@mastra/factory 0.0.0 → 0.1.0-alpha.2

package/dist/integrations/github/routes.js

@@ -0,0 +1,1832 @@
+// src/integrations/github/routes.ts
+import { randomUUID } from "crypto";
+import { registerApiRoute } from "@mastra/core/server";
+import { streamSSE } from "hono/streaming";
+
+// src/sandbox/fleet.ts
+import path from "path";
+function reportProgress(onProgress, event) {
+  if (!onProgress) return;
+  try {
+    onProgress(event);
+  } catch {
+  }
+}
+var SandboxBudgetError = class extends Error {
+  constructor(max) {
+    super(
+      `Sandbox budget exceeded: this server already has ${max} active sandbox(es), the configured per-replica maximum. Close an existing repository's sandbox and try again.`
+    );
+    this.max = max;
+    this.name = "SandboxBudgetError";
+  }
+  max;
+  code = "sandbox-budget-exceeded";
+};
+
+// src/integrations/github/config.ts
+var GITHUB_APP_ENV_VARS = [
+  "GITHUB_APP_ID",
+  "GITHUB_APP_PRIVATE_KEY",
+  "GITHUB_APP_CLIENT_ID",
+  "GITHUB_APP_CLIENT_SECRET",
+  "GITHUB_APP_SLUG"
+];
+function isGithubFeatureEnabled(options) {
+  return options.github !== void 0 && options.auth.enabled();
+}
+function getGithubFeatureDiagnostics(options) {
+  const { github, auth, appDbConfigured, stateSigner, fleet } = options;
+  return {
+    githubAppConfigured: github !== void 0,
+    factoryAuthEnabled: auth.enabled(),
+    appDbConfigured,
+    stateSecretConfigured: stateSigner?.stable ?? false,
+    sandboxEnabled: fleet?.enabled ?? false,
+    sandboxProvider: fleet?.provider ?? "none",
+    missingGithubAppEnvVars: github ? [] : [...GITHUB_APP_ENV_VARS]
+  };
+}
+
+// src/integrations/github/project-lock.ts
+import { createHash } from "crypto";
+var inProcessLocks = /* @__PURE__ */ new Map();
+function hashKey(key) {
+  const digest = createHash("sha256").update(key).digest();
+  const a = digest.readInt32BE(0);
+  const b = digest.readInt32BE(4);
+  return [a, b];
+}
+function withProjectLock(options) {
+  const { key, storage, fn, pool } = options;
+  const prev = inProcessLocks.get(key) ?? Promise.resolve();
+  const run = () => withDbAdvisoryLock({ key, storage, fn, pool });
+  const next = prev.then(run, run);
+  const tail = next.then(
+    () => void 0,
+    () => void 0
+  );
+  inProcessLocks.set(key, tail);
+  void tail.then(() => {
+    if (inProcessLocks.get(key) === tail) {
+      inProcessLocks.delete(key);
+    }
+  });
+  return next;
+}
+async function withDbAdvisoryLock(options) {
+  const { key, storage, fn, pool } = options;
+  if (process.env.MASTRACODE_DISTRIBUTED_LOCK === "0") {
+    return fn();
+  }
+  if (pool) return advisoryLockOver(pool, key, fn);
+  if (typeof storage?.withDistributedLock !== "function") {
+    return fn();
+  }
+  return storage.withDistributedLock(key, fn);
+}
+async function advisoryLockOver(pool, key, fn) {
+  const [k1, k2] = hashKey(key);
+  const client = await pool.connect();
+  try {
+    await client.query("BEGIN");
+    await client.query("SELECT pg_advisory_xact_lock($1, $2)", [k1, k2]);
+    try {
+      const result = await fn();
+      await client.query("COMMIT");
+      return result;
+    } catch (err) {
+      await client.query("ROLLBACK");
+      throw err;
+    }
+  } finally {
+    client.release();
+  }
+}
+
+// src/integrations/github/sandbox.ts
+import { createHash as createHash2 } from "crypto";
+function bindingStore(row, storage) {
+  return {
+    sandboxId: row.sandboxId,
+    setSandboxId: (id) => id === null ? storage.clearBinding({ id: row.id }) : storage.setSandboxId({ id: row.id, sandboxId: id }),
+    clear: () => storage.clearBinding({ id: row.id })
+  };
+}
+async function ensureProjectSandbox(options) {
+  const { fleet, row, storage, onProgress } = options;
+  return fleet.ensureSandbox(bindingStore(row, storage), onProgress);
+}
+async function teardownProjectSandbox(options) {
+  const { fleet, row, storage, sandbox } = options;
+  return fleet.teardownSandbox(bindingStore(row, storage), sandbox);
+}
+function shellQuote(value) {
+  return `'` + value.split(`'`).join(`'\\''`) + `'`;
+}
+async function sh(sandbox, script) {
+  return sandbox.executeCommand("sh", ["-c", script]);
+}
+var MaterializeError = class extends Error {
+  constructor(message, code) {
+    super(message);
+    this.code = code;
+    this.name = "MaterializeError";
+  }
+  code;
+};
+function tokenUrl(repoFullName, token) {
+  return `https://x-access-token:${token}@github.com/${repoFullName}.git`;
+}
+function cleanUrl(repoFullName) {
+  return `https://github.com/${repoFullName}.git`;
+}
+async function materializeRepo(options) {
+  const { row: sandboxRow, repoInfo, sandbox, token, storage, onProgress } = options;
+  const workdir = sandboxRow.sandboxWorkdir;
+  const repo = repoInfo.repoFullName;
+  if (!/^[\w.-]+\/[\w.-]+$/.test(repo)) {
+    throw new MaterializeError(`Refusing to materialize: invalid repo full name '${repo}'.`, "clone-failed");
+  }
+  if (!/^[A-Za-z0-9_./-]+$/.test(repoInfo.defaultBranch)) {
+    throw new MaterializeError(
+      `Refusing to materialize: invalid default branch '${repoInfo.defaultBranch}'.`,
+      "clone-failed"
+    );
+  }
+  const gitVersion = await sh(sandbox, "git --version");
+  if (gitVersion.exitCode !== 0) {
+    throw new MaterializeError(
+      "git is not installed in the sandbox. The sandbox template must include git.",
+      "git-missing"
+    );
+  }
+  const authUrl = tokenUrl(repo, token);
+  const alreadyMaterialized = Boolean(sandboxRow.materializedAt) || await hasExistingCheckout(sandbox, workdir, repo);
+  try {
+    if (!alreadyMaterialized) {
+      reportProgress(onProgress, {
+        phase: "cloning",
+        message: `Cloning ${repo} (first open can take a minute)\u2026`
+      });
+      const clone = await sh(
+        sandbox,
+        `git clone --depth=1 --single-branch --branch ${shellQuote(repoInfo.defaultBranch)} ${shellQuote(authUrl)} ${shellQuote(workdir)}`
+      );
+      if (clone.exitCode !== 0) {
+        throw classifyGitFailure(clone, "clone-failed");
+      }
+    } else {
+      reportProgress(onProgress, { phase: "pulling", message: `Updating ${repo} to the latest changes\u2026` });
+      const setUrl = await sh(sandbox, `git -C ${shellQuote(workdir)} remote set-url origin ${shellQuote(authUrl)}`);
+      if (setUrl.exitCode !== 0) {
+        throw new MaterializeError(`Failed to set git remote: ${setUrl.stderr}`, "pull-failed");
+      }
+      const pull = await sh(sandbox, `git -C ${shellQuote(workdir)} pull --ff-only`);
+      if (pull.exitCode !== 0) {
+        throw classifyGitFailure(pull, "pull-failed");
+      }
+    }
+  } finally {
+    await scrubRemote(sandbox, workdir, repo, alreadyMaterialized);
+  }
+  reportProgress(onProgress, { phase: "finalizing", message: "Finalizing workspace\u2026" });
+  await storage.markMaterialized({ id: sandboxRow.id });
+}
+async function hasExistingCheckout(sandbox, workdir, repoFullName) {
+  const result = await sh(sandbox, `git -C ${shellQuote(workdir)} remote get-url origin`);
+  if (result.exitCode !== 0) return false;
+  const url = result.stdout.trim().toLowerCase();
+  const suffix = `github.com/${repoFullName.toLowerCase()}`;
+  return url.endsWith(`${suffix}.git`) || url.endsWith(suffix);
+}
+async function scrubRemote(sandbox, workdir, repoFullName, expectGitDir) {
+  const result = await sh(
+    sandbox,
+    `git -C ${shellQuote(workdir)} remote set-url origin ${shellQuote(cleanUrl(repoFullName))}`
+  );
+  if (result.exitCode !== 0 && expectGitDir) {
+    throw new MaterializeError(
+      `Failed to scrub installation token from git remote: ${result.stderr.trim() || result.stdout.trim()}`,
+      "pull-failed"
+    );
+  }
+}
+function classifyGitFailure(result, fallback) {
+  const stderr = result.stderr || "";
+  if (/could not resolve host|failed to connect|network is unreachable|Connection timed out/i.test(stderr)) {
+    return new MaterializeError(
+      "The sandbox could not reach github.com. The sandbox network must allow outbound egress to github.com.",
+      "egress-blocked"
+    );
+  }
+  const verb = fallback === "clone-failed" ? "clone" : fallback === "pull-failed" ? "pull" : "push";
+  return new MaterializeError(`git ${verb} failed: ${stderr}`, fallback);
+}
+function isValidGitRef(value) {
+  return typeof value === "string" && value.length > 0 && value.length <= 255 && // Reject leading-dash refs (e.g. `--mirror`) so the value can never be
+  // parsed as a git option when interpolated into a command.
