0xray 2.2.4 → 3.0.0

package/scripts/hooks/run-hook.js

@@ -168,10 +168,129 @@ function runTypeScriptCheck(files) {
 
 // ── Codex validation ─────────────────────────────────────────
 
+/**
+ * Try to load the framework's ConsoleLogUsageValidator.
+ * Falls back gracefully if the framework dist is not available.
+ */
+async function tryLoadConsoleValidator() {
+  const distPaths = [
+    join(projectRoot, "dist", "enforcement", "validators", "code-quality-validators.js"),
+    join(projectRoot, "node_modules", "xray", "dist", "enforcement", "validators", "code-quality-validators.js"),
+  ];
+  for (const distPath of distPaths) {
+    if (existsSync(distPath)) {
+      try {
+        const mod = await import(distPath);
+        if (mod.ConsoleLogUsageValidator) {
+          return new mod.ConsoleLogUsageValidator();
+        }
+      } catch {
+        // Fall through to next dist path
+      }
+    }
+  }
+  return null;
+}
+
+/**
+ * Try to load the framework's LightweightValidator.
+ * Falls back gracefully if the framework dist is not available.
+ */
+async function tryLoadLightweightValidator() {
+  const distPaths = [
+    join(projectRoot, "dist", "postprocessor", "validation", "LightweightValidator.js"),
+    join(projectRoot, "node_modules", "0xray", "dist", "postprocessor", "validation", "LightweightValidator.js"),
+  ];
+  for (const distPath of distPaths) {
+    if (existsSync(distPath)) {
+      try {
+        const mod = await import(distPath);
+        if (mod.runLightweightPreCommitValidation) {
+          return mod.runLightweightPreCommitValidation;
+        }
+      } catch {}
+    }
+  }
+  return null;
+}
+
+/**
+ * Try to load the enforcement gate's beforeToolHook.
+ * Falls back gracefully if the framework dist is not available.
+ */
+async function tryLoadGate() {
+  const distPaths = [
+    join(projectRoot, "dist", "integrations", "enforcement-gate.js"),
+    join(projectRoot, "node_modules", "0xray", "dist", "integrations", "enforcement-gate.js"),
+  ];
+  for (const distPath of distPaths) {
+    if (existsSync(distPath)) {
+      try {
+        const mod = await import(distPath);
+        if (mod.beforeToolHook) {
+          return mod.beforeToolHook;
+        }
+      } catch {}
+    }
+  }
+  return null;
+}
+
+/**
+ * Check a single file for console.log/warn/error violations using the
+ * framework validator when available, falling back to inline regex.
+ *
+ * Delegates to ConsoleLogUsageValidator (from dist/) when available to
+ * ensure consistent CLI-exemption logic with the framework's registry.
+ */
+async function checkConsoleViolations(filePath, content) {
+  const frameworkValidator = await tryLoadConsoleValidator();
+  if (frameworkValidator) {
+    try {
+      const result = await frameworkValidator.validate({
+        operation: "write",
+        files: [filePath],
+        newCode: content,
+      });
+      if (!result.passed) {
+        return { errors: [`${filePath}: ${result.message}`], warnings: [] };
+      }
+      return { errors: [], warnings: [] };
+    } catch {
+      // Fall through to inline check
+    }
+  }
+
+  // Inline fallback (same logic as framework validator for consistency)
+  const codeWithoutComments = content
+    .replace(/\/\/.*$/gm, "")
+    .replace(/\/\*[\s\S]*?\*\//g, "");
+
+  const isCLIFile = filePath.includes("/cli/") || filePath.includes("src\\cli\\");
+  const violations = [];
+
+  const consolePatterns = [
+    { pattern: /\bconsole\.log\s*\(/g, name: "console.log" },
+    { pattern: /\bconsole\.warn\s*\(/g, name: "console.warn" },
+    { pattern: /\bconsole\.error\s*\(/g, name: "console.error" },
+  ];
+  for (const { pattern, name } of consolePatterns) {
+    const matches = codeWithoutComments.match(pattern);
+    if (matches && matches.length > 0) {
+      violations.push(`${matches.length} use(s) of ${name}`);
+    }
+  }
+
+  if (violations.length > 0 && !isCLIFile) {
+    return { errors: [`${filePath}: ${violations.join("; ")}`], warnings: [] };
+  }
+  return { errors: [], warnings: [] };
+}
+
 async function runCodexValidation(files) {
   /**
    * Run lightweight codex validation on files.
-   * Uses dynamic import of framework modules when available.
+   * Uses dynamic import of ConsoleLogUsageValidator from framework when available.
    */
   log("Running Codex validation...");
 
