@stigmer/runner 3.12.3 → 3.12.5

package/dist/shared/plan-mode-permissions.js

@@ -2,26 +2,25 @@
  * The Plan-mode filesystem permission rules — the enforcement twin of
  * `plan-mode-prompt.ts` (which carries the instruction half of the contract).
  *
- * Plan mode is contained BY CONSTRUCTION on the native harness: these rules
- * deny every filesystem write everywhere AND scope reads to the session
- * workspace (issue #528 — owner ruling: the workspace is plan mode's read
- * boundary on cloud and desktop runners alike). Without the read boundary,
- * model-provided absolute paths reached anywhere the process account could
- * read — the pod filesystem (including /proc/self/environ) on cloud runners,
- * the user's whole home directory on desktop — while plan mode still carries
- * exfiltration-capable tools (web_fetch, MCP). Rules are first-match-wins
- * with a permissive default (deepagents' decidePathAccess), so order is
- * load-bearing: the workspace read-allow must precede the read-deny.
+ * Plan mode's policy is: reads anywhere in the workspace, writes nowhere.
+ * Only the write half needs a RULE. The read boundary that issue #528 built
+ * out of rules (workspace read-allow + read-deny, glob-escaped real root) is
+ * now STRUCTURAL: every native-harness backend is virtual-rooted
+ * (`virtualMode: true` — see cas-capture-backend.ts, issue #754), so every
+ * path a tool can express resolves inside the workspace root and traversal
+ * is rejected at resolution. A rule cannot widen that, and no workspace-root
+ * glob is needed to narrow it — which also retires the whole
+ * special-characters-in-the-root hazard (`escapeGlobLiteral` and its
+ * end-to-end matcher suite) that the real-path rules carried.
  *
- * The workspace-root pattern is matched as a STRING against the raw tool-call
- * path (micromatch, dot:true), before the backend touches disk. That is
- * exactly why the legitimate out-of-workspace reads keep working: skills,
- * attachments, and the approved plan live in the platform dir but are
- * addressed through the `{workspace}/.stigmer` symlink (see
- * shared/workspace/stigmer-link.ts), so their path strings are in-root even
- * though the bytes are not. The same holds for multi-workspace local entries
- * (`{workspace}/{name}` symlinks). A realpath-based boundary would break
- * both; do not "harden" this into one.
+ * Paths in these rules are VIRTUAL: "/" is the workspace root, matched by
+ * micromatch against the raw tool-call path (dot:true) after the
+ * path-normalization middleware has canonicalized it (relative → "/"-rooted;
+ * see middleware/path-normalization.ts). The legitimate platform-dir reads
+ * (skills, attachments, the approved plan) keep working exactly as before:
+ * they are addressed through the `{workspace}/.stigmer` symlink
+ * (shared/workspace/stigmer-link.ts), an in-root path string in either
+ * dialect.
  *
  * Applied in execute-deep-agent/setup.ts to the parent graph AND threaded
  * into every compiled sub-agent graph: deepagents' parent-permission
@@ -30,50 +29,23 @@
  * (issue #255). Kept as its own side-effect-free module so tests can pin the
  * production rules without dragging in setup.ts's import graph.
  *
- * Rules travel with a companion: every graph that carries them also installs
- * the path-normalization middleware (middleware/path-normalization.ts,
- * issues #429/#528), because deepagents' rule validation refuses
- * workspace-relative paths outright and its `ls`/`glob`/`grep` schema default
- * of "/" would deny the bare first listing. Both are derived from the same
- * expression at each composition site so they cannot drift apart.
- *
  * Invariant: never combine these rules with a shell-capable (sandbox)
  * backend — deepagents rejects that pairing at graph construction (see the
  * cas-capture-backend.ts header). Plan mode guarantees it by construction:
  * it is the mode that clears `shellEnv`, and `shellEnv` is the single switch
  * for shell capability on both the parent and sub-agent backends.
  */
-import { resolve } from "node:path";
-/**
- * Backslash-escape every character micromatch/picomatch treats as glob
- * syntax, so the result matches the input literally. micromatch exports no
- * escape API of its own, and this is correctness, not caution: an unescaped
- * `(` in a desktop project path would make the workspace read-allow rule
- * silently never match — bricking every plan-mode read for that workspace.
- * Semantics are pinned end-to-end through deepagents' own matcher by the
- * special-character workspace suite in plan-mode-path-normalization.test.ts.
- */
-export function escapeGlobLiteral(literal) {
-    return literal.replace(/[\\*?()[\]{}!+@]/g, "\\$&");
-}
 /**
- * Build the plan-mode rule set for a graph whose filesystem backend is
- * rooted at `workspaceRootDir`. The three rules read as the policy:
- * reads allowed in the workspace, reads denied everywhere else, writes
- * denied everywhere.
+ * Build the plan-mode rule set. One rule IS the policy: writes denied
+ * everywhere ("/**" is every virtual path; deepagents evaluates
+ * first-match-wins with a permissive default, so reads stay allowed —
+ * workspace-confined structurally, not by rule).
  *
- * `{root}/**` matches the root itself as well as its subtree (verified
- * against the installed micromatch), so one allow pattern suffices. The
- * root is `path.resolve`d first because enforcement canonicalizes incoming
- * paths (collapsed slashes, no trailing separator) before matching — a
- * trailing slash in the pattern would silently match nothing.
+ * Deliberately parameterless: the pre-#754 signature took the workspace root
+ * to build a real-path read fence; resurrecting a root-derived rule would
+ * silently mismatch the virtual dialect the enforcement now sees.
  */
-export function buildPlanModePermissions(workspaceRootDir) {
-    const canonicalRoot = resolve(workspaceRootDir);
-    return [
-        { operations: ["read"], paths: [`${escapeGlobLiteral(canonicalRoot)}/**`] },
-        { operations: ["read"], paths: ["/**"], mode: "deny" },
-        { operations: ["write"], paths: ["/**"], mode: "deny" },
-    ];
+export function buildPlanModePermissions() {
+    return [{ operations: ["write"], paths: ["/**"], mode: "deny" }];
 }
 //# sourceMappingURL=plan-mode-permissions.js.map

