@mastra/factory 0.11.1 → 0.12.0-alpha.1

package/dist/integrations/github/routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../../src/integrations/github/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAG1D,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAG3D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAGvD,OAAO,KAAK,EAAuD,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEhH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+CAA+C,CAAC;AAC3F,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AASrF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AA2C1D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAgBxD,MAAM,WAAW,wBAAwB;IACvC,4EAA4E;IAC5E,IAAI,EAAE,SAAS,CAAC;IAChB,8EAA8E;IAC9E,KAAK,CAAC,EAAE,wBAAwB,CAAC;IACjC;;;;OAIG;IACH,KAAK,EAAE,YAAY,CAAC;IACpB,yEAAyE;IACzE,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB;;;;OAIG;IACH,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B;;;;OAIG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4FAA4F;IAC5F,UAAU,CAAC,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAC7C,gGAAgG;IAChG,cAAc,EAAE,IAAI,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;IACnD,6EAA6E;IAC7E,SAAS,CAAC,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;IACjC,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,sBAAsB,CAAC;IAClC,iBAAiB,CAAC,EAAE,OAAO,qCAAqC,EAAE,4BAA4B,CAAC;IAC/F,kFAAkF;IAClF,SAAS,CAAC,EAAE,IAAI,CAAC,OAAO,0CAA0C,EAAE,gBAAgB,EAAE,wBAAwB,CAAC,CAAC;IAChH,+FAA+F;IAC/F,kBAAkB,CAAC,EAAE,CAAC,KAAK,EAAE,mBAAmB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACvE;AA4ND;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,QAAQ,EAAE,CAgsB/E;AAkQD,KAAK,wBAAwB,GAAG,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC"}
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../../src/integrations/github/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAG1D,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAGvD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAInF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+CAA+C,CAAC;AAC3F,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAQrF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAuC1D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAgBxD,MAAM,WAAW,wBAAwB;IACvC,4EAA4E;IAC5E,IAAI,EAAE,SAAS,CAAC;IAChB,8EAA8E;IAC9E,KAAK,CAAC,EAAE,wBAAwB,CAAC;IACjC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,0BAA0B,CAAC;IACrC,yEAAyE;IACzE,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB;;;;OAIG;IACH,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B;;;;OAIG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4FAA4F;IAC5F,UAAU,CAAC,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAC7C,gGAAgG;IAChG,cAAc,EAAE,IAAI,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;IACnD,6EAA6E;IAC7E,SAAS,CAAC,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;IACjC,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,sBAAsB,CAAC;IAClC,iBAAiB,CAAC,EAAE,OAAO,qCAAqC,EAAE,4BAA4B,CAAC;IAC/F,kFAAkF;IAClF,SAAS,CAAC,EAAE,IAAI,CAAC,OAAO,0CAA0C,EAAE,gBAAgB,EAAE,wBAAwB,CAAC,CAAC;IAChH,+FAA+F;IAC/F,kBAAkB,CAAC,EAAE,CAAC,KAAK,EAAE,mBAAmB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACvE;AA4ND;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,QAAQ,EAAE,CAypB/E;AAiHD,KAAK,wBAAwB,GAAG,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC"}

package/dist/integrations/github/routes.js

@@ -1,18 +1,18 @@
-import { clearGithubPat, getGithubPat, getGithubPatStatus, setGithubPat } from "./pat.js";
+import { clearGithubPat, getGithubPatStatus, setGithubPat } from "./pat.js";
 import { listPullRequestSubscriptionsForThread, subscribeToPullRequest } from "./subscriptions.js";
-import { SandboxBudgetError } from "../../sandbox/fleet.js";
-import { MaterializeError, WorktreeError, commitAll, ensureProjectSandbox, isValidGitRef as isValidGitRef$1, materializeRepo, pushBranch, teardownProjectSandbox } from "./sandbox.js";
-import { baseCheckpointIsStale } from "../../sandbox/base-checkpoint-triggers.js";
+import { requireExec } from "../../sandbox/materialization.js";
+import { sanitizeSegment } from "../../sandbox/workdir.js";
+import { peekSessionSandbox } from "../../sandbox/session-sandbox.js";
 import { normalizeSessionTitle } from "../../session/session-title.js";
 import { getGithubFeatureDiagnostics, isGithubFeatureEnabled } from "./config.js";
 import { reclaimDeletedSessionSandbox } from "./sandbox-release.js";
+import { MaterializeError, SetupCommandError, commitAll, isValidGitRef as isValidGitRef$1, pushBranch } from "./sandbox.js";
 import { handleGithubWebhook } from "./webhook.js";
 import { registerApiRoute } from "@mastra/core/server";
 import { randomUUID } from "crypto";
 import { UniqueViolationError } from "@mastra/core/storage";
 import { resolveModel } from "@mastra/code-sdk/agents/model";
 import { RequestContext } from "@mastra/core/request-context";
-import { streamSSE } from "hono/streaming";
 //#region src/integrations/github/routes.ts
 /**
 * Mastra `apiRoutes` for the GitHub App project feature.
