factory-ai 1.4.0 → 1.5.0

package/src/mcp-tools.js

@@ -3,6 +3,16 @@ function renderContent(result) {
   return value.length > 32_000 ? `${value.slice(0, 32_000)}\n[TRUNCATED: request narrower MCP output]` : value;
 }
 
+async function withTimeout(operation, timeoutMs, label) {
+  let timer;
+  try {
+    return await Promise.race([
+      operation,
+      new Promise((_, reject) => { timer = setTimeout(() => reject(new Error(`${label} timed out after ${timeoutMs}ms`)), timeoutMs); timer.unref?.(); }),
+    ]);
+  } finally { clearTimeout(timer); }
+}
+
 async function defaultConnect(capability) {
   const [{ Client }, { StdioClientTransport }] = await Promise.all([
     import("@modelcontextprotocol/sdk/client/index.js"),
@@ -29,17 +39,23 @@ export async function connectMcpTools(capabilities, { connect = defaultConnect }
   const clients = [];
   const tools = {};
   try {
-    for (const capability of capabilities.filter((item) => item.type === "mcp")) {
+    const mcp = capabilities.filter((item) => item.type === "mcp");
+    const connected = await Promise.allSettled(mcp.map(async (capability) => {
       const client = await connect(capability);
-      clients.push(client);
       const listed = await client.listTools();
+      return { capability, client, listed };
+    }));
+    for (const result of connected) if (result.status === "fulfilled") clients.push(result.value.client);
+    const failure = connected.find((result) => result.status === "rejected");
+    if (failure) throw failure.reason;
+    for (const { capability, client, listed } of connected.map((result) => result.value)) {
       for (const definition of listed.tools) {
         const name = `${capability.name}__${definition.name}`;
         if (tools[name]) throw new Error(`Duplicate MCP tool: ${name}`);
         tools[name] = {
           description: definition.description ?? `${capability.name} ${definition.name}`,
           parameters: definition.inputSchema ?? { type: "object" },
-          execute: async (argumentsValue) => renderContent(await client.callTool({ name: definition.name, arguments: argumentsValue })),
+          execute: async (argumentsValue) => renderContent(await withTimeout(client.callTool({ name: definition.name, arguments: argumentsValue }), capability.timeoutMs ?? 60_000, `MCP tool ${name}`)),
         };
       }
     }

package/src/objective-status.js

@@ -0,0 +1,16 @@
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+
+const IDENTIFIER = /^[A-Za-z0-9_-]{1,64}$/;
+const TERMINAL = new Set(["complete", "failed", "blocked", "cancelled", "denied", "expired"]);
+
+export async function objectiveIsTerminal(stateDir, objectiveId) {
+  if (!IDENTIFIER.test(objectiveId ?? "")) return false;
+  try {
+    const state = JSON.parse(await readFile(path.join(stateDir, objectiveId, "state.json"), "utf8"));
+    return TERMINAL.has(state.status);
+  } catch (error) {
+    if (error.code === "ENOENT" || error instanceof SyntaxError) return false;
+    throw error;
+  }
+}

package/src/operator-logs.js

@@ -0,0 +1,24 @@
+const ALLOWED_FIELDS = new Set(["timestamp", "level", "event", "objectiveId", "taskId", "type", "messageId", "source", "deliveryCount", "error", "signal", "queue", "concurrency"]);
+
+function redact(value) {
+  return String(value)
+    .replaceAll(/\b(?:gh[pousr]_[A-Za-z0-9_]{20,}|github_pat_[A-Za-z0-9_]{20,}|sk-[A-Za-z0-9_-]{16,}|AKIA[A-Z0-9]{16}|xox[a-z]-[A-Za-z0-9-]{10,})\b/g, "[REDACTED]")
+    .replaceAll(/\bbot\d+:[A-Za-z0-9_-]{20,}\b/g, "bot[REDACTED]")
+    .replaceAll(/((?:api[_-]?key|token|secret|password|authorization)\s*[=:]\s*)\S+/gi, "$1[REDACTED]")
+    .slice(0, 2000);
+}
+
+export function safeOperatorLogs(raw, { maxCharacters = 250_000 } = {}) {
+  const output = [];
+  for (const line of String(raw).split("\n")) {
+    let parsed;
+    try { parsed = JSON.parse(line); } catch { continue; }
+    if (!parsed || typeof parsed !== "object" || typeof parsed.event !== "string") continue;
+    const safe = {};
+    for (const [key, value] of Object.entries(parsed)) {
+      if (ALLOWED_FIELDS.has(key) && ["string", "number", "boolean"].includes(typeof value)) safe[key] = typeof value === "string" ? redact(value) : value;
+    }
+    output.push(JSON.stringify(safe));
+  }
+  return output.join("\n").slice(-maxCharacters);
+}

