@mastra/factory 0.24.0-alpha.1 → 0.24.0-alpha.10

package/dist/factory.js

@@ -1,7 +1,7 @@
-import { timedPhase } from "./timing.js";
-import { buildAuthDisabledRoutes, buildAuthRoutes, createFactoryAuthGate, createFactoryRouteAuth, factoryUserOrgId, getFactoryAuthOrgId, getFactoryAuthUserFromContext, getFactoryAuthUserId } from "./auth.js";
+import { createRequestTimingMiddleware, factoryTimingEnabled, instrumentAsyncMethods, timedPhase } from "./timing.js";
+import { buildAuthDisabledRoutes, buildAuthRoutes, createFactoryAuthGate, createFactoryInteractiveMarker, createFactoryRouteAuth, factoryUserOrgId, getFactoryAuthOrgId, getFactoryAuthUserFromContext, getFactoryAuthUserId } from "./auth.js";
 import { assertFactoryConfigVersion } from "./rules/validation.js";
-import { isTerminalWorkItem } from "./boards/semantics.js";
+import { boardForWorkItem, isTerminalWorkItem } from "./boards/semantics.js";
 import { createBoardRegistry } from "./boards/registry.js";
 import "./boards/index.js";
 import { isValidGitRef } from "./sandbox/git-ref.js";
@@ -21,32 +21,41 @@ import { PlatformApiClient, platformApiClientConfigFromEnv } from "./integration
 import { buildPlatformConnectRoutes } from "./integrations/platform/connect/routes.js";
 import { observeSessionFirstExec } from "./session/first-exec-capture.js";
 import { observeSessionFilesystem } from "./session/filesystem-capture.js";
+import { sessionMemoryResourceId, sessionStampCounts } from "./session/session-threads.js";
 import { createPlaintextFactorySecretEncryption } from "./secret-encryption.js";
 import { ModelCredentialsStorage } from "./storage/domains/credentials/base.js";
 import { createTenantCredentialPrimer, primeTenantCredentials, registerTenantCredentialResolver } from "./routes/tenant-credentials.js";
-import { prepareSessionRunContext } from "./integrations/subscription-session.js";
+import { hasResolvedOrg } from "./session/org-seed.js";
+import { createSessionAsRowOwner, prepareSessionRunContext } from "./integrations/subscription-session.js";
 import { PlatformGithubIntegration } from "./integrations/platform/github/integration.js";
 import { PlatformGitLabIntegration } from "./integrations/platform/gitlab/integration.js";
 import { PlatformIncidentioIntegration } from "./integrations/platform/incidentio/integration.js";
 import { PlatformJiraIntegration } from "./integrations/platform/jira/integration.js";
 import { PlatformLinearIntegration } from "./integrations/platform/linear/integration.js";
 import { FactoryProjectsStorage } from "./storage/domains/projects/base.js";
+import { SourceControlStorage } from "./storage/domains/source-control/base.js";
+import { createSourceControlSessionLookup } from "./session/factory-session.js";
+import { AuditStorage } from "./storage/domains/audit/base.js";
+import { resolveFactoryToolScope } from "./tools/scope.js";
+import { deliverFactorySessionNotification } from "./tools/deliver.js";
+import { createSessionApprovalNotifier, createSessionRunEndReporter, createStageChangeNotifier, createWorkItemRunEndReporter } from "./tools/reports.js";
 import { resolveFactoryCredentialTenant } from "./session/credential-policy.js";
 import { hydrateSessionMemorySettings, layerPersonalMemorySettings } from "./session/memory-settings-hydration.js";
 import { MemorySettingsStorage, factoryMemorySettingsUserId } from "./storage/domains/memory-settings/base.js";
 import { resolveDeploymentModelProviders } from "./routes/config.js";
-import { createCustomProvidersPrimer, registerCustomProvidersSource } from "./routes/custom-provider-source.js";
+import { observeSessionRunEnd } from "./session/run-audit.js";
+import { observeSessionRunReports } from "./tools/run-watch.js";
+import { applyFactoryToolPermissions } from "./tools/permissions.js";
