0xray 4.0.11 → 4.0.13

package/.opencode/commands/dependency-audit.md

@@ -1,184 +0,0 @@
-# Dependency Audit Command
-
-## Description
-
-Comprehensive dependency analysis and security audit for all project dependencies across npm, pip, cargo, and other package managers.
-
-## Usage
-
-/dependency-audit [options]
-
-## Options
-
-- `--managers=<list>`: Package managers to audit (npm,pip,cargo,go,maven)
-- `--severity=<level>`: Minimum severity to report (low,medium,high,critical)
-- `--fix`: Auto-fix issues where possible
-- `--update`: Update dependencies to latest compatible versions
-- `--report=<format>`: Output format (json, html, markdown, sarif)
-
-## Implementation
-
-### 1. Dependency Discovery
-
-- **Package Managers**: Auto-detect and scan all used managers
-- **Lock Files**: Parse package-lock.json, requirements.txt, Cargo.lock, etc.
-- **Transitive Dependencies**: Analyze entire dependency tree
-- **Dev Dependencies**: Separate analysis for dev vs production deps
-
-### 2. Security Vulnerability Scanning
-
-- **CVE Database**: Check against NIST NVD
-- **Advisory Sources**: NPM, PyPI, RustSec, GitHub Advisories
-- **Custom Rules**: Project-specific security policies
-- **License Compliance**: Open source license validation
-
-### 3. Version Analysis
-
-- **Outdated Packages**: Identify packages with available updates
-- **Compatibility**: Check version compatibility across dependencies
-- **Breaking Changes**: Identify potentially breaking updates
-- **Maintenance Status**: Check package maintenance activity
-
-### 4. Performance Impact
-
-- **Bundle Size**: Impact of dependencies on bundle size
-- **Load Time**: Network loading performance
-- **Tree Shaking**: Dead code elimination effectiveness
-- **Caching**: Browser caching efficiency
-
-### 5. Quality Metrics
-
-- **Maintenance**: Commit frequency, issue response time
-- **Popularity**: Download counts, GitHub stars
-- **Security**: Security audit history
-- **Compatibility**: Platform and Node.js version support
-
-## Output Formats
-
-### JSON Report
-
-```json
-{
-  "timestamp": "2024-01-09T12:00:00Z",
-  "summary": {
-    "totalDeps": 245,
-    "vulnerable": 3,
-    "outdated": 12,
-    "unmaintained": 1
-  },
-  "vulnerabilities": [
-    {
-      "package": "lodash",
-      "version": "3.1.0",
-      "severity": "high",
-      "cve": "CVE-2021-23337",
-      "description": "Command injection vulnerability"
-    }
-  ],
-  "recommendations": [...]
-}
-```
-
-### SARIF Report
-
-Security-focused format for CI/CD integration:
-
-```json
-{
-  "version": "3.1.0",
-  "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
-  "runs": [
-    {
-      "tool": {
-        "driver": {
-          "name": "Dependency Audit",
-          "version": "3.1.0"
-        }
-      },
-      "results": [...]
-    }
-  ]
-}
-```
-
-### HTML Dashboard
-
-Interactive dashboard with:
-
-- Vulnerability timeline
-- Dependency tree visualization
-- Risk assessment charts
-- Remediation recommendations
-
-## Remediation Actions
-
-### Automatic Fixes
-
-- **Patch Updates**: Apply security patches
-- **Version Pinning**: Lock to secure versions
-- **Dependency Removal**: Remove unused dependencies
-- **Alternative Packages**: Suggest secure alternatives
-
-### Manual Actions Required
-
-- **Code Changes**: Update API usage for breaking changes
-- **Configuration Updates**: Modify config for new versions
-- **Testing**: Validate functionality after updates
-- **Documentation**: Update docs for API changes
-
-## Integration
-
-### CI/CD Pipeline
-
-```yaml
-- name: Dependency Audit
-  run: /dependency-audit --severity=medium --report=sarif
-  continue-on-error: false
-```
-
-### Pre-commit Hook
-
-```bash
-#!/bin/bash
-/dependency-audit --managers=npm --severity=high
-if [ $? -ne 0 ]; then
-  echo "Dependency audit failed. Fix vulnerabilities before committing."
-  exit 1
-fi
-```
-
-### Scheduled Scans
-
-- Daily security scans
-- Weekly dependency updates
-- Monthly comprehensive audits
-
-## Configuration
-
-Project-specific settings in `.dependency-audit.json`:
-
-```json
-{
-  "managers": {
-    "npm": {
-      "ignore": ["devDependencies"],
-      "allowList": ["lodash@4.17.21"]
-    },
-    "pip": {
-      "index-url": "https://pypi.org/simple/"
-    }
-  },
-  "policies": {
-    "maxAge": "1y",
-    "minDownloads": 1000,
-    "requireSbom": true
-  }
-}
-```
-
-## Dependencies
-
-- Node.js 18+
-- Package managers (npm, yarn, pnpm, pip, cargo, etc.)
-- Security databases (NVD, OSV)
-- Vulnerability scanners (npm audit, safety, cargo audit)

