threadwire 0.1.8 → 0.1.9

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 ## Unreleased
 
+## 0.1.9 - 2026-07-28
+
+- Add native Kimi Code subscription support through official OAuth, a distinct
+  narrow Kimi model broker, an immutable pinned worker/auth image set, and a
+  mandatory provider-dedicated isolated runtime with no direct fallback.
+- Normalize only trusted Kimi assistant/tool/session envelopes, preserve exact
+  native continuation and Telegram topic routing, and suppress thinking, raw
+  tool payloads, arbitrary metadata, stderr/stdout, grants, and OAuth material.
+- Bind Kimi grants and authenticated session state to provider, task, session,
+  run network, approved alias, and wire model; add adversarial fresh/resume,
+  failure, cancellation, refresh, redaction, network, and cross-provider tests.
+
 ## 0.1.8 - 2026-07-26
 
 - Add `threadwire run --transcript <path>` to durably capture the exact normalized

package/README.md

@@ -60,11 +60,11 @@ Use the local launcher. Install or refresh it after updating Threadwire with `np
   -- --model example-model
 ```
 
-The target always has the form `telegram:<chat-id>:<thread-id>` for topics, or `telegram:<chat-id>` for direct messages (DMs) and ordinary chats. The chat ID is always required and must be a nonzero signed integer. The thread ID is optional and valid only as the explicit topic suffix: when present it must be a positive safe integer, and a DM target simply omits it — a missing thread ID is never an error. `--provider` must be exactly one of `codex`, `claude`, or `opencode`. Malformed or missing provider, chat ID, or thread ID arguments are hard failures (exit code 2) reported through Threadwire's normal error path with fixed messages; they fail before the Telegram token is read, before any transport is created, and before any provider is launched, and the messages never echo the bot token or the untrusted argument value. `--process-number` accepts an explicit positive safe integer for automation; when omitted, Threadwire uses its launcher PID. Every Telegram message is labeled consistently, such as `[P42] …`, including chunked continuations.
+The target always has the form `telegram:<chat-id>:<thread-id>` for topics, or `telegram:<chat-id>` for direct messages (DMs) and ordinary chats. The chat ID is always required and must be a nonzero signed integer. The thread ID is optional and valid only as the explicit topic suffix: when present it must be a positive safe integer, and a DM target simply omits it — a missing thread ID is never an error. `--provider` must be exactly one of `codex`, `claude`, `kimi`, or `opencode`. Malformed or missing provider, chat ID, or thread ID arguments are hard failures (exit code 2) reported through Threadwire's normal error path with fixed messages; they fail before the Telegram token is read, before any transport is created, and before any provider is launched, and the messages never echo the bot token or the untrusted argument value. `--process-number` accepts an explicit positive safe integer for automation; when omitted, Threadwire uses its launcher PID. Every Telegram message is labeled consistently, such as `[P42] …`, including chunked continuations.
 
-Pass `--workspace-profile <name>` only when invoking Threadwire inside the container-native runtime, for example with `node bin/threadwire.js run` as shown in [Container runtime](docs/container-runtime.md). A profile selects a reviewed entry from the checked-in [threadwire.workspace-profiles.json](threadwire.workspace-profiles.json). It supplies the absolute in-container repository root, the exact in-container working directory, and the allowlisted providers for that workspace. Threadwire validates the selected profile, rejects malformed or unknown names, verifies the configured workspace exists and is still a healthy Git worktree, and records the selected profile plus immutable revision/worktree identity in the local activity log before provider spawn. The checked-in `container-runtime` default targets `/workspace/threadwire` inside the container-native runtime and currently allowlists only `codex`.
+Pass `--workspace-profile <name>` only when invoking Threadwire inside the container-native runtime, for example with `node bin/threadwire.js run` as shown in [Container runtime](docs/container-runtime.md). A profile selects a reviewed entry from the checked-in [threadwire.workspace-profiles.json](threadwire.workspace-profiles.json). It supplies the absolute in-container repository root, the exact in-container working directory, and the allowlisted providers for that workspace. Threadwire validates the selected profile, rejects malformed or unknown names, verifies the configured workspace exists and is still a healthy Git worktree, and records the selected profile plus immutable revision/worktree identity in the local activity log before provider spawn. The checked-in `container-runtime` default targets `/workspace/threadwire` inside the container-native runtime and allowlists `codex` and isolated `kimi`.
 
-Provider tool-start and tool-finish events do not produce Telegram messages by default. Pass the boolean `--tool-messages` flag to opt in, as shown above. When enabled, each tool is one concise, silent status line rather than a pair of noisy start/finish notices: when a tool starts, Threadwire sends `🛠 [P42] Tool: <safe command or tool description>` (for example `🛠 [P42] Tool: command — git status --short`), and when that same tool finishes, it edits the original message in place so it begins `✅` instead — no second completion message is sent, and Telegram edits raise no notification. The command/description shows a safe CLI-style preview with credential-bearing values (tokens, passwords, keys, authorization/cookie forms, credentials in URLs) redacted and control characters stripped; only normalized Codex command-completion output may also be appended to that same edited status as a Telegram-native expandable HTML blockquote with the visible label `Output →`; it is credential-redacted, HTML-escaped, and Unicode-safe bounded. Stderr, reasoning, and every other raw provider result remain excluded. Use `--max-output-length <positive-integer>` to truncate only that preview Unicode-safely; omit the option for unlimited tool detail. A prompt may instead come from `--prompt-file` or piped stdin, and every source rejects blank/whitespace content. Arguments following `--` pass to the selected provider, except output-stream options owned by Threadwire.
