0xray 3.4.1 → 3.4.3

package/dist/security/security-scanner.d.ts

@@ -0,0 +1,119 @@
+/**
+ * 0xRay Framework - Security Scanner
+ *
+ * Automated security vulnerability scanning and compliance validation
+ * Integrates with security tools and provides comprehensive security reports
+ */
+export interface SecurityScanConfig {
+    enabled: boolean;
+    tools: {
+        npmAudit: boolean;
+        trivy: boolean;
+        eslintSecurity: boolean;
+        dependencyCheck: boolean;
+    };
+    severityThreshold: "low" | "moderate" | "high" | "critical";
+    reportPath: string;
+    failOnVulnerabilities: boolean;
+}
+export interface SecurityVulnerability {
+    id: string;
+    title: string;
+    description: string;
+    severity: "low" | "moderate" | "high" | "critical";
+    package?: string;
+    version?: string;
+    cve?: string;
+    url?: string;
+    recommendation: string;
+}
+export interface SecurityReport {
+    timestamp: string;
+    duration: number;
+    tools: {
+        npmAudit: SecurityVulnerability[];
+        trivy: SecurityVulnerability[];
+        eslintSecurity: SecurityVulnerability[];
+        dependencyCheck: SecurityVulnerability[];
+    };
+    summary: {
+        totalVulnerabilities: number;
+        bySeverity: Record<string, number>;
+        byTool: Record<string, number>;
+    };
+    recommendations: string[];
+    compliant: boolean;
+}
+export declare class SecurityScanner {
+    private config;
+    constructor(config?: Partial<SecurityScanConfig>);
+    /**
+     * Run comprehensive security scan
+     */
+    runSecurityScan(): Promise<SecurityReport>;
+    /**
+     * Run npm audit
+     */
+    private runNpmAudit;
+    /**
+     * Run Trivy security scan
+     */
+    private runTrivyScan;
+    /**
+     * Run ESLint security rules
+     */
+    private runEslintSecurity;
+    /**
+     * Run OWASP Dependency Check
+     */
+    private runDependencyCheck;
+    /**
+     * Generate comprehensive security report
+     */
+    private generateReport;
+    /**
+     * Generate security recommendations
+     */
+    private generateRecommendations;
+    /**
+     * Save report to file
+     */
+    private saveReport;
+    /**
+     * Log security scan results
+     */
+    private logResults;
+    /**
+     * Map npm audit severity levels
+     */
+    private mapNpmSeverity;
+    /**
+     * Map Trivy severity levels
+     */
+    private mapTrivySeverity;
+    /**
+     * Map Dependency Check severity levels
+     */
+    private mapDependencyCheckSeverity;
+    /**
+     * Validate AI prompt security
+     */
+    validatePrompt(prompt: string): Promise<{
+        isSafe: boolean;
+        violations: string[];
+        riskLevel: string;
+    }>;
+    /**
+     * Validate AI response security
+     */
+    validateResponse(response: string): Promise<{
+        isSafe: boolean;
+        violations: string[];
+        riskLevel: string;
+    }>;
+    /**
+     * Create empty report when scanning is disabled
+     */
+    private createEmptyReport;
+}
+export declare const securityScanner: SecurityScanner;

package/dist/services/inference-tuner.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Inference Tuner - Autonomous Learning Service
+ *
+ * Implements the autonomous inference improvement loop:
+ * 1. Collects routing outcomes and pattern metrics
+ * 2. Analyzes performance and detects drift
+ * 3. Generates refinement reports
+ * 4. Updates configuration automatically
+ *
+ * @module services
+ */
+export interface TuningConfig {
+    autoUpdateMappings: boolean;
+    autoUpdateThresholds: boolean;
+    minConfidenceThreshold: number;
+    minSuccessRateForAutoAdd: number;
+    learningIntervalMs: number;
+    maxMappingsToAdd: number;
+}
+export declare class InferenceTuner {
+    private config;
+    private lastTuningTime;
+    private tuningInProgress;
+    private tuningInterval;
+    constructor(config?: Partial<TuningConfig>);
+    /**
+     * Start autonomous tuning
+     */
+    start(): void;
+    /**
+     * Stop autonomous tuning
+     */
+    stop(): void;
+    /**
+     * Run a single tuning cycle
+     */
+    runTuningCycle(): Promise<void>;
+    /**
+     * Perform the actual tuning work
+     */
+    private performTuning;
+    /**
+     * Suggest new mappings based on patterns and outcomes
+     */
+    private suggestMappingsFromPatterns;
+    /**
+     * Resolve the path to the routing-mappings.json file.
+     * Checks multiple known locations and returns the first one found.
+     */
+    private resolveMappingsPath;
+    /**
+     * Load current routing mappings from disk.
+     */
+    private loadMappings;
+    /**
+     * Save routing mappings to disk.
+     */
+    private saveMappings;
+    /**
+     * Add a keyword mapping to the routing-mappings.json file.
+     *
+     * Checks for conflicts (keyword already mapped to a different agent)
+     * before adding. If the keyword already exists for the same agent,
+     * updates the confidence if the new value is higher.
+     */
+    private addKeywordMapping;
+    /**
+     * Get tuning status
+     */
+    getStatus(): {
+        running: boolean;
+        lastTuningTime: number;
+        config: TuningConfig;
+    };
+}
+export declare const inferenceTuner: InferenceTuner;

