@danielblomma/cortex-mcp 2.2.4 → 2.4.0

package/scaffold/mcp/src/enterprise/reviews/pattern-context.ts

@@ -0,0 +1,231 @@
+import { loadContextData } from "../../graph.js";
+import { normalizeRepoPath, runLocalPatternEvidence } from "../../patternEvidence.js";
+import { compareText } from "../../searchResults.js";
+import type { ContextData, PatternEvidenceParams, ToolPayload } from "../../types.js";
+
+type PatternEvidenceRunner = (input: PatternEvidenceParams) => Promise<ToolPayload>;
+
+// Loads context data lazily on first use and shares it across all targets in
+// one review, instead of re-reading the index from disk per target. Load
+// failures surface per target, matching the per-file error handling below.
+export function createLocalPatternRunner(
+  loadData: () => Promise<ContextData> = loadContextData,
+): PatternEvidenceRunner {
+  let shared: Promise<ContextData> | undefined;
+  return async (params) => {
+    shared ??= loadData();
+    return runLocalPatternEvidence(params, { data: await shared });
+  };
+}
+
+export const PATTERN_REVIEW_QUESTION =
+  "Does this change follow the established pattern for this kind of problem in this repository, or does it introduce a second way to solve something that already has a local convention?";
+
+const PATTERN_EVIDENCE_ORDER = ["same_file", "same_module", "same_feature_area", "repo_wide"] as const;
+
+// Canonicalizes like the pattern evidence engine, then rejects paths that
+// must never appear in review citations (absolute, drive-letter, or
+// parent-escaping paths).
+function normalizeReviewPath(value: string): string | null {
+  const normalized = normalizeRepoPath(value);
+  if (
+    !normalized ||
+    normalized.startsWith("/") ||
+    /^[A-Za-z]:\//.test(normalized) ||
+    normalized.split("/").includes("..")
+  ) {
+    return null;
+  }
+  return normalized;
+}
+
+function safeIdentifier(value: unknown): string | null {
+  if (typeof value !== "string" || value.length === 0 || value.length > 1000) return null;
+  if (/(?:^|:)\/|[A-Za-z]:[\\/]|(?:^|[:/])\.\.(?:[:/]|$)/u.test(value)) return null;
+  return value;
+}
+
+function emptyTiers(): ToolPayload[] {
+  return PATTERN_EVIDENCE_ORDER.map((name) => ({ name, evidence: [] }));
+}
+
+function sanitizeEvidenceTiers(value: unknown): { tiers: ToolPayload[]; dropped: number } {
+  const inputTiers = Array.isArray(value) ? value : [];
+  let dropped = 0;
+  const tiers = PATTERN_EVIDENCE_ORDER.map((name) => {
+    const source = inputTiers.find((candidate) =>
+      candidate && typeof candidate === "object" && (candidate as Record<string, unknown>).name === name
+    ) as Record<string, unknown> | undefined;
+    const rawEvidence = Array.isArray(source?.evidence) ? source.evidence : [];
+    const evidence: ToolPayload[] = [];
+    for (const candidate of rawEvidence) {
+      if (!candidate || typeof candidate !== "object") {
+        dropped += 1;
+        continue;
+      }
+      const row = candidate as Record<string, unknown>;
+      const citationPath = typeof row.path === "string" ? normalizeReviewPath(row.path) : null;
+      const id = safeIdentifier(row.id);
+      if (!citationPath || !id) {
+        dropped += 1;
+        continue;
+      }
+      evidence.push({
+        id,
+        entity_type: typeof row.entity_type === "string" ? row.entity_type.slice(0, 100) : "",
+        kind: typeof row.kind === "string" ? row.kind.slice(0, 100) : "",
+        title: typeof row.title === "string" ? row.title.slice(0, 500) : id,
+        path: citationPath,
+        start_line: Number.isInteger(row.start_line) ? row.start_line : null,
+        end_line: Number.isInteger(row.end_line) ? row.end_line : null,
+        excerpt: typeof row.excerpt === "string" ? row.excerpt.slice(0, 1000) : "",
+        score: typeof row.score === "number" && Number.isFinite(row.score) ? row.score : null,
+        matched_rules: Array.isArray(row.matched_rules)
+          ? row.matched_rules.filter((item): item is string => typeof item === "string").slice(0, 50)
+          : [],
+      });
+    }
+    return { name, evidence };
+  });
+  return { tiers, dropped };
+}
+
+function emptyTarget(file: string, status: "not_indexed" | "error", query?: string): ToolPayload {
+  return {
+    path: file,
+    status,
+    review_question: PATTERN_REVIEW_QUESTION,
+    query: query ?? null,
+    query_source: query ? "explicit" : null,
+    local_pattern_found: false,
+    fallback_used: false,
