0xray 3.5.4 → 3.5.5

package/scripts/hooks/run-hook.js

@@ -20,8 +20,9 @@
  */
 
 import { existsSync, readFileSync, writeFileSync, mkdirSync, appendFileSync } from "fs";
-import { join, dirname } from "path";
+import { join, dirname, resolve } from "path";
 import { execSync, exec, execFileSync } from "child_process";
+import { fileURLToPath } from "url";
 
 // ── Parse arguments ──────────────────────────────────────────
 
@@ -203,82 +204,152 @@ function runTypeScriptCheck(files) {
   }
 }
 
-// ── Codex validation ─────────────────────────────────────────
+// ── Codex validation (diff-hunk scoped) ──────────────────────
+
+/** Parse + lines from a unified diff (staged or commit-range). */
+export function parseAddedLinesFromDiff(diff) {
+  const addedLines = [];
+  for (const line of diff.split("\n")) {
+    if (
+      line.startsWith("+++") ||
+      line.startsWith("---") ||
+      line.startsWith("@@") ||
+      line.startsWith("diff ") ||
+      line.startsWith("index ")
+    ) {
+      continue;
+    }
+    if (line.startsWith("+")) {
+      addedLines.push(line.slice(1));
+    }
+  }
+  return addedLines;
+}
 
-async function runCodexValidation(files) {
-  /**
-   * Run lightweight codex validation on files.
-   * Uses dynamic import of framework modules when available.
-   */
-  log("Running Codex validation...");
+/**
+ * Collect added lines per file from git diff.
+ * scope `staged` → --cached (pre-commit); scope `range` → COMMIT_RANGE (pre-push).
+ */
+export function getAddedLinesByFile(
+  files,
+  { scope = "staged", range = null, root = projectRoot } = {},
+) {
+  const addedByFile = new Map();
+
+  for (const file of files) {
+    if (!/\.(ts|tsx|js|jsx|mjs)$/.test(file)) continue;
+    try {
+      const gitArgs =
+        scope === "range" && range
+          ? ["diff", range, "-U0", "--", file]
+          : ["diff", "--cached", "-U0", "--", file];
+      const diff = execFileSync("git", gitArgs, {
+        cwd: root,
+        encoding: "utf-8",
+        stdio: ["pipe", "pipe", "pipe"],
+      });
+      const addedLines = parseAddedLinesFromDiff(diff);
+      if (addedLines.length > 0) {
+        addedByFile.set(file, addedLines);
+      }
+    } catch {
+      // Deletions-only or unreadable diff — skip codex for this file
+    }
+  }
 
-  const tsFiles = files.filter((f) => /\.(ts|tsx)$/.test(f));
-  const jsFiles = files.filter((f) => /\.(js|jsx|mjs)$/.test(f));
+  return addedByFile;
+}
 
-  if (tsFiles.length === 0 && jsFiles.length === 0) {
-    return { passed: true, warnings: [], errors: [] };
-  }
+/** Pre-commit: staged diff hunks only. */
+export function getStagedAddedLinesByFile(files, root = projectRoot) {
+  return getAddedLinesByFile(files, { scope: "staged", root });
+}
+
+/** Pre-push: added lines in commit range (e.g. remote..local). */
+export function getRangeAddedLinesByFile(files, range, root = projectRoot) {
+  return getAddedLinesByFile(files, { scope: "range", range, root });
+}
 
-  // Quick static checks without framework dependency
+export function scanAddedLinesForCodex(file, addedLines) {
   const errors = [];
   const warnings = [];
+  const content = addedLines.join("\n");
+  const lines = addedLines;
 
-  for (const file of [...tsFiles, ...jsFiles]) {
-    const filePath = join(projectRoot, file);
-    if (!existsSync(filePath)) continue;
+  const consoleLogLines = lines.reduce((acc, line, i) => {
+    if (/\bconsole\.(log|warn|error)\b/.test(line) && !line.includes("NOSONAR")) {
+      acc.push(i + 1);
+    }
+    return acc;
+  }, []);
+  if (consoleLogLines.length > 0) {
+    errors.push(
+      `${file}: console.log/warn/error in staged diff at hunk line(s) ${consoleLogLines.slice(0, 3).join(", ")}`,
+    );
+  }
 