+Provider tool-start and tool-finish events do not produce Telegram messages by default. Pass the boolean `--tool-messages` flag to opt in, as shown above. When enabled, each tool is one concise, silent status line rather than a pair of noisy start/finish notices: when a tool starts, Threadwire sends `🛠 [P42] Tool: <safe command or tool description>` (for example `🛠 [P42] Tool: command — git status --short`), and when that same tool finishes, it edits the original message in place so it begins `✅` instead — no second completion message is sent, and Telegram edits raise no notification. The command/description shows a safe CLI-style preview with credential-bearing values (tokens, passwords, keys, authorization/cookie forms, credentials in URLs) redacted and control characters stripped; only normalized Codex command-completion output may also be appended to that same edited status as a Telegram-native expandable HTML blockquote with the visible label `Output →`; it is credential-redacted, HTML-escaped, and Unicode-safe bounded. Stderr, reasoning, and every other raw provider result remain excluded. Use `--max-output-length <positive-integer>` to truncate only that preview Unicode-safely; omit the option for unlimited tool detail. A prompt may instead come from `--prompt-file` or piped stdin, and every source rejects blank/whitespace content. Arguments following `--` pass to the selected provider, except output-stream options owned by Threadwire. Kimi is narrower: it always uses the dedicated isolated subscription runtime and accepts only one server-approved model alias through `--model <alias>` (or `-m <alias>`); Threadwire owns its prompt, output, session, permissions, configuration, tools, skills, plugins, MCP, and directories.
 
 Threadwire directly spawns the structurally separate terminal adapters `/opt/data/libexec/threadwire/codex`, `/opt/data/libexec/threadwire/claude`, or `/opt/data/libexec/threadwire/opencode-local-fleet` with an argv array and `shell: false`. These libexec adapters hold the real provider-CLI logic and are never on a worker's `PATH`, so relaying can never recurse back into the front-door shims. Each spawn also sets `THREADWIRE_ACTIVE=1` in the provider child environment. The executable can be overridden per provider with `THREADWIRE_CODEX_BIN`, `THREADWIRE_CLAUDE_BIN`, or `THREADWIRE_OPENCODE_BIN` for staged cutover and rollback. It does not impose a worker timeout. `SIGINT` and `SIGTERM` are forwarded to the worker as explicit cancellation.
 

package/TELEGRAM-INGRESS.md

@@ -1,9 +1,10 @@
 # Telegram Ingress for Threadwire
 
 Standalone Threadwire webhook service that accepts Telegram Bot API updates.
-Native providers use the existing worker path; when isolated-runtime authority
-is configured, Codex uses isolated preflight/run exclusively with no native
-fallback. Hermes is not involved.
+Codex, Claude, and OpenCode retain the existing worker behavior. Kimi always
+uses its dedicated isolated preflight/run authority with no native fallback;
+a missing Kimi runtime fails before provider or transport construction. Hermes
+is not involved.
 
 ## Important bot ownership
 
@@ -44,7 +45,7 @@ The process binds to **loopback (`127.0.0.1`) by default**. Expose it only throu
   - **Residual restart boundary:** this store is process-local memory only. A process restart clears reservations and completed IDs, so Telegram redelivery after restart can launch work again until IDs are re-observed. This is not durable multi-instance replay protection.
 - Bound concurrent spawned workers (default 4, configurable). When at capacity, reject with `503` without launching. The concurrency slot is released when the background worker settles (success or failure after spawn), or immediately on pre-spawn failure.
 - Both chat and sender allowlists are mandatory and exact; missing IDs fail closed.
-- Command grammar is exact: `/code[optional @bot] <codex|claude|opencode> <nonblank prompt>`.
+- Command grammar is exact: `/code[optional @bot] <codex|claude|kimi|opencode> <nonblank prompt>`.
 - Direct target is derived only from authenticated `message.chat.id` and optional positive `message_thread_id`.
   - DM/chat: `telegram:<chat-id>`
   - Topic: `telegram:<chat-id>:<thread-id>`
@@ -82,6 +83,8 @@ Optional:
 | `THREADWIRE_TELEGRAM_REQUEST_TIMEOUT_MS` | Deadline for each outbound Telegram request, including response parsing (default `30000`, positive safe integer no greater than `2147483647`) |
 | `THREADWIRE_UPDATE_ID_CAPACITY` | Max retained completed `update_id` entries (default `10000`) |
 | `THREADWIRE_UPDATE_ID_TTL_MS` | Retention TTL for completed `update_id` entries in ms (default `86400000`) |
+| `THREADWIRE_KIMI_ISOLATED_RUNTIME_URL` | Dedicated Kimi supervisor URL; Compose defaults to `http://kimi-isolated-runtime:8790` |
+| `THREADWIRE_KIMI_ISOLATED_RUNTIME_CONTROL_TOKEN` | Dedicated Kimi control token. When absent, `/code kimi` remains recognized but fails closed before launch. |
 
 ## Run
 
@@ -111,6 +114,7 @@ The wrapper starts the service exported by the importable
 /code codex write a hello world program
 /code@your_bot claude explain quantum computing
 /code opencode build a todo app
+/code kimi inspect this repository
 ```
 
