0xray 3.4.7 → 3.4.9

package/dist/mcps/orchestrator/execution/execution-planner.js

@@ -5,6 +5,20 @@
  */
 import { getAgentCapabilitiesManager } from '../config/agent-capabilities.js';
 import { getProvider, toMemoryTask, fromMemoryTask, } from '../config/memory-routing-bridge.js';
+/** Dependency count from task-ID list or numeric hint from analyze-complexity */
+export function dependencyCount(deps) {
+    if (deps == null)
+        return 0;
+    if (typeof deps === 'number' && Number.isFinite(deps)) {
+        return Math.max(0, Math.round(deps));
+    }
+    if (Array.isArray(deps))
+        return deps.length;
+    return 0;
+}
+function isDependencyIdList(deps) {
+    return Array.isArray(deps) && deps.length > 0;
+}
 /**
  * Execution Planner
  * Plans and optimizes task execution strategies
@@ -33,8 +47,8 @@ export class ExecutionPlanner {
             if (!task.type) {
                 errors.push(`Task ${i}: Missing required field 'type'`);
             }
-            // Check dependencies exist
-            if (task.dependencies && task.id) {
+            // Check task-ID dependencies exist (numeric hints skip graph validation)
+            if (isDependencyIdList(task.dependencies) && task.id) {
                 const taskIds = new Set(tasks.map(t => t.id).filter((id) => !!id));
                 for (const depId of task.dependencies) {
                     if (!taskIds.has(depId)) {
@@ -117,11 +131,11 @@ export class ExecutionPlanner {
         const independentTasks = [];
         const dependentTasks = [];
         for (const task of sortedTasks) {
-            if (!task.dependencies || task.dependencies.length === 0) {
-                independentTasks.push(task);
+            if (isDependencyIdList(task.dependencies)) {
+                dependentTasks.push(task);
             }
             else {
-                dependentTasks.push(task);
+                independentTasks.push(task);
             }
         }
         // Assign independent tasks in parallel
@@ -140,7 +154,7 @@ export class ExecutionPlanner {
             if (visited.has(task.id))
                 return;
             visited.add(task.id);
-            if (task.dependencies) {
+            if (isDependencyIdList(task.dependencies)) {
                 for (const depId of task.dependencies) {
                     const depTask = taskMap.get(depId);
                     if (depTask)
@@ -263,10 +277,7 @@ export class ExecutionPlanner {
         if (task.estimatedComplexity) {
             complexity = (complexity + task.estimatedComplexity) / 2;
         }
-        // Adjust based on dependencies
-        if (task.dependencies) {
-            complexity += task.dependencies.length * 5;
-        }
+        complexity += dependencyCount(task.dependencies) * 5;
         if (task.metadata?.memoryComplexityBoost !== undefined) {
             complexity += task.metadata.memoryComplexityBoost;
         }
@@ -295,7 +306,7 @@ export class ExecutionPlanner {
      */
     calculateParallelPotential(tasks) {
         // Tasks without dependencies can run in parallel
-        const independent = tasks.filter(t => !t.dependencies || t.dependencies.length === 0);
+        const independent = tasks.filter((t) => !isDependencyIdList(t.dependencies));
         return independent.length / tasks.length;
     }
 }

package/dist/mcps/orchestrator/handlers/complexity-handler.d.ts

@@ -4,6 +4,17 @@
  * Handles complexity analysis requests
  */
 import type { OrchestrationTask } from '../types.js';
+type AnalyzeComplexityInput = {
+    id?: string;
+    description?: string;
+    type?: string;
+    files?: string[];
+    dependencyCount?: number;
+    dependencies?: string[] | number;
+    riskLevel?: string;
+    estimatedComplexity?: number;
+    priority?: OrchestrationTask['priority'];
+};
 /**
  * Complexity Handler
  * Processes analyze-complexity requests
@@ -14,7 +25,7 @@ export declare class ComplexityHandler {
      * Handle analyze-complexity request
      */
     handleAnalyzeComplexity(args: {
-        tasks: OrchestrationTask[];
+        tasks: AnalyzeComplexityInput[];
     }, asideId?: string): Promise<{
         content: Array<{
             type: string;
@@ -30,3 +41,4 @@ export declare class ComplexityHandler {
      */
     private formatComplexityResponse;
 }
+export {};

