rl-rock 1.2.7 → 1.3.0

package/README.md

@@ -10,6 +10,8 @@ ROCK (Remote Operation Container Kit) TypeScript SDK - 用于管理远程沙箱
 
 - 🚀 **沙箱管理** - 创建、启动、停止远程容器沙箱
 - 📁 **文件系统** - 上传、下载、读取、写入文件
+  - OSS 大文件上传/下载支持
+  - 灵活的上传模式选择 (auto/direct/oss)
 - 🖥️ **命令执行** - 同步/异步执行 Shell 命令
 - 🔧 **运行时环境** - 支持 Python、Node.js 运行时环境管理（沙箱内安装）
 - 🤖 **模型服务** - 沙箱内模型服务安装与生命周期管理
@@ -88,6 +90,14 @@ await sandbox.upload({
   sourcePath: './local-file.txt',
   targetPath: '/remote/path/file.txt',
 });
+
+// 上传大文件使用 OSS (自动选择)
+await sandbox.uploadByPath('./large-file.zip', '/remote/large-file.zip', 'auto');
+// 强制使用 OSS 上传
+await sandbox.uploadByPath('./large-file.zip', '/remote/large-file.zip', 'oss');
+
+// 从沙箱下载文件到本地 (需要配置 OSS)
+await sandbox.downloadFile('/remote/file.txt', './local-file.txt');
 ```
 
 ### 使用 EnvHub
@@ -212,7 +222,7 @@ console.log(result.output);
 | `ROCK_BASE_URL` | ROCK 服务基础 URL | `http://localhost:8080` |
 | `ROCK_ENVHUB_BASE_URL` | EnvHub 服务 URL | `http://localhost:8081` |
 | `ROCK_SANDBOX_STARTUP_TIMEOUT_SECONDS` | 沙箱启动超时时间 | `180` |
-| `ROCK_OSS_ENABLE` | 是否启用 OSS 上传 | `false` |
+| `ROCK_OSS_ENABLE` | 是否启用 OSS 上传/下载 | `false` |
 | `ROCK_OSS_BUCKET_ENDPOINT` | OSS Endpoint | - |
 | `ROCK_OSS_BUCKET_NAME` | OSS Bucket 名称 | - |
 

package/dist/index.d.mts

@@ -151,18 +151,30 @@ declare const ReadFileRequestSchema: z.ZodObject<{
     errors?: string | undefined;
 }>;
 type ReadFileRequest = z.infer<typeof ReadFileRequestSchema>;
+/**
+ * Upload mode enum
+ * - auto: Automatically choose upload method based on file size and OSS availability
+ * - direct: Force direct HTTP upload
+ * - oss: Force OSS upload
+ */
+declare const UploadModeSchema: z.ZodEnum<["auto", "direct", "oss"]>;
+type UploadMode = z.infer<typeof UploadModeSchema>;
 /**
  * Upload file request
+ * Note: uploadMode defaults to 'auto' in the implementation, not in the schema
  */
 declare const UploadRequestSchema: z.ZodObject<{
     sourcePath: z.ZodString;
     targetPath: z.ZodString;
+    uploadMode: z.ZodOptional<z.ZodEnum<["auto", "direct", "oss"]>>;
 }, "strip", z.ZodTypeAny, {
     sourcePath: string;
     targetPath: string;
+    uploadMode?: "auto" | "direct" | "oss" | undefined;
 }, {
     sourcePath: string;
     targetPath: string;
+    uploadMode?: "auto" | "direct" | "oss" | undefined;
 }>;
 type UploadRequest = z.infer<typeof UploadRequestSchema>;
 /**
@@ -475,6 +487,41 @@ declare const OssSetupResponseSchema: z.ZodObject<{
     success?: boolean | undefined;
 }>;
 type OssSetupResponse = z.infer<typeof OssSetupResponseSchema>;
+/**
+ * Download file response
+ */
+declare const DownloadFileResponseSchema: z.ZodObject<{
+    success: z.ZodDefault<z.ZodBoolean>;
+    message: z.ZodDefault<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    message: string;
+    success: boolean;
+}, {
+    message?: string | undefined;
+    success?: boolean | undefined;
+}>;
+type DownloadFileResponse = z.infer<typeof DownloadFileResponseSchema>;
+/**
+ * OSS STS credentials from sandbox /get_token API
+ * API returns snake_case, which gets converted to camelCase by HttpUtils
+ */
+declare const OssCredentialsSchema: z.ZodObject<{
+    accessKeyId: z.ZodString;
+    accessKeySecret: z.ZodString;
+    securityToken: z.ZodString;
+    expiration: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    accessKeyId: string;
+    accessKeySecret: string;
+    securityToken: string;
+    expiration: string;
+}, {
+    accessKeyId: string;
+    accessKeySecret: string;
+    securityToken: string;
+    expiration: string;
+}>;
+type OssCredentials = z.infer<typeof OssCredentialsSchema>;
 
 /**
  * Common constants
