@danielblomma/cortex-mcp 2.0.15 → 2.0.18

package/scaffold/mcp/tests/review-policy-selection.test.mjs

@@ -0,0 +1,85 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { partitionReviewPolicies } from "../dist/enterprise/reviews/policy-selection.js";
+import { DEFERRED_CODE_REVIEW_REASON } from "../dist/enterprise/reviews/policy-selection.js";
+import "../dist/core/validators/builtins.js";
+
+test("partitionReviewPolicies: defers require-code-review with explicit evidence", () => {
+  const result = partitionReviewPolicies([
+    {
+      id: "require-code-review",
+      description: "Code review is required",
+      priority: 10,
+      scope: "global",
+      enforce: true,
+      source: "org",
+      kind: "predefined",
+      type: null,
+      config: null,
+      severity: "block",
+      status: "active",
+      title: "Require code review",
+    },
+  ]);
+
+  assert.deepEqual(result.enforced, []);
+  assert.deepEqual(result.skipped, [
+    {
+      policy_id: "require-code-review",
+      kind: "predefined",
+      type: null,
+      reason: DEFERRED_CODE_REVIEW_REASON,
+    },
+  ]);
+});
+
+test("partitionReviewPolicies: keeps executable validators enforced and skips missing evaluators", () => {
+  const result = partitionReviewPolicies([
+    {
+      id: "no-secrets-in-code",
+      description: "Block secrets",
+      priority: 10,
+      scope: "global",
+      enforce: true,
+      source: "org",
+      kind: "predefined",
+      type: null,
+      config: null,
+      severity: "block",
+      status: "active",
+      title: "No secrets",
+    },
+    {
+      id: "custom.missing",
+      description: "Missing evaluator",
+      priority: 20,
+      scope: "global",
+      enforce: true,
+      source: "org",
+      kind: "custom",
+      type: "regex-custom",
+      config: { pattern: "secret" },
+      severity: "warning",
+      status: "active",
+      title: "Missing custom evaluator",
+    },
+  ]);
+
+  assert.deepEqual(result.enforced, [
+    {
+      id: "no-secrets-in-code",
+      type: null,
+      config: null,
+      severity: "block",
+    },
+  ]);
+  assert.deepEqual(result.skipped, [
+    {
+      policy_id: "custom.missing",
+      kind: "custom",
+      type: "regex-custom",
+      reason: 'No evaluator registered for type "regex-custom"',
+    },
+  ]);
+});

