@danielblomma/cortex-mcp 2.2.5 → 2.4.1

package/scaffold/mcp/src/daemon/skill-sync-checker.ts

@@ -1,13 +1,24 @@
 import {
   existsSync,
+  lstatSync,
   mkdirSync,
   readFileSync,
-  rmSync,
+  readdirSync,
+  realpathSync,
+  renameSync,
+  rmdirSync,
+  unlinkSync,
   writeFileSync,
 } from "node:fs";
+import { randomUUID } from "node:crypto";
 import { homedir, hostname } from "node:os";
-import { join } from "node:path";
+import { isAbsolute, join, relative, resolve, sep } from "node:path";
 import { loadEnterpriseConfig } from "../core/config.js";
+import { matchesEnterpriseHostIdentity } from "../core/enterprise-host-identity.js";
+import {
+  enterpriseCredentialId,
+  isAllowedLicenseEndpoint,
+} from "../core/license.js";
 import { writeHostAuditEvent } from "./ungoverned-scanner.js";
 import { daemonDir } from "./paths.js";
 
@@ -35,10 +46,14 @@ import { daemonDir } from "./paths.js";
 
 const STATE_FILENAME = "skills.local.json";
 const NOTIFICATION_FILENAME = ".skills-update-applied.json";
+const OWNERSHIP_FILENAME = ".cortex-managed.json";
+const OWNERSHIP_VERSION = 1;
 
 const SUPPORTED_CLIS = ["claude", "codex"] as const;
 type SkillCli = (typeof SUPPORTED_CLIS)[number];
 
+const SKILL_NAME_RE = /^[a-z0-9](?:[a-z0-9-]{0,78}[a-z0-9])?$/;
+
 type ManifestEntry = {
   name: string;
   scope: string;
@@ -46,6 +61,7 @@ type ManifestEntry = {
 };
 
 type LocalSkillRecord = {
+  credential_id?: string;
   cli: SkillCli;
   scope: string;
   updated_at: string;
@@ -53,6 +69,7 @@ type LocalSkillRecord = {
 };
 
 type LocalSkillsState = {
+  credential_id?: string;
   skills: Record<string, LocalSkillRecord>;
   last_synced_at?: string;
 };
@@ -102,6 +119,10 @@ function readState(): LocalSkillsState {
           : inferredCli;
       const normalizedKey = key.includes(":") ? key : `${cli}:${key}`;
       normalizedSkills[normalizedKey] = {
+        credential_id:
+          typeof record.credential_id === "string"
+            ? record.credential_id
+            : undefined,
         cli,
         scope: String(record.scope ?? "global"),
         updated_at: String(record.updated_at ?? ""),
@@ -109,6 +130,10 @@ function readState(): LocalSkillsState {
       };
     }
     return {
+      credential_id:
+        typeof parsed.credential_id === "string"
+          ? parsed.credential_id
+          : undefined,
       skills: normalizedSkills,
       last_synced_at: parsed.last_synced_at,
     };
@@ -130,12 +155,65 @@ function writeState(state: LocalSkillsState): void {
  * skills are installed once per CLI, so the destination root depends on the
  * active sync target rather than just the stored scope.
  */
-function skillFilePath(cli: SkillCli, name: string): string {
-  const root =
-    cli === "codex"
-      ? join(homedir(), ".codex", "skills")
-      : join(homedir(), ".claude", "skills");
-  return join(root, name, "SKILL.md");
+function isSafeSkillName(name: unknown): name is string {
+  return typeof name === "string" && SKILL_NAME_RE.test(name);
+}
+
+function assertPathContained(root: string, target: string): void {
+  const rel = relative(root, target);
+  if (
+    rel === ".." ||
+    rel.startsWith(`..${sep}`) ||
+    isAbsolute(rel)
+  ) {
+    throw new Error("skill target escapes managed root");
+  }
+}
+
+function configuredSkillRoot(cli: SkillCli): string {
+  return join(
+    realpathSync(homedir()),
+    cli === "codex" ? ".codex" : ".claude",
+    "skills",
+  );
+}
+
+function assertNotSymlink(path: string, description: string): void {
+  if (existsSync(path) && lstatSync(path).isSymbolicLink()) {
+    throw new Error(`${description} must not be a symbolic link`);
+  }
+}
+
+function resolveSkillRoot(cli: SkillCli, create: boolean): string | null {
+  const root = configuredSkillRoot(cli);
+  const cliRoot = resolve(root, "..");
+  assertNotSymlink(cliRoot, `${cli} configuration directory`);
+  if (!existsSync(cliRoot)) {
+    if (!create) return null;
+    mkdirSync(cliRoot, { mode: 0o700 });
+  }
+  if (!lstatSync(cliRoot).isDirectory()) {
+    throw new Error(`${cli} configuration path is not a directory`);
+  }
+
+  assertNotSymlink(root, `${cli} skills root`);
+  if (!existsSync(root)) {
+    if (!create) return null;
+    mkdirSync(root, { mode: 0o700 });
+  }
+  if (!lstatSync(root).isDirectory()) {
+    throw new Error(`${cli} skills root is not a directory`);
+  }
+  return realpathSync(root);
+}
+
+function skillFilePath(root: string, name: string): string {
+  if (!isSafeSkillName(name)) {
+    throw new Error("invalid skill name");
+  }
+  const target = resolve(root, name, "SKILL.md");
+  assertPathContained(resolve(root), target);
+  return target;
 }
 