package/.opencode/commands/enforcer-daily-scan.md

@@ -1,137 +0,0 @@
----
-name: enforcer-daily-scan
-description: Automated daily framework compliance monitoring with threshold validation
----
-
-#!/bin/bash
-
-# Daily compliance scan for xray
-
-echo "🔍 xray - Daily Compliance Scan"
-echo "========================================================="
-
-# Initialize compliance status
-
-COMPLIANT=true
-ISSUES=()
-
-# 1. Bundle Size Check
-
-echo "📦 Checking bundle size..."
-if command -v npm &> /dev/null && [ -f "package.json" ]; then
-npm run build > /dev/null 2>&1
-if [ -d "dist" ]; then
-BUNDLE_SIZE=$(du -sh dist/ | cut -f1)
-        echo "Current bundle size: $BUNDLE_SIZE"
-        # Check against 2MB threshold
-        if [[ "$BUNDLE_SIZE" > "2MB" ]]; then
-ISSUES+=("Bundle size violation: $BUNDLE_SIZE > 2MB")
-COMPLIANT=false
-fi
-else
-echo "⚠️ Build directory not found"
-fi
-else
-echo "⚠️ npm not available or package.json not found"
-fi
-
-# 2. Test Coverage Validation
-
-echo ""
-echo "🧪 Checking test coverage..."
-if command -v npm &> /dev/null && npm run test:coverage > /dev/null 2>&1; then # Parse coverage from generated reports
-if [ -f "coverage/lcov.info" ]; then # Extract line coverage percentage
-COVERAGE=$(grep -o "LF:[0-9]*" coverage/lcov.info | head -1 | sed 's/LF://')
-        TOTAL=$(grep -o "LH:[0-9]_" coverage/lcov.info | head -1 | sed 's/LH://')
-if [ "$COVERAGE" -gt 0 ] 2>/dev/null; then
-PERCENTAGE=$((TOTAL _ 100 / COVERAGE))
-echo "Test coverage: $PERCENTAGE%"
-            if [ "$PERCENTAGE" -lt 85 ]; then
-ISSUES+=("Test coverage violation: $PERCENTAGE% < 85%")
-COMPLIANT=false
-fi
-fi
-else
-echo "⚠️ Coverage report not found"
-fi
-else
-echo "⚠️ Test coverage command failed"
-fi
-
-# 3. Code Duplication Analysis
-
-echo ""
-echo "🔄 Checking code duplication..."
-if command -v jscpd &> /dev/null; then
-DUPLICATION=$(jscpd --reporters console --format "javascript,typescript" . 2>/dev/null | grep -o "[0-9]*\.[0-9]*%" | head -1)
-    if [[ -n "$DUPLICATION" ]]; then
-echo "Code duplication: ${DUPLICATION}%"
-        # Remove % sign for comparison
-        DUP_NUM=$(echo $DUPLICATION | sed 's/%//')
-        if (( $(echo "$DUP_NUM > 5" | bc -l 2>/dev/null) )); then
-ISSUES+=("Code duplication violation: ${DUPLICATION}% > 5%")
-COMPLIANT=false
-fi
-fi
-else
-echo "⚠️ jscpd not available for duplication analysis"
-fi
-
-# 4. Syntax Error Prevention
-
-echo ""
-echo "🔧 Checking syntax errors..."
-if command -v npm &> /dev/null && [ -f "package.json" ]; then
-if npm run lint > /dev/null 2>&1; then
-echo "✅ No syntax/linting errors detected"
-else
-ISSUES+=("Syntax/linting errors detected")
-COMPLIANT=false
-fi
-else
-echo "⚠️ Lint command not available"
-fi
-
-# 5. Runtime Error Rate Estimation
-
-echo ""
-echo "🚨 Estimating runtime error risk..."
-
-# Check for common error patterns
-
-ERROR*PATTERNS=$(find src -name "*.ts" -o -name "_.tsx" -o -name "_.js" -o -name "*.jsx" | xargs grep -l "console.error\|throw new\|catch.*error" 2>/dev/null | wc -l)
-TOTAL*FILES=$(find src -name "\*.ts" -o -name "*.tsx" -o -name "\_.js" -o -name "\_.jsx" | wc -l)
-
-if [ "$TOTAL_FILES" -gt 0 ]; then
-ERROR_RATIO=$((ERROR_PATTERNS * 100 / TOTAL_FILES))
-    echo "Error handling coverage: $ERROR_RATIO% of files"
-    if [ "$ERROR_RATIO" -lt 80 ]; then
-ISSUES+=("Low error handling coverage: $ERROR_RATIO% < 80%")
-COMPLIANT=false
-fi
-fi
-
-# Report Results
-
-echo ""
-echo "📊 COMPLIANCE REPORT"
-echo "==================="
-
-if [ "$COMPLIANT" = true ]; then
-echo "✅ FRAMEWORK COMPLIANT"
-echo "All thresholds met - ready for development"
-else
-echo "❌ COMPLIANCE VIOLATIONS DETECTED"
-echo ""
-echo "Issues requiring attention:"
-for issue in "${ISSUES[@]}"; do
-echo " - $issue"
-done
-echo ""
-echo "Remediation required before proceeding"
-exit 1
-fi
-
-echo ""
-echo "🎯 xray Status: OPERATIONAL"
-echo "Next scheduled scan: Tomorrow at 09:00"

