threadwire 0.1.23 → 0.1.25

package/CHANGELOG.md

@@ -2,6 +2,26 @@
 
 ## Unreleased
 
+- Harden `threadwire capacity` edge cases. Kimi quota remaining percent is now
+  computed with integer-safe arithmetic so values such as 29 % of 100 no longer
+  lose the inclusive reserve boundary to floating-point rounding. Kimi probe
+  body-read aborts, timeouts, and transport errors are classified as
+  `unavailable`, while oversized bodies and malformed JSON remain `protocol`;
+  no token or response detail is leaked. `--timeout-ms` is now rejected above
+  Node's maximum timer delay (`2147483647`), matching the existing positive
+  integer error convention and updated help text.
+
+- Fix a race in isolated-runtime worker cleanup: Docker's ContainerStop returns
+  HTTP 304 when the owned container exits before the stop call, and
+  ContainerKill returns HTTP 409 when the container exits between the post-stop
+  reinspection and the kill call. `stopAndRemoveWorkerContainer` now recognizes
+  only the endpoint-specific structured status for each call (304 at stop, 409
+  at kill), reinspects the exact container ID, and continues with removal only
+  when the reinspection confirms a terminal state. Genuine stop/kill errors
+  still fail closed, no broad cleanup is performed, and lineage retention
+  behavior is unchanged. Add focused lifecycle tests for 304 stop, 409 kill,
+  304 kill, and genuine error paths.
+
 - Complete every short filesystem write while spooling oversized worker JSONL
   records, preventing truncated or corrupted worker output. Reject stalled,
   invalid, or impossible write counts and clean up the private spool artifact

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "threadwire",
-  "version": "0.1.23",
+  "version": "0.1.25",
   "description": "Stream Codex, Claude, Kimi Code, and OpenCode worker progress to an explicit Telegram destination",
   "keywords": [
     "ai-agent",

package/src/absolute-deadline.js

@@ -75,6 +75,13 @@ export async function abortable(promise, signal) {
   })
 }
 
+export class ResponseCapacityError extends Error {
+  constructor() {
+    super("Response exceeded capacity")
+    this.name = "ResponseCapacityError"
+  }
+}
+
 export async function readResponseCapped(response, capacity, signal) {
   const reader = response.body?.getReader()
   if (!reader) return Buffer.alloc(0)
@@ -87,8 +94,8 @@ export async function readResponseCapped(response, capacity, signal) {
       const chunk = Buffer.from(value)
       size += chunk.length
       if (size > capacity) {
-        await reader.cancel(new Error("Response exceeded capacity")).catch(() => {})
-        throw new Error("Response exceeded capacity")
+        await reader.cancel(new ResponseCapacityError()).catch(() => {})
+        throw new ResponseCapacityError()
       }
       chunks.push(chunk)
     }

package/src/cli.js

@@ -4,7 +4,7 @@ import {lstat, readFile, readlink, realpath} from "node:fs/promises"
 import {randomUUID} from "node:crypto"
 import {basename, dirname, isAbsolute, join, normalize, resolve} from "node:path"
 import {stdin, stderr, stdout} from "node:process"
-import {createFetchTransport} from "./notifiers/fetch-transport.js"
+import {createFetchTransport, MAX_TIMER_DELAY_MS} from "./notifiers/fetch-transport.js"
 import {createTelegramSender, parseTelegramTarget} from "./notifiers/telegram.js"
 import {createProvider, PROVIDERS} from "./providers/index.js"
 import {runWorker} from "./run-worker.js"
@@ -45,7 +45,7 @@ const HELP = `Usage: threadwire run --provider <codex|claude|kimi|opencode> --ta
   (--summary | --events [--kind <kind>] [--after <order>] [--before <order>] [--limit <positive-integer>] | --failures [--after <order>] [--limit <positive-integer>])
        threadwire capacity [--provider <codex|kimi>]...
   [--short-reserve-percent <0-100>] [--long-reserve-percent <0-100>]
-  [--timeout-ms <positive-integer>]
+  [--timeout-ms <1-2147483647>]
        threadwire status --activity-log <absolute-path>
   (Emits one closed versioned JSON status document from the activity log.)`
 