+import { createFactoryTools } from "./tools/index.js";
+import { buildFactoryMcpRoutes, resolveMcpAuthorizationServers } from "./mcp/routes.js";
+import { createCustomProvidersPrimer, primeCustomProvidersForRequestContext, registerCustomProvidersSource } from "./routes/custom-provider-source.js";
 import { ProjectRoutes } from "./routes/projects.js";
-import { SourceControlStorage } from "./storage/domains/source-control/base.js";
-import { createSourceControlSessionLookup } from "./session/factory-session.js";
 import { FactoryTransitionService } from "./rules/transition-service.js";
-import { AuditStorage } from "./storage/domains/audit/base.js";
 import { AuditDomain } from "./storage/domains/audit/domain.js";
 import { QueueHealthStorage } from "./storage/domains/queue-health/base.js";
 import { assembleFactoryApiRoutes, buildIntegrationContext } from "./routes/surface.js";
 import { TelemetryRoutes } from "./routes/telemetry.js";
 import { readFactorySessionScope, resolveFactorySessionAddress } from "./rules/binding-context.js";
-import { observeSessionRunEnd } from "./session/run-audit.js";
 import { FactoryFeedReader } from "./storage/domains/comments/feed-context.js";
 import { FactoryDecisionDispatcher } from "./rules/dispatcher.js";
 import { FactoryPhaseStateProcessor, reportMemorySettingsUnavailable } from "./rules/processor.js";
@@ -56,11 +65,16 @@ import { createFactoryTransitionTools } from "./rules/tools.js";
 import { CallbackFactorySandbox } from "./sandbox/callback-factory-sandbox.js";
 import { SessionRetirementCoordinator } from "./sandbox/session-retirement.js";
 import { handleServerError } from "./server-error.js";
+import { FactoryChannelReplyProcessor } from "./session/channel-reply-processor.js";
+import { FactoryChannelSessionLinkProcessor } from "./session/channel-session-link-processor.js";
 import { hydrateSessionDefaultModel } from "./session/default-model-hydration.js";
 import { observeSessionFirstMessage } from "./session/first-message-capture.js";
 import { LiveSessions } from "./session/live-sessions.js";
+import { FactoryReplyCredentialProcessor } from "./session/reply-credential-processor.js";
+import { migrateSessionResources } from "./session/resource-migration.js";
 import { createSourceControlTools } from "./session/source-control-tools.js";
 import { readFactoryThinkingLevel, resolveFactoryThinkingLevel } from "./session/thinking-default.js";
+import { observeSessionThreadStamp } from "./session/thread-session-stamp.js";
 import { observeSessionThreadTitle } from "./session/thread-title-mirror.js";
 import { createSpaStaticMiddleware, resolveUiDistDir } from "./spa-static.js";
 import { createStateSigner } from "./state-signing.js";
@@ -72,9 +86,12 @@ import { CustomProvidersStorage } from "./storage/domains/custom-providers/base.
 import { FilesystemStorage } from "./storage/domains/filesystem/base.js";
 import { IntegrationStorage } from "./storage/domains/integrations/base.js";
 import { ModelDefaultsStorage } from "./storage/domains/model-defaults/base.js";
+import { FactorySessionsStateProcessor } from "./tools/sessions-state-processor.js";
+import { RequestContext } from "@mastra/core/request-context";
 import { hasAuthInit, isUserProvider } from "@mastra/core/server";
 import { MastraAuthStudio } from "@mastra/auth-studio";
 import { prepareAgentControllerMount } from "@mastra/code-sdk";
+import { getDynamicMemory } from "@mastra/code-sdk/agents/memory";
 import { AgentControllerChannels } from "@mastra/core/channels";
 import { EventEmitterPubSub } from "@mastra/core/events";
 import { describeFactorySandbox, isFactorySandbox } from "@mastra/core/workspace";
@@ -100,6 +117,12 @@ import { describeFactorySandbox, isFactorySandbox } from "@mastra/core/workspace
 * and the storage domains those capabilities require.
