threadwire 0.1.6 → 0.1.9

package/CHANGELOG.md

@@ -0,0 +1,52 @@
+# Changelog
+
+## Unreleased
+
+## 0.1.9 - 2026-07-28
+
+- Add native Kimi Code subscription support through official OAuth, a distinct
+  narrow Kimi model broker, an immutable pinned worker/auth image set, and a
+  mandatory provider-dedicated isolated runtime with no direct fallback.
+- Normalize only trusted Kimi assistant/tool/session envelopes, preserve exact
+  native continuation and Telegram topic routing, and suppress thinking, raw
+  tool payloads, arbitrary metadata, stderr/stdout, grants, and OAuth material.
+- Bind Kimi grants and authenticated session state to provider, task, session,
+  run network, approved alias, and wire model; add adversarial fresh/resume,
+  failure, cancellation, refresh, redaction, network, and cross-provider tests.
+
+## 0.1.8 - 2026-07-26
+
+- Add `threadwire run --transcript <path>` to durably capture the exact normalized
+  stdout JSONL protocol in a private, exclusive file while keeping activity logs
+  and scoped raw evidence artifacts separate.
+- Add an opt-in, fail-closed isolated Codex write runtime. A root-owned
+  supervisor launches one worktree-only worker per task while a separate narrow
+  model broker retains upstream credentials. Fresh/resume, secret rotation,
+  filesystem/network/socket escapes, configuration overrides and cleanup are
+  covered by adversarial Docker E2E.
+- Bind broker grants to dedicated trusted run-network listeners and an exact
+  allowlisted model/request schema; add stable worktree ancestry checks,
+  task-private persistent resume state, contained nested cwd and structured
+  Codex arguments. The Compose deployment is now an explicit opt-in override.
+- Allocate authenticated, uniquely labeled state per fresh Codex lineage;
+  reject volume adoption and nested worktree mounts; use Docker's structured
+  host-bind API; and require an explicit supervisor-side model allowlist.
+- Bound and eagerly expire preflight capabilities, serialize writable lineage
+  resumes, and automatically reconcile and garbage-collect authenticated state
+  volumes with restart-safe cleanup retry.
+- Bound active runs and Docker/broker operations through cleanup, reserve state
+  before awaited revalidation, autonomously close expired grant listeners, and
+  reconcile exactly owned workers and networks across every container state.
+- Abort accepted broker work and caller-disconnected runs at one absolute
+  deadline; make crash cleanup authority an fsync'd authenticated full run
+  identity rather than labels; and durably fsync registry rename evidence.
+- Carry one launch deadline from preflight through prompt/secret/evidence/
+  Telegram setup, worker execution and cleanup; make supervisor and broker
+  shutdown abort control uploads and active work; move Docker GC outside the
+  registry transaction; and stream-cap broker/runtime responses.
+- Gate worker start on one-shot activation of a verified pending broker grant
+  and address its listener by the inspected per-run IP, removing dynamic
+  network-alias readiness races.
+- Route relay-profile Telegram Codex jobs exclusively through the isolated
+  runtime, keep validate-only launches local, preserve bounded stdout/stderr
+  evidence channels, and protect live lineages from concurrent reconciliation.

package/README.md

@@ -7,6 +7,13 @@ non-root Codex provider, Docker secrets, loopback TLS proxy, verification, and
 rollback path, see [Container runtime](docs/container-runtime.md). The legacy
 host launcher below remains supported and is separate from that deployment.
 
+Relay-originated Codex writes are explicit and default off. `--relay-write`
+requires a reviewed `--workspace-profile` plus the root-owned isolated runtime
+and credential broker. The worker gets one writable task worktree, no upstream
+or Git credential, and no route except its run-scoped broker. Missing
+prerequisites fail before prompt or credential reads with no native fallback.
+See [Isolated provider runtime](docs/isolated-provider-runtime.md).
+
 ## Run with npx
 
