0xray 3.5.4 → 4.0.0

package/dist/integrations/hooks/station-hook-runtime.mjs

@@ -0,0 +1,24 @@
+/**
+ * ESM face for station-hook-runtime.cjs — Grok hooks import this.
+ */
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+
+const require = createRequire(import.meta.url);
+const impl = require(join(dirname(fileURLToPath(import.meta.url)), 'station-hook-runtime.cjs'));
+
+export const stationMarkdownPath = impl.stationMarkdownPath;
+export const sessionBootPath = impl.sessionBootPath;
+export const clipIntent = impl.clipIntent;
+export const readExistingBoot = impl.readExistingBoot;
+export const readGitBrief = impl.readGitBrief;
+export const readGitSubject = impl.readGitSubject;
+export const readPlanLine = impl.readPlanLine;
+export const buildRepertoireResume = impl.buildRepertoireResume;
+export const persistRepertoireWorking = impl.persistRepertoireWorking;
+export const readRepertoireWorking = impl.readRepertoireWorking;
+export const formatWorkingLine = impl.formatWorkingLine;
+export const applyStationHeat = impl.applyStationHeat;
+export const formatStationMarkdown = impl.formatStationMarkdown;
+export const writeStationMarkdown = impl.writeStationMarkdown;

package/dist/integrations/hooks/station-memory-ingest.mjs

@@ -0,0 +1,45 @@
+#!/usr/bin/env node
+/**
+ * Compact ingest — persist matched signals back into the organ (project-local copy).
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const root = process.argv[2];
+const sessionId = process.argv[3] || 'station';
+const hookEvent = process.argv[4] || 'post_compact';
+let signals = [];
+try {
+  signals = JSON.parse(process.argv[5] || '[]');
+} catch {
+  signals = [];
+}
+if (!root || !Array.isArray(signals) || signals.length === 0) {
+  process.exit(0);
+}
+
+let routing = { enabled: false, provider: 'null' };
+const featuresPath = join(root, '.xray', 'features.json');
+if (existsSync(featuresPath)) {
+  try {
+    routing = JSON.parse(readFileSync(featuresPath, 'utf8')).memory_routing || routing;
+  } catch {
+    /* leftover */
+  }
+}
+
+const { loadMemoryRoutingProvider } = await import('../../memory-routing/index.js');
+const provider = await loadMemoryRoutingProvider(routing, root);
+if (!provider || typeof provider.ingestFeedback !== 'function') process.exit(0);
+
+provider.ingestFeedback({
+  timestamp: new Date().toISOString(),
+  sessionId,
+  taskId: `station-${hookEvent}`,
+  assignedAgent: 'station',
+  memorySignals: signals,
+  complexity: 0,
+  success: true,
+  durationMs: 0,
+});
+process.exit(0);

package/dist/integrations/hooks/station-memory-match.mjs

@@ -0,0 +1,47 @@
+#!/usr/bin/env node
+/**
+ * Sync helper for station-hook-runtime.cjs — match Repertoire signals for an intent.
+ * Prints a JSON string array. Used on every floor's station heat, not only Grok.
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const root = process.argv[2];
+const intent = process.argv[3] || '';
+if (!root || !intent) {
+  process.stdout.write('[]\n');
+  process.exit(0);
+}
+
+let routing = { enabled: false, provider: 'null' };
+const featuresPath = join(root, '.xray', 'features.json');
+if (existsSync(featuresPath)) {
+  try {
+    routing = JSON.parse(readFileSync(featuresPath, 'utf8')).memory_routing || routing;
+  } catch {
+    /* leftover */
+  }
+}
+
+const { loadMemoryRoutingProvider } = await import('../../memory-routing/index.js');
+const provider = await loadMemoryRoutingProvider(routing, root);
+if (!provider || provider.id === 'null' || typeof provider.getTaskConfidence !== 'function') {
+  process.stdout.write('[]\n');
+  process.exit(0);
+}
+
+const conf = provider.getTaskConfidence({
+  id: 'station',
+  description: String(intent),
+  type: 'station',
+});
+const names = Array.isArray(conf.matchedSignals) ? conf.matchedSignals : [];
+const safe = [];
+for (const signalName of names) {
+  const name = String(signalName || '').trim();
+  if (!name || name.toLowerCase().startsWith('bedrock-')) continue;
+  safe.push(name);
+  if (safe.length >= 4) break;
+}
+process.stdout.write(`${JSON.stringify(safe)}\n`);
+process.exit(0);

