threadwire 0.1.10 → 0.1.12

package/src/kimi-model-broker.js

@@ -21,12 +21,20 @@ const UPSTREAM_URL = "https://api.kimi.com/coding/v1/chat/completions"
 /** @typedef {ReturnType<typeof createKimiGrantStore>} KimiGrantStore */
 /** @typedef {Awaited<ReturnType<typeof openKimiOAuthStore>>} KimiOAuthStore */
 
-/** @param {{environment?: NodeJS.ProcessEnv, fetchImplementation?: typeof fetch, oauthFetchImplementation?: typeof fetch}} [options] */
+/** @param {{environment?: NodeJS.ProcessEnv, fetchImplementation?: typeof fetch, oauthFetchImplementation?: typeof fetch, onWorkerRequestAuthorized?: (token: string) => void}} [options] */
 export async function startKimiModelBroker(options = {}) {
   const environment = options.environment ?? process.env
   const host = safeHost(environment.THREADWIRE_KIMI_MODEL_BROKER_HOST ?? "0.0.0.0")
   const port = portValue(environment.THREADWIRE_KIMI_MODEL_BROKER_PORT, 8791)
+  const workerHost = safeHost(environment.THREADWIRE_KIMI_MODEL_BROKER_WORKER_HOST ?? "0.0.0.0")
+  const workerPort = portValue(environment.THREADWIRE_KIMI_MODEL_BROKER_WORKER_PORT, 8792)
   const adminToken = authoritySetting(environment.THREADWIRE_KIMI_MODEL_BROKER_ADMIN_TOKEN, "THREADWIRE_KIMI_MODEL_BROKER_ADMIN_TOKEN")
+  // The published worker bind is an explicit deployment decision: Compose
+  // renders a non-task-reachable loopback sentinel only so an inactive Kimi
+  // profile loads, and passes the raw setting through. Startup requires a
+  // nonempty supported bind before either listener opens, so a missing or
+  // invalid bind exits instead of publishing on every interface.
+  const workerBind = bindSetting(environment.THREADWIRE_KIMI_MODEL_BROKER_WORKER_BIND, "THREADWIRE_KIMI_MODEL_BROKER_WORKER_BIND")
   const approvedModels = parseApprovedKimiModels(environment.THREADWIRE_ALLOWED_KIMI_MODELS)
   const oauth = await openKimiOAuthStore({
     file: safeSetting(environment.THREADWIRE_KIMI_OAUTH_FILE, "THREADWIRE_KIMI_OAUTH_FILE"),
@@ -34,27 +42,48 @@ export async function startKimiModelBroker(options = {}) {
   })
   const fetchImplementation = options.fetchImplementation ?? fetch
   const grants = createKimiGrantStore()
-  /** @type {Map<string, import("node:http").Server>} */
-  const listeners = new Map()
-  /** @type {Map<string, {controller: AbortController, timer: NodeJS.Timeout, sockets: Set<import("node:net").Socket>}>} */
+  /** @type {Map<string, {controller: AbortController, timer: NodeJS.Timeout, grant: KimiGrant}>} */
   const runtimes = new Map()
   /** @type {Set<import("node:net").Socket>} */
   const controlSockets = new Set()
+  /** @type {Set<import("node:net").Socket>} */
+  const workerSockets = new Set()
   let stopping = false
 
