@stigmer/runner 3.15.3-dev.20260916211208 → 3.16.0

package/src/__tests__/run-credential-registration.test.ts

@@ -0,0 +1,80 @@
+/**
+ * Pins that every place a worker is composed registers BOTH ends of the run
+ * credential (`shared/run-credential.ts`): the activity inbound interceptor
+ * in the two roots that create workers, and the workflow interceptor module
+ * in the two runtime-bundling roots and the pre-built bundle script.
+ *
+ * Why a fence and not a comment: a root that forgot the activity end would
+ * present the operator's API key on every member's run — the failure this
+ * whole design exists to end — and on the desktop (the manager root) it
+ * would be invisible, because a person's own runner works for that person
+ * either way. The roots are read off the TypeScript syntax tree
+ * (`__test-utils__/module-specifiers.ts`) for the imports and off the source
+ * for the one call each import must make; the build script is JavaScript
+ * and is read as text.
+ */
+
+import { describe, expect, it } from "vitest";
+import { fileURLToPath } from "node:url";
+
+import {
+  moduleSpecifiers,
+  readSource,
+} from "../__test-utils__/module-specifiers.js";
+
+const SRC_ROOT = fileURLToPath(new URL("../", import.meta.url));
+const RUNNER_ROOT = fileURLToPath(new URL("../../", import.meta.url));
+
+const ACTIVITY_END = "./interceptors/run-credential-activity.js";
+const WORKFLOW_END_RESOLVER = "runCredentialWorkflowInterceptorModule";
+
+function root(file: string): {
+  file: string;
+  source: string;
+  specifiers: string[];
+} {
+  const path = `${SRC_ROOT}${file}`;
+  const source = readSource(path);
+  return { file, source, specifiers: moduleSpecifiers(path, source) };
+}
+
+describe("run-credential registration", () => {
+  for (const file of ["worker.ts", "runner-manager.ts"]) {
+    it(`${file} registers the activity end and resolves the workflow end`, () => {
+      const { specifiers, source } = root(file);
+      expect(
+        specifiers,
+        `${file} must import the activity interceptor`,
+      ).toContain(ACTIVITY_END);
+      expect(
+        source,
+        `${file} must place runCredentialActivityInterceptor in its activity interceptors`,
+      ).toMatch(
+        /ActivityInterceptorsFactory\[\]\s*=\s*\[runCredentialActivityInterceptor\]/,
+      );
+      expect(
+        source,
+        `${file} must resolve the workflow interceptor module`,
+      ).toContain(`${WORKFLOW_END_RESOLVER}()`);
+    });
+  }
+
+  it("scripts/bundle-slim.mjs bakes the workflow end into the pre-built bundle", () => {
+    const source = readSource(`${RUNNER_ROOT}scripts/bundle-slim.mjs`);
+    expect(source).toMatch(
+      new RegExp(
+        `workflowInterceptorModules:\\s*\\[\\s*${WORKFLOW_END_RESOLVER}\\(\\)`,
+      ),
+    );
+  });
+
+  it("the workflow end is a sandbox module: it imports nothing from Node", () => {
+    const path = `${SRC_ROOT}workflows/interceptors/run-credential.ts`;
+    const nodeImports = moduleSpecifiers(path, readSource(path)).filter((s) =>
+      s.startsWith("node:"),
+    );
+    expect(nodeImports).toEqual([]);
+    const wirePath = `${SRC_ROOT}shared/run-credential.ts`;
+    expect(moduleSpecifiers(wirePath, readSource(wirePath))).toEqual([]);
+  });
+});

