@mastra/factory 0.2.2-alpha.0 → 0.2.2-alpha.2

package/dist/workspace.js

@@ -1,449 +1,247 @@
-// src/workspace.ts
+import { getFactoryAuthUserId } from "./auth.js";
+import { getGithubPat } from "./integrations/github/pat.js";
+import { registerGithubPatKind, registerGithubTokenInjector } from "./integrations/github/token-refresh.js";
+import { checkoutSessionBranch, materializeRepo, runWorktreeSetup } from "./integrations/github/sandbox.js";
+import { getFactorySessionAddress } from "./rules/binding-context.js";
+import path, { dirname, join } from "path";
+import { LocalSandbox, LocalSkillSource, Workspace } from "@mastra/core/workspace";
+import { DEFAULT_CONFIG_DIR } from "@mastra/code-sdk/constants";
+import { SandboxFilesystem } from "@mastra/code-sdk/agents/sandbox-filesystem";
 import { existsSync } from "fs";
-import path2, { dirname, join } from "path";
 import { fileURLToPath } from "url";
-import { SandboxFilesystem } from "@mastra/code-sdk/agents/sandbox-filesystem";
 import { MASTRACODE_WORKSPACE_TOOLS } from "@mastra/code-sdk/agents/tool-availability";
 import { getDynamicWorkspace } from "@mastra/code-sdk/agents/workspace";
-import { DEFAULT_CONFIG_DIR } from "@mastra/code-sdk/constants";
-import { LocalSandbox, LocalSkillSource, Workspace } from "@mastra/core/workspace";
-
-// src/auth.ts
-import { MastraAuthWorkos } from "@mastra/auth-workos";
-import {
-  registerApiRoute,
-  isAuthHttpHandler,
-  isCredentialsProvider,
-  isOrganizationsProvider,
-  isSessionProvider,
-  isSSOProvider
-} from "@mastra/core/server";
-function getFactoryAuthUserId(user) {
-  return user?.workosId ?? user?.id;
-}
-function getFactoryAuthOrgId(user) {
-  return user?.organizationId;
-}
-
-// src/integrations/github/pat.ts
-var PAT_SETTINGS_USER_ID = "__github_org_settings__";
-function asToken(value) {
-  return typeof value === "string" && value.length > 0 ? value : null;
-}
-async function getGithubPat(getStorage, orgId, kind = "default") {
-  try {
-    const settings = await getStorage().settings.get(orgId, PAT_SETTINGS_USER_ID);
-    if (!settings) return null;
-    if (kind === "reviewer") return asToken(settings.reviewerPat) ?? asToken(settings.pat);
-    return asToken(settings.pat);
-  } catch {
-    return null;
-  }
-}
-
-// src/integrations/github/sandbox.ts
-import { createHash } from "crypto";
-
-// src/sandbox/fleet.ts
-import path from "path";
-function reportProgress(onProgress, event) {
-  if (!onProgress) return;
-  try {
-    onProgress(event);
-  } catch {
-  }
-}
-
-// src/integrations/github/sandbox.ts
-function shellQuote(value) {
-  return `'` + value.split(`'`).join(`'\\''`) + `'`;
-}
-async function sh(sandbox, script) {
-  return sandbox.executeCommand("sh", ["-c", script]);
-}
-var MaterializeError = class extends Error {
-  constructor(message, code) {
-    super(message);
-    this.code = code;
-    this.name = "MaterializeError";
-  }
-  code;
-};
-function tokenUrl(repoFullName, token) {
-  return `https://x-access-token:${token}@github.com/${repoFullName}.git`;
-}
-function cleanUrl(repoFullName) {
-  return `https://github.com/${repoFullName}.git`;
-}
-async function materializeRepo(options) {
-  const { row: sandboxRow, repoInfo, sandbox, token, storage, onProgress } = options;
-  const workdir = sandboxRow.sandboxWorkdir;
-  const repo = repoInfo.repoFullName;
-  if (!/^[\w.-]+\/[\w.-]+$/.test(repo)) {
-    throw new MaterializeError(`Refusing to materialize: invalid repo full name '${repo}'.`, "clone-failed");
-  }
-  if (!/^[A-Za-z0-9_./-]+$/.test(repoInfo.defaultBranch)) {
-    throw new MaterializeError(
-      `Refusing to materialize: invalid default branch '${repoInfo.defaultBranch}'.`,
-      "clone-failed"
-    );
-  }
