@danielblomma/cortex-mcp 2.0.16 → 2.0.18

package/scaffold/mcp/tests/review-trust-contract.test.mjs

@@ -0,0 +1,167 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { SECURE_BUILD_WORKFLOW } from "../dist/core/workflow/default-workflows.js";
+import {
+  loadReviewTrustState,
+  recordQueuedReviewTrustState,
+  recordReviewDeliveryStatus,
+} from "../dist/enterprise/reviews/trust-state.js";
+import { syncedWorkflowsCachePath } from "../dist/core/workflow/synced-registry.js";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const reviewFixture = JSON.parse(
+  fs.readFileSync(
+    path.resolve(__dirname, "./fixtures/review-trust-contract.json"),
+    "utf8",
+  ),
+);
+
+function makeProject() {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "cortex-review-contract-"));
+  const contextDir = path.join(root, ".context");
+  fs.mkdirSync(contextDir, { recursive: true });
+  const taskDir = path.join(root, ".agents", "task-1");
+  fs.mkdirSync(taskDir, { recursive: true });
+  fs.writeFileSync(
+    path.join(taskDir, "state.json"),
+    JSON.stringify(
+      {
+        workflow_id: "secure-build",
+        outcome: "in_progress",
+      },
+      null,
+      2,
+    ),
+    "utf8",
+  );
+  return { root, contextDir };
+}
+
+function enableSyncedSecureBuild(homeDir) {
+  const syncedDir = path.join(homeDir, ".cortex");
+  fs.mkdirSync(syncedDir, { recursive: true });
+  fs.writeFileSync(
+    syncedWorkflowsCachePath(syncedDir),
+    JSON.stringify(
+      {
+        workflows: {
+          "secure-build": {
+            workflow_id: "secure-build",
+            version: 1,
+            updated_at: "2026-05-19T09:30:00.000Z",
+            definition: SECURE_BUILD_WORKFLOW,
+          },
+        },
+      },
+      null,
+      2,
+    ),
+    "utf8",
+  );
+}
+
+function normalizeContractShape(state) {
+  return {
+    workflow: {
+      id: state.workflow.id,
+      source: state.workflow.source,
+    },
+    last_review_at: state.last_review_at,
+    skipped_policies: state.skipped_policies,
+    delivery: {
+      status: state.delivery.status,
+      review_count: state.delivery.review_count,
+      last_accepted_at: state.delivery.last_accepted_at,
+      last_attempted_at: state.delivery.last_attempted_at,
+      last_error: state.delivery.last_error,
+    },
+  };
+}
+
+test("review trust contract: accepted payload matches the shared cross-repo fixture", () => {
+  const { root, contextDir } = makeProject();
+  const fakeHome = fs.mkdtempSync(path.join(os.tmpdir(), "cortex-review-home-"));
+  process.env.HOME = fakeHome;
+  enableSyncedSecureBuild(fakeHome);
+
+  try {
+    const accepted = reviewFixture.accepted.workflow_snapshot.snapshot.review_trust;
+    recordQueuedReviewTrustState(
+      {
+        contextDir,
+        projectRoot: root,
+        repo: reviewFixture.accepted.workflow_snapshot.repo,
+        instance_id: reviewFixture.accepted.workflow_snapshot.instanceId,
+        session_id: reviewFixture.accepted.workflow_snapshot.sessionId,
+        task_id: "task-1",
+      },
+      {
+        reviewedAt: accepted.last_review_at,
+        summary: {
+          total: accepted.delivery.review_count,
+          passed: 2,
+          failed: 0,
+          warnings: 0,
+          skipped: accepted.skipped_policies.length,
+        },
+        skippedPolicies: accepted.skipped_policies,
+      },
+    );
+    recordReviewDeliveryStatus(contextDir, "accepted", {
+      reviewCount: accepted.delivery.review_count,
+      attemptedAt: accepted.delivery.last_accepted_at,
+    });
+
+    const state = loadReviewTrustState(contextDir);
+    assert.deepEqual(normalizeContractShape(state), accepted);
+  } finally {
+    delete process.env.HOME;
+  }
+});
+
+test("review trust contract: failed payload matches the shared cross-repo fixture", () => {
+  const { root, contextDir } = makeProject();
+  const fakeHome = fs.mkdtempSync(path.join(os.tmpdir(), "cortex-review-home-"));
+  process.env.HOME = fakeHome;
+  enableSyncedSecureBuild(fakeHome);
+
+  try {
+    const failed = reviewFixture.failed.workflow_snapshot.snapshot.review_trust;
+    recordQueuedReviewTrustState(
+      {
+        contextDir,
+        projectRoot: root,
+        repo: reviewFixture.failed.workflow_snapshot.repo,
+        instance_id: reviewFixture.failed.workflow_snapshot.instanceId,
+        session_id: reviewFixture.failed.workflow_snapshot.sessionId,
+        task_id: "task-1",
+      },
+      {
+        reviewedAt: failed.last_review_at,
+        summary: {
+          total: failed.delivery.review_count,
+          passed: 1,
+          failed: 1,
+          warnings: 0,
+          skipped: 0,
+        },
+        skippedPolicies: [],
+      },
+    );
+    recordReviewDeliveryStatus(contextDir, "failed", {
+      reviewCount: failed.delivery.review_count,
+      attemptedAt: failed.delivery.last_attempted_at,
+      error: failed.delivery.last_error,
+    });
+
+    const state = loadReviewTrustState(contextDir);
+    assert.deepEqual(normalizeContractShape(state), failed);
+  } finally {
+    delete process.env.HOME;
+  }
+});

