0xray 4.0.28 → 4.0.30

package/scripts/node/postinstall.cjs

@@ -2,12 +2,8 @@
 
 const fs = require("fs");
 const path = require("path");
-const {
-  installAllBridges,
-  resolveConsumerTargetDir,
-  isConsumerInstall,
-} = require("./install-bridges.cjs");
-const { applyConsumerGitignore } = require("./consumer-gitignore.cjs");
+const { resolveConsumerTargetDir } = require("./install-bridges.cjs");
+const { linkVendoredRepertoire } = require("./wear-vendored-repertoire.cjs");
 const {
   overlayConsumerTree,
   mintConsumerFromSsot,
@@ -18,12 +14,6 @@ const {
   readPackageIdentity,
 } = require("../foundry/mint-suit.cjs");
 
-function structuredLog(component, action, status, details) {
-  const ts = new Date().toISOString();
-  const detailsPart = details ? ` | ${JSON.stringify(details)}` : "";
-  console.log(`${ts} [${component}] ${action} - ${String(status).toUpperCase()}${detailsPart}`);
-}
-
 const XRAY_MANAGED_AGENTS_MARKER = "<!-- 0xray-managed -->";
 const XRAY_MANAGED_AGENTS_BEGIN = "<!-- 0xray-managed:begin -->";
 const XRAY_MANAGED_AGENTS_END = "<!-- 0xray-managed:end -->";
@@ -85,53 +75,10 @@ function deployManagedAgents(packageRoot, targetDir, log) {
   if (updated !== current) fs.writeFileSync(agentsDest, updated);
 }
 
-function deployConsumerGitignore(packageRoot, targetDir, log) {
-  const gitignoreResult = applyConsumerGitignore(targetDir, packageRoot);
-  if (gitignoreResult === "created") {
-    log("postinstall", "Created .gitignore from template", "info");
-  } else if (gitignoreResult === "merged") {
-    log("postinstall", "Merged 0xray suit entries into .gitignore", "info");
-  }
-}
-
-/**
- * Wear bridges for consumers (full 4-platform) and the framework repo (dogfood).
- * installAllBridges already decides which path.
- */
-function runPostinstall(packageRoot, targetDir, log) {
-  const logFn = log || structuredLog;
-  const resolvedPackage = path.resolve(packageRoot);
-  const resolvedTarget = path.resolve(targetDir);
-  const consumer = isConsumerInstall(resolvedPackage, resolvedTarget);
-
-  if (consumer) {
-    deployManagedAgents(resolvedPackage, resolvedTarget, logFn);
-    deployConsumerGitignore(resolvedPackage, resolvedTarget, logFn);
-  }
-
-  try {
-    installAllBridges({
-      targetDir: resolvedTarget,
-      packageRoot: resolvedPackage,
-      log: logFn,
-    });
-    if (consumer) {
-      mintConsumerSuit(resolvedPackage, resolvedTarget, logFn);
-    }
-  } catch (e) {
-    logFn("postinstall", "Bridge install failed", "error", { error: e.message });
-    throw e;
-  }
-
-  if (consumer) {
-    logFn(
-      "postinstall",
-      "0xRay framework installed (4 bridges). Run `npx 0xray setup` for symlinks/Hermes skill extras.",
-      "success",
-    );
-  } else {
-    logFn("postinstall", "framework dogfood wear complete", "success");
-  }
+/** npm install links vendored @0xray/repertoire and nothing else. The suit is `npx 0xray wear`. */
+function runPostinstall(packageRoot, targetDir, _log) {
+  linkVendoredRepertoire(packageRoot, targetDir);
+  console.log("Run `npx 0xray wear`");
 }
 
 module.exports = {

package/scripts/node/setup.cjs

@@ -3,6 +3,84 @@
 const fs = require("fs");
 const path = require("path");
 