 Threadwire requires Node.js 22 or newer. Run the published CLI without a global
@@ -53,11 +60,11 @@ Use the local launcher. Install or refresh it after updating Threadwire with `np
   -- --model example-model
 ```
 
-The target always has the form `telegram:<chat-id>:<thread-id>` for topics, or `telegram:<chat-id>` for direct messages (DMs) and ordinary chats. The chat ID is always required and must be a nonzero signed integer. The thread ID is optional and valid only as the explicit topic suffix: when present it must be a positive safe integer, and a DM target simply omits it — a missing thread ID is never an error. `--provider` must be exactly one of `codex`, `claude`, or `opencode`. Malformed or missing provider, chat ID, or thread ID arguments are hard failures (exit code 2) reported through Threadwire's normal error path with fixed messages; they fail before the Telegram token is read, before any transport is created, and before any provider is launched, and the messages never echo the bot token or the untrusted argument value. `--process-number` accepts an explicit positive safe integer for automation; when omitted, Threadwire uses its launcher PID. Every Telegram message is labeled consistently, such as `[P42] …`, including chunked continuations.
+The target always has the form `telegram:<chat-id>:<thread-id>` for topics, or `telegram:<chat-id>` for direct messages (DMs) and ordinary chats. The chat ID is always required and must be a nonzero signed integer. The thread ID is optional and valid only as the explicit topic suffix: when present it must be a positive safe integer, and a DM target simply omits it — a missing thread ID is never an error. `--provider` must be exactly one of `codex`, `claude`, `kimi`, or `opencode`. Malformed or missing provider, chat ID, or thread ID arguments are hard failures (exit code 2) reported through Threadwire's normal error path with fixed messages; they fail before the Telegram token is read, before any transport is created, and before any provider is launched, and the messages never echo the bot token or the untrusted argument value. `--process-number` accepts an explicit positive safe integer for automation; when omitted, Threadwire uses its launcher PID. Every Telegram message is labeled consistently, such as `[P42] …`, including chunked continuations.
 
-Pass `--workspace-profile <name>` only when invoking Threadwire inside the container-native runtime, for example with `node bin/threadwire.js run` as shown in [Container runtime](docs/container-runtime.md). A profile selects a reviewed entry from the checked-in [threadwire.workspace-profiles.json](threadwire.workspace-profiles.json). It supplies the absolute in-container repository root, the exact in-container working directory, and the allowlisted providers for that workspace. Threadwire validates the selected profile, rejects malformed or unknown names, verifies the configured workspace exists and is still a healthy Git worktree, and records the selected profile plus immutable revision/worktree identity in the local activity log before provider spawn. The checked-in `container-runtime` default targets `/workspace/threadwire` inside the container-native runtime and currently allowlists only `codex`.
+Pass `--workspace-profile <name>` only when invoking Threadwire inside the container-native runtime, for example with `node bin/threadwire.js run` as shown in [Container runtime](docs/container-runtime.md). A profile selects a reviewed entry from the checked-in [threadwire.workspace-profiles.json](threadwire.workspace-profiles.json). It supplies the absolute in-container repository root, the exact in-container working directory, and the allowlisted providers for that workspace. Threadwire validates the selected profile, rejects malformed or unknown names, verifies the configured workspace exists and is still a healthy Git worktree, and records the selected profile plus immutable revision/worktree identity in the local activity log before provider spawn. The checked-in `container-runtime` default targets `/workspace/threadwire` inside the container-native runtime and allowlists `codex` and isolated `kimi`.
 
-Provider tool-start and tool-finish events do not produce Telegram messages by default. Pass the boolean `--tool-messages` flag to opt in, as shown above. When enabled, each tool is one concise, silent status line rather than a pair of noisy start/finish notices: when a tool starts, Threadwire sends `🛠 [P42] Tool: <safe command or tool description>` (for example `🛠 [P42] Tool: command — git status --short`), and when that same tool finishes, it edits the original message in place so it begins `✅` instead — no second completion message is sent, and Telegram edits raise no notification. The command/description shows a safe CLI-style preview with credential-bearing values (tokens, passwords, keys, authorization/cookie forms, credentials in URLs) redacted and control characters stripped; only normalized Codex command-completion output may also be appended to that same edited status as a Telegram-native expandable HTML blockquote with the visible label `Output →`; it is credential-redacted, HTML-escaped, and Unicode-safe bounded. Stderr, reasoning, and every other raw provider result remain excluded. Use `--max-output-length <positive-integer>` to truncate only that preview Unicode-safely; omit the option for unlimited tool detail. A prompt may instead come from `--prompt-file` or piped stdin, and every source rejects blank/whitespace content. Arguments following `--` pass to the selected provider, except output-stream options owned by Threadwire.
+Provider tool-start and tool-finish events do not produce Telegram messages by default. Pass the boolean `--tool-messages` flag to opt in, as shown above. When enabled, each tool is one concise, silent status line rather than a pair of noisy start/finish notices: when a tool starts, Threadwire sends `🛠 [P42] Tool: <safe command or tool description>` (for example `🛠 [P42] Tool: command — git status --short`), and when that same tool finishes, it edits the original message in place so it begins `✅` instead — no second completion message is sent, and Telegram edits raise no notification. The command/description shows a safe CLI-style preview with credential-bearing values (tokens, passwords, keys, authorization/cookie forms, credentials in URLs) redacted and control characters stripped; only normalized Codex command-completion output may also be appended to that same edited status as a Telegram-native expandable HTML blockquote with the visible label `Output →`; it is credential-redacted, HTML-escaped, and Unicode-safe bounded. Stderr, reasoning, and every other raw provider result remain excluded. Use `--max-output-length <positive-integer>` to truncate only that preview Unicode-safely; omit the option for unlimited tool detail. A prompt may instead come from `--prompt-file` or piped stdin, and every source rejects blank/whitespace content. Arguments following `--` pass to the selected provider, except output-stream options owned by Threadwire. Kimi is narrower: it always uses the dedicated isolated subscription runtime and accepts only one server-approved model alias through `--model <alias>` (or `-m <alias>`); Threadwire owns its prompt, output, session, permissions, configuration, tools, skills, plugins, MCP, and directories.
 
 Threadwire directly spawns the structurally separate terminal adapters `/opt/data/libexec/threadwire/codex`, `/opt/data/libexec/threadwire/claude`, or `/opt/data/libexec/threadwire/opencode-local-fleet` with an argv array and `shell: false`. These libexec adapters hold the real provider-CLI logic and are never on a worker's `PATH`, so relaying can never recurse back into the front-door shims. Each spawn also sets `THREADWIRE_ACTIVE=1` in the provider child environment. The executable can be overridden per provider with `THREADWIRE_CODEX_BIN`, `THREADWIRE_CLAUDE_BIN`, or `THREADWIRE_OPENCODE_BIN` for staged cutover and rollback. It does not impose a worker timeout. `SIGINT` and `SIGTERM` are forwarded to the worker as explicit cancellation.
 
@@ -67,13 +74,17 @@ Threadwire directly spawns the structurally separate terminal adapters `/opt/dat
 
 The relay contract: the caller supplies `THREADWIRE_TARGET` (`telegram:<chat-id>` or `telegram:<chat-id>:<thread-id>`) and, optionally, `THREADWIRE_PROCESS_NUMBER`. The prompt arrives on a piped stdin; all native provider flags pass through after `--`. A positional prompt is never parsed. A missing `THREADWIRE_TARGET` fails closed (exit code 2) and a malformed one is rejected by the launcher's token-free preflight — the shim never invents a default destination and never silently downgrades a requested relay to a direct run. A shim relays only for a worker mode (`codex exec …`, `opencode-local-fleet run …`, or any non-interactive `claude …`); it drops the worker subcommand before relaying and Threadwire re-adds it around the prompt. Version and help queries, non-worker subcommands, interactive TTY sessions, and any invocation already inside a relayed run (`THREADWIRE_ACTIVE=1`, so nested provider workers stay local/native) run the real CLI directly through the libexec adapter.
 
