@mastra/factory 0.2.2-alpha.0 → 0.2.2-alpha.1

package/dist/factory.js

@@ -24558,6 +24558,31 @@ import {
   isSessionProvider,
   isSSOProvider
 } from "@mastra/core/server";
+
+// src/timing.ts
+async function timedPhase(phase, fn) {
+  const start = performance.now();
+  try {
+    return await fn();
+  } finally {
+    process.stderr.write(`[factory:timing] ${phase} ${Math.round(performance.now() - start)}ms
+`);
+  }
+}
+async function timedAboveThreshold(phase, thresholdMs, fn) {
+  const start = performance.now();
+  try {
+    return await fn();
+  } finally {
+    const elapsed = performance.now() - start;
+    if (elapsed > thresholdMs) {
+      process.stderr.write(`[factory:timing] slow ${phase} ${Math.round(elapsed)}ms
+`);
+    }
+  }
+}
+
+// src/auth.ts
 function sanitizeReturnTo(raw) {
   if (!raw) return "/";
   if (!raw.startsWith("/")) return "/";
@@ -24846,11 +24871,15 @@ function createFactoryAuthGate(provider) {
     if (c.req.method === "POST" && path3 === "/web/github/webhook") {
       return next();
     }
-    if (path3 === "/signin" || path3.startsWith("/assets/")) {
+    if (path3 === "/signin" || path3.startsWith("/assets/") || path3 === "/manifest.webmanifest" || path3 === "/mastra.svg") {
       return next();
     }
     const token = getBearerToken(c.req.header("Authorization"));
-    const user = await authenticateRequest(provider, token, c.req.raw);
+    const user = await timedAboveThreshold(
+      "auth.gate.authenticate",
+      1e3,
+      () => authenticateRequest(provider, token, c.req.raw)
+    );
     if (user) {
       await ensureUserOrg(provider, user);
       c.set(FACTORY_AUTH_USER_KEY, user);
@@ -25532,8 +25561,23 @@ async function teardownProjectSandbox(options) {
 function shellQuote(value) {
   return `'` + value.split(`'`).join(`'\\''`) + `'`;
 }
-async function sh(sandbox, script) {
-  return sandbox.executeCommand("sh", ["-c", script]);
+var DEFAULT_COMMAND_TIMEOUT_MS = 15 * 6e4;
+var CHECKOUT_COMMAND_TIMEOUT_MS = 5 * 6e4;
+async function sh(sandbox, script, options = {}) {
+  const timeoutMs = options.timeoutMs ?? DEFAULT_COMMAND_TIMEOUT_MS;
+  let timer;
+  const hangGuard = new Promise((_, reject) => {
+    timer = setTimeout(() => {
+      const phase = options.phase ? ` during ${options.phase}` : "";
+      reject(new Error(`Sandbox command timed out after ${Math.round(timeoutMs / 1e3)}s${phase}.`));
+    }, timeoutMs);
+    timer.unref?.();
+  });
+  try {
+    return await Promise.race([sandbox.executeCommand("sh", ["-c", script], { timeout: timeoutMs }), hangGuard]);
+  } finally {
+    clearTimeout(timer);
+  }
 }
 var MaterializeError = class extends Error {
   constructor(message, code) {
@@ -25570,7 +25614,8 @@ async function materializeRepo(options) {
     );
   }
   const authUrl = tokenUrl(repo, token);
-  const alreadyMaterialized = Boolean(sandboxRow.materializedAt) || await hasExistingCheckout(sandbox, workdir, repo);
+  const alreadyMaterialized = await hasExistingCheckout(sandbox, workdir, repo);
+  let succeeded = false;
   try {
     if (!alreadyMaterialized) {
       reportProgress(onProgress, {
@@ -25579,7 +25624,8 @@ async function materializeRepo(options) {
       });
       const clone = await sh(
         sandbox,
-        `git clone --depth=1 --single-branch --branch ${shellQuote(repoInfo.defaultBranch)} ${shellQuote(authUrl)} ${shellQuote(workdir)}`
+        `git clone --depth=1 --single-branch --branch ${shellQuote(repoInfo.defaultBranch)} ${shellQuote(authUrl)} ${shellQuote(workdir)}`,
+        { phase: "repository clone" }
       );
       if (clone.exitCode !== 0) {
         throw classifyGitFailure(clone, "clone-failed");
@@ -25590,13 +25636,14 @@ async function materializeRepo(options) {
       if (setUrl.exitCode !== 0) {
         throw new MaterializeError(`Failed to set git remote: ${setUrl.stderr}`, "pull-failed");
       }
-      const pull = await sh(sandbox, `git -C ${shellQuote(workdir)} pull --ff-only`);
+      const pull = await sh(sandbox, `git -C ${shellQuote(workdir)} pull --ff-only`, { phase: "repository pull" });
       if (pull.exitCode !== 0) {
         throw classifyGitFailure(pull, "pull-failed");
       }
     }
+    succeeded = true;
   } finally {
-    await scrubRemote(sandbox, workdir, repo, alreadyMaterialized);
+    await scrubRemote(sandbox, workdir, repo, succeeded);
   }
   reportProgress(onProgress, { phase: "finalizing", message: "Finalizing workspace\u2026" });
   await storage.markMaterialized({ id: sandboxRow.id });
@@ -25627,7 +25674,8 @@ async function checkoutSessionBranch(sandbox, workdir, {
     if (setUrl.exitCode !== 0) throw classifyGitFailure(setUrl, "pull-failed");
     const fetch2 = await sh(
       sandbox,
-      `git -C ${shellQuote(workdir)} fetch origin ${shellQuote(baseBranch)} && git -C ${shellQuote(workdir)} checkout -b ${shellQuote(branch)} FETCH_HEAD`
+      `git -C ${shellQuote(workdir)} fetch origin ${shellQuote(baseBranch)} && git -C ${shellQuote(workdir)} checkout -b ${shellQuote(branch)} FETCH_HEAD`,
+      { timeoutMs: CHECKOUT_COMMAND_TIMEOUT_MS, phase: "branch checkout" }
     );
     if (fetch2.exitCode !== 0) throw classifyGitFailure(fetch2, "clone-failed");
