0xray 4.0.27 → 4.0.28

package/.grok-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "0xray",
-  "version": "4.0.27",
+  "version": "4.0.28",
   "description": "0xRay suit for Grok, Hermes, OpenClaw, OpenCode: mill+inspect, Codex, 7 MCP servers. Costume 45/42 is opt-in foundry, not the default wear.",
   "author": {
     "name": "0xRay AI",

package/.xray/features.json

@@ -1,6 +1,6 @@
 {
   "$schema": "./features.schema.json",
-  "version": "4.0.27",
+  "version": "4.0.28",
   "description": "0xRay Framework - Unified Feature Configuration",
   "suit_temperament": {
     "profile": "auto",

package/README.md

@@ -52,7 +52,8 @@ Docs: [guides/autonomy-command](docs-site/docs/guides/autonomy-command.md) · Sk
 | Version | Highlights |
 |---------|------------|
 | **Unreleased** | Fasten is **foundry-plant/0**: builtin plant is mill+inspect only. `foundry.json` `"plant": "@0xray/blip"` (aliases `"plant": "blip"` / `"plant": "sound"`) fastens whatever that mill declares (looker / vibe / mixer live in the mill). Nested mill `@0xray/foundry@0.1.12`. CLI shims `foundry blip\|sound` remain (0.1.11+). Shop plant first-class (`shop-extract`, `shop-witness`, `shop-pin` + `foundry.json` `shopPlant`). |
-| **4.0.27** | Host compact proof needs a generation id and a numeric usage percent, and the same preCompact receipt is mirrored to nested consumer wear roots. Memory scoring: [docs/memory-scoring.md](docs/memory-scoring.md) (orchestrator links it). Companion `@0xray/grok-bot` 0.1.6: general page vs `house/` overlay, `templates/house/`, `grok-bot house init`, doctor `GROK_BOT_HOUSE` or walk-up. Not published. |
+| **4.0.28** | MCP servers start through `scripts/node/mcp-launch.cjs` and only see PATH, HOME, XRAY_ROOT, plus names on their keep list. Tokens such as NPM_TOKEN are not inherited. User env values stay out of argv. Postinstall keeps user edits to AGENTS.md, .mcp.json, and opencode.json. `house init` does not copy EXAMPLE.md; doctor FAILs while `house/EXAMPLE.md` exists. Inspect adds a machinePlugin check. The Cursor hook defaults XRAY_ROOT to the suit. Companion `@0xray/grok-bot` 0.1.7. Released 2026-09-27. |
+| **4.0.27** | Host compact proof needs a generation id and a numeric usage percent, and the same preCompact receipt is mirrored to nested consumer wear roots. Memory scoring: [docs/memory-scoring.md](docs/memory-scoring.md) (orchestrator links it). Companion `@0xray/grok-bot` 0.1.6: general page vs `house/` overlay, `templates/house/`, `grok-bot house init`, doctor `GROK_BOT_HOUSE` or walk-up. Released 2026-09-26. |
 | **4.0.9** | Mill target: postinstall does not mill npm global prefix or `_npx` as a consumer. Isolated HOME skips machine `~/.grok`. |
 | **4.0.0** | Exo + temperament. Constitution always on; ceremony by host. Repertoire organ on (vendored 0.2). Station card survives compact/host-swap. **On npm.** [vision](docs-site/docs/architecture/v4-vision.md) · [now](docs-site/docs/architecture/v4-now.md) |
 | **3.4.1** | Unified `install-bridges.cjs` on postinstall — OpenCode, Grok, Hermes, OpenClaw in one pass. All 7 MCPs servers via `npx -y 0xray mcp <cmd>` (no `dist/` paths). Canonical `release.mjs` pipeline. |

package/dist/CHANGELOG.md

@@ -41,6 +41,14 @@ The format is based on [Conventional Commits](https://www.conventionalcommits.or
 - Archive root `integrations/` costume SKILL dump → `docs/archive/integrations-costume/`. Live wear is `src/integrations`.
 - Archive root `commands/` stale copy → `docs/archive/commands-copy/`. Live wear is `src/opencode/commands`.
 
+## [4.0.28] - 2026-09-26
+
+Next patch after npm `4.0.27`. Released 2026-09-27.
+
+MCP servers start through `scripts/node/mcp-launch.cjs` and only see PATH, HOME, and XRAY_ROOT, plus the names on their keep list. Tokens such as NPM_TOKEN are no longer inherited. User env values stay out of argv. Postinstall keeps user edits to AGENTS.md, .mcp.json, and opencode.json. `house init` no longer copies EXAMPLE.md, and doctor FAILs while `house/EXAMPLE.md` exists. Inspect has a new machinePlugin check. The Cursor hook defaults XRAY_ROOT to the suit directory. Companion package `@0xray/grok-bot@0.1.7`.
+
+---
+
 ## [4.0.27] - 2026-09-25
 
 Next patch after npm `4.0.26`. Released 2026-09-26.

