0xray 4.0.33 → 4.0.35

package/xray/codex.json

@@ -1,6 +1,6 @@
 {
   "version": "3.1.0",
-  "lastUpdated": "2026-08-24",
+  "lastUpdated": "2026-10-01",
   "errorPreventionTarget": 0.998,
   "terms": {
     "1": {
@@ -62,7 +62,7 @@
     "8": {
       "number": 8,
       "title": "Prevent Infinite Loops",
-      "description": "Guarantee termination in all iterative processes. All loops must have clear termination conditions. Recursive functions must have base cases. Event loops must have exit strategies. Async operations must have timeout mechanisms.",
+      "description": "Guarantee termination in all iterative processes. All loops must have clear termination conditions. Recursive functions must have base cases. Event loops must have exit strategies. Async operations must have timeout mechanisms. A job names when it is done and when it stops.",
       "category": "core",
       "zeroTolerance": true,
       "enforcementLevel": "blocking"
@@ -230,7 +230,7 @@
     "29": {
       "number": 29,
       "title": "Security by Design",
-      "description": "Validate all inputs. Sanitize data before rendering. Use HTTPS for all requests. Implement rate limiting. Never expose sensitive data.",
+      "description": "Validate all inputs. Sanitize data before rendering. Use HTTPS for all requests. Implement rate limiting. Never expose sensitive data. Do not trust Host or X-Forwarded-Host to choose an environment. A refusal in the UI needs the same check on the server.",
       "category": "security",
       "zeroTolerance": true,
       "enforcementLevel": "blocking"
@@ -534,7 +534,7 @@
     "67": {
       "number": 67,
       "title": "Use Best Subagents, Reuse Session Context",
-      "description": "Delegate work to the best-suited subagent for each task. Stay responsive to user inquiries, additional todos, and course corrections. Reuse the same subagent via session ID to preserve context and avoid restarting from zero. Do not spawn fresh agents when an existing one has the relevant context.",
+      "description": "Delegate work to the best-suited subagent for each task. Stay responsive to user inquiries, additional todos, and course corrections. Reuse the same subagent via session ID to preserve context and avoid restarting from zero. Do not spawn fresh agents when an existing one has the relevant context. Reuse one cloud for a workstream. Do not launch a new agent for a check the seat can run.",
       "category": "process",
       "zeroTolerance": false,
       "enforcementLevel": "high"
@@ -554,6 +554,14 @@
       "category": "process",
       "zeroTolerance": true,
       "enforcementLevel": "blocking"
+    },
+    "70": {
+      "number": 70,
+      "title": "Current Copy Before Edits",
+      "description": "Before an edit, be on the latest main and run the current package. If this repo is 0xray, this repo is that package. An older package waits. Compare set-aside work to main before you throw it away.",
+      "category": "process",
+      "zeroTolerance": true,
+      "enforcementLevel": "blocking"
     }
   },
   "interweaves": [

package/xray/features.json

@@ -1,6 +1,6 @@
 {
   "$schema": "./features.schema.json",
-  "version": "4.0.33",
+  "version": "4.0.35",
   "description": "0xRay Framework - Unified Feature Configuration",
   "suit_temperament": {
     "profile": "auto",

package/dist/agents/known-names.d.ts

@@ -1,26 +0,0 @@
-/**
- * Known Names — Single combined vocabulary for agent names, skill names,
- * system service names, and opencode built-in types. All consumers import
- * from here instead of defining their own hardcoded lists.
- *
- * Imports:
- *   - registry.ts (AGENT_REGISTRY, AGENT_KEYS) — canonical agent definitions
- *   - mcps/index.ts (MCP_SERVERS) — canonical MCP server manifest
- */
-import { AGENT_KEYS, type AgentKey } from "./registry.js";
-import { MCP_SERVERS } from "../mcps/index.js";
-export { AGENT_KEYS, type AgentKey };
-export type { AgentKey as AgentName };
-/** All agent names as a mutable array */
-export declare function getAgentNames(): string[];
-export declare const SYSTEM_SERVICE_NAMES: readonly ["enforcer", "orchestrator", "analyzer"];
-export declare const OPENCODE_BUILTIN_TYPES: readonly ["explore", "general"];
-export declare const ALL_KNOWN_NAMES: readonly [...string[], "enforcer", "orchestrator", "analyzer", "explore", "general"];
-export type KnownName = typeof ALL_KNOWN_NAMES[number];
-export declare const BOOT_AGENTS: readonly ["enforcer", "architect", "bug-triage-specialist", "code-reviewer", "security-auditor", "refactorer", "testing-lead"];
-export declare function isValidType(name: string): boolean;
-export declare const AGENT_TO_SKILL_MAP: Record<string, string>;
-/** Resolve agent name to skill name via alias map, fallback to identity */
-export declare function resolveSkill(agentOrSkill: string): string;
-export { MCP_SERVERS };
-export declare function getSkillNames(): string[];

