0xray 4.0.34 → 4.0.36

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (160) hide show
  1. package/.grok-plugin/plugin.json +1 -1
  2. package/.xray/codex.json +12 -4
  3. package/.xray/features.json +1 -1
  4. package/AGENTS-consumer.md +6 -6
  5. package/AGENTS.md +5 -5
  6. package/README.md +2 -2
  7. package/dist/AGENTS.md +5 -5
  8. package/dist/CHANGELOG.md +26 -0
  9. package/dist/README.md +2 -2
  10. package/dist/cli/index.js +2 -5
  11. package/dist/governance/governance-service.js +1 -1
  12. package/dist/integrations/base/README.md +1 -9
  13. package/dist/integrations/base/index.d.ts +0 -1
  14. package/dist/integrations/base/index.js +0 -2
  15. package/dist/integrations/governance/index.js +31 -8
  16. package/dist/integrations/grok/hooks/grok-hook-utils.js +1 -1
  17. package/dist/integrations/grok/hooks/session-start.js +12 -0
  18. package/dist/integrations/grok/plugin/0xray/hooks/hooks.json +6 -6
  19. package/dist/integrations/hooks/goggles-mcp.mjs +10 -3
  20. package/dist/integrations/hooks/goggles-pipeline.mjs +110 -23
  21. package/dist/integrations/hooks/host-truth.mjs +74 -0
  22. package/dist/integrations/hooks/station-hook-runtime.cjs +3 -0
  23. package/dist/integrations/openclaw/plugin/xray-pre-tool/package.json +1 -1
  24. package/dist/mcps/knowledge-skills/storyteller.server.js +0 -1
  25. package/dist/nucleus/delegation-gate.d.ts +2 -2
  26. package/dist/nucleus/delegation-gate.js +13 -2
  27. package/dist/nucleus/work-freshness.mjs +189 -0
  28. package/dist/processors/implementations/agents-md-validation-processor.js +1 -1
  29. package/docs-site/docs/plates/boot.md +17 -2
  30. package/docs-site/docs/plates/governance.md +3 -2
  31. package/docs-site/docs/plates/index.md +3 -1
  32. package/docs-site/docs/plates/memory-recall.md +26 -35
  33. package/docs-site/docs/plates/orchestration.md +39 -35
  34. package/docs-site/docs/plates/processor.md +34 -36
  35. package/docs-site/docs/plates/reporting.md +3 -8
  36. package/docs-site/docs/plates/routing.md +22 -11
  37. package/package.json +3 -2
  38. package/scripts/foundry/release.mjs +48 -5
  39. package/scripts/mjs/run-grok-hook.mjs +50 -0
  40. package/scripts/mjs/test-consumer-readiness.mjs +1 -0
  41. package/scripts/mjs/test-mcp-functionality.mjs +14 -9
  42. package/scripts/node/basic-security-audit.cjs +0 -1
  43. package/scripts/node/bridge-mcp-wiring.cjs +66 -3
  44. package/scripts/node/install-bridges.cjs +3 -3
  45. package/scripts/node/postinstall.cjs +1 -1
  46. package/scripts/node/prepare-consumer.cjs +11 -7
  47. package/scripts/node/setup-dev.cjs +18 -26
  48. package/scripts/node/validate-mcp-connectivity.js +2 -1
  49. package/src/integrations/grok/plugin/0xray/hooks/hooks.json +6 -6
  50. package/src/integrations/openclaw/plugin/xray-pre-tool/package.json +1 -1
  51. package/src/mcps/knowledge-skills/storyteller.server.ts +0 -1
  52. package/xray/agents_template.md +5 -5
  53. package/xray/codex.json +12 -4
  54. package/xray/features.json +1 -1
  55. package/dist/agents/known-names.d.ts +0 -26
  56. package/dist/agents/known-names.js +0 -72
  57. package/dist/analytics/consent-manager.d.ts +0 -92
  58. package/dist/analytics/consent-manager.js +0 -257
  59. package/dist/benchmark/performance-benchmark.d.ts +0 -103
  60. package/dist/benchmark/performance-benchmark.js +0 -373
  61. package/dist/cli/commands/analytics-disable.d.ts +0 -9
  62. package/dist/cli/commands/analytics-disable.js +0 -72
  63. package/dist/cli/commands/analytics-enable-action.d.ts +0 -8
  64. package/dist/cli/commands/analytics-enable-action.js +0 -82
  65. package/dist/cli/commands/analytics-preview.d.ts +0 -9
  66. package/dist/cli/commands/analytics-preview.js +0 -106
  67. package/dist/cli/commands/analytics-status.d.ts +0 -9
  68. package/dist/cli/commands/analytics-status.js +0 -68
  69. package/dist/cli/commands/enforce.d.ts +0 -12
  70. package/dist/cli/commands/enforce.js +0 -78
  71. package/dist/cli/commands/govern.d.ts +0 -29
  72. package/dist/cli/commands/govern.js +0 -149
  73. package/dist/cli/commands/security-audit.d.ts +0 -23
  74. package/dist/cli/commands/security-audit.js +0 -219
  75. package/dist/cli/server.d.ts +0 -1
  76. package/dist/cli/server.js +0 -147
  77. package/dist/config/routing-mappings.d.ts +0 -26
  78. package/dist/config/routing-mappings.js +0 -151
  79. package/dist/core/bridge.mjs +0 -922
  80. package/dist/core/trace-context.d.ts +0 -12
  81. package/dist/core/trace-context.js +0 -33
  82. package/dist/enforcement/index.d.ts +0 -22
  83. package/dist/enforcement/index.js +0 -40
  84. package/dist/enforcement/loaders/index.d.ts +0 -36
  85. package/dist/enforcement/loaders/index.js +0 -39
