0xray 4.0.34 → 4.0.36

package/docs-site/docs/plates/memory-recall.md

@@ -5,45 +5,36 @@ sidebar_label: Memory recall
 
 # Memory recall
 
-Speech becomes a lesson. Intent names one plate. Compact points at the station card. The card names the stamp. The stamp file is the schematic.
+Intent names one plate. Equal top scores recall nothing. A missing worn copy is stamped from the docs plate. An edited copy stays.
 
 ```
 ┌──────────────────────────────────────────────────────────────┐
 │ INPUT LAYER                                                  │
 │                                                              │
-│   ┌──────────────┐   ┌──────────────┐   ┌────────────────┐  │
-│   │ speech       │   │ intent       │   │ compact cut    │  │
-│   └──────┬───────┘   └──────┬───────┘   └───────┬────────┘  │
-└──────────┼──────────────────┼───────────────────┼───────────┘
-           v                  v                   v
-┌──────────┼──────────────────┼───────────────────┼───────────┐
-│ PROCESSING LAYER             │                   │           │
-│          v                  v                   v           │
-│   ┌──────────────┐   ┌──────────────┐   ┌────────────────┐ │
-│   │ speech grades│   │ intent       │   │ compact says   │ │
-│   │ to a lesson  │   │ recalls one  │   │ Read STATION.md│ │
-│   │ on a signal  │   │ plate        │   │                │ │
-│   └──────┬───────┘   └──────┬───────┘   └───────┬────────┘ │
-│          │                  │                   │          │
-│          │                  v                   │          │
-│          │     ┌────────────────────────────┐   │          │
-│          │     │ card keeps the short       │   │          │
-│          │     │ subsystem table            │   │          │
-│          │     │ card names Plate: <id>     │   │          │
-│          │     └─────────────┬──────────────┘   │          │
-└──────────┼───────────────────┼──────────────────┼──────────┘
-           v                   v                  v
-┌──────────┴───────────────────┴──────────────────┴──────────┐
-│ OUTPUT LAYER                                               │
-│                                                            │
-│   ┌────────────────────────────┐  ┌─────────────────────┐ │
-│   │ lesson on the signal       │  │ stamp file          │ │
-│   │ an episode of what happened│  │ the schematic       │ │
-│   └────────────────────────────┘  │ docs-site/docs/     │ │
-│                                   │ plates/<id>.md      │ │
-│                                   │ worn copy only when │ │
-│                                   │ .xray/state/plates/ │ │
-│                                   │ <id>.md is missing  │ │
-│                                   └─────────────────────┘ │
+│   ┌──────────────────────────────────────────────────────┐  │
+│   │ intent                                               │  │
+│   └──────────────────────────┬───────────────────────────┘  │
+└──────────────────────────────┼──────────────────────────────┘
+                               v
+┌──────────────────────────────┼──────────────────────────────┐
+│ PROCESSING LAYER             v                              │
+│   ┌──────────────────────────────────────────────────────┐  │
+│   │ score cues                                           │  │
+│   │ one winner loads that plate                          │  │
+│   │ a tie returns nothing                                │  │
+│   └──────────────────────────┬───────────────────────────┘  │
+│                              v                              │
+│   ┌──────────────────────────────────────────────────────┐  │
+│   │ stampPlateIfMissing                                  │  │
+│   │ writes .xray/state/plates only when that file        │  │
+│   │ is missing                                           │  │
+│   └──────────────────────────┬───────────────────────────┘  │
+└──────────────────────────────┼──────────────────────────────┘
+                               v
+┌──────────────────────────────┼──────────────────────────────┐
+│ OUTPUT LAYER                 v                              │
+│   ┌────────────────────┐        ┌────────────────────────┐ │
+│   │ plate line         │        │ stamp file             │ │
+│   └────────────────────┘        └────────────────────────┘ │
 └──────────────────────────────────────────────────────────────┘
 ```

