vibelet 1.2.221 → 1.2.224

package/dist/runtime-version.cjs

@@ -1,2 +1,2 @@
-var c=require("node:fs"),n=require("node:path"),p="@vibelet/cli";function i(r){try{let e=JSON.parse((0,c.readFileSync)(r,"utf8"));if(e.name===p&&typeof e.version=="string"&&e.version.length>0)return e.version}catch{}return null}function l(){return"1.2.221"}var a=l();process.stdout.write(`${a}
+var c=require("node:fs"),n=require("node:path"),p="@vibelet/cli";function i(r){try{let e=JSON.parse((0,c.readFileSync)(r,"utf8"));if(e.name===p&&typeof e.version=="string"&&e.version.length>0)return e.version}catch{}return null}function l(){return"1.2.224"}var a=l();process.stdout.write(`${a}
 `);

package/dist/vibelet.mjs

@@ -14312,19 +14312,19 @@ function printCliHelp({ packageJson, port }) {
   process.stdout.write(`  vibelet\n\n`);
   process.stdout.write(`Usage:\n`);
   process.stdout.write(
-    `  npx ${packageJson.name}           Install/start the daemon, auto-enable remote access, and print a pairing QR code\n`,
+    `  npx ${packageJson.name}           Install/start the daemon, enable Tailcat and Cloudflare access by default, and print a pairing QR code\n`,
   );
   process.stdout.write(`  npx ${packageJson.name} start     Same as above\n`);
   process.stdout.write(
-    `  npx ${packageJson.name} --access=local   Use LAN/local pairing only; skip Cloudflare and Tailscale\n`,
+    `  npx ${packageJson.name} --access=local   Use LAN/local pairing only; skip Tailcat, Cloudflare and Tailscale\n`,
   );
-  process.stdout.write(`  npx ${packageJson.name} --access=remote --force  Force a new Cloudflare Tunnel URL\n`);
+  process.stdout.write(`  npx ${packageJson.name} --cloudflare --force  Force a new Cloudflare Tunnel URL\n`);
   process.stdout.write(`  npx ${packageJson.name} --access=https://<url>  Use a custom tunnel URL for remote access\n`);
   process.stdout.write(`  npx ${packageJson.name} --access=<host>  Set the primary LAN/Tailscale host/IP address\n`);
   process.stdout.write(
-    `  npx ${packageJson.name} --tailcat  Enable userspace Tailcat direct access (keeps existing fallbacks)\n`,
+    `  npx ${packageJson.name} --tailcat  Enable Tailcat access without automatic Cloudflare Tunnel\n`,
   );
-  process.stdout.write(`  npx ${packageJson.name} --no-tailcat  Disable previously enabled Tailcat access\n`);
+  process.stdout.write(`  npx ${packageJson.name} --no-tailcat  Disable Tailcat access; keep Cloudflare available\n`);
   process.stdout.write(`  npx ${packageJson.name} --port <port>  Start or query the daemon on a custom port\n`);
   process.stdout.write(
     `  npx ${packageJson.name} --claude-driver tui  Drive the interactive Claude TUI (subscription) instead of \`claude -p\`\n`,
@@ -14344,12 +14344,12 @@ function printCliHelp({ packageJson, port }) {
   process.stdout.write(`  npx ${packageJson.name === 'vibelet' ? '@vibelet/cli' : 'vibelet'}\n`);
   process.stdout.write(`  vibelet\n\n`);
   process.stdout.write(`Remote access:\n`);
-  process.stdout.write(`  # Remote access is on by default for start/reset/restart\n`);
+  process.stdout.write(`  # Tailcat and Cloudflare are on by default for start/reset/restart\n`);
   process.stdout.write(`  npx ${packageJson.name}\n\n`);
   process.stdout.write(`  # Want LAN/local-only pairing for this run?\n`);
   process.stdout.write(`  npx ${packageJson.name} --access=local\n\n`);
-  process.stdout.write(`  # Need a fresh Cloudflare Tunnel URL?\n`);
-  process.stdout.write(`  npx ${packageJson.name} --access=remote --force\n\n`);
+  process.stdout.write(`  # Use Cloudflare instead of Tailcat (add --force for a fresh URL):\n`);
+  process.stdout.write(`  npx ${packageJson.name} --cloudflare\n\n`);
   process.stdout.write(`  # Or bring your own tunnel and pass the URL manually:\n`);
   process.stdout.write(`  npx cloudflared tunnel --protocol auto --url http://localhost:${port}\n`);
   process.stdout.write(`  ngrok http ${port}\n`);
@@ -14358,8 +14358,12 @@ function printCliHelp({ packageJson, port }) {
   process.stdout.write(`  npx ${packageJson.name} --access=<tailscale-ip>\n\n`);
   process.stdout.write(`\nTailcat direct access:\n`);
   process.stdout.write(`  npx ${packageJson.name} --tailcat\n`);
-  process.stdout.write(`  # Tailcat runs inside Vibelet and does not change system VPN, DNS, or routes.\n\n`);
-  process.stdout.write(`Legacy aliases still work: --local, --relay, --host, --fallback-hosts, --remote, --tunnel.\n`);
+  process.stdout.write(
+    `  # Add --cloudflare to --tailcat to enable both transports.\n  # Tailcat does not change system VPN, DNS, or routes.\n\n`,
+  );
+  process.stdout.write(
+    `Legacy aliases still work: --access=remote, --local, --relay, --host, --fallback-hosts, --remote, --tunnel.\n`,
+  );
 }
 
