0xray 3.0.14 → 3.1.0

package/dist/core/codex-injector.js

@@ -13,7 +13,7 @@ import { frameworkLogger } from "../core/framework-logger.js";
 import { resolveCodexPath } from "./config-paths.js";
 // Dynamic imports for cross-environment compatibility
 let extractCodexMetadata;
-let StringRayContextLoader;
+let XrayContextLoaderClass;
 let importsInitialized = false;
 async function initializeImports() {
     if (importsInitialized)
@@ -22,13 +22,13 @@ async function initializeImports() {
         const codexParser = await import("../utils/codex-parser.js");
         const contextLoaderModule = await import("./context-loader.js");
         extractCodexMetadata = codexParser.extractCodexMetadata;
-        StringRayContextLoader = contextLoaderModule.StringRayContextLoader;
+        XrayContextLoaderClass = contextLoaderModule.XrayContextLoader;
     }
     catch {
         const codexParser = await import("../utils/codex-parser");
         const contextLoaderModule = await import("./context-loader");
         extractCodexMetadata = codexParser.extractCodexMetadata;
-        StringRayContextLoader = contextLoaderModule.StringRayContextLoader;
+        XrayContextLoaderClass = contextLoaderModule.XrayContextLoader;
     }
     importsInitialized = true;
 }
@@ -38,7 +38,7 @@ async function initializeImports() {
 const codexCache = new Map();
 /**
  * Codex file locations resolved through the standard priority chain.
- * Uses config-paths.ts resolver so STRRAY_CONFIG_DIR and .strray/ work.
+ * Uses config-paths.ts resolver so STRRAY_CONFIG_DIR and .xray/ work.
  */
 function getCodexFileLocations(projectRoot) {
     const root = projectRoot || process.cwd();
@@ -193,7 +193,7 @@ export function createXrayCodexInjectorHook() {
                     await frameworkLogger.log("codex-injector", "codex context loaded for validation", "success", { jobId, contextCount: codexContexts.length });
                     // Use the initialized context loader
                     await initializeImports();
-                    const ContextLoaderClass = StringRayContextLoader;
+                    const ContextLoaderClass = XrayContextLoaderClass;
                     const contextLoader = new ContextLoaderClass();
                     const loadResult = await contextLoader.loadCodexContext(sessionId);
                     if (!loadResult.success || !loadResult.context) {

package/dist/core/config-loader.js

@@ -10,7 +10,7 @@ import * as fs from "fs";
 import * as path from "path";
 import { frameworkLogger } from "./framework-logger.js";
 import { getConfigDir, resolveConfigPath } from "./config-paths.js";
-export class StringRayConfigLoader {
+export class XrayConfigLoader {
     configPath;
     cachedConfig = null;
     cacheExpiry = 30000; // 30 seconds
@@ -145,4 +145,6 @@ export class StringRayConfigLoader {
     }
 }
 // Export singleton instance
-export const strRayConfigLoader = new StringRayConfigLoader();
+export const xrayConfigLoader = new XrayConfigLoader();
+export { XrayConfigLoader as StringRayConfigLoader };
+export { xrayConfigLoader as strRayConfigLoader };

