factory-ai 1.0.0

package/src/container-runner.js

@@ -0,0 +1,77 @@
+import path from "node:path";
+import { run } from "./process.js";
+
+const AZURE_ENVIRONMENT = [
+  "TEXTVED_AZURE_BASE_URL",
+  "TEXTVED_AZURE_API_KEY",
+  "AZURE_OPENAI_BASE_URL",
+  "AZURE_OPENAI_API_KEY",
+  "AWS_ACCESS_KEY_ID",
+  "AWS_SECRET_ACCESS_KEY",
+  "AWS_SESSION_TOKEN",
+  "AWS_REGION",
+  "AWS_DEFAULT_REGION",
+  "FACTORY_MODEL_SCOUT",
+  "FACTORY_MODEL_PLANNER",
+  "FACTORY_MODEL_BUILDER",
+  "FACTORY_MODEL_TESTER",
+  "FACTORY_MODEL_DEBUGGER",
+  "FACTORY_MODEL_REVIEWER",
+  "FACTORY_MODEL_SECURITY",
+  "FACTORY_MODEL_RELEASE",
+];
+
+function parseOutput(stdout) {
+  const lines = stdout.trim().split("\n").filter(Boolean);
+  if (lines.length === 0) throw new Error("Agent container returned no result");
+  return JSON.parse(lines.at(-1));
+}
+
+export class ContainerAgentRunner {
+  constructor({ image, memoryDir, timeoutMs, execute = run }) {
+    if (!image) throw new Error("FACTORY_WORKER_IMAGE is required");
+    this.image = image;
+    this.memoryDir = memoryDir;
+    this.timeoutMs = timeoutMs;
+    this.execute = execute;
+  }
+
+  async executePacket(packet, directory) {
+    const name = `agent-${packet.objective.id}-${packet.task?.id ?? "planner"}`.toLowerCase().replaceAll(/[^a-z0-9_.-]/g, "-").slice(0, 63);
+    const args = [
+      "run", "-i", "--rm", "--name", name,
+      "--read-only",
+      "--user", `${process.getuid()}:${process.getgid()}`,
+      "--cap-drop", "ALL",
+      "--security-opt", "no-new-privileges",
+      "--pids-limit", "512",
+      "--memory", "8g",
+      "--cpus", "2",
+      "--tmpfs", "/tmp:rw,noexec,nosuid,size=1g",
+      "--volume", `${path.resolve(directory)}:/workspace:rw`,
+      ...(this.memoryDir ? ["--volume", `${path.resolve(this.memoryDir)}:/memory:rw`] : []),
+      "--workdir", "/workspace",
+      "--env", "HOME=/tmp",
+      ...AZURE_ENVIRONMENT.flatMap((nameValue) => ["--env", nameValue]),
+      this.image,
+    ];
+    const result = await this.execute("docker", args, {
+      input: `${JSON.stringify(packet)}\n`,
+      timeoutMs: this.timeoutMs,
+      maxOutputBytes: 2_000_000,
+    });
+    return parseOutput(result.stdout);
+  }
+
+  invoke({ objective, task, directory, prompt }) {
+    return this.executePacket({ mode: "task", objective, task, prompt }, directory);
+  }
+
+  plan(objective, directory) {
+    return this.executePacket({
+      mode: "plan",
+      objective,
+      task: { id: "planner0", role: "planner", instructions: "Create the delivery graph.", capabilities: [] },
+    }, directory);
+  }
+}

