mastra-ai
diff --git a/‎.changeset/silver-zebras-rule.md‎
Lines changed: 7 additions & 0 deletions b/‎.changeset/silver-zebras-rule.md‎
Lines changed: 7 additions & 0 deletions
diff --git a/‎.claude/skills/builder-smoke-test/SKILL.md‎
Lines changed: 14 additions & 14 deletions b/‎.claude/skills/builder-smoke-test/SKILL.md‎
Lines changed: 14 additions & 14 deletions
diff --git a/‎.claude/skills/builder-smoke-test/assets/template/src/mastra/index.ts‎
Lines changed: 4 additions & 4 deletions b/‎.claude/skills/builder-smoke-test/assets/template/src/mastra/index.ts‎
Lines changed: 4 additions & 4 deletions
diff --git a/‎.claude/skills/builder-smoke-test/references/agents.md‎
Lines changed: 2 additions & 2 deletions b/‎.claude/skills/builder-smoke-test/references/agents.md‎
Lines changed: 2 additions & 2 deletions
diff --git a/‎.claude/skills/builder-smoke-test/references/auth.md‎
Lines changed: 6 additions & 5 deletions b/‎.claude/skills/builder-smoke-test/references/auth.md‎
Lines changed: 6 additions & 5 deletions
diff --git a/‎.claude/skills/builder-smoke-test/references/defaults.md‎
Lines changed: 2 additions & 0 deletions b/‎.claude/skills/builder-smoke-test/references/defaults.md‎
Lines changed: 2 additions & 0 deletions
diff --git a/‎.claude/skills/builder-smoke-test/references/favorites.md‎
Lines changed: 162 additions & 0 deletions b/‎.claude/skills/builder-smoke-test/references/favorites.md‎
Lines changed: 162 additions & 0 deletions
diff --git a/‎.claude/skills/builder-smoke-test/references/infrastructure.md‎
Lines changed: 4 additions & 2 deletions b/‎.claude/skills/builder-smoke-test/references/infrastructure.md‎
Lines changed: 4 additions & 2 deletions
diff --git a/‎.claude/skills/builder-smoke-test/references/model-policy.md‎
Lines changed: 1 addition & 1 deletion b/‎.claude/skills/builder-smoke-test/references/model-policy.md‎
Lines changed: 1 addition & 1 deletion
@@ -0,0 +1,7 @@
+---
+'@mastra/server': patch
+---
+
+Stored agent and skill POST, PATCH, and skill publish responses now include `isFavorited`, matching GET behavior. Clients can read favorite status from write responses without an extra GET request.
+
+Under auth-off, write responses also omit `favoriteCount` to match GET, so the response shape is consistent across all single-entity endpoints.
@@ -26,7 +26,7 @@ This skill is for **branch QA** — it complements the release-time `mastra-smok
 | 7   | **Registry**           | `references/registry.md`         | `--test registry` or full                                               |
 | 8   | **Agents**             | `references/agents.md`           | `--test agents` or full                                                 |
 | 9   | **Picker Allowlists**  | `references/picker-allowlist.md` | `--test pickers` or full                                                |
-| 10  | **Stars**              | `references/stars.md`            | `--test stars` or full                                                  |
+| 10  | **Favorites**          | `references/favorites.md`        | `--test favorites` or full (formerly `stars`)                           |
 | 11  | **Permissions / RBAC** | `references/permissions.md`      | `--test permissions` or full                                            |
 | 12  | **Infrastructure**     | `references/infrastructure.md`   | `--test infrastructure` or full                                         |
 | 13  | **Channels**           | `references/channels.md`         | `--test channels` or full                                               |
@@ -57,14 +57,14 @@ Example: `--test skills,registry,agents` → Setup + Skills + Registry + Agents.
 
 `--scope` runs a curated group of related sections. Setup is always implied.
 
-| Scope    | Includes                                                  |
-| -------- | --------------------------------------------------------- |
-| `rbac`   | permissions, auth                                         |
-| `skills` | skills, registry, defaults                                |
-| `agents` | agents, pickers, defaults, model-policy                   |
-| `infra`  | infrastructure, channels, reconciliation                  |
-| `ui`     | ui                                                        |
-| `quick`  | workspace, skills, agents, stars, ui (skips long-running) |
+| Scope    | Includes                                                      |
+| -------- | ------------------------------------------------------------- |
+| `rbac`   | permissions, auth                                             |
+| `skills` | skills, registry, defaults                                    |
+| `agents` | agents, pickers, defaults, model-policy                       |
+| `infra`  | infrastructure, channels, reconciliation                      |
+| `ui`     | ui                                                            |
+| `quick`  | workspace, skills, agents, favorites, ui (skips long-running) |
 
 `--scope` and `--test` can be combined; the union is run.
 
