factory-ai 1.3.0 → 1.5.0

package/src/mcp-tools.js

@@ -3,6 +3,16 @@ function renderContent(result) {
   return value.length > 32_000 ? `${value.slice(0, 32_000)}\n[TRUNCATED: request narrower MCP output]` : value;
 }
 
+async function withTimeout(operation, timeoutMs, label) {
+  let timer;
+  try {
+    return await Promise.race([
+      operation,
+      new Promise((_, reject) => { timer = setTimeout(() => reject(new Error(`${label} timed out after ${timeoutMs}ms`)), timeoutMs); timer.unref?.(); }),
+    ]);
+  } finally { clearTimeout(timer); }
+}
+
 async function defaultConnect(capability) {
   const [{ Client }, { StdioClientTransport }] = await Promise.all([
     import("@modelcontextprotocol/sdk/client/index.js"),
@@ -29,17 +39,23 @@ export async function connectMcpTools(capabilities, { connect = defaultConnect }
   const clients = [];
   const tools = {};
   try {
-    for (const capability of capabilities.filter((item) => item.type === "mcp")) {
+    const mcp = capabilities.filter((item) => item.type === "mcp");
+    const connected = await Promise.allSettled(mcp.map(async (capability) => {
       const client = await connect(capability);
-      clients.push(client);
       const listed = await client.listTools();
+      return { capability, client, listed };
+    }));
+    for (const result of connected) if (result.status === "fulfilled") clients.push(result.value.client);
+    const failure = connected.find((result) => result.status === "rejected");
+    if (failure) throw failure.reason;
+    for (const { capability, client, listed } of connected.map((result) => result.value)) {
       for (const definition of listed.tools) {
         const name = `${capability.name}__${definition.name}`;
         if (tools[name]) throw new Error(`Duplicate MCP tool: ${name}`);
         tools[name] = {
           description: definition.description ?? `${capability.name} ${definition.name}`,
           parameters: definition.inputSchema ?? { type: "object" },
-          execute: async (argumentsValue) => renderContent(await client.callTool({ name: definition.name, arguments: argumentsValue })),
+          execute: async (argumentsValue) => renderContent(await withTimeout(client.callTool({ name: definition.name, arguments: argumentsValue }), capability.timeoutMs ?? 60_000, `MCP tool ${name}`)),
         };
       }
     }

package/src/objective-status.js

@@ -0,0 +1,16 @@
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+
+const IDENTIFIER = /^[A-Za-z0-9_-]{1,64}$/;
+const TERMINAL = new Set(["complete", "failed", "blocked", "cancelled", "denied", "expired"]);
+
+export async function objectiveIsTerminal(stateDir, objectiveId) {
+  if (!IDENTIFIER.test(objectiveId ?? "")) return false;
+  try {
+    const state = JSON.parse(await readFile(path.join(stateDir, objectiveId, "state.json"), "utf8"));
+    return TERMINAL.has(state.status);
+  } catch (error) {
+    if (error.code === "ENOENT" || error instanceof SyntaxError) return false;
+    throw error;
+  }
+}

package/src/operator-logs.js

@@ -0,0 +1,24 @@
+const ALLOWED_FIELDS = new Set(["timestamp", "level", "event", "objectiveId", "taskId", "type", "messageId", "source", "deliveryCount", "error", "signal", "queue", "concurrency"]);
+
+function redact(value) {
+  return String(value)
+    .replaceAll(/\b(?:gh[pousr]_[A-Za-z0-9_]{20,}|github_pat_[A-Za-z0-9_]{20,}|sk-[A-Za-z0-9_-]{16,}|AKIA[A-Z0-9]{16}|xox[a-z]-[A-Za-z0-9-]{10,})\b/g, "[REDACTED]")
+    .replaceAll(/\bbot\d+:[A-Za-z0-9_-]{20,}\b/g, "bot[REDACTED]")
+    .replaceAll(/((?:api[_-]?key|token|secret|password|authorization)\s*[=:]\s*)\S+/gi, "$1[REDACTED]")
+    .slice(0, 2000);
+}
+
+export function safeOperatorLogs(raw, { maxCharacters = 250_000 } = {}) {
+  const output = [];
+  for (const line of String(raw).split("\n")) {
+    let parsed;
+    try { parsed = JSON.parse(line); } catch { continue; }
+    if (!parsed || typeof parsed !== "object" || typeof parsed.event !== "string") continue;
+    const safe = {};
+    for (const [key, value] of Object.entries(parsed)) {
+      if (ALLOWED_FIELDS.has(key) && ["string", "number", "boolean"].includes(typeof value)) safe[key] = typeof value === "string" ? redact(value) : value;
+    }
+    output.push(JSON.stringify(safe));
+  }
+  return output.join("\n").slice(-maxCharacters);
+}