package/dist/README.md

@@ -52,7 +52,8 @@ Docs: [guides/autonomy-command](docs-site/docs/guides/autonomy-command.md) · Sk
 | Version | Highlights |
 |---------|------------|
 | **Unreleased** | Fasten is **foundry-plant/0**: builtin plant is mill+inspect only. `foundry.json` `"plant": "@0xray/blip"` (aliases `"plant": "blip"` / `"plant": "sound"`) fastens whatever that mill declares (looker / vibe / mixer live in the mill). Nested mill `@0xray/foundry@0.1.12`. CLI shims `foundry blip\|sound` remain (0.1.11+). Shop plant first-class (`shop-extract`, `shop-witness`, `shop-pin` + `foundry.json` `shopPlant`). |
-| **4.0.27** | Host compact proof needs a generation id and a numeric usage percent, and the same preCompact receipt is mirrored to nested consumer wear roots. Memory scoring: [docs/memory-scoring.md](docs/memory-scoring.md) (orchestrator links it). Companion `@0xray/grok-bot` 0.1.6: general page vs `house/` overlay, `templates/house/`, `grok-bot house init`, doctor `GROK_BOT_HOUSE` or walk-up. Not published. |
+| **4.0.28** | MCP servers start through `scripts/node/mcp-launch.cjs` and only see PATH, HOME, XRAY_ROOT, plus names on their keep list. Tokens such as NPM_TOKEN are not inherited. User env values stay out of argv. Postinstall keeps user edits to AGENTS.md, .mcp.json, and opencode.json. `house init` does not copy EXAMPLE.md; doctor FAILs while `house/EXAMPLE.md` exists. Inspect adds a machinePlugin check. The Cursor hook defaults XRAY_ROOT to the suit. Companion `@0xray/grok-bot` 0.1.7. Released 2026-09-27. |
+| **4.0.27** | Host compact proof needs a generation id and a numeric usage percent, and the same preCompact receipt is mirrored to nested consumer wear roots. Memory scoring: [docs/memory-scoring.md](docs/memory-scoring.md) (orchestrator links it). Companion `@0xray/grok-bot` 0.1.6: general page vs `house/` overlay, `templates/house/`, `grok-bot house init`, doctor `GROK_BOT_HOUSE` or walk-up. Released 2026-09-26. |
 | **4.0.9** | Mill target: postinstall does not mill npm global prefix or `_npx` as a consumer. Isolated HOME skips machine `~/.grok`. |
 | **4.0.0** | Exo + temperament. Constitution always on; ceremony by host. Repertoire organ on (vendored 0.2). Station card survives compact/host-swap. **On npm.** [vision](docs-site/docs/architecture/v4-vision.md) · [now](docs-site/docs/architecture/v4-now.md) |
 | **3.4.1** | Unified `install-bridges.cjs` on postinstall — OpenCode, Grok, Hermes, OpenClaw in one pass. All 7 MCPs servers via `npx -y 0xray mcp <cmd>` (no `dist/` paths). Canonical `release.mjs` pipeline. |

package/dist/integrations/cursor/hooks/xray-cloud-hook.sh

@@ -59,5 +59,5 @@ fi
 
 export XRAY_HOOK_EVENT="$EVENT"
 export XRAY_AI_PATH="$MILL"
-export XRAY_ROOT="$MILL"
+export XRAY_ROOT="${XRAY_ROOT:-$(pwd)}"
 exec "$NODE_BIN" "${MILL}/${REL}"

package/dist/integrations/hooks/plates.cjs

@@ -14,6 +14,7 @@ const PLATE_IDS = Object.freeze([
   "processor",
   "reporting",
   "memory-recall",
+  "house",
 ]);
 
 /** Id token, then extra phrases. Equal top scores recall nothing. */
@@ -61,6 +62,12 @@ const CUES = {
     [/recall(?:s|ed|ing)?\s+(?:a\s+|one\s+|the\s+)?plate/i, 5],
     [/stamp(?:ed|ing)?\s+plates?/i, 4],
   ],
+  house: [
+    [/house init/i, 4],
+    [/HOUSE\.md/i, 4],
+    [/GROK_BOT_HOUSE/i, 4],
+    [/setup-house/i, 4],
+  ],
 };
 
 function platesDir() {

package/dist/integrations/openclaw/plugin/xray-pre-tool/package.json

@@ -1,6 +1,6 @@
 {
   "name": "xray-pre-tool",
-  "version": "4.0.27",
+  "version": "4.0.28",
   "private": true,
   "type": "module",
   "description": "0xRay constitution + temperament PreToolUse for OpenClaw",

package/dist/memory-routing/plates.d.ts

@@ -1,4 +1,4 @@
-export declare const PLATE_IDS: readonly ["routing", "governance", "boot", "orchestration", "processor", "reporting", "memory-recall"];
+export declare const PLATE_IDS: readonly ["routing", "governance", "boot", "orchestration", "processor", "reporting", "memory-recall", "house"];
 export type PlateId = (typeof PLATE_IDS)[number];
 export interface PlateStamp {
     id: PlateId;

package/dist/memory-routing/plates.js

@@ -13,6 +13,7 @@ export const PLATE_IDS = [
     'processor',
     'reporting',
     'memory-recall',
+    'house',
 ];
 function isPlateId(value) {
     return PLATE_IDS.includes(value);

package/docs-site/docs/plates/house.md

@@ -0,0 +1,50 @@
+---
+title: House
+sidebar_label: House
+---
+
+# House
+
+One team, one folder. `grok-bot house init` copies `HOUSE.md`, `WAVEBOARD.md`, and `ATTENTION_STATE.md` into `./house`. It does not copy `EXAMPLE.md`. It refuses when a target file is already there. Doctor reads `HOUSE.md` through `GROK_BOT_HOUSE`, or by walking up when that variable is unset, and FAILs with `house/EXAMPLE.md exists — delete it` when that file is present. A wake reads the station, then the board files in `house/`.
+
+```
+┌──────────────────────────────────────────────────────────────┐
+│ INPUT LAYER                                                  │
+│                                                              │
+│   npx @0xray/grok-bot house init                             │
+│   copies HOUSE.md, WAVEBOARD.md, ATTENTION_STATE.md only     │
+│   refuses if a target file is already there                  │
+└──────────────────────────────┬───────────────────────────────┘
+                               v
+┌──────────────────────────────┼───────────────────────────────┐
+│ PROCESSING LAYER             v                               │
+│                                                              │
+│   ┌──────────────────────────────────────────────────────┐   │
+│   │ HOUSE.md — six headings                              │   │
+│   │ owner · seats · public voice · allowed · ask first   │   │
+│   │ board: WAVEBOARD.md + ATTENTION_STATE.md             │   │
+│   │ the owner approves Allowed before it counts          │   │
+│   └───────────────────────────┬──────────────────────────┘   │
+│                                v                             │
+│   ┌──────────────────────────────────────────────────────┐   │
+│   │ grok-bot doctor                                      │   │
+│   │ GROK_BOT_HOUSE, or walk up for house/HOUSE.md        │   │
+│   │ a set path that is missing warns and does not walk   │   │
+│   │ a line that starts with (example) fails              │   │
+│   │ house/EXAMPLE.md exists — delete it                  │   │
+│   └───────────────────────────┬──────────────────────────┘   │
+└──────────────────────────────┼───────────────────────────────┘
+                               v
+┌──────────────────────────────┼───────────────────────────────┐
+│ OUTPUT LAYER                 v                               │
+│                                                              │
+│   read the station, then house/WAVEBOARD.md                  │
+│   and house/ATTENTION_STATE.md                               │
+│   a missing board file uses templates/house/                 │
+│   one card, one owner                                        │
+│   change the house when the owner says a rule twice          │
+└──────────────────────────────────────────────────────────────┘
+
+```
+
+stamped · 0xray · @0xray/grok-bot 0.1.7

package/docs-site/docs/plates/index.md

@@ -13,4 +13,4 @@ The station card stays the short subsystem table. That table is the index still
 
 The markdown file is the source of truth for that stamp. When the pipeline changes, edit the plate. A worn project may hold a copy at `.xray/state/plates/<id>.md`. The copy is written only when that file is missing, so a local edit stays.
 
