@mastra/factory 0.0.0-aggregate-trace-20261015182851

package/dist/routes/skills.js

@@ -0,0 +1,198 @@
+import { peekSessionSandbox } from "../sandbox/session-sandbox.js";
+import { Route } from "./route.js";
+import { listFactorySkills } from "../skills/catalog.js";
+import { SkillInvocationError, resolveSkillInvocation } from "../skills/service.js";
+import { registerApiRoute } from "@mastra/core/server";
+//#region src/routes/skills.ts
+const MAX_RESOURCE_ID_LENGTH = 512;
+const MAX_SCOPE_LENGTH = 2048;
+const MAX_ARGUMENTS_LENGTH = 16384;
+const SKILL_NAME_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+function loose(context) {
+	return context;
+}
+function parseBody(value) {
+	if (!value || typeof value !== "object") return void 0;
+	const input = value;
+	if (typeof input.resourceId !== "string" || input.resourceId.length === 0) return void 0;
+	if (input.resourceId.length > MAX_RESOURCE_ID_LENGTH) return void 0;
+	if (input.projectRepositoryId !== void 0 && (typeof input.projectRepositoryId !== "string" || !UUID_RE.test(input.projectRepositoryId))) return;
+	if (input.scope !== void 0 && (typeof input.scope !== "string" || input.scope.length > MAX_SCOPE_LENGTH)) return;
+	if (typeof input.name !== "string" || input.name.length > 64 || !SKILL_NAME_RE.test(input.name)) return void 0;
+	if (input.arguments !== void 0) {
+		if (typeof input.arguments !== "string" || input.arguments.length > MAX_ARGUMENTS_LENGTH) return void 0;
+	}
+	return {
+		resourceId: input.resourceId,
+		...input.projectRepositoryId ? { projectRepositoryId: input.projectRepositoryId } : {},
+		...input.scope ? { scope: input.scope } : {},
+		name: input.name,
+		...input.arguments !== void 0 ? { arguments: input.arguments } : {}
+	};
+}
+var SkillRoutes = class extends Route {
+	async #authorizeSessionAddress(context, address) {
+		const { auth, sourceControlStorage: storage, ensureSourceControlReady } = this.deps;
+		if (!auth.enabled()) return { allowed: true };
+		await auth.ensureUser(context);
+		const tenant = auth.tenant(context);
+		if (!tenant) return {
+			allowed: false,
+			status: 401,
+			code: "unauthorized",
+			message: "Authentication required."
+		};
+		if (address.resourceId === tenant.userId) return { allowed: true };
+		if (!UUID_RE.test(address.resourceId) || !address.projectRepositoryId || !UUID_RE.test(address.projectRepositoryId)) return {
+			allowed: false,
+			status: 400,
+			code: "invalid_request",
+			message: "Invalid skill invocation request."
+		};
+		if (!tenant.orgId || !address.scope) return {
+			allowed: false,
+			status: 403,
+			code: "session_forbidden",
+			message: "Session access denied."
+		};
+		if (!storage) return {
+			allowed: false,
+			status: 403,
+			code: "session_forbidden",
+			message: "Session access denied."
+		};
+		if (ensureSourceControlReady) try {
+			await ensureSourceControlReady();
+		} catch {
+			return {
+				allowed: false,
+				status: 403,
+				code: "session_forbidden",
+				message: "Session access denied."
+			};
+		}
+		const projectRepository = await storage.projectRepositories.get({
+			orgId: tenant.orgId,
+			id: address.projectRepositoryId
+		});
+		if (!projectRepository) return {
+			allowed: false,
+			status: 403,
+			code: "session_forbidden",
+			message: "Session access denied."
+		};
+		const connection = await storage.connections.get({
+			orgId: tenant.orgId,
+			id: projectRepository.connectionId
+		});
+		if (!connection || connection.factoryProjectId !== address.resourceId) return {
+			allowed: false,
+			status: 403,
+			code: "session_forbidden",
+			message: "Session access denied."
+		};
+		return (await storage.sessions.list({
+			projectRepositoryId: address.projectRepositoryId,
+			viewerUserId: tenant.userId
+		})).some((row) => {
+			const liveWorkdir = peekSessionSandbox(row.id)?.workdir;
+			return liveWorkdir !== void 0 && liveWorkdir === address.scope;
+		}) ? { allowed: true } : {
+			allowed: false,
+			status: 403,
+			code: "session_forbidden",
+			message: "Session access denied."
+		};
+	}
+	routes() {
+		const { controllerId, controller, authorizeSessionAddress: customAuthorize } = this.deps;
+		const authorize = customAuthorize ?? ((context, address) => this.#authorizeSessionAddress(context, address));
+		const handleSkillRequest = async (context, dispatch) => {
+			const c = loose(context);
+			if (c.req.param("controllerId") !== controllerId) return c.json({
+				error: "controller_not_found",
+				message: "Agent controller not found."
+			}, 404);
+			let rawBody;
+			try {
+				rawBody = await c.req.json();
+			} catch {
+				return c.json({
+					error: "invalid_request",
+					message: "Invalid JSON body."
+				}, 400);
+			}
+			const body = parseBody(rawBody);
+			if (!body) return c.json({
+				error: "invalid_request",
+				message: "Invalid skill invocation request."