 ## Modules

package/bin/kimi-model-broker.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+
+import {startKimiModelBroker} from "../src/kimi-model-broker.js"
+
+await startKimiModelBroker()

package/docs/container-runtime.md

@@ -199,3 +199,25 @@ Back them up using an operator-approved volume backup process before migration.
 `docker compose down --volumes` is destructive and removes the container-owned
 repository and provider state; use it only for an explicitly confirmed teardown.
 Never export or archive mounted secret files with workspace/provider backups.
+
+
+## Kimi subscription containers
+
+Kimi is intentionally excluded from the same-UID container-native provider
+launch described above. Never mount `threadwire-kimi-oauth`, its access/refresh
+tokens, or the auth home into the Threadwire runtime, supervisor, worker,
+workspace, or session-state volume. Kimi uses four immutable build targets:
+`kimi-auth`, `kimi-model-broker`, `kimi-relay-worker`, and `isolated-runtime`.
+The first two share UID/GID 10003 and only the OAuth volume; the worker uses
+UID/GID 10002 with only the selected worktree and provider-bound state; the
+root supervisor alone receives the Docker socket. The broker/auth service uses
+Node `22.19.0` and exactly `@moonshot-ai/kimi-code@0.29.2` with the checked npm
+integrity and archive SHA-512 in the Dockerfile.
+
+Enable the checked-in override with `--profile kimi` only after the OAuth/model
+operator flow in [Isolated provider runtime](isolated-provider-runtime.md).
+The default workspace profile allowlists Kimi because isolation is mandatory;
+without the dedicated Kimi control token/client, both CLI and Telegram Kimi
+jobs fail closed rather than using the native child path. Keep broker egress
+restricted to official Kimi Code subscription/auth endpoints and do not provide
+a Moonshot API key, custom base URL, Docker socket, or ingress secret.

