threadwire 0.1.12 → 0.1.13

package/CHANGELOG.md

@@ -2,6 +2,8 @@
 
 ## Unreleased
 
+## 0.1.13 - 2026-08-01
+
 - Remove the default one-hour full-run deadline from the isolated runtime: when `THREADWIRE_ISOLATED_RUNTIME_CLIENT_TIMEOUT_MS` (client) and `THREADWIRE_WORKER_TIMEOUT_MS` (supervisor) are unset or blank, a healthy running worker continues until natural completion, caller cancellation/disconnect, supervisor shutdown, or concrete failure. Setting either to a positive millisecond value enables the existing single absolute preflight+run deadline with unchanged validation and caps. Compose no longer inserts numeric timeout defaults. Preflight admission, per-operation Docker/network calls, state collection (30 seconds), and emergency cleanup stay independently bounded.
 - Add authenticated broker grant-lease renewal (Kimi and Codex): grants are issued as a bounded lease (default 60 seconds, `THREADWIRE_GRANT_LEASE_MS`, capped at one hour) that the supervisor renews via `POST /admin/grants/{token}/renew` while the run is active. Cleanup still revokes explicitly; if the supervisor dies or loses contact, renewals stop and the broker expires and aborts the grant within one lease. Malformed renewals (unknown/expired token, invalid ttlMs, missing admin auth) fail closed without extending the grant, and no renewal route exists on worker endpoints.
 - Add Kimi-only Threadwire binding v1 named-volume admission: task-labelled source/context/lease validation, immutable context manifest validation, offline validator, dynamic task UID/GID workers with context RO/state RW mounts and an exact binding-declared source mount mode, and v5 authenticated binding state. Kimi path/worktree preflights and supervisor host workspace/socket mounts are no longer accepted.
@@ -12,6 +14,19 @@
 - Reconcile exact relay/worker/network/state/grant identity on restart: genuine resources are adopted and cleaned up by their exact sealed spec, while image, mount, network, or environment tampering fails closed and retains authenticated cleanup evidence. The sealed Kimi worker/validator/relay image is the resolved image content Id (the worker/validator pin the binding's `contextImageId`; the relay pins its inspected image Id), matching how Docker normalizes a created container's `Config.Image`, so a genuine crash survivor is recognized rather than retained as a cleanup failure. The validator and relay environments accept legitimate non-sensitive keys inherited from the image while every owned key must match its sealed value exactly once and any injected sensitive or controlled key fails closed.
 - Qualify genuine separate-daemon fresh/resume/denial/read-only/concurrency operation with zero residue: adversarial split-daemon E2E proves exact resume, read-only review mounts, binding/argument denial, concurrent task isolation, and complete relay/network/state cleanup on the task DinD.
 
+- Remove workspace profiles from normal provider execution. `--cwd` now passes
+  any caller-accessible directory directly to Codex, Claude, Kimi, and
+  OpenCode; no Git, source identity, task binding, or root-allowlist lookup is
+  performed. `--workspace-profile` is rejected—migrate invocations to
+  `--cwd <directory>`. Native Kimi is the default path, supports
+  `THREADWIRE_KIMI_BIN`, translates exact `--resume-session` values to Kimi's
+  native `--session` option, and passes compatible provider arguments while
+  Threadwire retains prompt and stream-output ownership. The optional isolated
+  Kimi path remains explicit and fail-closed without native fallback.
+- Preserve only the explicit caller-owned native Kimi configuration contract,
+  report exactly one completed or failed terminal lifecycle outcome, and reject
+  provider option terminators that could neutralize Threadwire-owned arguments.
+
 ## 0.1.10 - 2026-07-28
 
 - Accept official slash-qualified Kimi model aliases through workspace-free

package/README.md

@@ -1,6 +1,6 @@
 # Threadwire
 
-Threadwire is a Node.js CLI that launches a Codex, Claude, or OpenCode worker and streams a concise, human-readable activity feed to one explicitly selected Telegram destination: a direct message, normal chat, or forum topic. The default feed includes the assistant's response prose, lifecycle outcomes, and diagnostics. Provider tool-status messages are disabled by default.
+Threadwire is a Node.js CLI that launches a Codex, Claude, Kimi, or OpenCode worker and streams a concise, human-readable activity feed to one explicitly selected Telegram destination: a direct message, normal chat, or forum topic. The default feed includes the assistant's response prose, lifecycle outcomes, and diagnostics. Provider tool-status messages are disabled by default.
 
 For the container-native webhook deployment, including its named-volume worktree,
 non-root Codex provider, Docker secrets, loopback TLS proxy, verification, and
@@ -8,8 +8,7 @@ rollback path, see [Container runtime](docs/container-runtime.md). The legacy
 host launcher below remains supported and is separate from that deployment.
 
 Relay-originated Codex writes are explicit and default off. `--relay-write`
-requires a reviewed `--workspace-profile` plus the root-owned isolated runtime
-and credential broker. The worker gets one writable task worktree, no upstream
+selects the optional root-owned isolated runtime and credential broker. The worker gets one writable task worktree, no upstream
 or Git credential, and no route except its run-scoped broker. Missing
 prerequisites fail before prompt or credential reads with no native fallback.
 The isolated runtime imposes no default full-run deadline: a healthy running
@@ -71,11 +70,11 @@ Use the local launcher. Install or refresh it after updating Threadwire with `np
 
 The target always has the form `telegram:<chat-id>:<thread-id>` for topics, or `telegram:<chat-id>` for direct messages (DMs) and ordinary chats. The chat ID is always required and must be a nonzero signed integer. The thread ID is optional and valid only as the explicit topic suffix: when present it must be a positive safe integer, and a DM target simply omits it — a missing thread ID is never an error. `--provider` must be exactly one of `codex`, `claude`, `kimi`, or `opencode`. Malformed or missing provider, chat ID, or thread ID arguments are hard failures (exit code 2) reported through Threadwire's normal error path with fixed messages; they fail before the Telegram token is read, before any transport is created, and before any provider is launched, and the messages never echo the bot token or the untrusted argument value. `--process-number` accepts an explicit positive safe integer for automation; when omitted, Threadwire uses its launcher PID. Every Telegram message is labeled consistently, such as `[P42] …`, including chunked continuations.
 
-Pass `--workspace-profile <name>` only when invoking Threadwire inside the container-native runtime, for example with `node bin/threadwire.js run` as shown in [Container runtime](docs/container-runtime.md). A profile selects a reviewed entry from the checked-in [threadwire.workspace-profiles.json](threadwire.workspace-profiles.json). Non-Kimi providers resolve the reviewed in-container repository path and Git provenance. Kimi instead requires the v2 `threadwire-v1` profile marker and a trusted `THREADWIRE_KIMI_TASK_BINDING`; it never accepts a repository path preflight. The binding names the task-owned source/context volumes, immutable context digests, revision, runtime identity, and live lease. Only safe provenance is recorded locally.
+`--cwd` is the complete workspace contract for every provider. It may name any caller-accessible directory, including a non-Git directory. Threadwire passes it unchanged to the native provider and performs no profile, repository, source-identity, task-binding, or root-allowlist lookup. `--workspace-profile` has been removed and is rejected; migrate invocations by replacing it with `--cwd <directory>`.
 
-Provider tool-start and tool-finish events do not produce Telegram messages by default. Pass the boolean `--tool-messages` flag to opt in, as shown above. When enabled, each tool is one concise, silent status line rather than a pair of noisy start/finish notices: when a tool starts, Threadwire sends `🛠 [P42] Tool: <safe command or tool description>` (for example `🛠 [P42] Tool: command — git status --short`), and when that same tool finishes, it edits the original message in place so it begins `✅` instead — no second completion message is sent, and Telegram edits raise no notification. The command/description shows a safe CLI-style preview with credential-bearing values (tokens, passwords, keys, authorization/cookie forms, credentials in URLs) redacted and control characters stripped; only normalized Codex command-completion output may also be appended to that same edited status as a Telegram-native expandable HTML blockquote with the visible label `Output →`; it is credential-redacted, HTML-escaped, and Unicode-safe bounded. Stderr, reasoning, and every other raw provider result remain excluded. Use `--max-output-length <positive-integer>` to truncate only that preview Unicode-safely; omit the option for unlimited tool detail. A prompt may instead come from `--prompt-file` or piped stdin, and every source rejects blank/whitespace content. Arguments following `--` pass to the selected provider, except output-stream options owned by Threadwire. Kimi is narrower: it always uses the dedicated isolated subscription runtime and accepts only one server-approved model alias through `--model <alias>` (or `-m <alias>`); Threadwire owns its prompt, output, session, permissions, configuration, tools, skills, plugins, MCP, and directories.
+Provider tool-start and tool-finish events do not produce Telegram messages by default. Pass the boolean `--tool-messages` flag to opt in, as shown above. When enabled, each tool is one concise, silent status line rather than a pair of noisy start/finish notices: when a tool starts, Threadwire sends `🛠 [P42] Tool: <safe command or tool description>` (for example `🛠 [P42] Tool: command — git status --short`), and when that same tool finishes, it edits the original message in place so it begins `✅` instead — no second completion message is sent, and Telegram edits raise no notification. The command/description shows a safe CLI-style preview with credential-bearing values (tokens, passwords, keys, authorization/cookie forms, credentials in URLs) redacted and control characters stripped; only normalized Codex command-completion output may also be appended to that same edited status as a Telegram-native expandable HTML blockquote with the visible label `Output →`; it is credential-redacted, HTML-escaped, and Unicode-safe bounded. Stderr, reasoning, and every other raw provider result remain excluded. Use `--max-output-length <positive-integer>` to truncate only that preview Unicode-safely; omit the option for unlimited tool detail. A prompt may instead come from `--prompt-file` or piped stdin, and every source rejects blank/whitespace content. Arguments following `--` pass to the selected provider, except output-stream and session options owned by Threadwire. Native Kimi uses the caller's compatible configuration. Threadwire maps its public `--resume-session <exact-id>` option to Kimi's native `--session <exact-id>` option and owns `--prompt` plus `--output-format stream-json`. The caller environment or image must provide the Kimi executable at `/usr/local/bin/kimi` or set `THREADWIRE_KIMI_BIN`; a missing executable fails normally.
 
