@botlearn-course/daemon 0.0.20-beta.9 → 0.0.20

package/README.md

@@ -36,22 +36,22 @@ npx --yes --package @botlearn-course/daemon@latest botlearn-course-daemon course
 | `course doctor` | 打印 Auth 状态（不含 token）与 runtime 探测表（安装路径 / 版本 / 登录状态 / 安装提示）。 |
 | `--help` / `--version` | 帮助与版本。 |
 
-包内还包含供 BotLearn 托管 E2B Template 使用的内部命令
+包内还包含供 BotLearn 托管 sandbox 使用的内部命令
 `botlearn-sandbox-supervisor agent-service session`。它不是 BYOA 用户入口：生产环境只允许由
-Agent Service 以固定 argv 启动，通过 stdin 接收一次性 bootstrap。E2B 中 daemon/runtime 分别
+Agent Service 以固定 argv 启动，通过 stdin 接收一次性 bootstrap。sandbox 中 daemon/runtime 分别
 降权到 `botlearn-control`/`user` UID；继承 `NoNewPrivs=1`、无法使用 sudo 的平台保留 root control
 daemon，由 root-owned 固定 launcher 清空附加组后直接降权为 `user`。两条路径都为 DeepSeek
 设置 `no_new_privs`，runtime 用户本身没有 sudo 权限。托管启动链只执行
-`/opt` 下的固定 Node、supervisor、daemon、launcher 与 DeepSeek 文件，不信任 E2B 会开放给 runtime
+`/opt` 下的固定 Node、supervisor、daemon、launcher 与 DeepSeek 文件，不信任 provider 会开放给 runtime
 写入的 `/usr/local/bin`。
 `agent-service session --bootstrap-stdin` 同样属于受 supervisor 保护的内部协议，不应直接暴露给
 课程任务或 workspace shell。
 
 veFaaS Origin 的托管 workspace 使用用户级 NAS backing image。root bootstrap 完成 NFS、marker、
-ext4、loop mount 和固定 3 GiB 校验后，daemon 才发送 `sandbox.ready`。RuntimeSession 使用稳定路径
+ext4、`fuse2fs` mount 和固定 3 GiB 校验后，daemon 才发送 `sandbox.ready`。RuntimeSession 使用稳定路径
 `/workspace/sessions/{runtime_session_id}/workspace`，Sandbox generation 只参与写入隔离。磁盘写满
 统一上报 `workspace_user_quota_exceeded`。pause 和 cleanup 进入 drain 后，daemon 先停止 runtime
-writer，再通过 root launcher 执行 ext4 sync、loop unmount、backing image 和 NFS parent fsync；完成后
+writer，再通过 root launcher 执行 ext4 sync、`fuse2fs` unmount、backing image 和 NFS parent fsync；完成后
 才发送 `sandbox.drained` 并退出。
 
 ## 支持的 runtime

package/dist/agent-service-sandbox.d.ts

@@ -3,6 +3,13 @@ import type { WorkspaceScanMeasurement } from "./file-candidates.js";
 import { type RuntimeSkillProviderFactory } from "./runtime-skills.js";
 import { type PersistentSessionExecution, type PreparedPersistentTurn, type RunReportingClient } from "./run-dispatcher.js";
 import type { CourseRuntime, CourseRuntimeProfile, RunEvent, RunEventReceipt, RunFileCandidate, RunFileRecord, RunStartPayload } from "./types.js";
+export declare function workspaceDurabilityCapabilities(): string[];
+/**
+ * NAS 是运行时 workspace 的唯一持久事实来源，committed snapshot 只供前端查看。
+ * 任何 restore payload 都意味着对端仍在下发已删除的 S3 回写指令，必须 fail closed，
+ * 否则可能用落后的派生快照覆盖 NAS 中较新的内容。
+ */
+export declare function assertWorkspaceRestoreAllowed(requestedRestore: unknown): void;
 export interface AgentServiceSandboxOptions {
     wsUrl: string;
     sandboxId: string;

