@stigmer/runner 3.11.0 → 3.12.0

package/src/__test-utils__/vitest-global-setup.ts

@@ -0,0 +1,50 @@
+/**
+ * Vitest globalSetup: refuse to run the suite on a Node that cannot run the
+ * runner.
+ *
+ * Why this exists: the durable checkpointer imports Node's built-in
+ * `node:sqlite` at module load time, so on a Node without it (below 22.13,
+ * or 23.0–23.3 — the 23.x line only gained it unflagged in 23.4) the
+ * sqlite-importing test files die at COLLECTION with a raw
+ * `ERR_UNKNOWN_BUILTIN_MODULE` while the rest of the suite grinds on
+ * (oss#257). globalSetup runs once in the main process before any file is
+ * collected, so the whole run fails immediately with the same actionable
+ * message the runner itself prints at boot (src/preflight.ts).
+ *
+ * Deliberately fails the WHOLE suite rather than skipping the sqlite tests:
+ * a Node that cannot load `node:sqlite` cannot run the runner at all, and a
+ * green-with-skips suite on such a Node would be a false signal. The gate is
+ * a capability probe, not a version check — on Nodes where the builtin is
+ * flag-gated (22.5–22.12, 23.0–23.3), `NODE_OPTIONS=--experimental-sqlite`
+ * satisfies the probe and the suite runs (vitest workers inherit
+ * NODE_OPTIONS, so the flag reaches every fork).
+ *
+ * Lives in src/__test-utils__/ so `tsc --noEmit` covers it (the dev tsconfig
+ * only includes src/) while tsconfig.build.json's exclusion keeps it out of
+ * dist/.
+ */
+
+import { preflightNodeRuntime } from "../preflight.js";
+
+/**
+ * Throw an actionable error when this Node cannot run the runner (and hence
+ * its test suite). The preflight message is reused verbatim — single source
+ * of the diagnosis, contract pinned by __tests__/preflight.test.ts — with a
+ * test-context fix hint appended (the check-runner-node Makefile idiom).
+ */
+export function assertNodeCanRunSuite(
+  preflight: () => string | null = preflightNodeRuntime,
+): void {
+  const failure = preflight();
+  if (failure === null) return;
+  throw new Error(
+    `${failure}\n` +
+      `  fix: nvm use (the repo's .nvmrc pins a supported Node), or on a Node\n` +
+      `  where node:sqlite is flag-gated (22.5-22.12, 23.0-23.3) run the suite\n` +
+      `  with NODE_OPTIONS=--experimental-sqlite.`,
+  );
+}
+
+export default function globalSetup(): void {
+  assertNodeCanRunSuite();
+}

package/src/__tests__/bootstrap.test.ts

@@ -161,6 +161,49 @@ describe("resolveRunnerBootstrap", () => {
     );
 
     expect(result.runnerAccessToken).toBeUndefined();
+    expect(result.payloadEncryption).toBeUndefined();
+  });
+
+  it("surfaces server-managed payload-encryption keys from the discovery branch", async () => {
+    const factory: BootstrapClientFactory = async () => ({
+      getRunnerBootstrapConfig: () =>
+        Promise.resolve({
+          temporalAddress: "t:7233",
+          temporalNamespace: "default",
+          payloadEncryption: {
+            key: "a".repeat(44),
+            keyId: "identity-key-v2",
+            secondaryKey: "b".repeat(44),
+            secondaryKeyId: "identity-key-v1",
+          },
+        }),
+    });
+
+    const result = await resolveRunnerBootstrap(
+      { token: "tok", stigmerEndpoint: "https://api.stigmer.ai" },
+      factory,
+    );
+
+    expect(result.payloadEncryption).toEqual({
+      key: "a".repeat(44),
+      keyId: "identity-key-v2",
+      secondaryKey: "b".repeat(44),
+      secondaryKeyId: "identity-key-v1",
+    });
+  });
+
+  it("omits payload-encryption keys when the server does not manage them", async () => {
+    const factory: BootstrapClientFactory = async () => ({
+      getRunnerBootstrapConfig: () =>
+        Promise.resolve({ temporalAddress: "t:7233", temporalNamespace: "default" }),
+    });
+
+    const result = await resolveRunnerBootstrap(
+      { token: "tok", stigmerEndpoint: "https://api.stigmer.ai" },
+      factory,
+    );
+
+    expect(result.payloadEncryption).toBeUndefined();
   });
 });
 