-  const gitVersion = await sh(sandbox, "git --version");
-  if (gitVersion.exitCode !== 0) {
-    throw new MaterializeError(
-      "git is not installed in the sandbox. The sandbox template must include git.",
-      "git-missing"
-    );
-  }
-  const authUrl = tokenUrl(repo, token);
-  const alreadyMaterialized = Boolean(sandboxRow.materializedAt) || await hasExistingCheckout(sandbox, workdir, repo);
-  try {
-    if (!alreadyMaterialized) {
-      reportProgress(onProgress, {
-        phase: "cloning",
-        message: `Cloning ${repo} (first open can take a minute)\u2026`
-      });
-      const clone = await sh(
-        sandbox,
-        `git clone --depth=1 --single-branch --branch ${shellQuote(repoInfo.defaultBranch)} ${shellQuote(authUrl)} ${shellQuote(workdir)}`
-      );
-      if (clone.exitCode !== 0) {
-        throw classifyGitFailure(clone, "clone-failed");
-      }
-    } else {
-      reportProgress(onProgress, { phase: "pulling", message: `Updating ${repo} to the latest changes\u2026` });
-      const setUrl = await sh(sandbox, `git -C ${shellQuote(workdir)} remote set-url origin ${shellQuote(authUrl)}`);
-      if (setUrl.exitCode !== 0) {
-        throw new MaterializeError(`Failed to set git remote: ${setUrl.stderr}`, "pull-failed");
-      }
-      const pull = await sh(sandbox, `git -C ${shellQuote(workdir)} pull --ff-only`);
-      if (pull.exitCode !== 0) {
-        throw classifyGitFailure(pull, "pull-failed");
-      }
-    }
-  } finally {
-    await scrubRemote(sandbox, workdir, repo, alreadyMaterialized);
-  }
-  reportProgress(onProgress, { phase: "finalizing", message: "Finalizing workspace\u2026" });
-  await storage.markMaterialized({ id: sandboxRow.id });
-}
-async function checkoutSessionBranch(sandbox, workdir, {
-  branch,
-  baseBranch,
-  token,
-  repoFullName
-}) {
-  if (!isValidGitRef(branch) || !isValidGitRef(baseBranch)) {
-    throw new MaterializeError("Refusing to create a session from an invalid branch name.", "clone-failed");
-  }
-  const current = await sh(sandbox, `git -C ${shellQuote(workdir)} branch --show-current`);
-  if (current.exitCode === 0 && current.stdout.trim() === branch) return;
-  const local = await sh(
-    sandbox,
-    `git -C ${shellQuote(workdir)} show-ref --verify --quiet refs/heads/${shellQuote(branch)}`
-  );
-  if (local.exitCode === 0) {
-    const checkout = await sh(sandbox, `git -C ${shellQuote(workdir)} checkout ${shellQuote(branch)}`);
-    if (checkout.exitCode !== 0) throw classifyGitFailure(checkout, "clone-failed");
-    return;
-  }
-  const authUrl = tokenUrl(repoFullName, token);
-  try {
-    const setUrl = await sh(sandbox, `git -C ${shellQuote(workdir)} remote set-url origin ${shellQuote(authUrl)}`);
-    if (setUrl.exitCode !== 0) throw classifyGitFailure(setUrl, "pull-failed");
-    const fetch = await sh(
-      sandbox,
-      `git -C ${shellQuote(workdir)} fetch origin ${shellQuote(baseBranch)} && git -C ${shellQuote(workdir)} checkout -b ${shellQuote(branch)} FETCH_HEAD`
-    );
-    if (fetch.exitCode !== 0) throw classifyGitFailure(fetch, "clone-failed");
-  } finally {
-    await sh(sandbox, `git -C ${shellQuote(workdir)} remote set-url origin ${shellQuote(cleanUrl(repoFullName))}`);
-  }
-}
-async function hasExistingCheckout(sandbox, workdir, repoFullName) {
-  const result = await sh(sandbox, `git -C ${shellQuote(workdir)} remote get-url origin`);
-  if (result.exitCode !== 0) return false;
-  const url = result.stdout.trim().toLowerCase();
-  const suffix = `github.com/${repoFullName.toLowerCase()}`;
-  return url.endsWith(`${suffix}.git`) || url.endsWith(suffix);
-}
-async function scrubRemote(sandbox, workdir, repoFullName, expectGitDir) {
-  const result = await sh(
