@stigmer/runner 3.5.3 → 3.7.0

package/src/activities/execute-cursor/session-lifecycle.ts

@@ -40,7 +40,12 @@ import { mkdirSync } from "node:fs";
 import { join } from "node:path";
 
 import { Agent } from "@cursor/sdk";
-import type { SDKAgent, CursorAgentPlatformOptions, AgentDefinition } from "@cursor/sdk";
+import type {
+  SDKAgent,
+  CursorAgentPlatformOptions,
+  AgentDefinition,
+  ModelParameterValue,
+} from "@cursor/sdk";
 import { withTimeout, TimeoutError } from "../../shared/with-timeout.js";
 import type { CursorMcpServerConfig } from "./mcp-resolver.js";
 
@@ -83,6 +88,15 @@ const LOCAL_SETTING_SOURCES = ["project"] as const;
 export interface CreateAgentOptions {
   apiKey: string;
   model: string;
+  /**
+   * Explicit variant parameters sent with the model selection on every
+   * create AND resume (stigmer/stigmer#357). A bare `{ id }` lets the
+   * Cursor catalog's default variant pick the price, so the caller always
+   * supplies the pinned params from resolveServiceTierParams — possibly
+   * empty (Auto, or a model with no price-bearing parameters), but never
+   * absent by accident.
+   */
+  modelParams?: ModelParameterValue[];
   workspaceDirs: string[];
   sessionId: string;
   /** Durable workspace volume root; the SDK state store lives under it. */
@@ -112,6 +126,8 @@ export interface ResumeAgentOptions {
   /** Durable workspace volume root; the SDK state store lives under it. */
   workspaceRootDir: string;
   model?: string;
+  /** Explicit variant parameters — see {@link CreateAgentOptions.modelParams}. */
+  modelParams?: ModelParameterValue[];
   mcpServers?: Record<string, CursorMcpServerConfig>;
   /** Custom sub-agents — see {@link CreateAgentOptions.agents}. */
   agents?: Record<string, AgentDefinition>;
@@ -129,6 +145,8 @@ export interface CloudRepo {
 export interface CreateCloudAgentOptions {
   apiKey: string;
   model?: string;
+  /** Explicit variant parameters — see {@link CreateAgentOptions.modelParams}. */
+  modelParams?: ModelParameterValue[];
   repos: CloudRepo[];
   sessionId: string;
   mcpServers?: Record<string, CursorMcpServerConfig>;
@@ -140,6 +158,8 @@ export interface ResumeCloudAgentOptions {
   apiKey: string;
   agentId: string;
   model?: string;
+  /** Explicit variant parameters — see {@link CreateAgentOptions.modelParams}. */
+  modelParams?: ModelParameterValue[];
   mcpServers?: Record<string, CursorMcpServerConfig>;
   /** Custom sub-agents — see {@link CreateAgentOptions.agents}. */
   agents?: Record<string, AgentDefinition>;
@@ -245,7 +265,9 @@ export async function createAgent(options: CreateAgentOptions): Promise<SDKAgent
 
   return Agent.create({
     apiKey: options.apiKey,
-    model: { id: options.model },
+    // Always a full selection — id AND params. A bare { id } would let the
+    // catalog's default variant (account-influenced) pick the price (#357).
+    model: { id: options.model, params: options.modelParams },
     local: { cwd, settingSources: [...LOCAL_SETTING_SOURCES] },
     mcpServers: options.mcpServers as Record<string, any>,
     agents: options.agents,
@@ -273,7 +295,11 @@ export async function resumeAgent(options: ResumeAgentOptions): Promise<SDKAgent
 
