0xray 3.0.3 → 3.0.6

package/.mcp.json

@@ -0,0 +1,14 @@
+{
+  "mcpServers": {
+    "xray-skills": {
+      "command": "npx",
+      "args": ["-y", "0xray", "mcp", "skills"],
+      "description": "13 developer tools: code review, security audit, API design, database design, project analysis, testing strategy, performance optimization, UI/UX design, DevOps deployment, documentation generation, storyteller, and more. Works standalone — no configuration needed."
+    },
+    "xray-governance": {
+      "command": "npx",
+      "args": ["-y", "0xray", "mcp", "governance"],
+      "description": "[Advanced] Multi-skill governance orchestrator — runs proposals through code-review, security-audit, researcher + external Dynamo Solar SSOT. Requires additional setup (see docs)."
+    }
+  }
+}

package/.opencode/codex.codex

@@ -1,5 +1,5 @@
 {
-  "version": "3.0.3",
+  "version": "3.0.5",
   "terms": [
      1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68
   ],

package/.opencode/commands/dependency-audit.md

@@ -69,7 +69,7 @@ Comprehensive dependency analysis and security audit for all project dependencie
   "vulnerabilities": [
     {
       "package": "lodash",
-      "version": "3.0.3",
+      "version": "3.0.5",
       "severity": "high",
       "cve": "CVE-2021-23337",
       "description": "Command injection vulnerability"
@@ -85,14 +85,14 @@ Security-focused format for CI/CD integration:
 
 ```json
 {
-  "version": "3.0.3",
+  "version": "3.0.5",
   "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
   "runs": [
     {
       "tool": {
         "driver": {
           "name": "Dependency Audit",
-          "version": "3.0.3"
+          "version": "3.0.5"
         }
       },
       "results": [...]

package/.opencode/enforcer-config.json

@@ -1,6 +1,6 @@
 {
   "framework": "xray 3.0",
-  "version": "3.0.3",
+  "version": "3.0.5",
   "description": "Codex-compliant framework configuration for Credible UI project",
   "thresholds": {
     "bundleSize": {
@@ -220,7 +220,7 @@
       }
     },
     "codex": {
-      "version": "3.0.3",
+      "version": "3.0.5",
       "terms": [
         1,
         2,

package/.opencode/init.sh

@@ -9,20 +9,17 @@ else
     PROJECT_ROOT=$(realpath "$SCRIPT_DIR/..")
 fi
 
-# Try to find framework package.json - check source first (dev), then node_modules (consumer)
-# For development, prefer the source version over node_modules
-# Need to handle both root-level and .opencode/ subdirectory runs
-SOURCE_PACKAGE_JSON="$SCRIPT_DIR/package.json"
-if [ ! -f "$SOURCE_PACKAGE_JSON" ] && [ -f "$PROJECT_ROOT/package.json" ]; then
-    SOURCE_PACKAGE_JSON="$PROJECT_ROOT/package.json"
-fi
+# Detect mode: dev (xray repo) vs consumer (npm dependency)
+# - Dev: PROJECT_ROOT has src/core/boot-orchestrator.ts (xray source)
+# - Consumer: node_modules/0xray/package.json exists
+# - Fallback: no xray found at all
 NODE_MODULES_PACKAGE_JSON="$PROJECT_ROOT/node_modules/0xray/package.json"
 
-if [ -f "$SOURCE_PACKAGE_JSON" ]; then
-    # Development mode: use source version (project root)
+if [ -f "$PROJECT_ROOT/src/core/boot-orchestrator.ts" ]; then
+    # Development mode: running inside the xray repo itself
     FRAMEWORK_ROOT="$PROJECT_ROOT"
 elif [ -f "$NODE_MODULES_PACKAGE_JSON" ]; then
-    # Consumer mode: use installed version
+    # Consumer mode: 0xray installed as npm dependency
     FRAMEWORK_ROOT="$PROJECT_ROOT/node_modules/0xray"
 else
     FRAMEWORK_ROOT="$PROJECT_ROOT"

package/.opencode/plugin/xray-codex-injection.js

@@ -0,0 +1,624 @@
+/**
+ * Consumer runtime compat (xray codex injection + XRAY_ env + .xray fallbacks).
+ */
+import * as fs from "fs";
+import * as path from "path";
+import { spawn } from "child_process";
+import { beforeToolHook, afterToolHook } from '../integrations/enforcement-gate.js';
+// ---------------------------------------------------------------------------
+// Dynamic module holders (loaded via candidate-based resolution)
+// ---------------------------------------------------------------------------
+let _resolveCodexPath = null;
+let _resolveStateDir = null;
+let _frameworkLogger = null;
+let _systemPromptGenerator = null;
+let _featuresConfigLoader = null;
+let _detectTaskType = null;
+// ---------------------------------------------------------------------------
+// Module loaders (candidate-based resolution for dev, dist, and consumer paths)
+// ---------------------------------------------------------------------------
+async function loadFrameworkLogger() {
+    if (_frameworkLogger)
+        return _frameworkLogger;
+    const candidates = [
+        "../core/framework-logger.js",
+        "../../node_modules/0xray/dist/core/framework-logger.js",
+    ];
+    for (const p of candidates) {
+        try {
+            const mod = await import(p);
+            _frameworkLogger = mod.frameworkLogger;
+            return _frameworkLogger;
+        }
+        catch (_) {
+            // try next candidate
+        }
+    }
+    _frameworkLogger = {
+        log: (_module, _event, _status, _data) => { },
+    };
+    return _frameworkLogger;
+}
+async function loadConfigPaths() {
+    if (_resolveCodexPath && _resolveStateDir)
+        return;
+    const candidates = [
+        "../core/config-paths.js",
+        "../../node_modules/0xray/dist/core/config-paths.js",
+    ];
+    for (const p of candidates) {
+        try {
+            const mod = await import(p);
+            _resolveCodexPath = mod.resolveCodexPath;
+            _resolveStateDir = mod.resolveStateDir;
+            return;
+        }
+        catch (_) {
+            // try next candidate
+        }
+    }
+    const logger = await loadFrameworkLogger();
+    logger.log("xray-codex-plugin", "config-paths-load-failed", "warning", { warning: "Failed to load config-paths module from any location" });
+}
+async function resolveCodexPath(root) {
+    await loadConfigPaths();
+    if (!_resolveCodexPath)
+        throw new Error("resolveCodexPath not available after loading");
+    return _resolveCodexPath(root);
+}
+async function resolveStateDir(root) {
+    await loadConfigPaths();
+    if (!_resolveStateDir)
+        throw new Error("resolveStateDir not available after loading");
+    return _resolveStateDir(root);
+}
+async function importSystemPromptGenerator() {
+    if (_systemPromptGenerator)
+        return;
+    const candidates = [
+        "../core/system-prompt-generator.js",
+        "../../node_modules/0xray/dist/core/system-prompt-generator.js",
+    ];
+    for (const p of candidates) {
+        try {
+            const module = await import(p);
+            _systemPromptGenerator = module.generateLeanSystemPrompt;
+            return;
+        }
+        catch (_) {
+            // try next candidate
+        }
+    }
+    const logger = await loadFrameworkLogger();
+    logger.log("xray-codex-plugin", "system-prompt-generator-load-failed", "warning", { warning: "Failed to load lean system prompt generator, using fallback" });
+}
+function validateModulePath(resolvedPath, allowedPrefix) {
+    const normalized = path.resolve(resolvedPath);
+    const allowed = path.resolve(allowedPrefix);
+    if (!normalized.startsWith(allowed)) {
+        throw new Error(`Module path validation failed: ${normalized} is outside allowed path ${allowed}`);
+    }
+}
+async function loadXrayComponents() {
+    if (_featuresConfigLoader)
+        return;
+    const logger = await getOrCreateLogger(process.cwd());
+    try {
+        const root = process.cwd();
+        const distPrefix = path.join(root, 'dist');
+        validateModulePath(`${root}/dist/core/features-config.js`, distPrefix);
+        const featuresModule = await import(`${root}/dist/core/features-config.js`);
+        _featuresConfigLoader = featuresModule.featuresConfigLoader;
+        _detectTaskType = featuresModule.detectTaskType;
