@mastra/factory 0.1.0-alpha.2 → 0.1.0-alpha.4

package/dist/factory.js

@@ -11163,8 +11163,10 @@ function assertIdentifier(kind, name) {
   }
 }
 function isUniqueViolation(error) {
+  const code = typeof error === "object" && error !== null ? error.code : void 0;
+  if (code === "SQLITE_CONSTRAINT_UNIQUE" || code === "SQLITE_CONSTRAINT_PRIMARYKEY") return true;
   const message = error instanceof Error ? error.message : String(error);
-  return message.includes("UNIQUE constraint failed") || message.includes("SQLITE_CONSTRAINT");
+  return message.includes("UNIQUE constraint failed") || message.includes("SQLITE_CONSTRAINT_UNIQUE") || message.includes("SQLITE_CONSTRAINT_PRIMARYKEY");
 }
 function primaryKeyOf(schema) {
   const pks = Object.entries(schema.columns).filter(([, spec]) => spec.type === "uuid-pk" || spec.primaryKey);
@@ -24103,6 +24105,35 @@ ${unreflectedContent}` : bufferedReflection;
         if (spec.default !== void 0) ddl += ` DEFAULT ${serializeDefault(spec.default)}`;
         return ddl;
       }
+      /**
+       * A table created by an older schema may still say NOT NULL on a column the
+       * current schema declares nullable — inserts of null then fail on databases
+       * that predate the change. SQLite has no `ALTER COLUMN DROP NOT NULL`, so
+       * relaxation swaps in a table rebuilt from the current schema (create shadow
+       * → copy → drop → rename) atomically.
+       */
+      async #relaxDriftedNotNulls(schema) {
+        const info = await this.#client.execute(`PRAGMA table_info("${schema.name}")`);
+        const hasDrift = info.rows.some((row) => {
+          const spec = schema.columns[String(row.name)];
+          if (!spec || spec.type === "uuid-pk" || spec.primaryKey) return false;
+          return spec.nullable === true && Number(row.notnull) === 1;
+        });
+        if (!hasDrift) return;
+        const ddl = Object.entries(schema.columns).map(([name, spec]) => this.#columnDdl(name, spec));
+        const shadow = `${schema.name}__nullable_rebuild`;
+        const cols = Object.keys(schema.columns).map((name) => `"${name}"`).join(", ");
+        await this.#client.batch(
+          [
+            `DROP TABLE IF EXISTS "${shadow}"`,
+            `CREATE TABLE "${shadow}" (${ddl.join(", ")})`,
+            `INSERT INTO "${shadow}" (${cols}) SELECT ${cols} FROM "${schema.name}"`,
+            `DROP TABLE "${schema.name}"`,
+            `ALTER TABLE "${shadow}" RENAME TO "${schema.name}"`
+          ],
+          "write"
+        );
+      }
       async #ensureCollection(schema) {
         assertIdentifier("collection", schema.name);
         primaryKeyOf(schema);
@@ -24114,6 +24145,7 @@ ${unreflectedContent}` : bufferedReflection;
           if (existing.has(name)) continue;
           await this.#client.execute(`ALTER TABLE "${schema.name}" ADD COLUMN ${this.#columnDdl(name, spec)}`);
         }
+        await this.#relaxDriftedNotNulls(schema);
         for (const index of schema.uniqueIndexes ?? []) {
           assertIdentifier("index", index.name);
           index.columns.forEach((column) => assertIdentifier("column", column));
@@ -24798,6 +24830,19 @@ function retirePullRequestSubscription(id, status, storage) {
   return storage.subscriptions.updateStatus(id, status);
 }
 
+// src/integrations/github/token-refresh.ts
+var GITHUB_TOKEN_INJECTOR_CONTEXT_KEY = "factoryGithubTokenInjector";
+function registerGithubTokenInjector(requestContext, injector) {
+  requestContext.set(GITHUB_TOKEN_INJECTOR_CONTEXT_KEY, injector);
+}
+function injectGithubToken(requestContext, token) {
+  const injector = requestContext.get(GITHUB_TOKEN_INJECTOR_CONTEXT_KEY);
+  if (!injector) {
+    throw new Error("GitHub token refresh requires an active Factory sandbox workspace.");
+  }
+  injector(token);
+}
+
 // src/integrations/github/session-subscriptions.ts
 function sessionUserId(user) {
   return user?.workosId ?? user?.id;
@@ -24885,11 +24930,30 @@ async function unsubscribeCurrentSessionFromPullRequest(requestContext, pullRequ
   await unsubscribeFromPullRequest(await subscriptionInput(target, number3), github.integrationStorage);
   return number3;
 }
+async function refreshGithubToken(requestContext, github) {
+  const target = await resolveSessionTarget(requestContext, github);
+  const access = await github.versionControl.getRepositoryAccess({
+    orgId: target.orgId,
+    repositoryId: target.repository.id
+  });
+  const token = access.authorization?.token;
+  if (!token) throw new Error("Repository access did not include a bearer token for the Factory session.");
+  injectGithubToken(requestContext, token);
+}
 function createGithubSubscriptionTools(requestContext, github) {
   const context = requestContext.get("controller");
   const user = requestContext.get("user");
   if (!context?.getState().projectRepositoryId || !sessionOrgId(user) || !sessionUserId(user)) return {};
   return {
+    github_refresh_token: createTool({
+      id: "github_refresh_token",
+      description: "Refresh GitHub CLI authentication in the active Factory sandbox. Use this after a gh command fails because authentication is expired, invalid, or missing. It installs a fresh GH_TOKEN for subsequent sandbox commands. After this tool succeeds, retry the failed gh command. Takes no arguments and never returns the token.",
+      inputSchema: z.object({}),
+      execute: async () => {
+        await refreshGithubToken(requestContext, github);
+        return { refreshed: true };
+      }
+    }),
     github_subscribe_pr: createTool({
       id: "github_subscribe_pr",
       description: "Subscribe this thread to GitHub pull request activity. You usually do not need this tool: successful gh pr create commands subscribe automatically. Use it for an existing PR or to recover when automatic subscription did not occur. Closed or merged PRs are unsubscribed automatically. Accepts a PR number or canonical URL for the active project.",
@@ -25033,20 +25097,27 @@ var SandboxBudgetError = class extends Error {
   max;
   code = "sandbox-budget-exceeded";
 };
-function toMaterializationSandbox(sandbox) {
+function toMaterializationSandbox(sandbox, initialEnvironment = {}) {
   if (typeof sandbox.executeCommand !== "function") {
     throw new Error(
       `Sandbox provider '${sandbox.provider}' does not implement executeCommand() \u2014 cannot materialize repos.`
     );
   }
   const lifecycle = sandbox;
+  const environment = { ...initialEnvironment };
   return {
     id: sandbox.id,
     start: async () => {
       await (lifecycle._start ?? sandbox.start)?.call(sandbox);
     },
     getInfo: async () => await sandbox.getInfo?.() ?? {},
-    executeCommand: (command, args, options) => sandbox.executeCommand(command, args, options),
+    executeCommand: (command, args, options) => sandbox.executeCommand(command, args, {
+      ...options,
+      env: { ...environment, ...options?.env }
+    }),
+    setEnvironmentVariable: (name, value) => {
+      environment[name] = value;
+    },
     stop: async () => {
       await (lifecycle._stop ?? sandbox.stop)?.call(sandbox);
     }
@@ -25186,7 +25257,7 @@ var SandboxFleet = class {
       ...opts.idleTimeoutMinutes !== void 0 ? { idleTimeoutMinutes: opts.idleTimeoutMinutes } : {},
       ...opts.checkpointName ? { checkpointName: opts.checkpointName } : {}
     });
-    return toMaterializationSandbox(clone);
+    return toMaterializationSandbox(clone, opts.env);
   }
   async ensureSandbox(store, envOrProgress, progressOrOptions, maybeOptions = {}) {
     const env = typeof envOrProgress === "function" ? void 0 : envOrProgress;
@@ -25356,8 +25427,8 @@ function bindingStore(row, storage) {
   };
 }
 async function ensureProjectSandbox(options) {
-  const { fleet, row, storage, onProgress } = options;
-  return fleet.ensureSandbox(bindingStore(row, storage), onProgress);
+  const { fleet, row, storage, token, onProgress } = options;
+  return fleet.ensureSandbox(bindingStore(row, storage), { GH_TOKEN: token }, onProgress);
 }
 async function teardownProjectSandbox(options) {