package/src/operator.js

@@ -4,6 +4,8 @@ import { fileURLToPath } from "node:url";
 import { gunzipSync } from "node:zlib";
 import { DefaultAzureCredential } from "@azure/identity";
 import { BlobServiceClient } from "@azure/storage-blob";
+import { ServiceBusClient } from "@azure/service-bus";
+import { sendMessage } from "./bus.js";
 import { run } from "./process.js";
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
@@ -36,6 +38,16 @@ export function createOperator(environment = process.env) {
     }
     throw new Error("Azure Run Command remained busy");
   };
+  const downloadOperatorBlob = async (name) => {
+    if (!storageAccount) return null;
+    try {
+      const service = new BlobServiceClient(`https://${storageAccount}.blob.core.windows.net`, new DefaultAzureCredential());
+      return await service.getContainerClient("operator").getBlockBlobClient(name).downloadToBuffer();
+    } catch (error) {
+      if (["BlobNotFound", "ContainerNotFound"].includes(error.code)) return null;
+      throw error;
+    }
+  };
   const withVault = async (operation) => {
     const ip = await command("curl", ["-fsS", "https://api.ipify.org"]);
     await command("az", ["keyvault", "network-rule", "add", "--name", vault, "--ip-address", `${ip}/32`, "--output", "none"]);
@@ -47,18 +59,16 @@ export function createOperator(environment = process.env) {
   return {
     dashboard: async () => {
       if (storageAccount) {
-        try {
-          const service = new BlobServiceClient(`https://${storageAccount}.blob.core.windows.net`, new DefaultAzureCredential());
-          const value = await service.getContainerClient("operator").getBlockBlobClient("dashboard.json").downloadToBuffer();
-          return JSON.parse(value.toString("utf8"));
-        } catch (error) {
-          if (!["BlobNotFound", "ContainerNotFound"].includes(error.code)) throw error;
-        }
+        const value = await downloadOperatorBlob("dashboard.json");
+        if (value) return JSON.parse(value.toString("utf8"));
       }
       const encoded = await remote("sudo -u factory env $(xargs < /etc/agent-factory-control.env) node /opt/agent-factory/app/src/dashboard.js --json | gzip -c | base64 -w0");
       return JSON.parse(gunzipSync(Buffer.from(encoded, "base64")).toString("utf8"));
     },
-    logs: async () => remote('journalctl -u agent-factory-control -u agent-factory-worker -u agent-factory-release --since "1 hour ago" --no-pager -n 300'),
+    logs: async () => {
+      const value = await downloadOperatorBlob("logs.txt");
+      return value ? value.toString("utf8") : remote('journalctl -u agent-factory-control -u agent-factory-worker -u agent-factory-release --since "1 hour ago" --no-pager -n 300');
+    },
     submit: async (repository, objective) => {
       if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(repository) || objective.trim().length < 3) throw new Error("Valid repository and objective are required");
       const output = await command(path.join(root, "bin/factory"), ["submit", repository, objective]);
@@ -69,9 +79,21 @@ export function createOperator(environment = process.env) {
       if (!["pause", "resume"].includes(action)) throw new Error("Unsupported control action");
       return command(path.join(root, "bin/factory"), [action]);
     },
+    approval: async ({ objectiveId, approvalId, decision, reason }) => {
+      if (!/^[A-Za-z0-9_-]{1,64}$/.test(objectiveId) || !/^[A-Za-z0-9_-]{1,64}$/.test(approvalId) || !["approved", "denied"].includes(decision) || !reason?.trim()) throw new Error("Valid approval decision is required");
+      const client = new ServiceBusClient(namespace.includes(".") ? namespace : `${namespace}.servicebus.windows.net`, new DefaultAzureCredential());
+      const sender = client.createSender("control-events");
+      const messageId = `approval-${objectiveId}-${approvalId}-${decision}`.slice(0, 64);
+      try { await sendMessage(sender, { type: "approval_decision", objectiveId, approvalId, decision, actor: "local-operator", reason: reason.trim().slice(0, 1000), decidedAt: new Date().toISOString(), messageId }, messageId, objectiveId); }
+      finally { await sender.close(); await client.close(); }
+    },
     capabilities: async () => JSON.parse(await readFile(path.join(root, "config/capabilities.json"), "utf8")),
     config: () => ({ factoryName, factoryPurpose, resourceGroup, vm, namespace, vault, storageAccount, models: { scout: "GPT-5.4 nano", simpleBuilder: "Kimi K2.7-Code", builder: "GPT-5.5", tester: "GPT-5.4", critical: "GPT-5.6" } }),
-    listSecrets: async () => withVault(async () => JSON.parse(await command("az", ["keyvault", "secret", "list", "--vault-name", vault, "--query", "[].{name:name,updated:attributes.updated}", "--output", "json"]))),
+    listSecrets: async () => {
+      const dashboard = await downloadOperatorBlob("dashboard.json");
+      if (dashboard) return JSON.parse(dashboard.toString("utf8")).secrets ?? [];
+      return withVault(async () => JSON.parse(await command("az", ["keyvault", "secret", "list", "--vault-name", vault, "--query", "[].{name:name,updated:attributes.updated}", "--output", "json"])));
+    },
     setSecret: async (name, value) => withVault(async () => {
       if (!/^[A-Za-z0-9-]{1,127}$/.test(name) || !value) throw new Error("Valid secret name and value are required");
       await command("az", ["keyvault", "secret", "set", "--vault-name", vault, "--name", name, "--value", value, "--output", "none"]);

