0xray 4.0.13 → 4.0.15

package/dist/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Xray Framework Team
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/README.md

@@ -0,0 +1,234 @@
+# xray — exo for coding agents
+
+**4.0** — a suit that survives the context window
+
+![0xRay v4 exo — CONSTITUTION ON](docs-site/static/img/exo-skeleton-v4.jpg)
+
+Not a catalog of agents. The product is the **skeleton you wear**.
+
+## Your AI Power Suit
+
+**Your AI Power ⚡️ Suit 🦾** — an exoskeleton that blocks AI slop from becoming real damage.
+
+- **Bone** — three-subsystem OS: Inference · External Governance (Dynamo / Codex) · Autonomous Engine (thinDispatch)
+- **Always on** — Codex 11 / 29 / 69, destructive shell, no new MCP/skill/handler surface
+- **Temperament** — `frontier` | `guided` | `strict` | `auto` — how loud the engine is, not whether governance exists
+- **Wear** — Grok, OpenCode, Hermes, OpenClaw, plus Cursor project hooks. One SSOT gate
+- **Muscle** — Repertoire: auto-enables when the module resolves; session-start writes a one-line resume so the next station is not born amnesiac
+
+```bash
+npm install 0xray
+```
+
+Consumer `npm install 0xray` auto-wires four chat bridges, Cursor project hooks, and seven MCP servers. Repertoire **0.2** is the factory memory organ (vendored): seed primitives, in-process routing, extra host MCP `repertoire`. Not an eighth `xray-*` server. Opt out with `"enabled": false, "provider": "repertoire"`.
+
+## Quick Start
+
+```bash
+npm install 0xray          # postinstall: mill+inspect plant + 4 bridges + 7 MCPs + AGENTS.md + .mcp.json
+npx 0xray status          # verify install
+npx 0xray setup            # optional: symlinks, hook extras
+npx @0xray/foundry inspect --skip-live   # mill receipt (chat is not a receipt)
+```
+
+Manual per-platform install (idempotent, same result as postinstall):
+
+```bash
+npx 0xray opencode install
+npx 0xray grok install     # 7 MCPs servers + project .grok/plugins/0xray (not machine last-wins)
+npx 0xray hermes install
+npx 0xray openclaw install
+npx 0xray skill:install    # starter skills
+```
+
+## Autonomy command (default operating model)
+
+When the suit is worn, **`autonomy-command`** is ON by default: lead dev takes helm, phased todos, best subagent per task, per-suite test triage, loop until green. No keywords required. Slash: `/autonomy-command`
+
+Docs: [guides/autonomy-command](docs-site/docs/guides/autonomy-command.md) · Skill: `src/skills/autonomy-command/SKILL.md`
+
+## What's New Since 3.1
+
+| Version | Highlights |
+|---------|------------|
+| **Unreleased** | Fasten is **foundry-plant/0**: builtin plant is mill+inspect only. `foundry.json` `"plant": "@0xray/blip"` (aliases `"plant": "blip"` / `"plant": "sound"`) fastens whatever that mill declares (looker / vibe / mixer live in the mill). Nested mill `@0xray/foundry@0.1.12`. CLI shims `foundry blip\|sound` remain (0.1.11+). Shop plant first-class (`shop-extract`, `shop-witness`, `shop-pin` + `foundry.json` `shopPlant`). 0xray stays 4.0.15. |
+| **4.0.9** | Mill target: postinstall does not mill npm global prefix or `_npx` as a consumer. Isolated HOME skips machine `~/.grok`. |
+| **4.0.0** | Exo + temperament. Constitution always on; ceremony by host. Repertoire organ on (vendored 0.2). Station card survives compact/host-swap. **On npm.** [vision](docs-site/docs/architecture/v4-vision.md) · [now](docs-site/docs/architecture/v4-now.md) |