package/dist/core/config-paths.js

@@ -7,15 +7,15 @@
  *
  * Resolution order (per file type):
  *   1. STRRAY_CONFIG_DIR/<relative_path>     (if env var set)
- *   2. .strray/<relative_path>                (preferred lightweight root)
- *   3. .opencode/strray/<relative_path>       (legacy OpenCode root)
+ *   2. .xray/<relative_path>                 (preferred lightweight root)
+ *   3. .opencode/xray/<relative_path>        (legacy OpenCode root)
  *   4. null                                   (callers fall back to built-in defaults)
  *
  * For state/data directories, uses:
  *   1. STRRAY_CONFIG_DIR/state                 (if env var set)
- *   2. .strray/state
+ *   2. .xray/state
  *   3. .opencode/state                         (legacy)
- *   4. .strray/state                           (default — always writable)
+ *   4. .xray/state                              (default — always writable)
  */
 import { existsSync } from "fs";
 import { join, resolve } from "path";
@@ -40,8 +40,8 @@ export function getConfigDir(projectRoot) {
         const resolved = resolve(root, envDir);
         candidates.push({ dir: resolved, source: "env" });
     }
-    candidates.push({ dir: join(root, ".strray"), source: "dot-strray" });
-    candidates.push({ dir: join(root, ".opencode", "strray"), source: "dot-opencode" });
+    candidates.push({ dir: join(root, ".xray"), source: "dot-xray" });
+    candidates.push({ dir: join(root, ".opencode", "xray"), source: "dot-opencode" });
     // Return the first that exists, or the highest-priority default
     for (const c of candidates) {
         if (existsSync(c.dir)) {
@@ -49,7 +49,7 @@ export function getConfigDir(projectRoot) {
             return c.dir;
         }
     }
-    // Nothing exists — use highest priority default (env > .strray > .opencode)
+    // Nothing exists — use highest priority default (env > .xray > .opencode)
     const defaultDir = candidates[0];
     _resolvedConfigDirs.set(root, defaultDir.dir);
     return defaultDir.dir;
@@ -68,8 +68,8 @@ export function resolveConfigPath(relativePath, projectRoot) {
     if (envDir) {
         candidates.push(resolve(root, envDir, relativePath));
     }
-    candidates.push(join(root, ".strray", relativePath));
-    candidates.push(join(root, ".opencode", "strray", relativePath));
+    candidates.push(join(root, ".xray", relativePath));
+    candidates.push(join(root, ".opencode", "xray", relativePath));
     for (const candidate of candidates) {
         if (existsSync(candidate)) {
             return candidate;
@@ -90,7 +90,7 @@ export function resolveStateDir(projectRoot) {
     if (envDir) {
         candidates.push(join(root, envDir, "state"));
     }
-    candidates.push(join(root, ".strray", "state"));
+    candidates.push(join(root, ".xray", "state"));
     candidates.push(join(root, ".opencode", "state"));
     for (const candidate of candidates) {
         if (existsSync(candidate)) {
@@ -117,8 +117,8 @@ export function resolveProfilesDir(projectRoot) {
     if (envDir) {
         candidates.push(join(root, envDir, "profiles"));
     }
-    candidates.push(join(root, ".strray", "profiles"));
-    candidates.push(join(root, ".opencode", "strray", "profiles"));
+    candidates.push(join(root, ".xray", "profiles"));
+    candidates.push(join(root, ".opencode", "xray", "profiles"));
     for (const candidate of candidates) {
         if (existsSync(candidate)) {
             return candidate;
@@ -137,9 +137,9 @@ export function resolveCodexPath(projectRoot) {
     if (envDir) {
         candidates.push(join(root, envDir, "codex.json"));
     }
-    candidates.push(join(root, ".strray", "codex.json"));
+    candidates.push(join(root, ".xray", "codex.json"));
     candidates.push(join(root, "xray", "codex.json"));
-    candidates.push(join(root, ".opencode", "strray", "codex.json"));
+    candidates.push(join(root, ".opencode", "xray", "codex.json"));
     // Additional fallback locations (for standalone usage)
     candidates.push(join(root, "codex.json"));
     candidates.push(join(root, "src", "codex.json"));

