@stigmer/runner 3.12.3 → 3.12.5

package/src/shared/model-client.ts

@@ -34,6 +34,12 @@ import {
   toFoundryDeploymentName,
 } from "./llm-backend.js";
 import { resolveToApiModelId } from "./model-registry.js";
+import {
+  toAnthropicServiceTier,
+  toOpenAiServiceTier,
+  type EffectiveServiceTier,
+} from "./service-tier.js";
+import { getRunnerSecret } from "./runner-credential-store.js";
 
 export interface BuildChatModelOptions {
   /** Registry id ("claude-haiku-4.5"), "provider:model", or a provider API id. */
@@ -63,6 +69,20 @@ export interface BuildChatModelOptions {
    */
   readonly timeoutMs?: number;
   readonly maxRetries?: number;
+  /**
+   * The execution's EFFECTIVE service tier (stigmer/stigmer#361) — already
+   * resolved by the caller (resolveEffectiveServiceTier), never
+   * UNSPECIFIED. When set, every provider request pins its tier explicitly
+   * (OpenAI `service_tier`; Anthropic `service_tier` via invocationKwargs)
+   * so the provider ACCOUNT's default can never pick the price — the #357
+   * contract, held on the native harness. Deliberately optional:
+   * platform-internal utility calls (tool-approval classification, session
+   * subjects, structured extraction, workflow llm_call) are not the
+   * execution's own turns and send no tier — the provider treats an absent
+   * parameter as its standard behavior, and those calls' models are
+   * platform-chosen economy models.
+   */
+  readonly serviceTier?: EffectiveServiceTier;
 }
 
 /**
@@ -128,11 +148,11 @@ export async function buildChatModel(opts: BuildChatModelOptions): Promise<Built
   // tests. Prerequisites are re-checked here (not only in
   // the factories' preflight) so paths that construct models without a
   // runner factory still fail at dispatch with the catalog message instead
-  // of mid-request. Credentials are read natively by each SDK from its
-  // standard conventions (GCP: CLOUD_ML_REGION + ADC; AWS: AWS_REGION +
-  // the credential chain / AWS_BEARER_TOKEN_BEDROCK; Foundry:
-  // ANTHROPIC_FOUNDRY_API_KEY, or the Azure credential chain when no key
-  // is set).
+  // of mid-request. Ambient credentials are read natively by each SDK from
+  // its standard conventions (GCP: CLOUD_ML_REGION + ADC; AWS: AWS_REGION +
+  // the credential chain); runner-held keys (AWS_BEARER_TOKEN_BEDROCK,
+  // ANTHROPIC_FOUNDRY_API_KEY) are passed explicitly from the credential
+  // store because the boot capture empties their env slots (#508).
   let backendCreateClient:
     | ((options: { maxRetries?: number; timeout?: number }) => unknown)
     | undefined;
@@ -149,8 +169,17 @@ export async function buildChatModel(opts: BuildChatModelOptions): Promise<Built
     const prereq = checkBedrockPrerequisites();
     if (prereq !== null) throw new Error(prereq);
     const { AnthropicBedrock } = await import("@anthropic-ai/bedrock-sdk");
+    // The SDK's own default for `apiKey` is process.env.AWS_BEARER_TOKEN_BEDROCK,
+    // which the boot capture has emptied (#508) — hand it the stored value
+    // explicitly. `undefined` when absent preserves the SDK's fallthrough to
+    // the ambient AWS credential chain (env keys, IRSA, config files).
+    const bedrockBearerToken = getRunnerSecret("AWS_BEARER_TOKEN_BEDROCK");
     backendCreateClient = (options) =>
-      new AnthropicBedrock({ maxRetries: options.maxRetries, timeout: options.timeout });
+      new AnthropicBedrock({
+        apiKey: bedrockBearerToken,
+        maxRetries: options.maxRetries,
+        timeout: options.timeout,
+      });
     wireModelId = toBedrockModelId(apiModelId);
     if (maxTokens === undefined) {
       // LangChain's per-model maxTokens table prefix-matches the model
@@ -179,8 +208,13 @@ export async function buildChatModel(opts: BuildChatModelOptions): Promise<Built
     // so refreshed tokens flow without reconstruction (pinned by
     // foundry-seam.test.ts). Endpoint (resource or base URL) and the key
     // are read natively by the SDK from its own env vars.
+    // The SDK's own default for `apiKey` is process.env.ANTHROPIC_FOUNDRY_API_KEY,
+    // which the boot capture has emptied (#508) — resolve it from the store
+    // and hand it over explicitly. The either/or stays intact: exactly one of
+    // apiKey / azureADTokenProvider reaches the constructor.
+    const foundryApiKey = getRunnerSecret("ANTHROPIC_FOUNDRY_API_KEY")?.trim() || undefined;
     let azureADTokenProvider: (() => Promise<string>) | undefined;
-    if (!process.env.ANTHROPIC_FOUNDRY_API_KEY?.trim()) {
+    if (!foundryApiKey) {
       const { DefaultAzureCredential, getBearerTokenProvider } = await import("@azure/identity");
       azureADTokenProvider = getBearerTokenProvider(
         new DefaultAzureCredential(),
@@ -191,7 +225,7 @@ export async function buildChatModel(opts: BuildChatModelOptions): Promise<Built
       new AnthropicFoundry({
         maxRetries: options.maxRetries,
         timeout: options.timeout,
-        ...(azureADTokenProvider ? { azureADTokenProvider } : {}),
+        ...(foundryApiKey ? { apiKey: foundryApiKey } : { azureADTokenProvider }),
       });
     // Unlike the vertex/bedrock ids, the deployment name needs no maxTokens
     // handling: stripping the snapshot date preserves LangChain's per-model
@@ -207,19 +241,27 @@ export async function buildChatModel(opts: BuildChatModelOptions): Promise<Built
     ? buildProxyHeaders(opts.stigmerToken, opts.headerScope ?? {})
     : undefined;
 