-[Routing](./routing.md) · [Governance](./governance.md) · [Boot](./boot.md) · [Orchestration](./orchestration.md) · [Processor](./processor.md) · [Reporting](./reporting.md) · [Memory recall](./memory-recall.md)
+[Routing](./routing.md) · [Governance](./governance.md) · [Boot](./boot.md) · [Orchestration](./orchestration.md) · [Processor](./processor.md) · [Reporting](./reporting.md) · [Memory recall](./memory-recall.md) · [House](./house.md)

package/llms.txt

@@ -12,6 +12,7 @@ Default consumer wear is **mill plant** (`mill` + `inspect`), not a 45-skill / 4
 - Memory scoring rules: [docs/memory-scoring.md](docs/memory-scoring.md). The orchestrator links that file. It does not copy the rules.
 - Host `preCompact` writes the hook line and per-session receipt on the suit mill and on nested consumer wear roots (a bench with local `node_modules/0xray`). A counted cut needs a non-empty generation id and a numeric usage percent.
 - `@0xray/grok-bot`: the general page is `grok-bot/OP-PROC.md`. The team overlay is `house/` and is not in that npm pack. `templates/house/` ships. `grok-bot house init` copies the template and refuses to overwrite. Doctor uses `GROK_BOT_HOUSE` when set, otherwise walks up from the working directory for `house/HOUSE.md`.
+- MCP servers start through `scripts/node/mcp-launch.cjs`. They see PATH, HOME, and XRAY_ROOT, plus the names on their keep list. Tokens such as NPM_TOKEN are not inherited. User env values stay out of argv. Postinstall keeps user edits to AGENTS.md, `.mcp.json`, and `opencode.json`. `house init` does not copy EXAMPLE.md. Doctor FAILs while `house/EXAMPLE.md` exists. Inspect has a machinePlugin check. The Cursor hook defaults XRAY_ROOT to the suit directory.
 
 - `npx @0xray/foundry mint --skip-live` — re-fasten mill plant, then inspect.
 - `npx @0xray/foundry inspect --skip-live` — plant-vs-worn, receipt, CI. Chat is not a receipt.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "0xray",
-  "version": "4.0.27",
+  "version": "4.0.28",
   "description": "Multi-agent orchestration and Codex governance for OpenCode, Hermes, Grok Build, and OpenClaw",
   "readme": "README.md",
   "license": "MIT",

package/scripts/foundry/inspect.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * Mill inspect organ. Runs the six plant checks plus observational harness.
+ * Mill inspect organ. Runs the plant checks, a machinePlugin check, and observational harness.
  * Not an 8th MCP. Not PPE. Does not fasten hooks or Repertoire.
  *
  *   npx @0xray/foundry inspect [--skip-live] [--go] [--go-out PATH]
@@ -515,7 +515,7 @@ export function packagesToProbe(root) {
   });
 }
 
-function checkIsolatedHome(root, env = process.env, machine = mint.machineHome()) {
+export function checkIsolatedHome(root, env = process.env, machine = mint.machineHome()) {
   const isolated = isIsolatedHome(env, machine);
   const machinePlugin = machineGrokPluginDir(machine);
   const dests = mint.resolveGrokPluginDests(root, env, machine);
@@ -542,6 +542,50 @@ function checkIsolatedHome(root, env = process.env, machine = mint.machineHome()
   };
 }
 
+function isXrayPluginName(name) {
+  return name === "0xray" || name.startsWith("0xray");
+}
+
+/** 0xray plugin dirs under the machine HOME's grok plugin folder. */
+export function machineXrayPluginPaths(machine = mint.machineHome()) {
+  const pluginsDir = path.join(machine, ".grok", "plugins");
+  if (!fs.existsSync(pluginsDir)) return [];
+  let names;
+  try {
+    names = fs.readdirSync(pluginsDir);
+  } catch {
+    return [];
+  }
+  return names
+    .filter((name) => isXrayPluginName(name))
+    .sort()
+    .map((name) => path.join(pluginsDir, name));
+}
+
+/**
+ * `isolated` stays HOME != machine home. This check is whether a machine-level
+ * 0xray Grok plugin exists. Overall inspect ok is false when this check fails.
+ */
+export function checkMachinePlugin(machine = mint.machineHome()) {
+  const machinePlugin = machineGrokPluginDir(machine);
+  const hits = machineXrayPluginPaths(machine);
+  if (hits.length > 0) {
+    return {
+      id: "machinePlugin",
+      ok: false,
+      machinePlugin,
+      hits,
+      detail: `machine-level ${hits.join(", ")} exists — delete it`,
+    };
+  }
+  return {
+    id: "machinePlugin",
+    ok: true,
+    machinePlugin,
+    hits: [],
+  };
+}
+
 export async function inspectSuit(root, opts = {}) {
   const millRoot = opts.millRoot || millPackageDir();
   const fetchFn = opts.fetch || fetch;
@@ -584,6 +628,7 @@ export async function inspectSuit(root, opts = {}) {
   }
 
   checks.push(checkIsolatedHome(root, env, machineHome));
+  checks.push(checkMachinePlugin(machineHome));
   checks.push(checkHarness(root, requireHarness));
 
   const failed = checks.filter((c) => c.ok === false);

package/scripts/node/bridge-mcp-wiring.cjs

@@ -144,20 +144,25 @@ function detectConsumerExtraMcpServers(targetDir) {
   try {
     const repertoireMcp = resolveRepertoireMcp(targetDir);
     if (!repertoireMcp) return extras;
+    const launch = wrapScopedLaunch(
+      { command: "node", args: [repertoireMcp] },
+      baseScopedEnv(targetDir),
+    );
     extras.hermes.repertoire = {
-      command: "node",
-      args: [repertoireMcp],
-      env: { XRAY_ROOT: targetDir },
+      command: launch.command,
+      args: launch.args,
+      env: launch.env,
     };
     extras.opencode.repertoire = {
       type: "local",
-      command: ["node", repertoireMcp],
+      command: launch.commandList,
       enabled: true,
+      environment: launch.env,
     };
     extras.openclaw.repertoire = {
-      command: "node",
-      args: [repertoireMcp],
-      env: { XRAY_ROOT: targetDir },
+      command: launch.command,
+      args: launch.args,
+      env: launch.env,
     };
   } catch {
     // best-effort
@@ -165,11 +170,284 @@ function detectConsumerExtraMcpServers(targetDir) {
   return extras;
 }
 