package/dist/agent-service-sandbox.js

@@ -1,7 +1,4 @@
-import { randomUUID } from "node:crypto";
-import { chmodSync, closeSync, createWriteStream, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, writeFileSync, } from "node:fs";
-import { Readable } from "node:stream";
-import { pipeline } from "node:stream/promises";
+import { chmodSync, closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, writeFileSync, } from "node:fs";
 import path from "node:path";
 import { ensureDaemonHome } from "./auth-store.js";
 import { AGENT_SERVICE_WS_SCHEMA, AGENT_SERVICE_WS_SUBPROTOCOL, createSandboxFrame, createWorkspaceFileChunk, parseSandboxFrame, UnsupportedSandboxProtocolError, WORKSPACE_FILE_READ_BINARY_CAPABILITY, } from "./agent-service-ws-protocol.js";
@@ -16,12 +13,9 @@ import { readWorkspaceFile, WorkspaceFileReadError } from "./workspace-file-read
 import { checkpointWorkspace, WorkspaceSnapshotControlError, } from "./workspace-snapshot-control.js";
 import { assertWorkspaceWriterFreezeSupported, freezeRuntimeWriters, issueWorkspaceWriterFreezeProof, quiesceRuntimeWriters, thawRuntimeWriters, } from "./runtime-quiescence.js";
 import { WorkspaceSnapshotStagingError } from "./workspace-snapshot-staging.js";
-import { validateWorkspaceEntrySet, WorkspaceEntrySetError, } from "./workspace-entry-set.js";
-import { WORKSPACE_SNAPSHOT_POLICY_V1, workspaceSnapshotPolicyCapability, } from "./workspace-snapshot-policy.js";
-import { assertWorkspaceRestoreCapacity, restoreWorkspaceSnapshot, WorkspaceRestoreError, } from "./workspace-restore.js";
-import { readWorkspaceMaterializationMarker } from "./workspace-materialization.js";
-import { assertWorkspaceFilesystem, flushWorkspaceFilesystem, nasWorkspaceEnabled, } from "./workspace-filesystem.js";
-import { applyRuntimeWorkspaceQuota } from "./workspace-quota.js";
+import { WorkspaceEntrySetError, } from "./workspace-entry-set.js";
+import { workspaceSnapshotPolicyCapability, } from "./workspace-snapshot-policy.js";
+import { assertWorkspaceFilesystem, flushWorkspaceFilesystem, } from "./workspace-filesystem.js";
 import { WebSocketClient, } from "./websocket-client.js";
 const RECONNECT_DELAYS_MS = [1_000, 2_000, 4_000, 8_000, 16_000, 30_000];
 const MAX_SPOOL_FRAMES = 1024;
@@ -41,6 +35,23 @@ function agentServiceHttpBase(wsUrl) {
 }
 const RUNTIME_LOG_WINDOW_MS = 60_000;
 const WORKSPACE_FILE_TRANSFER_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+export function workspaceDurabilityCapabilities() {
+    return [
+        "workspace_writer_freeze_v1",
+        "workspace_snapshot_v2",
+        "workspace_nas_v1",
+    ];
+}
+/**
+ * NAS 是运行时 workspace 的唯一持久事实来源，committed snapshot 只供前端查看。
+ * 任何 restore payload 都意味着对端仍在下发已删除的 S3 回写指令，必须 fail closed，
+ * 否则可能用落后的派生快照覆盖 NAS 中较新的内容。
+ */
+export function assertWorkspaceRestoreAllowed(requestedRestore) {
+    if (requestedRestore !== null && requestedRestore !== undefined) {
+        throw new Error("workspace_restore_forbidden_for_nas");
+    }
+}
 const DISABLED_RUNTIME_LOG_POLICY = {
     enabled: false,
     maxEventBytes: 4096,
@@ -836,7 +847,8 @@ export class AgentServiceSandboxClient {
             this.rejectPending(new Error("Agent Service sandbox generation changed"));
             for (const sessionId of Object.keys(this.state.sessions)) {
                 revokeRuntimeSessionWorkspace(sessionId, this.state.sandboxGeneration);
-                removeRuntimeSessionWorkspace(sessionId, this.state.sandboxGeneration, nasWorkspaceEnabled());
+                // NAS image 跨 generation 保留正文，只清掉本地 daemon 侧的 session 状态。
+                removeRuntimeSessionWorkspace(sessionId, this.state.sandboxGeneration, true);
             }
             this.state.sessions = {};
             this.state.sandboxGeneration = frame.sandbox_generation;
@@ -872,10 +884,7 @@ export class AgentServiceSandboxClient {
             protocol_versions: [AGENT_SERVICE_WS_SCHEMA],
             capabilities: [
                 WORKSPACE_FILE_READ_BINARY_CAPABILITY,
-                "workspace_writer_freeze_v1",
-                "workspace_snapshot_v2",
-                "workspace_restore_v1",
-                ...(nasWorkspaceEnabled() ? ["workspace_nas_v1"] : []),
+                ...workspaceDurabilityCapabilities(),
                 ...(workspaceCopyV1Supported() ? ["workspace_copy_v1"] : []),
             ],
             workspace_snapshot_policy: workspaceSnapshotPolicyCapability(),
@@ -1058,7 +1067,7 @@ export class AgentServiceSandboxClient {
         const courseRunId = frame.payload.course_run_id;
         const requestedWorkspaceRef = frame.payload.workspace_ref;
         const requestedCopy = frame.payload.workspace_copy;
-        const requestedRestore = frame.payload.workspace_restore;
+        assertWorkspaceRestoreAllowed(frame.payload.workspace_restore);
         const requestedCopyRecord = requestedCopy && typeof requestedCopy === "object"
             ? requestedCopy
             : undefined;
@@ -1079,11 +1088,7 @@ export class AgentServiceSandboxClient {
