@stigmer/runner 3.12.3 → 3.12.5

package/src/middleware/__tests__/path-normalization.test.ts

@@ -35,36 +35,47 @@ async function argsSeenByHandler(
 }
 
 describe("normalizeWorkspacePathArg", () => {
-  it("maps a workspace-relative path to its rootDir-joined absolute form", () => {
-    expect(normalizeWorkspacePathArg("src/main.py", ROOT)).toBe(`${ROOT}/src/main.py`);
+  it("maps a workspace-relative path to its virtual-absolute form", () => {
+    expect(normalizeWorkspacePathArg("src/main.py", ROOT)).toBe("/src/main.py");
   });
 
-  it("strips a leading ./ before joining", () => {
-    expect(normalizeWorkspacePathArg("./notes.md", ROOT)).toBe(`${ROOT}/notes.md`);
+  it("strips a leading ./ before rooting", () => {
+    expect(normalizeWorkspacePathArg("./notes.md", ROOT)).toBe("/notes.md");
   });
 
   it("handles multi-workspace entry-relative paths", () => {
     expect(normalizeWorkspacePathArg("entry-1/src/main.py", ROOT)).toBe(
-      `${ROOT}/entry-1/src/main.py`,
+      "/entry-1/src/main.py",
     );
   });
 
   it("resolves interior .. segments that stay inside the root", () => {
-    expect(normalizeWorkspacePathArg("src/../notes.md", ROOT)).toBe(`${ROOT}/notes.md`);
+    expect(normalizeWorkspacePathArg("src/../notes.md", ROOT)).toBe("/notes.md");
+    // Same repair on an already-virtual path: the virtual resolver rejects
+    // `..` outright, so the safe interior collapse happens at this seam.
+    expect(normalizeWorkspacePathArg("/src/../notes.md", ROOT)).toBe("/notes.md");
   });
 
-  it("leaves absolute paths untouched", () => {
+  it("maps a REAL-absolute in-root path to its virtual form (legacy-dialect compatibility)", () => {
+    expect(normalizeWorkspacePathArg(`${ROOT}/src/main.py`, ROOT)).toBe("/src/main.py");
+    // The root itself is the virtual root.
+    expect(normalizeWorkspacePathArg(ROOT, ROOT)).toBe("/");
+  });
+
+  it("leaves canonical virtual-absolute paths untouched", () => {
+    // In the virtual dialect these are already canonical names — "/etc/hosts"
+    // means the WORKSPACE's etc/hosts, not the host file.
     expect(normalizeWorkspacePathArg("/etc/hosts", ROOT)).toBeUndefined();
-    expect(normalizeWorkspacePathArg(`${ROOT}/src/main.py`, ROOT)).toBeUndefined();
     expect(normalizeWorkspacePathArg("/", ROOT)).toBeUndefined();
   });
 
   it("refuses to rewrite relatives that escape the workspace root", () => {
-    // A naive join would resolve `..` away and hand upstream validation a
-    // clean out-of-root absolute path — an out-of-root read that today's
-    // validation refuses. The guard keeps the refusal.
+    // posix.normalize would silently swallow a leading ".." on an absolute
+    // path — rewriting the call onto a DIFFERENT in-root file. The escape is
+    // detected in relative form and left raw for the upstream refusal.
     expect(normalizeWorkspacePathArg("../sibling/secret.txt", ROOT)).toBeUndefined();
     expect(normalizeWorkspacePathArg("src/../../escape.txt", ROOT)).toBeUndefined();
+    expect(normalizeWorkspacePathArg("/src/../../escape.txt", ROOT)).toBeUndefined();
   });
 
