factory-ai 1.5.1 → 1.5.3

package/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes follow semantic versioning and the Keep a Changelog structur
 
 ## [Unreleased]
 
+## [1.5.3] - 2026-07-13
+
+### Fixed
+
+- Validate npm's actual attestation URL and SLSA predicate metadata fields during verified automatic updates.
+
+## [1.5.2] - 2026-07-13
+
+### Fixed
+
+- Parse runtime environment files with an allowlist so factory names and purposes containing spaces do not break verified automatic updates.
+
 ## [1.5.1] - 2026-07-13
 
 ### Fixed

package/bootstrap/auto-update.sh

@@ -14,16 +14,19 @@ version=$(jq -r .latest <<<"$status")
 commit=$(jq -r .gitHead <<<"$status")
 [[ $commit =~ ^[0-9a-f]{40}$ ]] || { printf 'npm release does not contain a valid gitHead.\n' >&2; exit 1; }
 
-set -a
-source /etc/agent-factory.env
-set +a
+while IFS='=' read -r name value; do
+  case "$name" in
+    KEY_VAULT_NAME|SERVICE_BUS_NAMESPACE|FACTORY_STORAGE_ACCOUNT|FACTORY_NAME|FACTORY_PURPOSE|AWS_REGION|FACTORY_MODEL_SCOUT|FACTORY_MODEL_PLANNER|FACTORY_MODEL_BUILDER|FACTORY_MODEL_TESTER|FACTORY_MODEL_DEBUGGER|FACTORY_MODEL_REVIEWER|FACTORY_MODEL_SECURITY|FACTORY_MODEL_RELEASE|FACTORY_COMPACT_AFTER_INPUT_TOKENS|FACTORY_COMPACT_MAX_CHARACTERS|FACTORY_WATCHDOG_STALE_SECONDS|FACTORY_HOOKS_JSON) printf -v "$name" '%s' "$value" ;;
+  esac
+done < /etc/agent-factory.env
 github_token=$(az keyvault secret show --vault-name "$KEY_VAULT_NAME" --name github-token --query value --output tsv)
 tag_commit=$(GH_TOKEN="$github_token" gh api "repos/itsvedantkumar/factory-ai/commits/v$version" --jq .sha)
 [[ $tag_commit == "$commit" ]] || { printf 'npm gitHead does not match the immutable release tag.\n' >&2; exit 1; }
 release_ok=$(GH_TOKEN="$github_token" gh release view "v$version" --repo itsvedantkumar/factory-ai --json isDraft,isPrerelease --jq '(.isDraft == false) and (.isPrerelease == false)')
 [[ $release_ok == true ]] || { printf 'Matching stable GitHub release is unavailable.\n' >&2; exit 1; }
-provenance=$(npm view "factory-ai@$version" dist.attestations.provenance.url 2>/dev/null || true)
-[[ $provenance == https://search.sigstore.dev/* ]] || { printf 'npm release lacks verifiable provenance metadata.\n' >&2; exit 1; }
+attestation_url=$(npm view "factory-ai@$version" dist.attestations.url 2>/dev/null || true)
+predicate_type=$(npm view "factory-ai@$version" dist.attestations.provenance.predicateType 2>/dev/null || true)
+[[ $attestation_url == https://registry.npmjs.org/-/npm/v1/attestations/* && $predicate_type == https://slsa.dev/provenance/v1 ]] || { printf 'npm release lacks verifiable provenance metadata.\n' >&2; exit 1; }
 checks=$(GH_TOKEN="$github_token" gh api "repos/itsvedantkumar/factory-ai/commits/$commit/check-runs" --jq '[.check_runs[] | select(.name == "verify") | .conclusion] | any(. == "success")')
 [[ $checks == true ]] || { printf 'Candidate commit lacks successful CI verification.\n' >&2; exit 1; }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "factory-ai",
-  "version": "1.5.1",
+  "version": "1.5.3",
   "description": "Deploy a private autonomous coding-agent factory on Azure: isolated builders, testers, security reviewers, durable orchestration, multi-model routing, memory, cost controls, and gated GitHub pull requests.",
   "private": false,
   "license": "MIT",