@stigmer/runner 3.12.3 → 3.12.4

package/src/runner-manager.ts

@@ -32,6 +32,11 @@ import type { WorkerActivities } from "./worker.js";
 import { resolveWorkflowSource, OTEL_WORKFLOW_INTERCEPTOR_MODULE } from "./workflow-source.js";
 import { resolveRunnerBootstrap, refreshRunnerAccessToken } from "./bootstrap.js";
 import { assertLlmBackendsPreflight } from "./preflight.js";
+import {
+  captureRunnerSecrets,
+  getRunnerSecret,
+  setRunnerSecret,
+} from "./shared/runner-credential-store.js";
 import { createRunnerTokenCoordinator } from "./runner-token-coordinator.js";
 // Per-task-queue in-flight activity tracking lives in ./in-flight.ts so the
 // activity interceptor (no manager-closure handle) and unit tests can reach it.
@@ -214,6 +219,12 @@ export async function createStigmerRunnerManager(
 ): Promise<StigmerRunnerManager> {
   validateManagerOptions(options);
 
+  // Take custody of runner secrets BEFORE anything else can read them from
+  // env — and before any agent code could spawn with them (#508). Runs here
+  // (not only in main.ts) because this factory is a public library boot door:
+  // in-process embedders like the desktop never execute main.ts.
+  captureRunnerSecrets();
+
   const { registerStigmerDeepagentsProfiles } = await import(
     "./activities/execute-deep-agent/deepagents-profiles.js"
   );
@@ -365,7 +376,7 @@ export async function createStigmerRunnerManager(
   if (
     !bootstrap.payloadEncryption &&
     bootstrap.runnerAccessToken &&
-    !process.env.STIGMER_PAYLOAD_ENCRYPTION_KEY
+    !getRunnerSecret("STIGMER_PAYLOAD_ENCRYPTION_KEY")
   ) {
     console.warn(
       "[runner-manager] Server minted a runner token but returned no payload " +
@@ -530,6 +541,13 @@ export async function createStigmerRunnerManager(
       await removeManaged(
         sessions, sessionId, SESSION_QUEUE_PREFIX + sessionId, "session",
       );
+      // The session is done on this host — release its parked agent (and
+      // the executor + MCP subprocesses the lease pins) immediately rather
+      // than waiting out the idle TTL (#215).
+      const { evictSessionAgent } = await import(
+        "./activities/execute-cursor/agent-session-cache.js"
+      );
+      evictSessionAgent(sessionId);
     },
 
     activeSessions(): string[] {
@@ -585,12 +603,11 @@ export async function createStigmerRunnerManager(
       // proxy credential follows it: only when no token has been minted (so the
       // pre-mint lockstep is preserved), never once the runner owns a minted
       // token. See runner-token-coordinator.ts and the staleness changelogs.
+      // The credential store is the second leg of the pair (it replaced the
+      // process.env.STIGMER_TOKEN write, #508): per-call readers like
+      // call-llm and the registry headers resolve the current token there.
       tokenRef.current = token;
-      if (token) {
-        process.env.STIGMER_TOKEN = token;
-      } else {
-        delete process.env.STIGMER_TOKEN;
-      }
+      setRunnerSecret("STIGMER_TOKEN", token);
       tokenCoordinator.onControlPlaneTokenChanged(token);
       console.log("[runner-manager] Auth token updated");
     },
@@ -629,6 +646,12 @@ export async function createStigmerRunnerManager(
       }
 
       await Promise.all(shutdownPromises);
+      // Workers are drained — release every parked session agent so their
+      // executor leases dispose (stdio MCP subprocesses die with them) (#215).
+      const { closeAllCachedAgents } = await import(
+        "./activities/execute-cursor/agent-session-cache.js"
+      );
+      closeAllCachedAgents();
       sessions.clear();
       workflowExecutions.clear();
       poolControl = null;

