0xray 3.0.14 → 3.1.0

package/dist/integrations/hermes-agent/tools.py

@@ -10,9 +10,9 @@ Falls back to CLI (npx 0xray) when bridge is unavailable.
         return json.dumps({"error": str(e)})
 
 
-# ── Tool: strray_validate ─────────────────────────────────────
+# ── Tool: xray_validate ─────────────────────────────────────
 
-def strray_validate(args: dict, **kwargs) -> str:
+def xray_validate(args: dict, **kwargs) -> str:
     """Run pre-commit validation on files using the framework.
 
     Uses bridge for real quality gate + processor pipeline.
@@ -41,7 +41,7 @@ def strray_validate(args: dict, **kwargs) -> str:
         })
 
     # Fallback to CLI
-    result = json.loads(_run_strray(["validate"], timeout=30))
+    result = json.loads(_run_xray(["validate"], timeout=30))
     if "error" in result:
         return json.dumps(result)
 
@@ -54,10 +54,10 @@ def strray_validate(args: dict, **kwargs) -> str:
     })
 
 
-# ── Tool: strray_codex_check ──────────────────────────────────
+# ── Tool: xray_codex_check ──────────────────────────────────
 
-def strray_codex_check(args: dict, **kwargs) -> str:
-    """Check code against StringRay codex rules.
+def xray_codex_check(args: dict, **kwargs) -> str:
+    """Check code against Xray codex rules.
 
     Uses bridge for real quality gate codex checks.
     Falls back to CLI if bridge unavailable.
@@ -93,7 +93,7 @@ def strray_codex_check(args: dict, **kwargs) -> str:
             "focus_areas": focus_areas or "all",
             "code_length": len(code),
             "note": "Bridge unavailable — basic analysis only. "
-                   "Full codex validation available via MCP: mcp_strray_enforcer_codex_enforcement",
+                   "Full codex validation available via MCP: mcp_xray_enforcer_codex_enforcement",
             "via": "static",
         })
 
@@ -109,7 +109,7 @@ def strray_codex_check(args: dict, **kwargs) -> str:
             "via": "bridge",
         })
 
-    result = json.loads(_run_strray(["health"], timeout=15))
+    result = json.loads(_run_xray(["health"], timeout=15))
     if "error" in result:
         return json.dumps(result)
 
@@ -121,10 +121,10 @@ def strray_codex_check(args: dict, **kwargs) -> str:
     })
 
 
-# ── Tool: strray_health ───────────────────────────────────────
+# ── Tool: xray_health ───────────────────────────────────────
 
-def strray_health(args: dict, **kwargs) -> str:
-    """Check StringRay framework health via bridge.
+def xray_health(args: dict, **kwargs) -> str:
+    """Check Xray framework health via bridge.
 
     Returns framework status, loaded components, version.
     """
@@ -141,13 +141,13 @@ def strray_health(args: dict, **kwargs) -> str:
         })
 
     # Fallback to CLI
-    return _run_strray(["health"], timeout=15)
+    return _run_xray(["health"], timeout=15)
 
 
-# ── Tool: strray_hooks ───────────────────────────────────────
+# ── Tool: xray_hooks ───────────────────────────────────────
 
-def strray_hooks(args: dict, **kwargs) -> str:
-    """Manage StringRay git hooks.
+def xray_hooks(args: dict, **kwargs) -> str:
+    """Manage Xray git hooks.
 