package/src/activities/__tests__/generate-session-subject-wire.test.ts

@@ -0,0 +1,119 @@
+/**
+ * The GenerateSessionSubject activity's wire contract: one argument in one of
+ * two shapes — the positional execution id every server has sent, and the
+ * typed object a server sends when the dispatch carries the run credential.
+ * Both reach the same core with the same execution id; the credential is the
+ * activity boundary's business, not this activity's (the header explains).
+ *
+ * The client is the hermetic module seam (`__test-utils__/hermetic-activity.ts`)
+ * because the factory constructs its own `StigmerClient`; the LLM seam is
+ * module-mocked to return a fixed title.
+ */
+
+import { describe, expect, it, vi } from "vitest";
+import type { StigmerClient } from "../../client/stigmer-client.js";
+import { bindHermeticClient } from "../../__test-utils__/hermetic-activity.js";
+import { mockStigmerClient } from "../../__test-utils__/mock-client.js";
+
+vi.mock("../../client/stigmer-client.js", async () =>
+  (
+    await import("../../__test-utils__/hermetic-activity.js")
+  ).hermeticStigmerClientModule(),
+);
+vi.mock("../../shared/model-registry.js", () => ({
+  getSummarizationModel: vi.fn(async (primary: string) => primary),
+}));
+vi.mock("../../shared/model-client.js", () => ({
+  buildChatModel: vi.fn(async () => ({
+    model: { invoke: vi.fn(async () => ({ content: "Indexing Basics" })) },
+  })),
+}));
+vi.mock("../../shared/llm-backend.js", () => ({
+  checkDirectCredentials: vi.fn(() => null),
+}));
+vi.mock("../../shared/llm-proxy.js", () => ({
+  tryInferProvider: vi.fn(() => "anthropic"),
+}));
+
+import {
+  AUTO_CREATED_SUBJECT,
+  createGenerateSessionSubjectActivities,
+} from "../generate-session-subject.js";
+import type { Config } from "../../config.js";
+
+const EXECUTION_ID = "aex_wire_1";
+
+function clientReadingExecution(): {
+  client: StigmerClient;
+  reads: string[];
+  titled: string[];
+} {
+  const reads: string[] = [];
+  const titled: string[] = [];
+  const client = mockStigmerClient({
+    getExecution: vi.fn(async (executionId: string) => {
+      reads.push(executionId);
+      return {
+        spec: {
+          sessionId: "ses_1",
+          agentId: "agt_1",
+          message: "How do indexes work?",
+        },
+      } as never;
+    }),
+    getSession: vi.fn(
+      async () =>
+        ({
+          spec: { subject: AUTO_CREATED_SUBJECT, agentInstanceId: "" },
+        }) as never,
+    ),
+    getAgent: vi.fn(
+      async () =>
+        ({ metadata: { name: "a" }, spec: { description: "" } }) as never,
+    ),
+    updateSessionSubject: vi.fn(async (_sessionId: string, subject: string) => {
+      titled.push(subject);
+      return {} as never;
+    }),
+  });
+  return { client, reads, titled };
+}
+
+function activityUnderTest() {
+  const { client, reads, titled } = clientReadingExecution();
+  bindHermeticClient(client);
+  const config = {
+    stigmerBackendEndpoint: "http://localhost:0",
+    stigmerToken: null,
+    proxyEndpoint: null,
+    primaryModel: "claude-sonnet-4.5",
+  } as unknown as Config;
+  const { GenerateSessionSubject } =
+    createGenerateSessionSubjectActivities(config);
+  return { GenerateSessionSubject, reads, titled };
+}
+
+describe("GenerateSessionSubject wire shapes", () => {
+  it("accepts the positional execution id — every earlier server's shape", async () => {
+    const { GenerateSessionSubject, reads, titled } = activityUnderTest();
+    await GenerateSessionSubject(EXECUTION_ID);
+    expect(reads).toEqual([EXECUTION_ID]);
+    expect(titled).toEqual(["Indexing Basics"]);
+  });
+
+  it("accepts the typed object carrying the run credential and reads the same execution", async () => {
+    const { GenerateSessionSubject, reads, titled } = activityUnderTest();
+    await GenerateSessionSubject({
+      execution_id: EXECUTION_ID,
+      execution_context_token: "run-cred",
+    });
+    expect(reads).toEqual([EXECUTION_ID]);
+    expect(titled).toEqual(["Indexing Basics"]);
+  });
+
+  it("accepts the typed object without a credential", async () => {
+    const { GenerateSessionSubject, reads } = activityUnderTest();
+    await GenerateSessionSubject({ execution_id: EXECUTION_ID });
+    expect(reads).toEqual([EXECUTION_ID]);
+  });
+});

