dsh-plugin-local-infer 0.1.2 → 0.1.4

package/packages/providers/lib/vram.d.ts

@@ -1,11 +1,14 @@
 /**
- * NInfer VramModel data. The measured memory constants for the two Qwen
- * artifacts NInfer serves, ported from `docs/config-calculator.html` in the
- * NInfer fork: every byte figure is measured on an RTX 3090 (24 GiB, sm_86,
- * CUDA 12.8) against the engine's own capacity report, not estimated from
- * parameter counts. The provenance note on each model names the exact weight
- * artifact the figures apply to, because the runtime also recognizes other
- * weight profiles with different resident sizes.
+ * VramModel data for the engines the card prices. The NInfer models are the
+ * measured memory constants for the two Qwen artifacts NInfer serves, ported
+ * from `docs/config-calculator.html` in the NInfer fork: every byte figure is
+ * measured on an RTX 3090 (24 GiB, sm_86, CUDA 12.8) against the engine's own
+ * capacity report, not estimated from parameter counts. The provenance note on
+ * each model names the exact weight artifact the figures apply to, because the
+ * runtime also recognizes other weight profiles with different resident sizes.
+ * The Basalt models are the estimated sets for the engine's `.basalt`
+ * artifacts: the measured figures are not yet available, so their terms are
+ * estimated from the model size and flagged `source: 'estimated'`.
  * @module dsh-plugin-local-infer/providers/vram
  */
 import type { VramModel } from 'dsh-plugin-local-infer/core';
@@ -21,4 +24,27 @@ export declare const NINFER_VRAM_MODELS: readonly VramModel[];
  * Resolves one NInfer VramModel by its registry id, e.g. `qwen3-27b`.
  */
 export declare function ninferVramModel(modelId: string): VramModel | undefined;
-//# sourceMappingURL=vram.d.ts.map
+/**
+ * The Basalt estimated VramModels, one per `.basalt` artifact the engine
+ * serves.
+ *
+ * The first is the Qwen3.8-Flash-Next NVFP4 artifact
+ * (`Qwen3.8-FN-NVFP4-DQ6_K.basalt`). The measured figures are not yet
+ * available, so every term is estimated from the model size, not measured
+ * against the engine: the weights price a ~48B-total-parameter MoE in NVFP4
+ * (0.5 bytes per parameter, ~24 GiB), and the KV per-token terms price a
+ * 48-layer, 8-KV-head, 128-head-dim GQA layout across the four KV formats
+ * Basalt serves (fp16, int8, q4_0, k8v4). The `source: 'estimated'` flag is
+ * what keeps the meter from reading these as authoritative.
+ *
+ * Basalt's `spec` setting is a token-window count (a number), not a named
+ * speculation backend, so neither model carries a `speculation` table or a
+ * `specKey`: the estimator prices them from the base terms.
+ */
+export declare const BASALT_VRAM_MODELS: readonly VramModel[];
+/**
+ * Resolves a Basalt VramModel by its registry id, `qwen38-flash-next` or
+ * `deepseek-v41-flash`.
+ */
+export declare function basaltVramModel(modelId: string): VramModel | undefined;
+//# sourceMappingURL=vram.d.ts.map

package/packages/providers/lib/vram.js

@@ -1,13 +1,17 @@
 /**
- * NInfer VramModel data. The measured memory constants for the two Qwen
- * artifacts NInfer serves, ported from `docs/config-calculator.html` in the
- * NInfer fork: every byte figure is measured on an RTX 3090 (24 GiB, sm_86,
- * CUDA 12.8) against the engine's own capacity report, not estimated from
- * parameter counts. The provenance note on each model names the exact weight
- * artifact the figures apply to, because the runtime also recognizes other
- * weight profiles with different resident sizes.
+ * VramModel data for the engines the card prices. The NInfer models are the
+ * measured memory constants for the two Qwen artifacts NInfer serves, ported
+ * from `docs/config-calculator.html` in the NInfer fork: every byte figure is
+ * measured on an RTX 3090 (24 GiB, sm_86, CUDA 12.8) against the engine's own
+ * capacity report, not estimated from parameter counts. The provenance note on
+ * each model names the exact weight artifact the figures apply to, because the
+ * runtime also recognizes other weight profiles with different resident sizes.