@@ -231,7 +231,7 @@ function parseCapacityArguments(arguments_) {
       providers.push(provider)
     } else if (option === "--short-reserve-percent") shortReservePercent = reservePercent(value, option)
     else if (option === "--long-reserve-percent") longReservePercent = reservePercent(value, option)
-    else if (option === "--timeout-ms") timeoutMs = positiveInteger(value, option)
+    else if (option === "--timeout-ms") timeoutMs = capacityTimeoutMs(value, option)
     else throw new Error(HELP)
   }
   return {
@@ -843,6 +843,15 @@ function positiveInteger(value, option) {
   return number
 }
 
+/** @param {string} value @param {string} option */
+function capacityTimeoutMs(value, option) {
+  const number = positiveInteger(value, option)
+  if (number > MAX_TIMER_DELAY_MS) {
+    throw new Error(`${option} must be no greater than ${MAX_TIMER_DELAY_MS}`)
+  }
+  return number
+}
+
 /** @param {string} value */
 function sessionId(value) {
   try {

package/src/docker-api.js

@@ -3,6 +3,15 @@
 
 import {request as httpRequest} from "node:http"
 
+export class DockerApiError extends Error {
+  /** @param {string} method @param {string} path @param {number} status */
+  constructor(method, path, status) {
+    super(`Docker API ${method} ${path} failed (${status})`)
+    this.name = "DockerApiError"
+    this.status = status
+  }
+}
+
 export class DockerApi {
   /** @param {{host?: string, requestImplementation?: typeof httpRequest}} [options] */
   constructor(options = {}) {
@@ -38,7 +47,7 @@ export class DockerApi {
           const content = combined.toString("utf8")
           const status = response.statusCode ?? 500
           if (status < 200 || status >= 300) {
-            reject(new Error(`Docker API ${method} ${path} failed (${status})`))
+            reject(new DockerApiError(method, path, status))
             return
           }
           if (combined.length === 0) {
@@ -135,7 +144,7 @@ export class DockerApi {
         const status = response.statusCode ?? 500
         if (status < 200 || status >= 300) {
           response.resume()
-          fail(new Error(`Docker API GET /containers/${id}/logs failed (${status})`))
+          fail(new DockerApiError("GET", `/containers/${id}/logs`, status))
           return
         }
         response.on("data", (chunk) => {

package/src/isolated-runtime-client.js

@@ -1,7 +1,7 @@
 // @ts-nocheck
 /* eslint-disable jsdoc/require-jsdoc */
 
-import {AbsoluteDeadline, deadlineAfter, abortable, readResponseCapped} from "./absolute-deadline.js"
+import {AbsoluteDeadline, deadlineAfter, abortable, readResponseCapped, ResponseCapacityError} from "./absolute-deadline.js"
 
 const MAX_RESPONSE_BYTES = 2_097_152
 const MAX_RAW_OUTPUT_BYTES = 1_048_576
@@ -207,7 +207,7 @@ export class IsolatedRuntimeClient {
     try {
       bytes = await readResponseCapped(response, MAX_RESPONSE_BYTES, signal)
     } catch (error) {
-      if (error instanceof Error && error.message === "Response exceeded capacity") throw new Error("Isolated runtime response exceeded the configured capacity", {cause: error})
+      if (error instanceof ResponseCapacityError) throw new Error("Isolated runtime response exceeded the configured capacity", {cause: error})
       throw error
     }
     if (!response.ok) throw new Error(safeRemoteError(bytes))

