factory-ai 1.0.1 → 1.1.0

package/ARCHITECTURE.md

@@ -4,6 +4,6 @@ The CEO submits one objective. A deterministic control service persists state an
 
 The control service has no model, shell, Git, workspace, Docker, Key Vault secret-loading, or release implementation. Agent containers have bounded CPU, memory, PIDs, steps, output, runtime, filesystem mounts, commands, skills, and MCP tools. GitHub credentials remain on trusted host services.
 
-Durability comes from Service Bus peek-lock/redelivery, systemd supervision, a retained Premium SSD, atomic state writes, Git checkpoints, and GitHub pull requests. Benchmarked GPT-5.4 nano handles scouting, GPT-5.4 handles independent testing, Kimi K2.7-Code handles implementation, and GPT-5.6 handles planning, debugging, review, security, and release analysis.
+Durability comes from Service Bus peek-lock/redelivery, systemd supervision, a retained Premium SSD, atomic state writes, Git checkpoints, and GitHub pull requests. Benchmarked GPT-5.4 nano handles scouting, GPT-5.4 handles independent testing, Kimi K2.7-Code handles simple implementation, GPT-5.5 handles complex implementation, and GPT-5.6 handles planning, debugging, review, security, and release analysis.
 
 Trust boundaries: CEO input and repository content are untrusted; capability definitions are pinned and allowlisted; agent containers cannot publish; the release bot cannot bypass approval gates; Azure credentials are loaded from Key Vault into process memory.

package/CHANGELOG.md

@@ -11,6 +11,21 @@ All notable changes follow semantic versioning and the Keep a Changelog structur
 - Azure and Bedrock provider wizard.
 - Durable evaluation, analytics, scaling, policy, extension, and recovery roadmap.
 
+## [1.1.0] - 2026-07-13
+
+### Added
+
+- GPT-5.5 as the benchmarked default implementation model, with Kimi retained for explicitly simple tasks.
+- Per-role step/output budgets and per-model input/cache/output token telemetry.
+- Cache-friendly prompt ordering and compact deterministic memory.
+- Bounded line-range reads, listings, command output, MCP output, and scanner evidence.
+
+## [1.0.2] - 2026-07-13
+
+### Fixed
+
+- Compress large Azure dashboard payloads so the interactive TUI remains reliable as objective history grows.
+
 ## [1.0.1] - 2026-07-13
 
 ### Fixed

package/README.md

@@ -57,7 +57,7 @@ factory ui
 
   [running] Add authenticated health checks
     succeeded  scout     GPT-5.4 nano  · inspect conventions
-    running    builder   GPT-5.6       · implement contract
+    running    builder   GPT-5.5       · implement contract
     blocked    tester    GPT-5.4       · verify behavior
     blocked    reviewer  GPT-5.6       · review correctness
     blocked    security  GPT-5.6       · assess boundaries
@@ -115,12 +115,25 @@ Defaults are evidence-based and role-specific:
 | --- | --- | --- |
 | Scout | GPT-5.4 nano | Low-cost search and repository inspection |
 | Simple builder task | Kimi K2.7-Code | Economy coding path, independently reviewed |
-| Complex/unspecified builder task | GPT-5.6 | Fail-safe implementation default |
+| Complex/unspecified builder task | GPT-5.5 | Faster benchmarked implementation default |
 | Tester | GPT-5.4 | Independent behavioral verification |
 | Planner, debugger, reviewer, security, release | GPT-5.6 | Higher-judgment work |
 
 Any role can be overridden with an Azure deployment or `bedrock/MODEL_ID`. Bedrock uses the Converse tool API behind the same sandbox and approval gates.
 
+## Token and Cost Efficiency
+
+Factory AI minimizes tokens before relying on cheaper models:
+
+- GPT-5.4 nano scouts, Kimi handles explicitly simple coding, GPT-5.5 handles complex coding, and GPT-5.6 is reserved for high-judgment roles.
+- Stable guardrail/skill prompt prefixes improve provider prompt-cache reuse.
+- Every role has explicit step and output-token budgets.
+- File reads are line-ranged and bounded; listings, commands, MCP output, memory, and scanner evidence are truncated with continuation hints.
+- Read-only roles do not receive write-tool schemas.
+- Planner memory is compact, repository-scoped, and limited to recent verified events.
+- Dashboard and TUI track input, cached-input, and output tokens by model.
+- The planner is instructed to produce the smallest valid DAG, avoiding duplicate agents.
+
 ## Reliability
 
