@botlearn-course/daemon 0.0.13 → 0.0.14

package/README.md

@@ -114,8 +114,11 @@ runtime 凭据。
 - 本包 production 依赖为零，发布 tarball 只包含 `dist/`、`README.md`、`package.json`、
   `LICENSE`（CI 发布前强制校验）。
 - 托管 session 的 control token/reconnect state 位于 runtime UID 不可访问的 `0700` control home；
-  runtime workspace 独立可写，Prompt Pack/Skill 则通过 control-owned、group-readable 的只读视图
-  提供。长期模型 provider key 留在 Agent Service，runtime 只拿 generation-scoped proxy grant。
+  runtime workspace 独立可写。activation-scoped Skill Provider binding 只留在 daemon control
+  process 内存；DeepSeek 只通过 clean-env `course_skills` Unix Socket relay 按需读取当前授权
+  `SKILL.md`/reference，endpoint/token 不进入 runtime env、MCP config、state、workspace 或日志。
+  Prompt Pack 仍通过受信 system context 应用。长期模型 provider key 留在 Agent Service，runtime
+  只拿 generation-scoped proxy grant。
 
 ## 发布
 

package/dist/agent-service-sandbox.d.ts

@@ -1,4 +1,5 @@
 import { type Logger } from "./log.js";
+import { type RuntimeSkillProviderFactory } from "./runtime-skills.js";
 import { type PersistentSessionExecution, type PreparedPersistentTurn, type RunReportingClient } from "./run-dispatcher.js";
 import type { CourseRuntime, CourseRuntimeProfile, RunEvent, RunFileCandidate, RunFileRecord, RunStartPayload } from "./types.js";
 export interface AgentServiceSandboxOptions {
@@ -11,6 +12,8 @@ export interface AgentServiceSandboxOptions {
     log?: Logger;
     random?: () => number;
     sleep?: (ms: number) => Promise<void>;
+    /** Test/provider injection; production uses the bounded HTTP Runtime Skill Provider. */
+    prepareSkillProvider?: RuntimeSkillProviderFactory;
 }
 /**
  * Long-running daemon client for one user-scoped managed sandbox (ADR-015).
@@ -24,6 +27,7 @@ export declare class AgentServiceSandboxClient implements RunReportingClient, Pe
     private readonly log;
     private readonly random;
     private readonly sleep;
+    private readonly prepareSkillProvider;
     private readonly state;
     private readonly dispatcher;
     /** agent_run_id → TURN scope（session/attempt/activation），事件与文件帧路由用。 */

