@stigmer/runner 3.11.0 → 3.12.0

package/src/shared/model-client.ts

@@ -55,10 +55,27 @@ export interface BuildChatModelOptions {
    * stays the caller's decision to avoid silently changing behavior.
    */
   readonly maxTokens?: number;
+  /**
+   * Per-request bound. When omitted, defaults to the operator's
+   * STIGMER_LLM_REQUEST_TIMEOUT_MS — resolved HERE, not per caller, so no
+   * call site can drop the bound by forgetting to plumb it (the sub-agent
+   * factory did exactly that; stigmer/stigmer#468). An explicit value wins.
+   */
   readonly timeoutMs?: number;
   readonly maxRetries?: number;
 }
 
+/**
+ * The operator's request-timeout bound. Only a positive integer means
+ * "bound the request" — unset, non-numeric, zero, and negative all
+ * normalize to no bound. Deployment-static env, read here the same way
+ * provider API keys are.
+ */
+function resolveDefaultTimeoutMs(): number | undefined {
+  const parsed = Number.parseInt(process.env.STIGMER_LLM_REQUEST_TIMEOUT_MS ?? "", 10);
+  return parsed > 0 ? parsed : undefined;
+}
+
 export interface BuiltChatModel {
   readonly model: BaseChatModel;
   readonly provider: LlmProvider;
@@ -82,6 +99,7 @@ export async function buildChatModel(opts: BuildChatModelOptions): Promise<Built
   const resolved = await resolveToApiModelId(opts.modelName);
   const provider = inferProvider(resolved);
   const apiModelId = stripProviderPrefix(resolved);
+  const timeoutMs = opts.timeoutMs ?? resolveDefaultTimeoutMs();
 
   // Backend precedence by construction: a proxied call never consults the
   // backend var — the proxy owns provider routing (the factories' preflight
@@ -201,7 +219,7 @@ export async function buildChatModel(opts: BuildChatModelOptions): Promise<Built
     temperature: opts.temperature ?? 0,
     apiKey,
     ...(maxTokens ? { maxTokens } : {}),
-    ...(opts.timeoutMs ? { maxRetries: opts.maxRetries ?? 0 } : {}),
+    ...(timeoutMs ? { maxRetries: opts.maxRetries ?? 0 } : {}),
   };
 
   // The request timeout lives in a different slot per wrapper: ChatOpenAI
@@ -215,7 +233,7 @@ export async function buildChatModel(opts: BuildChatModelOptions): Promise<Built
   // that is LangChain's own retry knob, distinct from the SDK-level
   // maxRetries the factories receive.
   const anthropicClientOptions = {
-    ...(opts.timeoutMs ? { timeout: opts.timeoutMs } : {}),
+    ...(timeoutMs ? { timeout: timeoutMs } : {}),
     ...(baseUrl ? { baseURL: baseUrl } : {}),
     ...(headers ? { defaultHeaders: headers } : {}),
   };
@@ -231,7 +249,7 @@ export async function buildChatModel(opts: BuildChatModelOptions): Promise<Built
     ? new ChatOpenAI({
         model: apiModelId,
         ...common,
-        ...(opts.timeoutMs ? { timeout: opts.timeoutMs } : {}),
+        ...(timeoutMs ? { timeout: timeoutMs } : {}),
         ...(baseUrl || headers
           ? {
               configuration: {

package/src/shared/model-pricing-data.ts

@@ -30,9 +30,18 @@ interface RegistryEntry {
   };
 }
 
-import { resolveModelRegistryUrl, buildRegistryHeaders } from "./registry-endpoint.js";
+import {
+  resolveModelRegistryUrl,
+  buildRegistryHeaders,
+  REGISTRY_RETRY_POLICY,
+} from "./registry-endpoint.js";
+import { fetchWithRetry } from "./http-retry.js";
 