package/src/process.js

@@ -1,7 +1,7 @@
 import { spawn } from "node:child_process";
 
 export function run(command, args, options = {}) {
-  const { cwd, env, inheritEnv = true, timeoutMs = 300_000, input, allowExitCodes = [0], maxOutputBytes = 10_000_000 } = options;
+  const { cwd, env, inheritEnv = true, timeoutMs = 300_000, input, allowExitCodes = [0], maxOutputBytes = 10_000_000, onStdout, onStderr } = options;
   return new Promise((resolve, reject) => {
     const child = spawn(command, args, {
       cwd,
@@ -27,8 +27,8 @@ export function run(command, args, options = {}) {
       if (stream === "stdout") stdout += chunk;
       else stderr += chunk;
     }
-    child.stdout.on("data", (chunk) => appendOutput("stdout", chunk));
-    child.stderr.on("data", (chunk) => appendOutput("stderr", chunk));
+    child.stdout.on("data", (chunk) => { appendOutput("stdout", chunk); onStdout?.(chunk); });
+    child.stderr.on("data", (chunk) => { appendOutput("stderr", chunk); onStderr?.(chunk); });
     child.on("error", (error) => {
       clearTimeout(timer);
       reject(error);

package/src/release-gate.js

@@ -5,6 +5,7 @@ export function evaluateReleaseGate(tasks, results, facts = {}) {
   for (const task of tasks.filter((candidate) => APPROVAL_ROLES.has(candidate.role))) {
     const result = results[task.id];
     if (result?.status !== "succeeded" || result.approval !== "approved") blockers.push(`${task.role} ${task.id}: ${result?.approval ?? result?.status ?? "missing"}`);
+    for (const scan of result?.scannerEvidence ?? []) if (scan.status !== "passed") blockers.push(`${task.role} ${task.id}: ${scan.scanner} ${scan.status}`);
   }
   const approvals = facts.approvals ?? blockers.length === 0;
   return { approved: approvals, blockers, autoMerge: approvals && facts.policyAllows === true && facts.checksPass === true };

package/src/release-service.js

@@ -24,7 +24,10 @@ const subscription = bus.receiver.subscribe({
       await bus.receiver.completeMessage(message);
     } catch (error) {
       log("error", "release_failed", { deliveryCount: message.deliveryCount, error: error.message });
-      if (message.deliveryCount >= config.maxDeliveryCount) await bus.receiver.deadLetterMessage(message, { deadLetterReason: "ReleaseFailed", deadLetterErrorDescription: error.message.slice(0, 4096) });
+      if (message.deliveryCount >= config.maxDeliveryCount) {
+        if (message.body?.objectiveId) await sendMessage(bus.sender, { type: "failure_result", objectiveId: message.body.objectiveId, taskId: "release", error: `Release failed after ${message.deliveryCount} deliveries: ${error.message}` }, `${message.body.objectiveId}:release-failure:v1`, message.body.objectiveId);
+        await bus.receiver.deadLetterMessage(message, { deadLetterReason: "ReleaseFailed", deadLetterErrorDescription: error.message.slice(0, 4096) });
+      }
       else await bus.receiver.abandonMessage(message);
     }
   },

