@danielblomma/cortex-mcp 2.4.0 → 2.4.1

package/scaffold/mcp/dist/graphCsv.js

@@ -0,0 +1,55 @@
+import fs from "node:fs";
+// ryugraph's CSV reader treats an empty field as NULL by default
+// (DEFAULT_CSV_NULL_STRINGS = {""}), so a quoted empty string round-trips to
+// null rather than "". Every column the graph loader emits is a real
+// string/number/bool produced by asString/asNumber/asBoolean — never null —
+// so we override NULL_STRINGS with a sentinel that cannot occur in any cell.
+// A NUL byte qualifies: ingest's binary-file filter rejects any source file
+// containing one, and filesystem paths and computed ids cannot contain NUL
+// either. This keeps empty strings as "" and matches the prepared-statement
+// loader byte-for-byte.
+export const CSV_NULL_SENTINEL = String.fromCharCode(0);
+// PARALLEL=false is required: ryugraph's parallel CSV reader rejects quoted
+// newlines, and chunk/rule/ADR bodies routinely contain them. ESCAPE='"'
+// plus QUOTE='"' is RFC 4180 style (a literal quote is written as "").
+export const CSV_COPY_OPTIONS = `(HEADER=true, DELIM=",", QUOTE='"', ESCAPE='"', PARALLEL=false, NULL_STRINGS=['${CSV_NULL_SENTINEL}'])`;
+// Every cell is quoted unconditionally and internal quotes are doubled. The
+// reader coerces quoted "true"/"123" back to BOOL/INT64 columns, so a single
+// uniform escaping path covers strings, numbers, and booleans.
+export function toCsvCell(value) {
+    const text = value === null || value === undefined
+        ? ""
+        : typeof value === "boolean"
+            ? value
+                ? "true"
+                : "false"
+            : String(value);
+    return `"${text.replace(/"/g, '""')}"`;
+}
+export function toCsvRow(values) {
+    return values.map(toCsvCell).join(",");
+}
+export function writeCsv(filePath, header, rows) {
+    const fd = fs.openSync(filePath, "w");
+    let rowCount = 0;
+    try {
+        fs.writeSync(fd, `${toCsvRow(header)}\n`, undefined, "utf8");
+        for (const row of rows) {
+            fs.writeSync(fd, `${toCsvRow(row)}\n`, undefined, "utf8");
+            rowCount += 1;
+        }
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+    return rowCount;
+}
+// Escape a filesystem path for use inside a double-quoted ryugraph COPY path
+// literal. Separators are normalized to "/" (accepted on every platform,
+// Windows included) and any embedded double quote is backslash-escaped, so a
+// repo or cache path containing a quote does not break the COPY statement and
+// silently lose the bulk-load path. Order matters: normalize separators first,
+// then escape quotes, so the escaping backslash is not itself rewritten.
+export function toCopyPathLiteral(filePath) {
+    return filePath.replace(/\\/g, "/").replace(/"/g, '\\"');
+}

package/scaffold/mcp/dist/graphMetrics.js

@@ -0,0 +1,8 @@
+export function relationDegree(relations) {
+    const degrees = new Map();
+    for (const relation of relations) {
+        degrees.set(relation.from, (degrees.get(relation.from) ?? 0) + 1);
+        degrees.set(relation.to, (degrees.get(relation.to) ?? 0) + 1);
+    }
+    return degrees;
+}