 const CACHE_TTL_MS = 3_600_000;
+// Failed fetches are cached much shorter than successes (the model-registry.ts
+// policy): a transient failure must not pin DEFAULT_PRICING — wrong rates for
+// cost tracking — for a full hour.
+const FAILURE_CACHE_TTL_MS = 60_000;
 
 export const DEFAULT_PRICING: ModelPricing = {
   model: "unknown",
@@ -66,7 +75,11 @@ function parsePricingTable(json: unknown): ModelPricing[] {
 }
 
 async function fetchFromApi(): Promise<readonly ModelPricing[]> {
-  const res = await fetch(resolveModelRegistryUrl(), { headers: buildRegistryHeaders() });
+  const res = await fetchWithRetry(
+    resolveModelRegistryUrl(),
+    { headers: buildRegistryHeaders() },
+    REGISTRY_RETRY_POLICY,
+  );
   if (!res.ok) throw new Error(`Model registry fetch failed: ${res.status}`);
   const data: unknown = await res.json();
   const table = parsePricingTable(data);
@@ -93,7 +106,7 @@ export async function getPricingTable(): Promise<readonly ModelPricing[]> {
         `Failed to fetch model registry, using default pricing: ${err}`,
       );
       const fallback = [DEFAULT_PRICING];
-      cache = { data: fallback, expiresAt: Date.now() + CACHE_TTL_MS };
+      cache = { data: fallback, expiresAt: Date.now() + FAILURE_CACHE_TTL_MS };
       return fallback;
     })
     .finally(() => {
@@ -102,3 +115,9 @@ export async function getPricingTable(): Promise<readonly ModelPricing[]> {
 
   return inflightFetch;
 }
+
+/** Exposed for testing — resets the in-memory cache. */
+export function _resetPricingCache(): void {
+  cache = null;
+  inflightFetch = null;
+}

package/src/shared/model-registry.ts

@@ -10,7 +10,12 @@
  * (getModelVisionCapability).
  */
 
-import { resolveModelRegistryUrl, buildRegistryHeaders } from "./registry-endpoint.js";
+import {
+  resolveModelRegistryUrl,
+  buildRegistryHeaders,
+  REGISTRY_RETRY_POLICY,
+} from "./registry-endpoint.js";
+import { fetchWithRetry } from "./http-retry.js";
 
 const CACHE_TTL_MS = 3_600_000;
 // Failed fetches are cached much shorter than successes: a transient failure
@@ -68,7 +73,7 @@ function parseVisionCapability(capabilities: unknown): boolean | undefined {
 
 async function fetchRegistry(): Promise<readonly RegistryModel[]> {
   const url = resolveModelRegistryUrl();
-  const res = await fetch(url, { headers: buildRegistryHeaders() });
+  const res = await fetchWithRetry(url, { headers: buildRegistryHeaders() }, REGISTRY_RETRY_POLICY);
   if (!res.ok) throw new Error(`Model registry fetch failed: ${res.status}`);
   const data: unknown = await res.json();
   return parseRegistry(data);

package/src/shared/plan-mode-permissions.ts

@@ -16,6 +16,13 @@
  * (issue #255). Kept as its own side-effect-free module so tests can pin the
  * production rules without dragging in setup.ts's import graph.
  *
+ * Rules travel with a companion: every graph that carries them also installs
+ * the path-normalization middleware (middleware/path-normalization.ts,
+ * issue #429), because deepagents' rule validation refuses workspace-relative
+ * paths outright — without the shim, prompt-compliant relative READS die in
+ * validation instead of just working. Both are derived from the same
+ * expression at each composition site so they cannot drift apart.
+ *
  * Invariant: never combine these rules with a shell-capable (sandbox)
  * backend — deepagents rejects that pairing at graph construction (see the
  * cas-capture-backend.ts header). Plan mode guarantees it by construction:

package/src/shared/registry-endpoint.ts

@@ -20,10 +20,37 @@
  */
 
 import { normalizeEndpoint } from "../config.js";
+import type { FetchRetryPolicy } from "./http-retry.js";
 
