factory-ai 1.2.1 → 1.3.0

package/CHANGELOG.md

@@ -11,6 +11,14 @@ All notable changes follow semantic versioning and the Keep a Changelog structur
 - Azure and Bedrock provider wizard.
 - Durable evaluation, analytics, scaling, policy, extension, and recovery roadmap.
 
+## [1.3.0] - 2026-07-13
+
+### Added
+
+- RBAC-protected Azure Blob dashboard snapshots for lock-free multi-operator TUI access.
+- One-minute snapshot timer and direct local Azure-identity reads.
+- Factory AI process, container, journal, Azure, Bedrock, MCP, Git, and PR identity metadata.
+
 ## [1.2.1] - 2026-07-13
 
 ### Fixed

package/bin/factory

@@ -9,6 +9,7 @@ RESOURCE_GROUP=${FACTORY_RESOURCE_GROUP:-factory-ai-rg}
 VM=${FACTORY_VM:-agent-factory-vm}
 NAMESPACE=${FACTORY_SERVICE_BUS:-}
 VAULT=${FACTORY_KEY_VAULT:-}
+STORAGE=${FACTORY_STORAGE_ACCOUNT:-}
 
 remote() {
   az vm run-command invoke --resource-group "$RESOURCE_GROUP" --name "$VM" \
@@ -73,7 +74,7 @@ case "$command" in
     exec "$0" submit "$repo" "$objective"
     ;;
   ui)
-    FACTORY_RESOURCE_GROUP="$RESOURCE_GROUP" FACTORY_VM="$VM" FACTORY_SERVICE_BUS="$NAMESPACE" FACTORY_KEY_VAULT="$VAULT" node "$FACTORY_ROOT/src/tui.js"
+    FACTORY_RESOURCE_GROUP="$RESOURCE_GROUP" FACTORY_VM="$VM" FACTORY_SERVICE_BUS="$NAMESPACE" FACTORY_KEY_VAULT="$VAULT" FACTORY_STORAGE_ACCOUNT="$STORAGE" node "$FACTORY_ROOT/src/tui.js"
     ;;
   setup)
     for dependency in az gh jq curl ssh-keygen node; do command -v "$dependency" >/dev/null || { printf 'Missing dependency: %s\n' "$dependency" >&2; exit 1; }; done
@@ -96,6 +97,7 @@ case "$command" in
     deployment=$(az deployment group create --name agent-factory-setup --resource-group "$RESOURCE_GROUP" --template-file "$FACTORY_ROOT/infra/main.bicep" --parameters adminSshKey="$(< "$key.pub")" operatorObjectId="$operator" --output json)
     vault=$(jq -r '.properties.outputs.keyVaultName.value' <<<"$deployment")
     namespace=$(jq -r '.properties.outputs.serviceBusNamespace.value' <<<"$deployment")
+    storage=$(jq -r '.properties.outputs.storageAccount.value' <<<"$deployment")
     VAULT=$vault
     NAMESPACE=$namespace
     mkdir -p "$(dirname "$CONFIG_FILE")"
@@ -104,6 +106,7 @@ case "$command" in
       printf 'FACTORY_VM=%q\n' agent-factory-vm
       printf 'FACTORY_SERVICE_BUS=%q\n' "$namespace"
       printf 'FACTORY_KEY_VAULT=%q\n' "$vault"
+      printf 'FACTORY_STORAGE_ACCOUNT=%q\n' "$storage"
     } > "$CONFIG_FILE"
     chmod 0600 "$CONFIG_FILE"
     ip=$(curl -fsS https://api.ipify.org)
@@ -151,7 +154,7 @@ case "$command" in
     printf 'Azure foundation and credential vault ready. Config: %s\n' "$CONFIG_FILE"
     if [[ $deploy_now == true ]]; then
       source_ref=$(gh api repos/itsvedantkumar/factory-ai/commits/main --jq .sha)
-      parameters=(KEY_VAULT_NAME "$vault" SERVICE_BUS_NAMESPACE "$namespace" SERVICE_BUS_QUEUE code-tasks SOURCE_REPOSITORY itsvedantkumar/factory-ai SOURCE_REF "$source_ref")
+      parameters=(KEY_VAULT_NAME "$vault" SERVICE_BUS_NAMESPACE "$namespace" SERVICE_BUS_QUEUE code-tasks FACTORY_STORAGE_ACCOUNT "$storage" SOURCE_REPOSITORY itsvedantkumar/factory-ai SOURCE_REF "$source_ref")
       if [[ $provider == bedrock ]]; then
         parameters+=(AWS_REGION "$aws_region")
         for role in SCOUT PLANNER BUILDER TESTER DEBUGGER REVIEWER SECURITY RELEASE; do parameters+=("FACTORY_MODEL_$role" "bedrock/$bedrock_builder"); done