-    sandbox,
-    `git -C ${shellQuote(workdir)} remote set-url origin ${shellQuote(cleanUrl(repoFullName))}`
-  );
-  if (result.exitCode !== 0 && expectGitDir) {
-    throw new MaterializeError(
-      `Failed to scrub installation token from git remote: ${result.stderr.trim() || result.stdout.trim()}`,
-      "pull-failed"
-    );
-  }
-}
-function classifyGitFailure(result, fallback) {
-  const stderr = result.stderr || "";
-  if (/could not resolve host|failed to connect|network is unreachable|Connection timed out/i.test(stderr)) {
-    return new MaterializeError(
-      "The sandbox could not reach github.com. The sandbox network must allow outbound egress to github.com.",
-      "egress-blocked"
-    );
-  }
-  const verb = fallback === "clone-failed" ? "clone" : fallback === "pull-failed" ? "pull" : "push";
-  return new MaterializeError(`git ${verb} failed: ${stderr}`, fallback);
-}
-function isValidGitRef(value) {
-  return typeof value === "string" && value.length > 0 && value.length <= 255 && // Reject leading-dash refs (e.g. `--mirror`) so the value can never be
-  // parsed as a git option when interpolated into a command.
-  !value.startsWith("-") && /^[A-Za-z0-9_./-]+$/.test(value);
-}
-var WorktreeError = class extends Error {
-  constructor(message, code) {
-    super(message);
-    this.code = code;
-    this.name = "WorktreeError";
-  }
-  code;
-};
-async function runWorktreeSetup(sandbox, worktreePath, command) {
-  const result = await sh(sandbox, `cd ${shellQuote(worktreePath)} && { ${command}
-}`);
-  if (result.exitCode !== 0) {
-    const detail = (result.stderr.trim() || result.stdout.trim()).slice(-2e3);
-    throw new WorktreeError(`Setup command failed (exit ${result.exitCode}): ${detail}`, "setup-failed");
-  }
-}
-
-// src/integrations/github/token-refresh.ts
-var GITHUB_TOKEN_INJECTOR_CONTEXT_KEY = "factoryGithubTokenInjector";
-var GITHUB_PAT_KIND_CONTEXT_KEY = "factoryGithubPatKind";
-function registerGithubTokenInjector(requestContext, injector) {
-  requestContext.set(GITHUB_TOKEN_INJECTOR_CONTEXT_KEY, injector);
-}
-function registerGithubPatKind(requestContext, kind) {
-  requestContext.set(GITHUB_PAT_KIND_CONTEXT_KEY, kind);
-}
-
-// src/rules/binding-context.ts
-function getFactorySessionCoordinates(requestContext) {
-  if (!requestContext || typeof requestContext.get !== "function") return null;
-  const context = requestContext.get("controller");
-  const factoryProjectId = context?.getState().factoryProjectId;
-  if (!context?.threadId || !context.resourceId || !factoryProjectId) return null;
-  return {
-    factoryProjectId,
-    threadId: context.threadId,
-    resourceId: context.resourceId,
-    sessionId: context.resourceId
-  };
-}
-function getFactorySessionAddress(requestContext) {
-  const coordinates = getFactorySessionCoordinates(requestContext);
-  if (!coordinates || !requestContext || typeof requestContext.get !== "function") return null;
-  const user = requestContext.get("user");
-  const orgId = getFactoryAuthOrgId(user);
-  if (!orgId) return null;
-  return { orgId, ...coordinates };
-}
-
-// src/workspace.ts
-var WORKSPACE_ID_PREFIX = "mfw";
-var SESSION_CHECKPOINT_PREFIX = "mastracode-session";
+//#region src/workspace.ts
+const WORKSPACE_ID_PREFIX = "mfw";
+const SESSION_CHECKPOINT_PREFIX = "mastracode-session";
 function checkpointNameForSession(sessionId) {
-  return `${SESSION_CHECKPOINT_PREFIX}-${sessionId}`;
-}
-var bundleDirectory = dirname(fileURLToPath(import.meta.url));
-var bundledFactorySkillsPath = join(bundleDirectory, "factory-skills");
-var FACTORY_SKILLS_SOURCE_PATH = [
-  // Deploy bundle: the consumer copies `factory-skills/` next to the built
-  // server module (e.g. via its public/ dir).
