threadwire 0.1.6 → 0.1.9

package/src/isolated-state.js

@@ -0,0 +1,470 @@
+// @ts-nocheck
+/* eslint-disable jsdoc/require-jsdoc */
+
+import {createHmac, randomBytes, timingSafeEqual} from "node:crypto"
+import {constants} from "node:fs"
+import {chmod, lstat, mkdir, open, readFile, readdir, rename, unlink} from "node:fs/promises"
+import {dirname, join} from "node:path"
+
+const OWNER = "threadwire-isolated-runtime"
+
+/**
+ * Authenticated registry of both public session aliases and private volume
+ * ownership. Lineage ownership deliberately outlives an expired alias until
+ * Docker confirms that the volume was deleted.
+ * @param {{file: string, key: string, namespace: string, provider?: "codex" | "kimi", now?: () => number, random?: (size: number) => Buffer}} options
+ */
+export async function openStateRegistry(options) {
+  const provider = options.provider ?? "codex"
+  if (!/^\/.+/u.test(options.file) || options.key.length < 32 || !/^[A-Za-z0-9_.-]{1,64}$/u.test(options.namespace)
+    || (provider !== "codex" && provider !== "kimi")) {
+    throw new Error("Invalid isolated state configuration")
+  }
+  const now = options.now ?? Date.now
+  const random = options.random ?? randomBytes
+  const durabilityObserver = options.durabilityObserver
+  await mkdir(dirname(options.file), {recursive: true, mode: 0o700})
+  await chmod(dirname(options.file), 0o700)
+  await requirePrivateDirectory(dirname(options.file))
+  const sessions = new Map()
+  const lineages = new Map()
+  const runs = new Map()
+  let serial = Promise.resolve()
+  try {
+    const document = JSON.parse(await readFile(options.file, "utf8"))
+    const payload = JSON.stringify(document.payload)
+    if (![1, 2, 3, 4].includes(document.version) || typeof document.mac !== "string" || !equalMac(document.mac, mac(options.key, payload))) throw new Error()
+    if (document.version < 4 && provider !== "codex") throw new Error()
+    if (!Array.isArray(document.payload?.sessions)) throw new Error()
+    for (const rawEntry of document.payload.sessions) {
+      if (!validSession(rawEntry, document.version === 4)) throw new Error()
+      const entry = document.version === 4 ? rawEntry : {...rawEntry, provider: "codex"}
+      if (entry.provider !== provider) throw new Error()
+      sessions.set(entry.sessionId, without(entry, "sessionId"))
+      lineages.set(entry.lineage, lineageFromSession(options.namespace, entry))
+    }
+    if (document.version === 2) {
+      if (!Array.isArray(document.payload.lineages)) throw new Error()
+      for (const entry of document.payload.lineages) {
+        if (!validLineage(entry, options.namespace, false)) throw new Error()
+        lineages.set(entry.lineage, {...entry, provider: "codex"})
+      }
+    }
+    if (document.version === 3 || document.version === 4) {
+      if (!Array.isArray(document.payload.lineages) || !Array.isArray(document.payload.runs)) throw new Error()
+      for (const rawEntry of document.payload.lineages) {
+        if (!validLineage(rawEntry, options.namespace, document.version === 4)) throw new Error()
+        const entry = document.version === 4 ? rawEntry : {...rawEntry, provider: "codex"}
+        if (entry.provider !== provider) throw new Error()
+        lineages.set(entry.lineage, entry)
+      }
+      for (const rawEntry of document.payload.runs) {
+        canonicalRunIdentity(rawEntry)
+        const entry = document.version === 4 ? rawEntry : {...rawEntry, provider: "codex", sealVersion: 3}
+        if (entry.provider !== provider) throw new Error()
+        runs.set(entry.run, entry)
+      }
+    }
+  } catch (error) {
+    if (/** @type {NodeJS.ErrnoException} */ (error).code !== "ENOENT") throw new Error("Isolated state registry authentication failed", {cause: error})
+  }
+  await removeAuthenticatedTemps(dirname(options.file), options.key, options.namespace)
+
+  const persist = async (sessionState = sessions, lineageState = lineages, runState = runs, signal) => {
+    throwIfAborted(signal)
+    const payload = {
+      sessions: [...sessionState.entries()].map(([sessionId, entry]) => ({sessionId, ...entry})),