package/docs/isolated-provider-runtime.md

@@ -135,3 +135,98 @@ Run `npm run all-checks`, `npm run verify:package`, and
 production relay-worker, and fake-upstream image variables documented
 by that script. E2E uses host-volume canaries and fake-upstream authorization
 logs; worker self-report is not the sole assertion.
+
+
+## Native Kimi Code subscription boundary
+
+Kimi uses the same proven supervisor mechanics but a distinct protocol and
+credential service. `THREADWIRE_ISOLATED_PROVIDER=kimi` makes the supervisor
+accept only Kimi preflights, select only `THREADWIRE_KIMI_RELAY_WORKER_IMAGE`,
+issue grants only to `THREADWIRE_KIMI_MODEL_BROKER_URL`, and persist
+provider-bound state in the separate Kimi namespace. Codex requests, sessions,
+workers, grants, and volumes cannot be adopted by this service, and the Codex
+broker remains unchanged.
+
+The Kimi broker is not a generic credential proxy. It accepts only
+`POST /v1/chat/completions`, validates a closed request schema and one approved
+wire model, substitutes OAuth immediately before the fixed official
+`https://api.kimi.com/coding/v1/chat/completions` request, and streams the
+bounded response. A grant is pending until the inspected worker is ready and is
+bound to provider, task hash, exact resume session (or fresh lineage), run,
+Docker network, approved alias, and wire model. Revocation, timeout, shutdown,
+or cleanup closes its private listener and active sockets.
+
+The immutable Kimi worker image pins `@moonshot-ai/kimi-code@0.29.2` and verifies
+the npm archive SHA-512 before installation. It receives no OAuth file, Docker
+socket, Telegram credential, supervisor token, broker admin token, ambient
+provider executable override, external network, or unrelated home directory.
+Its fixed entrypoint owns `--model`, optional exact `--session`, `--prompt`,
+`--output-format stream-json`, and an empty skills directory. Static deny rules,
+workspace/config ancestry checks, a sanitized private home, read-only root,
+and the existing mount/inode checks remain mandatory. There is no native unsafe
+fallback and no `THREADWIRE_KIMI_BIN` control.
+
+Only exact pinned stream records are normalized: assistant string content,
+validated tool name/key start and finish, and one exact
+`session.resume_hint`. Thinking, tool arguments/results, retry errors, version
+or arbitrary metadata, malformed records, raw stdout/stderr, synthetic grants,
+and OAuth material are discarded. The worker is the only reader of native Kimi
+stdout and Docker receives only sanitized envelopes and fixed lifecycle events;
+the supervisor returns `rawChunks: []` for every Kimi run.
+
+### Operator OAuth and model approval
+
+Build and publish the `kimi-auth`, `kimi-model-broker`, `kimi-relay-worker`, and
+existing `isolated-runtime` targets as immutable digests. Set distinct random
+Kimi runtime and broker admin tokens of at least 32 characters, the Kimi image digests, and an allowlist
+such as:
+
+```sh
+export THREADWIRE_ALLOWED_KIMI_MODELS='{"default":{"model":"<verified-account-model>","protocol":"kimi"}}'
+```
+
+OAuth writes only the named `threadwire-kimi-oauth` volume at the official
+`credentials/kimi-code.json` location. Stop the broker during interactive auth
+so the CLI and broker cannot race a refresh, then run the opt-in, workspace-free
+auth service:
+
+```sh
+docker compose -f compose.yaml -f compose.relay-write.yaml stop kimi-isolated-runtime kimi-model-broker
+docker compose -f compose.yaml -f compose.relay-write.yaml --profile kimi-auth run --rm kimi-auth login
+docker compose -f compose.yaml -f compose.relay-write.yaml --profile kimi-auth run --rm kimi-auth verify '<verified-account-model>'
+docker compose -f compose.yaml -f compose.relay-write.yaml --profile kimi up --detach --wait
+```
+
+Complete the official device flow directly in the operator terminal. Do not
+copy device codes into tickets, chat, logs, environment files, or Threadwire.
+The auth service has no workspace, ingress network, Docker socket, Threadwire
+control token, or Telegram credential and uses Docker logging driver `none`.
+`verify <account-model>` discards native output and prints only a fixed
+success/failure; use it to confirm each exact account model value before mapping
+that value to a server-approved Threadwire alias.
+API keys, Moonshot platform mode, custom base URLs, discovery by ordinary jobs,
+and arbitrary aliases are unsupported.
+
+For logout or account rotation, stop the Kimi runtime and broker, run
+`--profile kimi-auth run --rm kimi-auth logout` or `login`, verify approved
+models, then restart the Kimi profile. The broker validates strict owner/mode,
+regular-file, link-count, schema, and size constraints; refreshes are serialized
+and atomically persisted, and corruption, symlinks, revocation, or unreadable
+state makes health and preflight fail closed with redacted errors.
+
+### Kimi validation and rollback
+
+Run `npm run test:kimi-isolated-runtime-e2e` from an approved Docker supervisor
+boundary after supplying the documented immutable image variables. A real
+account smoke must then cover fresh execution, capture of exactly one native
+session ID, exact resume with that ID, an approved non-default alias if used,
+Telegram DM/topic routing, cancellation, and confirmation that service logs and
+activity/evidence contain no OAuth token, device code, raw Kimi record, tool
+payload, or synthetic grant.
+
+Rollback by stopping `kimi-isolated-runtime` and `kimi-model-broker`, removing
+the `kimi` Compose profile/control variables, and reverting the Threadwire image.
+Kimi commands then fail closed; Codex behavior is unaffected. Preserve the OAuth
+and Kimi state volumes for a recoverable rollback. Remove them only as an
+explicit credential/session teardown after OAuth revocation; never archive them
+with workspace backups.