-  // Proxy mode authenticates with the Stigmer token; direct mode falls back to
-  // the provider's own env-var key.
+  // Proxy mode authenticates with the Stigmer token; direct mode falls back
+  // to the provider's own key, resolved from the credential store (the boot
+  // capture moved it out of process.env, #508).
   const apiKey = opts.proxyEndpoint
     ? (opts.stigmerToken ?? "proxy-managed")
     : provider === "openai"
-      ? (process.env.OPENAI_API_KEY ?? "")
-      : (process.env.ANTHROPIC_API_KEY ?? "");
+      ? (getRunnerSecret("OPENAI_API_KEY") ?? "")
+      : (getRunnerSecret("ANTHROPIC_API_KEY") ?? "");
 
+  // maxRetries applies when a timeout is bound (a retry loop under a bound
+  // multiplies the wall-clock budget) or when the caller pinned it
+  // explicitly (call-llm hands retry ownership to Temporal, #686). Callers
+  // that set neither keep LangChain's default retry behavior unchanged.
+  const maxRetries = timeoutMs !== undefined || opts.maxRetries !== undefined
+    ? { maxRetries: opts.maxRetries ?? 0 }
+    : {};
   const common = {
     temperature: opts.temperature ?? 0,
     apiKey,
     ...(maxTokens ? { maxTokens } : {}),
-    ...(timeoutMs ? { maxRetries: opts.maxRetries ?? 0 } : {}),
+    ...maxRetries,
   };
 
   // The request timeout lives in a different slot per wrapper: ChatOpenAI
@@ -242,6 +284,18 @@ export async function buildChatModel(opts: BuildChatModelOptions): Promise<Built
       ? { clientOptions: anthropicClientOptions }
       : {};
 
