factory-ai 1.0.0

package/src/release-bot.js

@@ -0,0 +1,36 @@
+import { mkdtemp, rm } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { run } from "./process.js";
+
+async function defaultCheckout(message) {
+  const directory = await mkdtemp(path.join(os.tmpdir(), "agent-release-"));
+  await run("git", ["clone", "--branch", message.branch, "--single-branch", message.objective.repository, directory], { timeoutMs: 300_000 });
+  return directory;
+}
+
+export class ReleaseBot {
+  constructor({ checkout = defaultCheckout, publisher, sendControl, cleanup = (directory) => rm(directory, { recursive: true, force: true }) }) {
+    this.checkout = checkout;
+    this.publisher = publisher;
+    this.sendControl = sendControl;
+    this.cleanup = cleanup;
+  }
+
+  async process(message) {
+    if (message?.type !== "publish_request") throw new Error(`Unsupported release message: ${message?.type}`);
+    const directory = await this.checkout(message);
+    try {
+      const release = await this.publisher.publish({
+        directory,
+        objective: message.objective,
+        task: { title: message.objective.objective },
+        branch: message.branch,
+        results: message.results,
+      });
+      await this.sendControl({ type: "release_result", objectiveId: message.objectiveId, release });
+    } finally {
+      await this.cleanup(directory);
+    }
+  }
+}

package/src/release-gate.js

@@ -0,0 +1,11 @@
+const APPROVAL_ROLES = new Set(["tester", "reviewer", "security"]);
+
+export function evaluateReleaseGate(tasks, results, facts = {}) {
+  const blockers = [];
+  for (const task of tasks.filter((candidate) => APPROVAL_ROLES.has(candidate.role))) {
+    const result = results[task.id];
+    if (result?.status !== "succeeded" || result.approval !== "approved") blockers.push(`${task.role} ${task.id}: ${result?.approval ?? result?.status ?? "missing"}`);
+  }
+  const approvals = facts.approvals ?? blockers.length === 0;
+  return { approved: approvals, blockers, autoMerge: approvals && facts.policyAllows === true && facts.checksPass === true };
+}

package/src/release-service.js

@@ -0,0 +1,41 @@
+#!/usr/bin/env node
+import { loadConfig } from "./config.js";
+import { createBus, sendMessage } from "./bus.js";
+import { loadRuntimeSecrets } from "./secrets.js";
+import { run } from "./process.js";
+import { ReleaseBot } from "./release-bot.js";
+import { GitHubRelease } from "./release.js";
+import { log } from "./log.js";
+
+const config = loadConfig();
+Object.assign(process.env, await loadRuntimeSecrets(config, undefined, ["GH_TOKEN"]));
+await run("gh", ["auth", "setup-git"], { timeoutMs: 60_000 });
+const bus = createBus(config, config.releaseQueue, config.controlQueue);
+const bot = new ReleaseBot({
+  publisher: new GitHubRelease(config.timeoutMs),
+  sendControl: (message) => sendMessage(bus.sender, message, `${message.objectiveId}:release-result:v1`, message.objectiveId),
+});
+
+const subscription = bus.receiver.subscribe({
+  processMessage: async (message) => {
+    try {
+      await bot.process(message.body);
+      await bus.receiver.completeMessage(message);
+    } catch (error) {
+      log("error", "release_failed", { deliveryCount: message.deliveryCount, error: error.message });
+      if (message.deliveryCount >= config.maxDeliveryCount) await bus.receiver.deadLetterMessage(message, { deadLetterReason: "ReleaseFailed", deadLetterErrorDescription: error.message.slice(0, 4096) });
+      else await bus.receiver.abandonMessage(message);
+    }
+  },
+  processError: async ({ error, errorSource }) => log("error", "release_bus_error", { source: errorSource, error: error.message }),
+}, { autoCompleteMessages: false, maxConcurrentCalls: 1, maxAutoLockRenewalDurationInMs: (config.timeoutMs * 2) + 300_000 });
+
+async function shutdown() {
+  await subscription.close();
+  await bus.receiver.close();
+  await bus.sender.close();
+  await bus.client.close();
+}
+process.once("SIGTERM", () => shutdown().catch((error) => log("error", "release_shutdown_failed", { error: error.message })));
+process.once("SIGINT", () => shutdown().catch((error) => log("error", "release_shutdown_failed", { error: error.message })));
+log("info", "release_started", { queue: config.releaseQueue });

