@llmtune/cli 0.1.0 → 0.1.1

package/dist/tools/registry.js

@@ -0,0 +1,77 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ToolRegistry = void 0;
+exports.createTool = createTool;
+const validation_1 = require("./validation");
+class ToolInstance {
+    def;
+    constructor(def) { this.def = def; }
+    spec() {
+        return {
+            name: this.def.name,
+            description: this.def.description,
+            inputSchema: this.def.inputSchema,
+            isReadOnly: this.def.isReadOnly,
+            isDestructive: this.def.isDestructive,
+        };
+    }
+    run(input, ctx) {
+        return this.def.run(input, ctx);
+    }
+}
+function createTool(def) {
+    return new ToolInstance(def);
+}
+class ToolRegistry {
+    tools = new Map();
+    register(tool) {
+        const spec = tool.spec();
+        const key = spec.name.toLowerCase();
+        if (this.tools.has(key)) {
+            throw new Error(`duplicate tool name: ${spec.name}`);
+        }
+        this.tools.set(key, tool);
+    }
+    listSpecs() {
+        return Array.from(this.tools.values()).map((t) => t.spec());
+    }
+    get(name) {
+        return this.tools.get(name.toLowerCase());
+    }
+    dispatch(name, input, ctx) {
+        const tool = this.get(name);
+        if (!tool) {
+            return { name, output: { error: `unknown tool: ${name}` }, isError: true };
+        }
+        const spec = tool.spec();
+        try {
+            (0, validation_1.validateJsonSchema)(input, spec.inputSchema);
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            return { name: spec.name, output: { error: msg }, isError: true };
+        }
+        const result = tool.run(input, ctx);
+        if (result instanceof Promise) {
+            throw new Error("Async tools not supported in sync dispatch. Use dispatchAsync instead.");
+        }
+        return result;
+    }
+    async dispatchAsync(name, input, ctx) {
+        const tool = this.get(name);
+        if (!tool) {
+            return { name, output: { error: `unknown tool: ${name}` }, isError: true };
+        }
+        const spec = tool.spec();
+        try {
+            (0, validation_1.validateJsonSchema)(input, spec.inputSchema);
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            return { name: spec.name, output: { error: msg }, isError: true };
+        }
+        return tool.run(input, ctx);
+    }
+}
+exports.ToolRegistry = ToolRegistry;
+//# sourceMappingURL=registry.js.map

package/dist/tools/sandbox/docker.d.ts

@@ -0,0 +1,16 @@
+import type { ToolResult } from "../protocol";
+export interface SandboxConfig {
+    enabled: boolean;
+    image: string;
+    timeoutMs: number;
+    readOnlyPaths: string[];
+    maxMemoryMB: number;
+}
+export declare const DEFAULT_SANDBOX_CONFIG: SandboxConfig;
+export declare function configureSandbox(config: Partial<SandboxConfig>): void;
+export declare function isSandboxEnabled(): boolean;
+export declare function isDockerAvailable(): Promise<boolean>;
+export declare function ensureSandboxImage(): Promise<boolean>;
+export declare function runInSandbox(command: string, cwd: string): Promise<ToolResult>;
+export declare function writeFileInSandbox(filePath: string, content: string, cwd: string): Promise<ToolResult>;
+//# sourceMappingURL=docker.d.ts.map