+    evidence_order: [...PATTERN_EVIDENCE_ORDER],
+    tiers: emptyTiers(),
+    warning: null,
+    message: status === "not_indexed"
+      ? "Target is not present as a file-backed entity in the current Cortex index. Run cortex update before reviewing it."
+      : "Pattern evidence could not be produced for this target.",
+    citations_dropped: 0,
+  };
+}
+
+function disabledPatternReview(requested: number, limit: number, topK: number): ToolPayload {
+  return {
+    enabled: false,
+    non_blocking: true,
+    affects_policy_summary: false,
+    review_question: PATTERN_REVIEW_QUESTION,
+    limit,
+    top_k_per_tier: topK,
+    targets: [],
+    summary: {
+      requested,
+      eligible: 0,
+      analyzed: 0,
+      local_evidence: 0,
+      repo_fallback: 0,
+      no_evidence: 0,
+      not_indexed: 0,
+      errors: 0,
+      omitted: 0,
+      invalid_paths: 0,
+    },
+  };
+}
+
+export async function buildPatternReviewContext(input: {
+  files: string[];
+  enabled: boolean;
+  query?: string;
+  topK: number;
+  limit: number;
+  runner?: PatternEvidenceRunner;
+}): Promise<ToolPayload> {
+  if (!input.enabled) {
+    return disabledPatternReview(input.files.length, input.limit, input.topK);
+  }
+
+  const normalized = input.files.map(normalizeReviewPath);
+  const invalidPaths = normalized.filter((value) => value === null).length;
+  const eligible = [...new Set(normalized.filter((value): value is string => value !== null))]
+    .sort(compareText);
+  const selected = eligible.slice(0, input.limit);
+  const runner = input.runner ?? createLocalPatternRunner();
+  const targets: ToolPayload[] = [];
+  const counts = {
+    local_evidence: 0,
+    repo_fallback: 0,
+    no_evidence: 0,
+    not_indexed: 0,
+    errors: 0,
+  };
+
+  for (const file of selected) {
+    try {
+      const evidence = await runner({
+        target: file,
+        query: input.query,
+        top_k: input.topK,
+        include_deprecated: false,
+      });
+      const sanitized = sanitizeEvidenceTiers(evidence.tiers);
+      const localPatternFound = sanitized.tiers.slice(0, 3).some((tier) =>
+        Array.isArray(tier.evidence) && tier.evidence.length > 0
+      );
+      const repoEvidence = sanitized.tiers[3].evidence;
+      const fallbackUsed = !localPatternFound && Array.isArray(repoEvidence) && repoEvidence.length > 0;
+      const status = localPatternFound
+        ? "local_evidence"
+        : fallbackUsed
+          ? "repo_fallback"
+          : "no_evidence";
+      counts[status] += 1;
+      const warning = status === "local_evidence"
+        ? typeof evidence.warning === "string" ? "Pattern evidence completed with local runtime warnings." : null
+        : status === "repo_fallback"
+          ? "No applicable local pattern evidence was found; repository-wide fallback evidence is provided."
+          : "No applicable local pattern evidence was found.";
+      targets.push({
+        path: file,
+        status,
+        review_question: PATTERN_REVIEW_QUESTION,
+        query: typeof evidence.query === "string" ? evidence.query.slice(0, 1000) : input.query ?? null,
+        query_source: evidence.query_source === "explicit" || evidence.query_source === "derived_from_target"
+          ? evidence.query_source
+          : input.query ? "explicit" : null,
+        local_pattern_found: localPatternFound,
+        fallback_used: fallbackUsed,
+        evidence_order: [...PATTERN_EVIDENCE_ORDER],
+        tiers: sanitized.tiers,
+        warning,
+        message: null,
+        citations_dropped: sanitized.dropped,
+      });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      const notIndexed = /not found in indexed context|not file-backed/u.test(message);
+      const status = notIndexed ? "not_indexed" : "error";
+      counts[notIndexed ? "not_indexed" : "errors"] += 1;
+      targets.push(emptyTarget(file, status, input.query));
+    }
+  }
+
+  return {
+    enabled: true,
+    non_blocking: true,
+    affects_policy_summary: false,
+    review_question: PATTERN_REVIEW_QUESTION,
+    query: input.query ?? null,
+    limit: input.limit,
+    top_k_per_tier: input.topK,
+    targets,
+    summary: {
+      requested: input.files.length,
+      eligible: eligible.length,
+      analyzed: selected.length,
+      ...counts,
+      omitted: Math.max(0, eligible.length - selected.length),
+      invalid_paths: invalidPaths,
+    },
+  };
+}