package/docs-site/docs/plates/orchestration.md

@@ -5,51 +5,55 @@ sidebar_label: Orchestration
 
 # Orchestration
 
-Multi-step work is planned, run, and closed. Routing picks an agent. This plate is the coordination around that pick.
+Each tool is its own call. `spawnAside` opens around `orchestrate-task`, `analyze-complexity`, and `govern-and-apply`. `closeAside` runs when that call returns.
 
 ```
 ┌────────────────────────────────────────────────────────────┐
 │ INPUT LAYER                                                │
 │                                                            │
-│   ┌────────────────────────────────────────────────────┐  │
-│   │ tasks                                              │  │
-│   │ descriptions · dependencies · type                 │  │
-│   └──────────────────────────┬─────────────────────────┘  │
-└──────────────────────────────┼────────────────────────────┘
-                               v
-┌──────────────────────────────┼────────────────────────────┐
-│ PROCESSING LAYER             v                            │
-│   ┌────────────────────────────────────────────────────┐  │
-│   │ analyze-complexity                                 │  │
-│   │ ExecutionPlanner validates and plans               │  │
-│   └──────────────────────────┬─────────────────────────┘  │
-│                              v                            │
-│   ┌────────────────────────────────────────────────────┐  │
-│   │ orchestrate-task                                   │  │
-│   │ lead stays on the main thread                      │  │
-│   └──────────────────────────┬─────────────────────────┘  │
-│                              v                            │
-│   ┌────────────────────────────────────────────────────┐  │
-│   │ spawnAside                                         │  │
-│   │ on orchestrate-task, analyze-complexity,           │  │
-│   │ and govern-and-apply                               │  │
-│   │ observations from the three flows                  │  │
-│   └──────────────────────────┬─────────────────────────┘  │
-│                              v                            │
-│   ┌────────────────────────────────────────────────────┐  │
-│   │ confidence gate                                    │  │
-│   │ getTaskConfidence when Repertoire is worn          │  │
-│   └──────────────────────────┬─────────────────────────┘  │
-│                              v                            │
-│   ┌────────────────────────────────────────────────────┐  │
-│   │ closeAside                                         │  │
-│   └──────────────────────────┬─────────────────────────┘  │
+│   ┌──────────────────────┐      ┌──────────────────────┐  │
+│   │ tool name            │      │ arguments            │  │
+│   └──────────┬───────────┘      └──────────┬───────────┘  │
+└──────────────┼─────────────────────────────┼──────────────┘
+               v                             v
+┌──────────────┼─────────────────────────────┼──────────────┐
+│ PROCESSING LAYER                            │              │
+│              v                             v              │
+│   ┌────────────────────────────────────────────────────┐ │
+│   │ orchestrate-task                                   │ │
+│   │ spawnAside · handleOrchestrateTask · closeAside    │ │
+│   └──────────────────────────┬─────────────────────────┘ │
+│                              v                           │
+│   ┌────────────────────────────────────────────────────┐ │
+│   │ analyze-complexity                                 │ │
+│   │ a due synthesis checkpoint can return first        │ │
+│   │ spawnAside · handleAnalyzeComplexity · closeAside  │ │
+│   └──────────────────────────┬─────────────────────────┘ │
+│                              v                           │
+│   ┌────────────────────────────────────────────────────┐ │
+│   │ govern-and-apply                                   │ │
+│   │ a due synthesis checkpoint blocks first            │ │
+│   │ spawnAside · governExternalProposals · closeAside  │ │
+│   └──────────────────────────┬─────────────────────────┘ │
+│                              v                           │
+│   ┌────────────────────────────────────────────────────┐ │
+│   │ get-orchestration-status                           │ │
+│   └──────────────────────────┬─────────────────────────┘ │
+│                              v                           │
+│   ┌────────────────────────────────────────────────────┐ │
+│   │ cancel-orchestration                               │ │
+│   │ closeAside on a forced cancel or a matching session│ │
+│   └──────────────────────────┬─────────────────────────┘ │
+│                              v                           │
+│   ┌────────────────────────────────────────────────────┐ │
+│   │ optimize-orchestration                             │ │
+│   └──────────────────────────┬─────────────────────────┘ │
 └──────────────────────────────┼────────────────────────────┘
                                v
 ┌──────────────────────────────┼────────────────────────────┐
 │ OUTPUT LAYER                 v                            │
 │   ┌─────────────────────┐    ┌─────────────────────────┐ │
-│   │ execution result    │    │ aside observations      │ │
+│   │ tool result         │    │ aside id                │ │
 │   └─────────────────────┘    └─────────────────────────┘ │
 └────────────────────────────────────────────────────────────┘
 ```