package/dist/core/context-loader.js

@@ -22,7 +22,7 @@ function isValidMatch(match, index) {
  *
  * Loads and parses the Universal Development Codex v1.2.0 from codex.json
  */
-export class StringRayContextLoader {
+export class XrayContextLoader {
     static instance;
     cachedContext = null;
     codexFilePaths = [];
@@ -33,10 +33,10 @@ export class StringRayContextLoader {
      * Get singleton instance
      */
     static getInstance() {
-        if (!StringRayContextLoader.instance) {
-            StringRayContextLoader.instance = new StringRayContextLoader();
+        if (!XrayContextLoader.instance) {
+            XrayContextLoader.instance = new XrayContextLoader();
         }
-        return StringRayContextLoader.instance;
+        return XrayContextLoader.instance;
     }
     /**
      * Load codex context
@@ -266,4 +266,7 @@ export class StringRayContextLoader {
 /**
  * Export singleton instance
  */
-export const strRayContextLoader = StringRayContextLoader.getInstance();
+export const xrayContextLoader = XrayContextLoader.getInstance();
+// Backward compat aliases
+export { XrayContextLoader as StringRayContextLoader };
+export { xrayContextLoader as strRayContextLoader };

package/dist/core/index.js

@@ -1,5 +1,5 @@
 export { KernelOrchestrator } from "./orchestrator.js";
-export { defaultStringRayConfig } from "./xray-activation.js"; // consumer runtime compat from prior StringRay releases (1-line min per Scope Rule)
+export { defaultXrayConfig, defaultXrayConfig as defaultStringRayConfig } from "./xray-activation.js"; // consumer runtime compat
 // Decoupled config path resolution (Layer 1)
 export { getConfigDir, resolveConfigPath, resolveStateDir, resolveProfilesDir, resolveCodexPath, resolveLogDir, resetConfigDirCache, STRRAY_CONFIG_DIR_ENV, } from "./config-paths.js";
 // Standalone codex formatter (Layer 2)

package/dist/core/orchestrator.js

@@ -267,7 +267,7 @@ export class KernelOrchestrator {
                 `B) Use a single orchestrator for all dependent tasks\n` +
                 `C) Remove the dependency if it's not needed\n\n` +
                 `Example of correct usage:\n` +
-                `  const orch = new StringRayOrchestrator();\n` +
+                `  const orch = new XrayOrchestrator();\n` +
                 `  await orch.executeComplexTask("test", [\n` +
                 `    { id: "task-1" },\n` +
                 `    { id: "task-2", dependencies: ["task-1"] }  // ✅ Same orchestrator\n` +

package/dist/core/system-prompt-generator.js

@@ -7,7 +7,7 @@
  * @version 1.0.0
  * @since 2026-03-03
  */
-import { StringRayContextLoader } from "./context-loader.js";
+import { XrayContextLoader } from "./context-loader.js";
 import { validateContext, preventSystemPromptBloat } from "./context-validator.js";
 import fs from "fs";
 import path from "path";
@@ -140,7 +140,7 @@ export async function generateLeanSystemPrompt(config = {}) {
     let finalPrompt = systemPrompt;
     if (showCodexContext && enableTokenOptimization) {
         try {
-            const contextLoader = StringRayContextLoader.getInstance();
+            const contextLoader = XrayContextLoader.getInstance();
             const loadResult = await contextLoader.loadCodexContext(process.cwd());
             if (loadResult.success && loadResult.context) {
                 const codexSummary = generateCodexSummary(loadResult.context, maxTokenBudget);

