threadwire 0.1.6 → 0.1.8

package/CHANGELOG.md

@@ -0,0 +1,40 @@
+# Changelog
+
+## Unreleased
+
+## 0.1.8 - 2026-07-26
+
+- Add `threadwire run --transcript <path>` to durably capture the exact normalized
+  stdout JSONL protocol in a private, exclusive file while keeping activity logs
+  and scoped raw evidence artifacts separate.
+- Add an opt-in, fail-closed isolated Codex write runtime. A root-owned
+  supervisor launches one worktree-only worker per task while a separate narrow
+  model broker retains upstream credentials. Fresh/resume, secret rotation,
+  filesystem/network/socket escapes, configuration overrides and cleanup are
+  covered by adversarial Docker E2E.
+- Bind broker grants to dedicated trusted run-network listeners and an exact
+  allowlisted model/request schema; add stable worktree ancestry checks,
+  task-private persistent resume state, contained nested cwd and structured
+  Codex arguments. The Compose deployment is now an explicit opt-in override.
+- Allocate authenticated, uniquely labeled state per fresh Codex lineage;
+  reject volume adoption and nested worktree mounts; use Docker's structured
+  host-bind API; and require an explicit supervisor-side model allowlist.
+- Bound and eagerly expire preflight capabilities, serialize writable lineage
+  resumes, and automatically reconcile and garbage-collect authenticated state
+  volumes with restart-safe cleanup retry.
+- Bound active runs and Docker/broker operations through cleanup, reserve state
+  before awaited revalidation, autonomously close expired grant listeners, and
+  reconcile exactly owned workers and networks across every container state.
+- Abort accepted broker work and caller-disconnected runs at one absolute
+  deadline; make crash cleanup authority an fsync'd authenticated full run
+  identity rather than labels; and durably fsync registry rename evidence.
+- Carry one launch deadline from preflight through prompt/secret/evidence/
+  Telegram setup, worker execution and cleanup; make supervisor and broker
+  shutdown abort control uploads and active work; move Docker GC outside the
+  registry transaction; and stream-cap broker/runtime responses.
+- Gate worker start on one-shot activation of a verified pending broker grant
+  and address its listener by the inspected per-run IP, removing dynamic
+  network-alias readiness races.
+- Route relay-profile Telegram Codex jobs exclusively through the isolated
+  runtime, keep validate-only launches local, preserve bounded stdout/stderr
+  evidence channels, and protect live lineages from concurrent reconciliation.

package/README.md

@@ -7,6 +7,13 @@ non-root Codex provider, Docker secrets, loopback TLS proxy, verification, and
 rollback path, see [Container runtime](docs/container-runtime.md). The legacy
 host launcher below remains supported and is separate from that deployment.
 
+Relay-originated Codex writes are explicit and default off. `--relay-write`
+requires a reviewed `--workspace-profile` plus the root-owned isolated runtime
+and credential broker. The worker gets one writable task worktree, no upstream
+or Git credential, and no route except its run-scoped broker. Missing
+prerequisites fail before prompt or credential reads with no native fallback.
+See [Isolated provider runtime](docs/isolated-provider-runtime.md).
+
 ## Run with npx
 
 Threadwire requires Node.js 22 or newer. Run the published CLI without a global
@@ -67,13 +74,17 @@ Threadwire directly spawns the structurally separate terminal adapters `/opt/dat
 
 The relay contract: the caller supplies `THREADWIRE_TARGET` (`telegram:<chat-id>` or `telegram:<chat-id>:<thread-id>`) and, optionally, `THREADWIRE_PROCESS_NUMBER`. The prompt arrives on a piped stdin; all native provider flags pass through after `--`. A positional prompt is never parsed. A missing `THREADWIRE_TARGET` fails closed (exit code 2) and a malformed one is rejected by the launcher's token-free preflight — the shim never invents a default destination and never silently downgrades a requested relay to a direct run. A shim relays only for a worker mode (`codex exec …`, `opencode-local-fleet run …`, or any non-interactive `claude …`); it drops the worker subcommand before relaying and Threadwire re-adds it around the prompt. Version and help queries, non-worker subcommands, interactive TTY sessions, and any invocation already inside a relayed run (`THREADWIRE_ACTIVE=1`, so nested provider workers stay local/native) run the real CLI directly through the libexec adapter.
 
