orbi-cli 0.6.0__tar.gz → 0.6.2__tar.gz

{orbi_cli-0.6.0/src/orbi_cli.egg-info → orbi_cli-0.6.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: orbi-cli
-Version: 0.6.0
+Version: 0.6.2
 Summary: Orbi — local AI development worker: claims GitHub Issues, runs Pi in isolated worktrees, and delivers PRs (GitHub Issues + labels are the only state store).
 Author: xqliu
 License-Expression: AGPL-3.0-only OR LicenseRef-Sustainable-Use-1.0

{orbi_cli-0.6.0 → orbi_cli-0.6.2}/pyproject.toml

@@ -44,7 +44,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "orbi-cli"
-version = "0.6.0"
+version = "0.6.2"
 description = "Orbi — local AI development worker: claims GitHub Issues, runs Pi in isolated worktrees, and delivers PRs (GitHub Issues + labels are the only state store)."
 readme = "README.md"
 requires-python = ">=3.14"

{orbi_cli-0.6.0 → orbi_cli-0.6.2}/src/orbi/__init__.py

@@ -18,4 +18,4 @@ the package would shadow the installed package for every process with
 the checkout root on sys.path. The direct-execution compatibility entry
 is `python3 -m orbi.cli` (development path only).
 """
-__version__ = "0.6.0"
+__version__ = "0.6.2"

{orbi_cli-0.6.0 → orbi_cli-0.6.2}/src/orbi/config.py

@@ -828,25 +828,6 @@ def _pi_provider_api_key_finding(path: Path, provider_id: str,
     return None
 
 
-def _expand_pi_api_key_refs(api_key: str) -> str:
-    """Resolve `$VAR` / `${VAR}` references in an `apiKey`.
-
-    Same reference syntax `_pi_provider_api_key_finding` validates (Pi's
-    `docs/models.md`): every reference whose environment variable is
-    set and non-empty is replaced by the real value; a reference whose
-    variable is missing or empty — only possible for a non-selected
-    provider, the selected one already failed config load otherwise —
-    stays verbatim (that provider stays unavailable in Pi, the exact
-    pre-#303 behavior). The value itself is never logged.
-    """
-    return re.sub(
-        r"\$\{([A-Za-z_][A-Za-z0-9_]*)\}|\$([A-Za-z_][A-Za-z0-9_]*)",
-        lambda match: os.environ.get(match.group(1) or match.group(2))
-        or match.group(0),
-        api_key,
-    )
-
-
 def parse_repositories(entries: object, base: Path) -> list[dict]:
     """Parse the explicit multi-repo registry.
 

{orbi_cli-0.6.0 → orbi_cli-0.6.2}/src/orbi/pi_session.py

@@ -332,16 +332,17 @@ def prepare_pi_agent_dir(worktree: Path, config: config_domain.RunnerConfig,
     exists: stored auth for providers present in the merged catalog is
     still valid.
 