package/docs-site/docs/plates/processor.md

@@ -5,42 +5,40 @@ sidebar_label: Processor
 
 # Processor
 
-Three pipelines run in parallel. A is the live suit. B is the legacy processor manager. C is mill, git, and CI. Nothing in A is an input to B or C.
+`ProcessorManager` runs the enabled pre processors, then the enabled post processors. Prompt text longer than 10 characters is checked inside the pre pass.
 
 ```
-┌────────────────────────────────────────────────────────────────────────┐
-│ INPUT LAYER                                                            │
-│                                                                        │
-│   ┌──────────────────┐  ┌──────────────────┐  ┌────────────────────┐  │
-│   │ tool / session   │  │ prompt text      │  │ commit / release   │  │
-│   └────────┬─────────┘  └────────┬─────────┘  └─────────┬──────────┘  │
-└────────────┼─────────────────────┼──────────────────────┼─────────────┘
-             v                     v                      v
-┌────────────┼─────────────────────┼──────────────────────┼─────────────┐
-│ PROCESSING LAYER   three parallel pipelines             │             │
-│            │                     │                      │             │
-│  ┌─────────┴──────────┐ ┌────────┴─────────┐ ┌──────────┴──────────┐ │
-│  │ A suit (live OS)   │ │ B legacy manager │ │ C mill / git / CI   │ │
-│  │                    │ │                  │ │                     │ │
-│  │ SessionStart       │ │ prompt-security  │ │ mint                │ │
-│  │        v           │ │        v         │ │        v            │ │
-│  │ PreToolUse         │ │ executePre       │ │ inspect             │ │
-│  │        v           │ │        v         │ │        v            │ │
-│  │ tool runs          │ │ work             │ │ pre-commit          │ │
-│  │        v           │ │        v         │ │        v            │ │
-│  │ PostToolUse        │ │ executePost      │ │ pre-push            │ │
-│  │        v           │ │                  │ │        v            │ │
-│  │ compact heat       │ │                  │ │ foundry release     │ │
-│  │                    │ │                  │ │        v            │ │
-│  │                    │ │                  │ │ CI quality → docs   │ │
-│  └─────────┬──────────┘ └────────┬─────────┘ └──────────┬──────────┘ │
-└────────────┼─────────────────────┼──────────────────────┼────────────┘
-             v                     v                      v
-┌────────────┴─────────────────────┴──────────────────────┴────────────┐
-│ OUTPUT LAYER                                                          │
-│                                                                       │
-│   ┌──────────────────┐  ┌──────────────────┐  ┌────────────────────┐ │
-│   │ allow / deny     │  │ processor result │  │ gate / tag         │ │
-│   └──────────────────┘  └──────────────────┘  └────────────────────┘ │
-└────────────────────────────────────────────────────────────────────────┘
+┌──────────────────────────────────────────────────────────────┐
+│ INPUT LAYER                                                  │
+│                                                              │
+│   ┌──────────────┐   ┌──────────────┐   ┌────────────────┐  │
+│   │ tool         │   │ args         │   │ operation      │  │
+│   └──────┬───────┘   └──────┬───────┘   └───────┬────────┘  │
+└──────────┼──────────────────┼───────────────────┼───────────┘
+           v                  v                   v
+┌──────────┼──────────────────┼───────────────────┼───────────┐
+│ PROCESSING LAYER             │                   │           │
+│          v                  v                   v           │
+│   ┌──────────────────────────────────────────────────────┐ │
+│   │ executePreProcessors                                 │ │
+│   │ prompt-security-validator when the prompt is longer  │ │
+│   │ than 10 characters                                   │ │
+│   │ enabled pre processors, by priority                  │ │
+│   └──────────────────────────┬───────────────────────────┘ │
+│                              v                             │
+│   ┌──────────────────────────────────────────────────────┐ │
+│   │ executePostProcessors                                │ │
+│   │ enabled post processors, by priority                 │ │
+│   │ a stagger waits out its minimum interval             │ │
+│   │ pre results are passed in                            │ │
+│   └──────────────────────────┬───────────────────────────┘ │
+└──────────────────────────────┼──────────────────────────────┘
+                               v
+┌──────────────────────────────┼──────────────────────────────┐
+│ OUTPUT LAYER                 v                              │
+│   ┌──────────────────────────┐   ┌───────────────────────┐ │
+│   │ pre result               │   │ post results          │ │
+│   │ success and results      │   │                       │ │
+│   └──────────────────────────┘   └───────────────────────┘ │
+└──────────────────────────────────────────────────────────────┘
 ```

