@danielblomma/cortex-mcp 2.4.0 → 2.4.1

package/scaffold/mcp/src/daemon/workflow-sync-checker.ts

@@ -6,6 +6,11 @@ import {
 import { hostname } from "node:os";
 import { join } from "node:path";
 import { loadEnterpriseConfig } from "../core/config.js";
+import { matchesEnterpriseHostIdentity } from "../core/enterprise-host-identity.js";
+import {
+  enterpriseCredentialId,
+  isAllowedLicenseEndpoint,
+} from "../core/license.js";
 import { workflowDefinitionSchema, type WorkflowDefinition } from "../core/workflow/schemas.js";
 import { writeHostAuditEvent } from "./ungoverned-scanner.js";
 import { daemonDir } from "./paths.js";
@@ -55,6 +60,7 @@ type LocalWorkflowRecord = {
 };
 
 type LocalWorkflowsState = {
+  credential_id?: string;
   workflows: Record<string, LocalWorkflowRecord>;
   last_synced_at?: string;
 };
@@ -79,6 +85,10 @@ export function readSyncedWorkflowsState(): LocalWorkflowsState {
   try {
     const parsed = JSON.parse(readFileSync(path, "utf8")) as LocalWorkflowsState;
     return {
+      credential_id:
+        typeof parsed.credential_id === "string"
+          ? parsed.credential_id
+          : undefined,
       workflows: parsed.workflows ?? {},
       last_synced_at: parsed.last_synced_at,
     };
@@ -149,6 +159,28 @@ export async function runWorkflowSyncOnce(
     await writeAudit(cwd, outcome);
     return outcome;
   }
+  if (!isAllowedLicenseEndpoint(baseUrl)) {
+    const outcome: WorkflowSyncOutcome = {
+      kind: "failed",
+      error: "insecure or invalid enterprise endpoint",
+    };
+    await writeAudit(cwd, outcome);
+    return outcome;
+  }
+
+  const credentialId = enterpriseCredentialId(baseUrl, apiKey);
+  if (!matchesEnterpriseHostIdentity(credentialId)) {
+    const outcome: WorkflowSyncOutcome = {
+      kind: "failed",
+      error:
+        "enterprise identity conflict: this user profile is already enrolled to another endpoint or API key",
+    };
+    await writeAudit(cwd, outcome);
+    return outcome;
+  }
+  const state = readSyncedWorkflowsState();
+  const identityChanged = state.credential_id !== credentialId;
+  state.credential_id = credentialId;
 
   let manifest: ManifestEntry[];
   try {
@@ -162,7 +194,6 @@ export async function runWorkflowSyncOnce(
     return outcome;
   }
 
-  const state = readSyncedWorkflowsState();
   const remoteByName = new Map(manifest.map((e) => [e.workflow_id, e]));
 
   const added: string[] = [];
@@ -174,7 +205,11 @@ export async function runWorkflowSyncOnce(
     const isNew = !local;
     const isChanged =
       Boolean(local) &&
-      (local.updated_at !== entry.updated_at || local.version !== entry.version);
+      (
+        identityChanged ||
+        local.updated_at !== entry.updated_at ||
+        local.version !== entry.version
+      );
     if (!isNew && !isChanged) continue;
 
     let fetched: FetchedWorkflow;
@@ -224,6 +259,10 @@ export async function runWorkflowSyncOnce(
 
   const totalChanged = added.length + changed.length + removed.length;
   if (totalChanged === 0) {
+    if (identityChanged) {
+      state.last_synced_at = new Date().toISOString();
+      writeSyncedWorkflowsState(state);
+    }
     const outcome: WorkflowSyncOutcome = {
       kind: "unchanged",
       count: manifest.length,

package/scaffold/mcp/src/enterprise/audit/push.ts

@@ -1,4 +1,5 @@
 import type { AuditEntry } from "../../core/audit/writer.js";
+import { isAllowedEnterpriseEndpoint } from "../../core/secure-endpoint.js";
 import { sanitizeAuditEntryForPush } from "../privacy/boundary.js";
 
 export type AuditPushContext = {
@@ -40,6 +41,13 @@ export async function pushAuditEvents(
   if (pending.length === 0) {
     return { success: true, count: 0 };
   }
+  if (!isAllowedEnterpriseEndpoint(baseUrl)) {
+    return {
+      success: false,
+      count: 0,
+      error: "insecure or invalid enterprise endpoint",
+    };
+  }
 
