@danielblomma/cortex-mcp 2.4.0 → 2.4.2

package/scaffold/mcp/dist/contextEntities.js

@@ -0,0 +1,282 @@
+function isWindowChunkId(id) {
+    return id.includes(":window:");
+}
+function baseChunkId(id) {
+    const markerIndex = id.indexOf(":window:");
+    return markerIndex === -1 ? id : id.slice(0, markerIndex);
+}
+function groupRuleLinks(relations) {
+    const links = new Map();
+    for (const relation of relations) {
+        if (relation.relation !== "CONSTRAINS" && relation.relation !== "IMPLEMENTS") {
+            continue;
+        }
+        if (relation.relation === "CONSTRAINS") {
+            const list = links.get(relation.to) ?? [];
+            list.push(relation.from);
+            links.set(relation.to, list);
+        }
+        else {
+            const list = links.get(relation.from) ?? [];
+            list.push(relation.to);
+            links.set(relation.from, list);
+        }
+    }
+    return links;
+}
+function buildRelationSearchSignals(data) {
+    const labelsById = new Map();
+    for (const document of data.documents) {
+        labelsById.set(document.id, document.path);
+    }
+    for (const chunk of data.chunks) {
+        labelsById.set(chunk.id, chunk.name || chunk.id);
+    }
+    for (const module of data.modules) {
+        labelsById.set(module.id, module.name || module.path);
+    }
+    for (const project of data.projects) {
+        labelsById.set(project.id, project.name || project.path);
+    }
+    const supportedRelations = new Set([
+        "CALLS_SQL",
+        "USES_CONFIG_KEY",
+        "USES_RESOURCE_KEY",
+        "USES_SETTING_KEY",
+        "USES_CONFIG",
+        "TRANSFORMS_CONFIG"
+    ]);
+    const signalsByEntity = new Map();
+    for (const relation of data.relations) {
+        if (!supportedRelations.has(relation.relation)) {
+            continue;
+        }
+        const sourceLabel = labelsById.get(relation.from) ?? relation.from;
+        const targetLabel = labelsById.get(relation.to) ?? relation.to;
+        const outgoingSignal = [relation.relation.toLowerCase(), relation.note, targetLabel].filter(Boolean).join(" ");
+        const incomingSignal = ["affected_by", relation.relation.toLowerCase(), relation.note, sourceLabel]
+            .filter(Boolean)
+            .join(" ");
+        const outgoing = signalsByEntity.get(relation.from) ?? [];
+        outgoing.push(outgoingSignal);
+        signalsByEntity.set(relation.from, outgoing);
+        const incoming = signalsByEntity.get(relation.to) ?? [];
+        incoming.push(incomingSignal);
+        signalsByEntity.set(relation.to, incoming);
+    }
+    return new Map([...signalsByEntity.entries()].map(([id, parts]) => [id, parts.join("\n")]));
+}
+function buildSearchEntityIndexes(data) {
+    const fileRuleLinks = groupRuleLinks(data.relations);
+    const relationSignals = buildRelationSearchSignals(data);
+    const adrPathSet = new Set(data.adrs
+        .map((adr) => adr.path.trim().toLowerCase())
+        .filter((adrPath) => adrPath.length > 0));
+    const filePathById = new Map(data.documents.filter((document) => document.kind === "CODE").map((document) => [document.id, document.path]));
+    return { fileRuleLinks, relationSignals, adrPathSet, filePathById };
+}
+export function* iterateSearchEntities(data, includeContent) {
+    const { fileRuleLinks, relationSignals, adrPathSet, filePathById } = buildSearchEntityIndexes(data);
+    for (const document of data.documents) {
+        const normalizedPath = document.path.trim().toLowerCase();
+        if (document.kind === "ADR" && adrPathSet.has(normalizedPath)) {
+            continue;
+        }
+        yield {
+            id: document.id,
+            entity_type: "File",
+            kind: document.kind,
+            label: document.path,
+            path: document.path,
+            text: `${document.path}\n${document.excerpt}\n${document.content}\n${relationSignals.get(document.id) ?? ""}`,
+            status: document.status,
+            source_of_truth: document.source_of_truth,
