0xray 3.0.12 → 3.1.0

package/.opencode/agents/testing-best-practices.yml

@@ -0,0 +1,12 @@
+name: testing-best-practices
+skill: testing-best-practices
+description: "testing best practices specialist"
+version: "1.0.0"
+mode: subagent
+
+capabilities:
+  - domain_specialization
+
+quality:
+  test_coverage: recommended
+  type_safety: strict

package/.opencode/codex.codex

@@ -1,7 +1,7 @@
 {
-  "version": "3.0.11",
+  "version": "1.22.67",
   "terms": [
-     1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68
+    1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60
   ],
   "framework": "xray Universal Development Codex",
   "compliance": "99.6% Error Prevention"

package/.opencode/commands/dependency-audit.md

@@ -69,7 +69,7 @@ Comprehensive dependency analysis and security audit for all project dependencie
   "vulnerabilities": [
     {
       "package": "lodash",
-      "version": "3.0.11",
+      "version": "1.22.67",
       "severity": "high",
       "cve": "CVE-2021-23337",
       "description": "Command injection vulnerability"
@@ -85,14 +85,14 @@ Security-focused format for CI/CD integration:
 
 ```json
 {
-  "version": "3.0.11",
+  "version": "1.22.67",
   "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
   "runs": [
     {
       "tool": {
         "driver": {
           "name": "Dependency Audit",
-          "version": "3.0.11"
+          "version": "1.22.67"
         }
       },
       "results": [...]

package/.opencode/enforcer-config.json

@@ -1,6 +1,6 @@
 {
-  "framework": "xray 3.0",
-  "version": "3.0.11",
+  "framework": "xray 2.0",
+  "version": "1.22.67",
   "description": "Codex-compliant framework configuration for Credible UI project",
   "thresholds": {
     "bundleSize": {
@@ -220,7 +220,7 @@
       }
     },
     "codex": {
-      "version": "3.0.11",
+      "version": "1.22.67",
       "terms": [
         1,
         2,

package/.opencode/init.sh

@@ -9,17 +9,20 @@ else
     PROJECT_ROOT=$(realpath "$SCRIPT_DIR/..")
 fi
 
-# Detect mode: dev (xray repo) vs consumer (npm dependency)
-# - Dev: PROJECT_ROOT has src/core/boot-orchestrator.ts (xray source)
-# - Consumer: node_modules/0xray/package.json exists
-# - Fallback: no xray found at all
+# Try to find framework package.json - check source first (dev), then node_modules (consumer)
+# For development, prefer the source version over node_modules
+# Need to handle both root-level and .opencode/ subdirectory runs
+SOURCE_PACKAGE_JSON="$SCRIPT_DIR/package.json"
+if [ ! -f "$SOURCE_PACKAGE_JSON" ] && [ -f "$PROJECT_ROOT/package.json" ]; then
+    SOURCE_PACKAGE_JSON="$PROJECT_ROOT/package.json"
+fi
 NODE_MODULES_PACKAGE_JSON="$PROJECT_ROOT/node_modules/0xray/package.json"
 
-if [ -f "$PROJECT_ROOT/src/core/boot-orchestrator.ts" ]; then
-    # Development mode: running inside the xray repo itself
+if [ -f "$SOURCE_PACKAGE_JSON" ]; then
+    # Development mode: use source version (project root)
     FRAMEWORK_ROOT="$PROJECT_ROOT"
 elif [ -f "$NODE_MODULES_PACKAGE_JSON" ]; then
-    # Consumer mode: 0xray installed as npm dependency
+    # Consumer mode: use installed version
     FRAMEWORK_ROOT="$PROJECT_ROOT/node_modules/0xray"
 else
     FRAMEWORK_ROOT="$PROJECT_ROOT"
@@ -27,7 +30,7 @@ fi
 