                     typeof copyId !== "string" ||
                     copyId.length < 1 ||
                     typeof requestedCopySource !== "string" ||
-                    requestedCopySource.length < 1))
-            || (requestedRestore !== null && requestedRestore !== undefined &&
-                (typeof requestedRestore !== "object" || Array.isArray(requestedRestore)))
-            || (requestedCopy !== null && requestedCopy !== undefined &&
-                requestedRestore !== null && requestedRestore !== undefined)) {
+                    requestedCopySource.length < 1))) {
             throw new Error("invalid session.open payload");
         }
         if (session.courseRunId !== null && session.courseRunId !== courseRunId) {
@@ -1097,165 +1102,6 @@ export class AgentServiceSandboxClient {
         const isNewSession = session.courseRunId === null;
         let markerPath = null;
         try {
-            if (requestedRestore && typeof requestedRestore === "object") {
-                const raw = requestedRestore;
-                const descriptorRaw = raw.descriptor;
-                const controlFence = raw.control_fence;
-                let restoreControlToken = raw.control_token;
-                if (!controlFence || typeof controlFence !== "object" || Array.isArray(controlFence)) {
-                    throw new Error("invalid workspace restore control fence");
-                }
-                if (typeof restoreControlToken !== "string" || restoreControlToken.length < 32) {
-                    throw new Error("invalid workspace restore control token");
-                }
-                if (!descriptorRaw || !Array.isArray(raw.entries)) {
-                    throw new Error("invalid workspace restore payload");
-                }
-                const descriptor = {
-                    sandboxId: this.options.sandboxId,
-                    sandboxGeneration: this.sandboxGeneration,
-                    runtimeSessionId: sessionId,
-                    continuityState: descriptorRaw.continuity_state,
-                    continuityErrorCode: descriptorRaw.continuity_error_code,
-                    snapshotId: descriptorRaw.snapshot_id,
-                    revision: Number(descriptorRaw.revision),
-                    contentSha256: descriptorRaw.content_sha256,
-                    expectedFileCount: Number(descriptorRaw.expected_file_count),
-                    expectedEntryCount: Number(descriptorRaw.expected_entry_count),
-                    expectedTotalBytes: Number(descriptorRaw.expected_total_bytes),
-                };
-                const workspaceDirectory = runtimeSessionWorkspaceDir(sessionId, this.sandboxGeneration);
-                const requiredFreeBytes = Math.max(WORKSPACE_SNAPSHOT_POLICY_V1.requiredRestoreFreeBytes, descriptor.expectedTotalBytes + WORKSPACE_SNAPSHOT_POLICY_V1.requiredRestoreFreeBytes);
-                // Fail before issuing or consuming any object grant. The download staging is a
-                // sibling on this same bounded backing filesystem and is renamed, not copied,
-                // into the atomic restore staging tree.
-                assertWorkspaceRestoreCapacity({
-                    workspaceDirectory,
-                    descriptor,
-                    requiredFreeBytes,
-                    entryCopies: 2,
-                });
-                const entries = [];
-                const predownloadRoot = path.join(path.dirname(workspaceDirectory), `.botlearn-predownload-${sessionId}-${randomUUID()}`);
-                mkdirSync(predownloadRoot, { recursive: true, mode: 0o700 });
-                try {
-                    let nextCursor = null;
-                    do {
-                        if (nextCursor !== null && nextCursor.length > 2048) {
-                            throw new Error("invalid workspace restore cursor");
-                        }
-                        const pageSignal = AbortSignal.timeout(60_000);
-                        const response = await fetch(`${agentServiceHttpBase(this.options.wsUrl)}/runtime-sessions/${sessionId}/restore-grants`, {
-                            method: "POST",
-                            headers: {
-                                Authorization: `Bearer ${restoreControlToken}`,
-                                "Content-Type": "application/json",
-                            },
-                            body: JSON.stringify({
-                                policy_id: WORKSPACE_SNAPSHOT_POLICY_V1.policyId,
-                                fence: controlFence,
-                                cursor: nextCursor,
-                                // Fetch one canonical entry at a time so a grant is consumed as soon as
-                                // it is signed, including deployments using the minimum 60-second TTL.
-                                max_entries: 1,
-                            }),
-                            signal: pageSignal,
