATH=${process.env.CODEX_PATH}` : ''}${process.env.CLAUDE_PATH ? `\nEnvironment=CLAUDE_PATH=${process.env.CLAUDE_PATH}` : ''}
 
 [Install]
 WantedBy=default.target
@@ -15539,8 +15693,7 @@ async function requestShutdown() {
       signal: AbortSignal.timeout(2000),
     });
   } catch {
-    // Request timed out or connection refused — daemon may be deadlocked or
-    // already gone. Either way, fall through to polling for actual exit.
+    // A timeout or refusal means the daemon may be deadlocked or gone; poll for its actual exit.
   }
   return waitForDaemonExit(5_000);
 }
@@ -15560,7 +15713,7 @@ function retireTrackedQuickTunnel({ required = false } = {}) {
 
 async function stopRunningDaemon(backend) {
   try {
-    await (0,_vibelet_stop_logic_mjs__WEBPACK_IMPORTED_MODULE_13__/* .stopDaemonWithHooks */ .v)({
+    await (0,_vibelet_stop_logic_mjs__WEBPACK_IMPORTED_MODULE_14__/* .stopDaemonWithHooks */ .v)({
       requestShutdown,
       backendStop: () => backend.stop(),
       waitForDaemonExit,
@@ -15573,15 +15726,13 @@ async function stopRunningDaemon(backend) {
 async function ensureDaemonForTerminalControl(backend) {
   const healthyDaemon = await probeHealth(1_500);
   const tokenReady = (0,node_fs__WEBPACK_IMPORTED_MODULE_1__.existsSync)(runtimeTerminalControlTokenPath);
-  const terminalControlReady = healthyDaemon && tokenReady && (0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_11__/* .doesHealthSupportTerminalControl */ .iX)(healthyDaemon);
-  if (terminalControlReady) {
-    return healthyDaemon;
-  }
+  const terminalControlReady = healthyDaemon && tokenReady && (0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_12__/* .doesHealthSupportTerminalControl */ .iX)(healthyDaemon);
+  if (terminalControlReady) return healthyDaemon;
 
   if (healthyDaemon && !terminalControlReady) {
     const activeSessions = typeof healthyDaemon.activeSessions === 'number' ? healthyDaemon.activeSessions : 0;
     if (activeSessions > 0) {
-      const reason = (0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_11__/* .doesHealthSupportTerminalControl */ .iX)(healthyDaemon)
+      const reason = (0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_12__/* .doesHealthSupportTerminalControl */ .iX)(healthyDaemon)
         ? 'terminal-control token is missing'
         : 'the running daemon does not advertise terminal-control support';
       process.stderr.write(
@@ -15600,24 +15751,19 @@ async function ensureDaemonForTerminalControl(backend) {
 }
 
 function validateExplicitCleartextHosts({ hostArg, fallbackHostsArg }) {
-  const unsafeHosts = (0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_14__/* .findUnsafeCleartextHosts */ .dE)({ hostArg, fallbackHostsArg });
-  if (unsafeHosts.length === 0) {
-    return;
-  }
-  fail(
-    `Refusing public cleartext host ${unsafeHosts[0]}. Use --access=https://..., a Tailscale host, or a LAN/local address.`,
-  );
+  const [unsafeHost] = (0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_15__/* .findUnsafeCleartextHosts */ .dE)({ hostArg, fallbackHostsArg });
+  if (unsafeHost) fail(`Refusing public cleartext host ${unsafeHost}. Use HTTPS, Tailscale, LAN, or local access.`);
 }
 
 async function printPairingQr(pairingPayload) {
-  const payload = JSON.stringify((0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_14__/* .createCompactPairingPayload */ .YP)(pairingPayload));
-  const deepLink = (0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_14__/* .buildPairingDeepLink */ .N7)(payload);
+  const payload = JSON.stringify((0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_15__/* .createCompactPairingPayload */ .YP)(pairingPayload));
+  const deepLink = (0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_15__/* .buildPairingDeepLink */ .N7)(payload);
   (0,node_fs__WEBPACK_IMPORTED_MODULE_1__.mkdirSync)(vibeletDir, { recursive: true });
   await qrcode__WEBPACK_IMPORTED_MODULE_6__.toFile(pairingQrPngPath, payload, {
     type: 'png',
     errorCorrectionLevel: 'M',
     margin: 1,
-    scale: 8,
+    scale: 4,
   });
   const qr = await qrcode__WEBPACK_IMPORTED_MODULE_6__.toString(payload, {
     type: 'terminal',
@@ -15640,10 +15786,11 @@ async function printPairingSummary(existingHealth = null, { relayUrlOverride = n
   const pairingPayload =
     relayUrlOverride === null
       ? daemonPairingPayload
-      : (0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_14__/* .applyRelayUrlToPairingPayload */ .mp)(daemonPairingPayload, relayUrlOverride);
-  const connections = (0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_14__/* .normalizePairingConnections */ .No)(pairingPayload);
+      : (0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_15__/* .applyRelayUrlToPairingPayload */ .mp)(daemonPairingPayload, relayUrlOverride);
+  const connections = (0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_15__/* .normalizePairingConnections */ .No)(pairingPayload);
   const [preferredConnection, ...otherConnections] = connections;
-  const webUiConnection = (0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_14__/* .selectWebUiConnectionTarget */ .SF)(connections);
+  const webUiConnection = (0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_15__/* .selectWebUiConnectionTarget */ .SF)(connections);
+  const compactPairingPayload = (0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_15__/* .createCompactPairingPayload */ .YP)(pairingPayload);
 