 function stateSkillKey(cli: SkillCli, name: string): string {
@@ -151,7 +229,7 @@ async function fetchManifest(
   baseUrl: string,
   apiKey: string,
   cli: SkillCli,
-): Promise<ManifestEntry[]> {
+): Promise<unknown[]> {
   const url = new URL(
     baseUrl.replace(/\/$/, "") + "/api/v1/govern/skills/manifest",
   );
@@ -162,8 +240,12 @@ async function fetchManifest(
   if (!res.ok) {
     throw new Error(`HTTP ${res.status} ${res.statusText}`);
   }
-  const body = (await res.json()) as { skills?: ManifestEntry[] };
-  return body.skills ?? [];
+  const body = (await res.json()) as { skills?: unknown };
+  if (body.skills === undefined) return [];
+  if (!Array.isArray(body.skills)) {
+    throw new Error("invalid skill manifest: skills must be an array");
+  }
+  return body.skills;
 }
 
 async function fetchSkillBody(
@@ -185,19 +267,219 @@ async function fetchSkillBody(
   return res.text();
 }
 
-function writeSkillFile(path: string, content: string): void {
-  const dir = path.replace(/\/SKILL\.md$/, "");
-  mkdirSync(dir, { recursive: true });
-  writeFileSync(path, content, "utf8");
+function validateManifest(
+  manifest: unknown[],
+  cli: SkillCli,
+): ManifestEntry[] {
+  const validated: ManifestEntry[] = [];
+  const names = new Set<string>();
+  for (let index = 0; index < manifest.length; index += 1) {
+    const raw = manifest[index];
+    if (!raw || typeof raw !== "object") {
+      throw new Error(`invalid skill manifest entry at index ${index}`);
+    }
+    const entry = raw as Record<string, unknown>;
+    if (!isSafeSkillName(entry.name)) {
+      throw new Error(`invalid skill name at manifest index ${index}`);
+    }
+    if (
+      entry.scope !== "global" &&
+      entry.scope !== "cli:claude" &&
+      entry.scope !== "cli:codex"
+    ) {
+      throw new Error(`invalid skill scope at manifest index ${index}`);
+    }
+    if (typeof entry.updated_at !== "string" || !entry.updated_at.trim()) {
+      throw new Error(`invalid skill timestamp at manifest index ${index}`);
+    }
+    if (shouldSyncForCli(entry.scope, cli)) {
+      if (names.has(entry.name)) {
+        throw new Error(`duplicate skill name at manifest index ${index}`);
+      }
+      names.add(entry.name);
+    }
+    validated.push({
+      name: entry.name,
+      scope: entry.scope,
+      updated_at: entry.updated_at,
+    });
+  }
+  return validated;
+}
+
+type OwnershipMarker = {
+  version: number;
+  manager: string;
+  cli: SkillCli;
+  name: string;
+};
+
+function ownershipMarker(cli: SkillCli, name: string): OwnershipMarker {
+  return {
+    version: OWNERSHIP_VERSION,
+    manager: "cortex",
+    cli,
+    name,
+  };
+}
+
+function assertCortexOwnedSkillDir(
+  skillDir: string,
+  cli: SkillCli,
+  name: string,
+): void {
+  const markerPath = join(skillDir, OWNERSHIP_FILENAME);
+  if (!existsSync(markerPath) || lstatSync(markerPath).isSymbolicLink()) {
+    throw new Error("skill directory is not owned by Cortex");
+  }
+  let parsed: Partial<OwnershipMarker>;
+  try {
+    parsed = JSON.parse(readFileSync(markerPath, "utf8")) as Partial<OwnershipMarker>;
+  } catch {
+    throw new Error("skill directory has an invalid Cortex ownership marker");
+  }
+  if (
+    parsed.version !== OWNERSHIP_VERSION ||
+    parsed.manager !== "cortex" ||
+    parsed.cli !== cli ||
+    parsed.name !== name
+  ) {
+    throw new Error("skill directory has an invalid Cortex ownership marker");
+  }
 }
 