package/src/release.js

@@ -0,0 +1,102 @@
+import { run } from "./process.js";
+import { evaluateReleaseGate } from "./release-gate.js";
+
+export { evaluateReleaseGate } from "./release-gate.js";
+
+export function requiredChecksPass(exitCode, checks) {
+  if (checks.length === 0) return exitCode === 0 || exitCode === 1;
+  return exitCode === 0 && checks.every((check) => ["pass", "skipping"].includes(check.bucket));
+}
+
+function parseJson(value, fallback) {
+  try {
+    return JSON.parse(value);
+  } catch {
+    return fallback;
+  }
+}
+
+export class GitHubRelease {
+  constructor(timeoutMs, execute = run, sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms))) {
+    this.timeoutMs = timeoutMs;
+    this.execute = execute;
+    this.sleep = sleep;
+  }
+
+  async requiredChecks(directory, branch) {
+    const deadline = Date.now() + this.timeoutMs;
+    let command;
+    do {
+      command = await this.execute("gh", [
+        "pr", "checks", branch, "--required", "--json", "name,state,link,bucket",
+      ], { cwd: directory, timeoutMs: 60_000, allowExitCodes: [0, 1, 8] });
+      if (command.code !== 8 || Date.now() >= deadline) break;
+      await this.sleep(Math.min(15_000, Math.max(0, deadline - Date.now())));
+    } while (Date.now() < deadline);
+    return command;
+  }
+
+  async publish({ directory, objective, task, branch, results }) {
+    const commits = Object.entries(results)
+      .filter(([, result]) => result.commit)
+      .map(([id, result]) => `- ${id}: \`${result.commit}\` - ${result.summary}`)
+      .join("\n");
+    const body = [
+      `Automated delivery for CEO objective \`${objective.id}\`.`,
+      "",
+      "## Validated checkpoints",
+      commits || "- No prior checkpoints",
+      "",
+      "Human review and repository branch protections remain authoritative.",
+    ].join("\n");
+    const title = `[Factory AI] ${task.title}`;
+    const create = await this.execute("gh", [
+      "pr", "create", "--base", objective.baseBranch, "--head", branch,
+      "--title", title, "--body", body,
+    ], { cwd: directory, timeoutMs: 120_000, allowExitCodes: [0, 1] });
+    if (create.code !== 0) {
+      await this.execute("gh", ["pr", "edit", branch, "--title", title, "--body", body], {
+        cwd: directory,
+        timeoutMs: 120_000,
+      });
+    }
+    const view = await this.execute("gh", [
+      "pr", "view", branch, "--json", "url,number,reviewDecision,mergeStateStatus",
+    ], { cwd: directory, timeoutMs: 60_000 });
+    const pullRequest = parseJson(view.stdout, {});
+    const repository = await this.execute("gh", ["repo", "view", "--json", "nameWithOwner", "--jq", ".nameWithOwner"], {
+      cwd: directory,
+      timeoutMs: 60_000,
+    });
+    const policy = await this.execute("gh", ["api", `repos/${repository.stdout.trim()}`, "--jq", ".allow_auto_merge"], {
+      cwd: directory,
+      timeoutMs: 60_000,
+    });
+    const checksCommand = await this.requiredChecks(directory, branch);
+    const checks = parseJson(checksCommand.stdout, []);
+    const checksPass = requiredChecksPass(checksCommand.code, checks);
+    const gate = evaluateReleaseGate([], {}, {
+      approvals: true,
+      policyAllows: policy.stdout.trim() === "true",
+      checksPass,
+    });
+    if (gate.autoMerge) {
+      await this.execute("gh", ["pr", "merge", branch, "--auto", "--merge"], {
+        cwd: directory,
+        timeoutMs: 60_000,
+      });
+    }
+    return {
+      url: pullRequest.url,
+      number: pullRequest.number,
+      checks,
+      reviewDecision: pullRequest.reviewDecision,
+      mergeStateStatus: pullRequest.mergeStateStatus,
+      autoMergeEnabled: gate.autoMerge,
+      blockers: [
+        ...(gate.autoMerge || policy.stdout.trim() === "true" ? [] : ["Repository auto-merge policy is disabled"]),
+        ...(checksPass ? [] : ["Required checks are pending or failing"]),
+      ],
+    };
+  }
+}

