mastracode 0.26.1-alpha.0 → 0.27.0-alpha.10

package/CHANGELOG.md

@@ -1,5 +1,284 @@
 # mastracode
 
+## 0.27.0-alpha.10
+
+### Patch Changes
+
+- Improved the Mastra Code status area to show active work time, completed work duration, and idle time. ([#18656](https://github.com/mastra-ai/mastra/pull/18656))
+
+- Added Mastra Code plugin support: ([#18658](https://github.com/mastra-ai/mastra/pull/18658))
+  - Install, scaffold, configure, block, and auto-update plugins with local-change backups.
+  - Load plugin tools in all modes, including streaming progress and subagent-style rendering.
+  - Load bundled plugin commands, skills, and plugin-provided system instructions.
+
+  Example:
+
+  ```ts
+  import { createTool, defineMastraCodePlugin, z } from 'mastracode/plugin';
+
+  export default defineMastraCodePlugin({
+    id: 'acme.tools',
+    tools: {
+      echo: {
+        tool: createTool({
+          id: 'echo',
+          inputSchema: z.object({ message: z.string() }),
+          execute: async ({ message }) => ({ message }),
+        }),
+      },
+    },
+  });
+  ```
+
+- Updated dependencies [[`6f578ac`](https://github.com/mastra-ai/mastra/commit/6f578acba84930b406b2a0700b17cfdfaf5aae56), [`c01012f`](https://github.com/mastra-ai/mastra/commit/c01012f50368d29eb3fc3764df42d48291973d23), [`9eefdc0`](https://github.com/mastra-ai/mastra/commit/9eefdc0ac03f989718c6d835334940a977938895), [`be875ed`](https://github.com/mastra-ai/mastra/commit/be875ed43f856742ce58529f531b5ea0ae6911f3), [`9eefdc0`](https://github.com/mastra-ai/mastra/commit/9eefdc0ac03f989718c6d835334940a977938895), [`7d112ca`](https://github.com/mastra-ai/mastra/commit/7d112ca17078479b2659b88ba1c85b936cfc111c)]:
+  - @mastra/memory@1.22.0-alpha.3
+  - @mastra/core@1.48.0-alpha.10
+  - @mastra/server@1.48.0-alpha.10
+  - @mastra/libsql@1.14.3-alpha.0
+  - @mastra/pg@1.14.3-alpha.0
+  - @mastra/hono@1.5.3-alpha.10
+  - @mastra/react@1.2.1-alpha.10
+
+## 0.27.0-alpha.9
+
+### Patch Changes
+
+- Updated dependencies [[`e84e791`](https://github.com/mastra-ai/mastra/commit/e84e79174031d7bc8793ca6c805eb38b06e7cfb1)]:
+  - @mastra/core@1.48.0-alpha.9
+  - @mastra/react@1.2.1-alpha.9
+  - @mastra/server@1.48.0-alpha.9
+  - @mastra/hono@1.5.3-alpha.9
+
+## 0.27.0-alpha.8
+
+### Patch Changes
+
+- MastraCode now builds its code agent through the new `createCodingAgent` factory from `@mastra/core/coding-agent` instead of constructing the `Agent` inline. No user-facing behavior changes — the system prompt and agent configuration are unchanged. ([#18695](https://github.com/mastra-ai/mastra/pull/18695))
+
+- Updated dependencies [[`0ac14ce`](https://github.com/mastra-ai/mastra/commit/0ac14cea48e1b0a7857782153c78f7242fdf7e1a), [`c2f0b7f`](https://github.com/mastra-ai/mastra/commit/c2f0b7f1370f4428d165f51f0d1d9a48331cc257)]:
+  - @mastra/core@1.48.0-alpha.8
+  - @mastra/react@1.2.1-alpha.8
+  - @mastra/server@1.48.0-alpha.8
+  - @mastra/hono@1.5.3-alpha.8
+
+## 0.27.0-alpha.7
+
+### Minor Changes
+
+- Reworked headless mode into a real programmatic API. You can now run MastraCode from Node/CI code with `runMC({ controller, session, prompt })`, which returns a handle that streams live events as an async-iterable and resolves to a typed result with status, text, usage, tool calls, and an exit code — it never calls `process.exit` or writes to global streams. The CLI is now a thin adapter over the same runner. ([#18680](https://github.com/mastra-ai/mastra/pull/18680))
+
+  ```ts
+  import { createMastraCode, runMC } from 'mastracode';
+
+  const { controller, session } = await createMastraCode({ settingsPath });
+
+  const run = runMC({ controller, session, prompt: 'Fix the failing test' });
+  for await (const event of run) {
+    // optional: react to live progress events
+  }
+  const result = await run.result;
+  process.exitCode = result.exitCode; // 0 success, 1 error/aborted/max-turns, 2 timeout
+  ```
+
+  Approvals and suspensions are resolved by a pluggable policy (default keeps the previous auto-approve behavior); a built-in `denyPolicy` plus `permissionModeToPolicy` are exported, and a new `--permission-mode {auto|deny}` flag selects between them. A new `--max-turns` flag (and `maxTurns` option) caps assistant turns and reports a `max_turns` status with exit code 1 when the cap is hit mid-task.
+
+  Breaking changes / migration:
+  - Output flags consolidated: the `--format` and `--output-format` flags are replaced by a single `--output` flag with values `human`, `json`, or `jsonl`.
+    - Before: `mastracode --prompt "..." --output-format json`
+    - After: `mastracode --prompt "..." --output json`
+  - Programmatic entry point changed from the old `runHeadless`/`headlessMain` to `runMC` (pure runner) and `runMCCli` (CLI adapter). `runMC` takes an already-built `controller` + `session` from `createMastraCode` and returns a result object instead of only an exit code.
+
+- Turned MastraCode Web into a multi-org cloud coding service. When WorkOS auth and a GitHub App are configured, a team can sign in, connect their repos, and run coding agents that branch, commit, push, and open pull requests — all from isolated cloud sandboxes. When the relevant environment variables are absent, the server and UI behave exactly as before (local-path projects, single shared store, no auth UI), so this is fully opt-in. ([#18567](https://github.com/mastra-ai/mastra/pull/18567))
+
+  **Authentication (WorkOS AuthKit).** Setting `WORKOS_API_KEY` and `WORKOS_CLIENT_ID` protects every route: unauthenticated visitors are redirected to the WorkOS hosted login, signed-in users get an encrypted session, expired sessions bounce back to login, and the sidebar shows the signed-in email with a Sign out button. Users with no WorkOS organization get a personal org bootstrapped on first authenticated use (idempotent, with recovery from partial creations), so personal accounts can use org-scoped features without hand-creating an org.
+
+  **Org-owned GitHub projects.** With the GitHub App env vars set (`GITHUB_APP_ID`, `GITHUB_APP_PRIVATE_KEY`, `GITHUB_APP_CLIENT_ID`, `GITHUB_APP_CLIENT_SECRET`, `GITHUB_APP_SLUG`, `APP_DATABASE_URL`), users install/connect the app, pick repos they can access, and turn each into a project. The installation and connected repos belong to the WorkOS organization; the same repo can be connected independently by different orgs with no cross-visibility. Each repo is materialized into an isolated cloud sandbox on open — cloned (or pulled) inside the sandbox with a short-lived installation token that never reaches the browser and is scrubbed from the remote afterward.
+
+  **Cloud coding-agent write-back.** From a connected repo, each user gets their own sandbox, git worktrees, and feature branches. The agent runs against the selected worktree (file edits and commands bind to its path) and can commit, push, and open pull requests via the in-sandbox `gh` CLI, authenticated with short-lived per-operation installation tokens. The sidebar shows a nested project → worktree → conversations tree with a "+ New worktree" affordance; conversations scope per worktree.
+
+  **Sandbox providers.** A provider is selected automatically: Railway when `RAILWAY_API_TOKEN` is set, otherwise a local provider that runs git directly on the host (single-user local dev only — no tenant isolation). `MASTRACODE_SANDBOX_PROVIDER` overrides explicitly. Idle sandboxes are torn down and re-provisioned on the next open; a per-replica live-sandbox cap (`MASTRACODE_MAX_SANDBOXES`) and a per-user teardown route bound resource use.
+
+  **Per-(org,user) state isolation.** Agent state (threads, messages, memory, recall vectors) is isolated by the `(organization, user)` pair, each backed by a dedicated libSQL database whose location is derived server-side from a hash of `(orgId, userId)` — never a client-supplied path. By default each tenant gets local libSQL files under `MASTRACODE_TENANT_DB_ROOT`; for hosted deployments, point each tenant at a remote libSQL/Turso database via `MASTRACODE_TENANT_DB_URL_TEMPLATE` (plus optional vector template and auth tokens).
+
+  **Sandbox isolation hardening.** Commands run in the local sandbox receive only a sanitized allow-list of environment variables (PATH/HOME/locale/git config), so server secrets such as `GITHUB_APP_PRIVATE_KEY`, `WORKOS_API_KEY`, and `APP_DATABASE_URL` are never exposed to code running against an untrusted checkout. Sandbox filesystem write operations (write/append/copy/move/mkdir) now verify the destination's real path — including a symlinked parent directory — stays within the workspace root, preventing a malicious repo's symlink from redirecting writes outside the sandbox.
+
+  **Multi-replica deployment hardening.** Per-(project,user) git writes are serialized across replicas with Postgres advisory locks (`MASTRACODE_DISTRIBUTED_LOCK`, on by default; requires `APP_DATABASE_URL`). OAuth/install state signing requires a replica-stable secret in multi-replica setups, in-memory tenant stacks are evicted by idle timeout and an LRU cap (`MASTRACODE_TENANT_IDLE_MINUTES`, `MASTRACODE_TENANT_MAX_APPS`), and `MASTRACODE_REQUIRE_REMOTE_TENANT_DB=1` fails startup when no shared remote tenant DB is configured.
+
+  ```bash
+  # Auth + GitHub App (opt-in)
+  WORKOS_API_KEY=sk_xxxxxxxx
+  WORKOS_CLIENT_ID=client_xxxxxxxx
+  GITHUB_APP_ID=123456
+  GITHUB_APP_PRIVATE_KEY="-----BEGIN RSA PRIVATE KEY-----\n...\n-----END RSA PRIVATE KEY-----"
+  GITHUB_APP_CLIENT_ID=Iv1.xxxxxxxx
+  GITHUB_APP_CLIENT_SECRET=xxxxxxxx
+  GITHUB_APP_SLUG=your-app-slug
+  APP_DATABASE_URL=postgres://user:pass@host:5432/mastracode_web
+
+  # Multi-replica hosted deployment
+  GITHUB_APP_WEBHOOK_SECRET=...                      # replica-stable state signing
+  MASTRACODE_DISTRIBUTED_LOCK=1                       # cross-replica git write locks
+  MASTRACODE_REQUIRE_REMOTE_TENANT_DB=1              # require shared remote tenant DBs
+  MASTRACODE_TENANT_DB_URL_TEMPLATE=libsql://{id}-org.turso.io
+  MASTRACODE_TENANT_IDLE_MINUTES=30
+  MASTRACODE_TENANT_MAX_APPS=100
+  MASTRACODE_MAX_SANDBOXES=50
+  ```
+
+  Still deferred: collaboration within a project (multiple users sharing one worktree/sandbox/branch), org admin/roles and membership management, and org-level project deletion.
