threadwire 0.1.11 → 0.1.12

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 ## Unreleased
 
+- Remove the default one-hour full-run deadline from the isolated runtime: when `THREADWIRE_ISOLATED_RUNTIME_CLIENT_TIMEOUT_MS` (client) and `THREADWIRE_WORKER_TIMEOUT_MS` (supervisor) are unset or blank, a healthy running worker continues until natural completion, caller cancellation/disconnect, supervisor shutdown, or concrete failure. Setting either to a positive millisecond value enables the existing single absolute preflight+run deadline with unchanged validation and caps. Compose no longer inserts numeric timeout defaults. Preflight admission, per-operation Docker/network calls, state collection (30 seconds), and emergency cleanup stay independently bounded.
+- Add authenticated broker grant-lease renewal (Kimi and Codex): grants are issued as a bounded lease (default 60 seconds, `THREADWIRE_GRANT_LEASE_MS`, capped at one hour) that the supervisor renews via `POST /admin/grants/{token}/renew` while the run is active. Cleanup still revokes explicitly; if the supervisor dies or loses contact, renewals stop and the broker expires and aborts the grant within one lease. Malformed renewals (unknown/expired token, invalid ttlMs, missing admin auth) fail closed without extending the grant, and no renewal route exists on worker endpoints.
+- Add Kimi-only Threadwire binding v1 named-volume admission: task-labelled source/context/lease validation, immutable context manifest validation, offline validator, dynamic task UID/GID workers with context RO/state RW mounts and an exact binding-declared source mount mode, and v5 authenticated binding state. Kimi path/worktree preflights and supervisor host workspace/socket mounts are no longer accepted.
+- Fail closed on Kimi context manifest task/image identity mismatch: the worker itself revalidates the mounted manifest against the binding task attestation before launch, so a mismatched manifest task identity can never produce a successful client run.
+- Support explicitly read-only Kimi review sources: binding v1 `source.readOnly: true` pins a read-only lease/worker source mount for Docker-enforced reviewers, while writable implementation sources keep the exact read-write mode.
+- Add a credential-free per-run cross-daemon relay: the central Kimi broker splits into an internal admin/control endpoint and a stable worker endpoint, and each run creates a tiny mount-free, credential-free relay on the separate task DinD that forwards only the fixed chat shape to the worker endpoint. The worker URL and published bind have no insecure default and must be explicitly task-DinD-reachable; the configured worker URL is the stable worker origin, which the relay normalizes to the fixed `/v1/chat/completions` path (rejecting any other path fail-closed). Kimi-specific values are load-time optional so a genuine Codex-only relay-write profile renders and starts without them, while the Kimi runtime and client still fail closed at startup or job launch when they are absent. Outer-Compose DNS and outer-host loopback are never assumed, and admin/worker authority stay distinct.
+- Stream Kimi output incrementally over bounded framed NDJSON: the supervisor follows the worker's multiplexed Docker logs, validates each stdout envelope as it arrives, and relays `record` frames to the client before worker completion, followed by exactly one `terminal` exit-code frame. Session envelopes are buffered and published only once the run succeeds, so a resume hint followed by a nonzero exit never exposes an unusable resume session. Byte caps, redaction/admission rules, exact session validation, cancellation/deadline behavior, and cleanup are preserved; stderr is never relayed.
+- Reconcile exact relay/worker/network/state/grant identity on restart: genuine resources are adopted and cleaned up by their exact sealed spec, while image, mount, network, or environment tampering fails closed and retains authenticated cleanup evidence. The sealed Kimi worker/validator/relay image is the resolved image content Id (the worker/validator pin the binding's `contextImageId`; the relay pins its inspected image Id), matching how Docker normalizes a created container's `Config.Image`, so a genuine crash survivor is recognized rather than retained as a cleanup failure. The validator and relay environments accept legitimate non-sensitive keys inherited from the image while every owned key must match its sealed value exactly once and any injected sensitive or controlled key fails closed.
+- Qualify genuine separate-daemon fresh/resume/denial/read-only/concurrency operation with zero residue: adversarial split-daemon E2E proves exact resume, read-only review mounts, binding/argument denial, concurrent task isolation, and complete relay/network/state cleanup on the task DinD.
+
 ## 0.1.10 - 2026-07-28
 
 - Accept official slash-qualified Kimi model aliases through workspace-free

package/README.md

@@ -12,6 +12,15 @@ requires a reviewed `--workspace-profile` plus the root-owned isolated runtime
 and credential broker. The worker gets one writable task worktree, no upstream
 or Git credential, and no route except its run-scoped broker. Missing
 prerequisites fail before prompt or credential reads with no native fallback.
+The isolated runtime imposes no default full-run deadline: a healthy running
+worker is never stopped merely because time elapsed. An operator may set
+`THREADWIRE_WORKER_TIMEOUT_MS` (supervisor) and
+`THREADWIRE_ISOLATED_RUNTIME_CLIENT_TIMEOUT_MS` (client) to a positive
+millisecond value to enable one absolute preflight+run deadline; empty or
+unset means unlimited. Broker grants use a bounded lease that the supervisor
+renews while the run is active and that expires within one lease if the
+supervisor dies; unrelated safety timeouts (preflight slice, per-operation
+Docker/network calls, state collection, emergency cleanup) are unchanged.
 See [Isolated provider runtime](docs/isolated-provider-runtime.md).
 