@@ -1196,6 +1243,8 @@ declare class Sandbox extends AbstractSandbox {
     private hostName;
     private hostIp;
     private cluster;
+    private ossBucket;
+    private ossTokenExpireTime;
     private deploy;
     private fs;
     private network;
@@ -1238,7 +1287,27 @@ declare class Sandbox extends AbstractSandbox {
     writeFile(request: WriteFileRequest): Promise<WriteFileResponse>;
     readFile(request: ReadFileRequest): Promise<ReadFileResponse>;
     upload(request: UploadRequest): Promise<UploadResponse>;
-    uploadByPath(sourcePath: string, targetPath: string): Promise<UploadResponse>;
+    uploadByPath(sourcePath: string, targetPath: string, uploadMode?: UploadMode): Promise<UploadResponse>;
+    /**
+     * Get OSS STS credentials from sandbox
+     */
+    getOssStsCredentials(): Promise<OssCredentials>;
+    /**
+     * Check if OSS token is expired (with 5-minute buffer)
+     */
+    isTokenExpired(): boolean;
+    /**
+     * Download file from sandbox via OSS
+     */
+    downloadFile(remotePath: string, localPath: string): Promise<DownloadFileResponse>;
+    /**
+     * Upload file via OSS (internal method)
+     */
+    private uploadViaOss;
+    /**
+     * Setup OSS bucket with STS credentials
+     */
+    private setupOss;
     close(): Promise<void>;
     toString(): string;
 }
@@ -2356,4 +2425,4 @@ declare class DefaultAgent extends Agent {
  */
 declare const VERSION: string;
 
-export { Agent, type AgentBashCommand, AgentBashCommandSchema, type AgentConfig, AgentConfigSchema, BadRequestRockError, type BaseConfig, type BashAction, BashActionSchema, type ChmodRequest, ChmodRequestSchema, type ChmodResponse, ChmodResponseSchema, type ChownRequest, ChownRequestSchema, type ChownResponse, ChownResponseSchema, type CloseResponse, CloseResponseSchema, type CloseSessionRequest, CloseSessionRequestSchema, type CloseSessionResponse, CloseSessionResponseSchema, Codes, type Command, type CommandResponse, CommandResponseSchema, CommandRockError, CommandSchema, type CreateBashSessionRequest, CreateBashSessionRequestSchema, type CreateSessionResponse, CreateSessionResponseSchema, DefaultAgent, type DefaultAgentConfig, DefaultAgentConfigSchema, Deploy, EnvHubClient, type EnvHubClientConfig, EnvHubClientConfigSchema, EnvHubError, type ExecuteBashSessionResponse, ExecuteBashSessionResponseSchema, HttpUtils, InternalServerRockError, InvalidParameterRockException, type IsAliveResponse, IsAliveResponseSchema, LinuxFileSystem, LinuxRemoteUser, ModelClient, type ModelClientConfig, ModelService, type ModelServiceConfig, ModelServiceConfigSchema, NODE_DEFAULT_VERSION, Network, NodeRuntimeEnv, type NodeRuntimeEnvConfig, NodeRuntimeEnvConfigSchema, type Observation, ObservationSchema, type OssSetupResponse, OssSetupResponseSchema, PID_PREFIX, PID_SUFFIX, type PollOptions, Process, PythonRuntimeEnv, type PythonRuntimeEnvConfig, PythonRuntimeEnvConfigSchema, type ReadFileRequest, ReadFileRequestSchema, type ReadFileResponse, ReadFileResponseSchema, ReasonPhrases, type ResetResult, type RockAgentConfig, RockAgentConfigSchema, RockEnv, type RockEnvConfig, type RockEnvInfo, RockEnvInfoSchema, RockException, RunMode, type RunModeType, RuntimeEnv, type RuntimeEnvConfig, RuntimeEnvConfigSchema, type RuntimeEnvId, Sandbox, type SandboxConfig, SandboxConfigSchema, SandboxGroup, type SandboxGroupConfig, SandboxGroupConfigSchema, type SandboxLike, type SandboxResponse, SandboxResponseSchema, type RunModeType as SandboxRunModeType, type SandboxStatusResponse, SandboxStatusResponseSchema, SpeedupType, type StepResult, type UploadRequest, UploadRequestSchema, type UploadResponse, UploadResponseSchema, VERSION, type WriteFileRequest, WriteFileRequestSchema, type WriteFileResponse, WriteFileResponseSchema, arunWithRetry, createRockEnvInfo, createRuntimeEnvId, createSandboxConfig, createSandboxGroupConfig, deprecated, deprecatedClass, extractNohupPid as extractNohupPidFromSandbox, fromRockException, getDefaultPipIndexUrl, getEnv, getReasonPhrase, getRequiredEnv, isClientError, isCommandError, isEnvSet, isError, isNode, isServerError, isSuccess, make, raiseForCode, retryAsync, sleep, withRetry, withTimeLogging };