+
+- Auto-provision a per-tenant Turso database in deployed MastraCode Web environments. ([#18690](https://github.com/mastra-ai/mastra/pull/18690))
+
+  Previously, hosting per-`(org, user)` agent state on Turso required each tenant's database to already exist at the URL produced by `MASTRACODE_TENANT_DB_URL_TEMPLATE`. There was no way to create those databases on demand, so the only zero-setup option was server-local libSQL files — which are ephemeral and not shared across replicas.
+
+  Setting `MASTRACODE_TURSO_PLATFORM_TOKEN` and `MASTRACODE_TURSO_ORG` now enables a third tenant-storage mode: the first time a tenant is seen, its own Turso database is created via the Turso Platform API (idempotent — an "already exists" race recovers the hostname via `databases.get`), a scoped auth token is minted, and the stable database-name/hostname mapping is persisted in the app Postgres (`tenant_databases` table, requires `APP_DATABASE_URL`). All replicas converge on the same database and cold starts never re-create it. Only the durable mapping is stored; the auth token is minted fresh per resolution, so no long-lived credential is persisted.
+
+  Resolution priority is: explicit `MASTRACODE_TENANT_DB_URL_TEMPLATE` → Turso auto-provisioning → local libSQL files. Turso provisioning also satisfies `MASTRACODE_REQUIRE_REMOTE_TENANT_DB=1`. The `@tursodatabase/api` client is loaded dynamically, so deployments that don't use Turso never pull it in at runtime.
+
+  ```bash
+  MASTRACODE_TURSO_PLATFORM_TOKEN=...    # Turso Platform API token
+  MASTRACODE_TURSO_ORG=my-org            # org that owns provisioned databases
+  MASTRACODE_TURSO_GROUP=default         # optional group (default "default")
+  APP_DATABASE_URL=postgres://...        # required for the mapping table
+  ```
+
+### Patch Changes
+
+- Updated dependencies [[`8be63b0`](https://github.com/mastra-ai/mastra/commit/8be63b015fb8d72cea1220f05e7dc3bb997cc249), [`ee14cae`](https://github.com/mastra-ai/mastra/commit/ee14cae244805783bde518a6142de28b744b169c), [`345eecc`](https://github.com/mastra-ai/mastra/commit/345eecce6ba519b5d987f0e10b5de4c8e5734580), [`ee14cae`](https://github.com/mastra-ai/mastra/commit/ee14cae244805783bde518a6142de28b744b169c)]:
+  - @mastra/core@1.48.0-alpha.7
+  - @mastra/server@1.48.0-alpha.7
+  - @mastra/hono@1.5.3-alpha.7
+  - @mastra/react@1.2.1-alpha.7
+
+## 0.27.0-alpha.6
+
+### Patch Changes
+
+- Renamed the AgentController interval API. `heartbeatHandlers` is now `intervalHandlers`, the `HeartbeatHandler` type is now `IntervalHandler`, and the `removeHeartbeat()`/`stopHeartbeats()` methods are now `removeInterval()`/`stopIntervals()`. This better reflects that these are fixed-interval background tasks, not liveness pings, and is distinct from the unrelated `mastra.heartbeats` scheduled-agent feature. ([#18665](https://github.com/mastra-ai/mastra/pull/18665))
+
+  **Before**
+
+  ```ts
+  const { controller } = await createMastraCode({
+    heartbeatHandlers: [{ id: 'sync', intervalMs: 60_000, handler: async () => {} }],
+  });
+  await controller.removeHeartbeat({ id: 'sync' });
+  await controller.stopHeartbeats();
+  ```
+
+  **After**
+
+  ```ts
+  const { controller } = await createMastraCode({
+    intervalHandlers: [{ id: 'sync', intervalMs: 60_000, handler: async () => {} }],
+  });
+  await controller.removeInterval({ id: 'sync' });
+  await controller.stopIntervals();
+  ```
+
+- Improved MastraCode web chat so hydrated and streaming messages render consistently, including tool cards, reasoning, and failed-tool states. ([#18620](https://github.com/mastra-ai/mastra/pull/18620))
+
+- Updated dependencies [[`b33c77d`](https://github.com/mastra-ai/mastra/commit/b33c77d5293f14a794f3ec38dc947a6676de2764), [`1009f77`](https://github.com/mastra-ai/mastra/commit/1009f772aa40016b49267c8566d0c29f6a16aa3c), [`23c31de`](https://github.com/mastra-ai/mastra/commit/23c31de96ed8153402dcf092ac84b27a0c3638c1), [`0368766`](https://github.com/mastra-ai/mastra/commit/0368766744c7ea3df4d6059e2cc15f7bdf55f5a6), [`d0702ee`](https://github.com/mastra-ai/mastra/commit/d0702eedc1594cb2d0d83476440cfc2ec8820adb), [`65a66db`](https://github.com/mastra-ai/mastra/commit/65a66dbe249a0d92d828c605b955e73a983cf3b0), [`2866f04`](https://github.com/mastra-ai/mastra/commit/2866f04953edb78c1637fa45cc53abe24122edcb)]:
+  - @mastra/core@1.48.0-alpha.6
+  - @mastra/schema-compat@1.3.2-alpha.1
+  - @mastra/mcp@1.12.1-alpha.0
+  - @mastra/react@1.2.1-alpha.6
+  - @mastra/memory@1.21.3-alpha.2
+  - @mastra/server@1.48.0-alpha.6
+  - @mastra/hono@1.5.3-alpha.6
+
+## 0.27.0-alpha.5
+
+### Patch Changes
+
+- Updated dependencies [[`1917c53`](https://github.com/mastra-ai/mastra/commit/1917c53b19dac43926f29c496893b0686462dca4), [`c607ece`](https://github.com/mastra-ai/mastra/commit/c607eceeda028a80b24d00ee7dae376db73df526), [`58e287b`](https://github.com/mastra-ai/mastra/commit/58e287b1edaf978b13745a1795989cad3826e82b)]:
+  - @mastra/core@1.48.0-alpha.5
+  - @mastra/server@1.48.0-alpha.5
+  - @mastra/memory@1.21.3-alpha.1
+  - @mastra/hono@1.5.3-alpha.5
+
+## 0.27.0-alpha.4
+
+### Minor Changes
+
+- Added voice input to the MastraCode TUI. Enable it with /voice, then hold the spacebar to dictate a prompt and release to finish. Your speech streams into the input in real time as you talk and is transcribed with OpenAI Whisper. The setting persists across restarts. ([#18624](https://github.com/mastra-ai/mastra/pull/18624))
+
+  Requires an OpenAI API key (set `OPENAI_API_KEY` or configure it via `/api-keys`) and a local audio recorder on your `PATH` — `rec`/`sox` (recommended for live streaming) or `ffmpeg` on macOS, and `pw-record`/`parecord`/`arecord`/`sox` on Linux.
+
+- Added Amazon Bedrock as a model provider in Mastra Code. Bedrock models surfaced by models.dev are now selectable via `/models` and usable as build/plan/fast or subagent models with the `amazon-bedrock/<modelId>` form. Models are only offered when AWS credentials are detected. ([#17937](https://github.com/mastra-ai/mastra/pull/17937))
+
+  Bedrock authenticates with AWS SigV4 through the standard AWS credential chain (`fromNodeProviderChain`), so environment variables, shared `~/.aws` profiles, SSO, and container/instance roles all work without extra configuration. Set `AWS_REGION` (defaults to `us-east-1`) to target a region, or `AWS_BEARER_TOKEN_BEDROCK` to use Bedrock API-key auth instead.
+
+  ```sh
+  # Pick a Bedrock model from the picker
+  /models
+
+  # Or set it directly via the build/plan/fast slots
+  /build amazon-bedrock/<modelId>
+  ```
+
+### Patch Changes
+
+- Amazon Bedrock models now appear under their own `amazon-bedrock/<model>` provider in the model picker instead of the `mastracode/amazon-bedrock/<model>` namespace. Bedrock is resolved through a dedicated Amazon Bedrock gateway that authenticates with the AWS credential chain (SigV4) and surfaces models from the public models.dev catalog. Saved model selections using the previous `mastracode/amazon-bedrock/...` IDs are still resolved at runtime, so existing config keeps working. ([#17937](https://github.com/mastra-ai/mastra/pull/17937))
+
+- Updated dependencies [[`705ba98`](https://github.com/mastra-ai/mastra/commit/705ba98726d388a596e896225f237907ca6807a9), [`e62c108`](https://github.com/mastra-ai/mastra/commit/e62c108409dfd6a6cac0a48ec39c5cc81d24fd52), [`bfbbb01`](https://github.com/mastra-ai/mastra/commit/bfbbb01bd845ba54cdc0c678c277d08a7cb847e4)]:
+  - @mastra/core@1.48.0-alpha.4
+  - @mastra/server@1.48.0-alpha.4
+  - @mastra/hono@1.5.3-alpha.4
+
+## 0.27.0-alpha.3
+
+### Patch Changes
+
+- Fixed MCP HTTP server URLs so `${VAR}` references resolve from the environment, the same way header values already do. A server configured with `"url": "${MCP_SERVER_URL}"` is now connected instead of being silently skipped as an invalid URL. ([#18579](https://github.com/mastra-ai/mastra/pull/18579))
+
+- MCP stdio servers now resolve `${VAR}` references in their `env` values from the host environment, matching the existing behavior for HTTP server headers. You can reference secrets from the environment instead of hardcoding them in `mcp.json`: ([#18529](https://github.com/mastra-ai/mastra/pull/18529))
+
+  ```json
+  {
+    "mcpServers": {
+      "github": {
+        "command": "npx",
+        "args": ["-y", "@modelcontextprotocol/server-github"],
+        "env": { "GITHUB_TOKEN": "${GITHUB_TOKEN}" }
+      }
+    }
+  }
+  ```
+
+- Updated dependencies [[`cdd5f93`](https://github.com/mastra-ai/mastra/commit/cdd5f939cefa67390629704dce92563ccbf492b2), [`1b8728a`](https://github.com/mastra-ai/mastra/commit/1b8728a57fd844205a452b0b4216d20ff60c784a), [`9feeaa0`](https://github.com/mastra-ai/mastra/commit/9feeaa0f9a1af07039e5b4f22b932b0cb18617e8), [`e05dade`](https://github.com/mastra-ai/mastra/commit/e05dade21c3e2551893ad939e6028cdafd84a1b2), [`213feb8`](https://github.com/mastra-ai/mastra/commit/213feb87bfdd1d8ec00ea660e218f9bcfcb34e7b)]:
+  - @mastra/core@1.48.0-alpha.3
+  - @mastra/schema-compat@1.3.2-alpha.0
+  - @mastra/server@1.48.0-alpha.3
+  - @mastra/mcp@1.12.0
+  - @mastra/memory@1.21.3-alpha.0
+  - @mastra/hono@1.5.3-alpha.3
+
+## 0.27.0-alpha.2
+
+### Patch Changes
+
+- Updated dependencies [[`e420b3c`](https://github.com/mastra-ai/mastra/commit/e420b3c3ffc98bbc5b791897ea390bb47af99696)]:
+  - @mastra/core@1.48.0-alpha.2
+  - @mastra/server@1.48.0-alpha.2
+  - @mastra/hono@1.5.3-alpha.2
+
+## 0.27.0-alpha.1
+
+### Minor Changes
+
+- **Improved web settings data loading** ([#18518](https://github.com/mastra-ai/mastra/pull/18518))
+  - Settings panels now avoid duplicate requests and refresh lists after saves or removals.
+  - Provider keys, custom providers, model packs, observational memory, and the directory picker now stay in sync automatically.
+  - Streaming chat behavior is unchanged.
+
+### Patch Changes
+
+- Updated dependencies [[`95857bc`](https://github.com/mastra-ai/mastra/commit/95857bcd6669da7193f503e803f0d72a2bd66be6), [`8e9c0fb`](https://github.com/mastra-ai/mastra/commit/8e9c0fb48fd58da2efcdff2cf1202ee41092c315)]:
+  - @mastra/core@1.48.0-alpha.1
+  - @mastra/server@1.48.0-alpha.1
+  - @mastra/hono@1.5.3-alpha.1
+
 ## 0.26.1-alpha.0
 
