@botlearn-course/daemon 0.0.20-beta.11 → 0.0.20-beta.13

package/README.md

@@ -36,13 +36,13 @@ npx --yes --package @botlearn-course/daemon@latest botlearn-course-daemon course
 | `course doctor` | 打印 Auth 状态（不含 token）与 runtime 探测表（安装路径 / 版本 / 登录状态 / 安装提示）。 |
 | `--help` / `--version` | 帮助与版本。 |
 
-包内还包含供 BotLearn 托管 E2B Template 使用的内部命令
+包内还包含供 BotLearn 托管 sandbox 使用的内部命令
 `botlearn-sandbox-supervisor agent-service session`。它不是 BYOA 用户入口：生产环境只允许由
-Agent Service 以固定 argv 启动，通过 stdin 接收一次性 bootstrap。E2B 中 daemon/runtime 分别
+Agent Service 以固定 argv 启动，通过 stdin 接收一次性 bootstrap。sandbox 中 daemon/runtime 分别
 降权到 `botlearn-control`/`user` UID；继承 `NoNewPrivs=1`、无法使用 sudo 的平台保留 root control
 daemon，由 root-owned 固定 launcher 清空附加组后直接降权为 `user`。两条路径都为 DeepSeek
 设置 `no_new_privs`，runtime 用户本身没有 sudo 权限。托管启动链只执行
-`/opt` 下的固定 Node、supervisor、daemon、launcher 与 DeepSeek 文件，不信任 E2B 会开放给 runtime
+`/opt` 下的固定 Node、supervisor、daemon、launcher 与 DeepSeek 文件，不信任 provider 会开放给 runtime
 写入的 `/usr/local/bin`。
 `agent-service session --bootstrap-stdin` 同样属于受 supervisor 保护的内部协议，不应直接暴露给
 课程任务或 workspace shell。

package/dist/agent-service-sandbox.js

@@ -4,7 +4,7 @@ import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import path from "node:path";
 import { ensureDaemonHome } from "./auth-store.js";
-import { AGENT_SERVICE_WS_SCHEMA, AGENT_SERVICE_WS_SUBPROTOCOL, createSandboxFrame, createWorkspaceFileChunk, parseSandboxFrame, UnsupportedSandboxProtocolError, WORKSPACE_FILE_READ_BINARY_CAPABILITY, } from "./agent-service-ws-protocol.js";
+import { AGENT_SERVICE_WS_SCHEMA, AGENT_SERVICE_WS_SUBPROTOCOL, createSandboxFrame, createWorkspaceFileChunk, parseSandboxFrame, UnsupportedSandboxProtocolError, WORKSPACE_FILE_READ_BINARY_CAPABILITY, WORKSPACE_SNAPSHOT_ATTESTATION_CAPABILITY, } from "./agent-service-ws-protocol.js";
 import { log as defaultLog, setOperationalLogSink, } from "./log.js";
 import { availableRunCapabilities, runtimeSupportsCourseSkills, } from "./runtime-capabilities.js";
 import { activationRuntimeEnv, runtimeChildEnv } from "./runtime-env.js";
@@ -875,6 +875,7 @@ export class AgentServiceSandboxClient {
                 "workspace_writer_freeze_v1",
                 "workspace_snapshot_v2",
                 "workspace_restore_v1",
+                WORKSPACE_SNAPSHOT_ATTESTATION_CAPABILITY,
                 ...(nasWorkspaceEnabled() ? ["workspace_nas_v1"] : []),
                 ...(workspaceCopyV1Supported() ? ["workspace_copy_v1"] : []),
             ],

package/dist/agent-service-ws-protocol.d.ts

@@ -1,6 +1,7 @@
 export declare const AGENT_SERVICE_WS_SCHEMA: "botlearn-agent-sandbox-ws/0.4";
 export declare const AGENT_SERVICE_WS_SUBPROTOCOL: "botlearn-agent-sandbox.v4";
 export declare const WORKSPACE_FILE_READ_BINARY_CAPABILITY: "workspace_file_read_binary_v1";
+export declare const WORKSPACE_SNAPSHOT_ATTESTATION_CAPABILITY: "workspace_snapshot_attestation_v1";
 export declare const WORKSPACE_FILE_CHUNK_BYTES: number;
 export declare const WORKSPACE_FILE_CHUNK_HEADER_BYTES = 29;
 export type SandboxFrameType = "sandbox.hello" | "sandbox.sync" | "session.open" | "session.activate" | "turn.start" | "turn.cancel" | "session.close" | "sandbox.drain" | "sandbox.shutdown" | "event.ack" | "auth.rotate" | "workspace.file.read" | "workspace.checkpoint" | "workspace.thaw" | "ping" | "sandbox.ready" | "sandbox.heartbeat" | "command.ack" | "session.opened" | "session.open_failed" | "session.closed" | "turn.event" | "turn.file.report" | "workspace.file.result" | "sandbox.drained" | "sandbox.log" | "pong" | "protocol.error";

