orbit-code-ai 0.1.33 → 0.1.35

package/dist/cli.mjs

@@ -83759,7 +83759,7 @@ async function printStartupScreen() {
   const sLen = ` ● ${sL}    Ready — type /help to begin`.length;
   out.push(boxRow(sRow, W2, sLen));
   out.push(`${rgb(...BORDER)}╚${"═".repeat(W2 - 2)}╝${RESET}`);
-  out.push(`  ${DIM}${rgb(...DIMCOL)}orbit-code ${RESET}${rgb(...ACCENT)}v${"0.1.33"}${RESET}`);
+  out.push(`  ${DIM}${rgb(...DIMCOL)}orbit-code ${RESET}${rgb(...ACCENT)}v${"0.1.35"}${RESET}`);
   out.push("");
   process.stdout.write(out.join(`
 `) + `
@@ -334266,7 +334266,7 @@ function getAnthropicEnvMetadata() {
 function getBuildAgeMinutes() {
   if (false)
     ;
-  const buildTime = new Date("2026-07-01T08:00:15.087Z").getTime();
+  const buildTime = new Date("2026-07-01T09:45:32.083Z").getTime();
   if (isNaN(buildTime))
     return;
   return Math.floor((Date.now() - buildTime) / 60000);
@@ -358683,7 +358683,7 @@ function buildPrimarySection() {
   }, undefined, false, undefined, this);
   return [{
     label: "Version",
-    value: "0.1.33"
+    value: "0.1.35"
   }, {
     label: "Session name",
     value: nameValue
@@ -470794,7 +470794,7 @@ function WelcomeV2() {
             dimColor: true,
             children: [
               "v",
-              "0.1.33",
+              "0.1.35",
               " "
             ]
           }, undefined, true, undefined, this)
@@ -470994,7 +470994,7 @@ function WelcomeV2() {
           dimColor: true,
           children: [
             "v",
-            "0.1.33",
+            "0.1.35",
             " "
           ]
         }, undefined, true, undefined, this)
@@ -471220,7 +471220,7 @@ function AppleTerminalWelcomeV2(t0) {
         dimColor: true,
         children: [
           "v",
-          "0.1.33",
+          "0.1.35",
           " "
         ]
       }, undefined, true, undefined, this);
@@ -471474,7 +471474,7 @@ function AppleTerminalWelcomeV2(t0) {
       dimColor: true,
       children: [
         "v",
-        "0.1.33",
+        "0.1.35",
         " "
       ]
     }, undefined, true, undefined, this);
@@ -509921,9 +509921,39 @@ async function testConnection(conn) {
   await runQuery(conn, "SELECT 1 AS ok");
   return true;
 }
-var import_tedious;
+function assertReadOnlySelect(sql) {
+  const cleaned = sql.trim().replace(/;\s*$/, "").trim();
+  if (!cleaned)
+    throw new ReadOnlyGuardError("Empty query.");
+  if (cleaned.includes(";"))
+    throw new ReadOnlyGuardError('Only a single statement is allowed (no ";" chaining).');
+  if (cleaned.includes("--") || cleaned.includes("/*"))
+    throw new ReadOnlyGuardError("Comments are not allowed in the query.");
+  if (!/^(with|select)\b/i.test(cleaned))
+    throw new ReadOnlyGuardError("Query must start with SELECT (or WITH … SELECT).");
+  const banned = cleaned.match(FORBIDDEN_TOKENS);
+  if (banned)
+    throw new ReadOnlyGuardError(`Query contains a disallowed keyword: "${banned[0]}". Only read-only SELECTs are permitted.`);
+  return cleaned;
+}
+async function runReadOnlySelect(conn, sql, maxRows = READONLY_ROW_CAP) {
+  const gated = assertReadOnlySelect(sql);
+  const cap = Math.max(1, Math.min(maxRows, READONLY_ROW_CAP));
+  const batch = `SET ROWCOUNT ${cap};
+${gated};
+SET ROWCOUNT 0;`;
+  return runQuery(conn, batch);
+}
+var import_tedious, READONLY_ROW_CAP = 50, FORBIDDEN_TOKENS, ReadOnlyGuardError;
 var init_mssqlClient = __esm(() => {
   import_tedious = __toESM(require_tedious(), 1);
+  FORBIDDEN_TOKENS = /\b(insert|update|delete|merge|drop|alter|truncate|create|exec|execute|grant|revoke|into|waitfor|shutdown|reconfigure|backup|restore|openrowset|openquery|opendatasource|bulk|sp_[a-z0-9_]+|xp_[a-z0-9_]+)\b/i;
+  ReadOnlyGuardError = class ReadOnlyGuardError extends Error {
+    constructor(message) {
+      super(message);
+      this.name = "ReadOnlyGuardError";
+    }
+  };
 });
 