-Threadwire directly spawns the structurally separate terminal adapters `/opt/data/libexec/threadwire/codex`, `/opt/data/libexec/threadwire/claude`, or `/opt/data/libexec/threadwire/opencode-local-fleet` with an argv array and `shell: false`. These libexec adapters hold the real provider-CLI logic and are never on a worker's `PATH`, so relaying can never recurse back into the front-door shims. Each spawn also sets `THREADWIRE_ACTIVE=1` in the provider child environment. The executable can be overridden per provider with `THREADWIRE_CODEX_BIN`, `THREADWIRE_CLAUDE_BIN`, or `THREADWIRE_OPENCODE_BIN` for staged cutover and rollback. It does not impose a worker timeout. `SIGINT` and `SIGTERM` are forwarded to the worker as explicit cancellation.
+Threadwire directly spawns the structurally separate terminal adapters `/opt/data/libexec/threadwire/codex`, `/opt/data/libexec/threadwire/claude`, `/usr/local/bin/kimi`, or `/opt/data/libexec/threadwire/opencode-local-fleet` with an argv array and `shell: false`. These libexec adapters hold the real provider-CLI logic and are never on a worker's `PATH`, so relaying can never recurse back into the front-door shims. Each spawn also sets `THREADWIRE_ACTIVE=1` in the provider child environment. The executable can be overridden per provider with `THREADWIRE_CODEX_BIN`, `THREADWIRE_CLAUDE_BIN`, `THREADWIRE_KIMI_BIN`, or `THREADWIRE_OPENCODE_BIN` for staged cutover and rollback. It does not impose a worker timeout. `SIGINT` and `SIGTERM` are forwarded to the worker as explicit cancellation.
 
 ## Provider front-door shims
 
@@ -83,11 +82,11 @@ Threadwire directly spawns the structurally separate terminal adapters `/opt/dat
 
 The relay contract: the caller supplies `THREADWIRE_TARGET` (`telegram:<chat-id>` or `telegram:<chat-id>:<thread-id>`) and, optionally, `THREADWIRE_PROCESS_NUMBER`. The prompt arrives on a piped stdin; all native provider flags pass through after `--`. A positional prompt is never parsed. A missing `THREADWIRE_TARGET` fails closed (exit code 2) and a malformed one is rejected by the launcher's token-free preflight — the shim never invents a default destination and never silently downgrades a requested relay to a direct run. A shim relays only for a worker mode (`codex exec …`, `opencode-local-fleet run …`, or any non-interactive `claude …`); it drops the worker subcommand before relaying and Threadwire re-adds it around the prompt. Version and help queries, non-worker subcommands, interactive TTY sessions, and any invocation already inside a relayed run (`THREADWIRE_ACTIVE=1`, so nested provider workers stay local/native) run the real CLI directly through the libexec adapter.
 
-Pass `--resume-session <exact-provider-session-id>` to continue a stored Codex, Claude, or OpenCode session. Threadwire preserves the provider's native resume ordering and streaming options and never uses implicit latest-session behavior.
+Pass `--resume-session <exact-provider-session-id>` to continue a stored Codex, Claude, Kimi, or OpenCode session. Threadwire preserves the provider's native resume ordering and streaming options and never uses implicit latest-session behavior.
 
 Pass `--transcript <path>` to capture the exact normalized, caller-facing JSONL protocol written to run stdout. The file is created privately (mode `0600`), must not already exist, and contains the same records in the same byte order as stdout. It never contains provider JSONL, reasoning, tool payloads, prompts, stderr, or credentials.
 
-`--activity-log <path>` is different: it retains its append contract and writes only minimal safe lifecycle facts—the selected workspace profile and immutable provenance, provider start (`provider`, child `pid`), and available native session ID. It is local-only and never enters Telegram or normalized stdout.
+`--activity-log <path>` is different: it retains its append contract and writes only minimal safe lifecycle facts—provider start (`provider`, child `pid`) and available native session ID. It is local-only and never enters Telegram or normalized stdout.
 
 Provider stdout is decoded as JSONL with a finite 1 MiB UTF-8 byte limit for each pending unterminated record. Exceeding it rejects the run, removes listeners and signal handlers, and terminates the provider without parsing or rendering the oversized content.
 

package/TELEGRAM-INGRESS.md

@@ -1,10 +1,10 @@
 # Telegram Ingress for Threadwire
 
 Standalone Threadwire webhook service that accepts Telegram Bot API updates.
-Codex, Claude, and OpenCode retain the existing worker behavior. Kimi always
-uses its dedicated isolated preflight/run authority with no native fallback;
-a missing Kimi runtime fails before provider or transport construction. Hermes
-is not involved.
+Codex, Claude, Kimi, and OpenCode use their native provider adapter by default.
+An operator may explicitly configure the Kimi isolated client; that selected
+path remains fail-closed and never falls back to native execution. Hermes is
+not involved.
 
 ## Important bot ownership
 
@@ -83,9 +83,9 @@ Optional:
 | `THREADWIRE_TELEGRAM_REQUEST_TIMEOUT_MS` | Deadline for each outbound Telegram request, including response parsing (default `30000`, positive safe integer no greater than `2147483647`) |
 | `THREADWIRE_UPDATE_ID_CAPACITY` | Max retained completed `update_id` entries (default `10000`) |
 | `THREADWIRE_UPDATE_ID_TTL_MS` | Retention TTL for completed `update_id` entries in ms (default `86400000`) |
-| `THREADWIRE_KIMI_ISOLATED_RUNTIME_URL` | Dedicated Kimi supervisor URL; Compose defaults to `http://kimi-isolated-runtime:8790` |
-| `THREADWIRE_KIMI_ISOLATED_RUNTIME_CONTROL_TOKEN` | Dedicated Kimi control token. When absent, `/code kimi` remains recognized but fails closed before launch. |
-| `THREADWIRE_KIMI_TASK_BINDING` | Trusted closed Threadwire binding v1 JSON. It is captured before provider filtering, sent only to Kimi preflight, and is never forwarded to a provider or worker. |
+| `THREADWIRE_KIMI_ISOLATED_RUNTIME_URL` | Optional dedicated Kimi supervisor URL, used only with an explicit control token. |
+| `THREADWIRE_KIMI_ISOLATED_RUNTIME_CONTROL_TOKEN` | Selects the optional dedicated Kimi isolation client. Without it, `/code kimi` runs natively. |
+| `THREADWIRE_KIMI_TASK_BINDING` | Optional trusted binding used only by the explicitly selected Kimi isolation client; native Kimi never reads it. |
 | `THREADWIRE_ISOLATED_RUNTIME_CLIENT_TIMEOUT_MS` | Optional absolute preflight+run deadline in ms for isolated (Codex relay-write and Kimi) runs. Empty/unset means no full-run deadline: a healthy running worker is never stopped merely because time elapsed. The supervisor-side equivalent is `THREADWIRE_WORKER_TIMEOUT_MS`. Broker grants always use a bounded lease renewed by the supervisor while the run is active, expiring within one lease if the supervisor dies; unrelated safety timeouts are unchanged. |
 
 ## Run

package/docs/container-runtime.md

@@ -84,16 +84,13 @@ docker compose exec -T threadwire sh -c 'test "$(id -u):$(id -g)" = 10001:10001
 
 Telegram commands derive their explicit destination from the authenticated
 update. A credentialed direct smoke test must also name a target explicitly and
-keeps both credentials mounted as secret files. The checked-in
-`container-runtime` workspace profile points to the bootstrapped
-`/workspace/threadwire` worktree inside the current runtime, so `threadwire run`
-selects that reviewed in-container workspace directly rather than deriving a
-path from ambient host state or Telegram input:
+keeps both credentials mounted as secret files. Direct execution supplies the
+caller-accessible working directory explicitly:
 
 ```sh
 node bin/threadwire.js run \
   --provider codex --target telegram:-1001234567890:42 \
-  --workspace-profile container-runtime \
+  --cwd /workspace/threadwire \
   --prompt 'Inspect the container worktree.'
 ```
 
@@ -114,27 +111,11 @@ permissions that deny the provider, or move it to a separate container or
 sandbox. The same-UID, same-container, capability-free design cannot truthfully
 provide that stronger boundary.
 