  86. package/dist/enforcement/test-auto-healing.d.ts +0 -83
  87. package/dist/enforcement/test-auto-healing.js +0 -325
  88. package/dist/inference/index.d.ts +0 -10
  89. package/dist/inference/index.js +0 -5
  90. package/dist/infrastructure/iac-validator.d.ts +0 -150
  91. package/dist/infrastructure/iac-validator.js +0 -465
  92. package/dist/infrastructure/schemas/cloud-schemas.d.ts +0 -482
  93. package/dist/infrastructure/schemas/cloud-schemas.js +0 -488
  94. package/dist/integrations/base/ExampleIntegration.d.ts +0 -46
  95. package/dist/integrations/base/ExampleIntegration.js +0 -180
  96. package/dist/integrations/enforcement-gate.d.ts +0 -44
  97. package/dist/integrations/enforcement-gate.js +0 -348
  98. package/dist/mcps/connection/connection-manager.d.ts +0 -39
  99. package/dist/mcps/connection/connection-manager.js +0 -79
  100. package/dist/mcps/index.d.ts +0 -17
  101. package/dist/mcps/index.js +0 -65
  102. package/dist/mcps/orchestrator/index.d.ts +0 -6
  103. package/dist/mcps/orchestrator/index.js +0 -5
  104. package/dist/metrics/index.d.ts +0 -6
  105. package/dist/metrics/index.js +0 -6
  106. package/dist/orchestrator/self-direction-activation.d.ts +0 -108
  107. package/dist/orchestrator/self-direction-activation.js +0 -244
  108. package/dist/orchestrator/universal-registry-bridge.d.ts +0 -84
  109. package/dist/orchestrator/universal-registry-bridge.js +0 -246
  110. package/dist/performance/performance-budget-enforcer.d.ts +0 -157
  111. package/dist/performance/performance-budget-enforcer.js +0 -433
  112. package/dist/performance/performance-regression-tester.d.ts +0 -107
  113. package/dist/performance/performance-regression-tester.js +0 -341
  114. package/dist/postprocessor/analysis/CodeChangeAnalyzer.d.ts +0 -11
  115. package/dist/postprocessor/analysis/CodeChangeAnalyzer.js +0 -50
  116. package/dist/postprocessor/config/ProcessorConfigLoader.d.ts +0 -44
  117. package/dist/postprocessor/config/ProcessorConfigLoader.js +0 -16
  118. package/dist/postprocessor/integration.d.ts +0 -156
  119. package/dist/postprocessor/integration.js +0 -194
  120. package/dist/postprocessor/metamorphosis/index.d.ts +0 -2
  121. package/dist/postprocessor/metamorphosis/index.js +0 -1
  122. package/dist/postprocessor/redeploy/RetryHandler.d.ts +0 -49
  123. package/dist/postprocessor/redeploy/RetryHandler.js +0 -118
  124. package/dist/processors/implementations/session-capture-processor.d.ts +0 -14
  125. package/dist/processors/implementations/session-capture-processor.js +0 -37
  126. package/dist/public/XrayService.d.ts +0 -17
  127. package/dist/public/XrayService.js +0 -40
  128. package/dist/public/index.d.ts +0 -4
  129. package/dist/public/index.js +0 -2
  130. package/dist/security/comprehensive-security-audit.d.ts +0 -157
  131. package/dist/security/comprehensive-security-audit.js +0 -1004
  132. package/dist/security/index.d.ts +0 -13
  133. package/dist/security/index.js +0 -13
  134. package/dist/security/security-agent-coordinator.d.ts +0 -71
  135. package/dist/security/security-agent-coordinator.js +0 -203
  136. package/dist/security/security-hardening-system.d.ts +0 -238
  137. package/dist/security/security-hardening-system.js +0 -726
  138. package/dist/security/security-orchestration-layer.d.ts +0 -118
  139. package/dist/security/security-orchestration-layer.js +0 -495
  140. package/dist/testing/memory-regression-suite.d.ts +0 -105
  141. package/dist/testing/memory-regression-suite.js +0 -258
  142. package/dist/tools/assess-complexity-tool.d.ts +0 -28
  143. package/dist/tools/assess-complexity-tool.js +0 -44
  144. package/dist/tools/query-routing-tool.d.ts +0 -17
  145. package/dist/tools/query-routing-tool.js +0 -59
  146. package/dist/utils/batch-operations.d.ts +0 -25
  147. package/dist/utils/batch-operations.js +0 -292
  148. package/dist/utils/task-graph.d.ts +0 -29
  149. package/dist/utils/task-graph.js +0 -106
  150. package/dist/utils/test-template-generator.d.ts +0 -25
  151. package/dist/utils/test-template-generator.js +0 -178
  152. package/dist/utils/token-manager.d.ts +0 -48
  153. package/dist/utils/token-manager.js +0 -163
  154. package/dist/validation/agent-config-validator.d.ts +0 -110
  155. package/dist/validation/agent-config-validator.js +0 -280
  156. package/dist/validation/orchestration-flow-validator.d.ts +0 -87
  157. package/dist/validation/orchestration-flow-validator.js +0 -606
  158. package/src/mcps/connection/connection-manager.ts +0 -91
  159. package/src/mcps/index.ts +0 -80
  160. package/src/mcps/orchestrator/index.ts +0 -29
@@ -218,10 +218,69 @@ function readInstalledXrayVersion() {
218
218
  return pkg.version;
219
219
  }
220
220
 
