@mastra/factory 0.1.0-alpha.3 → 0.1.0-alpha.5

package/dist/integrations/platform/github/integration.js

@@ -117,8 +117,8 @@ function bindingStore(row, storage) {
   };
 }
 async function ensureProjectSandbox(options) {
-  const { fleet, row, storage, onProgress } = options;
-  return fleet.ensureSandbox(bindingStore(row, storage), onProgress);
+  const { fleet, row, storage, token, onProgress } = options;
+  return fleet.ensureSandbox(bindingStore(row, storage), { GH_TOKEN: token }, onProgress);
 }
 async function teardownProjectSandbox(options) {
   const { fleet, row, storage, sandbox } = options;
@@ -1395,13 +1395,6 @@ async function loadOrCreateSandboxRow(github, project, userId) {
 async function prepareProject(options) {
   const { github, fleet, project, userId, onProgress } = options;
   const sandboxRow = await loadOrCreateSandboxRow(github, project, userId);
-  const sandbox = await ensureProjectSandbox({
-    fleet,
-    row: sandboxRow,
-    storage: github.sourceControlStorage.sandboxes,
-    onProgress
-  });
-  const fresh = await github.sourceControlStorage.sandboxes.getById({ id: sandboxRow.id });
   const access = await github.versionControl.getRepositoryAccess({
     orgId: project.installation.orgId,
     repositoryId: project.repository.id
@@ -1409,6 +1402,14 @@ async function prepareProject(options) {
   if (!access.authorization) {
     throw new MaterializeError("Repository access did not include a bearer token.", "clone-failed");
   }
+  const sandbox = await ensureProjectSandbox({
+    fleet,
+    row: sandboxRow,
+    storage: github.sourceControlStorage.sandboxes,
+    token: access.authorization.token,
+    onProgress
+  });
+  const fresh = await github.sourceControlStorage.sandboxes.getById({ id: sandboxRow.id });
   const finalRow = fresh ?? sandboxRow;
   await materializeRepo({
     row: finalRow,
@@ -1728,7 +1729,8 @@ function buildProjectGitRoutes({
                 baseBranch: base,
                 headBranch: head,
                 title,
-                body: prBody
+                body: prBody,
+                actingUserId: userId
               });
               await emitAudit?.({
                 context: loose(c),
@@ -1839,6 +1841,18 @@ async function resolveSessionWorkspace(github, projectId, userId, sessionId) {
 // src/integrations/github/session-subscriptions.ts
 import { createTool } from "@mastra/core/tools";
 import { z } from "zod";
+
+// src/integrations/github/token-refresh.ts
+var GITHUB_TOKEN_INJECTOR_CONTEXT_KEY = "factoryGithubTokenInjector";
+function injectGithubToken(requestContext, token) {
+  const injector = requestContext.get(GITHUB_TOKEN_INJECTOR_CONTEXT_KEY);
+  if (!injector) {
+    throw new Error("GitHub token refresh requires an active Factory sandbox workspace.");
+  }
+  injector(token);
+}
+
+// src/integrations/github/session-subscriptions.ts
 function sessionUserId(user) {
   return user?.workosId ?? user?.id;
 }
@@ -1925,11 +1939,30 @@ async function unsubscribeCurrentSessionFromPullRequest(requestContext, pullRequ
   await unsubscribeFromPullRequest(await subscriptionInput(target, number), github.integrationStorage);
   return number;
 }
+async function refreshGithubToken(requestContext, github) {
+  const target = await resolveSessionTarget(requestContext, github);
+  const access = await github.versionControl.getRepositoryAccess({
+    orgId: target.orgId,
+    repositoryId: target.repository.id
+  });
+  const token = access.authorization?.token;
+  if (!token) throw new Error("Repository access did not include a bearer token for the Factory session.");
+  injectGithubToken(requestContext, token);
+}
 function createGithubSubscriptionTools(requestContext, github) {
   const context = requestContext.get("controller");
   const user = requestContext.get("user");
   if (!context?.getState().projectRepositoryId || !sessionOrgId(user) || !sessionUserId(user)) return {};
   return {
+    github_refresh_token: createTool({
+      id: "github_refresh_token",
+      description: "Refresh GitHub CLI authentication in the active Factory sandbox. Use this after a gh command fails because authentication is expired, invalid, or missing. It installs a fresh GH_TOKEN for subsequent sandbox commands. After this tool succeeds, retry the failed gh command. Takes no arguments and never returns the token.",
+      inputSchema: z.object({}),
+      execute: async () => {
+        await refreshGithubToken(requestContext, github);
+        return { refreshed: true };
+      }
+    }),
     github_subscribe_pr: createTool({
       id: "github_subscribe_pr",
       description: "Subscribe this thread to GitHub pull request activity. You usually do not need this tool: successful gh pr create commands subscribe automatically. Use it for an existing PR or to recover when automatic subscription did not occur. Closed or merged PRs are unsubscribed automatically. Accepts a PR number or canonical URL for the active project.",