package/.opencode/commands/framework-compliance-audit.md

@@ -1,205 +0,0 @@
-#!/bin/bash
-
-# xray - Full Framework Compliance Audit
-
-# Comprehensive validation of all framework components and thresholds
-
-echo "📋 xray - Full Compliance Audit"
-echo "================================================================"
-
-# Initialize audit results
-
-AUDIT_PASSED=true
-CRITICAL_ISSUES=()
-WARNINGS=()
-COMPLIANCE_SCORES=()
-
-# 1. Configuration Integrity Check
-
-echo "⚙️ Checking framework configuration integrity..."
-if [ -f ".opencode/enforcer-config.json" ] && [ -f "opencode.json" ]; then
-echo "✅ Framework configurations present"
-COMPLIANCE_SCORES+=("configuration_integrity:PASS")
-else
-echo "❌ Framework configurations missing"
-CRITICAL_ISSUES+=("Framework configuration files missing")
-AUDIT_PASSED=false
-COMPLIANCE_SCORES+=("configuration_integrity:FAIL")
-fi
-
-# 2. Agent Configuration Audit
-
-echo ""
-echo "🤖 Auditing agent configurations..."
-AGENTS=("enforcer" "architect" "orchestrator" "bug-triage-specialist" "code-reviewer" "security-auditor" "refactorer" "testing-lead")
-AGENT_SCORE=0
-for agent in "${AGENTS[@]}"; do
-    if [ -f ".opencode/agents/${agent}.md" ]; then
-AGENT_SCORE=$((AGENT_SCORE + 1))
-    else
-        CRITICAL_ISSUES+=("Agent configuration missing: ${agent}")
-        AUDIT_PASSED=false
-    fi
-done
-AGENT_PERCENTAGE=$((AGENT_SCORE \* 100 / 8))
-echo "Agent configurations: ${AGENT_SCORE}/${#AGENTS[@]} (${AGENT_PERCENTAGE}%)"
-COMPLIANCE_SCORES+=("agent_configurations:${AGENT_PERCENTAGE}%")
-
-# 3. Automation Hooks Validation
-
-echo ""
-echo "🔗 Validating automation hooks..."
-HOOKS=("pre-commit-introspection" "auto-format" "security-scan" "enforcer-daily-scan")
-HOOK_SCORE=0
-for hook in "${HOOKS[@]}"; do
-    if [ -f ".opencode/commands/${hook}.md" ]; then
-HOOK_SCORE=$((HOOK_SCORE + 1))
-    else
-        CRITICAL_ISSUES+=("Automation hook missing: ${hook}")
-        AUDIT_PASSED=false
-    fi
-done
-HOOK_PERCENTAGE=$((HOOK_SCORE \* 100 / 4))
-echo "Automation hooks: ${HOOK_SCORE}/${#HOOKS[@]} (${HOOK_PERCENTAGE}%)"
-COMPLIANCE_SCORES+=("automation_hooks:${HOOK_PERCENTAGE}%")
-
-# 4. MCP Knowledge Skills Audit
-
-echo ""
-echo "🧠 Auditing MCP knowledge skills..."
-MCPS=("project-analysis" "testing-strategy" "architecture-patterns" "performance-optimization" "git-workflow" "api-design")
-MCP_SCORE=0
-for mcp in "${MCPS[@]}"; do
-    if [ -f ".opencode/mcps/${mcp}.mcp.json" ]; then
-MCP_SCORE=$((MCP_SCORE + 1))
-    else
-        WARNINGS+=("MCP knowledge skill missing: ${mcp}")
-    fi
-done
-MCP_PERCENTAGE=$((MCP_SCORE \* 100 / 6))
-echo "MCP knowledge skills: ${MCP_SCORE}/${#MCPS[@]} (${MCP_PERCENTAGE}%)"
-COMPLIANCE_SCORES+=("mcp_knowledge_skills:${MCP_PERCENTAGE}%")
-
-# 5. Workflow Templates Check
-
-echo ""
-echo "📋 Checking workflow templates..."
-if [ -f ".opencode/workflows/post-deployment-audit.yml" ]; then
-echo "✅ Workflow templates present"
-COMPLIANCE_SCORES+=("workflow_templates:PASS")
-else
-WARNINGS+=("Workflow templates missing")
-COMPLIANCE_SCORES+=("workflow_templates:WARN")
-fi
-
-# 6. Session Initialization Validation
-
-echo ""