-    try {
-      const content = readFileSync(filePath, "utf-8");
-      const lines = content.split("\n");
+  const todoLines = lines.reduce((acc, line, i) => {
+    if (/\/\/\s*(TODO|FIXME|HACK|XXX)\b/i.test(line)) {
+      acc.push(i + 1);
+    }
+    return acc;
+  }, []);
+  if (todoLines.length > 0) {
+    warnings.push(`${file}: ${todoLines.length} TODO/FIXME in staged diff`);
+  }
 
-      // Check for console.log (codex violation)
-      const consoleLogLines = lines.reduce((acc, line, i) => {
-        if (/\bconsole\.(log|warn|error)\b/.test(line) && !line.includes("NOSONAR")) {
-          acc.push(i + 1);
-        }
-        return acc;
-      }, []);
-      if (consoleLogLines.length > 0) {
-        errors.push(`${file}: console.log/warn/error found at lines ${consoleLogLines.slice(0, 3).join(", ")}`);
-      }
+  const tsIgnoreLines = lines.reduce((acc, line, i) => {
+    if (/@ts-ignore|@ts-nocheck|@ts-expect-error/.test(line)) {
+      acc.push(i + 1);
+    }
+    return acc;
+  }, []);
+  if (tsIgnoreLines.length > 0) {
+    warnings.push(`${file}: ${tsIgnoreLines.length} @ts-ignore/@ts-nocheck in staged diff`);
+  }
 
-      // Check for TODO/FIXME
-      const todoLines = lines.reduce((acc, line, i) => {
-        if (/\/\/\s*(TODO|FIXME|HACK|XXX)\b/i.test(line)) {
-          acc.push(i + 1);
-        }
-        return acc;
-      }, []);
-      if (todoLines.length > 0) {
-        warnings.push(`${file}: ${todoLines.length} TODO/FIXME comment(s) found`);
+  if (/\bany\b/.test(content)) {
+    const anyLines = lines.reduce((acc, line, i) => {
+      if (/\bany\b/.test(line) && !line.includes("//") && !line.includes("*")) {
+        acc.push(i + 1);
       }
+      return acc;
+    }, []);
+    if (anyLines.length > 0) {
+      warnings.push(`${file}: ${anyLines.length} use(s) of 'any' in staged diff`);
+    }
+  }
 
-      // Check for @ts-ignore
-      const tsIgnoreLines = lines.reduce((acc, line, i) => {
-        if (/@ts-ignore|@ts-nocheck|@ts-expect-error/.test(line)) {
-          acc.push(i + 1);
-        }
-        return acc;
-      }, []);
-      if (tsIgnoreLines.length > 0) {
-        warnings.push(`${file}: ${tsIgnoreLines.length} @ts-ignore/@ts-nocheck found`);
-      }
+  return { errors, warnings };
+}
 
-      // Check for any type
-      if (/\bany\b/.test(content)) {
-        const anyLines = lines.reduce((acc, line, i) => {
-          if (/\bany\b/.test(line) && !line.includes("//") && !line.includes("*")) {
-            acc.push(i + 1);
-          }
-          return acc;
-        }, []);
-        if (anyLines.length > 3) {
-          warnings.push(`${file}: ${anyLines.length} uses of 'any' type`);
-        }
-      }
-    } catch {
-      // Skip unreadable files
-    }
+async function runCodexValidation(files, options = {}) {
+  /**
+   * Run lightweight codex validation on diff hunks only (staged or commit range).
+   */
+  const scope = options.scope || "staged";
+  const range = options.range || null;
+  const scopeLabel = scope === "range" && range ? `range ${range}` : "staged";
+  log(`Running Codex validation (diff-hunk scope: ${scopeLabel})...`);
+
+  const codexFiles = files.filter((f) => /\.(ts|tsx|js|jsx|mjs)$/.test(f));
+  if (codexFiles.length === 0) {
+    return { passed: true, warnings: [], errors: [] };
+  }
+
+  const addedByFile =
+    scope === "range" && range
+      ? getRangeAddedLinesByFile(codexFiles, range)
+      : getStagedAddedLinesByFile(codexFiles);
+  const errors = [];
+  const warnings = [];
+
+  for (const file of codexFiles) {
+    const addedLines = addedByFile.get(file);
+    if (!addedLines || addedLines.length === 0) continue;
+    const scan = scanAddedLinesForCodex(file, addedLines);
+    errors.push(...scan.errors);
+    warnings.push(...scan.warnings);
   }
 
