0xray 4.0.5 → 4.0.6

package/dist/CHANGELOG.md

@@ -29,6 +29,13 @@ The format is based on [Conventional Commits](https://www.conventionalcommits.or
 - Empty garment: mill plant (`mill` skill) is the hanger. Not 45/42 costume unless `foundry.json` `"costume": true`. Mill 0.1.5.
 - Mill plant fastens **inspect** (inspect AI work) plus `mill`. Not empty. Mill 0.1.6.
 - Nested mill **0.1.7**: inspect organ, four floors, passwd HOME, mill CI receipt. 4.0.5.
+- Nested mill **0.1.8**: isolated Hermes/OpenClaw, consumer tarball GET, CLI mint inspects. 4.0.6.
+
+---
+
+## [4.0.6] - 2026-09-09
+
+Nested mill **0.1.8**. Isolated HOME skips machine Hermes/OpenClaw. Inspect GETs public consumer `.tgz`. CLI `mint` runs inspect (chat is not done). Postinstall does not inspect. Not 5.0.0.
 
 ---
 

package/dist/cli/commands/hermes-install.js

@@ -1,6 +1,5 @@
 import fs from 'fs';
 import path from 'path';
-import { homedir } from 'os';
 import { createRequire } from 'module';
 import { frameworkLogger } from '../../core/framework-logger.js';
 import { syncBuiltinSkills } from './skill-install.js';
@@ -8,6 +7,7 @@ import { mintAfterWear } from './foundry-mint-wear.js';
 const __dirname = path.dirname(new URL(import.meta.url).pathname);
 const require = createRequire(import.meta.url);
 const packageRoot = path.join(__dirname, '..', '..', '..');
+const millSuit = require(path.join(packageRoot, 'scripts', 'foundry', 'mint-suit.cjs'));
 const wiring = require(path.join(packageRoot, 'scripts', 'node', 'bridge-mcp-wiring.cjs'));
 export function registerHermesCommands(hermesCmd) {
     hermesCmd
@@ -21,8 +21,10 @@ export function registerHermesCommands(hermesCmd) {
 }
 async function installForHermes(options = {}) {
     frameworkLogger.log('hermes-integration', 'install-start', 'info', { options });
-    const home = homedir();
-    const targetPluginDir = path.join(home, '.hermes/plugins/xray-hermes');
+    const isolated = millSuit.isIsolatedHome();
+    const targetPluginDir = isolated
+        ? path.join(process.cwd(), '.hermes/plugins/xray-hermes')
+        : path.join(millSuit.machineHome(), '.hermes/plugins/xray-hermes');
     const possibleSources = [
         path.join(__dirname, '..', '..', '..', 'dist/integrations/hermes-agent'),
         path.join(__dirname, '..', '..', '..', 'src/integrations/hermes-agent'),
@@ -65,10 +67,10 @@ async function installForHermes(options = {}) {
             frameworkLogger.log('hermes-integration', 'skills-synced', 'info', { count: skillsCopied });
         }
         wiring.copyHermesFindProjectRootHelper(packageRoot, targetPluginDir);
-        if (wiring.copyHermesHookRuntimes(packageRoot)) {
+        if (!isolated && wiring.copyHermesHookRuntimes(packageRoot)) {
             frameworkLogger.log('hermes-integration', 'hooks-copied', 'info', {});
         }
-        const wired = wiring.wireHermesBridge(targetDir);
+        const wired = isolated ? { count: 0 } : wiring.wireHermesBridge(targetDir);
         mintAfterWear(targetDir);
         console.log(`\x1b[32m✓ Wired Hermes mcp_servers (${wired.count} servers)\x1b[0m`);
         console.log(`\x1b[32m✓ Consumer root → ${targetDir}\x1b[0m`);