   } finally {
@@ -25751,7 +25799,7 @@ function computeWorktreePath(repoWorkdir, branch) {
 }
 async function runWorktreeSetup(sandbox, worktreePath, command) {
   const result = await sh(sandbox, `cd ${shellQuote(worktreePath)} && { ${command}
-}`);
+}`, { phase: "worktree setup" });
   if (result.exitCode !== 0) {
     const detail = (result.stderr.trim() || result.stdout.trim()).slice(-2e3);
     throw new WorktreeError(`Setup command failed (exit ${result.exitCode}): ${detail}`, "setup-failed");
@@ -26484,43 +26532,56 @@ function buildGithubRoutes(options) {
       handler: async (c) => {
         const resolved = await resolveOrgTenant(loose(c), auth);
         if ("response" in resolved) return resolved.response;
-        const installs = await github.sourceControlStorage.installations.list({ orgId: resolved.tenant.orgId });
+        const orgId = resolved.tenant.orgId;
+        const installs = await github.sourceControlStorage.installations.list({ orgId });
         const query = (c.req.query("q") ?? "").toLowerCase();
-        const repos = [];
+        const listed = await Promise.all(
+          installs.map(async (inst) => {
+            try {
+              return { inst, list: await github.listInstallationRepos(Number(inst.externalId)) };
+            } catch (err) {
+              if (err.status !== 404) throw err;
+              console.error(`[Mastra Factory] pruning stale GitHub installation ${inst.externalId} (404 from GitHub)`);
+              await github.sourceControlStorage.installations.delete({ orgId, id: inst.id });
+              return { inst, list: [] };
+            }
+          })
+        );
+        const matches = [];
         const seenRepositoryIds = /* @__PURE__ */ new Set();
-        for (const inst of installs) {
-          let list;
-          try {
-            list = await github.listInstallationRepos(Number(inst.externalId));
-          } catch (err) {
-            if (err.status !== 404) throw err;
-            console.error(`[Mastra Factory] pruning stale GitHub installation ${inst.externalId} (404 from GitHub)`);
-            await github.sourceControlStorage.installations.delete({ orgId: resolved.tenant.orgId, id: inst.id });
-            continue;
-          }
+        for (const { inst, list } of listed) {
           for (const repo of list) {
             if (query && !repo.fullName.toLowerCase().includes(query)) continue;
             if (seenRepositoryIds.has(repo.id)) continue;
             seenRepositoryIds.add(repo.id);
-            const repository = await github.sourceControlStorage.repositories.upsert({
-              orgId: resolved.tenant.orgId,
-              input: {
-                installationId: inst.id,
-                externalId: repo.id.toString(),
-                slug: repo.fullName,
-                defaultBranch: isValidGitRef2(repo.defaultBranch) ? repo.defaultBranch : "main",
-                providerMetadata: { private: repo.private, owner: repo.owner }
-              }
-            });
-            repos.push({
-              ...repo,
-              installationStorageId: inst.id,
-              repositoryStorageId: repository.id,
-              sandboxProvider: fleet.provider,
-              sandboxWorkdir: fleet.computeWorkdir(repo.fullName)
-            });
+            matches.push({ inst, repo });
           }
         }
+        const repos = new Array(matches.length);
+        const upsertConcurrency = 10;
+        for (let start = 0; start < matches.length; start += upsertConcurrency) {
+          await Promise.all(
+            matches.slice(start, start + upsertConcurrency).map(async ({ inst, repo }, offset) => {
+              const repository = await github.sourceControlStorage.repositories.upsert({
+                orgId,
+                input: {
+                  installationId: inst.id,
+                  externalId: repo.id.toString(),
+                  slug: repo.fullName,
+                  defaultBranch: isValidGitRef2(repo.defaultBranch) ? repo.defaultBranch : "main",
+                  providerMetadata: { private: repo.private, owner: repo.owner }
+                }
+              });
+              repos[start + offset] = {
+                ...repo,
+                installationStorageId: inst.id,
+                repositoryStorageId: repository.id,
+                sandboxProvider: fleet.provider,
+                sandboxWorkdir: fleet.computeWorkdir(repo.fullName)
+              };
+            })
+          );
+        }
         return c.json({ repos });
       }
     })
@@ -26851,8 +26912,25 @@ async function loadOrCreateSandboxRow(github, project, userId) {
   return github.sourceControlStorage.sandboxes.getOrCreate({ projectRepository: project, userId });
 }
 async function prepareProject(options) {
-  const { github, fleet, project, userId, onProgress } = options;
-  const sandboxRow = await loadOrCreateSandboxRow(github, project, userId);
+  const { github, fleet, userId, onProgress } = options;
+  let project = options.project;
+  if (project.sandboxProvider !== fleet.provider) {
+    const sandboxWorkdir = fleet.computeWorkdir(project.repository.slug);
+    await github.sourceControlStorage.projectRepositories.update({