+  !value.startsWith("-") && /^[A-Za-z0-9_./-]+$/.test(value);
+}
+function resolveGitIdentity(identity) {
+  const login = (identity.login || "").trim();
+  const name = (identity.name || "").trim() || login || "Mastra Code";
+  const email = (identity.email || "").trim() || (login ? `${login}@users.noreply.github.com` : "mastra-code@users.noreply.github.com");
+  return { name, email };
+}
+async function configureGitIdentity(sandbox, workdir, identity) {
+  const { name, email } = resolveGitIdentity(identity);
+  const setName = await sh(sandbox, `git -C ${shellQuote(workdir)} config user.name ${shellQuote(name)}`);
+  if (setName.exitCode !== 0) {
+    throw new MaterializeError(`Failed to set git user.name: ${setName.stderr.trim()}`, "commit-failed");
+  }
+  const setEmail = await sh(sandbox, `git -C ${shellQuote(workdir)} config user.email ${shellQuote(email)}`);
+  if (setEmail.exitCode !== 0) {
+    throw new MaterializeError(`Failed to set git user.email: ${setEmail.stderr.trim()}`, "commit-failed");
+  }
+}
+async function withInstallToken(sandbox, workdir, repoFullName, token, fn) {
+  if (!/^[\w.-]+\/[\w.-]+$/.test(repoFullName)) {
+    throw new MaterializeError(`Refusing to push: invalid repo full name '${repoFullName}'.`, "push-failed");
+  }
+  const setUrl = await sh(
+    sandbox,
+    `git -C ${shellQuote(workdir)} remote set-url origin ${shellQuote(tokenUrl(repoFullName, token))}`
+  );
+  if (setUrl.exitCode !== 0) {
+    await scrubRemote(sandbox, workdir, repoFullName, false);
+    throw new MaterializeError(`Failed to set git remote: ${setUrl.stderr.trim()}`, "push-failed");
+  }
+  try {
+    return await fn();
+  } finally {
+    await scrubRemote(sandbox, workdir, repoFullName, true);
+  }
+}
+async function pushBranch(sandbox, workdir, branch, token, repoFullName) {
+  if (!isValidGitRef(branch)) {
+    throw new MaterializeError(`Refusing to push: invalid branch name '${branch}'.`, "push-failed");
+  }
+  await withInstallToken(sandbox, workdir, repoFullName, token, async () => {
+    const push = await sh(sandbox, `git -C ${shellQuote(workdir)} push -u origin ${shellQuote(branch)}`);
+    if (push.exitCode !== 0) {
+      throw classifyGitFailure(push, "push-failed");
+    }
+  });
+}
+async function commitAll(sandbox, workdir, message, identity) {
+  await configureGitIdentity(sandbox, workdir, identity);
+  const add = await sh(sandbox, `git -C ${shellQuote(workdir)} add -A`);
+  if (add.exitCode !== 0) {
+    throw new MaterializeError(`git add failed: ${add.stderr.trim() || add.stdout.trim()}`, "commit-failed");
+  }
+  const staged = await sh(sandbox, `git -C ${shellQuote(workdir)} diff --cached --quiet`);
+  if (staged.exitCode === 0) {
+    return { committed: false };
+  }
+  const commit = await sh(sandbox, `git -C ${shellQuote(workdir)} commit -m ${shellQuote(message)}`);
+  if (commit.exitCode !== 0) {
+    throw new MaterializeError(`git commit failed: ${commit.stderr.trim() || commit.stdout.trim()}`, "commit-failed");
+  }
+  return { committed: true };
+}
+var WorktreeError = class extends Error {
+  constructor(message, code) {
+    super(message);
+    this.code = code;
+    this.name = "WorktreeError";
+  }
+  code;
+};
+function safeBranchDir(branch) {
+  const sanitized = branch.replace(/[^A-Za-z0-9._-]+/g, "-").replace(/\/+/g, "-").replace(/^[-.]+|[-.]+$/g, "").slice(0, 100) || "work";
+  if (sanitized === branch) return sanitized;
+  const hash = createHash2("sha256").update(branch).digest("hex").slice(0, 8);
+  return `${sanitized}-${hash}`;
+}
+function computeWorktreePath(repoWorkdir, branch) {
+  const parent = repoWorkdir.replace(/\/+$/, "").split("/").slice(0, -1).join("/") || "";
+  return `${parent}/worktrees/${safeBranchDir(branch)}`;
+}
+
+// src/integrations/github/subscriptions.ts
+function changeRequestTargetKey(input) {
+  return `change-request:${input.installationExternalId}:${input.repositoryExternalId}:${input.changeRequestId}`;
+}
+function sameSession(row, input) {
+  return row.orgId === input.orgId && row.sessionId === input.sessionId && row.resourceId === input.resourceId && row.threadId === input.threadId && (row.sessionScope ?? "") === (input.sessionScope ?? "");
+}
+async function subscribeToPullRequest(input, storage) {
+  const targetKey = changeRequestTargetKey(input);
+  const existing = (await storage.subscriptions.listByTarget(targetKey)).find((row) => sameSession(row, input));
+  if (existing) {
+    if (existing.status !== "open") await storage.subscriptions.updateStatus(existing.id, "open");
+    return { ...existing, status: "open" };
+  }
+  return storage.subscriptions.create({
+    orgId: input.orgId,
+    targetKey,
+    sessionId: input.sessionId,
+    resourceId: input.resourceId,
+    threadId: input.threadId,
+    sessionScope: input.sessionScope ?? "",
+    status: "open",
+    data: {
+      installationExternalId: input.installationExternalId,
+      projectRepositoryId: input.projectRepositoryId,
+      repositoryExternalId: input.repositoryExternalId,
+      repositorySlug: input.repositorySlug,
+      changeRequestId: input.changeRequestId,
+      ownerId: input.ownerId,
+      source: input.source,
+      subscribedByUserId: input.subscribedByUserId ?? null
+    }
+  });
+}
+async function listPullRequestSubscriptionsForThread(input, storage) {
+  const rows = await storage.subscriptions.listByThread(input.resourceId, input.threadId);
+  return rows.filter(
+    (row) => row.orgId === input.orgId && row.resourceId === input.resourceId && row.threadId === input.threadId && (row.sessionScope ?? "") === (input.sessionScope ?? "")
+  );
+}
+async function listPullRequestSubscriptionsForWebhook(input, options, storage) {
+  const rows = await storage.subscriptions.listByTarget(changeRequestTargetKey(input));
+  return options?.includeTerminal ? rows : rows.filter((row) => row.status === "open");
+}
+function retirePullRequestSubscription(id, status, storage) {
+  return storage.subscriptions.updateStatus(id, status);
+}
+
+// src/integrations/github/webhook.ts
+import { createHmac, timingSafeEqual } from "crypto";
+var SUPPORTED_GITHUB_WEBHOOK_EVENTS = /* @__PURE__ */ new Set([
+  "issues",
+  "issue_comment",
+  "pull_request",
+  "pull_request_review",
+  "pull_request_review_comment"
+]);
+function normalizeHeader(value) {
+  if (!value) return null;
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+function verifySignature(rawBody, signature, secret) {
+  if (!signature.startsWith("sha256=")) return false;
+  const signatureHex = signature.slice("sha256=".length);
+  if (!/^[a-fA-F0-9]{64}$/.test(signatureHex)) return false;
+  const expectedHex = createHmac("sha256", secret).update(rawBody).digest("hex");
+  const received = Buffer.from(signatureHex, "hex");
+  const expected = Buffer.from(expectedHex, "hex");
+  return received.length === expected.length && timingSafeEqual(received, expected);
+}
+async function parseGithubWebhook(c, secret) {
+  if (!secret) {
+    return { status: 401, body: { error: "unauthorized", message: "GitHub webhook secret is not configured" } };
+  }
+  const event = normalizeHeader(c.req.header("x-github-event"));
+  const deliveryId = normalizeHeader(c.req.header("x-github-delivery"));
+  const signature = normalizeHeader(c.req.header("x-hub-signature-256"));
+  if (!event) return { status: 400, body: { error: "bad_request", message: "Missing x-github-event header" } };
+  if (!deliveryId) return { status: 400, body: { error: "bad_request", message: "Missing x-github-delivery header" } };
+  if (!signature)
+    return { status: 401, body: { error: "unauthorized", message: "Missing x-hub-signature-256 header" } };
+  const rawBody = await c.req.text();
+  if (!verifySignature(rawBody, signature, secret)) {
+    return { status: 401, body: { error: "unauthorized", message: "Invalid GitHub webhook signature" } };
+  }
+  let payload;
+  try {
+    payload = JSON.parse(rawBody);
+  } catch {
+    return { status: 400, body: { error: "bad_request", message: "Malformed JSON payload" } };
+  }
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+    return { status: 400, body: { error: "bad_request", message: "Payload must be a JSON object" } };
+  }
+  return { event, deliveryId, payload };
+}
+function getObject(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+function getString(value) {
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function getNumber(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+function getBoolean(value) {
+  return typeof value === "boolean" ? value : void 0;
+}
+function getLabels(value) {
+  if (!Array.isArray(value)) return [];
+  return value.map((label) => typeof label === "string" ? label : getString(getObject(label)?.name)).filter((label) => Boolean(label));
+}
+function getIssueTriageRunInput(parsed) {
+  if (parsed.event !== "issues" || getString(parsed.payload.action) !== "opened") return null;
+  const repository = getString(getObject(parsed.payload.repository)?.full_name);
+  const issue = getObject(parsed.payload.issue);
+  const sender = getString(getObject(parsed.payload.sender)?.login);
+  const installationId = getNumber(getObject(parsed.payload.installation)?.id);
+  const issueNumber = getNumber(issue?.number);
+  const issueTitle = getString(issue?.title);
+  const issueUrl = getString(issue?.html_url);
+  if (!repository || !installationId || !issueNumber || !issueTitle || !issueUrl) return null;
+  return {
+    repository,
