threadwire 0.1.11 → 0.1.12

package/src/isolated-state.js

@@ -33,12 +33,17 @@ export async function openStateRegistry(options) {
   try {
     const document = JSON.parse(await readFile(options.file, "utf8"))
     const payload = JSON.stringify(document.payload)
-    if (![1, 2, 3, 4].includes(document.version) || typeof document.mac !== "string" || !equalMac(document.mac, mac(options.key, payload))) throw new Error()
-    if (document.version < 4 && provider !== "codex") throw new Error()
+    if (![1, 2, 3, 4, 5, 6, 7].includes(document.version) || typeof document.mac !== "string" || !equalMac(document.mac, mac(options.key, payload))) throw new Error()
+    // Binding-v1 Kimi never adopts a host-worktree registry document, the
+    // relay-sealed Kimi run identity (v6) never adopts a pre-relay v5 document,
+    // and the task/revision-sealed Kimi identity (v7) never adopts a v6 one.
+    if (document.version < 5 && provider !== "codex") throw new Error()
+    if (document.version < 6 && provider === "kimi") throw new Error()
+    if (document.version < 7 && provider === "kimi") throw new Error()
     if (!Array.isArray(document.payload?.sessions)) throw new Error()
     for (const rawEntry of document.payload.sessions) {
-      if (!validSession(rawEntry, document.version === 4)) throw new Error()
-      const entry = document.version === 4 ? rawEntry : {...rawEntry, provider: "codex"}
+      if (!validSession(rawEntry, document.version >= 4)) throw new Error()
+      const entry = document.version >= 4 ? rawEntry : {...rawEntry, provider: "codex"}
       if (entry.provider !== provider) throw new Error()
       sessions.set(entry.sessionId, without(entry, "sessionId"))
       lineages.set(entry.lineage, lineageFromSession(options.namespace, entry))
@@ -50,17 +55,17 @@ export async function openStateRegistry(options) {
         lineages.set(entry.lineage, {...entry, provider: "codex"})
       }
     }
-    if (document.version === 3 || document.version === 4) {
+    if (document.version === 3 || document.version === 4 || document.version === 5 || document.version === 6 || document.version === 7) {
       if (!Array.isArray(document.payload.lineages) || !Array.isArray(document.payload.runs)) throw new Error()
       for (const rawEntry of document.payload.lineages) {
-        if (!validLineage(rawEntry, options.namespace, document.version === 4)) throw new Error()
-        const entry = document.version === 4 ? rawEntry : {...rawEntry, provider: "codex"}
+        if (!validLineage(rawEntry, options.namespace, document.version >= 4)) throw new Error()
+        const entry = document.version >= 4 ? rawEntry : {...rawEntry, provider: "codex"}
         if (entry.provider !== provider) throw new Error()
         lineages.set(entry.lineage, entry)
       }
       for (const rawEntry of document.payload.runs) {
         canonicalRunIdentity(rawEntry)
-        const entry = document.version === 4 ? rawEntry : {...rawEntry, provider: "codex", sealVersion: 3}
+        const entry = document.version >= 4 ? rawEntry : {...rawEntry, provider: "codex", sealVersion: 3}
         if (entry.provider !== provider) throw new Error()
         runs.set(entry.run, entry)
       }
@@ -78,7 +83,7 @@ export async function openStateRegistry(options) {
       runs: [...runState.values()]
     }
     const serializedPayload = JSON.stringify(payload)
-    const document = JSON.stringify({version: 4, payload, mac: mac(options.key, serializedPayload)})
+    const document = JSON.stringify({version: 7, payload, mac: mac(options.key, serializedPayload)})
     const temporary = join(dirname(options.file), `.sessions-${random(12).toString("hex")}.tmp`)
     let handle
     try {
@@ -234,6 +239,32 @@ export async function openStateRegistry(options) {
         throwIfAborted(signal)
       })
     },
+    /**
+     * Rolls back exactly the aliases a just-completed `register` call added
+     * for this allocation. An alias is removed only while it still points at
+     * the same lineage and volume; unrelated sessions and the lineage
+     * ownership record itself are left untouched.
+     */
+    async unregister(sessionIds, allocation, signal) {
+      await transact(async () => {
+        throwIfAborted(signal)
+        const normalized = providerAllocation(allocation, provider)
+        const nextSessions = new Map(sessions)
+        let changed = false
+        for (const sessionId of sessionIds) {
+          const existing = nextSessions.get(sessionId)
+          if (!existing) continue
+          if (existing.provider !== normalized.provider || existing.task !== normalized.task
+            || existing.lineage !== normalized.lineage || existing.volume !== normalized.volume) continue
+          nextSessions.delete(sessionId)
+          changed = true
+        }
+        if (!changed) return
+        await persist(nextSessions, lineages, runs, signal)
+        replace(sessions, nextSessions)
+        throwIfAborted(signal)
+      })
+    },
     /**
      * Sweeps aliases, adopts only exactly labelled namespace-owned orphan
      * volumes, and retries failed deletions without dropping ownership.
@@ -409,11 +440,11 @@ async function removeAuthenticatedTemps(directory, key, namespace) {
 }
 