package/scaffold/mcp/tests/review-trust-contract.test.mjs

@@ -0,0 +1,167 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { SECURE_BUILD_WORKFLOW } from "../dist/core/workflow/default-workflows.js";
+import {
+  loadReviewTrustState,
+  recordQueuedReviewTrustState,
+  recordReviewDeliveryStatus,
+} from "../dist/enterprise/reviews/trust-state.js";
+import { syncedWorkflowsCachePath } from "../dist/core/workflow/synced-registry.js";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const reviewFixture = JSON.parse(
+  fs.readFileSync(
+    path.resolve(__dirname, "./fixtures/review-trust-contract.json"),
+    "utf8",
+  ),
+);
+
+function makeProject() {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "cortex-review-contract-"));
+  const contextDir = path.join(root, ".context");
+  fs.mkdirSync(contextDir, { recursive: true });
+  const taskDir = path.join(root, ".agents", "task-1");
+  fs.mkdirSync(taskDir, { recursive: true });
+  fs.writeFileSync(
+    path.join(taskDir, "state.json"),
+    JSON.stringify(
+      {
+        workflow_id: "secure-build",
+        outcome: "in_progress",
+      },
+      null,
+      2,
+    ),
+    "utf8",
+  );
+  return { root, contextDir };
+}
+
+function enableSyncedSecureBuild(homeDir) {
+  const syncedDir = path.join(homeDir, ".cortex");
+  fs.mkdirSync(syncedDir, { recursive: true });
+  fs.writeFileSync(
+    syncedWorkflowsCachePath(syncedDir),
+    JSON.stringify(
+      {
+        workflows: {
+          "secure-build": {
+            workflow_id: "secure-build",
+            version: 1,
+            updated_at: "2026-05-19T09:30:00.000Z",
+            definition: SECURE_BUILD_WORKFLOW,
+          },
+        },
+      },
+      null,
+      2,
+    ),
+    "utf8",
+  );
+}
+
+function normalizeContractShape(state) {
+  return {
+    workflow: {
+      id: state.workflow.id,
+      source: state.workflow.source,
+    },
+    last_review_at: state.last_review_at,
+    skipped_policies: state.skipped_policies,
+    delivery: {
+      status: state.delivery.status,
+      review_count: state.delivery.review_count,
+      last_accepted_at: state.delivery.last_accepted_at,
+      last_attempted_at: state.delivery.last_attempted_at,
+      last_error: state.delivery.last_error,
+    },
+  };
+}
+
+test("review trust contract: accepted payload matches the shared cross-repo fixture", () => {
+  const { root, contextDir } = makeProject();
+  const fakeHome = fs.mkdtempSync(path.join(os.tmpdir(), "cortex-review-home-"));
+  process.env.HOME = fakeHome;
+  enableSyncedSecureBuild(fakeHome);
+
+  try {
+    const accepted = reviewFixture.accepted.workflow_snapshot.snapshot.review_trust;
+    recordQueuedReviewTrustState(
+      {
+        contextDir,
+        projectRoot: root,
+        repo: reviewFixture.accepted.workflow_snapshot.repo,
+        instance_id: reviewFixture.accepted.workflow_snapshot.instanceId,
+        session_id: reviewFixture.accepted.workflow_snapshot.sessionId,
+        task_id: "task-1",
+      },
+      {
+        reviewedAt: accepted.last_review_at,
+        summary: {
+          total: accepted.delivery.review_count,
+          passed: 2,
+          failed: 0,
+          warnings: 0,
+          skipped: accepted.skipped_policies.length,
+        },
+        skippedPolicies: accepted.skipped_policies,
+      },
+    );
+    recordReviewDeliveryStatus(contextDir, "accepted", {
+      reviewCount: accepted.delivery.review_count,
+      attemptedAt: accepted.delivery.last_accepted_at,
+    });
+
+    const state = loadReviewTrustState(contextDir);
+    assert.deepEqual(normalizeContractShape(state), accepted);
+  } finally {
+    delete process.env.HOME;
+  }
+});
+
+test("review trust contract: failed payload matches the shared cross-repo fixture", () => {
+  const { root, contextDir } = makeProject();
+  const fakeHome = fs.mkdtempSync(path.join(os.tmpdir(), "cortex-review-home-"));
+  process.env.HOME = fakeHome;
+  enableSyncedSecureBuild(fakeHome);
+
+  try {
+    const failed = reviewFixture.failed.workflow_snapshot.snapshot.review_trust;
+    recordQueuedReviewTrustState(
+      {
+        contextDir,
+        projectRoot: root,
+        repo: reviewFixture.failed.workflow_snapshot.repo,
+        instance_id: reviewFixture.failed.workflow_snapshot.instanceId,
+        session_id: reviewFixture.failed.workflow_snapshot.sessionId,
+        task_id: "task-1",
+      },
+      {
+        reviewedAt: failed.last_review_at,
+        summary: {
+          total: failed.delivery.review_count,
+          passed: 1,
+          failed: 1,
+          warnings: 0,
+          skipped: 0,
+        },
+        skippedPolicies: [],
+      },
+    );
+    recordReviewDeliveryStatus(contextDir, "failed", {
+      reviewCount: failed.delivery.review_count,
+      attemptedAt: failed.delivery.last_attempted_at,
+      error: failed.delivery.last_error,
+    });
+
+    const state = loadReviewTrustState(contextDir);
+    assert.deepEqual(normalizeContractShape(state), failed);
+  } finally {
+    delete process.env.HOME;
+  }
+});

