0xray 3.0.8 → 3.0.10

package/src/mcps/knowledge-skills/skill-invocation.server.ts

@@ -5,6 +5,7 @@ import {
   ErrorCode,
   McpError,
 } from "@modelcontextprotocol/sdk/types.js";
+import { realpathSync } from "fs";
 import * as path from "path";
 import { fileURLToPath } from "url";
 import { randomUUID } from "crypto";
@@ -735,9 +736,8 @@ class SkillInvocationServer extends XrayKnowledgeSkillBase {
   }
 }
 
-// Start the server if this file is run directly
-const entryPoint = path.resolve(process.argv[1] ?? "");
-if (entryPoint && fileURLToPath(import.meta.url) === entryPoint) {
+// Start the server if this file is run directly (realpath handles /var → /private/var on macOS)
+if (process.argv[1] && realpathSync(fileURLToPath(import.meta.url)) === realpathSync(process.argv[1])) {
   // If --port or MCP_PORT is set, use HTTP transport (for Grok CLI compatibility)
   const cliPort = process.argv.find((a) => a.startsWith("--port="))?.split("=")[1];
   const port = parseInt(cliPort ?? process.env.MCP_PORT ?? "", 10);

package/src/mcps/knowledge-skills/tech-writer.server.ts

@@ -888,7 +888,7 @@ class XrayDocumentationGenerationServer extends XrayKnowledgeSkillBase {
       openapi: "3.0.0",
       info: {
         title: "API Documentation",
-        version: "3.0.7",
+        version: "3.0.9",
         description: "Generated API documentation",
       },
       servers: [

package/src/mcps/orchestrator/server.ts

@@ -5,6 +5,8 @@
  * Provides a clean API while hiding internal complexity
  */
 
+import { realpathSync } from "fs";
+import { fileURLToPath } from "url";
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import {
@@ -376,8 +378,8 @@ export function createOrchestratorServer(): OrchestratorServer {
   return serverInstance;
 }
 
-// Run if called directly
-if (import.meta.url === `file://${process.argv[1]}`) {
+// Run if called directly (realpath handles /var → /private/var on macOS)
+if (process.argv[1] && realpathSync(fileURLToPath(import.meta.url)) === realpathSync(process.argv[1])) {
   const server = createOrchestratorServer();
   server.start().catch((error) => {
     frameworkLogger.log('orchestrator.server', 'fatal-error', 'error', {

package/src/mcps/registry.json

@@ -1,5 +1,5 @@
 {
-  "version": "3.0.7",
+  "version": "3.0.9",
   "description": "0xRay Community MCPs Registry - curated API-focused MCP servers",
   "sources": [
     {

package/src/opencode/codex.codex

@@ -1,5 +1,5 @@
 {
-  "version": "3.0.7",
+  "version": "3.0.9",
   "terms": [
      1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68
   ],