package/src/runner.ts

@@ -20,6 +20,10 @@ import { DEFAULT_CURSOR_AGENT_RESOLVE_TIMEOUT_MS, DEFAULT_CURSOR_STREAM_STALL_TI
 import type { WorkerActivities } from "./worker.js";
 import { resolveRunnerBootstrap } from "./bootstrap.js";
 import { assertLlmBackendsPreflight } from "./preflight.js";
+import {
+  captureRunnerSecrets,
+  setRunnerSecret,
+} from "./shared/runner-credential-store.js";
 import { markBoot, emitRunnerBootTiming } from "./shared/cold-start-timing.js";
 
 /**
@@ -118,11 +122,12 @@ export interface StigmerRunner {
  * Wire up self-renewal for a static cloud sandbox's control-plane credential
  * (see sandbox-token-renewal.ts for the model). The applied token reaches
  * every consumer: activity gRPC clients read {@code tokenRef} per request,
- * env-reading call sites (call-llm, registry-endpoint) read
- * {@code process.env.STIGMER_TOKEN} per call, artifact storage resolves the
- * ref per call, and the two Cursor SDK interceptors are updated directly —
- * a static runner has no {@code RunnerTokenCoordinator} minting a separate
- * proxy credential, so its x-stigmer-auth IS this token.
+ * per-call sites (call-llm, registry-endpoint headers) resolve it through
+ * the runner credential store (which replaced the process.env.STIGMER_TOKEN
+ * channel, #508), artifact storage resolves the ref per call, and the two
+ * Cursor SDK interceptors are updated directly — a static runner has no
+ * {@code RunnerTokenCoordinator} minting a separate proxy credential, so its
+ * x-stigmer-auth IS this token.
  */
 async function startStaticSandboxTokenRenewal(
   config: Config,
@@ -157,7 +162,9 @@ async function startStaticSandboxTokenRenewal(
       client.getRunnerScopedToken({ renewal: true }, currentToken),
     applyToken: (token) => {
       tokenRef.current = token;
-      process.env.STIGMER_TOKEN = token;
+      // Store write replaced the process.env.STIGMER_TOKEN write (#508) —
+      // same per-call readers (call-llm, registry headers), no env exposure.
+      setRunnerSecret("STIGMER_TOKEN", token);
       updateInterceptorToken(token);
       updateHttp2InterceptorToken(token);
     },
@@ -190,6 +197,12 @@ export async function createStigmerRunner(
 ): Promise<StigmerRunner> {
   validateOptions(options);
 
+  // Take custody of runner secrets BEFORE anything else can read them from
+  // env — and before any agent code could spawn with them (#508). Runs here
+  // (not only in main.ts) because this factory is a public library boot door
+  // for in-process embedders.
+  captureRunnerSecrets();
+
   const { registerStigmerDeepagentsProfiles } = await import(
     "./activities/execute-deep-agent/deepagents-profiles.js"
   );
@@ -327,6 +340,12 @@ export async function createStigmerRunner(
       emitRunnerBootTiming({ task_queue: config.taskQueue, mode: config.mode });
       await worker.run();
       console.log("Worker stopped");
+      // The worker has drained — release any parked session agent so its
+      // executor lease disposes with the process (#215).
+      const { closeAllCachedAgents } = await import(
+        "./activities/execute-cursor/agent-session-cache.js"
+      );
+      closeAllCachedAgents();
     },
     shutdown() {
       tokenRenewal?.stop();

package/src/shared/__tests__/model-client.test.ts

@@ -23,6 +23,7 @@ vi.mock("@langchain/openai", () => ({
 
 import { buildChatModel } from "../model-client.js";
 import { _resetRegistryCache } from "../model-registry.js";
+import { ServiceTier } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 
 interface MockModel {
   id: string;
@@ -306,6 +307,18 @@ describe("buildChatModel", () => {
       expect(lastAnthropicArgs().apiKey).toBe("");
     });
 