package/src/control-plane.js

@@ -0,0 +1,142 @@
+import { parseObjective, parsePlan, parseResultMessage } from "./validation.js";
+import { validateDeliveryGraph, readyTasks } from "./task-graph.js";
+import { selectCapabilities } from "./capabilities.js";
+import { evaluateReleaseGate } from "./release-gate.js";
+
+export class ControlPlane {
+  constructor({ store, memory, registry, sendTask, sendRelease = async () => { throw new Error("Release sender is unavailable"); } }) {
+    this.store = store;
+    this.memory = memory;
+    this.registry = registry;
+    this.sendTask = sendTask;
+    this.sendRelease = sendRelease;
+  }
+
+  async acceptObjective(value) {
+    const objective = parseObjective(value);
+    try {
+      await this.store.read(objective.id);
+      return;
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+    await this.store.write(objective.id, {
+      objective,
+      status: "planning",
+      tasks: [],
+      results: {},
+      createdAt: new Date().toISOString(),
+    });
+    const context = this.memory ? await this.memory.context(objective.repository) : [];
+    await this.sendTask({
+      type: "planning_task",
+      objectiveId: objective.id,
+      objective,
+      context,
+      task: {
+        id: "planner0",
+        role: "planner",
+        title: "Create delivery graph",
+        instructions: "Create the smallest safe delivery graph.",
+        dependsOn: [],
+        capabilities: [],
+      },
+    });
+  }
+
+  async acceptPlanningResult(value) {
+    if (value?.type !== "planning_result" || typeof value.objectiveId !== "string") throw new Error("Invalid planning result");
+    const delivery = parsePlan(value.delivery);
+    validateDeliveryGraph(delivery.tasks);
+    for (const task of delivery.tasks) selectCapabilities(this.registry, task.role, task.capabilities);
+    await this.store.update(value.objectiveId, (state) => ({
+      ...state,
+      status: "running",
+      executiveIntent: delivery.executiveIntent,
+      tasks: delivery.tasks,
+    }));
+    await this.dispatch(value.objectiveId);
+  }
+
+  async acceptTaskResult(value) {
+    const result = parseResultMessage(value);
+    await this.store.update(result.objectiveId, (state) => ({
+      ...state,
+      results: {
+        ...state.results,
+        [result.taskId]: { ...result, completedAt: new Date().toISOString() },
+      },
+    }));
+    await this.dispatch(result.objectiveId);
+  }
+
+  async acceptReleaseResult(value) {
+    if (value?.type !== "release_result" || typeof value.objectiveId !== "string" || !value.release?.url) throw new Error("Invalid release result");
+    const state = await this.store.update(value.objectiveId, (current) => ({ ...current, status: "complete", release: value.release, completedAt: new Date().toISOString() }));
+    await this.store.writeResult(value.objectiveId, {
+      objectiveId: value.objectiveId,
+      status: "complete",
+      executiveSummary: state.executiveIntent ?? state.objective.objective,
+      pullRequest: value.release.url,
+      checks: value.release.checks ?? [],
+      blockers: value.release.blockers ?? [],
+      autoMergeEnabled: value.release.autoMergeEnabled ?? false,
+      completedAt: state.completedAt,
+    });
+    if (this.memory) await this.memory.append({
+      type: "objective-completed",
+      objectiveId: value.objectiveId,
+      repository: state.objective.repository,
+      objective: state.objective.objective,
+      executiveIntent: state.executiveIntent,
+      pullRequest: value.release.url,
+      checks: value.release.checks ?? [],
+      blockers: value.release.blockers ?? [],
+    });
+  }
+
+  async acceptFailure(value) {
+    if (value?.type !== "failure_result" || typeof value.objectiveId !== "string" || typeof value.error !== "string") throw new Error("Invalid failure result");
+    const blocker = `${value.taskId ?? "unknown-task"}: ${value.error}`;
+    const state = await this.store.update(value.objectiveId, (current) => ({ ...current, status: "failed", failure: blocker, completedAt: new Date().toISOString() }));
+    await this.store.writeResult(value.objectiveId, {
+      objectiveId: value.objectiveId,
+      status: "failed",
+      executiveSummary: state.executiveIntent ?? state.objective.objective,
+      checks: [],
+      blockers: [blocker],
+      autoMergeEnabled: false,
+      completedAt: state.completedAt,
+    });
+  }
+
+  async dispatch(objectiveId) {
+    const state = await this.store.read(objectiveId);
+    for (const taskId of readyTasks(state.tasks, state.results)) {
+      const task = state.tasks.find((candidate) => candidate.id === taskId);
+      const dependencyCommits = task.dependsOn.map((id) => state.results[id]?.commit).filter(Boolean);
+      await this.sendTask({ type: "agent_task", objectiveId, objective: state.objective, task, dependencyCommits });
+      await this.store.update(objectiveId, (current) => ({
+        ...current,
+        results: { ...current.results, [taskId]: { status: "queued", queuedAt: new Date().toISOString() } },
+      }));
+    }
+    const latest = await this.store.read(objectiveId);
+    if (latest.status !== "releasing" && latest.tasks.length > 0 && latest.tasks.every((task) => latest.results[task.id]?.status === "succeeded")) {
+      const gate = evaluateReleaseGate(latest.tasks, latest.results);
+      if (!gate.approved) {
+        await this.store.update(objectiveId, (current) => ({ ...current, status: "blocked", failure: gate.blockers.join(", ") }));
+        return;
+      }
+      const releaseTask = latest.tasks.find((task) => task.role === "release");
+      await this.sendRelease({
+        type: "publish_request",
+        objectiveId,
+        objective: latest.objective,
+        branch: latest.results[releaseTask.id].branch,
+        results: latest.results,
+      });
+      await this.store.update(objectiveId, (current) => ({ ...current, status: "releasing" }));
+    }
+  }
+}

