@mastra/factory 0.8.0-alpha.12 → 0.8.0-alpha.14

package/dist/integrations/github/app-identity.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Factory's own GitHub identity.
+ *
+ * Factory must recognise its own writes, or it wakes itself: a handoff comment
+ * arrives back through ingress, fires the rule that authored it, and cancels the
+ * run mid-flight. Every self-loop guard depends on answering "is this me?".
+ *
+ * The answer is not free. On a Platform deployment the credentials that post as
+ * `mastra-platform[bot]` do not carry that login, and `GITHUB_APP_SLUG`
+ * describes a *different*, self-hosted App — so it is legitimately unset. A bare
+ * `login === `${slug}[bot]`` therefore compares against `undefined[bot]`, never
+ * matches, and silently disables every guard while looking correct.
+ *
+ * Two sources, in order of trust:
+ *
+ * 1. **Observed.** Every comment Factory creates comes back with its author.
+ *    That is authoritative, costs no extra request, and needs no configuration —
+ *    Factory learns its own name the first time it speaks.
+ * 2. **Configured.** `slug` from a self-hosted GitHub App, when present.
+ *
+ * When neither is available the identity is *unknown*, which is distinct from
+ * "not Factory". Callers must handle it explicitly rather than inherit a `false`.
+ */
+export declare class GithubAppIdentity {
+    #private;
+    constructor(slug?: string);
+    /** The login Factory posts as, or `undefined` when it cannot be determined. */
+    get login(): string | undefined;
+    /** True once Factory can recognise its own writes. */
+    get known(): boolean;
+    /**
+     * Record the author GitHub reported for a write Factory just made. Observed
+     * identity wins over configuration: it is what GitHub actually attributes the
+     * write to, whereas the slug is a claim about a possibly-different App.
+     */
+    observeSelfAuthor(login: string | null | undefined): void;
+    /**
+     * Whether `login` is Factory. Returns `false` when the identity is unknown —
+     * callers that must not fail open should check {@link known} first.
+     */
+    matches(login: string | null | undefined): boolean;
+}
+//# sourceMappingURL=app-identity.d.ts.map

package/dist/integrations/github/app-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-identity.d.ts","sourceRoot":"","sources":["../../../src/integrations/github/app-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,iBAAiB;;gBAIhB,IAAI,CAAC,EAAE,MAAM;IAKzB,+EAA+E;IAC/E,IAAI,KAAK,IAAI,MAAM,GAAG,SAAS,CAE9B;IAED,sDAAsD;IACtD,IAAI,KAAK,IAAI,OAAO,CAEnB;IAED;;;;OAIG;IACH,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI;IAKzD;;;OAGG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO;CAKnD"}

package/dist/integrations/github/app-identity.js

@@ -0,0 +1,62 @@
+//#region src/integrations/github/app-identity.ts
+/**
+* Factory's own GitHub identity.
+*
+* Factory must recognise its own writes, or it wakes itself: a handoff comment
+* arrives back through ingress, fires the rule that authored it, and cancels the
+* run mid-flight. Every self-loop guard depends on answering "is this me?".
+*
+* The answer is not free. On a Platform deployment the credentials that post as
+* `mastra-platform[bot]` do not carry that login, and `GITHUB_APP_SLUG`
+* describes a *different*, self-hosted App — so it is legitimately unset. A bare
+* `login === `${slug}[bot]`` therefore compares against `undefined[bot]`, never
+* matches, and silently disables every guard while looking correct.
+*
+* Two sources, in order of trust:
+*
+* 1. **Observed.** Every comment Factory creates comes back with its author.
+*    That is authoritative, costs no extra request, and needs no configuration —
+*    Factory learns its own name the first time it speaks.
+* 2. **Configured.** `slug` from a self-hosted GitHub App, when present.
+*
+* When neither is available the identity is *unknown*, which is distinct from
+* "not Factory". Callers must handle it explicitly rather than inherit a `false`.
+*/
+var GithubAppIdentity = class {
+	#configuredLogin;
+	#observedLogin;
+	constructor(slug) {
+		const trimmed = slug?.trim();
+		this.#configuredLogin = trimmed ? `${trimmed.toLowerCase()}[bot]` : void 0;
+	}
+	/** The login Factory posts as, or `undefined` when it cannot be determined. */
+	get login() {
+		return this.#observedLogin ?? this.#configuredLogin;
+	}
+	/** True once Factory can recognise its own writes. */
+	get known() {
+		return this.login !== void 0;
+	}
+	/**
+	* Record the author GitHub reported for a write Factory just made. Observed
+	* identity wins over configuration: it is what GitHub actually attributes the
+	* write to, whereas the slug is a claim about a possibly-different App.
+	*/
+	observeSelfAuthor(login) {
+		const trimmed = login?.trim().toLowerCase();
+		if (trimmed) this.#observedLogin = trimmed;
+	}
+	/**
+	* Whether `login` is Factory. Returns `false` when the identity is unknown —
+	* callers that must not fail open should check {@link known} first.
+	*/
+	matches(login) {
+		const self = this.login;
+		if (!self || !login) return false;
+		return login.trim().toLowerCase() === self;
+	}
+};
+//#endregion
+export { GithubAppIdentity };
+
+//# sourceMappingURL=app-identity.js.map

