0xray 3.5.0 → 3.5.2

package/scripts/hooks/install-hooks.cjs

@@ -1,12 +1,9 @@
 #!/usr/bin/env node
 /**
- * install-hooks.cjs — Installs xray pre-commit hook into the consumer project's .git/hooks/.
+ * install-hooks.cjs — Installs xray pre-commit + post-commit hooks into consumer .git/hooks/.
  *
- * Called from setup.cjs or standalone via:
+ * Called from postinstall.cjs or standalone via:
  *   node scripts/hooks/install-hooks.cjs
- *
- * Creates a consumer-aware pre-commit hook that references the installed
- * package's run-hook.js and LightweightValidator via node_modules/ paths.
  */
 
 const fs = require("fs");
@@ -15,7 +12,6 @@ const { execSync } = require("child_process");
 
 const packageRoot = path.resolve(path.join(__dirname, "..", ".."));
 
-// Determine the target project root (where .git/ lives)
 let targetDir;
 try {
   targetDir = execSync("git rev-parse --show-toplevel 2>/dev/null", {
@@ -33,34 +29,49 @@ if (!fs.existsSync(gitHooksDir)) {
   process.exit(0);
 }
 
-// Check if we're in a consumer install (via node_modules) or dev
 const isConsumer = packageRoot.includes("node_modules");
-
-// Resolve run-hook.js path
-// In dev: scripts/hooks/run-hook.js (relative to project root)
-// In consumer: node_modules/0xray/scripts/hooks/run-hook.js (relative to project root)
 const runHookRelativePath = isConsumer
   ? "node_modules/0xray/scripts/hooks/run-hook.js"
   : "scripts/hooks/run-hook.js";
+const loadReflectionRelativePath = isConsumer
+  ? "node_modules/0xray/scripts/node/load-reflection-config.mjs"
+  : "scripts/node/load-reflection-config.mjs";
+const autoReflectionRelativePath = isConsumer
+  ? "node_modules/0xray/scripts/node/auto-reflection-generator.mjs"
+  : "scripts/node/auto-reflection-generator.mjs";
 
-const hookContent = `#!/bin/bash
+function hookRunnerExists(projectRoot) {
+  return (
+    fs.existsSync(path.join(projectRoot, "node_modules/0xray/scripts/hooks/run-hook.js")) ||
+    fs.existsSync(path.join(projectRoot, "scripts/hooks/run-hook.js"))
+  );
+}
+
+function isXrayHookContent(content) {
+  return content.includes("0xRay") || content.includes("xray");
+}
+
+function backupExistingHook(hookPath) {
+  const backupPath = `${hookPath}.backup-${Date.now()}`;
+  fs.copyFileSync(hookPath, backupPath);
+  console.log(`ℹ️  Backed up existing hook to ${path.basename(backupPath)}`);
+}
+
+const preCommitContent = `#!/bin/bash
 # 0xRay Pre-Commit Hook — Consumer Install
-# Installed by xray setup on $(new Date().toISOString().split('T')[0])
-# Runs TypeScript check, linting, and Codex validation before commit
+# Installed by xray setup on ${new Date().toISOString().split("T")[0]}
 # BLOCKS the commit if validation fails
 
 set -e
 
 PROJECT_ROOT=$(git rev-parse --show-toplevel)
 
-# Get staged files (only source files)
 STAGED_FILES=$(git diff --cached --name-only --diff-filter=ACM | grep -E '\\.(ts|tsx|js|jsx|mjs)$' || true)
 
 if [ -z "$STAGED_FILES" ]; then
   exit 0
 fi
 
-# Run the Node.js hook runner
 if command -v node >/dev/null 2>&1; then
   export HOOK_TYPE="pre-commit"
   export STAGED_FILES="$STAGED_FILES"
@@ -69,32 +80,121 @@ if command -v node >/dev/null 2>&1; then
     node "$PROJECT_ROOT/${runHookRelativePath}" pre-commit
     exit $?
   else
-    echo "Warning: xray hook runner not found — install may be incomplete"
-    exit 0
+    echo "Error: xray hook runner not found at ${runHookRelativePath} — run npm install 0xray"
+    exit 1
   fi
 else
-  echo "Warning: Node.js not found, skipping xray pre-commit validation"
-  exit 0
+  echo "Error: Node.js not found — xray pre-commit validation requires node"
+  exit 1
 fi
 `;
 