package/dist/agent-service-sandbox.js

@@ -3,9 +3,10 @@ import path from "node:path";
 import { ensureDaemonHome } from "./auth-store.js";
 import { AGENT_SERVICE_WS_SCHEMA, AGENT_SERVICE_WS_SUBPROTOCOL, createSandboxFrame, parseSandboxFrame, UnsupportedSandboxProtocolError, } from "./agent-service-ws-protocol.js";
 import { log as defaultLog } from "./log.js";
-import { availableRunCapabilities } from "./runtime-capabilities.js";
+import { availableRunCapabilities, runtimeSupportsCourseSkills, } from "./runtime-capabilities.js";
 import { activationRuntimeEnv, runtimeChildEnv } from "./runtime-env.js";
 import { redactSecretString } from "./redaction.js";
+import { parseRuntimeSkillProviderGrantSet, prepareRuntimeSkillProvider, RuntimeSkillProviderError, } from "./runtime-skills.js";
 import { RunDispatcher, } from "./run-dispatcher.js";
 import { ensureRuntimeSessionDirectories, ensureRuntimeSessionWorkspace, exposeRuntimeSessionWorkspace, removeRuntimeSessionWorkspace, revokeRuntimeSessionWorkspace, } from "./workspace.js";
 import { WebSocketClient, } from "./websocket-client.js";
@@ -44,6 +45,9 @@ function inputAttachmentGrant(value) {
     }
     return { baseUrl: parsed.toString().replace(/\/$/, ""), token };
 }
+function runtimeSkillGrantKey(grants) {
+    return JSON.stringify(grants);
+}
 class SandboxClosedError extends Error {
     code;
     reason;
@@ -244,6 +248,7 @@ export class AgentServiceSandboxClient {
     log;
     random;
     sleep;
+    prepareSkillProvider;
     state;
     dispatcher;
     /** agent_run_id → TURN scope（session/attempt/activation），事件与文件帧路由用。 */
@@ -277,6 +282,8 @@ export class AgentServiceSandboxClient {
         this.log = options.log ?? defaultLog;
         this.random = options.random ?? Math.random;
         this.sleep = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+        this.prepareSkillProvider =
+            options.prepareSkillProvider ?? ((raw) => prepareRuntimeSkillProvider(raw));
         this.state = loadState(options.sandboxId, options.sandboxToken);
         this.dispatcher = new RunDispatcher(this, options.runtimes, {
             persistentSession: this,
@@ -318,6 +325,7 @@ export class AgentServiceSandboxClient {
             contextRevision,
             runtimeEnv,
             inputAttachmentGrant: activation.inputAttachmentGrant,
+            ...(activation.skillProvider ? { skillProvider: activation.skillProvider } : {}),
         };
     }
     persistNativeSession(nativeSessionId) {
@@ -849,33 +857,59 @@ export class AgentServiceSandboxClient {
             await this.sendCommandAck(frame, "rejected", error instanceof Error ? error.message : "invalid_instructions");
             return;
         }
+        const rawSkillProvider = frame.payload.skill_provider;
+        const hasSkillProvider = rawSkillProvider !== undefined && rawSkillProvider !== null;
+        if (hasSkillProvider && !runtimeSupportsCourseSkills(runtimeId)) {
+            await this.sendCommandAck(frame, "rejected", "skill_provider_runtime_unsupported");
+            return;
+        }
+        let skillGrantKey;
+        if (hasSkillProvider) {
+            try {
+                skillGrantKey = runtimeSkillGrantKey(parseRuntimeSkillProviderGrantSet(rawSkillProvider));
+            }
+            catch (error) {
+                const code = error instanceof RuntimeSkillProviderError
+                    ? error.code
+                    : "skill_provider_binding_invalid";
+                await this.sendCommandAck(frame, "rejected", code);
+                return;
+            }
+        }
         const capabilities = Array.isArray(frame.payload.capabilities)
             ? frame.payload.capabilities.filter((item) => typeof item === "string" && item.length > 0)
             : [];
-        if (capabilities.length > 0) {
-            const workspace = ensureRuntimeSessionDirectories(sessionId, this.sandboxGeneration);
-            const available = new Set(availableRunCapabilities({
-                agent_run_id: "activation-probe",
-                course_run_id: session.courseRunId ?? "",
-                lesson_id: null,
-                task_id: null,
-                agent_instance_id: null,
-                runtime: { id: runtimeId },
-                input: {},
-                context: {},
-                limits: {},
-            }, workspace.workspaceDir));
-            const missing = capabilities.filter((item) => !available.has(item)).sort();
-            if (missing.length > 0) {
-                await this.sendCommandAck(frame, "rejected", `missing_capabilities:${missing.join(",")}`);
-                return;
+        let availableCapabilities;
+        const missingCapabilities = (required) => {
+            if (required.length === 0)
+                return [];
+            if (!availableCapabilities) {
+                const workspace = ensureRuntimeSessionDirectories(sessionId, this.sandboxGeneration);
+                availableCapabilities = new Set(availableRunCapabilities({
+                    agent_run_id: "activation-probe",
+                    course_run_id: session.courseRunId ?? "",
+                    lesson_id: null,
+                    task_id: null,
+                    agent_instance_id: null,
+                    runtime: { id: runtimeId },
+                    input: {},
+                    context: {},
+                    limits: {},
+                }, workspace.workspaceDir));
             }
+            return Array.from(new Set(required.filter((item) => !availableCapabilities.has(item)))).sort();
+        };
+        const missingDeclaredCapabilities = missingCapabilities(capabilities);
+        if (missingDeclaredCapabilities.length > 0) {
+            await this.sendCommandAck(frame, "rejected", `missing_capabilities:${missingDeclaredCapabilities.join(",")}`);
+            return;
         }
         const existingActivation = this.activationContexts.get(sessionId);
         if (existingActivation?.activationId === activationId) {
             if (this.activeSessionId !== sessionId ||
                 session.runtimeId !== runtimeId ||
-                session.contextRevision !== contextRevision) {
+                session.contextRevision !== contextRevision ||
+                existingActivation.skillGrantKey !== skillGrantKey) {
                 await this.sendCommandAck(frame, "rejected", "activation_redefinition");
                 return;
             }
@@ -891,6 +925,25 @@ export class AgentServiceSandboxClient {
             await this.sendCommandAck(frame, "ok");
             return;
         }
+        let skillProvider;
+        if (hasSkillProvider) {
+            try {
+                skillProvider = await this.prepareSkillProvider(rawSkillProvider);
+            }
+            catch (error) {
+                const code = error instanceof RuntimeSkillProviderError
+                    ? error.code
+                    : "skill_provider_prepare_failed";
+                await this.sendCommandAck(frame, "rejected", code);
+                return;
+            }
+            const requiredBySkills = skillProvider.catalog.flatMap((entry) => entry.requiredCapabilities);
+            const missingSkillCapabilities = missingCapabilities(requiredBySkills);
+            if (missingSkillCapabilities.length > 0) {
+                await this.sendCommandAck(frame, "rejected", `missing_capabilities:${missingSkillCapabilities.join(",")}`);
+                return;
+            }
+        }
         // 同一时刻只允许一个 active session/activation。先撤销上一 workspace 的
         // runtime 访问并等待进程退出，再暴露新 workspace，避免同 UID 跨 Session 读取。
         const previousSessionId = this.activeSessionId;
@@ -920,6 +973,8 @@ export class AgentServiceSandboxClient {
             runtimeEnv,
             instructions,
             inputAttachmentGrant: attachmentGrant,
+            ...(skillProvider ? { skillProvider } : {}),
+            ...(skillGrantKey ? { skillGrantKey } : {}),
         });
         this.activeSessionId = sessionId;
         this.persist();