   const { fleet, row, storage, sandbox } = options;
@@ -26073,6 +26144,7 @@ function polledIssueEvent(project, issue) {
         number: issue.number,
         title: issue.title,
         html_url: issue.url,
+        created_at: issue.createdAt,
         labels: issue.labels.map((name) => ({ name }))
       }
     }
@@ -26092,6 +26164,7 @@ function polledPullRequestEvent(project, pullRequest) {
         number: pullRequest.number,
         title: pullRequest.title,
         html_url: pullRequest.url,
+        created_at: pullRequest.createdAt,
         state: "open",
         merged: false,
         head: { ref: pullRequest.headBranch },
@@ -26621,13 +26694,6 @@ async function loadOrCreateSandboxRow(github, project, userId) {
 async function prepareProject(options) {
   const { github, fleet, project, userId, onProgress } = options;
   const sandboxRow = await loadOrCreateSandboxRow(github, project, userId);
-  const sandbox = await ensureProjectSandbox({
-    fleet,
-    row: sandboxRow,
-    storage: github.sourceControlStorage.sandboxes,
-    onProgress
-  });
-  const fresh = await github.sourceControlStorage.sandboxes.getById({ id: sandboxRow.id });
   const access = await github.versionControl.getRepositoryAccess({
     orgId: project.installation.orgId,
     repositoryId: project.repository.id
@@ -26635,6 +26701,14 @@ async function prepareProject(options) {
   if (!access.authorization) {
     throw new MaterializeError("Repository access did not include a bearer token.", "clone-failed");
   }
+  const sandbox = await ensureProjectSandbox({
+    fleet,
+    row: sandboxRow,
+    storage: github.sourceControlStorage.sandboxes,
+    token: access.authorization.token,
+    onProgress
+  });
+  const fresh = await github.sourceControlStorage.sandboxes.getById({ id: sandboxRow.id });
   const finalRow = fresh ?? sandboxRow;
   await materializeRepo({
     row: finalRow,
@@ -27240,6 +27314,7 @@ var PlatformGithubEventWorker = class extends MastraWorker {
   #controller;
   #github;
   #storage;
+  #ingestFactoryEvent;
   #intervalMs;
   #now;
   #dispatch;
@@ -27259,6 +27334,7 @@ var PlatformGithubEventWorker = class extends MastraWorker {
     this.#controller = config.controller;
     this.#github = config.github;
     this.#storage = config.storage;
+    this.#ingestFactoryEvent = config.ingestFactoryEvent;
     this.#intervalMs = config.intervalMs ?? DEFAULT_POLL_INTERVAL_MS;
     if (!Number.isFinite(this.#intervalMs) || this.#intervalMs <= 0) {
       throw new Error("Platform GitHub event polling interval must be a positive number.");
@@ -27416,6 +27492,9 @@ var PlatformGithubEventWorker = class extends MastraWorker {
           });
           continue;
         }
+        if (isFactoryClosureEvent(parsed)) {
+          await this.#ingestFactoryEvent?.(parsed);
+        }
         const result = await this.#dispatch(parsed, {
           controller: this.#controller,
           listSubscriptions: (target, options) => listPullRequestSubscriptionsForWebhook(target, options, this.#github.integrationStorage),
@@ -27481,6 +27560,9 @@ function normalizeSettings(value) {
   }
   return { version: 1, repositories: { ...value.repositories } };
 }
+function isFactoryClosureEvent(event) {
+  return (event.event === "issues" || event.event === "pull_request") && event.payload.action === "closed";
+}
 function parseEvent(event) {
   if (!event.id || !event.deliveryId || !SUPPORTED_EVENTS.has(event.event) || !event.payload || typeof event.payload !== "object" || Array.isArray(event.payload)) {
     return null;
@@ -27829,6 +27911,7 @@ var PlatformGithubIntegration = class {
         controller: ctx.controller,
         github: this,
         storage: ctx.storage.generic,
+        ingestFactoryEvent: ctx.hooks?.ingestGithubEvent,
         intervalMs: this.#pollingIntervalMs
       })
     ];
@@ -29065,6 +29148,158 @@ function isNotFound2(error) {
   return error instanceof PlatformApiError && error.status === 404;
 }
 
+// src/routes/custom-provider-source.ts
+import { setCustomProvidersSource } from "@mastra/code-sdk/agents/custom-provider-source";
+
+// src/routes/provider-credentials.ts
+function getAuthProviderId(provider) {
+  return provider === "openai" ? "openai-codex" : provider;
+}
+var WEB_OAUTH_FLOW_KINDS = {
+  anthropic: "paste-code",
+  openai: "device-code",
+  "github-copilot": "device-code",
+  xai: "device-code"
+};
+async function getTenantCredentialsStorage(credentials) {
+  if (!credentials) return void 0;
+  try {
+    await credentials.ensureReady();
+  } catch {
+    return void 0;
+  }
+  return credentials;
+}
+function tenantOrgId(tenant) {
+  return tenant.orgId ?? `user:${tenant.userId}`;
+}
+async function resolveCredentialContext({
+  c,
+  auth,
+  credentials
+}) {
+  await auth.ensureUser(c);
+  const tenant = auth.tenant(c);
+  if (!tenant) {
+    if (auth.enabled()) return { response: c.json({ error: "unauthorized" }, 401) };
+    return { mode: "local" };
+  }
+  const storage = await getTenantCredentialsStorage(credentials);
+  if (!storage) {
+    return {
+      response: c.json(
+        {
+          error: "credentials_unavailable",
+          message: "Tenant credential storage is unavailable \u2014 the app database is not configured or failed to start."
+        },
+        503
+      )
+    };
+  }
+  return { mode: "tenant", storage, orgId: tenantOrgId(tenant), userId: tenant.userId };
+}
+async function listTenantCredentialsForRequest({
+  c,
+  auth,
+  credentials
+}) {
+  await auth.ensureUser(c);
+  const tenant = auth.tenant(c);
+  if (!tenant) return auth.enabled() ? [] : void 0;
+  const storage = await getTenantCredentialsStorage(credentials);
+  if (!storage) return [];
+  return storage.listCredentials(tenantOrgId(tenant), tenant.userId);
+}
+
+// src/routes/custom-provider-source.ts
+var SNAPSHOT_TTL_MS = 15e3;
+var MAX_CACHED_ORGS = 1e3;
+var LOCAL_ORG = "local";
+var OrgCustomProvidersSnapshot = class {
+  #orgId;
+  #storage;
+  #snapshot = [];
+  #fetchedAt = 0;
+  #hydrating;
+  constructor(orgId, storage) {
+    this.#orgId = orgId;
+    this.#storage = storage;
+  }
+  /** Hydrate the snapshot when stale; coalesces concurrent callers. */
+  async ensureFresh(now = Date.now()) {
+    if (now - this.#fetchedAt < SNAPSHOT_TTL_MS) return;
+    this.#hydrating ??= this.#hydrate().finally(() => {
+      this.#hydrating = void 0;
+    });
+    await this.#hydrating;
+  }
+  async #hydrate() {
+    await this.#storage.ensureReady();
+    const records = await this.#storage.list({ orgId: this.#orgId });
+    this.#snapshot = records.map((record) => ({
+      name: record.name,
+      url: record.url,
+      apiKey: record.apiKey ?? void 0,
+      models: record.models
+    }));
+    this.#fetchedAt = Date.now();
+  }
+  /** Sync by contract; kicks a background re-hydrate when the snapshot is stale. */
+  get() {
+    if (Date.now() - this.#fetchedAt >= SNAPSHOT_TTL_MS) {
+      void this.ensureFresh().catch(() => {
+      });
+    }
+    return this.#snapshot;
+  }
+};
+var orgSnapshots = /* @__PURE__ */ new Map();
+function snapshotFor(orgId, storage) {
+  let snapshot = orgSnapshots.get(orgId);
+  if (!snapshot) {
+    if (orgSnapshots.size >= MAX_CACHED_ORGS) {
+      const oldest = orgSnapshots.keys().next().value;
+      if (oldest !== void 0) orgSnapshots.delete(oldest);
+    }
+    snapshot = new OrgCustomProvidersSnapshot(orgId, storage);
+    orgSnapshots.set(orgId, snapshot);
+  }
+  return snapshot;
+}
+function orgForTenant(tenant, authEnabled) {
+  if (!authEnabled) return LOCAL_ORG;
+  return tenant ? tenantOrgId(tenant) : void 0;
+}
+function registerCustomProvidersSource({
+  storage,
+  authEnabled
+}) {
+  setCustomProvidersSource((tenant) => {
+    const orgId = orgForTenant(tenant, authEnabled);
+    if (!orgId) return [];
+    return snapshotFor(orgId, storage).get();
+  });
+}
+function invalidateCustomProvidersSnapshots(tenant) {
+  orgSnapshots.delete(tenant.orgId);
+}
+function createCustomProvidersPrimer({
+  auth,
+  storage,
+  authEnabled