package/src/isolated-runtime.js

@@ -6,7 +6,7 @@ import {once} from "node:events"
 import {lstat, realpath} from "node:fs/promises"
 import {createServer} from "node:http"
 import {isAbsolute, join, normalize, relative} from "node:path"
-import {DockerApi} from "./docker-api.js"
+import {DockerApi, DockerApiError} from "./docker-api.js"
 import {buildKimiBindingValidatorSpec, buildKimiRelayContainerSpec, buildWorkerContainerSpec, isDigestImage} from "./isolated-worker.js"
 import {validateRelayWriteProviderArguments} from "./relay-write.js"
 import {codexSessionId, parseCodexEvent} from "./providers/codex.js"
@@ -723,11 +723,19 @@ async function stopAndRemoveWorkerContainer(docker, containerId, requestOptions)
   let inspection = await docker.inspectContainer(containerId, requestOptions)
   if (typeof inspection?.State?.Running !== "boolean") throw new Error("Worker container state unavailable")
   if (inspection.State.Running) {
-    await docker.stopContainer(containerId, WORKER_STOP_GRACE_SECONDS, requestOptions)
+    try {
+      await docker.stopContainer(containerId, WORKER_STOP_GRACE_SECONDS, requestOptions)
+    } catch (error) {
+      if (!isContainerStopAlreadyStoppedError(error)) throw error
+    }
     inspection = await docker.inspectContainer(containerId, requestOptions)
     if (typeof inspection?.State?.Running !== "boolean") throw new Error("Worker container state unavailable")
     if (inspection.State.Running) {
-      await docker.killContainer(containerId, "KILL", requestOptions)
+      try {
+        await docker.killContainer(containerId, "KILL", requestOptions)
+      } catch (error) {
+        if (!isContainerKillConflictError(error)) throw error
+      }
       inspection = await docker.inspectContainer(containerId, requestOptions)
       if (inspection?.State?.Running !== false) throw new ContainerCleanupConfirmationError()
     }
@@ -735,6 +743,14 @@ async function stopAndRemoveWorkerContainer(docker, containerId, requestOptions)
   await docker.removeContainer(containerId, requestOptions)
 }
 
+function isContainerStopAlreadyStoppedError(error) {
+  return error instanceof DockerApiError && error.status === 304
+}
+
+function isContainerKillConflictError(error) {
+  return error instanceof DockerApiError && error.status === 409
+}
+
 class ContainerCleanupConfirmationError extends Error {
   /** @param {{cause?: unknown}} [options] */
   constructor(options = {}) {

package/src/provider-capacity-kimi.js

@@ -1,7 +1,7 @@
 // @ts-check
 
 import {isAbsolute, join} from "node:path"
-import {readResponseCapped} from "./absolute-deadline.js"
+import {readResponseCapped, ResponseCapacityError} from "./absolute-deadline.js"
 import {openKimiOAuthStore} from "./kimi-oauth-store.js"
 import {CapacityProbeError, DEFAULT_CAPACITY_TIMEOUT_MS, normalizeKimiUsages} from "./provider-capacity.js"
 
@@ -64,13 +64,22 @@ export async function probeKimiCapacity(options) {
   if (contentType === null || !contentType.toLowerCase().includes("application/json")) {
     throw new CapacityProbeError("protocol", "Kimi usages response has an unexpected content type")
   }
+  /** @type {Buffer} */
+  let bytes
+  try {
+    bytes = await readResponseCapped(response, MAX_USAGES_BYTES, signal)
+  } catch (error) {
+    if (error instanceof ResponseCapacityError) {
+      throw new CapacityProbeError("protocol", "Kimi usages response body exceeded the size bound")
+    }
+    throw new CapacityProbeError("unavailable", "Kimi usages response body is unavailable")
+  }
   /** @type {unknown} */
   let parsed
   try {
-    const bytes = await readResponseCapped(response, MAX_USAGES_BYTES, signal)
     parsed = JSON.parse(bytes.toString("utf8"))
   } catch {
-    throw new CapacityProbeError("protocol", "Kimi usages response is not valid bounded JSON")
+    throw new CapacityProbeError("protocol", "Kimi usages response is not valid JSON")
   }
   return normalizeKimiUsages(parsed)
 }

package/src/provider-capacity.js

@@ -213,7 +213,7 @@ function kimiQuotaWindow(value, windowDurationSeconds) {
   const used = quotaValue(value.used)
   const remaining = quotaValue(value.remaining)
   if (limit < 1 || used + remaining !== limit) throw kimiProtocolError()
-  const remainingPercent = Math.floor((remaining / limit) * 100)
+  const remainingPercent = Number((BigInt(remaining) * 100n) / BigInt(limit))
   return {
     usedPercent: 100 - remainingPercent,
     remainingPercent,