package/src/control-service.js

@@ -0,0 +1,55 @@
+#!/usr/bin/env node
+import { loadConfig } from "./config.js";
+import { createBus, sendMessage } from "./bus.js";
+import { StateStore } from "./state.js";
+import { ControlPlane } from "./control-plane.js";
+import { loadRegistry } from "./registry.js";
+import { log } from "./log.js";
+import { ProjectMemory } from "./project-memory.js";
+
+const config = loadConfig();
+const bus = createBus(config, config.controlQueue, config.agentQueue);
+const releaseSender = bus.client.createSender(config.releaseQueue);
+const control = new ControlPlane({
+  store: new StateStore(config.stateDir),
+  memory: new ProjectMemory(config.memoryDir),
+  registry: await loadRegistry(config.registryPath),
+  sendTask: (message) => sendMessage(bus.sender, message, `${message.objectiveId}:${message.task.id}:v1`, message.objectiveId),
+  sendRelease: (message) => sendMessage(releaseSender, message, `${message.objectiveId}:publish:v1`, message.objectiveId),
+});
+
+let shuttingDown = false;
+const subscription = bus.receiver.subscribe({
+  processMessage: async (message) => {
+    try {
+      if (message.body?.type === "objective") await control.acceptObjective(message.body);
+      else if (message.body?.type === "planning_result") await control.acceptPlanningResult(message.body);
+      else if (message.body?.type === "result") await control.acceptTaskResult(message.body);
+      else if (message.body?.type === "release_result") await control.acceptReleaseResult(message.body);
+      else if (message.body?.type === "failure_result") await control.acceptFailure(message.body);
+      else throw new Error(`Unsupported control message type: ${message.body?.type}`);
+      await bus.receiver.completeMessage(message);
+    } catch (error) {
+      log("error", "control_message_failed", { messageId: String(message.messageId), deliveryCount: message.deliveryCount, error: error.message });
+      if (message.deliveryCount >= config.maxDeliveryCount) {
+        await bus.receiver.deadLetterMessage(message, { deadLetterReason: "MaxDeliveryExceeded", deadLetterErrorDescription: error.message.slice(0, 4096) });
+      } else await bus.receiver.abandonMessage(message);
+    }
+  },
+  processError: async ({ error, errorSource }) => log("error", "control_bus_error", { source: errorSource, error: error.message }),
+}, { autoCompleteMessages: false, maxConcurrentCalls: 1, maxAutoLockRenewalDurationInMs: 300_000 });
+
+async function shutdown(signal) {
+  if (shuttingDown) return;
+  shuttingDown = true;
+  log("info", "control_shutdown", { signal });
+  await subscription.close();
+  await bus.receiver.close();
+  await bus.sender.close();
+  await releaseSender.close();
+  await bus.client.close();
+}
+
+process.once("SIGTERM", () => shutdown("SIGTERM").catch((error) => log("error", "control_shutdown_failed", { error: error.message })));
+process.once("SIGINT", () => shutdown("SIGINT").catch((error) => log("error", "control_shutdown_failed", { error: error.message })));
+log("info", "control_started", { queue: config.controlQueue });

