@stigmer/runner 3.15.3-dev.20260914121148 → 3.16.0

package/src/interceptors/run-credential-activity.ts

@@ -0,0 +1,67 @@
+/**
+ * The activity boundary's ONE entry into the run-credential store.
+ *
+ * Every activity a worker runs — the server-dispatched turn activities, the
+ * server-dispatched GenerateSessionSubject, and every local or remote
+ * activity the runner's own serverless-workflow engine schedules — passes
+ * through this inbound interceptor. It reads the run credential from
+ * whichever channel the dispatch used (`shared/run-credential.ts`: the
+ * Temporal header the runner's workflow stamps, else the input object's
+ * key the server's workflow sets) and runs the activity inside
+ * `withRunCredential`, so that every control-plane request the activity
+ * makes — however deep, however detached — is made as the run's human.
+ *
+ * Header before input: a runner-dispatched activity's header is the nearer
+ * authority; in practice a dispatch carries exactly one of the two. An
+ * activity whose dispatch carried neither runs with no credential in the
+ * store, and the client falls back to the process credential exactly as it
+ * did before the store existed — an older server, and the cloud, see no
+ * change.
+ *
+ * Both worker roots (`worker.ts`, `runner-manager.ts`) register this
+ * unconditionally; it is inert without a credential. It logs nothing: a
+ * credential is never written to a log, and the arguments it inspects may
+ * carry anything.
+ */
+
+import type { ActivityInterceptorsFactory } from "@temporalio/worker";
+import { defaultPayloadConverter } from "@temporalio/common";
+
+import {
+  RUN_CREDENTIAL_HEADER,
+  readRunCredentialFromInput,
+} from "../shared/run-credential.js";
+import { withRunCredential } from "../shared/run-credential-store.js";
+
+/** The inbound interceptor factory both worker roots register. */
+export const runCredentialActivityInterceptor: ActivityInterceptorsFactory =
+  () => ({
+    inbound: {
+      async execute(input, next) {
+        const credential =
+          readRunCredentialFromHeader(input.headers[RUN_CREDENTIAL_HEADER]) ??
+          readRunCredentialFromInput(input.args[0]);
+        if (credential === undefined) {
+          return next(input);
+        }
+        return withRunCredential(credential, () => next(input));
+      },
+    },
+  });
+
+/**
+ * The credential a header payload carries, or `undefined` when there is no
+ * such header or it does not decode to a non-empty string. Decoding uses the
+ * default converter, never the worker's data converter: headers bypass the
+ * payload codecs by SDK design, and the stamping side encodes with the same
+ * default converter.
+ */
+function readRunCredentialFromHeader(payload: unknown): string | undefined {
+  if (payload === undefined) {
+    return undefined;
+  }
+  const value: unknown = defaultPayloadConverter.fromPayload(
+    payload as Parameters<typeof defaultPayloadConverter.fromPayload>[0],
+  );
+  return typeof value === "string" && value !== "" ? value : undefined;
+}

package/src/middleware/__tests__/cost-advisory.test.ts

@@ -3,9 +3,9 @@
  * running total the sub-agent views share, and warns the model ONCE at the
  * configured share of `max_cost_usd`. Nothing here caps: the enforcement is
  * the turn runtime's (`shared/__tests__/cost-guard.test.ts`,
- * `harness/__tests__/run-turn.test.ts`'s cost-cap arm). Until S3 M2b this
+ * `harness/__tests__/run-turn.test.ts`'s cost-cap arm). Until #1096 this
  * file was `cost-cap.test.ts` and also pinned the in-graph tool block and
- * the "exceeded" message — retired with that half (Q-S3-3, Q-M2b-9).
+ * the "exceeded" message — retired with that half.
  */
 
 import { describe, it, expect } from "vitest";

