@mastra/factory 0.1.0-alpha.6 → 0.1.0-alpha.7

package/dist/rules/start-coordinator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"start-coordinator.d.ts","sourceRoot":"","sources":["../../src/rules/start-coordinator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAG9D,OAAO,KAAK,EAAwB,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AAClH,OAAO,KAAK,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AACnG,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACxE,OAAO,KAAK,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAE5E,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1G,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,QAAQ,EAAE;QACR,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,mBAAmB,CAAC;KAC5B,CAAC;IACF,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAED,qBAAa,2BAA4B,SAAQ,KAAK;IACpD,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,uBAAuB,EAAE;QAAE,MAAM,EAAE,UAAU,CAAA;KAAE,CAAC,CAAC;gBAE9D,MAAM,EAAE,OAAO,CAAC,uBAAuB,EAAE;QAAE,MAAM,EAAE,UAAU,CAAA;KAAE,CAAC;CAK7E;AAED,MAAM,WAAW,0BAA0B;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,SAAS,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;IAClE,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,KAAK,iBAAiB,GAAG,eAAe,CAAC,eAAe,CAAC,CAAC;AAqD1D,qBAAa,uBAAuB;;gBAOhC,UAAU,EAAE,iBAAiB,EAC7B,OAAO,EAAE,gBAAgB,EACzB,iBAAiB,CAAC,EAAE,IAAI,CAAC,wBAAwB,EAAE,YAAY,CAAC,EAChE,aAAa,CAAC,EAAE,0BAA0B;IAQtC,OAAO,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,0BAA0B,CAAC;CAoEjF"}
+{"version":3,"file":"start-coordinator.d.ts","sourceRoot":"","sources":["../../src/rules/start-coordinator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAG9D,OAAO,KAAK,EAAwB,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AAClH,OAAO,KAAK,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AACnG,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACxE,OAAO,KAAK,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAE5E,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1G,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,QAAQ,EAAE;QACR,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,mBAAmB,CAAC;KAC5B,CAAC;IACF,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAED,qBAAa,2BAA4B,SAAQ,KAAK;IACpD,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,uBAAuB,EAAE;QAAE,MAAM,EAAE,UAAU,CAAA;KAAE,CAAC,CAAC;gBAE9D,MAAM,EAAE,OAAO,CAAC,uBAAuB,EAAE;QAAE,MAAM,EAAE,UAAU,CAAA;KAAE,CAAC;CAK7E;AAED,MAAM,WAAW,0BAA0B;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,SAAS,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;IAClE,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,KAAK,iBAAiB,GAAG,eAAe,CAAC,eAAe,CAAC,CAAC;AAqD1D,qBAAa,uBAAuB;;gBAOhC,UAAU,EAAE,iBAAiB,EAC7B,OAAO,EAAE,gBAAgB,EACzB,iBAAiB,CAAC,EAAE,IAAI,CAAC,wBAAwB,EAAE,YAAY,CAAC,EAChE,aAAa,CAAC,EAAE,0BAA0B;IAQtC,OAAO,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,0BAA0B,CAAC;CAgFjF"}

package/dist/rules/start-coordinator.js

@@ -71,13 +71,19 @@ var FactoryStartCoordinator = class {
     if (!request.requestContext) {
       requestContext.set("user", { workosId: request.userId, organizationId: request.orgId });
     }
+    const sessionState = {
+      factoryProjectId: request.factoryProjectId,
+      projectRepositoryId: sourceSession.projectRepositoryId
+    };
     const session = await this.#controller.createSession({
       id: sourceSession.sessionId,
       ownerId: request.userId,
       resourceId: sourceSession.sessionId,
       threadId: sourceSession.sessionId,
-      requestContext
+      requestContext,
+      tags: sessionState
     });
+    await session.state.set(sessionState);
     const threadId = await configureThread(session, request);
     const kickoffMessage = await resolveKickoffMessage(session, request.invocation);
     const prepared = await storage.prepareRunStart({

package/dist/rules/start-coordinator.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/rules/start-coordinator.ts"],"sourcesContent":["import type { MastraCodeState } from '@mastra/code-sdk/schema';\nimport type { AgentController } from '@mastra/core/agent-controller';\nimport { RequestContext } from '@mastra/core/request-context';\nimport { formatSkillActivation } from '@mastra/core/workspace';\n\nimport type { SourceControlSession, SourceControlStorageHandle } from '../storage/domains/source-control/base.js';\nimport type { CreateWorkItemInput, WorkItemsStorage } from '../storage/domains/work-items/base.js';\nimport type { FactoryTransitionService } from './transition-service.js';\nimport type { FactoryRuleStage, FactoryTransitionResult } from './types.js';\n\nexport