@danielblomma/cortex-mcp 2.2.5 → 2.4.1

package/scaffold/mcp/tests/search-graph-score.test.mjs

@@ -1,6 +1,7 @@
 import test from "node:test";
 import assert from "node:assert/strict";
 import { buildSearchResults, buildSearchResultsWithStats } from "../dist/searchResults.js";
+import { expandQueryTokens, semanticScore, structuralSearchBoost, tokenize } from "../dist/searchCore.js";
 
 function makeEntity(id, entityType, overrides = {}) {
   return {
@@ -166,6 +167,172 @@ test("ranking is preserved when score fields are omitted from the response", ()
   assert.equal("score" in results[0], false);
 });
 
+test("tokenization exposes camel-case code identifiers for lexical matching", () => {
+  const tokens = tokenize("buildSearchResults parseRankingFromConfig parseJavaScriptCode parseCSharpParser C# VB.NET");
+
+  assert.ok(tokens.includes("build"));
+  assert.ok(tokens.includes("search"));
+  assert.ok(tokens.includes("results"));
+  assert.ok(tokens.includes("parse"));
+  assert.ok(tokens.includes("ranking"));
+  assert.ok(tokens.includes("config"));
+  assert.ok(tokens.includes("javascript"));
+  assert.ok(tokens.includes("csharp"));
+  assert.ok(tokens.includes("vbnet"));
+  assert.equal(tokens.includes("java"), false);
+});
+
+test("query aliases do not dilute lexical semantic scoring", () => {
+  assert.equal(semanticScore(expandQueryTokens(["dashboard"]), "", "status"), 0.85);
+  assert.equal(semanticScore(expandQueryTokens(["import"]), "", "imports"), 0.85);
+});
+
+test("structural search boost favors matching path and symbol fields", () => {
+  const query = "How does the JavaScript and TypeScript parser collect calls and imports?";
+  const queryTokens = expandQueryTokens(Array.from(new Set(tokenize(query))));
+  const jsImports = makeEntity("js-imports", "Chunk", {
+    label: "collectImports",
+    path: "scaffold/scripts/parsers/javascript/imports.mjs"
+  });
+  const cppParser = makeEntity("cpp-parser", "Chunk", {
+    label: "parseCode",
+    path: "scaffold/scripts/parsers/cpp-treesitter.mjs"
+  });
+  const csharpParser = makeEntity("csharp-parser", "Chunk", {
+    label: "CSharpParser",
+    path: "scaffold/scripts/parsers/dotnet/CSharpParser/Program.cs"
+  });
+
+  assert.ok(
+    structuralSearchBoost(jsImports, queryTokens, query.toLowerCase()) >
+      structuralSearchBoost(cppParser, queryTokens, query.toLowerCase())
+  );
+  assert.ok(
+    structuralSearchBoost(jsImports, queryTokens, query.toLowerCase()) >
+      structuralSearchBoost(csharpParser, queryTokens, query.toLowerCase())
+  );
+});
+
+test("low-semantic graph hubs cannot outrank strong semantic code matches on secondary signals alone", () => {
+  const candidates = [
+    makeEntity("hub", "Chunk", {
+      text: "broad weak query",
+      trust_level: 100
+    }),
+    makeEntity("leaf", "Chunk", {
+      text: "precise strong query",
+      trust_level: 10
+    })
+  ];
+
+  const results = buildSearchResults({
+    candidates,
+    degreeByEntity: new Map([
+      ["hub", 100],
+      ["leaf", 0]
+    ]),
+    queryTokens: ["query"],
+    queryPhrase: "query",
+    ranking: { semantic: 0.4, graph: 0.25, trust: 0.2, recency: 0.15 },
+    includeScores: true,
+    includeMatchedRules: false,
+    includeContent: false,
+    queryVector: null,
+    embeddingVectors: new Map(),