 ### Patch Changes

package/README.md

@@ -101,6 +101,7 @@ Select a suggestion with arrow keys and press Tab to insert it.
 | `/mcp`              | Show/reload MCP server connections                                          |
 | `/sandbox`          | Manage allowed paths (add/remove dirs)                                      |
 | `/permissions`      | View/manage tool approval permissions                                       |
+| `/plugins`          | Install and manage trusted Mastra Code plugins                              |
 | `/settings`         | General settings (notifications, YOLO, etc.)                                |
 | `/yolo`             | Toggle YOLO mode (auto-approve all tools)                                   |
 | `/resource`         | Show/switch resource ID (tag for sharing)                                   |
@@ -111,6 +112,10 @@ Select a suggestion with arrow keys and press Tab to insert it.
 | `/help`             | Show available commands                                                     |
 | `/exit`             | Exit the TUI                                                                |
 
+### Plugins
+
+Use `/plugins` to install and manage trusted local or GitHub plugins. Plugins can add tools, commands, skills, and system instructions. Because plugins execute code inside Mastra Code and their instructions are appended to the agent prompt, only install plugins from sources you trust.
+
 ### Goals
 
 Use `/goal <objective>` to have Mastra Code keep working toward an objective across turns. Goals use a judge model to decide whether the goal is complete, should continue, or should wait for an explicit user checkpoint. Configure defaults with `/judge`.
@@ -215,6 +220,8 @@ When both are available, Claude Max OAuth takes priority.
 
 For **other providers** (OpenAI, Google, etc.), set the corresponding environment variable (e.g., `OPENAI_API_KEY`, `GOOGLE_GENERATIVE_AI_API_KEY`) or use OAuth where supported.
 
+For **Amazon Bedrock**, mastracode authenticates with AWS SigV4 through the standard AWS credential chain — environment variables (`AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` / `AWS_SESSION_TOKEN`), a shared `~/.aws` profile (`AWS_PROFILE`, including SSO), or a container/instance role all work, the same resolution order as the AWS CLI. Set `AWS_REGION` (defaults to `us-east-1`) to choose a region. Select Bedrock models with the `amazon-bedrock/<modelId>` form, where `<modelId>` is any Bedrock model ID surfaced via `/models`. To use Bedrock API-key auth instead of SigV4, set `AWS_BEARER_TOKEN_BEDROCK`.
+
 Credentials are stored alongside the database in `auth.json`.
 
 ### Custom providers and models
@@ -256,6 +263,129 @@ To save plans to a project-local directory instead, set the `MASTRA_PLANS_DIR` e
 export MASTRA_PLANS_DIR=.mastracode/plans
 ```
 
+### Web UI: optional auth & GitHub projects
+
+The web UI (`mastracode web`) supports optional WorkOS authentication and a GitHub App
+integration. Both are off by default — when their environment variables are absent the web UI
+behaves exactly as before.
+
+**WorkOS auth** — when `WORKOS_API_KEY` and `WORKOS_CLIENT_ID` are set, every route requires a
+signed-in user (hosted login + encrypted session):
+
+```bash
+export WORKOS_API_KEY=...
+export WORKOS_CLIENT_ID=...
+export WORKOS_REDIRECT_URI=https://your-host/auth/callback   # optional
+export WORKOS_COOKIE_PASSWORD=...                            # optional (recommended in prod)
+```
+
+On first authenticated use, a user with no WorkOS organization is automatically given a personal
+org (the org is created and the user added as a member), so org-scoped features work without
+hand-creating an org in the WorkOS dashboard. The WorkOS API key must be allowed to create
+organizations and memberships; if it isn't, bootstrap fails soft (logged) and the user keeps the
+`organization_required` response.
+
+**GitHub projects** — when the GitHub App variables are set _and_ WorkOS auth is enabled,
+signed-in users can install the GitHub App, pick repositories, and turn each repo into a project.
+The tenant boundary is the **WorkOS organization**: the GitHub App installation and the connected
+project (repo) are owned by the org, while each user inside the org gets their own isolated
+sandbox, worktrees, branches, and PRs against that repo. The **same repo can be connected
+independently by different orgs** without ever seeing each other's projects, sandboxes, or state.
+Personal accounts are bootstrapped into a personal org on first use (see above), so they can
+connect GitHub projects too; users always get isolated agent state regardless. Repo and project
+metadata persist in a separate application Postgres (`APP_DATABASE_URL`):
+
+```bash
+export GITHUB_APP_ID=...
+export GITHUB_APP_PRIVATE_KEY="-----BEGIN RSA PRIVATE KEY-----\n...\n-----END RSA PRIVATE KEY-----"
+export GITHUB_APP_CLIENT_ID=...
+export GITHUB_APP_CLIENT_SECRET=...
+export GITHUB_APP_SLUG=your-app-slug
+export APP_DATABASE_URL=postgres://user:pass@host:5432/db
+export GITHUB_APP_REDIRECT_URI=https://your-host/auth/github/callback  # optional
+```
+
+GitHub-backed projects are cloned into an isolated cloud sandbox on open, which requires a
+sandbox provider. Railway is the first supported backend:
+
+```bash
+export RAILWAY_API_TOKEN=...
+export RAILWAY_ENVIRONMENT_ID=...
+export MASTRACODE_SANDBOX_PROVIDER=railway                  # optional (default when a token is set)
+export MASTRACODE_SANDBOX_WORKDIR=/workspace                # optional (path inside the sandbox)
+export MASTRACODE_SANDBOX_IDLE_MINUTES=30                   # optional (idle teardown window; default 30)
+```
+
+The sandbox template must have `git` and `gh` (the GitHub CLI) installed and outbound network
+access to `github.com`. `gh` is only required to open pull requests; clone/open work without it.
+Idle sandboxes are stopped by the provider after `MASTRACODE_SANDBOX_IDLE_MINUTES`; the next open
+detects the stopped VM and re-provisions automatically.
+Without a sandbox provider, users can still connect GitHub and pick repos, but opening a repo
+project shows a clear "sandbox not configured" error.
+
+### Per-(org,user) storage isolation
+
+When WorkOS web auth is enabled, the tenant boundary is the **(organization, user)** pair: each
+user in each org operates against their own dedicated libSQL database for all agent state (threads,
+messages, memory, observational memory, recall vectors) — no tenant can read another tenant's data
+at the storage layer. Two users in the same org are isolated, and the same user across two orgs is
+also isolated. The database location is derived server-side from a hash of `(orgId, userId)` (no
+client-supplied paths); users without an org fall back to a user-only key.
+
+```bash
+# Local files (default): one isolated DB dir per tenant under this root
+export MASTRACODE_TENANT_DB_ROOT=~/.mastracode/web/tenants    # optional
+
+# Or remote libSQL/Turso per tenant ({id} = hashed (orgId, userId)). This mode
+# assumes each tenant DB already exists at the templated URL.
+export MASTRACODE_TENANT_DB_URL_TEMPLATE=libsql://{id}-org.turso.io        # optional
+export MASTRACODE_TENANT_VECTOR_URL_TEMPLATE=libsql://{id}-vec-org.turso.io # optional
+export MASTRACODE_TENANT_DB_AUTH_TOKEN=...                                  # optional
+export MASTRACODE_TENANT_VECTOR_AUTH_TOKEN=...                              # optional
+
+# Or auto-provision a Turso database per tenant on first access via the Turso
+# Platform API (no pre-created DBs needed). Requires APP_DATABASE_URL: the
+# stable db-name/hostname mapping is persisted there so replicas converge on
+# one DB and cold starts don't re-create it. A scoped token is minted fresh per
+# resolution, so no long-lived credential is stored.
+export MASTRACODE_TURSO_PLATFORM_TOKEN=...    # optional
+export MASTRACODE_TURSO_ORG=my-org            # optional
+export MASTRACODE_TURSO_GROUP=default         # optional (default "default")
+```
+
+Resolution priority: explicit `MASTRACODE_TENANT_DB_URL_TEMPLATE` → Turso
+auto-provisioning (when the platform token + org are set) → local libSQL files.
+
+When web auth is disabled the server uses a single shared store, exactly as before.
+
+### Multi-replica deployment
+
+The web server keeps each tenant's Mastra stack in an in-memory cache and serializes per-user git
+write operations. For hosted, multi-replica deployments a few settings make this safe and bounded:
+
+```bash
+# Replica-stable state signing — REQUIRED across replicas. Without an explicit
+# GITHUB_APP_WEBHOOK_SECRET (or WORKOS_COOKIE_PASSWORD) the OAuth/install state
+# is signed with a per-process random key and callbacks fail on other replicas.
+export GITHUB_APP_WEBHOOK_SECRET=...
+
+# Cross-replica serialization of per-(project,user) git writes via Postgres
+# advisory locks (default on, requires APP_DATABASE_URL). Set 0 for local dev.
+export MASTRACODE_DISTRIBUTED_LOCK=1
+
+# Persist/share tenant DBs across replicas — fail/warn at startup if no remote
+# tenant DB backend (URL template OR Turso auto-provisioning) is configured
+# (local-file DBs don't survive restarts or sharing).
+export MASTRACODE_REQUIRE_REMOTE_TENANT_DB=1
+
+# Bound in-memory tenant caches as the team grows.
+export MASTRACODE_TENANT_IDLE_MINUTES=30    # idle eviction window (0 disables)
+export MASTRACODE_TENANT_MAX_APPS=100       # LRU cap on cached stacks (0 disables)
+
+# Per-replica cap on concurrently live sandboxes (0 / unset = unlimited).
+export MASTRACODE_MAX_SANDBOXES=50
+```
+
 ## Architecture
 