package/docs-site/docs/plates/reporting.md

@@ -5,7 +5,7 @@ sidebar_label: Reporting
 
 # Reporting
 
-Logs become a report. Session start can also drop a schedule marker. The marker is a side output, not a second chain through the formatter.
+Logs become a report. A valid cache returns the formatted report and does not write the file again.
 
 ```
 ┌────────────────────────────────────────────────────────────┐
@@ -22,14 +22,9 @@ Logs become a report. Session start can also drop a schedule marker. The marker
 │   ┌────────────────────────────────────────────────────┐  │
 │   │ FrameworkReportingSystem                           │  │
 │   │ collect logs → metrics → formatReport              │  │
-│   │ cache a fresh report, then write the file          │  │
+│   │ cache the fresh report                             │  │
+│   │ write the file when outputPath is set              │  │
 │   └──────────────────────────┬─────────────────────────┘  │
-│                              │                            │
-│   ┌──────────────────────────┼─────────────────────────┐  │
-│   │ SessionStart marker      │                         │  │
-│   │ autonomous-reporting     │  side output            │  │
-│   │ scheduled flag           │                         │  │
-│   └──────────────────────────┼─────────────────────────┘  │
 └──────────────────────────────┼────────────────────────────┘
                                v
 ┌──────────────────────────────┼────────────────────────────┐

package/docs-site/docs/plates/routing.md

@@ -5,14 +5,14 @@ sidebar_label: Routing
 
 # Routing
 
-Task text becomes an agent. thinDispatch scores the work. Repertoire may adjust the score when the organ is worn.
+Task text becomes an agent. `scoreAndRoute` scores the work, then `routeToAgent` picks the tier agent. Repertoire may replace that agent when a law matches. Naming no plane stops before that pick and returns nobody.
 