   /** @param {string} token */
-  const revokeGrant = async (token) => {
+  const revokeGrant = (token) => {
     grants.revoke(token)
     const runtime = runtimes.get(token)
     runtimes.delete(token)
-    if (runtime !== undefined) {
-      clearTimeout(runtime.timer)
-      runtime.controller.abort(new Error("Kimi broker grant revoked"))
-      for (const socket of runtime.sockets) socket.destroy()
-      runtime.sockets.clear()
-    }
-    await closeListener(listeners, token)
+    if (runtime === undefined) return
+    clearTimeout(runtime.timer)
+    runtime.controller.abort(new Error("Kimi broker grant revoked"))
   }
+  /** @param {string} token @param {number} expiresAt */
+  const scheduleExpiry = (token, expiresAt) => {
+    const timer = setTimeout(() => revokeGrant(token), Math.max(1, expiresAt - Date.now()))
+    timer.unref()
+    return timer
+  }
+
+  const workerServer = createServer((request, response) => {
+    /** @type {{grants: KimiGrantStore, runtimes: Map<string, {controller: AbortController, timer: NodeJS.Timeout, grant: KimiGrant}>, oauth: KimiOAuthStore, fetchImplementation: typeof fetch, onWorkerRequestAuthorized?: (token: string) => void}} */
+    const dependencies = {grants, runtimes, oauth, fetchImplementation}
+    if (options.onWorkerRequestAuthorized !== undefined) dependencies.onWorkerRequestAuthorized = options.onWorkerRequestAuthorized
+    proxyWorkerRequest(request, response, dependencies).catch((error) => {
+      if (error instanceof Error && /^Kimi broker request denied (?:header: [a-z0-9-]+|body keys: (?:unsafe|[a-z0-9_,]+))$/u.test(error.message)) {
+        process.stderr.write(`threadwire-kimi-broker: ${error.message}\n`)
+      }
+      if (response.destroyed) return
+      const status = clientError(error) ? 403 : 502
+      sendJson(response, status, {error: status === 403 ? "request denied" : "Kimi model broker unavailable"})
+    })
+  })
+  workerServer.on("connection", (socket) => {
+    if (stopping) return socket.destroy()
+    workerSockets.add(socket)
+    socket.once("close", () => workerSockets.delete(socket))
+  })
 
   const server = createServer(async (request, response) => {
     try {
@@ -70,37 +99,23 @@ export async function startKimiModelBroker(options = {}) {
       if (request.method === "POST" && request.url === "/admin/grants") {
         const health = await oauth.health()
         if (!health.ready) throw new Error("Kimi OAuth login required")
-        const body = await readJson(request)
-        const selection = parseGrant(body, approvedModels)
-        const token = grants.issue(selection.grant)
+        const grant = parseGrant(await readJson(request), approvedModels)
+        const token = grants.issue(grant)
         const controller = new AbortController()
-        /** @type {Set<import("node:net").Socket>} */
-        const sockets = new Set()
-        const listener = createServer((workerRequest, workerResponse) => {
-          proxyWorkerRequest(workerRequest, workerResponse, {
-            token, grant: selection.grant, grants, oauth, fetchImplementation, signal: controller.signal
-          }).catch((error) => {
-            if (workerResponse.destroyed) return
-            const status = clientError(error) ? 403 : 502
-            sendJson(workerResponse, status, {error: status === 403 ? "request denied" : "Kimi model broker unavailable"})
-          })
-        })
-        listener.on("connection", (socket) => {
-          if (controller.signal.aborted) return socket.destroy()
-          sockets.add(socket)
-          socket.once("close", () => sockets.delete(socket))
-        })
-        try { await listen(listener, 0, selection.brokerAddress) } catch (error) {
-          grants.revoke(token)
-          throw error
-        }
-        listeners.set(token, listener)
-        const timer = setTimeout(() => { void revokeGrant(token) }, selection.grant.ttlMs)
-        timer.unref()
-        runtimes.set(token, {controller, timer, sockets})
-        const address = listener.address()
-        if (address === null || typeof address === "string") throw new Error("Kimi broker listener unavailable")
-        sendJson(response, 201, {token, port: address.port})
+        runtimes.set(token, {controller, timer: scheduleExpiry(token, Date.now() + grant.ttlMs), grant})
+        sendJson(response, 201, {token})
+        return
+      }
+      if (request.method === "POST" && request.url?.startsWith("/admin/grants/") && request.url.endsWith("/renew")) {
+        const token = decodeURIComponent(request.url.slice("/admin/grants/".length, -"/renew".length))
+        const body = await readJson(request)
+        if (!record(body) || typeof body.ttlMs !== "number") throw new Error("Invalid Kimi broker grant")
+        const renewed = grants.renew(token, body.ttlMs)
+        const runtime = runtimes.get(token)
+        if (runtime === undefined) throw new Error("Kimi broker grant unknown token")
+        clearTimeout(runtime.timer)
+        runtime.timer = scheduleExpiry(token, renewed.expiresAt)
+        sendJson(response, 200, {ok: true})
         return
       }
       if (request.method === "POST" && request.url?.startsWith("/admin/grants/") && request.url.endsWith("/activate")) {
@@ -111,7 +126,7 @@ export async function startKimiModelBroker(options = {}) {
       }
       if (request.method === "DELETE" && request.url?.startsWith("/admin/grants/")) {
         const token = decodeURIComponent(request.url.slice("/admin/grants/".length))
-        await revokeGrant(token)
+        revokeGrant(token)
         response.writeHead(204)
         response.end()
         return
@@ -123,65 +138,91 @@ export async function startKimiModelBroker(options = {}) {
     }
   })
   server.on("connection", (socket) => {
+    if (stopping) return socket.destroy()
     controlSockets.add(socket)
     socket.once("close", () => controlSockets.delete(socket))
   })
-  await listen(server, port, host)
+  await listen(workerServer, workerPort, workerHost)
+  try { await listen(server, port, host) } catch (error) {
+    await boundedClose(workerServer)
+    throw error
+  }
   return {
     server,
-    activeListeners: () => listeners.size,
+    workerServer,
+    activeListeners: () => runtimes.size,
     close: async () => {
       if (stopping) return
       stopping = true
+      for (const token of [...runtimes.keys()]) revokeGrant(token)
       for (const socket of controlSockets) socket.destroy()
-      await Promise.all([...listeners.keys()].map(revokeGrant))
-      await boundedClose(server)
+      for (const socket of workerSockets) socket.destroy()
+      await Promise.all([boundedClose(server), boundedClose(workerServer)])
     },
-    config: {host, port, models: [...approvedModels.keys()]}
+    config: {host, port, workerHost, workerPort, workerBind, models: [...approvedModels.keys()]}
   }
 }
 
