0xray 3.0.12 → 3.1.0

package/dist/security/security-scanner.js

@@ -0,0 +1,429 @@
+/**
+ * 0xRay Framework - Security Scanner
+ *
+ * Automated security vulnerability scanning and compliance validation
+ * Integrates with security tools and provides comprehensive security reports
+ */
+import { exec } from "child_process";
+import { promises as fs } from "fs";
+import { frameworkLogger } from "../core/framework-logger.js";
+import { promisify } from "util";
+import { promptSecurityValidator, } from "./prompt-security-validator.js";
+const execAsync = promisify(exec);
+export class SecurityScanner {
+    config;
+    constructor(config = {}) {
+        this.config = {
+            enabled: true,
+            tools: {
+                npmAudit: true,
+                trivy: false, // Requires separate installation
+                eslintSecurity: true,
+                dependencyCheck: false, // Requires separate installation
+                ...config.tools,
+            },
+            severityThreshold: "moderate",
+            reportPath: "./security-report.json",
+            failOnVulnerabilities: true,
+            ...config,
+        };
+    }
+    /**
+     * Run comprehensive security scan
+     */
+    async runSecurityScan() {
+        const jobId = `security-scan-${Date.now()}-${Math.random().toString(36).substring(2, 11)}`;
+        const startTime = Date.now();
+        if (!this.config.enabled) {
+            return this.createEmptyReport();
+        }
+        frameworkLogger.log("security-scanner", "scan-start", "info", {
+            jobId,
+            tools: this.config.tools,
+            severityThreshold: this.config.severityThreshold,
+        });
+        const results = await Promise.allSettled([
+            this.config.tools.npmAudit ? this.runNpmAudit() : Promise.resolve([]),
+            this.config.tools.trivy ? this.runTrivyScan() : Promise.resolve([]),
+            this.config.tools.eslintSecurity
+                ? this.runEslintSecurity()
+                : Promise.resolve([]),
+            this.config.tools.dependencyCheck
+                ? this.runDependencyCheck()
+                : Promise.resolve([]),
+        ]);
+        const tools = {
+            npmAudit: results[0].status === "fulfilled" ? results[0].value : [],
+            trivy: results[1].status === "fulfilled" ? results[1].value : [],
+            eslintSecurity: results[2].status === "fulfilled" ? results[2].value : [],
+            dependencyCheck: results[3].status === "fulfilled" ? results[3].value : [],
+        };
+        const duration = Date.now() - startTime;
+        const report = this.generateReport(tools, duration);
+        // Save report
+        await this.saveReport(report, jobId);
+        // Log results
+        await this.logResults(report);
+        return report;
+    }
+    /**
+     * Run npm audit
+     */
+    async runNpmAudit() {
+        try {
+            const { stdout } = await execAsync("npm audit --json");
+            const auditResult = JSON.parse(stdout);
+            const vulnerabilities = [];
+            if (auditResult.vulnerabilities) {
+                for (const [packageName, vuln] of Object.entries(auditResult.vulnerabilities)) {
+                    vulnerabilities.push({
+                        id: vuln.name || packageName,
+                        title: vuln.title || "Security vulnerability",
+                        description: vuln.overview || "No description available",
+                        severity: this.mapNpmSeverity(vuln.severity),
+                        package: packageName,
+                        version: vuln.version,
+                        cve: vuln.cwe,
+                        url: vuln.url,
+                        recommendation: vuln.recommendation || "Update to a secure version",
+                    });
+                }
+            }
+            return vulnerabilities;
+        }
+        catch (error) {
+            const errorMessage = error instanceof Error ? error.message : String(error);
+            frameworkLogger.log("security-scanner", "npm-audit-failed", "warning", { message: "⚠️ npm audit failed", error: errorMessage });
+            return [];
+        }
+    }
+    /**
+     * Run Trivy security scan
+     */
+    async runTrivyScan() {
+        try {
+            const { stdout } = await execAsync("trivy fs --format json .");