package/dist/core/xray-activation.js

@@ -1,10 +1,10 @@
 /**
- * Consumer runtime compat shim from prior StringRay releases (1-line min per Scope Rule; primary xray paths + XRAY_||STRRAY_ env + .strray fallbacks).
+ * Consumer runtime compat shim from prior 0xRay releases (1-line min per Scope Rule; primary xray paths + XRAY_||STRRAY_ env + .xray fallbacks).
  */
 import { frameworkLogger } from "../core/framework-logger.js";
 import { ensureCriticalComponents } from "../architect/architectural-integrity.js";
 import { validateRegistryConsistency } from "../agents/registry.js";
-export const defaultStringRayConfig = {
+export const defaultXrayConfig = {
     enableOrchestrator: true,
     enableBootOrchestrator: true,
     enableStateManagement: true,
@@ -13,15 +13,15 @@ export const defaultStringRayConfig = {
     enableProcessors: true,
     enablePostProcessor: true,
 };
-export async function activateStringRayFramework(config = {}) {
+export async function activateXrayFramework(config = {}) {
     const jobId = `activation-${Date.now()}-${Math.random().toString(36).substring(2, 11)}`;
-    const activationConfig = { ...defaultStringRayConfig, ...config };
+    const activationConfig = { ...defaultXrayConfig, ...config };
     // Banner display moved to init.sh execution in plugin
     // Framework activation proceeds quietly
-    frameworkLogger.log("stringray-activation", "beginning xray framework activation", "info", { jobId, ...activationConfig });
+    frameworkLogger.log("xray-activation", "beginning xray framework activation", "info", { jobId, ...activationConfig });
     const registryValidation = validateRegistryConsistency();
     if (!registryValidation.valid) {
-        frameworkLogger.log("stringray-activation", "registry-validation-failed", "warning", { errors: registryValidation.errors });
+        frameworkLogger.log("xray-activation", "registry-validation-failed", "warning", { errors: registryValidation.errors });
     }
     try {
         if (activationConfig.enableCodexInjection) {
@@ -48,87 +48,89 @@ export async function activateStringRayFramework(config = {}) {
         // Ensure architectural integrity - critical components must always be active
         await ensureCriticalComponents();
         // Loading display moved to init.sh for dramatic line-by-line presentation
-        frameworkLogger.log("stringray-activation", "xray framework activation completed successfully", "success", { jobId });
+        frameworkLogger.log("xray-activation", "xray framework activation completed successfully", "success", { jobId });
     }
     catch (error) {
-        await frameworkLogger.log("stringray-activation", "framework-activation-failed", "error", { jobId, error: String(error) });
+        await frameworkLogger.log("xray-activation", "framework-activation-failed", "error", { jobId, error: String(error) });
         throw error;
     }
 }
 async function activateCodexInjection(jobId) {
-    frameworkLogger.log("stringray-activation", "activating codex injection", "info", { jobId });
+    frameworkLogger.log("xray-activation", "activating codex injection", "info", { jobId });
     const { createXrayCodexInjectorHook } = await import("./codex-injector.js");
     const hook = createXrayCodexInjectorHook();
-    globalThis.strRayHooks = globalThis.strRayHooks || [];
-    globalThis.strRayHooks.push(hook);
-    frameworkLogger.log("stringray-activation", "codex injection activated", "success", { jobId, hookName: hook.name });
+    globalThis.xrayHooks = globalThis.xrayHooks || [];
+    globalThis.xrayHooks.push(hook);
+    frameworkLogger.log("xray-activation", "codex injection activated", "success", { jobId, hookName: hook.name });
 }
 async function activateHooks(jobId) {
     try {
-        frameworkLogger.log("stringray-activation", "activating xray hooks", "info", { jobId });
+        frameworkLogger.log("xray-activation", "activating xray hooks", "info", { jobId });
         // Create and register the Codex injector hook
         const { createXrayCodexInjectorHook } = await import("./codex-injector");
         const hook = createXrayCodexInjectorHook();
         // Store hook globally for OpenCode to pick up
-        globalThis.strRayHooks = globalThis.strRayHooks || [];
-        globalThis.strRayHooks.push(hook);
-        frameworkLogger.log("stringray-activation", "xray hooks activated", "success", {
+        globalThis.xrayHooks = globalThis.xrayHooks || [];
+        globalThis.xrayHooks.push(hook);
+        frameworkLogger.log("xray-activation", "xray hooks activated", "success", {
             jobId,
             hookName: hook.name,
-            hooksRegistered: globalThis.strRayHooks.length
+            hooksRegistered: globalThis.xrayHooks.length
         });
     }
     catch (error) {
-        await frameworkLogger.log("stringray-activation", "hooks activation failed", "error", { jobId, error: String(error) });
+        await frameworkLogger.log("xray-activation", "hooks activation failed", "error", { jobId, error: String(error) });
     }
 }
 async function activateBootOrchestrator(jobId) {
