@matterailab/orbcode 0.1.14 → 0.2.0

package/README.md

@@ -130,10 +130,10 @@ Fallbacks & overrides:
 - **settings.json key**: set `apiKey` in `~/.orbcode/settings.json` (or a
   project's `.orbcode/settings.json`) to skip login. The login screen itself is
   browser-redirect only.
-- **Env token**: set `ORBCODE_TOKEN` to skip login entirely (takes precedence
+- **Env token**: set `MATTERAI_TOKEN` to skip login entirely (takes precedence
   over everything).
-- **Dev endpoints**: `ORBCODE_BACKEND_URL` (default `https://api.matterai.so`)
-  and `ORBCODE_APP_URL` (default `https://app.matterai.so`) override where the
+- **Dev endpoints**: `MATTERAI_BACKEND_URL` (default `https://api.matterai.so`)
+  and `MATTERAI_APP_URL` (default `https://app.matterai.so`) override where the
   device flow points — useful against a local backend/webapp.
 - Tokens are MatterAI JWTs. A token whose payload has `env: "development"`
   automatically routes API calls to `http://localhost:3000`, matching the
@@ -346,13 +346,13 @@ and `--resume <id>`.
 
 | env var               | effect                                                            |
 | --------------------- | ----------------------------------------------------------------- |
-| `ORBCODE_TOKEN`       | auth token (overrides everything)                                 |
-| `ORBCODE_API_KEY`     | same as `apiKey` in settings.json                                 |
-| `ORBCODE_BASE_URL`    | same as `baseUrl` in settings.json                                |
-| `ORBCODE_MODEL`       | model override (what `--model` sets internally)                   |
-| `ORBCODE_CONFIG_DIR`  | config directory (default `~/.orbcode`)                           |
-| `ORBCODE_BACKEND_URL` | device-auth backend (default `https://api.matterai.so`)           |
-| `ORBCODE_APP_URL`     | webapp for the authorize page (default `https://app.matterai.so`) |
+| `MATTERAI_TOKEN`       | auth token (overrides everything)                                 |
+| `MATTERAI_API_KEY`     | same as `apiKey` in settings.json                                 |
+| `MATTERAI_BASE_URL`    | same as `baseUrl` in settings.json                                |
+| `MATTERAI_MODEL`       | model override (what `--model` sets internally)                   |
+| `MATTERAI_CONFIG_DIR`  | config directory (default `~/.orbcode`)                           |
+| `MATTERAI_BACKEND_URL` | device-auth backend (default `https://api.matterai.so`)           |
+| `MATTERAI_APP_URL`     | webapp for the authorize page (default `https://app.matterai.so`) |
 
 `autoApproveEdits` / `autoApproveSafeCommands` set the session defaults for the
 approval prompts (dangerous commands still always prompt); shift+tab cycles
@@ -365,7 +365,7 @@ them to **block** dangerous actions, **auto-approve** trusted ones, **rewrite**
 tool inputs, **inject context** into the model, **format code** after edits,
 **notify** you, or **keep the agent working** until a condition is met. They use
 the **same contract as Claude Code's hooks**, so scripts written for it work
-here (just use `$ORBCODE_PROJECT_DIR` and OrbCode's tool names).
+here (just use `$MATTERAI_PROJECT_DIR` and OrbCode's tool names).
 
 > 📖 **This is the overview. The complete, example-driven reference —
 > per-event input/output, a copy-paste cookbook, debugging, and security — is in
@@ -588,8 +588,8 @@ node test-device-auth.mjs  # device-auth polling flow against a local mock
   command runs `dist/`, and the version is read from `package.json` at runtime.
 - **Stale link after the rename** — `npm unlink -g orbitalcode && npm link`.
 - **Login times out** — the device code lives 10 minutes; press Enter to retry,
-  or paste a token manually. Against a local stack, set `ORBCODE_BACKEND_URL`
-  and `ORBCODE_APP_URL`.
+  or paste a token manually. Against a local stack, set `MATTERAI_BACKEND_URL`
+  and `MATTERAI_APP_URL`.
 - **401 on chat** — token expired: `/logout` then `/login`.
 - **Keyboard input does nothing** — OrbCode needs a real TTY (raw mode); it
   won't accept piped stdin. Use `-p` for non-interactive runs.

