[BUG] [v0.0.7] cortex github uninstall deletes unrelated workflow files whose contents merely mention cortex

[marvinayisi]

Project

cortex

Description

cortex github uninstall can delete an unrelated workflow file if the file merely contains the word cortex.

repro.mp4

Error Message

$ cortex github uninstall --path /tmp/cortex-gh-uninstall.XXXXXX --workflow-name ci --force
Cortex workflow removed successfully!
   Removed: /tmp/cortex-gh-uninstall.XXXXXX/.github/workflows/ci.yml

exists_after=no

Debug Logs

$ cat /tmp/cortex-gh-uninstall.XXXXXX/.github/workflows/ci.yml
name: CI
on: [push]
# notify cortex team on failure
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - run: echo unrelated

$ cortex github uninstall --path /tmp/cortex-gh-uninstall.XXXXXX --workflow-name ci --force
# file is deleted even though it was not generated by Cortex

System Information

cortex 0.0.7 (7954d02 2026-04-03)
macOS 26.1 (25B78)
Darwin 25.1.0 arm64
CPU: Apple M2
RAM: 8 GB

Screenshots

repro.mp4

Steps to Reproduce

1. Create a temporary directory with .github/workflows/ci.yml.
2. Put an unrelated workflow in that file, but include the word cortex somewhere in the contents.
3. Run cortex github uninstall --path <dir> --workflow-name ci --force.
4. Check whether the original file still exists.

Expected Behavior

github uninstall should only remove workflows that were actually generated by Cortex, not arbitrary workflows whose contents happen to mention the word cortex.

Actual Behavior

The command treats any matching file as a Cortex workflow if its contents contain Cortex or cortex, then deletes it.

Additional Context

Code path: /Users/odeili/Projects/platform/cortex/src/cortex-cli/src/github_cmd.rs. run_uninstall() verifies the target file using a loose content.contains("Cortex") || content.contains("cortex") check before removal. Duplicate check on April 5, 2026: searched github uninstall deletes unrelated workflow containing cortex string, github uninstall false positive removes non cortex workflow, and cortex github uninstall removes unrelated workflow containing cortex; I did not find a matching Cortex issue.

[GreyforgeLabs]

Opened upstream PR: CortexLM/cortex-code#388

Patch summary:

• cortex github uninstall now requires the cortex github install generator marker before treating a workflow as Cortex-owned.
• Unrelated workflow files that merely mention cortex are rejected and left intact.
• Added binary integration coverage for both rejecting an unrelated workflow and still removing a generated Cortex workflow.

Validation:

• cargo test -p cortex-cli --test github_uninstall_workflow --no-default-features --features cortex-tui -- --nocapture
• cargo check -p cortex-cli --no-default-features --features cortex-tui
• cargo fmt --package cortex-cli --check
• git diff --check

[atlas-cortex]

✅ Validation Summary — Issue #46726

All validation checks passed. All 17 code rules passed. | 14 LLM instructions active

Confidence Score: 4/5

• All validation checks passed. This submission meets the bounty requirements.

Validation Checks

Check	Status	Detail
Media Evidence	✅ Pass	Evidence found and accessible
Spam Detection	✅ Pass	Score: 24% — no spam signals
Duplicate Detection	✅ Pass	No significant overlap with existing issues
Code Verification	✅ Pass	Bug confirmed in source code (confidence: 100%) — screenshots invalid — The code in src/cortex-cli/src/github_cmd.rs confirms the bug. The `run_uninst
Edit History	✅ Pass	No suspicious edits
LLM Evaluation	✅ Pass	All validation checks passed. All 17 code rules passed.

Validation Pipeline

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["Issue #46726"] --> B{"Media Check"}
    B -->|"✅ Found"| C{"Spam Check"}
    C -->|"✅ Clean"| D{"Duplicate Check"}
    D -->|"✅ Unique"| CV{"Code Verify"}
    CV -->|"✅ Confirmed"| E{"Edit History"}
    E -->|"✅ Normal"| F{"LLM Evaluation"}
    F -->|"✅ Valid"| G["✅ Approved"]
    style G fill:#51cf66,color:#fff