+      orgId: project.installation.orgId,
+      id: project.id,
+      input: { sandboxProvider: fleet.provider, sandboxWorkdir }
+    });
+    project = { ...project, sandboxProvider: fleet.provider, sandboxWorkdir };
+  }
+  let sandboxRow = await loadOrCreateSandboxRow(github, project, userId);
+  if (sandboxRow.sandboxWorkdir !== project.sandboxWorkdir) {
+    await github.sourceControlStorage.sandboxes.setWorkdir({
+      id: sandboxRow.id,
+      sandboxWorkdir: project.sandboxWorkdir
+    });
+    sandboxRow = { ...sandboxRow, sandboxWorkdir: project.sandboxWorkdir, materializedAt: null };
+  }
   const access = await github.versionControl.getRepositoryAccess({
     orgId: project.installation.orgId,
     repositoryId: project.repository.id
@@ -28326,6 +28404,17 @@ function retryDelay(error, fallbackMs) {
 // src/integrations/platform/github/integration.ts
 var PAGE_SIZE = 30;
 var API_PREFIX2 = "/v1/server";
+var INSTALLATION_REPOS_CACHE_TTL_MS = 3e4;
+var REPOSITORY_ACCESS_CACHE_TTL_MS = 5 * 6e4;
+var MAX_CACHE_ENTRIES = 1e3;
+function setBounded(cache, key, value) {
+  cache.delete(key);
+  cache.set(key, value);
+  if (cache.size > MAX_CACHE_ENTRIES) {
+    const oldest = cache.keys().next().value;
+    if (oldest !== void 0) cache.delete(oldest);
+  }
+}
 var REPOSITORY_TOKEN_PERMISSIONS = {
   contents: "write",
   issues: "write",
@@ -28345,6 +28434,10 @@ var PlatformGithubIntegration = class {
   #pollingIntervalMs;
   #storage;
   #integrationStorage;
+  /** installationId → cached repository listing (TTL-bounded). */
+  #installationReposCache = /* @__PURE__ */ new Map();
+  /** `orgId:repositoryId` → cached repository access (TTL-bounded). */
+  #repositoryAccessCache = /* @__PURE__ */ new Map();
   intake = {
     resolveIntakeDispatch: (input) => this.#resolveIntakeDispatch(input),
     listSources: async ({ orgId, userId }) => {
@@ -28475,6 +28568,10 @@ var PlatformGithubIntegration = class {
       )
     ),
     getRepositoryAccess: async ({ orgId, repositoryId }) => {
+      const cacheKey = `${orgId}:${repositoryId}`;
+      const cached = this.#repositoryAccessCache.get(cacheKey);
+      if (cached && cached.expiresAt > Date.now()) return cached.access;
+      this.#repositoryAccessCache.delete(cacheKey);
       const repository = await this.storage.repositories.get({ orgId, id: repositoryId });
       if (!repository) throw new Error("Version-control repository not found.");
       const cloneUrl = `https://github.com/${repository.slug}.git`;
@@ -28488,10 +28585,15 @@ var PlatformGithubIntegration = class {
         `${API_PREFIX2}/github-app/installations/${installationId}/token`,
         { repositories: [repositoryName], permissions: REPOSITORY_TOKEN_PERMISSIONS }
       );
-      return {
+      const access = {
         cloneUrl,
         authorization: { scheme: "bearer", token: token.token }
       };
+      setBounded(this.#repositoryAccessCache, cacheKey, {
+        access,
+        expiresAt: Date.now() + REPOSITORY_ACCESS_CACHE_TTL_MS
+      });
+      return access;
     },
     listPullRequests: (input) => this.#listPullRequests(input),
     getPullRequest: (input) => this.#getPullRequest(input),
@@ -28786,8 +28888,16 @@ var PlatformGithubIntegration = class {
     }
   }
   async listInstallationRepos(installationId) {
+    const cached = this.#installationReposCache.get(installationId);
+    if (cached && cached.expiresAt > Date.now()) return cached.repos;
+    this.#installationReposCache.delete(installationId);
     const result = await this.#client.request("GET", `${API_PREFIX2}/github-app/installations/${installationId}/repositories`);
-    return result.repositories.map((repository) => ({ ...repository, installationId }));
+    const repos = result.repositories.map((repository) => ({ ...repository, installationId }));
+    setBounded(this.#installationReposCache, installationId, {
+      repos,
+      expiresAt: Date.now() + INSTALLATION_REPOS_CACHE_TTL_MS
+    });
+    return repos;
   }
   async mintInstallationToken(installationId) {
     const repositories = await this.listInstallationRepos(installationId);
@@ -31922,7 +32032,7 @@ var ConfigRoutes = class extends Route {
             const record = await context.storage.get({ orgId: context.orgId, userId: context.userId });
             if (!resourceId) return c.json({ config: readStoredOMConfig(record) });
             const session = await controller.getSessionByResource?.(resourceId, scope);
-            if (!session) return c.json({ error: `No session for resourceId "${resourceId}"` }, 404);
+            if (!session) return c.json({ config: readStoredOMConfig(record) });
             await hydrateSessionMemorySettings(session, record);
             return c.json({ config: readOMConfig(session) });
           } catch (error) {
@@ -31956,7 +32066,6 @@ var ConfigRoutes = class extends Route {
           if ("response" in context) return context.response;
           try {
             const session = resourceId ? await controller.getSessionByResource?.(resourceId, scope) : void 0;
-            if (resourceId && !session) return c.json({ error: `No session for resourceId "${resourceId}"` }, 404);
