@mastra/factory 0.0.0-aggregate-trace-20261015182851

package/dist/integrations/github/routes.js

@@ -0,0 +1,1362 @@
+import { AUTO_TRIAGED_LABEL, NEEDS_APPROVAL_LABEL } from "../../rules/types.js";
+import { listRepositoryCommits } from "./commits.js";
+import { clearGithubPat, getGithubPatStatus, setGithubPat } from "./pat.js";
+import { isValidGitRef } from "../../sandbox/git-ref.js";
+import { MaterializeError, SetupCommandError, commitAll, pushBranch } from "./sandbox.js";
+import { requireExec } from "../../sandbox/materialization.js";
+import { sanitizeSegment } from "../../sandbox/workdir.js";
+import { peekSessionSandbox } from "../../sandbox/session-sandbox.js";
+import { listPullRequestSubscriptionsForThread, subscribeToPullRequest } from "./subscriptions.js";
+import { polledPullRequestEvent } from "./rules.js";
+import { waitForPendingFilesystemCapture } from "../../session/filesystem-capture.js";
+import { normalizeSessionTitle } from "../../session/session-title.js";
+import { getGithubFeatureDiagnostics, isGithubFeatureEnabled } from "./config.js";
+import { reclaimDeletedSessionSandbox } from "./sandbox-release.js";
+import { handleGithubWebhook } from "./webhook.js";
+import { RequestContext } from "@mastra/core/request-context";
+import { registerApiRoute } from "@mastra/core/server";
+import { UniqueViolationError } from "@mastra/core/storage";
+import { resolveModel } from "@mastra/code-sdk/agents/model";
+//#region src/integrations/github/routes.ts
+const sessionOperationLocks = /* @__PURE__ */ new Map();
+const USER_SESSION_BRANCH_PREFIX = "user/session-";
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+/**
+* Serialize same-session mutations within one Factory process. Factory sessions
+* normally issue these operations sequentially, so this lock is probably not
+* necessary; keep the cheap local guard until that invariant is enforced by
+* the request protocol. It intentionally does not consume a database connection.
+*/
+function withSessionOperationLock(sessionId, fn) {
+	const next = (sessionOperationLocks.get(sessionId) ?? Promise.resolve()).then(fn, fn);
+	const tail = next.then(() => void 0, () => void 0);
+	sessionOperationLocks.set(sessionId, tail);
+	tail.then(() => {
+		if (sessionOperationLocks.get(sessionId) === tail) sessionOperationLocks.delete(sessionId);
+	});
+	return next;
+}
+/** Erase a route handler's path-parameterized context to a plain `Context`. */
+function loose(c) {
+	return c;
+}
+function pullRequestNumberFromUrl(value, expectedRepo) {
+	try {
+		const url = new URL(value);
+		const match = url.pathname.match(/^\/([^/]+\/[^/]+)\/pull\/(\d+)\/?$/);
+		if (url.protocol !== "https:" || url.hostname !== "github.com" || match?.[1]?.toLowerCase() !== expectedRepo.toLowerCase()) return;
+		const number = Number(match[2]);
+		return Number.isInteger(number) && number > 0 ? number : void 0;
+	} catch {
+		return;
+	}
+}
+function isJsonObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* Resolve the org-scoped tenant for a GitHub request. GitHub project features
+* are org-owned, so they require both a signed-in user and a WorkOS
+* organization. Returns the `(orgId, userId)` tenant (with `orgId` narrowed to a
+* non-null string) or a ready-to-return error response: 401 when unauthenticated,
+* 403 when the user has no organization (personal account).
+*
+* Resolves the session from the request cookie itself (via `auth.ensureUser`)
+* instead of relying on the auth gate's context stash: on platform deploys
+* custom `apiRoutes` run on an isolated sub-app context where the gate's
+* `c.set(...)` is invisible. When the gate stash IS visible (local Hono
+* server), `auth.ensureUser` returns the cached user and this is a no-op.
+*/
+async function resolveOrgTenant(c, auth) {
+	await auth.ensureUser(c);
+	const tenant = auth.tenant(c);
+	if (!tenant) return { response: c.json({ error: "unauthorized" }, 401) };
+	if (!tenant.orgId) return { response: c.json({
+		error: "organization_required",
+		message: "GitHub projects require a WorkOS organization. Personal accounts cannot connect repositories."
+	}, 403) };
+	return { tenant: {
+		orgId: tenant.orgId,
+		userId: tenant.userId
+	} };
+}
+/**
+* Parse a 1-based `page` query param. Missing means page 1; anything that is
+* not a small positive integer is rejected (`null`).
+*/
+function parseListPage(raw) {
+	if (raw === void 0) return 1;
+	if (!/^\d{1,5}$/.test(raw)) return null;
+	const page = Number(raw);
+	return page >= 1 ? page : null;
+}
+function parseResourceNumber(raw) {
+	if (raw === void 0 || !/^\d{1,10}$/.test(raw)) return null;
+	const parsed = Number(raw);
+	return parsed > 0 ? parsed : null;
+}
+const VALID_ISSUE_LABEL_FILTERS = /* @__PURE__ */ new Set([AUTO_TRIAGED_LABEL, NEEDS_APPROVAL_LABEL]);
+function parseIssueLabelFilter(raw) {
+	if (raw === void 0 || raw === "") return void 0;
+	if (VALID_ISSUE_LABEL_FILTERS.has(raw)) return raw;
+	return null;
+}
+async function resolveProjectRepository(args) {
+	const projectRepository = await args.github.sourceControlStorage.projectRepositories.get({
+		orgId: args.orgId,
+		id: args.projectRepositoryId
+	});
+	if (!projectRepository) return null;
+	const connection = await args.github.sourceControlStorage.connections.get({
+		orgId: args.orgId,
+		id: projectRepository.connectionId
+	});
+	if (!connection) return null;
+	const repository = await args.github.sourceControlStorage.repositories.get({
+		orgId: args.orgId,
+		id: projectRepository.repositoryId
+	});
+	if (!repository) return null;
+	const installation = await args.github.sourceControlStorage.installations.get({
+		orgId: args.orgId,
+		id: connection.installationId
+	});
+	if (!installation) return null;
+	return {
+		...projectRepository,
+		connection,
+		installation,
+		repository,
+		factoryProjectId: connection.factoryProjectId,
+		defaultBranch: projectRepository.branch ?? repository.defaultBranch
+	};
+}
+function polledIssueEvent(project, issue) {
+	const repositoryId = Number(project.repository.externalId);
+	const assigneeLogins = issue.assignees ?? (issue.assignee ? [issue.assignee] : []);
+	return {
+		event: "issues",
+		deliveryId: `poll:${repositoryId}:issue:${issue.number}:${issue.createdAt}`,
+		payload: {
+			action: "opened",
+			installation: { id: Number(project.installation.externalId) },
+			repository: {
+				id: repositoryId,
