0xray 3.5.5 → 4.0.1

package/vendor/@0xray/repertoire/scripts/verify-grok-suit.mjs

@@ -0,0 +1,304 @@
+#!/usr/bin/env node
+/**
+ * Verify 0xRay suit is fully wearable in Grok Build for this repo.
+ * Run: npm run build && node scripts/verify-grok-suit.mjs
+ */
+import { execSync } from 'node:child_process';
+import { existsSync, readFileSync, statSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { mcpStdioInitializeProbe, resolveConsumerRoot } from './suit-bridge-shared.mjs';
+
+function resolveMemoryProviderPath(projectRoot) {
+  const local = join(projectRoot, 'dist/provider/memory-routing-provider.js');
+  if (existsSync(local)) return local;
+  const installed = join(
+    projectRoot,
+    'node_modules/@0xray/repertoire/dist/provider/memory-routing-provider.js',
+  );
+  if (existsSync(installed)) return installed;
+  return local;
+}
+
+const root = resolveConsumerRoot();
+let failed = 0;
+
+function pass(name, detail = '') {
+  console.log(`✅ ${name}${detail ? ` — ${detail}` : ''}`);
+}
+
+function fail(name, detail = '') {
+  failed++;
+  console.error(`❌ ${name}${detail ? ` — ${detail}` : ''}`);
+}
+
+function resolveLiveHook(name) {
+  const candidates = [
+    join(root, 'node_modules/0xray/dist/integrations/grok/hooks', name),
+    join(homedir(), 'dev/xray/dist/integrations/grok/hooks', name),
+  ];
+  return candidates.find((p) => existsSync(p)) || null;
+}
+
+function tailActivityLog(workspace, tailBytes = 32768) {
+  const logFile = join(workspace, 'logs', 'framework', 'activity.log');
+  if (!existsSync(logFile)) return '';
+  const stat = statSync(logFile);
+  const start = Math.max(0, stat.size - tailBytes);
+  const buf = readFileSync(logFile).subarray(start);
+  return buf.toString('utf8');
+}
+
+function runHook(hookPath, fixture, env = {}) {
+  const payload = JSON.stringify(fixture);
+  return execSync(`printf '%s' '${payload.replace(/'/g, "'\\''")}' | node "${hookPath}"`, {
+    encoding: 'utf8',
+    env: { ...process.env, GROK_WORKSPACE_ROOT: root, ...env },
+  });
+}
+
+// 1. .xray layout
+for (const f of ['codex.json', 'features.json', 'config.json']) {
+  const p = join(root, '.xray', f);
+  existsSync(p) ? pass(`.xray/${f}`) : fail(`.xray/${f}`, 'missing');
+}
+
+// 2. features.json contract
+try {
+  const features = JSON.parse(readFileSync(join(root, '.xray/features.json'), 'utf8'));
+  let installedXrayVersion = 'unknown';
+  try {
+    const xrayPkg = JSON.parse(
+      readFileSync(join(root, 'node_modules/0xray/package.json'), 'utf8'),
+    );
+    installedXrayVersion = xrayPkg.version ?? 'unknown';
+  } catch {
+    /* optional */
+  }
+  if (features.version === installedXrayVersion) {
+    pass('features.json version', installedXrayVersion);
+  } else {
+    fail('features.json version', `got ${features.version}, expected ${installedXrayVersion}`);
+  }
+  if (features.inference_governance?.enabled) pass('inference_governance');
+  else fail('inference_governance', 'not enabled');
+  if (features.memory_routing?.enabled) pass('memory_routing');
+  else fail('memory_routing', 'not enabled');
+  if (features.synthesis?.enabled) pass('synthesis.enabled');
+  else fail('synthesis.enabled', 'not enabled');
+} catch (e) {