package/dist/mcps/orchestrator/handlers/complexity-handler.js

@@ -7,6 +7,34 @@ import { frameworkLogger } from '../../../core/framework-logger.js';
 import { buildLeadDevPlan, isLeadDevModeActive, persistLeadDevPlan, } from '../../../nucleus/autonomy-kernel.js';
 import { getExecutionPlanner } from '../execution/execution-planner.js';
 import { addObservations, extractComplexityObservations } from '../aside-context.js';
+function normalizeAnalyzeTasks(raw) {
+    return raw.map((task, index) => {
+        let deps;
+        if (Array.isArray(task.dependencies)) {
+            deps = task.dependencies;
+        }
+        else if (typeof task.dependencies === 'number' && Number.isFinite(task.dependencies)) {
+            deps = task.dependencies;
+        }
+        else if (typeof task.dependencyCount === 'number' &&
+            Number.isFinite(task.dependencyCount)) {
+            deps = task.dependencyCount;
+        }
+        const normalized = {
+            id: task.id ?? `task-${index + 1}`,
+            description: task.description ?? '',
+            type: task.type ?? 'implement',
+        };
+        if (task.priority)
+            normalized.priority = task.priority;
+        if (deps !== undefined)
+            normalized.dependencies = deps;
+        if (task.estimatedComplexity !== undefined) {
+            normalized.estimatedComplexity = task.estimatedComplexity;
+        }
+        return normalized;
+    });
+}
 /**
  * Complexity Handler
  * Processes analyze-complexity requests
@@ -17,7 +45,7 @@ export class ComplexityHandler {
      * Handle analyze-complexity request
      */
     async handleAnalyzeComplexity(args, asideId) {
-        const { tasks = [] } = args;
+        const tasks = normalizeAnalyzeTasks(args.tasks ?? []);
         await frameworkLogger.log('orchestrator.server', 'analyze-complexity-start', 'info', { taskCount: tasks.length });
         try {
             const analysis = await this.planner.analyzeTaskComplexity(tasks);
@@ -27,12 +55,20 @@ export class ComplexityHandler {
             }
             const primaryDescription = tasks.map((t) => t.description).filter(Boolean).join(' ');
             const taskTypes = tasks.map((t) => t.type).filter(Boolean);
-            const leadDevPlan = isLeadDevModeActive() && primaryDescription
-                ? buildLeadDevPlan(primaryDescription, taskTypes.length ? taskTypes : ['implement'])
+            const planTaskInputs = tasks
+                .filter((t) => t.description?.trim())
+                .map((t) => ({ description: t.description, type: t.type }));
+            const leadDevPlan = isLeadDevModeActive() && (primaryDescription || planTaskInputs.length > 0)
+                ? buildLeadDevPlan(primaryDescription, taskTypes.length ? taskTypes : ['implement'], planTaskInputs)
                 : null;
             if (leadDevPlan) {
                 try {
-                    persistLeadDevPlan(leadDevPlan);
+                    const planPath = persistLeadDevPlan(leadDevPlan);
+                    await frameworkLogger.log('orchestrator.server', 'lead-dev-plan-persisted', 'info', {
+                        planPath,
+                        phaseCount: leadDevPlan.phases.length,
+                        todoCount: leadDevPlan.phases.reduce((n, p) => n + p.todos.length, 0),
+                    });
                 }
                 catch (err) {
                     await frameworkLogger.log('orchestrator.server', 'lead-dev-plan-persist-failed', 'warning', { error: err instanceof Error ? err.message : String(err) });