package/src/repo-map.js

@@ -0,0 +1,128 @@
+import { run } from "./process.js";
+
+const sourceGlob = "*.{c,cc,cpp,cs,go,h,hpp,java,js,jsx,php,py,rb,rs,sh,ts,tsx}";
+const excludedGlobs = [
+  "!**/.git/**",
+  "!**/.next/**",
+  "!**/.turbo/**",
+  "!**/build/**",
+  "!**/coverage/**",
+  "!**/dist/**",
+  "!**/generated/**",
+  "!**/node_modules/**",
+  "!**/vendor/**",
+  "!**/*.generated.*",
+  "!**/*.min.*",
+];
+const symbolPattern = String.raw`^\s*(?:(?:export|public|private|protected|static)\s+)*(?:async\s+)?(?:class|def|enum|fn|func|function|interface|struct|trait|type|const|let|var)\s+[A-Za-z_$][A-Za-z0-9_$]*`;
+const stopWords = new Set(["and", "for", "from", "into", "the", "this", "with"]);
+
+function objectiveTerms(objective) {
+  return [...new Set(String(objective).toLowerCase().match(/[a-z_$][a-z0-9_$-]{2,}/g) ?? [])]
+    .filter((term) => !stopWords.has(term))
+    .sort();
+}
+
+function rgArgs(pattern) {
+  return [
+    "--line-number", "--no-heading", "--color", "never", "--max-count", "20", "--max-filesize", "256K",
+    "--glob", sourceGlob,
+    ...excludedGlobs.flatMap((glob) => ["--glob", glob]),
+    "--regexp", pattern,
+    ".",
+  ];
+}
+
+async function extract(directory, pattern) {
+  if (!pattern) return [];
+  const { stdout } = await run("rg", rgArgs(pattern), {
+    cwd: directory,
+    allowExitCodes: [0, 1],
+    timeoutMs: 15_000,
+    maxOutputBytes: 5_000_000,
+  });
+  return stdout.split("\n").flatMap((line) => {
+    const match = line.match(/^\.\/(.*?):(\d+):(.*)$/);
+    if (!match) return [];
+    return [{ path: match[1], startLine: Number(match[2]), endLine: Number(match[2]), content: match[3].trim().slice(0, 500) }];
+  });
+}
+
+function keyFor(entry) {
+  return `${entry.path}:${entry.startLine}:${entry.endLine}`;
+}
+
+function rank(entries, terms) {
+  const byRange = new Map();
+  for (const entry of entries) {
+    const path = entry.path.toLowerCase();
+    const content = entry.content.toLowerCase();
+    const score = 1 + terms.reduce((total, term) => total + (path.includes(term) ? 8 : 0) + (content.includes(term) ? 3 : 0), 0);
+    const ranked = { ...entry, score };
+    const previous = byRange.get(keyFor(ranked));
+    if (!previous || ranked.score > previous.score || (ranked.score === previous.score && ranked.content < previous.content)) byRange.set(keyFor(ranked), ranked);
+  }
+  return [...byRange.values()].sort((a, b) => b.score - a.score
+    || a.path.localeCompare(b.path)
+    || a.startLine - b.startLine
+    || a.endLine - b.endLine
+    || a.content.localeCompare(b.content));
+}
+
+function entriesWithinBudget(entries, maxCharacters, heading) {
+  let length = `${heading}\n`.length;
+  const selected = [];
+  for (const entry of entries) {
+    const section = `--- ${entry.path}:${entry.startLine}-${entry.endLine} score=${Number(entry.score ?? 0).toFixed(3)} ---\n${entry.content}\n`;
+    if (length + section.length > maxCharacters) continue;
+    selected.push(entry);
+    length += section.length;
+  }
+  return selected;
+}
+
+export function formatRepositoryEntries(entries, maxCharacters, heading = "REPOSITORY MAP (ranked symbols and objective references)") {
+  if (maxCharacters <= 0) return "";
+  let output = `${heading}\n`;
+  for (const entry of entriesWithinBudget(entries, maxCharacters, heading)) {
+    output += `--- ${entry.path}:${entry.startLine}-${entry.endLine} score=${Number(entry.score ?? 0).toFixed(3)} ---\n${entry.content}\n`;
+  }
+  return output.length <= maxCharacters ? output.trimEnd() : output.slice(0, maxCharacters);
+}
+
+export async function buildRepositoryMap(directory, objective, { maxCharacters = 8000 } = {}) {
+  const terms = objectiveTerms(objective);
+  const referencePattern = terms.length ? terms.map((term) => term.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|") : "";
+  const [symbols, references] = await Promise.all([
+    extract(directory, symbolPattern),
+    extract(directory, referencePattern),
+  ]);
+  const ranked = rank([...symbols, ...references], terms);
+  const heading = "REPOSITORY MAP (ranked symbols and objective references)";
+  const entries = entriesWithinBudget(ranked, maxCharacters, heading);
+  return { entries, text: formatRepositoryEntries(entries, maxCharacters) };
+}
+
+export function mergeRepositoryContext(repositoryEntries, semanticPoints, maxCharacters = 12_000) {
+  const occupied = new Set(repositoryEntries.map(keyFor));
+  const byRange = new Map();
+  for (const point of semanticPoints) {
+    const entry = {
+    path: point.payload?.path ?? "",
+    startLine: Number(point.payload?.startLine ?? 0),
+    endLine: Number(point.payload?.endLine ?? point.payload?.startLine ?? 0),
+    content: String(point.payload?.content ?? ""),
+    score: Number(point.score ?? 0),
+    };
+    const key = keyFor(entry);
+    const previous = byRange.get(key);
+    if (entry.path && !occupied.has(key) && (!previous || entry.score > previous.score || (entry.score === previous.score && entry.content < previous.content))) byRange.set(key, entry);
+  }
+  const semanticEntries = [...byRange.values()].sort((a, b) => b.score - a.score
+    || a.path.localeCompare(b.path)
+    || a.startLine - b.startLine
+    || a.endLine - b.endLine
+    || a.content.localeCompare(b.content));
+  const semanticText = formatRepositoryEntries(semanticEntries, maxCharacters, "LOCAL SEMANTIC CONTEXT");
+  return { entries: [...repositoryEntries, ...semanticEntries], semanticText };
+}