package/scaffold/mcp/dist/hooks/permission-request.js

@@ -0,0 +1,89 @@
+import { call } from "../daemon/client.js";
+import { evaluateToolCall } from "../core/workflow/enforcement.js";
+import { ensureDaemon, isEnterpriseProject, normalizeToolCall, parseInput, readStdin, resolveDaemonEntry, sendHeartbeat, serializeForAudit, getStringField, } from "./shared.js";
+async function main() {
+    const raw = await readStdin();
+    const input = parseInput(raw);
+    const normalized = normalizeToolCall(input);
+    const enterprise = isEnterpriseProject(normalized.cwd);
+    ensureDaemon(resolveDaemonEntry(import.meta.url));
+    if (normalized.sessionId) {
+        void sendHeartbeat({
+            cli: "codex",
+            hook: "PermissionRequest",
+            session_id: normalized.sessionId,
+            cwd: normalized.cwd,
+        });
+    }
+    const activeTaskId = process.env.CORTEX_ACTIVE_TASK_ID?.trim();
+    if (activeTaskId) {
+        try {
+            const verdict = evaluateToolCall({
+                cwd: normalized.cwd,
+                taskId: activeTaskId,
+                call: { toolName: normalized.toolName, toolInput: normalized.toolInput },
+            });
+            if (!verdict.allowed) {
+                process.stderr.write(`[cortex] Permission denied by workflow: ${verdict.reason}\n`);
+                process.exit(2);
+            }
+        }
+        catch (err) {
+            process.stderr.write(`[cortex] permission capability evaluation failed (${err instanceof Error ? err.message : String(err)}); deferring to policy.check\n`);
+        }
+    }
+    const policyPayload = {
+        tool: normalized.toolName,
+        cwd: normalized.cwd,
+        input: normalized.toolInput,
+    };
+    const policyRes = await call("policy.check", policyPayload, {
+        timeoutMs: 5000,
+    });
+    const approvalReason = getStringField(input, ["reason", "permission_reason", "permissionReason"]);
+    const auditPayload = {
+        cwd: normalized.cwd,
+        entry: {
+            timestamp: new Date().toISOString(),
+            tool: "permission.request",
+            input: {
+                tool_name: normalized.toolName,
+                command: normalized.toolInput.command ?? null,
+                prefix_rule: normalized.toolInput.prefix_rule ?? null,
+                sandbox_permissions: normalized.toolInput.sandbox_permissions ?? null,
+            },
+            event_type: "session",
+            evidence_level: "diagnostic",
+            resource_type: "approval_request",
+            session_id: normalized.sessionId,
+            metadata: {
+                tool_name: normalized.toolName,
+                reason: approvalReason ?? null,
+                command_preview: serializeForAudit(normalized.toolInput.command),
+            },
+            ...(policyRes.ok && !policyRes.result.allow
+                ? {
+                    status: "error",
+                }
+                : {}),
+        },
+    };
+    void call("audit.log", auditPayload, { timeoutMs: 3000 });
+    if (policyRes.ok) {
+        if (policyRes.result.allow) {
+            process.exit(0);
+        }
+        process.stderr.write(`[cortex] Permission denied by policy: ${policyRes.result.reason ?? "unspecified"}\n`);
+        process.exit(2);
+    }
+    if (enterprise) {
+        process.stderr.write(`[cortex] Enterprise daemon unreachable (${policyRes.error}). Denying permission per fail-closed policy.\n`);
+        process.exit(2);
+    }
+    process.stderr.write(`[cortex] Daemon unreachable (${policyRes.error}). Allowing permission request (community mode).\n`);
+    process.exit(0);
+}
+main().catch((err) => {
+    process.stderr.write(`[cortex permission-request] error: ${err instanceof Error ? err.message : String(err)}\n`);
+    process.exit(0);
+});

