0xray 4.0.40 → 4.0.42

package/scripts/node/install-bridges.cjs

@@ -7,7 +7,7 @@
 
 const fs = require("fs");
 const path = require("path");
-const { execFileSync, execSync } = require("child_process");
+const { execFileSync } = require("child_process");
 const {
   wantsCostume,
   isIsolatedHome,
@@ -22,17 +22,19 @@ const {
   wireOpencodeBridge,
   wireOpenClawBridge,
   deployPortableProjectMcpJson,
-  scopedMcpLaunch,
   mergeMcpMap,
   mergeNamedRecords,
   jsonDeepEqual,
   copyHermesFindProjectRootHelper,
   copyHermesHookRuntimes,
   installOpenClawHostWear,
+  recordOpenClawProjectPlugin,
   maybeWriteOpenClawCliBackend,
   isEphemeralInstallRoot,
   enableMemoryRoutingIfResolves,
-  XRAY_MCP_SERVERS,
+  pinLauncherPackageRoot,
+  writeProjectSuitMcp,
+  trustGrokFolder,
 } = require("./bridge-mcp-wiring.cjs");
 
 const wearIo = { writes: 0, skips: 0 };
@@ -334,6 +336,34 @@ function mergeOpencodeJson(targetDir, packageRoot, log) {
   }
 }
 
+function settlePackageRoot(packageRoot, targetDir) {
+  const resolved = path.resolve(packageRoot || ".");
+  if (!targetDir || !isEphemeralInstallRoot(resolved) || isEphemeralInstallRoot(path.resolve(targetDir))) {
+    return resolved;
+  }
+  const dest = path.join(machineHome(), ".grok", "wears", "0xray");
+  if (resolved === dest) return dest;
+  // Copy beside the live wear. A hook pointed at dest keeps loading until the swap.
+  const staging = `${dest}.next`;
+  const backup = `${dest}.prev`;
+  fs.rmSync(staging, { recursive: true, force: true });
+  fs.mkdirSync(path.dirname(dest), { recursive: true });
+  fs.cpSync(resolved, staging, {
+    recursive: true,
+    filter(src) {
+      const rel = path.relative(resolved, src);
+      if (!rel) return true;
+      const top = rel.split(path.sep)[0];
+      return top !== "node_modules" && top !== ".git";
+    },
+  });
+  fs.rmSync(backup, { recursive: true, force: true });
+  if (fs.existsSync(dest)) fs.renameSync(dest, backup);
+  fs.renameSync(staging, dest);
+  fs.rmSync(backup, { recursive: true, force: true });
+  return dest;
+}
+
 function grokHookShellCommand(packageRoot, scriptName, extraArgs) {
   const script = path.join(packageRoot, "scripts", "mjs", "run-grok-hook.mjs");
   const extra = extraArgs ? ` ${extraArgs}` : "";
@@ -365,6 +395,7 @@ function ensureGrokHookEvent(hooks, eventName) {
 }
 
 function patchGrokHooks(pluginDir, packageRoot, targetDir, log, label) {
+  packageRoot = settlePackageRoot(packageRoot, targetDir);
   const hooksDir = path.join(pluginDir, "hooks");
   const hooksPath = path.join(hooksDir, "hooks.json");
   const hookScript = path.join(packageRoot, "scripts", "mjs", "run-grok-hook.mjs");
@@ -454,42 +485,11 @@ function findGrokPluginSource(packageRoot) {
   return candidates.find((p) => fs.existsSync(p));
 }
 