+    issueNumber,
+    issueTitle,
+    issueUrl,
+    labels: getLabels(issue?.labels),
+    sender,
+    installationId
+  };
+}
+function normalizeGithubWebhookMetadata(parsed) {
+  const { event, deliveryId, payload } = parsed;
+  const repository = getObject(payload.repository);
+  const issue = getObject(payload.issue);
+  const pullRequest = getObject(payload.pull_request);
+  const sender = getObject(payload.sender);
+  const installation = getObject(payload.installation);
+  const issuePullRequest = getObject(issue?.pull_request);
+  return {
+    event,
+    action: getString(payload.action),
+    deliveryId,
+    repository: getString(repository?.full_name),
+    repositoryId: getNumber(repository?.id),
+    issueNumber: getNumber(issue?.number),
+    pullRequestNumber: getNumber(pullRequest?.number) ?? (event === "issue_comment" && issuePullRequest ? getNumber(issue?.number) : void 0),
+    sender: getString(sender?.login),
+    senderType: getString(sender?.type),
+    installationId: getNumber(installation?.id)
+  };
+}
+function notificationSummary(metadata, label) {
+  const actor = metadata.sender ? `${metadata.sender} ` : "";
+  return `${actor}${label} on ${metadata.repository}#${metadata.pullRequestNumber}`;
+}
+function notificationTargetUrl(event, payload) {
+  if (event === "issue_comment" || event === "pull_request_review_comment") {
+    return getString(getObject(payload.comment)?.html_url);
+  }
+  if (event === "pull_request_review") {
+    return getString(getObject(payload.review)?.html_url);
+  }
+  return getString(getObject(payload.pull_request)?.html_url);
+}
+function classifyGithubWebhook(parsed) {
+  const metadata = normalizeGithubWebhookMetadata(parsed);
+  const { event, payload } = parsed;
+  const action = metadata.action;
+  if (!action || !metadata.repositoryId || !metadata.installationId || !metadata.pullRequestNumber || !metadata.repository) {
+    return void 0;
+  }
+  let priority;
+  let kind;
+  let label;
+  let terminal = false;
+  if (event === "pull_request_review" && action === "submitted") {
+    const state = getString(getObject(payload.review)?.state)?.toLowerCase().replaceAll("_", "-");
+    priority = state === "approved" || state === "changes-requested" ? "urgent" : "high";
+    kind = state === "approved" ? "review-approved" : state === "changes-requested" ? "review-changes-requested" : "review-submitted";
+    label = state === "approved" ? "approved the pull request" : state === "changes-requested" ? "requested changes" : "submitted a review";
+  } else if (event === "pull_request" && action === "closed") {
+    const merged = getBoolean(getObject(payload.pull_request)?.merged) === true;
+    priority = "urgent";
+    kind = merged ? "pull-request-merged" : "pull-request-closed";
+    label = merged ? "merged the pull request" : "closed the pull request";
+    terminal = true;
+  } else if (event === "issue_comment" && action === "created") {
+    priority = "high";
+    kind = "issue-comment-created";
+    label = "commented";
+  } else if (event === "pull_request_review_comment" && action === "created") {
+    priority = "high";
+    kind = "review-comment-created";
+    label = "left a review comment";
+  } else if (event === "pull_request" && action === "reopened") {
+    priority = "high";
+    kind = "pull-request-reopened";
+    label = "reopened the pull request";
+  } else if (event === "pull_request_review" && action === "dismissed") {
+    priority = "high";
+    kind = "review-dismissed";
+    label = "dismissed a review";
+  } else if (event === "pull_request" && [
+    "synchronize",
+    "ready_for_review",
+    "converted_to_draft",
+    "assigned",
+    "unassigned",
+    "review_requested",
+    "review_request_removed"
+  ].includes(action)) {
+    priority = "medium";
+    kind = `pull-request-${action.replaceAll("_", "-")}`;
+    label = action.replaceAll("_", " ");
+  } else if (event === "pull_request" && ["edited", "labeled", "unlabeled", "milestoned", "demilestoned"].includes(action)) {
+    priority = "low";
+    kind = `pull-request-${action.replaceAll("_", "-")}`;
+    label = action.replaceAll("_", " ");
+  } else {
+    return void 0;
+  }
+  return {
+    action,
+    kind,
+    priority,
+    summary: notificationSummary(metadata, label),
+    terminal,
+    metadata: {
+      ...metadata,
+      pullRequestNumber: metadata.pullRequestNumber,
+      repositoryId: metadata.repositoryId,
+      installationId: metadata.installationId
+    },
+    payload
+  };
+}
+async function resolveSubscriptionSession(controller, subscription) {
+  const { sessionId, resourceId, threadId } = subscription;
+  if (!sessionId || !resourceId || !threadId) {
+    throw new Error(`GitHub subscription ${subscription.id} is missing its session binding.`);
+  }
+  const scope = subscription.sessionScope || void 0;
+  let session = await controller.getSessionByResource(resourceId, scope);
+  if (!session) {
+    const tags = {
+      factoryProjectId: resourceId,
+      projectRepositoryId: subscription.data.projectRepositoryId,
+      ...scope ? { worktreePath: scope } : {}
+    };
+    session = await controller.createSession({
+      id: sessionId,
+      ownerId: subscription.data.ownerId,
+      resourceId,
+      scope,
+      tags
+    });
+  }
+  if (session.thread.getId() !== threadId) {
+    await session.thread.switch({ threadId, emitEvent: false });
+  }
+  if (session.thread.getId() !== threadId) {
+    throw new Error(`Session ${sessionId} did not bind thread ${threadId}.`);
+  }
+  return session;
+}
+var AUTHORIZED_BOTS = /* @__PURE__ */ new Set(["coderabbitai[bot]", "devin-ai-integration[bot]"]);
+var AUTHORIZED_PERMISSIONS = /* @__PURE__ */ new Set(["admin", "maintain", "write"]);
+var PERMISSION_CHECK_TIMEOUT_MS = 5e3;
+var AUTHOR_GATED_KINDS = /* @__PURE__ */ new Set([
+  "issue-comment-created",
+  "review-comment-created",
+  "review-submitted",
+  "review-approved",
+  "review-changes-requested",
+  "review-dismissed"
+]);
+async function isAuthorizedGithubSender(notification, github) {
+  if (!AUTHOR_GATED_KINDS.has(notification.kind)) return true;
+  const sender = notification.metadata.sender;
+  const repository = notification.metadata.repository;
+  if (!sender || !repository) return false;
+  const normalizedSender = sender.toLowerCase();
+  if (notification.metadata.senderType?.toLowerCase() === "bot" || normalizedSender.endsWith("[bot]")) {
+    return AUTHORIZED_BOTS.has(normalizedSender);
+  }
+  if (!github) return false;
+  const abortController = new AbortController();
+  let timeout;
+  try {
+    const permission = await Promise.race([
+      github.getRepositoryCollaboratorPermission(
+        notification.metadata.installationId,
+        repository,
+        sender,
+        abortController.signal
+      ),
+      new Promise((resolve) => {
+        timeout = setTimeout(() => {
+          abortController.abort();
+          resolve(void 0);
+        }, PERMISSION_CHECK_TIMEOUT_MS);
+      })
+    ]);
+    return permission !== void 0 && AUTHORIZED_PERMISSIONS.has(permission);
+  } catch {
+    return false;
+  } finally {
+    if (timeout) clearTimeout(timeout);
+  }
+}
+async function dispatchGithubWebhook(parsed, dependencies) {
+  const notification = classifyGithubWebhook(parsed);
+  if (!notification) return { delivered: 0, failed: 0, ignored: true };
+  const isAuthorizedSender = dependencies.isAuthorizedSender ?? ((n) => isAuthorizedGithubSender(n, dependencies.github));
+  if (!await isAuthorizedSender(notification)) {
+    return { delivered: 0, failed: 0, ignored: true };
+  }
+  const target = {
+    installationExternalId: notification.metadata.installationId.toString(),
+    repositoryExternalId: notification.metadata.repositoryId.toString(),
+    changeRequestId: notification.metadata.pullRequestNumber.toString()
+  };
+  const listSubscriptions = dependencies.listSubscriptions ?? ((subscriptionTarget, options) => {
+    if (!dependencies.github) throw new Error("GitHub integration is required to load webhook subscriptions.");
+    return listPullRequestSubscriptionsForWebhook(
+      subscriptionTarget,
+      options,
+      dependencies.github.integrationStorage
+    );
+  });
+  const retireSubscription = dependencies.retireSubscription ?? ((id, status) => {
+    if (!dependencies.github) throw new Error("GitHub integration is required to retire webhook subscriptions.");
+    return retirePullRequestSubscription(id, status, dependencies.github.integrationStorage);
+  });
+  const subscriptions = await listSubscriptions(target, { includeTerminal: notification.action === "reopened" });
+  let delivered = 0;
+  let failed = 0;
+  for (const subscription of subscriptions) {
+    try {
+      const session = await resolveSubscriptionSession(dependencies.controller, subscription);
+      const result = await session.sendNotificationSignal({
+        source: "github",
+        kind: notification.kind,
+        summary: notification.summary,
+        priority: notification.priority,
+        payload: notification.payload,
+        sourceId: parsed.deliveryId,
+        dedupeKey: `${parsed.deliveryId}:${subscription.sessionId}:${subscription.threadId}`,
+        coalesceKey: `github:${subscription.data.repositoryExternalId}:pull-request:${subscription.data.changeRequestId}`,
+        metadata: {
+          event: notification.metadata.event,
+          action: notification.action,