+            const trivyResult = JSON.parse(stdout);
+            const vulnerabilities = [];
+            if (trivyResult.Results) {
+                for (const result of trivyResult.Results) {
+                    if (result.Vulnerabilities) {
+                        for (const vuln of result.Vulnerabilities) {
+                            vulnerabilities.push({
+                                id: vuln.VulnerabilityID,
+                                title: vuln.Title,
+                                description: vuln.Description,
+                                severity: this.mapTrivySeverity(vuln.Severity),
+                                package: vuln.PkgName,
+                                version: vuln.InstalledVersion,
+                                cve: vuln.VulnerabilityID,
+                                url: vuln.PrimaryURL,
+                                recommendation: vuln.FixedVersion
+                                    ? `Update to ${vuln.FixedVersion}`
+                                    : "Review and mitigate",
+                            });
+                        }
+                    }
+                }
+            }
+            return vulnerabilities;
+        }
+        catch (error) {
+            const errorMessage = error instanceof Error ? error.message : String(error);
+            frameworkLogger.log("security-scanner", "trivy-scan-failed", "warning", { message: "⚠️ Trivy scan failed", error: errorMessage });
+            return [];
+        }
+    }
+    /**
+     * Run ESLint security rules
+     */
+    async runEslintSecurity() {
+        try {
+            const { stdout } = await execAsync("npx eslint --format json src/");
+            const eslintResults = JSON.parse(stdout);
+            const vulnerabilities = [];
+            for (const result of eslintResults) {
+                for (const message of result.messages) {
+                    if (message.ruleId &&
+                        (message.ruleId.includes("security") ||
+                            message.ruleId.includes("xss") ||
+                            message.ruleId.includes("injection"))) {
+                        vulnerabilities.push({
+                            id: message.ruleId,
+                            title: message.message,
+                            description: `Security issue in ${result.filePath}:${message.line}:${message.column}`,
+                            severity: "moderate",
+                            recommendation: "Fix the security vulnerability according to ESLint recommendations",
+                        });
+                    }
+                }
+            }
+            return vulnerabilities;
+        }
+        catch (error) {
+            const errorMessage = error instanceof Error ? error.message : String(error);
+            frameworkLogger.log("security-scanner", "eslint-scan-failed", "warning", { message: "⚠️ ESLint security scan failed", error: errorMessage });
+            return [];
+        }
+    }
+    /**
+     * Run OWASP Dependency Check
+     */
+    async runDependencyCheck() {
+        try {
+            const { stdout } = await execAsync("dependency-check --format JSON --out . --scan .");
+            const dcResult = JSON.parse(stdout);
+            const vulnerabilities = [];
+            if (dcResult.dependencies) {
+                for (const dep of dcResult.dependencies) {
+                    if (dep.vulnerabilities) {
+                        for (const vuln of dep.vulnerabilities) {
+                            vulnerabilities.push({
+                                id: vuln.name,
+                                title: vuln.description,
+                                description: vuln.description,
+                                severity: this.mapDependencyCheckSeverity(vuln.severity),
+                                package: dep.fileName,
+                                cve: vuln.name,
+                                url: vuln.references?.[0]?.url,
+                                recommendation: "Update dependency or apply security patches",
+                            });
+                        }
+                    }
+                }
+            }
+            return vulnerabilities;
+        }
+        catch (error) {