+  // The tier rides the request body per provider dialect (#361): OpenAI
+  // takes `service_tier` as a first-class constructor field; ChatAnthropic
+  // has no such field, so it rides `invocationKwargs`, which the wrapper
+  // spreads into every request body. Both spellings resolve through the
+  // shared mapping so no construction site can invent a third one.
+  const openAiServiceTierField = opts.serviceTier !== undefined
+    ? { service_tier: toOpenAiServiceTier(opts.serviceTier) }
+    : {};
+  const anthropicServiceTierField = opts.serviceTier !== undefined
+    ? { invocationKwargs: { service_tier: toAnthropicServiceTier(opts.serviceTier) } }
+    : {};
+
   // The two SDKs name the transport-override block differently (OpenAI:
   // `configuration`, Anthropic: `clientOptions`) — encapsulating that here is
   // the whole point, since the shape mismatch is where bugs used to hide.
@@ -249,6 +303,7 @@ export async function buildChatModel(opts: BuildChatModelOptions): Promise<Built
     ? new ChatOpenAI({
         model: apiModelId,
         ...common,
+        ...openAiServiceTierField,
         ...(timeoutMs ? { timeout: timeoutMs } : {}),
         ...(baseUrl || headers
           ? {
@@ -266,6 +321,13 @@ export async function buildChatModel(opts: BuildChatModelOptions): Promise<Built
         // provided) is what lets this construct with no ANTHROPIC_API_KEY.
         // (Backend mode never has a proxy — see the precedence rule above —
         // so the clientOptions here carry at most the timeout.)
+        //
+        // service_tier deliberately does NOT ride backend requests:
+        // standard/priority tiers are an Anthropic-FIRST-PARTY billing
+        // concept, and Vertex/Bedrock/Foundry bill through the cloud
+        // provider with no tier dimension — an unknown body param there is
+        // a request refusal waiting to happen. The account-default price
+        // hole this parameter closes does not exist on those backends.
         new ChatAnthropic({
           model: wireModelId,
           ...common,
@@ -275,6 +337,7 @@ export async function buildChatModel(opts: BuildChatModelOptions): Promise<Built
       : new ChatAnthropic({
           model: apiModelId,
           ...common,
+          ...anthropicServiceTierField,
           ...anthropicClientOptionsField,
         });
 

package/src/shared/placeholder-resolver.ts

@@ -1,8 +1,10 @@
 /**
  * Strict placeholder resolver for ${VAR_NAME} syntax in MCP server configs.
  *
+ * Port of the Python agent-runner's PlaceholderResolver (strict mode only).
  * Always raises on unresolved placeholders — sending literal ${VAR} as an
- * HTTP header value produces cryptic auth failures from the remote server.
+ * HTTP header value (e.g. Authorization: Bearer ${API_KEY}) produces
+ * cryptic auth failures from the remote server.
  */
 
 const PLACEHOLDER_RE = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
@@ -41,6 +43,9 @@ export function resolvePlaceholders(
 
 /**
  * Resolve placeholders in all values of a headers map.
+ *
+ * @throws PlaceholderResolutionError if any header value contains an
+ *   unresolvable placeholder.
  */
 export function resolveHeaders(
   headers: Record<string, string>,
@@ -55,7 +60,9 @@ export function resolveHeaders(
 
 /**
  * Filter env vars to only keys declared in the MCP server's spec.env.
- * Prevents secret over-sharing by restricting the environment to
+ *
+ * Mirrors the agent-runner's _filter_env_to_declared_keys: prevents
+ * secret over-sharing by restricting the subprocess/HTTP environment to
  * explicitly declared variables.
  */
 export function filterEnvToDeclaredKeys(