package/src/activities/generate-session-subject.ts

@@ -23,12 +23,24 @@
  * here degrades to a heuristic title (the first words of the user message):
  * a title is worth having even when no model is reachable.
  *
- * Activity contract (the Go stub dispatches exactly ONE argument — the cloud
- * Java signature carries a second, invokerIdentityAccountId, that never
- * crosses this wire):
+ * Activity contract — exactly ONE argument, in one of two shapes:
  *   Name:   "GenerateSessionSubject"
  *   Input:  (executionId: string)
+ *           | ({ execution_id, execution_context_token? }: GenerateSessionSubjectInput)
  *   Output: void
+ *
+ * The object is what a server sends when the dispatch carries the run's
+ * credential (shared/run-credential.ts), so that this activity reads the
+ * run and titles the session AS THE RUN'S HUMAN — with sign-in on, the
+ * operator's key the process holds cannot read a member's run. The string
+ * is what every server sent before, and what a server whose dispatch carries
+ * no credential still sends (the cloud's, whose desktop runners in the field
+ * must keep titling sessions). Both shapes are accepted — the dual-shape
+ * posture the turn activities take (shared/activity-input.ts); the
+ * credential itself is entered by the activity boundary
+ * (interceptors/run-credential-activity.ts), never read here. The cloud's
+ * Java signature carries a second argument, invokerIdentityAccountId, that
+ * never crosses this wire.
  */
 
 import { SystemMessage, HumanMessage } from "@langchain/core/messages";
@@ -344,6 +356,16 @@ function log(msg: string): void {
 // Temporal Activity Factory
 // ─────────────────────────────────────────────────────────────────────────────
 
+/**
+ * The typed wire shape of the activity's argument (snake_case keys, the
+ * polyglot workflow-input convention). `execution_context_token` is the run
+ * credential, present exactly when the dispatch carried one.
+ */
+export interface GenerateSessionSubjectInput {
+  readonly execution_id: string;
+  readonly execution_context_token?: string;
+}
+
 export function createGenerateSessionSubjectActivities(config: Config) {
   const client = new StigmerClient({
     endpoint: config.stigmerBackendEndpoint,
@@ -353,7 +375,10 @@ export function createGenerateSessionSubjectActivities(config: Config) {
   });
 
   return {
-    GenerateSessionSubject: async (executionId: string): Promise<void> => {
+    GenerateSessionSubject: async (
+      input: GenerateSessionSubjectInput | string,
+    ): Promise<void> => {
+      const executionId = typeof input === "string" ? input : input.execution_id;
       activityStarted();
       try {
         log(`started: execution=${executionId}`);

package/src/client/__tests__/stigmer-client.test.ts

@@ -20,6 +20,8 @@ vi.mock("@connectrpc/connect", () => ({
 }));
 
 import { StigmerClient } from "../stigmer-client.js";
+import { withRunCredential } from "../../shared/run-credential-store.js";
+import { AgentExecutionCommandController } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/command_pb";
 import { ExecutionContextQueryController } from "@stigmer/protos/ai/stigmer/agentic/executioncontext/v1/query_pb";
 import { PlatformQueryController } from "@stigmer/protos/ai/stigmer/platform/v1/server_info_pb";
 
@@ -279,6 +281,96 @@ describe("StigmerClient", () => {
     });
   });
 