   return Agent.resume(options.agentId, {
     apiKey: options.apiKey,
-    model: options.model ? { id: options.model } : undefined,
+    // Variant params must be re-supplied on resume exactly like mcpServers:
+    // explicit params hold across resume (verified against the billing
+    // ledger, #357), but an id-only resume would fall back to the catalog
+    // default variant for the new turns.
+    model: options.model ? { id: options.model, params: options.modelParams } : undefined,
     // Neither cwd nor settingSources survive Agent.resume(); both must be
     // re-supplied every turn. Omitting cwd makes the SDK fall back to
     // process.cwd(), which re-roots the agent in the runner's own working
@@ -307,7 +333,7 @@ export async function createCloudAgent(options: CreateCloudAgentOptions): Promis
 
   return Agent.create({
     apiKey: options.apiKey,
-    model: options.model ? { id: options.model } : undefined,
+    model: options.model ? { id: options.model, params: options.modelParams } : undefined,
     cloud: { repos: options.repos },
     mcpServers: options.mcpServers as Record<string, any>,
     agents: options.agents,
@@ -328,7 +354,7 @@ export async function resumeCloudAgent(options: ResumeCloudAgentOptions): Promis
 
   return Agent.resume(options.agentId, {
     apiKey: options.apiKey,
-    model: options.model ? { id: options.model } : undefined,
+    model: options.model ? { id: options.model, params: options.modelParams } : undefined,
     mcpServers: options.mcpServers as Record<string, any>,
     agents: options.agents,
   });
@@ -372,6 +398,7 @@ export async function resolveAgent(
             apiKey: options.apiKey,
             agentId: harnessStateId,
             model: options.model,
+            modelParams: options.modelParams,
             mcpServers: options.mcpServers,
             agents: options.agents,
           })
@@ -382,6 +409,7 @@ export async function resolveAgent(
             workspaceDirs: (options as CreateAgentOptions).workspaceDirs,
             workspaceRootDir: (options as CreateAgentOptions).workspaceRootDir,
             model: options.model,
+            modelParams: options.modelParams,
             mcpServers: options.mcpServers,
             agents: options.agents,
           });

package/src/activities/execute-cursor/usage-accumulator.ts

@@ -13,7 +13,10 @@
  * wire via ProxyUsageReporter once traffic routing (Task 5B) is complete.
  */
 
-import { getCursorModelPricing, computeTurnCost } from "./model-pricing.js";
+import type { ModelParameterValue } from "@cursor/sdk";
+import { ServiceTier } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+
+import { getCursorModelPricingForVariant, computeTurnCost } from "./model-pricing.js";
 
 export interface TurnUsage {
   readonly inputTokens?: number;
@@ -32,6 +35,10 @@ export interface UsageSnapshot {
   readonly estimatedCostUsd: number;
   readonly model: string;
   readonly observedAt: string;
+  /** Tier the runner requested — always explicit post-translation (#357). */
+  readonly requestedServiceTier: ServiceTier;
+  /** JSON-encoded ModelSelection.params the runner sent; "" when none. */
+  readonly requestedModelParams: string;
 }
 
 const EMPTY_SNAPSHOT: UsageSnapshot = {
@@ -44,6 +51,8 @@ const EMPTY_SNAPSHOT: UsageSnapshot = {
   estimatedCostUsd: 0,
   model: "",
   observedAt: "",
+  requestedServiceTier: ServiceTier.UNSPECIFIED,
+  requestedModelParams: "",
 };
 
 export interface TurnRecord {
@@ -64,7 +73,22 @@ export class UsageAccumulator {
   private observedAt = "";
   private readonly turnRecords: TurnRecord[] = [];
 
-  constructor(private readonly model: string) {}
+  /** JSON-encoded params the runner sent with the model selection (#357). */
+  private readonly requestedModelParams: string;
+
+  constructor(
+    private readonly model: string,
+    /**
+     * The explicit tier the runner requested from the provider. Recorded
+     * verbatim into status as the audit trail that the account default was
+     * never left in control (#357).
+     */
+    private readonly requestedServiceTier: ServiceTier = ServiceTier.UNSPECIFIED,
+    requestedModelParams: readonly ModelParameterValue[] = [],
+  ) {
+    this.requestedModelParams =
+      requestedModelParams.length > 0 ? JSON.stringify(requestedModelParams) : "";
+  }
 
   addTurn(usage: TurnUsage): void {
     const input = usage.inputTokens ?? 0;
@@ -86,7 +110,13 @@ export class UsageAccumulator {
       cacheWriteTokens: cacheWrite,
     });
 
