Improve Foundry auth and task flows (#240)

Author: NathanFlurry

foundry/CLAUDE.md

@@ -164,7 +164,11 @@ For all Rivet/RivetKit implementation:
 - Integration tests use `setupTest()` from `rivetkit/test` and are gated behind `HF_ENABLE_ACTOR_INTEGRATION_TESTS=1`.
 - End-to-end testing must run against the dev backend started via `docker compose -f compose.dev.yaml up` (host -> container). Do not run E2E against an in-process test runtime.
   - E2E tests should talk to the backend over HTTP (default `http://127.0.0.1:7741/api/rivet`) and use real GitHub repos/PRs.
+  - For Foundry live verification, use `rivet-dev/sandbox-agent-testing` as the default testing repo unless the task explicitly says otherwise.
   - Secrets (e.g. `OPENAI_API_KEY`, `GITHUB_TOKEN`/`GH_TOKEN`) must be provided via environment variables, never hardcoded in the repo.
+  - `~/misc/env.txt` and `~/misc/the-foundry.env` contain the expected local OpenAI + GitHub OAuth/App config for dev.
+  - Do not assume `gh auth token` is sufficient for Foundry task provisioning against private repos. Sandbox/bootstrap git clone, push, and PR flows require a repo-capable `GITHUB_TOKEN`/`GH_TOKEN` in the backend container.
+  - Preferred product behavior for org workspaces is to mint a GitHub App installation token from the workspace installation and inject it into backend/sandbox git operations. Do not rely on an operator's ambient CLI auth as the long-term solution.
 - Treat client E2E tests in `packages/client/test` as the primary end-to-end source of truth for product behavior.
 - Keep backend tests small and targeted. Only retain backend-only tests for invariants or persistence rules that are not well-covered through client E2E.
 - Do not keep large browser E2E suites around in a broken state. If a frontend browser E2E is not maintained and producing signal, remove it until it can be replaced with a reliable test.

foundry/compose.dev.yaml

@@ -22,6 +22,21 @@ services:
       # Support either GITHUB_TOKEN or GITHUB_PAT in local env files.
       GITHUB_TOKEN: "${GITHUB_TOKEN:-${GITHUB_PAT:-}}"
       GH_TOKEN: "${GH_TOKEN:-${GITHUB_TOKEN:-${GITHUB_PAT:-}}}"
+      APP_URL: "${APP_URL:-}"
+      BETTER_AUTH_URL: "${BETTER_AUTH_URL:-}"
+      BETTER_AUTH_SECRET: "${BETTER_AUTH_SECRET:-}"
+      GITHUB_CLIENT_ID: "${GITHUB_CLIENT_ID:-}"
+      GITHUB_CLIENT_SECRET: "${GITHUB_CLIENT_SECRET:-}"
+      GITHUB_REDIRECT_URI: "${GITHUB_REDIRECT_URI:-}"
+      GITHUB_APP_ID: "${GITHUB_APP_ID:-}"
+      GITHUB_APP_CLIENT_ID: "${GITHUB_APP_CLIENT_ID:-}"
+      GITHUB_APP_CLIENT_SECRET: "${GITHUB_APP_CLIENT_SECRET:-}"
+      GITHUB_APP_PRIVATE_KEY: "${GITHUB_APP_PRIVATE_KEY:-}"
+      GITHUB_WEBHOOK_SECRET: "${GITHUB_WEBHOOK_SECRET:-${GITHUB_APP_WEBHOOK_SECRET:-}}"
+      STRIPE_PUBLISHABLE_KEY: "${STRIPE_PUBLISHABLE_KEY:-}"
+      STRIPE_SECRET_KEY: "${STRIPE_SECRET_KEY:-}"
+      STRIPE_WEBHOOK_SECRET: "${STRIPE_WEBHOOK_SECRET:-}"
+      STRIPE_PRICE_TEAM: "${STRIPE_PRICE_TEAM:-}"
       DAYTONA_ENDPOINT: "${DAYTONA_ENDPOINT:-}"
       DAYTONA_API_KEY: "${DAYTONA_API_KEY:-}"
       HF_DAYTONA_ENDPOINT: "${HF_DAYTONA_ENDPOINT:-}"