package/dist/session/index.d.ts

@@ -0,0 +1,3 @@
+export { SessionCleanupManager, createSessionCleanupManager } from "./session-cleanup-manager.js";
+export { SessionMonitor, createSessionMonitor } from "./session-monitor.js";
+export { SessionStateManager, createSessionStateManager } from "./session-state-manager.js";

package/dist/session/session-cleanup-manager.d.ts

@@ -0,0 +1,117 @@
+/**
+ * Session Cleanup Manager
+ *
+ * Manages automatic cleanup of sessions with TTL-based expiration,
+ * idle session detection, and manual cleanup utilities.
+ *
+ * @since 2026-01-07
+ */
+import { XrayStateManager } from "../state/state-manager.js";
+import { SessionMonitor } from "./session-monitor.js";
+export interface SessionMetadata {
+    sessionId: string;
+    createdAt: number;
+    lastActivity: number;
+    ttlMs: number;
+    isActive: boolean;
+    agentCount: number;
+    memoryUsage: number;
+    cleanupReason?: string;
+}
+export interface CleanupConfig {
+    ttlMs: number;
+    idleTimeoutMs: number;
+    maxSessions: number;
+    cleanupIntervalMs: number;
+    enableAutoCleanup: boolean;
+}
+export interface CleanupResult {
+    sessionsCleaned: number;
+    sessionsExpired: number;
+    sessionsIdle: number;
+    errors: string[];
+}
+export declare class SessionCleanupManager {
+    private stateManager;
+    private config;
+    private cleanupInterval?;
+    private _sessionMetadata?;
+    private _metadataLoaded;
+    private sessionMonitor;
+    constructor(stateManager: XrayStateManager, config?: Partial<CleanupConfig>, sessionMonitor?: SessionMonitor);
+    /**
+     * Lazy-loaded session metadata - loads from state manager on first access
+     */
+    private get sessionMetadata();
+    private set sessionMetadata(value);
+    /**
+     * Initialize cleanup manager and start auto-cleanup if enabled
+     */
+    private initialize;
+    start(): void;
+    /**
+     * Register a new session for cleanup tracking
+     */
+    registerSession(sessionId: string, ttlMs?: number): void;
+    updateActivity(sessionId: string): void;
+    updateMetadata(sessionId: string, updates: Partial<SessionMetadata>): void;
+    /**
+     * Check if session should be cleaned up
+     */
+    shouldCleanup(sessionId: string): boolean;
+    /**
+     * Perform cleanup of expired/idle sessions
+     */
+    performCleanup(): Promise<CleanupResult>;
+    /**
+     * Manually cleanup a specific session
+     */
+    manualCleanup(sessionId: string, reason?: string): Promise<boolean>;
+    /**
+     * Cleanup all sessions (emergency cleanup)
+     */
+    emergencyCleanup(): Promise<CleanupResult>;
+    /**
+     * Get cleanup statistics
+     */
+    getCleanupStats(): {
+        totalSessions: number;
+        activeSessions: number;
+        expiredSessions: number;
+        idleSessions: number;
+        nextCleanup: number;
+    };
+    /**
+     * Get session metadata
+     */
+    getSessionMetadata(sessionId: string): SessionMetadata | undefined;
+    /**
+     * List all sessions with metadata
+     */
+    listSessions(): SessionMetadata[];
+    /**
+     * Start automatic cleanup interval
+     */
+    private startAutoCleanup;
+    /**
+     * Stop automatic cleanup
+     */
+    stopAutoCleanup(): void;
+    /**
+     * Load session metadata from state manager (lazy loading)
+     */
+    private loadSessionMetadata;
+    /**
+     * Persist session metadata to state manager
+     */
+    private persistSessionMetadata;
+    /**
+     * Cleanup a specific session
+     */
+    private cleanupSession;
+    /**
+     * Shutdown cleanup manager
+     */
+    shutdown(): void;
+}
+export declare const createSessionCleanupManager: (stateManager: XrayStateManager, config?: Partial<CleanupConfig>, sessionMonitor?: SessionMonitor) => SessionCleanupManager;

