@stigmer/runner 3.15.3-dev.20260914121148 → 3.16.0

package/src/activities/execute-deep-agent/turn-stream.ts

@@ -9,7 +9,7 @@
  * runtime's stall watchdog measures the engine; `reportUsage()` per parent
  * `message_finish`, priced here at the registry's rates for the model the
  * turn runs on (`shared/model-pricing.ts`), so the runtime accounts and
- * enforces the cost cap and writes `streamingUsage` (Q-M2a-2); `requestPersist()`
+ * enforces the cost cap and writes `streamingUsage`; `requestPersist()`
  * where a discrete change or the streaming cadence says so
  * (`shared/persist-decision.ts` over the builder's one dirty flag), AWAITED,
  * so a platform STOP the runtime reads from that write aborts the signal
@@ -19,7 +19,7 @@
  * this loop never does). An error the aborted run throws is the abort itself
  * and settles `interrupted`, never `failed`.
  *
- * WHEN the run is aborted (S3 M2a, F-M2a-18): on the arrival of the next
+ * WHEN the run is aborted: on the arrival of the next
  * event — the graph's own step boundary — or after {@link STOP_GRACE_MS} if
  * no event arrives. A LangGraph run aborted while a step is in flight leaves
  * `@langchain/core` with an orphaned rejection (`AsyncGeneratorWithSetup`
@@ -34,7 +34,7 @@
  * here) is forced, and that one orphan is the price of unblocking it — the
  * contract's bound on settling `interrupted` is what wins.
  *
- * Until S3 M2a this loop (`streaming-v3.ts`) armed its own 120 s stall
+ * Until #1096 this loop (`streaming-v3.ts`) armed its own 120 s stall
  * check, pulsed the Temporal heartbeat every 2 s, read STOP from its own
  * persist and activated a graceful-stop middleware on it, told a pause from
  * the activity's cancellation signal, and wrote PAUSED, COMPLETED and
@@ -53,8 +53,7 @@ import { TimeoutError, withTimeout } from "../../shared/with-timeout.js";
 import { InlinePublisher } from "./inline-publisher.js";
 import { StreamingSideEffects } from "./streaming-side-effects.js";
 import { createV3EventRecorder, type V3ProtocolEvent } from "./v3-event-recorder.js";
-import { normalize } from "./v3-protocol-normalizer.js";
-import { V3StatusBuilder } from "./v3-status-builder.js";
+import { DeepAgentTranslator, usageOf, type V3UsagePayload } from "./translator.js";
 import type { DeepAgentEngine, DeepAgentGraphInput, DeepAgentWorkspace } from "./turn-setup.js";
 
 /**
@@ -95,14 +94,17 @@ export interface DeepAgentStreamResult {
 }
 
 /**
- * The transcript writers of one turn: the builder over `sink.status` and the
- * publisher that writes artifacts through it (so a published artifact still
- * forces the next persist). Built by the adapter's turn once and shared by
- * the stream and the settle; the builder reports usage into the sink, priced
- * for the model the turn runs on.
+ * This harness's transcript writers for one turn: the translator that turns
+ * the engine's events into canonical ones (over the gate's posture, so every
+ * tool start carries its attribution and gate answer), and the publisher
+ * that registers artifacts on the runtime's builder (`sink.transcript`, so
+ * a published artifact still dirties the next persist). The builder itself
+ * is the runtime's, one per turn, and is read from the sink where it is
+ * needed. Built by the adapter's turn once and shared by the stream and the
+ * settle.
  */
 export interface DeepAgentTranscript {
-  readonly builder: V3StatusBuilder;
+  readonly translator: DeepAgentTranslator;
   readonly publisher: InlinePublisher;
 }
 