-function buildStdioMcpServer(mcpCmd, env, targetDir) {
+function readInstalledXrayVersion() {
+  const pkgPath = path.join(__dirname, "..", "..", "package.json");
+  const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf8"));
+  if (typeof pkg.version !== "string" || !pkg.version) {
+    throw new Error("0xray package.json version missing; refusing unpinned MCP launch");
+  }
+  return pkg.version;
+}
+
+function localXrayCli(targetDir) {
+  if (!targetDir) return null;
+  const cli = path.join(targetDir, "node_modules", "0xray", "dist", "cli", "index.js");
+  return fs.existsSync(cli) ? cli : null;
+}
+
+/** Prefer the installed CLI. Else pin npx to this package version. Never bare `0xray`. */
+function pinnedMcpLaunch(targetDir, mcpCmd) {
+  const cli = localXrayCli(targetDir);
+  if (cli) {
+    return {
+      command: "node",
+      args: [cli, "mcp", mcpCmd],
+      commandList: ["node", cli, "mcp", mcpCmd],
+    };
+  }
+  const spec = `0xray@${readInstalledXrayVersion()}`;
   return {
     command: "npx",
-    args: ["-y", "0xray", "mcp", mcpCmd],
-    env: { ...env, XRAY_ROOT: targetDir },
+    args: ["-y", spec, "mcp", mcpCmd],
+    commandList: ["npx", "-y", spec, "mcp", mcpCmd],
+  };
+}
+
+/**
+ * Stdio MCP hosts merge an `env` object onto the parent process. They cannot
+ * drop inherited secrets. argv is world-readable, so values never go on the
+ * command line. Every launch is:
+ *   node <mcp-launch.cjs> --keep PATH,HOME,XRAY_ROOT[,flag][,user names] -- <pinned command>
+ * `scripts/node/mcp-launch.cjs` copies those names from its own environ (the
+ * live host, after the host merged this entry's `env` block) and spawns the
+ * server. PATH and HOME are names only; their values are whatever the host
+ * has at launch. XRAY_ROOT and non-secret server flags stay in the `env`
+ * block. User keys stay in that block too, and their names are appended to
+ * --keep. NODE_OPTIONS is omitted: none of the seven stdio servers read it.
+ */
+const LIVE_ENV_NAMES = ["PATH", "HOME"];
+
+function mcpLauncherPath() {
+  return path.join(__dirname, "mcp-launch.cjs");
+}
+
+function baseScopedEnv(targetDir) {
+  const env = {};
+  if (targetDir) env.XRAY_ROOT = targetDir;
+  return env;
+}
+
+function orderedEnv(envMap) {
+  const preferred = ["PATH", "HOME", "XRAY_ROOT"];
+  const ordered = {};
+  for (const key of preferred) {
+    if (Object.prototype.hasOwnProperty.call(envMap, key)) ordered[key] = String(envMap[key]);
+  }
+  for (const key of Object.keys(envMap)) {
+    if (!Object.prototype.hasOwnProperty.call(ordered, key)) ordered[key] = String(envMap[key]);
+  }
+  return ordered;
+}
+
+function mergeScopedEnv(layers) {
+  const merged = {};
+  for (const layer of layers) {
+    if (!layer || typeof layer !== "object" || Array.isArray(layer)) continue;
+    for (const key of Object.keys(layer)) {
+      if (layer[key] == null) continue;
+      merged[key] = String(layer[key]);
+    }
+  }
+  return orderedEnv(merged);
+}
+
+function configEnvFromMap(envMap) {
+  const ordered = orderedEnv(envMap || {});
+  const config = {};
+  for (const key of Object.keys(ordered)) {
+    if (LIVE_ENV_NAMES.includes(key)) continue;
+    config[key] = ordered[key];
+  }
+  return config;
+}
+
+function keepList(config) {
+  return [...LIVE_ENV_NAMES, ...Object.keys(config)];
+}
+
+function wrapScopedLaunch(inner, envMap) {
+  const env = configEnvFromMap(envMap);
+  const tail = [mcpLauncherPath(), "--keep", keepList(env).join(","), "--", inner.command, ...inner.args];
+  return {
+    command: "node",
+    args: tail,
+    commandList: ["node", ...tail],
+    env,
+  };
+}
+
+function scopedMcpLaunch(targetDir, mcpCmd, serverEnv) {
+  return wrapScopedLaunch(pinnedMcpLaunch(targetDir, mcpCmd), mergeScopedEnv([baseScopedEnv(targetDir), serverEnv]));
+}
+
+function commandTokens(server) {
+  if (!server || typeof server !== "object") return [];
+  if (Array.isArray(server.command)) return server.command.map(String);
+  const tokens = [];
+  if (typeof server.command === "string") tokens.push(server.command);
+  if (Array.isArray(server.args)) tokens.push(...server.args.map(String));
+  return tokens;
+}
+
+function isMcpLauncherToken(token) {
+  return token === "mcp-launch.cjs" || token.endsWith(`${path.sep}mcp-launch.cjs`) || token.endsWith("/mcp-launch.cjs");
+}
+
+function peelScopedLaunch(tokens) {
+  if (tokens[0] === "env") {
+    let i = 1;
+    if (tokens[i] === "-i" || tokens[i] === "--ignore-environment") i += 1;
+    else return tokens.slice();
+    while (i < tokens.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(tokens[i])) i += 1;
+    return tokens.slice(i);
+  }
+  if (tokens[0] === "node" && isMcpLauncherToken(tokens[1] || "")) {
+    const dash = tokens.indexOf("--");
+    if (dash >= 0) return tokens.slice(dash + 1);
+  }
+  return tokens.slice();
+}
+
+function launchTokens(server) {
+  return peelScopedLaunch(commandTokens(server));
+}
+
+function innerFromTokens(tokens) {
+  if (!tokens.length) return null;
+  return { command: tokens[0], args: tokens.slice(1) };
+}
+
+function usesCommandArray(server) {
+  return Array.isArray(server && server.command);
+}
+
+function hasVersionPin(server) {
+  return launchTokens(server).some((token) => /^0xray@.+/.test(token));
+}
+
+function isUnpinnedXrayLaunch(server) {
+  return launchTokens(server).some((token) => token === "0xray");
+}
+
+function jsonDeepEqual(a, b) {
+  if (a === b) return true;
+  if (typeof a !== typeof b) return false;
+  if (a === null || b === null || typeof a !== "object") return a === b;
+  if (Array.isArray(a) || Array.isArray(b)) {
+    if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
+    return a.every((item, i) => jsonDeepEqual(item, b[i]));
+  }
+  const aKeys = Object.keys(a);
+  const bKeys = Object.keys(b);
+  if (aKeys.length !== bKeys.length) return false;
+  return aKeys.every((key) => Object.prototype.hasOwnProperty.call(b, key) && jsonDeepEqual(a[key], b[key]));
+}
+
+function mcpCmdFromInner(inner) {
+  const idx = inner.args.indexOf("mcp");
+  if (idx >= 0 && inner.args[idx + 1]) return inner.args[idx + 1];
+  return inner.args.length > 0 ? inner.args[inner.args.length - 1] : null;
+}
+
+/** Framework fills gaps. User env, enabled/disabled, and version pins win. Unpinned `0xray` is repinned. Launch is `node mcp-launch.cjs --keep names -- cmd`. */
+function mergeUserWinsServer(framework, user, targetDir) {
+  if (!user || typeof user !== "object") return framework;
+  if (!framework || typeof framework !== "object") return user;
+  const next = { ...user };
+  const userInner = innerFromTokens(launchTokens(user));
+  const frameworkInner = innerFromTokens(launchTokens(framework));
+  let inner = userInner || frameworkInner;
+  if (userInner && !hasVersionPin(user) && isUnpinnedXrayLaunch(user) && frameworkInner) {
+    inner = frameworkInner;
+  }
+  if (inner && isUnpinnedXrayLaunch({ command: inner.command, args: inner.args })) {
+    const mcpCmd = mcpCmdFromInner(inner);
+    if (mcpCmd) inner = pinnedMcpLaunch(targetDir, mcpCmd);
+  }
+  if (!inner) return framework;
+  const mergedEnv = mergeScopedEnv([
+    baseScopedEnv(targetDir),
+    framework.env,
+    framework.environment,
+    user.env,
+    user.environment,
+  ]);
+  const wrapped = wrapScopedLaunch(inner, mergedEnv);
+  if (usesCommandArray(user) || usesCommandArray(framework)) {
+    next.command = wrapped.commandList;
+    delete next.args;
+  } else {
+    next.command = wrapped.command;
+    next.args = wrapped.args;
+  }
+  const wantEnvironment =
+    Object.prototype.hasOwnProperty.call(user, "environment") ||
+    Object.prototype.hasOwnProperty.call(framework, "environment");
+  const wantEnv =
+    Object.prototype.hasOwnProperty.call(user, "env") || Object.prototype.hasOwnProperty.call(framework, "env");
+  if (wantEnvironment) next.environment = mergedEnv;
+  if (wantEnv) next.env = mergedEnv;
+  else if (!wantEnvironment) next.env = mergedEnv;
+  if (!Object.prototype.hasOwnProperty.call(user, "enabled") && Object.prototype.hasOwnProperty.call(framework, "enabled")) {
+    next.enabled = framework.enabled;
+  }
+  if (!Object.prototype.hasOwnProperty.call(user, "disabled") && Object.prototype.hasOwnProperty.call(framework, "disabled")) {
+    next.disabled = framework.disabled;
+  }
+  return next;
+}
+
+function mergeMcpMap(frameworkServers, userServers, targetDir) {
+  const framework = frameworkServers && typeof frameworkServers === "object" ? frameworkServers : {};
+  const user = userServers && typeof userServers === "object" ? userServers : {};
+  const merged = {};
+  const seen = new Set();
+  for (const name of Object.keys(user)) {
+    seen.add(name);
+    merged[name] = framework[name] ? mergeUserWinsServer(framework[name], user[name], targetDir) : user[name];
+  }
+  for (const name of Object.keys(framework)) {
+    if (seen.has(name)) continue;
+    merged[name] = framework[name];
+  }
+  return merged;
+}
+
+function mergeNamedRecords(src, dest) {
+  const source = src && typeof src === "object" ? src : {};
+  const user = dest && typeof dest === "object" ? dest : {};
+  const merged = {};
+  const seen = new Set();
+  for (const name of Object.keys(user)) {
+    seen.add(name);
+    const fromSrc = source[name];
+    const fromUser = user[name];
+    if (
+      fromSrc &&
+      fromUser &&
+      typeof fromSrc === "object" &&
+      typeof fromUser === "object" &&
+      !Array.isArray(fromSrc) &&
+      !Array.isArray(fromUser)
+    ) {
+      merged[name] = { ...fromSrc, ...fromUser };
+    } else {
+      merged[name] = fromUser;
+    }
+  }
+  for (const name of Object.keys(source)) {
+    if (seen.has(name)) continue;
+    merged[name] = source[name];
+  }
+  return merged;
+}
+
+function buildStdioMcpServer(mcpCmd, env, targetDir) {
+  const launch = scopedMcpLaunch(targetDir, mcpCmd, env);
+  return {
+    command: launch.command,
+    args: launch.args,
+    env: launch.env,
   };
 }
 