package/src/dashboard.js

@@ -0,0 +1,180 @@
+#!/usr/bin/env node
+import { readdir, readFile } from "node:fs/promises";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { modelForTask } from "./routing.js";
+import { DefaultAzureCredential } from "@azure/identity";
+import { ServiceBusAdministrationClient } from "@azure/service-bus";
+import { loadConfig } from "./config.js";
+
+export async function loadQueueMetrics(config, {
+  createAdmin = () => new ServiceBusAdministrationClient(config.serviceBusFqdn, new DefaultAzureCredential()),
+} = {}) {
+  const admin = createAdmin();
+  const properties = await Promise.all([config.controlQueue, config.agentQueue, config.releaseQueue].map((queue) => admin.getQueueRuntimeProperties(queue)));
+  return {
+    active: properties.reduce((total, item) => total + (item.activeMessageCount ?? 0), 0),
+    deadLetter: properties.reduce((total, item) => total + (item.deadLetterMessageCount ?? 0), 0),
+  };
+}
+
+export async function loadAzureCost(config, { credential = new DefaultAzureCredential(), fetch = globalThis.fetch } = {}) {
+  if (!config.subscriptionId || !config.resourceGroup) return null;
+  const access = await credential.getToken("https://management.azure.com/.default");
+  const scope = `/subscriptions/${config.subscriptionId}/resourceGroups/${config.resourceGroup}`;
+  const response = await fetch(`https://management.azure.com${scope}/providers/Microsoft.CostManagement/query?api-version=2025-03-01`, {
+    method: "POST",
+    headers: { authorization: `Bearer ${access.token}`, "content-type": "application/json" },
+    body: JSON.stringify({
+      type: "ActualCost",
+      timeframe: "MonthToDate",
+      dataset: {
+        granularity: "None",
+        aggregation: { totalCost: { name: "Cost", function: "Sum" } },
+        grouping: [{ type: "Dimension", name: "ResourceType" }],
+      },
+    }),
+  });
+  if (!response.ok) throw new Error(`Azure Cost Management HTTP ${response.status}`);
+  const result = await response.json();
+  const columns = result.properties?.columns?.map((column) => column.name) ?? [];
+  const costIndex = columns.indexOf("Cost");
+  const serviceIndex = columns.indexOf("ResourceType");
+  const currencyIndex = columns.indexOf("Currency");
+  const byService = {};
+  let monthToDate = 0;
+  let currency = "USD";
+  for (const row of result.properties?.rows ?? []) {
+    const amount = Number(row[costIndex] ?? 0);
+    monthToDate += amount;
+    byService[row[serviceIndex] ?? "Other"] = amount;
+    currency = row[currencyIndex] ?? currency;
+  }
+  return { monthToDate, currency, byService };
+}
+
+export function humanDuration(seconds) {
+  const value = Math.max(0, Math.floor(seconds ?? 0));
+  if (value >= 3600) return `${Math.floor(value / 3600)}h ${Math.floor((value % 3600) / 60)}m`;
+  if (value >= 60) return `${Math.floor(value / 60)}m ${value % 60}s`;
+  return `${value}s`;
+}
+
+function sortObject(value) {
+  if (Array.isArray(value)) return value.map(sortObject);
+  if (value && typeof value === "object") return Object.fromEntries(Object.keys(value).sort().map((key) => [key, sortObject(value[key])]));
+  return value;
+}
+
+export function stableStringify(value) {
+  return `${JSON.stringify(sortObject(value))}\n`;
+}
+
+export async function loadLocalState(root) {
+  const states = [];
+  const warnings = [];
+  let directories = [];
+  try {
+    directories = await readdir(root, { withFileTypes: true });
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+  for (const entry of directories.filter((item) => item.isDirectory() && item.name !== "reports").sort((a, b) => a.name.localeCompare(b.name))) {
+    const file = path.join(root, entry.name, "state.json");
+    try {
+      states.push(JSON.parse(await readFile(file, "utf8")));
+    } catch (error) {
+      if (error.code !== "ENOENT") warnings.push(`${file}: ${error.message}`);
+    }
+  }
+  return { states, warnings };
+}
+
+function taskState(task, results) {
+  if (results[task.id]?.status) return results[task.id].status;