interface FactoryStartRequest {\n  orgId: string;\n  userId: string;\n  factoryProjectId: string;\n  sessionId: string;\n  threadTitle: string;\n  threadTags?: Record<string, string>;\n  kickoffKey: string;\n  invocation?: { type: 'prompt'; prompt: string } | { type: 'skill'; skillName: string; arguments: string };\n  destinationStage: FactoryRuleStage;\n  workItem: {\n    id?: string;\n    role: string;\n    input: CreateWorkItemInput;\n  };\n  requestContext?: RequestContext;\n}\n\nexport class FactoryStartTransitionError extends Error {\n  readonly result: Extract<FactoryTransitionResult, { status: 'rejected' }>;\n\n  constructor(result: Extract<FactoryTransitionResult, { status: 'rejected' }>) {\n    super(result.reason);\n    this.name = 'FactoryStartTransitionError';\n    this.result = result;\n  }\n}\n\nexport interface FactoryStartPreparedResult {\n  workItemId: string;\n  bindingId: string;\n  threadId: string;\n  resourceId: string;\n  sessionId: string;\n  branch: string;\n  revision: number;\n  kickoffStatus: 'pending' | 'leased' | 'retry' | 'sent' | 'failed';\n  replayed: boolean;\n}\n\ntype FactoryController = AgentController<MastraCodeState>;\ntype FactorySession = Awaited<ReturnType<FactoryController['createSession']>>;\n\nfunction escapeSkillBoundary(value: string): string {\n  return value.replaceAll('</skill>', '&lt;/skill&gt;');\n}\n\nasync function resolveKickoffMessage(\n  session: FactorySession,\n  invocation: FactoryStartRequest['invocation'],\n): Promise<string | null> {\n  if (!invocation) return null;\n  if (invocation.type === 'prompt') return invocation.prompt;\n\n  const skills = session.getWorkspace().skills;\n  await skills?.maybeRefresh();\n  const skill = await skills?.get(invocation.skillName);\n  if (!skill || skill['user-invocable'] === false) {\n    throw new Error(`Skill not found: ${invocation.skillName}.`);\n  }\n  const args = invocation.arguments.trim();\n  const content = `${formatSkillActivation(skill)}${args ? `\\n\\nARGUMENTS: ${args}` : ''}`.trim();\n  return `<skill name=\"${skill.name}\">\\n${escapeSkillBoundary(content)}\\n</skill>`;\n}\n\nasync function resolveSourceSession(\n  storage: SourceControlStorageHandle,\n  request: FactoryStartRequest,\n): Promise<SourceControlSession> {\n  const session = await storage.sessions.getBySessionId(request.sessionId);\n  if (!session || session.orgId !== request.orgId || session.userId !== request.userId) {\n    throw new Error('Factory session not found');\n  }\n  const projectRepository = await storage.projectRepositories.get({\n    orgId: request.orgId,\n    id: session.projectRepositoryId,\n  });\n  if (!projectRepository) throw new Error('Factory session repository not found');\n  const connection = await storage.connections.get({ orgId: request.orgId, id: projectRepository.connectionId });\n  if (!connection || connection.factoryProjectId !== request.factoryProjectId) {\n    throw new Error('Factory session does not belong to this project');\n  }\n  return session;\n}\n\nasync function configureThread(session: FactorySession, request: FactoryStartRequest): Promise<string> {\n  const threadId = session.thread.requireId();\n  await session.thread.rename({ title: request.threadTitle });\n  const settings = { ...(request.threadTags ?? {}), factorySessionId: request.sessionId };\n  await Promise.all(Object.entries(settings).map(([key, value]) => session.thread.setSetting({ key, value })));\n  return threadId;\n}\n\nexport class FactoryStartCoordinator {\n  readonly #controller: FactoryController;\n  readonly #storage: WorkItemsStorage;\n  readonly #transitionService?: Pick<FactoryTransitionService, 'transition'>;\n  readonly #sourceControl?: SourceControlStorageHandle;\n\n  constructor(\n    controller: FactoryController,\n    storage: WorkItemsStorage,\n    transitionService?: Pick<FactoryTransitionService, 'transition'>,\n    sourceControl?: SourceControlStorageHandle,\n  ) {\n    this.#controller = controller;\n    this.#storage = storage;\n    this.#transitionService = transitionService;\n    this.#sourceControl = sourceControl;\n  }\n\n  async prepare(request: FactoryStartRequest): Promise<FactoryStartPreparedResult> {\n    const storage = this.#storage;\n    if (!this.#sourceControl) throw new Error('Factory source control storage is unavailable');\n    const sourceSession = await resolveSourceSession(this.#sourceControl, request);\n    const requestContext = request.requestContext ?? new RequestContext();\n    if (!request.requestContext) {\n      requestContext.set('user', { workosId: request.userId, organizationId: request.orgId });\n    }\n    const session = await this.