@danielblomma/cortex-mcp 2.4.0 → 2.4.2

package/scaffold/mcp/dist/enterprise/reviews/trust-state.js

@@ -0,0 +1,186 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync, } from "node:fs";
+import { join } from "node:path";
+import { setWorkflowReviewTrust } from "../workflow/state.js";
+import { resolveWorkflowDefinition } from "../../core/workflow/resolution.js";
+function trustStatePath(contextDir) {
+    return join(contextDir, "review-trust.json");
+}
+function nowIso() {
+    return new Date().toISOString();
+}
+function initialTrustState() {
+    return {
+        version: 1,
+        repo: null,
+        instance_id: null,
+        session_id: null,
+        workflow: {
+            id: null,
+            source: "unknown",
+            task_id: null,
+        },
+        last_review_at: null,
+        review_summary: null,
+        skipped_policies: [],
+        delivery: {
+            status: "never_attempted",
+            review_count: 0,
+            queued_at: null,
+            last_attempted_at: null,
+            last_pushed_at: null,
+            last_accepted_at: null,
+            last_error: null,
+        },
+        trust_warnings: [],
+    };
+}
+function ensureContextDir(contextDir) {
+    mkdirSync(contextDir, { recursive: true });
+}
+function inferWorkflow(projectRoot, taskId) {
+    const normalizedTaskId = taskId?.trim();
+    if (!normalizedTaskId) {
+        return { id: null, source: "unknown", task_id: null };
+    }
+    const statePath = join(projectRoot, ".agents", normalizedTaskId, "state.json");
+    if (!existsSync(statePath)) {
+        return { id: null, source: "unknown", task_id: normalizedTaskId };
+    }
+    try {
+        const raw = JSON.parse(readFileSync(statePath, "utf8"));
+        const workflowId = typeof raw.workflow_id === "string" ? raw.workflow_id : null;
+        if (!workflowId) {
+            return { id: null, source: "unknown", task_id: normalizedTaskId };
+        }
+        const resolved = resolveWorkflowDefinition(workflowId, {
+            cwd: projectRoot,
+        });
+        return {
+            id: workflowId,
+            source: resolved.source,
+            task_id: normalizedTaskId,
+        };
+    }
+    catch {
+        return {
+            id: null,
+            source: "unknown",
+            task_id: normalizedTaskId,
+        };
+    }
+}
+function computeWarnings(state) {
+    const warnings = [];
+    if (!state.workflow.id) {
+        warnings.push({
+            code: "workflow-unresolved",
+            message: "No active local workflow could be resolved for this review session, so workflow/review correlation is unproven.",
+        });
+    }
+    else if (state.workflow.source !== "synced") {
+        warnings.push({
+            code: "workflow-source-unverified",
+            message: `Workflow "${state.workflow.id}" is not proven to come from the synced org registry for this session.`,
+        });
+    }
+    if (state.delivery.status === "queued" || state.delivery.status === "pushed") {
+        warnings.push({
+            code: "review-delivery-pending",
+            message: "Local review results exist for this session, but Cortex has not yet confirmed acceptance by the control plane.",
+        });
+    }
+    if (state.delivery.status === "failed") {
+        warnings.push({
+            code: "review-delivery-failed",
+            message: `Review delivery failed${state.delivery.last_error ? `: ${state.delivery.last_error}` : ""}`,
+        });
+    }
+    if (state.skipped_policies.length > 0) {
+        warnings.push({
+            code: "policy-not-enforceable",
+            message: `${state.skipped_policies.length} configured policy` +
+                `${state.skipped_policies.length === 1 ? " was" : "ies were"} not enforceable locally.`,
+        });
+    }
+    return warnings;
+}
+export function loadReviewTrustState(contextDir) {
+    ensureContextDir(contextDir);
+    const filePath = trustStatePath(contextDir);
+    if (!existsSync(filePath)) {
+        const initial = initialTrustState();
+        writeReviewTrustState(contextDir, initial);
+        return initial;
+    }
+    try {
+        const parsed = JSON.parse(readFileSync(filePath, "utf8"));
+        parsed.trust_warnings = computeWarnings(parsed);
+        return parsed;
+    }
+    catch {
+        const initial = initialTrustState();
+        writeReviewTrustState(contextDir, initial);
+        return initial;
+    }
+}
+export function writeReviewTrustState(contextDir, state) {
+    ensureContextDir(contextDir);
+    state.trust_warnings = computeWarnings(state);
+    writeFileSync(trustStatePath(contextDir), `${JSON.stringify(state, null, 2)}\n`, "utf8");
+    setWorkflowReviewTrust(contextDir, state);
+    return state;
+}
+export function recordQueuedReviewTrustState(context, input) {
+    const state = loadReviewTrustState(context.contextDir);
+    const workflow = inferWorkflow(context.projectRoot, context.task_id);
+    state.repo = context.repo ?? state.repo;
+    state.instance_id = context.instance_id ?? state.instance_id;
+    state.session_id = context.session_id ?? state.session_id;
+    state.workflow = workflow;
+    state.last_review_at = input.reviewedAt;
+    state.review_summary = {
+        total: input.summary.total,
+        passed: input.summary.passed,
+        failed: input.summary.failed,
+        warnings: input.summary.warnings,
+        skipped: input.summary.skipped,
+    };
+    state.skipped_policies = input.skippedPolicies;
+    const hasQueuedReviews = input.summary.total > 0;
+    state.delivery = {
+        status: hasQueuedReviews ? "queued" : "never_attempted",
+        review_count: input.summary.total,
+        queued_at: hasQueuedReviews ? input.reviewedAt : null,
+        last_attempted_at: null,
+        last_pushed_at: null,
+        last_accepted_at: null,
+        last_error: null,
+    };
+    return writeReviewTrustState(context.contextDir, state);
+}
+export function recordReviewDeliveryStatus(contextDir, status, input = {}) {
+    const state = loadReviewTrustState(contextDir);
+    const at = input.attemptedAt ?? nowIso();
+    state.delivery.review_count = input.reviewCount ?? state.delivery.review_count;
+    state.delivery.last_attempted_at = at;
+    if (status === "pushed") {
+        state.delivery.status = "pushed";
+        state.delivery.last_pushed_at = at;
+        state.delivery.last_error = null;
+    }
+    else if (status === "accepted") {
+        state.delivery.status = "accepted";
+        state.delivery.last_pushed_at = at;
+        state.delivery.last_accepted_at = at;
+        state.delivery.last_error = null;
+    }
+    else if (status === "failed") {
+        state.delivery.status = "failed";
+        state.delivery.last_pushed_at = at;
+        state.delivery.last_error = input.error ?? "unknown error";
+    }
+    else {
+        state.delivery.status = status;
+    }
+    return writeReviewTrustState(contextDir, state);
+}

