0xray 4.0.29 → 4.0.30

package/.grok-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "0xray",
-  "version": "4.0.29",
+  "version": "4.0.30",
   "description": "0xRay suit for Grok, Hermes, OpenClaw, OpenCode: mill+inspect, Codex, 7 MCP servers. Costume 45/42 is opt-in foundry, not the default wear.",
   "author": {
     "name": "0xRay AI",

package/.xray/features.json

@@ -1,6 +1,6 @@
 {
   "$schema": "./features.schema.json",
-  "version": "4.0.29",
+  "version": "4.0.30",
   "description": "0xRay Framework - Unified Feature Configuration",
   "suit_temperament": {
     "profile": "auto",

package/README.md

@@ -52,6 +52,7 @@ Docs: [guides/autonomy-command](docs-site/docs/guides/autonomy-command.md) · Sk
 | Version | Highlights |
 |---------|------------|
 | **Unreleased** | Fasten is **foundry-plant/0**: builtin plant is mill+inspect only. `foundry.json` `"plant": "@0xray/blip"` (aliases `"plant": "blip"` / `"plant": "sound"`) fastens whatever that mill declares (looker / vibe / mixer live in the mill). Nested mill `@0xray/foundry@0.1.12`. CLI shims `foundry blip\|sound` remain (0.1.11+). Shop plant first-class (`shop-extract`, `shop-witness`, `shop-pin` + `foundry.json` `shopPlant`). |
+| **4.0.30** | Fixes 4.0.29: `npx 0xray wear` and `setup` work outside a git checkout again. They write the 4.0.28 project setup, skip only Cursor hooks, and print one warning. Inside a git checkout they restore the 4.0.28 project setup, and `wear` adds Cursor hooks plus the unwear snapshot. Companion `@0xray/grok-bot` 0.1.8. Released 2026-09-28. |
 | **4.0.29** | `npm install` only creates the relative `node_modules/@0xray/repertoire` link to the vendored repertoire and prints `npx 0xray wear`. Run `npx 0xray wear` after install. Wear writes only the consumer project's `.cursor/hooks.json` (installed dist hooks, beside user entries); `npx 0xray unwear` restores the snapshot. Companion `@0xray/grok-bot` 0.1.8. Released 2026-09-28. |
 | **4.0.28** | MCP servers start through `scripts/node/mcp-launch.cjs` and only see PATH, HOME, XRAY_ROOT, plus names on their keep list. Tokens such as NPM_TOKEN are not inherited. User env values stay out of argv. Postinstall keeps user edits to AGENTS.md, .mcp.json, and opencode.json. `house init` does not copy EXAMPLE.md; doctor FAILs while `house/EXAMPLE.md` exists. Inspect adds a machinePlugin check. The Cursor hook defaults XRAY_ROOT to the suit. Companion `@0xray/grok-bot` 0.1.7. Released 2026-09-27. |
 | **4.0.27** | Host compact proof needs a generation id and a numeric usage percent, and the same preCompact receipt is mirrored to nested consumer wear roots. Memory scoring: [docs/memory-scoring.md](docs/memory-scoring.md) (orchestrator links it). Companion `@0xray/grok-bot` 0.1.6: general page vs `house/` overlay, `templates/house/`, `grok-bot house init`, doctor `GROK_BOT_HOUSE` or walk-up. Released 2026-09-26. |

package/dist/CHANGELOG.md

@@ -41,6 +41,14 @@ The format is based on [Conventional Commits](https://www.conventionalcommits.or
 - Archive root `integrations/` costume SKILL dump → `docs/archive/integrations-costume/`. Live wear is `src/integrations`.
 - Archive root `commands/` stale copy → `docs/archive/commands-copy/`. Live wear is `src/opencode/commands`.
 
+## [4.0.30] - 2026-09-28
+
+Next patch after npm `4.0.29`. Released 2026-09-28.
+
+Fixes the 4.0.29 regression where `npx 0xray wear` and `npx 0xray setup` exited 1 with `cursor-wear: not a git work tree` outside a git checkout (#147). Outside a git checkout, both commands again write the 4.0.28 consumer project setup and skip only Cursor hooks, with one stderr line: `cursor-wear: hooks skipped because this folder is not a git checkout`. Inside a git checkout, `wear` and `setup` restore the 4.0.28 project setup that 4.0.29 had dropped: managed `AGENTS.md`, `.gitignore` entries, `.xray` config, the `node_modules/@0xray/repertoire` link, the mill/inspect plant, chat bridges, the `.opencode/skills` sync, and the `dist` / `scripts` links. `wear` then adds the Cursor hooks, including the six hook scripts, and the `.xray/state/cursor-hook-wear/` snapshot. Postinstall is unchanged: it links the vendored repertoire and prints `npx 0xray wear`. Companion package `@0xray/grok-bot` is unchanged at 0.1.8.
+
+---
+
 ## [4.0.29] - 2026-09-28
 