@@ -2056,6 +2089,9 @@ var PlatformApiClient = class {
       accept: "application/json",
       authorization: `Bearer ${this.#accessToken}`
     };
+    if (options?.actingUserId) {
+      headers["x-acting-user-id"] = options.actingUserId;
+    }
     const timeoutSignal = AbortSignal.timeout(15e3);
     const init = {
       method,
@@ -2107,6 +2143,9 @@ function redact(message, accessToken) {
 function logPlatformInfo(message, fields) {
   writePlatformLog("info", message, fields);
 }
+function logPlatformWarn(message, fields) {
+  writePlatformLog("warn", message, fields);
+}
 function logPlatformError(message, fields) {
   writePlatformLog("error", message, fields);
 }
@@ -2425,6 +2464,11 @@ function retryDelay(error, fallbackMs) {
 // src/integrations/platform/github/integration.ts
 var PAGE_SIZE = 30;
 var API_PREFIX2 = "/v1/server";
+var REPOSITORY_TOKEN_PERMISSIONS = {
+  contents: "write",
+  issues: "write",
+  pull_requests: "write"
+};
 function loose2(c) {
   return c;
 }
@@ -2538,7 +2582,7 @@ var PlatformGithubIntegration = class {
       return this.#listIssues(input.connection, sourceId, parsePositiveCursor(input.cursor), input.labels);
     },
     getIssue: (input) => this.#getIssue(input.connection, input.sourceId, input.issueId),
-    createComment: (input) => this.#createIssueComment(input.connection, input.sourceId, input.issueId, input.body)
+    createComment: (input) => this.#createIssueComment(input)
   };
   versionControl = {
     initialize: ({ storage }) => {
@@ -2577,7 +2621,7 @@ var PlatformGithubIntegration = class {
       const token = await this.#client.request(
         "POST",
         `${API_PREFIX2}/github-app/installations/${installationId}/token`,
-        { repositories: [repositoryName], permissions: { contents: "write" } }
+        { repositories: [repositoryName], permissions: REPOSITORY_TOKEN_PERMISSIONS }
       );
       return {
         cloneUrl: `https://github.com/${repository.slug}.git`,
@@ -2641,6 +2685,7 @@ var PlatformGithubIntegration = class {
     return [
       this.#statusRoute(ctx),
       this.#connectRoute(ctx),
+      this.#connectUserRoute(ctx),
       ...buildGithubRoutes({
         auth: ctx.auth,
         fleet: ctx.fleet,
@@ -2672,11 +2717,16 @@ var PlatformGithubIntegration = class {
             organizationRequired: true,
             connected: false,
             installations: [],
+            userConnected: false,
+            userGithubUsername: null,
             reason: "organization_required",
             diagnostics: this.diagnostics()
           });
         }
-        const installations = await this.#syncInstallations(tenant.orgId, tenant.userId);
+        const [installations, userConnection] = await Promise.all([
+          this.#syncInstallations(tenant.orgId, tenant.userId),
+          this.#fetchUserConnection(tenant.userId)
+        ]);
         return c.json({
           enabled: true,
           sandboxEnabled: ctx.fleet.enabled,
@@ -2686,6 +2736,8 @@ var PlatformGithubIntegration = class {
             accountLogin: installation.accountName,
             accountType: installation.accountType
           })),
+          userConnected: userConnection.connected,
+          userGithubUsername: userConnection.githubUsername,
           reason: installations.length > 0 ? "ready" : "not_connected",
           diagnostics: this.diagnostics()
         });
@@ -2720,6 +2772,55 @@ var PlatformGithubIntegration = class {
       }
     });
   }
+  #connectUserRoute(ctx) {
+    return registerApiRoute2("/auth/github/connect-user", {
+      method: "GET",
+      requiresAuth: false,
+      handler: async (c) => {
+        await ctx.auth.ensureUser(loose2(c));
+        const tenant = ctx.auth.tenant(loose2(c));
+        if (!tenant?.orgId) return c.json({ error: "unauthorized" }, 401);
+        const redirectTo = c.req.query("redirectTo") || c.req.query("return_to") || "/";
+        const originator = routeBaseUrl(ctx, c.req.url);
+        logPlatformInfo("Starting Platform GitHub user authorization flow", {
+          orgId: tenant.orgId,
+          redirectTo,
+          originator
+        });
+        const query = new URLSearchParams({
+          userId: tenant.userId,
+          redirectTo,
+          originator
+        });
+        const { url } = await this.#client.request(
+          "GET",
+          `${API_PREFIX2}/github-app/authenticate?${query}`
+        );
+        return c.redirect(url);
+      }
+    });
+  }
+  /**
+   * Personal GitHub connection status for the acting user. Returns
+   * not-connected when the platform predates the user-connection endpoint.