 ```
 ┌──────────────────────────────────────────────────────────────┐
 │ INPUT LAYER                                                  │
 │                                                              │
 │   ┌──────────────┐   ┌──────────────┐   ┌────────────────┐  │
-│   │ task text    │   │ @agent       │   │ scoreAndRoute  │  │
+│   │ task text    │   │ context      │   │ thresholds     │  │
 │   └──────┬───────┘   └──────┬───────┘   └───────┬────────┘  │
 │          └──────────────────┴─────────┬─────────┘           │
 └────────────────────────────────────────┼─────────────────────┘
@@ -21,22 +21,30 @@ Task text becomes an agent. thinDispatch scores the work. Repertoire may adjust
 │ PROCESSING LAYER                       │                     │
 │                                        v                     │
 │   ┌──────────────────────────────────────────────────────┐  │
-│   │ TaskSkillRouter                                      │  │
-│   │ keyword facade into the route                        │  │
+│   │ scoreComplexity                                      │  │
+│   │ ≤15 simple · single-agent                            │  │
+│   │ ≤25 moderate · multi-agent                           │  │
+│   │ ≤50 complex · orchestrator-led                       │  │
+│   │ >50 enterprise · orchestrator-led                    │  │
 │   └──────────────────────────┬───────────────────────────┘  │
 │                              v                              │
 │   ┌──────────────────────────────────────────────────────┐  │
-│   │ thinDispatch                                         │  │
-│   │ ≤15 single agent                                     │  │
-│   │ ≤25 single agent with tools                          │  │
-│   │ ≤50 multi-agent                                      │  │
-│   │ >50 orchestrator-led                                 │  │
+│   │ lensPlane                                            │  │
+│   │ no plane named stops here and the agent is empty     │  │
+│   │ one plane attaches that file                         │  │
 │   └──────────────────────────┬───────────────────────────┘  │
 │                              v                              │
 │   ┌──────────────────────────────────────────────────────┐  │
-│   │ Repertoire resolveThinDispatch                       │  │
-│   │ worn organ may change agent and score                │  │
+│   │ routeToAgent                                         │  │
+│   │ simple → code-reviewer                               │  │
+│   │ moderate, complex, enterprise → architect            │  │
+│   └──────────────────────────┬───────────────────────────┘  │
+│                              v                              │
+│   ┌──────────────────────────────────────────────────────┐  │
+│   │ resolveThinDispatch                                  │  │
+│   │ worn repertoire may change agent and score           │  │
 │   │ null provider leaves the score alone                 │  │
+│   │ a stop never reaches this step                       │  │
 │   └──────────────────────────┬───────────────────────────┘  │
 └──────────────────────────────┼──────────────────────────────┘
                                v
@@ -45,5 +53,8 @@ Task text becomes an agent. thinDispatch scores the work. Repertoire may adjust
 │   ┌────────────┐   ┌────────────────┐   ┌────────────────┐ │
 │   │ agent      │   │ strategy       │   │ adjusted score │ │
 │   └────────────┘   └────────────────┘   └────────────────┘ │
+│   ┌────────────┐                                            │
+│   │ file       │                                            │
+│   └────────────┘                                            │
 └──────────────────────────────────────────────────────────────┘
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "0xray",
-  "version": "4.0.34",
+  "version": "4.0.36",
   "description": "Multi-agent orchestration and Codex governance for OpenCode, Hermes, Grok Build, and OpenClaw",
   "readme": "README.md",
   "license": "MIT",
@@ -73,7 +73,7 @@
     "test": "vitest run",
     "test:batch": "npm test",
     "test:unit": "npm test -- src/__tests__/unit/config-loader.test.ts src/__tests__/unit/state-manager.test.ts src/__tests__/unit/state-manager-persistence.test.ts src/__tests__/unit/context-loader.test.ts src/__tests__/unit/pattern-analyzer.test.ts src/__tests__/unit/complexity-calibrator.test.ts",
-    "test:core-framework": "npm test -- src/__tests__/unit/self-direction-activation.test.ts src/__tests__/unit/ast-code-parser.test.ts src/__tests__/unit/v2-deletion-protection.test.ts",
+    "test:core-framework": "npm test -- src/__tests__/unit/v2-deletion-protection.test.ts",
     "test:security": "npm test -- src/__tests__/unit/security/security-hardener.test.ts src/__tests__/unit/security/security-headers.test.ts src/__tests__/unit/security/security-auditor.test.ts",
     "test:performance": "npm test -- src/__tests__/unit/monitoring.test.ts src/__tests__/unit/benchmark.test.ts src/__tests__/unit/analytics.test.ts",
     "test:session-management": "npm test -- src/__tests__/unit/session-state-manager.test.ts src/__tests__/unit/session-security-validator.test.ts src/__tests__/unit/session-coordination-validator.test.ts src/__tests__/unit/session-migration-validator.test.ts src/__tests__/unit/session-migration-logic.test.ts",
@@ -171,6 +171,7 @@
     "scripts/mjs/verify-four-floor-compact.mjs",
     "scripts/mjs/run-repertoire-mcp.mjs",
     "scripts/mjs/run-goggles-mcp.mjs",
+    "scripts/mjs/run-grok-hook.mjs",
     "scripts/mjs/verify-delegation-gate-core.mjs",
     "scripts/mjs/delegation-gate-fixture.mjs",
     "src/opencode/",

package/scripts/foundry/release.mjs

@@ -9,7 +9,8 @@
  * 4. Commit release artifacts → push
  * 5. Verify gate (reconcile + git + release docs + smoke)
  * 6. npm publish (idempotent — skip if version already on registry)
- * 7. Tag → push tag (only after successful publish)
+ * 7. Poll npm view until the registry lists that version
+ * 8. Tag → push tag (only after the registry lists it)
  *
  * Usage:
  *   npx @0xray/foundry release [patch|minor|major] --dry-run
@@ -90,9 +91,13 @@ function currentBranch() {
   return execSync("git rev-parse --abbrev-ref HEAD", { cwd: rootDir, encoding: "utf-8" }).trim();
 }
 
