@stigmer/runner 3.21.0 → 3.22.1-dev.20260922095755

package/src/__tests__/config.test.ts

@@ -28,7 +28,7 @@ describe("loadConfig", () => {
     expect(config.temporalAddress).toBe("");
     expect(config.temporalNamespace).toBe("default");
     expect(config.stigmerBackendEndpoint).toBe("http://localhost:7234");
-    expect(config.stigmerToken).toBeNull();
+    expect(config.stigmerTokenRef.current).toBeNull();
     expect(config.cursorApiKey).toBe("test-key");
     expect(config.proxyEndpoint).toBeNull();
     expect(config.maxConcurrentActivities).toBe(5);
@@ -85,7 +85,7 @@ describe("loadConfig", () => {
 
     const config = loadConfig();
     expect(config.temporalAddress).toBe("");
-    expect(config.stigmerToken).toBe("token");
+    expect(config.stigmerTokenRef.current).toBe("token");
   });
 
   it("requires STIGMER_TOKEN in cloud mode", () => {
@@ -102,18 +102,19 @@ describe("loadConfig", () => {
     const config = loadConfig();
 
     expect(config.proxyEndpoint).toBe("https://proxy.example.com");
-    expect(config.stigmerToken).toBe("token");
+    expect(config.stigmerTokenRef.current).toBe("token");
   });
 
-  it("uses STIGMER_TOKEN as cursorApiKey in proxy mode for BiDi proxy auth", () => {
+  it("never copies STIGMER_TOKEN into cursorApiKey in proxy mode: the placeholder the option mappers use, the credential only in the ref", () => {
     process.env.STIGMER_PROXY_ENDPOINT = "https://api.stigmer.ai";
     process.env.STIGMER_TOKEN = "eyJhbGciOiJSUzI1NiJ9.test-jwt-token";
     const config = loadConfig();
 
-    expect(config.cursorApiKey).toBe("eyJhbGciOiJSUzI1NiJ9.test-jwt-token");
+    expect(config.cursorApiKey).toBe("proxy-managed");
+    expect(config.stigmerTokenRef.current).toBe("eyJhbGciOiJSUzI1NiJ9.test-jwt-token");
   });
 
-  it("prefers explicit CURSOR_API_KEY over STIGMER_TOKEN in proxy mode", () => {
+  it("keeps an explicit CURSOR_API_KEY in proxy mode", () => {
     process.env.STIGMER_PROXY_ENDPOINT = "https://api.stigmer.ai";
     process.env.STIGMER_TOKEN = "stigmer-jwt";
     process.env.CURSOR_API_KEY = "explicit-cursor-key";
@@ -122,16 +123,6 @@ describe("loadConfig", () => {
     expect(config.cursorApiKey).toBe("explicit-cursor-key");
   });
 
-  it("falls back to proxy-managed when no token in proxy mode", () => {
-    process.env.MODE = "local";
-    process.env.STIGMER_PROXY_ENDPOINT = "http://localhost:9090";
-    process.env.STIGMER_TOKEN = "token";
-    const config = loadConfig();
-
-    // With STIGMER_TOKEN present, cursorApiKey should be the token
-    expect(config.cursorApiKey).toBe("token");
-  });
-
   it("normalizes bare host:port to http://", () => {
     process.env.STIGMER_BACKEND_ENDPOINT = "backend:7234";
     process.env.CURSOR_API_KEY = "test-key";

package/src/__tests__/runner-manager.test.ts

@@ -1,22 +1,26 @@
 import { describe, it, expect } from "vitest";
 import { mapManagerOptionsToConfig } from "../runner-manager.js";
 import type { RunnerManagerOptions } from "../runner-manager.js";
+import type { TokenRef } from "../config.js";
 