221
+ /**
222
+ * npm installs the package named `0xray` at `node_modules/0xray`.
223
+ * `node_modules/xray` is the pre-rename folder. Use it only when that tree
224
+ * is the one on disk. Never prefer the old name over the real install.
225
+ */
226
+ const INSTALLED_PACKAGE_DIRS = ["0xray", "xray"];
227
+
228
+ function normalizeLaunchToken(token) {
229
+ return String(token).replace(/\\/g, "/");
230
+ }
231
+
221
232
  function localXrayCli(targetDir) {
222
233
  if (!targetDir) return null;
223
- const cli = path.join(targetDir, "node_modules", "0xray", "dist", "cli", "index.js");
224
- return fs.existsSync(cli) ? cli : null;
234
+ for (const dirName of INSTALLED_PACKAGE_DIRS) {
235
+ const cli = path.join(targetDir, "node_modules", dirName, "dist", "cli", "index.js");
236
+ if (fs.existsSync(cli)) return cli;
237
+ }
238
+ return null;
239
+ }
240
+
241
+ function isInstalledPackageCli(token) {
242
+ const normalized = normalizeLaunchToken(token);
243
+ return INSTALLED_PACKAGE_DIRS.some((dirName) =>
244
+ normalized.includes(`node_modules/${dirName}/dist/cli/index.js`),
245
+ );
246
+ }
247
+
248
+ /** Project-root `dist/cli/index.js` is the factory checkout. It is gitignored and goes stale. */
249
+ function isCheckoutDistCliLaunch(server) {
250
+ return launchTokens(server).some((token) => {
251
+ const normalized = normalizeLaunchToken(token);
252
+ const isDistCli =
253
+ normalized === "dist/cli/index.js" ||
254
+ normalized === "./dist/cli/index.js" ||
255
+ normalized.endsWith("/dist/cli/index.js");
256
+ return isDistCli && !isInstalledPackageCli(normalized);
257
+ });
258
+ }
259
+
260
+ function isLegacyXrayCliLaunch(server) {
261
+ return launchTokens(server).some((token) => {
262
+ const normalized = normalizeLaunchToken(token);
263
+ return normalized.includes("node_modules/xray/dist/cli/index.js");
264
+ });
265
+ }
266
+
267
+ function mcpSubcommand(inner) {
268
+ if (!inner || !Array.isArray(inner.args)) return null;
269
+ const idx = inner.args.indexOf("mcp");
270
+ if (idx >= 0 && inner.args[idx + 1]) return inner.args[idx + 1];
271
+ return null;
272
+ }
273
+
274
+ /**
275
+ * A checkout `dist/cli` launch is replaced with the installed package.
276
+ * A legacy `node_modules/xray` launch is replaced only when `node_modules/0xray` exists.
277
+ */
278
+ function shouldRepinToInstalledCli(inner, targetDir) {
279
+ if (!inner || hasVersionPin(inner)) return false;
280
+ if (isCheckoutDistCliLaunch(inner)) return true;
281
+ if (!isLegacyXrayCliLaunch(inner)) return false;
282
+ const cli = localXrayCli(targetDir);
283
+ return Boolean(cli && normalizeLaunchToken(cli).includes("/node_modules/0xray/"));
225
284
  }
226
285
 
227
286
  /** Prefer the installed CLI. Else pin npx to this package version. Never bare `0xray`. */
@@ -388,7 +447,7 @@ function mcpCmdFromInner(inner) {
388
447
  return inner.args.length > 0 ? inner.args[inner.args.length - 1] : null;
389
448
  }
390
449
 
