@stigmer/runner 3.29.0 → 3.31.0

package/src/activities/__tests__/call-eval.test.ts

@@ -0,0 +1,115 @@
+// Unit arms for the eval task's verdict schema: the structured-output shape
+// the judge is bound to, per scoring mode (stigmer#1293).
+//
+// Pinned: each mode declares exactly the fields its parser reads, all
+// required, and a multi-criteria `name` is limited to the configured
+// criteria's names; the schema reaches the LLM call in place of the empty
+// object it replaced; converted the way the LLM call converts it, the schema
+// accepts a well-formed verdict and refuses a nameless criterion, an
+// unconfigured name and a missing field, the shapes a real judge returned
+// when the schema declared no fields; a structured multi-criteria verdict
+// comes back as named criteria with their weighted score.
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { jsonSchemaToZod } from "../../shared/json-schema-to-zod.js";
+
+const callLlmAction = vi.fn();
+vi.mock("../call-llm.js", () => ({ callLlmAction: (...args: unknown[]) => callLlmAction(...args) }));
+
+const { callEvalAction, verdictSchema } = await import("../call-eval.js");
+
+const CRITERIA = [
+  { name: "accurate", description: "matches the source", weight: 3 },
+  { name: "concise", description: "short", weight: 1 },
+];
+
+beforeEach(() => {
+  callLlmAction.mockReset();
+});
+
+describe("verdictSchema", () => {
+  it("declares the fields each mode's parser reads, all required", () => {
+    expect(verdictSchema("EVAL_PASS_FAIL")).toEqual({
+      type: "object",
+      properties: { pass: { type: "boolean" }, reasoning: { type: "string" } },
+      required: ["pass", "reasoning"],
+    });
+    expect(verdictSchema("EVAL_NUMERIC_SCORE")).toEqual({
+      type: "object",
+      properties: { score: { type: "number" }, reasoning: { type: "string" } },
+      required: ["score", "reasoning"],
+    });
+    expect(verdictSchema("EVAL_MULTI_CRITERIA", CRITERIA)).toEqual({
+      type: "object",
+      properties: {
+        criteria: {
+          type: "array",
+          items: {
+            type: "object",
+            properties: {
+              name: { type: "string", enum: ["accurate", "concise"] },
+              score: { type: "number" },
+              reasoning: { type: "string" },
+            },
+            required: ["name", "score", "reasoning"],
+          },
+        },
+      },
+      required: ["criteria"],
+    });
+  });
+
+  it("refuses an unknown scoring mode", () => {
+    expect(() => verdictSchema("EVAL_VIBES")).toThrow("Unknown scoring_mode 'EVAL_VIBES'");
+  });
+
+  it("converted as the LLM call converts it, binds the multi-criteria verdict's shape", () => {
+    const schema = jsonSchemaToZod(verdictSchema("EVAL_MULTI_CRITERIA", CRITERIA));
+    const good = {
+      criteria: [
+        { name: "accurate", score: 1, reasoning: "right" },
+        { name: "concise", score: 0.5, reasoning: "long" },
+      ],
+    };
+    expect(schema.safeParse(good).success).toBe(true);
+    expect(schema.safeParse({}).success, "no criteria at all").toBe(false);
+    expect(schema.safeParse({ criteria: [{ criterion: "accurate", score: 1, reasoning: "r" }] }).success, "a nameless criterion").toBe(false);
+    expect(schema.safeParse({ criteria: [{ name: "style", score: 1, reasoning: "r" }] }).success, "an unconfigured name").toBe(false);
+    expect(schema.safeParse({ criteria: [{ name: "accurate", reasoning: "r" }] }).success, "a missing score").toBe(false);
+  });
+});
+
+describe("callEvalAction", () => {
+  function reply(result: unknown): { result: unknown; model: string; input_tokens: number; output_tokens: number } {
+    return { result, model: "claude-sonnet-4-6", input_tokens: 100, output_tokens: 20 };
+  }
+
+  it("binds the judge to its mode's verdict schema, never an empty object", async () => {
+    for (const [mode, result] of [
+      ["EVAL_PASS_FAIL", { pass: true, reasoning: "ok" }],
+      ["EVAL_NUMERIC_SCORE", { score: 0.5, reasoning: "ok" }],
+    ] as const) {
+      callLlmAction.mockResolvedValueOnce(reply(result));
+      await callEvalAction({ model: "claude-sonnet-4-6", subject: "s", rubric: "r", scoring_mode: mode }, {}, "exec-1");
+      expect(callLlmAction.mock.lastCall?.[0].response_schema).toEqual(verdictSchema(mode));
+    }
+  });
+
+  it("reads a structured multi-criteria verdict as named criteria with their weighted score", async () => {
+    callLlmAction.mockResolvedValueOnce(
+      reply({
+        criteria: [
+          { name: "accurate", score: 1, reasoning: "right" },
+          { name: "concise", score: 0.5, reasoning: "long" },
+        ],
+      }),
+    );
+    const result = await callEvalAction(
+      { model: "claude-sonnet-4-6", subject: "s", rubric: "r", scoring_mode: "EVAL_MULTI_CRITERIA", criteria: CRITERIA, threshold: 0 },
+      {},
+      "exec-2",
+    );
+    expect(callLlmAction.mock.lastCall?.[0].response_schema).toEqual(verdictSchema("EVAL_MULTI_CRITERIA", CRITERIA));
+    expect(result.criteria?.map((c) => c.name)).toEqual(["accurate", "concise"]);
+    expect(result.score).toBeCloseTo(0.875, 5);
+  });
+});