+  fail('features.json parse', e.message);
+}
+
+// 3. Memory provider built (local dist or installed @0xray/repertoire)
+const provider = resolveMemoryProviderPath(root);
+existsSync(provider)
+  ? pass('memory-routing-provider.js')
+  : fail('memory-routing-provider.js', 'npm install @0xray/repertoire or npm run build');
+
+// 4. .mcp.json — 7 xray + repertoire
+try {
+  const mcp = JSON.parse(readFileSync(join(root, '.mcp.json'), 'utf8'));
+  const servers = Object.keys(mcp.mcpServers || {});
+  const xrayCount = servers.filter((s) => s.startsWith('xray-')).length;
+  if (xrayCount === 7) pass('.mcp.json xray servers', '7/7');
+  else fail('.mcp.json xray servers', `${xrayCount}/7`);
+  servers.includes('repertoire') ? pass('.mcp.json repertoire') : fail('.mcp.json repertoire', 'missing');
+  const mcpRaw = readFileSync(join(root, '.mcp.json'), 'utf8');
+  if (/\/Users\/[^"'\s]+/.test(mcpRaw)) {
+    fail('.mcp.json portable paths', 'absolute /Users/ path in committed .mcp.json');
+  } else {
+    pass('.mcp.json portable paths');
+  }
+} catch (e) {
+  fail('.mcp.json', e.message);
+}
+
+// 5. Grok plugin + UserPromptSubmit boot hook
+const grokPlugin = join(homedir(), '.grok/plugins/0xray');
+const grokHooks = join(grokPlugin, 'hooks/hooks.json');
+existsSync(grokPlugin) ? pass('Grok plugin', grokPlugin) : fail('Grok plugin', 'run: npx 0xray grok install --force');
+if (existsSync(grokHooks)) {
+  const hooksRaw = readFileSync(grokHooks, 'utf8');
+  hooksRaw.includes('session-start.js')
+    ? pass('SessionStart hook')
+    : fail('SessionStart hook', 're-run: npx 0xray grok install --force');
+  hooksRaw.includes('pre-tool-use.js')
+    ? pass('PreToolUse hook (live Grok path)')
+    : fail('PreToolUse hook', 'missing from hooks.json');
+  hooksRaw.includes('UserPromptSubmit')
+    ? pass('UserPromptSubmit boot hook')
+    : fail('UserPromptSubmit boot hook', 'add session-start.js — npx 0xray grok install --force');
+} else {
+  fail('Grok hooks.json', 'missing');
+}
+
+try {
+  const features = JSON.parse(readFileSync(join(root, '.xray/features.json'), 'utf8'));
+  if (features.multi_agent_orchestration?.lead_dev_mode) pass('lead_dev_mode in features.json');
+  else fail('lead_dev_mode', 'not enabled');
+  if (features.multi_agent_orchestration?.no_new_surface !== false) pass('no_new_surface in features.json');
+  else fail('no_new_surface', 'disabled');
+} catch (e) {
+  fail('lead_dev_mode', e.message);
+}
+
+try {
+  const codex = JSON.parse(readFileSync(join(root, '.xray/codex.json'), 'utf8'));
+  if (codex.terms?.['69']) pass('codex term 69 (no new surface)');
+  else fail('codex term 69', 'missing');
+} catch (e) {
+  fail('codex term 69', e.message);
+}
+
+// 6. 0xray package xray field (server-config-registry — no fallback)
+try {
+  const xrayPkg = JSON.parse(
+    readFileSync(join(root, 'node_modules/0xray/package.json'), 'utf8'),
+  );
+  if (xrayPkg.xray?.mcpServersPath || xrayPkg.xray?.dist) pass('0xray package.json xray field');
+  else fail('0xray package.json xray field', 'missing — npm link ~/dev/xray && rebuild');
+} catch (e) {
+  fail('0xray package.json xray field', e.message);
+}
+
+// 7. CLI health
+try {
+  execSync('npx 0xray health', { cwd: root, stdio: 'pipe', encoding: 'utf8' });