+function say(line) {
+  process.stdout.write(`${line}\n`);
+}
+
 function npmVersionPublished(version) {
   try {
-    const out = execSync(`npm view ${packageName()}@${version} version`, {
+    const out = execSync(`npm view ${packageName()}@${version} version --prefer-online`, {
       cwd: rootDir,
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"],
@@ -103,20 +108,58 @@ function npmVersionPublished(version) {
   }
 }
 
+function sleepMs(ms) {
+  const seconds = Math.max(1, Math.round(Number(ms) / 1000));
+  execSync(`sleep ${seconds}`, { stdio: "ignore" });
+}
+
+/**
+ * npm publish exits 0 while the registry still says the version is processing.
+ * Tag only after npm view lists it. Returns false when the wait runs out.
+ * @param {string} version
+ * @param {object} [hooks]
+ */
+export function waitUntilListed(version, hooks = {}) {
+  const name = hooks.name ?? packageName();
+  const listed = hooks.listed ?? (() => npmVersionPublished(version));
+  const sleep = hooks.sleep ?? sleepMs;
+  const now = hooks.now ?? Date.now;
+  const log = hooks.log ?? say;
+  const fail = hooks.fail ?? ((line) => {
+    process.stderr.write(`${line}\n`);
+    process.exit(1);
+  });
+  const intervalMs = hooks.intervalMs ?? Number(process.env.FOUNDRY_PUBLISH_POLL_MS || 15000);
+  const timeoutMs = hooks.timeoutMs ?? Number(process.env.FOUNDRY_PUBLISH_TIMEOUT_MS || 20 * 60 * 1000);
+  const started = now();
+  let attempt = 0;
+  while (!listed()) {
+    if (now() - started >= timeoutMs) {
+      fail(`❌ ${name}@${version} was uploaded but the registry has not listed it. Tag not pushed.`);
+      return false;
+    }
+    attempt += 1;
+    log(`… registry has not listed ${name}@${version} yet (try ${attempt})`);
+    sleep(intervalMs);
+  }
+  return true;
+}
+
 function publishIdempotent(version) {
   if (dryRun) {
-    console.log(`  would: ${npmPublishCmd()} (check ${packageName()}@${version} first)`);
+    say(`  would: ${npmPublishCmd()} then poll npm view ${packageName()}@${version} until listed`);
     return;
   }
   if (npmVersionPublished(version)) {
-    console.log(`ℹ️  ${packageName()}@${version} already on npm — skipping publish`);
+    say(`ℹ️  ${packageName()}@${version} already on npm — skipping publish`);
     return;
   }
   if (isXrayExoRepo(rootDir)) {
     runMill("assert-packed-dist-cli.mjs", [], "packed dist/cli");
   }
   execSync(npmPublishCmd(), { cwd: rootDir, stdio: "inherit", encoding: "utf-8" });
-  console.log(`✅ Published ${packageName()}@${version}`);
+  if (!waitUntilListed(version)) process.exit(1);
+  say(`✅ Published ${packageName()}@${version}`);
 }
 
 async function main() {

package/scripts/mjs/run-grok-hook.mjs

@@ -0,0 +1,50 @@
+#!/usr/bin/env node
+/**
+ * Runs a Grok hook from dist, or from src when a rebuild has removed dist.
+ * The hook command stays on this file, which prebuild does not delete.
+ */
+import { existsSync, realpathSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+const here = dirname(fileURLToPath(import.meta.url));
+const root = join(here, '..', '..');
+
+export function resolveGrokHook(packageRoot, name) {
+  const base = String(name || '');
+  if (!base || base.includes('/') || base.includes('..') || !base.endsWith('.js')) return '';
+  const candidates = [
+    join(packageRoot, 'dist', 'integrations', 'grok', 'hooks', base),
+    join(packageRoot, 'src', 'integrations', 'grok', 'hooks', base),
+  ];
+  return candidates.find((file) => existsSync(file)) || '';
+}
+
+function allow() {
+  process.stdout.write('{"decision":"allow"}\n');
+  process.exit(0);
+}
+
+async function main() {
+  const name = process.argv[2];
+  const hit = resolveGrokHook(root, name);
+  if (!hit) allow();
+  const extra = process.argv.slice(3);
+  process.argv = [process.argv[0], hit, ...extra];
+  try {
+    await import(pathToFileURL(hit).href);
+  } catch {
+    allow();
+  }
+}
+
+function samePath(left, right) {
+  try {
+    return realpathSync(left) === realpathSync(right);
+  } catch {
+    return left === right;
+  }
+}
+
+const invoked = Boolean(process.argv[1]) && samePath(process.argv[1], fileURLToPath(import.meta.url));
+if (invoked) await main();