package/src/activities/__tests__/classify-tool-approvals.test.ts

@@ -724,6 +724,7 @@ function makeConfig() {
     taskQueue: "test",
     temporalAddress: "localhost:7233",
     temporalNamespace: "default",
+    temporalConnection: {},
     stigmerBackendEndpoint: "http://localhost:7234",
   mcpBridgeEndpoint: null,
     stigmerTokenRef: { current: "test-token" },

package/src/activities/__tests__/discover-mcp-server.test.ts

@@ -900,6 +900,7 @@ function makeConfig() {
     taskQueue: "test",
     temporalAddress: "localhost:7233",
     temporalNamespace: "default",
+    temporalConnection: {},
     stigmerBackendEndpoint: "http://localhost:7234",
   mcpBridgeEndpoint: null,
     stigmerTokenRef: { current: "test-token" },

package/src/activities/call-eval.ts

@@ -11,6 +11,16 @@
  *
  * Uses callLlmAction for the underlying LLM call, keeping proxy/auth
  * handling in one place.
+ *
+ * The judge answers through structured output, and the schema it is given is
+ * the verdict's own shape for its scoring mode (verdictSchema): the forced
+ * `extract` tool a provider binds describes exactly the fields the parsers
+ * below read, with a multi-criteria `name` limited to the configured
+ * criteria. An object schema with no fields left the model to guess the
+ * shape from the prompt's prose alone, and on a real judge the multi-criteria
+ * mode came back with no criteria or with nameless ones, read as a score of
+ * 0 or an average over "unknown" (stigmer#1293). The prompts still spell the
+ * format out; the schema is what binds it.
  */
 
 import { ApplicationFailure } from "@temporalio/activity";
@@ -54,6 +64,54 @@ export interface EvalResult {
   output_tokens: number;
 }
 
