@danielblomma/cortex-mcp 2.2.5 → 2.4.1

package/scaffold/mcp/src/cli/run.ts

@@ -1,7 +1,12 @@
 import { spawn } from "node:child_process";
 import {
   existsSync,
+  closeSync,
+  fchmodSync,
+  lstatSync,
+  openSync,
   readFileSync,
+  renameSync,
   writeFileSync,
   unlinkSync,
   mkdirSync,
@@ -10,6 +15,7 @@ import {
 import { join, dirname } from "node:path";
 import { platform, tmpdir } from "node:os";
 import { randomUUID } from "node:crypto";
+import { getGovernManagedPath } from "../core/govern-paths.js";
 
 export type RunCli = "claude" | "codex" | "copilot";
 export const RUN_CLIS: RunCli[] = ["claude", "codex", "copilot"];
@@ -186,17 +192,8 @@ export async function runAiCli(options: RunOptions): Promise<number> {
   return 1;
 }
 
-const DEFAULT_COPILOT_SHIM_PATHS: Partial<Record<NodeJS.Platform, string>> = {
-  darwin: "/usr/local/bin/copilot",
-  linux: "/usr/local/bin/copilot",
-};
-
 export function getDefaultCopilotShimPath(os: NodeJS.Platform): string {
-  const path = DEFAULT_COPILOT_SHIM_PATHS[os];
-  if (!path) {
-    throw new Error(`copilot shim install not yet supported on ${os}`);
-  }
-  return path;
+  return getGovernManagedPath("copilot", os);
 }
 
 export function buildCopilotShim(realBinary: string): string {
@@ -240,19 +237,56 @@ export function installCopilotShim(options: InstallShimOptions = {}): InstallShi
         "Install GitHub Copilot CLI first, then re-run cortex enterprise sync.",
     };
   }
-  if (existsSync(shimPath) && !isCortexShim(shimPath)) {
-    return {
-      ok: false,
-      message:
-        `${shimPath} exists and is not a cortex shim — refusing to overwrite. ` +
-        "Move/rename the existing file, then re-run.",
-    };
+  try {
+    const existing = lstatSync(shimPath);
+    if (
+      existing.isSymbolicLink() ||
+      !existing.isFile() ||
+      !isCortexShim(shimPath)
+    ) {
+      return {
+        ok: false,
+        message:
+          `${shimPath} exists and is not a regular cortex shim — refusing to overwrite. ` +
+          "Move/rename the existing path, then re-run.",
+      };
+    }
+  } catch (err) {
+    if ((err as NodeJS.ErrnoException).code !== "ENOENT") {
+      return {
+        ok: false,
+        message:
+          `Failed to inspect shim path ${shimPath}: ${err instanceof Error ? err.message : String(err)}`,
+      };
+    }
   }
+  const temporaryPath = `${shimPath}.tmp.${process.pid}.${randomUUID()}`;
+  let fd: number | null = null;
   try {
     mkdirSync(dirname(shimPath), { recursive: true });
-    writeFileSync(shimPath, buildCopilotShim(real));
-    chmodSync(shimPath, 0o755);
+    fd = openSync(temporaryPath, "wx", 0o700);
+    writeFileSync(fd, buildCopilotShim(real));
+    fchmodSync(fd, 0o755);
+    closeSync(fd);
+    fd = null;
+    renameSync(temporaryPath, shimPath);
+    const installed = lstatSync(shimPath);
+    if (!installed.isFile() || installed.isSymbolicLink()) {
+      throw new Error("installed shim is not a regular file");
+    }
   } catch (err) {
+    if (fd !== null) {
+      try {
+        closeSync(fd);
+      } catch {
+        // Best effort.
+      }
+    }
+    try {
+      unlinkSync(temporaryPath);
+    } catch {
+      // Best effort.
+    }
     return {
       ok: false,
       message: `Failed to write shim at ${shimPath}: ${err instanceof Error ? err.message : String(err)}`,