+				full_name: project.repository.slug
+			},
+			sender: { login: issue.author ?? "__unknown__" },
+			issue: {
+				number: issue.number,
+				title: issue.title,
+				html_url: issue.url,
+				created_at: issue.createdAt,
+				assignees: assigneeLogins.map((login) => ({ login })),
+				labels: issue.labels.map((name) => ({ name }))
+			}
+		}
+	};
+}
+function listedPullRequestEvent(project, pullRequest) {
+	return polledPullRequestEvent(reconcileRepositoryOf(project), pullRequest.number, listedOpenPullRequestState(pullRequest));
+}
+function reconcileRepositoryOf(project) {
+	return {
+		id: Number(project.repository.externalId),
+		fullName: project.repository.slug,
+		installationId: Number(project.installation.externalId)
+	};
+}
+function listedOpenPullRequestState(pullRequest) {
+	return {
+		title: pullRequest.title,
+		url: pullRequest.url,
+		state: "open",
+		draft: false,
+		merged: false,
+		assignees: pullRequest.assignees,
+		requestedReviewers: pullRequest.requestedReviewers,
+		labels: pullRequest.labels,
+		headBranch: pullRequest.headBranch,
+		baseBranch: pullRequest.baseBranch,
+		author: pullRequest.author ?? void 0,
+		createdAt: pullRequest.createdAt
+	};
+}
+async function ingestPolledEvents(events, ingestFactoryEvent) {
+	if (!ingestFactoryEvent) return;
+	const rejected = (await Promise.allSettled(events.map((event) => ingestFactoryEvent(event)))).find((result) => result.status === "rejected");
+	if (rejected) console.warn("[Mastra Factory] Failed to ingest polled GitHub events", { error: rejected.reason });
+}
+const LINKED_BACKLOG_MAX_PAGES = 5;
+function listedIssueOf(issue) {
+	return {
+		number: Number(issue.id),
+		title: issue.title,
+		url: issue.url,
+		author: issue.author,
+		assignee: issue.assignee,
+		assignees: issue.assignees,
+		labels: issue.labels,
+		createdAt: issue.createdAt
+	};
+}
+function listedPullRequestOf(pr) {
+	return {
+		number: Number(pr.id),
+		title: pr.title,
+		url: pr.url,
+		author: pr.author,
+		assignees: pr.assignees ?? [],
+		requestedReviewers: pr.requestedReviewers ?? [],
+		labels: pr.labels ?? [],
+		headBranch: pr.headBranch,
+		baseBranch: pr.baseBranch,
+		createdAt: pr.createdAt
+	};
+}
+/**
+* Feed a just-linked repository's open issues and pull requests through the
+* same rules ingress the list routes use, so its backlog reaches the board
+* without anyone browsing it. Rows owned by another integration don't resolve
+* through this integration's storage handle and are skipped.
+*/
+async function ingestLinkedRepositoryBacklog(args) {
+	if (!args.ingestFactoryEvent) return;
+	const project = await resolveProjectRepository(args);
+	if (!project) return;
+	const connection = {
+		type: "app-installation",
+		installationId: Number(project.installation.externalId)
+	};
+	const sourceId = project.repository.slug;
+	for (let page = 1; page <= LINKED_BACKLOG_MAX_PAGES; page += 1) {
+		const { issues, nextCursor } = await args.github.intake.listIssues({
+			connection,
+			sourceIds: [sourceId],
+			cursor: String(page)
+		});
+		await ingestPolledEvents(issues.map((issue) => polledIssueEvent(project, listedIssueOf(issue))), args.ingestFactoryEvent);
+		if (nextCursor === null) break;
+	}
+	for (let page = 1; page <= LINKED_BACKLOG_MAX_PAGES; page += 1) {
+		const { pullRequests, nextCursor } = await args.github.versionControl.listPullRequests({
+			connection,
+			sourceId,
+			includeDrafts: false,
+			cursor: String(page)
+		});
+		await ingestPolledEvents(pullRequests.map((pr) => listedPullRequestEvent(project, listedPullRequestOf(pr))), args.ingestFactoryEvent);
+		if (nextCursor === null) break;
+	}
+}
+/**
+* Build the GitHub routes as Mastra `apiRoutes`. When the feature is disabled,
+* returns only the `status` route so the SPA can detect the disabled state.
+*/
+function buildGithubRoutes(options) {
+	const routes = [];
+	const { auth, sandbox, users, storage, github, stateSigner, controller, memorySettings, emitAudit, sessionRetirement, workItems } = options;
+	const diagnostics = () => getGithubFeatureDiagnostics({
+		github,
+		auth,
+		appDbConfigured: storage !== void 0,
+		stateSigner,
+		sandbox
+	});
+	routes.push(registerApiRoute("/web/github/status", {
+		method: "GET",
+		requiresAuth: false,
+		handler: async (c) => {
+			if (!isGithubFeatureEnabled({
+				github,
+				auth
+			}) || !github || !stateSigner) return c.json({
+				enabled: false,
+				connected: false,
+				installations: [],
+				reason: "missing_config",
+				diagnostics: diagnostics()
+			});
+			await auth.ensureUser(loose(c));
+			const tenant = auth.tenant(loose(c));
+			if (!tenant) return c.json({
+				error: "unauthorized",
+				reason: "auth_required"
+			}, 401);
+			if (!tenant.orgId) return c.json({
+				enabled: true,
+				sandboxEnabled: !!sandbox,
+				organizationRequired: true,
+				connected: false,
+				installations: [],
+				reason: "organization_required",
+				diagnostics: diagnostics()
+			});
+			const rows = options.github ? await options.github.sourceControlStorage.installations.list({ orgId: tenant.orgId }) : [];
+			const connected = rows.length > 0;
+			return c.json({
+				enabled: true,
+				sandboxEnabled: !!sandbox,
+				connected,
+				installations: rows.map((r) => ({
+					installationId: Number(r.externalId),
+					accountLogin: r.accountName,
+					accountType: r.accountType
+				})),
+				reason: connected ? "ready" : "not_connected",
+				diagnostics: diagnostics()
+			});
+		}
+	}));
+	if (!isGithubFeatureEnabled({
+		github,
+		auth
+	}) || !github || !stateSigner) return routes;
+	const signState = (orgId, userId) => stateSigner.sign(orgId, userId);
+	const verifyState = (state) => stateSigner.verify(state);
+	routes.push(registerApiRoute("/web/github/subscriptions", {
+		method: "GET",
+		handler: async (c) => {
+			await auth.ensureUser(loose(c));
+			const tenant = auth.tenant(loose(c));
+			if (!tenant?.orgId) return c.json({ error: "unauthorized" }, 401);
+			const resourceId = c.req.query("resourceId");
+			const threadId = c.req.query("threadId");
+			const sessionScope = c.req.query("scope");
+			if (!resourceId || !threadId) return c.json({ error: "resourceId and threadId are required" }, 400);
+			const subscriptions = await listPullRequestSubscriptionsForThread({
+				orgId: tenant.orgId,
+				resourceId,
+				threadId,
+				sessionScope
+			}, github.integrationStorage);
