@botlearn-course/daemon 0.0.2 → 0.0.4

package/dist/agent-service-ws-protocol.d.ts

@@ -0,0 +1,28 @@
+export declare const AGENT_SERVICE_WS_SCHEMA: "botlearn-agent-sandbox-ws/0.1";
+export declare const AGENT_SERVICE_WS_SUBPROTOCOL: "botlearn-agent-sandbox.v1";
+export type SandboxFrameType = "session.hello" | "session.sync" | "turn.start" | "turn.cancel" | "session.drain" | "session.shutdown" | "event.ack" | "turn.file.upload_grant" | "auth.rotate" | "ping" | "session.ready" | "session.heartbeat" | "command.ack" | "turn.event" | "turn.file.prepare" | "turn.file.committed" | "session.drained" | "pong" | "protocol.error";
+export interface SandboxFrame {
+    schema_version: typeof AGENT_SERVICE_WS_SCHEMA;
+    type: SandboxFrameType;
+    frame_id: string;
+    session_id: string;
+    session_generation: number;
+    connection_epoch: number;
+    seq: number;
+    sent_at: string;
+    agent_run_id: string | null;
+    worker_attempt: number | null;
+    payload: Record<string, unknown>;
+}
+export declare function parseSandboxFrame(raw: string, maxBytes?: number): SandboxFrame;
+export declare function createSandboxFrame(input: {
+    type: SandboxFrameType;
+    sessionId: string;
+    sessionGeneration: number;
+    connectionEpoch: number;
+    seq: number;
+    payload?: Record<string, unknown>;
+    agentRunId?: string;
+    workerAttempt?: number;
+    frameId?: string;
+}): SandboxFrame;

package/dist/agent-service-ws-protocol.js

@@ -0,0 +1,128 @@
+import { randomUUID } from "node:crypto";
+export const AGENT_SERVICE_WS_SCHEMA = "botlearn-agent-sandbox-ws/0.1";
+export const AGENT_SERVICE_WS_SUBPROTOCOL = "botlearn-agent-sandbox.v1";
+const FRAME_TYPES = new Set([
+    "session.hello",
+    "session.sync",
+    "turn.start",
+    "turn.cancel",
+    "session.drain",
+    "session.shutdown",
+    "event.ack",
+    "turn.file.upload_grant",
+    "auth.rotate",
+    "ping",
+    "session.ready",
+    "session.heartbeat",
+    "command.ack",
+    "turn.event",
+    "turn.file.prepare",
+    "turn.file.committed",
+    "session.drained",
+    "pong",
+    "protocol.error",
+]);
+const TURN_TYPES = new Set([
+    "turn.start",
+    "turn.cancel",
+    "event.ack",
+    "turn.file.upload_grant",
+    "turn.event",
+    "turn.file.prepare",
+    "turn.file.committed",
+]);
+const FRAME_KEYS = new Set([
+    "schema_version",
+    "type",
+    "frame_id",
+    "session_id",
+    "session_generation",
+    "connection_epoch",
+    "seq",
+    "sent_at",
+    "agent_run_id",
+    "worker_attempt",
+    "payload",
+]);
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+function positiveInteger(value, label) {
+    if (!Number.isInteger(value) || value < 1) {
+        throw new Error(`${label} must be a positive integer`);
+    }
+    return value;
+}
+export function parseSandboxFrame(raw, maxBytes = 262_144) {
+    if (Buffer.byteLength(raw, "utf8") > maxBytes)
+        throw new Error("frame exceeds size limit");
+    const decoded = JSON.parse(raw);
+    if (!decoded || typeof decoded !== "object" || Array.isArray(decoded)) {
+        throw new Error("frame must be an object");
+    }
+    const value = decoded;
+    for (const key of Object.keys(value)) {
+        if (!FRAME_KEYS.has(key))
+            throw new Error(`unknown sandbox WebSocket frame field: ${key}`);
+    }
+    if (value.schema_version !== AGENT_SERVICE_WS_SCHEMA) {
+        throw new Error("unsupported sandbox WebSocket schema");
+    }
+    if (typeof value.type !== "string" || !FRAME_TYPES.has(value.type)) {
+        throw new Error("unknown sandbox WebSocket frame type");
+    }
+    const type = value.type;
+    const agentRunId = typeof value.agent_run_id === "string" ? value.agent_run_id : null;
+    const workerAttempt = value.worker_attempt == null
+        ? null
+        : positiveInteger(value.worker_attempt, "worker_attempt");
+    if (TURN_TYPES.has(type) && (!agentRunId || workerAttempt === null)) {
+        throw new Error(`${type} requires turn fencing fields`);
+    }
+    if (!TURN_TYPES.has(type) && (agentRunId !== null || workerAttempt !== null)) {
+        throw new Error(`${type} cannot carry turn fencing fields`);
+    }
+    if (!value.payload || typeof value.payload !== "object" || Array.isArray(value.payload)) {
+        throw new Error("frame payload must be an object");
+    }
+    for (const key of ["frame_id", "session_id", "sent_at"]) {
+        if (typeof value[key] !== "string" || !value[key])
+            throw new Error(`${key} is required`);
+    }
+    if (value.frame_id.length > 120)
+        throw new Error("frame_id is too long");
+    if (!UUID_PATTERN.test(value.session_id))
+        throw new Error("session_id must be a UUID");
+    if (agentRunId !== null && !UUID_PATTERN.test(agentRunId)) {
+        throw new Error("agent_run_id must be a UUID");
+    }
+    if (Number.isNaN(Date.parse(value.sent_at)))
+        throw new Error("sent_at is invalid");
+    return {
+        schema_version: AGENT_SERVICE_WS_SCHEMA,
+        type,
+        frame_id: value.frame_id,
+        session_id: value.session_id,
+        session_generation: positiveInteger(value.session_generation, "session_generation"),
+        connection_epoch: positiveInteger(value.connection_epoch, "connection_epoch"),
+        seq: positiveInteger(value.seq, "seq"),
+        sent_at: value.sent_at,
+        agent_run_id: agentRunId,
+        worker_attempt: workerAttempt,
+        payload: value.payload,
+    };
+}
+export function createSandboxFrame(input) {
+    const frame = {
+        schema_version: AGENT_SERVICE_WS_SCHEMA,
+        type: input.type,
+        frame_id: input.frameId ?? `frm_${randomUUID().replaceAll("-", "")}`,
+        session_id: input.sessionId,
+        session_generation: input.sessionGeneration,
+        connection_epoch: input.connectionEpoch,
+        seq: input.seq,
+        sent_at: new Date().toISOString(),
+        agent_run_id: input.agentRunId ?? null,
+        worker_attempt: input.workerAttempt ?? null,
+        payload: input.payload ?? {},
+    };
+    return parseSandboxFrame(JSON.stringify(frame));
+}