+ * The Basalt models are the estimated sets for the engine's `.basalt`
+ * artifacts: the measured figures are not yet available, so their terms are
+ * estimated from the model size and flagged `source: 'estimated'`.
  * @module dsh-plugin-local-infer/providers/vram
  */
+import { BASALT_DEEPSEEK_MODEL_ID, BASALT_DEFAULT_MODEL_ID, } from "./engines/basalt/basalt.js";
 /**
  * DFlash2's CUDA-graph allowance is a step in context, measured at 8,192 /
  * 16,384 / 32,768: 288 MiB up to 8,192 tokens and 384 MiB beyond. Only three
@@ -247,4 +251,73 @@ export const NINFER_VRAM_MODELS = [
 export function ninferVramModel(modelId) {
     return NINFER_VRAM_MODELS.find(model => model.id === modelId);
 }
-//# sourceMappingURL=vram.js.map
+/**
+ * The Basalt estimated VramModels, one per `.basalt` artifact the engine
+ * serves.
+ *
+ * The first is the Qwen3.8-Flash-Next NVFP4 artifact
+ * (`Qwen3.8-FN-NVFP4-DQ6_K.basalt`). The measured figures are not yet
+ * available, so every term is estimated from the model size, not measured
+ * against the engine: the weights price a ~48B-total-parameter MoE in NVFP4
+ * (0.5 bytes per parameter, ~24 GiB), and the KV per-token terms price a
+ * 48-layer, 8-KV-head, 128-head-dim GQA layout across the four KV formats
+ * Basalt serves (fp16, int8, q4_0, k8v4). The `source: 'estimated'` flag is
+ * what keeps the meter from reading these as authoritative.
+ *
+ * Basalt's `spec` setting is a token-window count (a number), not a named
+ * speculation backend, so neither model carries a `speculation` table or a
+ * `specKey`: the estimator prices them from the base terms.
+ */
+export const BASALT_VRAM_MODELS = [
+    {
+        id: BASALT_DEFAULT_MODEL_ID,
+        source: 'estimated',
+        weightsBytes: 24000000000,
+        workspaceBytes: 536870912,
+        nativeMaxContext: 262144,
+        seqFixedBytes: 10485760,
+        seqPerToken: 0.0625,
+        kvBytesPerToken: {
+            fp16: 196608,
+            int8: 98304,
+            q4_0: 49152,
+            k8v4: 73728,
+        },
+    },
+    // The DeepSeek-V4.1-Flash UD-IQ1_M pack
+    // (`DeepSeek-V4.1-Flash-1017-UD-IQ1_M.basalt`). Every term is estimated
+    // from the public pack facts, like the Qwen row. The weights: the native
+    // checkpoint is ~510 GB of BF16 dense plus MXFP4 expert weights, a
+    // ~6.8 bits-per-weight average, which prices ~600B weights; the pack
+    // requantizes them to UD-IQ1_M's ~1.7 bits per weight, ~1.3e11 bytes
+    // (~121 GiB) resident. The checkpoint's other ~393 GB of engram lookup
+    // tables stream from RAM and file, so they add no resident weights and no
+    // term prices them. The KV: the pack has no KV-format choice, so the
+    // engine's single format is priced under the `fp16` key the kv surface
+    // defaults to; a DeepSeek latent-KV (MLA-family) layout carries ~576
+    // fp16 elements per layer (~1152 bytes), and ~46080 bytes per token is
+    // that order at ~40 attention layers, the compact pool that makes the
+    // pack's 1,048,576-token cap a ~48 GB KV pool at all. The workspace,
+    // fixed-session, and per-token activation terms ride at the Blackwell
+    // order for a model this size, a few times the Qwen estimates.
+    {
+        id: BASALT_DEEPSEEK_MODEL_ID,
+        source: 'estimated',
+        weightsBytes: 130000000000,
+        workspaceBytes: 1073741824,
+        nativeMaxContext: 1048576,
+        seqFixedBytes: 33554432,
+        seqPerToken: 0.125,
+        kvBytesPerToken: {
+            fp16: 46080,
+        },
+    },
+];
+/**
+ * Resolves a Basalt VramModel by its registry id, `qwen38-flash-next` or
+ * `deepseek-v41-flash`.