 */
 const CONTROLLER_ID = "code";
+/** Why a wake couldn't be run as its Factory session's owner. */
+const WAKE_OWNER_UNRESOLVED = {
+	"session-not-found": "no Factory session row names its owner",
+	"organization-unresolved": "its owner's organization is unresolved",
+	"organization-mismatch": "its owner's organization doesn't match"
+};
 function hasPlatformCredentials() {
 	return Boolean(process.env.MASTRA_PLATFORM_ACCESS_TOKEN?.trim() || process.env.MASTRA_PLATFORM_SECRET_KEY?.trim());
 }
@@ -199,6 +222,7 @@ var MastraFactory = class {
 	#configVersion;
 	#prepared;
 	#dispatcher;
+	#startCoordinator;
 	#factoryProcessor;
 	/** Environment builds through the sandbox's `builds`; undefined when the sandbox has none. */
 	#environmentBuilds;
@@ -233,7 +257,7 @@ var MastraFactory = class {
 		this.#preparing = true;
 		const publicOrigin = (this.#config.publicUrl ?? "http://localhost:4111").replace(/\/+$/, "");
 		const allowedOrigins = (this.#config.allowedOrigins ?? []).map((o) => o.replace(/\/+$/, "")).filter(Boolean);
-		const storage = this.#config.storage;
+		const storage = instrumentAsyncMethods(this.#config.storage, "storage");
 		const vector = this.#config.vector;
 		const pubsub = this.#config.pubsub;
 		const eventBus = pubsub ?? new EventEmitterPubSub();
@@ -243,6 +267,8 @@ var MastraFactory = class {
 		const secretEncryption = this.#config.secretEncryption ?? createPlaintextFactorySecretEncryption();
 		const deploymentModelProviders = resolveDeploymentModelProviders(this.#config.deploymentModelProviders);
 		const routeAuth = createFactoryRouteAuth(auth);
+		const mcpConfig = this.#config.mcp;
+		const mcpAuthorizationServers = mcpConfig === false || mcpConfig?.enabled === false ? [] : resolveMcpAuthorizationServers(auth?.name, mcpConfig);
 		const integrations = [...this.#config.integrations ?? []];
 		const explicitGithub = integrations.some((integration) => integration.id === "github");
 		let installedPlatformGithub = false;
@@ -349,7 +375,8 @@ var MastraFactory = class {
 			});
 			if (integration.versionControl && integrationSourceControl) integration.versionControl.initialize({ storage: integrationSourceControl });
 		}
-		const sourceControlSessions = createSourceControlSessionLookup([.../* @__PURE__ */ new Set(["github", ...integrations.filter((integration) => integration.versionControl).map(({ id }) => id)])].map((id) => sourceControlStorage.forIntegration(id)));
+		const sourceControlHandles = [.../* @__PURE__ */ new Set(["github", ...integrations.filter((integration) => integration.versionControl).map(({ id }) => id)])].map((id) => sourceControlStorage.forIntegration(id));
+		const sourceControlSessions = createSourceControlSessionLookup(sourceControlHandles);
 		if (auth) registerTenantCredentialResolver(modelCredentialsStorage, deploymentModelProviders, (requestContext) => resolveFactoryCredentialTenant(requestContext, {
 			projects: factoryProjectsStorage,
 			sourceControl: sourceControlSessions,
@@ -371,11 +398,32 @@ var MastraFactory = class {
 		});
 		const intakeReady = integrations.some((integration) => integration.intake !== void 0) && storage.isDomainReady("intake");
 		const factoryReady = storage.isDomainReady("projects") && storage.isDomainReady("work-items");
+		if (storage.isDomainReady("source-control") && storage.isDomainReady("work-items")) await timedPhase("prepare.migrate.sessionResources", async () => {
+			try {
+				const mastraStorage = storage.getMastraStorage();
+				const memory = await mastraStorage.getStore("memory");
+				if (!memory) return;
+				const sessionMemory = getDynamicMemory(mastraStorage, vector);
+				await migrateSessionResources({
+					sessions: sourceControlStorage,
+					workItems: workItemsStorage,
+					...storage.isDomainReady("integrations") ? { integrations: integrationStorage } : {},
