@botlearn-course/daemon 0.0.16 → 0.0.17-beta.2

package/README.md

@@ -102,6 +102,9 @@ runtime 凭据。
 - 文件扫描只访问 workspace 内路径；包含 `..`、绝对路径或反斜杠的路径会被拒绝。daemon
   只上报相对路径、大小、sha256 和有界脱敏 preview，文件正文始终留在本地或托管 sandbox
   的持久 workspace，不上传 Course Service 或对象存储。扫描或 metadata 上报失败不影响 run 终态。
+- 托管 Practice Agent 的学员输入附件由 Course Service 为当前 activation 签发单对象、短时效的
+  存储源站 URL；daemon 直接下载并复核 grant 集合、大小、SHA-256、MIME 与图片签名。URL 只留在
+  control process 内存，不进入 runtime env、prompt、workspace state、transcript、事件或日志。
 - 每个 run 在独立 workspace 内执行并有超时上限；runtime 进程在取消/超时后会被终止
   （SIGTERM → SIGKILL）。
 - `report_progress` MCP 子进程以 clean environment 启动，不继承 Course 控制字段或模型凭据；

package/dist/agent-service-sandbox.js

@@ -15,6 +15,7 @@ const MAX_SPOOL_FRAMES = 1024;
 const MAX_SPOOL_BYTES = 8 * 1024 * 1024;
 const MAX_EVENT_ACK_WINDOW = 64;
 const LEGACY_EVENT_ACK_WINDOW = 1;
+const INPUT_ATTACHMENT_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 /** 出站 seq 基址：seq = connection_epoch * SEQ_EPOCH_BASE + n，跨重连单调（合同 §1.1）。 */
 const SEQ_EPOCH_BASE = 1_000_000_000;
 const RUNTIME_LOG_WINDOW_MS = 60_000;
@@ -88,26 +89,44 @@ function inputAttachmentGrant(value) {
         throw new Error("invalid_input_attachment_grant");
     }
     const candidate = value;
-    const baseUrl = typeof candidate.base_url === "string" ? candidate.base_url.trim() : "";
-    const token = typeof candidate.token === "string" ? candidate.token.trim() : "";
-    if (!baseUrl || baseUrl.length > 2048 || !token || token.length > 8192) {
+    if (!Array.isArray(candidate.downloads) ||
+        candidate.downloads.length < 1 ||
+        candidate.downloads.length > 5) {
         throw new Error("invalid_input_attachment_grant");
     }
-    let parsed;
-    try {
-        parsed = new URL(baseUrl);
-    }
-    catch {
-        throw new Error("invalid_input_attachment_grant");
-    }
-    if (!["http:", "https:"].includes(parsed.protocol) ||
-        parsed.username ||
-        parsed.password ||
-        parsed.search ||
-        parsed.hash) {
+    const downloads = candidate.downloads.map((value) => {
+        if (!value || typeof value !== "object" || Array.isArray(value)) {
+            throw new Error("invalid_input_attachment_grant");
+        }
+        const raw = value;
+        const attachmentId = typeof raw.attachment_id === "string"
+            ? raw.attachment_id.trim()
+            : "";
+        const downloadUrl = typeof raw.download_url === "string"
+            ? raw.download_url.trim()
+            : "";
+        let parsed;
+        try {
+            parsed = new URL(downloadUrl);
+        }
+        catch {
+            throw new Error("invalid_input_attachment_grant");
+        }
+        if (!INPUT_ATTACHMENT_ID.test(attachmentId) ||
+            !downloadUrl ||
+            downloadUrl.length > 4096 ||
+            !["http:", "https:"].includes(parsed.protocol) ||
+            parsed.username ||
+            parsed.password ||
+            parsed.hash) {
+            throw new Error("invalid_input_attachment_grant");
+        }
+        return { attachmentId, downloadUrl };
+    });
+    if (new Set(downloads.map((item) => item.attachmentId)).size !== downloads.length) {
         throw new Error("invalid_input_attachment_grant");
     }
-    return { baseUrl: parsed.toString().replace(/\/$/, ""), token };
+    return { downloads };
 }
 function runtimeSkillGrantKey(grants) {
     return JSON.stringify(grants);

package/dist/input-attachments.d.ts

@@ -1,6 +1,8 @@
 import type { MaterializedInputAttachment, RunInputAttachment } from "./types.js";
 export interface InputAttachmentGrant {
-    baseUrl: string;
-    token: string;
+    downloads: Array<{
+        attachmentId: string;
+        downloadUrl: string;
+    }>;
 }
 export declare function materializeInputAttachments(workspaceDir: string, attachments: RunInputAttachment[], grant: InputAttachmentGrant, signal: AbortSignal): Promise<MaterializedInputAttachment[]>;