-Pass `--resume-session <exact-provider-session-id>` to continue a stored Codex, Claude, or OpenCode session. Threadwire preserves the provider's native resume ordering and streaming options and never uses implicit latest-session behavior. To request a local JSONL activity log, pass `--activity-log <path>`. It writes only safe local facts: the selected workspace profile plus immutable workspace provenance, provider-started facts (`provider`, child `pid`), and session-available facts (`provider`, native `sessionId`). Raw events, reasoning, tool data, stderr, credentials, prompts, and Telegram token data are excluded. This activity log is local-only and is never enqueued for Telegram delivery.
+Pass `--resume-session <exact-provider-session-id>` to continue a stored Codex, Claude, or OpenCode session. Threadwire preserves the provider's native resume ordering and streaming options and never uses implicit latest-session behavior.
+
+Pass `--transcript <path>` to capture the exact normalized, caller-facing JSONL protocol written to run stdout. The file is created privately (mode `0600`), must not already exist, and contains the same records in the same byte order as stdout. It never contains provider JSONL, reasoning, tool payloads, prompts, stderr, or credentials.
+
+`--activity-log <path>` is different: it retains its append contract and writes only minimal safe lifecycle facts—the selected workspace profile and immutable provenance, provider start (`provider`, child `pid`), and available native session ID. It is local-only and never enters Telegram or normalized stdout.
 
 Provider stdout is decoded as JSONL with a finite 1 MiB UTF-8 byte limit for each pending unterminated record. Exceeding it rejects the run, removes listeners and signal handlers, and terminates the provider without parsing or rendering the oversized content.
 
 For normal `threadwire run` execution, Threadwire stdout is the parent-model admission plane. It emits exactly one versioned terminal `delegated_result` JSON object and no progress records. The envelope contains a bounded, credential-redacted, control-normalized final conclusion when one was produced, structured terminal state and exit code, and the exact bounded provider session handle when available. Its closed schema can also represent concise blocker/decision requests, opaque artifact handles, commit/URL references, and a concise validation summary; current provider adapters do not infer these optional fields from prose. Unknown, nested, wrongly typed, cardinality-invalid, or oversized admission candidates fail closed. See [Delegated-result protocol](docs/delegated-result-protocol.md) for the complete schema, limits, and caller obligations.
 
-Set the trusted operator setting `THREADWIRE_EVIDENCE_ROOT` for standalone runs to persist the delegated prompt and raw provider stdout/stderr as a scoped file-backed artifact; Telegram ingress uses its dedicated evidence volume automatically. The parent or owning Telegram topic receives only an opaque bearer handle. Retrieve later with `threadwire evidence read` or the authenticated `/evidence` Telegram command and an explicit bounded selector. See [Evidence artifacts](docs/evidence-artifacts.md) for permissions, quotas, retention, recovery, authorization, redaction, privacy, and cleanup behavior.
+Scoped raw evidence artifacts are separate from both files above. Set the trusted operator setting `THREADWIRE_EVIDENCE_ROOT` for standalone runs to persist the delegated prompt and raw provider stdout/stderr as a scoped file-backed artifact; Telegram ingress uses its dedicated evidence volume automatically. The parent or owning Telegram topic receives only an opaque bearer handle. Retrieve later with `threadwire evidence read` or the authenticated `/evidence` Telegram command and an explicit bounded selector. See [Evidence artifacts](docs/evidence-artifacts.md) for permissions, quotas, retention, recovery, authorization, redaction, privacy, and cleanup behavior.
 
 Telegram is the separate user-visible progress plane. Lifecycle notices, diagnostics, tool activity, and assistant streaming continue there independently; `--tool-messages` affects only Telegram. Execution-environment details, provider records and streams, lifecycle progress, diagnostics, tool names/arguments/details/output, stderr, prompts, narration/reasoning, and full transcripts never enter stdout. Threadwire's bounded error diagnostic remains on stderr. Help output is the sole non-run, human-readable stdout mode. This default is an intentional pre-1.0 protocol break from the former mixed Hermes JSONL stream.
 

package/TELEGRAM-INGRESS.md

@@ -1,6 +1,10 @@
 # Telegram Ingress for Threadwire
 
-Standalone Threadwire webhook service that accepts Telegram Bot API updates and launches Threadwire's existing worker path (`createProvider` → Telegram transport/sender → `NoticeQueue` → `Relay` → `runWorker`). Hermes is not involved.
+Standalone Threadwire webhook service that accepts Telegram Bot API updates.
+Codex, Claude, and OpenCode retain the existing worker behavior. Kimi always
+uses its dedicated isolated preflight/run authority with no native fallback;
+a missing Kimi runtime fails before provider or transport construction. Hermes
+is not involved.
 
 ## Important bot ownership
 
@@ -41,7 +45,7 @@ The process binds to **loopback (`127.0.0.1`) by default**. Expose it only throu
   - **Residual restart boundary:** this store is process-local memory only. A process restart clears reservations and completed IDs, so Telegram redelivery after restart can launch work again until IDs are re-observed. This is not durable multi-instance replay protection.
 - Bound concurrent spawned workers (default 4, configurable). When at capacity, reject with `503` without launching. The concurrency slot is released when the background worker settles (success or failure after spawn), or immediately on pre-spawn failure.
 - Both chat and sender allowlists are mandatory and exact; missing IDs fail closed.
-- Command grammar is exact: `/code[optional @bot] <codex|claude|opencode> <nonblank prompt>`.
+- Command grammar is exact: `/code[optional @bot] <codex|claude|kimi|opencode> <nonblank prompt>`.
 - Direct target is derived only from authenticated `message.chat.id` and optional positive `message_thread_id`.
   - DM/chat: `telegram:<chat-id>`
   - Topic: `telegram:<chat-id>:<thread-id>`
@@ -49,7 +53,10 @@ The process binds to **loopback (`127.0.0.1`) by default**. Expose it only throu
 - Provider child env strips Telegram tokens, webhook secret, allowlists, bind/port, concurrency, tool-message, and update-guard service config. `runWorker` also strips Telegram tokens.
 - No logging of headers, bodies, prompts, or secrets.
 - Webhook secret must be at least 32 characters after trim.
-- Accepted work returns `202` only after the worker child has actually spawned (`onSpawn`); process completion alone is never treated as dispatch success.
+- Native work returns `202` only after the worker child has actually spawned
+  (`onSpawn`). Isolated Codex work returns `202` only after the authenticated
+  isolated run completes successfully; preflight alone is never treated as
+  dispatch success.
 - Failure before spawn rejects the request with `500` and is reported once via the operational error reporter.
 - Failure after spawn is reported once via the worker-failure reporter (not double-reported through both channels in the real entrypoint wiring).
 - Authenticated irrelevant updates return `200`.
@@ -76,6 +83,8 @@ Optional:
 | `THREADWIRE_TELEGRAM_REQUEST_TIMEOUT_MS` | Deadline for each outbound Telegram request, including response parsing (default `30000`, positive safe integer no greater than `2147483647`) |
 | `THREADWIRE_UPDATE_ID_CAPACITY` | Max retained completed `update_id` entries (default `10000`) |
 | `THREADWIRE_UPDATE_ID_TTL_MS` | Retention TTL for completed `update_id` entries in ms (default `86400000`) |
+| `THREADWIRE_KIMI_ISOLATED_RUNTIME_URL` | Dedicated Kimi supervisor URL; Compose defaults to `http://kimi-isolated-runtime:8790` |
+| `THREADWIRE_KIMI_ISOLATED_RUNTIME_CONTROL_TOKEN` | Dedicated Kimi control token. When absent, `/code kimi` remains recognized but fails closed before launch. |
 
 ## Run
 
@@ -105,6 +114,7 @@ The wrapper starts the service exported by the importable
 /code codex write a hello world program
 /code@your_bot claude explain quantum computing
 /code opencode build a todo app
+/code kimi inspect this repository
 ```
 