-echo "🚀 Validating session initialization..."
-if [ -f ".opencode/init.sh" ]; then
-echo "✅ Session initialization script present"
-COMPLIANCE_SCORES+=("session_initialization:PASS")
-else
-CRITICAL_ISSUES+=("Session initialization script missing")
-AUDIT_PASSED=false
-COMPLIANCE_SCORES+=("session_initialization:FAIL")
-fi
-
-# 7. Codex Compliance Verification
-
-echo ""
-echo "📜 Verifying Codex compliance..."
-CODEX_TERMS=(1 2 3 4 5 6 7 8 9 10 15 24 29 32 38 42 43)
-echo "Codex terms validated: ${#CODEX_TERMS[@]} terms"
-COMPLIANCE_SCORES+=("codex_compliance:${#CODEX_TERMS[@]}")
-
-# 8. Threshold Compliance Assessment
-
-echo ""
-echo "📊 Assessing threshold compliance..."
-
-# Bundle size check
-
-if command -v npm &> /dev/null && [ -f "package.json" ]; then
-npm run build > /dev/null 2>&1
-if [ -d "dist" ]; then
-BUNDLE_SIZE=$(du -sh dist/ | cut -f1 | sed 's/M.*//')
-        if [ "$BUNDLE_SIZE" -le 2 ]; then
-echo "✅ Bundle size within threshold: ${BUNDLE_SIZE}MB ≤ 2MB"
-COMPLIANCE_SCORES+=("bundle_size:PASS")
-else
-echo "❌ Bundle size violation: ${BUNDLE_SIZE}MB > 2MB"
-CRITICAL_ISSUES+=("Bundle size exceeds threshold")
-AUDIT_PASSED=false
-COMPLIANCE_SCORES+=("bundle_size:FAIL")
-fi
-else
-WARNINGS+=("Build directory not found for bundle analysis")
-fi
-else
-WARNINGS+=("Bundle size check unavailable")
-fi
-
-# 9. Runtime Error Prevention Metrics
-
-echo ""
-echo "🚨 Calculating runtime error prevention metrics..."
-if [ -d "src" ]; then
-TOTAL*TS_FILES=$(find src -name "*.ts" -o -name "_.tsx" | wc -l)
-ERROR_HANDLING_FILES=$(grep -r "catch\|throw\|try" src --include="_.ts" --include="\_.tsx" 2>/dev/null | wc -l)
-
-    if [ "$TOTAL_TS_FILES" -gt 0 ]; then
-        PREVENTION_RATE=$((ERROR_HANDLING_FILES * 100 / TOTAL_TS_FILES))
-        echo "Error handling coverage: ${PREVENTION_RATE}% of files"
-        if [ "$PREVENTION_RATE" -ge 80 ]; then
-            echo "✅ Runtime error prevention: TARGET MET (≥80%)"
-            COMPLIANCE_SCORES+=("error_prevention:PASS")
-        else
-            echo "⚠️ Runtime error prevention: BELOW TARGET (<80%)"
-            WARNINGS+=("Runtime error prevention below 80% target")
-            COMPLIANCE_SCORES+=("error_prevention:WARN")
-        fi
-    fi
-
-fi
-
-# Final Audit Report
-
-echo ""
-echo "📋 FRAMEWORK COMPLIANCE AUDIT REPORT"
-echo "===================================="
-
-if [ "$AUDIT_PASSED" = true ]; then
-echo "✅ FRAMEWORK COMPLIANCE AUDIT PASSED"
-echo "xray is fully operational"
-else
-echo "❌ FRAMEWORK COMPLIANCE AUDIT FAILED"
-echo ""
-echo "Critical Issues Requiring Resolution:"
-for issue in "${CRITICAL_ISSUES[@]}"; do
-echo " - 🔴 $issue"
-done
-echo ""
-echo "Framework remediation required"
-exit 1
-fi
-
-if [ ${#WARNINGS[@]} -gt 0 ]; then
-    echo ""
-    echo "⚠️ Warnings (Non-critical):"
-    for warning in "${WARNINGS[@]}"; do
-echo " - $warning"
-done
-fi
-
-echo ""
-echo "📊 Compliance Scores:"
-for score in "${COMPLIANCE_SCORES[@]}"; do
-echo " - $score"
-done
-
-echo ""
-echo "🎯 xray"
-echo "Status: FULLY COMPLIANT & OPERATIONAL"
-echo "Codex Terms Enforced: [1,2,3,4,5,6,7,8,9,10,15,24,29,32,38,42,43]"
-echo "Runtime Error Prevention: 90% Target Active"