-    `apiKey` env-var references (`$VAR` / `${VAR}`) are resolved into
-    the per-run copy: config load already required the
-    SELECTED provider's references to resolve, so the materialized
-    catalog carries a usable real credential — without it Pi would
-    hold the literal `$VAR` string and the request could never
-    authenticate. References whose variable is missing or empty (only
-    possible for non-selected providers) stay verbatim. The user's
-    provider file and user agent dir are never modified, and the
-    resolved key never reaches the journal, a comment, or a commit:
-    the per-run dir is the gitignored `<worktree>/.orbi/pi-agent/`.
+    `apiKey` env-var references (`$VAR` / `${VAR}`) are copied
+    VERBATIM into the per-run catalog: Pi 1.0 interpolates them from
+    the process environment it inherits at request time (Pi
+    `docs/models.md`: "For an authenticated endpoint, `apiKey` and
+    header values can use `$NAME` or `${NAME}` environment
+    interpolation"), so the plaintext key is never written into the
+    worktree. Config load still requires the SELECTED provider's
+    references to resolve, so an unusable reference fails fast before
+    a run starts. The user's provider file and user agent dir are
+    never modified; the per-run dir is the gitignored
+    `<worktree>/.orbi/pi-agent/`.
     """
     providers_data = config.pi_providers_data
     if providers_data is None:
@@ -366,17 +367,13 @@ def prepare_pi_agent_dir(worktree: Path, config: config_domain.RunnerConfig,
             user_providers = {}
         merged_providers.update(user_providers)
     merged_providers.update(providers_data["providers"])
-    # The per-run copy carries the resolved `apiKey` values
-    # (entries with a string key are copied, so the loaded config data
-    # keeps its literal references).
-    resolved_providers: dict = {}
-    for provider_id, entry in merged_providers.items():
-        api_key = entry.get("apiKey") if isinstance(entry, dict) else None
-        if isinstance(api_key, str) and api_key:
-            entry = {**entry, "apiKey": config_domain._expand_pi_api_key_refs(api_key)}
-        resolved_providers[provider_id] = entry
+    # The per-run catalog is written verbatim: an `apiKey` env-var
+    # reference stays a reference, so no plaintext credential is ever
+    # written into the worktree. Pi 1.0 interpolates `$NAME` /
+    # `${NAME}` from the process environment it inherits at request
+    # time (Pi `docs/models.md`).
     (agent_dir / "models.json").write_text(
-        json.dumps({"providers": resolved_providers}, indent=2),
+        json.dumps({"providers": merged_providers}, indent=2),
         encoding="utf-8",
     )
     # Per-run settings.json: a real file consistent with
@@ -860,7 +857,7 @@ def run_ticket_agent(
             config, ROLE_TICKET, IMPLEMENT_EXCLUDED_SKILLS, session_dir,
             system_prompt, context,
             context_placeholder="<issue-context-redacted>",
-            tools=False, extensions=False,
+            tools=False, extensions=True,
         )
         # Startup phase: the provider config is loaded and resolved
         # before the spawn; a configured provider file is materialized

{orbi_cli-0.6.0 → orbi_cli-0.6.2/src/orbi_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: orbi-cli
-Version: 0.6.0
+Version: 0.6.2
 Summary: Orbi — local AI development worker: claims GitHub Issues, runs Pi in isolated worktrees, and delivers PRs (GitHub Issues + labels are the only state store).
 Author: xqliu
 License-Expression: AGPL-3.0-only OR LicenseRef-Sustainable-Use-1.0

{orbi_cli-0.6.0 → orbi_cli-0.6.2}/tests/test_bootstrap_runner.py

@@ -15010,43 +15010,48 @@ def test_prepare_pi_agent_dir_repo_providers_win_on_collision(
     )
 
 
-def test_prepare_pi_agent_dir_expands_api_key_env_reference(
+def test_prepare_pi_agent_dir_keeps_api_key_env_reference_verbatim(
     tmp_path, monkeypatch,
 ):
-    """The per-run catalog carries the REAL key (Issue #303).
+    """The per-run catalog keeps the literal `$VAR` reference (Issue #1554).
 
-    `_load_pi_providers` validates that the selected provider's
-    `$VAR` reference resolves; the materialized per-run `models.json`
-    must close the validate/use gap and write the resolved value,
-    otherwise the provider has no usable credential and the run
-    cannot authenticate. The loaded config data keeps the literal
-    reference (only the gitignored per-run copy materializes it).
+    Pi 1.0 interpolates `apiKey` from the environment it inherits at
+    request time, so the per-run `models.json` must never carry the
+    plaintext key resolved into a file inside the worktree. Config load
+    still validates that the selected provider's reference resolves.
     """
     home = tmp_path / "home"
     _user_agent_dir(home)
     monkeypatch.setenv("HOME", str(home))
-    monkeypatch.setenv("GROQ_API_KEY", "sk-real-key-value")
-    config = _model_config(
-        tmp_path, pi_providers_data=GROQ_PROVIDERS,
-        pi_provider="groq", pi_model="qwen/qwen3.8-27b",
+    monkeypatch.setenv("ORBI_TEST_KEY", "secret-value")
+    providers = {
+        "providers": {
+            "testprov": {
+                "baseUrl": "http://127.0.0.1:18084/v1",
+                "api": "openai-completions",
+                "apiKey": "$ORBI_TEST_KEY",
+                "models": [{"id": "test-model"}],
+            },
+        }
+    }
+    config_path = _providers_config(
+        tmp_path, providers,
+        pi_provider='"testprov"', pi_model='"test-model"',
     )
+    config = config_domain.load_config(config_path)
     agent_dir = pi_session.prepare_pi_agent_dir(tmp_path, config)
-    merged = json.loads(
-        (agent_dir / "models.json").read_text(encoding="utf-8"),
-    )
-    assert merged["providers"]["groq"]["apiKey"] == "sk-real-key-value"
-    # The loaded provider data (and the user's file behind it) keeps
-    # the env-var reference: only the per-run copy materializes it.
-    assert config.pi_providers_data["providers"]["groq"][
-        "apiKey"
-    ] == "$GROQ_API_KEY"
+    raw = (agent_dir / "models.json").read_text(encoding="utf-8")
+    merged = json.loads(raw)
+    assert merged["providers"]["testprov"]["apiKey"] == "$ORBI_TEST_KEY"
+    assert "secret-value" not in raw
 