-    frameworkLogger.log("stringray-activation", "activating boot orchestrator", "info", { jobId });
+    frameworkLogger.log("xray-activation", "activating boot orchestrator", "info", { jobId });
     const { bootOrchestrator } = await import("./boot-orchestrator");
     await bootOrchestrator.executeBootSequence();
-    frameworkLogger.log("stringray-activation", "boot orchestrator activated", "success", { jobId });
+    frameworkLogger.log("xray-activation", "boot orchestrator activated", "success", { jobId });
 }
 async function activateStateManagement(jobId) {
-    frameworkLogger.log("stringray-activation", "activating state management", "info", { jobId });
-    const { StringRayStateManager } = await import("../state/state-manager");
-    const stateManager = new StringRayStateManager();
+    frameworkLogger.log("xray-activation", "activating state management", "info", { jobId });
+    const { XrayStateManager } = await import("../state/state-manager");
+    const stateManager = new XrayStateManager();
     // Store the state manager instance globally for framework use
-    globalThis.strRayStateManager = stateManager;
-    frameworkLogger.log("stringray-activation", "state management activated", "success", { jobId });
+    globalThis.xrayStateManager = stateManager;
+    frameworkLogger.log("xray-activation", "state management activated", "success", { jobId });
 }
 async function activateOrchestrator(jobId) {
-    frameworkLogger.log("stringray-activation", "activating xray orchestrator", "info", { jobId });
+    frameworkLogger.log("xray-activation", "activating xray orchestrator", "info", { jobId });
     const { strRayOrchestrator } = await import("./orchestrator");
     // Also activate the multi-agent orchestration coordinator
     const { multiAgentOrchestrationCoordinator } = await import("../orchestrator/multi-agent-orchestration-coordinator");
-    frameworkLogger.log("stringray-activation", "xray orchestrator and multi-agent coordination activated", "success", { jobId });
+    frameworkLogger.log("xray-activation", "xray orchestrator and multi-agent coordination activated", "success", { jobId });
 }
 async function activateProcessors(jobId) {
-    frameworkLogger.log("stringray-activation", "activating processor pipeline", "info", { jobId });
+    frameworkLogger.log("xray-activation", "activating processor pipeline", "info", { jobId });
     const { ProcessorManager } = await import("../processors/processor-manager");
-    const { StringRayStateManager } = await import("../state/state-manager");
-    const stateManager = new StringRayStateManager();
+    const { XrayStateManager } = await import("../state/state-manager");
+    const stateManager = new XrayStateManager();
     const processorManager = new ProcessorManager(stateManager);
     // Store the processor manager instance globally for framework use
-    globalThis.strRayProcessorManager = processorManager;
-    frameworkLogger.log("stringray-activation", "processor pipeline activated", "success", { jobId });
+    globalThis.xrayProcessorManager = processorManager;
+    frameworkLogger.log("xray-activation", "processor pipeline activated", "success", { jobId });
 }
 async function activatePostProcessor(jobId) {
-    frameworkLogger.log("stringray-activation", "activating post-processor system", "info", { jobId });
+    frameworkLogger.log("xray-activation", "activating post-processor system", "info", { jobId });
     const { PostProcessor } = await import("../postprocessor/PostProcessor");
     // Get existing state manager (should be initialized by boot orchestrator)
-    const stateManager = globalThis.strRayStateManager;
+    const stateManager = globalThis.xrayStateManager;
     if (!stateManager) {
         throw new Error("State manager not initialized - boot orchestrator must run first");
     }
     const postProcessor = new PostProcessor(stateManager, null, {});
-    globalThis.strRayPostProcessor = postProcessor;
-    frameworkLogger.log("stringray-activation", "post-processor system activated", "success", { jobId });
+    globalThis.xrayPostProcessor = postProcessor;
+    frameworkLogger.log("xray-activation", "post-processor system activated", "success", { jobId });
     const { pathResolver } = await import("../utils/path-resolver.js");
-    globalThis.strRayPathResolver = pathResolver;
-    frameworkLogger.log("stringray-activation", "path resolver activated", "success", { jobId });
+    globalThis.xrayPathResolver = pathResolver;
+    frameworkLogger.log("xray-activation", "path resolver activated", "success", { jobId });
     const { CodexInjector } = await import("./codex-injector.js");
     const codexInjector = new CodexInjector();
-    globalThis.strRayCodexInjector = codexInjector;
-    frameworkLogger.log("stringray-activation", "codex injector activated", "success", { jobId });
+    globalThis.xrayCodexInjector = codexInjector;
+    frameworkLogger.log("xray-activation", "codex injector activated", "success", { jobId });
 }
+export { defaultXrayConfig as defaultStringRayConfig };
+export { activateXrayFramework as activateStringRayFramework };

