@danielblomma/cortex-mcp 2.0.16 → 2.0.19

package/scaffold/mcp/src/core/workflow/mcp-tools.ts

@@ -1,8 +1,7 @@
 import { z } from "zod";
 import { advanceStage, createRun, getRunState } from "./run-lifecycle.js";
 import { composeStageEnvelope } from "./envelope.js";
-import { DEFAULT_WORKFLOWS } from "./default-workflows.js";
-import { loadSyncedWorkflows } from "./synced-registry.js";
+import { resolveWorkflowDefinition } from "./resolution.js";
 import {
   stageOverrideSchema,
   stageStatusSchema,
@@ -88,33 +87,18 @@ export function resolveProjectRoot(): string {
 export type WorkflowToolContext = {
   cwd: string;
   workflows?: Record<string, WorkflowDefinition>;
+  bundledFallbackPolicy?: "allow" | "warn" | "block";
 };
 
-function resolveWorkflow(
-  workflowId: string,
-  registry: Record<string, WorkflowDefinition> | undefined,
-): WorkflowDefinition {
-  // When the caller passes an explicit registry, it wins outright (used
-  // by tests). Otherwise we merge bundled defaults with the org-authored
-  // workflows the daemon has synced into ~/.cortex/workflows.local.json,
-  // with the synced ones taking precedence on workflow_id collisions so
-  // org overrides actually override.
-  const workflows =
-    registry ?? { ...DEFAULT_WORKFLOWS, ...loadSyncedWorkflows() };
-  const workflow = workflows[workflowId];
-  if (!workflow) {
-    throw new Error(
-      `Unknown workflow_id: ${workflowId}. Available: ${Object.keys(workflows).join(", ") || "<none>"}`,
-    );
-  }
-  return workflow;
-}
-
 export function runWorkflowStart(
   input: WorkflowStartInputT,
   ctx: WorkflowToolContext,
 ) {
-  const workflow = resolveWorkflow(input.workflow_id, ctx.workflows);
+  const resolved = resolveWorkflowDefinition(input.workflow_id, {
+    registry: ctx.workflows,
+    bundledFallbackPolicy: ctx.bundledFallbackPolicy,
+  });
+  const workflow = resolved.workflow;
   const state = createRun({
     cwd: ctx.cwd,
     taskId: input.task_id,
@@ -129,6 +113,8 @@ export function runWorkflowStart(
   return {
     state,
     envelope,
+    workflow_source: resolved.source,
+    warnings: resolved.warnings,
   };
 }
 
@@ -142,7 +128,9 @@ export function runWorkflowAdvance(
       `No run state found for task ${input.task_id}. Call cortex.workflow.start first.`,
     );
   }
-  const workflow = resolveWorkflow(state.workflow_id, ctx.workflows);
+  const workflow = resolveWorkflowDefinition(state.workflow_id, {
+    registry: ctx.workflows,
+  }).workflow;
   const stage = workflow.stages.find((s) => s.name === input.stage);
   if (!stage) {
     throw new Error(`Stage ${input.stage} is not defined in workflow ${workflow.id}`);
@@ -220,7 +208,9 @@ export function runWorkflowEnvelope(
       `No run state found for task ${input.task_id}. Call cortex.workflow.start first.`,
     );
   }
-  const workflow = resolveWorkflow(state.workflow_id, ctx.workflows);
+  const workflow = resolveWorkflowDefinition(state.workflow_id, {
+    registry: ctx.workflows,
+  }).workflow;
   const envelope = composeStageEnvelope({
     cwd: ctx.cwd,
     taskId: input.task_id,