+        logger.log(`✅ Loaded from cwd/dist/`);
+        return;
+    }
+    catch (e) {
+        const message = e instanceof Error ? e.message : String(e);
+        logger.log(`❌ Failed to load from cwd/dist/: ${message}`);
+    }
+    const pluginPaths = ["0xray"];
+    for (const pluginPath of pluginPaths) {
+        try {
+            const nodeModulesPrefix = path.join(process.cwd(), 'node_modules');
+            validateModulePath(`${process.cwd()}/node_modules/${pluginPath}/dist/core/features-config.js`, nodeModulesPrefix);
+            const fm = await import(`${process.cwd()}/node_modules/${pluginPath}/dist/core/features-config.js`);
+            _featuresConfigLoader = fm.featuresConfigLoader;
+            _detectTaskType = fm.detectTaskType;
+            logger.log(`✅ Loaded from node_modules/${pluginPath}/dist/`);
+            return;
+        }
+        catch (e) {
+            const message = e instanceof Error ? e.message : String(e);
+            logger.log(`❌ Failed to load from node_modules/${pluginPath}/dist/: ${message}`);
+        }
+    }
+}
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+function spawnPromise(command, args, cwd) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(command, args, {
+            cwd,
+            stdio: ["ignore", "inherit", "pipe"],
+        });
+        let stderr = "";
+        if (child.stderr) {
+            child.stderr.on("data", (data) => {
+                stderr += data.toString();
+            });
+        }
+        child.on("close", (code) => {
+            if (code === 0) {
+                resolve({ stdout: "", stderr });
+            }
+            else {
+                reject(new Error(`Process exited with code ${code}: ${stderr}`));
+            }
+        });
+        child.on("error", (error) => {
+            reject(error);
+        });
+    });
+}
+class PluginLogger {
+    logPath;
+    constructor(directory) {
+        const logsDir = path.join(directory, ".opencode", "logs");
+        if (!fs.existsSync(logsDir)) {
+            fs.mkdirSync(logsDir, { recursive: true });
+        }
+        const today = new Date().toISOString().split("T")[0];
+        this.logPath = path.join(logsDir, `xray-plugin-${today}.log`);
+    }
+    async logAsync(message) {
+        try {
+            const timestamp = new Date().toISOString();
+            const logEntry = `[${timestamp}] ${message}\n`;
+            await fs.promises.appendFile(this.logPath, logEntry, "utf-8");
+        }
+        catch {
+            // Silent fail - logging failure should not break plugin
+        }
+    }
+    log(message) {
+        void this.logAsync(message);
+    }
+    warn(message) {
+        this.log(`WARN: ${message}`);
+    }
+    error(message, error) {
+        const errorDetail = error instanceof Error ? `: ${error.message}` : "";
+        this.log(`ERROR: ${message}${errorDetail}`);
+    }
+}
+let loggerInstance = null;
+let loggerInitPromise = null;
+async function getOrCreateLogger(directory) {
+    if (loggerInstance) {
+        return loggerInstance;
+    }
+    if (loggerInitPromise) {
+        return loggerInitPromise;
+    }
+    loggerInitPromise = (async () => {
+        const logger = new PluginLogger(directory);
+        loggerInstance = logger;
+        return logger;
+    })();
+    return loggerInitPromise;
+}
+function getFrameworkVersion() {
+    try {
+        const packageJsonPath = path.join(process.cwd(), "package.json");
+        const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, "utf-8"));
+        return packageJson.version || "1.4.6";
+    }
+    catch {
+        return "1.4.6";
+    }
+}
+function getFrameworkIdentity() {
+    const version = getFrameworkVersion();
+    return `0xRay Framework v${version} - AI Orchestration
+
+🔧 Core: architect, code-reviewer, refactorer, testing-lead, strategist
+📚 Codex: 5 Essential Terms (99.6% Error Prevention Target)
+🎯 Goal: Progressive, production-ready development workflow
+
+📖 Documentation: config dir (codex, config, agents docs) — resolved via config-paths
+`;
+}
+let cachedCodexContexts = null;
+async function getCodexFileLocations(directory) {
+    const root = directory || process.cwd();
+    const resolved = await resolveCodexPath(root);
+    resolved.push(path.join(root, ".opencode", "codex.codex"), path.join(root, ".xray", "agents_template.md"), path.join(root, ".opencode", "xray", "agents_template.md"), path.join(root, "AGENTS.md"));
+    return resolved;
+}
+function readFileContent(filePath) {
+    try {
+        return fs.readFileSync(filePath, "utf-8");
+    }
+    catch (error) {
+        const logger = new PluginLogger(process.cwd());
+        logger.error(`Failed to read file ${filePath}`, error);
+        return null;
+    }
+}
+function extractCodexMetadata(content) {
+    if (content.trim().startsWith("{")) {
+        try {
+            const parsed = JSON.parse(content);
+            const version = parsed.version || "1.6.0";
+            const terms = parsed.terms || {};
+            const termCount = Object.keys(terms).length;
+            return { version, termCount };
+        }
+        catch {
+            // Not valid JSON, try markdown format
+        }
+    }
+    const versionMatch = content.match(/\*\*Version\*\*:\s*(\d+\.\d+\.\d+)/);
+    const version = versionMatch?.[1] ?? "1.6.0";
+    const termMatches = content.match(/####\s*\d+\.\s/g);
+    const termCount = termMatches ? termMatches.length : 0;
+    return { version, termCount };
+}
+function createCodexContextEntry(filePath, content) {
+    const metadata = extractCodexMetadata(content);
+    return {
+        id: `xray-codex-${path.basename(filePath)}`,
+        source: filePath,
+        content,
+        priority: "critical",
+        metadata: {
+            version: metadata.version,
+            termCount: metadata.termCount,
+            loadedAt: new Date().toISOString(),
+        },
+    };
+}
+async function loadCodexContext(directory) {
+    if (cachedCodexContexts) {
+        return cachedCodexContexts;
+    }
+    const codexContexts = [];
+    const locations = await getCodexFileLocations(directory);
+    for (const fileLocation of locations) {
+        const fullPath = path.isAbsolute(fileLocation) ? fileLocation : path.join(directory, fileLocation);
+        const content = readFileContent(fullPath);
+        if (content && content.trim().length > 0) {
+            const entry = createCodexContextEntry(fullPath, content);
+            if (entry.metadata.termCount > 0) {
+                codexContexts.push(entry);
+            }
+        }
+    }
+    cachedCodexContexts = codexContexts;
+    if (codexContexts.length === 0) {
+        void getOrCreateLogger(directory).then((l) => l.error(`No valid codex files found. Checked: ${locations.join(", ")}`));
+    }
+    return codexContexts;
+}
+function formatCodexContext(contexts) {
+    if (contexts.length === 0) {
+        return "";
+    }
+    const parts = [];
+    for (const context of contexts) {
+        parts.push(`# 0xRay Codex Context v${context.metadata.version}`, `Source: ${context.source}`, `Terms Loaded: ${context.metadata.termCount}`, `Loaded At: ${context.metadata.loadedAt}`, "", context.content, "", "---", "");
+    }
+    return parts.join("\n");
+}
+// ---------------------------------------------------------------------------
+// Analytics and task classification
+// ---------------------------------------------------------------------------
+const INFERENCE_TUNE_INTERVAL = 100;
+let _openCodeToolCallCount = 0;
+let _lastTuneToolCallCount = 0;
+const TOOL_AGENT_MAP = {
+    write: { agent: "code-reviewer", skill: "write" },
+    edit: { agent: "code-reviewer", skill: "edit" },
+    multiedit: { agent: "code-reviewer", skill: "multiedit" },
+    bash: { agent: "testing-lead", skill: "execution" },