 /** Default local stigmer-server origin — mirrors config.ts's local-mode default. */
 const DEFAULT_LOCAL_BACKEND = "http://localhost:7234";
 
+/**
+ * Shared retry policy for the three registry fetch clients (model-registry.ts
+ * and both model-pricing-data.ts modules) — stigmer/stigmer#468.
+ *
+ * The timeout is the load-bearing half: each consumer deduplicates callers
+ * through a single in-flight promise, so one hung fetch strands every
+ * concurrent caller behind it — model-registry.ts's sits in front of every
+ * LLM client build. 10 s (not the checkpointer's 30 s) because the response
+ * is a small JSON document and the callers degrade gracefully; what they must
+ * never do is wait forever.
+ *
+ * The retry half matters because the degrade is not free: a failed registry
+ * fetch is cached (60 s empty registry → unresolved model ids that 404 at the
+ * provider; pricing falls back to defaults), so a budget spanning a
+ * pod-restart reroute converts that poisoned window into ~1.75 s of backoff.
+ * Worst case fully bounded: ~31 s of cold-cache stall when the control plane
+ * is genuinely down, versus an infinite hang before #468.
+ */
+export const REGISTRY_RETRY_POLICY: FetchRetryPolicy = {
+  label: "registry-endpoint",
+  baseDelayMs: 250,
+  backoffFactor: 2,
+  maxRetries: 3,
+  requestTimeoutMs: 10_000,
+};
+
 /**
  * Resolve the base URL (origin, no path) for model-registry and pricing
  * fetches. See module doc for the tier order.

package/src/shared/runner-credential-keys.ts

@@ -0,0 +1,46 @@
+/**
+ * Env var names of the runner's own credentials — the single source of truth
+ * for every surface that isolates agent-spawned processes from the runner's
+ * process env (issue #385).
+ *
+ * Inclusion rule: a name belongs here iff the runner reads it from its own
+ * `process.env` to authenticate the runner's own outbound calls. User-supplied
+ * credentials resolved from ExecutionContext (e.g. GITHUB_TOKEN, read only
+ * from mergedEnvVars) must NEVER be listed — the ExecutionContext overlay is
+ * their sanctioned delivery channel, and denying them here would break it.
+ *
+ * Consumers:
+ * - shell-env.ts: SHELL_ENV_DENYLIST for the native harness `execute` tool.
+ * - mcp-manager.test.ts: leak-tripwire canaries for MCP stdio subprocesses
+ *   (that path passes NO runner env by construction; the test plants these
+ *   names to prove none leak through).
+ *
+ * Ambient cloud-SDK chain vars (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY,
+ * GOOGLE_APPLICATION_CREDENTIALS, ...) are deliberately absent: they are
+ * dual-use on local runners (operators expect agent shells to keep their
+ * ambient aws/gcloud auth), and on a local backend the shell can read the
+ * credential files off disk regardless (owner ruling on #385).
+ */
+export const RUNNER_CREDENTIAL_ENV_KEYS: readonly string[] = [
+  // Derives HITL approval fingerprints (fingerprint-secret.ts) — an agent
+  // that reads this could forge approval receipts.
+  "STIGMER_RUNNER_HITL_SECRET",
+  // Stigmer control-plane auth (config.ts; rotated at runtime by
+  // runner-manager.ts). Executions receive theirs via ExecutionContext.
+  "STIGMER_TOKEN",
+  // Fallback bearer token for model-registry/pricing fetches when
+  // STIGMER_TOKEN is unset (registry-endpoint.ts).
+  "STIGMER_AUTH_TOKEN",
+  // Cursor harness credential (config.ts) — agent-spawned processes never
+  // need direct Cursor API access.
+  "CURSOR_API_KEY",
+  // Direct-mode Anthropic key for the native harness (model-client.ts).
+  "ANTHROPIC_API_KEY",
+  // Direct-mode OpenAI key for the native harness (model-client.ts).
+  "OPENAI_API_KEY",
+  // Azure AI Foundry backend key (model-client.ts).
+  "ANTHROPIC_FOUNDRY_API_KEY",
+  // Bedrock backend bearer credential, read by the AWS SDK's chain
+  // (llm-backend.ts documents it as a supported auth path).
+  "AWS_BEARER_TOKEN_BEDROCK",
+];

