@botlearn-course/daemon 0.0.2 → 0.0.3

package/dist/runtimes/deepseek-tui.js

@@ -3,7 +3,7 @@ import { existsSync, realpathSync } from "node:fs";
 import path from "node:path";
 import net from "node:net";
 import { MAX_PROGRESS_EVENTS_PER_ATTEMPT } from "../mcp/report-progress.js";
-import { runtimeChildEnv } from "../runtime-env.js";
+import { runtimeChildEnv, runtimeChildIdentity } from "../runtime-env.js";
 import { readCommandVersion, resolveCommandOnPath } from "./probe.js";
 import { adaptDeepseekProgressStarted, cleanupProgressMcpConfig, createDeepseekProgressState, createProgressMcpConfig, deepseekProgressDispositions, isDeepseekProgressCompletion, progressMcpAutoInjectionSupported, progressSystemContext, } from "./progress.js";
 import { consoleLogger, wrapEngineAdapter, } from "./engine.js";
@@ -210,7 +210,8 @@ export class DeepseekTuiAdapter {
                 token,
             ], {
                 cwd: opts.cwd,
-                env: this.spawnEnv(progressMcpConfig?.path),
+                env: this.spawnEnv(opts, progressMcpConfig?.path),
+                ...runtimeChildIdentity(),
                 stdio: ["ignore", "pipe", "pipe"],
                 // 自成进程组：解析到的二进制可能是会再 spawn 真实 deepseek-tui
                 // server 的 dispatcher，shutdown 必须对整组发信号而非仅直接子进程。
@@ -264,9 +265,9 @@ export class DeepseekTuiAdapter {
      * 不设置 DEEPSEEK_RUNTIME_DIR：server 跨 run 池化共享，per-run 目录不成立；
      * BYOA 直接用用户本机 deepseek 自身的默认状态目录（含已登录凭据）。
      */
-    spawnEnv(progressMcpConfigPath) {
+    spawnEnv(opts, progressMcpConfigPath) {
         const env = {
-            ...runtimeChildEnv(),
+            ...runtimeChildEnv(opts.env ?? process.env),
             FORCE_COLOR: "0",
             NO_COLOR: "1",
         };
@@ -636,11 +637,11 @@ function extractDeepseekError(eventName, payload) {
             stringField(payload?.payload, "message") ??
             stringField(payload?.payload, "error"));
     }
-    if (eventName === "item.failed") {
-        return (stringField(payload?.payload?.item, "detail") ??
-            stringField(payload?.payload?.item, "summary") ??
-            stringField(payload?.payload, "error"));
-    }
+    // An item failure is a tool result inside an otherwise live turn. DeepSeek may use it
+    // to correct the arguments, choose another tool, and still complete the turn. Treating
+    // its detail as a sticky runtime error would discard that recovery and fail the run
+    // even after a later assistant message or successful turn completion. Only provider
+    // errors and terminal turn failures are run-level errors here.
     if (isDeepseekTerminalEvent(eventName, payload)) {
         const turn = payload?.payload?.turn ?? payload?.turn;
         const status = stringField(turn, "status");

package/dist/runtimes/engine.d.ts

@@ -37,6 +37,7 @@ export interface EngineRunOptions {
     systemContext?: string;
     onBlock?: (block: StreamBlock) => void;
     onStatus?: (event: RuntimeStatusEvent) => void;
+    env?: NodeJS.ProcessEnv;
 }
 export interface EngineRunResult {
     text: string;

package/dist/runtimes/engine.js

@@ -114,9 +114,10 @@ export function wrapEngineAdapter(id, engine, opts) {
             };
             const result = await engine.run({
                 text,
-                sessionId: null,
+                sessionId: run.nativeSessionId ?? null,
                 cwd: run.workspaceDir,
                 signal,
+                ...(run.runtimeEnv ? { env: run.runtimeEnv } : {}),
                 ...(extraArgs.length > 0 ? { extraArgs } : {}),
                 ...(systemContext !== undefined ? { systemContext } : {}),
                 onBlock: (block) => {
@@ -143,6 +144,7 @@ export function wrapEngineAdapter(id, engine, opts) {
             if (result.progressDispositions) {
                 await sink.progressDispositions?.(result.progressDispositions);
             }
+            await sink.runtimeSession?.(result.newSessionId);
             if (result.error) {
                 throw new RuntimeExecutionError(result.error, "runtime_error", result.runtimeFailure);
             }