+  pass('npx 0xray health');
+} catch {
+  fail('npx 0xray health');
+}
+
+const preToolHook = resolveLiveHook('pre-tool-use.js');
+const sessionHook = resolveLiveHook('session-start.js');
+if (!preToolHook) fail('Live PreToolUse hook path', 'not found in node_modules/0xray');
+else pass('Live PreToolUse hook path', preToolHook);
+
+if (!sessionHook) fail('Live SessionStart hook path', 'not found');
+else pass('Live SessionStart hook path', sessionHook);
+
+// 8. SessionStart → session-boot.json + activity.log
+const bootPath = join(root, '.xray', 'state', 'session-boot.json');
+const activityBefore = tailActivityLog(root);
+if (sessionHook) {
+  try {
+    runHook(
+      sessionHook,
+      {
+        hookEventName: 'session_start',
+        sessionId: 'verify-suit-probe',
+        workspaceRoot: root,
+        cwd: root,
+      },
+      { GROK_HOOK_EVENT: 'session_start', GROK_SESSION_ID: 'verify-suit-probe' },
+    );
+    if (existsSync(bootPath)) {
+      const boot = JSON.parse(readFileSync(bootPath, 'utf8'));
+      if (boot.lead_dev_mode === true) pass('session-boot.json written', 'lead_dev_mode=true');
+      else fail('session-boot.json', 'lead_dev_mode not true');
+    } else {
+      fail('session-boot.json', 'missing after SessionStart hook');
+    }
+    const activityAfter = tailActivityLog(root);
+    if (/grok-session-start.*session-boot-written/.test(activityAfter)) {
+      pass('SessionStart logged to activity.log');
+    } else {
+      fail('SessionStart activity.log', 'no grok-session-start entry');
+    }
+  } catch (e) {
+    fail('SessionStart hook probe', e.message?.slice(0, 160));
+  }
+}
+
+// 9. PreToolUse deny + activity.log (same path Grok uses live)
+if (preToolHook) {
+  try {
+    const out = runHook(preToolHook, {
+      toolName: 'search_replace',
+      workspaceRoot: root,
+      toolInput: { path: 'src/mcps/new-thing.server.ts', new_string: 'export {}' },
+    });
+    if (/"decision"\s*:\s*"deny"/.test(out)) pass('PreToolUse deny (live hook path)');
+    else fail('PreToolUse deny', `got: ${out.slice(0, 120)}`);
+
+    const activity = tailActivityLog(root);
+    if (/grok-pre-tool-use.*deny/.test(activity)) {
+      pass('PreToolUse deny logged to activity.log');
+    } else {
+      fail('PreToolUse activity.log', 'no grok-pre-tool-use deny entry');
+    }
+  } catch (e) {
+    fail('PreToolUse hook probe', e.message?.slice(0, 160));
+  }
+}
+
+// 10. MCP enforcer stdio + no server-config-registry fallback (Node probe — no GNU timeout)
+const activityBeforeEnforcer = tailActivityLog(root);
+try {
+  await mcpStdioInitializeProbe({
+    cwd: root,
+    command: 'npx',
+    args: ['0xray', 'mcp', 'enforcer'],
+    timeoutMs: 6000,
+  });
+  pass('MCP enforcer stdio');
+
+  const activityNew = tailActivityLog(root).slice(activityBeforeEnforcer.length);
+  if (/using-fallback-path/.test(activityNew)) {
+    fail('server-config-registry', 'using-fallback-path in activity.log after enforcer boot');
+  } else {
+    pass('server-config-registry resolved (no fallback warning)');
+  }
+} catch (e) {
+  fail('MCP enforcer stdio', e.message?.slice(0, 120));
+}
+
+// 11. Orchestrator behavior assertions (0xray@3.4.10+)