+    search: { agent: "researcher", skill: "search" },
+    read: { agent: "researcher", skill: "read" },
+    glob: { agent: "researcher", skill: "glob" },
+    grep: { agent: "researcher", skill: "search" },
+    ls: { agent: "researcher", skill: "list" },
+};
+function classifyTaskType(tool, args) {
+    const cmd = String(args?.command ?? "").toLowerCase().trim();
+    if (tool === "bash" && cmd) {
+        if (/(npm|yarn|pnpm)\s+test|jest|vitest|mocha|pytest/.test(cmd))
+            return "testing";
+        if (/(npm|yarn|pnpm)\s+run|npx|cargo|go run|make\s/.test(cmd))
+            return "build";
+        if (/audit|security|snyk|owasp|bandit/.test(cmd))
+            return "security";
+        if (/eslint|prettier|black|ruff|lint|format/.test(cmd))
+            return "lint";
+        if (/git\s/.test(cmd))
+            return "git";
+        if (/(npm|yarn|pnpm)\s+install|pip install|cargo add/.test(cmd))
+            return "install";
+        if (/grep|rg |find |ls |cat |head |tail /.test(cmd))
+            return "search";
+    }
+    if (tool === "write")
+        return "write";
+    if (tool === "edit" || tool === "multiedit")
+        return "edit";
+    if (tool === "read")
+        return "read";
+    if (tool === "search" || tool === "grep" || tool === "glob")
+        return "search";
+    return "unknown";
+}
+// ---------------------------------------------------------------------------
+// Shared helpers extracted from duplicated plugin logic
+// ---------------------------------------------------------------------------
+function isWriteEditOperation(tool) {
+    return tool === "write" || tool === "edit" || tool === "multiedit";
+}
+function resolveAgentName(input) {
+    const globalAgent = globalThis.currentAgent;
+    if (globalAgent?.agentType)
+        return globalAgent.agentType;
+    if (globalAgent?.type)
+        return globalAgent.type;
+    if (input?.agentType)
+        return input.agentType;
+    return "architect";
+}
+// ---------------------------------------------------------------------------
+// Feature detection helpers
+// Main plugin function
+// ---------------------------------------------------------------------------
+export default async function xrayCodexPlugin(input) {
+    const { directory: inputDirectory } = input;
+    const directory = inputDirectory || process.cwd();
+    return {
+        "experimental.chat.system.transform": async (_input, output) => {
+            try {
+                await importSystemPromptGenerator();
+                let leanPrompt = getFrameworkIdentity();
+                if (_systemPromptGenerator) {
+                    leanPrompt = await _systemPromptGenerator({
+                        showWelcomeBanner: true,
+                        showCodexContext: false,
+                        enableTokenOptimization: true,
+                        maxTokenBudget: 8192,
+                        showCriticalTermsOnly: true,
+                        showEssentialLinks: true,
+                    });
+                }
+                if (output.system && Array.isArray(output.system)) {
+                    output.system = [leanPrompt];
+                }
+            }
+            catch (error) {
+                const logger = await getOrCreateLogger(directory);
+                logger.error("System prompt injection failed:", error);
+                const fallback = getFrameworkIdentity();
+                if (output.system && Array.isArray(output.system)) {
+                    output.system = [fallback];
+                }
+            }
+        },
+        "tool.execute.before": async (input, output) => {
+            const logger = await getOrCreateLogger(directory);
+            logger.log(`🚀 TOOL EXECUTE BEFORE HOOK FIRED: ${input.tool}`);
+            logger.log(`📥 Full input: ${JSON.stringify(input)}`);
+            await loadXrayComponents();
+            if (_featuresConfigLoader && _detectTaskType) {
+                try {
+                    const config = _featuresConfigLoader.loadConfig();
+                    if (config.model_routing?.enabled) {
+                        const taskType = _detectTaskType(input.tool);
+                        const routing = taskType !== "unknown"
+                            ? config.model_routing.task_routing?.[taskType]
+                            : undefined;
+                        if (routing?.model) {
+                            output.model = routing.model;
+                            logger.log(`Model routed: ${input.tool} → ${taskType} → ${routing.model}`);
+                        }
+                    }
+                }
+                catch (e) {
+                    logger.error("Model routing error", e);
+                }
+            }
+            const { tool, args } = input;
+            const gateResult = await beforeToolHook(tool, args);
+            if (gateResult.blocked) {
+                const msgs = gateResult.violations.map(v => `[${v.severity}] ${v.message}`).join("; ");
+                logger.error(`🚫 Enforcement gate blocked: ${msgs}`);
+                throw new Error(`ENFORCER BLOCKED: ${msgs}`);
+            }
+            if (gateResult.violations.length > 0) {
+                logger.warn(`⚠️ Enforcement gate: ${gateResult.violations.length} warning(s), resonance=${gateResult.resonance.toFixed(2)}`);
+            }
+            logger.log(`✅ Enforcement gate passed for ${tool}`);
+            if (isWriteEditOperation(tool)) {
+                logger.log(`🔧 Processors delegated to enforcement gate for ${tool}`);
+            }
+        },
+        "tool.execute.after": async (input, _output) => {
+            const logger = await getOrCreateLogger(directory);
+            await loadXrayComponents();
+            const { tool, args, result } = input;
+            try {
+                const { routingOutcomeTracker } = await import("../delegation/analytics/outcome-tracker.js");
+                const mapping = TOOL_AGENT_MAP[tool];
+                const taskType = classifyTaskType(tool, args);
+                const rawDesc = args?.content
+                    ? String(args.content).slice(0, 150)
+                    : args?.filePath
+                        ? String(args.filePath)
+                        : args?.command
+                            ? String(args.command).slice(0, 150)
+                            : tool;
+                const description = `[${taskType}] ${rawDesc}`;
+                const outcomeFields = {
+                    taskId: `opencode-${_openCodeToolCallCount}`,
+                    taskDescription: description,
+                    routedAgent: mapping?.agent ?? "direct",
+                    routedSkill: mapping?.skill ?? tool,
+                    confidence: mapping ? 0.8 : 0.5,
+                    success: result?.error == null,
+                    routingMethod: mapping ? "keyword" : "default",
+                };
+                if (taskType !== "unknown")
+                    outcomeFields.taskType = taskType;
+                routingOutcomeTracker.recordOutcome(outcomeFields);
+            }
+            catch {
+                // Outcome tracker not available — skip silently
+            }
+            logger.log(`📥 After hook input: ${JSON.stringify({ tool, hasArgs: !!args, args, hasResult: !!result }).slice(0, 200)}`);
+            // Run enforcement after-hook for code-producing tools
+            if (tool && (tool.includes('write') || tool.includes('edit') || tool.includes('create') || tool.includes('modify'))) {
+                try {
+                    const afterResult = await afterToolHook(tool, args, result, null);
+                    if (afterResult.processorResults.length > 0) {
+                        logger.log(`📊 Post-tool processors: ${afterResult.processorResults.filter(r => r.success).length}/${afterResult.processorResults.length} passed`);