@@ -194,12 +472,12 @@ function buildOpenClawMcpServers(targetDir) {
 function buildOpencodeMcpEntries(targetDir) {
   const entries = {};
   for (const s of XRAY_MCP_SERVERS) {
-    const environment = { ...s.env };
+    const launch = scopedMcpLaunch(targetDir, s.mcpCmd, s.env);
     entries[s.name] = {
       type: "local",
-      command: ["npx", "-y", "0xray", "mcp", s.mcpCmd],
+      command: launch.commandList,
       enabled: true,
-      ...(Object.keys(environment).length > 0 ? { environment } : {}),
+      environment: launch.env,
     };
   }
   const extras = detectConsumerExtraMcpServers(targetDir);
@@ -209,23 +487,25 @@ function buildOpencodeMcpEntries(targetDir) {
 function buildPluginMcpJson(targetDir) {
   const mcpServers = {};
   for (const s of XRAY_MCP_SERVERS) {
+    const launch = scopedMcpLaunch(targetDir, s.mcpCmd, s.env);
     mcpServers[s.name] = {
-      command: "npx",
-      args: ["-y", "0xray", "mcp", s.mcpCmd],
-      env: { ...s.env, XRAY_ROOT: targetDir },
+      command: launch.command,
+      args: launch.args,
+      env: launch.env,
     };
   }
   return { mcpServers };
 }
 