+  return task.dependsOn.every((id) => results[id]?.status === "succeeded") ? "ready" : "blocked";
+}
+
+export function aggregateDashboard({ states = [], queue = {}, cost = null, runtime = {}, hostUptimeSeconds = 0, warnings = [], now = new Date() }) {
+  const objectives = states.map((state) => {
+    const results = state.results ?? {};
+    const tasks = (state.tasks ?? []).map((task) => ({
+      id: task.id,
+      role: task.role,
+      title: task.title,
+      model: modelForTask(task),
+      state: taskState(task, results),
+      branch: results[task.id]?.branch,
+      commit: results[task.id]?.commit,
+      elapsedSeconds: results[task.id]?.startedAt
+        ? (new Date(results[task.id]?.completedAt ?? now).getTime() - new Date(results[task.id].startedAt).getTime()) / 1000
+        : 0,
+    }));
+    return {
+      id: state.objective?.id,
+      objective: state.objective?.objective,
+      repository: state.objective?.repository,
+      status: state.status,
+      tasks,
+      checks: Object.entries(results).flatMap(([id, result]) => (result.checks ?? []).map((check) => `${id}: ${check}`)),
+      blocker: state.failure,
+      pullRequest: Object.values(results).map((result) => result.release?.url).find(Boolean),
+    };
+  });
+  const summary = {};
+  for (const objective of objectives) summary[objective.status ?? "unknown"] = (summary[objective.status ?? "unknown"] ?? 0) + 1;
+  const startedAt = runtime.startedAt ? new Date(runtime.startedAt) : null;
+  return {
+    generatedAt: now.toISOString(),
+    worker: {
+      status: runtime.status ?? "unknown",
+      uptimeSeconds: startedAt ? Math.max(0, (now.getTime() - startedAt.getTime()) / 1000) : hostUptimeSeconds,
+    },
+    queue: { active: queue.active ?? 0, deadLetter: queue.deadLetter ?? 0 },
+    cost,
+    summary: { objectives: summary },
+    objectives,
+    warnings,
+  };
+}
+
+function clip(value, width) {
+  const text = String(value ?? "");
+  return text.length <= width ? text : `${text.slice(0, Math.max(0, width - 1))}…`;
+}
+
+export function renderDashboard(dashboard, { width = 100 } = {}) {
+  const lines = [
+    "╔═ FACTORY AI ═╗",
+    `Worker ${dashboard.worker.status} · uptime ${humanDuration(dashboard.worker.uptimeSeconds)} · queue ${dashboard.queue.active} · DLQ ${dashboard.queue.deadLetter}`,
+    `Objectives ${Object.entries(dashboard.summary.objectives).map(([state, count]) => `${state}:${count}`).join(" ") || "none"}`,
+  ];
+  if (dashboard.cost) lines.push(`Azure MTD ${dashboard.cost.currency} ${dashboard.cost.monthToDate.toFixed(2)} · billing data may be delayed`);
+  for (const objective of dashboard.objectives) {
+    lines.push("", `[${objective.status}] ${objective.id} ${objective.objective}`);
+    for (const task of objective.tasks) lines.push(`  ${task.state.padEnd(9)} ${task.role.padEnd(9)} ${task.model} · ${task.title ?? task.id}`);
+    if (objective.pullRequest) lines.push(`  PR ${objective.pullRequest}`);
+    if (objective.blocker) lines.push(`  BLOCKED ${objective.blocker}`);
+  }
+  for (const warning of dashboard.warnings) lines.push(`WARN ${warning}`);
+  return lines.map((line) => clip(line, Math.max(20, width))).join("\n");
+}
+
+async function main() {
+  const root = process.env.FACTORY_STATE_DIR ?? "/opt/agent-factory/state";
+  const json = process.argv.includes("--json");
+  const loaded = await loadLocalState(root);
+  let queue = {};
+  let cost = null;
+  if (process.env.SERVICE_BUS_NAMESPACE) queue = await loadQueueMetrics(loadConfig());
+  if (process.env.AZURE_SUBSCRIPTION_ID) {
+    try { cost = await loadAzureCost(loadConfig()); } catch (error) { loaded.warnings.push(`Cost unavailable: ${error.message}`); }
+  }
+  const dashboard = aggregateDashboard({ ...loaded, queue, cost, runtime: { status: "running" } });
+  process.stdout.write(json ? stableStringify(dashboard) : `${renderDashboard(dashboard, { width: process.stdout.columns ?? 100 })}\n`);
+}
+
+if (import.meta.url === pathToFileURL(process.argv[1] ?? "").href) main().catch((error) => {
+  process.stderr.write(`${error.message}\n`);
+  process.exitCode = 1;
+});