package/scaffold/mcp/src/cli/stage.ts

@@ -35,7 +35,7 @@ import { isEnforcedMode, isEnterpriseProject } from "../hooks/shared.js";
 const ENTERPRISE_REQUIRED_MESSAGE =
   "cortex stage is part of the Cortex Harness — an enterprise-only feature. " +
   "This project does not have an enterprise license configured (no enterprise.api_key " +
-  "in .context/enterprise.yml). Run 'cortex enterprise <api-key>' to enable it, or " +
+  "in .context/enterprise.yml). Run 'cortex enterprise install --api-key-stdin' to enable it, or " +
   "contact your org admin.";
 
 export async function runStageCommand(args: string[]): Promise<void> {
@@ -142,6 +142,7 @@ async function runStart(args: string[]): Promise<void> {
     typeof flags.workflow === "string" ? flags.workflow : "secure-build";
 
   const resolved = resolveWorkflowDefinition(workflowId, {
+    cwd: projectRoot(),
     emitBundledFallbackWarning: true,
     bundledFallbackPolicy: isEnforcedMode(projectRoot()) ? "block" : "warn",
   });
@@ -183,7 +184,9 @@ async function runEnvelope(args: string[]): Promise<void> {
       `No run state for task ${taskId}. Start one with 'cortex stage start'.`,
     );
   }
-  const workflow = resolveWorkflowDefinition(state.workflow_id).workflow;
+  const workflow = resolveWorkflowDefinition(state.workflow_id, {
+    cwd: projectRoot(),
+  }).workflow;
   const envelope = composeStageEnvelope({
     cwd: projectRoot(),
     taskId,
@@ -243,7 +246,9 @@ async function runAdvance(args: string[]): Promise<void> {
       `No run state for task ${taskId}. Start one with 'cortex stage start'.`,
     );
   }
-  const workflow = resolveWorkflowDefinition(state.workflow_id).workflow;
+  const workflow = resolveWorkflowDefinition(state.workflow_id, {
+    cwd: projectRoot(),
+  }).workflow;
   const stage = workflow.stages.find((s) => s.name === stageName);
   if (!stage) {
     throw new Error(

package/scaffold/mcp/src/core/config.ts

@@ -2,6 +2,7 @@ import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import type { Role, RBACConfig } from "./rbac/check.js";
 import { parseValidatorsConfig, type ValidatorsConfig } from "./validators/config.js";
+import { isAllowedEnterpriseEndpoint } from "./secure-endpoint.js";
 
 export type TelemetryConfig = {
   enabled: boolean;
@@ -201,7 +202,10 @@ function isLikelyHttpUrl(value: string): boolean {
 
 export function resolveEnterpriseActivation(config: EnterpriseConfig): EnterpriseActivation {
   const apiKey = config.enterprise.api_key.trim();
-  const endpoint = config.enterprise.endpoint.trim();
+  const endpoint = (
+    config.enterprise.base_url ||
+    config.enterprise.endpoint
+  ).trim();
 
   if (!apiKey) {
     return { active: false, reason: "missing_api_key", api_key: null, endpoint: endpoint || null };
@@ -215,7 +219,10 @@ export function resolveEnterpriseActivation(config: EnterpriseConfig): Enterpris
     return { active: false, reason: "invalid_api_key_format", api_key: apiKey, endpoint };
   }
 
-  if (!isLikelyHttpUrl(endpoint)) {
+  if (
+    !isLikelyHttpUrl(endpoint) ||
+    !isAllowedEnterpriseEndpoint(endpoint)
+  ) {
     return { active: false, reason: "invalid_endpoint_format", api_key: apiKey, endpoint };
   }
 

