@dbx-tools/appkit-mastra 0.9.106 → 0.9.110

package/package.json

@@ -34,29 +34,31 @@
   },
   "dependencies": {
     "@databricks/appkit": "0.81.0",
-    "@dbx-tools/appkit": "^0.9.106",
-    "@dbx-tools/core": "^0.9.106",
-    "@dbx-tools/databricks": "^0.9.106",
-    "@dbx-tools/fs": "^0.9.106",
-    "@dbx-tools/genie": "^0.9.106",
-    "@dbx-tools/model": "^0.9.106",
-    "@dbx-tools/model-protocol": "^0.9.106",
-    "@dbx-tools/path": "^0.9.106",
-    "@dbx-tools/postgres": "^0.9.106",
-    "@dbx-tools/shared-core": "^0.9.106",
-    "@dbx-tools/shared-fs": "^0.9.106",
-    "@dbx-tools/shared-genie": "^0.9.106",
-    "@dbx-tools/shared-mastra": "^0.9.106",
-    "@dbx-tools/shared-model": "^0.9.106",
+    "@dbx-tools/appkit": "^0.9.110",
+    "@dbx-tools/core": "^0.9.110",
+    "@dbx-tools/databricks": "^0.9.110",
+    "@dbx-tools/fs": "^0.9.110",
+    "@dbx-tools/genie": "^0.9.110",
+    "@dbx-tools/model": "^0.9.110",
+    "@dbx-tools/model-protocol": "^0.9.110",
+    "@dbx-tools/path": "^0.9.110",
+    "@dbx-tools/postgres": "^0.9.110",
+    "@dbx-tools/shared-core": "^0.9.110",
+    "@dbx-tools/shared-fs": "^0.9.110",
+    "@dbx-tools/shared-genie": "^0.9.110",
+    "@dbx-tools/shared-mastra": "^0.9.110",
+    "@dbx-tools/shared-model": "^0.9.110",
     "@mastra/ai-sdk": "1.10.5",
     "@mastra/core": "1.71.0",
     "@mastra/express": "1.5.15",
     "@mastra/fastembed": "1.3.2",
+    "@mastra/isolated-vm": "0.1.2",
     "@mastra/mcp": "2.1.0",
     "@mastra/memory": "1.32.1",
     "@mastra/observability": "1.18.1",
     "@mastra/otel-bridge": "1.5.11",
     "@mastra/pg": "1.27.1",
+    "@mastra/quickjs": "0.1.3",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@opentelemetry/api": "^1.9.1",
     "@opentelemetry/core": "2.11.0",
@@ -217,7 +219,7 @@
       "./package.json": "./package.json"
     }
   },
-  "version": "0.9.106",
+  "version": "0.9.110",
   "types": "./lib/index.d.ts",
   "dbxToolsConfig": {
     "tags": [

package/src/agents.ts

@@ -38,21 +38,42 @@ import { createEventedAgent } from "@mastra/core/agent/durable";
 import { SkillSearchProcessor } from "@mastra/core/processors";
 import type { OutputProcessor } from "@mastra/core/processors";
 import { MASTRA_RESOURCE_ID_KEY } from "@mastra/core/request-context";
-import type { Tool } from "@mastra/core/tools";
-import { createTool } from "@mastra/core/tools";
+import type { RequestContext } from "@mastra/core/request-context";
+import type { CodeModeTransport, Tool } from "@mastra/core/tools";
+import { createCodeMode, createTool } from "@mastra/core/tools";
 import type { Workspace } from "@mastra/core/workspace";
+import { createWorkspaceTools } from "@mastra/core/workspace";
 import type { PgVectorConfig, PostgresStoreConfig } from "@mastra/pg";
+import { QuickJsCodeModeTransport } from "@mastra/quickjs";
 
 import { buildRenderDataTool } from "./chart.ts";
 import type { MastraPluginConfig } from "./config.ts";
 import { buildGenieToolkitProvider, resolveGenieSpaces } from "./genie.ts";
-import type { MemoryBuilder } from "./memory.ts";
+import { withRequestMemoryScope, type MemoryBuilder } from "./memory.ts";
 import { buildModel, RESPONSES_PROVIDER_OPTIONS } from "./model.ts";
 import { stripStaleChartsProcessor } from "./processors.ts";
 import { MASTRA_RESOLVED_MODEL_KEY } from "./serving.ts";
 import { TYPOGRAPHY_RULE } from "./style.ts";
 import { buildSummarizeTool } from "./summarize.ts";
-import { bindDatabricksWorkspaceContext, databricksWorkspace } from "./workspaces.ts";
+import {
+  bindDatabricksWorkspaceContext,
+  databricksWorkspace,
+  type DatabricksWorkspaceOptions,
+} from "./workspaces.ts";
+
+const codeModeLogger = log.logger("mastra/code-mode");