package/dist/integrations/hooks/user-aside-hook-runtime.mjs

@@ -0,0 +1,49 @@
+#!/usr/bin/env node
+/**
+ * Lazy-load user-aside SSOT for Grok session-boot hints.
+ */
+import { createRequire } from 'node:module';
+import { existsSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+
+function resolvePackageRoot() {
+  let dir = __dirname;
+  for (let i = 0; i < 10; i++) {
+    const pkg = join(dir, 'package.json');
+    if (existsSync(pkg)) {
+      try {
+        const require = createRequire(join(dir, 'package.json'));
+        if (require('./package.json').name === '0xray') return dir;
+      } catch {
+        /* continue */
+      }
+    }
+    const nm = join(dir, 'node_modules', '0xray', 'package.json');
+    if (existsSync(nm)) return dirname(nm);
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return resolve(__dirname, '../../..');
+}
+
+function loadUserAside() {
+  const root = resolvePackageRoot();
+  const candidates = [
+    join(__dirname, '../../nucleus/user-aside.js'),
+    join(root, 'dist/nucleus/user-aside.js'),
+    join(process.cwd(), 'node_modules/0xray/dist/nucleus/user-aside.js'),
+  ];
+  const found = candidates.find((p) => existsSync(p));
+  if (!found) return null;
+  return createRequire(import.meta.url)(found);
+}
+
+export function getActiveUserAsideBoot(projectRoot, sessionId = null) {
+  const mod = loadUserAside();
+  if (!mod?.getUserAsideBootHints) return null;
+  return mod.getUserAsideBootHints(projectRoot, sessionId);
+}

package/dist/integrations/openclaw/client.d.ts

@@ -1,12 +1,16 @@
 /**
  * OpenClaw WebSocket Client
  *
- * Implements OpenClaw Gateway Protocol v3 with proper request/response handling,
+ * Implements OpenClaw Gateway Protocol v3–v4 with proper request/response handling,
  * reconnection logic, and event management.
  *
  * @since 2026-03-14
  */
 import { OpenClawClientConfig, OpenClawClientState, ClientStatistics } from './types.js';
+export declare function isUsableOpenClawDeviceIdentity(deviceId: string | undefined, keyPair: {
+    publicKey?: string;
+    privateKey?: string;
+} | undefined): boolean;
 /**
  * OpenClaw WebSocket Client
  */