-/** Portable .mcp.json for Grok/Cursor — no absolute XRAY_ROOT */
-function buildPortableProjectMcpJson() {
+/** Project .mcp.json for Grok/Cursor. Launcher allowlist drops inherited secrets; XRAY_ROOT is set when targetDir is known. */
+function buildPortableProjectMcpJson(targetDir) {
   const mcpServers = {};
   for (const s of XRAY_MCP_SERVERS) {
+    const launch = scopedMcpLaunch(targetDir, s.mcpCmd, s.env);
     mcpServers[s.name] = {
-      command: "npx",
-      args: ["-y", "0xray", "mcp", s.mcpCmd],
-      ...(Object.keys(s.env).length > 0 ? { env: { ...s.env } } : {}),
+      command: launch.command,
+      args: launch.args,
+      env: launch.env,
     };
   }
   return { mcpServers };
@@ -312,16 +592,21 @@ function mergeOpencodeMcpRegistry(targetDir) {
       config = { $schema: "https://opencode.ai/config.json", mcp: {} };
     }
   }
-  config.mcp = { ...(config.mcp || {}), ...entries };
-  fs.writeFileSync(opencodePath, `${JSON.stringify(config, null, 2)}\n`);
+  const existed = fs.existsSync(opencodePath);
+  const nextMcp = mergeMcpMap(entries, config.mcp || {}, targetDir);
+  const next = { ...config, mcp: nextMcp };
+  if (existed && jsonDeepEqual(next, config)) return Object.keys(entries).length;
+  fs.writeFileSync(opencodePath, `${JSON.stringify(next, null, 2)}\n`);
   return Object.keys(entries).length;
 }
 
 function deployPortableProjectMcpJson(targetDir) {
   const destPath = path.join(targetDir, ".mcp.json");
-  const portable = buildPortableProjectMcpJson();
+  const portable = buildPortableProjectMcpJson(targetDir);
   let existing = { mcpServers: {} };
+  let hadFile = false;
   if (fs.existsSync(destPath)) {
+    hadFile = true;
     try {
       existing = JSON.parse(fs.readFileSync(destPath, "utf8"));
     } catch {
@@ -329,14 +614,12 @@ function deployPortableProjectMcpJson(targetDir) {
     }
   }
   const extras = detectConsumerExtraMcpServers(targetDir);
+  const framework = { ...portable.mcpServers, ...(extras.openclaw || {}) };
   const merged = {
     ...existing,
-    mcpServers: {
-      ...(existing.mcpServers || {}),
-      ...portable.mcpServers,
-      ...(extras.openclaw || {}),
-    },
+    mcpServers: mergeMcpMap(framework, existing.mcpServers || {}, targetDir),
   };
+  if (hadFile && jsonDeepEqual(merged, existing)) return;
   fs.writeFileSync(destPath, `${JSON.stringify(merged, null, 2)}\n`);
 }
 
@@ -573,6 +856,14 @@ module.exports = {
   buildStdioMcpServer,
   buildPluginMcpJson,
   buildPortableProjectMcpJson,
+  pinnedMcpLaunch,
+  scopedMcpLaunch,
+  baseScopedEnv,
+  wrapScopedLaunch,
+  mergeMcpMap,
+  mergeNamedRecords,
+  mergeUserWinsServer,
+  jsonDeepEqual,
   copyHermesFindProjectRootHelper,
   writeHermesPluginArtifacts,
   syncHermesMcpRegistry,

package/scripts/node/consumer-install-smoke.mjs

@@ -353,11 +353,45 @@ function main() {
         throw new Error(`Missing MCP server in .mcp.json: ${name}`);
       }
       const entry = mcp.mcpServers[name];
-      if (entry.command !== "npx") {
-        throw new Error(`${name} should use npx, got ${entry.command}`);
+      const cli = path.join(tmpRoot, "node_modules", "0xray", "dist", "cli", "index.js");
+      const args = Array.isArray(entry.args) ? entry.args.map(String) : [];
+      const launcher = path.join(nmRoot, "scripts", "node", "mcp-launch.cjs");
+      if (entry.command !== "node" || args[0] !== launcher || args[1] !== "--keep") {
+        throw new Error(`${name} must launch via node mcp-launch.cjs --keep, got ${entry.command} ${args.join(" ")}`);
+      }
+      const dash = args.indexOf("--");
+      if (dash < 0) throw new Error(`${name} launcher args missing --`);
+      const kept = String(args[2] || "").split(",").filter(Boolean);
+      const inner = args.slice(dash + 1);
+      const pinnedNode = inner[0] === "node" && inner[1] === cli && inner[2] === "mcp";
+      const pinnedNpx =
+        inner[0] === "npx" && inner[1] === "-y" && /^0xray@\d/.test(inner[2] || "") && inner[3] === "mcp";
+      if (!pinnedNode && !pinnedNpx) {
+        throw new Error(`${name} must pin node CLI or npx 0xray@version after --, got ${inner.join(" ")}`);
+      }
+      if (inner.includes("0xray")) {
+        throw new Error(`${name} launched unpinned 0xray`);
+      }
+      for (const required of ["PATH", "HOME", "XRAY_ROOT"]) {
+        if (!kept.includes(required)) {
+          throw new Error(`${name} keep list missing ${required}`);
+        }
+      }
+      if (entry.env && (entry.env.PATH || entry.env.HOME)) {
+        throw new Error(`${name} baked PATH or HOME into the env block`);
+      }
+      for (const arg of args) {
+        if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(arg)) {
+          throw new Error(`${name} put an env assignment in argv: ${arg.split("=")[0]}`);
+        }
+      }
+      for (const banned of ["NPM_TOKEN", "CURSOR_AUTH_TOKEN", "GITHUB_TOKEN", "GH_TOKEN", "RAILWAY_TOKEN"]) {
+        if (kept.includes(banned) || (entry.env && Object.prototype.hasOwnProperty.call(entry.env, banned))) {
+          throw new Error(`${name} inherited ${banned}`);
+        }
       }
     }
-    console.log(`  ✅ .mcp.json has ${XRAY_MCP_NAMES.length} npx MCP servers`);
+    console.log(`  ✅ .mcp.json has ${XRAY_MCP_NAMES.length} version-pinned MCP servers`);
 