package/package.json

@@ -1,12 +1,13 @@
 {
   "name": "threadwire",
-  "version": "0.1.8",
-  "description": "Stream Codex, Claude, and OpenCode worker progress to an explicit Telegram destination",
+  "version": "0.1.9",
+  "description": "Stream Codex, Claude, Kimi Code, and OpenCode worker progress to an explicit Telegram destination",
   "keywords": [
     "ai-agent",
     "claude",
     "cli",
     "codex",
+    "kimi",
     "opencode",
     "telegram"
   ],
@@ -24,6 +25,7 @@
   ],
   "bin": {
     "threadwire-isolated-runtime": "bin/isolated-runtime.js",
+    "threadwire-kimi-model-broker": "bin/kimi-model-broker.js",
     "threadwire-model-broker": "bin/model-broker.js",
     "threadwire": "bin/threadwire.js",
     "threadwire-telegram-webhook": "bin/telegram-webhook.js"
@@ -54,7 +56,8 @@
     "test:container-e2e": "sh docker/test/production-e2e.sh",
     "test:isolated-runtime-e2e": "sh docker/test/isolated-runtime-e2e.sh",
     "typecheck": "tsc --noEmit",
-    "verify:package": "node scripts/verify-package.js"
+    "verify:package": "node scripts/verify-package.js",
+    "test:kimi-isolated-runtime-e2e": "sh docker/test/kimi-isolated-runtime-e2e.sh"
   },
   "devDependencies": {
     "@eslint/js": "10.0.1",

