threadwire 0.1.5 → 0.1.8

package/scripts/provider-shims/front-door.sh.template

@@ -55,6 +55,24 @@ fi
 @@WORKER_SUBCOMMAND_SHIFT@@
 
 threadwire_relay_arguments=(run --provider "$THREADWIRE_PROVIDER" --target "$THREADWIRE_TARGET")
+case "${THREADWIRE_RELAY_WRITE:-0}" in
+  0) ;;
+  1)
+    if [[ ! "${THREADWIRE_WORKSPACE_PROFILE:-}" =~ ^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$ ]]; then
+      printf '%s\n' 'threadwire: relay write capability requires a valid THREADWIRE_WORKSPACE_PROFILE' >&2
+      exit 2
+    fi
+    if [[ "$THREADWIRE_PROVIDER" != codex ]]; then
+      printf '%s\n' 'threadwire: relay write capability is only supported for codex' >&2
+      exit 2
+    fi
+    threadwire_relay_arguments+=(--workspace-profile "$THREADWIRE_WORKSPACE_PROFILE" --relay-write)
+    ;;
+  *)
+    printf '%s\n' 'threadwire: relay write capability must be enabled with THREADWIRE_RELAY_WRITE=1' >&2
+    exit 2
+    ;;
+esac
 if [[ -n "${THREADWIRE_PROCESS_NUMBER:-}" ]]; then
   threadwire_relay_arguments+=(--process-number "$THREADWIRE_PROCESS_NUMBER")
 fi

package/scripts/verify-package.js

@@ -14,12 +14,19 @@ const npmEnvironment = {
   npm_config_dry_run: "false"
 }
 const EXPECTED_FILES = [
+  "CHANGELOG.md",
   "LICENSE",
   "README.md",
   "TELEGRAM-INGRESS.md",
   "bin/telegram-webhook.js",
   "bin/threadwire.js",
+  "bin/isolated-runtime.js",
+  "bin/model-broker.js",
+  "docs/card-10520-plan.md",
   "docs/container-runtime.md",
+  "docs/delegated-result-protocol.md",
+  "docs/evidence-artifacts.md",
+  "docs/isolated-provider-runtime.md",
   "package.json",
   "scripts/atomic-install.js",
   "scripts/install-local-launcher.js",
@@ -29,9 +36,21 @@ const EXPECTED_FILES = [
   "scripts/provider-shims/front-door.sh.template",
   "scripts/provider-shims/opencode-local-fleet.adapter.sh",
   "scripts/verify-package.js",
+  "src/absolute-deadline.js",
   "src/activity-log.js",
+  "src/normalized-output.js",
   "src/cli.js",
-  "src/hermes-protocol.js",
+  "src/context-budget-metrics.js",
+  "src/delegated-result-admission.js",
+  "src/docker-api.js",
+  "src/evidence-store.js",
+  "src/isolated-runtime-client.js",
+  "src/isolated-runtime.js",
+  "src/isolated-state.js",
+  "src/isolated-worker.js",
+  "src/model-broker-policy.js",
+  "src/model-broker.js",
+  "src/mount-policy.js",
   "src/notice-queue.js",
   "src/notifiers/fetch-transport.js",
   "src/notifiers/telegram.js",
@@ -41,6 +60,7 @@ const EXPECTED_FILES = [
   "src/providers/index.js",
   "src/providers/opencode.js",
   "src/relay.js",
+  "src/relay-write.js",
   "src/run-worker.js",
   "src/sentence-buffer.js",
   "src/telegram-ingress/command.js",
@@ -51,6 +71,7 @@ const EXPECTED_FILES = [
   "src/telegram-ingress/update-guard.js",
   "src/telegram-webhook.js",
   "src/types.js",
+  "src/worker-control.js",
   "src/workspace-profile.js",
   "threadwire.workspace-profiles.json"
 ]

