feat(FN-3377): add llama.cpp provider integration with pi extension and mob

This merge adds a new llama.cpp local AI provider integration, including a `pi-llama-cpp` CLI extension package with model resolution and context retrieval, a `LlamaCppProviderCard` UI component for provider configuration, backend API routes for model registration and llama.cpp probe/health checking

Fusion-Task-Id: FN-3377

packages/cli-alias/index.js

@@ -11,7 +11,10 @@
 // verbatim so behavior matches the main CLI exactly (e.g. bare `fn` prints
 // help, not `fn dashboard`).
 
-import { basename } from "node:path";
+import { basename, join } from "node:path";
+import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";
+import { homedir } from "node:os";
+import { createRequire } from "node:module";
 
 const args = globalThis.process.argv.slice(2);
 const invokedAs = basename(globalThis.process.argv[1] || "").replace(/\.(js|cjs|mjs|exe)$/i, "");
@@ -22,4 +25,128 @@ if (isAliasInvocation && args.length === 0) {
   globalThis.process.argv = [globalThis.process.argv[0], globalThis.process.argv[1], "dashboard"];
 }
 
+maybeAnnounceUpdateAndRefresh();
+
 await import("@runfusion/fusion/dist/bin.js");
+
+// ──────────────────────────────────────────────────────────────────────────
+// Update notice & background refresh.
+//
+// Reads the existing `~/.fusion/update-check.json` cache that the dashboard
+// server writes (packages/dashboard/src/update-check.ts). If a newer version
+// is available, prints a one-line stderr notice. To avoid coupling the
+// launcher to the dashboard bundle and to keep it fast, we never import
+// dashboard code here — we just consume the cache file by its known shape.
+//
+// If the cache is missing or older than 24h, fires a non-blocking fetch
+// against the npm registry and rewrites the cache so users who never open
+// the dashboard still pick up updates eventually. Skipped in CI, when
+// stderr isn't a TTY, or when FUSION_NO_UPDATE_CHECK=1 is set.
+function maybeAnnounceUpdateAndRefresh() {
+  try {
+    if (process.env.FUSION_NO_UPDATE_CHECK === "1") return;
+    if (process.env.CI) return;
+    if (!process.stderr.isTTY) return;
+
+    const fusionDir = resolveFusionDir();
+    const cachePath = join(fusionDir, "update-check.json");
+    const currentVersion = readBundledFusionVersion();
+
+    let cache = null;
+    try {
+      cache = JSON.parse(readFileSync(cachePath, "utf-8"));
+    } catch { /* missing or corrupt — treat as no cache */ }
+
+    if (
+      cache &&
+      cache.updateAvailable === true &&
+      typeof cache.latestVersion === "string" &&
+      cache.currentVersion === currentVersion
+    ) {
+      const yellow = (s) => `\x1b[33m${s}\x1b[0m`;
+      const dim = (s) => `\x1b[2m${s}\x1b[0m`;
+      process.stderr.write(
+        yellow(
+          `\nFusion ${cache.latestVersion} is available (you have ${currentVersion}).\n`,
+        ) +
+          dim(`  Update: npx runfusion.ai@latest\n  Disable: FUSION_NO_UPDATE_CHECK=1\n\n`),
+      );
+    }
+
+    const DAY_MS = 24 * 60 * 60 * 1000;
+    const stale =
+      !cache ||
+      typeof cache.lastChecked !== "number" ||
+      Date.now() - cache.lastChecked > DAY_MS ||
+      cache.currentVersion !== currentVersion;
+    if (stale && currentVersion) {
+      backgroundRefresh(fusionDir, cachePath, currentVersion).catch(() => {});
+    }
+  } catch {
+    // Update check is best-effort — never block or fail the launcher.
+  }
+}
+
+function resolveFusionDir() {
+  const home = process.env.HOME || process.env.USERPROFILE || homedir();
+  const preferred = join(home, ".fusion");
+  if (existsSync(preferred)) return preferred;
+  const legacy = join(home, ".pi", "fusion");
+  if (existsSync(legacy)) return legacy;
+  return preferred;
+}
+
+function readBundledFusionVersion() {
+  try {
+    const require = createRequire(import.meta.url);
+    const pkgPath = require.resolve("@runfusion/fusion/package.json");
+    const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
+    return typeof pkg.version === "string" ? pkg.version : null;
+  } catch {
+    return null;
+  }
+}
+
+async function backgroundRefresh(fusionDir, cachePath, currentVersion) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 1500);
+  try {
+    const response = await fetch("https://registry.npmjs.org/@runfusion%2Ffusion", {
+      signal: controller.signal,
+    });
+    if (!response.ok) return;
+    const payload = await response.json();
+    const latestVersion = payload?.["dist-tags"]?.latest;
+    if (typeof latestVersion !== "string") return;
+
+    const result = {
+      currentVersion,
+      latestVersion,
+      updateAvailable: isRemoteNewer(latestVersion, currentVersion),
+      lastChecked: Date.now(),
+    };
+
+    try {
+      mkdirSync(fusionDir, { recursive: true });
+      writeFileSync(cachePath, JSON.stringify(result, null, 2), "utf-8");
+    } catch { /* best-effort */ }
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+function isRemoteNewer(remote, current) {
+  const parse = (v) =>
+    String(v)
+      .split(".")
+      .slice(0, 3)
+      .map((p) => Number.parseInt(p, 10))
+      .map((n) => (Number.isFinite(n) ? n : 0));
+  const r = parse(remote);
+  const c = parse(current);
+  for (let i = 0; i < 3; i++) {
+    if ((r[i] ?? 0) > (c[i] ?? 0)) return true;
+    if ((r[i] ?? 0) < (c[i] ?? 0)) return false;
+  }
+  return false;
+}

packages/cli/src/__tests__/package-config.test.ts

@@ -1,6 +1,7 @@
 import { describe, it, expect } from "vitest";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
+import { builtinModules } from "node:module";
 import { parse } from "yaml";
 
 const workspaceRoot = join(__dirname, "..", "..", "..", "..");
@@ -79,12 +80,101 @@ describe("CLI package.json publishing config", () => {
     expect(deps).toContain("ioredis");
   });
 
