0xray 3.4.8 → 3.4.9

package/AGENTS-consumer.md

@@ -4,7 +4,7 @@
 
 Quick reference for the 0xRay AI orchestration framework (shipped to your project on `npm install 0xray`).
 
-**v3.4.8** — 7 MCP servers · 45 skills · 68 codex terms · 4 platform bridges
+**v3.4.9** — 7 MCP servers · 45 skills · 68 codex terms · 4 platform bridges
 
 ## Postinstall (automatic)
 

package/AGENTS.md

@@ -1,6 +1,6 @@
 # xray Agents
 
-Quick reference for the xray AI orchestration framework (**v3.4.8**).
+Quick reference for the xray AI orchestration framework (**v3.4.9**).
 
 **42 agents** · **45 skills** · **7 consumer MCP servers** · **68 codex terms** · **3,226 tests**
 

package/README.md

@@ -1,6 +1,20 @@
 # xray — MCP-Centric AI Governance OS
 
-**v3.4.8** — 42 agents · 45 skills · 7 MCP servers · 68 codex terms · 3,226 tests
+**v3.4.9** — 42 agents · 45 skills · 7 MCP servers · 68 codex terms · 3,226 tests
+
+## Your AI Power Suit
+
+**Your AI Power ⚡️ Suit 🦾** — an exoskeleton that blocks AI slop from becoming real damage.
+
+- learns with **Repertoire** 🧠
+- has a **Solar Ban Hammer** ☀️🔨 (Dynamo governance)
+- can also **Confer** 🗣️ (3-agent internal deliberation)
+
+The core AI Governance OS stack is **complete and open source**. A commercial version is next — powers up the suit further.
+
+```bash
+npm install 0xray@latest
+```
 
 xray is the pure v2 three-subsystem AI orchestration framework — **MCP-centric**, governed by Dynamo, and autonomous via thinDispatch. Consumer `npm install 0xray` auto-wires all four platform bridges and seven MCP servers with zero manual config.
 

package/SKILLS.md

@@ -1,6 +1,6 @@
 # 0xray Skills
 
-**v3.4.8** — **45 skills** · invoked via `xray-skills` MCP · synced on postinstall
+**v3.4.9** — **45 skills** · invoked via `xray-skills` MCP · synced on postinstall
 
 xray ships 45 knowledge skills (`src/skills/<name>/SKILL.md`) across the full software lifecycle. Lead-dev operating model lives in **`orchestrator`** skill + `multi_agent_orchestration.lead_dev_mode` in features.json. Skills load on demand via the **xray-skills** MCP server (`npx -y 0xray mcp skills`), agent `@mentions`, or platform skill directories after postinstall.
 

package/dist/AGENTS.md

@@ -1,6 +1,6 @@
 # xray Agents
 
-Quick reference for the xray AI orchestration framework (**v3.4.8**).
+Quick reference for the xray AI orchestration framework (**v3.4.9**).
 
 **42 agents** · **45 skills** · **7 consumer MCP servers** · **68 codex terms** · **3,226 tests**
 

package/dist/CHANGELOG.md

@@ -4,6 +4,22 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Conventional Commits](https://www.conventionalcommits.org/).
 
+## [3.4.9] - 2026-06-19
+
+### ⚠️ Breaking Changes
+- **`orchestrate-task`** — returns `success: false` when implementation agents (backend-engineer, frontend-engineer, bug-triage, etc.) are **deferred**. Only MCP consult skills execute in-process. Callers must not treat a completed response as work done; delegate via host `Task` / `spawn_subagent` per lead-dev-plan.
+
+### 🐛 Bug Fixes
+- **Orchestrator honesty** — no fake-complete for implementation agents; `delegate-deferred` + `lead-dev-plan-persisted` logged to `activity.log`
+- **`analyze-complexity` NaN** — `dependencyCount` + `dependencies[]` schema; numeric dependency hints no longer produce NaN scores
+- **Lead-dev plan** — `buildLeadDevPlan` uses per-task inputs; multi-task intake forces phased plan (not collapsed "Direct execution")
+- **Hermes governance voters** — route through `hermes -z` CLI (same path as groover `hermes-runner`); honor `HERMES_BIN`, `HERMES_HOME`
+
+### ✅ Tests
+- Unit coverage: `execution-planner-dependencies`, deferred task-handler, per-task lead-dev todos
+
+---
+
 ## [3.4.8] - 2026-06-19
 