package/dist/mcps/orchestrator/handlers/task-handler.js

@@ -49,7 +49,6 @@ export class TaskHandler {
                     },
                 });
             }
-            // Execute orchestration (simulated for MCP server)
             const results = await this.executePlan(executionPlan, sessionId, timeout);
             // Feed per-task outcomes back to memory provider (not aggregate session stats)
             if (memoryProvider.ingestFeedback) {
@@ -74,6 +73,8 @@ export class TaskHandler {
             orchestrationResult.success = results.success;
             orchestrationResult.completedTasks = results.completedTasks;
             orchestrationResult.failedTasks = results.failedTasks;
+            orchestrationResult.deferredTasks = results.deferredTasks;
+            orchestrationResult.recommendations.push(...results.recommendations);
             orchestrationResult.agentUtilization = results.agentUtilization;
             orchestrationResult.bottlenecks = results.bottlenecks;
             orchestrationResult.recommendations = results.recommendations;
@@ -111,6 +112,7 @@ export class TaskHandler {
         const agentUtilization = {};
         let completedTasks = 0;
         let failedTasks = 0;
+        let deferredTasks = 0;
         const agentOutputs = {};
         const taskOutcomes = [];
         const skillServers = new Set([
@@ -163,20 +165,23 @@ export class TaskHandler {
                 }
             }
             else {
-                // For non-MCP agents we still count them as "assigned" (they will be handled by the caller or legacy path)
                 for (const task of tasks) {
-                    completedTasks++;
+                    deferredTasks++;
                     taskOutcomes.push({
                         taskId: task.id,
                         agent,
-                        success: true,
+                        success: false,
                         durationMs: 0,
                     });
+                    await frameworkLogger.log('orchestrator.task-handler', 'delegate-deferred', 'info', { agent, taskId: task.id, sessionId });
                 }
             }
         }
         const recommendations = [];
         const bottlenecks = [];
+        if (deferredTasks > 0) {
+            recommendations.push(`${deferredTasks} task(s) require host delegation (Task/spawn_subagent per lead-dev-plan) — orchestrate-task only invokes MCP consult skills directly`);
+        }
         if (plan.agentAssignments.size > 5) {
             recommendations.push('Consider reducing the number of agents for better coordination');
         }
@@ -186,9 +191,10 @@ export class TaskHandler {
             }
         }
         return {
-            success: failedTasks === 0,
+            success: failedTasks === 0 && deferredTasks === 0,
             completedTasks,
             failedTasks,
+            deferredTasks,
             agentUtilization,
             bottlenecks,
             recommendations,
@@ -232,9 +238,10 @@ export class TaskHandler {
 **Session ID:** ${result.sessionId}
 **Success:** ${result.success ? '✅ COMPLETED' : '❌ FAILED'}
 **Duration:** ${result.duration}ms
-**Tasks:** ${result.completedTasks + result.failedTasks} total
+**Tasks:** ${result.completedTasks + result.failedTasks + (result.deferredTasks ?? 0)} total
   - ✅ Completed: ${result.completedTasks}
   - ❌ Failed: ${result.failedTasks}
+  - ⏸ Deferred (host delegation required): ${result.deferredTasks ?? 0}
 
 **Agent Utilization:**
 ${Object.entries(result.agentUtilization)

package/dist/mcps/orchestrator/server.js

@@ -117,7 +117,15 @@ export class OrchestratorServer {
                                             description: { type: 'string' },
                                             type: { type: 'string' },
                                             files: { type: 'array', items: { type: 'string' } },
-                                            dependencies: { type: 'number' },
+                                            dependencyCount: {
+                                                type: 'number',
+                                                description: 'Upstream dependency count (complexity hint only)',
+                                            },
+                                            dependencies: {
+                                                type: 'array',
+                                                items: { type: 'string' },
+                                                description: 'Task IDs this task depends on',
+                                            },
                                             riskLevel: {
                                                 type: 'string',
                                                 enum: ['low', 'medium', 'high', 'critical'],