package/src/operator.js

@@ -4,6 +4,8 @@ import { fileURLToPath } from "node:url";
 import { gunzipSync } from "node:zlib";
 import { DefaultAzureCredential } from "@azure/identity";
 import { BlobServiceClient } from "@azure/storage-blob";
+import { ServiceBusClient } from "@azure/service-bus";
+import { sendMessage } from "./bus.js";
 import { run } from "./process.js";
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
@@ -24,6 +26,8 @@ export function createOperator(environment = process.env) {
   const namespace = environment.FACTORY_SERVICE_BUS ?? "";
   const vault = environment.FACTORY_KEY_VAULT ?? "";
   const storageAccount = environment.FACTORY_STORAGE_ACCOUNT ?? "";
+  const factoryName = environment.FACTORY_NAME ?? "Factory AI";
+  const factoryPurpose = environment.FACTORY_PURPOSE ?? "Ship secure reviewed software continuously";
   const remote = async (script) => {
     for (let attempt = 0; attempt < 6; attempt += 1) {
       try { return extractRunCommand(await command("az", ["vm", "run-command", "invoke", "--resource-group", resourceGroup, "--name", vm, "--command-id", "RunShellScript", "--scripts", script, "--query", "value[0].message", "--output", "tsv"])); }
@@ -34,6 +38,16 @@ export function createOperator(environment = process.env) {
     }
     throw new Error("Azure Run Command remained busy");
   };
+  const downloadOperatorBlob = async (name) => {
+    if (!storageAccount) return null;
+    try {
+      const service = new BlobServiceClient(`https://${storageAccount}.blob.core.windows.net`, new DefaultAzureCredential());
+      return await service.getContainerClient("operator").getBlockBlobClient(name).downloadToBuffer();
+    } catch (error) {
+      if (["BlobNotFound", "ContainerNotFound"].includes(error.code)) return null;
+      throw error;
+    }
+  };
   const withVault = async (operation) => {
     const ip = await command("curl", ["-fsS", "https://api.ipify.org"]);
     await command("az", ["keyvault", "network-rule", "add", "--name", vault, "--ip-address", `${ip}/32`, "--output", "none"]);
@@ -45,18 +59,16 @@ export function createOperator(environment = process.env) {
   return {
     dashboard: async () => {
       if (storageAccount) {
-        try {
-          const service = new BlobServiceClient(`https://${storageAccount}.blob.core.windows.net`, new DefaultAzureCredential());
-          const value = await service.getContainerClient("operator").getBlockBlobClient("dashboard.json").downloadToBuffer();
-          return JSON.parse(value.toString("utf8"));
-        } catch (error) {
-          if (!["BlobNotFound", "ContainerNotFound"].includes(error.code)) throw error;
-        }
+        const value = await downloadOperatorBlob("dashboard.json");
+        if (value) return JSON.parse(value.toString("utf8"));
       }
       const encoded = await remote("sudo -u factory env $(xargs < /etc/agent-factory-control.env) node /opt/agent-factory/app/src/dashboard.js --json | gzip -c | base64 -w0");
       return JSON.parse(gunzipSync(Buffer.from(encoded, "base64")).toString("utf8"));
     },
-    logs: async () => remote('journalctl -u agent-factory-control -u agent-factory-worker -u agent-factory-release --since "1 hour ago" --no-pager -n 300'),
+    logs: async () => {
+      const value = await downloadOperatorBlob("logs.txt");
+      return value ? value.toString("utf8") : remote('journalctl -u agent-factory-control -u agent-factory-worker -u agent-factory-release --since "1 hour ago" --no-pager -n 300');
+    },
     submit: async (repository, objective) => {
       if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(repository) || objective.trim().length < 3) throw new Error("Valid repository and objective are required");
       const output = await command(path.join(root, "bin/factory"), ["submit", repository, objective]);
@@ -67,9 +79,21 @@ export function createOperator(environment = process.env) {
       if (!["pause", "resume"].includes(action)) throw new Error("Unsupported control action");
       return command(path.join(root, "bin/factory"), [action]);
     },
+    approval: async ({ objectiveId, approvalId, decision, reason }) => {
+      if (!/^[A-Za-z0-9_-]{1,64}$/.test(objectiveId) || !/^[A-Za-z0-9_-]{1,64}$/.test(approvalId) || !["approved", "denied"].includes(decision) || !reason?.trim()) throw new Error("Valid approval decision is required");
+      const client = new ServiceBusClient(namespace.includes(".") ? namespace : `${namespace}.servicebus.windows.net`, new DefaultAzureCredential());
+      const sender = client.createSender("control-events");
+      const messageId = `approval-${objectiveId}-${approvalId}-${decision}`.slice(0, 64);
+      try { await sendMessage(sender, { type: "approval_decision", objectiveId, approvalId, decision, actor: "local-operator", reason: reason.trim().slice(0, 1000), decidedAt: new Date().toISOString(), messageId }, messageId, objectiveId); }
+      finally { await sender.close(); await client.close(); }
+    },
     capabilities: async () => JSON.parse(await readFile(path.join(root, "config/capabilities.json"), "utf8")),
-    config: () => ({ resourceGroup, vm, namespace, vault, storageAccount, models: { scout: "GPT-5.4 nano", simpleBuilder: "Kimi K2.7-Code", builder: "GPT-5.5", tester: "GPT-5.4", critical: "GPT-5.6" } }),
-    listSecrets: async () => withVault(async () => JSON.parse(await command("az", ["keyvault", "secret", "list", "--vault-name", vault, "--query", "[].{name:name,updated:attributes.updated}", "--output", "json"]))),
+    config: () => ({ factoryName, factoryPurpose, resourceGroup, vm, namespace, vault, storageAccount, models: { scout: "GPT-5.4 nano", simpleBuilder: "Kimi K2.7-Code", builder: "GPT-5.5", tester: "GPT-5.4", critical: "GPT-5.6" } }),
+    listSecrets: async () => {
+      const dashboard = await downloadOperatorBlob("dashboard.json");
+      if (dashboard) return JSON.parse(dashboard.toString("utf8")).secrets ?? [];
+      return withVault(async () => JSON.parse(await command("az", ["keyvault", "secret", "list", "--vault-name", vault, "--query", "[].{name:name,updated:attributes.updated}", "--output", "json"])));
+    },
     setSecret: async (name, value) => withVault(async () => {
       if (!/^[A-Za-z0-9-]{1,127}$/.test(name) || !value) throw new Error("Valid secret name and value are required");
       await command("az", ["keyvault", "secret", "set", "--vault-name", vault, "--name", name, "--value", value, "--output", "none"]);