+function syncSetupSkillsAndRootLinks(packageRoot, targetDir) {
+ /* 1. Sync core skills from src/skills/ (dev) or dist/skills/ (consumer) → .opencode/skills/  [P3-SKILLS-DE-DUP-SCOPE-AND-EXEC-01: orchestrator package SSOT canonical src/skills/orchestrator/SKILL.md; mirror .opencode/skills/orchestrator/ is built output of this logic; see paired guarded fw in status.ts getSkillsList + mapping append + deep ref 2026-05-26 authority for one-package dedup under pivoted surgical plan] 
+   [P3-SKILLS-DE-DUP-RESEARCHER-FOLLOW-01: researcher package SSOT canonical src/skills/researcher/SKILL.md (high-value per deep ref + YML precedent + playbook P3-SKILLS-FOLLOW-01); mirror .opencode/skills/researcher/ is built output of this logic; see paired guarded fw in status.ts + rich append + YML @ harness-codex verification (FORCE exercised P3-YML + codex-enforcement + 100/60/0 + 3 subagents tracked + 0 hot + 3-hot re-establish + all prior green) + deep ref 2026-05-26 + Phase 3 Pivot + Term 61 + user's "create a todo list. spawn subagents..." + 6/6+7/7 + YML. Governance-visible hook for skills SSOT at install layer. Silent, additive, reversible, no behavior change, fw/echo only.]
+   [P3-SKILLS-FOLLOW-02: code-review package SSOT canonical src/skills/code-review/SKILL.md (next high-value per deep ref "parallel small batches" + @architect scoping rec 2 + YML @ "Ready for next" + this P3-SKILLS-FOLLOW-02 on user's spawn command); mirror .opencode/skills/code-review/ is built output of this logic; see paired guarded fw "P3-SKILLS-FOLLOW-02-code-review-ssot-preferred" in status.ts (after researcher) + rich append docs/reflections/p3-skills-follow-02-code-review-2026-05-27.md + YML @ harness-codex verification + 0 hot + 3-hot + all ties + ps 0 + this work (2-file surgical edit, harness post, mapping append after latest ~17099+, todo advance 1, spawn replacement, self-audit 100%, green + ready) + deep ref 2026-05-26 + Phase 3 Pivot + Term 61 + 6/6+7/7 + YML. Governance-visible hook for skills SSOT at install layer for code-review. Silent, additive, reversible, no behavior change, fw/echo only. "The box contains its builders. The relay is hot."] */
+const skillsSource = fs.existsSync(path.join(packageRoot, "src", "skills"))
+  ? path.join(packageRoot, "src", "skills")
+  : path.join(packageRoot, "dist", "skills");
+const skillsDest = path.join(targetDir, ".opencode", "skills");
+
+if (fs.existsSync(skillsSource)) {
+  try {
+    if (!fs.existsSync(skillsDest)) fs.mkdirSync(skillsDest, { recursive: true });
+    const skillDirs = fs.readdirSync(skillsSource, { withFileTypes: true });
+    let copied = 0, skipped = 0;
+    for (const entry of skillDirs) {
+      if (!entry.isDirectory()) continue;
+      const skillMd = path.join(skillsSource, entry.name, "SKILL.md");
+      if (!fs.existsSync(skillMd)) continue;
+      const destMd = path.join(skillsDest, entry.name, "SKILL.md");
+      const destDir = path.dirname(destMd);
+      if (!fs.existsSync(destDir)) fs.mkdirSync(destDir, { recursive: true });
+      if (fs.existsSync(destMd)) {
+        const destContent = fs.readFileSync(destMd, "utf8");
+        if (destContent.includes("source: community")) { skipped++; continue; }
+        if (fs.statSync(skillMd).mtime <= fs.statSync(destMd).mtime) continue;
+      }
+      fs.copyFileSync(skillMd, destMd);
+      copied++;
+    }
+    console.log(`✅ Skills: ${copied} updated, ${skipped} community skills preserved`);
+  } catch (e) { console.warn(`⚠️ Skills sync: ${e.message}`); }
+}
+
+// 4. Create scripts symlink
+const scriptsSource = path.join(packageRoot, "scripts");
+const scriptsDest = path.join(targetDir, "scripts");
+
+if (fs.existsSync(scriptsSource)) {
+  try {
+    if (fs.existsSync(scriptsDest)) {
+      const stats = fs.lstatSync(scriptsDest);
+      if (stats.isSymbolicLink()) {
+        console.log("ℹ️  Scripts symlink: exists");
+      } else {
+        console.log("⚠️ Scripts dir exists but is not a symlink");
+      }
+    } else {
+      fs.symlinkSync(scriptsSource, scriptsDest, "dir");
+      console.log("✅ Scripts symlink: created");
+    }
+  } catch (e) { console.warn(`⚠️ Scripts symlink: ${e.message}`); }
+}
+
+// 5. Create dist symlink
+const distSource = path.join(packageRoot, "dist");
+const distDest = path.join(targetDir, "dist");
+
+if (fs.existsSync(distSource)) {
+  try {
+    if (fs.existsSync(distDest)) {
+      const stats = fs.lstatSync(distDest);
+      if (stats.isSymbolicLink()) {
+        console.log("ℹ️  Dist symlink: exists");
+      } else {
+        console.log("⚠️ Dist exists but is not a symlink");
+      }
+    } else {
+      fs.symlinkSync(distSource, distDest, "dir");
+      console.log("✅ Dist symlink: created");
+    }
+  } catch (e) { console.warn(`⚠️ Dist symlink: ${e.message}`); }
+}
+
+}
+
+module.exports = { syncSetupSkillsAndRootLinks };
+
+if (require.main === module) {
 const packageRoot = path.join(__dirname, "..", "..");
 const homeDir = require("os").homedir();
 