foundry/packages/backend/src/actors/project-pr-sync/index.ts

@@ -4,6 +4,7 @@ import { getActorRuntimeContext } from "../context.js";
 import { getProject, selfProjectPrSync } from "../handles.js";
 import { logActorWarning, resolveErrorMessage, resolveErrorStack } from "../logging.js";
 import { type PollingControlState, runWorkflowPollingLoop } from "../polling.js";
+import { resolveWorkspaceGithubAuth } from "../../services/github-auth.js";
 
 export interface ProjectPrSyncInput {
   workspaceId: string;
@@ -31,7 +32,8 @@ const CONTROL = {
 
 async function pollPrs(c: { state: ProjectPrSyncState }): Promise<void> {
   const { driver } = getActorRuntimeContext();
-  const items = await driver.github.listPullRequests(c.state.repoPath);
+  const auth = await resolveWorkspaceGithubAuth(c, c.state.workspaceId);
+  const items = await driver.github.listPullRequests(c.state.repoPath, { githubToken: auth?.githubToken ?? null });
   const parent = getProject(c, c.state.workspaceId, c.state.repoId);
   await parent.applyPrSyncResult({ items, at: Date.now() });
 }

foundry/packages/backend/src/actors/project/actions.ts

@@ -7,6 +7,7 @@ import { getActorRuntimeContext } from "../context.js";
 import { getTask, getOrCreateTask, getOrCreateHistory, getOrCreateProjectBranchSync, getOrCreateProjectPrSync, selfProject } from "../handles.js";
 import { isActorNotFoundError, logActorWarning, resolveErrorMessage } from "../logging.js";
 import { foundryRepoClonePath } from "../../services/foundry-paths.js";
+import { resolveWorkspaceGithubAuth } from "../../services/github-auth.js";
 import { expectQueueResponse } from "../../services/queue.js";
 import { withRepoGitLock } from "../../services/repo-git-lock.js";
 import { branches, taskIndex, prCache, repoMeta } from "./db/schema.js";
@@ -112,7 +113,8 @@ export function projectWorkflowQueueName(name: ProjectQueueName): ProjectQueueNa
 async function ensureLocalClone(c: any, remoteUrl: string): Promise<string> {
   const { config, driver } = getActorRuntimeContext();
   const localPath = foundryRepoClonePath(config, c.state.workspaceId, c.state.repoId);
-  await driver.git.ensureCloned(remoteUrl, localPath);
+  const auth = await resolveWorkspaceGithubAuth(c, c.state.workspaceId);
+  await driver.git.ensureCloned(remoteUrl, localPath, { githubToken: auth?.githubToken ?? null });
   c.state.localPath = localPath;
   return localPath;
 }
@@ -301,6 +303,26 @@ async function enrichTaskRecord(c: any, record: TaskRecord): Promise<TaskRecord>
   };
 }
 
+async function reinsertTaskIndexRow(c: any, taskId: string, branchName: string | null, updatedAt: number): Promise<void> {
+  const now = Date.now();
+  await c.db
+    .insert(taskIndex)
+    .values({
+      taskId,
+      branchName,
+      createdAt: updatedAt || now,
+      updatedAt: now,
+    })
+    .onConflictDoUpdate({
+      target: taskIndex.taskId,
+      set: {
+        branchName,
+        updatedAt: now,
+      },
+    })
+    .run();
+}
+
 async function ensureProjectMutation(c: any, cmd: EnsureProjectCommand): Promise<EnsureProjectResult> {
   c.state.remoteUrl = cmd.remoteUrl;
   const localPath = await ensureLocalClone(c, cmd.remoteUrl);
@@ -454,9 +476,10 @@ async function registerTaskBranchMutation(c: any, cmd: RegisterTaskBranchCommand
   let headSha = "";
   let trackedInStack = false;
   let parentBranch: string | null = null;
+  const auth = await resolveWorkspaceGithubAuth(c, c.state.workspaceId);
 
   await withRepoGitLock(localPath, async () => {
-    await driver.git.fetch(localPath);
+    await driver.git.fetch(localPath, { githubToken: auth?.githubToken ?? null });
     const baseRef = await driver.git.remoteDefaultBaseRef(localPath);
     const normalizedBase = normalizeBaseBranchName(baseRef);
 
