@stigmer/runner 3.12.3 → 3.12.5

package/src/activities/execute-deep-agent/index.ts

@@ -78,10 +78,33 @@ import { stampFlowedFileEditRows, stampFlowedSubAgentFileEditRows } from "./stam
 import { deriveTurnCommandProvenance } from "./command-provenance.js";
 import { describeExecutionError } from "../../shared/model-error.js";
 import { inferProvider, type LlmProvider } from "../../shared/llm-proxy.js";
+import { getShutdownSignalForQueue } from "../../shared/worker-shutdown.js";
 
 /** The harness id stamped on the deep-agent's file-review ledger events. */
 const DEEP_AGENT_HARNESS_ID = "deep-agent";
 
+/**
+ * The worker-shutdown terminal status (#776). A shutdown is not a pause: the
+ * execution will not resume on this worker, so persisting PAUSED would strand
+ * the user with a lie. The copy is byte-identical to the Cursor harness's
+ * worker-shutdown branch so every downstream status.error consumer (the Go and
+ * Java workflow fallbacks, the cloud channel decision table) keys on ONE shape.
+ */
+function buildWorkerShutdownStatus(): AgentExecutionStatus {
+  return create(AgentExecutionStatusSchema, {
+    phase: ExecutionPhase.EXECUTION_FAILED,
+    error: "Execution interrupted: runner worker was shut down. Retry or resume.",
+    completedAt: utcTimestamp(),
+    messages: [
+      create(AgentMessageSchema, {
+        type: MessageType.MESSAGE_SYSTEM,
+        content: "Execution interrupted: the runner worker was shut down while the agent was still running. You can retry or resume.",
+        timestamp: utcTimestamp(),
+      }),
+    ],
+  });
+}
+
 /**
  * Best-effort provider inference for error-message wording. inferProvider
  * throws on unrecognized names; an error path must never throw over a label.
@@ -115,6 +138,11 @@ export function createDeepAgentActivities(config: Config) {
     ): Promise<unknown> => {
       const { executionId, threadId, turnSeq } = normalizeActivityInput(arg0, arg1);
       activityStarted();
+      // Worker-shutdown classification channel (#776): the pause paths below
+      // consult this signal to distinguish "my worker is draining" (SIGTERM,
+      // desktop quit) from "the orchestrator cancelled me" (a real user
+      // pause). See shared/worker-shutdown.ts for the ownership contract.
+      const shutdownSignal = getShutdownSignalForQueue(Context.current().info.taskQueue);
       let setup: SetupResult | null = null;
       // Exclusive turn lock on the workspace working tree — held across the
       // entire tree-mutating window (decision reconcile, agent writes,
@@ -567,6 +595,13 @@ export function createDeepAgentActivities(config: Config) {
 
         if (result.terminalStatus) {
           if (initialStatus.phase === ExecutionPhase.EXECUTION_PAUSED) {
+            // The stream loop marks PAUSED for ANY platform cancellation; a
+            // worker shutdown is not a pause and must not persist as one (#776).
+            if (shutdownSignal?.aborted) {
+              console.log(`[ExecuteDeepAgent] Cancelled (worker shutdown) for execution ${executionId}: events=${result.eventsProcessed}`);
+              await persistStatus(client, executionId, buildWorkerShutdownStatus(), { offload: statusOffload }).catch(() => {});
+              throw new CancelledFailure("Activity cancelled (worker shutdown, not user pause)");
+            }
             await persistStatus(client, executionId, initialStatus, { offload: statusOffload });
             console.log(`[ExecuteDeepAgent] Paused for execution ${executionId}: events=${result.eventsProcessed}`);
             throw new CancelledFailure("Activity paused by orchestrator");
@@ -617,15 +652,20 @@ export function createDeepAgentActivities(config: Config) {
                 policyEngineVersion: intr.policySource ? POLICY_ENGINE_VERSION : "",
               });
 