package/src/shared/synthesized-attachment.ts

@@ -1,8 +1,8 @@
 /**
  * Shared mechanics of runner-synthesized MCP attachments — the pieces
- * the datastore records attachment (T05) and the channel messaging
- * attachment (proactive-messaging DD-006 D8) have in common, extracted
- * when the second attachment arrived.
+ * the channel messaging attachment (proactive-messaging DD-006 D8) and
+ * the conversation participation attachment (DD-008 D-c) have in
+ * common, extracted when the second attachment arrived.
  *
  * A synthesized attachment is a first-party MCP server entry the runner
  * builds itself (no McpServer resource, no Environment, no credential in
@@ -44,7 +44,7 @@ export interface SynthesizedAttachmentOptions {
  * Inject a synthesized attachment into a resolved server list — AFTER
  * resolve + backfill (see the module header). A user server shadowing
  * the reserved slug is replaced, loudly; `label` names the attachment
- * in that warning (e.g. "datastore records").
+ * in that warning (e.g. "channel messaging").
  */
 export function injectSynthesizedAttachment(
   resolvedServers: ResolvedMcpServer[],

package/src/workflow-engine/__tests__/tasks/emit-event.test.ts

@@ -1,32 +1,34 @@
 import { describe, it, expect, vi, afterEach, beforeEach } from "vitest";
-import { emitEventAction, type EmitEventConfig } from "../../../activities/emit-event.js";
-
-// ─── Temporal signal-delivery mocks ──────────────────────────────────────────
-// deliverSignal dynamically imports @temporalio/client and resolves the cluster
-// coordinates through loadConfig(). We mock both so the signal path is testable
-// without a live Temporal server, and so we can assert which address it dials.
-const mockConnect = vi.fn(async (_opts: { address: string }) => ({}));
-const mockSignal = vi.fn(async () => undefined);
-const mockGetHandle = vi.fn((_id: string) => ({ signal: mockSignal }));
-const mockClientCtor = vi.fn((_opts: { connection: unknown; namespace: string }) => ({
-  workflow: { getHandle: mockGetHandle },
+import { emitEventAction, type EmitEventConfig, type SignalDeliveryTarget } from "../../../activities/emit-event.js";
+
+// ─── Server-mediated signal-delivery mocks ───────────────────────────────────
+// deliverSignal routes through StigmerClient.sendWorkflowSignal (the server's
+// SendSignal lane — oss#517). We mock the client so the signal path is testable
+// without a live server, and so we can assert the addressing, the bounded call
+// timeout, and the best-effort delivery_errors contract.
+const mockSendWorkflowSignal = vi.fn(async (
+  _executionId: string,
+  _signalName: string,
+  _payload: unknown,
+  _options?: { timeoutMs?: number },
+) => ({}));
+const mockClientCtor = vi.fn((_opts: { endpoint: string; token?: string | null }) => ({
+  sendWorkflowSignal: mockSendWorkflowSignal,
 }));
 
-vi.mock("@temporalio/client", () => ({
-  Connection: { connect: (opts: { address: string }) => mockConnect(opts) },
-  Client: vi.fn().mockImplementation((opts: { connection: unknown; namespace: string }) =>
-    mockClientCtor(opts),
+vi.mock("../../../client/stigmer-client.js", () => ({
+  StigmerClient: vi.fn().mockImplementation(
+    (opts: { endpoint: string; token?: string | null }) => mockClientCtor(opts),
   ),
 }));
 
