@botlearn-course/daemon 0.0.15 → 0.0.17-beta.1

package/README.md

@@ -102,6 +102,9 @@ runtime 凭据。
 - 文件扫描只访问 workspace 内路径；包含 `..`、绝对路径或反斜杠的路径会被拒绝。daemon
   只上报相对路径、大小、sha256 和有界脱敏 preview，文件正文始终留在本地或托管 sandbox
   的持久 workspace，不上传 Course Service 或对象存储。扫描或 metadata 上报失败不影响 run 终态。
+- 托管 Practice Agent 的学员输入附件由 Course Service 为当前 activation 签发单对象、短时效的
+  存储源站 URL；daemon 直接下载并复核 grant 集合、大小、SHA-256、MIME 与图片签名。URL 只留在
+  control process 内存，不进入 runtime env、prompt、workspace state、transcript、事件或日志。
 - 每个 run 在独立 workspace 内执行并有超时上限；runtime 进程在取消/超时后会被终止
   （SIGTERM → SIGKILL）。
 - `report_progress` MCP 子进程以 clean environment 启动，不继承 Course 控制字段或模型凭据；

package/dist/agent-service-client.d.ts

@@ -1,4 +1,4 @@
-import type { CourseRuntimeProfile, RunEvent, RunFileCandidate, RunFileRecord, RunStartPayload } from "./types.js";
+import type { CourseRuntimeProfile, RunEvent, RunEventReceipt, RunFileCandidate, RunFileRecord, RunStartPayload } from "./types.js";
 /** Run-scoped client used only inside an Agent Service sandbox. */
 export declare class AgentServiceRunClient {
     private readonly baseUrl;
@@ -10,7 +10,7 @@ export declare class AgentServiceRunClient {
     private url;
     private request;
     getRun(): Promise<RunStartPayload>;
-    postEvent(agentRunId: string, event: RunEvent): Promise<void>;
+    postEvent(agentRunId: string, event: RunEvent): Promise<RunEventReceipt>;
     postFile(agentRunId: string, file: RunFileCandidate): Promise<RunFileRecord>;
     getRunRuntimeProfile(agentRunId: string): Promise<CourseRuntimeProfile>;
     heartbeat(): Promise<void>;

package/dist/agent-service-client.js

@@ -47,7 +47,18 @@ export class AgentServiceRunClient {
         this.assertRunId(agentRunId);
         this.traceId = event.trace_id ?? this.traceId;
         const sanitized = redactSecretsDeep(event, 8, [this.runToken]);
-        await this.request("POST", `/course/v1/agent-service/runs/${agentRunId}/events`, sanitized);
+        const response = await this.request("POST", `/course/v1/agent-service/runs/${agentRunId}/events`, sanitized);
+        return response?.disposition === "retry"
+            ? {
+                disposition: "retry",
+                ...(typeof response.candidate_attempt === "number"
+                    ? { candidate_attempt: response.candidate_attempt }
+                    : {}),
+                ...(typeof response.retry_feedback === "string"
+                    ? { retry_feedback: response.retry_feedback }
+                    : {}),
+            }
+            : { disposition: "accepted" };
     }
     async postFile(agentRunId, file) {
         this.assertRunId(agentRunId);

package/dist/agent-service-sandbox.d.ts

@@ -1,7 +1,7 @@
 import { type Logger } from "./log.js";
 import { type RuntimeSkillProviderFactory } from "./runtime-skills.js";
 import { type PersistentSessionExecution, type PreparedPersistentTurn, type RunReportingClient } from "./run-dispatcher.js";
-import type { CourseRuntime, CourseRuntimeProfile, RunEvent, RunFileCandidate, RunFileRecord, RunStartPayload } from "./types.js";
+import type { CourseRuntime, CourseRuntimeProfile, RunEvent, RunEventReceipt, RunFileCandidate, RunFileRecord, RunStartPayload } from "./types.js";
 export interface AgentServiceSandboxOptions {
     wsUrl: string;
     sandboxId: string;
@@ -73,7 +73,7 @@ export declare class AgentServiceSandboxClient implements RunReportingClient, Pe
     private recoverPendingActivationCleanups;
     run(): Promise<void>;
     stop(): void;
-    postEvent(agentRunId: string, event: RunEvent): Promise<void>;
+    postEvent(agentRunId: string, event: RunEvent): Promise<RunEventReceipt>;
     postFile(agentRunId: string, file: RunFileCandidate): Promise<RunFileRecord>;
     getRunRuntimeProfile(agentRunId: string): Promise<CourseRuntimeProfile>;
     private connectOnce;

