threadwire 0.1.6 → 0.1.8

package/src/model-broker.js

@@ -0,0 +1,313 @@
+// @ts-nocheck
+/* eslint-disable jsdoc/require-jsdoc */
+
+import {constants} from "node:fs"
+import {open} from "node:fs/promises"
+import {createServer} from "node:http"
+import {bearerToken, createGrantStore, validateBrokerRequest, validateResponsesBody} from "./model-broker-policy.js"
+import {abortable, readResponseCapped} from "./absolute-deadline.js"
+
+const MAX_BODY_BYTES = 2_097_152
+const MAX_SECRET_BYTES = 65_536
+
+/** @param {{environment?: NodeJS.ProcessEnv, fetchImplementation?: typeof fetch}} [options] */
+export async function startModelBroker(options = {}) {
+  const environment = options.environment ?? process.env
+  const host = environment.THREADWIRE_MODEL_BROKER_HOST ?? "0.0.0.0"
+  const port = portValue(environment.THREADWIRE_MODEL_BROKER_PORT, 8789)
+  const adminToken = safeSetting(environment.THREADWIRE_MODEL_BROKER_ADMIN_TOKEN, "THREADWIRE_MODEL_BROKER_ADMIN_TOKEN")
+  const upstream = upstreamUrl(environment.THREADWIRE_CODEX_UPSTREAM_URL)
+  let credential = await readSecretFile(environment.THREADWIRE_CODEX_CREDENTIAL_FILE)
+  let generation = 1
+  let reloading = false
+  let stopping = false
+  const shutdown = new AbortController()
+  const controlSockets = new Set()
+  const grants = createGrantStore()
+  /** @type {Map<string, import("node:http").Server>} */
+  const listeners = new Map()
+  /** @type {Map<string, {controller: AbortController, timer: NodeJS.Timeout, sockets: Set<import("node:net").Socket>}>} */
+  const grantRuntimes = new Map()
+  const fetchImplementation = options.fetchImplementation ?? fetch
+  const revokeGrant = async (token) => {
+    grants.revoke(token)
+    const runtime = grantRuntimes.get(token)
+    grantRuntimes.delete(token)
+    if (runtime !== undefined) {
+      clearTimeout(runtime.timer)
+      runtime.controller.abort(new Error("Broker grant expired"))
+      for (const socket of runtime.sockets) socket.destroy()
+      runtime.sockets.clear()
+    }
+    await closeListener(listeners, token, 1000)
+  }
+
+  const server = createServer(async (request, response) => {
+    try {
+      if (stopping) throw new Error("Model broker is shutting down")
+      if (request.method === "GET" && request.url === "/healthz") {
+        response.writeHead(200, {"content-type": "application/json"})
+        response.end(JSON.stringify({ok: true, generation}))
+        return
+      }
+      if (request.url === "/admin/grants" && request.method === "POST") {
+        requireAdmin(request.headers.authorization, adminToken)
+        if (reloading) throw new Error("Model broker reload is active")
+        const body = await readJson(request, shutdown.signal)
+        const grant = parseGrant(body)
+        const expiresAt = Date.now() + grant.ttlMs
+        const token = grants.issue(grant)
+        const controller = new AbortController()
+        const sockets = new Set()
+        const listener = createServer((workerRequest, workerResponse) => {
+          proxyWorkerRequest(workerRequest, workerResponse, {
+            grants, token, grant, credential: () => credential, upstream, fetchImplementation,
+            signal: controller.signal
+          }).catch((error) => {
+            if (workerResponse.destroyed) return
+            process.stderr.write(`threadwire-model-broker: ${error instanceof Error ? error.message : "request failed"}\n`)
+            const status = isClientError(error) ? 403 : 502
+            sendJson(workerResponse, status, {error: status === 403 ? "request denied" : "model broker unavailable"})
+          })
+        })
+        listener.on("connection", (socket) => {
+          if (controller.signal.aborted) {
+            socket.destroy()
+            return
+          }
+          sockets.add(socket)
+          socket.once("close", () => sockets.delete(socket))
+        })
+        try {
+          await listen(listener, 0, grant.brokerAddress)
+        } catch (error) {
+          grants.revoke(token)
+          throw error
+        }
+        listeners.set(token, listener)
+        const expiryTimer = setTimeout(() => { void revokeGrant(token) }, Math.max(1, expiresAt - Date.now()))
+        expiryTimer.unref()
+        grantRuntimes.set(token, {controller, timer: expiryTimer, sockets})
