@mastra/factory 0.0.0-esbuild-bundle-worker-20260807173433

package/dist/integrations/github/routes.js

@@ -0,0 +1,1335 @@
+import { clearGithubPat, getGithubPat, getGithubPatStatus, setGithubPat } from "./pat.js";
+import { listPullRequestSubscriptionsForThread, subscribeToPullRequest } from "./subscriptions.js";
+import { SandboxBudgetError } from "../../sandbox/fleet.js";
+import { MaterializeError, WorktreeError, commitAll, computeWorktreePath, ensureProjectSandbox, isValidGitRef as isValidGitRef$1, materializeRepo, pushBranch, teardownProjectSandbox } from "./sandbox.js";
+import { reclaimDeletedSessionSandbox } from "./sandbox-release.js";
+import { resolveFactoryDefaultModelId } from "../../session/factory-session.js";
+import { getGithubFeatureDiagnostics, isGithubFeatureEnabled } from "./config.js";
+import { handleGithubWebhook } from "./webhook.js";
+import { registerApiRoute } from "@mastra/core/server";
+import { randomUUID } from "crypto";
+import { UniqueViolationError } from "@mastra/core/storage";
+import { streamSSE } from "hono/streaming";
+//#region src/integrations/github/routes.ts
+/**
+* Mastra `apiRoutes` for the GitHub App project feature.
+*
+* Registered alongside the other `/web/*` routes, behind the host auth gate.
+* Every route additionally re-checks the authenticated user via the injected
+* `RouteAuth` seam and scopes all rows by that user's stable id, so a user can
+* only ever see and operate on their own installations and projects.
+*
+* When the feature is disabled (`isGithubFeatureEnabled()` false), `buildGithubRoutes`
+* returns only `GET /web/github/status`, which reports `enabled:false`
+* so the SPA can cleanly hide all GitHub UI.
+*/
+const sessionOperationLocks = /* @__PURE__ */ new Map();
+const MAX_SESSION_TITLE_LENGTH = 80;
+const USER_SESSION_BRANCH_PREFIX = "user/session-";
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+/**
+* Serialize same-session mutations within one Factory process. Factory sessions
+* normally issue these operations sequentially, so this lock is probably not
+* necessary; keep the cheap local guard until that invariant is enforced by
+* the request protocol. It intentionally does not consume a database connection.
+*/
+function withSessionOperationLock(sessionId, fn) {
+	const next = (sessionOperationLocks.get(sessionId) ?? Promise.resolve()).then(fn, fn);
+	const tail = next.then(() => void 0, () => void 0);
+	sessionOperationLocks.set(sessionId, tail);
+	tail.then(() => {
+		if (sessionOperationLocks.get(sessionId) === tail) sessionOperationLocks.delete(sessionId);
+	});
+	return next;
+}
+/** Erase a route handler's path-parameterized context to a plain `Context`. */
+function loose(c) {
+	return c;
+}
+function pullRequestNumberFromUrl(value, expectedRepo) {
+	try {
+		const url = new URL(value);
+		const match = url.pathname.match(/^\/([^/]+\/[^/]+)\/pull\/(\d+)\/?$/);
+		if (url.protocol !== "https:" || url.hostname !== "github.com" || match?.[1]?.toLowerCase() !== expectedRepo.toLowerCase()) return;
+		const number = Number(match[2]);
+		return Number.isInteger(number) && number > 0 ? number : void 0;
+	} catch {
+		return;
+	}
+}
+function isCanonicalGithubIssueUrl(value, repoFullName, issueNumber) {
+	try {
+		const url = new URL(value);
+		const [owner, repo] = repoFullName.split("/");
+		return url.protocol === "https:" && url.hostname === "github.com" && url.pathname === `/${owner}/${repo}/issues/${issueNumber}` && url.search === "" && url.hash === "";
+	} catch {
+		return false;
+	}
+}
+/**
+* Validate a git branch/ref name against a strict whitelist. The value is later
+* interpolated into a shell `git clone --branch` command, so it must never
+* contain shell metacharacters. We accept only git-ref-safe characters and
+* reject anything else rather than relying on shell quoting alone.
+*/
+function isValidGitRef(value) {
+	return typeof value === "string" && value.length > 0 && value.length <= 255 && /^[A-Za-z0-9_./-]+$/.test(value);
+}
+function isJsonObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function normalizeSessionTitle(title) {
+	return [...title.replace(/\s+/g, " ").trim()].slice(0, MAX_SESSION_TITLE_LENGTH).join("").trimEnd() || null;
+}
+/**
+* Resolve the org-scoped tenant for a GitHub request. GitHub project features
+* are org-owned, so they require both a signed-in user and a WorkOS
+* organization. Returns the `(orgId, userId)` tenant (with `orgId` narrowed to a
+* non-null string) or a ready-to-return error response: 401 when unauthenticated,
+* 403 when the user has no organization (personal account).
+*
+* Resolves the session from the request cookie itself (via `auth.ensureUser`)
+* instead of relying on the auth gate's context stash: on platform deploys
+* custom `apiRoutes` run on an isolated sub-app context where the gate's
+* `c.set(...)` is invisible. When the gate stash IS visible (local Hono
+* server), `auth.ensureUser` returns the cached user and this is a no-op.
+*/
+async function resolveOrgTenant(c, auth) {
+	await auth.ensureUser(c);
+	const tenant = auth.tenant(c);
+	if (!tenant) return { response: c.json({ error: "unauthorized" }, 401) };
+	if (!tenant.orgId) return { response: c.json({
+		error: "organization_required",
+		message: "GitHub projects require a WorkOS organization. Personal accounts cannot connect repositories."
+	}, 403) };
+	return { tenant: {
+		orgId: tenant.orgId,
+		userId: tenant.userId
+	} };
+}
+/**
+* Parse a 1-based `page` query param. Missing means page 1; anything that is
+* not a small positive integer is rejected (`null`).