     Actions: install, uninstall, list, status
     Uses bridge for hook management when available.
@@ -174,7 +174,7 @@ def strray_hooks(args: dict, **kwargs) -> str:
 
     # Fallback: direct file-based hook management
     git_hooks_dir = Path(_get_project_root()) / ".git" / "hooks"
-    strray_hooks_dir = Path(_get_project_root()) / "hooks"
+    xray_hooks_dir = Path(_get_project_root()) / "hooks"
 
     if not git_hooks_dir.exists():
         return json.dumps({"error": "Not a git repository", "via": "fallback"})
@@ -183,19 +183,19 @@ def strray_hooks(args: dict, **kwargs) -> str:
         result = {"managed": [], "missing": [], "external": [], "stale": []}
         for hook_name in hooks:
             git_hook = git_hooks_dir / hook_name
-            strray_hook = strray_hooks_dir / hook_name
+            xray_hook = xray_hooks_dir / hook_name
             if not git_hook.exists():
                 result["missing"].append(hook_name)
             else:
                 try:
                     content = git_hook.read_text()[:500]
-                    if "StringRay" in content or "strray" in content or "run-hook.js" in content:
+                    if "Xray" in content or "xray" in content or "strray" in content or "run-hook.js" in content:
                         result["managed"].append(hook_name)
                     else:
                         result["external"].append(hook_name)
                 except OSError:
                     result["external"].append(hook_name)
-            if not strray_hook.exists():
+            if not xray_hook.exists():
                 result["stale"].append(hook_name)
         return json.dumps({"status": "ok", "action": action, **result, "via": "fallback"})
 
@@ -203,7 +203,7 @@ def strray_hooks(args: dict, **kwargs) -> str:
         installed = []
         skipped = []
         for hook_name in hooks:
-            src = strray_hooks_dir / hook_name
+            src = xray_hooks_dir / hook_name
             dst = git_hooks_dir / hook_name
             if not src.exists():
                 skipped.append(hook_name)
@@ -212,8 +212,8 @@ def strray_hooks(args: dict, **kwargs) -> str:
                 if dst.exists():
                     try:
                         content = dst.read_text()[:500]
-                        if "StringRay" not in content and "strray" not in content:
-                            dst.rename(dst.with_suffix(".strray-backup"))
+                        if "Xray" not in content and "xray" not in content and "strray" not in content:
+                            dst.rename(dst.with_suffix(".xray-backup"))
                         else:
                             dst.unlink()
                     except OSError:
@@ -233,13 +233,13 @@ def strray_hooks(args: dict, **kwargs) -> str:
         restored = []
         for hook_name in hooks:
             dst = git_hooks_dir / hook_name
-            backup = dst.with_suffix(".strray-backup")
+            backup = dst.with_suffix(".xray-backup")
             if not dst.exists():
                 continue
             try:
                 content = dst.read_text()[:500]
-                is_strray = "StringRay" in content or "strray" in content or "run-hook.js" in content
-                if is_strray or dst.is_symlink():
+                is_xray = "Xray" in content or "xray" in content or "strray" in content or "run-hook.js" in content
+                if is_xray or dst.is_symlink():
                     dst.unlink()
                     if backup.exists():
                         shutil.move(str(backup), str(dst))

package/dist/integrations/plugins/plugin-registry.js

@@ -46,8 +46,8 @@ export class PluginRegistry extends EventEmitter {
     reloadDebounce = new Map();
     constructor(config = {}) {
         super();
-        this.pluginsDir = config.pluginsDir || ".strray/plugins";
-        this.configPath = config.configPath || ".strray/config/plugin-config.json";
+        this.pluginsDir = config.pluginsDir || ".xray/plugins";
+        this.configPath = config.configPath || ".xray/config/plugin-config.json";
         this.autoStart = config.autoStart ?? true;
         this.enableMetrics = config.enableMetrics ?? true;
         this.enableHotReload = config.enableHotReload ?? false;