@@ -76,7 +76,7 @@ Example: `--test skills,registry,agents` → Setup + Skills + Registry + Agents.
 
 # Specific sections
 /builder-smoke-test --test workspace,skills
-/builder-smoke-test --test agents,stars
+/builder-smoke-test --test agents,favorites
 /builder-smoke-test --test reconciliation
 /builder-smoke-test --test ui
 
@@ -142,7 +142,7 @@ accordingly:
 - **Required (every run):** `setup.md`. Any failure here blocks the rest
   of the run.
 - **Standard (default tiers for `full`, `quick`, scope shortcuts):**
-  `workspace.md`, `skills.md`, `agents.md`, `stars.md`, `ui.md` (core),
+  `workspace.md`, `skills.md`, `agents.md`, `favorites.md`, `ui.md` (core),
   `auth.md` when `--auth on`.
 - **Extended (only when explicitly selected via `--test`/`--scope` or
   the matching code surface changed):** `reconciliation.md`,
@@ -389,11 +389,11 @@ run the per-section commands in `references/<section>.md`.
 | Registry install  | `POST /editor/builder/registries/:registryId/install`                      |
 | Workspace CRUD    | `GET/POST/PATCH/DELETE /stored/workspaces[/:id]`                           |
 | Agent CRUD        | `GET/POST/PATCH/DELETE /stored/agents[/:id]`                               |
-| Agent star        | `PUT / DELETE /stored/agents/:id/star`                                     |
+| Agent favorite    | `PUT / DELETE /stored/agents/:id/favorite`                                 |
 | Agent avatar      | `PATCH /stored/agents/:id` with `metadata.avatarUrl` (owner-only)          |
 | Skill CRUD        | `GET/POST/PATCH/DELETE /stored/skills[/:id]`                               |
 | Skill publish     | `POST /stored/skills/:id/publish`                                          |
-| Skill star        | `PUT / DELETE /stored/skills/:id/star`                                     |
+| Skill favorite    | `PUT / DELETE /stored/skills/:id/favorite`                                 |
 | Auth me           | `GET /api/auth/me` (returns logged-in user + roles + permissions)          |
 | Auth refresh      | `POST /auth/refresh`                                                       |
 
@@ -507,7 +507,7 @@ Some flows are documented in `references/` but are not driven by the smoke-test
 - `references/registry.md` — skills.sh browse/install, library Copy flow, origin badges, gating
 - `references/agents.md` — stored agent CRUD, skill attachment, model swap, delete-from-edit, avatar upload
 - `references/picker-allowlist.md` — tools/agents/workflows pickers respect allowlists
-- `references/stars.md` — star/unstar agents and skills, idempotency
+- `references/favorites.md` — favorite/unfavorite agents and skills, idempotency (formerly `stars.md`)
 - `references/permissions.md` — viewer/member/admin/owner gating, role expectation matrix, UI impersonation, auth-off bypass
 - `references/infrastructure.md` — `/editor/builder/infrastructure` payload + UI
 - `references/channels.md` — Slack provider visibility, connectChannel tool
 
@@ -2,7 +2,7 @@ import type { Context } from 'hono';
 import { Mastra } from '@mastra/core/mastra';
 import { Workspace, LocalFilesystem } from '@mastra/core/workspace';
 import { MastraEditor } from '@mastra/editor';
-import { builderAgent } from '@mastra/editor/ee';
+import { createBuilderAgent } from '@mastra/editor/ee';
 import { LibSQLStore } from '@mastra/libsql';
 import { Observability, DefaultExporter, SensitiveDataFilter } from '@mastra/observability';
 import { SlackProvider } from '@mastra/slack';
@@ -28,7 +28,7 @@ export const mastra = new Mastra({
   storage,
   workspace: builderWorkspace,
   agents: {
-    builderAgent,
+    builderAgent: createBuilderAgent(),
     weatherAgent,
   },
   tools: {
@@ -96,14 +96,14 @@ export const mastra = new Mastra({
           tools: true,
           agents: true,
           workflows: true,
-          stars: true,
+          favorites: true,
           skills: true,
           model: true,
           browser: true,
           avatarUpload: true,
         },
         skill: {
-          stars: true,
+          favorites: true,
         },
       },
       configuration: {
 
@@ -44,7 +44,7 @@ Notes (don't assert under `--auth off`):
 
 - `visibility` will be `"public"` regardless of request (see auth-on path).
 - `authorId` will be `null` (no caller).
-- `starCount` will be `0` (no caller-scoped star rows).
+- `favoriteCount` will be `0` and `isFavorited` will be `false` (no caller-scoped favorite rows).
 