+      lineages: [...lineageState.values()],
+      runs: [...runState.values()]
+    }
+    const serializedPayload = JSON.stringify(payload)
+    const document = JSON.stringify({version: 4, payload, mac: mac(options.key, serializedPayload)})
+    const temporary = join(dirname(options.file), `.sessions-${random(12).toString("hex")}.tmp`)
+    let handle
+    try {
+      handle = await open(temporary, "wx", 0o600)
+      throwIfAborted(signal)
+      await handle.writeFile(document)
+      await durabilityObserver?.("before-file-sync")
+      await handle.sync()
+      await durabilityObserver?.("after-file-sync")
+      await handle.close()
+      handle = undefined
+      throwIfAborted(signal)
+      await durabilityObserver?.("before-rename")
+      await rename(temporary, options.file)
+      await durabilityObserver?.("after-rename")
+      const directory = await open(dirname(options.file), "r")
+      try {
+        await durabilityObserver?.("before-directory-sync")
+        await directory.sync()
+        await durabilityObserver?.("after-directory-sync")
+      } finally {
+        await directory.close()
+      }
+    } catch (error) {
+      await handle?.close().catch(() => {})
+      throw error
+    }
+  }
+  const transact = (operation) => {
+    const result = serial.then(operation)
+    serial = result.catch(() => {})
+    return result
+  }
+  const allocationRecord = (allocation) => ({
+    provider: allocation.provider,
+    task: allocation.task,
+    lineage: allocation.lineage,
+    volume: allocation.volume,
+    labels: allocation.labels
+  })
+  const ownsRunSeal = (identity, seal, legacyLabels = false) => {
+    const persisted = runs.get(identity.run)
+    if (!persisted || typeof seal !== "string") return false
+    try {
+      if (canonicalRunIdentity(persisted) !== canonicalRunIdentity(identity)) return false
+      const legacySeal = persisted.sealVersion === 3
+      if (legacyLabels !== legacySeal) return false
+      const canonical = legacySeal ? legacyCanonicalRunIdentity(persisted) : canonicalRunIdentity(persisted)
+      return equalMac(seal, mac(options.key, canonical))
+    } catch {
+      return false
+    }
+  }
+
+  return {
+    namespace: options.namespace,
+    provider,
+    allocate(task) {
+      const lineage = random(24).toString("hex")
+      return {
+        provider,
+        task,
+        lineage,
+        volume: `threadwire-state-${options.namespace}-${lineage}`,
+        labels: stateLabels(options.namespace, task, lineage)
+      }
+    },
+    sealRun(identity) {
+      if (identity.sealVersion !== undefined) throw new Error("Invalid isolated run identity")
+      return mac(options.key, canonicalRunIdentity(identity))
+    },
+    ownsRunSeal(identity, seal, legacyLabels = false) {
+      return ownsRunSeal(identity, seal, legacyLabels)
+    },
+    ownsRun(identity, seal, legacyLabels = false) {
+      const lineage = lineages.get(identity.lineage)
+      if (!lineage || lineage.provider !== (identity.provider ?? "codex")
+        || lineage.volume !== identity.volume || lineage.labels["org.threadwire.task"] !== identity.task) return false
+      return ownsRunSeal(identity, seal, legacyLabels)
+    },
+    async trackRun(identity, signal) {
+      await transact(async () => {
+        throwIfAborted(signal)
+        const normalized = {...identity, provider: identity.provider ?? provider}
+        if (normalized.sealVersion !== undefined) throw new Error("Invalid isolated run identity")
+        canonicalRunIdentity(normalized)
+        if (normalized.provider !== provider || !lineages.has(normalized.lineage)) throw new Error(`${provider === "kimi" ? "Kimi" : "Codex"} run lineage is unavailable`)
+        const existing = runs.get(normalized.run)
+        if (existing && canonicalRunIdentity(existing) !== canonicalRunIdentity(normalized)) throw new Error(`${provider === "kimi" ? "Kimi" : "Codex"} run ownership collision`)
+        const nextRuns = new Map(runs)
+        nextRuns.set(normalized.run, existing ?? normalized)