package/scaffold/mcp/tests/review-validator-source.test.mjs

@@ -0,0 +1,52 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+import { runValidators } from "../dist/core/validators/engine.js";
+import "../dist/core/validators/builtins.js";
+
+function makeProject() {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "cortex-review-validator-"));
+  const contextDir = path.join(root, ".context");
+  fs.mkdirSync(contextDir, { recursive: true });
+  return { root, contextDir };
+}
+
+test("require-code-review reports source none when no evidence exists", async () => {
+  const { root, contextDir } = makeProject();
+  const result = await runValidators(
+    new Set(["require-code-review"]),
+    { projectRoot: root, contextDir, changedFiles: [] },
+    {},
+  );
+
+  assert.equal(result.results[0].pass, false);
+  assert.match(result.results[0].detail ?? "", /Source: none/);
+});
+
+test("require-code-review reports workflow state as the evidence source", async () => {
+  const { root, contextDir } = makeProject();
+  fs.mkdirSync(path.join(contextDir, "workflow"), { recursive: true });
+  fs.writeFileSync(
+    path.join(contextDir, "workflow", "state.json"),
+    JSON.stringify({
+      last_review: {
+        status: "passed",
+        reviewed_at: "2026-05-17T10:00:00.000Z",
+        reviewed_files: [],
+      },
+    }),
+    "utf8",
+  );
+
+  const result = await runValidators(
+    new Set(["require-code-review"]),
+    { projectRoot: root, contextDir, changedFiles: [] },
+    {},
+  );
+
+  assert.equal(result.results[0].pass, true);
+  assert.match(result.results[0].detail ?? "", /Source: workflow state/);
+});