-              // Capture a sanitized args preview while the graph is paused, so the
-              // approval UI renders the proposed change before the tool runs. Args
-              // are correlated from the AI-message tool call in graph state (the
-              // single source of truth).
-              const { argsPreview } = captureApprovalArtifacts({
+              // Capture a sanitized args preview AND the redacted args object
+              // while the graph is paused, so the approval UI renders the
+              // proposed change before the tool runs — and the row header can
+              // extract its filename-first path from `args` like every other
+              // row (issue #754: a placeholder without args rendered a
+              // pathless "Write" header). Args are correlated from the
+              // AI-message tool call in graph state (the single source of
+              // truth).
+              const { argsPreview, args } = captureApprovalArtifacts({
                 toolCallId: intr.toolCallId,
                 messages: aiMessages,
               });
               if (argsPreview) toolCall.argsPreview = argsPreview;
+              if (args) toolCall.args = args as typeof toolCall.args;
 
               aiMsg.toolCalls.push(toolCall);
             }
@@ -749,6 +789,13 @@ export function createDeepAgentActivities(config: Config) {
 
       } catch (err: unknown) {
         if (err instanceof CancelledFailure) {
+          // Worker shutdown is infrastructure failure, not pause — the caught
+          // CancelledFailure is itself the interruption evidence (#776).
+          if (shutdownSignal?.aborted) {
+            console.log(`[ExecuteDeepAgent] Cancelled (worker shutdown) for execution ${executionId}`);
+            await persistStatus(client, executionId, buildWorkerShutdownStatus()).catch(() => {});
+            throw err;
+          }
           console.log(`[ExecuteDeepAgent] Cancelled (pause) for execution ${executionId}`);
           const pausedStatus = create(AgentExecutionStatusSchema, {
             phase: ExecutionPhase.EXECUTION_PAUSED,
@@ -758,6 +805,11 @@ export function createDeepAgentActivities(config: Config) {
         }
 
         if (Context.current().cancellationSignal.aborted) {
+          if (shutdownSignal?.aborted) {
+            console.log(`[ExecuteDeepAgent] Error during worker-shutdown cancellation for ${executionId}: ${err}`);
+            await persistStatus(client, executionId, buildWorkerShutdownStatus()).catch(() => {});
+            throw new CancelledFailure("Activity cancelled (worker shutdown, not user pause)");
+          }
           console.log(`[ExecuteDeepAgent] Error during cancellation for ${executionId}, treating as pause: ${err}`);
           const pausedStatus = create(AgentExecutionStatusSchema, {
             phase: ExecutionPhase.EXECUTION_PAUSED,

package/src/activities/execute-deep-agent/prompt-builder.ts

@@ -17,6 +17,10 @@ import {
   type SenderIdentity,
 } from "../../shared/sender-identity.js";
 import { formatSessionContextText } from "../../shared/session-context.js";
+import {
+  formatDeclaredPreferencesText,
+  type DeclaredPreferencesContent,
+} from "../../shared/declared-preferences.js";
 import {
   visionDisclosureLines,
   type NotViewableEntry,
@@ -166,6 +170,14 @@ export interface PromptBuilderInput {
    * context is standing session state, like skills.
    */
   sessionContext?: string;
+  /**
+   * Platform-declared standing preferences (stigmer/stigmer#293): the org's
+   * and user's standing context, server-snapshotted onto the execution
+   * spec's `declared_preferences` at create. Injected on EVERY turn like
+   * the bridge — the native system prompt is rebuilt per invocation, so an
+   * edited preference reaches the very next turn.
+   */
+  declaredPreferences?: DeclaredPreferencesContent;
 }
 
 // The prompt renders the injector's own result type — a local structural twin
@@ -229,6 +241,16 @@ export function buildEnhancedSystemPrompt(input: PromptBuilderInput): string {
       formatSenderIdentityText(input.senderIdentity);
   }
 