 ## Run with npx
@@ -62,7 +71,7 @@ Use the local launcher. Install or refresh it after updating Threadwire with `np
 
 The target always has the form `telegram:<chat-id>:<thread-id>` for topics, or `telegram:<chat-id>` for direct messages (DMs) and ordinary chats. The chat ID is always required and must be a nonzero signed integer. The thread ID is optional and valid only as the explicit topic suffix: when present it must be a positive safe integer, and a DM target simply omits it — a missing thread ID is never an error. `--provider` must be exactly one of `codex`, `claude`, `kimi`, or `opencode`. Malformed or missing provider, chat ID, or thread ID arguments are hard failures (exit code 2) reported through Threadwire's normal error path with fixed messages; they fail before the Telegram token is read, before any transport is created, and before any provider is launched, and the messages never echo the bot token or the untrusted argument value. `--process-number` accepts an explicit positive safe integer for automation; when omitted, Threadwire uses its launcher PID. Every Telegram message is labeled consistently, such as `[P42] …`, including chunked continuations.
 
-Pass `--workspace-profile <name>` only when invoking Threadwire inside the container-native runtime, for example with `node bin/threadwire.js run` as shown in [Container runtime](docs/container-runtime.md). A profile selects a reviewed entry from the checked-in [threadwire.workspace-profiles.json](threadwire.workspace-profiles.json). It supplies the absolute in-container repository root, the exact in-container working directory, and the allowlisted providers for that workspace. Threadwire validates the selected profile, rejects malformed or unknown names, verifies the configured workspace exists and is still a healthy Git worktree, and records the selected profile plus immutable revision/worktree identity in the local activity log before provider spawn. The checked-in `container-runtime` default targets `/workspace/threadwire` inside the container-native runtime and allowlists `codex` and isolated `kimi`.
+Pass `--workspace-profile <name>` only when invoking Threadwire inside the container-native runtime, for example with `node bin/threadwire.js run` as shown in [Container runtime](docs/container-runtime.md). A profile selects a reviewed entry from the checked-in [threadwire.workspace-profiles.json](threadwire.workspace-profiles.json). Non-Kimi providers resolve the reviewed in-container repository path and Git provenance. Kimi instead requires the v2 `threadwire-v1` profile marker and a trusted `THREADWIRE_KIMI_TASK_BINDING`; it never accepts a repository path preflight. The binding names the task-owned source/context volumes, immutable context digests, revision, runtime identity, and live lease. Only safe provenance is recorded locally.
 
 Provider tool-start and tool-finish events do not produce Telegram messages by default. Pass the boolean `--tool-messages` flag to opt in, as shown above. When enabled, each tool is one concise, silent status line rather than a pair of noisy start/finish notices: when a tool starts, Threadwire sends `🛠 [P42] Tool: <safe command or tool description>` (for example `🛠 [P42] Tool: command — git status --short`), and when that same tool finishes, it edits the original message in place so it begins `✅` instead — no second completion message is sent, and Telegram edits raise no notification. The command/description shows a safe CLI-style preview with credential-bearing values (tokens, passwords, keys, authorization/cookie forms, credentials in URLs) redacted and control characters stripped; only normalized Codex command-completion output may also be appended to that same edited status as a Telegram-native expandable HTML blockquote with the visible label `Output →`; it is credential-redacted, HTML-escaped, and Unicode-safe bounded. Stderr, reasoning, and every other raw provider result remain excluded. Use `--max-output-length <positive-integer>` to truncate only that preview Unicode-safely; omit the option for unlimited tool detail. A prompt may instead come from `--prompt-file` or piped stdin, and every source rejects blank/whitespace content. Arguments following `--` pass to the selected provider, except output-stream options owned by Threadwire. Kimi is narrower: it always uses the dedicated isolated subscription runtime and accepts only one server-approved model alias through `--model <alias>` (or `-m <alias>`); Threadwire owns its prompt, output, session, permissions, configuration, tools, skills, plugins, MCP, and directories.
 

package/TELEGRAM-INGRESS.md

@@ -85,6 +85,8 @@ Optional:
 | `THREADWIRE_UPDATE_ID_TTL_MS` | Retention TTL for completed `update_id` entries in ms (default `86400000`) |
 | `THREADWIRE_KIMI_ISOLATED_RUNTIME_URL` | Dedicated Kimi supervisor URL; Compose defaults to `http://kimi-isolated-runtime:8790` |
 | `THREADWIRE_KIMI_ISOLATED_RUNTIME_CONTROL_TOKEN` | Dedicated Kimi control token. When absent, `/code kimi` remains recognized but fails closed before launch. |
+| `THREADWIRE_KIMI_TASK_BINDING` | Trusted closed Threadwire binding v1 JSON. It is captured before provider filtering, sent only to Kimi preflight, and is never forwarded to a provider or worker. |
+| `THREADWIRE_ISOLATED_RUNTIME_CLIENT_TIMEOUT_MS` | Optional absolute preflight+run deadline in ms for isolated (Codex relay-write and Kimi) runs. Empty/unset means no full-run deadline: a healthy running worker is never stopped merely because time elapsed. The supervisor-side equivalent is `THREADWIRE_WORKER_TIMEOUT_MS`. Broker grants always use a bounded lease renewed by the supervisor while the run is active, expiring within one lease if the supervisor dies; unrelated safety timeouts are unchanged. |
 
 ## Run
 

package/docs/container-runtime.md

@@ -203,12 +203,17 @@ Never export or archive mounted secret files with workspace/provider backups.
 