+            trust_level: document.trust_level,
+            updated_at: document.updated_at,
+            snippet: document.excerpt,
+            matched_rules: fileRuleLinks.get(document.id) ?? [],
+            content: includeContent ? document.content : undefined
+        };
+    }
+    for (const rule of data.rules) {
+        yield {
+            id: rule.id,
+            entity_type: "Rule",
+            kind: "RULE",
+            label: rule.title || rule.id,
+            path: "",
+            text: `${rule.id}\n${rule.title}\n${rule.body}`,
+            status: rule.status,
+            source_of_truth: rule.source_of_truth,
+            trust_level: rule.trust_level,
+            updated_at: rule.updated_at,
+            snippet: rule.body.slice(0, 500),
+            matched_rules: [rule.id],
+            content: includeContent ? rule.body : undefined
+        };
+    }
+    for (const adr of data.adrs) {
+        yield {
+            id: adr.id,
+            entity_type: "ADR",
+            kind: "ADR",
+            label: adr.title || adr.id,
+            path: adr.path,
+            text: `${adr.path}\n${adr.title}\n${adr.body}`,
+            status: adr.status,
+            source_of_truth: adr.source_of_truth,
+            trust_level: adr.trust_level,
+            updated_at: adr.decision_date,
+            snippet: adr.body.slice(0, 500),
+            matched_rules: [],
+            content: includeContent ? adr.body : undefined
+        };
+    }
+    for (const chunk of data.chunks) {
+        const filePath = filePathById.get(chunk.file_id) ?? "";
+        yield {
+            id: chunk.id,
+            entity_type: "Chunk",
+            kind: chunk.kind || "chunk",
+            label: chunk.name || chunk.id,
+            path: filePath,
+            text: `${filePath}\n${chunk.name}\n${chunk.signature}\n${chunk.description}\n${chunk.body}\n${relationSignals.get(chunk.id) ?? ""}`,
+            status: chunk.status,
+            source_of_truth: chunk.source_of_truth,
+            trust_level: chunk.trust_level,
+            updated_at: chunk.updated_at,
+            snippet: chunk.description || chunk.body.slice(0, 500),
+            matched_rules: fileRuleLinks.get(chunk.file_id) ?? [],
+            content: includeContent ? chunk.body : undefined
+        };
+    }
+    for (const module of data.modules) {
+        yield {
+            id: module.id,
+            entity_type: "Module",
+            kind: "MODULE",
+            label: module.name,
+            path: module.path,
+            text: `${module.path}\n${module.name}\n${module.summary}\n${module.exported_symbols}`,
+            status: module.status,
+            source_of_truth: module.source_of_truth,
+            trust_level: module.trust_level,
+            updated_at: module.updated_at,
+            snippet: (module.summary || "").slice(0, 500),
+            matched_rules: [],
+            content: includeContent ? module.summary : undefined
+        };
+    }
+    for (const project of data.projects) {
+        yield {
+            id: project.id,
+            entity_type: "Project",
+            kind: project.kind.toUpperCase() || "PROJECT",
+            label: project.name || project.path,
+            path: project.path,
+            text: `${project.path}\n${project.name}\n${project.kind}\n${project.language}\n${project.target_framework}\n${project.summary}`,
+            status: project.status,
+            source_of_truth: project.source_of_truth,
+            trust_level: project.trust_level,
+            updated_at: project.updated_at,
+            snippet: (project.summary || "").slice(0, 500),
+            matched_rules: [],
+            content: includeContent ? project.summary : undefined
+        };
+    }
+}
+export function buildSearchEntities(data, includeContent) {
+    return Array.from(iterateSearchEntities(data, includeContent));
+}
+export function buildChunkPartOfRelations(data) {
+    const relations = [];
+    for (const chunk of data.chunks) {
+        if (isWindowChunkId(chunk.id)) {
+            relations.push({