-    const pricing = getCursorModelPricing(this.model);
+    // Estimate at the rates of the variant we explicitly requested — a
+    // FAST run priced at base rates would understate the display estimate
+    // ~4x relative to the authoritative bill (#357).
+    const pricing = getCursorModelPricingForVariant(
+      this.model,
+      this.requestedServiceTier === ServiceTier.FAST ? "fast" : null,
+    );
     this.estimatedCostUsd += computeTurnCost(
       pricing, input, output, cacheWrite, cacheRead,
     );
@@ -122,6 +152,8 @@ export class UsageAccumulator {
       estimatedCostUsd: this.estimatedCostUsd,
       model: this.model,
       observedAt: this.observedAt,
+      requestedServiceTier: this.requestedServiceTier,
+      requestedModelParams: this.requestedModelParams,
     };
   }
 }

package/src/activities/execute-deep-agent/prompt-builder.ts

@@ -98,6 +98,12 @@ export interface PromptBuilderInput {
    * formatDatastoresSection); empty when the agent uses no datastores.
    */
   datastoresPromptSection?: string;
+  /**
+   * The `<available_channel_templates>` section
+   * (shared/channel-attachment.ts formatChannelTemplatesSection); absent
+   * when the agent serves no proactive channel or nothing is sendable.
+   */
+  channelTemplatesPromptSection?: string;
   workspaceFileRefs: string[];
   workspaceRoot: string;
   injectedFiles: InjectedFile[];
@@ -174,6 +180,10 @@ export function buildEnhancedSystemPrompt(input: PromptBuilderInput): string {
     prompt += "\n\n" + input.datastoresPromptSection;
   }
 
+  if (input.channelTemplatesPromptSection) {
+    prompt += "\n\n" + input.channelTemplatesPromptSection;
+  }
+
   if (input.workspaceFileRefs.length > 0) {
     const refSection = buildReferencedFilesSection(
       input.workspaceFileRefs,

package/src/activities/execute-deep-agent/setup.ts

@@ -26,6 +26,10 @@ import { TimingRecorder, emitTimingLog } from "../../shared/cold-start-timing.js
 import { createCheckpointer } from "../../shared/checkpointer/factory.js";
 import { readContextBridge } from "../../shared/context-bridge.js";
 import { readSenderIdentity } from "../../shared/sender-identity.js";
+import {
+  injectCallerIdentityEnv,
+  resolveCallerIdentity,
+} from "../../shared/caller-identity.js";
 import { readSessionContext } from "../../shared/session-context.js";
 import { connectMcpServers, type McpConnectionResult } from "../../shared/mcp-manager.js";
 import { resolveMcpServers } from "../../shared/mcp-resolver.js";
@@ -33,9 +37,14 @@ import { resolveMcpTransportPosture } from "../../shared/mcp-transport-guard.js"
 import { backfillMcpServersIfNeeded } from "../../shared/connect-backfill.js";
 import {
   formatDatastoresSection,
-  injectDatastoreAttachment,
   synthesizeDatastoreAttachment,
 } from "../../shared/datastore-attachment.js";
+import {
+  discoverChannelMessaging,
+  formatChannelTemplatesSection,
+  synthesizeChannelAttachment,
+} from "../../shared/channel-attachment.js";
+import { injectSynthesizedAttachment } from "../../shared/synthesized-attachment.js";
 import { WorkspaceProvisioner } from "../../shared/workspace/provisioner.js";
 import { LocalWorkspaceBackend } from "../../shared/workspace/local-backend.js";
 import type { WorkspaceBackend, ProvisionResult } from "../../shared/workspace/types.js";
@@ -334,12 +343,41 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
     ];
     const datastoreUsages = agent.spec!.datastoreUsages || [];
 