+}) {
+  return async (c, next) => {
+    const orgId = orgForTenant(auth.tenant(c), authEnabled);
+    if (orgId) {
+      try {
+        await snapshotFor(orgId, storage).ensureFresh();
+      } catch {
+      }
+    }
+    await next();
+  };
+}
+
 // src/routes/projects.ts
 import { registerApiRoute as registerApiRoute6 } from "@mastra/core/server";
 
@@ -29931,6 +30166,11 @@ var FactoryGithubEventService = class {
     return results[0] ?? { status: "ignored" };
   }
   async #ingestProject(parsed, event, installationId, repositoryId, repositoryName, login, project) {
+    const factoryProject = await this.options.projects.get({
+      orgId: project.orgId,
+      id: project.factoryProjectId
+    });
+    if (!factoryProject) return { status: "missing" };
     const issue = object(parsed.payload.issue);
     const pullRequest = object(parsed.payload.pull_request);
     const issueNumber = number(issue?.number);
@@ -29975,13 +30215,22 @@ var FactoryGithubEventService = class {
       } : {},
       event,
       deliveryId: parsed.deliveryId,
+      factory: { createdAt: factoryProject.createdAt.toISOString() },
       repository: { id: repositoryId, fullName: repositoryName },
-      ...issueNumber && string(issue?.title) && string(issue?.html_url) ? { issue: { number: issueNumber, title: string(issue?.title), url: string(issue?.html_url) } } : {},
+      ...issueNumber && string(issue?.title) && string(issue?.html_url) ? {
+        issue: {
+          number: issueNumber,
+          title: string(issue?.title),
+          url: string(issue?.html_url),
+          ...string(issue?.created_at) ? { createdAt: string(issue?.created_at) } : {}
+        }
+      } : {},
       ...pullRequestNumber && string(pullRequest?.title) && string(pullRequest?.html_url) ? {
         pullRequest: {
           number: pullRequestNumber,
           title: string(pullRequest?.title),
           url: string(pullRequest?.html_url),
+          ...string(pullRequest?.created_at) ? { createdAt: string(pullRequest?.created_at) } : {},
           state: string(pullRequest?.state) === "closed" ? "closed" : "open",
           merged: boolean(pullRequest?.merged) ?? false,
           headBranch: string(object(pullRequest?.head)?.ref) ?? "",
@@ -30478,82 +30727,10 @@ var FactoryTransitionService = class {
 };
 
 // src/routes/config.ts
-import { removeCustomPackFromSettings } from "@mastra/code-sdk/onboarding/custom-packs";
-import {
-  removeCustomProviderFromSettings,
-  upsertCustomProviderInSettings
-} from "@mastra/code-sdk/onboarding/custom-providers";
-import { applyOmRoleOverride, persistOmObserveAttachments } from "@mastra/code-sdk/onboarding/om-settings";
+import { DEFAULT_OM_MODEL_ID } from "@mastra/code-sdk/constants";
 import { getAvailableModePacks } from "@mastra/code-sdk/onboarding/packs";
-import {
-  getCustomProviderId,
-  loadSettings,
-  saveSettings,
-  THREAD_ACTIVE_MODEL_PACK_ID_KEY
-} from "@mastra/code-sdk/onboarding/settings";
+import { getCustomProviderId, THREAD_ACTIVE_MODEL_PACK_ID_KEY } from "@mastra/code-sdk/onboarding/settings";
 import { registerApiRoute as registerApiRoute7 } from "@mastra/core/server";
-
-// src/routes/provider-credentials.ts
-function getAuthProviderId(provider) {
-  return provider === "openai" ? "openai-codex" : provider;
-}
-var WEB_OAUTH_FLOW_KINDS = {
-  anthropic: "paste-code",
-  openai: "device-code",
-  "github-copilot": "device-code",
-  xai: "device-code"
-};
-async function getTenantCredentialsStorage(credentials) {
-  if (!credentials) return void 0;
-  try {
-    await credentials.ensureReady();
-  } catch {
-    return void 0;
-  }
-  return credentials;
-}
-function tenantOrgId(tenant) {
-  return tenant.orgId ?? `user:${tenant.userId}`;
-}
-async function resolveCredentialContext({
-  c,
-  auth,
-  credentials
-}) {
-  await auth.ensureUser(c);
-  const tenant = auth.tenant(c);
-  if (!tenant) {
-    if (auth.enabled()) return { response: c.json({ error: "unauthorized" }, 401) };
-    return { mode: "local" };
-  }
-  const storage = await getTenantCredentialsStorage(credentials);
-  if (!storage) {
-    return {
-      response: c.json(
-        {
-          error: "credentials_unavailable",
-          message: "Tenant credential storage is unavailable \u2014 the app database is not configured or failed to start."
-        },
-        503
-      )
-    };
-  }
-  return { mode: "tenant", storage, orgId: tenantOrgId(tenant), userId: tenant.userId };
-}
-async function listTenantCredentialsForRequest({
-  c,
-  auth,
-  credentials
-}) {
-  await auth.ensureUser(c);
-  const tenant = auth.tenant(c);
-  if (!tenant) return auth.enabled() ? [] : void 0;
-  const storage = await getTenantCredentialsStorage(credentials);
-  if (!storage) return [];
-  return storage.listCredentials(tenantOrgId(tenant), tenant.userId);
-}
-
-// src/routes/config.ts
 function loose6(c) {
   return c;
 }
@@ -30597,15 +30774,39 @@ async function listProviders({
   }
   return Array.from(seen.values()).sort((a, b) => a.provider.localeCompare(b.provider));
 }
-function listCustomProviders() {
-  const settings = loadSettings();
-  return settings.customProviders.map((p) => ({
-    id: getCustomProviderId(p.name),
-    name: p.name,
-    url: p.url,
-    hasApiKey: Boolean(p.apiKey),
-    models: p.models
-  }));
+function toCustomProviderInfo(record) {
+  return {
+    id: record.providerId,
+    name: record.name,
+    url: record.url,
+    hasApiKey: Boolean(record.apiKey),
+    models: record.models
+  };
+}
+async function resolveCustomProvidersContext({
+  c,
+  auth,
+  customProviders
+}) {
+  await auth.ensureUser(c);
+  const tenant = auth.tenant(c);
+  if (!tenant && auth.enabled()) return { response: c.json({ error: "unauthorized" }, 401) };
+  if (customProviders) {
+    try {
+      await customProviders.ensureReady();
+      return tenant ? { storage: customProviders, orgId: tenantOrgId(tenant), userId: tenant.userId } : { storage: customProviders, orgId: "local", userId: "local" };
+    } catch {
+    }
+  }
+  return {
+    response: c.json(
+      {
+        error: "custom_providers_unavailable",
+        message: "Custom provider storage is unavailable \u2014 the app database is not configured or failed to start."
+      },
+      503
+    )
+  };
 }
 function parseCustomProviderBody(body) {
   if (!body || typeof body !== "object") return { error: "Invalid JSON body" };
@@ -30670,15 +30871,6 @@ async function buildProviderAccess({
 function canUseModelProvider(access, provider) {
   return Boolean(access[provider]);
 }
-async function getTenantModelPacksStorage(modelPacks) {
-  if (!modelPacks) return void 0;
-  try {
-    await modelPacks.ensureReady();
-  } catch {
-    return void 0;
-  }
-  return modelPacks;
-}
 async function resolvePackContext({
   c,
   auth,
@@ -30686,23 +30878,23 @@ async function resolvePackContext({
 }) {
   await auth.ensureUser(c);
   const tenant = auth.tenant(c);
-  if (!tenant) {
-    if (auth.enabled()) return { response: c.json({ error: "unauthorized" }, 401) };
-    return { mode: "local" };
-  }
-  const storage = await getTenantModelPacksStorage(modelPacks);
-  if (!storage) {
-    return {
-      response: c.json(
-        {
-          error: "model_packs_unavailable",
-          message: "Model pack storage is unavailable \u2014 the app database is not configured or failed to start."
-        },
-        503
-      )
-    };
+  if (!tenant && auth.enabled()) return { response: c.json({ error: "unauthorized" }, 401) };
+  if (modelPacks) {
+    try {
+      await modelPacks.ensureReady();
+      return tenant ? { storage: modelPacks, orgId: tenantOrgId(tenant), userId: tenant.userId } : { storage: modelPacks, orgId: "local", userId: "local" };
+    } catch {
+    }
   }
-  return { mode: "tenant", storage, orgId: tenantOrgId(tenant), userId: tenant.userId };
+  return {
+    response: c.json(
+      {
+        error: "model_packs_unavailable",
+        message: "Model pack storage is unavailable \u2014 the app database is not configured or failed to start."