   process.stdout.write(`Vibelet daemon is ready.\n\n`);
   process.stdout.write(`Device: ${health.displayName}\n`);
@@ -15651,73 +15798,26 @@ async function printPairingSummary(existingHealth = null, { relayUrlOverride = n
   process.stdout.write(`Host: ${pairingPayload.canonicalHost}\n`);
   process.stdout.write(`Port: ${pairingPayload.port}\n`);
   if (preferredConnection) {
-    process.stdout.write(`Preferred path: ${(0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_14__/* .formatConnectionSummary */ .uR)(preferredConnection)}\n`);
+    process.stdout.write(`Preferred path: ${(0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_15__/* .formatConnectionSummary */ .uR)(preferredConnection)}\n`);
   }
   if (otherConnections.length > 0) {
     process.stdout.write(`Other paths:\n`);
     otherConnections.forEach((target) => {
-      process.stdout.write(`  - ${(0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_14__/* .formatConnectionSummary */ .uR)(target)}\n`);
+      process.stdout.write(`  - ${(0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_15__/* .formatConnectionSummary */ .uR)(target)}\n`);
     });
   }
-  if (webUiConnection) {
-    process.stdout.write(`Web UI: ${(0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_14__/* .buildWebUiUrl */ .Gv)(webUiConnection, (0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_14__/* .createCompactPairingPayload */ .YP)(pairingPayload))}\n`);
+  process.stdout.write(`Web UI: ${(0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_15__/* .buildWebUiUrl */ .Gv)({ host: 'localhost', port }, compactPairingPayload)}\n`);
+  if (webUiConnection && webUiConnection.host !== 'localhost') {
+    process.stdout.write(`Web UI (other devices): ${(0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_15__/* .buildWebUiUrl */ .Gv)(webUiConnection, compactPairingPayload)}\n`);
   }
   process.stdout.write(`Paired devices: ${health.pairedDevices}\n`);
   await printPairingQr(pairingPayload);
 }
 