 /**
  * The manager maps its options into a runner {@link Config}. The critical
  * invariant these tests lock is that execution location (`mode`) is decoupled
  * from credential transport (`proxyEndpoint`): the desktop runner executes
  * LOCALLY while still routing Cursor traffic through the proxy. Re-coupling the
- * two previously broke local-path workspace sessions.
+ * two previously broke local-path workspace sessions. The second invariant:
+ * the config carries the root's credential REFS and no credential by value,
+ * so a rotation the root writes is what every reader sees (config.ts header).
  */
 describe("mapManagerOptionsToConfig", () => {
   const base: RunnerManagerOptions = {
     temporalAddress: "localhost:7233",
     stigmerEndpoint: "http://localhost:7234",
   };
+  const refs = (): [TokenRef, TokenRef] => [{ current: null }, { current: null }];
 
   it("defaults mode to local when executionMode is unset", () => {
-    const config = mapManagerOptionsToConfig(base);
+    const config = mapManagerOptionsToConfig(base, ...refs());
     expect(config.mode).toBe("local");
   });
 
@@ -25,7 +29,7 @@ describe("mapManagerOptionsToConfig", () => {
       ...base,
       proxyEndpoint: "https://localhost:9090",
       stigmerToken: "tok",
-    });
+    }, ...refs());
     expect(config.mode).toBe("local");
     expect(config.proxyEndpoint).toBe("https://localhost:9090");
     // Proxy transport still engages independently of execution location.
@@ -48,7 +52,25 @@ describe("mapManagerOptionsToConfig", () => {
     // After the mint the two refs diverge; the proxy credential follows the mint.
     runnerTokenRef.current = "minted-runner-token";
     expect(config.proxyTokenRef?.current).toBe("minted-runner-token");
-    expect(config.stigmerTokenRef?.current).toBe("control-plane-token");
+    expect(config.stigmerTokenRef.current).toBe("control-plane-token");
+  });
+
+  it("carries the control-plane credential as the root's ref and nowhere by value: a rotation the root writes is what a reader sees", () => {
+    const tokenRef: TokenRef = { current: "boot-credential" };
+    const runnerTokenRef: TokenRef = { current: "boot-credential" };
+    const config = mapManagerOptionsToConfig(
+      { ...base, proxyEndpoint: "https://localhost:9090", stigmerToken: "boot-credential" },
+      tokenRef,
+      runnerTokenRef,
+    );
+    expect(config.stigmerTokenRef).toBe(tokenRef);
+    expect(config.cursorApiKey).toBe("proxy-managed");
+
+    // The pre-mint lockstep the coordinator keeps: one rotation writes both refs.
+    tokenRef.current = "session-credential";
+    runnerTokenRef.current = "session-credential";
+    expect(config.stigmerTokenRef.current).toBe("session-credential");
+    expect(JSON.stringify(config)).not.toContain("boot-credential");
   });
 
   it("uses cloud only when executionMode is explicitly cloud", () => {
@@ -57,7 +79,7 @@ describe("mapManagerOptionsToConfig", () => {
       executionMode: "cloud",
       proxyEndpoint: "https://proxy.example.com",
       stigmerToken: "tok",
-    });
+    }, ...refs());
     expect(config.mode).toBe("cloud");
   });
 
@@ -67,7 +89,7 @@ describe("mapManagerOptionsToConfig", () => {
       executionMode: "local",
       proxyEndpoint: "https://proxy.example.com",
       stigmerToken: "tok",
-    });
+    }, ...refs());
     expect(config.mode).toBe("local");
   });
 });

package/src/__tests__/runner.test.ts

@@ -1,6 +1,7 @@
 import { describe, it, expect } from "vitest";
 import { mapOptionsToConfig } from "../runner.js";
 import type { StigmerRunnerOptions, StigmerRunner } from "../runner.js";
+import type { TokenRef } from "../config.js";
 
 /**
  * Unit tests for the createStigmerRunner factory.
@@ -107,6 +108,9 @@ describe("StigmerRunnerOptions type contract", () => {
  * credential transport (`proxyEndpoint`): an explicit `executionMode` always
  * wins, and only when it is unset does `mode` fall back to the proxy-derived
  * default for backward compatibility. This mirrors `mapManagerOptionsToConfig`.
+ * The static root binds ONE ref as both the control-plane and the proxy
+ * credential (it mints no separate proxy token), and the config carries no
+ * credential by value (config.ts header).
  */
 describe("mapOptionsToConfig — execution mode", () => {
   const base: StigmerRunnerOptions = {
@@ -114,9 +118,10 @@ describe("mapOptionsToConfig — execution mode", () => {
     temporalAddress: "localhost:7233",
     stigmerEndpoint: "http://localhost:7234",
   };
+  const refs = (): [TokenRef, TokenRef] => [{ current: null }, { current: null }];
 
   it("defaults mode to local with no proxy and no executionMode", () => {
-    const config = mapOptionsToConfig(base);
+    const config = mapOptionsToConfig(base, ...refs());
     expect(config.mode).toBe("local");
   });
 