+			return c.json({ subscriptions: subscriptions.map((subscription) => ({
+				id: subscription.id,
+				repoFullName: subscription.data.repositorySlug,
+				pullRequestNumber: Number(subscription.data.changeRequestId),
+				status: subscription.status,
+				url: `https://github.com/${subscription.data.repositorySlug}/pull/${subscription.data.changeRequestId}`
+			})) });
+		}
+	}), registerApiRoute("/web/github/webhook", {
+		method: "POST",
+		requiresAuth: false,
+		handler: async (c) => {
+			const result = await handleGithubWebhook(loose(c), {
+				github,
+				ingestFactoryEvent: options.ingestFactoryEvent,
+				...options.controller ? {
+					controller: options.controller,
+					onTargetError: (subscription, error) => {
+						console.warn(`[GitHub Webhook] Delivery failed for subscription ${subscription.id} (${subscription.resourceId}/${subscription.threadId}).`, error);
+					}
+				} : {}
+			});
+			return c.json(result.body, result.status);
+		}
+	}));
+	const redirectUri = options.redirectUri ?? `${(options.baseUrl ?? "").replace(/\/$/, "")}/auth/github/callback`;
+	routes.push(registerApiRoute("/auth/github/connect", {
+		method: "GET",
+		requiresAuth: false,
+		handler: async (c) => {
+			const resolved = await resolveOrgTenant(loose(c), auth);
+			if ("response" in resolved) return resolved.response;
+			const state = signState(resolved.tenant.orgId, resolved.tenant.userId);
+			if (c.req.query("manage")) return c.redirect(github.buildInstallUrl(state));
+			return c.redirect(github.buildOAuthIdentifyUrl(state, redirectUri));
+		}
+	}));
+	routes.push(registerApiRoute("/auth/github/callback", {
+		method: "GET",
+		requiresAuth: false,
+		handler: async (c) => {
+			const resolved = await resolveOrgTenant(loose(c), auth);
+			if ("response" in resolved) return resolved.response;
+			const { orgId, userId } = resolved.tenant;
+			const state = c.req.query("state");
+			if (!state) return c.redirect(github.buildOAuthIdentifyUrl(signState(orgId, userId), redirectUri));
+			const stateTenant = verifyState(state);
+			if (!stateTenant || stateTenant.userId !== userId || stateTenant.orgId !== orgId) {
+				console.warn("[GitHub] Install callback rejected: state/tenant mismatch.", JSON.stringify({
+					stateValid: Boolean(stateTenant),
+					stateOrgId: stateTenant?.orgId,
+					stateUserId: stateTenant?.userId,
+					sessionOrgId: orgId,
+					sessionUserId: userId
+				}));
+				return c.redirect("/?github=error");
+			}
+			const code = c.req.query("code");
+			if (!code) return c.redirect(github.buildOAuthIdentifyUrl(signState(orgId, userId), redirectUri));
+			try {
+				const userToken = await github.exchangeOAuthCode(code, redirectUri);
+				const installations = await github.listUserInstallations(userToken);
+				if (installations.length === 0) return c.redirect(github.buildInstallUrl(signState(orgId, userId)));
+				for (const inst of installations) await github.sourceControlStorage.installations.upsert({
+					orgId,
+					connectedByUserId: userId,
+					externalId: inst.installationId.toString(),
+					accountName: inst.accountLogin,
+					accountType: inst.accountType
+				});
+			} catch (error) {
+				console.warn(`[GitHub] Install callback failed to persist installations for org ${orgId} / user ${userId}.`, error);
+				return c.redirect("/?github=error");
+			}
+			return c.redirect("/?github=connected");
+		}
+	}));
+	routes.push(registerApiRoute("/web/github/repos", {
+		method: "GET",
+		requiresAuth: false,
+		handler: async (c) => {
+			const resolved = await resolveOrgTenant(loose(c), auth);
+			if ("response" in resolved) return resolved.response;
+			const orgId = resolved.tenant.orgId;
+			const installs = await github.sourceControlStorage.installations.list({ orgId });
+			const query = (c.req.query("q") ?? "").toLowerCase();
+			const fresh = c.req.query("refresh") === "1";
+			const listed = await Promise.all(installs.map(async (inst) => {
+				try {
+					return {
+						inst,
+						list: await github.listInstallationRepos(Number(inst.externalId), { fresh })
+					};
+				} catch (err) {
+					if (err.status === 403) {
+						console.warn(`[Mastra Factory] skipping GitHub installation ${inst.externalId} (${inst.accountName}): ${err.message}`);
+						return {
+							inst,
+							list: []
+						};
+					}
+					if (err.status !== 404) throw err;
+					console.error(`[Mastra Factory] pruning stale GitHub installation ${inst.externalId} (404 from GitHub)`);
+					await github.sourceControlStorage.installations.delete({
+						orgId,
+						id: inst.id
+					});
+					return {
+						inst,
+						list: []
+					};
+				}
+			}));
+			const matches = [];
+			const seenRepositoryIds = /* @__PURE__ */ new Set();
+			for (const { inst, list } of listed) for (const repo of list) {
+				if (query && !repo.fullName.toLowerCase().includes(query)) continue;
+				if (seenRepositoryIds.has(repo.id)) continue;
+				seenRepositoryIds.add(repo.id);
+				matches.push({
+					inst,
+					repo
+				});
+			}
+			const repos = matches.map(({ inst, repo }) => ({
+				...repo,
+				installationStorageId: inst.id,
+				sandboxProvider: sandbox ? "custom" : "none",
+				sandboxWorkdir: `~/${sanitizeSegment(repo.fullName.split("/", 2)[1] || "repo")}`
+			}));
+			return c.json({ repos });
+		}
+	}));
+	routes.push(registerApiRoute("/web/github/projects/:id/issues", {
+		method: "GET",
+		requiresAuth: false,
+		handler: async (c) => {
+			const loaded = await loadOrgProject({
+				github,
+				auth,
+				c: loose(c)
+			});
+			if ("response" in loaded) return loaded.response;
+			const page = parseListPage(c.req.query("page"));
+			if (page === null) return c.json({ error: "invalid_page" }, 400);
+			const label = parseIssueLabelFilter(c.req.query("label"));
+			if (label === null) return c.json({ error: "invalid_label" }, 400);
+			try {
+				const { issues, nextCursor } = await github.intake.listIssues({
+					connection: {
+						type: "app-installation",
+						installationId: Number(loaded.project.installation.externalId)
+					},
+					sourceIds: [loaded.project.repository.slug],
+					labels: label ? [label] : void 0,
+					cursor: String(page)
+				});
+				const responseIssues = issues.map((issue) => ({
+					repositoryId: Number(loaded.project.repository.externalId),
+					number: Number(issue.id),
+					title: issue.title,
+					url: issue.url,