package/scaffold/mcp/src/core/workflow/resolution.ts

@@ -0,0 +1,113 @@
+import { DEFAULT_WORKFLOWS } from "./default-workflows.js";
+import { loadSyncedWorkflows } from "./synced-registry.js";
+import type { WorkflowDefinition } from "./schemas.js";
+
+export type WorkflowSource = "bundled" | "synced" | "injected";
+
+export type WorkflowResolutionWarning = {
+  code: "bundled-workflow-fallback";
+  workflow_id: string;
+  message: string;
+  bundled_available: boolean;
+  synced_available: boolean;
+};
+
+export type WorkflowResolution = {
+  workflow: WorkflowDefinition;
+  source: WorkflowSource;
+  warnings: WorkflowResolutionWarning[];
+  bundled_ids: string[];
+  synced_ids: string[];
+  available_ids: string[];
+};
+
+type ResolveWorkflowOptions = {
+  registry?: Record<string, WorkflowDefinition>;
+  syncedDir?: string;
+  emitBundledFallbackWarning?: boolean;
+  bundledFallbackPolicy?: "allow" | "warn" | "block";
+};
+
+function sortIds(ids: Iterable<string>): string[] {
+  return [...ids].sort((left, right) => left.localeCompare(right));
+}
+
+function formatIds(ids: string[]): string {
+  return ids.length > 0 ? ids.join(", ") : "<none>";
+}
+
+export function resolveWorkflowDefinition(
+  workflowId: string,
+  options: ResolveWorkflowOptions = {},
+): WorkflowResolution {
+  if (options.registry) {
+    const availableIds = sortIds(Object.keys(options.registry));
+    const workflow = options.registry[workflowId];
+    if (!workflow) {
+      throw new Error(
+        `Unknown workflow_id: ${workflowId}. Available injected: ${formatIds(availableIds)}`,
+      );
+    }
+    return {
+      workflow,
+      source: "injected",
+      warnings: [],
+      bundled_ids: [],
+      synced_ids: [],
+      available_ids: availableIds,
+    };
+  }
+
+  const bundled = DEFAULT_WORKFLOWS;
+  const synced = loadSyncedWorkflows(options.syncedDir);
+  const bundledIds = sortIds(Object.keys(bundled));
+  const syncedIds = sortIds(Object.keys(synced));
+  const merged = { ...bundled, ...synced };
+  const availableIds = sortIds(Object.keys(merged));
+  const workflow = merged[workflowId];
+
+  if (!workflow) {
+    throw new Error(
+      `Unknown workflow_id: ${workflowId}. Available bundled: ${formatIds(bundledIds)}. ` +
+        `Available synced: ${formatIds(syncedIds)}. Available all: ${formatIds(availableIds)}`,
+    );
+  }
+
+  const source: WorkflowSource = Object.prototype.hasOwnProperty.call(synced, workflowId)
+    ? "synced"
+    : "bundled";
+  const warnings: WorkflowResolutionWarning[] = [];
+  const fallbackPolicy = options.bundledFallbackPolicy ?? "allow";
+
+  if (source === "bundled" && fallbackPolicy === "block") {
+    throw new Error(
+      `Workflow "${workflowId}" is only available from the bundled registry, ` +
+        "but enforced govern mode requires a synced org workflow. " +
+        `Available synced: ${formatIds(syncedIds)}.`,
+    );
+  }
+
+  if (
+    source === "bundled" &&
+    (options.emitBundledFallbackWarning || fallbackPolicy === "warn")
+  ) {
+    warnings.push({
+      code: "bundled-workflow-fallback",
+      workflow_id: workflowId,
+      bundled_available: true,
+      synced_available: syncedIds.length > 0,
+      message:
+        `Workflow "${workflowId}" was resolved from the bundled registry because ` +
+        "no synced org workflow with that id exists in the local cache.",
+    });
+  }
+
+  return {
+    workflow,
+    source,
+    warnings,
+    bundled_ids: bundledIds,
+    synced_ids: syncedIds,
+    available_ids: availableIds,
+  };
+}

package/scaffold/mcp/src/embeddings.ts

@@ -101,7 +101,7 @@ export function loadEmbeddingIndex(): EmbeddingIndex {
     embeddingsCache = {
       model: null,
       vectors: new Map(),
-      warning: "Embedding index missing (run: ./scripts/context.sh embed)"
+      warning: "Embedding index missing (run: cortex embed)"
     };
     return embeddingsCache;
   }