package/src/reporter.js

@@ -47,6 +47,17 @@ export async function uploadDashboardSnapshot(config, dashboard, {
   return true;
 }
 
+export async function uploadOperatorBlob(config, name, value, contentType = "text/plain; charset=utf-8", {
+  credential = new DefaultAzureCredential(),
+  createClient = (url, auth) => new BlobServiceClient(url, auth),
+} = {}) {
+  if (!config.storageAccount) return false;
+  const service = createClient(`https://${config.storageAccount}.blob.core.windows.net`, credential);
+  const blob = service.getContainerClient("operator").getBlockBlobClient(name);
+  await blob.uploadData(Buffer.from(value), { blobHTTPHeaders: { blobContentType: contentType, blobCacheControl: "no-store" } });
+  return true;
+}
+
 async function main() {
   const root = process.env.FACTORY_STATE_DIR ?? "/opt/agent-factory/state";
   const config = loadConfig();

package/src/retriever.js

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import { lstat, mkdir, readFile, readdir, rename, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { run } from "./process.js";
+import { mergeRepositoryContext } from "./repo-map.js";
 
 const textExtensions = new Set([".c", ".cc", ".cpp", ".cs", ".css", ".go", ".h", ".hpp", ".html", ".java", ".js", ".jsx", ".json", ".md", ".mdx", ".php", ".py", ".rb", ".rs", ".scss", ".sh", ".sql", ".svelte", ".toml", ".ts", ".tsx", ".vue", ".yaml", ".yml"]);
 const ignoredDirectories = new Set([".git", ".next", ".turbo", "build", "coverage", "dist", "node_modules", "vendor"]);
@@ -18,15 +19,8 @@ export function chunkText(file, value, { linesPerChunk = 120, overlapLines = 20
   return chunks;
 }
 
-export function formatRetrievedContext(points, maxCharacters = 12_000) {
-  let output = "";
-  for (const point of points) {
-    const payload = point.payload ?? {};
-    const section = `\n--- ${payload.path}:${payload.startLine} score=${Number(point.score ?? 0).toFixed(3)} ---\n${payload.content ?? ""}\n`;
-    if (output.length + section.length > maxCharacters) break;
-    output += section;
-  }
-  return output.trim();
+export function formatRetrievedContext(points, maxCharacters = 12_000, repositoryEntries = []) {
+  return mergeRepositoryContext(repositoryEntries, points, maxCharacters).semanticText;
 }
 
 async function collectFiles(directory, root, output, limits) {
@@ -42,6 +36,14 @@ async function collectFiles(directory, root, output, limits) {
   }
 }
 
+async function workspaceRevision(directory) {
+  const head = (await run("git", ["-C", directory, "rev-parse", "HEAD"])).stdout.trim();
+  const status = (await run("git", ["-C", directory, "status", "--porcelain=v1"], { maxOutputBytes: 200_000 })).stdout;
+  if (!status) return head;
+  const diff = (await run("git", ["-C", directory, "diff", "--binary", "HEAD"], { maxOutputBytes: 2_000_000 })).stdout;
+  return `${head}-worktree-${createHash("sha256").update(status).update(diff).digest("hex").slice(0, 16)}`;
+}
+
 function pointId(value) {
   const hash = createHash("sha256").update(value).digest("hex");
   return `${hash.slice(0, 8)}-${hash.slice(8, 12)}-4${hash.slice(13, 16)}-a${hash.slice(17, 20)}-${hash.slice(20, 32)}`;
@@ -101,9 +103,9 @@ export class LocalRetriever {
   }
 