+ */
+export function basaltVramModel(modelId) {
+    return BASALT_VRAM_MODELS.find(model => model.id === modelId);
+}
+//# sourceMappingURL=vram.js.map

package/packages/providers/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin-local-infer-providers",
-  "version": "0.1.0",
+  "version": "0.1.4",
   "description": "Concrete providers for the dsh local-inference plugin: the ninfer, hyperqwen, llamacpp, and strata engine adapters, the NInfer VramModel, the built-in presets, the built-in guidelines, and the per-OS SystemDep install command data. Each registers itself with ctx.localInfer.",
   "keywords": [
     "dsh",
@@ -38,6 +38,6 @@
     "@deepseek-ai/cordis": ">=4.0.1"
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "^4.0.1"
+    "@deepseek-ai/cordis": "^4.0.6-alpha.2"
   }
 }

package/packages/service/lib/index.d.ts

@@ -18,9 +18,12 @@
  * @module dsh-plugin-local-infer/service
  */
 import { Context, Service } from '@deepseek-ai/cordis';
-import type { Config, DefaultModel, ModelDirectoryEntry, EngineAdapter, EngineDepPlan, EnginePlatformConfig, GpuUsageProbe, Guideline, GuidelineResult, HardwareProfile, HardwareProbes, InstallResult, LaunchPlan, ModelRow, Preset, PresetSource, ProcessLine, ProviderLaunchRecord, ProviderRef, ProviderStatus, ReLinkOutcome, RegisterResult, ReserveResolution, ResolvedDefaults, SystemDep, VramModel } from 'dsh-plugin-local-infer/core';
-import type { DetectOsReserveOptions, DownloadModelOptions, DownloadResult, EngineDeathEvent, EstimateResult, FetchPresetOptions, FetchPresetResult, HfCliOptions, LaunchOptions, LaunchResult, LocalInferService, ProviderStatusOptions, RegisterModelOptions } from './types.ts';
-export type { DetectOsReserveOptions, DownloadModelOptions, DownloadResult, EngineDeathEvent, EstimateResult, FetchPresetOptions, FetchPresetResult, HfCliOptions, LaunchOptions, LaunchResult, LocalInferService, ProviderStatusOptions, RegisterModelOptions, SettingsDescribeResult, SettingsForms, SettingsNamespaceDescriptor, } from './types.ts';
+import type { BuildMode, CommandLogger, CommandOutcome, CommandRunner, Config, DefaultModel, ModelCacheEntry, ModelDirectoryEntry, EngineAdapter, EngineDepPlan, EnginePlatformConfig, GpuUsageProbe, Guideline, GuidelineResult, HardwareProfile, HardwareProbes, InstallResult, LaunchPlan, ModelRow, Preset, PresetSource, ProcessLine, ProviderLaunchRecord, ProviderRef, ProviderStatus, ReLinkOutcome, RegisterResult, ReserveResolution, ResolvedDefaults, SudoGuard, SystemDep, VramModel } from 'dsh-plugin-local-infer/core';
+import type { DetectOsReserveOptions, DownloadModelOptions, DownloadResult, EngineDeathEvent, EstimateResult, FetchPresetOptions, FetchPresetResult, HfCliOptions, LaunchOptions, LaunchResult, LocalInferService, ProviderStatusOptions, RegisterModelOptions, RunInstallOptions, RunLogListener, RunLogSnapshot } from './types.ts';
+import { RunLogStore, runLogKey } from './run-logs.ts';
+import { findLaunchTarget } from './launch-target.ts';
+export { RunLogStore, runLogKey, findLaunchTarget };
+export type { DetectOsReserveOptions, DownloadModelOptions, DownloadResult, EngineDeathEvent, EstimateResult, FetchPresetOptions, FetchPresetResult, HfCliOptions, LaunchOptions, LaunchResult, LaunchTargetEntry, LocalInferService, ProviderStatusOptions, RegisterModelOptions, RunInstallOptions, RunLogAppendEvent, RunLogEndEvent, RunLogEvent, RunLogListener, RunLogResetEvent, RunLogSnapshot, SettingsDescribeResult, SettingsForms, SettingsNamespaceDescriptor, } from './types.ts';
 declare module '@deepseek-ai/cordis' {
     interface Context {
         localInfer: LocalInferService;
@@ -53,7 +56,11 @@ export declare class LocalInfer extends Service implements LocalInferService {
     private readonly launchedPorts;
     private readonly engineWatchers;
     private readonly handledPids;
+    private readonly launchingEngines;
+    private readonly stoppingEngines;
     private deathObserver;
+    private readonly sudoObservers;
+    private readonly runLogs;