package/dist/agent-service-sandbox.js

@@ -15,6 +15,7 @@ const MAX_SPOOL_FRAMES = 1024;
 const MAX_SPOOL_BYTES = 8 * 1024 * 1024;
 const MAX_EVENT_ACK_WINDOW = 64;
 const LEGACY_EVENT_ACK_WINDOW = 1;
+const INPUT_ATTACHMENT_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 /** 出站 seq 基址：seq = connection_epoch * SEQ_EPOCH_BASE + n，跨重连单调（合同 §1.1）。 */
 const SEQ_EPOCH_BASE = 1_000_000_000;
 const RUNTIME_LOG_WINDOW_MS = 60_000;
@@ -88,26 +89,44 @@ function inputAttachmentGrant(value) {
         throw new Error("invalid_input_attachment_grant");
     }
     const candidate = value;
-    const baseUrl = typeof candidate.base_url === "string" ? candidate.base_url.trim() : "";
-    const token = typeof candidate.token === "string" ? candidate.token.trim() : "";
-    if (!baseUrl || baseUrl.length > 2048 || !token || token.length > 8192) {
+    if (!Array.isArray(candidate.downloads) ||
+        candidate.downloads.length < 1 ||
+        candidate.downloads.length > 5) {
         throw new Error("invalid_input_attachment_grant");
     }
-    let parsed;
-    try {
-        parsed = new URL(baseUrl);
-    }
-    catch {
-        throw new Error("invalid_input_attachment_grant");
-    }
-    if (!["http:", "https:"].includes(parsed.protocol) ||
-        parsed.username ||
-        parsed.password ||
-        parsed.search ||
-        parsed.hash) {
+    const downloads = candidate.downloads.map((value) => {
+        if (!value || typeof value !== "object" || Array.isArray(value)) {
+            throw new Error("invalid_input_attachment_grant");
+        }
+        const raw = value;
+        const attachmentId = typeof raw.attachment_id === "string"
+            ? raw.attachment_id.trim()
+            : "";
+        const downloadUrl = typeof raw.download_url === "string"
+            ? raw.download_url.trim()
+            : "";
+        let parsed;
+        try {
+            parsed = new URL(downloadUrl);
+        }
+        catch {
+            throw new Error("invalid_input_attachment_grant");
+        }
+        if (!INPUT_ATTACHMENT_ID.test(attachmentId) ||
+            !downloadUrl ||
+            downloadUrl.length > 4096 ||
+            !["http:", "https:"].includes(parsed.protocol) ||
+            parsed.username ||
+            parsed.password ||
+            parsed.hash) {
+            throw new Error("invalid_input_attachment_grant");
+        }
+        return { attachmentId, downloadUrl };
+    });
+    if (new Set(downloads.map((item) => item.attachmentId)).size !== downloads.length) {
         throw new Error("invalid_input_attachment_grant");
     }
-    return { baseUrl: parsed.toString().replace(/\/$/, ""), token };
+    return { downloads };
 }
 function runtimeSkillGrantKey(grants) {
     return JSON.stringify(grants);
@@ -418,9 +437,8 @@ export class AgentServiceSandboxClient {
         const scope = this.turnScopes.get(payload.agent_run_id);
         if (!scope)
             return;
-        const activation = this.activationContexts.get(scope.sessionId);
         const session = this.state.sessions[scope.sessionId];
-        if (session && activation?.activationId === scope.activationId) {
+        if (session?.activationId === scope.activationId) {
             // Persist the cleanup obligation before attempting chmod. A terminal event has
             // already been durably ACKed at this point, so reconnect/restart must finish this
             // revoke even when the server desired state has already moved to idle.
@@ -603,8 +621,7 @@ export class AgentServiceSandboxClient {
             reject: rejectAck,
         });
         await this.sendFrame(frame);
-        if (event.type !== "run.block")
-            await ack;
+        return event.type !== "run.block" ? await ack : { disposition: "accepted" };