 Next patch after npm `4.0.28`. Released 2026-09-28.

package/dist/README.md

@@ -52,6 +52,7 @@ Docs: [guides/autonomy-command](docs-site/docs/guides/autonomy-command.md) · Sk
 | Version | Highlights |
 |---------|------------|
 | **Unreleased** | Fasten is **foundry-plant/0**: builtin plant is mill+inspect only. `foundry.json` `"plant": "@0xray/blip"` (aliases `"plant": "blip"` / `"plant": "sound"`) fastens whatever that mill declares (looker / vibe / mixer live in the mill). Nested mill `@0xray/foundry@0.1.12`. CLI shims `foundry blip\|sound` remain (0.1.11+). Shop plant first-class (`shop-extract`, `shop-witness`, `shop-pin` + `foundry.json` `shopPlant`). |
+| **4.0.30** | Fixes 4.0.29: `npx 0xray wear` and `setup` work outside a git checkout again. They write the 4.0.28 project setup, skip only Cursor hooks, and print one warning. Inside a git checkout they restore the 4.0.28 project setup, and `wear` adds Cursor hooks plus the unwear snapshot. Companion `@0xray/grok-bot` 0.1.8. Released 2026-09-28. |
 | **4.0.29** | `npm install` only creates the relative `node_modules/@0xray/repertoire` link to the vendored repertoire and prints `npx 0xray wear`. Run `npx 0xray wear` after install. Wear writes only the consumer project's `.cursor/hooks.json` (installed dist hooks, beside user entries); `npx 0xray unwear` restores the snapshot. Companion `@0xray/grok-bot` 0.1.8. Released 2026-09-28. |
 | **4.0.28** | MCP servers start through `scripts/node/mcp-launch.cjs` and only see PATH, HOME, XRAY_ROOT, plus names on their keep list. Tokens such as NPM_TOKEN are not inherited. User env values stay out of argv. Postinstall keeps user edits to AGENTS.md, .mcp.json, and opencode.json. `house init` does not copy EXAMPLE.md; doctor FAILs while `house/EXAMPLE.md` exists. Inspect adds a machinePlugin check. The Cursor hook defaults XRAY_ROOT to the suit. Companion `@0xray/grok-bot` 0.1.7. Released 2026-09-27. |
 | **4.0.27** | Host compact proof needs a generation id and a numeric usage percent, and the same preCompact receipt is mirrored to nested consumer wear roots. Memory scoring: [docs/memory-scoring.md](docs/memory-scoring.md) (orchestrator links it). Companion `@0xray/grok-bot` 0.1.6: general page vs `house/` overlay, `templates/house/`, `grok-bot house init`, doctor `GROK_BOT_HOUSE` or walk-up. Released 2026-09-26. |

package/dist/integrations/openclaw/plugin/xray-pre-tool/package.json

@@ -1,6 +1,6 @@
 {
   "name": "xray-pre-tool",
-  "version": "4.0.29",
+  "version": "4.0.30",
   "private": true,
   "type": "module",
   "description": "0xRay constitution + temperament PreToolUse for OpenClaw",

package/llms.txt

@@ -14,6 +14,7 @@ Default consumer wear is **mill plant** (`mill` + `inspect`), not a 45-skill / 4
 - `@0xray/grok-bot`: the general page is `grok-bot/OP-PROC.md`. The team overlay is `house/` and is not in that npm pack. `templates/house/` ships. `grok-bot house init` copies the template and refuses to overwrite. Doctor uses `GROK_BOT_HOUSE` when set, otherwise walks up from the working directory for `house/HOUSE.md`.
 - MCP servers start through `scripts/node/mcp-launch.cjs`. They see PATH, HOME, and XRAY_ROOT, plus the names on their keep list. Tokens such as NPM_TOKEN are not inherited. User env values stay out of argv. Postinstall keeps user edits to AGENTS.md, `.mcp.json`, and `opencode.json`. `house init` does not copy EXAMPLE.md. Doctor FAILs while `house/EXAMPLE.md` exists. Inspect has a machinePlugin check. The Cursor hook defaults XRAY_ROOT to the suit directory.
 - `npm install` only creates the relative `node_modules/@0xray/repertoire` link to the vendored repertoire and prints `npx 0xray wear`. Run `npx 0xray wear` after install; it writes only the consumer project's `.cursor/hooks.json`. `npx 0xray unwear` restores the pre-wear snapshot.
+- 4.0.30: `npx 0xray wear` and `setup` also work outside a git checkout. They write the 4.0.28 project setup and skip only Cursor hooks, with one warning. In a git checkout they write the 4.0.28 project setup plus Cursor hooks.
 
