aios-dashboard 0.2.0

package/LICENSE

@@ -0,0 +1,25 @@
+MIT License
+
+Copyright (c) 2026 AIOS Dashboard CLI contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this installer command-line software and associated documentation files
+(the "Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish, distribute,
+sublicense, and/or sell copies of the Software, and to permit persons to whom
+the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+This license applies only to the files distributed in the aios-dashboard npm
+CLI package. It does not license the AIOS Dashboard application downloaded by
+the CLI.

package/README.md

@@ -0,0 +1,91 @@
+# aios-dashboard
+
+Public, dependency-free installer and local process controller for the AIOS
+Dashboard. Requires Node.js 22.22.0 or newer.
+
+This package contains no Dashboard application source. Active members receive a
+short-lived application URL and SHA-256 digest from the AIOS MCP. Claude runs:
+
+```bash
+npx --yes --loglevel=error --package aios-dashboard@0.2.0 aios-dashboard init \
+  --dir /path/to/aios \
+  --source '<signed-MCP-URL>' \
+  --source-sha256 '<64-hex-digest>' \
+  --yes \
+  --start
+```
+
+The CLI verifies the archive before extraction, builds in staging, preserves
+the installed `.env`, `data/`, and `learnings.md` on update, atomically swaps
+the app, starts the production server on loopback, and opens
+`http://127.0.0.1:8080`. It redacts signed URL queries and does not forward them
+through cross-origin redirects. The MCP command also lowers npm's log level so
+npx does not echo the bearer URL in its command notice. Downloads are limited
+to 250 MiB and five minutes; ZIP entry count and expanded size are bounded
+before extraction.
+
+Installation uses exactly pnpm 10.30.3 with `--frozen-lockfile --prod=false`.
+For `node-pty`, Linux needs Python 3, make, and a C/C++ compiler; Windows uses
+its prebuild, and the installer repairs the macOS spawn-helper execute bit. A
+configured member database URL is retained even when it is temporarily
+unreachable.
+
+Bare `npx aios-dashboard init` does not fetch a private GitHub release; it tells
+the member to ask Claude for an entitled install plan. `--ref` exists only for
+maintainer development.
+
+Manage an installed local Dashboard with:
+
+```bash
+npx --yes --package aios-dashboard@0.2.0 aios-dashboard start  --dir /path/to/aios
+npx --yes --package aios-dashboard@0.2.0 aios-dashboard status --dir /path/to/aios
+npx --yes --package aios-dashboard@0.2.0 aios-dashboard open   --dir /path/to/aios
+npx --yes --package aios-dashboard@0.2.0 aios-dashboard stop   --dir /path/to/aios
+```
+
+`AUTH_DISABLED=true` is written only for a local, single-user install and must
+never be exposed publicly. Without a member database, the app opens a setup
+experience and reports live data as not connected rather than as zero.
+Lifecycle ownership is proven with a per-launch loopback runtime token plus OS
+process identity before a live PID is signalled.
+
+## Hosted runner
+
+Connect a member's local Claude Code to their hosted Dashboard:
+
+```bash
+npx --yes --package aios-dashboard@0.2.0 aios-dashboard connect --dir /path/to/aios
+```
+
+The command starts the installed app as a local runner on `127.0.0.1:8099`,
+opens a Cloudflare quick tunnel, and prints a pairing block. Paste the whole
+block into **Settings → Deploy → Connect your computer** in the hosted
+Dashboard. Leave the command running; Ctrl+C disconnects.
+
+Options:
+
+- `--port <port>` — local runner port (default `8099`).
+- `--tunnel-url <origin>` — use a tunnel you already run.
+- `--tunnel-name <name>` and `--tunnel-hostname <host>` — use a stable named
+  Cloudflare tunnel.
+- `--no-download` — do not download cloudflared automatically.
+- `--rotate` — mint a new pairing code and invalidate the old one.
+- `--daemon` — install a systemd (Linux) or launchd (macOS) user service.
+- `--print-pairing` — print the current pairing block without starting.
+- `--dry-run` — show the plan without changing anything.
+
+cloudflared is taken from PATH, this CLI's data directory, or
+`node_modules/.bin`. If absent, the official platform binary is downloaded once
+into the CLI data directory. If that is unavailable, install it yourself or
+pass `--tunnel-url`.
