0xray 4.0.35 → 4.0.37

package/dist/enforcement/validators/architecture-validators.js

@@ -278,6 +278,108 @@ export class ErrorResolutionValidator extends BaseValidator {
         return this.createSuccessResult("Error resolution patterns are properly implemented");
     }
 }
+/** Code points matched by a non-unicode `\s` in this Node. */
+function isCallWhitespace(ch) {
+    const c = ch.charCodeAt(0);
+    if (c <= 32) {
+        return c === 9 || c === 10 || c === 11 || c === 12 || c === 13 || c === 32;
+    }
+    if (c >= 0x2000 && c <= 0x200a)
+        return true;
+    return (c === 0xa0 ||
+        c === 0x1680 ||
+        c === 0x2028 ||
+        c === 0x2029 ||
+        c === 0x202f ||
+        c === 0x205f ||
+        c === 0x3000 ||
+        c === 0xfeff);
+}
+/** Per-name scans are cheaper below this; one automaton wins above it. */
+const CALL_SCAN_NAME_THRESHOLD = 48;
+/**
+ * Counts `name\\s*\\(` for every name.
+ * Suffix hits count (`foo` inside `myfoo(`), matching a separate global regex per name.
+ */
+function countNameCallSites(code, names) {
+    if (names.length < CALL_SCAN_NAME_THRESHOLD) {
+        return names.map((funcName) => (code.match(new RegExp(`${funcName}\\s*\\(`, "g")) || []).length);
+    }
+    const counts = new Array(names.length).fill(0);
+    if (code.length === 0)
+        return counts;
+    const nodes = [{ next: new Map(), fail: 0, out: [] }];
+    for (let nameIndex = 0; nameIndex < names.length; nameIndex++) {
+        const name = names[nameIndex] ?? "";
+        let state = 0;
+        for (let i = 0; i < name.length; i++) {
+            const ch = name.charAt(i);
+            const current = nodes[state];
+            if (!current)
+                break;
+            let next = current.next.get(ch);
+            if (next === undefined) {
+                next = nodes.length;
+                nodes.push({ next: new Map(), fail: 0, out: [] });
+                current.next.set(ch, next);
+            }
+            state = next;
+        }
+        nodes[state]?.out.push(nameIndex);
+    }
+    const queue = [];
+    const root = nodes[0];
+    if (!root)
+        return counts;
+    for (const next of root.next.values())
+        queue.push(next);
+    let head = 0;
+    while (head < queue.length) {
+        const currentIndex = queue[head++];
+        const current = currentIndex === undefined ? undefined : nodes[currentIndex];
+        if (!current)
+            continue;
+        for (const [ch, childIndex] of current.next) {
+            queue.push(childIndex);
+            let fail = current.fail;
+            while (fail !== 0 && !nodes[fail]?.next.has(ch)) {
+                fail = nodes[fail]?.fail ?? 0;
+            }
+            const down = nodes[fail]?.next.get(ch);
+            const child = nodes[childIndex];
+            if (!child)
+                continue;
+            child.fail = down !== undefined && down !== childIndex ? down : 0;
+            const failOut = nodes[child.fail]?.out;
+            if (failOut && failOut.length > 0) {
+                child.out = child.out.concat(failOut);
+            }
+        }
+    }
+    let state = 0;
+    for (let i = 0; i < code.length; i++) {
+        const ch = code.charAt(i);
+        while (state !== 0 && !nodes[state]?.next.has(ch)) {
+            state = nodes[state]?.fail ?? 0;
+        }
+        const down = nodes[state]?.next.get(ch);
+        state = down === undefined ? 0 : down;
+        const outs = nodes[state]?.out;
+        if (!outs || outs.length === 0)
+            continue;
+        let k = i + 1;
+        while (k < code.length && isCallWhitespace(code.charAt(k)))
+            k++;
+        if (code.charAt(k) !== "(")
+            continue;
+        for (const nameIndex of outs) {
+            const current = counts[nameIndex];
+            if (current !== undefined)
+                counts[nameIndex] = current + 1;
+        }
+    }
+    return counts;
+}
 /**
  * Validates loop safety (Codex Term #8).
  * Prevents infinite loops by checking for proper termination conditions.
@@ -322,15 +424,19 @@ export class LoopSafetyValidator extends BaseValidator {
         // Check for recursion without base case detection (basic)
         const functionMatches = newCode.match(/function\s+\w+\s*\([^)]*\)/g);
         if (functionMatches) {
-            const functionNames = functionMatches
-                .map((match) => {
-                const nameMatch = match.match(/function\s+(\w+)/);
-                return nameMatch ? nameMatch[1] : null;
-            })
-                .filter(Boolean);
-            for (const funcName of functionNames) {
-                // Check if function calls itself (basic recursion detection)
-                const selfCalls = (newCode.match(new RegExp(`${funcName}\\s*\\(`, "g")) || []).length;
+            const functionNames = [];
+            for (const match of functionMatches) {
+                const name = match.match(/function\s+(\w+)/)?.[1];
+                if (name)
+                    functionNames.push(name);
+            }
+            const callCounts = countNameCallSites(newCode, functionNames);
+            for (let i = 0; i < functionNames.length; i++) {
+                const funcName = functionNames[i];
+                if (!funcName)
+                    continue;
+                // Same count a per-name /name\s*\(/g scan would return, including suffix hits.
+                const selfCalls = callCounts[i] ?? 0;
                 if (selfCalls > 1) {
                     // More than just the function definition
                     // Allow recursive functions with proper base cases (edge case)