package/src/absolute-deadline.js

@@ -0,0 +1,94 @@
+// @ts-nocheck
+/* eslint-disable jsdoc/require-jsdoc */
+
+export class AbsoluteDeadline {
+  constructor(expiresAt, {signal, request, response, now = Date.now, timeoutMessage = "Operation timeout", disconnectMessage = "Caller disconnected"} = {}) {
+    if (!Number.isSafeInteger(expiresAt) || expiresAt <= now()) throw new Error(timeoutMessage)
+    this.expiresAt = expiresAt
+    this.now = now
+    this.controller = new AbortController()
+    this.signal = this.controller.signal
+    this.parentSignal = signal
+    this.request = request
+    this.response = response
+    this.socket = request?.socket
+    this.timeoutMessage = timeoutMessage
+    this.abortParent = () => this.controller.abort(signal.reason instanceof Error ? signal.reason : new Error("Operation aborted"))
+    this.abortRequest = () => this.controller.abort(new Error(disconnectMessage))
+    this.abortResponse = () => {
+      if (!response?.writableEnded) this.abortRequest()
+    }
+    this.abortSocket = () => {
+      if (!response?.writableEnded) this.abortRequest()
+    }
+    if (signal?.aborted) this.abortParent()
+    else signal?.addEventListener("abort", this.abortParent, {once: true})
+    request?.once?.("aborted", this.abortRequest)
+    response?.once?.("close", this.abortResponse)
+    this.socket?.once?.("close", this.abortSocket)
+    this.timer = setTimeout(() => this.controller.abort(new Error(timeoutMessage)), Math.max(1, expiresAt - now()))
+    this.timer.unref()
+    this.signal.addEventListener("abort", () => request?.destroy?.(this.signal.reason), {once: true})
+    if (request?.aborted || (response?.destroyed && !response.writableEnded)) this.abortRequest()
+  }
+  remaining() {
+    this.throwIfAborted()
+    const remaining = this.expiresAt - this.now()
+    if (remaining <= 0) {
+      this.controller.abort(new Error(this.timeoutMessage))
+      this.throwIfAborted()
+    }
+    return Math.max(1, remaining)
+  }
+  options() {
+    return {signal: this.signal, timeoutMs: this.remaining()}
+  }
+  throwIfAborted() {
+    if (this.signal.aborted) throw this.signal.reason instanceof Error ? this.signal.reason : new Error("Operation aborted")
+  }
+  close() {
+    clearTimeout(this.timer)
+    this.abortParent && this.parentSignal?.removeEventListener?.("abort", this.abortParent)
+    this.request?.off?.("aborted", this.abortRequest)
+    this.response?.off?.("close", this.abortResponse)
+    this.socket?.off?.("close", this.abortSocket)
+  }
+}
+
+export function deadlineAfter(timeoutMs, options = {}) {
+  const now = options.now ?? Date.now
+  return new AbsoluteDeadline(now() + timeoutMs, {...options, now})
+}
+
+export async function abortable(promise, signal) {
+  if (signal?.aborted) throw signal.reason
+  if (!signal) return promise
+  return new Promise((resolve, reject) => {
+    const abort = () => reject(signal.reason instanceof Error ? signal.reason : new Error("Operation aborted"))
+    signal.addEventListener("abort", abort, {once: true})
+    Promise.resolve(promise).then(resolve, reject).finally(() => signal.removeEventListener("abort", abort))
+  })
+}
+
+export async function readResponseCapped(response, capacity, signal) {
+  const reader = response.body?.getReader()
+  if (!reader) return Buffer.alloc(0)
+  const chunks = []
+  let size = 0
+  try {
+    while (true) {
+      const {done, value} = await abortable(reader.read(), signal)
+      if (done) break
+      const chunk = Buffer.from(value)
+      size += chunk.length
+      if (size > capacity) {
+        await reader.cancel(new Error("Response exceeded capacity")).catch(() => {})
+        throw new Error("Response exceeded capacity")
+      }
+      chunks.push(chunk)
+    }
+    return Buffer.concat(chunks, size)
+  } finally {
+    reader.releaseLock()
+  }
+}