package/src/opencode/commands/dependency-audit.md

@@ -69,7 +69,7 @@ Comprehensive dependency analysis and security audit for all project dependencie
   "vulnerabilities": [
     {
       "package": "lodash",
-      "version": "3.0.7",
+      "version": "3.0.9",
       "severity": "high",
       "cve": "CVE-2021-23337",
       "description": "Command injection vulnerability"
@@ -85,14 +85,14 @@ Security-focused format for CI/CD integration:
 
 ```json
 {
-  "version": "3.0.7",
+  "version": "3.0.9",
   "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
   "runs": [
     {
       "tool": {
         "driver": {
           "name": "Dependency Audit",
-          "version": "3.0.7"
+          "version": "3.0.9"
         }
       },
       "results": [...]

package/src/opencode/enforcer-config.json

@@ -1,6 +1,6 @@
 {
   "framework": "xray 3.0",
-  "version": "3.0.7",
+  "version": "3.0.9",
   "description": "Codex-compliant framework configuration for Credible UI project",
   "thresholds": {
     "bundleSize": {
@@ -220,7 +220,7 @@
       }
     },
     "codex": {
-      "version": "3.0.7",
+      "version": "3.0.9",
       "terms": [
         1,
         2,

package/src/skills/registry.json

@@ -1,5 +1,5 @@
 {
-  "version": "3.0.7",
+  "version": "3.0.9",
   "description": "0xRay Skills Registry - recommended skill sources for consumers",
   "sources": [
     {

package/xray/agents_template.md

@@ -1,109 +1,49 @@
-# StringRay AI v1.15.1 – Agent Context & Universal Development Codex
+# AGENTS.md — 0xRay Consumer Template
 
-**Framework Version**: 1.14.0  
-**Codex Version**: 1.7.5 (condensed)  
-**Last Updated**: 2026-03-23  
-**Purpose**: Systematic error prevention and production-ready AI-assisted development
+**Version**: 3.0.9
+**Updated**: 2026-06-13
 
-## 🎯 CRITICAL RULES – ZERO TOLERANCE (MANDATORY)
+## What is 0xRay?
 
-1. **Full File Reading Before Edit**  
-   ALWAYS read the ENTIRE file using the `read` tool before ANY edit, refactor, or write.  
-   Understand complete structure, imports, dependencies, and context.  
-   Partial/contextual edits are strictly forbidden.
+0xRay provides intelligent multi-agent orchestration with automatic delegation and Codex compliance validation under the pure three-subsystem model (Inference + External Governance via Dynamo + Autonomous Engine via thinDispatch 7-flow in MCP orchestrator). Agents operate via YML surfaces and MCP skill servers.
 
-2. **Verify Changes Actually Applied**  
-   After every edit/write: use `read` to confirm the exact changes are present.  
-   Check for regressions and unintended modifications.  
-   NEVER declare success without observable verification.
+## Available MCP Servers
 
-3. **Command & Tool Output Review**  
-   Immediately review ALL command/tool outputs.  
-   Identify errors, warnings, or anomalies.  
-   Add TODO for course correction if issues found.  
-   Do not proceed until critical problems are resolved.
+| Server | Purpose |
+|--------|---------|
+| `xray-enforcer` | Codex compliance & error prevention |
+| `xray-governance` | Proposal governance, codex snapshot |
+| `xray-orchestrator` | thinDispatch 7-flow delegation routing |
+| `xray-skills` | Skill invocation (code-review, security-audit, researcher, etc.) |
 
-4. **No False Success Claims**  
-   Only report "completed", "edited", or "fixed" after verification steps confirm success.  
-   Prohibited: assuming success, subjective "looks correct", skipping checks for "trivial" changes.
+## CLI Commands
 
-5. **Surgical & Progressive Fixes**  
-   Fix root causes minimally – no patches, stubs, or over-engineering.  
-   All code must be production-ready from first commit.
+```
+npx 0xray setup          Full framework configuration
+npx 0xray validate        Run Codex compliance validation
+npx 0xray status          Show framework status
+npx 0xray install <mcp>   Install MCP server (groks)
+```
 
-6. **Error & Loop Prevention**  
-   Resolve all errors before continuing (90%+ runtime prevention target).  
-   Every loop/async must have clear termination/timeout.
+## Governance
 
-7. **Type Safety & Immutability First**  
-   No `any`, `@ts-ignore`. Prefer immutable patterns and early returns/guards.
+All actions are governed by the Universal Development Codex via Dynamo (External Governance SSOT). Governance precedes action.
 
-8. **DRY, YAGNI, Separation of Concerns**  
-   No duplication. No unnecessary features. One responsibility per module/function.
+## Logging
 
-9. **Test & Performance Awareness**  
-   >85% behavioral coverage target. Respect bundle <2MB, FCP <2s budgets.
+Use `fwLogger` / `frameworkLogger` structured logging only (never `console.*`). Logs go to `logs/framework/activity.log` + `.opencode/logs/`.
 
-10. **Security & Input Validation**  
-    Validate/sanitize all inputs. Security by design.
+## Architecture
 
-## Core Codex Terms (Top 20 – Enforced)
+- **Inference**: Session capture, pattern accumulation, governance triggers
