@getforgeai/cli 0.1.0-beta.1

package/dist/vm/providers/vfkit.js

@@ -0,0 +1,371 @@
+import { spawn, execFile } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync, } from "node:fs";
+import { homedir, platform } from "node:os";
+import { join } from "node:path";
+import { promisify } from "node:util";
+import chalk from "chalk";
+import { vmLog } from "../log.js";
+const execFileAsync = promisify(execFile);
+import { createHash } from "node:crypto";
+const VM_BASE_DIR = join(homedir(), ".forgeai", "vm", "instances");
+/**
+ * Generate a unique MAC address from a session ID.
+ * Uses 52:54:00 prefix (QEMU/KVM convention for locally administered MACs)
+ * + 3 bytes derived from hash of the ID.
+ */
+function generateMac(id) {
+    const hash = createHash("md5").update(id).digest("hex");
+    return `52:54:00:${hash.slice(0, 2)}:${hash.slice(2, 4)}:${hash.slice(4, 6)}`;
+}
+/**
+ * Resolve the bundled vfkit binary path.
+ * The binary is vendored at packages/cli/vendor/darwin/vfkit and included in the npm package.
+ * No download needed — it ships with the CLI.
+ */
+function resolveVfkitPath() {
+    // Walk up from dist/vm/providers/ to find vendor/darwin/vfkit
+    // In dev:  packages/cli/src/vm/providers/vfkit.ts → ../../vendor/darwin/vfkit
+    // In dist: packages/cli/dist/vm/providers/vfkit.js → ../../vendor/darwin/vfkit
+    const cliRoot = join(import.meta.dirname, "..", "..", "..");
+    return join(cliRoot, "vendor", "darwin", "vfkit");
+}
+const VFKIT_PATH = resolveVfkitPath();
+const SSH_USER = "ubuntu";
+/**
+ * vfkit provider for macOS.
+ * Uses Apple's Virtualization Framework via the vfkit binary (auto-downloaded).
+ * No brew install needed — single binary CLI.
+ */
+export class VfkitProvider {
+    name = "vfkit";
+    vms = new Map();
+    async isAvailable() {
+        if (platform() !== "darwin")
+            return false;
+        // Check macOS version >= 13 (Ventura) for Virtualization.framework
+        try {
+            const { stdout } = await execFileAsync("sw_vers", ["-productVersion"]);
+            const major = parseInt(stdout.trim().split(".")[0], 10);
+            if (major < 13)
+                return false;
+        }
+        catch {
+            return false;
+        }
+        // Check bundled vfkit binary exists
+        if (!existsSync(VFKIT_PATH)) {
+            vmLog.warn("vfkit", `Bundled vfkit binary not found at ${VFKIT_PATH}`);
+            return false;
+        }
+        return true;
+    }
+    async start(id, config) {
+        // Clean up any stale instance from a previous failed run
+        const existingVm = this.vms.get(id);
+        if (existingVm) {
+            console.log(chalk.dim(`[vfkit] Cleaning up stale VM "${id}" before start`));
+            await this.destroy(id);
+        }
+        const instanceDir = join(VM_BASE_DIR, id);
+        // Remove stale instance dir (previous crash may have left files without a tracked process)
+        if (existsSync(instanceDir)) {
+            rmSync(instanceDir, { recursive: true, force: true });
+        }
+        mkdirSync(instanceDir, { recursive: true, mode: 0o700 });
+        const vsockSocket = join(instanceDir, "vsock.sock");
+        const consoleLog = join(instanceDir, "console.log");
+        const efiVars = join(instanceDir, "efi-vars");
+        // Clone the base disk image per session using APFS copy-on-write (instant on macOS)
+        const diskImage = join(instanceDir, "disk.raw");
+        vmLog.dim("vfkit", `Cloning base image (APFS CoW)...`);