package/dist/mcps/config/server-config-registry.js

@@ -16,20 +16,20 @@ import fs from 'fs';
 /**
  * Resolve the correct framework root and MCP servers path.
  * Priority:
- *   1. STRRAY_DEV_PATH env var (explicit dev override)
- *   2. The "strray" field in the nearest package.json that declares it (works in both source tree and installed package)
+ *   1. XRAY_DEV_PATH env var (explicit dev override)
+ *   2. The "xray" field in the nearest package.json that declares it (works in both source tree and installed package)
  *   3. Safe fallback to node_modules/0xray/dist
  */
 function resolveFrameworkPaths() {
     // Highest priority: explicit environment override
-    if (process.env.STRRAY_DEV_PATH) {
-        const devPath = process.env.STRRAY_DEV_PATH;
+    if (process.env.XRAY_DEV_PATH) {
+        const devPath = process.env.XRAY_DEV_PATH;
         return {
             frameworkRoot: devPath,
             mcpServersPath: join(devPath, 'mcps'),
         };
     }
-    // Walk upward from this module to find the package that owns the "strray" config
+    // Walk upward from this module to find the package that owns the "xray" config
     let currentDir = dirname(fileURLToPath(import.meta.url));
     // Safety limit to avoid walking the entire filesystem
     const MAX_LEVELS = 12;
@@ -38,10 +38,10 @@ function resolveFrameworkPaths() {
         if (fs.existsSync(pkgPath)) {
             try {
                 const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
-                if (pkg.name === '0xray' && pkg.strray) {
-                    const strrayCfg = pkg.strray;
+                if (pkg.name === '0xray' && pkg.xray) {
+                    const xrayCfg = pkg.xray;
                     const frameworkRoot = currentDir;
-                    const declaredMcp = strrayCfg.mcpServersPath || (strrayCfg.dist ? join(strrayCfg.dist, 'mcps') : 'dist/mcps');
+                    const declaredMcp = xrayCfg.mcpServersPath || (xrayCfg.dist ? join(xrayCfg.dist, 'mcps') : 'dist/mcps');
                     return {
                         frameworkRoot,
                         mcpServersPath: join(frameworkRoot, declaredMcp),
@@ -60,7 +60,7 @@ function resolveFrameworkPaths() {
     // Final fallback (should almost never be reached)
     const fallback = 'node_modules/0xray/dist';
     frameworkLogger.log('server-config-registry', 'using-fallback-path', 'warning', {
-        reason: 'Could not locate strray package.json with "strray" field',
+        reason: 'Could not locate xray package.json with "xray" field',
         fallback,
     });
     return {
@@ -323,7 +323,7 @@ export class ServerConfigRegistry {
     /**
      * Create a dynamic configuration for an unknown server
      * Uses the knowledge-skills directory as default location.
-     * Now respects the "strray" field declared in package.json.
+     * Now respects the "xray" field declared in package.json.
      */
     createDynamicConfig(serverName) {
         // Validate serverName against path traversal attacks

package/dist/mcps/connection/mcp-connection.js

@@ -52,7 +52,7 @@ export class McpConnection extends EventEmitter {
                     protocolVersion: MCP_PROTOCOL_VERSION,
                     capabilities: {},
                     clientInfo: {
-                        name: 'strray-mcp-client',
+                        name: 'xray-mcp-client',
                         version: '1.7.5',
                     },
                 },

package/dist/mcps/framework-help.server.js

@@ -21,7 +21,7 @@ class FrameworkHelpServer {
             return {
                 tools: [
                     {
-                        name: "strray_get_capabilities",
+                        name: "xray_get_capabilities",
                         description: "Get comprehensive list of all 0xRay framework capabilities, commands, and available tools",
                         inputSchema: {
                             type: "object",
@@ -43,7 +43,7 @@ class FrameworkHelpServer {
                         },
                     },
                     {
-                        name: "strray_get_commands",
+                        name: "xray_get_commands",
                         description: "Get list of available 0xRay commands and their usage",
                         inputSchema: {
                             type: "object",
@@ -63,7 +63,7 @@ class FrameworkHelpServer {
                         },
                     },
                     {
-                        name: "strray_explain_capability",
+                        name: "xray_explain_capability",
                         description: "Get detailed explanation of a specific 0xRay capability",
                         inputSchema: {
                             type: "object",
@@ -84,11 +84,11 @@ class FrameworkHelpServer {
             const { name, arguments: args } = request.params;
             try {
                 switch (name) {
-                    case "strray_get_capabilities":
+                    case "xray_get_capabilities":
                         return this.handleGetCapabilities(args);
-                    case "strray_get_commands":
+                    case "xray_get_commands":
                         return this.handleGetCommands(args);
-                    case "strray_explain_capability":
+                    case "xray_explain_capability":
                         return this.handleExplainCapability(args);
                     default:
                         throw new McpError(ErrorCode.MethodNotFound, `Unknown tool: ${name}`);