@@ -112,41 +114,40 @@ export function createDeepAgentTranscript(
   engine: DeepAgentEngine,
   workspace: DeepAgentWorkspace,
 ): DeepAgentTranscript {
-  const builder = new V3StatusBuilder(input.executionId, sink.status, {
-    onUsage: (usage) => {
-      // LangChain's `input_tokens` already INCLUDES the cache buckets (the
-      // Anthropic adapter folds them in; the cost advisory reads them the
-      // same way), so the counts are reported as delivered and the price
-      // is computed over the disjoint buckets.
-      const inputTokens = usage.input_tokens ?? 0;
-      const outputTokens = usage.output_tokens ?? 0;
-      const cacheReadTokens = usage.input_token_details?.cache_read ?? 0;
-      const cacheWriteTokens = usage.input_token_details?.cache_creation ?? 0;
-      const uncachedInput = Math.max(inputTokens - cacheReadTokens - cacheWriteTokens, 0);
-      sink.reportUsage({
-        inputTokens,
-        outputTokens,
-        cacheReadTokens,
-        cacheWriteTokens,
-        estimatedCostUsd: computeTurnCost(engine.pricing, uncachedInput, outputTokens, cacheWriteTokens, cacheReadTokens),
-        model: engine.modelName,
-      });
-    },
-  });
-  builder.setApprovalProvider({
-    policies: engine.gate.policies,
-    toolServerMap: engine.gate.toolServerMap,
-    leasedCategories: engine.gate.leasedCategories,
-    globalBypass: engine.gate.globalBypass,
-    unattended: engine.gate.unattended,
-  });
+  const translator = new DeepAgentTranslator(engine.gate);
   const publisher = new InlinePublisher({
     workspaceBackend: workspace.backend,
     artifactStorage: input.artifactStorage,
-    statusWriter: builder,
+    artifacts: sink.transcript,
     executionId: input.executionId,
   });
-  return { builder, publisher };
+  return { translator, publisher };
+}
+
+/**
+ * Price one `message-finish`'s usage at the engine's rates and report it to
+ * the sink, which accounts, enforces the cost cap and writes `streamingUsage`
+ * (one writer of the summary). LangChain's `input_tokens` already INCLUDES the cache buckets
+ * (the Anthropic adapter folds them in; the cost advisory reads them the same
+ * way), so the counts are reported as delivered and the price is computed
+ * over the disjoint buckets. A sub-agent on its own model is priced at the
+ * parent's rate, as the in-graph cost cap always did (per-sub-agent pricing
+ * is #1121).
+ */
+function reportUsage(sink: TurnSink, engine: DeepAgentEngine, usage: V3UsagePayload): void {
+  const inputTokens = usage.input_tokens ?? 0;
+  const outputTokens = usage.output_tokens ?? 0;
+  const cacheReadTokens = usage.input_token_details?.cache_read ?? 0;
+  const cacheWriteTokens = usage.input_token_details?.cache_creation ?? 0;
+  const uncachedInput = Math.max(inputTokens - cacheReadTokens - cacheWriteTokens, 0);
+  sink.reportUsage({
+    inputTokens,
+    outputTokens,
+    cacheReadTokens,
+    cacheWriteTokens,
+    estimatedCostUsd: computeTurnCost(engine.pricing, uncachedInput, outputTokens, cacheWriteTokens, cacheReadTokens),
+    model: engine.modelName,
+  });
 }
 
 export interface DeepAgentStreamDeps {
@@ -165,7 +166,8 @@ export interface DeepAgentStreamDeps {
 export async function consumeDeepAgentStream(deps: DeepAgentStreamDeps): Promise<DeepAgentStreamResult> {
   const { input, sink, engine, graphInput, transcript } = deps;
   const { executionId } = input;
-  const { builder, publisher } = transcript;
+  const { translator, publisher } = transcript;
+  const builder = sink.transcript;
 
   const scheduler = new StreamingUpdateScheduler(loadStreamingConfig());
   const recorder = createV3EventRecorder(executionId, process.env.V3_EVENT_RECORD_DIR);
@@ -214,21 +216,21 @@ export async function consumeDeepAgentStream(deps: DeepAgentStreamDeps): Promise
 
         recorder?.record(event, eventsProcessed);
         let detail: string | undefined;
-        for (const normalized of normalize(event)) {
-          builder.processEvent(normalized);
+        for (const normalized of translator.translate(event)) {
+          builder.apply(normalized);
+          sideEffects.onEvent(normalized);
           if (normalized.kind === "tool_started") detail = normalized.name;
         }
-        sideEffects.onProtocolEvent(event);
+        const usage = usageOf(event);
+        if (usage) reportUsage(sink, engine, usage);
         eventsProcessed++;
         sink.recordActivity(detail);
 