-function removeSkillFile(path: string): void {
-  if (!existsSync(path)) return;
-  // Remove the per-skill directory (parent of SKILL.md). The skills root
-  // is shared with non-Cortex skills so we never recurse beyond the
-  // skill's own directory.
-  const dir = path.replace(/\/SKILL\.md$/, "");
-  rmSync(dir, { recursive: true, force: true });
+function preflightSkillWrite(
+  cli: SkillCli,
+  name: string,
+): { root: string; skillDir: string; target: string } {
+  const root = resolveSkillRoot(cli, true);
+  if (!root) throw new Error("skill root could not be created");
+  const target = skillFilePath(root, name);
+  const skillDir = resolve(root, name);
+  assertPathContained(root, skillDir);
+  if (!existsSync(skillDir)) return { root, skillDir, target };
+
+  const stat = lstatSync(skillDir);
+  if (stat.isSymbolicLink()) {
+    throw new Error("skill directory must not be a symbolic link");
+  }
+  if (!stat.isDirectory()) {
+    throw new Error("managed skill target is not a directory");
+  }
+  assertCortexOwnedSkillDir(skillDir, cli, name);
+  const existingSkillFile = join(skillDir, "SKILL.md");
+  if (
+    existsSync(existingSkillFile) &&
+    lstatSync(existingSkillFile).isSymbolicLink()
+  ) {
+    throw new Error("skill file must not be a symbolic link");
+  }
+  return { root, skillDir, target };
+}
+
+function writeSkillFile(
+  cli: SkillCli,
+  name: string,
+  content: string,
+): string {
+  const {
+    root,
+    skillDir,
+    target: lexicalTarget,
+  } = preflightSkillWrite(cli, name);
+
+  let created = false;
+  if (existsSync(skillDir)) {
+    const stat = lstatSync(skillDir);
+    if (stat.isSymbolicLink()) {
+      throw new Error("skill directory must not be a symbolic link");
+    }
+    if (!stat.isDirectory()) {
+      throw new Error("managed skill target is not a directory");
+    }
+    assertCortexOwnedSkillDir(skillDir, cli, name);
+  } else {
+    mkdirSync(skillDir, { mode: 0o700 });
+    created = true;
+    writeFileSync(
+      join(skillDir, OWNERSHIP_FILENAME),
+      JSON.stringify(ownershipMarker(cli, name), null, 2) + "\n",
+      { encoding: "utf8", mode: 0o600, flag: "wx" },
+    );
+  }
+
+  const realSkillDir = realpathSync(skillDir);
+  assertPathContained(root, realSkillDir);
+  const target = join(realSkillDir, "SKILL.md");
+  assertPathContained(root, target);
+  if (existsSync(target) && lstatSync(target).isSymbolicLink()) {
+    throw new Error("skill file must not be a symbolic link");
+  }
+
+  const temporaryTarget = join(
+    realSkillDir,
+    `.SKILL.md.${process.pid}.${randomUUID()}.tmp`,
+  );
+  try {
+    writeFileSync(temporaryTarget, content, {
+      encoding: "utf8",
+      mode: 0o600,
+      flag: "wx",
+    });
+    renameSync(temporaryTarget, target);
+  } catch (err) {
+    if (existsSync(temporaryTarget)) unlinkSync(temporaryTarget);
+    if (created) {
+      const entries = readdirSync(skillDir);
+      if (
+        entries.length === 1 &&
+        entries[0] === OWNERSHIP_FILENAME
+      ) {
+        unlinkSync(join(skillDir, OWNERSHIP_FILENAME));
+        rmdirSync(skillDir);
+      }
+    }
+    throw err;
+  }
+  return lexicalTarget;
+}
+
+function removeSkillFile(cli: SkillCli, name: string): void {
+  if (!isSafeSkillName(name)) {
+    throw new Error("invalid skill name");
+  }
+  const root = resolveSkillRoot(cli, false);
+  if (!root) return;
+  const skillDir = resolve(root, name);
+  assertPathContained(root, skillDir);
+  if (!existsSync(skillDir)) return;
+
+  const stat = lstatSync(skillDir);
+  if (stat.isSymbolicLink()) {
+    throw new Error("skill directory must not be a symbolic link");
+  }
+  if (!stat.isDirectory()) {
+    throw new Error("managed skill target is not a directory");
+  }
+  assertPathContained(root, realpathSync(skillDir));
+  assertCortexOwnedSkillDir(skillDir, cli, name);
+
+  const entries = readdirSync(skillDir);
+  const unexpected = entries.filter(
+    (entry) => entry !== OWNERSHIP_FILENAME && entry !== "SKILL.md",
+  );
+  if (unexpected.length > 0) {
+    throw new Error("managed skill directory contains unowned files");
+  }
+  const skillPath = join(skillDir, "SKILL.md");
+  if (existsSync(skillPath)) {
+    if (lstatSync(skillPath).isSymbolicLink()) {
+      throw new Error("skill file must not be a symbolic link");
+    }
+    unlinkSync(skillPath);
+  }
+  unlinkSync(join(skillDir, OWNERSHIP_FILENAME));
+  rmdirSync(skillDir);
 }
 