+export { Agent, type AgentBashCommand, AgentBashCommandSchema, type AgentConfig, AgentConfigSchema, BadRequestRockError, type BaseConfig, type BashAction, BashActionSchema, type ChmodRequest, ChmodRequestSchema, type ChmodResponse, ChmodResponseSchema, type ChownRequest, ChownRequestSchema, type ChownResponse, ChownResponseSchema, type CloseResponse, CloseResponseSchema, type CloseSessionRequest, CloseSessionRequestSchema, type CloseSessionResponse, CloseSessionResponseSchema, Codes, type Command, type CommandResponse, CommandResponseSchema, CommandRockError, CommandSchema, type CreateBashSessionRequest, CreateBashSessionRequestSchema, type CreateSessionResponse, CreateSessionResponseSchema, DefaultAgent, type DefaultAgentConfig, DefaultAgentConfigSchema, Deploy, type DownloadFileResponse, DownloadFileResponseSchema, EnvHubClient, type EnvHubClientConfig, EnvHubClientConfigSchema, EnvHubError, type ExecuteBashSessionResponse, ExecuteBashSessionResponseSchema, HttpUtils, InternalServerRockError, InvalidParameterRockException, type IsAliveResponse, IsAliveResponseSchema, LinuxFileSystem, LinuxRemoteUser, ModelClient, type ModelClientConfig, ModelService, type ModelServiceConfig, ModelServiceConfigSchema, NODE_DEFAULT_VERSION, Network, NodeRuntimeEnv, type NodeRuntimeEnvConfig, NodeRuntimeEnvConfigSchema, type Observation, ObservationSchema, type OssCredentials, OssCredentialsSchema, type OssSetupResponse, OssSetupResponseSchema, PID_PREFIX, PID_SUFFIX, type PollOptions, Process, PythonRuntimeEnv, type PythonRuntimeEnvConfig, PythonRuntimeEnvConfigSchema, type ReadFileRequest, ReadFileRequestSchema, type ReadFileResponse, ReadFileResponseSchema, ReasonPhrases, type ResetResult, type RockAgentConfig, RockAgentConfigSchema, RockEnv, type RockEnvConfig, type RockEnvInfo, RockEnvInfoSchema, RockException, RunMode, type RunModeType, RuntimeEnv, type RuntimeEnvConfig, RuntimeEnvConfigSchema, type RuntimeEnvId, Sandbox, type SandboxConfig, SandboxConfigSchema, SandboxGroup, type SandboxGroupConfig, SandboxGroupConfigSchema, type SandboxLike, type SandboxResponse, SandboxResponseSchema, type RunModeType as SandboxRunModeType, type SandboxStatusResponse, SandboxStatusResponseSchema, SpeedupType, type StepResult, type UploadMode, UploadModeSchema, type UploadRequest, UploadRequestSchema, type UploadResponse, UploadResponseSchema, VERSION, type WriteFileRequest, WriteFileRequestSchema, type WriteFileResponse, WriteFileResponseSchema, arunWithRetry, createRockEnvInfo, createRuntimeEnvId, createSandboxConfig, createSandboxGroupConfig, deprecated, deprecatedClass, extractNohupPid as extractNohupPidFromSandbox, fromRockException, getDefaultPipIndexUrl, getEnv, getReasonPhrase, getRequiredEnv, isClientError, isCommandError, isEnvSet, isError, isNode, isServerError, isSuccess, make, raiseForCode, retryAsync, sleep, withRetry, withTimeLogging };

package/dist/index.d.ts

@@ -151,18 +151,30 @@ declare const ReadFileRequestSchema: z.ZodObject<{
     errors?: string | undefined;
 }>;
 type ReadFileRequest = z.infer<typeof ReadFileRequestSchema>;
+/**
+ * Upload mode enum