+    it("does NOT send service_tier on a backend adapter — tiers are Anthropic-first-party billing, and Vertex/Bedrock/Foundry have no tier dimension", async () => {
+      mockRegistryResponse([
+        { id: "claude-sonnet-4.6", apiModelId: "claude-sonnet-4-6", provider: "anthropic" },
+      ]);
+
+      await buildChatModel({ modelName: "claude-sonnet-4.6", serviceTier: ServiceTier.STANDARD });
+
+      const args = lastAnthropicArgs();
+      expect(typeof args.createClient).toBe("function");
+      expect(args).not.toHaveProperty("invocationKwargs");
+    });
+
     it("yields to the proxy: a proxied call never consults the backend var", async () => {
       mockRegistryResponse([
         { id: "claude-sonnet-4.6", apiModelId: "claude-sonnet-4-6", provider: "anthropic" },
@@ -359,4 +372,90 @@ describe("buildChatModel", () => {
     await expect(buildChatModel({ modelName: "claude-sonnet-4.6" }))
       .rejects.toThrow(/STIGMER_ANTHROPIC_BACKEND="verteks" is not a supported backend/);
   });
+
+  describe("service tier (stigmer/stigmer#361)", () => {
+    // The #357 contract on the native harness: when the caller passes the
+    // execution's effective tier, every provider request pins it
+    // explicitly, so the provider ACCOUNT's default can never pick the
+    // price. Each provider has its own spelling; both are pinned here so
+    // a wrapper upgrade that moves the slot fails loudly.
+
+    it("OpenAI: STANDARD pins service_tier 'default' — never 'auto', which would re-open the account-default hole", async () => {
+      mockRegistryResponse([
+        { id: "gpt-4.1", apiModelId: "gpt-4.1", provider: "openai" },
+      ]);
+
+      await buildChatModel({ modelName: "gpt-4.1", serviceTier: ServiceTier.STANDARD });
+
+      const args = mockOpenAICtor.mock.calls.at(-1)?.[0] as Record<string, unknown>;
+      expect(args).toMatchObject({ service_tier: "default" });
+    });
+
+    it("OpenAI: FAST pins service_tier 'priority'", async () => {
+      mockRegistryResponse([
+        { id: "gpt-4.1", apiModelId: "gpt-4.1", provider: "openai" },
+      ]);
+
+      await buildChatModel({ modelName: "gpt-4.1", serviceTier: ServiceTier.FAST });
+
+      const args = mockOpenAICtor.mock.calls.at(-1)?.[0] as Record<string, unknown>;
+      expect(args).toMatchObject({ service_tier: "priority" });
+    });
+
+    it("Anthropic: STANDARD rides invocationKwargs as 'standard_only' — priority capacity is never consumed implicitly", async () => {
+      mockRegistryResponse([
+        { id: "claude-haiku-4.5", apiModelId: "claude-haiku-4-5-20251001", provider: "anthropic" },
+      ]);
+
+      await buildChatModel({ modelName: "claude-haiku-4.5", serviceTier: ServiceTier.STANDARD });
+
+      expect(lastAnthropicArgs()).toMatchObject({
+        invocationKwargs: { service_tier: "standard_only" },
+      });
+    });
+
+    it("Anthropic: FAST rides invocationKwargs as 'auto' — use purchased priority capacity when available", async () => {
+      mockRegistryResponse([
+        { id: "claude-haiku-4.5", apiModelId: "claude-haiku-4-5-20251001", provider: "anthropic" },
+      ]);
+
+      await buildChatModel({ modelName: "claude-haiku-4.5", serviceTier: ServiceTier.FAST });
+
+      expect(lastAnthropicArgs()).toMatchObject({
+        invocationKwargs: { service_tier: "auto" },
+      });
+    });
+
+    it("an omitted tier sends NO tier parameter on either provider — platform-internal utility calls stay untiered", async () => {
+      mockRegistryResponse([
+        { id: "gpt-4.1", apiModelId: "gpt-4.1", provider: "openai" },
+      ]);
+      await buildChatModel({ modelName: "gpt-4.1" });
+      const openAiArgs = mockOpenAICtor.mock.calls.at(-1)?.[0] as Record<string, unknown>;
+      expect(openAiArgs).not.toHaveProperty("service_tier");
+
+      mockRegistryResponse([
+        { id: "claude-haiku-4.5", apiModelId: "claude-haiku-4-5-20251001", provider: "anthropic" },
+      ]);
+      await buildChatModel({ modelName: "claude-haiku-4.5" });
+      expect(lastAnthropicArgs()).not.toHaveProperty("invocationKwargs");
+    });
+
+    it("the tier rides the proxy path too — the request body parameter is what the proxy meters", async () => {
+      mockRegistryResponse([
+        { id: "claude-haiku-4.5", apiModelId: "claude-haiku-4-5-20251001", provider: "anthropic" },
+      ]);
+
+      await buildChatModel({
+        modelName: "claude-haiku-4.5",
+        proxyEndpoint: "https://api.stigmer.ai",
+        stigmerToken: "token",
+        serviceTier: ServiceTier.STANDARD,
+      });
+
+      expect(lastAnthropicArgs()).toMatchObject({
+        invocationKwargs: { service_tier: "standard_only" },
+      });
+    });
+  });
 });