@@ -467,8 +490,8 @@ async function registerTaskBranchMutation(c: any, cmd: RegisterTaskBranchCommand
         throw new Error(`Remote branch not found: ${branchName}`);
       }
     } else {
-      await driver.git.ensureRemoteBranch(localPath, branchName);
-      await driver.git.fetch(localPath);
+      await driver.git.ensureRemoteBranch(localPath, branchName, { githubToken: auth?.githubToken ?? null });
+      await driver.git.fetch(localPath, { githubToken: auth?.githubToken ?? null });
       try {
         headSha = await driver.git.revParse(localPath, `origin/${branchName}`);
       } catch {
@@ -947,7 +970,17 @@ export const projectActions = {
 
     const row = await c.db.select({ taskId: taskIndex.taskId }).from(taskIndex).where(eq(taskIndex.taskId, cmd.taskId)).get();
     if (!row) {
-      throw new Error(`Unknown task in repo ${c.state.repoId}: ${cmd.taskId}`);
+      try {
+        const h = getTask(c, c.state.workspaceId, c.state.repoId, cmd.taskId);
+        const record = await h.get();
+        await reinsertTaskIndexRow(c, cmd.taskId, record.branchName ?? null, record.updatedAt ?? Date.now());
+        return await enrichTaskRecord(c, record);
+      } catch (error) {
+        if (isStaleTaskReferenceError(error)) {
+          throw new Error(`Unknown task in repo ${c.state.repoId}: ${cmd.taskId}`);
+        }
+        throw error;
+      }
     }
 
     try {

foundry/packages/backend/src/actors/task/index.ts

@@ -142,10 +142,14 @@ export const task = actor({
 
     async provision(c, cmd: InitializeCommand): Promise<{ ok: true }> {
       const self = selfTask(c);
-      await self.send(taskWorkflowQueueName("task.command.provision"), cmd ?? {}, {
+      const result = await self.send(taskWorkflowQueueName("task.command.provision"), cmd ?? {}, {
         wait: true,
         timeout: 30 * 60_000,
       });
+      const response = expectQueueResponse<{ ok: boolean; error?: string }>(result);
+      if (!response.ok) {
+        throw new Error(response.error ?? "task provisioning failed");
+      }
       return { ok: true };
     },
 

foundry/packages/backend/src/actors/task/workbench.ts

@@ -2,7 +2,8 @@
 import { basename } from "node:path";
 import { asc, eq } from "drizzle-orm";
 import { getActorRuntimeContext } from "../context.js";
-import { getOrCreateTaskStatusSync, getOrCreateProject, getOrCreateWorkspace, getSandboxInstance } from "../handles.js";
+import { getOrCreateTaskStatusSync, getOrCreateProject, getOrCreateWorkspace, getSandboxInstance, selfTask } from "../handles.js";
+import { resolveWorkspaceGithubAuth } from "../../services/github-auth.js";
 import { task as taskTable, taskRuntime, taskWorkbenchSessions } from "./db/schema.js";
 import { getCurrentRecord } from "./workflow/common.js";
 
@@ -547,7 +548,26 @@ export async function renameWorkbenchBranch(c: any, value: string): Promise<void
 }
 
 export async function createWorkbenchSession(c: any, model?: string): Promise<{ tabId: string }> {
-  const record = await ensureWorkbenchSeeded(c);
+  let record = await ensureWorkbenchSeeded(c);
+  if (!record.activeSandboxId) {
+    const providerId = record.providerId ?? c.state.providerId ?? getActorRuntimeContext().providers.defaultProviderId();
+    await selfTask(c).provision({ providerId });
+    record = await ensureWorkbenchSeeded(c);
+  }
+
+  if (record.activeSessionId) {
+    const existingSessions = await listSessionMetaRows(c);
+    if (existingSessions.length === 0) {
+      await ensureSessionMeta(c, {
+        sessionId: record.activeSessionId,
+        model: model ?? defaultModelForAgent(record.agentType),
+        sessionName: "Session 1",
+      });
+      await notifyWorkbenchUpdated(c);
+      return { tabId: record.activeSessionId };
+    }
+  }
+
   if (!record.activeSandboxId) {
     throw new Error("cannot create session without an active sandbox");
   }
@@ -783,7 +803,10 @@ export async function publishWorkbenchPr(c: any): Promise<void> {
     throw new Error("cannot publish PR without a branch");
   }
   const { driver } = getActorRuntimeContext();
-  const created = await driver.github.createPr(c.state.repoLocalPath, record.branchName, record.title ?? c.state.task);
+  const auth = await resolveWorkspaceGithubAuth(c, c.state.workspaceId);
+  const created = await driver.github.createPr(c.state.repoLocalPath, record.branchName, record.title ?? c.state.task, undefined, {
+    githubToken: auth?.githubToken ?? null,
+  });
   await c.db
     .update(taskTable)
     .set({