-With `--workspace-profile`, `threadwire run` emits one caller-facing
-`execution_environment` JSONL record before provider startup. It includes only
-the resolved profile name, in-container repository path, exact Git revision,
-and immutable worktree identity; it never includes Telegram or provider
-credentials.
-
-The same reviewed profile file also governs authenticated webhook launches. The
-default profile is selected server-side; Telegram message text never supplies a
-raw path, container identifier, executable path, Git URL, or environment
-assignment. Before every spawn, Threadwire verifies that the configured
-workspace still exists, is still a Git worktree at the configured root, and
-still has a stable revision/worktree identity. If the worktree is removed or
-unhealthy, spawn fails before the provider starts so Telegram can retry after
-remediation.
-
-Provision profile changes and revision updates entirely inside the container
-worktree. Edit `threadwire.workspace-profiles.json` in `/workspace/threadwire`,
-commit the reviewed change in that worktree, and let the existing bootstrap and
-rollback flow move the whole repository plus its `.threadwire-source-identity`
-forward or backward together. Do not introduce host-only paths, Docker CLI
-arguments, or Compose-generated container names into the profile file.
+`--workspace-profile` is removed and rejected. Threadwire does not inspect Git,
+source identity, task binding, or workspace allowlists for normal provider
+launches. Telegram ingress uses its own process working directory unless its
+operator supplies another caller-accessible directory through the embedding
+configuration; Telegram message text never supplies a path.
 
 ## Verification and leakage audit
 
@@ -205,10 +186,13 @@ Never export or archive mounted secret files with workspace/provider backups.
 
 Kimi source is not a host worktree. The task controller creates one labelled source named volume (including its `.git` directory), one labelled immutable context named volume, and a running labelled lease container. The trusted Kimi supervisor reaches only the owning task-DinD API through `THREADWIRE_KIMI_TASK_DOCKER_HOST`; it has no workspace bind or outer Docker socket. It verifies the closed binding, exact labels/volume identities, lease image/user/workdir/mounts, references, Git revision, and manifest before issuing a broker grant. The worker has exactly the binding-declared source mount at `/workspace` (read-write for implementation sources, read-only for review sources), context RO at `/context`, and lineage state RW at `/state`. The worker entrypoint independently revalidates the mounted context manifest task/image identity and the exact source mount mode before Kimi starts; a mismatched manifest task identity or mount mode fails the run closed.
 
-Kimi is intentionally excluded from the same-UID container-native provider
-launch described above. Never mount `threadwire-kimi-oauth`, its access/refresh
-tokens, or the auth home into the Threadwire runtime, supervisor, worker,
-workspace, or session-state volume. Kimi uses five immutable build targets:
+The checked-in standard `runtime` image installs Codex only: it does not install
+Kimi or provide Kimi credentials. Native Kimi therefore requires a caller image
+or environment that provides `/usr/local/bin/kimi` (or sets
+`THREADWIRE_KIMI_BIN`); a missing executable fails normally. Never mount
+`threadwire-kimi-oauth`, its access/refresh tokens, or the auth home into the
+Threadwire runtime, supervisor, worker, workspace, or session-state volume.
+The optional isolated Kimi flow uses five immutable build targets:
 `kimi-auth`, `kimi-model-broker`, `kimi-model-relay`, `kimi-relay-worker`, and
 `isolated-runtime`.
 The first two share UID/GID 10003 and only the OAuth volume; the credential-free
@@ -239,9 +223,9 @@ listener until an explicit nonempty bind is configured, so the sentinel is
 never an operational default.
 Only the worker port is published, on that bind — the admin endpoint stays on
 the internal control network.
-The default workspace profile allowlists Kimi because isolation is mandatory;
-without the dedicated Kimi control token/client, both CLI and Telegram Kimi
-jobs fail closed rather than using the native child path. Keep broker egress
+The optional Kimi supervisor is selected only by its dedicated control
+token/client. Without that explicit selection, CLI and Telegram Kimi jobs use
+the native child path and caller/provider configuration. Keep broker egress
 restricted to official Kimi Code subscription/auth endpoints and do not provide
 a Moonshot API key, custom base URL, Docker socket, or ingress secret.
 

package/docs/isolated-provider-runtime.md

@@ -1,7 +1,7 @@
 # Isolated provider runtime
 
 Relay-originated Codex writes are disabled unless the caller supplies both
-`--relay-write` and a reviewed `--workspace-profile`. The write path never
+`--relay-write` and an explicitly selected supervisor. The write path never
 falls back to the native provider launcher.
 When the Telegram service is configured with isolated-runtime authority, Codex
 webhook jobs use the same preflight/run boundary exclusively; an unavailable
@@ -155,7 +155,15 @@ by that script. E2E uses host-volume canaries and fake-upstream authorization
 logs; worker self-report is not the sole assertion.
 
 
-## Native Kimi Code subscription boundary
+## Optional isolated Kimi Code subscription boundary
+
+Normal `threadwire run --provider kimi` is native execution: it directly runs
+the caller-provided Kimi executable at `/usr/local/bin/kimi`, or the path in
+`THREADWIRE_KIMI_BIN`. It does not select this isolated supervisor, broker, or
+model allowlist. The checked-in standard `runtime` image installs Codex only,
+so native Kimi needs a caller-supplied executable and fails normally when it is
+missing. The remaining section documents the separately configured, optional
+isolated Kimi supervisor.
 
 Kimi binding v1 is separate from the Codex worktree contract. A Kimi preflight contains `binding`, never `repositoryRoot` or `cwd`. The supervisor queries the task-DinD daemon for exactly one labelled source volume, context volume, and running lease, rejects ambiguity/RW context references, validates the lease and worker image, then uses an offline two-volume validator to check the real Git revision and complete immutable context manifest. Only after that does it create the per-run data plane on the task daemon: a private internal worker network, a task-owned non-internal egress network, one credential-free relay attached to both, and a three-volume Kimi worker attached only to the internal network. OAuth remains broker-only; workers receive a synthetic per-run grant and no raw binding, volume, lease, control, or OAuth value. Kimi v6 state seals include the binding digest, source/context identities, source mount mode, dynamic UID/GID/workdir, validator, worker, relay, relay image, both networks, the central endpoint identity, state, and image. Old path-based and pre-relay Kimi state is intentionally not adopted.
 
@@ -226,7 +234,8 @@ Its fixed entrypoint owns `--model`, optional exact `--session`, `--prompt`,
 `--output-format stream-json`, and an empty skills directory. Static deny rules,
 workspace/config ancestry checks, a sanitized private home, read-only root,
 and the existing mount/inode checks remain mandatory. There is no native unsafe
-fallback and no `THREADWIRE_KIMI_BIN` control.
+fallback within the explicitly selected isolated path. Normal Kimi execution
+uses the native adapter and may use `THREADWIRE_KIMI_BIN`.
 
 Only exact pinned stream records are normalized: assistant string content,
 validated tool name/key start and finish, and one exact
@@ -263,7 +272,8 @@ such as:
 export THREADWIRE_ALLOWED_KIMI_MODELS='{"default":{"model":"kimi-for-coding","protocol":"kimi"},"kimi-code/kimi-for-coding":{"model":"kimi-for-coding","protocol":"kimi"}}'
 ```
 
-`default` is the server-owned selection for no-argument and Telegram jobs.
+`default` is the server-owned selection for isolated supervisor jobs without a
+model argument.
 `kimi-code/kimi-for-coding` is the exact official provider-qualified alias for
 explicit callers. Each key is an opaque allowlisted value, not a path, and
 Threadwire never normalizes or strips its prefix. The `model` field is the
@@ -272,8 +282,8 @@ alias.
 
 OAuth writes only the named `threadwire-kimi-oauth` volume at the official
 `credentials/kimi-code.json` location. Stop the broker during interactive auth
-so the CLI and broker cannot race a refresh, then run the opt-in, workspace-free
-auth service:
+so the auth CLI and broker cannot race a refresh, then run the opt-in,
+workspace-free auth service:
 
 ```sh
 docker compose -f compose.yaml -f compose.relay-write.yaml stop kimi-isolated-runtime kimi-model-broker
@@ -288,20 +298,12 @@ The auth service has no workspace, ingress network, Docker socket, Threadwire
 control token, or Telegram credential and uses Docker logging driver `none`.
 `verify <provider-qualified-alias>` discards native output and prints only a
 fixed success/failure; use it to confirm each exact official alias before
-adding that alias and its independently verified wire model to the server
-allowlist. An explicit CLI job selects the exact key as one argv value:
-
-```sh
-node bin/threadwire.js run \
-  --provider kimi \
-  --target telegram:-1001234567890:42 \
-  --workspace-profile container-runtime \
-  --prompt 'Inspect the project.' \
-  -- --model 'kimi-code/kimi-for-coding'
-```
+adding that alias and its independently verified wire model to the isolated
+supervisor allowlist. This operator configuration does not configure or select
+the native CLI Kimi model.
 
-API keys, Moonshot platform mode, custom base URLs, discovery by ordinary jobs,
-and arbitrary aliases are unsupported.
+For the isolated supervisor, API keys, Moonshot platform mode, custom base
+URLs, discovery by ordinary jobs, and arbitrary aliases are unsupported.
 
 For logout or account rotation, stop the Kimi runtime and broker, run
 `--profile kimi-auth run --rm kimi-auth logout` or `login`, verify approved
@@ -322,7 +324,8 @@ payload, or synthetic grant.
 
