@danielblomma/cortex-mcp 2.4.0 → 2.4.2

package/scaffold/mcp/dist/daemon/main.js

@@ -0,0 +1,449 @@
+import { readFileSync, existsSync, writeFileSync, mkdirSync, rmSync } from "node:fs";
+import { basename, join } from "node:path";
+import { randomUUID } from "node:crypto";
+import { CortexDaemon } from "./server.js";
+import { loadEnterpriseConfig, resolveEnterpriseActivation } from "../core/config.js";
+import { configuredEnterpriseCredentialId } from "../core/enterprise-identity.js";
+import { matchesEnterpriseHostIdentity } from "../core/enterprise-host-identity.js";
+import { startGlobalUngovernedEventsPusher } from "./global-host-events.js";
+import { pushMetrics } from "../enterprise/telemetry/sync.js";
+import { TelemetryCollector } from "../core/telemetry/collector.js";
+import { resolveTelemetryStateDir, telemetryStatePath } from "../core/telemetry/state-dir.js";
+import { AuditWriter } from "../core/audit/writer.js";
+import { PolicyStore } from "../core/policy/store.js";
+import { enforceInjectionPolicy, isInjectionDefenseActive, } from "../core/policy/enforce.js";
+import { startUngovernedScanner } from "./ungoverned-scanner.js";
+import { HeartbeatTracker, writeTamperLock, emitTamperAudit, } from "./heartbeat-tracker.js";
+import { startSyncTimer } from "./sync-checker.js";
+import { startSkillSyncTimer } from "./skill-sync-checker.js";
+import { startWorkflowSyncTimer } from "./workflow-sync-checker.js";
+import { startCapabilitySyncTimer } from "./capability-sync-checker.js";
+import { startHostEventsPusher } from "./host-events-pusher.js";
+import { startEgressProxy } from "./egress-proxy.js";
+import { startHeartbeatPusher } from "./heartbeat-pusher.js";
+import { normalizeProjectCwd, ProjectServiceRegistry, } from "./project-service-registry.js";
+/**
+ * Daemon entry point. Run by `cortex daemon start` (or auto-spawned by
+ * the first hook that needs it).
+ *
+ * v2.0.0: policy.check is currently a stub allowing all calls (real policy
+ * evaluation in subsequent commit). telemetry.flush is fully wired — the
+ * Stop hook now reliably pushes metrics.json even if MCP died abruptly.
+ */
+function extractStringFields(value, out = []) {
+    if (typeof value === "string") {
+        out.push(value);
+    }
+    else if (Array.isArray(value)) {
+        for (const v of value)
+            extractStringFields(v, out);
+    }
+    else if (value && typeof value === "object") {
+        for (const v of Object.values(value)) {
+            extractStringFields(v, out);
+        }
+    }
+    return out;
+}
+async function policyCheck(payload) {
+    if (!payload.cwd)
+        return { allow: true };
+    const contextDir = join(payload.cwd, ".context");
+    if (!existsSync(contextDir))
+        return { allow: true };
+    const store = new PolicyStore(contextDir);
+    const policies = store.getMergedPolicies();
+    if (!isInjectionDefenseActive(policies)) {
+        return { allow: true };
+    }
+    const haystack = extractStringFields(payload.input).join("\n");
+    if (!haystack)
+        return { allow: true };
+    const result = enforceInjectionPolicy(haystack, policies);
+    if (result.allowed)
+        return { allow: true };
+    const topMatch = result.scan.matches[0];
+    const reason = topMatch
+        ? `prompt-injection-defense: ${topMatch.category} (${topMatch.matched.slice(0, 80)})`
+        : "prompt-injection-defense: flagged";
+    return { allow: false, reason };
+}
+function readMetrics(contextDir) {
+    const path = telemetryStatePath(contextDir, "metrics.json");
+    if (!existsSync(path))
+        return null;
+    try {
+        return JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+function pendingPushPath(contextDir) {
+    return telemetryStatePath(contextDir, "pending-push.json");
+}
+function readPendingPush(contextDir) {
+    const path = pendingPushPath(contextDir);
+    if (!existsSync(path))
+        return null;
+    try {
+        return JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+function writePendingPush(contextDir, pending) {
+    const path = pendingPushPath(contextDir);
+    mkdirSync(resolveTelemetryStateDir(contextDir), { recursive: true });