 # 0xRay Framework Version - read from FRAMEWORK_ROOT (already resolved above)
 # FRAMEWORK_ROOT correctly picks source in dev mode, node_modules in consumer mode
-FRAMEWORK_VERSION=$(node -e "console.log(require('$FRAMEWORK_ROOT/package.json').version)" 2>/dev/null || echo "unknown")
+XRAY_VERSION=$(node -e "console.log(require('$FRAMEWORK_ROOT/package.json').version)" 2>/dev/null || echo "unknown")
 
 # Dedup guard — prevent duplicate runs during startup
 # Uses a TTL lockfile (10s window) since OpenCode may trigger config hook
@@ -67,7 +70,7 @@ echo -e "${PURPLE}//      ╚█████╔╝██╔╝ ██╗██
 echo -e "${PURPLE}//       ╚════╝ ╚═╝  ╚═╝╚═╝  ╚═╝╚═╝  ╚═╝   ╚═╝           //${NC}" && sleep 0.1
 echo -e "${PURPLE}//                                                       //${NC}" && sleep 0.1
 echo -e "${PURPLE}//      ⚡ 0xRay: Self-Healing AI Governance OS          //${NC}" && sleep 0.1
-echo -e "${PURPLE}//      42 agents · 44 skills · 39 MCP servers           //${NC}" && sleep 0.1
+echo -e "${PURPLE}//          Platform • 99.6% Error Prevention            //${NC}" && sleep 0.1
 echo -e "${PURPLE}//═══════════════════════════════════════════════════════//${NC}" && sleep 0.2
 echo -e "${PURPLE}//              🚀 Initializing...                          //${NC}" && sleep 0.3
 echo -e "${PURPLE}//═══════════════════════════════════════════════════════//${NC}" && sleep 0.2
@@ -96,18 +99,15 @@ if [ "$SKILLS_COUNT" -eq 0 ]; then
     SKILLS_COUNT=$(ls -1d "$PROJECT_ROOT/node_modules/0xray/.opencode/skills/"* 2>/dev/null | wc -l | tr -d ' ')
 fi
 
-# Plugin status (check dev dist, then .opencode, then consumer)
-PLUGIN_DEV_DIST="$PROJECT_ROOT/dist/plugin/xray-codex-injection.js"
-PLUGIN_DEV_OPENCODE="$PROJECT_ROOT/.opencode/plugin/xray-codex-injection.js"
-PLUGIN_DEV_OPENCODE_PLURAL="$PROJECT_ROOT/.opencode/plugins/xray-codex-injection.js"
+# Plugin status (check both dev and consumer paths)
+PLUGIN_DEV="$PROJECT_ROOT/.opencode/plugin/xray-codex-injection.js"
+PLUGIN_DEV_PLURAL="$PROJECT_ROOT/.opencode/plugins/xray-codex-injection.js"
 PLUGIN_CONSUMER="$PROJECT_ROOT/node_modules/0xray/.opencode/plugin/xray-codex-injection.js"
 PLUGIN_CONSUMER_PLURAL="$PROJECT_ROOT/node_modules/0xray/.opencode/plugins/xray-codex-injection.js"
 
-if [ -f "$PLUGIN_DEV_DIST" ]; then
-    PLUGIN_STATUS="✅"
-elif [ -f "$PLUGIN_DEV_OPENCODE" ]; then
+if [ -f "$PLUGIN_DEV" ]; then
     PLUGIN_STATUS="✅"
-elif [ -f "$PLUGIN_DEV_OPENCODE_PLURAL" ]; then
+elif [ -f "$PLUGIN_DEV_PLURAL" ]; then
     PLUGIN_STATUS="✅"
 elif [ -f "$PLUGIN_CONSUMER" ]; then
     PLUGIN_STATUS="✅"
@@ -124,7 +124,7 @@ if [ ! -f "$PROJECT_ROOT/.opencode/enforcer-config.json" ]; then
 fi
 
 echo ""
-echo "⚡ 0xRay v$FRAMEWORK_VERSION"
+echo "⚡ 0xRay v$XRAY_VERSION"
 echo "🤖 Agents: $AGENTS_COUNT | ⚙️ MCPs: $MCPS_COUNT | 💡 Skills: $SKILLS_COUNT"
 
 # BootOrchestrator check (check dev and consumer paths)

package/.opencode/skills/api-design/SKILL.md

@@ -0,0 +1,37 @@
+---
+source: framework
+name: api-design
+description: RESTful API design and validation
+author: StrRay Framework
+version: 1.0.0
+schema_version: "1.0"
+tags: [design, api, design]
+capabilities:
+  - design_rest_api
+  - validate_api_specs
+  - generate_api_docs
+dependencies: []
+
+mcp:
+  api-design:
+    command: node
+    args: [node_modules/0xray/dist/mcps/knowledge-skills/api-design.server.js]
+---
+
+# Api Design Skill
+
+RESTful API design and validation.