package/dist/delegation/agent-delegator.js

@@ -45,9 +45,9 @@ export class AgentDelegator {
      */
     loadRoutingMappings() {
         const candidates = [
-            path.resolve(process.cwd(), ".strray/routing-mappings.json"),
+            path.resolve(process.cwd(), ".xray/routing-mappings.json"),
             path.resolve(process.cwd(), "xray/routing-mappings.json"),
-            path.resolve(process.cwd(), ".opencode/strray/routing-mappings.json"),
+            path.resolve(process.cwd(), ".opencode/xray/routing-mappings.json"),
             path.resolve(process.cwd(), "routing-mappings.json"),
         ];
         for (const p of candidates) {

package/dist/enforcement/enforcer-tools.js

@@ -5,7 +5,7 @@
 import { ruleEnforcer, } from "./rule-enforcer.js";
 import { frameworkLogger } from "../core/framework-logger.js";
 import { AgentDelegator } from "../delegation/agent-delegator.js";
-import { StringRayStateManager } from "../state/state-manager.js";
+import { XrayStateManager } from "../state/state-manager.js";
 import { strRayConfigLoader } from "../core/config-loader.js";
 import * as fs from "fs";
 import * as path from "path";
@@ -325,7 +325,7 @@ async function executeReleaseWorkflow(operation, context, jobId, routing) {
 async function delegateToAgent(agentName, operation, context, jobId) {
     try {
         // Create a minimal state manager and config loader for the delegator
-        const stateManager = new StringRayStateManager();
+        const stateManager = new XrayStateManager();
         // Create the delegator
         const delegator = new AgentDelegator(stateManager, strRayConfigLoader);
         // Build task description for the delegated agent

package/dist/enforcement/loaders/codex-loader.js

@@ -30,13 +30,13 @@ export class CodexLoader extends BaseLoader {
     name = "codex";
     /**
      * Path to the codex.json file.
-     * Uses the standard config-paths resolver which checks .strray/, .opencode/strray/, etc.
+     * Uses the standard config-paths resolver which checks .xray/, .opencode/xray/, etc.
      */
     get codexPath() {
         const candidates = resolveCodexPath();
         const found = candidates.find((p) => existsSync(p));
         // Fallback to primary path even if not found yet
-        return found ?? candidates[0] ?? this.resolvePath(".opencode/strray/codex.json");
+        return found ?? candidates[0] ?? this.resolvePath(".opencode/xray/codex.json");
     }
     /**
      * Check if codex.json exists.