 - Azure Service Bus peek-lock delivery, duplicate detection, retries, and dead letters

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "factory-ai",
-  "version": "1.0.1",
+  "version": "1.1.0",
   "description": "Deploy a private autonomous coding-agent factory on Azure: isolated builders, testers, security reviewers, durable orchestration, multi-model routing, memory, cost controls, and gated GitHub pull requests.",
   "private": false,
   "license": "MIT",

package/src/agent-runner.js

@@ -24,6 +24,15 @@ function endpointForRoute(route, role, environment) {
   return { baseUrl, apiKey, model };
 }
 
+function budgetFor(task) {
+  if (task.role === "scout") return { maxSteps: 14, maxOutputTokens: 1200 };
+  if (task.role === "builder" && task.complexity === "simple") return { maxSteps: 20, maxOutputTokens: 2400 };
+  if (task.role === "builder") return { maxSteps: 32, maxOutputTokens: 3200 };
+  if (task.role === "debugger") return { maxSteps: 36, maxOutputTokens: 3200 };
+  if (["tester", "reviewer", "security"].includes(task.role)) return { maxSteps: 22, maxOutputTokens: 1800 };
+  return { maxSteps: 22, maxOutputTokens: 2200 };
+}
+
 export class AzureAgentRunner {
   constructor(config, registry, {
     environment = process.env,
@@ -42,40 +51,56 @@ export class AzureAgentRunner {
       `ALLOWLISTED SKILL ${item.name}@${item.version}:\n${await readFile(item.path, "utf8")}`
     )));
     return [
-      `You are the isolated ${task.role} subagent for CEO objective: ${objective.objective}`,
-      task.instructions,
+      `You are a Factory AI isolated ${task.role} subagent.`,
       "Work only in the assigned repository. Never inspect credentials, push Git refs, deploy, or install global tools.",
       "Use tools for evidence. Make the smallest correct change and verify every completion claim.",
-      prompt,
-      ...skills,
       'Return only JSON: {"summary":"concise outcome","checks":["command/result"],"risks":["remaining risk"],"approval":"approved|changes_requested|not_applicable"}.',
+      ...skills,
+      `CEO objective: ${objective.objective}`,
+      task.instructions,
+      prompt,
     ].join("\n\n");
   }
 
   harness(task, directory, additionalTools = {}) {
     const role = task.role;
     const route = modelForTask(task, this.environment);
-    const tools = { ...createWorkspaceTools(directory), ...additionalTools };
-    const maxSteps = role === "scout" ? 20 : 40;
+    const workspaceTools = createWorkspaceTools(directory);
+    if (!["builder", "debugger"].includes(role)) delete workspaceTools.write_file;
+    const tools = { ...workspaceTools, ...additionalTools };
+    const budget = budgetFor(task);
     if (route.startsWith("bedrock/")) {
       return this.createBedrockHarness({
         region: this.environment.AWS_REGION ?? "us-east-1",
         model: route.slice("bedrock/".length),
         tools,
-        maxSteps,
+        ...budget,
       });
     }
-    return this.createHarness({ ...endpointForRoute(route, role, this.environment), tools, timeoutMs: this.config.timeoutMs, maxSteps });
+    return this.createHarness({ ...endpointForRoute(route, role, this.environment), tools, timeoutMs: this.config.timeoutMs, ...budget });
   }
 