package/dist/shared/plan-mode-permissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"plan-mode-permissions.js","sourceRoot":"","sources":["../../src/shared/plan-mode-permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,OAAO,OAAO,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CACtC,gBAAwB;IAExB,MAAM,aAAa,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAChD,OAAO;QACL,EAAE,UAAU,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,iBAAiB,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE;QAC3E,EAAE,UAAU,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE;QACtD,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE;KACxD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"plan-mode-permissions.js","sourceRoot":"","sources":["../../src/shared/plan-mode-permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAIH;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB;IACtC,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;AACnE,CAAC"}

package/dist/shared/registry-endpoint.d.ts

@@ -46,6 +46,11 @@ export declare function resolveRegistryBaseUrl(env?: NodeJS.ProcessEnv): string;
 /**
  * Build request headers for registry fetches: bearer auth when a token is
  * present (cloud requires it; the local server ignores it).
+ *
+ * The default env is the credential-store view, not bare `process.env`:
+ * both token names are captured out of the environment at boot (#508), and
+ * the store also carries rotated tokens (manager updateToken / static
+ * renewal) that never touch env at all.
  */
 export declare function buildRegistryHeaders(env?: NodeJS.ProcessEnv): Record<string, string>;
 /** Full URL of the model registry endpoint for the resolved control plane. */

package/dist/shared/registry-endpoint.js

@@ -19,6 +19,7 @@
  * API would only mask misconfiguration (and breaks offline/local use).
  */
 import { normalizeEndpoint } from "../config.js";
+import { runnerSecretsEnvView } from "./runner-credential-store.js";
 /** Default local stigmer-server origin — mirrors config.ts's local-mode default. */
 const DEFAULT_LOCAL_BACKEND = "http://localhost:7234";
 /**
@@ -62,8 +63,13 @@ export function resolveRegistryBaseUrl(env = process.env) {
 /**
  * Build request headers for registry fetches: bearer auth when a token is
  * present (cloud requires it; the local server ignores it).
+ *
+ * The default env is the credential-store view, not bare `process.env`:
+ * both token names are captured out of the environment at boot (#508), and
+ * the store also carries rotated tokens (manager updateToken / static
+ * renewal) that never touch env at all.
  */
-export function buildRegistryHeaders(env = process.env) {
+export function buildRegistryHeaders(env = runnerSecretsEnvView()) {
     const token = env.STIGMER_TOKEN ?? env.STIGMER_AUTH_TOKEN;
     return token ? { Authorization: `Bearer ${token}` } : {};
 }