package/dist/integrations/github/app-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-identity.js","names":["#configuredLogin","#observedLogin"],"sources":["../../../src/integrations/github/app-identity.ts"],"sourcesContent":["/**\n * Factory's own GitHub identity.\n *\n * Factory must recognise its own writes, or it wakes itself: a handoff comment\n * arrives back through ingress, fires the rule that authored it, and cancels the\n * run mid-flight. Every self-loop guard depends on answering \"is this me?\".\n *\n * The answer is not free. On a Platform deployment the credentials that post as\n * `mastra-platform[bot]` do not carry that login, and `GITHUB_APP_SLUG`\n * describes a *different*, self-hosted App — so it is legitimately unset. A bare\n * `login === `${slug}[bot]`` therefore compares against `undefined[bot]`, never\n * matches, and silently disables every guard while looking correct.\n *\n * Two sources, in order of trust:\n *\n * 1. **Observed.** Every comment Factory creates comes back with its author.\n *    That is authoritative, costs no extra request, and needs no configuration —\n *    Factory learns its own name the first time it speaks.\n * 2. **Configured.** `slug` from a self-hosted GitHub App, when present.\n *\n * When neither is available the identity is *unknown*, which is distinct from\n * \"not Factory\". Callers must handle it explicitly rather than inherit a `false`.\n */\nexport class GithubAppIdentity {\n  #configuredLogin: string | undefined;\n  #observedLogin: string | undefined;\n\n  constructor(slug?: string) {\n    const trimmed = slug?.trim();\n    this.#configuredLogin = trimmed ? `${trimmed.toLowerCase()}[bot]` : undefined;\n  }\n\n  /** The login Factory posts as, or `undefined` when it cannot be determined. */\n  get login(): string | undefined {\n    return this.#observedLogin ?? this.#configuredLogin;\n  }\n\n  /** True once Factory can recognise its own writes. */\n  get known(): boolean {\n    return this.login !== undefined;\n  }\n\n  /**\n   * Record the author GitHub reported for a write Factory just made. Observed\n   * identity wins over configuration: it is what GitHub actually attributes the\n   * write to, whereas the slug is a claim about a possibly-different App.\n   */\n  observeSelfAuthor(login: string | null | undefined): void {\n    const trimmed = login?.trim().toLowerCase();\n    if (trimmed) this.#observedLogin = trimmed;\n  }\n\n  /**\n   * Whether `login` is Factory. Returns `false` when the identity is unknown —\n   * callers that must not fail open should check {@link known} first.\n   */\n  matches(login: string | null | undefined): boolean {\n    const self = this.login;\n    if (!self || !login) return false;\n    return login.trim().toLowerCase() === self;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAuBA,IAAa,oBAAb,MAA+B;CAC7B;CACA;CAEA,YAAY,MAAe;EACzB,MAAM,UAAU,MAAM,KAAK;EAC3B,KAAKA,mBAAmB,UAAU,GAAG,QAAQ,YAAY,EAAE,SAAS,KAAA;CACtE;;CAGA,IAAI,QAA4B;EAC9B,OAAO,KAAKC,kBAAkB,KAAKD;CACrC;;CAGA,IAAI,QAAiB;EACnB,OAAO,KAAK,UAAU,KAAA;CACxB;;;;;;CAOA,kBAAkB,OAAwC;EACxD,MAAM,UAAU,OAAO,KAAK,CAAC,CAAC,YAAY;EAC1C,IAAI,SAAS,KAAKC,iBAAiB;CACrC;;;;;CAMA,QAAQ,OAA2C;EACjD,MAAM,OAAO,KAAK;EAClB,IAAI,CAAC,QAAQ,CAAC,OAAO,OAAO;EAC5B,OAAO,MAAM,KAAK,CAAC,CAAC,YAAY,MAAM;CACxC;AACF"}

package/dist/integrations/github/routes.js

@@ -908,7 +908,7 @@ function buildProjectGitRoutes({ github, auth, fleet, controller, emitAudit, ses
 				if (!project) return c.json({ error: "Project repository not found" }, 404);
 				const sessions = await github.sourceControlStorage.sessions.list({
 					projectRepositoryId: project.id,
-					userId
+					viewerUserId: userId
 				});
 				return c.json({ sessions });
 			}
@@ -963,7 +963,8 @@ function buildProjectGitRoutes({ github, auth, fleet, controller, emitAudit, ses
 					userId,
 					branch,
 					baseBranch,
-					title: normalizedTitle
+					title: normalizedTitle,
+					visibility: "org"
 				}).catch(async (error) => {
 					if (!(error instanceof UniqueViolationError) || requestedSessionId === void 0) throw error;
 					const conflict = await github.sourceControlStorage.sessions.getBySessionId(sessionId);
@@ -981,7 +982,7 @@ function buildProjectGitRoutes({ github, auth, fleet, controller, emitAudit, ses
 				const resolved = await resolveOrgTenant(loose(c), auth);
 				if ("response" in resolved) return resolved.response;
 				const session = await github.sourceControlStorage.sessions.getBySessionId(c.req.param("sessionId"));
-				if (!session || session.orgId !== resolved.tenant.orgId || session.userId !== resolved.tenant.userId) return c.json({ error: "Session not found" }, 404);
+				if (!session || session.orgId !== resolved.tenant.orgId || session.visibility === "private" && session.userId !== resolved.tenant.userId) return c.json({ error: "Session not found" }, 404);
 				return c.json({ session });
 			}
 		}),