package/src/middleware/approval-gate.ts

@@ -24,6 +24,12 @@
  * unrecognized mutating built-in (e.g. `bash`, `overwrite_file`) is therefore
  * gated by what it does, not by whether someone remembered to list it.
  *
+ * The decision itself — `resolveToolApproval` — lives in
+ * `shared/approval-policy.ts` beside its provenance twin since #1097:
+ * the native translator reports the same answer on every
+ * `tool_started`, so the transcript row and this gate can never disagree
+ * about whether a call waits. This module is where the decision is ACTED on.
+ *
  * Gateway invariant (Phase 2): this middleware IS the in-process execution
  * gateway for the deep-agent harness — `handler(request)` is the side effect. A
  * side effect runs only with a backing authorization: either (a) the tool was
@@ -50,7 +56,7 @@ import {
   type MergedToolPolicy,
   type PolicySource,
   POLICY_ENGINE_VERSION,
-  resolveApprovalMessage,
+  resolveToolApproval,
   unattendedSkipMessage,
 } from "../shared/approval-policy.js";
 import { toolApprovalCategory, type ToolApprovalCategory } from "../shared/tool-kind.js";
@@ -164,16 +170,6 @@ interface ApprovalDecision {
   readonly comment?: string;
 }
 
-// Approval-message template per mutating category. Keyed by category (not raw
-// tool name) so every alias of a mutation renders one message; placeholders
-// resolve against the deep-agent stream arg shape (`path`/`command`). Mirrors
-// the Cursor side's CATEGORY_APPROVAL_MESSAGE.
-const CATEGORY_APPROVAL_MESSAGE: Record<ToolApprovalCategory, string> = {
-  write: "Write file: {{args.path}}",
-  delete: "Delete: {{args.path}}",
-  shell: "Execute command: {{args.command}}",
-};
-
 /**
  * The ToolMessage returned when a secret-like write is hard-blocked (DD-E /
  * DD-26 #2): the write is NEVER applied and the graph continues (this replaces
@@ -383,69 +379,6 @@ export function createApprovalGateMiddleware(
   };
 }
 
-interface ApprovalRequirement {
-  readonly requiresApproval: boolean;
-  readonly message: string;
-  /** Which policy layer determined this verdict — stamped on the shadow receipt. */
-  readonly source: PolicySource;
-}
-
-function resolveToolApproval(
-  toolName: string,
-  serverSlug: string,
-  args: Record<string, unknown>,
-  policies: ReadonlyMap<string, MergedToolPolicy>,
-  leasedCategories: ReadonlySet<ToolApprovalCategory>,
-): ApprovalRequirement {
-  if (serverSlug) {
-    // MCP tools stay governed by the connect-flow classifier + four-level policy
-    // chain. The policy map carries only the tools that REQUIRE approval, so an
-    // absent entry means the classifier already auto-approved it — fail-OPEN is
-    // correct here (a fail-closed default would re-gate everything the classifier
-    // cleared). This is deliberately NOT changed by the built-in fail-closed flip.
-    //
-    // A server-scoped lease surfaces here as an absent entry too: the leased
-    // server's tools are dropped from `policies` upstream (mergeApprovalPolicies),
-    // so a lease-cleared MCP tool takes this same auto-approve path. (Its shadow
-    // receipt therefore reads classifier_default rather than approval_lease; a
-    // faithful per-server lease provenance would need the lease set threaded here
-    // and is deferred with the rest of the persisted-receipt work.)
-    const key = `${serverSlug}/${toolName}`;
-    const policy = policies.get(key);
-    if (policy) {
-      return {
-        requiresApproval: policy.requiresApproval,
-        message: resolveApprovalMessage(policy.approvalMessage, toolName, args),
-        source: policy.source,
-      };
-    }
-    // Absent = cleared by the MCP four-level chain (classifier base) or by a
-    // server-scoped lease (dropped upstream).
-    return { requiresApproval: false, message: "", source: "classifier_default" };
-  }
-
-  // Built-in/platform tool: gate exactly the mutating categories via the shared
-  // classifier. Fail-CLOSED for the mutating set — any built-in classifyTool
-  // deems write/edit/delete/shell requires approval. Read-only and unclassified
-  // built-ins are not mutating, so they remain fail-open.
-  const category = toolApprovalCategory(toolName);
-  if (category) {
-    // Run-lifetime category lease: the user chose "approve all <category>"
-    // earlier in this run, so every built-in of that category is auto-approved
-    // for the rest of the run (the scoped successor to auto-approve-all).
-    if (leasedCategories.has(category)) {
-      return { requiresApproval: false, message: "", source: "approval_lease" };
-    }
-    return {
-      requiresApproval: true,
-      message: resolveApprovalMessage(CATEGORY_APPROVAL_MESSAGE[category], toolName, args),
-      source: "builtin_category",
-    };
-  }
-
-  return { requiresApproval: false, message: "", source: "builtin_category" };
-}
-
 /** Shared empty set so a config without leases allocates nothing per call. */
 const EMPTY_CATEGORY_SET: ReadonlySet<ToolApprovalCategory> = new Set();
 