+
+The pairing token is a credential with access to Claude Code in the workspace.
+Do not post it or store it in a shared channel. Runner credentials live outside
+the replaceable app directory with mode `0600`; `connect` forces
+`AUTH_DISABLED=false` and a separate auth secret before exposing any tunnel.
+
+## License boundary
+
+The files in this npm package are MIT-licensed. The private Dashboard application
+downloaded for an entitled member is a separate artifact and is not licensed by
+this package's `LICENSE`.

package/bin/aios-dashboard.mjs

@@ -0,0 +1,17 @@
+#!/usr/bin/env node
+
+import { readFile } from "node:fs/promises";
+import { fileURLToPath } from "node:url";
+import path from "node:path";
+
+import { parseArgs, runInstaller } from "../lib/installer.mjs";
+
+const packagePath = path.join(path.dirname(fileURLToPath(import.meta.url)), "..", "package.json");
+const packageJson = JSON.parse(await readFile(packagePath, "utf8"));
+
+try {
+  await runInstaller(parseArgs(process.argv.slice(2)), packageJson.version);
+} catch (error) {
+  console.error(`aios-dashboard: ${error instanceof Error ? error.message : String(error)}`);
+  process.exitCode = 1;
+}

package/lib/connect.mjs

@@ -0,0 +1,559 @@
+import { spawn } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { existsSync } from "node:fs";
+/**
+ * `aios-dashboard connect` — make the hosted dashboard reach this computer.
+ *
+ * Before this command, connecting was: start the app in local mode with a
+ * hand-made 48-character secret, start a tunnel in a second terminal, copy the
+ * tunnel origin and the secret into the host's environment variables, and
+ * redeploy. Four steps, two terminals, one redeploy, and a secret that
+ * inevitably ends up in shell history.
+ *
+ * Now it is one foreground command that starts the runner, opens the tunnel,
+ * and prints a pairing block to paste into Settings → Deploy. The block carries
+ * the *pairing code* — the same secret in a spelling that survives a copy and
+ * cannot be typo'd — and the hosted copy stores it in the member's own
+ * database, so there is nothing to redeploy.
+ *
+ * ## Why the runner keeps its login wall
+ *
+ * A local install writes `AUTH_DISABLED=true`, which is fine for an app
+ * reachable only from the machine it runs on. A tunnel makes it reachable from
+ * everywhere. This command therefore starts the runner with auth *enabled* and
+ * its own persistent `BETTER_AUTH_SECRET`, so the runner's UI stays behind
+ * sign-in while the bearer token opens exactly the three bridge paths and
+ * nothing else.
+ */
+import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
+import path from "node:path";
+
+import { generatePairingSecret, pairingCodeFromToken } from "./pairing.mjs";
+import {
+  dataDir,
+  dashboardPath,
+  portableCommand,
+  workspacePath,
+} from "./paths.mjs";
+import { choosePackageManager, supportsNode } from "./prerequisites.mjs";
+import { ensureCloudflared, originFromOutput, startTunnel } from "./tunnel.mjs";
+
+export const DEFAULT_RUNNER_PORT = 8099;
+const RUNNER_READY_TIMEOUT_MS = 300_000;
+/** Cloudflare drops quick tunnels without warning; come back, do not give up. */
+const TUNNEL_RESTART_DELAYS_MS = [1_000, 2_000, 5_000, 10_000, 30_000];
+
+export function connectHelpText() {
+  return `Connect this computer to a hosted AIOS Dashboard
+
+Usage:
+  aios-dashboard connect [--dir <workspace>] [--port <port>]
+
+Options:
+  --dir <workspace>       AIOS workspace holding dashboard/ (default: current directory)
+  --port <port>           Local port for the runner (default: ${DEFAULT_RUNNER_PORT})
+  --tunnel-url <origin>   Use a tunnel you already run instead of cloudflared
+  --tunnel-name <name>    Run a named Cloudflare tunnel instead of a quick one
+  --tunnel-hostname <h>   The stable hostname of that named tunnel
+  --no-download           Never fetch cloudflared; fail with instructions instead
+  --rotate                Mint a new pairing code, invalidating the old one
+  --daemon                Install a user service so this survives a reboot
+  --print-pairing         Print the current pairing block and exit
+  --dry-run               Show what would run without starting anything
+  --help, -h              Show this help
+`;
+}
+
+/* ------------------------------------------------------------------ *
+ * The credential, kept out of the app directory on purpose
+ * ------------------------------------------------------------------ */
+
+export function credentialPath(platform = process.platform, env = process.env) {
+  return path.join(dataDir(platform, env), "runner.json");
+}
+
+/**
+ * Read the stored runner credential, or make one.
