@danielblomma/cortex-mcp 2.0.16 → 2.0.19

package/scaffold/mcp/tests/enterprise-review-trust.test.mjs

@@ -0,0 +1,318 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+import {
+  loadReviewTrustState,
+  recordQueuedReviewTrustState,
+} from "../dist/enterprise/reviews/trust-state.js";
+import {
+  pendingCount,
+  pushReviewResults,
+  queueReviewResult,
+  setReviewPushContext,
+} from "../dist/enterprise/reviews/push.js";
+
+function makeProject() {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "cortex-review-trust-"));
+  const contextDir = path.join(root, ".context");
+  fs.mkdirSync(contextDir, { recursive: true });
+  return { root, contextDir };
+}
+
+function writeTaskState(root, taskId, workflowId = "secure-build") {
+  const taskDir = path.join(root, ".agents", taskId);
+  fs.mkdirSync(taskDir, { recursive: true });
+  fs.writeFileSync(
+    path.join(taskDir, "state.json"),
+    JSON.stringify(
+      {
+        workflow_id: workflowId,
+        outcome: "in_progress",
+      },
+      null,
+      2,
+    ),
+    "utf8",
+  );
+}
+
+function queueOneReview(reviewedAt = "2026-05-17T10:00:00.000Z") {
+  queueReviewResult({
+    policy_id: "no-secrets-in-code",
+    pass: true,
+    severity: "info",
+    message: "No new secrets found",
+    reviewed_at: reviewedAt,
+  });
+}
+
+test.afterEach(async () => {
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = async () => ({ ok: true, status: 200 });
+  try {
+    while (pendingCount() > 0) {
+      await pushReviewResults("https://example.com", "ent_test");
+    }
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});
+
+test("review trust state persists queued review evidence", () => {
+  const { root, contextDir } = makeProject();
+  const state = recordQueuedReviewTrustState(
+    {
+      contextDir,
+      projectRoot: root,
+      repo: "demo-repo",
+      instance_id: "abc123",
+      session_id: "session-1",
+    },
+    {
+      reviewedAt: "2026-05-17T10:00:00.000Z",
+      summary: {
+        total: 2,
+        passed: 1,
+        failed: 1,
+        warnings: 0,
+        skipped: 1,
+      },
+      skippedPolicies: [
+        {
+          policy_id: "require-code-review",
+          kind: "predefined",
+          type: null,
+          reason: "validate this policy from workflow state on the next run.",
+        },
+      ],
+    },
+  );
+
+  assert.equal(state.delivery.status, "queued");
+  assert.equal(state.review_summary.total, 2);
+  assert.equal(state.skipped_policies.length, 1);
+  assert.ok(fs.existsSync(path.join(contextDir, "review-trust.json")));
+  assert.match(
+    state.trust_warnings.map((warning) => warning.code).join(","),
+    /workflow-unresolved/,
+  );
+});
+
+test("review trust state writes workflow state even when no workflow file exists yet", () => {
+  const { contextDir } = makeProject();
+  const state = loadReviewTrustState(contextDir);
+
+  assert.equal(state.delivery.status, "never_attempted");
+  assert.ok(fs.existsSync(path.join(contextDir, "workflow", "state.json")));
+});
+
+test("review trust uses the explicit active task instead of guessing from the newest agent run", () => {
+  const { root, contextDir } = makeProject();
+  const fakeHome = fs.mkdtempSync(path.join(os.tmpdir(), "cortex-review-home-"));
+  process.env.HOME = fakeHome;
+  try {
+    writeTaskState(root, "task-a");
+    writeTaskState(root, "task-b", "shadow-workflow");
+    const state = recordQueuedReviewTrustState(
+      {
+        contextDir,
+        projectRoot: root,
+        repo: "demo-repo",
+        instance_id: "abc123",
+        session_id: "session-1",
+        task_id: "task-a",
+      },
+      {
+        reviewedAt: "2026-05-17T10:00:00.000Z",
+        summary: {
+          total: 1,
+          passed: 1,
+          failed: 0,
+          warnings: 0,
+          skipped: 0,
+        },
+        skippedPolicies: [],
+      },
+    );
+
+    assert.equal(state.workflow.task_id, "task-a");
+    assert.equal(state.workflow.id, "secure-build");
+  } finally {
+    delete process.env.HOME;
+  }
+});
+
+test("review push marks delivery accepted on successful ingestion", async () => {
+  const { contextDir } = makeProject();
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = async () => ({ ok: true, status: 200 });
+
+  setReviewPushContext({
+    repo: "demo-repo",
+    instance_id: "abc123",
+    session_id: "session-accepted",
+    context_dir: contextDir,
+  });
+  queueOneReview();
+
+  try {