package/scaffold/mcp/dist/enterprise/telemetry/sync.js

@@ -0,0 +1,57 @@
+import { isAllowedEnterpriseEndpoint } from "../../core/secure-endpoint.js";
+import { buildTelemetryPushPayload } from "../privacy/boundary.js";
+let lastPush = null;
+export function getLastPush() {
+    return lastPush;
+}
+/**
+ * Push aggregated metrics to the Cortex Cloud API.
+ * Connected edition only. Returns success/failure.
+ *
+ * The actual cloud API is built in Phase 4 — this sends a POST
+ * with JSON body and expects a 2xx response.
+ */
+export async function pushMetrics(metrics, endpoint, apiKey, context = {}) {
+    if (!endpoint || !apiKey) {
+        const result = { success: false, error: "endpoint or api_key not configured" };
+        lastPush = result;
+        return result;
+    }
+    if (!isAllowedEnterpriseEndpoint(endpoint)) {
+        const result = {
+            success: false,
+            error: "insecure or invalid enterprise endpoint",
+        };
+        lastPush = result;
+        return result;
+    }
+    try {
+        const response = await fetch(endpoint, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                "Authorization": `Bearer ${apiKey}`,
+            },
+            body: JSON.stringify(buildTelemetryPushPayload(metrics, context)),
+            signal: AbortSignal.timeout(10000),
+        });
+        const result = {
+            success: response.ok,
+            status: response.status,
+            pushed_at: new Date().toISOString(),
+        };
+        if (!response.ok) {
+            result.error = `HTTP ${response.status}`;
+        }
+        lastPush = result;
+        return result;
+    }
+    catch (err) {
+        const result = {
+            success: false,
+            error: err instanceof Error ? err.message : "unknown error",
+        };
+        lastPush = result;
+        return result;
+    }
+}