package/scaffold/mcp/dist/hooks/post-tool-use.js

@@ -0,0 +1,105 @@
+import { call } from "../daemon/client.js";
+import { evaluateToolCall } from "../core/workflow/enforcement.js";
+import { ensureDaemon, getBooleanField, getNumberField, getRecordField, getStringField, isEnterpriseProject, normalizeToolCall, parseInput, readStdin, resolveDaemonEntry, sendHeartbeat, serializeForAudit, } from "./shared.js";
+function extractToolOutput(input) {
+    const record = getRecordField(input, ["tool_output", "toolOutput", "tool_result", "toolResult", "result"]) ??
+        {};
+    const outputText = getStringField(input, ["output", "stdout", "stderr"]);
+    if (outputText && record.output === undefined) {
+        record.output = outputText;
+    }
+    const success = getBooleanField(input, ["success"]);
+    if (success !== undefined && record.success === undefined) {
+        record.success = success;
+    }
+    const exitCode = getNumberField(input, ["exit_code", "exitCode"]);
+    if (exitCode !== undefined && record.exit_code === undefined) {
+        record.exit_code = exitCode;
+    }
+    return record;
+}
+async function main() {
+    const raw = await readStdin();
+    const input = parseInput(raw);
+    const normalized = normalizeToolCall(input);
+    const enterprise = isEnterpriseProject(normalized.cwd);
+    const toolOutput = extractToolOutput(input);
+    ensureDaemon(resolveDaemonEntry(import.meta.url));
+    if (normalized.sessionId) {
+        void sendHeartbeat({
+            cli: "codex",
+            hook: "PostToolUse",
+            session_id: normalized.sessionId,
+            cwd: normalized.cwd,
+        });
+    }
+    const success = getBooleanField(input, ["success"]) ??
+        (typeof toolOutput.exit_code === "number" ? toolOutput.exit_code === 0 : undefined);
+    const durationMs = getNumberField(input, ["duration_ms", "durationMs"]);
+    const auditPayload = {
+        cwd: normalized.cwd,
+        entry: {
+            timestamp: new Date().toISOString(),
+            tool: normalized.toolName,
+            input: normalized.toolInput,
+            event_type: "tool",
+            evidence_level: "diagnostic",
+            resource_type: "tool_result",
+            session_id: normalized.sessionId,
+            ...(durationMs !== undefined ? { duration_ms: durationMs } : {}),
+            ...(success !== undefined
+                ? { status: success ? "success" : "error" }
+                : {}),
+            metadata: {
+                hook: "PostToolUse",
+                tool_output_preview: serializeForAudit(toolOutput),
+            },
+        },
+    };
+    void call("audit.log", auditPayload, { timeoutMs: 3000 });
+    const activeTaskId = process.env.CORTEX_ACTIVE_TASK_ID?.trim();
+    if (activeTaskId) {
+        try {
+            const verdict = evaluateToolCall({
+                cwd: normalized.cwd,
+                taskId: activeTaskId,
+                call: { toolName: normalized.toolName, toolInput: normalized.toolInput },
+            });
+            if (!verdict.allowed) {
+                process.stderr.write(`[cortex] Blocked after tool execution: ${verdict.reason}\n`);
+                process.exit(2);
+            }
+        }
+        catch (err) {
+            process.stderr.write(`[cortex] post-tool capability evaluation failed (${err instanceof Error ? err.message : String(err)}); deferring to policy.check\n`);
+        }
+    }
+    if (Object.keys(toolOutput).length === 0) {
+        process.exit(0);
+    }
+    const policyPayload = {
+        tool: `${normalized.toolName}.result`,
+        cwd: normalized.cwd,
+        input: toolOutput,
+    };
+    const policyRes = await call("policy.check", policyPayload, {
+        timeoutMs: 5000,
+    });
+    if (policyRes.ok) {
+        if (policyRes.result.allow) {
+            process.exit(0);
+        }
+        process.stderr.write(`[cortex] Blocked after tool execution by policy: ${policyRes.result.reason ?? "unspecified"}\n`);
+        process.exit(2);
+    }
+    if (enterprise) {
+        process.stderr.write(`[cortex] Enterprise daemon unreachable (${policyRes.error}). Blocking continuation per fail-closed policy.\n`);
+        process.exit(2);
+    }
+    process.stderr.write(`[cortex] Daemon unreachable (${policyRes.error}). Allowing continuation (community mode).\n`);
+    process.exit(0);
+}
+main().catch((err) => {
+    process.stderr.write(`[cortex post-tool-use] error: ${err instanceof Error ? err.message : String(err)}\n`);
+    process.exit(0);
+});