+    // The synthesized attachments' credential story (DD-006 D4): the
+    // exchanged token authenticates the discovery reads per-call (the
+    // messaging reach refuses a desktop runner's ambient embedded_runner
+    // credential; undefined lets the ambient credential apply). The
+    // attachment header falls back to the ambient credential.
+    const exchangedRunnerToken =
+      await client.acquireScopedRunnerToken({ agentExecutionId: executionId });
+    const attachmentCredential = exchangedRunnerToken
+      ?? config.stigmerTokenRef?.current
+      ?? config.stigmerToken;
+
+    // The channel discovery read runs BEFORE the MCP gate below: an
+    // agent whose ONLY tool source is a proactive channel would
+    // otherwise never enter MCP resolution and never connect the
+    // attachment (DD-006 D7). Every failure mode degrades to an empty
+    // answer — no tool, no section, execution unharmed.
+    const channelMessaging = await discoverChannelMessaging(client, exchangedRunnerToken);
+
     let resolvedMcpServers: Awaited<ReturnType<typeof resolveMcpServers>> | null = null;
-    if (mcpServerUsages.length > 0 || datastoreUsages.length > 0) {
+    if (mcpServerUsages.length > 0 || datastoreUsages.length > 0 || channelMessaging.length > 0) {
       await reportSetupProgress(client, executionId, "Connecting tools…");
       const transportPosture = resolveMcpTransportPosture(config.mode);
+      // The MCP-bound env map (and ONLY it) carries the reserved
+      // caller-identity keys — mirror of the Cursor harness's Phase 4
+      // injection; filterEnvToDeclaredKeys keeps undeclared servers blind.
+      const mcpEnvVars = injectCallerIdentityEnv(
+        envResult.mergedEnvVars,
+        resolveCallerIdentity(
+          session.spec!.metadata,
+          session.status?.audit?.specAudit?.createdBy,
+        ),
+        sessionId,
+      );
       resolvedMcpServers = await resolveMcpServers(
-        client, mcpServerUsages, envResult.mergedEnvVars, transportPosture,
+        client, mcpServerUsages, mcpEnvVars, transportPosture,
       );
       timing.mark("resolve_mcp_servers");
 
@@ -348,7 +386,7 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
         client,
         resolvedMcpServers.resolvedServers,
         mcpServerUsages,
-        envResult.mergedEnvVars,
+        mcpEnvVars,
         sessionOrg,
         transportPosture,
         undefined,
@@ -360,17 +398,30 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
       // approval maps keep it approval-free by construction (see
       // shared/datastore-attachment.ts).
       if (datastoreUsages.length > 0) {
-        const scopedCredential =
-          (await client.acquireScopedRunnerToken({ agentExecutionId: executionId }))
-          ?? config.stigmerTokenRef?.current
-          ?? config.stigmerToken;
         const attachment = synthesizeDatastoreAttachment(datastoreUsages, {
           bridgeEndpoint: config.mcpBridgeEndpoint,
-          credential: scopedCredential,
+          credential: attachmentCredential,
+          backendEndpoint: config.stigmerBackendEndpoint,
+        });
+        if (attachment) {
+          backfilledServers = injectSynthesizedAttachment(
+            backfilledServers, attachment, "datastore records",
+          );
+        }
+      }
+
+      // The channel messaging attachment (DD-006 D7/D8) — the records
+      // attachment's twin, injected under the same after-backfill rule.
+      if (channelMessaging.length > 0) {
+        const attachment = synthesizeChannelAttachment(channelMessaging, {
+          bridgeEndpoint: config.mcpBridgeEndpoint,
+          credential: attachmentCredential,
           backendEndpoint: config.stigmerBackendEndpoint,
         });
         if (attachment) {
-          backfilledServers = injectDatastoreAttachment(backfilledServers, attachment);
+          backfilledServers = injectSynthesizedAttachment(
+            backfilledServers, attachment, "channel messaging",
+          );
         }
       }
       resolvedMcpServers = { resolvedServers: backfilledServers };
@@ -445,6 +496,11 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
       datastoresPromptSection: datastoreUsages.length > 0
         ? formatDatastoresSection(datastoreUsages)
         : undefined,
+      // "" (nothing sendable) threads as undefined: the tool alone still
+      // serves text sends inside a 24-hour window (DD-006 D6).
+      channelTemplatesPromptSection: channelMessaging.length > 0
+        ? formatChannelTemplatesSection(channelMessaging) || undefined
+        : undefined,
       workspaceFileRefs: execution.spec!.workspaceFileRefs || [],
       workspaceRoot: workspaceBackend.rootDir,
       injectedFiles,

