0xray 3.5.5 → 4.0.1

package/vendor/@0xray/repertoire/scripts/confirm-suit-harness.mjs

@@ -0,0 +1,220 @@
+#!/usr/bin/env node
+/**
+ * Grok Build harness confirmation protocol (Layers 2a/2c + 2b checklist).
+ *
+ * Invoked by:
+ *   npm run confirm:suit          — full Grok confirm (Layer 1 via verify:suit + this harness + trap test)
+ *   npm run confirm:suit:all      — all 4 bridges + this harness for Grok deep probes
+ *
+ * Layer 1: filesystem + CLI (verify-grok-suit.mjs) — run separately or via confirm:suit
+ * Layer 2a: stdio MCP probes (repertoire memory routing — bypasses harness prefix bug)
+ * Layer 2b: harness MCP probes (agent runs CallMcpTool live — documented below)
+ */
+import { spawn } from 'node:child_process';
+import { execSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { resolve, join } from 'node:path';
+import { readInstalledXrayVersion } from './suit-bridge-shared.mjs';
+
+const root = resolve(import.meta.dirname, '..');
+const skipLayer1 = process.argv.includes('--skip-layer1');
+
+function resolveResearcherServerPath() {
+  const sibling = resolve(root, '../xray/dist/mcps/researcher.server.js');
+  if (existsSync(sibling)) return sibling;
+  return resolve(root, 'node_modules/0xray/dist/mcps/researcher.server.js');
+}
+
+const TRAP_PROBE_DESCRIPTION =
+  'TYPE: ontological-trap attestation-as-map consumer-boundary revalidation required';
+
+function mcpStdioProbe({ serverPath, toolName, args, timeoutMs = 4000 }) {
+  return new Promise((resolveProbe, rejectProbe) => {
+    const messages = [
+      {
+        jsonrpc: '2.0',
+        id: 1,
+        method: 'initialize',
+        params: {
+          protocolVersion: '2024-11-05',
+          capabilities: {},
+          clientInfo: { name: 'confirm-suit-harness', version: '1.0' },
+        },
+      },
+      {
+        jsonrpc: '2.0',
+        id: 2,
+        method: 'tools/call',
+        params: { name: toolName, arguments: args },
+      },
+    ];
+
+    const proc = spawn('node', [serverPath], { cwd: root, stdio: ['pipe', 'pipe', 'pipe'] });
+    let out = '';
+    proc.stdout.on('data', (chunk) => {
+      out += chunk.toString();
+    });
+    proc.stderr.on('data', (chunk) => {
+      out += chunk.toString();
+    });
+
+    const timer = setTimeout(() => {
+      proc.kill();
+      rejectProbe(new Error(`timeout after ${timeoutMs}ms`));
+    }, timeoutMs);
+
+    proc.on('close', (code) => {
+      clearTimeout(timer);
+      if (code !== null && code !== 0 && !out.includes('"result"')) {
+        rejectProbe(new Error(`exit ${code}: ${out.slice(0, 200)}`));
+        return;
+      }
+      resolveProbe(out);
+    });
+
+    for (const msg of messages) {
+      proc.stdin.write(`${JSON.stringify(msg)}\n`);
+    }
+    setTimeout(() => proc.kill('SIGTERM'), timeoutMs - 200);
+  });
+}
+
+console.log('═══ 0xRay Suit Confirmation Protocol ═══\n');
+
+// ── Layer 1 ──────────────────────────────────────────────────────────────────
+let layer1Ok = skipLayer1;
+if (skipLayer1) {
+  console.log('Layer 1 — Skipped (--skip-layer1; already verified by confirm-suit-all)\n');
+} else {
+  console.log('Layer 1 — Local install (automated)\n');
+  try {
+    execSync('node scripts/verify-grok-suit.mjs', { cwd: root, stdio: 'inherit' });