@@ -43,37 +121,7 @@ if (hasHermes) {
  * Extended header for next high-value package (code-review). src/skills/code-review/SKILL.md canonical SSOT; .opencode/skills/code-review/ built mirror of this sync logic. See paired guarded fw log "P3-SKILLS-FOLLOW-02-code-review-ssot-preferred" in status.ts getSkillsList (inserted after researcher block) + rich append docs/reflections/p3-skills-follow-02-code-review-2026-05-27.md (per AGENTS) + CGT/Governance-visible for YML @ harness-codex verification + 0 hot + 3-hot re-establish + all ties to spawn command + deep ref + pivot + Term 61 + 6/6+7/7 + YML + ps 0 + this P3-SKILLS-FOLLOW-02 full work (2-file surgical, harness post green tsc 0 new on touched, mapping append after latest, todo advance exactly 1, spawn replacement to maintain 3-hot, self-audit 100%) + verification + "the box contains its builders. The relay is hot.". 2 files max total for this follow-02. Highly modular (100% prior P3-SKILLS/YML/7th pattern reuse exactly inside existing sync logic). Fully reversible (targeted delete of notes restores exact prior). fw/echo discipline. AGENTS org (scripts/ for sh/cjs). Term 61 surgical forward motion held (no bloat, pure on actual dedup). "the box contains its builders". Green + ready. Subagent ID for resume.
  */
 