+| **3.4.1** | Unified `install-bridges.cjs` on postinstall — OpenCode, Grok, Hermes, OpenClaw in one pass. All 7 MCPs servers via `npx -y 0xray mcp <cmd>` (no `dist/` paths). Canonical `release.mjs` pipeline. |
+| **3.3.1** | Orchestrator confidence gate wired into execution planning. |
+| **3.3.0** | Pluggable **Memory Routing** (`features.json` → `memory_routing`). Repertoire is the default provider in the framework repo. |
+| **3.2.0** | Typecheck hardening (58 errors fixed), orphan cleanup (5 deleted / ~39 integrated), full pre-tool-use hook, SelfProposalEngine + AsideContext restored, Hermes E2E 44/0/0, Grok CLI E2E green. |
+| **3.1.1** | StringRay → **0xRay** rename. Marketplace files (`.mcp.json`, `.grok-plugin/plugin.json`). Postinstall ships `AGENTS.md`, `SKILLS.md`, `.gitignore.default`. ConfigLoader `mcpServers` format. |
+| **3.1.0** | Pre-publish guard tolerates missing `features.json`. |
+
+### Consolidations
+
+- **One consumer install path** — `postinstall.cjs` → `installAllBridges()` replaces scattered per-platform setup. **4.0.9:** does not mill npm global prefix or `_npx`.
+- **7-server MCP surface** — `.mcp.json` SSOT; Grok plugin and all bridges share `XRAY_MCP_SERVERS`.
+- **Dev vs consumer AGENTS** — `AGENTS.md` (framework) vs `AGENTS-consumer.md` (copied to consumer projects on install).
+- **Release pipeline** — `npm run release:patch|minor|major` → reconcile → gate → artifacts → tag → publish.
+
+### Removals / Deprecations
+
+- **StringRay / strray-ai** branding retired (3.1.1).
+- **`hermes bridge`** CLI removed — use `npx 0xray hermes install`.
+- **`.opencode/xray/` fallback** removed from auto-reflection-generator (3.1.1).
+- **~180 stale `@version` JSDoc tags** and **"xray 2.0" command doc strings** cleaned (3.2.0).
+- **`advanced-features/`** decoupled from core boot — not on the consumer install path.
+- **PostProcessor** soft-deprecated since 3.0 (`enablePostProcessor: false` default).
+
+## Three-Subsystem Architecture
+
+```
+┌─────────────────────────────────────────────────┐
+│                  Inference                       │
+│  Proposals · Reflection · Memory routing        │
+├─────────────────────────────────────────────────┤
+│           External Governance (Dynamo)           │
+│  Codex enforcement · Resonance/Isotopic · SSOT    │
+│  3 deliberation MCPs: code-review, security,     │
+│  researcher (within 7-server consumer surface)  │
+├─────────────────────────────────────────────────┤
+│          Autonomous Engine (thinDispatch)        │
+│  7-flow · AsideContext · Confidence gate        │
+└─────────────────────────────────────────────────┘
+```
+
+- **Inference** — proposals, reflection, execution planning. Optional memory-routing enrichment (v3.3).
+- **External Governance** — Dynamo Solar SSOT; CodexPolicyService; weighted PHI/TAU deliberation.
+- **Autonomous Engine** — thinDispatch 7-flow routing; orchestrator confidence gate (v3.3.1).
+
+## Consumer Install (postinstall)
+
+On `npm install 0xray` in a consumer project, postinstall automatically:
+
+1. Copies **`AGENTS-consumer.md` → `AGENTS.md`**. Does **not** write consumer-root **`SKILLS.md`**.