package/scaffold/mcp/src/enterprise/index.ts

@@ -17,7 +17,8 @@ import { registerEnterpriseTools } from "./tools/enterprise.js";
 import { registerHarnessTools } from "./tools/harness.js";
 import { pushViolations, setViolationPushContext } from "./violations/push.js";
 import { pushReviewResults, setReviewPushContext } from "./reviews/push.js";
-import { setWorkflowPushContext } from "./workflow/push.js";
+import { pushWorkflowSnapshot, setWorkflowPushContext } from "./workflow/push.js";
+import { hasWorkflowState, loadWorkflowState } from "./workflow/state.js";
 
 const require = createRequire(import.meta.url);
 const pkg = require("../package.json") as { version: string };
@@ -32,6 +33,7 @@ let activeAuditWriter: AuditWriter | null = null;
 let activeInstanceId: string | null = null;
 let activeSessionId: string | null = null;
 let activeRepo: string | null = null;
+let activeContextDir: string | null = null;
 
 async function flushComplianceQueues(
   config: EnterpriseConfig,
@@ -64,6 +66,15 @@ async function flushComplianceQueues(
     if (!result.success) {
       process.stderr.write(`[cortex-enterprise] ${reason} reviews push failed: ${result.error}\n`);
     }
+    if (result.attempted && activeContextDir && hasWorkflowState(activeContextDir)) {
+      const workflowState = loadWorkflowState(activeContextDir);
+      const workflowResult = await pushWorkflowSnapshot(baseUrl, apiKey, workflowState);
+      if (!workflowResult.success) {
+        process.stderr.write(
+          `[cortex-enterprise] ${reason} workflow snapshot refresh after review push failed: ${workflowResult.error}\n`,
+        );
+      }
+    }
   } catch (err) {
     process.stderr.write(`[cortex-enterprise] ${reason} reviews push error: ${err}\n`);
   }
@@ -113,6 +124,7 @@ export function shutdown(): void {
   activeInstanceId = null;
   activeSessionId = null;
   activeRepo = null;
+  activeContextDir = null;
   setAuditPushContext({});
   setViolationPushContext({});
   setReviewPushContext({});
@@ -248,6 +260,7 @@ export async function onSessionEvent(event: SessionEvent): Promise<void> {
 export async function register(server: McpServer): Promise<void> {
   const projectRoot = process.env.CORTEX_PROJECT_ROOT?.trim() || process.cwd();
   const contextDir = path.join(projectRoot, ".context");
+  activeContextDir = contextDir;
 
   const config = loadEnterpriseConfig(contextDir);
   const activation = resolveEnterpriseActivation(config);
@@ -295,6 +308,8 @@ export async function register(server: McpServer): Promise<void> {
     repo: activeRepo ?? undefined,
     instance_id: activeInstanceId ?? undefined,
     session_id: activeSessionId ?? undefined,
+    context_dir: contextDir,
+    project_root: projectRoot,
   });
   setWorkflowPushContext({
     repo: activeRepo ?? undefined,

package/scaffold/mcp/src/enterprise/reviews/policy-selection.ts

@@ -0,0 +1,65 @@
+import type { OrgPolicy } from "../../core/policy/store.js";
+import {
+  getGenericEvaluator,
+  getValidator,
+  type EnforcedPolicy,
+} from "../../core/validators/engine.js";
+import type { ReviewSkippedPolicy } from "./trust-state.js";
+
+export const DEFERRED_CODE_REVIEW_REASON =
+  "Current context.review invocation is the review being recorded; validate this policy from workflow state on the next run.";
+
+export type PartitionedReviewPolicies = {
+  enforced: EnforcedPolicy[];
+  skipped: ReviewSkippedPolicy[];
+};
+
+export function partitionReviewPolicies(
+  policies: OrgPolicy[],
+): PartitionedReviewPolicies {
+  const enforced: EnforcedPolicy[] = [];
+  const skipped: ReviewSkippedPolicy[] = [];
+
+  for (const policy of policies) {
+    if (!policy.enforce) continue;
+
+    if (policy.id === "require-code-review") {
+      skipped.push({
+        policy_id: policy.id,
+        kind: policy.kind ?? null,
+        type: policy.type ?? null,
+        reason: DEFERRED_CODE_REVIEW_REASON,
+      });
+      continue;
+    }
+
+    if (policy.type) {
+      if (!getGenericEvaluator(policy.type)) {
+        skipped.push({
+          policy_id: policy.id,
+          kind: policy.kind ?? null,
+          type: policy.type,
+          reason: `No evaluator registered for type "${policy.type}"`,
+        });
+        continue;
+      }
+    } else if (!getValidator(policy.id)) {
+      skipped.push({
+        policy_id: policy.id,
+        kind: policy.kind ?? null,
+        type: null,
+        reason: "No executable validator registered for this policy",
+      });
+      continue;
+    }
+
+    enforced.push({
+      id: policy.id,
+      type: policy.type ?? null,
+      config: policy.config ?? null,
+      severity: policy.severity ?? "block",
+    });
+  }
+
+  return { enforced, skipped };
+}