#controller.createSession({\n      id: sourceSession.sessionId,\n      ownerId: request.userId,\n      resourceId: sourceSession.sessionId,\n      threadId: sourceSession.sessionId,\n      requestContext,\n    });\n    const threadId = await configureThread(session, request);\n    const kickoffMessage = await resolveKickoffMessage(session, request.invocation);\n    const prepared = await storage.prepareRunStart({\n      orgId: request.orgId,\n      userId: request.userId,\n      factoryProjectId: request.factoryProjectId,\n      workItem: { id: request.workItem.id, input: request.workItem.input },\n      role: request.workItem.role,\n      session: { sessionId: sourceSession.sessionId, branch: sourceSession.branch, threadId },\n      resourceId: sourceSession.sessionId,\n      kickoffKey: request.kickoffKey,\n      kickoffMessage,\n    });\n    await session.thread.setSetting({ key: 'factoryWorkItemId', value: prepared.item.id });\n\n    let revision = prepared.item.revision;\n    if (prepared.item.stages.length !== 1 || prepared.item.stages[0] !== request.destinationStage) {\n      if (!this.#transitionService) throw new Error('Factory transition service is unavailable.');\n      const transition = await this.#transitionService.transition({\n        orgId: request.orgId,\n        factoryProjectId: request.factoryProjectId,\n        workItemId: prepared.item.id,\n        board: prepared.item.externalSource?.type === 'pull-request' ? 'review' : 'work',\n        stage: request.destinationStage,\n        expectedRevision: prepared.item.revision,\n        actor: { type: 'human', id: request.userId },\n        ingress: { type: 'human', identity: `start:${request.kickoffKey}:transition` },\n        cause: 'run_start',\n      });\n      if (transition.status === 'rejected') {\n        await storage.markPendingStart(prepared.binding.id, 'failed', transition.reason);\n        throw new FactoryStartTransitionError(transition);\n      }\n      revision = transition.revision;\n    }\n\n    if (kickoffMessage === null) {\n      await storage.markPendingStart(prepared.binding.id, 'sent');\n      prepared.pendingStart.status = 'sent';\n    }\n\n    return {\n      workItemId: prepared.item.id,\n      bindingId: prepared.binding.id,\n      threadId,\n      resourceId: sourceSession.sessionId,\n      sessionId: sourceSession.sessionId,\n      branch: sourceSession.branch,\n      revision,\n      kickoffStatus: prepared.pendingStart.status,\n      replayed: prepared.replayed,\n    };\n  }\n}\n"],"mappings":";AAEA,SAAS,sBAAsB;AAC/B,SAAS,6BAA6B;AAyB/B,IAAM,8BAAN,cAA0C,MAAM;AAAA,EAC5C;AAAA,EAET,YAAY,QAAkE;AAC5E,UAAM,OAAO,MAAM;AACnB,SAAK,OAAO;AACZ,SAAK,SAAS;AAAA,EAChB;AACF;AAiBA,SAAS,oBAAoB,OAAuB;AAClD,SAAO,MAAM,WAAW,YAAY,gBAAgB;AACtD;AAEA,eAAe,sBACb,SACA,YACwB;AACxB,MAAI,CAAC,WAAY,QAAO;AACxB,MAAI,WAAW,SAAS,SAAU,QAAO,WAAW;AAEpD,QAAM,SAAS,QAAQ,aAAa,EAAE;AACtC,QAAM,QAAQ,aAAa;AAC3B,QAAM,QAAQ,MAAM,QAAQ,IAAI,WAAW,SAAS;AACpD,MAAI,CAAC,SAAS,MAAM,gBAAgB,MAAM,OAAO;AAC/C,UAAM,IAAI,MAAM,oBAAoB,WAAW,SAAS,GAAG;AAAA,EAC7D;AACA,QAAM,OAAO,WAAW,UAAU,KAAK;AACvC,QAAM,UAAU,GAAG,sBAAsB,KAAK,CAAC,GAAG,OAAO;AAAA;AAAA,aAAkB,IAAI,KAAK,EAAE,GAAG,KAAK;AAC9F,SAAO,gBAAgB,MAAM,IAAI;AAAA,EAAO,oBAAoB,OAAO,CAAC;AAAA;AACtE;AAEA,eAAe,qBACb,SACA,SAC+B;AAC/B,QAAM,UAAU,MAAM,QAAQ,SAAS,eAAe,QAAQ,SAAS;AACvE,MAAI,CAAC,WAAW,QAAQ,UAAU,QAAQ,SAAS,QAAQ,WAAW,QAAQ,QAAQ;AACpF,UAAM,IAAI,MAAM,2BAA2B;AAAA,EAC7C;AACA,QAAM,oBAAoB,MAAM,QAAQ,oBAAoB,IAAI;AAAA,IAC9D,OAAO,QAAQ;AAAA,IACf,IAAI,QAAQ;AAAA,EACd,CAAC;AACD,MAAI,CAAC,kBAAmB,OAAM,IAAI,MAAM,sCAAsC;AAC9E,QAAM,aAAa,MAAM,QAAQ,YAAY,IAAI,EAAE,OAAO,QAAQ,OAAO,IAAI,kBAAkB,aAAa,CAAC;AAC7G,MAAI,CAAC,cAAc,WAAW,qBAAqB,QAAQ,kBAAkB;AAC3E,UAAM,IAAI,MAAM,iDAAiD;AAAA,EACnE;AACA,SAAO;AACT;AAEA,eAAe,gBAAgB,SAAyB,SAA+C;AACrG,QAAM,WAAW,QAAQ,OAAO,UAAU;AAC1C,QAAM,QAAQ,OAAO,OAAO,EAAE,OAAO,QAAQ,YAAY,CAAC;AAC1D,QAAM,WAAW,EAAE,GAAI,QAAQ,cAAc,CAAC,GAAI,kBAAkB,QAAQ,UAAU;AACtF,QAAM,QAAQ,IAAI,OAAO,QAAQ,QAAQ,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,QAAQ,OAAO,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC;AAC3G,SAAO;AACT;AAEO,IAAM,0BAAN,MAA8B;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YACE,YACA,SACA,mBACA,eACA;AACA,SAAK,cAAc;AACnB,SAAK,WAAW;AAChB,SAAK,qBAAqB;AAC1B,SAAK,iBAAiB;AAAA,EACxB;AAAA,EAEA,MAAM,QAAQ,SAAmE;AAC/E,UAAM,UAAU,KAAK;AACrB,QAAI,CAAC,KAAK,eAAgB,OAAM,IAAI,MAAM,+CAA+C;AACzF,UAAM,gBAAgB,MAAM,qBAAqB,KAAK,gBAAgB,OAAO;AAC7E,UAAM,iBAAiB,QAAQ,kBAAkB,IAAI,eAAe;AACpE,QAAI,CAAC,QAAQ,gBAAgB;AAC3B,qBAAe,IAAI,QAAQ,EAAE,UAAU,QAAQ,QAAQ,gBAAgB,QAAQ,MAAM,CAAC;AAAA,IACxF;AACA,UAAM,UAAU,MAAM