 function authenticatedDocument(document, key, namespace) {
-  if (!record(document) || ![1, 2, 3, 4].includes(document.version) || typeof document.mac !== "string"
+  if (!record(document) || ![1, 2, 3, 4, 5, 6, 7].includes(document.version) || typeof document.mac !== "string"
     || !record(document.payload) || !Array.isArray(document.payload.sessions)) return false
   const payload = JSON.stringify(document.payload)
   if (!equalMac(document.mac, mac(key, payload))) return false
-  const current = document.version === 4
+  const current = document.version >= 4
   if (!document.payload.sessions.every((entry) => validSession(entry, current))) return false
   if (document.version === 1) return true
   if (!Array.isArray(document.payload.lineages)
@@ -425,6 +456,7 @@ function authenticatedDocument(document, key, namespace) {
 }
 
 function canonicalRunIdentity(identity) {
+  if (record(identity) && identity.provider === "kimi") return canonicalKimiRunIdentity(identity)
   const keys = [
     "provider", "namespace", "run", "lineage", "task", "volume", "network", "container",
     "image", "worktreeType", "worktreeSource", "worktreeSubpath"
@@ -440,6 +472,25 @@ function canonicalRunIdentity(identity) {
   return JSON.stringify(Object.fromEntries(keys.map((key) => [key, normalized[key]])))
 }
 
+function canonicalKimiRunIdentity(identity) {
+  const keys = [
+    "provider", "namespace", "run", "lineage", "task", "volume", "network", "egressNetwork", "validator", "worker", "relay", "image", "relayImage",
+    "endpoint", "bindingDigest", "sourceVolume", "sourceTarget", "sourceReadOnly", "contextVolume", "contextTarget", "contextManifestDigest",
+    "contextContentDigest", "contextImageId", "runtimeUid", "runtimeGid", "workdir", "taskId", "expectedRevision"
+  ]
+  if (!record(identity) || Object.keys(identity).length !== keys.length || keys.some((key) => typeof identity[key] !== "string")
+    || identity.provider !== "kimi" || !/^(?:true|false)$/u.test(identity.sourceReadOnly)
+    || !/^sha256:[0-9a-f]{64}$/u.test(identity.bindingDigest)
+    || !/^sha256:[0-9a-f]{64}$/u.test(identity.contextManifestDigest)
+    || !/^sha256:[0-9a-f]{64}$/u.test(identity.contextContentDigest)
+    || !/^sha256:[0-9a-f]{64}$/u.test(identity.contextImageId)
+    || !/^sha256:[0-9a-f]{64}$/u.test(identity.relayImage)
+    || !/^\d+$/u.test(identity.runtimeUid) || !/^\d+$/u.test(identity.runtimeGid)
+    || !/^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/u.test(identity.taskId)
+    || !/^[0-9a-f]{40}$/u.test(identity.expectedRevision)) throw new Error("Invalid Kimi binding run identity")
+  return JSON.stringify(Object.fromEntries(keys.map((key) => [key, identity[key]])))
+}
+
 function legacyCanonicalRunIdentity(identity) {
   const keys = [
     "namespace", "run", "lineage", "task", "volume", "network", "container",