 
-def test_prepare_pi_agent_dir_expands_braced_and_embedded_references(
+def test_prepare_pi_agent_dir_keeps_braced_and_embedded_references(
     tmp_path, monkeypatch,
 ):
-    """`${VAR}` and references embedded in larger literals expand too
-    (Pi's documented interpolation syntax, `docs/models.md`)."""
+    """`${VAR}` and references embedded in larger literals stay verbatim
+    too (Pi resolves its documented interpolation syntax at request
+    time, `docs/models.md`)."""
     home = tmp_path / "home"
     _user_agent_dir(home)
     monkeypatch.setenv("HOME", str(home))
@@ -15070,15 +15075,17 @@ def test_prepare_pi_agent_dir_expands_braced_and_embedded_references(
     merged = json.loads(
         (agent_dir / "models.json").read_text(encoding="utf-8"),
     )
-    assert merged["providers"]["local"]["apiKey"] == "alpha_mid_omega"
+    assert merged["providers"]["local"]["apiKey"] == (
+        "${TEST_PREFIX}_mid_$TEST_SUFFIX"
+    )
 
 
-def test_prepare_pi_agent_dir_unresolved_reference_stays_verbatim(
+def test_prepare_pi_agent_dir_keeps_every_reference_verbatim(
     tmp_path, monkeypatch,
 ):
-    """Only the SELECTED provider's key must resolve: an unselected
-    provider whose variable is missing keeps the literal reference and
-    stays unavailable in Pi (the pre-#303 behavior, never an error)."""
+    """Every provider's reference is copied verbatim, selected or not:
+    a variable missing from the environment is resolved (or rejected)
+    by Pi/config load, never materialized here."""
     home = tmp_path / "home"
     _user_agent_dir(home)
     monkeypatch.setenv("HOME", str(home))
@@ -15103,7 +15110,7 @@ def test_prepare_pi_agent_dir_unresolved_reference_stays_verbatim(
     merged = json.loads(
         (agent_dir / "models.json").read_text(encoding="utf-8"),
     )
-    assert merged["providers"]["groq"]["apiKey"] == "sk-real-key-value"
+    assert merged["providers"]["groq"]["apiKey"] == "$GROQ_API_KEY"
     assert merged["providers"]["other"]["apiKey"] == "$MISSING_PROVIDER_KEY"
 
 
@@ -15112,7 +15119,7 @@ def test_prepare_pi_agent_dir_leaves_non_string_api_keys_untouched(
 ):
     """Entries without a string `apiKey` (absent, or a malformed
     non-object entry from the user's own models.json) pass through
-    unchanged — expansion never invents or crashes on them."""
+    unchanged — the verbatim copy never invents or crashes on them."""
     home = tmp_path / "home"
     _user_agent_dir(
         home,
@@ -15134,12 +15141,12 @@ def test_prepare_pi_agent_dir_leaves_non_string_api_keys_untouched(
     assert merged["providers"]["junk"] == "not-an-object"
 