+2. Fastens **mill plant** (`mill` + `inspect`). Fasten is **foundry-plant/0**: builtin plant is mill+inspect only. `foundry.json` `"plant": "@0xray/blip"` (aliases `"plant": "blip"` / `"plant": "sound"`) fastens whatever that mill package declares — organs (looker, vibe, mixer) live in the mill, not an xray catalog. Nested mill `@0xray/foundry@0.1.12`. CLI shims `foundry blip|sound` still exist on foundry 0.1.11+; fasten is the new cut. Not a 45-skill / 42-agent costume dump. `foundry.json` `"costume": true` is the opt-in dump.
+3. Seeds **`.gitignore`** from `.gitignore.default` (if absent)
+4. Deploys **`.xray/`** config (`codex.json`, `features.json`, `config.json`) then overlays **their** plant
+5. Writes project **`.mcp.json`** with 7 MCPs servers (`npx -y 0xray mcp …`)
+6. Installs **4 chat bridges**: OpenCode, Grok, Hermes, OpenClaw, plus **Cursor** `.cursor/hooks.json` (PPE + wiring; mill plant, not costume)
+7. Factory shop plant (`shop-extract`, `shop-witness`, `shop-pin` from groover-hangar) may coexist when worn. Extra shops: `foundry.json` `shopPlant`. Not costume.
+8. Installs git pre-commit hook (non-blocking if not a git repo)
+
+See [llms.txt](llms.txt) for the agent map. Catalog of 45 skills lives in [SKILLS.md](SKILLS.md) — that is the exo catalog, not default consumer wear.
+
+## Seven MCP Servers (consumer)
+
+All registered via `npx -y 0xray mcp <cmd>` — no brittle `dist/` paths:
+
+| Server | Command | Role |
+|--------|---------|------|
+| `xray-governance` | `mcp governance` | Proposal governance, codex snapshot, quality gates |
+| `xray-skills` | `mcp skills` | 45 knowledge skills + skill invocation |
+| `xray-orchestrator` | `mcp orchestrator` | Complexity analysis, lead-dev plan, task delegation |
+| `xray-enforcer` | `mcp enforcer` | Codex compliance, rule validation |
+| `xray-researcher` | `mcp researcher` | Codebase exploration, implementation lookup |
+| `xray-code-review` | `mcp code-review` | Proposal quality, best practices |
+| `xray-architect-tools` | `mcp architect-tools` | System design, architecture decisions |
+
+The framework repo also ships additional internal `.server.ts` implementations for orchestration pipelines — these are not part of the 7-server consumer `.mcp.json` surface.
+
+## Agents
+
+**42 YML agent surfaces** in `src/opencode/agents/*.yml` — zero manual registration. Invoke via `@agent-name` in OpenCode.
+
+Core governance agents:
+
+| Agent | Purpose |
+|-------|---------|
+| `@enforcer` | Codex compliance & error prevention |
+| `@orchestrator` | Multi-step task coordination |
+| `@architect` | System design & technical decisions |
+| `@security-auditor` | Vulnerability detection |
+| `@code-reviewer` | Quality assessment |
+| `@refactorer` | Technical debt elimination |
+| `@testing-lead` | Testing strategy |
+| `@bug-triage-specialist` | Error investigation |
+| `@researcher` | Codebase exploration |
+
+See [AGENTS.md](AGENTS.md) and [SKILLS.md](SKILLS.md) for the full agent and skill catalog.
+
+## Memory Routing + Repertoire (v3.3+)
+
+Pluggable `memory_routing` block in `features.json` (validated by `features.schema.json`):
+
+```json
+"memory_routing": {
+  "enabled": true,
+  "provider": "repertoire",
+  "module_path": "node_modules/@0xray/repertoire/dist/provider/memory-routing-provider.js",
+  "config": {
+    "signalsPath": ".xray/state/repertoire/curated_signals.json",
+    "statePath": ".xray/state/repertoire/inference-state.json",
+    "feedbackDir": ".xray/state/repertoire/feedback"
+  }
+}
+```
+
+| Integration | What it does |
+|-------------|--------------|
+| **ExecutionPlanner** (v3.3.1) | `getTaskConfidence()` → complexity boost, trap hints, signal-aware `selectAgent()` |