+          repository: notification.metadata.repository,
+          issueNumber: notification.metadata.issueNumber,
+          pullRequestNumber: notification.metadata.pullRequestNumber,
+          targetUrl: notificationTargetUrl(parsed.event, parsed.payload),
+          deliveryId: parsed.deliveryId
+        }
+      });
+      await Promise.all([result.persisted, result.accepted].filter(Boolean));
+      if (notification.terminal) {
+        await retireSubscription(subscription.id, notification.kind === "pull-request-merged" ? "merged" : "closed");
+      } else if (notification.action === "reopened") {
+        await retireSubscription(subscription.id, "open");
+      }
+      delivered += 1;
+    } catch (error) {
+      failed += 1;
+      dependencies.onTargetError?.(subscription, error);
+    }
+  }
+  return { delivered, failed, ignored: false };
+}
+async function handleGithubWebhook(c, options) {
+  const parsed = await parseGithubWebhook(c, options.github.webhookSecret);
+  if ("status" in parsed) return parsed;
+  if (!SUPPORTED_GITHUB_WEBHOOK_EVENTS.has(parsed.event)) {
+    return { status: 202, body: { ok: true, ignored: true } };
+  }
+  const metadata = normalizeGithubWebhookMetadata(parsed);
+  console.info("[GitHub Webhook]", metadata);
+  if (options.ingestFactoryEvent) {
+    await options.ingestFactoryEvent(parsed);
+  } else {
+    const issueTriageRun = getIssueTriageRunInput(parsed);
+    if (issueTriageRun && options.runIssueTriage) {
+      void options.runIssueTriage(issueTriageRun).catch((error) => {
+        console.error("[GitHub Webhook] Failed to run issue triage", {
+          deliveryId: metadata.deliveryId,
+          repository: metadata.repository,
+          issueNumber: metadata.issueNumber,
+          error: error instanceof Error ? error.message : String(error)
+        });
+      });
+    }
+  }
+  if (!options.controller) {
+    return { status: 202, body: { ok: true } };
+  }
+  const result = await dispatchGithubWebhook(parsed, options);
+  if (result.failed > 0) {
+    console.warn(`[GitHub Webhook] ${result.failed} subscribed target(s) failed for delivery ${parsed.deliveryId}.`);
+  }
+  return { status: 202, body: { ok: true, ...result.ignored ? { ignored: true } : {} } };
+}
+
+// src/integrations/github/routes.ts
+function loose(c) {
+  return c;
+}
+async function resolveFactoryDefaultModelId(projects, factoryProjectId) {
+  if (!projects || !factoryProjectId) return void 0;
+  try {
+    const project = await projects.getById({ id: factoryProjectId });
+    return project?.defaultModelId ?? void 0;
+  } catch {
+    return void 0;
+  }
+}
+function pullRequestNumberFromUrl(value, expectedRepo) {
+  try {
+    const url = new URL(value);
+    const match = url.pathname.match(/^\/([^/]+\/[^/]+)\/pull\/(\d+)\/?$/);
+    if (url.protocol !== "https:" || url.hostname !== "github.com" || match?.[1]?.toLowerCase() !== expectedRepo.toLowerCase()) {
+      return void 0;
+    }
+    const number = Number(match[2]);
+    return Number.isInteger(number) && number > 0 ? number : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function isCanonicalGithubIssueUrl(value, repoFullName, issueNumber) {
+  try {
+    const url = new URL(value);
+    const [owner, repo] = repoFullName.split("/");
+    return url.protocol === "https:" && url.hostname === "github.com" && url.pathname === `/${owner}/${repo}/issues/${issueNumber}` && url.search === "" && url.hash === "";
+  } catch {
+    return false;
+  }
+}
+function isValidGitRef2(value) {
+  return typeof value === "string" && value.length > 0 && value.length <= 255 && /^[A-Za-z0-9_./-]+$/.test(value);
+}
+async function resolveOrgTenant(c, auth) {
+  await auth.ensureUser(c);
+  const tenant = auth.tenant(c);
+  if (!tenant) return { response: c.json({ error: "unauthorized" }, 401) };
+  if (!tenant.orgId) {
+    return {
+      response: c.json(
+        {
+          error: "organization_required",
+          message: "GitHub projects require a WorkOS organization. Personal accounts cannot connect repositories."
+        },
+        403
+      )
+    };
+  }
+  return { tenant: { orgId: tenant.orgId, userId: tenant.userId } };
+}
+function parseListPage(raw) {
+  if (raw === void 0) return 1;
+  if (!/^\d{1,5}$/.test(raw)) return null;
+  const page = Number(raw);
+  return page >= 1 ? page : null;
+}
+var VALID_ISSUE_LABEL_FILTERS = /* @__PURE__ */ new Set(["auto-triaged", "needs-approval"]);
+function parseIssueLabelFilter(raw) {
+  if (raw === void 0 || raw === "") return void 0;
+  if (VALID_ISSUE_LABEL_FILTERS.has(raw)) return raw;
+  return null;
+}
+function parseIssueNumberParam(raw) {
+  if (!raw || !/^\d{1,10}$/.test(raw)) return null;
+  const issueNumber = Number(raw);
+  return Number.isSafeInteger(issueNumber) && issueNumber > 0 ? issueNumber : null;
+}
+function parseStringList(value) {
+  if (!Array.isArray(value)) return [];
+  return value.filter((item) => typeof item === "string" && item.length > 0);
+}
+async function resolveProjectRepository(args) {
+  const projectRepository = await args.github.sourceControlStorage.projectRepositories.get({
+    orgId: args.orgId,
+    id: args.projectRepositoryId
+  });
+  if (!projectRepository) return null;
+  const connection = await args.github.sourceControlStorage.connections.get({
+    orgId: args.orgId,
+    id: projectRepository.connectionId
+  });
+  if (!connection) return null;
+  const repository = await args.github.sourceControlStorage.repositories.get({
+    orgId: args.orgId,
+    id: projectRepository.repositoryId
+  });
+  if (!repository) return null;
+  const installation = await args.github.sourceControlStorage.installations.get({
+    orgId: args.orgId,
+    id: connection.installationId
+  });
+  if (!installation) return null;
+  return {
+    ...projectRepository,
+    connection,
+    installation,
+    repository,
+    factoryProjectId: connection.factoryProjectId,
+    defaultBranch: projectRepository.branch ?? repository.defaultBranch
+  };
+}
+function polledIssueEvent(project, issue) {
+  const repositoryId = Number(project.repository.externalId);
+  return {
+    event: "issues",
+    deliveryId: `poll:${repositoryId}:issue:${issue.number}:${issue.createdAt}`,
+    payload: {
+      action: "opened",
+      installation: { id: Number(project.installation.externalId) },
+      repository: { id: repositoryId, full_name: project.repository.slug },
+      sender: { login: issue.author ?? "__unknown__" },
+      issue: {
+        number: issue.number,
+        title: issue.title,
+        html_url: issue.url,
+        labels: issue.labels.map((name) => ({ name }))
+      }
+    }
+  };
+}
+function polledPullRequestEvent(project, pullRequest) {
+  const repositoryId = Number(project.repository.externalId);
+  return {
+    event: "pull_request",
+    deliveryId: `poll:${repositoryId}:pull-request:${pullRequest.number}:${pullRequest.createdAt}`,
+    payload: {
+      action: "opened",
+      installation: { id: Number(project.installation.externalId) },
+      repository: { id: repositoryId, full_name: project.repository.slug },
+      sender: { login: pullRequest.author ?? "__unknown__" },
+      pull_request: {
+        number: pullRequest.number,
+        title: pullRequest.title,
+        html_url: pullRequest.url,
+        state: "open",
+        merged: false,
+        head: { ref: pullRequest.headBranch },
+        base: { ref: pullRequest.baseBranch }
+      }
+    }
+  };
+}
+async function ingestPolledEvents(events, ingestFactoryEvent) {
+  if (!ingestFactoryEvent) return;
+  const results = await Promise.allSettled(events.map((event) => ingestFactoryEvent(event)));
+  const rejected = results.find((result) => result.status === "rejected");
+  if (rejected) throw rejected.reason;
+}
+function buildGithubRoutes(options) {
+  const routes = [];
+  const { auth, fleet, storage, github, stateSigner, emitAudit } = options;
+  const diagnostics = () => getGithubFeatureDiagnostics({ github, auth, appDbConfigured: storage !== void 0, stateSigner, fleet });
+  routes.push(
+    registerApiRoute("/web/github/status", {
+      method: "GET",
+      requiresAuth: false,
+      handler: async (c) => {
+        if (!isGithubFeatureEnabled({ github, auth }) || !github || !stateSigner) {
+          return c.json({
+            enabled: false,
+            connected: false,
+            installations: [],
+            reason: "missing_config",
+            diagnostics: diagnostics()
+          });
+        }
+        await auth.ensureUser(loose(c));
+        const tenant = auth.tenant(loose(c));
+        if (!tenant) return c.json({ error: "unauthorized", reason: "auth_required" }, 401);
+        if (!tenant.orgId) {
+          return c.json({
+            enabled: true,
+            sandboxEnabled: fleet.enabled,
+            organizationRequired: true,
+            connected: false,
+            installations: [],
+            reason: "organization_required",
+            diagnostics: diagnostics()
+          });
+        }
+        const rows = options.github ? await options.github.sourceControlStorage.installations.list({ orgId: tenant.orgId }) : [];
+        const connected = rows.length > 0;
+        return c.json({
+          enabled: true,
+          sandboxEnabled: fleet.enabled,
+          connected,
+          installations: rows.map((r) => ({
+            installationId: Number(r.externalId),
+            accountLogin: r.accountName,
+            accountType: r.accountType