package/src/process.js

@@ -1,7 +1,7 @@
 import { spawn } from "node:child_process";
 
 export function run(command, args, options = {}) {
-  const { cwd, env, inheritEnv = true, timeoutMs = 300_000, input, allowExitCodes = [0], maxOutputBytes = 10_000_000 } = options;
+  const { cwd, env, inheritEnv = true, timeoutMs = 300_000, input, allowExitCodes = [0], maxOutputBytes = 10_000_000, onStdout, onStderr } = options;
   return new Promise((resolve, reject) => {
     const child = spawn(command, args, {
       cwd,
@@ -27,8 +27,8 @@ export function run(command, args, options = {}) {
       if (stream === "stdout") stdout += chunk;
       else stderr += chunk;
     }
-    child.stdout.on("data", (chunk) => appendOutput("stdout", chunk));
-    child.stderr.on("data", (chunk) => appendOutput("stderr", chunk));
+    child.stdout.on("data", (chunk) => { appendOutput("stdout", chunk); onStdout?.(chunk); });
+    child.stderr.on("data", (chunk) => { appendOutput("stderr", chunk); onStderr?.(chunk); });
     child.on("error", (error) => {
       clearTimeout(timer);
       reject(error);

package/src/release-gate.js

@@ -5,6 +5,7 @@ export function evaluateReleaseGate(tasks, results, facts = {}) {
   for (const task of tasks.filter((candidate) => APPROVAL_ROLES.has(candidate.role))) {
     const result = results[task.id];
     if (result?.status !== "succeeded" || result.approval !== "approved") blockers.push(`${task.role} ${task.id}: ${result?.approval ?? result?.status ?? "missing"}`);
+    for (const scan of result?.scannerEvidence ?? []) if (scan.status !== "passed") blockers.push(`${task.role} ${task.id}: ${scan.scanner} ${scan.status}`);
   }
   const approvals = facts.approvals ?? blockers.length === 0;
   return { approved: approvals, blockers, autoMerge: approvals && facts.policyAllows === true && facts.checksPass === true };

