fix(frontend): oss fixes and token for tabs

[jog1t]

Description

Please include a summary of the changes and the related issue. Please also include relevant motivation and context.

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

How Has This Been Tested?

Please describe the tests that you ran to verify your changes.

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes

[jog1t]

• fix(frontend): oss fixes and token for tabs #5243 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[railway-app]

🚅 Deployed to the rivet-pr-5243 environment in rivet-frontend

Service	Status	Web	Updated (UTC)
kitchen-sink	❌ Build Failed (View Logs)	Web	Jun 12, 2026 at 11:20 pm
frontend-cloud	✅ Success (View Logs)	Web	Jun 12, 2026 at 11:19 pm
ladle	✅ Success (View Logs)	Web	Jun 12, 2026 at 11:16 pm
frontend-inspector	❌ Build Failed (View Logs)	Web	Jun 12, 2026 at 11:15 pm
website	😴 Sleeping (View Logs)	Web	Jun 12, 2026 at 11:09 pm
mcp-hub	✅ Success (View Logs)	Web	Jun 12, 2026 at 10:58 pm

[claude]

PR Review: fix(frontend): oss fixes and token for tabs

This PR adds OSS/engine flavor support for the namespace landing, context switcher, and settings drawer, and embeds a rivetToken as a path-segment for inspector iframe auth. Overall the direction is solid; a few items worth addressing below.

---

Issues

1. NoProvidersAlert flash before runner queries resolve (engine-namespace-landing.tsx)

When both runner queries are still in-flight, the numeric defaults kick in and hasProviders is false. If the builds query resolves empty first, the component renders <NoProvidersAlert variant="connect" /> immediately -- even for users who do have providers -- and the alert then disappears once the runner queries resolve. Add isPending guards from the runner queries to defer the empty-state branch until all three queries have settled.

2. Referrer-Policy header missing from custom-tab responses (inspector.rs)

The header is added to json_http_response and inspector_ui_response, but the gateway also serves /inspector/custom-tabs/ assets. If there is a separate response path for those static files, it needs the same Referrer-Policy: no-referrer -- otherwise the path-segment token can still leak via Referer on sub-resource fetches from custom-tab content.

3. Sort order divergence between landing components

EngineNamespaceLanding sorts builds by a.id.localeCompare(b.id) (alphabetical by ID). If ActorsGrid’s sorted uses a different order (e.g. by creation time or display name), the two flavors will render cards in different order despite the goal of OSS and platform not visually diverging. Align the sort or extract a shared sort function.

---

Minor / Nits

4. useEngineNamespaceReady with an exact path match (settings-drawer.tsx)

useMatch("/_context/ns/$namespace", { shouldThrow: false }) may return null when the user is on a deeper child route, causing EngineNamespaceSettings to show the skeleton indefinitely. Confirm the behavior with a child route active, or use useParams to check for namespace presence instead.

5. openCreateActor casts search to Record<string, unknown> (engine-namespace-landing.tsx)

Bypasses TanStack Router’s typed search schema. If the cloud ActorsGrid uses the typed approach, align with it to catch search-param regressions at compile time.

6. EngineNamespaceList -- data spread assumes flat array

If namespacesQueryOptions does not include a page-flattening select, data is InfiniteData<...> and [...(data ?? [])] will not produce a namespace list. Verify that namespacesQueryOptions flattens via select (as buildsQueryOptions appears to) or add the flatten explicitly.

---

Positive changes worth calling out

• actor-not-found.tsx: switching from isLoading to isFetched is the correct fix -- isLoading returning true on background refetches was a real skeleton-flash bug, and the comment explains the reasoning well.
• ActorBuildCard extraction: clean factoring; makes the OSS/platform parity constraint enforceable rather than documentary.
• Referrer-Policy: no-referrer: right mitigation for the in-path token Referer leak; the inline comment accurately scopes what it does and does not protect against.
• Removing the auto-redirect to first build: better UX -- the landing gives the user agency rather than silently dropping them into an actor context they did not choose.
• Documentation additions in .claude/reference/feature-flags.md and frontend/CLAUDE.md: the flavor-testing instructions and known parallel pairs list are genuinely useful for future contributors.