+      },
+      503
+    )
+  };
 }
 function recordToModePack(record) {
   return { id: `custom:${record.id}`, name: record.name, description: "Saved custom pack", models: record.models };
@@ -30715,7 +30907,7 @@ async function listModelPacks({
   activePackId
 }) {
   const access = await buildProviderAccess({ controller, authStorage, tenantCredentials });
-  const packs = packContext.mode === "local" ? getAvailableModePacks(access, loadSettings().customModelPacks) : [
+  const packs = [
     ...getAvailableModePacks(access),
     ...(await packContext.storage.list({ orgId: packContext.orgId })).map(recordToModePack)
   ];
@@ -30773,20 +30965,57 @@ function readOMConfig(session) {
     observeAttachments: observeAttachments === true || observeAttachments === false ? observeAttachments : "auto"
   };
 }
-function persistOmThreshold({ role, value }) {
-  const settings = loadSettings();
-  if (role === "observation") settings.models.omObservationThreshold = value;
-  else settings.models.omReflectionThreshold = value;
-  saveSettings(settings);
-}
-function persistOmRoleOverride({
-  role,
-  modelId,
-  otherRoleCurrentModelId
+async function resolveMemorySettingsContext({
+  c,
+  auth,
+  memorySettings
 }) {
-  const settings = loadSettings();
-  applyOmRoleOverride(settings, role, modelId, otherRoleCurrentModelId);
-  saveSettings(settings);
+  await auth.ensureUser(c);
+  const tenant = auth.tenant(c);
+  if (!tenant && auth.enabled()) return { response: c.json({ error: "unauthorized" }, 401) };
+  if (memorySettings) {
+    try {
+      await memorySettings.ensureReady();
+      return tenant ? { storage: memorySettings, orgId: tenantOrgId(tenant), userId: tenant.userId } : { storage: memorySettings, orgId: "local", userId: "local" };
+    } catch {
+    }
+  }
+  return {
+    response: c.json(
+      {
+        error: "memory_settings_unavailable",
+        message: "Memory settings storage is unavailable \u2014 the app database is not configured or failed to start."
+      },
+      503
+    )
+  };
+}
+async function persistMemorySettings(context, patch, fillIfUnset) {
+  await context.storage.patch({ orgId: context.orgId, userId: context.userId, patch, fillIfUnset });
+}
+async function hydrateSessionMemorySettings(session, record) {
+  for (const role of ["observer", "reflector"]) {
+    const stored = role === "observer" ? record?.observerModelId : record?.reflectorModelId;
+    const target = stored ?? DEFAULT_OM_MODEL_ID;
+    if (session.om[role].modelId() !== target) {
+      await session.om[role].switchModel({ modelId: target });
+    }
+  }
+  const state = session.state.get() ?? {};
+  const updates = {};
+  const observationThreshold = record?.observationThreshold ?? DEFAULT_OBSERVATION_THRESHOLD;
+  if (state.observationThreshold !== observationThreshold) {
+    updates.observationThreshold = observationThreshold;
+  }
+  const reflectionThreshold = record?.reflectionThreshold ?? DEFAULT_REFLECTION_THRESHOLD;
+  if (state.reflectionThreshold !== reflectionThreshold) {
+    updates.reflectionThreshold = reflectionThreshold;
+  }
+  const observeAttachments = record?.observeAttachments ?? "auto";
+  if ((state.observeAttachments ?? "auto") !== observeAttachments) {
+    updates.observeAttachments = observeAttachments;
+  }
+  if (Object.keys(updates).length > 0) await session.state.set(updates);
 }
 var ConfigRoutes = class extends Route {
   routes() {
@@ -30794,6 +31023,8 @@ var ConfigRoutes = class extends Route {
     const { controller, authStorage, auth } = options;
     const onCredentialsChanged = options.onCredentialsChanged ?? (() => {
     });
+    const onCustomProvidersChanged = options.onCustomProvidersChanged ?? (() => {
+    });
     return [
       registerApiRoute7("/web/config/providers", {
         method: "GET",
@@ -30885,14 +31116,22 @@ var ConfigRoutes = class extends Route {
         }
       }),
       // ── Custom providers (OpenAI-compatible endpoints) ──────────────────────
-      // Mirrors the TUI's /custom-providers command. Backed by GlobalSettings
-      // (settings.json), not session state — these are user-global definitions.
+      // Mirrors the TUI's /custom-providers command, but backed by the
+      // `custom-providers` domain (org rows in tenant mode, a sentinel `local`
+      // org in no-auth mode) — the server never reads settings.json for these.
       registerApiRoute7("/web/config/custom-providers", {
         method: "GET",
         requiresAuth: false,
-        handler: (c) => {
+        handler: async (c) => {
+          const ctx = await resolveCustomProvidersContext({
+            c: loose6(c),
+            auth,
+            customProviders: options.customProviders
+          });
+          if ("response" in ctx) return ctx.response;
           try {
-            return c.json({ providers: listCustomProviders() });
+            const records = await ctx.storage.list({ orgId: ctx.orgId });
+            return c.json({ providers: records.map(toCustomProviderInfo) });
           } catch (error) {
             return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
           }
@@ -30902,6 +31141,12 @@ var ConfigRoutes = class extends Route {
         method: "POST",
         requiresAuth: false,
         handler: async (c) => {
+          const ctx = await resolveCustomProvidersContext({
+            c: loose6(c),
+            auth,
+            customProviders: options.customProviders
+          });
+          if ("response" in ctx) return ctx.response;
           let body;
           try {
             body = await c.req.json();
@@ -30912,11 +31157,20 @@ var ConfigRoutes = class extends Route {
           if ("error" in parsed) return c.json({ error: parsed.error }, 400);
           const previousId = body && typeof body === "object" && typeof body.previousId === "string" ? body.previousId : void 0;
           try {
-            const settings = loadSettings();
-            upsertCustomProviderInSettings(settings, parsed, previousId);
-            saveSettings(settings);
-            const id = getCustomProviderId(parsed.name);
-            return c.json({ ok: true, provider: listCustomProviders().find((p) => p.id === id) });
+            const record = await ctx.storage.upsert({
+              orgId: ctx.orgId,
+              userId: ctx.userId,
+              input: {
+                providerId: getCustomProviderId(parsed.name),
+                name: parsed.name,
+                url: parsed.url,
+                apiKey: parsed.apiKey,
+                models: parsed.models
+              },
+              previousProviderId: previousId
+            });
+            onCustomProvidersChanged({ orgId: ctx.orgId });
+            return c.json({ ok: true, provider: toCustomProviderInfo(record) });
           } catch (error) {
             return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
           }
@@ -30925,12 +31179,17 @@ var ConfigRoutes = class extends Route {
       registerApiRoute7("/web/config/custom-providers/:id", {
         method: "DELETE",
         requiresAuth: false,
-        handler: (c) => {
+        handler: async (c) => {
+          const ctx = await resolveCustomProvidersContext({
+            c: loose6(c),
+            auth,
+            customProviders: options.customProviders
+          });
+          if ("response" in ctx) return ctx.response;
           const id = c.req.param("id");
           try {
-            const settings = loadSettings();
-            removeCustomProviderFromSettings(settings, id);
-            saveSettings(settings);
+            await ctx.storage.delete({ orgId: ctx.orgId, providerId: id });
+            onCustomProvidersChanged({ orgId: ctx.orgId });
             return c.json({ ok: true });
           } catch (error) {
             return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
@@ -30959,8 +31218,30 @@ var ConfigRoutes = class extends Route {
                 tenantCredentials
               })
             ]);
+            const catalog = models.filter((m) => canUseModelProvider(access, m.provider) && typeof m.id === "string").map((m) => ({ id: m.id, provider: m.provider, modelName: m.modelName, hasApiKey: true }));
+            if (options.customProviders) {
+              try {
+                const ctx = await resolveCustomProvidersContext({
+                  c: loose6(c),
+                  auth,
+                  customProviders: options.customProviders
+                });
+                if (!("response" in ctx)) {
+                  const known = new Set(catalog.map((m) => m.id));
+                  for (const record of await ctx.storage.list({ orgId: ctx.orgId })) {
+                    for (const model of record.models) {
+                      const id = `${record.providerId}/${model}`;
+                      if (known.has(id)) continue;
+                      known.add(id);
+                      catalog.push({ id, provider: record.providerId, modelName: model, hasApiKey: true });
+                    }
+                  }
+                }
+              } catch {
+              }
+            }
             return c.json({
-              models: models.filter((m) => canUseModelProvider(access, m.provider) && typeof m.id === "string").map((m) => ({ id: m.id, provider: m.provider, modelName: m.modelName, hasApiKey: true })).sort(
+              models: catalog.sort(
                 (a, b) => a.provider === b.provider ? a.id.localeCompare(b.id) : a.provider.localeCompare(b.provider)
               )
             });
@@ -30970,10 +31251,10 @@ var ConfigRoutes = class extends Route {
         }
       }),
       // ── Model packs ─────────────────────────────────────────────────────────
-      // Mirrors the TUI's /models-pack command. Custom-pack CRUD is DB-backed in
-      // tenant mode (model-packs storage domain, org-scoped) and settings.json in
-      // local mode; activation is session-scoped and resolves the session from
-      // the controller registry by resourceId.