+        try {
+            await execFileAsync("cp", ["-c", config.rootfsPath, diskImage], {
+                timeout: 30_000,
+            });
+        }
+        catch {
+            // Fallback to regular copy if APFS clone not supported (non-APFS volume)
+            vmLog.dim("vfkit", `APFS clone failed, falling back to regular copy...`);
+            await execFileAsync("cp", [config.rootfsPath, diskImage], {
+                timeout: 300_000,
+            });
+        }
+        // Generate SSH key pair for this VM session
+        const sshKeyPath = join(instanceDir, "ssh_key");
+        await execFileAsync("ssh-keygen", [
+            "-t",
+            "ed25519",
+            "-f",
+            sshKeyPath,
+            "-N",
+            "",
+            "-q",
+        ]);
+        const pubKey = readFileSync(`${sshKeyPath}.pub`, "utf-8").trim();
+        // Write per-session cloud-init with the SSH key
+        const userData = `#cloud-config
+ssh_authorized_keys:
+  - ${pubKey}
+hostname: forgeai-agent
+package_update: false
+runcmd:
+  - mkdir -p /workspace
+`;
+        const metaData = `instance-id: ${id}\nlocal-hostname: forgeai-agent\n`;
+        writeFileSync(join(instanceDir, "user-data"), userData);
+        writeFileSync(join(instanceDir, "meta-data"), metaData);
+        vmLog.cyan("vfkit", `Starting VM "${id}" — ${config.cpus} CPUs, ${config.memoryMB}MB RAM`);
+        const args = [
+            "--cpus",
+            String(config.cpus),
+            "--memory",
+            String(config.memoryMB),
+            "--bootloader",
+            `efi,variable-store=${efiVars},create`,
+            "--device",
+            `virtio-blk,path=${diskImage}`,
+            "--device",
+            `virtio-fs,mountTag=session,sharedDir=${config.sessionDir}`,
+            "--device",
+            `virtio-vsock,port=${config.vsockPort},socketURL=${vsockSocket}`,
+            "--device",
+            `virtio-net,nat,mac=${generateMac(id)}`,
+            "--device",
+            `virtio-serial,logFilePath=${consoleLog}`,
+            "--cloud-init",
+            `${join(instanceDir, "user-data")},${join(instanceDir, "meta-data")}`,
+        ];
+        const child = spawn(VFKIT_PATH, args, {
+            stdio: ["ignore", "pipe", "pipe"],
+            detached: true,
+        });
+        if (!child.pid) {
+            throw new Error("Failed to start vfkit — no PID");
+        }
+        // Log stderr for debugging
+        child.stderr?.on("data", (data) => {
+            const text = data.toString().trim();
+            if (text)
+                console.log(chalk.dim(`[vfkit:${id}] ${text}`));
+        });
+        child.on("exit", (code) => {
+            vmLog.dim("vfkit", `VM "${id}" exited (code: ${code})`);
+            this.vms.delete(id);
+        });
+        const vm = {
+            process: child,
+            pid: child.pid,
+            guestIp: "",
+            vsockSocket,
+            instanceDir,
+        };
+        this.vms.set(id, vm);
+        // Discover guest IP and wait for SSH readiness
+        await this.waitForBoot(id);
+        vmLog.info("vfkit", `VM "${id}" running (PID: ${child.pid})`);
+        return {
+            id,
+            status: "RUNNING",
+            pid: child.pid,
+            vsockCid: 3, // vfkit uses vsock Unix socket, CID is implicit
+        };
+    }
+    /**
+     * Discover the guest IP from the ARP table (NAT networking gives 192.168.64.x).