+        const address = listener.address()
+        if (address === null || typeof address === "string") throw new Error("Invalid broker listener")
+        sendJson(response, 201, {token, generation, port: address.port})
+        return
+      }
+      if (request.url?.startsWith("/admin/grants/") && request.method === "DELETE") {
+        requireAdmin(request.headers.authorization, adminToken)
+        const token = decodeURIComponent(request.url.slice("/admin/grants/".length))
+        await revokeGrant(token)
+        response.writeHead(204)
+        response.end()
+        return
+      }
+      if (request.url?.startsWith("/admin/grants/") && request.url.endsWith("/activate") && request.method === "POST") {
+        requireAdmin(request.headers.authorization, adminToken)
+        const token = decodeURIComponent(request.url.slice("/admin/grants/".length, -"/activate".length))
+        grants.activate(token)
+        sendJson(response, 200, {ok: true})
+        return
+      }
+      if (request.url === "/admin/reload" && request.method === "POST") {
+        requireAdmin(request.headers.authorization, adminToken)
+        if (reloading) throw new Error("Model broker reload is active")
+        reloading = true
+        try {
+          const replacement = await readSecretFile(environment.THREADWIRE_CODEX_CREDENTIAL_FILE)
+          grants.clear()
+          await Promise.all([...listeners.keys()].map(revokeGrant))
+          credential = replacement
+          generation += 1
+        } finally {
+          reloading = false
+        }
+        sendJson(response, 200, {ok: true, generation})
+        return
+      }
+      sendJson(response, 403, {error: "request denied"})
+    } catch (error) {
+      const status = isClientError(error) ? 403 : 502
+      sendJson(response, status, {error: status === 403 ? "request denied" : "model broker unavailable"})
+    }
+  })
+  server.on("connection", (socket) => {
+    if (shutdown.signal.aborted) return socket.destroy()
+    controlSockets.add(socket)
+    socket.once("close", () => controlSockets.delete(socket))
+  })
+  await listen(server, port, host)
+  return {
+    server,
+    close: async () => {
+      stopping = true
+      shutdown.abort(new Error("Model broker is shutting down"))
+      for (const socket of controlSockets) socket.destroy()
+      await Promise.all([...listeners.keys()].map(revokeGrant))
+      await Promise.race([
+        new Promise((resolve) => server.close(() => resolve(undefined))),
+        new Promise((resolve) => {
+          const timer = setTimeout(resolve, 1000)
+          timer.unref()
+        })
+      ])
+    },
+    activeListeners: () => listeners.size,
+    config: {host, port, upstream: upstream.toString()}
+  }
+}
+
+/** @param {unknown} value */
+function parseGrant(value) {
+  if (!isRecord(value) || value.provider !== "codex" || typeof value.runId !== "string" || typeof value.networkId !== "string" || typeof value.model !== "string" || typeof value.brokerAddress !== "string") {
+    throw new Error("Invalid broker grant")
+  }
+  if (!/^(?:\d{1,3}\.){3}\d{1,3}$/u.test(value.brokerAddress)) throw new Error("Invalid broker grant")
+  const ttlMs = value.ttlMs
+  if (typeof ttlMs !== "number") throw new Error("Invalid broker grant")
+  return {provider: "codex", runId: value.runId, networkId: value.networkId, model: value.model, brokerAddress: value.brokerAddress, ttlMs}
+}
+
+async function proxyWorkerRequest(request, response, options) {
+  throwIfAborted(options.signal)
+  const policyHeaders = {...request.headers}
+  delete policyHeaders.host
+  delete policyHeaders.connection
+  delete policyHeaders["transfer-encoding"]
+  validateBrokerRequest({method: request.method, path: request.url, headers: policyHeaders})
+  const suppliedToken = bearerToken(request.headers.authorization)
+  if (suppliedToken !== options.token) throw new Error("Broker grant token mismatch")
+  const grant = options.grants.authorize(suppliedToken, {
+    provider: "codex", networkId: options.grant.networkId, runId: options.grant.runId
+  })
+  const body = await readBody(request, options.signal)
+  throwIfAborted(options.signal)
+  options.grants.authorize(suppliedToken, {
+    provider: "codex", networkId: options.grant.networkId, runId: options.grant.runId
