Add Mesa as a workspace filesystem provider

.changeset/big-dogs-change.md

@@ -0,0 +1,26 @@
+---
+'@mastra/core': minor
+'mastracode': patch
+---
+
+Renamed the AgentController interval API. `heartbeatHandlers` is now `intervalHandlers`, the `HeartbeatHandler` type is now `IntervalHandler`, and the `removeHeartbeat()`/`stopHeartbeats()` methods are now `removeInterval()`/`stopIntervals()`. This better reflects that these are fixed-interval background tasks, not liveness pings, and is distinct from the unrelated `mastra.heartbeats` scheduled-agent feature.
+
+**Before**
+
+```ts
+const { controller } = await createMastraCode({
+  heartbeatHandlers: [{ id: 'sync', intervalMs: 60_000, handler: async () => {} }],
+});
+await controller.removeHeartbeat({ id: 'sync' });
+await controller.stopHeartbeats();
+```
+
+**After**
+
+```ts
+const { controller } = await createMastraCode({
+  intervalHandlers: [{ id: 'sync', intervalMs: 60_000, handler: async () => {} }],
+});
+await controller.removeInterval({ id: 'sync' });
+await controller.stopIntervals();
+```

.changeset/calm-spiders-give.md

@@ -0,0 +1,5 @@
+---
+'@mastra/core': patch
+---
+
+Fixed thread metadata being lost when a processor or working memory writes to it during an agent run. The thread is re-saved when the run finishes, and it was using a stale in-memory snapshot that overwrote any metadata written mid-run via updateThread. The agent now re-reads the latest persisted thread before that save, so mid-run metadata is preserved. Affects all storage backends (Postgres, LibSQL, and others). Fixes #16216.

.changeset/chatty-clowns-push.md

@@ -0,0 +1,5 @@
+---
+'@mastra/rag': minor
+---
+
+Added MongoDBConfig to DatabaseConfig, exposing numCandidates for MongoDB Atlas Vector Search queries via the RAG tool layer.

.changeset/cold-tigers-move.md

@@ -0,0 +1,27 @@
+---
+'@mastra/core': minor
+---
+
+Added `createCodingAgent` factory and a reusable `buildBasePrompt` so other projects can build a coding agent on top of the same defaults MastraCode uses.
+
+The factory wires sensible, portable defaults that you can override per field:
+
+- **Workspace** — a local filesystem + sandbox rooted at `process.cwd()` (set `basePath`, pass your own `workspace`, or pass `workspace: undefined` to opt out entirely).
+- **Task signals** — `TaskSignalProvider` so a task list persists across turns.
+- **Error handling** — retries on `ECONNRESET` and bad-request errors, plus prefill and provider-history compatibility processors.
+- **Goal judging** — the default goal judge prompt.
+
+`buildBasePrompt` is parameterized with `productName`, `coAuthorName` (both default to "Mastra Code"), and `coAuthorEmail` (defaults to "noreply@mastra.ai"), so you can brand the system prompt and commit trailer without forking it.
+
+```ts
+import { createCodingAgent } from '@mastra/core/coding-agent';
+
+const agent = createCodingAgent({
+  id: 'my-coding-agent',
+  name: 'My Coding Agent',
+  model: 'openai/gpt-5',
+  instructions: 'You help with my project.',
+  tools: {},
+  basePath: '/path/to/repo',
+});
+```