+                from: chunk.id,
+                to: baseChunkId(chunk.id),
+                relation: "PART_OF",
+                note: "Overlap window belongs to base chunk"
+            });
+        }
+        if (!chunk.file_id) {
+            continue;
+        }
+        relations.push({
+            from: chunk.id,
+            to: chunk.file_id,
+            relation: "PART_OF",
+            note: "Chunk belongs to file"
+        });
+    }
+    return relations;
+}
+export function entityCatalog(data) {
+    const catalog = new Map();
+    const fileById = new Map(data.documents.map((document) => [document.id, document]));
+    for (const file of data.documents) {
+        catalog.set(file.id, {
+            id: file.id,
+            type: "File",
+            label: file.path,
+            status: file.status,
+            source_of_truth: file.source_of_truth
+        });
+    }
+    for (const rule of data.rules) {
+        catalog.set(rule.id, {
+            id: rule.id,
+            type: "Rule",
+            label: rule.title,
+            status: rule.status,
+            source_of_truth: rule.source_of_truth
+        });
+    }
+    for (const adr of data.adrs) {
+        catalog.set(adr.id, {
+            id: adr.id,
+            type: "ADR",
+            label: adr.title || adr.id,
+            status: adr.status,
+            source_of_truth: adr.source_of_truth
+        });
+    }
+    for (const chunk of data.chunks) {
+        const filePath = fileById.get(chunk.file_id)?.path ?? "";
+        const chunkEntity = {
+            id: chunk.id,
+            type: "Chunk",
+            label: chunk.name || chunk.id,
+            status: chunk.status,
+            source_of_truth: chunk.source_of_truth
+        };
+        if (filePath) {
+            chunkEntity.path = filePath;
+        }
+        catalog.set(chunk.id, chunkEntity);
+    }
+    for (const module of data.modules) {
+        catalog.set(module.id, {
+            id: module.id,
+            type: "Module",
+            label: module.name,
+            status: module.status,
+            source_of_truth: module.source_of_truth,
+            path: module.path
+        });
+    }
+    for (const project of data.projects) {
+        catalog.set(project.id, {
+            id: project.id,
+            type: "Project",
+            label: project.name || project.path,
+            status: project.status,
+            source_of_truth: project.source_of_truth,
+            path: project.path
+        });
+    }
+    return catalog;
+}
+export function buildEntitySearchMap(data) {
+    return new Map(buildSearchEntities(data, false).map((entity) => [entity.id, entity]));
+}

package/scaffold/mcp/dist/core/audit/query.js

@@ -0,0 +1,72 @@
+import { readFileSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+const DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
+export function queryAuditLog(contextDir, query) {
+    const auditDir = join(contextDir, "audit");
+    const limit = query.limit ?? 50;
+    if (query.from && !DATE_RE.test(query.from))
+        return [];
+    if (query.to && !DATE_RE.test(query.to))
+        return [];
+    let files;
+    try {
+        files = readdirSync(auditDir)
+            .filter(f => f.endsWith(".jsonl"))
+            .sort();
+    }
+    catch {
+        return [];
+    }
+    // Filter files by date range
+    if (query.from) {
+        const fromFile = `${query.from}.jsonl`;
+        files = files.filter(f => f >= fromFile);
+    }
+    if (query.to) {
+        const toFile = `${query.to}.jsonl`;
+        files = files.filter(f => f <= toFile);
+    }
+    const results = [];
+    // Read newest files first
+    for (const file of files.reverse()) {
+        if (results.length >= limit)
+            break;
+        try {
+            const raw = readFileSync(join(auditDir, file), "utf8").trim();
+            if (!raw)
+                continue;
+            const entries = raw
+                .split("\n")
+                .map(line => {
+                try {
+                    return JSON.parse(line);
