mastra-ai/mastra · error

Repository access did not include a bearer token for the Fac

Error message

Repository access did not include a bearer token for the Factory session

What it means

The Factory workspace resolves a GitHub bearer token by fetching the repository access record for the session's org and repository. This error is thrown when that record comes back without an `authorization.token`, meaning the backend granted (or reported) access but attached no usable credential. Without the token the sandbox cannot authenticate GitHub operations on behalf of the session.

Source

Thrown at mastracode/factory/src/workspace.ts:415

    // there instead of in its session workdir). Pin it to the session workdir
    // once known. A remote workdir resolves at the sandbox's first start, so
    // the pin self-heals on the next resolution after the VM has run.
    if (ctx && workdir && ctx.getState()?.projectPath !== workdir) {
      await ctx.setState({ projectPath: workdir, projectName: repoFullName });
    }

    const extensionId = effectiveSkillExtension ? `-${effectiveSkillExtension.id}` : '';
    const workspaceId = `${WORKSPACE_ID_PREFIX}-${projectRepository.id}-${session.id}${extensionId}`;
    const workspaceGeneration = workspaceRegistry.generation(session.sessionId);
    const configDir = DEFAULT_CONFIG_DIR;

    const getRepositoryToken = async (): Promise<string> => {
      const access = await github.versionControl.getRepositoryAccess({
        orgId: session.orgId,
        repositoryId: repository.id,
      });
      const token = access.authorization?.token;
      if (!token) throw new Error('Repository access did not include a bearer token for the Factory session');
      return token;
    };
    const resolveGithubPatKind = async (fallback: GithubPatKind): Promise<GithubPatKind> => {
      if (!workItems) return 'default';
      try {
        const address = getFactorySessionAddress(requestContext);
        const runBinding = address ? await workItems.findRunBindingBySession(address) : null;
        return runBinding?.role === 'review' && runBinding.status === 'active' && runBinding.orgId === session.orgId
          ? 'reviewer'
          : 'default';
      } catch {
        // Preserve the installed role when binding storage is temporarily unavailable.
        return fallback;
      }
    };
    const registerGithubTokenContext = (registered: GithubTokenRegistration): void => {
      const generation = registered.generation;
      registerGithubTokenInjector(requestContext, token => {

View on GitHub (pinned to 75dd419e61)

Solutions

1. Verify the repository is connected to the correct GitHub App installation for `session.orgId` and reinstall/re-authorize if revoked
2. Check the backend getRepositoryAccess response for the repository — ensure authorization token issuance is enabled and the credential store has a token
3. Re-create or refresh the Factory session so it re-resolves repository access with current credentials
4. Inspect server logs for credential provisioning failures around the getRepositoryAccess call

Example fix

// before
const token = access.authorization?.token;
if (!token) throw new Error('Repository access did not include a bearer token for the Factory session');
// after (caller-side guard)
const access = await github.versionControl.getRepositoryAccess({ orgId, repositoryId });
if (!access.authorization?.token) {
  await reconnectGithubInstallation(orgId, repositoryId); // re-authorize before retrying
}
const token = access.authorization!.token;

const access = await github.versionControl.getRepositoryAccess({ orgId, repositoryId });
if (!access.authorization?.token) {
  throw new Error(`No GitHub token for repo ${repositoryId} in org ${orgId}; reconnect the GitHub installation.`);
}
// proceed only when a token exists

function hasGithubToken(access: RepositoryAccess): access is RepositoryAccess & { authorization: { token: string } } {
  return typeof access.authorization?.token === 'string' && access.authorization.token.length > 0;
}

try {
  const token = await getRepositoryToken();
  return token;
} catch (e) {
  if (e instanceof Error && e.message.includes('did not include a bearer token')) {
    await promptReconnectGithubInstallation();
  }
  throw e;
}

When it happens

Trigger: Calling `getRepositoryToken` (via ghCliToken, reconciliation, or token) when `github.versionControl.getRepositoryAccess({orgId, repositoryId})` resolves to an access object whose `authorization` is undefined or whose `authorization.token` is empty.

Common situations: The repository is not actually connected to GitHub App installation for the org; the installation was revoked or expired; backend returns a partial access record after a partial sync; org policy strips tokens; stale session state pointing at a repository whose credentials were rotated away.

Related errors

• GitHub token refresh no longer matches the active Factory wo
• GitHub capabilities require a GitHub connection.
• Factory workspace GitHub credential registration is no longe
• ${body?.error} or Failed to save GitHub token (${res.status}
• Failed to remove GitHub token (${res.status})

AI-assisted analysis of mastra-ai/mastra@75dd419e61 (2026-08-30). Data as JSON: /api/errors/acf8e9e902ba69c8. Report an issue: GitHub.