package/dist/governance/llm-governance-provider.js

@@ -0,0 +1,210 @@
+import { readFileSync, existsSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { frameworkLogger } from "../core/framework-logger.js";
+const XAI_ENDPOINT = "https://api.x.ai/v1/chat/completions";
+const XAI_MODEL = "grok-4.3";
+const ROLE_PROMPTS = {
+    "code-review": `You are a senior code reviewer on a governance committee for a software project. Analyze the following proposal from a code quality, maintainability, readability, and engineering best practices perspective.
+
+Consider:
+- Does the proposal improve or degrade code quality?
+- Does it follow established design patterns?
+- Does it introduce technical debt?
+- Are there potential regressions or edge cases?
+
+Respond with a structured vote in exactly this format:
+DECISION: approve|reject|abstain
+CONFIDENCE: <0.0-1.0>
+REASONING: <2-4 sentence analysis of the proposal's code quality implications>`,
+    "security-audit": `You are a senior security engineer on a governance committee for a software project. Analyze the following proposal from a security, threat modeling, and compliance perspective.
+
+Consider:
+- Does the proposal introduce new attack surface?
+- Does it handle authentication, authorization, and data protection properly?
+- Are there compliance implications (GDPR, SOC2, PCI-DSS, etc.)?
+- Does it follow security best practices (input validation, least privilege, defense in depth)?
+
+Respond with a structured vote in exactly this format:
+DECISION: approve|reject|abstain
+CONFIDENCE: <0.0-1.0>
+REASONING: <2-4 sentence analysis of the proposal's security implications>`,
+    "researcher": `You are a senior architect and researcher on a governance committee for a software project. Analyze the following proposal from a codebase-wide architectural and historical perspective.
+
+Consider:
+- Does the proposal align with the project's observed architecture patterns?
+- Does it integrate well with existing systems and data flows?
+- Does it address recurring problems observed in the project history?
+- What is the broader impact on the codebase ecosystem?
+
+Respond with a structured vote in exactly this format:
+DECISION: approve|reject|abstain
+CONFIDENCE: <0.0-1.0>
+REASONING: <2-4 sentence analysis of the proposal's broader project impact>`,
+};
+function readHermesOAuthToken() {
+    try {
+        const authPath = join(homedir(), ".hermes", "auth.json");
+        if (!existsSync(authPath))
+            return null;
+        const raw = readFileSync(authPath, "utf-8");
+        const data = JSON.parse(raw);
+        let entry;
+        if (data && typeof data === "object" && !Array.isArray(data)) {
+            entry = data["xai-oauth"];
+            if (!entry?.access_token && data.access_token) {
+                entry = data;
+            }
+        }
+        if (!entry?.access_token && Array.isArray(data)) {
+            entry = data.find((e) => e.provider === "xai-oauth" || !!e.access_token);
+        }
+        if (!entry?.access_token)
+            return null;
+        if (entry.expires_at && Date.now() / 1000 > entry.expires_at) {
+            frameworkLogger.log("llm-governance", "hermes-token-expired", "warning", { expiresAt: entry.expires_at });
+            return null;
+        }
+        return entry.access_token;
+    }
+    catch (err) {
+        frameworkLogger.log("llm-governance", "hermes-auth-read-error", "warning", { error: String(err) });
+        return null;
+    }
+}
+function getConfig() {
+    const directEndpoint = process.env.XRAY_LLM_ENDPOINT ||
+        process.env.XRAY_GOVERNANCE_LLM_ENDPOINT ||
+        "";
+    const directApiKey = process.env.XRAY_LLM_API_KEY ||
+        process.env.XRAY_GOVERNANCE_LLM_API_KEY ||
+        "";
+    const directModel = process.env.XRAY_LLM_MODEL ||
+        process.env.XRAY_GOVERNANCE_LLM_MODEL ||
+        "gpt-4o";
+    const directEnabled = process.env.XRAY_GOVERNANCE_LLM_ENABLED === "true" ||
+        process.env.XRAY_LLM_ENABLED === "true";
+    if (directEnabled && directEndpoint && directApiKey) {
+        return { endpoint: directEndpoint, apiKey: directApiKey, model: directModel };