+ * - auto: Automatically choose upload method based on file size and OSS availability
+ * - direct: Force direct HTTP upload
+ * - oss: Force OSS upload
+ */
+declare const UploadModeSchema: z.ZodEnum<["auto", "direct", "oss"]>;
+type UploadMode = z.infer<typeof UploadModeSchema>;
 /**
  * Upload file request
+ * Note: uploadMode defaults to 'auto' in the implementation, not in the schema
  */
 declare const UploadRequestSchema: z.ZodObject<{
     sourcePath: z.ZodString;
     targetPath: z.ZodString;
+    uploadMode: z.ZodOptional<z.ZodEnum<["auto", "direct", "oss"]>>;
 }, "strip", z.ZodTypeAny, {
     sourcePath: string;
     targetPath: string;
+    uploadMode?: "auto" | "direct" | "oss" | undefined;
 }, {
     sourcePath: string;
     targetPath: string;
+    uploadMode?: "auto" | "direct" | "oss" | undefined;
 }>;
 type UploadRequest = z.infer<typeof UploadRequestSchema>;
 /**
@@ -475,6 +487,41 @@ declare const OssSetupResponseSchema: z.ZodObject<{
     success?: boolean | undefined;
 }>;
 type OssSetupResponse = z.infer<typeof OssSetupResponseSchema>;
+/**
+ * Download file response
+ */
+declare const DownloadFileResponseSchema: z.ZodObject<{
+    success: z.ZodDefault<z.ZodBoolean>;
+    message: z.ZodDefault<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    message: string;
+    success: boolean;
+}, {
+    message?: string | undefined;
+    success?: boolean | undefined;
+}>;
+type DownloadFileResponse = z.infer<typeof DownloadFileResponseSchema>;
+/**
+ * OSS STS credentials from sandbox /get_token API
+ * API returns snake_case, which gets converted to camelCase by HttpUtils
+ */
+declare const OssCredentialsSchema: z.ZodObject<{
+    accessKeyId: z.ZodString;
+    accessKeySecret: z.ZodString;
+    securityToken: z.ZodString;
+    expiration: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    accessKeyId: string;
+    accessKeySecret: string;
+    securityToken: string;
+    expiration: string;
+}, {
+    accessKeyId: string;
+    accessKeySecret: string;
+    securityToken: string;
+    expiration: string;
+}>;
+type OssCredentials = z.infer<typeof OssCredentialsSchema>;
 
 /**
  * Common constants
@@ -1196,6 +1243,8 @@ declare class Sandbox extends AbstractSandbox {
     private hostName;
     private hostIp;
     private cluster;
+    private ossBucket;
+    private ossTokenExpireTime;
     private deploy;
     private fs;
     private network;
@@ -1238,7 +1287,27 @@ declare class Sandbox extends AbstractSandbox {
     writeFile(request: WriteFileRequest): Promise<WriteFileResponse>;
     readFile(request: ReadFileRequest): Promise<ReadFileResponse>;
     upload(request: UploadRequest): Promise<UploadResponse>;
-    uploadByPath(sourcePath: string, targetPath: string): Promise<UploadResponse>;
+    uploadByPath(sourcePath: string, targetPath: string, uploadMode?: UploadMode): Promise<UploadResponse>;
+    /**
+     * Get OSS STS credentials from sandbox
+     */
+    getOssStsCredentials(): Promise<OssCredentials>;
+    /**
+     * Check if OSS token is expired (with 5-minute buffer)
+     */
+    isTokenExpired(): boolean;
+    /**
+     * Download file from sandbox via OSS
+     */
+    downloadFile(remotePath: string, localPath: string): Promise<DownloadFileResponse>;
+    /**
+     * Upload file via OSS (internal method)
+     */
+    private uploadViaOss;
+    /**
+     * Setup OSS bucket with STS credentials
+     */
+    private setupOss;
     close(): Promise<void>;
     toString(): string;
 }
@@ -2356,4 +2425,4 @@ declare class DefaultAgent extends Agent {
  */
 declare const VERSION: string;
 