package/scaffold/mcp/src/core/enterprise-host-identity.ts

@@ -0,0 +1,259 @@
+import {
+  chownSync,
+  chmodSync,
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  readFileSync,
+  realpathSync,
+  renameSync,
+  unlinkSync,
+  writeFileSync,
+} from "node:fs";
+import { createHash, randomUUID } from "node:crypto";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+const HOST_IDENTITY_FILENAME = "enterprise-host-identity.json";
+const HOST_IDENTITY_VERSION = 2;
+
+type EnterpriseHostIdentity = {
+  version: 2;
+  credential_id: string;
+  endpoint_sha256: string;
+};
+
+type HostIdentityOwner = {
+  uid: number;
+  gid: number;
+};
+
+type HostIdentityOptions = {
+  homeDir?: string;
+  owner?: HostIdentityOwner;
+};
+
+export type EnterpriseHostIdentityStatus =
+  | "unbound"
+  | "match"
+  | "rotation"
+  | "conflict"
+  | "invalid";
+
+function configuredHomeDir(homeDir?: string): string {
+  return homeDir ?? process.env.HOME?.trim() ?? homedir();
+}
+
+function hostIdentityDir(
+  options: HostIdentityOptions = {},
+  create = false,
+): string | null {
+  try {
+    const home = realpathSync(configuredHomeDir(options.homeDir));
+    const dir = join(home, ".cortex");
+    if (existsSync(dir)) {
+      const stat = lstatSync(dir);
+      if (!stat.isDirectory() || stat.isSymbolicLink()) return null;
+      if (realpathSync(dir) !== dir) return null;
+      if (options.owner) {
+        if (stat.uid !== options.owner.uid && stat.uid !== 0) return null;
+        chownSync(dir, options.owner.uid, options.owner.gid);
+        chmodSync(dir, 0o700);
+      }
+      return dir;
+    }
+    if (!create) return null;
+    mkdirSync(dir, { mode: 0o700 });
+    if (options.owner) {
+      chownSync(dir, options.owner.uid, options.owner.gid);
+    }
+    chmodSync(dir, 0o700);
+    return dir;
+  } catch {
+    return null;
+  }
+}
+
+function hostIdentityPath(
+  options: HostIdentityOptions = {},
+  createDir = false,
+): string | null {
+  const dir = hostIdentityDir(options, createDir);
+  return dir ? join(dir, HOST_IDENTITY_FILENAME) : null;
+}
+
+function readHostIdentity(
+  options: HostIdentityOptions = {},
+): EnterpriseHostIdentity | null {
+  const path = hostIdentityPath(options);
+  if (!path) return null;
+  if (!existsSync(path)) return null;
+  try {
+    const stat = lstatSync(path);
+    if (!stat.isFile() || stat.isSymbolicLink()) return null;
+    if (
+      options.owner &&
+      stat.uid !== options.owner.uid &&
+      stat.uid !== 0
+    ) {
+      return null;
+    }
+    const parsed = JSON.parse(
+      readFileSync(path, "utf8"),
+    ) as Partial<EnterpriseHostIdentity>;
+    if (
+      parsed.version !== HOST_IDENTITY_VERSION ||
+      typeof parsed.credential_id !== "string" ||
+      !/^[a-f0-9]{64}$/.test(parsed.credential_id) ||
+      typeof parsed.endpoint_sha256 !== "string" ||
+      !/^[a-f0-9]{64}$/.test(parsed.endpoint_sha256)
+    ) {
+      return null;
+    }
+    return parsed as EnterpriseHostIdentity;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Atomically bind user-global Enterprise services and artifacts to one
+ * endpoint/API-key identity. Malformed existing enrollment fails closed.
+ */
+export function claimEnterpriseHostIdentity(
+  credentialId: string,
+  endpoint: string,
+  options: HostIdentityOptions = {},
+): boolean {
+  if (!/^[a-f0-9]{64}$/.test(credentialId)) return false;
+  const endpointSha256 = createHash("sha256")
+    .update(endpoint.trim().replace(/\/+$/, ""), "utf8")
+    .digest("hex");
+  const path = hostIdentityPath(options, true);