package/src/shared/__tests__/runner-credential-store.test.ts

@@ -0,0 +1,155 @@
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import {
+  captureRunnerSecrets,
+  getRunnerSecret,
+  setRunnerSecret,
+  runnerSecretsEnvView,
+  resetRunnerSecretsForTests,
+} from "../runner-credential-store.js";
+import {
+  RUNNER_CREDENTIAL_ENV_KEYS,
+  RUNNER_ENCRYPTION_ENV_KEYS,
+  RUNNER_SECRET_ENV_KEYS,
+} from "../runner-credential-keys.js";
+
+/** Snapshot/restore of every env slot these tests touch. */
+const savedEnv = new Map<string, string | undefined>();
+
+beforeEach(() => {
+  resetRunnerSecretsForTests();
+  for (const key of RUNNER_SECRET_ENV_KEYS) {
+    savedEnv.set(key, process.env[key]);
+    delete process.env[key];
+  }
+});
+
+afterEach(() => {
+  resetRunnerSecretsForTests();
+  for (const [key, value] of savedEnv) {
+    if (value === undefined) {
+      delete process.env[key];
+    } else {
+      process.env[key] = value;
+    }
+  }
+  savedEnv.clear();
+});
+
+describe("captureRunnerSecrets", () => {
+  it("moves every listed secret out of process.env and into the store", () => {
+    // Plant a value for every name in the source-of-truth list, so a key
+    // added to runner-credential-keys.ts is covered here automatically —
+    // the #385 test idiom, applied to custody.
+    for (const key of RUNNER_SECRET_ENV_KEYS) {
+      process.env[key] = `boot-${key}`;
+    }
+
+    captureRunnerSecrets();
+
+    for (const key of RUNNER_SECRET_ENV_KEYS) {
+      expect(
+        process.env[key],
+        `'${key}' must not remain in process.env after capture — anything ` +
+        `left there is readable by every agent shell command (issue #508)`,
+      ).toBeUndefined();
+      expect(getRunnerSecret(key)).toBe(`boot-${key}`);
+    }
+  });
+
+  it("is idempotent — a second capture cannot re-freeze rotated values", () => {
+    process.env.STIGMER_TOKEN = "boot-token";
+    captureRunnerSecrets();
+    setRunnerSecret("STIGMER_TOKEN", "rotated-token");
+
+    // A late (buggy or racing) boot-door call must be a no-op.
+    process.env.STIGMER_TOKEN = "stale-replant";
+    captureRunnerSecrets();
+
+    expect(getRunnerSecret("STIGMER_TOKEN")).toBe("rotated-token");
+    // The replant stays in env (capture did not consume it) — the live-env
+    // fallback below deliberately does NOT apply when the store holds a
+    // value, so rotation always wins.
+    expect(process.env.STIGMER_TOKEN).toBe("stale-replant");
+    delete process.env.STIGMER_TOKEN;
+  });
+
+  it("scrubs the encryption keys, not only the #385 credentials (issue #508)", () => {
+    // Pins the #508 scope widening by name. The parameterized test above
+    // would pass even if the combined list regressed to the 8 credentials;
+    // this one cannot.
+    for (const key of [
+      "STIGMER_PAYLOAD_ENCRYPTION_KEY",
+      "STIGMER_PAYLOAD_ENCRYPTION_SECONDARY_KEY",
