orbit-code-ai 0.1.4 → 0.1.5

package/dist/cli.mjs

@@ -83712,7 +83712,7 @@ function printStartupScreen() {
   const sLen = ` ● ${sL}    Ready — type /help to begin`.length;
   out.push(boxRow(sRow, W2, sLen));
   out.push(`${rgb(...BORDER)}╚${"═".repeat(W2 - 2)}╝${RESET}`);
-  out.push(`  ${DIM}${rgb(...DIMCOL)}orbit-ai ${RESET}${rgb(...ACCENT)}v${"0.1.4"}${RESET}`);
+  out.push(`  ${DIM}${rgb(...DIMCOL)}orbit-ai ${RESET}${rgb(...ACCENT)}v${"0.1.5"}${RESET}`);
   out.push("");
   process.stdout.write(out.join(`
 `) + `
@@ -334183,7 +334183,7 @@ function getAnthropicEnvMetadata() {
 function getBuildAgeMinutes() {
   if (false)
     ;
-  const buildTime = new Date("2026-06-23T07:21:13.640Z").getTime();
+  const buildTime = new Date("2026-06-23T09:09:31.460Z").getTime();
   if (isNaN(buildTime))
     return;
   return Math.floor((Date.now() - buildTime) / 60000);
@@ -358600,7 +358600,7 @@ function buildPrimarySection() {
   }, undefined, false, undefined, this);
   return [{
     label: "Version",
-    value: "0.1.4"
+    value: "0.1.5"
   }, {
     label: "Session name",
     value: nameValue
@@ -470842,7 +470842,7 @@ function WelcomeV2() {
             dimColor: true,
             children: [
               "v",
-              "0.1.4",
+              "0.1.5",
               " "
             ]
           }, undefined, true, undefined, this)
@@ -471042,7 +471042,7 @@ function WelcomeV2() {
           dimColor: true,
           children: [
             "v",
-            "0.1.4",
+            "0.1.5",
             " "
           ]
         }, undefined, true, undefined, this)
@@ -471268,7 +471268,7 @@ function AppleTerminalWelcomeV2(t0) {
         dimColor: true,
         children: [
           "v",
-          "0.1.4",
+          "0.1.5",
           " "
         ]
       }, undefined, true, undefined, this);
@@ -471522,7 +471522,7 @@ function AppleTerminalWelcomeV2(t0) {
       dimColor: true,
       children: [
         "v",
-        "0.1.4",
+        "0.1.5",
         " "
       ]
     }, undefined, true, undefined, this);
@@ -492076,7 +492076,7 @@ Usage: orbitcode --remote "your task description"`, () => gracefulShutdown(1));
         pendingHookMessages
       }, renderAndRun);
     }
-  }).version("0.1.4 (Orbit AI)", "-v, --version", "Output the version number");
+  }).version("0.1.5 (Orbit AI)", "-v, --version", "Output the version number");
   program2.option("-w, --worktree [name]", "Create a new git worktree for this session (optionally specify a name)");
   program2.option("--tmux", "Create a tmux session for the worktree (requires --worktree). Uses iTerm2 native panes when available; use --tmux=classic for traditional tmux.");
   if (canUserConfigureAdvisor()) {
@@ -492598,7 +492598,7 @@ if (false) {}
 async function main2() {
   const args = process.argv.slice(2);
   if (args.length === 1 && (args[0] === "--version" || args[0] === "-v" || args[0] === "-V")) {
-    console.log(`${"0.1.4"} (Orbit AI)`);
+    console.log(`${"0.1.5"} (Orbit AI)`);
     return;
   }
   if (args.includes("--provider")) {
@@ -492702,4 +492702,4 @@ async function main2() {
 }
 main2();
 
-//# debugId=6D27063EF650359964756E2164756E21
+//# debugId=DE134726E7DCEFCE64756E2164756E21

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "orbit-code-ai",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "description": "Orbit AI – Your AI-powered IBM ACE coding companion",
   "type": "module",
   "author": "moenawaf",

package/skills/apic-api/SKILL.md

@@ -20,7 +20,10 @@ Flags:
                         they want before generating. Orbit does not assume a version.
   --crypto <name>       jws-crypto object for JWT validation (default: <appsegment>-crypto-object)
   --backend-auth <name> APIC variable injected as backend auth header (e.g. servicenow-auth)
-  --no-jwt              omit jwt-validate + Check Expiration + 400 throw (no token enforcement)
+  --jwt                 force JWT on (skip the prompt); --no-jwt forces it off. If neither is
+                        given, ASK the user whether JWT validation is required (see Clarify step).
+  --no-jwt              omit jwt-validate + Check Expiration + 400 throw + ExpiredToken catch
+                        (no token enforcement)
   --no-logging          omit the middleware UpsertMDLogQ logging invoke (AmerApp-style)
   --no-envelope         return the raw backend body instead of the {Header,Body} ESB envelope
   --no-cors             disable CORS
@@ -90,10 +93,14 @@ in a single batched follow-up** (alongside the 2.0/3.0 question). Do NOT invent
 values for these:
 
 - **OpenAPI version** — 2.0 or 3.0 (always ask if unspecified).
+- **JWT validation** — **ASK whether this API requires JWT validation** unless `--jwt`/`--no-jwt`
+  was passed or the prompt clearly states it. JWT is NOT assumed on. If **yes**, include the JWT
+  policies and ask for the crypto object (below). If **no**, omit JWT entirely (see the
+  "No-JWT shape" section) and do not ask for a crypto object.
 - **Channel / app + basePath** — e.g. `/v1/AmerApp`. The app segment also drives naming. There is
   no way to infer this from the operation name; ask (offer the known channels if helpful).
 - **JWT crypto object** — e.g. `$(amerapp-crypto-object)`. Tied to the channel, not the operation.
-  Only needed when JWT is enabled (default). Ask; do not derive it from the API name.
+  **Only ask this when JWT is enabled.** Do not derive it from the API name.
 - **Backend auth** — the APIC variable and the header it goes on (`Authorization` vs `Token`), if
   the backend needs auth. Ask only if the prompt implies the backend is protected.
 