package/dist/auth/auth.js

@@ -32,10 +32,10 @@ export function getSignInUrl() {
     return `${APP_URL}/authentication/sign-in?loginType=extension&source=cli`;
 }
 function deviceAuthBaseUrl() {
-    return process.env.ORBCODE_BACKEND_URL || DEFAULT_BACKEND_URL;
+    return process.env.MATTERAI_BACKEND_URL || DEFAULT_BACKEND_URL;
 }
 function deviceAuthAppUrl() {
-    return process.env.ORBCODE_APP_URL || APP_URL;
+    return process.env.MATTERAI_APP_URL || APP_URL;
 }
 export async function startDeviceAuth() {
     const response = await fetch(`${deviceAuthBaseUrl()}/orbcode/auth/start`, {

package/dist/config/settings.js

@@ -20,7 +20,7 @@ const SETTINGS_KEYS = [
     "env",
 ];
 export function getConfigDir() {
-    return process.env.ORBCODE_CONFIG_DIR || path.join(os.homedir(), ".orbcode");
+    return process.env.MATTERAI_CONFIG_DIR || path.join(os.homedir(), ".orbcode");
 }
 function getConfigPath() {
     return path.join(getConfigDir(), "config.json");
@@ -76,7 +76,7 @@ function isProjectHooksTrusted(cwd, hash) {
     // stdin is not a TTY (so a stray export in a shell rc file can't silently
     // disable the trust gate for interactive sessions). A non-TTY check keeps
     // the gate meaningful in the TUI while still letting CI opt in.
-    if (process.env.ORBCODE_TRUST_PROJECT_HOOKS === "1" && !process.stdin.isTTY)
+    if (process.env.MATTERAI_TRUST_PROJECT_HOOKS === "1" && !process.stdin.isTTY)
         return true;
     const store = readJson(getTrustStorePath());
     return Boolean(store && store[cwd] === hash);
@@ -179,23 +179,23 @@ export function loadSettings() {
         }
     }
     // Environment variables take precedence over all files.
-    if (process.env.ORBCODE_BASE_URL)
-        settings.baseUrl = process.env.ORBCODE_BASE_URL;
-    if (process.env.ORBCODE_API_KEY)
-        settings.apiKey = process.env.ORBCODE_API_KEY;
-    if (process.env.ORBCODE_MODEL)
-        settings.model = process.env.ORBCODE_MODEL;
+    if (process.env.MATTERAI_BASE_URL)
+        settings.baseUrl = process.env.MATTERAI_BASE_URL;
+    if (process.env.MATTERAI_API_KEY)
+        settings.apiKey = process.env.MATTERAI_API_KEY;
+    if (process.env.MATTERAI_MODEL)
+        settings.model = process.env.MATTERAI_MODEL;
     if (!isValidAxonModel(settings.model)) {
         settings.model = DEFAULT_MODEL_ID;
     }
     return settings;
 }
 /**
- * Effective credential: ORBCODE_TOKEN env > apiKey (settings.json / env) >
+ * Effective credential: MATTERAI_TOKEN env > apiKey (settings.json / env) >
  * stored login token.
  */
 export function getAuthToken(settings) {
-    return process.env.ORBCODE_TOKEN || settings.apiKey || settings.token;
+    return process.env.MATTERAI_TOKEN || settings.apiKey || settings.token;
 }
 /** Persist app state to config.json. settings.json-only fields are skipped. */
 export function saveSettings(settings) {