,KAAK,YAAY,cAAc;AAAA,MACnD,IAAI,cAAc;AAAA,MAClB,SAAS,QAAQ;AAAA,MACjB,YAAY,cAAc;AAAA,MAC1B,UAAU,cAAc;AAAA,MACxB;AAAA,IACF,CAAC;AACD,UAAM,WAAW,MAAM,gBAAgB,SAAS,OAAO;AACvD,UAAM,iBAAiB,MAAM,sBAAsB,SAAS,QAAQ,UAAU;AAC9E,UAAM,WAAW,MAAM,QAAQ,gBAAgB;AAAA,MAC7C,OAAO,QAAQ;AAAA,MACf,QAAQ,QAAQ;AAAA,MAChB,kBAAkB,QAAQ;AAAA,MAC1B,UAAU,EAAE,IAAI,QAAQ,SAAS,IAAI,OAAO,QAAQ,SAAS,MAAM;AAAA,MACnE,MAAM,QAAQ,SAAS;AAAA,MACvB,SAAS,EAAE,WAAW,cAAc,WAAW,QAAQ,cAAc,QAAQ,SAAS;AAAA,MACtF,YAAY,cAAc;AAAA,MAC1B,YAAY,QAAQ;AAAA,MACpB;AAAA,IACF,CAAC;AACD,UAAM,QAAQ,OAAO,WAAW,EAAE,KAAK,qBAAqB,OAAO,SAAS,KAAK,GAAG,CAAC;AAErF,QAAI,WAAW,SAAS,KAAK;AAC7B,QAAI,SAAS,KAAK,OAAO,WAAW,KAAK,SAAS,KAAK,OAAO,CAAC,MAAM,QAAQ,kBAAkB;AAC7F,UAAI,CAAC,KAAK,mBAAoB,OAAM,IAAI,MAAM,4CAA4C;AAC1F,YAAM,aAAa,MAAM,KAAK,mBAAmB,WAAW;AAAA,QAC1D,OAAO,QAAQ;AAAA,QACf,kBAAkB,QAAQ;AAAA,QAC1B,YAAY,SAAS,KAAK;AAAA,QAC1B,OAAO,SAAS,KAAK,gBAAgB,SAAS,iBAAiB,WAAW;AAAA,QAC1E,OAAO,QAAQ;AAAA,QACf,kBAAkB,SAAS,KAAK;AAAA,QAChC,OAAO,EAAE,MAAM,SAAS,IAAI,QAAQ,OAAO;AAAA,QAC3C,SAAS,EAAE,MAAM,SAAS,UAAU,SAAS,QAAQ,UAAU,cAAc;AAAA,QAC7E,OAAO;AAAA,MACT,CAAC;AACD,UAAI,WAAW,WAAW,YAAY;AACpC,cAAM,QAAQ,iBAAiB,SAAS,QAAQ,IAAI,UAAU,WAAW,MAAM;AAC/E,cAAM,IAAI,4BAA4B,UAAU;AAAA,MAClD;AACA,iBAAW,WAAW;AAAA,IACxB;AAEA,QAAI,mBAAmB,MAAM;AAC3B,YAAM,QAAQ,iBAAiB,SAAS,QAAQ,IAAI,MAAM;AAC1D,eAAS,aAAa,SAAS;AAAA,IACjC;AAEA,WAAO;AAAA,MACL,YAAY,SAAS,KAAK;AAAA,MAC1B,WAAW,SAAS,QAAQ;AAAA,MAC5B;AAAA,MACA,YAAY,cAAc;AAAA,MAC1B,WAAW,cAAc;AAAA,MACzB,QAAQ,cAAc;AAAA,MACtB;AAAA,MACA,eAAe,SAAS,aAAa;AAAA,MACrC,UAAU,SAAS;AAAA,IACrB;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/rules/start-coordinator.ts"],"sourcesContent":["import type { MastraCodeState } from '@mastra/code-sdk/schema';\nimport type { AgentController } from '@mastra/core/agent-controller';\nimport { RequestContext } from '@mastra/core/request-context';\nimport { formatSkillActivation } from '@mastra/core/workspace';\n\nimport type { SourceControlSession, SourceControlStorageHandle } from '../storage/domains/source-control/base.js';\nimport type { CreateWorkItemInput, WorkItemsStorage } from '../storage/domains/work-items/base.js';\nimport type { FactoryTransitionService } from './transition-service.js';\nimport type { FactoryRuleStage, FactoryTransitionResult } from './types.js';\n\nexport interface FactoryStartRequest {\n  orgId: string;\n  userId: string;\n  factoryProjectId: string;\n  sessionId: string;\n  threadTitle: string;\n  threadTags?: Record<string, string>;\n  kickoffKey: string;\n  invocation?: { type: 'prompt'; prompt: string } | { type: 'skill'; skillName: string; arguments: string };\n  destinationStage: FactoryRuleStage;\n  workItem: {\n    id?: string;\n    role: string;\n    input: CreateWorkItemInput;\n  };\n  requestContext?: RequestContext;\n}\n\nexport class FactoryStartTransitionError extends Error {\n  readonly result: Extract<FactoryTransitionResult, { status: 'rejected' }>;\n\n  constructor(result: Extract<FactoryTransitionResult, { status: 'rejected' }>) {\n    super(result.reason);\n    this.name = 'FactoryStartTransitionError';\n    this.result = result;\n  }\n}\n\nexport interface FactoryStartPreparedResult {\n  workItemId: string;\n  bindingId: string;\n  threadId: string;\n  resourceId: string;\n  sessionId: string;\n  branch: string;\n  revision: number;\n  kickoffStatus: 'pending' | 'leased' | 'retry' | 'sent' | 'failed';\n  replayed: boolean;\n}\n\ntype FactoryController = AgentController<MastraCodeState>;\ntype FactorySession = Awaited<ReturnType<FactoryController['createSession']>>;\n\nfunction escapeSkillBoundary(value: string): string {\n  return value.replaceAll('</skill>', '&lt;/skill&gt;');\n}\n\nasync function resolveKickoffMessage(\n  session: FactorySession,\n  invocation: FactoryStartRequest['invocation'],\n): Promise<string | null> {\n  if (!invocation) return null;\n  if (invocation.type === 'prompt') return invocation.prompt;\n\n  const skills = session.getWorkspace().skills;\n  await skills?.maybeRefresh();\n  const skill = await skills?.get(invocation.skillName);\n  if (!skill || skill['user-invocable'] === false) {\n    throw new Error(`Skill not found: ${invocation.skillName}.`);\n  }\n  const args = invocation.arguments.trim();\n  const content = `${formatSkillActivation(skill)}${args ? `\\n\\nARGUMENTS: ${args}` : ''}`.trim();\n  return `<skill name=\"${skill.name}\">\\n${escapeSkillBoundary(content)}\\n</skill>`;\n}\n\nasync function resolveSourceSession(\n  storage: SourceControlStorageHandle,\n  request: FactoryStartRequest,\n): Promise<SourceControlSession> {\n  const session = await storage.sessions.getBySessionId(request.sessionId);\n  if (!session || session.orgId !