   async invoke({ objective, task, directory, prompt }) {
     const capabilities = selectCapabilities(this.registry, task.role, task.capabilities);
     const mcp = await connectMcpTools(capabilities);
+    const started = Date.now();
     try {
       const response = await this.harness(task, directory, mcp.tools).run(
         await this.promptForTask(objective, task, prompt, capabilities),
       );
-      return parseJson(response.text);
+      return {
+        ...parseJson(response.text),
+        telemetry: {
+          model: modelForTask(task, this.environment),
+          steps: response.steps ?? 0,
+          durationMs: Date.now() - started,
+          usage: {
+            inputTokens: response.usage?.inputTokens ?? 0,
+            cachedInputTokens: response.usage?.cachedInputTokens ?? 0,
+            outputTokens: response.usage?.outputTokens ?? 0,
+          },
+        },
+      };
     } finally {
       await mcp.close();
     }
@@ -90,15 +115,16 @@ export class AzureAgentRunner {
       ...Object.entries(this.registry.skills ?? {}),
       ...Object.entries(this.registry.mcp ?? {}),
     ].map(([name, item]) => [name, { version: item.version, roles: item.roles }]));
-    const prompt = `You are a planner subagent. Decompose the objective into a small executable DAG.
-Objective: ${objective.objective}
-Verified prior project context: ${JSON.stringify(projectContext)}
+    const prompt = `You are a Factory AI planner subagent. Decompose objectives into the smallest executable DAG.
 Allowed roles: scout, builder, tester, debugger, reviewer, security, release.
 Allowed capabilities: ${JSON.stringify(registrySummary)}
 Include tester, reviewer, and security ancestors of exactly one terminal release task.
 Return only JSON: {"executiveIntent":"...","tasks":[{"id":"...","role":"...","title":"...","instructions":"...","dependsOn":[],"capabilities":[],"complexity":"simple|complex"}]}
 
-${plannerSkills.join("\n\n")}`;
+${plannerSkills.join("\n\n")}
+
+Objective: ${objective.objective}
+Verified prior project context: ${JSON.stringify(projectContext).slice(0, 12000)}`;
     const mcp = await connectMcpTools(plannerCapabilities);
     try {
       const response = await this.harness({ role: "planner", complexity: "complex" }, directory, mcp.tools).run(prompt);

package/src/azure-harness.js

@@ -27,6 +27,7 @@ export class AzureResponsesHarness {
     tools,
     fetch = globalThis.fetch,
     maxSteps = 40,
+    maxOutputTokens = 4096,
     retries = 4,
     timeoutMs = 180_000,
     sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
@@ -37,6 +38,7 @@ export class AzureResponsesHarness {
     this.tools = tools;
     this.fetch = fetch;
     this.maxSteps = maxSteps;
+    this.maxOutputTokens = maxOutputTokens;
     this.retries = retries;
     this.timeoutMs = timeoutMs;
     this.sleep = sleep;
@@ -79,15 +81,20 @@ export class AzureResponsesHarness {
     let input = prompt;
     let previousResponseId;
     const definitions = toolDefinitions(this.tools);
+    const usage = { inputTokens: 0, cachedInputTokens: 0, outputTokens: 0 };
     for (let step = 0; step < this.maxSteps; step += 1) {
       const response = await this.request({
         model: this.model,
         input,
         ...(previousResponseId ? { previous_response_id: previousResponseId } : {}),
         tools: definitions,
+        max_output_tokens: this.maxOutputTokens,
       });
+      usage.inputTokens += response.usage?.input_tokens ?? 0;
+      usage.cachedInputTokens += response.usage?.input_tokens_details?.cached_tokens ?? 0;
+      usage.outputTokens += response.usage?.output_tokens ?? 0;
       const calls = (response.output ?? []).filter((item) => item.type === "function_call");
-      if (calls.length === 0) return { text: outputText(response), responseId: response.id, steps: step + 1 };
+      if (calls.length === 0) return { text: outputText(response), responseId: response.id, steps: step + 1, usage };
       const outputs = [];
       for (const call of calls) {
         const tool = this.tools[call.name];

package/src/bedrock-harness.js

@@ -11,11 +11,12 @@ function definitions(tools) {
 }
 
 export class BedrockHarness {
-  constructor({ client, region = process.env.AWS_REGION ?? "us-east-1", model, tools, maxSteps = 40 }) {
+  constructor({ client, region = process.env.AWS_REGION ?? "us-east-1", model, tools, maxSteps = 40, maxOutputTokens = 4096 }) {
     this.client = client ?? new BedrockRuntimeClient({ region });
     this.model = model;
     this.tools = tools;
     this.maxSteps = maxSteps;
+    this.maxOutputTokens = maxOutputTokens;
   }
 
   async run(prompt) {
@@ -25,6 +26,7 @@ export class BedrockHarness {
       const response = await this.client.send(new ConverseCommand({
         modelId: this.model,
         messages,
+        inferenceConfig: { maxTokens: this.maxOutputTokens },
         ...(Object.keys(this.tools).length ? { toolConfig: { tools: definitions(this.tools) } } : {}),
       }));
       usage.inputTokens += response.usage?.inputTokens ?? 0;

