0xray 3.5.0 → 3.5.1

package/scripts/mjs/delegation-gate-fixture.mjs

@@ -0,0 +1,84 @@
+/**
+ * Shared 4/4 delegation gate fixture — seeds consumer tmp workspace.
+ */
+import { mkdirSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+export const FIXTURE_SESSION_ID = 'verify-gate';
+
+export function seedDelegationGateFixture(tmp) {
+  mkdirSync(join(tmp, '.xray', 'state'), { recursive: true });
+  writeFileSync(
+    join(tmp, '.xray', 'features.json'),
+    JSON.stringify({
+      multi_agent_orchestration: {
+        enabled: true,
+        lead_dev_mode: true,
+        auto_chain_delegations: true,
+      },
+    }),
+  );
+  writeFileSync(
+    join(tmp, '.xray', 'state', 'lead-dev-plan.json'),
+    JSON.stringify({
+      active: true,
+      persistedAt: new Date().toISOString(),
+      phases: [],
+    }),
+  );
+  writeFileSync(
+    join(tmp, '.xray', 'state', 'pending-delegations.json'),
+    JSON.stringify({
+      sessionId: FIXTURE_SESSION_ID,
+      createdAt: new Date().toISOString(),
+      ttlMs: 14400000,
+      delegations: [
+        {
+          id: 'del-verify',
+          taskId: 'impl-1',
+          agent: 'backend-engineer',
+          taskDescription: 'implement',
+          taskType: 'implement',
+          sessionId: FIXTURE_SESSION_ID,
+          planTodoId: '2.1',
+          planTodoTask: 'swap deps',
+          matchMethod: 'agent-only',
+          matchConfidence: 0.5,
+          status: 'pending',
+          createdAt: new Date().toISOString(),
+          satisfiedAt: null,
+          spawnHint: {
+            tool: 'Task',
+            subagent_type: 'backend-engineer',
+            description: 'Lead-dev delegation 2.1',
+            planTodoId: '2.1',
+            delegationId: 'del-verify',
+          },
+        },
+      ],
+    }),
+  );
+}
+
+export function seedSpawnTodoPlan(tmp) {
+  writeFileSync(
+    join(tmp, '.xray', 'state', 'lead-dev-plan.json'),
+    JSON.stringify({
+      active: true,
+      persistedAt: new Date().toISOString(),
+      phases: [
+        {
+          id: 'phase-2',
+          todos: [
+            {
+              id: '2.1',
+              task: 'swap deps',
+              subagent: 'backend-engineer',
+              status: 'pending',
+            },
+          ],
+        },
+      ],
+    }),
+  );
+}