+    const result = await pushReviewResults("https://example.com", "ent_test");
+    assert.equal(result.success, true);
+    assert.equal(result.delivery_status, "accepted");
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+
+  const state = loadReviewTrustState(contextDir);
+  assert.equal(state.delivery.status, "accepted");
+});
+
+test("review push marks delivery failed on HTTP errors", async () => {
+  const { contextDir } = makeProject();
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = async () => ({ ok: false, status: 502 });
+
+  setReviewPushContext({
+    repo: "demo-repo",
+    instance_id: "abc123",
+    session_id: "session-http-fail",
+    context_dir: contextDir,
+  });
+  queueOneReview();
+
+  try {
+    const result = await pushReviewResults("https://example.com", "ent_test");
+    assert.equal(result.success, false);
+    assert.equal(result.delivery_status, "failed");
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+
+  const state = loadReviewTrustState(contextDir);
+  assert.equal(state.delivery.status, "failed");
+  assert.equal(state.delivery.last_error, "HTTP 502");
+});
+
+test("review push marks delivery failed on network errors", async () => {
+  const { contextDir } = makeProject();
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = async () => {
+    throw new Error("network down");
+  };
+
+  setReviewPushContext({
+    repo: "demo-repo",
+    instance_id: "abc123",
+    session_id: "session-network-fail",
+    context_dir: contextDir,
+  });
+  queueOneReview();
+
+  try {
+    const result = await pushReviewResults("https://example.com", "ent_test");
+    assert.equal(result.success, false);
+    assert.equal(result.delivery_status, "failed");
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+
+  const state = loadReviewTrustState(contextDir);
+  assert.equal(state.delivery.status, "failed");
+  assert.equal(state.delivery.last_error, "network down");
+});
+
+test("queuing a new review resets prior accepted delivery markers", async () => {
+  const { root, contextDir } = makeProject();
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = async () => ({ ok: true, status: 200 });
+
+  setReviewPushContext({
+    repo: "demo-repo",
+    instance_id: "abc123",
+    session_id: "session-accepted",
+    context_dir: contextDir,
+  });
+  queueOneReview("2026-05-17T10:00:00.000Z");
+
+  try {
+    const result = await pushReviewResults("https://example.com", "ent_test");
+    assert.equal(result.success, true);
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+
+  const accepted = loadReviewTrustState(contextDir);
+  assert.equal(accepted.delivery.status, "accepted");
+  assert.ok(accepted.delivery.last_accepted_at);
+
+  const queued = recordQueuedReviewTrustState(
+    {
+      contextDir,
+      projectRoot: root,
+      repo: "demo-repo",
+      instance_id: "abc123",
+      session_id: "session-next",
+    },
+    {
+      reviewedAt: "2026-05-17T11:00:00.000Z",
+      summary: {
+        total: 1,
+        passed: 1,
+        failed: 0,
+        warnings: 0,
+        skipped: 0,
+      },
+      skippedPolicies: [],
+    },
+  );
+
+  assert.equal(queued.delivery.status, "queued");
+  assert.equal(queued.delivery.last_attempted_at, null);
+  assert.equal(queued.delivery.last_pushed_at, null);
+  assert.equal(queued.delivery.last_accepted_at, null);
+});
+
+test("zero-result reviews stay never_attempted instead of looking queued", () => {
+  const { root, contextDir } = makeProject();
+  const state = recordQueuedReviewTrustState(
+    {
+      contextDir,
+      projectRoot: root,
+      repo: "demo-repo",
+      instance_id: "abc123",
+      session_id: "session-empty",
+    },
+    {
+      reviewedAt: "2026-05-17T11:00:00.000Z",
+      summary: {
+        total: 0,
+        passed: 0,
+        failed: 0,
+        warnings: 0,
+        skipped: 2,
+      },
+      skippedPolicies: [
+        {
+          policy_id: "require-code-review",
+          kind: "predefined",
+          type: null,
+          reason: "validate this policy from workflow state on the next run.",
+        },
+        {
+          policy_id: "custom.missing",
+          kind: "custom",
+          type: "regex-custom",
+          reason: 'No evaluator registered for type "regex-custom"',
+        },
+      ],
+    },
+  );
+
+  assert.equal(state.delivery.status, "never_attempted");
+  assert.equal(state.delivery.review_count, 0);
+  assert.equal(state.delivery.queued_at, null);
+  assert.equal(state.delivery.last_attempted_at, null);
+});