+  if (!path) return false;
+  if (existsSync(path)) {
+    const existing = readHostIdentity(options);
+    if (!existing || existing.endpoint_sha256 !== endpointSha256) {
+      return false;
+    }
+    if (existing.credential_id === credentialId) {
+      try {
+        if (options.owner) {
+          chownSync(path, options.owner.uid, options.owner.gid);
+        }
+        chmodSync(path, 0o600);
+        return true;
+      } catch {
+        return false;
+      }
+    }
+    return replaceHostIdentity(path, {
+      version: HOST_IDENTITY_VERSION,
+      credential_id: credentialId,
+      endpoint_sha256: endpointSha256,
+    }, options.owner);
+  }
+
+  try {
+    writeFileSync(
+      path,
+      JSON.stringify(
+        {
+          version: HOST_IDENTITY_VERSION,
+          credential_id: credentialId,
+          endpoint_sha256: endpointSha256,
+        },
+        null,
+        2,
+      ) + "\n",
+      { encoding: "utf8", mode: 0o600, flag: "wx" },
+    );
+    if (options.owner) {
+      chownSync(path, options.owner.uid, options.owner.gid);
+    }
+    chmodSync(path, 0o600);
+    return true;
+  } catch {
+    // Another process may have won the create race. Only the same identity
+    // is accepted after re-reading the completed enrollment record.
+    const existing = readHostIdentity(options);
+    return (
+      existing?.credential_id === credentialId &&
+      existing.endpoint_sha256 === endpointSha256
+    );
+  }
+}
+
+function replaceHostIdentity(
+  path: string,
+  identity: EnterpriseHostIdentity,
+  owner?: HostIdentityOwner,
+): boolean {
+  const temporaryPath = `${path}.${process.pid}.${randomUUID()}.tmp`;
+  try {
+    writeFileSync(
+      temporaryPath,
+      JSON.stringify(identity, null, 2) + "\n",
+      { encoding: "utf8", mode: 0o600, flag: "wx" },
+    );
+    if (owner) {
+      chownSync(temporaryPath, owner.uid, owner.gid);
+    }
+    chmodSync(temporaryPath, 0o600);
+    renameSync(temporaryPath, path);
+    chmodSync(path, 0o600);
+    return true;
+  } catch {
+    try {
+      unlinkSync(temporaryPath);
+    } catch {
+      // Best effort.
+    }
+    return false;
+  }
+}
+
+export function matchesEnterpriseHostIdentity(
+  credentialId: string,
+  options: HostIdentityOptions = {},
+): boolean {
+  if (!/^[a-f0-9]{64}$/.test(credentialId)) return false;
+  return readHostIdentity(options)?.credential_id === credentialId;
+}
+
+export function inspectEnterpriseHostIdentity(
+  credentialId: string,
+  endpoint: string,
+  options: HostIdentityOptions = {},
+): EnterpriseHostIdentityStatus {
+  if (!/^[a-f0-9]{64}$/.test(credentialId)) return "invalid";
+  let home: string;
+  try {
+    home = realpathSync(configuredHomeDir(options.homeDir));
+  } catch {
+    return "invalid";
+  }
+  const dir = join(home, ".cortex");
+  if (!existsSync(dir)) return "unbound";
+  try {
+    const dirStat = lstatSync(dir);
+    if (
+      !dirStat.isDirectory() ||
+      dirStat.isSymbolicLink() ||
+      realpathSync(dir) !== dir
+    ) {
+      return "invalid";
+    }
+  } catch {
+    return "invalid";
+  }
+  const path = join(dir, HOST_IDENTITY_FILENAME);
+  if (!existsSync(path)) return "unbound";
+  const existing = readHostIdentity(options);
+  if (!existing) return "invalid";
+  const endpointSha256 = createHash("sha256")
+    .update(endpoint.trim().replace(/\/+$/, ""), "utf8")
+    .digest("hex");
+  if (existing.endpoint_sha256 !== endpointSha256) return "conflict";
+  return existing.credential_id === credentialId ? "match" : "rotation";
+}