-// Mutable so each test can vary what config.ts resolves. Mirrors the real
-// resolution where temporalAddress comes from TEMPORAL_SERVICE_ADDRESS.
-let mockTemporalAddress = "localhost:7233";
-let mockTemporalNamespace = "default";
+// Mutable so each test can vary what config.ts resolves. deliverSignal builds
+// its client from the canonical stigmerBackendEndpoint resolution.
+let mockBackendEndpoint = "http://localhost:7234";
 vi.mock("../../../config.js", () => ({
   loadConfig: () => ({
-    temporalAddress: mockTemporalAddress,
-    temporalNamespace: mockTemporalNamespace,
+    stigmerBackendEndpoint: mockBackendEndpoint,
+    stigmerToken: null,
   }),
 }));
 
@@ -260,63 +262,139 @@ describe("emitEventAction", () => {
     });
   });
 
-  describe("signal delivery (Temporal coordinates from config)", () => {
+  describe("signal delivery (server-mediated SendSignal lane)", () => {
     beforeEach(() => {
-      mockConnect.mockClear();
-      mockSignal.mockClear();
-      mockGetHandle.mockClear();
+      mockSendWorkflowSignal.mockClear();
       mockClientCtor.mockClear();
-      mockSignal.mockResolvedValue(undefined);
-      mockTemporalAddress = "localhost:7233";
-      mockTemporalNamespace = "default";
+      mockSendWorkflowSignal.mockResolvedValue({});
+      mockBackendEndpoint = "http://localhost:7234";
     });
 
-    it("dials the Temporal address resolved by config, not a hardcoded localhost", async () => {
-      // Regression for F1: deliverSignal previously read process.env.TEMPORAL_ADDRESS
-      // and fell back to localhost — diverging from the canonical
-      // TEMPORAL_SERVICE_ADDRESS the worker uses. It now goes through loadConfig().
-      mockTemporalAddress = "stigmer-temporal-frontend:7233";
-      mockTemporalNamespace = "stigmer-prod";
+    it("routes through the server resolved by config, addressed by execution_id", async () => {
+      mockBackendEndpoint = "https://api.stigmer.example.com";
 
       const config: EmitEventConfig = {
         event: { type: "approval.granted" },
         delivery: [
-          { signal: { workflow_id: "wf-abc", signal_name: "approvalResolved" } },
+          { signal: { execution_id: "wfx_01ABC", signal_name: "approval_resolved" } },
         ],
       };
 
       const result = await emitEventAction(config, "exec-1");
 
-      expect(mockConnect).toHaveBeenCalledWith({ address: "stigmer-temporal-frontend:7233" });
       expect(mockClientCtor).toHaveBeenCalledWith(
-        expect.objectContaining({ namespace: "stigmer-prod" }),
+        expect.objectContaining({ endpoint: "https://api.stigmer.example.com" }),
       );
-      expect(mockGetHandle).toHaveBeenCalledWith("wf-abc");
-      expect(mockSignal).toHaveBeenCalledTimes(1);
-      const [signalName, envelope] = mockSignal.mock.calls[0] as unknown as [
-        string,
-        Record<string, unknown>,
-      ];
-      expect(signalName).toBe("approvalResolved");
+      expect(mockSendWorkflowSignal).toHaveBeenCalledTimes(1);
+      const [executionId, signalName, envelope, options] =
+        mockSendWorkflowSignal.mock.calls[0] as unknown as [
+          string,
+          string,
+          Record<string, unknown>,
+          { timeoutMs?: number },
+        ];
+      expect(executionId).toBe("wfx_01ABC");
+      expect(signalName).toBe("approval_resolved");
       expect(envelope.type).toBe("approval.granted");
+      expect(envelope.specversion).toBe("1.0");
       expect(result.delivery_errors).toBeUndefined();
+      // Best-effort delivery must never consume the activity's 5m budget.
+      expect(options).toEqual({ timeoutMs: 30_000 });
     });
 