package/.opencode/commands/interactive-validator.md

@@ -1,75 +0,0 @@
-#!/bin/bash
-
-# xray - Interactive Session Validator
-
-# Real-time agent cross-checking during coding sessions
-
-echo "🔍 xray - Interactive Session Validation"
-echo "=================================================================="
-
-# Check if this is an interactive coding session
-
-if [ -n "$GROK_SESSION" ]; then
-echo "✅ Interactive AI coding session detected"
-else
-echo "ℹ️ Standard validation mode"
-fi
-
-# Determine validation scope based on recent changes
-
-if git diff --quiet && git diff --staged --quiet; then
-echo "📝 No uncommitted changes detected"
-VALIDATION_SCOPE="baseline"
-else
-echo "📝 Uncommitted changes detected - running targeted validation"
-VALIDATION_SCOPE="changes"
-fi
-
-echo ""
-echo "🎯 Validation Scope: $VALIDATION_SCOPE"
-echo ""
-
-# Invoke relevant agents based on coding activity
-
-case $VALIDATION_SCOPE in
-"changes")
-echo "🤖 Invoking Code Reviewer for change validation..." # Simulate Code Reviewer agent cross-check
-echo " 📋 Code quality assessment: Checking patterns and best practices"
-echo " 🔒 Security validation: Scanning for vulnerabilities"
-echo " ✅ Code Reviewer: Changes comply with standards"
-
-        echo ""
-        echo "🏗️ Invoking Architect for structural validation..."
-        # Simulate Architect agent cross-check
-        echo "   🏛️ Architecture review: Assessing design patterns"
-        echo "   🔗 Dependency analysis: Checking for circular imports"
-        echo "   ✅ Architect: Structure maintains scalability"
-
-        echo ""
-        echo "🧪 Invoking Test Architect for coverage validation..."
-        # Simulate Test Architect agent cross-check
-        echo "   📊 Coverage analysis: Evaluating test requirements"
-        echo "   🎯 Behavioral testing: Assessing real scenario coverage"
-        echo "   ✅ Test Architect: Testing strategy adequate"
-        ;;
-
-    "baseline")
-        echo "📊 Running baseline compliance check..."
-        # Run standard compliance validation
-        tail -n +6 .opencode/commands/enforcer-daily-scan.md | bash > /dev/null 2>&1
-        echo "✅ Baseline compliance verified"
-        ;;
-
-esac
-
-echo ""
-echo "🛡️ Invoking Security Auditor for ongoing validation..."
-echo " 🔐 Security scan: Monitoring for vulnerabilities"
-echo " 🛡️ Threat assessment: Evaluating risk patterns"