-                        });
-                        if (!response.ok) {
-                            let code = "workspace_restore_unavailable";
-                            let retryable = response.status >= 500 || response.status === 408 ||
-                                response.status === 429;
-                            try {
-                                const rejected = await response.json();
-                                const detail = rejected.detail;
-                                if (detail && typeof detail === "object" && !Array.isArray(detail)) {
-                                    const stableCode = detail.code;
-                                    if (typeof stableCode === "string" && stableCode.length <= 120) {
-                                        code = stableCode;
-                                    }
-                                    if (typeof detail.retryable === "boolean") {
-                                        retryable = detail.retryable;
-                                    }
-                                }
-                            }
-                            catch {
-                                // Content-free fallback retains the stable local failure code.
-                            }
-                            throw new WorkspaceRestoreError(code, retryable);
-                        }
-                        const page = await response.json();
-                        if (!Array.isArray(page.entries))
-                            throw new Error("invalid workspace restore page");
-                        if (typeof page.control_token !== "string" || page.control_token.length < 32) {
-                            throw new Error("invalid refreshed workspace restore control token");
-                        }
-                        restoreControlToken = page.control_token;
-                        const pageFiles = [];
-                        for (const value of page.entries) {
-                            if (!value || typeof value !== "object" || Array.isArray(value)) {
-                                throw new Error("invalid workspace restore entry");
-                            }
-                            const item = value;
-                            if (item.entry_type === "directory") {
-                                entries.push({ type: "directory", path: String(item.path), mode: "0700" });
-                                continue;
-                            }
-                            if (item.entry_type !== "file" || !item.grant || typeof item.grant !== "object") {
-                                throw new Error("invalid workspace restore file grant");
-                            }
-                            const entry = {
-                                type: "file",
-                                path: String(item.path),
-                                mode: item.mode,
-                                sizeBytes: Number(item.size_bytes),
-                                sha256: String(item.sha256),
-                            };
-                            entries.push(entry);
-                            pageFiles.push({ entry, grant: item.grant });
-                        }
-                        // Validate all paths and duplicates before using any page path locally.
-                        validateWorkspaceEntrySet({ schemaVersion: "agent-workspace-entry-set/1", entries }, WORKSPACE_SNAPSHOT_POLICY_V1.limits);
-                        for (const { entry, grant } of pageFiles) {
-                            if (typeof grant.url !== "string")
-                                throw new Error("workspace restore grant missing");
-                            const destination = path.join(predownloadRoot, ...entry.path.split("/"));
-                            mkdirSync(path.dirname(destination), { recursive: true, mode: 0o700 });
-                            const part = `${destination}.part`;
-                            const downloadSignal = AbortSignal.timeout(60_000);
-                            const download = await fetch(grant.url, {
-                                method: "GET",
-                                headers: grant.headers,
-                                signal: downloadSignal,
-                            });
-                            if (!download.ok)
-                                throw new Error(`workspace_restore_download_${download.status}`);
-                            if (!download.body)
-                                throw new Error("workspace_restore_download_body_missing");
-                            await pipeline(Readable.fromWeb(download.body), createWriteStream(part, { mode: 0o600 }), { signal: downloadSignal });
-                            renameSync(part, destination);
-                        }
-                        const rawNext = page.next_cursor;
-                        if (rawNext !== null && rawNext !== undefined && typeof rawNext !== "string") {