 ## Modules

package/bin/isolated-runtime.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+
+import {startIsolatedRuntime} from "../src/isolated-runtime.js"
+
+await startIsolatedRuntime()

package/bin/kimi-model-broker.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+
+import {startKimiModelBroker} from "../src/kimi-model-broker.js"
+
+await startKimiModelBroker()

package/bin/model-broker.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+
+import {startModelBroker} from "../src/model-broker.js"
+
+await startModelBroker()

package/docs/container-runtime.md

@@ -199,3 +199,25 @@ Back them up using an operator-approved volume backup process before migration.
 `docker compose down --volumes` is destructive and removes the container-owned
 repository and provider state; use it only for an explicitly confirmed teardown.
 Never export or archive mounted secret files with workspace/provider backups.
+
+
+## Kimi subscription containers
+
+Kimi is intentionally excluded from the same-UID container-native provider
+launch described above. Never mount `threadwire-kimi-oauth`, its access/refresh
+tokens, or the auth home into the Threadwire runtime, supervisor, worker,
+workspace, or session-state volume. Kimi uses four immutable build targets:
+`kimi-auth`, `kimi-model-broker`, `kimi-relay-worker`, and `isolated-runtime`.
+The first two share UID/GID 10003 and only the OAuth volume; the worker uses
+UID/GID 10002 with only the selected worktree and provider-bound state; the
+root supervisor alone receives the Docker socket. The broker/auth service uses
+Node `22.19.0` and exactly `@moonshot-ai/kimi-code@0.29.2` with the checked npm
+integrity and archive SHA-512 in the Dockerfile.
+
+Enable the checked-in override with `--profile kimi` only after the OAuth/model
+operator flow in [Isolated provider runtime](isolated-provider-runtime.md).
+The default workspace profile allowlists Kimi because isolation is mandatory;
+without the dedicated Kimi control token/client, both CLI and Telegram Kimi
+jobs fail closed rather than using the native child path. Keep broker egress
+restricted to official Kimi Code subscription/auth endpoints and do not provide
+a Moonshot API key, custom base URL, Docker socket, or ingress secret.