 - `npx @0xray/foundry mint --skip-live` — re-fasten mill plant, then inspect.
 - `npx @0xray/foundry inspect --skip-live` — plant-vs-worn, receipt, CI. Chat is not a receipt.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "0xray",
-  "version": "4.0.29",
+  "version": "4.0.30",
   "description": "Multi-agent orchestration and Codex governance for OpenCode, Hermes, Grok Build, and OpenClaw",
   "readme": "README.md",
   "license": "MIT",
@@ -82,7 +82,7 @@
     "test:miscellaneous": "npm test -- src/__tests__/unit/blocked-test.test.ts",
     "test:grok-bot": "npm test -- src/__tests__/unit/grok-bot-seat-doctor.test.ts src/__tests__/unit/grok-bot-op-proc-map.test.ts src/__tests__/unit/lead-cadence.test.ts src/__tests__/unit/grok-bot-auto-review-policy.test.ts",
     "test:quick": "npm test -- src/__tests__/integration/boot-orchestrator.integration.test.ts src/__tests__/unit/config-loader.test.ts src/__tests__/unit/state-manager.test.ts",
-    "test:comprehensive": "npm run typecheck && npm run test:unit && npm run test:core-framework && npm run test:security && npm run test:performance && npm run test:session-management && npm run test:code-analysis && npm run test:processors && npm run test:miscellaneous && npm test -- src/__tests__/unit/llm-governance-provider.test.ts src/__tests__/unit/mcp-server-smoke.test.ts src/__tests__/unit/cursor-hooks.test.ts src/__tests__/unit/host-vs-mill-score.test.ts && npm run test:grok-bot",
+    "test:comprehensive": "npm run typecheck && npm run test:unit && npm run test:core-framework && npm run test:security && npm run test:performance && npm run test:session-management && npm run test:code-analysis && npm run test:processors && npm run test:miscellaneous && npm test -- src/__tests__/unit/llm-governance-provider.test.ts src/__tests__/unit/mcp-server-smoke.test.ts src/__tests__/unit/cursor-hooks.test.ts src/__tests__/unit/host-vs-mill-score.test.ts src/__tests__/unit/wear-pack-file-list.test.ts && npm run test:grok-bot",
     "test:integration-all": "npm test -- src/__tests__/integration/",
     "test:performance-all": "npm test -- src/__tests__/performance/ src/__tests__/unit/performance-system.test.ts src/__tests__/unit/benchmark.test.ts src/__tests__/unit/analytics.test.ts",
     "test:agents-all": "echo 'Legacy agents test entry retired'",

package/scripts/node/install-bridges.cjs

@@ -1615,11 +1615,11 @@ function userBytesBeforeWear(previousText) {
   return stripOwnedHookEntries(previousText);
 }
 