+  // Platform-declared standing facts precede embedder-supplied context
+  // (DD-002 D3): both are standing background, but the declared preferences
+  // are platform-authored while session context is the embedder's overlay —
+  // the more specific overlay reads later and naturally refines.
+  if (input.declaredPreferences) {
+    prompt +=
+      "\n\n## Declared preferences\n\n" +
+      formatDeclaredPreferencesText(input.declaredPreferences);
+  }
+
   // Standing facts about the user (session context) come before the
   // carried conversation (bridge): the bridge may refer back to them.
   if (input.sessionContext) {

package/src/activities/execute-deep-agent/setup.ts

@@ -32,6 +32,7 @@ import {
   resolveCallerIdentity,
 } from "../../shared/caller-identity.js";
 import { readSessionContext } from "../../shared/session-context.js";
+import { readDeclaredPreferences } from "../../shared/declared-preferences.js";
 import { connectMcpServers, type McpConnectionResult } from "../../shared/mcp-manager.js";
 import { mergeMcpServerUsages, resolveMcpServers } from "../../shared/mcp-resolver.js";
 import { resolveMcpTransportPosture } from "../../shared/mcp-transport-guard.js";
@@ -72,6 +73,7 @@ import { getRunnerHitlMasterSecret } from "../../shared/fingerprint-secret.js";
 import { getModelPricing, ensureLoaded as ensurePricingLoaded } from "../../shared/model-pricing.js";
 import { getDefaultModel, getModelVisionCapability } from "../../shared/model-registry.js";
 import { buildChatModel } from "../../shared/model-client.js";
+import { resolveEffectiveServiceTier } from "../../shared/service-tier.js";
 import {
   loadArtifactStorageConfig,
   resolveUsableArtifactStorage,
@@ -87,12 +89,9 @@ import type { ToolApprovalCategory } from "../../shared/tool-kind.js";
 import {
   mergeSkillRefs,
   fetchSkillsByRefs,
-  writeSkills,
-  computeSkillPaths,
-  checkSkillIntegrity,
+  mountSkills,
   generatePromptSection,
   generateAlsoAvailableSection,
-  fetchSkillArtifacts,
 } from "../../shared/skill-writer.js";
 import { filterSkills, SKILL_COUNT_THRESHOLD } from "../../shared/skill-relevance.js";
 import { injectAttachments } from "./attachment-injector.js";
@@ -477,8 +476,11 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
       const skills = await fetchSkillsByRefs(client, skillRefs);
 
       if (skills.length > 0) {
-        const artifacts = await fetchSkillArtifacts(client, skills);
-        const { paths: skillPaths } = await writeSkills(skills, workspaceBackend, artifacts);
+        // platformDir is an invariant of this path: provisionWorkspace below
+        // threads ensurePlatformDir into every backend it constructs.
+        const { paths: skillPaths } = await mountSkills(
+          client, skills, workspaceBackend.platformDir!,
+        );
 
         const userMessage = execution.spec!.message || "";
         const skillNames = skills.map(s => s.spec?.name || s.metadata?.slug || "unknown");
@@ -572,6 +574,9 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
       contextBridge: readContextBridge(session.spec!.metadata),
       senderIdentity: readSenderIdentity(session.spec!.metadata),
       sessionContext: readSessionContext(session.spec!.metadata),
+      declaredPreferences: readDeclaredPreferences(
+        execution.spec!.declaredPreferences,
+      ),
     });
 
