@botlearn-course/daemon 0.0.10 → 0.0.11

package/README.md

@@ -38,9 +38,10 @@ npx --yes --package @botlearn-course/daemon@latest botlearn-course-daemon course
 
 包内还包含供 BotLearn 托管 E2B Template 使用的内部命令
 `botlearn-sandbox-supervisor agent-service session`。它不是 BYOA 用户入口：生产环境只允许由
-Agent Service 以固定 argv 启动，通过 stdin 接收一次性 bootstrap，并把 daemon/runtime 分别降权
-到 `botlearn-control`/`user` UID。E2B Template 通过 root-owned 固定 launcher 将 DeepSeek
-单向降权为 `user` 并设置 `no_new_privs`；runtime 用户本身没有 sudo 权限。托管启动链只执行
+Agent Service 以固定 argv 启动，通过 stdin 接收一次性 bootstrap。E2B 中 daemon/runtime 分别
+降权到 `botlearn-control`/`user` UID；继承 `NoNewPrivs=1`、无法使用 sudo 的平台保留 root control
+daemon，由 root-owned 固定 launcher 清空附加组后直接降权为 `user`。两条路径都为 DeepSeek
+设置 `no_new_privs`，runtime 用户本身没有 sudo 权限。托管启动链只执行
 `/opt` 下的固定 Node、supervisor、daemon、launcher 与 DeepSeek 文件，不信任 E2B 会开放给 runtime
 写入的 `/usr/local/bin`。
 `agent-service session --bootstrap-stdin` 同样属于受 supervisor 保护的内部协议，不应直接暴露给

package/dist/runtime-env.d.ts

@@ -14,14 +14,16 @@ export declare function runtimeChildIdentity(env?: NodeJS.ProcessEnv): {
     gid?: number;
 };
 /**
- * Build the fixed control-to-runtime privilege boundary used by the E2B Template.
+ * Build the fixed control-to-runtime privilege boundary used by managed sandboxes.
  *
- * A non-root botlearn-control daemon cannot use spawn({ uid }) directly. The Template
- * therefore grants it one sudoers command: a root-owned launcher that accepts only the
- * immutable DeepSeek dispatcher and sets no_new_privs as the unprivileged runtime user.
- * BYOA processes do not set BOTLEARN_RUNTIME_USER and retain their direct-spawn behavior.
+ * E2B runs the daemon as botlearn-control and grants it one fixed sudoers command.
+ * Platforms that inherit no_new_privs cannot use sudo, so their root supervisor daemon
+ * invokes the same immutable launcher directly; the launcher clears supplementary groups
+ * and performs the one-way uid/gid drop. BYOA retains direct-spawn behavior.
  */
-export declare function runtimeChildLaunch(binary: string, args: string[], env?: NodeJS.ProcessEnv): {
+export declare function runtimeChildLaunch(binary: string, args: string[], env?: NodeJS.ProcessEnv, options?: {
+    currentUid?: number;
+}): {
     binary: string;
     args: string[];
     identity: {