+        await persist(sessions, lineages, nextRuns, signal)
+        replace(runs, nextRuns)
+        throwIfAborted(signal)
+      })
+    },
+    async completeRun(run, signal) {
+      await transact(async () => {
+        throwIfAborted(signal)
+        if (!runs.has(run)) return
+        const nextRuns = new Map(runs)
+        nextRuns.delete(run)
+        await persist(sessions, lineages, nextRuns, signal)
+        replace(runs, nextRuns)
+        throwIfAborted(signal)
+      })
+    },
+    runRecords() {
+      return [...runs.values()].map((entry) => ({...entry}))
+    },
+    lookup(sessionId, expectedProvider = provider) {
+      const entry = sessions.get(sessionId)
+      if (!entry || entry.provider !== expectedProvider || entry.expiresAt <= now()) return undefined
+      return {...entry, labels: stateLabels(options.namespace, entry.task, entry.lineage)}
+    },
+    async track(allocation, signal) {
+      await transact(async () => {
+        throwIfAborted(signal)
+        const normalized = providerAllocation(allocation, provider)
+        const existing = lineages.get(normalized.lineage)
+        const candidate = allocationRecord(normalized)
+        if (existing && JSON.stringify(existing) !== JSON.stringify(candidate)) throw new Error("Codex lineage ownership collision")
+        const nextLineages = new Map(lineages)
+        nextLineages.set(normalized.lineage, candidate)
+        await persist(sessions, nextLineages, runs, signal)
+        replace(lineages, nextLineages)
+        throwIfAborted(signal)
+      })
+    },
+    async register(sessionIds, allocation, ttlMs, signal) {
+      await transact(async () => {
+        throwIfAborted(signal)
+        const normalized = providerAllocation(allocation, provider)
+        const candidate = allocationRecord(normalized)
+        const owned = lineages.get(normalized.lineage)
+        if (owned && JSON.stringify(owned) !== JSON.stringify(candidate)) throw new Error("Codex lineage ownership collision")
+        const nextSessions = new Map(sessions)
+        const nextLineages = new Map(lineages)
+        for (const sessionId of sessionIds) {
+          const existing = nextSessions.get(sessionId)
+          if (existing && (existing.provider !== normalized.provider || existing.task !== normalized.task || existing.lineage !== normalized.lineage || existing.volume !== normalized.volume)) {
+            throw new Error("Codex session lineage collision")
+          }
+          nextSessions.set(sessionId, {
+            provider: normalized.provider, task: normalized.task, lineage: normalized.lineage,
+            volume: normalized.volume, expiresAt: now() + ttlMs
+          })
+        }
+        nextLineages.set(normalized.lineage, candidate)
+        await persist(nextSessions, nextLineages, runs, signal)
+        replace(sessions, nextSessions)
+        replace(lineages, nextLineages)
+        throwIfAborted(signal)
+      })
+    },
+    /**
+     * Sweeps aliases, adopts only exactly labelled namespace-owned orphan
+     * volumes, and retries failed deletions without dropping ownership.
+     */
+    async collect(docker, activeLineages = new Set(), requestOptions = {}) {
+      throwIfAborted(requestOptions.signal)
+      const listed = await docker.listVolumes({
+        "org.threadwire.owner": OWNER,
+        "org.threadwire.namespace": options.namespace
+      }, requestOptions)
+      const plan = await transact(async () => {
+        throwIfAborted(requestOptions.signal)
+        const nextSessions = new Map(sessions)
+        const nextLineages = new Map(lineages)
+        for (const [sessionId, entry] of nextSessions) if (entry.expiresAt <= now()) nextSessions.delete(sessionId)
+        for (const volume of Array.isArray(listed?.Volumes) ? listed.Volumes : []) {
+          const orphan = ownedVolumeRecord(volume, options.namespace, provider)
+          if (orphan && !nextLineages.has(orphan.lineage)) nextLineages.set(orphan.lineage, orphan)
+        }
+        // Persist removals and adopted cleanup evidence before touching Docker.