 ## Kimi subscription containers
 
+Kimi source is not a host worktree. The task controller creates one labelled source named volume (including its `.git` directory), one labelled immutable context named volume, and a running labelled lease container. The trusted Kimi supervisor reaches only the owning task-DinD API through `THREADWIRE_KIMI_TASK_DOCKER_HOST`; it has no workspace bind or outer Docker socket. It verifies the closed binding, exact labels/volume identities, lease image/user/workdir/mounts, references, Git revision, and manifest before issuing a broker grant. The worker has exactly the binding-declared source mount at `/workspace` (read-write for implementation sources, read-only for review sources), context RO at `/context`, and lineage state RW at `/state`. The worker entrypoint independently revalidates the mounted context manifest task/image identity and the exact source mount mode before Kimi starts; a mismatched manifest task identity or mount mode fails the run closed.
+
 Kimi is intentionally excluded from the same-UID container-native provider
 launch described above. Never mount `threadwire-kimi-oauth`, its access/refresh
 tokens, or the auth home into the Threadwire runtime, supervisor, worker,
-workspace, or session-state volume. Kimi uses four immutable build targets:
-`kimi-auth`, `kimi-model-broker`, `kimi-relay-worker`, and `isolated-runtime`.
-The first two share UID/GID 10003 and only the OAuth volume; the worker uses
+workspace, or session-state volume. Kimi uses five immutable build targets:
+`kimi-auth`, `kimi-model-broker`, `kimi-model-relay`, `kimi-relay-worker`, and
+`isolated-runtime`.
+The first two share UID/GID 10003 and only the OAuth volume; the credential-free
+relay also uses UID/GID 10003 with no mounts and no credential environment; the
+worker uses
 UID/GID 10002 with only the selected worktree and provider-bound state; the
 root supervisor alone receives the Docker socket. The broker/auth service uses
 Node `22.19.0` and exactly `@moonshot-ai/kimi-code@0.29.2` with the checked npm
@@ -216,8 +221,39 @@ integrity and archive SHA-512 in the Dockerfile.
 
 Enable the checked-in override with `--profile kimi` only after the OAuth/model
 operator flow in [Isolated provider runtime](isolated-provider-runtime.md).
+The per-run relay is created on the separate task DinD, so the deployment has
+no default central worker route: set
+`THREADWIRE_KIMI_MODEL_BROKER_WORKER_URL` to an explicit address the task DinD
+can reach (for example the outer host's task-DinD gateway) and
+`THREADWIRE_KIMI_MODEL_BROKER_WORKER_BIND` to an explicit bind reachable by that
+daemon. The URL is the stable worker origin; the relay normalizes a bare origin
+to the fixed `/v1/chat/completions` path and rejects any other path fail-closed.
+Outer-Compose DNS and outer-host loopback are unreachable from the task
+daemon. Both values are load-time optional so a Codex-only relay-write profile
+renders without them; the Kimi runtime then fails closed at startup when they
+are empty, so the Kimi profile never becomes functional without both explicit
+values. An unset bind renders the published worker port on a non-task-reachable
+loopback sentinel (`127.0.0.1`) so the file loads without publishing on every
+interface; the broker receives the raw setting and refuses to open either
+listener until an explicit nonempty bind is configured, so the sentinel is
+never an operational default.
+Only the worker port is published, on that bind — the admin endpoint stays on
+the internal control network.
 The default workspace profile allowlists Kimi because isolation is mandatory;
 without the dedicated Kimi control token/client, both CLI and Telegram Kimi
 jobs fail closed rather than using the native child path. Keep broker egress
 restricted to official Kimi Code subscription/auth endpoints and do not provide
 a Moonshot API key, custom base URL, Docker socket, or ingress secret.
+
+Neither the Kimi nor the Codex isolated runtime imposes a default full-run
+deadline: `THREADWIRE_WORKER_TIMEOUT_MS` (supervisor) and
+`THREADWIRE_ISOLATED_RUNTIME_CLIENT_TIMEOUT_MS` (client) pass through empty
+when unset, and an empty/unset value means a healthy running worker is never
+stopped merely because time elapsed. Setting either to a positive millisecond
+value enables one absolute preflight+run deadline. Broker grants are bounded
+leases (default 60 seconds, `THREADWIRE_GRANT_LEASE_MS`, maximum one hour;
+invalid, zero, or excessive values fail startup) that the supervisor renews
+over the authenticated admin endpoint while the run is active; the grant
+expires within one lease if
+the supervisor dies. Unrelated safety timeouts (preflight slice, per-operation
+Docker/network calls, state collection, emergency cleanup) are unchanged.