 // src/utils/sql/spMetadata.ts
@@ -510205,6 +510235,73 @@ How to judge matches (ESQL LANGUAGE DATABASE rules):
 - REAL mismatches are: parameter COUNT, ORDER, direction (IN/OUT), type incompatibility, and \`DYNAMIC RESULT SETS <n>\` not matching the actual result-set count above (e.g. declaring RESULT SETS 1 when the DB proc returns none — this breaks any code reading the result set).
 Report concrete functional mismatches with file:line, or confirm it matches.${GROUND}`;
 }
+function renderCell(v) {
+  if (v === null || v === undefined)
+    return "NULL";
+  if (v instanceof Date)
+    return v.toISOString();
+  if (typeof v === "object" && v !== null && "length" in v)
+    return `0x${Buffer.from(v).toString("hex")}`;
+  return String(v);
+}
+async function runQueryCmd(conn, sql) {
+  let rows;
+  try {
+    rows = await runReadOnlySelect(conn, sql);
+  } catch (e2) {
+    if (e2 instanceof ReadOnlyGuardError)
+      return `Query rejected by the read-only gate: ${e2.message}
+
+Rewrite it as a single SELECT (or WITH … SELECT) with no other statements.`;
+    return `Query failed: ${e2.message}. This is the real database error — report it; do not invent rows.`;
+  }
+  if (rows.length === 0)
+    return `The SELECT returned NO rows. This is a real result — it means no row in the database matches those conditions. Do NOT fabricate values; tell the user no matching data exists (for an "error/not-found" case this may be exactly what you want).`;
+  const cols = Object.keys(rows[0]);
+  const lines = rows.map((r, i3) => `${i3 + 1}. ${cols.map((c6) => `${c6}=${renderCell(r[c6])}`).join(", ")}`).join(`
+`);
+  return `Real rows from the live database (${rows.length}, capped at ${READONLY_ROW_CAP}):
+${lines}
+
+These are ACTUAL values from the database. Use them exactly as returned — never alter, round, or invent field values. State only what appears above; if a value is not shown, say it is not shown.`;
+}
+async function runTestData(conn, schema, name, caseHint) {
+  const def2 = await getProcedureDefinition(conn, schema, name);
+  if (!def2) {
+    return `Could not read the source of ${schema}.${name} (missing or WITH ENCRYPTION). Without the real T-SQL I cannot know which tables/columns to sample. Ask the user for the correct procedure name (try /sql procs) — do NOT guess test data.`;
+  }
+  const sp = await describeProcedure(conn, schema, name);
+  const params = sp.params.map((p) => `  - ${p.isOutput ? "OUT" : "IN "} @${p.name} : ${p.dataType}${p.maxLength ? `(${p.maxLength})` : ""}`).join(`
+`) || "  (no parameters)";
+  const MAX = 24000;
+  const body = def2.length > MAX ? `${def2.slice(0, MAX)}
+-- …[truncated]…` : def2;
+  const wanted = caseHint || "happy";
+  return `Goal: produce REAL, runnable test-data for a "${wanted}" case, expressed as the application's input body.
+
+Ground truth for ${schema}.${name} (live database):
+
+Parameters (these are what the SP consumes — trace each back to a request-body field):
+${params}
+
+Actual T-SQL source:
+\`\`\`sql
+${body}
+\`\`\`
+
+Do this, in order:
+1. From the T-SQL above, identify the driving table(s) and the WHERE/branch conditions the input parameters flow into. For a "${wanted}" case:
+   - happy    → conditions that make the SP's main/success path return a row.
+   - error/not-found → a key that does NOT exist, or values that hit the SP's empty-result / validation branch.
+   - boundary → real extremes (e.g. longest value, min/max, nullable edges) drawn from the actual data.
+2. Write ONE read-only SELECT that pulls a REAL row supplying the parameter values for that case (e.g. \`SELECT TOP 1 <param-columns> FROM <table> WHERE <branch conditions>\`). It MUST be a single SELECT/CTE — no other statements.
+3. Run it by invoking the /sql skill with:  query <your SELECT>
+   (This executes it against the live DB through the read-only gate and returns the actual rows.)