   async #index(directory, repository) {
-    const commit = (await run("git", ["-C", directory, "rev-parse", "HEAD"])).stdout.trim();
+    const commit = await workspaceRevision(directory);
     const manifest = await this.loadManifest();
-    if (manifest[repository]?.commit === commit && manifest[repository]?.model === this.model) return false;
+    if (manifest[repository]?.[commit]?.model === this.model) return false;
     const files = [];
     await collectFiles(directory, directory, files, { maxFiles: 2000, maxFileBytes: 256_000 });
     const chunks = [];
@@ -122,9 +124,6 @@ export class LocalRetriever {
         method: "PUT", headers: { "content-type": "application/json" }, body: JSON.stringify({ vectors: { size: vectorSize, distance: "Cosine" } }),
       });
     } else if (!collectionResponse.ok) throw new Error(`Qdrant collection HTTP ${collectionResponse.status}`);
-    await this.request(`${this.qdrantUrl}/collections/${this.collection}/points/delete?wait=true`, {
-      method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ filter: { must: [{ key: "repository", match: { value: repository } }] } }),
-    });
     for (let start = 0; start < selected.length; start += 32) {
       const batch = selected.slice(start, start + 32);
       const remaining = batch.slice(1);
@@ -136,19 +135,20 @@ export class LocalRetriever {
         method: "PUT", headers: { "content-type": "application/json" }, body: JSON.stringify({ points }),
       });
     }
-    manifest[repository] = { commit, model: this.model, chunks: selected.length, indexedAt: new Date().toISOString() };
+    manifest[repository] = { ...(manifest[repository]?.commit ? {} : manifest[repository]), [commit]: { model: this.model, chunks: selected.length, indexedAt: new Date().toISOString() } };
     await this.saveManifest(manifest);
     return true;
   }
 
-  async context(directory, repository, query, { limit = 8, maxCharacters = 12_000 } = {}) {
+  async context(directory, repository, query, { limit = 8, maxCharacters = 12_000, repositoryEntries = [] } = {}) {
     await this.ensureIndexed(directory, repository);
+    const commit = await workspaceRevision(directory);
     const [vector] = await this.embed([query]);
     const result = await this.request(`${this.qdrantUrl}/collections/${this.collection}/points/query`, {
       method: "POST",
       headers: { "content-type": "application/json" },
-      body: JSON.stringify({ query: vector, filter: { must: [{ key: "repository", match: { value: repository } }] }, limit, with_payload: true }),
+      body: JSON.stringify({ query: vector, filter: { must: [{ key: "repository", match: { value: repository } }, { key: "commit", match: { value: commit } }] }, limit, with_payload: true }),
     });
-    return formatRetrievedContext(result.result?.points ?? [], maxCharacters);
+    return formatRetrievedContext(result.result?.points ?? [], maxCharacters, repositoryEntries);
   }
 }

package/src/routing.js

@@ -20,10 +20,20 @@ const MODELS = Object.freeze({
   release: "azureai-textved/gpt-5.6-sol",
 });
 
+const PROVIDERS = new Set(["azureai-textved", "azureai-responses", "bedrock"]);
+
+export function validateModelRoute(route) {
+  if (typeof route !== "string" || route.length > 240 || !/^[A-Za-z0-9._:/-]+$/.test(route)) throw new Error("Invalid model route");
+  const separator = route.indexOf("/");
+  if (separator < 1 || !PROVIDERS.has(route.slice(0, separator))) throw new Error("Unsupported model provider");
+  if (separator === route.length - 1) throw new Error("Invalid model route");
+  return route;
+}
+
 export function modelForRole(role, environment = process.env) {
   const model = environment[`FACTORY_MODEL_${role.toUpperCase()}`] ?? MODELS[role];
   if (!model) throw new Error(`Unknown role: ${role}`);
-  return model;
+  return validateModelRoute(model);
 }
 
 export function modelForTask(task, environment = process.env) {

package/src/scanner-suite.js

@@ -20,7 +20,7 @@ const scanners = [
   {
     name: "semgrep",
     image: "semgrep/semgrep@sha256:183a149fb3e9700ab5294a7b4ab0241a826fd046bc8b721062fbea80fdfa438f",
-    args: ["semgrep", "scan", "--config", "p/default", "--json", "/workspace"],
+    args: ["semgrep", "scan", "--error", "--config", "p/default", "--json", "/workspace"],
   },
 ];
 
@@ -37,9 +37,10 @@ export class ScannerSuite {
     this.execute = execute;
   }
 
-  async scan(directory) {
+  async scan(directory, { names } = {}) {
     const workspace = path.resolve(directory);
-    return Promise.all(scanners.map(async (scanner) => {
+    const selected = names ? scanners.filter((scanner) => names.includes(scanner.name)) : scanners;
+    return Promise.all(selected.map(async (scanner) => {
       const args = [
         "run", "--rm", "--read-only", "--cap-drop", "ALL", "--security-opt", "no-new-privileges",
         "--pids-limit", "512", "--memory", "4g", "--cpus", "1", "--tmpfs", "/tmp:rw,noexec,nosuid,size=3g",