-Pass `--resume-session <exact-provider-session-id>` to continue a stored Codex, Claude, or OpenCode session. Threadwire preserves the provider's native resume ordering and streaming options and never uses implicit latest-session behavior. To request a local JSONL activity log, pass `--activity-log <path>`. It writes only safe local facts: the selected workspace profile plus immutable workspace provenance, provider-started facts (`provider`, child `pid`), and session-available facts (`provider`, native `sessionId`). Raw events, reasoning, tool data, stderr, credentials, prompts, and Telegram token data are excluded. This activity log is local-only and is never enqueued for Telegram delivery.
+Pass `--resume-session <exact-provider-session-id>` to continue a stored Codex, Claude, or OpenCode session. Threadwire preserves the provider's native resume ordering and streaming options and never uses implicit latest-session behavior.
+
+Pass `--transcript <path>` to capture the exact normalized, caller-facing JSONL protocol written to run stdout. The file is created privately (mode `0600`), must not already exist, and contains the same records in the same byte order as stdout. It never contains provider JSONL, reasoning, tool payloads, prompts, stderr, or credentials.
+
+`--activity-log <path>` is different: it retains its append contract and writes only minimal safe lifecycle facts—the selected workspace profile and immutable provenance, provider start (`provider`, child `pid`), and available native session ID. It is local-only and never enters Telegram or normalized stdout.
 
 Provider stdout is decoded as JSONL with a finite 1 MiB UTF-8 byte limit for each pending unterminated record. Exceeding it rejects the run, removes listeners and signal handlers, and terminates the provider without parsing or rendering the oversized content.
 
 For normal `threadwire run` execution, Threadwire stdout is the parent-model admission plane. It emits exactly one versioned terminal `delegated_result` JSON object and no progress records. The envelope contains a bounded, credential-redacted, control-normalized final conclusion when one was produced, structured terminal state and exit code, and the exact bounded provider session handle when available. Its closed schema can also represent concise blocker/decision requests, opaque artifact handles, commit/URL references, and a concise validation summary; current provider adapters do not infer these optional fields from prose. Unknown, nested, wrongly typed, cardinality-invalid, or oversized admission candidates fail closed. See [Delegated-result protocol](docs/delegated-result-protocol.md) for the complete schema, limits, and caller obligations.
 
-Set the trusted operator setting `THREADWIRE_EVIDENCE_ROOT` for standalone runs to persist the delegated prompt and raw provider stdout/stderr as a scoped file-backed artifact; Telegram ingress uses its dedicated evidence volume automatically. The parent or owning Telegram topic receives only an opaque bearer handle. Retrieve later with `threadwire evidence read` or the authenticated `/evidence` Telegram command and an explicit bounded selector. See [Evidence artifacts](docs/evidence-artifacts.md) for permissions, quotas, retention, recovery, authorization, redaction, privacy, and cleanup behavior.
+Scoped raw evidence artifacts are separate from both files above. Set the trusted operator setting `THREADWIRE_EVIDENCE_ROOT` for standalone runs to persist the delegated prompt and raw provider stdout/stderr as a scoped file-backed artifact; Telegram ingress uses its dedicated evidence volume automatically. The parent or owning Telegram topic receives only an opaque bearer handle. Retrieve later with `threadwire evidence read` or the authenticated `/evidence` Telegram command and an explicit bounded selector. See [Evidence artifacts](docs/evidence-artifacts.md) for permissions, quotas, retention, recovery, authorization, redaction, privacy, and cleanup behavior.
 
 Telegram is the separate user-visible progress plane. Lifecycle notices, diagnostics, tool activity, and assistant streaming continue there independently; `--tool-messages` affects only Telegram. Execution-environment details, provider records and streams, lifecycle progress, diagnostics, tool names/arguments/details/output, stderr, prompts, narration/reasoning, and full transcripts never enter stdout. Threadwire's bounded error diagnostic remains on stderr. Help output is the sole non-run, human-readable stdout mode. This default is an intentional pre-1.0 protocol break from the former mixed Hermes JSONL stream.
 

package/TELEGRAM-INGRESS.md

@@ -1,6 +1,9 @@
 # Telegram Ingress for Threadwire
 
-Standalone Threadwire webhook service that accepts Telegram Bot API updates and launches Threadwire's existing worker path (`createProvider` → Telegram transport/sender → `NoticeQueue` → `Relay` → `runWorker`). Hermes is not involved.
+Standalone Threadwire webhook service that accepts Telegram Bot API updates.
+Native providers use the existing worker path; when isolated-runtime authority
+is configured, Codex uses isolated preflight/run exclusively with no native
+fallback. Hermes is not involved.
 