-                            throw new Error("invalid workspace restore cursor");
-                        }
-                        nextCursor = rawNext ?? null;
-                    } while (nextCursor !== null);
-                    await restoreWorkspaceSnapshot({
-                        workspaceDirectory,
-                        controlDirectory: path.join(ensureDaemonHome(), "agent-service-sandboxes", this.options.sandboxId, "workspace-control"),
-                        descriptor,
-                        entrySet: { schemaVersion: "agent-workspace-entry-set/1", entries },
-                        limits: WORKSPACE_SNAPSHOT_POLICY_V1.limits,
-                        requiredFreeBytes,
-                        downloadFile: async (entry, partPath) => {
-                            renameSync(path.join(predownloadRoot, ...entry.path.split("/")), partPath);
-                        },
-                    });
-                }
-                finally {
-                    rmSync(predownloadRoot, { recursive: true, force: true });
-                }
-            }
             if (typeof requestedCopySource === "string" && typeof copyId === "string") {
                 if (session.workspaceCopyReceipt !== null) {
                     const receipt = session.workspaceCopyReceipt;
@@ -1299,14 +1145,6 @@ export class AgentServiceSandboxClient {
                 });
                 return;
             }
-            if (requestedRestore) {
-                const restoreError = error instanceof WorkspaceRestoreError ? error : null;
-                await this.sendSessionFrame("session.open_failed", sessionId, {
-                    error_code: restoreError?.code ?? "workspace_restore_unavailable",
-                    retryable: restoreError?.retryable ?? true,
-                });
-                return;
-            }
             throw error;
         }
         session.courseRunId = courseRunId;
@@ -1322,41 +1160,14 @@ export class AgentServiceSandboxClient {
         if (markerPath !== null) {
             await finalizeRuntimeSessionWorkspaceCopy(markerPath);
         }
-        try {
-            if (!nasWorkspaceEnabled()) {
-                await applyRuntimeWorkspaceQuota(sessionId, this.sandboxGeneration);
-            }
-        }
-        catch (error) {
-            if (requestedRestore) {
-                await this.sendSessionFrame("session.open_failed", sessionId, {
-                    error_code: "workspace_restore_unavailable",
-                });
-                return;
-            }
-            if (requestedCopy) {
-                await this.sendSessionFrame("session.open_failed", sessionId, {
-                    error_code: "workspace_migration_io_failed",
-                });
-                return;
-            }
-            throw error;
-        }
         this.state.sessions[sessionId] = session;
         this.persist();
-        const materialization = readWorkspaceMaterializationMarker(this.options.sandboxId, sessionId);
+        // NAS 是唯一的 workspace 权威来源，所以 session.opened 不携带 snapshot 物化标记：
+        // 挂载证明只说明当前 generation 已挂上 NAS，不要求运行目录等于某个 committed revision。
         await this.sendSessionFrame("session.opened", sessionId, {
             workspace_ref: session.workspaceRef,
             native_session_id: session.nativeSessionId,
-            ...(materialization
-                ? {
-                    workspace_marker_version: 1,
-                    workspace_continuity_state: materialization.workspaceContinuityState,
-                    workspace_snapshot_id: materialization.snapshotId,
-                    workspace_revision: materialization.revision,
-                    workspace_content_sha256: materialization.contentSha256,
-                }
-                : {}),
+            workspace_authority: "nas",
             ...(session.workspaceCopyReceipt !== null
                 ? { workspace_copy_receipt: session.workspaceCopyReceipt }
                 : {}),
@@ -1420,17 +1231,11 @@ export class AgentServiceSandboxClient {
                 freezeProof,
             });
             checkpointCommitted = true;
-            const marker = readWorkspaceMaterializationMarker(this.options.sandboxId, sessionId);
-            if (!marker)
-                throw new Error("workspace checkpoint marker missing");
+            // committed revision 只是派生投影，不改变运行目录，所以这里不上报物化标记。
             await this.sendSessionFrame("session.opened", sessionId, {
                 workspace_ref: session.workspaceRef,
                 native_session_id: session.nativeSessionId,
-                workspace_marker_version: 1,
-                workspace_continuity_state: marker.workspaceContinuityState,
-                workspace_snapshot_id: marker.snapshotId,
-                workspace_revision: marker.revision,
-                workspace_content_sha256: marker.contentSha256,
+                workspace_authority: "nas",
             });
             await this.sendCommandAck(frame, "ok");
             if (!lifecycleCheckpoint)

