@stigmer/runner 3.12.3 → 3.12.5

package/src/shared/__tests__/artifact-storage.test.ts

@@ -618,6 +618,22 @@ describe("createArtifactStorage", () => {
     };
     expect(() => createArtifactStorage(cfg)).toThrow("STIGMER_TOKEN");
   });
+
+  it("throws for the deliberate 'none' posture — resolveUsable degrades it, claimcheck fail-hards", async () => {
+    const cfg: ArtifactStorageConfig = {
+      type: "none",
+      localPath: "/tmp/artifacts",
+      localServeUrl: "http://localhost:7235",
+      proxyEndpoint: null,
+      proxyAuthToken: null,
+    };
+    expect(() => createArtifactStorage(cfg)).toThrow(/deliberately disabled/i);
+    // The capture/offload resolver treats it as the first-class absent store:
+    // deny-gate mode, not a crash.
+    await expect(
+      resolveUsableArtifactStorage(cfg, { executionId: "exec-none" }),
+    ).resolves.toBeUndefined();
+  });
 });
 
 describe("loadArtifactStorageConfig", () => {
@@ -680,6 +696,18 @@ describe("loadArtifactStorageConfig", () => {
     expect(cfg.proxyAuthToken).toBe("tok");
   });
 
+  it("honors ARTIFACT_STORAGE_TYPE=none even when a proxy endpoint is configured", () => {
+    // "none" is a deliberate operator/e2e posture — it must beat the
+    // storage-follows-transport default exactly like the other overrides.
+    process.env.ARTIFACT_STORAGE_TYPE = "none";
+    const cfg = loadArtifactStorageConfig({
+      ...baseConfig,
+      proxyEndpoint: "https://proxy.example.com",
+      stigmerToken: "tok",
+    });
+    expect(cfg.type).toBe("none");
+  });
+
   it("respects ARTIFACT_STORAGE_TYPE override", () => {
     process.env.ARTIFACT_STORAGE_TYPE = "proxy";
     const cfg = loadArtifactStorageConfig({

package/src/shared/__tests__/bedrock-seam.test.ts

@@ -2,11 +2,11 @@
  * Characterization test for the ChatAnthropic `createClient` ->
  * AnthropicBedrock seam — the integration the T04 bedrock backend adapter
  * is built on. Sibling of vertex-seam.test.ts; same rules: this pins REAL
- * cross-package behavior (`@langchain/anthropic` bundling @anthropic-ai/sdk
- * 0.95.x driving `@anthropic-ai/bedrock-sdk` bundling its own nested
- * >=0.115 copy), so a future bump of either side fails here in CI instead
- * of in production. See scripts/check-langchain-deps.sh for why the two
- * @anthropic-ai/sdk versions coexist and when they collapse to one.
+ * cross-package behavior (`@langchain/anthropic` driving
+ * `@anthropic-ai/bedrock-sdk`, both resolving the single override-pinned
+ * @anthropic-ai/sdk copy), so a future bump of either side fails here in
+ * CI instead of in production. See scripts/check-langchain-deps.sh for
+ * the override rationale and the single-copy invariant it guards.
  *
  * Determinism: zero live credentials, zero network. SigV4 signing runs for
  * real — it is pure HMAC over static test keys passed through the SDK's

