@danielblomma/cortex-mcp 2.0.15 → 2.0.18

package/scaffold/mcp/tests/workflow-cli.test.mjs

@@ -6,6 +6,32 @@ import path from "node:path";
 
 import { runStageCommand } from "../dist/cli/stage.js";
 
+const TINY_WORKFLOW = {
+  id: "tiny",
+  description: "Two-stage tests workflow",
+  version: 1,
+  stages: [
+    {
+      name: "plan",
+      artifact: "plan.md",
+      reads: [],
+      required_fields: [],
+      validators: [],
+      capability: "planner",
+      description: "Produce a plan.",
+    },
+    {
+      name: "review",
+      artifact: "review.md",
+      reads: ["plan"],
+      required_fields: ["approved"],
+      validators: [],
+      capability: "reviewer",
+      description: "Review the plan.",
+    },
+  ],
+};
+
 function makeWorkspace() {
   const dir = fs.mkdtempSync(path.join(os.tmpdir(), "cortex-stage-cli-"));
   process.env.CORTEX_PROJECT_ROOT = dir;
@@ -21,6 +47,37 @@ function makeWorkspace() {
   return dir;
 }
 
+function writeSyncedWorkflow(homeDir, workflowId, definition) {
+  const cortexDir = path.join(homeDir, ".cortex");
+  fs.mkdirSync(cortexDir, { recursive: true });
+  fs.writeFileSync(
+    path.join(cortexDir, "workflows.local.json"),
+    JSON.stringify({
+      workflows: {
+        [workflowId]: {
+          workflow_id: workflowId,
+          version: definition.version,
+          updated_at: "2026-05-17T10:00:00.000Z",
+          definition,
+        },
+      },
+    }),
+    "utf8",
+  );
+}
+
+function setEnforcedMode(projectRoot) {
+  fs.writeFileSync(
+    path.join(projectRoot, ".context", "govern.local.json"),
+    JSON.stringify({
+      installs: {
+        codex: { mode: "enforced" },
+      },
+    }),
+    "utf8",
+  );
+}
+
 function captureStdout(run) {
   const original = process.stdout.write.bind(process.stdout);
   let captured = "";
@@ -37,6 +94,7 @@ function captureStdout(run) {
 
 test.afterEach(() => {
   delete process.env.CORTEX_PROJECT_ROOT;
+  delete process.env.HOME;
 });
 
 test("stage start: creates run + returns first envelope as JSON on stdout", async () => {
@@ -56,6 +114,8 @@ test("stage start: creates run + returns first envelope as JSON on stdout", asyn
   assert.equal(parsed.state.task_id, "task-1");
   assert.equal(parsed.state.current_stage, "plan");
   assert.equal(parsed.envelope.expectedArtifact, "plan.md");
+  assert.equal(parsed.workflow_source, "bundled");
+  assert.equal(parsed.warnings.length, 1);
   assert.ok(fs.existsSync(path.join(cwd, ".agents", "task-1", "state.json")));
 });
 
@@ -71,7 +131,48 @@ test("stage start: rejects unknown workflow", async () => {
       "--workflow",
       "no-such",
     ]),
-    /Unknown workflow_id/,
+    /Available bundled: secure-build/,
+  );
+});
+
+test("stage start: accepts synced workflow ids from the local cache", async () => {
+  makeWorkspace();
+  const fakeHome = fs.mkdtempSync(path.join(os.tmpdir(), "cortex-stage-home-"));
+  process.env.HOME = fakeHome;
+  writeSyncedWorkflow(fakeHome, "tiny", TINY_WORKFLOW);
+
+  const { captured } = await captureStdout(() =>
+    runStageCommand([
+      "start",
+      "--task-id",
+      "task-synced",
+      "--description",
+      "Use synced workflow",
+      "--workflow",
+      "tiny",
+    ]),
+  );
+  const parsed = JSON.parse(captured);
+  assert.equal(parsed.state.workflow_id, "tiny");
+  assert.equal(parsed.workflow_source, "synced");
+  assert.deepEqual(parsed.warnings, []);
+});
+
+test("stage start: blocks bundled workflow fallback in enforced mode", async () => {
+  const cwd = makeWorkspace();
+  setEnforcedMode(cwd);
+
+  await assert.rejects(
+    runStageCommand([
+      "start",
+      "--task-id",
+      "task-enforced",
+      "--description",
+      "Use bundled fallback",
+      "--workflow",
+      "secure-build",
+    ]),
+    /requires a synced org workflow/,
   );
 });
 

package/scaffold/mcp/tests/workflow-mcp-tools.test.mjs

@@ -86,6 +86,7 @@ test("runWorkflowStart: creates run and returns the first envelope", () => {
   assert.equal(result.state.current_stage, "plan");
   assert.equal(result.state.outcome, "in_progress");
   assert.equal(result.envelope.expectedArtifact, "plan.md");
+  assert.equal(result.workflow_source, "injected");
   assert.match(result.envelope.prompt, /# STAGE: plan/);
 