+*/
+function parseListPage(raw) {
+	if (raw === void 0) return 1;
+	if (!/^\d{1,5}$/.test(raw)) return null;
+	const page = Number(raw);
+	return page >= 1 ? page : null;
+}
+const VALID_ISSUE_LABEL_FILTERS = /* @__PURE__ */ new Set(["auto-triaged", "needs-approval"]);
+function parseIssueLabelFilter(raw) {
+	if (raw === void 0 || raw === "") return void 0;
+	if (VALID_ISSUE_LABEL_FILTERS.has(raw)) return raw;
+	return null;
+}
+function parseIssueNumberParam(raw) {
+	if (!raw || !/^\d{1,10}$/.test(raw)) return null;
+	const issueNumber = Number(raw);
+	return Number.isSafeInteger(issueNumber) && issueNumber > 0 ? issueNumber : null;
+}
+function parseStringList(value) {
+	if (!Array.isArray(value)) return [];
+	return value.filter((item) => typeof item === "string" && item.length > 0);
+}
+async function resolveProjectRepository(args) {
+	const projectRepository = await args.github.sourceControlStorage.projectRepositories.get({
+		orgId: args.orgId,
+		id: args.projectRepositoryId
+	});
+	if (!projectRepository) return null;
+	const connection = await args.github.sourceControlStorage.connections.get({
+		orgId: args.orgId,
+		id: projectRepository.connectionId
+	});
+	if (!connection) return null;
+	const repository = await args.github.sourceControlStorage.repositories.get({
+		orgId: args.orgId,
+		id: projectRepository.repositoryId
+	});
+	if (!repository) return null;
+	const installation = await args.github.sourceControlStorage.installations.get({
+		orgId: args.orgId,
+		id: connection.installationId
+	});
+	if (!installation) return null;
+	return {
+		...projectRepository,
+		connection,
+		installation,
+		repository,
+		factoryProjectId: connection.factoryProjectId,
+		defaultBranch: projectRepository.branch ?? repository.defaultBranch
+	};
+}
+function polledIssueEvent(project, issue) {
+	const repositoryId = Number(project.repository.externalId);
+	const assigneeLogins = issue.assignees ?? (issue.assignee ? [issue.assignee] : []);
+	return {
+		event: "issues",
+		deliveryId: `poll:${repositoryId}:issue:${issue.number}:${issue.createdAt}`,
+		payload: {
+			action: "opened",
+			installation: { id: Number(project.installation.externalId) },
+			repository: {
+				id: repositoryId,
+				full_name: project.repository.slug
+			},
+			sender: { login: issue.author ?? "__unknown__" },
+			issue: {
+				number: issue.number,
+				title: issue.title,
+				html_url: issue.url,
+				created_at: issue.createdAt,
+				assignees: assigneeLogins.map((login) => ({ login })),
+				labels: issue.labels.map((name) => ({ name }))
+			}
+		}
+	};
+}
+function polledPullRequestEvent(project, pullRequest) {
+	const repositoryId = Number(project.repository.externalId);
+	return {
+		event: "pull_request",
+		deliveryId: `poll:${repositoryId}:pull-request:${pullRequest.number}:${pullRequest.createdAt}`,
+		payload: {
+			action: "opened",
+			installation: { id: Number(project.installation.externalId) },
+			repository: {
+				id: repositoryId,
+				full_name: project.repository.slug
+			},
+			sender: { login: pullRequest.author ?? "__unknown__" },
+			pull_request: {
+				number: pullRequest.number,
+				title: pullRequest.title,
+				html_url: pullRequest.url,
+				created_at: pullRequest.createdAt,
+				state: "open",
+				merged: false,
+				assignees: pullRequest.assignees.map((login) => ({ login })),
+				requested_reviewers: pullRequest.requestedReviewers.map((login) => ({ login })),
+				head: { ref: pullRequest.headBranch },
+				base: { ref: pullRequest.baseBranch }
+			}
+		}
+	};
+}
+async function ingestPolledEvents(events, ingestFactoryEvent) {
+	if (!ingestFactoryEvent) return;
+	const rejected = (await Promise.allSettled(events.map((event) => ingestFactoryEvent(event)))).find((result) => result.status === "rejected");
+	if (rejected) throw rejected.reason;
+}
+/**
+* Build the GitHub routes as Mastra `apiRoutes`. When the feature is disabled,
+* returns only the `status` route so the SPA can detect the disabled state.
+*/
+function buildGithubRoutes(options) {
+	const routes = [];
+	const { auth, fleet, storage, github, stateSigner, emitAudit } = options;
+	const diagnostics = () => getGithubFeatureDiagnostics({
+		github,
+		auth,
+		appDbConfigured: storage !== void 0,
+		stateSigner,
+		fleet
+	});
+	routes.push(registerApiRoute("/web/github/status", {
+		method: "GET",
+		requiresAuth: false,
+		handler: async (c) => {
+			if (!isGithubFeatureEnabled({
+				github,
+				auth
+			}) || !github || !stateSigner) return c.json({
+				enabled: false,
+				connected: false,
+				installations: [],
+				reason: "missing_config",
+				diagnostics: diagnostics()
+			});
+			await auth.ensureUser(loose(c));
+			const tenant = auth.tenant(loose(c));
+			if (!tenant) return c.json({
+				error: "unauthorized",
+				reason: "auth_required"
+			}, 401);
+			if (!tenant.orgId) return c.json({
+				enabled: true,
+				sandboxEnabled: fleet.enabled,
+				organizationRequired: true,
+				connected: false,
+				installations: [],
+				reason: "organization_required",
+				diagnostics: diagnostics()
+			});
+			const rows = options.github ? await options.github.sourceControlStorage.installations.list({ orgId: tenant.orgId }) : [];
+			const connected = rows.length > 0;
+			return c.json({
+				enabled: true,
+				sandboxEnabled: fleet.enabled,
+				connected,
+				installations: rows.map((r) => ({
+					installationId: Number(r.externalId),
+					accountLogin: r.accountName,
+					accountType: r.accountType
+				})),
+				reason: connected ? "ready" : "not_connected",
+				diagnostics: diagnostics()
+			});
+		}
+	}));
+	if (!isGithubFeatureEnabled({
+		github,
+		auth
+	}) || !github || !stateSigner) return routes;
+	const signState = (orgId, userId) => stateSigner.sign(orgId, userId);
+	const verifyState = (state) => stateSigner.verify(state);
+	const { runIssueTriage } = options;
+	const runBoardIssueTriage = runIssueTriage ? async (input) => {
+		if (!input.resourceId || !input.projectPath) throw new Error("GitHub issue triage requires an explicit Factory project repository");
+		await github.addIssueLabels(input.installationId, input.repository, input.issueNumber, ["auto-triaged"]);
+		return runIssueTriage({
+			...input,
+			defaultModelId: input.defaultModelId ?? await resolveFactoryDefaultModelId(options.projects, input.resourceId),
+			labels: input.labels.includes("auto-triaged") ? input.labels : [...input.labels, "auto-triaged"]
+		});
+	} : void 0;
+	routes.push(registerApiRoute("/web/github/subscriptions", {
+		method: "GET",
+		handler: async (c) => {
+			await auth.ensureUser(loose(c));
+			const tenant = auth.tenant(loose(c));