package/scaffold/mcp/dist/hooks/pre-compact.js

@@ -0,0 +1,29 @@
+import { call } from "../daemon/client.js";
+import { ensureDaemon, parseInput, readStdin, resolveDaemonEntry, } from "./shared.js";
+async function main() {
+    const raw = await readStdin();
+    const input = parseInput(raw);
+    const cwd = input.cwd ?? process.cwd();
+    ensureDaemon(resolveDaemonEntry(import.meta.url));
+    const payload = {
+        cwd,
+        entry: {
+            timestamp: new Date().toISOString(),
+            tool: "session.pre_compact",
+            input: {
+                session_id: input.session_id ?? null,
+                context_size_tokens: input.context_size_tokens ?? null,
+            },
+            event_type: "session",
+            evidence_level: "diagnostic",
+            resource_type: "session",
+            session_id: input.session_id,
+            metadata: {
+                context_size_tokens: input.context_size_tokens ?? null,
+            },
+        },
+    };
+    await call("audit.log", payload, { timeoutMs: 3000 });
+    process.exit(0);
+}
+main().catch(() => process.exit(0));

package/scaffold/mcp/dist/hooks/pre-tool-use.js

@@ -0,0 +1,78 @@
+import { call } from "../daemon/client.js";
+import { ensureDaemon, isEnterpriseProject, parseInput, readStdin, resolveDaemonEntry, sendHeartbeat, } from "./shared.js";
+import { evaluateToolCall } from "../core/workflow/enforcement.js";
+async function main() {
+    const raw = await readStdin();
+    const input = parseInput(raw);
+    const cwd = input.cwd || process.cwd();
+    const tool = input.tool_name || "unknown";
+    const enterprise = isEnterpriseProject(cwd);
+    // Try to bring the daemon up if it's not already.
+    ensureDaemon(resolveDaemonEntry(import.meta.url));
+    if (input.session_id) {
+        void sendHeartbeat({
+            cli: "claude",
+            hook: "PreToolUse",
+            session_id: input.session_id,
+            cwd,
+        });
+    }
+    // Workflow capability gate. Runs before policy.check so harness-level
+    // restrictions block before the daemon's general policy machinery sees
+    // the call. No-op when CORTEX_ACTIVE_TASK_ID is unset.
+    const activeTaskId = process.env.CORTEX_ACTIVE_TASK_ID?.trim();
+    if (activeTaskId) {
+        try {
+            const verdict = evaluateToolCall({
+                cwd,
+                taskId: activeTaskId,
+                call: { toolName: tool, toolInput: input.tool_input ?? {} },
+            });
+            if (!verdict.allowed) {
+                process.stderr.write(`[cortex] Blocked by harness capability: ${verdict.reason}\n`);
+                process.exit(2);
+            }
+        }
+        catch (err) {
+            // Capability evaluation should never crash the hook — if it does,
+            // log and fall through to the existing policy.check rather than
+            // accidentally blocking a legitimate tool.
+            process.stderr.write(`[cortex] capability evaluation failed (${err instanceof Error ? err.message : String(err)}); deferring to policy.check\n`);
+        }
+    }
+    const payload = {
+        tool,
+        cwd,
+        input: input.tool_input ?? {},
+    };
+    const res = await call("policy.check", payload, {
+        timeoutMs: 5000,
+    });
+    if (res.ok) {
+        if (res.result.allow) {
+            process.exit(0);
+        }
+        else {
+            // Hook spec: exit 2 + stderr message → Claude Code blocks the tool.
+            process.stderr.write(`[cortex] Blocked by policy: ${res.result.reason ?? "unspecified"}\n`);
+            process.exit(2);
+        }
+    }
+    // Daemon unreachable — apply split fail-mode.
+    if (enterprise) {
+        process.stderr.write(`[cortex] Enterprise daemon unreachable (${res.error}). Blocking tool per fail-closed policy.\n`);
+        process.stderr.write("[cortex] Start the daemon with: cortex daemon start\n");
+        process.exit(2);
+    }
+    else {
+        process.stderr.write(`[cortex] Daemon unreachable (${res.error}). Allowing tool (community mode).\n`);
+        process.exit(0);
+    }
+}
+main().catch((err) => {
+    process.stderr.write(`[cortex pre-tool-use] error: ${err instanceof Error ? err.message : String(err)}\n`);
+    // Hook errors should not block the user — fail-open on internal exceptions
+    // regardless of mode. The split fail-mode applies only to the explicit
+    // "daemon unreachable" path above.
+    process.exit(0);
+});