package/src/release-service.js

@@ -24,7 +24,10 @@ const subscription = bus.receiver.subscribe({
       await bus.receiver.completeMessage(message);
     } catch (error) {
       log("error", "release_failed", { deliveryCount: message.deliveryCount, error: error.message });
-      if (message.deliveryCount >= config.maxDeliveryCount) await bus.receiver.deadLetterMessage(message, { deadLetterReason: "ReleaseFailed", deadLetterErrorDescription: error.message.slice(0, 4096) });
+      if (message.deliveryCount >= config.maxDeliveryCount) {
+        if (message.body?.objectiveId) await sendMessage(bus.sender, { type: "failure_result", objectiveId: message.body.objectiveId, taskId: "release", error: `Release failed after ${message.deliveryCount} deliveries: ${error.message}` }, `${message.body.objectiveId}:release-failure:v1`, message.body.objectiveId);
+        await bus.receiver.deadLetterMessage(message, { deadLetterReason: "ReleaseFailed", deadLetterErrorDescription: error.message.slice(0, 4096) });
+      }
       else await bus.receiver.abandonMessage(message);
     }
   },

package/src/release.js

@@ -49,7 +49,7 @@ export class GitHubRelease {
       "",
       "Human review and repository branch protections remain authoritative.",
     ].join("\n");
-    const title = `[Factory AI] ${task.title}`;
+    const title = `[${process.env.FACTORY_NAME ?? "Factory AI"}] ${task.title}`;
     const create = await this.execute("gh", [
       "pr", "create", "--base", objective.baseBranch, "--head", branch,
       "--title", title, "--body", body,

package/src/repo-map.js

@@ -0,0 +1,128 @@
+import { run } from "./process.js";
+
+const sourceGlob = "*.{c,cc,cpp,cs,go,h,hpp,java,js,jsx,php,py,rb,rs,sh,ts,tsx}";
+const excludedGlobs = [
+  "!**/.git/**",
+  "!**/.next/**",
+  "!**/.turbo/**",
+  "!**/build/**",
+  "!**/coverage/**",
+  "!**/dist/**",
+  "!**/generated/**",
+  "!**/node_modules/**",
+  "!**/vendor/**",
+  "!**/*.generated.*",
+  "!**/*.min.*",
+];
+const symbolPattern = String.raw`^\s*(?:(?:export|public|private|protected|static)\s+)*(?:async\s+)?(?:class|def|enum|fn|func|function|interface|struct|trait|type|const|let|var)\s+[A-Za-z_$][A-Za-z0-9_$]*`;
+const stopWords = new Set(["and", "for", "from", "into", "the", "this", "with"]);
+
+function objectiveTerms(objective) {
+  return [...new Set(String(objective).toLowerCase().match(/[a-z_$][a-z0-9_$-]{2,}/g) ?? [])]
+    .filter((term) => !stopWords.has(term))
+    .sort();
+}
+
+function rgArgs(pattern) {
+  return [
+    "--line-number", "--no-heading", "--color", "never", "--max-count", "20", "--max-filesize", "256K",
+    "--glob", sourceGlob,
+    ...excludedGlobs.flatMap((glob) => ["--glob", glob]),
+    "--regexp", pattern,
+    ".",
+  ];
+}
+
+async function extract(directory, pattern) {
+  if (!pattern) return [];
+  const { stdout } = await run("rg", rgArgs(pattern), {
+    cwd: directory,
+    allowExitCodes: [0, 1],
+    timeoutMs: 15_000,
+    maxOutputBytes: 5_000_000,
+  });
+  return stdout.split("\n").flatMap((line) => {
+    const match = line.match(/^\.\/(.*?):(\d+):(.*)$/);
+    if (!match) return [];
+    return [{ path: match[1], startLine: Number(match[2]), endLine: Number(match[2]), content: match[3].trim().slice(0, 500) }];
+  });
+}
+
+function keyFor(entry) {
+  return `${entry.path}:${entry.startLine}:${entry.endLine}`;
+}
+
+function rank(entries, terms) {
+  const byRange = new Map();
+  for (const entry of entries) {
+    const path = entry.path.toLowerCase();
+    const content = entry.content.toLowerCase();
+    const score = 1 + terms.reduce((total, term) => total + (path.includes(term) ? 8 : 0) + (content.includes(term) ? 3 : 0), 0);
+    const ranked = { ...entry, score };
+    const previous = byRange.get(keyFor(ranked));
+    if (!previous || ranked.score > previous.score || (ranked.score === previous.score && ranked.content < previous.content)) byRange.set(keyFor(ranked), ranked);
+  }
+  return [...byRange.values()].sort((a, b) => b.score - a.score
+    || a.path.localeCompare(b.path)
+    || a.startLine - b.startLine
+    || a.endLine - b.endLine
+    || a.content.localeCompare(b.content));
+}
+
+function entriesWithinBudget(entries, maxCharacters, heading) {
+  let length = `${heading}\n`.length;
+  const selected = [];
+  for (const entry of entries) {
+    const section = `--- ${entry.path}:${entry.startLine}-${entry.endLine} score=${Number(entry.score ?? 0).toFixed(3)} ---\n${entry.content}\n`;
+    if (length + section.length > maxCharacters) continue;
+    selected.push(entry);
+    length += section.length;
+  }
+  return selected;
+}
+
+export function formatRepositoryEntries(entries, maxCharacters, heading = "REPOSITORY MAP (ranked symbols and objective references)") {
+  if (maxCharacters <= 0) return "";
+  let output = `${heading}\n`;
+  for (const entry of entriesWithinBudget(entries, maxCharacters, heading)) {
+    output += `--- ${entry.path}:${entry.startLine}-${entry.endLine} score=${Number(entry.score ?? 0).toFixed(3)} ---\n${entry.content}\n`;
+  }
+  return output.length <= maxCharacters ? output.trimEnd() : output.slice(0, maxCharacters);
+}
+
+export async function buildRepositoryMap(directory, objective, { maxCharacters = 8000 } = {}) {
+  const terms = objectiveTerms(objective);
+  const referencePattern = terms.length ? terms.map((term) => term.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|") : "";
+  const [symbols, references] = await Promise.all([
+    extract(directory, symbolPattern),
+    extract(directory, referencePattern),
+  ]);
+  const ranked = rank([...symbols, ...references], terms);
+  const heading = "REPOSITORY MAP (ranked symbols and objective references)";
+  const entries = entriesWithinBudget(ranked, maxCharacters, heading);
+  return { entries, text: formatRepositoryEntries(entries, maxCharacters) };
+}
+
+export function mergeRepositoryContext(repositoryEntries, semanticPoints, maxCharacters = 12_000) {
+  const occupied = new Set(repositoryEntries.map(keyFor));
+  const byRange = new Map();
+  for (const point of semanticPoints) {
+    const entry = {
+    path: point.payload?.path ?? "",
+    startLine: Number(point.payload?.startLine ?? 0),
+    endLine: Number(point.payload?.endLine ?? point.payload?.startLine ?? 0),
+    content: String(point.payload?.content ?? ""),
+    score: Number(point.score ?? 0),
+    };
+    const key = keyFor(entry);
+    const previous = byRange.get(key);
+    if (entry.path && !occupied.has(key) && (!previous || entry.score > previous.score || (entry.score === previous.score && entry.content < previous.content))) byRange.set(key, entry);
+  }
+  const semanticEntries = [...byRange.values()].sort((a, b) => b.score - a.score
+    || a.path.localeCompare(b.path)
+    || a.startLine - b.startLine
+    || a.endLine - b.endLine
+    || a.content.localeCompare(b.content));
+  const semanticText = formatRepositoryEntries(semanticEntries, maxCharacters, "LOCAL SEMANTIC CONTEXT");
+  return { entries: [...repositoryEntries, ...semanticEntries], semanticText };
+}