package/dist/integrations/openclaw/client.js

@@ -1,7 +1,7 @@
 /**
  * OpenClaw WebSocket Client
  *
- * Implements OpenClaw Gateway Protocol v3 with proper request/response handling,
+ * Implements OpenClaw Gateway Protocol v3–v4 with proper request/response handling,
  * reconnection logic, and event management.
  *
  * @since 2026-03-14
@@ -9,6 +9,12 @@
 import { WebSocket } from 'ws';
 import * as crypto from 'crypto';
 import { isOpenClawResponse, isOpenClawEvent, OpenClawTimeoutError, OpenClawConnectionError, } from './types.js';
+export function isUsableOpenClawDeviceIdentity(deviceId, keyPair) {
+    if (!deviceId || deviceId === 'your-device-id') {
+        return false;
+    }
+    return Boolean(keyPair?.publicKey && keyPair?.privateKey);
+}
 /**
  * OpenClaw WebSocket Client
  */
@@ -249,9 +255,9 @@ export class OpenClawClient {
     sendHandshake() {
         const params = {
             minProtocol: 3,
-            maxProtocol: 3,
+            maxProtocol: 4,
             client: {
-                id: 'openclaw-tui',
+                id: 'gateway-client',
                 version: '1.0.0',
                 platform: process.platform,
                 mode: 'cli',
@@ -260,18 +266,20 @@ export class OpenClawClient {
             scopes: ['operator.read', 'operator.write', 'operator.admin'],
             caps: [],
             commands: [],
-            userAgent: `OpenClaw-TUI/2026.4.25`,
+            userAgent: `OpenClaw-TUI/2026.7.1`,
         };
         // Add auth if provided
         if (this.config.authToken) {
             params.auth = { token: this.config.authToken };
         }
-        // Add device if provided
-        if (this.config.deviceId && this.config.deviceKeyPair) {
+        // Never send a placeholder device — gateway treats stub identity as NOT_PAIRED.
+        const deviceId = this.config.deviceId;
+        const keyPair = this.config.deviceKeyPair;
+        if (isUsableOpenClawDeviceIdentity(deviceId, keyPair) && deviceId && keyPair) {
             params.device = {
-                id: this.config.deviceId,
-                publicKey: this.config.deviceKeyPair.publicKey,
-                signature: this.signDeviceChallenge(this.config.deviceId),
+                id: deviceId,
+                publicKey: keyPair.publicKey,
+                signature: this.signDeviceChallenge(deviceId),
                 signedAt: Date.now(),
                 nonce: this.generateNonce(),
             };

package/dist/integrations/openclaw/config.js

@@ -308,7 +308,6 @@ export class OpenClawConfigLoader {
             // SECURITY WARNING: authToken MUST be configured before use.
             // Leaving this empty will prevent authenticated connections.
             authToken: process.env.OPENCLAW_AUTH_TOKEN || '',
-            deviceId: process.env.OPENCLAW_DEVICE_ID || 'your-device-id',
             autoReconnect: true,
             maxReconnectAttempts: 5,
             reconnectDelay: 1000,

package/dist/integrations/openclaw/hooks/pre-tool-gate-runtime.mjs

@@ -0,0 +1,102 @@
+#!/usr/bin/env node
+/**
+ * OpenClaw host PreToolUse runtime — stdin JSON → stdout { action: block|allow }.
+ * Installed to ~/.openclaw/hooks/xray-pre-tool.mjs by `0xray openclaw install`.
+ */
+import { createRequire } from 'node:module';
+import { existsSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { stdin } from 'node:process';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const require = createRequire(import.meta.url);
+
+function resolveGate() {
+  const envRoot = process.env.XRAY_AI_PATH || process.env.XRAY_ROOT || '';
+  const candidates = [
+    envRoot ? join(envRoot, 'dist/nucleus/delegation-gate.js') : '',
+    join(__dirname, '../../../nucleus/delegation-gate.js'),
+    join(__dirname, '../../../../dist/nucleus/delegation-gate.js'),
+    join(process.cwd(), 'node_modules/0xray/dist/nucleus/delegation-gate.js'),
+    join(process.cwd(), 'dist/nucleus/delegation-gate.js'),
+  ].filter(Boolean);
+  const found = candidates.find((p) => existsSync(p));
+  if (!found) {
+    throw new Error('delegation-gate.js missing — build 0xray or npm install 0xray');
+  }
+  return require(found);
+}
+
+function readStdin() {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    stdin.setEncoding('utf8');
+    stdin.on('data', (c) => chunks.push(c));
+    stdin.on('end', () => {
+      const raw = chunks.join('').trim();
+      if (!raw) {
+        resolve({});
+        return;
+      }
+      try {
+        resolve(JSON.parse(raw));
+      } catch (err) {
+        reject(err);
+      }
+    });
+    stdin.on('error', reject);
+  });
+}
+
+function decide(event, gate) {
+  const projectRoot =
+    event.cwd || event.workspaceRoot || event.projectRoot || process.cwd();
+  const sessionId = event.sessionId || event.session_id || 'openclaw';
+  const toolName = event.tool || event.toolName || event.name || 'unknown';
+  const args = event.args || event.toolInput || event.input || {};
+  const features = gate.loadDelegationGateFeatures(projectRoot, 'openclaw');
+  const outcome = gate.evaluatePreToolGate(toolName, args, {
+    projectRoot,
+    sessionId,
+    features,
+    host: 'openclaw',
+  });
+  if (!outcome.allow) {
+    return {
+      action: 'block',
+      allow: false,
+      reason: outcome.reason,
+      gate: outcome.gate,
+    };
+  }
+  return {
+    action: 'allow',
+    allow: true,
+    reason: outcome.reason,
+    gate: outcome.gate,
+    warn: Boolean(outcome.reason),
+  };
+}
+
+async function main() {
+  try {
+    const event = await readStdin();
+    const gate = resolveGate();
+    const decision = decide(event, gate);
+    console.log(JSON.stringify(decision));
+    process.exit(decision.action === 'block' ? 2 : 0);
+  } catch (err) {
+    console.log(
+      JSON.stringify({
+        action: 'block',
+        allow: false,
+        gate: 'openclaw-pre-tool-error',
+        reason: err instanceof Error ? err.message : String(err),
+      }),
+    );
+    process.exit(2);
+  }
+}
+
+main();