 ### 🐛 Bug Fixes

package/dist/README.md

@@ -1,6 +1,20 @@
 # xray — MCP-Centric AI Governance OS
 
-**v3.4.8** — 42 agents · 45 skills · 7 MCP servers · 68 codex terms · 3,226 tests
+**v3.4.9** — 42 agents · 45 skills · 7 MCP servers · 68 codex terms · 3,226 tests
+
+## Your AI Power Suit
+
+**Your AI Power ⚡️ Suit 🦾** — an exoskeleton that blocks AI slop from becoming real damage.
+
+- learns with **Repertoire** 🧠
+- has a **Solar Ban Hammer** ☀️🔨 (Dynamo governance)
+- can also **Confer** 🗣️ (3-agent internal deliberation)
+
+The core AI Governance OS stack is **complete and open source**. A commercial version is next — powers up the suit further.
+
+```bash
+npm install 0xray@latest
+```
 
 xray is the pure v2 three-subsystem AI orchestration framework — **MCP-centric**, governed by Dynamo, and autonomous via thinDispatch. Consumer `npm install 0xray` auto-wires all four platform bridges and seven MCP servers with zero manual config.
 

package/dist/SKILLS.md

@@ -1,6 +1,6 @@
 # 0xray Skills
 
-**v3.4.8** — **45 skills** · invoked via `xray-skills` MCP · synced on postinstall
+**v3.4.9** — **45 skills** · invoked via `xray-skills` MCP · synced on postinstall
 
 xray ships 45 knowledge skills (`src/skills/<name>/SKILL.md`) across the full software lifecycle. Lead-dev operating model lives in **`orchestrator`** skill + `multi_agent_orchestration.lead_dev_mode` in features.json. Skills load on demand via the **xray-skills** MCP server (`npx -y 0xray mcp skills`), agent `@mentions`, or platform skill directories after postinstall.
 

package/dist/governance/llm-governance-provider.d.ts

@@ -4,6 +4,8 @@ export interface GovernanceVote {
     confidence: number;
     reasoning: string;
 }
+export declare function resolveHermesBin(): string;
+export declare function hermesCliAvailable(): boolean;
 export declare function tryLLMGovernance(role: GovernanceRole, proposalTitle: string, proposalDescription: string, evidence: string[], proposalType: string): Promise<GovernanceVote | null>;
 export declare function checkHermesOAuthStatus(): {
     configured: boolean;

package/dist/governance/llm-governance-provider.js

@@ -1,9 +1,8 @@
-import { readFileSync, existsSync } from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
+import { execFileSync } from "node:child_process";
 import { frameworkLogger } from "../core/framework-logger.js";
-const XAI_ENDPOINT = "https://api.x.ai/v1/chat/completions";
-const XAI_MODEL = "grok-4.3";
+const DEFAULT_HERMES_PROVIDER = "xai-oauth";
+const DEFAULT_HERMES_MODEL = "grok-4.3";
+const DEFAULT_HERMES_TIMEOUT_MS = 120_000;
 const ROLE_PROMPTS = {
     "code-review": `You are a senior code reviewer on a governance committee for a software project. Analyze the following proposal from a code quality, maintainability, readability, and engineering best practices perspective.
 