package/src/shared/__tests__/declared-preferences.test.ts

@@ -0,0 +1,109 @@
+/**
+ * Unit tests for the declared-preferences module (stigmer/stigmer#293,
+ * DD-002). Like conversation-catchup there is no string key to mirror-guard —
+ * the value rides the typed `AgentExecutionSpec.declared_preferences` proto
+ * field, so codegen enforces the cross-repo contract. What IS pinned here:
+ * the per-scope blank-is-absent read semantics (the server stamps the field
+ * on EVERY eligible create, usually with blank scopes), the per-scope
+ * attribution, and the framing's behavioral contract.
+ */
+
+import { describe, it, expect } from "vitest";
+import { create } from "@bufbuild/protobuf";
+import { DeclaredPreferencesSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/spec_pb";
+
+import {
+  formatDeclaredPreferencesText,
+  readDeclaredPreferences,
+} from "../declared-preferences.js";
+
+const ORG_CONTEXT = "We deploy to us-east-1. All costs in USD.";
+const USER_CONTEXT = "Keep answers terse. Prefer Go examples.";
+
+describe("readDeclaredPreferences", () => {
+  it("reads both scopes when both are set", () => {
+    const preferences = create(DeclaredPreferencesSchema, {
+      orgContext: ORG_CONTEXT,
+      userContext: USER_CONTEXT,
+    });
+    expect(readDeclaredPreferences(preferences)).toEqual({
+      orgContext: ORG_CONTEXT,
+      userContext: USER_CONTEXT,
+    });
+  });
+
+  it("answers undefined when the field is absent (pre-#293 executions)", () => {
+    expect(readDeclaredPreferences(undefined)).toBeUndefined();
+  });
+
+  it("answers undefined when both scopes are blank — the server stamps the field on every eligible create", () => {
+    const preferences = create(DeclaredPreferencesSchema, {
+      orgContext: "  ",
+      userContext: "",
+    });
+    expect(readDeclaredPreferences(preferences)).toBeUndefined();
+  });
+
+  it("blank-is-absent applies per scope: an org-only snapshot carries no user scope", () => {
+    const preferences = create(DeclaredPreferencesSchema, {
+      orgContext: ORG_CONTEXT,
+      userContext: "   ",
+    });
+    expect(readDeclaredPreferences(preferences)).toEqual({
+      orgContext: ORG_CONTEXT,
+      userContext: undefined,
+    });
+  });
+
+  it("trims surrounding whitespace from each scope", () => {
+    const preferences = create(DeclaredPreferencesSchema, {
+      orgContext: "  org facts  ",
+      userContext: "\nuser facts\n",
+    });
+    expect(readDeclaredPreferences(preferences)).toEqual({
+      orgContext: "org facts",
+      userContext: "user facts",
+    });
+  });
+});
+
+describe("formatDeclaredPreferencesText", () => {
+  it("frames the preferences as already-known, non-announced background", () => {
+    const framed = formatDeclaredPreferencesText({
+      orgContext: ORG_CONTEXT,
+      userContext: USER_CONTEXT,
+    });
+
+    expect(framed).toContain("Standing preferences declared by");
+    expect(framed).toContain("Do not repeat them back");
+    expect(framed).toContain("not instructions that override your task");
+  });
+
+  it("attributes each scope explicitly, organization first, user last", () => {
+    const framed = formatDeclaredPreferencesText({
+      orgContext: ORG_CONTEXT,
+      userContext: USER_CONTEXT,
+    });
+
+    const org = framed.indexOf("Declared by the organization:");
+    const user = framed.indexOf("Declared by the user:");
+    expect(org).toBeGreaterThan(-1);
+    expect(user).toBeGreaterThan(org);
+    expect(framed).toContain(ORG_CONTEXT);
+    expect(framed.endsWith(USER_CONTEXT)).toBe(true);
+  });
+
+  it("renders only the org subsection for an org-only snapshot", () => {
+    const framed = formatDeclaredPreferencesText({ orgContext: ORG_CONTEXT });
+
+    expect(framed).toContain("Declared by the organization:");
+    expect(framed).not.toContain("Declared by the user:");
+  });
+
+  it("renders only the user subsection for a user-only snapshot", () => {
+    const framed = formatDeclaredPreferencesText({ userContext: USER_CONTEXT });
+
+    expect(framed).not.toContain("Declared by the organization:");
+    expect(framed).toContain("Declared by the user:");
+  });
+});

package/src/shared/__tests__/foundry-seam.test.ts

@@ -3,11 +3,11 @@
  * AnthropicFoundry seam — the integration the T05 foundry backend adapter
  * is built on. Sibling of vertex-seam.test.ts and bedrock-seam.test.ts;
  * same rules: this pins REAL cross-package behavior (`@langchain/anthropic`
- * bundling @anthropic-ai/sdk 0.95.x driving `@anthropic-ai/foundry-sdk`
- * bundling its own nested >=0.115 copy), so a future bump of either side
- * fails here in CI instead of in production. See
- * scripts/check-langchain-deps.sh for why the two @anthropic-ai/sdk
- * versions coexist and when they collapse to one.
+ * driving `@anthropic-ai/foundry-sdk`, both resolving the single
+ * override-pinned @anthropic-ai/sdk copy), so a future bump of either
+ * side fails here in CI instead of in production. See
+ * scripts/check-langchain-deps.sh for the override rationale and the
+ * single-copy invariant it guards.
  *
  * Determinism: zero live credentials, zero network. API-key auth is a
  * static test key; Entra ID auth is a fake `azureADTokenProvider` (the