     constructor(ctx: Context);
     registerEngine(adapter: EngineAdapter): () => void;
     registerPreset(preset: Preset): () => void;
@@ -139,14 +146,16 @@ export declare class LocalInfer extends Service implements LocalInferService {
      */
     providerStatuses(providers: readonly ProviderRef[], options?: ProviderStatusOptions): Promise<Record<string, ProviderStatus>>;
     /**
-     * unsureBannerKillCommands returns the bash kill commands for the engine
+     * unsureBannerKillCommands returns the stop commands for the engine
      * processes the detector saw holding VRAM, for the "unsure" banner the card
      * shows when no provider is confirmed running but at least one reads as
      * unsure. A process is included when its command line carries an engine
      * binary marker and the card's VRAM usage is above 30% of the total (the
      * threshold below which a foreign engine is not considered to be holding
-     * the card). The commands are one `kill <pid>` per matching process, in
-     * pid order. An empty list means no matching process was seen, so the
+     * the card). The command form switches on the host OS: one
+     * `Stop-Process -Id <pid>` per matching process on Windows (the PowerShell
+     * cmdlet the banner's text area runs), one `kill <pid>` on Linux and macOS,
+     * in pid order. An empty list means no matching process was seen, so the
      * banner's text area renders empty.
      */
     unsureBannerKillCommands(options?: {
@@ -166,21 +175,32 @@ export declare class LocalInfer extends Service implements LocalInferService {
      * deps resolves the host deps an engine's deploy step needs for a build
      * mode. A registered adapter that declares systemDeps wins; the provider-
      * registered plan for the engine id is the fallback, and an engine with
-     * neither plans an empty list (nothing to install, the gate passes).
+     * neither plans an empty list (nothing to install, the gate passes). The
+     * local list is per-OS: a Windows host reads the plan's windows entry (the
+     * winget toolchain the providers sourced from the Windows profile), every
+     * other host reads the linux entry, so the System dependencies section
+     * shows the right toolchain for the host.
      */
-    deps(engineId: string, buildMode: 'docker' | 'local', hw: HardwareProfile): Promise<readonly SystemDep[]>;
+    deps(engineId: string, buildMode: BuildMode, hw: HardwareProfile): Promise<readonly SystemDep[]>;
     /**
      * installString renders the copy/paste block for the resolved dep plan,
      * keyed to the detected package manager, with the by-hand note for a dep
      * the manager has no commands for.
      */
-    installString(engineId: string, buildMode: 'docker' | 'local', hw: HardwareProfile): Promise<string>;
+    installString(engineId: string, buildMode: BuildMode, hw: HardwareProfile): Promise<string>;
     /**
      * runInstall is the Play/Run path: it runs the resolved dep plan's commands
-     * through the shell runner and re-probes each dep. The runner captures the
-     * per-command exit, so a failure names the command that broke.
-     */
-    runInstall(engineId: string, buildMode: 'docker' | 'local', hw: HardwareProfile): Promise<InstallResult>;
+     * through the guarded shell runner and re-probes each dep. The runner
+     * captures the per-command exit, so a failure names the command that broke,
+     * and a declared-sudo command whose probe finds no cached credentials
+     * announces the CLI prompt through the sudo observer and fails at the
+     * sudo deadline. options.onLog is the install run's log sink: the command
+     * line reaches it as a `$ <command>` line before the guarded runner spawns
+     * the child (and before the sudo guard's probe announces), so the run text
+     * carries the command ahead of the per-dep results. options.runner injects
+     * the command runner so a test reads the command lines without a real shell.
