@stage-labs/metro 0.1.0-beta.21 → 0.1.0-beta.211

package/runtime/node_modules/@metro-labs/daemon/src/metro-user/helper-script.ts

@@ -0,0 +1,126 @@
+export const HELPER_PATH = '/usr/local/lib/metro/root-helper';
+const HELPER_VERSION = 1;
+export const SUDOERS_PATH = '/etc/sudoers.d/metro';
+export const METRO_USER = 'metro';
+const METRO_HOME = '/var/lib/metro';
+
+export const sudoersText = (agent: string): string =>
+  [
+    `${METRO_USER} ALL=(${agent}) NOPASSWD: ALL`,
+    `${METRO_USER} ALL=(root) NOPASSWD: ${HELPER_PATH} *`,
+    `Defaults:${METRO_USER} !requiretty`,
+    '',
+  ].join('\n');
+
+const lines = (...parts: string[]): string => parts.join('\n');
+
+const CHECKS = lines(
+  'AGENT=agent',
+  'UNITS=/etc/systemd/system',
+  'die() { echo "root-helper: $*" >&2; exit 2; }',
+  'agent_uid() { id -u "$AGENT" 2>/dev/null || die "no agent user"; }',
+  'service_ok() {',
+  '  printf %s "$1" | grep -Eq "^[A-Za-z0-9@_.-]+\\.service$" || die "bad service name"',
+  '  case "$1" in metro*) die "not a metro unit";; esac',
+  '  frag=$(systemctl show "$1" -p FragmentPath --value)',
+  '  case "$frag" in "$UNITS"/*) ;; *) die "not a unit under $UNITS";; esac',
+  '  systemctl show "$1" -p TriggeredBy --value | grep -q "\\.timer" || die "not started by a timer"',
+  '}',
+  'dropin_ok() {',
+  '  case "$1" in 10-metro-agent.conf|11-metro-vault.conf) ;; *) die "bad drop-in name";; esac',
+  '  home=$(getent passwd "$AGENT" | cut -d: -f6)',
+  '  saw_user=0',
+  '  while IFS= read -r line; do',
+  '    case "$line" in',
+  '      "[Service]"|"") ;;',
+  '      "User=$AGENT") saw_user=1 ;;',
+  '      Group=*) printf %s "${line#Group=}" | grep -Eq "^[0-9]+$" || die "bad group" ;;',
+  '      "WorkingDirectory=$home"|"WorkingDirectory=$home"/*) ;;',
+  '      Environment=*) ;;',
+  '      "EnvironmentFile=-$home/.metro/vault.env") ;;',
+  '      "ExecStart=") ;;',
+  '      ExecStart=[+!@]*) die "privileged ExecStart refused" ;;',
+  '      ExecStart=*) ;;',
+  '      *) die "line not allowed: $line" ;;',
+  '    esac',
+  '  done < "$2"',
+  '  if [ "$1" = 10-metro-agent.conf ] && [ "$saw_user" != 1 ]; then die "the drop-in must set User=$AGENT"; fi',
+  '}',
+);
+
+const FIREWALL = lines(
+  'firewall_on() {',
+  '  uid=$(agent_uid)',
+  '  for t in iptables ip6tables; do',
+  '    $t -w -N METRO_AGENT 2>/dev/null || true',
+  '    $t -w -F METRO_AGENT',
+  '    $t -w -A METRO_AGENT -o lo -j ACCEPT',
+  '    $t -w -A METRO_AGENT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT',
+  '    $t -w -A METRO_AGENT -p udp --dport 53 -j ACCEPT',
+  '    $t -w -A METRO_AGENT -p tcp --dport 53 -j ACCEPT',
+  '    $t -w -A METRO_AGENT -p tcp -j REJECT --reject-with tcp-reset',
+  '    $t -w -A METRO_AGENT -j REJECT',
+  '    $t -w -C OUTPUT -m owner --uid-owner "$uid" -j METRO_AGENT 2>/dev/null || $t -w -I OUTPUT -m owner --uid-owner "$uid" -j METRO_AGENT',
+  '  done',
+  '}',
+  'firewall_off() {',
+  '  uid=$(agent_uid)',
+  '  for t in iptables ip6tables; do',
+  '    while $t -w -C OUTPUT -m owner --uid-owner "$uid" -j METRO_AGENT 2>/dev/null; do $t -w -D OUTPUT -m owner --uid-owner "$uid" -j METRO_AGENT; done',
+  '    $t -w -F METRO_AGENT 2>/dev/null || true',
+  '    $t -w -X METRO_AGENT 2>/dev/null || true',
+  '  done',
+  '}',
+);
+
+const ACTIONS = lines(
+  'action="${1:-}"; [ "$#" -gt 0 ] && shift',
+  'case "$action" in',
+  `  version) echo ${String(HELPER_VERSION)} ;;`,
+  '  ensure-agent)',
+  '    getent passwd "$AGENT" >/dev/null || useradd --create-home --shell /bin/bash "$AGENT"',