-function registerGrokMcpServers(targetDir, log, pluginDirs) {
-  try {
-    execSync("which grok", { stdio: "ignore" });
-  } catch {
-    log("grok-bridge", "grok CLI not on PATH — plugin .mcp.json still configured", "info");
-    return;
-  }
-
-  for (const s of XRAY_MCP_SERVERS) {
-    try {
-      const launch = scopedMcpLaunch(targetDir, s.mcpCmd, s.env);
-      const argv = ["mcp", "add", s.name, "--command", launch.command, "--args", launch.args[0], ...launch.args.slice(1)];
-      for (const [key, value] of Object.entries(launch.env)) {
-        argv.push("--env", `${key}=${value}`);
-      }
-      execFileSync("grok", argv, { stdio: "pipe" });
-      log("grok-bridge", `registered ${s.name} (mcp-launch)`, "info");
-    } catch {
-      // already registered or grok config conflict — non-blocking
-    }
-  }
-
-  const dirs =
-    Array.isArray(pluginDirs) && pluginDirs.length > 0
-      ? pluginDirs
-      : [path.join(targetDir, ".grok", "plugins", "0xray")];
-  for (const pluginDir of dirs) {
-    if (!fs.existsSync(pluginDir)) continue;
-    try {
-      execSync(`grok plugins trust "${pluginDir}"`, { stdio: "ignore" });
-      log("grok-bridge", "plugin trusted", "info", { path: pluginDir });
-      break;
-    } catch {
-      // best-effort
-    }
-  }
+function registerGrokMcpServers(targetDir, log, env) {
+  const tomlPath = writeProjectSuitMcp(targetDir);
+  log("grok-bridge", "project mcp config written", "info", { path: tomlPath });
+  const trustPath = trustGrokFolder(targetDir, env || process.env);
+  log("grok-bridge", "folder trusted", "info", { path: trustPath });
 }
 
 
@@ -580,6 +580,83 @@ function grokPluginSettled(sourceDir, dest, packageRoot, targetDir) {
   return true;
 }
 
+/** Absolute paths under a temp checkout. Longest match wins so a script path is retargeted before its root. */
+function retargetEphemeralText(text, durableRoot) {
+  if (typeof text !== "string" || !isEphemeralInstallRoot(text)) return text;
+  const re = /(?:\/private\/var\/folders\/|\/var\/folders\/|\/private\/tmp\/|\/tmp\/|\/Temp\/)[^\s"']*/g;
+  const tokens = [...new Set(text.match(re) || [])].sort((a, b) => b.length - a.length);
+  let out = text;
+  for (const token of tokens) {
+    const scriptsAt = token.indexOf("/scripts/");
+    if (scriptsAt > 0) {
+      const repl = path.join(durableRoot, token.slice(scriptsAt + 1));
+      if (fs.existsSync(repl)) out = out.split(token).join(repl);
+      continue;
+    }
+    const runner = path.join(durableRoot, "scripts", "mjs", "run-grok-hook.mjs");
+    if (
+      !fs.existsSync(token) &&
+      fs.existsSync(runner) &&
+      (out.includes("run-grok-hook") || out.includes("mcp-launch.cjs"))
+    ) {
+      out = out.split(token).join(durableRoot);
+    }
+  }
+  return out;
+}
+
+function scrubEphemeralPins(node, durableRoot) {
+  if (Array.isArray(node)) return node.map((item) => scrubEphemeralPins(item, durableRoot));
+  if (!node || typeof node !== "object") {
+    return typeof node === "string" ? retargetEphemeralText(node, durableRoot) : node;
+  }
+  const out = {};
+  for (const [key, value] of Object.entries(node)) {
+    if ((key === "env" || key === "environment") && value && typeof value === "object" && !Array.isArray(value)) {
+      const env = {};
+      for (const [envKey, envValue] of Object.entries(value)) {
+        if (typeof envValue === "string" && isEphemeralInstallRoot(envValue)) {
+          if (envKey === "XRAY_AI_PATH") env[envKey] = durableRoot;
+          continue;
+        }
+        env[envKey] = scrubEphemeralPins(envValue, durableRoot);
+      }
+      out[key] = env;
+      continue;
+    }
+    out[key] = scrubEphemeralPins(value, durableRoot);
+  }
+  return out;
+}
+
+/**
+ * Shared HOME does not wear the machine plugin, but Grok still loads a stale
+ * `~/.grok/plugins/0xray`. Drop temp XRAY_ROOT pins and retarget dead launch
+ * paths onto the durable wear. A real project root on that plugin is left alone.
+ */
+function scrubEphemeralMachineGrokPins(machine, durablePackageRoot) {
+  if (!machine || !durablePackageRoot) return 0;
+  const runner = path.join(durablePackageRoot, "scripts", "mjs", "run-grok-hook.mjs");
+  if (!fs.existsSync(runner)) return 0;
+  const plugin = path.join(machine, ".grok", "plugins", "0xray");
+  const files = [path.join(plugin, "hooks", "hooks.json"), path.join(plugin, ".mcp.json")];
+  let changed = 0;
+  for (const file of files) {
+    if (!fs.existsSync(file)) continue;
+    let data;
+    try {
+      data = JSON.parse(fs.readFileSync(file, "utf8"));
+    } catch {
+      continue;
+    }
+    const next = scrubEphemeralPins(data, durablePackageRoot);
+    if (JSON.stringify(data) === JSON.stringify(next)) continue;
+    writeFileIfChanged(file, `${JSON.stringify(next, null, 2)}\n`);
+    changed += 1;
+  }
+  return changed;
+}
+
 function installGrokBridge(targetDir, packageRoot, log, opts) {
   const sourceDir = findGrokPluginSource(packageRoot);
   if (!sourceDir) {
@@ -599,6 +676,7 @@ function installGrokBridge(targetDir, packageRoot, log, opts) {
     log("grok-bridge", "skip machine ~/.grok plugin — isolated HOME", "info");
   } else {
     log("grok-bridge", "skip machine ~/.grok plugin — project-scoped wear", "info");
+    scrubEphemeralMachineGrokPins(machine, settlePackageRoot(packageRoot, targetDir));
   }
 