+      // Mirrors the TUI's /models-pack command. Custom-pack CRUD lives in the
+      // model-packs storage domain (org-scoped, sentinel `local` org in no-auth
+      // mode — never settings.json); activation is session-scoped and resolves
+      // the session from the controller registry by resourceId.
       registerApiRoute7("/web/config/model-packs", {
         method: "GET",
         requiresAuth: false,
@@ -31027,21 +31308,12 @@ var ConfigRoutes = class extends Route {
             return c.json({ error: "models.build, models.plan and models.fast are required" }, 400);
           }
           try {
-            if (packContext.mode === "tenant") {
-              const record = await packContext.storage.upsert({
-                orgId: packContext.orgId,
-                userId: packContext.userId,
-                input: { name, models: { build, plan, fast } }
-              });
-              return c.json({ ok: true, pack: recordToModePack(record) });
-            }
-            const settings = loadSettings();
-            const entry = { name, models: { build, plan, fast }, createdAt: (/* @__PURE__ */ new Date()).toISOString() };
-            const idx = settings.customModelPacks.findIndex((p) => p.name === name);
-            if (idx >= 0) settings.customModelPacks[idx] = entry;
-            else settings.customModelPacks.push(entry);
-            saveSettings(settings);
-            return c.json({ ok: true, pack: { id: `custom:${name}`, name, models: { build, plan, fast } } });
+            const record = await packContext.storage.upsert({
+              orgId: packContext.orgId,
+              userId: packContext.userId,
+              input: { name, models: { build, plan, fast } }
+            });
+            return c.json({ ok: true, pack: recordToModePack(record) });
           } catch (error) {
             return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
           }
@@ -31055,15 +31327,9 @@ var ConfigRoutes = class extends Route {
           if ("response" in packContext) return packContext.response;
           const id = decodeURIComponent(c.req.param("id"));
           try {
-            if (packContext.mode === "tenant") {
-              const recordId = id.startsWith("custom:") ? id.slice("custom:".length) : id;
-              const deleted = await packContext.storage.delete({ orgId: packContext.orgId, id: recordId });
-              return deleted ? c.json({ ok: true }) : c.json({ error: `Unknown pack "${id}"` }, 404);
-            }
-            const settings = loadSettings();
-            removeCustomPackFromSettings(settings, id);
-            saveSettings(settings);
-            return c.json({ ok: true });
+            const recordId = id.startsWith("custom:") ? id.slice("custom:".length) : id;
+            const deleted = await packContext.storage.delete({ orgId: packContext.orgId, id: recordId });
+            return deleted ? c.json({ ok: true }) : c.json({ error: `Unknown pack "${id}"` }, 404);
           } catch (error) {
             return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
           }
@@ -31110,8 +31376,10 @@ var ConfigRoutes = class extends Route {
       }),
       // ── Observational memory ──────────────────────────────────────────────────
       // Mirrors the TUI's /om command. All five knobs are session-scoped (resolved
-      // from the session, persisted to its state + thread setting) plus written to
-      // GlobalSettings so the choice survives restarts and stays in sync with the TUI.
+      // from the session, persisted to its state + thread setting) and durably
+      // stored in the per-(org, user) `memory-settings` app table — never
+      // settings.json. GET hydrates the session from the stored row first so the
+      // DB, not the SDK's boot-time seed, is the source of truth.
       registerApiRoute7("/web/config/om", {
         method: "GET",
         requiresAuth: false,
@@ -31119,9 +31387,17 @@ var ConfigRoutes = class extends Route {
           const resourceId = c.req.query("resourceId");
           const scope = c.req.query("scope") || void 0;
           if (!resourceId) return c.json({ error: "Missing required query param: resourceId" }, 400);
+          const context = await resolveMemorySettingsContext({
+            c: loose6(c),
+            auth,
+            memorySettings: options.memorySettings
+          });
+          if ("response" in context) return context.response;
           try {
             const session = await controller.getSessionByResource?.(resourceId, scope);
             if (!session) return c.json({ error: `No session for resourceId "${resourceId}"` }, 404);
+            const record = await context.storage.get({ orgId: context.orgId, userId: context.userId });
+            await hydrateSessionMemorySettings(session, record);
             return c.json({ config: readOMConfig(session) });
           } catch (error) {
             return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
@@ -31147,13 +31423,24 @@ var ConfigRoutes = class extends Route {
           const modelId = typeof body.modelId === "string" ? body.modelId.trim() : "";
           if (!resourceId) return c.json({ error: "Missing required field: resourceId" }, 400);
           if (!modelId) return c.json({ error: "Missing required field: modelId" }, 400);
+          const context = await resolveMemorySettingsContext({
+            c: loose6(c),
+            auth,
+            memorySettings: options.memorySettings
+          });
+          if ("response" in context) return context.response;
           try {
             const session = await controller.getSessionByResource?.(resourceId, scope);
             if (!session) return c.json({ error: `No session for resourceId "${resourceId}"` }, 404);
             const otherRole = role === "observer" ? session.om.reflector : session.om.observer;
             const otherRoleCurrentModelId = otherRole.modelId() ?? null;
             await session.om[role].switchModel({ modelId });
-            persistOmRoleOverride({ role, modelId, otherRoleCurrentModelId });
+            const otherKey = role === "observer" ? "reflectorModelId" : "observerModelId";
+            await persistMemorySettings(
+              context,
+              { [role === "observer" ? "observerModelId" : "reflectorModelId"]: modelId },
+              otherRoleCurrentModelId ? { [otherKey]: otherRoleCurrentModelId } : void 0
+            );
             return c.json({ ok: true, config: readOMConfig(session) });
           } catch (error) {
             return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
@@ -31178,19 +31465,27 @@ var ConfigRoutes = class extends Route {
           if (observation === void 0 && reflection === void 0) {
             return c.json({ error: "Provide observationThreshold and/or reflectionThreshold (positive numbers)" }, 400);
           }
+          const context = await resolveMemorySettingsContext({
+            c: loose6(c),
+            auth,
+            memorySettings: options.memorySettings
+          });
+          if ("response" in context) return context.response;
           try {
             const session = await controller.getSessionByResource?.(resourceId, scope);
             if (!session) return c.json({ error: `No session for resourceId "${resourceId}"` }, 404);
             if (observation !== void 0) {
               await session.state.set({ observationThreshold: observation });
               await session.thread.setSetting({ key: "observationThreshold", value: observation });
-              persistOmThreshold({ role: "observation", value: observation });
             }
             if (reflection !== void 0) {
               await session.state.set({ reflectionThreshold: reflection });
               await session.thread.setSetting({ key: "reflectionThreshold", value: reflection });
-              persistOmThreshold({ role: "reflection", value: reflection });
             }
+            await persistMemorySettings(context, {
+              ...observation !== void 0 ? { observationThreshold: observation } : {},
+              ...reflection !== void 0 ? { reflectionThreshold: reflection } : {}
+            });
             return c.json({ ok: true, config: readOMConfig(session) });
           } catch (error) {
             return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
@@ -31215,12 +31510,18 @@ var ConfigRoutes = class extends Route {
           if (raw !== "auto" && raw !== true && raw !== false) {
             return c.json({ error: "value must be 'auto', true, or false" }, 400);
           }