package/dist/index.d.ts

@@ -12,11 +12,9 @@ export * from "./run-dispatcher.js";
 export * from "./run-queue.js";
 export * from "./workspace.js";
 export * from "./workspace-entry-set.js";
-export * from "./workspace-materialization.js";
 export * from "./workspace-snapshot-staging.js";
 export * from "./workspace-snapshot-policy.js";
 export * from "./workspace-snapshot-control.js";
-export * from "./workspace-restore.js";
 export * from "./transcript.js";
 export * from "./file-candidates.js";
 export * from "./doctor.js";

package/dist/index.js

@@ -12,11 +12,9 @@ export * from "./run-dispatcher.js";
 export * from "./run-queue.js";
 export * from "./workspace.js";
 export * from "./workspace-entry-set.js";
-export * from "./workspace-materialization.js";
 export * from "./workspace-snapshot-staging.js";
 export * from "./workspace-snapshot-policy.js";
 export * from "./workspace-snapshot-control.js";
-export * from "./workspace-restore.js";
 export * from "./transcript.js";
 export * from "./file-candidates.js";
 export * from "./doctor.js";

package/dist/redaction.js

@@ -25,6 +25,7 @@ const QUOTED_JSON_SECRET_PATTERN = new RegExp(`(["'])(${SECRET_KEY_NAME_SOURCE})
 const QUOTED_ARGV_SECRET_PATTERN = new RegExp(`(["'])(${SECRET_FLAG_SOURCE})\\1(\\s*,\\s*)(["'])([^"'\\\\]*(?:\\\\.[^"'\\\\]*)*)\\4`, "gi");
 // blic_ 是课程 install code 前缀，与 runtime token 前缀一并脱敏。
 const SECRET_PREFIX_PATTERN = /\b(blic_|drt_|dit_|gho_|ghp_|sk-)[A-Za-z0-9_-]+/g;
+const SIGNED_OBJECT_URL_PATTERN = /https?:\/\/[^\s"'<>]*[?&](?:X-Amz-Algorithm|X-Amz-Credential|X-Amz-Signature|X-Amz-Security-Token)=[^\s"'<>]*/gi;
 const SECRET_VALUE_PATTERNS = [
     [/\b(Bearer\s+)[^\s"']+/gi, `$1${REDACTED}`],
     [new RegExp(`(^|[\\s])(${SECRET_FLAG_SOURCE})=([^\\s"']+)`, "gi"), `$1$2=${REDACTED}`],
@@ -83,6 +84,7 @@ export function assertNoInjectedCredentials(data, additionalSecrets = []) {
 }
 export function redactSecretString(text, additionalSecrets = []) {
     return redactInjectedCredentials(text, additionalSecrets)
+        .replace(SIGNED_OBJECT_URL_PATTERN, REDACTED)
         .replace(/\b(Bearer\s+)[^\s"']+/gi, `$1${REDACTED}`)
         .replace(new RegExp(`(^|[\\s])(${SECRET_FLAG_SOURCE})=([^\\s"']+)`, "gi"), `$1$2=${REDACTED}`)
         .replace(new RegExp(`(^|[\\s])(${SECRET_FLAG_SOURCE})(\\s+)([^\\s"']+)`, "gi"), `$1$2$3${REDACTED}`)

package/dist/runtime-env.d.ts

@@ -16,7 +16,7 @@ export declare function runtimeChildIdentity(env?: NodeJS.ProcessEnv): {
 /**
  * Build the fixed control-to-runtime privilege boundary used by managed sandboxes.
  *
- * E2B runs the daemon as botlearn-control and grants it one fixed sudoers command.
+ * The legacy image boundary may grant botlearn-control one fixed sudoers command.
  * Platforms that inherit no_new_privs cannot use sudo, so their root supervisor daemon
  * invokes the same immutable launcher directly; the launcher clears supplementary groups
  * and performs the one-way uid/gid drop. BYOA retains direct-spawn behavior.

package/dist/runtime-env.js

@@ -96,7 +96,7 @@ export function runtimeChildIdentity(env = process.env) {
 /**
  * Build the fixed control-to-runtime privilege boundary used by managed sandboxes.
  *
- * E2B runs the daemon as botlearn-control and grants it one fixed sudoers command.
+ * The legacy image boundary may grant botlearn-control one fixed sudoers command.
  * Platforms that inherit no_new_privs cannot use sudo, so their root supervisor daemon
  * invokes the same immutable launcher directly; the launcher clears supplementary groups
  * and performs the one-way uid/gid drop. BYOA retains direct-spawn behavior.