foundry/packages/backend/src/actors/task/workflow/index.ts

@@ -104,7 +104,10 @@ const commandHandlers: Record<TaskQueueName, WorkflowHandler> = {
       await msg.complete({ ok: true });
     } catch (error) {
       await loopCtx.step("init-failed-v2", async () => initFailedActivity(loopCtx, error));
-      await msg.complete({ ok: false });
+      await msg.complete({
+        ok: false,
+        error: resolveErrorMessage(error),
+      });
     }
   },
 

foundry/packages/backend/src/actors/task/workflow/init.ts

@@ -1,6 +1,7 @@
 // @ts-nocheck
 import { desc, eq } from "drizzle-orm";
 import { resolveCreateFlowDecision } from "../../../services/create-flow.js";
+import { resolveWorkspaceGithubAuth } from "../../../services/github-auth.js";
 import { getActorRuntimeContext } from "../../context.js";
 import { getOrCreateTaskStatusSync, getOrCreateHistory, getOrCreateProject, getOrCreateSandboxInstance, getSandboxInstance, selfTask } from "../../handles.js";
 import { logActorWarning, resolveErrorMessage } from "../../logging.js";
@@ -150,8 +151,9 @@ export async function initEnsureNameActivity(loopCtx: any): Promise<void> {
   }
 
   const { driver } = getActorRuntimeContext();
+  const auth = await resolveWorkspaceGithubAuth(loopCtx, loopCtx.state.workspaceId);
   try {
-    await driver.git.fetch(loopCtx.state.repoLocalPath);
+    await driver.git.fetch(loopCtx.state.repoLocalPath, { githubToken: auth?.githubToken ?? null });
   } catch (error) {
     logActorWarning("task.init", "fetch before naming failed", {
       workspaceId: loopCtx.state.workspaceId,
@@ -160,7 +162,9 @@ export async function initEnsureNameActivity(loopCtx: any): Promise<void> {
       error: resolveErrorMessage(error),
     });
   }
-  const remoteBranches = (await driver.git.listRemoteBranches(loopCtx.state.repoLocalPath)).map((branch: any) => branch.branchName);
+  const remoteBranches = (await driver.git.listRemoteBranches(loopCtx.state.repoLocalPath, { githubToken: auth?.githubToken ?? null })).map(
+    (branch: any) => branch.branchName,
+  );
 
   const project = await getOrCreateProject(loopCtx, loopCtx.state.workspaceId, loopCtx.state.repoId, loopCtx.state.repoRemote);
   const reservedBranches = await project.listReservedBranches({});
@@ -274,13 +278,15 @@ export async function initCreateSandboxActivity(loopCtx: any, body: any): Promis
   });
 
   try {
+    const auth = await resolveWorkspaceGithubAuth(loopCtx, loopCtx.state.workspaceId);
     const sandbox = await withActivityTimeout(timeoutMs, "createSandbox", async () =>
       provider.createSandbox({
         workspaceId: loopCtx.state.workspaceId,
         repoId: loopCtx.state.repoId,
         repoRemote: loopCtx.state.repoRemote,
         branchName: loopCtx.state.branchName,
         taskId: loopCtx.state.taskId,
+        githubToken: auth?.githubToken ?? null,
         debug: (message, context) => debugInit(loopCtx, message, context),
       }),
     );