391
- /** Framework fills gaps. User env, enabled/disabled, and version pins win. Unpinned `0xray` is repinned. Launch is `node mcp-launch.cjs --keep names -- cmd`. */
450
+ /** Framework fills gaps. User env, enabled/disabled, and version pins win. Unpinned `0xray` and a checkout `dist/cli` launch are repinned to the installed package. Launch is `node mcp-launch.cjs --keep names -- cmd`. */
392
451
  function mergeUserWinsServer(framework, user, targetDir) {
393
452
  if (!user || typeof user !== "object") return framework;
394
453
  if (!framework || typeof framework !== "object") return user;
@@ -403,6 +462,10 @@ function mergeUserWinsServer(framework, user, targetDir) {
403
462
  const mcpCmd = mcpCmdFromInner(inner);
404
463
  if (mcpCmd) inner = pinnedMcpLaunch(targetDir, mcpCmd);
405
464
  }
465
+ if (inner && shouldRepinToInstalledCli(inner, targetDir)) {
466
+ const mcpCmd = mcpSubcommand(inner);
467
+ if (mcpCmd) inner = pinnedMcpLaunch(targetDir, mcpCmd);
468
+ }
406
469
  if (!inner) return framework;
407
470
  const mergedEnv = mergeScopedEnv([
408
471
  baseScopedEnv(targetDir),
@@ -228,10 +228,10 @@ function mergeOpencodeJson(targetDir, packageRoot, log) {
228
228
  }
229
229
 
230
230
  function grokHookShellCommand(packageRoot, scriptName, extraArgs) {
231
- const script = path.join(packageRoot, "dist", "integrations", "grok", "hooks", scriptName);
231
+ const script = path.join(packageRoot, "scripts", "mjs", "run-grok-hook.mjs");
232
232
  const extra = extraArgs ? ` ${extraArgs}` : "";
233
233
  // JSON.stringify quotes so spaces/$ in install paths still exec (Grok fail-opens on crash).
234
- return `XRAY_AI_PATH=${JSON.stringify(packageRoot)} node ${JSON.stringify(script)}${extra}`;
234
+ return `XRAY_AI_PATH=${JSON.stringify(packageRoot)} node ${JSON.stringify(script)} ${scriptName}${extra}`;
235
235
  }
236
236
 
237
237
  function patchGrokHookEntry(hook, packageRoot, targetDir, scriptName, extraArgs) {
@@ -260,7 +260,7 @@ function ensureGrokHookEvent(hooks, eventName) {
260
260
  function patchGrokHooks(pluginDir, packageRoot, targetDir, log, label) {
261
261
  const hooksDir = path.join(pluginDir, "hooks");
262
262
  const hooksPath = path.join(hooksDir, "hooks.json");
263
- const hookScript = path.join(packageRoot, "dist", "integrations", "grok", "hooks", "pre-tool-use.js");
263
+ const hookScript = path.join(packageRoot, "scripts", "mjs", "run-grok-hook.mjs");
264
264
  if (!fs.existsSync(hooksPath)) {
265
265
  if (!fs.existsSync(hooksDir)) fs.mkdirSync(hooksDir, { recursive: true });
266
266
  if (!fs.existsSync(hooksPath)) return;
@@ -75,7 +75,7 @@ function deployManagedAgents(packageRoot, targetDir, log) {
75
75
  if (updated !== current) fs.writeFileSync(agentsDest, updated);
76
76
  }
77
77
 
78
- /** npm install links vendored @0xray/repertoire and nothing else. The suit is `npx 0xray wear`. */
78
+ /** npm install links vendored @0xray/repertoire and does not write `.mcp.json`. `npx 0xray wear` rewrites a checkout `dist/cli` launch to `node_modules/0xray`. */
79
79
  function runPostinstall(packageRoot, targetDir, _log) {
80
80
  linkVendoredRepertoire(packageRoot, targetDir);
81
81
  console.log("Run `npx 0xray wear`");
@@ -33,21 +33,25 @@ function updatePathsInFile(filePath) {
33
33
  let content = fs.readFileSync(filePath, 'utf-8');
34
34
  let updated = false;
35
35
 
36
- // Transform development paths back to consumer paths (plain xray; legacy @0xray/xray removed)
37
- // Only transform if it's not already a consumer path
38
- if (content.includes('dist/plugin/mcps/') && !content.includes('node_modules/xray/dist/plugin/mcps/')) {
36
+ // The published package name is 0xray, so the installed tree is node_modules/0xray.
37
+ // Upgrade a pre-rename node_modules/xray path before prefixing bare dist/ paths.
38
+ if (content.includes('node_modules/xray/')) {
39
+ content = content.replace(/node_modules\/xray\//g, 'node_modules/0xray/');
40
+ updated = true;
41
+ }
42
+
43
+ if (content.includes('dist/plugin/mcps/') && !content.includes('node_modules/0xray/dist/plugin/mcps/')) {
39
44
  content = content.replace(
40
45
  /dist\/plugin\/mcps\//g,
41
- 'node_modules/xray/dist/plugin/mcps/'
46
+ 'node_modules/0xray/dist/plugin/mcps/'
42
47
  );
43
48
  updated = true;
44
49
  }
45
50
 
46
- // Transform plugin paths back to consumer format (only the relative dev paths)
47
51
  if (content.includes('../../../dist/plugin/')) {
48
52
  content = content.replace(
49
53
  /\.\.\/\.\.\/\.\.\/dist\/plugin\//g,
50
- 'node_modules/xray/dist/plugin/'
54
+ 'node_modules/0xray/dist/plugin/'
51
55
  );
52
56
  updated = true;
53
57
  }
@@ -140,4 +144,4 @@ function addJsExtensionsToDist() {
140
144
  addJsExtensionsToDist();
141
145
 