package/scripts/verify-package.js

@@ -13,6 +13,7 @@ const npmEnvironment = {
   NPM_CONFIG_DRY_RUN: "false",
   npm_config_dry_run: "false"
 }
+const packageTmpdir = process.env.THREADWIRE_PACKAGE_TMPDIR ?? tmpdir()
 const EXPECTED_FILES = [
   "CHANGELOG.md",
   "LICENSE",
@@ -21,6 +22,7 @@ const EXPECTED_FILES = [
   "bin/telegram-webhook.js",
   "bin/threadwire.js",
   "bin/isolated-runtime.js",
+  "bin/kimi-model-broker.js",
   "bin/model-broker.js",
   "docs/card-10520-plan.md",
   "docs/container-runtime.md",
@@ -48,6 +50,9 @@ const EXPECTED_FILES = [
   "src/isolated-runtime.js",
   "src/isolated-state.js",
   "src/isolated-worker.js",
+  "src/kimi-model-broker-policy.js",
+  "src/kimi-model-broker.js",
+  "src/kimi-oauth-store.js",
   "src/model-broker-policy.js",
   "src/model-broker.js",
   "src/mount-policy.js",
@@ -58,6 +63,7 @@ const EXPECTED_FILES = [
   "src/providers/codex.js",
   "src/providers/executable.js",
   "src/providers/index.js",
+  "src/providers/kimi.js",
   "src/providers/opencode.js",
   "src/relay.js",
   "src/relay-write.js",
@@ -78,7 +84,7 @@ const EXPECTED_FILES = [
 
 /** @returns {Promise<void>} */
 async function main() {
-  const temporaryDirectory = await mkdtemp(join(tmpdir(), "threadwire-package-"))
+  const temporaryDirectory = await mkdtemp(join(packageTmpdir, "threadwire-package-"))
   const cacheDirectory = join(temporaryDirectory, "npm-cache")
 
   try {
@@ -133,6 +139,7 @@ async function main() {
       ], {
         env: {
           PATH: process.env.PATH,
+          HOME: process.env.HOME,
           NPM_CONFIG_DRY_RUN: "false",
           npm_config_dry_run: "false"
         },

package/src/activity-log.js

@@ -24,13 +24,13 @@ export class ActivityLog {
     this.write({type: "workspace-selected", profile, repositoryRoot, revision, sourceIdentity})
   }
 
-  /** @param {"codex" | "claude" | "opencode"} provider @param {number} pid */
+  /** @param {"codex" | "claude" | "kimi" | "opencode"} provider @param {number} pid */
   recordStarted(provider, pid) {
     if (!Number.isSafeInteger(pid) || pid <= 0) throw new Error("Provider child PID is unavailable")
     this.write({type: "provider-started", provider, pid})
   }
 
-  /** @param {"codex" | "claude" | "opencode"} provider @param {string} sessionId */
+  /** @param {"codex" | "claude" | "kimi" | "opencode"} provider @param {string} sessionId */
   recordSession(provider, sessionId) {
     if (!SESSION_ID_PATTERN.test(sessionId)) return
     this.write({type: "session-available", provider, sessionId})
@@ -42,7 +42,7 @@ export class ActivityLog {
     closeSync(this.fileDescriptor)
   }
 
-  /** @param {{type: "workspace-selected", profile: string, repositoryRoot: string, revision: string, sourceIdentity: string} | {type: "provider-started", provider: "codex" | "claude" | "opencode", pid: number} | {type: "session-available", provider: "codex" | "claude" | "opencode", sessionId: string}} fact */
+  /** @param {{type: "workspace-selected", profile: string, repositoryRoot: string, revision: string, sourceIdentity: string} | {type: "provider-started", provider: "codex" | "claude" | "kimi" | "opencode", pid: number} | {type: "session-available", provider: "codex" | "claude" | "kimi" | "opencode", sessionId: string}} fact */
   write(fact) {
     if (this.closed) throw new Error("Activity log is closed")
     writeSync(this.fileDescriptor, `${JSON.stringify(fact)}\n`)

package/src/cli.js

@@ -15,12 +15,13 @@ import {resolveWorkspaceProfile} from "./workspace-profile.js"
 import {WorkerControl} from "./worker-control.js"
 import {EvidenceStore} from "./evidence-store.js"
 import {ContextBudgetMetrics} from "./context-budget-metrics.js"
-import {isolatedRuntimeClientFromEnvironment} from "./isolated-runtime-client.js"
+import {isolatedRuntimeClientFromEnvironment, kimiIsolatedRuntimeClientFromEnvironment} from "./isolated-runtime-client.js"
+import {kimiSessionEnvelopeId} from "./providers/kimi.js"
 import {validateRelayWriteProviderArguments} from "./relay-write.js"
 import {abortable} from "./absolute-deadline.js"
 import {NormalizedOutput} from "./normalized-output.js"
 