package/src/shared/plan-mode-permissions.ts

@@ -2,26 +2,25 @@
  * The Plan-mode filesystem permission rules — the enforcement twin of
  * `plan-mode-prompt.ts` (which carries the instruction half of the contract).
  *
- * Plan mode is contained BY CONSTRUCTION on the native harness: these rules
- * deny every filesystem write everywhere AND scope reads to the session
- * workspace (issue #528 — owner ruling: the workspace is plan mode's read
- * boundary on cloud and desktop runners alike). Without the read boundary,
- * model-provided absolute paths reached anywhere the process account could
- * read — the pod filesystem (including /proc/self/environ) on cloud runners,
- * the user's whole home directory on desktop — while plan mode still carries
- * exfiltration-capable tools (web_fetch, MCP). Rules are first-match-wins
- * with a permissive default (deepagents' decidePathAccess), so order is
- * load-bearing: the workspace read-allow must precede the read-deny.
+ * Plan mode's policy is: reads anywhere in the workspace, writes nowhere.
+ * Only the write half needs a RULE. The read boundary that issue #528 built
+ * out of rules (workspace read-allow + read-deny, glob-escaped real root) is
+ * now STRUCTURAL: every native-harness backend is virtual-rooted
+ * (`virtualMode: true` — see cas-capture-backend.ts, issue #754), so every
+ * path a tool can express resolves inside the workspace root and traversal
+ * is rejected at resolution. A rule cannot widen that, and no workspace-root
+ * glob is needed to narrow it — which also retires the whole
+ * special-characters-in-the-root hazard (`escapeGlobLiteral` and its
+ * end-to-end matcher suite) that the real-path rules carried.
  *
- * The workspace-root pattern is matched as a STRING against the raw tool-call
- * path (micromatch, dot:true), before the backend touches disk. That is
- * exactly why the legitimate out-of-workspace reads keep working: skills,
- * attachments, and the approved plan live in the platform dir but are
- * addressed through the `{workspace}/.stigmer` symlink (see
- * shared/workspace/stigmer-link.ts), so their path strings are in-root even
- * though the bytes are not. The same holds for multi-workspace local entries
- * (`{workspace}/{name}` symlinks). A realpath-based boundary would break
- * both; do not "harden" this into one.
+ * Paths in these rules are VIRTUAL: "/" is the workspace root, matched by
+ * micromatch against the raw tool-call path (dot:true) after the
+ * path-normalization middleware has canonicalized it (relative → "/"-rooted;
+ * see middleware/path-normalization.ts). The legitimate platform-dir reads
+ * (skills, attachments, the approved plan) keep working exactly as before:
+ * they are addressed through the `{workspace}/.stigmer` symlink
+ * (shared/workspace/stigmer-link.ts), an in-root path string in either
+ * dialect.
  *
  * Applied in execute-deep-agent/setup.ts to the parent graph AND threaded
  * into every compiled sub-agent graph: deepagents' parent-permission
@@ -30,13 +29,6 @@
  * (issue #255). Kept as its own side-effect-free module so tests can pin the
  * production rules without dragging in setup.ts's import graph.
  *
- * Rules travel with a companion: every graph that carries them also installs
- * the path-normalization middleware (middleware/path-normalization.ts,
- * issues #429/#528), because deepagents' rule validation refuses
- * workspace-relative paths outright and its `ls`/`glob`/`grep` schema default
- * of "/" would deny the bare first listing. Both are derived from the same
- * expression at each composition site so they cannot drift apart.
- *
  * Invariant: never combine these rules with a shell-capable (sandbox)
  * backend — deepagents rejects that pairing at graph construction (see the
  * cas-capture-backend.ts header). Plan mode guarantees it by construction:
@@ -44,41 +36,18 @@
  * for shell capability on both the parent and sub-agent backends.
  */
 
-import { resolve } from "node:path";
 import type { FilesystemPermission } from "deepagents";
 
 /**
- * Backslash-escape every character micromatch/picomatch treats as glob
- * syntax, so the result matches the input literally. micromatch exports no
- * escape API of its own, and this is correctness, not caution: an unescaped
- * `(` in a desktop project path would make the workspace read-allow rule
- * silently never match — bricking every plan-mode read for that workspace.
- * Semantics are pinned end-to-end through deepagents' own matcher by the
- * special-character workspace suite in plan-mode-path-normalization.test.ts.
- */
-export function escapeGlobLiteral(literal: string): string {
-  return literal.replace(/[\\*?()[\]{}!+@]/g, "\\$&");
-}
-
-/**
- * Build the plan-mode rule set for a graph whose filesystem backend is
- * rooted at `workspaceRootDir`. The three rules read as the policy:
- * reads allowed in the workspace, reads denied everywhere else, writes
- * denied everywhere.
+ * Build the plan-mode rule set. One rule IS the policy: writes denied
+ * everywhere ("/**" is every virtual path; deepagents evaluates
+ * first-match-wins with a permissive default, so reads stay allowed —
+ * workspace-confined structurally, not by rule).
  *
- * `{root}/**` matches the root itself as well as its subtree (verified
- * against the installed micromatch), so one allow pattern suffices. The
- * root is `path.resolve`d first because enforcement canonicalizes incoming
- * paths (collapsed slashes, no trailing separator) before matching — a
- * trailing slash in the pattern would silently match nothing.
+ * Deliberately parameterless: the pre-#754 signature took the workspace root
+ * to build a real-path read fence; resurrecting a root-derived rule would
+ * silently mismatch the virtual dialect the enforcement now sees.
  */
-export function buildPlanModePermissions(
-  workspaceRootDir: string,
-): FilesystemPermission[] {
-  const canonicalRoot = resolve(workspaceRootDir);
-  return [
-    { operations: ["read"], paths: [`${escapeGlobLiteral(canonicalRoot)}/**`] },
-    { operations: ["read"], paths: ["/**"], mode: "deny" },
-    { operations: ["write"], paths: ["/**"], mode: "deny" },
-  ];
+export function buildPlanModePermissions(): FilesystemPermission[] {
+  return [{ operations: ["write"], paths: ["/**"], mode: "deny" }];
 }