package/src/log.js

@@ -0,0 +1,19 @@
+const SECRET_KEY = /token|secret|password|authorization|api.?key/i;
+
+function sanitize(value) {
+  if (Array.isArray(value)) return value.map(sanitize);
+  if (!value || typeof value !== "object") return value;
+  return Object.fromEntries(Object.entries(value).map(([key, item]) => [
+    key,
+    SECRET_KEY.test(key) ? "[REDACTED]" : sanitize(item),
+  ]));
+}
+
+export function log(level, event, fields = {}) {
+  process.stdout.write(`${JSON.stringify({
+    timestamp: new Date().toISOString(),
+    level,
+    event,
+    ...sanitize(fields),
+  })}\n`);
+}

package/src/mcp-tools.js

@@ -0,0 +1,53 @@
+function renderContent(result) {
+  return (result.content ?? []).map((item) => item.type === "text" ? item.text : JSON.stringify(item)).join("\n");
+}
+
+async function defaultConnect(capability) {
+  const [{ Client }, { StdioClientTransport }] = await Promise.all([
+    import("@modelcontextprotocol/sdk/client/index.js"),
+    import("@modelcontextprotocol/sdk/client/stdio.js"),
+  ]);
+  const [command, ...args] = capability.command;
+  const transport = new StdioClientTransport({
+    command,
+    args,
+    env: {
+      PATH: process.env.PATH,
+      HOME: process.env.HOME ?? "/tmp",
+      PLAYWRIGHT_BROWSERS_PATH: process.env.PLAYWRIGHT_BROWSERS_PATH ?? "/ms-playwright",
+      ...(capability.environment ?? {}),
+    },
+    stderr: "pipe",
+  });
+  const client = new Client({ name: "factory-ai", version: "1.0.0" });
+  await client.connect(transport);
+  return client;
+}
+
+export async function connectMcpTools(capabilities, { connect = defaultConnect } = {}) {
+  const clients = [];
+  const tools = {};
+  try {
+    for (const capability of capabilities.filter((item) => item.type === "mcp")) {
+      const client = await connect(capability);
+      clients.push(client);
+      const listed = await client.listTools();
+      for (const definition of listed.tools) {
+        const name = `${capability.name}__${definition.name}`;
+        if (tools[name]) throw new Error(`Duplicate MCP tool: ${name}`);
+        tools[name] = {
+          description: definition.description ?? `${capability.name} ${definition.name}`,
+          parameters: definition.inputSchema ?? { type: "object" },
+          execute: async (argumentsValue) => renderContent(await client.callTool({ name: definition.name, arguments: argumentsValue })),
+        };
+      }
+    }
+    return {
+      tools,
+      close: async () => Promise.allSettled(clients.map((client) => client.close())),
+    };
+  } catch (error) {
+    await Promise.allSettled(clients.map((client) => client.close()));
+    throw error;
+  }
+}