package/dist/agents/known-names.js

@@ -1,72 +0,0 @@
-/**
- * Known Names — Single combined vocabulary for agent names, skill names,
- * system service names, and opencode built-in types. All consumers import
- * from here instead of defining their own hardcoded lists.
- *
- * Imports:
- *   - registry.ts (AGENT_REGISTRY, AGENT_KEYS) — canonical agent definitions
- *   - mcps/index.ts (MCP_SERVERS) — canonical MCP server manifest
- */
-import { AGENT_KEYS } from "./registry.js";
-import { MCP_SERVERS } from "../mcps/index.js";
-// ── Agent names (from SSOT) ──
-export { AGENT_KEYS };
-/** All agent names as a mutable array */
-export function getAgentNames() {
-    return [...AGENT_KEYS];
-}
-// ── System service names (not in AGENT_REGISTRY) ──
-export const SYSTEM_SERVICE_NAMES = [
-    "enforcer",
-    "orchestrator",
-    "analyzer",
-];
-// ── Opencode CLI built-in types ──
-export const OPENCODE_BUILTIN_TYPES = [
-    "explore",
-    "general",
-];
-// ── Combined vocabulary ──
-export const ALL_KNOWN_NAMES = [
-    ...AGENT_KEYS,
-    ...SYSTEM_SERVICE_NAMES,
-    ...OPENCODE_BUILTIN_TYPES,
-];
-// ── Boot-priority agents (loaded first by boot-orchestrator) ──
-export const BOOT_AGENTS = [
-    "enforcer",
-    "architect",
-    "bug-triage-specialist",
-    "code-reviewer",
-    "security-auditor",
-    "refactorer",
-    "testing-lead",
-];
-// ── Validation ──
-export function isValidType(name) {
-    return ALL_KNOWN_NAMES.includes(name);
-}
-// ── Agent → Skill alias map (single source) ──
-export const AGENT_TO_SKILL_MAP = {
-    "architect": "architecture-patterns",
-    "backend-engineer": "api-design",
-    "code-reviewer": "code-review",
-    "database-engineer": "database-design",
-    "devops-engineer": "devops-deployment",
-    "mobile-developer": "mobile-development",
-    "performance-engineer": "performance-optimization",
-    "security-auditor": "security-audit",
-    "testing-lead": "testing-strategy",
-    "tech-writer": "documentation-generation",
-    "frontend-ui-ux-engineer": "ui-ux-design",
-    "frontend-engineer": "project-analysis",
-};
-/** Resolve agent name to skill name via alias map, fallback to identity */
-export function resolveSkill(agentOrSkill) {
-    return AGENT_TO_SKILL_MAP[agentOrSkill] || agentOrSkill;
-}
-// ── MCP server names (for consumers that need them) ──
-export { MCP_SERVERS };
-export function getSkillNames() {
-    return MCP_SERVERS.map(s => s.serverName);
-}