+        await persist(nextSessions, nextLineages, runs, requestOptions.signal)
+        replace(sessions, nextSessions)
+        replace(lineages, nextLineages)
+        throwIfAborted(requestOptions.signal)
+        const live = new Set([...nextSessions.values()].map((entry) => entry.lineage))
+        return [...nextLineages].filter(([lineage]) => !live.has(lineage) && !activeLineages.has(lineage))
+      })
+      const removedCandidates = []
+      for (const [lineage, entry] of plan) {
+        throwIfAborted(requestOptions.signal)
+        try {
+          const volume = await docker.inspectVolume(entry.volume, requestOptions)
+          validateStateVolume(volume, entry.volume, entry.labels)
+          if (activeLineages.has(lineage)) continue
+          await docker.removeVolume(entry.volume, requestOptions)
+          removedCandidates.push([lineage, entry])
+        } catch (error) {
+          if (isDockerMissing(error)) removedCandidates.push([lineage, entry])
+        }
+      }
+      return transact(async () => {
+        throwIfAborted(requestOptions.signal)
+        const nextLineages = new Map(lineages)
+        let removed = 0
+        const live = new Set([...sessions.values()].filter((entry) => entry.expiresAt > now()).map((entry) => entry.lineage))
+        for (const [lineage, expected] of removedCandidates) {
+          if (live.has(lineage) || activeLineages.has(lineage)) continue
+          if (JSON.stringify(nextLineages.get(lineage)) !== JSON.stringify(expected)) continue
+          nextLineages.delete(lineage)
+          removed++
+        }
+        await persist(sessions, nextLineages, runs, requestOptions.signal)
+        replace(lineages, nextLineages)
+        throwIfAborted(requestOptions.signal)
+        return {sessions: sessions.size, lineages: lineages.size, removed}
+      })
+    },
+    counts() {
+      return {sessions: sessions.size, lineages: lineages.size, runs: runs.size}
+    }
+  }
+}
+
+function throwIfAborted(signal) {
+  if (signal?.aborted) throw signal.reason instanceof Error ? signal.reason : new Error("Isolated state operation aborted")
+}
+
+export function stateLabels(namespace, task, lineage) {
+  return {
+    "org.threadwire.owner": OWNER,
+    "org.threadwire.namespace": namespace,
+    "org.threadwire.task": createHmac("sha256", namespace).update(task).digest("hex"),
+    "org.threadwire.lineage": lineage
+  }
+}
+
+export function validateStateVolume(volume, name, labels) {
+  if (!record(volume) || volume.Name !== name || !record(volume.Labels)) throw new Error("Isolated state volume collision")
+  const actual = volume.Labels
+  if (Object.keys(actual).length !== Object.keys(labels).length) throw new Error("Isolated state volume collision")
+  for (const [key, value] of Object.entries(labels)) if (actual[key] !== value) throw new Error("Isolated state volume collision")
+}
+
+function ownedVolumeRecord(volume, namespace, provider) {
+  if (!record(volume) || !record(volume.Labels)) return undefined
+  const labels = volume.Labels
+  const lineage = labels["org.threadwire.lineage"]
+  const name = volume.Name
+  if (Object.keys(labels).length !== 4
+    || labels["org.threadwire.owner"] !== OWNER
+    || labels["org.threadwire.namespace"] !== namespace
+    || !/^[0-9a-f]{64}$/u.test(labels["org.threadwire.task"])
+    || !/^[0-9a-f]{48}$/u.test(lineage)
+    || name !== `threadwire-state-${namespace}-${lineage}`) return undefined
+  return {provider, task: "", lineage, volume: name, labels}
+}
+
+function providerAllocation(allocation, expectedProvider) {
+  const actualProvider = allocation.provider ?? "codex"
+  if (actualProvider !== expectedProvider) throw new Error("Isolated state provider mismatch")
+  return {...allocation, provider: actualProvider}
+}
+