package/src/reporter.js

@@ -0,0 +1,49 @@
+#!/usr/bin/env node
+import { mkdir, readdir, rename, rm, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { aggregateDashboard, loadAzureCost, loadLocalState, loadQueueMetrics, stableStringify } from "./dashboard.js";
+import { loadConfig } from "./config.js";
+
+function markdown(dashboard) {
+  const objectives = Object.entries(dashboard.summary.objectives).map(([state, count]) => `${state}=${count}`).join(", ") || "none";
+  const cost = dashboard.cost ? `\nAzure month-to-date: ${dashboard.cost.currency} ${dashboard.cost.monthToDate.toFixed(2)} (billing data may be delayed)\n` : "";
+  return `# Factory AI Hourly Report\n\nGenerated: ${dashboard.generatedAt}\n\nQueue: ${dashboard.queue.active} active, ${dashboard.queue.deadLetter} dead-letter\n${cost}\nObjectives: ${objectives}\n`;
+}
+
+async function atomicWrite(file, content) {
+  const temporary = `${file}.${process.pid}.tmp`;
+  await writeFile(temporary, content, { mode: 0o640 });
+  await rename(temporary, file);
+}
+
+export async function writeHourlyReport(root, dashboard, { now = new Date(), retention = 168 } = {}) {
+  const reports = path.join(root, "reports");
+  await mkdir(reports, { recursive: true, mode: 0o750 });
+  const stem = now.toISOString().slice(0, 13);
+  await atomicWrite(path.join(reports, `${stem}.json`), stableStringify(dashboard));
+  await atomicWrite(path.join(reports, `${stem}.md`), markdown(dashboard));
+  const stems = [...new Set((await readdir(reports)).filter((name) => /^\d{4}-\d{2}-\d{2}T\d{2}\.(json|md)$/.test(name)).map((name) => name.slice(0, 13)))].sort();
+  for (const expired of stems.slice(0, Math.max(0, stems.length - retention))) {
+    await Promise.all(["json", "md"].map((extension) => rm(path.join(reports, `${expired}.${extension}`), { force: true })));
+  }
+  return stem;
+}
+
+async function main() {
+  const root = process.env.FACTORY_STATE_DIR ?? "/opt/agent-factory/state";
+  const loaded = await loadLocalState(root);
+  const queue = process.env.SERVICE_BUS_NAMESPACE ? await loadQueueMetrics(loadConfig()) : {};
+  let cost = null;
+  if (process.env.AZURE_SUBSCRIPTION_ID) {
+    try { cost = await loadAzureCost(loadConfig()); } catch (error) { loaded.warnings.push(`Cost unavailable: ${error.message}`); }
+  }
+  const dashboard = aggregateDashboard({ ...loaded, queue, cost, runtime: { status: "running" } });
+  const stem = await writeHourlyReport(root, dashboard);
+  process.stdout.write(`${JSON.stringify({ event: "hourly_report", report: stem })}\n`);
+}
+
+if (import.meta.url === pathToFileURL(process.argv[1] ?? "").href) main().catch((error) => {
+  process.stderr.write(`${error.message}\n`);
+  process.exitCode = 1;
+});

package/src/routing.js

@@ -0,0 +1,34 @@
+export const ROLES = Object.freeze([
+  "scout",
+  "planner",
+  "builder",
+  "tester",
+  "debugger",
+  "reviewer",
+  "security",
+  "release",
+]);
+
+const MODELS = Object.freeze({
+  scout: "azureai-textved/factory-gpt-5-4-nano",
+  tester: "azureai-responses/gpt-5.4",
+  planner: "azureai-textved/gpt-5.6-sol",
+  builder: "azureai-textved/gpt-5.6-sol",
+  debugger: "azureai-textved/gpt-5.6-sol",
+  reviewer: "azureai-textved/gpt-5.6-sol",
+  security: "azureai-textved/gpt-5.6-sol",
+  release: "azureai-textved/gpt-5.6-sol",
+});
+
+export function modelForRole(role, environment = process.env) {
+  const model = environment[`FACTORY_MODEL_${role.toUpperCase()}`] ?? MODELS[role];
+  if (!model) throw new Error(`Unknown role: ${role}`);
+  return model;
+}
+
+export function modelForTask(task, environment = process.env) {
+  if (task.role === "builder" && task.complexity === "simple" && !environment.FACTORY_MODEL_BUILDER) {
+    return "azureai-textved/factory-kimi-k2-7-code";
+  }
+  return modelForRole(task.role, environment);
+}

