0xray 4.0.8 → 4.0.9

package/.xray/features.json

@@ -1,6 +1,6 @@
 {
   "$schema": "./features.schema.json",
-  "version": "4.0.8",
+  "version": "4.0.9",
   "description": "0xRay Framework - Unified Feature Configuration",
   "suit_temperament": {
     "profile": "auto",

package/README.md

@@ -50,6 +50,7 @@ Docs: [guides/autonomy-command](docs-site/docs/guides/autonomy-command.md) · Sk
 
 | Version | Highlights |
 |---------|------------|
+| **4.0.9** | Mill target: postinstall does not mill npm global prefix or `_npx` as a consumer. Isolated HOME skips machine `~/.grok`. |
 | **4.0.0** | Exo + temperament. Constitution always on; ceremony by host. Repertoire organ on (vendored 0.2). Station card survives compact/host-swap. **On npm.** [vision](docs-site/docs/architecture/v4-vision.md) · [now](docs-site/docs/architecture/v4-now.md) |
 | **3.4.1** | Unified `install-bridges.cjs` on postinstall — OpenCode, Grok, Hermes, OpenClaw in one pass. All 7 MCPs servers via `npx -y 0xray mcp <cmd>` (no `dist/` paths). Canonical `release.mjs` pipeline. |
 | **3.3.1** | Orchestrator confidence gate wired into execution planning. |
@@ -60,7 +61,7 @@ Docs: [guides/autonomy-command](docs-site/docs/guides/autonomy-command.md) · Sk
 
 ### Consolidations
 
-- **One consumer install path** — `postinstall.cjs` → `installAllBridges()` replaces scattered per-platform setup.
+- **One consumer install path** — `postinstall.cjs` → `installAllBridges()` replaces scattered per-platform setup. **4.0.9:** does not mill npm global prefix or `_npx`.
 - **7-server MCP surface** — `.mcp.json` SSOT; Grok plugin and all bridges share `XRAY_MCP_SERVERS`.
 - **Dev vs consumer AGENTS** — `AGENTS.md` (framework) vs `AGENTS-consumer.md` (copied to consumer projects on install).
 - **Release pipeline** — `npm run release:patch|minor|major` → reconcile → gate → artifacts → tag → publish.

package/dist/CHANGELOG.md

@@ -34,6 +34,14 @@ The format is based on [Conventional Commits](https://www.conventionalcommits.or
 
 ---
 
+## [4.0.9] - 2026-09-11
+
+Postinstall does **not** mill npm global prefix or npx cache as a consumer. `resolveConsumerTargetDir` treats `_npx` and a prefix without `package.json` as an install prefix: mill `INIT_CWD` if it is a real project, else mill the 0xray package (dogfood skip). Isolated HOME still skips machine `~/.grok`. Mill plant stays `mill` + `inspect`. Not 45/42 costume. Nested mill stays **0.1.9**. Not 5.0.0.
+
+- fix(foundry): do not mill npm global prefix or npx cache as a consumer (b08b19612)
+
+---
+
 ## [4.0.8] - 2026-09-11
 
 ### 🔄 Changes

package/dist/README.md

@@ -50,6 +50,7 @@ Docs: [guides/autonomy-command](docs-site/docs/guides/autonomy-command.md) · Sk
 
 | Version | Highlights |
 |---------|------------|
+| **4.0.9** | Mill target: postinstall does not mill npm global prefix or `_npx` as a consumer. Isolated HOME skips machine `~/.grok`. |
 | **4.0.0** | Exo + temperament. Constitution always on; ceremony by host. Repertoire organ on (vendored 0.2). Station card survives compact/host-swap. **On npm.** [vision](docs-site/docs/architecture/v4-vision.md) · [now](docs-site/docs/architecture/v4-now.md) |
 | **3.4.1** | Unified `install-bridges.cjs` on postinstall — OpenCode, Grok, Hermes, OpenClaw in one pass. All 7 MCPs servers via `npx -y 0xray mcp <cmd>` (no `dist/` paths). Canonical `release.mjs` pipeline. |
 | **3.3.1** | Orchestrator confidence gate wired into execution planning. |
@@ -60,7 +61,7 @@ Docs: [guides/autonomy-command](docs-site/docs/guides/autonomy-command.md) · Sk
 
 ### Consolidations
 
-- **One consumer install path** — `postinstall.cjs` → `installAllBridges()` replaces scattered per-platform setup.
+- **One consumer install path** — `postinstall.cjs` → `installAllBridges()` replaces scattered per-platform setup. **4.0.9:** does not mill npm global prefix or `_npx`.
 - **7-server MCP surface** — `.mcp.json` SSOT; Grok plugin and all bridges share `XRAY_MCP_SERVERS`.
 - **Dev vs consumer AGENTS** — `AGENTS.md` (framework) vs `AGENTS-consumer.md` (copied to consumer projects on install).
 - **Release pipeline** — `npm run release:patch|minor|major` → reconcile → gate → artifacts → tag → publish.