+			}, 400);
+			const authorization = await authorize(c, {
+				resourceId: body.resourceId,
+				projectRepositoryId: body.projectRepositoryId,
+				scope: body.scope
+			});
+			if (!authorization.allowed) return c.json({
+				error: authorization.code,
+				message: authorization.message
+			}, authorization.status ?? 403);
+			try {
+				const resolved = await resolveSkillInvocation(controller, body);
+				if (dispatch) {
+					const requestContext = c.get("requestContext");
+					resolved.session.sendMessage({
+						content: resolved.message,
+						...requestContext ? { requestContext } : {}
+					}).catch((error) => {
+						console.error("Workspace skill dispatch failed after acceptance", error);
+					});
+				}
+				return c.json({
+					ok: true,
+					skill: resolved.skillName,
+					message: resolved.message
+				});
+			} catch (error) {
+				if (error instanceof SkillInvocationError) return c.json({
+					error: error.code,
+					message: error.message
+				}, 404);
+				throw error;
+			}
+		};
+		const handleFactorySkillsList = async (context) => {
+			const c = loose(context);
+			const { auth } = this.deps;
+			if (auth.enabled()) {
+				await auth.ensureUser(c);
+				if (!auth.tenant(c)) return c.json({
+					error: "unauthorized",
+					message: "Authentication required."
+				}, 401);
+			}
+			return c.json({ skills: await listFactorySkills() });
+		};
+		return [
+			registerApiRoute("/web/factory/skills", {
+				method: "GET",
+				requiresAuth: false,
+				handler: (context) => handleFactorySkillsList(context)
+			}),
+			registerApiRoute("/web/agent-controller/:controllerId/skills/prepare", {
+				method: "POST",
+				requiresAuth: false,
+				handler: (context) => handleSkillRequest(context, false)
+			}),
+			registerApiRoute("/web/agent-controller/:controllerId/skills/invoke", {
+				method: "POST",
+				requiresAuth: false,
+				handler: (context) => handleSkillRequest(context, true)
+			})
+		];
+	}
+};
+//#endregion
+export { SkillRoutes };
+
+//# sourceMappingURL=skills.js.map

package/dist/routes/skills.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills.js","names":["#authorizeSessionAddress"],"sources":["../../src/routes/skills.ts"],"sourcesContent":["import type { MastraCodeState } from '@mastra/code-sdk/schema';\nimport type { AgentController } from '@mastra/core/agent-controller';\nimport type { RequestContext } from '@mastra/core/request-context';\nimport type { ApiRoute } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\nimport type { Context } from 'hono';\n\nimport { peekSessionSandbox } from '../sandbox/session-sandbox.js';\nimport { listFactorySkills } from '../skills/catalog.js';\nimport { resolveSkillInvocation, SkillInvocationError } from '../skills/service.js';\nimport type { SourceControlStorageHandle } from '../storage/domains/source-control/base.js';\nimport type { RouteDependencies } from './route.js';\nimport { Route } from './route.js';\n\nconst MAX_RESOURCE_ID_LENGTH = 512;\nconst MAX_SCOPE_LENGTH = 2048;\nconst MAX_ARGUMENTS_LENGTH = 16_384;\nconst SKILL_NAME_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;\n\ninterface SkillInvocationBody {\n  resourceId: string;\n  projectRepositoryId?: string;\n  scope?: string;\n  name: string;\n  arguments?: string;\n}\n\ninterface SessionAuthorizationResult {\n  allowed: boolean;\n  status?: 400 | 401 | 403;\n  code?: 'invalid_request' | 'unauthorized' | 'session_forbidden';\n  message?: string;\n}\n\nexport interface SkillRoutesDeps extends RouteDependencies {\n  controllerId: string;\n  controller: Pick<AgentController<MastraCodeState>, 'getSessionByResource'>;\n  sourceControlStorage?: SourceControlStorageHandle;\n  ensureSourceControlReady?: () => Promise<void>;\n  authorizeSessionAddress?: (\n    context: Context,\n    address: { resourceId: string; projectRepositoryId?: string; scope?: string },\n  ) => Promise<SessionAuthorizationResult>;\n}\n\nfunction loose(context: unknown): Context {\n  return context as Context;\n}\n\nfunction parseBody(value: unknown): SkillInvocationBody | undefined {\n  if (!value || typeof value !== 'object') return undefined;\n  const input = value as Record<string, unknown>;\n  if (typeof input.resourceId !== 'string' || input.resourceId.length === 0) return undefined;\n  if (input.resourceId.length > MAX_RESOURCE_ID_LENGTH) return undefined;\n  if (\n    input.projectRepositoryId !== undefined &&\n    (typeof input.projectRepositoryId !== 'string' || !UUID_RE.test(input.projectRepositoryId))\n  ) {\n    return undefined;\n  }\n  if (input.scope !== undefined && (typeof input.scope !== 'string' || input.scope.length > MAX_SCOPE_LENGTH)) {\n    return undefined;\n  }\n  if (typeof input.name !== 'string' || input.name.length > 64 || !SKILL_NAME_RE.test(input.name)) return undefined;\n  if (input.arguments !