package/src/reporter.js

@@ -12,7 +12,7 @@ process.title = "factory-ai-reporter";
 function markdown(dashboard) {
   const objectives = Object.entries(dashboard.summary.objectives).map(([state, count]) => `${state}=${count}`).join(", ") || "none";
   const cost = dashboard.cost ? `\nAzure month-to-date: ${dashboard.cost.currency} ${dashboard.cost.monthToDate.toFixed(2)} (billing data may be delayed)\n` : "";
-  return `# Factory AI Hourly Report\n\nGenerated: ${dashboard.generatedAt}\n\nQueue: ${dashboard.queue.active} active, ${dashboard.queue.deadLetter} dead-letter\n${cost}\nObjectives: ${objectives}\n`;
+  return `# ${process.env.FACTORY_NAME ?? "Factory AI"} Hourly Report\n\nGenerated: ${dashboard.generatedAt}\n\nQueue: ${dashboard.queue.active} active, ${dashboard.queue.deadLetter} dead-letter\n${cost}\nObjectives: ${objectives}\n`;
 }
 
 async function atomicWrite(file, content) {
@@ -47,6 +47,17 @@ export async function uploadDashboardSnapshot(config, dashboard, {
   return true;
 }
 
+export async function uploadOperatorBlob(config, name, value, contentType = "text/plain; charset=utf-8", {
+  credential = new DefaultAzureCredential(),
+  createClient = (url, auth) => new BlobServiceClient(url, auth),
+} = {}) {
+  if (!config.storageAccount) return false;
+  const service = createClient(`https://${config.storageAccount}.blob.core.windows.net`, credential);
+  const blob = service.getContainerClient("operator").getBlockBlobClient(name);
+  await blob.uploadData(Buffer.from(value), { blobHTTPHeaders: { blobContentType: contentType, blobCacheControl: "no-store" } });
+  return true;
+}
+
 async function main() {
   const root = process.env.FACTORY_STATE_DIR ?? "/opt/agent-factory/state";
   const config = loadConfig();