package/dist/shared/registry-endpoint.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry-endpoint.js","sourceRoot":"","sources":["../../src/shared/registry-endpoint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAGjD,oFAAoF;AACpF,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AAEtD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAqB;IACrD,KAAK,EAAE,mBAAmB;IAC1B,WAAW,EAAE,GAAG;IAChB,aAAa,EAAE,CAAC;IAChB,UAAU,EAAE,CAAC;IACb,gBAAgB,EAAE,MAAM;CACzB,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACzE,MAAM,QAAQ,GAAG,GAAG,CAAC,qBAAqB,CAAC;IAC3C,IAAI,QAAQ;QAAE,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAEjD,MAAM,aAAa,GAAG,GAAG,CAAC,sBAAsB,CAAC;IACjD,IAAI,aAAa;QAAE,OAAO,iBAAiB,CAAC,aAAa,CAAC,CAAC;IAE3D,OAAO,iBAAiB,CAAC,GAAG,CAAC,wBAAwB,IAAI,qBAAqB,CAAC,CAAC;AAClF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACvE,MAAM,KAAK,GAAG,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,kBAAkB,CAAC;IAC1D,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,uBAAuB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC1E,OAAO,GAAG,sBAAsB,CAAC,GAAG,CAAC,0BAA0B,CAAC;AAClE,CAAC"}
+{"version":3,"file":"registry-endpoint.js","sourceRoot":"","sources":["../../src/shared/registry-endpoint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAEpE,oFAAoF;AACpF,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AAEtD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAqB;IACrD,KAAK,EAAE,mBAAmB;IAC1B,WAAW,EAAE,GAAG;IAChB,aAAa,EAAE,CAAC;IAChB,UAAU,EAAE,CAAC;IACb,gBAAgB,EAAE,MAAM;CACzB,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACzE,MAAM,QAAQ,GAAG,GAAG,CAAC,qBAAqB,CAAC;IAC3C,IAAI,QAAQ;QAAE,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAEjD,MAAM,aAAa,GAAG,GAAG,CAAC,sBAAsB,CAAC;IACjD,IAAI,aAAa;QAAE,OAAO,iBAAiB,CAAC,aAAa,CAAC,CAAC;IAE3D,OAAO,iBAAiB,CAAC,GAAG,CAAC,wBAAwB,IAAI,qBAAqB,CAAC,CAAC;AAClF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAyB,oBAAoB,EAAE;IAE/C,MAAM,KAAK,GAAG,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,kBAAkB,CAAC;IAC1D,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,uBAAuB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC1E,OAAO,GAAG,sBAAsB,CAAC,GAAG,CAAC,0BAA0B,CAAC;AAClE,CAAC"}

package/dist/shared/runner-credential-keys.d.ts

@@ -10,7 +10,13 @@
  * their sanctioned delivery channel, and denying them here would break it.
  *
  * Consumers:
- * - shell-env.ts: SHELL_ENV_DENYLIST for the native harness `execute` tool.
+ * - runner-credential-store.ts: captures every name listed in this module
+ *   out of `process.env` at boot (issue #508 — the Cursor SDK's local agent
+ *   runtime runs in-process and its shell tool spawns from the runner's own
+ *   env, so credentials must not LIVE there; see that module for custody
+ *   rules).
+ * - shell-env.ts: SHELL_ENV_DENYLIST for the native harness `execute` tool
+ *   (defense-in-depth behind the boot scrub).
  * - mcp-manager.test.ts: leak-tripwire canaries for MCP stdio subprocesses
  *   (that path passes NO runner env by construction; the test plants these
  *   names to prove none leak through).
@@ -22,3 +28,22 @@
  * credential files off disk regardless (owner ruling on #385).
  */
 export declare const RUNNER_CREDENTIAL_ENV_KEYS: readonly string[];
+/**
+ * Env var names of the runner's non-credential secrets — material that is
+ * not an outbound-call credential (so it does not belong in
+ * {@link RUNNER_CREDENTIAL_ENV_KEYS}, whose inclusion rule is pinned above)
+ * but is every bit as sensitive in an agent-readable environment
+ * (owner ruling on #508: same boot scrub, separate constant so the #385
+ * rule keeps its meaning).
+ *
+ * The `*_KEY_ID` companions are deliberately absent: key identifiers are
+ * rotation bookkeeping, not secrets.
+ */
+export declare const RUNNER_ENCRYPTION_ENV_KEYS: readonly string[];
+/**
+ * Every env name whose VALUE the credential store takes custody of at boot:
+ * the #385 credential set plus the #508 encryption-key set. This is the
+ * scrub list — after `captureRunnerSecrets()`, none of these names remain
+ * in `process.env`.
+ */
+export declare const RUNNER_SECRET_ENV_KEYS: readonly string[];

