0xray 4.0.0 → 4.0.2

package/scripts/node/ci-cd-auto-fix.cjs

@@ -1,263 +1,18 @@
 #!/usr/bin/env node
-
-/**
- * CI/CD Auto-Fix Script
- * 
- * Automatically fixes common CI/CD issues detected by the monitoring pipeline.
- * 
- * Usage: node scripts/node/ci-cd-auto-fix.cjs
- */
-
-const fs = require('fs');
-const path = require('path');
-const { execSync } = require('child_process');
-
-const rootDir = path.resolve(__dirname, '../..');
-
-// Colors for output
-const RED = '\x1b[0;31m';
-const GREEN = '\x1b[0;32m';
-const YELLOW = '\x1b[1;33m';
-const BLUE = '\x1b[0;34m';
-const NC = '\x1b[0m';
-
-const log = {
-  info: (msg) => console.log(`${BLUE}ℹ️  ${msg}${NC}`),
-  success: (msg) => console.log(`${GREEN}✅ ${msg}${NC}`),
-  error: (msg) => console.log(`${RED}❌ ${msg}${NC}`),
-  warn: (msg) => console.log(`${YELLOW}⚠️  ${msg}${NC}`),
-};
-
-const MAX_ITERATIONS = parseInt(process.env.MAX_ITERATIONS || '3');
-const GITHUB_TOKEN = process.env.GITHUB_TOKEN || '';
-const GITHUB_REPOSITORY = process.env.GITHUB_REPOSITORY || '';
-
-/**
- * Check if running in GitHub Actions
- */
-function isGitHubActions() {
-  return !!process.env.GITHUB_ACTIONS;
-}
-
-/**
- * Run a command and return output
- */
-function runCommand(cmd, options = {}) {
-  try {
-    const output = execSync(cmd, {
-      cwd: rootDir,
-      encoding: 'utf8',
-      stdio: 'pipe',
-      ...options,
-    });
-    return { success: true, output };
-  } catch (error) {
-    return { success: false, error: error.message, output: error.stdout || '' };
-  }
-}
-
-/**
- * Fix TypeScript errors
- */
-function fixTypeErrors() {
-  log.info('Checking TypeScript compilation...');
-  const result = runCommand('npx tsc --noEmit 2>&1 || true');
-  
-  if (result.success || result.output.includes('error TS')) {
-    const tsErrors = result.output.match(/error TS\d+:/g) || [];
-    if (tsErrors.length > 0) {
-      log.warn(`Found ${tsErrors.length} TypeScript errors`);
-      // Try to run typecheck with fix
-      const fixResult = runCommand('npm run typecheck 2>&1 || true');
-      if (fixResult.success) {
-        log.success('TypeScript errors resolved');
-        return true;
-      }
-    }
-  }
-  return false;
-}
-
 /**
- * Fix ESLint errors
+ * Mill does not auto-push CI fixes. Report only.
+ *
+ *   node scripts/node/ci-cd-auto-fix.cjs
  */
-function fixLintErrors() {
-  log.info('Checking ESLint...');
-  const result = runCommand('npm run lint 2>&1 || true');
-  
-  if (result.output.includes('error') || result.output.includes('warning')) {
-    log.warn('ESLint issues found, attempting fix...');
-    const fixResult = runCommand('npm run lint:fix 2>&1 || npx eslint --fix . 2>&1 || true');
-    if (fixResult.success) {
-      log.success('ESLint errors resolved');
-      return true;
-    }
-  }
-  return false;
-}
 