package/src/scanner-suite.js

@@ -0,0 +1,58 @@
+import path from "node:path";
+import { run } from "./process.js";
+
+const scanners = [
+  {
+    name: "trivy",
+    image: "aquasec/trivy@sha256:cffe3f5161a47a6823fbd23d985795b3ed72a4c806da4c4df16266c02accdd6f",
+    args: ["fs", "--scanners", "vuln,secret,misconfig", "--severity", "HIGH,CRITICAL", "--exit-code", "1", "--format", "table", "/workspace"],
+  },
+  {
+    name: "gitleaks",
+    image: "zricethezav/gitleaks@sha256:c00b6bd0aeb3071cbcb79009cb16a60dd9e0a7c60e2be9ab65d25e6bc8abbb7f",
+    args: ["detect", "--source", "/workspace", "--redact", "--no-banner", "--exit-code", "1"],
+  },
+  {
+    name: "osv-scanner",
+    image: "ghcr.io/google/osv-scanner@sha256:f7ba4be68bac8086b1f88fd598fdca1ca67239c79ad2c2b5c78e03a82e5187c4",
+    args: ["scan", "--recursive", "/workspace", "--format", "json"],
+  },
+  {
+    name: "semgrep",
+    image: "semgrep/semgrep@sha256:183a149fb3e9700ab5294a7b4ab0241a826fd046bc8b721062fbea80fdfa438f",
+    args: ["semgrep", "scan", "--config", "p/default", "--json", "/workspace"],
+  },
+];
+
+function redact(value) {
+  return String(value)
+    .replaceAll(/((?:api[_-]?key|token|secret|password)\s*[=:]\s*)\S+/gi, "$1[REDACTED]")
+    .replaceAll(/\b[A-Za-z0-9+/_=-]{48,}\b/g, "[REDACTED]")
+    .slice(-20_000);
+}
+
+export class ScannerSuite {
+  constructor({ execute = run } = {}) {
+    this.execute = execute;
+  }
+
+  async scan(directory) {
+    const workspace = path.resolve(directory);
+    return Promise.all(scanners.map(async (scanner) => {
+      const args = [
+        "run", "--rm", "--read-only", "--cap-drop", "ALL", "--security-opt", "no-new-privileges",
+        "--pids-limit", "512", "--memory", "4g", "--cpus", "1", "--tmpfs", "/tmp:rw,noexec,nosuid,size=3g",
+        "--env", "HOME=/tmp",
+        "--volume", `${workspace}:/workspace:ro`, scanner.image, ...scanner.args,
+      ];
+      try {
+        const result = await this.execute("docker", args, { timeoutMs: 600_000, maxOutputBytes: 4_000_000, allowExitCodes: [0, 1, 2] });
+        const output = redact(`${result.stdout}\n${result.stderr}`);
+        const executionError = /(?:FATAL|Traceback|read-only file system|no space left on device)/i.test(output);
+        return { scanner: scanner.name, status: executionError || result.code === 2 ? "error" : result.code === 1 ? "findings" : "passed", output };
+      } catch (error) {
+        return { scanner: scanner.name, status: "error", output: redact(error.message) };
+      }
+    }));
+  }
+}

package/src/secrets.js

@@ -0,0 +1,22 @@
+import { DefaultAzureCredential } from "@azure/identity";
+import { SecretClient } from "@azure/keyvault-secrets";
+
+export async function loadRuntimeSecrets(config, credential = new DefaultAzureCredential(), environmentNames = Object.keys(config.secretNames)) {
+  const client = new SecretClient(config.keyVaultUrl, credential);
+  const values = {};
+  for (const environmentName of environmentNames) {
+    const secretName = config.secretNames[environmentName];
+    if (!secretName) throw new Error(`Unknown runtime secret: ${environmentName}`);
+    let secret;
+    try { secret = await client.getSecret(secretName); } catch (error) {
+      if (error.statusCode === 404 || error.code === "SecretNotFound") continue;
+      throw error;
+    }
+    if (!secret.value || /[\r\n]/.test(secret.value)) {
+      throw new Error(`Key Vault secret ${secretName} is empty or invalid`);
+    }
+    values[environmentName] = secret.value;
+  }
+  if (values.GH_TOKEN) values.GITHUB_PERSONAL_ACCESS_TOKEN = values.GH_TOKEN;
+  return values;
+}