Loading

Raw Evidence

{
  "media": {
    "hasMedia": true,
    "accessible": true,
    "urls": [
      "https://private-user-images.githubusercontent.com/187752593/573875521-b8611d80-047b-472d-bb67-306a9f65804d.mp4?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3NzkyNDcxMzgsIm5iZiI6MTc3OTI0NjgzOCwicGF0aCI6Ii8xODc3NTI1OTMvNTczODc1NTIxLWI4NjExZDgwLTA0N2ItNDcyZC1iYjY3LTMwNmE5ZjY1ODA0ZC5tcDQ_WC1BbXotQWxnb3JpdGhtPUFXUzQtSE1BQy1TSEEyNTYmWC1BbXotQ3JlZGVudGlhbD1BS0lBVkNPRFlMU0E1M1BRSzRaQSUyRjIwMjYwNTIwJTJGdXMtZWFzdC0xJTJGczMlMkZhd3M0X3JlcXVlc3QmWC1BbXotRGF0ZT0yMDI2MDUyMFQwMzEzNThaJlgtQW16LUV4cGlyZXM9MzAwJlgtQW16LVNpZ25hdHVyZT00YjkxOGYzNzY2MDM5ZTk4ZDgyZGIyM2NjNzE3N2YyZWNkYTliOTVmY2ZiODVlYTU5NGI4OTZkYzg5ZDg2OGM2JlgtQW16LVNpZ25lZEhlYWRlcnM9aG9zdCZyZXNwb25zZS1jb250ZW50LXR5cGU9dmlkZW8lMkZtcDQifQ.yGOF7Fq57S9cBg60dnr8guviYky7XU5QFmQEw595TmI"
    ],
    "evidence": [
      "Found 1 media URL(s) via GitHub rendered HTML",
      "1 URL(s) accessible"
    ]
  },
  "spam": {
    "overallScore": 0.24213615023474178,
    "details": "template=0.42 (1 recent issues compared); burst=0.25 (2 issues in 2h window); parity=0.00; overall=0.24 (threshold=0.7)"
  },
  "duplicate": {
    "isDuplicate": false,
    "similarity": 0.3747909312178001,
    "topSimilar": [
      {
        "issueNumber": 43283,
        "title": "[BUG] [v0.0.7] CLI QUICK START uses “fix the bug” example while /bug describes “Report a bug” — inconsistent",
        "similarity": 0.3747909312178001
      },
      {
        "issueNumber": 43479,
        "title": "[BUG] [v0.0.7] %USERPROFILE%\\\\.cortex directory listing: mixed left/right column alignment (PowerShell dir / Get-ChildItem)",
        "similarity": 0.3554546514994495
      },
      {
        "issueNumber": 46721,
        "title": "s",
        "similarity": 0.2898945188260579
      },
      {
        "issueNumber": 43632,
        "title": "[BUG] [v0.0.7] `cortex github status` falsely reports \"[OK] Cortex workflow is installed\" for any workflow containing the word \"Cortex\"",
        "similarity": 0.23333333333333334
      },
      {
        "issueNumber": 46666,
        "title": "[bug][v0.0.7] `cortex mcp add --force` ends with \"Added\" MCP server after the error path told the user to \"overwrite\"",
        "similarity": 0.19718309859154928
      }
    ]
  },
  "editHistory": {
    "fraudScore": 0,
    "editCount": 0,
    "details": "No edits detected"
  },
  "codeVerification": {
    "plausible": true,
    "confidence": 1,
    "reasoning": "The code in `src/cortex-cli/src/github_cmd.rs` confirms the bug. The `run_uninstall` function checks if a workflow file is a Cortex workflow by simply checking if its content contains the string \"Cortex\" or \"cortex\". If it does, it proceeds to delete the file. This means any unrelated workflow file that happens to contain the word \"cortex\" will be deleted by `cortex github uninstall`.",
    "codeEvidence": "    let mut found_workflow: Option<PathBuf> = None;\n    for name in &possible_names {\n        let path = workflows_dir.join(name);\n        if path.exists() {\n            // Verify it's a Cortex workflow\n            if let Ok(content) = std::fs::read_to_string(&path)\n                && (content.contains(\"Cortex\") || content.contains(\"cortex\"))\n            {\n                found_workflow = Some(path);\n                break;\n            }\n        }\n    }",
    "screenshotValid": false,
    "screenshotReasoning": "The screenshot URL provided in the bug report is inaccessible (likely broken or private), so it cannot be verified. However, the code evidence strongly supports the bug's plausibility. Since the screenshot is inaccessible, it cannot be considered valid evidence of a real user-facing bug."
  },
  "rules": {
    "codeResults": {
      "passed": [
        {
          "ruleId": "content.no-profanity",
          "category": "content",
          "severity": "flag",
          "passed": true,
          "message": "Issue should not contain excessive profanity or abusive language",
          "weight": 1
        },
        {
          "ruleId": "content.reasonable-length",
          "category": "content",
          "severity": "flag",
          "passed": true,
          "message": "Issue body should not exceed 15000 characters (possible spam dump)",
          "weight": 1
        },
        {
          "ruleId": "content.has-context",
          "category": "content",
          "severity": "penalize",
          "passed": true,
          "message": "Issue should mention the affected page, component, or URL",
          "weight": 0.2
        },
        {
          "ruleId": "media.require-evidence",
          "category": "media",
          "severity": "require",
          "passed": true,
          "message": "Issue must include at least one screenshot or video URL",
          "weight": 1
        },
        {
          "ruleId": "media.must-be-accessible",
          "category": "media",
          "severity": "require",
          "passed": true,
          "message": "All media URLs must be publicly accessible (HTTP 200)",
          "weight": 1
        },
        {
          "ruleId": "media.no-placeholder-urls",
          "category": "media",
          "severity": "reject",
          "passed": true,
          "message": "Media URLs should not be placeholder or example URLs",
          "weight": 1
        },
        {
          "ruleId": "scoring.duplicate-threshold",
          "category": "scoring",
          "severity": "penalize",
          "passed": true,
          "message": "Penalize issues with moderate duplicate similarity (0.5-0.75)",
          "weight": 0.3
        },
        {
          "ruleId": "scoring.suspicious-edits",
          "category": "scoring",