+  '    chmod 700 "$(getent passwd "$AGENT" | cut -d: -f6)" ;;',
+  '  as-agent-scope)',
+  '    [ "$#" -ge 3 ] || die "usage: as-agent-scope <max> <high> <command...>"',
+  '    printf %s "$1$2" | grep -Eq "^[0-9]+$" || die "bad memory limits"',
+  '    max="$1"; high="$2"; shift 2',
+  '    uid=$(agent_uid); gid=$(id -g "$AGENT")',
+  '    exec systemd-run --scope --quiet --collect --unit="metro-claude-$(date +%s%N)" -p MemoryMax="$max" -p MemoryHigh="$high" -p OOMPolicy=continue -- setpriv --reuid="$uid" --regid="$gid" --init-groups -- "$@" ;;',
+  '  dropin-write)',
+  '    service_ok "$1"; tmp=$(mktemp); trap \'rm -f "$tmp"\' EXIT; cat > "$tmp"; dropin_ok "$2" "$tmp"',
+  '    mkdir -p "$UNITS/$1.d"; install -m 644 "$tmp" "$UNITS/$1.d/$2" ;;',
+  '  dropin-remove)',
+  '    service_ok "$1"; case "$2" in 10-metro-agent.conf|11-metro-vault.conf) ;; *) die "bad drop-in name";; esac',
+  '    rm -f "$UNITS/$1.d/$2" ;;',
+  '  daemon-reload) systemctl daemon-reload ;;',
+  '  start-job)',
+  '    service_ok "$1"; [ "$(systemctl show "$1" -p User --value)" = "$AGENT" ] || die "that job does not run as $AGENT"',
+  '    systemctl start --no-block "$1" ;;',
+  '  root-crontab) crontab -l -u root 2>/dev/null || true ;;',
+  '  root-crontab-drop)',
+  '    printf %s "$1" | grep -Eq "^[0-9a-f]{16}$" || die "bad line id"',
+  `    backups="${METRO_HOME}/.metro/agents"`,
+  '    cur=$(mktemp); crontab -l -u root > "$cur" 2>/dev/null || true',
+  '    kept=$(mktemp); found=0',
+  '    while IFS= read -r line; do',
+  '      id=$(printf %s "$line" | sed "s/^[[:space:]]*//;s/[[:space:]]*$//" | tr -d "\\n" | sha256sum | cut -c1-16)',
+  '      if [ "$id" = "$1" ] && [ "$found" = 0 ]; then found=1; elif [ -n "$line" ]; then printf "%s\\n" "$line" >> "$kept"; fi',
+  '    done < "$cur"',
+  '    [ "$found" = 1 ] || die "that cron line is gone"',
+  '    install -m 600 "$cur" "$backups/crontab-root.$(date +%Y-%m-%dT%H-%M-%S).bak"',
+  '    crontab -u root "$kept"; rm -f "$cur" "$kept" ;;',
+  '  firewall-on) firewall_on ;;',
+  '  firewall-off) firewall_off ;;',
+  '  trust-ca)',
+  `    src="${METRO_HOME}/.metro/agents/vault/ca/ca.crt"`,
+  '    head -n1 "$src" | grep -q "BEGIN CERTIFICATE" || die "not a certificate"',
+  '    if grep -q "PRIVATE KEY" "$src"; then die "a key is not a certificate"; fi',
+  '    install -m 644 "$src" /usr/local/share/ca-certificates/metro-vault.crt && update-ca-certificates >/dev/null ;;',
+  '  untrust-ca) rm -f /usr/local/share/ca-certificates/metro-vault.crt; update-ca-certificates --fresh >/dev/null ;;',
+  '  install-nss-tools) DEBIAN_FRONTEND=noninteractive apt-get install -y -q libnss3-tools >/dev/null ;;',
+  '  *) die "unknown action: $action" ;;',
+  'esac',
+);
+
+export const helperScript = (): string =>
+  ['#!/bin/sh', 'set -eu', 'export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', CHECKS, FIREWALL, ACTIONS, ''].join('\n');

package/runtime/node_modules/@metro-labs/daemon/src/metro-user/install.ts

@@ -0,0 +1,37 @@
+import { spawnSync } from 'node:child_process';
+import { chmodSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { HELPER_PATH, helperScript, SUDOERS_PATH, sudoersText } from './helper-script.js';
+import { AGENT_NAME } from '../agent-user/user.js';
+
+interface InstallPaths {
+  helper: string;
+  sudoers: string;
+}
+
+function checked(file: string, args: string[]): void {
+  const run = spawnSync(file, args, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
+  if (run.error !== undefined) throw run.error;
+  if (run.status !== 0) throw new Error(`${file} ${args.join(' ')}: ${`${run.stdout}${run.stderr}`.trim() || `exit ${String(run.status)}`}`);