-export { Agent, type AgentBashCommand, AgentBashCommandSchema, type AgentConfig, AgentConfigSchema, BadRequestRockError, type BaseConfig, type BashAction, BashActionSchema, type ChmodRequest, ChmodRequestSchema, type ChmodResponse, ChmodResponseSchema, type ChownRequest, ChownRequestSchema, type ChownResponse, ChownResponseSchema, type CloseResponse, CloseResponseSchema, type CloseSessionRequest, CloseSessionRequestSchema, type CloseSessionResponse, CloseSessionResponseSchema, Codes, type Command, type CommandResponse, CommandResponseSchema, CommandRockError, CommandSchema, type CreateBashSessionRequest, CreateBashSessionRequestSchema, type CreateSessionResponse, CreateSessionResponseSchema, DefaultAgent, type DefaultAgentConfig, DefaultAgentConfigSchema, Deploy, EnvHubClient, type EnvHubClientConfig, EnvHubClientConfigSchema, EnvHubError, type ExecuteBashSessionResponse, ExecuteBashSessionResponseSchema, HttpUtils, InternalServerRockError, InvalidParameterRockException, type IsAliveResponse, IsAliveResponseSchema, LinuxFileSystem, LinuxRemoteUser, ModelClient, type ModelClientConfig, ModelService, type ModelServiceConfig, ModelServiceConfigSchema, NODE_DEFAULT_VERSION, Network, NodeRuntimeEnv, type NodeRuntimeEnvConfig, NodeRuntimeEnvConfigSchema, type Observation, ObservationSchema, type OssSetupResponse, OssSetupResponseSchema, PID_PREFIX, PID_SUFFIX, type PollOptions, Process, PythonRuntimeEnv, type PythonRuntimeEnvConfig, PythonRuntimeEnvConfigSchema, type ReadFileRequest, ReadFileRequestSchema, type ReadFileResponse, ReadFileResponseSchema, ReasonPhrases, type ResetResult, type RockAgentConfig, RockAgentConfigSchema, RockEnv, type RockEnvConfig, type RockEnvInfo, RockEnvInfoSchema, RockException, RunMode, type RunModeType, RuntimeEnv, type RuntimeEnvConfig, RuntimeEnvConfigSchema, type RuntimeEnvId, Sandbox, type SandboxConfig, SandboxConfigSchema, SandboxGroup, type SandboxGroupConfig, SandboxGroupConfigSchema, type SandboxLike, type SandboxResponse, SandboxResponseSchema, type RunModeType as SandboxRunModeType, type SandboxStatusResponse, SandboxStatusResponseSchema, SpeedupType, type StepResult, type UploadRequest, UploadRequestSchema, type UploadResponse, UploadResponseSchema, VERSION, type WriteFileRequest, WriteFileRequestSchema, type WriteFileResponse, WriteFileResponseSchema, arunWithRetry, createRockEnvInfo, createRuntimeEnvId, createSandboxConfig, createSandboxGroupConfig, deprecated, deprecatedClass, extractNohupPid as extractNohupPidFromSandbox, fromRockException, getDefaultPipIndexUrl, getEnv, getReasonPhrase, getRequiredEnv, isClientError, isCommandError, isEnvSet, isError, isNode, isServerError, isSuccess, make, raiseForCode, retryAsync, sleep, withRetry, withTimeLogging };
+export { Agent, type AgentBashCommand, AgentBashCommandSchema, type AgentConfig, AgentConfigSchema, BadRequestRockError, type BaseConfig, type BashAction, BashActionSchema, type ChmodRequest, ChmodRequestSchema, type ChmodResponse, ChmodResponseSchema, type ChownRequest, ChownRequestSchema, type ChownResponse, ChownResponseSchema, type CloseResponse, CloseResponseSchema, type CloseSessionRequest, CloseSessionRequestSchema, type CloseSessionResponse, CloseSessionResponseSchema, Codes, type Command, type CommandResponse, CommandResponseSchema, CommandRockError, CommandSchema, type CreateBashSessionRequest, CreateBashSessionRequestSchema, type CreateSessionResponse, CreateSessionResponseSchema, DefaultAgent, type DefaultAgentConfig, DefaultAgentConfigSchema, Deploy, type DownloadFileResponse, DownloadFileResponseSchema, EnvHubClient, type EnvHubClientConfig, EnvHubClientConfigSchema, EnvHubError, type