     assertFreshInstallDefaults(tmpRoot, version);
     assertOrganRequire(tmpRoot);

package/scripts/node/install-bridges.cjs

@@ -22,6 +22,10 @@ const {
   wireOpencodeBridge,
   wireOpenClawBridge,
   deployPortableProjectMcpJson,
+  scopedMcpLaunch,
+  mergeMcpMap,
+  mergeNamedRecords,
+  jsonDeepEqual,
   copyHermesFindProjectRootHelper,
   copyHermesHookRuntimes,
   installOpenClawHostWear,
@@ -199,10 +203,21 @@ function mergeOpencodeJson(targetDir, packageRoot, log) {
     if (fs.existsSync(userOpencode)) {
       const destData = JSON.parse(fs.readFileSync(userOpencode, "utf8"));
       const merged = { ...destData };
-      if (srcData.agent) merged.agent = srcData.agent;
-      if (srcData.mcp) merged.mcp = { ...destData.mcp, ...srcData.mcp };
-      if (srcData.compaction) merged.compaction = srcData.compaction;
-      fs.writeFileSync(userOpencode, JSON.stringify(merged, null, 2) + "\n");
+      if (srcData.agent || destData.agent) {
+        merged.agent = mergeNamedRecords(srcData.agent, destData.agent);
+      }
+      if (srcData.mcp || destData.mcp) {
+        merged.mcp = mergeMcpMap(srcData.mcp, destData.mcp, targetDir);
+      }
+      if (srcData.compaction || destData.compaction) {
+        merged.compaction =
+          srcData.compaction && destData.compaction
+            ? { ...srcData.compaction, ...destData.compaction }
+            : destData.compaction || srcData.compaction;
+      }
+      if (!jsonDeepEqual(merged, destData)) {
+        fs.writeFileSync(userOpencode, JSON.stringify(merged, null, 2) + "\n");
+      }
     } else {
       fs.copyFileSync(rootOpencode, userOpencode);
     }
@@ -308,13 +323,13 @@ function copyOpencodePlugin(packageRoot, opencodeDest, log) {
   if (!fs.existsSync(pluginSource)) return;
   const pluginDestDir = path.dirname(pluginDest);
   if (!fs.existsSync(pluginDestDir)) fs.mkdirSync(pluginDestDir, { recursive: true });
-  const shouldCopy =
-    !fs.existsSync(pluginDest) ||
-    fs.statSync(pluginSource).mtime > fs.statSync(pluginDest).mtime;
-  if (shouldCopy) {
-    fs.copyFileSync(pluginSource, pluginDest);
-    log("opencode-bridge", "plugin updated", "info");
+  const scopePkg = path.join(opencodeDest, "package.json");
+  if (!fs.existsSync(scopePkg)) {
+    fs.writeFileSync(scopePkg, `${JSON.stringify({ type: "module" })}\n`);
   }
+  const shim = `export { default } from ${JSON.stringify(pluginSource)};\n`;
+  fs.writeFileSync(pluginDest, shim);
+  log("opencode-bridge", "plugin shim written", "info");
 }
 
 function installOpencodeBridge(targetDir, packageRoot, log) {
@@ -368,15 +383,13 @@ function registerGrokMcpServers(targetDir, log, pluginDirs) {
 
   for (const s of XRAY_MCP_SERVERS) {
     try {
-      const envEntries = { ...s.env, XRAY_ROOT: targetDir };
-      const envFlags = Object.entries(envEntries)
-        .map(([k, v]) => `--env "${k}=${v}"`)
-        .join(" ");
-      execSync(
-        `grok mcp add ${s.name} --command npx --args "-y" "0xray" "mcp" "${s.mcpCmd}" ${envFlags}`,
-        { stdio: "pipe" }
-      );
-      log("grok-bridge", `registered ${s.name} (npx)`, "info");
+      const launch = scopedMcpLaunch(targetDir, s.mcpCmd, s.env);
+      const argv = ["mcp", "add", s.name, "--command", launch.command, "--args", launch.args[0], ...launch.args.slice(1)];
+      for (const [key, value] of Object.entries(launch.env)) {
+        argv.push("--env", `${key}=${value}`);
+      }
+      execFileSync("grok", argv, { stdio: "pipe" });
+      log("grok-bridge", `registered ${s.name} (mcp-launch)`, "info");
     } catch {
       // already registered or grok config conflict — non-blocking
     }
@@ -1068,6 +1081,8 @@ module.exports = {
   installFrameworkDogfoodWear,
   wearVendoredRepertoire,
   installCursorBridge,
+  mergeOpencodeJson,
+  copyOpencodePlugin,
   parseExecDaemonCmdline,
   reloadCursorHostHooks,
   resolveCursorHooksTemplate,

