0xray 4.0.33 → 4.0.35

package/docs-site/docs/plates/processor.md

@@ -5,42 +5,40 @@ sidebar_label: Processor
 
 # Processor
 
-Three pipelines run in parallel. A is the live suit. B is the legacy processor manager. C is mill, git, and CI. Nothing in A is an input to B or C.
+`ProcessorManager` runs the enabled pre processors, then the enabled post processors. Prompt text longer than 10 characters is checked inside the pre pass.
 
 ```
-┌────────────────────────────────────────────────────────────────────────┐
-│ INPUT LAYER                                                            │
-│                                                                        │
-│   ┌──────────────────┐  ┌──────────────────┐  ┌────────────────────┐  │
-│   │ tool / session   │  │ prompt text      │  │ commit / release   │  │
-│   └────────┬─────────┘  └────────┬─────────┘  └─────────┬──────────┘  │
-└────────────┼─────────────────────┼──────────────────────┼─────────────┘
-             v                     v                      v
-┌────────────┼─────────────────────┼──────────────────────┼─────────────┐
-│ PROCESSING LAYER   three parallel pipelines             │             │
-│            │                     │                      │             │
-│  ┌─────────┴──────────┐ ┌────────┴─────────┐ ┌──────────┴──────────┐ │
-│  │ A suit (live OS)   │ │ B legacy manager │ │ C mill / git / CI   │ │
-│  │                    │ │                  │ │                     │ │
-│  │ SessionStart       │ │ prompt-security  │ │ mint                │ │
-│  │        v           │ │        v         │ │        v            │ │
-│  │ PreToolUse         │ │ executePre       │ │ inspect             │ │
-│  │        v           │ │        v         │ │        v            │ │
-│  │ tool runs          │ │ work             │ │ pre-commit          │ │
-│  │        v           │ │        v         │ │        v            │ │
-│  │ PostToolUse        │ │ executePost      │ │ pre-push            │ │
-│  │        v           │ │                  │ │        v            │ │
-│  │ compact heat       │ │                  │ │ foundry release     │ │
-│  │                    │ │                  │ │        v            │ │
-│  │                    │ │                  │ │ CI quality → docs   │ │
-│  └─────────┬──────────┘ └────────┬─────────┘ └──────────┬──────────┘ │
-└────────────┼─────────────────────┼──────────────────────┼────────────┘
-             v                     v                      v
-┌────────────┴─────────────────────┴──────────────────────┴────────────┐
-│ OUTPUT LAYER                                                          │
-│                                                                       │
-│   ┌──────────────────┐  ┌──────────────────┐  ┌────────────────────┐ │
-│   │ allow / deny     │  │ processor result │  │ gate / tag         │ │
-│   └──────────────────┘  └──────────────────┘  └────────────────────┘ │
-└────────────────────────────────────────────────────────────────────────┘
+┌──────────────────────────────────────────────────────────────┐
+│ INPUT LAYER                                                  │
+│                                                              │
+│   ┌──────────────┐   ┌──────────────┐   ┌────────────────┐  │
+│   │ tool         │   │ args         │   │ operation      │  │
+│   └──────┬───────┘   └──────┬───────┘   └───────┬────────┘  │
+└──────────┼──────────────────┼───────────────────┼───────────┘
+           v                  v                   v
+┌──────────┼──────────────────┼───────────────────┼───────────┐
+│ PROCESSING LAYER             │                   │           │
+│          v                  v                   v           │
+│   ┌──────────────────────────────────────────────────────┐ │
+│   │ executePreProcessors                                 │ │
+│   │ prompt-security-validator when the prompt is longer  │ │
+│   │ than 10 characters                                   │ │
+│   │ enabled pre processors, by priority                  │ │
+│   └──────────────────────────┬───────────────────────────┘ │
+│                              v                             │
+│   ┌──────────────────────────────────────────────────────┐ │
+│   │ executePostProcessors                                │ │
+│   │ enabled post processors, by priority                 │ │
+│   │ a stagger waits out its minimum interval             │ │
+│   │ pre results are passed in                            │ │
+│   └──────────────────────────┬───────────────────────────┘ │
+└──────────────────────────────┼──────────────────────────────┘
+                               v
+┌──────────────────────────────┼──────────────────────────────┐
+│ OUTPUT LAYER                 v                              │
+│   ┌──────────────────────────┐   ┌───────────────────────┐ │
+│   │ pre result               │   │ post results          │ │
+│   │ success and results      │   │                       │ │
+│   └──────────────────────────┘   └───────────────────────┘ │
+└──────────────────────────────────────────────────────────────┘
 ```