.changeset/crisp-geckos-do.md

@@ -0,0 +1,36 @@
+---
+'mastracode': minor
+---
+
+Improved push-to-talk voice input in the MastraCode TUI. Enable it with `/voice`, hold the spacebar to dictate, and release to finish — your speech streams into the input box in real time.
+
+**Choose how you dictate**
+
+`/voice` is now an interactive settings menu. You can toggle voice on/off, pick a transcription engine, and (for cloud transcription) pick a provider and model. Run `/voice status` to see the current engine, provider/model, and whether it's ready to use. The quick toggles `/voice on` and `/voice off` still work.
+
+**On-device transcription on macOS**
+
+On macOS, voice now defaults to a native on-device engine (Apple's `SFSpeechRecognizer`). It's free, works offline, and streams words into the input box with low latency — no API key required.
+
+When you turn voice on, the TUI checks the macOS Microphone and Speech Recognition permissions for you and guides you through whatever is needed: if access is blocked it offers to open the exact Privacy & Security pane (and tells you to enable "MastraCode Voice" there); if macOS simply hasn't asked yet, it explains that the first time you hold space it will prompt and you should click Allow. The same guidance appears in `/voice status` and, if dictation ever fails on a permission problem, alongside the error — so you're never left guessing what to do.
+
+**Multiple cloud providers, not just OpenAI**
+
+Cloud transcription is no longer locked to OpenAI Whisper. You can pick from several providers — OpenAI, Groq and other OpenAI-compatible Whisper hosts, plus Deepgram via its own SDK — and choose a model for each. Set the matching API key via the provider's environment variable or `/api-keys`; if a key is missing, `/voice` points you to `/api-keys`.
+
+You still need a local audio recorder on your `PATH` for the cloud engine — `rec`/`sox` (recommended) or `ffmpeg` on macOS, and `pw-record`/`parecord`/`arecord`/`sox` on Linux. Non-macOS systems default to the cloud engine.
+
+**Reliability fixes**
+
+macOS native engine:
+
+- It now triggers the permission prompt and works end-to-end. The on-device recognizer ships as a proper `.app` bundle — `Contents/MacOS/<binary>` plus a generated `Contents/Info.plist` with the Speech Recognition and Microphone usage descriptions — that is ad-hoc signed (`codesign -f -s -`) so the plist binds into the signature.
+- The bundle is launched through macOS LaunchServices (`open`), the only launch path that makes macOS show the permission dialogs. A bare command-line executable — even one with an embedded, signed Info.plist — never fires `SFSpeechRecognizer.requestAuthorization`, so the Allow prompt never appeared and the recognizer was silently denied.
+- Because a LaunchServices-launched app has no stdin/stdout pipe back to the CLI, the recognizer talks to the TUI over files: it appends newline-delimited JSON events to an events file the engine tails, and the engine asks it to flush a final result and quit by writing a stop sentinel file the recognizer polls for. The engine buffers partial lines so an event split across reads is never dropped, and it lets the recognizer see the stop sentinel before tearing the process down.
+- `/voice status` does a real readiness check: it verifies the Swift toolchain and probes the actual Speech Recognition and Microphone permission state, naming exactly which one to enable in System Settings (and explaining the first-run prompt when permission hasn't been requested yet). The probe runs through the same `.app` bundle so it reads authorization under the bundle's TCC identity — probing the loose binary would query a different identity and wrongly report "not granted".
+- If the recognizer exits before it can start (suppressed prompt or TCC kill), the engine surfaces a clear, actionable error with its captured output. A not-yet-determined permission state is no longer dressed up as the cause of a real crash, so you no longer see a misleading "macOS will prompt next time" message in red. The recognizer's Swift source and plist ship with the built CLI so the bundle can be built on first use.
+
+Cloud engine:
+
+- The live-partial loop is more robust: non-overlapping ticks and de-duplicated partials, and the terminal callback always fires on stop (final transcript, empty result, or error).
+- First-dictation latency is reduced: the provider client is built once per dictation and reused across ticks so its HTTP connection stays warm (keep-alive), removing the DNS + TLS handshake cost that made the first dictation lag. The loop also polls at a short cadence until the recorder produces usable audio, so the opening partial fires as soon as there's something to transcribe.

.changeset/durable-agent-parity-phase-1.md

@@ -0,0 +1,9 @@
+---
+'@mastra/core': patch
+---
+
+`DurableAgent` now matches `Agent` behavior in three places where the durable loop previously diverged:
+
+- `isTaskComplete` scorers receive `requestContext` as `customContext`, so the same scorer code works on both agents. Only JSON-serializable entries from `requestContext` are forwarded; non-serializable values are dropped. Do not store secrets in `RequestContext` if you persist durable agent snapshots.
+- Provider-defined tools (e.g. OpenAI `web_search`) resolve and execute when invoked by the model, instead of surfacing as `ToolNotFoundError`.
+- Each iteration of a multi-step durable run produces a distinct assistant `messageId`, matching the non-durable loop and unblocking downstream consumers (signal drains, audit logs, replay) that key off message identity.

.changeset/early-spoons-joke.md

@@ -0,0 +1,18 @@
+---
+'@mastra/inngest': minor
+---
+
+Added support for the fine-grained authorization (FGA) `actor` signal on the Inngest execution engine.
+
+Workflows running on the Inngest engine can now pass a trusted `actor` through `run.start()`, `startAsync()`, `resume()`, `stream()`, and `timeTravel()`. The signal is re-threaded across durable step and nested-workflow boundaries, so every nested agent, tool, and memory FGA check sees the same actor. Previously `actor` was only threaded through the default engine, so trusted background workflows on Inngest lost the membership bypass at each step re-entry.
+
+**Usage**
+
+```ts
+const run = await workflow.createRun();
+await run.start({
+  inputData,
+  requestContext, // includes organizationId / tenant scope
+  actor: { actorKind: 'system', sourceWorkflow: 'nightly-sync' },
+});
+```