@@ -125,7 +130,7 @@ describe("mapOptionsToConfig — execution mode", () => {
       ...base,
       proxyEndpoint: "https://proxy.example.com",
       stigmerToken: "tok",
-    });
+    }, ...refs());
     expect(config.mode).toBe("cloud");
     // Proxy transport still engages independently of execution location.
     expect(config.proxyEndpoint).toBe("https://proxy.example.com");
@@ -139,7 +144,7 @@ describe("mapOptionsToConfig — execution mode", () => {
       executionMode: "local",
       proxyEndpoint: "https://proxy.example.com",
       stigmerToken: "tok",
-    });
+    }, ...refs());
     expect(config.mode).toBe("local");
     // Transport still routes through the proxy despite local execution.
     expect(config.proxyEndpoint).toBe("https://proxy.example.com");
@@ -147,9 +152,28 @@ describe("mapOptionsToConfig — execution mode", () => {
   });
 
   it("honors explicit cloud executionMode without a proxy", () => {
-    const config = mapOptionsToConfig({ ...base, executionMode: "cloud" });
+    const config = mapOptionsToConfig({ ...base, executionMode: "cloud" }, ...refs());
     expect(config.mode).toBe("cloud");
   });
+
+  it("binds the one ref as both the control-plane and the proxy credential, and carries no credential by value", () => {
+    const tokenRef: TokenRef = { current: "boot-credential" };
+    const runnerTokenRef: TokenRef = { current: null };
+    const config = mapOptionsToConfig(
+      { ...base, proxyEndpoint: "https://proxy.example.com", stigmerToken: "boot-credential" },
+      tokenRef,
+      runnerTokenRef,
+    );
+    expect(config.stigmerTokenRef).toBe(tokenRef);
+    expect(config.proxyTokenRef).toBe(tokenRef);
+    expect(config.stigmerRunnerTokenRef).toBe(runnerTokenRef);
+    expect(config.cursorApiKey).toBe("proxy-managed");
+
+    tokenRef.current = "renewed-credential";
+    expect(config.stigmerTokenRef.current).toBe("renewed-credential");
+    expect(config.proxyTokenRef?.current).toBe("renewed-credential");
+    expect(JSON.stringify(config)).not.toContain("boot-credential");
+  });
 });
 
 describe("StigmerRunner type contract", () => {

package/src/activities/__tests__/attach-session.test.ts

@@ -21,7 +21,7 @@ import {
 
 const config = {
   stigmerBackendEndpoint: "http://localhost:7234",
-  stigmerToken: "pool-tok",
+  stigmerTokenRef: { current: "pool-tok" },
 } as unknown as Config;
 
 function fakeManager(): PoolAttachTarget & {

package/src/activities/__tests__/call-agent-contracts.test.ts

@@ -61,18 +61,14 @@ vi.mock("../../client/stigmer-client.js", () => ({
   })),
 }));
 
-vi.mock("../../config.js", () => ({
-  loadConfig: () => ({
-    stigmerBackendEndpoint: "http://localhost:7234",
-    stigmerToken: "test-token",
-  }),
-}));
-
 vi.mock("../../shared/heartbeat.js", () => ({
   startHeartbeat: () => ({ stop: vi.fn() }),
 }));
 
 import { callAgentAction } from "../call-agent.js";
+import { testConfig } from "../../__test-utils__/config-fixture.js";
+
+const appConfig = testConfig({ stigmerTokenRef: { current: "test-token" } });
 
 describe("CallAgent server contract compliance", () => {
   beforeEach(() => {
@@ -93,6 +89,7 @@ describe("CallAgent server contract compliance", () => {
         { agent: "notification-analyst", message: "Analyze cohort data", ...config },
         { __stigmer_org_id: "tt-demo", ...env },
         "wfl_parent_123",
+        appConfig,
       );
     } catch (e: any) {
       if (e.name !== "CompleteAsyncError") throw e;

package/src/activities/__tests__/call-agent-status.test.ts

@@ -27,10 +27,7 @@ vi.mock("../../client/stigmer-client.js", () => ({
   })),
 }));
 