+          })),
+          reason: connected ? "ready" : "not_connected",
+          diagnostics: diagnostics()
+        });
+      }
+    })
+  );
+  if (!isGithubFeatureEnabled({ github, auth }) || !github || !stateSigner) {
+    return routes;
+  }
+  const signState = (orgId, userId) => stateSigner.sign(orgId, userId);
+  const verifyState = (state) => stateSigner.verify(state);
+  const { runIssueTriage } = options;
+  const runBoardIssueTriage = runIssueTriage ? async (input) => {
+    if (!input.resourceId || !input.projectPath) {
+      throw new Error("GitHub issue triage requires an explicit Factory project repository");
+    }
+    await github.addIssueLabels(input.installationId, input.repository, input.issueNumber, ["auto-triaged"]);
+    return runIssueTriage({
+      ...input,
+      defaultModelId: input.defaultModelId ?? await resolveFactoryDefaultModelId(options.projects, input.resourceId),
+      labels: input.labels.includes("auto-triaged") ? input.labels : [...input.labels, "auto-triaged"]
+    });
+  } : void 0;
+  routes.push(
+    registerApiRoute("/web/github/subscriptions", {
+      method: "GET",
+      handler: async (c) => {
+        await auth.ensureUser(loose(c));
+        const tenant = auth.tenant(loose(c));
+        if (!tenant?.orgId) return c.json({ error: "unauthorized" }, 401);
+        const resourceId = c.req.query("resourceId");
+        const threadId = c.req.query("threadId");
+        const sessionScope = c.req.query("scope");
+        if (!resourceId || !threadId) return c.json({ error: "resourceId and threadId are required" }, 400);
+        const subscriptions = await listPullRequestSubscriptionsForThread(
+          {
+            orgId: tenant.orgId,
+            resourceId,
+            threadId,
+            sessionScope
+          },
+          github.integrationStorage
+        );
+        return c.json({
+          subscriptions: subscriptions.map((subscription) => ({
+            id: subscription.id,
+            repoFullName: subscription.data.repositorySlug,
+            pullRequestNumber: Number(subscription.data.changeRequestId),
+            status: subscription.status,
+            url: `https://github.com/${subscription.data.repositorySlug}/pull/${subscription.data.changeRequestId}`
+          }))
+        });
+      }
+    }),
+    registerApiRoute("/web/github/webhook", {
+      method: "POST",
+      requiresAuth: false,
+      handler: async (c) => {
+        const result = await handleGithubWebhook(loose(c), {
+          github,
+          runIssueTriage: runBoardIssueTriage,
+          ingestFactoryEvent: options.ingestFactoryEvent,
+          ...options.controller ? {
+            controller: options.controller,
+            onTargetError: (subscription, error) => {
+              console.warn(
+                `[GitHub Webhook] Delivery failed for subscription ${subscription.id} (${subscription.resourceId}/${subscription.threadId}).`,
+                error
+              );
+            }
+          } : {}
+        });
+        return c.json(result.body, result.status);
+      }
+    })
+  );
+  const redirectUri = options.redirectUri ?? `${(options.baseUrl ?? "").replace(/\/$/, "")}/auth/github/callback`;
+  routes.push(
+    registerApiRoute("/auth/github/connect", {
+      method: "GET",
+      requiresAuth: false,
+      handler: async (c) => {
+        const resolved = await resolveOrgTenant(loose(c), auth);
+        if ("response" in resolved) return resolved.response;
+        const state = signState(resolved.tenant.orgId, resolved.tenant.userId);
+        if (c.req.query("manage")) return c.redirect(github.buildInstallUrl(state));
+        return c.redirect(github.buildOAuthIdentifyUrl(state, redirectUri));
+      }
+    })
+  );
+  routes.push(
+    registerApiRoute("/auth/github/callback", {
+      method: "GET",
+      requiresAuth: false,
+      handler: async (c) => {
+        const resolved = await resolveOrgTenant(loose(c), auth);
+        if ("response" in resolved) return resolved.response;
+        const { orgId, userId } = resolved.tenant;
+        const state = c.req.query("state");
+        if (!state) {
+          return c.redirect(github.buildOAuthIdentifyUrl(signState(orgId, userId), redirectUri));
+        }
+        const stateTenant = verifyState(state);
+        if (!stateTenant || stateTenant.userId !== userId || stateTenant.orgId !== orgId) {
+          console.warn(
+            "[GitHub] Install callback rejected: state/tenant mismatch.",
+            JSON.stringify({
+              stateValid: Boolean(stateTenant),
+              stateOrgId: stateTenant?.orgId,
+              stateUserId: stateTenant?.userId,
+              sessionOrgId: orgId,
+              sessionUserId: userId
+            })
+          );
+          return c.redirect("/?github=error");
+        }
+        const code = c.req.query("code");
+        if (!code) {
+          return c.redirect(github.buildOAuthIdentifyUrl(signState(orgId, userId), redirectUri));
+        }
+        try {
+          const userToken = await github.exchangeOAuthCode(code, redirectUri);
+          const installations = await github.listUserInstallations(userToken);
+          if (installations.length === 0) {
+            return c.redirect(github.buildInstallUrl(signState(orgId, userId)));
+          }
+          for (const inst of installations) {
+            await github.sourceControlStorage.installations.upsert({
+              orgId,
+              connectedByUserId: userId,
+              externalId: inst.installationId.toString(),
+              accountName: inst.accountLogin,
+              accountType: inst.accountType
+            });
+          }
+        } catch (error) {
+          console.warn(
+            `[GitHub] Install callback failed to persist installations for org ${orgId} / user ${userId}.`,
+            error
+          );
+          return c.redirect("/?github=error");
+        }
+        return c.redirect("/?github=connected");
+      }
+    })
+  );
+  routes.push(
+    registerApiRoute("/web/github/repos", {
+      method: "GET",
+      requiresAuth: false,
+      handler: async (c) => {
+        const resolved = await resolveOrgTenant(loose(c), auth);
+        if ("response" in resolved) return resolved.response;
+        const installs = await github.sourceControlStorage.installations.list({ orgId: resolved.tenant.orgId });
+        const query = (c.req.query("q") ?? "").toLowerCase();
+        const repos = [];
+        const seenRepositoryIds = /* @__PURE__ */ new Set();
+        for (const inst of installs) {
+          let list;
+          try {
+            list = await github.listInstallationRepos(Number(inst.externalId));
+          } catch (err) {
+            if (err.status !== 404) throw err;
+            console.error(`[MastraCode Web] pruning stale GitHub installation ${inst.externalId} (404 from GitHub)`);
+            await github.sourceControlStorage.installations.delete({ orgId: resolved.tenant.orgId, id: inst.id });
+            continue;
+          }
+          for (const repo of list) {
+            if (query && !repo.fullName.toLowerCase().includes(query)) continue;
+            if (seenRepositoryIds.has(repo.id)) continue;
+            seenRepositoryIds.add(repo.id);
+            const repository = await github.sourceControlStorage.repositories.upsert({
+              orgId: resolved.tenant.orgId,
+              input: {
+                installationId: inst.id,
+                externalId: repo.id.toString(),
+                slug: repo.fullName,
+                defaultBranch: isValidGitRef2(repo.defaultBranch) ? repo.defaultBranch : "main",
+                providerMetadata: { private: repo.private, owner: repo.owner }
+              }
+            });
+            repos.push({
+              ...repo,
+              installationStorageId: inst.id,
+              repositoryStorageId: repository.id,
+              sandboxProvider: fleet.provider,
+              sandboxWorkdir: fleet.computeWorkdir(repo.fullName)
+            });
+          }
+        }
+        return c.json({ repos });
+      }
+    })
+  );
+  routes.push(
+    registerApiRoute("/web/github/projects/:id/ensure", {
+      method: "POST",
+      requiresAuth: false,
+      handler: async (c) => {
+        const resolved = await resolveOrgTenant(loose(c), auth);
+        if ("response" in resolved) return resolved.response;
+        const { orgId, userId } = resolved.tenant;
+        if (!fleet.enabled) {
+          return c.json({ error: "sandbox_not_configured", message: "No sandbox provider is configured." }, 503);
+        }
+        const projectRepositoryId = c.req.param("id");
+        if (!projectRepositoryId) return c.json({ error: "Project repository not found" }, 404);
+        const project = await resolveProjectRepository({ github, orgId, projectRepositoryId });
+        if (!project) {
+          return c.json({ error: "Project repository not found" }, 404);
+        }
+        const wantsStream = (c.req.header("accept") ?? "").includes("text/event-stream");
+        if (wantsStream) {
+          return streamSSE(loose(c), async (stream) => {
+            try {
+              const result = await prepareProject({
+                github,
+                fleet,
+                project,
+                userId,
+                onProgress: (ev) => void stream.writeSSE({ event: "progress", data: JSON.stringify(ev) })
+              });