   for (const dest of targets) {
@@ -634,8 +712,8 @@ function installGrokBridge(targetDir, packageRoot, log, opts) {
     if (globalCopied > 0) {
       log("grok-bridge", `global skills synced (${globalCopied})`, "info", { path: grokGlobalSkills });
     }
-    registerGrokMcpServers(targetDir, log, targets);
   }
+  registerGrokMcpServers(targetDir, log, env);
 }
 
 function installHermesBridge(targetDir, packageRoot, log) {
@@ -773,7 +851,7 @@ function installOpenclawBridge(targetDir, packageRoot, log) {
   }
 
   if (!ephemeralOpenclaw && !isolatedOpenclaw) {
-    const hook = installOpenClawHostWear(packageRoot);
+    const hook = installOpenClawHostWear(packageRoot, targetDir);
     if (hook) log("openclaw-bridge", "PreToolUse hook installed", "info", { path: hook });
     if (maybeWriteOpenClawCliBackend()) {
       log("openclaw-bridge", "opencode-cli backend written", "info");
@@ -787,6 +865,11 @@ function installOpenclawBridge(targetDir, packageRoot, log) {
       "info",
     );
   }
+
+  const recorded = recordOpenClawProjectPlugin(targetDir, packageRoot);
+  if (recorded) {
+    log("openclaw-bridge", "project plugin path recorded", "info", { path: recorded });
+  }
 }
 
 const XRAY_CONFIG_FILES = ["codex.json", "features.json", "features.schema.json", "config.json"];
@@ -1846,26 +1929,29 @@ function syncSetupSkillsAndRootLinks(packageRoot, targetDir) {
   require("./setup.cjs").syncSetupSkillsAndRootLinks(packageRoot, targetDir);
 }
 
-function setupSkillMirrorNames(packageRoot) {
-  const skillsSource = fs.existsSync(path.join(packageRoot, "src", "skills"))
+/** A byte-identical package skill is the old mirror. A different body still throws. */
+function wornSkillMatchesPackage(packageRoot, targetDir, name) {
+  const source = fs.existsSync(path.join(packageRoot, "src", "skills"))
     ? path.join(packageRoot, "src", "skills")
     : path.join(packageRoot, "dist", "skills");
-  if (!fs.existsSync(skillsSource)) return new Set();
-  const names = new Set();
-  for (const entry of fs.readdirSync(skillsSource, { withFileTypes: true })) {
-    if (!entry.isDirectory()) continue;
-    if (fs.existsSync(path.join(skillsSource, entry.name, "SKILL.md"))) names.add(entry.name);
+  const packaged = path.join(source, name, "SKILL.md");
+  if (!fs.existsSync(packaged)) return false;
+  const packagedBytes = fs.readFileSync(packaged);
+  let saw = false;
+  for (const parts of ROLE_SKILL_DIRS) {
+    const worn = path.join(targetDir, ...parts, name, "SKILL.md");
+    if (!fs.existsSync(worn)) continue;
+    saw = true;
+    if (!packagedBytes.equals(fs.readFileSync(worn))) return false;
   }
-  return names;
+  return saw;
 }
 