package/bootstrap/agent-factory-control.service

@@ -7,6 +7,7 @@ StartLimitBurst=10
 
 [Service]
 Type=simple
+SyslogIdentifier=factory-ai-control
 User=factory
 Group=factory
 WorkingDirectory=/opt/agent-factory/app

package/bootstrap/agent-factory-release.service

@@ -5,6 +5,7 @@ Wants=network-online.target
 
 [Service]
 Type=simple
+SyslogIdentifier=factory-ai-release
 User=factory
 Group=factory
 WorkingDirectory=/opt/agent-factory/app

package/bootstrap/agent-factory-reporter.service

@@ -4,6 +4,7 @@ After=agent-factory-worker.service
 
 [Service]
 Type=oneshot
+SyslogIdentifier=factory-ai-reporter
 User=factory
 Group=factory
 WorkingDirectory=/opt/agent-factory/app

package/bootstrap/agent-factory-telegram.service

@@ -5,6 +5,7 @@ Wants=network-online.target
 
 [Service]
 Type=simple
+SyslogIdentifier=factory-ai-telegram
 User=factory
 Group=factory
 WorkingDirectory=/opt/agent-factory/app

package/bootstrap/agent-factory-worker.service

@@ -8,6 +8,7 @@ StartLimitBurst=10
 
 [Service]
 Type=simple
+SyslogIdentifier=factory-ai-worker
 User=factory
 Group=factory
 WorkingDirectory=/opt/agent-factory/app

package/bootstrap/deploy-runtime.sh

@@ -20,7 +20,7 @@ while (($# > 0)); do
     shift
   fi
   case "$name" in
-    KEY_VAULT_NAME|SERVICE_BUS_NAMESPACE|SERVICE_BUS_QUEUE|SOURCE_REPOSITORY|SOURCE_REF|AWS_REGION|FACTORY_MODEL_SCOUT|FACTORY_MODEL_PLANNER|FACTORY_MODEL_BUILDER|FACTORY_MODEL_TESTER|FACTORY_MODEL_DEBUGGER|FACTORY_MODEL_REVIEWER|FACTORY_MODEL_SECURITY|FACTORY_MODEL_RELEASE) printf -v "$name" '%s' "$value" ;;
+    KEY_VAULT_NAME|SERVICE_BUS_NAMESPACE|SERVICE_BUS_QUEUE|SOURCE_REPOSITORY|SOURCE_REF|FACTORY_STORAGE_ACCOUNT|AWS_REGION|FACTORY_MODEL_SCOUT|FACTORY_MODEL_PLANNER|FACTORY_MODEL_BUILDER|FACTORY_MODEL_TESTER|FACTORY_MODEL_DEBUGGER|FACTORY_MODEL_REVIEWER|FACTORY_MODEL_SECURITY|FACTORY_MODEL_RELEASE) printf -v "$name" '%s' "$value" ;;
     *) echo "Unknown deployment parameter: $name" >&2; exit 1 ;;
   esac
 done
@@ -62,6 +62,7 @@ KEY_VAULT_NAME="$KEY_VAULT_NAME" \
 SERVICE_BUS_NAMESPACE="$SERVICE_BUS_NAMESPACE" \
 SERVICE_BUS_QUEUE="$SERVICE_BUS_QUEUE" \
 FACTORY_WORKER_IMAGE="agent-factory-worker:$SOURCE_REF" \
+FACTORY_STORAGE_ACCOUNT="${FACTORY_STORAGE_ACCOUNT:-}" \
 AWS_REGION="${AWS_REGION:-}" \
 FACTORY_MODEL_SCOUT="${FACTORY_MODEL_SCOUT:-}" \
 FACTORY_MODEL_PLANNER="${FACTORY_MODEL_PLANNER:-}" \