+// ─── Verdict Schemas ─────────────────────────────────────────────────────
+
+/**
+ * The structured-output schema of a judge's verdict, per scoring mode: the
+ * fields the mode's parser reads, all required. For EVAL_MULTI_CRITERIA each
+ * returned criterion's `name` is one of the configured criteria's names.
+ */
+export function verdictSchema(scoringMode: string, criteria: readonly EvalCriterion[] = []): Record<string, unknown> {
+  switch (scoringMode) {
+    case "EVAL_PASS_FAIL":
+      return {
+        type: "object",
+        properties: { pass: { type: "boolean" }, reasoning: { type: "string" } },
+        required: ["pass", "reasoning"],
+      };
+    case "EVAL_NUMERIC_SCORE":
+      return {
+        type: "object",
+        properties: { score: { type: "number" }, reasoning: { type: "string" } },
+        required: ["score", "reasoning"],
+      };
+    case "EVAL_MULTI_CRITERIA":
+      return {
+        type: "object",
+        properties: {
+          criteria: {
+            type: "array",
+            items: {
+              type: "object",
+              properties: {
+                name: { type: "string", enum: criteria.map((c) => c.name) },
+                score: { type: "number" },
+                reasoning: { type: "string" },
+              },
+              required: ["name", "score", "reasoning"],
+            },
+          },
+        },
+        required: ["criteria"],
+      };
+    default:
+      throw ApplicationFailure.nonRetryable(
+        `Unknown scoring_mode '${scoringMode}'. Supported: EVAL_PASS_FAIL, EVAL_NUMERIC_SCORE, EVAL_MULTI_CRITERIA`,
+        "EVAL_UNKNOWN_SCORING_MODE",
+      );
+  }
+}
+
 // ─── Judge Prompt Builders ───────────────────────────────────────────────
 
 function buildPassFailPrompt(rubric: string, subject: string): string {
@@ -272,7 +330,7 @@ export async function callEvalAction(
       model: config.model,
       prompt,
       system_prompt: config.system_prompt,
-      response_schema: { type: "object" },
+      response_schema: verdictSchema(scoringMode, config.criteria),
     },
     runtimeEnv,
     executionId,

package/src/activities/execute-cursor/__test-utils__/hermetic-cursor.ts

@@ -145,6 +145,7 @@ export function hermeticCursorConfig(env: HermeticEnvironment): Config {
     taskQueue: "hermetic-test-queue",
     temporalAddress: "localhost:7233",
     temporalNamespace: "default",
+    temporalConnection: {},
     stigmerBackendEndpoint: "http://localhost:7234",
     mcpBridgeEndpoint: null,
     stigmerTokenRef: { current: null },

package/src/activities/execute-deep-agent/__test-utils__/hermetic-deep-agent.ts

@@ -143,6 +143,7 @@ export function hermeticDeepAgentConfig(env: HermeticEnvironment, checkpointerTy
     taskQueue: "hermetic-test-queue",
     temporalAddress: "localhost:7233",
     temporalNamespace: "default",
+    temporalConnection: {},
     stigmerBackendEndpoint: "http://localhost:7234",
     mcpBridgeEndpoint: null,
     stigmerTokenRef: { current: null },

package/src/activities/execute-deep-agent/__tests__/adapter.test.ts

@@ -23,6 +23,7 @@ const CONFIG: Config = {
   taskQueue: "adapter-test-queue",
   temporalAddress: "localhost:7233",
   temporalNamespace: "default",
+  temporalConnection: {},
   stigmerBackendEndpoint: "http://localhost:7234",
   mcpBridgeEndpoint: null,
   stigmerTokenRef: { current: "tok" },

package/src/activities/hydrate-workflow-execution.ts

@@ -19,7 +19,7 @@ import { StigmerClient } from "../client/stigmer-client.js";
 import { loadWorkflowFromYaml } from "../workflow-engine/loader.js";
 import { ValidationState } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/serverless/validation_pb";
 import type { Config } from "../config.js";
-import type { ExecuteServerlessWorkflowInput } from "../workflows/execute-serverless-workflow.js";
+import type { ExecuteServerlessWorkflowInput } from "../workflows/engine-core.js";
 
 export interface HydrateInput {
   readonly execution_id: string;

package/src/activities/workflow-event-activities.ts

@@ -167,8 +167,8 @@ function nextSequence(): bigint {
  * failed run) returns the highest persisted sequence_number, so new
  * events continue from N+1.
  *
- * When executionId is empty (direct executeServerlessWorkflow without a
- * persisted execution), returns 0 as a safe fallback.
+ * When executionId is empty (an engine run with no persisted execution,
+ * as the test harness's inline entry makes), returns 0 as a safe fallback.
  *
  * Returns a plain number — the value crosses back into the workflow
  * through Temporal's JSON payload converter, which cannot carry BigInt.