+    writeFileSync(path, JSON.stringify(pending, null, 2), "utf8");
+}
+function deletePendingPush(contextDir) {
+    const path = pendingPushPath(contextDir);
+    try {
+        rmSync(path, { force: true });
+    }
+    catch {
+        // best effort
+    }
+}
+function ackOnDisk(contextDir, pushed) {
+    const collector = new TelemetryCollector(contextDir, pushed.client_version || "unknown");
+    collector.acknowledgePush(pushed);
+    collector.flush();
+}
+const telemetryBackoff = new Map();
+const TELEMETRY_BACKOFF_BASE_MS = 60_000;
+const TELEMETRY_BACKOFF_CAP_MS = 30 * 60_000;
+function shouldSkipTelemetryPush(cwd, now = Date.now()) {
+    const state = telemetryBackoff.get(cwd);
+    return state ? now < state.nextPushAt : false;
+}
+function recordTelemetryPushOutcome(cwd, success, now = Date.now()) {
+    if (success) {
+        telemetryBackoff.delete(cwd);
+        return;
+    }
+    const prev = telemetryBackoff.get(cwd) ?? { nextPushAt: 0, consecutiveFailures: 0 };
+    const failures = prev.consecutiveFailures + 1;
+    const delay = Math.min(TELEMETRY_BACKOFF_BASE_MS * 2 ** (failures - 1), TELEMETRY_BACKOFF_CAP_MS);
+    telemetryBackoff.set(cwd, {
+        consecutiveFailures: failures,
+        nextPushAt: now + delay,
+    });
+}
+async function telemetryFlush(payload) {
+    const cwd = payload.cwd ?? process.cwd();
+    const contextDir = join(cwd, ".context");
+    if (!existsSync(contextDir)) {
+        return { flushed: false, events_pushed: 0 };
+    }
+    const config = loadEnterpriseConfig(contextDir);
+    const activation = resolveEnterpriseActivation(config);
+    if (!activation.active || !config.telemetry.enabled) {
+        // Community mode or telemetry disabled → nothing to push.
+        return { flushed: false, events_pushed: 0 };
+    }
+    if (!config.telemetry.endpoint || !config.telemetry.api_key) {
+        return { flushed: false, events_pushed: 0 };
+    }
+    if (shouldSkipTelemetryPush(cwd)) {
+        return { flushed: false, events_pushed: 0 };
+    }
+    const repo = basename(cwd);
+    const endpoint = config.telemetry.endpoint;
+    const apiKey = config.telemetry.api_key;
+    // Recovery: if a pending push exists, retry it first with the same
+    // push_id so the server can deduplicate against an earlier in-flight
+    // attempt that may have crashed before delete.
+    const pending = readPendingPush(contextDir);
+    if (pending) {
+        const result = await pushMetrics(pending.snapshot, endpoint, apiKey, {
+            repo,
+            session_id: payload.session_id,
+            push_id: pending.push_id,
+        });
+        recordTelemetryPushOutcome(cwd, result.success);
+        if (!result.success) {
+            process.stderr.write(`[cortex-daemon] pending telemetry push retry failed: ${result.error ?? "unknown"}\n`);
+            return { flushed: false, events_pushed: 0 };
+        }
+        ackOnDisk(contextDir, pending.snapshot);
+        deletePendingPush(contextDir);
+        return { flushed: true, events_pushed: pending.snapshot.total_tool_calls };
+    }
+    const metrics = readMetrics(contextDir);
+    if (!metrics) {
+        // No metrics on disk yet — MCP hasn't flushed. Nothing to push.
+        return { flushed: false, events_pushed: 0 };
+    }
+    const push_id = randomUUID();
+    writePendingPush(contextDir, {
+        snapshot: metrics,
+        push_id,
+        written_at: new Date().toISOString(),
+    });
+    const result = await pushMetrics(metrics, endpoint, apiKey, {
+        repo,
+        session_id: payload.session_id,
+        push_id,
+    });
+    recordTelemetryPushOutcome(cwd, result.success);
+    if (!result.success) {
+        process.stderr.write(`[cortex-daemon] telemetry push failed: ${result.error ?? "unknown"}\n`);
+        // Pending stays on disk; next tick (after backoff) will retry.
+        return { flushed: false, events_pushed: 0 };
+    }
+    ackOnDisk(contextDir, metrics);
+    deletePendingPush(contextDir);
+    return {
+        flushed: true,
+        events_pushed: metrics.total_tool_calls,
+    };
+}
+// Per-cwd AuditWriter cache. Daemon serves multiple projects so we don't
+// want to instantiate (and lose buffered state) on every audit.log call.
