orbit-code-ai 0.1.4 → 0.1.6

package/dist/cli.mjs

@@ -83712,7 +83712,7 @@ function printStartupScreen() {
   const sLen = ` ● ${sL}    Ready — type /help to begin`.length;
   out.push(boxRow(sRow, W2, sLen));
   out.push(`${rgb(...BORDER)}╚${"═".repeat(W2 - 2)}╝${RESET}`);
-  out.push(`  ${DIM}${rgb(...DIMCOL)}orbit-ai ${RESET}${rgb(...ACCENT)}v${"0.1.4"}${RESET}`);
+  out.push(`  ${DIM}${rgb(...DIMCOL)}orbit-ai ${RESET}${rgb(...ACCENT)}v${"0.1.6"}${RESET}`);
   out.push("");
   process.stdout.write(out.join(`
 `) + `
@@ -334183,7 +334183,7 @@ function getAnthropicEnvMetadata() {
 function getBuildAgeMinutes() {
   if (false)
     ;
-  const buildTime = new Date("2026-06-23T07:21:13.640Z").getTime();
+  const buildTime = new Date("2026-06-23T11:43:54.224Z").getTime();
   if (isNaN(buildTime))
     return;
   return Math.floor((Date.now() - buildTime) / 60000);
@@ -358600,7 +358600,7 @@ function buildPrimarySection() {
   }, undefined, false, undefined, this);
   return [{
     label: "Version",
-    value: "0.1.4"
+    value: "0.1.6"
   }, {
     label: "Session name",
     value: nameValue
@@ -470842,7 +470842,7 @@ function WelcomeV2() {
             dimColor: true,
             children: [
               "v",
-              "0.1.4",
+              "0.1.6",
               " "
             ]
           }, undefined, true, undefined, this)
@@ -471042,7 +471042,7 @@ function WelcomeV2() {
           dimColor: true,
           children: [
             "v",
-            "0.1.4",
+            "0.1.6",
             " "
           ]
         }, undefined, true, undefined, this)
@@ -471268,7 +471268,7 @@ function AppleTerminalWelcomeV2(t0) {
         dimColor: true,
         children: [
           "v",
-          "0.1.4",
+          "0.1.6",
           " "
         ]
       }, undefined, true, undefined, this);
@@ -471522,7 +471522,7 @@ function AppleTerminalWelcomeV2(t0) {
       dimColor: true,
       children: [
         "v",
-        "0.1.4",
+        "0.1.6",
         " "
       ]
     }, undefined, true, undefined, this);
@@ -474944,39 +474944,57 @@ ${args || "Review the entire ACE project in the current working directory only.
   });
   registerBundledSkill({
     name: "ace-explain",
-    description: "Explain an IBM ACE flow or ESQL module in plain language — what it does, how it works, its role in the integration flow",
+    description: "Explain an IBM ACE flow, ESQL module, OR an entire application/service in plain language — what it does, how it works, and its role in the integration. Reads ALL artifacts (msgflows, ESQL, XSD, Swagger) before explaining, never just the Swagger.",
     aliases: ["ace-doc"],
-    model: "gemini-3.1-flash-lite",
-    whenToUse: "When the user wants to understand what an ACE flow or ESQL module does, needs documentation, or wants an end-to-end walkthrough",
-    argumentHint: "<file to explain>",
-    allowedTools: ["Read", "Glob", "Grep"],
+    model: "gemini-3.5-flash",
+    whenToUse: 'When the user wants to understand, summarize, document, or walk through what an ACE flow, ESQL module, application, service, or project does — including requests like "what does this app do" or "explain this service"',
+    argumentHint: "<file, app folder, or service to explain>",
+    allowedTools: ["Read", "Glob", "Grep", "Bash"],
     userInvocable: true,
     async getPromptForCommand(args) {
       const prompt = `# ACE Code Explanation
 
 ${readInstructions([
-        "components/common-utils.md"
+        "components/common-utils.md",
+        "msgflow-xml-reference.md"
       ])}
 