 ## Important bot ownership
 
@@ -49,7 +52,10 @@ The process binds to **loopback (`127.0.0.1`) by default**. Expose it only throu
 - Provider child env strips Telegram tokens, webhook secret, allowlists, bind/port, concurrency, tool-message, and update-guard service config. `runWorker` also strips Telegram tokens.
 - No logging of headers, bodies, prompts, or secrets.
 - Webhook secret must be at least 32 characters after trim.
-- Accepted work returns `202` only after the worker child has actually spawned (`onSpawn`); process completion alone is never treated as dispatch success.
+- Native work returns `202` only after the worker child has actually spawned
+  (`onSpawn`). Isolated Codex work returns `202` only after the authenticated
+  isolated run completes successfully; preflight alone is never treated as
+  dispatch success.
 - Failure before spawn rejects the request with `500` and is reported once via the operational error reporter.
 - Failure after spawn is reported once via the worker-failure reporter (not double-reported through both channels in the real entrypoint wiring).
 - Authenticated irrelevant updates return `200`.

package/bin/isolated-runtime.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+
+import {startIsolatedRuntime} from "../src/isolated-runtime.js"
+
+await startIsolatedRuntime()

package/bin/model-broker.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+
+import {startModelBroker} from "../src/model-broker.js"
+
+await startModelBroker()