package/dist/cli/commands/openclaw-install.js

@@ -1,6 +1,5 @@
 import fs from 'fs';
 import path from 'path';
-import { homedir } from 'os';
 import { createRequire } from 'module';
 import { frameworkLogger } from '../../core/framework-logger.js';
 import { syncBuiltinSkills } from './skill-install.js';
@@ -9,6 +8,7 @@ import { OpenClawConfigLoader } from '../../integrations/openclaw/config.js';
 import { writeSuitSessionBoot } from '../../nucleus/suit-temperament.js';
 const __dirname = path.dirname(new URL(import.meta.url).pathname);
 const require = createRequire(import.meta.url);
+const millSuit = require(path.join(__dirname, '..', '..', '..', 'scripts', 'foundry', 'mint-suit.cjs'));
 const wiring = require(path.join(__dirname, '..', '..', '..', 'scripts', 'node', 'bridge-mcp-wiring.cjs'));
 export function registerOpenClawCommands(openclawCmd) {
     openclawCmd
@@ -40,14 +40,19 @@ async function installForOpenClaw(options = {}) {
             const relative = path.relative(process.cwd(), configPath);
             console.log(`\x1b[32m✓ Created OpenClaw config at ${relative}\x1b[0m`);
         }
-        const openclawSkillsDir = path.join(homedir(), '.openclaw', 'skills');
+        const isolated = millSuit.isIsolatedHome();
+        const openclawSkillsDir = isolated
+            ? path.join(targetDir, '.openclaw', 'skills')
+            : path.join(millSuit.machineHome(), '.openclaw', 'skills');
         const skillsCopied = syncBuiltinSkills(openclawSkillsDir);
         if (skillsCopied > 0) {
             console.log(`\x1b[32m✓ Synced ${skillsCopied} builtin skills to ~/.openclaw/skills/\x1b[0m`);
         }
         frameworkLogger.log('openclaw-integration', 'skills-synced', 'info', { count: skillsCopied });
         mintAfterWear(targetDir);
-        const wired = wiring.wireOpenClawBridge(targetDir);
+        const wired = isolated
+            ? { count: 0, path: configPath, method: 'skipped-isolated-home' }
+            : wiring.wireOpenClawBridge(targetDir);
         console.log(`\x1b[32m✓ Wired OpenClaw MCP servers (${wired.count} via ${wired.method}) → ${wired.path}\x1b[0m`);
         console.log(`\x1b[32m✓ Consumer root → ${targetDir}\x1b[0m`);
         try {
@@ -57,8 +62,8 @@ async function installForOpenClaw(options = {}) {
             /* session-boot is best-effort */
         }
         const packageRoot = path.resolve(__dirname, '..', '..', '..');
-        const hookInstalled = wiring.installOpenClawHostWear(packageRoot);
-        const cliBackend = wiring.maybeWriteOpenClawCliBackend();
+        const hookInstalled = isolated ? null : wiring.installOpenClawHostWear(packageRoot);
+        const cliBackend = isolated ? false : wiring.maybeWriteOpenClawCliBackend();
         frameworkLogger.log('openclaw-integration', 'cli-backend', 'info', { written: cliBackend });
         if (hookInstalled) {
             console.log(`\x1b[32m✓ OpenClaw PreToolUse hook → ${hookInstalled}\x1b[0m`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "0xray",
-  "version": "4.0.5",
+  "version": "4.0.6",
   "description": "Multi-agent orchestration and Codex governance for OpenCode, Hermes, Grok Build, and OpenClaw",
   "readme": "README.md",
   "license": "MIT",

package/scripts/foundry/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## [0.1.8] - 2026-09-09
+
+Isolated HOME skips machine `~/.hermes` and `~/.openclaw` (passwd home, same gate as Grok). Inspect GETs a public consumer tarball (`@0xray/review-suit`). CLI `mint` runs inspect after overlay; postinstall does not. Not an 8th MCP. Not 5.0.
+
 ## [0.1.7] - 2026-09-04
 