 
@@ -15919,8 +15923,10 @@ function shouldManageQuickTunnel({
   savedRelayUrl = '',
   force = false,
   preserveAccess = false,
+  tailcatEnabled = false,
+  remoteRequested = false,
 }) {
-  if (preserveAccess) return false;
+  if (preserveAccess || !remoteRequested) return false;
   if (!startCommand || localMode || relayArg !== null || hostArg || fallbackHostsArg) {
     return false;
   }
@@ -16042,18 +16048,24 @@ async function stopDaemonWithHooks({
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __nccwpck_require__) => {
 
 /* harmony export */ __nccwpck_require__.d(__webpack_exports__, {
-/* harmony export */   S: () => (/* binding */ createTailcatConfigStore)
+/* harmony export */   OW: () => (/* binding */ shouldRequestCloudflare),
+/* harmony export */   SS: () => (/* binding */ configureTailcatMode),
+/* harmony export */   SY: () => (/* binding */ createTailcatConfigStore)
 /* harmony export */ });
+/* unused harmony export resolveTailcatChoice */
 /* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __nccwpck_require__(3024);
+/* harmony import */ var _vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_1__ = __nccwpck_require__(6927);
+
 
 
 function createTailcatConfigStore(configPath, dataDirectory) {
   return {
     load() {
       try {
-        return JSON.parse((0,node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync)(configPath, 'utf8')).enabled === true;
+        const enabled = JSON.parse((0,node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync)(configPath, 'utf8')).enabled;
+        return typeof enabled === 'boolean' ? enabled : true;
       } catch {
-        return false;
+        return true;
       }
     },
     save(enabled) {
@@ -16063,6 +16075,77 @@ function createTailcatConfigStore(configPath, dataDirectory) {
   };
 }
 
+function resolveTailcatChoice({ enable, disable, cloudflareRequested, environmentEnabled, savedEnabled }) {
+  if (enable) return true;
+  if (disable || cloudflareRequested) return false;
+  return environmentEnabled || savedEnabled;
+}
+
+function configureTailcatMode({
+  readFlag,
+  fail,
+  config,
+  localMode,
+  cloudflareRequested,
+  environment = process.env,
+}) {
+  const enable = readFlag('tailcat');
+  const disable = readFlag('no-tailcat');
+  if (enable && disable) fail('Do not combine --tailcat with --no-tailcat.');
+  const requested = resolveTailcatChoice({
+    enable,
+    disable,
+    cloudflareRequested,
+    environmentEnabled: (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_1__/* .isTruthyEnvFlag */ .ap)(environment.VIBELET_TAILCAT),
+    savedEnabled: config.load(),
+  });
+  if (enable || disable) config.save(requested);
+  // Local access overrides Tailcat for this run without changing its saved choice.
+  const enabled = !localMode && requested;
+  if (enabled) environment.VIBELET_TAILCAT = '1';
+  else delete environment.VIBELET_TAILCAT;
+  return { enabled, explicitChoice: enable || disable };
+}
+
+function shouldRequestCloudflare({ accessTarget, tailcatEnabled, explicitTailcatChoice }) {
+  return accessTarget?.kind === 'remote' || (!accessTarget && !(explicitTailcatChoice && tailcatEnabled));
+}
+
+
+/***/ }),
+
+/***/ 50:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __nccwpck_require__) => {
+
+/* harmony export */ __nccwpck_require__.d(__webpack_exports__, {
+/* harmony export */   Q: () => (/* binding */ normalizePortValue),
+/* harmony export */   Z: () => (/* binding */ compareVersions)
+/* harmony export */ });
+function normalizePortValue(rawValue) {
+  if (typeof rawValue !== 'string' && typeof rawValue !== 'number') {
+    return null;
+  }
+  const normalized = String(rawValue).trim();
+  if (!/^\d+$/.test(normalized)) {
+    return null;
+  }
+  const parsed = Number(normalized);
+  if (!Number.isInteger(parsed) || parsed <= 0 || parsed > 65535) {
+    return null;
+  }
+  return parsed;
+}
+
+function compareVersions(a, b) {
+  const pa = a.split('.').map(Number);
+  const pb = b.split('.').map(Number);
+  for (let i = 0; i < 3; i++) {
+    if ((pa[i] || 0) < (pb[i] || 0)) return -1;
+    if ((pa[i] || 0) > (pb[i] || 0)) return 1;
+  }
+  return 0;
+}
+
 