package/dist/analytics/consent-manager.d.ts

@@ -1,92 +0,0 @@
-/**
- * Consent Manager for 0xRay Central Analytics
- *
- * Manages user consent for analytics data submission with granular
- * control over what categories can be shared.
- *
- * @since 2026-03-06
- */
-export interface ConsentConfiguration {
-    analyticsEnabled: boolean;
-    consentDate: Date;
-    consentVersion: string;
-    lastOptOut: Date | undefined;
-    categories: {
-        reflections: boolean;
-        logs: boolean;
-        metrics: boolean;
-        patterns: boolean;
-    };
-    projectId: string;
-}
-export interface ConsentCategory {
-    name: string;
-    description: string;
-    enabled: boolean;
-}
-export declare class ConsentManager {
-    private configPath;
-    private config;
-    private submissionQueue;
-    constructor(configPath?: string | undefined);
-    /**
-     * Initialize consent manager - load existing config or create default
-     */
-    initialize(): Promise<ConsentConfiguration>;
-    /**
-     * Enable analytics (opt-in)
-     */
-    enableConsent(categories?: string[]): Promise<void>;
-    /**
-     * Disable analytics (opt-out)
-     */
-    disableConsent(): Promise<void>;
-    /**
-     * Check if submission is allowed for a category
-     */
-    canSubmit(category: string): boolean;
-    /**
-     * Get current consent status
-     */
-    getStatus(): Promise<ConsentConfiguration>;
-    /**
-     * Enable specific category
-     */
-    enableCategory(category: string): Promise<void>;
-    /**
-     * Disable specific category
-     */
-    disableCategory(category: string): Promise<void>;
-    /**
-     * Get all categories with their status
-     */
-    getCategories(): ConsentCategory[];
-    /**
-     * Generate anonymous project ID
-     */
-    private generateProjectId;
-    /**
-     * Create default disabled configuration
-     */
-    private createDefaultConfig;
-    /**
-     * Load configuration from file
-     */
-    private loadConfig;
-    /**
-     * Save configuration to file
-     */
-    private saveConfig;
-    /**
-     * Clear submission queue
-     */
-    private clearSubmissionQueue;
-    /**
-     * Add item to submission queue
-     */
-    queueSubmission(data: unknown): Promise<void>;
-    /**
-     * Save submission queue to file
-     */
-    private saveSubmissionQueue;
-}