+
+## Tools Available
+
+- **api_design**: API design
+- **endpoint_validation**: Endpoint validation
+- **api_documentation**: API documentation
+
+## Usage
+
+This skill provides design capabilities for api design functionality.
+
+## Integration
+
+Activated when design capabilities are requested through the skills system.

package/.opencode/skills/architect-tools/SKILL.md

@@ -0,0 +1,37 @@
+---
+source: framework
+name: architect-tools
+description: System design and technical architecture tools
+author: StrRay Framework
+version: 1.0.0
+schema_version: "1.0"
+tags: [design, architect, tools]
+capabilities:
+  - design_system
+  - evaluate_architecture
+  - recommend_tools
+dependencies: []
+
+mcp:
+  architect-tools:
+    command: node
+    args: [node_modules/0xray/dist/mcps/architect-tools.server.js]
+---
+
+# Architect Tools Skill
+
+System design and technical architecture tools.
+
+## Tools Available
+
+- **architecture_design**: Architecture design
+- **system_planning**: System planning
+- **technical_decisions**: Technical decisions
+
+## Usage
+
+This skill provides design capabilities for architect tools functionality.
+
+## Integration
+
+Activated when design capabilities are requested through the skills system.

package/.opencode/skills/architecture-patterns/SKILL.md

@@ -0,0 +1,37 @@
+---
+source: framework
+name: architecture-patterns
+description: Software architecture patterns and best practices
+author: StrRay Framework
+version: 1.0.0
+schema_version: "1.0"
+tags: [design, architecture, patterns]
+capabilities:
+  - analyze_architecture
+  - recommend_patterns
+  - evaluate_design
+dependencies: []
+
+mcp:
+  architecture-patterns:
+    command: node
+    args: [node_modules/0xray/dist/mcps/knowledge-skills/architecture-patterns.server.js]
+---
+
+# Architecture Patterns Skill
+
+Software architecture patterns and best practices.
+
+## Tools Available
+
+- **architecture_patterns**: Architecture patterns
+- **design_patterns**: Design patterns
+- **best_practices**: Best practices
+
+## Usage
+
+This skill provides design capabilities for architecture patterns functionality.
+
+## Integration
+
+Activated when design capabilities are requested through the skills system.

package/.opencode/skills/auto-format/SKILL.md

@@ -0,0 +1,37 @@
+---
+source: framework
+name: auto-format
+description: Automated code formatting and style consistency
+author: StrRay Framework
+version: 1.0.0
+schema_version: "1.0"
+tags: [formatting, auto, format]
+capabilities:
+  - format_code
+  - enforce_style
+  - fix_lint_errors
+dependencies: []
+
+mcp:
+  auto-format:
+    command: node
+    args: [node_modules/0xray/dist/mcps/auto-format.server.js]
+---
+
+# Auto Format Skill
+
+Automated code formatting and style consistency.