     }
     async postFile(agentRunId, file) {
         const scope = this.turnScopes.get(agentRunId);
@@ -1236,15 +1253,54 @@ export class AgentServiceSandboxClient {
         });
     }
     async handleTurnCancel(frame) {
-        if (!this.matchesTurnScope(frame, this.turnScopes.get(frame.agent_run_id))) {
+        const sessionId = frame.runtime_session_id;
+        const runId = frame.agent_run_id;
+        const workerAttempt = frame.worker_attempt;
+        const activationId = frame.activation_id;
+        const requestedScope = { sessionId, workerAttempt, activationId };
+        const existingScope = this.turnScopes.get(runId);
+        if (existingScope && !this.sameTurnScope(existingScope, requestedScope)) {
             await this.sendCommandAck(frame, "rejected", "turn_scope_mismatch");
             return;
         }
-        if (!this.dispatcher.cancel(frame.agent_run_id)) {
-            await this.sendCommandAck(frame, "rejected", "turn_not_running");
+        const session = this.state.sessions[sessionId];
+        if (!session) {
+            await this.sendCommandAck(frame, "rejected", "session_not_open");
+            return;
+        }
+        const accepted = Object.values(session.acceptedCommands).find((command) => command.agentRunId === runId);
+        if (accepted && (accepted.workerAttempt !== workerAttempt ||
+            accepted.activationId !== activationId)) {
+            await this.sendCommandAck(frame, "rejected", "turn_scope_mismatch");
             return;
         }
+        this.turnScopes.set(runId, requestedScope);
+        if (this.dispatcher.cancel(runId)) {
+            await this.sendCommandAck(frame, "ok");
+            return;
+        }
+        // ``turn.cancel`` may win the race before ``turn.start`` is delivered, or arrive
+        // after a daemon restart lost the runtime process.  The fenced server command is
+        // authoritative: ACK it and synthesize the durable terminal event without touching
+        // the sandbox generation or deleting the runtime-session workspace.
         await this.sendCommandAck(frame, "ok");
+        await this.postEvent(runId, {
+            type: "run.cancelled",
+            event_id: `cancel-${runId}-${workerAttempt}`,
+            seq: 1,
+            payload: {
+                reason: "cancelled_by_request",
+                runtime: session.runtimeId,
+            },
+        });
+        const commandId = `run:${runId}:${workerAttempt}`;
+        if (!session.completedCommands.includes(commandId)) {
+            session.completedCommands.push(commandId);
+            session.completedCommands = session.completedCommands.slice(-256);
+        }
+        delete session.acceptedCommands[commandId];
+        this.persist();
+        this.finishTurn({ agent_run_id: runId });
     }
     /**
      * 幂等关闭一个 runtime session：终止其 runtime 子进程、删除 workspace/native state、
@@ -1474,7 +1530,17 @@ export class AgentServiceSandboxClient {
         this.persist();
         if (pending) {
             this.pendingAcks.delete(frameId);
-            pending.resolve();
+            pending.resolve(frame.payload.disposition === "retry"
+                ? {
+                    disposition: "retry",
+                    ...(typeof frame.payload.candidate_attempt === "number"
+                        ? { candidate_attempt: frame.payload.candidate_attempt }
+                        : {}),
+                    ...(typeof frame.payload.retry_feedback === "string"
+                        ? { retry_feedback: frame.payload.retry_feedback }
+                        : {}),
+                }
+                : { disposition: "accepted" });
         }
     }
     async replaySpool() {