+					memory,
+					threads: sessionMemory({ requestContext: new RequestContext() })
+				});
+				await sessionMemory.settled();
+			} catch (error) {
+				console.warn(`[factory] session resource migration stopped early: ${error instanceof Error ? error.message : error}`);
+			}
+		});
 		const knowledgeEnabled = this.#config.knowledge !== void 0 || process.env.MASTRACODE_EXPERIMENTAL_SUBCONSCIOUS === "1";
 		const githubIntegration = integrations.find((integration) => integration.id === "github");
 		const gitlabIntegration = integrations.find((integration) => integration.id === "gitlab" && integration.intake && integration.versionControl);
 		const workItemsReady = storage.isDomainReady("work-items");
-		const sessionRetirement = sandboxConfig && storage.isDomainReady("source-control") ? new SessionRetirementCoordinator({ invalidateSession: (sessionId) => workspaceRegistry.invalidateSession(sessionId) }) : void 0;
+		const sessionRetirement = sandboxConfig && storage.isDomainReady("source-control") ? new SessionRetirementCoordinator({
+			invalidateSession: (sessionId) => workspaceRegistry.invalidateSession(sessionId),
+			sandbox: sandboxConfig
+		}) : void 0;
 		const retireTerminalSessions = sessionRetirement && workItemsReady ? async ({ orgId, workItemId }) => {
 			const item = await workItemsStorage.get({
 				orgId,
@@ -402,11 +450,73 @@ var MastraFactory = class {
 			abortSession: async (binding) => {
 				const controller = this.#prepared?.base.controller;
 				if (!controller) return;
-				const session = await controller.getSessionByResource(binding.resourceId);
+				const session = await controller.getSession(binding.sessionId);
 				if (session?.stream.isActive()) session.abort();
 			},
 			...retireTerminalSessions ? { releaseSandboxes: retireTerminalSessions } : {}
 		}) : void 0;
+		const factoryMessaging = async () => {
+			const controller = this.#prepared?.base.controller;
+			const notifications = await controller?.getMastra()?.getStorage()?.getStore("notifications");
+			return controller && notifications ? {
+				controller,
+				notifications
+			} : null;
+		};
+		const factoryReporting = async () => {
+			const messaging = await factoryMessaging();
+			if (!messaging) return null;
+			return {
+				notifications: messaging.notifications,
+				deliver: (target, notification, options) => deliverFactorySessionNotification({
+					controller: messaging.controller,
+					sessions: sourceControlSessions,
+					runs: workItemsStorage,
+					target,
+					notification,
+					...options
+				})
+			};
+		};
+		const sessionReports = {
+			sessions: sourceControlSessions,
+			workItems: workItemsStorage,
+			reporting: factoryReporting
+		};
+		const reportSessionRunEnd = createSessionRunEndReporter(sessionReports);
+		const resolveWakeSession = async ({ resourceId, threadId, thread }) => {
+			const stamp = (thread === void 0 ? await this.#prepared?.base.controller.queryThreadById({ threadId }) : thread)?.metadata?.factorySessionId;
+			const candidates = [.../* @__PURE__ */ new Set([
+				typeof stamp === "string" ? stamp : "",
+				threadId,
+				resourceId
+			])].filter(Boolean);
+			for (const sessionId of candidates) {
+				const row = await sourceControlSessions.getBySessionId(sessionId);
+				if (row && (!(sessionId !== threadId && sessionId !== resourceId) || sessionStampCounts(row, resourceId)) && (resourceId === sessionId || resourceId === await sessionMemoryResourceId(this.#prepared?.base.controller, row, workItemsStorage))) return {
+					sessionId,
+					row
+				};
+			}
+			return {
+				sessionId: threadId,
+				row: null
+			};
+		};
+		const failWake = async ({ sessionId, threadId }, reason) => {
+			const message = `Factory session ${sessionId} can't be woken as its owner: ${reason}.`;
+			await reportSessionRunEnd({
