Fix Foundry auth: migrate to Better Auth adapter, fix access token retrieval

- Remove @ts-nocheck from better-auth.ts, auth-user/index.ts, app-shell.ts
  and fix all type errors
- Fix getAccessTokenForSession: read GitHub token directly from account
  record instead of calling Better Auth's internal /get-access-token
  endpoint which returns 403 on server-side calls
- Re-implement workspaceAuth helper functions (workspaceAuthColumn,
  normalizeAuthValue, workspaceAuthClause, workspaceAuthWhere) that were
  accidentally deleted
- Remove all retry logic (withRetries, isRetryableAppActorError)
- Implement CORS origin allowlist from configured environment
- Document cachedAppWorkspace singleton pattern
- Add inline org sync fallback in buildAppSnapshot for post-OAuth flow
- Add no-retry rule to CLAUDE.md

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

foundry/packages/client/src/backend-client.ts

@@ -38,14 +38,6 @@ import { sandboxInstanceKey, workspaceKey } from "./keys.js";
 
 export type TaskAction = "push" | "sync" | "merge" | "archive" | "kill";
 
-type RivetMetadataResponse = {
-  runtime?: string;
-  actorNames?: Record<string, unknown>;
-  clientEndpoint?: string;
-  clientNamespace?: string;
-  clientToken?: string;
-};
-
 export interface SandboxSessionRecord {
   id: string;
   agent: string;
@@ -138,16 +130,9 @@ export interface BackendClientOptions {
   mode?: "remote" | "mock";
 }
 
-export interface BackendMetadata {
-  runtime?: string;
-  actorNames?: Record<string, unknown>;
-  clientEndpoint?: string;
-  clientNamespace?: string;
-  clientToken?: string;
-}
-
 export interface BackendClient {
   getAppSnapshot(): Promise<FoundryAppSnapshot>;
+  subscribeApp(listener: () => void): () => void;
   signInWithGithub(): Promise<void>;
   signOutApp(): Promise<FoundryAppSnapshot>;
   skipAppStarterRepo(): Promise<FoundryAppSnapshot>;
@@ -295,118 +280,6 @@ function deriveBackendEndpoints(endpoint: string): { appEndpoint: string; rivetE
   };
 }
 