   it("leaves ~-carrying paths untouched (upstream refuses them either way)", () => {
@@ -84,7 +95,7 @@ describe("createPathNormalizationMiddleware", () => {
         file_path: "src/main.py",
         content: "x",
       });
-      expect(args.file_path).toBe(`${ROOT}/src/main.py`);
+      expect(args.file_path).toBe("/src/main.py");
       // Sibling args ride along untouched.
       expect(args.content).toBe("x");
     }
@@ -93,27 +104,26 @@ describe("createPathNormalizationMiddleware", () => {
   it("rewrites the base path on ls/glob/grep", async () => {
     for (const tool of ["ls", "glob", "grep"]) {
       const args = await argsSeenByHandler(tool, { path: "src", pattern: "**/*.py" });
-      expect(args.path).toBe(`${ROOT}/src`);
+      expect(args.path).toBe("/src");
       // The pattern is never a path — byte-untouched.
       expect(args.pattern).toBe("**/*.py");
     }
   });
 
-  it("passes absolute paths through byte-untouched", async () => {
+  it("passes canonical virtual paths through byte-untouched", async () => {
     const args = await argsSeenByHandler("read_file", { file_path: "/etc/hosts" });
     expect(args.file_path).toBe("/etc/hosts");
   });
 
-  it("supplies the workspace root when the base path is omitted on ls/glob/grep", async () => {
-    // Deliberate reversal of the original #429 pin ("leaves an omitted base
-    // path alone"): the tools' schema default is "/" — the OS ROOT under the
-    // legacy backend — applied inside the tool AFTER this seam, so under the
-    // #528 workspace read boundary an untouched omission would deny the bare
-    // first listing. The middleware fills the omission with the root it
-    // already knows.
+  it("leaves an omitted base path alone — the tools' '/' default IS the workspace root now", async () => {
+    // Deliberate reversal of the #528 injection: under the legacy backend the
+    // schema default "/" meant the OS ROOT, so the middleware had to fill the
+    // omission. Under the virtual root (issue #754) the default already means
+    // the workspace root — filling it would just duplicate the tool's own
+    // behavior.
     for (const tool of ["ls", "glob", "grep"]) {
       const args = await argsSeenByHandler(tool, { pattern: "TOKEN" });
-      expect(args.path).toBe(ROOT);
+      expect(args.path).toBeUndefined();
       expect(args.pattern).toBe("TOKEN");
     }
   });
@@ -125,16 +135,6 @@ describe("createPathNormalizationMiddleware", () => {
     expect(args.file_path).toBeUndefined();
   });
 
-  it("leaves an explicit '/' untouched on the dir tools — the rules answer it honestly", async () => {
-    // The model asked for the OS root; under plan mode's read boundary the
-    // honest answer is the rules' denial, not silently substituted workspace
-    // contents (the #429 never-convert-a-refusal-into-an-allowance doctrine).
-    for (const tool of ["ls", "glob", "grep"]) {
-      const args = await argsSeenByHandler(tool, { path: "/" });
-      expect(args.path).toBe("/");
-    }
-  });
-
   it("never touches tools outside the built-in filesystem set", async () => {
     // An MCP tool could plausibly carry a same-named arg with different
     // semantics; only the six built-in names are rewritten.