== undefined) {\n    if (typeof input.arguments !== 'string' || input.arguments.length > MAX_ARGUMENTS_LENGTH) return undefined;\n  }\n  return {\n    resourceId: input.resourceId,\n    ...(input.projectRepositoryId ? { projectRepositoryId: input.projectRepositoryId } : {}),\n    ...(input.scope ? { scope: input.scope } : {}),\n    name: input.name,\n    ...(input.arguments !== undefined ? { arguments: input.arguments } : {}),\n  };\n}\n\nexport class SkillRoutes extends Route<SkillRoutesDeps> {\n  async #authorizeSessionAddress(\n    context: Context,\n    address: { resourceId: string; projectRepositoryId?: string; scope?: string },\n  ): Promise<SessionAuthorizationResult> {\n    const { auth, sourceControlStorage: storage, ensureSourceControlReady } = this.deps;\n    if (!auth.enabled()) return { allowed: true };\n\n    await auth.ensureUser(context);\n    const tenant = auth.tenant(context);\n    if (!tenant) {\n      return { allowed: false, status: 401, code: 'unauthorized', message: 'Authentication required.' };\n    }\n\n    // Personal sessions are keyed by the authenticated WorkOS user id. Their\n    // scope is a client-managed local/user-session worktree and needs no app DB.\n    if (address.resourceId === tenant.userId) return { allowed: true };\n\n    // Factory sessions are keyed by factoryProjectId and explicitly identify the\n    // linked repository whose user-owned worktree supplies the session scope.\n    if (\n      !UUID_RE.test(address.resourceId) ||\n      !address.projectRepositoryId ||\n      !UUID_RE.test(address.projectRepositoryId)\n    ) {\n      return { allowed: false, status: 400, code: 'invalid_request', message: 'Invalid skill invocation request.' };\n    }\n    if (!tenant.orgId || !address.scope) {\n      return { allowed: false, status: 403, code: 'session_forbidden', message: 'Session access denied.' };\n    }\n    if (!storage) {\n      return { allowed: false, status: 403, code: 'session_forbidden', message: 'Session access denied.' };\n    }\n    if (ensureSourceControlReady) {\n      try {\n        await ensureSourceControlReady();\n      } catch {\n        return { allowed: false, status: 403, code: 'session_forbidden', message: 'Session access denied.' };\n      }\n    }\n    const projectRepository = await storage.projectRepositories.get({\n      orgId: tenant.orgId,\n      id: address.projectRepositoryId,\n    });\n    if (!projectRepository) {\n      return { allowed: false, status: 403, code: 'session_forbidden', message: 'Session access denied.' };\n    }\n    const connection = await storage.connections.get({ orgId: tenant.orgId, id: projectRepository.connectionId });\n    if (!connection || connection.factoryProjectId !== address.resourceId) {\n      return { allowed: false, status: 403, code: 'session_forbidden', message: 'Session access denied.' };\n    }\n    // The scope must be the live workdir of a session the viewer can see under\n    // this repository. The live memoized sandbox entry is the only truth for\n    // workdirs (persisted columns are observability); no running/memoized\n    // sandbox at that path means no grant (fail closed).\n    const sessions = await storage.sessions.list({\n      projectRepositoryId: address.projectRepositoryId,\n      viewerUserId: tenant.userId,\n    });\n    const scopeIsLiveSessionWorkdir = sessions.some(row => {\n      const liveWorkdir = peekSessionSandbox(row.id)?.workdir;\n      return liveWorkdir !== undefined && liveWorkdir === address.scope;\n    });\n    return scopeIsLiveSessionWorkdir\n      ? { allowed: true }\n      : { allowed: false, status: 403, code: 'session_forbidden', message: 'Session access denied.' };\n  }\n\n  routes(): ApiRoute[] {\n    const { controllerId, controller, authorizeSessionAddress: customAuthorize } = this.deps;\n    const authorize =\n      customAuthorize ??\n      ((context: Context, address: { resourceId: string; projectRepositoryId?: string; scope?: string }) =>\n        this.#authorizeSessionAddress(context, address));\n    const handleSkillRequest = async (context: unknown, dispatch: boolean) => {\n      const c = loose(context);\n      if (c.req.param('controllerId') !== controllerId) {\n        return c.json({ error: 'controller_not_found', message: 'Agent controller not found.' }, 404);\n      }\n\n      let rawBody: unknown;\n      try {\n        rawBody = await c.req.json();\n      } catch {\n        return c.json({ error: 'invalid_request', message: 'Invalid JSON body.' }, 400);\n      }\n      const body = parseBody(rawBody);\n      if (!body) {\n        return c.json({ error: 'invalid_request', message: 'Invalid skill invocation request.' }, 400);\n      }\n\n      const authorization = await authorize(c, {\n        resourceId: body.resourceId,\n        projectRepositoryId: body.projectRepositoryId,\n        scope: body.scope,\n      });\n      if (!authorization.allowed) {\n        return c.json({ error: authorization.code, message: authorization.message }, authorization.status ?? 