+  })
+  validateResponsesBody(body, grant.model)
+  throwIfAborted(options.signal)
+  const upstreamResponse = await abortable(options.fetchImplementation(new URL("/v1/responses", options.upstream), {
+    method: "POST",
+    redirect: "error",
+    headers: {
+      authorization: `Bearer ${options.credential()}`,
+      "content-type": "application/json",
+      "user-agent": "threadwire-model-broker/1"
+    },
+    body,
+    signal: options.signal
+  }), options.signal)
+  throwIfAborted(options.signal)
+  const bytes = await readResponseCapped(upstreamResponse, MAX_BODY_BYTES, options.signal)
+  throwIfAborted(options.signal)
+  response.writeHead(upstreamResponse.status, {"content-type": safeContentType(upstreamResponse.headers.get("content-type"))})
+  response.end(bytes)
+}
+
+async function closeListener(listeners, token, timeoutMs) {
+  const listener = listeners.get(token)
+  listeners.delete(token)
+  if (listener === undefined) return
+  await Promise.race([
+    new Promise((resolve) => listener.close(() => resolve(undefined))),
+    new Promise((resolve) => {
+      const timer = setTimeout(resolve, timeoutMs)
+      timer.unref()
+    })
+  ])
+}
+
+async function readSecretFile(path) {
+  const safePath = safeSetting(path, "THREADWIRE_CODEX_CREDENTIAL_FILE")
+  let handle
+  try {
+    handle = await open(safePath, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK)
+    const metadata = await handle.stat()
+    if (!metadata.isFile() || metadata.size < 1 || metadata.size > MAX_SECRET_BYTES || (metadata.mode & 0o022) !== 0) throw new Error()
+    const value = (await handle.readFile("utf8")).replace(/[\r\n]+$/u, "")
+    if (value.length === 0 || /[\r\n]/u.test(value)) throw new Error()
+    return value
+  } catch {
+    throw new Error("Codex credential file is unavailable")
+  } finally {
+    await handle?.close().catch(() => {})
+  }
+}
+
+async function readJson(request, signal) {
+  const body = await readBody(request, signal)
+  try {
+    return JSON.parse(body.toString("utf8"))
+  } catch {
+    throw new Error("Invalid request")
+  }
+}
+
+async function readBody(request, signal) {
+  const chunks = []
+  let size = 0
+  for await (const chunk of request) {
+    throwIfAborted(signal)
+    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)
+    size += buffer.length
+    if (size > MAX_BODY_BYTES) throw new Error("Request exceeded capacity")
+    chunks.push(buffer)
+  }
+  throwIfAborted(signal)
+  return Buffer.concat(chunks)
+}
+
+function throwIfAborted(signal) {
+  if (signal?.aborted) throw signal.reason instanceof Error ? signal.reason : new Error("Broker grant expired")
+}
+
+function requireAdmin(value, expected) {
+  if (value !== `Bearer ${expected}`) throw new Error("Request denied")
+}
+
+function upstreamUrl(value) {
+  const url = new URL(safeSetting(value, "THREADWIRE_CODEX_UPSTREAM_URL"))
+  if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.search || url.hash) {
+    throw new Error("THREADWIRE_CODEX_UPSTREAM_URL is invalid")
+  }
+  return url
+}
+
+function safeSetting(value, name) {
+  if (typeof value !== "string" || value.length === 0 || /[\r\n]/u.test(value)) throw new Error(`${name} is required`)
+  return value
+}
+
+function portValue(value, fallback) {
+  if (value === undefined) return fallback
+  const number = Number(value)
+  if (!/^\d+$/u.test(value) || !Number.isSafeInteger(number) || number < 1 || number > 65535) throw new Error("Invalid model broker port")
+  return number
+}
+
+function safeContentType(value) {
+  return value && /^[\w.+-]+\/[\w.+-]+(?:;\s*charset=[\w-]+)?$/u.test(value) ? value : "application/json"
+}
+
+function sendJson(response, status, value) {
+  response.writeHead(status, {"content-type": "application/json"})
+  response.end(JSON.stringify(value))
+}
+
+function isClientError(error) {
+  return error instanceof Error && /denied|grant|Invalid request|capacity/u.test(error.message)
+}
+
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value)
+}
+
+function listen(server, port, host) {
+  return new Promise((resolve, reject) => {
+    server.once("error", reject)
+    server.listen(port, host, () => {
+      server.removeListener("error", reject)
+      resolve(undefined)
+    })
+  })
+}