 Rollback by stopping `kimi-isolated-runtime` and `kimi-model-broker`, removing
 the `kimi` Compose profile/control variables, and reverting the Threadwire image.
-Kimi commands then fail closed; Codex behavior is unaffected. Preserve the OAuth
+Isolated Kimi requests then fail closed; native Kimi remains independent of
+that optional deployment. Codex behavior is unaffected. Preserve the OAuth
 and Kimi state volumes for a recoverable rollback. Remove them only as an
 explicit credential/session teardown after OAuth revocation; never archive them
 with workspace backups.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "threadwire",
-  "version": "0.1.12",
+  "version": "0.1.13",
   "description": "Stream Codex, Claude, Kimi Code, and OpenCode worker progress to an explicit Telegram destination",
   "keywords": [
     "ai-agent",
@@ -20,8 +20,7 @@
     "docs/",
     "scripts/",
     "src/",
-    "TELEGRAM-INGRESS.md",
-    "threadwire.workspace-profiles.json"
+    "TELEGRAM-INGRESS.md"
   ],
   "bin": {
     "threadwire-isolated-runtime": "bin/isolated-runtime.js",

package/scripts/provider-shims/front-door.sh.template

@@ -58,15 +58,11 @@ threadwire_relay_arguments=(run --provider "$THREADWIRE_PROVIDER" --target "$THR
 case "${THREADWIRE_RELAY_WRITE:-0}" in
   0) ;;
   1)
-    if [[ ! "${THREADWIRE_WORKSPACE_PROFILE:-}" =~ ^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$ ]]; then
-      printf '%s\n' 'threadwire: relay write capability requires a valid THREADWIRE_WORKSPACE_PROFILE' >&2
-      exit 2
-    fi
     if [[ "$THREADWIRE_PROVIDER" != codex ]]; then
       printf '%s\n' 'threadwire: relay write capability is only supported for codex' >&2
       exit 2
     fi
-    threadwire_relay_arguments+=(--workspace-profile "$THREADWIRE_WORKSPACE_PROFILE" --relay-write)
+    threadwire_relay_arguments+=(--relay-write)
     ;;
   *)
     printf '%s\n' 'threadwire: relay write capability must be enabled with THREADWIRE_RELAY_WRITE=1' >&2

package/scripts/verify-package.js

@@ -79,9 +79,7 @@ const EXPECTED_FILES = [
   "src/telegram-webhook.js",
   "src/threadwire-binding.js",
   "src/types.js",
-  "src/worker-control.js",
-  "src/workspace-profile.js",
-  "threadwire.workspace-profiles.json"
+  "src/worker-control.js"
 ]
 
 /** @returns {Promise<void>} */

package/src/activity-log.js

@@ -3,9 +3,6 @@
 import {closeSync, openSync, writeSync} from "node:fs"
 
 const SESSION_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,511}$/u
-const PROFILE_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u
-const REVISION_PATTERN = /^[0-9a-f]{40}$/u
-const SOURCE_IDENTITY_PATTERN = /^[0-9a-f]{40}$|^[0-9a-f]{64}$/u
 
 export class ActivityLog {
   /** @param {string} path */
@@ -14,16 +11,6 @@ export class ActivityLog {
     this.closed = false
   }
 
-  /** @param {string} profile @param {string} repositoryRoot @param {string} revision @param {string} sourceIdentity */
-  recordWorkspace(profile, repositoryRoot, revision, sourceIdentity) {
-    if (!PROFILE_PATTERN.test(profile)) throw new Error("Workspace profile is invalid")
-    if (typeof repositoryRoot !== "string" || repositoryRoot.length === 0) throw new Error("Workspace repository root is invalid")
-    if (!REVISION_PATTERN.test(revision) || !SOURCE_IDENTITY_PATTERN.test(sourceIdentity)) {
-      throw new Error("Workspace provenance is invalid")
-    }
-    this.write({type: "workspace-selected", profile, repositoryRoot, revision, sourceIdentity})
-  }
-
   /** @param {"codex" | "claude" | "kimi" | "opencode"} provider @param {number} pid */
   recordStarted(provider, pid) {
     if (!Number.isSafeInteger(pid) || pid <= 0) throw new Error("Provider child PID is unavailable")
@@ -42,7 +29,7 @@ export class ActivityLog {
     closeSync(this.fileDescriptor)
   }
 
-  /** @param {{type: "workspace-selected", profile: string, repositoryRoot: string, revision: string, sourceIdentity: string} | {type: "provider-started", provider: "codex" | "claude" | "kimi" | "opencode", pid: number} | {type: "session-available", provider: "codex" | "claude" | "kimi" | "opencode", sessionId: string}} fact */
+  /** @param {{type: "provider-started", provider: "codex" | "claude" | "kimi" | "opencode", pid: number} | {type: "session-available", provider: "codex" | "claude" | "kimi" | "opencode", sessionId: string}} fact */
   write(fact) {
     if (this.closed) throw new Error("Activity log is closed")
     writeSync(this.fileDescriptor, `${JSON.stringify(fact)}\n`)

package/src/cli.js

@@ -11,20 +11,16 @@ import {runWorker} from "./run-worker.js"
 import {ActivityLog} from "./activity-log.js"
 import {DelegatedResultAdmission, validateContinuationHandle} from "./delegated-result-admission.js"
 import {buildProviderEnvironment, collectEvidenceRedactions, parseTelegramRequestTimeoutMs, resolveFileBackedSettings} from "./telegram-ingress/config.js"
-import {resolveWorkspaceProfile} from "./workspace-profile.js"
 import {WorkerControl} from "./worker-control.js"
 import {EvidenceStore} from "./evidence-store.js"
 import {ContextBudgetMetrics} from "./context-budget-metrics.js"
-import {isolatedRuntimeClientFromEnvironment, kimiIsolatedRuntimeClientFromEnvironment} from "./isolated-runtime-client.js"
-import {parseTrustedThreadwireBinding} from "./threadwire-binding.js"
-import {kimiSessionEnvelopeId} from "./providers/kimi.js"
+import {isolatedRuntimeClientFromEnvironment} from "./isolated-runtime-client.js"
 import {validateRelayWriteProviderArguments} from "./relay-write.js"
 import {abortable} from "./absolute-deadline.js"
 import {NormalizedOutput} from "./normalized-output.js"
 
 const HELP = `Usage: threadwire run --provider <codex|claude|kimi|opencode> --target telegram:<chat-id> | telegram:<chat-id>:<thread-id>
   [--process-number <positive-integer>] [--cwd <directory>]
-  [--workspace-profile <name>]
   [--relay-write]
   [--tool-messages] [--max-output-length <positive-integer>]
   [--resume-session <provider-session-id>] [--transcript <normalized-jsonl-path>]
@@ -34,7 +30,7 @@ const HELP = `Usage: threadwire run --provider <codex|claude|kimi|opencode> --ta
        threadwire evidence read --handle <opaque-handle>
   (--bytes <offset>:<limit> | --lines <start>:<limit> | --query <literal> --context-bytes <limit>)`
 
-/** @typedef {{provider: string, target: string, cwd: string, toolMessages: boolean, relayWrite: boolean, workspaceProfile?: string, prompt?: string, promptFile?: string, processNumber?: number, maxOutputLength?: number, resumeSession?: string, transcript?: string, activityLog?: string, providerArguments: string[]}} ParsedArguments */
+/** @typedef {{provider: string, target: string, cwd: string, toolMessages: boolean, relayWrite: boolean, prompt?: string, promptFile?: string, processNumber?: number, maxOutputLength?: number, resumeSession?: string, transcript?: string, activityLog?: string, providerArguments: string[]}} ParsedArguments */
 /** @typedef {{evidenceRead: true, request: unknown}} EvidenceParsedArguments */
 /**
  * @typedef {{
@@ -47,9 +43,7 @@ const HELP = `Usage: threadwire run --provider <codex|claude|kimi|opencode> --ta
  *   evidenceStore?: EvidenceStore,
  *   evidenceOwnerScope?: {destinationId: string, runId: string},
  *   workerControlOptions?: Pick<ConstructorParameters<typeof WorkerControl>[0], "queueOptions">,
- *   workspaceProfileOperations?: import("./workspace-profile.js").WorkspaceProfileOperations,
- *   isolatedRuntimeClient?: Pick<import("./isolated-runtime-client.js").IsolatedRuntimeClient, "preflight" | "run">,
- *   kimiIsolatedRuntimeClient?: Pick<import("./isolated-runtime-client.js").IsolatedRuntimeClient, "preflight" | "run">
+ *   isolatedRuntimeClient?: Pick<import("./isolated-runtime-client.js").IsolatedRuntimeClient, "preflight" | "run">
  * }} MainDependencies
  */
 
