0xray 2.0.0

package/.opencode/commands/auto-format.md

@@ -0,0 +1,99 @@
+---
+name: auto-format
+description: Automated code formatting hook with Prettier and framework-specific formatters
+---
+
+#!/bin/bash
+
+# xray 2.0 - Auto Format Hook
+
+# Ensures consistent code formatting across all files
+
+echo "🎨 xray 2.0 - Auto Format"
+echo "================================================"
+
+# Initialize status
+
+FORMATTED=true
+CHANGES_MADE=()
+
+# Check for Prettier availability
+
+if command -v npx &> /dev/null; then
+echo "🔧 Running Prettier formatting..."
+
+    # Format all supported file types
+    if npx prettier --write "**/*.{js,jsx,ts,tsx,json,css,scss,md}" --ignore-path .gitignore > /dev/null 2>&1; then
+        echo "✅ Prettier formatting completed"
+        CHANGES_MADE+=("Prettier formatting applied")
+    else
+        echo "⚠️ Prettier formatting failed or no files to format"
+    fi
+
+else
+echo "⚠️ npx/prettier not available"
+FORMATTED=false
+fi
+
+# Framework-specific formatting (React/TypeScript)
+
+if [ -f "package.json" ] && command -v npm &> /dev/null; then # ESLint auto-fix if available
+if npm run lint:fix > /dev/null 2>&1 2>/dev/null; then
+echo "🔨 ESLint auto-fix applied"
+CHANGES_MADE+=("ESLint auto-fix applied")
+fi
+
+    # TypeScript compilation check
+    if npm run typecheck > /dev/null 2>&1; then
+        echo "✅ TypeScript compilation successful"
+    else
+        echo "⚠️ TypeScript compilation issues detected"
+        FORMATTED=false
+    fi
+
+fi
+
+# Format shell scripts if shfmt available
+
+if command -v shfmt &> /dev/null; then
+echo "🐚 Formatting shell scripts..."
+find . -name "\*.sh" -type f -exec shfmt -w -i 2 {} \; > /dev/null 2>&1
+if [ $? -eq 0 ]; then
+echo "✅ Shell scripts formatted"
+CHANGES_MADE+=("Shell scripts formatted")
+fi
+fi
+
+# Format Python files if black available
+
+if command -v black &> /dev/null; then
+echo "🐍 Formatting Python files..."
+black . > /dev/null 2>&1
+if [ $? -eq 0 ]; then
+echo "✅ Python files formatted"
+CHANGES_MADE+=("Python files formatted")
+fi
+fi
+
+# Check for unstaged changes
+
+if git diff --quiet && git diff --staged --quiet; then
+echo "📋 No formatting changes detected"
+else
+echo "📝 Formatting changes applied:"
+for change in "${CHANGES_MADE[@]}"; do
+echo " - $change"
+done
+fi
+
+# Final status
+
+if [ "$FORMATTED" = true ]; then
+echo ""
+echo "✅ Code formatting completed successfully"
+echo "🎯 xray 2.0: FORMATTING OPERATIONAL"
+else
+echo ""
+echo "⚠️ Some formatting operations failed"
+echo "Manual review recommended"
+fi