   const passed = errors.length === 0;
@@ -302,6 +373,7 @@ async function runLogMaintenance() {
   try {
     const distDirs = [
       join(projectRoot, "dist"),
+      join(projectRoot, "node_modules", "0xray", "dist"),
       join(projectRoot, "node_modules", "xray", "dist"),
     ];
 
@@ -375,7 +447,7 @@ async function runLogMaintenance() {
 
 // ── Comprehensive validation (pre-push) ──────────────────────
 
-async function runFullValidation(files) {
+async function runFullValidation(files, commitRange = null) {
   /**
    * Full validation suite for pre-push.
    * Includes TypeScript check, codex validation, and test hints.
@@ -385,8 +457,11 @@ async function runFullValidation(files) {
   // TypeScript check
   const tsResult = runTypeScriptCheck(files);
 
-  // Codex validation
-  const codexResult = await runCodexValidation(files);
+  // Codex validation — commit range diff (not --cached)
+  const codexResult = await runCodexValidation(files, {
+    scope: commitRange ? "range" : "staged",
+    range: commitRange,
+  });
 
   // Check for test files
   const sourceFiles = files.filter((f) =>
@@ -487,15 +562,20 @@ async function handlePrePush() {
     .split("\n")
     .map((f) => f.trim())
     .filter(Boolean);
+  const commitRange = (process.env.COMMIT_RANGE || "").trim() || null;
 
   if (changedFiles.length === 0) {
     log("No changed files to validate");
     process.exit(0);
   }
 
-  log(`Validating ${changedFiles.length} changed file(s) for push...`);
+  log(
+    `Validating ${changedFiles.length} changed file(s) for push` +
+      (commitRange ? ` (range ${commitRange})` : "") +
+      "...",
+  );
 
-  const result = await runFullValidation(changedFiles);
+  const result = await runFullValidation(changedFiles, commitRange);
 
   if (!result.passed) {
     console.error("\n❌ Pre-push validation failed:\n");
@@ -586,22 +666,27 @@ const handlers = {
   "pre-command": handlePreCommand,
 };
 
-const handler = handlers[hookType];
-if (!handler) {
-  console.error(`Unknown hook type: ${hookType}`);
-  console.error(`Valid types: ${Object.keys(handlers).join(", ")}`);
-  process.exit(1);
-}
+const isDirectRun =
+  process.argv[1] &&
+  resolve(process.argv[1]) === resolve(fileURLToPath(import.meta.url));
 
-// Run with timing
-const startTime = Date.now();
-handler()
-  .then(() => {
-    const duration = Date.now() - startTime;
-    log(`Hook completed in ${duration}ms`);
-  })
-  .catch((err) => {
-    logError(`Hook crashed: ${err.message}`);
-    console.error(`0xRay hook error: ${err.message}`);
+if (isDirectRun) {
+  const handler = handlers[hookType];
+  if (!handler) {
+    console.error(`Unknown hook type: ${hookType}`);
+    console.error(`Valid types: ${Object.keys(handlers).join(", ")}`);
     process.exit(1);
-  });
+  }
+
+  const startTime = Date.now();
+  handler()
+    .then(() => {
+      const duration = Date.now() - startTime;
+      log(`Hook completed in ${duration}ms`);
+    })
+    .catch((err) => {
+      logError(`Hook crashed: ${err.message}`);
+      console.error(`0xRay hook error: ${err.message}`);
+      process.exit(1);
+    });
+}