+                }
+                catch {
+                    return null;
+                }
+            })
+                .filter(Boolean)
+                .reverse(); // newest first within file
+            for (const entry of entries) {
+                if (results.length >= limit)
+                    break;
+                // Apply tool filter
+                if (query.tool && entry.tool !== query.tool)
+                    continue;
+                if (query.event_type && entry.event_type !== query.event_type)
+                    continue;
+                if (query.evidence_level && entry.evidence_level !== query.evidence_level)
+                    continue;
+                if (query.status && entry.status !== query.status)
+                    continue;
+                if (query.session_id && entry.session_id !== query.session_id)
+                    continue;
+                results.push(entry);
+            }
+        }
+        catch {
+            // skip unreadable files
+        }
+    }
+    return results;
+}

package/scaffold/mcp/dist/core/audit/writer.js

@@ -0,0 +1,28 @@
+import { appendFile, mkdir } from "node:fs/promises";
+import { join } from "node:path";
+export class AuditWriter {
+    auditDir;
+    onEntry;
+    initialized = false;
+    constructor(contextDir, options = {}) {
+        this.auditDir = join(contextDir, "audit");
+        this.onEntry = options.onEntry ?? null;
+    }
+    log(entry) {
+        const date = entry.timestamp.slice(0, 10); // YYYY-MM-DD
+        const filePath = join(this.auditDir, `${date}.jsonl`);
+        const line = JSON.stringify(entry) + "\n";
+        this.onEntry?.(entry);
+        // Fire-and-forget async write — don't block the tool handler
+        this.writeAsync(filePath, line).catch(() => {
+            process.stderr.write("[cortex-enterprise] Failed to write audit entry\n");
+        });
+    }
+    async writeAsync(filePath, line) {
+        if (!this.initialized) {
+            await mkdir(this.auditDir, { recursive: true });
+            this.initialized = true;
+        }
+        await appendFile(filePath, line);
+    }
+}

package/scaffold/mcp/dist/core/config.js

@@ -0,0 +1,235 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { parseValidatorsConfig } from "./validators/config.js";
+import { isAllowedEnterpriseEndpoint } from "./secure-endpoint.js";
+const DEFAULT_FRAMEWORKS = ["iso27001", "iso42001", "soc2"];
+const EU_ADDON_FRAMEWORKS = ["gdpr", "ai_act", "nis2"];
+const VALID_FRAMEWORKS = new Set([
+    ...DEFAULT_FRAMEWORKS,
+    ...EU_ADDON_FRAMEWORKS,
+]);
+const VALID_MODES = new Set(["off", "advisory", "enforced"]);
+const VALID_TIERS = new Set(["prevent", "wrap", "detect", "off"]);
+const DEFAULTS = {
+    enterprise: {
+        endpoint: "",
+        api_key: "",
+        base_url: "",
+    },
+    telemetry: {
+        enabled: false,
+        endpoint: "",
+        api_key: "",
+        interval_minutes: 10,
+    },
+    audit: {
+        enabled: true,
+        retention_days: 90,
+    },
+    policy: {
+        enabled: true,
+        endpoint: "",
+        api_key: "",
+        sync_interval_minutes: 240,
+    },
+    rbac: {
+        enabled: false,
+        default_role: "developer",
+    },
+    validators: {},
+    compliance: {
+        frameworks: [],
+        eu_addons: false,
+    },
+    govern: {
+        mode: "off",
+        sync_on_startup: true,
+        sync_interval_minutes: 60,
+        tier_claude: "prevent",
+        tier_codex: "prevent",
+        tier_copilot: "wrap",
+        detect_ungoverned: true,
+        govern_endpoint: "",
+    },
+};
+const VALID_ROLES = ["admin", "developer", "readonly"];
+function isValidRole(value) {
+    return VALID_ROLES.includes(value);
+}
+function stripInlineComment(value) {
+    // Strip # comments that aren't inside quotes
+    const singleMatch = value.match(/^'([^']*)'(\s*#.*)?$/);
+    if (singleMatch)
+        return singleMatch[1];
+    const doubleMatch = value.match(/^"([^"]*)"(\s*#.*)?$/);
+    if (doubleMatch)