package/dist/tools/sandbox/docker.js

@@ -0,0 +1,240 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_SANDBOX_CONFIG = void 0;
+exports.configureSandbox = configureSandbox;
+exports.isSandboxEnabled = isSandboxEnabled;
+exports.isDockerAvailable = isDockerAvailable;
+exports.ensureSandboxImage = ensureSandboxImage;
+exports.runInSandbox = runInSandbox;
+exports.writeFileInSandbox = writeFileInSandbox;
+/**
+ * Docker-based tool sandbox for enterprise deployments.
+ * Isolates bash and file write operations inside a Docker container
+ * to prevent accidental or malicious damage to the host system.
+ */
+const child_process_1 = require("child_process");
+const util_1 = require("util");
+const path = __importStar(require("path"));
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
+const SANDBOX_IMAGE = "llmtune-sandbox:latest";
+const SANDBOX_WORKDIR = "/workspace";
+const EXECUTION_TIMEOUT_MS = 60_000;
+const MAX_OUTPUT_BYTES = 100_000;
+exports.DEFAULT_SANDBOX_CONFIG = {
+    enabled: false,
+    image: SANDBOX_IMAGE,
+    timeoutMs: EXECUTION_TIMEOUT_MS,
+    readOnlyPaths: [],
+    maxMemoryMB: 512,
+};
+let sandboxConfig = { ...exports.DEFAULT_SANDBOX_CONFIG };
+function configureSandbox(config) {
+    sandboxConfig = { ...sandboxConfig, ...config };
+}
+function isSandboxEnabled() {
+    return sandboxConfig.enabled;
+}
+async function isDockerAvailable() {
+    try {
+        const { stdout } = await execFileAsync("docker", ["--version"], {
+            timeout: 5000,
+        });
+        return /docker/i.test(stdout);
+    }
+    catch {
+        return false;
+    }
+}
+async function ensureSandboxImage() {
+    try {
+        const { stdout } = await execFileAsync("docker", ["images", "-q", sandboxConfig.image], {
+            timeout: 10000,
+        });
+        if (stdout.trim())
+            return true;
+        // Pull the image if not found
+        console.log(`Pulling sandbox image: ${sandboxConfig.image}...`);
+        await execFileAsync("docker", ["pull", sandboxConfig.image], {
+            timeout: 120_000,
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function runInSandbox(command, cwd) {
+    if (!sandboxConfig.enabled) {
+        return {
+            name: "sandbox",
+            output: { error: "Sandbox is not enabled" },
+            isError: true,
+        };
+    }
+    const dockerAvailable = await isDockerAvailable();
+    if (!dockerAvailable) {
+        return {
+            name: "sandbox",
+            output: { error: "Docker is not available. Install Docker to use sandbox mode." },
+            isError: true,
+        };
+    }
+    const workspaceMount = `${path.resolve(cwd)}:${SANDBOX_WORKDIR}`;
+    const memoryLimit = `${sandboxConfig.maxMemoryMB}m`;
+    const timeout = Math.min(sandboxConfig.timeoutMs, 120_000);
+    const args = [
+        "run",
+        "--rm",
+        "--network", "none",
+        "--memory", memoryLimit,
+        "--cpus", "1",
+        "--timeout", String(Math.ceil(timeout / 1000)),
+        "-v", `${workspaceMount}:ro`,
+        "--workdir", SANDBOX_WORKDIR,
+        sandboxConfig.image,
+        "sh", "-c", command,
+    ];
+    try {
+        const { stdout, stderr } = await execFileAsync("docker", args, {
+            timeout: timeout + 10_000,
+            maxBuffer: MAX_OUTPUT_BYTES,
+        });
+        let output = "";
+        if (stdout)
+            output += truncateOutput(stdout);
+        if (stderr) {
+            output += "\n--- stderr ---\n";
+            output += truncateOutput(stderr);
+        }
+        return {
+            name: "sandbox",
+            output: {
+                stdout: output.trim(),
+                exit_code: 0,
+                sandboxed: true,
+            },
+            isError: false,
+        };
+    }
+    catch (err) {
+        const execErr = err;
+        let output = "";
+        if (execErr.stdout)
+            output += truncateOutput(execErr.stdout);
+        if (execErr.stderr) {
+            output += "\n--- stderr ---\n";
+            output += truncateOutput(execErr.stderr);
+        }
+        if (execErr.killed) {
+            output += `\n--- Process killed (timeout or memory limit) ---`;
+        }
+        return {
+            name: "sandbox",
+            output: {
+                stdout: output.trim(),
+                exit_code: typeof execErr.code === "number" ? execErr.code : 1,
+                sandboxed: true,
+                timed_out: execErr.killed ?? false,
+            },
+            isError: true,
+        };
+    }
+}
+async function writeFileInSandbox(filePath, content, cwd) {
+    if (!sandboxConfig.enabled) {
+        return {
+            name: "sandbox",
+            output: { error: "Sandbox is not enabled" },
+            isError: true,
+        };
+    }
+    // Write to a temp file on host, then copy into container
+    const tmpDir = path.join(os.tmpdir(), "llmtune-sandbox");
+    fs.mkdirSync(tmpDir, { recursive: true });
+    const tmpFile = path.join(tmpDir, `write-${Date.now()}.tmp`);
+    fs.writeFileSync(tmpFile, content, "utf-8");
+    try {
+        const absTarget = path.resolve(cwd, filePath);
+        const containerPath = `${SANDBOX_WORKDIR}/${path.relative(cwd, absTarget).replace(/\\/g, "/")}`;
+        const workspaceMount = `${path.resolve(cwd)}:${SANDBOX_WORKDIR}`;
+        const dockerArgs = [
+            "run",
+            "--rm",
+            "--network", "none",
+            "--memory", `${sandboxConfig.maxMemoryMB}m`,
+            "-v", `${workspaceMount}`,
+            "-v", `${tmpFile}:/tmp/write-content.tmp:ro`,
+            "--workdir", SANDBOX_WORKDIR,
+            sandboxConfig.image,
+            "sh", "-c", `mkdir -p "$(dirname '${containerPath}')" && cp /tmp/write-content.tmp '${containerPath}'`,
+        ];
+        await execFileAsync("docker", dockerArgs, { timeout: 30_000 });
+        return {
+            name: "sandbox",
+            output: {
+                type: "text",
+                filePath,
+                bytesWritten: Buffer.byteLength(content, "utf-8"),
+                sandboxed: true,
+            },
+            isError: false,
+        };
+    }
+    catch (err) {
+        return {
+            name: "sandbox",
+            output: { error: `Sandbox write failed: ${err.message}` },
+            isError: true,
+        };
+    }
+    finally {
+        try {
+            fs.unlinkSync(tmpFile);
+        }
+        catch {
+            // cleanup failure is non-critical
+        }
+    }
+}
+function truncateOutput(output) {
+    if (output.length > 50_000) {
+        return output.slice(0, 50_000) + "\n... (truncated)";
+    }
+    return output;
+}
+//# sourceMappingURL=docker.js.map