 /***/ }),
 
@@ -16071,22 +16154,23 @@ function createTailcatConfigStore(configPath, dataDirectory) {
 
 __nccwpck_require__.a(__webpack_module__, async (__webpack_handle_async_dependencies__, __webpack_async_result__) => { try {
 /* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_0__ = __nccwpck_require__(1421);
+/* harmony import */ var _vibelet_value_validation_mjs__WEBPACK_IMPORTED_MODULE_12__ = __nccwpck_require__(50);
 /* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_1__ = __nccwpck_require__(3024);
 /* harmony import */ var node_module__WEBPACK_IMPORTED_MODULE_2__ = __nccwpck_require__(8995);
 /* harmony import */ var node_os__WEBPACK_IMPORTED_MODULE_3__ = __nccwpck_require__(8161);
 /* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_4__ = __nccwpck_require__(6760);
 /* harmony import */ var node_url__WEBPACK_IMPORTED_MODULE_5__ = __nccwpck_require__(3136);
-/* harmony import */ var _vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_17__ = __nccwpck_require__(6927);
+/* harmony import */ var _vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_18__ = __nccwpck_require__(6927);
 /* harmony import */ var _cloudflared_tunnel_manager_mjs__WEBPACK_IMPORTED_MODULE_6__ = __nccwpck_require__(1484);
 /* harmony import */ var _vibelet_cloudflare_runtime_mjs__WEBPACK_IMPORTED_MODULE_7__ = __nccwpck_require__(3869);
-/* harmony import */ var _vibelet_launchd_mjs__WEBPACK_IMPORTED_MODULE_13__ = __nccwpck_require__(1010);
+/* harmony import */ var _vibelet_launchd_mjs__WEBPACK_IMPORTED_MODULE_14__ = __nccwpck_require__(1010);
 /* harmony import */ var _linux_systemd_mjs__WEBPACK_IMPORTED_MODULE_8__ = __nccwpck_require__(4217);
-/* harmony import */ var _vibelet_stop_logic_mjs__WEBPACK_IMPORTED_MODULE_14__ = __nccwpck_require__(6274);
-/* harmony import */ var _vibelet_help_mjs__WEBPACK_IMPORTED_MODULE_16__ = __nccwpck_require__(4162);
+/* harmony import */ var _vibelet_stop_logic_mjs__WEBPACK_IMPORTED_MODULE_15__ = __nccwpck_require__(6274);
+/* harmony import */ var _vibelet_help_mjs__WEBPACK_IMPORTED_MODULE_17__ = __nccwpck_require__(4162);
 /* harmony import */ var _vibelet_tailcat_config_mjs__WEBPACK_IMPORTED_MODULE_9__ = __nccwpck_require__(5798);
-/* harmony import */ var _vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_12__ = __nccwpck_require__(4);
+/* harmony import */ var _vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_13__ = __nccwpck_require__(4);
 /* harmony import */ var _terminal_wrapper_mjs__WEBPACK_IMPORTED_MODULE_10__ = __nccwpck_require__(5028);
-/* harmony import */ var _vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_15__ = __nccwpck_require__(7721);
+/* harmony import */ var _vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_16__ = __nccwpck_require__(7721);
 /* harmony import */ var _vibelet_pairing_output_mjs__WEBPACK_IMPORTED_MODULE_11__ = __nccwpck_require__(9485);
 
 
@@ -16107,6 +16191,7 @@ __nccwpck_require__.a(__webpack_module__, async (__webpack_handle_async_dependen
 
 
 
+
 
 // ─── Paths & constants ─────────────────────────────────────────────────────────
 
@@ -16127,7 +16212,7 @@ const stdoutLogPath = (0,node_path__WEBPACK_IMPORTED_MODULE_4__.join)(logDir, 'd
 const stderrLogPath = (0,node_path__WEBPACK_IMPORTED_MODULE_4__.join)(logDir, 'daemon.stderr.log');
 const pidFilePath = (0,node_path__WEBPACK_IMPORTED_MODULE_4__.join)(vibeletDir, 'daemon.pid');
 const relayConfig = (0,_vibelet_cloudflare_runtime_mjs__WEBPACK_IMPORTED_MODULE_7__/* .createRelayConfigStore */ .T7)((0,node_path__WEBPACK_IMPORTED_MODULE_4__.join)(vibeletDir, 'relay.json'));
-const tailcatConfig = (0,_vibelet_tailcat_config_mjs__WEBPACK_IMPORTED_MODULE_9__/* .createTailcatConfigStore */ .S)((0,node_path__WEBPACK_IMPORTED_MODULE_4__.join)(vibeletDir, 'tailcat.json'), vibeletDir);
+const tailcatConfig = (0,_vibelet_tailcat_config_mjs__WEBPACK_IMPORTED_MODULE_9__/* .createTailcatConfigStore */ .SY)((0,node_path__WEBPACK_IMPORTED_MODULE_4__.join)(vibeletDir, 'tailcat.json'), vibeletDir);
 const tunnelStatePath = (0,node_path__WEBPACK_IMPORTED_MODULE_4__.join)(vibeletDir, 'tunnel.json');
 const cloudflaredUpdateStatePath = (0,node_path__WEBPACK_IMPORTED_MODULE_4__.join)(vibeletDir, 'cloudflared-update.json');
 const updateCheckPath = (0,node_path__WEBPACK_IMPORTED_MODULE_4__.join)(vibeletDir, 'update-check.json');
@@ -16136,22 +16221,7 @@ const UPDATE_CHECK_INTERVAL_MS = 4 * 60 * 60 * 1000; // 4 hours
 