+        return doubleMatch[1];
+    // Unquoted: strip from first # preceded by whitespace
+    const commentIdx = value.search(/\s+#/);
+    return commentIdx >= 0 ? value.slice(0, commentIdx).trimEnd() : value;
+}
+function parseInlineList(value) {
+    const trimmed = value.trim();
+    if (!trimmed.startsWith("[") || !trimmed.endsWith("]"))
+        return null;
+    const inner = trimmed.slice(1, -1).trim();
+    if (!inner)
+        return [];
+    return inner
+        .split(",")
+        .map((part) => part.trim().replace(/^["']|["']$/g, ""))
+        .filter(Boolean);
+}
+function parseSimpleYaml(text) {
+    const result = {};
+    let section = "";
+    for (const line of text.split("\n")) {
+        const trimmed = line.trimEnd();
+        if (!trimmed || trimmed.startsWith("#"))
+            continue;
+        const sectionMatch = trimmed.match(/^(\w+):\s*$/);
+        if (sectionMatch) {
+            section = sectionMatch[1];
+            continue;
+        }
+        const kvMatch = trimmed.match(/^\s+(\w+):\s*(.+?)\s*$/);
+        if (kvMatch && section) {
+            result[`${section}.${kvMatch[1]}`] = stripInlineComment(kvMatch[2]);
+            continue;
+        }
+        const topMatch = trimmed.match(/^(\w+):\s*(.+?)\s*$/);
+        if (topMatch) {
+            result[topMatch[1]] = stripInlineComment(topMatch[2]);
+        }
+    }
+    return result;
+}
+function isLikelyApiKey(value) {
+    return /^(?:ctx|ent)_[A-Za-z0-9._-]{8,}$/.test(value);
+}
+function isLikelyHttpUrl(value) {
+    try {
+        const parsed = new URL(value);
+        return parsed.protocol === "http:" || parsed.protocol === "https:";
+    }
+    catch {
+        return false;
+    }
+}
+export function resolveEnterpriseActivation(config) {
+    const apiKey = config.enterprise.api_key.trim();
+    const endpoint = (config.enterprise.base_url ||
+        config.enterprise.endpoint).trim();
+    if (!apiKey) {
+        return { active: false, reason: "missing_api_key", api_key: null, endpoint: endpoint || null };
+    }
+    if (!endpoint) {
+        return { active: false, reason: "missing_endpoint", api_key: apiKey, endpoint: null };
+    }
+    if (!isLikelyApiKey(apiKey)) {
+        return { active: false, reason: "invalid_api_key_format", api_key: apiKey, endpoint };
+    }
+    if (!isLikelyHttpUrl(endpoint) ||
+        !isAllowedEnterpriseEndpoint(endpoint)) {
+        return { active: false, reason: "invalid_endpoint_format", api_key: apiKey, endpoint };
+    }
+    return { active: true, reason: "active", api_key: apiKey, endpoint };
+}
+function deriveEndpoint(baseUrl, suffix) {
+    if (!baseUrl)
+        return "";
+    return baseUrl.replace(/\/$/, "") + suffix;
+}
+function isValidTier(value) {
+    return value !== undefined && VALID_TIERS.has(value);
+}
+function isValidMode(value) {
+    return value !== undefined && VALID_MODES.has(value);
+}
+function resolveFrameworks(rawList, euAddons) {
+    const parsed = rawList ? parseInlineList(rawList) : null;
+    const base = parsed && parsed.length > 0
+        ? parsed.filter((f) => VALID_FRAMEWORKS.has(f))
+        : DEFAULT_FRAMEWORKS.slice();
+    if (!euAddons)
+        return base;
+    const merged = new Set(base);
+    for (const f of EU_ADDON_FRAMEWORKS)
+        merged.add(f);
+    return Array.from(merged);
+}
+export function loadEnterpriseConfig(contextDir) {
+    let raw;
+    try {
+        raw = readFileSync(join(contextDir, "enterprise.yml"), "utf8");
+    }
+    catch {
+        try {
+            raw = readFileSync(join(contextDir, "enterprise.yaml"), "utf8");
+        }
+        catch {
+            return DEFAULTS;
+        }
+    }
+    const fields = parseSimpleYaml(raw);
+    const enterpriseApiKey = fields["enterprise.api_key"] ?? DEFAULTS.enterprise.api_key;
+    const baseUrl = (fields["enterprise.base_url"] ?? fields["enterprise.endpoint"] ?? "").replace(/\/$/, "");
+    const enterpriseEndpoint = fields["enterprise.endpoint"] ?? baseUrl;
+    const telemetryEndpoint = fields["enterprise.endpoint_telemetry"] ??
