…1410)

Follow-up to #1408. Three reliability fixes on the OS/auth path, one
branch.

## 1. ~5-minute logout (root cause from library source)

`@better-auth/oauth-provider`'s refresh-token grant **rotates** the
refresh token on every use and, on reuse of an already-rotated token,
**revokes the entire token family** (`handleRefreshTokenGrant` →
`createRefreshToken` marks the old token `revoked`, and a later reuse
deletes all of the user+client's refresh tokens). A normal OS page load
fires several concurrent requests; once the 5-minute access token was
within the 30s refresh skew, each request independently hit the token
endpoint with the same cookie token — the first rotated it, the rest
looked like theft and nuked the session → logout, repeating roughly
every 5 minutes.

Fixes (`apps/auth/src/lib/server.ts`, the SDK OS bundles):
- **Single-flight refresh** per refresh token — concurrent refreshes
collapse to one token-endpoint call (`createSingleFlight`, extracted +
unit-tested).
- **Never refresh on WebSocket upgrades** — an upgrade response can't
carry `Set-Cookie`, so refreshing there would rotate the token into a
response the browser can't store and strand the session (this is also
the **REPL websocket failure**: once the access token went stale, the
capnweb upgrade tried to refresh, failed, and 401'd).
- **Tolerate a failed refresh while the access token is still valid** —
serve the request and let a later one retry, instead of dropping the
session on any hiccup.
- **Access-token TTL 5m → 30m** (`auth-plugins.ts`) so refresh is rare.
Tradeoff: org/project claim changes propagate within ≤30m (mitigated for
the creator by client cache seeding).

## 2. Deploy-time JWKS (`apps/os/alchemy.run.ts`)

#1408 verified JWTs locally from a static JWKS but relied on a hand-set
Doppler secret. Now the alchemy script **fetches `<issuer>/jwks` at
deploy time** into `APP_CONFIG` (typesafe), so key rotation only needs
an OS redeploy. A loopback issuer (local dev auth, own keys) skips the
static JWKS; a failed fetch falls back to runtime JWKS. **Verified**:
preview-5 deploy log shows the JWKS baked into config and the worker
healthy with zero auth-worker roundtrips.

## 3. Stream append skeleton flash
(`apps/os/.../project-stream-view.tsx`)

On append the virtualized window shifted (the list grows and the view
force-scrolled to the bottom), which re-created the visible-range SQL
query. `stream-browser-db.query()` seeds a new range query as `pending`
carrying a *different* range's rows, so `rowsByIndex` missed the visible
indices and every visible row blanked to a grey `bg-slate-100` skeleton
for a frame — the "skeleton flash + all rows redraw". Fixes: retain the
last committed rows across range re-queries (only genuinely-new indices
fall back to a skeleton), and only auto-scroll to the bottom when
already pinned there (don't yank a scrolled-up reader and trigger a
full-window re-query).

## Proof status (being precise)

- **Refresh single-flight**: proven by
`apps/os/src/auth/iterate-auth-single-flight.test.ts` (deterministic) +
root cause read from the oauth-provider source. The end-to-end "wait 5
minutes in a browser" proof was **not** completed: production auth is
Google-only (no headless sign-in) and doesn't honor service-token
impersonation at the public `oauth2/authorize`, and the fixed local
stack now issues 30m tokens. Worth a manual 5-min check after this
deploys to prod auth.
- **Deploy-time JWKS**: verified on a real preview-5 deploy.
- **Stream flash**: fix is code-reasoned and safe (retain-last-rows +
sticky-scroll); not pixel-verified — the local headless harness was too
unstable (Chrome OOM, dev issuer drift) to capture the sub-second flash
reliably. See `apps/os/docs/headless-local-debugging.md`.

## Docs

`apps/os/docs/headless-local-debugging.md` — driving the full local
OS+Auth stack headlessly (test OTP `424242`, signup allowlist,
orgs/projects, OAuth/consent quirks, reading local D1, MutationObserver
over throttled timers).

`pnpm typecheck && pnpm lint && pnpm test` all green.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **High Risk**
> Changes authentication refresh semantics, WebSocket session behavior,
and access-token lifetime—security-critical paths that affect all
signed-in users and long-lived connections.
> 
> **Overview**
> Addresses three reliability issues on the OS/auth path: periodic
session logout, JWT verification at deploy, and stream UI flicker.
> 
> **Auth session (~5‑minute logout):** Adds exported
`createSingleFlight` and wraps refresh-token grants so concurrent
requests sharing one cookie collapse to a single token call—avoiding
rotated-token reuse that revokes the whole family. Cookie middleware
skips refresh on WebSocket upgrades (no `Set-Cookie`), tolerates refresh
failures while the access token is still valid, and extends access-token
TTL from 5m to 30m on the auth provider.
> 
> **OS deploy:** `alchemy.run.ts` fetches issuer JWKS at deploy time
into static config (loopback dev skips production JWKS; fetch failure
falls back to runtime JWKS).
> 
> **Stream UI:** `project-stream-view` keeps last committed SQLite rows
during virtualizer range re-queries and only auto-scrolls when the user
is pinned near the bottom, reducing skeleton flashes on append.
> 
> Adds `headless-local-debugging.md`, README link, and unit tests for
`createSingleFlight`.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
10682c4. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

<!-- CLOUDFLARE_PREVIEW -->
## Environment Config Lease
<!-- CLOUDFLARE_PREVIEW_STATE -->
<!--
{
  "apps": {
    "os": {
      "appDisplayName": "OS",
      "appSlug": "os",
      "status": "deployed",
      "updatedAt": "2026-06-09T23:12:17.956Z",
      "headSha": "10682c43e5022fef9c39f55405bed1f423384950",
      "message": null,
      "publicUrl": "https://os.iterate-preview-2.com",
"runUrl": "https://github.com/iterate/iterate/actions/runs/27241670590",
      "shortSha": "10682c4"
    }
  },
  "environmentConfigLease": {
    "dopplerConfig": "preview_2",
    "leasedUntil": 1781050179583,
    "leaseId": "0aa9f837-5428-4f86-be56-bfc11f0a201d",
    "slug": "preview-2",
    "type": "environment-config-lease"
  }
}
-->
<!-- /CLOUDFLARE_PREVIEW_STATE -->
Lease: `preview-2`
Doppler config: `preview_2`
Type: `environment-config-lease`
Leased until: 2026-06-10T00:09:39.583Z

### OS
Status: deployed
Commit: `10682c4`
Preview: https://os.iterate-preview-2.com
[Workflow
run](https://github.com/iterate/iterate/actions/runs/27241670590)
Updated: 2026-06-09T23:12:17.956Z
<!-- /CLOUDFLARE_PREVIEW -->

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>