package/bootstrap/factory-ai-snapshot.service

@@ -0,0 +1,18 @@
+[Unit]
+Description=Publish Factory AI operator dashboard snapshot
+After=network-online.target agent-factory-control.service
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+User=factory
+Group=factory
+WorkingDirectory=/opt/agent-factory/app
+EnvironmentFile=/etc/agent-factory-control.env
+ExecStart=/usr/bin/node /opt/agent-factory/app/src/snapshot.js
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+UMask=0027
+SyslogIdentifier=factory-ai-snapshot

package/bootstrap/factory-ai-snapshot.timer

@@ -0,0 +1,11 @@
+[Unit]
+Description=Refresh Factory AI operator dashboard every minute
+
+[Timer]
+OnBootSec=2m
+OnUnitActiveSec=1m
+RandomizedDelaySec=5
+Persistent=true
+
+[Install]
+WantedBy=timers.target

package/bootstrap/factory-ai-update.service

@@ -6,6 +6,7 @@ Requires=docker.service
 
 [Service]
 Type=oneshot
+SyslogIdentifier=factory-ai-updater
 User=root
 Group=root
 ExecStart=/opt/agent-factory/app/bootstrap/auto-update.sh

package/bootstrap/setup.sh

@@ -35,6 +35,7 @@ test "$(node --version | cut -d. -f1)" = "v20"
 id "$FACTORY_USER" >/dev/null 2>&1 || useradd --system --create-home --shell /usr/sbin/nologin "$FACTORY_USER"
 test -f "$APP_DIR/package-lock.json"
 npm ci --omit=dev --prefix "$APP_DIR"
+factory_version=$(node -p "require('$APP_DIR/package.json').version")
 docker build --file "$APP_DIR/Dockerfile.worker" --tag "$FACTORY_WORKER_IMAGE" "$APP_DIR"
 for scanner_image in \
   aquasec/trivy@sha256:cffe3f5161a47a6823fbd23d985795b3ed72a4c806da4c4df16266c02accdd6f \
@@ -74,13 +75,16 @@ install -m 0600 -o root -g root /dev/null /etc/agent-factory.env
   printf 'KEY_VAULT_NAME=%s\n' "$KEY_VAULT_NAME"
   printf 'AZURE_SUBSCRIPTION_ID=%s\n' "$subscription_id"
   printf 'FACTORY_RESOURCE_GROUP=%s\n' "$resource_group"
+  [[ -n ${FACTORY_STORAGE_ACCOUNT:-} ]] && printf 'FACTORY_STORAGE_ACCOUNT=%s\n' "$FACTORY_STORAGE_ACCOUNT"
   printf 'FACTORY_STATE_DIR=/opt/agent-factory/state\n'
   printf 'FACTORY_WORKSPACE_DIR=/opt/agent-factory/workspaces\n'
   printf 'FACTORY_REGISTRY=%s/config/capabilities.json\n' "$APP_DIR"
   printf 'FACTORY_WORKER_IMAGE=%s\n' "$FACTORY_WORKER_IMAGE"
+  printf 'FACTORY_VERSION=%s\n' "$factory_version"
   printf 'MAX_CONCURRENCY=3\n'
   printf 'TASK_TIMEOUT_MS=1800000\n'
   printf 'MAX_DELIVERY_COUNT=8\n'
+  printf 'FACTORY_VERSION=%s\n' "$factory_version"
   [[ -n ${AWS_REGION:-} ]] && printf 'AWS_REGION=%s\nAWS_DEFAULT_REGION=%s\n' "$AWS_REGION" "$AWS_REGION"
   for variable in FACTORY_MODEL_SCOUT FACTORY_MODEL_PLANNER FACTORY_MODEL_BUILDER FACTORY_MODEL_TESTER FACTORY_MODEL_DEBUGGER FACTORY_MODEL_REVIEWER FACTORY_MODEL_SECURITY FACTORY_MODEL_RELEASE; do
     [[ -n ${!variable:-} ]] && printf '%s=%s\n' "$variable" "${!variable}"
@@ -96,6 +100,7 @@ install -m 0600 -o root -g root /dev/null /etc/agent-factory-control.env
   printf 'KEY_VAULT_NAME=%s\n' "$KEY_VAULT_NAME"
   printf 'AZURE_SUBSCRIPTION_ID=%s\n' "$subscription_id"
   printf 'FACTORY_RESOURCE_GROUP=%s\n' "$resource_group"
+  [[ -n ${FACTORY_STORAGE_ACCOUNT:-} ]] && printf 'FACTORY_STORAGE_ACCOUNT=%s\n' "$FACTORY_STORAGE_ACCOUNT"
   printf 'FACTORY_STATE_DIR=/opt/agent-factory/state\n'
   printf 'FACTORY_REGISTRY=%s/config/capabilities.json\n' "$APP_DIR"
   printf 'MAX_DELIVERY_COUNT=8\n'
@@ -117,6 +122,8 @@ install -m 0644 "$APP_DIR/bootstrap/agent-factory-telegram.service" /etc/systemd
 chmod 0755 "$APP_DIR/bootstrap/auto-update.sh"
 install -m 0644 "$APP_DIR/bootstrap/factory-ai-update.service" /etc/systemd/system/factory-ai-update.service
 install -m 0644 "$APP_DIR/bootstrap/factory-ai-update.timer" /etc/systemd/system/factory-ai-update.timer
+install -m 0644 "$APP_DIR/bootstrap/factory-ai-snapshot.service" /etc/systemd/system/factory-ai-snapshot.service
+install -m 0644 "$APP_DIR/bootstrap/factory-ai-snapshot.timer" /etc/systemd/system/factory-ai-snapshot.timer
 systemctl daemon-reload
 systemctl enable --now agent-factory-worker.service
 systemctl enable --now agent-factory-control.service
@@ -124,5 +131,6 @@ systemctl enable --now agent-factory-release.service
 systemctl enable --now agent-factory-reporter.timer
 systemctl enable --now agent-factory-telegram.service
 systemctl enable --now factory-ai-update.timer
+systemctl enable --now factory-ai-snapshot.timer
 systemctl restart agent-factory-control.service agent-factory-worker.service agent-factory-release.service
 echo "Agent factory worker installed"