package/scaffold/mcp/tests/review-validator-source.test.mjs

@@ -0,0 +1,52 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+import { runValidators } from "../dist/core/validators/engine.js";
+import "../dist/core/validators/builtins.js";
+
+function makeProject() {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "cortex-review-validator-"));
+  const contextDir = path.join(root, ".context");
+  fs.mkdirSync(contextDir, { recursive: true });
+  return { root, contextDir };
+}
+
+test("require-code-review reports source none when no evidence exists", async () => {
+  const { root, contextDir } = makeProject();
+  const result = await runValidators(
+    new Set(["require-code-review"]),
+    { projectRoot: root, contextDir, changedFiles: [] },
+    {},
+  );
+
+  assert.equal(result.results[0].pass, false);
+  assert.match(result.results[0].detail ?? "", /Source: none/);
+});
+
+test("require-code-review reports workflow state as the evidence source", async () => {
+  const { root, contextDir } = makeProject();
+  fs.mkdirSync(path.join(contextDir, "workflow"), { recursive: true });
+  fs.writeFileSync(
+    path.join(contextDir, "workflow", "state.json"),
+    JSON.stringify({
+      last_review: {
+        status: "passed",
+        reviewed_at: "2026-05-17T10:00:00.000Z",
+        reviewed_files: [],
+      },
+    }),
+    "utf8",
+  );
+
+  const result = await runValidators(
+    new Set(["require-code-review"]),
+    { projectRoot: root, contextDir, changedFiles: [] },
+    {},
+  );
+
+  assert.equal(result.results[0].pass, true);
+  assert.match(result.results[0].detail ?? "", /Source: workflow state/);
+});