package/.opencode/commands/auto-summary-capture.md

@@ -0,0 +1,90 @@
+#!/bin/bash
+
+# xray 2.0 - Auto Summary Capture
+
+# Monitors for 'job done print summary' signal and automatically logs summaries
+
+# 🚨 CRITICAL RULE: REFACTORING LOG IS APPEND-ONLY 🚨
+
+#
+
+# The REFACTORING_LOG.md file serves as an immutable audit trail of the project's evolution.
+
+# This file must NEVER be edited or modified after creation - only NEW entries may be appended.
+
+#
+
+# ❌ NEVER edit existing entries
+
+# ❌ NEVER delete entries
+
+# ❌ NEVER reorder entries
+
+# ❌ NEVER modify timestamps or content
+
+#
+
+# ✅ ONLY append new entries to the end
+
+# ✅ ONLY add new information, never change old information
+
+# ✅ ONLY use this automated logging system for consistency
+
+#
+
+# This ensures the refactoring log remains a reliable, immutable record of all changes.
+
+# If you need to correct information, append a new entry documenting the correction.
+
+#
+
+# 🚨 VIOLATION OF THIS RULE WILL BREAK THE PROJECT'S HISTORICAL RECORD 🚨
+
+echo "📝 xray 2.0 - Auto Summary Capture"
+echo "======================================"
+echo "Monitoring for 'job done print summary' signals..."
+echo "All AI-generated summaries will be automatically logged to REFACTORING_LOG.md"
+echo ""
+
+# Create a temporary file to capture the summary
+
+TEMP_FILE=$(mktemp)
+CAPTURING=false
+
+# Function to log captured summary
+
+log_summary() {
+if [ -s "$TEMP_FILE" ]; then
+echo "📝 Captured AI summary - logging to REFACTORING_LOG.md..."
+
+        # Log the captured content
+        export XRAY_SUMMARY_CONTENT="$(cat "$TEMP_FILE")"
+        tail -n +6 .opencode/commands/summary-logger.md | bash 2>/dev/null || true
+
+        # Clear temp file
+        > "$TEMP_FILE"
+        CAPTURING=false
+
+        echo "✅ Summary automatically logged!"
+        echo ""
+    fi
+
+}
+
+# Monitor for the signal (this would be integrated into the AI workflow)
+
+# For now, demonstrate the concept
+
+echo "🔄 Auto-capture system ready. When AI outputs 'job done print summary',"
+echo " the following summary content will be automatically captured and logged."
+echo ""
+echo "Example usage:"
+echo "1. AI completes task"
+echo "2. AI outputs: 'job done print summary'"
+echo "3. AI outputs summary content"
+echo "4. System automatically logs to REFACTORING_LOG.md"
+echo ""
+
+# Clean up
+
+rm -f "$TEMP_FILE"