== request.orgId || session.userId !== request.userId) {\n    throw new Error('Factory session not found');\n  }\n  const projectRepository = await storage.projectRepositories.get({\n    orgId: request.orgId,\n    id: session.projectRepositoryId,\n  });\n  if (!projectRepository) throw new Error('Factory session repository not found');\n  const connection = await storage.connections.get({ orgId: request.orgId, id: projectRepository.connectionId });\n  if (!connection || connection.factoryProjectId !== request.factoryProjectId) {\n    throw new Error('Factory session does not belong to this project');\n  }\n  return session;\n}\n\nasync function configureThread(session: FactorySession, request: FactoryStartRequest): Promise<string> {\n  const threadId = session.thread.requireId();\n  await session.thread.rename({ title: request.threadTitle });\n  const settings = { ...(request.threadTags ?? {}), factorySessionId: request.sessionId };\n  await Promise.all(Object.entries(settings).map(([key, value]) => session.thread.setSetting({ key, value })));\n  return threadId;\n}\n\nexport class FactoryStartCoordinator {\n  readonly #controller: FactoryController;\n  readonly #storage: WorkItemsStorage;\n  readonly #transitionService?: Pick<FactoryTransitionService, 'transition'>;\n  readonly #sourceControl?: SourceControlStorageHandle;\n\n  constructor(\n    controller: FactoryController,\n    storage: WorkItemsStorage,\n    transitionService?: Pick<FactoryTransitionService, 'transition'>,\n    sourceControl?: SourceControlStorageHandle,\n  ) {\n    this.#controller = controller;\n    this.#storage = storage;\n    this.#transitionService = transitionService;\n    this.#sourceControl = sourceControl;\n  }\n\n  async prepare(request: FactoryStartRequest): Promise<FactoryStartPreparedResult> {\n    const storage = this.#storage;\n    if (!this.#sourceControl) throw new Error('Factory source control storage is unavailable');\n    const sourceSession = await resolveSourceSession(this.#sourceControl, request);\n    const requestContext = request.requestContext ?? new RequestContext();\n    if (!request.requestContext) {\n      requestContext.set('user', { workosId: request.userId, organizationId: request.orgId });\n    }\n    const sessionState = {\n      factoryProjectId: request.factoryProjectId,\n      projectRepositoryId: sourceSession.projectRepositoryId,\n    };\n    const session = await this.#controller.createSession({\n      id: sourceSession.sessionId,\n      ownerId: request.userId,\n      resourceId: sourceSession.sessionId,\n      threadId: sourceSession.sessionId,\n      requestContext,\n      tags: sessionState,\n    });\n    // Bound-agent authority gates (the transition tool, the factory-phase\n    // processor, workspace token selection) resolve the session address from\n    // controller state. Seed it server-side — `tags` covers fresh creation,\n    // the explicit setState covers get-or-create returning a session another\n    // caller created without them — so autonomous runs never depend on a\n    // browser connecting to populate the state.\n    await session.state.set(sessionState);\n    const threadId = await configureThread(session, request);\n    const kickoffMessage = await resolveKickoffMessage(session, request.invocation);\n    const prepared = await storage.prepareRunStart({\n      orgId: request.orgId,\n      userId: request.userId,\n      factoryProjectId: request.factoryProjectId,\n      workItem: { id: request.workItem.id, input: request.workItem.input },\n      role: request.workItem.role,\n      session: { sessionId: sourceSession.sessionId, branch: sourceSession.branch, threadId },\n      resourceId: sourceSession.sessionId,\n      kickoffKey: request.kickoffKey,\n      kickoffMessage,\n    });\n    await session.thread.setSetting({ key: 'factoryWorkItemId', value: prepared.item.id });\n\n    let revision = prepared.item.revision;\n    if (prepared.item.stages.length !== 1 || prepared.item.stages[0] !== request.destinationStage) {\n      if (!this.#transitionService) throw new Error('Factory transition service is unavailable.');\n      const transition = await this.#transitionService.transition({\n        orgId: request.orgId,\n        factoryProjectId: request.factoryProjectId,\n        workItemId: prepared.item.id,\n        board: prepared.item.externalSource?.type === 'pull-request' ? 