-/** The 4.0.28 skill mirror is not a consumer costume. Any other extra name still throws. */
-function isSetupSkillMirrorDump(err, packageRoot) {
+function isSetupSkillMirrorDump(err, packageRoot, targetDir) {
   if (!err || err.code !== "FOUNDRY_COSTUME_DUMP") return false;
   if (!Array.isArray(err.extraSkills) || err.extraSkills.length === 0) return false;
   if (Array.isArray(err.extraAgents) && err.extraAgents.length > 0) return false;
-  const mirrored = setupSkillMirrorNames(packageRoot);
-  return err.extraSkills.every((name) => mirrored.has(name));
+  return err.extraSkills.every((name) => wornSkillMatchesPackage(packageRoot, targetDir, name));
 }
 
 function packageShipsConsumerSuit(packageRoot) {
@@ -1873,11 +1959,41 @@ function packageShipsConsumerSuit(packageRoot) {
 }
 
 /**
- * 4.0.28 consumer postinstall files: AGENTS.md, .gitignore, repertoire link,
- * .xray config, bridges, mill plant, then the setup.cjs skill mirror and
- * dist/scripts links. Does not install Cursor hooks or git hooks.
+ * Consumer wear files: AGENTS.md, .gitignore, repertoire link, .xray config,
+ * bridges, mill plant (mill + inspect), and the scripts and dist links.
+ * The role-skill mirror stays in the package.
+ * Does not install Cursor hooks or git hooks.
  * Existing user files follow the 4.0.28 guards inside those functions.
  */
+
+const ROLE_SKILL_KEEP = new Set(["mill", "inspect"]);
+const ROLE_SKILL_DIRS = [
+  [".opencode", "skills"],
+  [".grok", "plugins", "0xray", "skills"],
+  [".hermes", "plugins", "xray-hermes", "skills"],
+  [".openclaw", "skills"],
+];
+
+function removeCopiedRoleSkills(packageRoot, targetDir) {
+  const source = fs.existsSync(path.join(packageRoot, "src", "skills"))
+    ? path.join(packageRoot, "src", "skills")
+    : path.join(packageRoot, "dist", "skills");
+  if (!fs.existsSync(source)) return;
+  for (const parts of ROLE_SKILL_DIRS) {
+    const dir = path.join(targetDir, ...parts);
+    if (!fs.existsSync(dir)) continue;
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+      if (!entry.isDirectory() || ROLE_SKILL_KEEP.has(entry.name)) continue;
+      const packaged = path.join(source, entry.name, "SKILL.md");
+      const worn = path.join(dir, entry.name, "SKILL.md");
+      if (!fs.existsSync(packaged) || !fs.existsSync(worn)) continue;
+      const same = fs.readFileSync(packaged).equals(fs.readFileSync(worn));
+      if (!same) continue;
+      fs.rmSync(path.join(dir, entry.name), { recursive: true, force: true });
+    }
+  }
+}
+
 function installConsumerProjectFiles(packageRoot, targetDir, log) {
   const write = typeof log === "function" ? log : () => {};
   if (!isConsumerInstall(packageRoot, targetDir) || !packageShipsConsumerSuit(packageRoot)) {
@@ -1896,10 +2012,11 @@ function installConsumerProjectFiles(packageRoot, targetDir, log) {
   installGrokBridge(targetDir, packageRoot, write);
   installHermesBridge(targetDir, packageRoot, write);
   installOpenclawBridge(targetDir, packageRoot, write);
+  removeCopiedRoleSkills(packageRoot, targetDir);
   try {
     mintConsumerSuit(packageRoot, targetDir, write);
   } catch (err) {
-    if (!isSetupSkillMirrorDump(err, packageRoot)) throw err;
+    if (!isSetupSkillMirrorDump(err, packageRoot, targetDir)) throw err;
   }
   syncSetupSkillsAndRootLinks(packageRoot, targetDir);
   return true;
@@ -2085,7 +2202,9 @@ function wearCursorHooks(targetDir, packageRoot, log, opts) {
   const write = typeof log === "function" ? log : () => {};
   const options = opts || {};
   const resolvedTarget = path.resolve(targetDir);
-  const resolvedPackage = path.resolve(packageRoot);
+  const resolvedPackage = settlePackageRoot(path.resolve(packageRoot), resolvedTarget);
+  pinLauncherPackageRoot(resolvedPackage);
+  try {
   if (classifyCursorWearGit(resolvedTarget) === "not-work-tree") {
     wearSuitSkippingCursorHooks(resolvedPackage, resolvedTarget, write);
     return;
@@ -2137,6 +2256,9 @@ function wearCursorHooks(targetDir, packageRoot, log, opts) {
   }
   write("cursor-bridge", "hooks.json wired to installed dist", "info", { path: hooksPath });
   return hooksPath;
+  } finally {
+    pinLauncherPackageRoot("");
+  }
 }
 