+  describe("run credential (the activity's own, shared/run-credential-store.ts)", () => {
+    // The server mints a credential for ONE execution at dispatch and, with
+    // sign-in on, admits its bearer as that run's human. The activity boundary
+    // enters it into the store; these arms pin that the client presents it on
+    // every RPC about a run, on no process-bound RPC, below an explicit
+    // per-call header and above every process credential — and that two
+    // concurrent activities never see each other's.
+
+    function clientWithEveryProcessCredential(): StigmerClient {
+      return new StigmerClient({
+        endpoint: "http://localhost",
+        token: "static-tok",
+        tokenRef: { current: "control-plane-tok" },
+        runnerTokenRef: { current: "runner-tok" },
+      });
+    }
+
+    it("presents the run credential on an ordinary control-plane RPC", async () => {
+      clientWithEveryProcessCredential();
+      const req = makeRequest();
+      await withRunCredential("run-cred", () => runInterceptor(req));
+      expect(req.header.get("authorization")).toBe("Bearer run-cred");
+    });
+
+    it("presents it above the runner credential on the three runner-credential RPCs", async () => {
+      clientWithEveryProcessCredential();
+      for (const req of [
+        makeExecutionContextRequest(),
+        makeScopedTokenExchangeRequest(),
+        makeRequest(AgentExecutionCommandController.typeName, "create"),
+      ]) {
+        await withRunCredential("run-cred", () => runInterceptor(req));
+        expect(req.header.get("authorization")).toBe("Bearer run-cred");
+      }
+    });
+
+    it("never presents it on the process-bound bootstrap read", async () => {
+      clientWithEveryProcessCredential();
+      const req = makeRequest(PlatformQueryController.typeName, "getRunnerBootstrapConfig");
+      await withRunCredential("run-cred", () => runInterceptor(req));
+      expect(req.header.get("authorization")).toBe("Bearer control-plane-tok");
+    });
+
+    it("yields to an explicit per-call credential", async () => {
+      clientWithEveryProcessCredential();
+      const req = makeRequest();
+      req.header.set("authorization", "Bearer explicit-tok");
+      await withRunCredential("run-cred", () => runInterceptor(req));
+      expect(req.header.get("authorization")).toBe("Bearer explicit-tok");
+    });
+
+    it("leaves every rule below untouched when no activity credential is current", async () => {
+      clientWithEveryProcessCredential();
+      const ordinary = makeRequest();
+      await runInterceptor(ordinary);
+      expect(ordinary.header.get("authorization")).toBe("Bearer control-plane-tok");
+      const ec = makeExecutionContextRequest();
+      await runInterceptor(ec);
+      expect(ec.header.get("authorization")).toBe("Bearer runner-tok");
+    });
+
+    it("never crosses between two concurrent activities sharing one client", async () => {
+      clientWithEveryProcessCredential();
+      const reqA = makeRequest();
+      const reqB = makeRequest();
+      await Promise.all([
+        withRunCredential("run-cred-A", async () => {
+          await new Promise((resolve) => setTimeout(resolve, 2));
+          await runInterceptor(reqA);
+        }),
+        withRunCredential("run-cred-B", async () => {
+          await new Promise((resolve) => setTimeout(resolve, 1));
+          await runInterceptor(reqB);
+        }),
+      ]);
+      expect(reqA.header.get("authorization")).toBe("Bearer run-cred-A");
+      expect(reqB.header.get("authorization")).toBe("Bearer run-cred-B");
+    });
+
+    it("acquireScopedRunnerToken answers the run credential without an exchange", async () => {
+      const client = clientWithEveryProcessCredential();
+      const exchange = vi.spyOn(client, "getRunnerScopedToken");
+      const token = await withRunCredential("run-cred", () =>
+        client.acquireScopedRunnerToken({ agentExecutionId: "aex_1" }),
+      );
+      expect(token).toBe("run-cred");
+      expect(exchange).not.toHaveBeenCalled();
+    });
+  });
+
   describe("acquireScopedRunnerToken", () => {
     function clientWithRunnerCredential(token: string | null): StigmerClient {
       return new StigmerClient({

package/src/client/stigmer-client.ts

@@ -55,6 +55,7 @@ import { ChannelMessageQueryController } from "@stigmer/protos/ai/stigmer/agenti
 import type { ChannelTemplate, MessagingChannel } from "@stigmer/protos/ai/stigmer/agentic/agentchannel/v1/message_io_pb";
 import { TOKEN_TYPE_EMBEDDED_RUNNER, tokenTypeOf } from "./token-claims.js";
 import { assertCreateRequirements, assertReferenceRequirements } from "./server-contracts.js";
+import { currentRunCredential } from "../shared/run-credential-store.js";
 
