chore(foundry): migrate to actions (#262)

* feat(foundry): checkpoint actor and workspace refactor

* docs(foundry): add agent handoff context

* wip(foundry): continue actor refactor

* wip(foundry): capture remaining local changes

* Complete Foundry refactor checklist

* Fix Foundry validation fallout

* wip

* wip: convert all actors from workflow to plain run handlers

Workaround for RivetKit bug where c.queue.iter() never yields messages
for actors created via getOrCreate from another actor's context. The
queue accepts messages (visible in inspector) but the iterator hangs.
Sleep/wake fixes it, but actors with active connections never sleep.

Converted organization, github-data, task, and user actors from
run: workflow(...) to plain run: async (c) => { for await ... }.

Also fixes:
- Missing auth tables in org migration (auth_verification etc)
- default_model NOT NULL constraint on org profile upsert
- Nested workflow step in github-data (HistoryDivergedError)
- Removed --force from frontend Dockerfile pnpm install

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Convert all actors from queues/workflows to direct actions, lazy task creation

Major refactor replacing all queue-based workflow communication with direct
RivetKit action calls across all actors. This works around a RivetKit bug
where c.queue.iter() deadlocks for actors created from another actor's context.

Key changes:
- All actors (organization, task, user, audit-log, github-data) converted
  from run: workflow(...) to actions-only (no run handler, no queues)
- PR sync creates virtual task entries in org local DB instead of spawning
  task actors — prevents OOM from 200+ actors created simultaneously
- Task actors created lazily on first user interaction via getOrCreate,
  self-initialize from org's getTaskIndexEntry data
- Removed requireRepoExists cross-actor call (caused 500s), replaced with
  local resolveTaskRepoId from org's taskIndex table
- Fixed getOrganizationContext to thread overrides through all sync phases
- Fixed sandbox repo path (/home/user/repo for E2B compatibility)
- Fixed buildSessionDetail to skip transcript fetch for pending sessions
- Added process crash protection (uncaughtException/unhandledRejection)
- Fixed React infinite render loop in mock-layout useEffect dependencies
- Added sandbox listProcesses error handling for expired E2B sandboxes
- Set E2B sandbox timeout to 1 hour (was 5 min default)
- Updated CLAUDE.md with lazy task creation rules, no-silent-catch policy,
  React hook dependency safety rules

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Fix E2B sandbox timeout comment, frontend stability, and create-flow improvements

- Add TEMPORARY comment on E2B timeoutMs with pointer to rivetkit sandbox
  resilience proposal for when autoPause lands
- Fix React useEffect dependency stability in mock-layout and
  organization-dashboard to prevent infinite re-render loops
- Fix terminal-pane ref handling
- Improve create-flow service and tests

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

foundry/packages/frontend/src/features/tasks/model.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, it } from "vitest";
 import type { TaskRecord } from "@sandbox-agent/foundry-shared";
-import { formatDiffStat, groupTasksByRepo } from "./model";
+import { groupTasksByRepo } from "./model";
 
 const base: TaskRecord = {
   organizationId: "default",
@@ -12,9 +12,8 @@ const base: TaskRecord = {
   task: "Ship one",
   sandboxProviderId: "local",
   status: "running",
-  statusMessage: null,
   activeSandboxId: "sandbox-1",
-  activeSessionId: "session-1",
+  pullRequest: null,
   sandboxes: [
     {
       sandboxId: "sandbox-1",
@@ -26,17 +25,6 @@ const base: TaskRecord = {
       updatedAt: 10,
     },
   ],
-  agentType: null,
-  prSubmitted: false,
-  diffStat: null,
-  prUrl: null,
-  prAuthor: null,
-  ciStatus: null,
-  reviewStatus: null,
-  reviewer: null,
-  conflictsWithMain: null,
-  hasUnpushed: null,
-  parentBranch: null,
   createdAt: 10,
   updatedAt: 10,
 };
@@ -66,19 +54,3 @@ describe("groupTasksByRepo", () => {
     expect(groups[1]?.repoId).toBe("repo-a");
   });
 });
-
-describe("formatDiffStat", () => {
-  it("returns No changes for zero-diff values", () => {
-    expect(formatDiffStat("+0/-0")).toBe("No changes");
-    expect(formatDiffStat("+0 -0")).toBe("No changes");
-  });
-
-  it("returns dash for empty values", () => {
-    expect(formatDiffStat(null)).toBe("-");
-    expect(formatDiffStat("")).toBe("-");
-  });
-
-  it("keeps non-empty non-zero diff stats", () => {
-    expect(formatDiffStat("+12/-4")).toBe("+12/-4");
-  });
-});

foundry/packages/frontend/src/features/tasks/model.ts

@@ -37,14 +37,3 @@ export function groupTasksByRepo(tasks: TaskRecord[]): RepoGroup[] {
       return a.repoRemote.localeCompare(b.repoRemote);
     });
 }
-
-export function formatDiffStat(diffStat: string | null | undefined): string {
-  const normalized = diffStat?.trim();
-  if (!normalized) {
-    return "-";
-  }
-  if (normalized === "+0/-0" || normalized === "+0 -0" || normalized === "0 files changed") {
-    return "No changes";
-  }
-  return normalized;
-}