+function lineageFromSession(namespace, entry) {
+  return {
+    provider: entry.provider, task: entry.task, lineage: entry.lineage, volume: entry.volume,
+    labels: stateLabels(namespace, entry.task, entry.lineage)
+  }
+}
+
+function validSession(value, requireProvider = true) {
+  return record(value) && (!requireProvider || value.provider === "codex" || value.provider === "kimi")
+    && typeof value.sessionId === "string" && typeof value.task === "string"
+    && /^[0-9a-f]{48}$/u.test(value.lineage)
+    && /^threadwire-state-[A-Za-z0-9_.-]+-[0-9a-f]{48}$/u.test(value.volume)
+    && Number.isSafeInteger(value.expiresAt)
+}
+
+function validLineage(value, namespace, requireProvider = true) {
+  return record(value) && (!requireProvider || value.provider === "codex" || value.provider === "kimi")
+    && typeof value.task === "string" && /^[0-9a-f]{48}$/u.test(value.lineage)
+    && value.volume === `threadwire-state-${namespace}-${value.lineage}` && record(value.labels)
+    && Object.keys(value.labels).length === 4
+    && value.labels["org.threadwire.owner"] === OWNER
+    && value.labels["org.threadwire.namespace"] === namespace
+    && value.labels["org.threadwire.lineage"] === value.lineage
+    && /^[0-9a-f]{64}$/u.test(value.labels["org.threadwire.task"])
+}
+
+function isDockerMissing(error) {
+  return error instanceof Error && /\(404\)/u.test(error.message)
+}
+
+function without(value, key) {
+  const copy = {...value}
+  delete copy[key]
+  return copy
+}
+
+function replace(target, source) {
+  target.clear()
+  for (const [key, value] of source) target.set(key, value)
+}
+
+async function removeAuthenticatedTemps(directory, key, namespace) {
+  const names = await readdir(directory)
+  let removed = false
+  for (const name of names) {
+    if (!/^\.sessions-[0-9a-f]{24}\.tmp$/u.test(name)) continue
+    let handle
+    try {
+      const path = join(directory, name)
+      handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW)
+      const before = await handle.stat({bigint: true})
+      if (!before.isFile() || before.isSymbolicLink() || before.nlink !== 1n
+        || before.uid !== BigInt(process.getuid?.() ?? -1)
+        || before.size < 1n || before.size > 4_194_304n || (before.mode & 0o077n) !== 0n) continue
+      const document = JSON.parse(await handle.readFile("utf8"))
+      if (!authenticatedDocument(document, key, namespace)) continue
+      const after = await lstat(path, {bigint: true})
+      if (after.dev !== before.dev || after.ino !== before.ino || after.isSymbolicLink()) continue
+      await unlink(path)
+      removed = true
+    } catch {
+      // Malformed, unreadable, and foreign temp files are deliberately left untouched.
+    } finally {
+      await handle?.close().catch(() => {})
+    }
+  }
+  if (!removed) return
+  const handle = await open(directory, "r")
+  try { await handle.sync() } finally { await handle.close() }
+}
+
+function authenticatedDocument(document, key, namespace) {
+  if (!record(document) || ![1, 2, 3, 4].includes(document.version) || typeof document.mac !== "string"
+    || !record(document.payload) || !Array.isArray(document.payload.sessions)) return false
+  const payload = JSON.stringify(document.payload)
+  if (!equalMac(document.mac, mac(key, payload))) return false
+  const current = document.version === 4
+  if (!document.payload.sessions.every((entry) => validSession(entry, current))) return false
+  if (document.version === 1) return true
+  if (!Array.isArray(document.payload.lineages)
+    || !document.payload.lineages.every((entry) => validLineage(entry, namespace, current))) return false
+  return document.version === 2 || (Array.isArray(document.payload.runs)
+    && document.payload.runs.every((entry) => {