+const behaviorScript = join(root, 'node_modules/0xray/scripts/mjs/verify-orchestrator-behavior.mjs');
+if (!existsSync(behaviorScript)) {
+  fail('Orchestrator behavior assertions', 'missing script — npm install 0xray@^3.4.10');
+} else {
+  try {
+    execSync(`node "${behaviorScript}"`, { cwd: root, stdio: 'pipe', encoding: 'utf8' });
+    pass('Orchestrator behavior assertions');
+  } catch (e) {
+    const detail = (e.stderr || e.stdout || e.message || '').toString().slice(0, 160);
+    fail('Orchestrator behavior assertions', detail);
+  }
+}
+
+// 12. Grok delegation + synthesis gate fixtures (0xray@3.5.0+)
+for (const [label, scriptName] of [
+  ['Grok delegation gate fixture', 'verify-grok-delegation-gate.mjs'],
+  ['Grok synthesis gate fixture', 'verify-grok-synthesis-gate.mjs'],
+]) {
+  const gateScript = join(root, 'node_modules/0xray/scripts/mjs', scriptName);
+  if (!existsSync(gateScript)) {
+    fail(label, 'missing script — npm install 0xray@main (3.5.0+)');
+  } else {
+    try {
+      execSync(`node "${gateScript}"`, { cwd: root, stdio: 'pipe', encoding: 'utf8' });
+      pass(label);
+    } catch (e) {
+      const detail = (e.stderr || e.stdout || e.message || '').toString().slice(0, 160);
+      fail(label, detail);
+    }
+  }
+}
+
+// 13. Installed Grok plugin PostToolUse hook (3.5.0 auto-chain)
+const installedGrokHooks = join(grokPlugin, 'hooks/hooks.json');
+if (existsSync(installedGrokHooks)) {
+  const installedRaw = readFileSync(installedGrokHooks, 'utf8');
+  if (installedRaw.includes('PostToolUse') && installedRaw.includes('post-tool-use.js')) {
+    pass('Grok plugin PostToolUse hook installed');
+  } else {
+    fail('Grok plugin PostToolUse hook', 'run: npx 0xray grok install --force');
+  }
+} else {
+  fail('Grok plugin PostToolUse hook', 'hooks.json missing — npx 0xray grok install --force');
+}
+
+console.log('\n' + (failed === 0 ? '🎉 Suit wearable — operate within 0xRay.' : `⚠️  ${failed} check(s) failed — fix before tuning.`));
+process.exit(failed === 0 ? 0 : 1);

package/vendor/@0xray/repertoire/scripts/verify-hermes-suit.mjs

@@ -0,0 +1,163 @@
+#!/usr/bin/env node
+/**
+ * Verify Hermes suit bridge for this consumer repo.
+ * Run: node scripts/verify-hermes-suit.mjs
+ */
+import { execSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join, resolve } from 'node:path';
+import {
+  HERMES_CONFIG_PATH,
+  HERMES_PLUGIN_DIR,
+  REPERTOIRE_MCP,
+  XRAY_MCP_SERVERS,
+  ensureConsumerRootMarker,
+} from './suit-bridge-shared.mjs';
+
+const root = resolve(import.meta.dirname, '..');
+ensureConsumerRootMarker(
+  join(HERMES_PLUGIN_DIR, 'xray-consumer-root.txt'),
+  'npx 0xray hermes install --force',
+);
+let failed = 0;
+
+function pass(name, detail = '') {
+  console.log(`✅ ${name}${detail ? ` — ${detail}` : ''}`);
+}
+
+function fail(name, detail = '') {
+  failed++;
+  console.error(`❌ ${name}${detail ? ` — ${detail}` : ''}`);
+}
+
+// 1. Hermes CLI
+try {
+  const hermesPath = execSync('which hermes', { encoding: 'utf8' }).trim();
+  pass('hermes cli', hermesPath);
+} catch {
+  fail('hermes cli', 'not on PATH');
+}
+
+// 2. Plugin installed
+const pluginYaml = join(HERMES_PLUGIN_DIR, 'plugin.yaml');