-function printHelp() {
-  process.stdout.write(`Vibelet ${packageJson.version}\n\n`);
-  process.stdout.write(`Package names:\n`);
-  process.stdout.write(`  @vibelet/cli\n`);
-  process.stdout.write(`  vibelet\n\n`);
-  process.stdout.write(`Usage:\n`);
-  process.stdout.write(
-    `  npx ${packageJson.name}           Install/start the daemon, auto-enable remote access, and print a pairing QR code\n`,
-  );
-  process.stdout.write(`  npx ${packageJson.name} start     Same as above\n`);
-  process.stdout.write(
-    `  npx ${packageJson.name} --access=local   Use LAN/local pairing only; skip Cloudflare and Tailscale\n`,
-  );
-  process.stdout.write(`  npx ${packageJson.name} --access=remote --force  Force a new Cloudflare Tunnel URL\n`);
-  process.stdout.write(`  npx ${packageJson.name} --access=https://<url>  Use a custom tunnel URL for remote access\n`);
-  process.stdout.write(`  npx ${packageJson.name} --access=<host>  Set the primary LAN/Tailscale host/IP address\n`);
-  process.stdout.write(`  npx ${packageJson.name} --port <port>  Start or query the daemon on a custom port\n`);
-  process.stdout.write(
-    `  npx ${packageJson.name} --claude-driver tui  Drive the interactive Claude TUI (subscription) instead of \`claude -p\`\n`,
-  );
-  process.stdout.write(`  npx ${packageJson.name} --access=<host>,<fallbacks>  Set fallback LAN/Tailscale hosts\n`);
-  process.stdout.write(`  npx ${packageJson.name} stop      Stop the daemon\n`);
-  process.stdout.write(`  npx ${packageJson.name} restart   Restart the daemon\n`);
-  process.stdout.write(`  npx ${packageJson.name} status    Show service and daemon status\n`);
-  process.stdout.write(`  npx ${packageJson.name} logs      Print recent daemon logs\n`);
-  process.stdout.write(`  npx ${packageJson.name} reset     Reset pairings and print a fresh QR code\n`);
-  process.stdout.write(`  npx ${packageJson.name} claude [...args]  Start Claude Code with Vibelet App takeover\n`);
-  process.stdout.write(`  npx ${packageJson.name} codex [...args]   Start Codex with Vibelet App takeover\n`);
-  process.stdout.write(`  npx ${packageJson.name} --help    Show this help text\n`);
-  process.stdout.write(`  npx ${packageJson.name} --version Show the installed CLI version\n`);
-  process.stdout.write(`\n`);
-  process.stdout.write(`You can also invoke the published alias with:\n`);
-  process.stdout.write(`  npx ${packageJson.name === 'vibelet' ? '@vibelet/cli' : 'vibelet'}\n`);
-  process.stdout.write(`  vibelet\n\n`);
-  process.stdout.write(`Remote access:\n`);
-  process.stdout.write(`  # Remote access is on by default for start/reset/restart\n`);
-  process.stdout.write(`  npx ${packageJson.name}\n\n`);
-  process.stdout.write(`  # Want LAN/local-only pairing for this run?\n`);
-  process.stdout.write(`  npx ${packageJson.name} --access=local\n\n`);
-  process.stdout.write(`  # Need a fresh Cloudflare Tunnel URL?\n`);
-  process.stdout.write(`  npx ${packageJson.name} --access=remote --force\n\n`);
-  process.stdout.write(`  # Or bring your own tunnel and pass the URL manually:\n`);
-  process.stdout.write(`  npx cloudflared tunnel --protocol auto --url http://localhost:${port}\n`);
-  process.stdout.write(`  ngrok http ${port}\n`);
-  process.stdout.write(`  npx ${packageJson.name} --access=https://<your-tunnel-url>\n\n`);
-  process.stdout.write(`  # Tailscale (P2P VPN, no tunnel needed)\n`);
-  process.stdout.write(`  npx ${packageJson.name} --access=<tailscale-ip>\n\n`);
-  process.stdout.write(`Legacy aliases still work: --local, --relay, --host, --fallback-hosts, --remote, --tunnel.\n`);
-}
+const printHelp = () => (0,_vibelet_help_mjs__WEBPACK_IMPORTED_MODULE_16__/* .printCliHelp */ .n)({ packageJson, port });
 
 function parseNamedArg(name, errorHint) {
-  return (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_15__/* .parseNamedArg */ .nE)(process.argv, name, errorHint, fail);
+  return (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_17__/* .parseNamedArg */ .nE)(process.argv, name, errorHint, fail);
 }
 
 function parseRelayArg() {
@@ -15767,7 +15867,14 @@ function parseCommandArg(argv) {
     ) {
       continue;
     }
-    if (arg === '--local' || arg === '--remote' || arg === '--tunnel' || arg === '--force') {
+    if (
+      arg === '--local' ||
+      arg === '--remote' ||
+      arg === '--tunnel' ||
+      arg === '--force' ||
+      arg === '--tailcat' ||
+      arg === '--no-tailcat'
+    ) {
       continue;
     }
     return arg;
@@ -15792,9 +15899,7 @@ async function main() {
     process.env.VIBE_PORT = String(portArg);
   }
 
-  // Select the Claude driver: 'print' (claude -p, default) or 'tui' (interactive
-  // TUI). Forwarded to the daemon via env so every backend (detached/launchd/
-  // systemd) picks it up.
+  // Forward the selected Claude driver to every daemon backend.
   const claudeDriverArg = parseNamedArg('claude-driver', 'tui');
   if (claudeDriverArg !== null) {
     process.env.VIBE_CLAUDE_DRIVER = claudeDriverArg;
@@ -15812,10 +15917,10 @@ async function main() {
     return;
   }
 
-  if ((0,_terminal_wrapper_mjs__WEBPACK_IMPORTED_MODULE_10__/* .isTerminalAgentCommand */ .$c)(command)) {
+  if ((0,_terminal_wrapper_mjs__WEBPACK_IMPORTED_MODULE_11__/* .isTerminalAgentCommand */ .$c)(command)) {
     const backend = resolveBackend();
     await ensureDaemonForTerminalControl(backend);
-    process.exitCode = await (0,_terminal_wrapper_mjs__WEBPACK_IMPORTED_MODULE_10__/* .runManagedNativeTerminal */ .WA)({
+    process.exitCode = await (0,_terminal_wrapper_mjs__WEBPACK_IMPORTED_MODULE_11__/* .runManagedNativeTerminal */ .WA)({
       agent: command,
       args: process.argv.slice(3),
       port,
@@ -15824,26 +15929,40 @@ async function main() {
     return;
   }
 