package/docs/isolated-provider-runtime.md

@@ -0,0 +1,137 @@
+# Isolated provider runtime
+
+Relay-originated Codex writes are disabled unless the caller supplies both
+`--relay-write` and a reviewed `--workspace-profile`. The write path never
+falls back to the native provider launcher.
+When the Telegram service is configured with isolated-runtime authority, Codex
+webhook jobs use the same preflight/run boundary exclusively; an unavailable
+runtime fails the job rather than invoking the native runner. Raw provider
+stdout and stderr are returned as separately identified, bounded chunks for
+the existing evidence callbacks.
+
+## Security boundary
+
+Telegram ingress has neither provider secrets nor container-runtime authority.
+The root-owned isolated-runtime supervisor has Docker authority and a read-only
+view of allowlisted worktree roots, but no provider credential. The model
+broker alone mounts the upstream credential. Each grant creates a listener
+bound to the broker's trusted per-run network interface. That listener accepts
+one token, one run/network lineage, one allowlisted model, and a closed
+`/v1/responses` schema; it is not a generic HTTP proxy.
+The listener remains non-authorizing while the supervisor creates and verifies
+the worker. The supervisor then activates it exactly once immediately before
+worker start. Workers receive the inspected per-run broker IP directly, so
+launch does not depend on asynchronous container-DNS alias propagation.
+
+For each fresh or explicit-resume run the supervisor creates a unique Docker
+internal network, attaches the broker, and launches an immutable worker. The
+worker has a read-only root, all capabilities dropped, no-new-privileges,
+container-local tmp/run, resource limits, and exactly one writable
+worktree mount. It has no host home, common Git directory, sibling worktree,
+host temp, shared provider state, secret, Docker/SSH socket, or external route. Its
+short-lived broker grant is revoked during cleanup.
+The grant owns one absolute deadline and every accepted socket. Expiry,
+explicit revoke, credential reload, or broker shutdown aborts an incomplete
+upload or upstream request, destroys accepted sockets, and closes the listener;
+authorization is checked again after the bounded request body is acquired.
+
+Codex state lives in a unique, random, immutable-label Docker volume for each
+fresh lineage, never a host or common Codex home. An HMAC-authenticated,
+root-private supervisor registry maps returned session IDs to that exact
+volume. Resume revalidates the volume's owner, namespace, task, and lineage
+labels before every mount. A collision, unlabeled or differently labeled
+preexisting volume, sibling,
+missing, expired, or lost state fails before worker creation.
+Only one worker may mount a lineage at a time; the supervisor holds an atomic
+reservation from preflight consumption through worker cleanup. Expired aliases
+are removed by authenticated periodic GC. The registry retains lineage
+ownership until Docker confirms deletion, retries cleanup failures, and
+reconciles exactly labelled orphan volumes on startup while preserving volumes
+referenced by in-process runs. On restart, exactly owned created, running, or
+exited orphan workers and their networks are removed before volume GC retries.
+An fsync'd, HMAC-authenticated run record binds the generated names, pinned
+image digest, entrypoint policy, private network, state volume, and exact
+worktree mount source/options. Reconciliation inspects that full identity and
+network endpoint membership; forgeable labels or any mismatched name, image,
+mount, option, command, or endpoint are never deletion authority.
+
+Preflight verifies Docker, the immutable image, broker readiness, the
+allowlisted non-symlink worktree with no nested mounts, stable device/inode ancestry, and mount policy before prompt, Telegram
+token, dotenv, evidence, resume state, executable override, or provider
+credential reads. The ancestry is revalidated immediately before container
+creation and start, and the immutable entrypoint verifies the mounted worktree
+and reviewed nested cwd before Codex. Only `--model` and `--color` are accepted;
+they are transported as a JSON array and passed exactly once without shell
+splitting. All other provider arguments are rejected before launch.
+Authenticated preflight admission has strict endpoint/field size limits,
+global and per-task caps, and an eager timer sweep, so abandoned capabilities
+expire without requiring a matching `/run`.
+Consumed capabilities enter a separate global/per-task active-run admission
+before validation can yield. The lineage reservation is acquired synchronously
+at that boundary, preventing periodic GC from deleting resume state during
+revalidation. Docker and broker operations have bounded deadlines, and each
+worker has a bounded operator-configured lifetime; timeout cleanup revokes the
+grant and removes the exactly labelled worker and network before capacity is
+released.
+The relay creates one absolute launch deadline before preflight. The same
+deadline and cancellation signal span prompt/stdin and file-secret reads,
+evidence and Telegram setup, Docker setup, broker readiness, execution,
+response/log reads, upstream work and exact cleanup. A disconnected caller or
+supervisor shutdown aborts its run. Independent per-step timeouts cannot extend
+the overall budget, and response bodies are stream-limited to 2 MiB.
+
+Codex bypasses its nested sandbox only inside this mandatory outer container.
+Its task-private home contains only that lineage's session state; persisted
+config, rules, hooks, plugins, MCP files and instruction files are rejected
+before Codex starts. MCP is forced empty and project instruction loading is disabled.
+Failure to create the outer boundary is fatal.
+
+## Deployment and rotation
+
+The default `compose.yaml` contains no provider secret, broker, supervisor, or
+Docker socket. Enable writes only with both files and the explicit profile:
+
+```sh
+docker compose -f compose.yaml -f compose.relay-write.yaml --profile relay-write up
+```
+
+The override fails interpolation unless every required image, control token,
+worktree root, allowlist and credential-file setting is present. Set immutable supervisor, broker, and worker images; a host
+`THREADWIRE_WORKSPACE_ROOT`; JSON `THREADWIRE_ALLOWED_WORKTREE_ROOTS`; separate
+runtime and broker control tokens; `THREADWIRE_ALLOWED_CODEX_MODELS` as a JSON
+server-side model allowlist; a unique `THREADWIRE_STATE_NAMESPACE`; a random
+`THREADWIRE_STATE_AUTH_KEY` of at least 32 characters; and a deployment secret file for the Codex
+credential. The supervisor alone receives `/var/run/docker.sock`. Restrict
+broker egress at the host/firewall to provider endpoints.
+
+The supervisor defaults to 16 active runs globally, two per reviewed task, a
+30-second maximum preflight slice, and a one-hour end-to-end launch deadline. Operators may
+lower these finite limits with `THREADWIRE_PREFLIGHT_TIMEOUT_MS`,
+`THREADWIRE_ACTIVE_RUN_CAPACITY`, `THREADWIRE_ACTIVE_TASK_CAPACITY`, and
+`THREADWIRE_WORKER_TIMEOUT_MS`; invalid, zero, or excessive values fail startup.
+
+The authenticated registry persists through file fsync, atomic rename, and
+parent-directory fsync. Startup removes only strictly named abandoned temp
+files whose complete contents authenticate under the deployment key; malformed
+or foreign files are left untouched for operator inspection.
+
+`THREADWIRE_WORKTREE_VOLUME` is only for nested-Docker/test deployments. Docker
+volume `Subpath` still mounts only the selected task directory. Production uses
+the exact host bind through Docker's structured Mount API with private
+propagation. The supervisor verifies the resulting two-mount inventory before
+start, and the entrypoint independently rejects nested worktree mounts.
+
+Replace the broker secret atomically and restart it, or call authenticated
+`/admin/reload`. Reload increments the generation and revokes existing grants.
+Missing, writable, symlinked, empty, or oversized secret files keep it unready.
+
+If Docker, broker, pinned image, worktree, security option, or private network
+is unavailable, relay write fails closed. There is no native fallback.
+
+## Verification
+
+Run `npm run all-checks`, `npm run verify:package`, and
+`npm run test:isolated-runtime-e2e` with broker, runtime, hostile-probe,
+production relay-worker, and fake-upstream image variables documented
+by that script. E2E uses host-volume canaries and fake-upstream authorization
+logs; worker self-report is not the sole assertion.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "threadwire",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "description": "Stream Codex, Claude, and OpenCode worker progress to an explicit Telegram destination",
   "keywords": [
     "ai-agent",
@@ -14,6 +14,7 @@
   "private": false,
   "type": "module",
   "files": [
+    "CHANGELOG.md",
     "bin/",
     "docs/",
     "scripts/",
@@ -22,6 +23,8 @@
     "threadwire.workspace-profiles.json"
   ],
   "bin": {
+    "threadwire-isolated-runtime": "bin/isolated-runtime.js",
+    "threadwire-model-broker": "bin/model-broker.js",
     "threadwire": "bin/threadwire.js",
     "threadwire-telegram-webhook": "bin/telegram-webhook.js"
   },
@@ -49,6 +52,7 @@
     "prepublishOnly": "npm run all-checks && npm run verify:package",
     "test": "node --test \"test/**/*.test.js\"",
     "test:container-e2e": "sh docker/test/production-e2e.sh",
+    "test:isolated-runtime-e2e": "sh docker/test/isolated-runtime-e2e.sh",
     "typecheck": "tsc --noEmit",
     "verify:package": "node scripts/verify-package.js"
   },