 ```

package/dist/{acp-UF33ZDIG.cjs → acp-33VZO665.cjs}

@@ -1,8 +1,8 @@
 'use strict';
 
-var chunkYPTGVE6M_cjs = require('./chunk-YPTGVE6M.cjs');
-var chunkKGBCGF6C_cjs = require('./chunk-KGBCGF6C.cjs');
 var chunkVBH3L4LD_cjs = require('./chunk-VBH3L4LD.cjs');
+var chunkHADE25EX_cjs = require('./chunk-HADE25EX.cjs');
+var chunkWX46SWL3_cjs = require('./chunk-WX46SWL3.cjs');
 var crypto = require('crypto');
 var stream = require('stream');
 var sdk = require('@agentclientprotocol/sdk');
@@ -45,7 +45,7 @@ async function acpMain(options) {
   };
   let result;
   try {
-    result = await chunkYPTGVE6M_cjs.createMastraCode({
+    result = await chunkHADE25EX_cjs.createMastraCode({
       unixSocketPubSub: false,
       disableMcp: false,
       disableHooks: false
@@ -57,12 +57,12 @@ async function acpMain(options) {
       { id: "fast", name: "Fast" }
     ];
     const cleanup = async () => {
-      chunkKGBCGF6C_cjs.releaseAllThreadLocks();
+      chunkWX46SWL3_cjs.releaseAllThreadLocks();
       const closeSignalsPubSub = signalsPubSub?.close;
       await Promise.allSettled([
         mcpManager?.disconnect(),
         controller?.getMastra()?.stopWorkers(),
-        controller?.stopHeartbeats(),
+        controller?.stopIntervals(),
         closeSignalsPubSub?.()
       ]);
       console.log = originalConsoleLog;
@@ -83,5 +83,5 @@ async function acpMain(options) {
 }
 
 exports.acpMain = acpMain;
-//# sourceMappingURL=acp-UF33ZDIG.cjs.map
-//# sourceMappingURL=acp-UF33ZDIG.cjs.map
+//# sourceMappingURL=acp-33VZO665.cjs.map
+//# sourceMappingURL=acp-33VZO665.cjs.map