@@ -63,7 +57,6 @@ export function parseArguments(arguments_) {
   const providerArguments = separator < 0 ? [] : arguments_.slice(separator + 1)
   /** @type {Partial<ParsedArguments>} */
   const parsed = {providerArguments, cwd: process.cwd(), toolMessages: false, relayWrite: false}
-  let cwdProvided = false
   let transcriptProvided = false
   for (let index = 0; index < ownArguments.length;) {
     const option = ownArguments[index]
@@ -86,8 +79,7 @@ export function parseArguments(arguments_) {
     else if (option === "--target") parsed.target = value
     else if (option === "--cwd") {
       parsed.cwd = resolve(value)
-      cwdProvided = true
-    } else if (option === "--workspace-profile") parsed.workspaceProfile = value
+    } else if (option === "--workspace-profile") throw new Error("--workspace-profile is no longer supported; use --cwd")
     else if (option === "--prompt") parsed.prompt = value
     else if (option === "--prompt-file") parsed.promptFile = resolve(value)
     else if (option === "--process-number") parsed.processNumber = positiveInteger(value, "--process-number")
@@ -108,14 +100,9 @@ export function parseArguments(arguments_) {
   }
   if (!parsed.target) throw new Error("--target is required")
   if (parsed.prompt !== undefined && parsed.promptFile !== undefined) throw new Error("Use exactly one prompt source")
-  if (parsed.workspaceProfile !== undefined && cwdProvided) {
-    throw new Error("--cwd and --workspace-profile are mutually exclusive")
-  }
   if (parsed.transcript !== undefined && parsed.transcript === parsed.activityLog) {
     throw new Error("--transcript and --activity-log must resolve to different paths")
   }
-  if (parsed.relayWrite && parsed.workspaceProfile === undefined) throw new Error("--relay-write requires --workspace-profile")
-  if (parsed.provider === "kimi" && parsed.workspaceProfile === undefined) throw new Error("Kimi requires --workspace-profile")
   if (parsed.relayWrite && parsed.provider !== "codex") throw new Error("--relay-write is only supported for codex")
   return /** @type {ParsedArguments} */ (parsed)
 }
@@ -200,35 +187,17 @@ export async function main(arguments_, dependencies = {}) {
     runAdmission = normalizedOutput === undefined ? undefined : new DelegatedResultAdmission({output: normalizedOutput, metrics})
     const target = parseTelegramTarget(parsed.target)
     if (parsed.relayWrite) validateRelayWriteProviderArguments(parsed.providerArguments)
-    const kimiBinding = parsed.provider === "kimi"
-      ? parseTrustedThreadwireBinding(sourceEnvironment.THREADWIRE_KIMI_TASK_BINDING)
-      : undefined
-    const resolvedWorkspace = parsed.workspaceProfile === undefined
-      ? undefined
-      : await resolveWorkspaceProfile(
-        {
-          provider: /** @type {"codex" | "claude" | "kimi" | "opencode"} */ (parsed.provider), profile: parsed.workspaceProfile,
-          ...(kimiBinding === undefined ? {} : {binding: kimiBinding})
-        },
-        dependencies.workspaceProfileOperations
-      )
     if (validateOnly) return 0
-    const usesIsolatedRuntime = parsed.relayWrite || parsed.provider === "kimi"
+    const usesIsolatedRuntime = parsed.relayWrite
     const isolatedRuntimeClient = usesIsolatedRuntime
-      ? parsed.provider === "kimi"
-        ? dependencies.kimiIsolatedRuntimeClient ?? kimiIsolatedRuntimeClientFromEnvironment(sourceEnvironment)
-        : dependencies.isolatedRuntimeClient ?? isolatedRuntimeClientFromEnvironment(sourceEnvironment)
+      ? dependencies.isolatedRuntimeClient ?? isolatedRuntimeClientFromEnvironment(sourceEnvironment)
       : undefined
     const isolatedPreflight = usesIsolatedRuntime
       ? await /** @type {NonNullable<typeof isolatedRuntimeClient>} */ (isolatedRuntimeClient).preflight({
         provider: parsed.provider,
-        profile: /** @type {string} */ (parsed.workspaceProfile),
-        ...(parsed.provider === "kimi"
-          ? {binding: kimiBinding}
-          : {
-            repositoryRoot: /** @type {import("./workspace-profile.js").ResolvedWorkspaceProfile} */ (resolvedWorkspace).repositoryRoot,
-            cwd: /** @type {import("./workspace-profile.js").ResolvedWorkspaceProfile} */ (resolvedWorkspace).cwd
-          }),
+        profile: "explicit-cwd",
+        repositoryRoot: parsed.cwd,
+        cwd: parsed.cwd,
         providerArguments: parsed.providerArguments,
         ...(parsed.resumeSession === undefined ? {} : {resumeSession: parsed.resumeSession})
       })
@@ -268,18 +237,18 @@ export async function main(arguments_, dependencies = {}) {
         await boundedLaunch(evidence.append("prompt", promptEvidence), launchDeadline)
         evidencePayloadBytes += Buffer.byteLength(promptEvidence, "utf8")
       }
-      const providerEnvironment = buildProviderEnvironment(environment)
+      const providerEnvironment = buildProviderEnvironment(environment, {
+        provider: parsed.provider,
+        isolated: usesIsolatedRuntime
+      })
       const provider = createProvider(
         parsed.provider,
         parsed.providerArguments,
         prompt,
         parsed.resumeSession,
-        usesIsolatedRuntime ? {} : providerEnvironment
+        providerEnvironment
       )
       if (parsed.resumeSession !== undefined) admission.setContinuationHandle(parsed.resumeSession)
-      if (parsed.workspaceProfile !== undefined) {
-        if (resolvedWorkspace === undefined) throw new Error("Workspace profile resolution failed")
-      }
       const token = environment.THREADWIRE_TELEGRAM_BOT_TOKEN
       if (!token) throw new Error("THREADWIRE_TELEGRAM_BOT_TOKEN is required")
       const transport = (dependencies.transportFactory ?? createFetchTransport)(token, undefined, parseTelegramRequestTimeoutMs(environment))
@@ -292,20 +261,13 @@ export async function main(arguments_, dependencies = {}) {
         metrics
       })
       activity = parsed.activityLog === undefined ? undefined : new ActivityLog(parsed.activityLog)
-      if (activity && resolvedWorkspace) {
-        activity.recordWorkspace(
-          resolvedWorkspace.profile,
-          resolvedWorkspace.repositoryRoot,
-          resolvedWorkspace.revision,
-          resolvedWorkspace.sourceIdentity
-        )
-      }
       /** @type {import("./run-worker.js").RunWorkerOptions} */
       const workerOptions = {
         executable: provider.executable,
         arguments: provider.arguments,
-        cwd: resolvedWorkspace?.cwd ?? parsed.cwd,
+        cwd: parsed.cwd,
         environment: providerEnvironment,
+        provider: provider.name,
         parse: provider.parse,
         onEvent: (event) => {
           validateNormalizedWorkerEvent(event)
@@ -320,7 +282,7 @@ export async function main(arguments_, dependencies = {}) {
         },
         onRecord: (record) => {
           metrics.recordParsedProviderRecord("provider_stdout")
-          const id = parsed.provider === "kimi" ? kimiSessionEnvelopeId(record) : provider.sessionId(record)
+          const id = provider.sessionId(record)
           if (id !== undefined) {
             admission.setContinuationHandle(id)
             activity?.recordSession(provider.name, id)

package/src/providers/index.js

@@ -27,7 +27,7 @@ export function createProvider(name, providerArguments, prompt, resumeSession, e
     return {...command, name: "opencode", parse: createOpenCodeParser(), sessionId: createOpenCodeSessionId()}
   }
   if (name === "kimi") {
-    const command = buildKimiCommand(providerArguments, prompt, resumeSession)
+    const command = buildKimiCommand(providerArguments, prompt, resumeSession, environment)
     return {...command, name: "kimi", parse: createKimiParser(), sessionId: createKimiSessionId()}
   }
   throw new Error(`--provider must be one of: ${PROVIDERS.join(", ")}`)

package/src/providers/kimi.js

@@ -20,14 +20,24 @@ export function validateKimiProviderArguments(providerArguments) {
   throw new Error("Threadwire owns Kimi prompt, output, session, model configuration, permissions, and extensions")
 }
 
-/** @param {string[]} providerArguments @param {string} prompt @param {string | undefined} [resumeSession] */
-export function buildKimiCommand(providerArguments, prompt, resumeSession) {
-  const selection = validateKimiProviderArguments(providerArguments)
+const OWNED_ARGUMENTS = new Set([
+  "--prompt", "-p", "--output-format", "--session", "-S", "--resume-session", "--resume", "-r"
+])
+
+/**
+ * Native Kimi uses caller-owned provider configuration. Threadwire owns only
+ * the prompt, stream output, and explicit resume handle.
+ * @param {string[]} providerArguments @param {string} prompt @param {string | undefined} [resumeSession] @param {NodeJS.ProcessEnv} [environment]
+ */
+export function buildKimiCommand(providerArguments, prompt, resumeSession, environment = process.env) {
+  rejectNativeOwnedArguments(providerArguments)
   if (resumeSession !== undefined && !SESSION_PATTERN.test(resumeSession)) throw new Error("Kimi session ID is invalid")
   return {
-    executable: EXECUTABLE,
+    executable: environment.THREADWIRE_KIMI_BIN?.length ? environment.THREADWIRE_KIMI_BIN : EXECUTABLE,
     arguments: [
-      "--model", selection.modelAlias,
+      ...providerArguments,
+      // Threadwire's public resume option maps to Kimi Code's native session option.
+      // Kimi Code 0.29.2 does not provide a --resume-session flag.
       ...(resumeSession === undefined ? [] : ["--session", resumeSession]),
       "--prompt", prompt,
       "--output-format", "stream-json"
@@ -35,6 +45,16 @@ export function buildKimiCommand(providerArguments, prompt, resumeSession) {
   }
 }
 