package/scaffold/mcp/tests/skill-sync-checker.test.mjs

@@ -0,0 +1,277 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+import {
+  runSkillSyncForCli,
+  runSkillSyncOnce,
+} from "../dist/daemon/skill-sync-checker.js";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const skillFixture = JSON.parse(
+  fs.readFileSync(
+    path.resolve(__dirname, "./fixtures/org-skillz-contract.json"),
+    "utf8",
+  ),
+);
+
+function makeWorkspace() {
+  const cwd = fs.mkdtempSync(path.join(os.tmpdir(), "cortex-skill-sync-"));
+  const contextDir = path.join(cwd, ".context");
+  fs.mkdirSync(contextDir, { recursive: true });
+  fs.writeFileSync(
+    path.join(contextDir, "enterprise.yml"),
+    [
+      "enterprise:",
+      "  api_key: ent_test_12345678",
+      "  endpoint: https://example.com",
+      "",
+    ].join("\n"),
+    "utf8",
+  );
+  return { cwd, contextDir };
+}
+
+function skillPath(homeDir, cli, name) {
+  const root = cli === "codex"
+    ? path.join(homeDir, ".codex", "skills")
+    : path.join(homeDir, ".claude", "skills");
+  return path.join(root, name, "SKILL.md");
+}
+
+function daemonStatePath(homeDir) {
+  return path.join(homeDir, ".cortex", "skills.local.json");
+}
+
+function daemonNotificationPath(homeDir) {
+  return path.join(homeDir, ".cortex", ".skills-update-applied.json");
+}
+
+function latestHostAuditFile(cwd) {
+  const auditDir = path.join(cwd, ".context", "audit");
+  const files = fs.existsSync(auditDir)
+    ? fs.readdirSync(auditDir).filter((file) => file.startsWith("host-events-"))
+    : [];
+  assert.ok(files.length > 0, "expected at least one host audit file");
+  files.sort();
+  return path.join(auditDir, files[files.length - 1]);
+}
+
+function createFetchStub(state) {
+  return async (input) => {
+    const url = input instanceof URL
+      ? input
+      : new URL(typeof input === "string" ? input : input.url);
+    if (url.pathname === "/api/v1/govern/skills/manifest") {
+      const cli = url.searchParams.get("cli");
+      return {
+        ok: true,
+        status: 200,
+        statusText: "OK",
+        json: async () => ({ skills: state.manifests[cli] ?? [] }),
+      };
+    }
+
+    if (url.pathname.startsWith("/api/v1/govern/skills/")) {
+      const name = decodeURIComponent(url.pathname.split("/").pop() ?? "");
+      if (!(name in state.bodies)) {
+        return {
+          ok: false,
+          status: 404,
+          statusText: "Not Found",
+          text: async () => "",
+        };
+      }
+      return {
+        ok: true,
+        status: 200,
+        statusText: "OK",
+        text: async () => state.bodies[name],
+      };
+    }
+
+    throw new Error(`Unexpected fetch URL: ${url.toString()}`);
+  };
+}
+
+test.afterEach(() => {
+  delete process.env.HOME;
+  globalThis.fetch = undefined;
+});
+
+test("runSkillSyncOnce: syncs global and CLI-scoped skills into the correct local roots", async () => {
+  const { cwd } = makeWorkspace();
+  const homeDir = fs.mkdtempSync(path.join(os.tmpdir(), "cortex-skill-home-"));
+  process.env.HOME = homeDir;
+
+  const state = {
+    manifests: {
+      claude: [
+        {
+          name: "global-skill",
+          scope: "global",
+          updated_at: "2026-05-19T08:00:00.000Z",
+        },
+      ],
+      codex: [
+        {
+          name: "global-skill",
+          scope: "global",
+          updated_at: "2026-05-19T08:00:00.000Z",
+        },
+        {
+          name: "codex-only",
+          scope: "cli:codex",
+          updated_at: "2026-05-19T08:00:00.000Z",
+        },
+      ],
+    },
+    bodies: {
+      "global-skill": "---\nname: global-skill\ndescription: \"Global\"\n---\n\n# Global\n",
+      "codex-only": "---\nname: codex-only\ndescription: \"Codex\"\n---\n\n# Codex\n",
+    },
+  };
+
+  globalThis.fetch = createFetchStub(state);
+
+  const outcomes = await runSkillSyncOnce(cwd, ["claude", "codex"]);
+  assert.equal(outcomes[0].kind, "synced");
+  assert.equal(outcomes[1].kind, "synced");
+
+  assert.ok(fs.existsSync(skillPath(homeDir, "claude", "global-skill")));
+  assert.ok(!fs.existsSync(skillPath(homeDir, "claude", "codex-only")));
+  assert.ok(fs.existsSync(skillPath(homeDir, "codex", "global-skill")));
+  assert.ok(fs.existsSync(skillPath(homeDir, "codex", "codex-only")));
+
+  const parsedState = JSON.parse(fs.readFileSync(daemonStatePath(homeDir), "utf8"));
+  assert.deepEqual(Object.keys(parsedState.skills).sort(), [
+    "claude:global-skill",
+    "codex:codex-only",
+    "codex:global-skill",
+  ]);
+
+  const notification = JSON.parse(
+    fs.readFileSync(daemonNotificationPath(homeDir), "utf8"),
+  );
+  assert.equal(notification.cli, "codex");
+
+  const auditLines = fs
+    .readFileSync(latestHostAuditFile(cwd), "utf8")
+    .trim()
+    .split("\n")
+    .map((line) => JSON.parse(line));
+  assert.deepEqual(
+    auditLines.map((event) => event.event_type),
+    ["skills_synced", "skills_synced"],
+  );
+});
+
+test("runSkillSyncForCli: rewrites a changed skill and reports an unchanged rerun", async () => {
+  const { cwd } = makeWorkspace();
+  const homeDir = fs.mkdtempSync(path.join(os.tmpdir(), "cortex-skill-home-"));
+  process.env.HOME = homeDir;
+
+  const state = {
+    manifests: {
+      codex: [
+        {
+          name: "global-skill",
+          scope: "global",
+          updated_at: "2026-05-19T08:00:00.000Z",
+        },
+      ],
+    },
+    bodies: {
+      "global-skill": "---\nname: global-skill\ndescription: \"V1\"\n---\n\n# One\n",
+    },
+  };
+  globalThis.fetch = createFetchStub(state);
+
+  const first = await runSkillSyncForCli(cwd, "codex");
+  assert.equal(first.kind, "synced");
+  assert.deepEqual(first.added, ["global-skill"]);
+
+  state.manifests.codex[0].updated_at = "2026-05-19T09:00:00.000Z";
+  state.bodies["global-skill"] =
+    "---\nname: global-skill\ndescription: \"V2\"\n---\n\n# Two\n";
+
+  const second = await runSkillSyncForCli(cwd, "codex");
+  assert.equal(second.kind, "synced");
+  assert.deepEqual(second.changed, ["global-skill"]);
+  assert.match(
+    fs.readFileSync(skillPath(homeDir, "codex", "global-skill"), "utf8"),
+    /# Two/,
+  );
+
+  const third = await runSkillSyncForCli(cwd, "codex");
+  assert.deepEqual(third, {
+    kind: "unchanged",
+    cli: "codex",
+    count: 1,
+  });
+});
+
+test("runSkillSyncForCli: removes skills that disappear from the manifest", async () => {
+  const { cwd } = makeWorkspace();
+  const homeDir = fs.mkdtempSync(path.join(os.tmpdir(), "cortex-skill-home-"));
+  process.env.HOME = homeDir;
+
+  const state = {
+    manifests: {
+      claude: [
+        {
+          name: "global-skill",
+          scope: "global",
+          updated_at: "2026-05-19T08:00:00.000Z",
+        },
+      ],
+    },
+    bodies: {
+      "global-skill": "---\nname: global-skill\ndescription: \"Global\"\n---\n\n# Global\n",
+    },
+  };
+  globalThis.fetch = createFetchStub(state);
+
+  const first = await runSkillSyncForCli(cwd, "claude");
+  assert.equal(first.kind, "synced");
+  assert.ok(fs.existsSync(skillPath(homeDir, "claude", "global-skill")));
+
+  state.manifests.claude = [];
+
+  const second = await runSkillSyncForCli(cwd, "claude");
+  assert.equal(second.kind, "synced");
+  assert.deepEqual(second.removed, ["global-skill"]);
+  assert.ok(!fs.existsSync(skillPath(homeDir, "claude", "global-skill")));
+});
+
+test("runSkillSyncOnce: consumes the shared org-skillz contract fixture end-to-end", async () => {
+  const { cwd } = makeWorkspace();
+  const homeDir = fs.mkdtempSync(path.join(os.tmpdir(), "cortex-skill-home-"));
+  process.env.HOME = homeDir;
+
+  globalThis.fetch = createFetchStub({
+    manifests: skillFixture.manifest,
+    bodies: skillFixture.markdown,
+  });
+
+  const outcomes = await runSkillSyncOnce(cwd, ["claude", "codex"]);
+  assert.equal(outcomes[0].kind, "synced");
+  assert.equal(outcomes[1].kind, "synced");
+
+  assert.equal(
+    fs.readFileSync(skillPath(homeDir, "codex", "alpha-codex"), "utf8"),
+    skillFixture.markdown["alpha-codex"],
+  );
+  assert.equal(
+    fs.readFileSync(skillPath(homeDir, "codex", "global-guard"), "utf8"),
+    skillFixture.markdown["global-guard"],
+  );
+  assert.equal(
+    fs.readFileSync(skillPath(homeDir, "claude", "claude-playbook"), "utf8"),
+    skillFixture.markdown["claude-playbook"],
+  );
+  assert.ok(!fs.existsSync(skillPath(homeDir, "claude", "alpha-codex")));
+});