package/scaffold/mcp/tests/skill-sync-checker.test.mjs

@@ -0,0 +1,277 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+import {
+  runSkillSyncForCli,
+  runSkillSyncOnce,
+} from "../dist/daemon/skill-sync-checker.js";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const skillFixture = JSON.parse(
+  fs.readFileSync(
+    path.resolve(__dirname, "./fixtures/org-skillz-contract.json"),
+    "utf8",
+  ),
+);
+
+function makeWorkspace() {
+  const cwd = fs.mkdtempSync(path.join(os.tmpdir(), "cortex-skill-sync-"));
+  const contextDir = path.join(cwd, ".context");
+  fs.mkdirSync(contextDir, { recursive: true });
+  fs.writeFileSync(
+    path.join(contextDir, "enterprise.yml"),
+    [
+      "enterprise:",
+      "  api_key: ent_test_12345678",
+      "  endpoint: https://example.com",
+      "",
+    ].join("\n"),
+    "utf8",
+  );
+  return { cwd, contextDir };
+}
+
+function skillPath(homeDir, cli, name) {
+  const root = cli === "codex"
+    ? path.join(homeDir, ".codex", "skills")
+    : path.join(homeDir, ".claude", "skills");
+  return path.join(root, name, "SKILL.md");
+}
+
+function daemonStatePath(homeDir) {
+  return path.join(homeDir, ".cortex", "skills.local.json");
+}
+
+function daemonNotificationPath(homeDir) {
+  return path.join(homeDir, ".cortex", ".skills-update-applied.json");
+}
+
+function latestHostAuditFile(cwd) {
+  const auditDir = path.join(cwd, ".context", "audit");
+  const files = fs.existsSync(auditDir)
+    ? fs.readdirSync(auditDir).filter((file) => file.startsWith("host-events-"))
+    : [];
+  assert.ok(files.length > 0, "expected at least one host audit file");
+  files.sort();
+  return path.join(auditDir, files[files.length - 1]);
+}
+
+function createFetchStub(state) {
+  return async (input) => {
+    const url = input instanceof URL
+      ? input
+      : new URL(typeof input === "string" ? input : input.url);
+    if (url.pathname === "/api/v1/govern/skills/manifest") {
+      const cli = url.searchParams.get("cli");
+      return {
+        ok: true,
+        status: 200,
+        statusText: "OK",
+        json: async () => ({ skills: state.manifests[cli] ?? [] }),
+      };
+    }
+
+    if (url.pathname.startsWith("/api/v1/govern/skills/")) {
+      const name = decodeURIComponent(url.pathname.split("/").pop() ?? "");
+      if (!(name in state.bodies)) {
+        return {
+          ok: false,
+          status: 404,
+          statusText: "Not Found",
+          text: async () => "",
+        };
+      }
+      return {
+        ok: true,
+        status: 200,
+        statusText: "OK",
+        text: async () => state.bodies[name],
+      };
+    }
+
+    throw new Error(`Unexpected fetch URL: ${url.toString()}`);
+  };
+}
+
+test.afterEach(() => {
+  delete process.env.HOME;
+  globalThis.fetch = undefined;
+});
+
+test("runSkillSyncOnce: syncs global and CLI-scoped skills into the correct local roots", async () => {
+  const { cwd } = makeWorkspace();
+  const homeDir = fs.mkdtempSync(path.join(os.tmpdir(), "cortex-skill-home-"));
+  process.env.HOME = homeDir;
+
+  const state = {
+    manifests: {
+      claude: [
+        {
+          name: "global-skill",
+          scope: "global",
+          updated_at: "2026-05-19T08:00:00.000Z",
+        },
+      ],
+      codex: [
+        {
+          name: "global-skill",
+          scope: "global",
+          updated_at: "2026-05-19T08:00:00.000Z",
+        },
+        {
+          name: "codex-only",
+          scope: "cli:codex",
+          updated_at: "2026-05-19T08:00:00.000Z",
+        },
+      ],
+    },
+    bodies: {
+      "global-skill": "---\nname: global-skill\ndescription: \"Global\"\n---\n\n# Global\n",
+      "codex-only": "---\nname: codex-only\ndescription: \"Codex\"\n---\n\n# Codex\n",
+    },
+  };
+
+  globalThis.fetch = createFetchStub(state);
+
+  const outcomes = await runSkillSyncOnce(cwd, ["claude", "codex"]);
+  assert.equal(outcomes[0].kind, "synced");
+  assert.equal(outcomes[1].kind, "synced");
+
+  assert.ok(fs.existsSync(skillPath(homeDir, "claude", "global-skill")));
+  assert.ok(!fs.existsSync(skillPath(homeDir, "claude", "codex-only")));
+  assert.ok(fs.existsSync(skillPath(homeDir, "codex", "global-skill")));