@@ -182,7 +301,6 @@ async function runCodexValidation(files) {
     return { passed: true, warnings: [], errors: [] };
   }
 
-  // Quick static checks without framework dependency
   const errors = [];
   const warnings = [];
 
@@ -194,49 +312,36 @@ async function runCodexValidation(files) {
       const content = readFileSync(filePath, "utf-8");
       const lines = content.split("\n");
 
-      // Check for console.log (codex violation)
-      const consoleLogLines = lines.reduce((acc, line, i) => {
-        if (/\bconsole\.(log|warn|error)\b/.test(line) && !line.includes("NOSONAR")) {
-          acc.push(i + 1);
-        }
-        return acc;
-      }, []);
-      if (consoleLogLines.length > 0) {
-        errors.push(`${file}: console.log/warn/error found at lines ${consoleLogLines.slice(0, 3).join(", ")}`);
-      }
-
-      // Check for TODO/FIXME
-      const todoLines = lines.reduce((acc, line, i) => {
-        if (/\/\/\s*(TODO|FIXME|HACK|XXX)\b/i.test(line)) {
-          acc.push(i + 1);
-        }
-        return acc;
-      }, []);
-      if (todoLines.length > 0) {
-        warnings.push(`${file}: ${todoLines.length} TODO/FIXME comment(s) found`);
-      }
-
-      // Check for @ts-ignore
-      const tsIgnoreLines = lines.reduce((acc, line, i) => {
-        if (/@ts-ignore|@ts-nocheck|@ts-expect-error/.test(line)) {
-          acc.push(i + 1);
-        }
-        return acc;
-      }, []);
-      if (tsIgnoreLines.length > 0) {
-        warnings.push(`${file}: ${tsIgnoreLines.length} @ts-ignore/@ts-nocheck found`);
+      // Console check via framework validator (with inline fallback)
+      const consoleResult = await checkConsoleViolations(file, content);
+      errors.push(...consoleResult.errors);
+      warnings.push(...consoleResult.warnings);
+
+      // LightweightValidator for TODO/@ts-ignore/any/security/syntax (replaces inline regex)
+      const lwValidate = await tryLoadLightweightValidator();
+      if (lwValidate) {
+        const lwResult = await lwValidate([filePath]);
+        errors.push(...lwResult.errors);
+        warnings.push(...lwResult.warnings);
       }
 