package/dist/runtimes/hermes-agent.d.ts

@@ -41,7 +41,7 @@ export declare class HermesAgentAdapter extends AcpRuntimeAdapter {
      * 用户 `~/.hermes` 的 `.env` / config.yaml 里。
      */
     protected buildArgs(_opts: EngineRunOptions): string[];
-    protected spawnEnv(_opts: EngineRunOptions): NodeJS.ProcessEnv;
+    protected spawnEnv(opts: EngineRunOptions): NodeJS.ProcessEnv;
     /** spawn 前把 systemContext 原子写入 `<cwd>/AGENTS.md`（tmp 0600 + rename）。 */
     protected prepareTurn(opts: EngineRunOptions): void;
     /**

package/dist/runtimes/hermes-agent.js

@@ -3,6 +3,7 @@ import path from "node:path";
 import { AcpRuntimeAdapter, } from "./acp-stream.js";
 import { firstExistingPath, readCommandVersion, resolveCommandOnPath, resolveHomePath, } from "./probe.js";
 import { wrapEngineAdapter, } from "./engine.js";
+import { runtimeChildEnv } from "../runtime-env.js";
 /**
  * `hermes-acp` 不在 PATH 上时的已知绝对位置。上游 `scripts/install.sh`
  * （curl|bash 安装器）把私有 virtualenv 装到 `~/.hermes/hermes-agent/venv/`，
@@ -80,9 +81,9 @@ export class HermesAgentAdapter extends AcpRuntimeAdapter {
     buildArgs(_opts) {
         return [];
     }
-    spawnEnv(_opts) {
+    spawnEnv(opts) {
         return {
-            ...process.env,
+            ...runtimeChildEnv(opts.env ?? process.env),
             // 保持 ACP stdout 无 ANSI 码。
             NO_COLOR: "1",
             // 危险工具调用走 ACP request_permission。

package/dist/runtimes/ndjson-stream.d.ts

@@ -46,6 +46,6 @@ export declare abstract class NdjsonStreamAdapter implements EngineAdapter {
     protected abstract buildArgs(opts: EngineRunOptions): string[];
     protected abstract handleEvent(obj: unknown, ctx: NdjsonEventCtx): void;
     /** 覆盖以调整 env（FORCE_COLOR=0、NO_COLOR=1 等）。 */
-    protected spawnEnv(_opts: EngineRunOptions): NodeJS.ProcessEnv;
+    protected spawnEnv(opts: EngineRunOptions): NodeJS.ProcessEnv;
     run(opts: EngineRunOptions): Promise<EngineRunResult>;
 }

package/dist/runtimes/ndjson-stream.js

@@ -1,4 +1,5 @@
 import { spawn } from "node:child_process";
+import { runtimeChildEnv, runtimeChildIdentity } from "../runtime-env.js";
 import { safeCommand, sanitizeRuntimeFailureText, tailText } from "../redaction.js";
 import { sliceUtf8Bytes, utf8ByteLength } from "./text-cap.js";
 import { consoleLogger, } from "./engine.js";
@@ -21,8 +22,8 @@ export class NdjsonStreamAdapter {
         this.log = logger ?? consoleLogger;
     }
     /** 覆盖以调整 env（FORCE_COLOR=0、NO_COLOR=1 等）。 */
-    spawnEnv(_opts) {
-        return { ...process.env };
+    spawnEnv(opts) {
+        return runtimeChildEnv(opts.env ?? process.env);
     }
     async run(opts) {
         if (opts.signal.aborted) {
@@ -43,6 +44,7 @@ export class NdjsonStreamAdapter {
         const child = spawn(binary, args, {
             cwd: opts.cwd,
             env: this.spawnEnv(opts),
+            ...runtimeChildIdentity(),
             stdio: ["ignore", "pipe", "pipe"],
         });
         // spawn 是同步的，但若在 spawn 与稍后挂监听之间发生 abort 会被漏掉，

