The CLI tunnel startup generated a bootstrap token but discarded it,
then built a URL with ?token=<uiPassword> which the tunnel auth system
ignores. Remote users always saw 'Tunnel access required' with no way
to authenticate.
Capture the bootstrap token, build the /connect?t=... URL, and pass it
through onTunnelReady so the CLI prints the correct one-time connect
link (and QR code).
Node's ESM loader rejects bare Windows paths (e.g. C:\...) passed to
dynamic import(), interpreting the drive letter as a URL protocol.
Convert the package-manager.js path through pathToFileURL() to produce
a valid file:// URL, matching the fix already applied to the server
import on line 628.
plfavreau