+				sessionId,
+				threadId,
+				since: /* @__PURE__ */ new Date(),
+				outcome: {
+					status: "failed",
+					reason: message,
+					failureCode: "wake-owner-unresolved"
+				}
+			}).catch((error) => console.warn("[factory] Unable to report a failed wake.", error));
+			throw new Error(message);
+		};
 		const onTerminalStage = terminalCleanup ? (args) => terminalCleanup({
 			orgId: args.orgId,
 			factoryProjectId: args.factoryProjectId,
@@ -426,9 +536,42 @@ var MastraFactory = class {
 					id: factoryProjectId
 				}))?.autoApprovePlans ?? false;
 			},
+			selfReviewEnabled: async ({ orgId, factoryProjectId }) => {
+				await factoryProjectsStorage.ensureReady();
+				return (await factoryProjectsStorage.get({
+					orgId,
+					id: factoryProjectId
+				}))?.selfReviewEnabled ?? false;
+			},
 			...onTerminalStage ? { onTerminalStage } : {},
+			onTransitionCommitted: createStageChangeNotifier({
+				workItems: workItemsStorage,
+				reporting: factoryReporting
+			}),
 			...githubIntegration ? { onAccepted: (args) => reconcileGithubAcceptanceLabels(githubIntegration, sourceControlStorage.forIntegration(githubIntegration.id), args) } : {}
 		}) : void 0;
+		const factoryToolDeps = {
+			workItems: workItemsStorage,
+			comments: workItemCommentsStorage,
+			feed: commentsDomain,
+			audit: auditStorage,
+			boards: this.#boards,
+			transitionService,
+			auditRecorder: auditDomain,
+			sessions: sourceControlSessions,
+			sessionModel: {
+				projects: factoryProjectsStorage,
+				modelDefaults: modelDefaultsStorage,
+				...auth ? { tenantCatalog: {
+					credentials: modelCredentialsStorage,
+					customProviders: customProvidersStorage,
+					deploymentProviders: deploymentModelProviders
+				} } : {}
+			},
+			intake: intakeStorage,
+			startCoordinator: () => this.#startCoordinator,
+			messaging: factoryMessaging
+		};
 		this.#environmentBuilds = this.#sandbox?.builds ? new EnvironmentBuildRunner({
 			sandbox: this.#sandbox,
 			projects: factoryProjectsStorage,
@@ -503,7 +646,7 @@ var MastraFactory = class {
 			...sessionRetirement ? { sessionRetirement } : {},
 			...workItemsReady ? {
 				workItems: workItemsStorage,
-				controller: { getSessionByResource: async (resourceId) => this.#prepared?.base.controller.getSessionByResource(resourceId) }
+				controller: { getSession: async (sessionId) => this.#prepared?.base.controller.getSession(sessionId) }
 			} : {}
 		});
 		const loadMemorySettings = async ({ requestContext, binding }) => {
@@ -587,14 +730,78 @@ var MastraFactory = class {
 				workspaceRegistry
 			}),
 			disableGithubSignals: true,
-			prepareWakeRequestContext: async ({ requestContext, resourceId }) => {
-				if (!storage.isDomainReady("source-control")) return;
-				await prepareSessionRunContext(requestContext, resourceId, { sessions: sourceControlSessions });
+			prepareWakeRequestContext: async ({ requestContext, resourceId, threadId }) => {
+				if (!storage.isDomainReady("source-control")) {
+					if (auth) await failWake({
+						sessionId: threadId,
+						threadId
+					}, "session storage is not ready");
+					return;
+				}
+				const { sessionId, row } = await resolveWakeSession({
+					resourceId,
+					threadId
+				});
+				if (!row) {
+					if (auth) await failWake({
+						sessionId,
+						threadId
+					}, WAKE_OWNER_UNRESOLVED["session-not-found"]);
+					return;
+				}
+				const prepared = await prepareSessionRunContext(requestContext, sessionId, { sessions: sourceControlSessions });
+				if (prepared !== "prepared") {
+					if (auth) await failWake({
+						sessionId,
+						threadId
+					}, WAKE_OWNER_UNRESOLVED[prepared]);
+					return;
+				}
+				await primeCustomProvidersForRequestContext(requestContext);
 			},
+			...auth ? { resumeWakeSession: async ({ resourceId, threadId }) => {
