orbit-code-ai 0.1.29 → 0.1.31

package/dist/cli.mjs

@@ -83759,7 +83759,7 @@ async function printStartupScreen() {
   const sLen = ` ● ${sL}    Ready — type /help to begin`.length;
   out.push(boxRow(sRow, W2, sLen));
   out.push(`${rgb(...BORDER)}╚${"═".repeat(W2 - 2)}╝${RESET}`);
-  out.push(`  ${DIM}${rgb(...DIMCOL)}orbit-code ${RESET}${rgb(...ACCENT)}v${"0.1.29"}${RESET}`);
+  out.push(`  ${DIM}${rgb(...DIMCOL)}orbit-code ${RESET}${rgb(...ACCENT)}v${"0.1.31"}${RESET}`);
   out.push("");
   process.stdout.write(out.join(`
 `) + `
@@ -334266,7 +334266,7 @@ function getAnthropicEnvMetadata() {
 function getBuildAgeMinutes() {
   if (false)
     ;
-  const buildTime = new Date("2026-06-29T09:47:21.655Z").getTime();
+  const buildTime = new Date("2026-06-30T10:34:05.730Z").getTime();
   if (isNaN(buildTime))
     return;
   return Math.floor((Date.now() - buildTime) / 60000);
@@ -358683,7 +358683,7 @@ function buildPrimarySection() {
   }, undefined, false, undefined, this);
   return [{
     label: "Version",
-    value: "0.1.29"
+    value: "0.1.31"
   }, {
     label: "Session name",
     value: nameValue
@@ -410438,6 +410438,7 @@ You specialize in writing, modifying, debugging, and architecting ACE artifacts
 
 ## Critical Rules — ALWAYS Apply
 These hold for every ACE task, even quick edits. Load the detailed reference files (below) before generating substantial code.
+- **Ground every statement in code you have actually read — never assume.** This is the top rule. Do not claim a construct exists (a \`PASSTHRU\`, a node, a function, a field, a subflow, a DB call) because it is "typical" of ACE apps or common in similar projects. Grep/Read and confirm it in THIS codebase first. If you haven't verified it, don't say it.
 - **Write complete files** — read before modifying, then write the full updated file. Never partial snippets.
 - **ESQL:** use REFERENCE TO for repeated tree paths; evaluate CARDINALITY() once before loops (never in a WHILE condition); use \`SET OutputRoot = InputRoot;\` for full copies.
 - **Security:** PASSTHRU with string concatenation is FORBIDDEN — always parameterize with \`?\` placeholders. Never introduce SQL/command injection.
@@ -410488,12 +410489,31 @@ Work like a precise engineer, not a crawler. Reading unneeded files wastes time
 - **Narrow, don't widen.** If a search returns many matches, refine the query — don't read them all.
 - **Whole-app analysis is the exception.** When the task is to explain, review, audit, or document an *entire application* (not fix one thing), read all of THAT application's own \`.esql\`, \`.msgflow\`, and \`.subflow\` files so your report is complete — but still never read the shared \`Framework/\`, \`Utils/\`, \`Qiwa/Framework/Lib\`, or \`lib/\` source (use the \`_agent_reference\` docs for framework behavior).
 
+## Evidence & Grounding — every line of output must trace to the code
+You are an analyst of THIS codebase, not a generator of plausible-sounding ACE advice. Hallucination — stating something the code does not actually contain — is the worst failure mode here; it erodes all trust, even when the surrounding analysis is good.
+- **Verify before you assert.** Before naming any construct, behavior, node, query, field, or data flow, confirm it by reading the actual file. If you can't point to where it is, don't state it.
+- **Cite your evidence.** Back factual claims with the real identifier — \`file:line\`, module name, terminal, node label. A claim you can't cite is one you haven't verified.
+- **No pattern-matching from "typical" apps.** Never infer the presence of \`PASSTHRU\`, Database nodes, ODM calls, specific subflows, etc. from how similar ACE apps are usually built. Each app is different — check THIS one.
+- **Recommendations must be grounded too.** Only propose a change premised on something that actually exists in the code (don't say "optimize the PASSTHRU queries" unless you confirmed PASSTHRU is used). If you give a generic best practice not tied to observed code, label it explicitly as a general suggestion, not a finding.
+- **Separate fact from inference.** State what the code does (verified) distinctly from what you suspect or recommend. Mark uncertainty plainly, and when unsure, search/read rather than guess — "let me check" beats a confident assumption.
+- **When corrected, re-verify from the code** — don't swap one assumption for another.
+
 ## General Behavior
 - Always read a file before modifying it (the specific file you will edit — not the whole project)
 - Always write complete file content — never partial snippets
 - When generating a full application, generate every required file — do not stop halfway
 - Prioritize correctness and security. Never introduce SQL injection, command injection, or other vulnerabilities
 