package/scaffold/mcp/tests/telemetry-collector.test.mjs

@@ -1,6 +1,6 @@
 import test from "node:test";
 import assert from "node:assert/strict";
-import { mkdtempSync } from "node:fs";
+import { chmodSync, existsSync, mkdtempSync, mkdirSync } from "node:fs";
 import { tmpdir } from "node:os";
 import path from "node:path";
 
@@ -28,3 +28,33 @@ test("TelemetryCollector counts context.impact as an impact analysis", () => {
   assert.equal(metrics.impact_analyses, 1);
   assert.equal(metrics.tool_metrics["context.impact"].calls, 1);
 });
+
+test("TelemetryCollector falls back when .context/telemetry is not writable", () => {
+  const contextDir = createContextDir("cortex-telemetry-fallback-");
+  const primaryTelemetryDir = path.join(contextDir, "telemetry");
+  const fallbackMetricsPath = path.join(
+    contextDir,
+    "cache",
+    "telemetry",
+    "metrics.json",
+  );
+
+  mkdirSync(primaryTelemetryDir, { recursive: true });
+  chmodSync(primaryTelemetryDir, 0o555);
+
+  try {
+    const collector = new TelemetryCollector(contextDir, "test-version");
+    collector.recordEvent({
+      tool: "context.search",
+      phase: "success",
+      result_count: 1,
+      estimated_tokens_saved: 100,
+      duration_ms: 10,
+    });
+    collector.flush();
+
+    assert.equal(existsSync(fallbackMetricsPath), true);
+  } finally {
+    chmodSync(primaryTelemetryDir, 0o755);
+  }
+});