package/dist/shared/runner-credential-keys.js

@@ -10,7 +10,13 @@
  * their sanctioned delivery channel, and denying them here would break it.
  *
  * Consumers:
- * - shell-env.ts: SHELL_ENV_DENYLIST for the native harness `execute` tool.
+ * - runner-credential-store.ts: captures every name listed in this module
+ *   out of `process.env` at boot (issue #508 — the Cursor SDK's local agent
+ *   runtime runs in-process and its shell tool spawns from the runner's own
+ *   env, so credentials must not LIVE there; see that module for custody
+ *   rules).
+ * - shell-env.ts: SHELL_ENV_DENYLIST for the native harness `execute` tool
+ *   (defense-in-depth behind the boot scrub).
  * - mcp-manager.test.ts: leak-tripwire canaries for MCP stdio subprocesses
  *   (that path passes NO runner env by construction; the test plants these
  *   names to prove none leak through).
@@ -44,4 +50,31 @@ export const RUNNER_CREDENTIAL_ENV_KEYS = [
     // (llm-backend.ts documents it as a supported auth path).
     "AWS_BEARER_TOKEN_BEDROCK",
 ];
+/**
+ * Env var names of the runner's non-credential secrets — material that is
+ * not an outbound-call credential (so it does not belong in
+ * {@link RUNNER_CREDENTIAL_ENV_KEYS}, whose inclusion rule is pinned above)
+ * but is every bit as sensitive in an agent-readable environment
+ * (owner ruling on #508: same boot scrub, separate constant so the #385
+ * rule keeps its meaning).
+ *
+ * The `*_KEY_ID` companions are deliberately absent: key identifiers are
+ * rotation bookkeeping, not secrets.
+ */
+export const RUNNER_ENCRYPTION_ENV_KEYS = [
+    // Temporal payload-encryption keys (encryption/config.ts). An agent that
+    // reads these could decrypt the runner's Temporal history payloads.
+    "STIGMER_PAYLOAD_ENCRYPTION_KEY",
+    "STIGMER_PAYLOAD_ENCRYPTION_SECONDARY_KEY",
+];
+/**
+ * Every env name whose VALUE the credential store takes custody of at boot:
+ * the #385 credential set plus the #508 encryption-key set. This is the
+ * scrub list — after `captureRunnerSecrets()`, none of these names remain
+ * in `process.env`.
+ */
+export const RUNNER_SECRET_ENV_KEYS = [
+    ...RUNNER_CREDENTIAL_ENV_KEYS,
+    ...RUNNER_ENCRYPTION_ENV_KEYS,
+];
 //# sourceMappingURL=runner-credential-keys.js.map

package/dist/shared/runner-credential-keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"runner-credential-keys.js","sourceRoot":"","sources":["../../src/shared/runner-credential-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAsB;IAC3D,wEAAwE;IACxE,iDAAiD;IACjD,4BAA4B;IAC5B,+DAA+D;IAC/D,sEAAsE;IACtE,eAAe;IACf,gEAAgE;IAChE,iDAAiD;IACjD,oBAAoB;IACpB,wEAAwE;IACxE,iCAAiC;IACjC,gBAAgB;IAChB,sEAAsE;IACtE,mBAAmB;IACnB,mEAAmE;IACnE,gBAAgB;IAChB,kDAAkD;IAClD,2BAA2B;IAC3B,iEAAiE;IACjE,0DAA0D;IAC1D,0BAA0B;CAC3B,CAAC"}
+{"version":3,"file":"runner-credential-keys.js","sourceRoot":"","sources":["../../src/shared/runner-credential-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAsB;IAC3D,wEAAwE;IACxE,iDAAiD;IACjD,4BAA4B;IAC5B,+DAA+D;IAC/D,sEAAsE;IACtE,eAAe;IACf,gEAAgE;IAChE,iDAAiD;IACjD,oBAAoB;IACpB,wEAAwE;IACxE,iCAAiC;IACjC,gBAAgB;IAChB,sEAAsE;IACtE,mBAAmB;IACnB,mEAAmE;IACnE,gBAAgB;IAChB,kDAAkD;IAClD,2BAA2B;IAC3B,iEAAiE;IACjE,0DAA0D;IAC1D,0BAA0B;CAC3B,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAsB;IAC3D,yEAAyE;IACzE,oEAAoE;IACpE,gCAAgC;IAChC,0CAA0C;CAC3C,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAsB;IACvD,GAAG,0BAA0B;IAC7B,GAAG,0BAA0B;CAC9B,CAAC"}