package/dist/mcps/knowledge-skills/code-review.server.js

@@ -10,6 +10,7 @@ import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextpro
 import * as fs from "fs";
 import * as path from "path";
 import { createGracefulShutdown } from "../../utils/shutdown-handler.js";
+import { tryLLMGovernance } from "../../governance/llm-governance-provider.js";
 class XrayCodeReviewServer {
     server;
     constructor() {
@@ -339,48 +340,22 @@ class XrayCodeReviewServer {
      */
     async analyzeProposal(args) {
         const { proposalTitle = "", proposalDescription = "", evidence = [], proposalType = "" } = args;
-        const text = `${proposalTitle} ${proposalDescription} ${evidence.join(" ")}`.toLowerCase();
-        let decision = "approve";
-        let confidence = 0.82;
-        let reasoning = "The proposal appears reasonable from a code quality and maintainability perspective.";
-        if (text.includes("aml") || text.includes("kyc") || text.includes("anti-money")) {
-            decision = "approve";
-            confidence = 0.88;
-            reasoning = "AML/KYC compliance code requires rigorous review: transaction monitoring must handle edge cases, avoid false positives from legitimate patterns, and maintain audit trails for regulatory inspection.";
-        }
-        else if (text.includes("psd2") || text.includes("strong customer authentication") || text.includes("payment initiation")) {
-            decision = "approve";
-            confidence = 0.90;
-            reasoning = "PSD2 SCA implementation must balance security with user experience. Code should use well-audited MFA libraries, avoid rolling custom authentication, and include comprehensive test coverage for all authentication flows.";
-        }
-        else if (text.includes("gdpr") || text.includes("right to erasure") || text.includes("data protection")) {
-            decision = "approve";
-            confidence = 0.92;
-            reasoning = "GDPR erasure pipelines require careful code review: cascading deletes must be transactional, audit logs must be preserved, and the 30-day SLA demands observability and monitoring integration.";
-        }
-        else if (text.includes("extract method")) {
-            decision = "approve";
-            confidence = 0.93;
-            reasoning = "Extract Method is a well-established refactoring pattern that improves readability and reduces cognitive load when applied consistently.";
-        }
-        else if (text.includes("test coverage")) {
-            decision = "approve";
-            confidence = 0.90;
-            reasoning = "Expanding automated test coverage generally improves long-term code health and reduces regression risk.";
-        }
-        else if (text.includes("increase timeout") && text.includes("flaky")) {
-            decision = "reject";
-            confidence = 0.72;
-            reasoning = "Repeatedly increasing timeouts to mask flaky tests is an anti-pattern that hides underlying race conditions or timing issues.";
-        }
-        if (proposalType === "fix" && text.includes("timeout")) {
-            confidence = Math.max(0.68, confidence - 0.08);
+        const vote = await tryLLMGovernance("code-review", proposalTitle, proposalDescription, evidence, proposalType);
+        if (!vote) {
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: "DECISION: abstain\nCONFIDENCE: 0.50\nREASONING: No LLM governance provider configured. Set XRAY_GOVERNANCE_LLM_ENABLED=true + XRAY_LLM_ENDPOINT, or install Hermes and run: hermes auth add xai-oauth --no-browser",
+                    },
+                ],
+            };
         }
         return {
             content: [
                 {
                     type: "text",
-                    text: `DECISION: ${decision}\nCONFIDENCE: ${confidence.toFixed(2)}\nREASONING: ${reasoning}`,
+                    text: `DECISION: ${vote.decision}\nCONFIDENCE: ${vote.confidence.toFixed(2)}\nREASONING: ${vote.reasoning}`,
                 },
             ],
         };