 /**
  * @param {import("node:http").IncomingMessage} request
  * @param {import("node:http").ServerResponse} response
- * @param {{token: string, grant: KimiGrant, grants: KimiGrantStore, oauth: KimiOAuthStore, fetchImplementation: typeof fetch, signal: AbortSignal}} options
+ * @param {{grants: KimiGrantStore, runtimes: Map<string, {controller: AbortController, timer: NodeJS.Timeout, grant: KimiGrant}>, oauth: KimiOAuthStore, fetchImplementation: typeof fetch, onWorkerRequestAuthorized?: (token: string) => void}} options
  */
 async function proxyWorkerRequest(request, response, options) {
-  throwIfAborted(options.signal)
   const policyHeaders = {...request.headers}
   delete policyHeaders.host
   delete policyHeaders.connection
   delete policyHeaders["transfer-encoding"]
   validateKimiBrokerRequest({method: request.method ?? "", path: request.url ?? "", headers: policyHeaders})
   const token = kimiBearerToken(request.headers.authorization)
-  if (token !== options.token) throw new Error("Kimi broker request denied")
+  const runtime = options.runtimes.get(token)
+  if (runtime === undefined) throw new Error("Kimi broker grant unknown token")
+  const signal = runtime.controller.signal
+  throwIfAborted(signal)
   const context = {
-    provider: "kimi", runId: options.grant.runId,
-    networkId: options.grant.networkId, taskId: options.grant.taskId,
-    sessionId: options.grant.sessionId, modelAlias: options.grant.modelAlias
+    provider: "kimi", runId: runtime.grant.runId,
+    networkId: runtime.grant.networkId, taskId: runtime.grant.taskId,
+    sessionId: runtime.grant.sessionId, modelAlias: runtime.grant.modelAlias
   }
   const grant = options.grants.authorize(token, context)
-  const body = await readBody(request, options.signal)
-  options.grants.authorize(token, context)
-  validateKimiChatBody(body, grant.model)
-  const accessToken = await options.oauth.getAccessToken({signal: options.signal})
-  throwIfAborted(options.signal)
-  const upstream = await abortable(options.fetchImplementation(UPSTREAM_URL, {
-    method: "POST",
-    redirect: "error",
-    headers: {
-      authorization: `Bearer ${accessToken}`,
-      "content-type": "application/json",
-      accept: "text/event-stream",
-      "user-agent": "threadwire-kimi-model-broker/1"
-    },
-    body,
-    signal: options.signal
-  }), options.signal)
-  throwIfAborted(options.signal)
-  const contentType = safeContentType(upstream.headers.get("content-type"))
-  response.writeHead(upstream.status, {"content-type": contentType, "cache-control": "no-store"})
-  await streamResponse(upstream, response, options.signal)
+  // Couple this authenticated in-flight request to the grant abort signal:
+  // revocation or expiry destroys this request's own socket, waking a stalled
+  // body read so the upload terminates and releases its request/socket
+  // resources. Only this request's socket is touched; unrelated grants and
+  // broker shutdown semantics are unaffected.
+  const wake = () => request.socket.destroy()
+  signal.addEventListener("abort", wake, {once: true})
+  // Never miss an abort that raced the hook installation.
+  if (signal.aborted) {
+    signal.removeEventListener("abort", wake)
+    wake()
+    throwIfAborted(signal)
+  }
+  // Optional lifecycle seam: fires only after the grant is authorized and the
+  // abort hook is installed, i.e. once authenticated body processing begins.
+  options.onWorkerRequestAuthorized?.(token)
+  try {
+    const body = await readBody(request, signal)
+    options.grants.authorize(token, context)
+    validateKimiChatBody(body, grant.model)
+    const accessToken = await options.oauth.getAccessToken({signal})
+    throwIfAborted(signal)
+    const upstream = await abortable(options.fetchImplementation(UPSTREAM_URL, {
+      method: "POST", redirect: "error",
+      headers: {
+        authorization: `Bearer ${accessToken}`,
+        "content-type": "application/json", accept: "text/event-stream",
+        "user-agent": "threadwire-kimi-model-broker/1"
+      },
+      body, signal
+    }), signal)
+    throwIfAborted(signal)
+    const contentType = safeContentType(upstream.headers.get("content-type"))
+    response.writeHead(upstream.status, {"content-type": contentType, "cache-control": "no-store"})
+    await streamResponse(upstream, response, signal)
+  } finally {
+    signal.removeEventListener("abort", wake)
+  }
 }
 