package/dist/core/hooks.js

@@ -260,11 +260,11 @@ function capContext(text) {
 }
 /** Keys always stripped from the hook environment (OrbCode credentials/config). */
 const HOOK_ENV_REDACT_EXACT = new Set([
-    "ORBCODE_TOKEN",
-    "ORBCODE_API_KEY",
-    "ORBCODE_CONFIG_DIR",
-    "ORBCODE_BACKEND_URL",
-    "ORBCODE_APP_URL",
+    "MATTERAI_TOKEN",
+    "MATTERAI_API_KEY",
+    "MATTERAI_CONFIG_DIR",
+    "MATTERAI_BACKEND_URL",
+    "MATTERAI_APP_URL",
 ]);
 /** Pattern for credential-like env var names (TOKEN, KEY, SECRET, …) so
  *  third-party secrets (GITHUB_TOKEN, AWS_SECRET_ACCESS_KEY, …) are redacted
@@ -274,7 +274,7 @@ const HOOK_ENV_REDACT_PATTERN = /(?:^|_)(TOKEN|KEY|SECRET|PASSWORD|PASSWD|CREDEN
  *  (so PATH, HOME, npx, git, … all work) minus anything that looks like a
  *  credential — hooks must never see the user's API token. */
 function buildHookEnv(cwd) {
-    const env = { ORBCODE_PROJECT_DIR: cwd };
+    const env = { MATTERAI_PROJECT_DIR: cwd };
     for (const [key, value] of Object.entries(process.env)) {
         if (value === undefined)
             continue;

package/dist/headless.js

@@ -4,9 +4,9 @@ import { Agent } from "./core/agent.js";
 /** Non-interactive `orbcode -p "prompt"` mode: prints the final response to stdout. */
 export async function runHeadless(prompt, yolo) {
     const settings = loadSettings();
-    // An unknown --model (or ORBCODE_MODEL) silently resolves to the default; say
+    // An unknown --model (or MATTERAI_MODEL) silently resolves to the default; say
     // so on stderr instead of quietly running a different model than requested.
-    const requestedModel = process.env.ORBCODE_MODEL;
+    const requestedModel = process.env.MATTERAI_MODEL;
     if (requestedModel && !isValidAxonModel(requestedModel)) {
         process.stderr.write(`warning: unknown model "${requestedModel}"; using "${settings.model}". ` +
             `Add it under "customModels" in settings.json (with a "provider") to use it.\n`);
@@ -18,7 +18,7 @@ export async function runHeadless(prompt, yolo) {
     // so they don't need a MatterAI login. Only gate on the token when the
     // selected model actually goes through the MatterAI gateway.
     if (!token && !usesAiSdk(getModel(settings.model))) {
-        console.error("Not signed in. Run `orbcode login`, set ORBCODE_TOKEN, or put an apiKey in settings.json.");
+        console.error("Not signed in. Run `orbcode login`, set MATTERAI_TOKEN, or put an apiKey in settings.json.");
         process.exit(1);
     }
     // There's no interactive trust prompt in headless mode, so untrusted project
@@ -26,7 +26,7 @@ export async function runHeadless(prompt, yolo) {
     const pendingHooks = getPendingProjectHooks();
     if (pendingHooks) {
         process.stderr.write(`note: ${pendingHooks.commands.length} project hook(s) in .orbcode/settings.json are untrusted and were skipped. ` +
-            `Trust them in an interactive session, or set ORBCODE_TRUST_PROJECT_HOOKS=1.\n`);
+            `Trust them in an interactive session, or set MATTERAI_TRUST_PROJECT_HOOKS=1.\n`);
     }
     let exitCode = 0;
     // Only the final content is printed: either the attempt_completion result

package/dist/index.js

@@ -88,9 +88,9 @@ async function main() {
     }
     const model = takeFlagValue(args, "model") ?? takeFlagValue(args, "m");
     if (model) {
-        // loadSettings() treats ORBCODE_MODEL as the highest-precedence override,
+        // loadSettings() treats MATTERAI_MODEL as the highest-precedence override,
         // so the flag reaches both the TUI and headless mode without plumbing.
-        process.env.ORBCODE_MODEL = model;
+        process.env.MATTERAI_MODEL = model;
     }
     let initialSession;
     const resumeId = takeFlagValue(args, "resume") ?? takeFlagValue(args, "r");