403);\n      }\n\n      try {\n        const resolved = await resolveSkillInvocation(controller, body);\n        if (dispatch) {\n          const requestContext = c.get('requestContext' as never) as RequestContext | undefined;\n          void resolved.session\n            .sendMessage({ content: resolved.message, ...(requestContext ? { requestContext } : {}) })\n            .catch((error: unknown) => {\n              console.error('Workspace skill dispatch failed after acceptance', error);\n            });\n        }\n        return c.json({ ok: true, skill: resolved.skillName, message: resolved.message });\n      } catch (error) {\n        if (error instanceof SkillInvocationError) {\n          return c.json({ error: error.code, message: error.message }, 404);\n        }\n        throw error;\n      }\n    };\n\n    const handleFactorySkillsList = async (context: unknown) => {\n      const c = loose(context);\n      const { auth } = this.deps;\n      if (auth.enabled()) {\n        await auth.ensureUser(c);\n        if (!auth.tenant(c)) {\n          return c.json({ error: 'unauthorized', message: 'Authentication required.' }, 401);\n        }\n      }\n      return c.json({ skills: await listFactorySkills() });\n    };\n\n    return [\n      registerApiRoute('/web/factory/skills', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: context => handleFactorySkillsList(context),\n      }),\n      registerApiRoute('/web/agent-controller/:controllerId/skills/prepare', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: context => handleSkillRequest(context, false),\n      }),\n      registerApiRoute('/web/agent-controller/:controllerId/skills/invoke', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: context => handleSkillRequest(context, true),\n      }),\n    ];\n  }\n}\n"],"mappings":";;;;;;AAcA,MAAM,yBAAyB;AAC/B,MAAM,mBAAmB;AACzB,MAAM,uBAAuB;AAC7B,MAAM,gBAAgB;AACtB,MAAM,UAAU;AA4BhB,SAAS,MAAM,SAA2B;CACxC,OAAO;AACT;AAEA,SAAS,UAAU,OAAiD;CAClE,IAAI,CAAC,SAAS,OAAO,UAAU,UAAU,OAAO,KAAA;CAChD,MAAM,QAAQ;CACd,IAAI,OAAO,MAAM,eAAe,YAAY,MAAM,WAAW,WAAW,GAAG,OAAO,KAAA;CAClF,IAAI,MAAM,WAAW,SAAS,wBAAwB,OAAO,KAAA;CAC7D,IACE,MAAM,wBAAwB,KAAA,MAC7B,OAAO,MAAM,wBAAwB,YAAY,CAAC,QAAQ,KAAK,MAAM,mBAAmB,IAEzF;CAEF,IAAI,MAAM,UAAU,KAAA,MAAc,OAAO,MAAM,UAAU,YAAY,MAAM,MAAM,SAAS,mBACxF;CAEF,IAAI,OAAO,MAAM,SAAS,YAAY,MAAM,KAAK,SAAS,MAAM,CAAC,cAAc,KAAK,MAAM,IAAI,GAAG,OAAO,KAAA;CACxG,IAAI,MAAM,cAAc,KAAA,GAClB;MAAA,OAAO,MAAM,cAAc,YAAY,MAAM,UAAU,SAAS,sBAAsB,OAAO,KAAA;CAAA;CAEnG,OAAO;EACL,YAAY,MAAM;EAClB,GAAI,MAAM,sBAAsB,EAAE,qBAAqB,MAAM,oBAAoB,IAAI,CAAC;EACtF,GAAI,MAAM,QAAQ,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;EAC5C,MAAM,MAAM;EACZ,GAAI,MAAM,cAAc,KAAA,IAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;CACxE;AACF;AAEA,IAAa,cAAb,cAAiC,MAAuB;CACtD,MAAMA,yBACJ,SACA,SACqC;EACrC,MAAM,EAAE,MAAM,sBAAsB,SAAS,6BAA6B,KAAK;EAC/E,IAAI,CAAC,KAAK,QAAQ,GAAG,OAAO,EAAE,SAAS,KAAK;EAE5C,MAAM,KAAK,WAAW,OAAO;EAC7B,MAAM,SAAS,KAAK,OAAO,OAAO;EAClC,IAAI,CAAC,QACH,OAAO;GAAE,SAAS;GAAO,QAAQ;GAAK,MAAM;GAAgB,SAAS;EAA2B;EAKlG,IAAI,QAAQ,eAAe,OAAO,QAAQ,OAAO,EAAE,SAAS,KAAK;EAIjE,IACE,CAAC,QAAQ,KAAK,QAAQ,UAAU,KAChC,CAAC,QAAQ,uBACT,CAAC,QAAQ,KAAK,QAAQ,mBAAmB,GAEzC,OAAO;GAAE,SAAS;GAAO,QAAQ;GAAK,MAAM;GAAmB,SAAS;EAAoC;EAE9G,IAAI,CAAC,OAAO,SAAS,CAAC,QAAQ,OAC5B,OAAO;GAAE,SAAS;GAAO,QAAQ;GAAK,MAAM;GAAqB,SAAS;EAAyB;EAErG,IAAI,CAAC,SACH,OAAO;GAAE,SAAS;GAAO,QAAQ;GAAK,MAAM;GAAqB,SAAS;EAAyB;EAErG,IAAI,0BACF,IAAI;GACF,MAAM,yBAAyB;EACjC,QAAQ;GACN,OAAO;IAAE,SAAS;IAAO,QAAQ;IAAK,MAAM;IAAqB,SAAS;GAAyB;EACrG;EAEF,MAAM,oBAAoB,MAAM,QAAQ,oBAAoB,IAAI;GAC9D,OAAO,OAAO;GACd,IAAI,QAAQ;EACd,CAAC;EACD,IAAI,CAAC,mBACH,OAAO;GAAE,SAAS;GAAO,QAAQ;GAAK,MAAM;GAAqB,SAAS;EAAyB;EAErG,MAAM,aAAa,MAAM,QAAQ,YAAY,IAAI;GAAE,OAAO,OAAO;GAAO,IAAI,kBAAkB;EAAa,CAAC;EAC5G,IAAI,CAAC,cAAc,WAAW,qBAAqB,QAAQ,YACzD,OAAO;GAAE,SAAS;GAAO,QAAQ;GAAK,MAAM;GAAqB,SAAS;EAAyB;EAcrG,QAJkC,MAJX,QAAQ,SAAS,KAAK;GAC3C,qBAAqB,QAAQ;GAC7B,cAAc,OAAO;EACvB,CAAC,EAAA,CAC0C,MAAK,QAAO;GACrD,MAAM,cAAc,mBAAmB,IAAI,EAAE,CAAC,EAAE;GAChD,OAAO,gBAAgB,KAAA,KAAa,gBAAgB,QAAQ;EAC9D,CAC+B,IAC3B,EAAE,SAAS,KAAK,IAChB;GAAE,SAAS;GAAO,QAAQ;GAAK,MAAM;GAAqB,SAAS;EAAyB;CAClG;CAEA,SAAqB;EACnB,MAAM,EAAE,cAAc,YAAY,yBAAyB,oBAAoB,KAAK;EACpF,MAAM,YACJ,qBACE,SAAkB,YAClB,KAAKA,yBAAyB,SAAS,OAAO;EAClD,MAAM,qBAAqB,OAAO,SAAkB,aAAsB;GACxE,MAAM,IAAI,MAAM,OAAO;GACvB,IAAI,EAAE,IAAI,MAAM,cAAc,MAAM,cAClC,OAAO,EAAE,KAAK;IAAE,OAAO;IAAwB,SAAS;GAA8B,GAAG,GAAG;GAG9F,IAAI;GACJ,IAAI;IACF,UAAU,MAAM,EAAE,IAAI,KAAK;GAC7B,QAAQ;IACN,OAAO,EAAE,KAAK;KAAE,OAAO;KAAmB,SAAS;IAAqB,GAAG,GAAG;GAChF;GACA,MAAM,OAAO,UAAU,OAAO;GAC9B,IAAI,CAAC,MACH,OAAO,EAAE,KAAK;IAAE,OAAO;IAAmB,SAAS;GAAoC,GAAG,GAAG;GAG/F,MAAM,gBAAgB,MAAM,UAAU,GAAG;IACvC,YAAY,KAAK