package/src/mount-policy.js

@@ -0,0 +1,28 @@
+// @ts-check
+
+import {readFile} from "node:fs/promises"
+import {isAbsolute, relative} from "node:path"
+
+/** @param {string} root @param {(path: string, encoding: "utf8") => Promise<string>} [reader] */
+export async function assertNoNestedMounts(root, reader = readFile) {
+  const mountinfo = await reader("/proc/self/mountinfo", "utf8")
+  for (const line of mountinfo.split("\n")) {
+    if (line.length === 0) continue
+    const fields = line.split(" ")
+    const encoded = fields[4]
+    if (encoded === undefined) throw new Error("Mount topology unavailable")
+    const mountpoint = decodeMountinfo(encoded)
+    if (mountpoint !== root && within(root, mountpoint)) throw new Error("Nested worktree mounts are forbidden")
+  }
+}
+
+/** @param {string} root @param {string} child */
+function within(root, child) {
+  const path = relative(root, child)
+  return path !== "" && !path.startsWith("..") && !isAbsolute(path)
+}
+
+/** @param {string} value */
+function decodeMountinfo(value) {
+  return value.replace(/\\(040|011|012|134)/gu, (_, octal) => String.fromCharCode(Number.parseInt(octal, 8)))
+}

package/src/normalized-output.js

@@ -0,0 +1,68 @@
+// @ts-check
+
+import {closeSync, fsyncSync, openSync, writeSync} from "node:fs"
+import {dirname} from "node:path"
+
+const filesystemOperations = {closeSync, fsyncSync, openSync, writeSync}
+
+/**
+ * @typedef {object} FilesystemOperations
+ * @property {(fileDescriptor: number) => void} closeSync Close a transcript.
+ * @property {(fileDescriptor: number) => void} fsyncSync Sync a transcript.
+ * @property {(path: string, flags: string, mode?: number) => number} openSync Open a transcript or directory.
+ * @property {(fileDescriptor: number, buffer: Buffer, offset: number, length: number) => number} writeSync
+ * Write transcript bytes.
+ */
+
+export class NormalizedOutput {
+  /**
+   * @param {Pick<NodeJS.WritableStream, "write">} output
+   * @param {string | undefined} transcriptPath
+   * @param {FilesystemOperations} [filesystem]
+   */
+  constructor(output, transcriptPath, filesystem = filesystemOperations) {
+    this.output = output
+    this.filesystem = filesystem
+    this.transcriptDirectory = transcriptPath === undefined ? undefined : dirname(transcriptPath)
+    this.fileDescriptor = transcriptPath === undefined
+      ? undefined
+      : this.filesystem.openSync(transcriptPath, "wx", 0o600)
+    this.closed = false
+  }
+
+  /** @param {string} record */
+  write(record) {
+    if (this.closed) throw new Error("Normalized output is closed")
+    if (this.fileDescriptor !== undefined) {
+      const bytes = Buffer.from(record)
+      let offset = 0
+      while (offset < bytes.length) {
+        const written = this.filesystem.writeSync(
+          this.fileDescriptor,
+          bytes,
+          offset,
+          bytes.length - offset
+        )
+        if (written === 0) throw new Error("Transcript write made zero bytes of progress")
+        offset += written
+      }
+      this.filesystem.fsyncSync(this.fileDescriptor)
+      const directoryDescriptor = this.filesystem.openSync(
+        /** @type {string} */ (this.transcriptDirectory),
+        "r"
+      )
+      try {
+        this.filesystem.fsyncSync(directoryDescriptor)
+      } finally {
+        this.filesystem.closeSync(directoryDescriptor)
+      }
+    }
+    this.output.write(record)
+  }
+
+  close() {
+    if (this.closed) return
+    this.closed = true
+    if (this.fileDescriptor !== undefined) this.filesystem.closeSync(this.fileDescriptor)
+  }
+}