+          const context = await resolveMemorySettingsContext({
+            c: loose6(c),
+            auth,
+            memorySettings: options.memorySettings
+          });
+          if ("response" in context) return context.response;
           try {
             const session = await controller.getSessionByResource?.(resourceId, scope);
             if (!session) return c.json({ error: `No session for resourceId "${resourceId}"` }, 404);
             await session.state.set({ observeAttachments: value });
             await session.thread.setSetting({ key: "observeAttachments", value });
-            persistOmObserveAttachments(value);
+            await persistMemorySettings(context, { observeAttachments: value });
             return c.json({ ok: true, config: readOMConfig(session) });
           } catch (error) {
             return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
@@ -32438,7 +32739,7 @@ var SkillRoutes = class extends Route {
 // src/routes/tenant-credentials.ts
 import { setCredentialStoreProvider } from "@mastra/code-sdk/agents/credential-resolver";
 import { getOAuthProvider } from "@mastra/code-sdk/auth/storage";
-var SNAPSHOT_TTL_MS = 15e3;
+var SNAPSHOT_TTL_MS2 = 15e3;
 var MAX_CACHED_TENANTS = 1e3;
 var TenantCredentialStore = class {
   allowEnvironmentFallback = false;
@@ -32455,7 +32756,7 @@ var TenantCredentialStore = class {
   }
   /** Hydrate the snapshot when stale; coalesces concurrent callers. */
   async ensureFresh(now = Date.now()) {
-    if (now - this.#fetchedAt < SNAPSHOT_TTL_MS) return;
+    if (now - this.#fetchedAt < SNAPSHOT_TTL_MS2) return;
     this.#hydrating ??= this.#hydrate().finally(() => {
       this.#hydrating = void 0;
     });
@@ -32477,7 +32778,7 @@ var TenantCredentialStore = class {
   }
   /** Sync by contract; kicks a background re-hydrate when the snapshot is stale. */
   reload() {
-    if (Date.now() - this.#fetchedAt >= SNAPSHOT_TTL_MS) {
+    if (Date.now() - this.#fetchedAt >= SNAPSHOT_TTL_MS2) {
       void this.ensureFresh().catch(() => {
       });
     }
@@ -34813,6 +35114,7 @@ function assembleFactoryApiRoutes(deps) {
     github: githubIntegration,
     sourceControl: githubStorage,
     integrationStorage: deps.integrationStorage.forIntegration("github"),
+    projects: deps.domains.projects,
     storage: workItems,
     rules: deps.rules
   }) : void 0;
@@ -34860,7 +35162,10 @@ function assembleFactoryApiRoutes(deps) {
       authStorage: deps.authStorage,
       modelCredentials: deps.domains.modelCredentials,
       modelPacks: deps.domains.modelPacks,
-      onCredentialsChanged: invalidateTenantCredentialSnapshots
+      memorySettings: deps.domains.memorySettings,
+      customProviders: deps.domains.customProviders,
+      onCredentialsChanged: invalidateTenantCredentialSnapshots,
+      onCustomProvidersChanged: invalidateCustomProvidersSnapshots
     }).routes(),
     ...new OAuthRoutes({
       auth: deps.auth,
@@ -34950,6 +35255,12 @@ function advanceApprovedPlan(context) {
     stage: "execute"
   };
 }
+function createdAfterFactory(createdAt, factoryCreatedAt) {
+  if (!createdAt) return false;
+  const sourceCreatedAt = Date.parse(createdAt);
+  const projectCreatedAt = Date.parse(factoryCreatedAt);
+  return Number.isFinite(sourceCreatedAt) && Number.isFinite(projectCreatedAt) && sourceCreatedAt > projectCreatedAt;
+}
 function issueOpened(context) {
   if (!context.issue) return;
   return {
@@ -34960,7 +35271,7 @@ function issueOpened(context) {
     sourceKey: `github-issue:${context.issue.number}`,
     title: context.issue.title,
     url: context.issue.url,
-    stage: trustedGithubActor(context) ? "triage" : "intake",
+    stage: trustedGithubActor(context) && createdAfterFactory(context.issue.createdAt, context.factory.createdAt) ? "triage" : "intake",
     metadata: {
       githubRepositoryId: context.repository.id,
       githubIssueNumber: context.issue.number
@@ -34977,7 +35288,7 @@ function pullRequestOpened(context) {
     sourceKey: `github-pr:${context.pullRequest.number}`,
     title: context.pullRequest.title,
     url: context.pullRequest.url,
-    stage: trustedGithubActor(context) ? "review" : "intake",
+    stage: trustedGithubActor(context) && createdAfterFactory(context.pullRequest.createdAt, context.factory.createdAt) ? "review" : "intake",
     metadata: {
       githubRepositoryId: context.repository.id,
       githubPullRequestNumber: context.pullRequest.number,
@@ -36019,10 +36330,13 @@ var MIME = {
 };
 var SERVER_PREFIXES = ["/api", "/web", "/auth"];
 function resolveUiDistDir() {
+  const projectRoot = process.env.MASTRA_PROJECT_ROOT?.trim();
   const candidates = [
     process.env.MASTRACODE_UI_DIST,
-    join2(dirname(fileURLToPath(import.meta.url)), "ui"),
-    resolve2(process.cwd(), "src/mastra/public/ui")
+    resolve2(process.cwd(), "factory"),
+    join2(dirname(fileURLToPath(import.meta.url)), "factory"),
+    projectRoot && resolve2(projectRoot, "src/mastra/public/factory"),
+    resolve2(process.cwd(), "src/mastra/public/factory")
   ];
   for (const candidate of candidates) {
     if (candidate && existsSync(join2(candidate, "index.html"))) return resolve2(candidate);
@@ -36448,8 +36762,154 @@ var AuditDomain = class {
   }
 };
 
-// src/storage/domains/intake/base.ts
+// src/storage/domains/custom-providers/base.ts
 import { FactoryStorageDomain as FactoryStorageDomain5, UniqueViolationError as UniqueViolationError5 } from "@mastra/core/storage";
+var CUSTOM_PROVIDERS_SCHEMA = {
+  name: "custom_providers",
+  columns: {
+    id: { type: "uuid-pk" },
+    org_id: { type: "text" },
+    created_by: { type: "text" },
+    provider_id: { type: "text" },
+    name: { type: "text" },
+    url: { type: "text" },
+    api_key: { type: "text", nullable: true },
+    models: { type: "json" },
+    created_at: { type: "timestamp" },
+    updated_at: { type: "timestamp" }
+  },
+  uniqueIndexes: [{ name: "custom_providers_org_provider_key", columns: ["org_id", "provider_id"] }]
+};
+function toRecord(row) {
+  return {
+    id: row.id,
+    orgId: row.org_id,
+    createdBy: row.created_by,
+    providerId: row.provider_id,
+    name: row.name,
+    url: row.url,
+    apiKey: row.api_key,
+    models: Array.isArray(row.models) ? row.models : [],
+    createdAt: row.created_at,
+    updatedAt: row.updated_at
+  };
+}
+var CustomProvidersStorage = class extends FactoryStorageDomain5 {
+  constructor() {
+    super("custom-providers");
+  }
+  async init() {
+    await this.ensureCollections([CUSTOM_PROVIDERS_SCHEMA]);
+  }
+  async dangerouslyClearAll() {
+    await this.ops.deleteMany("custom_providers", {});
+  }
+  get #db() {
+    return this.ops;
+  }
+  /**
+   * Create or wholesale-replace a provider by `(orgId, providerId)` — mirrors
+   * the settings.json upsert semantics (no key retention: an absent `apiKey`
+   * clears the stored key). `previousProviderId` renames the provider: the
+   * common path is a single atomic in-place update of the old row; renaming
+   * onto an id that already exists overwrites the target first and removes the
+   * old row last, so no interleaving or failure can lose the provider.
+   */
+  async upsert({
+    orgId,
+    userId,
+    input,
+    previousProviderId
+  }) {
+    const now = /* @__PURE__ */ new Date();
+    const renameFrom = previousProviderId && previousProviderId !== input.providerId ? previousProviderId : void 0;
+    if (renameFrom) {
+      const target = await this.#db.findOne("custom_providers", {
+        org_id: orgId,
+        provider_id: input.providerId
+      });
+      if (!target) {
+        const renamed = await this.#db.updateAtomic(
+          "custom_providers",
+          { org_id: orgId, provider_id: renameFrom },
+          () => ({
+            provider_id: input.providerId,
+            name: input.name,
+            url: input.url,
+            api_key: input.apiKey ?? null,
+            models: input.models,
+            updated_at: now
+          })
+        );
+        if (renamed) return toRecord(renamed);
+      }
+    }
+    const record = await this.#write({ orgId, userId, input, now });
+    if (renameFrom) {
+      await this.#db.deleteMany("custom_providers", { org_id: orgId, provider_id: renameFrom });
+    }
+    return record;
+  }
+  /**
+   * Update-first, then insert-and-catch-unique-violation (see `queue_health`):
+   * concurrent creates of the same provider both succeed (last write wins on
+   * the single row) instead of one failing on the unique index, and a row
+   * deleted mid-flight is recreated rather than reported as a stale success.