;IACjB,qBAAqB,KAAK;IAC1B,OAAO,KAAK;GACd,CAAC;GACD,IAAI,CAAC,cAAc,SACjB,OAAO,EAAE,KAAK;IAAE,OAAO,cAAc;IAAM,SAAS,cAAc;GAAQ,GAAG,cAAc,UAAU,GAAG;GAG1G,IAAI;IACF,MAAM,WAAW,MAAM,uBAAuB,YAAY,IAAI;IAC9D,IAAI,UAAU;KACZ,MAAM,iBAAiB,EAAE,IAAI,gBAAyB;KACtD,SAAc,QACX,YAAY;MAAE,SAAS,SAAS;MAAS,GAAI,iBAAiB,EAAE,eAAe,IAAI,CAAC;KAAG,CAAC,CAAC,CACzF,OAAO,UAAmB;MACzB,QAAQ,MAAM,oDAAoD,KAAK;KACzE,CAAC;IACL;IACA,OAAO,EAAE,KAAK;KAAE,IAAI;KAAM,OAAO,SAAS;KAAW,SAAS,SAAS;IAAQ,CAAC;GAClF,SAAS,OAAO;IACd,IAAI,iBAAiB,sBACnB,OAAO,EAAE,KAAK;KAAE,OAAO,MAAM;KAAM,SAAS,MAAM;IAAQ,GAAG,GAAG;IAElE,MAAM;GACR;EACF;EAEA,MAAM,0BAA0B,OAAO,YAAqB;GAC1D,MAAM,IAAI,MAAM,OAAO;GACvB,MAAM,EAAE,SAAS,KAAK;GACtB,IAAI,KAAK,QAAQ,GAAG;IAClB,MAAM,KAAK,WAAW,CAAC;IACvB,IAAI,CAAC,KAAK,OAAO,CAAC,GAChB,OAAO,EAAE,KAAK;KAAE,OAAO;KAAgB,SAAS;IAA2B,GAAG,GAAG;GAErF;GACA,OAAO,EAAE,KAAK,EAAE,QAAQ,MAAM,kBAAkB,EAAE,CAAC;EACrD;EAEA,OAAO;GACL,iBAAiB,uBAAuB;IACtC,QAAQ;IACR,cAAc;IACd,UAAS,YAAW,wBAAwB,OAAO;GACrD,CAAC;GACD,iBAAiB,sDAAsD;IACrE,QAAQ;IACR,cAAc;IACd,UAAS,YAAW,mBAAmB,SAAS,KAAK;GACvD,CAAC;GACD,iBAAiB,qDAAqD;IACpE,QAAQ;IACR,cAAc;IACd,UAAS,YAAW,mBAAmB,SAAS,IAAI;GACtD,CAAC;EACH;CACF;AACF"}

package/dist/routes/source-control-sessions.d.ts

@@ -0,0 +1,22 @@
+import type { MountedMastraCode } from '@mastra/code-sdk';
+import type { ApiRoute, IUserProvider } from '@mastra/core/server';
+import type { SessionRetirementCoordinator } from '../sandbox/session-retirement.js';
+import type { MemorySettingsStorage } from '../storage/domains/memory-settings/base.js';
+import type { FactoryProjectsStorage } from '../storage/domains/projects/base.js';
+import type { SourceControlStorageHandle } from '../storage/domains/source-control/base.js';
+import type { WorkItemsStorage } from '../storage/domains/work-items/base.js';
+import type { RouteAuth } from './route.js';
+type SessionOwnerUserProvider = Pick<IUserProvider, 'getUser'> & Partial<Pick<IUserProvider, 'getUsers'>>;
+export interface SourceControlSessionRoutesOptions {
+    auth: RouteAuth;
+    sourceControls: readonly SourceControlStorageHandle[];
+    projects: Pick<FactoryProjectsStorage, 'get'>;
+    users?: SessionOwnerUserProvider;
+    controller?: MountedMastraCode['controller'];
+    memorySettings: Pick<MemorySettingsStorage, 'get'>;
+    sessionRetirement?: SessionRetirementCoordinator;
+    workItems?: Pick<WorkItemsStorage, 'clearSessionReferences'>;
+}
+export declare function buildSourceControlSessionRoutes(options: SourceControlSessionRoutesOptions): ApiRoute[];
+export {};
+//# sourceMappingURL=source-control-sessions.d.ts.map

package/dist/routes/source-control-sessions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-control-sessions.d.ts","sourceRoot":"","sources":["../../src/routes/source-control-sessions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAG1D,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAOnE,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,kCAAkC,CAAC;AAGrF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,KAAK,EAGV,0BAA0B,EAC3B,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAoB5C,KAAK,wBAAwB,GAAG,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC;AAE1G,MAAM,WAAW,iCAAiC;IAChD,IAAI,EAAE,SAAS,CAAC;IAChB,cAAc,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACtD,QAAQ,EAAE,IAAI,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;IAC9C,KAAK,CAAC,EAAE,wBAAwB,CAAC;IACjC,UAAU,CAAC,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAC7C,cAAc,EAAE,IAAI,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;IACnD,iBAAiB,CAAC,EAAE,4BAA4B,CAAC;IACjD,SAAS,CAAC,EAAE,IAAI,CAAC,gBAAgB,EAAE,wBAAwB,CAAC,CAAC;CAC9D;AA0RD,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,iCAAiC,GAAG,QAAQ,EAAE,CA6ItG"}

package/dist/routes/source-control-sessions.js

@@ -0,0 +1,356 @@
+import { isValidGitRef } from "../sandbox/git-ref.js";
+import { waitForPendingFilesystemCapture } from "../session/filesystem-capture.js";
+import { normalizeSessionTitle } from "../session/session-title.js";
+import { reclaimDeletedSessionSandbox } from "../integrations/github/sandbox-release.js";
+import { RequestContext } from "@mastra/core/request-context";
+import { registerApiRoute } from "@mastra/core/server";
+import { UniqueViolationError } from "@mastra/core/storage";
+import { resolveModel } from "@mastra/code-sdk/agents/model";
+//#region src/routes/source-control-sessions.ts
+function loose(c) {
+	return c;
+}
+const USER_SESSION_BRANCH_PREFIX = "user/session-";
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+const MAX_SESSION_OWNER_PROFILES = 100;
+const MAX_SESSION_OWNER_PROFILE_CACHE_ENTRIES = 500;
+const SESSION_OWNER_PROFILE_TTL_MS = 5 * 6e4;
+async function resolveOrgTenant(c, auth) {
+	await auth.ensureUser(c);
+	const tenant = auth.tenant(c);
+	if (!tenant) return { response: c.json({
+		error: "unauthorized",
+		reason: "auth_required"