package/scripts/node/mcp-launch.cjs

@@ -0,0 +1,70 @@
+#!/usr/bin/env node
+"use strict";
+/**
+ * Start an MCP server with an allowlisted environment.
+ *
+ *   node mcp-launch.cjs --keep PATH,HOME,XRAY_ROOT[,NAME...] -- <cmd> [args...]
+ *
+ * argv carries names only. The host merges the config `env` block onto this
+ * process, so values come from the live environment. The child receives
+ * process.env filtered to those names. stdio is inherited. Signals and the
+ * exit code are forwarded.
+ */
+const { spawn } = require("child_process");
+
+function fail(message) {
+  process.stderr.write(`mcp-launch: ${message}\n`);
+  process.exit(1);
+}
+
+function parseArgs(argv) {
+  const keepIdx = argv.indexOf("--keep");
+  const dash = argv.indexOf("--");
+  if (keepIdx < 0 || dash < 0 || dash !== keepIdx + 2 || dash >= argv.length - 1) {
+    fail("usage: node mcp-launch.cjs --keep NAME[,NAME...] -- <cmd> [args...]");
+  }
+  const keep = argv[keepIdx + 1]
+    .split(",")
+    .map((name) => name.trim())
+    .filter(Boolean);
+  if (keep.length === 0) fail("--keep needs at least one name");
+  for (const name of keep) {
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) fail(`refusing keep name ${name}`);
+  }
+  return { keep, command: argv[dash + 1], args: argv.slice(dash + 2) };
+}
+
+function childEnv(keep) {
+  const env = {};
+  for (const name of keep) {
+    if (process.env[name] != null) env[name] = process.env[name];
+  }
+  return env;
+}
+
+function main() {
+  const { keep, command, args } = parseArgs(process.argv.slice(2));
+  const child = spawn(command, args, { env: childEnv(keep), stdio: "inherit" });
+  const forward = (signal) => {
+    if (!child.pid) return;
+    try {
+      child.kill(signal);
+    } catch {
+      /* child already exited */
+    }
+  };
+  for (const signal of ["SIGINT", "SIGTERM", "SIGHUP"]) {
+    process.on(signal, () => forward(signal));
+  }
+  child.on("error", (err) => fail(err.message));
+  child.on("exit", (code, signal) => {
+    if (signal) {
+      process.removeAllListeners(signal);
+      process.kill(process.pid, signal);
+      return;
+    }
+    process.exit(code == null ? 1 : code);
+  });
+}
+
+main();

package/scripts/node/postinstall.cjs

@@ -25,6 +25,8 @@ function structuredLog(component, action, status, details) {
 }
 
 const XRAY_MANAGED_AGENTS_MARKER = "<!-- 0xray-managed -->";
+const XRAY_MANAGED_AGENTS_BEGIN = "<!-- 0xray-managed:begin -->";
+const XRAY_MANAGED_AGENTS_END = "<!-- 0xray-managed:end -->";
 
 function fillConsumerPlaceholders(content, consumer) {
   const name = consumer.name || "this project";
@@ -36,24 +38,51 @@ function fillConsumerPlaceholders(content, consumer) {
     .join(versionParen);
 }
 
+function renderManagedAgents(packageRoot, targetDir) {
+  let content = fs.readFileSync(path.join(packageRoot, "AGENTS-consumer.md"), "utf8");
+  const consumer = readPackageIdentity(path.join(targetDir, "package.json"));
+  content = fillConsumerPlaceholders(content, consumer).trim();
+  if (!content.includes(XRAY_MANAGED_AGENTS_MARKER)) {
+    content = `${content}\n\n${XRAY_MANAGED_AGENTS_MARKER}`;
+  }
+  return `${XRAY_MANAGED_AGENTS_BEGIN}\n${content}\n${XRAY_MANAGED_AGENTS_END}\n`;
+}
+
+function managedRegion(text) {
+  const beginAt = text.indexOf(XRAY_MANAGED_AGENTS_BEGIN);
+  const endAt = text.indexOf(XRAY_MANAGED_AGENTS_END);
+  if (beginAt === -1 || endAt === -1 || endAt < beginAt) return null;
+  return {
+    before: text.slice(0, beginAt),
+    after: text.slice(endAt + XRAY_MANAGED_AGENTS_END.length),
+  };
+}
+
+function outsideRegionEdited(parts) {
+  return parts.before.trim() !== "" || parts.after.trim() !== "";
+}
+
 function deployManagedAgents(packageRoot, targetDir, log) {
   const agentsConsumer = path.join(packageRoot, "AGENTS-consumer.md");
   const agentsDest = path.join(targetDir, "AGENTS.md");
   if (!fs.existsSync(agentsConsumer)) return;
-  const shouldDeployAgents =
-    !fs.existsSync(agentsDest) ||
-    fs.readFileSync(agentsDest, "utf8").includes(XRAY_MANAGED_AGENTS_MARKER);
-  if (shouldDeployAgents) {
-    let content = fs.readFileSync(agentsConsumer, "utf8");
-    const consumer = readPackageIdentity(path.join(targetDir, "package.json"));
-    content = fillConsumerPlaceholders(content, consumer);
-    if (!content.includes(XRAY_MANAGED_AGENTS_MARKER)) {
-      content = `${content.trimEnd()}\n\n${XRAY_MANAGED_AGENTS_MARKER}\n`;
-    }
-    fs.writeFileSync(agentsDest, content);
-  } else {
-    log("postinstall", "Skipped AGENTS.md (consumer-customized)", "info");
+  const next = renderManagedAgents(packageRoot, targetDir);
+  if (!fs.existsSync(agentsDest)) {
+    fs.writeFileSync(agentsDest, next);
+    return;
+  }
+  const current = fs.readFileSync(agentsDest, "utf8");
+  const parts = managedRegion(current);
+  if (!parts || outsideRegionEdited(parts)) {
+    fs.writeFileSync(path.join(targetDir, "AGENTS.md.0xray-new"), next);
+    log("postinstall", "AGENTS.md left in place; wrote AGENTS.md.0xray-new", "info");
+    return;
   }
+  const beginAt = next.indexOf(XRAY_MANAGED_AGENTS_BEGIN);
+  const endAt = next.indexOf(XRAY_MANAGED_AGENTS_END);
+  const interior = next.slice(beginAt, endAt + XRAY_MANAGED_AGENTS_END.length);
+  const updated = `${parts.before}${interior}${parts.after}`;
+  if (updated !== current) fs.writeFileSync(agentsDest, updated);
 }
 
 function deployConsumerGitignore(packageRoot, targetDir, log) {

package/src/integrations/openclaw/plugin/xray-pre-tool/package.json

@@ -1,6 +1,6 @@
 {
   "name": "xray-pre-tool",
-  "version": "4.0.27",
+  "version": "4.0.28",
   "private": true,
   "type": "module",
   "description": "0xRay constitution + temperament PreToolUse for OpenClaw",

package/xray/features.json

@@ -1,6 +1,6 @@
 {
   "$schema": "./features.schema.json",
-  "version": "4.0.27",
+  "version": "4.0.28",
   "description": "0xRay Framework - Unified Feature Configuration",
   "suit_temperament": {
     "profile": "auto",