+      try { canonicalRunIdentity(entry); return true } catch { return false }
+    }))
+}
+
+function canonicalRunIdentity(identity) {
+  const keys = [
+    "provider", "namespace", "run", "lineage", "task", "volume", "network", "container",
+    "image", "worktreeType", "worktreeSource", "worktreeSubpath"
+  ]
+  if (!record(identity)) throw new Error("Invalid isolated run identity")
+  const normalized = {...identity, provider: identity.provider ?? "codex"}
+  const legacySeal = normalized.sealVersion === 3 && normalized.provider === "codex"
+  const expectedKeys = legacySeal ? [...keys, "sealVersion"] : keys
+  if (Object.keys(normalized).length !== expectedKeys.length
+    || expectedKeys.some((key) => !Object.prototype.hasOwnProperty.call(normalized, key))
+    || (normalized.provider !== "codex" && normalized.provider !== "kimi")
+    || keys.some((key) => typeof normalized[key] !== "string")) throw new Error("Invalid isolated run identity")
+  return JSON.stringify(Object.fromEntries(keys.map((key) => [key, normalized[key]])))
+}
+
+function legacyCanonicalRunIdentity(identity) {
+  const keys = [
+    "namespace", "run", "lineage", "task", "volume", "network", "container",
+    "image", "worktreeType", "worktreeSource", "worktreeSubpath"
+  ]
+  if (!record(identity) || identity.provider !== "codex" || identity.sealVersion !== 3
+    || Object.keys(identity).length !== keys.length + 2
+    || keys.some((key) => typeof identity[key] !== "string")) throw new Error("Invalid legacy Codex run identity")
+  return JSON.stringify(Object.fromEntries(keys.map((key) => [key, identity[key]])))
+}
+
+async function requirePrivateDirectory(path) {
+  const stats = await lstat(path)
+  if (!stats.isDirectory() || stats.isSymbolicLink() || (stats.mode & 0o077) !== 0) throw new Error("Invalid isolated state directory")
+}
+
+function mac(key, payload) {
+  return createHmac("sha256", key).update(payload).digest("hex")
+}
+
+function equalMac(left, right) {
+  if (!/^[0-9a-f]{64}$/u.test(left)) return false
+  return timingSafeEqual(Buffer.from(left, "hex"), Buffer.from(right, "hex"))
+}
+
+function record(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value)
+}

package/src/isolated-worker.js

@@ -0,0 +1,144 @@
+// @ts-check
+
+import {isAbsolute, normalize} from "node:path"
+
+const DIGEST_IMAGE = /^(?:[^@\s]+@)?sha256:[0-9a-f]{64}$/u
+const SAFE_VALUE = /^[^\0\r\n]+$/u
+
+/**
+ * @typedef {{
+ *   provider?: "codex" | "kimi",
+ *   image: string,
+ *   worktree: string,
+ *   networkName: string,
+ *   brokerToken: string,
+ *   prompt: string,
+ *   resumeSession?: string,
+ *   brokerUrl?: string
+ *   worktreeVolume?: {name: string, subpath: string}
+ *   workingDirectory: string,
+ *   providerArguments: string[],
+ *   model?: string,
+ *   stateVolume: string,
+ *   worktreeInode: string,
+ *   cwdInode: string
+ *   lineage?: string
+ *   namespace?: string
+ *   runId?: string
+ *   taskHash?: string
+ *   runSeal?: string
+ * }} WorkerSpecOptions
+ */
+
+/** @param {WorkerSpecOptions} options */
+export function buildWorkerContainerSpec(options) {
+  const provider = options.provider ?? "codex"
+  if (provider !== "codex" && provider !== "kimi") throw new Error("Worker provider is invalid")
+  if (!DIGEST_IMAGE.test(options.image)) throw new Error("Worker image must use an immutable digest")
+  if (!isAbsolute(options.worktree) || normalize(options.worktree) !== options.worktree || options.worktree === "/") {
+    throw new Error("Worker worktree must be a normalized non-root absolute path")
+  }
+  for (const [name, value] of /** @type {[string, string][]} */ ([["network", options.networkName], ["capability", options.brokerToken], ["prompt", options.prompt]])) {
+    if (!SAFE_VALUE.test(value)) throw new Error(`Worker ${name} is invalid`)
+  }