+   */
+  async #fetchUserConnection(userId) {
+    try {
+      const connection = await this.#client.request(
+        "GET",
+        `${API_PREFIX2}/github-app/user-connection?${new URLSearchParams({ userId })}`
+      );
+      if (!connection.connected && connection.reason) {
+        logPlatformWarn("Platform GitHub user connection verification failed", {
+          userId,
+          reason: connection.reason
+        });
+      }
+      return connection;
+    } catch {
+      return { connected: false, githubUsername: null };
+    }
+  }
   async #syncInstallations(orgId, userId) {
     const result = await this.#client.request(
       "GET",
@@ -2815,7 +2916,7 @@ var PlatformGithubIntegration = class {
     const result = await this.#client.request(
       "POST",
       `${API_PREFIX2}/github-app/installations/${installationId}/token`,
-      { repositories: repositories.map((repository) => repository.name), permissions: { contents: "write" } }
+      { repositories: repositories.map((repository) => repository.name), permissions: REPOSITORY_TOKEN_PERMISSIONS }
     );
     return result.token;
   }
@@ -2870,15 +2971,16 @@ var PlatformGithubIntegration = class {
       throw error;
     }
   }
-  async #createIssueComment(connection, sourceId, issueId, body) {
-    requireGithubConnection(connection);
-    const repository = requireSource(sourceId, "GitHub Intake requires a repository source.");
-    const issueNumber = requirePositiveId(issueId, "issue");
+  async #createIssueComment(input) {
+    requireGithubConnection(input.connection);
+    const repository = requireSource(input.sourceId, "GitHub Intake requires a repository source.");
+    const issueNumber = requirePositiveId(input.issueId, "issue");
     try {
       const comment = await this.#client.request(
         "POST",
         repositoryPath(repository, `issues/${issueNumber}/comments`),
-        { body }
+        { body: input.body },
+        { actingUserId: input.actingUserId }
       );
       return { id: String(comment.id), url: comment.htmlUrl };
     } catch (error) {
@@ -2915,29 +3017,40 @@ var PlatformGithubIntegration = class {
   }
   async #createPullRequest(input) {
     requireGithubConnection(input.connection);
-    const result = await this.#client.request("POST", repositoryPath(input.sourceId, "pulls"), {
-      head: input.headBranch,
-      base: input.baseBranch,
-      title: input.title,
-      body: input.body,
-      draft: input.draft
-    });
+    const result = await this.#client.request(
+      "POST",
+      repositoryPath(input.sourceId, "pulls"),
+      {
+        head: input.headBranch,
+        base: input.baseBranch,
+        title: input.title,
+        body: input.body,
+        draft: input.draft
+      },
+      { actingUserId: input.actingUserId }
+    );
     return parsePullRequest2(result);
   }
   async #updatePullRequest(input) {
-    const result = await this.#client.request("PATCH", pullRequestPath(input, input.pullRequestId), {
-      title: input.title,
-      body: input.body === null ? "" : input.body,
-      base: input.baseBranch,
-      state: input.state
-    });
+    const result = await this.#client.request(
+      "PATCH",
+      pullRequestPath(input, input.pullRequestId),
+      {
+        title: input.title,
+        body: input.body === null ? "" : input.body,
+        base: input.baseBranch,
+        state: input.state
+      },
+      { actingUserId: input.actingUserId }
+    );
     return parsePullRequest2(result);
   }
   #mergePullRequest(input) {
     return this.#client.request(
       "PUT",
       `${pullRequestPath(input, input.pullRequestId)}/merge`,
-      { commitTitle: input.commitTitle, commitMessage: input.commitMessage, method: input.method }
+      { commitTitle: input.commitTitle, commitMessage: input.commitMessage, method: input.method },
+      { actingUserId: input.actingUserId }
     );
   }
   async #listComments(input) {
@@ -2955,7 +3068,8 @@ var PlatformGithubIntegration = class {
     const comment = await this.#client.request(
       "POST",
       repositoryPath(input.sourceId, `issues/${requirePositiveId(input.pullRequestId, "pull request")}/comments`),
-      { body: input.body }
+      { body: input.body },
+      { actingUserId: input.actingUserId }
     );
     return parseComment(comment);
   }
@@ -2964,7 +3078,8 @@ var PlatformGithubIntegration = class {
     const comment = await this.#client.request(
       "PATCH",
