fix(storage): write strings raw so current_tenant does not double-encode

[sonegillis1]

The bug

LocalStorageService was asymmetric — getItem read raw, setItem JSON-stringified:

async getItem<T>(key: string)          { return window.localStorage.getItem(key) as T; }
async setItem<T>(key: string, item: T) { window.localStorage.setItem(key, JSON.stringify(item)); }

So every string written through the SDK came back double-encoded.

That fed an infinite refresh loop in the SDK's syncCookiesToLocalStorage. From a console capture of a mentor embed on a different tenant — 120 iterations in 112 seconds:

cookieCurrentTenant  {"key":"gillis",...}          ← JSON string
localCurrentTenant   "{\"key\":\"gillis\",...}"    ← JSON string of a JSON string
Cookie sync detected changes from another SPA, refreshing page

Identical values, reported as different, forever:

1. the tenant keys genuinely differ, so the sync writes the cookie value to storage
2. setItem stringifies that string → stored double-encoded
3. next poll, one JSON.parse yields the JSON string, not an object, so .key is undefined
4. "gillis" !== undefined → "changed" → write → refresh → back to 2, forever

It also fired 118 interval redirecting to auth spa attempts, stopped only by the login-timestamp guard.

The fix

Strings are written as-is, so they round-trip through getItem. Non-strings are still serialised, so object callers are unaffected.

This matches how the other SPAs implement the same interface (mentorai, apps/auth both write raw).

Verified

• tsc --noEmit clean
• full suite 3032 passed / 10 skipped
• new case asserting a JSON string round-trips (setItem → getItem → JSON.parse gives the object back); the existing non-string case still asserts stringification

Related

iblai/iblai-web-frontend#2059 hardens the SDK's comparison so no host adapter can spin this loop again, and fixes a second issue in the same capture where a tenant switch offered to the host was never taken.

🤖 Generated with Claude Code