package/src/snapshot.js

@@ -2,6 +2,11 @@
 import { aggregateDashboard, loadAzureCost, loadLocalState, loadQueueMetrics } from "./dashboard.js";
 import { loadConfig } from "./config.js";
 import { uploadDashboardSnapshot } from "./reporter.js";
+import { uploadOperatorBlob } from "./reporter.js";
+import { DefaultAzureCredential } from "@azure/identity";
+import { SecretClient } from "@azure/keyvault-secrets";
+import { run } from "./process.js";
+import { safeOperatorLogs } from "./operator-logs.js";
 
 process.title = "factory-ai-snapshot";
 const config = loadConfig();
@@ -11,5 +16,16 @@ const queue = await loadQueueMetrics(config);
 let cost = null;
 try { cost = await loadAzureCost(config); } catch (error) { loaded.warnings.push(`Cost unavailable: ${error.message}`); }
 const dashboard = aggregateDashboard({ ...loaded, queue, cost, runtime: { status: "running" } });
+try {
+  const secrets = [];
+  const client = new SecretClient(config.keyVaultUrl, new DefaultAzureCredential());
+  for await (const item of client.listPropertiesOfSecrets()) secrets.push({ name: item.name, updated: item.updatedOn?.toISOString() });
+  dashboard.secrets = secrets.sort((left, right) => left.name.localeCompare(right.name));
+} catch (error) { dashboard.warnings.push(`Secret metadata unavailable: ${error.message}`); }
+try {
+  const result = await run("journalctl", ["-o", "cat", "-u", "agent-factory-control", "-u", "agent-factory-worker", "-u", "agent-factory-release", "-u", "agent-factory-telegram", "--since", "1 hour ago", "--no-pager", "-n", "500"], { timeoutMs: 30_000, maxOutputBytes: 500_000 });
+  const logs = safeOperatorLogs(result.stdout);
+  await uploadOperatorBlob(config, "logs.txt", logs);
+} catch (error) { dashboard.warnings.push(`Log snapshot unavailable: ${error.message}`); }
 await uploadDashboardSnapshot(config, dashboard);
 process.stdout.write(`${JSON.stringify({ event: "dashboard_snapshot", generatedAt: dashboard.generatedAt })}\n`);

package/src/task-entry.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import { AzureAgentRunner } from "./agent-runner.js";
 import { loadRegistry } from "./registry.js";
+import { createTelemetry } from "./telemetry.js";
 
 const input = await new Promise((resolve, reject) => {
   let value = "";
@@ -10,11 +11,32 @@ const input = await new Promise((resolve, reject) => {
   process.stdin.on("error", reject);
 });
 const packet = JSON.parse(input);
+const runtimeEnvironment = packet.runtimeEnvironment ?? {};
+delete packet.runtimeEnvironment;
 process.title = `factory-ai-${packet.task?.role ?? packet.mode}`.slice(0, 63);
 const registry = await loadRegistry("/opt/agent-factory/app/config/capabilities.json");
-const runner = new AzureAgentRunner({ timeoutMs: 1_800_000 }, registry);
-let result;
-if (packet.mode === "plan") result = await runner.plan(packet.objective, "/workspace");
-else if (packet.mode === "task") result = await runner.invoke({ ...packet, directory: "/workspace" });
-else throw new Error(`Unsupported task mode: ${packet.mode}`);
-process.stdout.write(`${JSON.stringify(result)}\n`);
+let currentPhase = "starting";
+const telemetry = createTelemetry({ exporter: async (record) => process.stderr.write(`@factory-event ${JSON.stringify({ type: "telemetry.recorded", telemetry: record, occurredAt: record.timestamp })}\n`) });
+const eventSink = (event) => {
+  if (event.type !== "agent.heartbeat") currentPhase = event.tool ? `${event.type}:${event.tool}` : event.type;
+  process.stderr.write(`@factory-event ${JSON.stringify({ ...event, phase: currentPhase, occurredAt: new Date().toISOString() })}\n`);
+  const kind = event.type?.startsWith("model.") ? "model" : event.type?.startsWith("tool.") ? "tool" : null;
+  if (kind) void telemetry.emitEvent(kind, { objectiveId: packet.objective.id, taskId: packet.task?.id ?? "planner0", role: packet.task?.role ?? packet.mode }, { statusClass: event.type.endsWith("failed") ? "error" : event.type.endsWith("retry") ? "retry" : "ok", attempt: event.attempt ?? event.step ?? 0, inputTokens: event.usage?.input_tokens ?? event.usage?.inputTokens, outputTokens: event.usage?.output_tokens ?? event.usage?.outputTokens });
+};
+const runner = new AzureAgentRunner({ timeoutMs: 1_800_000 }, registry, { eventSink, environment: { ...process.env, ...runtimeEnvironment } });
+const heartbeat = setInterval(() => eventSink({ type: "agent.heartbeat", role: packet.task?.role ?? packet.mode, phase: currentPhase }), 15_000);
+heartbeat.unref();
+try {
+  eventSink({ type: "agent.started", role: packet.task?.role ?? packet.mode });
+  let result;
+  if (packet.mode === "plan") result = await runner.plan(packet.objective, "/workspace", packet.context ?? []);
+  else if (packet.mode === "task") result = await runner.invoke({ ...packet, directory: "/workspace" });
+  else throw new Error(`Unsupported task mode: ${packet.mode}`);
+  eventSink({ type: "agent.completed", role: packet.task?.role ?? packet.mode });
+  process.stdout.write(`${JSON.stringify(result)}\n`);
+} catch (error) {
+  eventSink({ type: "agent.failed", role: packet.task?.role ?? packet.mode, error: String(error.message ?? error).slice(0, 500) });
+  throw error;
+} finally {
+  clearInterval(heartbeat);
+}

