@ornexus/neocortex 4.60.43 → 4.60.45

package/targets-stubs/codex/install-codex.sh

@@ -51,7 +51,10 @@ install_codex() {
     if [ -f "$codex_target/config-mcp.toml" ]; then
         local config_file="$codex_home/config.toml"
         if command -v node >/dev/null 2>&1; then
-            node "$(dirname "$codex_target/config-mcp.toml")/../lib/mcp-merge.js" toml "$codex_target/config-mcp.toml" "$config_file" CODEX || true
+            node "$(dirname "$codex_target/config-mcp.toml")/../lib/mcp-merge.js" toml "$codex_target/config-mcp.toml" "$config_file" CODEX || {
+                echo "[CODEX] ERROR: MCP merge blocked; user config was preserved." >&2
+                return 1
+            }
         else
             echo "[CODEX] WARN: node not found; leaving existing $config_file untouched"
             echo "[CODEX] WARN: Stub available at: $codex_target/config-mcp.toml"

package/targets-stubs/cursor/agent.md

@@ -1,6 +1,6 @@
 ---
 name: neocortex
-description: "🧠 Neocortex v4.60.43 | OrNexus Team"
+description: "🧠 Neocortex v4.60.45 | OrNexus Team"
 model: inherit
 readonly: false
 is_background: false
@@ -64,7 +64,7 @@ SEMPRE que este agente for invocado, imprima o banner abaixo como PRIMEIRO outpu
 ┌────────────────────────────────────────────────────────────┐
 │                                                            │
 │       #######           N E O C O R T E X                  │
-│      ###  ########      v4.60.43                           │
+│      ###  ########      v4.60.45                           │
 │ #########      #####                                       │
 │ ##    ##############    Development Orchestrator           │
 │ ##   ###  ######  ##    OrNexus Team                       │

package/targets-stubs/cursor/install-cursor.sh

@@ -42,7 +42,10 @@ install_cursor() {
 
     # 2. User-level additive merge MCP config (preserves user-configured servers)
     if [ -f "$cursor_target/mcp.json" ]; then
-        _merge_cursor_mcp "$cursor_target/mcp.json" "${CURSOR_HOME:-$HOME/.cursor}/mcp.json" || true
+        _merge_cursor_mcp "$cursor_target/mcp.json" "${CURSOR_HOME:-$HOME/.cursor}/mcp.json" || {
+            echo "[CURSOR] ERROR: MCP merge blocked; user config was preserved." >&2
+            return 1
+        }
     fi
 
     echo "[CURSOR] Thin-client installation complete!"

package/targets-stubs/gemini-cli/agent.md

@@ -1,6 +1,6 @@
 ---
 name: neocortex-root
-description: "🧠 Neocortex v4.60.43 | OrNexus Team"
+description: "🧠 Neocortex v4.60.45 | OrNexus Team"
 kind: local
 tools:
   # File operations (Gemini CLI built-ins)
@@ -62,7 +62,7 @@ SEMPRE que este agente for invocado, imprima o banner abaixo como PRIMEIRO outpu
 ┌────────────────────────────────────────────────────────────┐
 │                                                            │
 │       #######           N E O C O R T E X                  │
-│      ###  ########      v4.60.43                           │
+│      ###  ########      v4.60.45                           │
 │ #########      #####                                       │
 │ ##    ##############    Development Orchestrator           │
 │ ##   ###  ######  ##    OrNexus Team                       │

package/targets-stubs/gemini-cli/install-gemini.sh

@@ -63,7 +63,10 @@ install_gemini() {
 
     # 4. Additive merge MCP config into settings.json
     if [ -f "$gemini_target/settings-mcp.json" ]; then
-        _merge_gemini_mcp "$gemini_target/settings-mcp.json" "$gemini_home/settings.json" || true
+        _merge_gemini_mcp "$gemini_target/settings-mcp.json" "$gemini_home/settings.json" || {
+            echo "[GEMINI] ERROR: MCP merge blocked; user config was preserved." >&2
+            return 1
+        }
     fi
 
     echo "[GEMINI] Thin-client installation complete!"