package/scripts/mjs/verify-confer-core.mjs

@@ -0,0 +1,103 @@
+#!/usr/bin/env node
+/**
+ * Confer quorum fixture — 3-agent synthesis consult completes via fixture mode.
+ */
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const packageRoot = join(__dirname, '../..');
+
+const { buildSynthesisCheckpointPlan } = await import(
+  join(packageRoot, 'dist/nucleus/autonomy-kernel.js')
+);
+const { savePersistedLeadDevPlan, areSynthesisConsultTodosComplete } = await import(
+  join(packageRoot, 'dist/nucleus/lead-dev-plan-persistence.js')
+);
+const { recordExecutionSlice, isSynthesisCheckpointDue } = await import(
+  join(packageRoot, 'dist/nucleus/synthesis.js')
+);
+const { runConferQuorum, loadConferCheckpoint, CONFER_AGENTS } = await import(
+  join(packageRoot, 'dist/nucleus/confer.js')
+);
+
+const sessionId = 'verify-confer-core';
+let failed = 0;
+function pass(n) {
+  console.log(`✅ ${n}`);
+}
+function fail(n, d = '') {
+  failed++;
+  console.error(`❌ ${n}${d ? ` — ${d}` : ''}`);
+}
+
+const tmp = mkdtempSync(join(tmpdir(), 'xray-confer-verify-'));
+mkdirSync(join(tmp, '.xray', 'state'), { recursive: true });
+writeFileSync(
+  join(tmp, '.xray', 'features.json'),
+  JSON.stringify({
+    multi_agent_orchestration: { lead_dev_mode: true, confer_on_synthesis: true },
+    synthesis: { enabled: true, every_n_gates: 1, every_n_turns: 0, every_n_todos_completed: 0 },
+  }),
+);
+
+try {
+  recordExecutionSlice('gate', { projectRoot: tmp, sessionId });
+  if (!isSynthesisCheckpointDue(tmp, sessionId)) fail('step 1: synthesis due');
+  else pass('step 1: synthesis checkpoint due');
+
+  const plan = buildSynthesisCheckpointPlan('gate threshold (1/1)');
+  if (!plan) fail('step 2: synthesis plan');
+  else {
+    savePersistedLeadDevPlan(
+      { ...plan, persistedAt: new Date().toISOString(), sessionId },
+      tmp,
+    );
+    pass('step 2: synthesis plan persisted');
+  }
+
+  if (CONFER_AGENTS.length !== 3) fail('step 3: confer agent count', String(CONFER_AGENTS.length));
+  else pass('step 3: three confer agents defined');
+
+  const result = await runConferQuorum(tmp, sessionId, {
+    collocatedText: 'verify confer fixture context',
+    dueReason: 'gate threshold',
+    fixture: true,
+  });
+
+  if (result.status === 'completed' && result.agents.length === 3) {
+    pass('step 4: confer quorum completed all agents');
+  } else {
+    fail('step 4: confer quorum', JSON.stringify(result));
+  }
+
+  const state = loadConferCheckpoint(tmp);
+  if (state?.status === 'completed' && state.completedAgents.length === 3) {
+    pass('step 5: confer checkpoint state completed');
+  } else {
+    fail('step 5: confer state', JSON.stringify(state));
+  }
+
+  if (areSynthesisConsultTodosComplete(
+    (await import(join(packageRoot, 'dist/nucleus/lead-dev-plan-persistence.js'))).loadPersistedLeadDevPlan(tmp),
+  )) {
+    pass('step 6: synthesis consult todos complete after confer');
+  } else {
+    fail('step 6: consult todos incomplete');
+  }
+
+  if (!isSynthesisCheckpointDue(tmp, sessionId)) pass('step 7: synthesis checkpoint cleared');
+  else fail('step 7: checkpoint still due');
+} finally {
+  rmSync(tmp, { recursive: true, force: true });
+}
+
+console.log(
+  '\n' +
+    (failed === 0
+      ? '🎉 Confer verify passed (7/7).'
+      : `⚠️  ${failed} confer check(s) failed.`),
+);
+process.exit(failed === 0 ? 0 : 1);