package/src/middleware/cost-advisory.ts

@@ -11,17 +11,17 @@
  * shape `execution-budget.ts` already has beside LangGraph's `recursionLimit`:
  * the middleware warns inside the graph, the engine's own limit enforces.
  *
- * Until S3 M2b (Q-S3-3) this module was `cost-cap.ts` and did both: it also
+ * Until #1096 this module was `cost-cap.ts` and did both: it also
  * blocked every tool call once the running cost passed the cap and gave the
  * model one tool-free round to summarize. That second enforcement lived
  * inside the graph, where the runtime could not see it, and a platform STOP
  * had a sibling (`graceful-stop.ts`, deleted with it) that let the run spend
  * a summary round after the platform said stop. Both went when the runtime
- * became the one place a turn is stopped (harness runtime program, S3).
+ * became the one place a turn is stopped.
  *
  * afterModel — reads `usage_metadata` off the latest AIMessage, prices the
  *   call at the parent's rates (a sub-agent on its own model is priced the
- *   same way the enforcement prices it; per-sub-agent pricing is an S5 item),
+ *   same way the enforcement prices it; per-sub-agent pricing is #1121),
  *   accumulates the running total, and injects the warning SystemMessage once
  *   at `warningPct` of the cap.
  *

package/src/middleware/index.ts

@@ -21,7 +21,7 @@
  * Every middleware here either shapes the graph's tool surface or ADVISES
  * the model; none of them stops the run. A stop — the platform's, the
  * cost cap's, a stall's — is the turn runtime's, delivered to the graph
- * through its abort signal (harness runtime program, S3 Q-S3-3; until M2b a
+ * through its abort signal (since #1096; until then a
  * graceful-stop middleware and the cost cap's tool block were second stops
  * inside the graph that the runtime could not see).
  *

package/src/runner-manager.ts

@@ -29,7 +29,12 @@ import { DEFAULT_CURSOR_AGENT_RESOLVE_TIMEOUT_MS, DEFAULT_CURSOR_STREAM_STALL_TI
 // desktop manager never calls emitRunnerBootTiming, so marks cost nothing).
 import { markBoot } from "./shared/cold-start-timing.js";
 import type { WorkerActivities } from "./worker.js";
-import { resolveWorkflowSource, OTEL_WORKFLOW_INTERCEPTOR_MODULE } from "./workflow-source.js";
+import {
+  resolveWorkflowSource,
+  runCredentialWorkflowInterceptorModule,
+  OTEL_WORKFLOW_INTERCEPTOR_MODULE,
+} from "./workflow-source.js";
+import { runCredentialActivityInterceptor } from "./interceptors/run-credential-activity.js";
 import { resolveRunnerBootstrap, refreshRunnerAccessToken } from "./bootstrap.js";
 import { assertLlmBackendsPreflight } from "./preflight.js";
 import {
@@ -701,7 +706,7 @@ export function mapManagerOptionsToConfig(
     // The manager's proxy credential is the minted runner token once adopted
     // (the control-plane token in lockstep before that), so it is this ref and
     // not `tokenRef`: binding `tokenRef` would keep sending the desktop's own
-    // Auth0 token as x-stigmer-auth after the mint (Q-S2-7).
+    // Auth0 token as x-stigmer-auth after the mint.
     proxyTokenRef: runnerTokenRef,
     cursorApiKey: proxyActive
       ? (options.cursorApiKey ?? "proxy-managed")
@@ -816,9 +821,14 @@ async function buildInterceptorConfig(): Promise<InterceptorConfig> {
     "./interceptors/workflow-metrics-sink.js"
   );
 