-const hookPath = path.join(gitHooksDir, "pre-commit");
-const existing = fs.existsSync(hookPath);
-if (existing) {
-  const existingContent = fs.readFileSync(hookPath, "utf-8");
-  if (existingContent.includes("0xRay") || existingContent.includes("xray")) {
-    console.log("ℹ️  Pre-commit hook already installed by xray — skipping");
-    process.exit(0);
-  }
-}
+const postCommitContent = `#!/bin/bash
+# 0xRay Post-Commit Hook — Consumer Install
+# Runs activity logging and auto-reflection after commit (non-blocking)
 
-try {
-  fs.writeFileSync(hookPath, hookContent, { mode: 0o755 });
+PROJECT_ROOT=$(git rev-parse --show-toplevel)
+COMMIT_SHA=$(git rev-parse HEAD)
+BRANCH=$(git rev-parse --abbrev-ref HEAD)
+
+(
+  if command -v node >/dev/null 2>&1 && [ -f "$PROJECT_ROOT/${runHookRelativePath}" ]; then
+    export HOOK_TYPE="post-commit"
+    export COMMIT_SHA="$COMMIT_SHA"
+    export BRANCH="$BRANCH"
+    export PROJECT_ROOT="$PROJECT_ROOT"
+    node "$PROJECT_ROOT/${runHookRelativePath}" post-commit 2>/dev/null || true
+  fi
+) &
+
+MODE="minimal"
+COMMIT_THRESHOLD=25
+DAYS_THRESHOLD=14
+AUTO_GENERATE=true
+PROMPT_USER=true
+
+if command -v node >/dev/null 2>&1; then
+  LOAD_SCRIPT="$PROJECT_ROOT/${loadReflectionRelativePath}"
+  if [ -f "$LOAD_SCRIPT" ]; then
+    export PROJECT_ROOT="$PROJECT_ROOT"
+    REFLECTION_JSON=$(node "$LOAD_SCRIPT" --json 2>/dev/null || echo '{}')
+    MODE=$(node -e 'const c=JSON.parse(process.argv[1]);process.stdout.write(String(c.mode||"minimal"))' "$REFLECTION_JSON")
+    COMMIT_THRESHOLD=$(node -e 'const c=JSON.parse(process.argv[1]);process.stdout.write(String(c.commitThreshold??25))' "$REFLECTION_JSON")
+    DAYS_THRESHOLD=$(node -e 'const c=JSON.parse(process.argv[1]);process.stdout.write(String(c.daysThreshold??14))' "$REFLECTION_JSON")
+    AUTO_GENERATE=$(node -e 'const c=JSON.parse(process.argv[1]);process.stdout.write(c.autoGenerate===false?"false":"true")' "$REFLECTION_JSON")
+    PROMPT_USER=$(node -e 'const c=JSON.parse(process.argv[1]);process.stdout.write(c.promptUser===false?"false":"true")' "$REFLECTION_JSON")
+  fi
+fi
+
+COMMIT_MSG=$(git log -1 --pretty=%B)
+SIGNIFICANT_KEYWORDS="fix|bug|debug|deploy|release|feature|refactor|kernel|learning|pattern|wire|connect|integrate"
+
+if echo "$COMMIT_MSG" | grep -qiE "$SIGNIFICANT_KEYWORDS" && [ "$PROMPT_USER" = true ]; then
+  echo ""
+  echo "📝 REFLECTION SUGGESTION: This commit appears to involve significant changes."
+  echo "   Consider writing a reflection using the v3.0 template:"
+  echo "   → cat docs/reflections/TEMPLATE_v3.md"
+  echo ""
+fi
+