package/scaffold/mcp/src/enterprise/tools/enterprise.ts

@@ -4,6 +4,7 @@ import { readFileSync, statSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { z } from "zod";
 import { walkProjectFiles } from "./walk.js";
+import { resolveChangedReviewFiles } from "../reviews/changed-files.js";
 import type { EnterpriseConfig } from "../../core/config.js";
 import type { TelemetryCollector } from "../../core/telemetry/collector.js";
 import type { AuditWriter } from "../../core/audit/writer.js";
@@ -16,6 +17,7 @@ import { queueViolation } from "../violations/push.js";
 import { getReviewPushContext, queueReviewResult } from "../reviews/push.js";
 import { partitionReviewPolicies } from "../reviews/policy-selection.js";
 import { recordQueuedReviewTrustState } from "../reviews/trust-state.js";
+import { buildPatternReviewContext } from "../reviews/pattern-context.js";
 import { pushWorkflowSnapshot } from "../workflow/push.js";
 import { OUTBOUND_DATA_BOUNDARY } from "../privacy/boundary.js";
 import {
@@ -41,6 +43,25 @@ type ToolPayload = Record<string, unknown>;
 
 const VALID_ROLES = new Set<Role>(["admin", "developer", "readonly"]);
 
+export function buildContextReviewAuditInput(input: {
+  scope: "all" | "changed";
+  include_passed: boolean;
+  include_pattern_evidence: boolean;
+  pattern_query?: string;
+  pattern_top_k: number;
+  pattern_limit: number;
+}): Record<string, unknown> {
+  return {
+    scope: input.scope,
+    include_passed: input.include_passed,
+    include_pattern_evidence: input.include_pattern_evidence,
+    pattern_query_present: Boolean(input.pattern_query),
+    pattern_query_length: input.pattern_query?.length ?? 0,
+    pattern_top_k: input.pattern_top_k,
+    pattern_limit: input.pattern_limit,
+  };
+}
+
 function snapshotReviewedFiles(
   projectRoot: string,
   changedFiles: string[] | undefined,
@@ -828,12 +849,20 @@ export function registerEnterpriseTools(
       description:
         "Run enterprise policy validators against the current project. " +
         "Checks enforced policies (test coverage, file size, external API calls, code review) " +
-        "and returns pass/fail results with actionable details.",
+        "and returns pass/fail results plus non-blocking repo-local pattern evidence.",
       inputSchema: z.object({
         scope: z.enum(["all", "changed"]).default("changed")
           .describe("'changed' validates only git-modified files; 'all' validates everything"),
         include_passed: z.boolean().default(true)
           .describe("Include passing validators in results"),
+        include_pattern_evidence: z.boolean().default(true)
+          .describe("Include bounded, local-only repo pattern context without changing pass/fail"),
+        pattern_query: z.string().trim().min(1).max(1000).optional()
+          .describe("Optional shared pattern query; omitted queries are derived per target"),
+        pattern_top_k: z.number().int().min(1).max(5).default(2)
+          .describe("Maximum evidence items returned per locality tier and target"),
+        pattern_limit: z.number().int().min(1).max(25).default(10)
+          .describe("Maximum review targets analyzed for pattern evidence"),
       }),
     },
     async (input) => {
@@ -844,6 +873,10 @@ export function registerEnterpriseTools(
       const parsed = z.object({
         scope: z.enum(["all", "changed"]).default("changed"),
         include_passed: z.boolean().default(true),
+        include_pattern_evidence: z.boolean().default(true),
+        pattern_query: z.string().trim().min(1).max(1000).optional(),
+        pattern_top_k: z.number().int().min(1).max(5).default(2),
+        pattern_limit: z.number().int().min(1).max(25).default(10),
       }).parse(input ?? {});
 