+    layer1Ok = true;
+  } catch {
+    console.error('\n❌ Layer 1 FAILED — fix before harness probes\n');
+    process.exit(1);
+  }
+}
+
+// ── Layer 2a — stdio probes ──────────────────────────────────────────────────
+console.log('\nLayer 2a — Stdio MCP probes (automated)\n');
+const layer2a = [];
+
+const repertoireServer = resolve(root, 'dist/mcp/server.js');
+if (!existsSync(repertoireServer)) {
+  console.error('❌ repertoire stdio — dist/mcp/server.js missing (run npm run build)');
+  layer2a.push({ name: 'repertoire stdio', ok: false });
+} else {
+  try {
+    const out = await mcpStdioProbe({
+      serverPath: repertoireServer,
+      toolName: 'get_task_confidence',
+      args: { description: 'Confirm 0xRay suit worn after reboot' },
+    });
+    const ok =
+      out.includes('repertoire__get_task_confidence') ||
+      out.includes('recommendedAgent') ||
+      out.includes('highConfidenceTrapPresent');
+    layer2a.push({ name: 'repertoire__get_task_confidence (stdio)', ok });
+    console.log(ok ? '✅ repertoire__get_task_confidence (stdio)' : '❌ repertoire stdio — unexpected response');
+  } catch (e) {
+    layer2a.push({ name: 'repertoire stdio', ok: false });
+    console.error(`❌ repertoire stdio — ${e.message}`);
+  }
+}
+
+// ── Layer 2c — researcher trap routing (MCP subprocess) ───────────────────
+console.log('\nLayer 2c — Researcher trap routing e2e (automated)\n');
+const layer2c = [];
+
+const researcherServer = resolveResearcherServerPath();
+if (!existsSync(researcherServer)) {
+  console.error('❌ researcher stdio — server missing');
+  layer2c.push({ name: 'researcher trap routing', ok: false });
+} else {
+  try {
+    let ok = false;
+    let lastOut = '';
+    for (let attempt = 0; attempt < 6 && !ok; attempt++) {
+      if (attempt > 0) await new Promise((r) => setTimeout(r, 500));
+      lastOut = await mcpStdioProbe({
+        serverPath: researcherServer,
+        toolName: 'analyze_proposal',
+        args: {
+          proposalTitle: 'Trap governance review',
+          proposalDescription: TRAP_PROBE_DESCRIPTION,
+          proposalType: 'governance',
+        },
+        timeoutMs: 8000,
+      });
+      ok =
+        lastOut.includes('MEMORY_ROUTING:') &&
+        lastOut.includes('recommendedAgent: architect') &&
+        lastOut.includes('attestation-as-map');
+    }
+    layer2c.push({ name: 'analyze_proposal trap routing (stdio)', ok });
+    console.log(
+      ok
+        ? '✅ analyze_proposal trap routing (stdio)'
+        : '❌ researcher trap routing — silent no-op (MEMORY_ROUTING missing)',
+    );
+    if (!ok) {
+      console.error(`   Response snippet: ${lastOut.slice(0, 240)}`);
+    }
+  } catch (e) {
+    layer2c.push({ name: 'researcher trap routing', ok: false });
+    console.error(`❌ researcher trap routing — ${e.message}`);
+  }
+}
+
+// ── Layer 2b — harness checklist (agent-verified) ──────────────────────────
+console.log('\nLayer 2b — Harness MCP probes (agent CallMcpTool after reboot)\n');
+const harnessProbes = [
+  { server: 'xray-enforcer', tool: 'get-enforcement-status', key: 'totalRules' },
+  { server: 'xray-enforcer', tool: 'codex-enforcement', key: 'termsValidated', args: { operation: 'suit-probe' } },