-Read the relevant file(s) and explain the code clearly to a developer who is unfamiliar with it. Use the common-utils reference to identify framework function calls and constants. Cover its role in the overall integration flow.
+You must explain the target to a developer unfamiliar with it. The target may be a single
+file OR an entire application/service folder.
+
+## MANDATORY procedure — do this before writing ANY explanation
+
+1. **Enumerate every file** in the target. If it is a folder, list the whole tree
+   (e.g. \`Glob\` with \`**/*\` under the target, or \`ls -R\`). Do not assume the file set.
+2. **Read EVERY artifact** — every \`.msgflow\`, \`.esql\`, \`.xsd\`, \`.json\`/Swagger,
+   \`.subflow\`, \`.descriptor\`, and \`.properties\` file. Read them in full, not just one.
+3. Only AFTER you have read all of them, write the explanation.
+
+⚠️ **The Swagger/JSON is NOT enough.** It only describes the request/response *contract* —
+it tells you nothing about what the service actually does. The real behavior lives in the
+**\`.msgflow\`** files (node wiring, routing, which subflows run) and the **\`.esql\`** files
+(the transformation and business logic). An explanation derived only from the \`.json\` is
+incomplete and wrong. If you have not read the msgflows and ESQL, you have not done the task.
+Use the msgflow XML reference above to decode the \`.msgflow\` node/connection structure.
 
 ## What to Cover
 
-1. **Purpose:** What does this flow/module do in one sentence?
-2. **End-to-end walkthrough:** Trace the message path from input to output, including all nodes and connections
+1. **Purpose:** What does this app/flow/module do, in one sentence?
+2. **End-to-end walkthrough:** Trace the message path from input to output across the flows —
+   every node, subflow, and connection (read from the .msgflow files, not inferred).
 3. **Message domains:** What parser domains are used (XMLNSC, JSON, SOAP, etc.)?
-4. **Key transformations:** What does the ESQL do to the message tree? What fields are mapped?
-5. **Error handling:** How are errors caught and routed? Which terminals are wired to error handlers?
-6. **External dependencies:** Database calls (stored procedures), SOAP/REST backend calls, queue names
-7. **Framework usage:** Which Qiwa framework subflows are used and why?
-8. **State management:** How is Environment.Variables used for intermediate state?
-9. **Non-obvious design decisions:** Anything a new developer might find confusing
+4. **Key transformations:** What the ESQL does to the message tree; which fields are mapped.
+5. **Error handling:** How errors are caught and routed; which terminals wire to error handlers.
+6. **External dependencies:** DB calls (stored procedures), SOAP/REST backends, queue names.
+7. **Framework usage:** Which Qiwa framework subflows are used and why.
+8. **State management:** How Environment.Variables carries intermediate state.
+9. **Non-obvious design decisions:** Anything a new developer might find confusing.
 
-Use plain language. Assume the reader knows basic integration concepts but not this specific service.
+Use plain language. Assume the reader knows basic integration concepts but not this service.
 
 ## Target
 
-${args || "The user did not specify a file. Ask them which flow or ESQL module they want explained, or offer to give an overview of the entire project."}`;
+${args || "The user did not specify a target. Ask which file, application folder, or service they want explained."}`;
       return [{ type: "text", text: prompt }];
     }
   });
@@ -492076,7 +492094,7 @@ Usage: orbitcode --remote "your task description"`, () => gracefulShutdown(1));
         pendingHookMessages
       }, renderAndRun);
     }
-  }).version("0.1.4 (Orbit AI)", "-v, --version", "Output the version number");
+  }).version("0.1.6 (Orbit AI)", "-v, --version", "Output the version number");
   program2.option("-w, --worktree [name]", "Create a new git worktree for this session (optionally specify a name)");
   program2.option("--tmux", "Create a tmux session for the worktree (requires --worktree). Uses iTerm2 native panes when available; use --tmux=classic for traditional tmux.");
   if (canUserConfigureAdvisor()) {
@@ -492598,7 +492616,7 @@ if (false) {}
 async function main2() {
   const args = process.argv.slice(2);
   if (args.length === 1 && (args[0] === "--version" || args[0] === "-v" || args[0] === "-V")) {
-    console.log(`${"0.1.4"} (Orbit AI)`);
+    console.log(`${"0.1.6"} (Orbit AI)`);
     return;
   }
   if (args.includes("--provider")) {
@@ -492702,4 +492720,4 @@ async function main2() {
 }
 main2();
 