-function assertCursorWearGit(targetDir) {
+function classifyCursorWearGit(targetDir) {
   try {
     execFileSync("git", ["--version"], { stdio: "ignore" });
   } catch {
-    throw new Error("cursor-wear: git is missing");
+    return "missing";
   }
   let bare = "";
   try {
@@ -1629,9 +1629,9 @@ function assertCursorWearGit(targetDir) {
       stdio: ["ignore", "pipe", "pipe"],
     }).trim();
   } catch {
-    throw new Error("cursor-wear: not a git work tree");
+    return "not-work-tree";
   }
-  if (bare === "true") throw new Error("cursor-wear: bare repository");
+  if (bare === "true") return "bare";
   let inside = "";
   try {
     inside = execFileSync("git", ["rev-parse", "--is-inside-work-tree"], {
@@ -1640,9 +1640,98 @@ function assertCursorWearGit(targetDir) {
       stdio: ["ignore", "pipe", "pipe"],
     }).trim();
   } catch {
-    throw new Error("cursor-wear: not a git work tree");
+    return "not-work-tree";
+  }
+  if (inside !== "true") return "not-work-tree";
+  return "ok";
+}
+
+function assertCursorWearGit(targetDir) {
+  const kind = classifyCursorWearGit(targetDir);
+  if (kind === "missing") throw new Error("cursor-wear: git is missing");
+  if (kind === "bare") throw new Error("cursor-wear: bare repository");
+  if (kind === "not-work-tree") throw new Error("cursor-wear: not a git work tree");
+}
+
+const CURSOR_HOOKS_SKIPPED_LINE =
+  "cursor-wear: hooks skipped because this folder is not a git checkout\n";
+
+function syncSetupSkillsAndRootLinks(packageRoot, targetDir) {
+  require("./setup.cjs").syncSetupSkillsAndRootLinks(packageRoot, targetDir);
+}
+
+function setupSkillMirrorNames(packageRoot) {
+  const skillsSource = fs.existsSync(path.join(packageRoot, "src", "skills"))
+    ? path.join(packageRoot, "src", "skills")
+    : path.join(packageRoot, "dist", "skills");
+  if (!fs.existsSync(skillsSource)) return new Set();
+  const names = new Set();
+  for (const entry of fs.readdirSync(skillsSource, { withFileTypes: true })) {
+    if (!entry.isDirectory()) continue;
+    if (fs.existsSync(path.join(skillsSource, entry.name, "SKILL.md"))) names.add(entry.name);
   }
-  if (inside !== "true") throw new Error("cursor-wear: not a git work tree");
+  return names;
+}
+
+/** The 4.0.28 skill mirror is not a consumer costume. Any other extra name still throws. */
+function isSetupSkillMirrorDump(err, packageRoot) {
+  if (!err || err.code !== "FOUNDRY_COSTUME_DUMP") return false;
+  if (!Array.isArray(err.extraSkills) || err.extraSkills.length === 0) return false;
+  if (Array.isArray(err.extraAgents) && err.extraAgents.length > 0) return false;
+  const mirrored = setupSkillMirrorNames(packageRoot);
+  return err.extraSkills.every((name) => mirrored.has(name));
+}
+
+function packageShipsConsumerSuit(packageRoot) {
+  return fs.existsSync(path.join(packageRoot, "AGENTS-consumer.md"));
+}
+
+/**
+ * 4.0.28 consumer postinstall files: AGENTS.md, .gitignore, repertoire link,
+ * .xray config, bridges, mill plant, then the setup.cjs skill mirror and
+ * dist/scripts links. Does not install Cursor hooks or git hooks.
+ * Existing user files follow the 4.0.28 guards inside those functions.
+ */
+function installConsumerProjectFiles(packageRoot, targetDir, log) {
+  const write = typeof log === "function" ? log : () => {};
+  if (!isConsumerInstall(packageRoot, targetDir) || !packageShipsConsumerSuit(packageRoot)) {
+    return false;
+  }
+  const { deployManagedAgents } = require("./postinstall.cjs");
+  const { applyConsumerGitignore } = require("./consumer-gitignore.cjs");
+  const { mintConsumerSuit } = require("../foundry/mint-suit.cjs");
+  deployManagedAgents(packageRoot, targetDir, write);
+  applyConsumerGitignore(targetDir, packageRoot);
+  wearVendoredRepertoire(packageRoot, targetDir, write);
+  deployXrayConfig(targetDir, packageRoot, write);
+  deployProjectMcpJson(targetDir, write);
+  mergeOpencodeJson(targetDir, packageRoot, write);
+  installOpencodeBridge(targetDir, packageRoot, write);
+  installGrokBridge(targetDir, packageRoot, write);
+  installHermesBridge(targetDir, packageRoot, write);
+  installOpenclawBridge(targetDir, packageRoot, write);
+  try {
+    mintConsumerSuit(packageRoot, targetDir, write);
+  } catch (err) {
+    if (!isSetupSkillMirrorDump(err, packageRoot)) throw err;
+  }
+  syncSetupSkillsAndRootLinks(packageRoot, targetDir);
+  return true;
+}
+
+/**
+ * 4.0.28 consumer postinstall, minus Cursor hooks and git hooks.
+ * Used only when the folder is not a git work tree.
+ */
+function wearSuitSkippingCursorHooks(packageRoot, targetDir, log) {
+  const write = typeof log === "function" ? log : () => {};
+  if (!installConsumerProjectFiles(packageRoot, targetDir, write)) {
+    if (!isConsumerInstall(packageRoot, targetDir)) {
+      wearVendoredRepertoire(packageRoot, targetDir, write);
+    }
+    syncSetupSkillsAndRootLinks(packageRoot, targetDir);
+  }
+  process.stderr.write(CURSOR_HOOKS_SKIPPED_LINE);
 }
 