package/src/client/stigmer-client.ts

@@ -49,7 +49,9 @@ import { WorkflowQueryController } from "@stigmer/protos/ai/stigmer/agentic/work
 import type { Workflow } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/api_pb";
 import { WorkflowInstanceQueryController } from "@stigmer/protos/ai/stigmer/agentic/workflowinstance/v1/query_pb";
 import type { WorkflowInstance } from "@stigmer/protos/ai/stigmer/agentic/workflowinstance/v1/api_pb";
-import { PlatformQueryController, GetRunnerScopedTokenInputSchema } from "@stigmer/protos/ai/stigmer/platform/v1/server_info_pb";
+import { PlatformQueryController, GetRunnerScopedTokenInputSchema, TokenRenewalSchema } from "@stigmer/protos/ai/stigmer/platform/v1/server_info_pb";
+import { ChannelMessageQueryController } from "@stigmer/protos/ai/stigmer/agentic/agentchannel/v1/message_query_pb";
+import type { ChannelTemplate, MessagingChannel } from "@stigmer/protos/ai/stigmer/agentic/agentchannel/v1/message_io_pb";
 import { isEmbeddedRunnerToken } from "./token-claims.js";
 import { assertCreateRequirements, assertReferenceRequirements } from "./server-contracts.js";
 
@@ -92,12 +94,16 @@ export interface RunnerScopedToken {
  * `poolClaimSessionId` is the warm-pool attach exchange: a pool sandbox
  * presenting its pool_sandbox credential for the session it was claimed for
  * (the server authorizes against the claim record, not the caller's FGA
- * relations). The execution arms remain embedded_runner-only.
+ * relations). `renewal` is a live sandbox extending its own credential
+ * before expiry: no id is named because every mint parameter comes from the
+ * presented credential's verified claims (see sandbox-token-renewal.ts).
+ * The execution arms remain embedded_runner-only.
  */
 export type RunnerScopedTokenScope =
   | { agentExecutionId: string }
   | { workflowExecutionId: string }
-  | { poolClaimSessionId: string };
+  | { poolClaimSessionId: string }
+  | { renewal: true };
 
 /**
  * Map the scope union onto the proto oneof init shape. The narrowing chain is
@@ -111,7 +117,10 @@ function toRunnerScopedTokenOneof(scope: RunnerScopedTokenScope) {
   if ("workflowExecutionId" in scope) {
     return { case: "workflowExecutionId", value: scope.workflowExecutionId } as const;
   }
-  return { case: "poolClaim", value: { sessionId: scope.poolClaimSessionId } } as const;
+  if ("poolClaimSessionId" in scope) {
+    return { case: "poolClaim", value: { sessionId: scope.poolClaimSessionId } } as const;
+  }
+  return { case: "renewal", value: create(TokenRenewalSchema) } as const;
 }
 