package/src/dashboard.js

@@ -123,6 +123,20 @@ export function aggregateDashboard({ states = [], queue = {}, cost = null, runti
   });
   const summary = {};
   for (const objective of objectives) summary[objective.status ?? "unknown"] = (summary[objective.status ?? "unknown"] ?? 0) + 1;
+  const modelUsage = {};
+  for (const state of states) {
+    for (const result of Object.values(state.results ?? {})) {
+      const telemetry = result.telemetry;
+      if (!telemetry?.model) continue;
+      const current = modelUsage[telemetry.model] ?? { tasks: 0, inputTokens: 0, cachedInputTokens: 0, outputTokens: 0, durationMs: 0 };
+      current.tasks += 1;
+      current.inputTokens += telemetry.usage?.inputTokens ?? 0;
+      current.cachedInputTokens += telemetry.usage?.cachedInputTokens ?? 0;
+      current.outputTokens += telemetry.usage?.outputTokens ?? 0;
+      current.durationMs += telemetry.durationMs ?? 0;
+      modelUsage[telemetry.model] = current;
+    }
+  }
   const startedAt = runtime.startedAt ? new Date(runtime.startedAt) : null;
   return {
     generatedAt: now.toISOString(),
@@ -133,6 +147,7 @@ export function aggregateDashboard({ states = [], queue = {}, cost = null, runti
     queue: { active: queue.active ?? 0, deadLetter: queue.deadLetter ?? 0 },
     cost,
     summary: { objectives: summary },
+    modelUsage,
     objectives,
     warnings,
   };
@@ -150,6 +165,10 @@ export function renderDashboard(dashboard, { width = 100 } = {}) {
     `Objectives ${Object.entries(dashboard.summary.objectives).map(([state, count]) => `${state}:${count}`).join(" ") || "none"}`,
   ];
   if (dashboard.cost) lines.push(`Azure MTD ${dashboard.cost.currency} ${dashboard.cost.monthToDate.toFixed(2)} · billing data may be delayed`);
+  const totalInput = Object.values(dashboard.modelUsage ?? {}).reduce((sum, item) => sum + item.inputTokens, 0);
+  const totalCached = Object.values(dashboard.modelUsage ?? {}).reduce((sum, item) => sum + item.cachedInputTokens, 0);
+  const totalOutput = Object.values(dashboard.modelUsage ?? {}).reduce((sum, item) => sum + item.outputTokens, 0);
+  if (totalInput || totalOutput) lines.push(`Tokens input ${totalInput} · cached ${totalCached} · output ${totalOutput}`);
   for (const objective of dashboard.objectives) {
     lines.push("", `[${objective.status}] ${objective.id} ${objective.objective}`);
     for (const task of objective.tasks) lines.push(`  ${task.state.padEnd(9)} ${task.role.padEnd(9)} ${task.model} · ${task.title ?? task.id}`);

package/src/mcp-tools.js

@@ -1,5 +1,6 @@
 function renderContent(result) {
-  return (result.content ?? []).map((item) => item.type === "text" ? item.text : JSON.stringify(item)).join("\n");
+  const value = (result.content ?? []).map((item) => item.type === "text" ? item.text : JSON.stringify(item)).join("\n");
+  return value.length > 32_000 ? `${value.slice(0, 32_000)}\n[TRUNCATED: request narrower MCP output]` : value;
 }
 