- /* 1. Sync core skills from src/skills/ (dev) or dist/skills/ (consumer) → .opencode/skills/  [P3-SKILLS-DE-DUP-SCOPE-AND-EXEC-01: orchestrator package SSOT canonical src/skills/orchestrator/SKILL.md; mirror .opencode/skills/orchestrator/ is built output of this logic; see paired guarded fw in status.ts getSkillsList + mapping append + deep ref 2026-05-26 authority for one-package dedup under pivoted surgical plan] 
-   [P3-SKILLS-DE-DUP-RESEARCHER-FOLLOW-01: researcher package SSOT canonical src/skills/researcher/SKILL.md (high-value per deep ref + YML precedent + playbook P3-SKILLS-FOLLOW-01); mirror .opencode/skills/researcher/ is built output of this logic; see paired guarded fw in status.ts + rich append + YML @ harness-codex verification (FORCE exercised P3-YML + codex-enforcement + 100/60/0 + 3 subagents tracked + 0 hot + 3-hot re-establish + all prior green) + deep ref 2026-05-26 + Phase 3 Pivot + Term 61 + user's "create a todo list. spawn subagents..." + 6/6+7/7 + YML. Governance-visible hook for skills SSOT at install layer. Silent, additive, reversible, no behavior change, fw/echo only.]
-   [P3-SKILLS-FOLLOW-02: code-review package SSOT canonical src/skills/code-review/SKILL.md (next high-value per deep ref "parallel small batches" + @architect scoping rec 2 + YML @ "Ready for next" + this P3-SKILLS-FOLLOW-02 on user's spawn command); mirror .opencode/skills/code-review/ is built output of this logic; see paired guarded fw "P3-SKILLS-FOLLOW-02-code-review-ssot-preferred" in status.ts (after researcher) + rich append docs/reflections/p3-skills-follow-02-code-review-2026-05-27.md + YML @ harness-codex verification + 0 hot + 3-hot + all ties + ps 0 + this work (2-file surgical edit, harness post, mapping append after latest ~17099+, todo advance 1, spawn replacement, self-audit 100%, green + ready) + deep ref 2026-05-26 + Phase 3 Pivot + Term 61 + 6/6+7/7 + YML. Governance-visible hook for skills SSOT at install layer for code-review. Silent, additive, reversible, no behavior change, fw/echo only. "The box contains its builders. The relay is hot."] */
-const skillsSource = fs.existsSync(path.join(packageRoot, "src", "skills"))
-  ? path.join(packageRoot, "src", "skills")
-  : path.join(packageRoot, "dist", "skills");
-const skillsDest = path.join(targetDir, ".opencode", "skills");
-
-if (fs.existsSync(skillsSource)) {
-  try {
-    if (!fs.existsSync(skillsDest)) fs.mkdirSync(skillsDest, { recursive: true });
-    const skillDirs = fs.readdirSync(skillsSource, { withFileTypes: true });
-    let copied = 0, skipped = 0;
-    for (const entry of skillDirs) {
-      if (!entry.isDirectory()) continue;
-      const skillMd = path.join(skillsSource, entry.name, "SKILL.md");
-      if (!fs.existsSync(skillMd)) continue;
-      const destMd = path.join(skillsDest, entry.name, "SKILL.md");
-      const destDir = path.dirname(destMd);
-      if (!fs.existsSync(destDir)) fs.mkdirSync(destDir, { recursive: true });
-      if (fs.existsSync(destMd)) {
-        const destContent = fs.readFileSync(destMd, "utf8");
-        if (destContent.includes("source: community")) { skipped++; continue; }
-        if (fs.statSync(skillMd).mtime <= fs.statSync(destMd).mtime) continue;
-      }
-      fs.copyFileSync(skillMd, destMd);
-      copied++;
-    }
-    console.log(`✅ Skills: ${copied} updated, ${skipped} community skills preserved`);
-  } catch (e) { console.warn(`⚠️ Skills sync: ${e.message}`); }
-}
+syncSetupSkillsAndRootLinks(packageRoot, targetDir);
 
 // 2. Handle opencode.json merge
 const rootOpencodeJson = path.join(packageRoot, "opencode.json");
@@ -121,46 +169,6 @@ if (fs.existsSync(pluginSource)) {
   console.log("ℹ️  Plugin source not found (build may be needed)");
 }
 
-// 4. Create scripts symlink
-const scriptsSource = path.join(packageRoot, "scripts");
-const scriptsDest = path.join(targetDir, "scripts");
-
-if (fs.existsSync(scriptsSource)) {
-  try {
-    if (fs.existsSync(scriptsDest)) {
-      const stats = fs.lstatSync(scriptsDest);
-      if (stats.isSymbolicLink()) {
-        console.log("ℹ️  Scripts symlink: exists");
-      } else {
-        console.log("⚠️ Scripts dir exists but is not a symlink");
-      }
-    } else {
-      fs.symlinkSync(scriptsSource, scriptsDest, "dir");
-      console.log("✅ Scripts symlink: created");
-    }
-  } catch (e) { console.warn(`⚠️ Scripts symlink: ${e.message}`); }
-}
-
-// 5. Create dist symlink
-const distSource = path.join(packageRoot, "dist");
-const distDest = path.join(targetDir, "dist");
-
-if (fs.existsSync(distSource)) {
-  try {
-    if (fs.existsSync(distDest)) {
-      const stats = fs.lstatSync(distDest);
-      if (stats.isSymbolicLink()) {
-        console.log("ℹ️  Dist symlink: exists");
-      } else {
-        console.log("⚠️ Dist exists but is not a symlink");
-      }
-    } else {
-      fs.symlinkSync(distSource, distDest, "dir");
-      console.log("✅ Dist symlink: created");
-    }
-  } catch (e) { console.warn(`⚠️ Dist symlink: ${e.message}`); }
-}
-
 // 6. Convert MCP paths in consumer opencode.json
 const isConsumer = isConsumerInstall(packageRoot, targetDir);
 const consumerPkgName = isConsumer
@@ -234,3 +242,4 @@ if (resolvedPackage !== resolvedTarget) {
 }
 