+4. Take the returned real values and map each SP parameter back to its request-body field by reading this project's ESQL (Grep the working directory for "${name}" to find the CALL and the field-to-parameter mapping) and the app's XSD (the input body field names).
+5. Return the finished input body (XML matching the app's request schema) with the concrete real values filled in, and show the exact SELECT you ran so the developer can see where each value came from.
+
+Data-handling notice (state this once to the user): these values are REAL data pulled from the connected database and may include personal/production data. Return them as-is; do not fabricate or substitute values. If the SELECT returns no rows, say so plainly — for a happy case it means no qualifying data exists; do not invent a row.`;
+}
 async function handle(args) {
   const trimmed = args.trim();
   if (!trimmed)
@@ -510299,6 +510396,24 @@ Do NOT attempt to answer database questions — you have no connection or data.`
       return `Failed to verify ${restStr}: ${e2.message}`;
     }
   }
+  if (firstTok === "query") {
+    if (!restStr)
+      return "Usage: /sql query <SELECT …>";
+    return await runQueryCmd(conn, restStr);
+  }
+  if (firstTok === "testdata" || firstTok === "test-data") {
+    if (!restStr)
+      return "Usage: /sql testdata <schema.proc|AppName> [happy|error|boundary] [notes]";
+    const tokens = restStr.split(/\s+/);
+    const target = extractProcName(restStr) ?? tokens[0];
+    const { schema: schema2, name: name2 } = splitProc(target);
+    const caseHint = restStr.match(/\b(happy|error|not[- ]?found|boundary|edge)\b/i)?.[1] ?? "";
+    try {
+      return await runTestData(conn, schema2, name2, caseHint.toLowerCase());
+    } catch (e2) {
+      return `Failed to prepare test data for ${schema2}.${name2}: ${e2.message}`;
+    }
+  }
   const intent = inferIntent(trimmed);
   if (intent === "list" && !extractProcName(trimmed)) {
     try {
@@ -510327,9 +510442,9 @@ Do NOT attempt to answer database questions — you have no connection or data.`
 function registerSqlSkill() {
   registerBundledSkill({
     name: "sql",
-    description: "Connect to a SQL Server database (read-only) to list/describe stored procedures, generate the ESQL SP call, or verify how an ACE app calls an SP — all from live DB metadata.",
-    whenToUse: "When the user asks about the SQL database, stored procedures (their inputs/outputs), wants an ESQL stored-procedure CALL generated from the DB, or wants to verify SP parameters used inside an ACE application.",
-    argumentHint: "connect|status|procs|describe|gen|verify … (or plain English)",
+    description: "Connect to a SQL Server database (read-only) to list/describe stored procedures, generate the ESQL SP call, verify how an ACE app calls an SP, or produce real test-data input for an application from live tables — all from live DB metadata and gated read-only SELECTs.",
+    whenToUse: "When the user asks about the SQL database, stored procedures (their inputs/outputs), wants an ESQL stored-procedure CALL generated from the DB, wants to verify SP parameters used inside an ACE application, or wants real test-data (a happy/error/boundary input body) for an application built from actual rows in the database.",
+    argumentHint: "connect|status|procs|describe|gen|verify|testdata|query … (or plain English)",
     userInvocable: true,
     allowedTools: ["Read", "Glob", "Grep"],
     async getPromptForCommand(args) {
@@ -510341,7 +510456,15 @@ function registerSqlSkill() {
     }
   });
 }
-var HELP = `# /sql — SQL Server helper (native connection)
+var HELP, GROUND = `
+
+IMPORTANT: The metadata above is the ONLY database information you have — you cannot query the DB yourself. State only what appears above; never invent, guess, or "fill in" parameters, columns, types, or procedures. If something is not shown, say it is not shown.`, STOPWORDS;
+var init_sql = __esm(() => {
+  init_bundledSkills();
+  init_connectionStore();
+  init_mssqlClient();
+  init_spMetadata();
+  HELP = `# /sql — SQL Server helper (native connection)
 