+let resolvedCodeModeTransport: Promise<CodeModeTransport> | undefined;
+
+/** Return whether this boot environment matches isolated-vm's supported app shape. */
+function supportsIsolatedVmTransport(): boolean {
+  if (process.versions.bun || process.release.name !== "node" || process.platform !== "linux") {
+    return false;
+  }
+  const nodeMajor = Number.parseInt(process.versions.node.split(".")[0] ?? "", 10);
+  if (!Number.isFinite(nodeMajor) || nodeMajor < 20 || nodeMajor >= 25) return false;
+  const nodeOptions = process.env.NODE_OPTIONS?.split(/\s+/) ?? [];
+  return [...process.execArgv, ...nodeOptions].includes("--no-node-snapshot");
+}
 
 /**
  * Tool record accepted by every Mastra `Agent.tools` field and by the
@@ -169,8 +190,9 @@ function deriveToolId(description: string): string {
  * ```
  *
  * Adds the package's default workspace when the definition omits one. That
- * workspace carries Databricks skill mounts and Monty command execution. An
- * explicit workspace remains the caller's complete override.
+ * workspace carries Databricks skill mounts while command execution stays
+ * disabled until a sandbox is selected explicitly. An explicit workspace
+ * remains the caller's complete override.
  */
 export function createAgent<
   TRequestContext extends Record<string, unknown> | unknown = unknown,
@@ -186,7 +208,7 @@ export function createAgent<
 /**
  * Brand for a {@link Workspace} that `createAgent` built with no caller
  * options, so {@link buildAgents} may rebuild it with startup-provisioned
- * `extraSkillPaths` (a caller-supplied workspace is never touched).
+ * `extraSkillMounts` (a caller-supplied workspace is never touched).
  */
 const defaultWorkspaces = new WeakSet<Workspace>();
 
@@ -529,22 +551,114 @@ function appendDefaultInstructions(
 function composeInstructions<TRequestContext extends Record<string, unknown> | unknown>(
   agentInstructions: AgentConfig<string, ToolsInput, undefined, TRequestContext>["instructions"],
   style: string | null,
+  resolveCodeMode?: CodeModeResolver<TRequestContext>,
 ): AgentConfig<string, ToolsInput, undefined, TRequestContext>["instructions"] {
-  if (typeof agentInstructions !== "function") {
-    return appendDefaultInstructions(agentInstructions, style) as AgentConfig<
+  const append = (instructions: AgentInstructions, codeModeInstructions?: string) => {
+    const composed = appendDefaultInstructions(instructions, style);
+    return codeModeInstructions ? appendInstructionBlock(composed, codeModeInstructions) : composed;
+  };
+  if (typeof agentInstructions !== "function" && !resolveCodeMode) {
+    return append(agentInstructions) as AgentConfig<
       string,
       ToolsInput,
       undefined,
       TRequestContext
     >["instructions"];
   }
-  return (async (args) =>
-    appendDefaultInstructions(await agentInstructions(args), style)) as AgentConfig<
-    string,
-    ToolsInput,
-    undefined,
-    TRequestContext
-  >["instructions"];
+  return (async (args) => {
+    const [instructions, codeMode] = await Promise.all([
+      typeof agentInstructions === "function" ? agentInstructions(args) : agentInstructions,
+      resolveCodeMode?.(args),
+    ]);
+    return append(instructions, codeMode?.instructions);
+  }) as AgentConfig<string, ToolsInput, undefined, TRequestContext>["instructions"];
+}
+
+/** Append one system instruction block while preserving Mastra's accepted shapes. */
+function appendInstructionBlock(instructions: AgentInstructions, block: string): AgentInstructions {
+  if (typeof instructions === "string") return `${instructions.trimEnd()}\n\n${block}`;
+  if (Array.isArray(instructions)) {