package/dist/course-client.d.ts

@@ -1,4 +1,4 @@
-import type { CourseRuntimeProfile, DaemonAuth, RunEvent, RunFileCandidate, RunFileRecord, RunStartPayload } from "./types.js";
+import type { CourseRuntimeProfile, DaemonAuth, RunEvent, RunEventReceipt, RunFileCandidate, RunFileRecord, RunStartPayload } from "./types.js";
 export declare class CourseClientError extends Error {
     readonly status: number;
     constructor(status: number, message: string);
@@ -31,7 +31,7 @@ export declare class CourseClient {
     private request;
     /** 领取下一个分配给本 daemon 的 queued run（无则返回 null）。 */
     claimNextRun(): Promise<RunStartPayload | null>;
-    postEvent(agentRunId: string, event: RunEvent): Promise<void>;
+    postEvent(agentRunId: string, event: RunEvent): Promise<RunEventReceipt>;
     postFile(agentRunId: string, file: RunFileCandidate): Promise<RunFileRecord | void>;
     getRunRuntimeProfile(agentRunId: string): Promise<CourseRuntimeProfile>;
 }

package/dist/course-client.js

@@ -103,7 +103,18 @@ export class CourseClient {
     async postEvent(agentRunId, event) {
         const credentials = [this.accessToken, this.refreshToken].filter((value) => typeof value === "string");
         const sanitized = redactSecretsDeep(event, 8, credentials);
-        await this.request("POST", `/course/v1/daemon/runs/${agentRunId}/events`, sanitized, event.trace_id);
+        const response = await this.request("POST", `/course/v1/daemon/runs/${agentRunId}/events`, sanitized, event.trace_id);
+        return response?.disposition === "retry"
+            ? {
+                disposition: "retry",
+                ...(typeof response.candidate_attempt === "number"
+                    ? { candidate_attempt: response.candidate_attempt }
+                    : {}),
+                ...(typeof response.retry_feedback === "string"
+                    ? { retry_feedback: response.retry_feedback }
+                    : {}),
+            }
+            : { disposition: "accepted" };
     }
     async postFile(agentRunId, file) {
         return this.request("POST", `/course/v1/daemon/runs/${agentRunId}/files`, file);

package/dist/input-attachments.d.ts

@@ -1,6 +1,8 @@
 import type { MaterializedInputAttachment, RunInputAttachment } from "./types.js";
 export interface InputAttachmentGrant {
-    baseUrl: string;
-    token: string;
+    downloads: Array<{
+        attachmentId: string;
+        downloadUrl: string;
+    }>;
 }
 export declare function materializeInputAttachments(workspaceDir: string, attachments: RunInputAttachment[], grant: InputAttachmentGrant, signal: AbortSignal): Promise<MaterializedInputAttachment[]>;

package/dist/input-attachments.js

@@ -58,26 +58,39 @@ function validateAttachment(attachment) {
     }
     return extension;
 }
-function validateGrant(grant) {
-    if (!grant.token || grant.token.length > 8192) {
-        throw new Error("invalid input attachment download token");
+function validateDownloadUrl(value) {
+    if (!value || value.length > 4096) {
+        throw new Error("invalid input attachment download URL");
     }
-    let base;
+    let parsed;
     try {
-        base = new URL(grant.baseUrl.endsWith("/") ? grant.baseUrl : `${grant.baseUrl}/`);
+        parsed = new URL(value);
     }
     catch {
         throw new Error("invalid input attachment download URL");
     }
-    if (!["http:", "https:"].includes(base.protocol) ||
-        base.username ||
-        base.password ||
-        base.search ||
-        base.hash ||
-        base.toString().length > 2048) {
+    if (!["http:", "https:"].includes(parsed.protocol) ||
+        parsed.username ||
+        parsed.password ||
+        parsed.hash) {
         throw new Error("invalid input attachment download URL");
     }
-    return base;
+    return value;
+}
+function validateGrant(grant) {
+    if (!Array.isArray(grant.downloads) ||
+        grant.downloads.length < 1 ||
+        grant.downloads.length > MAX_ATTACHMENTS) {
+        throw new Error("invalid input attachment download grant");
+    }
+    const downloads = new Map();
+    for (const item of grant.downloads) {
+        if (!ATTACHMENT_ID.test(item.attachmentId) || downloads.has(item.attachmentId)) {
+            throw new Error("invalid input attachment download grant");
+        }
+        downloads.set(item.attachmentId, validateDownloadUrl(item.downloadUrl));
+    }
+    return downloads;
 }
 function hasExpectedImageSignature(contentType, bytes) {
     switch (contentType) {
@@ -177,7 +190,12 @@ export async function materializeInputAttachments(workspaceDir, attachments, gra
     if (new Set(attachments.map((item) => item.attachment_id)).size !== attachments.length) {
         throw new Error("duplicate input attachment id");
     }
-    const baseUrl = validateGrant(grant);
+    const extensions = new Map(attachments.map((attachment) => [attachment.attachment_id, validateAttachment(attachment)]));
+    const downloadUrls = validateGrant(grant);
+    if (downloadUrls.size !== attachments.length ||
+        attachments.some((attachment) => !downloadUrls.has(attachment.attachment_id))) {
+        throw new Error("input attachment download grant does not match run attachments");
+    }
     const inputDir = path.resolve(workspaceDir, ".botlearn", "input-attachments");
     const workspaceRoot = path.resolve(workspaceDir);
     if (!inputDir.startsWith(`${workspaceRoot}${path.sep}`)) {
@@ -188,7 +206,7 @@ export async function materializeInputAttachments(workspaceDir, attachments, gra
     await chmod(inputDir, 0o770);
     const results = [];
     for (const attachment of attachments) {
-        const extension = validateAttachment(attachment);
+        const extension = extensions.get(attachment.attachment_id);
         const filename = `${attachment.attachment_id}${extension}`;
         const filePath = path.join(inputDir, filename);
         const relativePath = path.posix.join(".botlearn", "input-attachments", filename);
@@ -196,9 +214,9 @@ export async function materializeInputAttachments(workspaceDir, attachments, gra
             await rm(filePath, { force: true });
             const partPath = `${filePath}.part`;
             await rm(partPath, { force: true });
-            const downloadUrl = new URL(encodeURIComponent(attachment.attachment_id), baseUrl);
+            const downloadUrl = downloadUrls.get(attachment.attachment_id);
             const response = await fetch(downloadUrl, {
-                headers: { authorization: `Bearer ${grant.token}` },
+                headers: { "accept-encoding": "identity" },
                 redirect: "error",
                 signal,
             });