-vi.mock("../../config.js", () => ({
-  loadConfig: () => ({ stigmerBackendEndpoint: "http://localhost:7234", stigmerToken: "t" }),
-}));
-
+import { StigmerClient } from "../../client/stigmer-client.js";
 import {
   updateWorkflowFileReviewStatus,
   getAwaitingFileReviewChangeSetIds,
@@ -38,6 +35,10 @@ import {
   clearWorkflowApprovalStatus,
 } from "../call-agent-status.js";
 
+// The client the factory would build from the runner's Config; the mocked
+// constructor above is what it resolves to.
+const client = new StigmerClient({ endpoint: "http://localhost:7234" });
+
 describe("call-agent-status file-review activities", () => {
   beforeEach(() => {
     capturedUpdates = [];
@@ -46,7 +47,7 @@ describe("call-agent-status file-review activities", () => {
 
   describe("updateWorkflowFileReviewStatus", () => {
     it("writes a single per-child reference scoped to the child", async () => {
-      await updateWorkflowFileReviewStatus("wfx_1", "aex_child", ["fcs_1", "fcs_2"]);
+      await updateWorkflowFileReviewStatus(client, "wfx_1", "aex_child", ["fcs_1", "fcs_2"]);
 
       expect(capturedUpdates).toHaveLength(1);
       const { executionId, status, options } = capturedUpdates[0];
@@ -59,7 +60,7 @@ describe("call-agent-status file-review activities", () => {
     });
 
     it("empty changeSetIds writes an empty list (scoped clear for the child)", async () => {
-      await updateWorkflowFileReviewStatus("wfx_1", "aex_child", []);
+      await updateWorkflowFileReviewStatus(client, "wfx_1", "aex_child", []);
 
       expect(capturedUpdates).toHaveLength(1);
       const { status, options } = capturedUpdates[0];
@@ -69,8 +70,8 @@ describe("call-agent-status file-review activities", () => {
     });
 
     it("is a no-op when executionId or childExecutionId is missing", async () => {
-      await updateWorkflowFileReviewStatus("", "aex_child", ["fcs_1"]);
-      await updateWorkflowFileReviewStatus("wfx_1", "", ["fcs_1"]);
+      await updateWorkflowFileReviewStatus(client, "", "aex_child", ["fcs_1"]);
+      await updateWorkflowFileReviewStatus(client, "wfx_1", "", ["fcs_1"]);
       expect(capturedUpdates).toHaveLength(0);
     });
   });
@@ -88,17 +89,17 @@ describe("call-agent-status file-review activities", () => {
         },
       };
 
-      const ids = await getAwaitingFileReviewChangeSetIds("aex_child");
+      const ids = await getAwaitingFileReviewChangeSetIds(client, "aex_child");
       expect(ids).toEqual(["fcs_await1", "fcs_await2"]);
     });
 
     it("returns empty when the child has no file change sets", async () => {
       mockGetExecutionResult = { status: {} };
-      expect(await getAwaitingFileReviewChangeSetIds("aex_child")).toEqual([]);
+      expect(await getAwaitingFileReviewChangeSetIds(client, "aex_child")).toEqual([]);
     });
 
     it("returns empty (non-fatal) on a missing child id", async () => {
-      expect(await getAwaitingFileReviewChangeSetIds("")).toEqual([]);
+      expect(await getAwaitingFileReviewChangeSetIds(client, "")).toEqual([]);
       expect(capturedUpdates).toHaveLength(0);
     });
   });
@@ -114,7 +115,7 @@ describe("call-agent-status file-review activities", () => {
         },
       };
 