+	}, 401) };
+	if (!tenant.orgId) return { response: c.json({
+		error: "organization_required",
+		message: "Source-control sessions require an organization."
+	}, 403) };
+	return { tenant: {
+		orgId: tenant.orgId,
+		userId: tenant.userId
+	} };
+}
+async function resolveProjectRepository(sourceControls, orgId, projectRepositoryId) {
+	const matches = (await Promise.all(sourceControls.map(async (sourceControl) => {
+		const project = await sourceControl.projectRepositories.get({
+			orgId,
+			id: projectRepositoryId
+		});
+		if (!project) return null;
+		const repository = await sourceControl.repositories.get({
+			orgId,
+			id: project.repositoryId
+		});
+		if (!repository) return null;
+		const connection = await sourceControl.connections.get({
+			orgId,
+			id: project.connectionId
+		});
+		if (!connection) return null;
+		return {
+			sourceControl,
+			project,
+			factoryProjectId: connection.factoryProjectId,
+			defaultBranch: project.branch ?? repository.defaultBranch
+		};
+	}))).filter((match) => match !== null);
+	if (matches.length > 1) throw new Error("Factory project repository exists in multiple source-control providers.");
+	return matches[0] ?? null;
+}
+async function resolveSession(sourceControls, sessionId) {
+	const matches = (await Promise.all(sourceControls.map(async (sourceControl) => ({
+		sourceControl,
+		session: await sourceControl.sessions.getBySessionId(sessionId)
+	})))).filter((match) => match.session !== null);
+	if (matches.length > 1) throw new Error("Factory session exists in multiple source-control providers.");
+	return matches[0] ?? null;
+}
+function isJsonObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function createSessionNaming() {
+	const inFlight = /* @__PURE__ */ new Map();
+	return (sessionId, run) => {
+		const pending = inFlight.get(sessionId);
+		if (pending) return pending;
+		const started = run().finally(() => inFlight.delete(sessionId));
+		inFlight.set(sessionId, started);
+		return started;
+	};
+}
+function titleModel(modelId) {
+	return ({ requestContext }) => resolveModel(modelId, {
+		remapForCodexOAuth: true,
+		requestContext
+	});
+}
+function createSessionOwnerProfileResolver(users) {
+	const cache = /* @__PURE__ */ new Map();
+	const cacheProfile = (userId, profile, expiresAt) => {
+		cache.delete(userId);
+		cache.set(userId, {
+			profile,
+			expiresAt
+		});
+		if (cache.size > MAX_SESSION_OWNER_PROFILE_CACHE_ENTRIES) {
+			const oldestUserId = cache.keys().next().value;
+			if (oldestUserId !== void 0) cache.delete(oldestUserId);
+		}
+	};
+	return async (userIds) => {
+		if (!users) return /* @__PURE__ */ new Map();
+		const requestedUserIds = [...new Set(userIds)].slice(0, MAX_SESSION_OWNER_PROFILES);
+		const profiles = /* @__PURE__ */ new Map();
+		const unresolvedUserIds = [];
+		const now = Date.now();
+		for (const userId of requestedUserIds) {
+			const cached = cache.get(userId);
+			if (!cached || cached.expiresAt <= now) {
+				cache.delete(userId);
+				unresolvedUserIds.push(userId);
+			} else if (cached.profile) profiles.set(userId, cached.profile);
+		}
+		if (unresolvedUserIds.length === 0) return profiles;
+		let resolvedUsers;
+		if (users.getUsers) try {
+			resolvedUsers = await users.getUsers(unresolvedUserIds);
+		} catch (error) {
+			console.warn("[Factory Sessions] Bulk owner profile lookup failed; falling back to individual lookups", { error: error instanceof Error ? error.message : String(error) });
+			resolvedUsers = (await Promise.allSettled(unresolvedUserIds.map((userId) => users.getUser(userId)))).filter((result) => result.status === "fulfilled").map((result) => result.value);
+		}
+		else resolvedUsers = (await Promise.allSettled(unresolvedUserIds.map((userId) => users.getUser(userId)))).filter((result) => result.status === "fulfilled").map((result) => result.value);
+		for (const user of resolvedUsers) {
+			if (!user) continue;
+			const name = user.name?.trim() || user.email?.trim();
+			if (!name) continue;
+			profiles.set(user.id, {
+				id: user.id,
+				name,
+				...user.avatarUrl ? { avatarUrl: user.avatarUrl } : {}
+			});
+		}
+		const expiresAt = now + SESSION_OWNER_PROFILE_TTL_MS;
+		for (const userId of unresolvedUserIds) cacheProfile(userId, profiles.get(userId), expiresAt);
+		return profiles;
+	};
+}
+function withOwnerProfile(session, owners) {
+	const owner = owners.get(session.userId);
+	return owner ? {
+		...session,
+		owner
+	} : session;
+}
+function projectSessionRoutes(path, options, resolveOwnerProfiles) {
+	return [registerApiRoute(path, {
+		method: "GET",
+		requiresAuth: false,
+		handler: async (c) => {
+			const resolved = await resolveOrgTenant(loose(c), options.auth);
+			if ("response" in resolved) return resolved.response;
+			const { orgId, userId } = resolved.tenant;