+                    }
+                    if (afterResult.governanceTriggered) {
+                        logger.log(`🏛️ Governance cycle triggered from ${tool} output`);
+                    }
+                }
+                catch (e) {
+                    logger.log(`⚠️ Post-tool enforcement hook skipped: ${e instanceof Error ? e.message : String(e)}`);
+                }
+            }
+            _openCodeToolCallCount++;
+            if (_openCodeToolCallCount - _lastTuneToolCallCount >= INFERENCE_TUNE_INTERVAL) {
+                _lastTuneToolCallCount = _openCodeToolCallCount;
+                try {
+                    const { inferenceTuner } = await import("../services/inference-tuner.js");
+                    inferenceTuner
+                        .runTuningCycle()
+                        .then(() => {
+                        logger.log(`🔄 Inference tuning cycle completed (call #${_openCodeToolCallCount})`);
+                    })
+                        .catch((err) => {
+                        logger.log(`⚠️ Inference tuning cycle skipped: ${err instanceof Error ? err.message : String(err)}`);
+                    });
+                }
+                catch {
+                    // Tuner not available in this environment — skip silently
+                }
+                // DISABLED: Auto governance proposal voting causes runaway token consumption
+                // See bug fix: inference cycle auto-trigger disabled to prevent recursive
+                // opencode process spawning via invokeViaOpencode() → architect → task subagents
+                //
+                // try {
+                //   const { InferenceCycle } = await import(
+                //     "../inference/inference-cycle.js"
+                //   );
+                //   const cycle = new InferenceCycle(directory);
+                //   cycle.maybeRunCycle()...
+                // } catch {}
+            }
+        },
+        "chat.message": async (input, output) => {
+            const logger = await getOrCreateLogger(directory);
+            if (!output.parts) {
+                return;
+            }
+            const textContent = input.parts?.find(p => p.type === "text")?.text ?? "";
+            if (!textContent) {
+                return;
+            }
+            const agentMentionRegex = /@(\w+)(?:\s+(.+?))?(?=$|\n\n|\r\r)/g;
+            let match;
+            let hasAgentMention = false;
+            let transformedText = textContent;
+            const knownAgents = {
+                "architect": "architect",
+                "strategist": "strategist",
+                "testing-lead": "testing-lead",
+                "bug-triage-specialist": "bug-triage-specialist",
+                "code-reviewer": "code-reviewer",
+                "security-auditor": "security-auditor",
+                "refactorer": "refactorer",
+                "researcher": "researcher",
+                "code-analyzer": "code-analyzer",
+                "frontend-engineer": "frontend-engineer",
+                "frontend-ui-ux-engineer": "frontend-ui-ux-engineer",
+                "backend-engineer": "backend-engineer",
+                "database-engineer": "database-engineer",
+                "devops-engineer": "devops-engineer",
+                "performance-engineer": "performance-engineer",
+                "mobile-developer": "mobile-developer",
+                "content-creator": "content-creator",
+                "growth-strategist": "growth-strategist",
+                "seo-consultant": "seo-consultant",
+                "tech-writer": "tech-writer",
+                "multimodal-looker": "multimodal-looker",
+                "log-monitor": "log-monitor",
+            };
+            while ((match = agentMentionRegex.exec(textContent)) !== null) {
+                const agentName = match[1].toLowerCase().replace(/-/g, "");
+                const taskPart = match[2]?.trim() ?? "";
+                if (knownAgents[agentName]) {
+                    hasAgentMention = true;
+                    const canonicalAgent = knownAgents[agentName];
+                    logger.log(`🎯 Agent mention detected: @${canonicalAgent}`);
+                    const prefix = `\n[DELEGATE TO AGENT: ${canonicalAgent}]\n`;
+                    transformedText = prefix + (taskPart || textContent.replace(`@${match[1]}`, "").trim());
+                    break;
+                }
+            }
+            if (hasAgentMention) {
+                const textPart = output.parts.find(p => p.type === "text");
+                if (textPart) {
+                    textPart.text = transformedText;
+                    logger.log(`✅ Transformed prompt for agent routing`);
+                }
+            }
+        },
+        config: async (_config) => {
+            const lockFile = path.join(directory, ".opencode", "logs", ".xray-init.lock");
+            const now = Date.now();
+            try {
+                if (fs.existsSync(lockFile)) {
+                    const stat = fs.statSync(lockFile);
+                    if (now - stat.mtimeMs < 15000) {
+                        return;
+                    }
+                }
+                fs.writeFileSync(lockFile, String(now));
+            }
+            catch {
+                // lock check failed — proceed anyway
+            }
+            const logger = await getOrCreateLogger(directory);
+            logger.log("🔧 Plugin config hook triggered - initializing 0xRay integration");
+            let initScriptPath = path.join(directory, ".opencode", "init.sh");
+            const pkgInitPath = path.join(directory, "node_modules", "0xray", ".opencode", "init.sh");
+            if (!fs.existsSync(initScriptPath) && fs.existsSync(pkgInitPath)) {
+                initScriptPath = pkgInitPath;
+            }
+            if (fs.existsSync(initScriptPath)) {
+                try {
+                    const { stderr } = await spawnPromise("bash", [initScriptPath], directory);
+                    if (stderr) {
+                        logger.error(`Framework init error: ${stderr}`);
+                    }
+                    else {
+                        logger.log("✅ 0xRay Framework initialized successfully");
+                    }
+                }
+                catch (error) {
+                    logger.error("Framework initialization failed", error);
+                }
+            }
+            logger.log("✅ Plugin config hook completed");
+        },
+    };
+}
+//# sourceMappingURL=xray-codex-injection.js.map

package/.plugin/plugin.json

@@ -0,0 +1,11 @@
+{
+  "id": "0xray",
+  "name": "0xRay",
+  "version": "3.0.5",
+  "description": "Multi-agent orchestration, Codex governance, and AI-powered development tools. 13 MCP tools (code review, security audit, API design, database design, project analysis, testing, performance, UI/UX, DevOps, documentation, storytelling) plus 44 knowledge skills for best-practice guidance across the full software development lifecycle.",
+  "author": "0xRay AI",
+  "homepage": "https://github.com/0xRayAI/xray",
+  "components": {
+    "mcpServers": [".mcp.json"]
+  }
+}

package/README.md

@@ -1,6 +1,6 @@
 # 0xRay — Self-Healing AI Governance OS
 
-**v3.0.3** — 41 agents · 44 skills · 15 MCPs servers · 20 codex terms · 160 test files
+**v3.0.6** — 41 agents · 44 skills · 15 MCPs servers · 20 codex terms · 160 test files
 
 [![Docs](https://img.shields.io/badge/docs-0xRayAI.github.io/xray-10b981?style=flat-square)](https://0xrayai.github.io/xray/)
 
@@ -14,25 +14,24 @@ Think of it as an **AI supervisor for your AI coders**: catch hallucinations, pr
 
 ## Quick Start
 
+Pick your AI coding tool and run **one command**:
+
 ```bash
-npm install 0xray
+# OpenCode (most common)
+npx -y 0xray opencode install
 