package/src/isolated-worker.js

@@ -1,9 +1,11 @@
 // @ts-check
 
 import {isAbsolute, normalize} from "node:path"
+import {parseThreadwireBinding} from "./threadwire-binding.js"
 
 const DIGEST_IMAGE = /^(?:[^@\s]+@)?sha256:[0-9a-f]{64}$/u
 const SAFE_VALUE = /^[^\0\r\n]+$/u
+const MAX_PROMPT_LENGTH = 524_288
 
 /**
  * @typedef {{
@@ -22,6 +24,7 @@ const SAFE_VALUE = /^[^\0\r\n]+$/u
  *   stateVolume: string,
  *   worktreeInode: string,
  *   cwdInode: string
+ *   binding?: unknown
  *   lineage?: string
  *   namespace?: string
  *   runId?: string
@@ -34,18 +37,17 @@ const SAFE_VALUE = /^[^\0\r\n]+$/u
 export function buildWorkerContainerSpec(options) {
   const provider = options.provider ?? "codex"
   if (provider !== "codex" && provider !== "kimi") throw new Error("Worker provider is invalid")
+  if (provider === "kimi") return buildKimiWorkerContainerSpec(options)
   if (!DIGEST_IMAGE.test(options.image)) throw new Error("Worker image must use an immutable digest")
   if (!isAbsolute(options.worktree) || normalize(options.worktree) !== options.worktree || options.worktree === "/") {
     throw new Error("Worker worktree must be a normalized non-root absolute path")
   }
-  for (const [name, value] of /** @type {[string, string][]} */ ([["network", options.networkName], ["capability", options.brokerToken], ["prompt", options.prompt]])) {
+  for (const [name, value] of /** @type {[string, string][]} */ ([["network", options.networkName], ["capability", options.brokerToken]])) {
     if (!SAFE_VALUE.test(value)) throw new Error(`Worker ${name} is invalid`)
   }
+  if (!validPrompt(options.prompt)) throw new Error("Worker prompt is invalid")
   if (options.resumeSession !== undefined && !SAFE_VALUE.test(options.resumeSession)) throw new Error("Worker resume session is invalid")
   if (!isAbsolute(options.workingDirectory) || !withinWorktree(options.workingDirectory)) throw new Error("Worker cwd is invalid")
-  if (provider === "kimi" && (typeof options.model !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._:/-]{0,255}$/u.test(options.model))) {
-    throw new Error("Worker Kimi model is invalid")
-  }
   const commonEnvironment = [
     "HOME=/home/worker",
     "TMPDIR=/tmp",
@@ -54,22 +56,14 @@ export function buildWorkerContainerSpec(options) {
     `THREADWIRE_CWD_INODE=${options.cwdInode}`,
     ...(options.resumeSession === undefined ? [] : [`THREADWIRE_RESUME_SESSION=${options.resumeSession}`])
   ]
-  const environment = provider === "kimi"
-    ? [
-      ...commonEnvironment,
-      "KIMI_CODE_HOME=/home/worker/.kimi-code",
-      `THREADWIRE_KIMI_MODEL=${options.model}`,
-      `THREADWIRE_KIMI_BROKER_URL=${options.brokerUrl}`,
-      `THREADWIRE_KIMI_BROKER_TOKEN=${options.brokerToken}`
-    ]
-    : [
-      ...commonEnvironment,
-      "CODEX_HOME=/home/worker/.codex",
-      `OPENAI_BASE_URL=${options.brokerUrl ?? "http://model-broker:8789/v1"}`,
-      `OPENAI_API_KEY=${options.brokerToken}`,
-      `CODEX_API_KEY=${options.brokerToken}`,
-      `THREADWIRE_CODEX_ARGUMENTS=${JSON.stringify(options.providerArguments)}`
-    ]
+  const environment = [
+    ...commonEnvironment,
+    "CODEX_HOME=/home/worker/.codex",
+    `OPENAI_BASE_URL=${options.brokerUrl ?? "http://model-broker:8789/v1"}`,
+    `OPENAI_API_KEY=${options.brokerToken}`,
+    `CODEX_API_KEY=${options.brokerToken}`,
+    `THREADWIRE_CODEX_ARGUMENTS=${JSON.stringify(options.providerArguments)}`
+  ]
   const worktreeMount = options.worktreeVolume === undefined
     ? {
       Type: "bind",
@@ -100,9 +94,7 @@ export function buildWorkerContainerSpec(options) {
         "org.threadwire.run-seal": options.runSeal
       })
     },
-    Entrypoint: provider === "kimi"
-      ? ["node", "/opt/threadwire/docker/kimi-worker-entrypoint.mjs"]
-      : ["/usr/local/libexec/threadwire/worker-entrypoint"],
+    Entrypoint: ["/usr/local/libexec/threadwire/worker-entrypoint"],
     Env: environment,
     WorkingDir: options.workingDirectory,
     User: "10002:10002",
@@ -133,6 +125,222 @@ export function buildWorkerContainerSpec(options) {
   }
 }
 