 let officialSitePrinted = false;
 let updateMessage = '';
-let port = normalizePortValue(process.env.VIBE_PORT) ?? 9876;
-
-function normalizePortValue(rawValue) {
-  if (typeof rawValue !== 'string' && typeof rawValue !== 'number') {
-    return null;
-  }
-  const normalized = String(rawValue).trim();
-  if (!/^\d+$/.test(normalized)) {
-    return null;
-  }
-  const parsed = Number(normalized);
-  if (!Number.isInteger(parsed) || parsed <= 0 || parsed > 65535) {
-    return null;
-  }
-  return parsed;
-}
+let port = (0,_vibelet_value_validation_mjs__WEBPACK_IMPORTED_MODULE_12__/* .normalizePortValue */ .Q)(process.env.VIBE_PORT) ?? 9876;
 
 function printOfficialSite() {
   if (officialSitePrinted) return;
@@ -16183,20 +16253,10 @@ function writeUpdateCheck(data) {
   }
 }
 
-function compareVersions(a, b) {
-  const pa = a.split('.').map(Number);
-  const pb = b.split('.').map(Number);
-  for (let i = 0; i < 3; i++) {
-    if ((pa[i] || 0) < (pb[i] || 0)) return -1;
-    if ((pa[i] || 0) > (pb[i] || 0)) return 1;
-  }
-  return 0;
-}
-
 function checkForUpdateFromCache() {
   const cached = readUpdateCheck();
   if (!cached?.latestVersion) return;
-  if (compareVersions(packageJson.version, cached.latestVersion) < 0) {
+  if ((0,_vibelet_value_validation_mjs__WEBPACK_IMPORTED_MODULE_12__/* .compareVersions */ .Z)(packageJson.version, cached.latestVersion) < 0) {
     updateMessage =
       `\x1b[33m╭───────────────────────────────────────────╮\x1b[0m\n` +
       `\x1b[33m│\x1b[0m  Update available: \x1b[90m${packageJson.version}\x1b[0m → \x1b[32m${cached.latestVersion}\x1b[0m${' '.repeat(Math.max(0, 14 - packageJson.version.length - cached.latestVersion.length))}\x1b[33m│\x1b[0m\n` +
@@ -16274,7 +16334,7 @@ function ensureRuntimeInstalled() {
   const runtimeMetadata = readRuntimeMetadata();
 
   if (
-    (0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_12__/* .shouldRefuseRuntimeDowngrade */ .Ne)({
+    (0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_13__/* .shouldRefuseRuntimeDowngrade */ .Ne)({
       cliVersion: packageJson.version,
       runtimeVersion: runtimeMetadata?.version,
       runtimeEntryExists: (0,node_fs__WEBPACK_IMPORTED_MODULE_1__.existsSync)(runtimeDaemonEntryPath),
@@ -16478,7 +16538,7 @@ function createDarwinBackend() {
   }
 
   function bootoutService() {
-    return (0,_vibelet_launchd_mjs__WEBPACK_IMPORTED_MODULE_13__/* .bootoutLaunchdService */ .B)({
+    return (0,_vibelet_launchd_mjs__WEBPACK_IMPORTED_MODULE_14__/* .bootoutLaunchdService */ .B)({
       launchctl,
       launchDomain,
       label,
@@ -16568,7 +16628,7 @@ ${envSection}
         if (result.status !== 0) {
           fail(
             'Failed to bootstrap vibelet launch agent.',
-            [(0,_vibelet_launchd_mjs__WEBPACK_IMPORTED_MODULE_13__/* .describeLaunchctlResult */ .N)(bootoutResult.result), (0,_vibelet_launchd_mjs__WEBPACK_IMPORTED_MODULE_13__/* .describeLaunchctlResult */ .N)(result)].filter(Boolean).join('\n'),
+            [(0,_vibelet_launchd_mjs__WEBPACK_IMPORTED_MODULE_14__/* .describeLaunchctlResult */ .N)(bootoutResult.result), (0,_vibelet_launchd_mjs__WEBPACK_IMPORTED_MODULE_14__/* .describeLaunchctlResult */ .N)(result)].filter(Boolean).join('\n'),
           );
         }
       }
@@ -16584,7 +16644,7 @@ ${envSection}
     stop() {
       const bootoutResult = bootoutService();
       if (!bootoutResult.ok) {
-        fail('Failed to unload vibelet launch agent.', (0,_vibelet_launchd_mjs__WEBPACK_IMPORTED_MODULE_13__/* .describeLaunchctlResult */ .N)(bootoutResult.result));
+        fail('Failed to unload vibelet launch agent.', (0,_vibelet_launchd_mjs__WEBPACK_IMPORTED_MODULE_14__/* .describeLaunchctlResult */ .N)(bootoutResult.result));
       }
       // bootout returns before launchd actually finishes unloading. Poll
       // until the service is gone so a follow-up install() doesn't see a
@@ -16927,7 +16987,7 @@ function retireTrackedQuickTunnel({ required = false } = {}) {
 