package/src/shared/__tests__/model-client.test.ts

@@ -23,6 +23,7 @@ vi.mock("@langchain/openai", () => ({
 
 import { buildChatModel } from "../model-client.js";
 import { _resetRegistryCache } from "../model-registry.js";
+import { ServiceTier } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 
 interface MockModel {
   id: string;
@@ -306,6 +307,18 @@ describe("buildChatModel", () => {
       expect(lastAnthropicArgs().apiKey).toBe("");
     });
 
+    it("does NOT send service_tier on a backend adapter — tiers are Anthropic-first-party billing, and Vertex/Bedrock/Foundry have no tier dimension", async () => {
+      mockRegistryResponse([
+        { id: "claude-sonnet-4.6", apiModelId: "claude-sonnet-4-6", provider: "anthropic" },
+      ]);
+
+      await buildChatModel({ modelName: "claude-sonnet-4.6", serviceTier: ServiceTier.STANDARD });
+
+      const args = lastAnthropicArgs();
+      expect(typeof args.createClient).toBe("function");
+      expect(args).not.toHaveProperty("invocationKwargs");
+    });
+
     it("yields to the proxy: a proxied call never consults the backend var", async () => {
       mockRegistryResponse([
         { id: "claude-sonnet-4.6", apiModelId: "claude-sonnet-4-6", provider: "anthropic" },
@@ -359,4 +372,90 @@ describe("buildChatModel", () => {
     await expect(buildChatModel({ modelName: "claude-sonnet-4.6" }))
       .rejects.toThrow(/STIGMER_ANTHROPIC_BACKEND="verteks" is not a supported backend/);
   });
+
+  describe("service tier (stigmer/stigmer#361)", () => {
+    // The #357 contract on the native harness: when the caller passes the
+    // execution's effective tier, every provider request pins it
+    // explicitly, so the provider ACCOUNT's default can never pick the
+    // price. Each provider has its own spelling; both are pinned here so
+    // a wrapper upgrade that moves the slot fails loudly.
+
+    it("OpenAI: STANDARD pins service_tier 'default' — never 'auto', which would re-open the account-default hole", async () => {
+      mockRegistryResponse([
+        { id: "gpt-4.1", apiModelId: "gpt-4.1", provider: "openai" },
+      ]);
+
+      await buildChatModel({ modelName: "gpt-4.1", serviceTier: ServiceTier.STANDARD });
+
+      const args = mockOpenAICtor.mock.calls.at(-1)?.[0] as Record<string, unknown>;
+      expect(args).toMatchObject({ service_tier: "default" });
+    });
+
+    it("OpenAI: FAST pins service_tier 'priority'", async () => {
+      mockRegistryResponse([
+        { id: "gpt-4.1", apiModelId: "gpt-4.1", provider: "openai" },
+      ]);
+
+      await buildChatModel({ modelName: "gpt-4.1", serviceTier: ServiceTier.FAST });
+
+      const args = mockOpenAICtor.mock.calls.at(-1)?.[0] as Record<string, unknown>;
+      expect(args).toMatchObject({ service_tier: "priority" });
+    });
+
+    it("Anthropic: STANDARD rides invocationKwargs as 'standard_only' — priority capacity is never consumed implicitly", async () => {
+      mockRegistryResponse([
+        { id: "claude-haiku-4.5", apiModelId: "claude-haiku-4-5-20251001", provider: "anthropic" },
+      ]);
+
+      await buildChatModel({ modelName: "claude-haiku-4.5", serviceTier: ServiceTier.STANDARD });
+
+      expect(lastAnthropicArgs()).toMatchObject({
+        invocationKwargs: { service_tier: "standard_only" },
+      });
+    });
+
+    it("Anthropic: FAST rides invocationKwargs as 'auto' — use purchased priority capacity when available", async () => {
+      mockRegistryResponse([
+        { id: "claude-haiku-4.5", apiModelId: "claude-haiku-4-5-20251001", provider: "anthropic" },
+      ]);
+
+      await buildChatModel({ modelName: "claude-haiku-4.5", serviceTier: ServiceTier.FAST });
+
+      expect(lastAnthropicArgs()).toMatchObject({
+        invocationKwargs: { service_tier: "auto" },
+      });
+    });
+
+    it("an omitted tier sends NO tier parameter on either provider — platform-internal utility calls stay untiered", async () => {
+      mockRegistryResponse([
+        { id: "gpt-4.1", apiModelId: "gpt-4.1", provider: "openai" },
+      ]);
+      await buildChatModel({ modelName: "gpt-4.1" });
+      const openAiArgs = mockOpenAICtor.mock.calls.at(-1)?.[0] as Record<string, unknown>;
+      expect(openAiArgs).not.toHaveProperty("service_tier");
+
+      mockRegistryResponse([
+        { id: "claude-haiku-4.5", apiModelId: "claude-haiku-4-5-20251001", provider: "anthropic" },
+      ]);
+      await buildChatModel({ modelName: "claude-haiku-4.5" });
+      expect(lastAnthropicArgs()).not.toHaveProperty("invocationKwargs");
+    });
+
+    it("the tier rides the proxy path too — the request body parameter is what the proxy meters", async () => {
+      mockRegistryResponse([
+        { id: "claude-haiku-4.5", apiModelId: "claude-haiku-4-5-20251001", provider: "anthropic" },
+      ]);
+
+      await buildChatModel({
+        modelName: "claude-haiku-4.5",
+        proxyEndpoint: "https://api.stigmer.ai",
+        stigmerToken: "token",
+        serviceTier: ServiceTier.STANDARD,
+      });
+
+      expect(lastAnthropicArgs()).toMatchObject({
+        invocationKwargs: { service_tier: "standard_only" },
+      });
+    });
+  });
 });