+}
+
+export function installRootHelper(paths: InstallPaths = { helper: HELPER_PATH, sudoers: SUDOERS_PATH }): void {
+  mkdirSync(dirname(paths.helper), { recursive: true, mode: 0o755 });
+  writeFileSync(paths.helper, helperScript(), { mode: 0o755 });
+  chmodSync(paths.helper, 0o755);
+  const work = mkdtempSync(join(tmpdir(), 'metro-sudoers-'));
+  try {
+    const draft = join(work, 'metro');
+    writeFileSync(draft, sudoersText(AGENT_NAME), { mode: 0o440 });
+    checked('visudo', ['-cf', draft]);
+    checked('install', ['-m', '440', draft, paths.sudoers]);
+  } finally {
+    rmSync(work, { recursive: true, force: true });
+  }
+}
+
+if (import.meta.main) {
+  installRootHelper();
+  process.stdout.write(`metro: wrote ${HELPER_PATH} and ${SUDOERS_PATH}\n`);
+}

package/runtime/node_modules/@metro-labs/daemon/src/metro-user/privilege.ts

@@ -0,0 +1,48 @@
+import { spawnSync } from 'node:child_process';
+import { HELPER_PATH, METRO_USER } from './helper-script.js';
+
+export interface PrivilegeHost {
+  platform: string;
+  uid: number | undefined;
+  user: string;
+}
+
+let metroUid: number | null | undefined;
+
+function uidOfMetro(): number | null {
+  if (metroUid !== undefined) return metroUid;
+  const run = spawnSync('getent', ['passwd', METRO_USER], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+  const uid = Number(run.status === 0 ? run.stdout.split(':')[2] : NaN);
+  metroUid = Number.isInteger(uid) && uid > 0 ? uid : null;
+  return metroUid;
+}
+
+const realHost = (): PrivilegeHost => {
+  const uid = process.getuid?.();
+  const linux = process.platform === 'linux';
+  return { platform: process.platform, uid, user: linux && uid !== 0 && uid !== undefined && uid === uidOfMetro() ? METRO_USER : '' };
+};
+
+export const runningAsRoot = (host: PrivilegeHost = realHost()): boolean => host.platform === 'linux' && host.uid === 0;
+
+export const runningAsMetro = (host: PrivilegeHost = realHost()): boolean =>
+  host.platform === 'linux' && host.uid !== 0 && host.user === METRO_USER;
+
+export interface HelperResult {
+  status: number | null;
+  stdout: string;
+  stderr: string;
+}
+
+export function rootHelper(args: string[], input?: string): HelperResult {
+  const run = spawnSync('sudo', ['-n', HELPER_PATH, ...args], { encoding: 'utf8', input, stdio: ['pipe', 'pipe', 'pipe'], timeout: 180_000 });
+  return { status: run.error === undefined ? run.status : null, stdout: run.stdout ?? '', stderr: run.stderr ?? run.error?.message ?? '' };
+}
+
+export function mustHelper(args: string[], input?: string): string {
+  const run = rootHelper(args, input);
+  if (run.status !== 0) throw new Error(run.stderr.trim() || `root-helper ${args[0] ?? ''} failed`);
+  return run.stdout;
+}
+
+export const helperArgv = (args: string[]): [string, string[]] => ['sudo', ['-n', HELPER_PATH, ...args]];

package/runtime/node_modules/@metro-labs/daemon/src/monitor/api.ts

@@ -0,0 +1,132 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { errMsg, log } from '@metro-labs/core/log';
+import { subscribeEvents, type MetroEvent } from '@metro-labs/core/events';
+import { eventInScope } from '../agents/scope.js';
+import { hasAnyKey } from '../agents/keys.js';
+import {
+  allowedAgents,
+  authenticate,
+} from '../mcp/request-identity.js';
+
+const KEEPALIVE_MS = 25_000;
+
+const monitorEnabled = (): boolean => hasAnyKey();
+
+function cors(req: IncomingMessage): Record<string, string> {
+  return {
+    'access-control-allow-origin': req.headers.origin ?? '*',