 ### 2. Get the agent
 
@@ -179,7 +179,7 @@ curl -s -X PATCH "$BASE/stored/agents/$AGENT_ID" \
 - [ ] Owner: 200, response `metadata.avatarUrl` is the data URL you sent (or a server-rewritten URL)
 - [ ] Non-owner authenticated user: 403 (ownership check inside `assertWriteAccess`)
 - [ ] Auth off: behaves as owner (no caller → bypass)
-- [ ] Oversized blob (>512 KB) is rejected with a structured 400 from `validateMetadataAvatarUrl`
+- [ ] Oversized blob (>512 KB) is rejected with **`413 Payload Too Large`** from `validateMetadataAvatarUrl` (not `400`)
 
 ## Builder defaults at create
 
 
@@ -49,18 +49,19 @@ themselves or dictate values for you to write.
 
 ### 0. Auth ON — extract the session cookie for curl
 
-The WorkOS session cookie is `httpOnly`, so `curl` cannot mint it via `/api/auth/login` and `document.cookie` cannot read it in the browser. **Do this before any other auth-on step that uses `curl`.** Don't fall back to "UI only" — every snippet below uses `-H "Cookie: $COOKIE"` and this is how you get the value.
+The WorkOS session cookie is `httpOnly`, so `curl` cannot mint it via `/sign-in` and `document.cookie` cannot read it in the browser. **Do this before any other auth-on step that uses `curl`.** Don't fall back to "UI only" — every snippet below uses `-H "Cookie: $COOKIE"` and this is how you get the value.
 
-The scaffold ships a debug route gated by `SMOKE_TEST_COOKIE_LEAK=1` that echoes back the request's Cookie header.
+The scaffold ships a debug route gated by `SMOKE_TEST_COOKIE_LEAK=1` that echoes back the request's Cookie header. `scaffold.sh` writes this line into `.env` automatically whenever the `--workos-*` flags trigger auth-on mode, so you should not normally need to add it by hand.
 
 > **Ordering gotcha.** The `apiRoutes` array is built **once** when `mastra dev` boots, from `process.env.SMOKE_TEST_COOKIE_LEAK`. If the flag isn't set in `.env` before that boot, `GET /smoke-test/cookie` returns `404` even though it appears in this doc. If you see a 404 here, the fix is always "stop `mastra dev`, confirm the line is in `$PROJECT_DIR/.env`, restart" — never try to enable it at runtime via curl or browser. Verify with `grep SMOKE_TEST_COOKIE_LEAK "$PROJECT_DIR/.env"` before restarting.
 
 Recipe:
 
 ```bash
-# 1. Add the leak flag to $PROJECT_DIR/.env (only for the smoke test)
-echo 'SMOKE_TEST_COOKIE_LEAK=1' >> "$PROJECT_DIR/.env"
-# 2. Restart `mastra dev` so it picks up the env change.
+# 1. Confirm the leak flag is in $PROJECT_DIR/.env (scaffold.sh writes it for auth-on).
+grep -q '^SMOKE_TEST_COOKIE_LEAK=1' "$PROJECT_DIR/.env" \
+  || echo 'SMOKE_TEST_COOKIE_LEAK=1' >> "$PROJECT_DIR/.env"
+# 2. Restart `mastra dev` so it picks up the env change (only needed if step 1 wrote anything).
 # 3. In the browser, sign in via WorkOS (navigate to $BASE/agent-builder).
 # 4. In the same browser session, navigate to $BASE/smoke-test/cookie
 #    and copy the response body (it's the raw Cookie header).
 
@@ -4,6 +4,8 @@ When the Agent Builder is enabled, `applyBuilderDefaults()` fills in workspace,
 
 Reference: `packages/core/src/agent-builder/ee/apply-builder-defaults.ts` and the scaffolded project's `src/mastra/index.ts` (the `builder.configuration.agent` block).
 
+> **Visibility under `--auth off`.** Some examples below pass `"visibility": "private"`. With `--auth off` the server has no caller to attribute ownership to and forces `visibility: "public"` (and `authorId: null`) regardless of what you send. That is expected; don't fail the step on it. Under `--auth on`, `"private"` is preserved.
+
 ## Source-of-truth: builder config in the scaffolded project
 