package/infra/main.bicep

@@ -20,6 +20,7 @@ var prefix = 'agent-factory'
 var unique = uniqueString(subscription().subscriptionId, resourceGroup().id)
 var keyVaultName = 'af${take(unique, 18)}'
 var serviceBusName = 'af-${unique}'
+var storageName = 'fa${take(unique, 20)}'
 
 resource nsg 'Microsoft.Network/networkSecurityGroups@2024-05-01' = {
   name: '${prefix}-nsg'
@@ -147,6 +148,43 @@ resource vault 'Microsoft.KeyVault/vaults@2024-11-01' = {
   }
 }
 
+resource storage 'Microsoft.Storage/storageAccounts@2025-01-01' = {
+  name: storageName
+  location: location
+  sku: {
+    name: 'Standard_ZRS'
+  }
+  kind: 'StorageV2'
+  properties: {
+    allowBlobPublicAccess: false
+    allowSharedKeyAccess: false
+    defaultToOAuthAuthentication: true
+    minimumTlsVersion: 'TLS1_2'
+    publicNetworkAccess: 'Enabled'
+    supportsHttpsTrafficOnly: true
+  }
+}
+
+resource blobService 'Microsoft.Storage/storageAccounts/blobServices@2025-01-01' = {
+  parent: storage
+  name: 'default'
+  properties: {
+    deleteRetentionPolicy: {
+      enabled: true
+      days: 30
+    }
+    isVersioningEnabled: true
+  }
+}
+
+resource operatorContainer 'Microsoft.Storage/storageAccounts/blobServices/containers@2025-01-01' = {
+  parent: blobService
+  name: 'operator'
+  properties: {
+    publicAccess: 'None'
+  }
+}
+
 resource serviceBus 'Microsoft.ServiceBus/namespaces@2024-01-01' = {
   name: serviceBusName
   location: location
@@ -299,11 +337,32 @@ resource workerCostReader 'Microsoft.Authorization/roleAssignments@2022-04-01' =
   }
 }
 