-      const surfaced = await updateWorkflowTaskApprovalStatus("wfx_1", "task_a", "aex_child");
+      const surfaced = await updateWorkflowTaskApprovalStatus(client, "wfx_1", "task_a", "aex_child");
 
       expect(surfaced).toBe(true);
       expect(capturedUpdates).toHaveLength(1);
@@ -131,19 +132,19 @@ describe("call-agent-status file-review activities", () => {
       // approval card, and the orchestrator deliberately does not retry.
       mockGetExecutionResult = { status: { pendingApprovals: [] } };
 
-      const surfaced = await updateWorkflowTaskApprovalStatus("wfx_1", "task_a", "aex_child");
+      const surfaced = await updateWorkflowTaskApprovalStatus(client, "wfx_1", "task_a", "aex_child");
 
       expect(surfaced).toBe(false);
       expect(capturedUpdates).toHaveLength(0);
     });
 
     it("updateWorkflowTaskApprovalStatus is a no-op without a child id", async () => {
-      expect(await updateWorkflowTaskApprovalStatus("wfx_1", "task_a", "")).toBe(false);
+      expect(await updateWorkflowTaskApprovalStatus(client, "wfx_1", "task_a", "")).toBe(false);
       expect(capturedUpdates).toHaveLength(0);
     });
 
     it("clearWorkflowApprovalStatus scopes the clear to the given child", async () => {
-      await clearWorkflowApprovalStatus("wfx_1", "aex_child");
+      await clearWorkflowApprovalStatus(client, "wfx_1", "aex_child");
 
       expect(capturedUpdates).toHaveLength(1);
       const { status, options } = capturedUpdates[0];
@@ -153,7 +154,7 @@ describe("call-agent-status file-review activities", () => {
     });
 
     it("clearWorkflowApprovalStatus is a no-op without a child id", async () => {
-      await clearWorkflowApprovalStatus("wfx_1", "");
+      await clearWorkflowApprovalStatus(client, "wfx_1", "");
       expect(capturedUpdates).toHaveLength(0);
     });
   });

package/src/activities/__tests__/call-agent.test.ts

@@ -30,18 +30,16 @@ vi.mock("../../client/stigmer-client.js", () => ({
   })),
 }));
 
-vi.mock("../../config.js", () => ({
-  loadConfig: () => ({
-    stigmerBackendEndpoint: "http://localhost:7234",
-    stigmerToken: "test-token",
-  }),
-}));
-
 vi.mock("../../shared/heartbeat.js", () => ({
   startHeartbeat: () => ({ stop: vi.fn() }),
 }));
 
 import { callAgentAction } from "../call-agent.js";
+import { testConfig } from "../../__test-utils__/config-fixture.js";
+
+// The runner's injected Config, as the factory passes it (the mocked client
+// constructor above is what its refs resolve to).
+const appConfig = testConfig({ stigmerTokenRef: { current: "test-token" } });
 
 describe("callAgentAction", () => {
   beforeEach(() => {
@@ -68,6 +66,7 @@ describe("callAgentAction", () => {
           { agent: "notification-analyst", message: "Analyze data" },
           { __stigmer_org_id: "tt-demo" },
           "wfl_parent123",
+          appConfig,
         ),
       ).rejects.toThrow("CompleteAsyncError");
 
@@ -84,6 +83,7 @@ describe("callAgentAction", () => {
           { agent: "acme/my-agent", message: "Do something" },
           { __stigmer_org_id: "default-org" },
           "wfl_parent456",
+          appConfig,
         ),
       ).rejects.toThrow("CompleteAsyncError");
 
@@ -100,6 +100,7 @@ describe("callAgentAction", () => {
           { agent: "explicit-org/my-agent", message: "Hello" },
           { __stigmer_org_id: "workflow-org" },
           "wfl_parent789",
+          appConfig,
         ),
       ).rejects.toThrow("CompleteAsyncError");
 