 /** @param {Response} upstream @param {import("node:http").ServerResponse} response @param {AbortSignal} signal */
@@ -206,24 +247,20 @@ async function streamResponse(upstream, response, signal) {
   } finally { reader.releaseLock() }
 }
 
-/** @param {unknown} value @param {Map<string, ApprovedKimiModel>} approvedModels @returns {{brokerAddress: string, grant: KimiGrant}} */
+/** @param {unknown} value @param {Map<string, ApprovedKimiModel>} approvedModels @returns {KimiGrant} */
 function parseGrant(value, approvedModels) {
-  if (!record(value) || !exactKeys(value, ["brokerAddress", "modelAlias", "networkId", "provider", "runId", "sessionId", "taskId", "ttlMs"])
+  if (!record(value) || !exactKeys(value, ["modelAlias", "networkId", "provider", "runId", "sessionId", "taskId", "ttlMs"])
     || value.provider !== "kimi" || typeof value.runId !== "string" || typeof value.networkId !== "string"
     || typeof value.taskId !== "string" || typeof value.sessionId !== "string"
-    || typeof value.modelAlias !== "string" || typeof value.brokerAddress !== "string" || typeof value.ttlMs !== "number") {
+    || typeof value.modelAlias !== "string" || typeof value.ttlMs !== "number") {
     throw new Error("Invalid Kimi broker grant")
   }
-  if (!/^(?:\d{1,3}\.){3}\d{1,3}$/u.test(value.brokerAddress)) throw new Error("Invalid Kimi broker grant")
   const model = approvedModels.get(value.modelAlias)
   if (model === undefined) throw new Error("Kimi model is not allowed")
   return {
-    brokerAddress: value.brokerAddress,
-    grant: {
-      provider: "kimi", runId: value.runId, networkId: value.networkId,
-      taskId: value.taskId, sessionId: value.sessionId,
-      modelAlias: model.alias, model: model.model, ttlMs: value.ttlMs
-    }
+    provider: "kimi", runId: value.runId, networkId: value.networkId,
+    taskId: value.taskId, sessionId: value.sessionId,
+    modelAlias: model.alias, model: model.model, ttlMs: value.ttlMs
   }
 }
 