package/dist/analytics/consent-manager.js

@@ -1,257 +0,0 @@
-/**
- * Consent Manager for 0xRay Central Analytics
- *
- * Manages user consent for analytics data submission with granular
- * control over what categories can be shared.
- *
- * @since 2026-03-06
- */
-import * as fs from "fs/promises";
-import * as path from "path";
-import { frameworkLogger } from "../core/framework-logger.js";
-import { getConfigDir, resolveConfigPath } from "../core/config-paths.js";
-export class ConsentManager {
-    configPath;
-    config = null;
-    submissionQueue = [];
-    constructor(configPath = undefined) {
-        this.configPath = configPath || resolveConfigPath("consent.json") || path.join(getConfigDir(), "consent.json");
-    }
-    /**
-     * Initialize consent manager - load existing config or create default
-     */
-    async initialize() {
-        try {
-            await this.loadConfig();
-            if (!this.config) {
-                // Create default disabled configuration
-                this.config = this.createDefaultConfig();
-                await this.saveConfig();
-            }
-            return this.config;
-        }
-        catch (error) {
-            // If config doesn't exist, create default
-            this.config = this.createDefaultConfig();
-            await this.saveConfig();
-            return this.config;
-        }
-    }
-    /**
-     * Enable analytics (opt-in)
-     */
-    async enableConsent(categories) {
-        if (!this.config) {
-            await this.initialize();
-        }
-        if (!this.config) {
-            throw new Error("Failed to initialize consent configuration");
-        }
-        // Enable all categories if none specified
-        const categoriesToEnable = categories || Object.keys(this.config.categories);
-        // Enable main analytics flag
-        this.config.analyticsEnabled = true;
-        this.config.consentDate = new Date();
-        this.config.consentVersion = "1.0";
-        // Enable specified categories
-        categoriesToEnable.forEach(cat => {
-            if (this.config && cat in this.config.categories) {
-                this.config.categories[cat] = true;
-            }
-        });
-        // Generate project ID if not exists
-        if (!this.config.projectId || this.config.projectId === "") {
-            this.config.projectId = this.generateProjectId();
-        }
-        await this.saveConfig();
-    }
-    /**
-     * Disable analytics (opt-out)
-     */
-    async disableConsent() {
-        if (!this.config) {
-            await this.initialize();
-        }
-        if (!this.config) {
-            throw new Error("Failed to initialize consent configuration");
-        }
-        // Disable all analytics
-        this.config.analyticsEnabled = false;
-        this.config.lastOptOut = new Date();
-        // Disable all categories
-        Object.keys(this.config.categories).forEach(cat => {
-            this.config.categories[cat] = false;
-        });
-        await this.saveConfig();
-        // Clear submission queue
-        await this.clearSubmissionQueue();
-    }
-    /**
-     * Check if submission is allowed for a category
-     */
-    canSubmit(category) {
-        if (!this.config) {
-            return false;
-        }
-        return this.config.analyticsEnabled &&
-            this.config.categories[category] === true;
-    }
-    /**
-     * Get current consent status
-     */
-    async getStatus() {
-        if (!this.config) {
-            await this.initialize();
-        }
-        if (!this.config) {
-            throw new Error("Failed to load consent configuration");
-        }
-        return { ...this.config };
-    }
-    /**
-     * Enable specific category
-     */
-    async enableCategory(category) {
-        if (!this.config) {
-            await this.initialize();
-        }
-        if (!this.config || !(category in this.config.categories)) {
-            throw new Error(`Invalid category: ${category}`);
-        }
-        this.config.categories[category] = true;
-        await this.saveConfig();
-    }
-    /**
-     * Disable specific category
-     */
-    async disableCategory(category) {
-        if (!this.config) {
-            await this.initialize();
-        }
-        if (!this.config || !(category in this.config.categories)) {
-            throw new Error(`Invalid category: ${category}`);
-        }
-        this.config.categories[category] = false;
-        await this.saveConfig();
-    }
-    /**
-     * Get all categories with their status
-     */
-    getCategories() {
-        if (!this.config) {
-            return [];
-        }
-        const categoryInfo = {
-            reflections: "Anonymized reflection data for pattern learning",
-            logs: "Framework activity logs for performance analysis",
-            metrics: "Agent performance and routing metrics",
-            patterns: "P9 pattern learning data and insights"
-        };
-        return Object.entries(this.config.categories).map(([name, enabled]) => ({
-            name,
-            description: categoryInfo[name] || "",
-            enabled: enabled
-        }));
-    }
-    /**
-     * Generate anonymous project ID
-     */
-    generateProjectId() {
-        // Generate UUID-like identifier
-        const timestamp = Date.now().toString(36);
-        const random = Math.random().toString(36).substring(2, 8);
-        return `project-${timestamp}-${random}`;
-    }
-    /**
-     * Create default disabled configuration
-     */
-    createDefaultConfig() {
-        return {
-            analyticsEnabled: false,
-            consentDate: new Date(),
-            consentVersion: "1.0",
-            lastOptOut: undefined,
-            categories: {
-                reflections: false,
-                logs: false,
-                metrics: false,
-                patterns: false
-            },
-            projectId: this.generateProjectId()
-        };
-    }
-    /**
-     * Load configuration from file
-     */
-    async loadConfig() {
-        try {
-            const configData = await fs.readFile(this.configPath, "utf-8");
-            this.config = JSON.parse(configData);
-            // Convert date strings back to Date objects
-            if (this.config.consentDate) {
-                this.config.consentDate = new Date(this.config.consentDate);
-            }
-            if (this.config.lastOptOut) {
-                this.config.lastOptOut = new Date(this.config.lastOptOut);
-            }
-        }
-        catch (error) {
-            // Config doesn't exist or is invalid
-            this.config = null;
-        }
-    }
-    /**
-     * Save configuration to file
-     */
-    async saveConfig() {
-        if (!this.config) {
-            throw new Error("No configuration to save");
-        }
-        // Ensure directory exists
-        const configDir = path.dirname(this.configPath);
-        try {
-            await fs.mkdir(configDir, { recursive: true });
-        }
-        catch {
-            // Directory already exists
-        }
-        await fs.writeFile(this.configPath, JSON.stringify(this.config, null, 2), "utf-8");
-    }
-    /**
-     * Clear submission queue
-     */
-    async clearSubmissionQueue() {
-        const queuePath = path.join(path.dirname(this.configPath), "analytics", "submission-queue.json");
-        try {
-            await fs.writeFile(queuePath, "[]", "utf-8");
-            this.submissionQueue = [];
-        }
-        catch (error) {
-            // Queue directory doesn't exist yet, which is fine
-        }
-    }
-    /**
-     * Add item to submission queue
-     */
-    async queueSubmission(data) {
-        if (!this.canSubmit("all")) {
-            throw new Error("Analytics is disabled or category not enabled");
-        }
-        this.submissionQueue.push(data);
-        await this.saveSubmissionQueue();
-    }
-    /**
-     * Save submission queue to file
-     */
-    async saveSubmissionQueue() {
-        const queueDir = path.join(path.dirname(this.configPath), "analytics");
-        const queuePath = path.join(queueDir, "submission-queue.json");
-        try {
-            await fs.mkdir(queueDir, { recursive: true });
-            await fs.writeFile(queuePath, JSON.stringify(this.submissionQueue, null, 2), "utf-8");
-        }
-        catch (error) {
-            frameworkLogger.log("consent-manager", "save-queue-failed", "error", { error, message: "Failed to save submission queue" });
-        }
-    }
-}