 /**
@@ -2344,15 +2466,16 @@ function installFrameworkDogfoodWear(packageRoot, log) {
  * @param {{ targetDir: string, packageRoot: string, log?: Function }} opts
  */
 function installAllBridges(opts) {
-  const packageRoot = path.resolve(opts.packageRoot);
   const targetDir = path.resolve(opts.targetDir);
+  const packageRoot = settlePackageRoot(path.resolve(opts.packageRoot), targetDir);
+  pinLauncherPackageRoot(packageRoot);
   const logFn = opts.log;
   const log =
     logFn ||
     ((_component, _action, _status, _details) => {
       /* noop */
     });
-
+  try {
   wearVendoredRepertoire(packageRoot, targetDir, log);
 
   if (!isConsumerInstall(packageRoot, targetDir)) {
@@ -2373,6 +2496,9 @@ function installAllBridges(opts) {
   installCursorBridge(targetDir, packageRoot, log);
 
   log("install-bridges", "4-platform + cursor wear complete", "success");
+  } finally {
+    pinLauncherPackageRoot("");
+  }
 }
 
 module.exports = {
@@ -2393,6 +2519,8 @@ module.exports = {
   MERGE_CONFIG_FILES,
   patchGrokHooks,
   grokHookShellCommand,
+  settlePackageRoot,
+  scrubEphemeralMachineGrokPins,
   writeGrokDiscoveredHooks,
   isEphemeralInstallRoot,
   isIsolatedHome,

package/scripts/node/setup.cjs

@@ -4,37 +4,7 @@ const fs = require("fs");
 const path = require("path");
 
 function syncSetupSkillsAndRootLinks(packageRoot, targetDir) {
- /* 1. Sync core skills from src/skills/ (dev) or dist/skills/ (consumer) → .opencode/skills/  [P3-SKILLS-DE-DUP-SCOPE-AND-EXEC-01: orchestrator package SSOT canonical src/skills/orchestrator/SKILL.md; mirror .opencode/skills/orchestrator/ is built output of this logic; see paired guarded fw in status.ts getSkillsList + mapping append + deep ref 2026-05-26 authority for one-package dedup under pivoted surgical plan] 
-   [P3-SKILLS-DE-DUP-RESEARCHER-FOLLOW-01: researcher package SSOT canonical src/skills/researcher/SKILL.md (high-value per deep ref + YML precedent + playbook P3-SKILLS-FOLLOW-01); mirror .opencode/skills/researcher/ is built output of this logic; see paired guarded fw in status.ts + rich append + YML @ harness-codex verification (FORCE exercised P3-YML + codex-enforcement + 100/60/0 + 3 subagents tracked + 0 hot + 3-hot re-establish + all prior green) + deep ref 2026-05-26 + Phase 3 Pivot + Term 61 + user's "create a todo list. spawn subagents..." + 6/6+7/7 + YML. Governance-visible hook for skills SSOT at install layer. Silent, additive, reversible, no behavior change, fw/echo only.]
-   [P3-SKILLS-FOLLOW-02: code-review package SSOT canonical src/skills/code-review/SKILL.md (next high-value per deep ref "parallel small batches" + @architect scoping rec 2 + YML @ "Ready for next" + this P3-SKILLS-FOLLOW-02 on user's spawn command); mirror .opencode/skills/code-review/ is built output of this logic; see paired guarded fw "P3-SKILLS-FOLLOW-02-code-review-ssot-preferred" in status.ts (after researcher) + rich append docs/reflections/p3-skills-follow-02-code-review-2026-05-27.md + YML @ harness-codex verification + 0 hot + 3-hot + all ties + ps 0 + this work (2-file surgical edit, harness post, mapping append after latest ~17099+, todo advance 1, spawn replacement, self-audit 100%, green + ready) + deep ref 2026-05-26 + Phase 3 Pivot + Term 61 + 6/6+7/7 + YML. Governance-visible hook for skills SSOT at install layer for code-review. Silent, additive, reversible, no behavior change, fw/echo only. "The box contains its builders. The relay is hot."] */
-const skillsSource = fs.existsSync(path.join(packageRoot, "src", "skills"))
-  ? path.join(packageRoot, "src", "skills")
-  : path.join(packageRoot, "dist", "skills");
-const skillsDest = path.join(targetDir, ".opencode", "skills");
-
-if (fs.existsSync(skillsSource)) {
-  try {
-    if (!fs.existsSync(skillsDest)) fs.mkdirSync(skillsDest, { recursive: true });
-    const skillDirs = fs.readdirSync(skillsSource, { withFileTypes: true });
-    let copied = 0, skipped = 0;
-    for (const entry of skillDirs) {
-      if (!entry.isDirectory()) continue;
-      const skillMd = path.join(skillsSource, entry.name, "SKILL.md");
-      if (!fs.existsSync(skillMd)) continue;
-      const destMd = path.join(skillsDest, entry.name, "SKILL.md");
-      const destDir = path.dirname(destMd);
-      if (!fs.existsSync(destDir)) fs.mkdirSync(destDir, { recursive: true });
-      if (fs.existsSync(destMd)) {
-        const destContent = fs.readFileSync(destMd, "utf8");
-        if (destContent.includes("source: community")) { skipped++; continue; }
-        if (fs.statSync(skillMd).mtime <= fs.statSync(destMd).mtime) continue;
-      }
-      fs.copyFileSync(skillMd, destMd);
-      copied++;
-    }
-    console.log(`✅ Skills: ${copied} updated, ${skipped} community skills preserved`);
-  } catch (e) { console.warn(`⚠️ Skills sync: ${e.message}`); }
-}
+  // Mint fastens mill and inspect. The role-skill mirror stays in the package.
 