+resource workerBlobContributor 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
+  name: guid(storage.id, vm.id, 'storage-blob-data-contributor')
+  scope: storage
+  properties: {
+    principalId: vm.identity.principalId
+    principalType: 'ServicePrincipal'
+    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')
+  }
+}
+
+resource operatorBlobReader 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
+  name: guid(storage.id, operatorObjectId, 'storage-blob-data-reader')
+  scope: storage
+  properties: {
+    principalId: operatorObjectId
+    principalType: 'User'
+    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '2a2b9908-6ea1-4ae2-8e65-a410df84e7d1')
+  }
+}
+
 output vmName string = vm.name
 output privateIp string = nic.properties.ipConfigurations[0].properties.privateIPAddress
 output egressIp string = egressIp.properties.ipAddress
 output keyVaultName string = vault.name
 output serviceBusNamespace string = serviceBus.name
+output storageAccount string = storage.name
 output controlQueue string = queues[0].name
 output agentQueue string = queues[1].name
 output releaseQueue string = queues[2].name

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "factory-ai",
-  "version": "1.2.1",
+  "version": "1.3.0",
   "description": "Deploy a private autonomous coding-agent factory on Azure: isolated builders, testers, security reviewers, durable orchestration, multi-model routing, memory, cost controls, and gated GitHub pull requests.",
   "private": false,
   "license": "MIT",
@@ -40,6 +40,7 @@
     "agent-factory-release": "src/release-service.js",
     "agent-factory-task": "src/task-entry.js",
     "factory-ai-telegram": "src/telegram-service.js",
+    "factory-ai-snapshot": "src/snapshot.js",
     "agent-factory-worker": "src/worker.js"
   },
   "files": [
@@ -63,6 +64,7 @@
     "@azure/identity": "4.13.1",
     "@azure/keyvault-secrets": "4.10.0",
     "@azure/service-bus": "7.9.5",
+    "@azure/storage-blob": "12.28.0",
     "@inquirer/prompts": "8.5.2",
     "@modelcontextprotocol/sdk": "1.29.0",
     "@modelcontextprotocol/server-memory": "2026.7.4",

package/src/azure-harness.js

@@ -31,6 +31,7 @@ export class AzureResponsesHarness {
     retries = 4,
     timeoutMs = 180_000,
     sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+    userAgent = `factory-ai/${process.env.FACTORY_VERSION ?? "dev"}`,
   }) {
     this.endpoint = `${baseUrl.replace(/\/$/, "")}/responses`;
     this.apiKey = apiKey;
@@ -42,6 +43,7 @@ export class AzureResponsesHarness {
     this.retries = retries;
     this.timeoutMs = timeoutMs;
     this.sleep = sleep;
+    this.userAgent = userAgent;
   }
 
   async request(body) {
@@ -56,6 +58,8 @@ export class AzureResponsesHarness {
             "content-type": "application/json",
             "api-key": this.apiKey,
             authorization: `Bearer ${this.apiKey}`,
+            "user-agent": this.userAgent,
+            "x-ms-useragent": this.userAgent,
           },
           body: JSON.stringify(body),
           signal: controller.signal,

package/src/bedrock-harness.js

@@ -12,7 +12,7 @@ function definitions(tools) {
 
 export class BedrockHarness {
   constructor({ client, region = process.env.AWS_REGION ?? "us-east-1", model, tools, maxSteps = 40, maxOutputTokens = 4096 }) {
-    this.client = client ?? new BedrockRuntimeClient({ region });
+    this.client = client ?? new BedrockRuntimeClient({ region, customUserAgent: `factory-ai/${process.env.FACTORY_VERSION ?? "dev"}` });
     this.model = model;
     this.tools = tools;
     this.maxSteps = maxSteps;

package/src/ceo.js

@@ -6,6 +6,8 @@ import { loadConfig } from "./config.js";
 import { createBus, sendMessage } from "./bus.js";
 import { parseObjective } from "./validation.js";
 
+process.title = "factory-ai-ceo";
+
 function argumentsFrom(argv) {
   const options = { baseBranch: "main", wait: false, timeoutMs: 3_600_000, words: [] };
   for (let index = 0; index < argv.length; index += 1) {