+if [ "$AUTO_GENERATE" = true ] && [ -d "$PROJECT_ROOT/docs/reflections" ]; then
+  if stat --version >/dev/null 2>&1; then
+    LAST_REFLECTION=$(find "$PROJECT_ROOT/docs/reflections" -name "*.md" -type f -exec stat --format="%Y" {} \\; 2>/dev/null | sort -rn | head -1)
+  else
+    LAST_REFLECTION=$(find "$PROJECT_ROOT/docs/reflections" -name "*.md" -type f -exec stat -f "%m" {} \\; 2>/dev/null | sort -rn | head -1)
+  fi
+
+  if [ -n "$LAST_REFLECTION" ]; then
+    REFLECTION_EPOCH=$(date -r "$LAST_REFLECTION" +%s 2>/dev/null || echo "0")
+    NOW_EPOCH=$(date +%s)
+    DAYS_SINCE=$(( (NOW_EPOCH - REFLECTION_EPOCH) / 86400 ))
+    COMMITS_SINCE=$(git log --since="$LAST_REFLECTION" --oneline 2>/dev/null | wc -l | tr -d ' ')
+  else
+    DAYS_SINCE=999
+    COMMITS_SINCE=$(git rev-list --count HEAD 2>/dev/null || echo "0")
+  fi
+
+  if [ "$COMMITS_SINCE" -gt "$COMMIT_THRESHOLD" ] || [ "$DAYS_SINCE" -gt "$DAYS_THRESHOLD" ]; then
+    echo ""
+    echo "⚠️  AUTO-REFLECTION TRIGGERED (mode: $MODE)"
+    echo "   $COMMITS_SINCE commits since last reflection ($DAYS_SINCE days)"
+    if [ "$MODE" != "off" ]; then
+      cd "$PROJECT_ROOT"
+      if [ -f "$PROJECT_ROOT/${autoReflectionRelativePath}" ]; then
+        node "$PROJECT_ROOT/${autoReflectionRelativePath}" --trigger commit-threshold \\
+          --title "Multiple commits since last reflection" 2>/dev/null || true
+      fi
+    fi
+  fi
+fi
+
+exit 0
+`;
+
+function installHook(name, content, { forceReinstall = false } = {}) {
+  const hookPath = path.join(gitHooksDir, name);
+  const existing = fs.existsSync(hookPath);
   if (existing) {
-    console.log("✅ Pre-commit hook updated for xray validation");
-  } else {
-    console.log("✅ Pre-commit hook installed — runs Codex validation on every commit");
+    const existingContent = fs.readFileSync(hookPath, "utf-8");
+    const isXray = isXrayHookContent(existingContent);
+    if (isXray && hookRunnerExists(targetDir) && !forceReinstall) {
+      console.log(`ℹ️  ${name} hook already installed by xray — skipping`);
+      return false;
+    }
+    if (isXray && !hookRunnerExists(targetDir)) {
+      console.log(`⚠️  Stale xray ${name} hook detected — reinstalling`);
+    } else if (!isXray) {
+      backupExistingHook(hookPath);
+    }
   }
-} catch (e) {
-  console.warn(`⚠️ Failed to install pre-commit hook: ${e.message}`);
+  fs.writeFileSync(hookPath, content, { mode: 0o755 });
+  console.log(
+    existing
+      ? `✅ ${name} hook updated for xray`
+      : `✅ ${name} hook installed`,
+  );
+  return true;
 }
+
+installHook("pre-commit", preCommitContent);
+installHook("post-commit", postCommitContent);