-      // Check for any type
-      if (/\bany\b/.test(content)) {
-        const anyLines = lines.reduce((acc, line, i) => {
-          if (/\bany\b/.test(line) && !line.includes("//") && !line.includes("*")) {
-            acc.push(i + 1);
+      // Full registry gate call (same path as TUI/CLI hooks)
+      const beforeHook = await tryLoadGate();
+      if (beforeHook) {
+        try {
+          const gateResult = await beforeHook("write", { filePath, content });
+          if (!gateResult.allowed && gateResult.violations) {
+            for (const v of gateResult.violations) {
+              const msg = `${file}: ${v.message || v.ruleId}`;
+              if (v.severity === "error" || v.severity === "blocking") {
+                errors.push(msg);
+              } else {
+                warnings.push(msg);
+              }
+            }
           }
-          return acc;
-        }, []);
-        if (anyLines.length > 3) {
-          warnings.push(`${file}: ${anyLines.length} uses of 'any' type`);
+        } catch (gateErr) {
+          logError(`Gate call failed for ${file}: ${gateErr.message}`);
         }
       }
     } catch {
@@ -398,34 +503,38 @@ async function handlePreCommit() {
   // TypeScript check (blocking)
   const tsResult = runTypeScriptCheck(stagedFiles);
   if (!tsResult.passed) {
-    console.error("\n❌ TypeScript validation failed:");
-    tsResult.errors.slice(0, 10).forEach((e) => console.error(`   ${e}`));
+    process.stderr.write("\n❌ TypeScript validation failed:\n");
+    tsResult.errors.slice(0, 10).forEach((e) => process.stderr.write(`   ${e}\n`));
     if (tsResult.errors.length > 10) {
-      console.error(`   ... and ${tsResult.errors.length - 10} more`);
+      process.stderr.write(`   ... and ${tsResult.errors.length - 10} more\n`);
     }
-    console.error("\nFix TypeScript errors before committing.");
-    console.error("Run: npx tsc --noEmit\n");
+    process.stderr.write("\nFix TypeScript errors before committing.\n");
+    process.stderr.write("Run: npx tsc --noEmit\n");
     process.exit(1);
   }
 
   // Codex validation (blocking)
   const codexResult = await runCodexValidation(stagedFiles);
   if (!codexResult.passed) {
-    console.error("\n❌ Codex validation failed:");
-    codexResult.errors.slice(0, 10).forEach((e) => console.error(`   ${e}`));
-    console.error("\nFix Codex violations before committing.");
-    console.error("Run: npx xray validate\n");
+    logError("Codex validation failed:");
+    codexResult.errors.slice(0, 10).forEach((e) => logError(`   ${e}`));
+    process.stderr.write("\n❌ Codex validation failed:\n");
+    codexResult.errors.slice(0, 10).forEach((e) => process.stderr.write(`   ${e}\n`));
+    process.stderr.write("\nFix Codex violations before committing.\n");
+    process.stderr.write("Run: npx xray validate\n\n");
     process.exit(1);
   }
 
   // Warnings (non-blocking)
   if (codexResult.warnings.length > 0) {
-    console.warn("\n⚠️  Codex warnings:");
-    codexResult.warnings.slice(0, 5).forEach((w) => console.warn(`   ${w}`));
-    console.warn();
+    log("Codex warnings:");
+    codexResult.warnings.slice(0, 5).forEach((w) => log(`   ${w}`));
+    process.stderr.write("\n⚠️  Codex warnings:\n");
+    codexResult.warnings.slice(0, 5).forEach((w) => process.stderr.write(`   ${w}\n`));
+    process.stderr.write("\n");
   }
 
-  console.log(`\n✅ Pre-commit validation passed (${stagedFiles.length} files)\n`);
+  log(`\n✅ Pre-commit validation passed (${stagedFiles.length} files)\n`);
   process.exit(0);
 }
 
@@ -461,41 +570,45 @@ async function handlePrePush() {
   const result = await runFullValidation(changedFiles);
 
   if (!result.passed) {
-    console.error("\n❌ Pre-push validation failed:\n");
+    logError("Pre-push validation failed:");
+    process.stderr.write("\n❌ Pre-push validation failed:\n");
 
     if (!result.typescript.passed) {
-      console.error("TypeScript errors:");
+      process.stderr.write("TypeScript errors:\n");
       result.typescript.errors.slice(0, 10).forEach((e) =>
-        console.error(`   ${e}`)
+        process.stderr.write(`   ${e}\n`)
       );
-      console.error();
+      process.stderr.write("\n");
     }
 
     if (!result.codex.passed) {
-      console.error("Codex violations:");
+      process.stderr.write("Codex violations:\n");
       result.codex.errors.slice(0, 10).forEach((e) =>
-        console.error(`   ${e}`)
+        process.stderr.write(`   ${e}\n`)
       );
-      console.error();
+      process.stderr.write("\n");
     }
 