.changeset/eighty-points-sneeze.md

@@ -0,0 +1,5 @@
+---
+'@mastra/core': patch
+---
+
+add agent reference to processor execution context

.changeset/few-planets-invite.md

@@ -0,0 +1,18 @@
+---
+'@mastra/mesa': minor
+---
+
+Added a Mesa filesystem provider for Mastra workspaces.
+
+```ts
+import { Workspace } from '@mastra/core/workspace';
+import { MesaFilesystem } from '@mastra/mesa';
+
+const workspace = new Workspace({
+  filesystem: new MesaFilesystem({
+    apiKey: process.env.MESA_API_KEY,
+    org: 'acme',
+    repos: [{ name: 'docs', bookmark: 'main' }],
+  }),
+});
+```

.changeset/fix-client-js-logs-pagination-zero.md

@@ -0,0 +1,5 @@
+---
+'@mastra/client-js': patch
+---
+
+Fix `listLogs` and `getLogForRun` dropping the `page` and `perPage` query parameters when they are `0`. Requesting the first page with `page: 0` (or `perPage: 0`) now sends those values instead of falling back to the server defaults. Closes #18631.

.changeset/fix-deployer-env-dollar-corruption.md

@@ -0,0 +1,5 @@
+---
+'@mastra/deployer': patch
+---
+
+Fix `FileEnvService.setEnvValue` corrupting env values that contain `$` when updating an existing key. Values such as database URLs and passwords that include `$&`, `$$`, or `$1` are now written exactly as provided instead of being mangled by `String.prototype.replace` special patterns. Closes #18633.

.changeset/fix-fs-agents-dev-entry-write-order.md

@@ -0,0 +1,12 @@
+---
+'@mastra/deployer': patch
+'mastra': patch
+---
+
+Fix `ENOENT: .mastra-fs-agents-entry.mjs` when running `mastra dev`/`mastra build` in a project that uses file-based agents. The generated fs-agents wrapper entry was written before `bundler.prepare()` emptied the output directory, so it was wiped before the bundler could read it. Wrapper generation is now split: `prepareFsAgentsEntry` returns the generated source without writing, and the new `writeFsAgentsEntry` writes it after `prepare()` runs.
+
+```ts
+const fsAgents = await prepareFsAgentsEntry({ entryFile, mastraDir, outputDirectory });
+await bundler.prepare(outputDirectory); // empties output dir
+await writeFsAgentsEntry(fsAgents); // wrapper now survives for the bundler
+```

.changeset/fix-inmemory-getworkflowrunbyid-optional-name.md

@@ -0,0 +1,5 @@
+---
+'@mastra/core': patch
+---
+
+Fix in-memory workflow storage `getWorkflowRunById` returning `null` when `workflowName` is omitted. `workflowName` is optional in the storage contract and the pg/libsql adapters match by `runId` alone when it is not provided, but the in-memory store always compared `workflow_name === workflowName`, which never matched for an undefined name. It now matches by `runId`, only filters by `workflowName` when provided, and returns the most recent run for parity with the persistent adapters. Closes #18585.

.changeset/fix-inmemory-observability-exclusive-bounds.md

@@ -0,0 +1,5 @@
+---
+'@mastra/core': patch
+---
+
+Fix in-memory observability `listTraces` ignoring the `startExclusive` and `endExclusive` flags on `startedAt`/`endedAt` filters. Exclusive date-range bounds now drop a trace that sits exactly on the boundary, matching the pg/libsql adapters (and the in-memory log/metric filters). Closes #18635.

.changeset/fix-inmemory-scores-scorerid-sort.md

@@ -0,0 +1,5 @@
+---
+'@mastra/core': patch
+---
+
+Fix in-memory scores store `listScoresByScorerId` returning scores in insertion order instead of newest first. The pg and libsql adapters order by `createdAt DESC`, and the sibling `listScoresBySpan` already does, so the in-memory store now sorts the same way before paginating. Closes #18618.

.changeset/fix-schema-compat-v4-string-format-drop.md

@@ -0,0 +1,5 @@
+---
+'@mastra/schema-compat': patch
+---
+
+Fix the Zod v4 string handler silently dropping unrecognized `string_format` checks. Formats without a textual description (such as `ipv4`, `ipv6`, `datetime`, `date`, `time`, `base64`, `cuid2`, `ulid`, `nanoid`, `jwt`) are now preserved as validation instead of being removed, so schemas using them keep rejecting invalid input. Closes #18634.