+    'access-control-allow-methods': 'GET, OPTIONS',
+    'access-control-allow-headers': 'Authorization, Content-Type',
+    'access-control-max-age': '86400',
+    vary: 'Origin',
+  };
+}
+
+function sendJson(
+  res: ServerResponse,
+  req: IncomingMessage,
+  status: number,
+  body: unknown,
+): void {
+  res.writeHead(status, { 'content-type': 'application/json', ...cors(req) });
+  res.end(JSON.stringify(body));
+}
+
+function startTailStream(
+  req: IncomingMessage,
+  res: ServerResponse,
+  allowed: Set<string>,
+): void {
+  res.writeHead(200, {
+    'content-type': 'text/event-stream',
+    'cache-control': 'no-cache, no-transform',
+    connection: 'keep-alive',
+    'x-accel-buffering': 'no',
+    ...cors(req),
+  });
+  const timers: { keepalive?: ReturnType<typeof setInterval> } = {};
+  const subs: { stop?: () => void } = {};
+  let done = false;
+  const cleanup = (): void => {
+    if (done) return;
+    done = true;
+    subs.stop?.();
+    if (timers.keepalive) clearInterval(timers.keepalive);
+    try {
+      res.end();
+    } catch {
+      log.debug('monitor: tail cleanup end failed');
+    }
+  };
+  const write = (chunk: string): void => {
+    if (done) return;
+    if (res.destroyed || res.writableEnded) {
+      cleanup();
+      return;
+    }
+    try {
+      res.write(chunk);
+    } catch (err) {
+      log.debug({ err: errMsg(err) }, 'monitor: tail write failed');
+      cleanup();
+    }
+  };
+  write(': metro monitor tail (live)\n\n');
+  let id = 0;
+  subs.stop = subscribeEvents((e: MetroEvent): void => {
+    if (!eventInScope(allowed, e.line)) return;
+    id += 1;
+    write(`id: ${id}\nevent: live\ndata: ${JSON.stringify(e)}\n\n`);
+  });
+  timers.keepalive = setInterval(() => {
+    write(': keepalive\n\n');
+  }, KEEPALIVE_MS);
+  timers.keepalive.unref?.();
+  req.on('close', cleanup);
+  req.on('error', cleanup);
+}
+
+function routeApi(
+  req: IncomingMessage,
+  res: ServerResponse,
+  path: string,
+  allowed: Set<string>,
+): void {
+  if (path === '/api/tail') {
+    if (req.method !== 'GET') {
+      sendJson(res, req, 405, { error: 'method not allowed' });
+      return;
+    }
+    startTailStream(req, res, allowed);
+    return;
+  }
+  sendJson(res, req, 404, { error: 'not found' });
+}
+
+function preflight(req: IncomingMessage, res: ServerResponse): boolean {
+  if (!monitorEnabled()) {
+    sendJson(res, req, 404, { error: 'not found' });
+    return true;
+  }
+  if (req.method === 'OPTIONS') {
+    res.writeHead(204, cors(req)).end();
+    return true;
+  }
+  return false;
+}
+
+export function handleMonitorRequest(
+  req: IncomingMessage,
+  res: ServerResponse,
+): boolean {
+  const path = (req.url ?? '').split('?', 2)[0] ?? '';
+  if (!path.startsWith('/api/')) return false;
+  if (preflight(req, res)) return true;
+  const identity = authenticate(req);
+  if (!identity) {
+    sendJson(res, req, 401, { error: 'unauthorized' });
+    return true;
+  }
+  routeApi(req, res, path, allowedAgents(identity));
+  return true;
+}

package/runtime/node_modules/@metro-labs/daemon/src/net/tunnel.ts

@@ -0,0 +1,316 @@
+import { execFile, spawn, type ChildProcess } from 'node:child_process';
+import { Resolver } from 'node:dns/promises';
+import { request as httpsRequest } from 'node:https';
+import { errMsg, log } from '@metro-labs/core/log';
+import { localOwner } from '../agents/file-admin.js';
+
+const RESTART_DELAY_MS = 2_000;
+const RESTART_DELAY_MAX_MS = 30_000;
+const TAKEN_RE = /listener already exists/i;
+const ADOPTED_MISSES = 2;
+const adoptedCheckMs = (): number => Number(process.env.METRO_TUNNEL_WATCH_MS) || 30_000;