+     */
+    async waitForBoot(id) {
+        const vm = this.vms.get(id);
+        if (!vm)
+            throw new Error(`VM "${id}" not tracked — cannot wait for boot`);
+        const maxWait = 120_000;
+        const interval = 3_000;
+        const start = Date.now();
+        let attempts = 0;
+        while (Date.now() - start < maxWait) {
+            attempts++;
+            const elapsed = Math.round((Date.now() - start) / 1000);
+            vmLog.dim("vfkit", `Waiting for VM "${id}" (attempt ${attempts}, ${elapsed}s elapsed)`);
+            // Get all candidate IPs from ARP table
+            const candidateIps = await this.discoverCandidateIps();
+            // Try SSH on each candidate with OUR key (filters out other VMs)
+            for (const ip of candidateIps) {
+                try {
+                    await execFileAsync("ssh", [
+                        "-o",
+                        "StrictHostKeyChecking=no",
+                        "-o",
+                        "UserKnownHostsFile=/dev/null",
+                        "-o",
+                        "ConnectTimeout=2",
+                        "-o",
+                        "BatchMode=yes",
+                        "-i",
+                        join(vm.instanceDir, "ssh_key"),
+                        `${SSH_USER}@${ip}`,
+                        "echo ready",
+                    ], { timeout: 5_000 });
+                    // SSH works with our key — this is our VM
+                    vm.guestIp = ip;
+                    vmLog.info("vfkit", `VM "${id}" ready (IP: ${ip})`);
+                    return;
+                }
+                catch {
+                    // This IP doesn't accept our key or isn't ready — try next
+                }
+            }
+            await new Promise((resolve) => setTimeout(resolve, interval));
+        }
+        throw new Error(`VM "${id}" boot timeout — SSH not ready after ${maxWait / 1000}s`);
+    }
+    /**
+     * Get all candidate guest IPs from the ARP table (192.168.64.x range).
+     */
+    async discoverCandidateIps() {
+        try {
+            const { stdout } = await execFileAsync("arp", ["-a"], { timeout: 5_000 });
+            const ips = [];
+            for (const match of stdout.matchAll(/\(192\.168\.64\.(\d+)\)/g)) {
+                const ip = `192.168.64.${match[1]}`;
+                if (ip !== "192.168.64.1" && ip !== "192.168.64.255") {
+                    ips.push(ip);
+                }
+            }
+            return ips;
+        }
+        catch {
+            return [];
+        }
+    }
+    async exec(id, cmd, args) {
+        const vm = this.vms.get(id);
+        if (!vm)
+            throw new Error(`VM "${id}" not running`);
+        if (!vm.guestIp)
+            throw new Error(`VM "${id}" has no guest IP — boot may have failed`);
+        const cmdParts = args ? [cmd, ...args] : [cmd];
+        // Shell-escape each argument for SSH remote command
+        const escapedArgs = cmdParts
+            .map((a) => `'${a.replace(/'/g, "'\\''")}'`)
+            .join(" ");
+        try {
+            const { stdout, stderr } = await execFileAsync("ssh", [
+                "-A",
+                "-o",
+                "StrictHostKeyChecking=no",
+                "-o",
+                "UserKnownHostsFile=/dev/null",
+                "-i",
+                join(vm.instanceDir, "ssh_key"),
+                `${SSH_USER}@${vm.guestIp}`,
+                "--",
+                escapedArgs,
+            ], { timeout: 600_000 });
+            return { stdout, stderr, exitCode: 0 };
+        }
+        catch (error) {
+            const execError = error;
+            return {
+                stdout: execError.stdout ?? "",
+                stderr: execError.stderr ?? String(error),
+                exitCode: execError.code ?? 1,
+            };
+        }
+    }
+    /**
+     * Spawn a long-lived process in the VM via SSH with piped stdout/stderr.
+     * Returns the SSH ChildProcess which satisfies AgentProcess.