 function writeNotification(data: {
@@ -224,10 +506,30 @@ export async function runSkillSyncForCli(
   if (!apiKey || !baseUrl) {
     return { kind: "failed", cli, error: "enterprise not configured" };
   }
+  if (!isAllowedLicenseEndpoint(baseUrl)) {
+    return { kind: "failed", cli, error: "insecure or invalid enterprise endpoint" };
+  }
+
+  const credentialId = enterpriseCredentialId(baseUrl, apiKey);
+  if (!matchesEnterpriseHostIdentity(credentialId)) {
+    return {
+      kind: "failed",
+      cli,
+      error:
+        "enterprise identity conflict: this user profile is already enrolled to another endpoint or API key",
+    };
+  }
+  const state = readState();
+  const identityChanged = state.credential_id !== credentialId;
+  let stateSanitized = identityChanged;
+  state.credential_id = credentialId;
 
   let manifest: ManifestEntry[];
   try {
-    manifest = await fetchManifest(baseUrl, apiKey, cli);
+    manifest = validateManifest(
+      await fetchManifest(baseUrl, apiKey, cli),
+      cli,
+    );
   } catch (err) {
     return {
       kind: "failed",
@@ -236,7 +538,6 @@ export async function runSkillSyncForCli(
     };
   }
 
-  const state = readState();
   const relevantManifest = manifest.filter((entry) =>
     shouldSyncForCli(entry.scope, cli),
   );
@@ -245,7 +546,6 @@ export async function runSkillSyncForCli(
   const added: string[] = [];
   const changed: string[] = [];
   const removed: string[] = [];
-
   // Detect adds + changes
   for (const entry of relevantManifest) {
     const skillKey = stateSkillKey(cli, entry.name);
@@ -253,9 +553,27 @@ export async function runSkillSyncForCli(
     const isNew = !local;
     const isChanged =
       Boolean(local) &&
-      (local.updated_at !== entry.updated_at || local.scope !== entry.scope);
+      (
+        identityChanged ||
+        local.credential_id !== credentialId ||
+        local.updated_at !== entry.updated_at ||
+        local.scope !== entry.scope
+      );
     if (!isNew && !isChanged) continue;
 
