@danielblomma/cortex-mcp 2.2.5 → 2.4.1

package/scaffold/mcp/src/daemon/workflow-sync-checker.ts

@@ -6,6 +6,11 @@ import {
 import { hostname } from "node:os";
 import { join } from "node:path";
 import { loadEnterpriseConfig } from "../core/config.js";
+import { matchesEnterpriseHostIdentity } from "../core/enterprise-host-identity.js";
+import {
+  enterpriseCredentialId,
+  isAllowedLicenseEndpoint,
+} from "../core/license.js";
 import { workflowDefinitionSchema, type WorkflowDefinition } from "../core/workflow/schemas.js";
 import { writeHostAuditEvent } from "./ungoverned-scanner.js";
 import { daemonDir } from "./paths.js";
@@ -55,6 +60,7 @@ type LocalWorkflowRecord = {
 };
 
 type LocalWorkflowsState = {
+  credential_id?: string;
   workflows: Record<string, LocalWorkflowRecord>;
   last_synced_at?: string;
 };
@@ -79,6 +85,10 @@ export function readSyncedWorkflowsState(): LocalWorkflowsState {
   try {
     const parsed = JSON.parse(readFileSync(path, "utf8")) as LocalWorkflowsState;
     return {
+      credential_id:
+        typeof parsed.credential_id === "string"
+          ? parsed.credential_id
+          : undefined,
       workflows: parsed.workflows ?? {},
       last_synced_at: parsed.last_synced_at,
     };
@@ -149,6 +159,28 @@ export async function runWorkflowSyncOnce(
     await writeAudit(cwd, outcome);
     return outcome;
   }
+  if (!isAllowedLicenseEndpoint(baseUrl)) {
+    const outcome: WorkflowSyncOutcome = {
+      kind: "failed",
+      error: "insecure or invalid enterprise endpoint",
+    };
+    await writeAudit(cwd, outcome);
+    return outcome;
+  }
+
+  const credentialId = enterpriseCredentialId(baseUrl, apiKey);
+  if (!matchesEnterpriseHostIdentity(credentialId)) {
+    const outcome: WorkflowSyncOutcome = {
+      kind: "failed",
+      error:
+        "enterprise identity conflict: this user profile is already enrolled to another endpoint or API key",
+    };
+    await writeAudit(cwd, outcome);
+    return outcome;
+  }
+  const state = readSyncedWorkflowsState();
+  const identityChanged = state.credential_id !== credentialId;
+  state.credential_id = credentialId;
 
   let manifest: ManifestEntry[];
   try {
@@ -162,7 +194,6 @@ export async function runWorkflowSyncOnce(
     return outcome;
   }
 
-  const state = readSyncedWorkflowsState();
   const remoteByName = new Map(manifest.map((e) => [e.workflow_id, e]));
 
   const added: string[] = [];
@@ -174,7 +205,11 @@ export async function runWorkflowSyncOnce(
     const isNew = !local;
     const isChanged =
       Boolean(local) &&
-      (local.updated_at !== entry.updated_at || local.version !== entry.version);
+      (
+        identityChanged ||
+        local.updated_at !== entry.updated_at ||
+        local.version !== entry.version
+      );
     if (!isNew && !isChanged) continue;
 
     let fetched: FetchedWorkflow;
@@ -224,6 +259,10 @@ export async function runWorkflowSyncOnce(
 
   const totalChanged = added.length + changed.length + removed.length;
   if (totalChanged === 0) {
+    if (identityChanged) {
+      state.last_synced_at = new Date().toISOString();
+      writeSyncedWorkflowsState(state);
+    }
     const outcome: WorkflowSyncOutcome = {
       kind: "unchanged",
       count: manifest.length,

package/scaffold/mcp/src/embed.ts

@@ -31,6 +31,31 @@ const MODEL_CACHE_DIR = PATHS.embeddingsModelCache;
 const EMBEDDINGS_DIR = path.dirname(EMBEDDINGS_PATH);
 