-    it("keeps signal delivery best-effort: failures are collected, not thrown", async () => {
-      mockSignal.mockRejectedValueOnce(new Error("temporal unavailable"));
+    it("keeps signal delivery best-effort: server refusals are collected, not thrown", async () => {
+      mockSendWorkflowSignal.mockRejectedValueOnce(
+        new Error("[failed_precondition] cannot send signal to execution in phase EXECUTION_COMPLETED"),
+      );
+
+      const config: EmitEventConfig = {
+        event: { type: "test" },
+        delivery: [
+          { signal: { execution_id: "wfx_done", signal_name: "ping" } },
+        ],
+      };
+
+      const result = await emitEventAction(config, "exec-1");
+
+      expect(result.delivery_errors).toHaveLength(1);
+      expect((result.delivery_errors as any)[0].target).toBe("signal:wfx_done/ping");
+      expect((result.delivery_errors as any)[0].error).toContain("failed_precondition");
+    });
 
+    it("refuses the pre-oss#517 workflow_id field by name, without calling the server", async () => {
       const config: EmitEventConfig = {
         event: { type: "test" },
         delivery: [
-          { signal: { workflow_id: "wf-down", signal_name: "ping" } },
+          {
+            signal: {
+              workflow_id: "workflow-exec-wfx_01ABC",
+              signal_name: "ping",
+            } as unknown as SignalDeliveryTarget,
+          },
         ],
       };
 
       const result = await emitEventAction(config, "exec-1");
 
+      expect(mockSendWorkflowSignal).not.toHaveBeenCalled();
       expect(result.delivery_errors).toHaveLength(1);
-      expect((result.delivery_errors as any)[0].target).toBe("signal:wf-down/ping");
-      expect((result.delivery_errors as any)[0].error).toContain("temporal unavailable");
+      expect((result.delivery_errors as any)[0].error).toContain("'execution_id'");
+      expect((result.delivery_errors as any)[0].error).toContain("'workflow_id' is not supported");
+    });
+
+    it("refuses a signal target missing signal_name", async () => {
+      const config: EmitEventConfig = {
+        event: { type: "test" },
+        delivery: [
+          {
+            signal: {
+              execution_id: "wfx_01ABC",
+            } as unknown as SignalDeliveryTarget,
+          },
+        ],
+      };
+
+      const result = await emitEventAction(config, "exec-1");
+
+      expect(mockSendWorkflowSignal).not.toHaveBeenCalled();
+      expect(result.delivery_errors).toHaveLength(1);
+      expect((result.delivery_errors as any)[0].error).toContain("'signal_name'");
+    });
+
+    it("reuses one client across multiple signal targets", async () => {
+      const config: EmitEventConfig = {
+        event: { type: "fanout" },
+        delivery: [
+          { signal: { execution_id: "wfx_a", signal_name: "sig_a" } },
+          { signal: { execution_id: "wfx_b", signal_name: "sig_b" } },
+        ],
+      };
+
+      const result = await emitEventAction(config, "exec-1");
+
+      expect(mockClientCtor).toHaveBeenCalledTimes(1);
+      expect(mockSendWorkflowSignal).toHaveBeenCalledTimes(2);
+      expect(result.delivery_errors).toBeUndefined();
+    });
+
+    it("constructs no client for webhook-only delivery", async () => {
+      const originalFetch = globalThis.fetch;
+      globalThis.fetch = vi.fn(() =>
+        Promise.resolve(new Response(null, { status: 200 })),
+      ) as any;
+
+      try {
+        const config: EmitEventConfig = {
+          event: { type: "test" },
+          delivery: [{ webhook: { url: "https://events.example.com" } }],
+        };
+
+        await emitEventAction(config, "exec-1");
+
+        expect(mockClientCtor).not.toHaveBeenCalled();
+      } finally {
+        globalThis.fetch = originalFetch;
+      }
     });
   });
 });

package/src/workflow-engine/resolve.ts

@@ -158,6 +158,9 @@ function parsePath(path: string): (string | number)[] {
 
 const RUNTIME_PLACEHOLDER_RE = /\$\{\.(secrets|env_vars)\.\w+\}/;
 