package/docs/isolated-provider-runtime.md

@@ -30,7 +30,11 @@ container-local tmp/run, resource limits, and exactly one writable
 worktree mount. It has no host home, common Git directory, sibling worktree,
 host temp, shared provider state, secret, Docker/SSH socket, or external route. Its
 short-lived broker grant is revoked during cleanup.
-The grant owns one absolute deadline and every accepted socket. Expiry,
+The grant is issued as a bounded lease (default 60 seconds) that the
+supervisor renews over the authenticated admin endpoint while its run is
+active; cleanup still revokes it explicitly, and if the supervisor dies or
+loses contact the broker's own expiry timer fires within one lease. The grant
+owns every accepted socket. Expiry,
 explicit revoke, credential reload, or broker shutdown aborts an incomplete
 upload or upstream request, destroys accepted sockets, and closes the listener;
 authorization is checked again after the bounded request body is acquired.
@@ -69,15 +73,19 @@ expire without requiring a matching `/run`.
 Consumed capabilities enter a separate global/per-task active-run admission
 before validation can yield. The lineage reservation is acquired synchronously
 at that boundary, preventing periodic GC from deleting resume state during
-revalidation. Docker and broker operations have bounded deadlines, and each
-worker has a bounded operator-configured lifetime; timeout cleanup revokes the
+revalidation. Docker and broker operations have bounded deadlines. There is no
+default full-run deadline: a healthy running worker is never stopped merely
+because time elapsed. An operator may set `THREADWIRE_WORKER_TIMEOUT_MS` to a
+positive millisecond value to enable one absolute preflight+run deadline;
+timeout cleanup revokes the
 grant and removes the exactly labelled worker and network before capacity is
 released.
-The relay creates one absolute launch deadline before preflight. The same
-deadline and cancellation signal span prompt/stdin and file-secret reads,
+When the operator enables it, the relay creates one absolute launch deadline
+before preflight. That
+deadline and the cancellation signal span prompt/stdin and file-secret reads,
 evidence and Telegram setup, Docker setup, broker readiness, execution,
 response/log reads, upstream work and exact cleanup. A disconnected caller or
-supervisor shutdown aborts its run. Independent per-step timeouts cannot extend
+supervisor shutdown aborts its run regardless. Independent per-step timeouts cannot extend
 the overall budget, and response bodies are stream-limited to 2 MiB.
 
 Codex bypasses its nested sandbox only inside this mandatory outer container.
@@ -105,10 +113,20 @@ credential. The supervisor alone receives `/var/run/docker.sock`. Restrict
 broker egress at the host/firewall to provider endpoints.
 
 The supervisor defaults to 16 active runs globally, two per reviewed task, a
-30-second maximum preflight slice, and a one-hour end-to-end launch deadline. Operators may
-lower these finite limits with `THREADWIRE_PREFLIGHT_TIMEOUT_MS`,
+30-second maximum preflight slice, and no full-run deadline: an unset or empty
+`THREADWIRE_WORKER_TIMEOUT_MS` (supervisor) or
+`THREADWIRE_ISOLATED_RUNTIME_CLIENT_TIMEOUT_MS` (client) means a run may
+continue until natural completion, caller cancellation/disconnect, supervisor
+shutdown, or concrete failure. Setting either to a positive millisecond value
+enables one absolute preflight+run deadline. Operators may
+lower the finite limits with `THREADWIRE_PREFLIGHT_TIMEOUT_MS`,
 `THREADWIRE_ACTIVE_RUN_CAPACITY`, `THREADWIRE_ACTIVE_TASK_CAPACITY`, and
 `THREADWIRE_WORKER_TIMEOUT_MS`; invalid, zero, or excessive values fail startup.
+Broker grants always use a bounded lease (default 60 seconds, tunable with
+`THREADWIRE_GRANT_LEASE_MS`, maximum one hour) that the supervisor renews while
+the run is active; the grant expires within one lease if the supervisor dies.
+An invalid, zero, or excessive `THREADWIRE_GRANT_LEASE_MS` value fails startup
+rather than being silently coerced.
 
 The authenticated registry persists through file fsync, atomic rename, and
 parent-directory fsync. Startup removes only strictly named abandoned temp
@@ -139,6 +157,10 @@ logs; worker self-report is not the sole assertion.
 