-/**
- * Fix test failures
- */
-function fixTestFailures() {
-  log.info('Running tests to identify failures...');
-  const result = runCommand('npm test 2>&1 || true');
-  
-  if (!result.success || result.output.includes('failed') || result.output.includes('FAIL')) {
-    log.warn('Test failures detected');
-    
-    // Check for specific failure patterns
-    const patterns = [
-      { pattern: /console\.(log|warn|error)/, fix: 'Run lint:fix to remove console statements' },
-      { pattern: /any\s*\|/, fix: 'Replace any types with proper interfaces' },
-      { pattern: /undefined/, fix: 'Add null checks or default values' },
-    ];
-    
-    for (const { pattern, fix } of patterns) {
-      if (pattern.test(result.output)) {
-        log.info(`Fix suggestion: ${fix}`);
-      }
-    }
-    return false;
-  }
-  
-  log.success('All tests passing');
-  return true;
-}
-
-/**
- * Fix missing dependencies
- */
-function fixDependencies() {
-  log.info('Checking dependencies...');
-  
-  const result = runCommand('npm ci 2>&1 || npm install 2>&1');
-  if (result.success) {
-    log.success('Dependencies up to date');
-    return true;
-  }
-  
-  log.error('Dependency issues may require manual intervention');
-  return false;
-}
-
-/**
- * Fix Git hooks
- */
-function fixGitHooks() {
-  log.info('Setting up Git hooks...');
-  const result = runCommand('npm run prepare 2>&1 || npx husky install 2>&1 || true');
-  
-  if (result.success) {
-    log.success('Git hooks configured');
-    return true;
-  }
-  return false;
-}
-
-/**
- * Fix consumer path issues
- */
-function fixConsumerPaths() {
-  log.info('Checking consumer path configuration...');
-  
-  const prepareResult = runCommand('npm run prepare-consumer 2>&1 || true');
-  if (prepareResult.output.includes('No development paths')) {
-    log.success('Paths already correct');
-    return true;
-  }
-  
-  // Run prepare-consumer to fix paths
-  const fixResult = runCommand('npm run prepare-consumer 2>&1');
-  if (fixResult.success || fixResult.output.includes('Complete')) {
-    log.success('Consumer paths fixed');
-    return true;
-  }
-  
-  return false;
-}
-
-/**
- * Generate health report
- */
-function generateHealthReport() {
-  const report = {
-    timestamp: new Date().toISOString(),
-    version: require(path.join(rootDir, 'package.json')).version,
-    status: 'healthy',
-    fixes_applied: [],
-    issues_remaining: [],
-  };
-  
-  const logsDir = path.join(rootDir, '.opencode', 'logs');
-  if (!fs.existsSync(logsDir)) {
-    fs.mkdirSync(logsDir, { recursive: true });
-  }
-  
-  const reportPath = path.join(logsDir, 'ci-cd-monitor-report.json');
-  fs.writeFileSync(reportPath, JSON.stringify(report, null, 2));
-  
-  log.info(`Health report generated: ${reportPath}`);
-}
-
-/**
- * Main auto-fix routine
- */
-async function autoFix() {
-  log.info('Starting CI/CD Auto-Fix...');
-  log.info(`Max iterations: ${MAX_ITERATIONS}`);
-  console.log('');
-  
-  let fixed = false;
-  const fixes = [];
-  
-  // Run all fix routines
-  const routines = [
-    { name: 'Dependencies', fn: fixDependencies },
-    { name: 'Consumer Paths', fn: fixConsumerPaths },
-    { name: 'Git Hooks', fn: fixGitHooks },
-    { name: 'TypeScript', fn: fixTypeErrors },
-    { name: 'ESLint', fn: fixLintErrors },
-    { name: 'Tests', fn: fixTestFailures },
-  ];
-  
-  for (const { name, fn } of routines) {
-    console.log('');
-    log.info(`Running: ${name}...`);
-    try {
-      if (fn()) {
-        fixes.push(name);
-        fixed = true;
-      }
-    } catch (error) {
-      log.error(`${name} failed: ${error.message}`);
-    }
-  }
-  
-  console.log('');
-  console.log('══════════════════════════════════════════════════');
-  
-  if (fixed) {
-    log.success(`CI/CD Auto-Fix Complete! ${fixes.length} issue(s) resolved.`);
-    console.log('');
-    console.log('Fixes applied:');
-    fixes.forEach((fix, i) => console.log(`  ${i + 1}. ${fix}`));
-  } else {
-    log.warn('No issues resolved (or none detected)');
-  }
-  
-  // Generate health report
-  generateHealthReport();
-  
-  console.log('══════════════════════════════════════════════════');
-  
-  return fixed;
-}
+const { spawnSync } = require("child_process");
+const path = require("path");
 