+            const errorMessage = error instanceof Error ? error.message : String(error);
+            frameworkLogger.log("security-scanner", "dependency-check-failed", "warning", { message: "⚠️ Dependency check failed", error: errorMessage });
+            return [];
+        }
+    }
+    /**
+     * Generate comprehensive security report
+     */
+    generateReport(tools, duration) {
+        const allVulnerabilities = [
+            ...tools.npmAudit,
+            ...tools.trivy,
+            ...tools.eslintSecurity,
+            ...tools.dependencyCheck,
+        ];
+        const bySeverity = allVulnerabilities.reduce((acc, vuln) => {
+            acc[vuln.severity] = (acc[vuln.severity] || 0) + 1;
+            return acc;
+        }, {});
+        const byTool = {
+            npmAudit: tools.npmAudit.length,
+            trivy: tools.trivy.length,
+            eslintSecurity: tools.eslintSecurity.length,
+            dependencyCheck: tools.dependencyCheck.length,
+        };
+        const highSeverityCount = (bySeverity.high || 0) + (bySeverity.critical || 0);
+        const shouldFail = this.config.failOnVulnerabilities &&
+            highSeverityCount > 0 &&
+            this.config.severityThreshold !== "low";
+        const recommendations = this.generateRecommendations(allVulnerabilities);
+        return {
+            timestamp: new Date().toISOString(),
+            duration,
+            tools,
+            summary: {
+                totalVulnerabilities: allVulnerabilities.length,
+                bySeverity,
+                byTool,
+            },
+            recommendations,
+            compliant: !shouldFail,
+        };
+    }
+    /**
+     * Generate security recommendations
+     */
+    generateRecommendations(vulnerabilities) {
+        const recommendations = [];
+        if (vulnerabilities.some((v) => v.severity === "critical")) {
+            recommendations.push("🚨 Critical security vulnerabilities found - immediate action required");
+        }
+        if (vulnerabilities.some((v) => v.severity === "high")) {
+            recommendations.push("⚠️ High-severity vulnerabilities detected - prioritize fixes");
+        }
+        if (vulnerabilities.filter((v) => v.package).length > 0) {
+            recommendations.push("📦 Update vulnerable dependencies to latest secure versions");
+        }
+        if (vulnerabilities.filter((v) => v.id.includes("eslint")).length > 0) {
+            recommendations.push("🔧 Fix code security issues identified by ESLint");
+        }
+        recommendations.push("🔍 Run regular security scans and keep dependencies updated");
+        recommendations.push("📋 Review security policies and implement security headers");
+        return recommendations;
+    }
+    /**
+     * Save report to file
+     */
+    async saveReport(report, jobId) {
+        try {
+            await fs.writeFile(this.config.reportPath, JSON.stringify(report, null, 2));
+            frameworkLogger.log("security-scanner", "report-saved", "success", {
+                jobId,
+                reportPath: this.config.reportPath,
+            });
+        }
+        catch (error) {
+            const errorMessage = error instanceof Error ? error.message : String(error);
+            frameworkLogger.log("security-scanner", "save-report-failed", "warning", { message: "⚠️ Failed to save security report", error: errorMessage });
+        }
+    }
+    /**
+     * Log security scan results
+     */
+    async logResults(report) {
+        await frameworkLogger.log("security-scanner", "-n-security-scan-complete-report-duration-ms-", "info", { message: `\n🔒 Security Scan Complete (${report.duration}ms)` });
+        await frameworkLogger.log("security-scanner", "-total-vulnerabilities-report-summary-totalvulnera", "info", {
+            message: `📊 Total vulnerabilities: ${report.summary.totalVulnerabilities}`,
+        });
+        await frameworkLogger.log("security-scanner", "-n-by-severity-", "info", {
+            message: "\n📈 By Severity:",
+        });
+        for (const [severity, count] of Object.entries(report.summary.bySeverity)) {
+            await frameworkLogger.log("security-scanner", "-severity-count-", "info", { message: `  ${severity}: ${count}` });
+        }
+        await frameworkLogger.log("security-scanner", "-n-by-tool-", "info", {
+            message: "\n🛠️ By Tool:",