 ## Native Kimi Code subscription boundary
 
+Kimi binding v1 is separate from the Codex worktree contract. A Kimi preflight contains `binding`, never `repositoryRoot` or `cwd`. The supervisor queries the task-DinD daemon for exactly one labelled source volume, context volume, and running lease, rejects ambiguity/RW context references, validates the lease and worker image, then uses an offline two-volume validator to check the real Git revision and complete immutable context manifest. Only after that does it create the per-run data plane on the task daemon: a private internal worker network, a task-owned non-internal egress network, one credential-free relay attached to both, and a three-volume Kimi worker attached only to the internal network. OAuth remains broker-only; workers receive a synthetic per-run grant and no raw binding, volume, lease, control, or OAuth value. Kimi v6 state seals include the binding digest, source/context identities, source mount mode, dynamic UID/GID/workdir, validator, worker, relay, relay image, both networks, the central endpoint identity, state, and image. Old path-based and pre-relay Kimi state is intentionally not adopted.
+
+The binding's `source.readOnly` selects the exact admitted mount mode: `false` is a writable implementation source, `true` an explicitly read-only review source for Docker-enforced reviewers. Admission and revalidation pin the lease and worker source mounts to that exact mode, one-writer isolation is unchanged, and the worker entrypoint independently asserts the mounted mode from `/proc/self/mountinfo` before launch. Both the validator and the worker compare the mounted context manifest's task and image identity against the binding attestation; a mismatch fails the run closed and can never produce a successful client run.
+
 Kimi uses the same proven supervisor mechanics but a distinct protocol and
 credential service. `THREADWIRE_ISOLATED_PROVIDER=kimi` makes the supervisor
 accept only Kimi preflights, select only `THREADWIRE_KIMI_RELAY_WORKER_IMAGE`,
@@ -147,14 +169,54 @@ provider-bound state in the separate Kimi namespace. Codex requests, sessions,
 workers, grants, and volumes cannot be adopted by this service, and the Codex
 broker remains unchanged.
 
+The central Kimi broker runs on an outer daemon, not the task daemon, so the
+supervisor never resolves a broker container by name. It splits the broker into
+an admin/control endpoint (grant lifecycle only) and a stable worker endpoint
+(grant-auth chat proxy). For each run it creates a tiny credential-free relay
+on the task daemon from the immutable `THREADWIRE_KIMI_MODEL_RELAY_IMAGE`
+digest. The relay knows only the configured central worker URL
+(`THREADWIRE_KIMI_MODEL_BROKER_WORKER_URL`) and its own listen port, receives
+no grant, OAuth, admin token, binding, mount, or Docker socket, and is attached
+to both the internal worker network and a dedicated egress network. The worker
+reaches only the relay's internal address; the relay forwards the fixed
+`POST /v1/chat/completions` shape to the central worker endpoint, preserving
+the grant bearer. The configured worker URL is the stable worker origin: a bare
+origin (for example `http://<gateway>:8792`) or the already-exact accepted path
+is normalized to the fixed `/v1/chat/completions` path, and any other path is
+rejected fail-closed at relay startup rather than forwarded verbatim. There is
+no DNS or host-gateway fallback, no container-name resolution, and TLS
+verification is never disabled.
+
+Because the relay runs on the separate task daemon, the stable worker URL is
+not defaulted: `THREADWIRE_KIMI_MODEL_BROKER_WORKER_URL` must be set to an
+explicit address the task daemon can reach (for example the outer host's
+task-DinD gateway), and the broker's published worker bind
+(`THREADWIRE_KIMI_MODEL_BROKER_WORKER_BIND`) must likewise be chosen explicitly
+to be reachable by that daemon. Outer-Compose DNS and outer-host loopback are
+unreachable from the task daemon and are never assumed. These values are
+load-time optional so a Codex-only relay-write profile renders and starts
+without them; the Kimi runtime and client then fail closed at startup or job
+launch when they are empty, so a Kimi deployment that does not supply an
+explicit task-reachable URL and bind never becomes functional. When the bind
+is unset, Compose renders the published worker port on a non-task-reachable
+loopback sentinel (`127.0.0.1`) purely so the file loads — never on every
+interface — and passes the raw setting through to the broker, which requires a
+nonempty explicit bind before opening either listener. The sentinel is not an
+operational default: without the explicit bind the broker exits instead of
+serving. The
+admin/control endpoint is never published — only the worker
+port is, on the explicit bind — so admin and worker authority stay distinct.
+
 The Kimi broker is not a generic credential proxy. It accepts only
 `POST /v1/chat/completions`, validates a closed request schema and one approved
 wire model, substitutes OAuth immediately before the fixed official
 `https://api.kimi.com/coding/v1/chat/completions` request, and streams the
 bounded response. A grant is pending until the inspected worker is ready and is
 bound to provider, task hash, exact resume session (or fresh lineage), run,
-Docker network, approved alias, and wire model. Revocation, timeout, shutdown,
-or cleanup closes its private listener and active sockets.
+Docker network, approved alias, and wire model. The grant is a bounded lease
+renewed by the supervisor while the run is active. Revocation, lease expiry,
+shutdown,
+or cleanup rejects the grant and closes its active sockets.
 
 The immutable Kimi worker image pins `@moonshot-ai/kimi-code@0.29.2` and verifies
 the npm archive SHA-512 before installation. It receives no OAuth file, Docker
@@ -174,10 +236,26 @@ and OAuth material are discarded. The worker is the only reader of native Kimi
 stdout and Docker receives only sanitized envelopes and fixed lifecycle events;
 the supervisor returns `rawChunks: []` for every Kimi run.
 