'review' : 'work',\n        stage: request.destinationStage,\n        expectedRevision: prepared.item.revision,\n        actor: { type: 'human', id: request.userId },\n        ingress: { type: 'human', identity: `start:${request.kickoffKey}:transition` },\n        cause: 'run_start',\n      });\n      if (transition.status === 'rejected') {\n        await storage.markPendingStart(prepared.binding.id, 'failed', transition.reason);\n        throw new FactoryStartTransitionError(transition);\n      }\n      revision = transition.revision;\n    }\n\n    if (kickoffMessage === null) {\n      await storage.markPendingStart(prepared.binding.id, 'sent');\n      prepared.pendingStart.status = 'sent';\n    }\n\n    return {\n      workItemId: prepared.item.id,\n      bindingId: prepared.binding.id,\n      threadId,\n      resourceId: sourceSession.sessionId,\n      sessionId: sourceSession.sessionId,\n      branch: sourceSession.branch,\n      revision,\n      kickoffStatus: prepared.pendingStart.status,\n      replayed: prepared.replayed,\n    };\n  }\n}\n"],"mappings":";AAEA,SAAS,sBAAsB;AAC/B,SAAS,6BAA6B;AAyB/B,IAAM,8BAAN,cAA0C,MAAM;AAAA,EAC5C;AAAA,EAET,YAAY,QAAkE;AAC5E,UAAM,OAAO,MAAM;AACnB,SAAK,OAAO;AACZ,SAAK,SAAS;AAAA,EAChB;AACF;AAiBA,SAAS,oBAAoB,OAAuB;AAClD,SAAO,MAAM,WAAW,YAAY,gBAAgB;AACtD;AAEA,eAAe,sBACb,SACA,YACwB;AACxB,MAAI,CAAC,WAAY,QAAO;AACxB,MAAI,WAAW,SAAS,SAAU,QAAO,WAAW;AAEpD,QAAM,SAAS,QAAQ,aAAa,EAAE;AACtC,QAAM,QAAQ,aAAa;AAC3B,QAAM,QAAQ,MAAM,QAAQ,IAAI,WAAW,SAAS;AACpD,MAAI,CAAC,SAAS,MAAM,gBAAgB,MAAM,OAAO;AAC/C,UAAM,IAAI,MAAM,oBAAoB,WAAW,SAAS,GAAG;AAAA,EAC7D;AACA,QAAM,OAAO,WAAW,UAAU,KAAK;AACvC,QAAM,UAAU,GAAG,sBAAsB,KAAK,CAAC,GAAG,OAAO;AAAA;AAAA,aAAkB,IAAI,KAAK,EAAE,GAAG,KAAK;AAC9F,SAAO,gBAAgB,MAAM,IAAI;AAAA,EAAO,oBAAoB,OAAO,CAAC;AAAA;AACtE;AAEA,eAAe,qBACb,SACA,SAC+B;AAC/B,QAAM,UAAU,MAAM,QAAQ,SAAS,eAAe,QAAQ,SAAS;AACvE,MAAI,CAAC,WAAW,QAAQ,UAAU,QAAQ,SAAS,QAAQ,WAAW,QAAQ,QAAQ;AACpF,UAAM,IAAI,MAAM,2BAA2B;AAAA,EAC7C;AACA,QAAM,oBAAoB,MAAM,QAAQ,oBAAoB,IAAI;AAAA,IAC9D,OAAO,QAAQ;AAAA,IACf,IAAI,QAAQ;AAAA,EACd,CAAC;AACD,MAAI,CAAC,kBAAmB,OAAM,IAAI,MAAM,sCAAsC;AAC9E,QAAM,aAAa,MAAM,QAAQ,YAAY,IAAI,EAAE,OAAO,QAAQ,OAAO,IAAI,kBAAkB,aAAa,CAAC;AAC7G,MAAI,CAAC,cAAc,WAAW,qBAAqB,QAAQ,kBAAkB;AAC3E,UAAM,IAAI,MAAM,iDAAiD;AAAA,EACnE;AACA,SAAO;AACT;AAEA,eAAe,gBAAgB,SAAyB,SAA+C;AACrG,QAAM,WAAW,QAAQ,OAAO,UAAU;AAC1C,QAAM,QAAQ,OAAO,OAAO,EAAE,OAAO,QAAQ,YAAY,CAAC;AAC1D,QAAM,WAAW,EAAE,GAAI,QAAQ,cAAc,CAAC,GAAI,kBAAkB,QAAQ,UAAU;AACtF,QAAM,QAAQ,IAAI,OAAO,QAAQ,QAAQ,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,QAAQ,OAAO,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC;AAC3G,SAAO;AACT;AAEO,IAAM,0BAAN,MAA8B;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YACE,YACA,SACA,mBACA,eACA;AACA,SAAK,cAAc;AACnB,SAAK,WAAW;AAChB,SAAK,qBAAqB;AAC1B,SAAK,iBAAiB;AAAA,EACxB;AAAA,EAEA,MAAM,QAAQ,SAAmE;AAC/E,UAAM,UAAU,KAAK;AACrB,QAAI,CAAC,KAAK,eAAgB,OAAM,IAAI,MAAM,+CAA+C;AACzF,UAAM,gBAAgB,MAAM,qBAAqB,KAAK,gBAAgB,OAAO;AAC7E,UAAM,iBAAiB,QAAQ,kBAAkB,IAAI,eAAe;AACpE,QAAI,CAAC,QAAQ,gBAAgB;AAC3B,qBAAe,IAAI,QAAQ,EAAE,UAAU,QAAQ,QAAQ,gBAAgB,QAAQ,MAAM,CAAC;AAAA,IACxF;AACA,UAAM,eAAe;AAAA,MACnB,kBAAkB,QAAQ;AAAA,MAC1B,qBAAqB,cAAc;AAAA,IACrC;AACA,UAAM,UAAU,MAAM,KAAK,YAAY,cAAc;AAAA,MACnD,IAAI,cAAc;AAAA,MAClB,SAAS,QAAQ;AAAA,MACjB,YAAY,cAAc;AAAA,MAC1B,UAAU,cAAc;AAAA,MACxB;AAAA,MACA,MAAM;AAAA,IACR,CAAC;AAOD,UAAM,QAAQ,MAAM,IAAI,YAAY;AACpC,UAAM,WAAW,MAAM,gBAAgB,SAAS,OAAO;AACvD,UAAM,iBAAiB,MAAM,sBAAsB,SAAS,QAAQ,UAAU;AAC9E,UAAM,WAAW,MAAM,QAAQ,gBAAgB;AAAA,MAC7C,OAAO,QAAQ;AAAA,MACf,QAAQ,QAAQ;AAAA,MAChB,kBAAkB,QAAQ;AAAA,MAC1B,UAAU,EAAE,IAAI,QAAQ,SAAS,IAAI,OAAO,QAAQ,SAAS,MAAM;AAAA,MACnE,MAAM,QAAQ,SAAS;AAAA,MACvB,SAAS,EAAE,WAAW,cAAc,WAAW,QAAQ,cAAc,QAAQ,SAAS;AAAA,MACtF,YAAY,cAAc;AAAA,MAC1B,YAAY,QAAQ;AAAA,MACpB;AAAA,IACF,CAAC;AACD,UAAM,QAAQ,OAAO,WAAW,EAAE,KAAK,qBAAqB,OAAO,SAAS,KAAK,GAAG,CAAC;AAErF,QAAI,WAAW,SAAS,KAAK;AAC7B,QAAI,SAAS,KAAK,OAAO,WAAW,KAAK,SAAS,KAAK,OAAO,CAAC,MAAM,QAAQ,kBAAkB;AAC7F,UAAI,CAAC,KAAK,mBAAoB,OAAM,IAAI,MAAM,4CAA4C;AAC1F,YAAM,aAAa,MAAM,KAAK,mBAAmB,WAAW;AAAA,QAC1D,OAAO,QAAQ;AAAA,QACf,kBAAkB,QAAQ;AAAA,QAC1B,YAAY,SAAS,KAAK;AAAA,QAC1B,OAAO,SAAS,KAAK,gBAAgB,SAAS,iBAAiB,WAAW;AAAA,QAC1E,OAAO,QAAQ;AAAA,QACf,kBAAkB,SAAS,KAAK;AAAA,QAChC,OAAO,EAAE,MAAM,SAAS,IAAI,QAAQ,OAAO;AAAA,QAC3C,SAAS,EAAE,MAAM,SAAS,UAAU,SAAS,QAAQ,UAAU,cAAc;AAAA,QAC7E,OAAO;AAAA,MACT,CAAC;AACD,UAAI,WAAW,WAAW,YAAY;AACpC,cAAM,QAAQ,iBAAiB,SAAS,QAAQ,IAAI,UAAU,WAAW,MAAM;AAC/E,cAAM,IAAI,4BAA4B,UAAU;AAAA,MAClD;AACA,iBAAW,WAAW;AAAA,IACxB;AAEA,QAAI,mBAAmB,MAAM;AAC3B,YAAM,QAAQ,iBAAiB,SAAS,QAAQ,IAAI,MAAM;AAC1D,eAAS,aAAa,SAAS;AAAA,IACjC;AAEA,WAAO;AAAA,MACL,YAAY,SAAS,KAAK;AAAA,MAC1B,WAAW,SAAS,QAAQ;AAAA,MAC5B;AAAA,MACA,YAAY,cAAc;AAAA,MAC1B,WAAW,cAAc;AAAA,MACzB,QAAQ,cAAc;AAAA,MACtB;AAAA,MACA,eAAe,SAAS,aAAa;AAAA,MACrC,UAAU,SAAS;AAAA,IACrB;AAAA,EACF;AACF;","names":[]}

package/dist/workspace.d.ts