.changeset/fix-zod-v4-date-constraint-descriptions.md

@@ -0,0 +1,5 @@
+---
+'@mastra/schema-compat': patch
+---
+
+Fix inverted date constraint descriptions in the Zod v4 schema handler. `z.date().min()` and `z.date().max()` were described with their bounds swapped (a lower bound was labelled "older than" and an upper bound "newer than"), so the schema sent to the model stated the opposite and impossible constraint. The handler now matches Zod semantics and the existing v3 handler. Closes #18581.

.changeset/floppy-towns-notice.md

@@ -0,0 +1,5 @@
+---
+'@mastra/railway': patch
+---
+
+Fixed Railway sandbox templates so they are built once during sandbox creation.

.changeset/forty-carpets-unite.md

@@ -0,0 +1,13 @@
+---
+'@mastra/memory': minor
+'@mastra/core': patch
+---
+
+add observational memory extractors
+
+Introduces a public Extractor API for Observational Memory
+with inline XML extraction and structured follow-up modes.
+Includes built-in extractors for current task, suggested
+response, and thread title. Persists extracted values into
+thread OM metadata with key-level merging and carry-forward
+into future observer/reflector prompts.

.changeset/fs-agents-cli.md

@@ -0,0 +1,16 @@
+---
+'mastra': minor
+---
+
+`mastra dev` and `mastra build` now pick up file-based agents defined under `src/mastra/agents/<name>/`. Agents created this way appear in Studio and respond just like agents registered in code, and the two styles can be mixed in one project. Files committed under `agents/<name>/workspace/` are mirrored into the agent's workspace so it starts with them on disk. Agents can also declare subagents under `agents/<name>/subagents/<childId>/`, which the agent can delegate to as a tool named after the directory.
+
+```text
+src/mastra/agents/weather/
+  config.ts          # export default agentConfig({ model: 'openai/gpt-4o' })
+  instructions.md
+  tools/get_weather.ts
+```
+
+```bash
+mastra dev   # discovers and registers src/mastra/agents/weather automatically
+```

.changeset/fs-agents-deployer.md

@@ -0,0 +1,14 @@
+---
+'@mastra/deployer': minor
+---
+
+You can now define agents by file convention instead of registering each one in code: drop a directory under `src/mastra/agents/<name>/`, run a Mastra build/dev, and the agent is bundled and registered onto your Mastra instance automatically. A directory becomes an agent when it has a `config.ts` or `instructions.md`; `tools/*.ts` add tools, `skills/` add skills (a `createSkill()` module, a packaged `SKILL.md` with its `references/`, or a flat `<skill>.md`), a `memory.ts` default export supplies the agent's `memory`, and `subagents/<childId>/` (one level deep) add delegatable subagents. Each agent gets a default workspace unless `workspace.ts` / `config.workspace` overrides it, and files committed under `agents/<name>/workspace/` are mirrored into the bundle to seed that workspace at runtime. Projects with no file-based agents are unaffected — the original entry is used unchanged.
+
+```text
+src/mastra/agents/weather/
+  config.ts          # export default agentConfig({ model: 'openai/gpt-4o' })
+  instructions.md
+  memory.ts          # export default new Memory()
+  tools/get_weather.ts
+  workspace/cities.json   # mirrored into the agent's workspace
+```

.changeset/fs-agents-server-source.md

@@ -0,0 +1,12 @@
+---
+'@mastra/server': patch
+---
+
+Allow `'fs'` as an agent/scorer definition source in the server handlers and response schemas. File-based agents are registered with `source: 'fs'`, and the scorer/agent list endpoints now surface and validate that value instead of failing schema validation.
+
+```ts
+// GET /api/agents now returns file-based agents alongside code/stored ones:
+{
+  "weather": { "name": "weather", "source": "fs" /* was rejected before */ }
+}
+```

.changeset/full-numbers-occur.md

@@ -0,0 +1,5 @@
+---
+'@mastra/server': patch
+---
+
+Fixed inline skills (created via createSkill()) not appearing in the Dev Portal. The server now uses agent.listSkills() and agent.getSkill() which return both inline and workspace skills, instead of only querying workspace skills.

.changeset/gateway-redos-fix.md

@@ -0,0 +1,5 @@
+---
+'@mastra/core': patch
+---
+
+Fix a polynomial ReDoS in the model gateway error matcher. The `Missing .+ environment variable` pattern used to classify expected missing-auth errors could backtrack catastrophically on adversarial error messages; it now uses `Missing [^ ]+ environment variable`, which matches the same real messages without the ambiguous overlap.