package/docs-site/docs/plates/reporting.md

@@ -5,7 +5,7 @@ sidebar_label: Reporting
 
 # Reporting
 
-Logs become a report. Session start can also drop a schedule marker. The marker is a side output, not a second chain through the formatter.
+Logs become a report. A valid cache returns the formatted report and does not write the file again.
 
 ```
 ┌────────────────────────────────────────────────────────────┐
@@ -22,14 +22,9 @@ Logs become a report. Session start can also drop a schedule marker. The marker
 │   ┌────────────────────────────────────────────────────┐  │
 │   │ FrameworkReportingSystem                           │  │
 │   │ collect logs → metrics → formatReport              │  │
-│   │ cache a fresh report, then write the file          │  │
+│   │ cache the fresh report                             │  │
+│   │ write the file when outputPath is set              │  │
 │   └──────────────────────────┬─────────────────────────┘  │
-│                              │                            │
-│   ┌──────────────────────────┼─────────────────────────┐  │
-│   │ SessionStart marker      │                         │  │
-│   │ autonomous-reporting     │  side output            │  │
-│   │ scheduled flag           │                         │  │
-│   └──────────────────────────┼─────────────────────────┘  │
 └──────────────────────────────┼────────────────────────────┘
                                v
 ┌──────────────────────────────┼────────────────────────────┐

package/docs-site/docs/plates/routing.md

@@ -5,14 +5,14 @@ sidebar_label: Routing
 
 # Routing
 
-Task text becomes an agent. thinDispatch scores the work. Repertoire may adjust the score when the organ is worn.
+Task text becomes an agent. `scoreAndRoute` scores the work, then `routeToAgent` picks the tier agent. Repertoire may replace that agent when a law matches. Naming no plane stops before that pick and returns nobody.
 