 function isGitTracked(targetDir, rel) {
@@ -1794,7 +1883,16 @@ function wearCursorHooks(targetDir, packageRoot, log, opts) {
   const options = opts || {};
   const resolvedTarget = path.resolve(targetDir);
   const resolvedPackage = path.resolve(packageRoot);
+  if (classifyCursorWearGit(resolvedTarget) === "not-work-tree") {
+    wearSuitSkippingCursorHooks(resolvedPackage, resolvedTarget, write);
+    return;
+  }
   assertCursorWearGit(resolvedTarget);
+  if (options.suit !== false) {
+    if (!installConsumerProjectFiles(resolvedPackage, resolvedTarget, write)) {
+      syncSetupSkillsAndRootLinks(resolvedPackage, resolvedTarget);
+    }
+  }
   if (!isConsumerInstall(resolvedPackage, resolvedTarget) || !consumerDistHooksReady(resolvedPackage)) {
     return fastenCursorHooksAt(resolvedTarget, resolvedPackage, write);
   }
@@ -1826,11 +1924,14 @@ function wearCursorHooks(targetDir, packageRoot, log, opts) {
     snap.meta.also = linkedWearRoots(resolvedTarget);
     saveWearState(snap.paths, snap.meta);
     for (const extra of snap.meta.also) {
-      wearCursorHooks(extra, resolvedPackage, write, { outerRoots: false });
+      wearCursorHooks(extra, resolvedPackage, write, { outerRoots: false, suit: false });
       process.stdout.write(`cursor-wear: wrote outer hooks at ${extra}\n`);
     }
     saveWearState(snap.paths, snap.meta);
   }
+  if (options.suit !== false && packageShipsConsumerSuit(resolvedPackage)) {
+    fastenCursorHookScripts(resolvedTarget, resolvedPackage, write);
+  }
   write("cursor-bridge", "hooks.json wired to installed dist", "info", { path: hooksPath });
   return hooksPath;
 }
@@ -1959,12 +2060,19 @@ function setupProjectBridges(opts) {
       : () => {
           /* noop */
         };
+  if (classifyCursorWearGit(targetDir) === "not-work-tree") {
+    wearSuitSkippingCursorHooks(packageRoot, targetDir, log);
+    return;
+  }
   assertSetupGit(targetDir);
-  deployProjectMcpJson(targetDir, log);
-  installOpencodeBridge(targetDir, packageRoot, log);
-  installGrokBridge(targetDir, packageRoot, log);
-  installHermesBridge(targetDir, packageRoot, log);
-  installOpenclawBridge(targetDir, packageRoot, log);
+  if (!installConsumerProjectFiles(packageRoot, targetDir, log)) {
+    syncSetupSkillsAndRootLinks(packageRoot, targetDir);
+    deployProjectMcpJson(targetDir, log);
+    installOpencodeBridge(targetDir, packageRoot, log);
+    installGrokBridge(targetDir, packageRoot, log);
+    installHermesBridge(targetDir, packageRoot, log);
+    installOpenclawBridge(targetDir, packageRoot, log);
+  }
   if (opts.gitHooks === true) installGitHooks(packageRoot, log, targetDir);
 }
 

package/scripts/node/setup.cjs

@@ -3,6 +3,84 @@
 const fs = require("fs");
 const path = require("path");
 