-const HELP = `Usage: threadwire run --provider <codex|claude|opencode> --target telegram:<chat-id> | telegram:<chat-id>:<thread-id>
+const HELP = `Usage: threadwire run --provider <codex|claude|kimi|opencode> --target telegram:<chat-id> | telegram:<chat-id>:<thread-id>
   [--process-number <positive-integer>] [--cwd <directory>]
   [--workspace-profile <name>]
   [--relay-write]
@@ -45,8 +46,9 @@ const HELP = `Usage: threadwire run --provider <codex|claude|opencode> --target
  *   evidenceStore?: EvidenceStore,
  *   evidenceOwnerScope?: {destinationId: string, runId: string},
  *   workerControlOptions?: Pick<ConstructorParameters<typeof WorkerControl>[0], "queueOptions">,
- *   workspaceProfileOperations?: import("./workspace-profile.js").WorkspaceProfileOperations
- *   isolatedRuntimeClient?: Pick<import("./isolated-runtime-client.js").IsolatedRuntimeClient, "preflight" | "run">
+ *   workspaceProfileOperations?: import("./workspace-profile.js").WorkspaceProfileOperations,
+ *   isolatedRuntimeClient?: Pick<import("./isolated-runtime-client.js").IsolatedRuntimeClient, "preflight" | "run">,
+ *   kimiIsolatedRuntimeClient?: Pick<import("./isolated-runtime-client.js").IsolatedRuntimeClient, "preflight" | "run">
  * }} MainDependencies
  */
 