package/dist/runtimes/openclaw-acp.js

@@ -1,4 +1,5 @@
 import { spawn } from "node:child_process";
+import { runtimeChildEnv, runtimeChildIdentity } from "../runtime-env.js";
 import { readCommandVersion, resolveCommandOnPath } from "./probe.js";
 import { sliceUtf8Bytes } from "./text-cap.js";
 import { consoleLogger, wrapEngineAdapter, } from "./engine.js";
@@ -384,7 +385,8 @@ export class OpenclawAcpAdapter {
             args.push("--token", gateway.token);
         const child = this.spawnFn(command, args, {
             stdio: ["pipe", "pipe", "pipe"],
-            env: { ...process.env },
+            env: runtimeChildEnv(this.env ?? process.env),
+            ...runtimeChildIdentity(),
         });
         installExitCleanupHook();
         const handle = {

package/dist/sandbox-supervisor.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export declare function acquireSessionSupervisorLock(runtimeSessionId: string, lockRoot?: string): (() => void) | null;
+export declare function runSandboxSupervisor(argv: string[]): Promise<number>;

package/dist/sandbox-supervisor.js

@@ -0,0 +1,176 @@
+#!/usr/bin/env node
+import { execFileSync, spawn } from "node:child_process";
+import { chmodSync, chownSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync, } from "node:fs";
+import path from "node:path";
+const MAX_BOOTSTRAP_BYTES = 64 * 1024;
+const CONTROL_USER = "botlearn-control";
+const RUNTIME_USER = "user";
+const CONTROL_HOME = "/home/botlearn-control/.botlearn-course/daemon";
+const WORKSPACE = "/workspace";
+const RUNTIME_PROFILE_ROOT = "/run/botlearn-runtime-profiles";
+const SUPERVISOR_LOCK_ROOT = "/run/botlearn-sandbox-supervisors";
+const DAEMON_BINARY = "/usr/local/bin/botlearn-course-daemon";
+function numericId(flag, user) {
+    const output = execFileSync("/usr/bin/id", [flag, user], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+    }).trim();
+    const value = Number(output);
+    if (!Number.isInteger(value) || value < 1) {
+        throw new Error(`sandbox supervisor could not resolve ${flag} for ${user}`);
+    }
+    return value;
+}
+async function readOneShotBootstrap() {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of process.stdin) {
+        const bytes = Buffer.from(chunk);
+        size += bytes.length;
+        if (size > MAX_BOOTSTRAP_BYTES) {
+            throw new Error("sandbox supervisor bootstrap exceeds size limit");
+        }
+        chunks.push(bytes);
+    }
+    if (size === 0)
+        throw new Error("sandbox supervisor bootstrap is empty");
+    return Buffer.concat(chunks);
+}
+export function acquireSessionSupervisorLock(runtimeSessionId, lockRoot = SUPERVISOR_LOCK_ROOT) {
+    const lockDir = path.join(lockRoot, runtimeSessionId);
+    const pidFile = path.join(lockDir, "pid");
+    mkdirSync(lockRoot, { recursive: true, mode: 0o700 });
+    try {
+        mkdirSync(lockDir, { mode: 0o700 });
+    }
+    catch (error) {
+        if (!existsSync(pidFile))
+            throw error;
+        const existingPid = Number(readFileSync(pidFile, "utf8").trim());
+        if (Number.isInteger(existingPid) && existingPid > 1) {
+            try {
+                process.kill(existingPid, 0);
+                return null;
+            }
+            catch {
+                // Stale lock from a supervisor that no longer exists.
+            }
+        }
+        rmSync(lockDir, { recursive: true, force: true });
+        mkdirSync(lockDir, { mode: 0o700 });
+    }
+    writeFileSync(pidFile, `${process.pid}\n`, { mode: 0o600 });
+    return () => {
+        try {
+            if (Number(readFileSync(pidFile, "utf8").trim()) === process.pid) {
+                rmSync(lockDir, { recursive: true, force: true });
+            }
+        }
+        catch {
+            // A replacement supervisor already owns or removed the lock.
+        }
+    };
+}
+function prepareDirectories(controlUid, controlGid, runtimeUid, runtimeSessionId, sessionGeneration) {
+    mkdirSync(CONTROL_HOME, { recursive: true, mode: 0o700 });
+    chownSync("/home/botlearn-control/.botlearn-course", controlUid, controlGid);