package/dist/mcps/knowledge-skills/security-audit.server.js

@@ -10,6 +10,7 @@ import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextpro
 import * as fs from "fs";
 import * as path from "path";
 import { createGracefulShutdown } from "../../utils/shutdown-handler.js";
+import { tryLLMGovernance } from "../../governance/llm-governance-provider.js";
 class XraySecurityAuditServer {
     server;
     constructor() {
@@ -777,53 +778,22 @@ class XraySecurityAuditServer {
      */
     async analyzeProposal(args) {
         const { proposalTitle = "", proposalDescription = "", evidence = [], proposalType = "" } = args;
-        const text = `${proposalTitle} ${proposalDescription} ${evidence.join(" ")}`.toLowerCase();
-        let decision = "approve";
-        let confidence = 0.82;
-        let reasoning = "The proposal does not appear to introduce significant new security surface area.";
-        if (text.includes("aml") || text.includes("kyc") || text.includes("anti-money")) {
-            decision = "approve";
-            confidence = 0.91;
-            reasoning = "AML/KYC compliance measures are critical for regulatory security posture. Automated transaction monitoring closes vulnerability gaps in financial crime detection and demonstrates due diligence for regulatory inspections.";
-        }
-        else if (text.includes("psd2") || text.includes("strong customer authentication") || text.includes("payment initiation")) {
-            decision = "approve";
-            confidence = 0.93;
-            reasoning = "PSD2 SCA implementation is a mandatory security control for payment services. Multi-factor authentication with dynamic linking reduces unauthorized payment risk and satisfies EBA regulatory technical standards.";
-        }
-        else if (text.includes("gdpr") || text.includes("right to erasure") || text.includes("data protection")) {
-            decision = "approve";
-            confidence = 0.94;
-            reasoning = "GDPR compliance controls are foundational to data security posture. Automated data erasure pipelines reduce data breach exposure windows and satisfy supervisory authority inspection requirements.";
-        }
-        else if (text.includes("beneficial ownership") || text.includes("ubo") || text.includes("pep screening")) {
-            decision = "approve";
-            confidence = 0.87;
-            reasoning = "Beneficial ownership transparency and PEP screening are critical AML controls. Verifying ultimate beneficial owners reduces money laundering risk through corporate account structuring.";
-        }
-        else if (text.includes("extract method")) {
-            decision = "approve";
-            confidence = 0.88;
-            reasoning = "Extract Method refactoring improves security posture by reducing attack surface in large monolithic files and enabling better isolation of sensitive logic.";
-        }
-        else if (text.includes("test coverage")) {
-            decision = "approve";
-            confidence = 0.91;
-            reasoning = "Expanding test coverage is one of the highest-ROI security controls available — more tests surface regressions and boundary condition vulnerabilities earlier.";
-        }
-        else if (text.includes("increase timeout") && text.includes("flaky")) {
-            decision = "reject";
-            confidence = 0.75;
-            reasoning = "Repeatedly increasing timeouts to hide flaky tests can mask timing attacks, race conditions, and resource exhaustion vulnerabilities. Root cause remediation is required.";
-        }
-        if (proposalType === "fix" && text.includes("timeout")) {
-            confidence = Math.max(0.65, confidence - 0.10);
+        const vote = await tryLLMGovernance("security-audit", proposalTitle, proposalDescription, evidence, proposalType);
+        if (!vote) {
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: "DECISION: abstain\nCONFIDENCE: 0.50\nREASONING: No LLM governance provider configured. Set XRAY_GOVERNANCE_LLM_ENABLED=true + XRAY_LLM_ENDPOINT, or install Hermes and run: hermes auth add xai-oauth --no-browser",
+                    },
+                ],
+            };
         }
         return {
             content: [
                 {
                     type: "text",
-                    text: `DECISION: ${decision}\nCONFIDENCE: ${confidence.toFixed(2)}\nREASONING: ${reasoning}`,
+                    text: `DECISION: ${vote.decision}\nCONFIDENCE: ${vote.confidence.toFixed(2)}\nREASONING: ${vote.reasoning}`,
                 },
             ],
         };