-  const accessTarget = (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_15__/* .parseAccessTargetArg */ .tY)(process.argv, fail);
-  if (accessTarget && (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_15__/* .hasLegacyAccessArgs */ .NT)(process.argv, process.env)) {
+  const accessTarget = (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_17__/* .parseAccessTargetArg */ .tY)(process.argv, fail);
+  if (accessTarget && (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_17__/* .hasLegacyAccessArgs */ .NT)(process.argv, process.env)) {
     fail(
       'Do not combine --access with legacy access flags.',
       'Use one form, for example `--access=local`, `--access=remote`, `--access=https://...`, or `--access=<host>`.',
     );
   }
   if (!accessTarget) {
-    (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_15__/* .consumeFlag */ .PC)(process.argv, 'remote') ||
-      (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_15__/* .consumeFlag */ .PC)(process.argv, 'tunnel') ||
-      (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_15__/* .readNpmConfigFlag */ .AW)('remote') ||
-      (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_15__/* .readNpmConfigFlag */ .AW)('tunnel');
+    (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_17__/* .consumeFlag */ .PC)(process.argv, 'remote') ||
+      (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_17__/* .consumeFlag */ .PC)(process.argv, 'tunnel') ||
+      (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_17__/* .readNpmConfigFlag */ .AW)('remote') ||
+      (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_17__/* .readNpmConfigFlag */ .AW)('tunnel');
   }
   const localFlag =
     accessTarget?.kind === 'local' ||
     (!accessTarget &&
-      ((0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_15__/* .consumeFlag */ .PC)(process.argv, 'local') ||
-        (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_15__/* .readNpmConfigFlag */ .AW)('local') ||
+      ((0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_17__/* .consumeFlag */ .PC)(process.argv, 'local') ||
+        (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_17__/* .readNpmConfigFlag */ .AW)('local') ||
         isTruthyEnvFlag(process.env.VIBELET_LOCAL_ONLY)));
-  const forceFlag = (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_15__/* .consumeFlag */ .PC)(process.argv, 'force') || (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_15__/* .readNpmConfigFlag */ .AW)('force');
+  const forceFlag = (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_17__/* .consumeFlag */ .PC)(process.argv, 'force') || (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_17__/* .readNpmConfigFlag */ .AW)('force');
+  const enableTailcatFlag = (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_17__/* .consumeFlag */ .PC)(process.argv, 'tailcat') || (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_17__/* .readNpmConfigFlag */ .AW)('tailcat');
+  const disableTailcatFlag = (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_17__/* .consumeFlag */ .PC)(process.argv, 'no-tailcat') || (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_17__/* .readNpmConfigFlag */ .AW)('no-tailcat');
+  if (enableTailcatFlag && disableTailcatFlag) {
+    fail('Do not combine --tailcat with --no-tailcat.');
+  }
+  const explicitTailcatChoice = enableTailcatFlag || disableTailcatFlag;
+  const tailcatEnabled = enableTailcatFlag
+    ? true
+    : disableTailcatFlag
+      ? false
+      : isTruthyEnvFlag(process.env.VIBELET_TAILCAT) || tailcatConfig.load();
+  if (explicitTailcatChoice) tailcatConfig.save(tailcatEnabled);
+  if (tailcatEnabled) process.env.VIBELET_TAILCAT = '1';
+  else delete process.env.VIBELET_TAILCAT;
   const relayArg =
     accessTarget?.kind === 'relay'
       ? accessTarget.relayUrl
@@ -15870,7 +15989,7 @@ async function main() {
   const savedRelayUrl = relayConfig.load();
   // --remote/--tunnel remain accepted for compatibility, but startup commands
   // now default to managed remote access unless another connection target wins.
-  const shouldManageTunnel = (0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_11__/* .shouldManageQuickTunnel */ .gm)({
+  const shouldManageTunnel = (0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_12__/* .shouldManageQuickTunnel */ .gm)({
     startCommand,
     localMode: localFlag,
     relayArg,
@@ -15885,7 +16004,7 @@ async function main() {
   }
 