+				const controller = this.#prepared?.base.controller;
+				if (!controller) return failWake({
+					sessionId: threadId,
+					threadId
+				}, "the Factory is not started");
+				const thread = await controller.queryThreadById({ threadId });
+				if (!thread || thread.resourceId !== resourceId) return failWake({
+					sessionId: threadId,
+					threadId
+				}, `thread ${threadId} is not the session's`);
+				const { sessionId, row } = storage.isDomainReady("source-control") ? await resolveWakeSession({
+					resourceId,
+					threadId,
+					thread
+				}) : {
+					sessionId: threadId,
+					row: null
+				};
+				if (!row?.factoryProjectId) return failWake({
+					sessionId,
+					threadId
+				}, WAKE_OWNER_UNRESOLVED["session-not-found"]);
+				if (!hasResolvedOrg(row.orgId)) return failWake({
+					sessionId,
+					threadId
+				}, WAKE_OWNER_UNRESOLVED["organization-unresolved"]);
+				if (await controller.getSession(sessionId)) return;
+				await createSessionAsRowOwner(controller, {
+					sessionId,
+					ownerResourceId: resourceId,
+					row,
+					tags: {
+						factoryProjectId: row.factoryProjectId,
+						...row.projectRepositoryId ? { projectRepositoryId: row.projectRepositoryId } : {}
+					},
+					threadId
+				});
+			} } : {},
 			disableSettingsOmSeed: true,
 			hostInstructions: async ({ requestContext }) => {
 				const context = requestContext.get("controller");
-				if (context?.threadId && context.resourceId) {
+				if (context?.threadId && context.sessionId) {
 					const current = context.getState();
 					if (!(Boolean(current.factoryProjectId) && Boolean(current.factoryOrgId) && typeof current.untrustedCheckout === "boolean")) {
 						const recovered = await resolveFactorySessionAddress({
@@ -621,10 +828,31 @@ var MastraFactory = class {
 			...mastraStorageBackend ? { storageBackend: mastraStorageBackend } : {},
 			...this.#config.knowledge ? { knowledge: this.#config.knowledge } : {},
 			inputProcessors: async ({ requestContext }) => {
+				const channelReplyProcessor = new FactoryChannelReplyProcessor();
 				const environmentProcessor = new FactoryEnvironmentStateProcessor();
+				const sessionsProcessor = workItemsStorage && storage.isDomainReady("source-control") ? [new FactorySessionsStateProcessor({
+					authEnabled: routeAuth.enabled(),
+					sessions: sourceControlSessions,
+					projects: factoryProjectsStorage,
+					workItems: workItemsStorage,
+					boards: this.#boards,
+					isRunning: async (sessionId) => {
+						return (await this.#prepared?.base.controller.getSession(sessionId))?.stream.isActive() ?? false;
+					},
+					lastActivity: async (threadId) => {
+						const thread = await this.#prepared?.base.controller.queryThreadById({ threadId });
+						return thread?.updatedAt ? new Date(thread.updatedAt) : null;
+					},
+					notifications: async () => (await factoryMessaging())?.notifications ?? null
+				})] : [];
 				if (factoryProcessor) {
 					await factoryProcessor.prepareMemorySettings(requestContext);
-					return [environmentProcessor, factoryProcessor];
+					return [
+						channelReplyProcessor,
+						environmentProcessor,
+						...sessionsProcessor,
+						factoryProcessor
+					];
 				}
 				try {
 					await loadMemorySettings({
@@ -634,8 +862,13 @@ var MastraFactory = class {
 				} catch (error) {
 					reportMemorySettingsUnavailable(requestContext, error instanceof Error ? error.message : String(error));
 				}
-				return [environmentProcessor];
+				return [
+					channelReplyProcessor,
+					environmentProcessor,
+					...sessionsProcessor
+				];
 			},
+			outputProcessors: [new FactoryChannelSessionLinkProcessor(), new FactoryReplyCredentialProcessor()],
 			...vector ? { vector } : {},
 			...toolIntegrations.length > 0 || sourceControlToolProviders.length > 0 || workItemsStorage && transitionService ? { extraTools: async ({ requestContext }) => {