package/dist/integrations/openclaw/index.js

@@ -11,7 +11,9 @@ import { OpenClawClient } from './client.js';
 import { XrayAPIServer } from './api-server.js';
 import { initializeGovernanceIntegration } from '../governance/index.js';
 import { featuresConfigLoader } from '../../core/features-config.js';
+import { writeSuitSessionBoot } from '../../nucleus/suit-temperament.js';
 import { OpenClawHooksManager } from './hooks/xray-hooks.js';
+import { evaluateOpenClawHostPreTool } from './pre-tool-gate.js';
 import { mcpClientManager } from '../../mcps/mcp-client.js';
 /**
  * Main OpenClaw Integration class
@@ -52,6 +54,12 @@ export class OpenClawIntegration extends BaseIntegration {
             return;
         }
         await this.log('info', 'Initializing...');
+        try {
+            writeSuitSessionBoot(process.cwd(), 'openclaw', { source: '0xray/openclaw-init' });
+        }
+        catch {
+            await this.log('warning', 'Failed to write suit session-boot');
+        }
         // Initialize API server if enabled
         if (config.apiServer?.enabled) {
             await this.log('info', 'Starting API server...');
@@ -123,6 +131,14 @@ export class OpenClawIntegration extends BaseIntegration {
         this.mcpToolBeforeUnsubscribe = await mcpClientManager.onToolEvent('tool.before', async (event) => {
             const toolEvent = event;
             try {
+                const gate = evaluateOpenClawHostPreTool(toolEvent.toolName, (toolEvent.args ?? {}), {
+                    projectRoot: process.cwd(),
+                    sessionId: String(toolEvent.sessionId ?? 'openclaw'),
+                });
+                if (!gate.allow) {
+                    await this.log('error', `OpenClaw PreToolUse blocked ${toolEvent.toolName}: ${gate.reason}`);
+                    throw new Error(`xray-openclaw-pre-tool:${gate.gate}:${gate.reason}`);
+                }
                 await this.hooksManager.onToolBefore({
                     toolName: toolEvent.toolName,
                     toolId: `${toolEvent.serverName}:${toolEvent.toolName}`,
@@ -134,6 +150,7 @@ export class OpenClawIntegration extends BaseIntegration {
             }
             catch (error) {
                 await this.log('error', `Error in tool.before handler: ${error}`);
+                throw error;
             }
         });
         // Subscribe to tool.after events and store unsubscribe function