 async function stopRunningDaemon(backend) {
   try {
-    await (0,_vibelet_stop_logic_mjs__WEBPACK_IMPORTED_MODULE_14__/* .stopDaemonWithHooks */ .v)({
+    await (0,_vibelet_stop_logic_mjs__WEBPACK_IMPORTED_MODULE_15__/* .stopDaemonWithHooks */ .v)({
       requestShutdown,
       backendStop: () => backend.stop(),
       waitForDaemonExit,
@@ -16940,13 +17000,13 @@ async function stopRunningDaemon(backend) {
 async function ensureDaemonForTerminalControl(backend) {
   const healthyDaemon = await probeHealth(1_500);
   const tokenReady = (0,node_fs__WEBPACK_IMPORTED_MODULE_1__.existsSync)(runtimeTerminalControlTokenPath);
-  const terminalControlReady = healthyDaemon && tokenReady && (0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_12__/* .doesHealthSupportTerminalControl */ .iX)(healthyDaemon);
+  const terminalControlReady = healthyDaemon && tokenReady && (0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_13__/* .doesHealthSupportTerminalControl */ .iX)(healthyDaemon);
   if (terminalControlReady) return healthyDaemon;
 
   if (healthyDaemon && !terminalControlReady) {
     const activeSessions = typeof healthyDaemon.activeSessions === 'number' ? healthyDaemon.activeSessions : 0;
     if (activeSessions > 0) {
-      const reason = (0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_12__/* .doesHealthSupportTerminalControl */ .iX)(healthyDaemon)
+      const reason = (0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_13__/* .doesHealthSupportTerminalControl */ .iX)(healthyDaemon)
         ? 'terminal-control token is missing'
         : 'the running daemon does not advertise terminal-control support';
       process.stderr.write(
@@ -16965,7 +17025,7 @@ async function ensureDaemonForTerminalControl(backend) {
 }
 
 function validateExplicitCleartextHosts({ hostArg, fallbackHostsArg }) {
-  const [unsafeHost] = (0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_15__/* .findUnsafeCleartextHosts */ .dE)({ hostArg, fallbackHostsArg });
+  const [unsafeHost] = (0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_16__/* .findUnsafeCleartextHosts */ .dE)({ hostArg, fallbackHostsArg });
   if (unsafeHost) fail(`Refusing public cleartext host ${unsafeHost}. Use HTTPS, Tailscale, LAN, or local access.`);
 }
 
@@ -16986,11 +17046,11 @@ async function printPairingSummary(existingHealth = null, { relayUrlOverride = n
   const pairingPayload =
     relayUrlOverride === null
       ? daemonPairingPayload
-      : (0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_15__/* .applyRelayUrlToPairingPayload */ .mp)(daemonPairingPayload, relayUrlOverride);
-  const connections = (0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_15__/* .normalizePairingConnections */ .No)(pairingPayload);
+      : (0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_16__/* .applyRelayUrlToPairingPayload */ .mp)(daemonPairingPayload, relayUrlOverride);
+  const connections = (0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_16__/* .normalizePairingConnections */ .No)(pairingPayload);
   const [preferredConnection, ...otherConnections] = connections;
-  const webUiConnection = (0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_15__/* .selectWebUiConnectionTarget */ .SF)(connections);
-  const compactPairingPayload = (0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_15__/* .createCompactPairingPayload */ .YP)(pairingPayload);
+  const webUiConnection = (0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_16__/* .selectWebUiConnectionTarget */ .SF)(connections);
+  const compactPairingPayload = (0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_16__/* .createCompactPairingPayload */ .YP)(pairingPayload);
 