             const otherRole = session ? role === "observer" ? session.om.reflector : session.om.observer : void 0;
             const otherRoleCurrentModelId = otherRole?.modelId() ?? null;
             await session?.om[role].switchModel({ modelId });
@@ -31998,7 +32107,6 @@ var ConfigRoutes = class extends Route {
           if ("response" in context) return context.response;
           try {
             const session = resourceId ? await controller.getSessionByResource?.(resourceId, scope) : void 0;
-            if (resourceId && !session) return c.json({ error: `No session for resourceId "${resourceId}"` }, 404);
             if (observation !== void 0 && session) {
               await session.state.set({ observationThreshold: observation });
               await session.thread.setSetting({ key: "observationThreshold", value: observation });
@@ -32043,7 +32151,6 @@ var ConfigRoutes = class extends Route {
           if ("response" in context) return context.response;
           try {
             const session = resourceId ? await controller.getSessionByResource?.(resourceId, scope) : void 0;
-            if (resourceId && !session) return c.json({ error: `No session for resourceId "${resourceId}"` }, 404);
             if (session) {
               await session.state.set({ observeAttachments: value });
               await session.thread.setSetting({ key: "observeAttachments", value });
@@ -33827,7 +33934,8 @@ var FACTORY_GOVERNANCE_SCHEMAS = [
         name: "factory_deferred_decisions_tenant_key_unique",
         columns: ["org_id", "factory_project_id", "idempotency_key"]
       }
-    ]
+    ],
+    indexes: [{ name: "factory_deferred_decisions_claim_idx", columns: ["status", "created_at"] }]
   },
   {
     name: "factory_run_bindings",
@@ -33844,7 +33952,17 @@ var FACTORY_GOVERNANCE_SCHEMAS = [
       status: { type: "text" },
       created_at: { type: "timestamp" },
       revoked_at: { type: "timestamp", nullable: true }
-    }
+    },
+    indexes: [
+      // Exact-address lookups run on every processor message; status filter is
+      // applied on top of the address columns.
+      {
+        name: "factory_run_bindings_session_idx",
+        columns: ["factory_project_id", "thread_id", "resource_id", "session_id"]
+      },
+      // Restart reconciler enumerates active bindings across all tenants.
+      { name: "factory_run_bindings_status_idx", columns: ["status"] }
+    ]
   },
   {
     name: "factory_tool_result_cursors",
@@ -33881,7 +33999,8 @@ var FACTORY_GOVERNANCE_SCHEMAS = [
         name: "factory_pending_starts_tenant_kickoff_unique",
         columns: ["org_id", "factory_project_id", "kickoff_key"]
       }
-    ]
+    ],
+    indexes: [{ name: "factory_pending_starts_claim_idx", columns: ["status", "created_at"] }]
   }
 ];
 function toBinding(row) {
@@ -33962,7 +34081,11 @@ var WorkItemsStorage = class extends FactoryStorageDomain3 {
   }
   async #claimLeases(table, input, map) {
     const claim = () => this.storage.withTransaction(async (ops) => {
-      const candidates = await ops.findMany(table, {}, { orderBy: [["created_at", "asc"]] });
+      const candidates = await ops.findMany(
+        table,
+        { status: { in: ["pending", "retry", "leased"] } },
+        { orderBy: [["created_at", "asc"]], limit: Math.max(input.limit * 5, 50) }
+      );
       const claimed = [];
       for (const candidate of candidates) {
         if (claimed.length >= input.limit) break;
@@ -36448,6 +36571,12 @@ var FactoryDecisionDispatcher = class {
             (candidate) => candidate.id === record.bindingId && candidate.status === "active"
           );
           if (!binding) throw new Error("Prepared Factory binding is unavailable or revoked.");
+          const item = await this.#storage.get({ orgId: record.orgId, id: binding.workItemId });
+          const startedBy = item?.sessions[binding.role]?.startedBy;
+          if (!startedBy) throw new Error(`Factory binding ${binding.id} has no authenticated session owner.`);
+          await this.#primeCredentials?.({ orgId: record.orgId, userId: startedBy });
+          const requestContext = new RequestContext2();
+          requestContext.set("user", { workosId: startedBy, organizationId: record.orgId });
           const session = await this.#requireSession(binding);
           await awaitNotification(
             await session.sendNotificationSignal(
@@ -36460,7 +36589,7 @@ var FactoryDecisionDispatcher = class {
                 sourceId: record.id,
                 dedupeKey: `factory-kickoff:${record.kickoffKey}`
               },
-              { ifActive: { behavior: "deliver" }, ifIdle: { behavior: "wake" } }
+              { ifActive: { behavior: "deliver" }, ifIdle: { behavior: "wake" }, requestContext }
             ),
             true
           );
@@ -36941,6 +37070,7 @@ var MIME = {
   ".mjs": "text/javascript; charset=utf-8",
   ".css": "text/css; charset=utf-8",
   ".json": "application/json",
+  ".webmanifest": "application/manifest+json",
   ".map": "application/json",
   ".svg": "image/svg+xml",
   ".png": "image/png",
@@ -38714,6 +38844,10 @@ var SourceControlStorage = class extends FactoryStorageDomain11 {
           }
         },