package/src/setup-menu.js

@@ -0,0 +1,26 @@
+#!/usr/bin/env node
+import { confirm, input, select } from "@inquirer/prompts";
+import { writeFile } from "node:fs/promises";
+
+const output = process.argv[2];
+if (!output) throw new Error("Setup result path is required");
+
+const provider = await select({
+  message: "Which model provider should the factory configure?",
+  choices: [
+    { name: "Azure AI Foundry (recommended)", value: "azure" },
+    { name: "AWS Bedrock", value: "bedrock" },
+    { name: "Azure + Bedrock", value: "both" },
+  ],
+});
+const location = await input({ message: "Azure infrastructure region", default: "centralindia" });
+const githubOrg = await input({ message: "GitHub Enterprise organization (optional; Enter for personal repos)", default: "" });
+let awsRegion = "us-east-1";
+let bedrockBuilderModel = "";
+if (provider !== "azure") {
+  awsRegion = await input({ message: "AWS Bedrock region", default: "us-east-1" });
+  bedrockBuilderModel = await input({ message: "Bedrock builder model ID", default: "us.anthropic.claude-sonnet-4-6-v1:0" });
+}
+const deployNow = await confirm({ message: "Deploy and start the runtime after storing credentials?", default: true });
+const telegram = await confirm({ message: "Enable Telegram remote objective intake?", default: false });
+await writeFile(output, `${JSON.stringify({ provider, location, githubOrg, awsRegion, bedrockBuilderModel, deployNow, telegram })}\n`, { mode: 0o600 });

package/src/state.js

@@ -0,0 +1,49 @@
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import path from "node:path";
+
+export class StateStore {
+  #locks = new Map();
+
+  constructor(root) {
+    this.root = root;
+  }
+
+  objectiveDir(id) {
+    return path.join(this.root, id);
+  }
+
+  async read(id) {
+    return JSON.parse(await readFile(path.join(this.objectiveDir(id), "state.json"), "utf8"));
+  }
+
+  async write(id, value) {
+    const directory = this.objectiveDir(id);
+    await mkdir(directory, { recursive: true, mode: 0o750 });
+    const temporary = path.join(directory, `state.${process.pid}.${Date.now()}.tmp`);
+    await writeFile(temporary, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o640 });
+    await rename(temporary, path.join(directory, "state.json"));
+    return value;
+  }
+
+  async update(id, operation) {
+    const previous = this.#locks.get(id) ?? Promise.resolve();
+    const current = previous.catch(() => {}).then(async () => {
+      const state = await this.read(id);
+      return this.write(id, await operation(state));
+    });
+    this.#locks.set(id, current);
+    try {
+      return await current;
+    } finally {
+      if (this.#locks.get(id) === current) this.#locks.delete(id);
+    }
+  }
+
+  async writeResult(id, result) {
+    const directory = this.objectiveDir(id);
+    const output = path.join(directory, "result.json");
+    const temporary = path.join(directory, `result.${process.pid}.${Date.now()}.tmp`);
+    await writeFile(temporary, `${JSON.stringify(result, null, 2)}\n`, { mode: 0o640 });
+    await rename(temporary, output);
+  }
+}

package/src/task-entry.js

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+import { AzureAgentRunner } from "./agent-runner.js";
+import { loadRegistry } from "./registry.js";
+
+const input = await new Promise((resolve, reject) => {
+  let value = "";
+  process.stdin.setEncoding("utf8");
+  process.stdin.on("data", (chunk) => { value += chunk; });
+  process.stdin.on("end", () => resolve(value));
+  process.stdin.on("error", reject);
+});
+const packet = JSON.parse(input);
+const registry = await loadRegistry("/opt/agent-factory/app/config/capabilities.json");
+const runner = new AzureAgentRunner({ timeoutMs: 1_800_000 }, registry);
+let result;
+if (packet.mode === "plan") result = await runner.plan(packet.objective, "/workspace");
+else if (packet.mode === "task") result = await runner.invoke({ ...packet, directory: "/workspace" });
+else throw new Error(`Unsupported task mode: ${packet.mode}`);
+process.stdout.write(`${JSON.stringify(result)}\n`);