@@ -122,6 +123,7 @@ describe("callAgentAction", () => {
           { agent: "my-agent", message: "Hello" },
           {},
           "wfl_parent",
+          appConfig,
         ),
       ).rejects.toThrow("call:agent requires an organization context");
     });
@@ -132,6 +134,7 @@ describe("callAgentAction", () => {
           { agent: "my-agent", message: "Hello" },
           { __stigmer_org_id: "env-org" },
           "wfl_parent",
+          appConfig,
         ),
       ).rejects.toThrow("CompleteAsyncError");
 
@@ -152,6 +155,7 @@ describe("callAgentAction", () => {
           { agent: "ghost-agent", message: "Hello" },
           { __stigmer_org_id: "test-org" },
           "wfl_parent",
+          appConfig,
         ),
       ).rejects.toThrow("resolved but has no metadata.id");
     });
@@ -164,6 +168,7 @@ describe("callAgentAction", () => {
           { agent: "", message: "Hello" },
           { __stigmer_org_id: "test-org" },
           "wfl_parent",
+          appConfig,
         ),
       ).rejects.toThrow("'agent' resolved to empty");
     });
@@ -174,6 +179,7 @@ describe("callAgentAction", () => {
           { agent: "my-agent", message: "" },
           { __stigmer_org_id: "test-org" },
           "wfl_parent",
+          appConfig,
         ),
       ).rejects.toThrow("'message' resolved to empty");
     });
@@ -186,6 +192,7 @@ describe("callAgentAction", () => {
           { agent: "my-agent", message: "Hello", harness: "CURSOR" },
           { __stigmer_org_id: "test-org" },
           "wfl_parent",
+          appConfig,
         ),
       ).rejects.toThrow("CompleteAsyncError");
 
@@ -204,6 +211,7 @@ describe("callAgentAction", () => {
           { agent: "my-agent", message: "Hello" },
           { __stigmer_org_id: "test-org" },
           "wfl_parent",
+          appConfig,
         ),
       ).rejects.toThrow("CompleteAsyncError");
 
@@ -218,6 +226,7 @@ describe("callAgentAction", () => {
           { agent: "my-agent", message: "Review this" },
           { __stigmer_org_id: "test-org" },
           "wfl_parent_id",
+          appConfig,
         ),
       ).rejects.toThrow("CompleteAsyncError");
 
@@ -243,6 +252,7 @@ describe("callAgentAction", () => {
             __stigmer_activity_task_queue: "wfexec:wex_abc123",
           },
           "wfl_parent",
+          appConfig,
         ),
       ).rejects.toThrow("CompleteAsyncError");
 
@@ -259,6 +269,7 @@ describe("callAgentAction", () => {
             __stigmer_activity_task_queue: "stigmer_runner",
           },
           "wfl_parent",
+          appConfig,
         ),
       ).rejects.toThrow("CompleteAsyncError");
 
@@ -282,6 +293,7 @@ describe("callAgentAction", () => {
           },
           { __stigmer_org_id: "test-org" },
           "wfl_parent",
+          appConfig,
         ),
       ).rejects.toThrow("CompleteAsyncError");
 
@@ -302,6 +314,7 @@ describe("callAgentAction", () => {
           },
           { __stigmer_org_id: "test-org" },
           "wfl_parent",
+          appConfig,
         ),
       ).rejects.toThrow("CompleteAsyncError");
 
@@ -323,6 +336,7 @@ describe("callAgentAction", () => {
           },
           { __stigmer_org_id: "test-org" },
           "wfl_parent",
+          appConfig,
         ),
       ).rejects.toThrow(
         "call:agent run_config.service_tier 'SERVICE_TIER_TURBO' has no proto mapping",
@@ -335,6 +349,7 @@ describe("callAgentAction", () => {
           { agent: "my-agent", message: "Hello" },
           { __stigmer_org_id: "test-org" },
           "wfl_parent",
+          appConfig,
         ),
       ).rejects.toThrow("CompleteAsyncError");
 
@@ -352,6 +367,7 @@ describe("callAgentAction", () => {
           },
           { __stigmer_org_id: "test-org" },
           "wfl_parent",
+          appConfig,
         ),
       ).rejects.toThrow("CompleteAsyncError");
 