-# Verify installation
-npx 0xray status
+# Grok CLI
+npx -y 0xray grok install
 
-# Install for your AI coding platform
-npx 0xray opencode install      # OpenCode (most common)
-npx 0xray grok install          # Grok CLI
-npx 0xray hermes install        # Hermes Agent
-npx 0xray openclaw install      # OpenClaw
+# Hermes Agent
+npx -y 0xray hermes install
 
-# Install starter skills (recommended)
-npx 0xray skill:install
-
-# See all available commands
-npx 0xray --help
+# OpenClaw
+npx -y 0xray openclaw install
 ```
 
+That's it — 0xRay installs as a native plugin with agents, governance, and MCP servers for your platform. Run `npx 0xray --help` to see all commands.
+
 **Requirements:** Node.js 18+, npm 9+, macOS or Linux.
 
 ---
@@ -181,7 +180,7 @@ Every subsystem is configurable via `features.json` (located at `xray/features.j
 
 ```json
 {
-  "version": "3.0.3",
+  "version": "3.0.5",
   "token_optimization": {
     "enabled": true,
     "max_context_tokens": 20000,

package/dist/CHANGELOG.md

@@ -4,6 +4,38 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Conventional Commits](https://www.conventionalcommits.org/).
 
+## [3.0.6] - 2026-06-13
+
+### 🔄 Changes
+
+- Version bump
+
+---
+
+## [3.0.5] - 2026-06-13
+
+### 🔄 Changes
+
+- Version bump
+
+---
+
+## [3.0.4] - 2026-06-13
+
+### 🔄 Changes
+
+- Version bump
+
+---
+
+## [3.0.4] - 2026-06-13
+
+### 🔄 Changes
+
+- Version bump
+
+---
+
 ## [3.0.3] - 2026-06-13
 
 ### 🔄 Changes

package/dist/README.md

@@ -1,6 +1,6 @@
 # 0xRay — Self-Healing AI Governance OS
 
-**v3.0.3** — 41 agents · 44 skills · 15 MCPs servers · 20 codex terms · 160 test files
+**v3.0.6** — 41 agents · 44 skills · 15 MCPs servers · 20 codex terms · 160 test files
 
 [![Docs](https://img.shields.io/badge/docs-0xRayAI.github.io/xray-10b981?style=flat-square)](https://0xrayai.github.io/xray/)
 
@@ -14,25 +14,24 @@ Think of it as an **AI supervisor for your AI coders**: catch hallucinations, pr
 
 ## Quick Start
 
+Pick your AI coding tool and run **one command**:
+
 ```bash
-npm install 0xray
+# OpenCode (most common)
+npx -y 0xray opencode install
 
-# Verify installation
-npx 0xray status
+# Grok CLI
+npx -y 0xray grok install
 
-# Install for your AI coding platform
-npx 0xray opencode install      # OpenCode (most common)
-npx 0xray grok install          # Grok CLI
-npx 0xray hermes install        # Hermes Agent
-npx 0xray openclaw install      # OpenClaw
+# Hermes Agent
+npx -y 0xray hermes install
 
-# Install starter skills (recommended)
-npx 0xray skill:install
-
-# See all available commands
-npx 0xray --help
+# OpenClaw
+npx -y 0xray openclaw install
 ```
 
+That's it — 0xRay installs as a native plugin with agents, governance, and MCP servers for your platform. Run `npx 0xray --help` to see all commands.
+
 **Requirements:** Node.js 18+, npm 9+, macOS or Linux.
 