-        const persist = shouldPersistStreamingStatus(
-          { deltaEnricherDirty: false, todosDirty: false, contentDirty: builder.forceNextUpdate },
-          scheduler,
-          eventsProcessed,
-        );
+        const persist = shouldPersistStreamingStatus(builder.dirty, scheduler, eventsProcessed);
         if (!persist) continue;
-        builder.clearForceFlag();
+        // Cleared as the write is requested, not after it lands: a change
+        // that folds while the write is in flight must dirty the next one.
+        builder.markPersisted();
         // The runtime attaches the mid-run file-change progress on this write
         // (the chokepoint's step 2), as it does on every write. Awaited so a platform STOP the runtime reads from this write has
         // aborted the signal by the time the next event arrives — where the

package/src/activities/execute-deep-agent/turn.ts

@@ -24,7 +24,7 @@
  * other exception — a provider error unwrapped from LangChain's middleware
  * wrapper, an MCP connect failure, an empty stream — is `failed` on the
  * `internal` surface with `describeExecutionError`'s sentence as
- * `status.error` whole (Q-M2a-9). Never branches on why `stopSignal`
+ * `status.error` whole. Never branches on why `stopSignal`
  * aborted, never writes a phase or a terminal copy, never imports
  * `@temporalio/*` (`__tests__/adapter-is-temporal-free.test.ts`).
  *
@@ -33,9 +33,9 @@
  * are connected and closed per turn. Both are closed on EVERY exit path in
  * the `finally`, before the runtime removes the link and releases the lock.
  *
- * Extracted from `index.ts` `createDeepAgentActivities` at S3 M2a; the
+ * Extracted from `index.ts` `createDeepAgentActivities` in #1096; the
  * hermetic goldens under `__tests__/hermetic/` pin the result byte for
- * byte, with the ruled alignments quoted in their headers.
+ * byte, with that move's deliberate alignments quoted in their headers.
  */
 
 import type { BaseCheckpointSaver } from "@langchain/langgraph-checkpoint";

package/src/activities/generate-session-subject.ts

@@ -23,12 +23,24 @@
  * here degrades to a heuristic title (the first words of the user message):
  * a title is worth having even when no model is reachable.
  *
- * Activity contract (the Go stub dispatches exactly ONE argument — the cloud
- * Java signature carries a second, invokerIdentityAccountId, that never
- * crosses this wire):
+ * Activity contract — exactly ONE argument, in one of two shapes:
  *   Name:   "GenerateSessionSubject"
  *   Input:  (executionId: string)
+ *           | ({ execution_id, execution_context_token? }: GenerateSessionSubjectInput)
  *   Output: void
+ *
+ * The object is what a server sends when the dispatch carries the run's
+ * credential (shared/run-credential.ts), so that this activity reads the
+ * run and titles the session AS THE RUN'S HUMAN — with sign-in on, the
+ * operator's key the process holds cannot read a member's run. The string
+ * is what every server sent before, and what a server whose dispatch carries
+ * no credential still sends (the cloud's, whose desktop runners in the field
+ * must keep titling sessions). Both shapes are accepted — the dual-shape
+ * posture the turn activities take (shared/activity-input.ts); the
+ * credential itself is entered by the activity boundary
+ * (interceptors/run-credential-activity.ts), never read here. The cloud's
+ * Java signature carries a second argument, invokerIdentityAccountId, that
+ * never crosses this wire.
  */
 
 import { SystemMessage, HumanMessage } from "@langchain/core/messages";
@@ -344,6 +356,16 @@ function log(msg: string): void {
 // Temporal Activity Factory
 // ─────────────────────────────────────────────────────────────────────────────
 
+/**
+ * The typed wire shape of the activity's argument (snake_case keys, the
+ * polyglot workflow-input convention). `execution_context_token` is the run
+ * credential, present exactly when the dispatch carried one.
+ */
+export interface GenerateSessionSubjectInput {
+  readonly execution_id: string;
+  readonly execution_context_token?: string;
+}
+
 export function createGenerateSessionSubjectActivities(config: Config) {
   const client = new StigmerClient({
     endpoint: config.stigmerBackendEndpoint,
@@ -353,7 +375,10 @@ export function createGenerateSessionSubjectActivities(config: Config) {
   });
 