@@ -273,6 +310,18 @@ function safeHost(value) {
   if (value !== "0.0.0.0" && value !== "127.0.0.1" && value !== "::") throw new Error("Invalid Kimi model broker host")
   return value
 }
+/** @param {string | undefined} value @param {string} name @returns {string} */
+function bindSetting(value, name) {
+  const bind = safeSetting(value, name).trim()
+  // A host interface only: no port, no whitespace, no wildcard. Loopback is
+  // the load-time sentinel; an explicit task-reachable address is the only
+  // functional choice.
+  if (bind === "0.0.0.0" || bind === "::") throw new Error(`${name} must not be a wildcard bind`)
+  if (bind !== "127.0.0.1" && bind !== "::1" && !/^\d{1,3}(?:\.\d{1,3}){3}$/u.test(bind)) {
+    throw new Error(`${name} must be an explicit interface address`)
+  }
+  return bind
+}
 /** @param {string | undefined} value @param {number} fallback @returns {number} */
 function portValue(value, fallback) {
   if (value === undefined) return fallback
@@ -316,10 +365,3 @@ function boundedClose(server) {
     new Promise((resolve) => { const timer = setTimeout(resolve, 1000); timer.unref() })
   ])
 }
-/** @param {Map<string, import("node:http").Server>} listeners @param {string} token */
-async function closeListener(listeners, token) {
-  const listener = listeners.get(token)
-  listeners.delete(token)
-  if (listener === undefined) return
-  await boundedClose(listener)
-}

package/src/model-broker-policy.js

@@ -36,10 +36,7 @@ export function createGrantStore(options = {}) {
     activate(token) {
       const grant = grants.get(token)
       if (!grant) throw new Error("Broker grant unknown token")
-      if (grant.expiresAt < now()) {
-        grants.delete(token)
-        throw new Error("Broker grant expired")
-      }
+      if (grant.expiresAt < now()) throw new Error("Broker grant expired")
       if (grant.active) throw new Error("Broker grant already active")
       grant.active = true
       return {...grant}
@@ -50,10 +47,16 @@ export function createGrantStore(options = {}) {
       if (!grant) throw new Error("Broker grant unknown token")
       if (grant.provider !== context.provider || grant.networkId !== context.networkId || (context.runId !== undefined && grant.runId !== context.runId)) throw new Error("Broker grant lineage denied")
       if (!grant.active) throw new Error("Broker grant pending")
-      if (grant.expiresAt < now()) {
-        grants.delete(token)
-        throw new Error("Broker grant expired")
-      }
+      if (grant.expiresAt < now()) throw new Error("Broker grant expired")
+      return {...grant}
+    },
+    /** @param {string} token @param {number} ttlMs */
+    renew(token, ttlMs) {
+      if (!Number.isSafeInteger(ttlMs) || ttlMs < 1 || ttlMs > 3_600_000) throw new Error("Invalid broker grant")
+      const grant = grants.get(token)
+      if (!grant) throw new Error("Broker grant unknown token")
+      if (grant.expiresAt < now()) throw new Error("Broker grant expired")
+      grant.expiresAt = now() + ttlMs
       return {...grant}
     },
     /** @param {string} token */