package/dist/tools/sandbox/index.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Sandbox manager: decides when to use Docker isolation vs local execution.
+ *
+ * Modes:
+ * - "off"       — all tools run locally (default)
+ * - "available" — use Docker when available, fall back to local
+ * - "required"  — require Docker for destructive tools (enterprise mode)
+ */
+import type { ToolResult } from "../protocol";
+export type SandboxMode = "off" | "available" | "required";
+export declare function getSandboxMode(): SandboxMode;
+export declare function setSandboxMode(mode: SandboxMode): void;
+export declare function isDockerAvailable(): boolean;
+/**
+ * Execute a bash command, optionally in a Docker sandbox.
+ */
+export declare function sandboxedExec(command: string, cwd: string, timeout: number): Promise<ToolResult>;
+//# sourceMappingURL=index.d.ts.map

package/dist/tools/sandbox/index.js

@@ -0,0 +1,80 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getSandboxMode = getSandboxMode;
+exports.setSandboxMode = setSandboxMode;
+exports.isDockerAvailable = isDockerAvailable;
+exports.sandboxedExec = sandboxedExec;
+const docker_1 = require("./docker");
+let sandboxMode = "off";
+let dockerAvailable = null;
+function getSandboxMode() {
+    return sandboxMode;
+}
+function setSandboxMode(mode) {
+    sandboxMode = mode;
+    dockerAvailable = null; // re-check on next use
+}
+function isDockerAvailable() {
+    if (dockerAvailable !== null)
+        return dockerAvailable;
+    // Quick check: can we run `docker info`?
+    try {
+        const { execSync } = require("child_process");
+        execSync("docker info", { timeout: 3000, stdio: "pipe" });
+        dockerAvailable = true;
+    }
+    catch {
+        dockerAvailable = false;
+    }
+    return dockerAvailable;
+}
+/**
+ * Execute a bash command, optionally in a Docker sandbox.
+ */
+async function sandboxedExec(command, cwd, timeout) {
+    if (sandboxMode === "off") {
+        return localExec(command, cwd, timeout);
+    }
+    if (sandboxMode === "available" && !isDockerAvailable()) {
+        return localExec(command, cwd, timeout);
+    }
+    if (sandboxMode === "required" && !isDockerAvailable()) {
+        return {
+            name: "bash",
+            output: {
+                error: "Enterprise mode requires Docker but Docker is not available. Install Docker or disable enterprise mode.",
+            },
+            isError: true,
+        };
+    }
+    return (0, docker_1.runInSandbox)(command, cwd);
+}
+function localExec(command, cwd, timeout) {
+    const { execSync } = require("child_process");
+    try {
+        const stdout = execSync(command, {
+            cwd,
+            timeout,
+            maxBuffer: 1024 * 1024 * 10,
+            encoding: "utf-8",
+            shell: process.platform === "win32" ? "cmd.exe" : "/bin/bash",
+        });
+        return { name: "bash", output: { stdout: stdout || "(no output)", exitCode: 0 }, isError: false };
+    }
+    catch (err) {
+        const e = err;
+        let output = "";
+        if (e.stdout)
+            output += String(e.stdout).slice(0, 50_000);
+        if (e.stderr)
+            output += "\n--- stderr ---\n" + String(e.stderr).slice(0, 50_000);
+        if (e.killed)
+            output += `\n--- Process timed out after ${timeout}ms ---`;
+        return {
+            name: "bash",
+            output: { stdout: output.trim(), exitCode: e.status ?? 1 },
+            isError: true,
+        };
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/tools/tools/ask-user.d.ts