+  assert.ok(fs.existsSync(skillPath(homeDir, "codex", "codex-only")));
+
+  const parsedState = JSON.parse(fs.readFileSync(daemonStatePath(homeDir), "utf8"));
+  assert.deepEqual(Object.keys(parsedState.skills).sort(), [
+    "claude:global-skill",
+    "codex:codex-only",
+    "codex:global-skill",
+  ]);
+
+  const notification = JSON.parse(
+    fs.readFileSync(daemonNotificationPath(homeDir), "utf8"),
+  );
+  assert.equal(notification.cli, "codex");
+
+  const auditLines = fs
+    .readFileSync(latestHostAuditFile(cwd), "utf8")
+    .trim()
+    .split("\n")
+    .map((line) => JSON.parse(line));
+  assert.deepEqual(
+    auditLines.map((event) => event.event_type),
+    ["skills_synced", "skills_synced"],
+  );
+});
+
+test("runSkillSyncForCli: rewrites a changed skill and reports an unchanged rerun", async () => {
+  const { cwd } = makeWorkspace();
+  const homeDir = fs.mkdtempSync(path.join(os.tmpdir(), "cortex-skill-home-"));
+  process.env.HOME = homeDir;
+
+  const state = {
+    manifests: {
+      codex: [
+        {
+          name: "global-skill",
+          scope: "global",
+          updated_at: "2026-05-19T08:00:00.000Z",
+        },
+      ],
+    },
+    bodies: {
+      "global-skill": "---\nname: global-skill\ndescription: \"V1\"\n---\n\n# One\n",
+    },
+  };
+  globalThis.fetch = createFetchStub(state);
+
+  const first = await runSkillSyncForCli(cwd, "codex");
+  assert.equal(first.kind, "synced");
+  assert.deepEqual(first.added, ["global-skill"]);
+
+  state.manifests.codex[0].updated_at = "2026-05-19T09:00:00.000Z";
+  state.bodies["global-skill"] =
+    "---\nname: global-skill\ndescription: \"V2\"\n---\n\n# Two\n";
+
+  const second = await runSkillSyncForCli(cwd, "codex");
+  assert.equal(second.kind, "synced");
+  assert.deepEqual(second.changed, ["global-skill"]);
+  assert.match(
+    fs.readFileSync(skillPath(homeDir, "codex", "global-skill"), "utf8"),
+    /# Two/,
+  );
+
+  const third = await runSkillSyncForCli(cwd, "codex");
+  assert.deepEqual(third, {
+    kind: "unchanged",
+    cli: "codex",
+    count: 1,
+  });
+});
+
+test("runSkillSyncForCli: removes skills that disappear from the manifest", async () => {
+  const { cwd } = makeWorkspace();
+  const homeDir = fs.mkdtempSync(path.join(os.tmpdir(), "cortex-skill-home-"));
+  process.env.HOME = homeDir;
+
+  const state = {
+    manifests: {
+      claude: [
+        {
+          name: "global-skill",
+          scope: "global",
+          updated_at: "2026-05-19T08:00:00.000Z",
+        },
+      ],
+    },
+    bodies: {
+      "global-skill": "---\nname: global-skill\ndescription: \"Global\"\n---\n\n# Global\n",
+    },
+  };
+  globalThis.fetch = createFetchStub(state);
+
+  const first = await runSkillSyncForCli(cwd, "claude");
+  assert.equal(first.kind, "synced");
+  assert.ok(fs.existsSync(skillPath(homeDir, "claude", "global-skill")));
+
+  state.manifests.claude = [];
+
+  const second = await runSkillSyncForCli(cwd, "claude");
+  assert.equal(second.kind, "synced");
+  assert.deepEqual(second.removed, ["global-skill"]);
+  assert.ok(!fs.existsSync(skillPath(homeDir, "claude", "global-skill")));
+});
+
+test("runSkillSyncOnce: consumes the shared org-skillz contract fixture end-to-end", async () => {
+  const { cwd } = makeWorkspace();
+  const homeDir = fs.mkdtempSync(path.join(os.tmpdir(), "cortex-skill-home-"));
+  process.env.HOME = homeDir;
+
+  globalThis.fetch = createFetchStub({
+    manifests: skillFixture.manifest,
+    bodies: skillFixture.markdown,
+  });
+
+  const outcomes = await runSkillSyncOnce(cwd, ["claude", "codex"]);
+  assert.equal(outcomes[0].kind, "synced");
+  assert.equal(outcomes[1].kind, "synced");
+
+  assert.equal(
+    fs.readFileSync(skillPath(homeDir, "codex", "alpha-codex"), "utf8"),
+    skillFixture.markdown["alpha-codex"],
+  );
+  assert.equal(
+    fs.readFileSync(skillPath(homeDir, "codex", "global-guard"), "utf8"),
+    skillFixture.markdown["global-guard"],
+  );
+  assert.equal(
+    fs.readFileSync(skillPath(homeDir, "claude", "claude-playbook"), "utf8"),
+    skillFixture.markdown["claude-playbook"],
+  );
+  assert.ok(!fs.existsSync(skillPath(homeDir, "claude", "alpha-codex")));
+});