package/src/model-broker.js

@@ -93,6 +93,20 @@ export async function startModelBroker(options = {}) {
         sendJson(response, 201, {token, generation, port: address.port})
         return
       }
+      if (request.url?.startsWith("/admin/grants/") && request.url.endsWith("/renew") && request.method === "POST") {
+        requireAdmin(request.headers.authorization, adminToken)
+        const token = decodeURIComponent(request.url.slice("/admin/grants/".length, -"/renew".length))
+        const body = await readJson(request, shutdown.signal)
+        if (!isRecord(body)) throw new Error("Invalid broker grant")
+        const renewed = grants.renew(token, body.ttlMs)
+        const runtime = grantRuntimes.get(token)
+        if (runtime === undefined) throw new Error("Broker grant unknown token")
+        clearTimeout(runtime.timer)
+        runtime.timer = setTimeout(() => { void revokeGrant(token) }, Math.max(1, renewed.expiresAt - Date.now()))
+        runtime.timer.unref()
+        sendJson(response, 200, {ok: true})
+        return
+      }
       if (request.url?.startsWith("/admin/grants/") && request.method === "DELETE") {
         requireAdmin(request.headers.authorization, adminToken)
         const token = decodeURIComponent(request.url.slice("/admin/grants/".length))

package/src/path-safety.js

@@ -0,0 +1,8 @@
+// @ts-check
+
+import {isAbsolute} from "node:path"
+
+/** @param {string} path */
+export function escapesDirectory(path) {
+  return path === ".." || path.startsWith("../") || isAbsolute(path)
+}

package/src/providers/kimi.js

@@ -105,7 +105,7 @@ function recognizeKimiRecord(record, state) {
         const parsed = parseToolCall(toolCall)
         if (parsed === undefined) return emptyRecognition()
         state?.tools.set(parsed.id, parsed.name)
-        events.push({type: "tool", phase: "started", name: parsed.name, key: `tool:${parsed.id}`})
+        events.push({type: "tool", phase: "started", name: parsed.name, key: `tool:${parsed.id}`, ...(parsed.detail === undefined ? {} : {detail: parsed.detail})})
       }
     }
     if (events.length === 0) return emptyRecognition()
@@ -132,14 +132,26 @@ function recognizeKimiRecord(record, state) {
   return emptyRecognition()
 }
 
-/** @param {unknown} value @returns {{id: string, name: string} | undefined} */
+/** @param {unknown} value @returns {{id: string, name: string, detail?: string} | undefined} */
 function parseToolCall(value) {
   if (!isRecord(value) || !exactKeys(value, ["type", "id", "function"])
     || value.type !== "function" || typeof value.id !== "string" || !TOOL_ID_PATTERN.test(value.id)
     || !isRecord(value.function) || !exactKeys(value.function, ["name", "arguments"])
     || typeof value.function.name !== "string" || !TOOL_NAME_PATTERN.test(value.function.name)
     || typeof value.function.arguments !== "string") return undefined
-  return {id: value.id, name: value.function.name}
+  return {id: value.id, name: value.function.name, ...toolDetail(value.function.arguments)}
+}
+
+/** @param {string} serialized @returns {{detail?: string}} */
+function toolDetail(serialized) {
+  let arguments_
+  try { arguments_ = JSON.parse(serialized) } catch { return {} }
+  if (!isRecord(arguments_)) return {}
+  for (const key of ["command", "file_path", "path", "pattern", "query", "description"]) {
+    const value = arguments_[key]
+    if (typeof value === "string" && value.length > 0) return {detail: Array.from(value).slice(0, 512).join("")}
+  }
+  return {}
 }
 
 /** @param {WorkerEvent[]} events @param {KimiRecordState | undefined} state @returns {WorkerEvent[]} */