package/src/__tests__/encryption-codec.test.ts

@@ -195,6 +195,59 @@ describe("loadPayloadEncryptionConfig", () => {
     process.env.STIGMER_PAYLOAD_ENCRYPTION_KEY_ID = "k1";
     expect(() => loadPayloadEncryptionConfig()).toThrow(/must decode to 32 bytes/);
   });
+
+  // Server-managed key material from getRunnerBootstrapConfig (stigmer#398):
+  // desktop-class runners receive a per-identity key at bootstrap instead of
+  // env config. The env key is the operator's explicit choice and must win.
+  describe("bootstrap-delivered keys", () => {
+    const bootstrapKeys = () => ({
+      key: randomBytes(32).toString("base64"),
+      keyId: "identity-key-v1",
+      secondaryKey: randomBytes(32).toString("base64"),
+      secondaryKeyId: "identity-key-v0",
+    });
+
+    it("enables encryption from bootstrap material when no env key is set", () => {
+      const config = loadPayloadEncryptionConfig(bootstrapKeys());
+      expect(config?.primary.keyId).toBe("identity-key-v1");
+      expect(config?.primary.key.length).toBe(32);
+      expect(config?.secondary?.keyId).toBe("identity-key-v0");
+    });
+
+    it("env-configured key wins over bootstrap material", () => {
+      process.env.STIGMER_PAYLOAD_ENCRYPTION_KEY = randomBytes(32).toString("base64");
+      process.env.STIGMER_PAYLOAD_ENCRYPTION_KEY_ID = "env-key";
+
+      const config = loadPayloadEncryptionConfig(bootstrapKeys());
+      expect(config?.primary.keyId).toBe("env-key");
+      expect(config?.secondary).toBeUndefined();
+    });
+
+    it("fails the boot on a bootstrap key without its id (server contract violation)", () => {
+      expect(() =>
+        loadPayloadEncryptionConfig({ key: randomBytes(32).toString("base64") }),
+      ).toThrow(/payload_encryption_key_id/);
+    });
+
+    it("fails the boot on a malformed bootstrap key rather than running plaintext", () => {
+      expect(() =>
+        loadPayloadEncryptionConfig({
+          key: randomBytes(16).toString("base64"),
+          keyId: "identity-key-v1",
+        }),
+      ).toThrow(/must decode to 32 bytes/);
+    });
+
+    it("fails the boot on a bootstrap secondary key without its id", () => {
+      expect(() =>
+        loadPayloadEncryptionConfig({
+          key: randomBytes(32).toString("base64"),
+          keyId: "identity-key-v1",
+          secondaryKey: randomBytes(32).toString("base64"),
+        }),
+      ).toThrow(/payload_encryption_secondary_key_id/);
+    });
+  });
 });
 
 describe("cross-language conformance fixture", () => {

package/src/__tests__/preflight.test.ts

@@ -11,6 +11,7 @@
  *   the desktop Run dialog via the IPC handshake.
  */
 
+import { readFileSync } from "node:fs";
 import { afterEach, describe, expect, it, vi } from "vitest";
 import {
   isNodeSqliteAvailable,
@@ -42,6 +43,20 @@ describe("preflightNodeRuntime", () => {
     // case BOTH sides must report unsupported.
     expect(preflightNodeRuntime() === null).toBe(isNodeSqliteAvailable());
   });
+
+  it("package.json engines matches the floors this preflight documents", () => {
+    // The published engines range and the preflight message describe the same
+    // two floors (node:sqlite is unflagged from 22.13 in the 22.x line and
+    // only from 23.4 after that). engines is the only one of the two that a
+    // future edit can silently loosen — `>=22.13` once re-admitted the
+    // 23.0–23.3 gap (oss#257) — so pin it byte-for-byte to the range that
+    // excludes that gap. If the floors genuinely move, update the preflight
+    // message, this pin, and package.json together.
+    const pkg = JSON.parse(
+      readFileSync(new URL("../../package.json", import.meta.url), "utf8"),
+    ) as { engines: { node: string } };
+    expect(pkg.engines.node).toBe("^22.13.0 || >=23.4.0");
+  });
 });
 
 describe("assertLlmBackendsPreflight", () => {

package/src/activities/__tests__/discover-mcp-server.test.ts

@@ -416,7 +416,45 @@ describe("DiscoverMcpServer activity", () => {
       );
 