142
146
  structuredLog('prepare-consumer', 'xray v2 Consumer Preparation: Complete!', 'success');
143
- structuredLog('prepare-consumer', 'Package is now ready for consumer installation (plain xray technical identity).', 'info');
147
+ structuredLog('prepare-consumer', 'Package is now ready for consumer installation (node_modules/0xray).', 'info');
@@ -23,32 +23,24 @@ function updatePathsInFile(filePath) {
23
23
  let content = fs.readFileSync(filePath, 'utf-8');
24
24
  let updated = false;
25
25
 
26
- // Transform MCP server paths (specific first)
27
- if (content.includes('node_modules/xray/dist/plugin/mcps/')) {
28
- content = content.replace(
29
- /node_modules\/xray\/dist\/plugin\/mcps\//g,
30
- 'dist/plugin/mcps/'
31
- );
32
- updated = true;
33
- }
34
-
35
- // Transform plugin paths (go up 3 directories from .opencode to project root)
36
- if (content.includes('node_modules/xray/dist/plugin/plugins/')) {
37
- content = content.replace(
38
- /node_modules\/xray\/dist\/plugin\/plugins\//g,
39
- '../../../dist/plugin/plugins/'
40
- );
41
- updated = true;
42
- }
43
-
44
- // Transform any remaining node_modules paths (but not plugin-specific ones we already handled)
45
- if (content.includes('node_modules/xray/dist/') &&
46
- !content.includes('dist/plugin/')) { // Avoid double transformation
47
- content = content.replace(
48
- /node_modules\/xray\/dist\//g,
49
- 'dist/'
50
- );
51
- updated = true;
26
+ // npm installs at node_modules/0xray. node_modules/xray is the pre-rename folder.
27
+ // Specific plugin paths first so the general dist/ strip does not flatten them.
28
+ for (const dirName of ['0xray', 'xray']) {
29
+ const plugins = `node_modules/${dirName}/dist/plugin/plugins/`;
30
+ if (content.includes(plugins)) {
31
+ content = content.replaceAll(plugins, '../../../dist/plugin/plugins/');
32
+ updated = true;
33
+ }
34
+ const mcps = `node_modules/${dirName}/dist/plugin/mcps/`;
35
+ if (content.includes(mcps)) {
36
+ content = content.replaceAll(mcps, 'dist/plugin/mcps/');
37
+ updated = true;
38
+ }
39
+ const prefix = `node_modules/${dirName}/dist/`;
40
+ if (content.includes(prefix)) {
41
+ content = content.replaceAll(prefix, 'dist/');
42
+ updated = true;
43
+ }
52
44
  }
53
45
 
54
46
  if (updated) {
@@ -18,7 +18,8 @@ const __filename = fileURLToPath(import.meta.url);
18
18
  const __dirname = path.dirname(__filename);
19
19
 
20
20
  // Detect if running in consumer environment (node_modules)
21
- const isConsumerEnvironment = __dirname.includes("node_modules/xray");
21
+ const isConsumerEnvironment = __dirname.includes(`${path.sep}node_modules${path.sep}0xray${path.sep}`)
22
+ || __dirname.includes(`${path.sep}node_modules${path.sep}xray${path.sep}`);
22
23
  const pathPrefix = isConsumerEnvironment ? "" : "";
23
24
 