package/src/telegram-ingress/core.js

@@ -27,6 +27,7 @@ import {parseCodeCommand, parseEvidenceCommand} from "./command.js"
  *   Relay?: typeof Relay,
  *   processNumber?: number,
  *   providerEnvironment?: NodeJS.ProcessEnv,
+ *   kimiBinding?: unknown,
  *   workspaceProfileOperations?: import("../workspace-profile.js").WorkspaceProfileOperations,
  *   activity?: Pick<import("../activity-log.js").ActivityLog, "recordWorkspace" | "recordStarted" | "recordSession" | "close">,
  *   evidenceStore?: import("../evidence-store.js").EvidenceStore,
@@ -113,8 +114,9 @@ export async function dispatchWorker(job, config, dependencies = {}) {
   const processNumber = dependencies.processNumber ?? process.pid
   // Explicit only: never fall back to ambient process.env (avoids secret leakage).
   const providerEnvironment = buildProviderEnvironment(dependencies.providerEnvironment ?? {})
+  const kimiBinding = job.provider === "kimi" ? dependencies.kimiBinding : undefined
   const workspace = await resolveWorkspaceProfile(
-    {provider: job.provider},
+    {provider: job.provider, ...(kimiBinding === undefined ? {} : {binding: kimiBinding})},
     dependencies.workspaceProfileOperations
   )
   const isolatedRuntimeClient = job.provider === "kimi"
@@ -124,8 +126,7 @@ export async function dispatchWorker(job, config, dependencies = {}) {
     ? await /** @type {NonNullable<typeof isolatedRuntimeClient>} */ (isolatedRuntimeClient).preflight({
       provider: "kimi",
       profile: workspace.profile,
-      repositoryRoot: workspace.repositoryRoot,
-      cwd: workspace.cwd,
+      binding: kimiBinding,
       providerArguments: []
     })
     : undefined
@@ -164,8 +165,9 @@ export async function dispatchWorker(job, config, dependencies = {}) {
         const preflight = earlyKimiPreflight ?? await isolatedRuntimeClient.preflight({
           provider: job.provider,
           profile: workspace.profile,
-          repositoryRoot: workspace.repositoryRoot,
-          cwd: workspace.cwd,
+          ...(job.provider === "kimi"
+            ? {binding: kimiBinding}
+            : {repositoryRoot: workspace.repositoryRoot, cwd: workspace.cwd}),
           providerArguments: []
         })
         const exitCode = await isolatedRuntimeClient.run({

package/src/telegram-webhook.js

@@ -6,6 +6,7 @@ import {EvidenceStore} from "./evidence-store.js"
 import {buildProviderEnvironment, parseIngressConfig, resolveIngressEnvironment} from "./telegram-ingress/config.js"
 import {createWebhookHandler} from "./telegram-ingress/http.js"
 import {isolatedRuntimeClientFromEnvironment, kimiIsolatedRuntimeClientFromEnvironment} from "./isolated-runtime-client.js"
+import {parseTrustedThreadwireBinding} from "./threadwire-binding.js"
 
 /**
  * Start the standalone Threadwire Telegram webhook service.
@@ -24,6 +25,14 @@ import {isolatedRuntimeClientFromEnvironment, kimiIsolatedRuntimeClientFromEnvir
  */
 export async function startTelegramWebhook(options = {}) {
   const environment = await resolveIngressEnvironment(options.env ?? process.env)
+  // Capture this trusted topology attestation before anything derives a
+  // provider environment. The parsed object is passed only to Kimi preflight.
+  // Codex-only Compose renders the variable as an empty string; a blank value
+  // means "absent", while a malformed non-blank value still fails closed.
+  const rawKimiBinding = environment.THREADWIRE_KIMI_TASK_BINDING
+  const kimiBinding = rawKimiBinding === undefined || rawKimiBinding.trim().length === 0
+    ? undefined
+    : parseTrustedThreadwireBinding(rawKimiBinding)
   const config = parseIngressConfig(environment)
   const createServerImpl = options.createServerImpl ?? createServer
   const onOperationalError = options.onOperationalError ?? defaultOperationalError
@@ -55,6 +64,7 @@ export async function startTelegramWebhook(options = {}) {
     providerEnvironment,
     ...(isolatedRuntimeClient === undefined ? {} : {isolatedRuntimeClient}),
     ...(kimiIsolatedRuntimeClient === undefined ? {} : {kimiIsolatedRuntimeClient}),
+    ...(kimiBinding === undefined ? {} : {kimiBinding}),
     onOperationalError,
     onWorkerFailure
   })