@@ -42,125 +41,97 @@ DECISION: approve|reject|abstain
 CONFIDENCE: <0.0-1.0>
 REASONING: <2-4 sentence analysis of the proposal's broader project impact>`,
 };
-function resolveHermesExpiresAt(provider, tokens) {
-    if (typeof provider.expires_at === "number")
-        return provider.expires_at;
-    const expiresIn = tokens?.expires_in ?? provider.expires_in;
-    if (typeof expiresIn !== "number")
-        return undefined;
-    const refreshCandidates = [provider.last_refresh, tokens?.last_refresh];
-    for (const lastRefresh of refreshCandidates) {
-        if (typeof lastRefresh !== "string")
-            continue;
-        const base = Date.parse(lastRefresh);
-        if (!Number.isNaN(base)) {
-            return Math.floor((base + expiresIn * 1000) / 1000);
-        }
-    }
-    return undefined;
+function resolveHermesProvider() {
+    return process.env.HERMES_PROVIDER?.trim() || DEFAULT_HERMES_PROVIDER;
 }
-function extractHermesOAuthEntry(data) {
-    if (!data || typeof data !== "object")
-        return undefined;
-    if (Array.isArray(data)) {
-        return data.find((e) => e.provider === "xai-oauth" || !!e.access_token);
-    }
-    const record = data;
-    const legacy = record["xai-oauth"];
-    if (legacy && typeof legacy === "object") {
-        const entry = legacy;
-        if (entry.access_token)
-            return entry;
-    }
-    if (typeof record.access_token === "string") {
-        return record;
-    }
-    for (const bucket of ["providers", "credential_pool"]) {
-        const pool = record[bucket];
-        if (!pool || typeof pool !== "object")
-            continue;
-        const provider = pool["xai-oauth"];
-        if (!provider || typeof provider !== "object")
-            continue;
-        const prov = provider;
-        const tokens = prov.tokens && typeof prov.tokens === "object"
-            ? prov.tokens
-            : undefined;
-        if (tokens && typeof tokens.access_token === "string") {
-            const entry = {
-                access_token: tokens.access_token,
-                provider: "xai-oauth",
-            };
-            if (typeof tokens.refresh_token === "string") {
-                entry.refresh_token = tokens.refresh_token;
-            }
-            const expiresAt = resolveHermesExpiresAt(prov, tokens);
-            if (expiresAt !== undefined)
-                entry.expires_at = expiresAt;
-            if (typeof tokens.token_type === "string")
-                entry.token_type = tokens.token_type;
-            return entry;
-        }
-        if (typeof prov.access_token === "string") {
-            return prov;
-        }
-    }
-    return undefined;
+function resolveHermesModel() {
+    return process.env.HERMES_MODEL?.trim() || DEFAULT_HERMES_MODEL;
 }
-function readHermesOAuthToken() {
-    try {
-        const authPath = join(homedir(), ".hermes", "auth.json");
-        if (!existsSync(authPath))
-            return null;
-        const raw = readFileSync(authPath, "utf-8");
-        const data = JSON.parse(raw);
-        const entry = extractHermesOAuthEntry(data);
-        if (!entry?.access_token) {
-            process.stderr.write("[llm] readHermesOAuthToken: no access_token in auth file\n");
-            return null;
-        }
-        if (entry.expires_at && Date.now() / 1000 > entry.expires_at) {
-            frameworkLogger.log("llm-governance", "hermes-token-expired", "warning", { expiresAt: entry.expires_at });
-            return null;
-        }
-        return entry.access_token;
-    }
-    catch (err) {
-        frameworkLogger.log("llm-governance", "hermes-auth-read-error", "warning", { error: String(err) });
-        return null;
-    }
+function resolveHermesTimeoutMs() {
+    const raw = process.env.HERMES_TIMEOUT_MS?.trim();
+    if (!raw)
+        return DEFAULT_HERMES_TIMEOUT_MS;
+    const parsed = Number(raw);
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : DEFAULT_HERMES_TIMEOUT_MS;
 }
-function getConfig() {
-    const directEndpoint = process.env.XRAY_LLM_ENDPOINT ||
+export function resolveHermesBin() {
+    const explicit = process.env.HERMES_BIN?.trim();
+    if (explicit)
+        return explicit;