package/dist/governance/codex-policy.service.d.ts

@@ -15,7 +15,8 @@
  *   - Returns ActiveCodexSnapshot compatible with the existing get_active_codex MCP tool.
  *   - Provides getTermCount() with safe 60-term fallback (preserves prior behavior of bypasses).
  *   - Full frameworkLogger discipline on every load/decision/error.
- *   - No caching in v1 skeleton (additive later); no mutation; no enforcement.
+ *   - Reuses one parsed codex while that file still wins and its mtime and size are unchanged.
+ *   - No mutation of the cached codex; no enforcement.
  *
  * First wired consumer: src/mcps/enforcer-tools.server.ts (getCodexTermCount bypass removed;
  * now delegates through this service).
@@ -34,9 +35,18 @@ import type { ActiveCodexSnapshot, ICodexPolicyProvider } from './governance-typ
  */
 export declare class CodexPolicyService implements ICodexPolicyProvider {
     private readonly component;
+    /**
+     * Winning parse. Invalid when a higher-priority path appears or mtime/size changes,
+     * so the next check still parses the bytes a fresh load would have read.
+     */
+    private codexCache;
+    private candidateKey;
+    private fileIdentity;
+    private cachedRaw;
     /**
      * Internal loader: resolves candidates, picks first existing, reads + parses.
-     * Always logs via frameworkLogger (success, error, fallback).
+     * Repeat calls skip the read and JSON.parse while the winning file is unchanged.
+     * Logs via frameworkLogger on load, error, and fallback (not on a cache hit).
      */
     private loadRaw;
     private computeTermCount;