 				const tools = {};
@@ -651,7 +884,55 @@ var MastraFactory = class {
 				if (storage.isDomainReady("source-control")) mergeTools("source-control", await createSourceControlTools({
 					requestContext,
 					providers: sourceControlToolProviders,
-					audit: auditDomain
+					audit: auditDomain,
+					testChecksEnabled: async ({ orgId, factoryProjectId }) => {
+						await factoryProjectsStorage.ensureReady();
+						return (await factoryProjectsStorage.get({
+							orgId,
+							id: factoryProjectId
+						}))?.reviewTestChecksEnabled ?? false;
+					},
+					...workItemsStorage ? {
+						selfReviewApprovedHead: async () => {
+							const resolution = await resolveFactorySessionAddress({
+								requestContext,
+								storage: workItemsStorage
+							});
+							if (!resolution) return void 0;
+							const binding = resolution.binding ?? await workItemsStorage.findActiveRunBinding(resolution.address);
+							if (!binding) return void 0;
+							const item = await workItemsStorage.get({
+								orgId: binding.orgId,
+								id: binding.workItemId
+							});
+							if (!item || boardForWorkItem(item) !== "work") return void 0;
+							if (typeof item.metadata?.openPullRequestNumber === "number") return void 0;
+							if (item.metadata?.selfReviewVerdict === void 0) {
+								await factoryProjectsStorage.ensureReady();
+								if (!(await factoryProjectsStorage.get({
+									orgId: binding.orgId,
+									id: binding.factoryProjectId
+								}))?.selfReviewEnabled) return void 0;
+							}
+							const sha = item.metadata?.selfReviewedHeadSha;
+							return item.metadata?.selfReviewVerdict === "approve" && typeof sha === "string" ? sha : null;
+						},
+						boundChangeRequestId: async () => {
+							const resolution = await resolveFactorySessionAddress({
+								requestContext,
+								storage: workItemsStorage
+							});
+							if (!resolution) return void 0;
+							const binding = resolution.binding ?? await workItemsStorage.findActiveRunBinding(resolution.address);
+							if (binding?.role !== "review") return void 0;
+							const source = (await workItemsStorage.get({
+								orgId: binding.orgId,
+								id: binding.workItemId
+							}))?.externalSource;
+							if (!source || !/pull-request|merge-request/.test(source.type)) return void 0;
+							return /(\d+)$/.exec(source.externalId)?.[1];
+						}
+					} : {}
 				}));
 				if (workItemsStorage && transitionService) {
 					mergeTools("factory", await createFactoryTransitionTools({
@@ -668,6 +949,19 @@ var MastraFactory = class {
 						uiOrigin: reviewSourceUiOrigin,
 						...storage.isDomainReady("source-control") ? { sessions: sourceControlSessions } : {}
 					}));
+					if (storage.isDomainReady("source-control")) {
+						const scope = await resolveFactoryToolScope({
+							requestContext,
+							authEnabled: routeAuth.enabled(),
+							sessions: sourceControlSessions,
+							projects: factoryProjectsStorage,
+							workItems: workItemsStorage
+						});
+						if (scope) mergeTools("factory-tools", createFactoryTools({
+							scope,
+							deps: factoryToolDeps
+						}));
+					}
 				}
 				for (const { integration, ready, ensureReady } of toolIntegrations) {
 					if (!ready && ensureReady) try {
@@ -718,6 +1012,14 @@ var MastraFactory = class {
 			} : {},
 			buildApiRoutes: ({ controller, authStorage }) => [
 				...auth ? buildAuthRoutes(auth, { publicUrl: publicOrigin }) : buildAuthDisabledRoutes(),
+				...auth && mcpAuthorizationServers.length > 0 ? buildFactoryMcpRoutes({
+					auth: routeAuth,
+					publicOrigin,
+					authorizationServers: mcpAuthorizationServers,
+					projects: factoryProjectsStorage,
+					sourceControls: sourceControlHandles,
+					tools: factoryToolDeps