package/scaffold/mcp/src/enterprise/reviews/push.ts

@@ -1,3 +1,5 @@
+import { recordReviewDeliveryStatus } from "./trust-state.js";
+
 export type ReviewPushItem = {
   policy_id: string;
   pass: boolean;
@@ -11,12 +13,16 @@ export type ReviewPushContext = {
   repo?: string;
   instance_id?: string;
   session_id?: string;
+  context_dir?: string;
+  project_root?: string;
 };
 
 export type ReviewPushResult = {
   success: boolean;
   count: number;
   error?: string;
+  attempted?: boolean;
+  delivery_status?: "accepted" | "failed";
 };
 
 const pending: ReviewPushItem[] = [];
@@ -26,6 +32,10 @@ export function setReviewPushContext(context: ReviewPushContext): void {
   activeContext = { ...context };
 }
 
+export function getReviewPushContext(): ReviewPushContext {
+  return { ...activeContext };
+}
+
 export function queueReviewResult(item: ReviewPushItem): void {
   pending.push(item);
 }
@@ -39,11 +49,18 @@ export async function pushReviewResults(
   apiKey: string,
 ): Promise<ReviewPushResult> {
   if (pending.length === 0) {
-    return { success: true, count: 0 };
+    return { success: true, count: 0, attempted: false };
   }
 
   const reviewsUrl = `${baseUrl.replace(/\/$/, "")}/api/v1/reviews/push`;
   const batch = pending.splice(0, 100);
+  const attemptedAt = new Date().toISOString();
+  if (activeContext.context_dir) {
+    recordReviewDeliveryStatus(activeContext.context_dir, "pushed", {
+      reviewCount: batch.length,
+      attemptedAt,
+    });
+  }
 
   try {
     const response = await fetch(reviewsUrl, {
@@ -64,16 +81,50 @@ export async function pushReviewResults(
 
     if (!response.ok) {
       pending.unshift(...batch);
-      return { success: false, count: 0, error: `HTTP ${response.status}` };
+      if (activeContext.context_dir) {
+        recordReviewDeliveryStatus(activeContext.context_dir, "failed", {
+          reviewCount: batch.length,
+          attemptedAt,
+          error: `HTTP ${response.status}`,
+        });
+      }
+      return {
+        success: false,
+        count: 0,
+        error: `HTTP ${response.status}`,
+        attempted: true,
+        delivery_status: "failed",
+      };
     }
 
-    return { success: true, count: batch.length };
+    if (activeContext.context_dir) {
+      recordReviewDeliveryStatus(activeContext.context_dir, "accepted", {
+        reviewCount: batch.length,
+        attemptedAt,
+      });
+    }
+    return {
+      success: true,
+      count: batch.length,
+      attempted: true,
+      delivery_status: "accepted",
+    };
   } catch (err) {
     pending.unshift(...batch);
+    const error = err instanceof Error ? err.message : "unknown error";
+    if (activeContext.context_dir) {
+      recordReviewDeliveryStatus(activeContext.context_dir, "failed", {
+        reviewCount: batch.length,
+        attemptedAt,
+        error,
+      });
+    }
     return {
       success: false,
       count: 0,
-      error: err instanceof Error ? err.message : "unknown error",
+      error,
+      attempted: true,
+      delivery_status: "failed",
     };
   }
 }