package/scripts/hooks/run-hook.js

@@ -21,7 +21,7 @@
 
 import { existsSync, readFileSync, writeFileSync, mkdirSync, appendFileSync } from "fs";
 import { join, dirname } from "path";
-import { execSync, exec } from "child_process";
+import { execSync, exec, execFileSync } from "child_process";
 
 // ── Parse arguments ──────────────────────────────────────────
 
@@ -92,14 +92,47 @@ function recordMetrics(duration, exitCode) {
 
 // ── TypeScript checking ──────────────────────────────────────
 
+function packageHasTypecheckScript() {
+  try {
+    const pkgPath = join(projectRoot, "package.json");
+    if (!existsSync(pkgPath)) return false;
+    const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
+    return typeof pkg.scripts?.typecheck === "string" && pkg.scripts.typecheck.length > 0;
+  } catch {
+    return false;
+  }
+}
+
 function runTypeScriptCheck(files) {
   /**
-   * Run tsc --noEmit on a subset of files.
-   * Falls back to full project check if per-file fails.
+   * Prefer npm run typecheck when defined (matches CI).
+   * Otherwise tsc --noEmit on staged files or full project.
    */
   log("Running TypeScript validation...");
 
   try {
+    if (packageHasTypecheckScript()) {
+      try {
+        execSync("npm run typecheck", {
+          cwd: projectRoot,
+          encoding: "utf-8",
+          timeout: 120000,
+          stdio: ["pipe", "pipe", "pipe"],
+        });
+        log("npm run typecheck passed");
+        return { passed: true, errors: [] };
+      } catch (err) {
+        const stderr = (err.stderr || err.stdout || "").toString();
+        const errorLines = stderr
+          .split("\n")
+          .filter((l) => /error TS\d+/.test(l))
+          .map((l) => l.trim())
+          .slice(0, 20);
+        log(`npm run typecheck failed: ${errorLines.length} errors`);
+        return { passed: false, errors: errorLines };
+      }
+    }
+
     // Check if tsconfig.json exists
     const tsconfigPath = join(projectRoot, "tsconfig.json");
     if (!existsSync(tsconfigPath)) {
@@ -115,12 +148,16 @@ function runTypeScriptCheck(files) {
     const tsFiles = files.filter((f) => /\.(ts|tsx)$/.test(f));
     if (tsFiles.length > 0 && tsFiles.length <= 20) {
       try {
-        execSync(`${tscCmd} --noEmit ${tsFiles.map((f) => `"${f}"`).join(" ")}`, {
-          cwd: projectRoot,
-          encoding: "utf-8",
-          timeout: 30000,
-          stdio: ["pipe", "pipe", "pipe"],
-        });
+        execFileSync(
+          tscCmd,
+          ["--noEmit", ...tsFiles],
+          {
+            cwd: projectRoot,
+            encoding: "utf-8",
+            timeout: 30000,
+            stdio: ["pipe", "pipe", "pipe"],
+          },
+        );
         log(`TypeScript check passed: ${tsFiles.length} files`);
         return { passed: true, errors: [] };
       } catch (err) {

package/scripts/mjs/delegation-gate-fixture.mjs

@@ -0,0 +1,121 @@
+/**
+ * Shared 4/4 delegation gate fixture — seeds consumer tmp workspace.
+ */
+import { mkdirSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+export const FIXTURE_SESSION_ID = 'verify-gate';
+
+export function seedDelegationGateFixture(tmp) {
+  mkdirSync(join(tmp, '.xray', 'state'), { recursive: true });
+  writeFileSync(
+    join(tmp, '.xray', 'features.json'),
+    JSON.stringify({
+      multi_agent_orchestration: {
+        enabled: true,
+        lead_dev_mode: true,
+        auto_chain_delegations: true,
+      },
+    }),
+  );
+  writeFileSync(
+    join(tmp, '.xray', 'state', 'lead-dev-plan.json'),
+    JSON.stringify({
+      active: true,
+      persistedAt: new Date().toISOString(),
+      phases: [],
+    }),
+  );
+  writeFileSync(
+    join(tmp, '.xray', 'state', 'pending-delegations.json'),
+    JSON.stringify({
+      sessionId: FIXTURE_SESSION_ID,
+      createdAt: new Date().toISOString(),
+      ttlMs: 14400000,
+      delegations: [
+        {
+          id: 'del-verify',
+          taskId: 'impl-1',
+          agent: 'backend-engineer',
+          taskDescription: 'implement',
+          taskType: 'implement',
+          sessionId: FIXTURE_SESSION_ID,
+          planTodoId: '2.1',
+          planTodoTask: 'swap deps',
+          matchMethod: 'agent-only',
+          matchConfidence: 0.5,
+          status: 'pending',
+          createdAt: new Date().toISOString(),
+          satisfiedAt: null,
+          spawnHint: {
+            tool: 'Task',
+            subagent_type: 'backend-engineer',
+            description: 'Lead-dev delegation 2.1',
+            planTodoId: '2.1',
+            delegationId: 'del-verify',
+          },
+        },
+      ],
+    }),
+  );
+}
+
+export const SYNTHESIS_FIXTURE_SESSION_ID = 'verify-synthesis';
+
+export function seedSynthesisDueFixture(tmp, sessionId = SYNTHESIS_FIXTURE_SESSION_ID) {
+  mkdirSync(join(tmp, '.xray', 'state'), { recursive: true });
+  const now = new Date().toISOString();
+  writeFileSync(
+    join(tmp, '.xray', 'features.json'),
+    JSON.stringify({
+      synthesis: {
+        enabled: true,
+        every_n_gates: 12,
+        every_n_turns: 0,
+        every_n_todos_completed: 0,
+      },
+      multi_agent_orchestration: {
+        enabled: true,
+        lead_dev_mode: true,
+        auto_chain_delegations: true,
+      },
+    }),
+  );
+  writeFileSync(
+    join(tmp, '.xray', 'state', 'synthesis-checkpoint.json'),
+    JSON.stringify({
+      version: 1,
+      sessionId,
+      slicesSinceLastSynthesis: { gates: 12, turns: 0, todosCompleted: 0 },
+      lifetimeSlices: { gates: 12, turns: 0, todosCompleted: 0 },
+      synthesisDue: true,
+      dueReason: 'gate_threshold',
+      lastSynthesisAt: null,
+      lastSliceAt: now,
+      synthesisCount: 0,
+    }),
+  );
+}
+
+export function seedSpawnTodoPlan(tmp) {
+  writeFileSync(
+    join(tmp, '.xray', 'state', 'lead-dev-plan.json'),
+    JSON.stringify({
+      active: true,
+      persistedAt: new Date().toISOString(),
+      phases: [
+        {
+          id: 'phase-2',
+          todos: [
+            {
+              id: '2.1',
+              task: 'swap deps',
+              subagent: 'backend-engineer',
+              status: 'pending',
+            },
+          ],
+        },
+      ],
+    }),
+  );
+}