 ---
@@ -181,7 +180,7 @@ Every subsystem is configurable via `features.json` (located at `xray/features.j
 
 ```json
 {
-  "version": "3.0.3",
+  "version": "3.0.5",
   "token_optimization": {
     "enabled": true,
     "max_context_tokens": 20000,

package/dist/analytics/routing-refiner.js

@@ -36,7 +36,7 @@ class RoutingRefiner {
         const optimizations = this.suggestMappingOptimizations(promptAnalysis, performanceReport);
         const warnings = this.generateWarnings(newMappings, optimizations);
         return {
-            version: "3.0.3",
+            version: "3.0.5",
             generatedAt: new Date(),
             summary: {
                 newMappings: newMappings.length,

package/dist/cli/commands/opencode-install.js

@@ -1,5 +1,6 @@
 import fs from 'fs';
 import path from 'path';
+import { execSync } from 'child_process';
 import { frameworkLogger } from '../../core/framework-logger.js';
 const __dirname = path.dirname(new URL(import.meta.url).pathname);
 export function registerOpencodeCommands(opencodeCmd) {
@@ -77,6 +78,14 @@ async function installForOpencode(options = {}) {
     }
     if (options.dryRun) {
         console.log(`[Opencode] Dry run: Would copy ${opencodeSource} → ${opencodeDest}`);
+        const pkgPath = path.join(process.cwd(), 'package.json');
+        if (fs.existsSync(pkgPath)) {
+            const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+            const has0xray = pkg.dependencies?.['0xray'] || pkg.devDependencies?.['0xray'];
+            if (!has0xray) {
+                console.log(`[Opencode] Dry run: Would add "0xray" dependency to package.json`);
+            }
+        }
         return;
     }
     try {
@@ -88,6 +97,24 @@ async function installForOpencode(options = {}) {
         copyDir(opencodeSource, opencodeDest);
         frameworkLogger.log('opencode-integration', 'opencode-copied', 'info', { destination: opencodeDest });
         console.log(`\x1b[32m✓ Copied OpenCode config to .opencode/\x1b[0m`);
+        // Ensure 0xray is an npm dependency so plugin imports resolve
+        const pkgPath = path.join(process.cwd(), 'package.json');
+        let needsInstall = false;
+        if (fs.existsSync(pkgPath)) {
+            const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+            const has0xray = pkg.dependencies?.['0xray'] || pkg.devDependencies?.['0xray'];
+            if (!has0xray) {
+                pkg.dependencies = pkg.dependencies || {};
+                pkg.dependencies['0xray'] = '*';
+                fs.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + '\n');
+                console.log(`\x1b[32m✓ Added 0xray dependency to package.json\x1b[0m`);
+                needsInstall = true;
+            }
+        }
+        if (needsInstall) {
+            console.log('Installing 0xray...');
+            execSync('npm install', { cwd: process.cwd(), stdio: 'inherit' });
+        }
         console.log('\n✅ 0xRay OpenCode plugin installed!');
         console.log('Restart OpenCode or run `opencode` to load the plugin.');
     }

package/dist/cli/commands/opencode-install.js.map

@@ -1 +1 @@
-{"version":3,"file":"opencode-install.js","sourceRoot":"","sources":["../../../src/cli/commands/opencode-install.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAEjE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;AAElE,MAAM,UAAU,wBAAwB,CAAC,WAAoB;IAC3D,WAAW;SACR,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,+DAA+D,CAAC;SAC5E,MAAM,CAAC,WAAW,EAAE,gDAAgD,CAAC;SACrE,MAAM,CAAC,SAAS,EAAE,yCAAyC,CAAC;SAC5D,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QACxB,MAAM,kBAAkB,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;AACP,CAAC;AAOD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,oBAAoB,EAAE,sBAAsB,CAAC,CAAC,CAAC;AAC5E,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;AACpD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAEzD,SAAS,SAAS,CAAC,GAAQ,EAAE,IAAS;IACpC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;IACpF,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;IAChE,MAAM,MAAM,GAAQ,EAAE,CAAC;IACvB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrG,CAAC;IACD,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC;gBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,OAAO,CAAC,GAAW,EAAE,IAAY,EAAE,OAAO,GAAG,EAAE;IACtD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClE,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACjE,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAS;QACxC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;QAClC,CAAC;aAAM,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;gBAC7D,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;oBAC/D,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBACpF,CAAC;qBAAM,CAAC;oBACN,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBACrC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;aAAM,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChF,OAAO;QACT,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,UAAkC,EAAE;IACpE,eAAe,CAAC,GAAG,CAAC,sBAAsB,EAAE,eAAe,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAElF,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;IAC3E,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,WAAW,CAAC,CAAC;IAE3D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QACnC,OAAO,CAAC,KAAK,CAAC,sEAAsE,CAAC,CAAC;QACtF,OAAO;IACT,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,CAAC,GAAG,CAAC,kCAAkC,cAAc,MAAM,YAAY,EAAE,CAAC,CAAC;QAClF,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YAClD,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;YAC/D,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;YACzC,OAAO;QACT,CAAC;QAED,OAAO,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;QACtC,eAAe,CAAC,GAAG,CAAC,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC;QAEtG,OAAO,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAC;QACrE,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;IAExE,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,eAAe,CAAC,GAAG,CAAC,sBAAsB,EAAE,eAAe,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9F,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IACnE,CAAC;IAED,eAAe,CAAC,GAAG,CAAC,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC"}
+{"version":3,"file":"opencode-install.js","sourceRoot":"","sources":["../../../src/cli/commands/opencode-install.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAEjE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;AAElE,MAAM,UAAU,wBAAwB,CAAC,WAAoB;IAC3D,WAAW;SACR,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,+DAA+D,CAAC;SAC5E,MAAM,CAAC,WAAW,EAAE,gDAAgD,CAAC;SACrE,MAAM,CAAC,SAAS,EAAE,yCAAyC,CAAC;SAC5D,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QACxB,MAAM,kBAAkB,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;AACP,CAAC;AAOD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,oBAAoB,EAAE,sBAAsB,CAAC,CAAC,CAAC;AAC5E,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;AACpD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAEzD,SAAS,SAAS,CAAC,GAAQ,EAAE,IAAS;IACpC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;IACpF,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;IAChE,MAAM,MAAM,GAAQ,EAAE,CAAC;IACvB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrG,CAAC;IACD,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC;gBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,OAAO,CAAC,GAAW,EAAE,IAAY,EAAE,OAAO,GAAG,EAAE;IACtD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClE,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACjE,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAS;QACxC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;QAClC,CAAC;aAAM,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;gBAC7D,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;oBAC/D,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBACpF,CAAC;qBAAM,CAAC;oBACN,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBACrC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;aAAM,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChF,OAAO;QACT,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,UAAkC,EAAE;IACpE,eAAe,CAAC,GAAG,CAAC,sBAAsB,EAAE,eAAe,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAElF,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;IAC3E,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,WAAW,CAAC,CAAC;IAE3D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QACnC,OAAO,CAAC,KAAK,CAAC,sEAAsE,CAAC,CAAC;QACtF,OAAO;IACT,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,CAAC,GAAG,CAAC,kCAAkC,cAAc,MAAM,YAAY,EAAE,CAAC,CAAC;QAClF,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC,CAAC;QACzD,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;YACzD,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,eAAe,EAAE,CAAC,OAAO,CAAC,CAAC;YAC/E,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;YAClF,CAAC;QACH,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YAClD,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;YAC/D,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;YACzC,OAAO;QACT,CAAC;QAED,OAAO,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;QACtC,eAAe,CAAC,GAAG,CAAC,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC;QAEtG,OAAO,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAC;QAErE,8DAA8D;QAC9D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC,CAAC;QACzD,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;YACzD,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,eAAe,EAAE,CAAC,OAAO,CAAC,CAAC;YAC/E,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,GAAG,CAAC,YAAY,GAAG,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;gBAC1C,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC;gBAChC,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;gBAC/D,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;gBACvE,YAAY,GAAG,IAAI,CAAC;YACtB,CAAC;QACH,CAAC;QACD,IAAI,YAAY,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;YACnC,QAAQ,CAAC,aAAa,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;IAExE,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,eAAe,CAAC,GAAG,CAAC,sBAAsB,EAAE,eAAe,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9F,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IACnE,CAAC;IAED,eAAe,CAAC,GAAG,CAAC,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC"}