+    return "hermes";
+}
+function getDirectLlmConfig() {
+    const endpoint = process.env.XRAY_LLM_ENDPOINT ||
         process.env.XRAY_GOVERNANCE_LLM_ENDPOINT ||
         "";
-    const directApiKey = process.env.XRAY_LLM_API_KEY ||
+    const apiKey = process.env.XRAY_LLM_API_KEY ||
         process.env.XRAY_GOVERNANCE_LLM_API_KEY ||
         "";
-    const directModel = process.env.XRAY_LLM_MODEL ||
+    const model = process.env.XRAY_LLM_MODEL ||
         process.env.XRAY_GOVERNANCE_LLM_MODEL ||
         "gpt-4o";
-    // First try: direct env-var config (highest priority)
     const directEnabled = process.env.XRAY_GOVERNANCE_LLM_ENABLED === "true" ||
         process.env.XRAY_LLM_ENABLED === "true";
-    if (directEnabled && directEndpoint && directApiKey) {
-        return { endpoint: directEndpoint, apiKey: directApiKey, model: directModel };
-    }
-    // Second try: Hermes xAI OAuth token from ~/.hermes/auth.json
-    const hermesToken = readHermesOAuthToken();
-    if (hermesToken) {
-        frameworkLogger.log("llm-governance", "using-hermes-oauth", "info", { provider: "xai-oauth", endpoint: XAI_ENDPOINT, model: XAI_MODEL });
-        return { endpoint: XAI_ENDPOINT, apiKey: hermesToken, model: XAI_MODEL };
+    if (directEnabled && endpoint && apiKey) {
+        return { mode: "direct", endpoint, apiKey, model };
     }
-    // Third try: direct endpoint even without explicit enable flag (if endpoint+key set)
-    if (directEndpoint && directApiKey) {
-        return { endpoint: directEndpoint, apiKey: directApiKey, model: directModel };
+    if (endpoint && apiKey) {
+        return { mode: "direct", endpoint, apiKey, model };
     }
-    if (process.env.DEBUG_LLM) {
-        process.stderr.write("[llm-debug] No config found. directEnabled=" + directEnabled + " endpoint=" + !!directEndpoint + " apiKey=" + !!directApiKey + " hermes=" + !!hermesToken + "\n");
+    return null;
+}
+function getConfig() {
+    const direct = getDirectLlmConfig();
+    if (direct)
+        return direct;
+    if (hermesCliAvailable()) {
+        return {
+            mode: "hermes",
+            provider: resolveHermesProvider(),
+            model: resolveHermesModel(),
+            timeoutMs: resolveHermesTimeoutMs(),
+        };
     }
     return null;
 }
+export function hermesCliAvailable() {
+    try {
+        execFileSync(resolveHermesBin(), ["--version"], {
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "pipe"],
+            timeout: 5_000,
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function buildGovernancePrompt(role, proposalTitle, proposalDescription, evidence, proposalType) {
+    const evidenceBlock = evidence.length > 0
+        ? `**Supporting Evidence:**\n${evidence.map((entry, index) => `${index + 1}. ${entry}`).join("\n")}\n\n`
+        : "";
+    return `${ROLE_PROMPTS[role]}
+
+## Proposal
+
+**Title:** ${proposalTitle}
+
+**Description:** ${proposalDescription}
+
+**Type:** ${proposalType}
+
+${evidenceBlock}---
+
+Please provide your structured vote.`;
+}
+function runHermesGovernanceInference(prompt, config) {
+    return execFileSync(resolveHermesBin(), ["-z", prompt, "--provider", config.provider, "--model", config.model], {
+        encoding: "utf8",
+        timeout: config.timeoutMs,
+        maxBuffer: 10 * 1024 * 1024,
+    }).trim();
+}
 function parseVote(text) {
     const decisionMatch = text.match(/DECISION:\s*(approve|reject|abstain)/i);
     const confidenceMatch = text.match(/CONFIDENCE:\s*([0-9.]+)/i);
@@ -175,13 +146,7 @@ function parseVote(text) {
         reasoning: reasoningMatch?.[1]?.trim() || "No reasoning provided",
     };
 }
-export async function tryLLMGovernance(role, proposalTitle, proposalDescription, evidence, proposalType) {
-    const config = getConfig();
-    if (!config) {
-        process.stderr.write("[llm] no config for role=" + role + "\n");
-        return null;
-    }
-    process.stderr.write("[llm] using config endpoint=" + config.endpoint + " model=" + config.model + "\n");
+async function callDirectLlm(role, config, proposalTitle, proposalDescription, evidence, proposalType) {
     const systemPrompt = ROLE_PROMPTS[role];
     const userMessage = `## Proposal
 