@@ -379,6 +395,7 @@ describe("callAgentAction", () => {
           },
           { __stigmer_org_id: "test-org" },
           "wfl_parent",
+          appConfig,
         ),
       ).rejects.toThrow("CompleteAsyncError");
 
@@ -398,6 +415,7 @@ describe("callAgentAction", () => {
           { agent: "my-agent", message: "Hello" },
           { __stigmer_org_id: "test-org" },
           "wfl_parent",
+          appConfig,
         ),
       ).rejects.toThrow("CompleteAsyncError");
 
@@ -416,6 +434,7 @@ describe("callAgentAction", () => {
           } as any,
           { __stigmer_org_id: "test-org" },
           "wfl_parent",
+          appConfig,
         ),
       ).rejects.toThrow("CompleteAsyncError");
 
@@ -430,6 +449,7 @@ describe("callAgentAction", () => {
           { agent: "my-agent", message: "Hello" },
           { __stigmer_org_id: "test-org" },
           "wfl_parent",
+          appConfig,
         ),
       ).rejects.toThrow("CompleteAsyncError");
 
@@ -463,6 +483,7 @@ describe("callAgentAction", () => {
           },
           { __stigmer_org_id: "test-org" },
           "wfl_parent",
+          appConfig,
         ),
       ).rejects.toThrow("CompleteAsyncError");
 

package/src/activities/__tests__/call-function.test.ts

@@ -1,14 +1,15 @@
 import { describe, it, expect } from "vitest";
 import { createCallFunctionActivities } from "../call-function.js";
+import { testConfig } from "../../__test-utils__/config-fixture.js";
 
 describe("createCallFunctionActivities", () => {
   it("creates activities object with CallFunction method", () => {
-    const activities = createCallFunctionActivities();
+    const activities = createCallFunctionActivities(testConfig());
     expect(typeof activities.CallFunction).toBe("function");
   });
 
   it("throws non-retryable error for unknown call type", async () => {
-    const activities = createCallFunctionActivities();
+    const activities = createCallFunctionActivities(testConfig());
 
     try {
       await activities.CallFunction("unknown_function", {}, {}, "exec-1");
@@ -20,7 +21,7 @@ describe("createCallFunctionActivities", () => {
   });
 
   it("throws non-retryable error for call:agent (not yet implemented)", async () => {
-    const activities = createCallFunctionActivities();
+    const activities = createCallFunctionActivities(testConfig());
 
     try {
       await activities.CallFunction("agent", { agent: "code-reviewer" }, {}, "exec-1");
@@ -31,7 +32,7 @@ describe("createCallFunctionActivities", () => {
   });
 
   it("resolves runtime placeholders in config before dispatching", async () => {
-    const activities = createCallFunctionActivities();
+    const activities = createCallFunctionActivities(testConfig());
 
     try {
       await activities.CallFunction(

package/src/activities/__tests__/classify-tool-approvals.test.ts

@@ -726,7 +726,7 @@ function makeConfig() {
     temporalNamespace: "default",
     stigmerBackendEndpoint: "http://localhost:7234",
   mcpBridgeEndpoint: null,
-    stigmerToken: "test-token",
+    stigmerTokenRef: { current: "test-token" },
     cursorApiKey: "",
     workspaceRootDir: "/tmp/test",
     mode: "local" as const,

package/src/activities/__tests__/discover-mcp-server.test.ts

@@ -902,7 +902,7 @@ function makeConfig() {
     temporalNamespace: "default",
     stigmerBackendEndpoint: "http://localhost:7234",
   mcpBridgeEndpoint: null,
-    stigmerToken: "test-token",
+    stigmerTokenRef: { current: "test-token" },
     cursorApiKey: "",
     workspaceRootDir: "/tmp/test",
     mode: "local" as const,

package/src/activities/__tests__/generate-session-subject-wire.test.ts

@@ -84,7 +84,7 @@ function activityUnderTest() {
   bindHermeticClient(client);
   const config = {
     stigmerBackendEndpoint: "http://localhost:0",
-    stigmerToken: null,
+    stigmerTokenRef: { current: null },
     proxyEndpoint: null,
     primaryModel: "claude-sonnet-4.5",
   } as unknown as Config;