package/scripts/provider-shims/front-door.sh.template

@@ -55,6 +55,24 @@ fi
 @@WORKER_SUBCOMMAND_SHIFT@@
 
 threadwire_relay_arguments=(run --provider "$THREADWIRE_PROVIDER" --target "$THREADWIRE_TARGET")
+case "${THREADWIRE_RELAY_WRITE:-0}" in
+  0) ;;
+  1)
+    if [[ ! "${THREADWIRE_WORKSPACE_PROFILE:-}" =~ ^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$ ]]; then
+      printf '%s\n' 'threadwire: relay write capability requires a valid THREADWIRE_WORKSPACE_PROFILE' >&2
+      exit 2
+    fi
+    if [[ "$THREADWIRE_PROVIDER" != codex ]]; then
+      printf '%s\n' 'threadwire: relay write capability is only supported for codex' >&2
+      exit 2
+    fi
+    threadwire_relay_arguments+=(--workspace-profile "$THREADWIRE_WORKSPACE_PROFILE" --relay-write)
+    ;;
+  *)
+    printf '%s\n' 'threadwire: relay write capability must be enabled with THREADWIRE_RELAY_WRITE=1' >&2
+    exit 2
+    ;;
+esac
 if [[ -n "${THREADWIRE_PROCESS_NUMBER:-}" ]]; then
   threadwire_relay_arguments+=(--process-number "$THREADWIRE_PROCESS_NUMBER")
 fi

package/scripts/verify-package.js

@@ -14,15 +14,19 @@ const npmEnvironment = {
   npm_config_dry_run: "false"
 }
 const EXPECTED_FILES = [
+  "CHANGELOG.md",
   "LICENSE",
   "README.md",
   "TELEGRAM-INGRESS.md",
   "bin/telegram-webhook.js",
   "bin/threadwire.js",
+  "bin/isolated-runtime.js",
+  "bin/model-broker.js",
   "docs/card-10520-plan.md",
   "docs/container-runtime.md",
   "docs/delegated-result-protocol.md",
   "docs/evidence-artifacts.md",
+  "docs/isolated-provider-runtime.md",
   "package.json",
   "scripts/atomic-install.js",
   "scripts/install-local-launcher.js",
@@ -32,11 +36,21 @@ const EXPECTED_FILES = [
   "scripts/provider-shims/front-door.sh.template",
   "scripts/provider-shims/opencode-local-fleet.adapter.sh",
   "scripts/verify-package.js",
+  "src/absolute-deadline.js",
   "src/activity-log.js",
+  "src/normalized-output.js",
   "src/cli.js",
   "src/context-budget-metrics.js",
   "src/delegated-result-admission.js",
+  "src/docker-api.js",
   "src/evidence-store.js",
+  "src/isolated-runtime-client.js",
+  "src/isolated-runtime.js",
+  "src/isolated-state.js",
+  "src/isolated-worker.js",
+  "src/model-broker-policy.js",
+  "src/model-broker.js",
+  "src/mount-policy.js",
   "src/notice-queue.js",
   "src/notifiers/fetch-transport.js",
   "src/notifiers/telegram.js",
@@ -46,6 +60,7 @@ const EXPECTED_FILES = [
   "src/providers/index.js",
   "src/providers/opencode.js",
   "src/relay.js",
+  "src/relay-write.js",
   "src/run-worker.js",
   "src/sentence-buffer.js",
   "src/telegram-ingress/command.js",