package/src/shared/__tests__/plan-mode-permissions.test.ts

@@ -1,58 +1,29 @@
 /**
- * Unit pins for the plan-mode rule builder (issue #528).
+ * Unit pins for the plan-mode rule builder.
  *
- * The rule ORDER and SHAPE are the security boundary: deepagents evaluates
- * first-match-wins with a permissive default, so the workspace read-allow
- * must precede the read-deny, and the deny patterns must be the match-all
- * "/**". These tests pin the built value; the boundary's end-to-end
- * behavior (including matcher semantics for escaped roots and symlinked
- * platform paths) is pinned against the real deepagents runtime in
+ * Since issue #754 the rules carry ONLY plan mode's write-deny: the read
+ * boundary is structural (virtual-rooted backends confine every path to the
+ * workspace), so there is no workspace-root glob, no escaping, and no rule
+ * ordering left to protect. The single rule's SHAPE is still the security
+ * boundary for writes — "/**" must stay the match-all virtual pattern and
+ * the operation class must stay `write` (deepagents evaluates
+ * first-match-wins with a permissive default, so reads flow by omission).
+ * End-to-end behavior is pinned against the real deepagents runtime in
  * execute-deep-agent/__tests__/plan-mode-path-normalization.test.ts.
  */
 
 import { describe, it, expect } from "vitest";
-import {
-  buildPlanModePermissions,
-  escapeGlobLiteral,
-} from "../plan-mode-permissions.js";
+import { buildPlanModePermissions } from "../plan-mode-permissions.js";
 
 describe("buildPlanModePermissions", () => {
-  it("builds the policy in enforcement order: workspace read-allow, then read-deny, then write-deny", () => {
-    expect(buildPlanModePermissions("/ws/session-1/repo")).toEqual([
-      { operations: ["read"], paths: ["/ws/session-1/repo/**"] },
-      { operations: ["read"], paths: ["/**"], mode: "deny" },
+  it("builds exactly the write-deny policy in the virtual dialect", () => {
+    expect(buildPlanModePermissions()).toEqual([
       { operations: ["write"], paths: ["/**"], mode: "deny" },
     ]);
   });
 