+			if (!tenant?.orgId) return c.json({ error: "unauthorized" }, 401);
+			const resourceId = c.req.query("resourceId");
+			const threadId = c.req.query("threadId");
+			const sessionScope = c.req.query("scope");
+			if (!resourceId || !threadId) return c.json({ error: "resourceId and threadId are required" }, 400);
+			const subscriptions = await listPullRequestSubscriptionsForThread({
+				orgId: tenant.orgId,
+				resourceId,
+				threadId,
+				sessionScope
+			}, github.integrationStorage);
+			return c.json({ subscriptions: subscriptions.map((subscription) => ({
+				id: subscription.id,
+				repoFullName: subscription.data.repositorySlug,
+				pullRequestNumber: Number(subscription.data.changeRequestId),
+				status: subscription.status,
+				url: `https://github.com/${subscription.data.repositorySlug}/pull/${subscription.data.changeRequestId}`
+			})) });
+		}
+	}), registerApiRoute("/web/github/webhook", {
+		method: "POST",
+		requiresAuth: false,
+		handler: async (c) => {
+			const result = await handleGithubWebhook(loose(c), {
+				github,
+				runIssueTriage: runBoardIssueTriage,
+				ingestFactoryEvent: options.ingestFactoryEvent,
+				...options.controller ? {
+					controller: options.controller,
+					onTargetError: (subscription, error) => {
+						console.warn(`[GitHub Webhook] Delivery failed for subscription ${subscription.id} (${subscription.resourceId}/${subscription.threadId}).`, error);
+					}
+				} : {}
+			});
+			return c.json(result.body, result.status);
+		}
+	}));
+	const redirectUri = options.redirectUri ?? `${(options.baseUrl ?? "").replace(/\/$/, "")}/auth/github/callback`;
+	routes.push(registerApiRoute("/auth/github/connect", {
+		method: "GET",
+		requiresAuth: false,
+		handler: async (c) => {
+			const resolved = await resolveOrgTenant(loose(c), auth);
+			if ("response" in resolved) return resolved.response;
+			const state = signState(resolved.tenant.orgId, resolved.tenant.userId);
+			if (c.req.query("manage")) return c.redirect(github.buildInstallUrl(state));
+			return c.redirect(github.buildOAuthIdentifyUrl(state, redirectUri));
+		}
+	}));
+	routes.push(registerApiRoute("/auth/github/callback", {
+		method: "GET",
+		requiresAuth: false,
+		handler: async (c) => {
+			const resolved = await resolveOrgTenant(loose(c), auth);
+			if ("response" in resolved) return resolved.response;
+			const { orgId, userId } = resolved.tenant;
+			const state = c.req.query("state");
+			if (!state) return c.redirect(github.buildOAuthIdentifyUrl(signState(orgId, userId), redirectUri));
+			const stateTenant = verifyState(state);
+			if (!stateTenant || stateTenant.userId !== userId || stateTenant.orgId !== orgId) {
+				console.warn("[GitHub] Install callback rejected: state/tenant mismatch.", JSON.stringify({
+					stateValid: Boolean(stateTenant),
+					stateOrgId: stateTenant?.orgId,
+					stateUserId: stateTenant?.userId,
+					sessionOrgId: orgId,
+					sessionUserId: userId
+				}));
+				return c.redirect("/?github=error");
+			}
+			const code = c.req.query("code");
+			if (!code) return c.redirect(github.buildOAuthIdentifyUrl(signState(orgId, userId), redirectUri));
+			try {
+				const userToken = await github.exchangeOAuthCode(code, redirectUri);
+				const installations = await github.listUserInstallations(userToken);
+				if (installations.length === 0) return c.redirect(github.buildInstallUrl(signState(orgId, userId)));
+				for (const inst of installations) await github.sourceControlStorage.installations.upsert({
+					orgId,
+					connectedByUserId: userId,
+					externalId: inst.installationId.toString(),
+					accountName: inst.accountLogin,
+					accountType: inst.accountType
+				});
+			} catch (error) {
+				console.warn(`[GitHub] Install callback failed to persist installations for org ${orgId} / user ${userId}.`, error);
+				return c.redirect("/?github=error");
+			}
+			return c.redirect("/?github=connected");
+		}
+	}));
+	routes.push(registerApiRoute("/web/github/repos", {
+		method: "GET",
+		requiresAuth: false,
+		handler: async (c) => {
+			const resolved = await resolveOrgTenant(loose(c), auth);
+			if ("response" in resolved) return resolved.response;
+			const orgId = resolved.tenant.orgId;
+			const installs = await github.sourceControlStorage.installations.list({ orgId });
+			const query = (c.req.query("q") ?? "").toLowerCase();
+			const listed = await Promise.all(installs.map(async (inst) => {
+				try {
+					return {
+						inst,
+						list: await github.listInstallationRepos(Number(inst.externalId))
+					};
+				} catch (err) {
+					if (err.status !== 404) throw err;
+					console.error(`[Mastra Factory] pruning stale GitHub installation ${inst.externalId} (404 from GitHub)`);
+					await github.sourceControlStorage.installations.delete({
+						orgId,
+						id: inst.id
+					});
+					return {
+						inst,
+						list: []
+					};
+				}
+			}));
+			const matches = [];
+			const seenRepositoryIds = /* @__PURE__ */ new Set();
+			for (const { inst, list } of listed) for (const repo of list) {
+				if (query && !repo.fullName.toLowerCase().includes(query)) continue;
+				if (seenRepositoryIds.has(repo.id)) continue;
+				seenRepositoryIds.add(repo.id);
+				matches.push({
+					inst,
+					repo
+				});
+			}
+			const repos = new Array(matches.length);
+			const upsertConcurrency = 10;
+			for (let start = 0; start < matches.length; start += upsertConcurrency) await Promise.all(matches.slice(start, start + upsertConcurrency).map(async ({ inst, repo }, offset) => {
+				const repository = await github.sourceControlStorage.repositories.upsert({
+					orgId,
+					input: {
+						installationId: inst.id,
+						externalId: repo.id.toString(),
+						slug: repo.fullName,
+						defaultBranch: isValidGitRef(repo.defaultBranch) ? repo.defaultBranch : "main",
+						providerMetadata: {
+							private: repo.private,
+							owner: repo.owner
+						}
+					}
+				});
+				repos[start + offset] = {
+					...repo,
+					installationStorageId: inst.id,
+					repositoryStorageId: repository.id,
+					sandboxProvider: fleet.provider,
+					sandboxWorkdir: fleet.computeWorkdir(repo.fullName)
+				};
+			}));
+			return c.json({ repos });
+		}
+	}));
+	routes.push(registerApiRoute("/web/github/projects/:id/ensure", {
+		method: "POST",
+		requiresAuth: false,
+		handler: async (c) => {
+			const resolved = await resolveOrgTenant(loose(c), auth);
+			if ("response" in resolved) return resolved.response;
+			const { orgId, userId } = resolved.tenant;
+			if (!fleet.enabled) return c.json({
+				error: "sandbox_not_configured",
+				message: "No sandbox provider is configured."