package/dist/shared/runner-credential-store.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Custody point for the runner's own secrets — the VALUES companion to
+ * runner-credential-keys.ts's names (issue #508).
+ *
+ * Why this exists: the Cursor SDK's local agent runtime ships inside
+ * `@cursor/sdk` and runs IN-PROCESS in the runner. Its shell tool spawns
+ * bash with `{...process.env, ...}` and its git layer does the same, so
+ * anything living in the runner's `process.env` is readable by every shell
+ * command the agent runs — and the SDK exposes no env option for local
+ * agents to scrub at the spawn boundary. Denylists on runner-owned spawn
+ * sites (shell-env.ts) cannot reach those vendor spawns. The only fix that
+ * covers every spawn surface, present and future, is for secrets not to
+ * LIVE in `process.env` at all: this module captures them at boot and is
+ * the sole holder afterwards.
+ *
+ * Custody rules:
+ *
+ *  1. `captureRunnerSecrets()` runs at every boot door (both public runner
+ *     factories, plus main() for symmetry) — it MOVES every
+ *     {@link RUNNER_SECRET_ENV_KEYS} value out of `process.env` into a
+ *     module-private map. Idempotent; first call wins.
+ *  2. Reads go through {@link getRunnerSecret}: captured value first, live
+ *     `process.env` as fallback. The fallback keeps the store honest rather
+ *     than frozen — production sets these vars only at process start (the
+ *     capture window), so the fallback is a dead path there, but tests and
+ *     unusual embedders that plant a value later see it behave exactly like
+ *     the env read it replaced.
+ *  3. Rotation writes go through {@link setRunnerSecret} (the
+ *     runner-manager/static-renewal token channel that previously wrote
+ *     `process.env.STIGMER_TOKEN` in lockstep with its tokenRef).
+ *  4. {@link runnerSecretsEnvView} adapts the store to the codebase's
+ *     `env: NodeJS.ProcessEnv` injection seams (llm-backend,
+ *     registry-endpoint). The view re-merges secrets over `process.env` —
+ *     it exists for in-process CONFIG READS ONLY and must never be handed
+ *     to a child process env or any spawn options.
+ *
+ * Embedder note: `@stigmer/runner` is a public library, and capture runs
+ * inside the factories, so embedding the runner scrubs the HOST process's
+ * env of runner secrets at boot. That is the point — agent shells run in
+ * the embedder's process — and host code that still needs a value reads it
+ * through this module.
+ */
+/**
+ * Move every {@link RUNNER_SECRET_ENV_KEYS} value out of `process.env` into
+ * the store. Idempotent — only the first call captures, so a late caller
+ * cannot re-freeze values that rotation has since replaced.
+ */
+export declare function captureRunnerSecrets(): void;
+/**
+ * Read a runner secret: captured value first, live `process.env` fallback
+ * (see custody rule 2). Returns `undefined` when the secret is absent —
+ * callers own their missing-secret reaction, exactly as with the env reads
+ * this replaces.
+ */
+export declare function getRunnerSecret(name: string): string | undefined;
+/**
+ * Write (or with `null`, clear) a runner secret — the rotation channel.
+ * Ensures capture has run first so a rotated value can never sit in
+ * `process.env` because a writer beat the boot capture.
+ */
+export declare function setRunnerSecret(name: string, value: string | null): void;
+/**
+ * `process.env` with the captured secrets merged back over it — an adapter
+ * for the `env: NodeJS.ProcessEnv` injection seams so their defaults stay
+ * secret-aware after the boot scrub.
+ *
+ * IN-PROCESS CONFIG READS ONLY: never pass this to a spawn/exec env, a
+ * worker thread, or anything else that leaves the process — doing so would
+ * reopen exactly the leak the store closes.
+ */
+export declare function runnerSecretsEnvView(): NodeJS.ProcessEnv;
+/**
+ * Test-only: forget everything captured and re-arm capture. Unit tests that
+ * plant secret env vars and boot pieces of the runner need each test to see
+ * its own values.
+ */
+export declare function resetRunnerSecretsForTests(): void;