 async function defaultConnect(capability) {

package/src/operator.js

@@ -1,6 +1,7 @@
 import { readFile } from "node:fs/promises";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
+import { gunzipSync } from "node:zlib";
 import { run } from "./process.js";
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
@@ -20,7 +21,16 @@ export function createOperator(environment = process.env) {
   const vm = environment.FACTORY_VM ?? "agent-factory-vm";
   const namespace = environment.FACTORY_SERVICE_BUS ?? "";
   const vault = environment.FACTORY_KEY_VAULT ?? "";
-  const remote = async (script) => extractRunCommand(await command("az", ["vm", "run-command", "invoke", "--resource-group", resourceGroup, "--name", vm, "--command-id", "RunShellScript", "--scripts", script, "--query", "value[0].message", "--output", "tsv"]));
+  const remote = async (script) => {
+    for (let attempt = 0; attempt < 6; attempt += 1) {
+      try { return extractRunCommand(await command("az", ["vm", "run-command", "invoke", "--resource-group", resourceGroup, "--name", vm, "--command-id", "RunShellScript", "--scripts", script, "--query", "value[0].message", "--output", "tsv"])); }
+      catch (error) {
+        if (!error.message.includes("Conflict") || attempt === 5) throw error;
+        await new Promise((resolve) => setTimeout(resolve, 10_000));
+      }
+    }
+    throw new Error("Azure Run Command remained busy");
+  };
   const withVault = async (operation) => {
     const ip = await command("curl", ["-fsS", "https://api.ipify.org"]);
     await command("az", ["keyvault", "network-rule", "add", "--name", vault, "--ip-address", `${ip}/32`, "--output", "none"]);
@@ -30,7 +40,10 @@ export function createOperator(environment = process.env) {
     }
   };
   return {
-    dashboard: async () => JSON.parse(await remote("sudo -u factory env $(xargs < /etc/agent-factory-control.env) node /opt/agent-factory/app/src/dashboard.js --json")),
+    dashboard: async () => {
+      const encoded = await remote("sudo -u factory env $(xargs < /etc/agent-factory-control.env) node /opt/agent-factory/app/src/dashboard.js --json | gzip -c | base64 -w0");
+      return JSON.parse(gunzipSync(Buffer.from(encoded, "base64")).toString("utf8"));
+    },
     logs: async () => remote('journalctl -u agent-factory-control -u agent-factory-worker -u agent-factory-release --since "1 hour ago" --no-pager -n 300'),
     submit: async (repository, objective) => {
       if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(repository) || objective.trim().length < 3) throw new Error("Valid repository and objective are required");
@@ -43,7 +56,7 @@ export function createOperator(environment = process.env) {
       return command(path.join(root, "bin/factory"), [action]);
     },
     capabilities: async () => JSON.parse(await readFile(path.join(root, "config/capabilities.json"), "utf8")),
-    config: () => ({ resourceGroup, vm, namespace, vault }),
+    config: () => ({ resourceGroup, vm, namespace, vault, models: { scout: "GPT-5.4 nano", simpleBuilder: "Kimi K2.7-Code", builder: "GPT-5.5", tester: "GPT-5.4", critical: "GPT-5.6" } }),
     listSecrets: async () => withVault(async () => JSON.parse(await command("az", ["keyvault", "secret", "list", "--vault-name", vault, "--query", "[].{name:name,updated:attributes.updated}", "--output", "json"]))),
     setSecret: async (name, value) => withVault(async () => {
       if (!/^[A-Za-z0-9-]{1,127}$/.test(name) || !value) throw new Error("Valid secret name and value are required");

package/src/project-memory.js

@@ -12,11 +12,19 @@ export class ProjectMemory {
     await appendFile(this.file, `${JSON.stringify({ ...event, recordedAt: new Date().toISOString() })}\n`, { mode: 0o640 });
   }
 
-  async context(repository, limit = 20) {
+  async context(repository, limit = 8) {
     let text;
     try { text = await readFile(this.file, "utf8"); } catch (error) { if (error.code === "ENOENT") return []; throw error; }
     return text.split("\n").filter(Boolean).flatMap((line) => {
       try { const value = JSON.parse(line); return value.repository === repository ? [value] : []; } catch { return []; }
-    }).slice(-limit);
+    }).slice(-limit).map((value) => ({
+      type: value.type,
+      objectiveId: value.objectiveId,
+      objective: String(value.objective ?? "").slice(0, 1000),
+      executiveIntent: String(value.executiveIntent ?? "").slice(0, 1000),
+      pullRequest: value.pullRequest,
+      blockers: (value.blockers ?? []).slice(0, 10).map((item) => String(item).slice(0, 300)),
+      recordedAt: value.recordedAt,
+    }));
   }
 }

package/src/routing.js

@@ -13,7 +13,7 @@ const MODELS = Object.freeze({
   scout: "azureai-textved/factory-gpt-5-4-nano",
   tester: "azureai-responses/gpt-5.4",
   planner: "azureai-textved/gpt-5.6-sol",
-  builder: "azureai-textved/gpt-5.6-sol",
+  builder: "azureai-textved/gpt-5.5",
   debugger: "azureai-textved/gpt-5.6-sol",
   reviewer: "azureai-textved/gpt-5.6-sol",
   security: "azureai-textved/gpt-5.6-sol",