+ *
+ * It lives in the data dir rather than `dashboard/.env` because
+ * `aios-dashboard init` replaces the app directory on update — a pairing that
+ * lived there would silently die on the next upgrade. Keeping it here also
+ * means a restart does *not* invalidate the pairing: only `--rotate` does, and
+ * that is the documented way to revoke a runner.
+ */
+export async function loadRunnerCredential({
+  rotate = false,
+  platform = process.platform,
+  env = process.env,
+  now = () => new Date().toISOString(),
+  random = randomBytes,
+} = {}) {
+  const file = credentialPath(platform, env);
+  let stored = null;
+  if (!rotate && existsSync(file)) {
+    try {
+      stored = JSON.parse(await readFile(file, "utf8"));
+    } catch {
+      stored = null;
+    }
+  }
+
+  const token =
+    typeof stored?.token === "string" && pairingCodeFromToken(stored.token)
+      ? stored.token
+      : generatePairingSecret(random).token;
+  const authSecret =
+    typeof stored?.authSecret === "string" && stored.authSecret.length >= 32
+      ? stored.authSecret
+      : random(32).toString("hex");
+
+  const record = {
+    token,
+    authSecret,
+    createdAt: stored?.createdAt ?? now(),
+    rotatedAt:
+      rotate || !stored ? now() : (stored.rotatedAt ?? stored.createdAt),
+  };
+
+  await mkdir(path.dirname(file), { recursive: true });
+  await writeFile(file, `${JSON.stringify(record, null, 2)}\n`, {
+    mode: 0o600,
+  });
+  await chmod(file, 0o600).catch(() => undefined);
+
+  return {
+    token: record.token,
+    code: pairingCodeFromToken(record.token),
+    authSecret: record.authSecret,
+    file,
+    rotated: rotate,
+  };
+}
+
+/* ------------------------------------------------------------------ *
+ * What the member copies
+ * ------------------------------------------------------------------ */
+
+/**
+ * The block printed to the terminal.
+ *
+ * Two spellings of the same thing: an `aios://connect` link that the pairing
+ * dialog parses in one paste, and the two fields underneath for anyone whose
+ * terminal mangles long lines. The code is a credential, and the block says so
+ * — the one line of security copy a person will actually read is the one next
+ * to the secret.
+ */
+export function pairingBlock({ origin, code, hostname, workspace }) {
+  const link = `aios://connect?origin=${encodeURIComponent(origin)}&code=${code.replace(/-/g, "")}`;
+  return [
+    "",
+    "  ┌─ Connect your dashboard ───────────────────────────────────",
+    "  │",
+    "  │  In the hosted dashboard, open Settings → Deploy →",
+    '  │  "Connect your computer" and paste this line:',
+    "  │",
+    `  │  ${link}`,
+    "  │",
+    "  │  Or paste the two fields:",
+    `  │    Address       ${origin}`,
+    `  │    Pairing code  ${code}`,
+    "  │",
+    `  │  Runner   ${hostname}${workspace ? ` · ${workspace}` : ""}`,
+    "  │  The pairing code is a password. It lets the dashboard run",
+    "  │  Claude Code in your workspace. Do not paste it anywhere else.",
+    "  │",
+    "  └────────────────────────────────────────────────────────────",
+    "",
+  ].join("\n");
+}
+
+/* ------------------------------------------------------------------ *
+ * The runner process
+ * ------------------------------------------------------------------ */
+
+/**
+ * The environment the runner child gets.
+ *
+ * `AUTH_DISABLED: "false"` is the important line and is set explicitly rather
+ * than deleted, because the value in `dashboard/.env` would otherwise win. See
+ * the file header.