@@ -112,6 +114,7 @@ export function parseArguments(arguments_) {
     throw new Error("--transcript and --activity-log must resolve to different paths")
   }
   if (parsed.relayWrite && parsed.workspaceProfile === undefined) throw new Error("--relay-write requires --workspace-profile")
+  if (parsed.provider === "kimi" && parsed.workspaceProfile === undefined) throw new Error("Kimi requires --workspace-profile")
   if (parsed.relayWrite && parsed.provider !== "codex") throw new Error("--relay-write is only supported for codex")
   return /** @type {ParsedArguments} */ (parsed)
 }
@@ -199,15 +202,18 @@ export async function main(arguments_, dependencies = {}) {
     const resolvedWorkspace = parsed.workspaceProfile === undefined
       ? undefined
       : await resolveWorkspaceProfile(
-        {provider: /** @type {"codex" | "claude" | "opencode"} */ (parsed.provider), profile: parsed.workspaceProfile},
+        {provider: /** @type {"codex" | "claude" | "kimi" | "opencode"} */ (parsed.provider), profile: parsed.workspaceProfile},
         dependencies.workspaceProfileOperations
       )
     if (validateOnly) return 0
-    const isolatedRuntimeClient = parsed.relayWrite
-      ? dependencies.isolatedRuntimeClient ?? isolatedRuntimeClientFromEnvironment(sourceEnvironment)
+    const usesIsolatedRuntime = parsed.relayWrite || parsed.provider === "kimi"
+    const isolatedRuntimeClient = usesIsolatedRuntime
+      ? parsed.provider === "kimi"
+        ? dependencies.kimiIsolatedRuntimeClient ?? kimiIsolatedRuntimeClientFromEnvironment(sourceEnvironment)
+        : dependencies.isolatedRuntimeClient ?? isolatedRuntimeClientFromEnvironment(sourceEnvironment)
       : undefined
-    const isolatedPreflight = parsed.relayWrite
-      ? await isolatedRuntimeClient?.preflight({
+    const isolatedPreflight = usesIsolatedRuntime
+      ? await /** @type {NonNullable<typeof isolatedRuntimeClient>} */ (isolatedRuntimeClient).preflight({
         provider: parsed.provider,
         profile: /** @type {string} */ (parsed.workspaceProfile),
         repositoryRoot: /** @type {import("./workspace-profile.js").ResolvedWorkspaceProfile} */ (resolvedWorkspace).repositoryRoot,
@@ -257,7 +263,7 @@ export async function main(arguments_, dependencies = {}) {
         parsed.providerArguments,
         prompt,
         parsed.resumeSession,
-        parsed.relayWrite ? {} : providerEnvironment
+        usesIsolatedRuntime ? {} : providerEnvironment
       )
       if (parsed.resumeSession !== undefined) admission.setContinuationHandle(parsed.resumeSession)
       if (parsed.workspaceProfile !== undefined) {
@@ -303,7 +309,7 @@ export async function main(arguments_, dependencies = {}) {
         },
         onRecord: (record) => {
           metrics.recordParsedProviderRecord("provider_stdout")
-          const id = provider.sessionId(record)
+          const id = parsed.provider === "kimi" ? kimiSessionEnvelopeId(record) : provider.sessionId(record)
           if (id !== undefined) {
             admission.setContinuationHandle(id)
             activity?.recordSession(provider.name, id)
@@ -322,7 +328,7 @@ export async function main(arguments_, dependencies = {}) {
           return evidence.append("provider-stderr", chunk).then(() => { evidencePayloadBytes += chunk.length })
         }
       }
-      const exitCode = parsed.relayWrite
+      const exitCode = usesIsolatedRuntime
         ? await /** @type {NonNullable<typeof isolatedRuntimeClient>} */ (isolatedRuntimeClient).run({
           preflightId: /** @type {{preflightId: string}} */ (isolatedPreflight).preflightId,
           prompt,
@@ -330,8 +336,8 @@ export async function main(arguments_, dependencies = {}) {
           ...(parsed.resumeSession === undefined ? {} : {resumeSession: parsed.resumeSession}),
           onEvent: workerOptions.onEvent,
           onRecord: /** @type {NonNullable<typeof workerOptions.onRecord>} */ (workerOptions.onRecord),
-          ...(workerOptions.onStdoutChunk === undefined ? {} : {onStdoutChunk: workerOptions.onStdoutChunk}),
-          ...(workerOptions.onStderrChunk === undefined ? {} : {onStderrChunk: workerOptions.onStderrChunk}),
+          ...(parsed.provider === "kimi" || workerOptions.onStdoutChunk === undefined ? {} : {onStdoutChunk: workerOptions.onStdoutChunk}),
+          ...(parsed.provider === "kimi" || workerOptions.onStderrChunk === undefined ? {} : {onStderrChunk: workerOptions.onStderrChunk}),
           ...(launchDeadline === undefined ? {} : {deadline: launchDeadline})
         })
         : await (dependencies.workerRunner ?? runWorker)(workerOptions)

package/src/isolated-runtime-client.js

@@ -121,6 +121,15 @@ export function isolatedRuntimeClientFromEnvironment(environment) {
   })
 }
 
+/** @param {NodeJS.ProcessEnv} environment */
+export function kimiIsolatedRuntimeClientFromEnvironment(environment) {
+  return new IsolatedRuntimeClient({
+    url: nonempty(environment.THREADWIRE_KIMI_ISOLATED_RUNTIME_URL, "THREADWIRE_KIMI_ISOLATED_RUNTIME_URL"),
+    controlToken: nonempty(environment.THREADWIRE_KIMI_ISOLATED_RUNTIME_CONTROL_TOKEN, "THREADWIRE_KIMI_ISOLATED_RUNTIME_CONTROL_TOKEN"),
+    timeoutMs: environment.THREADWIRE_ISOLATED_RUNTIME_CLIENT_TIMEOUT_MS
+  })
+}
+
 function normalizedUrl(value) {
   const url = new URL(value)
   if (url.protocol !== "http:" && url.protocol !== "https:") throw new Error("THREADWIRE_ISOLATED_RUNTIME_URL must use HTTP or HTTPS")