package/src/scanner-suite.js

@@ -26,9 +26,10 @@ const scanners = [
 
 function redact(value) {
   return String(value)
+    .replaceAll(/\u001b\[[0-9;]*m/g, "")
     .replaceAll(/((?:api[_-]?key|token|secret|password)\s*[=:]\s*)\S+/gi, "$1[REDACTED]")
     .replaceAll(/\b[A-Za-z0-9+/_=-]{48,}\b/g, "[REDACTED]")
-    .slice(-20_000);
+    .slice(-6000);
 }
 
 export class ScannerSuite {

package/src/tui.js

@@ -18,6 +18,7 @@ let capabilities;
 let secrets;
 let logs;
 let section = "Overview";
+let refreshing = false;
 
 function status(message, color = colors.muted) {
   footer.setContent(`  {${color}-fg}${message}{/}   {bold}n{/} new   {bold}r{/} refresh   {bold}q{/} quit`);
@@ -32,8 +33,12 @@ function badge(value) {
 function renderOverview() {
   const cost = dashboard?.cost ? `${dashboard.cost.currency} ${dashboard.cost.monthToDate.toFixed(2)}` : "unavailable";
   const counts = Object.entries(dashboard?.summary?.objectives ?? {}).map(([key, value]) => `${key} ${value}`).join("  ") || "none";
+  const modelUsage = Object.values(dashboard?.modelUsage ?? {});
+  const inputTokens = modelUsage.reduce((sum, item) => sum + item.inputTokens, 0);
+  const cachedTokens = modelUsage.reduce((sum, item) => sum + item.cachedInputTokens, 0);
+  const outputTokens = modelUsage.reduce((sum, item) => sum + item.outputTokens, 0);
   const recent = (dashboard?.objectives ?? []).slice(-8).reverse().map((objective) => `  ${badge(objective.status.padEnd(9))}  {bold}${objective.objective}{/}\n             ${objective.repository ?? ""}`).join("\n\n");
-  main.setContent(`{bold}System{/}\n\n  Queue      {#78dba9-fg}${dashboard?.queue?.active ?? 0}{/}\n  Dead letter ${dashboard?.queue?.deadLetter ?? 0}\n  Azure MTD  {#efc46b-fg}${cost}{/}\n  Objectives ${counts}\n\n{bold}Recent objectives{/}\n\n${recent || "  No objectives yet."}`);
+  main.setContent(`{bold}System{/}\n\n  Queue       {#78dba9-fg}${dashboard?.queue?.active ?? 0}{/}\n  Dead letter ${dashboard?.queue?.deadLetter ?? 0}\n  Azure MTD   {#efc46b-fg}${cost}{/}\n  Objectives  ${counts}\n  Tokens      ${inputTokens} in · ${cachedTokens} cached · ${outputTokens} out\n\n{bold}Recent objectives{/}\n\n${recent || "  No objectives yet."}`);
 }
 
 function renderObjectives() {
@@ -60,7 +65,7 @@ function renderCapabilities() {
 
 function renderSettings() {
   const config = operator.config();
-  main.setContent(`{bold}Runtime{/}\n\n  Resource group  ${config.resourceGroup}\n  VM              ${config.vm}\n  Service Bus     ${config.namespace}\n  Key Vault       ${config.vault}\n\n{bold}Model policy{/}\n\n  Scout           GPT-5.4 nano\n  Simple builder  Kimi K2.7-Code\n  Builder         GPT-5.6\n  Tester          GPT-5.4\n  Critical roles  GPT-5.6\n\n{#7f8b99-fg}Run factory setup to change providers or role routes.{/}`);
+  main.setContent(`{bold}Runtime{/}\n\n  Resource group  ${config.resourceGroup}\n  VM              ${config.vm}\n  Service Bus     ${config.namespace}\n  Key Vault       ${config.vault}\n\n{bold}Model policy{/}\n\n  Scout           GPT-5.4 nano\n  Simple builder  Kimi K2.7-Code\n  Builder         GPT-5.5\n  Tester          GPT-5.4\n  Critical roles  GPT-5.6\n\n{#7f8b99-fg}Run factory setup to change providers or role routes.{/}`);
 }
 