 ```
 ┌──────────────────────────────────────────────────────────────┐
 │ INPUT LAYER                                                  │
 │                                                              │
 │   ┌──────────────┐   ┌──────────────┐   ┌────────────────┐  │
-│   │ task text    │   │ @agent       │   │ scoreAndRoute  │  │
+│   │ task text    │   │ context      │   │ thresholds     │  │
 │   └──────┬───────┘   └──────┬───────┘   └───────┬────────┘  │
 │          └──────────────────┴─────────┬─────────┘           │
 └────────────────────────────────────────┼─────────────────────┘
@@ -21,22 +21,30 @@ Task text becomes an agent. thinDispatch scores the work. Repertoire may adjust
 │ PROCESSING LAYER                       │                     │
 │                                        v                     │
 │   ┌──────────────────────────────────────────────────────┐  │
-│   │ TaskSkillRouter                                      │  │
-│   │ keyword facade into the route                        │  │
+│   │ scoreComplexity                                      │  │
+│   │ ≤15 simple · single-agent                            │  │
+│   │ ≤25 moderate · multi-agent                           │  │
+│   │ ≤50 complex · orchestrator-led                       │  │
+│   │ >50 enterprise · orchestrator-led                    │  │
 │   └──────────────────────────┬───────────────────────────┘  │
 │                              v                              │
 │   ┌──────────────────────────────────────────────────────┐  │
-│   │ thinDispatch                                         │  │
-│   │ ≤15 single agent                                     │  │
-│   │ ≤25 single agent with tools                          │  │
-│   │ ≤50 multi-agent                                      │  │
-│   │ >50 orchestrator-led                                 │  │
+│   │ lensPlane                                            │  │
+│   │ no plane named stops here and the agent is empty     │  │
+│   │ one plane attaches that file                         │  │
 │   └──────────────────────────┬───────────────────────────┘  │
 │                              v                              │
 │   ┌──────────────────────────────────────────────────────┐  │
-│   │ Repertoire resolveThinDispatch                       │  │
-│   │ worn organ may change agent and score                │  │
+│   │ routeToAgent                                         │  │
+│   │ simple → code-reviewer                               │  │
+│   │ moderate, complex, enterprise → architect            │  │
+│   └──────────────────────────┬───────────────────────────┘  │
+│                              v                              │
+│   ┌──────────────────────────────────────────────────────┐  │
+│   │ resolveThinDispatch                                  │  │
+│   │ worn repertoire may change agent and score           │  │
 │   │ null provider leaves the score alone                 │  │
+│   │ a stop never reaches this step                       │  │
 │   └──────────────────────────┬───────────────────────────┘  │
 └──────────────────────────────┼──────────────────────────────┘
                                v
@@ -45,5 +53,8 @@ Task text becomes an agent. thinDispatch scores the work. Repertoire may adjust
 │   ┌────────────┐   ┌────────────────┐   ┌────────────────┐ │
 │   │ agent      │   │ strategy       │   │ adjusted score │ │
 │   └────────────┘   └────────────────┘   └────────────────┘ │
+│   ┌────────────┐                                            │
+│   │ file       │                                            │
+│   └────────────┘                                            │
 └──────────────────────────────────────────────────────────────┘
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "0xray",
-  "version": "4.0.33",
+  "version": "4.0.35",
   "description": "Multi-agent orchestration and Codex governance for OpenCode, Hermes, Grok Build, and OpenClaw",
   "readme": "README.md",
   "license": "MIT",
@@ -73,7 +73,7 @@
     "test": "vitest run",
     "test:batch": "npm test",
     "test:unit": "npm test -- src/__tests__/unit/config-loader.test.ts src/__tests__/unit/state-manager.test.ts src/__tests__/unit/state-manager-persistence.test.ts src/__tests__/unit/context-loader.test.ts src/__tests__/unit/pattern-analyzer.test.ts src/__tests__/unit/complexity-calibrator.test.ts",
-    "test:core-framework": "npm test -- src/__tests__/unit/self-direction-activation.test.ts src/__tests__/unit/ast-code-parser.test.ts src/__tests__/unit/v2-deletion-protection.test.ts",
+    "test:core-framework": "npm test -- src/__tests__/unit/v2-deletion-protection.test.ts",
     "test:security": "npm test -- src/__tests__/unit/security/security-hardener.test.ts src/__tests__/unit/security/security-headers.test.ts src/__tests__/unit/security/security-auditor.test.ts",
     "test:performance": "npm test -- src/__tests__/unit/monitoring.test.ts src/__tests__/unit/benchmark.test.ts src/__tests__/unit/analytics.test.ts",
     "test:session-management": "npm test -- src/__tests__/unit/session-state-manager.test.ts src/__tests__/unit/session-security-validator.test.ts src/__tests__/unit/session-coordination-validator.test.ts src/__tests__/unit/session-migration-validator.test.ts src/__tests__/unit/session-migration-logic.test.ts",

package/scripts/foundry/release.mjs

@@ -9,7 +9,8 @@
  * 4. Commit release artifacts → push
  * 5. Verify gate (reconcile + git + release docs + smoke)
  * 6. npm publish (idempotent — skip if version already on registry)
- * 7. Tag → push tag (only after successful publish)
+ * 7. Poll npm view until the registry lists that version
+ * 8. Tag → push tag (only after the registry lists it)
  *
  * Usage:
  *   npx @0xray/foundry release [patch|minor|major] --dry-run
@@ -90,9 +91,13 @@ function currentBranch() {
   return execSync("git rev-parse --abbrev-ref HEAD", { cwd: rootDir, encoding: "utf-8" }).trim();
 }
 
+function say(line) {
+  process.stdout.write(`${line}\n`);
+}
+
 function npmVersionPublished(version) {
   try {
-    const out = execSync(`npm view ${packageName()}@${version} version`, {
+    const out = execSync(`npm view ${packageName()}@${version} version --prefer-online`, {
       cwd: rootDir,
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"],
@@ -103,20 +108,58 @@ function npmVersionPublished(version) {
   }
 }
 