@@ -4,6 +4,7 @@ import { LocalSandbox, Workspace } from '@mastra/core/workspace';
 import type { MastraFactorySandboxConfig } from './factory.js';
 import type { GithubIntegration } from './integrations/github/integration.js';
 import type { SandboxFleet } from './sandbox/fleet.js';
+import type { WorkItemsStorage } from './storage/domains/work-items/base.js';
 export declare function checkpointNameForSession(sessionId: string): string;
 type DynamicWorkspaceContext = Parameters<typeof getDynamicWorkspace>[0];
 export interface CreateWorkspaceFactoryOptions {
@@ -13,6 +14,10 @@ export interface CreateWorkspaceFactoryOptions {
     github?: GithubIntegration;
     /** Fleet the per-session sandboxes are provisioned/reattached through. */
     fleet?: SandboxFleet;
+    /** Work-items storage used to resolve the session's run-binding role, so
+     * review-board sessions get the reviewer PAT as `GH_TOKEN`. Optional —
+     * without it every session uses the default (worker) PAT. */
+    workItems?: Pick<WorkItemsStorage, 'findRunBindingBySession'>;
 }
 export declare function createWorkspaceFactory(options?: CreateWorkspaceFactoryOptions): ({ requestContext, mastra, skillExtension }: DynamicWorkspaceContext) => Promise<Workspace<import("@mastra/core/workspace").WorkspaceFilesystem | undefined, import("@mastra/core/workspace").WorkspaceSandbox | undefined, undefined> | Workspace<import("@mastra/core/workspace").LocalFilesystem, LocalSandbox, undefined> | Workspace<SandboxFilesystem, import("@mastra/core/workspace").WorkspaceSandbox, undefined>>;
 export declare const getFactoryWorkspace: ({ requestContext, mastra, skillExtension }: DynamicWorkspaceContext) => Promise<Workspace<import("@mastra/core/workspace").WorkspaceFilesystem | undefined, import("@mastra/core/workspace").WorkspaceSandbox | undefined, undefined> | Workspace<import("@mastra/core/workspace").LocalFilesystem, LocalSandbox, undefined> | Workspace<SandboxFilesystem, import("@mastra/core/workspace").WorkspaceSandbox, undefined>>;

package/dist/workspace.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspace.d.ts","sourceRoot":"","sources":["../src/workspace.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,iBAAiB,EAAE,MAAM,4CAA4C,CAAC;AAE/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAKxE,OAAO,EAAE,YAAY,EAAoB,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAInF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAC;AAC/D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAG9E,OAAO,KAAK,EAAuB,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAK5E,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAElE;AA+ED,KAAK,uBAAuB,GAAG,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC;AAEzE,MAAM,WAAW,6BAA6B;IAC5C,wEAAwE;IACxE,OAAO,CAAC,EAAE,0BAA0B,CAAC;IACrC,gFAAgF;IAChF,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B,0EAA0E;IAC1E,KAAK,CAAC,EAAE,YAAY,CAAC;CACtB;AAED,wBAAgB,sBAAsB,CAAC,OAAO,GAAE,6BAAkC,IAKlE,4CAA4C,uBAAuB,wVAqHlF;AAED,eAAO,MAAM,mBAAmB,+CAvH4B,uBAAuB,uVAuHxB,CAAC"}
+{"version":3,"file":"workspace.d.ts","sourceRoot":"","sources":["../src/workspace.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,iBAAiB,EAAE,MAAM,4CAA4C,CAAC;AAE/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAKxE,OAAO,EAAE,YAAY,EAAoB,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAInF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAC;AAC/D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAM9E,OAAO,KAAK,EAAuB,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAK7E,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAElE;AA+ED,KAAK,uBAAuB,GAAG,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC;AAEzE,MAAM,WAAW,6BAA6B;IAC5C,wEAAwE;IACxE,OAAO,CAAC,EAAE,0BAA0B,CAAC;IACrC,gFAAgF;IAChF,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B,0EAA0E;IAC1E,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB;;iEAE6D;IAC7D,SAAS,CAAC,EAAE,IAAI,CAAC,gBAAgB,EAAE,yBAAyB,CAAC,CAAC;CAC/D;AAED,wBAAgB,sBAAsB,CAAC,OAAO,GAAE,6BAAkC,IAKlE,4CAA4C,uBAAuB,wVA2IlF;AAED,eAAO,MAAM,mBAAmB,+CA7I4B,uBAAuB,uVA6IxB,CAAC"}

package/dist/workspace.js

@@ -21,6 +21,25 @@ import {
 function getFactoryAuthUserId(user) {
   return user?.workosId ?? user?.id;
 }
+function getFactoryAuthOrgId(user) {
+  return user?.organizationId;
+}
+
+// src/integrations/github/pat.ts
+var PAT_SETTINGS_USER_ID = "__github_org_settings__";
+function asToken(value) {
+  return typeof value === "string" && value.length > 0 ? value : null;
+}
+async function getGithubPat(getStorage, orgId, kind = "default") {
+  try {
+    const settings = await getStorage().settings.get(orgId, PAT_SETTINGS_USER_ID);