-// Run auto-fix
-autoFix().then((fixed) => {
-  process.exit(fixed ? 0 : 0); // Always exit 0 for now
-}).catch((error) => {
-  log.error(`Auto-fix failed: ${error.message}`);
-  process.exit(1);
+const mill = path.join(__dirname, "../foundry/ci-monitor.mjs");
+const root = process.env.FOUNDRY_ROOT || process.cwd();
+const result = spawnSync(process.execPath, [mill, "--report", ...process.argv.slice(2)], {
+  stdio: "inherit",
+  cwd: root,
+  env: { ...process.env, FOUNDRY_ROOT: root },
 });
+process.exit(result.status === null ? 1 : result.status);

package/scripts/node/consumer-install-smoke.mjs

@@ -48,9 +48,14 @@ function assertFreshInstallDefaults(tmpRoot, version) {
   if (!features.memory_routing) {
     throw new Error("Deployed features.json missing memory_routing block");
   }
-  if (features.memory_routing.enabled !== false) {
+  if (features.memory_routing.enabled !== true) {
     throw new Error(
-      `Fresh install must default memory_routing.enabled=false (got ${features.memory_routing.enabled})`,
+      `Fresh 4.0 install must ship memory_routing.enabled=true with the vendored organ (got ${features.memory_routing.enabled})`,
+    );
+  }
+  if (features.memory_routing.provider !== "repertoire") {
+    throw new Error(
+      `Fresh install memory_routing.provider must be repertoire (got ${features.memory_routing.provider})`,
     );
   }
   if (!features.inference_governance) {
@@ -59,6 +64,33 @@ function assertFreshInstallDefaults(tmpRoot, version) {
   if (features.inference_governance.enabled !== false) {
     throw new Error("Fresh install must default inference_governance.enabled=false");
   }
+  const organHoisted = path.join(tmpRoot, "node_modules", "@0xray", "repertoire", "package.json");
+  const organNested = path.join(
+    tmpRoot,
+    "node_modules",
+    "0xray",
+    "node_modules",
+    "@0xray",
+    "repertoire",
+    "package.json",
+  );
+  const organVendor = path.join(
+    tmpRoot,
+    "node_modules",
+    "0xray",
+    "vendor",
+    "@0xray",
+    "repertoire",
+    "package.json",
+  );
+  const organPkg = [organNested, organHoisted, organVendor].find((p) => fs.existsSync(p));
+  if (!organPkg) {
+    throw new Error("vendored @0xray/repertoire missing from fresh tarball install");
+  }
+  const organ = JSON.parse(fs.readFileSync(organPkg, "utf-8"));
+  if (organ.version !== "0.2.0") {
+    throw new Error(`expected organ 0.2.0, got ${organ.version}`);
+  }
   console.log("  ✅ .xray/features.json fresh-install defaults (opt-in off)");
   return { consumerFeaturesPath, features };
 }
@@ -114,6 +146,27 @@ function runUpgradeMergeSmoke(tmpRoot, nmRoot, version) {
   if (shippedMarker && !merged[shippedMarker]) {
     throw new Error(`Upgrade merge missing shipped template key: ${shippedMarker}`);
   }
+  fs.writeFileSync(
+    consumerFeaturesPath,
+    `${JSON.stringify(
+      {
+        version: "3.5.5",
+        memory_routing: { enabled: false, provider: "repertoire" },
+      },
+      null,
+      2,
+    )}\n`,
+  );
+  deployXrayConfig(tmpRoot, nmRoot, () => {});
+  const optedOut = JSON.parse(fs.readFileSync(consumerFeaturesPath, "utf-8"));
+  if (optedOut.memory_routing?.enabled !== false) {
+    throw new Error(
+      `Upgrade merge must keep explicit memory_routing opt-out (got ${optedOut.memory_routing?.enabled})`,
+    );
+  }
+  if (optedOut.memory_routing?.provider !== "repertoire") {
+    throw new Error("Upgrade merge dropped memory_routing.provider on opt-out");
+  }
 