package/dist/cli.js

@@ -5,6 +5,7 @@ import { hostname } from "node:os";
 import { fileURLToPath } from "node:url";
 import { authFilePath, clearAuth, machineFingerprint, readAuth, writeAuth } from "./auth-store.js";
 import { AgentServiceRunClient } from "./agent-service-client.js";
+import { AgentServiceSessionClient } from "./agent-service-session.js";
 import { CourseClient, isAuthFailure, loginCourseDaemon } from "./course-client.js";
 import { runCourseDoctor } from "./doctor.js";
 import { log } from "./log.js";
@@ -14,6 +15,17 @@ import { RunDispatcher } from "./run-dispatcher.js";
 import { clearAgentServiceControlEnv } from "./runtime-env.js";
 import { RUNTIME_MODULES, detectAvailableRuntimeIds, fakeRuntimeEnabled, } from "./runtimes/index.js";
 const pkg = createRequire(import.meta.url)("../package.json");
+const SESSION_BOOTSTRAP_MAX_BYTES = 64 * 1024;
+const SESSION_RUNTIME_ENV_KEYS = new Set([
+    "OPENAI_API_KEY",
+    "OPENAI_BASE_URL",
+    "ANTHROPIC_API_KEY",
+    "ANTHROPIC_BASE_URL",
+    "DEEPSEEK_API_KEY",
+    "DEEPSEEK_BASE_URL",
+    "GEMINI_API_KEY",
+    "GEMINI_BASE_URL",
+]);
 const HELP = `botlearn-course-daemon ${pkg.version} — run BotLearn Course tasks on your own machine (BYOA)
 
 Usage:
@@ -22,6 +34,7 @@ Usage:
   botlearn-course-daemon course logout
   botlearn-course-daemon course doctor
   botlearn-course-daemon agent-service run
+  botlearn-course-daemon agent-service session
   botlearn-course-daemon --help | --version
 