package/src/config.ts

@@ -72,6 +72,8 @@ export const DEFAULT_CURSOR_AGENT_RESOLVE_TIMEOUT_MS = 120_000;
 export { DEFAULT_WORKSPACE_LOCK_TIMEOUT_MS } from "./shared/workspace/workspace-lock.js";
 import { DEFAULT_WORKSPACE_LOCK_TIMEOUT_MS } from "./shared/workspace/workspace-lock.js";
 import { getRunnerSecret } from "./shared/runner-credential-store.js";
+import { loadTemporalConnectionConfig } from "@stigmer/temporal-codecs";
+import type { TemporalConnectionConfig } from "@stigmer/temporal-codecs";
 
 /**
  * A shared mutable credential reference. The root that owns a credential
@@ -88,6 +90,13 @@ export interface Config {
   readonly taskQueue: string;
   readonly temporalAddress: string;
   readonly temporalNamespace: string;
+  /**
+   * TLS, mutual TLS or an API key for the Temporal connection, read from
+   * the `STIGMER_TEMPORAL_*` settings through the credential store (the
+   * API key and the client key are in its custody list, so they never
+   * stay in the environment agent tools inherit). `{}` is plaintext.
+   */
+  readonly temporalConnection: TemporalConnectionConfig;
   readonly stigmerBackendEndpoint: string;
   /**
    * The control-plane credential, read per use (the module header). The
@@ -272,6 +281,7 @@ export function loadConfig(): Config {
     taskQueue,
     temporalAddress,
     temporalNamespace,
+    temporalConnection: loadTemporalConnectionConfig(getRunnerSecret),
     stigmerBackendEndpoint,
     stigmerTokenRef,
     mcpBridgeEndpoint,

package/src/harness/transcript/__tests__/builder.test.ts

@@ -174,7 +174,7 @@ describe("TranscriptBuilder — tool_finished and tool_error are upserts", () =>
   });
 });
 
-describe("TranscriptBuilder — every row with args carries an elided, redacted argsPreview", () => {
+describe("TranscriptBuilder — every row with args carries them redacted, and an elided, redacted argsPreview", () => {
   it("an ungated row's preview is its args, secret keys redacted", () => {
     const { status } = feed(builder(), [
       { kind: "tool_started", callId: "c-1", name: "connect", input: { host: "localhost", password: "super-secret" }, mcpServerSlug: "db" },
@@ -182,6 +182,61 @@ describe("TranscriptBuilder — every row with args carries an elided, redacted
     expect(JSON.parse(rowOf(status, "c-1").argsPreview)).toEqual({ host: "localhost", password: "[REDACTED]" });
   });
 