package/dist/run-dispatcher.d.ts

@@ -2,7 +2,7 @@ import { type ScanLimits } from "./file-candidates.js";
 import { type InputAttachmentGrant } from "./input-attachments.js";
 import { type Logger } from "./log.js";
 import type { PreparedRuntimeSkillProvider } from "./runtime-skills.js";
-import { type CourseRuntimeProfile, type CourseRuntime, type RunEvent, type RunStartPayload } from "./types.js";
+import { type CourseRuntimeProfile, type CourseRuntime, type RunEvent, type RunEventReceipt, type RunStartPayload } from "./types.js";
 export interface RunDispatcherOptions {
     defaultRuntimeId?: string;
     log?: Logger;
@@ -26,7 +26,7 @@ export interface PersistentSessionExecution {
     finishTurn(payload: RunStartPayload): void;
 }
 export interface RunReportingClient {
-    postEvent(agentRunId: string, event: RunEvent): Promise<void>;
+    postEvent(agentRunId: string, event: RunEvent): Promise<void | RunEventReceipt>;
     postFile(agentRunId: string, file: import("./types.js").RunFileCandidate): Promise<unknown>;
     getRunRuntimeProfile?(agentRunId: string): Promise<CourseRuntimeProfile>;
 }

package/dist/run-dispatcher.js

@@ -23,6 +23,7 @@ const BLOCK_TEXT_MAX_CHARS = 4000;
 const CONTENT_FLUSH_MAX_CHARS = 512;
 const CONTENT_FLUSH_INTERVAL_MS = 100;
 const AGENT_STREAM_SCHEMA_VERSION = "agent-stream/0.1";
+const MAX_CANDIDATE_GENERATION_ATTEMPTS = 3;
 const SAFE_TOOL_NAME = /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,79}$/;
 const SAFE_FAILURE_CODE = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,119}$/;
 const SAFE_FAILURE_MODEL = /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,159}$/;
@@ -100,6 +101,29 @@ function chunkUnicodeText(value, maxCodePoints) {
     }
     return chunks;
 }
+function candidateRetryPayload(payload, feedback) {
+    const original = typeof payload.input.text === "string" ? payload.input.text : "";
+    const instruction = truncateText(redactSecretString(feedback?.trim() || "Produce a complete learner-facing reply."), 800);
+    return {
+        ...payload,
+        input: {
+            ...payload.input,
+            text: [
+                "[BotLearn internal response retry]",
+                "Replace the previous candidate completely. Do not mention this review or the previous reply.",
+                `Correction required: ${instruction}`,
+                original ? `Original current request:\n${original}` : "",
+            ].filter(Boolean).join("\n\n"),
+        },
+    };
+}
+function replacesLatestConversationTurn(payload) {
+    const regeneration = payload.context.regeneration;
+    return Boolean(regeneration &&
+        typeof regeneration === "object" &&
+        !Array.isArray(regeneration) &&
+        regeneration.mode === "replace_latest");
+}
 /**
  * Run dispatcher：把 Course Service 下发的 run.start 交给 runtime，
  * 并把 runtime 输出归一化成 run.block / run.message / run.completed 回报 Course Service。
@@ -265,8 +289,7 @@ export class RunDispatcher {
             };
             for (let attempt = 0; attempt < 3; attempt += 1) {
                 try {
-                    await this.client.postEvent(runId, outgoing);
-                    return;
+                    return await this.client.postEvent(runId, outgoing);
                 }
                 catch (err) {
                     if (isRunTerminal(err)) {
@@ -274,7 +297,13 @@ export class RunDispatcher {
                         controller.abort();
                         return;
                     }
-                    const retryable = !(err instanceof CourseClientError) || err.status === 429 || err.status >= 500;
+                    const candidateReview = event.type === "run.message"
+                        && typeof event.payload?.candidate_attempt === "number";
+                    // The Course Service already retries the side-effect-free judge once. A known
+                    // 5xx from that boundary must not multiply one review into six provider calls;
+                    // transport errors without a response still reuse this event id normally.
+                    const retryable = !(err instanceof CourseClientError)
+                        || (!candidateReview && (err.status === 429 || err.status >= 500));
                     if (!retryable || attempt === 2)
                         throw err;