+| **thinDispatch** | Nucleus `scoreAndRoute()` (`0xray/nucleus`); memory provider `resolveThinDispatch()` when routing enabled |
+| **Researcher** | `researcher-confidence.ts` appends `MEMORY_ROUTING:` block to governance output |
+| **AsideContext** (v3.2) | `buildInheritedContext` → `inheritedContext.memoryRouting` on orchestrator `spawnAside` |
+| **Feedback** | Per-task `ingestFeedback()` closes the learning loop |
+
+**External hosts** (Hermes/Grok): add `repertoire-mcp` to `.mcp.json` — see Repertoire docs.
+
+Opt out: `"memory_routing": { "enabled": false, "provider": "repertoire" }`.
+
+Docs: [memory routing](docs-site/docs/guides/memory-routing.md) · [Repertoire](docs-site/docs/guides/repertoire.md) · [features.json](docs-site/docs/guides/features-json.md) · [all features since 3.1](docs-site/docs/guides/features-since-3.1.md)
+
+## Integrations
+
+| Platform | Install | Postinstall behavior |
+|----------|---------|----------------------|
+| **OpenCode** | `npx 0xray opencode install` | Merges `opencode.json`, copies agent YML surfaces |
+| **Grok CLI / Build** | `npx 0xray grok install` | Project `.grok/plugins/0xray` (shared HOME does not clobber machine plugin), 7 MCPs servers |
+| **Hermes Agent** | `npx 0xray hermes install` | `~/.hermes/plugins/xray-hermes`, consumer root marker |
+| **OpenClaw** | `npx 0xray openclaw install` | `.xray/config/openclaw.json`, skill sync |
+| **Cursor** | postinstall (`installCursorBridge`) | Fastens `.cursor/hooks.json` (preToolUse / preCompact / afterFileEdit). Leaves an existing file alone. Not a fifth chat TUI. |
+
+## Governance & Codex
+
+- **69 terms** in `.xray/codex.json` — core, architecture, testing, performance, security, operations, governance (Codex 69: no new MCP/skill/handler surface)
+- CodexPolicyService — Governance-owned SSOT for codex loading
+- Pre-governance gate blocks non-compliant proposals
+- Active codex snapshot via `get_active_codex` MCP tool
+- frameworkLogger structured logging (never `console.*`)
+
+## Testing
+
+| Suite | Status (v4.0.1) |
+|-------|-----------------|
+| Four-floor consumer e2e | OpenCode 34/0 · Grok 63/0 · Hermes 39/0/2 · OpenClaw 96/0/1 (npm 4.0.0 pack) |
+| Consumer smoke | `npm run release:gate` — pack → clean install → 7 MCPs + 4 chat bridges + Cursor hooks + organ on |
+| Pack → tmp proof | `npm run pack:tmp-proof` — tgz install + `foundry mint --skip-live` + hangar shops + inspect (no costume dump). Playwright n/a (CLI). |
+
+```bash
+npm test
+npm run pack:tmp-proof  # pack → tmp fasten + hangar inspect
+npm run release:gate    # full release gate (before upload)
+npm run release:npm     # gate + prepare + npm publish --access public
+```
+
+## Release
+
+Product **4.0.0** is on npm. Do **not** run `release:major` to ship a 4.x fix (that becomes 5.0.0). Do **not** put a `scripts.publish` lifecycle that re-runs the gate after the registry PUT.
+
+```bash
+npm run release:gate
+npm run release:npm     # after gate is green; uses npm publish --access public
+npm run release:patch   # version bump pipeline (not for a already-bumped 4.0.0)
+```
+
+Pipeline: reconcile-version → release-gate (build + test + consumer smoke) → CHANGELOG/README/AGENTS artifacts → commit → tag → npm publish.
+
+## License
+
+MIT — see [LICENSE](LICENSE)
+
+---
+
+*xray — MCP-centric, governed, autonomous. Pure v2 three-subsystem.*