+        });
+        for (const [tool, count] of Object.entries(report.summary.byTool)) {
+            await frameworkLogger.log("security-scanner", "-tool-count-", "info", {
+                message: `  ${tool}: ${count}`,
+            });
+        }
+        if (report.recommendations.length > 0) {
+            await frameworkLogger.log("security-scanner", "-n-recommendations-", "info", { message: "\n💡 Recommendations:" });
+            for (const rec of report.recommendations) {
+                await frameworkLogger.log("security-scanner", "-rec-", "info", {
+                    message: `  • ${rec}`,
+                });
+            }
+        }
+        if (report.compliant) {
+            // Security scan result - kept as console.log for user visibility
+        }
+        else {
+            // Security scan failure - kept as console.log for user visibility
+        }
+    }
+    /**
+     * Map npm audit severity levels
+     */
+    mapNpmSeverity(severity) {
+        switch (severity) {
+            case "critical":
+                return "critical";
+            case "high":
+                return "high";
+            case "moderate":
+                return "moderate";
+            case "low":
+                return "low";
+            default:
+                return "moderate";
+        }
+    }
+    /**
+     * Map Trivy severity levels
+     */
+    mapTrivySeverity(severity) {
+        switch (severity.toUpperCase()) {
+            case "CRITICAL":
+                return "critical";
+            case "HIGH":
+                return "high";
+            case "MEDIUM":
+                return "moderate";
+            case "LOW":
+                return "low";
+            default:
+                return "moderate";
+        }
+    }
+    /**
+     * Map Dependency Check severity levels
+     */
+    mapDependencyCheckSeverity(severity) {
+        switch (severity.toUpperCase()) {
+            case "CRITICAL":
+                return "critical";
+            case "HIGH":
+                return "high";
+            case "MEDIUM":
+                return "moderate";
+            case "LOW":
+                return "low";
+            default:
+                return "moderate";
+        }
+    }
+    /**
+     * Validate AI prompt security
+     */
+    async validatePrompt(prompt) {
+        const result = promptSecurityValidator.validatePrompt(prompt);
+        if (!result.isSafe) {
+            frameworkLogger.log("security-scanner", "prompt-violation", "warning", {
+                message: `🚨 Prompt security violation detected (risk: ${result.riskLevel})`,
+                violations: result.violations,
+            });
+        }
+        return {
+            isSafe: result.isSafe,
+            violations: result.violations,
+            riskLevel: result.riskLevel,
+        };
+    }
+    /**
+     * Validate AI response security
+     */
+    async validateResponse(response) {
+        const result = promptSecurityValidator.validateResponse(response);
+        if (!result.isSafe) {
+            frameworkLogger.log("security-scanner", "response-violation", "warning", {
+                message: `🚨 Response security violation detected (risk: ${result.riskLevel})`,
+                violations: result.violations,
+            });
+        }
+        return {
+            isSafe: result.isSafe,
+            violations: result.violations,
+            riskLevel: result.riskLevel,
+        };
+    }
+    /**
+     * Create empty report when scanning is disabled
+     */
+    createEmptyReport() {
+        return {
+            timestamp: new Date().toISOString(),
+            duration: 0,
+            tools: {
+                npmAudit: [],
+                trivy: [],
+                eslintSecurity: [],
+                dependencyCheck: [],
+            },
+            summary: {
+                totalVulnerabilities: 0,
+                bySeverity: {},
+                byTool: {
+                    npmAudit: 0,
+                    trivy: 0,
+                    eslintSecurity: 0,
+                    dependencyCheck: 0,
+                },
+            },
+            recommendations: ["Security scanning is disabled"],
+            compliant: true,
+        };
+    }
+}
+// Export singleton instance
+export const securityScanner = new SecurityScanner();