+const auditWriters = new Map();
+function getAuditWriter(cwd) {
+    const contextDir = join(cwd, ".context");
+    let writer = auditWriters.get(contextDir);
+    if (!writer) {
+        writer = new AuditWriter(contextDir);
+        auditWriters.set(contextDir, writer);
+    }
+    return writer;
+}
+async function auditLog(payload) {
+    if (!payload.cwd || !payload.entry) {
+        return { written: false };
+    }
+    const contextDir = join(payload.cwd, ".context");
+    if (!existsSync(contextDir)) {
+        return { written: false };
+    }
+    const writer = getAuditWriter(payload.cwd);
+    const entry = {
+        timestamp: payload.entry.timestamp,
+        tool: payload.entry.tool,
+        input: payload.entry.input,
+        result_count: payload.entry.result_count ?? 0,
+        entities_returned: [],
+        rules_applied: [],
+        duration_ms: payload.entry.duration_ms ?? 0,
+        status: payload.entry.status,
+        event_type: payload.entry.event_type,
+        evidence_level: payload.entry.evidence_level,
+        resource_type: payload.entry.resource_type,
+        session_id: payload.entry.session_id,
+        metadata: payload.entry.metadata,
+    };
+    writer.log(entry);
+    return { written: true };
+}
+async function main() {
+    // Phase 6: hook heartbeat tracker (per-session activity record + tamper detect).
+    const tracker = new HeartbeatTracker();
+    let projectServices = null;
+    function registerEnterpriseProject(cwd) {
+        const config = loadEnterpriseConfig(join(cwd, ".context"));
+        if (!resolveEnterpriseActivation(config).active)
+            return true;
+        if (projectServices?.has(cwd))
+            return true;
+        const credentialId = configuredEnterpriseCredentialId(cwd);
+        if (!credentialId || !matchesEnterpriseHostIdentity(credentialId)) {
+            process.stderr.write(`[cortex-daemon] rejected Enterprise project ${cwd}: ` +
+                "this user profile is enrolled to another endpoint or API key\n");
+            return false;
+        }
+        if (!projectServices?.register(cwd)) {
+            process.stderr.write(`[cortex-daemon] rejected Enterprise project ${cwd}: ` +
+                "this user daemon is already bound to another endpoint or API key\n");
+            return false;
+        }
+        return true;
+    }
+    async function heartbeat(payload) {
+        const cwd = normalizeProjectCwd(payload.cwd);
+        if (!cwd) {
+            return { recorded: false, tamper_lock_active: false };
+        }
+        if (!registerEnterpriseProject(cwd)) {
+            return { recorded: false, tamper_lock_active: false };
+        }
+        return tracker.recordHeartbeat({ ...payload, cwd });
+    }
+    const daemon = new CortexDaemon({
+        onPolicyCheck: policyCheck,
+        onTelemetryFlush: telemetryFlush,
+        onAuditLog: auditLog,
+        onHeartbeat: heartbeat,
+    });
+    // Phase 5: Tier 3 ungoverned-session detection. Periodic process scan, audit
+    // emit per finding, optional SIGTERM in enforced mode (same-user only).
+    const scanInterval = parseInt(process.env.CORTEX_UNGOVERNED_SCAN_MS ?? "", 10);
+    const intervalMs = Number.isFinite(scanInterval) && scanInterval > 0 ? scanInterval : 60_000;
+    // Phase 6: periodic tamper-checker. For each active session that had at
+    // least one tool-fired hook then went silent past missing_threshold_seconds,
+    // write .cortex-tamper.lock + audit event. The next SessionStart in
+    // enforced mode will refuse to register tools until 'cortex enterprise
+    // repair' clears the lock.
+    const tamperThreshold = parseInt(process.env.CORTEX_TAMPER_MISSING_THRESHOLD_S ?? "", 10);
+    const missingThresholdSeconds = Number.isFinite(tamperThreshold) && tamperThreshold > 0 ? tamperThreshold : 300;
+    const tamperCheckInterval = parseInt(process.env.CORTEX_TAMPER_CHECK_MS ?? "", 10);
+    const tamperCheckMs = Number.isFinite(tamperCheckInterval) && tamperCheckInterval > 0 ? tamperCheckInterval : 60_000;
+    // Phase 7: periodic sync-version-check + host-events push to cortex-web.