package/dist/governance/codex-policy.service.js

@@ -15,7 +15,8 @@
  *   - Returns ActiveCodexSnapshot compatible with the existing get_active_codex MCP tool.
  *   - Provides getTermCount() with safe 60-term fallback (preserves prior behavior of bypasses).
  *   - Full frameworkLogger discipline on every load/decision/error.
- *   - No caching in v1 skeleton (additive later); no mutation; no enforcement.
+ *   - Reuses one parsed codex while that file still wins and its mtime and size are unchanged.
+ *   - No mutation of the cached codex; no enforcement.
  *
  * First wired consumer: src/mcps/enforcer-tools.server.ts (getCodexTermCount bypass removed;
  * now delegates through this service).
@@ -29,51 +30,125 @@
  */
 import { frameworkLogger } from '../core/framework-logger.js';
 import { resolveCodexPath } from '../core/config-paths.js';
-import { existsSync } from 'fs';
+import { existsSync, statSync } from 'fs';
 import * as fs from 'fs/promises';
+/** mtimeNs when the stat has it. mtimeMs only when it does not. */
+function codexClock(fileStat) {
+    const nanos = fileStat.mtimeNs;
+    if (typeof nanos === 'bigint')
+        return nanos.toString();
+    if (typeof nanos === 'number' && Number.isFinite(nanos))
+        return String(nanos);
+    if (typeof fileStat.mtimeMs === 'number' && Number.isFinite(fileStat.mtimeMs)) {
+        return String(fileStat.mtimeMs);
+    }
+    return null;
+}
 /**
  * Canonical implementation of the Governance Codex/Policy provider.
  * Single owner of the "first read" of any codex.json for the framework.
  */
 export class CodexPolicyService {
     component = 'codex-policy-service';
+    /**
+     * Winning parse. Invalid when a higher-priority path appears or mtime/size changes,
+     * so the next check still parses the bytes a fresh load would have read.
+     */
+    codexCache = null;
+    candidateKey(candidates) {
+        return JSON.stringify(candidates);
+    }
+    fileIdentity(sourcePath) {
+        try {
+            const fileStat = statSync(sourcePath);
+            if (!fileStat.isFile())
+                return null;
+            const clock = codexClock(fileStat);
+            if (clock === null)
+                return null;
+            return `${clock}:${fileStat.size}`;
+        }
+        catch {
+            return null;
+        }
+    }
+    cachedRaw(candidates) {
+        const cached = this.codexCache;
+        if (!cached || cached.candidateKey !== this.candidateKey(candidates))
+            return null;
+        for (let i = 0; i < cached.index; i++) {
+            const higher = candidates[i];
+            if (higher && existsSync(higher))
+                return null;
+        }
+        const identity = this.fileIdentity(cached.sourcePath);
+        if (!identity || identity !== cached.identity)
+            return null;
+        return cached.raw;
+    }
     /**
      * Internal loader: resolves candidates, picks first existing, reads + parses.
-     * Always logs via frameworkLogger (success, error, fallback).
+     * Repeat calls skip the read and JSON.parse while the winning file is unchanged.
+     * Logs via frameworkLogger on load, error, and fallback (not on a cache hit).
      */
     async loadRaw() {
-        const candidates = resolveCodexPath();
-        const resolvedPath = Array.isArray(candidates)
-            ? candidates.find((p) => existsSync(p)) || candidates[0] || null
-            : candidates || null;
-        if (!resolvedPath || !existsSync(resolvedPath)) {
+        const resolved = resolveCodexPath();
+        const candidates = Array.isArray(resolved)
+            ? resolved
+            : resolved
+                ? [resolved]
+                : [];
+        const hit = this.cachedRaw(candidates);
+        if (hit)
+            return hit;
+        const index = candidates.findIndex((candidate) => existsSync(candidate));
+        const indexed = index >= 0 ? candidates[index] : undefined;
+        const sourcePath = indexed ?? candidates[0] ?? null;
+        if (index < 0 || !sourcePath) {
+            this.codexCache = null;
             await frameworkLogger.log(this.component, 'codex-not-found', 'warning', {
                 candidates,
-                resolvedPath,
+                resolvedPath: sourcePath,
                 message: 'No codex.json found in standard locations; using fallback behavior',
             });
-            return { path: resolvedPath, data: this.getBuiltinFallback(), isFallback: true };
+            return { path: sourcePath, data: this.getBuiltinFallback(), isFallback: true };
         }
         try {
-            const content = await fs.readFile(resolvedPath, 'utf-8');
+            const before = this.fileIdentity(sourcePath);
+            const content = await fs.readFile(sourcePath, 'utf-8');
             const data = JSON.parse(content);
             const termCount = this.computeTermCount(data);
+            const raw = { path: sourcePath, data, isFallback: false };
+            const after = this.fileIdentity(sourcePath);
+            if (before && after && before === after) {
+                this.codexCache = {
+                    candidateKey: this.candidateKey(candidates),
+                    index,
+                    sourcePath,
+                    identity: after,
+                    raw,
+                };
+            }
+            else {
+                this.codexCache = null;
+            }
             await frameworkLogger.log(this.component, 'codex-loaded', 'success', {
-                source: resolvedPath,
+                source: sourcePath,
                 version: data?.version || 'unknown',
                 termCount,
                 lastUpdated: data?.lastUpdated,
             });
-            return { path: resolvedPath, data, isFallback: false };
+            return raw;
         }
         catch (error) {
+            this.codexCache = null;
             const msg = error instanceof Error ? error.message : String(error);
             await frameworkLogger.log(this.component, 'codex-load-error', 'error', {
-                source: resolvedPath,
+                source: sourcePath,
                 error: msg,
             });
             // Safe fallback (never break callers)
-            return { path: resolvedPath, data: this.getBuiltinFallback(), isFallback: true };
+            return { path: sourcePath, data: this.getBuiltinFallback(), isFallback: true };
         }
     }
     computeTermCount(data) {
@@ -121,7 +196,7 @@ export class CodexPolicyService {
                 ? 'Governance CodexPolicyService — builtin fallback (no external codex.json resolved)'
                 : 'Returned via Governance CodexPolicyService — V2 Single Source of Truth (S02-REAL)',
             dynamo_required: true,
-            ...(includeRaw ? { codex: data } : {}),
+            ...(includeRaw ? { codex: structuredClone(data) } : {}),
         };
         await frameworkLogger.log(this.component, 'get-current-codex', 'info', {
             source: path,