package/src/shared/registry-endpoint.ts

@@ -21,6 +21,7 @@
 
 import { normalizeEndpoint } from "../config.js";
 import type { FetchRetryPolicy } from "./http-retry.js";
+import { runnerSecretsEnvView } from "./runner-credential-store.js";
 
 /** Default local stigmer-server origin — mirrors config.ts's local-mode default. */
 const DEFAULT_LOCAL_BACKEND = "http://localhost:7234";
@@ -68,8 +69,15 @@ export function resolveRegistryBaseUrl(env: NodeJS.ProcessEnv = process.env): st
 /**
  * Build request headers for registry fetches: bearer auth when a token is
  * present (cloud requires it; the local server ignores it).
+ *
+ * The default env is the credential-store view, not bare `process.env`:
+ * both token names are captured out of the environment at boot (#508), and
+ * the store also carries rotated tokens (manager updateToken / static
+ * renewal) that never touch env at all.
  */
-export function buildRegistryHeaders(env: NodeJS.ProcessEnv = process.env): Record<string, string> {
+export function buildRegistryHeaders(
+  env: NodeJS.ProcessEnv = runnerSecretsEnvView(),
+): Record<string, string> {
   const token = env.STIGMER_TOKEN ?? env.STIGMER_AUTH_TOKEN;
   return token ? { Authorization: `Bearer ${token}` } : {};
 }

package/src/shared/runner-credential-keys.ts

@@ -10,7 +10,13 @@
  * their sanctioned delivery channel, and denying them here would break it.
  *
  * Consumers:
- * - shell-env.ts: SHELL_ENV_DENYLIST for the native harness `execute` tool.
+ * - runner-credential-store.ts: captures every name listed in this module
+ *   out of `process.env` at boot (issue #508 — the Cursor SDK's local agent
+ *   runtime runs in-process and its shell tool spawns from the runner's own
+ *   env, so credentials must not LIVE there; see that module for custody
+ *   rules).
+ * - shell-env.ts: SHELL_ENV_DENYLIST for the native harness `execute` tool
+ *   (defense-in-depth behind the boot scrub).
  * - mcp-manager.test.ts: leak-tripwire canaries for MCP stdio subprocesses
  *   (that path passes NO runner env by construction; the test plants these
  *   names to prove none leak through).
@@ -44,3 +50,32 @@ export const RUNNER_CREDENTIAL_ENV_KEYS: readonly string[] = [
   // (llm-backend.ts documents it as a supported auth path).
   "AWS_BEARER_TOKEN_BEDROCK",
 ];
+
+/**
+ * Env var names of the runner's non-credential secrets — material that is
+ * not an outbound-call credential (so it does not belong in
+ * {@link RUNNER_CREDENTIAL_ENV_KEYS}, whose inclusion rule is pinned above)
+ * but is every bit as sensitive in an agent-readable environment
+ * (owner ruling on #508: same boot scrub, separate constant so the #385
+ * rule keeps its meaning).
+ *
+ * The `*_KEY_ID` companions are deliberately absent: key identifiers are
+ * rotation bookkeeping, not secrets.
+ */
+export const RUNNER_ENCRYPTION_ENV_KEYS: readonly string[] = [
+  // Temporal payload-encryption keys (encryption/config.ts). An agent that
+  // reads these could decrypt the runner's Temporal history payloads.
+  "STIGMER_PAYLOAD_ENCRYPTION_KEY",
+  "STIGMER_PAYLOAD_ENCRYPTION_SECONDARY_KEY",
+];
+
+/**
+ * Every env name whose VALUE the credential store takes custody of at boot:
+ * the #385 credential set plus the #508 encryption-key set. This is the
+ * scrub list — after `captureRunnerSecrets()`, none of these names remain
+ * in `process.env`.
+ */
+export const RUNNER_SECRET_ENV_KEYS: readonly string[] = [
+  ...RUNNER_CREDENTIAL_ENV_KEYS,
+  ...RUNNER_ENCRYPTION_ENV_KEYS,
+];