package/docs/isolated-provider-runtime.md

@@ -0,0 +1,232 @@
+# Isolated provider runtime
+
+Relay-originated Codex writes are disabled unless the caller supplies both
+`--relay-write` and a reviewed `--workspace-profile`. The write path never
+falls back to the native provider launcher.
+When the Telegram service is configured with isolated-runtime authority, Codex
+webhook jobs use the same preflight/run boundary exclusively; an unavailable
+runtime fails the job rather than invoking the native runner. Raw provider
+stdout and stderr are returned as separately identified, bounded chunks for
+the existing evidence callbacks.
+
+## Security boundary
+
+Telegram ingress has neither provider secrets nor container-runtime authority.
+The root-owned isolated-runtime supervisor has Docker authority and a read-only
+view of allowlisted worktree roots, but no provider credential. The model
+broker alone mounts the upstream credential. Each grant creates a listener
+bound to the broker's trusted per-run network interface. That listener accepts
+one token, one run/network lineage, one allowlisted model, and a closed
+`/v1/responses` schema; it is not a generic HTTP proxy.
+The listener remains non-authorizing while the supervisor creates and verifies
+the worker. The supervisor then activates it exactly once immediately before
+worker start. Workers receive the inspected per-run broker IP directly, so
+launch does not depend on asynchronous container-DNS alias propagation.
+
+For each fresh or explicit-resume run the supervisor creates a unique Docker
+internal network, attaches the broker, and launches an immutable worker. The
+worker has a read-only root, all capabilities dropped, no-new-privileges,
+container-local tmp/run, resource limits, and exactly one writable
+worktree mount. It has no host home, common Git directory, sibling worktree,
+host temp, shared provider state, secret, Docker/SSH socket, or external route. Its
+short-lived broker grant is revoked during cleanup.
+The grant owns one absolute deadline and every accepted socket. Expiry,
+explicit revoke, credential reload, or broker shutdown aborts an incomplete
+upload or upstream request, destroys accepted sockets, and closes the listener;
+authorization is checked again after the bounded request body is acquired.
+
+Codex state lives in a unique, random, immutable-label Docker volume for each
+fresh lineage, never a host or common Codex home. An HMAC-authenticated,
+root-private supervisor registry maps returned session IDs to that exact
+volume. Resume revalidates the volume's owner, namespace, task, and lineage
+labels before every mount. A collision, unlabeled or differently labeled
+preexisting volume, sibling,
+missing, expired, or lost state fails before worker creation.
+Only one worker may mount a lineage at a time; the supervisor holds an atomic
+reservation from preflight consumption through worker cleanup. Expired aliases
+are removed by authenticated periodic GC. The registry retains lineage
+ownership until Docker confirms deletion, retries cleanup failures, and
+reconciles exactly labelled orphan volumes on startup while preserving volumes
+referenced by in-process runs. On restart, exactly owned created, running, or
+exited orphan workers and their networks are removed before volume GC retries.
+An fsync'd, HMAC-authenticated run record binds the generated names, pinned
+image digest, entrypoint policy, private network, state volume, and exact
+worktree mount source/options. Reconciliation inspects that full identity and
+network endpoint membership; forgeable labels or any mismatched name, image,
+mount, option, command, or endpoint are never deletion authority.
+
+Preflight verifies Docker, the immutable image, broker readiness, the
+allowlisted non-symlink worktree with no nested mounts, stable device/inode ancestry, and mount policy before prompt, Telegram
+token, dotenv, evidence, resume state, executable override, or provider
+credential reads. The ancestry is revalidated immediately before container
+creation and start, and the immutable entrypoint verifies the mounted worktree
+and reviewed nested cwd before Codex. Only `--model` and `--color` are accepted;
+they are transported as a JSON array and passed exactly once without shell
+splitting. All other provider arguments are rejected before launch.
+Authenticated preflight admission has strict endpoint/field size limits,
+global and per-task caps, and an eager timer sweep, so abandoned capabilities
+expire without requiring a matching `/run`.
+Consumed capabilities enter a separate global/per-task active-run admission
+before validation can yield. The lineage reservation is acquired synchronously
+at that boundary, preventing periodic GC from deleting resume state during
+revalidation. Docker and broker operations have bounded deadlines, and each
+worker has a bounded operator-configured lifetime; timeout cleanup revokes the
+grant and removes the exactly labelled worker and network before capacity is
+released.
+The relay creates one absolute launch deadline before preflight. The same
+deadline and cancellation signal span prompt/stdin and file-secret reads,
+evidence and Telegram setup, Docker setup, broker readiness, execution,
+response/log reads, upstream work and exact cleanup. A disconnected caller or
+supervisor shutdown aborts its run. Independent per-step timeouts cannot extend
+the overall budget, and response bodies are stream-limited to 2 MiB.
+
+Codex bypasses its nested sandbox only inside this mandatory outer container.
+Its task-private home contains only that lineage's session state; persisted
+config, rules, hooks, plugins, MCP files and instruction files are rejected
+before Codex starts. MCP is forced empty and project instruction loading is disabled.
+Failure to create the outer boundary is fatal.
+
+## Deployment and rotation
+
+The default `compose.yaml` contains no provider secret, broker, supervisor, or
+Docker socket. Enable writes only with both files and the explicit profile:
+
+```sh
+docker compose -f compose.yaml -f compose.relay-write.yaml --profile relay-write up
+```
+
+The override fails interpolation unless every required image, control token,
+worktree root, allowlist and credential-file setting is present. Set immutable supervisor, broker, and worker images; a host
+`THREADWIRE_WORKSPACE_ROOT`; JSON `THREADWIRE_ALLOWED_WORKTREE_ROOTS`; separate
+runtime and broker control tokens; `THREADWIRE_ALLOWED_CODEX_MODELS` as a JSON
+server-side model allowlist; a unique `THREADWIRE_STATE_NAMESPACE`; a random
+`THREADWIRE_STATE_AUTH_KEY` of at least 32 characters; and a deployment secret file for the Codex
+credential. The supervisor alone receives `/var/run/docker.sock`. Restrict
+broker egress at the host/firewall to provider endpoints.
+
+The supervisor defaults to 16 active runs globally, two per reviewed task, a
+30-second maximum preflight slice, and a one-hour end-to-end launch deadline. Operators may
+lower these finite limits with `THREADWIRE_PREFLIGHT_TIMEOUT_MS`,