+const FUNNEL_ON_RE = /\(Funnel on\)/i;
+
+export const tunnelWanted = (): boolean => process.env.METRO_TUNNEL?.trim() === 'tailscale';
+
+const FUNNEL_URL_RE = /https:\/\/[a-z0-9-]+(?:\.[a-z0-9-]+)+\.ts\.net(?::\d{2,5})?(?=[\s/]|$)/i;
+const SILENT_MS = 20_000;
+
+export const funnelUrlIn = (text: string): string | null =>
+  FUNNEL_URL_RE.exec(text)?.[0]?.toLowerCase() ?? null;
+
+export interface Adopted {
+  url: string | null;
+  hint: string;
+  alive?: () => Promise<boolean>;
+}
+
+export interface TunnelDriver {
+  name: string;
+  command: string;
+  args: string[];
+  urlIn: (text: string) => string | null;
+  adopt?: () => Promise<Adopted>;
+}
+
+const runText = (command: string, args: string[]): Promise<string> =>
+  new Promise((resolve) => {
+    execFile(command, args, { encoding: 'utf8', timeout: 10_000 }, (_err, stdout, stderr) => {
+      resolve(`${stdout}\n${stderr}`);
+    });
+  });
+
+export type Probe = (url: string, owner: string | null) => Promise<boolean>;
+
+const PROBE_MS = 5_000;
+const PUBLIC_RESOLVERS = ['1.1.1.1', '8.8.8.8'];
+
+async function publicAddresses(host: string): Promise<string[]> {
+  const found = await Promise.all(
+    PUBLIC_RESOLVERS.map(async (server) => {
+      const resolver = new Resolver();
+      resolver.setServers([server]);
+      const [v4, v6] = await Promise.all([resolver.resolve4(host).catch(() => []), resolver.resolve6(host).catch(() => [])]);
+      return [...v4, ...v6];
+    }),
+  );
+  return [...new Set(found.flat())];
+}
+
+function modeThrough(ip: string, host: string): Promise<{ mode?: unknown; owner?: unknown } | null> {
+  return new Promise((resolve) => {
+    const req = httpsRequest(
+      { host: ip, servername: host, port: 443, path: '/api/mode', method: 'GET', headers: { host }, timeout: PROBE_MS },
+      (res) => {
+        const chunks: Buffer[] = [];
+        res.on('data', (c: Buffer) => chunks.push(c));
+        res.on('end', () => {
+          try {
+            resolve(res.statusCode === 200 ? (JSON.parse(Buffer.concat(chunks).toString('utf8')) as { mode?: unknown }) : null);
+          } catch {
+            resolve(null);
+          }
+        });
+      },
+    );
+    req.on('timeout', () => {
+      req.destroy();
+    });
+    req.on('error', () => {
+      resolve(null);
+    });
+    req.end();
+  });
+}
+
+async function daemonAnswersAt(url: string, owner: string | null): Promise<boolean> {
+  const host = new URL(url).host;
+  const addresses = await publicAddresses(host);
+  if (addresses.length === 0) return false;
+  const body = await modeThrough(addresses[0] ?? '', host);
+  return body !== null && body.mode === 'local' && (owner === null || body.owner === owner);
+}
+
+export function nodeNameIn(statusJson: string): string | null {
+  try {
+    const parsed: unknown = JSON.parse(statusJson);
+    const self = typeof parsed === 'object' && parsed !== null ? (parsed as { Self?: { DNSName?: unknown } }).Self : undefined;
+    const name = typeof self?.DNSName === 'string' ? self.DNSName.replace(/\.$/, '').toLowerCase() : '';
+    return name === '' ? null : name;
+  } catch {
+    return null;
+  }
+}
+
+async function adoptFunnel(bin: string, port: number, probe: Probe, owner: () => string | null): Promise<Adopted> {
+  const name = nodeNameIn(await runText(bin, ['status', '--json']));
+  const watched = (url: string): Adopted => ({
+    url,
+    hint: `a Funnel already publishes this daemon at ${url}; using it`,
+    alive: () => probe(url, owner()),
+  });
+  if (name !== null) {