package/src/middleware/path-normalization.ts

@@ -1,55 +1,49 @@
 /**
- * Workspace-relative path normalization for permission-rule-bearing graphs
- * (issues #429, #528).
+ * Canonical virtual-path normalization for the native harness's built-in
+ * filesystem tools (issues #429, #528, #754).
  *
- * deepagents' permission enforcement canonicalizes tool-call paths BEFORE any
- * rule or backend runs, and its validation refuses non-absolute paths — on
- * EVERY filesystem tool call once a graph carries any permission rules, reads
- * included. Plan mode is the only rule-bearing production configuration
- * (shared/plan-mode-permissions.ts), so there a workspace-relative path —
- * the shape the multi-workspace prompt explicitly mandates, and one models
- * routinely choose in single-workspace sessions — fails with
- * `path must be absolute` instead of just working, burning tool rounds until
- * the model adapts by switching to absolute paths.
+ * The native harness speaks ONE path dialect end to end: the VIRTUAL ROOT,
+ * where "/" denotes the workspace root (backends are constructed with
+ * `virtualMode: true` — see execute-deep-agent/cas-capture-backend.ts). This
+ * middleware is the dialect-repair seam at the model boundary. It rewrites,
+ * on the deepagents built-in filesystem tools only:
  *
- * This middleware repairs the contract at our own seam: it rewrites
- * workspace-relative paths on the deepagents built-in filesystem tools to
- * workspace-absolute before the tool (and therefore enforcement) runs. The
- * write-deny rule then fires as designed and reads succeed on the first try.
- * Rule-less (act-mode) graphs never install it — the legacy backend already
- * resolves relative paths under the workspace root, so act mode keeps a
- * byte-zero delta.
+ *  - workspace-relative paths ("src/x.py", "./notes.md") to their virtual
+ *    absolute form ("/src/x.py") — deepagents' permission validation refuses
+ *    non-absolute shapes on rule-bearing graphs (plan mode), and the prompt
+ *    explicitly mandates entry-relative paths, so without this seam a
+ *    prompt-compliant call would die with `path must be absolute`;
+ *  - REAL-absolute paths under the workspace root ("{root}/src/x.py") to
+ *    their virtual form ("/src/x.py") — the compatibility mapping for the
+ *    pre-#754 dialect, where tool results and transcripts surfaced real
+ *    filesystem paths that a model may still echo back;
+ *  - interior `..` segments that stay inside the root ("src/../notes.md" →
+ *    "/notes.md") — the virtual resolver rejects `..` outright, so a safe
+ *    interior collapse is repaired here rather than burning a tool round.
  *
- * It also supplies the workspace root when `ls`/`glob`/`grep` are called
- * with NO path argument (issue #528). Those tools' schema default is "/" —
- * the OS ROOT under the legacy backend — and the default is applied inside
- * the tool, after this seam, so under the workspace read boundary a bare
- * first `ls` would otherwise die with `permission denied for read on /`
- * (the same first-turn degradation class #429 fixed). An EXPLICIT "/" is
- * deliberately NOT rewritten: the model asked for the OS root, and the
- * honest answer under plan mode's read boundary is the rules' denial —
- * silently substituting workspace contents would be an answer to a
- * different question.
+ * Nothing becomes newly reachable: escaping relatives ("../x") and
+ * `~`-carrying paths are left raw so the upstream refusal keeps speaking,
+ * and every rewritten path is workspace-confined by the virtual resolver
+ * regardless. The middleware converts false errors into correct behavior —
+ * never a refusal into an allowance.
  *
- * Invariant — nothing becomes newly reachable: only paths whose resolution
- * stays INSIDE the workspace root are rewritten. Escaping relatives (`../x`)
- * and `~`-carrying paths are left raw so today's validation refusal keeps
- * speaking (a naive join would resolve `..` away and smuggle an out-of-root
- * read past validation), and absolute paths pass through byte-untouched.
- * The middleware converts false errors into correct behavior — never a
- * refusal into an allowance the rules didn't decide. (The absent-path
- * injection honors the same line: it narrows the tool's own OS-root default
- * to the workspace, granting nothing the rules would refuse.)
+ * Installed on EVERY native graph (parent and sub-agent, act and plan mode)
+ * so all downstream consumers — the approval gate's capturability checks,
+ * the CAS observer, otel spans — observe one canonical dialect. The pre-#754
+ * version was installed only beside permission rules and also injected the
+ * workspace root when `ls`/`glob`/`grep` omitted their path (the tools'
+ * schema default "/" was the OS ROOT under the legacy backend); under the
+ * virtual root that default already MEANS the workspace root, so the
+ * injection is retired.
  *
  * Tool matching is by bare built-in name, the house doctrine (an MCP server
  * is not expected to shadow a built-in name — see shared/tool-kind.ts); the
  * rewrite touches only the tool's path-bearing argument, never glob/grep
  * patterns. Install FIRST in the stack so every downstream middleware
- * (approval gate, error hints, otel spans) observes canonical paths.
+ * observes canonical paths.
  */
 