 Inspect is mill flesh: `npx @0xray/foundry inspect` runs diff, plant vs worn (mint fails costume dump), mill receipt, CI, GET the `.tgz` (HTTP 200), isolated HOME vs passwd home. Four project skill floors created on fasten (OpenCode, Grok, Hermes, OpenClaw). CI report is `.xray/foundry-ci-report.json`. Not an 8th MCP. Not 5.0.

package/scripts/foundry/cli.mjs

@@ -26,7 +26,7 @@ const HELP =
   "\n" +
   "Mill, not exo. FOUNDRY_ROOT overrides cwd (the repo being milled).\n" +
   "release bumps/commits/pushes/publishes the milled cwd — pass --dry-run or --i-mean-it (or FOUNDRY_RELEASE=1).\n" +
-  "Mint fastens mill plant then overlays their plant (mill-fill JSON). PPE stays worn.\n" +
+  "Mint fastens mill plant then overlays their plant (mill-fill JSON), then runs inspect. PPE stays worn.\n" +
   "inspect runs the six mill checks (diff, plant vs worn, receipt, CI, live tarball GET, isolated HOME). Not an 8th MCP.\n" +
   "gate is build+test. docs-build is Docusaurus on the 0xray exo. ci reports GitHub Actions (no auto-push). hooks installs git pre/post hooks.\n";
 

package/scripts/foundry/inspect.mjs

@@ -179,7 +179,7 @@ export async function checkLivePut(packages, fetchFn = fetch) {
   return results;
 }
 
-function packagesToProbe(root) {
+export function packagesToProbe(root) {
   const pkgs = [];
   const inventory = readJson(path.join(root, ".xray", "foundry-inventory.json"));
   if (inventory?.mill?.name && inventory?.mill?.version) {
@@ -193,6 +193,17 @@ function packagesToProbe(root) {
   if (self?.name === "0xray" && self?.version) {
     pkgs.push({ name: "0xray", version: self.version });
   }
+  if (
+    self &&
+    self.private !== true &&
+    inventory?.consumer?.name &&
+    inventory?.consumer?.version
+  ) {
+    pkgs.push({
+      name: inventory.consumer.name,
+      version: inventory.consumer.version,
+    });
+  }
   const seen = new Set();
   return pkgs.filter((p) => {
     const key = `${p.name}@${p.version}`;

package/scripts/foundry/mint.mjs

@@ -8,13 +8,15 @@ import { createRequire } from "node:module";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { millPackageDir, resolveMillRoot } from "./mill-root.mjs";
+import { inspectSuit } from "./inspect.mjs";
 
 const require = createRequire(import.meta.url);
 const { mintConsumerSuit } = require("./mint-suit.cjs");
 
-function main() {
+async function main() {
   const target = resolveMillRoot();
   const millRoot = millPackageDir();
+  const skipLive = process.argv.includes("--skip-live");
   let inventory;
   try {
     inventory = mintConsumerSuit(millRoot, target, (component, action, status) => {
@@ -29,6 +31,9 @@ function main() {
     process.exit(0);
   }
   process.stdout.write(`${JSON.stringify(inventory, null, 2)}\n`);
+  const report = await inspectSuit(target, { millRoot, skipLive });
+  process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+  if (!report.ok) process.exit(1);
 }
 
 const isMain =

package/scripts/foundry/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@0xray/foundry",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "private": false,
   "type": "module",
   "description": "0xRay mill: mint their suit params, stamp, gate, publish, CI report, git hooks. Not the worn exo.",

package/scripts/foundry/plant/agents/inspect.yml

@@ -1,5 +1,5 @@
 name: inspect
 skill: inspect
 description: "Inspect AI work: diffs, traces, mill receipts, CI. Fastened mill plant."
-version: "0.1.7"
+version: "0.1.8"
 mode: subagent