+    try {
+      preflightSkillWrite(cli, entry.name);
+    } catch (err) {
+      return {
+        kind: "failed",
+        cli,
+        error:
+          err instanceof Error
+            ? `preflight ${entry.name}: ${err.message}`
+            : `preflight ${entry.name}: ${String(err)}`,
+      };
+    }
+
     let body: string;
     try {
       body = await fetchSkillBody(baseUrl, apiKey, entry.name);
@@ -270,9 +588,9 @@ export async function runSkillSyncForCli(
       };
     }
 
-    const path = skillFilePath(cli, entry.name);
+    let path: string;
     try {
-      writeSkillFile(path, body);
+      path = writeSkillFile(cli, entry.name, body);
     } catch (err) {
       return {
         kind: "failed",
@@ -285,6 +603,7 @@ export async function runSkillSyncForCli(
     }
 
     state.skills[skillKey] = {
+      credential_id: credentialId,
       cli,
       scope: entry.scope,
       updated_at: entry.updated_at,
@@ -301,12 +620,26 @@ export async function runSkillSyncForCli(
     if (record.cli !== cli) continue;
     const [, name] = skillKey.split(":", 2);
     if (!name) continue;
+    if (!isSafeSkillName(name)) {
+      // State from an older vulnerable version is not deletion authority.
+      // Drop the record without touching its persisted absolute path.
+      delete state.skills[skillKey];
+      stateSanitized = true;
+      continue;
+    }
     if (!shouldSyncForCli(record.scope, cli)) continue;
     if (remoteByName.has(name)) continue;
     try {
-      removeSkillFile(record.path);
-    } catch {
-      // best-effort; if unlink fails the next tick will retry
+      removeSkillFile(cli, name);
+    } catch (err) {
+      return {
+        kind: "failed",
+        cli,
+        error:
+          err instanceof Error
+            ? `remove ${name}: ${err.message}`
+            : `remove ${name}: ${String(err)}`,
+      };
     }
     delete state.skills[skillKey];
     removed.push(name);
@@ -314,6 +647,10 @@ export async function runSkillSyncForCli(
 
   const totalChanged = added.length + changed.length + removed.length;
   if (totalChanged === 0) {
+    if (stateSanitized) {
+      state.last_synced_at = new Date().toISOString();
+      writeState(state);
+    }
     return { kind: "unchanged", cli, count: relevantManifest.length };
   }
 

package/scaffold/mcp/src/daemon/sync-checker.ts

@@ -2,6 +2,7 @@ import { existsSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
 import { hostname } from "node:os";
 import { join } from "node:path";
 import { loadEnterpriseConfig } from "../core/config.js";
+import { isAllowedEnterpriseEndpoint } from "../core/secure-endpoint.js";
 import { writeHostAuditEvent } from "./ungoverned-scanner.js";
 
 /**
@@ -84,6 +85,9 @@ export async function checkSyncForCli(
   if (!apiKey || !baseUrl) {
     return { kind: "failed", error: "enterprise not configured" };
   }
+  if (!isAllowedEnterpriseEndpoint(baseUrl)) {
+    return { kind: "failed", error: "insecure or invalid enterprise endpoint" };
+  }
   const frameworks = activeFrameworks(cwd);
   if (frameworks.length === 0) {
     return { kind: "failed", error: "no active frameworks" };

package/scaffold/mcp/src/daemon/ungoverned-scanner.ts

@@ -1,7 +1,7 @@
 import { appendFile, mkdir } from "node:fs/promises";
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, lstatSync, readFileSync } from "node:fs";
 import { join } from "node:path";
-import { userInfo } from "node:os";
+import { platform, userInfo } from "node:os";
 import {
   detectUngoverned,
   enforceFinding,
@@ -9,12 +9,16 @@ import {
   type EnforcementMode,
   type UngovernedFinding,
 } from "../cli/ungoverned-detector.js";
+import { writeGlobalUngovernedEvent } from "./global-host-events.js";
+import { getGovernManagedPath } from "../core/govern-paths.js";
 
 export type ScannerOptions = {
   cwd: string;
   intervalMs?: number;
   mode?: EnforcementMode;
   detectorOptions?: DetectorOptions;
+  credentialId?: string;
+  managedPathOverrides?: Partial<Record<"claude" | "codex", string>>;
   onFinding?: (finding: UngovernedFinding & { action: string }) => void;
 };
 