   return {
-    GenerateSessionSubject: async (executionId: string): Promise<void> => {
+    GenerateSessionSubject: async (
+      input: GenerateSessionSubjectInput | string,
+    ): Promise<void> => {
+      const executionId = typeof input === "string" ? input : input.execution_id;
       activityStarted();
       try {
         log(`started: execution=${executionId}`);

package/src/client/__tests__/stigmer-client.test.ts

@@ -20,6 +20,8 @@ vi.mock("@connectrpc/connect", () => ({
 }));
 
 import { StigmerClient } from "../stigmer-client.js";
+import { withRunCredential } from "../../shared/run-credential-store.js";
+import { AgentExecutionCommandController } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/command_pb";
 import { ExecutionContextQueryController } from "@stigmer/protos/ai/stigmer/agentic/executioncontext/v1/query_pb";
 import { PlatformQueryController } from "@stigmer/protos/ai/stigmer/platform/v1/server_info_pb";
 
@@ -279,6 +281,96 @@ describe("StigmerClient", () => {
     });
   });
 
+  describe("run credential (the activity's own, shared/run-credential-store.ts)", () => {
+    // The server mints a credential for ONE execution at dispatch and, with
+    // sign-in on, admits its bearer as that run's human. The activity boundary
+    // enters it into the store; these arms pin that the client presents it on
+    // every RPC about a run, on no process-bound RPC, below an explicit
+    // per-call header and above every process credential — and that two
+    // concurrent activities never see each other's.
+
+    function clientWithEveryProcessCredential(): StigmerClient {
+      return new StigmerClient({
+        endpoint: "http://localhost",
+        token: "static-tok",
+        tokenRef: { current: "control-plane-tok" },
+        runnerTokenRef: { current: "runner-tok" },
+      });
+    }
+
+    it("presents the run credential on an ordinary control-plane RPC", async () => {
+      clientWithEveryProcessCredential();
+      const req = makeRequest();
+      await withRunCredential("run-cred", () => runInterceptor(req));
+      expect(req.header.get("authorization")).toBe("Bearer run-cred");
+    });
+
+    it("presents it above the runner credential on the three runner-credential RPCs", async () => {
+      clientWithEveryProcessCredential();
+      for (const req of [
+        makeExecutionContextRequest(),
+        makeScopedTokenExchangeRequest(),
+        makeRequest(AgentExecutionCommandController.typeName, "create"),
+      ]) {
+        await withRunCredential("run-cred", () => runInterceptor(req));
+        expect(req.header.get("authorization")).toBe("Bearer run-cred");
+      }
+    });
+
+    it("never presents it on the process-bound bootstrap read", async () => {
+      clientWithEveryProcessCredential();
+      const req = makeRequest(PlatformQueryController.typeName, "getRunnerBootstrapConfig");
+      await withRunCredential("run-cred", () => runInterceptor(req));
+      expect(req.header.get("authorization")).toBe("Bearer control-plane-tok");
+    });
+
+    it("yields to an explicit per-call credential", async () => {
+      clientWithEveryProcessCredential();
+      const req = makeRequest();
+      req.header.set("authorization", "Bearer explicit-tok");
+      await withRunCredential("run-cred", () => runInterceptor(req));
+      expect(req.header.get("authorization")).toBe("Bearer explicit-tok");
+    });
+
+    it("leaves every rule below untouched when no activity credential is current", async () => {
+      clientWithEveryProcessCredential();
+      const ordinary = makeRequest();
+      await runInterceptor(ordinary);
+      expect(ordinary.header.get("authorization")).toBe("Bearer control-plane-tok");
+      const ec = makeExecutionContextRequest();
+      await runInterceptor(ec);
+      expect(ec.header.get("authorization")).toBe("Bearer runner-tok");
+    });
+
+    it("never crosses between two concurrent activities sharing one client", async () => {
+      clientWithEveryProcessCredential();
+      const reqA = makeRequest();
+      const reqB = makeRequest();
+      await Promise.all([
+        withRunCredential("run-cred-A", async () => {
+          await new Promise((resolve) => setTimeout(resolve, 2));
+          await runInterceptor(reqA);
+        }),
+        withRunCredential("run-cred-B", async () => {
+          await new Promise((resolve) => setTimeout(resolve, 1));
+          await runInterceptor(reqB);
+        }),
+      ]);
+      expect(reqA.header.get("authorization")).toBe("Bearer run-cred-A");
+      expect(reqB.header.get("authorization")).toBe("Bearer run-cred-B");
+    });
+
+    it("acquireScopedRunnerToken answers the run credential without an exchange", async () => {
+      const client = clientWithEveryProcessCredential();
+      const exchange = vi.spyOn(client, "getRunnerScopedToken");
+      const token = await withRunCredential("run-cred", () =>
+        client.acquireScopedRunnerToken({ agentExecutionId: "aex_1" }),
+      );
+      expect(token).toBe("run-cred");
+      expect(exchange).not.toHaveBeenCalled();
+    });
+  });
+
   describe("acquireScopedRunnerToken", () => {
     function clientWithRunnerCredential(token: string | null): StigmerClient {
       return new StigmerClient({