+`THREADWIRE_ACTIVE_RUN_CAPACITY`, `THREADWIRE_ACTIVE_TASK_CAPACITY`, and
+`THREADWIRE_WORKER_TIMEOUT_MS`; invalid, zero, or excessive values fail startup.
+
+The authenticated registry persists through file fsync, atomic rename, and
+parent-directory fsync. Startup removes only strictly named abandoned temp
+files whose complete contents authenticate under the deployment key; malformed
+or foreign files are left untouched for operator inspection.
+
+`THREADWIRE_WORKTREE_VOLUME` is only for nested-Docker/test deployments. Docker
+volume `Subpath` still mounts only the selected task directory. Production uses
+the exact host bind through Docker's structured Mount API with private
+propagation. The supervisor verifies the resulting two-mount inventory before
+start, and the entrypoint independently rejects nested worktree mounts.
+
+Replace the broker secret atomically and restart it, or call authenticated
+`/admin/reload`. Reload increments the generation and revokes existing grants.
+Missing, writable, symlinked, empty, or oversized secret files keep it unready.
+
+If Docker, broker, pinned image, worktree, security option, or private network
+is unavailable, relay write fails closed. There is no native fallback.
+
+## Verification
+
+Run `npm run all-checks`, `npm run verify:package`, and
+`npm run test:isolated-runtime-e2e` with broker, runtime, hostile-probe,
+production relay-worker, and fake-upstream image variables documented
+by that script. E2E uses host-volume canaries and fake-upstream authorization
+logs; worker self-report is not the sole assertion.
+
+
+## Native Kimi Code subscription boundary
+
+Kimi uses the same proven supervisor mechanics but a distinct protocol and
+credential service. `THREADWIRE_ISOLATED_PROVIDER=kimi` makes the supervisor
+accept only Kimi preflights, select only `THREADWIRE_KIMI_RELAY_WORKER_IMAGE`,
+issue grants only to `THREADWIRE_KIMI_MODEL_BROKER_URL`, and persist
+provider-bound state in the separate Kimi namespace. Codex requests, sessions,
+workers, grants, and volumes cannot be adopted by this service, and the Codex
+broker remains unchanged.
+
+The Kimi broker is not a generic credential proxy. It accepts only
+`POST /v1/chat/completions`, validates a closed request schema and one approved
+wire model, substitutes OAuth immediately before the fixed official
+`https://api.kimi.com/coding/v1/chat/completions` request, and streams the
+bounded response. A grant is pending until the inspected worker is ready and is
+bound to provider, task hash, exact resume session (or fresh lineage), run,
+Docker network, approved alias, and wire model. Revocation, timeout, shutdown,
+or cleanup closes its private listener and active sockets.
+
+The immutable Kimi worker image pins `@moonshot-ai/kimi-code@0.29.2` and verifies
+the npm archive SHA-512 before installation. It receives no OAuth file, Docker
+socket, Telegram credential, supervisor token, broker admin token, ambient
+provider executable override, external network, or unrelated home directory.
+Its fixed entrypoint owns `--model`, optional exact `--session`, `--prompt`,
+`--output-format stream-json`, and an empty skills directory. Static deny rules,
+workspace/config ancestry checks, a sanitized private home, read-only root,
+and the existing mount/inode checks remain mandatory. There is no native unsafe
+fallback and no `THREADWIRE_KIMI_BIN` control.
+
+Only exact pinned stream records are normalized: assistant string content,
+validated tool name/key start and finish, and one exact
+`session.resume_hint`. Thinking, tool arguments/results, retry errors, version
+or arbitrary metadata, malformed records, raw stdout/stderr, synthetic grants,
+and OAuth material are discarded. The worker is the only reader of native Kimi
+stdout and Docker receives only sanitized envelopes and fixed lifecycle events;
+the supervisor returns `rawChunks: []` for every Kimi run.
+
+### Operator OAuth and model approval
+
+Build and publish the `kimi-auth`, `kimi-model-broker`, `kimi-relay-worker`, and
+existing `isolated-runtime` targets as immutable digests. Set distinct random
+Kimi runtime and broker admin tokens of at least 32 characters, the Kimi image digests, and an allowlist
+such as:
+
+```sh
+export THREADWIRE_ALLOWED_KIMI_MODELS='{"default":{"model":"<verified-account-model>","protocol":"kimi"}}'
+```
+
+OAuth writes only the named `threadwire-kimi-oauth` volume at the official
+`credentials/kimi-code.json` location. Stop the broker during interactive auth
+so the CLI and broker cannot race a refresh, then run the opt-in, workspace-free
+auth service:
+
+```sh
+docker compose -f compose.yaml -f compose.relay-write.yaml stop kimi-isolated-runtime kimi-model-broker
+docker compose -f compose.yaml -f compose.relay-write.yaml --profile kimi-auth run --rm kimi-auth login
+docker compose -f compose.yaml -f compose.relay-write.yaml --profile kimi-auth run --rm kimi-auth verify '<verified-account-model>'
+docker compose -f compose.yaml -f compose.relay-write.yaml --profile kimi up --detach --wait
+```
+
+Complete the official device flow directly in the operator terminal. Do not
+copy device codes into tickets, chat, logs, environment files, or Threadwire.
+The auth service has no workspace, ingress network, Docker socket, Threadwire
+control token, or Telegram credential and uses Docker logging driver `none`.
+`verify <account-model>` discards native output and prints only a fixed
+success/failure; use it to confirm each exact account model value before mapping
+that value to a server-approved Threadwire alias.
+API keys, Moonshot platform mode, custom base URLs, discovery by ordinary jobs,
+and arbitrary aliases are unsupported.
+
+For logout or account rotation, stop the Kimi runtime and broker, run
+`--profile kimi-auth run --rm kimi-auth logout` or `login`, verify approved
+models, then restart the Kimi profile. The broker validates strict owner/mode,
+regular-file, link-count, schema, and size constraints; refreshes are serialized
+and atomically persisted, and corruption, symlinks, revocation, or unreadable
+state makes health and preflight fail closed with redacted errors.
+
+### Kimi validation and rollback
+
+Run `npm run test:kimi-isolated-runtime-e2e` from an approved Docker supervisor
+boundary after supplying the documented immutable image variables. A real
+account smoke must then cover fresh execution, capture of exactly one native
+session ID, exact resume with that ID, an approved non-default alias if used,
+Telegram DM/topic routing, cancellation, and confirmation that service logs and
+activity/evidence contain no OAuth token, device code, raw Kimi record, tool
+payload, or synthetic grant.
+
+Rollback by stopping `kimi-isolated-runtime` and `kimi-model-broker`, removing
+the `kimi` Compose profile/control variables, and reverting the Threadwire image.
+Kimi commands then fail closed; Codex behavior is unaffected. Preserve the OAuth
+and Kimi state volumes for a recoverable rollback. Remove them only as an
+explicit credential/session teardown after OAuth revocation; never archive them
+with workspace backups.