     // Step 9: Construct the LLM model. Resolution to the provider API id
@@ -580,11 +585,22 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
     // The operator's STIGMER_LLM_REQUEST_TIMEOUT_MS bound is applied inside
     // buildChatModel (#468) — the sub-agent modelFactory below silently
     // dropped it when each caller parsed the env itself.
+    //
+    // The service tier resolves ONCE here (UNSPECIFIED → explicit
+    // STANDARD, shared/service-tier.ts) and rides every model this
+    // execution constructs — the primary below AND the sub-agent factory —
+    // so the provider account's default can never pick the price of any
+    // turn (#361, the native half of #357's contract). Sub-agents inherit
+    // it because the tier is an attribute of the EXECUTION's bill, and
+    // sub-agent calls land on the same ledger.
+    const serviceTier = resolveEffectiveServiceTier(
+      execution.spec!.executionConfig?.serviceTier);
     const { model } = await buildChatModel({
       modelName,
       proxyEndpoint: config.proxyEndpoint ?? undefined,
       stigmerToken: config.stigmerToken ?? undefined,
       headerScope: { executionId },
+      serviceTier,
     });
     timing.mark("build_model");
 
@@ -594,16 +610,13 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
     const execConfig = execution.spec!.executionConfig;
     const isPlanMode = execConfig?.interactionMode === InteractionMode.PLAN;
     const shellEnv = isPlanMode ? undefined : buildShellEnv(envResult.mergedEnvVars);
-    // Plan mode's filesystem permission rules, hoisted once: the parent graph,
-    // every sub-agent graph, AND the path-normalization middleware (issue #429)
-    // all derive from this single value, so a rule-bearing graph can never miss
-    // the shim that keeps prompt-compliant relative paths from dying in rule
-    // validation (`path must be absolute`). Built from the same rootDir the
-    // backends and the shim resolve against, so the workspace read boundary
-    // (issue #528) and the paths it must admit agree by construction.
-    const planModePermissions = isPlanMode
-      ? buildPlanModePermissions(workspaceBackend.rootDir)
-      : undefined;
+    // Plan mode's filesystem permission rules, hoisted once: the parent graph
+    // and every sub-agent graph carry this single value. The rules are the
+    // write-deny half of plan mode only — the read boundary is structural
+    // (virtual-rooted backends, issue #754), and the path-normalization shim
+    // is no longer tied to the rules: every native graph installs it (see
+    // buildMiddlewareStack below) so the whole harness speaks one dialect.
+    const planModePermissions = isPlanMode ? buildPlanModePermissions() : undefined;
 
     const toolServerMap = new Map<string, string>();
     if (mcpConnection) {
@@ -717,9 +730,10 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
       } : null,
       otelSpans: { toolServerMap },
       approvalGate: approvalGateConfig,
-      pathNormalization: planModePermissions
-        ? { rootDir: workspaceBackend.rootDir }
-        : null,
+      // Every graph, every mode (issue #754): the dialect-repair seam that
+      // keeps model-supplied paths canonical for the virtual-rooted backend
+      // and every downstream consumer (gate, capture, spans).
+      pathNormalization: { rootDir: workspaceBackend.rootDir },
     });
     timing.mark("build_middleware");
 
@@ -776,6 +790,9 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
             proxyEndpoint: config.proxyEndpoint ?? undefined,
             stigmerToken: config.stigmerToken ?? undefined,
             headerScope: { executionId },
+            // The execution's tier, inherited: sub-agent calls bill to the
+            // same execution (#361 — see the Step 9 resolution comment).
+            serviceTier,
           })).model,
         // Presence of shellEnv is the shell-capability switch for sub-agent
         // backends too (undefined in plan mode; see buildShellEnv above).

package/src/activities/execute-deep-agent/shell-env.ts

@@ -1,19 +1,22 @@
 /**
  * Shell environment for the native harness `execute` tool.
  *
- * Per-execution snapshot: runner-manager rotates `STIGMER_TOKEN` in
- * `process.env` at runtime, so this must run inside setup for each execution,
- * never once at process start.
+ * Since #508's boot capture, runner secrets never LIVE in `process.env`, so
+ * the denylist below is defense-in-depth: it keeps this surface safe even if
+ * something re-plants a secret in the environment after boot (a test, an
+ * embedder, a future regression). Still built per execution — the snapshot
+ * must reflect the env as it is now, not at process start.
  */
 