+  // stigmer#1119: the row's own args were stored raw, so a settled row's
+  // detail view showed what the waiting row's preview hid. Every path that
+  // writes a row's args redacts them; every other key stays verbatim.
+  describe("the row's args never carry a secret-keyed value, on every path that writes them", () => {
+    const input = { host: "localhost", password: "super-secret" };
+    const redacted = { host: "localhost", password: "[REDACTED]" };
+
+    it("a started call", () => {
+      const { status } = feed(builder(), [{ kind: "tool_started", callId: "c-1", name: "connect", input, mcpServerSlug: "db" }]);
+      expect(rowOf(status, "c-1").args).toEqual(redacted);
+    });
+
+    it("a re-emitted start filling the args the row lacked", () => {
+      const { status } = feed(builder(), [
+        { kind: "tool_started", callId: "c-1", name: "connect", input: {}, mcpServerSlug: "db" },
+        { kind: "tool_started", callId: "c-1", name: "connect", input, mcpServerSlug: "db" },
+      ]);
+      expect(rowOf(status, "c-1").args).toEqual(redacted);
+      expect(JSON.parse(rowOf(status, "c-1").argsPreview)).toEqual(redacted);
+    });
+
+    it("arguments streamed in chunks, once they parse", () => {
+      const { status } = feed(builder(), [
+        { kind: "tool_started", callId: "c-1", name: "connect", input: {}, mcpServerSlug: "db" },
+        { kind: "tool_arg_delta", callId: "c-1", argsChunk: '{"host":"localhost",' },
+        { kind: "tool_arg_delta", callId: "c-1", argsChunk: '"password":"super-secret"}' },
+      ]);
+      expect(rowOf(status, "c-1").args).toEqual(redacted);
+    });
+
+    it("streamed arguments that parse to something other than an object are not args", () => {
+      const { status } = feed(builder(), [
+        { kind: "tool_started", callId: "c-1", name: "connect", input: {}, mcpServerSlug: "db" },
+        { kind: "tool_arg_delta", callId: "c-1", argsChunk: '"super-secret"' },
+      ]);
+      expect(rowOf(status, "c-1").args).toBeUndefined();
+    });
+
+    it("an approval that reopens a streamed row with the proposal's args", () => {
+      const { status } = feed(builder(), [
+        { kind: "tool_started", callId: "c-1", name: "connect", input: { host: "localhost" }, mcpServerSlug: "db" },
+        { kind: "approval_proposed", callId: "c-1", name: "connect", mcpServerSlug: "db", message: "Connect?", args: input },
+      ]);
+      expect(rowOf(status, "c-1").args).toEqual(redacted);
+      expect(JSON.parse(rowOf(status, "c-1").argsPreview)).toEqual(redacted);
+    });
+
+    it("an approval for a call the stream never showed", () => {
+      const { status } = feed(builder(), [
+        { kind: "approval_proposed", callId: "c-1", name: "connect", mcpServerSlug: "db", message: "Connect?", args: input },
+      ]);
+      expect(rowOf(status, "c-1").args).toEqual(redacted);
+    });
+  });
+
   it("a long non-salient value is left out of the preview; a salient one (the command) survives verbatim", () => {
     const command = "echo " + "x".repeat(400);
     const { status } = feed(builder(), [

package/src/harness/transcript/builder.ts

@@ -39,8 +39,9 @@
  *     RUNNING (a WAITING row on native's durable-checkpoint resume; an
  *     INTERRUPTED row on a recovery replay, the enum's supersede rule) and
  *     takes the args and preview it lacked — never duplicated. Every row
- *     with args carries `argsPreview`, elided and redacted, salient fields
- *     verbatim. A finish or an error is an upsert: status
+ *     with args carries them with secret-keyed values redacted
+ *     (stigmer#1119), and an `argsPreview` elided and redacted, salient
+ *     fields verbatim. A finish or an error is an upsert: status
  *     monotonic, `completedAt` once, a non-empty result or message
  *     overwrites, an empty one never clears; a re-emit that
  *     changes nothing forces no persist; a fact the harness
@@ -124,7 +125,7 @@ import {
   ToolKind,
 } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 import { POLICY_ENGINE_VERSION, toProtoPolicySource } from "../../shared/approval-policy.js";
-import { SALIENT_ARG_FIELDS, buildElidedArgsPreview } from "../../shared/args-preview.js";
+import { SALIENT_ARG_FIELDS, buildElidedArgsPreview, redactSensitiveArgs } from "../../shared/args-preview.js";
 import { classifyTool } from "../../shared/tool-kind.js";
 import { applyTodoUpdate } from "../../shared/todos.js";
 import { utcTimestamp } from "../../shared/status.js";
@@ -453,7 +454,7 @@ export class TranscriptBuilder {
         existing.status = ToolCallStatus.TOOL_CALL_RUNNING;
       }
       if (Object.keys(input).length > 0) {
-        if (!existing.args) existing.args = input as JsonObject;
+        if (!existing.args) existing.args = rowArgs(input);
         if (!existing.argsPreview) stampArgsPreview(existing, input);
       }
       this._dirty = true;
@@ -479,7 +480,7 @@ export class TranscriptBuilder {
     });
 