+					author: issue.author,
+					assignee: issue.assignee,
+					assignees: issue.assignees,
+					labels: issue.labels,
+					comments: issue.commentCount ?? 0,
+					createdAt: issue.createdAt,
+					updatedAt: issue.updatedAt
+				}));
+				await ingestPolledEvents(responseIssues.map((issue) => polledIssueEvent(loaded.project, issue)), options.ingestFactoryEvent);
+				return c.json({
+					issues: responseIssues,
+					nextPage: nextCursor === null ? null : Number(nextCursor)
+				});
+			} catch (err) {
+				return c.json({
+					error: "github_fetch_failed",
+					message: err instanceof Error ? err.message : String(err)
+				}, 502);
+			}
+		}
+	}));
+	routes.push(registerApiRoute("/web/github/projects/:id/issues/:number", {
+		method: "GET",
+		requiresAuth: false,
+		handler: async (c) => {
+			const loaded = await loadOrgProject({
+				github,
+				auth,
+				c: loose(c)
+			});
+			if ("response" in loaded) return loaded.response;
+			const number = parseResourceNumber(c.req.param("number"));
+			if (number === null) return c.json({ error: "invalid_number" }, 400);
+			try {
+				const detail = await github.intake.getIssue({
+					connection: {
+						type: "app-installation",
+						installationId: Number(loaded.project.installation.externalId)
+					},
+					sourceId: loaded.project.repository.slug,
+					issueId: String(number)
+				});
+				if (detail === null) return c.json({ error: "issue_not_found" }, 404);
+				return c.json({
+					number: Number(detail.id),
+					title: detail.title,
+					url: detail.url,
+					author: detail.author,
+					assignee: detail.assignee,
+					labels: detail.labels,
+					comments: detail.commentCount ?? 0,
+					createdAt: detail.createdAt,
+					updatedAt: detail.updatedAt,
+					description: detail.description
+				});
+			} catch (err) {
+				return c.json({
+					error: "github_fetch_failed",
+					message: err instanceof Error ? err.message : String(err)
+				}, 502);
+			}
+		}
+	}));
+	routes.push(registerApiRoute("/web/github/projects/:id/prs", {
+		method: "GET",
+		requiresAuth: false,
+		handler: async (c) => {
+			const loaded = await loadOrgProject({
+				github,
+				auth,
+				c: loose(c)
+			});
+			if ("response" in loaded) return loaded.response;
+			const page = parseListPage(c.req.query("page"));
+			if (page === null) return c.json({ error: "invalid_page" }, 400);
+			try {
+				const { pullRequests, nextCursor } = await github.versionControl.listPullRequests({
+					connection: {
+						type: "app-installation",
+						installationId: Number(loaded.project.installation.externalId)
+					},
+					sourceId: loaded.project.repository.slug,
+					includeDrafts: false,
+					cursor: String(page)
+				});
+				const responsePullRequests = pullRequests.map((pr) => ({
+					repositoryId: Number(loaded.project.repository.externalId),
+					number: Number(pr.id),
+					title: pr.title,
+					url: pr.url,
+					author: pr.author,
+					assignees: pr.assignees ?? [],
+					requestedReviewers: pr.requestedReviewers ?? [],
+					labels: pr.labels ?? [],
+					baseBranch: pr.baseBranch,
+					headBranch: pr.headBranch,
+					createdAt: pr.createdAt,
+					updatedAt: pr.updatedAt
+				}));
+				await ingestPolledEvents(responsePullRequests.map((pullRequest) => listedPullRequestEvent(loaded.project, pullRequest)), options.ingestFactoryEvent);
+				return c.json({
+					pullRequests: responsePullRequests,
+					nextPage: nextCursor === null ? null : Number(nextCursor)
+				});
+			} catch (err) {
+				return c.json({
+					error: "github_fetch_failed",
+					message: err instanceof Error ? err.message : String(err)
+				}, 502);
+			}
+		}
+	}));
+	routes.push(registerApiRoute("/web/github/projects/:id/prs/:number", {
+		method: "GET",
+		requiresAuth: false,
+		handler: async (c) => {
+			const loaded = await loadOrgProject({
+				github,
+				auth,
+				c: loose(c)
+			});
+			if ("response" in loaded) return loaded.response;
+			const number = parseResourceNumber(c.req.param("number"));
+			if (number === null) return c.json({ error: "invalid_number" }, 400);
+			try {
+				const pr = await github.versionControl.getPullRequest({
+					connection: {
+						type: "app-installation",
+						installationId: Number(loaded.project.installation.externalId)
+					},
+					sourceId: loaded.project.repository.slug,
+					pullRequestId: String(number)
+				});
+				if (pr === null) return c.json({ error: "pull_request_not_found" }, 404);
+				return c.json({
+					number: Number(pr.id),
+					title: pr.title,
+					url: pr.url,
+					author: pr.author,
+					assignees: pr.assignees ?? [],
+					requestedReviewers: pr.requestedReviewers ?? [],
+					baseBranch: pr.baseBranch,
+					headBranch: pr.headBranch,
+					createdAt: pr.createdAt,
+					updatedAt: pr.updatedAt,
+					description: pr.body
+				});
+			} catch (err) {
+				return c.json({
+					error: "github_fetch_failed",
+					message: err instanceof Error ? err.message : String(err)
+				}, 502);
+			}
+		}
+	}));
+	routes.push(registerApiRoute("/web/github/projects/:id/settings", {
+		method: "GET",
+		requiresAuth: false,
+		handler: async (c) => {
+			const loaded = await loadOrgProject({
+				github,
+				auth,
+				c: loose(c)
+			});
+			if ("response" in loaded) return loaded.response;
+			return c.json({
+				setupCommand: loaded.project.setupCommand,
+				teardownCommand: loaded.project.teardownCommand
+			});
+		}
+	}));
+	routes.push(registerApiRoute("/web/github/projects/:id/settings", {
+		method: "POST",
+		requiresAuth: false,
+		handler: async (c) => {
+			const loaded = await loadOrgProject({
+				github,
+				auth,
+				c: loose(c)
+			});
+			if ("response" in loaded) return loaded.response;
+			let body;
+			try {
+				body = await c.req.json();
+			} catch {
+				return c.json({ error: "Invalid JSON body" }, 400);
+			}
+			for (const command of ["setupCommand", "teardownCommand"]) {
+				const value = body[command];
+				if (value === void 0) continue;
+				if (value !== null && typeof value !== "string") return c.json({ error: `Invalid ${command}` }, 400);
+				if (typeof value === "string" && value.length > 2e3) return c.json({ error: `${command} too long (max 2000 characters)` }, 400);
+				if (typeof value === "string" && /[\0-\x08\x0b\x0c\x0e-\x1f\x7f]/.test(value)) return c.json({ error: `${command} contains control characters` }, 400);
+			}