package/scripts/foundry/plant/agents/mill.yml

@@ -1,5 +1,5 @@
 name: mill
 skill: mill
 description: "Fasten their plant as the suit. Factory Repertoire. Inspect is the mill discipline."
-version: "0.1.7"
+version: "0.1.8"
 mode: subagent

package/scripts/foundry/plant/skills/inspect/SKILL.md

@@ -30,3 +30,5 @@ npx @0xray/foundry mint
 npx @0xray/foundry inspect
 npx @0xray/foundry ci --report
 ```
+
+CLI `mint` runs inspect after overlay (exit 1 if inspect fails). Postinstall mint does not; `--skip-live` skips the tarball GET. Chat is not a receipt.

package/scripts/node/bridge-mcp-wiring.cjs

@@ -230,12 +230,13 @@ function isIsolatedHome(env = process.env, machine = millSuit.machineHome()) {
 }
 
 function copyHermesHookRuntimes(packageRoot) {
+  if (millSuit.isIsolatedHome()) return false;
   const hooksSrc = [
     path.join(packageRoot, "dist", "integrations", "hooks"),
     path.join(packageRoot, "src", "integrations", "hooks"),
   ].find((p) => fs.existsSync(p));
   if (!hooksSrc) return false;
-  const hooksDst = path.join(os.homedir(), ".hermes", "plugins", "hooks");
+  const hooksDst = path.join(millSuit.machineHome(), ".hermes", "plugins", "hooks");
   fs.mkdirSync(hooksDst, { recursive: true });
   fs.cpSync(hooksSrc, hooksDst, { recursive: true, force: true });
   return true;
@@ -428,10 +429,11 @@ function resolveOpenClawPluginDir(packageRoot) {
 }
 
 function installOpenClawHostWear(packageRoot) {
+  if (millSuit.isIsolatedHome()) return null;
   const source = resolveOpenClawPreToolHookSource(packageRoot);
   if (!source) return null;
 
-  const hookDir = path.join(os.homedir(), ".openclaw", "hooks");
+  const hookDir = path.join(millSuit.machineHome(), ".openclaw", "hooks");
   fs.mkdirSync(hookDir, { recursive: true });
   const dest = path.join(hookDir, "xray-pre-tool.mjs");
   fs.copyFileSync(source, dest);

package/scripts/node/install-bridges.cjs

@@ -423,7 +423,16 @@ function installHermesBridge(targetDir, packageRoot, log) {
     return;
   }
 
-  const targetPluginDir = path.join(os.homedir(), ".hermes", "plugins", "xray-hermes");
+  const ephemeral = isEphemeralInstallRoot(targetDir);
+  const isolated = isIsolatedHome();
+  const machine = machineHome();
+  const targetPluginDir =
+    ephemeral || isolated
+      ? path.join(targetDir, ".hermes", "plugins", "xray-hermes")
+      : path.join(machine, ".hermes", "plugins", "xray-hermes");
+  if (isolated) {
+    log("hermes-bridge", "skip machine ~/.hermes plugin — isolated HOME", "info");
+  }
   fs.mkdirSync(targetPluginDir, { recursive: true });
   for (const entry of fs.readdirSync(sourceDir)) {
     const src = path.join(sourceDir, entry);
@@ -435,10 +444,15 @@ function installHermesBridge(targetDir, packageRoot, log) {
     }
   }
   copyHermesFindProjectRootHelper(packageRoot, targetPluginDir);
-  if (copyHermesHookRuntimes(packageRoot)) {
+  if (!ephemeral && !isolated && copyHermesHookRuntimes(packageRoot)) {
     log("hermes-bridge", "hook runtimes copied", "info", { path: "~/.hermes/plugins/hooks" });
   }
-  log("hermes-bridge", "plugin copied", "info", { path: "~/.hermes/plugins/xray-hermes" });
+  log(
+    "hermes-bridge",
+    "plugin copied",
+    "info",
+    { path: ephemeral || isolated ? path.relative(targetDir, targetPluginDir) : "~/.hermes/plugins/xray-hermes" },