+
+## Tools Available
+
+- **code_formatting**: Code formatting
+- **style_consistency**: Style consistency
+- **auto-formatting**: Auto-formatting
+
+## Usage
+
+This skill provides formatting capabilities for auto format functionality.
+
+## Integration
+
+Activated when formatting capabilities are requested through the skills system.

package/.opencode/skills/backend-engineer/SKILL.md

@@ -0,0 +1,49 @@
+---
+source: framework
+name: backend-engineer
+description: "Backend engineer for REST/GraphQL APIs, microservices, authentication, and server architecture"
+category: backend
+---
+
+# Backend Engineer Skill
+
+Backend specialist for server-side architecture and API design. Systematic, secure, performance-oriented.
+
+## API Design
+
+- Plural nouns for resources (/users, /orders)
+- Proper HTTP methods (GET, POST, PUT, PATCH, DELETE)
+- Correct status codes (201 for creation, 204 for deletion, 404 for missing)
+- API versioning (/v1/)
+- Cursor-based pagination
+- Consistent error response format
+
+## Authentication
+
+- JWT + refresh tokens for stateless auth
+- OAuth2 for third-party integrations
+- HTTPS only (never HTTP)
+- Rate limiting per user/IP
+- bcrypt/argon2 for password hashing
+
+## Microservices
+
+- API gateway for routing and rate limiting
+- Circuit breaker for fault tolerance
+- Message queues for async communication
+- Event sourcing for audit trails
+- Distributed tracing (OpenTelemetry)
+
+## Caching
+
+- CDN -> gateway -> application -> database levels
+- Cache-aside pattern for read-heavy data
+- Write-through for write-throughput needs
+- Appropriate TTLs per data type
+- Careful cache invalidation strategy
+
+## Performance Targets
+
+- API response < 200ms p95
+- 50-100 DB connections pooled
+- Memory profiled and bounded

package/.opencode/skills/boot-orchestrator/SKILL.md

@@ -0,0 +1,37 @@
+---
+source: framework
+name: boot-orchestrator
+description: Framework initialization and boot orchestration
+author: StrRay Framework
+version: 1.0.0
+schema_version: "1.0"
+tags: [infrastructure, boot, orchestrator]
+capabilities:
+  - initialize_framework
+  - orchestrate_boot_sequence
+  - manage_dependencies
+dependencies: []
+
+mcp:
+  boot-orchestrator:
+    command: node
+    args: [node_modules/0xray/dist/mcps/boot-orchestrator.server.js]
+---
+
+# Boot Orchestrator Skill
+
+Framework initialization and boot orchestration.
+
+## Tools Available
+
+- **boot_management**: Boot management
+- **initialization**: Initialization
+- **framework_startup**: Framework startup
+
+## Usage
+
+This skill provides infrastructure capabilities for boot orchestrator functionality.
+
+## Integration
+
+Activated when infrastructure capabilities are requested through the skills system.

package/.opencode/skills/bug-triage/SKILL.md

@@ -0,0 +1,43 @@
+---
+source: framework
+name: bug-triage
+description: Bug triage, debugging analysis, and issue prioritization
+author: StrRay Framework
+version: 1.0.0
+schema_version: "1.0"
+tags: [debugging, bug-fix, triage, error-analysis]
+capabilities:
+  - triage_bugs
+  - analyze_issues
+  - prioritize_fixes
+dependencies: []
+
+mcp:
+  bug-triage-specialist:
+    command: node
+    args: [node_modules/0xray/dist/mcps/knowledge-skills/bug-triage-specialist.server.js]
+---
+
+# Bug Triage Skill
+
+Comprehensive bug triage, debugging analysis, and issue prioritization.