-    console.error("Fix all errors before pushing.");
-    console.error("Run: npx tsc --noEmit && npx xray validate\n");
+    process.stderr.write("Fix all errors before pushing.\n");
+    process.stderr.write("Run: npx tsc --noEmit && npx xray validate\n\n");
     process.exit(1);
   }
 
   // Warnings
   if (result.codex.warnings.length > 0) {
-    console.warn("\n⚠️  Codex warnings:");
-    result.codex.warnings.slice(0, 5).forEach((w) => console.warn(`   ${w}`));
-    console.warn();
+    log("Codex warnings:");
+    result.codex.warnings.slice(0, 5).forEach((w) => log(`   ${w}`));
+    process.stderr.write("\n⚠️  Codex warnings:\n");
+    result.codex.warnings.slice(0, 5).forEach((w) => process.stderr.write(`   ${w}\n`));
+    process.stderr.write("\n");
   }
 
   if (result.testWarning) {
-    console.warn(`\n⚠️  ${result.testWarning}\n`);
+    log(`Pre-push test warning: ${result.testWarning}`);
+    process.stderr.write(`\n⚠️  ${result.testWarning}\n\n`);
   }
 
-  console.log(`\n✅ Pre-push validation passed (${changedFiles.length} files)\n`);
+  log(`\n✅ Pre-push validation passed (${changedFiles.length} files)\n`);
   process.exit(0);
 }
 
@@ -551,8 +664,8 @@ const handlers = {
 
 const handler = handlers[hookType];
 if (!handler) {
-  console.error(`Unknown hook type: ${hookType}`);
-  console.error(`Valid types: ${Object.keys(handlers).join(", ")}`);
+  process.stderr.write(`Unknown hook type: ${hookType}\n`);
+  process.stderr.write(`Valid types: ${Object.keys(handlers).join(", ")}\n`);
   process.exit(1);
 }
 
@@ -565,6 +678,6 @@ handler()
   })
   .catch((err) => {
     logError(`Hook crashed: ${err.message}`);
-    console.error(`0xRay hook error: ${err.message}`);
+    process.stderr.write(`0xRay hook error: ${err.message}\n`);
     process.exit(1);
   });

package/scripts/node/postinstall.cjs

@@ -11,14 +11,18 @@ function structuredLog(component, action, status, details) {
   console.log(`${ts} [${component}] ${action} - ${String(status).toUpperCase()}${detailsPart}`);
 }
 
-const packageRoot = path.join(__dirname, "..", "..");
+const packageRoot = path.resolve(__dirname, "..", "..");
 
-let targetDir;
-if (__dirname.includes("node_modules/xray")) {
-  // plain xray (final identity)
-  targetDir = path.join(__dirname, "..", "..", "..", "..");
-} else {
-  targetDir = process.env.PWD || process.cwd();
+// Consumer-friendly targetDir resolution:
+// - In node_modules/0xray (or legacy xray): walk up until outside node_modules to reach consumer project root.
+// - Otherwise (dev): use cwd.
+let targetDir = process.env.PWD || process.cwd();
+if (packageRoot.includes("node_modules")) {
+  let current = packageRoot;
+  while (current.includes("node_modules")) {
+    current = path.dirname(current);
+  }
+  targetDir = current;
 }
 
 const resolvedPackage = path.resolve(packageRoot);
@@ -73,6 +77,16 @@ if (resolvedPackage !== resolvedTarget) {
   }
 }
 
+// Install pre-commit hook (LightweightValidator + gate, if git repo)
+try {
+  const installHooks = path.join(packageRoot, "scripts", "hooks", "install-hooks.cjs");
+  if (fs.existsSync(installHooks)) {
+    execSync(`node "${installHooks}"`, { stdio: 'pipe' });
+  }
+} catch (_e) {
+  // Non-git or install failure — not blocking
+}
+
 if (resolvedPackage !== resolvedTarget) {
   structuredLog('postinstall', 'xray v2 framework installed. Run `npx xray setup` for full configuration (hooks, Hermes, symlinks).', 'success');
 }

package/scripts/node/prepare-consumer.cjs

@@ -33,12 +33,13 @@ function updatePathsInFile(filePath) {
     let content = fs.readFileSync(filePath, 'utf-8');
     let updated = false;
 