package/src/config.js

@@ -9,6 +9,7 @@ const environmentSchema = z.object({
   KEY_VAULT_NAME: z.string().min(3),
   AZURE_SUBSCRIPTION_ID: z.string().optional(),
   FACTORY_RESOURCE_GROUP: z.string().default("factory-ai-rg"),
+  FACTORY_STORAGE_ACCOUNT: z.string().optional(),
   FACTORY_STATE_DIR: z.string().default("/opt/agent-factory/state"),
   FACTORY_WORKSPACE_DIR: z.string().default("/opt/agent-factory/workspaces"),
   FACTORY_REGISTRY: z.string().default("/opt/agent-factory/app/config/capabilities.json"),
@@ -41,6 +42,7 @@ export function loadConfig(environment = process.env) {
     keyVaultUrl: `https://${env.KEY_VAULT_NAME}.vault.azure.net`,
     subscriptionId: env.AZURE_SUBSCRIPTION_ID,
     resourceGroup: env.FACTORY_RESOURCE_GROUP,
+    storageAccount: env.FACTORY_STORAGE_ACCOUNT,
     secretNames: {
       TEXTVED_AZURE_API_KEY: env.AZURE_PRIMARY_API_KEY_SECRET,
       TEXTVED_AZURE_BASE_URL: env.AZURE_PRIMARY_BASE_URL_SECRET,

package/src/container-runner.js

@@ -19,6 +19,7 @@ const AZURE_ENVIRONMENT = [
   "FACTORY_MODEL_REVIEWER",
   "FACTORY_MODEL_SECURITY",
   "FACTORY_MODEL_RELEASE",
+  "FACTORY_VERSION",
 ];
 
 function parseOutput(stdout) {
@@ -37,7 +38,7 @@ export class ContainerAgentRunner {
   }
 
   async executePacket(packet, directory) {
-    const name = `agent-${packet.objective.id}-${packet.task?.id ?? "planner"}`.toLowerCase().replaceAll(/[^a-z0-9_.-]/g, "-").slice(0, 63);
+    const name = `factory-ai-${packet.objective.id}-${packet.task?.id ?? "planner"}`.toLowerCase().replaceAll(/[^a-z0-9_.-]/g, "-").slice(0, 63);
     const args = [
       "run", "-i", "--rm", "--name", name,
       "--read-only",

package/src/control-service.js

@@ -7,6 +7,7 @@ import { loadRegistry } from "./registry.js";
 import { log } from "./log.js";
 import { ProjectMemory } from "./project-memory.js";
 
+process.title = "factory-ai-control";
 const config = loadConfig();
 const bus = createBus(config, config.controlQueue, config.agentQueue);
 const releaseSender = bus.client.createSender(config.releaseQueue);

package/src/operator.js

@@ -2,6 +2,8 @@ import { readFile } from "node:fs/promises";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { gunzipSync } from "node:zlib";
+import { DefaultAzureCredential } from "@azure/identity";
+import { BlobServiceClient } from "@azure/storage-blob";
 import { run } from "./process.js";
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
@@ -21,6 +23,7 @@ export function createOperator(environment = process.env) {
   const vm = environment.FACTORY_VM ?? "agent-factory-vm";
   const namespace = environment.FACTORY_SERVICE_BUS ?? "";
   const vault = environment.FACTORY_KEY_VAULT ?? "";
+  const storageAccount = environment.FACTORY_STORAGE_ACCOUNT ?? "";
   const remote = async (script) => {
     for (let attempt = 0; attempt < 6; attempt += 1) {
       try { return extractRunCommand(await command("az", ["vm", "run-command", "invoke", "--resource-group", resourceGroup, "--name", vm, "--command-id", "RunShellScript", "--scripts", script, "--query", "value[0].message", "--output", "tsv"])); }
@@ -41,6 +44,15 @@ export function createOperator(environment = process.env) {
   };
   return {
     dashboard: async () => {
+      if (storageAccount) {
+        try {
+          const service = new BlobServiceClient(`https://${storageAccount}.blob.core.windows.net`, new DefaultAzureCredential());
+          const value = await service.getContainerClient("operator").getBlockBlobClient("dashboard.json").downloadToBuffer();
+          return JSON.parse(value.toString("utf8"));
+        } catch (error) {
+          if (!["BlobNotFound", "ContainerNotFound"].includes(error.code)) throw error;
+        }
+      }
       const encoded = await remote("sudo -u factory env $(xargs < /etc/agent-factory-control.env) node /opt/agent-factory/app/src/dashboard.js --json | gzip -c | base64 -w0");
       return JSON.parse(gunzipSync(Buffer.from(encoded, "base64")).toString("utf8"));
     },
@@ -56,7 +68,7 @@ export function createOperator(environment = process.env) {
       return command(path.join(root, "bin/factory"), [action]);
     },
     capabilities: async () => JSON.parse(await readFile(path.join(root, "config/capabilities.json"), "utf8")),
-    config: () => ({ resourceGroup, vm, namespace, vault, models: { scout: "GPT-5.4 nano", simpleBuilder: "Kimi K2.7-Code", builder: "GPT-5.5", tester: "GPT-5.4", critical: "GPT-5.6" } }),
+    config: () => ({ resourceGroup, vm, namespace, vault, storageAccount, models: { scout: "GPT-5.4 nano", simpleBuilder: "Kimi K2.7-Code", builder: "GPT-5.5", tester: "GPT-5.4", critical: "GPT-5.6" } }),
     listSecrets: async () => withVault(async () => JSON.parse(await command("az", ["keyvault", "secret", "list", "--vault-name", vault, "--query", "[].{name:name,updated:attributes.updated}", "--output", "json"]))),
     setSecret: async (name, value) => withVault(async () => {
       if (!/^[A-Za-z0-9-]{1,127}$/.test(name) || !value) throw new Error("Valid secret name and value are required");