ExecuteBashSessionResponse, ExecuteBashSessionResponseSchema, HttpUtils, InternalServerRockError, InvalidParameterRockException, type IsAliveResponse, IsAliveResponseSchema, LinuxFileSystem, LinuxRemoteUser, ModelClient, type ModelClientConfig, ModelService, type ModelServiceConfig, ModelServiceConfigSchema, NODE_DEFAULT_VERSION, Network, NodeRuntimeEnv, type NodeRuntimeEnvConfig, NodeRuntimeEnvConfigSchema, type Observation, ObservationSchema, type OssCredentials, OssCredentialsSchema, type OssSetupResponse, OssSetupResponseSchema, PID_PREFIX, PID_SUFFIX, type PollOptions, Process, PythonRuntimeEnv, type PythonRuntimeEnvConfig, PythonRuntimeEnvConfigSchema, type ReadFileRequest, ReadFileRequestSchema, type ReadFileResponse, ReadFileResponseSchema, ReasonPhrases, type ResetResult, type RockAgentConfig, RockAgentConfigSchema, RockEnv, type RockEnvConfig, type RockEnvInfo, RockEnvInfoSchema, RockException, RunMode, type RunModeType, RuntimeEnv, type RuntimeEnvConfig, RuntimeEnvConfigSchema, type RuntimeEnvId, Sandbox, type SandboxConfig, SandboxConfigSchema, SandboxGroup, type SandboxGroupConfig, SandboxGroupConfigSchema, type SandboxLike, type SandboxResponse, SandboxResponseSchema, type RunModeType as SandboxRunModeType, type SandboxStatusResponse, SandboxStatusResponseSchema, SpeedupType, type StepResult, type UploadMode, UploadModeSchema, type UploadRequest, UploadRequestSchema, type UploadResponse, UploadResponseSchema, VERSION, type WriteFileRequest, WriteFileRequestSchema, type WriteFileResponse, WriteFileResponseSchema, arunWithRetry, createRockEnvInfo, createRuntimeEnvId, createSandboxConfig, createSandboxGroupConfig, deprecated, deprecatedClass, extractNohupPid as extractNohupPidFromSandbox, fromRockException, getDefaultPipIndexUrl, getEnv, getReasonPhrase, getRequiredEnv, isClientError, isCommandError, isEnvSet, isError, isNode, isServerError, isSuccess, make, raiseForCode, retryAsync, sleep, withRetry, withTimeLogging };

package/dist/index.js

@@ -79,9 +79,11 @@ var ReadFileRequestSchema = zod.z.object({
   encoding: zod.z.string().optional(),
   errors: zod.z.string().optional()
 });
+var UploadModeSchema = zod.z.enum(["auto", "direct", "oss"]);
 var UploadRequestSchema = zod.z.object({
   sourcePath: zod.z.string(),
-  targetPath: zod.z.string()
+  targetPath: zod.z.string(),
+  uploadMode: UploadModeSchema.optional()
 });
 var CloseSessionRequestSchema = zod.z.object({
   session: zod.z.string().default("default")
@@ -173,6 +175,16 @@ var OssSetupResponseSchema = zod.z.object({
   success: zod.z.boolean().default(false),
   message: zod.z.string().default("")
 });
+var DownloadFileResponseSchema = zod.z.object({
+  success: zod.z.boolean().default(false),
+  message: zod.z.string().default("")
+});
+var OssCredentialsSchema = zod.z.object({
+  accessKeyId: zod.z.string(),
+  accessKeySecret: zod.z.string(),
+  securityToken: zod.z.string(),
+  expiration: zod.z.string()
+});
 
 // src/common/constants.ts
 var RunMode = {
@@ -1436,6 +1448,53 @@ var LinuxFileSystem = class extends FileSystem {
   }
 };
 
+// src/sandbox/constants.ts
+var ENSURE_OSSUTIL_SCRIPT = `#!/bin/bash
+set -e
+
+# Check downloader
+if command -v wget >/dev/null 2>&1; then
+    DOWNLOADER="wget"
+elif command -v curl >/dev/null 2>&1; then
+    DOWNLOADER="curl"
+else
+    echo "ERROR: neither wget nor curl is available. Please install one first." >&2
+    exit 1
+fi
+
+# Check unzip
+if ! command -v unzip >/dev/null 2>&1; then
+    echo "ERROR: unzip is not available. Please install unzip first." >&2
+    exit 1
+fi
+
+# Skip if already installed
+if command -v ossutil >/dev/null 2>&1; then
+    echo "ossutil already installed, skipping."