package/dist/services/inference-tuner.js

@@ -299,4 +299,3 @@ export class InferenceTuner {
 }
 // Singleton instance
 export const inferenceTuner = new InferenceTuner();
-//# sourceMappingURL=inference-tuner.js.map

package/dist/session/index.js

@@ -1,4 +1,3 @@
 export { SessionCleanupManager, createSessionCleanupManager } from "./session-cleanup-manager.js";
 export { SessionMonitor, createSessionMonitor } from "./session-monitor.js";
 export { SessionStateManager, createSessionStateManager } from "./session-state-manager.js";
-//# sourceMappingURL=index.js.map

package/dist/session/session-cleanup-manager.js

@@ -364,4 +364,3 @@ export class SessionCleanupManager {
 export const createSessionCleanupManager = (stateManager, config, sessionMonitor) => {
     return new SessionCleanupManager(stateManager, config, sessionMonitor);
 };
-//# sourceMappingURL=session-cleanup-manager.js.map

package/dist/session/session-monitor.js

@@ -501,4 +501,3 @@ export class SessionMonitor {
 export const createSessionMonitor = (stateManager, sessionCoordinator, cleanupManager, config) => {
     return new SessionMonitor(stateManager, sessionCoordinator, cleanupManager, config);
 };
-//# sourceMappingURL=session-monitor.js.map

package/dist/session/session-state-manager.js

@@ -520,4 +520,3 @@ export class SessionStateManager {
 export const createSessionStateManager = (stateManager, sessionCoordinator) => {
     return new SessionStateManager(stateManager, sessionCoordinator);
 };
-//# sourceMappingURL=session-state-manager.js.map

package/dist/skills/hermes-agent/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: hermes-agent
-description: Manage 0xRay framework from Hermes Agent via the native strray-hermes plugin. Covers the 4 plugin tools (validate, codex_check, health, hooks), lifecycle hooks, slash commands, bridge architecture, and CLI fallback.
+description: Manage 0xRay framework from Hermes Agent via the native xray-hermes plugin. Covers the 4 plugin tools (validate, codex_check, health, hooks), lifecycle hooks, slash commands, bridge architecture, and CLI fallback.
 version: 2.1.0
 author: 0xRay AI
 metadata:
@@ -9,7 +9,7 @@ metadata:
     related_skills: []
 ---
 
-# 0xRay Hermes Plugin (strray-hermes)
+# 0xRay Hermes Plugin (xray-hermes)
 
 Native Hermes plugin providing 0xRay framework integration — quality gates, codex enforcement, git hooks, and full pre/post processing pipeline. Runs via a Node.js bridge to compiled framework components.
 
@@ -24,7 +24,7 @@ Native Hermes plugin providing 0xRay framework integration — quality gates, co
 ## Plugin Architecture
 
 ```
-~/.hermes/plugins/strray-hermes/
+~/.hermes/plugins/xray-hermes/
 ├── __init__.py         # Plugin registration, hooks, slash commands
 ├── tools.py            # 4 tool handlers (validate, codex_check, health, hooks)
 ├── schemas.py          # JSON schemas the LLM sees
@@ -43,17 +43,17 @@ Native Hermes plugin providing 0xRay framework integration — quality gates, co
 
 **Fallback:** When bridge is unavailable, tools fall back to `npx 0xray` CLI commands.
 
-**Config path resolution:** `STRRAY_CONFIG_DIR/` > `.xray/` > `.opencode/xray/` > built-in defaults.
+**Config path resolution:** `XRAY_CONFIG_DIR/` > `.xray/` > `.opencode/xray/` > built-in defaults.
 
 ## 4 Tools
 
-### strray_validate
+### xray_validate
 
 Run pre-commit validation on files. Uses bridge quality gate + processor pipeline, falls back to CLI.
 
 ```
-strray_validate(files=["src/my-module.ts"], operation="commit")
-strray_validate(files=["src/auth.ts", "src/auth.test.ts"], operation="modify")
+xray_validate(files=["src/my-module.ts"], operation="commit")
+xray_validate(files=["src/auth.ts", "src/auth.test.ts"], operation="modify")
 ```
 
 Parameters:
@@ -62,13 +62,13 @@ Parameters:
 
 Returns: pass/fail with per-file results and violations.
 
-### strray_codex_check
+### xray_codex_check
 
 Validate code against the 60-term Universal Development Codex. Checks error-handling, type-safety, performance, security, architecture.
 