package/dist/{acp-UF33ZDIG.cjs.map → acp-33VZO665.cjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/acp/server.ts","../src/acp/index.ts"],"names":["Readable","Writable","stream","ndJsonStream","randomUUID","AgentSideConnection","MastraCodeAcpAgent","setAutoApprove","createMastraCode","releaseAllThreadLocks"],"mappings":";;;;;;;;;AAUA,eAAsB,YAAA,CACpB,UAAA,EACA,KAAA,EACA,OAAA,EACe;AAEf,EAAA,MAAM,KAAA,GAAQA,eAAA,CAAS,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA;AAC1C,EAAA,MAAM,MAAA,GAASC,eAAA,CAAS,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA;AAC5C,EAAA,MAAMC,QAAA,GAASC,gBAAA,CAAa,MAAA,EAAQ,KAAK,CAAA;AACzC,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI,KAAA;AAGJ,EAAA,IAAI;AACF,IAAA,OAAA,GAAU,MAAM,WAAW,aAAA,CAAc;AAAA,MACvC,EAAA,EAAI,CAAA,IAAA,EAAOC,iBAAA,EAAY,CAAA,CAAA;AAAA,MACvB,OAAA,EAAS,CAAA,UAAA,EAAaA,iBAAA,EAAY,CAAA;AAAA,KACnC,CAAA;AACD,IAAA,MAAM,aAAA,GAAgB,OAAA;AAGtB,IAAA,MAAM,UAAA,GAAa,IAAIC,uBAAA,CAAoB,CAAA,IAAA,KAAQ;AACjD,MAAA,KAAA,GAAQ,IAAIC,oCAAA,CAAmB,IAAA,EAAM,UAAA,EAAY,eAAe,KAAK,CAAA;AACrE,MAAA,OAAO,KAAA;AAAA,IACT,GAAGJ,QAAM,CAAA;AAET,IAAA,MAAM,UAAA,CAAW,MAAA;AAAA,EACnB,CAAA,SAAE;AACA,IAAA,KAAA,EAAO,OAAA,EAAQ;AACf,IAAA,OAAA,EAAS,OAAO,iBAAA,EAAkB;AAClC,IAAA,MAAM,OAAA,EAAS,OAAO,mBAAA,EAAoB;AAC1C,IAAA,IAAI,OAAA,EAAS;AACX,MAAA,MAAM,OAAA,EAAQ;AAAA,IAChB;AAAA,EACF;AACF;;;AClCA,eAAsB,QAAQ,OAAA,EAA6D;AACzF,EAAA,IAAI,SAAS,oBAAA,EAAsB;AACjC,IAAAK,gCAAA,CAAe,IAAI,CAAA;AAAA,EACrB;AAGA,EAAA,MAAM,qBAAqB,OAAA,CAAQ,GAAA;AAEnC,EAAA,OAAA,CAAQ,GAAA,GAAM,IAAI,IAAA,KAAoB;AACpC,IAAA,OAAA,CAAQ,MAAA,CAAO,MAAM,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA,GAAI,IAAI,CAAA;AAAA,EACxD,CAAA;AAEA,EAAA,IAAI,MAAA;AAEJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,MAAMC,kCAAA,CAAiB;AAAA,MAC9B,gBAAA,EAAkB,KAAA;AAAA,MAClB,UAAA,EAAY,KAAA;AAAA,MACZ,YAAA,EAAc;AAAA,KACf,CAAA;AAED,IAAA,MAAM,EAAE,UAAA,EAAY,UAAA,EAAY,aAAA,EAAc,GAAI,MAAA;AAGlD,IAAA,MAAM,KAAA,GAA+B;AAAA,MACnC,EAAE,EAAA,EAAI,OAAA,EAAS,IAAA,EAAM,OAAA,EAAQ;AAAA,MAC7B,EAAE,EAAA,EAAI,MAAA,EAAQ,IAAA,EAAM,MAAA,EAAO;AAAA,MAC3B,EAAE,EAAA,EAAI,MAAA,EAAQ,IAAA,EAAM,MAAA;AAAO,KAC7B;AAGA,IAAA,MAAM,UAAU,YAAY;AAC1B,MAAAC,uCAAA,EAAsB;AACtB,MAAA,MAAM,qBAAsB,aAAA,EAAsE,KAAA;AAClG,MAAA,MAAM,QAAQ,UAAA,CAAW;AAAA,QACvB,YAAY,UAAA,EAAW;AAAA,QACvB,UAAA,EAAY,SAAA,EAAU,EAAG,WAAA,EAAY;AAAA,QACrC,YAAY,cAAA,EAAe;AAAA,QAC3B,kBAAA;AAAqB,OACtB,CAAA;AAID,MAAA,OAAA,CAAQ,GAAA,GAAM,kBAAA;AAAA,IAChB,CAAA;AAGA,IAAA,MAAM,eAAe,YAAY;AAC/B,MAAA,MAAM,OAAA,EAAQ;AACd,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IAChB,CAAA;AAEA,IAAA,OAAA,CAAQ,EAAA,CAAG,UAAU,YAAY,CAAA;AACjC,IAAA,OAAA,CAAQ,EAAA,CAAG,WAAW,YAAY,CAAA;AAElC,IAAA,MAAM,YAAA,CAAa,UAAA,EAAY,KAAA,EAAO,OAAO,CAAA;AAAA,EAC/C,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,mBAAA,EAAsB,KAAK;AAAA,CAAI,CAAA;AAEpD,IAAA,OAAA,CAAQ,GAAA,GAAM,kBAAA;AACd,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AACF","file":"acp-UF33ZDIG.cjs","sourcesContent":["import { randomUUID } from 'node:crypto';\nimport { Readable, Writable } from 'node:stream';\nimport { AgentSideConnection, ndJsonStream } from '@agentclientprotocol/sdk';\nimport type { AgentController, AgentControllerMode, Session } from '@mastra/core/agent-controller';\nimport { MastraCodeAcpAgent } from './agent.js';\n\n/**\n * Run the ACP server over stdio.\n * This sets up the JSON-RPC stream and keeps the process alive until the client disconnects.\n */\nexport async function runAcpServer(\n  controller: AgentController,\n  modes: AgentControllerMode[],\n  cleanup?: () => Promise<void>,\n): Promise<void> {\n  // Create the ndJSON stream from stdin/stdout\n  const input = Readable.toWeb(process.stdin) as ReadableStream<Uint8Array>;\n  const output = Writable.toWeb(process.stdout) as WritableStream<Uint8Array>;\n  const stream = ndJsonStream(output, input);\n  let session: Session | undefined;\n  let agent: MastraCodeAcpAgent | undefined;\n\n  // Handle cleanup on disconnect (success or error)\n  try {\n    session = await controller.createSession({\n      id: `acp-${randomUUID()}`,\n      ownerId: `acp-owner-${randomUUID()}`,\n    });\n    const activeSession = session;\n\n    // Create the agent-side connection\n    const connection = new AgentSideConnection(conn => {\n      agent = new MastraCodeAcpAgent(conn, controller, activeSession, modes);\n      return agent;\n    }, stream);\n\n    await connection.closed;\n  } finally {\n    agent?.dispose();\n    session?.thread.detachFromCurrent();\n    await session?.thread.clearAndReleaseLock();\n    if (cleanup) {\n      await cleanup();\n    }\n  }\n}\n","import type { AgentControllerMode } from '@mastra/core/agent-controller';\n\nimport { createMastraCode } from '../index.js';\nimport { releaseAllThreadLocks } from '../utils/thread-lock.js';\nimport { setAutoApprove } from './event-mapper.js';\nimport { runAcpServer } from './server.js';\n\n/**\n * Entry point for ACP server mode.\n * Initializes mastracode and runs the ACP protocol over stdio.\n */\nexport async function acpMain(options?: { dangerousAutoApprove?: boolean }): Promise<void> {\n  if (options?.dangerousAutoApprove) {\n    setAutoApprove(true);\n  }\n  // Redirect console.log to stderr to avoid polluting the JSON-RPC stream on stdout.\n  // eslint-disable-next-line no-console\n  const originalConsoleLog = console.log;\n  // eslint-disable-next-line no-console\n  console.log = (...args: unknown[]) => {\n    process.stderr.write(args.map(String).join(' ') + '\\n');\n  };\n\n  let result: Awaited<ReturnType<typeof createMastraCode>> | undefined;\n\n  try {\n    result = await createMastraCode({\n      unixSocketPubSub: false,\n      disableMcp: false,\n      disableHooks: false,\n    });\n\n    const { controller, mcpManager, signalsPubSub } = result;\n\n    // Default modes (same as createMastraCode defaults)\n    const modes: AgentControllerMode[] = [\n      { id: 'build', name: 'Build' },\n      { id: 'plan', name: 'Plan' },\n      { id: 'fast', name: 'Fast' },\n    ];\n\n    // Cleanup function (mirrors main.ts asyncCleanup)\n    const cleanup = async () => {\n      releaseAllThreadLocks();\n      const closeSignalsPubSub = (signalsPubSub as { close?: () => Promise<void> | void } | undefined)?.close;\n      await Promise.allSettled([\n        mcpManager?.disconnect(),\n        controller?.getMastra()?.stopWorkers(),\n        controller?.stopHeartbeats(),\n        closeSignalsPubSub?.(),\n      ]);\n\n      // Restore console.log\n      // eslint-disable-next-line no-console\n      console.log = originalConsoleLog;\n    };\n\n    // Handle signals\n    const handleSignal = async () => {\n      await cleanup();\n      process.exit(0);\n    };\n\n    process.on('SIGINT', handleSignal);\n    process.on('SIGTERM', handleSignal);\n\n    await runAcpServer(controller, modes, cleanup);\n  } catch (error) {\n    process.stderr.write(`[acp] Fatal error: ${error}\\n`);\n    // eslint-disable-next-line no-console\n    console.log = originalConsoleLog;\n    process.exit(1);\n  }\n}\n"]}
+{"version":3,"sources":["../src/acp/server.ts","../src/acp/index.ts"],"names":["Readable","Writable","stream","ndJsonStream","randomUUID","AgentSideConnection","MastraCodeAcpAgent","setAutoApprove","createMastraCode","releaseAllThreadLocks"],"mappings":";;;;;;;;;AAUA,eAAsB,YAAA,CACpB,UAAA,EACA,KAAA,EACA,OAAA,EACe;AAEf,EAAA,MAAM,KAAA,GAAQA,eAAA,CAAS,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA;AAC1C,EAAA,MAAM,MAAA,GAASC,eAAA,CAAS,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA;AAC5C,EAAA,MAAMC,QAAA,GAASC,gBAAA,CAAa,MAAA,EAAQ,KAAK,CAAA;AACzC,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI,KAAA;AAGJ,EAAA,IAAI;AACF,IAAA,OAAA,GAAU,MAAM,WAAW,aAAA,CAAc;AAAA,MACvC,EAAA,EAAI,CAAA,IAAA,EAAOC,iBAAA,EAAY,CAAA,CAAA;AAAA,MACvB,OAAA,EAAS,CAAA,UAAA,EAAaA,iBAAA,EAAY,CAAA;AAAA,KACnC,CAAA;AACD,IAAA,MAAM,aAAA,GAAgB,OAAA;AAGtB,IAAA,MAAM,UAAA,GAAa,IAAIC,uBAAA,CAAoB,CAAA,IAAA,KAAQ;AACjD,MAAA,KAAA,GAAQ,IAAIC,oCAAA,CAAmB,IAAA,EAAM,UAAA,EAAY,eAAe,KAAK,CAAA;AACrE,MAAA,OAAO,KAAA;AAAA,IACT,GAAGJ,QAAM,CAAA;AAET,IAAA,MAAM,UAAA,CAAW,MAAA;AAAA,EACnB,CAAA,SAAE;AACA,IAAA,KAAA,EAAO,OAAA,EAAQ;AACf,IAAA,OAAA,EAAS,OAAO,iBAAA,EAAkB;AAClC,IAAA,MAAM,OAAA,EAAS,OAAO,mBAAA,EAAoB;AAC1C,IAAA,IAAI,OAAA,EAAS;AACX,MAAA,MAAM,OAAA,EAAQ;AAAA,IAChB;AAAA,EACF;AACF;;;AClCA,eAAsB,QAAQ,OAAA,EAA6D;AACzF,EAAA,IAAI,SAAS,oBAAA,EAAsB;AACjC,IAAAK,gCAAA,CAAe,IAAI,CAAA;AAAA,EACrB;AAGA,EAAA,MAAM,qBAAqB,OAAA,CAAQ,GAAA;AAEnC,EAAA,OAAA,CAAQ,GAAA,GAAM,IAAI,IAAA,KAAoB;AACpC,IAAA,OAAA,CAAQ,MAAA,CAAO,MAAM,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA,GAAI,IAAI,CAAA;AAAA,EACxD,CAAA;AAEA,EAAA,IAAI,MAAA;AAEJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,MAAMC,kCAAA,CAAiB;AAAA,MAC9B,gBAAA,EAAkB,KAAA;AAAA,MAClB,UAAA,EAAY,KAAA;AAAA,MACZ,YAAA,EAAc;AAAA,KACf,CAAA;AAED,IAAA,MAAM,EAAE,UAAA,EAAY,UAAA,EAAY,aAAA,EAAc,GAAI,MAAA;AAGlD,IAAA,MAAM,KAAA,GAA+B;AAAA,MACnC,EAAE,EAAA,EAAI,OAAA,EAAS,IAAA,EAAM,OAAA,EAAQ;AAAA,MAC7B,EAAE,EAAA,EAAI,MAAA,EAAQ,IAAA,EAAM,MAAA,EAAO;AAAA,MAC3B,EAAE,EAAA,EAAI,MAAA,EAAQ,IAAA,EAAM,MAAA;AAAO,KAC7B;AAGA,IAAA,MAAM,UAAU,YAAY;AAC1B,MAAAC,uCAAA,EAAsB;AACtB,MAAA,MAAM,qBAAsB,aAAA,EAAsE,KAAA;AAClG,MAAA,MAAM,QAAQ,UAAA,CAAW;AAAA,QACvB,YAAY,UAAA,EAAW;AAAA,QACvB,UAAA,EAAY,SAAA,EAAU,EAAG,WAAA,EAAY;AAAA,QACrC,YAAY,aAAA,EAAc;AAAA,QAC1B,kBAAA;AAAqB,OACtB,CAAA;AAID,MAAA,OAAA,CAAQ,GAAA,GAAM,kBAAA;AAAA,IAChB,CAAA;AAGA,IAAA,MAAM,eAAe,YAAY;AAC/B,MAAA,MAAM,OAAA,EAAQ;AACd,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IAChB,CAAA;AAEA,IAAA,OAAA,CAAQ,EAAA,CAAG,UAAU,YAAY,CAAA;AACjC,IAAA,OAAA,CAAQ,EAAA,CAAG,WAAW,YAAY,CAAA;AAElC,IAAA,MAAM,YAAA,CAAa,UAAA,EAAY,KAAA,EAAO,OAAO,CAAA;AAAA,EAC/C,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,mBAAA,EAAsB,KAAK;AAAA,CAAI,CAAA;AAEpD,IAAA,OAAA,CAAQ,GAAA,GAAM,kBAAA;AACd,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AACF","file":"acp-33VZO665.cjs","sourcesContent":["import { randomUUID } from 'node:crypto';\nimport { Readable, Writable } from 'node:stream';\nimport { AgentSideConnection, ndJsonStream } from '@agentclientprotocol/sdk';\nimport type { AgentController, AgentControllerMode, Session } from '@mastra/core/agent-controller';\nimport { MastraCodeAcpAgent } from './agent.js';\n\n/**\n * Run the ACP server over stdio.\n * This sets up the JSON-RPC stream and keeps the process alive until the client disconnects.\n */\nexport async function runAcpServer(\n  controller: AgentController,\n  modes: AgentControllerMode[],\n  cleanup?: () => Promise<void>,\n): Promise<void> {\n  // Create the ndJSON stream from stdin/stdout\n  const input = Readable.toWeb(process.stdin) as ReadableStream<Uint8Array>;\n  const output = Writable.toWeb(process.stdout) as WritableStream<Uint8Array>;\n  const stream = ndJsonStream(output, input);\n  let session: Session | undefined;\n  let agent: MastraCodeAcpAgent | undefined;\n\n  // Handle cleanup on disconnect (success or error)\n  try {\n    session = await controller.createSession({\n      id: `acp-${randomUUID()}`,\n      ownerId: `acp-owner-${randomUUID()}`,\n    });\n    const activeSession = session;\n\n    // Create the agent-side connection\n    const connection = new AgentSideConnection(conn => {\n      agent = new MastraCodeAcpAgent(conn, controller, activeSession, modes);\n      return agent;\n    }, stream);\n\n    await connection.closed;\n  } finally {\n    agent?.dispose();\n    session?.thread.detachFromCurrent();\n    await session?.thread.clearAndReleaseLock();\n    if (cleanup) {\n      await cleanup();\n    }\n  }\n}\n","import type { AgentControllerMode } from '@mastra/core/agent-controller';\n\nimport { createMastraCode } from '../index.js';\nimport { releaseAllThreadLocks } from '../utils/thread-lock.js';\nimport { setAutoApprove } from './event-mapper.js';\nimport { runAcpServer } from './server.js';\n\n/**\n * Entry point for ACP server mode.\n * Initializes mastracode and runs the ACP protocol over stdio.\n */\nexport async function acpMain(options?: { dangerousAutoApprove?: boolean }): Promise<void> {\n  if (options?.dangerousAutoApprove) {\n    setAutoApprove(true);\n  }\n  // Redirect console.log to stderr to avoid polluting the JSON-RPC stream on stdout.\n  // eslint-disable-next-line no-console\n  const originalConsoleLog = console.log;\n  // eslint-disable-next-line no-console\n  console.log = (...args: unknown[]) => {\n    process.stderr.write(args.map(String).join(' ') + '\\n');\n  };\n\n  let result: Awaited<ReturnType<typeof createMastraCode>> | undefined;\n\n  try {\n    result = await createMastraCode({\n      unixSocketPubSub: false,\n      disableMcp: false,\n      disableHooks: false,\n    });\n\n    const { controller, mcpManager, signalsPubSub } = result;\n\n    // Default modes (same as createMastraCode defaults)\n    const modes: AgentControllerMode[] = [\n      { id: 'build', name: 'Build' },\n      { id: 'plan', name: 'Plan' },\n      { id: 'fast', name: 'Fast' },\n    ];\n\n    // Cleanup function (mirrors main.ts asyncCleanup)\n    const cleanup = async () => {\n      releaseAllThreadLocks();\n      const closeSignalsPubSub = (signalsPubSub as { close?: () => Promise<void> | void } | undefined)?.close;\n      await Promise.allSettled([\n        mcpManager?.disconnect(),\n        controller?.getMastra()?.stopWorkers(),\n        controller?.stopIntervals(),\n        closeSignalsPubSub?.(),\n      ]);\n\n      // Restore console.log\n      // eslint-disable-next-line no-console\n      console.log = originalConsoleLog;\n    };\n\n    // Handle signals\n    const handleSignal = async () => {\n      await cleanup();\n      process.exit(0);\n    };\n\n    process.on('SIGINT', handleSignal);\n    process.on('SIGTERM', handleSignal);\n\n    await runAcpServer(controller, modes, cleanup);\n  } catch (error) {\n    process.stderr.write(`[acp] Fatal error: ${error}\\n`);\n    // eslint-disable-next-line no-console\n    console.log = originalConsoleLog;\n    process.exit(1);\n  }\n}\n"]}