+    exit 0
+fi
+
+# Download
+cd /tmp
+if [ "$DOWNLOADER" = "wget" ]; then
+    wget -q https://gosspublic.alicdn.com/ossutil/v2/2.2.1/ossutil-2.2.1-linux-amd64.zip -O /tmp/ossutil.zip
+else
+    curl -sL -o /tmp/ossutil.zip https://gosspublic.alicdn.com/ossutil/v2/2.2.1/ossutil-2.2.1-linux-amd64.zip
+fi
+
+# Extract and install
+unzip -o -q ossutil.zip
+chmod 755 /tmp/ossutil-2.2.1-linux-amd64/ossutil
+mkdir -p /usr/local/bin
+mv /tmp/ossutil-2.2.1-linux-amd64/ossutil /usr/local/bin/
+
+# Cleanup
+rm -rf /tmp/ossutil.zip /tmp/ossutil-2.2.1-linux-amd64
+
+# Verify
+ossutil version
+`;
+
 // src/sandbox/network.ts
 var logger4 = initLogger("rock.sandbox.network");
 var SpeedupType = /* @__PURE__ */ ((SpeedupType2) => {
@@ -1839,6 +1898,10 @@ var Sandbox = class extends AbstractSandbox {
   hostName = null;
   hostIp = null;
   cluster;
+  // OSS-related properties
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  ossBucket = null;
+  ossTokenExpireTime = "";
   // Sub-components
   deploy;
   fs;
@@ -2226,7 +2289,7 @@ var Sandbox = class extends AbstractSandbox {
   async upload(request) {
     return this.uploadByPath(request.sourcePath, request.targetPath);
   }
-  async uploadByPath(sourcePath, targetPath) {
+  async uploadByPath(sourcePath, targetPath, uploadMode = "auto") {
     const url = `${this.url}/upload`;
     const headers = this.buildHeaders();
     try {
@@ -2236,6 +2299,13 @@ var Sandbox = class extends AbstractSandbox {
       } catch {
         return { success: false, message: `File not found: ${sourcePath}` };
       }
+      const stats = await fs.stat(sourcePath);
+      const fileSize = stats.size;
+      const ossEnabled = envVars.ROCK_OSS_ENABLE;
+      const ossThreshold = 1024 * 1024;
+      if (uploadMode === "oss" || uploadMode === "auto" && ossEnabled && fileSize > ossThreshold) {
+        return this.uploadViaOss(sourcePath, targetPath);
+      }
       const fileBuffer = await fs.readFile(sourcePath);
       const fileName = sourcePath.split("/").pop() ?? "file";
       const response = await HttpUtils.postMultipart(
@@ -2252,6 +2322,136 @@ var Sandbox = class extends AbstractSandbox {
       return { success: false, message: `Upload failed: ${e}` };
     }
   }
+  /**
+   * Get OSS STS credentials from sandbox
+   */
+  async getOssStsCredentials() {
+    const url = `${this.url}/get_token`;
+    const headers = this.buildHeaders();
+    const response = await HttpUtils.get(url, headers);
+    if (response.status !== "Success") {
+      throw new Error(`Failed to get OSS STS token: ${JSON.stringify(response)}`);
+    }
+    const credentials = OssCredentialsSchema.parse(response.result);
+    this.ossTokenExpireTime = credentials.expiration;
+    return credentials;
+  }
+  /**
+   * Check if OSS token is expired (with 5-minute buffer)
+   */
+  isTokenExpired() {
+    if (!this.ossTokenExpireTime) {
+      return true;
+    }
+    try {
+      const expireTime = new Date(this.ossTokenExpireTime);
+      const currentTime = /* @__PURE__ */ new Date();
+      const bufferMs = 5 * 60 * 1e3;
+      return currentTime.getTime() >= expireTime.getTime() - bufferMs;
+    } catch {
+      return true;
+    }
+  }
+  /**
+   * Download file from sandbox via OSS
+   */
+  async downloadFile(remotePath, localPath) {
+    if (!envVars.ROCK_OSS_ENABLE) {
+      return {
+        success: false,
+        message: "OSS download is not enabled. Please set ROCK_OSS_ENABLE=true"
+      };
+    }
+    try {
+      if (!remotePath || remotePath.trim() === "") {
+        return { success: false, message: "Remote path is required" };
+      }
+      const checkResult = await this.execute({ command: ["test", "-f", remotePath], timeout: 60 });
+      if (checkResult.exitCode !== 0) {
+        return { success: false, message: `Remote file does not exist: ${remotePath}` };
+      }
+      if (this.ossBucket === null || this.isTokenExpired()) {
+        await this.setupOss();
+      }
+      if (!this.ossBucket) {
+        return { success: false, message: "Failed to setup OSS bucket" };
+      }
+      await this.arun(ENSURE_OSSUTIL_SCRIPT, { mode: "nohup", waitTimeout: 300 });
+      const timestamp = Date.now();
+      const fileName = remotePath.split("/").pop() ?? "file";
+      const objectName = `download-${timestamp}-${fileName}`;
+      const credentials = await this.getOssStsCredentials();