 Subcommands (also understands plain English, e.g. "/sql details of the SP Get_UserInformation"):
 - \`/sql connect server=HOST database=DB user=USER password=PASS [port=1433] [encrypt=false]\` — save the connection once (OS secure vault; password never written to disk in plaintext).
@@ -510352,15 +510475,10 @@ Subcommands (also understands plain English, e.g. "/sql details of the SP Get_Us
 - \`/sql source <schema.proc>\` — the actual T-SQL body of the procedure (read the real code).
 - \`/sql gen <schema.proc>\` — generate the ESQL PROCEDURE declaration + CALL.
 - \`/sql verify <schema.proc>\` — pull the real SP signature, then check how this project's ESQL calls it.
+- \`/sql testdata <schema.proc|AppName> [happy|error|boundary] [notes]\` — read the SP's real T-SQL, pull a REAL matching row from the database, and return it as the application's input body.
+- \`/sql query <SELECT …>\` — run one read-only SELECT (SELECT/CTE only, capped to ${READONLY_ROW_CAP} rows). Used by /sql testdata to fetch real rows.
 
-Everything is read-only and every answer comes from live DB metadata.`, GROUND = `
-
-IMPORTANT: The metadata above is the ONLY database information you have — you cannot query the DB yourself. State only what appears above; never invent, guess, or "fill in" parameters, columns, types, or procedures. If something is not shown, say it is not shown.`, STOPWORDS;
-var init_sql = __esm(() => {
-  init_bundledSkills();
-  init_connectionStore();
-  init_mssqlClient();
-  init_spMetadata();
+Metadata/verify/gen are read-only catalog lookups. \`testdata\`/\`query\` execute a single gated SELECT against real tables and return ACTUAL data (which may include personal/production data).`;
   STOPWORDS = new Set([
     "sp",
     "the",
@@ -527012,7 +527130,7 @@ Usage: orbit --remote "your task description"`, () => gracefulShutdown(1));
         pendingHookMessages
       }, renderAndRun);
     }
-  }).version("0.1.33 (Orbit AI)", "-v, --version", "Output the version number");
+  }).version("0.1.35 (Orbit AI)", "-v, --version", "Output the version number");
   program2.option("-w, --worktree [name]", "Create a new git worktree for this session (optionally specify a name)");
   program2.option("--tmux", "Create a tmux session for the worktree (requires --worktree). Uses iTerm2 native panes when available; use --tmux=classic for traditional tmux.");
   if (canUserConfigureAdvisor()) {
@@ -527534,7 +527652,7 @@ if (false) {}
 async function main2() {
   const args = process.argv.slice(2);
   if (args.length === 1 && (args[0] === "--version" || args[0] === "-v" || args[0] === "-V")) {
-    console.log(`${"0.1.33"} (Orbit AI)`);
+    console.log(`${"0.1.35"} (Orbit AI)`);
     return;
   }
   if (args.includes("--provider")) {
@@ -527638,4 +527756,4 @@ async function main2() {
 }
 main2();
 
-//# debugId=DE14B935DE0448FB64756E2164756E21
+//# debugId=29BC5C9893E4168464756E2164756E21

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "orbit-code-ai",
-  "version": "0.1.33",
+  "version": "0.1.35",
   "description": "Orbit AI – Your AI-powered IBM ACE coding companion",
   "type": "module",
   "author": "moenawaf",