package/scaffold/mcp/dist/hooks/session-end.js

@@ -0,0 +1,43 @@
+import { call } from "../daemon/client.js";
+import { ensureDaemon, parseInput, readStdin, resolveDaemonEntry, sendHeartbeat, } from "./shared.js";
+async function main() {
+    const raw = await readStdin();
+    const input = parseInput(raw);
+    const cwd = input.cwd ?? process.cwd();
+    ensureDaemon(resolveDaemonEntry(import.meta.url));
+    // Audit first — even if telemetry push fails, we want the session-end
+    // record locally so cortex-web can later derive missing data.
+    const auditPayload = {
+        cwd,
+        entry: {
+            timestamp: new Date().toISOString(),
+            tool: "session.end",
+            input: { session_id: input.session_id ?? null },
+            event_type: "session",
+            evidence_level: "diagnostic",
+            resource_type: "session",
+            session_id: input.session_id,
+        },
+    };
+    await call("audit.log", auditPayload, { timeoutMs: 3000 });
+    // Final flush — best-effort, may have nothing on disk if MCP already
+    // flushed during shutdown.
+    const flushPayload = {
+        reason: "session_end",
+        session_id: input.session_id,
+        cwd,
+    };
+    await call("telemetry.flush", flushPayload, {
+        timeoutMs: 5000,
+    });
+    if (input.session_id) {
+        await sendHeartbeat({
+            cli: "claude",
+            hook: "SessionEnd",
+            session_id: input.session_id,
+            cwd,
+        });
+    }
+    process.exit(0);
+}
+main().catch(() => process.exit(0));

package/scaffold/mcp/dist/hooks/session-start.js

@@ -0,0 +1,41 @@
+import { call } from "../daemon/client.js";
+import { ensureDaemon, isEnforcedMode, parseInput, readStdin, readTamperLockJson, resolveDaemonEntry, sendHeartbeat, } from "./shared.js";
+async function main() {
+    const raw = await readStdin();
+    const input = parseInput(raw);
+    const cwd = input.cwd ?? process.cwd();
+    const sessionId = input.session_id ?? "";
+    // Tamper-lock check happens BEFORE we spawn the daemon. We don't want
+    // a tampered project to keep getting fresh daemons started.
+    const lock = readTamperLockJson(cwd);
+    if (lock && isEnforcedMode(cwd)) {
+        process.stderr.write("[cortex] Govern enforced: session blocked because hook tampering was detected.\n" +
+            "        Run 'sudo cortex enterprise repair' to verify managed-settings\n" +
+            "        integrity and clear .context/.cortex-tamper.lock, then retry.\n");
+        process.exit(2);
+    }
+    ensureDaemon(resolveDaemonEntry(import.meta.url));
+    const payload = {
+        cwd,
+        entry: {
+            timestamp: new Date().toISOString(),
+            tool: "session.start",
+            input: { session_id: sessionId || null },
+            event_type: "session",
+            evidence_level: "diagnostic",
+            resource_type: "session",
+            session_id: sessionId,
+        },
+    };
+    await call("audit.log", payload, { timeoutMs: 3000 });
+    if (sessionId) {
+        await sendHeartbeat({
+            cli: "claude",
+            hook: "SessionStart",
+            session_id: sessionId,
+            cwd,
+        });
+    }
+    process.exit(0);
+}
+main().catch(() => process.exit(0));