@@ -0,0 +1,3 @@
+import type { Tool } from "../protocol";
+export declare const askUserTool: Tool;
+//# sourceMappingURL=ask-user.d.ts.map

package/dist/tools/tools/ask-user.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.askUserTool = void 0;
+const readline_1 = require("readline");
+exports.askUserTool = {
+    spec() {
+        return {
+            name: "ask_user",
+            description: "Ask the user a question and wait for their response. Use when you need clarification, confirmation, or additional information before proceeding.",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    question: {
+                        type: "string",
+                        description: "The question to ask the user",
+                    },
+                    options: {
+                        type: "array",
+                        items: { type: "string" },
+                        description: "Optional list of choices for the user to pick from",
+                    },
+                },
+                required: ["question"],
+            },
+            isReadOnly: true,
+        };
+    },
+    async run(input, _ctx) {
+        const question = String(input.question ?? "");
+        if (!question) {
+            return { name: "ask_user", output: { error: "question is required" }, isError: true };
+        }
+        const options = Array.isArray(input.options) ? input.options.map(String) : [];
+        if (options.length > 0) {
+            console.log(`\n  ${question}`);
+            options.forEach((opt, i) => console.log(`    ${i + 1}. ${opt}`));
+            console.log();
+        }
+        else {
+            console.log(`\n  ${question}\n`);
+        }
+        const rl = (0, readline_1.createInterface)({ input: process.stdin, output: process.stdout });
+        const answer = await new Promise((resolve) => {
+            rl.question("  > ", (ans) => {
+                rl.close();
+                resolve(ans.trim());
+            });
+        });
+        return {
+            name: "ask_user",
+            output: { question, answer, selectedOption: options.length > 0 ? parseInt(answer) || 0 : undefined },
+            isError: false,
+        };
+    },
+};
+//# sourceMappingURL=ask-user.js.map

package/dist/tools/tools/bash.d.ts

@@ -0,0 +1,3 @@
+import type { Tool } from "../protocol";
+export declare const bashTool: Tool;
+//# sourceMappingURL=bash.d.ts.map

package/dist/tools/tools/bash.js

@@ -0,0 +1,85 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.bashTool = void 0;
+const child_process_1 = require("child_process");
+const util_1 = require("util");
+const execAsync = (0, util_1.promisify)(child_process_1.exec);
+const MAX_OUTPUT = 50_000;
+const TIMEOUT_MS = 120_000;
+exports.bashTool = {
+    spec() {
+        return {
+            name: "bash",
+            description: "Execute a shell command. Returns stdout, stderr, and exit code. Use for running builds, tests, git commands, and other shell operations.",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    command: {
+                        type: "string",
+                        description: "The command to execute",
+                    },
+                    timeout: {
+                        type: "number",
+                        description: "Optional timeout in ms (default 120000, max 300000)",
+                    },
+                },
+                required: ["command"],
+            },
+            isReadOnly: false,
+            isDestructive: true,
+        };
+    },
+    async run(input, _ctx) {
+        const command = String(input.command ?? "");
+        const timeout = Math.min(typeof input.timeout === "number" ? input.timeout : TIMEOUT_MS, 300_000);
+        if (!command.trim()) {
+            return { name: "bash", output: { error: "command is required" }, isError: true };
+        }
+        try {
+            const { stdout, stderr } = await execAsync(command, {
+                maxBuffer: 1024 * 1024 * 10,
+                timeout,
+                shell: process.platform === "win32" ? "cmd" : "/bin/bash",
+            });
+            let output = "";
+            if (stdout) {
+                output += stdout.length > MAX_OUTPUT
+                    ? stdout.slice(0, MAX_OUTPUT) + "\n... (truncated)"
+                    : stdout;
+            }
+            if (stderr) {
+                output += "\n--- stderr ---\n";
+                output += stderr.length > MAX_OUTPUT
+                    ? stderr.slice(0, MAX_OUTPUT) + "\n... (truncated)"
+                    : stderr;
+            }
+            return {
+                name: "bash",
+                output: { stdout: output.trim(), exit_code: 0 },
+                isError: false,
+            };
+        }
+        catch (err) {
+            const e = err;
+            const stdout = e.stdout || "";
+            const stderr = e.stderr || "";
+            const exitCode = typeof e.code === "number" ? e.code : 1;
+            let output = "";
+            if (stdout)
+                output += stdout.slice(0, MAX_OUTPUT);
+            if (stderr) {
+                output += "\n--- stderr ---\n";
+                output += stderr.slice(0, MAX_OUTPUT);
+            }
+            if (e.killed) {
+                output += `\n--- Process timed out after ${timeout}ms ---`;
+            }
+            return {
+                name: "bash",
+                output: { stdout: output.trim(), exit_code: exitCode },
+                isError: true,
+            };
+        }
+    },
+};
+//# sourceMappingURL=bash.js.map

package/dist/tools/tools/edit.d.ts

@@ -0,0 +1,3 @@
+import type { Tool } from "../protocol";
+export declare const editTool: Tool;
+//# sourceMappingURL=edit.d.ts.map