foundry/packages/backend/src/actors/task/workflow/status-sync.ts

@@ -2,6 +2,7 @@
 import { eq } from "drizzle-orm";
 import { getActorRuntimeContext } from "../../context.js";
 import { logActorWarning, resolveErrorMessage } from "../../logging.js";
+import { resolveWorkspaceGithubAuth } from "../../../services/github-auth.js";
 import { task as taskTable, taskRuntime, taskSandboxes } from "../db/schema.js";
 import { TASK_ROW_ID, appendHistory, resolveErrorDetail } from "./common.js";
 import { pushActiveBranchActivity } from "./push.js";
@@ -77,8 +78,10 @@ export async function idleSubmitPrActivity(loopCtx: any): Promise<void> {
 
   if (self && self.prSubmitted) return;
 
+  const auth = await resolveWorkspaceGithubAuth(loopCtx, loopCtx.state.workspaceId);
+
   try {
-    await driver.git.fetch(loopCtx.state.repoLocalPath);
+    await driver.git.fetch(loopCtx.state.repoLocalPath, { githubToken: auth?.githubToken ?? null });
   } catch (error) {
     logActorWarning("task.status-sync", "fetch before PR submit failed", {
       workspaceId: loopCtx.state.workspaceId,
@@ -98,7 +101,9 @@ export async function idleSubmitPrActivity(loopCtx: any): Promise<void> {
       historyKind: "task.push.auto",
     });
 
-    const pr = await driver.github.createPr(loopCtx.state.repoLocalPath, loopCtx.state.branchName, loopCtx.state.title);
+    const pr = await driver.github.createPr(loopCtx.state.repoLocalPath, loopCtx.state.branchName, loopCtx.state.title, undefined, {
+      githubToken: auth?.githubToken ?? null,
+    });
 
     await db.update(taskTable).set({ prSubmitted: 1, updatedAt: Date.now() }).where(eq(taskTable.id, TASK_ROW_ID)).run();
 

foundry/packages/backend/src/actors/workspace/actions.ts

@@ -34,6 +34,7 @@ import { getActorRuntimeContext } from "../context.js";
 import { getTask, getOrCreateHistory, getOrCreateProject, selfWorkspace } from "../handles.js";
 import { logActorWarning, resolveErrorMessage } from "../logging.js";
 import { normalizeRemoteUrl, repoIdFromRemote } from "../../services/repo.js";
+import { resolveWorkspaceGithubAuth } from "../../services/github-auth.js";
 import { taskLookup, repos, providerProfiles } from "./db/schema.js";
 import { agentTypeForModel } from "../task/workbench.js";
 import { expectQueueResponse } from "../../services/queue.js";
@@ -213,7 +214,8 @@ async function addRepoMutation(c: any, input: AddRepoInput): Promise<RepoRecord>
   }
 
   const { driver } = getActorRuntimeContext();
-  await driver.git.validateRemote(remoteUrl);
+  const auth = await resolveWorkspaceGithubAuth(c, c.state.workspaceId);
+  await driver.git.validateRemote(remoteUrl, { githubToken: auth?.githubToken ?? null });
 
   const repoId = repoIdFromRemote(remoteUrl);
   const now = Date.now();
@@ -439,7 +441,7 @@ export const workspaceActions = {
     c.broadcast("workbenchUpdated", { at: Date.now() });
   },
 
-  async createWorkbenchTask(c: any, input: TaskWorkbenchCreateTaskInput): Promise<{ taskId: string }> {
+  async createWorkbenchTask(c: any, input: TaskWorkbenchCreateTaskInput): Promise<{ taskId: string; tabId?: string }> {
     const created = await workspaceActions.createTask(c, {
       workspaceId: c.state.workspaceId,
       repoId: input.repoId,
@@ -448,7 +450,12 @@ export const workspaceActions = {
       ...(input.branch ? { explicitBranchName: input.branch } : {}),
       ...(input.model ? { agentType: agentTypeForModel(input.model) } : {}),
     });
-    return { taskId: created.taskId };
+    const task = await requireWorkbenchTask(c, created.taskId);
+    const snapshot = await task.getWorkbench({});
+    return {
+      taskId: created.taskId,
+      tabId: snapshot.tabs[0]?.id,
+    };
   },
 
   async markWorkbenchUnread(c: any, input: TaskWorkbenchSelectInput): Promise<void> {