-function isLoopbackHost(hostname: string): boolean {
-  const h = hostname.toLowerCase();
-  return h === "127.0.0.1" || h === "localhost" || h === "0.0.0.0" || h === "::1";
-}
-
-function rewriteLoopbackClientEndpoint(clientEndpoint: string, fallbackOrigin: string): string {
-  const clientUrl = new URL(clientEndpoint);
-  if (!isLoopbackHost(clientUrl.hostname)) {
-    return clientUrl.toString().replace(/\/$/, "");
-  }
-
-  const originUrl = new URL(fallbackOrigin);
-  // Keep the manager port from clientEndpoint; only rewrite host/protocol to match the origin.
-  clientUrl.hostname = originUrl.hostname;
-  clientUrl.protocol = originUrl.protocol;
-  return clientUrl.toString().replace(/\/$/, "");
-}
-
-async function fetchJsonWithTimeout(url: string, timeoutMs: number): Promise<unknown> {
-  const controller = new AbortController();
-  const timeout = setTimeout(() => controller.abort(), timeoutMs);
-  try {
-    const res = await fetch(url, { signal: controller.signal });
-    if (!res.ok) {
-      throw new Error(`request failed: ${res.status} ${res.statusText}`);
-    }
-    return (await res.json()) as unknown;
-  } finally {
-    clearTimeout(timeout);
-  }
-}
-
-async function fetchMetadataWithRetry(
-  endpoint: string,
-  namespace: string | undefined,
-  opts: { timeoutMs: number; requestTimeoutMs: number },
-): Promise<RivetMetadataResponse> {
-  const base = new URL(endpoint);
-  base.pathname = base.pathname.replace(/\/$/, "") + "/metadata";
-  if (namespace) {
-    base.searchParams.set("namespace", namespace);
-  }
-
-  const start = Date.now();
-  let delayMs = 250;
-  // Keep this bounded: callers (UI/CLI) should not hang forever if the backend is down.
-  for (;;) {
-    try {
-      const json = await fetchJsonWithTimeout(base.toString(), opts.requestTimeoutMs);
-      if (!json || typeof json !== "object") return {};
-      const data = json as Record<string, unknown>;
-      return {
-        runtime: typeof data.runtime === "string" ? data.runtime : undefined,
-        actorNames: data.actorNames && typeof data.actorNames === "object" ? (data.actorNames as Record<string, unknown>) : undefined,
-        clientEndpoint: typeof data.clientEndpoint === "string" ? data.clientEndpoint : undefined,
-        clientNamespace: typeof data.clientNamespace === "string" ? data.clientNamespace : undefined,
-        clientToken: typeof data.clientToken === "string" ? data.clientToken : undefined,
-      };
-    } catch (err) {
-      if (Date.now() - start > opts.timeoutMs) {
-        throw err;
-      }
-      await new Promise((r) => setTimeout(r, delayMs));
-      delayMs = Math.min(delayMs * 2, 2_000);
-    }
-  }
-}
-
-export async function readBackendMetadata(input: { endpoint: string; namespace?: string; timeoutMs?: number }): Promise<BackendMetadata> {
-  const base = new URL(input.endpoint);
-  base.pathname = base.pathname.replace(/\/$/, "") + "/metadata";
-  if (input.namespace) {
-    base.searchParams.set("namespace", input.namespace);
-  }
-
-  const json = await fetchJsonWithTimeout(base.toString(), input.timeoutMs ?? 4_000);
-  if (!json || typeof json !== "object") {
-    return {};
-  }
-  const data = json as Record<string, unknown>;
-  return {
-    runtime: typeof data.runtime === "string" ? data.runtime : undefined,
-    actorNames: data.actorNames && typeof data.actorNames === "object" ? (data.actorNames as Record<string, unknown>) : undefined,
-    clientEndpoint: typeof data.clientEndpoint === "string" ? data.clientEndpoint : undefined,
-    clientNamespace: typeof data.clientNamespace === "string" ? data.clientNamespace : undefined,
-    clientToken: typeof data.clientToken === "string" ? data.clientToken : undefined,
-  };
-}
-
-export async function checkBackendHealth(input: { endpoint: string; namespace?: string; timeoutMs?: number }): Promise<boolean> {
-  try {
-    const metadata = await readBackendMetadata(input);
-    return metadata.runtime === "rivetkit" && Boolean(metadata.actorNames);
-  } catch {
-    return false;
-  }
-}
-
-async function probeMetadataEndpoint(endpoint: string, namespace: string | undefined, timeoutMs: number): Promise<boolean> {
-  try {
-    const base = new URL(endpoint);
-    base.pathname = base.pathname.replace(/\/$/, "") + "/metadata";
-    if (namespace) {
-      base.searchParams.set("namespace", namespace);
-    }
-    await fetchJsonWithTimeout(base.toString(), timeoutMs);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
 export function createBackendClient(options: BackendClientOptions): BackendClient {
   if (options.mode === "mock") {
     return createMockBackendClient(options.defaultWorkspaceId);
@@ -415,8 +288,7 @@ export function createBackendClient(options: BackendClientOptions): BackendClien
   const endpoints = deriveBackendEndpoints(options.endpoint);
   const rivetApiEndpoint = endpoints.rivetEndpoint;
   const appApiEndpoint = endpoints.appEndpoint;
-  let clientPromise: Promise<RivetClient> | null = null;
-  let appSessionId = typeof window !== "undefined" ? window.localStorage.getItem("sandbox-agent-foundry:remote-app-session") : null;
+  const client = createClient({ endpoint: rivetApiEndpoint }) as unknown as RivetClient;
   const workbenchSubscriptions = new Map<
     string,
     {
@@ -431,34 +303,13 @@ export function createBackendClient(options: BackendClientOptions): BackendClien
       disposeConnPromise: Promise<(() => Promise<void>) | null> | null;
     }
   >();
-
-  const persistAppSessionId = (nextSessionId: string | null): void => {
-    appSessionId = nextSessionId;
-    if (typeof window === "undefined") {
-      return;
-    }
-    if (nextSessionId) {
-      window.localStorage.setItem("sandbox-agent-foundry:remote-app-session", nextSessionId);
-    } else {
-      window.localStorage.removeItem("sandbox-agent-foundry:remote-app-session");
-    }
+  const appSubscriptions = {
+    listeners: new Set<() => void>(),
+    disposeConnPromise: null as Promise<(() => Promise<void>) | null> | null,
   };
 
