Add dmr dev convenience wrapper

[ericcurtin]

For easier development.

[sourcery-ai]

Hey - I've found 2 security issues, 1 other issue, and left some high level feedback:

Security issues:

• Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. (link)
• Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. (link)

General comments:

• The dmr wrapper assumes it lives alongside model-runner and cmd/cli/model-cli; consider detecting missing binaries and printing a clear, actionable error (and perhaps the expected layout) instead of failing later with less obvious exec errors.
• In dmr, the server process's stdout/stderr are not wired anywhere; consider attaching them to os.Stderr so that server errors are visible when startup or requests fail.
• The BUILD_DMR variable in the Makefile appears unused now that build always depends on build-dmr; consider removing it or reintroducing a conditional if you still need to optionally skip building dmr.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- The `dmr` wrapper assumes it lives alongside `model-runner` and `cmd/cli/model-cli`; consider detecting missing binaries and printing a clear, actionable error (and perhaps the expected layout) instead of failing later with less obvious `exec` errors.
- In `dmr`, the server process's stdout/stderr are not wired anywhere; consider attaching them to `os.Stderr` so that server errors are visible when startup or requests fail.
- The `BUILD_DMR` variable in the Makefile appears unused now that `build` always depends on `build-dmr`; consider removing it or reintroducing a conditional if you still need to optionally skip building `dmr`.

## Individual Comments

### Comment 1
<location path="README.md" line_range="113" />
<code_context>
+./dmr run qwen3:0.6B-Q4_0 tell me today's news
 ```

+These components can also be built, ran and test separately using the makefile.
+
 ### Testing the Complete Stack End-to-End
</code_context>
<issue_to_address>
**issue (typo):** Fix verb agreement and reference to the Makefile in this sentence.

For example: `These components can also be built, run, and tested separately using the Makefile.`

```suggestion
These components can also be built, run, and tested separately using the Makefile.
```
</issue_to_address>

### Comment 2
<location path="cmd/dmr/main.go" line_range="66" />
<code_context>
	server := exec.Command(serverBin)
</code_context>
<issue_to_address>
**security (go.lang.security.audit.dangerous-exec-command):** Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.

*Source: opengrep*
</issue_to_address>

### Comment 3
<location path="cmd/dmr/main.go" line_range="88" />
<code_context>
	cli := exec.Command(cliBin, os.Args[1:]...)
</code_context>
<issue_to_address>
**security (go.lang.security.audit.dangerous-exec-command):** Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.

*Source: opengrep*
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[gemini-code-assist]

Code Review

This pull request introduces a dmr convenience wrapper for easier development, along with updates to the Makefile and README. The changes look good overall, simplifying the developer workflow.

I've added a couple of comments on the new cmd/dmr/main.go file regarding potential race conditions and robustness improvements in the server readiness check and signal handling. These are important for ensuring the wrapper behaves predictably and gracefully, especially during shutdown.