package/src/release-service.js

@@ -7,6 +7,7 @@ import { ReleaseBot } from "./release-bot.js";
 import { GitHubRelease } from "./release.js";
 import { log } from "./log.js";
 
+process.title = "factory-ai-release";
 const config = loadConfig();
 Object.assign(process.env, await loadRuntimeSecrets(config, undefined, ["GH_TOKEN"]));
 await run("gh", ["auth", "setup-git"], { timeoutMs: 60_000 });

package/src/reporter.js

@@ -4,6 +4,10 @@ import path from "node:path";
 import { pathToFileURL } from "node:url";
 import { aggregateDashboard, loadAzureCost, loadLocalState, loadQueueMetrics, stableStringify } from "./dashboard.js";
 import { loadConfig } from "./config.js";
+import { DefaultAzureCredential } from "@azure/identity";
+import { BlobServiceClient } from "@azure/storage-blob";
+
+process.title = "factory-ai-reporter";
 
 function markdown(dashboard) {
   const objectives = Object.entries(dashboard.summary.objectives).map(([state, count]) => `${state}=${count}`).join(", ") || "none";
@@ -30,16 +34,31 @@ export async function writeHourlyReport(root, dashboard, { now = new Date(), ret
   return stem;
 }
 
+export async function uploadDashboardSnapshot(config, dashboard, {
+  credential = new DefaultAzureCredential(),
+  createClient = (url, auth) => new BlobServiceClient(url, auth),
+} = {}) {
+  if (!config.storageAccount) return false;
+  const service = createClient(`https://${config.storageAccount}.blob.core.windows.net`, credential);
+  const blob = service.getContainerClient("operator").getBlockBlobClient("dashboard.json");
+  await blob.uploadData(Buffer.from(stableStringify(dashboard)), {
+    blobHTTPHeaders: { blobContentType: "application/json; charset=utf-8", blobCacheControl: "no-store" },
+  });
+  return true;
+}
+
 async function main() {
   const root = process.env.FACTORY_STATE_DIR ?? "/opt/agent-factory/state";
+  const config = loadConfig();
   const loaded = await loadLocalState(root);
-  const queue = process.env.SERVICE_BUS_NAMESPACE ? await loadQueueMetrics(loadConfig()) : {};
+  const queue = process.env.SERVICE_BUS_NAMESPACE ? await loadQueueMetrics(config) : {};
   let cost = null;
   if (process.env.AZURE_SUBSCRIPTION_ID) {
-    try { cost = await loadAzureCost(loadConfig()); } catch (error) { loaded.warnings.push(`Cost unavailable: ${error.message}`); }
+    try { cost = await loadAzureCost(config); } catch (error) { loaded.warnings.push(`Cost unavailable: ${error.message}`); }
   }
   const dashboard = aggregateDashboard({ ...loaded, queue, cost, runtime: { status: "running" } });
   const stem = await writeHourlyReport(root, dashboard);
+  await uploadDashboardSnapshot(config, dashboard);
   process.stdout.write(`${JSON.stringify({ event: "hourly_report", report: stem })}\n`);
 }
 