 Commands:
@@ -42,11 +55,14 @@ Agent Service sandbox environment:
   BOTLEARN_COURSE_API_URL
   BOTLEARN_AGENT_SERVICE_RUN_ID
   BOTLEARN_AGENT_SERVICE_RUN_TOKEN
-  BOTLEARN_AGENT_SERVICE_WORKER_ID`;
+  BOTLEARN_AGENT_SERVICE_WORKER_ID
+  BOTLEARN_AGENT_SERVICE_WS_URL
+  BOTLEARN_AGENT_SERVICE_RUNTIME_SESSION_ID
+  BOTLEARN_AGENT_SERVICE_SESSION_TOKEN`;
 // ---------------------------------------------------------------
 // flag parser（极简：--k v / --k=v / 布尔开关）
 // ---------------------------------------------------------------
-const BOOLEAN_FLAGS = new Set(["once", "help", "version"]);
+const BOOLEAN_FLAGS = new Set(["once", "help", "version", "bootstrap-stdin"]);
 export { clearAgentServiceControlEnv } from "./runtime-env.js";
 export function parseCliArgs(argv) {
     const positional = [];
@@ -288,6 +304,97 @@ async function cmdAgentServiceRun() {
     }
     return 0;
 }
+async function readSessionBootstrapFromStdin() {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of process.stdin) {
+        const bytes = Buffer.from(chunk);
+        size += bytes.length;
+        if (size > SESSION_BOOTSTRAP_MAX_BYTES) {
+            throw new Error("Agent Service session bootstrap exceeds size limit");
+        }
+        chunks.push(bytes);
+    }
+    const raw = Buffer.concat(chunks);
+    try {
+        const parsed = JSON.parse(raw.toString("utf8"));
+        if (parsed.schemaVersion !== "agent-service-session-bootstrap/0.1") {
+            throw new Error("Agent Service session bootstrap schema is unsupported");
+        }
+        const runtimeEnv = {};
+        if (parsed.runtimeEnv !== undefined) {
+            if (!parsed.runtimeEnv ||
+                typeof parsed.runtimeEnv !== "object" ||
+                Array.isArray(parsed.runtimeEnv)) {
+                throw new Error("Agent Service session bootstrap runtimeEnv is invalid");
+            }
+            for (const [key, value] of Object.entries(parsed.runtimeEnv)) {
+                if (!SESSION_RUNTIME_ENV_KEYS.has(key) ||
+                    typeof value !== "string" ||
+                    value.length < 1 ||
+                    value.length > 8192) {
+                    throw new Error(`Agent Service session bootstrap runtime env is forbidden: ${key}`);
+                }
+                runtimeEnv[key] = value;
+            }
+        }
+        const wsUrl = parsed.wsUrl;
+        const runtimeSessionId = parsed.runtimeSessionId;
+        const sessionToken = parsed.sessionToken;
+        if (typeof wsUrl !== "string" ||
+            !/^wss?:\/\//.test(wsUrl) ||
+            typeof runtimeSessionId !== "string" ||
+            !runtimeSessionId ||
+            typeof sessionToken !== "string" ||
+            !sessionToken) {
+            throw new Error("Agent Service session bootstrap is incomplete");
+        }
+        return {
+            wsUrl,
+            runtimeSessionId,
+            sessionToken,
+            ...(Object.keys(runtimeEnv).length > 0 ? { runtimeEnv } : {}),
+        };
+    }
+    finally {
+        raw.fill(0);
+        for (const chunk of chunks)
+            chunk.fill(0);
+    }
+}
+async function cmdAgentServiceSession(args) {
+    const bootstrap = args.flags["bootstrap-stdin"] === true
+        ? await readSessionBootstrapFromStdin()
+        : {
+            wsUrl: process.env.BOTLEARN_AGENT_SERVICE_WS_URL,
+            runtimeSessionId: process.env.BOTLEARN_AGENT_SERVICE_RUNTIME_SESSION_ID,
+            sessionToken: process.env.BOTLEARN_AGENT_SERVICE_SESSION_TOKEN,
+            runtimeEnv: undefined,
+        };
+    const { wsUrl, runtimeSessionId, sessionToken } = bootstrap;
+    if (!wsUrl || !runtimeSessionId || !sessionToken) {
+        console.error("Agent Service sandbox session environment is incomplete");
+        return 1;
+    }
+    augmentProcessPath();
+    const runtimes = new Map();
+    for (const mod of RUNTIME_MODULES) {
+        if (mod.hidden && !fakeRuntimeEnabled())
+            continue;
+        runtimes.set(mod.id, mod.create());
+    }
+    const client = new AgentServiceSessionClient({
+        wsUrl,
+        sessionId: runtimeSessionId,
+        sessionToken,
+        ...(bootstrap.runtimeEnv ? { runtimeEnv: bootstrap.runtimeEnv } : {}),
+        runtimes,
+        daemonVersion: pkg.version,
+    });
+    clearAgentServiceControlEnv();
+    await client.run();
+    return 0;
+}
 // ---------------------------------------------------------------
 // 入口
 // ---------------------------------------------------------------
@@ -320,6 +427,9 @@ export async function runCli(argv) {
     if (command === "agent-service" && sub === "run") {
         return cmdAgentServiceRun();
     }
+    if (command === "agent-service" && sub === "session") {
+        return cmdAgentServiceSession(args);
+    }
     console.error(HELP);
     return 1;
 }