   const auditUrl = `${baseUrl.replace(/\/$/, "")}/api/v1/audit/push`;
   let pushedCount = 0;

package/scaffold/mcp/src/enterprise/policy/sync.ts

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import type { OrgPolicy, PolicyStore } from "../../core/policy/store.js";
+import { isAllowedEnterpriseEndpoint } from "../../core/secure-endpoint.js";
 
 const CloudPolicySchema = z.object({
   id: z.string().min(1).max(200),
@@ -60,6 +61,17 @@ export async function syncFromCloud(
     lastSync = result;
     return result;
   }
+  if (!isAllowedEnterpriseEndpoint(endpoint)) {
+    const result: SyncResult = {
+      success: false,
+      synced: 0,
+      source: "cloud",
+      timestamp: new Date().toISOString(),
+      error: "insecure or invalid enterprise endpoint",
+    };
+    lastSync = result;
+    return result;
+  }
 
   try {
     const response = await fetch(endpoint, {

package/scaffold/mcp/src/enterprise/reviews/push.ts

@@ -1,4 +1,5 @@
 import { recordReviewDeliveryStatus } from "./trust-state.js";
+import { isAllowedEnterpriseEndpoint } from "../../core/secure-endpoint.js";
 
 export type ReviewPushItem = {
   policy_id: string;
@@ -51,6 +52,14 @@ export async function pushReviewResults(
   if (pending.length === 0) {
     return { success: true, count: 0, attempted: false };
   }
+  if (!isAllowedEnterpriseEndpoint(baseUrl)) {
+    return {
+      success: false,
+      count: 0,
+      error: "insecure or invalid enterprise endpoint",
+      attempted: false,
+    };
+  }
 
   const reviewsUrl = `${baseUrl.replace(/\/$/, "")}/api/v1/reviews/push`;
   const batch = pending.splice(0, 100);

package/scaffold/mcp/src/enterprise/reviews/trust-state.ts

@@ -143,7 +143,9 @@ function inferWorkflow(projectRoot: string, taskId?: string): WorkflowInference
     if (!workflowId) {
       return { id: null, source: "unknown", task_id: normalizedTaskId };
     }
-    const resolved = resolveWorkflowDefinition(workflowId);
+    const resolved = resolveWorkflowDefinition(workflowId, {
+      cwd: projectRoot,
+    });
     return {
       id: workflowId,
       source: resolved.source,

package/scaffold/mcp/src/enterprise/telemetry/sync.ts

@@ -1,4 +1,5 @@
 import type { TelemetryMetrics } from "../../core/telemetry/collector.js";
+import { isAllowedEnterpriseEndpoint } from "../../core/secure-endpoint.js";
 import { buildTelemetryPushPayload } from "../privacy/boundary.js";
 
 export type PushResult = {
@@ -38,6 +39,14 @@ export async function pushMetrics(
     lastPush = result;
     return result;
   }
+  if (!isAllowedEnterpriseEndpoint(endpoint)) {
+    const result: PushResult = {
+      success: false,
+      error: "insecure or invalid enterprise endpoint",
+    };
+    lastPush = result;
+    return result;
+  }
 
   try {
     const response = await fetch(endpoint, {

package/scaffold/mcp/src/enterprise/violations/push.ts

@@ -4,6 +4,8 @@
  * Uses the same endpoint/api_key as policy sync since
  * violations require the "policy" scope.
  */
+import { isAllowedEnterpriseEndpoint } from "../../core/secure-endpoint.js";
+
 type ViolationItem = {
   rule_id: string;
   severity: "error" | "warning" | "info";
@@ -54,6 +56,13 @@ export async function pushViolations(
   if (!baseUrl || !apiKey) {
     return { success: false, count: 0, error: "endpoint or api_key not configured" };
   }
+  if (!isAllowedEnterpriseEndpoint(baseUrl)) {
+    return {
+      success: false,
+      count: 0,
+      error: "insecure or invalid enterprise endpoint",
+    };
+  }
 
   const violationsUrl = `${baseUrl.replace(/\/$/, "")}/api/v1/violations/push`;
 

package/scaffold/mcp/src/enterprise/workflow/push.ts

@@ -1,4 +1,5 @@
 import type { WorkflowState } from "./state.js";
+import { isAllowedEnterpriseEndpoint } from "../../core/secure-endpoint.js";
 