   // state.json persisted under .agents/<task-id>/
@@ -117,6 +118,27 @@ test("runWorkflowStart: defaults to bundled DEFAULT_WORKFLOWS when no registry g
   );
   assert.equal(result.state.workflow_id, "secure-build");
   assert.equal(result.envelope.expectedArtifact, "plan.md");
+  assert.equal(result.workflow_source, "bundled");
+  assert.equal(result.warnings.length, 0);
+});
+
+test("runWorkflowStart: blocks bundled fallback when the caller requires synced workflows", () => {
+  const cwd = makeWorkspace();
+  assert.throws(
+    () =>
+      runWorkflowStart(
+        {
+          task_id: "task-enforced",
+          task_description: "Use the default workflow",
+          workflow_id: SECURE_BUILD_WORKFLOW.id,
+        },
+        {
+          cwd,
+          bundledFallbackPolicy: "block",
+        },
+      ),
+    /requires a synced org workflow/,
+  );
 });
 
 test("runWorkflowAdvance: writes artifact + state, returns next envelope while in_progress", () => {

package/scaffold/mcp/tests/workflow-synced-registry.test.mjs

@@ -8,6 +8,7 @@ import {
   loadSyncedWorkflows,
   syncedWorkflowsCachePath,
 } from "../dist/core/workflow/synced-registry.js";
+import { resolveWorkflowDefinition } from "../dist/core/workflow/resolution.js";
 import { runWorkflowStart } from "../dist/core/workflow/mcp-tools.js";
 import { SECURE_BUILD_WORKFLOW } from "../dist/core/workflow/default-workflows.js";
 
@@ -173,6 +174,61 @@ test("resolveWorkflow integration: synced cache adds new workflow_ids beyond def
     );
     assert.equal(result.state.workflow_id, "tiny");
     assert.equal(result.state.current_stage, "plan");
+    assert.equal(result.workflow_source, "synced");
+  } finally {
+    delete process.env.HOME;
+  }
+});
+
+test("resolveWorkflowDefinition: includes bundled fallback warning when synced cache lacks the requested id", () => {
+  const fakeHome = makeWorkspace();
+  process.env.HOME = fakeHome;
+  try {
+    const resolved = resolveWorkflowDefinition("secure-build", {
+      emitBundledFallbackWarning: true,
+    });
+    assert.equal(resolved.source, "bundled");
+    assert.equal(resolved.warnings.length, 1);
+    assert.match(resolved.warnings[0].message, /bundled registry/);
+  } finally {
+    delete process.env.HOME;
+  }
+});
+
+test("resolveWorkflowDefinition: can block bundled fallback when synced workflows are required", () => {
+  const fakeHome = makeWorkspace();
+  process.env.HOME = fakeHome;
+  try {
+    assert.throws(
+      () =>
+        resolveWorkflowDefinition("secure-build", {
+          bundledFallbackPolicy: "block",
+        }),
+      /requires a synced org workflow/,
+    );
+  } finally {
+    delete process.env.HOME;
+  }
+});
+
+test("resolveWorkflowDefinition: unknown workflow errors list bundled and synced ids", () => {
+  const fakeHome = makeWorkspace();
+  process.env.HOME = fakeHome;
+  try {
+    writeCache(path.join(fakeHome, ".cortex"), {
+      workflows: {
+        tiny: {
+          workflow_id: "tiny",
+          version: 1,
+          updated_at: "2026-05-06T12:00:00.000Z",
+          definition: TINY_WORKFLOW,
+        },
+      },
+    });
+    assert.throws(
+      () => resolveWorkflowDefinition("missing-workflow"),
+      /Available bundled: secure-build\. Available synced: tiny\./,
+    );
   } finally {
     delete process.env.HOME;
   }

package/scaffold/scripts/parsers/node_modules/.package-lock.json

@@ -9,7 +9,6 @@
       "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.16.0.tgz",
       "integrity": "sha512-UVJyE9MttOsBQIDKw1skb9nAwQuR5wuGD3+82K6JgJlm/Y+KI92oNsMNGZCYdDsVtRHSak0pcV5Dno5+4jh9sw==",
       "license": "MIT",
-      "peer": true,
       "bin": {
         "acorn": "bin/acorn"
       },