What versions & operating system are you using?

  System:
    OS: macOS 26.2
    CPU: (8) arm64 Apple M3
    Memory: 1.01 GB / 24.00 GB
    Shell: 5.9 - /bin/zsh
  Binaries:
    Node: 24.12.0 - /opt/homebrew/opt/node@24/bin/node
    npm: 11.6.2 - /opt/homebrew/opt/node@24/bin/npm
  npmPackages:
    @cloudflare/vitest-pool-workers: ^0.12.1 => 0.12.1
    wrangler: ^4.58.0 => 4.58.0

Please provide a link to a minimal reproduction

https://github.com/guidelabs/cloudflared-ci-bug-report/tree/920fde661b1ded82ac1f782f9a87910e3ac467db

Describe the Bug

cloudflared access login runs if remoteBindings are used in vitest (e.g. for vectorize). This happens on this line:

This work on a local machine, but doesn't work in a CI system as it starts a browser and expects us to login. Something we cannot do in a headless CI system. It's unclear how to prevent this. We are already setting the CLOUDFLARE_ACCOUNT_ID and CLOUDFLARE_API_TOKEN. And there is no documentation to be found on what else to do.

In addition to the provided reproduction code the *.{domain}.workers.dev should be behind a Zero Trust access gateway.

I spent some time understanding why cloudflared access login is needed in the first place. In a previous version of wrangler it wasn't required (wrangler 4.33.1 and @cloudflare/vitest-pool-workers ^0.8.69, perhaps related to #10938). But I wasn't able to fully understand it. The RemoteRuntimeController is part of the start. This does the createPreviewSession which then runs getAccessToken (see code links).

We consider not being able to run CI tests a bug. But apologizes if we missed something.

Please provide any relevant error logs

There is no error in the provided example. The issue is that the browser is opened. How can we prevent this via e.g. an environment variable? A more complex example does produce an error.