mastra-ai/mastra · error

Repository access did not include a bearer token for the…

Error message

Repository access did not include a bearer token for the Factory session

What it means

The Factory workspace resolves a GitHub bearer token by fetching the repository access record for the session's org and repository. This error is thrown when that record comes back without an `authorization.token`, meaning the backend granted (or reported) access but attached no usable credential. Without the token the sandbox cannot authenticate GitHub operations on behalf of the session.

Solutions

1. Verify the repository is connected to the correct GitHub App installation for `session.orgId` and reinstall/re-authorize if revoked
2. Check the backend getRepositoryAccess response for the repository — ensure authorization token issuance is enabled and the credential store has a token
3. Re-create or refresh the Factory session so it re-resolves repository access with current credentials
4. Inspect server logs for credential provisioning failures around the getRepositoryAccess call

Example fix

// before
const token = access.authorization?.token;
if (!token) throw new Error('Repository access did not include a bearer token for the Factory session');
// after (caller-side guard)
const access = await github.versionControl.getRepositoryAccess({ orgId, repositoryId });
if (!access.authorization?.token) {
  await reconnectGithubInstallation(orgId, repositoryId); // re-authorize before retrying
}
const token = access.authorization!.token;

const access = await github.versionControl.getRepositoryAccess({ orgId, repositoryId });
if (!access.authorization?.token) {
  throw new Error(`No GitHub token for repo ${repositoryId} in org ${orgId}; reconnect the GitHub installation.`);
}
// proceed only when a token exists

function hasGithubToken(access: RepositoryAccess): access is RepositoryAccess & { authorization: { token: string } } {
  return typeof access.authorization?.token === 'string' && access.authorization.token.length > 0;
}

try {
  const token = await getRepositoryToken();
  return token;
} catch (e) {
  if (e instanceof Error && e.message.includes('did not include a bearer token')) {
    await promptReconnectGithubInstallation();
  }
  throw e;
}

When it happens

Trigger: Calling `getRepositoryToken` (via ghCliToken, reconciliation, or token) when `github.versionControl.getRepositoryAccess({orgId, repositoryId})` resolves to an access object whose `authorization` is undefined or whose `authorization.token` is empty.

Common situations: The repository is not actually connected to GitHub App installation for the org; the installation was revoked or expired; backend returns a partial access record after a partial sync; org policy strips tokens; stale session state pointing at a repository whose credentials were rotated away.

Related errors

• GitHub token refresh no longer matches the active Factory…
• or Failed to save GitHub token ( )
• Factory workspace GitHub credential registration is no…
• Failed to remove GitHub token
• GitHub capabilities require a GitHub connection.

AI-assisted analysis of mastra-ai/mastra@75dd419e61 (2026-08-30). Data as JSON: /api/errors/acf8e9e902ba69c8. Report an issue: GitHub.

Appendix: source

Thrown at mastracode/factory/src/workspace.ts:415

    // there instead of in its session workdir). Pin it to the session workdir
    // once known. A remote workdir resolves at the sandbox's first start, so
    // the pin self-heals on the next resolution after the VM has run.
    if (ctx && workdir && ctx.getState()?.projectPath !== workdir) {
      await ctx.setState({ projectPath: workdir, projectName: repoFullName });
    }

    const extensionId = effectiveSkillExtension ? `-${effectiveSkillExtension.id}` : '';
    const workspaceId = `${WORKSPACE_ID_PREFIX}-${projectRepository.id}-${session.id}${extensionId}`;
    const workspaceGeneration = workspaceRegistry.generation(session.sessionId);
    const configDir = DEFAULT_CONFIG_DIR;

    const getRepositoryToken = async (): Promise<string> => {
      const access = await github.versionControl.getRepositoryAccess({
        orgId: session.orgId,
        repositoryId: repository.id,
      });
      const token = access.authorization?.token;
      if (!token) throw new Error('Repository access did not include a bearer token for the Factory session');
      return token;
    };
    const resolveGithubPatKind = async (fallback: GithubPatKind): Promise<GithubPatKind> => {
      if (!workItems) return 'default';
      try {
        const address = getFactorySessionAddress(requestContext);
        const runBinding = address ? await workItems.findRunBindingBySession(address) : null;
        return runBinding?.role === 'review' && runBinding.status === 'active' && runBinding.orgId === session.orgId
          ? 'reviewer'
          : 'default';
      } catch {
        // Preserve the installed role when binding storage is temporarily unavailable.
        return fallback;
      }
    };
    const registerGithubTokenContext = (registered: GithubTokenRegistration): void => {
      const generation = registered.generation;
      registerGithubTokenInjector(requestContext, token => {

View on GitHub (pinned to 75dd419e61)