package/targets-stubs/grok/install-grok.sh

@@ -21,7 +21,10 @@ install_grok() {
     fi
 
     if command -v node >/dev/null 2>&1; then
-        node "$source_dir/targets-stubs/lib/mcp-merge.js" toml "$grok_target/config-mcp.toml" "$grok_home/config.toml" GROK || true
+        node "$source_dir/targets-stubs/lib/mcp-merge.js" toml "$grok_target/config-mcp.toml" "$grok_home/config.toml" GROK || {
+            echo "[GROK] ERROR: MCP merge blocked; user config was preserved." >&2
+            return 1
+        }
     else
         echo "[GROK] WARN: node not found; leaving existing $grok_home/config.toml untouched"
     fi

package/targets-stubs/lib/mcp-merge.js

@@ -6,6 +6,7 @@
 
 const fs = require('fs');
 const path = require('path');
+const crypto = require('crypto');
 
 const MANAGED_SERVERS = [
   'playwright',
@@ -51,16 +52,168 @@ function stableJson(value) {
   return `${JSON.stringify(value, null, 2)}\n`;
 }
 
-function mergeJson(stubFile, destFile, rootKey, target) {
+function ownershipPath(destFile) {
+  return `${destFile}.neocortex-ownership.json`;
+}
+
+function atomicWrite(file, content) {
+  ensureDir(file);
+  const temporary = `${file}.tmp.${process.pid}.${crypto.randomBytes(6).toString('hex')}`;
+  let fd;
+  try {
+    fd = fs.openSync(temporary, 'wx', 0o600);
+    fs.writeFileSync(fd, content, 'utf8');
+    fs.fsyncSync(fd);
+  } finally {
+    if (fd !== undefined) fs.closeSync(fd);
+  }
+  try {
+    fs.renameSync(temporary, file);
+    try {
+      const dirFd = fs.openSync(path.dirname(file), 'r');
+      try { fs.fsyncSync(dirFd); } finally { fs.closeSync(dirFd); }
+    } catch { /* directory fsync is unavailable on some Windows filesystems */ }
+  } catch (error) {
+    try { fs.unlinkSync(temporary); } catch { /* best effort */ }
+    throw error;
+  }
+}
+
+function canonicalUrl(raw) {
+  if (typeof raw !== 'string' || raw.trim() === '') return null;
+  try {
+    const parsed = new URL(raw.trim());
+    parsed.protocol = parsed.protocol.toLowerCase();
+    parsed.hostname = parsed.hostname.toLowerCase();
+    parsed.hash = '';
+    if (parsed.pathname.length > 1) parsed.pathname = parsed.pathname.replace(/\/+$/, '');
+    return parsed.toString();
+  } catch { return null; }
+}
+
+function canonicalCommand(raw) {
+  const tokens = Array.isArray(raw) ? raw : [raw];
+  if (tokens.some((token) => typeof token !== 'string' || token.trim() === '')) return null;
+  return tokens.map((token, index) => {
+    const trimmed = token.trim();
+    if (index > 0) return trimmed;
+    const basename = trimmed.replace(/\\/g, '/').split('/').pop().toLowerCase();
+    return basename.replace(/\.(?:cmd|exe|bat)$/i, '');
+  });
+}
+
+function canonicalArgs(raw) {
+  if (raw === undefined) return [];
+  if (!Array.isArray(raw)
+    || raw.some((token) => typeof token !== 'string' || token.trim() === '')) return null;
+  return raw.map((token) => token.trim());
+}
+
+function semanticIdentity(entry) {
+  if (!entry || typeof entry !== 'object' || Array.isArray(entry)) return null;
+  const remote = canonicalUrl(entry.url || entry.httpUrl || entry.serverUrl);
+  if (remote) return { transport: 'remote', url: remote };
+  const command = canonicalCommand(entry.command);
+  if (!command) return null;
+  const args = canonicalArgs(entry.args);
+  if (!args) return null;
+  return { transport: 'stdio', argv: [...command, ...args] };
+}
+
+function fingerprint(entry) {
+  const identity = semanticIdentity(entry);
+  return identity
+    ? crypto.createHash('sha256').update(`neocortex-mcp-identity-v1\0${JSON.stringify(identity)}`).digest('hex')
+    : null;
+}
+
+function readOwnership(destFile, target, rootKey) {
+  const file = ownershipPath(destFile);
+  if (!fs.existsSync(file)) return { ok: true, file, value: { schemaVersion: 1, target, rootKey, entries: {} }, text: null };
+  try {
+    const text = fs.readFileSync(file, 'utf8');
+    const value = JSON.parse(text);
+    if (!value || value.schemaVersion !== 1 || typeof value.target !== 'string' || value.rootKey !== rootKey
+      || !value.entries || typeof value.entries !== 'object' || Array.isArray(value.entries)) {
+      throw new Error('invalid ownership schema');
+    }
+    return { ok: true, file, value, text };
+  } catch (error) {
+    console.error(`[${target}] ERROR: MCP_OWNERSHIP_MANIFEST_INVALID (${error.message}); leaving config untouched.`);
+    return { ok: false, file };
+  }
+}
+
+function planSemanticMerge(existing, baseline, managed, ownership, target) {
+  const next = { ...existing };
+  const nextOwned = { ...ownership.entries };
+  const blockers = [];
+  let added = 0;
+  let updated = 0;
+  let deduplicated = 0;
+
+  for (const name of managed) {
+    const desired = baseline[name];
+    const desiredFingerprint = fingerprint(desired);
+    if (!desiredFingerprint) {
+      blockers.push(`MCP_BASELINE_IDENTITY_INVALID:${name}`);
+      continue;
+    }
+    const aliases = Object.entries(next)
+      .filter(([candidate]) => candidate !== name)
+      .filter(([, entry]) => fingerprint(entry) === desiredFingerprint)
+      .map(([candidate]) => candidate);
+    if (aliases.length > 1) {
+      blockers.push(`MCP_SEMANTIC_DUPLICATE_AMBIGUOUS:${name}:${aliases.sort().join(',')}`);
+      continue;
+    }
+
+    const current = next[name];
+    const currentFingerprint = fingerprint(current);
+    const ownedFingerprint = nextOwned[name] && nextOwned[name].fingerprint;
+    const currentlyOwned = typeof ownedFingerprint === 'string' && currentFingerprint === ownedFingerprint;
+
+    if (aliases.length === 1) {
+      if (currentlyOwned) {
+        delete next[name];
+        delete nextOwned[name];
+        deduplicated += 1;
+      }
+      // A user-owned semantic alias is authoritative. Never duplicate or claim it.
+      continue;
+    }
+
+    if (current !== undefined && !currentlyOwned && currentFingerprint !== desiredFingerprint) {
+      blockers.push(`MCP_UNOWNED_NAME_CONFLICT:${name}`);
+      continue;
+    }
+
+    if (current === undefined) added += 1;
+    else if (JSON.stringify(current) !== JSON.stringify(desired)) updated += 1;
+    next[name] = desired;
+    nextOwned[name] = { fingerprint: desiredFingerprint };
+  }
+
+  if (blockers.length) {
+    for (const reason of blockers) console.error(`[${target}] ERROR: ${reason}; leaving config untouched.`);
+  }
+  return { next, entries: nextOwned, blockers, added, updated, deduplicated };
+}
+
+function mergeJson(stubFile, destFile, rootKey, target, managedTopLevelCsv = '') {
   const stubResult = readJson(stubFile, target);
   if (!stubResult.ok) return 1;
   const stub = stubResult.value;
   const baseline = stub[rootKey] && typeof stub[rootKey] === 'object' ? stub[rootKey] : {};
   const managed = MANAGED_SERVERS.filter((name) => Object.prototype.hasOwnProperty.call(baseline, name));
   ensureDir(destFile);
+  const ownership = readOwnership(destFile, target, rootKey);
+  if (!ownership.ok) return 3;
 