+The supervisor does not wait for worker completion before relaying output. It
+follows the worker's multiplexed Docker logs, demultiplexes and validates each
+stdout envelope as it arrives, and streams it to the relay caller over a single
+framed NDJSON run response: `record` frames are written incrementally, then
+exactly one `terminal` frame carries the final exit code. The client parses the
+same NDJSON stream and forwards each validated event to `WorkerControl` as it
+arrives, so long runs relay assistant/tool/lifecycle output to Telegram
+incrementally. Session envelopes are the one exception: they are buffered and
+only published once the run's success is known, so a resume hint followed by a
+nonzero exit never exposes an unusable resume session. Stderr frames are
+dropped, the same byte caps and conflicting-session rejection apply as the
+buffered path, and a mid-stream
+failure or cancellation still revokes the grant and removes the exact worker,
+relay, and both networks before capacity is released.
+
 ### Operator OAuth and model approval
 
-Build and publish the `kimi-auth`, `kimi-model-broker`, `kimi-relay-worker`, and
-existing `isolated-runtime` targets as immutable digests. Set distinct random
+Build and publish the `kimi-auth`, `kimi-model-broker`, `kimi-model-relay`,
+`kimi-relay-worker`, and existing `isolated-runtime` targets as immutable
+digests. Set distinct random
 Kimi runtime and broker admin tokens of at least 32 characters, the Kimi image digests, and an allowlist
 such as:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "threadwire",
-  "version": "0.1.11",
+  "version": "0.1.12",
   "description": "Stream Codex, Claude, Kimi Code, and OpenCode worker progress to an explicit Telegram destination",
   "keywords": [
     "ai-agent",

package/scripts/verify-package.js

@@ -77,6 +77,7 @@ const EXPECTED_FILES = [
   "src/telegram-ingress/http.js",
   "src/telegram-ingress/update-guard.js",
   "src/telegram-webhook.js",
+  "src/threadwire-binding.js",
   "src/types.js",
   "src/worker-control.js",
   "src/workspace-profile.js",

package/src/absolute-deadline.js

@@ -3,7 +3,7 @@
 
 export class AbsoluteDeadline {
   constructor(expiresAt, {signal, request, response, now = Date.now, timeoutMessage = "Operation timeout", disconnectMessage = "Caller disconnected"} = {}) {
-    if (!Number.isSafeInteger(expiresAt) || expiresAt <= now()) throw new Error(timeoutMessage)
+    if (expiresAt !== undefined && (!Number.isSafeInteger(expiresAt) || expiresAt <= now())) throw new Error(timeoutMessage)
     this.expiresAt = expiresAt
     this.now = now
     this.controller = new AbortController()
@@ -26,13 +26,14 @@ export class AbsoluteDeadline {
     request?.once?.("aborted", this.abortRequest)
     response?.once?.("close", this.abortResponse)
     this.socket?.once?.("close", this.abortSocket)
-    this.timer = setTimeout(() => this.controller.abort(new Error(timeoutMessage)), Math.max(1, expiresAt - now()))
-    this.timer.unref()
+    this.timer = expiresAt === undefined ? undefined : setTimeout(() => this.controller.abort(new Error(timeoutMessage)), Math.max(1, expiresAt - now()))
     this.signal.addEventListener("abort", () => request?.destroy?.(this.signal.reason), {once: true})
     if (request?.aborted || (response?.destroyed && !response.writableEnded)) this.abortRequest()
   }
   remaining() {
     this.throwIfAborted()
+    if (this.expiresAt === undefined) return undefined
+    if (this.expiresAt === undefined) return undefined
     const remaining = this.expiresAt - this.now()
     if (remaining <= 0) {
       this.controller.abort(new Error(this.timeoutMessage))
@@ -41,13 +42,14 @@ export class AbsoluteDeadline {
     return Math.max(1, remaining)
   }
   options() {
-    return {signal: this.signal, timeoutMs: this.remaining()}
+    const timeoutMs = this.remaining()
+    return timeoutMs === undefined ? {signal: this.signal} : {signal: this.signal, timeoutMs}
   }
   throwIfAborted() {
     if (this.signal.aborted) throw this.signal.reason instanceof Error ? this.signal.reason : new Error("Operation aborted")
   }
   close() {
-    clearTimeout(this.timer)
+    if (this.timer !== undefined) clearTimeout(this.timer)
     this.abortParent && this.parentSignal?.removeEventListener?.("abort", this.abortParent)
     this.request?.off?.("aborted", this.abortRequest)
     this.response?.off?.("close", this.abortResponse)
@@ -89,6 +91,7 @@ export async function readResponseCapped(response, capacity, signal) {
     }
     return Buffer.concat(chunks, size)
   } finally {
+    if (signal?.aborted) await reader.cancel(signal.reason).catch(() => {})
     reader.releaseLock()
   }
 }