package/scripts/mjs/verify-delegation-gate-core.mjs

@@ -3,7 +3,7 @@
  * Shared 4/4 delegation gate fixture against nucleus SSOT (any host adapter).
  * Usage: node scripts/mjs/verify-delegation-gate-core.mjs [--host=grok|hermes|opencode]
  */
-import { mkdtempSync, rmSync } from 'node:fs';
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -85,6 +85,52 @@ try {
   } else {
     fail('spawn todo persistence', JSON.stringify(denyWrongTodo));
   }
+
+  const staleTmp = mkdtempSync(join(tmpdir(), 'xray-gate-stale-'));
+  const staleAt = new Date(Date.now() - 9 * 60 * 60 * 1000).toISOString();
+  mkdirSync(join(staleTmp, '.xray', 'state'), { recursive: true });
+  writeFileSync(
+    join(staleTmp, '.xray', 'features.json'),
+    JSON.stringify({
+      multi_agent_orchestration: { enabled: true, lead_dev_mode: true },
+    }),
+  );
+  writeFileSync(
+    join(staleTmp, '.xray', 'state', 'lead-dev-plan.json'),
+    JSON.stringify({
+      active: true,
+      persistedAt: staleAt,
+      phases: [
+        {
+          id: 'phase-1',
+          todos: [
+            {
+              id: '1.1',
+              task: 'stale unstarted todo',
+              subagent: 'researcher',
+              status: 'pending',
+            },
+          ],
+        },
+      ],
+    }),
+  );
+  const denyStale = evaluatePreToolGate(
+    SPAWN_TOOL,
+    { prompt: 'plan todo 1.1 consult', subagent_type: 'researcher' },
+    {
+      projectRoot: staleTmp,
+      sessionId: FIXTURE_SESSION_ID,
+      features: loadDelegationGateFeatures(staleTmp),
+      host,
+    },
+  );
+  if (!denyStale.allow && denyStale.gate === 'spawn-plan-stale') {
+    pass('denies spawn when lead-dev plan is stale');
+  } else {
+    fail('spawn plan stale', JSON.stringify(denyStale));
+  }
+  rmSync(staleTmp, { recursive: true, force: true });
 } finally {
   rmSync(tmp, { recursive: true, force: true });
 }
@@ -93,7 +139,7 @@ const label = host === 'generic' ? 'core' : host;
 console.log(
   '\n' +
     (failed === 0
-      ? `🎉 Delegation gate verify passed (4/4) [${label}].`
+      ? `🎉 Delegation gate verify passed (5/5) [${label}].`
       : `⚠️  ${failed} gate check(s) failed [${label}].`),
 );
 process.exit(failed === 0 ? 0 : 1);