   console.log("  ✅ upgrade merge preserves opt-ins + bumps features.version");
 }
@@ -155,6 +208,8 @@ function main() {
     const requiredFiles = [
       "scripts/node/install-bridges.cjs",
       "scripts/node/postinstall.cjs",
+      "scripts/foundry/mint-suit.cjs",
+      "scripts/foundry/hooks.mjs",
       "package.json",
       "xray/features.json",
       "xray/features.schema.json",

package/scripts/node/enforce-version-compliance.sh

@@ -1,21 +1,6 @@
 #!/bin/bash
-
-# Version Compliance Enforcement Shell Wrapper
-# 
-# This shell script wraps the TypeScript version compliance enforcement.
-# It provides the CLI interface expected by CI/CD pipelines.
-#
-# Usage: ./scripts/node/enforce-version-compliance.sh
-#
-# @since 2026-01-15
-
-set -e
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-PROJECT_ROOT="$(dirname "$SCRIPT_DIR")"
-
-cd "$PROJECT_ROOT"
-
-# Use npx tsx to run TypeScript files directly
-# tsx is a zero-config TypeScript execution engine
-npx tsx "$SCRIPT_DIR/enforce-version-compliance.ts"
+# Foundry mill: docs + version SSOT. Not UVM.
+set -euo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+cd "$ROOT"
+exec node scripts/foundry/validate-release-docs.mjs "$@"

package/scripts/node/enforce-version-compliance.ts

@@ -1,116 +1,16 @@
 #!/usr/bin/env node
 /**
+ * Foundry mill wrapper. Version SSOT is package.json (reconcile-version).
+ * Prose is verified by validate-release-docs — not rewritten here.
  */
-
-import path from 'path';
-import { fileURLToPath } from 'url';
-
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = path.dirname(__filename);
-
-// Colors for terminal output
-const RED = '\x1b[0;31m';
-const GREEN = '\x1b[0;32m';
-const YELLOW = '\x1b[1;33m';
-const BLUE = '\x1b[0;34m';
-const NC = '\x1b[0m';
-
-async function main() {
-  console.log(`${BLUE}🔍 ENFORCER AGENT: Version Compliance Check${NC}`);
-  console.log(`${BLUE}==============================================${NC}`);
-  console.log('');
-
-  try {
-    // Import and run the processor - use file URL for ESM compatibility
-    // __dirname is the script's directory (scripts/node/), go up 2 levels to project root
-    const scriptDir = path.join(__dirname);
-    const projectRoot = path.join(scriptDir, '..', '..');
-    const processorPath = path.join(projectRoot, 'dist', 'processors', 'version-compliance-processor.js');
-    const { VersionComplianceProcessor } = await import(`file://${processorPath}`);
-    const processor = new VersionComplianceProcessor(projectRoot);
-    
-    const result = await processor.validateVersionCompliance();
-
-    // Display results
-    console.log(`${BLUE}📊 Version Audit:${NC}`);
-    console.log(`   NPM Published:    ${BLUE}${result.npmVersion}${NC}`);
-    console.log(`   package.json:     ${BLUE}${result.pkgVersion}${NC}`);
-    console.log(`   Version Manager:  ${BLUE}${result.uvmVersion}${NC}`);
-    console.log('');
-
-    // Rule 1: UVM 1 ahead of NPM
-    console.log('1️⃣  Checking: Version Manager 1 Ahead Rule');
-    if (result.npmVersion !== 'NOT_PUBLISHED' && result.npmVersion !== 'ERROR') {
-      const expectedUvm = incrementPatch(result.npmVersion);
-      if (result.uvmVersion === expectedUvm) {
-        console.log(`   ${GREEN}✅ PASS:${NC} Version manager is 1 ahead (${result.uvmVersion} > ${result.npmVersion})`);
-      } else {
-        console.log(`   ${RED}❌ VIOLATION:${NC} Version manager not 1 ahead of npm`);
-        console.log(`      NPM:      ${result.npmVersion}`);
-        console.log(`      UVM:      ${result.uvmVersion}`);
-        console.log(`      Expected: ${expectedUvm}`);
-      }
-    } else {
-      console.log(`   ${YELLOW}⚠️  NPM version not available (first publish)${NC}`);
-    }
-    console.log('');
-
-    // Rule 2: package.json sync
-    console.log('2️⃣  Checking: package.json Synchronization');
-    if (result.pkgVersion === result.uvmVersion) {
-      console.log(`   ${GREEN}✅ PASS:${NC} package.json matches UVM (${result.pkgVersion})`);
-    } else {
-      console.log(`   ${YELLOW}⚠️  WARNING:${NC} package.json version mismatch`);
-      console.log(`      package.json: ${result.pkgVersion}`);
-      console.log(`      UVM:          ${result.uvmVersion}`);
-      console.log(`      ℹ️  Run: npm version [patch|minor|major] to sync`);
-    }
-    console.log('');
-
-    // Display errors and warnings summary
-    console.log(`${BLUE}==============================================${NC}`);
-    
-    if (result.errors.length > 0) {
-      console.log(`${RED}❌ COMPLIANCE CHECK FAILED${NC}`);
-      console.log(`   Errors:   ${result.errors.length}`);
-      console.log(`   Warnings: ${result.warnings.length}`);
-      console.log('');
-      console.log(`${RED}🚫 BLOCKED: Cannot proceed with commit/publish${NC}`);
-      console.log('   Violations:');
-      result.errors.forEach(e => console.log(`     ${RED}•${NC} ${e}`));
-      
-      if (result.fixes && result.fixes.length > 0) {
-        console.log('');
-        console.log(`${YELLOW}🔧 FIXES:${NC}`);
-        result.fixes.forEach(f => {
-          console.log(`     ${YELLOW}•${NC} ${f.description}`);
-          console.log(`       Command: ${f.command}`);
-        });
-      }
-      
-      process.exit(1);
-    } else {
-      console.log(`${GREEN}✅ COMPLIANCE CHECK PASSED${NC}`);
-      if (result.warnings.length > 0) {
-        console.log(`   Warnings: ${result.warnings.length} (non-blocking)`);
-        result.warnings.forEach(w => console.log(`     ${YELLOW}⚠️${NC} ${w}`));
-      }
-      console.log('');
-      console.log(`${GREEN}🚀 APPROVED: Ready for commit/publish${NC}`);
-      process.exit(0);
-    }
-
-  } catch (error) {
-    console.error(`${RED}❌ Fatal error running version compliance:${NC}`, error);
-    process.exit(1);
-  }
-}
-
-// Helper to increment patch version
-function incrementPatch(version: string): string {
-  const parts = version.split('.').map(Number);
-  parts[2] = parts[2] + 1;
-  return parts.join('.');
-}
-
-main();
+import { spawnSync } from "node:child_process";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
+const result = spawnSync(
+  process.execPath,
+  [path.join(root, "scripts/foundry/validate-release-docs.mjs"), ...process.argv.slice(2)],
+  { cwd: root, stdio: "inherit" },
+);
+process.exit(result.status === null ? 1 : result.status);