 export const DEFAULT_MODEL_ID = "jinaai/jina-embeddings-v2-base-code";
+export const COMPACT_FILE_TEXT_STRATEGY = "compact_files_v1";
+export const COMPACT_FILE_TEXT_THRESHOLD_CHARS = 32768;
+export const COMPACT_FILE_TEXT_TARGET_CHARS = 16000;
+
+const COMPACT_FILE_SIGNAL_BUDGET_CHARS = 4096;
+const COMPACT_FILE_SIGNAL_MAX_LINE_CHARS = 512;
+const COMPACT_FILE_MIN_HEAD_CHARS = 4096;
+const COMPACT_FILE_MIN_TAIL_CHARS = 2048;
+
+export type EmbedTextProfile = "full" | "compact-files";
+
+type FileEmbeddingTextResult = {
+  text: string;
+  profile: EmbedTextProfile;
+  compacted: boolean;
+  original_chars: number;
+  text_chars: number;
+  omitted_chars: number;
+};
+
+type ParseFileEntitiesOptions = {
+  textProfile?: EmbedTextProfile;
+};
+
+type SignatureEntityType = "File" | "Rule" | "ADR" | "Module" | "Project" | "Chunk";
 
 export function resolveModelId(): string {
   return (process.env.CORTEX_EMBED_MODEL ?? DEFAULT_MODEL_ID).trim() || DEFAULT_MODEL_ID;
@@ -48,6 +73,11 @@ type FileEntity = {
   updated_at: string;
   text: string;
   signature: string;
+  text_profile: EmbedTextProfile;
+  text_compacted: boolean;
+  text_original_chars: number;
+  text_chars: number;
+  text_omitted_chars: number;
 };
 
 type RuleEntity = {
@@ -155,6 +185,129 @@ function normalizeText(value: string): string {
   return value.replace(/\s+/g, " ").trim();
 }
 
+export function resolveEmbedTextProfile(raw = process.env.CORTEX_EMBED_TEXT_PROFILE): EmbedTextProfile {
+  const value = (raw ?? "").trim().toLowerCase();
+  if (!value || value === "full") {
+    return "full";
+  }
+  if (value === "compact-files") {
+    return "compact-files";
+  }
+  throw new Error(
+    `Unsupported CORTEX_EMBED_TEXT_PROFILE=${JSON.stringify(raw)}; expected "full" or "compact-files"`
+  );
+}
+
+function isSignalLine(line: string): boolean {
+  const trimmed = line.trim();
+  if (!trimmed) {
+    return false;
+  }
+  return (
+    /^(import|export)\b/.test(trimmed) ||
+    /^(abstract\s+|async\s+|public\s+|private\s+|protected\s+|static\s+|readonly\s+|override\s+)*(class|interface|type|enum|function)\b/.test(trimmed) ||
+    /^(const|let|var)\s+[$A-Z_a-z][$\w]*\s*=/.test(trimmed) ||
+    /^(describe|it|test)\s*\(/.test(trimmed) ||
+    /^(@[A-Z_a-z][$\w]*|#[#\s])/.test(trimmed) ||
+    /^```[A-Za-z0-9_-]+/.test(trimmed) ||
+    /\b(route|router|endpoint|controller|handler|middleware|permission|auth|token|secret|security|todo|fixme)\b/i.test(trimmed)
+  );
+}
+
+function collectSignalLines(content: string, budgetChars: number): string {
+  const lines: string[] = [];
+  const seen = new Set<string>();
+  let used = 0;
+
+  for (const line of content.split(/\r?\n/)) {
+    if (!isSignalLine(line)) {
+      continue;
+    }
+    const normalized = line.trimEnd();
+    const signalLine = normalized.length > COMPACT_FILE_SIGNAL_MAX_LINE_CHARS
+      ? `${normalized.slice(0, COMPACT_FILE_SIGNAL_MAX_LINE_CHARS)} [cortex ${COMPACT_FILE_TEXT_STRATEGY} signal_line_truncated_chars=${normalized.length - COMPACT_FILE_SIGNAL_MAX_LINE_CHARS}]`
+      : normalized;
+    if (seen.has(signalLine)) {
+      continue;
+    }
+    const next = used + signalLine.length + 1;
+    if (next > budgetChars) {
+      continue;
+    }
+    lines.push(signalLine);
+    seen.add(signalLine);
+    used = next;
+  }
+
+  return lines.join("\n");
+}
+
+export function buildFileEmbeddingText(
+  filePath: string,
+  excerpt: string,
+  content: string,
+  profile: EmbedTextProfile = "full"
+): FileEmbeddingTextResult {
+  const fullText = `${filePath}\n${excerpt}\n${content}`;
+  if (profile === "full" || fullText.length <= COMPACT_FILE_TEXT_THRESHOLD_CHARS) {
+    return {
+      text: fullText,
+      profile,
+      compacted: false,
+      original_chars: fullText.length,
+      text_chars: fullText.length,
+      omitted_chars: 0
+    };
+  }
+
+  const signalText = collectSignalLines(content, COMPACT_FILE_SIGNAL_BUDGET_CHARS);
+  const markerPrefix = `[cortex ${COMPACT_FILE_TEXT_STRATEGY} omitted_chars=`;
+  const staticChars =
+    filePath.length +
+    excerpt.length +
+    signalText.length +
+    markerPrefix.length +
+    64;
+  const available = Math.max(
+    COMPACT_FILE_MIN_HEAD_CHARS + COMPACT_FILE_MIN_TAIL_CHARS,
+    COMPACT_FILE_TEXT_TARGET_CHARS - staticChars
+  );
+  const headChars = Math.max(COMPACT_FILE_MIN_HEAD_CHARS, Math.floor(available * 0.62));
+  const tailChars = Math.max(COMPACT_FILE_MIN_TAIL_CHARS, available - headChars);
+  const head = content.slice(0, headChars);
+  const tail = content.slice(-tailChars);
+  const omittedChars = Math.max(0, content.length - head.length - tail.length);
+  const marker = `${markerPrefix}${omittedChars}]`;
+  const compactText = [
+    filePath,
+    excerpt,
+    head,
+    marker,
+    signalText ? `[cortex ${COMPACT_FILE_TEXT_STRATEGY} signal_lines]\n${signalText}` : "",
+    tail
+  ].filter((part) => part.length > 0).join("\n");
+
+  if (compactText.length >= fullText.length) {
+    return {
+      text: fullText,
+      profile,
+      compacted: false,
+      original_chars: fullText.length,
+      text_chars: fullText.length,
+      omitted_chars: 0
+    };
+  }
+
+  return {
+    text: compactText,
+    profile,
+    compacted: true,
+    original_chars: fullText.length,
+    text_chars: compactText.length,
+    omitted_chars: fullText.length - compactText.length
+  };
+}
+
 function ensureRequiredFiles(): void {
   const required = [
     path.join(CACHE_DIR, "documents.jsonl"),
@@ -169,7 +322,8 @@ function ensureRequiredFiles(): void {
   }
 }
 