package/dist/input-attachments.js

@@ -58,26 +58,39 @@ function validateAttachment(attachment) {
     }
     return extension;
 }
-function validateGrant(grant) {
-    if (!grant.token || grant.token.length > 8192) {
-        throw new Error("invalid input attachment download token");
+function validateDownloadUrl(value) {
+    if (!value || value.length > 4096) {
+        throw new Error("invalid input attachment download URL");
     }
-    let base;
+    let parsed;
     try {
-        base = new URL(grant.baseUrl.endsWith("/") ? grant.baseUrl : `${grant.baseUrl}/`);
+        parsed = new URL(value);
     }
     catch {
         throw new Error("invalid input attachment download URL");
     }
-    if (!["http:", "https:"].includes(base.protocol) ||
-        base.username ||
-        base.password ||
-        base.search ||
-        base.hash ||
-        base.toString().length > 2048) {
+    if (!["http:", "https:"].includes(parsed.protocol) ||
+        parsed.username ||
+        parsed.password ||
+        parsed.hash) {
         throw new Error("invalid input attachment download URL");
     }
-    return base;
+    return value;
+}
+function validateGrant(grant) {
+    if (!Array.isArray(grant.downloads) ||
+        grant.downloads.length < 1 ||
+        grant.downloads.length > MAX_ATTACHMENTS) {
+        throw new Error("invalid input attachment download grant");
+    }
+    const downloads = new Map();
+    for (const item of grant.downloads) {
+        if (!ATTACHMENT_ID.test(item.attachmentId) || downloads.has(item.attachmentId)) {
+            throw new Error("invalid input attachment download grant");
+        }
+        downloads.set(item.attachmentId, validateDownloadUrl(item.downloadUrl));
+    }
+    return downloads;
 }
 function hasExpectedImageSignature(contentType, bytes) {
     switch (contentType) {
@@ -177,7 +190,12 @@ export async function materializeInputAttachments(workspaceDir, attachments, gra
     if (new Set(attachments.map((item) => item.attachment_id)).size !== attachments.length) {
         throw new Error("duplicate input attachment id");
     }
-    const baseUrl = validateGrant(grant);
+    const extensions = new Map(attachments.map((attachment) => [attachment.attachment_id, validateAttachment(attachment)]));
+    const downloadUrls = validateGrant(grant);
+    if (downloadUrls.size !== attachments.length ||
+        attachments.some((attachment) => !downloadUrls.has(attachment.attachment_id))) {
+        throw new Error("input attachment download grant does not match run attachments");
+    }
     const inputDir = path.resolve(workspaceDir, ".botlearn", "input-attachments");
     const workspaceRoot = path.resolve(workspaceDir);
     if (!inputDir.startsWith(`${workspaceRoot}${path.sep}`)) {
@@ -188,7 +206,7 @@ export async function materializeInputAttachments(workspaceDir, attachments, gra
     await chmod(inputDir, 0o770);
     const results = [];
     for (const attachment of attachments) {
-        const extension = validateAttachment(attachment);
+        const extension = extensions.get(attachment.attachment_id);
         const filename = `${attachment.attachment_id}${extension}`;
         const filePath = path.join(inputDir, filename);
         const relativePath = path.posix.join(".botlearn", "input-attachments", filename);
@@ -196,9 +214,9 @@ export async function materializeInputAttachments(workspaceDir, attachments, gra
             await rm(filePath, { force: true });
             const partPath = `${filePath}.part`;
             await rm(partPath, { force: true });
-            const downloadUrl = new URL(encodeURIComponent(attachment.attachment_id), baseUrl);
+            const downloadUrl = downloadUrls.get(attachment.attachment_id);
             const response = await fetch(downloadUrl, {
-                headers: { authorization: `Bearer ${grant.token}` },
+                headers: { "accept-encoding": "identity" },
                 redirect: "error",
                 signal,
             });

package/dist/run-dispatcher.js

@@ -18,6 +18,10 @@ const DEFAULT_TIMEOUT_SECONDS = 900;
 const MIN_TIMEOUT_SECONDS = 30;
 const MAX_TIMEOUT_SECONDS = 7200;
 const DEFAULT_MAX_OUTPUT_CHARS = 100_000;
+// Attachment size is bounded at 10 MiB in input-attachments.ts. Keep one universal
+// materialization budget that also works for supported cross-cloud object stores; this is
+// a daemon compatibility invariant, not an environment-specific tuning knob.
+const INPUT_ATTACHMENT_DOWNLOAD_TIMEOUT_MS = 5 * 60_000;
 // wire 上单块文本上限；完整文本在本地 transcript。
 const BLOCK_TEXT_MAX_CHARS = 4000;
 const CONTENT_FLUSH_MAX_CHARS = 512;
@@ -449,7 +453,7 @@ export class RunDispatcher {
                 const attachmentController = new AbortController();
                 const abortAttachmentDownload = () => attachmentController.abort();
                 controller.signal.addEventListener("abort", abortAttachmentDownload, { once: true });
-                const attachmentTimer = setTimeout(abortAttachmentDownload, 60_000);
+                const attachmentTimer = setTimeout(abortAttachmentDownload, INPUT_ATTACHMENT_DOWNLOAD_TIMEOUT_MS);
                 try {
                     inputAttachments = await materializeInputAttachments(workspaceDir, requestedAttachments, persistentTurn.inputAttachmentGrant, attachmentController.signal);
                 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botlearn-course/daemon",
-  "version": "0.0.16",
+  "version": "0.0.17-beta.2",
   "description": "Lightweight BotLearn Course daemon: run course tasks on your own machine with your own agent runtime (BYOA).",
   "type": "module",
   "bin": {