-//# debugId=6D27063EF650359964756E2164756E21
+//# debugId=412536CBF4AF9C5064756E2164756E21

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "orbit-code-ai",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "description": "Orbit AI – Your AI-powered IBM ACE coding companion",
   "type": "module",
   "author": "moenawaf",

package/skills/apic-api/SKILL.md

@@ -20,7 +20,10 @@ Flags:
                         they want before generating. Orbit does not assume a version.
   --crypto <name>       jws-crypto object for JWT validation (default: <appsegment>-crypto-object)
   --backend-auth <name> APIC variable injected as backend auth header (e.g. servicenow-auth)
-  --no-jwt              omit jwt-validate + Check Expiration + 400 throw (no token enforcement)
+  --jwt                 force JWT on (skip the prompt); --no-jwt forces it off. If neither is
+                        given, ASK the user whether JWT validation is required (see Clarify step).
+  --no-jwt              omit jwt-validate + Check Expiration + 400 throw + ExpiredToken catch
+                        (no token enforcement)
   --no-logging          omit the middleware UpsertMDLogQ logging invoke (AmerApp-style)
   --no-envelope         return the raw backend body instead of the {Header,Body} ESB envelope
   --no-cors             disable CORS
@@ -90,10 +93,14 @@ in a single batched follow-up** (alongside the 2.0/3.0 question). Do NOT invent
 values for these:
 
 - **OpenAPI version** — 2.0 or 3.0 (always ask if unspecified).
+- **JWT validation** — **ASK whether this API requires JWT validation** unless `--jwt`/`--no-jwt`
+  was passed or the prompt clearly states it. JWT is NOT assumed on. If **yes**, include the JWT
+  policies and ask for the crypto object (below). If **no**, omit JWT entirely (see the
+  "No-JWT shape" section) and do not ask for a crypto object.
 - **Channel / app + basePath** — e.g. `/v1/AmerApp`. The app segment also drives naming. There is
   no way to infer this from the operation name; ask (offer the known channels if helpful).
 - **JWT crypto object** — e.g. `$(amerapp-crypto-object)`. Tied to the channel, not the operation.
-  Only needed when JWT is enabled (default). Ask; do not derive it from the API name.
+  **Only ask this when JWT is enabled.** Do not derive it from the API name.
 - **Backend auth** — the APIC variable and the header it goes on (`Authorization` vs `Token`), if
   the backend needs auth. Ask only if the prompt implies the backend is protected.
 
@@ -109,6 +116,9 @@ never a guess that looks real.
    apply the 3.0 transform section.
 2. **The `x-ibm-configuration.assembly` block is identical in 2.0 and 3.0.** Only the *contract*
    (paths/definitions/security/schemes) changes between versions.
+2b. **JWT is optional and not assumed.** Decide JWT on/off from `--jwt`/`--no-jwt`, an explicit
+   statement in the prompt, or the clarify answer. With JWT **off**, build the simpler "No-JWT shape"
+   (no jwt-validate, no Check Expiration, no switch, no ExpiredToken catch) — see that section.
 3. **Paste the frozen gatewayscript verbatim.** The JS strings below must be byte-exact — DataPower
    rejects malformed assembly. Do not "clean up" or reformat them.
 4. **GET vs POST**: GET → query/header params, no request `map`, no `definitions`. POST with body
@@ -206,7 +216,8 @@ x-ibm-configuration:
           target-url: >-
             $(sakani-mw-base-url)/MW/MWLogServices/GeneralLog/UpsertMDLogQ?Environment=$(env.path)&ServiceName=$(api.name)&UserName=$(client.app.id)&RequestDt=$(system.datetime)
 