package/src/relay-write.js

@@ -0,0 +1,44 @@
+// @ts-check
+
+const MODEL_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u
+const COLORS = new Set(["always", "never", "auto"])
+
+/** @param {string[]} arguments_ */
+export function validateRelayWriteProviderArguments(arguments_) {
+  /** @type {string[]} */
+  const normalized = []
+  let model = "gpt-5-codex"
+  for (let index = 0; index < arguments_.length; index += 1) {
+    const argument = /** @type {string} */ (arguments_[index])
+    if (argument === "--model" || argument === "-m") {
+      const value = arguments_[index + 1]
+      if (value === undefined || !MODEL_PATTERN.test(value)) throw new Error("Provider argument is unavailable in relay write mode")
+      model = value
+      normalized.push("--model", value)
+      index += 1
+      continue
+    }
+    if (argument.startsWith("--model=")) {
+      const value = argument.slice("--model=".length)
+      if (!MODEL_PATTERN.test(value)) throw new Error("Provider argument is unavailable in relay write mode")
+      model = value
+      normalized.push("--model", value)
+      continue
+    }
+    if (argument === "--color") {
+      const value = arguments_[index + 1]
+      if (value === undefined || !COLORS.has(value)) throw new Error("Provider argument is unavailable in relay write mode")
+      normalized.push("--color", value)
+      index += 1
+      continue
+    }
+    if (argument.startsWith("--color=")) {
+      const value = argument.slice("--color=".length)
+      if (!COLORS.has(value)) throw new Error("Provider argument is unavailable in relay write mode")
+      normalized.push("--color", value)
+      continue
+    }
+    throw new Error("Provider argument is unavailable in relay write mode")
+  }
+  return {arguments: normalized, model}
+}

package/src/telegram-ingress/config.js

@@ -234,6 +234,13 @@ export function buildProviderEnvironment(source) {
 /** @param {string} key */
 function isIngressSecretKey(key) {
   if (FILE_BACKED_SETTINGS.some((name) => key === `${name}_FILE`)) return true
+  if (
+    key.startsWith("THREADWIRE_ISOLATED_RUNTIME_")
+    || key.startsWith("THREADWIRE_MODEL_BROKER_")
+    || key === "THREADWIRE_RELAY_WORKER_IMAGE"
+    || key === "THREADWIRE_ALLOWED_WORKTREE_ROOTS"
+    || key === "THREADWIRE_WORKTREE_VOLUME"
+  ) return true
   return key === "TELEGRAM_BOT_TOKEN" ||
     key === "THREADWIRE_TELEGRAM_BOT_TOKEN" ||
     key === "THREADWIRE_WEBHOOK_SECRET" ||

package/src/telegram-ingress/core.js

@@ -29,6 +29,7 @@ import {parseCodeCommand, parseEvidenceCommand} from "./command.js"
  *   workspaceProfileOperations?: import("../workspace-profile.js").WorkspaceProfileOperations,
  *   activity?: Pick<import("../activity-log.js").ActivityLog, "recordWorkspace" | "recordStarted" | "recordSession" | "close">,
  *   evidenceStore?: import("../evidence-store.js").EvidenceStore,
+ *   isolatedRuntimeClient?: Pick<import("../isolated-runtime-client.js").IsolatedRuntimeClient, "preflight" | "run">,
  *   onWorkerFailure?: (message: string) => void,
  *   onWorkerSettled?: () => void
  * }} IngressDependencies
@@ -136,6 +137,45 @@ export async function dispatchWorker(job, config, dependencies = {}) {
   try {
     await evidence?.append("prompt", `prompt\n${job.prompt}\nprovider-stream\n`)
 