+    if (instructions.every((instruction) => typeof instruction === "string")) {
+      return [...instructions, block] as AgentInstructions;
+    }
+    return [...instructions, { role: "system", content: block }] as AgentInstructions;
+  }
+  return [instructions, { role: "system", content: block }] as AgentInstructions;
+}
+
+/** Resolve one native Code Mode transport during plugin startup. */
+function codeModeTransport(): Promise<CodeModeTransport> {
+  resolvedCodeModeTransport ??= (async () => {
+    if (!supportsIsolatedVmTransport()) {
+      codeModeLogger.info("transport selected", { provider: "quickjs" });
+      return new QuickJsCodeModeTransport();
+    }
+    try {
+      const { IsolatedVmCodeModeTransport } = await import("@mastra/isolated-vm");
+      const transport = new IsolatedVmCodeModeTransport();
+      codeModeLogger.info("transport selected", { provider: "isolated-vm" });
+      return transport;
+    } catch (caught) {
+      codeModeLogger.warn("isolated-vm unavailable; using QuickJS", {
+        error: errorUtils.errorMessage(caught),
+      });
+      return new QuickJsCodeModeTransport();
+    }
+  })();
+  return resolvedCodeModeTransport;
+}
+
+type CodeModeResolver<TRequestContext extends Record<string, unknown> | unknown = unknown> = (
+  args: Parameters<
+    Exclude<
+      AgentConfig<string, ToolsInput, undefined, TRequestContext>["instructions"],
+      AgentInstructions
+    >
+  >[0],
+) => Promise<ReturnType<typeof createCodeMode> | undefined>;
+
+/** Build request-scoped native Code Mode over all executable context tools. */
+async function buildCodeMode<TRequestContext extends Record<string, unknown> | unknown>(
+  config: MastraPluginConfig,
+  tools: MastraTools,
+  workspace: Workspace | undefined,
+  requestContext: RequestContext<TRequestContext>,
+): Promise<ReturnType<typeof createCodeMode> | undefined> {
+  if (config.codeMode === false) return undefined;
+  const workspaceTools = workspace
+    ? await createWorkspaceTools(workspace, { requestContext, workspace })
+    : {};
+  const contextTools = { ...tools, ...workspaceTools };
+  const executableTools = Object.fromEntries(
+    Object.entries(contextTools).filter(
+      ([, tool]) =>
+        typeof tool === "object" &&
+        tool !== null &&
+        "execute" in tool &&
+        typeof tool.execute === "function",
+    ),
+  ) as ToolsInput;
+  if (Object.keys(executableTools).length === 0) return undefined;
+  const options = typeof config.codeMode === "object" ? config.codeMode : {};
+  const codeMode = createCodeMode(
+    { tools: executableTools, ...options },
+    await codeModeTransport(),
+  );
+  if (!("mastra_workspace_read_file" in workspaceTools)) return codeMode;
+  return {
+    ...codeMode,
+    instructions: `${codeMode.instructions}\n\nWorkspace file content note:\nText returned by external_mastra_workspace_read_file starts with one metadata line containing the path and size. Exclude that first line before calculating content character counts, hashes, or other content-only values.`,
+  };
+}
+
+/** Resolve Code Mode lazily so workspace and dynamic tool policy follow each request. */
+function codeModeResolver<TRequestContext extends Record<string, unknown> | unknown>(
+  config: MastraPluginConfig,
+  tools: MastraTools,
+  workspace: Workspace | undefined,
+): CodeModeResolver<TRequestContext> | undefined {
+  if (config.codeMode === false) return undefined;
+  return ({ requestContext }) => buildCodeMode(config, tools, workspace, requestContext);
 }
 
 /**
@@ -580,9 +694,9 @@ export async function buildAgents(opts: {
    * startup) folded into every agent that uses the auto-created default
    * workspace.