         getById: ({ id }) => getSandbox(id),
+        setWorkdir: async ({ id, sandboxWorkdir }) => {
+          await requireSandbox(id);
+          await db().updateMany(SANDBOXES, { id }, { sandbox_workdir: sandboxWorkdir, materialized_at: null });
+        },
         setSandboxId: async ({ id, sandboxId }) => {
           await requireSandbox(id);
           await db().updateMany(SANDBOXES, { id }, { sandbox_id: sandboxId });
@@ -38924,6 +39058,7 @@ function createWorkspaceFactory(options = {}) {
   const { sandbox: sandboxConfig, github, fleet, workItems } = options;
   const isLocalSandbox = sandboxConfig?.machine instanceof LocalSandbox;
   const githubTokenInjectors = /* @__PURE__ */ new Map();
+  const inflightMaterializations = /* @__PURE__ */ new Map();
   return async ({ requestContext, mastra, skillExtension }) => {
     const effectiveSkillExtension = skillExtension ?? factorySkillExtension;
     const ctx = requestContext.get("controller");
@@ -38991,65 +39126,84 @@ function createWorkspaceFactory(options = {}) {
       }
     } catch {
     }
-    const access = await github.versionControl.getRepositoryAccess({
-      orgId: session.orgId,
-      repositoryId: repository.id
-    });
-    const token = access.authorization?.token;
-    if (!token) throw new Error("Repository access did not include a bearer token for the Factory session");
-    let patKind = "default";
-    if (workItems) {
-      try {
-        const address = getFactorySessionAddress(requestContext);
-        const runBinding = address ? await workItems.findRunBindingBySession(address) : null;
-        if (runBinding?.role === "review" && runBinding.orgId === session.orgId) patKind = "reviewer";
-      } catch {
-      }
-    }
-    const ghCliToken = await getGithubPat(() => github.integrationStorage, session.orgId, patKind) ?? token;
-    const sandbox = await fleet.ensureSandbox(
-      binding,
-      { GH_TOKEN: ghCliToken },
-      void 0,
-      isLocalSandbox ? { workingDirectory: workdir } : {}
-    );
-    await materializeRepo({
-      row: { id: session.id, sandboxWorkdir: workdir, materializedAt: session.materializedAt },
-      repoInfo: { repoFullName, defaultBranch: repository.defaultBranch },
-      sandbox,
-      token,
-      storage: storage.sessions
-    });
-    await checkoutSessionBranch(sandbox, workdir, {
-      branch: session.branch,
-      baseBranch: session.baseBranch || projectRepository.branch || repository.defaultBranch,
-      token,
-      repoFullName
-    });
-    if (projectRepository.setupCommand) await runWorktreeSetup(sandbox, workdir, projectRepository.setupCommand);
-    const injectGithubToken2 = (freshToken) => {
-      if (!sandbox.setEnvironmentVariable) {
-        throw new Error("The active sandbox provider does not support runtime GitHub token refresh.");
+    const materialize = async () => {
+      const access = await github.versionControl.getRepositoryAccess({
+        orgId: session.orgId,
+        repositoryId: repository.id
+      });
+      const token = access.authorization?.token;
+      if (!token) throw new Error("Repository access did not include a bearer token for the Factory session");
+      let patKind = "default";
+      if (workItems) {
+        try {
+          const address = getFactorySessionAddress(requestContext);
+          const runBinding = address ? await workItems.findRunBindingBySession(address) : null;
+          if (runBinding?.role === "review" && runBinding.orgId === session.orgId) patKind = "reviewer";
+        } catch {
+        }
       }
-      sandbox.setEnvironmentVariable("GH_TOKEN", freshToken);
-      const registered = githubTokenInjectors.get(workspaceId);
-      if (registered) registered.ghToken = freshToken;
+      const ghCliToken = await getGithubPat(() => github.integrationStorage, session.orgId, patKind) ?? token;
+      const sandbox = await fleet.ensureSandbox(
+        binding,
+        { GH_TOKEN: ghCliToken },
+        void 0,
+        isLocalSandbox ? { workingDirectory: workdir } : {}
+      );
+      await materializeRepo({
+        row: { id: session.id, sandboxWorkdir: workdir, materializedAt: session.materializedAt },
+        repoInfo: { repoFullName, defaultBranch: repository.defaultBranch },
+        sandbox,
+        token,
+        storage: storage.sessions
+      });
+      await checkoutSessionBranch(sandbox, workdir, {
+        branch: session.branch,
+        baseBranch: session.baseBranch || projectRepository.branch || repository.defaultBranch,
+        token,
+        repoFullName
+      });
+      if (projectRepository.setupCommand) await runWorktreeSetup(sandbox, workdir, projectRepository.setupCommand);
+      const injectGithubToken2 = (freshToken) => {
+        if (!sandbox.setEnvironmentVariable) {
+          throw new Error("The active sandbox provider does not support runtime GitHub token refresh.");
+        }
+        sandbox.setEnvironmentVariable("GH_TOKEN", freshToken);
+        const registered = githubTokenInjectors.get(workspaceId);
+        if (registered) registered.ghToken = freshToken;
+      };
+      githubTokenInjectors.set(workspaceId, { inject: injectGithubToken2, patKind, ghToken: ghCliToken });