@@ -212,13 +212,13 @@ async function ingestPolledEvents(events, ingestFactoryEvent) {
 */
 function buildGithubRoutes(options) {
 	const routes = [];
-	const { auth, users, fleet, storage, github, stateSigner, controller, memorySettings, emitAudit, sessionRetirement, workItems } = options;
+	const { auth, sandbox, users, storage, github, stateSigner, controller, memorySettings, emitAudit, sessionRetirement, workItems } = options;
 	const diagnostics = () => getGithubFeatureDiagnostics({
 		github,
 		auth,
 		appDbConfigured: storage !== void 0,
 		stateSigner,
-		fleet
+		sandbox
 	});
 	routes.push(registerApiRoute("/web/github/status", {
 		method: "GET",
@@ -242,7 +242,7 @@ function buildGithubRoutes(options) {
 			}, 401);
 			if (!tenant.orgId) return c.json({
 				enabled: true,
-				sandboxEnabled: fleet.enabled,
+				sandboxEnabled: !!sandbox,
 				organizationRequired: true,
 				connected: false,
 				installations: [],
@@ -253,7 +253,7 @@ function buildGithubRoutes(options) {
 			const connected = rows.length > 0;
 			return c.json({
 				enabled: true,
-				sandboxEnabled: fleet.enabled,
+				sandboxEnabled: !!sandbox,
 				connected,
 				installations: rows.map((r) => ({
 					installationId: Number(r.externalId),
@@ -423,69 +423,13 @@ function buildGithubRoutes(options) {
 					...repo,
 					installationStorageId: inst.id,
 					repositoryStorageId: repository.id,
-					sandboxProvider: fleet.provider,
-					sandboxWorkdir: fleet.computeWorkdir(repo.fullName)
+					sandboxProvider: sandbox ? "custom" : "none",
+					sandboxWorkdir: `~/${sanitizeSegment(repo.fullName.split("/", 2)[1] || "repo")}`
 				};
 			}));
 			return c.json({ repos });
 		}
 	}));
-	routes.push(registerApiRoute("/web/github/projects/:id/ensure", {
-		method: "POST",
-		requiresAuth: false,
-		handler: async (c) => {
-			const resolved = await resolveOrgTenant(loose(c), auth);
-			if ("response" in resolved) return resolved.response;
-			const { orgId, userId } = resolved.tenant;
-			if (!fleet.enabled) return c.json({
-				error: "sandbox_not_configured",
-				message: "No sandbox provider is configured."
-			}, 503);
-			const projectRepositoryId = c.req.param("id");
-			if (!projectRepositoryId) return c.json({ error: "Project repository not found" }, 404);
-			const project = await resolveProjectRepository({
-				github,
-				orgId,
-				projectRepositoryId
-			});
-			if (!project) return c.json({ error: "Project repository not found" }, 404);
-			if ((c.req.header("accept") ?? "").includes("text/event-stream")) return streamSSE(loose(c), async (stream) => {
-				try {
-					const result = await prepareProject({
-						github,
-						fleet,
-						project,
-						userId,
-						onProgress: (ev) => void stream.writeSSE({
-							event: "progress",
-							data: JSON.stringify(ev)
-						})
-					});
-					await stream.writeSSE({
-						event: "done",
-						data: JSON.stringify(result)
-					});
-				} catch (err) {
-					await stream.writeSSE({
-						event: "error",
-						data: JSON.stringify(ensureErrorPayload(err).body)
-					});
-				}
-			});
-			try {
-				const result = await prepareProject({
-					github,
-					fleet,
-					project,
-					userId
-				});
-				return c.json(result);
-			} catch (err) {
-				const { status, body } = ensureErrorPayload(err);
-				return c.json(body, status);
-			}
-		}
-	}));
 	routes.push(registerApiRoute("/web/github/projects/:id/issues", {
 		method: "GET",
 		requiresAuth: false,
@@ -775,8 +719,8 @@ function buildGithubRoutes(options) {
 	routes.push(...buildProjectGitRoutes({
 		github,
 		auth,
+		sandbox,
 		users,
-		fleet,
 		controller,
 		memorySettings,
 		emitAudit,
@@ -817,135 +761,12 @@ function identityFromUser(user) {
 		email: u?.email ?? null
 	};
 }
-/**
-* Resolve a live, started sandbox for the caller's per-user sandbox binding. The
-* sandbox must already have been provisioned (`sandboxId` set) — the git write
-* routes never clone, they operate on the existing checkout.