+    ]) {
+      expect(RUNNER_ENCRYPTION_ENV_KEYS, `'${key}' must be a captured secret`).toContain(key);
+    }
+    for (const key of [...RUNNER_CREDENTIAL_ENV_KEYS, ...RUNNER_ENCRYPTION_ENV_KEYS]) {
+      expect(RUNNER_SECRET_ENV_KEYS, `'${key}' must be in the scrub list`).toContain(key);
+    }
+  });
+});
+
+describe("getRunnerSecret", () => {
+  it("falls back to a live process.env value the capture never saw", () => {
+    captureRunnerSecrets();
+    // Custody rule 2: a value planted after boot behaves like the env read
+    // the store replaced (test/embedder compatibility) — production only
+    // sets these at process start, so this path is dead there.
+    process.env.STIGMER_TOKEN = "late-planted";
+
+    expect(getRunnerSecret("STIGMER_TOKEN")).toBe("late-planted");
+  });
+
+  it("returns undefined for an absent secret", () => {
+    captureRunnerSecrets();
+    expect(getRunnerSecret("STIGMER_TOKEN")).toBeUndefined();
+  });
+});
+
+describe("setRunnerSecret", () => {
+  it("carries the rotation channel: set updates, null clears", () => {
+    captureRunnerSecrets();
+
+    setRunnerSecret("STIGMER_TOKEN", "minted-1");
+    expect(getRunnerSecret("STIGMER_TOKEN")).toBe("minted-1");
+
+    setRunnerSecret("STIGMER_TOKEN", "minted-2");
+    expect(getRunnerSecret("STIGMER_TOKEN")).toBe("minted-2");
+
+    setRunnerSecret("STIGMER_TOKEN", null);
+    expect(getRunnerSecret("STIGMER_TOKEN")).toBeUndefined();
+  });
+
+  it("never lets a rotated value sit in process.env, even if a writer beats the boot capture", () => {
+    process.env.STIGMER_TOKEN = "boot-token";
+
+    // No captureRunnerSecrets() call yet — the writer forces it.
+    setRunnerSecret("STIGMER_TOKEN", "rotated-early");
+
+    expect(process.env.STIGMER_TOKEN).toBeUndefined();
+    expect(getRunnerSecret("STIGMER_TOKEN")).toBe("rotated-early");
+  });
+});
+
+describe("runnerSecretsEnvView", () => {
+  it("merges captured secrets over process.env without writing them back", () => {
+    process.env.STIGMER_TOKEN = "boot-token";
+    captureRunnerSecrets();
+
+    const view = runnerSecretsEnvView();
+
+    expect(view.STIGMER_TOKEN).toBe("boot-token");
+    expect(view.PATH).toBe(process.env.PATH);
+    expect(
+      process.env.STIGMER_TOKEN,
+      "building the view must not re-plant secrets into process.env",
+    ).toBeUndefined();
+  });
+
+  it("reflects rotation", () => {
+    captureRunnerSecrets();
+    setRunnerSecret("STIGMER_TOKEN", "rotated");
+
+    expect(runnerSecretsEnvView().STIGMER_TOKEN).toBe("rotated");
+  });
+});

package/src/shared/__tests__/zip-extract.test.ts

@@ -1,7 +1,16 @@
 import { describe, it, expect } from "vitest";
-import { extractZipFileEntries } from "../zip-extract.js";
+import { extractZipFileEntries, type ZipFileEntry } from "../zip-extract.js";
 import { buildZip } from "../../__test-utils__/zip-fixtures.js";
 