       expect(result.tools).toEqual([]);
-      expect(mockClient.getExecutionContextByExecutionId).toHaveBeenCalledWith("ctx-abc");
+      // No payload-carried token -> the read goes out without a per-call
+      // credential (the cloud shape, where the ambient credential applies).
+      expect(mockClient.getExecutionContextByExecutionId).toHaveBeenCalledWith("ctx-abc", undefined);
+    });
+
+    it("presents the payload-carried EC token on the ExecutionContext read (oss#535)", async () => {
+      const { discoverMcpServer } = await import("../discover-mcp-server.js");
+
+      const mockClient = makeMockStigmerClient({
+        mcpServer: makeMcpServer({
+          metadata: { slug: "with-token" },
+          spec: makeStdioSpec("npx", ["server"]),
+        }),
+        executionContext: {
+          spec: {
+            data: {
+              API_KEY: { value: "secret-123", isSecret: true },
+            },
+          },
+        },
+      });
+
+      const mockMcpClient = makeMockMcpClient({ tools: [] });
+      mockInitializeConnections.mockResolvedValue({});
+      mockGetClient.mockResolvedValue(mockMcpClient);
+
+      await discoverMcpServer(
+        {
+          mcpServerId: "mcp-env",
+          executionContextId: "ctx-abc",
+          executionContextToken: "scoped-ec-token",
+        },
+        { stigmerClient: mockClient as any, transportPosture: "stdio-allowed" },
+      );
+
+      expect(mockClient.getExecutionContextByExecutionId).toHaveBeenCalledWith(
+        "ctx-abc",
+        "scoped-ec-token",
+      );
     });
 
     it("discovers a caller-identity-templating server via the anonymous sentinel", async () => {

package/src/activities/__tests__/error-classifier.test.ts

@@ -7,7 +7,13 @@
  */
 
 import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
-import { synthesizeError, formatClassifiedError, shouldRetryWithFreshAgent } from "../execute-cursor/error-classifier.js";
+import {
+  synthesizeError,
+  formatClassifiedError,
+  shouldRetryWithFreshAgent,
+  DETAIL_FREE_FALLBACK_USER_PREFIX,
+  TRANSPORT_TIMEOUT_USER_PREFIX,
+} from "../execute-cursor/error-classifier.js";
 
 describe("synthesizeError", () => {
   let consoleLogSpy: ReturnType<typeof vi.spyOn>;
@@ -213,7 +219,7 @@ describe("synthesizeError", () => {
 
     expect(result.category).toBe("unknown");
     expect(result.source).toBe("fallback");
-    expect(result.message).toContain("no detail from SDK");
+    expect(result.message).toContain(DETAIL_FREE_FALLBACK_USER_PREFIX);
     expect(result.message).toContain("claude-sonnet-4");
   });
 
@@ -261,6 +267,92 @@ describe("synthesizeError", () => {
     expect(result.message).toContain("agentId=agent-123");
   });
 