package/src/cli.js

@@ -16,6 +16,7 @@ import {WorkerControl} from "./worker-control.js"
 import {EvidenceStore} from "./evidence-store.js"
 import {ContextBudgetMetrics} from "./context-budget-metrics.js"
 import {isolatedRuntimeClientFromEnvironment, kimiIsolatedRuntimeClientFromEnvironment} from "./isolated-runtime-client.js"
+import {parseTrustedThreadwireBinding} from "./threadwire-binding.js"
 import {kimiSessionEnvelopeId} from "./providers/kimi.js"
 import {validateRelayWriteProviderArguments} from "./relay-write.js"
 import {abortable} from "./absolute-deadline.js"
@@ -199,10 +200,16 @@ export async function main(arguments_, dependencies = {}) {
     runAdmission = normalizedOutput === undefined ? undefined : new DelegatedResultAdmission({output: normalizedOutput, metrics})
     const target = parseTelegramTarget(parsed.target)
     if (parsed.relayWrite) validateRelayWriteProviderArguments(parsed.providerArguments)
+    const kimiBinding = parsed.provider === "kimi"
+      ? parseTrustedThreadwireBinding(sourceEnvironment.THREADWIRE_KIMI_TASK_BINDING)
+      : undefined
     const resolvedWorkspace = parsed.workspaceProfile === undefined
       ? undefined
       : await resolveWorkspaceProfile(
-        {provider: /** @type {"codex" | "claude" | "kimi" | "opencode"} */ (parsed.provider), profile: parsed.workspaceProfile},
+        {
+          provider: /** @type {"codex" | "claude" | "kimi" | "opencode"} */ (parsed.provider), profile: parsed.workspaceProfile,
+          ...(kimiBinding === undefined ? {} : {binding: kimiBinding})
+        },
         dependencies.workspaceProfileOperations
       )
     if (validateOnly) return 0
@@ -216,8 +223,12 @@ export async function main(arguments_, dependencies = {}) {
       ? await /** @type {NonNullable<typeof isolatedRuntimeClient>} */ (isolatedRuntimeClient).preflight({
         provider: parsed.provider,
         profile: /** @type {string} */ (parsed.workspaceProfile),
-        repositoryRoot: /** @type {import("./workspace-profile.js").ResolvedWorkspaceProfile} */ (resolvedWorkspace).repositoryRoot,
-        cwd: /** @type {import("./workspace-profile.js").ResolvedWorkspaceProfile} */ (resolvedWorkspace).cwd,
+        ...(parsed.provider === "kimi"
+          ? {binding: kimiBinding}
+          : {
+            repositoryRoot: /** @type {import("./workspace-profile.js").ResolvedWorkspaceProfile} */ (resolvedWorkspace).repositoryRoot,
+            cwd: /** @type {import("./workspace-profile.js").ResolvedWorkspaceProfile} */ (resolvedWorkspace).cwd
+          }),
         providerArguments: parsed.providerArguments,
         ...(parsed.resumeSession === undefined ? {} : {resumeSession: parsed.resumeSession})
       })

