tnk 0.1.15

Zero-trust sandbox for local inference and secure AI coding agent runtimes.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122

// Copyright 2026 tappunk
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

use tokio::process::Command as AsyncCommand;

use crate::ui;

async fn discover_lima_sandboxes() -> Vec<String> {
    let output = AsyncCommand::new("limactl")
        .args(["list", "--format", "{{.Name}}"])
        .output()
        .await
        .ok()
        .filter(|o| o.status.success());

    match output {
        Some(out) => String::from_utf8_lossy(&out.stdout)
            .lines()
            .map(str::trim)
            .filter(|id| {
                id.starts_with("tnk-")
                    && *id != "tnk-services"
                    && *id != "tnk-searxng"
                    && *id != "tnk-config"
            })
            .map(ToString::to_string)
            .collect(),
        None => Vec::new(),
    }
}

async fn stop_lima(name: String) {
    let graceful = tokio::time::timeout(
        std::time::Duration::from_secs(60),
        AsyncCommand::new("limactl").args(["stop", &name]).output(),
    )
    .await;

    let graceful_ok = match graceful {
        Ok(Ok(output)) => output.status.success(),
        Ok(Err(_)) | Err(_) => false,
    };

    if graceful_ok {
        ui::log_info(&format!("stopped {}", name));
        return;
    }

    eprintln!(
        "warning: graceful stop for '{}' did not succeed, escalating to force",
        name
    );
    tokio::time::sleep(std::time::Duration::from_secs(5)).await;

    let force = tokio::time::timeout(
        std::time::Duration::from_secs(20),
        AsyncCommand::new("limactl")
            .args(["stop", "--force", &name])
            .output(),
    )
    .await;

    match force {
        Ok(Ok(output)) if output.status.success() => {
            ui::log_info(&format!("stopped {}", name));
        }
        Ok(Ok(_)) | Ok(Err(_)) | Err(_) => {
            eprintln!("warning: failed to stop {}", name);
        }
    }
}

async fn stop_engine() {
    let mut had_any = false;

    if crate::engine::is_running().await {
        had_any = true;
        if let Err(err) = crate::engine::stop_all().await {
            eprintln!("warning: failed to stop inference engine: {}", err);
        }
    }

    if had_any {
        tokio::time::sleep(std::time::Duration::from_millis(500)).await;
        if crate::engine::is_running().await {
            eprintln!("warning: inference engine still running after stop request; retrying");
            if let Err(err) = crate::engine::stop_all().await {
                eprintln!("warning: second stop_all attempt failed: {}", err);
            }
        }
    }
}

pub async fn run(_timeout_secs: Option<u64>, dry_run: bool) -> Result<(), color_eyre::Report> {
    if dry_run {
        crate::ui::log_info("dry run, skipping shutdown actions");
        return Ok(());
    }

    let _lock =
        crate::lifecycle::acquire("lima-lifecycle", std::time::Duration::from_secs(20)).await?;

    for instance in discover_lima_sandboxes().await {
        stop_lima(instance).await;
    }
    crate::services::stop(false).await?;

    stop_engine().await;
    crate::ui::log_info("shutdown complete");
    Ok(())
}