package/scripts/mjs/verify-delegation-gate-core.mjs

@@ -0,0 +1,99 @@
+#!/usr/bin/env node
+/**
+ * Shared 4/4 delegation gate fixture against nucleus SSOT (any host adapter).
+ * Usage: node scripts/mjs/verify-delegation-gate-core.mjs [--host=grok|hermes|opencode]
+ */
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import {
+  FIXTURE_SESSION_ID,
+  seedDelegationGateFixture,
+  seedSpawnTodoPlan,
+} from './delegation-gate-fixture.mjs';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const packageRoot = join(__dirname, '../..');
+
+const hostArg = process.argv.find((a) => a.startsWith('--host='));
+const host = hostArg?.split('=')[1] || 'generic';
+
+const { evaluatePreToolGate, loadDelegationGateFeatures } = await import(
+  join(packageRoot, 'dist/integrations/hooks/delegation-gate-runtime.mjs')
+);
+
+const WRITE_TOOL =
+  host === 'hermes' ? 'write_file' : host === 'opencode' ? 'write' : 'search_replace';
+const READ_TOOL = host === 'hermes' ? 'read_file' : 'read_file';
+const SPAWN_TOOL =
+  host === 'hermes' ? 'delegate_task' : host === 'opencode' ? 'task' : 'Task';
+
+let failed = 0;
+function pass(n) {
+  console.log(`✅ ${n}`);
+}
+function fail(n, d = '') {
+  failed++;
+  console.error(`❌ ${n}${d ? ` — ${d}` : ''}`);
+}
+
+const tmp = mkdtempSync(join(tmpdir(), 'xray-gate-core-'));
+seedDelegationGateFixture(tmp);
+
+const ctx = () => ({
+  projectRoot: tmp,
+  sessionId: FIXTURE_SESSION_ID,
+  features: loadDelegationGateFeatures(tmp),
+  host,
+});
+
+try {
+  const deny = evaluatePreToolGate(
+    WRITE_TOOL,
+    host === 'opencode'
+      ? { filePath: 'src/a.ts', content: 'x' }
+      : { path: 'src/a.ts', new_string: 'x', content: 'x' },
+    ctx(),
+  );
+  if (!deny.allow && deny.gate === 'auto-chain-pending') {
+    pass('denies write while pending');
+  } else {
+    fail('write deny', JSON.stringify(deny));
+  }
+
+  const allowRead = evaluatePreToolGate(READ_TOOL, { path: 'src/a.ts' }, ctx());
+  if (allowRead.allow) pass('allows read while pending');
+  else fail('read allow', JSON.stringify(allowRead));
+
+  const allowSpawn = evaluatePreToolGate(
+    SPAWN_TOOL,
+    { prompt: 'plan todo 2.1 swap deps', subagent_type: 'backend-engineer' },
+    ctx(),
+  );
+  if (allowSpawn.allow) pass('allows spawn while pending');
+  else fail('spawn allow', JSON.stringify(allowSpawn));
+
+  seedSpawnTodoPlan(tmp);
+  const denyWrongTodo = evaluatePreToolGate(
+    SPAWN_TOOL,
+    { prompt: 'explore only', subagent_type: 'explore' },
+    ctx(),
+  );
+  if (!denyWrongTodo.allow && denyWrongTodo.gate === 'spawn-todo-persistence') {
+    pass('denies spawn skipping required plan todo');
+  } else {
+    fail('spawn todo persistence', JSON.stringify(denyWrongTodo));
+  }
+} finally {
+  rmSync(tmp, { recursive: true, force: true });
+}
+
+const label = host === 'generic' ? 'core' : host;
+console.log(
+  '\n' +
+    (failed === 0
+      ? `🎉 Delegation gate verify passed (4/4) [${label}].`
+      : `⚠️  ${failed} gate check(s) failed [${label}].`),
+);
+process.exit(failed === 0 ? 0 : 1);