package/scripts/node/foundry-shim.mjs

@@ -0,0 +1,19 @@
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import path from "node:path";
+
+/** Run the mill script when this wrapper is the CLI entry. */
+export function millMain(importMetaUrl, millBasename) {
+  const here = fileURLToPath(importMetaUrl);
+  if (!process.argv[1] || path.resolve(process.argv[1]) !== here) {
+    return;
+  }
+  const mill = path.resolve(path.dirname(here), "../foundry", millBasename);
+  const root = process.env.FOUNDRY_ROOT || process.cwd();
+  const result = spawnSync(process.execPath, [mill, ...process.argv.slice(2)], {
+    stdio: "inherit",
+    cwd: root,
+    env: { ...process.env, FOUNDRY_ROOT: root },
+  });
+  process.exit(result.status === null ? 1 : result.status);
+}

package/scripts/node/github-actions-monitor.cjs

@@ -1,23 +1,18 @@
 #!/usr/bin/env node
-
 /**
- * GitHub Actions Monitor
- * 
- * For consumer projects without real GitHub Actions, this returns success.
- * In production, this would check actual GitHub Actions workflow status.
- * 
- * Usage: node scripts/node/github-actions-monitor.cjs --commit <sha>
+ * Shim onto the mill CI monitor. Not PPE.
+ *
+ *   node scripts/node/github-actions-monitor.cjs [--commit SHA] [--report]
  */
 