                     await new Promise((resolve) => setTimeout(resolve, 100 * (attempt + 1)));
@@ -441,6 +470,14 @@ export class RunDispatcher {
                 controller.abort();
             }, timeoutSeconds * 1000);
             let finalText = "";
+            let activeNativeSessionId = persistentTurn?.nativeSessionId ?? null;
+            if (activeNativeSessionId && replacesLatestConversationTurn(payload)) {
+                // A user retry is a replacement branch, not a follow-up to the discarded answer.
+                // Clear the provider-native cache before execution; the durable Course transcript
+                // in this payload is sufficient to rebuild the branch in the same turn.
+                activeNativeSessionId = null;
+                this.persistentSession?.persistNativeSession("");
+            }
             // 上一次真正上了 wire 的块 kind：status 只在 kind 切换时上报一次，避免刷屏。
             let lastReportedKind = null;
             let lastReasoningPhase = null;
@@ -730,31 +767,93 @@ export class RunDispatcher {
                     await this.client.postFile(runId, file);
                 },
                 runtimeSession: async (sessionId) => {
+                    activeNativeSessionId = sessionId;
                     this.persistentSession?.persistNativeSession(sessionId);
                 },
             };
             modelStartedAt = this.now();
+            let acceptedOutput = "";
+            let attemptPayload = payload;
+            const resetVisibleCandidate = async () => {
+                await send({
+                    type: "run.block",
+                    payload: {
+                        schema_version: AGENT_STREAM_SCHEMA_VERSION,
+                        kind: "response_reset",
+                        runtime: runtime.id,
+                        status: "retrying",
+                    },
+                });
+            };
             try {
-                await runtime.run({
-                    payload,
-                    workspaceDir,
-                    inputAttachments,
-                    ...(persistentTurn
-                        ? {
-                            ...(persistentTurn.runtimeStateDir
-                                ? { runtimeStateDir: persistentTurn.runtimeStateDir }
-                                : {}),
-                            nativeSessionId: persistentTurn.nativeSessionId,
-                            contextRevision: persistentTurn.contextRevision,
-                            ...(persistentTurn.runtimeEnv
-                                ? { runtimeEnv: persistentTurn.runtimeEnv }
-                                : {}),
-                            ...(persistentTurn.skillProvider
-                                ? { skillProvider: persistentTurn.skillProvider }
-                                : {}),
-                        }
-                        : {}),
-                }, sink, controller.signal);
+                for (let candidateAttempt = 1; candidateAttempt <= MAX_CANDIDATE_GENERATION_ATTEMPTS; candidateAttempt += 1) {
+                    finalText = "";
+                    await runtime.run({
+                        payload: attemptPayload,
+                        workspaceDir,
+                        inputAttachments,
+                        ...(persistentTurn
+                            ? {
+                                ...(persistentTurn.runtimeStateDir
+                                    ? { runtimeStateDir: persistentTurn.runtimeStateDir }
+                                    : {}),
+                                nativeSessionId: activeNativeSessionId,
+                                contextRevision: persistentTurn.contextRevision,
+                                ...(persistentTurn.runtimeEnv
+                                    ? { runtimeEnv: persistentTurn.runtimeEnv }
+                                    : {}),
+                                ...(persistentTurn.skillProvider
+                                    ? { skillProvider: persistentTurn.skillProvider }
+                                    : {}),
+                            }
+                            : {}),
+                    }, sink, controller.signal);
+                    await flushContent();
+                    if (serverTerminal)
+                        return;