package/dist/mcps/orchestrator/types.d.ts

@@ -27,7 +27,8 @@ export interface OrchestrationTask {
     description: string;
     type: string;
     priority?: 'critical' | 'high' | 'medium' | 'low';
-    dependencies?: string[];
+    /** Task IDs (orchestrate-task) or dependency count hint (analyze-complexity) */
+    dependencies?: string[] | number;
     estimatedComplexity?: number;
     metadata?: OrchestrationTaskMetadata;
 }
@@ -43,6 +44,8 @@ export interface OrchestrationResult {
     success: boolean;
     completedTasks: number;
     failedTasks: number;
+    /** Implementation agents not executed by orchestrate-task — lead must delegate via host Task */
+    deferredTasks?: number;
     duration: number;
     agentUtilization: Record<string, number>;
     agentOutputs?: Record<string, string>;

package/dist/mcps/researcher.server.js

@@ -397,7 +397,7 @@ class XrayLibrarianServer extends XrayKnowledgeSkillBase {
         if (!vote) {
             const abstainReason = memoryContext?.confidence.highConfidenceTrapPresent
                 ? "No LLM governance provider configured. Repertoire detected a high-confidence ontological trap — route to the recommended agent before proceeding."
-                : "No LLM governance provider configured. Set XRAY_GOVERNANCE_LLM_ENABLED=true + XRAY_LLM_ENDPOINT, or install Hermes and run: hermes auth add xai-oauth --no-browser";
+                : "No LLM governance provider configured. Install Hermes on PATH (hermes -z) with xai-oauth, or set XRAY_GOVERNANCE_LLM_ENABLED=true + XRAY_LLM_ENDPOINT.";
             return {
                 content: [
                     {

package/dist/nucleus/autonomy-kernel.d.ts

@@ -18,6 +18,10 @@ export interface LeadDevPhase {
     definitionOfDone: string;
     todos: LeadDevTodo[];
 }
+export interface LeadDevPlanTaskInput {
+    description: string;
+    type?: string;
+}
 export interface LeadDevPlan {
     active: boolean;
     rules: readonly string[];
@@ -37,7 +41,7 @@ export interface LeadDevPlan {
 export declare function isLeadDevModeActive(): boolean;
 export declare function routeSubagent(taskType: string): SubagentRoute;
 export declare function shouldFlagFullTestSuite(command: string): boolean;
-export declare function buildLeadDevPlan(description: string, taskTypes?: string[]): LeadDevPlan | null;
+export declare function buildLeadDevPlan(description: string, taskTypes?: string[], taskInputs?: LeadDevPlanTaskInput[]): LeadDevPlan | null;
 export declare function buildSessionBootContext(): Record<string, unknown>;
 /** Persist plan for PreToolUse spawn_subagent gate */
 export declare function persistLeadDevPlan(plan: LeadDevPlan, projectRoot?: string): string;