package/package.json

@@ -1,12 +1,13 @@
 {
   "name": "threadwire",
-  "version": "0.1.6",
-  "description": "Stream Codex, Claude, and OpenCode worker progress to an explicit Telegram destination",
+  "version": "0.1.9",
+  "description": "Stream Codex, Claude, Kimi Code, and OpenCode worker progress to an explicit Telegram destination",
   "keywords": [
     "ai-agent",
     "claude",
     "cli",
     "codex",
+    "kimi",
     "opencode",
     "telegram"
   ],
@@ -14,6 +15,7 @@
   "private": false,
   "type": "module",
   "files": [
+    "CHANGELOG.md",
     "bin/",
     "docs/",
     "scripts/",
@@ -22,6 +24,9 @@
     "threadwire.workspace-profiles.json"
   ],
   "bin": {
+    "threadwire-isolated-runtime": "bin/isolated-runtime.js",
+    "threadwire-kimi-model-broker": "bin/kimi-model-broker.js",
+    "threadwire-model-broker": "bin/model-broker.js",
     "threadwire": "bin/threadwire.js",
     "threadwire-telegram-webhook": "bin/telegram-webhook.js"
   },
@@ -49,8 +54,10 @@
     "prepublishOnly": "npm run all-checks && npm run verify:package",
     "test": "node --test \"test/**/*.test.js\"",
     "test:container-e2e": "sh docker/test/production-e2e.sh",
+    "test:isolated-runtime-e2e": "sh docker/test/isolated-runtime-e2e.sh",
     "typecheck": "tsc --noEmit",
-    "verify:package": "node scripts/verify-package.js"
+    "verify:package": "node scripts/verify-package.js",
+    "test:kimi-isolated-runtime-e2e": "sh docker/test/kimi-isolated-runtime-e2e.sh"
   },
   "devDependencies": {
     "@eslint/js": "10.0.1",