+    // Daemon runs as the user post-Fas-3 privilege drop, so sync only checks
+    // version availability (writes a notification + audit). Re-applying
+    // managed-settings still requires 'sudo cortex enterprise sync'.
+    const syncIntervalRaw = parseInt(process.env.CORTEX_SYNC_CHECK_MS ?? "", 10);
+    const syncIntervalMs = Number.isFinite(syncIntervalRaw) && syncIntervalRaw > 0 ? syncIntervalRaw : 60 * 60 * 1000;
+    const pushIntervalRaw = parseInt(process.env.CORTEX_HOST_EVENTS_PUSH_MS ?? "", 10);
+    const pushIntervalMs = Number.isFinite(pushIntervalRaw) && pushIntervalRaw > 0 ? pushIntervalRaw : 5 * 60 * 1000;
+    // Skills v3: poll cortex-web for org-authored skills, write SKILL.md
+    // files into per-CLI user-scope directories. Runs at the same cadence
+    // as the govern-config sync check by default but is independently
+    // configurable.
+    const skillSyncRaw = parseInt(process.env.CORTEX_SKILL_SYNC_MS ?? "", 10);
+    const skillSyncMs = Number.isFinite(skillSyncRaw) && skillSyncRaw > 0 ? skillSyncRaw : syncIntervalMs;
+    // Harness Phase 2: poll cortex-web for org-authored workflows, cache
+    // their definitions locally so cortex.workflow.start can resolve
+    // org-specific workflow_ids ahead of bundled defaults. Same cadence
+    // as the skill sync by default; independently configurable via
+    // CORTEX_WORKFLOW_SYNC_MS / CORTEX_DISABLE_WORKFLOW_SYNC.
+    const workflowSyncRaw = parseInt(process.env.CORTEX_WORKFLOW_SYNC_MS ?? "", 10);
+    const workflowSyncMs = Number.isFinite(workflowSyncRaw) && workflowSyncRaw > 0
+        ? workflowSyncRaw
+        : skillSyncMs;
+    // Harness Phase 2: poll cortex-web for org-authored capabilities and
+    // cache definitions locally so evaluateToolCall can merge them over
+    // bundled DEFAULT_CAPABILITIES on the pre-tool-use path. Same cadence
+    // as the workflow sync by default; independently configurable via
+    // CORTEX_CAPABILITY_SYNC_MS / CORTEX_DISABLE_CAPABILITY_SYNC.
+    const capabilitySyncRaw = parseInt(process.env.CORTEX_CAPABILITY_SYNC_MS ?? "", 10);
+    const capabilitySyncMs = Number.isFinite(capabilitySyncRaw) && capabilitySyncRaw > 0
+        ? capabilitySyncRaw
+        : workflowSyncMs;
+    // Govern host heartbeat — fills host_enrollment on cortex-web so the
+    // dashboard at /dashboard/govern actually shows this host.
+    const heartbeatRaw = parseInt(process.env.CORTEX_HEARTBEAT_PUSH_MS ?? "", 10);
+    const heartbeatMs = Number.isFinite(heartbeatRaw) && heartbeatRaw > 0 ? heartbeatRaw : 5 * 60 * 1000;
+    projectServices = new ProjectServiceRegistry((cwd) => {
+        const handles = [];
+        if (process.env.CORTEX_DISABLE_SYNC_CHECK !== "1") {
+            handles.push(startSyncTimer(cwd, syncIntervalMs));
+        }
+        if (process.env.CORTEX_DISABLE_HOST_EVENTS_PUSH !== "1") {
+            handles.push(startHostEventsPusher(cwd, pushIntervalMs));
+        }
+        return handles;
+    }, {
+        credentialIdForCwd: configuredEnterpriseCredentialId,
+        hostFactory: (cwd, credentialId) => {
+            const handles = [];
+            // These services operate on user-global process or artifact state.
+            // One explicit host governance project owns them; projects carrying
+            // another Enterprise identity are rejected by the registry.
+            if (process.env.CORTEX_DISABLE_UNGOVERNED_SCAN !== "1") {
+                // Process snapshots do not carry a trustworthy project cwd. Keep the
+                // single host-wide scanner detection-only so an enforced project can
+                // never terminate a process belonging to an advisory project.