+    topK: 2,
+    minLexicalRelevance: 0,
+    minVectorRelevance: 0,
+    semanticScorer: (_tokens, _phrase, text) => (text.includes("strong") ? 0.7 : 0.2),
+    vectorScorer: () => 0,
+    recencyScorer: () => 1,
+    structuralSearchBooster: () => 0,
+    legacyDataAccessBooster: () => 0
+  });
+
+  assert.equal(results[0].id, "leaf");
+});
+
+test("diverse top-k selection admits a near-tie from another path", () => {
+  const candidates = [
+    makeEntity("a1", "Chunk", { path: "src/a.ts", text: "a1 query" }),
+    makeEntity("a2", "Chunk", { path: "src/a.ts", text: "a2 query" }),
+    makeEntity("a3", "Chunk", { path: "src/a.ts", text: "a3 query" }),
+    makeEntity("b1", "Chunk", { path: "src/b.ts", text: "b1 query" })
+  ];
+  const semanticById = new Map([
+    ["a1", 0.9],
+    ["a2", 0.89],
+    ["a3", 0.88],
+    ["b1", 0.86]
+  ]);
+
+  const results = buildSearchResults({
+    candidates,
+    degreeByEntity: new Map(),
+    queryTokens: ["query"],
+    queryPhrase: "query",
+    ranking: { semantic: 1, graph: 0, trust: 0, recency: 0 },
+    includeScores: true,
+    includeMatchedRules: false,
+    includeContent: false,
+    queryVector: null,
+    embeddingVectors: new Map(),
+    topK: 3,
+    minLexicalRelevance: 0,
+    minVectorRelevance: 0,
+    semanticScorer: (_tokens, _phrase, text) => semanticById.get(text.split(" ")[0]) ?? 0,
+    vectorScorer: () => 0,
+    recencyScorer: () => 0,
+    structuralSearchBooster: () => 0,
+    legacyDataAccessBooster: () => 0
+  });
+
+  assert.deepEqual(results.map((result) => result.id), ["a1", "a2", "b1"]);
+  assert.equal(results.some((result) => result.id === "a3"), false);
+  assert.deepEqual(results.map((result) => result.score), [0.9, 0.89, 0.86]);
+});
+
+test("strong test evidence can outrank a slightly weaker graph hub", () => {
+  const candidates = [
+    makeEntity("hub", "Chunk", {
+      path: "src/hub.ts",
+      text: "implementation query",
+      trust_level: 50
+    }),
+    makeEntity("test-evidence", "File", {
+      path: "tests/context-regressions.test.mjs",
+      text: "regression evidence query",
+      trust_level: 50
+    })
+  ];
+
+  const results = buildSearchResults({
+    candidates,
+    degreeByEntity: new Map([
+      ["hub", 100],
+      ["test-evidence", 0]
+    ]),
+    queryTokens: ["query"],
+    queryPhrase: "query",
+    ranking: { semantic: 0.4, graph: 0.25, trust: 0.2, recency: 0.15 },
+    includeScores: true,
+    includeMatchedRules: false,
+    includeContent: false,
+    queryVector: null,
+    embeddingVectors: new Map(),
+    topK: 2,
+    minLexicalRelevance: 0,
+    minVectorRelevance: 0,
+    semanticScorer: (_tokens, _phrase, text) => (text.includes("regression") ? 0.5 : 0.49),
+    vectorScorer: () => 0,
+    recencyScorer: () => 1,
+    structuralSearchBooster: () => 0,
+    legacyDataAccessBooster: () => 0
+  });
+
+  assert.equal(results[0].id, "test-evidence");
+});
+
 test("search results can consume a repeatable candidate generator with stats", () => {
   let passes = 0;
   const candidateSource = function* () {

package/scaffold/mcp/tests/secure-enterprise-endpoint.test.mjs

@@ -0,0 +1,46 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { isAllowedEnterpriseEndpoint } from "../dist/core/secure-endpoint.js";