24
25
  const MCP_SERVERS = [
@@ -5,7 +5,7 @@
5
5
  "hooks": [
6
6
  {
7
7
  "type": "command",
8
- "command": "XRAY_AI_PATH=\"${XRAY_AI_PATH:-node_modules/0xray}\" node \"${XRAY_AI_PATH:-node_modules/0xray}/dist/integrations/grok/hooks/pre-tool-use.js\"",
8
+ "command": "XRAY_AI_PATH=\"${XRAY_AI_PATH:-node_modules/0xray}\" node \"${XRAY_AI_PATH:-node_modules/0xray}/scripts/mjs/run-grok-hook.mjs\" pre-tool-use.js",
9
9
  "timeout": 30
10
10
  }
11
11
  ]
@@ -16,7 +16,7 @@
16
16
  "hooks": [
17
17
  {
18
18
  "type": "command",
19
- "command": "XRAY_AI_PATH=\"${XRAY_AI_PATH:-node_modules/0xray}\" node \"${XRAY_AI_PATH:-node_modules/0xray}/dist/integrations/grok/hooks/session-start.js\"",
19
+ "command": "XRAY_AI_PATH=\"${XRAY_AI_PATH:-node_modules/0xray}\" node \"${XRAY_AI_PATH:-node_modules/0xray}/scripts/mjs/run-grok-hook.mjs\" session-start.js",
20
20
  "timeout": 30
21
21
  }
22
22
  ]
@@ -27,7 +27,7 @@
27
27
  "hooks": [
28
28
  {
29
29
  "type": "command",
30
- "command": "XRAY_AI_PATH=\"${XRAY_AI_PATH:-node_modules/0xray}\" node \"${XRAY_AI_PATH:-node_modules/0xray}/dist/integrations/grok/hooks/session-start.js\" --hook-event=user_prompt_submit",
30
+ "command": "XRAY_AI_PATH=\"${XRAY_AI_PATH:-node_modules/0xray}\" node \"${XRAY_AI_PATH:-node_modules/0xray}/scripts/mjs/run-grok-hook.mjs\" session-start.js --hook-event=user_prompt_submit",
31
31
  "timeout": 30
32
32
  }
33
33
  ]
@@ -38,7 +38,7 @@
38
38
  "hooks": [
39
39
  {
40
40
  "type": "command",
41
- "command": "XRAY_AI_PATH=\"${XRAY_AI_PATH:-node_modules/0xray}\" node \"${XRAY_AI_PATH:-node_modules/0xray}/dist/integrations/grok/hooks/post-tool-use.js\"",
41
+ "command": "XRAY_AI_PATH=\"${XRAY_AI_PATH:-node_modules/0xray}\" node \"${XRAY_AI_PATH:-node_modules/0xray}/scripts/mjs/run-grok-hook.mjs\" post-tool-use.js",
42
42
  "timeout": 30
43
43
  }
44
44
  ]
@@ -49,7 +49,7 @@
49
49
  "hooks": [
50
50
  {
51
51
  "type": "command",
52
- "command": "XRAY_AI_PATH=\"${XRAY_AI_PATH:-node_modules/0xray}\" node \"${XRAY_AI_PATH:-node_modules/0xray}/dist/integrations/grok/hooks/session-start.js\" --hook-event=pre_compact",
52
+ "command": "XRAY_AI_PATH=\"${XRAY_AI_PATH:-node_modules/0xray}\" node \"${XRAY_AI_PATH:-node_modules/0xray}/scripts/mjs/run-grok-hook.mjs\" session-start.js --hook-event=pre_compact",
53
53
  "timeout": 30
54
54
  }
55
55
  ]
@@ -60,7 +60,7 @@
60
60
  "hooks": [
61
61
  {
62
62
  "type": "command",
63
- "command": "XRAY_AI_PATH=\"${XRAY_AI_PATH:-node_modules/0xray}\" node \"${XRAY_AI_PATH:-node_modules/0xray}/dist/integrations/grok/hooks/session-start.js\" --hook-event=post_compact",
63
+ "command": "XRAY_AI_PATH=\"${XRAY_AI_PATH:-node_modules/0xray}\" node \"${XRAY_AI_PATH:-node_modules/0xray}/scripts/mjs/run-grok-hook.mjs\" session-start.js --hook-event=post_compact",
64
64
  "timeout": 30
65
65
  }
66
66
  ]
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "xray-pre-tool",
3
- "version": "4.0.34",
3
+ "version": "4.0.36",
4
4
  "private": true,
5
5
  "type": "module",
6
6
  "description": "0xRay constitution + temperament PreToolUse for OpenClaw",
@@ -24,7 +24,6 @@ interface WriteStoryArgs {
24
24
  function resolveSkillMd(): string {
25
25
  const here = dirname(fileURLToPath(import.meta.url));
26
26
  const candidates = [
27
- join(here, '../../../skills/storyteller/SKILL.md'),
28
27
  join(here, '../../skills/storyteller/SKILL.md'),
29
28
  join(process.cwd(), 'node_modules/0xray/dist/skills/storyteller/SKILL.md'),
30
29
  join(process.cwd(), 'node_modules/xray/dist/skills/storyteller/SKILL.md'),
@@ -30,14 +30,14 @@ All seven use `npx -y 0xray mcp <cmd>`:
30
30
 
31
31
  xray operates under the three-subsystem model: Inference + External Governance (Dynamo Solar SSOT) + Autonomous Engine (thinDispatch 7-flow in MCP orchestrator). All actions are validated against the Universal Development Codex before execution.
32
32
 
33
- **Codex**: `.xray/codex.json` — **69 terms** across all agent interactions.
33
+ **Codex**: `.xray/codex.json` — **70 terms** across all agent interactions.
34
34
 
35
35
  ## thinDispatch Routing
36
36
 
37
- - Simple (≤15): Single agent
38
- - Moderate (≤25): Single agent with tools
39
- - Complex (≤50): Multi-agent coordination
40
- - Enterprise (>50): Orchestrator-led team
37
+ - Simple (≤15): single-agent
38
+ - Moderate (≤25): multi-agent
39
+ - Complex (≤50): orchestrator-led
40
+ - Enterprise (>50): orchestrator-led
41
41
 