 
-def test_prepare_pi_agent_dir_expands_zai_scene_from_load_config(
+def test_prepare_pi_agent_dir_keeps_zai_scene_reference_from_load_config(
     tmp_path, monkeypatch,
 ):
-    """The Issue #303 scene end to end: a z.ai-shaped provider file
-    (`apiKey: "$ZAI_API_KEY"`) loaded through `load_config` then
-    materialized must carry the real key in the per-run catalog."""
+    """The z.ai-shaped provider file (`apiKey: "$ZAI_API_KEY"`) loaded
+    through `load_config` must reach the per-run catalog verbatim, so
+    the plaintext key is never written into the worktree (Issue #1554)."""
     home = tmp_path / "home"
     _user_agent_dir(home)
     monkeypatch.setenv("HOME", str(home))
@@ -15163,7 +15170,7 @@ def test_prepare_pi_agent_dir_expands_zai_scene_from_load_config(
     merged = json.loads(
         (agent_dir / "models.json").read_text(encoding="utf-8"),
     )
-    assert merged["providers"]["z-ai"]["apiKey"] == "sk-zai-real-key"
+    assert merged["providers"]["z-ai"]["apiKey"] == "$ZAI_API_KEY"
     assert merged["providers"]["z-ai"]["baseUrl"] == (
         "https://api.z.ai/api/paas/v4"
     )
@@ -15708,8 +15715,8 @@ def test_load_config_api_key_from_deploy_env_file_ok(tmp_path, monkeypatch):
     )
     config = config_domain.load_config(config_path)
     assert config.pi_providers_data == GROQ_PROVIDERS
-    # The variable must be visible to the process so the per-run Pi agent
-    # dir expansion (_expand_pi_api_key_refs) resolves it too.
+    # The variable must be visible to the process so Pi can interpolate
+    # the verbatim `$GROQ_API_KEY` reference in the per-run catalog.
     assert os.environ.get("GROQ_API_KEY") == "file-key"
 
 

{orbi_cli-0.6.0 → orbi_cli-0.6.2}/tests/test_docs_i18n.py

@@ -60,7 +60,7 @@ KNOWN_LABELS = frozenset({
     NEEDS_DETAIL_LABEL,
 })
 
-LABEL_PATTERN = re.compile(r"\bai-[a-z][a-z-]*\b")
+LABEL_PATTERN = re.compile(r"(?<![\w-])ai-[a-z][a-z-]*\b")
 
 # Config fields the implementation understands (bootstrap_config_domain.load_config
 # plus the committed example) — the Chinese field table may document

{orbi_cli-0.6.0 → orbi_cli-0.6.2}/tests/test_docs_labels.py

@@ -46,7 +46,17 @@ KNOWN_LABELS = frozenset({
     NEEDS_DETAIL_LABEL,
 })
 
-LABEL_PATTERN = re.compile(r"\bai-[a-z][a-z-]*\b")
+LABEL_PATTERN = re.compile(r"(?<![\w-])ai-[a-z][a-z-]*\b")
+
+
+def test_label_pattern_ignores_hyphenated_names_containing_ai():
+    """Issue #1552: a hyphenated skill name like `write-ai-ready-issue`
+    contains the substring `ai-ready-issue`, which is not a label. Only a
+    standalone `ai-*` token preceded by a non-word/non-hyphen boundary
+    counts."""
+    assert LABEL_PATTERN.findall("the write-ai-ready-issue skill and ai-ready") == [
+        "ai-ready"
+    ]
 
 
 def test_docs_only_reference_existing_labels():

{orbi_cli-0.6.0 → orbi_cli-0.6.2}/tests/test_docs_site.py

@@ -67,7 +67,7 @@ KNOWN_LABELS = frozenset({
     "ai-needs-detail",
 })
 
-LABEL_PATTERN = re.compile(r"\bai-[a-z][a-z-]*\b")
+LABEL_PATTERN = re.compile(r"(?<![\w-])ai-[a-z][a-z-]*\b")
 
 # Config fields the implementation understands (bootstrap_config_domain.load_config
 # plus the committed example). A docs field table may document exactly this

{orbi_cli-0.6.0 → orbi_cli-0.6.2}/tests/test_pi_command.py

@@ -63,17 +63,18 @@ def test_ticket_command_and_log_with_everything_configured():
         pi_command.IMPLEMENT_EXCLUDED_SKILLS, SESSION_DIR,
         SYSTEM_PROMPT, CONTEXT,
         context_placeholder="<issue-context-redacted>",
-        tools=False, extensions=False,
+        tools=False, extensions=True,
     )
     assert command == [
-        "pi", "--no-tools", *IMPLEMENT_SKILL_ARGS,
+        "pi", "--no-tools", *EXTENSION_ARGS, *IMPLEMENT_SKILL_ARGS,
         "--provider", "openai", "--model", "gpt-5.6-sol",
         "--thinking", "medium",
         "--print", "--session-dir", str(SESSION_DIR),
         "--system-prompt", SYSTEM_PROMPT, CONTEXT,
     ]
     assert log_command == [
-        "pi", "--provider", "openai", "--model", "gpt-5.6-sol",
+        "pi", *EXTENSION_ARGS,
+        "--provider", "openai", "--model", "gpt-5.6-sol",
         "--thinking", "medium",
         "--print", "--session-dir", str(SESSION_DIR),
         "--system-prompt", "<redacted>", "<issue-context-redacted>",
@@ -131,7 +132,7 @@ def test_review_command_and_log_with_everything_configured():
      "placeholder", "expect_no_tools"),
     [
         (pi_command.ROLE_TICKET, pi_command.IMPLEMENT_EXCLUDED_SKILLS,
-         False, False, "<issue-context-redacted>", True),
+         False, True, "<issue-context-redacted>", True),
         (ROLE_IMPLEMENT, pi_command.IMPLEMENT_EXCLUDED_SKILLS,
          True, True, "<issue-context-redacted>", False),
         (pi_command.ROLE_REVIEW, pi_command.REVIEW_EXCLUDED_SKILLS,