@@ -38,7 +42,28 @@ function readMode(cwd: string): EnforcementMode {
   }
 }
 
-function readManagedTier1Clis(cwd: string): Set<string> {
+function isExpectedManagedArtifact(
+  cli: "claude" | "codex",
+  path: string,
+): boolean {
+  try {
+    const stat = lstatSync(path);
+    if (!stat.isFile() || stat.isSymbolicLink()) return false;
+    const raw = readFileSync(path, "utf8");
+    if (cli === "codex") {
+      return raw.startsWith("# Cortex govern — codex requirements");
+    }
+    const parsed = JSON.parse(raw) as Record<string, unknown>;
+    return parsed.allowManagedHooksOnly === true;
+  } catch {
+    return false;
+  }
+}
+
+function readManagedTier1Clis(
+  cwd: string,
+  overrides?: Partial<Record<"claude" | "codex", string>>,
+): Set<string> {
   const stateFile = join(cwd, ".context", "govern.local.json");
   const managed = new Set<string>();
   if (!existsSync(stateFile)) return managed;
@@ -49,7 +74,13 @@ function readManagedTier1Clis(cwd: string): Set<string> {
     };
     for (const [cli, inst] of Object.entries(parsed.installs ?? {})) {
       if (!TIER1_CLIS.has(cli)) continue;
-      if (!inst?.path || !existsSync(inst.path)) continue;
+      const tier1Cli = cli as "claude" | "codex";
+      const expectedPath =
+        overrides?.[tier1Cli] ??
+        getGovernManagedPath(tier1Cli, platform());
+      if (!isExpectedManagedArtifact(tier1Cli, expectedPath)) {
+        continue;
+      }
       managed.add(cli);
     }
   } catch {
@@ -79,7 +110,10 @@ export async function writeHostAuditEvent(
 
 export async function runScanOnce(options: ScannerOptions): Promise<UngovernedFinding[]> {
   const mode = options.mode ?? readMode(options.cwd);
-  const managedTier1Clis = readManagedTier1Clis(options.cwd);
+  const managedTier1Clis = readManagedTier1Clis(
+    options.cwd,
+    options.managedPathOverrides,
+  );
   const findings = filterManagedTier1Findings(
     detectUngoverned(options.detectorOptions),
     managedTier1Clis,
@@ -87,26 +121,24 @@ export async function runScanOnce(options: ScannerOptions): Promise<UngovernedFi
   const me = userInfo().username;
   for (const finding of findings) {
     const action = enforceFinding(finding, { mode, currentUser: me });
-    const event = {
-      event_type: "ungoverned_ai_session_detected",
-      timestamp: finding.detected_at,
-      host_id: finding.host_id,
-      cli: finding.cli,
-      binary: finding.binary,
-      pid: finding.pid,
-      ppid: finding.ppid,
-      user: finding.user,
-      args: finding.args,
-      parent_chain: finding.parent_chain,
-      mode,
-      action,
-    };
-    try {
-      await writeHostAuditEvent(options.cwd, event);
-    } catch (err) {
-      process.stderr.write(
-        `[cortex-daemon] failed to write ungoverned audit: ${err instanceof Error ? err.message : String(err)}\n`,
-      );
+    // A host process snapshot has no trustworthy project attribution. Store
+    // it only in the credential-bound user-global queue; never in whichever
+    // project happened to register first.
+    if (options.credentialId) {
+      writeGlobalUngovernedEvent(options.credentialId, {
+        event_type: "ungoverned_ai_session_detected",
+        timestamp: finding.detected_at,
+        host_id: finding.host_id,
+        cli: finding.cli,
+        binary: finding.binary,
+        pid: finding.pid,
+        ppid: finding.ppid,
+        user: finding.user,
+        args: finding.args,
+        parent_chain: finding.parent_chain,
+        mode,
+        action,
+      });
     }
     options.onFinding?.({ ...finding, action });
   }