rlm-cli 0.2.17 → 0.2.18

package/README.md

@@ -1,5 +1,7 @@
 # rlm-cli
 
+[![npm version](https://img.shields.io/npm/v/rlm-cli.svg)](https://www.npmjs.com/package/rlm-cli)
+
 ```
                      ██████╗ ██╗     ███╗   ███╗
                      ██╔══██╗██║     ████╗ ████║

package/dist/cli.js

@@ -91,9 +91,15 @@ function parseArgs() {
     return { modelId, file, url, useStdin, verbose, query };
 }
 // ── Helpers ─────────────────────────────────────────────────────────────────
+const MAX_STDIN_BYTES = 50 * 1024 * 1024; // 50MB
 async function readStdin() {
     const chunks = [];
+    let total = 0;
     for await (const chunk of process.stdin) {
+        total += chunk.length;
+        if (total > MAX_STDIN_BYTES) {
+            throw new Error(`stdin exceeds ${MAX_STDIN_BYTES / 1024 / 1024}MB limit`);
+        }
         chunks.push(chunk);
     }
     return Buffer.concat(chunks).toString("utf-8");
@@ -129,7 +135,13 @@ async function main() {
     let context;
     if (args.file) {
         console.error(`Reading context from file: ${args.file}`);
-        context = fs.readFileSync(args.file, "utf-8");
+        try {
+            context = fs.readFileSync(args.file, "utf-8");
+        }
+        catch (err) {
+            console.error(`Error: could not read file "${args.file}": ${err.message}`);
+            process.exit(1);
+        }
     }
     else if (args.url) {
         console.error(`Fetching context from URL: ${args.url}`);

package/dist/interactive.js

@@ -652,11 +652,11 @@ function isBinaryFile(filePath) {
     if (BINARY_EXTENSIONS.has(ext))
         return true;
     // Quick null-byte check on first 512 bytes
+    let fd;
     try {
-        const fd = fs.openSync(filePath, "r");
+        fd = fs.openSync(filePath, "r");
         const buf = Buffer.alloc(512);
         const bytesRead = fs.readSync(fd, buf, 0, 512, 0);
-        fs.closeSync(fd);
         for (let i = 0; i < bytesRead; i++) {
             if (buf[i] === 0)
                 return true;
@@ -665,9 +665,19 @@ function isBinaryFile(filePath) {
     catch { /* unreadable → skip */
         return true;
     }
+    finally {
+        if (fd !== undefined)
+            try {
+                fs.closeSync(fd);
+            }
+            catch { }
+    }
     return false;
 }
-function walkDir(dir) {
+const MAX_DIR_DEPTH = 30;
+function walkDir(dir, depth = 0) {
+    if (depth > MAX_DIR_DEPTH)
+        return [];
     const results = [];
     let entries;
     try {
@@ -679,11 +689,13 @@ function walkDir(dir) {
     for (const entry of entries) {
         if (entry.name.startsWith(".") && entry.name !== ".env")
             continue;
+        if (entry.isSymbolicLink())
+            continue;
         const full = path.join(dir, entry.name);
         if (entry.isDirectory()) {
             if (SKIP_DIRS.has(entry.name))
                 continue;
-            results.push(...walkDir(full));
+            results.push(...walkDir(full, depth + 1));
         }
         else if (entry.isFile()) {
             if (!isBinaryFile(full))
@@ -694,12 +706,12 @@ function walkDir(dir) {
     }
     return results;
 }
-function simpleGlobMatch(pattern, filePath) {
-    // Expand {a,b,c} braces into alternatives
+function simpleGlobMatch(pattern, filePath, _braceDepth = 0) {
+    // Expand {a,b,c} braces into alternatives (with depth limit)
     const braceMatch = pattern.match(/\{([^}]+)\}/);
-    if (braceMatch) {
-        const alternatives = braceMatch[1].split(",");
-        return alternatives.some((alt) => simpleGlobMatch(pattern.replace(braceMatch[0], alt.trim()), filePath));
+    if (braceMatch && _braceDepth < 5) {
+        const alternatives = braceMatch[1].split(",").slice(0, 50);
+        return alternatives.some((alt) => simpleGlobMatch(pattern.replace(braceMatch[0], alt.trim()), filePath, _braceDepth + 1));
     }
     // Convert glob to regex
     let regex = "^";

package/dist/repl.js

@@ -32,13 +32,18 @@ export class PythonRepl {
             return;
         const runtimePath = path.join(path.dirname(fileURLToPath(import.meta.url)), "runtime.py");
         const pythonCmd = process.platform === "win32" ? "python" : "python3";
+        const homeDir = os.homedir();
         this.proc = spawn(pythonCmd, [runtimePath], {
             stdio: ["pipe", "pipe", "pipe"],
             env: {
                 // Only pass what Python actually needs — not API keys or secrets
                 PATH: process.env.PATH,
-                HOME: os.homedir(),
+                HOME: homeDir,
+                USERPROFILE: homeDir, // Windows uses USERPROFILE
                 PYTHONUNBUFFERED: "1",
+                // Windows needs SystemRoot/SYSTEMROOT for Python to find DLLs
+                ...(process.env.SystemRoot ? { SystemRoot: process.env.SystemRoot } : {}),
+                ...(process.env.SYSTEMROOT ? { SYSTEMROOT: process.env.SYSTEMROOT } : {}),
             },
         });
         this.rl = readline.createInterface({ input: this.proc.stdout });
@@ -93,7 +98,11 @@ export class PythonRepl {
             catch {
                 // stdin may already be closed
             }
-            this.proc.kill("SIGTERM");
+            // SIGTERM is ignored on Windows; use SIGKILL as fallback
+            try {
+                this.proc.kill(process.platform === "win32" ? "SIGKILL" : "SIGTERM");
+            }
+            catch { /* already dead */ }
         }
         this.cleanup();
     }

package/dist/viewer.js

@@ -614,9 +614,17 @@ function syntaxHighlight(code) {
 async function main() {
     // Enter alternate screen buffer so output never scrolls the main terminal
     W(c.altScreenOn);
-    // Ensure we always leave alt screen on exit
-    const cleanup = () => W(c.showCursor, c.altScreenOff);
+    // Ensure we always restore terminal on exit (alt screen, cursor, raw mode)
+    const cleanup = () => {
+        try {
+            process.stdin.setRawMode(false);
+        }
+        catch { }
+        W(c.showCursor, c.altScreenOff);
+    };
     process.on("exit", cleanup);
+    process.on("SIGINT", () => { cleanup(); process.exit(0); });
+    process.on("SIGTERM", () => { cleanup(); process.exit(0); });
     let filePath = process.argv[2];
     if (!filePath) {
         const files = listTrajectories();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rlm-cli",
-  "version": "0.2.17",
+  "version": "0.2.18",
   "description": "Standalone CLI for Recursive Language Models (RLMs) — implements Algorithm 1 from arXiv:2512.24601",
   "type": "module",
   "bin": {