+function syncSetupSkillsAndRootLinks(packageRoot, targetDir) {
+ /* 1. Sync core skills from src/skills/ (dev) or dist/skills/ (consumer) → .opencode/skills/  [P3-SKILLS-DE-DUP-SCOPE-AND-EXEC-01: orchestrator package SSOT canonical src/skills/orchestrator/SKILL.md; mirror .opencode/skills/orchestrator/ is built output of this logic; see paired guarded fw in status.ts getSkillsList + mapping append + deep ref 2026-05-26 authority for one-package dedup under pivoted surgical plan] 
+   [P3-SKILLS-DE-DUP-RESEARCHER-FOLLOW-01: researcher package SSOT canonical src/skills/researcher/SKILL.md (high-value per deep ref + YML precedent + playbook P3-SKILLS-FOLLOW-01); mirror .opencode/skills/researcher/ is built output of this logic; see paired guarded fw in status.ts + rich append + YML @ harness-codex verification (FORCE exercised P3-YML + codex-enforcement + 100/60/0 + 3 subagents tracked + 0 hot + 3-hot re-establish + all prior green) + deep ref 2026-05-26 + Phase 3 Pivot + Term 61 + user's "create a todo list. spawn subagents..." + 6/6+7/7 + YML. Governance-visible hook for skills SSOT at install layer. Silent, additive, reversible, no behavior change, fw/echo only.]
+   [P3-SKILLS-FOLLOW-02: code-review package SSOT canonical src/skills/code-review/SKILL.md (next high-value per deep ref "parallel small batches" + @architect scoping rec 2 + YML @ "Ready for next" + this P3-SKILLS-FOLLOW-02 on user's spawn command); mirror .opencode/skills/code-review/ is built output of this logic; see paired guarded fw "P3-SKILLS-FOLLOW-02-code-review-ssot-preferred" in status.ts (after researcher) + rich append docs/reflections/p3-skills-follow-02-code-review-2026-05-27.md + YML @ harness-codex verification + 0 hot + 3-hot + all ties + ps 0 + this work (2-file surgical edit, harness post, mapping append after latest ~17099+, todo advance 1, spawn replacement, self-audit 100%, green + ready) + deep ref 2026-05-26 + Phase 3 Pivot + Term 61 + 6/6+7/7 + YML. Governance-visible hook for skills SSOT at install layer for code-review. Silent, additive, reversible, no behavior change, fw/echo only. "The box contains its builders. The relay is hot."] */
+const skillsSource = fs.existsSync(path.join(packageRoot, "src", "skills"))
+  ? path.join(packageRoot, "src", "skills")
+  : path.join(packageRoot, "dist", "skills");
+const skillsDest = path.join(targetDir, ".opencode", "skills");
+
+if (fs.existsSync(skillsSource)) {
+  try {
+    if (!fs.existsSync(skillsDest)) fs.mkdirSync(skillsDest, { recursive: true });
+    const skillDirs = fs.readdirSync(skillsSource, { withFileTypes: true });
+    let copied = 0, skipped = 0;
+    for (const entry of skillDirs) {
+      if (!entry.isDirectory()) continue;
+      const skillMd = path.join(skillsSource, entry.name, "SKILL.md");
+      if (!fs.existsSync(skillMd)) continue;
+      const destMd = path.join(skillsDest, entry.name, "SKILL.md");
+      const destDir = path.dirname(destMd);
+      if (!fs.existsSync(destDir)) fs.mkdirSync(destDir, { recursive: true });
+      if (fs.existsSync(destMd)) {
+        const destContent = fs.readFileSync(destMd, "utf8");
+        if (destContent.includes("source: community")) { skipped++; continue; }
+        if (fs.statSync(skillMd).mtime <= fs.statSync(destMd).mtime) continue;
+      }
+      fs.copyFileSync(skillMd, destMd);
+      copied++;
+    }
+    console.log(`✅ Skills: ${copied} updated, ${skipped} community skills preserved`);
+  } catch (e) { console.warn(`⚠️ Skills sync: ${e.message}`); }
+}
+
+// 4. Create scripts symlink
+const scriptsSource = path.join(packageRoot, "scripts");
+const scriptsDest = path.join(targetDir, "scripts");
+
+if (fs.existsSync(scriptsSource)) {
+  try {
+    if (fs.existsSync(scriptsDest)) {
+      const stats = fs.lstatSync(scriptsDest);
+      if (stats.isSymbolicLink()) {
+        console.log("ℹ️  Scripts symlink: exists");
+      } else {
+        console.log("⚠️ Scripts dir exists but is not a symlink");
+      }
+    } else {
+      fs.symlinkSync(scriptsSource, scriptsDest, "dir");
+      console.log("✅ Scripts symlink: created");
+    }
+  } catch (e) { console.warn(`⚠️ Scripts symlink: ${e.message}`); }
+}
+
+// 5. Create dist symlink
+const distSource = path.join(packageRoot, "dist");
+const distDest = path.join(targetDir, "dist");
+
+if (fs.existsSync(distSource)) {
+  try {
+    if (fs.existsSync(distDest)) {
+      const stats = fs.lstatSync(distDest);
+      if (stats.isSymbolicLink()) {
+        console.log("ℹ️  Dist symlink: exists");
+      } else {
+        console.log("⚠️ Dist exists but is not a symlink");
+      }
+    } else {
+      fs.symlinkSync(distSource, distDest, "dir");
+      console.log("✅ Dist symlink: created");
+    }
+  } catch (e) { console.warn(`⚠️ Dist symlink: ${e.message}`); }
+}
+
+}
+
+module.exports = { syncSetupSkillsAndRootLinks };
+
+if (require.main === module) {
 const packageRoot = path.join(__dirname, "..", "..");
 const homeDir = require("os").homedir();
 