+ */
+export function runnerEnv({ workspace, port, token, authSecret, base = {} }) {
+  return {
+    ...base,
+    AIOS_MODE: "local",
+    AIOS_ROOT: workspace,
+    AIOS_AGENT_RUNNER_TOKEN: token,
+    // A runner must never be a hosted copy's remote target as well.
+    AIOS_AGENT_REMOTE_URL: "",
+    AIOS_AGENT_REMOTE_TOKEN: "",
+    AUTH_DISABLED: "false",
+    BETTER_AUTH_SECRET: authSecret,
+    HOST: "127.0.0.1",
+    PORT: String(port),
+  };
+}
+
+/** `agent-native dev …`, spelled the way each package manager wants it. */
+export function runnerArgs(packageManagerName, port) {
+  const dev = [
+    "agent-native",
+    "dev",
+    "--host",
+    "127.0.0.1",
+    "--port",
+    String(port),
+  ];
+  return packageManagerName === "pnpm"
+    ? ["exec", ...dev]
+    : ["exec", "--", ...dev];
+}
+
+function startRunner({ target, packageManager, env, port, onLine }) {
+  const args = runnerArgs(packageManager.name, port);
+  const invocation = portableCommand(packageManager.command, [
+    ...(packageManager.commandArgs || []),
+    ...args,
+  ]);
+  const child = spawn(invocation.command, invocation.args, {
+    cwd: target,
+    env,
+    stdio: ["ignore", "pipe", "pipe"],
+    shell: false,
+  });
+  const read = (chunk) => onLine(chunk.toString("utf8"));
+  child.stdout?.on("data", read);
+  child.stderr?.on("data", read);
+  return child;
+}
+
+/**
+ * Wait until the runner answers its own `hello` with the token.
+ *
+ * This is a better readiness check than "the port is open": it proves the app
+ * booted in local mode, that bearer auth is wired, and that the token in the
+ * data dir is the one the process is actually using. If this never passes,
+ * nothing downstream would have worked anyway.
+ */
+export async function waitForRunner({
+  port,
+  token,
+  timeoutMs = RUNNER_READY_TIMEOUT_MS,
+  fetchImpl = fetch,
+  sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+  alive = () => true,
+}) {
+  const deadline = Date.now() + timeoutMs;
+  let lastStatus = 0;
+  while (Date.now() < deadline) {
+    if (!alive()) throw new Error("The runner exited before it was ready.");
+    try {
+      const response = await fetchImpl(
+        `http://127.0.0.1:${port}/api/claude-code/hello`,
+        {
+          headers: { Authorization: `Bearer ${token}` },
+          signal: AbortSignal.timeout(20_000),
+        },
+      );
+      lastStatus = response.status;
+      if (response.ok) return await response.json();
+      // 401/403 mean the app is up but disagrees about the credential — no
+      // amount of waiting fixes that, so say it now.
+      if (response.status === 401 || response.status === 403) {
+        throw new Error(
+          `The runner rejected its own token (HTTP ${response.status}). Try \`aios-dashboard connect --rotate\`.`,
+        );
+      }
+    } catch (error) {
+      if (
+        error instanceof Error &&
+        error.message.startsWith("The runner rejected")
+      ) {
+        throw error;
+      }
+      // Still compiling; the first boot of a dev server takes a while.
+    }
+    await sleep(500);
+  }
+  throw new Error(
+    `The runner did not become ready within ${Math.round(timeoutMs / 1000)}s${lastStatus ? ` (last status ${lastStatus})` : ""}.`,
+  );
+}
+
+/* ------------------------------------------------------------------ *
+ * The command
+ * ------------------------------------------------------------------ */
+
+/**
+ * The same origin rule the hosted dashboard applies, checked here so a typo
+ * fails in the terminal rather than as a rejected paste two steps later.
+ * Mirrors `normalizeRunnerOrigin` in `shared/agent-runner-pairing.ts`.