package/dist/integrations/grok/hooks/session-start.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 /**
  * Grok SessionStart / UserPromptSubmit / PreCompact / PostCompact.
- * Grok ignores stdout here; station heat is session-boot.json + STATION.md.
+ * Compact prints nothing. Station heat is session-boot.json + STATION.md.
  */
 
 import {
@@ -148,9 +148,10 @@ async function main() {
           : '0xray/grok-session-start';
 
     const intent = extractIntent(event);
-    const matchedSignals =
-      HOOK_EVENT === 'user_prompt_submit' ? [] : await matchStationSignals(eventRoot, intent);
     const compact = COMPACT_EVENTS.has(HOOK_EVENT);
+    // The compact payload is the whole conversation. Do not match it and do not print it.
+    const matchedSignals =
+      compact || HOOK_EVENT === 'user_prompt_submit' ? [] : await matchStationSignals(eventRoot, intent);
     let freshnessLine = null;
     if (!compact) {
       try {
@@ -164,8 +165,7 @@ async function main() {
     const payload = buildSessionBootPayload(eventRoot, source, {
       hookEvent: HOOK_EVENT,
       sessionId: event.sessionId || process.env.GROK_SESSION_ID || null,
-      ...(intent ? { intent } : {}),
-      ...(!compact && intent ? { cardText: intent } : {}),
+      ...(!compact && intent ? { intent, cardText: intent } : {}),
       ...(matchedSignals.length ? { matchedSignals } : {}),
       ...(freshnessLine ? { freshnessLine } : {}),
     });
@@ -195,7 +195,7 @@ async function main() {
       /* non-blocking pipeline facets */
     }
 
-    console.log(JSON.stringify(payload));
+    if (!compact) console.log(JSON.stringify(payload));
     process.exit(0);
   } catch (err) {
     appendHookActivity(root, 'grok-session-start', 'session-boot-error', 'error', {