-  bundledFactorySkillsPath,
-  // Package layout: `dist/../factory-skills` (also `src/../factory-skills`
-  // when running tests against sources).
-  join(bundleDirectory, "..", "factory-skills"),
-  // Consumer repo running from its package root before a build.
-  join(process.cwd(), "src", "mastra", "public", "factory-skills")
+	return `${SESSION_CHECKPOINT_PREFIX}-${sessionId}`;
+}
+const bundleDirectory = dirname(fileURLToPath(import.meta.url));
+const bundledFactorySkillsPath = join(bundleDirectory, "factory-skills");
+const FACTORY_SKILLS_SOURCE_PATH = [
+	bundledFactorySkillsPath,
+	join(bundleDirectory, "..", "factory-skills"),
+	join(process.cwd(), "src", "mastra", "public", "factory-skills")
 ].find(existsSync) ?? bundledFactorySkillsPath;
-var FACTORY_SKILLS_MOUNT = path2.resolve(path2.parse(process.cwd()).root, "__mastracode_factory_skills__");
-var FACTORY_SKILL_NAMES = /* @__PURE__ */ new Set(["configure-factory-rules", "factory-plan", "factory-review", "factory-triage"]);
+const FACTORY_SKILLS_MOUNT = path.resolve(path.parse(process.cwd()).root, "__mastracode_factory_skills__");
+const FACTORY_SKILL_NAMES = /* @__PURE__ */ new Set([
+	"configure-factory-rules",
+	"factory-plan",
+	"factory-review",
+	"factory-triage"
+]);
 var FactorySkillSource = class {
-  constructor(fallback, fallbackSkillRoots) {
-    this.fallback = fallback;
-    this.#fallbackSkillRoots = new Set(fallbackSkillRoots.map((skillPath) => path2.normalize(skillPath)));
-  }
-  fallback;
-  #factorySource = new LocalSkillSource({ basePath: FACTORY_SKILLS_SOURCE_PATH });
-  #fallbackSkillRoots;
-  #isFactoryPath(skillPath) {
-    const normalized = path2.normalize(skillPath);
-    return normalized === FACTORY_SKILLS_MOUNT || normalized.startsWith(`${FACTORY_SKILLS_MOUNT}${path2.sep}`);
-  }
-  #factoryPath(skillPath) {
-    return path2.relative(FACTORY_SKILLS_MOUNT, path2.normalize(skillPath));
-  }
-  exists(skillPath) {
-    return this.#isFactoryPath(skillPath) ? this.#factorySource.exists(this.#factoryPath(skillPath)) : this.fallback.exists(skillPath);
-  }
-  stat(skillPath) {
-    return this.#isFactoryPath(skillPath) ? this.#factorySource.stat(this.#factoryPath(skillPath)) : this.fallback.stat(skillPath);
-  }
-  readFile(skillPath) {
-    return this.#isFactoryPath(skillPath) ? this.#factorySource.readFile(this.#factoryPath(skillPath)) : this.fallback.readFile(skillPath);
-  }
-  async readdir(skillPath) {
-    if (this.#isFactoryPath(skillPath)) {
-      return this.#factorySource.readdir(this.#factoryPath(skillPath));
-    }
-    const entries = await this.fallback.readdir(skillPath);
-    if (this.#fallbackSkillRoots.has(path2.normalize(skillPath))) {
-      return entries.filter((entry) => !FACTORY_SKILL_NAMES.has(entry.name));
-    }
-    return entries;
-  }
-  realpath(skillPath) {
-    if (this.#isFactoryPath(skillPath)) return Promise.resolve(path2.normalize(skillPath));
-    return this.fallback.realpath ? this.fallback.realpath(skillPath) : Promise.resolve(skillPath);
-  }
+	fallback;
+	#factorySource = new LocalSkillSource({ basePath: FACTORY_SKILLS_SOURCE_PATH });
+	#fallbackSkillRoots;
+	constructor(fallback, fallbackSkillRoots) {
+		this.fallback = fallback;
+		this.#fallbackSkillRoots = new Set(fallbackSkillRoots.map((skillPath) => path.normalize(skillPath)));
+	}
+	#isFactoryPath(skillPath) {
+		const normalized = path.normalize(skillPath);
+		return normalized === FACTORY_SKILLS_MOUNT || normalized.startsWith(`${FACTORY_SKILLS_MOUNT}${path.sep}`);
+	}
+	#factoryPath(skillPath) {
+		return path.relative(FACTORY_SKILLS_MOUNT, path.normalize(skillPath));
+	}
+	exists(skillPath) {
+		return this.#isFactoryPath(skillPath) ? this.#factorySource.exists(this.#factoryPath(skillPath)) : this.fallback.exists(skillPath);
+	}
+	stat(skillPath) {