+/** @param {string[]} arguments_ */
+function rejectNativeOwnedArguments(arguments_) {
+  if (arguments_.includes("--")) throw new Error("Kimi provider argument terminator is not allowed")
+  if (arguments_.some((argument) => OWNED_ARGUMENTS.has(argument)
+    || argument.startsWith("--prompt=") || argument.startsWith("--output-format=")
+    || argument.startsWith("--session=") || argument.startsWith("--resume-session=") || argument.startsWith("--resume="))) {
+    throw new Error("Threadwire owns Kimi prompt, streaming output, and session options")
+  }
+}
+
 /** @returns {(record: unknown) => string | undefined} */
 export function createKimiSessionId() {
   let emitted = false

package/src/run-worker.js

@@ -9,7 +9,7 @@ const DEFAULT_MAX_STDOUT_RECORD_BYTES = 1_048_576
 const DEFAULT_TERMINATION_GRACE_PERIOD_MS = 5_000
 
 /**
- * @typedef {{executable: string, arguments: string[], cwd: string, environment?: NodeJS.ProcessEnv, parse: (record: unknown) => import("./types.js").WorkerEvent[], onEvent: (event: import("./types.js").WorkerEvent) => void | Promise<void>, onSpawn?: (pid: number) => void, onRecord?: (record: unknown) => void | Promise<void>, onStdoutChunk?: (chunk: Buffer) => void | Promise<void>, onStderrChunk?: (chunk: Buffer) => void | Promise<void>, spawnImplementation?: typeof nodeSpawn, maxStdoutRecordBytes?: number, terminationGracePeriodMs?: number, setTimer?: (callback: () => void, milliseconds: number) => unknown, clearTimer?: (handle: unknown) => void, platform?: NodeJS.Platform, killProcess?: (pid: number, signal: NodeJS.Signals) => boolean}} RunWorkerOptions
+ * @typedef {{executable: string, arguments: string[], cwd: string, environment?: NodeJS.ProcessEnv, provider?: string, parse: (record: unknown) => import("./types.js").WorkerEvent[], onEvent: (event: import("./types.js").WorkerEvent) => void | Promise<void>, onSpawn?: (pid: number) => void, onRecord?: (record: unknown) => void | Promise<void>, onStdoutChunk?: (chunk: Buffer) => void | Promise<void>, onStderrChunk?: (chunk: Buffer) => void | Promise<void>, spawnImplementation?: typeof nodeSpawn, maxStdoutRecordBytes?: number, terminationGracePeriodMs?: number, setTimer?: (callback: () => void, milliseconds: number) => unknown, clearTimer?: (handle: unknown) => void, platform?: NodeJS.Platform, killProcess?: (pid: number, signal: NodeJS.Signals) => boolean}} RunWorkerOptions
  */
 
 /** @param {RunWorkerOptions} options @returns {Promise<number>} */
@@ -25,7 +25,7 @@ export function runWorker(options) {
   const child = spawnImplementation(options.executable, options.arguments, {
     cwd: options.cwd,
     detached: useDetachedProcessGroup,
-    env: childEnvironment(options.environment ?? process.env),
+    env: childEnvironment(options.environment ?? process.env, options.provider),
     shell: false,
     stdio: ["ignore", "pipe", "pipe"]
   })
@@ -214,9 +214,9 @@ export class StdoutRecordTooLargeError extends Error {
   }
 }
 
-/** @param {NodeJS.ProcessEnv} environment */
-export function childEnvironment(environment = process.env) {
-  const childEnvironment = buildProviderEnvironment(environment)
+/** @param {NodeJS.ProcessEnv} environment @param {string | undefined} [provider] */
+export function childEnvironment(environment = process.env, provider) {
+  const childEnvironment = buildProviderEnvironment(environment, provider === undefined ? {} : {provider})
   // Mark the provider child tree active so a nested provider CLI invoked from
   // the /opt/data/bin front-door shim runs its libexec adapter directly instead
   // of relaying again. Threadwire always spawns the libexec adapter, never the

package/src/telegram-ingress/config.js

@@ -222,32 +222,38 @@ export function parseTelegramRequestTimeoutMs(environment) {
 /**
  * Build the environment passed to the provider child. Keeps operational host
  * variables needed by providers, but never forwards Telegram or ingress secrets.
+ * Kimi's native CLI has a deliberately narrow configuration contract. Its
+ * credentials and state directory are never useful to another provider or to
+ * an isolated Kimi worker.
  * @param {NodeJS.ProcessEnv} source
+ * @param {{provider?: string, isolated?: boolean}} [options]
  * @returns {NodeJS.ProcessEnv}
  */
-export function buildProviderEnvironment(source) {
+export function buildProviderEnvironment(source, options = {}) {
+  const preservesNativeKimiConfiguration = options.provider === "kimi" && options.isolated !== true
   /** @type {NodeJS.ProcessEnv} */
   const environment = {}
   for (const [key, value] of Object.entries(source)) {
     if (value === undefined) continue
-    if (isIngressSecretKey(key)) continue
+    if (isIngressSecretKey(key, preservesNativeKimiConfiguration)) continue
     environment[key] = value
   }
   return environment
 }
 
-/** @param {string} key */
-function isIngressSecretKey(key) {
+/** @param {string} key @param {boolean} preservesNativeKimiConfiguration */
+function isIngressSecretKey(key, preservesNativeKimiConfiguration) {
+  if (key === "THREADWIRE_KIMI_BIN") return !preservesNativeKimiConfiguration
+  if (key === "KIMI_API_KEY" || key === "MOONSHOT_API_KEY" || key === "KIMI_CODE_HOME") {
+    return !preservesNativeKimiConfiguration
+  }
   if (FILE_BACKED_SETTINGS.some((name) => key === `${name}_FILE`)) return true
   if (key === "THREADWIRE_REQUIRE_CODEX_ISOLATION") return true
   if (
     key.startsWith("THREADWIRE_ISOLATED_RUNTIME_")
     || key.startsWith("THREADWIRE_MODEL_BROKER_")
     || key.startsWith("THREADWIRE_KIMI_")
-    || key === "KIMI_MODEL_API_KEY"
-    || key === "KIMI_API_KEY"
-    || key === "MOONSHOT_API_KEY"
-    || key === "KIMI_CODE_HOME"
+    || key.startsWith("KIMI_")
     || key === "THREADWIRE_RELAY_WORKER_IMAGE"
     || key === "THREADWIRE_ALLOWED_WORKTREE_ROOTS"
     || key === "THREADWIRE_WORKTREE_VOLUME"

package/src/telegram-ingress/core.js

@@ -10,7 +10,6 @@ import {kimiSessionEnvelopeId} from "../providers/kimi.js"
 import {Relay} from "../relay.js"
 import {runWorker} from "../run-worker.js"
 import {WorkerControl} from "../worker-control.js"
-import {resolveWorkspaceProfile} from "../workspace-profile.js"
 import {buildProviderEnvironment, collectEvidenceRedactions} from "./config.js"
 import {parseCodeCommand, parseEvidenceCommand} from "./command.js"
 
@@ -27,9 +26,9 @@ import {parseCodeCommand, parseEvidenceCommand} from "./command.js"
  *   Relay?: typeof Relay,
  *   processNumber?: number,
  *   providerEnvironment?: NodeJS.ProcessEnv,
+ *   cwd?: string,
  *   kimiBinding?: unknown,
- *   workspaceProfileOperations?: import("../workspace-profile.js").WorkspaceProfileOperations,
- *   activity?: Pick<import("../activity-log.js").ActivityLog, "recordWorkspace" | "recordStarted" | "recordSession" | "close">,
+ *   activity?: Pick<import("../activity-log.js").ActivityLog, "recordStarted" | "recordSession" | "close">,
  *   evidenceStore?: import("../evidence-store.js").EvidenceStore,
  *   isolatedRuntimeClient?: Pick<import("../isolated-runtime-client.js").IsolatedRuntimeClient, "preflight" | "run">,
  *   kimiIsolatedRuntimeClient?: Pick<import("../isolated-runtime-client.js").IsolatedRuntimeClient, "preflight" | "run">,
@@ -97,9 +96,6 @@ export function interpretUpdate(update, config) {
  */
 export async function dispatchWorker(job, config, dependencies = {}) {
   if ("type" in job) throw new Error("Worker dispatch requires a worker job")
-  if (job.provider === "kimi" && dependencies.kimiIsolatedRuntimeClient === undefined) {
-    throw new Error("Kimi isolated runtime is required")
-  }
   if (job.provider === "codex" && config.requireCodexIsolation === true
     && dependencies.isolatedRuntimeClient === undefined) {
     throw new Error("Codex isolated runtime is required")
@@ -112,32 +108,26 @@ export async function dispatchWorker(job, config, dependencies = {}) {
   const NoticeQueueImpl = dependencies.NoticeQueue ?? NoticeQueue
   const RelayImpl = dependencies.Relay ?? Relay
   const processNumber = dependencies.processNumber ?? process.pid
-  // Explicit only: never fall back to ambient process.env (avoids secret leakage).
-  const providerEnvironment = buildProviderEnvironment(dependencies.providerEnvironment ?? {})
+  const cwd = dependencies.cwd ?? process.cwd()
   const kimiBinding = job.provider === "kimi" ? dependencies.kimiBinding : undefined
-  const workspace = await resolveWorkspaceProfile(
-    {provider: job.provider, ...(kimiBinding === undefined ? {} : {binding: kimiBinding})},
-    dependencies.workspaceProfileOperations
-  )
   const isolatedRuntimeClient = job.provider === "kimi"
     ? dependencies.kimiIsolatedRuntimeClient
     : job.provider === "codex" ? dependencies.isolatedRuntimeClient : undefined
-  const earlyKimiPreflight = job.provider === "kimi"
+  // Explicit only: never fall back to ambient process.env (avoids secret leakage).
+  const providerEnvironment = buildProviderEnvironment(dependencies.providerEnvironment ?? {}, {
+    provider: job.provider,
+    isolated: isolatedRuntimeClient !== undefined
+  })
+  const earlyKimiPreflight = job.provider === "kimi" && isolatedRuntimeClient !== undefined
     ? await /** @type {NonNullable<typeof isolatedRuntimeClient>} */ (isolatedRuntimeClient).preflight({
       provider: "kimi",
-      profile: workspace.profile,
+      profile: "explicit-isolation",
       binding: kimiBinding,
       providerArguments: []
     })
     : undefined
 