package/src/task-graph.js

@@ -0,0 +1,67 @@
+export function validateGraph(tasks) {
+  const ids = new Set(tasks.map((task) => task.id));
+  if (ids.size !== tasks.length) throw new Error("Task IDs must be unique");
+
+  for (const task of tasks) {
+    for (const dependency of task.dependsOn) {
+      if (!ids.has(dependency)) throw new Error(`Task ${task.id} depends on unknown task ${dependency}`);
+      if (dependency === task.id) throw new Error(`Task graph contains a cycle at ${task.id}`);
+    }
+  }
+
+  const visiting = new Set();
+  const visited = new Set();
+  const byId = new Map(tasks.map((task) => [task.id, task]));
+  function visit(id) {
+    if (visiting.has(id)) throw new Error(`Task graph contains a cycle at ${id}`);
+    if (visited.has(id)) return;
+    visiting.add(id);
+    for (const dependency of byId.get(id).dependsOn) visit(dependency);
+    visiting.delete(id);
+    visited.add(id);
+  }
+  for (const task of tasks) visit(task.id);
+  return tasks;
+}
+
+export function validateDeliveryGraph(tasks) {
+  validateGraph(tasks);
+  const releaseTasks = tasks.filter((task) => task.role === "release");
+  if (releaseTasks.length !== 1) throw new Error("Plan must contain exactly one release task");
+  const release = releaseTasks[0];
+  if (tasks.some((task) => task.dependsOn.includes(release.id))) {
+    throw new Error("Release task must be terminal");
+  }
+
+  const byId = new Map(tasks.map((task) => [task.id, task]));
+  const ancestors = new Set();
+  function collect(id) {
+    for (const dependency of byId.get(id).dependsOn) {
+      if (!ancestors.has(dependency)) {
+        ancestors.add(dependency);
+        collect(dependency);
+      }
+    }
+  }
+  collect(release.id);
+  for (const role of ["tester", "reviewer", "security"]) {
+    const gates = tasks.filter((task) => task.role === role);
+    if (gates.length === 0) throw new Error(`Plan must contain a ${role} task`);
+    if (!gates.some((task) => ancestors.has(task.id))) {
+      throw new Error(`Release must have a ${role} ancestor`);
+    }
+  }
+  return tasks;
+}
+
+export function readyTasks(tasks, results) {
+  return tasks
+    .filter((task) => !results[task.id])
+    .filter((task) => task.dependsOn.every((id) => results[id]?.status === "succeeded"))
+    .map((task) => task.id);
+}
+
+export function applyTaskResult(state, result) {
+  if (state.results[result.taskId]) return state;
+  return { ...state, results: { ...state.results, [result.taskId]: result } };
+}