package/src/retriever.js

@@ -0,0 +1,154 @@
+import { createHash } from "node:crypto";
+import { lstat, mkdir, readFile, readdir, rename, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { run } from "./process.js";
+import { mergeRepositoryContext } from "./repo-map.js";
+
+const textExtensions = new Set([".c", ".cc", ".cpp", ".cs", ".css", ".go", ".h", ".hpp", ".html", ".java", ".js", ".jsx", ".json", ".md", ".mdx", ".php", ".py", ".rb", ".rs", ".scss", ".sh", ".sql", ".svelte", ".toml", ".ts", ".tsx", ".vue", ".yaml", ".yml"]);
+const ignoredDirectories = new Set([".git", ".next", ".turbo", "build", "coverage", "dist", "node_modules", "vendor"]);
+
+export function chunkText(file, value, { linesPerChunk = 120, overlapLines = 20 } = {}) {
+  const lines = value.split("\n");
+  const chunks = [];
+  const step = Math.max(1, linesPerChunk - overlapLines);
+  for (let start = 0; start < lines.length; start += step) {
+    const content = lines.slice(start, start + linesPerChunk).join("\n").trim();
+    if (content) chunks.push({ path: file, startLine: start + 1, endLine: Math.min(lines.length, start + linesPerChunk), content });
+    if (start + linesPerChunk >= lines.length) break;
+  }
+  return chunks;
+}
+
+export function formatRetrievedContext(points, maxCharacters = 12_000, repositoryEntries = []) {
+  return mergeRepositoryContext(repositoryEntries, points, maxCharacters).semanticText;
+}
+
+async function collectFiles(directory, root, output, limits) {
+  if (output.length >= limits.maxFiles) return;
+  for (const entry of (await readdir(directory, { withFileTypes: true })).sort((a, b) => a.name.localeCompare(b.name))) {
+    if (entry.isSymbolicLink?.() || ignoredDirectories.has(entry.name) || output.length >= limits.maxFiles) continue;
+    const absolute = path.join(directory, entry.name);
+    if (entry.isDirectory()) await collectFiles(absolute, root, output, limits);
+    else if (entry.isFile() && textExtensions.has(path.extname(entry.name).toLowerCase())) {
+      const metadata = await lstat(absolute);
+      if (metadata.size <= limits.maxFileBytes) output.push({ absolute, relative: path.relative(root, absolute) });
+    }
+  }
+}
+
+async function workspaceRevision(directory) {
+  const head = (await run("git", ["-C", directory, "rev-parse", "HEAD"])).stdout.trim();
+  const status = (await run("git", ["-C", directory, "status", "--porcelain=v1"], { maxOutputBytes: 200_000 })).stdout;
+  if (!status) return head;
+  const diff = (await run("git", ["-C", directory, "diff", "--binary", "HEAD"], { maxOutputBytes: 2_000_000 })).stdout;
+  return `${head}-worktree-${createHash("sha256").update(status).update(diff).digest("hex").slice(0, 16)}`;
+}
+
+function pointId(value) {
+  const hash = createHash("sha256").update(value).digest("hex");
+  return `${hash.slice(0, 8)}-${hash.slice(8, 12)}-4${hash.slice(13, 16)}-a${hash.slice(17, 20)}-${hash.slice(20, 32)}`;
+}
+
+export class LocalRetriever {
+  #locks = new Map();
+
+  constructor({
+    stateDir,
+    ollamaUrl = "http://127.0.0.1:11434",
+    qdrantUrl = "http://127.0.0.1:6333",
+    model = "embeddinggemma",
+    collection = "factory_ai_code",
+    fetch = globalThis.fetch,
+  }) {
+    this.stateDir = stateDir;
+    this.manifestFile = path.join(stateDir, "retrieval", "manifest.json");
+    this.ollamaUrl = ollamaUrl;
+    this.qdrantUrl = qdrantUrl;
+    this.model = model;
+    this.collection = collection;
+    this.fetch = fetch;
+  }
+
+  async request(url, options = {}) {
+    const response = await this.fetch(url, { ...options, signal: AbortSignal.timeout(120_000) });
+    if (!response.ok) throw new Error(`Local retrieval HTTP ${response.status}: ${url}`);
+    return response.status === 204 ? {} : response.json();
+  }
+
+  async embed(input) {
+    const result = await this.request(`${this.ollamaUrl}/api/embed`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ model: this.model, input }),
+    });
+    return result.embeddings;
+  }
+
+  async loadManifest() {
+    try { return JSON.parse(await readFile(this.manifestFile, "utf8")); } catch (error) { if (error.code === "ENOENT") return {}; throw error; }
+  }
+
+  async saveManifest(value) {
+    await mkdir(path.dirname(this.manifestFile), { recursive: true, mode: 0o750 });
+    const temporary = `${this.manifestFile}.${process.pid}.tmp`;
+    await writeFile(temporary, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o640 });
+    await rename(temporary, this.manifestFile);
+  }
+
+  async ensureIndexed(directory, repository) {
+    const previous = this.#locks.get(repository) ?? Promise.resolve();
+    const current = previous.catch(() => {}).then(() => this.#index(directory, repository));
+    this.#locks.set(repository, current);
+    try { return await current; } finally { if (this.#locks.get(repository) === current) this.#locks.delete(repository); }
+  }
+
+  async #index(directory, repository) {
+    const commit = await workspaceRevision(directory);
+    const manifest = await this.loadManifest();
+    if (manifest[repository]?.[commit]?.model === this.model) return false;
+    const files = [];
+    await collectFiles(directory, directory, files, { maxFiles: 2000, maxFileBytes: 256_000 });
+    const chunks = [];
+    for (const file of files) {
+      const value = await readFile(file.absolute, "utf8");
+      chunks.push(...chunkText(file.relative, value));
+      if (chunks.length >= 5000) break;
+    }
+    const selected = chunks.slice(0, 5000);
+    if (selected.length === 0) return false;
+    const sample = await this.embed([`${selected[0].path}\n${selected[0].content}`]);
+    const vectorSize = sample[0].length;
+    const collectionResponse = await this.fetch(`${this.qdrantUrl}/collections/${this.collection}`, { signal: AbortSignal.timeout(30_000) });
+    if (collectionResponse.status === 404) {
+      await this.request(`${this.qdrantUrl}/collections/${this.collection}`, {
+        method: "PUT", headers: { "content-type": "application/json" }, body: JSON.stringify({ vectors: { size: vectorSize, distance: "Cosine" } }),
+      });
+    } else if (!collectionResponse.ok) throw new Error(`Qdrant collection HTTP ${collectionResponse.status}`);
+    for (let start = 0; start < selected.length; start += 32) {
+      const batch = selected.slice(start, start + 32);
+      const remaining = batch.slice(1);
+      const embeddings = start === 0
+        ? [sample[0], ...(remaining.length ? await this.embed(remaining.map((item) => `${item.path}\n${item.content}`)) : [])]
+        : await this.embed(batch.map((item) => `${item.path}\n${item.content}`));
+      const points = batch.map((item, index) => ({ id: pointId(`${repository}:${commit}:${item.path}:${item.startLine}`), vector: embeddings[index], payload: { repository, commit, ...item } }));
+      await this.request(`${this.qdrantUrl}/collections/${this.collection}/points?wait=true`, {
+        method: "PUT", headers: { "content-type": "application/json" }, body: JSON.stringify({ points }),
+      });
+    }
+    manifest[repository] = { ...(manifest[repository]?.commit ? {} : manifest[repository]), [commit]: { model: this.model, chunks: selected.length, indexedAt: new Date().toISOString() } };
+    await this.saveManifest(manifest);
+    return true;
+  }
+
+  async context(directory, repository, query, { limit = 8, maxCharacters = 12_000, repositoryEntries = [] } = {}) {
+    await this.ensureIndexed(directory, repository);
+    const commit = await workspaceRevision(directory);
+    const [vector] = await this.embed([query]);
+    const result = await this.request(`${this.qdrantUrl}/collections/${this.collection}/points/query`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ query: vector, filter: { must: [{ key: "repository", match: { value: repository } }, { key: "commit", match: { value: commit } }] }, limit, with_payload: true }),
+    });
+    return formatRetrievedContext(result.result?.points ?? [], maxCharacters, repositoryEntries);
+  }
+}