 export type WorkflowPushContext = {
   repo?: string;
@@ -26,6 +27,12 @@ export async function pushWorkflowSnapshot(
   if (!baseUrl || !apiKey) {
     return { success: false, error: "endpoint or api_key not configured" };
   }
+  if (!isAllowedEnterpriseEndpoint(baseUrl)) {
+    return {
+      success: false,
+      error: "insecure or invalid enterprise endpoint",
+    };
+  }
 
   const workflowUrl = `${baseUrl.replace(/\/$/, "")}/api/v1/workflow/push`;
 

package/scaffold/mcp/src/plugin.ts

@@ -120,6 +120,26 @@ export async function loadPlugins(server: McpServer): Promise<void> {
       );
       return;
     }
+    const [
+      { matchesEnterpriseHostIdentity },
+      { enterpriseCredentialId },
+    ] = await Promise.all([
+      import("./core/enterprise-host-identity.js"),
+      import("./core/license.js"),
+    ]);
+    if (
+      !matchesEnterpriseHostIdentity(
+        enterpriseCredentialId(
+          config.enterprise.base_url || config.enterprise.endpoint,
+          config.enterprise.api_key,
+        ),
+      )
+    ) {
+      process.stderr.write(
+        "[cortex] Enterprise inactive: this user profile is enrolled to another endpoint or API key\n",
+      );
+      return;
+    }
 
     if (typeof enterprise.register === "function") {
       await enterprise.register(server);

package/scaffold/mcp/tests/copilot-shim.test.mjs

@@ -80,7 +80,25 @@ test("installCopilotShim: refuses to overwrite a non-shim file at shim path", ()
       searchPath: ws.searchPath,
     });
     assert.equal(result.ok, false);
-    assert.match(result.message, /not a cortex shim/);
+    assert.match(result.message, /not a regular cortex shim/);
+  } finally {
+    fs.rmSync(ws.dir, { recursive: true, force: true });
+  }
+});
+
+test("installCopilotShim: refuses a dangling symlink without touching its target", () => {
+  const ws = makeWorkspace();
+  const target = path.join(ws.dir, "must-not-be-created");
+  try {
+    fs.symlinkSync(target, ws.shimPath);
+    const result = installCopilotShim({
+      shimPath: ws.shimPath,
+      searchPath: ws.searchPath,
+    });
+    assert.equal(result.ok, false);
+    assert.match(result.message, /regular cortex shim/);
+    assert.equal(fs.existsSync(target), false);
+    assert.equal(fs.lstatSync(ws.shimPath).isSymbolicLink(), true);
   } finally {
     fs.rmSync(ws.dir, { recursive: true, force: true });
   }

package/scaffold/mcp/tests/egress-proxy.test.mjs

@@ -237,3 +237,40 @@ test("egress proxy: stop() closes the server", async () => {
   assert.equal(proxy.isRunning(), false);
   fs.rmSync(cwd, { recursive: true, force: true });
 });
+
+test("egress proxy: an unattributed shared connection is not written into either project audit boundary", async () => {
+  const echo = await startEchoServer();
+  const projectA = makeProject();
+  const projectB = makeProject();
+  const proxy = await startEgressProxy({ port: 0, hostId: "test-host" });
+  try {
+    await new Promise((resolve, reject) => {
+      const client = net.connect(proxy.port, "127.0.0.1", () => {
+        client.write(
+          `GET http://127.0.0.1:${echo.port}/health HTTP/1.1\r\n` +
+            `Host: 127.0.0.1:${echo.port}\r\n\r\n`,
+        );
+      });
+      client.on("data", () => {
+        client.end();
+        resolve();
+      });
+      client.on("error", reject);
+    });
+    await new Promise((resolve) => setTimeout(resolve, 100));
+
+    assert.equal(
+      fs.existsSync(path.join(projectA, ".context", "audit")),
+      false,
+    );
+    assert.equal(
+      fs.existsSync(path.join(projectB, ".context", "audit")),
+      false,
+    );
+  } finally {
+    await proxy.stop();
+    await new Promise((resolve) => echo.server.close(resolve));
+    fs.rmSync(projectA, { recursive: true, force: true });
+    fs.rmSync(projectB, { recursive: true, force: true });
+  }
+});