       repositoryPath(input.sourceId, `issues/comments/${requirePositiveId(input.commentId, "comment")}`),
-      { body: input.body }
+      { body: input.body },
+      { actingUserId: input.actingUserId }
     );
     return parseComment(comment);
   }
@@ -2972,7 +3087,9 @@ var PlatformGithubIntegration = class {
     requireGithubConnection(input.connection);
     await this.#client.request(
       "DELETE",
-      repositoryPath(input.sourceId, `issues/comments/${requirePositiveId(input.commentId, "comment")}`)
+      repositoryPath(input.sourceId, `issues/comments/${requirePositiveId(input.commentId, "comment")}`),
+      void 0,
+      { actingUserId: input.actingUserId }
     );
   }
   async #listReviews(input) {
@@ -3003,7 +3120,8 @@ var PlatformGithubIntegration = class {
     const review = await this.#client.request(
       "POST",
       `${pullRequestPath(input, input.pullRequestId)}/reviews`,
-      { body: input.body, commitId: input.commitId, event: input.event ? reviewEvent(input.event) : void 0 }
+      { body: input.body, commitId: input.commitId, event: input.event ? reviewEvent(input.event) : void 0 },
+      { actingUserId: input.actingUserId }
     );
     return parseReview(review);
   }
@@ -3011,7 +3129,8 @@ var PlatformGithubIntegration = class {
     const review = await this.#client.request(
       "PUT",
       `${pullRequestPath(input, input.pullRequestId)}/reviews/${requirePositiveId(input.reviewId, "review")}`,
-      { body: input.body }
+      { body: input.body },
+      { actingUserId: input.actingUserId }
     );
     return parseReview(review);
   }
@@ -3019,7 +3138,8 @@ var PlatformGithubIntegration = class {
     const review = await this.#client.request(
       "POST",
       `${pullRequestPath(input, input.pullRequestId)}/reviews/${requirePositiveId(input.reviewId, "review")}/events`,
-      { body: input.body, event: reviewEvent(input.event) }
+      { body: input.body, event: reviewEvent(input.event) },
+      { actingUserId: input.actingUserId }
     );
     return parseReview(review);
   }
@@ -3027,14 +3147,17 @@ var PlatformGithubIntegration = class {
     const review = await this.#client.request(
       "PUT",
       `${pullRequestPath(input, input.pullRequestId)}/reviews/${requirePositiveId(input.reviewId, "review")}/dismissals`,
-      { message: input.message }
+      { message: input.message },
+      { actingUserId: input.actingUserId }
     );
     return parseReview(review);
   }
   async #deletePendingReview(input) {
     await this.#client.request(
       "DELETE",
-      `${pullRequestPath(input, input.pullRequestId)}/reviews/${requirePositiveId(input.reviewId, "review")}`
+      `${pullRequestPath(input, input.pullRequestId)}/reviews/${requirePositiveId(input.reviewId, "review")}`,
+      void 0,
+      { actingUserId: input.actingUserId }
     );
   }
   async #listReviewComments(input) {
@@ -3070,7 +3193,8 @@ var PlatformGithubIntegration = class {
       await this.#client.request(
         "POST",
         `${pullRequestPath(input, input.pullRequestId)}/comments`,
-        body
+        body,
+        { actingUserId: input.actingUserId }
       )
     );
   }
@@ -3080,7 +3204,8 @@ var PlatformGithubIntegration = class {
       await this.#client.request(
         "PATCH",
         repositoryPath(input.sourceId, `pulls/comments/${requirePositiveId(input.commentId, "review comment")}`),
-        { body: input.body }
+        { body: input.body },
+        { actingUserId: input.actingUserId }
       )
     );
   }
@@ -3088,7 +3213,9 @@ var PlatformGithubIntegration = class {
     requireGithubConnection(input.connection);
     await this.#client.request(
       "DELETE",
-      repositoryPath(input.sourceId, `pulls/comments/${requirePositiveId(input.commentId, "review comment")}`)
+      repositoryPath(input.sourceId, `pulls/comments/${requirePositiveId(input.commentId, "review comment")}`),
+      void 0,
+      { actingUserId: input.actingUserId }
     );
   }
   #requestedReviewers(method, input) {
@@ -3096,7 +3223,8 @@ var PlatformGithubIntegration = class {
     return this.#client.request(
       method,
       `${pullRequestPath(input, input.pullRequestId)}/requested-reviewers`,
-      method === "GET" ? void 0 : { users: input.users, teams: input.teams }
+      method === "GET" ? void 0 : { users: input.users, teams: input.teams },
+      method === "GET" ? void 0 : { actingUserId: input.actingUserId }
     );
   }
 };