package/dist/index.d.ts

@@ -6,6 +6,8 @@ export * from "./types.js";
 export * from "./auth-store.js";
 export * from "./course-client.js";
 export * from "./agent-service-client.js";
+export * from "./agent-service-session.js";
+export * from "./agent-service-ws-protocol.js";
 export * from "./run-dispatcher.js";
 export * from "./run-queue.js";
 export * from "./workspace.js";

package/dist/index.js

@@ -6,6 +6,8 @@ export * from "./types.js";
 export * from "./auth-store.js";
 export * from "./course-client.js";
 export * from "./agent-service-client.js";
+export * from "./agent-service-session.js";
+export * from "./agent-service-ws-protocol.js";
 export * from "./run-dispatcher.js";
 export * from "./run-queue.js";
 export * from "./workspace.js";

package/dist/run-dispatcher.d.ts

@@ -6,6 +6,18 @@ export interface RunDispatcherOptions {
     log?: Logger;
     scanLimits?: ScanLimits;
     now?: () => number;
+    persistentSession?: PersistentSessionExecution;
+}
+export interface PreparedPersistentTurn {
+    workspaceDir: string;
+    transcriptFile: string;
+    nativeSessionId: string | null;
+    contextRevision: number;
+    runtimeEnv?: NodeJS.ProcessEnv;
+}
+export interface PersistentSessionExecution {
+    prepareTurn(payload: RunStartPayload): PreparedPersistentTurn;
+    persistNativeSession(sessionId: string): void;
 }
 export interface RunReportingClient {
     postEvent(agentRunId: string, event: RunEvent): Promise<void>;
@@ -27,10 +39,13 @@ export declare class RunDispatcher {
     private readonly runtimes;
     private readonly queue;
     private readonly inflight;
+    private readonly scheduledRunIds;
+    private readonly pendingCancellations;
     private readonly defaultRuntimeId;
     private readonly log;
     private readonly scanLimits?;
     private readonly now;
+    private readonly persistentSession?;
     constructor(client: RunReportingClient, runtimes: Map<string, CourseRuntime>, opts?: RunDispatcherOptions);
     /** 排队执行一个 run。返回的 Promise 不 reject（失败已归一化回报为 run.failed）。 */
     dispatch(payload: RunStartPayload): Promise<void>;