-  it("declares dockerode as a runtime dependency when kept external in CLI bundling", () => {
-    const deps = Object.keys(pkg.dependencies || {});
-    const devDeps = Object.keys(pkg.devDependencies || {});
+  // Generalized guard derived from tsup.config.ts. Any non-builtin module
+  // marked `external` MUST be a runtime dep (so `npm install @runfusion/fusion`
+  // can resolve it after publish), and any module pulled in via `noExternal`
+  // (i.e. inlined into the bundle) MUST NOT leak into runtime deps.
+  // pnpm hoisting masks the missing-dep case in the workspace, so a hardcoded
+  // allowlist isn't enough — this iterates the live config instead.
+  describe("tsup external/noExternal vs published deps", () => {
+    const tsupRaw = readFileSync(
+      join(workspaceRoot, "packages", "cli", "tsup.config.ts"),
+      "utf-8",
+    );
 
-    expect(deps).toContain("dockerode");
-    expect(devDeps).not.toContain("dockerode");
+    function extractStringArray(name: string): string[] {
+      const m = tsupRaw.match(new RegExp(`${name}:\\s*\\[([\\s\\S]*?)\\]`, "m"));
+      if (!m) return [];
+      return [...m[1].matchAll(/["']([^"']+)["']/g)].map((mm) => mm[1]);
+    }
+
+    function extractRegexes(name: string): RegExp[] {
+      const m = tsupRaw.match(new RegExp(`${name}:\\s*\\[([\\s\\S]*?)\\]`, "m"));
+      if (!m) return [];
+      // Match `/PATTERN/flags` where PATTERN may contain escaped slashes (`\/`).
+      return [...m[1].matchAll(/\/((?:\\\/|[^/\n])+)\/[gimsuy]*/g)].map(
+        (mm) => new RegExp(mm[1].replace(/\\\//g, "/")),
+      );
+    }
+
+    const externals = extractStringArray("external");
+    const noExternalRegexes = extractRegexes("noExternal");
+    const noExternalStrings = extractStringArray("noExternal");
+
+    // Externals that intentionally aren't direct deps. Each entry needs a reason —
+    // when adding to this list, document *why* it doesn't need to be a runtime dep
+    // (transitive via another dep, only used by the Bun binary, etc.) so future
+    // edits don't silently re-introduce the dockerode-class bug.
+    const TRANSITIVE_EXTERNALS: Record<string, string> = {
+      ssh2: "transitive dep of dockerode",
+      "cpu-features": "transitive dep of dockerode (via ssh2)",
+      "node-pty": "only loaded by the Bun-compiled binary from dist/runtime/",
+      "@homebridge/node-pty-prebuilt-multiarch":
+        "only loaded by the Bun-compiled binary from dist/runtime/",
+    };
+
+    it("parses externals from tsup.config.ts", () => {
+      expect(externals.length).toBeGreaterThan(0);
+      expect(externals).toContain("dockerode");
+    });
+
+    it.each(externals.filter(
+      (e) =>
+        !builtinModules.includes(e) &&
+        !e.startsWith("node:") &&
+        !(e in TRANSITIVE_EXTERNALS),
+    ))(
+      'external "%s" is declared as a runtime dependency',
+      (external) => {
+        const deps = Object.keys(pkg.dependencies || {});
+        const devDeps = Object.keys(pkg.devDependencies || {});
+        expect(
+          deps,
+          `tsup external "${external}" must be in @runfusion/fusion dependencies — otherwise \`npx runfusion.ai\` fails with ERR_MODULE_NOT_FOUND on a clean install. If this is a transitive dep, add it to TRANSITIVE_EXTERNALS with a reason.`,
+        ).toContain(external);
+        expect(
+          devDeps,
+          `tsup external "${external}" must not be only a devDependency`,
+        ).not.toContain(external);
+      },
+    );
+
+    it("TRANSITIVE_EXTERNALS entries still appear in tsup external (otherwise stale)", () => {
+      for (const name of Object.keys(TRANSITIVE_EXTERNALS)) {
+        expect(
+          externals,
+          `TRANSITIVE_EXTERNALS["${name}"] is no longer in tsup external — remove the allowlist entry.`,
+        ).toContain(name);
+      }
+    });
+
+    it("noExternal (bundled) modules are not also runtime deps", () => {
+      const deps = Object.keys(pkg.dependencies || {});
+      for (const dep of deps) {
+        for (const re of noExternalRegexes) {
+          expect(
+            re.test(dep),
+            `dep "${dep}" matches noExternal pattern ${re} — bundled code should not also be a runtime dep`,
+          ).toBe(false);
+        }
+        for (const s of noExternalStrings) {
+          expect(
+            dep,
+            `dep "${dep}" is listed in noExternal — bundled code should not also be a runtime dep`,
+          ).not.toBe(s);
+        }
+      }
+    });
   });
 });