+    chownSync(CONTROL_HOME, controlUid, controlGid);
+    chmodSync(CONTROL_HOME, 0o700);
+    mkdirSync(RUNTIME_PROFILE_ROOT, { recursive: true, mode: 0o750 });
+    chownSync(RUNTIME_PROFILE_ROOT, controlUid, controlGid);
+    chmodSync(RUNTIME_PROFILE_ROOT, 0o750);
+    mkdirSync(WORKSPACE, { recursive: true, mode: 0o770 });
+    chownSync(WORKSPACE, runtimeUid, controlGid);
+    chmodSync(WORKSPACE, 0o770);
+    const sessionWorkspace = path.join(WORKSPACE, runtimeSessionId, `generation-${sessionGeneration}`);
+    mkdirSync(sessionWorkspace, { recursive: true, mode: 0o770 });
+    chownSync(path.join(WORKSPACE, runtimeSessionId), runtimeUid, controlGid);
+    chownSync(sessionWorkspace, runtimeUid, controlGid);
+    chmodSync(path.join(WORKSPACE, runtimeSessionId), 0o770);
+    chmodSync(sessionWorkspace, 0o770);
+}
+export async function runSandboxSupervisor(argv) {
+    if (argv.length !== 2 || argv[0] !== "agent-service" || argv[1] !== "session") {
+        throw new Error("sandbox supervisor only permits: agent-service session");
+    }
+    if (typeof process.getuid !== "function" || process.getuid() !== 0) {
+        throw new Error("sandbox supervisor must start as root");
+    }
+    const controlUid = numericId("-u", CONTROL_USER);
+    const controlGid = numericId("-g", CONTROL_USER);
+    const runtimeUid = numericId("-u", RUNTIME_USER);
+    const bootstrap = await readOneShotBootstrap();
+    let child;
+    let releaseLock = null;
+    try {
+        const decoded = JSON.parse(bootstrap.toString("utf8"));
+        const runtimeSessionId = decoded.runtimeSessionId;
+        const sessionGeneration = Number(decoded.sessionGeneration ?? 0);
+        if (typeof runtimeSessionId !== "string" ||
+            !/^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/.test(runtimeSessionId) ||
+            !Number.isInteger(sessionGeneration) ||
+            sessionGeneration < 1) {
+            throw new Error("sandbox supervisor bootstrap session scope is invalid");
+        }
+        releaseLock = acquireSessionSupervisorLock(runtimeSessionId);
+        if (releaseLock === null)
+            return 0;
+        prepareDirectories(controlUid, controlGid, runtimeUid, runtimeSessionId, sessionGeneration);
+        child = spawn(DAEMON_BINARY, ["agent-service", "session", "--bootstrap-stdin"], {
+            uid: controlUid,
+            gid: controlGid,
+            env: {
+                HOME: "/home/botlearn-control",
+                PATH: "/usr/local/bin:/usr/bin:/bin",
+                BOTLEARN_DAEMON_HOME: CONTROL_HOME,
+                BOTLEARN_RUNTIME_UID: String(runtimeUid),
+                BOTLEARN_RUNTIME_GID: String(controlGid),
+                BOTLEARN_AGENT_SERVICE_WORKSPACE_ROOT: WORKSPACE,
+                BOTLEARN_AGENT_SERVICE_PROFILE_ROOT: RUNTIME_PROFILE_ROOT,
+            },
+            stdio: ["pipe", "inherit", "inherit"],
+        });
+        if (child.stdin === null) {
+            child.kill("SIGKILL");
+            throw new Error("sandbox supervisor could not open daemon bootstrap pipe");
+        }
+        child.stdin.end(bootstrap);
+    }
+    catch (error) {
+        releaseLock?.();
+        throw error;
+    }
+    finally {
+        bootstrap.fill(0);
+    }
+    const forward = (signal) => {
+        if (!child.killed)
+            child.kill(signal);
+    };
+    process.once("SIGTERM", () => forward("SIGTERM"));
+    process.once("SIGINT", () => forward("SIGINT"));
+    try {
+        return await new Promise((resolve, reject) => {
+            child.once("error", reject);
+            child.once("exit", (code, signal) => {
+                if (signal)
+                    resolve(128);
+                else
+                    resolve(code ?? 1);
+            });
+        });
+    }
+    finally {
+        releaseLock?.();
+    }
+}
+if (process.argv[1]?.endsWith("sandbox-supervisor.js")) {
+    runSandboxSupervisor(process.argv.slice(2))
+        .then((code) => {
+        process.exitCode = code;
+    })
+        .catch((error) => {
+        process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+        process.exitCode = 1;
+    });
+}