   process.stdout.write(`Vibelet daemon is ready.\n\n`);
   process.stdout.write(`Device: ${health.displayName}\n`);
@@ -16998,26 +17058,26 @@ async function printPairingSummary(existingHealth = null, { relayUrlOverride = n
   process.stdout.write(`Host: ${pairingPayload.canonicalHost}\n`);
   process.stdout.write(`Port: ${pairingPayload.port}\n`);
   if (preferredConnection) {
-    process.stdout.write(`Preferred path: ${(0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_15__/* .formatConnectionSummary */ .uR)(preferredConnection)}\n`);
+    process.stdout.write(`Preferred path: ${(0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_16__/* .formatConnectionSummary */ .uR)(preferredConnection)}\n`);
   }
   if (otherConnections.length > 0) {
     process.stdout.write(`Other paths:\n`);
     otherConnections.forEach((target) => {
-      process.stdout.write(`  - ${(0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_15__/* .formatConnectionSummary */ .uR)(target)}\n`);
+      process.stdout.write(`  - ${(0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_16__/* .formatConnectionSummary */ .uR)(target)}\n`);
     });
   }
-  process.stdout.write(`Web UI: ${(0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_15__/* .buildWebUiUrl */ .Gv)({ host: 'localhost', port }, compactPairingPayload)}\n`);
+  process.stdout.write(`Web UI: ${(0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_16__/* .buildWebUiUrl */ .Gv)({ host: 'localhost', port }, compactPairingPayload)}\n`);
   if (webUiConnection && webUiConnection.host !== 'localhost') {
-    process.stdout.write(`Web UI (other devices): ${(0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_15__/* .buildWebUiUrl */ .Gv)(webUiConnection, compactPairingPayload)}\n`);
+    process.stdout.write(`Web UI (other devices): ${(0,_vibelet_pairing_connections_mjs__WEBPACK_IMPORTED_MODULE_16__/* .buildWebUiUrl */ .Gv)(webUiConnection, compactPairingPayload)}\n`);
   }
   process.stdout.write(`Paired devices: ${health.pairedDevices}\n`);
   await printPairingQr(pairingPayload);
 }
 
-const printHelp = () => (0,_vibelet_help_mjs__WEBPACK_IMPORTED_MODULE_16__/* .printCliHelp */ .n)({ packageJson, port });
+const printHelp = () => (0,_vibelet_help_mjs__WEBPACK_IMPORTED_MODULE_17__/* .printCliHelp */ .n)({ packageJson, port });
 
 function parseNamedArg(name, errorHint) {
-  return (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_17__/* .parseNamedArg */ .nE)(process.argv, name, errorHint, fail);
+  return (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_18__/* .parseNamedArg */ .nE)(process.argv, name, errorHint, fail);
 }
 
 function parseRelayArg() {
@@ -17027,7 +17087,7 @@ function parseRelayArg() {
 function parsePortArg() {
   const rawValue = parseNamedArg('port', '9876');
   if (rawValue === null) return null;
-  const parsed = normalizePortValue(rawValue);
+  const parsed = (0,_vibelet_value_validation_mjs__WEBPACK_IMPORTED_MODULE_12__/* .normalizePortValue */ .Q)(rawValue);
   if (parsed === null) {
     fail('--port must be an integer between 1 and 65535');
   }
@@ -17069,6 +17129,7 @@ function parseCommandArg(argv) {
     }
     if (
       arg === '--local' ||
+      arg === '--cloudflare' ||
       arg === '--remote' ||
       arg === '--tunnel' ||
       arg === '--force' ||
@@ -17128,42 +17189,41 @@ async function main() {
     return;
   }
 