+     */
+    spawnStreaming(id, cmd, args, cwd, options) {
+        const vm = this.vms.get(id);
+        if (!vm)
+            throw new Error(`VM "${id}" not running`);
+        // Build remote command with cd to cwd
+        const escapedArgs = args
+            .map((a) => `'${a.replace(/'/g, "'\\''")}'`)
+            .join(" ");
+        const cmdStr = args.length > 0 ? `'${cmd}' ${escapedArgs}` : `'${cmd}'`;
+        // Pass ANTHROPIC_API_KEY if explicitly set (overrides everything else)
+        const apiKey = process.env.ANTHROPIC_API_KEY ?? "";
+        const envPrefix = apiKey ? `ANTHROPIC_API_KEY='${apiKey}' ` : "";
+        const remoteCmd = `${envPrefix}cd '${cwd}' && ${cmdStr}`;
+        if (!vm.guestIp)
+            throw new Error(`VM "${id}" has no guest IP`);
+        // Build SSH args with optional reverse tunnels for MCP bridge
+        const tunnelArgs = [];
+        for (const t of options?.reverseTunnels ?? []) {
+            tunnelArgs.push("-R", `${t.remotePort}:localhost:${t.localPort}`);
+        }
+        const sshProcess = spawn("ssh", [
+            "-A",
+            ...tunnelArgs,
+            "-o",
+            "StrictHostKeyChecking=no",
+            "-o",
+            "UserKnownHostsFile=/dev/null",
+            "-o",
+            "ServerAliveInterval=30",
+            "-i",
+            join(vm.instanceDir, "ssh_key"),
+            `${SSH_USER}@${vm.guestIp}`,
+            "--",
+            remoteCmd,
+        ], {
+            stdio: ["ignore", "pipe", "pipe"],
+            detached: false,
+        });
+        if (sshProcess.pid === undefined) {
+            throw new Error("Failed to spawn SSH process — no PID assigned");
+        }
+        return { pid: sshProcess.pid, process: sshProcess };
+    }
+    async stop(id) {
+        const vm = this.vms.get(id);
+        if (!vm)
+            return;
+        vmLog.cyan("vfkit", `Stopping VM "${id}"`);
+        try {
+            vm.process.kill("SIGTERM");
+            await new Promise((resolve) => {
+                const timeout = setTimeout(() => {
+                    if (vm.process.exitCode === null)
+                        vm.process.kill("SIGKILL");
+                    resolve();
+                }, 10_000);
+                vm.process.once("exit", () => {
+                    clearTimeout(timeout);
+                    resolve();
+                });
+            });
+        }
+        catch {
+            // Best-effort
+        }
+        this.vms.delete(id);
+        vmLog.info("vfkit", `VM "${id}" stopped`);
+    }
+    async destroy(id) {
+        await this.stop(id);
+        const instanceDir = join(VM_BASE_DIR, id);
+        if (existsSync(instanceDir)) {
+            rmSync(instanceDir, { recursive: true, force: true });
+        }
+        vmLog.info("vfkit", `VM "${id}" destroyed`);
+    }
+    async getInfo(id) {
+        const vm = this.vms.get(id);
+        if (!vm)
+            return null;
+        return {
+            id,
+            status: vm.process.exitCode === null ? "RUNNING" : "STOPPED",
+            pid: vm.pid,
+        };
+    }
+    getVsockPath(id) {
+        const vm = this.vms.get(id);
+        if (!vm)
+            throw new Error(`VM "${id}" not running — cannot get vsock path`);
+        return vm.vsockSocket;
+    }
+}
+//# sourceMappingURL=vfkit.js.map

package/dist/vm/providers/wsl2.d.ts

@@ -0,0 +1,27 @@
+import { type ChildProcess } from "node:child_process";
+import type { VmConfig, VmInfo, VmProvider, ExecResult } from "../types.js";
+/**
+ * WSL2 provider for Windows.
+ * Manages VM lifecycle using wsl CLI and Windows Hyper-V.
+ */
+export declare class Wsl2Provider implements VmProvider {
+    readonly name = "wsl2";
+    private vms;
+    private vmidMap;
+    isAvailable(): Promise<boolean>;
+    start(id: string, config: VmConfig): Promise<VmInfo>;
+    exec(id: string, cmd: string, args?: string[]): Promise<ExecResult>;
+    stop(id: string): Promise<void>;
+    destroy(id: string): Promise<void>;
+    getInfo(id: string): Promise<VmInfo | null>;
+    getVsockPath(id: string): string;
+    /**
+     * Spawn a long-lived process in the WSL2 distro with piped stdout/stderr.