+  // The exact prod shape from oss#492: the Composer 2.5 capacity incident
+  // rejected every run with a bare { status: "error" } — all five detail
+  // channels empty, fresh agent (the poisoned-handle retry produces this
+  // same shape with isResumedHandle: false). End users read this message
+  // verbatim in embedded surfaces, so it must lead with actionable copy,
+  // keep the diagnostic parenthetical for operators, and be retryable
+  // (provider capacity is transient).
+  it("detail-free failure on a fresh agent leads with user-facing copy and is retryable (oss#492)", () => {
+    const result = synthesizeError({
+      sdkError: undefined,
+      sdkResultFields: undefined,
+      streamErrorMessage: undefined,
+      capturedRejection: undefined,
+      conversationErrorText: undefined,
+      isResumedHandle: false,
+      fallbackContext: { model: "composer-2.5", mode: "local", agentId: "agent-abc" },
+    });
+
+    expect(result.category).toBe("unknown");
+    expect(result.source).toBe("fallback");
+    expect(result.retryable).toBe(true);
+    expect(result.message.startsWith(DETAIL_FREE_FALLBACK_USER_PREFIX)).toBe(true);
+    // Diagnostic context survives for operators (and the env integration
+    // test's Model= matcher).
+    expect(result.message).toContain("Model=composer-2.5");
+    expect(result.message).toContain("mode=local");
+    expect(result.message).toContain("agentId=agent-abc");
+  });
+
+  // sdk-react's isInterruptedError reframes any error containing the phrase
+  // "retry or resume" as a neutral resumable notice instead of a failure
+  // alert. A capacity failure must render as a failure — guard the copy
+  // (formatted end-to-end, tail included) against ever matching that regex.
+  it("user-facing fallback copy never trips the sdk-react interrupted-error reframe", () => {
+    const interruptedReframe = /\[StallTimeoutError\]|execution interrupted|retry or resume/i;
+    for (const prefix of [DETAIL_FREE_FALLBACK_USER_PREFIX, TRANSPORT_TIMEOUT_USER_PREFIX]) {
+      expect(prefix).not.toMatch(interruptedReframe);
+    }
+    const formatted = formatClassifiedError(synthesizeError({
+      sdkResultFields: undefined,
+      streamErrorMessage: undefined,
+      capturedRejection: undefined,
+      isResumedHandle: false,
+      fallbackContext,
+    }));
+    expect(formatted).not.toMatch(interruptedReframe);
+  });
+
+  // ---------------------------------------------------------------------------
+  // Transport-timeout heuristic (0 messages, ~default SDK timeout)
+  // ---------------------------------------------------------------------------
+
+  it("classifies a 0-message ~30s failure as retryable network with user-facing copy", () => {
+    const result = synthesizeError({
+      sdkResultFields: undefined,
+      streamErrorMessage: undefined,
+      capturedRejection: undefined,
+      isResumedHandle: false,
+      fallbackContext,
+      durationMs: 30012,
+      messageCount: 0,
+    });
+
+    expect(result.category).toBe("network");
+    expect(result.source).toBe("fallback");
+    expect(result.retryable).toBe(true);
+    expect(result.message.startsWith(TRANSPORT_TIMEOUT_USER_PREFIX)).toBe(true);
+    expect(result.message).toContain("30012ms");
+    expect(result.message).toContain("Model=claude-sonnet-4");
+  });
+
+  it("does not apply the transport heuristic outside the default-timeout window", () => {
+    const result = synthesizeError({
+      sdkResultFields: undefined,
+      streamErrorMessage: undefined,
+      capturedRejection: undefined,
+      isResumedHandle: false,
+      fallbackContext,
+      durationMs: 120000,
+      messageCount: 0,
+    });
+
+    expect(result.category).toBe("unknown");
+    expect(result.message.startsWith(DETAIL_FREE_FALLBACK_USER_PREFIX)).toBe(true);
+  });
+
   // ---------------------------------------------------------------------------
   // Source priority
   // ---------------------------------------------------------------------------