package/dist/shared/runner-credential-store.js

@@ -0,0 +1,111 @@
+/**
+ * Custody point for the runner's own secrets — the VALUES companion to
+ * runner-credential-keys.ts's names (issue #508).
+ *
+ * Why this exists: the Cursor SDK's local agent runtime ships inside
+ * `@cursor/sdk` and runs IN-PROCESS in the runner. Its shell tool spawns
+ * bash with `{...process.env, ...}` and its git layer does the same, so
+ * anything living in the runner's `process.env` is readable by every shell
+ * command the agent runs — and the SDK exposes no env option for local
+ * agents to scrub at the spawn boundary. Denylists on runner-owned spawn
+ * sites (shell-env.ts) cannot reach those vendor spawns. The only fix that
+ * covers every spawn surface, present and future, is for secrets not to
+ * LIVE in `process.env` at all: this module captures them at boot and is
+ * the sole holder afterwards.
+ *
+ * Custody rules:
+ *
+ *  1. `captureRunnerSecrets()` runs at every boot door (both public runner
+ *     factories, plus main() for symmetry) — it MOVES every
+ *     {@link RUNNER_SECRET_ENV_KEYS} value out of `process.env` into a
+ *     module-private map. Idempotent; first call wins.
+ *  2. Reads go through {@link getRunnerSecret}: captured value first, live
+ *     `process.env` as fallback. The fallback keeps the store honest rather
+ *     than frozen — production sets these vars only at process start (the
+ *     capture window), so the fallback is a dead path there, but tests and
+ *     unusual embedders that plant a value later see it behave exactly like
+ *     the env read it replaced.
+ *  3. Rotation writes go through {@link setRunnerSecret} (the
+ *     runner-manager/static-renewal token channel that previously wrote
+ *     `process.env.STIGMER_TOKEN` in lockstep with its tokenRef).
+ *  4. {@link runnerSecretsEnvView} adapts the store to the codebase's
+ *     `env: NodeJS.ProcessEnv` injection seams (llm-backend,
+ *     registry-endpoint). The view re-merges secrets over `process.env` —
+ *     it exists for in-process CONFIG READS ONLY and must never be handed
+ *     to a child process env or any spawn options.
+ *
+ * Embedder note: `@stigmer/runner` is a public library, and capture runs
+ * inside the factories, so embedding the runner scrubs the HOST process's
+ * env of runner secrets at boot. That is the point — agent shells run in
+ * the embedder's process — and host code that still needs a value reads it
+ * through this module.
+ */
+import { RUNNER_SECRET_ENV_KEYS } from "./runner-credential-keys.js";
+const captured = new Map();
+let captureRan = false;
+/**
+ * Move every {@link RUNNER_SECRET_ENV_KEYS} value out of `process.env` into
+ * the store. Idempotent — only the first call captures, so a late caller
+ * cannot re-freeze values that rotation has since replaced.
+ */
+export function captureRunnerSecrets() {
+    if (captureRan)
+        return;
+    captureRan = true;
+    for (const name of RUNNER_SECRET_ENV_KEYS) {
+        const value = process.env[name];
+        if (value !== undefined) {
+            captured.set(name, value);
+            delete process.env[name];
+        }
+    }
+}
+/**
+ * Read a runner secret: captured value first, live `process.env` fallback
+ * (see custody rule 2). Returns `undefined` when the secret is absent —
+ * callers own their missing-secret reaction, exactly as with the env reads
+ * this replaces.
+ */
+export function getRunnerSecret(name) {
+    return captured.get(name) ?? process.env[name];
+}
+/**
+ * Write (or with `null`, clear) a runner secret — the rotation channel.
+ * Ensures capture has run first so a rotated value can never sit in
+ * `process.env` because a writer beat the boot capture.
+ */
+export function setRunnerSecret(name, value) {
+    captureRunnerSecrets();
+    if (value === null) {
+        captured.delete(name);
+    }
+    else {
+        captured.set(name, value);
+    }
+}
+/**
+ * `process.env` with the captured secrets merged back over it — an adapter
+ * for the `env: NodeJS.ProcessEnv` injection seams so their defaults stay
+ * secret-aware after the boot scrub.
+ *
+ * IN-PROCESS CONFIG READS ONLY: never pass this to a spawn/exec env, a
+ * worker thread, or anything else that leaves the process — doing so would
+ * reopen exactly the leak the store closes.
+ */
+export function runnerSecretsEnvView() {
+    const view = { ...process.env };
+    for (const [name, value] of captured) {
+        view[name] = value;
+    }
+    return view;
+}
+/**
+ * Test-only: forget everything captured and re-arm capture. Unit tests that
+ * plant secret env vars and boot pieces of the runner need each test to see
+ * its own values.
+ */
+export function resetRunnerSecretsForTests() {
+    captured.clear();
+    captureRan = false;
+}
+//# sourceMappingURL=runner-credential-store.js.map