 /**
  * Server-managed Temporal payload-encryption keys for this runner.
@@ -223,11 +224,25 @@ export class StigmerClient {
         // 1. An explicit per-call credential (an authorization header set via
         //    CallOptions) always wins. The scoped-token flow (issue #156)
         //    authenticates each ExecutionContext read with a token minted for
-        //    that specific execution; concurrent sessions in one runner process
-        //    make a shared mutable ref unusable for this — session A's read
-        //    must never go out with session B's token.
+        //    that specific execution; the renewal and pool-claim exchanges
+        //    present the token being exchanged; the connect lane hands its
+        //    decrypt-lane token per call.
         //
-        // 2. The runner credential (runnerTokenRef) authenticates the services
+        // 2. The run credential of the activity this request belongs to
+        //    (shared/run-credential-store.ts), on every RPC that is about a
+        //    run — which is every RPC but the process-bound bootstrap read.
+        //    The server minted it for exactly this execution at dispatch and,
+        //    with sign-in on, admits its bearer as the run's own human: the
+        //    status write, the child create, the artifact, the session title
+        //    are the member's, whoever's API key this process holds. It is
+        //    read from the async context, never from a ref: one process serves
+        //    many runs at once and a shared ref would be the wrong run's the
+        //    moment two overlap — the same reason rule 1 exists. Absent
+        //    outside an activity and when the dispatch carried none (an older
+        //    server; the cloud, whose runner credential is provisioned), so
+        //    the rules below are exactly what they were.
+        //
+        // 3. The runner credential (runnerTokenRef) authenticates the services
         //    that require a runner-class token_type claim: ExecutionContext
         //    reads carry decrypted secrets on cloud, and the server gates that
         //    decrypt on runner class + scope (stigmer-cloud#152/#155); the
@@ -239,13 +254,16 @@ export class StigmerClient {
         //    reserved-label guard and environment composer accept only from
         //    runner-class callers — a user-token create is rejected outright.
         //
-        // 3. Everything else uses the control-plane token. Falls through
-        //    unchanged when no runner token exists (OSS/local, where the
-        //    server enforces no auth).
+        // 4. Everything else uses the control-plane token: the process
+        //    credential, an operator's API key on a self-host. Falls through
+        //    unchanged when no runner token exists.
         (next) => async (req) => {
           if (req.header.has("authorization")) {
             return next(req);
           }
+          const isProcessBound =
+            req.service.typeName === PlatformQueryController.typeName &&
+            req.method.name === PlatformQueryController.method.getRunnerBootstrapConfig.name;
           const usesRunnerCredential =
             req.service.typeName === ExecutionContextQueryController.typeName ||
             (req.service.typeName === PlatformQueryController.typeName &&
@@ -253,7 +271,8 @@ export class StigmerClient {