package/src/activities/__tests__/run-command.test.ts

@@ -0,0 +1,221 @@
+/**
+ * Env contract tests for the workflow `run` task (oss#384).
+ *
+ * These spawn REAL subprocesses through the RunShell / RunScript
+ * activities and inspect the environment the child actually received —
+ * the leak-reproduction style established by the #256 fix (PR #383).
+ * Subprocess output is env variable NAMES only, never values.
+ */
+
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { createRunCommandActivities } from "../run-command.js";
+import { buildRunEnv, RUN_ENV_BASE_KEYS } from "../run-env.js";
+import { RuntimePlaceholderResolutionError } from "../../workflow-engine/resolve.js";
+
+/**
+ * Credentials planted into the runner process env before each test.
+ * Includes a name outside every known denylist to prove the contract
+ * is declare-to-receive, not deny-known-names.
+ */
+const PLANTED_SENTINELS: Record<string, string> = {
+  STIGMER_RUNNER_HITL_SECRET: "sentinel-hitl",
+  STIGMER_TOKEN: "sentinel-token",
+  CURSOR_API_KEY: "sentinel-cursor",
+  ANTHROPIC_API_KEY: "sentinel-anthropic",
+  OPERATOR_PRIVATE_CREDENTIAL: "sentinel-arbitrary",
+};
+
+const PRINT_ENV_KEYS_SHELL = `node -p 'JSON.stringify(Object.keys(process.env))'`;
+const PRINT_ENV_KEYS_SCRIPT = `console.log(JSON.stringify(Object.keys(process.env)))`;
+
+const activities = createRunCommandActivities();
+
+async function childEnvKeysViaShell(
+  environment?: Record<string, string>,
+  runtimeEnv: Record<string, unknown> = {},
+): Promise<string[]> {
+  const stdout = await activities.RunShell({
+    mode: "shell",
+    command: PRINT_ENV_KEYS_SHELL,
+    environment,
+    runtimeEnv,
+  });
+  return JSON.parse(String(stdout)) as string[];
+}
+
+async function childEnvKeysViaScript(
+  environment?: Record<string, string>,
+  runtimeEnv: Record<string, unknown> = {},
+): Promise<string[]> {
+  const stdout = await activities.RunScript({
+    mode: "script",
+    language: "js",
+    code: PRINT_ENV_KEYS_SCRIPT,
+    environment,
+    runtimeEnv,
+  });
+  return JSON.parse(String(stdout)) as string[];
+}
+
+describe("run task env contract (oss#384)", () => {
+  const saved: Record<string, string | undefined> = {};
+
+  beforeEach(() => {
+    for (const [key, value] of Object.entries(PLANTED_SENTINELS)) {
+      saved[key] = process.env[key];
+      process.env[key] = value;
+    }
+  });
+
+  afterEach(() => {
+    for (const key of Object.keys(PLANTED_SENTINELS)) {
+      if (saved[key] === undefined) {
+        delete process.env[key];
+      } else {
+        process.env[key] = saved[key];
+      }
+    }
+  });
+
+  describe("RunShell", () => {
+    it("does not leak runner process credentials to the child", async () => {
+      const keys = await childEnvKeysViaShell();
+
+      for (const sentinel of Object.keys(PLANTED_SENTINELS)) {
+        expect(keys, `runner credential "${sentinel}" leaked to shell child`)
+          .not.toContain(sentinel);
+      }
+    });
+
+    it("provides the minimal base env and the declared overlay", async () => {
+      const keys = await childEnvKeysViaShell({ DECLARED_VAR: "value" });
+
+      for (const base of RUN_ENV_BASE_KEYS) {
+        if (process.env[base] !== undefined) {
+          expect(keys, `base key "${base}" missing from shell child`).toContain(base);
+        }
+      }
+      expect(keys).toContain("DECLARED_VAR");
+    });
+
+    it("resolves ${.secrets.KEY} placeholders in declared values just-in-time", async () => {
+      const stdout = await activities.RunShell({
+        mode: "shell",
+        command: `node -p 'process.env.API_KEY'`,
+        environment: { API_KEY: "${.secrets.TEST_API_KEY}" },
+        runtimeEnv: { TEST_API_KEY: "resolved-secret-value" },
+      });
+
+      expect(stdout).toBe("resolved-secret-value");
+    });
+
+    it("fails non-retryably, naming the variable, when a placeholder key is missing", async () => {
+      await expect(
+        activities.RunShell({
+          mode: "shell",
+          command: "true",
+          environment: { API_KEY: "${.secrets.NOT_PROVIDED}" },
+          runtimeEnv: {},
+        }),
+      ).rejects.toMatchObject({
+        nonRetryable: true,
+        type: "RUN_ENV_UNRESOLVED_PLACEHOLDER",
+        message: expect.stringContaining("NOT_PROVIDED"),
+      });
+    });
+  });
+
+  describe("RunScript", () => {
+    it("does not leak runner process credentials to the child", async () => {
+      const keys = await childEnvKeysViaScript();
+
+      for (const sentinel of Object.keys(PLANTED_SENTINELS)) {
+        expect(keys, `runner credential "${sentinel}" leaked to script child`)
+          .not.toContain(sentinel);
+      }
+    });
+
+    it("provides the minimal base env and the declared overlay", async () => {
+      const keys = await childEnvKeysViaScript({ DECLARED_VAR: "value" });
+
+      for (const base of RUN_ENV_BASE_KEYS) {
+        if (process.env[base] !== undefined) {
+          expect(keys, `base key "${base}" missing from script child`).toContain(base);
+        }
+      }
+      expect(keys).toContain("DECLARED_VAR");
+    });
+
+    it("resolves ${.env_vars.KEY} placeholders in declared values just-in-time", async () => {
+      const stdout = await activities.RunScript({
+        mode: "script",
+        language: "js",
+        code: "console.log(process.env.REGION)",
+        environment: { REGION: "${.env_vars.DEPLOY_REGION}" },
+        runtimeEnv: { DEPLOY_REGION: "us-east-1" },
+      });
+
+      expect(stdout).toBe("us-east-1");
+    });
+  });
+});
+
+describe("buildRunEnv", () => {
+  it("copies only the base keys present in the runner env", () => {
+    const base = {
+      PATH: "/usr/bin",
+      HOME: "/home/runner",
+      TERM: "xterm",
+    };
+
+    const env = buildRunEnv(undefined, {}, base);
+
+    expect(env).toEqual({ PATH: "/usr/bin", HOME: "/home/runner", TERM: "xterm" });
+  });
+
+  it("never copies undeclared runner variables — the oss#384 tripwire", () => {
+    // Guards against a future reintroduction of `{ ...process.env }`:
+    // credentials must be structurally absent, whatever their names.
+    const base = {
+      PATH: "/usr/bin",
+      STIGMER_RUNNER_HITL_SECRET: "secret",
+      ANY_FUTURE_CREDENTIAL: "secret",
+    };
+
+    const env = buildRunEnv({ DECLARED: "yes" }, {}, base);
+
+    expect(Object.keys(env).sort()).toEqual(["DECLARED", "PATH"]);
+  });
+
+  it("lets a declared variable override a base variable", () => {
+    const base = { PATH: "/usr/bin" };
+
+    const env = buildRunEnv({ PATH: "/custom/bin" }, {}, base);
+
+    expect(env.PATH).toBe("/custom/bin");
+  });
+
+  it("passes non-placeholder declared values through untouched", () => {
+    const env = buildRunEnv(
+      { LITERAL: "plain-value", TEMPLATED: "prefix-${.secrets.KEY}-suffix" },
+      { KEY: "mid" },
+      {},
+    );
+
+    expect(env.LITERAL).toBe("plain-value");
+    expect(env.TEMPLATED).toBe("prefix-mid-suffix");
+  });
+
+  it("throws a named error for a missing placeholder key", () => {
+    expect(() =>
+      buildRunEnv({ API_KEY: "${.secrets.MISSING}" }, {}, {}),
+    ).toThrowError(RuntimePlaceholderResolutionError);
+
+    try {
+      buildRunEnv({ API_KEY: "${.secrets.MISSING}" }, {}, {});
+    } catch (err) {
+      expect((err as RuntimePlaceholderResolutionError).variableName).toBe("MISSING");
+      expect((err as Error).message).toContain('environment "API_KEY"');
+    }
+  });
+});