 ```
-strray_codex_check(code="const x: any = foo()", operation="create")
-strray_codex_check(code=snippet, operation="modify", focus_areas=["security", "error-handling"])
+xray_codex_check(code="const x: any = foo()", operation="create")
+xray_codex_check(code=snippet, operation="modify", focus_areas=["security", "error-handling"])
 ```
 
 Parameters:
@@ -78,25 +78,25 @@ Parameters:
 
 Returns: violations list with actionable remediation.
 
-### strray_health
+### xray_health
 
 Framework health check. Returns version, loaded components, project root.
 
 ```
-strray_health()
+xray_health()
 ```
 
 Returns: framework status, version, component availability, node version.
 
-### strray_hooks
+### xray_hooks
 
 Manage 0xRay git hooks (install, uninstall, list, status).
 
 ```
-strray_hooks(action="install")
-strray_hooks(action="status")
-strray_hooks(action="list")
-strray_hooks(action="uninstall", hooks=["pre-commit"])
+xray_hooks(action="install")
+xray_hooks(action="status")
+xray_hooks(action="list")
+xray_hooks(action="uninstall", hooks=["pre-commit"])
 ```
 
 Parameters:
@@ -122,7 +122,7 @@ Fires before ANY tool executes:
 1. Tracks session stats
 2. Logs tool-start event to `logs/framework/plugin-tool-events.log`
 3. For code-producing tools (write_file, patch, execute_code, write, edit): runs quality gate + pre-processors via bridge
-4. For other tools: nudges when a 0xRay MCP alternative exists (e.g., grep → search_codebase, eslint → strray_lint)
+4. For other tools: nudges when a 0xRay MCP alternative exists (e.g., grep → search_codebase, eslint → xray_lint)
 
 ### post_tool_call
 
@@ -137,16 +137,16 @@ Fires when a new session starts. Resets stats and logs to disk. Registration is
 ## Slash Command
 