package/src/telegram-service.js

@@ -0,0 +1,99 @@
+#!/usr/bin/env node
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { DefaultAzureCredential } from "@azure/identity";
+import { ServiceBusClient } from "@azure/service-bus";
+import { loadConfig } from "./config.js";
+import { loadRuntimeSecrets } from "./secrets.js";
+import { sendMessage } from "./bus.js";
+import { loadLocalState, loadQueueMetrics } from "./dashboard.js";
+import { isAllowedChat, objectiveFromTelegram, parseTelegramCommand } from "./telegram.js";
+import { log } from "./log.js";
+
+const config = loadConfig();
+Object.assign(process.env, await loadRuntimeSecrets(config, undefined, ["TELEGRAM_BOT_TOKEN", "TELEGRAM_ALLOWED_CHAT_IDS"]));
+const token = process.env.TELEGRAM_BOT_TOKEN;
+const allowed = new Set((process.env.TELEGRAM_ALLOWED_CHAT_IDS ?? "").split(",").map((value) => value.trim()).filter(Boolean));
+if (!token || allowed.size === 0) {
+  log("info", "telegram_disabled", { reason: "missing token or chat allowlist" });
+  process.exit(0);
+}
+
+const directory = path.join(config.stateDir, "telegram");
+const offsetFile = path.join(directory, "offset");
+await mkdir(directory, { recursive: true, mode: 0o750 });
+let offset = 0;
+try { offset = Number(await readFile(offsetFile, "utf8")) || 0; } catch (error) { if (error.code !== "ENOENT") throw error; }
+
+const client = new ServiceBusClient(config.serviceBusFqdn, new DefaultAzureCredential());
+const sender = client.createSender(config.controlQueue);
+const abort = new AbortController();
+
+async function telegram(method, body) {
+  const response = await fetch(`https://api.telegram.org/bot${token}/${method}`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(body),
+    signal: abort.signal,
+  });
+  const result = await response.json();
+  if (!response.ok || !result.ok) throw new Error(`Telegram ${method} failed: ${result.error_code ?? response.status}`);
+  return result.result;
+}
+
+async function reply(chatId, text) {
+  await telegram("sendMessage", { chat_id: chatId, text: String(text).slice(0, 4000), disable_web_page_preview: true });
+}
+
+async function saveOffset(value) {
+  const temporary = `${offsetFile}.${process.pid}.tmp`;
+  await writeFile(temporary, `${value}\n`, { mode: 0o640 });
+  await rename(temporary, offsetFile);
+}
+
+async function statusText() {
+  const [{ states }, queue] = await Promise.all([loadLocalState(config.stateDir), loadQueueMetrics(config)]);
+  const counts = {};
+  for (const state of states) counts[state.status ?? "unknown"] = (counts[state.status ?? "unknown"] ?? 0) + 1;
+  return [`Factory AI`, `Queue: ${queue.active} active, ${queue.deadLetter} dead-letter`, `Objectives: ${Object.entries(counts).map(([name, count]) => `${name} ${count}`).join(", ") || "none"}`].join("\n");
+}
+
+async function processUpdate(update) {
+  const message = update.message;
+  if (!message?.text || !isAllowedChat(message.chat?.id, allowed)) return;
+  try {
+    const command = parseTelegramCommand(message.text);
+    if (command.type === "help") return reply(message.chat.id, "/submit OWNER/REPO objective\n/goal OWNER/REPO objective\n/loop OWNER/REPO objective\n/status\n/help");
+    if (command.type === "status") return reply(message.chat.id, await statusText());
+    const objective = objectiveFromTelegram(update.update_id, command);
+    await sendMessage(sender, objective, objective.id);
+    await reply(message.chat.id, `Queued ${objective.id}\n${command.repository}\n${command.objective}`);
+  } catch (error) {
+    await reply(message.chat.id, `Rejected: ${String(error.message ?? error).slice(0, 500)}`);
+  }
+}
+
+async function shutdown(signal) {
+  log("info", "telegram_shutdown", { signal });
+  abort.abort();
+  await sender.close();
+  await client.close();
+}
+process.once("SIGTERM", () => shutdown("SIGTERM").catch(() => {}));
+process.once("SIGINT", () => shutdown("SIGINT").catch(() => {}));
+
+log("info", "telegram_started", { allowedChatCount: allowed.size });
+while (!abort.signal.aborted) {
+  try {
+    const updates = await telegram("getUpdates", { offset, timeout: 25, allowed_updates: ["message"] });
+    for (const update of updates) {
+      await processUpdate(update);
+      offset = update.update_id + 1;
+      await saveOffset(offset);
+    }
+  } catch (error) {
+    if (abort.signal.aborted) break;
+    log("error", "telegram_poll_failed", { error: String(error.message ?? error).replaceAll(token, "[REDACTED]").slice(0, 1000) });
+    await new Promise((resolve) => setTimeout(resolve, 5000));
+  }
+}

package/src/telegram.js

@@ -0,0 +1,31 @@
+const repositoryPattern = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+
+export function isAllowedChat(chatId, allowed) {
+  return allowed.size > 0 && allowed.has(String(chatId));
+}
+
+export function parseTelegramCommand(input) {
+  const text = String(input ?? "").trim();
+  const [rawCommand, repository, ...words] = text.split(/\s+/);
+  const command = rawCommand?.split("@")[0];
+  if (["/status", "/help"].includes(command) && !repository) return { type: command.slice(1) };
+  if (!["/submit", "/goal", "/loop"].includes(command)) throw new Error("Unknown command. Use /help");
+  if (!repositoryPattern.test(repository ?? "")) throw new Error("Repository must be OWNER/REPO");
+  const objective = words.join(" ").trim();
+  if (objective.length < 3) throw new Error("Objective is required");
+  if (objective.length > 8000) throw new Error("Objective is too long");
+  const prefix = command === "/submit" ? "" : `${command} `;
+  return { type: "submit", repository, objective: `${prefix}${objective}` };
+}
+
+export function objectiveFromTelegram(updateId, command, now = new Date()) {
+  if (command.type !== "submit" || !Number.isSafeInteger(updateId) || updateId < 0) throw new Error("Invalid Telegram objective input");
+  return {
+    id: `telegram-${updateId}`,
+    type: "objective",
+    objective: command.objective,
+    repository: `https://github.com/${command.repository}.git`,
+    baseBranch: "main",
+    createdAt: now.toISOString(),
+  };
+}