+			}, 503);
+			const projectRepositoryId = c.req.param("id");
+			if (!projectRepositoryId) return c.json({ error: "Project repository not found" }, 404);
+			const project = await resolveProjectRepository({
+				github,
+				orgId,
+				projectRepositoryId
+			});
+			if (!project) return c.json({ error: "Project repository not found" }, 404);
+			if ((c.req.header("accept") ?? "").includes("text/event-stream")) return streamSSE(loose(c), async (stream) => {
+				try {
+					const result = await prepareProject({
+						github,
+						fleet,
+						project,
+						userId,
+						onProgress: (ev) => void stream.writeSSE({
+							event: "progress",
+							data: JSON.stringify(ev)
+						})
+					});
+					await stream.writeSSE({
+						event: "done",
+						data: JSON.stringify(result)
+					});
+				} catch (err) {
+					await stream.writeSSE({
+						event: "error",
+						data: JSON.stringify(ensureErrorPayload(err).body)
+					});
+				}
+			});
+			try {
+				const result = await prepareProject({
+					github,
+					fleet,
+					project,
+					userId
+				});
+				return c.json(result);
+			} catch (err) {
+				const { status, body } = ensureErrorPayload(err);
+				return c.json(body, status);
+			}
+		}
+	}));
+	routes.push(registerApiRoute("/web/github/projects/:id/issues", {
+		method: "GET",
+		requiresAuth: false,
+		handler: async (c) => {
+			const loaded = await loadOrgProject({
+				github,
+				auth,
+				c: loose(c)
+			});
+			if ("response" in loaded) return loaded.response;
+			const page = parseListPage(c.req.query("page"));
+			if (page === null) return c.json({ error: "invalid_page" }, 400);
+			const label = parseIssueLabelFilter(c.req.query("label"));
+			if (label === null) return c.json({ error: "invalid_label" }, 400);
+			try {
+				const { issues, nextCursor } = await github.intake.listIssues({
+					connection: {
+						type: "app-installation",
+						installationId: Number(loaded.project.installation.externalId)
+					},
+					sourceIds: [loaded.project.repository.slug],
+					labels: label ? [label] : void 0,
+					cursor: String(page)
+				});
+				const responseIssues = issues.map((issue) => ({
+					number: Number(issue.id),
+					title: issue.title,
+					url: issue.url,
+					author: issue.author,
+					assignee: issue.assignee,
+					assignees: issue.assignees,
+					labels: issue.labels,
+					comments: issue.commentCount ?? 0,
+					createdAt: issue.createdAt,
+					updatedAt: issue.updatedAt
+				}));
+				await ingestPolledEvents(responseIssues.map((issue) => polledIssueEvent(loaded.project, issue)), options.ingestFactoryEvent);
+				return c.json({
+					issues: responseIssues,
+					nextPage: nextCursor === null ? null : Number(nextCursor)
+				});
+			} catch (err) {
+				return c.json({
+					error: "github_fetch_failed",
+					message: err instanceof Error ? err.message : String(err)
+				}, 502);
+			}
+		}
+	}));
+	routes.push(registerApiRoute("/web/github/projects/:id/issues/:number/triage", {
+		method: "POST",
+		requiresAuth: false,
+		handler: async (c) => {
+			const owned = await loadOwnedProject({
+				github,
+				auth,
+				fleet,
+				c: loose(c)
+			});
+			if ("response" in owned) return owned.response;
+			const { project, sandboxRow } = owned;
+			const issueNumber = parseIssueNumberParam(c.req.param("number"));
+			if (issueNumber === null) return c.json({ error: "invalid_issue_number" }, 400);
+			let body;
+			try {
+				body = await c.req.json();
+			} catch {
+				return c.json({ error: "Invalid JSON body" }, 400);
+			}
+			if (typeof body.title !== "string" || body.title.trim().length === 0 || body.title.length > 5e3) return c.json({ error: "invalid_title" }, 400);
+			if (typeof body.url !== "string" || body.url.trim().length === 0 || body.url.length > 2048 || !isCanonicalGithubIssueUrl(body.url, project.repository.slug, issueNumber)) return c.json({ error: "invalid_url" }, 400);
+			if (!runBoardIssueTriage) return c.json({ error: "triage_unavailable" }, 503);
+			const branch = `factory/issue-${issueNumber}`;
+			const projectPath = computeWorktreePath(sandboxRow.sandboxWorkdir, branch);
+			const result = await runBoardIssueTriage({
+				repository: project.repository.slug,
+				issueNumber,
+				issueTitle: body.title,
+				issueUrl: body.url,
+				labels: parseStringList(body.labels),
+				installationId: Number(project.installation.externalId),
+				resourceId: project.factoryProjectId,
+				projectPath,
+				branch
+			});
+			await emitAudit?.({
+				context: loose(c),
+				input: {
+					action: "factory.triage.started",
+					factoryProjectId: project.factoryProjectId,
+					projectRepositoryId: project.id,
+					targets: [{
+						type: "issue",
+						id: String(issueNumber),
+						name: body.title
+					}],
+					metadata: {
+						issueNumber,
+						branch,
+						threadId: result.threadId
+					}
+				}
+			});
+			return c.json({
+				ok: true,
+				threadId: result.threadId,
+				projectPath: result.projectPath ?? projectPath,
+				branch: result.branch ?? branch
+			}, 202);
+		}
+	}));
+	routes.push(registerApiRoute("/web/github/projects/:id/prs", {
+		method: "GET",
+		requiresAuth: false,
+		handler: async (c) => {
+			const loaded = await loadOrgProject({
+				github,
+				auth,
+				c: loose(c)
+			});
+			if ("response" in loaded) return loaded.response;
+			const page = parseListPage(c.req.query("page"));
+			if (page === null) return c.json({ error: "invalid_page" }, 400);
+			try {
+				const { pullRequests, nextCursor } = await github.versionControl.listPullRequests({
+					connection: {
+						type: "app-installation",
+						installationId: Number(loaded.project.installation.externalId)
+					},
+					sourceId: loaded.project.repository.slug,
+					includeDrafts: false,
+					cursor: String(page)
+				});
+				const responsePullRequests = pullRequests.map((pr) => ({
+					number: Number(pr.id),
+					title: pr.title,
+					url: pr.url,
+					author: pr.author,
+					assignees: pr.assignees ?? [],
+					requestedReviewers: pr.requestedReviewers ?? [],
+					baseBranch: pr.baseBranch,
+					headBranch: pr.headBranch,
+					createdAt: pr.createdAt,
+					updatedAt: pr.updatedAt