+     */
+    runInstall(engineId: string, buildMode: BuildMode, hw: HardwareProfile, options?: RunInstallOptions): Promise<InstallResult>;
     /**
      * launch is the lifecycle entry point: it resolves the adapter that rendered
      * the plan (by the plan's engineId), runs the adapter's deploy step (build
@@ -221,6 +241,60 @@ export declare class LocalInfer extends Service implements LocalInferService {
      * clears it, which the route's effect does on dispose.
      */
     setEngineDeathObserver(observer: ((event: EngineDeathEvent) => void) | undefined): void;
+    /**
+     * registerSudoObserver reserves `key`'s slot (the runLogKey rule every run
+     * path shares) for one run's hook for commands the sudo guard found
+     * waiting for a password on the launching CLI: the observer lands core's
+     * SUDO_CLI_NOTE line while the command waits. Registering a key that is
+     * taken replaces the old hook (a re-launch under the same key owns the
+     * note), and the disposer removes only its own hook, so a stale run's
+     * settle never clears a live one's routing. The run calls the disposer in
+     * a finally.
+     */
+    registerSudoObserver(key: string, observer: (command: string) => void): () => void;
+    /**
+     * notifySudoNeeded announces one guarded command to every registered sudo
+     * observer (the shared CLI password wait can block any run, and the
+     * announce seam does not name the run that triggered it). A throwing
+     * observer is isolated per announce: the note is a log courtesy, and a
+     * broken route must not fail the install that is already racing the sudo
+     * deadline. Published on the service surface so a command runner outside
+     * this package (the providers' lifecycle host) reports through the same
+     * seam.
+     */
+    notifySudoNeeded(command: string): void;
+    /**
+     * beginRun starts one provider process's live run-log run under the key
+     * runLogKey names: the buffer resets to the seed separator line, the
+     * running flag goes true, the seq restarts, and subscribers get the reset
+     * notice a mid-run attached reader needs to replace its display.
+     */
+    beginRun(key: string, seed: string): void;
+    /**
+     * appendRunLog appends one chunk to the key's live log (tail-capped to
+     * LOG_TAIL_BYTES) and notifies subscribers. Appending with no open run
+     * opens one lazily without a seed, so a late note (an engine-death line)
+     * still lands.
+     */
+    appendRunLog(key: string, text: string): void;
+    /**
+     * readRunLog answers the key's catch-up snapshot: the seq reached, the
+     * bounded tail text, and the running flag, the data a mid-run page
+     * refresh or a late-opened Logs pane renders from.
+     */
+    readRunLog(key: string): RunLogSnapshot;
+    /**
+     * subscribeRunLog registers a listener for the key's run-log events and
+     * returns the disposer (the route calls it when its stream closes).
+     * Listeners are independent per connection; none can block a writer.
+     */
+    subscribeRunLog(key: string, listener: RunLogListener): () => void;
+    /**
+     * endRun settles the key's run: the running flag clears and subscribers
+     * get the end event. The text stays readable until the next beginRun, so
+     * a late Logs pane still shows the finished run.
+     */
+    endRun(key: string): void;
     /**
      * watchLaunchedHandle ties a launched child's one-shot exit to the live
      * state: the host's close/error event (a crash, a pkill, or the stop kill)
@@ -238,6 +312,13 @@ export declare class LocalInfer extends Service implements LocalInferService {
      * record dead.
      */
     private watchAdoptedEngine;
+    /**
+     * engineKey is the in-flight state machine's key for one engine: the engine
+     * id plus its port when the plan names one, so two configs of one engine on
+     * different ports are distinct engines. A plan with no port keys on the
+     * engine id alone.
+     */
+    private engineKey;
     /**
      * stopEngineWatcher cancels one port's adopted-process poll, if it has one.
      */
@@ -256,9 +337,12 @@ export declare class LocalInfer extends Service implements LocalInferService {
     /**
      * stop signals the engine a launch started: it resolves the adapter by the
      * plan's engineId and runs the adapter's stop step (kill the tracked process,
-     * stop the named container, or compose down).