package/dist/mcps/knowledge-skills/ui-ux-design.server.js

@@ -1475,7 +1475,7 @@ Available: ${Object.keys(system.components).length} component types
     async run() {
         const transport = new StdioServerTransport();
         await this.server.connect(transport);
-        await frameworkLogger.log("ui-ux-design.server", "-strray-ui-ux-design-mcp-server-running-", "info", { message: "xray UI/UX Design MCP Server running..." });
+        await frameworkLogger.log("ui-ux-design.server", "-xray-ui-ux-design-mcp-server-running-", "info", { message: "xray UI/UX Design MCP Server running..." });
         const cleanup = async (signal) => {
             await frameworkLogger.log("ui-ux-design.server", "-received-signal-shutting-down-gracefully-", "info", { message: `Received ${signal}, shutting down gracefully...` });
             // Set a timeout to force exit if graceful shutdown fails
@@ -1488,7 +1488,7 @@ Available: ${Object.keys(system.components).length} component types
                     await this.server.close();
                 }
                 clearTimeout(timeout);
-                await frameworkLogger.log("ui-ux-design.server", "-strray-mcp-server-shut-down-gracefully-", "info", { message: "xray MCP Server shut down gracefully" });
+                await frameworkLogger.log("ui-ux-design.server", "-xray-mcp-server-shut-down-gracefully-", "info", { message: "xray MCP Server shut down gracefully" });
                 process.exit(0);
             }
             catch (error) {

package/dist/mcps/lint.server.js

@@ -20,7 +20,7 @@ class XrayLintServer {
             },
         });
         this.setupToolHandlers();
-        void frameworkLogger.log("lint.server", "-strray-lint-mcp-server-initialized-", "info", { message: "0xRay Lint MCP Server initialized" });
+        void frameworkLogger.log("lint.server", "-xray-lint-mcp-server-initialized-", "info", { message: "0xRay Lint MCP Server initialized" });
     }
     setupToolHandlers() {
         // List available tools
@@ -370,7 +370,7 @@ ${checkResults.details.map((d) => `• ${d}`).join("\n")}
     async run() {
         const transport = new StdioServerTransport();
         await this.server.connect(transport);
-        await frameworkLogger.log("lint.server", "-strray-lint-mcp-server-started-", "info", { message: "0xRay Lint MCP Server started" });
+        await frameworkLogger.log("lint.server", "-xray-lint-mcp-server-started-", "info", { message: "0xRay Lint MCP Server started" });
     }
 }
 // Start the server if run directly