+				}));
+				await ingestPolledEvents(responsePullRequests.map((pullRequest) => polledPullRequestEvent(loaded.project, pullRequest)), options.ingestFactoryEvent);
+				return c.json({
+					pullRequests: responsePullRequests,
+					nextPage: nextCursor === null ? null : Number(nextCursor)
+				});
+			} catch (err) {
+				return c.json({
+					error: "github_fetch_failed",
+					message: err instanceof Error ? err.message : String(err)
+				}, 502);
+			}
+		}
+	}));
+	routes.push(registerApiRoute("/web/github/projects/:id/settings", {
+		method: "GET",
+		requiresAuth: false,
+		handler: async (c) => {
+			const loaded = await loadOrgProject({
+				github,
+				auth,
+				c: loose(c)
+			});
+			if ("response" in loaded) return loaded.response;
+			return c.json({ setupCommand: loaded.project.setupCommand });
+		}
+	}));
+	routes.push(registerApiRoute("/web/github/projects/:id/settings", {
+		method: "POST",
+		requiresAuth: false,
+		handler: async (c) => {
+			const loaded = await loadOrgProject({
+				github,
+				auth,
+				c: loose(c)
+			});
+			if ("response" in loaded) return loaded.response;
+			let body;
+			try {
+				body = await c.req.json();
+			} catch {
+				return c.json({ error: "Invalid JSON body" }, 400);
+			}
+			if (body.setupCommand !== null && typeof body.setupCommand !== "string") return c.json({ error: "Invalid setupCommand" }, 400);
+			if (typeof body.setupCommand === "string" && body.setupCommand.length > 2e3) return c.json({ error: "setupCommand too long (max 2000 characters)" }, 400);
+			if (typeof body.setupCommand === "string" && /[\0-\x08\x0b\x0c\x0e-\x1f\x7f]/.test(body.setupCommand)) return c.json({ error: "setupCommand contains control characters" }, 400);
+			const setupCommand = typeof body.setupCommand === "string" && body.setupCommand.trim().length > 0 ? body.setupCommand.trim() : null;
+			await github.sourceControlStorage.projectRepositories.update({
+				orgId: loaded.project.installation.orgId,
+				id: loaded.project.id,
+				input: { setupCommand }
+			});
+			return c.json({ setupCommand });
+		}
+	}));
+	const parsePatKind = (value) => {
+		if (value === void 0 || value === null || value === "default") return "default";
+		if (value === "reviewer") return "reviewer";
+		return null;
+	};
+	routes.push(registerApiRoute("/web/github/pat", {
+		method: "GET",
+		requiresAuth: false,
+		handler: async (c) => {
+			const resolved = await resolveOrgTenant(loose(c), auth);
+			if ("response" in resolved) return resolved.response;
+			return c.json(await getGithubPatStatus(() => github.integrationStorage, resolved.tenant.orgId));
+		}
+	}), registerApiRoute("/web/github/pat", {
+		method: "POST",
+		requiresAuth: false,
+		handler: async (c) => {
+			const resolved = await resolveOrgTenant(loose(c), auth);
+			if ("response" in resolved) return resolved.response;
+			let body;
+			try {
+				body = await c.req.json();
+			} catch {
+				return c.json({ error: "Invalid JSON body" }, 400);
+			}
+			const kind = parsePatKind(body.kind);
+			if (!kind) return c.json({ error: "kind must be 'default' or 'reviewer'" }, 400);
+			const token = typeof body.token === "string" ? body.token.trim() : "";
+			if (!token) return c.json({ error: "A token is required" }, 400);
+			if (token.length > 500) return c.json({ error: "Token too long (max 500 characters)" }, 400);
+			if (/\s/.test(token)) return c.json({ error: "Token must not contain whitespace" }, 400);
+			await setGithubPat(github.integrationStorage, resolved.tenant.orgId, token, kind);
+			return c.json(await getGithubPatStatus(() => github.integrationStorage, resolved.tenant.orgId));
+		}
+	}), registerApiRoute("/web/github/pat", {
+		method: "DELETE",
+		requiresAuth: false,
+		handler: async (c) => {
+			const resolved = await resolveOrgTenant(loose(c), auth);
+			if ("response" in resolved) return resolved.response;
+			const kind = parsePatKind(c.req.query("kind"));
+			if (!kind) return c.json({ error: "kind must be 'default' or 'reviewer'" }, 400);
+			await clearGithubPat(github.integrationStorage, resolved.tenant.orgId, kind);
+			return c.json(await getGithubPatStatus(() => github.integrationStorage, resolved.tenant.orgId));
+		}
+	}));
+	routes.push(...buildProjectGitRoutes({
+		github,
+		auth,
+		fleet,
+		emitAudit
+	}));
+	return routes;
+}
+/**
+* Load the org-owned project for a read-only GitHub API route. Unlike
+* `loadOwnedProject`, this never touches sandbox state — the issues/PR list
+* routes only need the repo + installation, so they work before a sandbox is
+* ever provisioned.
+*/
+async function loadOrgProject(options) {
+	const { github, auth, c } = options;
+	const resolved = await resolveOrgTenant(c, auth);
+	if ("response" in resolved) return { response: resolved.response };
+	const { orgId, userId } = resolved.tenant;
+	const projectRepositoryId = c.req.param("id");
+	if (!projectRepositoryId) return { response: c.json({ error: "Project repository not found" }, 404) };
+	const project = await resolveProjectRepository({
+		github,
+		orgId,
+		projectRepositoryId
+	});
+	if (!project) return { response: c.json({ error: "Project repository not found" }, 404) };
+	return {
+		project,
+		userId
+	};
+}
+/** Derive a commit/author identity from the authenticated host user. */
+function identityFromUser(user) {
+	const u = user;
+	return {
+		name: u?.name ?? null,
+		email: u?.email ?? null
+	};
+}
+/**
+* Resolve a live, started sandbox for the caller's per-user sandbox binding. The
+* sandbox must already have been provisioned (`sandboxId` set) — the git write
+* routes never clone, they operate on the existing checkout.
+*/
+async function resolveProjectSandbox(options) {
+	const { fleet, sandboxRow } = options;
+	if (!sandboxRow.sandboxId) throw new MaterializeError("Project sandbox is not provisioned. Open the project first.", "clone-failed");
+	return fleet.reattachSandbox(sandboxRow.sandboxId);
+}
+/**
+* Load (or create) the caller's per-(project,user) sandbox binding row. The
+* binding inherits its workdir from the org-owned project, but `sandboxId` /
+* `materializedAt` stay null until the user first opens the project.