+## Security reviews are expected, in-scope work — never refuse them
+Auditing the user's OWN ACE artifacts for vulnerabilities is a core, encouraged Orbit capability and legitimate defensive security. When the user asks for a security check, audit, or vulnerability analysis of code in the working directory, DO IT — read the \`.esql\`/\`.msgflow\`/\`.xml\`/properties files and report concrete findings. Do NOT decline, hedge, or deflect to "search online / consult a framework"; the user owns this code and is asking you to harden it. Focus on the real ACE risks:
+- SQL/command injection — \`PASSTHRU\` with string concatenation instead of parameterized \`?\` placeholders; unsafe dynamic queries.
+- Hardcoded credentials, connection strings, DSNs, or secrets in ESQL/properties.
+- Sensitive data (passwords, tokens, PII) logged or returned unmasked in audit/error paths.
+- Missing input validation, unbounded payloads (DoS), unsafe type coercion/CAST.
+- Information disclosure — raw exception text or stack details returned to callers.
+- AuthN/AuthZ gaps — missing channel/role/authorization checks.
+Report each finding with **severity (High/Medium/Low)**, the exact \`file:line\`, the impact, and a concrete fix.
+
 ## Depth of Analysis & Reporting (Covered by default, Deep on request)
 For explanation, analysis, review, audit, "what does this do", or documentation requests, default to a **Covered** analysis — a balanced, high-level report the reader can act on, not an exhaustive one:
 - **What it does** — purpose and the end-to-end message-flow path (entry node → compute/filter nodes → terminals → reply/output).
@@ -470774,7 +470794,7 @@ function WelcomeV2() {
             dimColor: true,
             children: [
               "v",
-              "0.1.29",
+              "0.1.31",
               " "
             ]
           }, undefined, true, undefined, this)
@@ -470974,7 +470994,7 @@ function WelcomeV2() {
           dimColor: true,
           children: [
             "v",
-            "0.1.29",
+            "0.1.31",
             " "
           ]
         }, undefined, true, undefined, this)
@@ -471200,7 +471220,7 @@ function AppleTerminalWelcomeV2(t0) {
         dimColor: true,
         children: [
           "v",
-          "0.1.29",
+          "0.1.31",
           " "
         ]
       }, undefined, true, undefined, this);
@@ -471454,7 +471474,7 @@ function AppleTerminalWelcomeV2(t0) {
       dimColor: true,
       children: [
         "v",
-        "0.1.29",
+        "0.1.31",
         " "
       ]
     }, undefined, true, undefined, this);
@@ -492091,7 +492111,7 @@ Usage: orbit --remote "your task description"`, () => gracefulShutdown(1));
         pendingHookMessages
       }, renderAndRun);
     }
-  }).version("0.1.29 (Orbit AI)", "-v, --version", "Output the version number");
+  }).version("0.1.31 (Orbit AI)", "-v, --version", "Output the version number");
   program2.option("-w, --worktree [name]", "Create a new git worktree for this session (optionally specify a name)");
   program2.option("--tmux", "Create a tmux session for the worktree (requires --worktree). Uses iTerm2 native panes when available; use --tmux=classic for traditional tmux.");
   if (canUserConfigureAdvisor()) {
@@ -492613,7 +492633,7 @@ if (false) {}
 async function main2() {
   const args = process.argv.slice(2);
   if (args.length === 1 && (args[0] === "--version" || args[0] === "-v" || args[0] === "-V")) {
-    console.log(`${"0.1.29"} (Orbit AI)`);
+    console.log(`${"0.1.31"} (Orbit AI)`);
     return;
   }
   if (args.includes("--provider")) {
@@ -492717,4 +492737,4 @@ async function main2() {
 }
 main2();
 
-//# debugId=51295B4C9C2CF04664756E2164756E21
+//# debugId=F405FF23D2DC43EC64756E2164756E21

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "orbit-code-ai",
-  "version": "0.1.29",
+  "version": "0.1.31",
   "description": "Orbit AI – Your AI-powered IBM ACE coding companion",
   "type": "module",
   "author": "moenawaf",