package/.opencode/commands/dependency-audit.md

@@ -0,0 +1,184 @@
+# Dependency Audit Command
+
+## Description
+
+Comprehensive dependency analysis and security audit for all project dependencies across npm, pip, cargo, and other package managers.
+
+## Usage
+
+/dependency-audit [options]
+
+## Options
+
+- `--managers=<list>`: Package managers to audit (npm,pip,cargo,go,maven)
+- `--severity=<level>`: Minimum severity to report (low,medium,high,critical)
+- `--fix`: Auto-fix issues where possible
+- `--update`: Update dependencies to latest compatible versions
+- `--report=<format>`: Output format (json, html, markdown, sarif)
+
+## Implementation
+
+### 1. Dependency Discovery
+
+- **Package Managers**: Auto-detect and scan all used managers
+- **Lock Files**: Parse package-lock.json, requirements.txt, Cargo.lock, etc.
+- **Transitive Dependencies**: Analyze entire dependency tree
+- **Dev Dependencies**: Separate analysis for dev vs production deps
+
+### 2. Security Vulnerability Scanning
+
+- **CVE Database**: Check against NIST NVD
+- **Advisory Sources**: NPM, PyPI, RustSec, GitHub Advisories
+- **Custom Rules**: Project-specific security policies
+- **License Compliance**: Open source license validation
+
+### 3. Version Analysis
+
+- **Outdated Packages**: Identify packages with available updates
+- **Compatibility**: Check version compatibility across dependencies
+- **Breaking Changes**: Identify potentially breaking updates
+- **Maintenance Status**: Check package maintenance activity
+
+### 4. Performance Impact
+
+- **Bundle Size**: Impact of dependencies on bundle size
+- **Load Time**: Network loading performance
+- **Tree Shaking**: Dead code elimination effectiveness
+- **Caching**: Browser caching efficiency
+
+### 5. Quality Metrics
+
+- **Maintenance**: Commit frequency, issue response time
+- **Popularity**: Download counts, GitHub stars
+- **Security**: Security audit history
+- **Compatibility**: Platform and Node.js version support
+
+## Output Formats
+
+### JSON Report
+
+```json
+{
+  "timestamp": "2024-01-09T12:00:00Z",
+  "summary": {
+    "totalDeps": 245,
+    "vulnerable": 3,
+    "outdated": 12,
+    "unmaintained": 1
+  },
+  "vulnerabilities": [
+    {
+      "package": "lodash",
+      "version": "1.22.67",
+      "severity": "high",
+      "cve": "CVE-2021-23337",
+      "description": "Command injection vulnerability"
+    }
+  ],
+  "recommendations": [...]
+}
+```
+
+### SARIF Report
+
+Security-focused format for CI/CD integration:
+
+```json
+{
+  "version": "1.22.67",
+  "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
+  "runs": [
+    {
+      "tool": {
+        "driver": {
+          "name": "Dependency Audit",
+          "version": "1.22.67"
+        }
+      },
+      "results": [...]
+    }
+  ]
+}
+```
+
+### HTML Dashboard
+
+Interactive dashboard with:
+
+- Vulnerability timeline
+- Dependency tree visualization
+- Risk assessment charts
+- Remediation recommendations
+
+## Remediation Actions
+
+### Automatic Fixes
+
+- **Patch Updates**: Apply security patches
+- **Version Pinning**: Lock to secure versions
+- **Dependency Removal**: Remove unused dependencies
+- **Alternative Packages**: Suggest secure alternatives
+
+### Manual Actions Required
+
+- **Code Changes**: Update API usage for breaking changes
+- **Configuration Updates**: Modify config for new versions
+- **Testing**: Validate functionality after updates
+- **Documentation**: Update docs for API changes
+
+## Integration
+
+### CI/CD Pipeline
+
+```yaml
+- name: Dependency Audit
+  run: /dependency-audit --severity=medium --report=sarif
+  continue-on-error: false
+```
+
+### Pre-commit Hook
+
+```bash
+#!/bin/bash
+/dependency-audit --managers=npm --severity=high
+if [ $? -ne 0 ]; then
+  echo "Dependency audit failed. Fix vulnerabilities before committing."
+  exit 1
+fi
+```
+
+### Scheduled Scans
+
+- Daily security scans
+- Weekly dependency updates
+- Monthly comprehensive audits
+
+## Configuration
+
+Project-specific settings in `.dependency-audit.json`:
+
+```json
+{
+  "managers": {
+    "npm": {
+      "ignore": ["devDependencies"],
+      "allowList": ["lodash@4.17.21"]
+    },
+    "pip": {
+      "index-url": "https://pypi.org/simple/"
+    }
+  },
+  "policies": {
+    "maxAge": "1y",
+    "minDownloads": 1000,
+    "requireSbom": true
+  }
+}
+```
+
+## Dependencies
+
+- Node.js 18+
+- Package managers (npm, yarn, pnpm, pip, cargo, etc.)
+- Security databases (NVD, OSV)
+- Vulnerability scanners (npm audit, safety, cargo audit)