package/dist/run-dispatcher.js

@@ -36,10 +36,13 @@ export class RunDispatcher {
     runtimes;
     queue = new RunQueue();
     inflight = new Map();
+    scheduledRunIds = new Set();
+    pendingCancellations = new Set();
     defaultRuntimeId;
     log;
     scanLimits;
     now;
+    persistentSession;
     constructor(client, runtimes, opts = {}) {
         this.client = client;
         this.runtimes = runtimes;
@@ -47,22 +50,37 @@ export class RunDispatcher {
         this.log = opts.log ?? defaultLog;
         this.scanLimits = opts.scanLimits;
         this.now = opts.now ?? Date.now;
+        this.persistentSession = opts.persistentSession;
     }
     /** 排队执行一个 run。返回的 Promise 不 reject（失败已归一化回报为 run.failed）。 */
     dispatch(payload) {
         const key = payload.agent_instance_id ?? payload.agent_run_id;
-        return this.queue.enqueue(key, () => this.execute(payload));
+        this.scheduledRunIds.add(payload.agent_run_id);
+        return this.queue
+            .enqueue(key, () => this.execute(payload))
+            .finally(() => {
+            this.scheduledRunIds.delete(payload.agent_run_id);
+            this.pendingCancellations.delete(payload.agent_run_id);
+        });
     }
     cancel(agentRunId) {
         const controller = this.inflight.get(agentRunId);
-        if (!controller)
+        if (controller) {
+            controller.abort();
+            return true;
+        }
+        if (!this.scheduledRunIds.has(agentRunId))
             return false;
-        controller.abort();
+        // dispatch() queues execution on a microtask. A durable cancel may arrive after the
+        // command ACK but before execute() installs its AbortController.
+        this.pendingCancellations.add(agentRunId);
         return true;
     }
     cancelAll() {
         for (const controller of this.inflight.values())
             controller.abort();
+        for (const runId of this.scheduledRunIds)
+            this.pendingCancellations.add(runId);
     }
     get activeCount() {
         return this.inflight.size;
@@ -81,6 +99,8 @@ export class RunDispatcher {
         const runId = payload.agent_run_id;
         const controller = new AbortController();
         this.inflight.set(runId, controller);
+        if (this.pendingCancellations.delete(runId))
+            controller.abort();
         let seq = 0;
         // 服务端已把本 run 判为终态（409）：停止一切后续上报。
         let serverTerminal = false;
@@ -173,12 +193,13 @@ export class RunDispatcher {
                     ...runtimeProfileInstructions(payload, applied),
                 ];
             }
-            const { workspaceDir } = ensureRunWorkspace(runId);
+            const persistentTurn = this.persistentSession?.prepareTurn(payload);
+            const { workspaceDir } = persistentTurn ?? ensureRunWorkspace(runId);
             const missingCapabilities = missingRunCapabilities(payload, workspaceDir);
             if (missingCapabilities.length > 0) {
                 throw new RuntimeExecutionError(`runtime is missing required capabilities: ${missingCapabilities.join(", ")}`, "runtime_unavailable");
             }
-            const transcript = new TranscriptWriter(transcriptPath(runId));
+            const transcript = new TranscriptWriter(persistentTurn?.transcriptFile ?? transcriptPath(runId));
             const timeoutSeconds = clampTimeoutSeconds(payload.limits.timeout_seconds);
             timer = setTimeout(() => {
                 timedOut = true;
@@ -289,8 +310,23 @@ export class RunDispatcher {
                 file: async (file) => {
                     await this.client.postFile(runId, file);
                 },
+                runtimeSession: async (sessionId) => {
+                    this.persistentSession?.persistNativeSession(sessionId);
+                },
             };
-            await runtime.run({ payload, workspaceDir }, sink, controller.signal);
+            await runtime.run({
+                payload,
+                workspaceDir,
+                ...(persistentTurn
+                    ? {
+                        nativeSessionId: persistentTurn.nativeSessionId,
+                        contextRevision: persistentTurn.contextRevision,
+                        ...(persistentTurn.runtimeEnv
+                            ? { runtimeEnv: persistentTurn.runtimeEnv }
+                            : {}),
+                    }
+                    : {}),
+            }, sink, controller.signal);
             clearTimeout(timer);
             if (serverTerminal)
                 return;

package/dist/runtime-env.d.ts

@@ -2,3 +2,8 @@
 export declare function clearAgentServiceControlEnv(env?: NodeJS.ProcessEnv): void;
 /** Copy an environment for a runtime child without leaking Agent Service control values. */
 export declare function runtimeChildEnv(env?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+/** Run model processes as the Template's untrusted runtime UID when configured. */
+export declare function runtimeChildIdentity(env?: NodeJS.ProcessEnv): {
+    uid?: number;
+    gid?: number;
+};