-import { RUNNER_CREDENTIAL_ENV_KEYS } from "../../shared/runner-credential-keys.js";
+import { RUNNER_SECRET_ENV_KEYS } from "../../shared/runner-credential-keys.js";
 
 /**
  * Runner-internal keys that must never reach agent shell commands: every
- * credential the runner holds for its own outbound calls (issue #385). The
- * names — and the rule for adding one — live in runner-credential-keys.ts.
+ * credential the runner holds for its own outbound calls (issue #385) plus
+ * the runner's encryption keys (issue #508). The names — and the rules for
+ * adding one — live in runner-credential-keys.ts.
  */
-export const SHELL_ENV_DENYLIST: readonly string[] = RUNNER_CREDENTIAL_ENV_KEYS;
+export const SHELL_ENV_DENYLIST: readonly string[] = RUNNER_SECRET_ENV_KEYS;
 
 /**
  * Build the environment map passed to deepagents' LocalShellBackend.

package/src/activities/execute-deep-agent/subagent-transformer.ts

@@ -42,8 +42,7 @@ import { SubAgentGate } from "../../shared/subagent-gate.js";
 import { isModelRegistered } from "../../shared/model-registry.js";
 import {
   fetchSkillsByRefs,
-  fetchSkillArtifacts,
-  writeSkills,
+  mountSkills,
   generatePromptSection,
 } from "../../shared/skill-writer.js";
 
@@ -493,6 +492,10 @@ export function resolveSubagentSkillPrompt(
  *   (approval-gated by the sub-agent's own middleware). Absent (plan mode),
  *   the backend is filesystem-only — read-only by construction, matching the
  *   parent.
+ *
+ * Every variant is virtual-rooted (`virtualMode: true`) like the parent's —
+ * see the cas-capture-backend.ts header (issue #754): workspace confinement
+ * is structural on every graph, sub-agents included.
  */
 async function buildSubagentBackend(opts: {
   readonly workspaceRootDir: string;
@@ -508,11 +511,12 @@ async function buildSubagentBackend(opts: {
   }
 
   if (opts.shellEnv === undefined) {
-    return new FilesystemBackend({ rootDir: opts.workspaceRootDir });
+    return new FilesystemBackend({ rootDir: opts.workspaceRootDir, virtualMode: true });
   }
 
   const shellBackend = new LocalShellBackend({
     rootDir: opts.workspaceRootDir,
+    virtualMode: true,
     env: opts.shellEnv,
   });
   await shellBackend.initialize();
@@ -554,17 +558,14 @@ export async function compileSubagents(
       // Structural coupling (DD-19): a sub-agent gate flows gitignored writes into
       // CAS iff a CAS observer backs that sub-agent's filesystem backend. Deriving
       // both from the same `casObserver` makes "unobserved unreviewable bytes"
-      // impossible by construction. Same idiom for path normalization
-      // (issue #429): derived from the same `permissions` baked into the graph
-      // below, so a rule-bearing graph always carries the shim that keeps
-      // prompt-compliant relative paths from dying in rule validation.
+      // impossible by construction. Path normalization is unconditional
+      // (issue #754): every graph speaks the virtual dialect, so every graph
+      // carries the repair seam — matching the parent's composition.
       const middleware = buildSubAgentMiddleware({
         costCap: opts.costCap,
         approvalGate: opts.approvalGate,
         captureIgnored: !!opts.casObserver,
-        ...(opts.permissions?.length
-          ? { pathNormalization: { rootDir: opts.workspaceRootDir } }
-          : {}),
+        pathNormalization: { rootDir: opts.workspaceRootDir },
       });
 
       const modelName = spec.model ?? opts.parentModelName;
@@ -679,8 +680,14 @@ export async function transformAndCompileSubagents(
       const skills = await fetchSkillsByRefs(skillClient, refs);
 