   if (!fs.existsSync(destFile)) {
-    fs.writeFileSync(destFile, stableJson(stub));
+    const entries = Object.fromEntries(managed.map((name) => [name, { fingerprint: fingerprint(baseline[name]) }]));
+    atomicWrite(destFile, stableJson(stub));
+    atomicWrite(ownership.file, stableJson({ ...ownership.value, entries }));
     console.log(`[${target}] Created MCP config: ${destFile} (added ${managed.length})`);
     return 0;
   }
@@ -74,22 +227,38 @@ function mergeJson(stubFile, destFile, rootKey, target) {
   if (!existing[rootKey] || typeof existing[rootKey] !== 'object' || Array.isArray(existing[rootKey])) {
     existing[rootKey] = {};
   }
-
-  let added = 0;
-  let updated = 0;
-  for (const name of managed) {
-    if (Object.prototype.hasOwnProperty.call(existing[rootKey], name)) updated += 1;
-    else added += 1;
-    existing[rootKey][name] = baseline[name];
+  const migratedTopLevel = [];
+  for (const name of managedTopLevelCsv.split(',').map((entry) => entry.trim()).filter(Boolean)) {
+    if (!Object.prototype.hasOwnProperty.call(existing, name)) continue;
+    if (Object.prototype.hasOwnProperty.call(existing[rootKey], name)
+      && fingerprint(existing[rootKey][name]) !== fingerprint(existing[name])) {
+      console.error(`[${target}] ERROR: MCP_LEGACY_SCOPE_CONFLICT:${name}; leaving config untouched.`);
+      return 3;
+    }
+    if (!Object.prototype.hasOwnProperty.call(existing[rootKey], name)) existing[rootKey][name] = existing[name];
+    migratedTopLevel.push(name);
   }
 