package/dist/session/session-monitor.d.ts

@@ -0,0 +1,132 @@
+/**
+ * Session Monitor
+ *
+ * Provides real-time monitoring of sessions with health checks,
+ * performance tracking, and alerting capabilities.
+ *
+ * @since 2026-01-07
+ */
+import { XrayStateManager } from "../state/state-manager.js";
+import { SessionCoordinator } from "../delegation/session-coordinator.js";
+import { SessionCleanupManager } from "./session-cleanup-manager.js";
+export interface SessionHealth {
+    sessionId: string;
+    status: "healthy" | "degraded" | "critical" | "unknown";
+    lastCheck: number;
+    responseTime: number;
+    errorCount: number;
+    activeAgents: number;
+    memoryUsage: number;
+    issues: string[];
+}
+export interface SessionMetrics {
+    sessionId: string;
+    timestamp: number;
+    totalInteractions: number;
+    successfulInteractions: number;
+    failedInteractions: number;
+    averageResponseTime: number;
+    conflictResolutionRate: number;
+    coordinationEfficiency: number;
+    memoryUsage: number;
+    agentCount: number;
+}
+export interface InteractionRecord {
+    timestamp: number;
+    duration: number;
+    success: boolean;
+    agentId?: string;
+    operation?: string;
+}
+export interface MonitorConfig {
+    healthCheckIntervalMs: number;
+    metricsCollectionIntervalMs: number;
+    alertThresholds: {
+        maxResponseTime: number;
+        maxErrorRate: number;
+        maxMemoryUsage: number;
+        minCoordinationEfficiency: number;
+        maxConflicts: number;
+    };
+    enableAlerts: boolean;
+    enableMetrics: boolean;
+}
+export interface Alert {
+    id: string;
+    sessionId: string;
+    type: "health" | "performance" | "resource" | "coordination";
+    severity: "low" | "medium" | "high" | "critical";
+    message: string;
+    timestamp: number;
+    resolved: boolean;
+    resolvedAt?: number;
+}
+export declare class SessionMonitor {
+    private stateManager;
+    private sessionCoordinator;
+    private cleanupManager;
+    private config;
+    private healthChecks;
+    private metricsHistory;
+    private activeAlerts;
+    private healthCheckInterval?;
+    private metricsInterval?;
+    private interactionHistory;
+    private sessionResponseTimes;
+    private sessionErrors;
+    constructor(stateManager: XrayStateManager, sessionCoordinator: SessionCoordinator, cleanupManager: SessionCleanupManager, config?: Partial<MonitorConfig>);
+    start(): void;
+    registerSession(sessionId: string): void;
+    unregisterSession(sessionId: string): void;
+    performHealthCheck(sessionId: string): Promise<SessionHealth>;
+    collectMetrics(sessionId: string): SessionMetrics | null;
+    getHealthStatus(sessionId: string): SessionHealth | null;
+    getMetricsHistory(sessionId: string, limit?: number): SessionMetrics[];
+    getActiveAlerts(sessionId?: string): Alert[];
+    resolveAlert(alertId: string): boolean;
+    getMonitoringStats(): {
+        totalSessions: number;
+        healthySessions: number;
+        degradedSessions: number;
+        criticalSessions: number;
+        activeAlerts: number;
+        totalMetricsPoints: number;
+    };
+    private startHealthChecks;
+    private startMetricsCollection;
+    private generateAlerts;
+    private loadPersistedData;
+    private persistHealthData;
+    private persistMetricsData;
+    private persistAlertData;
+    shutdown(): void;
+    /**
+     * Record an interaction for tracking
+     */
+    recordInteraction(sessionId: string, interaction: InteractionRecord): void;
+    /**
+     * Get interaction history for a session
+     */
+    getInteractionHistory(sessionId: string, limit?: number): InteractionRecord[];
+    /**
+     * Perform comprehensive health checks on a session
+     */
+    private performComprehensiveHealthChecks;
+    /**
+     * Calculate failure ratio from interactions
+     */
+    private calculateFailureRatio;
+    /**
+     * Calculate conflict resolution rate from interactions
+     */
+    private calculateConflictResolutionRate;
+    /**
+     * Calculate coordination efficiency from interactions
+     */
+    private calculateCoordinationEfficiency;
+    private persistInteractionData;
+    private calculateSessionMemoryUsage;
+    private countSessionConflicts;
+    private calculateAverageResponseTime;
+}
+export declare const createSessionMonitor: (stateManager: XrayStateManager, sessionCoordinator: SessionCoordinator, cleanupManager: SessionCleanupManager, config?: Partial<MonitorConfig>) => SessionMonitor;