package/dist/mcps/mcp-client.js

@@ -98,7 +98,7 @@ export class MCPClient extends EventEmitter {
      * Pure MCP mode — simulation and generic fallbacks are disabled.
      */
     get isPureMcpMode() {
-        return process.env.STRRAY_FORCE_MCP_GOVERNANCE === 'true';
+        return process.env.XRAY_FORCE_MCP_GOVERNANCE === 'true';
     }
     /**
      * Register default simulation implementations
@@ -267,17 +267,17 @@ export class MCPClient extends EventEmitter {
             ],
             'framework-help': [
                 {
-                    name: 'strray_get_capabilities',
+                    name: 'xray_get_capabilities',
                     description: 'Get 0xRay framework capabilities',
                     inputSchema: { type: 'object', properties: {} },
                 },
                 {
-                    name: 'strray_get_commands',
+                    name: 'xray_get_commands',
                     description: 'Get available 0xRay commands',
                     inputSchema: { type: 'object', properties: {} },
                 },
                 {
-                    name: 'strray_explain_capability',
+                    name: 'xray_explain_capability',
                     description: 'Explain a specific capability',
                     inputSchema: {
                         type: 'object',
@@ -375,7 +375,7 @@ export class MCPClient extends EventEmitter {
             // === LAST RESORT: Generic fallback (disabled in pure mode) ===
             if (this.isPureMcpMode) {
                 throw new Error(`[PURE MCP] No real response for ${serverName}/${toolName}. ` +
-                    `All fallbacks are disabled when STRRAY_FORCE_MCP_GOVERNANCE=true.`);
+                    `All fallbacks are disabled when XRAY_FORCE_MCP_GOVERNANCE=true.`);
             }
             const fallbackResult = {
                 content: [

package/dist/mcps/orchestrator/server.js

@@ -8,7 +8,7 @@ import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { CallToolRequestSchema, ListToolsRequestSchema, } from '@modelcontextprotocol/sdk/types.js';
 import { frameworkLogger } from '../../core/framework-logger.js';
-import { StringRayStateManager } from '../../state/state-manager.js';
+import { XrayStateManager } from '../../state/state-manager.js';
 import { MultiAgentOrchestrationCoordinator } from '../../orchestrator/multi-agent-orchestration-coordinator.js';
 import { TaskHandler } from './handlers/task-handler.js';
 import { ComplexityHandler } from './handlers/complexity-handler.js';
@@ -29,7 +29,7 @@ export class OrchestratorServer {
     coordinator;
     constructor() {
         // Initialize actual coordinator
-        const stateManager = new StringRayStateManager();
+        const stateManager = new XrayStateManager();
         this.coordinator = new MultiAgentOrchestrationCoordinator(stateManager);
         // Initialize handlers
         this.taskHandler = new TaskHandler();