+import { pushMetrics } from "../dist/enterprise/telemetry/sync.js";
+import { syncFromCloud } from "../dist/enterprise/policy/sync.js";
+
+test("Enterprise endpoint policy allows TLS and loopback HTTP only", () => {
+  assert.equal(isAllowedEnterpriseEndpoint("https://enterprise.example.com"), true);
+  assert.equal(isAllowedEnterpriseEndpoint("http://127.0.0.1:8787"), true);
+  assert.equal(isAllowedEnterpriseEndpoint("http://localhost:8787"), true);
+  assert.equal(isAllowedEnterpriseEndpoint("http://[::1]:8787"), true);
+  assert.equal(isAllowedEnterpriseEndpoint("http://external.example.com"), false);
+  assert.equal(
+    isAllowedEnterpriseEndpoint("https://user:pass@enterprise.example.com"),
+    false,
+  );
+});
+
+test("telemetry and policy send primitives reject external HTTP before attaching a bearer key", async () => {
+  let fetches = 0;
+  globalThis.fetch = async () => {
+    fetches += 1;
+    throw new Error("fetch must not be called");
+  };
+  try {
+    const telemetry = await pushMetrics(
+      {},
+      "http://external.example.com/telemetry",
+      "ent_secret_12345678",
+    );
+    assert.equal(telemetry.success, false);
+    assert.match(telemetry.error, /insecure or invalid/);
+
+    const policy = await syncFromCloud(
+      "http://external.example.com/policy",
+      "ent_secret_12345678",
+      {},
+    );
+    assert.equal(policy.success, false);
+    assert.match(policy.error, /insecure or invalid/);
+    assert.equal(fetches, 0);
+  } finally {
+    globalThis.fetch = undefined;
+  }
+});

package/scaffold/mcp/tests/skill-sync-checker.test.mjs

@@ -6,9 +6,34 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 
 import {
-  runSkillSyncForCli,
-  runSkillSyncOnce,
+  runSkillSyncForCli as runSkillSyncForCliImpl,
+  runSkillSyncOnce as runSkillSyncOnceImpl,
 } from "../dist/daemon/skill-sync-checker.js";
+import { enterpriseCredentialId } from "../dist/core/license.js";
+import { claimEnterpriseHostIdentity } from "../dist/core/enterprise-host-identity.js";
+
+const TEST_ENDPOINT = "https://example.com";
+const TEST_API_KEY = "ent_test_12345678";
+
+function enrollTestIdentity() {
+  assert.equal(
+    claimEnterpriseHostIdentity(
+      enterpriseCredentialId(TEST_ENDPOINT, TEST_API_KEY),
+      TEST_ENDPOINT,
+    ),
+    true,
+  );
+}
+
+async function runSkillSyncForCli(cwd, cli) {
+  enrollTestIdentity();
+  return runSkillSyncForCliImpl(cwd, cli);
+}
+
+async function runSkillSyncOnce(cwd, clis) {
+  enrollTestIdentity();
+  return runSkillSyncOnceImpl(cwd, clis);
+}
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const skillFixture = JSON.parse(
@@ -76,6 +101,7 @@ function createFetchStub(state) {
     }
 
     if (url.pathname.startsWith("/api/v1/govern/skills/")) {
+      if (typeof state.bodyFetches === "number") state.bodyFetches += 1;
       const name = decodeURIComponent(url.pathname.split("/").pop() ?? "");
       if (!(name in state.bodies)) {
         return {
@@ -275,3 +301,421 @@ test("runSkillSyncOnce: consumes the shared org-skillz contract fixture end-to-e
   );
   assert.ok(!fs.existsSync(skillPath(homeDir, "claude", "alpha-codex")));
 });
+
+test("runSkillSyncForCli: rejects unsafe remote names before fetching or writing skill bodies", async () => {
+  const { cwd } = makeWorkspace();