package/src/operator.js

@@ -0,0 +1,57 @@
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { run } from "./process.js";
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+
+function extractRunCommand(value) {
+  const match = value.match(/\[stdout\]\n([\s\S]*?)\n\[stderr\]/);
+  return (match?.[1] ?? value).trim();
+}
+
+async function command(name, args, options = {}) {
+  const result = await run(name, args, { timeoutMs: 180_000, maxOutputBytes: 5_000_000, ...options });
+  return result.stdout.trim();
+}
+
+export function createOperator(environment = process.env) {
+  const resourceGroup = environment.FACTORY_RESOURCE_GROUP ?? "factory-ai-rg";
+  const vm = environment.FACTORY_VM ?? "agent-factory-vm";
+  const namespace = environment.FACTORY_SERVICE_BUS ?? "";
+  const vault = environment.FACTORY_KEY_VAULT ?? "";
+  const remote = async (script) => extractRunCommand(await command("az", ["vm", "run-command", "invoke", "--resource-group", resourceGroup, "--name", vm, "--command-id", "RunShellScript", "--scripts", script, "--query", "value[0].message", "--output", "tsv"]));
+  const withVault = async (operation) => {
+    const ip = await command("curl", ["-fsS", "https://api.ipify.org"]);
+    await command("az", ["keyvault", "network-rule", "add", "--name", vault, "--ip-address", `${ip}/32`, "--output", "none"]);
+    await new Promise((resolve) => setTimeout(resolve, 5000));
+    try { return await operation(); } finally {
+      await command("az", ["keyvault", "network-rule", "remove", "--name", vault, "--ip-address", `${ip}/32`, "--output", "none"]).catch(() => {});
+    }
+  };
+  return {
+    dashboard: async () => JSON.parse(await remote("sudo -u factory env $(xargs < /etc/agent-factory-control.env) node /opt/agent-factory/app/src/dashboard.js --json")),
+    logs: async () => remote('journalctl -u agent-factory-control -u agent-factory-worker -u agent-factory-release --since "1 hour ago" --no-pager -n 300'),
+    submit: async (repository, objective) => {
+      if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(repository) || objective.trim().length < 3) throw new Error("Valid repository and objective are required");
+      const output = await command(path.join(root, "bin/factory"), ["submit", repository, objective]);
+      const match = output.match(/\{"objectiveId"[\s\S]*?\}/);
+      return match ? JSON.parse(match[0]) : { status: "submitted" };
+    },
+    control: async (action) => {
+      if (!["pause", "resume"].includes(action)) throw new Error("Unsupported control action");
+      return command(path.join(root, "bin/factory"), [action]);
+    },
+    capabilities: async () => JSON.parse(await readFile(path.join(root, "config/capabilities.json"), "utf8")),
+    config: () => ({ resourceGroup, vm, namespace, vault }),
+    listSecrets: async () => withVault(async () => JSON.parse(await command("az", ["keyvault", "secret", "list", "--vault-name", vault, "--query", "[].{name:name,updated:attributes.updated}", "--output", "json"]))),
+    setSecret: async (name, value) => withVault(async () => {
+      if (!/^[A-Za-z0-9-]{1,127}$/.test(name) || !value) throw new Error("Valid secret name and value are required");
+      await command("az", ["keyvault", "secret", "set", "--vault-name", vault, "--name", name, "--value", value, "--output", "none"]);
+    }),
+    deleteSecret: async (name) => withVault(async () => {
+      if (!/^[A-Za-z0-9-]{1,127}$/.test(name)) throw new Error("Invalid secret name");
+      await command("az", ["keyvault", "secret", "delete", "--vault-name", vault, "--name", name, "--output", "none"]);
+    }),
+  };
+}