package/dist/agent-service-ws-protocol.js

@@ -2,6 +2,7 @@ import { randomUUID } from "node:crypto";
 export const AGENT_SERVICE_WS_SCHEMA = "botlearn-agent-sandbox-ws/0.4";
 export const AGENT_SERVICE_WS_SUBPROTOCOL = "botlearn-agent-sandbox.v4";
 export const WORKSPACE_FILE_READ_BINARY_CAPABILITY = "workspace_file_read_binary_v1";
+export const WORKSPACE_SNAPSHOT_ATTESTATION_CAPABILITY = "workspace_snapshot_attestation_v1";
 export const WORKSPACE_FILE_CHUNK_BYTES = 64 * 1024;
 export const WORKSPACE_FILE_CHUNK_HEADER_BYTES = 29;
 const WORKSPACE_FILE_CHUNK_MAGIC = Buffer.from("BLWF", "ascii");

package/dist/redaction.js

@@ -25,6 +25,7 @@ const QUOTED_JSON_SECRET_PATTERN = new RegExp(`(["'])(${SECRET_KEY_NAME_SOURCE})
 const QUOTED_ARGV_SECRET_PATTERN = new RegExp(`(["'])(${SECRET_FLAG_SOURCE})\\1(\\s*,\\s*)(["'])([^"'\\\\]*(?:\\\\.[^"'\\\\]*)*)\\4`, "gi");
 // blic_ 是课程 install code 前缀，与 runtime token 前缀一并脱敏。
 const SECRET_PREFIX_PATTERN = /\b(blic_|drt_|dit_|gho_|ghp_|sk-)[A-Za-z0-9_-]+/g;
+const SIGNED_OBJECT_URL_PATTERN = /https?:\/\/[^\s"'<>]*[?&](?:X-Amz-Algorithm|X-Amz-Credential|X-Amz-Signature|X-Amz-Security-Token)=[^\s"'<>]*/gi;
 const SECRET_VALUE_PATTERNS = [
     [/\b(Bearer\s+)[^\s"']+/gi, `$1${REDACTED}`],
     [new RegExp(`(^|[\\s])(${SECRET_FLAG_SOURCE})=([^\\s"']+)`, "gi"), `$1$2=${REDACTED}`],
@@ -83,6 +84,7 @@ export function assertNoInjectedCredentials(data, additionalSecrets = []) {
 }
 export function redactSecretString(text, additionalSecrets = []) {
     return redactInjectedCredentials(text, additionalSecrets)
+        .replace(SIGNED_OBJECT_URL_PATTERN, REDACTED)
         .replace(/\b(Bearer\s+)[^\s"']+/gi, `$1${REDACTED}`)
         .replace(new RegExp(`(^|[\\s])(${SECRET_FLAG_SOURCE})=([^\\s"']+)`, "gi"), `$1$2=${REDACTED}`)
         .replace(new RegExp(`(^|[\\s])(${SECRET_FLAG_SOURCE})(\\s+)([^\\s"']+)`, "gi"), `$1$2$3${REDACTED}`)

package/dist/runtime-env.d.ts

@@ -16,7 +16,7 @@ export declare function runtimeChildIdentity(env?: NodeJS.ProcessEnv): {
 /**
  * Build the fixed control-to-runtime privilege boundary used by managed sandboxes.
  *
- * E2B runs the daemon as botlearn-control and grants it one fixed sudoers command.
+ * The legacy image boundary may grant botlearn-control one fixed sudoers command.
  * Platforms that inherit no_new_privs cannot use sudo, so their root supervisor daemon
  * invokes the same immutable launcher directly; the launcher clears supplementary groups
  * and performs the one-way uid/gid drop. BYOA retains direct-spawn behavior.

package/dist/runtime-env.js

@@ -96,7 +96,7 @@ export function runtimeChildIdentity(env = process.env) {
 /**
  * Build the fixed control-to-runtime privilege boundary used by managed sandboxes.
  *
- * E2B runs the daemon as botlearn-control and grants it one fixed sudoers command.
+ * The legacy image boundary may grant botlearn-control one fixed sudoers command.
  * Platforms that inherit no_new_privs cannot use sudo, so their root supervisor daemon
  * invokes the same immutable launcher directly; the launcher clears supplementary groups
  * and performs the one-way uid/gid drop. BYOA retains direct-spawn behavior.

package/dist/sandbox-supervisor.js

@@ -19,7 +19,7 @@ const MANAGED_PATH = [
     "/opt/node/22.23.1/bin",
     "/usr/bin",
     "/bin",
-    // E2B materializes this directory as runtime-writable. Keep it last and never
+    // The managed image exposes this directory as runtime-writable. Keep it last and never
     // use it for a managed control-plane executable.
     "/usr/local/bin",
 ].join(":");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botlearn-course/daemon",
-  "version": "0.0.20-beta.11",
+  "version": "0.0.20-beta.13",
   "description": "Lightweight BotLearn Course daemon: run course tasks on your own machine with your own agent runtime (BYOA).",
   "type": "module",
   "bin": {