+function sleepMs(ms) {
+  const seconds = Math.max(1, Math.round(Number(ms) / 1000));
+  execSync(`sleep ${seconds}`, { stdio: "ignore" });
+}
+
+/**
+ * npm publish exits 0 while the registry still says the version is processing.
+ * Tag only after npm view lists it. Returns false when the wait runs out.
+ * @param {string} version
+ * @param {object} [hooks]
+ */
+export function waitUntilListed(version, hooks = {}) {
+  const name = hooks.name ?? packageName();
+  const listed = hooks.listed ?? (() => npmVersionPublished(version));
+  const sleep = hooks.sleep ?? sleepMs;
+  const now = hooks.now ?? Date.now;
+  const log = hooks.log ?? say;
+  const fail = hooks.fail ?? ((line) => {
+    process.stderr.write(`${line}\n`);
+    process.exit(1);
+  });
+  const intervalMs = hooks.intervalMs ?? Number(process.env.FOUNDRY_PUBLISH_POLL_MS || 15000);
+  const timeoutMs = hooks.timeoutMs ?? Number(process.env.FOUNDRY_PUBLISH_TIMEOUT_MS || 20 * 60 * 1000);
+  const started = now();
+  let attempt = 0;
+  while (!listed()) {
+    if (now() - started >= timeoutMs) {
+      fail(`❌ ${name}@${version} was uploaded but the registry has not listed it. Tag not pushed.`);
+      return false;
+    }
+    attempt += 1;
+    log(`… registry has not listed ${name}@${version} yet (try ${attempt})`);
+    sleep(intervalMs);
+  }
+  return true;
+}
+
 function publishIdempotent(version) {
   if (dryRun) {
-    console.log(`  would: ${npmPublishCmd()} (check ${packageName()}@${version} first)`);
+    say(`  would: ${npmPublishCmd()} then poll npm view ${packageName()}@${version} until listed`);
     return;
   }
   if (npmVersionPublished(version)) {
-    console.log(`ℹ️  ${packageName()}@${version} already on npm — skipping publish`);
+    say(`ℹ️  ${packageName()}@${version} already on npm — skipping publish`);
     return;
   }
   if (isXrayExoRepo(rootDir)) {
     runMill("assert-packed-dist-cli.mjs", [], "packed dist/cli");
   }
   execSync(npmPublishCmd(), { cwd: rootDir, stdio: "inherit", encoding: "utf-8" });
-  console.log(`✅ Published ${packageName()}@${version}`);
+  if (!waitUntilListed(version)) process.exit(1);
+  say(`✅ Published ${packageName()}@${version}`);
 }
 
 async function main() {

package/scripts/mjs/test-consumer-readiness.mjs

@@ -213,6 +213,7 @@ class ConsumerReadinessCheck {
 async function runPathVerification() {
   const isConsumerEnv = process.cwd().includes('test-') || 
                         process.cwd().includes('tmp') ||
+                        fs.existsSync('node_modules/0xray') ||
                         fs.existsSync('node_modules/xray');
   
   if (isConsumerEnv) {

package/scripts/mjs/test-mcp-functionality.mjs

@@ -14,10 +14,15 @@ import { fileURLToPath } from "url";
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
+function isInstalledPackagePath(value) {
+  const normalized = String(value).replace(/\\/g, "/");
+  return normalized.includes("node_modules/0xray") || normalized.includes("node_modules/xray");
+}
+
 class MCPFunctionalityTest {
   constructor() {
     this.results = { passed: [], failed: [] };
-    this.isConsumerEnvironment = __dirname.includes("node_modules/xray");
+    this.isConsumerEnvironment = isInstalledPackagePath(__dirname);
   }
 
   async testMCPFunctionality() {
@@ -95,9 +100,9 @@ class MCPFunctionalityTest {
       // Determine environment: dev vs consumer vs CI
       // - Dev: running from project root with src/ directory
       // - CI: running from project root but building first (has dist/)
-      // - Consumer: running from node_modules/xray/
+      // - Consumer: running from node_modules/0xray/ (legacy node_modules/xray/)
       const cwd = process.cwd();
-      const isConsumerEnv = cwd.includes("node_modules/xray");
+      const isConsumerEnv = isInstalledPackagePath(cwd);
       const hasPackageJson = fs.existsSync(path.join(cwd, "package.json"));
       const hasDistDir = fs.existsSync(path.join(cwd, "dist"));
       
@@ -155,16 +160,16 @@ class MCPFunctionalityTest {
         if (serverPath) {
           // Handle various path formats:
           // - ./dist/mcps/xxx.js (local dev)
-          // - node_modules/xray/dist/mcps/xxx.js (consumer)
+          // - node_modules/0xray/dist/mcps/xxx.js (consumer; legacy node_modules/xray/)
           // - dist/mcps/xxx.js (after stripping ./)
           let normalizedPath = serverPath.startsWith("./") 
             ? serverPath.slice(2) 
             : serverPath;
             