 ```
-/strray status    — Plugin and framework health (calls bridge)
-/strray stats     — Session pipeline statistics
-/strray help      — Show available commands
+/xray status    — Plugin and framework health (calls bridge)
+/xray stats     — Session pipeline statistics
+/xray help      — Show available commands
 /sr status        — Alias
 ```
 
 ## Session Stats (tracked automatically)
 
-The plugin tracks per-session counters visible via `/strray stats`:
-- total_tool_calls, code_operations, strray_mcp_calls, native_tool_calls
+The plugin tracks per-session counters visible via `/xray stats`:
+- total_tool_calls, code_operations, xray_mcp_calls, native_tool_calls
 - quality_gate_runs, quality_gate_blocks
 - pre_processor_runs, post_processor_runs
 - bridge_calls, bridge_errors
@@ -164,13 +164,13 @@ All logs go to `logs/framework/` in the project root:
 
 | User Says | Tool / Command |
 |----------|---------------|
-| "Is 0xRay working?" | `strray_health()` or `/strray status` |
-| "Check these files before I commit" | `strray_validate(files=[...], operation="commit")` |
-| "Is this code codex compliant?" | `strray_codex_check(code=..., operation="create")` |
-| "Set up git hooks" | `strray_hooks(action="install")` |
-| "What hooks are installed?" | `strray_hooks(action="status")` |
-| "Show session stats" | `/strray stats` |
-| "Why is the bridge failing?" | Check `strray_health()` → if `framework: "not_loaded"`, verify `dist/` symlink |
+| "Is 0xRay working?" | `xray_health()` or `/xray status` |
+| "Check these files before I commit" | `xray_validate(files=[...], operation="commit")` |
+| "Is this code codex compliant?" | `xray_codex_check(code=..., operation="create")` |
+| "Set up git hooks" | `xray_hooks(action="install")` |
+| "What hooks are installed?" | `xray_hooks(action="status")` |
+| "Show session stats" | `/xray stats` |
+| "Why is the bridge failing?" | Check `xray_health()` → if `framework: "not_loaded"`, verify `dist/` symlink |
 
 ## Bridge Commands (internal)
 
@@ -188,8 +188,8 @@ These are called by the Python tools via `bridge.mjs`, not directly by the LLM:
 
 Bridge can be invoked directly for debugging:
 ```bash
-echo '{"command":"health"}' | node ~/.hermes/plugins/strray-hermes/bridge.mjs
-node ~/.hermes/plugins/strray-hermes/bridge.mjs health --cwd /path/to/project
+echo '{"command":"health"}' | node ~/.hermes/plugins/xray-hermes/bridge.mjs
+node ~/.hermes/plugins/xray-hermes/bridge.mjs health --cwd /path/to/project
 ```
 
 ## Relationship to MCP Servers
@@ -198,15 +198,15 @@ The plugin and MCP servers are complementary:
 - **Plugin tools** = offline-first, always available, lightweight (validate, codex check, health, hooks)
 - **MCP servers** = deeper analysis requiring running Node.js (lint, security scan, architecture assessment, orchestration, codebase search)
 
-The plugin's pre_tool_call hook nudges when an MCP alternative exists (e.g., "use mcp_strray_lint_lint instead of raw eslint"). This is advisory, not blocking.
+The plugin's pre_tool_call hook nudges when an MCP alternative exists (e.g., "use mcp_xray_lint_lint instead of raw eslint"). This is advisory, not blocking.
 
 ## Pitfalls
 
 - Plugin requires restart after install/edit: Hermes loads plugins once at session start.
 - Bridge needs `dist/` symlink: The bridge loads compiled `.js` from `dist/` → `node_modules/0xray/dist/`. If the symlink breaks, bridge returns `framework: "not_loaded"`.
-- `strray_codex_check` without `code` param returns health, not a codex check. Pass `code` for actual validation.
+- `xray_codex_check` without `code` param returns health, not a codex check. Pass `code` for actual validation.
 - CLI fallback requires `npx 0xray` in PATH. If bridge fails and CLI isn't available, tools return errors.
 - Quality gate blocks are logged but NOT enforced (advisory). The tool returns violations; the agent decides what to do.
-- Git hooks use symlinks from `.git/hooks/` → `hooks/`. If the `hooks/` directory doesn't exist in the project, `strray_hooks(action="install")` skips those hooks.
-- Project root detection walks up from CWD looking for `node_modules/0xray`, `.opencode/xray/features.json`, or `package.json`. Override with `STRRAY_PROJECT_ROOT` env var.
+- Git hooks use symlinks from `.git/hooks/` → `hooks/`. If the `hooks/` directory doesn't exist in the project, `xray_hooks(action="install")` skips those hooks.
+- Project root detection walks up from CWD looking for `node_modules/0xray`, `.opencode/xray/features.json`, or `package.json`. Override with `XRAY_PROJECT_ROOT` env var.
 - `logs/framework/` is created automatically. Never breaks the agent if permissions fail.

package/dist/skills/orchestrator/SKILL.md

@@ -15,7 +15,7 @@ dependencies: []
 mcp:
   orchestrator:
     command: node
-    args: [node_modules/0xray/dist/mcps/orchestrator/server.js]
+    args: [node_modules/0xray/dist/mcps/orchestrator.server.js]
 ---
 
 # Orchestrator Skill

package/dist/skills/registry.json

@@ -1,5 +1,5 @@
 {
-  "version": "3.0.11",
+  "version": "1.22.67",
   "description": "0xRay Skills Registry - recommended skill sources for consumers",
   "sources": [
     {