+*/
+async function loadOrCreateSandboxRow(github, project, userId) {
+	return github.sourceControlStorage.sandboxes.getOrCreate({
+		projectRepository: project,
+		userId
+	});
+}
+/**
+* Provision/reattach the caller's sandbox and materialize the repo into it,
+* emitting coarse progress events as each server step happens. Shared by both
+* the JSON and SSE variants of the `/ensure` route. Throws on failure so the
+* caller can shape the response (HTTP status vs SSE `error` event).
+*/
+async function prepareProject(options) {
+	const { github, fleet, userId, onProgress } = options;
+	let project = options.project;
+	if (project.sandboxProvider !== fleet.provider) {
+		const sandboxWorkdir = fleet.computeWorkdir(project.repository.slug);
+		await github.sourceControlStorage.projectRepositories.update({
+			orgId: project.installation.orgId,
+			id: project.id,
+			input: {
+				sandboxProvider: fleet.provider,
+				sandboxWorkdir
+			}
+		});
+		project = {
+			...project,
+			sandboxProvider: fleet.provider,
+			sandboxWorkdir
+		};
+	}
+	let sandboxRow = await loadOrCreateSandboxRow(github, project, userId);
+	if (sandboxRow.sandboxWorkdir !== project.sandboxWorkdir) {
+		await github.sourceControlStorage.sandboxes.setWorkdir({
+			id: sandboxRow.id,
+			sandboxWorkdir: project.sandboxWorkdir
+		});
+		sandboxRow = {
+			...sandboxRow,
+			sandboxWorkdir: project.sandboxWorkdir,
+			materializedAt: null
+		};
+	}
+	const access = await github.versionControl.getRepositoryAccess({
+		orgId: project.installation.orgId,
+		repositoryId: project.repository.id
+	});
+	if (!access.authorization) throw new MaterializeError("Repository access did not include a bearer token.", "clone-failed");
+	const ghCliToken = await getGithubPat(() => github.integrationStorage, project.installation.orgId) ?? access.authorization.token;
+	const sandbox = await ensureProjectSandbox({
+		fleet,
+		row: sandboxRow,
+		storage: github.sourceControlStorage.sandboxes,
+		token: ghCliToken,
+		onProgress
+	});
+	const finalRow = await github.sourceControlStorage.sandboxes.getById({ id: sandboxRow.id }) ?? sandboxRow;
+	await materializeRepo({
+		row: finalRow,
+		repoInfo: {
+			repoFullName: project.repository.slug,
+			defaultBranch: project.defaultBranch
+		},
+		sandbox,
+		token: access.authorization.token,
+		storage: github.sourceControlStorage.sandboxes,
+		onProgress
+	});
+	const result = {
+		resourceId: project.factoryProjectId,
+		factoryProjectId: project.factoryProjectId,
+		projectRepositoryId: project.id,
+		sandboxId: finalRow.sandboxId,
+		sandboxWorkdir: finalRow.sandboxWorkdir
+	};
+	onProgress?.({
+		phase: "done",
+		message: "Workspace ready."
+	});
+	return result;
+}
+/** Shape an /ensure failure into an HTTP status + JSON body (also used as the SSE error payload). */
+function ensureErrorPayload(err) {
+	if (err instanceof SandboxBudgetError) return {
+		status: 429,
+		body: {
+			error: err.code,
+			message: err.message
+		}
+	};
+	if (err instanceof MaterializeError) return {
+		status: 502,
+		body: {
+			error: err.code,
+			message: err.message
+		}
+	};
+	return {
+		status: 500,
+		body: {
+			error: "materialize_failed",
+			message: err instanceof Error ? err.message : String(err)
+		}
+	};
+}
+/** Map a sandbox/worktree error to an actionable HTTP response. */
+function gitErrorResponse(c, err) {
+	if (err instanceof WorktreeError) return c.json({
+		error: err.code,
+		message: err.message
+	}, err.code === "invalid-branch" ? 400 : 502);
+	if (err instanceof MaterializeError) return c.json({
+		error: err.code,
+		message: err.message
+	}, 502);
+	return c.json({
+		error: "git_failed",
+		message: err instanceof Error ? err.message : String(err)
+	}, 500);
+}
+/**
+* Load the org-owned project and the caller's per-user sandbox binding for a git
+* route. Centralizes the auth + org/ownership checks every git route shares:
+* the project is scoped by `(id, orgId)`, the sandbox binding by
+* `(projectRepositoryId, userId)`. Returns the tenant, project, and sandbox row, or
+* a ready-to-return error response.
+*/
+async function loadOwnedProject(options) {
+	const { github, auth, fleet, c } = options;
+	const resolved = await resolveOrgTenant(c, auth);
+	if ("response" in resolved) return { response: resolved.response };
+	const { orgId, userId } = resolved.tenant;
+	if (!fleet.enabled) return { response: c.json({
+		error: "sandbox_not_configured",
+		message: "No sandbox provider is configured."