+  { server: 'xray-skills', tool: 'list-skills', key: 'Skills' },
+  { server: 'xray-orchestrator', tool: 'analyze-complexity', key: 'Complexity', args: { tasks: [{ description: 'suit probe', type: 'verification' }] } },
+  { server: 'xray-governance', tool: 'get_active_codex', key: 'term_count' },
+  { server: 'xray-researcher', tool: 'get_documentation', key: 'Documentation', args: { target: 'RepertoireService' } },
+  { server: 'xray-architect-tools', tool: 'context-analysis', key: 'codebaseStructure', args: { query: 'suit probe' } },
+  { server: 'xray-code-review', tool: 'check_best_practices', key: 'Compliance', args: { filePath: `${root}/src/mcp/server.ts`, language: 'typescript' } },
+  { server: 'Dynamo', tool: 'get_docs', key: 'docs' },
+  {
+    server: 'repertoire',
+    tool: 'get_task_confidence',
+    key: 'harness-broken',
+    note: 'harness double-prefixes repertoire__ — use Layer 2a stdio instead',
+  },
+];
+
+for (const p of harnessProbes) {
+  const note = p.note ? ` (${p.note})` : '';
+  console.log(`  □ ${p.server} → ${p.tool}${note}`);
+}
+
+// ── Layer 3 — verdict ────────────────────────────────────────────────────────
+const layer2aOk = layer2a.every((c) => c.ok);
+const layer2cOk = layer2c.every((c) => c.ok);
+console.log(`
+Layer 3 — Suit worn verdict (automated portion)
+  Layer 1: ${layer1Ok ? 'GREEN' : 'RED'}
+  Layer 2a repertoire stdio: ${layer2aOk ? 'GREEN' : 'RED'}
+  Layer 2c researcher trap routing: ${layer2cOk ? 'GREEN' : 'RED'}
+
+  FULL    = Layer 1 + 2a + 2c green + all Layer 2b harness probes respond
+  PARTIAL = Layer 1 green + core harness MCPs live (enforcer, skills, orchestrator, governance, Dynamo)
+  BROKEN  = Layer 1 fails OR core MCPs unreachable
+
+Harness note: repertoire tools are registered as repertoire__* — Grok harness prepends
+server name again (repertoire__repertoire__*). Memory routing works via stdio (Layer 2a/2c).
+
+Version: npm 0xray@${readInstalledXrayVersion()} from node_modules (no npm link)
+`);
+
+if (layer1Ok && layer2aOk && layer2cOk) {
+  console.log('✅ Automated checks PASS — agent should confirm Layer 2b harness probes for FULL verdict.');
+  process.exit(0);
+}
+
+console.error('❌ Automated checks FAILED — suit not ready.');
+process.exit(1);

package/vendor/@0xray/repertoire/scripts/run-live-synthesis-checkpoint.mjs

@@ -0,0 +1,215 @@
+#!/usr/bin/env node
+/**
+ * Live synthesis checkpoint driver — repertoire core (real .xray/state, not tmp).
+ *
+ * Usage:
+ *   node scripts/run-live-synthesis-checkpoint.mjs seed [--session-id=ID]
+ *   node scripts/run-live-synthesis-checkpoint.mjs status
+ *   node scripts/run-live-synthesis-checkpoint.mjs complete-todo --id=s.1
+ *   node scripts/run-live-synthesis-checkpoint.mjs finish
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const root = join(__dirname, '..');
+const xrayRoot = join(root, 'node_modules/0xray');
+const stateDir = join(root, '.xray', 'state');
+const checkpointPath = join(stateDir, 'synthesis-checkpoint.json');
+const planPath = join(stateDir, 'lead-dev-plan.json');
+
+const DEFAULT_SESSION = 'live-synthesis-repertoire';
+
+const log = (msg) => process.stdout.write(`${msg}\n`);
+const err = (msg) => process.stderr.write(`${msg}\n`);
+
+function parseSessionId() {