+     */
+    spawnStreaming(id: string, cmd: string, args: string[], cwd: string): {
+        pid: number;
+        process: ChildProcess;
+    };
+    private generateSetupScript;
+}
+//# sourceMappingURL=wsl2.d.ts.map

package/dist/vm/providers/wsl2.js

@@ -0,0 +1,226 @@
+import { execFile, spawn } from "node:child_process";
+import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { promisify } from "node:util";
+import chalk from "chalk";
+const execFileAsync = promisify(execFile);
+/**
+ * WSL2 provider for Windows.
+ * Manages VM lifecycle using wsl CLI and Windows Hyper-V.
+ */
+export class Wsl2Provider {
+    name = "wsl2";
+    vms = new Map();
+    vmidMap = new Map();
+    async isAvailable() {
+        try {
+            await execFileAsync("wsl", ["--status"]);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    async start(id, config) {
+        const distroName = `forgeai-${id}`;
+        const sessionDir = config.sessionDir;
+        const rootfsDir = join(sessionDir, "rootfs");
+        mkdirSync(rootfsDir, { recursive: true, mode: 0o700 });
+        console.log(chalk.cyan(`[wsl2] Importing distro "${distroName}" from rootfs at ${config.rootfsPath}`));
+        try {
+            await execFileAsync("wsl", [
+                "--import",
+                distroName,
+                rootfsDir,
+                config.rootfsPath,
+            ]);
+        }
+        catch (error) {
+            console.error(chalk.red(`[wsl2] Failed to import distro: ${error instanceof Error ? error.message : String(error)}`));
+            throw error;
+        }
+        const setupScript = this.generateSetupScript(config);
+        const setupPath = join(rootfsDir, ".setup.sh");
+        writeFileSync(setupPath, setupScript, { mode: 0o755 });
+        console.log(chalk.cyan(`[wsl2] Running setup script in "${distroName}"`));
+        try {
+            await execFileAsync("wsl", [
+                "-d",
+                distroName,
+                "--exec",
+                "bash",
+                "/.setup.sh",
+            ]);
+        }
+        catch (error) {
+            console.error(chalk.red(`[wsl2] Setup script failed: ${error instanceof Error ? error.message : String(error)}`));
+            throw error;
+        }
+        const vmid = `vm-${id}`;
+        this.vms.set(id, {
+            distroName,
+            cid: 0,
+            vmid,
+        });
+        this.vmidMap.set(distroName, vmid);
+        console.log(chalk.green(`[wsl2] Distro "${distroName}" started successfully`));
+        return {
+            id,
+            status: "RUNNING",
+            vsockCid: 0,
+        };
+    }
+    async exec(id, cmd, args) {
+        const vm = this.vms.get(id);
+        if (!vm) {
+            return {
+                stdout: "",
+                stderr: `Distro "${id}" not found in running WSL2 distros`,
+                exitCode: 1,
+            };
+        }
+        const cmdParts = args ? [cmd, ...args] : [cmd];
+        try {
+            const { stdout, stderr } = await execFileAsync("wsl", [
+                "-d",
+                vm.distroName,
+                "--",
+                ...cmdParts,
+            ]);
+            return {
+                stdout,
+                stderr,
+                exitCode: 0,
+            };
+        }
+        catch (error) {
+            const execError = error;
+            return {
+                stdout: execError.stdout ?? "",
+                stderr: execError.stderr ?? String(error),
+                exitCode: execError.code ?? 1,
+            };
+        }
+    }
+    async stop(id) {
+        const vm = this.vms.get(id);
+        if (!vm) {
+            console.warn(chalk.yellow(`[wsl2] Distro "${id}" not found`));
+            return;
+        }
+        console.log(chalk.cyan(`[wsl2] Terminating distro "${vm.distroName}"`));
+        try {
+            await execFileAsync("wsl", ["--terminate", vm.distroName]);
+            console.log(chalk.green(`[wsl2] Distro "${vm.distroName}" terminated`));