+  const homeDir = fs.mkdtempSync(path.join(os.tmpdir(), "cortex-skill-home-"));
+  process.env.HOME = homeDir;
+  const victimDir = path.join(homeDir, "Documents");
+  fs.mkdirSync(victimDir);
+  fs.writeFileSync(path.join(victimDir, "sentinel.txt"), "keep", "utf8");
+  let bodyFetches = 0;
+
+  globalThis.fetch = async (input) => {
+    const url = input instanceof URL ? input : new URL(input);
+    if (url.pathname.endsWith("/manifest")) {
+      return {
+        ok: true,
+        json: async () => ({
+          skills: [{
+            name: "../../Documents",
+            scope: "global",
+            updated_at: "2026-07-28T00:00:00.000Z",
+          }],
+        }),
+      };
+    }
+    bodyFetches += 1;
+    throw new Error("body fetch must not occur");
+  };
+
+  const outcome = await runSkillSyncForCli(cwd, "codex");
+  assert.equal(outcome.kind, "failed");
+  assert.match(outcome.error, /invalid skill name/);
+  assert.equal(bodyFetches, 0);
+  assert.equal(
+    fs.readFileSync(path.join(victimDir, "sentinel.txt"), "utf8"),
+    "keep",
+  );
+});
+
+test("runSkillSyncForCli: ignores persisted absolute paths when removing legacy state", async () => {
+  const { cwd } = makeWorkspace();
+  const homeDir = fs.mkdtempSync(path.join(os.tmpdir(), "cortex-skill-home-"));
+  process.env.HOME = homeDir;
+  const victimDir = path.join(homeDir, "Documents");
+  fs.mkdirSync(victimDir);
+  fs.writeFileSync(path.join(victimDir, "SKILL.md"), "not managed", "utf8");
+  fs.writeFileSync(path.join(victimDir, "sentinel.txt"), "keep", "utf8");
+  fs.mkdirSync(path.dirname(daemonStatePath(homeDir)), { recursive: true });
+  fs.writeFileSync(
+    daemonStatePath(homeDir),
+    JSON.stringify({
+      skills: {
+        "codex:safe-skill": {
+          cli: "codex",
+          scope: "global",
+          updated_at: "2026-07-27T00:00:00.000Z",
+          path: path.join(victimDir, "SKILL.md"),
+        },
+      },
+    }),
+    "utf8",
+  );
+  globalThis.fetch = createFetchStub({
+    manifests: { codex: [] },
+    bodies: {},
+  });
+
+  const outcome = await runSkillSyncForCli(cwd, "codex");
+  assert.equal(outcome.kind, "synced");
+  assert.deepEqual(outcome.removed, ["safe-skill"]);
+  assert.equal(
+    fs.readFileSync(path.join(victimDir, "sentinel.txt"), "utf8"),
+    "keep",
+  );
+  assert.equal(fs.existsSync(path.join(victimDir, "SKILL.md")), true);
+});
+
+test("runSkillSyncForCli: refuses to write through a managed skill directory symlink", {
+  skip: process.platform === "win32",
+}, async () => {
+  const { cwd } = makeWorkspace();
+  const homeDir = fs.mkdtempSync(path.join(os.tmpdir(), "cortex-skill-home-"));
+  process.env.HOME = homeDir;
+  const victimDir = path.join(homeDir, "victim");
+  const skillsRoot = path.join(homeDir, ".codex", "skills");
+  fs.mkdirSync(victimDir);
+  fs.mkdirSync(skillsRoot, { recursive: true });
+  fs.writeFileSync(path.join(victimDir, "SKILL.md"), "keep", "utf8");
+  fs.symlinkSync(victimDir, path.join(skillsRoot, "global-skill"), "dir");
+  const remote = {
+    bodyFetches: 0,
+    manifests: {
+      codex: [{
+        name: "global-skill",
+        scope: "global",
+        updated_at: "2026-07-28T00:00:00.000Z",
+      }],
+    },
+    bodies: {
+      "global-skill": "remote replacement",
+    },
+  };
+  globalThis.fetch = createFetchStub(remote);