package/dist/nucleus/autonomy-kernel.js

@@ -57,14 +57,30 @@ export function shouldFlagFullTestSuite(command) {
         /\btest:\w+/.test(cmd);
     return isTest && !hasFocusedTarget;
 }
-export function buildLeadDevPlan(description, taskTypes = ['implement']) {
+function buildImplementationTodos(description, taskTypes, taskInputs, idPrefix) {
+    if (taskInputs.length > 0) {
+        return taskInputs.map((t, i) => ({
+            id: `${idPrefix}.${i + 1}`,
+            task: t.description.slice(0, 200),
+            subagent: routeSubagent(t.type ?? 'implement'),
+            status: 'pending',
+        }));
+    }
+    return taskTypes.map((type, i) => ({
+        id: `${idPrefix}.${i + 1}`,
+        task: description.slice(0, 200),
+        subagent: routeSubagent(type),
+        status: 'pending',
+    }));
+}
+export function buildLeadDevPlan(description, taskTypes = ['implement'], taskInputs = []) {
     if (!isLeadDevModeActive())
         return null;
     const cfg = orchestrationConfig();
     const threshold = cfg.phased_plan_threshold ?? 25;
     const score = scoreComplexity(description, { taskTypes });
     const complexity = score.score;
-    const requiresPhasedPlan = complexity > threshold;
+    const requiresPhasedPlan = complexity > threshold || taskInputs.length > 1;
     const mandatoryConsults = cfg.auto_consult_major_work !== false && requiresPhasedPlan
         ? [...MANDATORY_MAJOR_CONSULTS]
         : [];
@@ -87,12 +103,7 @@ export function buildLeadDevPlan(description, taskTypes = ['implement']) {
                 name: 'Implementation',
                 goal: 'Execute with best subagent per todo',
                 definitionOfDone: 'Affected per-suite tests green',
-                todos: taskTypes.map((type, i) => ({
-                    id: `2.${i + 1}`,
-                    task: description.slice(0, 200),
-                    subagent: routeSubagent(type),
-                    status: 'pending',
-                })),
+                todos: buildImplementationTodos(description, taskTypes, taskInputs, '2'),
             },
             {
                 id: 'phase-3',
@@ -121,14 +132,7 @@ export function buildLeadDevPlan(description, taskTypes = ['implement']) {
                 name: 'Direct execution',
                 goal: description.slice(0, 120),
                 definitionOfDone: 'Task complete with tests green',
-                todos: [
-                    {
-                        id: '1.1',
-                        task: description.slice(0, 200),
-                        subagent: routeSubagent(taskTypes[0] ?? 'implement'),
-                        status: 'pending',
-                    },
-                ],
+                todos: buildImplementationTodos(description, taskTypes, taskInputs, '1'),
             },
         ];
     return {

package/dist/skills/orchestrator/SKILL.md

@@ -36,8 +36,9 @@ When `multi_agent_orchestration.lead_dev_mode` is true in `features.json` (defau
 
 | Step | MCP tool | Notes |
 |------|----------|-------|
-| **Intake + classify** | `analyze-complexity` | Pass `tasks` array; response includes **lead-dev plan JSON** when mode is on |
-| Delegate | `orchestrate-task` | Include agent + sessionId (codex 67) |
+| **Intake + classify** | `analyze-complexity` | Pass `tasks` array; persists `.xray/state/lead-dev-plan.json` when mode is on |
+| Delegate (consult) | `orchestrate-task` | Invokes MCP consult skills (code-review, researcher, security-audit, etc.) |
+| Delegate (implement) | **host `Task` / `spawn_subagent`** | `orchestrate-task` **defers** backend-engineer, frontend-engineer, bug-triage — lead must spawn |
 | Monitor | `get-orchestration-status` | Lead updates todos |
 | Major work | researcher + architect-tools + code-review | Auto-listed in plan when complexity > threshold |
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "0xray",
-  "version": "3.4.7",
+  "version": "3.4.9",
   "description": "Multi-agent orchestration and Codex governance for OpenCode, Hermes, Grok Build, and OpenClaw",
   "readme": "README.md",
   "license": "MIT",

package/scripts/node/release-gate.mjs

@@ -36,18 +36,26 @@ function main() {
 
   try {
     if (verifyOnly) {
-      step("1/4 Git + reconcile", "node scripts/node/pre-publish-guard.js --verify-only");
+      step("1/5 Git + reconcile", "node scripts/node/pre-publish-guard.js --verify-only");
       if (!skipDocs) {
-        step("2/4 Release docs", "node scripts/node/validate-release-docs.mjs");
+        step("2/5 Release docs", "node scripts/node/validate-release-docs.mjs");
       }
+      step(
+        "3/5 Plugin infrastructure",
+        "node scripts/test/validate-plugins-e2e.cjs --structural-only",
+      );
       if (!skipSmoke) {
-        step("3/4 Consumer install smoke", "node scripts/node/consumer-install-smoke.mjs");
+        step("4/5 Consumer install smoke", "node scripts/node/consumer-install-smoke.mjs");
       }
     } else {
-      step("1/4 Build", "npm run build");
-      step("2/4 Tests", "npm test");
+      step("1/5 Build", "npm run build");
+      step("2/5 Tests", "npm test");
+      step(
+        "3/5 Plugin infrastructure",
+        "node scripts/test/validate-plugins-e2e.cjs --structural-only",
+      );
       if (!skipSmoke) {
-        step("3/4 Consumer install smoke (fresh + upgrade)", "node scripts/node/consumer-install-smoke.mjs");
+        step("4/5 Consumer install smoke (fresh + upgrade)", "node scripts/node/consumer-install-smoke.mjs");
       }
     }
 