+      const bucketName = envVars.ROCK_OSS_BUCKET_NAME ?? "";
+      const region = envVars.ROCK_OSS_BUCKET_REGION ?? "";
+      const endpoint = `https://oss-${region}.aliyuncs.com`;
+      const ossutilConfigCmd = `ossutil config -e ${endpoint} -i ${credentials.accessKeyId} -k ${credentials.accessKeySecret} -t ${credentials.securityToken} -b ${bucketName}`;
+      await this.arun(ossutilConfigCmd, { mode: "nohup", waitTimeout: 60 });
+      const uploadToOssCmd = `ossutil cp ${remotePath} oss://${bucketName}/${objectName}`;
+      const uploadResult = await this.arun(uploadToOssCmd, { mode: "nohup", waitTimeout: 600 });
+      if (uploadResult.exitCode !== 0) {
+        return { success: false, message: `Sandbox to OSS upload failed: ${uploadResult.output}` };
+      }
+      const result = await this.ossBucket.get(objectName, localPath);
+      try {
+        await this.ossBucket.delete(objectName);
+      } catch {
+      }
+      return { success: true, message: `Successfully downloaded ${remotePath} to ${localPath}` };
+    } catch (e) {
+      return { success: false, message: `Download failed: ${e}` };
+    }
+  }
+  /**
+   * Upload file via OSS (internal method)
+   */
+  async uploadViaOss(sourcePath, targetPath) {
+    try {
+      if (this.ossBucket === null || this.isTokenExpired()) {
+        await this.setupOss();
+      }
+      if (!this.ossBucket) {
+        return { success: false, message: "Failed to setup OSS bucket" };
+      }
+      const timestamp = Date.now();
+      const fileName = sourcePath.split("/").pop() ?? "file";
+      const objectName = `${timestamp}-${fileName}`;
+      await this.ossBucket.put(objectName, sourcePath);
+      const signedUrl = this.ossBucket.signatureUrl(objectName, 600);
+      const downloadCmd = `wget -c -O '${targetPath}' '${signedUrl}'`;
+      await this.arun(downloadCmd, { mode: "nohup", waitTimeout: 600 });
+      const checkResult = await this.execute({ command: ["test", "-f", targetPath], timeout: 60 });
+      if (checkResult.exitCode !== 0) {
+        return { success: false, message: "Sandbox download phase failed" };
+      }
+      return { success: true, message: `Successfully uploaded file ${fileName} to ${targetPath} via OSS` };
+    } catch (e) {
+      return { success: false, message: `OSS upload failed: ${e}` };
+    }
+  }
+  /**
+   * Setup OSS bucket with STS credentials
+   */
+  async setupOss() {
+    const credentials = await this.getOssStsCredentials();
+    const OSS = (await import('ali-oss')).default;
+    this.ossBucket = new OSS({
+      region: envVars.ROCK_OSS_BUCKET_REGION ?? "",
+      accessKeyId: credentials.accessKeyId,
+      accessKeySecret: credentials.accessKeySecret,
+      stsToken: credentials.securityToken,
+      bucket: envVars.ROCK_OSS_BUCKET_NAME ?? "",
+      refreshSTSToken: async () => {
+        const newCreds = await this.getOssStsCredentials();
+        return {
+          accessKeyId: newCreds.accessKeyId,
+          accessKeySecret: newCreds.accessKeySecret,
+          stsToken: newCreds.securityToken
+        };
+      },
+      refreshSTSTokenInterval: 3e5
+      // 5 minutes
+    });
+  }
   // Close
   async close() {
     await this.stop();
@@ -3216,6 +3416,7 @@ exports.CreateSessionResponseSchema = CreateSessionResponseSchema;
 exports.DefaultAgent = DefaultAgent;
 exports.DefaultAgentConfigSchema = DefaultAgentConfigSchema;
 exports.Deploy = Deploy;
+exports.DownloadFileResponseSchema = DownloadFileResponseSchema;
 exports.EnvHubClient = EnvHubClient;
 exports.EnvHubClientConfigSchema = EnvHubClientConfigSchema;
 exports.EnvHubError = EnvHubError;
@@ -3234,6 +3435,7 @@ exports.Network = Network;
 exports.NodeRuntimeEnv = NodeRuntimeEnv;
 exports.NodeRuntimeEnvConfigSchema = NodeRuntimeEnvConfigSchema;
 exports.ObservationSchema = ObservationSchema;
+exports.OssCredentialsSchema = OssCredentialsSchema;
 exports.OssSetupResponseSchema = OssSetupResponseSchema;
 exports.PID_PREFIX = PID_PREFIX;
 exports.PID_SUFFIX = PID_SUFFIX;
@@ -3257,6 +3459,7 @@ exports.SandboxGroupConfigSchema = SandboxGroupConfigSchema;
 exports.SandboxResponseSchema = SandboxResponseSchema;
 exports.SandboxStatusResponseSchema = SandboxStatusResponseSchema;
 exports.SpeedupType = SpeedupType;
+exports.UploadModeSchema = UploadModeSchema;
 exports.UploadRequestSchema = UploadRequestSchema;
 exports.UploadResponseSchema = UploadResponseSchema;
 exports.VERSION = VERSION;