+    if (!settings) return null;
+    if (kind === "reviewer") return asToken(settings.reviewerPat) ?? asToken(settings.pat);
+    return asToken(settings.pat);
+  } catch {
+    return null;
+  }
+}
 
 // src/integrations/github/sandbox.ts
 import { createHash } from "crypto";
@@ -195,9 +214,35 @@ async function runWorktreeSetup(sandbox, worktreePath, command) {
 
 // src/integrations/github/token-refresh.ts
 var GITHUB_TOKEN_INJECTOR_CONTEXT_KEY = "factoryGithubTokenInjector";
+var GITHUB_PAT_KIND_CONTEXT_KEY = "factoryGithubPatKind";
 function registerGithubTokenInjector(requestContext, injector) {
   requestContext.set(GITHUB_TOKEN_INJECTOR_CONTEXT_KEY, injector);
 }
+function registerGithubPatKind(requestContext, kind) {
+  requestContext.set(GITHUB_PAT_KIND_CONTEXT_KEY, kind);
+}
+
+// src/rules/binding-context.ts
+function getFactorySessionCoordinates(requestContext) {
+  if (!requestContext || typeof requestContext.get !== "function") return null;
+  const context = requestContext.get("controller");
+  const factoryProjectId = context?.getState().factoryProjectId;
+  if (!context?.threadId || !context.resourceId || !factoryProjectId) return null;
+  return {
+    factoryProjectId,
+    threadId: context.threadId,
+    resourceId: context.resourceId,
+    sessionId: context.resourceId
+  };
+}
+function getFactorySessionAddress(requestContext) {
+  const coordinates = getFactorySessionCoordinates(requestContext);
+  if (!coordinates || !requestContext || typeof requestContext.get !== "function") return null;
+  const user = requestContext.get("user");
+  const orgId = getFactoryAuthOrgId(user);
+  if (!orgId) return null;
+  return { orgId, ...coordinates };
+}
 
 // src/workspace.ts
 var WORKSPACE_ID_PREFIX = "mfw";
@@ -264,7 +309,7 @@ var factorySkillExtension = {
   createSource: (fallback, fallbackSkillRoots) => new FactorySkillSource(fallback, fallbackSkillRoots)
 };
 function createWorkspaceFactory(options = {}) {
-  const { sandbox: sandboxConfig, github, fleet } = options;
+  const { sandbox: sandboxConfig, github, fleet, workItems } = options;
   const isLocalSandbox = sandboxConfig?.machine instanceof LocalSandbox;
   const githubTokenInjectors = /* @__PURE__ */ new Map();
   return async ({ requestContext, mastra, skillExtension }) => {
@@ -318,8 +363,11 @@ function createWorkspaceFactory(options = {}) {
       const existing = mastra?.getWorkspaceById(workspaceId);
       if (existing) {
         existing.setToolsConfig(MASTRACODE_WORKSPACE_TOOLS);
-        const injectGithubToken2 = githubTokenInjectors.get(workspaceId);
-        if (injectGithubToken2) registerGithubTokenInjector(requestContext, injectGithubToken2);
+        const registered = githubTokenInjectors.get(workspaceId);
+        if (registered) {
+          registerGithubTokenInjector(requestContext, registered.inject);
+          registerGithubPatKind(requestContext, registered.patKind);
+        }
         return existing;
       }
     } catch {
@@ -330,9 +378,19 @@ function createWorkspaceFactory(options = {}) {
     });
     const token = access.authorization?.token;
     if (!token) throw new Error("Repository access did not include a bearer token for the Factory session");
+    let patKind = "default";
+    if (workItems) {
+      try {
+        const address = getFactorySessionAddress(requestContext);
+        const runBinding = address ? await workItems.findRunBindingBySession(address) : null;
+        if (runBinding?.role === "review" && runBinding.orgId === session.orgId) patKind = "reviewer";
+      } catch {
+      }
+    }
+    const ghCliToken = await getGithubPat(() => github.integrationStorage, session.orgId, patKind) ?? token;
     const sandbox = await fleet.ensureSandbox(
       binding,
-      { GH_TOKEN: token },
+      { GH_TOKEN: ghCliToken },
       void 0,
       isLocalSandbox ? { workingDirectory: workdir } : {}
     );
@@ -356,8 +414,9 @@ function createWorkspaceFactory(options = {}) {
       }
       sandbox.setEnvironmentVariable("GH_TOKEN", freshToken);
     };
-    githubTokenInjectors.set(workspaceId, injectGithubToken);
+    githubTokenInjectors.set(workspaceId, { inject: injectGithubToken, patKind });
     registerGithubTokenInjector(requestContext, injectGithubToken);
+    registerGithubPatKind(requestContext, patKind);
     const filesystem = new SandboxFilesystem({ sandbox, workdir });
     const projectSkillPaths = [path2.join(configDir, "skills"), ".claude/skills", ".agents/skills"];
     const skillPaths = [...effectiveSkillExtension?.paths ?? [], ...projectSkillPaths];