    */
-  extraSkillPaths?: string[];
+  extraSkillMounts?: DatabricksWorkspaceOptions["extraSkillMounts"];
 }): Promise<BuiltAgents> {
-  const { config, context, memoryBuilder, log, extraSkillPaths } = opts;
+  const { config, context, memoryBuilder, log, extraSkillMounts } = opts;
   const definitions = resolveDefinitions(config);
   const ids = Object.keys(definitions);
   const defaultAgentId = config.defaultAgent ?? ids[0] ?? FALLBACK_AGENT_ID;
@@ -592,8 +706,8 @@ export async function buildAgents(opts: {
   // `render_data` for inline visualizations and `summarize` for
   // offloading text condensing to the fast / small chat tier. The
   // user can shadow either by including a same-named tool in their own
-  // `config.tools` or per-agent `tools`. Order in {@link resolveTools}
-  // is `system -> user-ambient -> per-agent`, last write wins.
+  // `config.tools` or per-agent `tools`. Merge order is
+  // `system -> user-ambient -> per-agent`, last write wins.
   const systemTools: MastraTools = {
     render_data: buildRenderDataTool(config),
     summarize: buildSummarizeTool(config),
@@ -615,18 +729,21 @@ export async function buildAgents(opts: {
   const approvalGatedByAgent: Array<{ agentId: string; toolIds: string[] }> = [];
 
   for (const [id, def] of Object.entries(definitions)) {
-    const tools = await resolveTools(def.tools, plugins, ambientTools);
+    const userTools = await resolveUserTools(def.tools, plugins);
+    const tools = { ...ambientTools, ...userTools };
     let workspace = resolveAgentWorkspace(def.workspace);
     if (
       (def.workspace === undefined && !workspace) ||
-      ((extraSkillPaths?.length ||
+      ((extraSkillMounts?.length ||
         config.sandbox !== undefined ||
+        config.workspaceFallbackToTmp !== undefined ||
         config.workspaceTools !== undefined ||
         context !== undefined) &&
         isDefaultWorkspace(workspace))
     ) {
       workspace = databricksWorkspace({
-        extraSkillPaths,
+        extraSkillMounts,
+        fallbackToTmp: config.workspaceFallbackToTmp,
         ...(config.workspaceTools !== undefined ? { tools: config.workspaceTools } : {}),
         pluginContext: context,
         sandbox: config.sandbox === true ? "databricks" : config.sandbox,
@@ -638,6 +755,7 @@ export async function buildAgents(opts: {
     const gated = approvalGatedToolIds(tools);
     if (gated.length > 0) approvalGatedByAgent.push({ agentId: id, toolIds: gated });
     const memory = memoryBuilder?.forAgent(id, def);
+    const resolveCodeMode = codeModeResolver(config, tools, workspace);
     const agent = new Agent({
       id,
       name: def.name ?? id,
@@ -646,17 +764,26 @@ export async function buildAgents(opts: {
       // metadata. Fall back to a generated one when the definition
       // omits it.