-          // If path contains node_modules/xray/, extract just the relative part
-          if (normalizedPath.includes("node_modules/xray/")) {
-            normalizedPath = normalizedPath.replace("node_modules/xray/", "");
-          }
+          normalizedPath = normalizedPath
+            .replace(/\\/g, "/")
+            .replace("node_modules/0xray/", "")
+            .replace("node_modules/xray/", "");
             
           // In CI/build environment, files are in cwd/dist/, not in node_modules
           // Try local paths first, then fall back to node_modules
@@ -249,7 +254,7 @@ class MCPFunctionalityTest {
     try {
       // Determine environment - reuse same logic
       const cwd = process.cwd();
-      const isConsumerEnv = cwd.includes("node_modules/xray");
+      const isConsumerEnv = isInstalledPackagePath(cwd);
       const hasPackageJson = fs.existsSync(path.join(cwd, "package.json"));
       const isDevOrCi = hasPackageJson && !isConsumerEnv;
       

package/scripts/node/basic-security-audit.cjs

@@ -150,7 +150,6 @@ class BasicSecurityAuditor {
       /LightweightValidator\.ts$/,
       /codex-parser\.ts$/,
       /openclaw/,
-      /advanced-features/,
       /tests\//,
       /global-processor-mocks/,
     ];

package/scripts/node/bridge-mcp-wiring.cjs

@@ -218,10 +218,69 @@ function readInstalledXrayVersion() {
   return pkg.version;
 }
 
+/**
+ * npm installs the package named `0xray` at `node_modules/0xray`.
+ * `node_modules/xray` is the pre-rename folder. Use it only when that tree
+ * is the one on disk. Never prefer the old name over the real install.
+ */
+const INSTALLED_PACKAGE_DIRS = ["0xray", "xray"];
+
+function normalizeLaunchToken(token) {
+  return String(token).replace(/\\/g, "/");
+}
+
 function localXrayCli(targetDir) {
   if (!targetDir) return null;
-  const cli = path.join(targetDir, "node_modules", "0xray", "dist", "cli", "index.js");
-  return fs.existsSync(cli) ? cli : null;
+  for (const dirName of INSTALLED_PACKAGE_DIRS) {
+    const cli = path.join(targetDir, "node_modules", dirName, "dist", "cli", "index.js");
+    if (fs.existsSync(cli)) return cli;
+  }
+  return null;
+}
+
+function isInstalledPackageCli(token) {
+  const normalized = normalizeLaunchToken(token);
+  return INSTALLED_PACKAGE_DIRS.some((dirName) =>
+    normalized.includes(`node_modules/${dirName}/dist/cli/index.js`),
+  );
+}
+
+/** Project-root `dist/cli/index.js` is the factory checkout. It is gitignored and goes stale. */
+function isCheckoutDistCliLaunch(server) {
+  return launchTokens(server).some((token) => {
+    const normalized = normalizeLaunchToken(token);
+    const isDistCli =
+      normalized === "dist/cli/index.js" ||
+      normalized === "./dist/cli/index.js" ||
+      normalized.endsWith("/dist/cli/index.js");
+    return isDistCli && !isInstalledPackageCli(normalized);
+  });
+}
+
+function isLegacyXrayCliLaunch(server) {
+  return launchTokens(server).some((token) => {
+    const normalized = normalizeLaunchToken(token);
+    return normalized.includes("node_modules/xray/dist/cli/index.js");
+  });
+}
+
+function mcpSubcommand(inner) {
+  if (!inner || !Array.isArray(inner.args)) return null;
+  const idx = inner.args.indexOf("mcp");
+  if (idx >= 0 && inner.args[idx + 1]) return inner.args[idx + 1];
+  return null;
+}
+
+/**
+ * A checkout `dist/cli` launch is replaced with the installed package.
+ * A legacy `node_modules/xray` launch is replaced only when `node_modules/0xray` exists.
+ */
+function shouldRepinToInstalledCli(inner, targetDir) {
+  if (!inner || hasVersionPin(inner)) return false;
+  if (isCheckoutDistCliLaunch(inner)) return true;
+  if (!isLegacyXrayCliLaunch(inner)) return false;
+  const cli = localXrayCli(targetDir);
+  return Boolean(cli && normalizeLaunchToken(cli).includes("/node_modules/0xray/"));
 }
 