package/scaffold/mcp/dist/hooks/shared.js

@@ -0,0 +1,194 @@
+import { readFileSync, existsSync } from "node:fs";
+import { join } from "node:path";
+import { call, isDaemonRunning, spawnDaemon } from "../daemon/client.js";
+import { fileURLToPath } from "node:url";
+export async function readStdin() {
+    return new Promise((resolve) => {
+        let data = "";
+        process.stdin.setEncoding("utf8");
+        process.stdin.on("data", (chunk) => {
+            data += chunk;
+        });
+        process.stdin.on("end", () => resolve(data));
+        // If stdin is a TTY (running interactively for testing), don't hang.
+        if (process.stdin.isTTY)
+            resolve("");
+    });
+}
+export function parseInput(raw) {
+    if (!raw.trim())
+        return {};
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return {};
+    }
+}
+function isRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+export function getStringField(input, keys) {
+    for (const key of keys) {
+        const value = input[key];
+        if (typeof value === "string" && value.trim())
+            return value;
+    }
+    return undefined;
+}
+export function getNumberField(input, keys) {
+    for (const key of keys) {
+        const value = input[key];
+        if (typeof value === "number" && Number.isFinite(value))
+            return value;
+    }
+    return undefined;
+}
+export function getBooleanField(input, keys) {
+    for (const key of keys) {
+        const value = input[key];
+        if (typeof value === "boolean")
+            return value;
+    }
+    return undefined;
+}
+export function getRecordField(input, keys) {
+    for (const key of keys) {
+        const value = input[key];
+        if (isRecord(value))
+            return value;
+    }
+    return undefined;
+}
+export function normalizeToolInput(value) {
+    if (isRecord(value))
+        return value;
+    return {};
+}
+export function normalizeToolCall(input) {
+    const cwd = getStringField(input, ["cwd", "working_directory", "workingDirectory"]) ?? process.cwd();
+    const sessionId = getStringField(input, ["session_id", "sessionId"]);
+    const toolName = getStringField(input, ["tool_name", "toolName", "tool"]) ??
+        (typeof input.command === "string" ? "Bash" : "unknown");
+    const toolInput = getRecordField(input, ["tool_input", "toolInput", "tool_args", "toolArgs", "input", "args"]) ??
+        {};
+    if (typeof input.command === "string" && toolInput.command === undefined) {
+        toolInput.command = input.command;
+    }
+    if (Array.isArray(input.prefix_rule) && toolInput.prefix_rule === undefined) {
+        toolInput.prefix_rule = input.prefix_rule;
+    }
+    if (typeof input.sandbox_permissions === "string" &&
+        toolInput.sandbox_permissions === undefined) {
+        toolInput.sandbox_permissions = input.sandbox_permissions;
+    }
+    return {
+        cwd,
+        ...(sessionId ? { sessionId } : {}),
+        toolName,
+        toolInput,
+    };
+}
+export function serializeForAudit(value, maxLen = 1200) {
+    if (value === undefined)
+        return undefined;
+    const raw = typeof value === "string"
+        ? value
+        : (() => {
+            try {
+                return JSON.stringify(value);
+            }
+            catch {
+                return String(value);
+            }
+        })();
+    if (!raw)
+        return undefined;
+    return raw.length <= maxLen ? raw : `${raw.slice(0, maxLen)}...`;
+}
+/**
+ * Detect whether the current project is running enterprise mode.
+ * Lightweight YAML peek — we don't want to load the full config parser
+ * on every hook invocation.
+ */
+export function isEnterpriseProject(cwd) {
+    const candidates = [
+        join(cwd, ".context", "enterprise.yml"),