package/dist/runtime-env.js

@@ -16,6 +16,7 @@ const AGENT_SERVICE_SUPERVISOR_ENV_KEYS = [
     "BOTLEARN_RUNTIME_GROUP",
     "BOTLEARN_RUNTIME_HOME",
     "BOTLEARN_RUNTIME_LAUNCHER",
+    "BOTLEARN_RUNTIME_LAUNCH_MODE",
     "BOTLEARN_AGENT_SERVICE_WORKSPACE_ROOT",
     "BOTLEARN_AGENT_SERVICE_PROFILE_ROOT",
 ];
@@ -27,6 +28,8 @@ const RUNTIME_USER_PATTERN = /^[a-z_][a-z0-9_-]{0,31}$/;
 const RUNTIME_SUDO_BINARY = "/usr/bin/sudo";
 const MANAGED_RUNTIME_LAUNCHER = "/opt/botlearn/bin/botlearn-runtime-launcher";
 const MANAGED_RUNTIME_BINARY = "/opt/deepseek-tui/0.8.39/bin/deepseek";
+const MANAGED_RUNTIME_UID = 1001;
+const MANAGED_RUNTIME_GID = 2000;
 /** Remove Course control-plane coordinates before any model/runtime child is created. */
 export function clearAgentServiceControlEnv(env = process.env) {
     for (const key of AGENT_SERVICE_CONTROL_ENV_KEYS)
@@ -84,16 +87,41 @@ export function runtimeChildIdentity(env = process.env) {
     return { uid, gid };
 }
 /**
- * Build the fixed control-to-runtime privilege boundary used by the E2B Template.
+ * Build the fixed control-to-runtime privilege boundary used by managed sandboxes.
  *
- * A non-root botlearn-control daemon cannot use spawn({ uid }) directly. The Template
- * therefore grants it one sudoers command: a root-owned launcher that accepts only the
- * immutable DeepSeek dispatcher and sets no_new_privs as the unprivileged runtime user.
- * BYOA processes do not set BOTLEARN_RUNTIME_USER and retain their direct-spawn behavior.
+ * E2B runs the daemon as botlearn-control and grants it one fixed sudoers command.
+ * Platforms that inherit no_new_privs cannot use sudo, so their root supervisor daemon
+ * invokes the same immutable launcher directly; the launcher clears supplementary groups
+ * and performs the one-way uid/gid drop. BYOA retains direct-spawn behavior.
  */
-export function runtimeChildLaunch(binary, args, env = process.env) {
+export function runtimeChildLaunch(binary, args, env = process.env, options = {}) {
+    const launchMode = env.BOTLEARN_RUNTIME_LAUNCH_MODE?.trim();
+    if (launchMode === "direct-uid") {
+        const currentUid = options.currentUid ?? process.getuid?.();
+        if (currentUid !== 0) {
+            throw new Error("direct managed runtime launch requires a root supervisor daemon");
+        }
+        if (binary !== MANAGED_RUNTIME_BINARY) {
+            throw new Error("invalid supervisor-provided runtime binary");
+        }
+        const identity = runtimeChildIdentity(env);
+        if (identity.uid !== MANAGED_RUNTIME_UID || identity.gid !== MANAGED_RUNTIME_GID) {
+            throw new Error("direct managed runtime launch requires a fixed runtime uid and gid");
+        }
+        return {
+            binary: MANAGED_RUNTIME_LAUNCHER,
+            args: [binary, ...args],
+            identity: {},
+        };
+    }
+    if (launchMode !== undefined && launchMode !== "sudo") {
+        throw new Error("invalid supervisor-provided runtime launch mode");
+    }
     const runtimeUser = env.BOTLEARN_RUNTIME_USER;
     if (runtimeUser === undefined) {
+        if (launchMode === "sudo") {
+            throw new Error("sudo managed runtime launch requires a fixed runtime user");
+        }
         return { binary, args, identity: runtimeChildIdentity(env) };
     }
     if (!RUNTIME_USER_PATTERN.test(runtimeUser)) {