+
+## Tools Available
+
+- **triage_bugs**: Analyze and triage bug reports to identify root causes
+- **analyze_stack_trace**: Parse and analyze stack traces
+- **suggest_fixes**: Generate specific code fixes for bugs
+- **prioritize_issues**: Prioritize bug fixes by severity and effort
+- **find_related_issues**: Find related or duplicate bugs
+
+## Usage
+
+This skill provides debugging capabilities for:
+- Error and exception analysis
+- Stack trace interpretation
+- Root cause identification
+- Bug prioritization for sprint planning
+
+## Integration
+
+Activated when debugging or bug-fixing capabilities are requested.

package/.opencode/skills/code-analyzer/SKILL.md

@@ -0,0 +1,45 @@
+---
+source: framework
+name: code-analyzer
+description: Deep code analysis, metrics extraction, and pattern detection (CONSOLIDATED - combines analyzer, explore, and original code-analyzer)
+author: StrRay Framework
+version: 1.0.0
+schema_version: "1.0"
+tags: [analysis, metrics, code-quality, patterns]
+capabilities:
+  - analyze_code
+  - extract_metrics
+  - detect_patterns
+dependencies: []
+
+mcp:
+  code-analyzer:
+    command: node
+    args: [node_modules/0xray/dist/mcps/knowledge-skills/code-analyzer.server.js]
+---
+
+# Code Analyzer Skill
+
+Deep code analysis, metrics extraction, and pattern detection.
+
+## Tools Available
+
+- **analyze_codebase**: Comprehensive codebase analysis
+- **calculate_metrics**: Code metrics (complexity, maintainability)
+- **detect_patterns**: Design pattern recognition
+- **find_code_smells**: Technical debt identification
+- **analyze_dependencies**: Dependency graph analysis
+- **generate_insights**: Actionable recommendations
+
+## Usage
+
+This skill provides code analysis capabilities for:
+- Complexity and maintainability metrics
+- Design pattern detection
+- Code smell identification
+- Dependency analysis
+- Architectural insights
+
+## Integration
+
+Activated when code analysis or quality assessment capabilities are requested.

package/.opencode/skills/code-review/SKILL.md

@@ -0,0 +1,52 @@
+---
+source: framework
+name: code-review
+description: Perform comprehensive code quality assessment and provide improvement suggestions
+author: StrRay Framework
+version: 1.0.0
+schema_version: "1.0"
+tags: [review, quality, assessment, improvement]
+capabilities:
+  - assess_quality
+  - review_code
+  - suggest_improvements
+dependencies: []
+
+mcp:
+  code-review:
+    command: node
+    args: [node_modules/0xray/dist/mcps/knowledge-skills/code-review.server.js]
+  tools:
+    - analyze_code_quality
+    - review_pull_request
+    - check_best_practices
+
+agent_binding:
+  primary: code-reviewer
+  auto_invoke: true
+  invoke_on:
+    - pre_commit
+    - pr_review
+---
+
+# Code Review Skill
+
+Provides automated code review capabilities with quality assessment and improvement suggestions.
+
+## Tools Available
+
+- **analyze_code_quality**: Analyze code quality metrics, identify issues, and provide improvement suggestions
+- **review_pull_request**: Review pull requests by analyzing changed files and providing comprehensive feedback
+- **check_best_practices**: Check adherence to coding best practices and standards
+
+## Usage
+
+This skill performs automated code reviews including:
+- Code quality analysis and metrics
+- Pull request review and feedback
+- Best practices compliance checking
+- Improvement recommendations and suggestions
+
+## Integration
+
+Activated for code review requests, pull request analysis, and quality assessments through the skills system.

package/.opencode/skills/content-creator/SKILL.md

@@ -0,0 +1,38 @@
+---
+source: framework
+name: content-creator
+description: "SEO copywriter for content that ranks and converts in both Google and AI search engines"
+category: content
+---
+
+# Content Creator Skill
+
+SEO copywriter specializing in content that ranks and converts for humans and AI search engines.
+
+## Brand Archetypes
+
+Adapt tone on command: Magician, Hero, Sage, Ruler, Everyman, Explorer, Innocent, Jester.