       if (skills.length > 0) {
-        const artifacts = await fetchSkillArtifacts(skillClient, skills);
-        const { paths: skillPaths } = await writeSkills(skills, workspaceBackend, artifacts);
+        // Runs after the parent's setup step 7b mounted its skills, so any
+        // skill shared by parent and sub-agent is a cache hit here — the
+        // hash-keyed marker turns the old double download into a no-op.
+        // platformDir is an invariant: provisionWorkspace threads
+        // ensurePlatformDir into every backend it constructs.
+        const { paths: skillPaths } = await mountSkills(
+          skillClient, skills, workspaceBackend.platformDir!,
+        );
 
         for (const skill of skills) {
           const slug = (skill as { metadata?: { slug?: string } }).metadata?.slug;

package/src/activities/execute-deep-agent/subagent-wiring.ts

@@ -75,9 +75,9 @@ export interface SubAgentMiddlewareOptions {
    */
   readonly captureIgnored?: boolean;
   /**
-   * Workspace-relative path normalization (issue #429). Present iff this
-   * sub-agent's graph carries filesystem permission rules — the caller
-   * derives it from the same `permissions` value it bakes into the graph.
+   * Virtual-dialect path normalization (issues #429/#754). Present on every
+   * sub-agent graph — the backends are virtual-rooted, so every graph
+   * carries the repair seam, matching the parent composition.
    */
   readonly pathNormalization?: PathNormalizationConfig;
 }

package/src/config.ts

@@ -53,6 +53,7 @@ export const DEFAULT_CURSOR_AGENT_RESOLVE_TIMEOUT_MS = 120_000;
 // three construction sites — mirrors DEFAULT_CURSOR_STREAM_STALL_TIMEOUT_MS).
 export { DEFAULT_WORKSPACE_LOCK_TIMEOUT_MS } from "./shared/workspace/workspace-lock.js";
 import { DEFAULT_WORKSPACE_LOCK_TIMEOUT_MS } from "./shared/workspace/workspace-lock.js";
+import { getRunnerSecret } from "./shared/runner-credential-store.js";
 
 export interface Config {
   readonly taskQueue: string;
@@ -158,9 +159,13 @@ export function loadConfig(): Config {
       : requireEnv("STIGMER_BACKEND_ENDPOINT"),
   );
 
-  const stigmerToken = (mode === "cloud" || proxyActive)
-    ? requireEnv("STIGMER_TOKEN")
-    : (process.env.STIGMER_TOKEN ?? null);
+  // Secrets resolve through the credential store, not process.env — the
+  // boot capture has already moved them out of the environment (#508).
+  const stigmerTokenValue = getRunnerSecret("STIGMER_TOKEN");
+  if ((mode === "cloud" || proxyActive) && !stigmerTokenValue) {
+    throw new Error("Required environment variable STIGMER_TOKEN is not set");
+  }
+  const stigmerToken = stigmerTokenValue ?? null;
 
   const mcpBridgeEndpoint = process.env.STIGMER_MCP_BRIDGE_ENDPOINT ?? null;
 
@@ -170,8 +175,8 @@ export function loadConfig(): Config {
   // the SDK's authorization header (Cursor access token) passes through to
   // api2.cursor.sh unchanged.
   const cursorApiKey = proxyActive
-    ? (process.env.CURSOR_API_KEY ?? stigmerToken ?? "proxy-managed")
-    : (process.env.CURSOR_API_KEY ?? "");
+    ? (getRunnerSecret("CURSOR_API_KEY") ?? stigmerToken ?? "proxy-managed")
+    : (getRunnerSecret("CURSOR_API_KEY") ?? "");
 
   const workspaceRootDir = resolveWorkspaceRootDir();
 

