@danielblomma/cortex-mcp 2.4.0 → 2.4.1

package/bin/daemon-control.mjs

@@ -0,0 +1,162 @@
+import { randomUUID } from "node:crypto";
+import { connect } from "node:net";
+import { tmpdir, userInfo } from "node:os";
+import { join } from "node:path";
+
+function daemonSocketPath() {
+  if (process.env.CORTEX_DAEMON_SOCKET_PATH?.trim()) {
+    return process.env.CORTEX_DAEMON_SOCKET_PATH.trim();
+  }
+  let uid = "anon";
+  try {
+    const info = userInfo();
+    uid =
+      typeof info.uid === "number" && info.uid >= 0
+        ? String(info.uid)
+        : info.username || uid;
+  } catch {
+    // Keep anonymous fallback.
+  }
+  return join(tmpdir(), `cortex-${uid}.sock`);
+}
+
+export async function callDaemon(
+  type,
+  payload,
+  options = {},
+) {
+  const timeoutMs = options.timeoutMs ?? 750;
+  const id = randomUUID();
+  return new Promise((resolve) => {
+    const socket = connect(daemonSocketPath());
+    let buffer = "";
+    let settled = false;
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      socket.destroy();
+      resolve(result);
+    };
+    const timer = setTimeout(
+      () => finish({ ok: false, error: "timeout" }),
+      timeoutMs,
+    );
+    timer.unref();
+    socket.once("connect", () => {
+      socket.write(`${JSON.stringify({ id, type, payload })}\n`);
+    });
+    socket.on("data", (chunk) => {
+      buffer += chunk.toString("utf8");
+      const newline = buffer.indexOf("\n");
+      if (newline < 0) return;
+      try {
+        const response = JSON.parse(buffer.slice(0, newline));
+        if (response.id !== id) {
+          finish({ ok: false, error: "invalid_response" });
+        } else if (response.ok) {
+          finish({ ok: true, result: response.result });
+        } else {
+          finish({ ok: false, error: response.error ?? "unknown_error" });
+        }
+      } catch {
+        finish({ ok: false, error: "invalid_response" });
+      }
+    });
+    socket.once("error", () => {
+      finish({ ok: false, error: "daemon_unreachable" });
+    });
+  });
+}
+
+export async function probeVerifiedDaemon(deps, timeoutMs = 750) {
+  const pidFromFile = deps.readPid();
+  let response;
+  try {
+    response = await deps.call("ping", {}, { timeoutMs, autoStart: false });
+  } catch {
+    response = { ok: false, error: "daemon_unreachable" };
+  }
+
+  const socketPid =
+    response?.ok &&
+    response.result?.pong === true &&
+    Number.isInteger(response.result?.pid) &&
+    response.result.pid > 0
+      ? response.result.pid
+      : null;
+  if (socketPid && deps.isPidAlive(socketPid)) {
+    if (pidFromFile && pidFromFile !== socketPid) {
+      return {
+        running: true,
+        verified: false,
+        pid: socketPid,
+        reason: "pid_file_socket_mismatch",
+      };
+    }
+    return {
+      running: true,
+      verified: true,
+      pid: socketPid,
+      reason: null,
+    };
+  }
+
+  if (pidFromFile && deps.isPidAlive(pidFromFile)) {
+    return {
+      running: true,
+      verified: false,
+      pid: pidFromFile,
+      reason: socketPid
+        ? "pid_file_socket_mismatch"
+        : "live_pid_without_daemon_handshake",
+    };
+  }
+  return {
+    running: false,
+    verified: false,
+    pid: null,
+    reason: pidFromFile ? "stale_pid_file" : "not_running",
+  };
+}
+
+export async function stopVerifiedDaemon(
+  deps,
+  options = {},
+) {
+  const timeoutMs = options.timeoutMs ?? 5_000;
+  const pollMs = options.pollMs ?? 50;
+  const probe = await probeVerifiedDaemon(deps);
+  if (!probe.running) return { stopped: false, pid: null };
+  if (!probe.verified || !probe.pid) {
+    throw new Error(
+      `Refusing to signal an unverified process (${probe.reason ?? "unknown identity"}).`,
+    );
+  }
+
+  const response = await deps.call(
+    "shutdown",
+    {},
+    { timeoutMs: Math.min(timeoutMs, 1_000), autoStart: false },
+  );
+  if (!response?.ok) {
+    throw new Error(
+      `Daemon rejected the authenticated shutdown request: ${response?.error ?? "unknown error"}`,