+/**
+ * Validate an opaque multiline task prompt for Docker environment transport.
+ * @param {unknown} value
+ */
+function validPrompt(value) {
+  return typeof value === "string" && value.trim().length > 0 && value.length <= MAX_PROMPT_LENGTH && !value.includes("\0")
+}
+
+/**
+ * Build the Kimi-only worker shape. Kimi deliberately does not inherit the
+ * Codex bind-worktree contract: its source and immutable context are exact
+ * named volumes resolved by the supervisor binding admission.
+ * @param {WorkerSpecOptions} options
+ */
+export function buildKimiWorkerContainerSpec(options) {
+  if (!DIGEST_IMAGE.test(options.image)) throw new Error("Worker image must use an immutable digest")
+  const binding = parseThreadwireBinding(options.binding)
+  for (const [name, value] of /** @type {[string, unknown][]} */ ([
+    ["network", options.networkName], ["capability", options.brokerToken], ["broker URL", options.brokerUrl]
+  ])) if (typeof value !== "string" || !SAFE_VALUE.test(value)) throw new Error(`Worker ${name} is invalid`)
+  if (!validPrompt(options.prompt)) throw new Error("Worker prompt is invalid")
+  if (typeof options.model !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._:/-]{0,255}$/u.test(options.model)) throw new Error("Worker Kimi model is invalid")
+  if (options.resumeSession !== undefined && !SAFE_VALUE.test(options.resumeSession)) throw new Error("Worker resume session is invalid")
+  const user = `${binding.runtime.uid}:${binding.runtime.gid}`
+  const uid = binding.runtime.uid
+  const gid = binding.runtime.gid
+  const environment = [
+    "PATH=/usr/local/bin:/usr/bin:/bin",
+    "NODE_VERSION=",
+    "YARN_VERSION=",
+    "HOME=/state/.threadwire-homes/home",
+    "KIMI_CODE_HOME=/state/.threadwire-homes/home/.kimi-code",
+    "TMPDIR=/tmp",
+    `THREADWIRE_PROMPT=${options.prompt}`,
+    `THREADWIRE_KIMI_MODEL=${options.model}`,
+    `THREADWIRE_KIMI_BROKER_URL=${options.brokerUrl}`,
+    `THREADWIRE_KIMI_BROKER_TOKEN=${options.brokerToken}`,
+    `THREADWIRE_SOURCE_TARGET=${binding.source.target}`,
+    `THREADWIRE_CONTEXT_TARGET=${binding.context.target}`,
+    `THREADWIRE_TASK_ID=${binding.taskId}`,
+    `THREADWIRE_SOURCE_READ_ONLY=${binding.source.readOnly}`,
+    `THREADWIRE_EXPECTED_REVISION=${binding.source.revision}`,
+    `THREADWIRE_CONTEXT_MANIFEST_DIGEST=${binding.context.digests.manifest}`,
+    `THREADWIRE_CONTEXT_CONTENT_DIGEST=${binding.context.digests.content}`,
+    `THREADWIRE_CONTEXT_IMAGE_ID=${binding.context.imageId}`,
+    ...(options.resumeSession === undefined ? [] : [`THREADWIRE_RESUME_SESSION=${options.resumeSession}`])
+  ]
+  return {
+    Image: options.image,
+    Labels: workerLabels(options, "kimi", "worker"),
+    Entrypoint: ["node", "/opt/threadwire/docker/kimi-worker-entrypoint.mjs"],
+    Env: environment,
+    WorkingDir: binding.runtime.workdir,
+    User: user,
+    NetworkDisabled: false,
+    HostConfig: {
+      ...workerHostConfig(options.networkName, uid, gid),
+      Mounts: [
+        {Type: "volume", Source: binding.source.volume, Target: binding.source.target, ReadOnly: binding.source.readOnly},
+        {Type: "volume", Source: binding.context.volume, Target: binding.context.target, ReadOnly: true},