package/dist/SKILLS.md

@@ -0,0 +1,167 @@
+# 0xray Skills
+
+**4.0** — a suit that survives the context window
+
+**45 skills** in this exo catalog. Default consumer plant is **`mill` + `inspect`**, not this dump. `npm install 0xray` does **not** sync 45 skills unless `foundry.json` `"costume": true`. Factory shop plant (`shop-extract`, `shop-witness`, `shop-pin`) coexists with mill plant when a hangar wears those shops. Extra shops: `foundry.json` `shopPlant`. Fasten is **foundry-plant/0**: builtin plant is mill+inspect only. `foundry.json` `"plant": "@0xray/blip"` (aliases `"plant": "blip"` / `"plant": "sound"`) fastens whatever that mill package declares — organs (looker, vibe, mixer) live in the mill, not this catalog. Nested mill `@0xray/foundry@0.1.12`. CLI shims `foundry blip|sound` still exist on foundry 0.1.11+. Agent map: [llms.txt](llms.txt).
+
+xray ships 45 knowledge skills (`src/skills/<name>/SKILL.md`) as the **costume / self-plant catalog**. Lead-dev operating model lives in **`orchestrator`** skill + `multi_agent_orchestration.lead_dev_mode` in features.json. Skills load on demand via the **xray-skills** MCP server (`npx -y 0xray mcp skills`) or when you plant them. This file is the exo catalog — mill does **not** write it to the consumer root.
+
+---
+
+## Governance & Compliance
+
+| Skill | Agent | Description |
+|-------|-------|-------------|
+| `code-review` | @code-reviewer | Proposal quality, code analysis, best practices |
+| `security-audit` | @security-auditor | Vulnerability detection, threat modeling |
+| `security-scan` | @security-auditor | Security vulnerability scanning and assessment |
+| `enforcer` | @enforcer | Codex compliance validation and error prevention |
+| `framework-compliance-audit` | — | Framework compliance auditing and validation |
+
+## Architecture & Design
+
+| Skill | Agent | Description |
+|-------|-------|-------------|
+| `architect-tools` | @architect | System design and technical architecture tools |
+| `architecture-patterns` | — | Software architecture patterns and best practices |
+| `api-design` | — | RESTful API design and validation |
+| `database-engineer` | @database-engineer | SQL/NoSQL schema design, query optimization, migrations |
+| `state-manager` | — | Application state management and persistence |
+| `session-management` | — | User sessions and persistent state |
+
+## Engineering
+
+| Skill | Agent | Description |
+|-------|-------|-------------|
+| `backend-engineer` | @backend-engineer | REST/GraphQL APIs, microservices, auth, server architecture |
+| `frontend-engineer` | @frontend-engineer | React/Vue/Angular/Svelte, responsive design, accessibility |
+| `frontend-ui-ux-engineer` | @frontend-ui-ux-engineer | Visual design, CSS systems, accessibility, UX |
+| `mobile-developer` | @mobile-developer | iOS, Android, React Native, Flutter |
+| `devops-engineer` | @devops-engineer | CI/CD, IaC, containers, cloud deployment |
+
+## Code Quality & Analysis
+
+| Skill | Agent | Description |
+|-------|-------|-------------|
+| `code-analyzer` | @code-analyzer | Deep code analysis, metrics, pattern detection |
+| `project-analysis` | — | Project structure, complexity, health metrics |
+| `lint` | — | Code linting and static analysis |
+| `auto-format` | — | Automated formatting and style consistency |
+| `refactoring-strategies` | @refactorer | Refactoring techniques and strategies |
+
+## Testing
+
+| Skill | Agent | Description |
+|-------|-------|-------------|
+| `testing-strategy` | @testing-lead | Comprehensive testing strategies and coverage |
+| `testing-best-practices` | — | Testing best practices and QA patterns |
+
+## Performance
+
+| Skill | Agent | Description |
+|-------|-------|-------------|
+| `performance-analysis` | — | System performance analysis |
+| `performance-engineer` | @performance-engineer | Profiling, benchmarking, load testing |
+| `performance-optimization` | — | Application performance tuning |
+
+## Debugging & Monitoring
+
+| Skill | Agent | Description |
+|-------|-------|-------------|
+| `bug-triage` | @bug-triage-specialist | Bug triage, debugging, issue prioritization |
+| `log-monitor` | @log-monitor | Log analysis, pattern detection, alerting |
+| `model-health-check` | — | AI model health monitoring and diagnostics |