     if (Object.keys(input).length > 0) {
-      tc.args = input as JsonObject;
+      tc.args = rowArgs(input);
       stampArgsPreview(tc, input);
     }
 
@@ -596,10 +597,16 @@ export class TranscriptBuilder {
     const buffer = (scope.argBuffers.get(callId) ?? "") + argsChunk;
     scope.argBuffers.set(callId, buffer);
 
+    let parsed: unknown;
     try {
-      tc.args = JSON.parse(buffer) as JsonObject;
+      parsed = JSON.parse(buffer);
     } catch {
       // Partial JSON — will parse on next chunk or tool-finished
+      return;
+    }
+    // A tool's arguments are an object (a proto Struct); anything else is not args.
+    if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
+      tc.args = rowArgs(parsed as Record<string, unknown>);
     }
   }
 
@@ -641,7 +648,7 @@ export class TranscriptBuilder {
       // and they re-derive the preview. Absent, the row
       // keeps what it had.
       if (event.args && Object.keys(event.args).length > 0) {
-        existing.args = event.args as JsonObject;
+        existing.args = rowArgs(event.args);
         stampArgsPreview(existing, event.args);
       }
       if (event.contentDigest) existing.approvalContentDigest = event.contentDigest;
@@ -671,7 +678,7 @@ export class TranscriptBuilder {
       tc.policyEngineVersion = POLICY_ENGINE_VERSION;
     }
     if (event.args && Object.keys(event.args).length > 0) {
-      tc.args = event.args as JsonObject;
+      tc.args = rowArgs(event.args);
       stampArgsPreview(tc, event.args);
     }
     if (event.contentDigest) tc.approvalContentDigest = event.contentDigest;
@@ -754,6 +761,20 @@ function finalizeStreaming(transcript: Transcript): void {
   }
 }
 
+/**
+ * The row's `args`, on every row with args: the call's arguments with every
+ * secret-keyed value redacted (`redactSensitiveArgs`, the preview's own
+ * first step). Until stigmer#1119 the row stored them raw and only the
+ * preview was redacted, so a settled row's detail view showed a token the
+ * waiting row had hidden. Nothing that reads a row's args back needs a
+ * secret: exact-apply, the approval identity and the content digest read
+ * path, content, edit and command fields, which
+ * `shared/__tests__/args-preview.test.ts` pins disjoint from the secret keys.
+ */
+function rowArgs(args: Record<string, unknown>): JsonObject {
+  return redactSensitiveArgs(args) as JsonObject;
+}
+
 /**
  * The row's `args_preview`, on EVERY row with args (since #1097):
  * `message.proto` promises it sanitized, redacted, at creation, for inline

package/src/runner-manager.ts

@@ -42,6 +42,8 @@ import {
   getRunnerSecret,
   setRunnerSecret,
 } from "./shared/runner-credential-store.js";
+import { loadTemporalConnectionConfig } from "@stigmer/temporal-codecs";
+import type { TemporalConnectionConfig } from "@stigmer/temporal-codecs";
 import { createRunnerTokenCoordinator } from "./runner-token-coordinator.js";
 // Per-task-queue in-flight activity tracking lives in ./in-flight.ts so the
 // activity interceptor (no manager-closure handle) and unit tests can reach it.
@@ -86,6 +88,15 @@ export interface RunnerManagerOptions {
   /** Temporal namespace. @default "default" */
   readonly temporalNamespace?: string;
 