+        {Type: "volume", Source: options.stateVolume, Target: "/state", ReadOnly: false}
+      ]
+    }
+  }
+}
+
+/**
+ * A credential-free, offline validator run before a Kimi broker grant exists.
+ * @param {{image: string, binding: unknown, labels: Record<string, string>}} options
+ */
+export function buildKimiBindingValidatorSpec(options) {
+  if (!DIGEST_IMAGE.test(options.image)) throw new Error("Worker image must use an immutable digest")
+  const binding = parseThreadwireBinding(options.binding)
+  if (!plainStringRecord(options.labels)) throw new Error("Kimi validator labels are invalid")
+  const uid = binding.runtime.uid
+  const gid = binding.runtime.gid
+  return {
+    Image: options.image,
+    Labels: {...options.labels},
+    Entrypoint: ["node", "/opt/threadwire/docker/kimi-binding-validator.mjs"],
+    Env: [
+      `THREADWIRE_TASK_ID=${binding.taskId}`,
+      `THREADWIRE_EXPECTED_REVISION=${binding.source.revision}`,
+      `THREADWIRE_CONTEXT_MANIFEST_DIGEST=${binding.context.digests.manifest}`,
+      `THREADWIRE_CONTEXT_CONTENT_DIGEST=${binding.context.digests.content}`,
+      `THREADWIRE_CONTEXT_IMAGE_ID=${binding.context.imageId}`
+    ],
+    WorkingDir: binding.runtime.workdir,
+    User: `${uid}:${gid}`,
+    NetworkDisabled: true,
+    HostConfig: {
+      AutoRemove: false,
+      Mounts: [
+        {Type: "volume", Source: binding.source.volume, Target: binding.source.target, ReadOnly: true},
+        {Type: "volume", Source: binding.context.volume, Target: binding.context.target, ReadOnly: true}
+      ],
+      CapDrop: ["ALL"],
+      NetworkMode: "none",
+      ReadonlyRootfs: true,
+      SecurityOpt: ["no-new-privileges"],
+      PidsLimit: 64,
+      Memory: 268_435_456,
+      NanoCpus: 500_000_000,
+      Tmpfs: {"/tmp": `rw,noexec,nosuid,nodev,size=16777216,uid=${uid},gid=${gid}`},
+      Ulimits: [{Name: "nofile", Soft: 256, Hard: 256}, {Name: "core", Soft: 0, Hard: 0}, {Name: "fsize", Soft: 67_108_864, Hard: 67_108_864}]
+    }
+  }
+}
+
+/**
+ * Role-aware container identity. Codex workers carry the network label; Kimi
+ * containers carry an exact role label (validator/relay/worker) instead, which
+ * is what restart reconciliation requires. The network label is never emitted
+ * for Kimi.
+ * @param {WorkerSpecOptions} options @param {"codex" | "kimi"} provider @param {"validator" | "relay" | "worker"} [role]
+ */
+function workerLabels(options, provider, role) {
+  return {
+    "org.threadwire.owner": "isolated-runtime",
+    ...(options.lineage === undefined ? {} : {
+      "org.threadwire.namespace": options.namespace,
+      "org.threadwire.provider": provider,
+      "org.threadwire.run": options.runId,
+      "org.threadwire.lineage": options.lineage,
+      "org.threadwire.task": options.taskHash,
+      ...(role === undefined ? {"org.threadwire.network": options.networkName} : {}),
+      "org.threadwire.state-volume": options.stateVolume,
+      "org.threadwire.run-seal": options.runSeal,
+      ...(role === undefined ? {} : {"org.threadwire.role": role})
+    })
+  }
+}
+
+/** @param {string} networkName @param {number} uid @param {number} gid */
+function workerHostConfig(networkName, uid, gid) {
+  return {
+    AutoRemove: false,
+    CapDrop: ["ALL"],
+    NetworkMode: networkName,