package/src/mcps/governance.server.ts

@@ -18,6 +18,7 @@ import { createMcpExpressApp } from "@modelcontextprotocol/sdk/server/express.js
 import type { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
 import {
   CallToolRequestSchema,
+  isInitializeRequest,
   type CallToolResult,
 } from "@modelcontextprotocol/sdk/types.js";
 import { XrayKnowledgeSkillBase } from "./shared/knowledge-skill-base.js";
@@ -419,6 +420,7 @@ class GovernanceServer extends XrayKnowledgeSkillBase {
 
   /**
    * Run as HTTP server using Streamable HTTP transport (for Grok CLI compatibility).
+   * Uses per-session transports so concurrent clients can each initialize independently.
    */
   async runHttp(port: number = parseInt(process.env.MCP_PORT ?? "3100", 10)): Promise<void> {
     await this.initializeGovernance();
@@ -429,11 +431,7 @@ class GovernanceServer extends XrayKnowledgeSkillBase {
       host: mcpHost,
       ...(allowedHosts ? { allowedHosts } : {}),
     });
-    const transport = new StreamableHTTPServerTransport({
-      sessionIdGenerator: () => randomUUID(),
-    });
-
-    await this.server.connect(transport as any);
+    const transports: Record<string, StreamableHTTPServerTransport> = {};
 
     const apiKey = process.env.GOVERNANCE_API_KEY;
     if (apiKey) {
@@ -455,8 +453,45 @@ class GovernanceServer extends XrayKnowledgeSkillBase {
       next();
     });
 
-    app.post("/mcp", async (req: any, res: any) => {
+    const mcpPostHandler = async (req: any, res: any) => {
       try {
+        const sessionId = req.headers["mcp-session-id"] as string | undefined;
+        let transport: StreamableHTTPServerTransport | undefined;
+
+        if (sessionId && transports[sessionId]) {
+          transport = transports[sessionId];
+        } else if (!sessionId && isInitializeRequest(req.body)) {
+          transport = new StreamableHTTPServerTransport({
+            sessionIdGenerator: () => randomUUID(),
+            onsessioninitialized: (sid) => {
+              if (transport) {
+                transports[sid] = transport;
+                frameworkLogger.log("governance-mcp", "session-initialized", "info", {
+                  sessionId: sid,
+                });
+              }
+            },
+          });
+          transport.onclose = () => {
+            const sid = transport?.sessionId;
+            if (sid && transports[sid]) {
+              delete transports[sid];
+              frameworkLogger.log("governance-mcp", "session-closed", "info", { sessionId: sid });
+            }
+          };
+          const sessionServer = new GovernanceServer();
+          await sessionServer.connect(transport as Transport);
+          await transport.handleRequest(req, res, req.body);
+          return;
+        } else {
+          res.status(400).json({
+            jsonrpc: "2.0",
+            error: { code: -32000, message: "Bad Request: No valid session ID provided" },
+            id: null,
+          });
+          return;
+        }
+
         await transport.handleRequest(req, res, req.body);
       } catch (error) {
         frameworkLogger.log("governance-mcp", "http-handler-error", "error", { error: String(error) });
@@ -464,18 +499,56 @@ class GovernanceServer extends XrayKnowledgeSkillBase {
           res.status(500).json({ jsonrpc: "2.0", error: { code: -32603, message: "Internal error" }, id: null });
         }
       }
+    };
+
+    app.post("/mcp", mcpPostHandler);
+
+    app.get("/mcp", async (req: any, res: any) => {
+      const sessionId = req.headers["mcp-session-id"] as string | undefined;
+      if (!sessionId || !transports[sessionId]) {
+        res.status(400).send("Invalid or missing session ID");
+        return;
+      }
+      try {
+        await transports[sessionId].handleRequest(req, res);
+      } catch (error) {
+        frameworkLogger.log("governance-mcp", "http-sse-error", "error", { error: String(error) });
+        if (!res.headersSent) {
+          res.status(500).send("Error processing SSE stream");
+        }
+      }
+    });
+
+    app.delete("/mcp", async (req: any, res: any) => {
+      const sessionId = req.headers["mcp-session-id"] as string | undefined;
+      if (!sessionId || !transports[sessionId]) {
+        res.status(400).send("Invalid or missing session ID");
+        return;
+      }
+      try {
+        await transports[sessionId].handleRequest(req, res);
+      } catch (error) {
+        frameworkLogger.log("governance-mcp", "http-delete-error", "error", { error: String(error) });
+        if (!res.headersSent) {
+          res.status(500).send("Error processing session termination");
+        }
+      }
     });
 