+  const arg = process.argv.find((a) => a.startsWith('--session-id='));
+  return arg?.split('=')[1] || process.env.GROK_SESSION_ID || DEFAULT_SESSION;
+}
+
+function loadFeatures() {
+  return JSON.parse(readFileSync(join(root, '.xray/features.json'), 'utf8'));
+}
+
+async function loadXray() {
+  const synthesis = await import(join(xrayRoot, 'dist/nucleus/synthesis.js'));
+  const persistence = await import(join(xrayRoot, 'dist/nucleus/lead-dev-plan-persistence.js'));
+  const kernel = await import(join(xrayRoot, 'dist/nucleus/autonomy-kernel.js'));
+  return { synthesis, persistence, kernel };
+}
+
+async function cmdSeed() {
+  const sessionId = parseSessionId();
+  const grokSession = process.env.GROK_SESSION_ID;
+  if (grokSession && grokSession !== sessionId) {
+    err(
+      `❌ GROK_SESSION_ID (${grokSession}) ≠ seed sessionId (${sessionId}) — hooks will skip synthesis due`,
+    );
+    process.exit(1);
+  }
+  const features = loadFeatures();
+  const threshold = features.synthesis?.every_n_gates ?? 12;
+  if (!features.synthesis?.enabled) {
+    err('❌ synthesis.enabled is false in .xray/features.json');
+    process.exit(1);
+  }
+
+  mkdirSync(stateDir, { recursive: true });
+  const { synthesis, kernel, persistence } = await loadXray();
+
+  // Reset prior checkpoint for clean live run
+  if (existsSync(checkpointPath)) {
+    const prior = synthesis.loadSynthesisCheckpointState(root);
+    if (prior?.synthesisDue) {
+      log('ℹ️  Clearing prior due checkpoint for fresh live run');
+    }
+  }
+
+  let becameDue = false;
+  for (let i = 0; i < threshold; i++) {
+    const result = synthesis.recordExecutionSlice('gate', { projectRoot: root, sessionId });
+    if (result.becameDue) becameDue = true;
+  }
+
+  const state = synthesis.loadSynthesisCheckpointState(root);
+  const due = synthesis.isSynthesisCheckpointDue(root, sessionId);
+
+  log(`📊 sessionId: ${sessionId}`);
+  log(`📊 gate slices recorded: ${threshold}`);
+  log(`📊 synthesisDue: ${due}`);
+  log(`📊 dueReason: ${state?.dueReason ?? 'null'}`);
+  log(`📊 synthesisCount: ${state?.synthesisCount ?? 0}`);
+
+  if (!due) {
+    err('❌ Checkpoint not due after seeding');
+    process.exit(1);
+  }
+
+  // Write session boot marker for hooks
+  writeFileSync(
+    join(stateDir, 'session-boot.json'),
+    JSON.stringify(
+      {
+        hook: 'live-synthesis-seed',
+        lead_dev_mode: true,
+        sessionId,
+        workspaceRoot: root,
+        timestamp: new Date().toISOString(),
+      },
+      null,
+      2,
+    ),
+  );
+
+  log('\n✅ Live synthesis checkpoint SEEDED');
+  log('Next: CallMcpTool xray-orchestrator analyze-complexity with sessionId');
+  log(`      sessionId: "${sessionId}"`);
+}
+
+async function cmdStatus() {
+  const sessionId = parseSessionId();
+  const { synthesis, persistence } = await loadXray();
+  const state = synthesis.loadSynthesisCheckpointState(root);
+  const due = synthesis.isSynthesisCheckpointDue(root, sessionId);
+  const plan = persistence.loadPersistedLeadDevPlan(root);
+  const consultTodos = plan ? persistence.getSynthesisConsultTodos(plan) : [];
+
+  log(JSON.stringify(
+    {
+      sessionId,
+      synthesisDue: due,
+      dueReason: state?.dueReason ?? null,
+      synthesisCount: state?.synthesisCount ?? 0,