 /** Prefer the installed CLI. Else pin npx to this package version. Never bare `0xray`. */
@@ -388,7 +447,7 @@ function mcpCmdFromInner(inner) {
   return inner.args.length > 0 ? inner.args[inner.args.length - 1] : null;
 }
 
-/** Framework fills gaps. User env, enabled/disabled, and version pins win. Unpinned `0xray` is repinned. Launch is `node mcp-launch.cjs --keep names -- cmd`. */
+/** Framework fills gaps. User env, enabled/disabled, and version pins win. Unpinned `0xray` and a checkout `dist/cli` launch are repinned to the installed package. Launch is `node mcp-launch.cjs --keep names -- cmd`. */
 function mergeUserWinsServer(framework, user, targetDir) {
   if (!user || typeof user !== "object") return framework;
   if (!framework || typeof framework !== "object") return user;
@@ -403,6 +462,10 @@ function mergeUserWinsServer(framework, user, targetDir) {
     const mcpCmd = mcpCmdFromInner(inner);
     if (mcpCmd) inner = pinnedMcpLaunch(targetDir, mcpCmd);
   }
+  if (inner && shouldRepinToInstalledCli(inner, targetDir)) {
+    const mcpCmd = mcpSubcommand(inner);
+    if (mcpCmd) inner = pinnedMcpLaunch(targetDir, mcpCmd);
+  }
   if (!inner) return framework;
   const mergedEnv = mergeScopedEnv([
     baseScopedEnv(targetDir),

package/scripts/node/postinstall.cjs

@@ -75,7 +75,7 @@ function deployManagedAgents(packageRoot, targetDir, log) {
   if (updated !== current) fs.writeFileSync(agentsDest, updated);
 }
 
-/** npm install links vendored @0xray/repertoire and nothing else. The suit is `npx 0xray wear`. */
+/** npm install links vendored @0xray/repertoire and does not write `.mcp.json`. `npx 0xray wear` rewrites a checkout `dist/cli` launch to `node_modules/0xray`. */
 function runPostinstall(packageRoot, targetDir, _log) {
   linkVendoredRepertoire(packageRoot, targetDir);
   console.log("Run `npx 0xray wear`");

package/scripts/node/prepare-consumer.cjs

@@ -33,21 +33,25 @@ function updatePathsInFile(filePath) {
     let content = fs.readFileSync(filePath, 'utf-8');
     let updated = false;
 
-    // Transform development paths back to consumer paths (plain xray; legacy @0xray/xray removed)
-    // Only transform if it's not already a consumer path
-    if (content.includes('dist/plugin/mcps/') && !content.includes('node_modules/xray/dist/plugin/mcps/')) {
+    // The published package name is 0xray, so the installed tree is node_modules/0xray.
+    // Upgrade a pre-rename node_modules/xray path before prefixing bare dist/ paths.
+    if (content.includes('node_modules/xray/')) {
+      content = content.replace(/node_modules\/xray\//g, 'node_modules/0xray/');
+      updated = true;
+    }
+
+    if (content.includes('dist/plugin/mcps/') && !content.includes('node_modules/0xray/dist/plugin/mcps/')) {
       content = content.replace(
         /dist\/plugin\/mcps\//g,
-        'node_modules/xray/dist/plugin/mcps/'
+        'node_modules/0xray/dist/plugin/mcps/'
       );
       updated = true;
     }
 
-    // Transform plugin paths back to consumer format (only the relative dev paths)
     if (content.includes('../../../dist/plugin/')) {
       content = content.replace(
         /\.\.\/\.\.\/\.\.\/dist\/plugin\//g,
-        'node_modules/xray/dist/plugin/'
+        'node_modules/0xray/dist/plugin/'
       );
       updated = true;
     }
@@ -140,4 +144,4 @@ function addJsExtensionsToDist() {
 addJsExtensionsToDist();
 
 structuredLog('prepare-consumer', 'xray v2 Consumer Preparation: Complete!', 'success');
-structuredLog('prepare-consumer', 'Package is now ready for consumer installation (plain xray technical identity).', 'info');
+structuredLog('prepare-consumer', 'Package is now ready for consumer installation (node_modules/0xray).', 'info');

package/scripts/node/setup-dev.cjs

@@ -23,32 +23,24 @@ function updatePathsInFile(filePath) {
     let content = fs.readFileSync(filePath, 'utf-8');
     let updated = false;
 