+/**
+ * Decode entries for text-content assertions. The production contract is
+ * bytes (issue #683); decoding belongs to the tests that want to assert on
+ * human-readable fixtures, not to the module under test.
+ */
+function decoded(entries: ZipFileEntry[]): { path: string; content: string }[] {
+  return entries.map((e) => ({ path: e.path, content: new TextDecoder().decode(e.content) }));
+}
+
 // ─── extractZipFileEntries ───────────────────────────────────────────────
 
 describe("extractZipFileEntries", () => {
@@ -12,9 +21,10 @@ describe("extractZipFileEntries", () => {
     ]);
 
     const entries = await extractZipFileEntries(zip);
-    expect(entries).toHaveLength(2);
-    expect(entries[0]).toEqual({ path: "SKILL.md", content: "# My Skill" });
-    expect(entries[1]).toEqual({ path: "references/schema.md", content: "# Schema\n\nTable definitions." });
+    expect(decoded(entries)).toEqual([
+      { path: "SKILL.md", content: "# My Skill" },
+      { path: "references/schema.md", content: "# Schema\n\nTable definitions." },
+    ]);
   });
 
   it("extracts deflated files", async () => {
@@ -22,8 +32,7 @@ describe("extractZipFileEntries", () => {
     const zip = buildZip([{ name: "notes.txt", content, method: "deflated" }]);
 
     const entries = await extractZipFileEntries(zip);
-    expect(entries).toHaveLength(1);
-    expect(entries[0]).toEqual({ path: "notes.txt", content });
+    expect(decoded(entries)).toEqual([{ path: "notes.txt", content }]);
   });
 
   it("skips directory entries", async () => {
@@ -123,6 +132,32 @@ describe("extractZipFileEntries", () => {
     expect(entries).toHaveLength(1);
   });
 
+  // ── Binary safety (issue #683) ──────────────────────────────────────────
+
+  it("round-trips a stored binary entry byte-identically", async () => {
+    // PNG magic followed by bytes that are not valid UTF-8 (0x89 alone, a
+    // lone continuation byte, an unpaired lead byte). A decode/encode
+    // round-trip replaces these with U+FFFD — the corruption this pins.
+    const binary = new Uint8Array([
+      0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0xff, 0xfe, 0x00, 0x80, 0xc3,
+    ]);
+    const zip = buildZip([{ name: "references/diagram.png", content: binary }]);
+
+    const entries = await extractZipFileEntries(zip);
+    expect(entries).toHaveLength(1);
+    expect(new Uint8Array(entries[0].content)).toEqual(binary);
+  });
+
+  it("round-trips a deflated binary entry byte-identically", async () => {
+    const binary = new Uint8Array(256);
+    for (let i = 0; i < 256; i++) binary[i] = i; // every byte value once
+    const zip = buildZip([{ name: "assets/font.woff2", content: binary, method: "deflated" }]);
+
+    const entries = await extractZipFileEntries(zip);
+    expect(entries).toHaveLength(1);
+    expect(new Uint8Array(entries[0].content)).toEqual(binary);
+  });
+
   // ── Streaming entries (issue #450) ─────────────────────────────────────
 
   it("extracts Go-default streaming archives (deflated, data descriptors)", async () => {
@@ -132,7 +167,7 @@ describe("extractZipFileEntries", () => {
     ]);
 