package/src/absolute-deadline.js

@@ -0,0 +1,94 @@
+// @ts-nocheck
+/* eslint-disable jsdoc/require-jsdoc */
+
+export class AbsoluteDeadline {
+  constructor(expiresAt, {signal, request, response, now = Date.now, timeoutMessage = "Operation timeout", disconnectMessage = "Caller disconnected"} = {}) {
+    if (!Number.isSafeInteger(expiresAt) || expiresAt <= now()) throw new Error(timeoutMessage)
+    this.expiresAt = expiresAt
+    this.now = now
+    this.controller = new AbortController()
+    this.signal = this.controller.signal
+    this.parentSignal = signal
+    this.request = request
+    this.response = response
+    this.socket = request?.socket
+    this.timeoutMessage = timeoutMessage
+    this.abortParent = () => this.controller.abort(signal.reason instanceof Error ? signal.reason : new Error("Operation aborted"))
+    this.abortRequest = () => this.controller.abort(new Error(disconnectMessage))
+    this.abortResponse = () => {
+      if (!response?.writableEnded) this.abortRequest()
+    }
+    this.abortSocket = () => {
+      if (!response?.writableEnded) this.abortRequest()
+    }
+    if (signal?.aborted) this.abortParent()
+    else signal?.addEventListener("abort", this.abortParent, {once: true})
+    request?.once?.("aborted", this.abortRequest)
+    response?.once?.("close", this.abortResponse)
+    this.socket?.once?.("close", this.abortSocket)
+    this.timer = setTimeout(() => this.controller.abort(new Error(timeoutMessage)), Math.max(1, expiresAt - now()))
+    this.timer.unref()
+    this.signal.addEventListener("abort", () => request?.destroy?.(this.signal.reason), {once: true})
+    if (request?.aborted || (response?.destroyed && !response.writableEnded)) this.abortRequest()
+  }
+  remaining() {
+    this.throwIfAborted()
+    const remaining = this.expiresAt - this.now()
+    if (remaining <= 0) {
+      this.controller.abort(new Error(this.timeoutMessage))
+      this.throwIfAborted()
+    }
+    return Math.max(1, remaining)
+  }
+  options() {
+    return {signal: this.signal, timeoutMs: this.remaining()}
+  }
+  throwIfAborted() {
+    if (this.signal.aborted) throw this.signal.reason instanceof Error ? this.signal.reason : new Error("Operation aborted")
+  }
+  close() {
+    clearTimeout(this.timer)
+    this.abortParent && this.parentSignal?.removeEventListener?.("abort", this.abortParent)
+    this.request?.off?.("aborted", this.abortRequest)
+    this.response?.off?.("close", this.abortResponse)
+    this.socket?.off?.("close", this.abortSocket)
+  }
+}
+
+export function deadlineAfter(timeoutMs, options = {}) {
+  const now = options.now ?? Date.now
+  return new AbsoluteDeadline(now() + timeoutMs, {...options, now})
+}
+
+export async function abortable(promise, signal) {
+  if (signal?.aborted) throw signal.reason
+  if (!signal) return promise
+  return new Promise((resolve, reject) => {
+    const abort = () => reject(signal.reason instanceof Error ? signal.reason : new Error("Operation aborted"))
+    signal.addEventListener("abort", abort, {once: true})
+    Promise.resolve(promise).then(resolve, reject).finally(() => signal.removeEventListener("abort", abort))
+  })
+}
+
+export async function readResponseCapped(response, capacity, signal) {
+  const reader = response.body?.getReader()
+  if (!reader) return Buffer.alloc(0)
+  const chunks = []
+  let size = 0
+  try {
+    while (true) {
+      const {done, value} = await abortable(reader.read(), signal)
+      if (done) break
+      const chunk = Buffer.from(value)
+      size += chunk.length
+      if (size > capacity) {
+        await reader.cancel(new Error("Response exceeded capacity")).catch(() => {})
+        throw new Error("Response exceeded capacity")
+      }
+      chunks.push(chunk)
+    }
+    return Buffer.concat(chunks, size)
+  } finally {
+    reader.releaseLock()
+  }
+}