+    ReadonlyRootfs: true,
+    SecurityOpt: ["no-new-privileges"],
+    PidsLimit: 128,
+    Memory: 1_073_741_824,
+    NanoCpus: 2_000_000_000,
+    Tmpfs: {
+      "/tmp": `rw,noexec,nosuid,nodev,size=67108864,uid=${uid},gid=${gid}`,
+      "/run": `rw,noexec,nosuid,nodev,size=1048576,uid=${uid},gid=${gid}`
+    },
+    Ulimits: [
+      {Name: "nofile", Soft: 1024, Hard: 1024},
+      {Name: "core", Soft: 0, Hard: 0},
+      {Name: "fsize", Soft: 1_073_741_824, Hard: 1_073_741_824}
+    ]
+  }
+}
+
+/** @param {unknown} value */
+function plainStringRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value)
+    && Object.values(value).every((entry) => typeof entry === "string" && SAFE_VALUE.test(entry))
+}
+
+/**
+ * A credential-free, per-run Kimi model relay. The relay is a dumb forwarder:
+ * it knows only the fixed central broker worker URL and its own listen port.
+ * It never receives a grant token, OAuth material, admin token, binding,
+ * source/context/state mount, or Docker socket, so it runs with no mounts and
+ * an empty credential surface on the task daemon.
+ * @param {{image: string, upstreamUrl: string, listenPort: number, networkName: string, labels?: Record<string, string>}} options
+ */
+export function buildKimiRelayContainerSpec(options) {
+  if (!DIGEST_IMAGE.test(options.image)) throw new Error("Kimi relay image must use an immutable digest")
+  if (typeof options.upstreamUrl !== "string" || !SAFE_VALUE.test(options.upstreamUrl)) throw new Error("Kimi relay upstream URL is invalid")
+  if (!Number.isSafeInteger(options.listenPort) || options.listenPort < 1 || options.listenPort > 65535) throw new Error("Kimi relay listen port is invalid")
+  if (typeof options.networkName !== "string" || !SAFE_VALUE.test(options.networkName)) throw new Error("Kimi relay network is invalid")
+  if (options.labels !== undefined && !plainStringRecord(options.labels)) throw new Error("Kimi relay labels are invalid")
+  const uid = 10003
+  const gid = 10003
+  return {
+    Image: options.image,
+    Labels: {
+      "org.threadwire.owner": "isolated-runtime",
+      ...(options.labels === undefined ? {} : {...options.labels})
+    },
+    Entrypoint: ["node", "/opt/threadwire/docker/kimi-model-relay-entrypoint.mjs"],
+    Env: [
+      "PATH=/usr/local/bin:/usr/bin:/bin",
+      "NODE_VERSION=",
+      "YARN_VERSION=",
+      `THREADWIRE_KIMI_RELAY_UPSTREAM_URL=${options.upstreamUrl}`,
+      `THREADWIRE_KIMI_RELAY_LISTEN_PORT=${options.listenPort}`
+    ],
+    User: `${uid}:${gid}`,
+    NetworkDisabled: false,
+    HostConfig: {
+      AutoRemove: false,
+      Mounts: [],
+      CapDrop: ["ALL"],
+      NetworkMode: options.networkName,
+      ReadonlyRootfs: true,
+      SecurityOpt: ["no-new-privileges"],
+      PidsLimit: 64,
+      Memory: 268_435_456,
+      NanoCpus: 500_000_000,
+      Tmpfs: {
+        "/tmp": `rw,noexec,nosuid,nodev,size=16777216,uid=${uid},gid=${gid}`
+      },
+      Ulimits: [
+        {Name: "nofile", Soft: 256, Hard: 256},
+        {Name: "core", Soft: 0, Hard: 0},
+        {Name: "fsize", Soft: 67_108_864, Hard: 67_108_864}
+      ]
+    }
+  }
+}
+
 /** @param {string} path */
 function withinWorktree(path) {
   return path === "/worktree" || path.startsWith("/worktree/")