package/dist/runtime-env.js

@@ -3,6 +3,15 @@ const AGENT_SERVICE_CONTROL_ENV_KEYS = [
     "BOTLEARN_AGENT_SERVICE_RUN_ID",
     "BOTLEARN_AGENT_SERVICE_RUN_TOKEN",
     "BOTLEARN_AGENT_SERVICE_WORKER_ID",
+    "BOTLEARN_AGENT_SERVICE_WS_URL",
+    "BOTLEARN_AGENT_SERVICE_RUNTIME_SESSION_ID",
+    "BOTLEARN_AGENT_SERVICE_SESSION_TOKEN",
+];
+const AGENT_SERVICE_SUPERVISOR_ENV_KEYS = [
+    "BOTLEARN_RUNTIME_UID",
+    "BOTLEARN_RUNTIME_GID",
+    "BOTLEARN_AGENT_SERVICE_WORKSPACE_ROOT",
+    "BOTLEARN_AGENT_SERVICE_PROFILE_ROOT",
 ];
 /** Remove Course control-plane coordinates before any model/runtime child is created. */
 export function clearAgentServiceControlEnv(env = process.env) {
@@ -13,5 +22,19 @@ export function clearAgentServiceControlEnv(env = process.env) {
 export function runtimeChildEnv(env = process.env) {
     const childEnv = { ...env };
     clearAgentServiceControlEnv(childEnv);
+    for (const key of AGENT_SERVICE_SUPERVISOR_ENV_KEYS)
+        delete childEnv[key];
     return childEnv;
 }
+/** Run model processes as the Template's untrusted runtime UID when configured. */
+export function runtimeChildIdentity(env = process.env) {
+    const uid = Number(env.BOTLEARN_RUNTIME_UID);
+    const gid = Number(env.BOTLEARN_RUNTIME_GID);
+    if (!Number.isInteger(uid) ||
+        uid < 1 ||
+        !Number.isInteger(gid) ||
+        gid < 1) {
+        return {};
+    }
+    return { uid, gid };
+}

package/dist/runtime-profile.js

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
-import { mkdirSync, mkdtempSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { chmodSync, mkdirSync, mkdtempSync, renameSync, rmSync, writeFileSync, } from "node:fs";
 import path from "node:path";
-import { runtimeProfileDir, runRootDir } from "./workspace.js";
+import { runtimeProfileDir, runtimeProfileRunRootDir } from "./workspace.js";
 const SAFE_ASSET_ID = /^[a-z0-9][a-z0-9._-]{0,159}$/;
 const SHA256 = /^sha256:[0-9a-f]{64}$/;
 const MAX_SKILL_PACKAGES = 32;
@@ -20,13 +20,19 @@ export function applyRunRuntimeProfile(payload, raw) {
     if (payload.context.profileHash !== profile.profileHash) {
         throw new RuntimeProfileApplyError("run.start profileHash does not match runtime profile");
     }
-    const runDir = runRootDir(payload.agent_run_id);
+    const runDir = runtimeProfileRunRootDir(payload.agent_run_id);
     const target = runtimeProfileDir(payload.agent_run_id);
-    mkdirSync(runDir, { recursive: true, mode: 0o700 });
+    const managedReadView = Boolean(process.env.BOTLEARN_AGENT_SERVICE_PROFILE_ROOT?.trim());
+    const directoryMode = managedReadView ? 0o750 : 0o700;
+    const fileMode = managedReadView ? 0o640 : 0o600;
+    mkdirSync(runDir, { recursive: true, mode: directoryMode });
+    chmodSync(runDir, directoryMode);
     const staging = mkdtempSync(path.join(runDir, ".runtime-profile-"));
+    chmodSync(staging, directoryMode);
     try {
         const skillsRoot = path.join(staging, "skills");
-        mkdirSync(skillsRoot, { recursive: true, mode: 0o700 });
+        mkdirSync(skillsRoot, { recursive: true, mode: directoryMode });
+        chmodSync(skillsRoot, directoryMode);
         const skillRefs = [];
         const skillIds = new Set();
         for (const skill of profile.skillPackages) {
@@ -34,12 +40,14 @@ export function applyRunRuntimeProfile(payload, raw) {
                 throw new RuntimeProfileApplyError(`duplicate runtime Skill id: ${skill.id}`);
             }
             skillIds.add(skill.id);
-            installSkillPackage(skillsRoot, skill);
+            installSkillPackage(skillsRoot, skill, { directoryMode, fileMode });
             skillRefs.push(`${skill.id}@${skill.version}`);
         }
         const promptPackPath = path.join(staging, "prompt-pack.md");
-        writeFileSync(promptPackPath, profile.promptPack.systemInstructions, { mode: 0o600 });
-        writeFileSync(path.join(staging, "profile.json"), `${JSON.stringify({
+        writeFileSync(promptPackPath, profile.promptPack.systemInstructions, { mode: fileMode });
+        chmodSync(promptPackPath, fileMode);
+        const manifestPath = path.join(staging, "profile.json");
+        writeFileSync(manifestPath, `${JSON.stringify({
             schemaVersion: profile.schemaVersion,
             profileId: profile.profileId,
             profileHash: profile.profileHash,
@@ -51,7 +59,8 @@ export function applyRunRuntimeProfile(payload, raw) {
             },
             skillRefs,
             requiredCapabilities: profile.requiredCapabilities,
-        }, null, 2)}\n`, { mode: 0o600 });
+        }, null, 2)}\n`, { mode: fileMode });
+        chmodSync(manifestPath, fileMode);
         rmSync(target, { recursive: true, force: true });
         renameSync(staging, target);
         return {
@@ -94,7 +103,7 @@ export function runtimeProfileInstructions(payload, applied) {
             : []),
     ];
 }
-function installSkillPackage(skillsRoot, skill) {
+function installSkillPackage(skillsRoot, skill, modes) {
     assertSafeAssetId(skill.id, "Skill id");
     if (!SHA256.test(skill.digest)) {
         throw new RuntimeProfileApplyError(`Skill ${skill.id} has an invalid digest`);
@@ -104,11 +113,14 @@ function installSkillPackage(skillsRoot, skill) {
         throw new RuntimeProfileApplyError(`Skill ${skill.id}@${skill.version} digest mismatch`);
     }
     const skillDir = path.join(skillsRoot, skill.id);
-    mkdirSync(skillDir, { recursive: true, mode: 0o700 });
+    mkdirSync(skillDir, { recursive: true, mode: modes.directoryMode });
+    chmodSync(skillDir, modes.directoryMode);
     for (const entry of entries) {
         const destination = path.join(skillDir, entry.path);
-        mkdirSync(path.dirname(destination), { recursive: true, mode: 0o700 });
-        writeFileSync(destination, entry.content, { mode: 0o600 });
+        mkdirSync(path.dirname(destination), { recursive: true, mode: modes.directoryMode });
+        chmodSync(path.dirname(destination), modes.directoryMode);
+        writeFileSync(destination, entry.content, { mode: modes.fileMode });
+        chmodSync(destination, modes.fileMode);
     }
 }
 function archiveEntries(skill) {