+- **External Governance**: Dynamo Solar SSOT via codex.json
+- **Autonomous Engine**: thinDispatch 7-flow in MCP orchestrator
 
-1. Progressive production-ready code  
-2. No patches/stubs/bridge code  
-3. Avoid over-engineering  
-4. Fit-for-purpose prod-level code  
-5. Surgical root-cause fixes  
-6. Batched introspection cycles  
-7. Resolve all errors (90% prevention)  
-8. Prevent infinite loops/timeouts  
-9. Shared global state / single source of truth  
-10. Type safety first (no `any`)  
-11. Early returns & guard clauses  
-12. Error boundaries & graceful degradation  
-13. Immutability preferred  
-14. Separation of concerns  
-15. DRY – eliminate duplication  
-16. YAGNI – no speculative features  
-17. Meaningful, self-documenting names  
-18. Small, focused functions (<30 lines ideal)  
-19. Consistent style (linter enforced)  
-20. Test coverage >85% (behavioral focus)
+## Complexity Routing
 
-## Agent Capabilities Matrix
-
-| Agent                     | Role                              | Complexity | Key Tools                              | Strategy          |
-|---------------------------|-----------------------------------|------------|----------------------------------------|-------------------|
-| enforcer                  | Codex & error prevention          | All        | read, grep, lsp_*, bash                | Block violations  |
-| orchestrator              | Workflow coordination             | Enterprise | read, grep, call_omo_agent, session_*  | Consensus         |
-| architect                 | Design & decisions                | High       | read, grep, lsp_*, background_task     | Expert priority   |
-| bug-triage-specialist     | Error investigation & fixes       | Debug      | read, grep, ast_grep_*                 | Majority vote     |
-| code-reviewer             | Quality & standards               | Changes    | read, grep, lsp_diagnostics            | Expert priority   |
-| security-auditor          | Vulnerabilities & compliance      | Security   | read, grep, grep_app_searchGitHub      | Block critical    |
-| refactorer                | Debt & consolidation              | Refactor   | read, grep, lsp_rename, ast_grep_*     | Majority vote     |
-| testing-lead              | Testing strategy & coverage       | Tests      | read, grep, lsp_*                      | Expert priority   |
-| storyteller               | Narrative deep reflections       | Narrative  | read, grep, write                      | Expert priority   |
-| researcher                | Codebase exploration              | Research   | read, grep, codesearch, websearch       | Expert priority   |
-
-## Complexity Routing Summary
-
-Score = (files×2 + change/10 + deps×3 + duration/10) × operation_weight × risk_mult  
-- Operation weights: debug 2.0, refactor 1.8, analyze 1.5, modify 1.2, others 1.0  
-- Risk multipliers: critical 1.6, high 1.3, medium 1.0, low 0.8  
-Thresholds:  
-- ≤15 → single agent  
-- 16–50 → multi-agent possible  
-- 51+ → orchestrator-led
-
-## Operational Guidelines
-
-- Evaluate complexity before execution  
-- Always verify: read full file → apply change → read again → confirm no regressions  
-- Use `call_omo_agent` or `task()` for delegation  
-- Log JobId for traceability  
-- Enforce codex compliance on every operation
-
-**Codex Enforcement**: All actions validated against these rules. Violations block progress until resolved.  
-**Target**: 99.6% systematic error prevention through verification-first behavior.
-
-(End of file - total 105 lines)
+| Complexity | Score | Strategy |
+|-----------|-------|----------|
+| Simple | ≤15 | Single agent |
+| Moderate | ≤25 | Single agent with tools |
+| Complex | ≤50 | Multi-agent coordination |
+| Enterprise | >50 | Orchestrator-led team |

package/xray/codex.json

@@ -1,5 +1,5 @@
 {
-  "version": "3.0.7",
+  "version": "3.0.9",
   "lastUpdated": "2026-06-05",
   "errorPreventionTarget": 0.998,
   "terms": {

package/xray/config.json

@@ -1,6 +1,6 @@
 {
   "$schema": "./config.schema.json",
-  "version": "3.0.7",
+  "version": "3.0.9",
   "description": "0xRay Framework - Token Management & Performance Configuration",
   "token_management": {
     "maxPromptTokens": 20000,

package/xray/features.json

@@ -1,6 +1,6 @@
 {
   "$schema": "./features.schema.json",
-  "version": "3.0.7",
+  "version": "3.0.9",
   "description": "0xRay Framework - Unified Feature Configuration",
   "token_optimization": {
     "enabled": true,

package/xray/integrations.json

@@ -4,19 +4,19 @@
     "openclaw": {
       "enabled": false,
       "type": "external-service",
-      "version": "3.0.7",
+      "version": "3.0.9",
       "config": {}
     },
     "python-bridge": {
       "enabled": false,
       "type": "protocol-bridge",
-      "version": "3.0.7",
+      "version": "3.0.9",
       "config": {}
     },
     "react": {
       "enabled": false,
       "type": "framework-adapter",
-      "version": "3.0.7",
+      "version": "3.0.9",
       "config": {}
     }
   }