@@ -191,40 +156,61 @@ export async function tryLLMGovernance(role, proposalTitle, proposalDescription,
 
 **Type:** ${proposalType}
 
-${evidence.length > 0 ? `**Supporting Evidence:**\n${evidence.map((e, i) => `${i + 1}. ${e}`).join("\n")}` : ""}
+${evidence.length > 0 ? `**Supporting Evidence:**\n${evidence.map((entry, index) => `${index + 1}. ${entry}`).join("\n")}` : ""}
 
 ---
 
 Please provide your structured vote.`;
-    try {
-        const response = await fetch(config.endpoint, {
-            method: "POST",
-            headers: {
-                "Content-Type": "application/json",
-                Authorization: `Bearer ${config.apiKey}`,
-            },
-            body: JSON.stringify({
-                model: config.model,
-                messages: [
-                    { role: "system", content: systemPrompt },
-                    { role: "user", content: userMessage },
-                ],
-                temperature: 0.3,
-                max_tokens: 500,
-            }),
+    const response = await fetch(config.endpoint, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/json",
+            Authorization: `Bearer ${config.apiKey}`,
+        },
+        body: JSON.stringify({
+            model: config.model,
+            messages: [
+                { role: "system", content: systemPrompt },
+                { role: "user", content: userMessage },
+            ],
+            temperature: 0.3,
+            max_tokens: 500,
+        }),
+    });
+    if (!response.ok) {
+        frameworkLogger.log("llm-governance", "api-call", "error", {
+            status: response.status,
+            statusText: response.statusText,
+            role,
         });
-        if (!response.ok) {
-            frameworkLogger.log("llm-governance", "api-call", "error", {
-                status: response.status,
-                statusText: response.statusText,
-                role,
-            });
-            return null;
-        }
-        const data = (await response.json());
-        const choices = data?.choices;
-        const message = choices?.[0]?.message;
-        const content = message?.content;
+        return null;
+    }
+    const data = (await response.json());
+    const choices = data?.choices;
+    const message = choices?.[0]?.message;
+    return message?.content ?? null;
+}
+export async function tryLLMGovernance(role, proposalTitle, proposalDescription, evidence, proposalType) {
+    const config = getConfig();
+    if (!config) {
+        process.stderr.write(`[llm] no config for role=${role}\n`);
+        return null;
+    }
+    if (config.mode === "hermes") {
+        process.stderr.write(`[llm] using hermes -z provider=${config.provider} model=${config.model}\n`);
+        frameworkLogger.log("llm-governance", "using-hermes-cli", "info", {
+            provider: config.provider,
+            model: config.model,
+            role,
+        });
+    }
+    else {
+        process.stderr.write(`[llm] using direct endpoint=${config.endpoint} model=${config.model}\n`);
+    }
+    try {
+        const content = config.mode === "hermes"
+            ? runHermesGovernanceInference(buildGovernancePrompt(role, proposalTitle, proposalDescription, evidence, proposalType), config)
+            : await callDirectLlm(role, config, proposalTitle, proposalDescription, evidence, proposalType);
         if (!content) {
             frameworkLogger.log("llm-governance", "parse", "warning", {
                 issue: "missing content in response",
@@ -257,23 +243,23 @@ Please provide your structured vote.`;
     }
 }
 export function checkHermesOAuthStatus() {
-    const config = getConfig();
-    if (!config) {
-        const hermesPath = join(homedir(), ".hermes", "auth.json");
-        if (existsSync(hermesPath)) {
-            return {
-                configured: false,
-                error: "Hermes auth file found but no valid xai-oauth token. Run: hermes auth add xai-oauth --no-browser",
-            };
-        }
+    const direct = getDirectLlmConfig();
+    if (direct) {
+        return {
+            configured: true,
+            endpoint: direct.endpoint,
+            model: direct.model,
+        };
+    }
+    if (hermesCliAvailable()) {
         return {
-            configured: false,
-            error: "No Hermes auth file found (~/.hermes/auth.json). Install Hermes and run: hermes auth add xai-oauth --no-browser",
+            configured: true,
+            endpoint: "hermes-cli",
+            model: resolveHermesModel(),
         };
     }
     return {
-        configured: true,
-        endpoint: XAI_ENDPOINT,
-        model: XAI_MODEL,
+        configured: false,
+        error: "Hermes CLI not found on PATH. Install Hermes and ensure xai-oauth is configured (same path as gateway/cron: hermes auth add xai-oauth).",
     };
 }