package/src/snapshot.js

@@ -0,0 +1,15 @@
+#!/usr/bin/env node
+import { aggregateDashboard, loadAzureCost, loadLocalState, loadQueueMetrics } from "./dashboard.js";
+import { loadConfig } from "./config.js";
+import { uploadDashboardSnapshot } from "./reporter.js";
+
+process.title = "factory-ai-snapshot";
+const config = loadConfig();
+const root = process.env.FACTORY_STATE_DIR ?? "/opt/agent-factory/state";
+const loaded = await loadLocalState(root);
+const queue = await loadQueueMetrics(config);
+let cost = null;
+try { cost = await loadAzureCost(config); } catch (error) { loaded.warnings.push(`Cost unavailable: ${error.message}`); }
+const dashboard = aggregateDashboard({ ...loaded, queue, cost, runtime: { status: "running" } });
+await uploadDashboardSnapshot(config, dashboard);
+process.stdout.write(`${JSON.stringify({ event: "dashboard_snapshot", generatedAt: dashboard.generatedAt })}\n`);

package/src/task-entry.js

@@ -10,6 +10,7 @@ const input = await new Promise((resolve, reject) => {
   process.stdin.on("error", reject);
 });
 const packet = JSON.parse(input);
+process.title = `factory-ai-${packet.task?.role ?? packet.mode}`.slice(0, 63);
 const registry = await loadRegistry("/opt/agent-factory/app/config/capabilities.json");
 const runner = new AzureAgentRunner({ timeoutMs: 1_800_000 }, registry);
 let result;

package/src/telegram-service.js

@@ -11,6 +11,7 @@ import { loadLocalState, loadQueueMetrics } from "./dashboard.js";
 import { formatObjectiveProgress, isAllowedChat, objectiveFromTelegram, parseTelegramCommand } from "./telegram.js";
 import { log } from "./log.js";
 
+process.title = "factory-ai-telegram";
 const config = loadConfig();
 Object.assign(process.env, await loadRuntimeSecrets(config, undefined, ["TELEGRAM_BOT_TOKEN", "TELEGRAM_ALLOWED_CHAT_IDS"]));
 const token = process.env.TELEGRAM_BOT_TOKEN;

package/src/tui.js

@@ -65,7 +65,7 @@ function renderCapabilities() {
 
 function renderSettings() {
   const config = operator.config();
-  main.setContent(`{bold}Runtime{/}\n\n  Resource group  ${config.resourceGroup}\n  VM              ${config.vm}\n  Service Bus     ${config.namespace}\n  Key Vault       ${config.vault}\n\n{bold}Model policy{/}\n\n  Scout           GPT-5.4 nano\n  Simple builder  Kimi K2.7-Code\n  Builder         GPT-5.5\n  Tester          GPT-5.4\n  Critical roles  GPT-5.6\n\n{#7f8b99-fg}Run factory setup to change providers or role routes.{/}`);
+  main.setContent(`{bold}Runtime{/}\n\n  Resource group  ${config.resourceGroup}\n  VM              ${config.vm}\n  Service Bus     ${config.namespace}\n  Key Vault       ${config.vault}\n  Operator state  ${config.storageAccount || "Run Command fallback"}\n\n{bold}Model policy{/}\n\n  Scout           GPT-5.4 nano\n  Simple builder  Kimi K2.7-Code\n  Builder         GPT-5.5\n  Tester          GPT-5.4\n  Critical roles  GPT-5.6\n\n{#7f8b99-fg}Run factory setup to change providers or role routes.{/}`);
 }
 
 function render() {

package/src/updater.js

@@ -2,6 +2,8 @@
 import { readFile } from "node:fs/promises";
 import { pathToFileURL } from "node:url";
 
+process.title = "factory-ai-updater";
+
 function parts(value) {
   if (!/^\d+\.\d+\.\d+$/.test(value)) throw new Error(`Unsupported version: ${value}`);
   return value.split(".").map(Number);

package/src/worker.js

@@ -10,6 +10,7 @@ import { sendMessage } from "./bus.js";
 import { ContainerAgentRunner } from "./container-runner.js";
 import { ScannerSuite } from "./scanner-suite.js";
 
+process.title = "factory-ai-worker";
 const config = loadConfig();
 Object.assign(process.env, await loadRuntimeSecrets(config));
 await run("gh", ["auth", "setup-git"], { timeoutMs: 60_000 });