   if (
-    (0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_11__/* .shouldRetireManagedQuickTunnel */ .Pg)({
+    (0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_12__/* .shouldRetireManagedQuickTunnel */ .Pg)({
       startCommand,
       manageQuickTunnel: shouldManageTunnel,
     })
@@ -15977,7 +16096,9 @@ async function main() {
     }
     const health = await probeHealth(1_500);
     if (health) {
-      process.stdout.write(JSON.stringify(health, null, 2) + '\n');
+      process.stdout.write(
+        JSON.stringify(health, (key, value) => (key === 'serverAddress' ? '[redacted]' : value), 2) + '\n',
+      );
     } else {
       process.stdout.write('Daemon is not responding.\n');
     }
@@ -16020,14 +16141,22 @@ async function main() {
   if (command === 'reset') {
     const healthyDaemon = await probeHealth(1_500);
     const hasExplicitConfigOverrides =
-      !(0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_11__/* .doesHealthMatchRequestedConnectionConfig */ .nW)({
+      !(0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_12__/* .doesHealthMatchRequestedConnectionConfig */ .nW)({
         health: healthyDaemon,
         relayUrl,
         canonicalHost: hostArg || '',
         fallbackHosts: fallbackHostsArg || '',
         localMode: localFlag,
+        tailcatEnabled,
       }) &&
-      (localFlag || relayArg !== null || Boolean(relayUrl) || Boolean(hostArg) || Boolean(fallbackHostsArg));
+      (localFlag ||
+        relayArg !== null ||
+        Boolean(relayUrl) ||
+        Boolean(hostArg) ||
+        Boolean(fallbackHostsArg) ||
+        explicitTailcatChoice ||
+        tailcatEnabled ||
+        healthyDaemon?.tailcat?.enabled === true);
     const shouldReplaceDetachedDaemon =
       !healthyDaemon && !backend.handlesProcessLifecycle && backend.isServiceInstalled();
     if (shouldReplaceDetachedDaemon || (healthyDaemon && hasExplicitConfigOverrides)) {
@@ -16048,39 +16177,46 @@ async function main() {
   }
 
   let healthyDaemon = await probeHealth(1_500);
+  let tailcatMismatch = (0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_12__/* .isTailcatConfigurationMismatch */ .Zg)({ health: healthyDaemon, tailcatEnabled });
   let hasExplicitConfigOverrides =
-    !(0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_11__/* .doesHealthMatchRequestedConnectionConfig */ .nW)({
+    !(0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_12__/* .doesHealthMatchRequestedConnectionConfig */ .nW)({
       health: healthyDaemon,
       relayUrl,
       canonicalHost: hostArg || '',
       fallbackHosts: fallbackHostsArg || '',
       localMode: localFlag,
+      tailcatEnabled,
     }) &&
     (localFlag ||
       shouldManageTunnel ||
       relayArg !== null ||
       Boolean(relayUrl) ||
       Boolean(hostArg) ||
-      Boolean(fallbackHostsArg));
+      Boolean(fallbackHostsArg) ||
+      explicitTailcatChoice ||
+      tailcatEnabled ||
+      healthyDaemon?.tailcat?.enabled === true);
   const relayOverrideRequested =
     !localFlag && !hostArg && !fallbackHostsArg && (shouldManageTunnel || relayArg !== null || Boolean(savedRelayUrl));
   const canApplyConnectionConfigWithoutRestart = Boolean(
-    healthyDaemon && relayOverrideRequested && hasExplicitConfigOverrides,
+    healthyDaemon && relayOverrideRequested && hasExplicitConfigOverrides && !tailcatMismatch,
   );
   if (healthyDaemon && hasExplicitConfigOverrides && canApplyConnectionConfigWithoutRestart) {
     const refreshedHealth = await tryUpdateRunningDaemonRelay(relayUrl);
     if (refreshedHealth) {
       healthyDaemon = refreshedHealth;
-      hasExplicitConfigOverrides = !(0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_11__/* .doesHealthMatchRequestedConnectionConfig */ .nW)({
+      hasExplicitConfigOverrides = !(0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_12__/* .doesHealthMatchRequestedConnectionConfig */ .nW)({
         health: healthyDaemon,
         relayUrl,
         canonicalHost: '',
         fallbackHosts: '',
         localMode: false,
+        tailcatEnabled,
       });
+      tailcatMismatch = (0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_12__/* .isTailcatConfigurationMismatch */ .Zg)({ health: healthyDaemon, tailcatEnabled });
     }
   }
-  const existingHealth = (0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_11__/* .shouldReuseHealthyDaemon */ .ZN)({
+  const existingHealth = (0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_12__/* .shouldReuseHealthyDaemon */ .ZN)({
     command,
     daemonHealthy: Boolean(healthyDaemon),
     hasExplicitConfigOverrides,