package/dist/runtimes/deepseek-tui.js

@@ -3,6 +3,7 @@ import { existsSync, realpathSync } from "node:fs";
 import path from "node:path";
 import net from "node:net";
 import { MAX_PROGRESS_EVENTS_PER_ATTEMPT } from "../mcp/report-progress.js";
+import { sanitizeRuntimeFailureText } from "../redaction.js";
 import { runtimeChildEnv, runtimeChildLaunch } from "../runtime-env.js";
 import { readCommandVersion, resolveCommandOnPath } from "./probe.js";
 import { adaptDeepseekProgressStarted, cleanupProgressMcpConfig, createDeepseekProgressState, createProgressMcpConfig, deepseekProgressDispositions, isDeepseekProgressCompletion, progressMcpAutoInjectionSupported, progressSystemContext, } from "./progress.js";
@@ -270,7 +271,7 @@ export class DeepseekTuiAdapter {
         };
         child.stderr?.setEncoding("utf8");
         child.stderr?.on("data", (chunk) => {
-            handle.stderrTail = (handle.stderrTail + chunk).slice(-4096);
+            handle.stderrTail = sanitizeRuntimeFailureText(handle.stderrTail + chunk, 4096);
         });
         child.on("close", () => {
             handle.closed = true;
@@ -287,7 +288,7 @@ export class DeepseekTuiAdapter {
             handle.progressMcpConfig = undefined;
         });
         try {
-            await waitForHealth(baseUrl, this.fetchFn, child, STARTUP_TIMEOUT_MS, signal);
+            await waitForHealth(baseUrl, this.fetchFn, handle, STARTUP_TIMEOUT_MS, signal);
         }
         catch (error) {
             shutdownHandle(handle, "startup-failed");
@@ -929,14 +930,18 @@ function shutdownHandle(handle, reason) {
     }
     log.debug("deepseek-tui.shutdown", { reason });
 }
-async function waitForHealth(baseUrl, fetchFn, child, timeoutMs, signal) {
+async function waitForHealth(baseUrl, fetchFn, handle, timeoutMs, signal) {
     const deadline = Date.now() + timeoutMs;
     let lastError = "";
     while (Date.now() < deadline) {
         if (signal.aborted)
             throw abortReason(signal);
-        if (child.exitCode !== null) {
-            throw new Error(`deepseek serve exited with code ${child.exitCode}`);
+        if (handle.child.exitCode !== null) {
+            const detail = sanitizeRuntimeFailureText(handle.stderrTail, 1024)
+                .trim()
+                .replace(/\s+/gu, " ");
+            throw new Error(`deepseek serve exited with code ${handle.child.exitCode}`
+                + (detail ? `: ${detail}` : ""));
         }
         try {
             const res = await fetchFn(`${baseUrl}/health`, { method: "GET", signal });

package/dist/runtimes/progress.js

@@ -191,7 +191,8 @@ function resolveManagedProgressRoot(explicit) {
         return null;
     let root = explicit?.trim();
     if (root === undefined) {
-        const managedRuntime = process.env.BOTLEARN_RUNTIME_USER?.trim();
+        const managedRuntime = process.env.BOTLEARN_RUNTIME_USER?.trim()
+            || process.env.BOTLEARN_RUNTIME_LAUNCH_MODE?.trim();
         if (!managedRuntime)
             return null;
         root = process.env.BOTLEARN_AGENT_SERVICE_PROFILE_ROOT?.trim();

package/dist/sandbox-supervisor.d.ts

@@ -1,4 +1,13 @@
 #!/usr/bin/env node
+export declare function noNewPrivilegesEnabled(status: string): boolean;
+export declare function sandboxSupervisorLaunchPlan(noNewPrivileges: boolean, controlUid: number, controlGid: number): {
+    directoryOwnerUid: number;
+    daemonIdentity: {
+        uid?: number;
+        gid: number;
+    };
+    runtimeLaunchEnv: Record<string, string>;
+};
 export declare function acquireSandboxSupervisorLock(sandboxId: string, lockRoot?: string): (() => void) | null;
 export declare function runSandboxSupervisor(argv: string[]): Promise<number>;
 export declare function isMainModule(entry?: string): boolean;

