The CLI tunnel startup generated a bootstrap token but discarded it, then built a URL with ?token=<uiPassword> which the tunnel auth system ignores. Remote users always saw 'Tunnel access required' with no way to authenticate. Capture the bootstrap token, build the /connect?t=... URL, and pass it through onTunnelReady so the CLI prints the correct one-time connect link (and QR code).