@@ -109,6 +116,9 @@ never a guess that looks real.
    apply the 3.0 transform section.
 2. **The `x-ibm-configuration.assembly` block is identical in 2.0 and 3.0.** Only the *contract*
    (paths/definitions/security/schemes) changes between versions.
+2b. **JWT is optional and not assumed.** Decide JWT on/off from `--jwt`/`--no-jwt`, an explicit
+   statement in the prompt, or the clarify answer. With JWT **off**, build the simpler "No-JWT shape"
+   (no jwt-validate, no Check Expiration, no switch, no ExpiredToken catch) — see that section.
 3. **Paste the frozen gatewayscript verbatim.** The JS strings below must be byte-exact — DataPower
    rejects malformed assembly. Do not "clean up" or reformat them.
 4. **GET vs POST**: GET → query/header params, no request `map`, no `definitions`. POST with body
@@ -206,7 +216,8 @@ x-ibm-configuration:
           target-url: >-
             $(sakani-mw-base-url)/MW/MWLogServices/GeneralLog/UpsertMDLogQ?Environment=$(env.path)&ServiceName=$(api.name)&UserName=$(client.app.id)&RequestDt=$(system.datetime)
 
-      # ── FROZEN: JWT — OMIT jwt-validate + Check Expiration if --no-jwt (then switch goes always-200) ──
+      # ── JWT (only when JWT is enabled). If JWT is OFF, omit jwt-validate + Check Expiration AND
+      #    drop the switch below — run the backend call directly. See "No-JWT shape". ──
       - jwt-validate:
           version: 2.0.0
           title: jwt-validate
@@ -406,6 +417,83 @@ basePath: {basePath}
 
 ---
 
+## No-JWT shape (when JWT validation is OFF)
+
+When the API does **not** require JWT, generate a simpler assembly: there's no token to validate, so
+there's no `jwt-validate`, no `Check Expiration`, no `switch`, and no `ExpiredToken` — the backend
+call runs directly, and the `catch` keeps only the `default` handler.
+
+`x-ibm-configuration.assembly.execute` becomes (everything else — `info`, `cors`, `properties`,
+`activity-log`, `paths`, `securityDefinitions`, `security`, `schemes`, `basePath` — is unchanged):
+
+```yaml
+    execute:
+      # POST-with-body only: leading parse (as in the main skeleton)
+      - gatewayscript:
+          version: 2.0.0
+          title: Prepare Request
+          source: "<<< the FROZEN Prepare Request source, verbatim >>>"
+
+      # Middleware logging — include unless --no-logging (same as main skeleton)
+      - set-variable: { version: 2.0.0, title: Log-set-variable, actions: [ { set: message.headers.Authorization, value: $(nhc-mw-auth), type: string } ] }
+      - invoke:    # ...the Log-invoke (UpsertMDLogQ) policy, verbatim...
+
+      # Backend auth + static headers (only if --backend-auth / --backend-headers given)
+      - set-variable: { version: 2.0.0, title: set-variable, actions: [ { set: message.headers.{backend-auth-header}, value: $({backend-auth-var}), type: string } ] }
+
+      # POST-with-body only: request map (see "POST request map")
+
+      # ── Backend call — run directly, NOT wrapped in a switch ──
+      - invoke:
+          version: 2.2.0          # or 2.3.0 / detect / keep per the backend
+          title: invoke
+          backend-type: json
+          header-control:   { type: blocklist, values: [] }
+          parameter-control: { type: allowlist, values: [] }   # MUST list backend query params ({query})
+          timeout: 60
+          verb: {verb}
+          http-version: HTTP/1.1
+          chunked-uploads: true
+          persistent-connection: true
+          cache-response: protocol
+          cache-ttl: 900
+          websocket-upgrade: false
+          target-url: >-
+            {backend-target-url}
+      - parse:
+          version: 2.2.0
+          title: parse
+          parse-settings-reference:
+            parse-settings:
+              document_type: json
+
+      # Prepare Response Header — include unless --no-envelope (FROZEN source, verbatim)
+      - gatewayscript:
+          version: 2.0.0
+          title: Prepare Response Header
+          source: "<<< the FROZEN Prepare Response Header source, verbatim >>>"
+
+      - log: { version: 2.1.0, title: log, log-level: default, mode: gather-and-send }
+    finally: []
+    catch:
+      - default:
+          - gatewayscript:
+              version: 2.0.0
+              title: DeFaultCatch
+              source: |2-
+                    # <<< the FROZEN DeFaultCatch source, verbatim >>>
+```
+
+Notes for the No-JWT shape:
+- Drop the `authorization` header param from `paths` (no bearer token is expected) unless the prompt
+  says otherwise.
+- Keep `securityDefinitions`/`security` (the `X-IBM-Client-Id`/`X-IBM-Client-Secret` API-key gate is
+  independent of JWT).
+- Everything else (logging, envelope, CORS, query/header params, POST map) follows the same flags as
+  the main skeleton.
+
+---
+
 ## POST request map (only when body fields are given)
 
 Insert this `map` **inside the 200 case, before the backend `invoke`**, and add the matching