+		return this.#isFactoryPath(skillPath) ? this.#factorySource.stat(this.#factoryPath(skillPath)) : this.fallback.stat(skillPath);
+	}
+	readFile(skillPath) {
+		return this.#isFactoryPath(skillPath) ? this.#factorySource.readFile(this.#factoryPath(skillPath)) : this.fallback.readFile(skillPath);
+	}
+	async readdir(skillPath) {
+		if (this.#isFactoryPath(skillPath)) return this.#factorySource.readdir(this.#factoryPath(skillPath));
+		const entries = await this.fallback.readdir(skillPath);
+		if (this.#fallbackSkillRoots.has(path.normalize(skillPath))) return entries.filter((entry) => !FACTORY_SKILL_NAMES.has(entry.name));
+		return entries;
+	}
+	realpath(skillPath) {
+		if (this.#isFactoryPath(skillPath)) return Promise.resolve(path.normalize(skillPath));
+		return this.fallback.realpath ? this.fallback.realpath(skillPath) : Promise.resolve(skillPath);
+	}
 };
-var factorySkillExtension = {
-  id: "web-factory",
-  paths: [FACTORY_SKILLS_MOUNT],
-  createSource: (fallback, fallbackSkillRoots) => new FactorySkillSource(fallback, fallbackSkillRoots)
+const factorySkillExtension = {
+	id: "web-factory",
+	paths: [FACTORY_SKILLS_MOUNT],
+	createSource: (fallback, fallbackSkillRoots) => new FactorySkillSource(fallback, fallbackSkillRoots)
 };
 function createWorkspaceFactory(options = {}) {
-  const { sandbox: sandboxConfig, github, fleet, workItems } = options;
-  const isLocalSandbox = sandboxConfig?.machine instanceof LocalSandbox;
-  const githubTokenInjectors = /* @__PURE__ */ new Map();
-  return async ({ requestContext, mastra, skillExtension }) => {
-    const effectiveSkillExtension = skillExtension ?? factorySkillExtension;
-    const ctx = requestContext.get("controller");
-    const session = ctx?.resourceId && github ? await github.sourceControlStorage.sessions.getBySessionId(ctx.resourceId) : null;
-    if (!session) {
-      if (sandboxConfig && !isLocalSandbox) {
-        throw new Error("A Factory session ID is required to create a remote sandbox workspace");
-      }
-      return getDynamicWorkspace({ requestContext, mastra, skillExtension: effectiveSkillExtension });
-    }
-    const user = requestContext.get("user");
-    const userId = getFactoryAuthUserId(user);
-    if (!user?.organizationId || !userId || user.organizationId !== session.orgId || userId !== session.userId) {
-      throw new Error(`Factory session ${session.sessionId} is not available to the current user`);
-    }
-    if (!sandboxConfig || !github || !fleet) {
-      throw new Error("GitHub and sandbox providers are required to create a Factory session workspace");
-    }
-    const storage = github.sourceControlStorage;
-    const projectRepository = await storage.projectRepositories.get({
-      orgId: session.orgId,
-      id: session.projectRepositoryId
-    });
-    if (!projectRepository) throw new Error(`Repository link ${session.projectRepositoryId} was not found`);
-    const connection = await storage.connections.get({ orgId: session.orgId, id: projectRepository.connectionId });
-    const repository = await storage.repositories.get({ orgId: session.orgId, id: projectRepository.repositoryId });
-    if (!connection || !repository) throw new Error(`Repository link ${session.projectRepositoryId} is incomplete`);
-    const installation = await storage.installations.get({ orgId: session.orgId, id: connection.installationId });
-    if (!installation) throw new Error(`GitHub installation ${connection.installationId} was not found`);
-    const repoFullName = repository.slug;
-    const workdir = isLocalSandbox ? fleet.computeLocalSessionWorkdir(repoFullName, session.id) : session.sandboxWorkdir ?? projectRepository.sandboxWorkdir;
-    const binding = {
-      sandboxId: session.sandboxId,
-      checkpointName: checkpointNameForSession(session.id),
-      setSandboxId: async (id) => {