+              await stream.writeSSE({ event: "done", data: JSON.stringify(result) });
+            } catch (err) {
+              await stream.writeSSE({ event: "error", data: JSON.stringify(ensureErrorPayload(err).body) });
+            }
+          });
+        }
+        try {
+          const result = await prepareProject({ github, fleet, project, userId });
+          return c.json(result);
+        } catch (err) {
+          const { status, body } = ensureErrorPayload(err);
+          return c.json(body, status);
+        }
+      }
+    })
+  );
+  routes.push(
+    registerApiRoute("/web/github/projects/:id/issues", {
+      method: "GET",
+      requiresAuth: false,
+      handler: async (c) => {
+        const loaded = await loadOrgProject({ github, auth, c: loose(c) });
+        if ("response" in loaded) return loaded.response;
+        const page = parseListPage(c.req.query("page"));
+        if (page === null) return c.json({ error: "invalid_page" }, 400);
+        const label = parseIssueLabelFilter(c.req.query("label"));
+        if (label === null) return c.json({ error: "invalid_label" }, 400);
+        try {
+          const { issues, nextCursor } = await github.intake.listIssues({
+            connection: {
+              type: "app-installation",
+              installationId: Number(loaded.project.installation.externalId)
+            },
+            sourceIds: [loaded.project.repository.slug],
+            labels: label ? [label] : void 0,
+            cursor: String(page)
+          });
+          const responseIssues = issues.map((issue) => ({
+            number: Number(issue.id),
+            title: issue.title,
+            url: issue.url,
+            author: issue.author,
+            labels: issue.labels,
+            comments: issue.commentCount ?? 0,
+            createdAt: issue.createdAt,
+            updatedAt: issue.updatedAt
+          }));
+          await ingestPolledEvents(
+            responseIssues.map((issue) => polledIssueEvent(loaded.project, issue)),
+            options.ingestFactoryEvent
+          );
+          return c.json({
+            issues: responseIssues,
+            nextPage: nextCursor === null ? null : Number(nextCursor)
+          });
+        } catch (err) {
+          return c.json(
+            { error: "github_fetch_failed", message: err instanceof Error ? err.message : String(err) },
+            502
+          );
+        }
+      }
+    })
+  );
+  routes.push(
+    registerApiRoute("/web/github/projects/:id/issues/:number/triage", {
+      method: "POST",
+      requiresAuth: false,
+      handler: async (c) => {
+        const owned = await loadOwnedProject({ github, auth, fleet, c: loose(c) });
+        if ("response" in owned) return owned.response;
+        const { project, sandboxRow } = owned;
+        const issueNumber = parseIssueNumberParam(c.req.param("number"));
+        if (issueNumber === null) return c.json({ error: "invalid_issue_number" }, 400);
+        let body;
+        try {
+          body = await c.req.json();
+        } catch {
+          return c.json({ error: "Invalid JSON body" }, 400);
+        }
+        if (typeof body.title !== "string" || body.title.trim().length === 0 || body.title.length > 5e3) {
+          return c.json({ error: "invalid_title" }, 400);
+        }
+        if (typeof body.url !== "string" || body.url.trim().length === 0 || body.url.length > 2048 || !isCanonicalGithubIssueUrl(body.url, project.repository.slug, issueNumber)) {
+          return c.json({ error: "invalid_url" }, 400);
+        }
+        if (!runIssueTriage) return c.json({ error: "triage_unavailable" }, 503);
+        const branch = `factory/issue-${issueNumber}`;
+        const projectPath = computeWorktreePath(sandboxRow.sandboxWorkdir, branch);
+        await github.addIssueLabels(Number(project.installation.externalId), project.repository.slug, issueNumber, [
+          "auto-triaged"
+        ]);
+        const result = await runIssueTriage({
+          repository: project.repository.slug,
+          issueNumber,
+          issueTitle: body.title,
+          issueUrl: body.url,
+          labels: parseStringList(body.labels),
+          installationId: Number(project.installation.externalId),
+          resourceId: project.factoryProjectId,
+          projectPath,
+          branch,
+          defaultModelId: await resolveFactoryDefaultModelId(options.projects, project.factoryProjectId)
+        });
+        await emitAudit?.({
+          context: loose(c),
+          input: {
+            action: "factory.triage.started",
+            factoryProjectId: project.factoryProjectId,
+            projectRepositoryId: project.id,
+            targets: [{ type: "issue", id: String(issueNumber), name: body.title }],
+            metadata: { issueNumber, branch, threadId: result.threadId }
+          }
+        });
+        return c.json(
+          {
+            ok: true,
+            threadId: result.threadId,
+            projectPath: result.projectPath ?? projectPath,
+            branch: result.branch ?? branch
+          },
+          202
+        );
+      }
+    })
+  );
+  routes.push(
+    registerApiRoute("/web/github/projects/:id/prs", {
+      method: "GET",
+      requiresAuth: false,
+      handler: async (c) => {
+        const loaded = await loadOrgProject({ github, auth, c: loose(c) });
+        if ("response" in loaded) return loaded.response;
+        const page = parseListPage(c.req.query("page"));
+        if (page === null) return c.json({ error: "invalid_page" }, 400);
+        try {
+          const { pullRequests, nextCursor } = await github.versionControl.listPullRequests({
+            connection: {
+              type: "app-installation",
+              installationId: Number(loaded.project.installation.externalId)
+            },
+            sourceId: loaded.project.repository.slug,
+            includeDrafts: false,
+            cursor: String(page)
+          });
+          const responsePullRequests = pullRequests.map((pr) => ({
+            number: Number(pr.id),
+            title: pr.title,
+            url: pr.url,
+            author: pr.author,
+            baseBranch: pr.baseBranch,
+            headBranch: pr.headBranch,
+            createdAt: pr.createdAt,
+            updatedAt: pr.updatedAt
+          }));
+          await ingestPolledEvents(
+            responsePullRequests.map((pullRequest) => polledPullRequestEvent(loaded.project, pullRequest)),
+            options.ingestFactoryEvent
+          );
+          return c.json({
+            pullRequests: responsePullRequests,
+            nextPage: nextCursor === null ? null : Number(nextCursor)
+          });
+        } catch (err) {
+          return c.json(
+            { error: "github_fetch_failed", message: err instanceof Error ? err.message : String(err) },
+            502
+          );
+        }
+      }
+    })
+  );
+  routes.push(
+    registerApiRoute("/web/github/projects/:id/settings", {
+      method: "GET",
+      requiresAuth: false,
+      handler: async (c) => {
+        const loaded = await loadOrgProject({ github, auth, c: loose(c) });
+        if ("response" in loaded) return loaded.response;
+        return c.json({ setupCommand: loaded.project.setupCommand });
+      }
+    })
+  );
+  routes.push(
+    registerApiRoute("/web/github/projects/:id/settings", {
+      method: "POST",
+      requiresAuth: false,
+      handler: async (c) => {
+        const loaded = await loadOrgProject({ github, auth, c: loose(c) });
+        if ("response" in loaded) return loaded.response;
+        let body;
+        try {
+          body = await c.req.json();
+        } catch {
+          return c.json({ error: "Invalid JSON body" }, 400);
+        }
+        if (body.setupCommand !== null && typeof body.setupCommand !== "string") {
+          return c.json({ error: "Invalid setupCommand" }, 400);
+        }
+        if (typeof body.setupCommand === "string" && body.setupCommand.length > 2e3) {
+          return c.json({ error: "setupCommand too long (max 2000 characters)" }, 400);
+        }
+        if (typeof body.setupCommand === "string" && /[\0-\x08\x0b\x0c\x0e-\x1f\x7f]/.test(body.setupCommand)) {
+          return c.json({ error: "setupCommand contains control characters" }, 400);
+        }
+        const setupCommand = typeof body.setupCommand === "string" && body.setupCommand.trim().length > 0 ? body.setupCommand.trim() : null;
+        await github.sourceControlStorage.projectRepositories.update({
+          orgId: loaded.project.installation.orgId,
+          id: loaded.project.id,
+          input: { setupCommand }
+        });
+        return c.json({ setupCommand });
+      }
+    })
+  );
+  routes.push(...buildProjectGitRoutes({ github, auth, fleet, storage, emitAudit }));
+  return routes;
+}
+async function loadOrgProject(options) {
+  const { github, auth, c } = options;
+  const resolved = await resolveOrgTenant(c, auth);
+  if ("response" in resolved) return { response: resolved.response };
+  const { orgId, userId } = resolved.tenant;
+  const projectRepositoryId = c.req.param("id");
+  if (!projectRepositoryId) {
+    return { response: c.json({ error: "Project repository not found" }, 404) };
+  }
+  const project = await resolveProjectRepository({ github, orgId, projectRepositoryId });
+  if (!project) {
+    return { response: c.json({ error: "Project repository not found" }, 404) };
+  }