       const projectRoot = process.env.CORTEX_PROJECT_ROOT?.trim() || process.cwd();
@@ -859,40 +892,7 @@ export function registerEnterpriseTools(
       //   project review; no git dependency.
       let changedFiles: string[] | undefined;
       if (parsed.scope === "changed") {
-        // Use `git rev-parse --is-inside-work-tree` to distinguish
-        // "valid repo, nothing changed" (→ empty list, reviewer sees
-        // nothing to scan) from "not a repo / git broken" (→ walk the
-        // project so scope=changed still returns meaningful results
-        // when run outside a git checkout).
-        let inGitRepo = false;
-        try {
-          const { execSync } = await import("node:child_process");
-          execSync("git rev-parse --is-inside-work-tree", {
-            cwd: projectRoot,
-            encoding: "utf8",
-            timeout: 3000,
-            stdio: ["ignore", "pipe", "ignore"],
-          });
-          inGitRepo = true;
-        } catch {
-          inGitRepo = false;
-        }
-
-        if (inGitRepo) {
-          try {
-            const { execSync } = await import("node:child_process");
-            const output = execSync("git diff --name-only HEAD 2>/dev/null || git diff --name-only", {
-              cwd: projectRoot,
-              encoding: "utf8",
-              timeout: 5000,
-            });
-            changedFiles = output.split("\n").map((f) => f.trim()).filter(Boolean);
-          } catch {
-            changedFiles = [];
-          }
-        } else {
-          changedFiles = walkProjectFiles(projectRoot);
-        }
+        changedFiles = resolveChangedReviewFiles(projectRoot) ?? walkProjectFiles(projectRoot);
       } else {
         changedFiles = walkProjectFiles(projectRoot);
       }
@@ -914,6 +914,14 @@ export function registerEnterpriseTools(
         projectRoot,
         changedFiles,
       }, config.validators);
+      const patternReview = await buildPatternReviewContext({
+        files: changedFiles ?? [],
+        enabled: parsed.include_pattern_evidence,
+        query: parsed.pattern_query,
+        topK: parsed.pattern_top_k,
+        limit: parsed.pattern_limit,
+      });
+      const patternSummary = patternReview.summary as Record<string, unknown>;
 
       // Filter out passed if requested
       const results = parsed.include_passed
@@ -944,7 +952,7 @@ export function registerEnterpriseTools(
       recordToolActivity({
         timestamp: now,
         tool: "context.review",
-        input: parsed as Record<string, unknown>,
+        input: buildContextReviewAuditInput(parsed),
         result_count: output.results.length,
         entities_returned: output.results.map((r) => r.policy_id),
         rules_applied: output.results.filter((r) => !r.pass).map((r) => r.policy_id),
@@ -958,6 +966,10 @@ export function registerEnterpriseTools(
           failed: output.summary.failed,
           warnings: output.results.filter((r) => !r.pass && r.severity === "warning").length,
           skipped: skippedPolicies.length,
+          pattern_analyzed: patternSummary.analyzed ?? 0,
+          pattern_local_evidence: patternSummary.local_evidence ?? 0,
+          pattern_repo_fallback: patternSummary.repo_fallback ?? 0,
+          pattern_omitted: patternSummary.omitted ?? 0,
         },
       });
 
@@ -1018,6 +1030,7 @@ export function registerEnterpriseTools(
         workflow_source: trustState.workflow.source,
         delivery: trustState.delivery,
         trust_warnings: trustState.trust_warnings,
+        pattern_review: patternReview,
       });
     },
   );

package/scaffold/mcp/src/paths.ts

@@ -98,12 +98,10 @@ export const PATHS = {
   transformsConfigRelations: path.join(CACHE_DIR, "relations.transforms_config.jsonl")
 };
 
-// Graph degree mostly measures how many rules constrain an entity (docs are
-// hubs, leaf code is not), so it gets low weight. Tuned together with the
-// midrank-percentile graph_score in searchResults.ts.
+// Tuned together with the midrank-percentile graph_score in searchResults.ts.
 export const DEFAULT_RANKING: RankingWeights = {
-  semantic: 0.55,
-  graph: 0.1,
+  semantic: 0.4,
+  graph: 0.25,
   trust: 0.2,
   recency: 0.15
 };