       description: def.description?.trim() || defaultAgentDescription(def.name ?? id),
-      instructions: composeInstructions(def.instructions, style),
+      instructions: composeInstructions(def.instructions, style, resolveCodeMode),
       ...(def.requestContextSchema ? { requestContextSchema: def.requestContextSchema } : {}),
       model: resolveModel(config, def.model),
-      defaultOptions: {
-        maxSteps: config.agentMaxSteps ?? DEFAULT_AGENT_MAX_STEPS,
-        providerOptions: RESPONSES_PROVIDER_OPTIONS,
-        ...(def.requireToolApproval !== undefined
-          ? { requireToolApproval: def.requireToolApproval }
-          : {}),
-      },
-      tools,
+      defaultOptions: ({ requestContext }) =>
+        withRequestMemoryScope(
+          {
+            maxSteps: config.agentMaxSteps ?? DEFAULT_AGENT_MAX_STEPS,
+            providerOptions: RESPONSES_PROVIDER_OPTIONS,
+            ...(def.requireToolApproval !== undefined
+              ? { requireToolApproval: def.requireToolApproval }
+              : {}),
+          },
+          memory ? requestContext : undefined,
+        ),
+      tools: resolveCodeMode
+        ? async (args) => {
+            const codeMode = await resolveCodeMode(args);
+            return codeMode ? { ...tools, [codeMode.tool.id]: codeMode.tool } : tools;
+          }
+        : tools,
       ...(memory ? { memory } : {}),
       ...(workspace ? { workspace } : {}),
       inputProcessors: [...inputProcessors, ...workspaceSkillInputProcessors(workspace, config)],
@@ -679,7 +806,7 @@ export async function buildAgents(opts: {
       name: def.name ?? id,
       defaultModel:
         defaultModel.kind === "configured" ? defaultModel.model : `<${defaultModel.kind}>`,
-      tools: Object.keys(tools),
+      tools: [...Object.keys(tools), ...(resolveCodeMode ? ["<dynamic-code-mode>"] : [])],
     });
   }
 
@@ -909,19 +1036,16 @@ function resolveModel(
 }
 
 /**
- * Resolve a definition's `tools` field to a flat `MastraTools` record,
- * merging in plugin-level ambient tools (per-agent tools win on key
- * collision). Callback errors propagate verbatim so the original stack
- * survives - the caller already knows which agent was registering.
+ * Resolve only the tools explicitly supplied by one agent definition.
+ * Callback errors propagate verbatim so the original stack survives - the
+ * caller already knows which agent was registering.
  */
-async function resolveTools(
+async function resolveUserTools(
   defTools: AnyMastraAgentDefinition["tools"],
   plugins: MastraPlugins,
-  ambientTools: MastraTools,
 ): Promise<MastraTools> {
-  if (!defTools) return { ...ambientTools };
-  const resolved = typeof defTools === "function" ? await defTools(plugins) : defTools;
-  return { ...ambientTools, ...resolved };
+  if (!defTools) return {};
+  return typeof defTools === "function" ? defTools(plugins) : defTools;
 }
 
 function resolveAgentWorkspace(

package/src/chat.ts

@@ -15,6 +15,8 @@ import { isEventedAgent } from "@mastra/core/agent/durable";
 import { registerApiRoute } from "@mastra/core/server";
 import { createUIMessageStreamResponse } from "ai";
 
+import { withRequestMemoryScope } from "./memory.ts";
+
 const logger = log.logger("mastra/chat");
 
 /** Client request cancellation is detached only for evented background agents. */
@@ -62,11 +64,14 @@ export function agentChatRoutes() {
             : status
               ? { agentVersion: { status } }
               : {}),
-          params: {
-            ...params,
+          params: withRequestMemoryScope(
+            {
+              ...params,
+              requestContext,
+              ...(abortSignal ? { abortSignal } : {}),
+            },
             requestContext,
-            ...(abortSignal ? { abortSignal } : {}),
-          },
+          ),
           version: "v7",
           sendReasoning: true,
           sendSources: true,

package/src/config.ts

@@ -158,6 +158,14 @@ export interface MastraWorkspaceSkillsConfig {
   ttlMs?: number;
 }
 
+/** Native Mastra Code Mode settings for sandboxed multi-tool orchestration. */
+export interface MastraCodeModeConfig {
+  /** Generated orchestration tool id. Defaults to `execute_typescript`. */
+  id?: string;
+  /** Maximum orchestration program runtime in milliseconds. Defaults to 30 seconds. */
+  timeout?: number;
+}
+
 /**
  * Fine-grained control for the optional MCP server exposure
  * ({@link MastraPluginConfig.mcp}). Every field is optional; the object
@@ -218,12 +226,22 @@ export interface MastraPluginConfig extends BasePluginConfig {
    */
   memory?: boolean | MastraMemoryConfig;
   /**
-   * Sandbox for auto-created agent workspaces. Defaults to Monty. `true`,
-   * `"databricks"`, or an object selects/configures Databricks Sandbox, and
-   * `false` disables workspace command execution. An agent with an explicit
-   * custom `workspace` keeps that workspace and its sandbox.