-echo " ✅ Security Auditor: No critical issues detected"
-
-echo ""
-echo "🎭 Session Status: AGENTS ACTIVE & MONITORING"
-echo "💡 Agents will cross-check changes as you code"
-echo ""
-echo "🔄 Ready for next coding instruction..."

package/.opencode/commands/job-summary-logger.md

@@ -1,68 +0,0 @@
-#!/bin/bash
-
-# xray - AI Summary Auto-Logger
-
-# Automatically captures and logs whatever AI outputs as final summary
-
-# 🚨 CRITICAL RULE: REFACTORING LOG IS APPEND-ONLY 🚨
-
-#
-
-# The REFACTORING_LOG.md file serves as an immutable audit trail of the project's evolution.
-
-# This file must NEVER be edited or modified after creation - only NEW entries may be appended.
-
-#
-
-# ❌ NEVER edit existing entries
-
-# ❌ NEVER delete entries
-
-# ❌ NEVER reorder entries
-
-# ❌ NEVER modify timestamps or content
-
-#
-
-# ✅ ONLY append new entries to the end
-
-# ✅ ONLY add new information, never change old information
-
-# ✅ ONLY use this automated logging system for consistency
-
-#
-
-# This ensures the refactoring log remains a reliable, immutable record of all changes.
-
-# If you need to correct information, append a new entry documenting the correction.
-
-#
-
-# 🚨 VIOLATION OF THIS RULE WILL BREAK THE PROJECT'S HISTORICAL RECORD 🚨
-
-echo "📝 xray - AI Summary Auto-Logger"
-echo "==============================="
-
-# This script captures whatever content is piped to it and logs it automatically
-
-# No special signals needed - just pipe any AI summary output to this command
-
-# Read summary from stdin (piped from AI output)
-
-if [ ! -t 0 ]; then
-SUMMARY_CONTENT=$(cat)
-    if [ -n "$SUMMARY_CONTENT" ]; then
-echo "✅ Captured AI summary output - logging to REFACTORING_LOG.md..."
-export XRAY_SUMMARY_CONTENT="$SUMMARY_CONTENT"
-tail -n +6 .opencode/commands/summary-logger.md | bash 2>/dev/null || true
-echo "✅ AI summary automatically logged!"
-else
-echo "❌ No summary content received"
-exit 1
-fi
-else
-echo "❌ No piped input detected."
-echo "Usage: echo 'AI summary content' | bash .opencode/commands/job-summary-logger.md"
-echo "This will automatically log whatever AI outputs to REFACTORING_LOG.md"
-exit 1
-fi

package/.opencode/commands/lint.md

@@ -1,11 +0,0 @@
-# Lint Command
-
-## Description
-
-Run linting checks on the codebase.
-
-## Steps
-
-1. Execute ESLint
-2. Check TypeScript compilation
-3. Report findings