-        await storage.sessions.setSandbox({ id: session.id, sandboxId: id, sandboxWorkdir: workdir });
-        session.sandboxId = id;
-        session.sandboxWorkdir = workdir;
-      },
-      clear: async () => {
-        await storage.sessions.setSandbox({ id: session.id, sandboxId: null, sandboxWorkdir: workdir });
-        session.sandboxId = null;
-      }
-    };
-    const extensionId = effectiveSkillExtension ? `-${effectiveSkillExtension.id}` : "";
-    const workspaceId = `${WORKSPACE_ID_PREFIX}-${projectRepository.id}-${session.id}${extensionId}`;
-    const configDir = sandboxConfig.workdir ?? DEFAULT_CONFIG_DIR;
-    try {
-      const existing = mastra?.getWorkspaceById(workspaceId);
-      if (existing) {
-        existing.setToolsConfig(MASTRACODE_WORKSPACE_TOOLS);
-        const registered = githubTokenInjectors.get(workspaceId);
-        if (registered) {
-          registerGithubTokenInjector(requestContext, registered.inject);
-          registerGithubPatKind(requestContext, registered.patKind);
-          try {
-            const pat = await getGithubPat(() => github.integrationStorage, session.orgId, registered.patKind);
-            if (pat && pat !== registered.ghToken) {
-              registered.inject(pat);
-            }
-          } catch {
-          }
-        }
-        return existing;
-      }
-    } catch {
-    }
-    const access = await github.versionControl.getRepositoryAccess({
-      orgId: session.orgId,
-      repositoryId: repository.id
-    });
-    const token = access.authorization?.token;
-    if (!token) throw new Error("Repository access did not include a bearer token for the Factory session");
-    let patKind = "default";
-    if (workItems) {
-      try {
-        const address = getFactorySessionAddress(requestContext);
-        const runBinding = address ? await workItems.findRunBindingBySession(address) : null;
-        if (runBinding?.role === "review" && runBinding.orgId === session.orgId) patKind = "reviewer";
-      } catch {
-      }
-    }
-    const ghCliToken = await getGithubPat(() => github.integrationStorage, session.orgId, patKind) ?? token;
-    const sandbox = await fleet.ensureSandbox(
-      binding,
-      { GH_TOKEN: ghCliToken },
-      void 0,
-      isLocalSandbox ? { workingDirectory: workdir } : {}
-    );
-    await materializeRepo({
-      row: { id: session.id, sandboxWorkdir: workdir, materializedAt: session.materializedAt },
-      repoInfo: { repoFullName, defaultBranch: repository.defaultBranch },
-      sandbox,
-      token,
-      storage: storage.sessions
-    });
-    await checkoutSessionBranch(sandbox, workdir, {
-      branch: session.branch,
-      baseBranch: session.baseBranch || projectRepository.branch || repository.defaultBranch,
-      token,
-      repoFullName
-    });
-    if (projectRepository.setupCommand) await runWorktreeSetup(sandbox, workdir, projectRepository.setupCommand);
-    const injectGithubToken = (freshToken) => {
-      if (!sandbox.setEnvironmentVariable) {
-        throw new Error("The active sandbox provider does not support runtime GitHub token refresh.");
-      }
-      sandbox.setEnvironmentVariable("GH_TOKEN", freshToken);
-      const registered = githubTokenInjectors.get(workspaceId);
-      if (registered) registered.ghToken = freshToken;
-    };
-    githubTokenInjectors.set(workspaceId, { inject: injectGithubToken, patKind, ghToken: ghCliToken });
-    registerGithubTokenInjector(requestContext, injectGithubToken);
-    registerGithubPatKind(requestContext, patKind);
-    const filesystem = new SandboxFilesystem({ sandbox, workdir });
-    const projectSkillPaths = [path2.join(configDir, "skills"), ".claude/skills", ".agents/skills"];
-    const skillPaths = [...effectiveSkillExtension?.paths ?? [], ...projectSkillPaths];
-    return new Workspace({
-      id: workspaceId,