 function render() {
@@ -77,6 +82,8 @@ function render() {
 }
 
 async function refresh() {
+  if (refreshing) return;
+  refreshing = true;
   status("Refreshing...");
   try {
     dashboard = await operator.dashboard();
@@ -86,6 +93,7 @@ async function refresh() {
     render();
     status(`Updated ${new Date().toLocaleTimeString()}`);
   } catch (error) { status(error.message, colors.danger); }
+  finally { refreshing = false; }
 }
 
 function ask(label, { secret = false } = {}) {

package/src/validation.js

@@ -36,6 +36,16 @@ const taskResultSchema = z.object({
   checks: z.array(z.string().trim().min(1).max(1000)).max(50),
   risks: z.array(z.string().trim().min(1).max(1000)).max(50),
   approval: z.enum(["approved", "changes_requested", "not_applicable"]),
+  telemetry: z.object({
+    model: z.string().min(1).max(300),
+    steps: z.number().int().nonnegative(),
+    durationMs: z.number().int().nonnegative(),
+    usage: z.object({
+      inputTokens: z.number().int().nonnegative().default(0),
+      cachedInputTokens: z.number().int().nonnegative().default(0),
+      outputTokens: z.number().int().nonnegative().default(0),
+    }),
+  }).optional(),
 }).strict();
 
 export const workMessageSchema = z.object({

package/src/workspace-tools.js

@@ -47,17 +47,25 @@ export function createWorkspaceTools(rootInput, { execute = run } = {}) {
   const root = realpathSync(path.resolve(rootInput));
   return {
     read_file: {
-      description: "Read a UTF-8 file inside the assigned workspace.",
+      description: "Read a bounded UTF-8 line range inside the assigned workspace. Use offsetLine/limitLines instead of rereading large files.",
       parameters: {
         type: "object",
-        properties: { path: { type: "string" } },
+        properties: {
+          path: { type: "string" },
+          offsetLine: { type: "integer", minimum: 1 },
+          limitLines: { type: "integer", minimum: 1, maximum: 2000 },
+        },
         required: ["path"],
         additionalProperties: false,
       },
-      execute: async ({ path: requested }) => {
+      execute: async ({ path: requested, offsetLine = 1, limitLines = 400 }) => {
         const value = await readFile(await existingPath(root, requested), "utf8");
-        if (Buffer.byteLength(value) > 512_000) throw new Error("File exceeds 512000 bytes");
-        return value;
+        const lines = value.split("\n");
+        const start = offsetLine - 1;
+        let output = lines.slice(start, start + limitLines).join("\n");
+        if (start + limitLines < lines.length) output += `\n[TRUNCATED: ${lines.length - start - limitLines} more lines; request the next range]`;
+        if (Buffer.byteLength(output) > 256_000) output = `${output.slice(0, 256_000)}\n[TRUNCATED: byte limit]`;
+        return output;
       },
     },
     write_file: {
@@ -81,14 +89,14 @@ export function createWorkspaceTools(rootInput, { execute = run } = {}) {
       description: "List files recursively inside the assigned workspace.",
       parameters: {
         type: "object",
-        properties: { path: { type: "string" } },
+        properties: { path: { type: "string" }, limit: { type: "integer", minimum: 1, maximum: 2000 } },
         required: ["path"],
         additionalProperties: false,
       },
-      execute: async ({ path: requested }) => {
+      execute: async ({ path: requested, limit = 500 }) => {
         const directory = await existingPath(root, requested);
         const output = [];
-        await walk(directory, root, output, 2000);
+        await walk(directory, root, output, limit);
         return JSON.stringify(output);
       },
     },
@@ -110,11 +118,12 @@ export function createWorkspaceTools(rootInput, { execute = run } = {}) {
         const result = await execute(command, args, {
           cwd: root,
           timeoutMs: 900_000,
-          maxOutputBytes: 2_000_000,
+          maxOutputBytes: 500_000,
           inheritEnv: false,
           env: { PATH: process.env.PATH, HOME: "/tmp/agent-home", CI: "true", NO_COLOR: "1" },
         });
-        return `${result.stdout}${result.stderr ? `\nSTDERR:\n${result.stderr}` : ""}`.slice(-2_000_000);
+        const output = `${result.stdout}${result.stderr ? `\nSTDERR:\n${result.stderr}` : ""}`;
+        return output.length > 120_000 ? `[TRUNCATED: showing final 120000 characters]\n${output.slice(-120_000)}` : output;
       },
     },
   };