package/src/process.js

@@ -0,0 +1,48 @@
+import { spawn } from "node:child_process";
+
+export function run(command, args, options = {}) {
+  const { cwd, env, inheritEnv = true, timeoutMs = 300_000, input, allowExitCodes = [0], maxOutputBytes = 10_000_000 } = options;
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, args, {
+      cwd,
+      env: inheritEnv ? { ...process.env, ...env } : env,
+      stdio: [input ? "pipe" : "ignore", "pipe", "pipe"],
+      shell: false,
+    });
+    let stdout = "";
+    let stderr = "";
+    let timedOut = false;
+    let outputExceeded = false;
+    const timer = setTimeout(() => {
+      timedOut = true;
+      child.kill("SIGTERM");
+      setTimeout(() => child.kill("SIGKILL"), 5000).unref();
+    }, timeoutMs).unref();
+    function appendOutput(stream, chunk) {
+      if (Buffer.byteLength(stdout) + Buffer.byteLength(stderr) + chunk.length > maxOutputBytes) {
+        outputExceeded = true;
+        child.kill("SIGTERM");
+        return;
+      }
+      if (stream === "stdout") stdout += chunk;
+      else stderr += chunk;
+    }
+    child.stdout.on("data", (chunk) => appendOutput("stdout", chunk));
+    child.stderr.on("data", (chunk) => appendOutput("stderr", chunk));
+    child.on("error", (error) => {
+      clearTimeout(timer);
+      reject(error);
+    });
+    child.on("close", (code, signal) => {
+      clearTimeout(timer);
+      if (timedOut) return reject(new Error(`${command} timed out after ${timeoutMs}ms`));
+      if (outputExceeded) return reject(new Error(`${command} exceeded ${maxOutputBytes} output bytes`));
+      if (!allowExitCodes.includes(code)) {
+        const detail = stderr.slice(-4000).replaceAll(/(token|key|secret)=\S+/gi, "$1=[REDACTED]");
+        return reject(new Error(`${command} exited ${code ?? signal}: ${detail}`));
+      }
+      resolve({ code, stdout, stderr });
+    });
+    if (input) child.stdin.end(input);
+  });
+}

package/src/project-memory.js

@@ -0,0 +1,22 @@
+import { appendFile, mkdir, readFile } from "node:fs/promises";
+import path from "node:path";
+
+export class ProjectMemory {
+  constructor(directory) {
+    this.directory = directory;
+    this.file = path.join(directory, "project-events.jsonl");
+  }
+
+  async append(event) {
+    await mkdir(this.directory, { recursive: true, mode: 0o750 });
+    await appendFile(this.file, `${JSON.stringify({ ...event, recordedAt: new Date().toISOString() })}\n`, { mode: 0o640 });
+  }
+
+  async context(repository, limit = 20) {
+    let text;
+    try { text = await readFile(this.file, "utf8"); } catch (error) { if (error.code === "ENOENT") return []; throw error; }
+    return text.split("\n").filter(Boolean).flatMap((line) => {
+      try { const value = JSON.parse(line); return value.repository === repository ? [value] : []; } catch { return []; }
+    }).slice(-limit);
+  }
+}

package/src/registry.js

@@ -0,0 +1,6 @@
+import { readFile } from "node:fs/promises";
+import { validateRegistry } from "./capabilities.js";
+
+export async function loadRegistry(file) {
+  return validateRegistry(JSON.parse(await readFile(file, "utf8")));
+}