-import { isAbsolute, relative } from "node:path";
-import { resolveWorkspacePath } from "../shared/file-change.js";
+import { isAbsolute, relative, posix } from "node:path";
 import type { StigmerMiddleware } from "./types.js";
 
 /**
@@ -66,55 +60,65 @@ const PATH_ARG_BY_TOOL: ReadonlyMap<string, string> = new Map([
   ["edit_file", "file_path"],
 ]);
 
-/**
- * The tools whose path argument is optional with an OS-root ("/") schema
- * default. When the model omits it, this middleware supplies the workspace
- * root instead (issue #528). The file tools are deliberately excluded: an
- * absent `file_path` is a genuine model error, and the tool's own input
- * validation gives the better message.
- */
-const DIR_DEFAULTING_TOOLS: ReadonlySet<string> = new Set(["ls", "glob", "grep"]);
-
 export interface PathNormalizationConfig {
-  /** The workspace root the graph's filesystem backend resolves against. */
+  /**
+   * The REAL workspace root the graph's backend is rooted at — used only for
+   * the legacy-dialect compatibility mapping (real-absolute in-root paths →
+   * virtual). The virtual rewrite itself needs no root.
+   */
   readonly rootDir: string;
 }
 
 /**
- * Rewrite `raw` to its workspace-absolute form, or return undefined when the
- * value must be left untouched (absolute already, `~`-carrying, or escaping
- * the workspace root). Exported for direct unit testing of the mapping table.
+ * Rewrite `raw` to its canonical virtual-absolute form, or return undefined
+ * when the value must be left untouched. Exported for direct unit testing of
+ * the mapping table.
+ *
+ * Left raw (undefined): empty strings, `~`-carrying paths (refused upstream
+ * in every mode), escaping relatives ("../x" — the refusal is the honest
+ * answer), real-absolute paths OUTSIDE the root (virtual dialect: they name
+ * an in-workspace path that simply does not exist — resolution answers
+ * honestly), and paths already in canonical virtual form.
  */
 export function normalizeWorkspacePathArg(
   raw: string,
   rootDir: string,
 ): string | undefined {
-  if (raw.length === 0 || isAbsolute(raw)) return undefined;
-  // Upstream validation refuses `~` segments even in absolute paths, so a
-  // rewrite could not make such a call succeed — leave the raw shape (and
-  // therefore the honest refusal) intact.
+  if (raw.length === 0) return undefined;
+  // Upstream validation refuses `~` segments in every position, and a rewrite
+  // could not make such a call succeed — leave the honest refusal intact.
   if (raw.split("/").includes("~")) return undefined;
 
-  const { absolutePath } = resolveWorkspacePath(raw, rootDir, false);
-
-  // No-new-reachability guard: `join` inside the resolver normalizes `..`
-  // segments away, so an escaping relative would otherwise pass upstream
-  // validation as a clean out-of-root absolute path. Today that shape is
-  // refused; keep it that way.
-  const rel = relative(rootDir, absolutePath);
-  if (rel.startsWith("..") || isAbsolute(rel)) return undefined;
-
-  return absolutePath;
+  // Legacy-dialect compatibility: a REAL absolute path under the workspace
+  // root maps to its virtual form. Any other absolute path is already a
+  // virtual-dialect name — reduced to relative form for canonicalization.
+  let candidate: string;
+  if (isAbsolute(raw)) {
+    const rel = relative(rootDir, raw);
+    if (rel === "") return "/";
+    candidate =
+      rel && !rel.startsWith("..") && !isAbsolute(rel)
+        ? rel
+        : raw.replace(/^\/+/, "");
+  } else {
+    candidate = raw;
+  }
+
+  // Canonicalize in RELATIVE form first: posix.normalize keeps a leading
+  // ".." on relative paths but silently swallows it on absolute ones, and a
+  // swallowed escape would rewrite the call onto a DIFFERENT in-root path —
+  // a refusal converted into an allowance. Detect the escape while it is
+  // still visible, and leave it raw for the upstream refusal.
+  const normalizedRel = posix.normalize(candidate);
+  if (normalizedRel === ".." || normalizedRel.startsWith("../")) return undefined;
+
+  const virtual = normalizedRel === "." ? "/" : `/${normalizedRel}`;
+  return virtual === raw ? undefined : virtual;
 }
 