package/scripts/provider-shims/front-door.sh.template

@@ -55,6 +55,24 @@ fi
 @@WORKER_SUBCOMMAND_SHIFT@@
 
 threadwire_relay_arguments=(run --provider "$THREADWIRE_PROVIDER" --target "$THREADWIRE_TARGET")
+case "${THREADWIRE_RELAY_WRITE:-0}" in
+  0) ;;
+  1)
+    if [[ ! "${THREADWIRE_WORKSPACE_PROFILE:-}" =~ ^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$ ]]; then
+      printf '%s\n' 'threadwire: relay write capability requires a valid THREADWIRE_WORKSPACE_PROFILE' >&2
+      exit 2
+    fi
+    if [[ "$THREADWIRE_PROVIDER" != codex ]]; then
+      printf '%s\n' 'threadwire: relay write capability is only supported for codex' >&2
+      exit 2
+    fi
+    threadwire_relay_arguments+=(--workspace-profile "$THREADWIRE_WORKSPACE_PROFILE" --relay-write)
+    ;;
+  *)
+    printf '%s\n' 'threadwire: relay write capability must be enabled with THREADWIRE_RELAY_WRITE=1' >&2
+    exit 2
+    ;;
+esac
 if [[ -n "${THREADWIRE_PROCESS_NUMBER:-}" ]]; then
   threadwire_relay_arguments+=(--process-number "$THREADWIRE_PROCESS_NUMBER")
 fi

package/scripts/verify-package.js

@@ -13,16 +13,22 @@ const npmEnvironment = {
   NPM_CONFIG_DRY_RUN: "false",
   npm_config_dry_run: "false"
 }
+const packageTmpdir = process.env.THREADWIRE_PACKAGE_TMPDIR ?? tmpdir()
 const EXPECTED_FILES = [
+  "CHANGELOG.md",
   "LICENSE",
   "README.md",
   "TELEGRAM-INGRESS.md",
   "bin/telegram-webhook.js",
   "bin/threadwire.js",
+  "bin/isolated-runtime.js",
+  "bin/kimi-model-broker.js",
+  "bin/model-broker.js",
   "docs/card-10520-plan.md",
   "docs/container-runtime.md",
   "docs/delegated-result-protocol.md",
   "docs/evidence-artifacts.md",
+  "docs/isolated-provider-runtime.md",
   "package.json",
   "scripts/atomic-install.js",
   "scripts/install-local-launcher.js",
@@ -32,11 +38,24 @@ const EXPECTED_FILES = [
   "scripts/provider-shims/front-door.sh.template",
   "scripts/provider-shims/opencode-local-fleet.adapter.sh",
   "scripts/verify-package.js",
+  "src/absolute-deadline.js",
   "src/activity-log.js",
+  "src/normalized-output.js",
   "src/cli.js",
   "src/context-budget-metrics.js",
   "src/delegated-result-admission.js",
+  "src/docker-api.js",
   "src/evidence-store.js",
+  "src/isolated-runtime-client.js",
+  "src/isolated-runtime.js",
+  "src/isolated-state.js",
+  "src/isolated-worker.js",
+  "src/kimi-model-broker-policy.js",
+  "src/kimi-model-broker.js",
+  "src/kimi-oauth-store.js",
+  "src/model-broker-policy.js",
+  "src/model-broker.js",
+  "src/mount-policy.js",
   "src/notice-queue.js",
   "src/notifiers/fetch-transport.js",
   "src/notifiers/telegram.js",
@@ -44,8 +63,10 @@ const EXPECTED_FILES = [
   "src/providers/codex.js",
   "src/providers/executable.js",
   "src/providers/index.js",
+  "src/providers/kimi.js",
   "src/providers/opencode.js",
   "src/relay.js",
+  "src/relay-write.js",
   "src/run-worker.js",
   "src/sentence-buffer.js",
   "src/telegram-ingress/command.js",
@@ -63,7 +84,7 @@ const EXPECTED_FILES = [
 
 /** @returns {Promise<void>} */
 async function main() {
-  const temporaryDirectory = await mkdtemp(join(tmpdir(), "threadwire-package-"))
+  const temporaryDirectory = await mkdtemp(join(packageTmpdir, "threadwire-package-"))
   const cacheDirectory = join(temporaryDirectory, "npm-cache")
 
   try {
@@ -118,6 +139,7 @@ async function main() {
       ], {
         env: {
           PATH: process.env.PATH,
+          HOME: process.env.HOME,
           NPM_CONFIG_DRY_RUN: "false",
           npm_config_dry_run: "false"
         },