+ */
+export function usableTunnelOrigin(raw) {
+  let url;
+  try {
+    url = new URL(String(raw ?? "").trim());
+  } catch {
+    return false;
+  }
+  const localHttp = url.protocol === "http:" && url.hostname === "localhost";
+  if (url.protocol !== "https:" && !localHttp) return false;
+  return !(
+    url.username ||
+    url.password ||
+    (url.pathname !== "" && url.pathname !== "/") ||
+    url.search ||
+    url.hash
+  );
+}
+
+/** Recognise the line the runner logs when a paired dashboard reaches it. */
+export const RUNNER_AUTHENTICATED_MARKER =
+  "[aios] runner request authenticated";
+
+/** cloudflared chatter that is not a problem the member can act on. */
+export const TUNNEL_NOISE_PATTERN = /receive buffer size|quic-go/i;
+
+/** Runner output worth interrupting a quiet terminal for. */
+export const RUNNER_PROBLEM_PATTERN =
+  /\b(?:EADDRINUSE|ELIFECYCLE|ERR_[A-Z_]+|Cannot find|error:|Error:|failed)\b/;
+
+export async function runConnect(
+  options,
+  { log = console.log, error = console.error } = {},
+) {
+  if (options.help) {
+    log(connectHelpText());
+    return;
+  }
+  if (!supportsNode()) throw new Error("Node.js 22 or newer is required.");
+
+  const workspace = workspacePath(options.dir);
+  const target = dashboardPath(workspace);
+  if (!existsSync(path.join(target, "package.json"))) {
+    throw new Error(
+      `No dashboard found at ${target}. Run \`aios-dashboard init\` in the workspace first.`,
+    );
+  }
+
+  const port = Number(options.port || DEFAULT_RUNNER_PORT);
+  if (!Number.isInteger(port) || port < 1 || port > 65_535) {
+    throw new Error(
+      `--port must be a number between 1 and 65535 (got ${options.port}).`,
+    );
+  }
+
+  if (options.tunnelUrl && !usableTunnelOrigin(options.tunnelUrl)) {
+    throw new Error(
+      `--tunnel-url must be an HTTPS origin with no path (got ${options.tunnelUrl}). Plain HTTP is accepted only for http://localhost:<port>.`,
+    );
+  }
+
+  const credential = await loadRunnerCredential({
+    rotate: options.rotate === true,
+  });
+  if (options.rotate) {
+    log(
+      "Minted a new pairing code. Any dashboard paired with the old one is now disconnected.",
+    );
+  }
+
+  if (options.printPairing) {
+    log(
+      pairingBlock({
+        origin: options.tunnelUrl || "https://<start connect to get one>",
+        code: credential.code,
+        hostname: (await import("node:os")).hostname(),
+        workspace: path.basename(workspace),
+      }),
+    );
+    return;
+  }
+
+  const packageManager = choosePackageManager();
+
+  if (options.dryRun) {
+    log("\naios-dashboard connect plan");
+    log(`  Workspace:   ${workspace}`);
+    log(`  Runner:      ${target} on http://127.0.0.1:${port}`);
+    log(`  Auth:        login wall enabled, secret from ${credential.file}`);
+    log(`  Credential:  ${credential.file} (mode 0600)`);
+    log(
+      `  Tunnel:      ${
+        options.tunnelUrl
+          ? `supplied (${options.tunnelUrl})`
+          : options.tunnelName
+            ? `named cloudflared tunnel "${options.tunnelName}"`
+            : "cloudflared quick tunnel"
+      }`,
+    );
+    log("\nDry run complete; nothing was started.");
+    return;
+  }
+
+  if (options.daemon) {
+    const { installConnectService } = await import("./service.mjs");
+    await installConnectService({ workspace, port, options, log });
+    return;
+  }
+
+  /* ---- runner ---- */
+  // The readiness check below is itself an authenticated request, so the
+  // "Connected" line only means something once a pairing block exists to have
+  // been pasted. Announcing before that would greet the CLI's own probe.
+  let watchingForDashboard = false;
+  let reachedAtLeastOnce = false;
+  const runner = startRunner({
+    target,
+    packageManager,
+    port,
+    env: runnerEnv({
+      workspace,
+      port,
+      token: credential.token,
+      authSecret: credential.authSecret,
+      base: process.env,
+    }),
+    onLine: (text) => {
+      // The runner's own output is otherwise swallowed by this process, which
+      // would leave a member staring at a silent terminal while the app failed
+      // to boot. Anything that looks like a problem is surfaced verbatim.