+    const url = `https://${name}`;
+    if (await probe(url, owner())) return watched(url);
+  }
+  const found = funnelAlreadyServing(await runText(bin, ['funnel', 'status']), port);
+  return found.url === null ? found : watched(found.url);
+}
+
+export function funnelAlreadyServing(status: string, port: number): Adopted {
+  const lines = status.split('\n');
+  const target = `http://127.0.0.1:${String(port)}`;
+  for (const [i, line] of lines.entries()) {
+    if (line.trimStart().startsWith('#')) continue;
+    const url = funnelUrlIn(line);
+    if (url === null) continue;
+    const body = lines.slice(i + 1, i + 6).join('\n');
+    if (!body.includes(target)) continue;
+    if (FUNNEL_ON_RE.test(line)) return { url, hint: `a Funnel already publishes this daemon at ${url}; using it` };
+    return {
+      url: null,
+      hint: `${url} is a tailnet-only serve config on this node, not a Funnel; run: tailscale serve reset`,
+    };
+  }
+  return { url: null, hint: 'port 443 is held by another serve config on this node; run: tailscale serve reset' };
+}
+
+function tailscaleBin(): string {
+  const configured = process.env.METRO_TAILSCALE_BIN?.trim() ?? '';
+  return configured === '' ? 'tailscale' : configured;
+}
+
+export const funnelDriver = (
+  port: number,
+  bin = tailscaleBin(),
+  probe: Probe = daemonAnswersAt,
+  owner: () => string | null = localOwner,
+): TunnelDriver => ({
+  name: 'tailscale funnel',
+  command: bin,
+  args: ['funnel', String(port)],
+  urlIn: funnelUrlIn,
+  adopt: () => adoptFunnel(bin, port, probe, owner),
+});
+
+let liveUrl: string | null = null;
+
+export const currentTunnelUrl = (): string | null => liveUrl;
+
+export type Resolves = (host: string) => Promise<boolean>;
+
+const RESOLVE_EVERY_MS = 3_000;
+const RESOLVE_GIVE_UP_MS = 180_000;
+
+async function resolvesPublicly(host: string): Promise<boolean> {
+  return (await publicAddresses(host)).length > 0;
+}
+
+async function untilResolvable(host: string, resolves: Resolves): Promise<boolean> {
+  const deadline = Date.now() + RESOLVE_GIVE_UP_MS;
+  while (Date.now() < deadline) {
+    if (await resolves(host)) return true;
+    await new Promise((r) => setTimeout(r, RESOLVE_EVERY_MS));
+  }
+  return false;
+}
+
+
+export class Tunnel {
+  private child: ChildProcess | null = null;
+  private closed = false;
+  private output: string[] = [];
+  private restartDelay = RESTART_DELAY_MS;
+  private watch: ReturnType<typeof setInterval> | null = null;
+
+  constructor(
+    private driver: TunnelDriver,
+    private onUrl: (url: string) => void = () => undefined,
+    private resolves: Resolves = resolvesPublicly,
+  ) {}
+
+  private noticeUrl(text: string): void {
+    const url = this.driver.urlIn(text);
+    if (url === null || url === liveUrl) return;
+    liveUrl = url;
+    this.restartDelay = RESTART_DELAY_MS;
+    log.info({ url }, `${this.driver.name} up; waiting for its name to resolve`);
+    this.announceWhenResolvable(url).catch((err: unknown) => {
+      log.warn({ err: errMsg(err) }, `${this.driver.name}: announce failed`);
+    });
+  }
+
+  private async announceWhenResolvable(url: string): Promise<void> {
+    const resolved = await untilResolvable(new URL(url).host, this.resolves);
+    if (liveUrl !== url) return;
+    if (!resolved) log.warn({ url }, `${this.driver.name} name still not resolving; announcing anyway`);
+    this.onUrl(url);
+  }
+
+  private read(d: Buffer | string): void {
+    const text = (typeof d === 'string' ? d : d.toString('utf8')).trim();
+    if (text === '') return;