42
42
  ## File Organization
43
43
 
package/xray/codex.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "version": "3.1.0",
3
- "lastUpdated": "2026-08-24",
3
+ "lastUpdated": "2026-10-01",
4
4
  "errorPreventionTarget": 0.998,
5
5
  "terms": {
6
6
  "1": {
@@ -62,7 +62,7 @@
62
62
  "8": {
63
63
  "number": 8,
64
64
  "title": "Prevent Infinite Loops",
65
- "description": "Guarantee termination in all iterative processes. All loops must have clear termination conditions. Recursive functions must have base cases. Event loops must have exit strategies. Async operations must have timeout mechanisms.",
65
+ "description": "Guarantee termination in all iterative processes. All loops must have clear termination conditions. Recursive functions must have base cases. Event loops must have exit strategies. Async operations must have timeout mechanisms. A job names when it is done and when it stops.",
66
66
  "category": "core",
67
67
  "zeroTolerance": true,
68
68
  "enforcementLevel": "blocking"
@@ -230,7 +230,7 @@
230
230
  "29": {
231
231
  "number": 29,
232
232
  "title": "Security by Design",
233
- "description": "Validate all inputs. Sanitize data before rendering. Use HTTPS for all requests. Implement rate limiting. Never expose sensitive data.",
233
+ "description": "Validate all inputs. Sanitize data before rendering. Use HTTPS for all requests. Implement rate limiting. Never expose sensitive data. Do not trust Host or X-Forwarded-Host to choose an environment. A refusal in the UI needs the same check on the server.",
234
234
  "category": "security",
235
235
  "zeroTolerance": true,
236
236
  "enforcementLevel": "blocking"
@@ -534,7 +534,7 @@
534
534
  "67": {
535
535
  "number": 67,
536
536
  "title": "Use Best Subagents, Reuse Session Context",
537
- "description": "Delegate work to the best-suited subagent for each task. Stay responsive to user inquiries, additional todos, and course corrections. Reuse the same subagent via session ID to preserve context and avoid restarting from zero. Do not spawn fresh agents when an existing one has the relevant context.",
537
+ "description": "Delegate work to the best-suited subagent for each task. Stay responsive to user inquiries, additional todos, and course corrections. Reuse the same subagent via session ID to preserve context and avoid restarting from zero. Do not spawn fresh agents when an existing one has the relevant context. Reuse one cloud for a workstream. Do not launch a new agent for a check the seat can run.",
538
538
  "category": "process",
539
539
  "zeroTolerance": false,
540
540
  "enforcementLevel": "high"
@@ -554,6 +554,14 @@
554
554
  "category": "process",
555
555
  "zeroTolerance": true,
556
556
  "enforcementLevel": "blocking"
557
+ },
558
+ "70": {
559
+ "number": 70,
560
+ "title": "Current Copy Before Edits",
561
+ "description": "Before an edit, be on the latest main and run the current package. If this repo is 0xray, this repo is that package. An older package waits. Compare set-aside work to main before you throw it away.",
562
+ "category": "process",
563
+ "zeroTolerance": true,
564
+ "enforcementLevel": "blocking"
557
565
  }
558
566
  },
559
567
  "interweaves": [
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "$schema": "./features.schema.json",
3
- "version": "4.0.34",
3
+ "version": "4.0.36",
4
4
  "description": "0xRay Framework - Unified Feature Configuration",
5
5
  "suit_temperament": {
6
6
  "profile": "auto",
@@ -1,26 +0,0 @@
1
- /**
2
- * Known Names — Single combined vocabulary for agent names, skill names,
3
- * system service names, and opencode built-in types. All consumers import
4
- * from here instead of defining their own hardcoded lists.
5
- *
6
- * Imports:
7
- * - registry.ts (AGENT_REGISTRY, AGENT_KEYS) — canonical agent definitions
8
- * - mcps/index.ts (MCP_SERVERS) — canonical MCP server manifest
9
- */
10
- import { AGENT_KEYS, type AgentKey } from "./registry.js";
11
- import { MCP_SERVERS } from "../mcps/index.js";
12
- export { AGENT_KEYS, type AgentKey };
13
- export type { AgentKey as AgentName };
14
- /** All agent names as a mutable array */
15
- export declare function getAgentNames(): string[];
16
- export declare const SYSTEM_SERVICE_NAMES: readonly ["enforcer", "orchestrator", "analyzer"];
17
- export declare const OPENCODE_BUILTIN_TYPES: readonly ["explore", "general"];
18
- export declare const ALL_KNOWN_NAMES: readonly [...string[], "enforcer", "orchestrator", "analyzer", "explore", "general"];
19
- export type KnownName = typeof ALL_KNOWN_NAMES[number];
20
- export declare const BOOT_AGENTS: readonly ["enforcer", "architect", "bug-triage-specialist", "code-reviewer", "security-auditor", "refactorer", "testing-lead"];
21
- export declare function isValidType(name: string): boolean;
22
- export declare const AGENT_TO_SKILL_MAP: Record<string, string>;
23
- /** Resolve agent name to skill name via alias map, fallback to identity */
24
- export declare function resolveSkill(agentOrSkill: string): string;