 ```ts
 
@@ -0,0 +1,162 @@
+# Favorites
+
+Test favorite/unfavorite functionality for stored agents and skills.
+
+Favorite endpoints are documented in `packages/server/src/server/schemas/favorites.ts` (toggle response) and the agent/skill response schemas in the same directory (GET response). Refer to those for exact field names and types; assert against the schema, not against fields baked into this doc.
+
+Both favorite and unfavorite are idempotent — calling them twice returns the same body the second time. Favorites are gated by the `favorites` builder feature (404 if disabled) and require auth (401 under `--auth off`). (This file was formerly named `stars.md`; the feature was renamed `stars` → `favorites` across the stack. See PR #16749 — STACK-3.)
+
+> **Field-name asymmetry.** The toggle endpoint (`PUT|DELETE /stored/{type}/:id/favorite`) returns `{ favorited, favoriteCount }`. The GET endpoint (`/stored/{type}/:id`) exposes the caller's favorite state as `isFavorited` (alongside `favoriteCount`). When asserting "is favorited" on GET, check `isFavorited`, not `favorited`.
+
+## Auth requirement
+
+**This section requires `--auth on`.** Favorites are scoped per caller (the row in `stored_favorites` is keyed on `(entityId, authorId)`). With `--auth off`, there is no caller to attach the favorite to and the route returns either `401 Authentication required` or `404 Not Found` depending on how the route is registered for the current build — both mean "unreachable under auth-off". Treat any non-2xx as the expected outcome.
+
+### Running with `--auth off`
+
+Favorites are **fully unreachable under `--auth off`**. The PUT/DELETE endpoints return a non-2xx (typically `401 Authentication required`, sometimes `404 Not Found` depending on build), and the Studio + Agent Builder favorite buttons render with a "Sign in to favorite this agent/skill" tooltip. Do the sanity check below, mark this section as `Skipped (requires --auth on)`, and move on. Do **not** try to create agents and favorite them — it will not work and is not expected to work.
+
+```bash
+# Sanity: confirm favorites are gated by auth
+curl -s -o /dev/null -w "%{http_code}\n" -X PUT $BASE/stored/agents/$AGENT_ID/favorite
+# → 401 or 404 (unreachable under auth-off)
+curl -s -o /dev/null -w "%{http_code}\n" -X DELETE $BASE/stored/agents/$AGENT_ID/favorite
+# → 404
+```
+
+- [ ] Both calls return a non-2xx status, either `401` or `404` (both mean "unreachable under auth-off")
+- [ ] Skip the rest of this file; report the section as `Skipped (requires --auth on)`
+
+## Prerequisites (auth-on)
+
+You need a logged-in session (`$SESSION` should be a `Cookie:` header) and a stored entity to target.
+
+**If you have `stored-agents:write` / `stored-skills:write`** (owner, admin, member), create test entities:
+
+```bash
+# Test agent
+AGENT_RESP=$(curl -s -X POST $BASE/stored/agents \
+  -H "$SESSION" \
+  -H 'Content-Type: application/json' \
+  -d '{
+    "name": "Favorite Test Agent",
+    "instructions": "Test agent for favorite testing",
+    "model": {"provider": "openai", "name": "gpt-4o-mini"}
+  }')
+AGENT_ID=$(echo "$AGENT_RESP" | jq -r '.id')
+
+# Test skill
+SKILL_RESP=$(curl -s -X POST $BASE/stored/skills \
+  -H "$SESSION" \
+  -H 'Content-Type: application/json' \
+  -d '{
+    "name": "Favorite Test Skill",
+    "description": "Test skill for favorite testing",
+    "instructions": "Favorite test instructions."
+  }')
+SKILL_ID=$(echo "$SKILL_RESP" | jq -r '.id')
+```
+
+**If you don't have write perms** (viewer), use the rows from `seed-multi-user.sh` (run it from SKILL.md execution flow step 4 if you haven't):
+
+```bash
+SKILL_ID=smoke-seed-public-skill   # public, owned by user_seed_other
+# For agents, skip steps 1–3 and run the skill steps only — the seed script does not
+# seed stored agents. Note "agent favorite CRUD: not exercised in non-admin runs" in the report.
+```
+
+## Steps
+
+### 1. Favorite an agent
+
+```bash