+    this.output.push(text);
+    log.debug({ output: text }, this.driver.name);
+    this.noticeUrl(text);
+  }
+
+  private silentCheck(): void {
+    if (this.closed || liveUrl !== null || this.child === null) return;
+    log.warn(
+      { output: this.output.join('\n') },
+      `${this.driver.name}: no public address after ${String(SILENT_MS / 1000)}s; its own output follows`,
+    );
+  }
+
+  start(): void {
+    if (this.closed) return;
+    log.info({ command: this.driver.command, args: this.driver.args }, `${this.driver.name} starting`);
+    this.output = [];
+    const child = spawn(this.driver.command, this.driver.args, { stdio: ['ignore', 'pipe', 'pipe'] });
+    this.child = child;
+    child.stdout?.on('data', (d: Buffer | string) => {
+      this.read(d);
+    });
+    child.stderr?.on('data', (d: Buffer | string) => {
+      this.read(d);
+    });
+    setTimeout(() => {
+      this.silentCheck();
+    }, SILENT_MS).unref();
+    child.on('exit', (code) => {
+      this.child = null;
+      liveUrl = null;
+      if (this.closed) return;
+      this.afterExit(code).catch((err: unknown) => {
+        log.warn({ err: errMsg(err) }, `${this.driver.name}: exit handling failed`);
+      });
+    });
+    child.on('error', (err) => {
+      if ((err as NodeJS.ErrnoException).code === 'ENOENT') {
+        this.closed = true;
+        log.error(
+          { command: this.driver.command },
+          `${this.driver.name}: the binary is not installed, so there is no public address; install it and restart`,
+        );
+        return;
+      }
+      log.warn({ err: errMsg(err) }, `${this.driver.name} spawn error`);
+    });
+  }
+
+  private async afterExit(code: number | null): Promise<void> {
+    const output = this.output.join('\n');
+    if (this.driver.adopt !== undefined && TAKEN_RE.test(output)) {
+      const found = await this.driver.adopt();
+      if (this.closed) return;
+      if (found.url !== null) {
+        log.info({ url: found.url }, `${this.driver.name}: ${found.hint}`);
+        this.noticeUrl(found.url);
+        if (found.alive !== undefined) this.watchAdopted(found.url, found.alive);
+        return;
+      }
+      log.error({ output }, `${this.driver.name}: ${found.hint}`);
+    } else log.warn({ code, output: this.output.slice(-5).join('\n') }, `${this.driver.name} exited; restarting`);
+    setTimeout(() => {
+      this.start();
+    }, this.restartDelay);
+    this.restartDelay = Math.min(this.restartDelay * 2, RESTART_DELAY_MAX_MS);
+  }
+
+  private watchAdopted(url: string, alive: () => Promise<boolean>): void {
+    let misses = 0;
+    const tick = async (): Promise<void> => {
+      if (this.closed || liveUrl !== url) {
+        this.unwatch();
+        return;
+      }
+      misses = (await alive()) ? 0 : misses + 1;
+      if (misses < ADOPTED_MISSES) return;
+      this.unwatch();
+      log.warn({ url }, `${this.driver.name}: the Funnel this daemon adopted no longer answers; publishing our own`);
+      liveUrl = null;
+      this.restartDelay = RESTART_DELAY_MS;
+      this.start();
+    };
+    this.unwatch();
+    this.watch = setInterval(() => {
+      tick().catch((err: unknown) => {
+        log.warn({ err: errMsg(err) }, `${this.driver.name}: adopted-funnel check failed`);
+      });
+    }, adoptedCheckMs());
+    this.watch.unref();
+  }
+
+  private unwatch(): void {
+    if (this.watch !== null) clearInterval(this.watch);
+    this.watch = null;
+  }
+
+  stop(): void {
+    this.closed = true;
+    this.unwatch();
+    this.child?.kill('SIGINT');
+    this.child = null;
+  }
+}