foundry/packages/frontend/src/features/tasks/status.test.ts

@@ -4,7 +4,7 @@ import { defaultTaskStatusMessage, deriveHeaderStatus, describeTaskState, isProv
 
 describe("defaultTaskStatusMessage", () => {
   it("covers every backend task status", () => {
-    for (const status of [...TaskStatusSchema.options, "new"] as const) {
+    for (const status of TaskStatusSchema.options) {
       expect(defaultTaskStatusMessage(status)).toMatch(/\S/);
     }
   });
@@ -15,18 +15,14 @@ describe("defaultTaskStatusMessage", () => {
 });
 
 describe("resolveTaskStateDetail", () => {
-  it("prefers the backend status message when present", () => {
-    expect(resolveTaskStateDetail("init_ensure_name", "determining title and branch")).toBe("determining title and branch");
-  });
-
-  it("falls back to the default copy when the backend message is empty", () => {
-    expect(resolveTaskStateDetail("init_complete", "  ")).toBe("Finalizing task initialization.");
+  it("returns the default copy for the current task status", () => {
+    expect(resolveTaskStateDetail("init_complete")).toBe("Finalizing task initialization.");
   });
 });
 
 describe("describeTaskState", () => {
   it("includes the raw backend status code in the title", () => {
-    expect(describeTaskState("kill_destroy_sandbox", null)).toEqual({
+    expect(describeTaskState("kill_destroy_sandbox")).toEqual({
       title: "Task state: kill_destroy_sandbox",
       detail: "Destroying sandbox resources.",
     });
@@ -52,7 +48,7 @@ describe("isProvisioningTaskStatus", () => {
 
 describe("deriveHeaderStatus", () => {
   it("returns error variant when session has error", () => {
-    const result = deriveHeaderStatus("running", null, "error", "Sandbox crashed");
+    const result = deriveHeaderStatus("running", "error", "Sandbox crashed");
     expect(result.variant).toBe("error");
     expect(result.label).toBe("Session error");
     expect(result.tooltip).toBe("Sandbox crashed");
@@ -60,76 +56,76 @@ describe("deriveHeaderStatus", () => {
   });
 
   it("returns error variant when task has error", () => {
-    const result = deriveHeaderStatus("error", "session:error", null, null);
+    const result = deriveHeaderStatus("error", null, null);
     expect(result.variant).toBe("error");
     expect(result.label).toBe("Error");
     expect(result.spinning).toBe(false);
   });
 
   it("returns warning variant with spinner for provisioning task", () => {
-    const result = deriveHeaderStatus("init_enqueue_provision", null, null, null);
+    const result = deriveHeaderStatus("init_enqueue_provision", null, null);
     expect(result.variant).toBe("warning");
     expect(result.label).toBe("Provisioning");
     expect(result.spinning).toBe(true);
   });
 
   it("returns warning variant for pending_provision session", () => {
-    const result = deriveHeaderStatus("running", null, "pending_provision", null);
+    const result = deriveHeaderStatus("running", "pending_provision", null);
     expect(result.variant).toBe("warning");
     expect(result.label).toBe("Provisioning");
     expect(result.spinning).toBe(true);
   });
 
   it("returns warning variant for pending_session_create session", () => {
-    const result = deriveHeaderStatus("running", null, "pending_session_create", null);
+    const result = deriveHeaderStatus("running", "pending_session_create", null);
     expect(result.variant).toBe("warning");
     expect(result.label).toBe("Creating session");
     expect(result.spinning).toBe(true);
   });
 
   it("returns success variant with spinner for running session", () => {
-    const result = deriveHeaderStatus("running", null, "running", null);
+    const result = deriveHeaderStatus("running", "running", null);
     expect(result.variant).toBe("success");
     expect(result.label).toBe("Running");
     expect(result.spinning).toBe(true);
   });
 
   it("returns success variant for idle/ready state", () => {
-    const result = deriveHeaderStatus("idle", null, "idle", null);
+    const result = deriveHeaderStatus("idle", "idle", null);
     expect(result.variant).toBe("success");
     expect(result.label).toBe("Ready");
     expect(result.spinning).toBe(false);
   });
 
   it("returns neutral variant for archived task", () => {
-    const result = deriveHeaderStatus("archived", null, null, null);
+    const result = deriveHeaderStatus("archived", null, null);
     expect(result.variant).toBe("neutral");
     expect(result.label).toBe("Archived");
   });
 
   it("session error takes priority over task error", () => {
-    const result = deriveHeaderStatus("error", "session:error", "error", "Sandbox OOM");
+    const result = deriveHeaderStatus("error", "error", "Sandbox OOM");
     expect(result.variant).toBe("error");
     expect(result.label).toBe("Session error");
     expect(result.tooltip).toBe("Sandbox OOM");
   });
 