package/scripts/mjs/verify-hermes-session-start.mjs

@@ -0,0 +1,137 @@
+#!/usr/bin/env node
+/**
+ * Hermes session-start bridge — stale plan archival with synthesis exemption.
+ */
+import { execSync } from 'node:child_process';
+import { existsSync, mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const packageRoot = join(__dirname, '../..');
+const bridge = join(packageRoot, 'dist/integrations/hermes-agent/bridge.mjs');
+
+let failed = 0;
+function pass(n) {
+  console.log(`✅ ${n}`);
+}
+function fail(n, d = '') {
+  failed++;
+  console.error(`❌ ${n}${d ? ` — ${d}` : ''}`);
+}
+
+function runBridge(payload, cwd) {
+  const json = JSON.stringify(payload).replace(/'/g, "'\\''");
+  const out = execSync(`node "${bridge}" session-start --cwd "${cwd}" '${json}'`, {
+    cwd,
+    encoding: 'utf8',
+    env: { ...process.env, XRAY_ROOT: cwd },
+  });
+  return JSON.parse(out.trim());
+}
+
+const tmp = mkdtempSync(join(tmpdir(), 'xray-hermes-session-'));
+const planPath = join(tmp, '.xray', 'state', 'lead-dev-plan.json');
+mkdirSync(join(tmp, '.xray', 'state'), { recursive: true });
+writeFileSync(
+  join(tmp, '.xray', 'features.json'),
+  JSON.stringify({
+    multi_agent_orchestration: {
+      enabled: true,
+      lead_dev_mode: true,
+      auto_consult_major_work: true,
+    },
+    synthesis: { enabled: true, every_n_gates: 1, every_n_turns: 0, every_n_todos_completed: 0 },
+  }),
+);
+
+const staleAt = new Date(Date.now() - 10 * 60 * 60 * 1000).toISOString();
+const synthesisPlan = {
+  active: true,
+  persistedAt: staleAt,
+  sessionId: 'hermes-session-start-fixture',
+  phases: [
+    {
+      id: 'phase-synthesis',
+      name: 'Reflect & realign',
+      goal: 'consult',
+      definitionOfDone: 'done',
+      todos: [
+        { id: 's.1', task: 'researcher consult', subagent: 'researcher', status: 'pending' },
+        { id: 's.2', task: 'architect consult', subagent: 'architect-tools', status: 'pending' },
+        { id: 's.3', task: 'review consult', subagent: 'code-review', status: 'pending' },
+      ],
+    },
+  ],
+};
+writeFileSync(planPath, JSON.stringify(synthesisPlan, null, 2));
+
+try {
+  const result = runBridge({ command: 'session-start', sessionId: 'hermes-session-start-fixture' }, tmp);
+  if (result.ok === true) pass('bridge session-start returns ok');
+  else fail('session-start ok', JSON.stringify(result));
+
+  if (existsSync(planPath)) pass('aged synthesis plan survives session-start archival');
+  else fail('synthesis plan preserved', 'lead-dev-plan.json missing');
+
+  const archived = result.planArchive?.archived === true;
+  if (!archived) pass('session-start did not archive protected synthesis plan');
+  else fail('synthesis archive skip', JSON.stringify(result.planArchive));
+
+  const staleTmp = mkdtempSync(join(tmpdir(), 'xray-hermes-stale-'));
+  const stalePlanPath = join(staleTmp, '.xray', 'state', 'lead-dev-plan.json');
+  mkdirSync(join(staleTmp, '.xray', 'state'), { recursive: true });
+  writeFileSync(
+    join(staleTmp, '.xray', 'features.json'),
+    JSON.stringify({
+      multi_agent_orchestration: { enabled: true, lead_dev_mode: true },
+    }),
+  );
+  const staleAt = new Date(Date.now() - 10 * 60 * 60 * 1000).toISOString();
+  writeFileSync(
+    stalePlanPath,
+    JSON.stringify(
+      {
+        active: true,
+        persistedAt: staleAt,
+        phases: [
+          {
+            id: 'phase-1',
+            todos: [
+              {
+                id: '1.1',
+                task: 'stale hygiene',
+                subagent: 'researcher',
+                status: 'pending',
+              },
+            ],
+          },
+        ],
+      },
+      null,
+      2,
+    ),
+  );
+
+  const staleResult = runBridge(
+    { command: 'session-start', sessionId: 'hermes-stale-archive-fixture' },
+    staleTmp,
+  );
+  if (staleResult.planArchive?.archived === true && !existsSync(stalePlanPath)) {
+    pass('session-start archives ordinary stale lead-dev plan');
+  } else {
+    fail('stale plan archival', JSON.stringify(staleResult.planArchive));
+  }
+  rmSync(staleTmp, { recursive: true, force: true });
+} finally {
+  rmSync(tmp, { recursive: true, force: true });
+}
+
+console.log(
+  '\n' +
+    (failed === 0
+      ? '🎉 Hermes session-start verify passed (4/4).'
+      : `⚠️  ${failed} Hermes session-start check(s) failed.`),
+);
+process.exit(failed === 0 ? 0 : 1);