-  it("canonicalizes the root before building the pattern", () => {
-    // Enforcement canonicalizes incoming paths (no trailing separator,
-    // collapsed slashes) before matching — a pattern built from a raw
-    // trailing-slash root would silently match nothing.
-    const [allow] = buildPlanModePermissions("/ws//session-1/repo/");
-    expect(allow.paths).toEqual(["/ws/session-1/repo/**"]);
-  });
-
-  it("glob-escapes the root so special characters match literally", () => {
-    const [allow] = buildPlanModePermissions("/Users/x/My (work) [v2]");
-    expect(allow.paths).toEqual(["/Users/x/My \\(work\\) \\[v2\\]/**"]);
-  });
-});
-
-describe("escapeGlobLiteral", () => {
-  it("escapes every micromatch metacharacter", () => {
-    expect(escapeGlobLiteral("a*b?c(d)e[f]g{h}i!j+k@l")).toBe(
-      "a\\*b\\?c\\(d\\)e\\[f\\]g\\{h\\}i\\!j\\+k\\@l",
-    );
-  });
-
-  it("escapes backslashes themselves", () => {
-    expect(escapeGlobLiteral("a\\b")).toBe("a\\\\b");
-  });
-
-  it("leaves plain path characters alone", () => {
-    expect(escapeGlobLiteral("/ws/session-1/repo.dir")).toBe(
-      "/ws/session-1/repo.dir",
-    );
+  it("carries no read rules — the read boundary is structural, not policy", () => {
+    const operations = buildPlanModePermissions().flatMap((rule) => rule.operations);
+    expect(operations).not.toContain("read");
   });
 });