package/scaffold/mcp/src/core/enterprise-identity.ts

@@ -0,0 +1,20 @@
+import { join } from "node:path";
+import { loadEnterpriseConfig } from "./config.js";
+import { enterpriseCredentialId } from "./license.js";
+
+/**
+ * Resolve the opaque per-user Enterprise identity for a project.
+ *
+ * The identifier binds the normalized endpoint and API key without
+ * persisting either credential in shared daemon metadata.
+ */
+export function configuredEnterpriseCredentialId(cwd: string): string | null {
+  const config = loadEnterpriseConfig(join(cwd, ".context"));
+  const apiKey = config.enterprise.api_key.trim();
+  const endpoint = (
+    config.enterprise.base_url ||
+    config.enterprise.endpoint
+  ).trim();
+  if (!apiKey || !endpoint) return null;
+  return enterpriseCredentialId(endpoint, apiKey);
+}

package/scaffold/mcp/src/core/enterprise-rotation.ts

@@ -0,0 +1,185 @@
+import {
+  existsSync,
+  lstatSync,
+  readFileSync,
+  readdirSync,
+  realpathSync,
+  rmdirSync,
+  unlinkSync,
+} from "node:fs";
+import { join, resolve } from "node:path";
+import { homedir } from "node:os";
+
+const SKILL_NAME_RE = /^[a-z0-9](?:[a-z0-9-]{0,78}[a-z0-9])?$/;
+const OWNERSHIP_FILENAME = ".cortex-managed.json";
+const STATE_FILES = [
+  "skills.local.json",
+  "workflows.local.json",
+  "capabilities.local.json",
+  ".skills-update-applied.json",
+] as const;
+
+type SkillCli = "claude" | "codex";
+
+type PurgeTarget = {
+  dir: string;
+  marker: string;
+  skill: string | null;
+};
+
+function configuredHome(homeDir?: string): string {
+  return homeDir ?? process.env.HOME?.trim() ?? homedir();
+}
+
+function safeDirectory(path: string): string | null {
+  if (!existsSync(path)) return null;
+  const stat = lstatSync(path);
+  if (!stat.isDirectory() || stat.isSymbolicLink()) {
+    throw new Error(`${path} is not a safe directory`);
+  }
+  const real = realpathSync(path);
+  if (real !== path) throw new Error(`${path} is not a canonical directory`);
+  return real;
+}
+
+function inspectManagedSkill(
+  root: string,
+  cli: SkillCli,
+  name: string,
+): PurgeTarget | null {
+  if (!SKILL_NAME_RE.test(name)) {
+    throw new Error("invalid managed skill name");
+  }
+  const dir = resolve(root, name);
+  if (!dir.startsWith(`${root}/`)) {
+    throw new Error("managed skill escapes its root");
+  }
+  const stat = lstatSync(dir);
+  if (!stat.isDirectory() || stat.isSymbolicLink()) {
+    throw new Error("managed skill target is not a safe directory");
+  }
+  if (realpathSync(dir) !== dir) {
+    throw new Error("managed skill target is not canonical");
+  }
+  const marker = join(dir, OWNERSHIP_FILENAME);
+  if (!existsSync(marker)) return null;
+  const markerStat = lstatSync(marker);
+  if (!markerStat.isFile() || markerStat.isSymbolicLink()) {
+    throw new Error("managed skill ownership marker is unsafe");
+  }
+  const parsed = JSON.parse(readFileSync(marker, "utf8")) as {
+    version?: unknown;
+    manager?: unknown;
+    cli?: unknown;
+    name?: unknown;
+  };
+  if (
+    parsed.version !== 1 ||
+    parsed.manager !== "cortex" ||
+    parsed.cli !== cli ||
+    parsed.name !== name
+  ) {
+    throw new Error("managed skill ownership marker is invalid");
+  }
+  const entries = readdirSync(dir);
+  const unexpected = entries.filter(
+    (entry) => entry !== OWNERSHIP_FILENAME && entry !== "SKILL.md",
+  );
+  if (unexpected.length > 0) {
+    throw new Error("managed skill directory contains unowned files");
+  }
+  const skill = join(dir, "SKILL.md");
+  if (existsSync(skill)) {
+    const skillStat = lstatSync(skill);
+    if (!skillStat.isFile() || skillStat.isSymbolicLink()) {
+      throw new Error("managed skill file is unsafe");
+    }
+  }
+  return { dir, marker, skill: existsSync(skill) ? skill : null };
+}
+
+function recordedSkills(home: string): Array<{ cli: SkillCli; name: string }> {
+  const statePath = join(home, ".cortex", "skills.local.json");
