0xray 3.4.7 → 3.4.8

package/AGENTS-consumer.md

@@ -4,7 +4,7 @@
 
 Quick reference for the 0xRay AI orchestration framework (shipped to your project on `npm install 0xray`).
 
-**v3.4.7** — 7 MCP servers · 45 skills · 68 codex terms · 4 platform bridges
+**v3.4.8** — 7 MCP servers · 45 skills · 68 codex terms · 4 platform bridges
 
 ## Postinstall (automatic)
 

package/AGENTS.md

@@ -1,6 +1,6 @@
 # xray Agents
 
-Quick reference for the xray AI orchestration framework (**v3.4.7**).
+Quick reference for the xray AI orchestration framework (**v3.4.8**).
 
 **42 agents** · **45 skills** · **7 consumer MCP servers** · **68 codex terms** · **3,226 tests**
 

package/README.md

@@ -1,6 +1,6 @@
 # xray — MCP-Centric AI Governance OS
 
-**v3.4.7** — 42 agents · 45 skills · 7 MCP servers · 68 codex terms · 3,226 tests
+**v3.4.8** — 42 agents · 45 skills · 7 MCP servers · 68 codex terms · 3,226 tests
 
 xray is the pure v2 three-subsystem AI orchestration framework — **MCP-centric**, governed by Dynamo, and autonomous via thinDispatch. Consumer `npm install 0xray` auto-wires all four platform bridges and seven MCP servers with zero manual config.
 

package/SKILLS.md

@@ -1,6 +1,6 @@
 # 0xray Skills
 
-**v3.4.7** — **45 skills** · invoked via `xray-skills` MCP · synced on postinstall
+**v3.4.8** — **45 skills** · invoked via `xray-skills` MCP · synced on postinstall
 
 xray ships 45 knowledge skills (`src/skills/<name>/SKILL.md`) across the full software lifecycle. Lead-dev operating model lives in **`orchestrator`** skill + `multi_agent_orchestration.lead_dev_mode` in features.json. Skills load on demand via the **xray-skills** MCP server (`npx -y 0xray mcp skills`), agent `@mentions`, or platform skill directories after postinstall.
 

package/dist/AGENTS.md

@@ -1,6 +1,6 @@
 # xray Agents
 
-Quick reference for the xray AI orchestration framework (**v3.4.7**).
+Quick reference for the xray AI orchestration framework (**v3.4.8**).
 
 **42 agents** · **45 skills** · **7 consumer MCP servers** · **68 codex terms** · **3,226 tests**
 

package/dist/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Conventional Commits](https://www.conventionalcommits.org/).
 
+## [3.4.8] - 2026-06-19
+
+### 🐛 Bug Fixes
+- **Hermes v2 OAuth** — governance LLM voters read `providers.xai-oauth.tokens` from `~/.hermes/auth.json` (npm consumers on modern Hermes no longer abstain)
+- **Headless deliberation** — honor `XRAY_GOVERNANCE_IN_PROCESS=1` for in-process skill voters without MCP subprocesses
+- **Governance MCP HTTP** — per-session Streamable HTTP transports on Railway
+
+### ✅ Tests
+- Unit coverage for Hermes v2 auth parsing and `XRAY_GOVERNANCE_IN_PROCESS` governance path
+
+---
+
 ## [3.4.7] - 2026-06-18
 
 ### 🐛 Bug Fixes

package/dist/README.md

@@ -1,6 +1,6 @@
 # xray — MCP-Centric AI Governance OS
 
-**v3.4.7** — 42 agents · 45 skills · 7 MCP servers · 68 codex terms · 3,226 tests
+**v3.4.8** — 42 agents · 45 skills · 7 MCP servers · 68 codex terms · 3,226 tests
 
 xray is the pure v2 three-subsystem AI orchestration framework — **MCP-centric**, governed by Dynamo, and autonomous via thinDispatch. Consumer `npm install 0xray` auto-wires all four platform bridges and seven MCP servers with zero manual config.
 