package/src/shared/__tests__/runner-credential-store.test.ts

@@ -0,0 +1,155 @@
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import {
+  captureRunnerSecrets,
+  getRunnerSecret,
+  setRunnerSecret,
+  runnerSecretsEnvView,
+  resetRunnerSecretsForTests,
+} from "../runner-credential-store.js";
+import {
+  RUNNER_CREDENTIAL_ENV_KEYS,
+  RUNNER_ENCRYPTION_ENV_KEYS,
+  RUNNER_SECRET_ENV_KEYS,
+} from "../runner-credential-keys.js";
+
+/** Snapshot/restore of every env slot these tests touch. */
+const savedEnv = new Map<string, string | undefined>();
+
+beforeEach(() => {
+  resetRunnerSecretsForTests();
+  for (const key of RUNNER_SECRET_ENV_KEYS) {
+    savedEnv.set(key, process.env[key]);
+    delete process.env[key];
+  }
+});
+
+afterEach(() => {
+  resetRunnerSecretsForTests();
+  for (const [key, value] of savedEnv) {
+    if (value === undefined) {
+      delete process.env[key];
+    } else {
+      process.env[key] = value;
+    }
+  }
+  savedEnv.clear();
+});
+
+describe("captureRunnerSecrets", () => {
+  it("moves every listed secret out of process.env and into the store", () => {
+    // Plant a value for every name in the source-of-truth list, so a key
+    // added to runner-credential-keys.ts is covered here automatically —
+    // the #385 test idiom, applied to custody.
+    for (const key of RUNNER_SECRET_ENV_KEYS) {
+      process.env[key] = `boot-${key}`;
+    }
+
+    captureRunnerSecrets();
+
+    for (const key of RUNNER_SECRET_ENV_KEYS) {
+      expect(
+        process.env[key],
+        `'${key}' must not remain in process.env after capture — anything ` +
+        `left there is readable by every agent shell command (issue #508)`,
+      ).toBeUndefined();
+      expect(getRunnerSecret(key)).toBe(`boot-${key}`);
+    }
+  });
+
+  it("is idempotent — a second capture cannot re-freeze rotated values", () => {
+    process.env.STIGMER_TOKEN = "boot-token";
+    captureRunnerSecrets();
+    setRunnerSecret("STIGMER_TOKEN", "rotated-token");
+
+    // A late (buggy or racing) boot-door call must be a no-op.
+    process.env.STIGMER_TOKEN = "stale-replant";
+    captureRunnerSecrets();
+
+    expect(getRunnerSecret("STIGMER_TOKEN")).toBe("rotated-token");
+    // The replant stays in env (capture did not consume it) — the live-env
+    // fallback below deliberately does NOT apply when the store holds a
+    // value, so rotation always wins.
+    expect(process.env.STIGMER_TOKEN).toBe("stale-replant");
+    delete process.env.STIGMER_TOKEN;
+  });
+
+  it("scrubs the encryption keys, not only the #385 credentials (issue #508)", () => {
+    // Pins the #508 scope widening by name. The parameterized test above
+    // would pass even if the combined list regressed to the 8 credentials;
+    // this one cannot.
+    for (const key of [
+      "STIGMER_PAYLOAD_ENCRYPTION_KEY",
+      "STIGMER_PAYLOAD_ENCRYPTION_SECONDARY_KEY",
+    ]) {
+      expect(RUNNER_ENCRYPTION_ENV_KEYS, `'${key}' must be a captured secret`).toContain(key);
+    }
+    for (const key of [...RUNNER_CREDENTIAL_ENV_KEYS, ...RUNNER_ENCRYPTION_ENV_KEYS]) {
+      expect(RUNNER_SECRET_ENV_KEYS, `'${key}' must be in the scrub list`).toContain(key);
+    }
+  });
+});
+
+describe("getRunnerSecret", () => {
+  it("falls back to a live process.env value the capture never saw", () => {
+    captureRunnerSecrets();
+    // Custody rule 2: a value planted after boot behaves like the env read
+    // the store replaced (test/embedder compatibility) — production only
+    // sets these at process start, so this path is dead there.
+    process.env.STIGMER_TOKEN = "late-planted";
+
+    expect(getRunnerSecret("STIGMER_TOKEN")).toBe("late-planted");
+  });
+
+  it("returns undefined for an absent secret", () => {
+    captureRunnerSecrets();
+    expect(getRunnerSecret("STIGMER_TOKEN")).toBeUndefined();
+  });
+});
+
+describe("setRunnerSecret", () => {
+  it("carries the rotation channel: set updates, null clears", () => {
+    captureRunnerSecrets();
+
+    setRunnerSecret("STIGMER_TOKEN", "minted-1");
+    expect(getRunnerSecret("STIGMER_TOKEN")).toBe("minted-1");
+
+    setRunnerSecret("STIGMER_TOKEN", "minted-2");
+    expect(getRunnerSecret("STIGMER_TOKEN")).toBe("minted-2");
+
+    setRunnerSecret("STIGMER_TOKEN", null);
+    expect(getRunnerSecret("STIGMER_TOKEN")).toBeUndefined();
+  });
+
+  it("never lets a rotated value sit in process.env, even if a writer beats the boot capture", () => {
+    process.env.STIGMER_TOKEN = "boot-token";
+
+    // No captureRunnerSecrets() call yet — the writer forces it.
+    setRunnerSecret("STIGMER_TOKEN", "rotated-early");
+
+    expect(process.env.STIGMER_TOKEN).toBeUndefined();
+    expect(getRunnerSecret("STIGMER_TOKEN")).toBe("rotated-early");
+  });
+});
+
+describe("runnerSecretsEnvView", () => {
+  it("merges captured secrets over process.env without writing them back", () => {
+    process.env.STIGMER_TOKEN = "boot-token";
+    captureRunnerSecrets();
+
+    const view = runnerSecretsEnvView();
+
+    expect(view.STIGMER_TOKEN).toBe("boot-token");
+    expect(view.PATH).toBe(process.env.PATH);
+    expect(
+      process.env.STIGMER_TOKEN,
+      "building the view must not re-plant secrets into process.env",
+    ).toBeUndefined();
+  });
+
+  it("reflects rotation", () => {
+    captureRunnerSecrets();
+    setRunnerSecret("STIGMER_TOKEN", "rotated");
+
+    expect(runnerSecretsEnvView().STIGMER_TOKEN).toBe("rotated");
+  });
+});