package/dist/index.d.ts

@@ -18,6 +18,7 @@ export * from "./log.js";
 export * from "./redaction.js";
 export * from "./runtime-profile.js";
 export * from "./runtime-env.js";
+export * from "./runtime-skills.js";
 export * from "./mcp/report-progress.js";
 export * from "./runtimes/index.js";
 export * from "./runtimes/engine.js";

package/dist/index.js

@@ -18,6 +18,7 @@ export * from "./log.js";
 export * from "./redaction.js";
 export * from "./runtime-profile.js";
 export * from "./runtime-env.js";
+export * from "./runtime-skills.js";
 export * from "./mcp/report-progress.js";
 export * from "./runtimes/index.js";
 export * from "./runtimes/engine.js";

package/dist/mcp/course-skills-relay.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export declare function runCourseSkillsRelay(argv?: string[]): void;

package/dist/mcp/course-skills-relay.js

@@ -0,0 +1,54 @@
+#!/usr/bin/env node
+import { realpathSync } from "node:fs";
+import net from "node:net";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+export function runCourseSkillsRelay(argv = process.argv.slice(2)) {
+    const socketPath = relaySocketPath(argv);
+    const socket = net.createConnection({ path: socketPath });
+    const fail = () => {
+        process.stderr.write("course_skills relay unavailable\n");
+        process.exitCode = 1;
+    };
+    socket.once("error", fail);
+    socket.once("connect", () => {
+        process.stdin.pipe(socket);
+        socket.pipe(process.stdout);
+    });
+    socket.once("close", () => {
+        if (!process.stdin.readableEnded)
+            process.stdin.destroy();
+    });
+}
+function relaySocketPath(argv) {
+    if (argv.length !== 2 || argv[0] !== "--socket") {
+        throw new Error("course_skills relay requires --socket");
+    }
+    const value = argv[1] ?? "";
+    if (!path.isAbsolute(value)
+        || value.includes("\0")
+        || Buffer.byteLength(value, "utf8") > 240) {
+        throw new Error("course_skills relay socket is invalid");
+    }
+    return value;
+}
+function isMainModule() {
+    const entry = process.argv[1];
+    if (!entry)
+        return false;
+    try {
+        return realpathSync(entry) === fileURLToPath(import.meta.url);
+    }
+    catch {
+        return false;
+    }
+}
+if (isMainModule()) {
+    try {
+        runCourseSkillsRelay();
+    }
+    catch {
+        process.stderr.write("course_skills relay configuration invalid\n");
+        process.exitCode = 1;
+    }
+}

package/dist/mcp/course-skills-server.d.ts

@@ -0,0 +1,49 @@
+import { type PreparedRuntimeSkillProvider, type RuntimeSkillCatalogEntry, type RuntimeSkillEvent } from "../runtime-skills.js";
+type JsonRpcId = string | number | null;
+interface JsonRpcRequest {
+    jsonrpc?: unknown;
+    id?: unknown;
+    method?: unknown;
+    params?: unknown;
+}
+interface JsonRpcResponse {
+    jsonrpc: "2.0";
+    id: JsonRpcId;
+    result?: unknown;
+    error?: {
+        code: number;
+        message: string;
+    };
+}
+export interface CourseSkillsMcpServer {
+    socketPath: string;
+    catalog: RuntimeSkillCatalogEntry[];
+    markApplied(): Promise<void>;
+    close(): Promise<void>;
+}
+export interface CourseSkillsMcpServerOptions {
+    prepared: PreparedRuntimeSkillProvider;
+    onEvent(event: RuntimeSkillEvent): Promise<void>;
+    /**
+     * Managed Agent Service root. `undefined` auto-detects it; `null` is only for
+     * private same-UID tests/BYOA experiments.
+     */
+    managedRoot?: string | null;
+}
+export declare class CourseSkillsMcpRuntime {
+    private readonly options;
+    private readonly grantsByRef;
+    private readonly loadedSkills;
+    private readonly loadedReferences;
+    private referenceBytes;
+    constructor(options: CourseSkillsMcpServerOptions);
+    emitAppliedEvents(): Promise<void>;
+    handle(request: JsonRpcRequest): Promise<JsonRpcResponse | null>;
+    private loadSkill;
+    private loadReference;
+    private requireGrant;
+    private emit;
+    private emitLoadFailed;
+}
+export declare function startCourseSkillsMcpServer(options: CourseSkillsMcpServerOptions): Promise<CourseSkillsMcpServer>;
+export {};