+
+  const outcome = await runSkillSyncForCli(cwd, "codex");
+  assert.equal(outcome.kind, "failed");
+  assert.match(outcome.error, /symbolic link/);
+  assert.equal(remote.bodyFetches, 0);
+  assert.equal(
+    fs.readFileSync(path.join(victimDir, "SKILL.md"), "utf8"),
+    "keep",
+  );
+});
+
+test("runSkillSyncForCli: refuses to overwrite an unmanaged personal skill collision", async () => {
+  const { cwd } = makeWorkspace();
+  const homeDir = fs.mkdtempSync(path.join(os.tmpdir(), "cortex-skill-home-"));
+  process.env.HOME = homeDir;
+  const personalDir = path.dirname(
+    skillPath(homeDir, "codex", "global-skill"),
+  );
+  fs.mkdirSync(personalDir, { recursive: true });
+  fs.writeFileSync(
+    path.join(personalDir, "SKILL.md"),
+    "personal content",
+    "utf8",
+  );
+  fs.writeFileSync(path.join(personalDir, "notes.txt"), "keep", "utf8");
+  const remote = {
+    bodyFetches: 0,
+    manifests: {
+      codex: [{
+        name: "global-skill",
+        scope: "global",
+        updated_at: "2026-07-28T00:00:00.000Z",
+      }],
+    },
+    bodies: { "global-skill": "remote replacement" },
+  };
+  globalThis.fetch = createFetchStub(remote);
+
+  const outcome = await runSkillSyncForCli(cwd, "codex");
+  assert.equal(outcome.kind, "failed");
+  assert.match(outcome.error, /not owned by Cortex/);
+  assert.equal(remote.bodyFetches, 0);
+  assert.equal(
+    fs.readFileSync(path.join(personalDir, "SKILL.md"), "utf8"),
+    "personal content",
+  );
+  assert.equal(
+    fs.readFileSync(path.join(personalDir, "notes.txt"), "utf8"),
+    "keep",
+  );
+});
+
+test("runSkillSyncForCli: refuses a symlinked CLI skills root", {
+  skip: process.platform === "win32",
+}, async () => {
+  const { cwd } = makeWorkspace();
+  const homeDir = fs.mkdtempSync(path.join(os.tmpdir(), "cortex-skill-home-"));
+  process.env.HOME = homeDir;
+  const victimDir = path.join(homeDir, "outside");
+  const cliDir = path.join(homeDir, ".codex");
+  fs.mkdirSync(victimDir);
+  fs.mkdirSync(cliDir);
+  fs.symlinkSync(victimDir, path.join(cliDir, "skills"), "dir");
+  const remote = {
+    bodyFetches: 0,
+    manifests: {
+      codex: [{
+        name: "global-skill",
+        scope: "global",
+        updated_at: "2026-07-28T00:00:00.000Z",
+      }],
+    },
+    bodies: { "global-skill": "remote replacement" },
+  };
+  globalThis.fetch = createFetchStub(remote);
+
+  const outcome = await runSkillSyncForCli(cwd, "codex");
+  assert.equal(outcome.kind, "failed");
+  assert.match(outcome.error, /skills root must not be a symbolic link/);
+  assert.equal(remote.bodyFetches, 0);
+  assert.deepEqual(fs.readdirSync(victimDir), []);
+});
+
+test("runSkillSyncForCli: a second credential cannot mutate the first credential's managed skills", async () => {
+  const { cwd, contextDir } = makeWorkspace();
+  const homeDir = fs.mkdtempSync(path.join(os.tmpdir(), "cortex-skill-home-"));
+  process.env.HOME = homeDir;
+  const remote = {
+    manifests: {
+      codex: [{
+        name: "global-skill",
+        scope: "global",
+        updated_at: "2026-07-28T00:00:00.000Z",
+      }],
+    },
+    bodies: { "global-skill": "identity A" },
+  };
+  globalThis.fetch = createFetchStub(remote);
+
+  const first = await runSkillSyncForCli(cwd, "codex");
+  assert.equal(first.kind, "synced");