package/scaffold/mcp/tests/fixtures/org-skillz-contract.json

@@ -0,0 +1,59 @@
+{
+  "skills": [
+    {
+      "name": "alpha-codex",
+      "description": "Codex-first org skill",
+      "body": "# Alpha Codex\n\nUse for Codex review flows.",
+      "scope": "cli:codex",
+      "enabled": true,
+      "updated_at": "2026-05-19T09:00:00.000Z"
+    },
+    {
+      "name": "claude-playbook",
+      "description": "Claude-only org skill",
+      "body": "# Claude Playbook\n\nUse for Claude-only flows.",
+      "scope": "cli:claude",
+      "enabled": true,
+      "updated_at": "2026-05-19T08:45:00.000Z"
+    },
+    {
+      "name": "global-guard",
+      "description": "Shared org skill",
+      "body": "# Global Guard\n\nApply for both CLIs.",
+      "scope": "global",
+      "enabled": true,
+      "updated_at": "2026-05-19T08:30:00.000Z"
+    }
+  ],
+  "manifest": {
+    "codex": [
+      {
+        "name": "alpha-codex",
+        "scope": "cli:codex",
+        "updated_at": "2026-05-19T09:00:00.000Z"
+      },
+      {
+        "name": "global-guard",
+        "scope": "global",
+        "updated_at": "2026-05-19T08:30:00.000Z"
+      }
+    ],
+    "claude": [
+      {
+        "name": "claude-playbook",
+        "scope": "cli:claude",
+        "updated_at": "2026-05-19T08:45:00.000Z"
+      },
+      {
+        "name": "global-guard",
+        "scope": "global",
+        "updated_at": "2026-05-19T08:30:00.000Z"
+      }
+    ]
+  },
+  "markdown": {
+    "alpha-codex": "---\nname: alpha-codex\ndescription: \"Codex-first org skill\"\n---\n\n# Alpha Codex\n\nUse for Codex review flows.\n",
+    "claude-playbook": "---\nname: claude-playbook\ndescription: \"Claude-only org skill\"\n---\n\n# Claude Playbook\n\nUse for Claude-only flows.\n",
+    "global-guard": "---\nname: global-guard\ndescription: \"Shared org skill\"\n---\n\n# Global Guard\n\nApply for both CLIs.\n"
+  }
+}