package/dist/benchmark/performance-benchmark.d.ts

@@ -1,103 +0,0 @@
-export interface BenchmarkResult {
-    operation: string;
-    startTime: number;
-    endTime: number;
-    duration: number;
-    success: boolean;
-    metadata: Record<string, any>;
-    error?: string | undefined;
-}
-export interface PerformanceMetrics {
-    totalOperations: number;
-    successfulOperations: number;
-    failedOperations: number;
-    averageDuration: number;
-    medianDuration: number;
-    p95Duration: number;
-    p99Duration: number;
-    minDuration: number;
-    maxDuration: number;
-    throughput: number;
-}
-export interface BootBenchmarkResult {
-    totalBootTime: number;
-    phaseTimings: Record<string, number>;
-    componentLoadTimes: Record<string, number>;
-    memoryUsage: {
-        beforeBoot: number;
-        afterBoot: number;
-        peakDuringBoot: number;
-    };
-    success: boolean;
-    errors: string[];
-    orchestratorLoadTime?: number;
-    delegationInitTime?: number;
-    sessionManagementInitTime?: number;
-    processorActivationTime?: number;
-    agentLoadingTime?: number;
-    enforcementActivationTime?: number;
-    codexComplianceActivationTime?: number;
-}
-export interface OrchestratorBenchmarkResult {
-    taskExecutionTimes: number[];
-    delegationLatencies: number[];
-    conflictResolutionTimes: number[];
-    concurrentTaskThroughput: number;
-    dependencyResolutionTime: number;
-    overallSuccess: boolean;
-}
-export interface SessionBenchmarkResult {
-    stateShareLatencies: number[];
-    dependencyUpdateTimes: number[];
-    groupOperationTimes: number[];
-    migrationTimes: number[];
-    failoverTimes: number[];
-    concurrentSessionOperations: number;
-}
-export declare class XrayPerformanceBenchmark {
-    private results;
-    private activeBenchmarks;
-    /**
-     * Start a benchmark measurement
-     */
-    startBenchmark(operation: string, metadata?: Record<string, any>): string;
-    /**
-     * End a benchmark measurement
-     */
-    endBenchmark(benchmarkId: string, success?: boolean, error?: string): BenchmarkResult | null;
-    /**
-     * Benchmark boot sequence performance
-     */
-    benchmarkBootSequence(_bootOrchestrator: unknown): Promise<BootBenchmarkResult>;
-    /**
-     * Benchmark orchestrator task execution
-     */
-    benchmarkOrchestratorTasks(_orchestrator: unknown, taskCount?: number, concurrentTasks?: number): Promise<OrchestratorBenchmarkResult>;
-    /**
-     * Benchmark session management operations
-     */
-    benchmarkSessionOperations(_sessionStateManager: unknown, operationCount?: number): Promise<SessionBenchmarkResult>;
-    /**
-     * Calculate performance metrics from benchmark results
-     */
-    calculateMetrics(operationFilter?: string): PerformanceMetrics;
-    /**
-     * Generate comprehensive benchmark report
-     */
-    generateReport(): {
-        summary: PerformanceMetrics;
-        bootBenchmark?: BootBenchmarkResult;
-        orchestratorBenchmark?: OrchestratorBenchmarkResult;
-        sessionBenchmark?: SessionBenchmarkResult;
-        recommendations: string[];
-    };
-    /**
-     * Clear all benchmark results
-     */
-    clearResults(): void;
-    /**
-     * Export results for external analysis
-     */
-    exportResults(): BenchmarkResult[];
-}
-export declare const performanceBenchmark: XrayPerformanceBenchmark;