-  const accessTarget = (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_17__/* .parseAccessTargetArg */ .tY)(process.argv, fail);
-  if (accessTarget && (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_17__/* .hasLegacyAccessArgs */ .NT)(process.argv, process.env)) {
+  let accessTarget = (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_18__/* .parseAccessTargetArg */ .tY)(process.argv, fail);
+  const cloudflareFlag = (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_18__/* .consumeFlag */ .PC)(process.argv, 'cloudflare') || (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_18__/* .readNpmConfigFlag */ .AW)('cloudflare');
+  if (cloudflareFlag && accessTarget && accessTarget.kind !== 'remote')
+    fail('Do not combine --cloudflare with another --access mode.');
+  if (cloudflareFlag) accessTarget = { kind: 'remote' };
+  if (accessTarget && (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_18__/* .hasLegacyAccessArgs */ .NT)(process.argv, process.env)) {
     fail(
       'Do not combine --access with legacy access flags.',
       'Use one form, for example `--access=local`, `--access=remote`, `--access=https://...`, or `--access=<host>`.',
     );
   }
   if (!accessTarget) {
-    (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_17__/* .consumeFlag */ .PC)(process.argv, 'remote') ||
-      (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_17__/* .consumeFlag */ .PC)(process.argv, 'tunnel') ||
-      (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_17__/* .readNpmConfigFlag */ .AW)('remote') ||
-      (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_17__/* .readNpmConfigFlag */ .AW)('tunnel');
+    const legacyRemote =
+      (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_18__/* .consumeFlag */ .PC)(process.argv, 'remote') ||
+      (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_18__/* .consumeFlag */ .PC)(process.argv, 'tunnel') ||
+      (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_18__/* .readNpmConfigFlag */ .AW)('remote') ||
+      (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_18__/* .readNpmConfigFlag */ .AW)('tunnel');
+    if (legacyRemote) accessTarget = { kind: 'remote' };
   }
   const localFlag =
     accessTarget?.kind === 'local' ||
     (!accessTarget &&
-      ((0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_17__/* .consumeFlag */ .PC)(process.argv, 'local') ||
-        (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_17__/* .readNpmConfigFlag */ .AW)('local') ||
-        (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_17__/* .isTruthyEnvFlag */ .ap)(process.env.VIBELET_LOCAL_ONLY)));
-  const forceFlag = (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_17__/* .consumeFlag */ .PC)(process.argv, 'force') || (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_17__/* .readNpmConfigFlag */ .AW)('force');
+      ((0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_18__/* .consumeFlag */ .PC)(process.argv, 'local') ||
+        (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_18__/* .readNpmConfigFlag */ .AW)('local') ||
+        (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_18__/* .isTruthyEnvFlag */ .ap)(process.env.VIBELET_LOCAL_ONLY)));
+  const forceFlag = (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_18__/* .consumeFlag */ .PC)(process.argv, 'force') || (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_18__/* .readNpmConfigFlag */ .AW)('force');
   // App-triggered upgrades keep the currently working connection intact.
-  const preserveAccess = (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_17__/* .consumeFlag */ .PC)(process.argv, 'preserve-access') || (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_17__/* .readNpmConfigFlag */ .AW)('preserve-access');
-  const enableTailcatFlag = (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_17__/* .consumeFlag */ .PC)(process.argv, 'tailcat') || (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_17__/* .readNpmConfigFlag */ .AW)('tailcat');
-  const disableTailcatFlag = (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_17__/* .consumeFlag */ .PC)(process.argv, 'no-tailcat') || (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_17__/* .readNpmConfigFlag */ .AW)('no-tailcat');
-  if (enableTailcatFlag && disableTailcatFlag) {
-    fail('Do not combine --tailcat with --no-tailcat.');
-  }
-  const explicitTailcatChoice = enableTailcatFlag || disableTailcatFlag;
-  const tailcatEnabled = enableTailcatFlag
-    ? true
-    : disableTailcatFlag
-      ? false
-      : (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_17__/* .isTruthyEnvFlag */ .ap)(process.env.VIBELET_TAILCAT) || tailcatConfig.load();
-  if (explicitTailcatChoice) tailcatConfig.save(tailcatEnabled);
-  if (tailcatEnabled) process.env.VIBELET_TAILCAT = '1';
-  else delete process.env.VIBELET_TAILCAT;
+  const preserveAccess = (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_18__/* .consumeFlag */ .PC)(process.argv, 'preserve-access') || (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_18__/* .readNpmConfigFlag */ .AW)('preserve-access');
+  const { enabled: tailcatEnabled, explicitChoice: explicitTailcatChoice } = (0,_vibelet_tailcat_config_mjs__WEBPACK_IMPORTED_MODULE_9__/* .configureTailcatMode */ .SS)({
+    readFlag: (name) => (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_18__/* .consumeFlag */ .PC)(process.argv, name) || (0,_vibelet_cli_args_mjs__WEBPACK_IMPORTED_MODULE_18__/* .readNpmConfigFlag */ .AW)(name),
+    fail,
+    config: tailcatConfig,
+    localMode: localFlag,
+    cloudflareRequested: accessTarget?.kind === 'remote',
+  });
   const relayArg =
     accessTarget?.kind === 'relay'
       ? accessTarget.relayUrl
@@ -17188,9 +17248,7 @@ async function main() {
   command = parseCommandArg(process.argv);
   const startCommand = isDaemonStartCommand(command);
   const savedRelayUrl = relayConfig.load();
-  // --remote/--tunnel remain accepted for compatibility, but startup commands
-  // now default to managed remote access unless another connection target wins.
-  const shouldManageTunnel = (0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_12__/* .shouldManageQuickTunnel */ .gm)({
+  const shouldManageTunnel = (0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_13__/* .shouldManageQuickTunnel */ .gm)({
     startCommand,
     localMode: localFlag,
     relayArg,
@@ -17199,14 +17257,16 @@ async function main() {
     savedRelayUrl,
     force: forceFlag,
     preserveAccess,
+    tailcatEnabled,
+    remoteRequested: (0,_vibelet_tailcat_config_mjs__WEBPACK_IMPORTED_MODULE_9__/* .shouldRequestCloudflare */ .OW)({ accessTarget, tailcatEnabled, explicitTailcatChoice }),
   });
   const cloudflaredProtocol = process.env.VIBELET_CLOUDFLARED_PROTOCOL?.trim() || 'http2';
-  if (!['auto', 'quic', 'http2'].includes(cloudflaredProtocol)) {
+  if (shouldManageTunnel && !['auto', 'quic', 'http2'].includes(cloudflaredProtocol)) {
     fail(`Unsupported VIBELET_CLOUDFLARED_PROTOCOL: ${cloudflaredProtocol}. Use auto, quic, or http2.`);
   }
 