package/scripts/mjs/verify-delegation-gate-core.mjs

@@ -0,0 +1,99 @@
+#!/usr/bin/env node
+/**
+ * Shared 4/4 delegation gate fixture against nucleus SSOT (any host adapter).
+ * Usage: node scripts/mjs/verify-delegation-gate-core.mjs [--host=grok|hermes|opencode]
+ */
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import {
+  FIXTURE_SESSION_ID,
+  seedDelegationGateFixture,
+  seedSpawnTodoPlan,
+} from './delegation-gate-fixture.mjs';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const packageRoot = join(__dirname, '../..');
+
+const hostArg = process.argv.find((a) => a.startsWith('--host='));
+const host = hostArg?.split('=')[1] || 'generic';
+
+const { evaluatePreToolGate, loadDelegationGateFeatures } = await import(
+  join(packageRoot, 'dist/integrations/hooks/delegation-gate-runtime.mjs')
+);
+
+const WRITE_TOOL =
+  host === 'hermes' ? 'write_file' : host === 'opencode' ? 'write' : 'search_replace';
+const READ_TOOL = host === 'hermes' ? 'read_file' : 'read_file';
+const SPAWN_TOOL =
+  host === 'hermes' ? 'delegate_task' : host === 'opencode' ? 'task' : 'Task';
+
+let failed = 0;
+function pass(n) {
+  console.log(`✅ ${n}`);
+}
+function fail(n, d = '') {
+  failed++;
+  console.error(`❌ ${n}${d ? ` — ${d}` : ''}`);
+}
+
+const tmp = mkdtempSync(join(tmpdir(), 'xray-gate-core-'));
+seedDelegationGateFixture(tmp);
+
+const ctx = () => ({
+  projectRoot: tmp,
+  sessionId: FIXTURE_SESSION_ID,
+  features: loadDelegationGateFeatures(tmp),
+  host,
+});
+
+try {
+  const deny = evaluatePreToolGate(
+    WRITE_TOOL,
+    host === 'opencode'
+      ? { filePath: 'src/a.ts', content: 'x' }
+      : { path: 'src/a.ts', new_string: 'x', content: 'x' },
+    ctx(),
+  );
+  if (!deny.allow && deny.gate === 'auto-chain-pending') {
+    pass('denies write while pending');
+  } else {
+    fail('write deny', JSON.stringify(deny));
+  }
+
+  const allowRead = evaluatePreToolGate(READ_TOOL, { path: 'src/a.ts' }, ctx());
+  if (allowRead.allow) pass('allows read while pending');
+  else fail('read allow', JSON.stringify(allowRead));
+
+  const allowSpawn = evaluatePreToolGate(
+    SPAWN_TOOL,
+    { prompt: 'plan todo 2.1 swap deps', subagent_type: 'backend-engineer' },
+    ctx(),
+  );
+  if (allowSpawn.allow) pass('allows spawn while pending');
+  else fail('spawn allow', JSON.stringify(allowSpawn));
+
+  seedSpawnTodoPlan(tmp);
+  const denyWrongTodo = evaluatePreToolGate(
+    SPAWN_TOOL,
+    { prompt: 'explore only', subagent_type: 'explore' },
+    ctx(),
+  );
+  if (!denyWrongTodo.allow && denyWrongTodo.gate === 'spawn-todo-persistence') {
+    pass('denies spawn skipping required plan todo');
+  } else {
+    fail('spawn todo persistence', JSON.stringify(denyWrongTodo));
+  }
+} finally {
+  rmSync(tmp, { recursive: true, force: true });
+}
+
+const label = host === 'generic' ? 'core' : host;
+console.log(
+  '\n' +
+    (failed === 0
+      ? `🎉 Delegation gate verify passed (4/4) [${label}].`
+      : `⚠️  ${failed} gate check(s) failed [${label}].`),
+);
+process.exit(failed === 0 ? 0 : 1);

package/scripts/mjs/verify-grok-delegation-gate.mjs

@@ -4,10 +4,15 @@
  * Run: node scripts/mjs/verify-grok-delegation-gate.mjs
  */
 import { execSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import {
+  FIXTURE_SESSION_ID,
+  seedDelegationGateFixture,
+  seedSpawnTodoPlan,
+} from './delegation-gate-fixture.mjs';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const packageRoot = join(__dirname, '../..');
@@ -32,57 +37,11 @@ function runHook(fixture, env = {}) {
 }
 
 const tmp = mkdtempSync(join(tmpdir(), 'xray-gate-verify-'));
-mkdirSync(join(tmp, '.xray', 'state'), { recursive: true });
-writeFileSync(
-  join(tmp, '.xray', 'features.json'),
-  JSON.stringify({
-    multi_agent_orchestration: {
-      enabled: true,
-      lead_dev_mode: true,
-      auto_chain_delegations: true,
-    },
-  }),
-);
-writeFileSync(
-  join(tmp, '.xray', 'state', 'lead-dev-plan.json'),
-  JSON.stringify({ active: true }),
-);
-writeFileSync(
-  join(tmp, '.xray', 'state', 'pending-delegations.json'),
-  JSON.stringify({
-    sessionId: 'verify-gate',
-    createdAt: new Date().toISOString(),
-    ttlMs: 14400000,
-    delegations: [
-      {
-        id: 'del-verify',
-        taskId: 'impl-1',
-        agent: 'backend-engineer',
-        taskDescription: 'implement',
-        taskType: 'implement',
-        sessionId: 'verify-gate',
-        planTodoId: '2.1',
-        planTodoTask: 'swap deps',
-        matchMethod: 'agent-only',
-        matchConfidence: 0.5,
-        status: 'pending',
-        createdAt: new Date().toISOString(),
-        satisfiedAt: null,
-        spawnHint: {
-          tool: 'Task',
-          subagent_type: 'backend-engineer',
-          description: 'Lead-dev delegation 2.1',
-          planTodoId: '2.1',
-          delegationId: 'del-verify',
-        },
-      },
-    ],
-  }),
-);
+seedDelegationGateFixture(tmp);
 
 const baseEnv = {
   GROK_WORKSPACE_ROOT: tmp,
-  GROK_SESSION_ID: 'verify-gate',
+  GROK_SESSION_ID: FIXTURE_SESSION_ID,
 };
 
 try {
@@ -125,26 +84,7 @@ try {
   if (allowTask.decision === 'allow') pass('PreToolUse allows Task while pending');
   else fail('Task allow', JSON.stringify(allowTask));
 