package/scaffold/mcp/tests/workflow-cli.test.mjs

@@ -6,6 +6,32 @@ import path from "node:path";
 
 import { runStageCommand } from "../dist/cli/stage.js";
 
+const TINY_WORKFLOW = {
+  id: "tiny",
+  description: "Two-stage tests workflow",
+  version: 1,
+  stages: [
+    {
+      name: "plan",
+      artifact: "plan.md",
+      reads: [],
+      required_fields: [],
+      validators: [],
+      capability: "planner",
+      description: "Produce a plan.",
+    },
+    {
+      name: "review",
+      artifact: "review.md",
+      reads: ["plan"],
+      required_fields: ["approved"],
+      validators: [],
+      capability: "reviewer",
+      description: "Review the plan.",
+    },
+  ],
+};
+
 function makeWorkspace() {
   const dir = fs.mkdtempSync(path.join(os.tmpdir(), "cortex-stage-cli-"));
   process.env.CORTEX_PROJECT_ROOT = dir;
@@ -21,6 +47,37 @@ function makeWorkspace() {
   return dir;
 }
 
+function writeSyncedWorkflow(homeDir, workflowId, definition) {
+  const cortexDir = path.join(homeDir, ".cortex");
+  fs.mkdirSync(cortexDir, { recursive: true });
+  fs.writeFileSync(
+    path.join(cortexDir, "workflows.local.json"),
+    JSON.stringify({
+      workflows: {
+        [workflowId]: {
+          workflow_id: workflowId,
+          version: definition.version,
+          updated_at: "2026-05-17T10:00:00.000Z",
+          definition,
+        },
+      },
+    }),
+    "utf8",
+  );
+}
+
+function setEnforcedMode(projectRoot) {
+  fs.writeFileSync(
+    path.join(projectRoot, ".context", "govern.local.json"),
+    JSON.stringify({
+      installs: {
+        codex: { mode: "enforced" },
+      },
+    }),
+    "utf8",
+  );
+}
+
 function captureStdout(run) {
   const original = process.stdout.write.bind(process.stdout);
   let captured = "";
@@ -37,6 +94,7 @@ function captureStdout(run) {
 