-*/
-async function resolveProjectSandbox(options) {
-	const { fleet, sandboxRow } = options;
-	if (!sandboxRow.sandboxId) throw new MaterializeError("Project sandbox is not provisioned. Open the project first.", "clone-failed");
-	return fleet.reattachSandbox(sandboxRow.sandboxId, { actingUserId: sandboxRow.userId });
-}
-/**
-* Load (or create) the caller's per-(project,user) sandbox binding row. The
-* binding inherits its workdir from the org-owned project, but `sandboxId` /
-* `materializedAt` stay null until the user first opens the project.
-*/
-async function loadOrCreateSandboxRow(github, project, userId) {
-	return github.sourceControlStorage.sandboxes.getOrCreate({
-		projectRepository: project,
-		userId
-	});
-}
-/**
-* Provision/reattach the caller's sandbox and materialize the repo into it,
-* emitting coarse progress events as each server step happens. Shared by both
-* the JSON and SSE variants of the `/ensure` route. Throws on failure so the
-* caller can shape the response (HTTP status vs SSE `error` event).
-*/
-async function prepareProject(options) {
-	const { github, fleet, userId, onProgress } = options;
-	let project = options.project;
-	if (project.sandboxProvider !== fleet.provider) {
-		const sandboxWorkdir = fleet.computeWorkdir(project.repository.slug);
-		await github.sourceControlStorage.projectRepositories.update({
-			orgId: project.installation.orgId,
-			id: project.id,
-			input: {
-				sandboxProvider: fleet.provider,
-				sandboxWorkdir
-			}
-		});
-		project = {
-			...project,
-			sandboxProvider: fleet.provider,
-			sandboxWorkdir
-		};
-	}
-	let sandboxRow = await loadOrCreateSandboxRow(github, project, userId);
-	if (sandboxRow.sandboxWorkdir !== project.sandboxWorkdir) {
-		await github.sourceControlStorage.sandboxes.setWorkdir({
-			id: sandboxRow.id,
-			sandboxWorkdir: project.sandboxWorkdir
-		});
-		sandboxRow = {
-			...sandboxRow,
-			sandboxWorkdir: project.sandboxWorkdir,
-			materializedAt: null
-		};
-	}
-	const access = await github.versionControl.getRepositoryAccess({
-		orgId: project.installation.orgId,
-		repositoryId: project.repository.id
-	});
-	if (!access.authorization) throw new MaterializeError("Repository access did not include a bearer token.", "clone-failed");
-	const ghCliToken = await getGithubPat(() => github.integrationStorage, project.installation.orgId) ?? access.authorization.token;
-	const seedCheckpointName = project.baseCheckpoint && !baseCheckpointIsStale(project) ? project.baseCheckpoint.name : void 0;
-	const sandbox = await ensureProjectSandbox({
-		fleet,
-		row: sandboxRow,
-		storage: github.sourceControlStorage.sandboxes,
-		token: ghCliToken,
-		onProgress,
-		...seedCheckpointName ? { seedCheckpointName } : {}
-	});
-	const finalRow = await github.sourceControlStorage.sandboxes.getById({ id: sandboxRow.id }) ?? sandboxRow;
-	await materializeRepo({
-		row: finalRow,
-		repoInfo: {
-			repoFullName: project.repository.slug,
-			defaultBranch: project.defaultBranch
-		},
-		sandbox,
-		token: access.authorization.token,
-		storage: github.sourceControlStorage.sandboxes,
-		onProgress,
-		skipPullOnExistingCheckout: Boolean(seedCheckpointName && sandbox.seedCheckpointNameUsed === seedCheckpointName)
-	});
-	const result = {
-		resourceId: project.factoryProjectId,
-		factoryProjectId: project.factoryProjectId,
-		projectRepositoryId: project.id,
-		sandboxId: finalRow.sandboxId,
-		sandboxWorkdir: finalRow.sandboxWorkdir
-	};
-	onProgress?.({
-		phase: "done",
-		message: "Workspace ready."