+      registerGithubTokenInjector(requestContext, injectGithubToken2);
+      registerGithubPatKind(requestContext, patKind);
+      const filesystem = new SandboxFilesystem2({ sandbox, workdir });
+      const projectSkillPaths = [path2.join(configDir, "skills"), ".claude/skills", ".agents/skills"];
+      const skillPaths = [...effectiveSkillExtension?.paths ?? [], ...projectSkillPaths];
+      return new Workspace({
+        id: workspaceId,
+        name: "Mastra Code Factory Session Workspace",
+        filesystem,
+        sandbox,
+        tools: MASTRACODE_WORKSPACE_TOOLS,
+        skills: skillPaths,
+        skillSource: effectiveSkillExtension?.createSource(filesystem, projectSkillPaths) ?? filesystem
+      });
     };
-    githubTokenInjectors.set(workspaceId, { inject: injectGithubToken2, patKind, ghToken: ghCliToken });
-    registerGithubTokenInjector(requestContext, injectGithubToken2);
-    registerGithubPatKind(requestContext, patKind);
-    const filesystem = new SandboxFilesystem2({ sandbox, workdir });
-    const projectSkillPaths = [path2.join(configDir, "skills"), ".claude/skills", ".agents/skills"];
-    const skillPaths = [...effectiveSkillExtension?.paths ?? [], ...projectSkillPaths];
-    return new Workspace({
-      id: workspaceId,
-      name: "Mastra Code Factory Session Workspace",
-      filesystem,
-      sandbox,
-      tools: MASTRACODE_WORKSPACE_TOOLS,
-      skills: skillPaths,
-      skillSource: effectiveSkillExtension?.createSource(filesystem, projectSkillPaths) ?? filesystem
-    });
+    const inflight = inflightMaterializations.get(workspaceId);
+    if (inflight) {
+      const workspace = await inflight;
+      const registered = githubTokenInjectors.get(workspaceId);
+      if (registered) {
+        registerGithubTokenInjector(requestContext, registered.inject);
+        registerGithubPatKind(requestContext, registered.patKind);
+      }
+      return workspace;
+    }
+    const materialization = materialize();
+    inflightMaterializations.set(workspaceId, materialization);
+    try {
+      return await materialization;
+    } finally {
+      inflightMaterializations.delete(workspaceId);
+    }
   };
 }
 var getFactoryWorkspace = createWorkspaceFactory();
@@ -39194,9 +39348,12 @@ var MastraFactory = class {
     registerSandboxReattach(fleet);
     const stateSigner = createStateSigner(this.#config.stateSecret);
     if (auth && hasAuthInit(auth)) {
-      await auth.init({ database: storage.authDatabase?.(), publicUrl: publicOrigin, allowedOrigins });
+      await timedPhase(
+        "prepare.auth.init",
+        () => auth.init({ database: storage.authDatabase?.(), publicUrl: publicOrigin, allowedOrigins })
+      );
     }
-    await storage.init();
+    await timedPhase("prepare.storage.init", () => storage.init());
     if (auth) {
       registerTenantCredentialResolver(modelCredentialsStorage);
     }
@@ -39264,153 +39421,160 @@ var MastraFactory = class {
     const toolIntegrations = integrationRegistrations.filter(
       ({ integration }) => integration.agentTools || integration.sessionTools
     );
-    const prepared = await prepareAgentControllerMount({
-      controllerId: CONTROLLER_ID,
-      workspace: createWorkspaceFactory({
-        ...this.#config.sandbox ? { sandbox: this.#config.sandbox } : {},
-        ...githubIntegration ? { github: githubIntegration } : {},
-        ...workItemsStorage ? { workItems: workItemsStorage } : {},
-        fleet
-      }),
-      disableGithubSignals: true,
-      // Memory settings live in the factory's `memory-settings` app table (per
-      // org/user), so the host machine's TUI settings.json must not seed them.
-      disableSettingsOmSeed: true,
-      storage: storage.getMastraStorage(),
-      ...mastraStorageBackend ? { storageBackend: mastraStorageBackend } : {},
-      ...factoryProcessor ? { inputProcessors: [factoryProcessor] } : {},
-      ...vector ? { vector } : {},
-      ...toolIntegrations.length > 0 || workItemsStorage && transitionService ? {
-        extraTools: async ({ requestContext }) => {
-          const tools = {};
-          const toolOwners = /* @__PURE__ */ new Map();
-          const mergeTools = (ownerId, contributed) => {
-            for (const [name, tool] of Object.entries(contributed)) {
-              const owner = toolOwners.get(name);
-              if (owner) {
-                throw new Error(
-                  `MastraFactory: integration tool '${name}' from '${ownerId}' conflicts with '${owner}'.`
-                );
+    const prepared = await timedPhase(
+      "prepare.controllerMount",
+      () => prepareAgentControllerMount({
+        controllerId: CONTROLLER_ID,
+        workspace: createWorkspaceFactory({
+          ...this.#config.sandbox ? { sandbox: this.#config.sandbox } : {},
+          ...githubIntegration ? { github: githubIntegration } : {},
+          ...workItemsStorage ? { workItems: workItemsStorage } : {},
+          fleet
+        }),
+        disableGithubSignals: true,
+        // Memory settings live in the factory's `memory-settings` app table (per
+        // org/user), so the host machine's TUI settings.json must not seed them.