   const provider = createProviderImpl(job.provider, [], job.prompt, undefined, providerEnvironment)
-  dependencies.activity?.recordWorkspace(
-    workspace.profile,
-    workspace.repositoryRoot,
-    workspace.revision,
-    workspace.sourceIdentity
-  )
   const transport = createFetchTransportImpl(config.botToken, undefined, config.telegramRequestTimeoutMs)
   const sender = createTelegramSenderImpl(job.target, transport)
   const control = new WorkerControlImpl({
@@ -164,10 +154,10 @@ export async function dispatchWorker(job, config, dependencies = {}) {
       try {
         const preflight = earlyKimiPreflight ?? await isolatedRuntimeClient.preflight({
           provider: job.provider,
-          profile: workspace.profile,
+          profile: "explicit-isolation",
           ...(job.provider === "kimi"
             ? {binding: kimiBinding}
-            : {repositoryRoot: workspace.repositoryRoot, cwd: workspace.cwd}),
+            : {repositoryRoot: cwd, cwd}),
           providerArguments: []
         })
         const exitCode = await isolatedRuntimeClient.run({
@@ -241,8 +231,9 @@ export async function dispatchWorker(job, config, dependencies = {}) {
     const running = runWorkerImpl({
       executable: provider.executable,
       arguments: provider.arguments,
-      cwd: workspace.cwd,
+      cwd,
       environment: providerEnvironment,
+      provider: provider.name,
       parse: provider.parse,
       onEvent: async (event) => control.accept(event),
       onSpawn: (pid) => {
@@ -262,11 +253,22 @@ export async function dispatchWorker(job, config, dependencies = {}) {
     // reported. Always notify settlement so concurrency slots are released.
     evidenceTransferred = true
     void (async () => {
+      /** @type {Error | undefined} */
+      let nativeKimiExitFailure
       try {
         try {
-          await running
+          const exitCode = await running
+          if (job.provider === "kimi" && spawnGate.settled) {
+            nativeKimiExitFailure = exitCode === 0 ? undefined : new Error(`Kimi worker exited with status ${exitCode}`)
+            await control.accept({
+              type: "lifecycle",
+              phase: exitCode === 0 ? "completed" : "failed",
+              summary: exitCode === 0 ? "Kimi worker completed" : "Kimi worker failed"
+            })
+            if (nativeKimiExitFailure !== undefined) throw nativeKimiExitFailure
+          }
         } catch (error) {
-          const failure = error instanceof Error ? error : new Error(safeFailureMessage(error))
+          const failure = nativeKimiExitFailure ?? (error instanceof Error ? error : new Error(safeFailureMessage(error)))
           if (spawnGate.settled) {
             reportBackgroundFailure(failure)
           } else {

package/src/telegram-ingress/http.js

@@ -3,7 +3,6 @@
 import {createConcurrencyLimiter} from "./concurrency.js"
 import {dispatchEvidenceRead, dispatchWorker, interpretUpdate, secretsEqual} from "./core.js"
 import {createUpdateGuard, parseUpdateId} from "./update-guard.js"
-import {WorkspaceProviderMismatchError} from "../workspace-profile.js"
 
 export const MAX_WEBHOOK_BODY_BYTES = 65_536
 export const WEBHOOK_PATH = "/webhook"
@@ -159,11 +158,6 @@ async function handleRequest(request, response, config, dependencies) {
       // Safety release for failures before the observer is installed (e.g. provider setup).
       // Idempotent with onWorkerSettled via slotHeld.
       releaseSlot()
-      if (error instanceof WorkspaceProviderMismatchError) {
-        dependencies.updateGuard.complete(updateId)
-        send(response, 200)
-        return
-      }
       dependencies.updateGuard.release(updateId)
       const message = error instanceof Error ? error.message : "Worker launch failed"
       dependencies.onOperationalError?.(message)

package/src/telegram-webhook.js

@@ -17,7 +17,7 @@ import {parseTrustedThreadwireBinding} from "./threadwire-binding.js"
  *   onOperationalError?: (message: string) => void,
  *   onWorkerFailure?: (message: string) => void,
  *   providerEnvironment?: NodeJS.ProcessEnv,
- *   activity?: Pick<ActivityLog, "recordWorkspace" | "recordStarted" | "recordSession" | "close">,
+ *   activity?: Pick<ActivityLog, "recordStarted" | "recordSession" | "close">,
  *   evidenceStore?: EvidenceStore,
  *   handlerDependencies?: import("./telegram-ingress/http.js").WebhookDependencies
  * }} [options]
@@ -25,14 +25,6 @@ import {parseTrustedThreadwireBinding} from "./threadwire-binding.js"
  */
 export async function startTelegramWebhook(options = {}) {
   const environment = await resolveIngressEnvironment(options.env ?? process.env)
-  // Capture this trusted topology attestation before anything derives a
-  // provider environment. The parsed object is passed only to Kimi preflight.
-  // Codex-only Compose renders the variable as an empty string; a blank value
-  // means "absent", while a malformed non-blank value still fails closed.
-  const rawKimiBinding = environment.THREADWIRE_KIMI_TASK_BINDING
-  const kimiBinding = rawKimiBinding === undefined || rawKimiBinding.trim().length === 0
-    ? undefined
-    : parseTrustedThreadwireBinding(rawKimiBinding)
   const config = parseIngressConfig(environment)
   const createServerImpl = options.createServerImpl ?? createServer
   const onOperationalError = options.onOperationalError ?? defaultOperationalError
@@ -42,7 +34,10 @@ export async function startTelegramWebhook(options = {}) {
   // Strip ingress/Telegram secrets before they enter the worker dependency chain.
   // Never pass ambient process.env through unfiltered.
   const providerEnvironment = buildProviderEnvironment(
-    options.providerEnvironment ?? environment
+    options.providerEnvironment ?? environment,
+    // dispatchWorker applies the final provider/path-aware filter. Retain only
+    // the narrow native Kimi candidate configuration until it can do so.
+    {provider: "kimi"}
   )
   const isolatedConfigured = typeof environment.THREADWIRE_ISOLATED_RUNTIME_CONTROL_TOKEN === "string"
     && environment.THREADWIRE_ISOLATED_RUNTIME_CONTROL_TOKEN.trim().length > 0
@@ -52,6 +47,12 @@ export async function startTelegramWebhook(options = {}) {
     && environment.THREADWIRE_KIMI_ISOLATED_RUNTIME_CONTROL_TOKEN.trim().length > 0
   const kimiIsolatedRuntimeClient = options.handlerDependencies?.kimiIsolatedRuntimeClient
     ?? (kimiIsolatedConfigured ? kimiIsolatedRuntimeClientFromEnvironment(environment) : undefined)
+  // A task binding belongs solely to an explicitly selected isolated Kimi
+  // supervisor. Native Kimi neither reads nor validates this topology input.
+  const rawKimiBinding = environment.THREADWIRE_KIMI_TASK_BINDING
+  const kimiBinding = kimiIsolatedRuntimeClient === undefined || rawKimiBinding === undefined || rawKimiBinding.trim().length === 0
+    ? undefined
+    : parseTrustedThreadwireBinding(rawKimiBinding)
   const activity = options.activity ?? options.handlerDependencies?.activity ?? new ActivityLog("/var/lib/threadwire/activity/threadwire.jsonl")
   const evidenceStore = options.evidenceStore ?? options.handlerDependencies?.evidenceStore ?? await EvidenceStore.open({
     root: config.evidenceRoot ?? "/var/lib/threadwire/evidence"