+  const plan = planSemanticMerge(existing[rootKey], baseline, managed, ownership.value, target);
+  if (plan.blockers.length) return 3;
+  existing[rootKey] = plan.next;
+  for (const name of migratedTopLevel) delete existing[name];
+
   const next = stableJson(existing);
+  const nextOwnership = stableJson({ ...ownership.value, entries: plan.entries });
   if (next !== existingResult.text) {
-    fs.writeFileSync(destFile, next);
-    console.log(`[${target}] Merged MCP config into: ${destFile} (added ${added}, updated ${updated}, preserved user entries)`);
+    if (migratedTopLevel.length > 0) {
+      const stamp = new Date().toISOString().replace(/[:.]/g, '-');
+      const structuralBackup = `${destFile}.neocortex-backup-structural-${stamp}`;
+      fs.copyFileSync(destFile, structuralBackup);
+      console.log(`[${target}] Legacy MCP scope migration backup created: ${structuralBackup}`);
+    }
+    atomicWrite(destFile, next);
+    console.log(`[${target}] Merged MCP config into: ${destFile} (added ${plan.added}, updated ${plan.updated}, deduplicated ${plan.deduplicated}, preserved user entries)`);
   } else {
     console.log(`[${target}] MCP config already up to date: ${destFile} (preserved user entries)`);
   }
+  if (nextOwnership !== ownership.text) atomicWrite(ownership.file, nextOwnership);
   return 0;
 }
 
@@ -109,7 +278,7 @@ function splitManagedTomlSections(text) {
   let currentName = null;
   let current = [];
   const flush = () => {
-    if (currentName && MANAGED_SERVERS.includes(currentName)) {
+    if (currentName) {
       sections.set(currentName, current.join('\n').replace(/\s+$/, '') + '\n');
     }
   };
@@ -119,6 +288,10 @@ function splitManagedTomlSections(text) {
       flush();
       currentName = match[1];
       current = [line];
+    } else if (/^\[[^\]]+\]$/.test(line)) {
+      flush();
+      currentName = null;
+      current = [];
     } else if (currentName) {
       current.push(line);
     }
@@ -127,6 +300,14 @@ function splitManagedTomlSections(text) {
   return sections;
 }
 
+function tomlEntry(section) {
+  const command = section.match(/^command\s*=\s*"([^"]+)"/m)?.[1];
+  const argsRaw = section.match(/^args\s*=\s*\[([^\]]*)\]/m)?.[1];
+  const args = argsRaw === undefined ? undefined : [...argsRaw.matchAll(/"((?:\\.|[^"])*)"/g)].map((match) => match[1].replace(/\\"/g, '"'));
+  const url = section.match(/^(?:url|http_url|server_url)\s*=\s*"([^"]+)"/m)?.[1];
+  return url ? { url } : { command, ...(args ? { args } : {}) };
+}
+
 function removeManagedTomlSections(text, managed) {
   const lines = text.split(/\r?\n/);
   const out = [];
@@ -146,11 +327,18 @@ function mergeToml(stubFile, destFile, target) {
   if (stubInvalid) throw new Error(`invalid stub TOML: ${stubInvalid}`);
   const stubSections = splitManagedTomlSections(stubText);
   const managed = [...stubSections.keys()];
-  const managedBlock = managed.map((name) => stubSections.get(name).trimEnd()).join('\n\n');
+  const baseline = Object.fromEntries(managed.map((name) => [name, tomlEntry(stubSections.get(name))]));
   ensureDir(destFile);
+  const ownership = readOwnership(destFile, target, 'mcp_servers');
+  if (!ownership.ok) return 3;
 
   if (!fs.existsSync(destFile)) {
-    fs.writeFileSync(destFile, `# Neocortex MCP Servers\n${managedBlock}\n`);
+    const managedBlock = managed.map((name) => stubSections.get(name).trimEnd()).join('\n\n');
+    atomicWrite(destFile, `# Neocortex MCP Servers\n${managedBlock}\n`);
+    atomicWrite(ownership.file, stableJson({
+      ...ownership.value,
+      entries: Object.fromEntries(managed.map((name) => [name, { fingerprint: fingerprint(baseline[name]) }])),
+    }));
     console.log(`[${target}] Created MCP config: ${destFile} (added ${managed.length})`);
     return 0;
   }
@@ -162,23 +350,35 @@ function mergeToml(stubFile, destFile, target) {
     return 0;
   }
 