-	});
-	return result;
-}
-/** Shape an /ensure failure into an HTTP status + JSON body (also used as the SSE error payload). */
-function ensureErrorPayload(err) {
-	if (err instanceof SandboxBudgetError) return {
-		status: 429,
-		body: {
-			error: err.code,
-			message: err.message
-		}
-	};
-	if (err instanceof MaterializeError) return {
-		status: 502,
-		body: {
-			error: err.code,
-			message: err.message
-		}
-	};
-	return {
-		status: 500,
-		body: {
-			error: "materialize_failed",
-			message: err instanceof Error ? err.message : String(err)
-		}
-	};
-}
-/** Map a sandbox/worktree error to an actionable HTTP response. */
+/** Map a sandbox/setup-command error to an actionable HTTP response. */
 function gitErrorResponse(c, err) {
-	if (err instanceof WorktreeError) return c.json({
+	if (err instanceof SetupCommandError) return c.json({
 		error: err.code,
 		message: err.message
-	}, err.code === "invalid-branch" ? 400 : 502);
+	}, 502);
 	if (err instanceof MaterializeError) return c.json({
 		error: err.code,
 		message: err.message
@@ -956,18 +777,17 @@ function gitErrorResponse(c, err) {
 	}, 500);
 }
 /**
-* Load the org-owned project and the caller's per-user sandbox binding for a git
-* route. Centralizes the auth + org/ownership checks every git route shares:
-* the project is scoped by `(id, orgId)`, the sandbox binding by
-* `(projectRepositoryId, userId)`. Returns the tenant, project, and sandbox row, or
-* a ready-to-return error response.
+* Load the org-owned project for a git route. Centralizes the auth +
+* org/ownership checks every git route shares: the project is scoped by
+* `(id, orgId)`. Returns the tenant and project, or a ready-to-return error
+* response.
 */
 async function loadOwnedProject(options) {
-	const { github, auth, fleet, c } = options;
+	const { github, auth, sandbox, c } = options;
 	const resolved = await resolveOrgTenant(c, auth);
 	if ("response" in resolved) return { response: resolved.response };
 	const { orgId, userId } = resolved.tenant;
-	if (!fleet.enabled) return { response: c.json({
+	if (!sandbox) return { response: c.json({
 		error: "sandbox_not_configured",
 		message: "No sandbox provider is configured."
 	}, 503) };
@@ -982,8 +802,7 @@ async function loadOwnedProject(options) {
 	return {
 		orgId,
 		userId,
-		project,
-		sandboxRow: await loadOrCreateSandboxRow(github, project, userId)
+		project
 	};
 }
 /**
@@ -1064,7 +883,7 @@ function createSessionOwnerProfileResolver(users) {
 		return profiles;
 	};
 }
-function buildProjectGitRoutes({ github, auth, users, fleet, controller, memorySettings, emitAudit, sessionRetirement, workItems }) {
+function buildProjectGitRoutes({ github, auth, sandbox, users, controller, memorySettings, emitAudit, sessionRetirement, workItems }) {
 	const nameSession = createSessionNaming();
 	const resolveSessionOwnerProfiles = createSessionOwnerProfileResolver(users);
 	return [
@@ -1198,11 +1017,7 @@ function buildProjectGitRoutes({ github, auth, users, fleet, controller, memoryS
 						sessionId: session.sessionId
 					});
 					await github.sourceControlStorage.sessions.delete(session.id);
-					reclaimDeletedSessionSandbox({
-						fleet,
-						sourceControl: github.sourceControlStorage,
-						session
-					}).catch((error) => {
+					reclaimDeletedSessionSandbox({ session }).catch((error) => {
 						console.error("[GitHub Sessions] Failed to reclaim sandbox for deleted session", {
 							sessionId: session.sessionId,
 							sandboxId: session.sandboxId,
@@ -1263,7 +1078,7 @@ function buildProjectGitRoutes({ github, auth, users, fleet, controller, memoryS
 				const owned = await loadOwnedProject({
 					github,
 					auth,
-					fleet,
+					sandbox,
 					c: loose(c)
 				});
 				if ("response" in owned) return owned.response;
@@ -1277,13 +1092,10 @@ function buildProjectGitRoutes({ github, auth, users, fleet, controller, memoryS
 				if (typeof body.message !== "string" || body.message.trim().length === 0 || body.message.length > 5e3) return c.json({ error: "Invalid message" }, 400);
 				const sessionWorkspace = await resolveSessionWorkspace(github, project.id, userId, body.sessionId);
 				if (!sessionWorkspace) return c.json({ error: "Invalid sessionId" }, 400);
-				const { workdir, sandboxBinding } = sessionWorkspace;
+				const { workdir, sandbox: sessionSandbox } = sessionWorkspace;
 				try {