+curl -s -X PUT $BASE/stored/agents/$AGENT_ID/favorite -H "$SESSION" | jq .
+```
+
+- [ ] HTTP `200`
+- [ ] Body is `{ "favorited": true, "favoriteCount": <n> }` with `n >= 1`
+
+### 2. Verify the agent is favorited
+
+```bash
+curl -s $BASE/stored/agents/$AGENT_ID -H "$SESSION" | jq .
+```
+
+- [ ] `isFavorited` is `true` on the GET response
+- [ ] `favoriteCount` matches the value from step 1
+
+### 3. Unfavorite the agent
+
+```bash
+curl -s -X DELETE $BASE/stored/agents/$AGENT_ID/favorite -H "$SESSION" | jq .
+```
+
+- [ ] HTTP `200`
+- [ ] Body shows the agent is no longer favorited for the caller and `favoriteCount` decreased by 1
+- [ ] Re-fetching the agent reflects the unfavorited state
+
+### 4. Favorite a skill
+
+```bash
+curl -s -X PUT $BASE/stored/skills/$SKILL_ID/favorite -H "$SESSION" | jq .
+```
+
+- [ ] HTTP `200`
+- [ ] Body is `{ "favorited": true, "favoriteCount": <n> }`
+
+### 5. Verify the skill is favorited
+
+```bash
+curl -s $BASE/stored/skills/$SKILL_ID -H "$SESSION" | jq .
+```
+
+- [ ] `isFavorited` is `true` on the GET response
+- [ ] `favoriteCount` matches step 4
+
+### 6. Unfavorite the skill
+
+```bash
+curl -s -X DELETE $BASE/stored/skills/$SKILL_ID/favorite -H "$SESSION" | jq .
+```
+
+- [ ] HTTP `200`
+- [ ] Body is `{ "favorited": false, "favoriteCount": <previous - 1> }`
+
+### 7. Idempotent favorite (favorite twice)
+
+```bash
+curl -s -X PUT $BASE/stored/agents/$AGENT_ID/favorite -H "$SESSION" | jq .
+curl -s -X PUT $BASE/stored/agents/$AGENT_ID/favorite -H "$SESSION" | jq .
+```
+
+- [ ] Both calls return `200`
+- [ ] Both bodies are identical (`favoriteCount` does not increment on the second call)
+
+### 8. Idempotent unfavorite (unfavorite twice)
+
+```bash
+curl -s -X DELETE $BASE/stored/agents/$AGENT_ID/favorite -H "$SESSION" | jq .
+curl -s -X DELETE $BASE/stored/agents/$AGENT_ID/favorite -H "$SESSION" | jq .
+```
+
+- [ ] Both calls return `200`
+- [ ] Both bodies are identical (`favorited: false`, `favoriteCount` unchanged on the second call)
+
+### Cleanup
+
+```bash
+curl -s -X DELETE $BASE/stored/agents/$AGENT_ID -H "$SESSION" -o /dev/null -w "%{http_code}\n"  # → 200
+curl -s -X DELETE $BASE/stored/skills/$SKILL_ID -H "$SESSION" -o /dev/null -w "%{http_code}\n"  # → 200
+```
+
+## Checklist
+
+- [ ] Auth-off path: PUT/DELETE favorite return non-2xx (`401` or `404`); no other assertions
+- [ ] Auth-on: favorite agent (200 + `favorited: true`)
+- [ ] Verify agent favorited on GET
+- [ ] Unfavorite agent (200 + `favorited: false`)
+- [ ] Favorite skill (200 + `favorited: true`)
+- [ ] Verify skill favorited on GET
+- [ ] Unfavorite skill (200 + `favorited: false`)
+- [ ] Idempotent favorite (second body identical)
+- [ ] Idempotent unfavorite (second body identical)
@@ -66,8 +66,10 @@ curl -s -H "$SESSION" "$BASE/editor/builder/infrastructure" | jq '.workspace'
 
 - [ ] `type` is `"id"` (matches `workspace: { type: 'id', workspaceId: 'builder-workspace' }`)
 - [ ] `workspaceId` is `"builder-workspace"`
-- [ ] `filesystemProvider` and `sandboxProvider` populated
-- [ ] `config` is an array of `{key, value}` pairs
+- [ ] `name` is present (e.g. `"Builder Workspace"`) and `source` reflects builder metadata
+- [ ] `registered` is `true`; `hasFilesystem` is `true`; `hasSandbox` reflects scaffold config
+- [ ] `filesystemProvider` populated (e.g. `"local"`); `sandboxProvider` may be `null` when no sandbox is configured
+- [ ] `config` is an array of `{key, value}` pairs — may be empty `[]` when the workspace block doesn't expose tunables
 
 If you change the inline workspace block in the scaffolded project's `src/mastra/index.ts` and restart:
 
 
@@ -27,7 +27,7 @@ models: {
 ### 1. Settings exposes the policy
 
 ```bash
-curl -s "$BASE/editor/builder/settings" | jq '.agent.models // .configuration.agent.models'
+curl -s "$BASE/editor/builder/settings" | jq '.configuration.agent.models'
 ```
 
 - [ ] `allowed` is an array with the two entries above