+/** Substitution form of {@link RUNTIME_PLACEHOLDER_RE} (global, capturing). */
+const RUNTIME_PLACEHOLDER_SUB_RE = /\$\{\.(secrets|env_vars)\.(\w+)\}/g;
+
 /**
  * Checks whether a string contains a runtime placeholder that should
  * NOT be evaluated in the workflow (deterministic) phase. These are
@@ -172,7 +175,9 @@ export function isRuntimePlaceholder(value: string): boolean {
 
 /**
  * Resolves runtime placeholders (`${.secrets.KEY}`, `${.env_vars.KEY}`)
- * in a string using values from the runtime environment map.
+ * in a string using values from the runtime environment map. Missing
+ * keys resolve to `""` — callers that must fail loudly instead use
+ * {@link resolveRuntimePlaceholdersStrict}.
  *
  * This runs in activities only — never in the workflow sandbox.
  */
@@ -181,7 +186,7 @@ export function resolveRuntimePlaceholders(
   runtimeEnv: Record<string, unknown>,
 ): string {
   return value.replace(
-    /\$\{\.(secrets|env_vars)\.(\w+)\}/g,
+    RUNTIME_PLACEHOLDER_SUB_RE,
     (_match, _ns: string, key: string) => {
       const resolved = runtimeEnv[key];
       return resolved !== undefined ? String(resolved) : "";
@@ -189,6 +194,47 @@ export function resolveRuntimePlaceholders(
   );
 }
 
+/** Thrown by {@link resolveRuntimePlaceholdersStrict} for a missing key. */
+export class RuntimePlaceholderResolutionError extends Error {
+  constructor(
+    public readonly variableName: string,
+    public readonly context?: string,
+  ) {
+    const where = context ? ` in ${context}` : "";
+    super(
+      `Unresolved runtime placeholder for "${variableName}"${where}: ` +
+        `variable is not present in the workflow's runtime environment`,
+    );
+    this.name = "RuntimePlaceholderResolutionError";
+  }
+}
+
+/**
+ * Strict variant of {@link resolveRuntimePlaceholders}: a placeholder
+ * whose key is missing from the runtime environment throws instead of
+ * resolving to `""` — a silently-empty credential produces cryptic
+ * downstream failures, so declared-value consumers (the run task's env
+ * contract) fail fast with the variable named.
+ *
+ * This runs in activities only — never in the workflow sandbox.
+ */
+export function resolveRuntimePlaceholdersStrict(
+  value: string,
+  runtimeEnv: Record<string, unknown>,
+  context?: string,
+): string {
+  return value.replace(
+    RUNTIME_PLACEHOLDER_SUB_RE,
+    (_match, _ns: string, key: string) => {
+      const resolved = runtimeEnv[key];
+      if (resolved === undefined) {
+        throw new RuntimePlaceholderResolutionError(key, context);
+      }
+      return String(resolved);
+    },
+  );
+}
+
 /**
  * Recursively resolves all runtime placeholders in a nested object.
  * Walks maps, arrays, and strings. Non-string leaves pass through.

package/src/workflows/__tests__/connect-mcp-server.test.ts

@@ -63,6 +63,7 @@ describe("ConnectMcpServerWorkflow", () => {
       expect(mockDiscoverActivity).toHaveBeenCalledWith({
         mcpServerId: "mcp-123",
         executionContextId: "ctx-abc",
+        executionContextToken: null,
         invokerIdentityAccountId: "user-1",
       });
 