+                handles.push(startUngovernedScanner({
+                    cwd,
+                    credentialId,
+                    intervalMs,
+                    mode: "advisory",
+                }));
+            }
+            if (process.env.CORTEX_DISABLE_HOST_EVENTS_PUSH !== "1") {
+                handles.push(startGlobalUngovernedEventsPusher(cwd, credentialId, pushIntervalMs));
+            }
+            if (process.env.CORTEX_DISABLE_SKILL_SYNC !== "1") {
+                handles.push(startSkillSyncTimer(cwd, skillSyncMs));
+            }
+            if (process.env.CORTEX_DISABLE_WORKFLOW_SYNC !== "1") {
+                handles.push(startWorkflowSyncTimer(cwd, workflowSyncMs));
+            }
+            if (process.env.CORTEX_DISABLE_CAPABILITY_SYNC !== "1") {
+                handles.push(startCapabilitySyncTimer(cwd, capabilitySyncMs));
+            }
+            if (process.env.CORTEX_DISABLE_HEARTBEAT_PUSH !== "1") {
+                handles.push(startHeartbeatPusher(cwd, heartbeatMs));
+            }
+            return handles;
+        },
+    });
+    await daemon.start();
+    const startupCwd = normalizeProjectCwd(process.cwd());
+    if (startupCwd)
+        registerEnterpriseProject(startupCwd);
+    // Phase 4 task 19: cortex egress proxy. Logs SNI + destination per
+    // outbound connection (no TLS termination). cortex run sets
+    // HTTPS_PROXY/HTTP_PROXY for the Copilot wrap; other AI CLIs respect
+    // these env vars too if a developer wires them in.
+    const proxyPortRaw = parseInt(process.env.CORTEX_EGRESS_PROXY_PORT ?? "", 10);
+    const proxyPort = Number.isFinite(proxyPortRaw) && proxyPortRaw > 0 ? proxyPortRaw : 18888;
+    if (process.env.CORTEX_DISABLE_EGRESS_PROXY !== "1") {
+        // A shared proxy connection has no trustworthy project identity. Keep
+        // transport support, but suppress project audit emission until callers
+        // use an attributable per-project channel.
+        startEgressProxy({ port: proxyPort })
+            .then((handle) => {
+            process.stderr.write(`[cortex-daemon] egress proxy listening on 127.0.0.1:${handle.port}\n`);
+        })
+            .catch((err) => {
+            process.stderr.write(`[cortex-daemon] egress proxy failed to start: ${err instanceof Error ? err.message : String(err)}\n`);
+        });
+    }
+    // Periodic telemetry push. Daemon owns the network call so MCP doesn't
+    // race with itself or with this loop. Walks active sessions, dedupes
+    // cwds, and runs the existing per-cwd flush handler.
+    const telemetryPushRaw = parseInt(process.env.CORTEX_TELEMETRY_PUSH_MS ?? "", 10);
+    const telemetryPushMs = Number.isFinite(telemetryPushRaw) && telemetryPushRaw > 0
+        ? telemetryPushRaw
+        : 5 * 60 * 1000;
+    if (process.env.CORTEX_DISABLE_TELEMETRY_PUSH !== "1") {
+        const telemetryTimer = setInterval(async () => {
+            const cwds = new Set();
+            for (const [, state] of tracker.getActiveSessions()) {
+                if (state.cwd)
+                    cwds.add(state.cwd);
+            }
+            for (const cwd of cwds) {
+                try {
+                    await telemetryFlush({ reason: "interval", cwd });
+                }
+                catch (err) {
+                    process.stderr.write(`[cortex-daemon] telemetry push failed for ${cwd}: ${err instanceof Error ? err.message : String(err)}\n`);
+                }
+            }
+        }, telemetryPushMs);
+        if (typeof telemetryTimer.unref === "function")
+            telemetryTimer.unref();
+    }
+    if (process.env.CORTEX_DISABLE_TAMPER_CHECK !== "1") {
+        const checkTimer = setInterval(() => {
+            const detected = tracker.detectTamper({
+                cwds: projectServices?.projectCwds() ?? [],
+                missingThresholdSeconds,
+            });
+            for (const entry of detected) {
+                try {
+                    writeTamperLock(entry.cwd, entry);
+                }
+                catch (err) {
+                    process.stderr.write(`[cortex-daemon] failed to write tamper lock: ${err instanceof Error ? err.message : String(err)}\n`);
+                }
+                void emitTamperAudit(entry.cwd, entry).catch((err) => {
+                    process.stderr.write(`[cortex-daemon] failed to emit tamper audit: ${err instanceof Error ? err.message : String(err)}\n`);
+                });
+            }
+        }, tamperCheckMs);
+        if (typeof checkTimer.unref === "function")
+            checkTimer.unref();
+    }
+}
+main().catch((err) => {
+    process.stderr.write(`[cortex-daemon] fatal: ${err instanceof Error ? err.message : String(err)}\n`);
+    process.exit(1);
+});

package/scaffold/mcp/dist/daemon/paths.js

@@ -0,0 +1,36 @@
+import { join } from "node:path";
+import { homedir, tmpdir, userInfo } from "node:os";
+import { mkdirSync } from "node:fs";
+/**
+ * Resolves filesystem locations the daemon and hooks share.