-  const activityInterceptors: ActivityInterceptorsFactory[] = [];
+  // The run credential's two ends (shared/run-credential.ts), always on and
+  // inert without a credential — the same pair the static root registers
+  // (worker.ts). The workflow module reaches the bundle through
+  // `workflowInterceptorModules` on the runtime path and is baked in on the
+  // pre-built path (scripts/bundle-slim.mjs).
+  const activityInterceptors: ActivityInterceptorsFactory[] = [runCredentialActivityInterceptor];
   let sinks: InjectedSinks<any> = { ...createWorkflowMetricsSinks() };
-  const workflowInterceptorModules: string[] = [];
+  const workflowInterceptorModules: string[] = [runCredentialWorkflowInterceptorModule()];
 
   // In-flight activity counter: keeps a session/wfexec worker alive while one of
   // its activities (notably the long ExecuteCursor) is running, so a view close

package/src/shared/__tests__/approval-policy.test.ts

@@ -13,6 +13,7 @@ import {
   resolveApprovalMessage,
   deriveActiveLeases,
   resolveApprovalProvenance,
+  resolveToolApproval,
   toProtoPolicySource,
   type ActiveLeases,
   type MergedToolPolicy,
@@ -510,6 +511,50 @@ describe("resolveApprovalProvenance", () => {
 // cases assert the mapping is total and that undefined collapses to UNSPECIFIED.
 // ---------------------------------------------------------------------------
 
+describe("resolveToolApproval — THE gate decision, shared by the gate and the translators", () => {
+  const NO_CATEGORIES: ReadonlySet<ToolApprovalCategory> = new Set();
+  const gated: ReadonlyMap<string, MergedToolPolicy> = new Map([
+    ["github/create_issue", { toolName: "create_issue", mcpServerSlug: "github", requiresApproval: true, approvalMessage: "Create issue '{{args.title}}'?", source: "agent_override" }],
+  ]);
+
+  it("an MCP tool with a gating policy waits, with the policy's message resolved and its layer as source", () => {
+    expect(resolveToolApproval("create_issue", "github", { title: "Fix crash" }, gated, NO_CATEGORIES)).toEqual({
+      requiresApproval: true,
+      message: "Create issue 'Fix crash'?",
+      source: "agent_override",
+    });
+  });
+
+  it("an MCP tool absent from the policy map runs — the classifier cleared it (fail-open), source classifier_default", () => {
+    expect(resolveToolApproval("list_issues", "github", {}, gated, NO_CATEGORIES)).toEqual({
+      requiresApproval: false,
+      message: "",
+      source: "classifier_default",
+    });
+  });
+
+  it("a mutating built-in waits with its category's message (fail-closed), source builtin_category", () => {
+    expect(resolveToolApproval("execute", "", { command: "rm -rf build" }, new Map(), NO_CATEGORIES)).toEqual({
+      requiresApproval: true,
+      message: "Run command: rm -rf build",
+      source: "builtin_category",
+    });
+  });
+
+  it("a mutating built-in whose category is leased runs, source approval_lease", () => {
+    expect(resolveToolApproval("execute", "", { command: "ls" }, new Map(), new Set<ToolApprovalCategory>(["shell"]))).toEqual({
+      requiresApproval: false,
+      message: "",
+      source: "approval_lease",
+    });
+  });
+
+  it("a read-only or unclassified built-in runs (fail-open)", () => {
+    expect(resolveToolApproval("read_file", "", { path: "/x" }, new Map(), NO_CATEGORIES).requiresApproval).toBe(false);
+    expect(resolveToolApproval("think", "", {}, new Map(), NO_CATEGORIES).requiresApproval).toBe(false);
+  });
+});
+
 describe("toProtoPolicySource", () => {
   it("maps undefined (no governing layer) to UNSPECIFIED", () => {
     expect(toProtoPolicySource(undefined)).toBe(ApprovalPolicySource.UNSPECIFIED);