-export function parseFileEntities(raw: JsonObject[]): FileEntity[] {
+export function parseFileEntities(raw: JsonObject[], options: ParseFileEntitiesOptions = {}): FileEntity[] {
+  const textProfile = options.textProfile ?? "full";
   return raw
     .map((item) => {
       const id = asString(item.id);
@@ -182,7 +336,7 @@ export function parseFileEntities(raw: JsonObject[]): FileEntity[] {
       const excerpt = asString(item.excerpt);
       const updatedAt = asString(item.updated_at);
       const checksum = asString(item.checksum, hashText(content));
-      const text = `${filePath}\n${excerpt}\n${content}`;
+      const embeddingText = buildFileEmbeddingText(filePath, excerpt, content, textProfile);
 
       return {
         id,
@@ -194,8 +348,13 @@ export function parseFileEntities(raw: JsonObject[]): FileEntity[] {
         source_of_truth: asBoolean(item.source_of_truth, false),
         trust_level: asNumber(item.trust_level, 50),
         updated_at: updatedAt,
-        text,
-        signature: hashText(`file|${checksum}|${updatedAt}|${hashText(text)}`)
+        text: embeddingText.text,
+        signature: hashText(`file|${checksum}|${updatedAt}|${hashText(embeddingText.text)}`),
+        text_profile: embeddingText.profile,
+        text_compacted: embeddingText.compacted,
+        text_original_chars: embeddingText.original_chars,
+        text_chars: embeddingText.text_chars,
+        text_omitted_chars: embeddingText.omitted_chars
       };
     })
     .filter((value): value is FileEntity => value !== null);
@@ -408,8 +567,24 @@ function roundVector(values: number[]): number[] {
   return values.map((value) => Number(value.toFixed(6)));
 }
 