+			const normalizeCommand = (value) => {
+				if (value === void 0) return void 0;
+				return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
+			};
+			const setupCommand = normalizeCommand(body.setupCommand);
+			const teardownCommand = normalizeCommand(body.teardownCommand);
+			await github.sourceControlStorage.projectRepositories.update({
+				orgId: loaded.project.installation.orgId,
+				id: loaded.project.id,
+				input: {
+					...setupCommand !== void 0 ? { setupCommand } : {},
+					...teardownCommand !== void 0 ? { teardownCommand } : {}
+				}
+			});
+			return c.json({
+				setupCommand: setupCommand === void 0 ? loaded.project.setupCommand : setupCommand,
+				teardownCommand: teardownCommand === void 0 ? loaded.project.teardownCommand : teardownCommand
+			});
+		}
+	}));
+	const parsePatKind = (value) => {
+		if (value === void 0 || value === null || value === "default") return "default";
+		if (value === "reviewer") return "reviewer";
+		return null;
+	};
+	routes.push(registerApiRoute("/web/github/pat", {
+		method: "GET",
+		requiresAuth: false,
+		handler: async (c) => {
+			const resolved = await resolveOrgTenant(loose(c), auth);
+			if ("response" in resolved) return resolved.response;
+			return c.json(await getGithubPatStatus(() => github.integrationStorage, resolved.tenant.orgId));
+		}
+	}), registerApiRoute("/web/github/pat", {
+		method: "POST",
+		requiresAuth: false,
+		handler: async (c) => {
+			const resolved = await resolveOrgTenant(loose(c), auth);
+			if ("response" in resolved) return resolved.response;
+			let body;
+			try {
+				body = await c.req.json();
+			} catch {
+				return c.json({ error: "Invalid JSON body" }, 400);
+			}
+			const kind = parsePatKind(body.kind);
+			if (!kind) return c.json({ error: "kind must be 'default' or 'reviewer'" }, 400);
+			const token = typeof body.token === "string" ? body.token.trim() : "";
+			if (!token) return c.json({ error: "A token is required" }, 400);
+			if (token.length > 500) return c.json({ error: "Token too long (max 500 characters)" }, 400);
+			if (/\s/.test(token)) return c.json({ error: "Token must not contain whitespace" }, 400);
+			await setGithubPat(github.integrationStorage, resolved.tenant.orgId, token, kind);
+			return c.json(await getGithubPatStatus(() => github.integrationStorage, resolved.tenant.orgId));
+		}
+	}), registerApiRoute("/web/github/pat", {
+		method: "DELETE",
+		requiresAuth: false,
+		handler: async (c) => {
+			const resolved = await resolveOrgTenant(loose(c), auth);
+			if ("response" in resolved) return resolved.response;
+			const kind = parsePatKind(c.req.query("kind"));
+			if (!kind) return c.json({ error: "kind must be 'default' or 'reviewer'" }, 400);
+			await clearGithubPat(github.integrationStorage, resolved.tenant.orgId, kind);
+			return c.json(await getGithubPatStatus(() => github.integrationStorage, resolved.tenant.orgId));
+		}
+	}));
+	routes.push(...buildProjectGitRoutes({
+		github,
+		auth,
+		sandbox,
+		users,
+		controller,
+		memorySettings,
+		emitAudit,
+		sessionRetirement,
+		workItems
+	}));
+	return routes;
+}
+/**
+* Load the org-owned project for a read-only GitHub API route. Unlike
+* `loadOwnedProject`, this never touches sandbox state — the issues/PR list
+* routes only need the repo + installation, so they work before a sandbox is
+* ever provisioned.
+*/
+async function loadOrgProject(options) {
+	const { github, auth, c } = options;
+	const resolved = await resolveOrgTenant(c, auth);
+	if ("response" in resolved) return { response: resolved.response };
+	const { orgId, userId } = resolved.tenant;
+	const projectRepositoryId = c.req.param("id");
+	if (!projectRepositoryId) return { response: c.json({ error: "Project repository not found" }, 404) };
+	const project = await resolveProjectRepository({
+		github,
+		orgId,
+		projectRepositoryId
+	});
+	if (!project) return { response: c.json({ error: "Project repository not found" }, 404) };
+	return {
+		project,
+		orgId,
+		userId
+	};
+}
+/** Derive a commit/author identity from the authenticated host user. */
+function identityFromUser(user) {
+	const u = user;
+	return {
+		name: u?.name ?? null,
+		email: u?.email ?? null
+	};
+}
+/** Map a sandbox/setup-command error to an actionable HTTP response. */
+function gitErrorResponse(c, err) {
+	if (err instanceof SetupCommandError) return c.json({
+		error: err.code,
+		message: err.message
+	}, 502);
+	if (err instanceof MaterializeError) return c.json({
+		error: err.code,
+		message: err.message
+	}, 502);
+	return c.json({
+		error: "git_failed",
+		message: err instanceof Error ? err.message : String(err)
+	}, 500);
+}
+/**
+* Load the org-owned project for a git route. Centralizes the auth +
+* org/ownership checks every git route shares: the project is scoped by
+* `(id, orgId)`. Returns the tenant and project, or a ready-to-return error
+* response.
+*/
+async function loadOwnedProject(options) {
+	const { github, auth, sandbox, c } = options;
+	const resolved = await resolveOrgTenant(c, auth);
+	if ("response" in resolved) return { response: resolved.response };
+	const { orgId, userId } = resolved.tenant;
+	if (!sandbox) return { response: c.json({
+		error: "sandbox_not_configured",
+		message: "No sandbox provider is configured."
+	}, 503) };
+	const projectRepositoryId = c.req.param("id");
+	if (!projectRepositoryId) return { response: c.json({ error: "Project repository not found" }, 404) };
+	const project = await resolveProjectRepository({
+		github,
+		orgId,
+		projectRepositoryId
+	});
+	if (!project) return { response: c.json({ error: "Project repository not found" }, 404) };
+	return {
+		orgId,
+		userId,
+		project
+	};
+}
+/**
+* One naming per session at a time: a second caller joins the run already in
+* flight instead of paying for another model call and racing its rename.
+*/
+function createSessionNaming() {
+	const inFlight = /* @__PURE__ */ new Map();
+	return (sessionId, run) => {
+		const pending = inFlight.get(sessionId);
+		if (pending) return pending;
+		const started = run().finally(() => inFlight.delete(sessionId));
+		inFlight.set(sessionId, started);
+		return started;
+	};
+}
+/**
+* Name a thread with a stored model id. Resolution has to go through
+* mastracode's gateway: a bare id handed to core's model router looks for a
+* process env key instead of the caller's stored provider credentials.