+  );
 
   writePluginMcpJson(targetPluginDir, targetDir, log, "hermes-bridge");
 
@@ -453,11 +467,13 @@ function installHermesBridge(targetDir, packageRoot, log) {
     log("hermes-bridge", "skip machine consumer marker — ephemeral consumer", "info");
   }
 
-  try {
-    const result = wireHermesBridge(targetDir);
-    log("hermes-bridge", `mcp_servers wired (${result.count} servers)`, "info");
-  } catch (e) {
-    log("hermes-bridge", "mcp_servers wire failed", "warn", { error: e.message });
+  if (!ephemeral && !isolated) {
+    try {
+      const result = wireHermesBridge(targetDir);
+      log("hermes-bridge", `mcp_servers wired (${result.count} servers)`, "info");
+    } catch (e) {
+      log("hermes-bridge", "mcp_servers wire failed", "warn", { error: e.message });
+    }
   }
 }
 
@@ -494,26 +510,52 @@ function installOpenclawBridge(targetDir, packageRoot, log) {
     log("openclaw-bridge", "config created", "info", { path: ".xray/config/openclaw.json" });
   }
 
-  const copied = syncCostumeSkills(path.join(os.homedir(), ".openclaw", "skills"), packageRoot, targetDir);
-  if (copied > 0) log("openclaw-bridge", `skills synced (${copied})`, "info", { path: "~/.openclaw/skills/" });
+  const ephemeralOpenclaw = isEphemeralInstallRoot(targetDir);
+  const isolatedOpenclaw = isIsolatedHome();
+  if (!ephemeralOpenclaw && !isolatedOpenclaw) {
+    const copied = syncCostumeSkills(
+      path.join(machineHome(), ".openclaw", "skills"),
+      packageRoot,
+      targetDir,
+    );
+    if (copied > 0) {
+      log("openclaw-bridge", `skills synced (${copied})`, "info", { path: "~/.openclaw/skills/" });
+    }
+  } else {
+    log(
+      "openclaw-bridge",
+      isolatedOpenclaw
+        ? "skip machine ~/.openclaw skills — isolated HOME"
+        : "skip machine ~/.openclaw skills — ephemeral consumer",
+      "info",
+    );
+  }
 
-  try {
-    const result = wireOpenClawBridge(targetDir);
-    log("openclaw-bridge", `openclaw.json mcp wired (${result.count} servers)`, "info", {
-      method: result.method,
-    });
-  } catch (e) {
-    log("openclaw-bridge", "openclaw.json mcp wire failed", "warn", { error: e.message });
+  if (!ephemeralOpenclaw && !isolatedOpenclaw) {
+    try {
+      const result = wireOpenClawBridge(targetDir);
+      log("openclaw-bridge", `openclaw.json mcp wired (${result.count} servers)`, "info", {
+        method: result.method,
+      });
+    } catch (e) {
+      log("openclaw-bridge", "openclaw.json mcp wire failed", "warn", { error: e.message });
+    }
   }
 
-  if (!isEphemeralInstallRoot(targetDir)) {
+  if (!ephemeralOpenclaw && !isolatedOpenclaw) {
     const hook = installOpenClawHostWear(packageRoot);
     if (hook) log("openclaw-bridge", "PreToolUse hook installed", "info", { path: hook });
     if (maybeWriteOpenClawCliBackend()) {
       log("openclaw-bridge", "opencode-cli backend written", "info");
     }
   } else {
-    log("openclaw-bridge", "skip machine PreToolUse wear — ephemeral consumer", "info");
+    log(
+      "openclaw-bridge",
+      isolatedOpenclaw
+        ? "skip machine PreToolUse wear — isolated HOME"
+        : "skip machine PreToolUse wear — ephemeral consumer",
+      "info",
+    );
   }
 }