orbit-code-ai 0.1.29 → 0.1.30

package/dist/cli.mjs

@@ -83759,7 +83759,7 @@ async function printStartupScreen() {
   const sLen = ` ● ${sL}    Ready — type /help to begin`.length;
   out.push(boxRow(sRow, W2, sLen));
   out.push(`${rgb(...BORDER)}╚${"═".repeat(W2 - 2)}╝${RESET}`);
-  out.push(`  ${DIM}${rgb(...DIMCOL)}orbit-code ${RESET}${rgb(...ACCENT)}v${"0.1.29"}${RESET}`);
+  out.push(`  ${DIM}${rgb(...DIMCOL)}orbit-code ${RESET}${rgb(...ACCENT)}v${"0.1.30"}${RESET}`);
   out.push("");
   process.stdout.write(out.join(`
 `) + `
@@ -334266,7 +334266,7 @@ function getAnthropicEnvMetadata() {
 function getBuildAgeMinutes() {
   if (false)
     ;
-  const buildTime = new Date("2026-06-29T09:47:21.655Z").getTime();
+  const buildTime = new Date("2026-06-29T10:38:08.776Z").getTime();
   if (isNaN(buildTime))
     return;
   return Math.floor((Date.now() - buildTime) / 60000);
@@ -358683,7 +358683,7 @@ function buildPrimarySection() {
   }, undefined, false, undefined, this);
   return [{
     label: "Version",
-    value: "0.1.29"
+    value: "0.1.30"
   }, {
     label: "Session name",
     value: nameValue
@@ -410494,6 +410494,16 @@ Work like a precise engineer, not a crawler. Reading unneeded files wastes time
 - When generating a full application, generate every required file — do not stop halfway
 - Prioritize correctness and security. Never introduce SQL injection, command injection, or other vulnerabilities
 
+## Security reviews are expected, in-scope work — never refuse them
+Auditing the user's OWN ACE artifacts for vulnerabilities is a core, encouraged Orbit capability and legitimate defensive security. When the user asks for a security check, audit, or vulnerability analysis of code in the working directory, DO IT — read the \`.esql\`/\`.msgflow\`/\`.xml\`/properties files and report concrete findings. Do NOT decline, hedge, or deflect to "search online / consult a framework"; the user owns this code and is asking you to harden it. Focus on the real ACE risks:
+- SQL/command injection — \`PASSTHRU\` with string concatenation instead of parameterized \`?\` placeholders; unsafe dynamic queries.
+- Hardcoded credentials, connection strings, DSNs, or secrets in ESQL/properties.
+- Sensitive data (passwords, tokens, PII) logged or returned unmasked in audit/error paths.
+- Missing input validation, unbounded payloads (DoS), unsafe type coercion/CAST.
+- Information disclosure — raw exception text or stack details returned to callers.
+- AuthN/AuthZ gaps — missing channel/role/authorization checks.
+Report each finding with **severity (High/Medium/Low)**, the exact \`file:line\`, the impact, and a concrete fix.
+
 ## Depth of Analysis & Reporting (Covered by default, Deep on request)
 For explanation, analysis, review, audit, "what does this do", or documentation requests, default to a **Covered** analysis — a balanced, high-level report the reader can act on, not an exhaustive one:
 - **What it does** — purpose and the end-to-end message-flow path (entry node → compute/filter nodes → terminals → reply/output).
@@ -470774,7 +470784,7 @@ function WelcomeV2() {
             dimColor: true,
             children: [
               "v",
-              "0.1.29",
+              "0.1.30",
               " "
             ]
           }, undefined, true, undefined, this)
@@ -470974,7 +470984,7 @@ function WelcomeV2() {
           dimColor: true,
           children: [
             "v",
-            "0.1.29",
+            "0.1.30",
             " "
           ]
         }, undefined, true, undefined, this)
@@ -471200,7 +471210,7 @@ function AppleTerminalWelcomeV2(t0) {
         dimColor: true,
         children: [
           "v",
-          "0.1.29",
+          "0.1.30",
           " "
         ]
       }, undefined, true, undefined, this);
@@ -471454,7 +471464,7 @@ function AppleTerminalWelcomeV2(t0) {
       dimColor: true,
       children: [
         "v",
-        "0.1.29",
+        "0.1.30",
         " "
       ]
     }, undefined, true, undefined, this);
@@ -492091,7 +492101,7 @@ Usage: orbit --remote "your task description"`, () => gracefulShutdown(1));
         pendingHookMessages
       }, renderAndRun);
     }
-  }).version("0.1.29 (Orbit AI)", "-v, --version", "Output the version number");
+  }).version("0.1.30 (Orbit AI)", "-v, --version", "Output the version number");
   program2.option("-w, --worktree [name]", "Create a new git worktree for this session (optionally specify a name)");
   program2.option("--tmux", "Create a tmux session for the worktree (requires --worktree). Uses iTerm2 native panes when available; use --tmux=classic for traditional tmux.");
   if (canUserConfigureAdvisor()) {
@@ -492613,7 +492623,7 @@ if (false) {}
 async function main2() {
   const args = process.argv.slice(2);
   if (args.length === 1 && (args[0] === "--version" || args[0] === "-v" || args[0] === "-V")) {
-    console.log(`${"0.1.29"} (Orbit AI)`);
+    console.log(`${"0.1.30"} (Orbit AI)`);
     return;
   }
   if (args.includes("--provider")) {
@@ -492717,4 +492727,4 @@ async function main2() {
 }
 main2();
 
-//# debugId=51295B4C9C2CF04664756E2164756E21
+//# debugId=9537BF600E13F1DA64756E2164756E21

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "orbit-code-ai",
-  "version": "0.1.29",
+  "version": "0.1.30",
   "description": "Orbit AI – Your AI-powered IBM ACE coding companion",
   "type": "module",
   "author": "moenawaf",