+        join(cwd, ".context", "enterprise.yaml"),
+    ];
+    for (const path of candidates) {
+        if (!existsSync(path))
+            continue;
+        try {
+            const raw = readFileSync(path, "utf8");
+            // Look for an api_key under enterprise: section.
+            // Conservative: any non-empty api_key value implies "intent to be enterprise".
+            const match = raw.match(/^\s*api_key:\s*(\S.*?)\s*$/m);
+            if (match && match[1] && match[1] !== "")
+                return true;
+        }
+        catch {
+            // ignore
+        }
+    }
+    return false;
+}
+export function ensureDaemon(daemonEntry) {
+    if (isDaemonRunning())
+        return;
+    spawnDaemon(daemonEntry);
+}
+/**
+ * Resolve daemon entry script path relative to this hook script's location.
+ * Hooks live at dist/hooks/<name>.js, daemon at dist/daemon/main.js.
+ */
+export function resolveDaemonEntry(hookFileUrl) {
+    const hookPath = fileURLToPath(hookFileUrl);
+    // dist/hooks/<x>.js → dist/daemon/main.js
+    return join(hookPath, "..", "..", "daemon", "main.js");
+}
+/**
+ * Send a heartbeat to the daemon for tamper-detection bookkeeping.
+ * Failure to reach the daemon is non-fatal — daemon-down is treated as
+ * "we don't know" rather than tamper. Returns whether the daemon
+ * reported an active tamper-lock for this cwd.
+ */
+export async function sendHeartbeat(payload) {
+    const result = await call("heartbeat", { ...payload, ts: new Date().toISOString() }, { timeoutMs: 1500 });
+    if (!result.ok)
+        return { tamperLockActive: false };
+    return { tamperLockActive: result.result.tamper_lock_active === true };
+}
+const TAMPER_LOCK_FILENAME = ".cortex-tamper.lock";
+export function readTamperLockJson(cwd) {
+    const path = join(cwd, ".context", TAMPER_LOCK_FILENAME);
+    if (!existsSync(path))
+        return null;
+    try {
+        return JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * True iff this cwd is in enforced govern mode. Reads govern.local.json,
+ * which is written by the install/install-flow. We don't fall back to
+ * enterprise.yml because the user's intent is captured at install time.
+ */
+export function isEnforcedMode(cwd) {
+    const path = join(cwd, ".context", "govern.local.json");
+    if (!existsSync(path))
+        return false;
+    try {
+        const parsed = JSON.parse(readFileSync(path, "utf8"));
+        for (const inst of Object.values(parsed.installs ?? {})) {
+            if (inst.mode === "enforced")
+                return true;
+        }
+        return false;
+    }
+    catch {
+        return false;
+    }
+}

package/scaffold/mcp/dist/hooks/stop.js

@@ -0,0 +1,28 @@
+import { call } from "../daemon/client.js";
+import { ensureDaemon, parseInput, readStdin, resolveDaemonEntry, } from "./shared.js";
+async function main() {
+    const raw = await readStdin();
+    const input = parseInput(raw);
+    ensureDaemon(resolveDaemonEntry(import.meta.url));
+    const payload = {
+        reason: "stop",
+        session_id: input.session_id,
+        cwd: input.cwd ?? process.cwd(),
+    };
+    const res = await call("telemetry.flush", payload, {
+        timeoutMs: 5000,
+    });
+    if (res.ok && res.result.flushed) {
+        process.stderr.write(`[cortex] Telemetry flushed: ${res.result.events_pushed} events\n`);
+    }
+    else if (!res.ok) {
+        // Best-effort: silent in normal output. Daemon-reachability is logged
+        // through other channels (PreToolUse warnings, daemon log).
+        process.stderr.write(`[cortex] Telemetry flush skipped: ${res.error}\n`);
+    }
+    process.exit(0);
+}
+main().catch(() => {
+    // Telemetry must never block. Swallow all errors.
+    process.exit(0);
+});