+  /**
+   * How the runner authenticates to the Temporal frontend: TLS, mutual TLS
+   * or an API key, in the SDK's own shape (`@stigmer/temporal-codecs`'
+   * `TemporalConnectionConfig`). When omitted, the runner reads the
+   * `STIGMER_TEMPORAL_*` settings from its environment, through its secret
+   * store. `{}` forces a plaintext connection.
+   */
+  readonly temporalConnection?: TemporalConnectionConfig;
+
   /** Auth token for authenticating with the Stigmer server. */
   readonly stigmerToken?: string;
 
@@ -368,6 +379,7 @@ export async function createStigmerRunnerManager(
 
   const connection = await NativeConnection.connect({
     address: config.temporalAddress,
+    ...config.temporalConnection,
   });
   markBoot("connection_opened");
 
@@ -707,6 +719,8 @@ export function mapManagerOptionsToConfig(
     // resolveTemporalCoordinates before any Temporal connection is opened.
     temporalAddress: options.temporalAddress ?? "",
     temporalNamespace: options.temporalNamespace ?? "default",
+    temporalConnection:
+      options.temporalConnection ?? loadTemporalConnectionConfig(getRunnerSecret),
     stigmerBackendEndpoint: normalizeEndpoint(options.stigmerEndpoint),
     // Env-only like the env-loaded path (loadConfig): the bridge endpoint
     // is deployment topology, not per-session state.

package/src/runner.ts

@@ -24,8 +24,11 @@ import { createRunnerTokenCoordinator } from "./runner-token-coordinator.js";
 import { assertLlmBackendsPreflight } from "./preflight.js";
 import {
   captureRunnerSecrets,
+  getRunnerSecret,
   setRunnerSecret,
 } from "./shared/runner-credential-store.js";
+import { loadTemporalConnectionConfig } from "@stigmer/temporal-codecs";
+import type { TemporalConnectionConfig } from "@stigmer/temporal-codecs";
 import { markBoot, emitRunnerBootTiming } from "./shared/cold-start-timing.js";
 
 /**
@@ -51,6 +54,15 @@ export interface StigmerRunnerOptions {
   /** Temporal namespace. @default "default" */
   readonly temporalNamespace?: string;
 
+  /**
+   * How the runner authenticates to the Temporal frontend: TLS, mutual TLS
+   * or an API key, in the SDK's own shape (`@stigmer/temporal-codecs`'
+   * `TemporalConnectionConfig`). When omitted, the runner reads the
+   * `STIGMER_TEMPORAL_*` settings from its environment, through its secret
+   * store. `{}` forces a plaintext connection.
+   */
+  readonly temporalConnection?: TemporalConnectionConfig;
+
   /** Auth token for authenticating with the Stigmer server. */
   readonly stigmerToken?: string;
 
@@ -419,6 +431,8 @@ export function mapOptionsToConfig(
     // resolveRunnerBootstrap before the worker connects to Temporal.
     temporalAddress: options.temporalAddress ?? "",
     temporalNamespace: options.temporalNamespace ?? "default",
+    temporalConnection:
+      options.temporalConnection ?? loadTemporalConnectionConfig(getRunnerSecret),
     stigmerBackendEndpoint: normalizeEndpoint(options.stigmerEndpoint),
     stigmerTokenRef: tokenRef,
     stigmerRunnerTokenRef: runnerTokenRef,

package/src/shared/__tests__/approval-policy.test.ts

@@ -418,6 +418,16 @@ describe("resolveApprovalMessage", () => {
     )).toBe("Set 42");
   });
 