+                    if (controller.signal.aborted)
+                        throw new Error("aborted");
+                    const maxOutputChars = typeof payload.limits.max_output_chars === "number" &&
+                        Number.isFinite(payload.limits.max_output_chars) &&
+                        payload.limits.max_output_chars > 0
+                        ? payload.limits.max_output_chars
+                        : DEFAULT_MAX_OUTPUT_CHARS;
+                    const output = redactSecretString(truncateText(finalText, maxOutputChars));
+                    await send({
+                        type: "run.block",
+                        payload: {
+                            schema_version: AGENT_STREAM_SCHEMA_VERSION,
+                            kind: "response_review",
+                            runtime: runtime.id,
+                            status: "in_progress",
+                        },
+                    });
+                    let receipt;
+                    try {
+                        receipt = await send({
+                            type: "run.message",
+                            role: "assistant",
+                            text: output,
+                            payload: { candidate_attempt: candidateAttempt },
+                        });
+                    }
+                    catch (error) {
+                        await resetVisibleCandidate();
+                        throw error;
+                    }
+                    if (receipt?.disposition !== "retry") {
+                        acceptedOutput = output;
+                        break;
+                    }
+                    await resetVisibleCandidate();
+                    if (candidateAttempt >= MAX_CANDIDATE_GENERATION_ATTEMPTS) {
+                        await sendFailure("candidate_rejected", "Agent could not produce a complete reply after two retries", new RuntimeExecutionError("Agent candidate rejected after bounded retries"), { candidate_attempts: candidateAttempt });
+                        return;
+                    }
+                    lastReportedKind = null;
+                    lastReasoningPhase = null;
+                    attemptPayload = candidateRetryPayload(payload, receipt.retry_feedback);
+                }
             }
             finally {
                 modelFinishedAt = this.now();
@@ -764,13 +863,7 @@ export class RunDispatcher {
                 return;
             if (controller.signal.aborted)
                 throw new Error("aborted");
-            const maxOutputChars = typeof payload.limits.max_output_chars === "number" &&
-                Number.isFinite(payload.limits.max_output_chars) &&
-                payload.limits.max_output_chars > 0
-                ? payload.limits.max_output_chars
-                : DEFAULT_MAX_OUTPUT_CHARS;
-            const output = redactSecretString(truncateText(finalText, maxOutputChars));
-            activeTranscript.writeFinal(output);
+            activeTranscript.writeFinal(acceptedOutput);
             fileReportStartedAt = this.now();
             try {
                 await reportFileCandidates(this.client, runId, workspaceDir, this.log, this.scanLimits);
@@ -778,7 +871,6 @@ export class RunDispatcher {
             finally {
                 fileReportFinishedAt = this.now();
             }
-            await send({ type: "run.message", role: "assistant", text: output });
             await sendTerminal({
                 type: "run.completed",
                 payload: { runtime: runtimeId, usage: usage() },

package/dist/types.d.ts

@@ -68,6 +68,11 @@ export interface RunEvent {
     error?: string;
     payload?: Record<string, unknown>;
 }
+export interface RunEventReceipt {
+    disposition: "accepted" | "retry";
+    candidate_attempt?: number;
+    retry_feedback?: string;
+}
 /** `POST /daemon/runs/{id}/files` 的文件候选（与后端 DaemonRunFileIn 一致）。 */
 export interface RunFileCandidate {
     event?: "created" | "modified" | "deleted";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botlearn-course/daemon",
-  "version": "0.0.15",
+  "version": "0.0.17-beta.1",
   "description": "Lightweight BotLearn Course daemon: run course tasks on your own machine with your own agent runtime (BYOA).",
   "type": "module",
   "bin": {