package/dist/session/session-state-manager.d.ts

@@ -0,0 +1,144 @@
+/**
+ * Session State Manager
+ *
+ * Manages cross-session state sharing, dependency tracking,
+ * and coordination for complex workflows.
+ *
+ * @since 2026-01-07
+ */
+import { XrayStateManager } from "../state/state-manager.js";
+import { SessionCoordinator } from "../delegation/session-coordinator.js";
+export interface SessionDependency {
+    sessionId: string;
+    dependsOn: string[];
+    dependedBy: string[];
+    state: "pending" | "active" | "completed" | "failed";
+    priority: number;
+    metadata: Record<string, unknown>;
+}
+export interface SessionGroup {
+    groupId: string;
+    sessionIds: string[];
+    coordinatorSession: string;
+    state: "forming" | "active" | "completing" | "completed" | "failed";
+    sharedState: Map<string, {
+        value: unknown;
+        fromSessionId: string;
+        timestamp: number;
+    }>;
+    createdAt: number;
+    completedAt?: number;
+}
+export interface MigrationPlan {
+    sessionId: string;
+    targetCoordinator: string;
+    stateTransfer: Map<string, unknown>;
+    migrationSteps: string[];
+    rollbackSteps: string[];
+}
+export interface FailoverConfig {
+    sessionId: string;
+    backupCoordinators: string[];
+    failoverThreshold: number;
+    autoFailover: boolean;
+}
+export declare class SessionStateManager {
+    private stateManager;
+    private sessionCoordinator;
+    private dependencies;
+    private sessionGroups;
+    private failoverConfigs;
+    constructor(stateManager: XrayStateManager, sessionCoordinator: SessionCoordinator);
+    /**
+     * Share state between sessions
+     */
+    shareState(fromSessionId: string, toSessionId: string, key: string, value: unknown): boolean;
+    /**
+     * Broadcast state to multiple sessions
+     */
+    broadcastState(fromSessionId: string, targetSessionIds: string[], key: string, value: unknown): number;
+    /**
+     * Register session dependency
+     */
+    registerDependency(sessionId: string, dependsOn: string[], metadata?: Record<string, unknown>): void;
+    /**
+     * Update dependency state
+     */
+    updateDependencyState(sessionId: string, state: SessionDependency["state"]): void;
+    /**
+     * Get dependency chain for a session
+     */
+    getDependencyChain(sessionId: string): {
+        dependencies: string[];
+        dependents: string[];
+        canStart: boolean;
+    };
+    /**
+     * Create session group for complex workflows
+     */
+    createSessionGroup(groupId: string, sessionIds: string[], coordinatorSession: string): SessionGroup;
+    /**
+     * Update session group state
+     */
+    updateSessionGroupState(groupId: string, state: SessionGroup["state"]): void;
+    /**
+     * Share state within a session group
+     */
+    shareGroupState(groupId: string, key: string, value: unknown, fromSessionId: string): boolean;
+    /**
+     * Get session group state
+     */
+    getGroupState(groupId: string, key: string): unknown;
+    /**
+     * Plan session migration
+     */
+    planMigration(sessionId: string, targetCoordinator: string): MigrationPlan;
+    /**
+     * Validate migration plan before execution
+     */
+    validateMigrationPlan(plan: MigrationPlan): Promise<{
+        valid: boolean;
+        errors: string[];
+        warnings: string[];
+    }>;
+    /**
+     * Validate rollback capability for a migration plan
+     */
+    validateRollbackCapability(plan: MigrationPlan): {
+        canRollback: boolean;
+        reason?: string;
+    };
+    /**
+     * Find orphaned agents in dependency graph
+     */
+    findOrphanedAgents(allAgents: string[], dependencies: Record<string, string[]>): string[];
+    /**
+     * Execute session migration
+     */
+    executeMigration(plan: MigrationPlan): Promise<boolean>;
+    /**
+     * Configure failover for a session
+     */
+    configureFailover(sessionId: string, backupCoordinators: string[], failoverThreshold: number, autoFailover: boolean): void;
+    /**
+     * Execute failover for a session
+     */
+    executeFailover(sessionId: string): Promise<boolean>;
+    /**
+     * Get coordination statistics
+     */
+    getCoordinationStats(): {
+        totalDependencies: number;
+        activeDependencies: number;
+        totalGroups: number;
+        activeGroups: number;
+        failoverConfigs: number;
+    };
+    private propagateDependencyUpdate;
+    private rollbackMigration;
+    private persistDependencies;
+    private persistSessionGroups;
+    private persistFailoverConfigs;
+    shutdown(): void;
+}
+export declare const createSessionStateManager: (stateManager: XrayStateManager, sessionCoordinator: SessionCoordinator) => SessionStateManager;

