{"record":{"id":"acf8e9e902ba69c8","repo":"mastra-ai/mastra","slug":"repository-access-did-not-include-a-bearer-token-f-acf8e9","errorCode":null,"errorMessage":"Repository access did not include a bearer token for the Factory session","messagePattern":"Repository access did not include a bearer token for the Factory session","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"mastracode/factory/src/workspace.ts","lineNumber":415,"sourceCode":"    // there instead of in its session workdir). Pin it to the session workdir\n    // once known. A remote workdir resolves at the sandbox's first start, so\n    // the pin self-heals on the next resolution after the VM has run.\n    if (ctx && workdir && ctx.getState()?.projectPath !== workdir) {\n      await ctx.setState({ projectPath: workdir, projectName: repoFullName });\n    }\n\n    const extensionId = effectiveSkillExtension ? `-${effectiveSkillExtension.id}` : '';\n    const workspaceId = `${WORKSPACE_ID_PREFIX}-${projectRepository.id}-${session.id}${extensionId}`;\n    const workspaceGeneration = workspaceRegistry.generation(session.sessionId);\n    const configDir = DEFAULT_CONFIG_DIR;\n\n    const getRepositoryToken = async (): Promise<string> => {\n      const access = await github.versionControl.getRepositoryAccess({\n        orgId: session.orgId,\n        repositoryId: repository.id,\n      });\n      const token = access.authorization?.token;\n      if (!token) throw new Error('Repository access did not include a bearer token for the Factory session');\n      return token;\n    };\n    const resolveGithubPatKind = async (fallback: GithubPatKind): Promise<GithubPatKind> => {\n      if (!workItems) return 'default';\n      try {\n        const address = getFactorySessionAddress(requestContext);\n        const runBinding = address ? await workItems.findRunBindingBySession(address) : null;\n        return runBinding?.role === 'review' && runBinding.status === 'active' && runBinding.orgId === session.orgId\n          ? 'reviewer'\n          : 'default';\n      } catch {\n        // Preserve the installed role when binding storage is temporarily unavailable.\n        return fallback;\n      }\n    };\n    const registerGithubTokenContext = (registered: GithubTokenRegistration): void => {\n      const generation = registered.generation;\n      registerGithubTokenInjector(requestContext, token => {","sourceCodeStart":397,"sourceCodeEnd":433,"githubUrl":"https://github.com/mastra-ai/mastra/blob/75dd419e613fe9c39f846ffc500716141b74fda6/mastracode/factory/src/workspace.ts#L397-L433","documentation":"The Factory workspace resolves a GitHub bearer token by fetching the repository access record for the session's org and repository. This error is thrown when that record comes back without an `authorization.token`, meaning the backend granted (or reported) access but attached no usable credential. Without the token the sandbox cannot authenticate GitHub operations on behalf of the session.","triggerScenarios":"Calling `getRepositoryToken` (via ghCliToken, reconciliation, or token) when `github.versionControl.getRepositoryAccess({orgId, repositoryId})` resolves to an access object whose `authorization` is undefined or whose `authorization.token` is empty.","commonSituations":"The repository is not actually connected to GitHub App installation for the org; the installation was revoked or expired; backend returns a partial access record after a partial sync; org policy strips tokens; stale session state pointing at a repository whose credentials were rotated away.","solutions":["Verify the repository is connected to the correct GitHub App installation for `session.orgId` and reinstall/re-authorize if revoked","Check the backend getRepositoryAccess response for the repository — ensure authorization token issuance is enabled and the credential store has a token","Re-create or refresh the Factory session so it re-resolves repository access with current credentials","Inspect server logs for credential provisioning failures around the getRepositoryAccess call"],"exampleFix":"// before\nconst token = access.authorization?.token;\nif (!token) throw new Error('Repository access did not include a bearer token for the Factory session');\n// after (caller-side guard)\nconst access = await github.versionControl.getRepositoryAccess({ orgId, repositoryId });\nif (!access.authorization?.token) {\n  await reconnectGithubInstallation(orgId, repositoryId); // re-authorize before retrying\n}\nconst token = access.authorization!.token;","handlingStrategy":"validation","validationCode":"const access = await github.versionControl.getRepositoryAccess({ orgId, repositoryId });\nif (!access.authorization?.token) {\n  throw new Error(`No GitHub token for repo ${repositoryId} in org ${orgId}; reconnect the GitHub installation.`);\n}\n// proceed only when a token exists","typeGuard":"function hasGithubToken(access: RepositoryAccess): access is RepositoryAccess & { authorization: { token: string } } {\n  return typeof access.authorization?.token === 'string' && access.authorization.token.length > 0;\n}","tryCatchPattern":"try {\n  const token = await getRepositoryToken();\n  return token;\n} catch (e) {\n  if (e instanceof Error && e.message.includes('did not include a bearer token')) {\n    await promptReconnectGithubInstallation();\n  }\n  throw e;\n}","preventionTips":["Verify the GitHub App installation for the org before creating Factory sessions","Monitor repository access responses and alert when authorization is present but token is empty","Re-authorize installations before they expire","Include orgId/repositoryId in error telemetry to spot recurring credential gaps"],"tags":["github","auth","missing-token","factory"],"backgroundTag":"missing-github-token","analyzedSha":"75dd419e613fe9c39f846ffc500716141b74fda6","analyzedAt":"2026-08-30T00:15:31.844Z","schemaVersion":2},"datasetVersion":"2026-08-30T03:17:51.788Z"}