+			const projectRepositoryId = c.req.param("id");
+			const project = projectRepositoryId ? await resolveProjectRepository(options.sourceControls, orgId, projectRepositoryId) : null;
+			if (!project) return c.json({ error: "Project repository not found" }, 404);
+			const sessions = await project.sourceControl.sessions.list({
+				projectRepositoryId: project.project.id,
+				viewerUserId: userId
+			});
+			const owners = await resolveOwnerProfiles(sessions.map((session) => session.userId));
+			return c.json({ sessions: sessions.map((session) => withOwnerProfile(session, owners)) });
+		}
+	}), registerApiRoute(path, {
+		method: "POST",
+		requiresAuth: false,
+		handler: async (c) => {
+			const resolved = await resolveOrgTenant(loose(c), options.auth);
+			if ("response" in resolved) return resolved.response;
+			const { orgId, userId } = resolved.tenant;
+			const projectRepositoryId = c.req.param("id");
+			const project = projectRepositoryId ? await resolveProjectRepository(options.sourceControls, orgId, projectRepositoryId) : null;
+			if (!project) return c.json({ error: "Project repository not found" }, 404);
+			let body;
+			try {
+				body = await c.req.json();
+			} catch {
+				return c.json({ error: "Invalid JSON body" }, 400);
+			}
+			if (!isJsonObject(body)) return c.json({ error: "Invalid JSON body" }, 400);
+			if (body.baseBranch !== void 0 && typeof body.baseBranch !== "string") return c.json({ error: "Invalid baseBranch" }, 400);
+			const baseBranch = body.baseBranch ?? project.defaultBranch;
+			if (!isValidGitRef(baseBranch)) return c.json({ error: "Invalid baseBranch" }, 400);
+			if (body.sessionId !== void 0 && (typeof body.sessionId !== "string" || !UUID_PATTERN.test(body.sessionId))) return c.json({ error: "Invalid sessionId" }, 400);
+			const requestedSessionId = body.sessionId;
+			const sessionId = requestedSessionId ?? globalThis.crypto.randomUUID();
+			if (body.title !== void 0 && typeof body.title !== "string") return c.json({ error: "Invalid title" }, 400);
+			const normalizedTitle = body.title === void 0 ? null : normalizeSessionTitle(body.title);
+			let branch;
+			if (body.branch === void 0) branch = `${USER_SESSION_BRANCH_PREFIX}${sessionId}`;
+			else if (isValidGitRef(body.branch)) branch = body.branch;
+			else return c.json({ error: "Invalid branch" }, 400);
+			if (requestedSessionId) {
+				const existing = await project.sourceControl.sessions.getBySessionId(sessionId);
+				if (existing) {
+					if (existing.projectRepositoryId !== project.project.id || existing.orgId !== orgId || existing.userId !== userId || existing.branch !== branch) return c.json({ error: "Session ID conflict" }, 409);
+					return c.json({ session: existing });
+				}
+			}
+			const session = await project.sourceControl.sessions.create({
+				sessionId,
+				projectRepositoryId: project.project.id,
+				factoryProjectId: project.factoryProjectId,
+				orgId,
+				userId,
+				branch,
+				baseBranch,
+				title: normalizedTitle,
+				visibility: "org"
+			}).catch(async (error) => {
+				if (!(error instanceof UniqueViolationError) || !requestedSessionId) throw error;
+				const conflict = await project.sourceControl.sessions.getBySessionId(sessionId);
+				if (!conflict) throw error;
+				return conflict;
+			});
+			if (requestedSessionId && (session.sessionId !== sessionId || session.projectRepositoryId !== project.project.id || session.orgId !== orgId || session.userId !== userId || session.branch !== branch)) return c.json({ error: "Session ID conflict" }, 409);
+			return c.json({ session });
+		}
+	})];
+}
+function buildSourceControlSessionRoutes(options) {
+	const nameSession = createSessionNaming();
+	const resolveOwnerProfiles = createSessionOwnerProfileResolver(options.users);
+	return [
+		registerApiRoute("/web/factory/projects/:id/sessions", {
+			method: "GET",
+			requiresAuth: false,
+			handler: async (c) => {
+				const resolved = await resolveOrgTenant(loose(c), options.auth);
+				if ("response" in resolved) return resolved.response;
+				const { orgId, userId } = resolved.tenant;
+				const factoryProjectId = c.req.param("id");
+				const project = factoryProjectId ? await options.projects.get({
+					orgId,
+					id: factoryProjectId
+				}) : null;
+				if (!project) return c.json({ error: "Factory not found" }, 404);
+				const sessions = (await Promise.all(options.sourceControls.map((sourceControl) => sourceControl.sessions.listByProject({
+					orgId,
+					factoryProjectId: project.id,
+					viewerUserId: userId
+				})))).flat();
+				const owners = await resolveOwnerProfiles(sessions.map((session) => session.userId));
+				return c.json({ sessions: sessions.map((session) => withOwnerProfile(session, owners)) });
+			}
+		}),
+		...projectSessionRoutes("/web/source-control/projects/:id/sessions", options, resolveOwnerProfiles),