package/dist/runtimes/deepseek-tui.js

@@ -1000,6 +1000,17 @@ function normalizeDeepseekEvent(eventName, payload, seq) {
             status: deepseekToolFailed(payload) ? "error" : "completed",
         };
     }
+    if (eventName === "item.delta" && isDeepseekReasoningEvent(eventName, payload)) {
+        const text = extractDeepseekDelta(payload);
+        return text
+            ? {
+                raw: { event: eventName, payload },
+                kind: "thinking",
+                seq,
+                text,
+            }
+            : null;
+    }
     if (eventName === "item.delta" && isAgentMessageDelta(payload)) {
         return {
             raw: { event: eventName, payload },

package/dist/sandbox-supervisor.js

@@ -19,7 +19,7 @@ const MANAGED_PATH = [
     "/opt/node/22.23.1/bin",
     "/usr/bin",
     "/bin",
-    // E2B materializes this directory as runtime-writable. Keep it last and never
+    // The managed image exposes this directory as runtime-writable. Keep it last and never
     // use it for a managed control-plane executable.
     "/usr/local/bin",
 ].join(":");

package/dist/tool-observation.js

@@ -12,6 +12,7 @@ const CALL_FIELDS = new Set([
     "arguments",
     "args",
     "input",
+    "detail",
     "command",
     "cmd",
     "cwd",
@@ -27,6 +28,7 @@ const CALL_FIELDS = new Set([
 const RESULT_FIELDS = new Set([
     "result",
     "output",
+    "detail",
     "stdout",
     "stderr",
     "exit_code",

package/dist/workspace-filesystem.d.ts

@@ -12,7 +12,6 @@ export interface WorkspaceCapacityProbes {
     backingFileBytes(imagePath: string): bigint;
 }
 export declare function parseWorkspaceMountInfo(text: string): MountInfoEntry[];
-export declare function nasWorkspaceEnabled(env?: NodeJS.ProcessEnv): boolean;
 export declare function workspaceFilesystemFlushCommand(env?: NodeJS.ProcessEnv): [string, string[]] | null;
 export declare function flushWorkspaceFilesystem(env?: NodeJS.ProcessEnv): Promise<void>;
 export declare function isWorkspaceQuotaExceededError(error: unknown): boolean;

package/dist/workspace-filesystem.js

@@ -1,7 +1,6 @@
 import { execFile } from "node:child_process";
 import { readFileSync, statfsSync, statSync } from "node:fs";
 import { promisify } from "node:util";
-import { assertRuntimeWorkspaceQuota } from "./workspace-quota.js";
 export const WORKSPACE_IMAGE_FORMAT = "botlearn-workspace-image/1";
 export const WORKSPACE_IMAGE_LOGICAL_BYTES = 3 * 1024 * 1024 * 1024;
 const RUNTIME_LAUNCHER = "/opt/botlearn/bin/botlearn-runtime-launcher";
@@ -35,12 +34,7 @@ export function parseWorkspaceMountInfo(text) {
         };
     });
 }
-export function nasWorkspaceEnabled(env = process.env) {
-    return env.BOTLEARN_WORKSPACE_IMAGE_FORMAT !== undefined;
-}
 export function workspaceFilesystemFlushCommand(env = process.env) {
-    if (!nasWorkspaceEnabled(env))
-        return null;
     if (env.BOTLEARN_RUNTIME_LAUNCH_MODE === "direct-uid") {
         return [RUNTIME_LAUNCHER, ["--workspace-filesystem-flush"]];
     }
@@ -82,10 +76,6 @@ export function isWorkspaceQuotaExceededError(error) {
         || (candidate.cause !== undefined && isWorkspaceQuotaExceededError(candidate.cause));
 }
 export function assertWorkspaceFilesystem(workspaceRoot, env = process.env, mountInfo, capacityProbes) {
-    if (!nasWorkspaceEnabled(env)) {
-        assertRuntimeWorkspaceQuota(workspaceRoot);
-        return;
-    }
     if (env.BOTLEARN_WORKSPACE_IMAGE_FORMAT !== WORKSPACE_IMAGE_FORMAT
         || env.BOTLEARN_WORKSPACE_LOGICAL_BYTES !== String(WORKSPACE_IMAGE_LOGICAL_BYTES)
         || !/^[0-9a-f]{64}$/u.test(env.BOTLEARN_WORKSPACE_SCOPE_DIGEST ?? "")) {