package/src/routing.js

@@ -20,10 +20,20 @@ const MODELS = Object.freeze({
   release: "azureai-textved/gpt-5.6-sol",
 });
 
+const PROVIDERS = new Set(["azureai-textved", "azureai-responses", "bedrock"]);
+
+export function validateModelRoute(route) {
+  if (typeof route !== "string" || route.length > 240 || !/^[A-Za-z0-9._:/-]+$/.test(route)) throw new Error("Invalid model route");
+  const separator = route.indexOf("/");
+  if (separator < 1 || !PROVIDERS.has(route.slice(0, separator))) throw new Error("Unsupported model provider");
+  if (separator === route.length - 1) throw new Error("Invalid model route");
+  return route;
+}
+
 export function modelForRole(role, environment = process.env) {
   const model = environment[`FACTORY_MODEL_${role.toUpperCase()}`] ?? MODELS[role];
   if (!model) throw new Error(`Unknown role: ${role}`);
-  return model;
+  return validateModelRoute(model);
 }
 
 export function modelForTask(task, environment = process.env) {

package/src/scanner-suite.js

@@ -20,7 +20,7 @@ const scanners = [
   {
     name: "semgrep",
     image: "semgrep/semgrep@sha256:183a149fb3e9700ab5294a7b4ab0241a826fd046bc8b721062fbea80fdfa438f",
-    args: ["semgrep", "scan", "--config", "p/default", "--json", "/workspace"],
+    args: ["semgrep", "scan", "--error", "--config", "p/default", "--json", "/workspace"],
   },
 ];
 