 test.afterEach(() => {
   delete process.env.CORTEX_PROJECT_ROOT;
+  delete process.env.HOME;
 });
 
 test("stage start: creates run + returns first envelope as JSON on stdout", async () => {
@@ -56,6 +114,8 @@ test("stage start: creates run + returns first envelope as JSON on stdout", asyn
   assert.equal(parsed.state.task_id, "task-1");
   assert.equal(parsed.state.current_stage, "plan");
   assert.equal(parsed.envelope.expectedArtifact, "plan.md");
+  assert.equal(parsed.workflow_source, "bundled");
+  assert.equal(parsed.warnings.length, 1);
   assert.ok(fs.existsSync(path.join(cwd, ".agents", "task-1", "state.json")));
 });
 
@@ -71,7 +131,48 @@ test("stage start: rejects unknown workflow", async () => {
       "--workflow",
       "no-such",
     ]),
-    /Unknown workflow_id/,
+    /Available bundled: secure-build/,
+  );
+});
+
+test("stage start: accepts synced workflow ids from the local cache", async () => {
+  makeWorkspace();
+  const fakeHome = fs.mkdtempSync(path.join(os.tmpdir(), "cortex-stage-home-"));
+  process.env.HOME = fakeHome;
+  writeSyncedWorkflow(fakeHome, "tiny", TINY_WORKFLOW);
+
+  const { captured } = await captureStdout(() =>
+    runStageCommand([
+      "start",
+      "--task-id",
+      "task-synced",
+      "--description",
+      "Use synced workflow",
+      "--workflow",
+      "tiny",
+    ]),
+  );
+  const parsed = JSON.parse(captured);
+  assert.equal(parsed.state.workflow_id, "tiny");
+  assert.equal(parsed.workflow_source, "synced");
+  assert.deepEqual(parsed.warnings, []);
+});
+
+test("stage start: blocks bundled workflow fallback in enforced mode", async () => {
+  const cwd = makeWorkspace();
+  setEnforcedMode(cwd);
+
+  await assert.rejects(
+    runStageCommand([
+      "start",
+      "--task-id",
+      "task-enforced",
+      "--description",
+      "Use bundled fallback",
+      "--workflow",
+      "secure-build",
+    ]),
+    /requires a synced org workflow/,
   );
 });
 

package/scaffold/mcp/tests/workflow-mcp-tools.test.mjs

@@ -86,6 +86,7 @@ test("runWorkflowStart: creates run and returns the first envelope", () => {
   assert.equal(result.state.current_stage, "plan");
   assert.equal(result.state.outcome, "in_progress");
   assert.equal(result.envelope.expectedArtifact, "plan.md");
+  assert.equal(result.workflow_source, "injected");
   assert.match(result.envelope.prompt, /# STAGE: plan/);
 
   // state.json persisted under .agents/<task-id>/
@@ -117,6 +118,27 @@ test("runWorkflowStart: defaults to bundled DEFAULT_WORKFLOWS when no registry g
   );
   assert.equal(result.state.workflow_id, "secure-build");
   assert.equal(result.envelope.expectedArtifact, "plan.md");
+  assert.equal(result.workflow_source, "bundled");
+  assert.equal(result.warnings.length, 0);
+});
+
+test("runWorkflowStart: blocks bundled fallback when the caller requires synced workflows", () => {
+  const cwd = makeWorkspace();
+  assert.throws(
+    () =>
+      runWorkflowStart(
+        {
+          task_id: "task-enforced",
+          task_description: "Use the default workflow",
+          workflow_id: SECURE_BUILD_WORKFLOW.id,
+        },
+        {
+          cwd,
+          bundledFallbackPolicy: "block",
+        },
+      ),
+    /requires a synced org workflow/,
+  );
 });
 
 test("runWorkflowAdvance: writes artifact + state, returns next envelope while in_progress", () => {