+        fields["telemetry.endpoint"] ??
+        deriveEndpoint(baseUrl, "/api/v1/telemetry/push");
+    const telemetryApiKey = fields["telemetry.api_key"] ?? enterpriseApiKey;
+    const policyEndpoint = fields["enterprise.endpoint_policy"] ??
+        fields["policy.endpoint"] ??
+        deriveEndpoint(baseUrl, "/api/v1/policies/sync");
+    const policyApiKey = fields["policy.api_key"] ?? enterpriseApiKey;
+    const governEndpoint = fields["enterprise.endpoint_govern"] ??
+        deriveEndpoint(baseUrl, "/api/v1/govern");
+    const euAddons = fields["compliance.eu_addons"] === "true";
+    const frameworks = resolveFrameworks(fields["compliance.frameworks"], euAddons);
+    const governMode = isValidMode(fields["govern.mode"]) ? fields["govern.mode"] : DEFAULTS.govern.mode;
+    return {
+        enterprise: {
+            endpoint: enterpriseEndpoint,
+            api_key: enterpriseApiKey,
+            base_url: baseUrl,
+        },
+        telemetry: {
+            endpoint: telemetryEndpoint,
+            api_key: telemetryApiKey,
+            enabled: fields["telemetry.enabled"] !== undefined
+                ? fields["telemetry.enabled"] === "true"
+                : !!(telemetryEndpoint && telemetryApiKey),
+            interval_minutes: parseInt(fields["telemetry.interval_minutes"] ?? "", 10) || DEFAULTS.telemetry.interval_minutes,
+        },
+        audit: {
+            enabled: fields["audit.enabled"] !== "false",
+            retention_days: parseInt(fields["audit.retention_days"] ?? "", 10) || DEFAULTS.audit.retention_days,
+        },
+        policy: {
+            enabled: fields["policy.enabled"] !== "false",
+            endpoint: policyEndpoint,
+            api_key: policyApiKey,
+            sync_interval_minutes: parseInt(fields["policy.sync_interval_minutes"] ?? "", 10) || DEFAULTS.policy.sync_interval_minutes,
+        },
+        rbac: {
+            enabled: fields["rbac.enabled"] === "true",
+            default_role: isValidRole(fields["rbac.default_role"]) ? fields["rbac.default_role"] : DEFAULTS.rbac.default_role,
+        },
+        validators: parseValidatorsConfig(fields),
+        compliance: {
+            frameworks,
+            eu_addons: euAddons,
+        },
+        govern: {
+            mode: governMode,
+            sync_on_startup: fields["govern.sync_on_startup"] !== "false",
+            sync_interval_minutes: parseInt(fields["govern.sync_interval_minutes"] ?? "", 10) || DEFAULTS.govern.sync_interval_minutes,
+            tier_claude: isValidTier(fields["govern.tier_claude"]) ? fields["govern.tier_claude"] : DEFAULTS.govern.tier_claude,
+            tier_codex: isValidTier(fields["govern.tier_codex"]) ? fields["govern.tier_codex"] : DEFAULTS.govern.tier_codex,
+            tier_copilot: isValidTier(fields["govern.tier_copilot"]) ? fields["govern.tier_copilot"] : DEFAULTS.govern.tier_copilot,
+            detect_ungoverned: fields["govern.detect_ungoverned"] !== "false",
+            govern_endpoint: governEndpoint,
+        },
+    };
+}