+*/
+function titleModel(modelId) {
+	return ({ requestContext }) => resolveModel(modelId, {
+		remapForCodexOAuth: true,
+		requestContext
+	});
+}
+/** A screenful of history; GitHub caps its own page at 100. */
+const DEFAULT_COMMIT_PAGE = 20;
+const MAX_COMMIT_PAGE = 100;
+const MAX_SESSION_OWNER_PROFILES = 100;
+const MAX_SESSION_OWNER_PROFILE_CACHE_ENTRIES = 500;
+const SESSION_OWNER_PROFILE_TTL_MS = 5 * 6e4;
+function createSessionOwnerProfileResolver(users) {
+	const cache = /* @__PURE__ */ new Map();
+	const cacheProfile = (userId, profile, expiresAt) => {
+		cache.delete(userId);
+		cache.set(userId, {
+			profile,
+			expiresAt
+		});
+		if (cache.size > MAX_SESSION_OWNER_PROFILE_CACHE_ENTRIES) {
+			const oldestUserId = cache.keys().next().value;
+			if (oldestUserId !== void 0) cache.delete(oldestUserId);
+		}
+	};
+	return async (userIds) => {
+		if (!users) return /* @__PURE__ */ new Map();
+		const requestedUserIds = [...new Set(userIds)].slice(0, MAX_SESSION_OWNER_PROFILES);
+		const profiles = /* @__PURE__ */ new Map();
+		const unresolvedUserIds = [];
+		const now = Date.now();
+		for (const userId of requestedUserIds) {
+			const cached = cache.get(userId);
+			if (!cached || cached.expiresAt <= now) {
+				cache.delete(userId);
+				unresolvedUserIds.push(userId);
+			} else if (cached.profile) profiles.set(userId, cached.profile);
+		}
+		if (unresolvedUserIds.length === 0) return profiles;
+		let resolvedUsers;
+		if (users.getUsers) try {
+			resolvedUsers = await users.getUsers(unresolvedUserIds);
+		} catch (error) {
+			console.warn("[GitHub Sessions] Bulk session owner profile lookup failed; falling back to individual lookups", { error: error instanceof Error ? error.message : String(error) });
+			resolvedUsers = (await Promise.allSettled(unresolvedUserIds.map((userId) => users.getUser(userId)))).filter((result) => result.status === "fulfilled").map((result) => result.value);
+		}
+		else resolvedUsers = (await Promise.allSettled(unresolvedUserIds.map((userId) => users.getUser(userId)))).filter((result) => result.status === "fulfilled").map((result) => result.value);
+		for (const user of resolvedUsers) {
+			if (!user) continue;
+			const name = user.name?.trim() || user.email?.trim();
+			if (!name) continue;
+			profiles.set(user.id, {
+				id: user.id,
+				name,
+				...user.avatarUrl ? { avatarUrl: user.avatarUrl } : {}
+			});
+		}
+		const expiresAt = now + SESSION_OWNER_PROFILE_TTL_MS;
+		for (const userId of unresolvedUserIds) cacheProfile(userId, profiles.get(userId), expiresAt);
+		return profiles;
+	};
+}
+function buildProjectGitRoutes({ github, auth, sandbox, users, controller, memorySettings, emitAudit, sessionRetirement, workItems }) {
+	const nameSession = createSessionNaming();
+	const resolveSessionOwnerProfiles = createSessionOwnerProfileResolver(users);
+	return [
+		registerApiRoute("/web/github/projects/:id/sessions", {
+			method: "GET",
+			requiresAuth: false,
+			handler: async (c) => {
+				const resolved = await resolveOrgTenant(loose(c), auth);
+				if ("response" in resolved) return resolved.response;
+				const { orgId, userId } = resolved.tenant;
+				const projectRepositoryId = c.req.param("id");
+				const project = projectRepositoryId ? await resolveProjectRepository({
+					github,
+					orgId,
+					projectRepositoryId
+				}) : null;
+				if (!project) return c.json({ error: "Project repository not found" }, 404);
+				const sessions = await github.sourceControlStorage.sessions.list({
+					projectRepositoryId: project.id,
+					viewerUserId: userId
+				});
+				const owners = await resolveSessionOwnerProfiles(sessions.map((session) => session.userId));
+				return c.json({ sessions: sessions.map((session) => {
+					const owner = owners.get(session.userId);
+					return {
+						...session,
+						...owner ? { owner } : {}
+					};
+				}) });
+			}
+		}),
+		registerApiRoute("/web/github/projects/:id/sessions", {
+			method: "POST",
+			requiresAuth: false,
+			handler: async (c) => {
+				const resolved = await resolveOrgTenant(loose(c), auth);
+				if ("response" in resolved) return resolved.response;
+				const { orgId, userId } = resolved.tenant;
+				const projectRepositoryId = c.req.param("id");
+				const project = projectRepositoryId ? await resolveProjectRepository({
+					github,
+					orgId,
+					projectRepositoryId
+				}) : null;
+				if (!project) return c.json({ error: "Project repository not found" }, 404);
+				let body;
+				try {
+					body = await c.req.json();
+				} catch {
+					return c.json({ error: "Invalid JSON body" }, 400);
+				}
+				if (!isJsonObject(body)) return c.json({ error: "Invalid JSON body" }, 400);
+				const requestedBaseBranch = body.baseBranch;
+				if (requestedBaseBranch !== void 0 && typeof requestedBaseBranch !== "string") return c.json({ error: "Invalid baseBranch" }, 400);
+				const baseBranch = requestedBaseBranch ?? project.defaultBranch;
+				if (!isValidGitRef(baseBranch)) return c.json({ error: "Invalid baseBranch" }, 400);
+				const requestedSessionId = body.sessionId;
+				if (requestedSessionId !== void 0 && (typeof requestedSessionId !== "string" || !UUID_PATTERN.test(requestedSessionId))) return c.json({ error: "Invalid sessionId" }, 400);
+				const sessionId = requestedSessionId ?? globalThis.crypto.randomUUID();
+				const requestedTitle = body.title;
+				if (requestedTitle !== void 0 && typeof requestedTitle !== "string") return c.json({ error: "Invalid title" }, 400);
+				const normalizedTitle = requestedTitle === void 0 ? null : normalizeSessionTitle(requestedTitle);
+				const requestedBranch = body.branch;
+				let branch;
+				if (requestedBranch === void 0) branch = `${USER_SESSION_BRANCH_PREFIX}${sessionId}`;
+				else if (typeof requestedBranch === "string" && isValidGitRef(requestedBranch)) branch = requestedBranch;
+				else return c.json({ error: "Invalid branch" }, 400);
+				if (requestedSessionId !== void 0) {
+					const existing = await github.sourceControlStorage.sessions.getBySessionId(sessionId);
+					if (existing) {
+						if (existing.projectRepositoryId !== project.id || existing.orgId !== orgId || existing.userId !== userId || existing.branch !== branch) return c.json({ error: "Session ID conflict" }, 409);
+						return c.json({ session: existing });
+					}
+				}
+				const session = await github.sourceControlStorage.sessions.create({
+					sessionId,
+					projectRepositoryId: project.id,
+					factoryProjectId: project.factoryProjectId,
+					orgId,
+					userId,
+					branch,
+					baseBranch,
+					title: normalizedTitle,
+					visibility: "org"
+				}).catch(async (error) => {