25
- export { MCP_SERVERS };
26
- export declare function getSkillNames(): string[];
@@ -1,72 +0,0 @@
1
- /**
2
- * Known Names — Single combined vocabulary for agent names, skill names,
3
- * system service names, and opencode built-in types. All consumers import
4
- * from here instead of defining their own hardcoded lists.
5
- *
6
- * Imports:
7
- * - registry.ts (AGENT_REGISTRY, AGENT_KEYS) — canonical agent definitions
8
- * - mcps/index.ts (MCP_SERVERS) — canonical MCP server manifest
9
- */
10
- import { AGENT_KEYS } from "./registry.js";
11
- import { MCP_SERVERS } from "../mcps/index.js";
12
- // ── Agent names (from SSOT) ──
13
- export { AGENT_KEYS };
14
- /** All agent names as a mutable array */
15
- export function getAgentNames() {
16
- return [...AGENT_KEYS];
17
- }
18
- // ── System service names (not in AGENT_REGISTRY) ──
19
- export const SYSTEM_SERVICE_NAMES = [
20
- "enforcer",
21
- "orchestrator",
22
- "analyzer",
23
- ];
24
- // ── Opencode CLI built-in types ──
25
- export const OPENCODE_BUILTIN_TYPES = [
26
- "explore",
27
- "general",
28
- ];
29
- // ── Combined vocabulary ──
30
- export const ALL_KNOWN_NAMES = [
31
- ...AGENT_KEYS,
32
- ...SYSTEM_SERVICE_NAMES,
33
- ...OPENCODE_BUILTIN_TYPES,
34
- ];
35
- // ── Boot-priority agents (loaded first by boot-orchestrator) ──
36
- export const BOOT_AGENTS = [
37
- "enforcer",
38
- "architect",
39
- "bug-triage-specialist",
40
- "code-reviewer",
41
- "security-auditor",
42
- "refactorer",
43
- "testing-lead",
44
- ];
45
- // ── Validation ──
46
- export function isValidType(name) {
47
- return ALL_KNOWN_NAMES.includes(name);
48
- }
49
- // ── Agent → Skill alias map (single source) ──
50
- export const AGENT_TO_SKILL_MAP = {
51
- "architect": "architecture-patterns",
52
- "backend-engineer": "api-design",
53
- "code-reviewer": "code-review",
54
- "database-engineer": "database-design",
55
- "devops-engineer": "devops-deployment",
56
- "mobile-developer": "mobile-development",
57
- "performance-engineer": "performance-optimization",
58
- "security-auditor": "security-audit",
59
- "testing-lead": "testing-strategy",
60
- "tech-writer": "documentation-generation",
61
- "frontend-ui-ux-engineer": "ui-ux-design",
62
- "frontend-engineer": "project-analysis",
63
- };
64
- /** Resolve agent name to skill name via alias map, fallback to identity */
65
- export function resolveSkill(agentOrSkill) {
66
- return AGENT_TO_SKILL_MAP[agentOrSkill] || agentOrSkill;
67
- }
68
- // ── MCP server names (for consumers that need them) ──
69
- export { MCP_SERVERS };
70
- export function getSkillNames() {
71
- return MCP_SERVERS.map(s => s.serverName);
72
- }
@@ -1,92 +0,0 @@
1
- /**
2
- * Consent Manager for 0xRay Central Analytics
3
- *
4
- * Manages user consent for analytics data submission with granular
5
- * control over what categories can be shared.
6
- *
7
- * @since 2026-03-06
8
- */
9
- export interface ConsentConfiguration {
10
- analyticsEnabled: boolean;
11
- consentDate: Date;
12
- consentVersion: string;
13
- lastOptOut: Date | undefined;
14
- categories: {
15
- reflections: boolean;
16
- logs: boolean;
17
- metrics: boolean;
18
- patterns: boolean;
19
- };
20
- projectId: string;
21
- }
22
- export interface ConsentCategory {
23
- name: string;
24
- description: string;
25
- enabled: boolean;
26
- }
27
- export declare class ConsentManager {
28
- private configPath;
29
- private config;
30
- private submissionQueue;
31
- constructor(configPath?: string | undefined);
32
- /**
33
- * Initialize consent manager - load existing config or create default
34
- */
35
- initialize(): Promise<ConsentConfiguration>;
36
- /**
37
- * Enable analytics (opt-in)
38
- */
39
- enableConsent(categories?: string[]): Promise<void>;
40
- /**
41
- * Disable analytics (opt-out)
42
- */
43
- disableConsent(): Promise<void>;
44
- /**
45
- * Check if submission is allowed for a category
46
- */
47
- canSubmit(category: string): boolean;
48
- /**
49
- * Get current consent status
50
- */
51
- getStatus(): Promise<ConsentConfiguration>;
52
- /**
53
- * Enable specific category
54
- */
55
- enableCategory(category: string): Promise<void>;
56
- /**
57
- * Disable specific category
58
- */
59
- disableCategory(category: string): Promise<void>;
60
- /**
61
- * Get all categories with their status
62
- */
63
- getCategories(): ConsentCategory[];
64
- /**
65
- * Generate anonymous project ID
66
- */
67
- private generateProjectId;
68
- /**
69
- * Create default disabled configuration
70
- */
71
- private createDefaultConfig;
72
- /**
73
- * Load configuration from file
74
- */
75
- private loadConfig;
76
- /**
77
- * Save configuration to file
78
- */
79
- private saveConfig;
80
- /**
81
- * Clear submission queue
82
- */
83
- private clearSubmissionQueue;
84
- /**
85
- * Add item to submission queue
86
- */
87
- queueSubmission(data: unknown): Promise<void>;
88
- /**
89
- * Save submission queue to file
90
- */
91
- private saveSubmissionQueue;
92
- }