+   */
+  async #write({
+    orgId,
+    userId,
+    input,
+    now
+  }) {
+    const updateExisting = () => this.#db.updateAtomic(
+      "custom_providers",
+      { org_id: orgId, provider_id: input.providerId },
+      () => ({
+        name: input.name,
+        url: input.url,
+        api_key: input.apiKey ?? null,
+        models: input.models,
+        updated_at: now
+      })
+    );
+    const updated = await updateExisting();
+    if (updated) return toRecord(updated);
+    try {
+      const row = await this.#db.insertOne("custom_providers", {
+        org_id: orgId,
+        created_by: userId,
+        provider_id: input.providerId,
+        name: input.name,
+        url: input.url,
+        api_key: input.apiKey ?? null,
+        models: input.models,
+        created_at: now,
+        updated_at: now
+      });
+      return toRecord(row);
+    } catch (error) {
+      if (!(error instanceof UniqueViolationError5)) throw error;
+      const row = await updateExisting();
+      if (!row) throw error;
+      return toRecord(row);
+    }
+  }
+  async list({ orgId }) {
+    const rows = await this.#db.findMany(
+      "custom_providers",
+      { org_id: orgId },
+      { orderBy: [["name", "asc"]] }
+    );
+    return rows.map(toRecord);
+  }
+  async delete({ orgId, providerId }) {
+    return await this.#db.deleteMany("custom_providers", { org_id: orgId, provider_id: providerId }) > 0;
+  }
+};
+
+// src/storage/domains/intake/base.ts
+import { FactoryStorageDomain as FactoryStorageDomain6, UniqueViolationError as UniqueViolationError6 } from "@mastra/core/storage";
 var DEFAULT_INTAKE_CONFIG = {};
 var INTAKE_SETTINGS_SCHEMA = {
   name: "intake_settings",
@@ -36463,7 +36923,7 @@ var INTAKE_SETTINGS_SCHEMA = {
   },
   uniqueIndexes: [{ name: "intake_settings_org_user_unique", columns: ["org_id", "user_id"] }]
 };
-var IntakeStorage = class extends FactoryStorageDomain5 {
+var IntakeStorage = class extends FactoryStorageDomain6 {
   constructor() {
     super("intake");
   }
@@ -36499,14 +36959,14 @@ var IntakeStorage = class extends FactoryStorageDomain5 {
     try {
       await this.#db.insertOne("intake_settings", { ...where, config, created_at: now, updated_at: now });
     } catch (error) {
-      if (!(error instanceof UniqueViolationError5)) throw error;
+      if (!(error instanceof UniqueViolationError6)) throw error;
       await this.#db.updateMany("intake_settings", where, { config, updated_at: now });
     }
   }
 };
 
 // src/storage/domains/integrations/base.ts
-import { FactoryStorageDomain as FactoryStorageDomain6, UniqueViolationError as UniqueViolationError6 } from "@mastra/core/storage";
+import { FactoryStorageDomain as FactoryStorageDomain7, UniqueViolationError as UniqueViolationError7 } from "@mastra/core/storage";
 var INTEGRATION_CONNECTIONS_SCHEMA = {
   name: "integration_connections",
   columns: {
@@ -36559,7 +37019,7 @@ var INTEGRATION_SETTINGS_SCHEMA = {
     { name: "integration_settings_integration_org_user_unique", columns: ["integration_id", "org_id", "user_id"] }
   ]
 };
-var IntegrationStorage = class extends FactoryStorageDomain6 {
+var IntegrationStorage = class extends FactoryStorageDomain7 {
   constructor() {
     super("integrations");
   }
@@ -36635,7 +37095,7 @@ var IntegrationStorage = class extends FactoryStorageDomain6 {
               });
               return;
             } catch (error) {
-              if (!(error instanceof UniqueViolationError6)) throw error;
+              if (!(error instanceof UniqueViolationError7)) throw error;
               lastError = error;
             }
           }
@@ -36740,7 +37200,7 @@ var IntegrationStorage = class extends FactoryStorageDomain6 {
               });
               return;
             } catch (error) {
-              if (!(error instanceof UniqueViolationError6)) throw error;
+              if (!(error instanceof UniqueViolationError7)) throw error;
               lastError = error;
             }
           }
@@ -36751,8 +37211,115 @@ var IntegrationStorage = class extends FactoryStorageDomain6 {
   }
 };
 
+// src/storage/domains/memory-settings/base.ts
+import { FactoryStorageDomain as FactoryStorageDomain8, UniqueViolationError as UniqueViolationError8 } from "@mastra/core/storage";
+var MEMORY_SETTINGS_SCHEMA = {
+  name: "memory_settings",
+  columns: {
+    id: { type: "uuid-pk" },
+    org_id: { type: "text" },
+    user_id: { type: "text" },
+    observer_model_id: { type: "text", nullable: true },
+    reflector_model_id: { type: "text", nullable: true },
+    observation_threshold: { type: "integer", nullable: true },
+    reflection_threshold: { type: "integer", nullable: true },
+    // 'auto' | true | false — json keeps the tri-state without string encoding.
+    observe_attachments: { type: "json", nullable: true },
+    created_at: { type: "timestamp" },
+    updated_at: { type: "timestamp" }
+  },
+  uniqueIndexes: [{ name: "memory_settings_org_user_key", columns: ["org_id", "user_id"] }]
+};
+function toRecord2(row) {
+  return {
+    orgId: row.org_id,
+    userId: row.user_id,
+    observerModelId: row.observer_model_id,
+    reflectorModelId: row.reflector_model_id,
+    observationThreshold: row.observation_threshold,
+    reflectionThreshold: row.reflection_threshold,
+    observeAttachments: row.observe_attachments,
+    createdAt: row.created_at,
+    updatedAt: row.updated_at
+  };
+}
+function patchToColumns(patch) {
+  const columns = {};
+  if (patch.observerModelId !== void 0) columns.observer_model_id = patch.observerModelId;
+  if (patch.reflectorModelId !== void 0) columns.reflector_model_id = patch.reflectorModelId;
+  if (patch.observationThreshold !== void 0) columns.observation_threshold = patch.observationThreshold;
+  if (patch.reflectionThreshold !== void 0) columns.reflection_threshold = patch.reflectionThreshold;
+  if (patch.observeAttachments !== void 0) columns.observe_attachments = patch.observeAttachments;
+  return columns;
+}
+var MemorySettingsStorage = class extends FactoryStorageDomain8 {
+  constructor() {
+    super("memory-settings");
+  }
+  async init() {
+    await this.ensureCollections([MEMORY_SETTINGS_SCHEMA]);
+  }
+  async dangerouslyClearAll() {
+    await this.ops.deleteMany("memory_settings", {});
+  }
+  get #db() {
+    return this.ops;
+  }
+  async get({ orgId, userId }) {
+    const row = await this.#db.findOne("memory_settings", { org_id: orgId, user_id: userId });
+    return row ? toRecord2(row) : null;
+  }
+  /**
+   * Upsert the user's row, writing only the knobs present in `patch`.
+   * `fillIfUnset` knobs are written only where the stored value is still
+   * `NULL`, decided inside the atomic update so concurrent explicit writes
+   * win over fills. Concurrent first writes are resolved via the shared
+   * insert-then-catch-unique-violation pattern (see `queue_health`).