package/src/shared/__tests__/args-preview.test.ts

@@ -1,38 +1,46 @@
 /**
- * Unit tests for the shared args-preview sanitizers.
+ * Unit tests for the shared args-preview builder — the ONE preview rule every
+ * tool row carries since #1097.
  *
  * The Cursor gate path depends on {@link buildElidedArgsPreview} producing a
  * SMALL, ALWAYS-VALID, salient-preserving preview: the resumed turn re-parses it
  * to rebuild an approval grant's identity, and the persist-time size backstop
  * would replace an oversized preview with an unparseable marker. These pin those
  * invariants so a large write can never silently break the resume round-trip.
+ * (The native harness's whole-string-truncating `sanitizeArgsPreview` and its
+ * two arms went with it: a preview that could truncate to invalid JSON has no
+ * caller left.)
  */
 
 import { describe, it, expect } from "vitest";
-import {
-  buildElidedArgsPreview,
-  sanitizeArgsPreview,
-  MAX_ARGS_PREVIEW_LENGTH,
-} from "../args-preview.js";
+import { buildElidedArgsPreview, redactSensitiveArgs, SALIENT_ARG_FIELDS } from "../args-preview.js";
 
-describe("sanitizeArgsPreview (native)", () => {
-  it("redacts sensitive keys", () => {
-    const out = JSON.parse(sanitizeArgsPreview({ api_key: "sk-123", path: "a.txt" }));
-    expect(out.api_key).toBe("[REDACTED]");
-    expect(out.path).toBe("a.txt");
+describe("SALIENT_ARG_FIELDS", () => {
+  it("spans both harnesses' shapes for a file and a shell command, in priority order", () => {
+    expect([...SALIENT_ARG_FIELDS]).toEqual(["file_path", "path", "target_notebook", "command"]);
   });
+});
 
-  it("truncates the whole string past the cap", () => {
-    const preview = sanitizeArgsPreview({ contents: "x".repeat(MAX_ARGS_PREVIEW_LENGTH * 2) });
-    expect(preview.length).toBeLessThanOrEqual(MAX_ARGS_PREVIEW_LENGTH + 1);
-    expect(preview.endsWith("…")).toBe(true);
+describe("redactSensitiveArgs", () => {
+  it("redacts secret keys case-insensitively and keeps everything else verbatim", () => {
+    expect(redactSensitiveArgs({ Api_Key: "sk-123", path: "a.txt", n: 1 })).toEqual({ Api_Key: "[REDACTED]", path: "a.txt", n: 1 });
   });
 });
 
-describe("buildElidedArgsPreview (cursor gate)", () => {
-  const SALIENT = ["file_path", "path", "target_notebook", "command"] as const;
+describe("buildElidedArgsPreview", () => {
+  const SALIENT = SALIENT_ARG_FIELDS;
+
+  it("is exactly JSON.stringify(args) for short, secret-free args (what every native row now carries)", () => {
+    expect(buildElidedArgsPreview({ path: "/x", n: 2 }, SALIENT)).toBe(JSON.stringify({ path: "/x", n: 2 }));
+  });
 
-  it("stays valid JSON and small for a large write, eliding the content value", () => {
+  it("yields an empty string for unserializable args instead of throwing", () => {
+    const cyclic: Record<string, unknown> = {};
+    cyclic.self = cyclic;
+    expect(buildElidedArgsPreview(cyclic, SALIENT)).toBe("");
+  });
+
+  it("stays valid JSON and small for a large write, leaving the content value out", () => {
     const content = "line\n".repeat(100_000); // ~500 KB
     const preview = buildElidedArgsPreview(
       { path: "src/big.ts", contents: content },
@@ -43,9 +51,21 @@ describe("buildElidedArgsPreview (cursor gate)", () => {
     const parsed = JSON.parse(preview) as Record<string, unknown>;
     // Bounded — nowhere near the raw content size.
     expect(preview.length).toBeLessThan(1_000);
-    // The salient path survives verbatim (grant identity), content is elided.
+    // The salient path survives verbatim (grant identity); the content is not
+    // in the preview at all — never an in-band marker a reader could mistake
+    // for the file (stigmer#1107): a surface that needs it reads the row's args.
     expect(parsed.path).toBe("src/big.ts");
-    expect(parsed.contents).toBe(`[${content.length} chars]`);
+    expect("contents" in parsed).toBe(false);
+  });
+
+  it("a value at the cap is carried whole; one character over is left out", () => {
+    const atCap = "a".repeat(200);
+    const overCap = "a".repeat(201);
+    const parsed = JSON.parse(
+      buildElidedArgsPreview({ path: "x", note: atCap, essay: overCap }, SALIENT),
+    ) as Record<string, unknown>;
+    expect(parsed.note).toBe(atCap);
+    expect("essay" in parsed).toBe(false);
   });
 