-  if (typeof window !== "undefined") {
-    const url = new URL(window.location.href);
-    const sessionFromUrl = url.searchParams.get("foundrySession");
-    if (sessionFromUrl) {
-      persistAppSessionId(sessionFromUrl);
-      url.searchParams.delete("foundrySession");
-      window.history.replaceState({}, document.title, `${url.pathname}${url.search}${url.hash}`);
-    }
-  }
-
   const appRequest = async <T>(path: string, init?: RequestInit): Promise<T> => {
     const headers = new Headers(init?.headers);
-    if (appSessionId) {
-      headers.set("x-foundry-session", appSessionId);
-    }
     if (init?.body && !headers.has("Content-Type")) {
       headers.set("Content-Type", "application/json");
     }
@@ -468,10 +319,6 @@ export function createBackendClient(options: BackendClientOptions): BackendClien
       headers,
       credentials: "include",
     });
-    const nextSessionId = res.headers.get("x-foundry-session");
-    if (nextSessionId) {
-      persistAppSessionId(nextSessionId);
-    }
     if (!res.ok) {
       throw new Error(`app request failed: ${res.status} ${res.statusText}`);
     }
@@ -485,51 +332,12 @@ export function createBackendClient(options: BackendClientOptions): BackendClien
     }
   };
 
-  const getClient = async (): Promise<RivetClient> => {
-    if (clientPromise) {
-      return clientPromise;
-    }
-
-    clientPromise = (async () => {
-      // Use the serverless /metadata endpoint to discover the manager endpoint.
-      // If the server reports a loopback clientEndpoint (127.0.0.1), rewrite to the same host
-      // as the configured endpoint so remote browsers/clients can connect.
-      const configured = new URL(rivetApiEndpoint);
-      const configuredOrigin = `${configured.protocol}//${configured.host}`;
-
-      const initialNamespace = undefined;
-      const metadata = await fetchMetadataWithRetry(rivetApiEndpoint, initialNamespace, {
-        timeoutMs: 30_000,
-        requestTimeoutMs: 8_000,
-      });
-
-      // Candidate endpoint: manager endpoint if provided, otherwise stick to the configured endpoint.
-      const candidateEndpoint = metadata.clientEndpoint ? rewriteLoopbackClientEndpoint(metadata.clientEndpoint, configuredOrigin) : rivetApiEndpoint;
-
-      // If the manager port isn't reachable from this client (common behind reverse proxies),
-      // fall back to the configured serverless endpoint to avoid hanging requests.
-      const shouldUseCandidate = metadata.clientEndpoint ? await probeMetadataEndpoint(candidateEndpoint, metadata.clientNamespace, 1_500) : true;
-      const resolvedEndpoint = shouldUseCandidate ? candidateEndpoint : rivetApiEndpoint;
-
-      return createClient({
-        endpoint: resolvedEndpoint,
-        namespace: metadata.clientNamespace,
-        token: metadata.clientToken,
-        // Prevent rivetkit from overriding back to a loopback endpoint (or to an unreachable manager).
-        disableMetadataLookup: true,
-      }) as unknown as RivetClient;
-    })();
-
-    return clientPromise;
-  };
-
   const workspace = async (workspaceId: string): Promise<WorkspaceHandle> =>
-    (await getClient()).workspace.getOrCreate(workspaceKey(workspaceId), {
+    client.workspace.getOrCreate(workspaceKey(workspaceId), {
       createWithInput: workspaceId,
     });
 
   const sandboxByKey = async (workspaceId: string, providerId: ProviderId, sandboxId: string): Promise<SandboxInstanceHandle> => {
-    const client = await getClient();
     return (client as any).sandboxInstance.get(sandboxInstanceKey(workspaceId, providerId, sandboxId));
   };
 
@@ -557,7 +365,6 @@ export function createBackendClient(options: BackendClientOptions): BackendClien
             (sb as any).sandboxActorId.length > 0,
         ) as { sandboxActorId?: string } | undefined;
         if (sandbox?.sandboxActorId) {
-          const client = await getClient();
           return (client as any).sandboxInstance.getForId(sandbox.sandboxActorId);
         }
       } catch (error) {
@@ -698,17 +505,62 @@ export function createBackendClient(options: BackendClientOptions): BackendClien
     };
   };
 
+  const subscribeApp = (listener: () => void): (() => void) => {
+    appSubscriptions.listeners.add(listener);
+
+    if (!appSubscriptions.disposeConnPromise) {
+      appSubscriptions.disposeConnPromise = (async () => {
+        const handle = await workspace("app");
+        const conn = (handle as any).connect();
+        const unsubscribeEvent = conn.on("appUpdated", () => {
+          for (const currentListener of [...appSubscriptions.listeners]) {
+            currentListener();
+          }
+        });
+        const unsubscribeError = conn.onError(() => {});
+        return async () => {
+          unsubscribeEvent();
+          unsubscribeError();
+          await conn.dispose();
+        };
+      })().catch(() => null);
+    }
+
+    return () => {
+      appSubscriptions.listeners.delete(listener);
+      if (appSubscriptions.listeners.size > 0) {
+        return;
+      }
+
+      void appSubscriptions.disposeConnPromise?.then(async (disposeConn) => {
+        await disposeConn?.();
+      });
+      appSubscriptions.disposeConnPromise = null;
+    };
+  };
+
   return {
     async getAppSnapshot(): Promise<FoundryAppSnapshot> {
       return await appRequest<FoundryAppSnapshot>("/app/snapshot");
     },
 