package/src/shared/runner-credential-store.ts

@@ -0,0 +1,115 @@
+/**
+ * Custody point for the runner's own secrets — the VALUES companion to
+ * runner-credential-keys.ts's names (issue #508).
+ *
+ * Why this exists: the Cursor SDK's local agent runtime ships inside
+ * `@cursor/sdk` and runs IN-PROCESS in the runner. Its shell tool spawns
+ * bash with `{...process.env, ...}` and its git layer does the same, so
+ * anything living in the runner's `process.env` is readable by every shell
+ * command the agent runs — and the SDK exposes no env option for local
+ * agents to scrub at the spawn boundary. Denylists on runner-owned spawn
+ * sites (shell-env.ts) cannot reach those vendor spawns. The only fix that
+ * covers every spawn surface, present and future, is for secrets not to
+ * LIVE in `process.env` at all: this module captures them at boot and is
+ * the sole holder afterwards.
+ *
+ * Custody rules:
+ *
+ *  1. `captureRunnerSecrets()` runs at every boot door (both public runner
+ *     factories, plus main() for symmetry) — it MOVES every
+ *     {@link RUNNER_SECRET_ENV_KEYS} value out of `process.env` into a
+ *     module-private map. Idempotent; first call wins.
+ *  2. Reads go through {@link getRunnerSecret}: captured value first, live
+ *     `process.env` as fallback. The fallback keeps the store honest rather
+ *     than frozen — production sets these vars only at process start (the
+ *     capture window), so the fallback is a dead path there, but tests and
+ *     unusual embedders that plant a value later see it behave exactly like
+ *     the env read it replaced.
+ *  3. Rotation writes go through {@link setRunnerSecret} (the
+ *     runner-manager/static-renewal token channel that previously wrote
+ *     `process.env.STIGMER_TOKEN` in lockstep with its tokenRef).
+ *  4. {@link runnerSecretsEnvView} adapts the store to the codebase's
+ *     `env: NodeJS.ProcessEnv` injection seams (llm-backend,
+ *     registry-endpoint). The view re-merges secrets over `process.env` —
+ *     it exists for in-process CONFIG READS ONLY and must never be handed
+ *     to a child process env or any spawn options.
+ *
+ * Embedder note: `@stigmer/runner` is a public library, and capture runs
+ * inside the factories, so embedding the runner scrubs the HOST process's
+ * env of runner secrets at boot. That is the point — agent shells run in
+ * the embedder's process — and host code that still needs a value reads it
+ * through this module.
+ */
+
+import { RUNNER_SECRET_ENV_KEYS } from "./runner-credential-keys.js";
+
+const captured = new Map<string, string>();
+let captureRan = false;
+
+/**
+ * Move every {@link RUNNER_SECRET_ENV_KEYS} value out of `process.env` into
+ * the store. Idempotent — only the first call captures, so a late caller
+ * cannot re-freeze values that rotation has since replaced.
+ */
+export function captureRunnerSecrets(): void {
+  if (captureRan) return;
+  captureRan = true;
+  for (const name of RUNNER_SECRET_ENV_KEYS) {
+    const value = process.env[name];
+    if (value !== undefined) {
+      captured.set(name, value);
+      delete process.env[name];
+    }
+  }
+}
+
+/**
+ * Read a runner secret: captured value first, live `process.env` fallback
+ * (see custody rule 2). Returns `undefined` when the secret is absent —
+ * callers own their missing-secret reaction, exactly as with the env reads
+ * this replaces.
+ */
+export function getRunnerSecret(name: string): string | undefined {
+  return captured.get(name) ?? process.env[name];
+}
+
+/**
+ * Write (or with `null`, clear) a runner secret — the rotation channel.
+ * Ensures capture has run first so a rotated value can never sit in
+ * `process.env` because a writer beat the boot capture.
+ */
+export function setRunnerSecret(name: string, value: string | null): void {
+  captureRunnerSecrets();
+  if (value === null) {
+    captured.delete(name);
+  } else {
+    captured.set(name, value);
+  }
+}
+
+/**
+ * `process.env` with the captured secrets merged back over it — an adapter
+ * for the `env: NodeJS.ProcessEnv` injection seams so their defaults stay
+ * secret-aware after the boot scrub.
+ *
+ * IN-PROCESS CONFIG READS ONLY: never pass this to a spawn/exec env, a
+ * worker thread, or anything else that leaves the process — doing so would
+ * reopen exactly the leak the store closes.
+ */
+export function runnerSecretsEnvView(): NodeJS.ProcessEnv {
+  const view: NodeJS.ProcessEnv = { ...process.env };
+  for (const [name, value] of captured) {
+    view[name] = value;
+  }
+  return view;
+}
+
+/**
+ * Test-only: forget everything captured and re-arm capture. Unit tests that
+ * plant secret env vars and boot pieces of the runner need each test to see
+ * its own values.
+ */
+export function resetRunnerSecretsForTests(): void {
+  captured.clear();
+  captureRan = false;
+}