   it("returns warning when no sandbox is available", () => {
-    const result = deriveHeaderStatus("idle", null, "idle", null, false);
+    const result = deriveHeaderStatus("idle", "idle", null, false);
     expect(result.variant).toBe("warning");
     expect(result.label).toBe("No sandbox");
     expect(result.spinning).toBe(false);
   });
 
   it("still shows provisioning when no sandbox but task is provisioning", () => {
-    const result = deriveHeaderStatus("init_enqueue_provision", null, null, null, false);
+    const result = deriveHeaderStatus("init_enqueue_provision", null, null, false);
     expect(result.variant).toBe("warning");
     expect(result.label).toBe("Provisioning");
     expect(result.spinning).toBe(true);
   });
 
   it("shows error over no-sandbox when session has error", () => {
-    const result = deriveHeaderStatus("idle", null, "error", "Connection lost", false);
+    const result = deriveHeaderStatus("idle", "error", "Connection lost", false);
     expect(result.variant).toBe("error");
     expect(result.label).toBe("Session error");
   });

foundry/packages/frontend/src/features/tasks/status.ts

@@ -1,7 +1,7 @@
-import type { TaskStatus, WorkbenchSessionStatus } from "@sandbox-agent/foundry-shared";
+import type { TaskStatus, WorkspaceSessionStatus } from "@sandbox-agent/foundry-shared";
 import type { HeaderStatusInfo } from "../../components/mock-layout/ui";
 
-export type TaskDisplayStatus = TaskStatus | "new";
+export type TaskDisplayStatus = TaskStatus;
 
 export interface TaskStateDescriptor {
   title: string;
@@ -9,15 +9,11 @@ export interface TaskStateDescriptor {
 }
 
 export function isProvisioningTaskStatus(status: TaskDisplayStatus | null | undefined): boolean {
-  return (
-    status === "new" || status === "init_bootstrap_db" || status === "init_enqueue_provision" || status === "init_ensure_name" || status === "init_assert_name"
-  );
+  return status === "init_bootstrap_db" || status === "init_enqueue_provision" || status === "init_ensure_name" || status === "init_assert_name";
 }
 
 export function defaultTaskStatusMessage(status: TaskDisplayStatus | null | undefined): string {
   switch (status) {
-    case "new":
-      return "Task created. Waiting to initialize.";
     case "init_bootstrap_db":
       return "Creating task records.";
     case "init_enqueue_provision":
@@ -54,15 +50,14 @@ export function defaultTaskStatusMessage(status: TaskDisplayStatus | null | unde
   }
 }
 
-export function resolveTaskStateDetail(status: TaskDisplayStatus | null | undefined, statusMessage: string | null | undefined): string {
-  const normalized = statusMessage?.trim();
-  return normalized && normalized.length > 0 ? normalized : defaultTaskStatusMessage(status);
+export function resolveTaskStateDetail(status: TaskDisplayStatus | null | undefined): string {
+  return defaultTaskStatusMessage(status);
 }
 
-export function describeTaskState(status: TaskDisplayStatus | null | undefined, statusMessage: string | null | undefined): TaskStateDescriptor {
+export function describeTaskState(status: TaskDisplayStatus | null | undefined): TaskStateDescriptor {
   return {
     title: status ? `Task state: ${status}` : "Task state unavailable",
-    detail: resolveTaskStateDetail(status, statusMessage),
+    detail: resolveTaskStateDetail(status),
   };
 }
 
@@ -72,8 +67,7 @@ export function describeTaskState(status: TaskDisplayStatus | null | undefined,
  */
 export function deriveHeaderStatus(
   taskStatus: TaskDisplayStatus | null | undefined,
-  taskStatusMessage: string | null | undefined,
-  sessionStatus: WorkbenchSessionStatus | null | undefined,
+  sessionStatus: WorkspaceSessionStatus | null | undefined,
   sessionErrorMessage: string | null | undefined,
   hasSandbox?: boolean,
 ): HeaderStatusInfo {
@@ -93,7 +87,7 @@ export function deriveHeaderStatus(
       variant: "error",
       label: "Error",
       spinning: false,
-      tooltip: taskStatusMessage ?? "Task entered an error state.",
+      tooltip: "Task entered an error state.",
     };
   }
 
@@ -103,7 +97,7 @@ export function deriveHeaderStatus(
       variant: "warning",
       label: "No sandbox",
       spinning: false,
-      tooltip: taskStatusMessage ?? "Sandbox is not available for this task.",
+      tooltip: "Sandbox is not available for this task.",
     };
   }
 
@@ -113,7 +107,7 @@ export function deriveHeaderStatus(
       variant: "warning",
       label: "Provisioning",
       spinning: true,
-      tooltip: resolveTaskStateDetail(taskStatus, taskStatusMessage),
+      tooltip: resolveTaskStateDetail(taskStatus),
     };
   }