 /**
- * Create middleware that normalizes workspace-relative paths on the built-in
- * filesystem tools before permission enforcement sees them.
- *
- * Installed only on graphs that carry filesystem permission rules — derive
- * the install condition from the same expression that supplies the rules
- * (setup.ts / compileSubagents) so the rules and their normalization shim
- * cannot drift apart.
+ * Create the dialect-repair middleware (see module header). Stateless per
+ * request; safe on every graph.
  */
 export function createPathNormalizationMiddleware(
   config: PathNormalizationConfig,
@@ -129,22 +133,6 @@ export function createPathNormalizationMiddleware(
       if (!argKey) return handler(request);
 
       const raw = request.toolCall.args[argKey];
-
-      // Absent base directory on ls/glob/grep: the middleware sees the
-      // model's raw args, BEFORE the tool's zod parse applies the "/"
-      // (OS root) schema default — so the omission must be filled here,
-      // where the workspace root is known. An explicit "/" is not this
-      // case and flows through to an honest rule denial (header doctrine).
-      if (raw == null && DIR_DEFAULTING_TOOLS.has(request.toolCall.name)) {
-        return handler({
-          ...request,
-          toolCall: {
-            ...request.toolCall,
-            args: { ...request.toolCall.args, [argKey]: rootDir },
-          },
-        });
-      }
-
       if (typeof raw !== "string") return handler(request);
 
       const normalized = normalizeWorkspacePathArg(raw, rootDir);

package/src/middleware/types.ts

@@ -117,9 +117,9 @@ export interface MiddlewareStackConfig {
   readonly otelSpans?: Partial<OtelSpansConfig>;
   readonly approvalGate?: ApprovalGateConfig | null;
   /**
-   * Workspace-relative path normalization (issue #429). Set iff the graph
-   * carries filesystem permission rules — derive from the same expression
-   * that supplies the rules so the two cannot drift apart.
+   * Virtual-dialect path normalization (issues #429/#754). Set on every
+   * native graph: the backends are virtual-rooted, so every graph carries
+   * the repair seam that keeps model-supplied paths canonical.
    */
   readonly pathNormalization?: PathNormalizationConfig | null;
 }

package/src/payload-codecs.ts

@@ -15,6 +15,7 @@
 import type { PayloadCodec } from "@temporalio/common";
 import type { Config } from "./config.js";
 import type { BootstrapKeyMaterial } from "./encryption/config.js";
+import { getRunnerSecret } from "./shared/runner-credential-store.js";
 
 export async function createPayloadCodecs(
   config: Config,
@@ -30,7 +31,7 @@ export async function createPayloadCodecs(
   const encryptionConfig = loadPayloadEncryptionConfig(bootstrapKeys);
   if (encryptionConfig) {
     codecs.push(new EncryptionPayloadCodec(encryptionConfig));
-    const source = process.env.STIGMER_PAYLOAD_ENCRYPTION_KEY ? "env" : "bootstrap";
+    const source = getRunnerSecret("STIGMER_PAYLOAD_ENCRYPTION_KEY") ? "env" : "bootstrap";
     console.log(
       `[runner] Payload encryption enabled (source=${source}, ` +
         `key_id=${encryptionConfig.primary.keyId}` +