-      name: "Mastra Code Factory Session Workspace",
-      filesystem,
-      sandbox,
-      tools: MASTRACODE_WORKSPACE_TOOLS,
-      skills: skillPaths,
-      skillSource: effectiveSkillExtension?.createSource(filesystem, projectSkillPaths) ?? filesystem
-    });
-  };
-}
-var getFactoryWorkspace = createWorkspaceFactory();
-export {
-  checkpointNameForSession,
-  createWorkspaceFactory,
-  getFactoryWorkspace
-};
+	const { sandbox: sandboxConfig, github, fleet, workItems } = options;
+	const isLocalSandbox = sandboxConfig?.machine instanceof LocalSandbox;
+	const githubTokenInjectors = /* @__PURE__ */ new Map();
+	const inflightMaterializations = /* @__PURE__ */ new Map();
+	return async ({ requestContext, mastra, skillExtension }) => {
+		const effectiveSkillExtension = skillExtension ?? factorySkillExtension;
+		const ctx = requestContext.get("controller");
+		const session = ctx?.resourceId && github ? await github.sourceControlStorage.sessions.getBySessionId(ctx.resourceId) : null;
+		if (!session) {
+			if (sandboxConfig && !isLocalSandbox) throw new Error("A Factory session ID is required to create a remote sandbox workspace");
+			return getDynamicWorkspace({
+				requestContext,
+				mastra,
+				skillExtension: effectiveSkillExtension
+			});
+		}
+		const user = requestContext.get("user");
+		const userId = getFactoryAuthUserId(user);
+		if (!user?.organizationId || !userId || user.organizationId !== session.orgId || userId !== session.userId) throw new Error(`Factory session ${session.sessionId} is not available to the current user`);
+		if (!sandboxConfig || !github || !fleet) throw new Error("GitHub and sandbox providers are required to create a Factory session workspace");
+		const storage = github.sourceControlStorage;
+		const projectRepository = await storage.projectRepositories.get({
+			orgId: session.orgId,
+			id: session.projectRepositoryId
+		});
+		if (!projectRepository) throw new Error(`Repository link ${session.projectRepositoryId} was not found`);
+		const connection = await storage.connections.get({
+			orgId: session.orgId,
+			id: projectRepository.connectionId
+		});
+		const repository = await storage.repositories.get({
+			orgId: session.orgId,
+			id: projectRepository.repositoryId
+		});
+		if (!connection || !repository) throw new Error(`Repository link ${session.projectRepositoryId} is incomplete`);
+		if (!await storage.installations.get({
+			orgId: session.orgId,
+			id: connection.installationId
+		})) throw new Error(`GitHub installation ${connection.installationId} was not found`);
+		const repoFullName = repository.slug;
+		const workdir = isLocalSandbox ? fleet.computeLocalSessionWorkdir(repoFullName, session.id) : session.sandboxWorkdir ?? projectRepository.sandboxWorkdir;
+		const binding = {
+			sandboxId: session.sandboxId,
+			checkpointName: checkpointNameForSession(session.id),
+			setSandboxId: async (id) => {
+				await storage.sessions.setSandbox({
+					id: session.id,
+					sandboxId: id,
+					sandboxWorkdir: workdir
+				});
+				session.sandboxId = id;
+				session.sandboxWorkdir = workdir;
+			},
+			clear: async () => {
+				await storage.sessions.setSandbox({
+					id: session.id,
+					sandboxId: null,
+					sandboxWorkdir: workdir
+				});
+				session.sandboxId = null;
+			}
+		};
+		const extensionId = effectiveSkillExtension ? `-${effectiveSkillExtension.id}` : "";
+		const workspaceId = `${WORKSPACE_ID_PREFIX}-${projectRepository.id}-${session.id}${extensionId}`;
+		const configDir = sandboxConfig.workdir ?? DEFAULT_CONFIG_DIR;
+		try {
+			const existing = mastra?.getWorkspaceById(workspaceId);
+			if (existing) {
+				existing.setToolsConfig(MASTRACODE_WORKSPACE_TOOLS);
+				const registered = githubTokenInjectors.get(workspaceId);
+				if (registered) {
+					registerGithubTokenInjector(requestContext, registered.inject);