+      if (RUNNER_PROBLEM_PATTERN.test(text)) error(text.trimEnd());
+      if (!watchingForDashboard || reachedAtLeastOnce) return;
+      if (!text.includes(RUNNER_AUTHENTICATED_MARKER)) return;
+      reachedAtLeastOnce = true;
+      log("Connected · hosted dashboard reached the runner");
+    },
+  });
+
+  let stopping = false;
+  let tunnel = null;
+  const stop = () => {
+    if (stopping) return;
+    stopping = true;
+    tunnel?.kill("SIGTERM");
+    runner.kill("SIGTERM");
+  };
+  process.once("SIGINT", () => {
+    log("\nStopping. The hosted dashboard will show its not-connected state.");
+    stop();
+    process.exitCode = 0;
+  });
+  process.once("SIGTERM", stop);
+  runner.once("exit", (code) => {
+    if (stopping) return;
+    error(`The runner exited with code ${code}.`);
+    stop();
+    process.exitCode = typeof code === "number" ? code : 1;
+  });
+
+  log(`Starting the runner on http://127.0.0.1:${port} …`);
+  const identity = await waitForRunner({
+    port,
+    token: credential.token,
+    alive: () => runner.exitCode === null,
+  }).catch((cause) => {
+    stop();
+    throw cause;
+  });
+  log(
+    `Runner ready · ${identity.hostname}${identity.workspace ? ` · ${identity.workspace}` : ""}${
+      identity.claude ? ` · claude ${identity.claude}` : " · claude not found"
+    }`,
+  );
+  if (!identity.claude) {
+    log(
+      "! The `claude` CLI was not found. Chat and commands will reach this computer and then fail honestly.",
+    );
+  }
+
+  /* ---- tunnel ---- */
+  let origin = options.tunnelUrl ?? null;
+  const openTunnel = async () => {
+    const binary = await ensureCloudflared({
+      allowDownload: options.noDownload !== true,
+      log,
+    });
+    const started = await startTunnel({
+      binary: binary.path,
+      port,
+      name: options.tunnelName ?? null,
+      hostname: options.tunnelHostname ?? null,
+      onLine: (text) => {
+        // Surface only what a person can act on; the rest is cloudflared's
+        // own connection bookkeeping. The UDP receive-buffer notice is loud,
+        // harmless, and not something a member can fix, so it stays quiet.
+        if (TUNNEL_NOISE_PATTERN.test(text)) return;
+        if (/ERR |error=|failed to/i.test(text)) error(text.trim());
+      },
+    });
+    tunnel = started.child;
+    return started.origin;
+  };
+
+  if (!origin) {
+    origin = await openTunnel().catch((cause) => {
+      stop();
+      throw cause;
+    });
+  } else {
+    log(`Using the tunnel you supplied: ${origin}`);
+  }
+
+  const printBlock = (currentOrigin, note) => {
+    if (note) log(note);
+    log(
+      pairingBlock({
+        origin: currentOrigin,
+        code: credential.code,
+        hostname: identity.hostname,
+        workspace: identity.workspace,
+      }),
+    );
+  };
+  printBlock(origin);
+  log("Leave this running. Press Ctrl+C to disconnect.");
+  watchingForDashboard = true;
+
+  /* ---- keep the tunnel alive ---- */
+  if (tunnel) {
+    let attempt = 0;
+    const watch = (child) => {
+      child.once("exit", async () => {
+        if (stopping) return;
+        const delay =
+          TUNNEL_RESTART_DELAYS_MS[
+            Math.min(attempt, TUNNEL_RESTART_DELAYS_MS.length - 1)
+          ];
+        attempt += 1;
+        error(
+          `The tunnel dropped. Reopening in ${Math.round(delay / 1000)}s …`,
+        );
+        await new Promise((resolve) => setTimeout(resolve, delay));
+        if (stopping) return;
+        try {
+          const next = await openTunnel();
+          attempt = 0;
+          if (next === origin) {
+            log("Tunnel reopened on the same address; nothing to re-paste.");
+          } else {
+            origin = next;
+            printBlock(
+              origin,
+              "The tunnel address changed. Paste this block again in Settings → Deploy:",
+            );
+          }
+          watch(tunnel);
+        } catch (cause) {
+          error(cause instanceof Error ? cause.message : String(cause));
+          watch(child);
+        }
+      });
+    };
+    watch(tunnel);
+  }
+
+  await new Promise((resolve) => runner.once("exit", resolve));
+}
+
+export { originFromOutput };