   it("never elides a salient field, even a very long shell command", () => {

package/src/shared/__tests__/attachment-naming.test.ts

@@ -129,7 +129,7 @@ describe("cross-harness naming parity", () => {
       makeAttachment("Makefile", "attachments/01D/Makefile"),
     ];
 
-    // One attachment pipeline serves both harnesses since S3 M2b (Q-S3-14);
+    // One attachment pipeline serves both harnesses since #1096;
     // the names it lands are the ones the React SDK's table above predicts.
     const resolved = await resolveAttachments(attachments, {
       sessionId,

package/src/shared/__tests__/attachment-resolver.test.ts

@@ -1,15 +1,15 @@
 /**
  * Tests for the attachment resolver — the turn runtime's attachment phase,
- * the one pipeline for both harnesses since S3 M2b (the native twin,
+ * the one pipeline for both harnesses since #1096 (the native twin,
  * `attachment-injector.ts`, retired then; its ZIP guards moved to
- * `attachment-zip.ts` at S3 M1).
+ * `attachment-zip.ts` in the same PR).
  *
  * The load-bearing behaviors: storage-key attachments materialize under the
  * platform inputs dir (the universal path — every server-created attachment
  * carries a storage key), the workspace `.stigmer` symlink exists even when
  * the agent has no skills, and any attachment that cannot be materialized
  * fails the resolution loudly (the silent-skip regression behind "plan file
- * wasn't found"). Since S3 M1 (Q-S3-14, Q-M1-2) the resolver is the one
+ * wasn't found"). Since #1096 the resolver is the one
  * attachment pipeline for every harness, so it also pins the two behaviors
  * lifted from the native injector: `extract` archives land under their mount
  * directory through the shared #567 guards, and an explicit `mountPath` is
@@ -279,7 +279,7 @@ describe("resolveAttachments", () => {
 
   // ── Explicit mountPath: honoured inside the inputs namespace, refused outside ──
 
-  describe("mountPath (S3 M1, Q-M1-2)", () => {
+  describe("mountPath", () => {
     it("places a file at its explicit `inputs/…` path, in every spelling the producers use", async () => {
       const { storage } = makeInMemoryArtifactStorage();
       await storage.upload("k/a", Buffer.from("A"), "text/plain");
@@ -364,7 +364,7 @@ describe("resolveAttachments", () => {
 
   // ── Archives: `extract` lands the entries under the mount directory ──────
 
-  describe("extract (S3 M1, Q-S3-14)", () => {
+  describe("extract", () => {
     const archive = () =>
       Buffer.from(
         buildZip([

package/src/shared/__tests__/attachment-zip.test.ts

@@ -3,7 +3,7 @@
  * (`shared/attachment-zip.ts`): the manifest checks (paths, traversal, null
  * bytes, duplicates, methods, emptiness, count and declared-size caps) and
  * the central-directory parsing that issue #567 made authoritative. Moved
- * from the native injector's test file at S3 M1 with the code; every
+ * from the native injector's test file in #1096 with the code; every
  * archive comes from the shared real-shape builder
  * (@stigmer/zip-structure/testing). The write of an admitted entry is each
  * caller's and is pinned in that caller's tests (`attachment-resolver.test.ts`).