+   */
+  async patch({
+    orgId,
+    userId,
+    patch,
+    fillIfUnset
+  }) {
+    const now = /* @__PURE__ */ new Date();
+    const updateExisting = () => this.#db.updateAtomic("memory_settings", { org_id: orgId, user_id: userId }, (row) => {
+      const columns = { ...patchToColumns(patch), updated_at: now };
+      if (fillIfUnset?.observerModelId !== void 0 && row.observer_model_id == null) {
+        columns.observer_model_id = patch.observerModelId ?? fillIfUnset.observerModelId;
+      }
+      if (fillIfUnset?.reflectorModelId !== void 0 && row.reflector_model_id == null) {
+        columns.reflector_model_id = patch.reflectorModelId ?? fillIfUnset.reflectorModelId;
+      }
+      return columns;
+    });
+    const updated = await updateExisting();
+    if (updated) return toRecord2(updated);
+    try {
+      const row = await this.#db.insertOne("memory_settings", {
+        org_id: orgId,
+        user_id: userId,
+        observer_model_id: fillIfUnset?.observerModelId ?? null,
+        reflector_model_id: fillIfUnset?.reflectorModelId ?? null,
+        observation_threshold: null,
+        reflection_threshold: null,
+        observe_attachments: null,
+        ...patchToColumns(patch),
+        created_at: now,
+        updated_at: now
+      });
+      return toRecord2(row);
+    } catch (error) {
+      if (!(error instanceof UniqueViolationError8)) throw error;
+      const row = await updateExisting();
+      if (!row) throw error;
+      return toRecord2(row);
+    }
+  }
+};
+
 // src/storage/domains/model-packs/base.ts
-import { FactoryStorageDomain as FactoryStorageDomain7 } from "@mastra/core/storage";
+import { FactoryStorageDomain as FactoryStorageDomain9 } from "@mastra/core/storage";
 var MODEL_PACKS_SCHEMA = {
   name: "model_packs",
   columns: {
@@ -36779,7 +37346,7 @@ function toModelPack(row) {
     updatedAt: row.updated_at
   };
 }
-var ModelPacksStorage = class extends FactoryStorageDomain7 {
+var ModelPacksStorage = class extends FactoryStorageDomain9 {
   constructor() {
     super("model-packs");
   }
@@ -36843,7 +37410,7 @@ var ModelPacksStorage = class extends FactoryStorageDomain7 {
 };
 
 // src/storage/domains/projects/base.ts
-import { FactoryStorageDomain as FactoryStorageDomain8 } from "@mastra/core/storage";
+import { FactoryStorageDomain as FactoryStorageDomain10 } from "@mastra/core/storage";
 var FACTORY_PROJECTS_SCHEMA = {
   name: "factory_projects",
   columns: {
@@ -36870,7 +37437,7 @@ function toFactoryProject(row) {
     updatedAt: row.updated_at
   };
 }
-var FactoryProjectsStorage = class extends FactoryStorageDomain8 {
+var FactoryProjectsStorage = class extends FactoryStorageDomain10 {
   constructor() {
     super("projects");
   }
@@ -36938,7 +37505,7 @@ var FactoryProjectsStorage = class extends FactoryStorageDomain8 {
 };
 
 // src/storage/domains/source-control/base.ts
-import { FactoryStorageDomain as FactoryStorageDomain9, UniqueViolationError as UniqueViolationError7 } from "@mastra/core/storage";
+import { FactoryStorageDomain as FactoryStorageDomain11, UniqueViolationError as UniqueViolationError9 } from "@mastra/core/storage";
 var FACTORY_PROJECTS = "factory_projects";
 var INSTALLATIONS = "source_control_installations";
 var REPOSITORIES = "source_control_repositories";
@@ -37191,7 +37758,7 @@ function toSession(row) {
     updatedAt: row.updated_at
   };
 }
-var SourceControlStorage = class extends FactoryStorageDomain9 {
+var SourceControlStorage = class extends FactoryStorageDomain11 {
   constructor() {
     super("source-control");
   }
@@ -37385,7 +37952,7 @@ var SourceControlStorage = class extends FactoryStorageDomain9 {
             });
             return toConnection(row);
           } catch (error) {
-            if (!(error instanceof UniqueViolationError7)) throw error;
+            if (!(error instanceof UniqueViolationError9)) throw error;
             const row = await db().findOne(CONNECTIONS, {
               factory_project_id: input.factoryProjectId,
               integration_id: integrationId,
@@ -37514,7 +38081,7 @@ var SourceControlStorage = class extends FactoryStorageDomain9 {
             });
             return toSandbox(row);
           } catch (error) {
-            if (!(error instanceof UniqueViolationError7)) throw error;
+            if (!(error instanceof UniqueViolationError9)) throw error;
             const row = await db().findOne(SANDBOXES, where);
             if (!row) throw error;
             return toSandbox(row);
@@ -37627,7 +38194,7 @@ var SourceControlStorage = class extends FactoryStorageDomain9 {
             });
             return toSession(row);
           } catch (error) {
-            if (!(error instanceof UniqueViolationError7)) throw error;
+            if (!(error instanceof UniqueViolationError9)) throw error;
             const row = await db().findOne(SESSIONS, {
               project_repository_id: input.projectRepositoryId,
               user_id: input.userId,
@@ -37730,6 +38297,7 @@ var factorySkillExtension = {
 function createWorkspaceFactory(options = {}) {
   const { sandbox: sandboxConfig, github, fleet } = options;
   const isLocalSandbox = sandboxConfig?.machine instanceof LocalSandbox;
+  const githubTokenInjectors = /* @__PURE__ */ new Map();
   return async ({ requestContext, mastra, skillExtension }) => {
     const effectiveSkillExtension = skillExtension ?? factorySkillExtension;
     const ctx = requestContext.get("controller");
@@ -37781,6 +38349,8 @@ function createWorkspaceFactory(options = {}) {
       const existing = mastra?.getWorkspaceById(workspaceId);
       if (existing) {
         existing.setToolsConfig(MASTRACODE_WORKSPACE_TOOLS);
+        const injectGithubToken3 = githubTokenInjectors.get(workspaceId);
+        if (injectGithubToken3) registerGithubTokenInjector(requestContext, injectGithubToken3);
         return existing;
       }
     } catch {
@@ -37811,6 +38381,14 @@ function createWorkspaceFactory(options = {}) {
       repoFullName
     });
     if (projectRepository.setupCommand) await runWorktreeSetup(sandbox, workdir, projectRepository.setupCommand);
+    const injectGithubToken2 = (freshToken) => {
+      if (!sandbox.setEnvironmentVariable) {
+        throw new Error("The active sandbox provider does not support runtime GitHub token refresh.");
+      }
+      sandbox.setEnvironmentVariable("GH_TOKEN", freshToken);
+    };
+    githubTokenInjectors.set(workspaceId, injectGithubToken2);
+    registerGithubTokenInjector(requestContext, injectGithubToken2);
     const filesystem = new SandboxFilesystem({ sandbox, workdir });
     const projectSkillPaths = [path2.join(configDir, "skills"), ".claude/skills", ".agents/skills"];
     const skillPaths = [...effectiveSkillExtension?.paths ?? [], ...projectSkillPaths];
@@ -37918,6 +38496,8 @@ var MastraFactory = class {
     const workItemsStorage = storage.registerDomain(new WorkItemsStorage());
     const modelCredentialsStorage = storage.registerDomain(new ModelCredentialsStorage());
     const modelPacksStorage = storage.registerDomain(new ModelPacksStorage());
+    const memorySettingsStorage = storage.registerDomain(new MemorySettingsStorage());
+    const customProvidersStorage = storage.registerDomain(new CustomProvidersStorage());
     const queueHealthStorage = storage.registerDomain(new QueueHealthStorage());
     const integrationStorage = storage.registerDomain(new IntegrationStorage());
     const factoryProjectsStorage = storage.registerDomain(new FactoryProjectsStorage());
@@ -37926,6 +38506,8 @@ var MastraFactory = class {
       intake: intakeStorage,
       modelCredentials: modelCredentialsStorage,
       modelPacks: modelPacksStorage,
+      memorySettings: memorySettingsStorage,
+      customProviders: customProvidersStorage,
       projects: factoryProjectsStorage,
       queueHealth: queueHealthStorage,
       workItems: workItemsStorage
@@ -37974,6 +38556,7 @@ var MastraFactory = class {
     if (auth) {
       registerTenantCredentialResolver(modelCredentialsStorage);
     }
+    registerCustomProvidersSource({ storage: customProvidersStorage, authEnabled: Boolean(auth) });
     for (const integration of integrations) {
       integration.initialize?.({
         storage: integrationStorage.forIntegration(integration.id),
@@ -38038,6 +38621,9 @@ var MastraFactory = class {
         fleet
       }),
       disableGithubSignals: true,
+      // Memory settings live in the factory's `memory-settings` app table (per
+      // org/user), so the host machine's TUI settings.json must not seed them.
+      disableSettingsOmSeed: true,
       storage: storage.getMastraStorage(),
       ...factoryProcessor ? { inputProcessors: [factoryProcessor] } : {},
       ...vector ? { vector } : {},
@@ -38146,12 +38732,25 @@ var MastraFactory = class {
         const uiDist = resolveUiDistDir();
         const spa = uiDist ? [createSpaStaticMiddleware(uiDist)] : [];
         if (!auth) {
-          return { ...spa.length ? { middleware: spa } : {}, ...cors, ...onError };
+          return {
+            middleware: [
+              createCustomProvidersPrimer({ auth: routeAuth, storage: customProvidersStorage, authEnabled: false }),
+              ...spa
+            ],
+            ...cors,
+            ...onError
+          };
         }
         return {
+          auth,
           middleware: [
             createFactoryAuthGate(auth),
             createTenantCredentialPrimer({ auth: routeAuth, credentials: modelCredentialsStorage }),
+            createCustomProvidersPrimer({
+              auth: routeAuth,
+              storage: customProvidersStorage,
+              authEnabled: Boolean(auth)
+            }),
             ...spa
           ],
           ...cors,
@@ -38181,6 +38780,10 @@ var MastraFactory = class {
     );
     return {
       ...prepared.mastraArgs,
+      // Same provider on `studio.auth` as on `server.auth` (buildServerConfig):
+      // deployed factories must authenticate BOTH plain API callers and Studio
+      // requests (`x-mastra-client-type: studio` routes to `studio.auth`).
+      ...auth ? { studio: { auth } } : {},
       ...integrationWorkers.length > 0 ? { workers: integrationWorkers } : {}
     };
   }