+    }
+    const hermesToken = readHermesOAuthToken();
+    if (hermesToken) {
+        frameworkLogger.log("llm-governance", "using-hermes-oauth", "info", { provider: "xai-oauth", endpoint: XAI_ENDPOINT, model: XAI_MODEL });
+        return { endpoint: XAI_ENDPOINT, apiKey: hermesToken, model: XAI_MODEL };
+    }
+    return null;
+}
+function parseVote(text) {
+    const decisionMatch = text.match(/DECISION:\s*(approve|reject|abstain)/i);
+    const confidenceMatch = text.match(/CONFIDENCE:\s*([0-9.]+)/i);
+    const reasoningMatch = text.match(/REASONING:\s*(.+)/is);
+    if (!decisionMatch || !decisionMatch[1])
+        return null;
+    const rawConfidence = confidenceMatch?.[1];
+    const confidence = rawConfidence ? parseFloat(rawConfidence) : 0.5;
+    return {
+        decision: decisionMatch[1].toLowerCase(),
+        confidence: isNaN(confidence) ? 0.5 : Math.min(1, Math.max(0, confidence)),
+        reasoning: reasoningMatch?.[1]?.trim() || "No reasoning provided",
+    };
+}
+export async function tryLLMGovernance(role, proposalTitle, proposalDescription, evidence, proposalType) {
+    const config = getConfig();
+    if (!config) {
+        return null;
+    }
+    const systemPrompt = ROLE_PROMPTS[role];
+    const userMessage = `## Proposal
+
+**Title:** ${proposalTitle}
+
+**Description:** ${proposalDescription}
+
+**Type:** ${proposalType}
+
+${evidence.length > 0 ? `**Supporting Evidence:**\n${evidence.map((e, i) => `${i + 1}. ${e}`).join("\n")}` : ""}
+
+---
+
+Please provide your structured vote.`;
+    try {
+        const response = await fetch(config.endpoint, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Authorization: `Bearer ${config.apiKey}`,
+            },
+            body: JSON.stringify({
+                model: config.model,
+                messages: [
+                    { role: "system", content: systemPrompt },
+                    { role: "user", content: userMessage },
+                ],
+                temperature: 0.3,
+                max_tokens: 500,
+            }),
+        });
+        if (!response.ok) {
+            frameworkLogger.log("llm-governance", "api-call", "error", {
+                status: response.status,
+                statusText: response.statusText,
+                role,
+            });
+            return null;
+        }
+        const data = (await response.json());
+        const choices = data?.choices;
+        const message = choices?.[0]?.message;
+        const content = message?.content;
+        if (!content) {
+            frameworkLogger.log("llm-governance", "parse", "warning", {
+                issue: "missing content in response",
+                role,
+            });
+            return null;
+        }
+        const vote = parseVote(content);
+        if (!vote) {
+            frameworkLogger.log("llm-governance", "parse", "warning", {
+                issue: "unparseable response",
+                snippet: content.slice(0, 200),
+                role,
+            });
+            return null;
+        }
+        frameworkLogger.log("llm-governance", "vote", "success", {
+            role,
+            decision: vote.decision,
+            confidence: vote.confidence,
+        });
+        return vote;
+    }
+    catch (error) {
+        frameworkLogger.log("llm-governance", "error", "error", {
+            error: String(error),
+            role,
+        });
+        return null;
+    }
+}
+export function checkHermesOAuthStatus() {
+    const config = getConfig();
+    if (!config) {
+        const hermesPath = join(homedir(), ".hermes", "auth.json");
+        if (existsSync(hermesPath)) {
+            return {
+                configured: false,
+                error: "Hermes auth file found but no valid xai-oauth token. Run: hermes auth add xai-oauth --no-browser",
+            };
+        }
+        return {
+            configured: false,
+            error: "No Hermes auth file found (~/.hermes/auth.json). Install Hermes and run: hermes auth add xai-oauth --no-browser",
+        };
+    }
+    return {
+        configured: true,
+        endpoint: XAI_ENDPOINT,
+        model: XAI_MODEL,
+    };
+}