 /**
@@ -156,6 +165,7 @@ export class StigmerClient {
   private readonly workflowQuery: Client<typeof WorkflowQueryController>;
   private readonly workflowInstanceQuery: Client<typeof WorkflowInstanceQueryController>;
   private readonly platformQuery: Client<typeof PlatformQueryController>;
+  private readonly channelMessageQuery: Client<typeof ChannelMessageQueryController>;
 
   private readonly tokenRef: TokenRef | null;
   private readonly runnerTokenRef: TokenRef | null;
@@ -239,6 +249,7 @@ export class StigmerClient {
     this.workflowQuery = createClient(WorkflowQueryController, this.transport);
     this.workflowInstanceQuery = createClient(WorkflowInstanceQueryController, this.transport);
     this.platformQuery = createClient(PlatformQueryController, this.transport);
+    this.channelMessageQuery = createClient(ChannelMessageQueryController, this.transport);
   }
 
   /**
@@ -380,6 +391,48 @@ export class StigmerClient {
     }
   }
 
+  /**
+   * The agent's serving proactive-messaging channels, as data
+   * (proactive-messaging DD-006 D2) — the runner's tool-attachment
+   * decision. An empty list is the everyday answer (most agents have no
+   * proactive channel).
+   *
+   * When a scoped runner token is supplied, the read authenticates with
+   * it per-call (the {@link getExecutionContextByExecutionId} precedent):
+   * the messaging reach refuses the desktop runner's ambient
+   * embedded_runner credential outright, and one desktop runner process
+   * serves many sessions concurrently, so the credential cannot live in
+   * a shared ref. A cloud sandbox runner's ambient credential is already
+   * the session-scoped token; OSS sends nothing and answers empty.
+   */
+  async listMessagingChannels(scopedToken?: string): Promise<MessagingChannel[]> {
+    const res = await this.channelMessageQuery.listMessagingChannels(
+      {},
+      scopedToken
+        ? { headers: { authorization: `Bearer ${scopedToken}` } }
+        : undefined,
+    );
+    return res.entries;
+  }
+
+  /**
+   * The channel's provider template registry, approved entries only —
+   * the `<available_channel_templates>` prompt section's source
+   * (proactive-messaging DD-003 D5). Entries carry the DD-006 D1
+   * sendability verdict (`unsupportedReason`, empty means sendable);
+   * the section formatter filters on it. Credential rules as
+   * {@link listMessagingChannels}.
+   */
+  async listChannelTemplates(channel: string, scopedToken?: string): Promise<ChannelTemplate[]> {
+    const res = await this.channelMessageQuery.listTemplates(
+      { channel, approvedOnly: true },
+      scopedToken
+        ? { headers: { authorization: `Bearer ${scopedToken}` } }
+        : undefined,
+    );
+    return res.entries;
+  }
+
   async getSession(sessionId: string): Promise<Session> {
     return this.sessionQuery.get({ value: sessionId });
   }

package/src/main.ts

@@ -213,6 +213,25 @@ async function runPoolMode(
     executionMode: config.mode,
   });
 
+  // Sandbox credential self-renewal (see sandbox-token-renewal.ts). Watches
+  // the env var because manager.updateToken keeps it in lockstep with the
+  // manager's internal ref: a blank member's pool_sandbox token parks the
+  // loop, the claim's updateToken swaps in a renewable session token, and
+  // from then on renewal applies fresh tokens back through the same
+  // updateToken (which also cascades to the proxy-credential coordinator).
+  const { startSandboxTokenRenewal } = await import("./sandbox-token-renewal.js");
+  const { StigmerClient } = await import("./client/stigmer-client.js");
+  const renewalClient = new StigmerClient({
+    endpoint: config.stigmerBackendEndpoint,
+    token: null,
+  });
+  const tokenRenewal = startSandboxTokenRenewal({
+    getToken: () => process.env.STIGMER_TOKEN ?? null,
+    renew: (currentToken) =>
+      renewalClient.getRunnerScopedToken({ renewal: true }, currentToken),
+    applyToken: (token) => manager.updateToken(token),
+  });
+
   let taskQueue: string;
   if (intent.kind === "pool-control") {
     registerPoolMemberContext({
@@ -277,6 +296,7 @@ async function runPoolMode(
       }
       shutdownRequested = true;
       console.warn(`[pool-member] Received ${signal}, shutting down gracefully...`);
+      tokenRenewal.stop();
       void manager.shutdown().then(resolve, (err) => {
         console.error("[pool-member] Shutdown failed:", err);
         resolve();