package/src/workspace-profile.js

@@ -1,212 +0,0 @@
-// @ts-check
-
-import {execFile as nodeExecFile} from "node:child_process"
-import {readFile} from "node:fs/promises"
-import {dirname, join, resolve, sep} from "node:path"
-import {fileURLToPath} from "node:url"
-import {promisify} from "node:util"
-import {PROVIDERS} from "./providers/index.js"
-import {parseThreadwireBinding} from "./threadwire-binding.js"
-
-const execFile = promisify(nodeExecFile)
-const DEFAULT_PROFILES_PATH = join(dirname(fileURLToPath(import.meta.url)), "..", "threadwire.workspace-profiles.json")
-const REVISION_PATTERN = /^[0-9a-f]{40}$/u
-const SOURCE_IDENTITY_PATTERN = /^[0-9a-f]{40}$|^[0-9a-f]{64}$/u
-const PROFILE_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u
-
-/**
- * @typedef {{repositoryRoot: string, cwd: string, providers: ("codex" | "claude" | "kimi" | "opencode")[], bindings?: {kimi: "threadwire-v1"}}} WorkspaceProfile
- * @typedef {{version: 1 | 2, defaultProfile: string, profiles: Record<string, WorkspaceProfile>}} WorkspaceProfilesConfig
- * @typedef {{profile: string, repositoryRoot: string, cwd: string, revision: string, sourceIdentity: string, binding?: unknown}} ResolvedWorkspaceProfile
- * @typedef {{repositoryRoot: string, revision: string, sourceIdentity: string}} GitProvenance
- * @typedef {{
- *   readProfiles?: () => Promise<unknown>,
- *   directoryExists?: (path: string) => Promise<boolean>,
- *   resolveGitProvenance?: (cwd: string) => Promise<GitProvenance>
- * }} WorkspaceProfileOperations
- */
-
-/** @param {unknown} value @returns {WorkspaceProfilesConfig} */
-export function parseWorkspaceProfiles(value) {
-  if (!isRecord(value) || (value.version !== 1 && value.version !== 2) || typeof value.defaultProfile !== "string" || !isRecord(value.profiles)) {
-    throw new Error("Workspace profile configuration is invalid")
-  }
-  assertExactKeys(value, ["version", "defaultProfile", "profiles"])
-  /** @type {Record<string, WorkspaceProfile>} */
-  const profiles = {}
-  for (const [name, profile] of Object.entries(value.profiles)) {
-    if (!PROFILE_NAME_PATTERN.test(name) || !isRecord(profile)) throw new Error("Workspace profile configuration is invalid")
-    assertExactKeys(profile, value.version === 2 ? ["repositoryRoot", "cwd", "providers", "bindings"] : ["repositoryRoot", "cwd", "providers"])
-    const repositoryRoot = absoluteNormalizedPath(profile.repositoryRoot)
-    const cwd = absoluteAbsolutePath(profile.cwd)
-    if (cwd !== resolve(cwd) || !pathWithin(repositoryRoot, resolve(cwd))) {
-      throw new Error(`Workspace profile ${name} cwd must stay within its repository root`)
-    }
-    const providers = parseProviders(profile.providers)
-    let bindings
-    if (value.version === 2 && Object.hasOwn(profile, "bindings")) {
-      if (!isRecord(profile.bindings)) throw new Error("Workspace profile configuration is invalid")
-      assertExactKeys(profile.bindings, ["kimi"])
-      if (profile.bindings.kimi !== "threadwire-v1") throw new Error("Workspace profile configuration is invalid")
-      bindings = /** @type {{kimi: "threadwire-v1"}} */ ({kimi: "threadwire-v1"})
-    }
-    profiles[name] = {repositoryRoot, cwd: resolve(cwd), providers, ...(bindings === undefined ? {} : {bindings})}
-  }
-  if (!Object.hasOwn(profiles, value.defaultProfile)) {
-    throw new Error("Workspace profile configuration is invalid")
-  }
-  return {version: value.version, defaultProfile: value.defaultProfile, profiles}
-}
-
-/**
- * Resolve a reviewed workspace profile to a validated in-container workspace.
- * @param {{provider: "codex" | "claude" | "kimi" | "opencode", profile?: string, binding?: unknown}} selection
- * @param {WorkspaceProfileOperations} [operations]
- * @returns {Promise<ResolvedWorkspaceProfile>}
- */
-export async function resolveWorkspaceProfile(selection, operations = {}) {
-  const raw = await (operations.readProfiles ?? readProfiles)()
-  const config = parseWorkspaceProfiles(raw)
-  const profileName = selection.profile ?? config.defaultProfile
-  const profile = config.profiles[profileName]
-  if (!profile) throw new Error("--workspace-profile must name a configured workspace profile")
-  if (!profile.providers.includes(selection.provider)) {
-    throw new WorkspaceProviderMismatchError(profileName, selection.provider)
-  }
-  if (selection.provider === "kimi") {
-    if (config.version !== 2 || profile.bindings?.kimi !== "threadwire-v1" || selection.binding === undefined) {
-      throw new Error("Kimi requires Threadwire binding schema v1")
-    }
-    let binding
-    try { binding = parseThreadwireBinding(selection.binding) } catch { throw new Error("Kimi requires Threadwire binding schema v1") }
-    return {
-      profile: profileName,
-      repositoryRoot: binding.source.target,
-      cwd: binding.runtime.workdir,
-      revision: binding.source.revision,
-      sourceIdentity: binding.context.digests.content.slice("sha256:".length),
-      binding
-    }
-  }
-  const directoryExists = operations.directoryExists ?? defaultDirectoryExists
-  if (!await directoryExists(profile.repositoryRoot) || !await directoryExists(profile.cwd)) {
-    throw new Error(`Workspace profile ${profileName} workspace is unavailable`)
-  }
-  let provenance
-  try {
-    provenance = await (operations.resolveGitProvenance ?? defaultResolveGitProvenance)(profile.cwd)
-  } catch {
-    throw new Error(`Workspace profile ${profileName} workspace is unavailable`)
-  }
-  if (provenance.repositoryRoot !== profile.repositoryRoot) {
-    throw new Error(`Workspace profile ${profileName} workspace is unavailable`)
-  }
-  return {
-    profile: profileName,
-    repositoryRoot: profile.repositoryRoot,
-    cwd: profile.cwd,
-    revision: provenance.revision,
-    sourceIdentity: provenance.sourceIdentity
-  }
-}
-
-export class WorkspaceProviderMismatchError extends Error {
-  /** @param {string} profileName @param {string} provider */
-  constructor(profileName, provider) {
-    super(`Workspace profile ${profileName} does not allow provider ${provider}`)
-    this.name = "WorkspaceProviderMismatchError"
-  }
-}
-
-/** @returns {Promise<unknown>} */
-async function readProfiles() {
-  return JSON.parse(await readFile(DEFAULT_PROFILES_PATH, "utf8"))
-}
-
-/** @param {string} path @returns {Promise<boolean>} */
-async function defaultDirectoryExists(path) {
-  try {
-    const metadata = await import("node:fs/promises").then(({stat}) => stat(path))
-    return metadata.isDirectory()
-  } catch {
-    return false
-  }
-}
-
-/** @param {string} cwd @returns {Promise<GitProvenance>} */
-async function defaultResolveGitProvenance(cwd) {
-  const repositoryRoot = await gitText(cwd, ["rev-parse", "--show-toplevel"])
-  const revision = await gitText(cwd, ["rev-parse", "HEAD"])
-  const sourceIdentity = await readSourceIdentity(repositoryRoot, cwd)
-  if (!REVISION_PATTERN.test(revision) || !SOURCE_IDENTITY_PATTERN.test(sourceIdentity)) throw new Error("invalid workspace provenance")
-  return {repositoryRoot, revision, sourceIdentity}
-}
-
-/** @param {string} cwd @param {string[]} arguments_ */
-async function gitText(cwd, arguments_) {
-  const {stdout} = await execFile("git", ["-C", cwd, ...arguments_], {encoding: "utf8"})
-  return stdout.trim()
-}
-
-/** @param {string} repositoryRoot @param {string} cwd */
-async function readSourceIdentity(repositoryRoot, cwd) {
-  try {
-    return (await readFile(join(repositoryRoot, ".threadwire-source-identity"), "utf8")).trim()
-  } catch {
-    return gitText(cwd, ["rev-parse", "HEAD^{tree}"])
-  }
-}
-
-/** @param {unknown} value */
-function parseProviders(value) {
-  if (!Array.isArray(value) || value.length === 0) throw new Error("Workspace profile configuration is invalid")
-  /** @type {("codex" | "claude" | "kimi" | "opencode")[]} */
-  const providers = []
-  for (const entry of value) {
-    if (typeof entry !== "string") {
-      throw new Error("Workspace profile configuration is invalid")
-    }
-    const provider = /** @type {(typeof PROVIDERS)[number]} */ (entry)
-    if (!PROVIDERS.includes(provider) || providers.includes(provider)) {
-      throw new Error(typeof entry === "string" ? `Workspace profile configuration contains unknown provider ${entry}` : "Workspace profile configuration is invalid")
-    }
-    providers.push(provider)
-  }
-  return providers
-}
-
-/** @param {unknown} value */
-function absoluteNormalizedPath(value) {
-  if (typeof value !== "string") throw new Error("Workspace profile configuration is invalid")
-  const normalized = resolve(value)
-  if (!normalized.startsWith(sep) || value !== normalized) {
-    throw new Error("Workspace profile configuration is invalid")
-  }
-  return normalized
-}
-
-/** @param {unknown} value */
-function absoluteAbsolutePath(value) {
-  if (typeof value !== "string") throw new Error("Workspace profile configuration is invalid")
-  const normalized = resolve(value)
-  if (!normalized.startsWith(sep)) throw new Error("Workspace profile configuration is invalid")
-  return value
-}
-
-/** @param {string} root @param {string} child */
-function pathWithin(root, child) {
-  return child === root || child.startsWith(`${root}${sep}`)
-}
-
-/** @param {unknown} value @returns {value is Record<string, unknown>} */
-function isRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value)
-}
-
-/** @param {Record<string, unknown>} value @param {string[]} allowedKeys */
-function assertExactKeys(value, allowedKeys) {
-  const allowed = new Set(allowedKeys)
-  for (const key of Object.keys(value)) {
-    if (!allowed.has(key)) throw new Error("Workspace profile configuration is invalid")
-  }
-}

package/threadwire.workspace-profiles.json

@@ -1,12 +0,0 @@
-{
-  "version": 2,
-  "defaultProfile": "container-runtime",
-  "profiles": {
-    "container-runtime": {
-      "repositoryRoot": "/workspace/threadwire",
-      "cwd": "/workspace/threadwire",
-      "providers": ["codex", "kimi"],
-      "bindings": {"kimi": "threadwire-v1"}
-    }
-  }
-}