+  // stigmer#1119: the message is stored on the row and shown on the approval
+  // card, so a secret-keyed placeholder never resolves to the secret.
+  it("redacts a secret-keyed placeholder, whatever the key's case, and keeps the rest", () => {
+    expect(resolveApprovalMessage(
+      "Push to {{args.repo}} with {{args.token}} ({{args.Api_Key}})?",
+      "push",
+      { repo: "acme/x", token: "s3cret", Api_Key: "sk-123" },
+    )).toBe("Push to acme/x with [REDACTED] ([REDACTED])?");
+  });
+
   it("handles null arg values", () => {
     expect(resolveApprovalMessage(
       "Value: {{args.val}}",

package/src/shared/__tests__/args-preview.test.ts

@@ -12,8 +12,25 @@
  * caller left.)
  */
 
+import { readFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
 import { describe, it, expect } from "vitest";
-import { buildElidedArgsPreview, redactSensitiveArgs, SALIENT_ARG_FIELDS } from "../args-preview.js";
+import { buildElidedArgsPreview, redactSensitiveArgs, SALIENT_ARG_FIELDS, SENSITIVE_ARG_KEYS } from "../args-preview.js";
+import { EDIT_NEW_FIELDS, EDIT_OLD_FIELDS, WRITE_CONTENT_FIELDS, extractFilePath } from "../file-tools.js";
+
+interface SecretArgsFixture {
+  keys: string[];
+  marker: string;
+  cases: { name: string; args: Record<string, unknown>; redacted: Record<string, unknown> }[];
+}
+
+// The cross-surface contract the @stigmer/sdk reader asserts too
+// (sdk/typescript/src/execution/__tests__/tool-view.fixtures.test.ts).
+const here = dirname(fileURLToPath(import.meta.url));
+const secretArgs = JSON.parse(
+  readFileSync(resolve(here, "../../../../../../test/fixtures/tool-view/secret-args.json"), "utf8"),
+) as SecretArgsFixture;
 
 describe("SALIENT_ARG_FIELDS", () => {
   it("spans both harnesses' shapes for a file and a shell command, in priority order", () => {
@@ -27,6 +44,38 @@ describe("redactSensitiveArgs", () => {
   });
 });
 
+describe("the secret-args wire contract (test/fixtures/tool-view/secret-args.json)", () => {
+  it("SENSITIVE_ARG_KEYS is the fixture's key set, the one the SDK reader mirrors", () => {
+    expect([...SENSITIVE_ARG_KEYS].sort()).toEqual([...secretArgs.keys].sort());
+  });
+
+  for (const c of secretArgs.cases) {
+    it(`redacts ${c.name}`, () => {
+      expect(redactSensitiveArgs(c.args)).toEqual(c.redacted);
+    });
+  }
+});
+
+// A row's args are redacted at creation (stigmer#1119), and three readers act
+// on them afterwards: exact-apply writes an approved file from the path and
+// content, the Cursor approval identity keys on the salient field, and the
+// content digest hashes the write or edit content. Widening the secret set into
+// one of those fields would make an approved write land as the marker on disk.
+describe("secret keys never overlap the fields a row's args are acted on by", () => {
+  const actedOn = [...SALIENT_ARG_FIELDS, ...WRITE_CONTENT_FIELDS, ...EDIT_OLD_FIELDS, ...EDIT_NEW_FIELDS];
+
+  it("no salient, write-content or edit field is a secret key", () => {
+    const overlap = actedOn.filter((field) => SENSITIVE_ARG_KEYS.has(field.toLowerCase()));
+    expect(overlap).toEqual([]);
+  });
+
+  it("no secret-keyed argument resolves as a file path", () => {
+    for (const key of SENSITIVE_ARG_KEYS) {
+      expect(extractFilePath({ [key]: "/w/a.txt" })).toBeNull();
+    }
+  });
+});
+
 describe("buildElidedArgsPreview", () => {
   const SALIENT = SALIENT_ARG_FIELDS;
 

package/src/shared/__tests__/artifact-storage.test.ts

@@ -644,6 +644,7 @@ describe("loadArtifactStorageConfig", () => {
     taskQueue: "q",
     temporalAddress: "localhost:7233",
     temporalNamespace: "default",
+    temporalConnection: {},
     stigmerBackendEndpoint: "http://localhost:7234",
     mcpBridgeEndpoint: null,
     cursorApiKey: "",