package/dist/skills/boot-orchestrator/SKILL.md

@@ -28,10 +28,6 @@ Framework initialization and boot orchestration.
 - **initialization**: Initialization
 - **framework_startup**: Framework startup
 
-## Usage
-
-This skill provides infrastructure capabilities for boot orchestrator functionality.
-
 ## Integration
 
-Activated when infrastructure capabilities are requested through the skills system.
+Lead-dev boot is handled by SessionStart hook + `orchestrator` skill — see `multi_agent_orchestration.lead_dev_mode` in features.json.

package/dist/skills/orchestrator/SKILL.md

@@ -1,11 +1,11 @@
 ---
 source: framework
 name: orchestrator
-description: Multi-agent workflow coordination and task delegation
+description: Multi-agent workflow coordination, lead-dev operating model (codex 67-68), and task delegation. Default when suit is worn — no keywords required.
 author: Xray Framework
 version: 1.0.0
 schema_version: "1.0"
-tags: [orchestration, orchestrator]
+tags: [orchestration, orchestrator, lead-dev]
 capabilities:
   - coordinate_agents
   - delegate_tasks
@@ -18,20 +18,43 @@ mcp:
     args: [node_modules/0xray/dist/mcps/orchestrator.server.js]
 ---
 
-# Orchestrator Skill
+# Orchestrator Skill — includes lead-dev operating model
 
-Multi-agent workflow coordination and task delegation.
+When `multi_agent_orchestration.lead_dev_mode` is true in `features.json` (default when suit is worn), this is the **default OS behavior** — not a separate skill or MCP.
 
-## Tools Available
+## Seven rules (codex 67–68)
 
-- **task_coordination**: Task coordination
-- **agent_delegation**: Agent delegation
-- **workflow_management**: Workflow management
+1. Phased plan + detailed todos; assign best subagent; monitor output
+2. Lead dev loops test→fix until green; no permission pings
+3. Per-suite test triage after major changes; full suite last
+4. Lead stays main thread; subagents execute; update todos
+5. Read all console and test output; triage fix rerun
+6. Never defer errors as "pre-existing" — add todo and resolve
+7. Resolve all errors before phase completion
 
-## Usage
+## MCP loop (one tool surface — no autonomy-intake)
 
-This skill provides orchestration capabilities for orchestrator functionality.
+| Step | MCP tool | Notes |
+|------|----------|-------|
+| **Intake + classify** | `analyze-complexity` | Pass `tasks` array; response includes **lead-dev plan JSON** when mode is on |
+| Delegate | `orchestrate-task` | Include agent + sessionId (codex 67) |
+| Monitor | `get-orchestration-status` | Lead updates todos |
+| Major work | researcher + architect-tools + code-review | Auto-listed in plan when complexity > threshold |
 
-## Integration
+## Subagent routing
 
-Activated when orchestration capabilities are requested through the skills system.
+| Task | Subagent |
+|------|----------|
+| Phasing | strategist |
+| Architecture | architect-tools |
+| Research | researcher |
+| Implementation | backend-engineer / frontend-engineer |
+| Test failures | bug-triage |
+| Review | code-review |
+
+## Hooks (rewired, not new MCPs)
+
+- **SessionStart** → `session-start.js` boots lead_dev_mode
+- **PreToolUse** → hints `per_suite_triage_required` on full `npm test`
+
+Config: `features.json` → `multi_agent_orchestration.lead_dev_mode`