+	}, 503) };
+	const projectRepositoryId = c.req.param("id");
+	if (!projectRepositoryId) return { response: c.json({ error: "Project repository not found" }, 404) };
+	const project = await resolveProjectRepository({
+		github,
+		orgId,
+		projectRepositoryId
+	});
+	if (!project) return { response: c.json({ error: "Project repository not found" }, 404) };
+	return {
+		orgId,
+		userId,
+		project,
+		sandboxRow: await loadOrCreateSandboxRow(github, project, userId)
+	};
+}
+function buildProjectGitRoutes({ github, auth, fleet, emitAudit }) {
+	return [
+		registerApiRoute("/web/github/projects/:id/sessions", {
+			method: "GET",
+			requiresAuth: false,
+			handler: async (c) => {
+				const resolved = await resolveOrgTenant(loose(c), auth);
+				if ("response" in resolved) return resolved.response;
+				const { orgId, userId } = resolved.tenant;
+				const projectRepositoryId = c.req.param("id");
+				const project = projectRepositoryId ? await resolveProjectRepository({
+					github,
+					orgId,
+					projectRepositoryId
+				}) : null;
+				if (!project) return c.json({ error: "Project repository not found" }, 404);
+				const sessions = await github.sourceControlStorage.sessions.list({
+					projectRepositoryId: project.id,
+					userId
+				});
+				return c.json({ sessions });
+			}
+		}),
+		registerApiRoute("/web/github/projects/:id/sessions", {
+			method: "POST",
+			requiresAuth: false,
+			handler: async (c) => {
+				const resolved = await resolveOrgTenant(loose(c), auth);
+				if ("response" in resolved) return resolved.response;
+				const { orgId, userId } = resolved.tenant;
+				const projectRepositoryId = c.req.param("id");
+				const project = projectRepositoryId ? await resolveProjectRepository({
+					github,
+					orgId,
+					projectRepositoryId
+				}) : null;
+				if (!project) return c.json({ error: "Project repository not found" }, 404);
+				let body;
+				try {
+					body = await c.req.json();
+				} catch {
+					return c.json({ error: "Invalid JSON body" }, 400);
+				}
+				if (!isJsonObject(body)) return c.json({ error: "Invalid JSON body" }, 400);
+				const requestedBaseBranch = body.baseBranch;
+				if (requestedBaseBranch !== void 0 && typeof requestedBaseBranch !== "string") return c.json({ error: "Invalid baseBranch" }, 400);
+				const baseBranch = requestedBaseBranch ?? project.defaultBranch;
+				if (!isValidGitRef$1(baseBranch)) return c.json({ error: "Invalid baseBranch" }, 400);
+				const requestedSessionId = body.sessionId;
+				if (requestedSessionId !== void 0 && (typeof requestedSessionId !== "string" || !UUID_PATTERN.test(requestedSessionId))) return c.json({ error: "Invalid sessionId" }, 400);
+				const sessionId = requestedSessionId ?? randomUUID();
+				const requestedTitle = body.title;
+				if (requestedTitle !== void 0 && typeof requestedTitle !== "string") return c.json({ error: "Invalid title" }, 400);
+				const normalizedTitle = requestedTitle === void 0 ? null : normalizeSessionTitle(requestedTitle);
+				const requestedBranch = body.branch;
+				let branch;
+				if (requestedBranch === void 0) branch = `${USER_SESSION_BRANCH_PREFIX}${sessionId}`;
+				else if (typeof requestedBranch === "string" && isValidGitRef$1(requestedBranch)) branch = requestedBranch;
+				else return c.json({ error: "Invalid branch" }, 400);
+				if (requestedSessionId !== void 0) {
+					const existing = await github.sourceControlStorage.sessions.getBySessionId(sessionId);
+					if (existing) {
+						if (existing.projectRepositoryId !== project.id || existing.orgId !== orgId || existing.userId !== userId || existing.branch !== branch) return c.json({ error: "Session ID conflict" }, 409);
+						return c.json({ session: existing });
+					}
+				}
+				const session = await github.sourceControlStorage.sessions.create({
+					sessionId,
+					projectRepositoryId: project.id,
+					orgId,
+					userId,
+					branch,
+					baseBranch,
+					title: normalizedTitle
+				}).catch(async (error) => {
+					if (!(error instanceof UniqueViolationError) || requestedSessionId === void 0) throw error;
+					const conflict = await github.sourceControlStorage.sessions.getBySessionId(sessionId);
+					if (!conflict) throw error;
+					return conflict;
+				});
+				if (requestedSessionId !== void 0 && (session.sessionId !== sessionId || session.projectRepositoryId !== project.id || session.orgId !== orgId || session.userId !== userId || session.branch !== branch)) return c.json({ error: "Session ID conflict" }, 409);
+				return c.json({ session });
+			}
+		}),
+		registerApiRoute("/web/user-sessions/:sessionId", {
+			method: "GET",
+			requiresAuth: false,
+			handler: async (c) => {
+				const resolved = await resolveOrgTenant(loose(c), auth);
+				if ("response" in resolved) return resolved.response;
+				const session = await github.sourceControlStorage.sessions.getBySessionId(c.req.param("sessionId"));
+				if (!session || session.orgId !== resolved.tenant.orgId || session.userId !== resolved.tenant.userId) return c.json({ error: "Session not found" }, 404);
+				return c.json({ session });
+			}
+		}),
+		registerApiRoute("/web/user-sessions/:sessionId", {
+			method: "DELETE",
+			requiresAuth: false,
+			handler: async (c) => {
+				const resolved = await resolveOrgTenant(loose(c), auth);
+				if ("response" in resolved) return resolved.response;
+				const session = await github.sourceControlStorage.sessions.getBySessionId(c.req.param("sessionId"));
+				if (!session || session.orgId !== resolved.tenant.orgId || session.userId !== resolved.tenant.userId) return c.json({ error: "Session not found" }, 404);
+				await github.sourceControlStorage.sessions.delete(session.id);
+				reclaimDeletedSessionSandbox({
+					fleet,
+					sourceControl: github.sourceControlStorage,
+					session
+				}).catch((error) => {
+					console.error("[GitHub Sessions] Failed to reclaim sandbox for deleted session", {
+						sessionId: session.sessionId,
+						sandboxId: session.sandboxId,
+						error
+					});
+				});
+				return c.json({ removed: true });
+			}
+		}),
+		registerApiRoute("/web/github/projects/:id/commit", {
+			method: "POST",
+			requiresAuth: false,
+			handler: async (c) => {
+				const owned = await loadOwnedProject({
+					github,
+					auth,
+					fleet,
+					c: loose(c)
+				});
+				if ("response" in owned) return owned.response;
+				const { userId, project } = owned;
+				let body;
+				try {
+					body = await c.req.json();
+				} catch {
+					return c.json({ error: "Invalid JSON body" }, 400);
+				}
+				if (typeof body.message !== "string" || body.message.trim().length === 0 || body.message.length > 5e3) return c.json({ error: "Invalid message" }, 400);
+				const sessionWorkspace = await resolveSessionWorkspace(github, project.id, userId, body.sessionId);
+				if (!sessionWorkspace) return c.json({ error: "Invalid sessionId" }, 400);
+				const { workdir, sandboxBinding } = sessionWorkspace;
+				try {
+					return await withSessionOperationLock(sessionWorkspace.session.sessionId, async () => {
+						const result = await commitAll(await resolveProjectSandbox({
+							fleet,
+							sandboxRow: sandboxBinding
+						}), workdir, body.message, identityFromUser(await auth.ensureUser(loose(c))));
+						if (result.committed) await emitAudit?.({
+							context: loose(c),
+							input: {
+								action: "factory.git.commit",
+								factoryProjectId: project.factoryProjectId,