@@ -43,37 +121,7 @@ if (hasHermes) {
  * Extended header for next high-value package (code-review). src/skills/code-review/SKILL.md canonical SSOT; .opencode/skills/code-review/ built mirror of this sync logic. See paired guarded fw log "P3-SKILLS-FOLLOW-02-code-review-ssot-preferred" in status.ts getSkillsList (inserted after researcher block) + rich append docs/reflections/p3-skills-follow-02-code-review-2026-05-27.md (per AGENTS) + CGT/Governance-visible for YML @ harness-codex verification + 0 hot + 3-hot re-establish + all ties to spawn command + deep ref + pivot + Term 61 + 6/6+7/7 + YML + ps 0 + this P3-SKILLS-FOLLOW-02 full work (2-file surgical, harness post green tsc 0 new on touched, mapping append after latest, todo advance exactly 1, spawn replacement to maintain 3-hot, self-audit 100%) + verification + "the box contains its builders. The relay is hot.". 2 files max total for this follow-02. Highly modular (100% prior P3-SKILLS/YML/7th pattern reuse exactly inside existing sync logic). Fully reversible (targeted delete of notes restores exact prior). fw/echo discipline. AGENTS org (scripts/ for sh/cjs). Term 61 surgical forward motion held (no bloat, pure on actual dedup). "the box contains its builders". Green + ready. Subagent ID for resume.
  */
 
- /* 1. Sync core skills from src/skills/ (dev) or dist/skills/ (consumer) → .opencode/skills/  [P3-SKILLS-DE-DUP-SCOPE-AND-EXEC-01: orchestrator package SSOT canonical src/skills/orchestrator/SKILL.md; mirror .opencode/skills/orchestrator/ is built output of this logic; see paired guarded fw in status.ts getSkillsList + mapping append + deep ref 2026-05-26 authority for one-package dedup under pivoted surgical plan] 
-   [P3-SKILLS-DE-DUP-RESEARCHER-FOLLOW-01: researcher package SSOT canonical src/skills/researcher/SKILL.md (high-value per deep ref + YML precedent + playbook P3-SKILLS-FOLLOW-01); mirror .opencode/skills/researcher/ is built output of this logic; see paired guarded fw in status.ts + rich append + YML @ harness-codex verification (FORCE exercised P3-YML + codex-enforcement + 100/60/0 + 3 subagents tracked + 0 hot + 3-hot re-establish + all prior green) + deep ref 2026-05-26 + Phase 3 Pivot + Term 61 + user's "create a todo list. spawn subagents..." + 6/6+7/7 + YML. Governance-visible hook for skills SSOT at install layer. Silent, additive, reversible, no behavior change, fw/echo only.]
-   [P3-SKILLS-FOLLOW-02: code-review package SSOT canonical src/skills/code-review/SKILL.md (next high-value per deep ref "parallel small batches" + @architect scoping rec 2 + YML @ "Ready for next" + this P3-SKILLS-FOLLOW-02 on user's spawn command); mirror .opencode/skills/code-review/ is built output of this logic; see paired guarded fw "P3-SKILLS-FOLLOW-02-code-review-ssot-preferred" in status.ts (after researcher) + rich append docs/reflections/p3-skills-follow-02-code-review-2026-05-27.md + YML @ harness-codex verification + 0 hot + 3-hot + all ties + ps 0 + this work (2-file surgical edit, harness post, mapping append after latest ~17099+, todo advance 1, spawn replacement, self-audit 100%, green + ready) + deep ref 2026-05-26 + Phase 3 Pivot + Term 61 + 6/6+7/7 + YML. Governance-visible hook for skills SSOT at install layer for code-review. Silent, additive, reversible, no behavior change, fw/echo only. "The box contains its builders. The relay is hot."] */
-const skillsSource = fs.existsSync(path.join(packageRoot, "src", "skills"))
-  ? path.join(packageRoot, "src", "skills")
-  : path.join(packageRoot, "dist", "skills");
-const skillsDest = path.join(targetDir, ".opencode", "skills");
-
-if (fs.existsSync(skillsSource)) {
-  try {
-    if (!fs.existsSync(skillsDest)) fs.mkdirSync(skillsDest, { recursive: true });
-    const skillDirs = fs.readdirSync(skillsSource, { withFileTypes: true });
-    let copied = 0, skipped = 0;
-    for (const entry of skillDirs) {
-      if (!entry.isDirectory()) continue;
-      const skillMd = path.join(skillsSource, entry.name, "SKILL.md");
-      if (!fs.existsSync(skillMd)) continue;
-      const destMd = path.join(skillsDest, entry.name, "SKILL.md");
-      const destDir = path.dirname(destMd);
-      if (!fs.existsSync(destDir)) fs.mkdirSync(destDir, { recursive: true });
-      if (fs.existsSync(destMd)) {
-        const destContent = fs.readFileSync(destMd, "utf8");
-        if (destContent.includes("source: community")) { skipped++; continue; }
-        if (fs.statSync(skillMd).mtime <= fs.statSync(destMd).mtime) continue;
-      }
-      fs.copyFileSync(skillMd, destMd);
-      copied++;
-    }
-    console.log(`✅ Skills: ${copied} updated, ${skipped} community skills preserved`);
-  } catch (e) { console.warn(`⚠️ Skills sync: ${e.message}`); }
-}
+syncSetupSkillsAndRootLinks(packageRoot, targetDir);
 