+  const installed = skillPath(homeDir, "codex", "global-skill");
+  assert.equal(fs.readFileSync(installed, "utf8"), "identity A");
+  assert.ok(
+    fs.existsSync(path.join(path.dirname(installed), ".cortex-managed.json")),
+  );
+
+  fs.writeFileSync(
+    path.join(contextDir, "enterprise.yml"),
+    [
+      "enterprise:",
+      "  api_key: ent_other_12345678",
+      "  endpoint: https://other.example.com",
+      "",
+    ].join("\n"),
+    "utf8",
+  );
+  remote.manifests.codex = [];
+
+  const second = await runSkillSyncForCli(cwd, "codex");
+  assert.equal(second.kind, "failed");
+  assert.match(second.error, /identity conflict/);
+  assert.equal(fs.readFileSync(installed, "utf8"), "identity A");
+});
+
+test("runSkillSyncForCli: removal refuses unowned files added to a managed directory", async () => {
+  const { cwd } = makeWorkspace();
+  const homeDir = fs.mkdtempSync(path.join(os.tmpdir(), "cortex-skill-home-"));
+  process.env.HOME = homeDir;
+  const remote = {
+    manifests: {
+      codex: [{
+        name: "global-skill",
+        scope: "global",
+        updated_at: "2026-07-28T00:00:00.000Z",
+      }],
+    },
+    bodies: { "global-skill": "managed" },
+  };
+  globalThis.fetch = createFetchStub(remote);
+  assert.equal((await runSkillSyncForCli(cwd, "codex")).kind, "synced");
+
+  const installedDir = path.dirname(
+    skillPath(homeDir, "codex", "global-skill"),
+  );
+  fs.writeFileSync(path.join(installedDir, "personal-note.txt"), "keep", "utf8");
+  remote.manifests.codex = [];
+
+  const outcome = await runSkillSyncForCli(cwd, "codex");
+  assert.equal(outcome.kind, "failed");
+  assert.match(outcome.error, /contains unowned files/);
+  assert.equal(
+    fs.readFileSync(path.join(installedDir, "personal-note.txt"), "utf8"),
+    "keep",
+  );
+});
+
+test("runSkillSyncForCli: refuses a managed SKILL.md symlink before fetching replacement content", {
+  skip: process.platform === "win32",
+}, async () => {
+  const { cwd } = makeWorkspace();
+  const homeDir = fs.mkdtempSync(path.join(os.tmpdir(), "cortex-skill-home-"));
+  process.env.HOME = homeDir;
+  const remote = {
+    bodyFetches: 0,
+    manifests: {
+      codex: [{
+        name: "global-skill",
+        scope: "global",
+        updated_at: "2026-07-28T00:00:00.000Z",
+      }],
+    },
+    bodies: { "global-skill": "managed v1" },
+  };
+  globalThis.fetch = createFetchStub(remote);
+  assert.equal((await runSkillSyncForCli(cwd, "codex")).kind, "synced");
+  assert.equal(remote.bodyFetches, 1);
+
+  const installed = skillPath(homeDir, "codex", "global-skill");
+  const victim = path.join(homeDir, "victim.txt");
+  fs.writeFileSync(victim, "keep", "utf8");
+  fs.unlinkSync(installed);
+  fs.symlinkSync(victim, installed);
+  remote.manifests.codex[0].updated_at = "2026-07-28T01:00:00.000Z";
+  remote.bodies["global-skill"] = "managed v2";
+
+  const outcome = await runSkillSyncForCli(cwd, "codex");
+  assert.equal(outcome.kind, "failed");
+  assert.match(outcome.error, /skill file must not be a symbolic link/);
+  assert.equal(remote.bodyFetches, 1);
+  assert.equal(fs.readFileSync(victim, "utf8"), "keep");
+});
+
+test("runSkillSyncForCli: rejects malformed manifest variants before any body fetch", async () => {
+  const variants = [
+    {