+  return { project, userId };
+}
+function identityFromUser(user) {
+  const u = user;
+  return { name: u?.name ?? null, email: u?.email ?? null };
+}
+async function resolveProjectSandbox(options) {
+  const { fleet, sandboxRow } = options;
+  if (!sandboxRow.sandboxId) {
+    throw new MaterializeError("Project sandbox is not provisioned. Open the project first.", "clone-failed");
+  }
+  return fleet.reattachSandbox(sandboxRow.sandboxId);
+}
+async function loadOrCreateSandboxRow(github, project, userId) {
+  return github.sourceControlStorage.sandboxes.getOrCreate({ projectRepository: project, userId });
+}
+async function prepareProject(options) {
+  const { github, fleet, project, userId, onProgress } = options;
+  const sandboxRow = await loadOrCreateSandboxRow(github, project, userId);
+  const sandbox = await ensureProjectSandbox({
+    fleet,
+    row: sandboxRow,
+    storage: github.sourceControlStorage.sandboxes,
+    onProgress
+  });
+  const fresh = await github.sourceControlStorage.sandboxes.getById({ id: sandboxRow.id });
+  const access = await github.versionControl.getRepositoryAccess({
+    orgId: project.installation.orgId,
+    repositoryId: project.repository.id
+  });
+  if (!access.authorization) {
+    throw new MaterializeError("Repository access did not include a bearer token.", "clone-failed");
+  }
+  const finalRow = fresh ?? sandboxRow;
+  await materializeRepo({
+    row: finalRow,
+    repoInfo: { repoFullName: project.repository.slug, defaultBranch: project.defaultBranch },
+    sandbox,
+    token: access.authorization.token,
+    storage: github.sourceControlStorage.sandboxes,
+    onProgress
+  });
+  const result = {
+    resourceId: project.factoryProjectId,
+    factoryProjectId: project.factoryProjectId,
+    projectRepositoryId: project.id,
+    sandboxId: finalRow.sandboxId,
+    sandboxWorkdir: finalRow.sandboxWorkdir
+  };
+  const done = { phase: "done", message: "Workspace ready." };
+  onProgress?.(done);
+  return result;
+}
+function ensureErrorPayload(err) {
+  if (err instanceof SandboxBudgetError) {
+    return { status: 429, body: { error: err.code, message: err.message } };
+  }
+  if (err instanceof MaterializeError) {
+    return { status: 502, body: { error: err.code, message: err.message } };
+  }
+  return {
+    status: 500,
+    body: { error: "materialize_failed", message: err instanceof Error ? err.message : String(err) }
+  };
+}
+function gitErrorResponse(c, err) {
+  if (err instanceof WorktreeError) {
+    return c.json({ error: err.code, message: err.message }, err.code === "invalid-branch" ? 400 : 502);
+  }
+  if (err instanceof MaterializeError) {
+    return c.json({ error: err.code, message: err.message }, 502);
+  }
+  return c.json({ error: "git_failed", message: err instanceof Error ? err.message : String(err) }, 500);
+}
+async function loadOwnedProject(options) {
+  const { github, auth, fleet, c } = options;
+  const resolved = await resolveOrgTenant(c, auth);
+  if ("response" in resolved) return { response: resolved.response };
+  const { orgId, userId } = resolved.tenant;
+  if (!fleet.enabled) {
+    return {
+      response: c.json({ error: "sandbox_not_configured", message: "No sandbox provider is configured." }, 503)
+    };
+  }
+  const projectRepositoryId = c.req.param("id");
+  if (!projectRepositoryId) {
+    return { response: c.json({ error: "Project repository not found" }, 404) };
+  }
+  const project = await resolveProjectRepository({ github, orgId, projectRepositoryId });
+  if (!project) {
+    return { response: c.json({ error: "Project repository not found" }, 404) };
+  }
+  const sandboxRow = await loadOrCreateSandboxRow(github, project, userId);
+  return { orgId, userId, project, sandboxRow };
+}
+function buildProjectGitRoutes({
+  github,
+  auth,
+  fleet,
+  storage,
+  emitAudit
+}) {
+  return [
+    // ── Create / list Factory sessions ──────────────────────────────────────
+    registerApiRoute("/web/github/projects/:id/sessions", {
+      method: "GET",
+      requiresAuth: false,
+      handler: async (c) => {
+        const resolved = await resolveOrgTenant(loose(c), auth);
+        if ("response" in resolved) return resolved.response;
+        const { orgId, userId } = resolved.tenant;
+        const projectRepositoryId = c.req.param("id");
+        const project = projectRepositoryId ? await resolveProjectRepository({ github, orgId, projectRepositoryId }) : null;
+        if (!project) return c.json({ error: "Project repository not found" }, 404);
+        const sessions = await github.sourceControlStorage.sessions.list({ projectRepositoryId: project.id, userId });
+        return c.json({ sessions });
+      }
+    }),
+    registerApiRoute("/web/github/projects/:id/sessions", {
+      method: "POST",
+      requiresAuth: false,
+      handler: async (c) => {
+        const resolved = await resolveOrgTenant(loose(c), auth);
+        if ("response" in resolved) return resolved.response;
+        const { orgId, userId } = resolved.tenant;
+        const projectRepositoryId = c.req.param("id");
+        const project = projectRepositoryId ? await resolveProjectRepository({ github, orgId, projectRepositoryId }) : null;
+        if (!project) return c.json({ error: "Project repository not found" }, 404);
+        let body;
+        try {
+          body = await c.req.json();
+        } catch {
+          return c.json({ error: "Invalid JSON body" }, 400);
+        }
+        if (!isValidGitRef(body.branch)) return c.json({ error: "Invalid branch" }, 400);
+        const baseBranch = body.baseBranch === void 0 ? project.defaultBranch : body.baseBranch;
+        if (!isValidGitRef(baseBranch)) return c.json({ error: "Invalid baseBranch" }, 400);
+        const session = await github.sourceControlStorage.sessions.create({
+          sessionId: randomUUID(),
+          projectRepositoryId: project.id,
+          orgId,
+          userId,
+          branch: body.branch,
+          baseBranch
+        });
+        return c.json({ session });
+      }
+    }),
+    registerApiRoute("/web/user-sessions/:sessionId", {
+      method: "GET",
+      requiresAuth: false,
+      handler: async (c) => {
+        const resolved = await resolveOrgTenant(loose(c), auth);
+        if ("response" in resolved) return resolved.response;
+        const session = await github.sourceControlStorage.sessions.getBySessionId(c.req.param("sessionId"));
+        if (!session || session.orgId !== resolved.tenant.orgId || session.userId !== resolved.tenant.userId) {
+          return c.json({ error: "Session not found" }, 404);
+        }
+        return c.json({ session });
+      }
+    }),
+    registerApiRoute("/web/user-sessions/:sessionId", {
+      method: "DELETE",
+      requiresAuth: false,
+      handler: async (c) => {
+        const resolved = await resolveOrgTenant(loose(c), auth);
+        if ("response" in resolved) return resolved.response;
+        const session = await github.sourceControlStorage.sessions.getBySessionId(c.req.param("sessionId"));
+        if (!session || session.orgId !== resolved.tenant.orgId || session.userId !== resolved.tenant.userId) {
+          return c.json({ error: "Session not found" }, 404);
+        }
+        let sandbox;
+        if (session.sandboxId) {
+          try {
+            sandbox = await fleet.reattachSandbox(session.sandboxId);
+          } catch {
+          }
+          await fleet.teardownSandbox(
+            {
+              sandboxId: session.sandboxId,
+              setSandboxId: async () => {
+              },
+              clear: async () => {
+                await github.sourceControlStorage.sessions.setSandbox({
+                  id: session.id,
+                  sandboxId: null,
+                  sandboxWorkdir: session.sandboxWorkdir ?? ""
+                });
+              }
+            },
+            sandbox
+          );
+        }
+        await github.sourceControlStorage.sessions.delete(session.id);
+        return c.json({ removed: true });
+      }
+    }),
+    // ── Stage all + commit inside a Factory session workspace ──────────────
+    registerApiRoute("/web/github/projects/:id/commit", {
+      method: "POST",
+      requiresAuth: false,
+      handler: async (c) => {
+        const owned = await loadOwnedProject({ github, auth, fleet, c: loose(c) });
+        if ("response" in owned) return owned.response;
+        const { userId, project } = owned;
+        let body;
+        try {
+          body = await c.req.json();
+        } catch {
+          return c.json({ error: "Invalid JSON body" }, 400);
+        }
+        if (typeof body.message !== "string" || body.message.trim().length === 0 || body.message.length > 5e3) {
+          return c.json({ error: "Invalid message" }, 400);
+        }
+        const sessionWorkspace = await resolveSessionWorkspace(github, project.id, userId, body.sessionId);
+        if (!sessionWorkspace) {
+          return c.json({ error: "Invalid sessionId" }, 400);
+        }
+        const { workdir, sandboxBinding } = sessionWorkspace;
+        try {
+          return await withProjectLock({
+            key: `${project.id}:${userId}`,
+            storage,
+            fn: async () => {
+              const sandbox = await resolveProjectSandbox({ fleet, sandboxRow: sandboxBinding });
+              const result = await commitAll(
+                sandbox,
+                workdir,
+                body.message,