+    );
+  }
+
+  const deadline = Date.now() + timeoutMs;
+  while (deps.isPidAlive(probe.pid) && Date.now() < deadline) {
+    await (options.wait ?? defaultWait)(pollMs);
+  }
+  if (deps.isPidAlive(probe.pid)) {
+    throw new Error(
+      `Verified daemon pid ${probe.pid} did not stop within ${timeoutMs}ms.`,
+    );
+  }
+  return { stopped: true, pid: probe.pid };
+}
+
+function defaultWait(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@danielblomma/cortex-mcp",
   "mcpName": "io.github.DanielBlomma/cortex",
-  "version": "2.4.0",
+  "version": "2.4.1",
   "description": "Local, repo-scoped context platform for coding assistants. Semantic search, graph relationships, and architectural rule context.",
   "type": "module",
   "author": "Daniel Blomma",
@@ -54,22 +54,26 @@
     "scaffold/scripts/parsers/dotnet/*/*.csproj",
     "scaffold/scripts/parsers/dotnet/*/Program.cs",
     "scaffold/mcp/src",
+    "scaffold/mcp/dist",
     "scaffold/mcp/tests",
     "scaffold/mcp/build.mjs",
     "scaffold/mcp/package.json",
     "scaffold/mcp/package-lock.json",
     "scaffold/mcp/tsconfig.json",
     "README.md",
+    "CHANGELOG.md",
     "mcp-registry-submission.json"
   ],
   "scripts": {
+    "prepack": "npm --prefix scaffold/mcp run build",
     "pretest": "test -d scaffold/scripts/parsers/node_modules || npm --prefix scaffold/scripts/parsers install --no-fund --no-update-notifier --silent",
-    "test": "node tests/context-regressions.test.mjs && node --test tests/ingest-units.test.mjs tests/ingest-parallel.test.mjs tests/ingest-worker-crash.test.mjs tests/javascript-parser.test.mjs tests/markdown-parser.test.mjs tests/sql-parser.test.mjs tests/config-parser.test.mjs tests/resources-parser.test.mjs tests/vbnet-parser.test.mjs tests/cpp-parser.test.mjs tests/dashboard.test.mjs tests/init-config.test.mjs tests/init-agents.test.mjs tests/multi-level.test.mjs tests/no-legacy-paths.test.mjs tests/tree-sitter-error-reporting.test.mjs tests/tree-sitter-body-cap.test.mjs tests/tree-sitter-exported.test.mjs tests/tree-sitter-robustness.test.mjs tests/bootstrapbench-run.test.mjs tests/bootstrapbench-stats.test.mjs tests/bootstrapbench-aggregate.test.mjs tests/bootstrapbench-cleanup.test.mjs tests/bootstrapbench-query-packs.test.mjs tests/query-cli-shim.test.mjs tests/session-bootstrap.test.mjs tests/plugin-skills.test.mjs tests/plugin-manifests.test.mjs",
+    "test": "node tests/context-regressions.test.mjs && node --test tests/ingest-units.test.mjs tests/ingest-parallel.test.mjs tests/ingest-worker-crash.test.mjs tests/javascript-parser.test.mjs tests/markdown-parser.test.mjs tests/sql-parser.test.mjs tests/config-parser.test.mjs tests/resources-parser.test.mjs tests/vbnet-parser.test.mjs tests/cpp-parser.test.mjs tests/dashboard.test.mjs tests/init-config.test.mjs tests/init-agents.test.mjs tests/multi-level.test.mjs tests/no-legacy-paths.test.mjs tests/tree-sitter-error-reporting.test.mjs tests/tree-sitter-body-cap.test.mjs tests/tree-sitter-exported.test.mjs tests/tree-sitter-robustness.test.mjs tests/bootstrapbench-run.test.mjs tests/bootstrapbench-stats.test.mjs tests/bootstrapbench-aggregate.test.mjs tests/bootstrapbench-cleanup.test.mjs tests/bootstrapbench-query-packs.test.mjs tests/query-cli-shim.test.mjs tests/enterprise-cli-security.test.mjs tests/session-bootstrap.test.mjs tests/plugin-skills.test.mjs tests/plugin-manifests.test.mjs",
     "release:sync-version": "node scripts/sync-release-version.mjs",
     "release:check-version-sync": "node scripts/sync-release-version.mjs --check",
+    "audit:dependencies": "npm audit --package-lock-only --audit-level=low --prefix frontend && npm audit --package-lock-only --audit-level=low --prefix scaffold/mcp && npm audit --package-lock-only --audit-level=low --prefix scaffold/scripts/parsers && npm audit --package-lock-only --audit-level=low --prefix scripts/parsers",
     "prepublishOnly": "echo 'Ready to publish to npm'"
   },
   "engines": {
-    "node": ">=20"
+    "node": ">=20.9.0"
   }
 }