package/dist/SKILLS.md

@@ -1,6 +1,6 @@
 # 0xray Skills
 
-**v3.4.7** — **45 skills** · invoked via `xray-skills` MCP · synced on postinstall
+**v3.4.8** — **45 skills** · invoked via `xray-skills` MCP · synced on postinstall
 
 xray ships 45 knowledge skills (`src/skills/<name>/SKILL.md`) across the full software lifecycle. Lead-dev operating model lives in **`orchestrator`** skill + `multi_agent_orchestration.lead_dev_mode` in features.json. Skills load on demand via the **xray-skills** MCP server (`npx -y 0xray mcp skills`), agent `@mentions`, or platform skill directories after postinstall.
 

package/dist/governance/governance-service.js

@@ -128,7 +128,9 @@ export class GovernanceService {
     }
     async callSkillServer(serverName, proposals, context) {
         const votes = [];
-        const useInProcess = process.env.VERCEL === '1' || !!process.env.RAILWAY_ENVIRONMENT;
+        const useInProcess = process.env.VERCEL === '1' ||
+            !!process.env.RAILWAY_ENVIRONMENT ||
+            process.env.XRAY_GOVERNANCE_IN_PROCESS === '1';
         for (const proposal of proposals) {
             try {
                 let text = '';

package/dist/governance/llm-governance-provider.js

@@ -42,6 +42,71 @@ DECISION: approve|reject|abstain
 CONFIDENCE: <0.0-1.0>
 REASONING: <2-4 sentence analysis of the proposal's broader project impact>`,
 };
+function resolveHermesExpiresAt(provider, tokens) {
+    if (typeof provider.expires_at === "number")
+        return provider.expires_at;
+    const expiresIn = tokens?.expires_in ?? provider.expires_in;
+    if (typeof expiresIn !== "number")
+        return undefined;
+    const refreshCandidates = [provider.last_refresh, tokens?.last_refresh];
+    for (const lastRefresh of refreshCandidates) {
+        if (typeof lastRefresh !== "string")
+            continue;
+        const base = Date.parse(lastRefresh);
+        if (!Number.isNaN(base)) {
+            return Math.floor((base + expiresIn * 1000) / 1000);
+        }
+    }
+    return undefined;
+}
+function extractHermesOAuthEntry(data) {
+    if (!data || typeof data !== "object")
+        return undefined;
+    if (Array.isArray(data)) {
+        return data.find((e) => e.provider === "xai-oauth" || !!e.access_token);
+    }
+    const record = data;
+    const legacy = record["xai-oauth"];
+    if (legacy && typeof legacy === "object") {
+        const entry = legacy;
+        if (entry.access_token)
+            return entry;
+    }
+    if (typeof record.access_token === "string") {
+        return record;
+    }
+    for (const bucket of ["providers", "credential_pool"]) {
+        const pool = record[bucket];
+        if (!pool || typeof pool !== "object")
+            continue;
+        const provider = pool["xai-oauth"];
+        if (!provider || typeof provider !== "object")
+            continue;
+        const prov = provider;
+        const tokens = prov.tokens && typeof prov.tokens === "object"
+            ? prov.tokens
+            : undefined;
+        if (tokens && typeof tokens.access_token === "string") {
+            const entry = {
+                access_token: tokens.access_token,
+                provider: "xai-oauth",
+            };
+            if (typeof tokens.refresh_token === "string") {
+                entry.refresh_token = tokens.refresh_token;
+            }
+            const expiresAt = resolveHermesExpiresAt(prov, tokens);
+            if (expiresAt !== undefined)
+                entry.expires_at = expiresAt;
+            if (typeof tokens.token_type === "string")
+                entry.token_type = tokens.token_type;
+            return entry;
+        }
+        if (typeof prov.access_token === "string") {
+            return prov;
+        }
+    }
+    return undefined;
+}
 function readHermesOAuthToken() {
     try {
         const authPath = join(homedir(), ".hermes", "auth.json");
@@ -49,16 +114,7 @@ function readHermesOAuthToken() {
             return null;
         const raw = readFileSync(authPath, "utf-8");
         const data = JSON.parse(raw);
-        let entry;
-        if (data && typeof data === "object" && !Array.isArray(data)) {
-            entry = data["xai-oauth"];
-            if (!entry?.access_token && data.access_token) {
-                entry = data;
-            }
-        }
-        if (!entry?.access_token && Array.isArray(data)) {
-            entry = data.find((e) => e.provider === "xai-oauth" || !!e.access_token);
-        }
+        const entry = extractHermesOAuthEntry(data);
         if (!entry?.access_token) {
             process.stderr.write("[llm] readHermesOAuthToken: no access_token in auth file\n");
             return null;