+
+## Orchestration & Workflow
+
+| Skill | Agent | Description |
+|-------|-------|-------------|
+| `orchestrator` | @orchestrator | Multi-agent coordination + **lead-dev mode** (codex 67–68) + lead cadence (dispatch four lines; critic Reads SEATS; ship matrix A–D in `LEAD-CADENCE.md`) |
+| `xray-orchestrator` | — | xray orchestration skill (MCP orchestrator surface) |
+| `processor-pipeline` | — | Data processing pipeline management |
+| `boot-orchestrator` | — | Framework boot orchestration |
+
+## Research & Content
+
+| Skill | Agent | Description |
+|-------|-------|-------------|
+| `researcher` | @researcher | Codebase exploration, implementation lookup |
+| `content-creator` | @content-creator | Marketing copy, technical docs, SEO content |
+| `tech-writer` | @tech-writer | API docs, READMEs, ADRs, changelogs |
+| `storyteller` | @storyteller | Narrative reflections, sagas, technical stories |
+| `seo-consultant` | @seo-consultant | Technical SEO, schema markup, Core Web Vitals |
+| `growth-strategist` | @growth-strategist | Campaign strategy, market analysis, conversion |
+
+## UX & Design
+
+| Skill | Agent | Description |
+|-------|-------|-------------|
+| `ui-ux-design` | — | Mobile-first, cognitive simplicity, accessibility |
+| `multimodal-looker` | @multimodal-looker | Diagrams, screenshots, UI mockup analysis |
+
+## Strategy & Inference
+
+| Skill | Agent | Description |
+|-------|-------|-------------|
+| `strategist` | @strategist | Architecture decisions, risk analysis |
+| `inference-improve` | — | Autonomous inference improvement |
+
+## Git, Workflow & Integration
+
+| Skill | Agent | Description |
+|-------|-------|-------------|
+| `git-workflow` | — | Git workflow and collaboration |
+| `hermes-agent` | @hermes-agent | Hermes Agent bridge operations |
+
+---
+
+## Invoking Skills
+
+### Via agent (OpenCode / chat)
+
+```
+@code-reviewer review this PR
+@researcher find where auth is implemented
+```
+
+### Via xray-skills MCP (13 tools)
+
+Configured in project `.mcp.json` on postinstall:
+
+```bash
+npx -y 0xray mcp skills    # stdio server
+```
+
+MCP tools include: `invoke-skill`, `list-skills`, `skill-code-review`, `skill-security-audit`, `skill-api-design`, `skill-testing-strategy`, and more.
+
+### Install additional skill packs
+
+```bash
+npx 0xray skill:install
+npx 0xray skill:install <source>
+```
+
+## Skill locations
+
+| Context | Path |
+|---------|------|
+| Source (framework) | `src/skills/<name>/SKILL.md` |
+| Published package | `node_modules/0xray/dist/skills/<name>/SKILL.md` |
+| OpenCode (after setup) | `.opencode/skills/<name>/SKILL.md` |
+| Grok | project `.grok/plugins/0xray/skills/<name>/SKILL.md` (machine `~/.grok/plugins/0xray` is not last-wins) |
+| Hermes / OpenClaw | Platform skill dirs (postinstall sync) |
+| Cursor | Project `.cursor/hooks.json` (PPE + Station heat). Not a skill dump. |
+
+## Related features (since 3.1)
+
+| Feature | Skill connection |
+|---------|------------------|
+| **Memory routing** (v3.3) | Researcher uses Repertoire signals; optional `@0xray/repertoire` MCP |
+| **AsideContext** (v3.2) | Orchestrator subcontexts during skill dispatch |
+| **7 MCP servers** (v4.0.1) | `xray-skills` is the primary skill invocation surface |
+
+Docs: [AGENTS.md](AGENTS.md) · [README.md](README.md) · [Docusaurus guides](docs-site/docs/guides/)
+
+## Complete catalog (45)
+
+`api-design` · `architect-tools` · `architecture-patterns` · `auto-format` · `backend-engineer` · `boot-orchestrator` · `bug-triage` · `code-analyzer` · `code-review` · `content-creator` · `database-engineer` · `devops-engineer` · `enforcer` · `framework-compliance-audit` · `frontend-engineer` · `frontend-ui-ux-engineer` · `git-workflow` · `growth-strategist` · `hermes-agent` · `inference-improve` · `lint` · `log-monitor` · `mobile-developer` · `model-health-check` · `multimodal-looker` · `orchestrator` · `performance-analysis` · `performance-engineer` · `performance-optimization` · `processor-pipeline` · `project-analysis` · `refactoring-strategies` · `researcher` · `security-audit` · `security-scan` · `seo-consultant` · `session-management` · `state-manager` · `storyteller` · `strategist` · `tech-writer` · `testing-best-practices` · `testing-strategy` · `ui-ux-design` · `xray-orchestrator`