 console.log("\n✅ xray setup complete.\n");
+}

package/scripts/node/unwear-cursor-hooks.cjs

@@ -0,0 +1,21 @@
+#!/usr/bin/env node
+/**
+ * Remove the Cursor suit. Prints "restored" only when the file bytes match
+ * the snapshot exactly. A mismatch keeps the snapshot and exits non-zero.
+ *
+ *   npx 0xray unwear
+ *   node node_modules/0xray/scripts/node/unwear-cursor-hooks.cjs [project]
+ */
+const path = require("path");
+const { unwearCursorHooks } = require("./install-bridges.cjs");
+
+const target = path.resolve(process.argv[2] || process.cwd());
+let restored = false;
+try {
+  restored = unwearCursorHooks(target);
+} catch (err) {
+  process.stderr.write(`${err && err.message ? err.message : err}\n`);
+  process.exit(1);
+}
+if (!restored) process.exit(1);
+process.stdout.write(`unwear: restored cursor hooks at ${target}\n`);

package/scripts/node/wear-cursor-hooks.cjs

@@ -0,0 +1,17 @@
+#!/usr/bin/env node
+/**
+ * Wear the Cursor suit in a git work tree.
+ *   npx 0xray wear
+ *   node node_modules/0xray/scripts/node/wear-cursor-hooks.cjs [project]
+ */
+const path = require("path");
+const { wearCursorHooks } = require("./install-bridges.cjs");
+
+const target = path.resolve(process.argv[2] || process.cwd());
+const packageRoot = path.resolve(__dirname, "..", "..");
+try {
+  wearCursorHooks(target, packageRoot, () => {});
+} catch (err) {
+  process.stderr.write(`${err && err.message ? err.message : err}\n`);
+  process.exit(1);
+}

package/scripts/node/wear-vendored-repertoire.cjs

@@ -122,6 +122,38 @@ function wearDestinations(packageRoot, targetDir) {
   return dests;
 }
 
+function repertoireLinkDest(targetDir) {
+  return path.join(targetDir, "node_modules", "@0xray", "repertoire");
+}
+
+function relativeRepertoireLink(vendor, dest) {
+  return path.relative(path.dirname(dest), vendor);
+}
+
+/**
+ * Create one relative symlink at <target>/node_modules/@0xray/repertoire.
+ * A real directory or a symlink that is not this link is left in place.
+ */
+function linkVendoredRepertoire(packageRoot, targetDir) {
+  const vendor = resolveVendoredRepertoire(packageRoot);
+  if (!vendor) return { linked: false, vendor: null, dest: null };
+  const dest = repertoireLinkDest(targetDir);
+  const rel = relativeRepertoireLink(vendor, dest);
+  try {
+    const st = fs.lstatSync(dest);
+    if (st.isSymbolicLink() && fs.readlinkSync(dest) === rel) {
+      return { linked: true, vendor, dest, unchanged: true };
+    }
+    return { linked: false, vendor, dest, skipped: true };
+  } catch {
+    /* dest absent */
+  }
+  fs.mkdirSync(path.dirname(dest), { recursive: true });
+  const linkType = process.platform === "win32" ? "junction" : "dir";
+  fs.symlinkSync(rel, dest, linkType);
+  return { linked: true, vendor, dest, unchanged: false };
+}
+
 function wearVendoredRepertoire(packageRoot, targetDir, log) {
   const vendor = resolveVendoredRepertoire(packageRoot);
   if (!vendor) return { worn: [], vendor: null };
@@ -153,6 +185,9 @@ function hasFileProtocolDependency(pkg) {
 module.exports = {
   resolveVendoredRepertoire,
   wearVendoredRepertoire,
+  linkVendoredRepertoire,
+  relativeRepertoireLink,
+  repertoireLinkDest,
   wearDestinations,
   hasFileProtocolDependency,
 };

package/src/integrations/openclaw/plugin/xray-pre-tool/package.json

@@ -1,6 +1,6 @@
 {
   "name": "xray-pre-tool",
-  "version": "4.0.28",
+  "version": "4.0.30",
   "private": true,
   "type": "module",
   "description": "0xRay constitution + temperament PreToolUse for OpenClaw",

package/xray/features.json

@@ -1,6 +1,6 @@
 {
   "$schema": "./features.schema.json",
-  "version": "4.0.28",
+  "version": "4.0.30",
   "description": "0xRay Framework - Unified Feature Configuration",
   "suit_temperament": {
     "profile": "auto",