+existsSync(pluginYaml) ? pass('xray-hermes plugin', HERMES_PLUGIN_DIR) : fail('xray-hermes plugin', 'run: npx 0xray hermes install --force');
+
+// 3. Consumer root marker
+const markerPath = join(HERMES_PLUGIN_DIR, 'xray-consumer-root.txt');
+if (existsSync(markerPath)) {
+  const marked = readFileSync(markerPath, 'utf8').trim();
+  marked === root ? pass('consumer root marker', root) : fail('consumer root marker', `got ${marked}`);
+} else {
+  fail('consumer root marker', 'missing');
+}
+
+// 4. Plugin enabled
+try {
+  const plugins = execSync('hermes plugins list 2>&1', { encoding: 'utf8' })
+    .replace(/\x1b\[[0-9;]*m/g, '');
+  const enabledLine = plugins.split('\n').find((line) => /│\s*0xray-hermes\b/.test(line));
+  if (enabledLine?.includes('enabled') && !enabledLine.includes('not enabled')) {
+    pass('0xray-hermes plugin enabled');
+  } else {
+    fail('0xray-hermes plugin enabled', 'run: hermes plugins enable 0xray-hermes');
+  }
+} catch (e) {
+  fail('0xray-hermes plugin enabled', e.message?.slice(0, 120));
+}
+
+// 5. Plugin .mcp.json
+try {
+  const pluginMcp = JSON.parse(readFileSync(join(HERMES_PLUGIN_DIR, '.mcp.json'), 'utf8'));
+  const names = Object.keys(pluginMcp.mcpServers ?? {});
+  const xrayCount = names.filter((n) => n.startsWith('xray-')).length;
+  if (xrayCount === 7) pass('plugin .mcp.json xray servers', '7/7');
+  else fail('plugin .mcp.json xray servers', `${xrayCount}/7`);
+} catch (e) {
+  fail('plugin .mcp.json', e.message);
+}
+
+// 6. Hermes config mcp_servers
+try {
+  const listScript = join(root, 'scripts', 'list-hermes-mcp-servers.py');
+  const out = execSync(`python3 "${listScript}" "${HERMES_CONFIG_PATH}"`, { encoding: 'utf8' });
+  const { names } = JSON.parse(out.trim());
+  const xrayCount = names.filter((n) => n.startsWith('xray-')).length;
+  if (xrayCount === 7) pass('config.yaml mcp_servers xray', '7/7');
+  else fail('config.yaml mcp_servers xray', `${xrayCount}/7`);
+  names.includes(REPERTOIRE_MCP.name)
+    ? pass('config.yaml mcp_servers repertoire')
+    : fail('config.yaml mcp_servers repertoire', 'missing');
+} catch (e) {
+  fail('config.yaml mcp_servers', e.message?.slice(0, 160));
+}
+
+// 7. Bridge health
+try {
+  const out = execSync(
+    `printf '%s' '{"command":"health"}' | node "${join(HERMES_PLUGIN_DIR, 'bridge.mjs')}" --cwd "${root}"`,
+    { encoding: 'utf8', cwd: root, env: { ...process.env, XRAY_ROOT: root } },
+  );
+  const health = JSON.parse(out.trim());
+  if (health.framework === 'loaded') pass('bridge health', 'framework loaded');
+  else fail('bridge health', JSON.stringify(health).slice(0, 120));
+  if (health.projectRoot === root) pass('bridge projectRoot', root);
+  else fail('bridge projectRoot', `got ${health.projectRoot}`);
+} catch (e) {
+  fail('bridge health', e.message?.slice(0, 160));
+}
+
+// 8. .xray contract (shared with Grok)
+for (const f of ['codex.json', 'features.json', 'config.json']) {
+  existsSync(join(root, '.xray', f)) ? pass(`.xray/${f}`) : fail(`.xray/${f}`, 'missing');
+}
+
+// 9. MCP enforcer stdio (same surface Hermes mcp_servers uses)
+try {
+  const init = JSON.stringify({
+    jsonrpc: '2.0',
+    id: 1,
+    method: 'initialize',
+    params: {
+      protocolVersion: '2024-11-05',