+        disableSettingsOmSeed: true,
+        storage: storage.getMastraStorage(),
+        ...mastraStorageBackend ? { storageBackend: mastraStorageBackend } : {},
+        ...factoryProcessor ? { inputProcessors: [factoryProcessor] } : {},
+        ...vector ? { vector } : {},
+        ...toolIntegrations.length > 0 || workItemsStorage && transitionService ? {
+          extraTools: async ({ requestContext }) => {
+            const tools = {};
+            const toolOwners = /* @__PURE__ */ new Map();
+            const mergeTools = (ownerId, contributed) => {
+              for (const [name, tool] of Object.entries(contributed)) {
+                const owner = toolOwners.get(name);
+                if (owner) {
+                  throw new Error(
+                    `MastraFactory: integration tool '${name}' from '${ownerId}' conflicts with '${owner}'.`
+                  );
+                }
+                toolOwners.set(name, ownerId);
+                tools[name] = tool;
               }
-              toolOwners.set(name, ownerId);
-              tools[name] = tool;
+            };
+            if (workItemsStorage && transitionService) {
+              mergeTools(
+                "factory",
+                await createFactoryTransitionTools({
+                  requestContext,
+                  storage: workItemsStorage,
+                  transitionService
+                })
+              );
             }
-          };
-          if (workItemsStorage && transitionService) {
-            mergeTools(
-              "factory",
-              await createFactoryTransitionTools({ requestContext, storage: workItemsStorage, transitionService })
-            );
-          }
-          for (const { integration, ready, ensureReady } of toolIntegrations) {
-            if (!ready && ensureReady) {
-              try {
-                await ensureReady();
-              } catch {
-                continue;
+            for (const { integration, ready, ensureReady } of toolIntegrations) {
+              if (!ready && ensureReady) {
+                try {
+                  await ensureReady();
+                } catch {
+                  continue;
+                }
+              }
+              if (integration.agentTools) {
+                mergeTools(integration.id, await integration.agentTools({ requestContext }));
+              }
+              if (integration.sessionTools) {
+                mergeTools(integration.id, integration.sessionTools({ requestContext }));
               }
             }
-            if (integration.agentTools) {
-              mergeTools(integration.id, await integration.agentTools({ requestContext }));
-            }
-            if (integration.sessionTools) {
-              mergeTools(integration.id, integration.sessionTools({ requestContext }));
-            }
+            return tools;
+          }
+        } : {},
+        postToolObserver: async (toolContext) => {
+          const requestContext = toolContext.context?.requestContext;
+          if (requestContext) {
+            await observeAgentGitAction({
+              audit: auditDomain,
+              toolContext: { ...toolContext, context: requestContext }
+            });
           }
-          return tools;
-        }
-      } : {},
-      postToolObserver: async (toolContext) => {
-        const requestContext = toolContext.context?.requestContext;
-        if (requestContext) {
-          await observeAgentGitAction({
+          await Promise.all(
+            integrations.map(async (integration) => {
+              if (!integration.postToolObserver) return;
+              try {
+                await integration.postToolObserver({ toolContext, requestContext });
+              } catch (error) {
+                console.warn(`[factory] Integration '${integration.id}' post-tool observer failed:`, error);
+              }
+            })
+          );
+        },
+        ...pubsub ? { pubsub, crossProcessPubSub: true } : {},
+        buildApiRoutes: ({ controller, authStorage }) => [
+          // Public `/auth/*` routes (login/callback/logout/me). Folded in as
+          // `apiRoutes` (not plain Hono routes) because the entry can't touch the
+          // Hono app the deployer generates. `requiresAuth: false`; the gate
+          // skips `/auth/*`.
+          ...auth ? buildAuthRoutes(auth, { publicUrl: publicOrigin }) : [],
+          // Custom `/web/*` routes (fs / config / integrations / factory / audit).