-    // Transform MCP server paths (specific first)
-    if (content.includes('node_modules/xray/dist/plugin/mcps/')) {
-      content = content.replace(
-        /node_modules\/xray\/dist\/plugin\/mcps\//g,
-        'dist/plugin/mcps/'
-      );
-      updated = true;
-    }
-
-    // Transform plugin paths (go up 3 directories from .opencode to project root)
-    if (content.includes('node_modules/xray/dist/plugin/plugins/')) {
-      content = content.replace(
-        /node_modules\/xray\/dist\/plugin\/plugins\//g,
-        '../../../dist/plugin/plugins/'
-      );
-      updated = true;
-    }
-
-    // Transform any remaining node_modules paths (but not plugin-specific ones we already handled)
-    if (content.includes('node_modules/xray/dist/') &&
-        !content.includes('dist/plugin/')) {  // Avoid double transformation
-      content = content.replace(
-        /node_modules\/xray\/dist\//g,
-        'dist/'
-      );
-      updated = true;
+    // npm installs at node_modules/0xray. node_modules/xray is the pre-rename folder.
+    // Specific plugin paths first so the general dist/ strip does not flatten them.
+    for (const dirName of ['0xray', 'xray']) {
+      const plugins = `node_modules/${dirName}/dist/plugin/plugins/`;
+      if (content.includes(plugins)) {
+        content = content.replaceAll(plugins, '../../../dist/plugin/plugins/');
+        updated = true;
+      }
+      const mcps = `node_modules/${dirName}/dist/plugin/mcps/`;
+      if (content.includes(mcps)) {
+        content = content.replaceAll(mcps, 'dist/plugin/mcps/');
+        updated = true;
+      }
+      const prefix = `node_modules/${dirName}/dist/`;
+      if (content.includes(prefix)) {
+        content = content.replaceAll(prefix, 'dist/');
+        updated = true;
+      }
     }
 
     if (updated) {

package/scripts/node/validate-mcp-connectivity.js

@@ -18,7 +18,8 @@ const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
 // Detect if running in consumer environment (node_modules)
-const isConsumerEnvironment = __dirname.includes("node_modules/xray");
+const isConsumerEnvironment = __dirname.includes(`${path.sep}node_modules${path.sep}0xray${path.sep}`)
+  || __dirname.includes(`${path.sep}node_modules${path.sep}xray${path.sep}`);
 const pathPrefix = isConsumerEnvironment ? "" : "";
 
 const MCP_SERVERS = [

package/src/integrations/openclaw/plugin/xray-pre-tool/package.json

@@ -1,6 +1,6 @@
 {
   "name": "xray-pre-tool",
-  "version": "4.0.33",
+  "version": "4.0.35",
   "private": true,
   "type": "module",
   "description": "0xRay constitution + temperament PreToolUse for OpenClaw",

package/src/mcps/knowledge-skills/storyteller.server.ts

@@ -24,7 +24,6 @@ interface WriteStoryArgs {
 function resolveSkillMd(): string {
   const here = dirname(fileURLToPath(import.meta.url));
   const candidates = [
-    join(here, '../../../skills/storyteller/SKILL.md'),
     join(here, '../../skills/storyteller/SKILL.md'),
     join(process.cwd(), 'node_modules/0xray/dist/skills/storyteller/SKILL.md'),
     join(process.cwd(), 'node_modules/xray/dist/skills/storyteller/SKILL.md'),

package/xray/agents_template.md

@@ -30,14 +30,14 @@ All seven use `npx -y 0xray mcp <cmd>`:
 
 xray operates under the three-subsystem model: Inference + External Governance (Dynamo Solar SSOT) + Autonomous Engine (thinDispatch 7-flow in MCP orchestrator). All actions are validated against the Universal Development Codex before execution.
 
-**Codex**: `.xray/codex.json` — **69 terms** across all agent interactions.
+**Codex**: `.xray/codex.json` — **70 terms** across all agent interactions.
 
 ## thinDispatch Routing
 
-- Simple (≤15): Single agent
-- Moderate (≤25): Single agent with tools
-- Complex (≤50): Multi-agent coordination
-- Enterprise (>50): Orchestrator-led team
+- Simple (≤15): single-agent
+- Moderate (≤25): multi-agent
+- Complex (≤50): orchestrator-led
+- Enterprise (>50): orchestrator-led
 
 ## File Organization