 // 4. Create scripts symlink
 const scriptsSource = path.join(packageRoot, "scripts");
@@ -106,21 +76,7 @@ if (hasHermes) {
   console.log("🔍 Hermes Agent detected");
 }
 
-/**
- * P3-SKILLS-DE-DUP-SCOPE-AND-EXEC-01 (supporting header in sync owner) — Small-Batch Surgical Skills Deduplication (one package: orchestrator). 
- * This file (scripts/node/setup.cjs) is the canonical sync owner enforcing src/skills/ (or dist/skills/) → .opencode/skills/ mirror for framework core skills.
- * Rich CGT + ties modeled on paired edit in src/cli/commands/status.ts + P3-YML-AGENT-SURFACES-UNIFICATION-01 + P3-7TH-GAP-DEEPER-01 + deep ref 2026-05-26 + Phase 3 Pivot + Term 61 + user's "create a todo list. spawn subagents..." + 6/6+7/7 + YML live.
- * Highly modular header only (no behavior change). Fully reversible (delete header). fw discipline + AGENTS org. 2 files total for this micro-slice (status.ts primary with fw guard + this header).
- * Governance-visible: documents the SSOT ownership for orchestrator package dedup at the build/install layer.
- * The box contains its builders. Term 61 held. Pure momentum.
- *
- * P3-SKILLS-DE-DUP-RESEARCHER-FOLLOW-01 (follow-on small-batch per deep ref "parallel small batches on skills deduplication (one package)" + YML @ "skills follow-on" + playbook P3-SKILLS-FOLLOW-01 + YML @ harness-codex verification 16982–17045 + FORCE + codex 100/60/0 + 3 subagents tracked + 0 hot + 3-hot re-establish + all prior completions + user's spawn command + deep ref 2026-05-26 + Phase 3 Pivot + Term 61 + 6/6+7/7 + YML): 
- * Extended header for next high-value package (researcher). src/skills/researcher/SKILL.md canonical SSOT; .opencode/skills/researcher/ built mirror of this sync logic. See paired guarded fw log "P3-SKILLS-DE-DUP-RESEARCHER-FOLLOW-01-researcher-ssot-preferred" in status.ts getSkillsList + rich append docs/reflections/p3-skills-dedup-researcher-follow-01-2026-05-27.md + CGT/Governance-visible for YML @ harness-codex verification + 0 hot + 3-hot + all ties. 2 files max total for this follow-on. Highly modular. Fully reversible. fw/echo discipline. AGENTS org (scripts/ for sh/cjs). Term 61 surgical forward motion held. "the box contains its builders". Green + ready.
- *
- * P3-SKILLS-FOLLOW-02 (follow-on small-batch per deep ref "parallel small batches on skills deduplication (one package)" + @architect scoping rec 2 + YML @ "Ready for next" + this execution on user's "create a todo list. spawn subagents to complete todos. maintain todo list. do not ask questions. do not stop. you have the full plan."; modeled exactly on "orchestrator" + researcher precedent): 
- * Extended header for next high-value package (code-review). src/skills/code-review/SKILL.md canonical SSOT; .opencode/skills/code-review/ built mirror of this sync logic. See paired guarded fw log "P3-SKILLS-FOLLOW-02-code-review-ssot-preferred" in status.ts getSkillsList (inserted after researcher block) + rich append docs/reflections/p3-skills-follow-02-code-review-2026-05-27.md (per AGENTS) + CGT/Governance-visible for YML @ harness-codex verification + 0 hot + 3-hot re-establish + all ties to spawn command + deep ref + pivot + Term 61 + 6/6+7/7 + YML + ps 0 + this P3-SKILLS-FOLLOW-02 full work (2-file surgical, harness post green tsc 0 new on touched, mapping append after latest, todo advance exactly 1, spawn replacement to maintain 3-hot, self-audit 100%) + verification + "the box contains its builders. The relay is hot.". 2 files max total for this follow-02. Highly modular (100% prior P3-SKILLS/YML/7th pattern reuse exactly inside existing sync logic). Fully reversible (targeted delete of notes restores exact prior). fw/echo discipline. AGENTS org (scripts/ for sh/cjs). Term 61 surgical forward motion held (no bloat, pure on actual dedup). "the box contains its builders". Green + ready. Subagent ID for resume.
- */
-
+// Mint fastens mill and inspect. The links below are scripts and dist.
 syncSetupSkillsAndRootLinks(packageRoot, targetDir);
 