package/scripts/mjs/verify-grok-delegation-gate.mjs

@@ -4,10 +4,15 @@
  * Run: node scripts/mjs/verify-grok-delegation-gate.mjs
  */
 import { execSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import {
+  FIXTURE_SESSION_ID,
+  seedDelegationGateFixture,
+  seedSpawnTodoPlan,
+} from './delegation-gate-fixture.mjs';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const packageRoot = join(__dirname, '../..');
@@ -32,57 +37,11 @@ function runHook(fixture, env = {}) {
 }
 
 const tmp = mkdtempSync(join(tmpdir(), 'xray-gate-verify-'));
-mkdirSync(join(tmp, '.xray', 'state'), { recursive: true });
-writeFileSync(
-  join(tmp, '.xray', 'features.json'),
-  JSON.stringify({
-    multi_agent_orchestration: {
-      enabled: true,
-      lead_dev_mode: true,
-      auto_chain_delegations: true,
-    },
-  }),
-);
-writeFileSync(
-  join(tmp, '.xray', 'state', 'lead-dev-plan.json'),
-  JSON.stringify({ active: true }),
-);
-writeFileSync(
-  join(tmp, '.xray', 'state', 'pending-delegations.json'),
-  JSON.stringify({
-    sessionId: 'verify-gate',
-    createdAt: new Date().toISOString(),
-    ttlMs: 14400000,
-    delegations: [
-      {
-        id: 'del-verify',
-        taskId: 'impl-1',
-        agent: 'backend-engineer',
-        taskDescription: 'implement',
-        taskType: 'implement',
-        sessionId: 'verify-gate',
-        planTodoId: '2.1',
-        planTodoTask: 'swap deps',
-        matchMethod: 'agent-only',
-        matchConfidence: 0.5,
-        status: 'pending',
-        createdAt: new Date().toISOString(),
-        satisfiedAt: null,
-        spawnHint: {
-          tool: 'Task',
-          subagent_type: 'backend-engineer',
-          description: 'Lead-dev delegation 2.1',
-          planTodoId: '2.1',
-          delegationId: 'del-verify',
-        },
-      },
-    ],
-  }),
-);
+seedDelegationGateFixture(tmp);
 
 const baseEnv = {
   GROK_WORKSPACE_ROOT: tmp,
-  GROK_SESSION_ID: 'verify-gate',
+  GROK_SESSION_ID: FIXTURE_SESSION_ID,
 };
 
 try {
@@ -125,26 +84,7 @@ try {
   if (allowTask.decision === 'allow') pass('PreToolUse allows Task while pending');
   else fail('Task allow', JSON.stringify(allowTask));
 
-  writeFileSync(
-    join(tmp, '.xray', 'state', 'lead-dev-plan.json'),
-    JSON.stringify({
-      active: true,
-      persistedAt: new Date().toISOString(),
-      phases: [
-        {
-          id: 'phase-2',
-          todos: [
-            {
-              id: '2.1',
-              task: 'swap deps',
-              subagent: 'backend-engineer',
-              status: 'pending',
-            },
-          ],
-        },
-      ],
-    }),
-  );
+  seedSpawnTodoPlan(tmp);
 
   const denyWrongTodo = runHook(
     {