package/dist/{acp-LENNVD37.js → acp-AFC64ZEZ.js}

@@ -1,6 +1,6 @@
-import { createMastraCode } from './chunk-IVWQHERI.js';
-import { releaseAllThreadLocks } from './chunk-NDCWIAKG.js';
 import { setAutoApprove, MastraCodeAcpAgent } from './chunk-IFUIWWGJ.js';
+import { createMastraCode } from './chunk-KP5DGNCF.js';
+import { releaseAllThreadLocks } from './chunk-GAPPKMQT.js';
 import { randomUUID } from 'crypto';
 import { Readable, Writable } from 'stream';
 import { ndJsonStream, AgentSideConnection } from '@agentclientprotocol/sdk';
@@ -60,7 +60,7 @@ async function acpMain(options) {
       await Promise.allSettled([
         mcpManager?.disconnect(),
         controller?.getMastra()?.stopWorkers(),
-        controller?.stopHeartbeats(),
+        controller?.stopIntervals(),
         closeSignalsPubSub?.()
       ]);
       console.log = originalConsoleLog;
@@ -81,5 +81,5 @@ async function acpMain(options) {
 }
 
 export { acpMain };
-//# sourceMappingURL=acp-LENNVD37.js.map
-//# sourceMappingURL=acp-LENNVD37.js.map
+//# sourceMappingURL=acp-AFC64ZEZ.js.map
+//# sourceMappingURL=acp-AFC64ZEZ.js.map