@@ -88,6 +89,30 @@ describe("ConnectMcpServerWorkflow", () => {
       expect(mockDiscoverActivity).toHaveBeenCalledWith({
         mcpServerId: "mcp-min",
         executionContextId: null,
+        executionContextToken: null,
+        invokerIdentityAccountId: null,
+      });
+    });
+
+    it("forwards the payload-carried EC token to discovery (oss#535)", async () => {
+      // The OSS handler mints an execution-scoped token into the workflow
+      // input; discovery presents it on the EC read to receive decrypted
+      // credentials from the redact-by-default OSS server.
+      const { connectMcpServer } = await import("../connect-mcp-server.js");
+
+      mockDiscoverActivity.mockResolvedValue(makeDiscoveryResult({ tools: [] }));
+      mockClassifyActivity.mockResolvedValue([]);
+
+      await connectMcpServer({
+        mcp_server_id: "mcp-tok",
+        execution_context_id: "ctx-tok",
+        execution_context_token: "scoped-ec-token",
+      });
+
+      expect(mockDiscoverActivity).toHaveBeenCalledWith({
+        mcpServerId: "mcp-tok",
+        executionContextId: "ctx-tok",
+        executionContextToken: "scoped-ec-token",
         invokerIdentityAccountId: null,
       });
     });

package/src/workflows/connect-mcp-server.ts

@@ -201,6 +201,7 @@ export async function connectMcpServer(
   const discovery = await discover.DiscoverMcpServerCapabilities({
     mcpServerId: input.mcp_server_id,
     executionContextId: input.execution_context_id ?? null,
+    executionContextToken: input.execution_context_token ?? null,
     invokerIdentityAccountId: input.invoker_identity_account_id ?? null,
   });
 
@@ -288,6 +289,7 @@ export async function discoverMcpServerLegacy(
   const discovery = await discover.DiscoverMcpServerCapabilities({
     mcpServerId: input.mcp_server_id,
     executionContextId: input.execution_context_id ?? null,
+    executionContextToken: input.execution_context_token ?? null,
     invokerIdentityAccountId: input.invoker_identity_account_id ?? null,
   });
 

package/src/workflows/types.ts

@@ -19,6 +19,14 @@
 export interface ConnectMcpServerWorkflowInput {
   mcp_server_id: string;
   execution_context_id?: string | null;
+  /**
+   * Execution-scoped token for reading the connect ExecutionContext's
+   * decrypted credentials (oss#535). Populated by the OSS Go handler, whose
+   * EC read RPCs redact secrets for tokenless callers; absent on cloud,
+   * where the discovery activity's ambient connect_sandbox credential
+   * decrypts on its own.
+   */
+  execution_context_token?: string | null;
   invoker_identity_account_id?: string | null;
 }
 

package/dist/activities/execute-cursor/mcp-config.d.ts

@@ -1,30 +0,0 @@
-/**
- * Cursor-specific MCP config mapping.
- *
- * Converts harness-agnostic ResolvedMcpServer into the Cursor SDK's
- * McpServerConfig shape for Agent.create(). The resolution logic lives
- * in shared/mcp-resolver.ts; this module only handles the final transform.
- */
-import type { ResolvedMcpServer } from "../../shared/mcp-resolver.js";
-export type { ResolvedMcpServer, McpResolutionResult } from "../../shared/mcp-resolver.js";
-export { resolveMcpServers, extractMcpServerSlugs, PlaceholderResolutionError, } from "../../shared/mcp-resolver.js";
-/**
- * Cursor SDK MCP server config shape (matches @cursor/sdk McpServerConfig).
- * Defined here to avoid tight coupling to the SDK's internal types.
- */
-export type CursorMcpServerConfig = {
-    type?: "stdio";
-    command: string;
-    args?: string[];
-    env?: Record<string, string>;
-    cwd?: string;
-} | {
-    type?: "http" | "sse";
-    url: string;
-    headers?: Record<string, string>;
-};
-/**
- * Transform resolved MCP servers into the Cursor SDK's mcpServers config
- * for Agent.create().
- */
-export declare function toCursorMcpConfig(servers: ResolvedMcpServer[]): Record<string, CursorMcpServerConfig>;