 // 2. Handle opencode.json merge

package/src/integrations/openclaw/plugin/xray-pre-tool/package.json

@@ -1,6 +1,6 @@
 {
   "name": "xray-pre-tool",
-  "version": "4.0.40",
+  "version": "4.0.42",
   "private": true,
   "type": "module",
   "description": "0xRay constitution + temperament PreToolUse for OpenClaw",

package/src/mcps/architect-tools.server.ts

@@ -10,14 +10,38 @@ import { XrayKnowledgeSkillBase } from "./shared/knowledge-skill-base.js";
 import * as fs from "fs";
 import * as path from "path";
 import { frameworkLogger } from "../core/framework-logger.js";
+import { type GovernanceVote } from "../governance/llm-governance-provider.js";
 import {
   contextAnalysis as architectContextAnalysis,
   codebaseStructure as architectCodebaseStructure,
   dependencyAnalysis as architectDependencyAnalysis,
   architectureAssessment as architectArchitectureAssessment,
-  formatConferArchitectureText,
+  type ArchitectureAssessment,
 } from "../architect/architect-tools.js";
 
+export type ConferModelVerdict = "PASS" | "CONDITIONAL" | "FAIL" | "UNREVIEWED";
+
+/** A confer verdict counts only when a model vote exists. Metrics alone are UNREVIEWED. */
+export function conferVerdictFromModelVote(
+  vote: Pick<GovernanceVote, "decision"> | null,
+): ConferModelVerdict {
+  if (!vote) return "UNREVIEWED";
+  if (vote.decision === "reject") return "FAIL";
+  if (vote.decision === "approve") return "PASS";
+  return "CONDITIONAL";
+}
+
+export function formatArchitectureAssessmentConferText(
+  conferPrompt: string,
+  assessment: ArchitectureAssessment,
+  verdict: ConferModelVerdict = "UNREVIEWED",
+): string {
+  const assessmentJson = JSON.stringify(assessment, null, 2);
+  const trimmed = conferPrompt.trim();
+  if (!trimmed) return assessmentJson;
+  return `${trimmed}\n\n## Architecture assessment\n${assessmentJson}\n\nVerdict: ${verdict}\nTop risks: review assessment metrics above\nHardening: address high-complexity or coupling findings before resuming`;
+}
+
 interface DirectoryNode {
   name: string;
   path: string;
@@ -48,7 +72,7 @@ export async function renderArchitectureAssessment(
     content: [
       {
         type: "text",
-        text: formatConferArchitectureText(conferPrompt, result),
+        text: formatArchitectureAssessmentConferText(conferPrompt, result, "UNREVIEWED"),
       },
     ],
   };

package/src/mcps/config/__tests__/server-config-registry.test.ts

@@ -83,25 +83,25 @@ describe('ServerConfigRegistry', () => {
       expect(registry.has('code-review')).toBe(true);
       const config = registry.get('code-review');
       expect(config?.command).toBe('node');
-      expect(config?.timeout).toBe(30000);
+      expect(config?.timeout).toBe(150000);
     });
 