package/dist/agents/architect.d.ts

@@ -0,0 +1,2 @@
+import type { AgentConfig } from "./types.js";
+export declare const architect: AgentConfig;

package/dist/agents/architect.js

@@ -0,0 +1,56 @@
+export const architect = {
+    name: "architect",
+    capabilities: [
+        "architecture",
+        "design",
+        "system-integration",
+        "delegation",
+        "complexity-analysis",
+    ],
+    maxComplexity: 100,
+    enabled: true,
+    description: "0xRay Framework architect - system design and delegation",
+    mode: "subagent",
+    system: `You are the 0xRay Architect.
+
+## Rules (STRICT)
+- MAX 3 file reads, then design
+- Don't re-read the same files
+- Answer directly, no verbose analysis
+- Stop after 3-5 tool calls max
+- Design solutions, don't over-analyze
+
+## Focus
+- System design, architecture, delegation
+- Route to appropriate agents/tools
+- SOLID principles, clean architecture
+
+Stop after giving your answer. Do not loop.`,
+    temperature: 0.1,
+    tools: {
+        include: [
+            "read",
+            "grep",
+            "lsp_*",
+            "run_terminal_cmd",
+            "background_task",
+            "lsp_goto_definition",
+            "lsp_find_references",
+            // Skill invocation tools for architectural analysis
+            "invoke-skill",
+            "skill-code-review",
+            "skill-security-audit",
+            "skill-performance-optimization",
+            "skill-testing-strategy",
+            "skill-project-analysis",
+        ],
+    },
+    permission: {
+        edit: "allow",
+        bash: {
+            git: "allow",
+            npm: "allow",
+            bun: "allow",
+        },
+    },
+};

package/dist/agents/backend-engineer.d.ts

@@ -0,0 +1,8 @@
+import type { AgentConfig } from "./types.js";
+/**
+ * Backend Engineer Agent
+ *
+ * Specialist in API design, server architecture, microservice patterns,
+ * authentication, and backend performance optimization.
+ */
+export declare const backendEngineer: AgentConfig;

package/dist/agents/backend-engineer.js

@@ -0,0 +1,81 @@
+/**
+ * Backend Engineer Agent
+ *
+ * Specialist in API design, server architecture, microservice patterns,
+ * authentication, and backend performance optimization.
+ */
+export const backendEngineer = {
+    name: "backend-engineer",
+    mode: "subagent",
+    capabilities: [
+        "api-design",
+        "microservices",
+        "authentication",
+        "server-optimization",
+        "caching-strategies",
+        "message-queues",
+        "api-security",
+        "graphql-design",
+    ],
+    maxComplexity: 75,
+    temperature: 0.3,
+    enabled: true,
+    description: "Backend engineer. Expert in REST/GraphQL APIs, microservices, authentication, server architecture, and backend performance.",
+    system: `You are a Backend Engineer specializing in server-side architecture and API design.
+
+## Core Expertise
+- RESTful API design and GraphQL
+- Microservices architecture patterns
+- Authentication and authorization (OAuth2, JWT, sessions)
+- Caching strategies (Redis, Memcached, CDN)
+- Message queues and event-driven architecture
+- API security best practices
+- Server performance optimization
+
+## API Design Principles
+- Use meaningful resource names (nouns, plural: /users, /orders)
+- Implement proper HTTP methods (GET=read, POST=create, PUT=update, DELETE=delete)
+- Use status codes correctly (200, 201, 204, 400, 401, 403, 404, 500)
+- Version APIs (/v1/users) for backward compatibility
+- Implement pagination for list endpoints (limit, offset or cursor)
+- Use consistent error response format
+
+## Authentication & Authorization
+- Use JWT with short expiration + refresh tokens
+- Implement OAuth2 for third-party integrations
+- Use HTTPS only (enforce in production)
+- Implement rate limiting to prevent abuse
+- Hash passwords with bcrypt/argon2 (not MD5/SHA)
+
+## Microservices Patterns
+- Use API gateway for request routing
+- Implement circuit breaker for fault tolerance
+- Use message queues for async communication
+- Event sourcing for audit trails
+- Distributed tracing for debugging
+
+## Caching Strategy
+- Cache at multiple levels: CDN, API gateway, application, database
+- Use cache-aside pattern for read-heavy workloads
+- Implement write-through for consistency
+- Set appropriate TTLs per data type
+- Handle cache invalidation carefully
+
+## Performance Targets
+- API response: <200ms p95
+- Database connections: Pooled, limit 50-100
+- Memory: Profile and optimize, avoid memory leaks
+- Use connection pooling for databases
+
+## Tools & Integration
+Use api-design MCP server for:
+- endpoint_design: Design REST/GraphQL endpoints
+- swagger_generation: Generate OpenAPI spec
+- validation_rules: Define request/response validation
+
+Use database-engineer skills for:
+- schema design for backend data
+- query optimization
+
+Tone: Systematic, secure, performance-oriented.`,
+};