package/dist/integrations/openclaw/plugin/xray-pre-tool/index.js

@@ -0,0 +1,75 @@
+import { createRequire } from 'node:module';
+import { existsSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { definePluginEntry } from 'openclaw/plugin-sdk/plugin-entry';
+
+const require = createRequire(import.meta.url);
+const pluginDir = dirname(fileURLToPath(import.meta.url));
+
+function hasGate(root) {
+  return Boolean(root) && existsSync(join(root, 'dist/nucleus/delegation-gate.js'));
+}
+
+function resolveXrayRoot() {
+  if (hasGate(process.env.XRAY_AI_PATH || '')) {
+    return process.env.XRAY_AI_PATH;
+  }
+  const marker = join(homedir(), '.openclaw', 'xray-consumer-root.txt');
+  const marked = existsSync(marker) ? readFileSync(marker, 'utf8').trim() : '';
+  const candidates = [
+    marked,
+    marked ? join(marked, 'node_modules', '0xray') : '',
+    marked ? join(marked, '..', 'xray') : '',
+    // Linked plugin lives at src/integrations/openclaw/plugin/xray-pre-tool
+    join(pluginDir, '..', '..', '..', '..', '..'),
+  ].filter(Boolean);
+  for (const candidate of candidates) {
+    if (hasGate(candidate)) {
+      return candidate;
+    }
+  }
+  return '';
+}
+
+export default definePluginEntry({
+  id: 'xray-pre-tool',
+  name: '0xRay PreToolUse',
+  register(api) {
+    api.on(
+      'before_tool_call',
+      (event, ctx) => {
+        try {
+          const xrayRoot = resolveXrayRoot();
+          if (!xrayRoot) {
+            return { block: true, blockReason: '0xRay dist missing — set XRAY_AI_PATH' };
+          }
+          const gate = require(join(xrayRoot, 'dist/nucleus/delegation-gate.js'));
+          const projectRoot =
+            process.env.XRAY_ROOT ||
+            ctx?.workspaceDir ||
+            ctx?.cwd ||
+            process.cwd();
+          const features = gate.loadDelegationGateFeatures(projectRoot, 'openclaw');
+          const outcome = gate.evaluatePreToolGate(event.toolName, event.params || {}, {
+            projectRoot,
+            sessionId: ctx?.sessionId || ctx?.sessionKey || 'openclaw',
+            features,
+            host: 'openclaw',
+          });
+          if (!outcome.allow) {
+            return { block: true, blockReason: outcome.reason || '0xRay constitution' };
+          }
+          return undefined;
+        } catch (err) {
+          return {
+            block: true,
+            blockReason: err instanceof Error ? err.message : String(err),
+          };
+        }
+      },
+      { priority: 80 },
+    );
+  },
+});

package/dist/integrations/openclaw/plugin/xray-pre-tool/openclaw.plugin.json

@@ -0,0 +1,10 @@
+{
+  "id": "xray-pre-tool",
+  "name": "0xRay PreToolUse",
+  "description": "Constitution and temperament gate for OpenClaw tool calls (Codex 11/29/69, spawn plan).",
+  "configSchema": {
+    "type": "object",
+    "additionalProperties": false,
+    "properties": {}
+  }
+}

package/dist/integrations/openclaw/plugin/xray-pre-tool/package.json

@@ -0,0 +1,10 @@
+{
+  "name": "xray-pre-tool",
+  "version": "4.0.0",
+  "private": true,
+  "type": "module",
+  "description": "0xRay constitution + temperament PreToolUse for OpenClaw",
+  "openclaw": {
+    "extensions": ["./index.js"]
+  }
+}