+      planActive: plan?.active ?? false,
+      phaseId: plan?.phases?.[0]?.id ?? null,
+      consultTodos: consultTodos.map((t) => ({ id: t.id, subagent: t.subagent, status: t.status })),
+    },
+    null,
+    2,
+  ));
+}
+
+async function cmdCompleteTodo() {
+  const todoId = process.argv.find((a) => a.startsWith('--id='))?.split('=')[1];
+  const verdict = process.argv.find((a) => a.startsWith('--verdict='))?.split('=')[1];
+  if (!todoId) {
+    err('Usage: complete-todo --id=s.1 --verdict=PASS|CONDITIONAL|FAIL');
+    process.exit(1);
+  }
+  if (!verdict || !['PASS', 'CONDITIONAL', 'FAIL'].includes(verdict)) {
+    err('❌ --verdict=PASS|CONDITIONAL|FAIL required (consult receipt gate)');
+    process.exit(1);
+  }
+
+  const sessionId = parseSessionId();
+  const { persistence } = await loadXray();
+  const { writeSynthesisConsultReceipt } = await import(
+    join(xrayRoot, 'dist/nucleus/synthesis-consult-receipt.js'),
+  );
+
+  const plan = persistence.loadPersistedLeadDevPlan(root);
+  const consultTodo = plan
+    ? persistence.getSynthesisConsultTodos(plan).find((t) => t.id === todoId)
+    : null;
+  if (!consultTodo) {
+    err(`❌ Consult todo ${todoId} not found in lead-dev plan`);
+    process.exit(1);
+  }
+
+  writeSynthesisConsultReceipt(
+    todoId,
+    {
+      sessionId: plan?.sessionId ?? sessionId,
+      subagent: consultTodo.subagent,
+      verdict,
+      topRisks: [],
+      hardeningNote: process.argv.find((a) => a.startsWith('--note='))?.split('=')[1] ?? '',
+    },
+    root,
+  );
+
+  const updated = persistence.updatePlanTodoStatus(todoId, 'completed', root);
+  if (!updated) {
+    err(`❌ Receipt gate blocked completion for ${todoId}`);
+    process.exit(1);
+  }
+
+  const refreshed = persistence.loadPersistedLeadDevPlan(root);
+  const todos = refreshed ? persistence.getSynthesisConsultTodos(refreshed) : [];
+  const allDone = todos.length > 0 && todos.every((t) => t.status === 'completed');
+  log(`✅ Marked ${todoId} completed (receipt: ${verdict})`);
+  log(`📊 consult todos: ${todos.map((t) => `${t.id}:${t.status}`).join(', ')}`);
+  if (allDone) log('🎉 All consult todos complete — checkpoint should clear on next gate eval');
+}
+
+async function cmdFinish() {
+  const sessionId = parseSessionId();
+  const { synthesis } = await loadXray();
+  const due = synthesis.isSynthesisCheckpointDue(root, sessionId);
+  const state = synthesis.loadSynthesisCheckpointState(root);
+  if (due) {
+    err('❌ Checkpoint still due — complete all consult todos first');
+    await cmdStatus();
+    process.exit(1);
+  }
+  log('✅ Live synthesis checkpoint CLEARED');
+  log(`📊 synthesisCount: ${state?.synthesisCount ?? 0}`);
+  log(`📊 lastSynthesisAt: ${state?.lastSynthesisAt ?? 'null'}`);
+}
+
+const cmd = process.argv[2] || 'seed';
+const handlers = {
+  seed: cmdSeed,
+  status: cmdStatus,
+  'complete-todo': cmdCompleteTodo,
+  finish: cmdFinish,
+};
+
+const handler = handlers[cmd];
+if (!handler) {
+  err(`Unknown command: ${cmd}`);
+  process.exit(1);
+}
+await handler();

package/vendor/@0xray/repertoire/scripts/suit-bridge-shared.mjs

@@ -0,0 +1,139 @@
+#!/usr/bin/env node
+/**
+ * Consumer-side helpers for suit verification — constants from 0xray bridge-mcp-wiring (SSOT).