     it('should have security-audit server registered by default', () => {
       expect(registry.has('security-audit')).toBe(true);
       const config = registry.get('security-audit');
-      expect(config?.timeout).toBe(45000);
+      expect(config?.timeout).toBe(150000);
     });
 
     it('should have security-auditor alias registered by default', () => {
       expect(registry.has('security-auditor')).toBe(true);
       const config = registry.get('security-auditor');
-      expect(config?.timeout).toBe(45000);
+      expect(config?.timeout).toBe(150000);
     });
 
     it('should have researcher server registered by default', () => {
       expect(registry.has('researcher')).toBe(true);
       const config = registry.get('researcher');
-      expect(config?.timeout).toBe(60000);
+      expect(config?.timeout).toBe(150000);
     });
 
     it('should have framework-help server registered by default', () => {
@@ -119,7 +119,7 @@ describe('ServerConfigRegistry', () => {
     it('should have architect server registered by default', () => {
       expect(registry.has('architect')).toBe(true);
       const config = registry.get('architect');
-      expect(config?.timeout).toBe(45000);
+      expect(config?.timeout).toBe(150000);
     });
 
     it('should have enforcer server registered by default', () => {
@@ -242,7 +242,16 @@ describe('ServerConfigRegistry', () => {
 
         // Governance (Dynamo Solar SSOT orchestrator) is allowed higher timeout
         // because it coordinates multiple skill MCPs + required external filter.
-        const maxTimeout = config.serverName === 'governance' ? 120000 : 60000;
+        const modelServers = new Set([
+          'governance',
+          'architect',
+          'code-review',
+          'code-reviewer',
+          'researcher',
+          'security-audit',
+          'security-auditor',
+        ]);
+        const maxTimeout = modelServers.has(config.serverName) ? 150000 : 60000;
         expect(config.timeout).toBeLessThanOrEqual(maxTimeout);
       }
     });

package/src/mcps/config/server-config-registry.ts

@@ -13,6 +13,9 @@ import { fileURLToPath } from 'url';
 import { dirname, join, resolve } from 'path';
 import fs from 'fs';
 
+/** Must outlast the 120s governance model call so a real approve can return. */
+const GOVERNANCE_MODEL_TIMEOUT_MS = 150_000;
+
 /**
  * Registry for managing MCP server configurations
  */
@@ -95,7 +98,7 @@ export class ServerConfigRegistry {
       serverName: 'code-review',
       command: 'node',
       args: [`${basePath}/knowledge-skills/code-review.server.js`],
-      timeout: 30000,
+      timeout: GOVERNANCE_MODEL_TIMEOUT_MS,
     });
 
     // Security Audit Server
@@ -103,7 +106,7 @@ export class ServerConfigRegistry {
       serverName: 'security-audit',
       command: 'node',
       args: [`${basePath}/knowledge-skills/security-audit.server.js`],
-      timeout: 45000,
+      timeout: GOVERNANCE_MODEL_TIMEOUT_MS,
     });
 
     // Performance Optimization Server
@@ -127,7 +130,7 @@ export class ServerConfigRegistry {
       serverName: 'researcher',
       command: 'node',
       args: [`${basePath}/researcher.server.js`],
-      timeout: 60000,
+      timeout: GOVERNANCE_MODEL_TIMEOUT_MS,
     });
 
     // Governance Service (meta-MCP that orchestrates the three skill servers + required external Dynamo)
@@ -199,7 +202,7 @@ export class ServerConfigRegistry {
       serverName: 'architect',
       command: 'node',
       args: [`${basePath}/architect-tools.server.js`],
-      timeout: 45000,
+      timeout: GOVERNANCE_MODEL_TIMEOUT_MS,
     });
 
     // Bug Triage Specialist Server
@@ -224,7 +227,7 @@ export class ServerConfigRegistry {
       serverName: 'code-reviewer',
       command: 'node',
       args: [`${basePath}/knowledge-skills/code-review.server.js`],
-      timeout: 30000,
+      timeout: GOVERNANCE_MODEL_TIMEOUT_MS,
     });
 
     // Security Auditor (alias for security-audit)
@@ -232,7 +235,7 @@ export class ServerConfigRegistry {
       serverName: 'security-auditor',
       command: 'node',
       args: [`${basePath}/knowledge-skills/security-audit.server.js`],
-      timeout: 45000,
+      timeout: GOVERNANCE_MODEL_TIMEOUT_MS,
     });
 
     // Refactorer Server