+     * stop the named container, or compose down). The optional `log` is the
+     * stop run's log sink: the adapter writes the `$ <command>` line of every
+     * command it runs (compose down, docker stop, a pid signal) through it
+     * before the child runs, so the stop's live run reads the command first.
      */
-    stop(plan: LaunchPlan): Promise<void>;
+    stop(plan: LaunchPlan, log?: CommandLogger): Promise<void>;
     /**
      * registerModel publishes a confirmed-working engine as a DSH model. It
      * builds the entry from the plan (the provider id, the base URL, and the
@@ -299,12 +383,21 @@ export declare class LocalInfer extends Service implements LocalInferService {
      */
     fetchPreset(source: PresetSource, options?: FetchPresetOptions): Promise<FetchPresetResult>;
     /**
-     * defaultModelDirectory is the plugin's model download directory: under
-     * the dsh home so a web user and a CLI user share one location, the way the
-     * config file does. The directory is created when absent, so the field's
-     * default is always a real path the deploy step can target.
+     * defaultModelDirectory is the plugin's model download directory: the
+     * Hugging Face hub cache the hf CLI and huggingface_hub share (HF_HUB_CACHE
+     * when set, then $HF_HOME/hub, then ~/.cache/huggingface/hub), so a model
+     * the plugin pulls lands where every other HF tooling looks. The directory
+     * is created when absent, so the field's default is always a real path the
+     * deploy step can target.
      */
     defaultModelDirectory(): string;
+    /**
+     * defaultDatasetDirectory is the plugin's dataset download directory: the
+     * Hugging Face datasets cache (HF_DATASETS_CACHE when set, then
+     * $HF_HOME/datasets, then ~/.cache/huggingface/datasets). Created when
+     * absent, for the same reason the model directory is.
+     */
+    defaultDatasetDirectory(): string;
     /**
      * hfCliAvailable probes for the hf CLI the model download runs: an
      * injected cliPath wins, then the `hf` binary on PATH. None found reads as
@@ -315,7 +408,10 @@ export declare class LocalInfer extends Service implements LocalInferService {
      * downloadModel runs the hf CLI download for one default model into the
      * model directory: it creates the target directory when absent (the
      * recursive flag covers the parents too), renders the command through the
-     * core builder (the single source the card shows), and runs it through the
+     * core builder (the single source the card shows), logs the rendered
+     * command's `$ <command>` line through options.onLog before the runner
+     * spawns the child (so every caller's run reads command first, output
+     * after, and the line is written once, here), and runs it through the
      * injected runner when one is given, so a test captures the command without
      * a live hf. A failure keeps the runner's detail, so the card names the
      * broken step.
@@ -325,8 +421,9 @@ export declare class LocalInfer extends Service implements LocalInferService {
      * downloadChatTemplate pulls the chat template file for one HF repo
      * reference into the model directory, so a selected template (the Froggeric
      * set, a custom repo) works out of the box. It shares the model download's
-     * recursive directory creation, runner, and long timeout: a template is a
-     * small file, but the hf CLI's cold start and auth are the same cost.
+     * recursive directory creation, runner, log line before the spawn, and long
+     * timeout: a template is a small file, but the hf CLI's cold start and auth
+     * are the same cost.
      */
     downloadChatTemplate(repo: string, directory: string, options?: DownloadModelOptions): Promise<DownloadResult>;
     /**
@@ -347,6 +444,22 @@ export declare class LocalInfer extends Service implements LocalInferService {
      * route renders as "no local models".
      */
     listModelDirectory(directory: string): ModelDirectoryEntry[];
+    /**
+     * listModelCache lists the hub cache's `models--*` directories, the data the
+     * per-engine model dropdown's cache scan draws from when the model directory
+     * is the plugin default (the hub cache). Each entry carries the repo id the
+     * directory names (the `{namespace}/{name}` decoded from the
+     * `models--{ns}--{name}` form) and the artifact file names its snapshots
+     * hold (the union across every commit). A missing or unreadable cache reads
+     * as an empty list, which the route renders as "no cached models".