package/src/runner.ts

@@ -114,6 +114,56 @@ export interface StigmerRunner {
   shutdown(): void;
 }
 
+/**
+ * Wire up self-renewal for a static cloud sandbox's control-plane credential
+ * (see sandbox-token-renewal.ts for the model). The applied token reaches
+ * every consumer: activity gRPC clients read {@code tokenRef} per request,
+ * env-reading call sites (call-llm, registry-endpoint) read
+ * {@code process.env.STIGMER_TOKEN} per call, artifact storage resolves the
+ * ref per call, and the two Cursor SDK interceptors are updated directly —
+ * a static runner has no {@code RunnerTokenCoordinator} minting a separate
+ * proxy credential, so its x-stigmer-auth IS this token.
+ */
+async function startStaticSandboxTokenRenewal(
+  config: Config,
+  tokenRef: { current: string | null },
+): Promise<{ stop(): void } | null> {
+  const { isRenewableSandboxToken, startSandboxTokenRenewal } = await import(
+    "./sandbox-token-renewal.js"
+  );
+  // Static mode's credential class never changes (it is baked into the pod's
+  // env), so a non-renewable credential — desktop/OSS/local — never starts
+  // the loop at all.
+  if (!isRenewableSandboxToken(tokenRef.current)) {
+    return null;
+  }
+
+  const { StigmerClient } = await import("./client/stigmer-client.js");
+  const { updateInterceptorToken } = await import(
+    "./activities/execute-cursor/fetch-interceptor.js"
+  );
+  const { updateHttp2InterceptorToken } = await import(
+    "./activities/execute-cursor/http2-interceptor.js"
+  );
+  const client = new StigmerClient({
+    endpoint: config.stigmerBackendEndpoint,
+    token: null,
+    tokenRef,
+  });
+
+  return startSandboxTokenRenewal({
+    getToken: () => tokenRef.current,
+    renew: (currentToken) =>
+      client.getRunnerScopedToken({ renewal: true }, currentToken),
+    applyToken: (token) => {
+      tokenRef.current = token;
+      process.env.STIGMER_TOKEN = token;
+      updateInterceptorToken(token);
+      updateHttp2InterceptorToken(token);
+    },
+  });
+}
+
 /**
  * Create a Stigmer runner ready to poll a Temporal task queue.
  *
@@ -198,13 +248,24 @@ export async function createStigmerRunner(
     token: options.stigmerToken,
     stigmerEndpoint: baseConfig.stigmerBackendEndpoint,
   });
+  // The control-plane credential lives in a shared mutable ref (as in manager
+  // mode) so the sandbox-token renewal below can rotate it in-process:
+  // activity clients read the ref per request instead of pinning the boot
+  // token for the pod's whole life.
+  const tokenRef = { current: baseConfig.stigmerToken };
   const config: Config = {
     ...baseConfig,
     temporalAddress: coordinates.temporalAddress,
     temporalNamespace: coordinates.temporalNamespace,
+    stigmerTokenRef: tokenRef,
   };
   markBoot("bootstrap_resolved");
 
+  // Cloud sandbox credential self-renewal (no-op for desktop/OSS/local
+  // credentials — see the helper). Started before the worker so the first
+  // renewal point is scheduled even if the pod boots with a part-used token.
+  const tokenRenewal = await startStaticSandboxTokenRenewal(config, tokenRef);
+
   const { setExecutionContextRef } = await import(
     "./activities/execute-cursor/rejection-capture.js"
   );
@@ -242,6 +303,7 @@ export async function createStigmerRunner(
       console.log("Worker stopped");
     },
     shutdown() {
+      tokenRenewal?.stop();
       worker.shutdown();
     },
   };