package/src/kimi-model-broker-policy.js

@@ -69,6 +69,15 @@ export function createKimiGrantStore(options = {}) {
       if (!grant.active) throw new Error("Kimi broker grant pending")
       return {...grant}
     },
+    /** @param {string} token @param {number} ttlMs */
+    renew(token, ttlMs) {
+      if (!Number.isSafeInteger(ttlMs) || ttlMs < 1 || ttlMs > 3_600_000) throw new Error("Invalid Kimi broker grant")
+      const grant = grants.get(token)
+      if (!grant) throw new Error("Kimi broker grant unknown token")
+      if (grant.expiresAt < now()) throw new Error("Kimi broker grant expired")
+      grant.expiresAt = now() + ttlMs
+      return {...grant}
+    },
     /** @param {string} token */
     revoke(token) { grants.delete(token) },
     clear() { grants.clear() }
@@ -83,10 +92,7 @@ export function createKimiGrantStore(options = {}) {
 function currentGrant(grants, token, now) {
   const grant = grants.get(token)
   if (!grant) throw new Error("Kimi broker grant unknown token")
-  if (grant.expiresAt < now()) {
-    grants.delete(token)
-    throw new Error("Kimi broker grant expired")
-  }
+  if (grant.expiresAt < now()) throw new Error("Kimi broker grant expired")
   return grant
 }
 
@@ -107,7 +113,12 @@ export function validateKimiChatBody(body, allowedModel) {
   if (topLevelKeyCount(text, "model") !== 1) throw denied()
   let value
   try { value = JSON.parse(text) } catch { throw denied() }
-  if (!record(value) || Object.keys(value).some((key) => !BODY_KEYS.has(key))) throw denied()
+  if (!record(value)) throw denied()
+  const unknownKeys = Object.keys(value).filter((key) => !BODY_KEYS.has(key))
+  if (unknownKeys.length > 0) {
+    const safeKeys = unknownKeys.every((key) => /^[a-z][a-z0-9_]{0,63}$/u.test(key)) ? unknownKeys.sort().join(",") : "unsafe"
+    throw new Error(`Kimi broker request denied body keys: ${safeKeys}`)
+  }
   if (value.model !== allowedModel || !Array.isArray(value.messages) || value.stream !== true) throw denied()
   if (value.messages.length === 0 || value.messages.length > 4096 || !value.messages.every(validMessage)) throw denied()
   if (value.tools !== undefined && (!Array.isArray(value.tools) || value.tools.length > 512 || !value.tools.every(record))) throw denied()