+								projectRepositoryId: project.id,
+								targets: [{
+									type: "session",
+									id: sessionWorkspace.session.sessionId
+								}],
+								metadata: { sessionId: sessionWorkspace.session.sessionId }
+							}
+						});
+						return c.json({ committed: result.committed });
+					});
+				} catch (err) {
+					return gitErrorResponse(loose(c), err);
+				}
+			}
+		}),
+		registerApiRoute("/web/github/projects/:id/push", {
+			method: "POST",
+			requiresAuth: false,
+			handler: async (c) => {
+				const owned = await loadOwnedProject({
+					github,
+					auth,
+					fleet,
+					c: loose(c)
+				});
+				if ("response" in owned) return owned.response;
+				const { orgId, userId, project } = owned;
+				let body;
+				try {
+					body = await c.req.json();
+				} catch {
+					return c.json({ error: "Invalid JSON body" }, 400);
+				}
+				if (!isValidGitRef$1(body.branch)) return c.json({ error: "Invalid branch" }, 400);
+				const branch = body.branch;
+				const sessionWorkspace = await resolveSessionWorkspace(github, project.id, userId, body.sessionId);
+				if (!sessionWorkspace) return c.json({ error: "Invalid sessionId" }, 400);
+				const { workdir, sandboxBinding } = sessionWorkspace;
+				try {
+					return await withSessionOperationLock(sessionWorkspace.session.sessionId, async () => {
+						const sandbox = await resolveProjectSandbox({
+							fleet,
+							sandboxRow: sandboxBinding
+						});
+						const access = await github.versionControl.getRepositoryAccess({
+							orgId,
+							repositoryId: project.repository.id
+						});
+						if (!access.authorization) throw new Error("Repository access did not include a bearer token.");
+						await pushBranch(sandbox, workdir, branch, access.authorization.token, project.repository.slug);
+						await emitAudit?.({
+							context: loose(c),
+							input: {
+								action: "factory.git.push",
+								factoryProjectId: project.factoryProjectId,
+								projectRepositoryId: project.id,
+								targets: [{
+									type: "branch",
+									id: branch
+								}],
+								metadata: {
+									branch,
+									sessionId: sessionWorkspace.session.sessionId
+								}
+							}
+						});
+						return c.json({
+							pushed: true,
+							branch
+						});
+					});
+				} catch (err) {
+					return gitErrorResponse(loose(c), err);
+				}
+			}
+		}),
+		registerApiRoute("/web/github/projects/:id/pr", {
+			method: "POST",
+			requiresAuth: false,
+			handler: async (c) => {
+				const owned = await loadOwnedProject({
+					github,
+					auth,
+					fleet,
+					c: loose(c)
+				});
+				if ("response" in owned) return owned.response;
+				const { orgId, userId, project } = owned;
+				let body;
+				try {
+					body = await c.req.json();
+				} catch {
+					return c.json({ error: "Invalid JSON body" }, 400);
+				}
+				if (!isValidGitRef$1(body.branch)) return c.json({ error: "Invalid branch" }, 400);
+				const base = body.base === void 0 ? project.defaultBranch : body.base;
+				if (!isValidGitRef$1(base)) return c.json({ error: "Invalid base" }, 400);
+				if (typeof body.title !== "string" || body.title.trim().length === 0 || body.title.length > 256) return c.json({ error: "Invalid title" }, 400);
+				if (body.body !== void 0 && (typeof body.body !== "string" || body.body.length > 65536)) return c.json({ error: "Invalid body" }, 400);
+				const head = body.branch;
+				const title = body.title;
+				const prBody = body.body;
+				const sessionWorkspace = await resolveSessionWorkspace(github, project.id, userId, body.sessionId);
+				if (!sessionWorkspace) return c.json({ error: "Invalid sessionId" }, 400);
+				try {
+					return await withSessionOperationLock(sessionWorkspace.session.sessionId, async () => {
+						const result = await github.versionControl.createPullRequest({
+							connection: {
+								type: "app-installation",
+								installationId: Number(project.installation.externalId)
+							},
+							sourceId: project.repository.slug,
+							baseBranch: base,
+							headBranch: head,
+							title,
+							body: prBody,
+							actingUserId: userId
+						});
+						await emitAudit?.({
+							context: loose(c),
+							input: {
+								action: "factory.git.pr_opened",
+								factoryProjectId: project.factoryProjectId,
+								projectRepositoryId: project.id,
+								targets: [{
+									type: "pull_request",
+									id: result.url,
+									name: title
+								}],
+								metadata: {
+									branch: head,
+									base,
+									url: result.url
+								}
+							}
+						});
+						const pullRequestNumber = pullRequestNumberFromUrl(result.url, project.repository.slug);
+						if (pullRequestNumber) {
+							const sessionId = sessionWorkspace.session.sessionId;
+							await subscribeToPullRequest({
+								orgId,
+								installationExternalId: project.installation.externalId,
+								projectRepositoryId: project.id,
+								repositoryExternalId: project.repository.externalId,
+								repositorySlug: project.repository.slug,
+								changeRequestId: pullRequestNumber.toString(),
+								sessionId,
+								ownerId: userId,
+								resourceId: sessionId,
+								threadId: sessionId,
+								source: "factory-pr-create",
+								subscribedByUserId: userId
+							}, github.integrationStorage).catch((error) => {
+								console.warn(`[GitHub] Pull request ${result.url} was created but automatic subscription failed.`, error);
+							});
+						}
+						return c.json({ url: result.url });
+					});
+				} catch (err) {
+					return c.json({
+						error: "github_pr_create_failed",
+						message: err instanceof Error ? err.message : String(err)
+					}, 502);
+				}
+			}
+		}),
+		registerApiRoute("/web/github/projects/:id/sandbox", {
+			method: "DELETE",
+			requiresAuth: false,
+			handler: async (c) => {
+				const owned = await loadOwnedProject({
+					github,
+					auth,
+					fleet,
+					c: loose(c)
+				});
+				if ("response" in owned) return owned.response;
+				const { sandboxRow } = owned;
+				if (!sandboxRow.sandboxId) return c.json({ tornDown: false });
+				try {
+					return await withSessionOperationLock(`sandbox:${sandboxRow.id}`, async () => {
+						const sandbox = await fleet.reattachSandbox(sandboxRow.sandboxId);
+						await teardownProjectSandbox({
+							fleet,
+							row: sandboxRow,
+							storage: github.sourceControlStorage.sandboxes,
+							sandbox
+						});
+						return c.json({ tornDown: true });
+					});
+				} catch (err) {
+					return gitErrorResponse(loose(c), err);
+				}
+			}
+		})
+	];
+}
+/** Resolve the materialized workspace owned by a Factory session. */
+async function resolveSessionWorkspace(github, projectId, userId, sessionId) {
+	if (typeof sessionId !== "string") return;
+	const session = await github.sourceControlStorage.sessions.getBySessionId(sessionId);
+	if (session?.projectRepositoryId !== projectId || session.userId !== userId || !session.sandboxId || !session.sandboxWorkdir) return;
+	return {
+		session,
+		workdir: session.sandboxWorkdir,
+		sandboxBinding: {
+			id: session.id,
+			projectRepositoryId: session.projectRepositoryId,
+			userId: session.userId,
+			sandboxId: session.sandboxId,
+			sandboxWorkdir: session.sandboxWorkdir,
+			materializedAt: session.materializedAt,
+			createdAt: session.createdAt
+		}
+	};
+}
+//#endregion
+export { buildGithubRoutes };
+
+//# sourceMappingURL=routes.js.map