package/src/runner-manager.ts

@@ -32,6 +32,11 @@ import type { WorkerActivities } from "./worker.js";
 import { resolveWorkflowSource, OTEL_WORKFLOW_INTERCEPTOR_MODULE } from "./workflow-source.js";
 import { resolveRunnerBootstrap, refreshRunnerAccessToken } from "./bootstrap.js";
 import { assertLlmBackendsPreflight } from "./preflight.js";
+import {
+  captureRunnerSecrets,
+  getRunnerSecret,
+  setRunnerSecret,
+} from "./shared/runner-credential-store.js";
 import { createRunnerTokenCoordinator } from "./runner-token-coordinator.js";
 // Per-task-queue in-flight activity tracking lives in ./in-flight.ts so the
 // activity interceptor (no manager-closure handle) and unit tests can reach it.
@@ -44,6 +49,10 @@ import {
   setQueueDrainCallback,
   forgetQueue,
 } from "./in-flight.js";
+import {
+  registerWorkerShutdownSignal,
+  unregisterWorkerShutdownSignal,
+} from "./shared/worker-shutdown.js";
 
 const SESSION_QUEUE_PREFIX = "session:";
 const WFEXEC_QUEUE_PREFIX = "wfexec:";
@@ -52,16 +61,10 @@ const WFEXEC_QUEUE_PREFIX = "wfexec:";
 // Mirrors SessionDispatchService's convention: lowercase kind, colon, id.
 const POOL_CONTROL_QUEUE_PREFIX = "sandbox:";
 
-/**
- * Module-level registry of shutdown signals per task queue.
- * Activities running in the same process can read this to determine
- * whether their worker is being shut down (vs orchestrator pause).
- */
-const _shutdownSignalRegistry = new Map<string, AbortSignal>();
-
-export function getShutdownSignalForQueue(taskQueue: string): AbortSignal | undefined {
-  return _shutdownSignalRegistry.get(taskQueue);
-}
+// Re-export for existing importers; the registry itself lives in
+// shared/worker-shutdown.ts so the static runner (runner.ts) and the
+// activities can share it without importing this manager module.
+export { getShutdownSignalForQueue } from "./shared/worker-shutdown.js";
 
 export interface RunnerManagerOptions {
   /**
@@ -214,6 +217,12 @@ export async function createStigmerRunnerManager(
 ): Promise<StigmerRunnerManager> {
   validateManagerOptions(options);
 
+  // Take custody of runner secrets BEFORE anything else can read them from
+  // env — and before any agent code could spawn with them (#508). Runs here
+  // (not only in main.ts) because this factory is a public library boot door:
+  // in-process embedders like the desktop never execute main.ts.
+  captureRunnerSecrets();
+
   const { registerStigmerDeepagentsProfiles } = await import(
     "./activities/execute-deep-agent/deepagents-profiles.js"
   );
@@ -365,7 +374,7 @@ export async function createStigmerRunnerManager(
   if (
     !bootstrap.payloadEncryption &&
     bootstrap.runnerAccessToken &&
-    !process.env.STIGMER_PAYLOAD_ENCRYPTION_KEY
+    !getRunnerSecret("STIGMER_PAYLOAD_ENCRYPTION_KEY")
   ) {
     console.warn(
       "[runner-manager] Server minted a runner token but returned no payload " +
@@ -400,15 +409,12 @@ export async function createStigmerRunnerManager(
 
   const sessions = new Map<string, ManagedSession>();
   const workflowExecutions = new Map<string, ManagedSession>();
-  const shutdownSignals = new Map<string, AbortController>();
   // At most one per process: a pool member IS its control worker's identity.
   let poolControl: { taskQueue: string; managed: ManagedSession } | null = null;
   let shuttingDown = false;
 
   async function createWorkerOnQueue(taskQueue: string): Promise<ManagedSession> {
-    const shutdownController = new AbortController();
-    shutdownSignals.set(taskQueue, shutdownController);
-    _shutdownSignalRegistry.set(taskQueue, shutdownController.signal);
+    const shutdownController = registerWorkerShutdownSignal(taskQueue);
 