+   * Expose executable tools from each agent definition through native Mastra
+   * Code Mode. Defaults on whenever the agent has executable tools. The plugin
+   * selects Mastra's isolated-vm transport once during startup and falls back
+   * to Mastra QuickJS when the native transport is unavailable. Set `false` to
+   * opt out.
+   */
+  codeMode?: boolean | MastraCodeModeConfig;
+  /**
+   * Sandbox for auto-created agent workspaces. Disabled by default. `"monty"`
+   * selects Monty; `true`, `"databricks"`, or an object selects/configures
+   * Databricks Sandbox. An agent with an explicit custom `workspace` keeps that
+   * workspace and its sandbox.
    */
   sandbox?: boolean | "databricks" | "monty" | DatabricksWorkspaceSandboxOptions;
+  /** Add user-scoped `/tmp` only when no configured workspace path mounts writable. */
+  workspaceFallbackToTmp?: boolean;
   /** Native Mastra workspace tool availability, approval, and hook configuration. */
   workspaceTools?: WorkspaceToolsConfig;
   /**
@@ -659,7 +677,7 @@ export const MASTRA_CONFIG_SCHEMA: ConfigSchema = {
     remoteSkills: {
       type: ["string", "array", "object"],
       description:
-        'Remote Agent-Skill sources provisioned at startup: "aitools" for Databricks\' own skill set (read from the public databricks/databricks-agent-skills repo, no CLI needed), a GitHub owner/repo, a git/GitLab URL, or a direct SKILL.md/archive URL. Non-aitools sources prefer the optional `skills` npm CLI, else a direct fetch; fails startup on error unless failOnError:false. Written to the Databricks user Assistant skills folder, or a local temp dir when no workspace is writable.',
+        'Remote Agent-Skill sources provisioned at startup: "aitools" for Databricks\' own skill set (read from the public databricks/databricks-agent-skills repo, no CLI needed), a GitHub owner/repo, a git/GitLab URL, or a direct SKILL.md/archive URL. Non-aitools sources prefer the optional `skills` npm CLI, else a direct fetch; fails startup on error unless failOnError:false. Written to the Databricks user Assistant skills folder, or read-only local backing storage exposed at stable virtual workspace mounts.',
     },
     storage: {
       type: ["boolean", "object"],
@@ -671,10 +689,20 @@ export const MASTRA_CONFIG_SCHEMA: ConfigSchema = {
       description:
         "PgVector store for Mastra semantic recall. `true` reuses the `lakebase` plugin's pool, an object opens a dedicated store. Auto-enabled when the `lakebase` plugin is registered.",
     },
+    codeMode: {
+      type: ["boolean", "object"],
+      description:
+        "Expose all executable tools available to the current request, including native workspace tools, through dynamically generated Mastra Code Mode for sandboxed TypeScript batching, aggregation, and arithmetic. The plugin selects Mastra isolated-vm once during startup and falls back to Mastra QuickJS when native initialization is unavailable. False disables it.",
+    },
     sandbox: {
       type: ["boolean", "string", "object"],
       description:
-        'Command sandbox for auto-created agent workspaces. Defaults to Monty; false disables command execution, and true, "databricks", or an object selects/configures Databricks Sandbox with optional fallback.',
+        'Command sandbox for auto-created agent workspaces. Disabled by default. "monty" selects Monty; true, "databricks", or an object selects/configures Databricks Sandbox.',
+    },
+    workspaceFallbackToTmp: {
+      type: "boolean",