+  if (options.resumeSession !== undefined && !SAFE_VALUE.test(options.resumeSession)) throw new Error("Worker resume session is invalid")
+  if (!isAbsolute(options.workingDirectory) || !withinWorktree(options.workingDirectory)) throw new Error("Worker cwd is invalid")
+  if (provider === "kimi" && (typeof options.model !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._:/-]{0,255}$/u.test(options.model))) {
+    throw new Error("Worker Kimi model is invalid")
+  }
+  const commonEnvironment = [
+    "HOME=/home/worker",
+    "TMPDIR=/tmp",
+    `THREADWIRE_PROMPT=${options.prompt}`,
+    `THREADWIRE_WORKTREE_INODE=${options.worktreeInode}`,
+    `THREADWIRE_CWD_INODE=${options.cwdInode}`,
+    ...(options.resumeSession === undefined ? [] : [`THREADWIRE_RESUME_SESSION=${options.resumeSession}`])
+  ]
+  const environment = provider === "kimi"
+    ? [
+      ...commonEnvironment,
+      "KIMI_CODE_HOME=/home/worker/.kimi-code",
+      `THREADWIRE_KIMI_MODEL=${options.model}`,
+      `THREADWIRE_KIMI_BROKER_URL=${options.brokerUrl}`,
+      `THREADWIRE_KIMI_BROKER_TOKEN=${options.brokerToken}`
+    ]
+    : [
+      ...commonEnvironment,
+      "CODEX_HOME=/home/worker/.codex",
+      `OPENAI_BASE_URL=${options.brokerUrl ?? "http://model-broker:8789/v1"}`,
+      `OPENAI_API_KEY=${options.brokerToken}`,
+      `CODEX_API_KEY=${options.brokerToken}`,
+      `THREADWIRE_CODEX_ARGUMENTS=${JSON.stringify(options.providerArguments)}`
+    ]
+  const worktreeMount = options.worktreeVolume === undefined
+    ? {
+      Type: "bind",
+      Source: options.worktree,
+      Target: "/worktree",
+      ReadOnly: false,
+      BindOptions: {Propagation: "rprivate"}
+    }
+    : {
+      Type: "volume",
+      Source: options.worktreeVolume.name,
+      Target: "/worktree",
+      ReadOnly: false,
+      VolumeOptions: {Subpath: options.worktreeVolume.subpath}
+    }
+  return {
+    Image: options.image,
+    Labels: {
+      "org.threadwire.owner": "isolated-runtime",
+      ...(options.lineage === undefined ? {} : {
+        "org.threadwire.namespace": options.namespace,
+        "org.threadwire.provider": provider,
+        "org.threadwire.run": options.runId,
+        "org.threadwire.lineage": options.lineage,
+        "org.threadwire.task": options.taskHash,
+        "org.threadwire.network": options.networkName,
+        "org.threadwire.state-volume": options.stateVolume,
+        "org.threadwire.run-seal": options.runSeal
+      })
+    },
+    Entrypoint: provider === "kimi"
+      ? ["node", "/opt/threadwire/docker/kimi-worker-entrypoint.mjs"]
+      : ["/usr/local/libexec/threadwire/worker-entrypoint"],
+    Env: environment,
+    WorkingDir: options.workingDirectory,
+    User: "10002:10002",
+    NetworkDisabled: false,
+    HostConfig: {
+      AutoRemove: false,
+      Mounts: [
+        worktreeMount,
+        {Type: "volume", Source: options.stateVolume, Target: "/home/worker", ReadOnly: false}
+      ],
+      CapDrop: ["ALL"],
+      NetworkMode: options.networkName,
+      ReadonlyRootfs: true,
+      SecurityOpt: ["no-new-privileges"],
+      PidsLimit: 128,
+      Memory: 1_073_741_824,
+      NanoCpus: 2_000_000_000,
+      Tmpfs: {
+        "/tmp": "rw,noexec,nosuid,nodev,size=67108864,uid=10002,gid=10002",
+        "/run": "rw,noexec,nosuid,nodev,size=1048576,uid=10002,gid=10002"
+      },
+      Ulimits: [
+        {Name: "nofile", Soft: 1024, Hard: 1024},
+        {Name: "core", Soft: 0, Hard: 0},
+        {Name: "fsize", Soft: 1_073_741_824, Hard: 1_073_741_824}
+      ]
+    }
+  }
+}
+
+/** @param {string} path */
+function withinWorktree(path) {
+  return path === "/worktree" || path.startsWith("/worktree/")
+}
+
+/** @param {string} value */
+export function isDigestImage(value) {
+  return DIGEST_IMAGE.test(value)
+}