package/dist/mcps/researcher.server.js

@@ -13,6 +13,7 @@ import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextpro
 import * as fs from "fs";
 import * as path from "path";
 import { frameworkLogger } from "../core/framework-logger.js";
+import { tryLLMGovernance } from "../governance/llm-governance-provider.js";
 class XrayLibrarianServer {
     server;
     constructor() {
@@ -400,48 +401,22 @@ class XrayLibrarianServer {
      */
     async analyzeProposal(args) {
         const { proposalTitle = "", proposalDescription = "", evidence = [], proposalType = "" } = args || {};
-        const text = `${proposalTitle} ${proposalDescription} ${(evidence || []).join(" ")}`.toLowerCase();
-        let decision = "approve";
-        let confidence = 0.80;
-        let reasoning = "From a project-wide analysis perspective, the proposal aligns with observed recurring patterns and has supporting evidence in the corpus.";
-        if (text.includes("aml") || text.includes("kyc") || text.includes("anti-money")) {
-            decision = "approve";
-            confidence = 0.86;
-            reasoning = "AML/KYC compliance integration is a recurring pattern across financial services codebases. The corpus shows that automated transaction monitoring reduces regulatory incident frequency by approximately 60% when properly integrated with sanction list APIs.";
-        }
-        else if (text.includes("psd2") || text.includes("strong customer authentication") || text.includes("payment initiation")) {
-            decision = "approve";
-            confidence = 0.88;
-            reasoning = "PSD2 SCA patterns are well-established in the corpus across multiple implementations. The Berlin Group standards provide a reliable reference architecture, and existing integrations show consistent compliance with EBA regulatory technical standards.";
-        }
-        else if (text.includes("gdpr") || text.includes("right to erasure") || text.includes("data protection")) {
-            decision = "approve";
-            confidence = 0.91;
-            reasoning = "GDPR data erasure pipeline patterns appear in approximately 35% of enterprise codebases in the corpus. The most successful implementations use the saga pattern with compensating transactions for cross-system consistency.";
-        }
-        else if (text.includes("extract method")) {
-            decision = "approve";
-            confidence = 0.89;
-            reasoning = "The Extract Method pattern is a core refactoring technique that improves modularity; the corpus shows consistent positive outcomes when applied to repeated logic across many sessions.";
-        }
-        else if (text.includes("test coverage")) {
-            decision = "approve";
-            confidence = 0.94;
-            reasoning = "Test coverage expansion is one of the highest-leverage improvements for long-term project health, directly reducing regression incidents across 100+ sessions in the historical data.";
-        }
-        else if (text.includes("technical debt")) {
-            decision = "approve";
-            confidence = 0.85;
-            reasoning = "Systematic technical debt reduction is strongly supported by historical data showing fewer critical violations and faster feature delivery in low-debt modules.";
-        }
-        if (proposalType === "fix" && !text.includes("pattern") && !text.includes("recurring")) {
-            confidence = Math.max(0.68, confidence - 0.10);
+        const vote = await tryLLMGovernance("researcher", proposalTitle || "", proposalDescription || "", evidence || [], proposalType || "");
+        if (!vote) {
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: "DECISION: abstain\nCONFIDENCE: 0.50\nREASONING: No LLM governance provider configured. Set XRAY_GOVERNANCE_LLM_ENABLED=true + XRAY_LLM_ENDPOINT, or install Hermes and run: hermes auth add xai-oauth --no-browser",
+                    },
+                ],
+            };
         }
         return {
             content: [
                 {
                     type: "text",
-                    text: `DECISION: ${decision}\nCONFIDENCE: ${confidence.toFixed(2)}\nREASONING: ${reasoning}`,
+                    text: `DECISION: ${vote.decision}\nCONFIDENCE: ${vote.confidence.toFixed(2)}\nREASONING: ${vote.reasoning}`,
                 },
             ],
         };

package/dist/mcps/simulation/server-simulations.js

@@ -73,7 +73,7 @@ export const researcherSimulations = {
  * Framework Help server simulations
  */
 export const frameworkHelpSimulations = {
-    strray_get_capabilities: () => ({
+    xray_get_capabilities: () => ({
         content: [
             {
                 type: 'text',
@@ -104,7 +104,7 @@ export const frameworkHelpSimulations = {
             },
         ],
     }),
-    strray_get_commands: () => ({
+    xray_get_commands: () => ({
         content: [
             {
                 type: 'text',
@@ -131,7 +131,7 @@ framework-reporting-system - Generate comprehensive framework reports
             },
         ],
     }),
-    strray_explain_capability: () => ({
+    xray_explain_capability: () => ({
         content: [
             {
                 type: 'text',

package/dist/orchestrator/enhanced-multi-agent-orchestrator.js

@@ -2,7 +2,7 @@
  * Enhanced Multi-Agent Orchestration with Clickable Monitoring
  * Integrates subagent spawning visibility and lifecycle management
  */
-import { StringRayStateManager } from "../state/state-manager.js";
+import { XrayStateManager } from "../state/state-manager.js";
 import { frameworkLogger } from "../core/framework-logger.js";
 import { ComplexityAnalyzer, } from "../delegation/complexity-analyzer.js";
 import { createAgentDelegator, } from "../delegation/agent-delegator.js";
@@ -17,7 +17,7 @@ export class EnhancedMultiAgentOrchestrator {
     executionContext;
     cleanupTimer = null;
     constructor(stateManager, isMainOrchestrator = false) {
-        this.stateManager = stateManager || new StringRayStateManager();
+        this.stateManager = stateManager || new XrayStateManager();
         this.complexityAnalyzer = new ComplexityAnalyzer();
         this.agentDelegator = createAgentDelegator(this.stateManager, strRayConfigLoader);
         this.state = {