package/src/client/stigmer-client.ts

@@ -55,6 +55,7 @@ import { ChannelMessageQueryController } from "@stigmer/protos/ai/stigmer/agenti
 import type { ChannelTemplate, MessagingChannel } from "@stigmer/protos/ai/stigmer/agentic/agentchannel/v1/message_io_pb";
 import { TOKEN_TYPE_EMBEDDED_RUNNER, tokenTypeOf } from "./token-claims.js";
 import { assertCreateRequirements, assertReferenceRequirements } from "./server-contracts.js";
+import { currentRunCredential } from "../shared/run-credential-store.js";
 
 /**
  * Server-managed Temporal payload-encryption keys for this runner.
@@ -223,11 +224,25 @@ export class StigmerClient {
         // 1. An explicit per-call credential (an authorization header set via
         //    CallOptions) always wins. The scoped-token flow (issue #156)
         //    authenticates each ExecutionContext read with a token minted for
-        //    that specific execution; concurrent sessions in one runner process
-        //    make a shared mutable ref unusable for this — session A's read
-        //    must never go out with session B's token.
+        //    that specific execution; the renewal and pool-claim exchanges
+        //    present the token being exchanged; the connect lane hands its
+        //    decrypt-lane token per call.
         //
-        // 2. The runner credential (runnerTokenRef) authenticates the services
+        // 2. The run credential of the activity this request belongs to
+        //    (shared/run-credential-store.ts), on every RPC that is about a
+        //    run — which is every RPC but the process-bound bootstrap read.
+        //    The server minted it for exactly this execution at dispatch and,
+        //    with sign-in on, admits its bearer as the run's own human: the
+        //    status write, the child create, the artifact, the session title
+        //    are the member's, whoever's API key this process holds. It is
+        //    read from the async context, never from a ref: one process serves
+        //    many runs at once and a shared ref would be the wrong run's the
+        //    moment two overlap — the same reason rule 1 exists. Absent
+        //    outside an activity and when the dispatch carried none (an older
+        //    server; the cloud, whose runner credential is provisioned), so
+        //    the rules below are exactly what they were.
+        //
+        // 3. The runner credential (runnerTokenRef) authenticates the services
         //    that require a runner-class token_type claim: ExecutionContext
         //    reads carry decrypted secrets on cloud, and the server gates that
         //    decrypt on runner class + scope (stigmer-cloud#152/#155); the
@@ -239,13 +254,16 @@ export class StigmerClient {
         //    reserved-label guard and environment composer accept only from
         //    runner-class callers — a user-token create is rejected outright.
         //
-        // 3. Everything else uses the control-plane token. Falls through
-        //    unchanged when no runner token exists (OSS/local, where the
-        //    server enforces no auth).
+        // 4. Everything else uses the control-plane token: the process
+        //    credential, an operator's API key on a self-host. Falls through
+        //    unchanged when no runner token exists.
         (next) => async (req) => {
           if (req.header.has("authorization")) {
             return next(req);
           }
+          const isProcessBound =
+            req.service.typeName === PlatformQueryController.typeName &&
+            req.method.name === PlatformQueryController.method.getRunnerBootstrapConfig.name;
           const usesRunnerCredential =
             req.service.typeName === ExecutionContextQueryController.typeName ||
             (req.service.typeName === PlatformQueryController.typeName &&
@@ -253,7 +271,8 @@ export class StigmerClient {
             (req.service.typeName === AgentExecutionCommandController.typeName &&
               req.method.name === AgentExecutionCommandController.method.create.name);
           const token =
-            (usesRunnerCredential ? this.runnerTokenRef?.current : null)
+            (isProcessBound ? undefined : currentRunCredential())
+            ?? (usesRunnerCredential ? this.runnerTokenRef?.current : null)
             ?? this.tokenRef?.current
             ?? this.currentToken;
           if (token) {
@@ -363,11 +382,16 @@ export class StigmerClient {
    * The call authenticates with the runner credential (see the interceptor).
    * Cloud verifies it is an embedded_runner token and that its identity can
    * view the named execution, then mints the same session/execution-scoped
-   * sandbox token a cloud sandbox runner receives at provisioning. OSS mints
-   * an execution-scoped token for any caller (oss#535 — a lane discriminator
-   * on a single-user server, not a trust boundary). Returns undefined when
-   * the server does not mint (pre-oss#535 OSS, or an unserved scope arm) —
-   * presence-based, like the bootstrap token fields.
+   * sandbox token a cloud sandbox runner receives at provisioning. An
+   * open-source server with sign-in off mints an execution-scoped token for
+   * any caller (oss#535 — there it only unlocks the ExecutionContext decrypt
+   * lane); with sign-in on the same token admits its bearer as the run's
+   * human, so the exchange mints only for the run's own person (a missing
+   * run NOT_FOUND, anyone else PERMISSION_DENIED). Runs normally receive
+   * their credential from the dispatch itself (shared/run-credential.ts);
+   * this exchange is the fallback. Returns undefined when the server does
+   * not mint (pre-oss#535 OSS, or an unserved scope arm) — presence-based,
+   * like the bootstrap token fields.
    *
    * `callerToken` authenticates the exchange per-call instead of the
    * process-wide runner credential. The warm-pool attach uses it: a pool
@@ -400,7 +424,13 @@ export class StigmerClient {
    * Acquire a scoped runner token for an ExecutionContext read, if this
    * runner's credential situation calls for one.
    *
-   * The gate is the credential itself, three ways:
+   * When the activity this call belongs to carries a run credential (the
+   * server minted it for this very execution at dispatch —
+   * shared/run-credential.ts), that IS the scoped token: it is answered
+   * without an RPC, and the exchange below serves only a dispatch that
+   * carried none — an older server, or the cloud's provisioned runner.
+   *
+   * Otherwise the gate is the credential itself, three ways:
    *
    * 1. An unscoped embedded_runner bootstrap token MUST be exchanged, and a
    *    failed exchange is a hard error, not a fallback: since the #156
@@ -431,6 +461,10 @@ export class StigmerClient {
   async acquireScopedRunnerToken(
     scope: RunnerScopedTokenScope,
   ): Promise<string | undefined> {
+    const runCredential = currentRunCredential();
+    if (runCredential !== undefined) {
+      return runCredential;
+    }
     // Inspect the same credential chain the EC read's interceptor would use.
     const ambientTokenType = tokenTypeOf(
       this.runnerTokenRef?.current ?? this.tokenRef?.current ?? this.currentToken,