+					if (!(error instanceof UniqueViolationError) || requestedSessionId === void 0) throw error;
+					const conflict = await github.sourceControlStorage.sessions.getBySessionId(sessionId);
+					if (!conflict) throw error;
+					return conflict;
+				});
+				if (requestedSessionId !== void 0 && (session.sessionId !== sessionId || session.projectRepositoryId !== project.id || session.orgId !== orgId || session.userId !== userId || session.branch !== branch)) return c.json({ error: "Session ID conflict" }, 409);
+				return c.json({ session });
+			}
+		}),
+		registerApiRoute("/web/user-sessions/:sessionId", {
+			method: "GET",
+			requiresAuth: false,
+			handler: async (c) => {
+				const resolved = await resolveOrgTenant(loose(c), auth);
+				if ("response" in resolved) return resolved.response;
+				const session = await github.sourceControlStorage.sessions.getBySessionId(c.req.param("sessionId"));
+				if (!session || session.orgId !== resolved.tenant.orgId || session.visibility === "private" && session.userId !== resolved.tenant.userId) return c.json({ error: "Session not found" }, 404);
+				return c.json({ session });
+			}
+		}),
+		registerApiRoute("/web/user-sessions/:sessionId", {
+			method: "DELETE",
+			requiresAuth: false,
+			handler: async (c) => {
+				const resolved = await resolveOrgTenant(loose(c), auth);
+				if ("response" in resolved) return resolved.response;
+				const session = await github.sourceControlStorage.sessions.getBySessionId(c.req.param("sessionId"));
+				if (!session || session.orgId !== resolved.tenant.orgId || session.userId !== resolved.tenant.userId) return c.json({ error: "Session not found" }, 404);
+				try {
+					await waitForPendingFilesystemCapture(session.sessionId).catch((error) => {
+						console.warn("[GitHub Sessions] Failed to drain filesystem capture before delete", {
+							sessionId: session.sessionId,
+							error
+						});
+					});
+					await controller?.deleteSession({ resourceId: session.sessionId });
+				} catch (error) {
+					console.error("[GitHub Sessions] Failed to tear down live controller session", {
+						sessionId: session.sessionId,
+						error
+					});
+				}
+				if (sessionRetirement) await sessionRetirement.retireSession({
+					sourceControl: github.sourceControlStorage,
+					...workItems ? { workItems } : {},
+					orgId: session.orgId,
+					sessionId: session.sessionId,
+					deleteSession: true
+				});
+				else {
+					await workItems?.clearSessionReferences({
+						orgId: session.orgId,
+						sessionId: session.sessionId
+					});
+					await github.sourceControlStorage.sessions.delete(session.id);
+					reclaimDeletedSessionSandbox({ session }).catch((error) => {
+						console.error("[GitHub Sessions] Failed to reclaim sandbox for deleted session", {
+							sessionId: session.sessionId,
+							sandboxId: session.sandboxId,
+							error
+						});
+					});
+				}
+				return c.json({ removed: true });
+			}
+		}),
+		registerApiRoute("/web/user-sessions/:sessionId/title", {
+			method: "POST",
+			requiresAuth: false,
+			handler: async (c) => {
+				const resolved = await resolveOrgTenant(loose(c), auth);
+				if ("response" in resolved) return resolved.response;
+				const sessionId = c.req.param("sessionId");
+				const row = await github.sourceControlStorage.sessions.getBySessionId(sessionId);
+				if (!row || row.orgId !== resolved.tenant.orgId || row.userId !== resolved.tenant.userId) return c.json({ error: "Session not found" }, 404);
+				if (!controller) return c.json({ error: "Sessions are not available on this server." }, 503);
+				const thread = (await controller.queryThreads({ resourceId: sessionId })).sort((a, b) => b.updatedAt.getTime() - a.updatedAt.getTime())[0];
+				if (!thread) return c.json({ error: "This session has no conversation to name yet." }, 409);
+				const stored = await memorySettings.get({
+					orgId: row.orgId,
+					userId: row.userId
+				});
+				const requestContext = new RequestContext();
+				requestContext.set("user", {
+					workosId: row.userId,
+					organizationId: row.orgId
+				});
+				requestContext.set("mastra__factoryMemorySettings", stored);
+				try {
+					const title = await nameSession(sessionId, async () => {
+						const generated = await controller.generateThreadTitle({
+							threadId: thread.id,
+							resourceId: sessionId,
+							requestContext,
+							...stored?.observerModelId ? { model: titleModel(stored.observerModelId) } : {}
+						});
+						const named = generated ? normalizeSessionTitle(generated) : null;
+						if (named) await github.sourceControlStorage.sessions.rename({
+							sessionId,
+							title: named
+						});
+						return named;
+					});
+					if (!title) return c.json({ error: "The model returned an empty title. Try again." }, 502);
+					return c.json({ title });
+				} catch (error) {
+					return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+				}
+			}
+		}),
+		registerApiRoute("/web/github/projects/:id/commit", {
+			method: "POST",
+			requiresAuth: false,
+			handler: async (c) => {
+				const owned = await loadOwnedProject({
+					github,
+					auth,
+					sandbox,
+					c: loose(c)
+				});
+				if ("response" in owned) return owned.response;
+				const { userId, project } = owned;
+				let body;
+				try {
+					body = await c.req.json();
+				} catch {
+					return c.json({ error: "Invalid JSON body" }, 400);
+				}
+				if (typeof body.message !== "string" || body.message.trim().length === 0 || body.message.length > 5e3) return c.json({ error: "Invalid message" }, 400);
+				const sessionWorkspace = await resolveSessionWorkspace(github, project.id, userId, body.sessionId);
+				if (!sessionWorkspace) return c.json({ error: "Invalid sessionId" }, 400);
+				const { workdir, sandbox: sessionSandbox } = sessionWorkspace;
+				try {
+					return await withSessionOperationLock(sessionWorkspace.session.sessionId, async () => {
+						const result = await commitAll(sessionSandbox, workdir, body.message, identityFromUser(await auth.ensureUser(loose(c))));
+						if (result.committed) await emitAudit?.({
+							context: loose(c),
+							input: {
+								action: "factory.git.commit",
+								factoryProjectId: project.factoryProjectId,
+								projectRepositoryId: project.id,
+								targets: [{
+									type: "session",
+									id: sessionWorkspace.session.sessionId
+								}],
+								metadata: { sessionId: sessionWorkspace.session.sessionId }
+							}
+						});
+						return c.json({ committed: result.committed });
+					});
+				} catch (err) {
+					return gitErrorResponse(loose(c), err);
+				}
+			}
+		}),
+		registerApiRoute("/web/github/projects/:id/commits", {
+			method: "GET",
+			requiresAuth: false,