package/dist/types.d.ts

@@ -147,12 +147,20 @@ export interface CourseRuntimeSink {
     file(file: RunFileCandidate): Promise<void>;
     /** 可选的 run-scoped 内部遥测；不得包含 summary 或 provider raw envelope。 */
     progressDispositions?(dispositions: RuntimeProgressDispositions): Promise<void>;
+    /** Persist the runtime-native thread/session id before a terminal turn event is emitted. */
+    runtimeSession?(sessionId: string): Promise<void>;
 }
 /** 一次 run 的本地执行上下文：服务器 payload + daemon 本地准备产物。 */
 export interface RunExecution {
     payload: RunStartPayload;
-    /** 本 run 的隔离工作区目录（runtime 的 cwd）。 */
+    /** Runtime cwd. Managed persistent sessions reuse one session-scoped workspace. */
     workspaceDir: string;
+    /** Runtime-native thread/session id to resume; null creates the first native session. */
+    nativeSessionId?: string | null;
+    /** Monotonic Course Service context revision accepted for this turn. */
+    contextRevision?: number;
+    /** Scoped runtime-only environment (for example a short-lived model proxy grant). */
+    runtimeEnv?: NodeJS.ProcessEnv;
 }
 export interface CourseRuntime {
     id: string;

package/dist/websocket-client.d.ts

@@ -0,0 +1,43 @@
+import { EventEmitter } from "node:events";
+export type WebSocketRawData = Buffer;
+export interface WebSocketClientOptions {
+    headers?: Record<string, string>;
+    maxPayload?: number;
+}
+/**
+ * Narrow RFC 6455 client for the daemon control plane.
+ *
+ * It intentionally supports only text/control frames, no extensions, and one configured
+ * subprotocol. Keeping this transport on Node built-ins preserves the daemon's zero
+ * production-dependency release invariant.
+ */
+export declare class WebSocketClient extends EventEmitter {
+    private readonly options;
+    static readonly CONNECTING = 0;
+    static readonly OPEN = 1;
+    static readonly CLOSING = 2;
+    static readonly CLOSED = 3;
+    readonly url: URL;
+    readonly requestedProtocol: string;
+    readonly maxPayload: number;
+    protocol: string;
+    readyState: number;
+    private socket;
+    private handshakeBuffer;
+    private frameBuffer;
+    private fragmentedOpcode;
+    private fragmentedChunks;
+    private fragmentedBytes;
+    private closeEmitted;
+    private closeSent;
+    constructor(rawUrl: string, protocol: string, options?: WebSocketClientOptions);
+    send(data: string, callback?: (error?: Error) => void): void;
+    close(code?: number, reason?: string): void;
+    private connect;
+    private sendHandshake;
+    private onData;
+    private consumeFrames;
+    private emitFragmentedMessage;
+    private failProtocol;
+    private emitClose;
+}