package/dist/mcps/governance.server.d.ts

@@ -29,6 +29,7 @@ declare class GovernanceServer extends XrayKnowledgeSkillBase {
     connect(transport: Transport): Promise<void>;
     /**
      * Run as HTTP server using Streamable HTTP transport (for Grok CLI compatibility).
+     * Uses per-session transports so concurrent clients can each initialize independently.
      */
     runHttp(port?: number): Promise<void>;
 }

package/dist/mcps/governance.server.js

@@ -13,7 +13,7 @@
  */
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { createMcpExpressApp } from "@modelcontextprotocol/sdk/server/express.js";
-import { CallToolRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
+import { CallToolRequestSchema, isInitializeRequest, } from "@modelcontextprotocol/sdk/types.js";
 import { XrayKnowledgeSkillBase } from "./shared/knowledge-skill-base.js";
 import { frameworkLogger } from "../core/framework-logger.js";
 import { featuresConfigLoader } from "../core/features-config.js";
@@ -351,6 +351,7 @@ class GovernanceServer extends XrayKnowledgeSkillBase {
     }
     /**
      * Run as HTTP server using Streamable HTTP transport (for Grok CLI compatibility).
+     * Uses per-session transports so concurrent clients can each initialize independently.
      */
     async runHttp(port = parseInt(process.env.MCP_PORT ?? "3100", 10)) {
         await this.initializeGovernance();
@@ -360,10 +361,7 @@ class GovernanceServer extends XrayKnowledgeSkillBase {
             host: mcpHost,
             ...(allowedHosts ? { allowedHosts } : {}),
         });
-        const transport = new StreamableHTTPServerTransport({
-            sessionIdGenerator: () => randomUUID(),
-        });
-        await this.server.connect(transport);
+        const transports = {};
         const apiKey = process.env.GOVERNANCE_API_KEY;
         if (apiKey) {
             frameworkLogger.log("governance-mcp", "api-key-auth-enabled", "info", {});
@@ -383,8 +381,45 @@ class GovernanceServer extends XrayKnowledgeSkillBase {
             }
             next();
         });
-        app.post("/mcp", async (req, res) => {
+        const mcpPostHandler = async (req, res) => {
             try {
+                const sessionId = req.headers["mcp-session-id"];
+                let transport;
+                if (sessionId && transports[sessionId]) {
+                    transport = transports[sessionId];
+                }
+                else if (!sessionId && isInitializeRequest(req.body)) {
+                    transport = new StreamableHTTPServerTransport({
+                        sessionIdGenerator: () => randomUUID(),
+                        onsessioninitialized: (sid) => {
+                            if (transport) {
+                                transports[sid] = transport;
+                                frameworkLogger.log("governance-mcp", "session-initialized", "info", {
+                                    sessionId: sid,
+                                });
+                            }
+                        },
+                    });
+                    transport.onclose = () => {
+                        const sid = transport?.sessionId;
+                        if (sid && transports[sid]) {
+                            delete transports[sid];
+                            frameworkLogger.log("governance-mcp", "session-closed", "info", { sessionId: sid });
+                        }
+                    };
+                    const sessionServer = new GovernanceServer();
+                    await sessionServer.connect(transport);
+                    await transport.handleRequest(req, res, req.body);
+                    return;
+                }
+                else {
+                    res.status(400).json({
+                        jsonrpc: "2.0",
+                        error: { code: -32000, message: "Bad Request: No valid session ID provided" },
+                        id: null,
+                    });
+                    return;
+                }
                 await transport.handleRequest(req, res, req.body);
             }
             catch (error) {
@@ -393,15 +428,51 @@ class GovernanceServer extends XrayKnowledgeSkillBase {
                     res.status(500).json({ jsonrpc: "2.0", error: { code: -32603, message: "Internal error" }, id: null });
                 }
             }
+        };
+        app.post("/mcp", mcpPostHandler);
+        app.get("/mcp", async (req, res) => {
+            const sessionId = req.headers["mcp-session-id"];
+            if (!sessionId || !transports[sessionId]) {
+                res.status(400).send("Invalid or missing session ID");
+                return;
+            }
+            try {
+                await transports[sessionId].handleRequest(req, res);
+            }
+            catch (error) {
+                frameworkLogger.log("governance-mcp", "http-sse-error", "error", { error: String(error) });
+                if (!res.headersSent) {
+                    res.status(500).send("Error processing SSE stream");
+                }
+            }
+        });
+        app.delete("/mcp", async (req, res) => {
+            const sessionId = req.headers["mcp-session-id"];
+            if (!sessionId || !transports[sessionId]) {
+                res.status(400).send("Invalid or missing session ID");
+                return;
+            }
+            try {
+                await transports[sessionId].handleRequest(req, res);
+            }
+            catch (error) {
+                frameworkLogger.log("governance-mcp", "http-delete-error", "error", { error: String(error) });
+                if (!res.headersSent) {
+                    res.status(500).send("Error processing session termination");
+                }
+            }
         });
         app.get("/health", (_req, res) => {
             res.json({ status: "ok", server: "governance" });
         });
+        const closeAllTransports = async () => {
+            await Promise.all(Object.values(transports).map((t) => t.close()));
+        };
         app.listen(port, () => {
             frameworkLogger.log("governance-mcp", "http-listening", "info", { port });
         });
-        process.on("SIGINT", () => { transport.close(); process.exit(0); });
-        process.on("SIGTERM", () => { transport.close(); process.exit(0); });
+        process.on("SIGINT", () => { void closeAllTransports().then(() => process.exit(0)); });
+        process.on("SIGTERM", () => { void closeAllTransports().then(() => process.exit(0)); });
     }
 }
 // Start the server if this file is run directly