+			handler: async (c) => {
+				const loaded = await loadOrgProject({
+					github,
+					auth,
+					c: loose(c)
+				});
+				if ("response" in loaded) return loaded.response;
+				const { orgId, project } = loaded;
+				const branch = c.req.query("branch") ?? project.defaultBranch;
+				if (!isValidGitRef(branch)) return c.json({ error: "Invalid branch" }, 400);
+				const limit = Math.min(Math.max(Math.floor(Number(c.req.query("limit") ?? DEFAULT_COMMIT_PAGE)) || DEFAULT_COMMIT_PAGE, 1), MAX_COMMIT_PAGE);
+				try {
+					const commits = await listRepositoryCommits(github, {
+						orgId,
+						project,
+						branch,
+						limit
+					});
+					return c.json({
+						commits,
+						branch
+					});
+				} catch (err) {
+					return gitErrorResponse(loose(c), err);
+				}
+			}
+		}),
+		registerApiRoute("/web/github/projects/:id/push", {
+			method: "POST",
+			requiresAuth: false,
+			handler: async (c) => {
+				const owned = await loadOwnedProject({
+					github,
+					auth,
+					sandbox,
+					c: loose(c)
+				});
+				if ("response" in owned) return owned.response;
+				const { orgId, userId, project } = owned;
+				let body;
+				try {
+					body = await c.req.json();
+				} catch {
+					return c.json({ error: "Invalid JSON body" }, 400);
+				}
+				if (!isValidGitRef(body.branch)) return c.json({ error: "Invalid branch" }, 400);
+				const branch = body.branch;
+				const sessionWorkspace = await resolveSessionWorkspace(github, project.id, userId, body.sessionId);
+				if (!sessionWorkspace) return c.json({ error: "Invalid sessionId" }, 400);
+				const { workdir, sandbox: sessionSandbox } = sessionWorkspace;
+				try {
+					return await withSessionOperationLock(sessionWorkspace.session.sessionId, async () => {
+						const access = await github.versionControl.getRepositoryAccess({
+							orgId,
+							repositoryId: project.repository.id
+						});
+						if (!access.authorization) throw new Error("Repository access did not include a bearer token.");
+						await pushBranch(sessionSandbox, workdir, branch, access.authorization.token, project.repository.slug);
+						await emitAudit?.({
+							context: loose(c),
+							input: {
+								action: "factory.git.push",
+								factoryProjectId: project.factoryProjectId,
+								projectRepositoryId: project.id,
+								targets: [{
+									type: "branch",
+									id: branch
+								}],
+								metadata: {
+									branch,
+									sessionId: sessionWorkspace.session.sessionId
+								}
+							}
+						});
+						return c.json({
+							pushed: true,
+							branch
+						});
+					});
+				} catch (err) {
+					return gitErrorResponse(loose(c), err);
+				}
+			}
+		}),
+		registerApiRoute("/web/github/projects/:id/pr", {
+			method: "POST",
+			requiresAuth: false,
+			handler: async (c) => {
+				const owned = await loadOwnedProject({
+					github,
+					auth,
+					sandbox,
+					c: loose(c)
+				});
+				if ("response" in owned) return owned.response;
+				const { orgId, userId, project } = owned;
+				let body;
+				try {
+					body = await c.req.json();
+				} catch {
+					return c.json({ error: "Invalid JSON body" }, 400);
+				}
+				if (!isValidGitRef(body.branch)) return c.json({ error: "Invalid branch" }, 400);
+				const base = body.base === void 0 ? project.defaultBranch : body.base;
+				if (!isValidGitRef(base)) return c.json({ error: "Invalid base" }, 400);
+				if (typeof body.title !== "string" || body.title.trim().length === 0 || body.title.length > 256) return c.json({ error: "Invalid title" }, 400);
+				if (body.body !== void 0 && (typeof body.body !== "string" || body.body.length > 65536)) return c.json({ error: "Invalid body" }, 400);
+				const head = body.branch;
+				const title = body.title;
+				const prBody = body.body;
+				const sessionWorkspace = await resolveSessionWorkspace(github, project.id, userId, body.sessionId);
+				if (!sessionWorkspace) return c.json({ error: "Invalid sessionId" }, 400);
+				try {
+					return await withSessionOperationLock(sessionWorkspace.session.sessionId, async () => {
+						const result = await github.versionControl.createPullRequest({
+							connection: {
+								type: "app-installation",
+								installationId: Number(project.installation.externalId)
+							},
+							sourceId: project.repository.slug,
+							baseBranch: base,
+							headBranch: head,
+							title,
+							body: prBody,
+							actingUserId: userId
+						});
+						await emitAudit?.({
+							context: loose(c),
+							input: {
+								action: "factory.git.pr_opened",
+								factoryProjectId: project.factoryProjectId,
+								projectRepositoryId: project.id,
+								targets: [{
+									type: "pull_request",
+									id: result.url,
+									name: title
+								}],
+								metadata: {
+									branch: head,
+									base,
+									url: result.url
+								}
+							}
+						});
+						const pullRequestNumber = pullRequestNumberFromUrl(result.url, project.repository.slug);
+						if (pullRequestNumber) {
+							const sessionId = sessionWorkspace.session.sessionId;
+							await subscribeToPullRequest({
+								orgId,
+								installationExternalId: project.installation.externalId,
+								projectRepositoryId: project.id,
+								repositoryExternalId: project.repository.externalId,
+								repositorySlug: project.repository.slug,
+								changeRequestId: pullRequestNumber.toString(),
+								sessionId,
+								ownerId: userId,
+								resourceId: sessionId,
+								threadId: sessionId,
+								source: "factory-pr-create",
+								subscribedByUserId: userId
+							}, github.integrationStorage).catch((error) => {
+								console.warn(`[GitHub] Pull request ${result.url} was created but automatic subscription failed.`, error);
+							});
+						}
+						return c.json({ url: result.url });
+					});
+				} catch (err) {
+					return c.json({
+						error: "github_pr_create_failed",
+						message: err instanceof Error ? err.message : String(err)
+					}, 502);
+				}
+			}
+		})
+	];
+}
+/** Resolve the materialized workspace owned by a Factory session. */
+async function resolveSessionWorkspace(github, projectId, userId, sessionId) {
+	if (typeof sessionId !== "string") return;
+	const session = await github.sourceControlStorage.sessions.getBySessionId(sessionId);
+	if (session?.projectRepositoryId !== projectId || session.userId !== userId) return;
+	const entry = peekSessionSandbox(session.id);
+	if (!entry?.workdir) return void 0;
+	return {
+		session,
+		workdir: entry.workdir,
+		sandbox: requireExec(entry.sandbox)
+	};
+}
+//#endregion
+export { buildGithubRoutes, ingestLinkedRepositoryBacklog };
+
+//# sourceMappingURL=routes.js.map