+      label: "absolute name",
+      manifest: [{
+        name: "/tmp/owned",
+        scope: "global",
+        updated_at: "2026-07-28T00:00:00.000Z",
+      }],
+    },
+    {
+      label: "separator-only name",
+      manifest: [{
+        name: "../",
+        scope: "global",
+        updated_at: "2026-07-28T00:00:00.000Z",
+      }],
+    },
+    {
+      label: "dot name",
+      manifest: [{
+        name: ".",
+        scope: "global",
+        updated_at: "2026-07-28T00:00:00.000Z",
+      }],
+    },
+    {
+      label: "malformed entry",
+      manifest: [null],
+    },
+    {
+      label: "invalid scope",
+      manifest: [{
+        name: "safe-name",
+        scope: "project",
+        updated_at: "2026-07-28T00:00:00.000Z",
+      }],
+    },
+    {
+      label: "missing timestamp",
+      manifest: [{
+        name: "safe-name",
+        scope: "global",
+        updated_at: "",
+      }],
+    },
+    {
+      label: "duplicate name",
+      manifest: [
+        {
+          name: "safe-name",
+          scope: "global",
+          updated_at: "2026-07-28T00:00:00.000Z",
+        },
+        {
+          name: "safe-name",
+          scope: "global",
+          updated_at: "2026-07-28T00:00:00.000Z",
+        },
+      ],
+    },
+  ];
+
+  for (const variant of variants) {
+    const { cwd } = makeWorkspace();
+    const homeDir = fs.mkdtempSync(path.join(os.tmpdir(), "cortex-skill-home-"));
+    process.env.HOME = homeDir;
+    let bodyFetches = 0;
+    globalThis.fetch = async (input) => {
+      const url = input instanceof URL ? input : new URL(input);
+      if (url.pathname.endsWith("/manifest")) {
+        return {
+          ok: true,
+          status: 200,
+          statusText: "OK",
+          json: async () => ({ skills: variant.manifest }),
+        };
+      }
+      bodyFetches += 1;
+      throw new Error("body fetch must not occur");
+    };
+    const outcome = await runSkillSyncForCli(cwd, "codex");
+    assert.equal(outcome.kind, "failed", variant.label);
+    assert.equal(bodyFetches, 0, variant.label);
+  }
+});
+
+test("runSkillSyncForCli: sanitizes an unsafe legacy state key without filesystem mutation", async () => {
+  const { cwd } = makeWorkspace();
+  const homeDir = fs.mkdtempSync(path.join(os.tmpdir(), "cortex-skill-home-"));
+  process.env.HOME = homeDir;
+  const victimDir = path.join(homeDir, "Documents");
+  fs.mkdirSync(victimDir);
+  fs.writeFileSync(path.join(victimDir, "sentinel.txt"), "keep", "utf8");
+  fs.mkdirSync(path.dirname(daemonStatePath(homeDir)), { recursive: true });
+  fs.writeFileSync(
+    daemonStatePath(homeDir),
+    JSON.stringify({
+      skills: {
+        "codex:../../Documents": {
+          cli: "codex",
+          scope: "global",
+          updated_at: "2026-07-27T00:00:00.000Z",
+          path: victimDir,
+        },
+      },
+    }),
+    "utf8",
+  );
+  globalThis.fetch = createFetchStub({
+    manifests: { codex: [] },
+    bodies: {},
+  });
+
+  const outcome = await runSkillSyncForCli(cwd, "codex");
+  assert.equal(outcome.kind, "unchanged");
+  assert.equal(
+    fs.readFileSync(path.join(victimDir, "sentinel.txt"), "utf8"),
+    "keep",
+  );
+  const state = JSON.parse(fs.readFileSync(daemonStatePath(homeDir), "utf8"));
+  assert.deepEqual(state.skills, {});
+});