package/src/task-graph.js

@@ -60,8 +60,3 @@ export function readyTasks(tasks, results) {
     .filter((task) => task.dependsOn.every((id) => results[id]?.status === "succeeded"))
     .map((task) => task.id);
 }
-
-export function applyTaskResult(state, result) {
-  if (state.results[result.taskId]) return state;
-  return { ...state, results: { ...state.results, [result.taskId]: result } };
-}

package/src/telegram-service.js

@@ -10,6 +10,7 @@ import { sendMessage } from "./bus.js";
 import { loadLocalState, loadQueueMetrics } from "./dashboard.js";
 import { formatObjectiveProgress, isAllowedChat, objectiveFromTelegram, parseTelegramCommand } from "./telegram.js";
 import { log } from "./log.js";
+import { ActivityStore } from "./activity.js";
 
 process.title = "factory-ai-telegram";
 const config = loadConfig();
@@ -37,6 +38,7 @@ const subscriptions = await loadJson(subscriptionsFile);
 const client = new ServiceBusClient(config.serviceBusFqdn, new DefaultAzureCredential());
 const sender = client.createSender(config.controlQueue);
 const abort = new AbortController();
+const activityStore = new ActivityStore(config.stateDir);
 
 async function telegram(method, body) {
   const response = await fetch(`https://api.telegram.org/bot${token}/${method}`, {
@@ -93,6 +95,7 @@ async function processUpdate(update) {
     }
     if (command.type === "objective") {
       const state = JSON.parse(await readFile(path.join(config.stateDir, command.objectiveId, "state.json"), "utf8"));
+      state.activity = await activityStore.latestObjective(command.objectiveId);
       return reply(message.chat.id, formatObjectiveProgress(state, config.factoryName));
     }
     const objective = objectiveFromTelegram(update.update_id, command);
@@ -107,14 +110,17 @@ async function processUpdate(update) {
 
 async function notifyProgress() {
   let changed = false;
+  const terminal = new Set(["complete", "failed", "blocked", "denied", "expired", "cancelled"]);
   for (const [objectiveId, subscription] of Object.entries(subscriptions)) {
     let state;
     try { state = JSON.parse(await readFile(path.join(config.stateDir, objectiveId, "state.json"), "utf8")); }
     catch (error) { if (error.code === "ENOENT") continue; throw error; }
+    state.activity = await activityStore.latestObjective(objectiveId);
     const text = formatObjectiveProgress(state, config.factoryName);
     const digest = createHash("sha256").update(text).digest("hex");
+    if (digest !== subscription.lastDigest) await reply(subscription.chatId, text);
+    if (terminal.has(state.status)) { delete subscriptions[objectiveId]; changed = true; continue; }
     if (digest === subscription.lastDigest) continue;
-    await reply(subscription.chatId, text);
     subscription.lastDigest = digest;
     subscription.lastStatus = state.status;
     subscription.notifiedAt = new Date().toISOString();

package/src/telegram.js

@@ -48,7 +48,11 @@ export function formatObjectiveProgress(state, factoryName = "Factory AI") {
     `Status: ${state.status ?? "unknown"}`,
     `${complete}/${tasks.length} tasks complete`,
   ];
-  for (const task of tasks.slice(0, 20)) lines.push(`${task.role}: ${results[task.id]?.status ?? "blocked"} — ${task.title}`);
+  for (const task of tasks.slice(0, 20)) {
+    const activity = state.activity?.[task.id];
+    const detail = activity ? ` — ${activity.phase ?? activity.type}${activity.tool ? ` ${activity.tool}` : ""}${activity.retryCount ? ` (${activity.retryCount} retries)` : ""}${activity.lastError ? ` [${activity.lastError}]` : ""}` : "";
+    lines.push(`${task.role}: ${results[task.id]?.status ?? "blocked"} — ${task.title}${detail}`);
+  }
   if (state.failure) lines.push(`Blocker: ${String(state.failure).slice(0, 500)}`);
   if (state.release?.url) lines.push(`PR: ${state.release.url}`);
   return lines.join("\n").slice(0, 4000);