+  if (!existsSync(statePath)) return [];
+  const stat = lstatSync(statePath);
+  if (!stat.isFile() || stat.isSymbolicLink()) {
+    throw new Error("skills state is unsafe");
+  }
+  const parsed = JSON.parse(readFileSync(statePath, "utf8")) as {
+    skills?: Record<string, { cli?: unknown }>;
+  };
+  if (!parsed.skills || typeof parsed.skills !== "object") return [];
+  const records: Array<{ cli: SkillCli; name: string }> = [];
+  for (const [key, value] of Object.entries(parsed.skills)) {
+    const [keyCli, name] = key.includes(":")
+      ? key.split(":", 2)
+      : [String(value?.cli ?? ""), key];
+    if (
+      (keyCli !== "claude" && keyCli !== "codex") ||
+      !SKILL_NAME_RE.test(name)
+    ) {
+      throw new Error("skills state contains an unsafe record");
+    }
+    records.push({ cli: keyCli, name });
+  }
+  return records;
+}
+
+/**
+ * Purge credential-specific artifacts before an explicit API-key rotation.
+ * Every path is derived from the target user's home and every skill deletion
+ * requires the Cortex ownership marker. Any ambiguity aborts rotation.
+ */
+export function prepareEnterpriseCredentialRotation(homeDir?: string): boolean {
+  try {
+    const home = realpathSync(configuredHome(homeDir));
+    const cortexDir = safeDirectory(join(home, ".cortex"));
+    if (!cortexDir) return true;
+
+    const targets = new Map<string, PurgeTarget>();
+    const recorded = recordedSkills(home);
+    for (const cli of ["claude", "codex"] as const) {
+      const cliDir = safeDirectory(join(home, cli === "codex" ? ".codex" : ".claude"));
+      if (!cliDir) {
+        if (recorded.some((record) => record.cli === cli)) return false;
+        continue;
+      }
+      const root = safeDirectory(join(cliDir, "skills"));
+      if (!root) {
+        if (recorded.some((record) => record.cli === cli)) return false;
+        continue;
+      }
+      for (const name of readdirSync(root)) {
+        const candidate = join(root, name);
+        const stat = lstatSync(candidate);
+        if (!stat.isDirectory() || stat.isSymbolicLink()) continue;
+        const target = inspectManagedSkill(root, cli, name);
+        if (target) targets.set(target.dir, target);
+      }
+      for (const record of recorded.filter((entry) => entry.cli === cli)) {
+        const candidate = join(root, record.name);
+        if (!existsSync(candidate)) continue;
+        const target = inspectManagedSkill(root, cli, record.name);
+        if (!target) {
+          // Legacy state without an ownership marker is not deletion
+          // authority. Abort and require the operator to resolve it.
+          return false;
+        }
+        targets.set(target.dir, target);
+      }
+    }
+
+    for (const target of targets.values()) {
+      if (target.skill) unlinkSync(target.skill);
+      unlinkSync(target.marker);
+      rmdirSync(target.dir);
+    }
+    for (const filename of STATE_FILES) {
+      const path = join(cortexDir, filename);
+      if (existsSync(path)) unlinkSync(path);
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}

package/scaffold/mcp/src/core/govern-paths.ts

@@ -0,0 +1,30 @@
+export type GovernManagedCli = "claude" | "codex" | "copilot";
+
+const MANAGED_PATHS: Record<
+  GovernManagedCli,
+  Partial<Record<NodeJS.Platform, string>>
+> = {
+  claude: {
+    darwin: "/Library/Application Support/ClaudeCode/managed-settings.json",
+    linux: "/etc/claude-code/managed-settings.json",
+  },
+  codex: {
+    darwin: "/Library/Application Support/Codex/requirements.toml",
+    linux: "/etc/codex/requirements.toml",
+  },
+  copilot: {
+    darwin: "/usr/local/bin/copilot",
+    linux: "/usr/local/bin/copilot",
+  },
+};
+
+export function getGovernManagedPath(
+  cli: GovernManagedCli,
+  os: NodeJS.Platform,
+): string {
+  const path = MANAGED_PATHS[cli][os];
+  if (!path) {
+    throw new Error(`govern install for ${cli} not yet supported on ${os}`);
+  }
+  return path;
+}