+          ...assembleFactoryApiRoutes({
+            controllerId: CONTROLLER_ID,
+            controller,
+            auth: routeAuth,
+            authStorage,
             audit: auditDomain,
-            toolContext: { ...toolContext, context: requestContext }
-          });
-        }
-        await Promise.all(
-          integrations.map(async (integration) => {
-            if (!integration.postToolObserver) return;
-            try {
-              await integration.postToolObserver({ toolContext, requestContext });
-            } catch (error) {
-              console.warn(`[factory] Integration '${integration.id}' post-tool observer failed:`, error);
+            publicOrigin,
+            stateSigner,
+            fleet,
+            factoryStorage: storage,
+            integrationStorage,
+            sourceControlStorage,
+            domains,
+            integrations: integrationRegistrations,
+            intakeReady,
+            factoryReady,
+            rules,
+            factoryTransitionService: transitionService,
+            onFactoryRuntime: ({ transitionService: runtimeTransitionService, prepareBinding }) => {
+              this.#dispatcher ??= new FactoryDecisionDispatcher({
+                controller,
+                transitionService: runtimeTransitionService,
+                storage: storage.getDomain("work-items"),
+                reconcileToolResults: () => factoryProcessor?.reconcileAllBoundThreads() ?? Promise.resolve(),
+                prepareBinding,
+                primeCredentials: (tenant) => primeTenantCredentials({ tenant, credentials: modelCredentialsStorage })
+              });
             }
-          })
-        );
-      },
-      ...pubsub ? { pubsub, crossProcessPubSub: true } : {},
-      buildApiRoutes: ({ controller, authStorage }) => [
-        // Public `/auth/*` routes (login/callback/logout/me). Folded in as
-        // `apiRoutes` (not plain Hono routes) because the entry can't touch the
-        // Hono app the deployer generates. `requiresAuth: false`; the gate
-        // skips `/auth/*`.
-        ...auth ? buildAuthRoutes(auth, { publicUrl: publicOrigin }) : [],
-        // Custom `/web/*` routes (fs / config / integrations / factory / audit).
-        ...assembleFactoryApiRoutes({
-          controllerId: CONTROLLER_ID,
-          controller,
-          auth: routeAuth,
-          authStorage,
-          audit: auditDomain,
-          publicOrigin,
-          stateSigner,
-          fleet,
-          factoryStorage: storage,
-          integrationStorage,
-          sourceControlStorage,
-          domains,
-          integrations: integrationRegistrations,
-          intakeReady,
-          factoryReady,
-          rules,
-          factoryTransitionService: transitionService,
-          onFactoryRuntime: ({ transitionService: runtimeTransitionService, prepareBinding }) => {
-            this.#dispatcher ??= new FactoryDecisionDispatcher({
-              controller,
-              transitionService: runtimeTransitionService,
-              storage: storage.getDomain("work-items"),
-              reconcileToolResults: () => factoryProcessor?.reconcileAllBoundThreads() ?? Promise.resolve(),
-              prepareBinding,
-              primeCredentials: (tenant) => primeTenantCredentials({ tenant, credentials: modelCredentialsStorage })
-            });
+          }),
+          ...projectRoutes.routes(),
+          ...auditDomain.routes()
+        ],
+        buildServerConfig: () => {
+          const cors = allowedOrigins.length ? { cors: { origin: allowedOrigins, credentials: true } } : {};
+          const onError = { onError: handleServerError };
+          const uiDist = resolveUiDistDir();
+          const spa = uiDist ? [createSpaStaticMiddleware(uiDist)] : [];
+          if (!auth) {
+            return {
+              middleware: [
+                createCustomProvidersPrimer({ auth: routeAuth, storage: customProvidersStorage, authEnabled: false }),
+                ...spa
+              ],
+              ...cors,
+              ...onError
+            };
           }
-        }),
-        ...projectRoutes.routes(),
-        ...auditDomain.routes()
-      ],
-      buildServerConfig: () => {
-        const cors = allowedOrigins.length ? { cors: { origin: allowedOrigins, credentials: true } } : {};
-        const onError = { onError: handleServerError };
-        const uiDist = resolveUiDistDir();
-        const spa = uiDist ? [createSpaStaticMiddleware(uiDist)] : [];
-        if (!auth) {
           return {
+            auth,
             middleware: [
-              createCustomProvidersPrimer({ auth: routeAuth, storage: customProvidersStorage, authEnabled: false }),
+              createFactoryAuthGate(auth),
+              createTenantCredentialPrimer({ auth: routeAuth, credentials: modelCredentialsStorage }),
+              createCustomProvidersPrimer({
+                auth: routeAuth,
+                storage: customProvidersStorage,
+                authEnabled: Boolean(auth)
+              }),
               ...spa
             ],
             ...cors,
             ...onError
           };
         }
-        return {
-          auth,
-          middleware: [
-            createFactoryAuthGate(auth),
-            createTenantCredentialPrimer({ auth: routeAuth, credentials: modelCredentialsStorage }),
-            createCustomProvidersPrimer({
-              auth: routeAuth,
-              storage: customProvidersStorage,
-              authEnabled: Boolean(auth)
-            }),
-            ...spa
-          ],
-          ...cors,
-          ...onError
-        };
-      }
-    });
+      })
+    );
     this.#prepared = prepared;
     this.#factoryProcessor = factoryProcessor;
     const integrationWorkers = integrationRegistrations.filter(({ integration, ready }) => ready && integration.workers).flatMap(
@@ -39451,8 +39615,11 @@ var MastraFactory = class {
     if (!this.#prepared) {
       throw new Error("MastraFactory.finalize() called before prepare()");
     }
-    await this.#prepared.finalize();
-    await this.#factoryProcessor?.reconcileAllBoundThreads();
+    await timedPhase("finalize.controller", () => this.#prepared.finalize());
+    await timedPhase(
+      "finalize.reconcileBoundThreads",
+      () => this.#factoryProcessor?.reconcileAllBoundThreads() ?? Promise.resolve()
+    );
     this.#dispatcher?.start();
   }
   /** Stop Factory-owned background dispatch before the host process shuts down. */