+					registerGithubPatKind(requestContext, registered.patKind);
+					try {
+						const pat = await getGithubPat(() => github.integrationStorage, session.orgId, registered.patKind);
+						if (pat && pat !== registered.ghToken) registered.inject(pat);
+					} catch {}
+				}
+				return existing;
+			}
+		} catch {}
+		const materialize = async () => {
+			const token = (await github.versionControl.getRepositoryAccess({
+				orgId: session.orgId,
+				repositoryId: repository.id
+			})).authorization?.token;
+			if (!token) throw new Error("Repository access did not include a bearer token for the Factory session");
+			let patKind = "default";
+			if (workItems) try {
+				const address = getFactorySessionAddress(requestContext);
+				const runBinding = address ? await workItems.findRunBindingBySession(address) : null;
+				if (runBinding?.role === "review" && runBinding.orgId === session.orgId) patKind = "reviewer";
+			} catch {}
+			const ghCliToken = await getGithubPat(() => github.integrationStorage, session.orgId, patKind) ?? token;
+			const sandbox = await fleet.ensureSandbox(binding, { GH_TOKEN: ghCliToken }, void 0, isLocalSandbox ? { workingDirectory: workdir } : {});
+			await materializeRepo({
+				row: {
+					id: session.id,
+					sandboxWorkdir: workdir,
+					materializedAt: session.materializedAt
+				},
+				repoInfo: {
+					repoFullName,
+					defaultBranch: repository.defaultBranch
+				},
+				sandbox,
+				token,
+				storage: storage.sessions
+			});
+			await checkoutSessionBranch(sandbox, workdir, {
+				branch: session.branch,
+				baseBranch: session.baseBranch || projectRepository.branch || repository.defaultBranch,
+				token,
+				repoFullName
+			});
+			if (projectRepository.setupCommand) await runWorktreeSetup(sandbox, workdir, projectRepository.setupCommand);
+			const injectGithubToken = (freshToken) => {
+				if (!sandbox.setEnvironmentVariable) throw new Error("The active sandbox provider does not support runtime GitHub token refresh.");
+				sandbox.setEnvironmentVariable("GH_TOKEN", freshToken);
+				const registered = githubTokenInjectors.get(workspaceId);
+				if (registered) registered.ghToken = freshToken;
+			};
+			githubTokenInjectors.set(workspaceId, {
+				inject: injectGithubToken,
+				patKind,
+				ghToken: ghCliToken
+			});
+			registerGithubTokenInjector(requestContext, injectGithubToken);
+			registerGithubPatKind(requestContext, patKind);
+			const filesystem = new SandboxFilesystem({
+				sandbox,
+				workdir
+			});
+			const projectSkillPaths = [
+				path.join(configDir, "skills"),
+				".claude/skills",
+				".agents/skills"
+			];
+			const skillPaths = [...effectiveSkillExtension?.paths ?? [], ...projectSkillPaths];
+			return new Workspace({
+				id: workspaceId,
+				name: "Mastra Code Factory Session Workspace",
+				filesystem,
+				sandbox,
+				tools: MASTRACODE_WORKSPACE_TOOLS,
+				skills: skillPaths,
+				skillSource: effectiveSkillExtension?.createSource(filesystem, projectSkillPaths) ?? filesystem
+			});
+		};
+		const inflight = inflightMaterializations.get(workspaceId);
+		if (inflight) {
+			const workspace = await inflight;
+			const registered = githubTokenInjectors.get(workspaceId);
+			if (registered) {
+				registerGithubTokenInjector(requestContext, registered.inject);
+				registerGithubPatKind(requestContext, registered.patKind);
+			}
+			return workspace;
+		}
+		const materialization = materialize();
+		inflightMaterializations.set(workspaceId, materialization);
+		try {
+			return await materialization;
+		} finally {
+			inflightMaterializations.delete(workspaceId);
+		}
+	};
+}
+const getFactoryWorkspace = createWorkspaceFactory();
+//#endregion
+export { checkpointNameForSession, createWorkspaceFactory, getFactoryWorkspace };
+
 //# sourceMappingURL=workspace.js.map