-const args = process.argv.slice(2);
-const commitIndex = args.indexOf('--commit');
-const commitSha = commitIndex >= 0 ? args[commitIndex + 1] : 'unknown';
-
-console.log(`Checking GitHub Actions status for commit: ${commitSha}`);
-
-// For consumer projects without GitHub Actions, always return success
-// Real CI environments should override this with actual GitHub API calls
-console.log('SUCCESS: All workflows passed');
-console.log('No failed jobs');
+const { spawnSync } = require("child_process");
+const path = require("path");
 
-process.exit(0);
+const mill = path.join(__dirname, "../foundry/ci-monitor.mjs");
+const root = process.env.FOUNDRY_ROOT || process.cwd();
+const result = spawnSync(process.execPath, [mill, ...process.argv.slice(2)], {
+  stdio: "inherit",
+  cwd: root,
+  env: { ...process.env, FOUNDRY_ROOT: root },
+});
+process.exit(result.status === null ? 1 : result.status);

package/scripts/node/postinstall.cjs

@@ -8,6 +8,15 @@ const {
   isConsumerInstall,
 } = require("./install-bridges.cjs");
 const { applyConsumerGitignore } = require("./consumer-gitignore.cjs");
+const {
+  overlayConsumerTree,
+  mintConsumerFromSsot,
+  mintConsumerSuit,
+  listConsumerSkillNames,
+  listConsumerAgentFiles,
+  loadFoundryParams,
+  readPackageIdentity,
+} = require("../foundry/mint-suit.cjs");
 
 function structuredLog(component, action, status, details) {
   const ts = new Date().toISOString();
@@ -17,6 +26,16 @@ function structuredLog(component, action, status, details) {
 
 const XRAY_MANAGED_AGENTS_MARKER = "<!-- 0xray-managed -->";
 
+function fillConsumerPlaceholders(content, consumer) {
+  const name = consumer.name || "this project";
+  const versionParen = consumer.version ? ` (${consumer.version})` : "";
+  return content
+    .split("{{CONSUMER_NAME}}")
+    .join(name)
+    .split("{{CONSUMER_VERSION_PAREN}}")
+    .join(versionParen);
+}
+
 function deployManagedAgents(packageRoot, targetDir, log) {
   const agentsConsumer = path.join(packageRoot, "AGENTS-consumer.md");
   const agentsDest = path.join(targetDir, "AGENTS.md");
@@ -26,6 +45,8 @@ function deployManagedAgents(packageRoot, targetDir, log) {
     fs.readFileSync(agentsDest, "utf8").includes(XRAY_MANAGED_AGENTS_MARKER);
   if (shouldDeployAgents) {
     let content = fs.readFileSync(agentsConsumer, "utf8");
+    const consumer = readPackageIdentity(path.join(targetDir, "package.json"));
+    content = fillConsumerPlaceholders(content, consumer);
     if (!content.includes(XRAY_MANAGED_AGENTS_MARKER)) {
       content = `${content.trimEnd()}\n\n${XRAY_MANAGED_AGENTS_MARKER}\n`;
     }
@@ -65,6 +86,9 @@ function runPostinstall(packageRoot, targetDir, log) {
       packageRoot: resolvedPackage,
       log: logFn,
     });
+    if (consumer) {
+      mintConsumerSuit(resolvedPackage, resolvedTarget, logFn);
+    }
   } catch (e) {
     logFn("postinstall", "Bridge install failed", "error", { error: e.message });
     throw e;
@@ -81,7 +105,18 @@ function runPostinstall(packageRoot, targetDir, log) {
   }
 }
 
-module.exports = { runPostinstall };
+module.exports = {
+  runPostinstall,
+  mintConsumerFromSsot,
+  mintConsumerSuit,
+  overlayConsumerTree,
+  listConsumerSkillNames,
+  listConsumerAgentFiles,
+  loadFoundryParams,
+  fillConsumerPlaceholders,
+  readPackageIdentity,
+  deployManagedAgents,
+};
 
 if (require.main === module) {
   const packageRoot = path.join(__dirname, "..", "..");