-  const preserved = removeManagedTomlSections(existing, managed).replace(/\n*# Neocortex MCP Servers\s*\n*$/, '\n');
-  const next = `${preserved.trimEnd()}\n\n# Neocortex MCP Servers\n${managedBlock}\n`;
+  const existingSections = splitManagedTomlSections(existing);
+  const existingEntries = Object.fromEntries([...existingSections].map(([name, section]) => [name, tomlEntry(section)]));
+  const plan = planSemanticMerge(existingEntries, baseline, managed, ownership.value, target);
+  if (plan.blockers.length) return 3;
+  const namesToRemove = managed.filter((name) => !Object.prototype.hasOwnProperty.call(plan.next, name)
+    || Object.prototype.hasOwnProperty.call(plan.entries, name));
+  const namesToAppend = managed.filter((name) => Object.prototype.hasOwnProperty.call(plan.entries, name));
+  const preserved = removeManagedTomlSections(existing, namesToRemove).replace(/\n*# Neocortex MCP Servers\s*\n*$/, '\n');
+  const managedBlock = namesToAppend.map((name) => stubSections.get(name).trimEnd()).join('\n\n');
+  const next = managedBlock
+    ? `${preserved.trimEnd()}\n\n# Neocortex MCP Servers\n${managedBlock}\n`
+    : `${preserved.trimEnd()}\n`;
+  const nextOwnership = stableJson({ ...ownership.value, entries: plan.entries });
   if (next !== existing) {
-    fs.writeFileSync(destFile, next);
-    console.log(`[${target}] Merged MCP config into: ${destFile} (managed ${managed.length}, preserved unknown sections)`);
+    atomicWrite(destFile, next);
+    console.log(`[${target}] Merged MCP config into: ${destFile} (managed ${namesToAppend.length}, deduplicated ${plan.deduplicated}, preserved unknown sections)`);
   } else {
     console.log(`[${target}] MCP config already up to date: ${destFile} (preserved unknown sections)`);
   }
+  if (nextOwnership !== ownership.text) atomicWrite(ownership.file, nextOwnership);
   return 0;
 }
 
-const [mode, stubFile, destFile, rootOrTarget, maybeTarget] = process.argv.slice(2);
+const [mode, stubFile, destFile, rootOrTarget, maybeTarget, managedTopLevelCsv] = process.argv.slice(2);
 if (!mode || !stubFile || !destFile) usage();
 
 try {
   const code = mode === 'json'
-    ? mergeJson(stubFile, destFile, rootOrTarget, maybeTarget || 'MCP')
+    ? mergeJson(stubFile, destFile, rootOrTarget, maybeTarget || 'MCP', managedTopLevelCsv)
     : mode === 'toml'
       ? mergeToml(stubFile, destFile, rootOrTarget || 'MCP')
       : (usage(), 64);

package/targets-stubs/opencode/neocortex-root.md

@@ -58,7 +58,7 @@ explicit server opt-in rather than a local assumption.
 ┌────────────────────────────────────────────────────────────┐
 │                                                            │
 │       #######           N E O C O R T E X                  │
-│      ###  ########      v4.60.43                           │
+│      ###  ########      v4.60.45                           │
 │ #########      #####                                       │
 │ ##    ##############    Development Orchestrator           │
 │ ##   ###  ######  ##    OrNexus Team                       │

package/targets-stubs/vscode/install-vscode.sh

@@ -64,7 +64,10 @@ install_vscode() {
 
     # 3. User-level additive merge MCP config
     if [ -f "$vscode_target/mcp.json" ]; then
-        _merge_vscode_mcp "$vscode_target/mcp.json" "$(_vscode_user_mcp_path)" || true
+        _merge_vscode_mcp "$vscode_target/mcp.json" "$(_vscode_user_mcp_path)" || {
+            echo "[VSCODE] ERROR: MCP merge blocked; user config was preserved." >&2
+            return 1
+        }
     fi
 
     echo "[VSCODE] Thin-client installation complete!"

package/targets-stubs/vscode/neocortex.agent.md

@@ -1,6 +1,6 @@
 ---
 name: "neocortex"
-description: "Neocortex v4.60.43 | OrNexus Team"
+description: "Neocortex v4.60.45 | OrNexus Team"
 tools:
   # Read / Edit (built-in tool sets)
   - read
@@ -68,7 +68,7 @@ SEMPRE que este agente for invocado, imprima o banner abaixo como PRIMEIRO outpu
 ┌────────────────────────────────────────────────────────────┐
 │                                                            │
 │       #######           N E O C O R T E X                  │
-│      ###  ########      v4.60.43                           │
+│      ###  ########      v4.60.45                           │
 │ #########      #####                                       │
 │ ##    ##############    Development Orchestrator           │
 │ ##   ###  ######  ##    OrNexus Team                       │