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "0xray",
-  "version": "3.4.7",
+  "version": "3.4.8",
   "description": "Multi-agent orchestration and Codex governance for OpenCode, Hermes, Grok Build, and OpenClaw",
   "readme": "README.md",
   "license": "MIT",

package/scripts/node/release-gate.mjs

@@ -36,18 +36,26 @@ function main() {
 
   try {
     if (verifyOnly) {
-      step("1/4 Git + reconcile", "node scripts/node/pre-publish-guard.js --verify-only");
+      step("1/5 Git + reconcile", "node scripts/node/pre-publish-guard.js --verify-only");
       if (!skipDocs) {
-        step("2/4 Release docs", "node scripts/node/validate-release-docs.mjs");
+        step("2/5 Release docs", "node scripts/node/validate-release-docs.mjs");
       }
+      step(
+        "3/5 Plugin infrastructure",
+        "node scripts/test/validate-plugins-e2e.cjs --structural-only",
+      );
       if (!skipSmoke) {
-        step("3/4 Consumer install smoke", "node scripts/node/consumer-install-smoke.mjs");
+        step("4/5 Consumer install smoke", "node scripts/node/consumer-install-smoke.mjs");
       }
     } else {
-      step("1/4 Build", "npm run build");
-      step("2/4 Tests", "npm test");
+      step("1/5 Build", "npm run build");
+      step("2/5 Tests", "npm test");
+      step(
+        "3/5 Plugin infrastructure",
+        "node scripts/test/validate-plugins-e2e.cjs --structural-only",
+      );
       if (!skipSmoke) {
-        step("3/4 Consumer install smoke (fresh + upgrade)", "node scripts/node/consumer-install-smoke.mjs");
+        step("4/5 Consumer install smoke (fresh + upgrade)", "node scripts/node/consumer-install-smoke.mjs");
       }
     }
 

package/src/mcps/governance.server.ts

@@ -18,6 +18,7 @@ import { createMcpExpressApp } from "@modelcontextprotocol/sdk/server/express.js
 import type { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
 import {
   CallToolRequestSchema,
+  isInitializeRequest,
   type CallToolResult,
 } from "@modelcontextprotocol/sdk/types.js";
 import { XrayKnowledgeSkillBase } from "./shared/knowledge-skill-base.js";
@@ -419,6 +420,7 @@ class GovernanceServer extends XrayKnowledgeSkillBase {
 