+    subscribeApp(listener: () => void): () => void {
+      return subscribeApp(listener);
+    },
+
     async signInWithGithub(): Promise<void> {
+      const callbackURL = typeof window !== "undefined" ? `${window.location.origin}/organizations` : `${appApiEndpoint.replace(/\/$/, "")}/organizations`;
+      const response = await appRequest<{ url: string; redirect?: boolean }>("/auth/sign-in/social", {
+        method: "POST",
+        body: JSON.stringify({
+          provider: "github",
+          callbackURL,
+          disableRedirect: true,
+        }),
+      });
       if (typeof window !== "undefined") {
-        window.location.assign(`${appApiEndpoint}/auth/github/start`);
-        return;
+        window.location.assign(response.url);
       }
-      await redirectTo("/auth/github/start");
     },
 
     async signOutApp(): Promise<FoundryAppSnapshot> {

foundry/packages/client/src/mock/backend-client.ts

@@ -192,6 +192,10 @@ export function createMockBackendClient(defaultWorkspaceId = "default"): Backend
       return unsupportedAppSnapshot();
     },
 
+    subscribeApp(_listener: () => void): () => void {
+      return () => {};
+    },
+
     async signInWithGithub(): Promise<void> {
       notSupported("signInWithGithub");
     },

foundry/packages/client/src/remote/app-client.ts

@@ -25,7 +25,7 @@ class RemoteFoundryAppStore implements FoundryAppClient {
   };
   private readonly listeners = new Set<() => void>();
   private refreshPromise: Promise<void> | null = null;
-  private syncPollTimeout: ReturnType<typeof setTimeout> | null = null;
+  private unsubscribeApp: (() => void) | null = null;
 
   constructor(options: RemoteFoundryAppClientOptions) {
     this.backend = options.backend;
@@ -37,9 +37,13 @@ class RemoteFoundryAppStore implements FoundryAppClient {
 
   subscribe(listener: () => void): () => void {
     this.listeners.add(listener);
-    void this.refresh();
+    this.ensureStarted();
     return () => {
       this.listeners.delete(listener);
+      if (this.listeners.size === 0 && this.unsubscribeApp) {
+        this.unsubscribeApp();
+        this.unsubscribeApp = null;
+      }
     };
   }
 
@@ -66,7 +70,6 @@ class RemoteFoundryAppStore implements FoundryAppClient {
   async selectOrganization(organizationId: string): Promise<void> {
     this.snapshot = await this.backend.selectAppOrganization(organizationId);
     this.notify();
-    this.scheduleSyncPollingIfNeeded();
   }
 
   async updateOrganizationProfile(input: UpdateFoundryOrganizationProfileInput): Promise<void> {
@@ -77,7 +80,6 @@ class RemoteFoundryAppStore implements FoundryAppClient {
   async triggerGithubSync(organizationId: string): Promise<void> {
     this.snapshot = await this.backend.triggerAppRepoImport(organizationId);
     this.notify();
-    this.scheduleSyncPollingIfNeeded();
   }
 
   async completeHostedCheckout(organizationId: string, planId: FoundryBillingPlanId): Promise<void> {
@@ -107,20 +109,13 @@ class RemoteFoundryAppStore implements FoundryAppClient {
     this.notify();
   }
 
-  private scheduleSyncPollingIfNeeded(): void {
-    if (this.syncPollTimeout) {
-      clearTimeout(this.syncPollTimeout);
-      this.syncPollTimeout = null;
+  private ensureStarted(): void {
+    if (!this.unsubscribeApp) {
+      this.unsubscribeApp = this.backend.subscribeApp(() => {
+        void this.refresh();
+      });
     }
-
-    if (!this.snapshot.organizations.some((organization) => organization.github.syncStatus === "syncing")) {
-      return;
-    }
-
-    this.syncPollTimeout = setTimeout(() => {
-      this.syncPollTimeout = null;
-      void this.refresh();
-    }, 500);
+    void this.refresh();
   }
 
   private async refresh(): Promise<void> {
@@ -132,7 +127,6 @@ class RemoteFoundryAppStore implements FoundryAppClient {
     this.refreshPromise = (async () => {
       this.snapshot = await this.backend.getAppSnapshot();
       this.notify();
-      this.scheduleSyncPollingIfNeeded();
     })().finally(() => {
       this.refreshPromise = null;
     });