package/src/shared/service-tier.ts

@@ -0,0 +1,78 @@
+/**
+ * Harness-neutral service-tier semantics (stigmer/stigmer#357, extended to
+ * the native harness by #361).
+ *
+ * The platform contract: an execution's price-bearing tier is ALWAYS
+ * explicit by the time a provider request leaves the runner. UNSPECIFIED
+ * resolves to STANDARD here and ONLY here — every upstream layer preserves
+ * the caller's raw enum so "user chose standard" stays distinguishable
+ * from "platform default" all the way to the ledger.
+ *
+ * Each harness owns its translation of the EFFECTIVE tier into provider
+ * wire terms:
+ *   - Cursor: explicit `ModelSelection.params` pinning the price-bearing
+ *     variant booleans (`execute-cursor/service-tier.ts`).
+ *   - Native: the provider's own request parameter, mapped in
+ *     `model-client.ts` (`toOpenAiServiceTier` / `toAnthropicServiceTier`
+ *     below) so no construction site can invent a third mapping.
+ */
+
+import { ServiceTier } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+
+/**
+ * The effective tier after platform-default resolution: never UNSPECIFIED.
+ */
+export type EffectiveServiceTier = ServiceTier.STANDARD | ServiceTier.FAST;
+
+/**
+ * Resolve the configured tier to its effective value. The single place in
+ * the platform where UNSPECIFIED becomes STANDARD.
+ */
+export function resolveEffectiveServiceTier(
+  configured: ServiceTier | undefined,
+): EffectiveServiceTier {
+  return configured === ServiceTier.FAST ? ServiceTier.FAST : ServiceTier.STANDARD;
+}
+
+/** Human-readable tier label for logs and error messages. */
+export function serviceTierLabel(tier: ServiceTier): string {
+  switch (tier) {
+    case ServiceTier.FAST:
+      return "fast";
+    case ServiceTier.STANDARD:
+      return "standard";
+    default:
+      return "unspecified";
+  }
+}
+
+/**
+ * OpenAI's `service_tier` request parameter for the effective tier.
+ *
+ * STANDARD maps to "default", NOT "auto": "auto" lets the ACCOUNT's
+ * project settings pick the processing tier — the exact
+ * account-default-decides-the-price hole #357 closed on the Cursor
+ * harness. FAST maps to "priority" (pay-as-you-go priority processing);
+ * create-time validation makes FAST unreachable until a registry entry
+ * prices it, so today's traffic always sends "default". "flex" (cheaper,
+ * slower) is a possible future tier, deliberately unmapped.
+ */
+export function toOpenAiServiceTier(tier: EffectiveServiceTier): "default" | "priority" {
+  return tier === ServiceTier.FAST ? "priority" : "default";
+}
+
+/**
+ * Anthropic's `service_tier` request parameter for the effective tier.
+ *
+ * STANDARD maps to "standard_only": never consume priority-tier capacity,
+ * so the bill is the public standard rate regardless of what the account
+ * has purchased. FAST maps to "auto" — Anthropic's priority tier is
+ * PURCHASED capacity, and "auto" means "use it when available"; the
+ * response's `usage.service_tier` reports what actually served, which is
+ * what billing reconciles against. FAST is unreachable until a registry
+ * entry prices it (and the platform buys priority capacity — the #361
+ * half-2 hold).
+ */
+export function toAnthropicServiceTier(tier: EffectiveServiceTier): "auto" | "standard_only" {
+  return tier === ServiceTier.FAST ? "auto" : "standard_only";
+}