     const worker = await Worker.create({
       connection,
@@ -470,8 +476,7 @@ export async function createStigmerRunnerManager(
     managed.worker.shutdown();
     await managed.runPromise;
     registry.delete(id);
-    shutdownSignals.delete(taskQueue);
-    _shutdownSignalRegistry.delete(taskQueue);
+    unregisterWorkerShutdownSignal(taskQueue);
     forgetQueue(taskQueue);
     console.log(`[runner-manager] Removed ${kind} ${id} (active=${registry.size})`);
   }
@@ -530,6 +535,13 @@ export async function createStigmerRunnerManager(
       await removeManaged(
         sessions, sessionId, SESSION_QUEUE_PREFIX + sessionId, "session",
       );
+      // The session is done on this host — release its parked agent (and
+      // the executor + MCP subprocesses the lease pins) immediately rather
+      // than waiting out the idle TTL (#215).
+      const { evictSessionAgent } = await import(
+        "./activities/execute-cursor/agent-session-cache.js"
+      );
+      evictSessionAgent(sessionId);
     },
 
     activeSessions(): string[] {
@@ -585,12 +597,11 @@ export async function createStigmerRunnerManager(
       // proxy credential follows it: only when no token has been minted (so the
       // pre-mint lockstep is preserved), never once the runner owns a minted
       // token. See runner-token-coordinator.ts and the staleness changelogs.
+      // The credential store is the second leg of the pair (it replaced the
+      // process.env.STIGMER_TOKEN write, #508): per-call readers like
+      // call-llm and the registry headers resolve the current token there.
       tokenRef.current = token;
-      if (token) {
-        process.env.STIGMER_TOKEN = token;
-      } else {
-        delete process.env.STIGMER_TOKEN;
-      }
+      setRunnerSecret("STIGMER_TOKEN", token);
       tokenCoordinator.onControlPlaneTokenChanged(token);
       console.log("[runner-manager] Auth token updated");
     },
@@ -603,6 +614,22 @@ export async function createStigmerRunnerManager(
         `[runner-manager] Shutting down ${totalWorkers} workers (${sessions.size} sessions, ${workflowExecutions.size} workflow executions)...`,
       );
 
+      // Mark every queue's shutdown signal BEFORE draining, so an in-flight
+      // activity cancelled by the drain classifies it as a worker shutdown
+      // rather than a user pause (issue #776 — a SIGTERM'd pool member used
+      // to persist EXECUTION_PAUSED and let raw Temporal drain text reach
+      // status.error). Aborting is classification-only: it stops nothing;
+      // worker.shutdown() below still owns the drain. This is deliberately
+      // NOT done in teardownManaged — single-worker teardowns only run once
+      // the queue is idle, and aborting there is the old view-close bug.
+      for (const session of sessions.values()) {
+        session.shutdownController.abort();
+      }
+      for (const execution of workflowExecutions.values()) {
+        execution.shutdownController.abort();
+      }
+      poolControl?.managed.shutdownController.abort();
+
       const shutdownPromises = [
         ...Array.from(sessions.entries()).map(
           async ([id, session]) => {
@@ -629,6 +656,12 @@ export async function createStigmerRunnerManager(
       }
 
       await Promise.all(shutdownPromises);
+      // Workers are drained — release every parked session agent so their
+      // executor leases dispose (stdio MCP subprocesses die with them) (#215).
+      const { closeAllCachedAgents } = await import(
+        "./activities/execute-cursor/agent-session-cache.js"
+      );
+      closeAllCachedAgents();
       sessions.clear();
       workflowExecutions.clear();
       poolControl = null;

package/src/runner.ts

@@ -20,6 +20,10 @@ import { DEFAULT_CURSOR_AGENT_RESOLVE_TIMEOUT_MS, DEFAULT_CURSOR_STREAM_STALL_TI
 import type { WorkerActivities } from "./worker.js";
 import { resolveRunnerBootstrap } from "./bootstrap.js";
 import { assertLlmBackendsPreflight } from "./preflight.js";
+import {
+  captureRunnerSecrets,
+  setRunnerSecret,
+} from "./shared/runner-credential-store.js";
 import { markBoot, emitRunnerBootTiming } from "./shared/cold-start-timing.js";
 