+    if (job.provider === "codex" && dependencies.isolatedRuntimeClient !== undefined) {
+      evidenceTransferred = true
+      try {
+        const preflight = await dependencies.isolatedRuntimeClient.preflight({
+          provider: "codex",
+          profile: workspace.profile,
+          repositoryRoot: workspace.repositoryRoot,
+          cwd: workspace.cwd,
+          providerArguments: []
+        })
+        const exitCode = await dependencies.isolatedRuntimeClient.run({
+          preflightId: preflight.preflightId,
+          prompt: job.prompt,
+          providerArguments: [],
+          ...(preflight.deadline === undefined ? {} : {deadline: preflight.deadline}),
+          onEvent: async (event) => control.accept(event),
+          onRecord: async (record) => {
+            const id = provider.sessionId(record)
+            if (id !== undefined) dependencies.activity?.recordSession(provider.name, id)
+          },
+          onStdoutChunk: (chunk) => evidence?.append("provider-stdout", chunk),
+          onStderrChunk: (chunk) => evidence?.append("provider-stderr", chunk)
+        })
+        if (exitCode !== 0) throw new Error(`Isolated Codex worker exited with status ${exitCode}`)
+        await control.close()
+        if (evidence !== undefined) {
+          await evidence.finalize()
+          await sender.send(`Evidence: ${evidence.handle}`)
+        }
+        return
+      } catch (error) {
+        await control.close().catch(() => {})
+        await evidence?.abort()
+        throw error
+      } finally {
+        dependencies.onWorkerSettled?.()
+      }
+    }
+
     /** @type {{resolve: () => void, reject: (error: Error) => void, settled: boolean}} */
     const spawnGate = {
       settled: false,

package/src/telegram-webhook.js

@@ -5,6 +5,7 @@ import {ActivityLog} from "./activity-log.js"
 import {EvidenceStore} from "./evidence-store.js"
 import {buildProviderEnvironment, parseIngressConfig, resolveIngressEnvironment} from "./telegram-ingress/config.js"
 import {createWebhookHandler} from "./telegram-ingress/http.js"
+import {isolatedRuntimeClientFromEnvironment} from "./isolated-runtime-client.js"
 
 /**
  * Start the standalone Threadwire Telegram webhook service.
@@ -34,6 +35,10 @@ export async function startTelegramWebhook(options = {}) {
   const providerEnvironment = buildProviderEnvironment(
     options.providerEnvironment ?? environment
   )
+  const isolatedConfigured = environment.THREADWIRE_ISOLATED_RUNTIME_URL !== undefined
+    || environment.THREADWIRE_ISOLATED_RUNTIME_CONTROL_TOKEN !== undefined
+  const isolatedRuntimeClient = options.handlerDependencies?.isolatedRuntimeClient
+    ?? (isolatedConfigured ? isolatedRuntimeClientFromEnvironment(environment) : undefined)
   const activity = options.activity ?? options.handlerDependencies?.activity ?? new ActivityLog("/var/lib/threadwire/activity/threadwire.jsonl")
   const evidenceStore = options.evidenceStore ?? options.handlerDependencies?.evidenceStore ?? await EvidenceStore.open({
     root: config.evidenceRoot ?? "/var/lib/threadwire/evidence"
@@ -44,6 +49,7 @@ export async function startTelegramWebhook(options = {}) {
     activity,
     evidenceStore,
     providerEnvironment,
+    ...(isolatedRuntimeClient === undefined ? {} : {isolatedRuntimeClient}),
     onOperationalError,
     onWorkerFailure
   })