             (req.service.typeName === AgentExecutionCommandController.typeName &&
               req.method.name === AgentExecutionCommandController.method.create.name);
           const token =
-            (usesRunnerCredential ? this.runnerTokenRef?.current : null)
+            (isProcessBound ? undefined : currentRunCredential())
+            ?? (usesRunnerCredential ? this.runnerTokenRef?.current : null)
             ?? this.tokenRef?.current
             ?? this.currentToken;
           if (token) {
@@ -363,11 +382,16 @@ export class StigmerClient {
    * The call authenticates with the runner credential (see the interceptor).
    * Cloud verifies it is an embedded_runner token and that its identity can
    * view the named execution, then mints the same session/execution-scoped
-   * sandbox token a cloud sandbox runner receives at provisioning. OSS mints
-   * an execution-scoped token for any caller (oss#535 — a lane discriminator
-   * on a single-user server, not a trust boundary). Returns undefined when
-   * the server does not mint (pre-oss#535 OSS, or an unserved scope arm) —
-   * presence-based, like the bootstrap token fields.
+   * sandbox token a cloud sandbox runner receives at provisioning. An
+   * open-source server with sign-in off mints an execution-scoped token for
+   * any caller (oss#535 — there it only unlocks the ExecutionContext decrypt
+   * lane); with sign-in on the same token admits its bearer as the run's
+   * human, so the exchange mints only for the run's own person (a missing
+   * run NOT_FOUND, anyone else PERMISSION_DENIED). Runs normally receive
+   * their credential from the dispatch itself (shared/run-credential.ts);
+   * this exchange is the fallback. Returns undefined when the server does
+   * not mint (pre-oss#535 OSS, or an unserved scope arm) — presence-based,
+   * like the bootstrap token fields.
    *
    * `callerToken` authenticates the exchange per-call instead of the
    * process-wide runner credential. The warm-pool attach uses it: a pool
@@ -400,7 +424,13 @@ export class StigmerClient {
    * Acquire a scoped runner token for an ExecutionContext read, if this
    * runner's credential situation calls for one.
    *
-   * The gate is the credential itself, three ways:
+   * When the activity this call belongs to carries a run credential (the
+   * server minted it for this very execution at dispatch —
+   * shared/run-credential.ts), that IS the scoped token: it is answered
+   * without an RPC, and the exchange below serves only a dispatch that
+   * carried none — an older server, or the cloud's provisioned runner.
+   *
+   * Otherwise the gate is the credential itself, three ways:
    *
    * 1. An unscoped embedded_runner bootstrap token MUST be exchanged, and a
    *    failed exchange is a hard error, not a fallback: since the #156
@@ -431,6 +461,10 @@ export class StigmerClient {
   async acquireScopedRunnerToken(
     scope: RunnerScopedTokenScope,
   ): Promise<string | undefined> {
+    const runCredential = currentRunCredential();
+    if (runCredential !== undefined) {
+      return runCredential;
+    }
     // Inspect the same credential chain the EC read's interceptor would use.
     const ambientTokenType = tokenTypeOf(
       this.runnerTokenRef?.current ?? this.tokenRef?.current ?? this.currentToken,