package/src/activities/discover-mcp-server.ts

@@ -81,6 +81,13 @@ const PLATFORM_INJECTABLE_MAP: Record<string, string> = {
 export interface DiscoverMcpServerInput {
   mcpServerId: string;
   executionContextId?: string | null;
+  /**
+   * Execution-scoped token unlocking the connect EC's decrypted credentials
+   * (oss#535). Minted by the OSS handler and carried with the work item —
+   * discovery has no execution of its own to exchange for one. Absent on
+   * cloud, where the ambient connect_sandbox credential decrypts.
+   */
+  executionContextToken?: string | null;
   invokerIdentityAccountId?: string | null;
 }
 
@@ -280,7 +287,7 @@ export async function discoverMcpServer(
   input: DiscoverMcpServerInput,
   deps: DiscoverDeps,
 ): Promise<DiscoverMcpServerOutput> {
-  const { mcpServerId, executionContextId } = input;
+  const { mcpServerId, executionContextId, executionContextToken } = input;
   const { stigmerClient } = deps;
 
   console.log(
@@ -301,6 +308,7 @@ export async function discoverMcpServer(
   const envVars = await resolveEnvVarsForDiscovery(
     stigmerClient,
     executionContextId ?? null,
+    executionContextToken ?? null,
     slug,
     declaredEnv,
   );
@@ -382,6 +390,7 @@ export async function discoverMcpServer(
 async function resolveEnvVarsForDiscovery(
   client: StigmerClient,
   executionContextId: string | null,
+  executionContextToken: string | null,
   slug: string,
   declaredEnv: Record<string, EnvVarDeclaration>,
 ): Promise<Record<string, string>> {
@@ -394,7 +403,12 @@ async function resolveEnvVarsForDiscovery(
 
   let execCtx: Awaited<ReturnType<typeof client.getExecutionContextByExecutionId>>;
   try {
-    execCtx = await client.getExecutionContextByExecutionId(executionContextId);
+    // The payload-carried token authenticates the read on OSS (oss#535);
+    // undefined on cloud, where the ambient credential applies instead.
+    execCtx = await client.getExecutionContextByExecutionId(
+      executionContextId,
+      executionContextToken ?? undefined,
+    );
   } catch (err) {
     const cause = err instanceof Error ? err.message : String(err);
     if (credentialsExpected) {