package/dist/integrations/openclaw/plugin/xray-pre-tool/package.json

@@ -1,6 +1,6 @@
 {
   "name": "xray-pre-tool",
-  "version": "4.0.4",
+  "version": "4.0.9",
   "private": true,
   "type": "module",
   "description": "0xRay constitution + temperament PreToolUse for OpenClaw",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "0xray",
-  "version": "4.0.8",
+  "version": "4.0.9",
   "description": "Multi-agent orchestration and Codex governance for OpenCode, Hermes, Grok Build, and OpenClaw",
   "readme": "README.md",
   "license": "MIT",

package/scripts/foundry/README.md

@@ -55,6 +55,8 @@ After mill plant is fastened, overlay their plant (defaults; remap in `foundry.j
 
 **Default mill plant:** `mill` + `inspect` (inspect AI work). Fastens a suit, not an empty one. Not 45/42 costume. `foundry.json` `"costume": true` copies that dump. Factory Repertoire still enable-when-resolves. PPE stays worn.
 
+**4.0.9 mill target (0xray postinstall, not this mill package):** `install-bridges.cjs` does not mill npm global prefix or npx `_npx` as a consumer. Isolated HOME skips machine `~/.grok`. Nested mill stays **0.1.9**.
+
 ## Publish this mill
 
 From **this directory**, not the 0xray repo root:

package/scripts/node/install-bridges.cjs

@@ -27,23 +27,44 @@ const SKIP_DIRS = new Set(["node_modules", "logs"]);
 const MERGE_FILES = new Set(["enforcer-config.json"]);
 const KEEP_IF_EXISTS = new Set([".yml", ".yaml", ".md"]);
 
+function isInstallPrefixTarget(dir) {
+  const n = path.resolve(dir);
+  const norm = n.replace(/\\/g, "/");
+  if (norm.includes("/_npx/") || norm.endsWith("/_npx")) return true;
+  if (!fs.existsSync(path.join(n, "package.json"))) return true;
+  return false;
+}
+
 function resolveConsumerTargetDir(packageRoot, fallbackDir) {
   const resolved = path.resolve(packageRoot);
+  const fallback = path.resolve(
+    fallbackDir || process.env.INIT_CWD || process.env.PWD || process.cwd(),
+  );
   const inNodeModules =
     resolved.includes(`${path.sep}node_modules${path.sep}`) ||
     resolved.endsWith(`${path.sep}node_modules`);
 
+  let candidate;
   if (!inNodeModules) {
-    return fallbackDir || process.env.PWD || process.cwd();
+    candidate = fallback;
+  } else {
+    let current = resolved;
+    while (path.basename(current) !== "node_modules") {
+      const parent = path.dirname(current);
+      if (parent === current) {
+        candidate = fallback;
+        break;
+      }
+      current = parent;
+    }
+    if (!candidate) candidate = path.dirname(current);
   }
 
-  let current = resolved;
-  while (path.basename(current) !== "node_modules") {
-    const parent = path.dirname(current);
-    if (parent === current) return fallbackDir || process.cwd();
-    current = parent;
+  if (isInstallPrefixTarget(candidate)) {
+    if (!isInstallPrefixTarget(fallback)) return fallback;
+    return resolved;
   }
-  return path.dirname(current);
+  return candidate;
 }
 
 function isConsumerInstall(packageRoot, targetDir) {
@@ -744,6 +765,7 @@ function installAllBridges(opts) {
 module.exports = {
   installAllBridges,
   resolveConsumerTargetDir,
+  isInstallPrefixTarget,
   syncBuiltinSkills,
   isConsumerInstall,
   deployXrayConfig,

package/scripts/node/postinstall.cjs

@@ -120,7 +120,10 @@ module.exports = {
 
 if (require.main === module) {
   const packageRoot = path.join(__dirname, "..", "..");
-  const targetDir = resolveConsumerTargetDir(packageRoot, process.env.PWD || process.cwd());
+  const targetDir = resolveConsumerTargetDir(
+    packageRoot,
+    process.env.INIT_CWD || process.env.PWD || process.cwd(),
+  );
   try {
     runPostinstall(packageRoot, targetDir);
   } catch {

package/scripts/node/setup.cjs

@@ -11,7 +11,10 @@ const {
   isConsumerInstall,
   deployXrayConfig,
 } = require("./install-bridges.cjs");
-let targetDir = resolveConsumerTargetDir(packageRoot, process.env.PWD || process.cwd());
+let targetDir = resolveConsumerTargetDir(
+  packageRoot,
+  process.env.INIT_CWD || process.env.PWD || process.cwd(),
+);
 
 const resolvedPackage = path.resolve(packageRoot);
 const resolvedTarget = path.resolve(targetDir);

package/src/integrations/openclaw/plugin/xray-pre-tool/package.json

@@ -1,6 +1,6 @@
 {
   "name": "xray-pre-tool",
-  "version": "4.0.4",
+  "version": "4.0.9",
   "private": true,
   "type": "module",
   "description": "0xRay constitution + temperament PreToolUse for OpenClaw",

package/xray/features.json

@@ -1,6 +1,6 @@
 {
   "$schema": "./features.schema.json",
-  "version": "4.0.8",
+  "version": "4.0.9",
   "description": "0xRay Framework - Unified Feature Configuration",
   "suit_temperament": {
     "profile": "auto",