{orbi_cli-0.6.0 → orbi_cli-0.6.2}/tests/test_pi_extensions.py

@@ -76,16 +76,35 @@ def test_pi_extension_args_and_env_isolate_disabled_and_secrets():
     assert "secret" not in " ".join(args)
 
 
-def test_run_pi_and_review_share_extension_contract(monkeypatch, tmp_path):
+def test_run_pi_review_and_ticket_share_extension_contract(monkeypatch, tmp_path):
     (tmp_path / "prompt.md").write_text("system", encoding="utf-8")
     (tmp_path / "prompt_review.md").write_text("review", encoding="utf-8")
+    disabled = tmp_path / "disabled.mjs"
+    disabled.write_text("export default () => {}", encoding="utf-8")
     calls = []
     monkeypatch.setattr(pi_session, "stream_pi", lambda command, **kw: calls.append((command, kw)) or "ok")
-    config = config_domain.RunnerConfig(prompt=tmp_path / "prompt.md", prompt_review=tmp_path / "prompt_review.md", repo_dir=tmp_path, source_repos=("owner/repo",), workspace_root=tmp_path, context_files=(), skills=(), base_branch="main", base_sha="abc", run_id="deadbeef", pi_extensions=({"source": "npm:fixture@1.2.3", "enabled": True, "env": {"FIXTURE_TOKEN": "secret"}},))
+    config = config_domain.RunnerConfig(prompt=tmp_path / "prompt.md", prompt_review=tmp_path / "prompt_review.md", repo_dir=tmp_path, source_repos=("owner/repo",), workspace_root=tmp_path, context_files=(), skills=(), base_branch="main", base_sha="abc", run_id="deadbeef", pi_extensions=({"source": "npm:fixture@1.2.3", "enabled": True, "env": {"FIXTURE_TOKEN": "secret"}}, {"source": str(disabled), "enabled": False, "env": {}}))
+    extension_args = pi_command._pi_extension_args(config)
+    assert extension_args == ["--no-extensions", "--extension", "npm:fixture@1.2.3"]
     pi_session.run_pi({"number": 1, "title": "t", "body": ""}, RunContext(run_id=config.run_id, issue={"number": 1, "title": "t", "body": ""}["number"], branch="b", worktree=tmp_path, source_repo="owner/repo"), config)
     pi_session.run_review(RunContext(run_id=config.run_id, issue=1, branch="b", worktree=tmp_path, source_repo="owner/repo"), {"number": 1, "url": "u", "base_oid": "b", "head_oid": "h", "head_ref": "r"}, config, 1)
     for command, kwargs in calls:
-        assert command[1:4] == ["--no-extensions", "--extension", "npm:fixture@1.2.3"]
+        assert command[1:4] == extension_args
         assert kwargs["pi_env"] == {"FIXTURE_TOKEN": "secret"}
         assert "secret" not in " ".join(kwargs["log_command"])
         assert kwargs["log_command"][1:4] == command[1:4]
+    assert len(calls) == 2
+    # The ticket role (#1558) keeps the --no-tools boundary and passes the
+    # SAME isolated extension flags implement/review use.
+    pi_session.run_ticket_agent(
+        {"number": 1558, "title": "t", "body": ""}, config, "owner/repo",
+    )
+    command, kwargs = calls[2]
+    assert command[:2 + len(extension_args)] == [
+        "pi", "--no-tools", *extension_args,
+    ]
+    assert kwargs["log_command"][:1 + len(extension_args)] == [
+        "pi", *extension_args,
+    ]
+    assert kwargs["pi_env"] == {"FIXTURE_TOKEN": "secret"}
+    assert "secret" not in " ".join(kwargs["log_command"])