package/src/config.ts

@@ -9,7 +9,10 @@
  *
  * 1. Direct mode (local / OSS):
  *    - CURSOR_API_KEY provided directly by the user (for Cursor harness).
- *    - STIGMER_TOKEN is optional (local stigmer-server has no auth).
+ *    - STIGMER_TOKEN is optional against a trusted-local server (it verifies
+ *      no credential) and is the runner's own API key against a self-hosted
+ *      server with sign-in on; each run's credential arrives with its
+ *      dispatch (shared/run-credential.ts).
  *    - STIGMER_PROXY_ENDPOINT is NOT set.
  *
  * 2. Proxy mode (cloud / managed runners):
@@ -151,8 +154,8 @@ export interface Config {
    * provides the proxy credential and mints no other, so
    * `proxyTokenRef === stigmerTokenRef`), the manager binds the minted runner
    * token (`proxyTokenRef === stigmerRunnerTokenRef`). Reading either sibling
-   * directly would send the wrong credential from one of the two roots
-   * (Q-S2-7). Required whenever `proxyEndpoint` is set; the Cursor adapter's
+   * directly would send the wrong credential from one of the two roots.
+   * Required whenever `proxyEndpoint` is set; the Cursor adapter's
    * boot refuses a proxy without it.
    */
   readonly proxyTokenRef?: { current: string | null };