package/scaffold/mcp/dist/.cortex-build-hash

@@ -0,0 +1 @@
+866649c8d7e3d7b844cf95c614725e8b3b438cd347f13dc2207fe88bb3d5cb89

package/scaffold/mcp/dist/cli/enterprise-setup.js

@@ -0,0 +1,134 @@
+import { randomUUID } from "node:crypto";
+import { join } from "node:path";
+import { chmodSync, existsSync, mkdirSync, renameSync, unlinkSync, writeFileSync, } from "node:fs";
+import { enterpriseCredentialId, isAllowedLicenseEndpoint, verifyLicense, } from "../core/license.js";
+import { claimEnterpriseHostIdentity, inspectEnterpriseHostIdentity, } from "../core/enterprise-host-identity.js";
+import { prepareEnterpriseCredentialRotation } from "../core/enterprise-rotation.js";
+/**
+ * One-liner enterprise onboarding.
+ *
+ *   $ printenv CORTEX_API_KEY | cortex enterprise install --api-key-stdin
+ *
+ * Replaces the manual `.context/enterprise.yml` editing flow that's been
+ * the friction point for new users. Validates the key against the
+ * license endpoint before writing config — so a typo'd key fails fast
+ * with a clear error rather than going silently into community-mode.
+ */
+const DEFAULT_ENDPOINT = "https://cortex-web-rho.vercel.app";
+const API_KEY_RE = /^(?:ctx|ent)_[A-Za-z0-9._-]{8,}$/;
+function buildEnterpriseYaml(baseUrl, apiKey) {
+    const lines = [
+        "# Cortex enterprise configuration. Generated by `cortex enterprise install --api-key-stdin`.",
+        "# Single api_key is used for telemetry, policy, audit and govern services.",
+        "enterprise:",
+        `  api_key: ${apiKey}`,
+        `  base_url: ${baseUrl}`,
+        "",
+        "telemetry:",
+        "  enabled: true",
+        "  interval_minutes: 1",
+        "",
+        "compliance:",
+        "  frameworks: [iso27001, iso42001, soc2]",
+        "  eu_addons: false",
+        "",
+        "govern:",
+        "  mode: off",
+        "  sync_on_startup: true",
+        "  sync_interval_minutes: 60",
+        "  tier_claude: prevent",
+        "  tier_codex: prevent",
+        "  tier_copilot: wrap",
+        "  detect_ungoverned: true",
+        "",
+    ];
+    return lines.join("\n");
+}
+export async function runEnterpriseSetup(options) {
+    const cwd = options.cwd ?? process.cwd();
+    const endpoint = (options.endpoint ?? DEFAULT_ENDPOINT).replace(/\/$/, "");
+    const apiKey = options.apiKey.trim();
+    if (!API_KEY_RE.test(apiKey)) {
+        return {
+            ok: false,
+            message: "API key must start with 'ctx_' or 'ent_' followed by at least 8 alphanumeric/._- chars.",
+        };
+    }
+    if (!isAllowedLicenseEndpoint(endpoint)) {
+        return {
+            ok: false,
+            message: "Endpoint must use HTTPS. Plain HTTP is allowed only for localhost loopback development.",
+        };
+    }
+    const contextDir = join(cwd, ".context");
+    if (!existsSync(contextDir)) {
+        return {
+            ok: false,
+            message: `No .context/ at ${cwd}. Run 'cortex init --bootstrap' first.`,
+        };
+    }
+    // Validate key BEFORE writing config — fail fast, no half-configured state.
+    const license = await verifyLicense(contextDir, endpoint, apiKey, {
+        client_version: process.env.CORTEX_VERSION,
+    });
+    if (!license.valid) {
+        return {
+            ok: false,
+            message: `License rejected: ${license.reason} (source=${license.source}). Verify the API key and endpoint are correct.`,
+        };
+    }
+    // Write enterprise.yml.
+    const configPath = join(contextDir, "enterprise.yml");
+    const temporaryConfigPath = join(contextDir, `.enterprise.yml.${process.pid}.${randomUUID()}.tmp`);
+    try {
+        mkdirSync(contextDir, { recursive: true });
+        writeFileSync(temporaryConfigPath, buildEnterpriseYaml(endpoint, apiKey), {
+            encoding: "utf8",
+            mode: 0o600,
+            flag: "wx",
+        });
+        chmodSync(temporaryConfigPath, 0o600);
+        renameSync(temporaryConfigPath, configPath);
+        // Preserve restrictive permissions even when replacing an existing file.
+        chmodSync(configPath, 0o600);
+    }
+    catch (err) {
+        try {
+            unlinkSync(temporaryConfigPath);
+        }
+        catch {
+            // The rename may already have completed, or the temp file was not made.
+        }
+        return {
+            ok: false,
+            message: `Failed to write ${configPath}: ${err instanceof Error ? err.message : String(err)}`,
+        };
+    }
+    return {
+        ok: true,
+        message: "Enterprise configuration written.",
+        configPath,
+        edition: license.edition,
+        expiresAt: license.expires_at,
+    };
+}
+export function bindEnterpriseIdentity(options) {
+    const endpoint = (options.endpoint ?? DEFAULT_ENDPOINT).replace(/\/$/, "");
+    const apiKey = options.apiKey.trim();
+    if (!API_KEY_RE.test(apiKey) || !isAllowedLicenseEndpoint(endpoint)) {
+        return false;
+    }
+    const credentialId = enterpriseCredentialId(endpoint, apiKey);
+    const identityStatus = inspectEnterpriseHostIdentity(credentialId, endpoint, { homeDir: options.homeDir, owner: options.owner });
+    if (identityStatus === "conflict" || identityStatus === "invalid") {
+        return false;
+    }
+    if (identityStatus === "rotation" &&
+        !prepareEnterpriseCredentialRotation(options.homeDir)) {
+        return false;
+    }
+    return claimEnterpriseHostIdentity(credentialId, endpoint, {
+        homeDir: options.homeDir,
+        owner: options.owner,
+    });
+}