+        }
+        catch (error) {
+            console.error(chalk.red(`[wsl2] Failed to terminate distro: ${error instanceof Error ? error.message : String(error)}`));
+            throw error;
+        }
+    }
+    async destroy(id) {
+        const vm = this.vms.get(id);
+        if (!vm) {
+            console.warn(chalk.yellow(`[wsl2] Distro "${id}" not found`));
+            return;
+        }
+        console.log(chalk.cyan(`[wsl2] Unregistering distro "${vm.distroName}"`));
+        try {
+            await execFileAsync("wsl", ["--unregister", vm.distroName]);
+            console.log(chalk.green(`[wsl2] Distro "${vm.distroName}" unregistered`));
+        }
+        catch (error) {
+            console.error(chalk.red(`[wsl2] Failed to unregister distro: ${error instanceof Error ? error.message : String(error)}`));
+        }
+        this.vms.delete(id);
+        this.vmidMap.delete(vm.distroName);
+        const instanceDir = join(homedir(), ".forgeai", "vm", "instances", id);
+        if (existsSync(instanceDir)) {
+            rmSync(instanceDir, { recursive: true, force: true });
+        }
+    }
+    async getInfo(id) {
+        const vm = this.vms.get(id);
+        if (!vm)
+            return null;
+        try {
+            const { stdout } = await execFileAsync("wsl", ["--list", "--verbose"]);
+            const lines = stdout.split("\n");
+            const found = lines.some((line) => line.includes(vm.distroName));
+            return {
+                id,
+                status: found ? "RUNNING" : "STOPPED",
+                vsockCid: 0,
+            };
+        }
+        catch {
+            return {
+                id,
+                status: "ERROR",
+                vsockCid: 0,
+            };
+        }
+    }
+    getVsockPath(id) {
+        const vm = this.vms.get(id);
+        if (!vm) {
+            throw new Error(`Distro "${id}" not found in running WSL2 distros`);
+        }
+        // WSL2 uses AF_HYPERV — exposed as TCP for Node.js compatibility
+        return `tcp:127.0.0.1:${6789 + vm.cid}`;
+    }
+    /**
+     * Spawn a long-lived process in the WSL2 distro with piped stdout/stderr.
+     */
+    spawnStreaming(id, cmd, args, cwd) {
+        const vm = this.vms.get(id);
+        if (!vm)
+            throw new Error(`Distro "${id}" not running`);
+        // Build the command to run inside WSL with cd to cwd
+        const remoteCmd = args.length > 0
+            ? `cd '${cwd}' && '${cmd}' ${args.map((a) => `'${a.replace(/'/g, "'\\''")}'`).join(" ")}`
+            : `cd '${cwd}' && '${cmd}'`;
+        const wslProcess = spawn("wsl", ["-d", vm.distroName, "--", "bash", "-c", remoteCmd], {
+            stdio: ["ignore", "pipe", "pipe"],
+            detached: false,
+        });
+        if (wslProcess.pid === undefined) {
+            throw new Error("Failed to spawn WSL process — no PID assigned");
+        }
+        return { pid: wslProcess.pid, process: wslProcess };
+    }
+    generateSetupScript(config) {
+        // Validate CIDR format and generate iptables rules
+        const cidrRegex = /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2}$/;
+        const rules = config.networkAllowlist
+            .filter((rule) => cidrRegex.test(rule.cidr))
+            .map((rule) => `iptables -A OUTPUT -p ${rule.protocol} -d ${rule.cidr} --dport ${rule.port} -j ACCEPT`)
+            .join("\n");
+        return `#!/bin/bash
+set -e
+
+apt-get update -qq
+apt-get install -y -qq iptables openssh-server git
+
+# Default policy: DROP all outbound
+iptables -P OUTPUT DROP
+iptables -P INPUT DROP
+iptables -P FORWARD DROP
+
+# Allow loopback
+iptables -A OUTPUT -o lo -j ACCEPT
+iptables -A INPUT -i lo -j ACCEPT
+
+# Allow established/related connections
+iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
+iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
+
+# Per-rule allowlist (CIDR + port + protocol)
+${rules}
+
+echo "[wsl2] Setup complete"
+`;
+    }
+}
+//# sourceMappingURL=wsl2.js.map