 					return await withSessionOperationLock(sessionWorkspace.session.sessionId, async () => {
-						const result = await commitAll(await resolveProjectSandbox({
-							fleet,
-							sandboxRow: sandboxBinding
-						}), workdir, body.message, identityFromUser(await auth.ensureUser(loose(c))));
+						const result = await commitAll(sessionSandbox, workdir, body.message, identityFromUser(await auth.ensureUser(loose(c))));
 						if (result.committed) await emitAudit?.({
 							context: loose(c),
 							input: {
@@ -1311,7 +1123,7 @@ function buildProjectGitRoutes({ github, auth, users, fleet, controller, memoryS
 				const owned = await loadOwnedProject({
 					github,
 					auth,
-					fleet,
+					sandbox,
 					c: loose(c)
 				});
 				if ("response" in owned) return owned.response;
@@ -1326,19 +1138,15 @@ function buildProjectGitRoutes({ github, auth, users, fleet, controller, memoryS
 				const branch = body.branch;
 				const sessionWorkspace = await resolveSessionWorkspace(github, project.id, userId, body.sessionId);
 				if (!sessionWorkspace) return c.json({ error: "Invalid sessionId" }, 400);
-				const { workdir, sandboxBinding } = sessionWorkspace;
+				const { workdir, sandbox: sessionSandbox } = sessionWorkspace;
 				try {
 					return await withSessionOperationLock(sessionWorkspace.session.sessionId, async () => {
-						const sandbox = await resolveProjectSandbox({
-							fleet,
-							sandboxRow: sandboxBinding
-						});
 						const access = await github.versionControl.getRepositoryAccess({
 							orgId,
 							repositoryId: project.repository.id
 						});
 						if (!access.authorization) throw new Error("Repository access did not include a bearer token.");
-						await pushBranch(sandbox, workdir, branch, access.authorization.token, project.repository.slug);
+						await pushBranch(sessionSandbox, workdir, branch, access.authorization.token, project.repository.slug);
 						await emitAudit?.({
 							context: loose(c),
 							input: {
@@ -1372,7 +1180,7 @@ function buildProjectGitRoutes({ github, auth, users, fleet, controller, memoryS
 				const owned = await loadOwnedProject({
 					github,
 					auth,
-					fleet,
+					sandbox,
 					c: loose(c)
 				});
 				if ("response" in owned) return owned.response;
@@ -1454,35 +1262,6 @@ function buildProjectGitRoutes({ github, auth, users, fleet, controller, memoryS
 					}, 502);
 				}
 			}
-		}),
-		registerApiRoute("/web/github/projects/:id/sandbox", {
-			method: "DELETE",
-			requiresAuth: false,
-			handler: async (c) => {
-				const owned = await loadOwnedProject({
-					github,
-					auth,
-					fleet,
-					c: loose(c)
-				});
-				if ("response" in owned) return owned.response;
-				const { sandboxRow } = owned;
-				if (!sandboxRow.sandboxId) return c.json({ tornDown: false });
-				try {
-					return await withSessionOperationLock(`sandbox:${sandboxRow.id}`, async () => {
-						const sandbox = await fleet.reattachSandbox(sandboxRow.sandboxId, { actingUserId: sandboxRow.userId });
-						await teardownProjectSandbox({
-							fleet,
-							row: sandboxRow,
-							storage: github.sourceControlStorage.sandboxes,
-							sandbox
-						});
-						return c.json({ tornDown: true });
-					});
-				} catch (err) {
-					return gitErrorResponse(loose(c), err);
-				}
-			}
 		})
 	];
 }
@@ -1490,19 +1269,13 @@ function buildProjectGitRoutes({ github, auth, users, fleet, controller, memoryS
 async function resolveSessionWorkspace(github, projectId, userId, sessionId) {
 	if (typeof sessionId !== "string") return;
 	const session = await github.sourceControlStorage.sessions.getBySessionId(sessionId);
-	if (session?.projectRepositoryId !== projectId || session.userId !== userId || !session.sandboxId || !session.sandboxWorkdir) return;
+	if (session?.projectRepositoryId !== projectId || session.userId !== userId) return;
+	const entry = peekSessionSandbox(session.id);
+	if (!entry?.workdir) return void 0;
 	return {
 		session,
-		workdir: session.sandboxWorkdir,
-		sandboxBinding: {
-			id: session.id,
-			projectRepositoryId: session.projectRepositoryId,
-			userId: session.userId,
-			sandboxId: session.sandboxId,
-			sandboxWorkdir: session.sandboxWorkdir,
-			materializedAt: session.materializedAt,
-			createdAt: session.createdAt
-		}
+		workdir: entry.workdir,
+		sandbox: requireExec(entry.sandbox)
 	};
 }
 //#endregion