package/dist/core/boot-orchestrator.js

@@ -717,9 +717,9 @@ export class BootOrchestrator {
         try {
             // Consumer runtime compat (XRAY_ env + .xray fallbacks)
             const xrayConfig = {
-                version: "3.0.3",
+                version: "3.0.5",
                 codex_enabled: true,
-                codex_version: "v3.0.2",
+                codex_version: "v3.0.5",
                 codex_terms: [
                     1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20,
                     21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37,

package/dist/core/features-config.js

@@ -286,7 +286,7 @@ export class FeaturesConfigLoader {
      */
     getDefaultConfig() {
         return {
-            version: "3.0.3",
+            version: "3.0.5",
             description: "0xRay Framework - Unified Feature Configuration",
             token_optimization: {
                 enabled: true,

package/dist/mcps/governance.server.js

@@ -32,7 +32,7 @@ class GovernanceServer {
     }
     createServer() {
         const server = new Server({
-            name: "governance", version: "3.0.3",
+            name: "governance", version: "3.0.5",
         }, {
             capabilities: {
                 tools: {},

package/dist/mcps/knowledge-skills/tech-writer.server.js

@@ -595,7 +595,7 @@ class XrayDocumentationGenerationServer extends XrayKnowledgeSkillBase {
             openapi: "3.0.0",
             info: {
                 title: "API Documentation",
-                version: "3.0.3",
+                version: "3.0.5",
                 description: "Generated API documentation",
             },
             servers: [

package/dist/mcps/registry.json

@@ -1,5 +1,5 @@
 {
-  "version": "3.0.3",
+  "version": "3.0.5",
   "description": "0xRay Community MCPs Registry - curated API-focused MCP servers",
   "sources": [
     {

package/dist/skills/registry.json

@@ -1,5 +1,5 @@
 {
-  "version": "3.0.3",
+  "version": "3.0.5",
   "description": "0xRay Skills Registry - recommended skill sources for consumers",
   "sources": [
     {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "0xray",
-  "version": "3.0.3",
+  "version": "3.0.6",
   "description": "Multi-agent orchestration and Codex governance for OpenCode, Hermes, Grok Build, and OpenClaw",
   "license": "MIT",
   "repository": {
@@ -73,7 +73,7 @@
     "postinstall": "node scripts/node/postinstall.cjs",
     "prepare": "npm run build",
     "prebuild": "rm -rf dist tsconfig.tsbuildinfo tsconfig.*.tsbuildinfo",
-    "build": "tsc && tsc -p tsconfig.full.json 2>/dev/null || true && mkdir -p dist/public dist/scripts && cp -r public/* dist/public/ && cp scripts/hooks/pre-command dist/scripts/ && cp scripts/hooks/pre-command.mjs dist/scripts/ && cp README.md AGENTS.md CHANGELOG.md LICENSE dist/ && find src -name '*.mjs' ! -path '*/__tests__/*' | while read f; do tgt=\"dist/${f#src/}\"; mkdir -p \"$(dirname $tgt)\"; cp \"$f\" \"$tgt\"; done && find dist -name '*.d.ts' -path '*/__tests__/*' -delete; find dist -name '*.js' -path '*/__tests__/*' -delete; for dir in skills integrations mcps; do find src/$dir -type f ! -name '*.ts' ! -path '*/.pytest_cache/*' | while read f; do tgt=\"dist/${f#src/}\"; mkdir -p \"$(dirname $tgt)\"; cp \"$f\" \"$tgt\"; done; done && mkdir -p dist/plugin && (find dist/plugin -name '*codex-injection*.js' -exec cp {} dist/plugin/xray-codex-injection.js \\; 2>/dev/null || true) && cp -r src/opencode/ .opencode/ && echo 'build artifacts in .opencode/xray/ removed — runtime reads from xray/ directly'",
+    "build": "tsc && tsc -p tsconfig.full.json 2>/dev/null || true && mkdir -p dist/public dist/scripts && cp -r public/* dist/public/ && cp scripts/hooks/pre-command dist/scripts/ && cp scripts/hooks/pre-command.mjs dist/scripts/ && cp README.md AGENTS.md CHANGELOG.md LICENSE dist/ && find src -name '*.mjs' ! -path '*/__tests__/*' | while read f; do tgt=\"dist/${f#src/}\"; mkdir -p \"$(dirname $tgt)\"; cp \"$f\" \"$tgt\"; done && find dist -name '*.d.ts' -path '*/__tests__/*' -delete; find dist -name '*.js' -path '*/__tests__/*' -delete; for dir in skills integrations mcps; do find src/$dir -type f ! -name '*.ts' ! -path '*/.pytest_cache/*' | while read f; do tgt=\"dist/${f#src/}\"; mkdir -p \"$(dirname $tgt)\"; cp \"$f\" \"$tgt\"; done; done && mkdir -p dist/plugin && (find dist/plugin -name '*codex-injection*.js' -exec cp {} dist/plugin/xray-codex-injection.js \\; 2>/dev/null || true) && cp -r src/opencode/ .opencode/ && mkdir -p .opencode/plugin && cp dist/plugin/xray-codex-injection.js .opencode/plugin/ && echo 'build artifacts in .opencode/xray/ removed — runtime reads from xray/ directly'",
     "build:all": "npm run build",
     "ci-install": "npm ci",
     "clean": "rm -rf dist tsconfig.tsbuildinfo tsconfig.*.tsbuildinfo",
@@ -163,6 +163,9 @@
     ".opencode/workflows/",
     ".opencode/codex.codex",
     ".opencode/enforcer-config.json",
+    ".opencode/plugin/",
+    ".mcp.json",
+    ".plugin/",
     "opencode.json",
     "README.md",
     "AGENTS.md",

package/scripts/node/universal-version-manager.js

@@ -147,7 +147,7 @@ function detectCodexInfo() {
       return { version: cver.startsWith("v") ? cver : `v${cver}`, termsCount: termCount, lastUpdated: new Date().toISOString().split("T")[0] };
     } catch {}
   }
-  return { version: "v3.0.2", termsCount: 68, lastUpdated: new Date().toISOString().split("T")[0] };
+  return { version: "v3.0.5", termsCount: 68, lastUpdated: new Date().toISOString().split("T")[0] };
 }
 
 const detectedCodex = detectCodexInfo();
@@ -155,7 +155,7 @@ const detectedCodex = detectCodexInfo();
 const OFFICIAL_VERSIONS = {
   // Framework version
   framework: {
-    version: "3.0.3",
+    version: "3.0.6",
       displayName: "xray: Self-Healing AI Governance OS",
       lastUpdated: "2026-06-13",
     // Counts (auto-calculated, but can be overridden)
@@ -403,7 +403,7 @@ const UPDATE_PATTERNS = [
       pattern: /xray AI v[0-9]+\.[0-9]+\.[0-9]+/g,
       replacement: `xray AI v${OFFICIAL_VERSIONS.framework.version}`,
     },
-    // Footer bare version (e.g., "**Version**: 3.0.3")
+    // Footer bare version (e.g., "**Version**: 3.0.5")
     {
       pattern: /\*\*Version\*\*:\s*[0-9]+\.[0-9]+\.[0-9]+/g,
       replacement: `**Version**: ${OFFICIAL_VERSIONS.framework.version}`,

package/src/mcps/governance.server.ts

@@ -72,7 +72,7 @@ class GovernanceServer {
   private createServer(): Server {
     const server = new Server(
       {
-        name: "governance", version: "3.0.3",
+        name: "governance", version: "3.0.5",
       },
       {
         capabilities: {

package/src/mcps/knowledge-skills/tech-writer.server.ts

@@ -888,7 +888,7 @@ class XrayDocumentationGenerationServer extends XrayKnowledgeSkillBase {
       openapi: "3.0.0",
       info: {
         title: "API Documentation",
-        version: "3.0.3",
+        version: "3.0.5",
         description: "Generated API documentation",
       },
       servers: [

package/src/mcps/registry.json

@@ -1,5 +1,5 @@
 {
-  "version": "3.0.3",
+  "version": "3.0.5",
   "description": "0xRay Community MCPs Registry - curated API-focused MCP servers",
   "sources": [
     {

package/src/opencode/codex.codex

@@ -1,5 +1,5 @@
 {
-  "version": "3.0.3",
+  "version": "3.0.5",
   "terms": [
      1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68
   ],

package/src/opencode/commands/dependency-audit.md

@@ -69,7 +69,7 @@ Comprehensive dependency analysis and security audit for all project dependencie
   "vulnerabilities": [
     {
       "package": "lodash",
-      "version": "3.0.3",
+      "version": "3.0.5",
       "severity": "high",
       "cve": "CVE-2021-23337",
       "description": "Command injection vulnerability"
@@ -85,14 +85,14 @@ Security-focused format for CI/CD integration:
 