+ */
+import { createRequire } from 'node:module';
+import { execSync, spawn } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+
+const packageRoot = resolve(import.meta.dirname, '..');
+
+/** Consumer project root (hoisted 0xray lives here, not under @0xray/repertoire). */
+export function resolveConsumerRoot() {
+  if (process.env.SUIT_VERIFY_ROOT) return resolve(process.env.SUIT_VERIFY_ROOT);
+  if (existsSync(join(process.cwd(), '.xray', 'features.json'))) return resolve(process.cwd());
+  return packageRoot;
+}
+
+function xrayPathCandidates(...segments) {
+  const consumerRoot = resolveConsumerRoot();
+  const roots =
+    consumerRoot === packageRoot ? [packageRoot] : [consumerRoot, packageRoot];
+  const candidates = roots.map((r) => join(r, 'node_modules/0xray', ...segments));
+  candidates.push(resolve(packageRoot, '../xray', ...segments));
+  return candidates;
+}
+
+function resolveXrayBridgeModule() {
+  const found = xrayPathCandidates('scripts/node/bridge-mcp-wiring.cjs').find((p) =>
+    existsSync(p),
+  );
+  if (!found) {
+    throw new Error('0xray bridge-mcp-wiring.cjs missing — run npm install');
+  }
+  return createRequire(import.meta.url)(found);
+}
+
+const wiring = resolveXrayBridgeModule();
+
+export const {
+  XRAY_MCP_SERVERS,
+  HERMES_CONFIG_PATH,
+  HERMES_PLUGIN_DIR,
+  OPENCLAW_CONFIG_PATH,
+  OPENCLAW_STATE_DIR,
+} = wiring;
+
+/** Repertoire consumer MCP surface (local dist when developing this repo). */
+export const REPERTOIRE_MCP = {
+  name: 'repertoire',
+  npxArgs: ['-y', '@0xray/repertoire', 'mcp'],
+  localArgs: ['node', 'dist/mcp/server.js'],
+};
+
+export function resolveXrayScript(filename) {
+  return xrayPathCandidates('scripts/node', filename).find((p) => existsSync(p)) ?? null;
+}
+
+export function readInstalledXrayVersion() {
+  const pkgPath = xrayPathCandidates('package.json').find((p) => existsSync(p));
+  if (!pkgPath) return 'unknown';
+  try {
+    const pkg = createRequire(import.meta.url)(pkgPath);
+    return pkg.version ?? 'unknown';
+  } catch {
+    return 'unknown';
+  }
+}
+
+/** Re-run native install when xray-consumer-root.txt points at wrong cwd (e.g. npx cache). */
+export function ensureConsumerRootMarker(markerPath, installCmd) {
+  const consumerRoot = resolveConsumerRoot();
+  let marked = '';
+  if (existsSync(markerPath)) {
+    marked = readFileSync(markerPath, 'utf8').trim();
+    if (marked === consumerRoot) return consumerRoot;
+  }
+  process.stdout.write(
+    `⚠  consumer root ${marked ? `drift (${marked})` : 'missing'} — running ${installCmd}\n`,
+  );
+  execSync(installCmd, { cwd: consumerRoot, stdio: 'inherit' });
+  return consumerRoot;
+}
+
+export function mcpStdioInitializeProbe({ cwd, command, args, env = {}, timeoutMs = 6000 }) {
+  return new Promise((resolveProbe, rejectProbe) => {
+    const init = JSON.stringify({
+      jsonrpc: '2.0',
+      id: 1,
+      method: 'initialize',
+      params: {
+        protocolVersion: '2024-11-05',
+        capabilities: {},
+        clientInfo: { name: 'suit-bridge-probe', version: '1.0' },
+      },
+    });
+
+    const proc = spawn(command, args, {
+      cwd,
+      env: { ...process.env, ...env },
+      stdio: ['pipe', 'pipe', 'pipe'],
+    });
+    let out = '';
+    const timer = setTimeout(() => {
+      proc.kill();
+      rejectProbe(new Error(`timeout after ${timeoutMs}ms`));
+    }, timeoutMs);
+
+    const finish = (ok) => {
+      if (finished) return;
+      finished = true;
+      clearTimeout(timer);
+      try {
+        proc.kill('SIGTERM');
+      } catch {
+        /* already exited */
+      }
+      if (ok) resolveProbe(out);
+      else rejectProbe(new Error(out.slice(0, 200) || 'no serverInfo in MCP response'));
+    };
+
+    let finished = false;
+
+    const onData = (chunk) => {
+      out += chunk.toString();
+      if (out.includes('serverInfo')) finish(true);
+    };
+
+    proc.stdout.on('data', onData);
+    proc.stderr.on('data', onData);
+
+    proc.on('close', () => {
+      if (!finished) finish(out.includes('serverInfo'));
+    });
+
+    proc.stdin.write(`${init}\n`);
+    proc.stdin.end();
+  });
+}