package/dist/shared/runner-credential-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-credential-store.js","sourceRoot":"","sources":["../../src/shared/runner-credential-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;AAC3C,IAAI,UAAU,GAAG,KAAK,CAAC;AAEvB;;;;GAIG;AACH,MAAM,UAAU,oBAAoB;IAClC,IAAI,UAAU;QAAE,OAAO;IACvB,UAAU,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,IAAI,IAAI,sBAAsB,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC1B,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,KAAoB;IAChE,oBAAoB,EAAE,CAAC;IACvB,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,IAAI,GAAsB,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IACnD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,QAAQ,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACrB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B;IACxC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACjB,UAAU,GAAG,KAAK,CAAC;AACrB,CAAC"}

package/dist/shared/service-tier.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Harness-neutral service-tier semantics (stigmer/stigmer#357, extended to
+ * the native harness by #361).
+ *
+ * The platform contract: an execution's price-bearing tier is ALWAYS
+ * explicit by the time a provider request leaves the runner. UNSPECIFIED
+ * resolves to STANDARD here and ONLY here — every upstream layer preserves
+ * the caller's raw enum so "user chose standard" stays distinguishable
+ * from "platform default" all the way to the ledger.
+ *
+ * Each harness owns its translation of the EFFECTIVE tier into provider
+ * wire terms:
+ *   - Cursor: explicit `ModelSelection.params` pinning the price-bearing
+ *     variant booleans (`execute-cursor/service-tier.ts`).
+ *   - Native: the provider's own request parameter, mapped in
+ *     `model-client.ts` (`toOpenAiServiceTier` / `toAnthropicServiceTier`
+ *     below) so no construction site can invent a third mapping.
+ */
+import { ServiceTier } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+/**
+ * The effective tier after platform-default resolution: never UNSPECIFIED.
+ */
+export type EffectiveServiceTier = ServiceTier.STANDARD | ServiceTier.FAST;
+/**
+ * Resolve the configured tier to its effective value. The single place in
+ * the platform where UNSPECIFIED becomes STANDARD.
+ */
+export declare function resolveEffectiveServiceTier(configured: ServiceTier | undefined): EffectiveServiceTier;
+/** Human-readable tier label for logs and error messages. */
+export declare function serviceTierLabel(tier: ServiceTier): string;
+/**
+ * OpenAI's `service_tier` request parameter for the effective tier.
+ *
+ * STANDARD maps to "default", NOT "auto": "auto" lets the ACCOUNT's
+ * project settings pick the processing tier — the exact
+ * account-default-decides-the-price hole #357 closed on the Cursor
+ * harness. FAST maps to "priority" (pay-as-you-go priority processing);
+ * create-time validation makes FAST unreachable until a registry entry
+ * prices it, so today's traffic always sends "default". "flex" (cheaper,
+ * slower) is a possible future tier, deliberately unmapped.
+ */
+export declare function toOpenAiServiceTier(tier: EffectiveServiceTier): "default" | "priority";
+/**
+ * Anthropic's `service_tier` request parameter for the effective tier.
+ *
+ * STANDARD maps to "standard_only": never consume priority-tier capacity,
+ * so the bill is the public standard rate regardless of what the account
+ * has purchased. FAST maps to "auto" — Anthropic's priority tier is
+ * PURCHASED capacity, and "auto" means "use it when available"; the
+ * response's `usage.service_tier` reports what actually served, which is
+ * what billing reconciles against. FAST is unreachable until a registry
+ * entry prices it (and the platform buys priority capacity — the #361
+ * half-2 hold).
+ */
+export declare function toAnthropicServiceTier(tier: EffectiveServiceTier): "auto" | "standard_only";