          "severity": "penalize",
          "passed": true,
          "message": "Penalize issues with concerning edit history (fraud score > 0.3)",
          "weight": 0.25
        },
        {
          "ruleId": "spam.high-score-reject",
          "category": "spam",
          "severity": "reject",
          "passed": true,
          "message": "Reject issues with spam score above 0.85",
          "weight": 1
        },
        {
          "ruleId": "spam.generic-title",
          "category": "spam",
          "severity": "penalize",
          "passed": true,
          "message": "Title should not be a generic/template title",
          "weight": 0.4
        },
        {
          "ruleId": "spam.body-is-title-repeat",
          "category": "spam",
          "severity": "penalize",
          "passed": true,
          "message": "Body should not be a simple repetition of the title",
          "weight": 0.5
        },
        {
          "ruleId": "spam.no-ai-filler",
          "category": "spam",
          "severity": "flag",
          "passed": true,
          "message": "Body should not contain obvious AI-generated filler phrases",
          "weight": 1
        },
        {
          "ruleId": "validity.min-body-length",
          "category": "validity",
          "severity": "reject",
          "passed": true,
          "message": "Issue body must be at least 50 characters",
          "weight": 1
        },
        {
          "ruleId": "validity.min-title-length",
          "category": "validity",
          "severity": "reject",
          "passed": true,
          "message": "Issue title must be at least 10 characters",
          "weight": 1
        },
        {
          "ruleId": "validity.no-empty-body",
          "category": "validity",
          "severity": "reject",
          "passed": true,
          "message": "Issue body must not be empty or only whitespace",
          "weight": 1
        },
        {
          "ruleId": "validity.has-steps-or-description",
          "category": "validity",
          "severity": "penalize",
          "passed": true,
          "message": "Issue body should contain structured content (steps, expected/actual behavior)",
          "weight": 0.3
        },
        {
          "ruleId": "validity.not-a-feature-request",
          "category": "validity",
          "severity": "flag",
          "passed": true,
          "message": "Issue should describe a bug, not a feature request",
          "weight": 1
        }
      ],
      "failed": []
    },
    "llmInstructions": [
      "Always prioritize concrete evidence (screenshots, videos, URLs) over the quality of the written description. A poorly written report with clear visual proof of a bug is VALID. A beautifully written report with no evidence is INVALID.",
      "A valid bug report must contain enough information for an engineer to reproduce the issue. If the steps to reproduce are missing or impossibly vague (\"it just broke\"), the issue is INVALID.",
      "You MUST call the deliver_verdict function exactly once. Do not output a JSON object manually. Do not output your verdict in plain text. Use the tool.",
      "Be highly suspicious of submissions that follow a rigid template: same structure, same phrasing, with only the page name or URL swapped. These are template-farmed and should be INVALID. Look for: identical sentence structure, placeholder-like descriptions, formulaic \"Steps to Reproduce\".",
      "When similar issues exist, the OLDER issue (lower issue number) always takes precedence. The newer submission is the duplicate, never the other way around.",
      "Confidence scores must be calibrated: use 0.9+ only when evidence is unambiguous and complete. Use 0.5-0.7 when the issue is borderline. Use below 0.5 when you are genuinely uncertain. Never default to 0.5 — commit to a direction.",
      "Do not give the benefit of the doubt. Missing evidence means INVALID. Unclear reproduction steps means INVALID. Inaccessible media means INVALID. The burden of proof is on the submitter.",
      "In the reasoning field, explain your step-by-step analysis BEFORE stating your conclusion. Cover: evidence quality, clarity, spam signals, and duplicate overlap in that order.",
      "Never mention internal scoring thresholds, rule IDs, detection heuristics, or system architecture in the recap field. The recap is public-facing. Keep reasoning technical but recap user-friendly.",
      "If the issue body reads like AI-generated boilerplate (phrases like \"It is important to note\", \"Furthermore\", \"In conclusion\", excessive politeness, no specific technical details), treat it as strong evidence of spam. AI-generated issues with no real bug details are INVALID.",
      "If the pre-computed media check says media URLs exist, verify the description matches what a screenshot would show. If the description talks about a login page but the context suggests the screenshot is of something unrelated, flag this as suspicious.",
      "Never soften a verdict out of sympathy. \"I can see you tried hard but...\" is not acceptable. If the submission does not meet criteria, it is INVALID regardless of apparent effort.",
      "Write your reasoning and recap in a professional, neutral tone. Do not be sarcastic, condescending, or emotional. State facts.",
      "The recap field must be 2-3 sentences maximum. It will be posted as a public comment. No bullet points in recap — use flowing prose."
    ],
    "totalCodeRules": 17,
    "totalLLMRules": 14,
    "hasReject": false,
    "hasFailed": false,
    "penaltyScore": 0,
    "summary": "All 17 code rules passed. | 14 LLM instructions active"
  }
}

_{Validated by Atlas • 2026-05-20}