package/dist/ui/App.js

@@ -523,7 +523,7 @@ export function App({ initialView, initialPrompt, initialSession, updateCheck, }
                         `Version     ${VERSION}`,
                         `Model       ${model.name} (${model.id})`,
                         `Directory   ${process.cwd()}`,
-                        `Account     ${getAuthToken(settings) ? (settings.apiKey || process.env.ORBCODE_TOKEN ? "API key" : "signed in") : "signed out"}${settings.organizationId ? ` · org ${settings.organizationId}` : ""}`,
+                        `Account     ${getAuthToken(settings) ? (settings.apiKey || process.env.MATTERAI_TOKEN ? "API key" : "signed in") : "signed out"}${settings.organizationId ? ` · org ${settings.organizationId}` : ""}`,
                         `Gateway     ${settings.baseUrl ?? "MatterAI (default)"}`,
                         `Context     ${contextTokens.toLocaleString()} / ${model.contextWindow.toLocaleString()} tokens (${contextPct}%)`,
                         `Cost        $${totalCost.toFixed(4)} this session`,

package/dist/ui/LoginView.js

@@ -78,5 +78,5 @@ export function LoginView({ onLogin }) {
             void beginBrowserLogin();
         }
     });
-    return (_jsxs(Box, { flexDirection: "column", borderStyle: "round", borderColor: COLORS.primary, paddingX: 1, children: [_jsxs(Text, { bold: true, color: COLORS.primary, children: ["Sign in to ", PRODUCT_NAME] }), phase === "waiting" ? (_jsxs(_Fragment, { children: [_jsx(Box, { marginTop: 1, children: _jsx(Spinner, { label: "Waiting for authorization in your browser" }) }), _jsx(Text, { dimColor: true, children: "Approve the \"Authorize OrbCode CLI\" dialog at:" }), _jsxs(Text, { dimColor: true, children: [" ", authorizeUrl] }), _jsx(Text, { dimColor: true, children: "Esc to cancel" })] })) : (_jsxs(Text, { children: ["Press ", _jsx(Text, { bold: true, children: "Enter" }), " to open MatterAI in your browser and authorize OrbCode CLI."] })), phase === "starting" && _jsx(Text, { color: COLORS.thinking, children: "Contacting sign-in service\u2026" }), phase === "verifying" && _jsx(Text, { color: COLORS.thinking, children: "Verifying\u2026" }), error && _jsxs(Text, { color: COLORS.error, children: ["\u2717 ", error] }), _jsx(Text, { dimColor: true, children: "To use a token instead, set apiKey in ~/.orbcode/settings.json or the ORBCODE_TOKEN env var." })] }));
+    return (_jsxs(Box, { flexDirection: "column", borderStyle: "round", borderColor: COLORS.primary, paddingX: 1, children: [_jsxs(Text, { bold: true, color: COLORS.primary, children: ["Sign in to ", PRODUCT_NAME] }), phase === "waiting" ? (_jsxs(_Fragment, { children: [_jsx(Box, { marginTop: 1, children: _jsx(Spinner, { label: "Waiting for authorization in your browser" }) }), _jsx(Text, { dimColor: true, children: "Approve the \"Authorize OrbCode CLI\" dialog at:" }), _jsxs(Text, { dimColor: true, children: [" ", authorizeUrl] }), _jsx(Text, { dimColor: true, children: "Esc to cancel" })] })) : (_jsxs(Text, { children: ["Press ", _jsx(Text, { bold: true, children: "Enter" }), " to open MatterAI in your browser and authorize OrbCode CLI."] })), phase === "starting" && _jsx(Text, { color: COLORS.thinking, children: "Contacting sign-in service\u2026" }), phase === "verifying" && _jsx(Text, { color: COLORS.thinking, children: "Verifying\u2026" }), error && _jsxs(Text, { color: COLORS.error, children: ["\u2717 ", error] }), _jsx(Text, { dimColor: true, children: "To use a token instead, set apiKey in ~/.orbcode/settings.json or the MATTERAI_TOKEN env var." })] }));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@matterailab/orbcode",
-  "version": "0.1.14",
+  "version": "0.2.0",
   "description": "OrbCode CLI — agentic coding in your terminal, powered by Axon models by MatterAI",
   "type": "module",
   "bin": {