+				}) : [],
 				...new TelemetryRoutes({
 					auth: routeAuth,
 					providerName: auth?.name,
@@ -751,7 +1053,8 @@ var MastraFactory = class {
 					configVersion,
 					boardRegistry: this.#boards,
 					factoryTransitionService: transitionService,
-					onFactoryRuntime: ({ transitionService: runtimeTransitionService, prepareBinding }) => {
+					onFactoryRuntime: ({ transitionService: runtimeTransitionService, startCoordinator, prepareBinding }) => {
+						this.#startCoordinator = startCoordinator;
 						this.#dispatcher ??= new FactoryDecisionDispatcher({
 							controller,
 							transitionService: runtimeTransitionService,
@@ -787,6 +1090,10 @@ var MastraFactory = class {
 								tenant,
 								credentials: modelCredentialsStorage
 							}),
+							reportRunEnd: createWorkItemRunEndReporter({
+								workItems: storage.getDomain("work-items"),
+								reporting: factoryReporting
+							}),
 							resolveLinkedWorkItemParentId: async ({ orgId, factoryProjectId, decision }) => {
 								if (decision.source !== "github-pr") return null;
 								const repositoryId = decision.metadata?.githubRepositoryId;
@@ -818,18 +1125,25 @@ var MastraFactory = class {
 				const onError = { onError: handleServerError };
 				const uiDist = resolveUiDistDir();
 				const spa = uiDist ? [createSpaStaticMiddleware(uiDist)] : [];
+				const timing = factoryTimingEnabled ? [createRequestTimingMiddleware()] : [];
 				if (!auth) return {
-					middleware: [createCustomProvidersPrimer({
-						auth: routeAuth,
-						storage: customProvidersStorage,
-						authEnabled: false
-					}), ...spa],
+					middleware: [
+						...timing,
+						createFactoryInteractiveMarker(),
+						createCustomProvidersPrimer({
+							auth: routeAuth,
+							storage: customProvidersStorage,
+							authEnabled: false
+						}),
+						...spa
+					],
 					...cors,
 					...onError
 				};
 				return {
 					auth,
 					middleware: [
+						...timing,
 						createFactoryAuthGate(auth),
 						createTenantCredentialPrimer({
 							auth: routeAuth,
@@ -847,6 +1161,7 @@ var MastraFactory = class {
 				};
 			}
 		}));
+		const notifyApprovalRequested = createSessionApprovalNotifier(sessionReports);
 		prepared.base.controller.onSessionCreated((session) => {
 			observeSessionFilesystem(session, {
 				filesystem: filesystemStorage,
@@ -856,6 +1171,17 @@ var MastraFactory = class {
 			observeSessionFirstExec(session, { sourceControl: { sessions: sourceControlSessions } });
 			observeSessionThreadTitle(session, { sourceControl: { sessions: sourceControlSessions } });
 			observeSessionRunEnd(session, { audit: auditDomain });
+			observeSessionRunReports(session, (outcome, since) => reportSessionRunEnd({
+				sessionId: session.identity.getId(),
+				threadId: session.thread.getId(),
+				outcome,
+				since
+			}), { onApprovalRequested: (request) => notifyApprovalRequested({
+				sessionId: session.identity.getId(),
+				threadId: session.thread.getId(),
+				...request
+			}) });
+			observeSessionThreadStamp(session);
 		});
 		prepared.base.controller.onSessionCreated((session) => hydrateSessionMemorySettings(session, { sourceControl: { sessions: sourceControlSessions } }), { blocking: true });
 		prepared.base.controller.onSessionCreated((session) => hydrateSessionDefaultModel(session, {
@@ -864,6 +1190,7 @@ var MastraFactory = class {
 			workItems: workItemsStorage,
 			modelDefaults: modelDefaultsStorage
 		}), { blocking: true });
+		prepared.base.controller.onSessionCreated((session) => applyFactoryToolPermissions(session, { sessions: sourceControlSessions }), { blocking: true });
 		this.#prepared = prepared;
 		this.#factoryProcessor = factoryProcessor;
 		const channelRegistrations = integrationRegistrations.filter(({ integration, ready }) => ready && integration.channels);