package/dist/integrations/grok/plugin/0xray/hooks/hooks.json

@@ -5,7 +5,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "XRAY_AI_PATH=\"${XRAY_AI_PATH:-node_modules/0xray}\" node \"${XRAY_AI_PATH:-node_modules/0xray}/dist/integrations/grok/hooks/pre-tool-use.js\"",
+            "command": "XRAY_AI_PATH=\"${XRAY_AI_PATH:-node_modules/0xray}\" node \"${XRAY_AI_PATH:-node_modules/0xray}/scripts/mjs/run-grok-hook.mjs\" pre-tool-use.js",
             "timeout": 30
           }
         ]
@@ -16,7 +16,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "XRAY_AI_PATH=\"${XRAY_AI_PATH:-node_modules/0xray}\" node \"${XRAY_AI_PATH:-node_modules/0xray}/dist/integrations/grok/hooks/session-start.js\"",
+            "command": "XRAY_AI_PATH=\"${XRAY_AI_PATH:-node_modules/0xray}\" node \"${XRAY_AI_PATH:-node_modules/0xray}/scripts/mjs/run-grok-hook.mjs\" session-start.js",
             "timeout": 30
           }
         ]
@@ -27,7 +27,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "XRAY_AI_PATH=\"${XRAY_AI_PATH:-node_modules/0xray}\" node \"${XRAY_AI_PATH:-node_modules/0xray}/dist/integrations/grok/hooks/session-start.js\" --hook-event=user_prompt_submit",
+            "command": "XRAY_AI_PATH=\"${XRAY_AI_PATH:-node_modules/0xray}\" node \"${XRAY_AI_PATH:-node_modules/0xray}/scripts/mjs/run-grok-hook.mjs\" session-start.js --hook-event=user_prompt_submit",
             "timeout": 30
           }
         ]
@@ -38,7 +38,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "XRAY_AI_PATH=\"${XRAY_AI_PATH:-node_modules/0xray}\" node \"${XRAY_AI_PATH:-node_modules/0xray}/dist/integrations/grok/hooks/post-tool-use.js\"",
+            "command": "XRAY_AI_PATH=\"${XRAY_AI_PATH:-node_modules/0xray}\" node \"${XRAY_AI_PATH:-node_modules/0xray}/scripts/mjs/run-grok-hook.mjs\" post-tool-use.js",
             "timeout": 30
           }
         ]
@@ -49,7 +49,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "XRAY_AI_PATH=\"${XRAY_AI_PATH:-node_modules/0xray}\" node \"${XRAY_AI_PATH:-node_modules/0xray}/dist/integrations/grok/hooks/session-start.js\" --hook-event=pre_compact",
+            "command": "XRAY_AI_PATH=\"${XRAY_AI_PATH:-node_modules/0xray}\" node \"${XRAY_AI_PATH:-node_modules/0xray}/scripts/mjs/run-grok-hook.mjs\" session-start.js --hook-event=pre_compact",
             "timeout": 30
           }
         ]
@@ -60,7 +60,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "XRAY_AI_PATH=\"${XRAY_AI_PATH:-node_modules/0xray}\" node \"${XRAY_AI_PATH:-node_modules/0xray}/dist/integrations/grok/hooks/session-start.js\" --hook-event=post_compact",
+            "command": "XRAY_AI_PATH=\"${XRAY_AI_PATH:-node_modules/0xray}\" node \"${XRAY_AI_PATH:-node_modules/0xray}/scripts/mjs/run-grok-hook.mjs\" session-start.js --hook-event=post_compact",
             "timeout": 30
           }
         ]

package/dist/integrations/hooks/goggles-mcp.mjs

@@ -2,7 +2,7 @@
  * Goggles MCP. Stdio. Server name `goggles`.
  * Tools: look, status_lens. Same organ as the CLI.
  */
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, readFileSync, realpathSync } from 'node:fs';
 import { basename, join, resolve } from 'node:path';
 import { pathToFileURL, fileURLToPath } from 'node:url';
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
@@ -328,9 +328,16 @@ async function main() {
   await server.connect(transport);
 }
 
+function sameInvoked(argvPath, modulePath) {
+  try {
+    return realpathSync(argvPath) === realpathSync(modulePath);
+  } catch {
+    return resolve(argvPath) === resolve(modulePath);
+  }
+}
+
 const thisFile = fileURLToPath(import.meta.url);
-const invoked = process.argv[1] ? resolve(process.argv[1]) : '';
-if (invoked && resolve(thisFile) === invoked) {
+if (process.argv[1] && sameInvoked(process.argv[1], thisFile)) {
   main().catch((err) => {
     process.stderr.write(`goggles MCP failed: ${err instanceof Error ? err.message : String(err)}\n`);
     process.exit(1);