package/dist/workspace-snapshot-control.js

@@ -1,7 +1,6 @@
 import { createReadStream, rmSync } from "node:fs";
 import path from "node:path";
 import { ensureDaemonHome } from "./auth-store.js";
-import { writeWorkspaceMaterializationMarker } from "./workspace-materialization.js";
 import { WORKSPACE_SNAPSHOT_POLICY_V1 } from "./workspace-snapshot-policy.js";
 import { stageWorkspaceSnapshot } from "./workspace-snapshot-staging.js";
 export class WorkspaceSnapshotControlError extends Error {
@@ -95,19 +94,6 @@ export async function checkpointWorkspace(options) {
             entry_set: entrySet,
         }, signal);
         if (proposal.unchanged) {
-            if (proposal.revision === 0 && proposal.snapshot_id === null) {
-                writeWorkspaceMaterializationMarker({
-                    schemaVersion: "agent-workspace-materialization/1",
-                    sandboxId: scope.sandboxId,
-                    sandboxGeneration: scope.sandboxGeneration,
-                    runtimeSessionId: scope.runtimeSessionId,
-                    workspaceContinuityState: "healthy",
-                    snapshotId: null,
-                    revision: 0,
-                    contentSha256: null,
-                    writtenAt: new Date().toISOString(),
-                });
-            }
             return {
                 revision: proposal.revision,
                 snapshotId: proposal.snapshot_id,
@@ -146,17 +132,6 @@ export async function checkpointWorkspace(options) {
             committed.content_sha256 === null) {
             throw new WorkspaceSnapshotControlError(committed.error_code || "workspace_snapshot_verification_failed", false);
         }
-        writeWorkspaceMaterializationMarker({
-            schemaVersion: "agent-workspace-materialization/1",
-            sandboxId: scope.sandboxId,
-            sandboxGeneration: scope.sandboxGeneration,
-            runtimeSessionId: scope.runtimeSessionId,
-            workspaceContinuityState: "healthy",
-            snapshotId: committed.snapshot_id,
-            revision: committed.revision,
-            contentSha256: committed.content_sha256,
-            writtenAt: new Date().toISOString(),
-        });
         return {
             revision: committed.revision,
             snapshotId: committed.snapshot_id,

package/dist/workspace-snapshot-policy.d.ts

@@ -20,5 +20,5 @@ export declare const WORKSPACE_SNAPSHOT_POLICY_V1: {
     readonly checkpointReservationBytes: number;
     readonly restorePageEntries: 25;
 };
-/** Wire representation validated exactly by Agent Service during the v0.3 handshake. */
+/** Wire representation validated exactly by Agent Service during the handshake. */
 export declare function workspaceSnapshotPolicyCapability(): Record<string, unknown>;

package/dist/workspace-snapshot-policy.js

@@ -1,4 +1,6 @@
-import { RUNTIME_WORKSPACE_INODE_QUOTA, RUNTIME_WORKSPACE_QUOTA_BYTES, } from "./workspace-quota.js";
+/** runtime 目录配额；与 Course Service 的 WorkspaceSnapshotPolicyV1 逐字段一致。 */
+const RUNTIME_WORKSPACE_QUOTA_BYTES = 512 * 1024 * 1024;
+const RUNTIME_WORKSPACE_INODE_QUOTA = 2_000;
 /**
  * Protocol limits frozen with Course Service's WorkspaceSnapshotPolicyV1.
  * Deployment may enable the capability, but must never override these values.
@@ -21,7 +23,7 @@ export const WORKSPACE_SNAPSHOT_POLICY_V1 = {
     checkpointReservationBytes: 512 * 1024 * 1024,
     restorePageEntries: 25,
 };
-/** Wire representation validated exactly by Agent Service during the v0.3 handshake. */
+/** Wire representation validated exactly by Agent Service during the handshake. */
 export function workspaceSnapshotPolicyCapability() {
     return {
         policy_id: WORKSPACE_SNAPSHOT_POLICY_V1.policyId,

package/dist/workspace.d.ts

@@ -20,9 +20,9 @@ export declare function runtimeProfileDir(agentRunId: string): string;
 export declare function runtimeProfileRunRootDir(agentRunId: string): string;
 export declare function runtimeSessionRootDir(runtimeSessionId: string, sandboxGeneration: number): string;
 /**
- * per-session workspace（ADR-015 §7）：NAS managed sandbox 使用稳定路径
- * `<root>/sessions/<runtime_session_id>/workspace`；旧 provider 保留 generation 路径。
- * 两种路径都由 daemon 在 session.open 时创建。
+ * per-session workspace（ADR-015 §7）：managed sandbox 使用稳定路径
+ * `<root>/sessions/<runtime_session_id>/workspace`。该路径不含 generation，
+ * 因为 NAS image 跨 generation 重新挂载后必须解析到同一个目录。
  */
 export declare function runtimeSessionWorkspaceDir(runtimeSessionId: string, sandboxGeneration: number): string;
 export declare function runtimeSessionTranscriptPath(runtimeSessionId: string, sandboxGeneration: number, agentRunId: string): string;