     const entries = await extractZipFileEntries(zip);
-    expect(entries).toEqual([
+    expect(decoded(entries)).toEqual([
       { path: "SKILL.md", content: "# Streamed Skill" },
       { path: "references/notes.md", content: "streamed notes" },
     ]);
@@ -151,7 +186,7 @@ describe("extractZipFileEntries", () => {
     ]);
 
     const entries = await extractZipFileEntries(zip);
-    expect(entries).toEqual([
+    expect(decoded(entries)).toEqual([
       { path: "poison.md", content: poisoned },
       { path: "after.md", content: "the entry after the poisoned one" },
     ]);
@@ -162,7 +197,7 @@ describe("extractZipFileEntries", () => {
     const zip = buildZip([{ name: "cd-sizes.txt", content, streaming: true }]);
 
     const entries = await extractZipFileEntries(zip);
-    expect(entries).toEqual([{ path: "cd-sizes.txt", content }]);
+    expect(decoded(entries)).toEqual([{ path: "cd-sizes.txt", content }]);
   });
 
   // ── Central directory edge cases ───────────────────────────────────────
@@ -173,7 +208,7 @@ describe("extractZipFileEntries", () => {
     });
 
     const entries = await extractZipFileEntries(zip);
-    expect(entries).toEqual([{ path: "a.txt", content: "aaa" }]);
+    expect(decoded(entries)).toEqual([{ path: "a.txt", content: "aaa" }]);
   });
 
   it("is not fooled by EOCD signature bytes inside the archive comment", async () => {
@@ -185,7 +220,7 @@ describe("extractZipFileEntries", () => {
     });
 
     const entries = await extractZipFileEntries(zip);
-    expect(entries).toEqual([{ path: "a.txt", content: "aaa" }]);
+    expect(decoded(entries)).toEqual([{ path: "a.txt", content: "aaa" }]);
   });
 
   it("returns empty array when the central directory is missing", async () => {

package/src/shared/fingerprint-secret.ts

@@ -20,6 +20,7 @@
  */
 
 import { randomBytes, type BinaryLike } from "node:crypto";
+import { getRunnerSecret } from "./runner-credential-store.js";
 
 const ENV_VAR = "STIGMER_RUNNER_HITL_SECRET";
 
@@ -27,13 +28,14 @@ let cached: Buffer | undefined;
 let warned = false;
 
 /**
- * Return the runner's HITL master secret (env-configured, else a stable
- * per-process random fallback). Memoized.
+ * Return the runner's HITL master secret (operator-configured via the
+ * {@link ENV_VAR} env var, resolved through the credential store since the
+ * #508 boot capture; else a stable per-process random fallback). Memoized.
  */
 export function getRunnerHitlMasterSecret(): BinaryLike {
   if (cached) return cached;
 
-  const fromEnv = process.env[ENV_VAR];
+  const fromEnv = getRunnerSecret(ENV_VAR);
   if (fromEnv && fromEnv.length > 0) {
     cached = Buffer.from(fromEnv, "utf-8");
     return cached;

package/src/shared/llm-backend.ts

@@ -15,6 +15,7 @@
  */
 
 import type { LlmProvider } from "./llm-proxy.js";
+import { runnerSecretsEnvView } from "./runner-credential-store.js";
 
 // ─── Backend selection ───────────────────────────────────────────────────────
 
@@ -345,7 +346,12 @@ export function checkFoundryPrerequisites(
  */
 export function checkDirectCredentials(
   provider: LlmProvider,
-  env: NodeJS.ProcessEnv = process.env,
+  // Credential keys live in the runner credential store after the boot
+  // capture (#508), so the default is the store view, not bare process.env.
+  // The other checks in this module keep the process.env default: they read
+  // deployment CONFIG (backend selection, regions), which is deliberately
+  // not captured.
+  env: NodeJS.ProcessEnv = runnerSecretsEnvView(),
 ): string | null {
   if (provider === "openai") {
     if (env.OPENAI_API_KEY?.trim()) return null;