   /**
    * Run as HTTP server using Streamable HTTP transport (for Grok CLI compatibility).
+   * Uses per-session transports so concurrent clients can each initialize independently.
    */
   async runHttp(port: number = parseInt(process.env.MCP_PORT ?? "3100", 10)): Promise<void> {
     await this.initializeGovernance();
@@ -429,11 +431,7 @@ class GovernanceServer extends XrayKnowledgeSkillBase {
       host: mcpHost,
       ...(allowedHosts ? { allowedHosts } : {}),
     });
-    const transport = new StreamableHTTPServerTransport({
-      sessionIdGenerator: () => randomUUID(),
-    });
-
-    await this.server.connect(transport as any);
+    const transports: Record<string, StreamableHTTPServerTransport> = {};
 
     const apiKey = process.env.GOVERNANCE_API_KEY;
     if (apiKey) {
@@ -455,8 +453,45 @@ class GovernanceServer extends XrayKnowledgeSkillBase {
       next();
     });
 
-    app.post("/mcp", async (req: any, res: any) => {
+    const mcpPostHandler = async (req: any, res: any) => {
       try {
+        const sessionId = req.headers["mcp-session-id"] as string | undefined;
+        let transport: StreamableHTTPServerTransport | undefined;
+
+        if (sessionId && transports[sessionId]) {
+          transport = transports[sessionId];
+        } else if (!sessionId && isInitializeRequest(req.body)) {
+          transport = new StreamableHTTPServerTransport({
+            sessionIdGenerator: () => randomUUID(),
+            onsessioninitialized: (sid) => {
+              if (transport) {
+                transports[sid] = transport;
+                frameworkLogger.log("governance-mcp", "session-initialized", "info", {
+                  sessionId: sid,
+                });
+              }
+            },
+          });
+          transport.onclose = () => {
+            const sid = transport?.sessionId;
+            if (sid && transports[sid]) {
+              delete transports[sid];
+              frameworkLogger.log("governance-mcp", "session-closed", "info", { sessionId: sid });
+            }
+          };
+          const sessionServer = new GovernanceServer();
+          await sessionServer.connect(transport as Transport);
+          await transport.handleRequest(req, res, req.body);
+          return;
+        } else {
+          res.status(400).json({
+            jsonrpc: "2.0",
+            error: { code: -32000, message: "Bad Request: No valid session ID provided" },
+            id: null,
+          });
+          return;
+        }
+
         await transport.handleRequest(req, res, req.body);
       } catch (error) {
         frameworkLogger.log("governance-mcp", "http-handler-error", "error", { error: String(error) });
@@ -464,18 +499,56 @@ class GovernanceServer extends XrayKnowledgeSkillBase {
           res.status(500).json({ jsonrpc: "2.0", error: { code: -32603, message: "Internal error" }, id: null });
         }
       }
+    };
+
+    app.post("/mcp", mcpPostHandler);
+
+    app.get("/mcp", async (req: any, res: any) => {
+      const sessionId = req.headers["mcp-session-id"] as string | undefined;
+      if (!sessionId || !transports[sessionId]) {
+        res.status(400).send("Invalid or missing session ID");
+        return;
+      }
+      try {
+        await transports[sessionId].handleRequest(req, res);
+      } catch (error) {
+        frameworkLogger.log("governance-mcp", "http-sse-error", "error", { error: String(error) });
+        if (!res.headersSent) {
+          res.status(500).send("Error processing SSE stream");
+        }
+      }
+    });
+
+    app.delete("/mcp", async (req: any, res: any) => {
+      const sessionId = req.headers["mcp-session-id"] as string | undefined;
+      if (!sessionId || !transports[sessionId]) {
+        res.status(400).send("Invalid or missing session ID");
+        return;
+      }
+      try {
+        await transports[sessionId].handleRequest(req, res);
+      } catch (error) {
+        frameworkLogger.log("governance-mcp", "http-delete-error", "error", { error: String(error) });
+        if (!res.headersSent) {
+          res.status(500).send("Error processing session termination");
+        }
+      }
     });
 
     app.get("/health", (_req: any, res: any) => {
       res.json({ status: "ok", server: "governance" });
     });
 
+    const closeAllTransports = async () => {
+      await Promise.all(Object.values(transports).map((t) => t.close()));
+    };
+
     app.listen(port, () => {
       frameworkLogger.log("governance-mcp", "http-listening", "info", { port });
     });
 
-    process.on("SIGINT", () => { transport.close(); process.exit(0); });
-    process.on("SIGTERM", () => { transport.close(); process.exit(0); });
+    process.on("SIGINT", () => { void closeAllTransports().then(() => process.exit(0)); });
+    process.on("SIGTERM", () => { void closeAllTransports().then(() => process.exit(0)); });
   }
 }