+      description:
+        "Add user-scoped /tmp to auto-created agent workspaces only when no configured Databricks path mounts writable. Defaults to false.",
     },
     workspaceSkills: {
       type: ["boolean", "object"],

package/src/memory.ts

@@ -36,6 +36,12 @@ import { getUsernameWithApiLookup } from "@databricks/appkit";
 import { migration as appkitMigration } from "@dbx-tools/appkit";
 import { postgresConnectionOptions } from "@dbx-tools/postgres";
 import { hash, log } from "@dbx-tools/shared-core";
+import type { AgentMemoryOption } from "@mastra/core/agent";
+import {
+  MASTRA_RESOURCE_ID_KEY,
+  MASTRA_THREAD_ID_KEY,
+  type RequestContext,
+} from "@mastra/core/request-context";
 import { fastembed } from "@mastra/fastembed";
 import { Memory } from "@mastra/memory";
 import { PgVector, PostgresStore } from "@mastra/pg";
@@ -48,6 +54,33 @@ import { summaryModel, TITLE_INSTRUCTIONS } from "./summarize.ts";
 
 const logger = log.logger("mastra/memory");
 
+/** Resolve the trusted Mastra memory scope stamped by AppKit middleware. */
+export function requestMemoryScope(
+  requestContext: Pick<RequestContext, "get"> | undefined,
+): AgentMemoryOption | undefined {
+  const threadId = requestContext?.get(MASTRA_THREAD_ID_KEY);
+  const resourceId = requestContext?.get(MASTRA_RESOURCE_ID_KEY);
+  if (typeof threadId !== "string" || typeof resourceId !== "string") return undefined;
+  return { thread: threadId, resource: resourceId };
+}
+
+/** Overlay trusted request memory identifiers onto Mastra execution options. */
+export function withRequestMemoryScope<T extends object>(
+  options: T,
+  requestContext: Pick<RequestContext, "get"> | undefined,
+): T & { memory?: AgentMemoryOption } {
+  const scope = requestMemoryScope(requestContext);
+  if (!scope) return options;
+  const memory = (options as { memory?: AgentMemoryOption }).memory;
+  return {
+    ...options,
+    memory: {
+      ...memory,
+      ...scope,
+    },
+  };
+}
+
 /**
  * Soften {@link PostgresStore.init} so a failed migration (e.g. Lakebase
  * `must be owner of table …` on `ALTER`) is logged once instead of rethrown

package/src/plugin.ts

@@ -1110,14 +1110,14 @@ export class MastraPlugin extends Plugin<MastraPluginConfig> {
     // Materialize any remote Agent-Skill sources ONCE at startup. Runs
     // outside a request scope, so it uses the app service principal's client
     // and defaults to the shared workspace Assistant skills tree; a source
-    // that lands on a local temp dir (no writable workspace) is folded into
-    // every default-workspace agent via `extraSkillPaths`.
+    // backed by local temp storage (no writable workspace) is folded into
+    // every default-workspace agent via `extraSkillMounts`.
     const provisioned = await provisionRemoteSkills(this.config.remoteSkills);
     if (provisioned.skillNames.length > 0) {
       this.logger.info("remote skills configured", {
         skills: provisioned.skillNames,
         databricksBasePath: provisioned.databricksBasePath,
-        localSkillPaths: provisioned.localSkillPaths.length,
+        localSkillMounts: provisioned.localSkillMounts.length,
       });
     }
 
@@ -1126,7 +1126,7 @@ export class MastraPlugin extends Plugin<MastraPluginConfig> {
       context: this.context,
       memoryBuilder,
       log: this.logger,
-      extraSkillPaths: provisioned.localSkillPaths,
+      extraSkillMounts: provisioned.localSkillMounts,
     });
 
     // `mastra.server.apiRoutes` is only honored by Mastra's standalone