package/src/shared/__tests__/blueprint-resolver.test.ts

@@ -4,7 +4,7 @@
  * (`resolveAgentBlueprint`). Union, deduplicated by slug, the session's ref
  * winning a collision (it may pin a different version).
  *
- * Carried from `skill-writer.test.ts` at S3 M2b, when the native
+ * Carried from `skill-writer.test.ts` in #1096, when the native
  * orchestrator's byte-twin of this function was deleted with its module;
  * until then the runtime's copy was tested only through the twin.
  */

package/src/shared/__tests__/channel-attachment.test.ts

@@ -28,6 +28,7 @@ import {
   type ChannelMessagingInfo,
 } from "../channel-attachment.js";
 import type { ResolvedMcpServer } from "../mcp-resolver.js";
+import { STDIO_CREDENTIAL_ENV } from "../synthesized-attachment.js";
 
 function channel(slug: string): MessagingChannel {
   return { channel: slug, provider: "whatsapp" } as MessagingChannel;
@@ -158,9 +159,20 @@ describe("synthesizeChannelAttachment", () => {
     });
   });
 
+  it("the stdio child receives the run's credential as its startup bearer — the memory attachment's twin, one carrier", () => {
+    const attachment = synthesizeChannelAttachment([info("isc-whatsapp", [])], {
+      bridgeEndpoint: null,
+      credential: "run-credential",
+      backendEndpoint: "http://localhost:7234",
+    });
+    expect(attachment?.env).toMatchObject({ [STDIO_CREDENTIAL_ENV]: "run-credential" });
+  });
+
   it("pins the cross-repo strings the mcp-server side guards too", () => {
     expect(CHANNEL_ATTACHMENT_SLUG).toBe("stigmer-channels");
     expect(CHANNELS_ROUTE).toBe("/channels");
+    // The mcp-server's startup-credential variable (mcp-server/src/config.ts).
+    expect(STDIO_CREDENTIAL_ENV).toBe("STIGMER_API_KEY");
   });
 
   it("is approval-free by construction: zero entries in the merged approval map", () => {

package/src/shared/__tests__/cost-guard.test.ts

@@ -1,6 +1,6 @@
 /**
  * Unit tests for the max_cost_usd hard-stop guard (cost-guard.ts), which the
- * Cursor activity calls today and the turn runtime takes over in S2 M3.
+ * Cursor activity called until the turn runtime took it over in #1070.
  *
  * The guard is the cursor-side analog of the native cost-cap middleware
  * (middleware/cost-cap.ts): same proto semantics (0/unset = no cap), same

package/src/shared/__tests__/exact-apply.test.ts

@@ -1,5 +1,6 @@
 /**
- * @regression file-hitl-phase0 — pins file-edit HITL fix #4 (see _projects/2026-06/20260630.01.file-change-hitl-redesign/tasks/T01_3_regression-manifest.md)
+ * @regression file-hitl-phase0 — pins exact-apply: the runner applies the exact
+ * approved whole-file bytes, never model-regenerated ones.
  *
  * Unit tests for resume-time exact-apply (the HITL "what you approve is what gets
  * applied" guarantee for the Cursor deny-only harness).

package/src/shared/__tests__/memory-attachment.test.ts

@@ -30,6 +30,7 @@ import {
   type MemoryCaptureContext,
 } from "../memory-attachment.js";
 import type { ResolvedMcpServer } from "../mcp-resolver.js";
+import { STDIO_CREDENTIAL_ENV } from "../synthesized-attachment.js";
 
 const context: MemoryCaptureContext = {
   org: "acme",
@@ -117,6 +118,22 @@ describe("synthesizeMemoryAttachment", () => {
     });
   });
 
+  it("the stdio child receives the run's credential as its startup bearer — the same credential the bridge shape presents per request", () => {
+    const attachment = synthesizeMemoryAttachment(enabled, context, {
+      ...ossOptions,
+      credential: "run-credential",
+    });
+    expect(attachment?.connectionType).toBe("stdio");
+    expect(attachment?.env).toMatchObject({
+      [STDIO_CREDENTIAL_ENV]: "run-credential",
+      STIGMER_MCP_ROSTER: "memory",
+    });
+    // The child's environment is byte-for-byte today's when the run carried no credential.
+    expect(synthesizeMemoryAttachment(enabled, context, ossOptions)?.env).not.toHaveProperty(
+      STDIO_CREDENTIAL_ENV,
+    );
+  });
+
   it("omits empty context fields from the carrier — best-effort attribution, never blank entries", () => {
     const partial: MemoryCaptureContext = {
       org: "acme",