     app.get("/health", (_req: any, res: any) => {
       res.json({ status: "ok", server: "governance" });
     });
 
+    const closeAllTransports = async () => {
+      await Promise.all(Object.values(transports).map((t) => t.close()));
+    };
+
     app.listen(port, () => {
       frameworkLogger.log("governance-mcp", "http-listening", "info", { port });
     });
 
-    process.on("SIGINT", () => { transport.close(); process.exit(0); });
-    process.on("SIGTERM", () => { transport.close(); process.exit(0); });
+    process.on("SIGINT", () => { void closeAllTransports().then(() => process.exit(0)); });
+    process.on("SIGTERM", () => { void closeAllTransports().then(() => process.exit(0)); });
   }
 }
 

package/src/mcps/knowledge-skills/code-review.server.ts

@@ -448,7 +448,7 @@ class XrayCodeReviewServer extends XrayKnowledgeSkillBase {
         content: [
           {
             type: "text",
-            text: "DECISION: abstain\nCONFIDENCE: 0.50\nREASONING: No LLM governance provider configured. Set XRAY_GOVERNANCE_LLM_ENABLED=true + XRAY_LLM_ENDPOINT, or install Hermes and run: hermes auth add xai-oauth --no-browser",
+            text: "DECISION: abstain\nCONFIDENCE: 0.50\nREASONING: No LLM governance provider configured. Install Hermes on PATH (hermes -z) with xai-oauth, or set XRAY_GOVERNANCE_LLM_ENABLED=true + XRAY_LLM_ENDPOINT.",
           },
         ],
       };

package/src/mcps/knowledge-skills/security-audit.server.ts

@@ -1008,7 +1008,7 @@ class XraySecurityAuditServer extends XrayKnowledgeSkillBase {
         content: [
           {
             type: "text",
-            text: "DECISION: abstain\nCONFIDENCE: 0.50\nREASONING: No LLM governance provider configured. Set XRAY_GOVERNANCE_LLM_ENABLED=true + XRAY_LLM_ENDPOINT, or install Hermes and run: hermes auth add xai-oauth --no-browser",
+            text: "DECISION: abstain\nCONFIDENCE: 0.50\nREASONING: No LLM governance provider configured. Install Hermes on PATH (hermes -z) with xai-oauth, or set XRAY_GOVERNANCE_LLM_ENABLED=true + XRAY_LLM_ENDPOINT.",
           },
         ],
       };

package/src/mcps/orchestrator/config/memory-routing-bridge.ts

@@ -39,7 +39,9 @@ export function toMemoryTask(task: OrchestrationTask): MemoryOrchestrationTask {
     type: task.type,
   };
   if (task.priority) result.priority = task.priority;
-  if (task.dependencies) result.dependencies = task.dependencies;
+  if (Array.isArray(task.dependencies) && task.dependencies.length > 0) {
+    result.dependencies = task.dependencies;
+  }
   if (task.estimatedComplexity !== undefined) result.estimatedComplexity = task.estimatedComplexity;
   if (task.metadata) result.metadata = task.metadata as Record<string, unknown>;
   return result;