package/dist/integrations/openclaw/pre-tool-gate.d.ts

@@ -0,0 +1,19 @@
+/**
+ * OpenClaw host-agent PreToolUse adapter.
+ * Platform still lacks a native consumer tool-block API; this SSOT is what
+ * install writes to ~/.openclaw/hooks and what the integration uses on tool.before.
+ */
+import { type ToolGateInput } from '../../nucleus/delegation-gate.js';
+export interface OpenClawPreToolContext {
+    projectRoot: string;
+    sessionId: string;
+}
+export interface OpenClawPreToolDecision {
+    action: 'block' | 'allow';
+    allow: boolean;
+    reason?: string;
+    gate?: string;
+    hint?: unknown;
+    warn?: boolean;
+}
+export declare function evaluateOpenClawHostPreTool(toolName: string, args: ToolGateInput, ctx: OpenClawPreToolContext): OpenClawPreToolDecision;

package/dist/integrations/openclaw/pre-tool-gate.js

@@ -0,0 +1,39 @@
+/**
+ * OpenClaw host-agent PreToolUse adapter.
+ * Platform still lacks a native consumer tool-block API; this SSOT is what
+ * install writes to ~/.openclaw/hooks and what the integration uses on tool.before.
+ */
+import { evaluatePreToolGate, loadDelegationGateFeatures, } from '../../nucleus/delegation-gate.js';
+export function evaluateOpenClawHostPreTool(toolName, args, ctx) {
+    const features = loadDelegationGateFeatures(ctx.projectRoot, 'openclaw');
+    const outcome = evaluatePreToolGate(toolName, args, {
+        projectRoot: ctx.projectRoot,
+        sessionId: ctx.sessionId,
+        features,
+        host: 'openclaw',
+    });
+    if (!outcome.allow) {
+        const blocked = {
+            action: 'block',
+            allow: false,
+            reason: outcome.reason,
+            gate: outcome.gate,
+        };
+        if ('hint' in outcome && outcome.hint)
+            blocked.hint = outcome.hint;
+        return blocked;
+    }
+    const allowed = {
+        action: 'allow',
+        allow: true,
+    };
+    if (outcome.reason) {
+        allowed.reason = outcome.reason;
+        allowed.warn = true;
+    }
+    if (outcome.gate)
+        allowed.gate = outcome.gate;
+    if ('hint' in outcome && outcome.hint)
+        allowed.hint = outcome.hint;
+    return allowed;
+}

package/dist/mcps/architect-tools.server.js

@@ -193,13 +193,18 @@ class XrayArchitectToolsServer extends XrayKnowledgeSkillBase {
     async architectureAssessment(args) {
         const projectRoot = args?.projectRoot || "";
         const assessmentType = args?.assessmentType || "comprehensive";
+        const conferPrompt = typeof args?.conferPrompt === "string" ? args.conferPrompt : "";
         frameworkLogger.log("mcps/architect-tools", "architecture-assessment", "info", { projectRoot });
         const result = await architectArchitectureAssessment(projectRoot, assessmentType);
+        const assessmentJson = JSON.stringify(result, null, 2);
+        const text = conferPrompt.trim()
+            ? `${conferPrompt.trim()}\n\n## Architecture assessment\n${assessmentJson}\n\nVerdict: CONDITIONAL\nTop risks: review assessment metrics above\nHardening: address high-complexity or coupling findings before resuming`
+            : assessmentJson;
         return {
             content: [
                 {
                     type: "text",
-                    text: JSON.stringify(result, null, 2),
+                    text,
                 },
             ],
         };

package/dist/mcps/orchestrator/handlers/complexity-handler.d.ts

@@ -29,6 +29,13 @@ export declare class ComplexityHandler {
         sessionId?: string;
         synthesisCheckpoint?: boolean;
         synthesisDueReason?: string | null;
+        collocatedText?: string | null;
+        conferFixture?: boolean;
+        userAsideId?: string;
+        userAsideTitle?: string;
+        worktree?: string;
+        branch?: string;
+        setActiveAside?: boolean;
     }, asideId?: string): Promise<{
         content: Array<{
             type: string;