package/scaffold/mcp/tests/fixtures/review-trust-contract.json

@@ -0,0 +1,111 @@
+{
+  "accepted": {
+    "review_session": {
+      "sessionId": "session-accepted",
+      "repo": "demo-repo",
+      "instanceId": "abc123",
+      "reviewCount": 3,
+      "lastReviewedAt": "2026-05-19T10:00:00.000Z",
+      "lastReceivedAt": "2026-05-19T10:02:00.000Z"
+    },
+    "workflow_session": {
+      "sessionId": "session-accepted",
+      "repo": "demo-repo",
+      "instanceId": "abc123",
+      "phase": "reviewed",
+      "reviewStatus": "passed",
+      "approvalStatus": "ready",
+      "lastReceivedAt": "2026-05-19T10:02:00.000Z"
+    },
+    "workflow_snapshot": {
+      "sessionId": "session-accepted",
+      "repo": "demo-repo",
+      "instanceId": "abc123",
+      "phase": "reviewed",
+      "reviewStatus": "passed",
+      "approvalStatus": "ready",
+      "receivedAt": "2026-05-19T10:02:00.000Z",
+      "snapshot": {
+        "review_trust": {
+          "workflow": {
+            "id": "secure-build",
+            "source": "synced"
+          },
+          "last_review_at": "2026-05-19T10:00:00.000Z",
+          "skipped_policies": [
+            {
+              "policy_id": "require-code-review",
+              "kind": "predefined",
+              "type": null,
+              "reason": "validate this policy from workflow state on the next run."
+            }
+          ],
+          "delivery": {
+            "status": "accepted",
+            "review_count": 3,
+            "last_accepted_at": "2026-05-19T10:02:00.000Z",
+            "last_attempted_at": "2026-05-19T10:02:00.000Z",
+            "last_error": null
+          }
+        }
+      }
+    },
+    "expected": {
+      "trustHealth": "healthy",
+      "workflowSource": "synced",
+      "reviewCount": 3,
+      "skippedPolicyIds": [
+        "require-code-review"
+      ]
+    }
+  },
+  "failed": {
+    "review_session": null,
+    "workflow_session": {
+      "sessionId": "session-failed",
+      "repo": "demo-repo",
+      "instanceId": "abc123",
+      "phase": "reviewed",
+      "reviewStatus": "passed",
+      "approvalStatus": "ready",
+      "lastReceivedAt": "2026-05-19T11:02:00.000Z"
+    },
+    "workflow_snapshot": {
+      "sessionId": "session-failed",
+      "repo": "demo-repo",
+      "instanceId": "abc123",
+      "phase": "reviewed",
+      "reviewStatus": "passed",
+      "approvalStatus": "ready",
+      "receivedAt": "2026-05-19T11:02:00.000Z",
+      "snapshot": {
+        "review_trust": {
+          "workflow": {
+            "id": "secure-build",
+            "source": "synced"
+          },
+          "last_review_at": "2026-05-19T11:00:00.000Z",
+          "skipped_policies": [],
+          "delivery": {
+            "status": "failed",
+            "review_count": 2,
+            "last_accepted_at": null,
+            "last_attempted_at": "2026-05-19T11:02:00.000Z",
+            "last_error": "HTTP 502"
+          }
+        }
+      }
+    },
+    "expected": {
+      "trustHealth": "failed_delivery",
+      "workflowSource": "synced",
+      "reviewCount": 2,
+      "lastPushFailure": {
+        "at": "2026-05-19T11:02:00.000Z",
+        "error": "HTTP 502",
+        "sessionId": "session-failed",
+        "repo": "demo-repo"
+      }
+    }
+  }
+}

package/scaffold/mcp/tests/review-policy-selection.test.mjs

@@ -0,0 +1,85 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { partitionReviewPolicies } from "../dist/enterprise/reviews/policy-selection.js";
+import { DEFERRED_CODE_REVIEW_REASON } from "../dist/enterprise/reviews/policy-selection.js";
+import "../dist/core/validators/builtins.js";
+
+test("partitionReviewPolicies: defers require-code-review with explicit evidence", () => {
+  const result = partitionReviewPolicies([
+    {
+      id: "require-code-review",
+      description: "Code review is required",
+      priority: 10,
+      scope: "global",
+      enforce: true,
+      source: "org",
+      kind: "predefined",
+      type: null,
+      config: null,
+      severity: "block",
+      status: "active",
+      title: "Require code review",
+    },
+  ]);
+
+  assert.deepEqual(result.enforced, []);
+  assert.deepEqual(result.skipped, [
+    {
+      policy_id: "require-code-review",
+      kind: "predefined",
+      type: null,
+      reason: DEFERRED_CODE_REVIEW_REASON,
+    },
+  ]);
+});
+
+test("partitionReviewPolicies: keeps executable validators enforced and skips missing evaluators", () => {
+  const result = partitionReviewPolicies([
+    {
+      id: "no-secrets-in-code",
+      description: "Block secrets",
+      priority: 10,
+      scope: "global",
+      enforce: true,
+      source: "org",
+      kind: "predefined",
+      type: null,
+      config: null,
+      severity: "block",
+      status: "active",
+      title: "No secrets",
+    },
+    {
+      id: "custom.missing",
+      description: "Missing evaluator",
+      priority: 20,
+      scope: "global",
+      enforce: true,
+      source: "org",
+      kind: "custom",
+      type: "regex-custom",
+      config: { pattern: "secret" },
+      severity: "warning",
+      status: "active",
+      title: "Missing custom evaluator",
+    },
+  ]);
+
+  assert.deepEqual(result.enforced, [
+    {
+      id: "no-secrets-in-code",
+      type: null,
+      config: null,
+      severity: "block",
+    },
+  ]);
+  assert.deepEqual(result.skipped, [
+    {
+      policy_id: "custom.missing",
+      kind: "custom",
+      type: "regex-custom",
+      reason: 'No evaluator registered for type "regex-custom"',
+    },
+  ]);
+});