package/dist/shared/service-tier.js

@@ -0,0 +1,67 @@
+/**
+ * Harness-neutral service-tier semantics (stigmer/stigmer#357, extended to
+ * the native harness by #361).
+ *
+ * The platform contract: an execution's price-bearing tier is ALWAYS
+ * explicit by the time a provider request leaves the runner. UNSPECIFIED
+ * resolves to STANDARD here and ONLY here — every upstream layer preserves
+ * the caller's raw enum so "user chose standard" stays distinguishable
+ * from "platform default" all the way to the ledger.
+ *
+ * Each harness owns its translation of the EFFECTIVE tier into provider
+ * wire terms:
+ *   - Cursor: explicit `ModelSelection.params` pinning the price-bearing
+ *     variant booleans (`execute-cursor/service-tier.ts`).
+ *   - Native: the provider's own request parameter, mapped in
+ *     `model-client.ts` (`toOpenAiServiceTier` / `toAnthropicServiceTier`
+ *     below) so no construction site can invent a third mapping.
+ */
+import { ServiceTier } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+/**
+ * Resolve the configured tier to its effective value. The single place in
+ * the platform where UNSPECIFIED becomes STANDARD.
+ */
+export function resolveEffectiveServiceTier(configured) {
+    return configured === ServiceTier.FAST ? ServiceTier.FAST : ServiceTier.STANDARD;
+}
+/** Human-readable tier label for logs and error messages. */
+export function serviceTierLabel(tier) {
+    switch (tier) {
+        case ServiceTier.FAST:
+            return "fast";
+        case ServiceTier.STANDARD:
+            return "standard";
+        default:
+            return "unspecified";
+    }
+}
+/**
+ * OpenAI's `service_tier` request parameter for the effective tier.
+ *
+ * STANDARD maps to "default", NOT "auto": "auto" lets the ACCOUNT's
+ * project settings pick the processing tier — the exact
+ * account-default-decides-the-price hole #357 closed on the Cursor
+ * harness. FAST maps to "priority" (pay-as-you-go priority processing);
+ * create-time validation makes FAST unreachable until a registry entry
+ * prices it, so today's traffic always sends "default". "flex" (cheaper,
+ * slower) is a possible future tier, deliberately unmapped.
+ */
+export function toOpenAiServiceTier(tier) {
+    return tier === ServiceTier.FAST ? "priority" : "default";
+}
+/**
+ * Anthropic's `service_tier` request parameter for the effective tier.
+ *
+ * STANDARD maps to "standard_only": never consume priority-tier capacity,
+ * so the bill is the public standard rate regardless of what the account
+ * has purchased. FAST maps to "auto" — Anthropic's priority tier is
+ * PURCHASED capacity, and "auto" means "use it when available"; the
+ * response's `usage.service_tier` reports what actually served, which is
+ * what billing reconciles against. FAST is unreachable until a registry
+ * entry prices it (and the platform buys priority capacity — the #361
+ * half-2 hold).
+ */
+export function toAnthropicServiceTier(tier) {
+    return tier === ServiceTier.FAST ? "auto" : "standard_only";
+}
+//# sourceMappingURL=service-tier.js.map

package/dist/shared/service-tier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-tier.js","sourceRoot":"","sources":["../../src/shared/service-tier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,8DAA8D,CAAC;AAO3F;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CACzC,UAAmC;IAEnC,OAAO,UAAU,KAAK,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC;AACnF,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,gBAAgB,CAAC,IAAiB;IAChD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,WAAW,CAAC,IAAI;YACnB,OAAO,MAAM,CAAC;QAChB,KAAK,WAAW,CAAC,QAAQ;YACvB,OAAO,UAAU,CAAC;QACpB;YACE,OAAO,aAAa,CAAC;IACzB,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAA0B;IAC5D,OAAO,IAAI,KAAK,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAA0B;IAC/D,OAAO,IAAI,KAAK,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC;AAC9D,CAAC"}