+ * Per-user, not per-project — one daemon serves all projects so warm graph
+ * + embeddings stay loaded across switches.
+ */
+function safeUid() {
+    try {
+        const info = userInfo();
+        if (typeof info.uid === "number" && info.uid >= 0) {
+            return String(info.uid);
+        }
+        return info.username || "anon";
+    }
+    catch {
+        return "anon";
+    }
+}
+export function daemonDir() {
+    const dir = join(homedir(), ".cortex");
+    mkdirSync(dir, { recursive: true });
+    return dir;
+}
+export function pidFilePath() {
+    return join(daemonDir(), "daemon.pid");
+}
+export function logFilePath() {
+    return join(daemonDir(), "daemon.log");
+}
+export function socketPath() {
+    // Keep socket in tmpdir per-user — Linux has 108-char path limit on
+    // sockaddr_un.sun_path so we avoid putting it under $HOME.
+    return join(tmpdir(), `cortex-${safeUid()}.sock`);
+}

package/scaffold/mcp/dist/daemon/project-service-registry.js

@@ -0,0 +1,78 @@
+import { existsSync, realpathSync, statSync } from "node:fs";
+import { join, resolve } from "node:path";
+export function normalizeProjectCwd(cwd) {
+    if (!cwd.trim())
+        return null;
+    const candidate = resolve(cwd);
+    try {
+        if (!existsSync(candidate) || !statSync(candidate).isDirectory()) {
+            return null;
+        }
+        if (!existsSync(join(candidate, ".context"))) {
+            return null;
+        }
+        return realpathSync(candidate);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Owns background services for every project observed by the per-user daemon.
+ * Request-time handlers already carry cwd in their payloads; this registry
+ * gives the periodic services the same project isolation.
+ */
+export class ProjectServiceRegistry {
+    factory;
+    options;
+    projects = new Map();
+    hostCredentialId = null;
+    hostHandles = [];
+    constructor(factory, options = {}) {
+        this.factory = factory;
+        this.options = options;
+    }
+    register(cwd) {
+        const normalized = normalizeProjectCwd(cwd);
+        if (!normalized || this.projects.has(normalized))
+            return false;
+        const credentialId = this.options.credentialIdForCwd?.(normalized) ?? "project-local";
+        if (!credentialId)
+            return false;
+        if (this.hostCredentialId &&
+            this.hostCredentialId !== credentialId) {
+            return false;
+        }
+        if (!this.hostCredentialId) {
+            this.hostCredentialId = credentialId;
+            this.hostHandles =
+                this.options.hostFactory?.(normalized, credentialId) ?? [];
+        }
+        const handles = this.factory(normalized);
+        this.projects.set(normalized, handles);
+        return true;
+    }
+    has(cwd) {
+        const normalized = normalizeProjectCwd(cwd);
+        return normalized ? this.projects.has(normalized) : false;
+    }
+    projectCwds() {
+        return Array.from(this.projects.keys());
+    }
+    async stopAll() {
+        const handles = [
+            ...Array.from(this.projects.values()).flat(),
+            ...this.hostHandles,
+        ];
+        this.projects.clear();
+        this.hostHandles = [];
+        this.hostCredentialId = null;
+        await Promise.allSettled(handles.map((handle) => Promise.resolve(handle.stop())));
+    }
+    size() {
+        return this.projects.size;
+    }
+    activeCredentialId() {
+        return this.hostCredentialId;
+    }
+}

package/scaffold/mcp/dist/daemon/protocol.js

@@ -0,0 +1,8 @@
+/**
+ * Wire protocol between cortex hooks and the cortex daemon.
+ * Newline-delimited JSON over a Unix socket.
+ *
+ * Each request: { id, type, payload }
+ * Each response: { id, ok, result?, error? }
+ */
+export const DEFAULT_REQUEST_TIMEOUT_MS = 5000;