-    // Transform development paths back to consumer paths (plain xray; legacy @0xray/xray removed)
-    // Only transform if it's not already a consumer path
-    if (content.includes('dist/plugin/mcps/') && !content.includes('node_modules/xray/dist/plugin/mcps/')) {
+    // Transform development paths back to consumer paths.
+    // Use 0xray (current published name). Keep xray for any legacy consumer configs.
+    // Only transform if it's not already a consumer path.
+    if (content.includes('dist/plugin/mcps/') && !content.includes('node_modules/0xray/dist/plugin/mcps/') && !content.includes('node_modules/xray/dist/plugin/mcps/')) {
       content = content.replace(
         /dist\/plugin\/mcps\//g,
-        'node_modules/xray/dist/plugin/mcps/'
+        'node_modules/0xray/dist/plugin/mcps/'
       );
       updated = true;
     }
@@ -47,7 +48,7 @@ function updatePathsInFile(filePath) {
     if (content.includes('../../../dist/plugin/')) {
       content = content.replace(
         /\.\.\/\.\.\/\.\.\/dist\/plugin\//g,
-        'node_modules/xray/dist/plugin/'
+        'node_modules/0xray/dist/plugin/'
       );
       updated = true;
     }

package/scripts/node/setup.cjs

@@ -3,14 +3,17 @@
 const fs = require("fs");
 const path = require("path");
 
-const packageRoot = path.join(__dirname, "..", "..");
+const packageRoot = path.resolve(__dirname, "..", "..");
 const homeDir = require("os").homedir();
 
-let targetDir;
-if (__dirname.includes("node_modules/xray")) {
-  targetDir = path.join(__dirname, "..", "..", "..", "..");
-} else {
-  targetDir = process.env.PWD || process.cwd();
+// Consumer-friendly targetDir (same logic as postinstall)
+let targetDir = process.env.PWD || process.cwd();
+if (packageRoot.includes("node_modules")) {
+  let current = packageRoot;
+  while (current.includes("node_modules")) {
+    current = path.dirname(current);
+  }
+  targetDir = current;
 }
 
 console.log("🔧 xray Setup: Full configuration...\n");
@@ -243,4 +246,14 @@ if (fs.existsSync(hermesSkillSource)) {
   } catch (e) { console.warn(`⚠️ Hermes skill: ${e.message}`); }
 }
 
+// 8. Install pre-commit hook (LightweightValidator + gate + registry)
+const installHooksPath = path.join(packageRoot, "scripts", "hooks", "install-hooks.cjs");
+if (fs.existsSync(installHooksPath)) {
+  try {
+    require("child_process").execSync(`node "${installHooksPath}"`, { stdio: "inherit" });
+  } catch (e) {
+    console.warn(`⚠️ Hook installation: ${e.message}`);
+  }
+}
+
 console.log("\n✅ xray setup complete.\n");

package/scripts/node/universal-version-manager.js

@@ -155,9 +155,9 @@ const detectedCodex = detectCodexInfo();
 const OFFICIAL_VERSIONS = {
   // Framework version
   framework: {
-    version: "2.2.3",
+    version: "3.0.0",
       displayName: "xray: Self-Healing AI Governance OS",
-      lastUpdated: "2026-06-10",
+      lastUpdated: "2026-06-12",
     // Counts (auto-calculated, but can be overridden)
     ...CALCULATED_COUNTS,
   },

package/src/integrations/grok/plugin/0xray/.mcp.json

@@ -2,10 +2,7 @@
   "mcpServers": {
     "xray-governance": {
       "command": "npx",
-      "args": ["-y", "0xray", "mcp", "governance"],
-      "env": {
-        "XRAY_FORCE_MCP_GOVERNANCE": "true"
-      }
+      "args": ["-y", "0xray", "mcp", "governance"]
     },
     "xray-skills": {
       "command": "npx",