 ```json
 {
-  "version": "3.0.3",
+  "version": "3.0.5",
   "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
   "runs": [
     {
       "tool": {
         "driver": {
           "name": "Dependency Audit",
-          "version": "3.0.3"
+          "version": "3.0.5"
         }
       },
       "results": [...]

package/src/opencode/enforcer-config.json

@@ -1,6 +1,6 @@
 {
   "framework": "xray 3.0",
-  "version": "3.0.3",
+  "version": "3.0.5",
   "description": "Codex-compliant framework configuration for Credible UI project",
   "thresholds": {
     "bundleSize": {
@@ -220,7 +220,7 @@
       }
     },
     "codex": {
-      "version": "3.0.3",
+      "version": "3.0.5",
       "terms": [
         1,
         2,

package/src/skills/registry.json

@@ -1,5 +1,5 @@
 {
-  "version": "3.0.3",
+  "version": "3.0.5",
   "description": "0xRay Skills Registry - recommended skill sources for consumers",
   "sources": [
     {

package/xray/codex.json

@@ -1,5 +1,5 @@
 {
-  "version": "3.0.3",
+  "version": "3.0.5",
   "lastUpdated": "2026-06-05",
   "errorPreventionTarget": 0.998,
   "terms": {

package/xray/config.json

@@ -1,6 +1,6 @@
 {
   "$schema": "./config.schema.json",
-  "version": "3.0.3",
+  "version": "3.0.5",
   "description": "0xRay Framework - Token Management & Performance Configuration",
   "token_management": {
     "maxPromptTokens": 20000,

package/xray/features.json

@@ -1,6 +1,6 @@
 {
   "$schema": "./features.schema.json",
-  "version": "3.0.3",
+  "version": "3.0.5",
   "description": "0xRay Framework - Unified Feature Configuration",
   "token_optimization": {
     "enabled": true,

package/xray/integrations.json

@@ -4,19 +4,19 @@
     "openclaw": {
       "enabled": false,
       "type": "external-service",
-      "version": "3.0.3",
+      "version": "3.0.5",
       "config": {}
     },
     "python-bridge": {
       "enabled": false,
       "type": "protocol-bridge",
-      "version": "3.0.3",
+      "version": "3.0.5",
       "config": {}
     },
     "react": {
       "enabled": false,
       "type": "framework-adapter",
-      "version": "3.0.3",
+      "version": "3.0.5",
       "config": {}
     }
   }