+Default: Professional-friendly-innovative.
+
+## SEO Content Rules
+
+- Primary keywords in H1, first 100 words, throughout
+- LSI/semantic keywords naturally integrated
+- H2-H4 structure with keyword-rich headings
+- Bullets, numbered lists, tables for scannability
+- E-E-A-T signals (author, dates, citations)
+- AI-citation friendly: clear lists, stats, examples
+- Meta descriptions: 150-160 chars, actionable
+
+## Content Types
+
+Blog posts (800-2000w), Product pages, Landing pages, Email sequences, Social posts, Meta descriptions & title tags
+
+## Copy Principles
+
+- Lead with benefit
+- Active voice
+- Tight sentences
+- Zero fluff
+- Strong CTAs
+- Social proof

package/.opencode/skills/database-engineer/SKILL.md

@@ -0,0 +1,46 @@
+---
+source: framework
+name: database-engineer
+description: "Database engineer for schema design, query optimization, migrations, and SQL/NoSQL architecture"
+category: database
+---
+
+# Database Engineer Skill
+
+Database specialist for architecture and optimization. Technical, precise, performance-oriented.
+
+## Database Systems
+
+PostgreSQL, MySQL, SQLite, SQL Server, MongoDB, Cassandra, Redis, DynamoDB, CockroachDB, TiDB, PlanetScale, Elasticsearch, Meilisearch
+
+## Schema Design
+
+- 3NF minimum normalization
+- Denormalize intentionally for read-heavy workloads
+- Use appropriate data types (no string for dates)
+- Soft deletes with deleted_at timestamps
+- Audit columns (created_at, updated_at, created_by)
+- Foreign key constraints for referential integrity
+
+## Query Optimization
+
+- Use EXPLAIN ANALYZE to find bottlenecks
+- Covering indexes for frequent queries
+- Avoid SELECT * — specify columns
+- Parameterized queries only (prevent SQL injection)
+- Cursor-based pagination, not OFFSET
+
+## Migration Strategy
+
+- Wrap in transactions
+- Batch backfills for large data changes
+- Additive columns first (drop later)
+- Concurrent index creation (CREATE INDEX CONCURRENTLY)
+- Deprecation periods before removing columns
+
+## Performance Targets
+
+- < 100ms OLTP queries
+- < 1s OLAP queries
+- 10-50 connection pool size
+- Zero-downtime migrations

package/.opencode/skills/devops-engineer/SKILL.md

@@ -0,0 +1,49 @@
+---
+source: framework
+name: devops-engineer
+description: "DevOps engineer for CI/CD, infrastructure as code, containers, cloud deployment, and operational reliability"
+category: devops
+---
+
+# DevOps Engineer Skill
+
+DevOps specialist for infrastructure, CI/CD, and operational reliability. Reliability-focused, security-conscious, automate everything.
+
+## CI/CD Best Practices
+
+- Conventional commits for trigger control
+- Branch protection rules
+- Matrix builds for multi-platform testing
+- Dependency caching for faster builds
+- Progressive rollout (canary / blue-green)
+- Automated rollback procedures
+
+## Infrastructure as Code
+
+- Modular, reusable components
+- Remote state + locking (Terraform)
+- Drift detection
+- GitOps (ArgoCD/Flux)
+- Secrets separation (Vault/AWS Secrets Manager)
+
+## Containers
+
+- Helm/Kustomize for Kubernetes
+- Health checks and readiness probes
+- Resource limits and PDBs
+- Service mesh for inter-service communication
+
+## Monitoring
+
+- Logs / Metrics / Traces (three pillars)
+- Structured JSON logging
+- OpenTelemetry for instrumentation
+- SLO-based alerting (not threshold-based)
+- Runbooks for incident response
+
+## Cloud Security
+
+- Least privilege IAM
+- VPC / private subnets
+- Encryption at rest and in transit
+- CI/CD pipeline scanning