@@ -37,9 +37,10 @@ export class ScannerSuite {
     this.execute = execute;
   }
 
-  async scan(directory) {
+  async scan(directory, { names } = {}) {
     const workspace = path.resolve(directory);
-    return Promise.all(scanners.map(async (scanner) => {
+    const selected = names ? scanners.filter((scanner) => names.includes(scanner.name)) : scanners;
+    return Promise.all(selected.map(async (scanner) => {
       const args = [
         "run", "--rm", "--read-only", "--cap-drop", "ALL", "--security-opt", "no-new-privileges",
         "--pids-limit", "512", "--memory", "4g", "--cpus", "1", "--tmpfs", "/tmp:rw,noexec,nosuid,size=3g",

package/src/setup-menu.js

@@ -5,6 +5,8 @@ import { writeFile } from "node:fs/promises";
 const output = process.argv[2];
 if (!output) throw new Error("Setup result path is required");
 
+const factoryName = await input({ message: "What should your factory be called?", default: "Factory AI" });
+const factoryPurpose = await input({ message: "What should this factory build or optimize for?", default: "Ship secure, reviewed software continuously" });
 const provider = await select({
   message: "Which model provider should the factory configure?",
   choices: [
@@ -23,4 +25,4 @@ if (provider !== "azure") {
 }
 const deployNow = await confirm({ message: "Deploy and start the runtime after storing credentials?", default: true });
 const telegram = await confirm({ message: "Enable Telegram remote objective intake?", default: false });
-await writeFile(output, `${JSON.stringify({ provider, location, githubOrg, awsRegion, bedrockBuilderModel, deployNow, telegram })}\n`, { mode: 0o600 });
+await writeFile(output, `${JSON.stringify({ factoryName, factoryPurpose, provider, location, githubOrg, awsRegion, bedrockBuilderModel, deployNow, telegram })}\n`, { mode: 0o600 });

package/src/snapshot.js

@@ -2,6 +2,11 @@
 import { aggregateDashboard, loadAzureCost, loadLocalState, loadQueueMetrics } from "./dashboard.js";
 import { loadConfig } from "./config.js";
 import { uploadDashboardSnapshot } from "./reporter.js";
+import { uploadOperatorBlob } from "./reporter.js";
+import { DefaultAzureCredential } from "@azure/identity";
+import { SecretClient } from "@azure/keyvault-secrets";
+import { run } from "./process.js";
+import { safeOperatorLogs } from "./operator-logs.js";
 
 process.title = "factory-ai-snapshot";
 const config = loadConfig();
@@ -11,5 +16,16 @@ const queue = await loadQueueMetrics(config);
 let cost = null;
 try { cost = await loadAzureCost(config); } catch (error) { loaded.warnings.push(`Cost unavailable: ${error.message}`); }
 const dashboard = aggregateDashboard({ ...loaded, queue, cost, runtime: { status: "running" } });
+try {
+  const secrets = [];
+  const client = new SecretClient(config.keyVaultUrl, new DefaultAzureCredential());
+  for await (const item of client.listPropertiesOfSecrets()) secrets.push({ name: item.name, updated: item.updatedOn?.toISOString() });
+  dashboard.secrets = secrets.sort((left, right) => left.name.localeCompare(right.name));
+} catch (error) { dashboard.warnings.push(`Secret metadata unavailable: ${error.message}`); }
+try {
+  const result = await run("journalctl", ["-o", "cat", "-u", "agent-factory-control", "-u", "agent-factory-worker", "-u", "agent-factory-release", "-u", "agent-factory-telegram", "--since", "1 hour ago", "--no-pager", "-n", "500"], { timeoutMs: 30_000, maxOutputBytes: 500_000 });
+  const logs = safeOperatorLogs(result.stdout);
+  await uploadOperatorBlob(config, "logs.txt", logs);
+} catch (error) { dashboard.warnings.push(`Log snapshot unavailable: ${error.message}`); }
 await uploadDashboardSnapshot(config, dashboard);
 process.stdout.write(`${JSON.stringify({ event: "dashboard_snapshot", generatedAt: dashboard.generatedAt })}\n`);