+      capabilities: {},
+      clientInfo: { name: 'verify-hermes-suit', version: '1.0' },
+    },
+  });
+  const out = execSync(
+    `printf '%s\\n' '${init.replace(/'/g, "'\\''")}' | timeout 12 npx 0xray mcp enforcer 2>/dev/null | head -1`,
+    { cwd: root, encoding: 'utf8', shell: '/bin/bash' },
+  );
+  if (out.includes('serverInfo')) pass('MCP enforcer stdio probe');
+  else fail('MCP enforcer stdio probe', out.slice(0, 120));
+} catch (e) {
+  fail('MCP enforcer stdio probe', e.message?.slice(0, 160));
+}
+
+// 10. Plugin tool surface (plugin.yaml — live session loads on restart)
+try {
+  const pluginYaml = readFileSync(join(HERMES_PLUGIN_DIR, 'plugin.yaml'), 'utf8');
+  const pluginTools = ['xray_validate', 'xray_codex_check', 'xray_health', 'xray_hooks'];
+  const found = pluginTools.filter((t) => pluginYaml.includes(t));
+  if (found.length === pluginTools.length) pass('plugin tools (plugin.yaml)', pluginTools.join(', '));
+  else fail('plugin tools (plugin.yaml)', `found ${found.length}/4`);
+} catch (e) {
+  fail('plugin tools (plugin.yaml)', e.message?.slice(0, 120));
+}
+
+// 11. Delegation gate fixture (0xray@3.5.1+)
+const hermesGateScript = join(root, 'node_modules/0xray/scripts/mjs/verify-hermes-delegation-gate.mjs');
+if (existsSync(hermesGateScript)) {
+  try {
+    execSync(`node "${hermesGateScript}"`, { cwd: root, stdio: 'pipe', encoding: 'utf8' });
+    pass('Hermes delegation gate fixture', '4/4');
+  } catch (e) {
+    const detail = (e.stdout || e.stderr || e.message || '').split('\n').slice(-3).join(' ').slice(0, 160);
+    fail('Hermes delegation gate fixture', detail);
+  }
+} else {
+  fail('Hermes delegation gate fixture', 'missing script — npm install 0xray@^3.5.1');
+}
+
+console.log('\n' + (failed === 0 ? '🎉 Hermes suit wearable.' : `⚠️  ${failed} Hermes check(s) failed.`));
+process.exit(failed === 0 ? 0 : 1);

package/vendor/@0xray/repertoire/scripts/verify-openclaw-suit.mjs

@@ -0,0 +1,125 @@
+#!/usr/bin/env node
+/**
+ * Verify OpenClaw suit bridge for this consumer repo (native 0xray install).
+ */
+import { execSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { REPERTOIRE_MCP, XRAY_MCP_SERVERS, ensureConsumerRootMarker } from './suit-bridge-shared.mjs';
+
+const root = resolve(import.meta.dirname, '..');
+const OPENCLAW_STATE = join(homedir(), '.openclaw');
+ensureConsumerRootMarker(
+  join(OPENCLAW_STATE, 'xray-consumer-root.txt'),
+  'npx 0xray openclaw install --force',
+);
+const OPENCLAW_CONFIG = join(OPENCLAW_STATE, 'openclaw.json');
+let failed = 0;
+
+function pass(name, detail = '') {
+  console.log(`✅ ${name}${detail ? ` — ${detail}` : ''}`);
+}
+
+function fail(name, detail = '') {
+  failed++;
+  console.error(`❌ ${name}${detail ? ` — ${detail}` : ''}`);
+}
+
+// 1. OpenClaw CLI
+try {
+  const openclawPath = execSync('which openclaw', { encoding: 'utf8' }).trim();
+  pass('openclaw cli', openclawPath);
+} catch {
+  fail('openclaw cli', 'not on PATH');
+}
+
+// 2. Consumer integration config
+const consumerConfig = join(root, '.xray', 'config', 'openclaw.json');
+existsSync(consumerConfig)
+  ? pass('consumer openclaw.json', consumerConfig)
+  : fail('consumer openclaw.json', 'run npx 0xray openclaw install');