package/dist/{acp-LENNVD37.js.map → acp-AFC64ZEZ.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/acp/server.ts","../src/acp/index.ts"],"names":[],"mappings":";;;;;;;AAUA,eAAsB,YAAA,CACpB,UAAA,EACA,KAAA,EACA,OAAA,EACe;AAEf,EAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA;AAC1C,EAAA,MAAM,MAAA,GAAS,QAAA,CAAS,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA;AAC5C,EAAA,MAAM,MAAA,GAAS,YAAA,CAAa,MAAA,EAAQ,KAAK,CAAA;AACzC,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI,KAAA;AAGJ,EAAA,IAAI;AACF,IAAA,OAAA,GAAU,MAAM,WAAW,aAAA,CAAc;AAAA,MACvC,EAAA,EAAI,CAAA,IAAA,EAAO,UAAA,EAAY,CAAA,CAAA;AAAA,MACvB,OAAA,EAAS,CAAA,UAAA,EAAa,UAAA,EAAY,CAAA;AAAA,KACnC,CAAA;AACD,IAAA,MAAM,aAAA,GAAgB,OAAA;AAGtB,IAAA,MAAM,UAAA,GAAa,IAAI,mBAAA,CAAoB,CAAA,IAAA,KAAQ;AACjD,MAAA,KAAA,GAAQ,IAAI,kBAAA,CAAmB,IAAA,EAAM,UAAA,EAAY,eAAe,KAAK,CAAA;AACrE,MAAA,OAAO,KAAA;AAAA,IACT,GAAG,MAAM,CAAA;AAET,IAAA,MAAM,UAAA,CAAW,MAAA;AAAA,EACnB,CAAA,SAAE;AACA,IAAA,KAAA,EAAO,OAAA,EAAQ;AACf,IAAA,OAAA,EAAS,OAAO,iBAAA,EAAkB;AAClC,IAAA,MAAM,OAAA,EAAS,OAAO,mBAAA,EAAoB;AAC1C,IAAA,IAAI,OAAA,EAAS;AACX,MAAA,MAAM,OAAA,EAAQ;AAAA,IAChB;AAAA,EACF;AACF;;;AClCA,eAAsB,QAAQ,OAAA,EAA6D;AACzF,EAAA,IAAI,SAAS,oBAAA,EAAsB;AACjC,IAAA,cAAA,CAAe,IAAI,CAAA;AAAA,EACrB;AAGA,EAAA,MAAM,qBAAqB,OAAA,CAAQ,GAAA;AAEnC,EAAA,OAAA,CAAQ,GAAA,GAAM,IAAI,IAAA,KAAoB;AACpC,IAAA,OAAA,CAAQ,MAAA,CAAO,MAAM,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA,GAAI,IAAI,CAAA;AAAA,EACxD,CAAA;AAEA,EAAA,IAAI,MAAA;AAEJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,MAAM,gBAAA,CAAiB;AAAA,MAC9B,gBAAA,EAAkB,KAAA;AAAA,MAClB,UAAA,EAAY,KAAA;AAAA,MACZ,YAAA,EAAc;AAAA,KACf,CAAA;AAED,IAAA,MAAM,EAAE,UAAA,EAAY,UAAA,EAAY,aAAA,EAAc,GAAI,MAAA;AAGlD,IAAA,MAAM,KAAA,GAA+B;AAAA,MACnC,EAAE,EAAA,EAAI,OAAA,EAAS,IAAA,EAAM,OAAA,EAAQ;AAAA,MAC7B,EAAE,EAAA,EAAI,MAAA,EAAQ,IAAA,EAAM,MAAA,EAAO;AAAA,MAC3B,EAAE,EAAA,EAAI,MAAA,EAAQ,IAAA,EAAM,MAAA;AAAO,KAC7B;AAGA,IAAA,MAAM,UAAU,YAAY;AAC1B,MAAA,qBAAA,EAAsB;AACtB,MAAA,MAAM,qBAAsB,aAAA,EAAsE,KAAA;AAClG,MAAA,MAAM,QAAQ,UAAA,CAAW;AAAA,QACvB,YAAY,UAAA,EAAW;AAAA,QACvB,UAAA,EAAY,SAAA,EAAU,EAAG,WAAA,EAAY;AAAA,QACrC,YAAY,cAAA,EAAe;AAAA,QAC3B,kBAAA;AAAqB,OACtB,CAAA;AAID,MAAA,OAAA,CAAQ,GAAA,GAAM,kBAAA;AAAA,IAChB,CAAA;AAGA,IAAA,MAAM,eAAe,YAAY;AAC/B,MAAA,MAAM,OAAA,EAAQ;AACd,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IAChB,CAAA;AAEA,IAAA,OAAA,CAAQ,EAAA,CAAG,UAAU,YAAY,CAAA;AACjC,IAAA,OAAA,CAAQ,EAAA,CAAG,WAAW,YAAY,CAAA;AAElC,IAAA,MAAM,YAAA,CAAa,UAAA,EAAY,KAAA,EAAO,OAAO,CAAA;AAAA,EAC/C,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,mBAAA,EAAsB,KAAK;AAAA,CAAI,CAAA;AAEpD,IAAA,OAAA,CAAQ,GAAA,GAAM,kBAAA;AACd,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AACF","file":"acp-LENNVD37.js","sourcesContent":["import { randomUUID } from 'node:crypto';\nimport { Readable, Writable } from 'node:stream';\nimport { AgentSideConnection, ndJsonStream } from '@agentclientprotocol/sdk';\nimport type { AgentController, AgentControllerMode, Session } from '@mastra/core/agent-controller';\nimport { MastraCodeAcpAgent } from './agent.js';\n\n/**\n * Run the ACP server over stdio.\n * This sets up the JSON-RPC stream and keeps the process alive until the client disconnects.\n */\nexport async function runAcpServer(\n  controller: AgentController,\n  modes: AgentControllerMode[],\n  cleanup?: () => Promise<void>,\n): Promise<void> {\n  // Create the ndJSON stream from stdin/stdout\n  const input = Readable.toWeb(process.stdin) as ReadableStream<Uint8Array>;\n  const output = Writable.toWeb(process.stdout) as WritableStream<Uint8Array>;\n  const stream = ndJsonStream(output, input);\n  let session: Session | undefined;\n  let agent: MastraCodeAcpAgent | undefined;\n\n  // Handle cleanup on disconnect (success or error)\n  try {\n    session = await controller.createSession({\n      id: `acp-${randomUUID()}`,\n      ownerId: `acp-owner-${randomUUID()}`,\n    });\n    const activeSession = session;\n\n    // Create the agent-side connection\n    const connection = new AgentSideConnection(conn => {\n      agent = new MastraCodeAcpAgent(conn, controller, activeSession, modes);\n      return agent;\n    }, stream);\n\n    await connection.closed;\n  } finally {\n    agent?.dispose();\n    session?.thread.detachFromCurrent();\n    await session?.thread.clearAndReleaseLock();\n    if (cleanup) {\n      await cleanup();\n    }\n  }\n}\n","import type { AgentControllerMode } from '@mastra/core/agent-controller';\n\nimport { createMastraCode } from '../index.js';\nimport { releaseAllThreadLocks } from '../utils/thread-lock.js';\nimport { setAutoApprove } from './event-mapper.js';\nimport { runAcpServer } from './server.js';\n\n/**\n * Entry point for ACP server mode.\n * Initializes mastracode and runs the ACP protocol over stdio.\n */\nexport async function acpMain(options?: { dangerousAutoApprove?: boolean }): Promise<void> {\n  if (options?.dangerousAutoApprove) {\n    setAutoApprove(true);\n  }\n  // Redirect console.log to stderr to avoid polluting the JSON-RPC stream on stdout.\n  // eslint-disable-next-line no-console\n  const originalConsoleLog = console.log;\n  // eslint-disable-next-line no-console\n  console.log = (...args: unknown[]) => {\n    process.stderr.write(args.map(String).join(' ') + '\\n');\n  };\n\n  let result: Awaited<ReturnType<typeof createMastraCode>> | undefined;\n\n  try {\n    result = await createMastraCode({\n      unixSocketPubSub: false,\n      disableMcp: false,\n      disableHooks: false,\n    });\n\n    const { controller, mcpManager, signalsPubSub } = result;\n\n    // Default modes (same as createMastraCode defaults)\n    const modes: AgentControllerMode[] = [\n      { id: 'build', name: 'Build' },\n      { id: 'plan', name: 'Plan' },\n      { id: 'fast', name: 'Fast' },\n    ];\n\n    // Cleanup function (mirrors main.ts asyncCleanup)\n    const cleanup = async () => {\n      releaseAllThreadLocks();\n      const closeSignalsPubSub = (signalsPubSub as { close?: () => Promise<void> | void } | undefined)?.close;\n      await Promise.allSettled([\n        mcpManager?.disconnect(),\n        controller?.getMastra()?.stopWorkers(),\n        controller?.stopHeartbeats(),\n        closeSignalsPubSub?.(),\n      ]);\n\n      // Restore console.log\n      // eslint-disable-next-line no-console\n      console.log = originalConsoleLog;\n    };\n\n    // Handle signals\n    const handleSignal = async () => {\n      await cleanup();\n      process.exit(0);\n    };\n\n    process.on('SIGINT', handleSignal);\n    process.on('SIGTERM', handleSignal);\n\n    await runAcpServer(controller, modes, cleanup);\n  } catch (error) {\n    process.stderr.write(`[acp] Fatal error: ${error}\\n`);\n    // eslint-disable-next-line no-console\n    console.log = originalConsoleLog;\n    process.exit(1);\n  }\n}\n"]}
+{"version":3,"sources":["../src/acp/server.ts","../src/acp/index.ts"],"names":[],"mappings":";;;;;;;AAUA,eAAsB,YAAA,CACpB,UAAA,EACA,KAAA,EACA,OAAA,EACe;AAEf,EAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA;AAC1C,EAAA,MAAM,MAAA,GAAS,QAAA,CAAS,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA;AAC5C,EAAA,MAAM,MAAA,GAAS,YAAA,CAAa,MAAA,EAAQ,KAAK,CAAA;AACzC,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI,KAAA;AAGJ,EAAA,IAAI;AACF,IAAA,OAAA,GAAU,MAAM,WAAW,aAAA,CAAc;AAAA,MACvC,EAAA,EAAI,CAAA,IAAA,EAAO,UAAA,EAAY,CAAA,CAAA;AAAA,MACvB,OAAA,EAAS,CAAA,UAAA,EAAa,UAAA,EAAY,CAAA;AAAA,KACnC,CAAA;AACD,IAAA,MAAM,aAAA,GAAgB,OAAA;AAGtB,IAAA,MAAM,UAAA,GAAa,IAAI,mBAAA,CAAoB,CAAA,IAAA,KAAQ;AACjD,MAAA,KAAA,GAAQ,IAAI,kBAAA,CAAmB,IAAA,EAAM,UAAA,EAAY,eAAe,KAAK,CAAA;AACrE,MAAA,OAAO,KAAA;AAAA,IACT,GAAG,MAAM,CAAA;AAET,IAAA,MAAM,UAAA,CAAW,MAAA;AAAA,EACnB,CAAA,SAAE;AACA,IAAA,KAAA,EAAO,OAAA,EAAQ;AACf,IAAA,OAAA,EAAS,OAAO,iBAAA,EAAkB;AAClC,IAAA,MAAM,OAAA,EAAS,OAAO,mBAAA,EAAoB;AAC1C,IAAA,IAAI,OAAA,EAAS;AACX,MAAA,MAAM,OAAA,EAAQ;AAAA,IAChB;AAAA,EACF;AACF;;;AClCA,eAAsB,QAAQ,OAAA,EAA6D;AACzF,EAAA,IAAI,SAAS,oBAAA,EAAsB;AACjC,IAAA,cAAA,CAAe,IAAI,CAAA;AAAA,EACrB;AAGA,EAAA,MAAM,qBAAqB,OAAA,CAAQ,GAAA;AAEnC,EAAA,OAAA,CAAQ,GAAA,GAAM,IAAI,IAAA,KAAoB;AACpC,IAAA,OAAA,CAAQ,MAAA,CAAO,MAAM,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA,GAAI,IAAI,CAAA;AAAA,EACxD,CAAA;AAEA,EAAA,IAAI,MAAA;AAEJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,MAAM,gBAAA,CAAiB;AAAA,MAC9B,gBAAA,EAAkB,KAAA;AAAA,MAClB,UAAA,EAAY,KAAA;AAAA,MACZ,YAAA,EAAc;AAAA,KACf,CAAA;AAED,IAAA,MAAM,EAAE,UAAA,EAAY,UAAA,EAAY,aAAA,EAAc,GAAI,MAAA;AAGlD,IAAA,MAAM,KAAA,GAA+B;AAAA,MACnC,EAAE,EAAA,EAAI,OAAA,EAAS,IAAA,EAAM,OAAA,EAAQ;AAAA,MAC7B,EAAE,EAAA,EAAI,MAAA,EAAQ,IAAA,EAAM,MAAA,EAAO;AAAA,MAC3B,EAAE,EAAA,EAAI,MAAA,EAAQ,IAAA,EAAM,MAAA;AAAO,KAC7B;AAGA,IAAA,MAAM,UAAU,YAAY;AAC1B,MAAA,qBAAA,EAAsB;AACtB,MAAA,MAAM,qBAAsB,aAAA,EAAsE,KAAA;AAClG,MAAA,MAAM,QAAQ,UAAA,CAAW;AAAA,QACvB,YAAY,UAAA,EAAW;AAAA,QACvB,UAAA,EAAY,SAAA,EAAU,EAAG,WAAA,EAAY;AAAA,QACrC,YAAY,aAAA,EAAc;AAAA,QAC1B,kBAAA;AAAqB,OACtB,CAAA;AAID,MAAA,OAAA,CAAQ,GAAA,GAAM,kBAAA;AAAA,IAChB,CAAA;AAGA,IAAA,MAAM,eAAe,YAAY;AAC/B,MAAA,MAAM,OAAA,EAAQ;AACd,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IAChB,CAAA;AAEA,IAAA,OAAA,CAAQ,EAAA,CAAG,UAAU,YAAY,CAAA;AACjC,IAAA,OAAA,CAAQ,EAAA,CAAG,WAAW,YAAY,CAAA;AAElC,IAAA,MAAM,YAAA,CAAa,UAAA,EAAY,KAAA,EAAO,OAAO,CAAA;AAAA,EAC/C,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,mBAAA,EAAsB,KAAK;AAAA,CAAI,CAAA;AAEpD,IAAA,OAAA,CAAQ,GAAA,GAAM,kBAAA;AACd,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AACF","file":"acp-AFC64ZEZ.js","sourcesContent":["import { randomUUID } from 'node:crypto';\nimport { Readable, Writable } from 'node:stream';\nimport { AgentSideConnection, ndJsonStream } from '@agentclientprotocol/sdk';\nimport type { AgentController, AgentControllerMode, Session } from '@mastra/core/agent-controller';\nimport { MastraCodeAcpAgent } from './agent.js';\n\n/**\n * Run the ACP server over stdio.\n * This sets up the JSON-RPC stream and keeps the process alive until the client disconnects.\n */\nexport async function runAcpServer(\n  controller: AgentController,\n  modes: AgentControllerMode[],\n  cleanup?: () => Promise<void>,\n): Promise<void> {\n  // Create the ndJSON stream from stdin/stdout\n  const input = Readable.toWeb(process.stdin) as ReadableStream<Uint8Array>;\n  const output = Writable.toWeb(process.stdout) as WritableStream<Uint8Array>;\n  const stream = ndJsonStream(output, input);\n  let session: Session | undefined;\n  let agent: MastraCodeAcpAgent | undefined;\n\n  // Handle cleanup on disconnect (success or error)\n  try {\n    session = await controller.createSession({\n      id: `acp-${randomUUID()}`,\n      ownerId: `acp-owner-${randomUUID()}`,\n    });\n    const activeSession = session;\n\n    // Create the agent-side connection\n    const connection = new AgentSideConnection(conn => {\n      agent = new MastraCodeAcpAgent(conn, controller, activeSession, modes);\n      return agent;\n    }, stream);\n\n    await connection.closed;\n  } finally {\n    agent?.dispose();\n    session?.thread.detachFromCurrent();\n    await session?.thread.clearAndReleaseLock();\n    if (cleanup) {\n      await cleanup();\n    }\n  }\n}\n","import type { AgentControllerMode } from '@mastra/core/agent-controller';\n\nimport { createMastraCode } from '../index.js';\nimport { releaseAllThreadLocks } from '../utils/thread-lock.js';\nimport { setAutoApprove } from './event-mapper.js';\nimport { runAcpServer } from './server.js';\n\n/**\n * Entry point for ACP server mode.\n * Initializes mastracode and runs the ACP protocol over stdio.\n */\nexport async function acpMain(options?: { dangerousAutoApprove?: boolean }): Promise<void> {\n  if (options?.dangerousAutoApprove) {\n    setAutoApprove(true);\n  }\n  // Redirect console.log to stderr to avoid polluting the JSON-RPC stream on stdout.\n  // eslint-disable-next-line no-console\n  const originalConsoleLog = console.log;\n  // eslint-disable-next-line no-console\n  console.log = (...args: unknown[]) => {\n    process.stderr.write(args.map(String).join(' ') + '\\n');\n  };\n\n  let result: Awaited<ReturnType<typeof createMastraCode>> | undefined;\n\n  try {\n    result = await createMastraCode({\n      unixSocketPubSub: false,\n      disableMcp: false,\n      disableHooks: false,\n    });\n\n    const { controller, mcpManager, signalsPubSub } = result;\n\n    // Default modes (same as createMastraCode defaults)\n    const modes: AgentControllerMode[] = [\n      { id: 'build', name: 'Build' },\n      { id: 'plan', name: 'Plan' },\n      { id: 'fast', name: 'Fast' },\n    ];\n\n    // Cleanup function (mirrors main.ts asyncCleanup)\n    const cleanup = async () => {\n      releaseAllThreadLocks();\n      const closeSignalsPubSub = (signalsPubSub as { close?: () => Promise<void> | void } | undefined)?.close;\n      await Promise.allSettled([\n        mcpManager?.disconnect(),\n        controller?.getMastra()?.stopWorkers(),\n        controller?.stopIntervals(),\n        closeSignalsPubSub?.(),\n      ]);\n\n      // Restore console.log\n      // eslint-disable-next-line no-console\n      console.log = originalConsoleLog;\n    };\n\n    // Handle signals\n    const handleSignal = async () => {\n      await cleanup();\n      process.exit(0);\n    };\n\n    process.on('SIGINT', handleSignal);\n    process.on('SIGTERM', handleSignal);\n\n    await runAcpServer(controller, modes, cleanup);\n  } catch (error) {\n    process.stderr.write(`[acp] Fatal error: ${error}\\n`);\n    // eslint-disable-next-line no-console\n    console.log = originalConsoleLog;\n    process.exit(1);\n  }\n}\n"]}