package/dist/sandbox-supervisor.js

@@ -23,6 +23,35 @@ const MANAGED_PATH = [
     // use it for a managed control-plane executable.
     "/usr/local/bin",
 ].join(":");
+export function noNewPrivilegesEnabled(status) {
+    const match = /^NoNewPrivs:\s*([01])\s*$/mu.exec(status);
+    if (!match)
+        throw new Error("sandbox supervisor could not read NoNewPrivs state");
+    return match[1] === "1";
+}
+export function sandboxSupervisorLaunchPlan(noNewPrivileges, controlUid, controlGid) {
+    if (noNewPrivileges) {
+        return {
+            directoryOwnerUid: 0,
+            // Keep the root supervisor's uid so Node can perform a one-way uid/gid drop for
+            // the runtime child. The control gid preserves the existing workspace/profile ACLs.
+            daemonIdentity: { gid: controlGid },
+            runtimeLaunchEnv: {
+                BOTLEARN_RUNTIME_LAUNCH_MODE: "direct-uid",
+            },
+        };
+    }
+    return {
+        directoryOwnerUid: controlUid,
+        daemonIdentity: { uid: controlUid, gid: controlGid },
+        runtimeLaunchEnv: {
+            BOTLEARN_RUNTIME_LAUNCH_MODE: "sudo",
+            BOTLEARN_RUNTIME_USER: RUNTIME_USER,
+            BOTLEARN_RUNTIME_GROUP: CONTROL_USER,
+            BOTLEARN_RUNTIME_LAUNCHER: RUNTIME_LAUNCHER,
+        },
+    };
+}
 function numericId(flag, user) {
     const output = execFileSync("/usr/bin/id", [flag, user], {
         encoding: "utf8",
@@ -112,6 +141,8 @@ export async function runSandboxSupervisor(argv) {
     const controlUid = numericId("-u", CONTROL_USER);
     const controlGid = numericId("-g", CONTROL_USER);
     const runtimeUid = numericId("-u", RUNTIME_USER);
+    const noNewPrivileges = noNewPrivilegesEnabled(readFileSync("/proc/self/status", "utf8"));
+    const launchPlan = sandboxSupervisorLaunchPlan(noNewPrivileges, controlUid, controlGid);
     const bootstrap = await readOneShotBootstrap();
     let child;
     let releaseLock = null;
@@ -128,25 +159,25 @@ export async function runSandboxSupervisor(argv) {
         releaseLock = acquireSandboxSupervisorLock(sandboxId);
         if (releaseLock === null)
             return 0;
-        prepareDirectories(controlUid, controlGid);
+        prepareDirectories(launchPlan.directoryOwnerUid, controlGid);
+        if (noNewPrivileges) {
+            process.stderr.write("sandbox supervisor: NoNewPrivs=1; using root daemon with direct runtime uid drop\n");
+        }
         child = spawn(NODE_BINARY, [
             DAEMON_ENTRY,
             "agent-service",
             "session",
             "--bootstrap-stdin",
         ], {
-            uid: controlUid,
-            gid: controlGid,
+            ...launchPlan.daemonIdentity,
             env: {
                 HOME: "/home/botlearn-control",
                 PATH: MANAGED_PATH,
                 BOTLEARN_DAEMON_HOME: CONTROL_HOME,
                 BOTLEARN_RUNTIME_UID: String(runtimeUid),
                 BOTLEARN_RUNTIME_GID: String(controlGid),
-                BOTLEARN_RUNTIME_USER: RUNTIME_USER,
-                BOTLEARN_RUNTIME_GROUP: CONTROL_USER,
                 BOTLEARN_RUNTIME_HOME: "/home/user",
-                BOTLEARN_RUNTIME_LAUNCHER: RUNTIME_LAUNCHER,
+                ...launchPlan.runtimeLaunchEnv,
                 BOTLEARN_DEEPSEEK_TUI_BIN: DEEPSEEK_BINARY,
                 BOTLEARN_AGENT_SERVICE_WORKSPACE_ROOT: WORKSPACE,
                 BOTLEARN_AGENT_SERVICE_PROFILE_ROOT: RUNTIME_PROFILE_ROOT,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botlearn-course/daemon",
-  "version": "0.0.10",
+  "version": "0.0.11",
   "description": "Lightweight BotLearn Course daemon: run course tasks on your own machine with your own agent runtime (BYOA).",
   "type": "module",
   "bin": {