+
+// 3. Consumer root marker
+const markerPath = join(OPENCLAW_STATE, 'xray-consumer-root.txt');
+if (existsSync(markerPath)) {
+  const marked = readFileSync(markerPath, 'utf8').trim();
+  marked === root ? pass('consumer root marker', root) : fail('consumer root marker', `got ${marked}`);
+} else {
+  fail('consumer root marker', 'missing');
+}
+
+// 4. xray-orchestrator skill synced
+const orchestratorSkill = join(OPENCLAW_STATE, 'skills', 'xray-orchestrator', 'SKILL.md');
+existsSync(orchestratorSkill)
+  ? pass('xray-orchestrator skill', orchestratorSkill)
+  : fail('xray-orchestrator skill', 'missing');
+
+// 5. openclaw mcp list
+try {
+  const listed = execSync('openclaw mcp list 2>&1', { encoding: 'utf8', timeout: 20000 });
+  const xrayListed = XRAY_MCP_SERVERS.filter((s) => listed.includes(s.name));
+  if (xrayListed.length === 7) pass('openclaw mcp list xray', '7/7');
+  else fail('openclaw mcp list xray', `${xrayListed.length}/7`);
+  listed.includes(REPERTOIRE_MCP.name)
+    ? pass('openclaw mcp list repertoire')
+    : fail('openclaw mcp list repertoire', 'not listed');
+} catch (e) {
+  fail('openclaw mcp list', e.message?.slice(0, 160));
+}
+
+// 6. openclaw.json mcp.servers block
+try {
+  const config = JSON.parse(readFileSync(OPENCLAW_CONFIG, 'utf8'));
+  const servers = config.mcp?.servers ?? {};
+  const xrayCount = Object.keys(servers).filter((n) => n.startsWith('xray-')).length;
+  if (xrayCount === 7) pass('openclaw.json mcp.servers xray', '7/7');
+  else fail('openclaw.json mcp.servers xray', `${xrayCount}/7`);
+  if (servers[REPERTOIRE_MCP.name]) pass('openclaw.json mcp.servers repertoire');
+  else fail('openclaw.json mcp.servers repertoire', 'missing');
+  if (servers['xray-enforcer']?.env?.XRAY_ROOT === root) {
+    pass('openclaw mcp XRAY_ROOT', root);
+  } else {
+    fail('openclaw mcp XRAY_ROOT', `got ${servers['xray-enforcer']?.env?.XRAY_ROOT}`);
+  }
+} catch (e) {
+  fail('openclaw.json mcp.servers', e.message?.slice(0, 160));
+}
+
+// 7. .xray contract
+for (const f of ['codex.json', 'features.json', 'config.json']) {
+  existsSync(join(root, '.xray', f)) ? pass(`.xray/${f}`) : fail(`.xray/${f}`, 'missing');
+}
+
+// 8. MCP stdio probe
+try {
+  const init = JSON.stringify({
+    jsonrpc: '2.0',
+    id: 1,
+    method: 'initialize',
+    params: {
+      protocolVersion: '2024-11-05',
+      capabilities: {},
+      clientInfo: { name: 'verify-openclaw-suit', version: '1.0' },
+    },
+  });
+  const out = execSync(
+    `printf '%s\\n' '${init.replace(/'/g, "'\\''")}' | timeout 12 npx 0xray mcp enforcer 2>/dev/null | head -1`,
+    { cwd: root, encoding: 'utf8', shell: '/bin/bash' },
+  );
+  if (out.includes('serverInfo')) pass('MCP enforcer stdio probe');
+  else fail('MCP enforcer stdio probe', out.slice(0, 120));
+} catch (e) {
+  fail('MCP enforcer stdio probe', e.message?.slice(0, 160));
+}
+
+// 9. npx 0xray health
+try {
+  execSync('npx 0xray health', { cwd: root, stdio: 'pipe', encoding: 'utf8' });
+  pass('npx 0xray health');
+} catch {
+  fail('npx 0xray health');
+}
+
+console.log('\n' + (failed === 0 ? '🎉 OpenClaw suit wearable.' : `⚠️  ${failed} OpenClaw check(s) failed.`));
+process.exit(failed === 0 ? 0 : 1);