-  writeFileSync(
-    join(tmp, '.xray', 'state', 'lead-dev-plan.json'),
-    JSON.stringify({
-      active: true,
-      persistedAt: new Date().toISOString(),
-      phases: [
-        {
-          id: 'phase-2',
-          todos: [
-            {
-              id: '2.1',
-              task: 'swap deps',
-              subagent: 'backend-engineer',
-              status: 'pending',
-            },
-          ],
-        },
-      ],
-    }),
-  );
+  seedSpawnTodoPlan(tmp);
 
   const denyWrongTodo = runHook(
     {

package/scripts/mjs/verify-hermes-delegation-gate.mjs

@@ -0,0 +1,89 @@
+#!/usr/bin/env node
+/**
+ * Hermes bridge delegation gate fixture (4/4) — uses bridge delegation-gate command.
+ */
+import { execSync } from 'node:child_process';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import {
+  FIXTURE_SESSION_ID,
+  seedDelegationGateFixture,
+  seedSpawnTodoPlan,
+} from './delegation-gate-fixture.mjs';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const packageRoot = join(__dirname, '../..');
+const bridge = join(packageRoot, 'dist/integrations/hermes-agent/bridge.mjs');
+
+let failed = 0;
+function pass(n) {
+  console.log(`✅ ${n}`);
+}
+function fail(n, d = '') {
+  failed++;
+  console.error(`❌ ${n}${d ? ` — ${d}` : ''}`);
+}
+
+function runBridge(payload, cwd) {
+  const json = JSON.stringify(payload).replace(/'/g, "'\\''");
+  const out = execSync(`node "${bridge}" delegation-gate --cwd "${cwd}" '${json}'`, {
+    cwd,
+    encoding: 'utf8',
+    env: { ...process.env, XRAY_ROOT: cwd },
+  });
+  return JSON.parse(out.trim());
+}
+
+const tmp = mkdtempSync(join(tmpdir(), 'xray-hermes-gate-'));
+seedDelegationGateFixture(tmp);
+
+const base = {
+  command: 'delegation-gate',
+  phase: 'pre',
+  sessionId: FIXTURE_SESSION_ID,
+  host: 'hermes',
+};
+
+try {
+  const deny = runBridge({ ...base, tool: 'write_file', args: { path: 'src/a.ts', content: 'x' } }, tmp);
+  if (deny.allow === false && deny.gate === 'auto-chain-pending') pass('bridge denies write while pending');
+  else fail('write deny', JSON.stringify(deny));
+
+  const allowRead = runBridge({ ...base, tool: 'read_file', args: { path: 'src/a.ts' } }, tmp);
+  if (allowRead.allow === true) pass('bridge allows read while pending');
+  else fail('read allow', JSON.stringify(allowRead));
+
+  const allowSpawn = runBridge(
+    {
+      ...base,
+      tool: 'delegate_task',
+      args: { prompt: 'plan todo 2.1 swap deps', subagent_type: 'backend-engineer' },
+    },
+    tmp,
+  );
+  if (allowSpawn.allow === true) pass('bridge allows delegate_task while pending');
+  else fail('spawn allow', JSON.stringify(allowSpawn));
+
+  seedSpawnTodoPlan(tmp);
+  const denyTodo = runBridge(
+    { ...base, tool: 'delegate_task', args: { prompt: 'explore only', subagent_type: 'explore' } },
+    tmp,
+  );
+  if (denyTodo.allow === false && denyTodo.gate === 'spawn-todo-persistence') {
+    pass('bridge denies spawn skipping required plan todo');
+  } else {
+    fail('spawn todo persistence', JSON.stringify(denyTodo));
+  }
+} finally {
+  rmSync(tmp, { recursive: true, force: true });
+}
+
+console.log(
+  '\n' +
+    (failed === 0
+      ? '🎉 Hermes delegation gate verify passed (4/4).'
+      : `⚠️  ${failed} Hermes gate check(s) failed.`),
+);
+process.exit(failed === 0 ? 0 : 1);

package/scripts/node/universal-version-manager.js

@@ -152,7 +152,7 @@ const OFFICIAL_VERSIONS = {
   framework: {
     version: PACKAGE_VERSION,
       displayName: "xray: Self-Healing AI Governance OS",
-      lastUpdated: "2026-06-17",
+      lastUpdated: "2026-06-19",
     // Counts (auto-calculated, but can be overridden)
     ...CALCULATED_COUNTS,
   },