package/.opencode/commands/enforcer-daily-scan.md

@@ -0,0 +1,137 @@
+---
+name: enforcer-daily-scan
+description: Automated daily framework compliance monitoring with threshold validation
+---
+
+#!/bin/bash
+
+# Daily compliance scan for xray 2.0
+
+echo "🔍 xray 2.0 - Daily Compliance Scan"
+echo "========================================================="
+
+# Initialize compliance status
+
+COMPLIANT=true
+ISSUES=()
+
+# 1. Bundle Size Check
+
+echo "📦 Checking bundle size..."
+if command -v npm &> /dev/null && [ -f "package.json" ]; then
+npm run build > /dev/null 2>&1
+if [ -d "dist" ]; then
+BUNDLE_SIZE=$(du -sh dist/ | cut -f1)
+        echo "Current bundle size: $BUNDLE_SIZE"
+        # Check against 2MB threshold
+        if [[ "$BUNDLE_SIZE" > "2MB" ]]; then
+ISSUES+=("Bundle size violation: $BUNDLE_SIZE > 2MB")
+COMPLIANT=false
+fi
+else
+echo "⚠️ Build directory not found"
+fi
+else
+echo "⚠️ npm not available or package.json not found"
+fi
+
+# 2. Test Coverage Validation
+
+echo ""
+echo "🧪 Checking test coverage..."
+if command -v npm &> /dev/null && npm run test:coverage > /dev/null 2>&1; then # Parse coverage from generated reports
+if [ -f "coverage/lcov.info" ]; then # Extract line coverage percentage
+COVERAGE=$(grep -o "LF:[0-9]*" coverage/lcov.info | head -1 | sed 's/LF://')
+        TOTAL=$(grep -o "LH:[0-9]_" coverage/lcov.info | head -1 | sed 's/LH://')
+if [ "$COVERAGE" -gt 0 ] 2>/dev/null; then
+PERCENTAGE=$((TOTAL _ 100 / COVERAGE))
+echo "Test coverage: $PERCENTAGE%"
+            if [ "$PERCENTAGE" -lt 85 ]; then
+ISSUES+=("Test coverage violation: $PERCENTAGE% < 85%")
+COMPLIANT=false
+fi
+fi
+else
+echo "⚠️ Coverage report not found"
+fi
+else
+echo "⚠️ Test coverage command failed"
+fi
+
+# 3. Code Duplication Analysis
+
+echo ""
+echo "🔄 Checking code duplication..."
+if command -v jscpd &> /dev/null; then
+DUPLICATION=$(jscpd --reporters console --format "javascript,typescript" . 2>/dev/null | grep -o "[0-9]*\.[0-9]*%" | head -1)
+    if [[ -n "$DUPLICATION" ]]; then
+echo "Code duplication: ${DUPLICATION}%"
+        # Remove % sign for comparison
+        DUP_NUM=$(echo $DUPLICATION | sed 's/%//')
+        if (( $(echo "$DUP_NUM > 5" | bc -l 2>/dev/null) )); then
+ISSUES+=("Code duplication violation: ${DUPLICATION}% > 5%")
+COMPLIANT=false
+fi
+fi
+else
+echo "⚠️ jscpd not available for duplication analysis"
+fi
+
+# 4. Syntax Error Prevention
+
+echo ""
+echo "🔧 Checking syntax errors..."
+if command -v npm &> /dev/null && [ -f "package.json" ]; then
+if npm run lint > /dev/null 2>&1; then
+echo "✅ No syntax/linting errors detected"
+else
+ISSUES+=("Syntax/linting errors detected")
+COMPLIANT=false
+fi
+else
+echo "⚠️ Lint command not available"
+fi
+
+# 5. Runtime Error Rate Estimation
+
+echo ""
+echo "🚨 Estimating runtime error risk..."
+
+# Check for common error patterns
+
+ERROR*PATTERNS=$(find src -name "*.ts" -o -name "_.tsx" -o -name "_.js" -o -name "*.jsx" | xargs grep -l "console.error\|throw new\|catch.*error" 2>/dev/null | wc -l)
+TOTAL*FILES=$(find src -name "\*.ts" -o -name "*.tsx" -o -name "\_.js" -o -name "\_.jsx" | wc -l)
+
+if [ "$TOTAL_FILES" -gt 0 ]; then
+ERROR_RATIO=$((ERROR_PATTERNS * 100 / TOTAL_FILES))
+    echo "Error handling coverage: $ERROR_RATIO% of files"
+    if [ "$ERROR_RATIO" -lt 80 ]; then
+ISSUES+=("Low error handling coverage: $ERROR_RATIO% < 80%")
+COMPLIANT=false
+fi
+fi
+
+# Report Results
+
+echo ""
+echo "📊 COMPLIANCE REPORT"
+echo "==================="
+
+if [ "$COMPLIANT" = true ]; then
+echo "✅ FRAMEWORK COMPLIANT"
+echo "All thresholds met - ready for development"
+else
+echo "❌ COMPLIANCE VIOLATIONS DETECTED"
+echo ""
+echo "Issues requiring attention:"
+for issue in "${ISSUES[@]}"; do
+echo " - $issue"
+done
+echo ""
+echo "Remediation required before proceeding"
+exit 1
+fi
+
+echo ""
+echo "🎯 xray 2.0 Status: OPERATIONAL"
+echo "Next scheduled scan: Tomorrow at 09:00"