package/dist/mcps/knowledge-skills/code-review.server.js

@@ -321,7 +321,7 @@ class XrayCodeReviewServer extends XrayKnowledgeSkillBase {
                 content: [
                     {
                         type: "text",
-                        text: "DECISION: abstain\nCONFIDENCE: 0.50\nREASONING: No LLM governance provider configured. Set XRAY_GOVERNANCE_LLM_ENABLED=true + XRAY_LLM_ENDPOINT, or install Hermes and run: hermes auth add xai-oauth --no-browser",
+                        text: "DECISION: abstain\nCONFIDENCE: 0.50\nREASONING: No LLM governance provider configured. Install Hermes on PATH (hermes -z) with xai-oauth, or set XRAY_GOVERNANCE_LLM_ENABLED=true + XRAY_LLM_ENDPOINT.",
                     },
                 ],
             };

package/dist/mcps/knowledge-skills/security-audit.server.js

@@ -666,7 +666,7 @@ class XraySecurityAuditServer extends XrayKnowledgeSkillBase {
                 content: [
                     {
                         type: "text",
-                        text: "DECISION: abstain\nCONFIDENCE: 0.50\nREASONING: No LLM governance provider configured. Set XRAY_GOVERNANCE_LLM_ENABLED=true + XRAY_LLM_ENDPOINT, or install Hermes and run: hermes auth add xai-oauth --no-browser",
+                        text: "DECISION: abstain\nCONFIDENCE: 0.50\nREASONING: No LLM governance provider configured. Install Hermes on PATH (hermes -z) with xai-oauth, or set XRAY_GOVERNANCE_LLM_ENABLED=true + XRAY_LLM_ENDPOINT.",
                     },
                 ],
             };

package/dist/mcps/orchestrator/config/memory-routing-bridge.js

@@ -34,8 +34,9 @@ export function toMemoryTask(task) {
     };
     if (task.priority)
         result.priority = task.priority;
-    if (task.dependencies)
+    if (Array.isArray(task.dependencies) && task.dependencies.length > 0) {
         result.dependencies = task.dependencies;
+    }
     if (task.estimatedComplexity !== undefined)
         result.estimatedComplexity = task.estimatedComplexity;
     if (task.metadata)

package/dist/mcps/orchestrator/execution/execution-planner.d.ts

@@ -4,6 +4,8 @@
  * Creates optimized execution plans for orchestration tasks
  */
 import type { OrchestrationTask, ExecutionPlan, ComplexityAnalysis, TaskValidation } from '../types.js';
+/** Dependency count from task-ID list or numeric hint from analyze-complexity */
+export declare function dependencyCount(deps: OrchestrationTask['dependencies'] | undefined): number;
 /**
  * Execution Planner
  * Plans and optimizes task execution strategies

