cloudflared

# Cloudflared Use Cloudflared as the default public tunnel for sandbox app previews. Prefer a Cloudflare quick tunnel for temporary sharing; use a named tunnel only when the operator explicitly needs a stable hostname or Cloudflare Access policy. ## Arguments Arguments received: `$ARGUMENTS` - `PORT`: first positional argument; required (example: `3000`) - `--host`: local upstream host; default `127.0.0.1` - `--name`: optional slug for the tmux/log suffix; default is the port - `--session`: optional tmux session name override; default `cloudflared-<slug>` If `PORT` is missing, ask which local port to tunnel. ## Pre-flight — confirm the public surface (do NOT assume) A dev stack usually listens on **several** ports where only ONE is the intended public surface (e.g. a web UI on `:3005`, a browser-editor gateway on `:8788`, a metrics port, a DB). Picking the wrong one wastes a tunnel and can expose the wrong service. Before starting a tunnel: 1. If the caller did not name the service explicitly, **list the listening ports and ask which service is meant to be public** — never default to "the web port". `ss -ltnp` or the project's dev docs disambiguate. 2. A quick-tunnel URL is a **public bearer URL** — anyone with it reaches the origin. If the target is not a throwaway static preview (it has auth, webhooks, an admin surface, or real data), get an explicit go-ahead before exposing it. ## Quick tunnel flow Run inside the sandbox, after the app is already ...