package/src/docker-api.js

@@ -60,13 +60,12 @@ export class DockerApi {
       const abort = () => request.destroy(options.signal.reason instanceof Error ? options.signal.reason : new Error("Docker request aborted"))
       if (options.signal?.aborted) abort()
       else options.signal?.addEventListener("abort", abort, {once: true})
-      const deadline = setTimeout(
-        () => request.destroy(new Error(`Docker API ${method} ${path} timed out`)),
-        timeoutMs
-      )
-      deadline.unref()
+      const deadline = timeoutMs > 0
+        ? setTimeout(() => request.destroy(new Error(`Docker API ${method} ${path} timed out`)), timeoutMs)
+        : undefined
+      deadline?.unref()
       request.once("close", () => {
-        clearTimeout(deadline)
+        if (deadline !== undefined) clearTimeout(deadline)
         options.signal?.removeEventListener("abort", abort)
       })
       if (payload !== undefined) request.end(payload)
@@ -77,13 +76,11 @@ export class DockerApi {
   version(options) { return this.request("GET", "/version", undefined, false, options) }
   inspectImage(image, options) { return this.request("GET", `/images/${encodeURIComponent(image)}/json`, undefined, false, options) }
   createNetwork(name, labels = {}, options) {
-    return this.request("POST", "/networks/create", {
-      Name: name,
-      Internal: true,
-      CheckDuplicate: true,
-      EnableIPv6: false,
-      Labels: {"org.threadwire.owner": "isolated-runtime", ...labels}
-    }, false, options)
+    return createNetwork(this.request.bind(this), name, labels, true, options)
+  }
+  /** Create a task-owned non-internal egress network for the per-run Kimi relay. */
+  createEgressNetwork(name, labels = {}, options) {
+    return createNetwork(this.request.bind(this), name, labels, false, options)
   }
   removeNetwork(id, options) { return this.request("DELETE", `/networks/${encodeURIComponent(id)}`, undefined, false, options) }
   inspectNetwork(id, options) { return this.request("GET", `/networks/${encodeURIComponent(id)}`, undefined, false, options) }
@@ -108,8 +105,72 @@ export class DockerApi {
     return this.request("GET", `/networks?filters=${encodeURIComponent(JSON.stringify(filters))}`, undefined, false, options)
   }
   startContainer(id, options) { return this.request("POST", `/containers/${encodeURIComponent(id)}/start`, undefined, false, options) }
-  waitContainer(id, options) { return this.request("POST", `/containers/${encodeURIComponent(id)}/wait?condition=not-running`, undefined, false, options) }
+  waitContainer(id, options = {}) {
+    return this.request("POST", `/containers/${encodeURIComponent(id)}/wait?condition=not-running`, undefined, false, {
+      ...options,
+      timeoutMs: options.timeoutMs ?? 0
+    })
+  }
   logs(id, options) { return this.request("GET", `/containers/${encodeURIComponent(id)}/logs?stdout=1&stderr=1`, undefined, true, options) }
+  /**
+   * Stream a container's multiplexed logs (stdout+stderr, follow) as raw bytes.
+   * Resolves once the follow stream ends (container stop) or rejects on abort,
+   * capacity overflow, or a Docker error. Each `onData` invocation carries one
+   * received chunk; framing/demultiplexing is the caller's responsibility.
+   * @param {string} id @param {(chunk: Buffer) => void} onData @param {{signal?: AbortSignal, timeoutMs?: number}} [options]
+   */
+  streamLogs(id, onData, options = {}) {
+    const timeoutMs = options.timeoutMs
+    const target = dockerTarget(this.host, `/containers/${encodeURIComponent(id)}/logs?stdout=1&stderr=1&follow=1`)
+    return new Promise((resolve, reject) => {
+      let bytes = 0
+      let settled = false
+      const fail = (error) => {
+        if (settled) return
+        settled = true
+        request.destroy()
+        reject(error)
+      }
+      const request = this.requestImplementation({...target, method: "GET", headers: {}}, (response) => {
+        const status = response.statusCode ?? 500
+        if (status < 200 || status >= 300) {
+          response.resume()
+          fail(new Error(`Docker API GET /containers/${id}/logs failed (${status})`))
+          return
+        }
+        response.on("data", (chunk) => {
+          const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)
+          bytes += buffer.length
+          if (bytes > 8_388_608) {
+            fail(new Error("Docker response exceeded capacity"))
+            return
+          }
+          onData(buffer)
+        })
+        response.on("end", () => {
+          if (settled) return
+          settled = true
+          resolve(undefined)
+        })
+        response.on("error", fail)
+      })
+      request.on("error", (error) => {
+        if (settled) return
+        settled = true
+        reject(error)
+      })
+      const abort = () => fail(options.signal.reason instanceof Error ? options.signal.reason : new Error("Docker request aborted"))
+      if (options.signal?.aborted) abort()
+      else options.signal?.addEventListener("abort", abort, {once: true})
+      const deadline = timeoutMs === undefined ? undefined : setTimeout(() => fail(new Error(`Docker API GET /containers/${id}/logs timed out`)), timeoutMs)
+      deadline?.unref()
+      request.once("close", () => {
+        if (deadline !== undefined) clearTimeout(deadline)
+        options.signal?.removeEventListener("abort", abort)
+      })
+      request.end()
+    })
+  }
   inspectContainer(id, options) { return this.request("GET", `/containers/${encodeURIComponent(id)}/json`, undefined, false, options) }
   removeContainer(id, options) { return this.request("DELETE", `/containers/${encodeURIComponent(id)}?force=1&v=1`, undefined, false, options) }
   createVolume(name, labels = {}, options) {
@@ -119,10 +180,35 @@ export class DockerApi {
     const filters = {label: Object.entries(labels).map(([key, value]) => `${key}=${value}`)}
     return this.request("GET", `/volumes?filters=${encodeURIComponent(JSON.stringify(filters))}`, undefined, false, options)
   }
+  /** List all containers so a volume reference can be inspected fail-closed. */
+  listVolumeReferences(volume, options) {
+    if (typeof volume !== "string" || volume.length === 0) throw new Error("Docker volume reference is invalid")
+    return this.listContainers({}, true, options).then(async (containers) => {
+      if (!Array.isArray(containers)) throw new Error("Docker volume references unavailable")
+      const references = []
+      for (const container of containers) {
+        if (!container || typeof container.Id !== "string") throw new Error("Docker volume references unavailable")
+        const inspection = await this.inspectContainer(container.Id, options)
+        const mounts = Array.isArray(inspection?.Mounts) ? inspection.Mounts : []
+        if (mounts.some((mount) => mount?.Type === "volume" && mount?.Name === volume)) references.push(inspection)
+      }
+      return references
+    })
+  }
   inspectVolume(name, options) { return this.request("GET", `/volumes/${encodeURIComponent(name)}`, undefined, false, options) }
   removeVolume(name, options) { return this.request("DELETE", `/volumes/${encodeURIComponent(name)}?force=0`, undefined, false, options) }
 }
 
+function createNetwork(request, name, labels, internal, options) {
+  return request("POST", "/networks/create", {
+    Name: name,
+    Internal: internal,
+    CheckDuplicate: true,
+    EnableIPv6: false,
+    Labels: {"org.threadwire.owner": "isolated-runtime", ...labels}
+  }, false, options)
+}
+
 function dockerTarget(host, path) {
   const url = new URL(host)
   if (url.protocol === "unix:") return {socketPath: url.pathname, path}