   if (
-    (0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_12__/* .shouldRetireManagedQuickTunnel */ .Pg)({
+    (0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_13__/* .shouldRetireManagedQuickTunnel */ .Pg)({
       startCommand,
       manageQuickTunnel: shouldManageTunnel,
       preserveAccess,
@@ -17249,7 +17309,12 @@ async function main() {
     }
   }
   const shouldIgnoreSavedRelay =
-    relayArg === null && (localFlag || Boolean(hostArg) || Boolean(fallbackHostsArg) || managedTunnelFailed);
+    relayArg === null &&
+    (localFlag ||
+      Boolean(hostArg) ||
+      Boolean(fallbackHostsArg) ||
+      managedTunnelFailed ||
+      (tailcatEnabled && !shouldManageTunnel && !preserveAccess));
   const relayUrl = relayArg !== null ? relayArg : shouldIgnoreSavedRelay ? '' : relayConfig.load();
   if (relayUrl) {
     process.env.VIBELET_RELAY_URL = relayUrl;
@@ -17344,7 +17409,7 @@ async function main() {
   if (command === 'reset') {
     const healthyDaemon = await probeHealth(1_500);
     const hasExplicitConfigOverrides =
-      !(0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_12__/* .doesHealthMatchRequestedConnectionConfig */ .nW)({
+      !(0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_13__/* .doesHealthMatchRequestedConnectionConfig */ .nW)({
         health: healthyDaemon,
         relayUrl,
         canonicalHost: hostArg || '',
@@ -17380,9 +17445,9 @@ async function main() {
   }
 
   let healthyDaemon = await probeHealth(1_500);
-  let tailcatMismatch = (0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_12__/* .isTailcatConfigurationMismatch */ .Zg)({ health: healthyDaemon, tailcatEnabled });
+  let tailcatMismatch = (0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_13__/* .isTailcatConfigurationMismatch */ .Zg)({ health: healthyDaemon, tailcatEnabled });
   let hasExplicitConfigOverrides =
-    !(0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_12__/* .doesHealthMatchRequestedConnectionConfig */ .nW)({
+    !(0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_13__/* .doesHealthMatchRequestedConnectionConfig */ .nW)({
       health: healthyDaemon,
       relayUrl,
       canonicalHost: hostArg || '',
@@ -17408,7 +17473,7 @@ async function main() {
     const refreshedHealth = await tryUpdateRunningDaemonRelay(relayUrl);
     if (refreshedHealth) {
       healthyDaemon = refreshedHealth;
-      hasExplicitConfigOverrides = !(0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_12__/* .doesHealthMatchRequestedConnectionConfig */ .nW)({
+      hasExplicitConfigOverrides = !(0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_13__/* .doesHealthMatchRequestedConnectionConfig */ .nW)({
         health: healthyDaemon,
         relayUrl,
         canonicalHost: '',
@@ -17416,10 +17481,10 @@ async function main() {
         localMode: false,
         tailcatEnabled,
       });
-      tailcatMismatch = (0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_12__/* .isTailcatConfigurationMismatch */ .Zg)({ health: healthyDaemon, tailcatEnabled });
+      tailcatMismatch = (0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_13__/* .isTailcatConfigurationMismatch */ .Zg)({ health: healthyDaemon, tailcatEnabled });
     }
   }
-  const existingHealth = (0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_12__/* .shouldReuseHealthyDaemon */ .ZN)({
+  const existingHealth = (0,_vibelet_runtime_policy_mjs__WEBPACK_IMPORTED_MODULE_13__/* .shouldReuseHealthyDaemon */ .ZN)({
     command,
     daemonHealthy: Boolean(healthyDaemon),
     hasExplicitConfigOverrides,
@@ -17431,7 +17496,7 @@ async function main() {
   if (existingHealth) {
     const runningVersion = typeof existingHealth.version === 'string' ? existingHealth.version : '';
     const activeSessions = typeof existingHealth.activeSessions === 'number' ? existingHealth.activeSessions : 0;
-    const isOutdated = runningVersion && compareVersions(runningVersion, packageJson.version) < 0;
+    const isOutdated = runningVersion && (0,_vibelet_value_validation_mjs__WEBPACK_IMPORTED_MODULE_12__/* .compareVersions */ .Z)(runningVersion, packageJson.version) < 0;
     // Only force a driver switch when the user explicitly requested one (flag/env).
     const requestedDriver = process.env.VIBE_CLAUDE_DRIVER ? normalizeDriver(process.env.VIBE_CLAUDE_DRIVER) : null;
     const runningDriver = normalizeDriver(existingHealth.claudeDriverMode);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vibelet",
-  "version": "1.2.221",
+  "version": "1.2.224",
   "description": "Cross-platform CLI for installing and running the Vibelet daemon",
   "homepage": "https://vibelet.icu",
   "files": [