+                identityFromUser(await auth.ensureUser(loose(c)))
+              );
+              if (result.committed) {
+                await emitAudit?.({
+                  context: loose(c),
+                  input: {
+                    action: "factory.git.commit",
+                    factoryProjectId: project.factoryProjectId,
+                    projectRepositoryId: project.id,
+                    targets: [{ type: "session", id: sessionWorkspace.session.sessionId }],
+                    metadata: { sessionId: sessionWorkspace.session.sessionId }
+                  }
+                });
+              }
+              return c.json({ committed: result.committed });
+            }
+          });
+        } catch (err) {
+          return gitErrorResponse(loose(c), err);
+        }
+      }
+    }),
+    // ── Push a branch back to GitHub ────────────────────────────────────────
+    registerApiRoute("/web/github/projects/:id/push", {
+      method: "POST",
+      requiresAuth: false,
+      handler: async (c) => {
+        const owned = await loadOwnedProject({ github, auth, fleet, c: loose(c) });
+        if ("response" in owned) return owned.response;
+        const { orgId, userId, project } = owned;
+        let body;
+        try {
+          body = await c.req.json();
+        } catch {
+          return c.json({ error: "Invalid JSON body" }, 400);
+        }
+        if (!isValidGitRef(body.branch)) {
+          return c.json({ error: "Invalid branch" }, 400);
+        }
+        const branch = body.branch;
+        const sessionWorkspace = await resolveSessionWorkspace(github, project.id, userId, body.sessionId);
+        if (!sessionWorkspace) {
+          return c.json({ error: "Invalid sessionId" }, 400);
+        }
+        const { workdir, sandboxBinding } = sessionWorkspace;
+        try {
+          return await withProjectLock({
+            key: `${project.id}:${userId}`,
+            storage,
+            fn: async () => {
+              const sandbox = await resolveProjectSandbox({ fleet, sandboxRow: sandboxBinding });
+              const access = await github.versionControl.getRepositoryAccess({
+                orgId,
+                repositoryId: project.repository.id
+              });
+              if (!access.authorization) throw new Error("Repository access did not include a bearer token.");
+              await pushBranch(sandbox, workdir, branch, access.authorization.token, project.repository.slug);
+              await emitAudit?.({
+                context: loose(c),
+                input: {
+                  action: "factory.git.push",
+                  factoryProjectId: project.factoryProjectId,
+                  projectRepositoryId: project.id,
+                  targets: [{ type: "branch", id: branch }],
+                  metadata: { branch, sessionId: sessionWorkspace.session.sessionId }
+                }
+              });
+              return c.json({ pushed: true, branch });
+            }
+          });
+        } catch (err) {
+          return gitErrorResponse(loose(c), err);
+        }
+      }
+    }),
+    // ── Open a pull request through the version-control capability ─────────
+    registerApiRoute("/web/github/projects/:id/pr", {
+      method: "POST",
+      requiresAuth: false,
+      handler: async (c) => {
+        const owned = await loadOwnedProject({ github, auth, fleet, c: loose(c) });
+        if ("response" in owned) return owned.response;
+        const { orgId, userId, project } = owned;
+        let body;
+        try {
+          body = await c.req.json();
+        } catch {
+          return c.json({ error: "Invalid JSON body" }, 400);
+        }
+        if (!isValidGitRef(body.branch)) {
+          return c.json({ error: "Invalid branch" }, 400);
+        }
+        const base = body.base === void 0 ? project.defaultBranch : body.base;
+        if (!isValidGitRef(base)) {
+          return c.json({ error: "Invalid base" }, 400);
+        }
+        if (typeof body.title !== "string" || body.title.trim().length === 0 || body.title.length > 256) {
+          return c.json({ error: "Invalid title" }, 400);
+        }
+        if (body.body !== void 0 && (typeof body.body !== "string" || body.body.length > 65536)) {
+          return c.json({ error: "Invalid body" }, 400);
+        }
+        const head = body.branch;
+        const title = body.title;
+        const prBody = body.body;
+        const sessionWorkspace = await resolveSessionWorkspace(github, project.id, userId, body.sessionId);
+        if (!sessionWorkspace) {
+          return c.json({ error: "Invalid sessionId" }, 400);
+        }
+        try {
+          return await withProjectLock({
+            key: `${project.id}:${userId}`,
+            storage,
+            fn: async () => {
+              const result = await github.versionControl.createPullRequest({
+                connection: {
+                  type: "app-installation",
+                  installationId: Number(project.installation.externalId)
+                },
+                sourceId: project.repository.slug,
+                baseBranch: base,
+                headBranch: head,
+                title,
+                body: prBody
+              });
+              await emitAudit?.({
+                context: loose(c),
+                input: {
+                  action: "factory.git.pr_opened",
+                  factoryProjectId: project.factoryProjectId,
+                  projectRepositoryId: project.id,
+                  targets: [{ type: "pull_request", id: result.url, name: title }],
+                  metadata: { branch: head, base, url: result.url }
+                }
+              });
+              const pullRequestNumber = pullRequestNumberFromUrl(result.url, project.repository.slug);
+              if (pullRequestNumber) {
+                const sessionId = sessionWorkspace.session.sessionId;
+                await subscribeToPullRequest(
+                  {
+                    orgId,
+                    installationExternalId: project.installation.externalId,
+                    projectRepositoryId: project.id,
+                    repositoryExternalId: project.repository.externalId,
+                    repositorySlug: project.repository.slug,
+                    changeRequestId: pullRequestNumber.toString(),
+                    sessionId,
+                    ownerId: userId,
+                    resourceId: sessionId,
+                    threadId: sessionId,
+                    source: "factory-pr-create",
+                    subscribedByUserId: userId
+                  },
+                  github.integrationStorage
+                ).catch((error) => {
+                  console.warn(
+                    `[GitHub] Pull request ${result.url} was created but automatic subscription failed.`,
+                    error
+                  );
+                });
+              }
+              return c.json({ url: result.url });
+            }
+          });
+        } catch (err) {
+          return c.json(
+            { error: "github_pr_create_failed", message: err instanceof Error ? err.message : String(err) },
+            502
+          );
+        }
+      }
+    }),
+    // ── Tear down the caller's sandbox for a project ────────────────────────
+    // Per-user teardown only: drops the caller's `(project, user)` sandbox
+    // binding and stops the VM, freeing a slot in the per-replica budget. Project
+    // deletion at the org level is out of scope (org admin model is later).
+    registerApiRoute("/web/github/projects/:id/sandbox", {
+      method: "DELETE",
+      requiresAuth: false,
+      handler: async (c) => {
+        const owned = await loadOwnedProject({ github, auth, fleet, c: loose(c) });
+        if ("response" in owned) return owned.response;
+        const { userId, project, sandboxRow } = owned;
+        if (!sandboxRow.sandboxId) {
+          return c.json({ tornDown: false });
+        }
+        try {
+          return await withProjectLock({
+            key: `${project.id}:${userId}`,
+            storage,
+            fn: async () => {
+              const sandbox = await fleet.reattachSandbox(sandboxRow.sandboxId);
+              await teardownProjectSandbox({
+                fleet,
+                row: sandboxRow,
+                storage: github.sourceControlStorage.sandboxes,
+                sandbox
+              });
+              return c.json({ tornDown: true });
+            }
+          });
+        } catch (err) {
+          return gitErrorResponse(loose(c), err);
+        }
+      }
+    })
+  ];
+}
+async function resolveSessionWorkspace(github, projectId, userId, sessionId) {
+  if (typeof sessionId !== "string") {
+    return void 0;
+  }
+  const session = await github.sourceControlStorage.sessions.getBySessionId(sessionId);
+  if (session?.projectRepositoryId !== projectId || session.userId !== userId || !session.sandboxId || !session.sandboxWorkdir) {
+    return void 0;
+  }
+  return {
+    session,
+    workdir: session.sandboxWorkdir,
+    sandboxBinding: {
+      id: session.id,
+      projectRepositoryId: session.projectRepositoryId,
+      userId: session.userId,
+      sandboxId: session.sandboxId,
+      sandboxWorkdir: session.sandboxWorkdir,
+      materializedAt: session.materializedAt,
+      createdAt: session.createdAt
+    }
+  };
+}
+export {
+  buildGithubRoutes
+};
+//# sourceMappingURL=routes.js.map