package/src/config.ts

@@ -9,7 +9,10 @@
  *
  * 1. Direct mode (local / OSS):
  *    - CURSOR_API_KEY provided directly by the user (for Cursor harness).
- *    - STIGMER_TOKEN is optional (local stigmer-server has no auth).
+ *    - STIGMER_TOKEN is optional against a trusted-local server (it verifies
+ *      no credential) and is the runner's own API key against a self-hosted
+ *      server with sign-in on; each run's credential arrives with its
+ *      dispatch (shared/run-credential.ts).
  *    - STIGMER_PROXY_ENDPOINT is NOT set.
  *
  * 2. Proxy mode (cloud / managed runners):

package/src/interceptors/__tests__/run-credential-activity.test.ts

@@ -0,0 +1,133 @@
+/**
+ * The activity boundary's entry into the run-credential store
+ * (`run-credential-activity.ts`): the two channels a dispatch can use, their
+ * precedence, the credential-less pass-through, and the promise that the
+ * boundary never writes a log line (a credential must never reach one).
+ */
+
+import { describe, expect, it, vi } from "vitest";
+import { defaultPayloadConverter } from "@temporalio/common";
+import type { ActivityExecuteInput } from "@temporalio/worker";
+
+import { runCredentialActivityInterceptor } from "../run-credential-activity.js";
+import {
+  RUN_CREDENTIAL_HEADER,
+  RUN_CREDENTIAL_INPUT_KEY,
+} from "../../shared/run-credential.js";
+import { currentRunCredential } from "../../shared/run-credential-store.js";
+
+function execute(input: ActivityExecuteInput): Promise<string | undefined> {
+  const interceptors = runCredentialActivityInterceptor({} as never);
+  const execute = interceptors.inbound?.execute;
+  if (execute === undefined)
+    throw new Error("the interceptor must implement execute");
+  return execute(input, async () => currentRunCredential()) as Promise<
+    string | undefined
+  >;
+}
+
+function headerOf(credential: string): ActivityExecuteInput["headers"] {
+  return {
+    [RUN_CREDENTIAL_HEADER]: defaultPayloadConverter.toPayload(credential),
+  };
+}
+
+describe("runCredentialActivityInterceptor", () => {
+  it("enters the header's credential — the runner's own dispatch", async () => {
+    expect(
+      await execute({ args: ["wex_1"], headers: headerOf("cred-header") }),
+    ).toBe("cred-header");
+  });
+
+  it("enters the input object's credential — the server's dispatch", async () => {
+    expect(
+      await execute({
+        args: [
+          {
+            execution_id: "aex_1",
+            thread_id: "",
+            [RUN_CREDENTIAL_INPUT_KEY]: "cred-input",
+          },
+        ],
+        headers: {},
+      }),
+    ).toBe("cred-input");
+  });
+
+  it("prefers the header when both are present", async () => {
+    expect(
+      await execute({
+        args: [{ [RUN_CREDENTIAL_INPUT_KEY]: "cred-input" }],
+        headers: headerOf("cred-header"),
+      }),
+    ).toBe("cred-header");
+  });
+
+  it("runs a credential-less activity with an empty store — an older server, the cloud", async () => {
+    expect(await execute({ args: ["aex_1", ""], headers: {} })).toBeUndefined();
+    expect(
+      await execute({
+        args: [{ execution_id: "aex_1", thread_id: "" }],
+        headers: {},
+      }),
+    ).toBeUndefined();
+    expect(await execute({ args: [], headers: {} })).toBeUndefined();
+  });
+
+  it("ignores a header that does not decode to a non-empty string", async () => {
+    expect(
+      await execute({
+        args: [],
+        headers: {
+          [RUN_CREDENTIAL_HEADER]: defaultPayloadConverter.toPayload(""),
+        },
+      }),
+    ).toBeUndefined();
+    expect(
+      await execute({
+        args: [],
+        headers: {
+          [RUN_CREDENTIAL_HEADER]: defaultPayloadConverter.toPayload(7),
+        },
+      }),
+    ).toBeUndefined();
+  });
+
+  it("does not read the connect lane's camelCase per-call token", async () => {
+    expect(
+      await execute({
+        args: [
+          { mcpServerId: "mcp_1", executionContextToken: "connect-token" },
+        ],
+        headers: {},
+      }),
+    ).toBeUndefined();
+  });
+
+  it("leaves the store empty once the activity has returned", async () => {
+    await execute({ args: [], headers: headerOf("cred-x") });
+    expect(currentRunCredential()).toBeUndefined();
+  });
+
+  it("writes nothing to the console on any path", async () => {
+    const spies = (["log", "warn", "error", "info", "debug"] as const).map(
+      (level) => vi.spyOn(console, level).mockImplementation(() => {}),
+    );
+    try {
+      await execute({
+        args: [{ [RUN_CREDENTIAL_INPUT_KEY]: "cred-secret" }],
+        headers: {},
+      });
+      await execute({ args: ["aex_1"], headers: headerOf("cred-secret") });
+      await execute({
+        args: [],
+        headers: {
+          [RUN_CREDENTIAL_HEADER]: defaultPayloadConverter.toPayload(7),
+        },
+      });
+      for (const spy of spies) expect(spy).not.toHaveBeenCalled();
+    } finally {
+      for (const spy of spies) spy.mockRestore();
+    }
+  });
+});