 // 2. Handle opencode.json merge
 const rootOpencodeJson = path.join(packageRoot, "opencode.json");
@@ -121,46 +169,6 @@ if (fs.existsSync(pluginSource)) {
   console.log("ℹ️  Plugin source not found (build may be needed)");
 }
 
-// 4. Create scripts symlink
-const scriptsSource = path.join(packageRoot, "scripts");
-const scriptsDest = path.join(targetDir, "scripts");
-
-if (fs.existsSync(scriptsSource)) {
-  try {
-    if (fs.existsSync(scriptsDest)) {
-      const stats = fs.lstatSync(scriptsDest);
-      if (stats.isSymbolicLink()) {
-        console.log("ℹ️  Scripts symlink: exists");
-      } else {
-        console.log("⚠️ Scripts dir exists but is not a symlink");
-      }
-    } else {
-      fs.symlinkSync(scriptsSource, scriptsDest, "dir");
-      console.log("✅ Scripts symlink: created");
-    }
-  } catch (e) { console.warn(`⚠️ Scripts symlink: ${e.message}`); }
-}
-
-// 5. Create dist symlink
-const distSource = path.join(packageRoot, "dist");
-const distDest = path.join(targetDir, "dist");
-
-if (fs.existsSync(distSource)) {
-  try {
-    if (fs.existsSync(distDest)) {
-      const stats = fs.lstatSync(distDest);
-      if (stats.isSymbolicLink()) {
-        console.log("ℹ️  Dist symlink: exists");
-      } else {
-        console.log("⚠️ Dist exists but is not a symlink");
-      }
-    } else {
-      fs.symlinkSync(distSource, distDest, "dir");
-      console.log("✅ Dist symlink: created");
-    }
-  } catch (e) { console.warn(`⚠️ Dist symlink: ${e.message}`); }
-}
-
 // 6. Convert MCP paths in consumer opencode.json
 const isConsumer = isConsumerInstall(packageRoot, targetDir);
 const consumerPkgName = isConsumer
@@ -234,3 +242,4 @@ if (resolvedPackage !== resolvedTarget) {
 }
 
 console.log("\n✅ xray setup complete.\n");
+}

package/src/integrations/openclaw/plugin/xray-pre-tool/package.json

@@ -1,6 +1,6 @@
 {
   "name": "xray-pre-tool",
-  "version": "4.0.29",
+  "version": "4.0.30",
   "private": true,
   "type": "module",
   "description": "0xRay constitution + temperament PreToolUse for OpenClaw",

package/xray/features.json

@@ -1,6 +1,6 @@
 {
   "$schema": "./features.schema.json",
-  "version": "4.0.29",
+  "version": "4.0.30",
   "description": "0xRay Framework - Unified Feature Configuration",
   "suit_temperament": {
     "profile": "auto",