package/dist/agents/instructions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"instructions.d.ts","sourceRoot":"","sources":["../../src/agents/instructions.ts"],"names":[],"mappings":"AAOA,wBAAsB,sBAAsB,CAAC,EAAE,cAAc,EAAE,EAAE;IAAE,cAAc,EAAE;QAAE,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAA;CAAE,mBAyBjH"}
+{"version":3,"file":"instructions.d.ts","sourceRoot":"","sources":["../../src/agents/instructions.ts"],"names":[],"mappings":"AAOA,wBAAsB,sBAAsB,CAAC,EAAE,cAAc,EAAE,EAAE;IAAE,cAAc,EAAE;QAAE,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAA;CAAE,mBAiCjH"}

package/dist/agents/model.d.ts

@@ -8,6 +8,12 @@ export type { MastraCodeCustomProvider, MastraCodeGatewayOptions } from './mastr
 type ResolvedModel = GatewayLanguageModel;
 export declare function createMastraCodeGateway(options: MastraCodeGatewayOptions): MastraCodeGateway;
 export declare function createMastraCodeModelCatalogProvider(gateway: MastraModelGatewayInterface): import("@mastra/core/harness").CustomModelCatalogProvider;
+/**
+ * Placeholder for future model ID normalization.
+ * Currently returns the input unchanged, but exists as a seam
+ * for aliasing, casing fixes, or validation in the future.
+ */
+export declare function resolveModelId(modelId: string): string;
 /**
  * Resolve a model ID to the correct provider instance.
  * Shared by the main agent, observer, and reflector.

package/dist/agents/model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../src/agents/model.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAC1F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAEnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAGL,iBAAiB,EAGlB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAExE,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,qBAAqB,EACrB,iBAAiB,EACjB,6BAA6B,EAC7B,WAAW,GACZ,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAElG,KAAK,aAAa,GAAG,oBAAoB,CAAC;AAa1C,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,wBAAwB,GAAG,iBAAiB,CAE5F;AAED,wBAAgB,oCAAoC,CAAC,OAAO,EAAE,2BAA2B,6DAIxF;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;IAAE,aAAa,CAAC,EAAE,aAAa,CAAC;IAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAAC,cAAc,CAAC,EAAE,cAAc,CAAA;CAAE,GACzG,oBAAoB,CAqCtB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,EAAE,cAAc,EAAE,EAAE;IAAE,cAAc,EAAE,cAAc,CAAA;CAAE,GAAG,aAAa,CAWrG;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAC/B,EAAE,cAAc,EAAE,EAAE;IAAE,cAAc,EAAE,cAAc,CAAA;CAAE,EACtD,YAAY,CAAC,EAAE,MAAM,GACpB,aAAa,GAAG,SAAS,CAI3B"}
+{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../src/agents/model.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAC1F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAGnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAGL,iBAAiB,EAGlB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAExE,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,qBAAqB,EACrB,iBAAiB,EACjB,6BAA6B,EAC7B,WAAW,GACZ,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAElG,KAAK,aAAa,GAAG,oBAAoB,CAAC;AAa1C,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,wBAAwB,GAAG,iBAAiB,CAE5F;AAED,wBAAgB,oCAAoC,CAAC,OAAO,EAAE,2BAA2B,6DAIxF;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;IAAE,aAAa,CAAC,EAAE,aAAa,CAAC;IAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAAC,cAAc,CAAC,EAAE,cAAc,CAAA;CAAE,GACzG,oBAAoB,CA+DtB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,EAAE,cAAc,EAAE,EAAE;IAAE,cAAc,EAAE,cAAc,CAAA;CAAE,GAAG,aAAa,CAWrG;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAC/B,EAAE,cAAc,EAAE,EAAE;IAAE,cAAc,EAAE,cAAc,CAAA;CAAE,EACtD,YAAY,CAAC,EAAE,MAAM,GACpB,aAAa,GAAG,SAAS,CAI3B"}

package/dist/agents/prompts/index.d.ts

@@ -1,11 +1,10 @@
 /**
  * Prompt system — exports the prompt builder and mode-specific prompts.
  */
-export { buildBasePrompt } from './base.js';
 export { buildModePrompt, buildModePromptFn } from './build.js';
 export { planModePrompt } from './plan.js';
 export { fastModePrompt } from './fast.js';
-import type { PromptContext as BasePromptContext } from './base.js';
+import type { PromptContext as BasePromptContext } from '@mastra/core/coding-agent';
 export interface PromptContext extends Omit<BasePromptContext, 'toolGuidance'> {
     modeId: string;
     state?: any;

package/dist/agents/prompts/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/agents/prompts/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAK3C,OAAO,KAAK,EAAE,aAAa,IAAI,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAQpE,MAAM,WAAW,aAAc,SAAQ,IAAI,CAAC,iBAAiB,EAAE,cAAc,CAAC;IAC5E,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,GAAG,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAQD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,aAAa,GAAG,MAAM,CAmD1D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/agents/prompts/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAG3C,OAAO,KAAK,EAAE,aAAa,IAAI,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAUpF,MAAM,WAAW,aAAc,SAAQ,IAAI,CAAC,iBAAiB,EAAE,cAAc,CAAC;IAC5E,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,GAAG,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAQD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,aAAa,GAAG,MAAM,CAmD1D"}