 /**
@@ -118,11 +122,12 @@ export interface StigmerRunner {
  * Wire up self-renewal for a static cloud sandbox's control-plane credential
  * (see sandbox-token-renewal.ts for the model). The applied token reaches
  * every consumer: activity gRPC clients read {@code tokenRef} per request,
- * env-reading call sites (call-llm, registry-endpoint) read
- * {@code process.env.STIGMER_TOKEN} per call, artifact storage resolves the
- * ref per call, and the two Cursor SDK interceptors are updated directly —
- * a static runner has no {@code RunnerTokenCoordinator} minting a separate
- * proxy credential, so its x-stigmer-auth IS this token.
+ * per-call sites (call-llm, registry-endpoint headers) resolve it through
+ * the runner credential store (which replaced the process.env.STIGMER_TOKEN
+ * channel, #508), artifact storage resolves the ref per call, and the two
+ * Cursor SDK interceptors are updated directly — a static runner has no
+ * {@code RunnerTokenCoordinator} minting a separate proxy credential, so its
+ * x-stigmer-auth IS this token.
  */
 async function startStaticSandboxTokenRenewal(
   config: Config,
@@ -157,7 +162,9 @@ async function startStaticSandboxTokenRenewal(
       client.getRunnerScopedToken({ renewal: true }, currentToken),
     applyToken: (token) => {
       tokenRef.current = token;
-      process.env.STIGMER_TOKEN = token;
+      // Store write replaced the process.env.STIGMER_TOKEN write (#508) —
+      // same per-call readers (call-llm, registry headers), no env exposure.
+      setRunnerSecret("STIGMER_TOKEN", token);
       updateInterceptorToken(token);
       updateHttp2InterceptorToken(token);
     },
@@ -190,6 +197,12 @@ export async function createStigmerRunner(
 ): Promise<StigmerRunner> {
   validateOptions(options);
 
+  // Take custody of runner secrets BEFORE anything else can read them from
+  // env — and before any agent code could spawn with them (#508). Runs here
+  // (not only in main.ts) because this factory is a public library boot door
+  // for in-process embedders.
+  captureRunnerSecrets();
+
   const { registerStigmerDeepagentsProfiles } = await import(
     "./activities/execute-deep-agent/deepagents-profiles.js"
   );
@@ -311,6 +324,16 @@ export async function createStigmerRunner(
   // unaffected — their env-injected platform key wins inside the loader.
   const payloadCodecs = await createPayloadCodecs(config, coordinates.payloadEncryption);
 
+  // Register the queue's shutdown signal BEFORE the worker can poll, so an
+  // activity interrupted by shutdown() below classifies the cancellation as a
+  // worker shutdown, not a user pause (issue #776). Static mode historically
+  // never registered one, leaving CLI daemons with the same misclassification
+  // the desktop manager had.
+  const { registerWorkerShutdownSignal } = await import(
+    "./shared/worker-shutdown.js"
+  );
+  const shutdownController = registerWorkerShutdownSignal(config.taskQueue);
+
   const { startWorker } = await import("./worker.js");
   const worker = await startWorker({ config, activities, payloadCodecs });
   markBoot("worker_created");
@@ -327,9 +350,19 @@ export async function createStigmerRunner(
       emitRunnerBootTiming({ task_queue: config.taskQueue, mode: config.mode });
       await worker.run();
       console.log("Worker stopped");
+      // The worker has drained — release any parked session agent so its
+      // executor lease disposes with the process (#215).
+      const { closeAllCachedAgents } = await import(
+        "./activities/execute-cursor/agent-session-cache.js"
+      );
+      closeAllCachedAgents();
     },
     shutdown() {
       tokenRenewal?.stop();
+      // Classification first, drain second: an in-flight activity cancelled
+      // by the drain must observe the signal already aborted (see
+      // shared/worker-shutdown.ts for the ownership contract).
+      shutdownController.abort();
       worker.shutdown();
     },
   };