package/scripts/mjs/test-consumer-readiness.mjs

@@ -213,6 +213,7 @@ class ConsumerReadinessCheck {
 async function runPathVerification() {
   const isConsumerEnv = process.cwd().includes('test-') || 
                         process.cwd().includes('tmp') ||
+                        fs.existsSync('node_modules/0xray') ||
                         fs.existsSync('node_modules/xray');
   
   if (isConsumerEnv) {

package/scripts/mjs/test-mcp-functionality.mjs

@@ -14,10 +14,15 @@ import { fileURLToPath } from "url";
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
+function isInstalledPackagePath(value) {
+  const normalized = String(value).replace(/\\/g, "/");
+  return normalized.includes("node_modules/0xray") || normalized.includes("node_modules/xray");
+}
+
 class MCPFunctionalityTest {
   constructor() {
     this.results = { passed: [], failed: [] };
-    this.isConsumerEnvironment = __dirname.includes("node_modules/xray");
+    this.isConsumerEnvironment = isInstalledPackagePath(__dirname);
   }
 
   async testMCPFunctionality() {
@@ -95,9 +100,9 @@ class MCPFunctionalityTest {
       // Determine environment: dev vs consumer vs CI
       // - Dev: running from project root with src/ directory
       // - CI: running from project root but building first (has dist/)
-      // - Consumer: running from node_modules/xray/
+      // - Consumer: running from node_modules/0xray/ (legacy node_modules/xray/)
       const cwd = process.cwd();
-      const isConsumerEnv = cwd.includes("node_modules/xray");
+      const isConsumerEnv = isInstalledPackagePath(cwd);
       const hasPackageJson = fs.existsSync(path.join(cwd, "package.json"));
       const hasDistDir = fs.existsSync(path.join(cwd, "dist"));
       
@@ -155,16 +160,16 @@ class MCPFunctionalityTest {
         if (serverPath) {
           // Handle various path formats:
           // - ./dist/mcps/xxx.js (local dev)
-          // - node_modules/xray/dist/mcps/xxx.js (consumer)
+          // - node_modules/0xray/dist/mcps/xxx.js (consumer; legacy node_modules/xray/)
           // - dist/mcps/xxx.js (after stripping ./)
           let normalizedPath = serverPath.startsWith("./") 
             ? serverPath.slice(2) 
             : serverPath;
             
-          // If path contains node_modules/xray/, extract just the relative part
-          if (normalizedPath.includes("node_modules/xray/")) {
-            normalizedPath = normalizedPath.replace("node_modules/xray/", "");
-          }
+          normalizedPath = normalizedPath
+            .replace(/\\/g, "/")
+            .replace("node_modules/0xray/", "")
+            .replace("node_modules/xray/", "");
             
           // In CI/build environment, files are in cwd/dist/, not in node_modules
           // Try local paths first, then fall back to node_modules
@@ -249,7 +254,7 @@ class MCPFunctionalityTest {
     try {
       // Determine environment - reuse same logic
       const cwd = process.cwd();
-      const isConsumerEnv = cwd.includes("node_modules/xray");
+      const isConsumerEnv = isInstalledPackagePath(cwd);
       const hasPackageJson = fs.existsSync(path.join(cwd, "package.json"));
       const isDevOrCi = hasPackageJson && !isConsumerEnv;
       

package/scripts/node/basic-security-audit.cjs

@@ -150,7 +150,6 @@ class BasicSecurityAuditor {
       /LightweightValidator\.ts$/,
       /codex-parser\.ts$/,
       /openclaw/,
-      /advanced-features/,
       /tests\//,
       /global-processor-mocks/,
     ];