package/src/encryption/config.ts

@@ -25,6 +25,8 @@
  * on the next runner boot — there is no live re-key.
  */
 
+import { getRunnerSecret } from "../shared/runner-credential-store.js";
+
 export interface EncryptionKey {
   readonly keyId: string;
   /** 32-byte AES-256 key. */
@@ -75,14 +77,18 @@ const AES_256_KEY_BYTES = 32;
 export function loadPayloadEncryptionConfig(
   bootstrap?: BootstrapKeyMaterial,
 ): PayloadEncryptionConfig | undefined {
-  const rawKey = process.env[KEY_ENV];
+  // Key VALUES resolve through the credential store (the #508 boot capture
+  // moves them out of process.env — agent shells must not read them); the
+  // *_KEY_ID companions are rotation bookkeeping, not secrets, and stay
+  // plain env reads.
+  const rawKey = getRunnerSecret(KEY_ENV);
   if (rawKey) {
     const primary: EncryptionKey = {
       keyId: requireKeyId(KEY_ID_ENV),
       key: parseKey(rawKey, KEY_ENV),
     };
 
-    const rawSecondary = process.env[SECONDARY_KEY_ENV];
+    const rawSecondary = getRunnerSecret(SECONDARY_KEY_ENV);
     const secondary: EncryptionKey | undefined = rawSecondary
       ? {
           keyId: requireKeyId(SECONDARY_KEY_ID_ENV),

package/src/index.ts

@@ -14,7 +14,7 @@
  * import { createStigmerRunner } from '@stigmer/runner';
  *
  * const runner = await createStigmerRunner({
- *   taskQueue: 'agent_execution_runner',
+ *   taskQueue: 'stigmer_runner',
  *   temporalAddress: 'localhost:7233',
  *   stigmerEndpoint: 'http://localhost:7234',
  * });

package/src/main.ts

@@ -32,6 +32,10 @@ import { createInterface } from "node:readline";
 import { preflightNodeRuntime } from "./preflight.js";
 import { markBoot, emitRunnerBootTiming } from "./shared/cold-start-timing.js";
 import { loadConfig } from "./config.js";
+import {
+  captureRunnerSecrets,
+  getRunnerSecret,
+} from "./shared/runner-credential-store.js";
 import { initTracing, initMetrics } from "./otel.js";
 import { createStigmerRunner } from "./runner.js";
 import { createStigmerRunnerManager } from "./runner-manager.js";
@@ -214,11 +218,12 @@ async function runPoolMode(
   });
 
   // Sandbox credential self-renewal (see sandbox-token-renewal.ts). Watches
-  // the env var because manager.updateToken keeps it in lockstep with the
-  // manager's internal ref: a blank member's pool_sandbox token parks the
-  // loop, the claim's updateToken swaps in a renewable session token, and
-  // from then on renewal applies fresh tokens back through the same
-  // updateToken (which also cascades to the proxy-credential coordinator).
+  // the credential store because manager.updateToken keeps it in lockstep
+  // with the manager's internal ref: a blank member's pool_sandbox token
+  // parks the loop, the claim's updateToken swaps in a renewable session
+  // token, and from then on renewal applies fresh tokens back through the
+  // same updateToken (which also cascades to the proxy-credential
+  // coordinator).
   const { startSandboxTokenRenewal } = await import("./sandbox-token-renewal.js");
   const { StigmerClient } = await import("./client/stigmer-client.js");
   const renewalClient = new StigmerClient({
@@ -226,7 +231,7 @@ async function runPoolMode(
     token: null,
   });
   const tokenRenewal = startSandboxTokenRenewal({
-    getToken: () => process.env.STIGMER_TOKEN ?? null,
+    getToken: () => getRunnerSecret("STIGMER_TOKEN") ?? null,
     renew: (currentToken) =>
       renewalClient.getRunnerScopedToken({ renewal: true }, currentToken),
     applyToken: (token) => manager.updateToken(token),
@@ -449,6 +454,11 @@ async function main(): Promise<void> {
 
   checkBuildFreshness();
 
+  // Take custody of runner secrets before the config load reads them (#508).
+  // The factories capture too (they are the library boot doors); doing it
+  // here as well keeps main.ts's own late readers store-only from the start.
+  captureRunnerSecrets();
+
   const config = loadConfig();
   markBoot("config_loaded");