package/dist/runtimes/acp-stream.js

@@ -1,4 +1,5 @@
 import { spawn } from "node:child_process";
+import { runtimeChildIdentity } from "../runtime-env.js";
 import { sanitizeRuntimeFailureText } from "../redaction.js";
 import { sliceUtf8Bytes, utf8ByteLength } from "./text-cap.js";
 import { consoleLogger, } from "./engine.js";
@@ -206,6 +207,7 @@ export class AcpRuntimeAdapter {
         const child = spawn(binary, args, {
             cwd: opts.cwd,
             env: this.spawnEnv(opts),
+            ...runtimeChildIdentity(),
             stdio: ["pipe", "pipe", "pipe"],
         });
         let killTimer = null;

package/dist/runtimes/codex.d.ts

@@ -38,7 +38,7 @@ export declare class CodexAdapter extends NdjsonStreamAdapter {
      * `--` 隔开 flags 与 positionals，防止以 `-` 开头的 prompt 被解析成选项。
      */
     protected buildArgs(opts: EngineRunOptions): string[];
-    protected spawnEnv(_opts: EngineRunOptions): NodeJS.ProcessEnv;
+    protected spawnEnv(opts: EngineRunOptions): NodeJS.ProcessEnv;
     protected handleEvent(raw: unknown, ctx: NdjsonEventCtx): void;
 }
 export declare const codexModule: RuntimeModule;

package/dist/runtimes/codex.js

@@ -181,9 +181,9 @@ export class CodexAdapter extends NdjsonStreamAdapter {
         }
         return ["exec", ...tail, "--", prompt];
     }
-    spawnEnv(_opts) {
+    spawnEnv(opts) {
         return {
-            ...process.env,
+            ...super.spawnEnv(opts),
             // 保证 JSONL 输出不混入 ANSI 转义。
             FORCE_COLOR: "0",
             NO_COLOR: "1",