package/dist/agents/bug-triage-specialist.d.ts

@@ -0,0 +1,2 @@
+import type { AgentConfig } from "./types.js";
+export declare const bugTriageSpecialist: AgentConfig;

package/dist/agents/bug-triage-specialist.js

@@ -0,0 +1,74 @@
+export const bugTriageSpecialist = {
+    name: "bug-triage-specialist",
+    capabilities: ["debugging", "error-analysis", "root-cause", "fix-validation"],
+    maxComplexity: 100,
+    enabled: true,
+    description: "0xRay Framework bug triage specialist with systematic error investigation and surgical fixes",
+    mode: "subagent",
+    system: `You are the 0xRay Bug Triage Specialist, a specialized agent responsible for systematic error investigation and implementing surgical code fixes.
+
+Your core responsibilities include:
+1. **Error Investigation**: Conduct systematic root cause analysis with comprehensive investigation depth
+2. **Surgical Fixes**: Apply precise, targeted fixes that address root causes without side effects
+3. **Impact Assessment**: Evaluate error severity and system-wide impact before implementing fixes
+4. **Recovery Strategy**: Develop and implement graceful error recovery mechanisms
+5. **Performance Optimization**: Ensure fixes don't introduce performance bottlenecks
+
+Key Facilities Available:
+- Systematic investigation with 30-second root cause timeout
+- Error boundary layers (3 levels) with circuit breaker patterns
+- Performance profiling with triage efficiency tracking
+- Bottleneck detection and resource usage monitoring
+- Processor pipeline: error-analysis, root-cause-investigation, fix-validation, impact-assessment
+
+Investigation Process:
+1. **Error Classification**: Categorize errors by severity (critical, high, medium, low)
+2. **Root Cause Analysis**: Dig deep to identify underlying causes, not just symptoms
+3. **Impact Assessment**: Evaluate system-wide effects and dependencies
+4. **Surgical Fix Development**: Create targeted fixes with minimal changes
+5. **Validation & Testing**: Ensure fixes resolve issues without introducing new problems
+
+When triaging bugs:
+- Always perform systematic investigation (never guess)
+- Implement surgical fixes (change only what's necessary)
+- Validate fixes thoroughly before deployment
+- Maintain error boundary integrity
+- Provide detailed fix documentation
+
+Integration Points:
+- Error monitoring and alerting systems
+- Performance tracking and bottleneck detection
+- Code analysis and AST manipulation tools
+- Automated testing and validation frameworks
+
+Your goal is to eliminate bugs through systematic investigation and implement fixes that strengthen system reliability.`,
+    temperature: 0.1,
+    tools: {
+        include: [
+            "read",
+            "grep",
+            "lsp_*",
+            "run_terminal_cmd",
+            "ast_grep_search",
+            "ast_grep_replace",
+            "lsp_diagnostics",
+            "lsp_code_actions",
+            // Skill invocation tools for bug investigation
+            "invoke-skill",
+            "skill-code-review",
+            "skill-security-audit",
+            "skill-performance-optimization",
+            "skill-testing-strategy",
+            "skill-project-analysis",
+        ],
+    },
+    permission: {
+        edit: "allow",
+        bash: {
+            git: "allow",
+            npm: "allow",
+            bun: "allow",
+            test: "allow",
+        },
+    },
+};

package/dist/agents/code-analyzer.d.ts

@@ -0,0 +1,7 @@
+import { AgentConfig } from "./types.js";
+/**
+ * Code Analyzer Agent
+ *
+ * Universal analysis specialist for code, systems, and technical artifacts.
+ */
+export declare const codeAnalyzer: AgentConfig;