package/dist/mcps/orchestrator/execution/execution-planner.js

@@ -5,6 +5,20 @@
  */
 import { getAgentCapabilitiesManager } from '../config/agent-capabilities.js';
 import { getProvider, toMemoryTask, fromMemoryTask, } from '../config/memory-routing-bridge.js';
+/** Dependency count from task-ID list or numeric hint from analyze-complexity */
+export function dependencyCount(deps) {
+    if (deps == null)
+        return 0;
+    if (typeof deps === 'number' && Number.isFinite(deps)) {
+        return Math.max(0, Math.round(deps));
+    }
+    if (Array.isArray(deps))
+        return deps.length;
+    return 0;
+}
+function isDependencyIdList(deps) {
+    return Array.isArray(deps) && deps.length > 0;
+}
 /**
  * Execution Planner
  * Plans and optimizes task execution strategies
@@ -33,8 +47,8 @@ export class ExecutionPlanner {
             if (!task.type) {
                 errors.push(`Task ${i}: Missing required field 'type'`);
             }
-            // Check dependencies exist
-            if (task.dependencies && task.id) {
+            // Check task-ID dependencies exist (numeric hints skip graph validation)
+            if (isDependencyIdList(task.dependencies) && task.id) {
                 const taskIds = new Set(tasks.map(t => t.id).filter((id) => !!id));
                 for (const depId of task.dependencies) {
                     if (!taskIds.has(depId)) {
@@ -117,11 +131,11 @@ export class ExecutionPlanner {
         const independentTasks = [];
         const dependentTasks = [];
         for (const task of sortedTasks) {
-            if (!task.dependencies || task.dependencies.length === 0) {
-                independentTasks.push(task);
+            if (isDependencyIdList(task.dependencies)) {
+                dependentTasks.push(task);
             }
             else {
-                dependentTasks.push(task);
+                independentTasks.push(task);
             }
         }
         // Assign independent tasks in parallel
@@ -140,7 +154,7 @@ export class ExecutionPlanner {
             if (visited.has(task.id))
                 return;
             visited.add(task.id);
-            if (task.dependencies) {
+            if (isDependencyIdList(task.dependencies)) {
                 for (const depId of task.dependencies) {
                     const depTask = taskMap.get(depId);
                     if (depTask)
@@ -263,10 +277,7 @@ export class ExecutionPlanner {
         if (task.estimatedComplexity) {
             complexity = (complexity + task.estimatedComplexity) / 2;
         }
-        // Adjust based on dependencies
-        if (task.dependencies) {
-            complexity += task.dependencies.length * 5;
-        }
+        complexity += dependencyCount(task.dependencies) * 5;
         if (task.metadata?.memoryComplexityBoost !== undefined) {
             complexity += task.metadata.memoryComplexityBoost;
         }
@@ -295,7 +306,7 @@ export class ExecutionPlanner {
      */
     calculateParallelPotential(tasks) {
         // Tasks without dependencies can run in parallel
-        const independent = tasks.filter(t => !t.dependencies || t.dependencies.length === 0);
+        const independent = tasks.filter((t) => !isDependencyIdList(t.dependencies));
         return independent.length / tasks.length;
     }
 }

package/dist/mcps/orchestrator/handlers/complexity-handler.d.ts

@@ -4,6 +4,17 @@
  * Handles complexity analysis requests
  */
 import type { OrchestrationTask } from '../types.js';
+type AnalyzeComplexityInput = {
+    id?: string;
+    description?: string;
+    type?: string;
+    files?: string[];
+    dependencyCount?: number;
+    dependencies?: string[] | number;
+    riskLevel?: string;
+    estimatedComplexity?: number;
+    priority?: OrchestrationTask['priority'];
+};
 /**
  * Complexity Handler
  * Processes analyze-complexity requests
@@ -14,7 +25,7 @@ export declare class ComplexityHandler {
      * Handle analyze-complexity request
      */
     handleAnalyzeComplexity(args: {
-        tasks: OrchestrationTask[];
+        tasks: AnalyzeComplexityInput[];
     }, asideId?: string): Promise<{
         content: Array<{
             type: string;
@@ -30,3 +41,4 @@ export declare class ComplexityHandler {
      */
     private formatComplexityResponse;
 }
+export {};