+		...projectSessionRoutes("/web/github/projects/:id/sessions", options, resolveOwnerProfiles),
+		registerApiRoute("/web/user-sessions/:sessionId", {
+			method: "GET",
+			requiresAuth: false,
+			handler: async (c) => {
+				const resolved = await resolveOrgTenant(loose(c), options.auth);
+				if ("response" in resolved) return resolved.response;
+				const session = (await resolveSession(options.sourceControls, c.req.param("sessionId")))?.session;
+				if (!session || session.orgId !== resolved.tenant.orgId || session.visibility === "private" && session.userId !== resolved.tenant.userId) return c.json({ error: "Session not found" }, 404);
+				const owners = await resolveOwnerProfiles([session.userId]);
+				return c.json({ session: withOwnerProfile(session, owners) });
+			}
+		}),
+		registerApiRoute("/web/user-sessions/:sessionId", {
+			method: "DELETE",
+			requiresAuth: false,
+			handler: async (c) => {
+				const resolved = await resolveOrgTenant(loose(c), options.auth);
+				if ("response" in resolved) return resolved.response;
+				const match = await resolveSession(options.sourceControls, c.req.param("sessionId"));
+				const session = match?.session;
+				if (!match || !session || session.orgId !== resolved.tenant.orgId || session.userId !== resolved.tenant.userId) return c.json({ error: "Session not found" }, 404);
+				try {
+					await waitForPendingFilesystemCapture(session.sessionId).catch((error) => {
+						console.warn("[Factory Sessions] Failed to drain filesystem capture before delete", {
+							sessionId: session.sessionId,
+							error
+						});
+					});
+					await options.controller?.deleteSession({ resourceId: session.sessionId });
+				} catch (error) {
+					console.error("[Factory Sessions] Failed to tear down live controller session", {
+						sessionId: session.sessionId,
+						error
+					});
+				}
+				if (options.sessionRetirement) await options.sessionRetirement.retireSession({
+					sourceControl: match.sourceControl,
+					...options.workItems ? { workItems: options.workItems } : {},
+					orgId: session.orgId,
+					sessionId: session.sessionId,
+					deleteSession: true
+				});
+				else {
+					await options.workItems?.clearSessionReferences({
+						orgId: session.orgId,
+						sessionId: session.sessionId
+					});
+					await match.sourceControl.sessions.delete(session.id);
+					reclaimDeletedSessionSandbox({ session }).catch((error) => {
+						console.error("[Factory Sessions] Failed to reclaim sandbox for deleted session", {
+							sessionId: session.sessionId,
+							sandboxId: session.sandboxId,
+							error
+						});
+					});
+				}
+				return c.json({ removed: true });
+			}
+		}),
+		registerApiRoute("/web/user-sessions/:sessionId/title", {
+			method: "POST",
+			requiresAuth: false,
+			handler: async (c) => {
+				const resolved = await resolveOrgTenant(loose(c), options.auth);
+				if ("response" in resolved) return resolved.response;
+				const sessionId = c.req.param("sessionId");
+				const match = await resolveSession(options.sourceControls, sessionId);
+				const row = match?.session;
+				if (!match || !row || row.orgId !== resolved.tenant.orgId || row.userId !== resolved.tenant.userId) return c.json({ error: "Session not found" }, 404);
+				if (!options.controller) return c.json({ error: "Sessions are not available on this server." }, 503);
+				const thread = (await options.controller.queryThreads({ resourceId: sessionId })).sort((a, b) => b.updatedAt.getTime() - a.updatedAt.getTime())[0];
+				if (!thread) return c.json({ error: "This session has no conversation to name yet." }, 409);
+				const stored = await options.memorySettings.get({
+					orgId: row.orgId,
+					userId: row.userId
+				});
+				const requestContext = new RequestContext();
+				requestContext.set("user", {
+					workosId: row.userId,
+					organizationId: row.orgId
+				});
+				try {
+					const title = await nameSession(sessionId, async () => {
+						const generated = await options.controller.generateThreadTitle({
+							threadId: thread.id,
+							resourceId: sessionId,
+							requestContext,
+							...stored?.observerModelId ? { model: titleModel(stored.observerModelId) } : {}
+						});
+						const named = generated ? normalizeSessionTitle(generated) : null;
+						if (named) await match.sourceControl.sessions.rename({
+							sessionId,
+							title: named
+						});
+						return named;
+					});
+					if (!title) return c.json({ error: "The model returned an empty title. Try again." }, 502);
+					return c.json({ title });
+				} catch (error) {
+					return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+				}
+			}
+		})
+	];
+}
+//#endregion
+export { buildSourceControlSessionRoutes };
+
+//# sourceMappingURL=source-control-sessions.js.map