-function resolveSignatureProfile(maxTokenCap: number | null): string {
-  return maxTokenCap ? `embed|max_tokens=${maxTokenCap}` : "";
+export function resolveSignatureProfile(
+  maxTokenCap: number | null,
+  textProfile: EmbedTextProfile = "full",
+  entityType?: SignatureEntityType
+): string {
+  const parts: string[] = [];
+  if (maxTokenCap) {
+    parts.push(`max_tokens=${maxTokenCap}`);
+  }
+  if (textProfile === "compact-files" && (entityType === undefined || entityType === "File")) {
+    parts.push(
+      "text_profile=compact-files",
+      COMPACT_FILE_TEXT_STRATEGY,
+      `threshold_chars=${COMPACT_FILE_TEXT_THRESHOLD_CHARS}`,
+      `target_chars=${COMPACT_FILE_TEXT_TARGET_CHARS}`
+    );
+  }
+  return parts.length ? `embed|${parts.join("|")}` : "";
 }
 
 function embeddingSignature(entitySignature: string, profile: string): string {
@@ -434,8 +609,19 @@ async function main(): Promise<void> {
   fs.mkdirSync(MODEL_CACHE_DIR, { recursive: true });
 
   const modelId = resolveModelId();
-
-  const documents = parseFileEntities(readJsonl(path.join(CACHE_DIR, "documents.jsonl")));
+  const textProfile = resolveEmbedTextProfile();
+
+  const documents = parseFileEntities(readJsonl(path.join(CACHE_DIR, "documents.jsonl")), { textProfile });
+  const textProfileStats = {
+    strategy: textProfile === "compact-files" ? COMPACT_FILE_TEXT_STRATEGY : null,
+    threshold_chars: textProfile === "compact-files" ? COMPACT_FILE_TEXT_THRESHOLD_CHARS : null,
+    target_chars: textProfile === "compact-files" ? COMPACT_FILE_TEXT_TARGET_CHARS : null,
+    file_entities: documents.length,
+    compacted_files: documents.filter((doc) => doc.text_compacted).length,
+    original_chars: documents.reduce((total, doc) => total + doc.text_original_chars, 0),
+    text_chars: documents.reduce((total, doc) => total + doc.text_chars, 0),
+    saved_chars: documents.reduce((total, doc) => total + doc.text_omitted_chars, 0)
+  };
   const rules = parseRuleEntities(readJsonl(path.join(CACHE_DIR, "entities.rule.jsonl")));
   const adrs = parseAdrEntities(readJsonl(path.join(CACHE_DIR, "entities.adr.jsonl")));
   const modules = parseModuleEntities(readJsonl(path.join(CACHE_DIR, "entities.module.jsonl")));
@@ -483,7 +669,10 @@ async function main(): Promise<void> {
     memoryBytes: memoryHeadroom,
     sessions: previewPoolConfig.sessions
   });
-  const signatureProfile = resolveSignatureProfile(tokenBudget.cap);
+  const defaultSignatureProfile = resolveSignatureProfile(tokenBudget.cap, "full");
+  const fileSignatureProfile = resolveSignatureProfile(tokenBudget.cap, textProfile, "File");
+  const signatureProfileForEntity = (entity: SearchEntity) =>
+    entity.type === "File" ? fileSignatureProfile : defaultSignatureProfile;
 
   const existing = parseExistingEmbeddings(readJsonlRecords(EMBEDDINGS_PATH), modelId);
 
@@ -494,6 +683,7 @@ async function main(): Promise<void> {
   let dimensions = 0;
 
   entities.forEach((entity, index) => {
+    const signatureProfile = signatureProfileForEntity(entity);
     const signature = embeddingSignature(entity.signature, signatureProfile);
     const previous = existing.get(entity.id);
     if (previous && previous.signature === signature && previous.vector.length > 0) {
@@ -628,6 +818,7 @@ async function main(): Promise<void> {
       maxInFlightTokens,
       onVector(index, rawVector) {
         const entity = entities[index];
+        const signatureProfile = signatureProfileForEntity(entity);
         const vector = roundVector(rawVector);
         embedded += 1;
         dimensions = dimensions || vector.length;
@@ -662,6 +853,13 @@ async function main(): Promise<void> {
     mode,
     model: modelId,
     dimensions,
+    text_profile: textProfile,
+    signature_profile: fileSignatureProfile === defaultSignatureProfile ? defaultSignatureProfile : "per_entity",
+    signature_profiles: {
+      default: defaultSignatureProfile,
+      file: fileSignatureProfile
+    },
+    text_profile_stats: textProfileStats,
     counts: {
       entities: entities.length,
       output: outputCount,
@@ -675,7 +873,10 @@ async function main(): Promise<void> {
   fs.writeFileSync(EMBEDDINGS_MANIFEST_PATH, `${JSON.stringify(manifest, null, 2)}\n`, "utf8");
 