+     */
+    listModelCache(): ModelCacheEntry[];
+    /**
+     * snapshotFiles unions the file names across every commit directory under a
+     * `models--*` dir's `snapshots/`, the artifact set the per-engine cache scan
+     * filters. A missing snapshots folder reads as an empty set.
+     */
+    private snapshotFiles;
     /**
      * specsForEngine reads the parameter surface of the registered adapter for
      * an engine id, so the defaults resolver floors the result on that engine's
@@ -436,6 +549,57 @@ export declare class LocalInfer extends Service implements LocalInferService {
      */
     private collectSpecs;
 }
+/**
+ * sudoProbe answers whether sudo already holds cached (or NOPASSWD)
+ * credentials: it runs SUDO_PROBE_COMMAND non-interactively through the
+ * probe timeout and reads a clean exit as "no prompt is coming". A refused
+ * -n, a missing sudo, and a hung probe all read as "a prompt is coming",
+ * the safe side: the run announces and caps instead of dead-locking on a
+ * TTY the card user cannot see.
+ */
+export declare function sudoProbe(): Promise<boolean>;
+/**
+ * sudoGuardFor is the service-side binding of core's guardSudoCommand: it
+ * supplies sudoProbe, so this package's install runner and the providers'
+ * lifecycle host drive one probe and one rule from one function. Calling
+ * it is itself the sudo declaration (needsSudo is true); callers gate on
+ * their own needsSudo fact first and never run a plain command through it.
+ */
+export declare function sudoGuardFor(command: string, notify: (command: string) => void, kill: () => void, timeoutMs?: number): Promise<SudoGuard>;
+/**
+ * guardedShellRunner builds the Play/Run runner: it runs one command line
+ * through the system shell and reports the exit. stdin stays closed. When
+ * core hands the command the dep's sudo declaration and sudoProbe finds no
+ * cached credentials, core's guard announces the CLI prompt through notify
+ * and arms the password deadline; its fire signals the child through the
+ * shared signalChild rule (SIGINT, then SIGTERM; the group signal reaches a
+ * sudo survivor of a compound line) and the run settles with
+ * sudoFailureDetail instead of the shell's bare signal exit. The guard adds
+ * only probe, notify, and deadline to the existing spawn; the copy/paste
+ * path stays the fallback for a passwordless host.
+ */
+export declare function guardedShellRunner(notify: (command: string) => void): CommandRunner;
+/**
+ * downloadRunner is the model-download runner: it spawns the rendered hf CLI
+ * command through the system shell and reports the exit. The spawned child's
+ * stdout and stderr chunks stream to onChunk as they land (the hf CLI's tqdm
+ * progress), while the output tail keeps the last kilobyte, the same rule the
+ * install runner uses, so a failure names the broken line. An abort on the
+ * optional signal interrupts the in-flight child (SIGINT, then SIGTERM), so a
+ * canceled download stops instead of running to the timeout. The optional
+ * graceMs overrides the 5 s SIGTERM escalation window for the abort path.
+ */
+export declare const downloadRunner: (command: string, signal?: AbortSignal, onChunk?: (chunk: string) => void, graceMs?: number) => Promise<CommandOutcome>;
+/**
+ * parseWindowsProcessTable reads the `pid<TAB>commandLine` rows PowerShell's
+ * Win32_Process probe emits into process lines the launch-signature matcher
+ * consumes. Each row is split on its first tab: the pid is the left field, the
+ * command line the right. A row with no tab (a system process with an empty
+ * command line, trimmed to its pid alone) is skipped, and a non-numeric pid is
+ * dropped. The env element stays undefined: Windows has no /proc environ to
+ * read, and the matcher reads a missing env as neutral.
+ */
+export declare function parseWindowsProcessTable(stdout: string): ProcessLine[];
 /**
  * runHardwareProbes collects the raw probe results the detector consumes: the
  * OS, CPU thread count, host RAM, the GPU reading, docker availability,
@@ -445,4 +609,4 @@ export declare class LocalInfer extends Service implements LocalInferService {
  */
 export declare function runHardwareProbes(): Promise<HardwareProbes>;
 export default LocalInfer;
-//# sourceMappingURL=index.d.ts.map
+//# sourceMappingURL=index.d.ts.map