-      # ── FROZEN: JWT — OMIT jwt-validate + Check Expiration if --no-jwt (then switch goes always-200) ──
+      # ── JWT (only when JWT is enabled). If JWT is OFF, omit jwt-validate + Check Expiration AND
+      #    drop the switch below — run the backend call directly. See "No-JWT shape". ──
       - jwt-validate:
           version: 2.0.0
           title: jwt-validate
@@ -406,6 +417,83 @@ basePath: {basePath}
 
 ---
 
+## No-JWT shape (when JWT validation is OFF)
+
+When the API does **not** require JWT, generate a simpler assembly: there's no token to validate, so
+there's no `jwt-validate`, no `Check Expiration`, no `switch`, and no `ExpiredToken` — the backend
+call runs directly, and the `catch` keeps only the `default` handler.
+
+`x-ibm-configuration.assembly.execute` becomes (everything else — `info`, `cors`, `properties`,
+`activity-log`, `paths`, `securityDefinitions`, `security`, `schemes`, `basePath` — is unchanged):
+
+```yaml
+    execute:
+      # POST-with-body only: leading parse (as in the main skeleton)
+      - gatewayscript:
+          version: 2.0.0
+          title: Prepare Request
+          source: "<<< the FROZEN Prepare Request source, verbatim >>>"
+
+      # Middleware logging — include unless --no-logging (same as main skeleton)
+      - set-variable: { version: 2.0.0, title: Log-set-variable, actions: [ { set: message.headers.Authorization, value: $(nhc-mw-auth), type: string } ] }
+      - invoke:    # ...the Log-invoke (UpsertMDLogQ) policy, verbatim...
+
+      # Backend auth + static headers (only if --backend-auth / --backend-headers given)
+      - set-variable: { version: 2.0.0, title: set-variable, actions: [ { set: message.headers.{backend-auth-header}, value: $({backend-auth-var}), type: string } ] }
+
+      # POST-with-body only: request map (see "POST request map")
+
+      # ── Backend call — run directly, NOT wrapped in a switch ──
+      - invoke:
+          version: 2.2.0          # or 2.3.0 / detect / keep per the backend
+          title: invoke
+          backend-type: json
+          header-control:   { type: blocklist, values: [] }
+          parameter-control: { type: allowlist, values: [] }   # MUST list backend query params ({query})
+          timeout: 60
+          verb: {verb}
+          http-version: HTTP/1.1
+          chunked-uploads: true
+          persistent-connection: true
+          cache-response: protocol
+          cache-ttl: 900
+          websocket-upgrade: false
+          target-url: >-
+            {backend-target-url}
+      - parse:
+          version: 2.2.0
+          title: parse
+          parse-settings-reference:
+            parse-settings:
+              document_type: json
+
+      # Prepare Response Header — include unless --no-envelope (FROZEN source, verbatim)
+      - gatewayscript:
+          version: 2.0.0
+          title: Prepare Response Header
+          source: "<<< the FROZEN Prepare Response Header source, verbatim >>>"
+
+      - log: { version: 2.1.0, title: log, log-level: default, mode: gather-and-send }
+    finally: []
+    catch:
+      - default:
+          - gatewayscript:
+              version: 2.0.0
+              title: DeFaultCatch
+              source: |2-
+                    # <<< the FROZEN DeFaultCatch source, verbatim >>>
+```
+
+Notes for the No-JWT shape:
+- Drop the `authorization` header param from `paths` (no bearer token is expected) unless the prompt
+  says otherwise.
+- Keep `securityDefinitions`/`security` (the `X-IBM-Client-Id`/`X-IBM-Client-Secret` API-key gate is
+  independent of JWT).
+- Everything else (logging, envelope, CORS, query/header params, POST map) follows the same flags as
+  the main skeleton.
+
+---
+
 ## POST request map (only when body fields are given)
 
 Insert this `map` **inside the 200 case, before the backend `invoke`**, and add the matching