   console.log(
-    `[embed] mode=${mode} model=${modelId} dim=${dimensions} pool=${poolConfig.sessions}x${poolConfig.threadsPerSession} batch<=${schedulerOptions.batchMaxItems} max_tokens<=${modelMaxTokensUsed || tokenBudget.cap || "model"} token_budget=${tokenBudget.mode} reason=${tokenBudget.reason}`
+    `[embed] mode=${mode} model=${modelId} dim=${dimensions} pool=${poolConfig.sessions}x${poolConfig.threadsPerSession} batch<=${schedulerOptions.batchMaxItems} max_tokens<=${modelMaxTokensUsed || tokenBudget.cap || "model"} token_budget=${tokenBudget.mode} reason=${tokenBudget.reason} text_profile=${textProfile}`
+  );
+  console.log(
+    `[embed] text_profile=${textProfile} compacted_files=${textProfileStats.compacted_files}/${textProfileStats.file_entities} saved_chars=${textProfileStats.saved_chars}`
   );
   console.log(
     `[embed] entities=${entities.length} embedded=${embedded} reused=${reused} failed=${failed}`

package/scaffold/mcp/src/enterprise/audit/push.ts

@@ -1,4 +1,5 @@
 import type { AuditEntry } from "../../core/audit/writer.js";
+import { isAllowedEnterpriseEndpoint } from "../../core/secure-endpoint.js";
 import { sanitizeAuditEntryForPush } from "../privacy/boundary.js";
 
 export type AuditPushContext = {
@@ -40,6 +41,13 @@ export async function pushAuditEvents(
   if (pending.length === 0) {
     return { success: true, count: 0 };
   }
+  if (!isAllowedEnterpriseEndpoint(baseUrl)) {
+    return {
+      success: false,
+      count: 0,
+      error: "insecure or invalid enterprise endpoint",
+    };
+  }
 
   const auditUrl = `${baseUrl.replace(/\/$/, "")}/api/v1/audit/push`;
   let pushedCount = 0;

package/scaffold/mcp/src/enterprise/index.ts

@@ -21,7 +21,7 @@ import { pushWorkflowSnapshot, setWorkflowPushContext } from "./workflow/push.js
 import { hasWorkflowState, loadWorkflowState } from "./workflow/state.js";
 
 const require = createRequire(import.meta.url);
-const pkg = require("../package.json") as { version: string };
+const pkg = require("../../package.json") as { version: string };
 
 export const name = "cortex-enterprise";
 export const version: string = pkg.version;

package/scaffold/mcp/src/enterprise/policy/sync.ts

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import type { OrgPolicy, PolicyStore } from "../../core/policy/store.js";
+import { isAllowedEnterpriseEndpoint } from "../../core/secure-endpoint.js";
 
 const CloudPolicySchema = z.object({
   id: z.string().min(1).max(200),
@@ -60,6 +61,17 @@ export async function syncFromCloud(
     lastSync = result;
     return result;
   }
+  if (!isAllowedEnterpriseEndpoint(endpoint)) {
+    const result: SyncResult = {
+      success: false,
+      synced: 0,
+      source: "cloud",
+      timestamp: new Date().toISOString(),
+      error: "insecure or invalid enterprise endpoint",
+    };
+    lastSync = result;
+    return result;
+  }
 
   try {
     const response = await fetch(endpoint, {

package/scaffold/mcp/src/enterprise/reviews/changed-files.ts

@@ -0,0 +1,34 @@
+import { execFileSync } from "node:child_process";
+
+function gitLines(projectRoot: string, args: string[]): string[] {
+  const output = execFileSync("git", args, {
+    cwd: projectRoot,
+    encoding: "utf8",
+    timeout: 5000,
+    stdio: ["ignore", "pipe", "ignore"],
+  });
+  return output.split("\n").map((value) => value.trim()).filter(Boolean);
+}
+
+function trackedChangedFiles(projectRoot: string): string[] {
+  try {
+    return gitLines(projectRoot, ["diff", "--name-only", "HEAD"]);
+  } catch {
+    // No HEAD yet (repo without commits): every tracked file is new.
+    return [
+      ...gitLines(projectRoot, ["diff", "--name-only"]),
+      ...gitLines(projectRoot, ["ls-files"]),
+    ];
+  }
+}
+
+export function resolveChangedReviewFiles(projectRoot: string): string[] | null {
+  try {
+    gitLines(projectRoot, ["rev-parse", "--is-inside-work-tree"]);
+    const tracked = trackedChangedFiles(projectRoot);
+    const untracked = gitLines(projectRoot, ["ls-files", "--others", "--exclude-standard"]);
+    return [...new Set([...tracked, ...untracked])].sort();
+  } catch {
+    return null;
+  }
+}