secufusion-mcp 1.0.26 → 1.0.28

package/AGENTS.md

@@ -7,25 +7,23 @@ You are an elite Senior Developer and Architect working on the SecuFusion worksp
 ## Phase 00 — Task Classification (The Absolute First Step)
 (TRIGGER: the moment any task, bug, user story, feature, or work item is received)
 
-### THE RULE — no exceptions, no shortcuts
+### THE RULE — Read, Examine, Then Classify
 
-**The VERY FIRST thing you do when any task arrives is call the `classify_task` tool.**
+When any task arrives, you must NOT blindly run the classification tool. You must achieve 99% accuracy on the problem statement first.
 
-Not after reading the codebase.
-Not after thinking about the approach.
-Not after asking clarifying questions.
-Not after saying "let me analyze this".
+**STEP 1:** Read and carefully examine the problem statement.
+**STEP 2:** Once you fully understand it, call the `classify_task` tool.
+**STEP 3:** The tool will run validation and analysis. Read the classification and proposed resolution.
+**STEP 4:** If everything is correct and approved, proceed to plan and code. Before this is complete, NO code is allowed.
 
-**FIRST. THING. `classify_task`. Always.**
-
-If you find yourself about to read a file, write a plan, or type any code before calling
+If you find yourself about to write a plan or type any code before calling
 `classify_task` — **STOP**. You are doing it wrong. Call `classify_task` first.
 
 ---
 
 ### When to trigger
 
-Every single one of these MUST call `classify_task` BEFORE anything else:
+Every single one of these MUST trigger this analysis and classification flow BEFORE anything else:
 
 - User pastes a work item: `"WI-2847: Add MFA enforcement..."` / `"BUG-1140: Tenant deletion reports failure..."`
 - User describes a bug: `"There is a null pointer in the events service"` / `"The dashboard is showing wrong device count"`

package/index.js

@@ -1605,72 +1605,67 @@ server.tool("classify_task", "MANDATORY FIRST STEP for every task without except
     if (corpus.includes("pure ui") || corpus.includes("no backend changes") || corpus.includes("frontend only")) {
         backendScore = 0;
     }
-    // Determine classification
-    let classification;
-    let confidence = "HIGH";
-    if (backendScore > 0 && frontendScore === 0 && extensionScore === 0) {
-        classification = "BACKEND_ONLY";
-    }
-    else if (frontendScore > 0 && backendScore === 0 && extensionScore === 0) {
-        classification = "FRONTEND_ONLY";
-    }
-    else if (extensionScore > 0 && backendScore === 0 && frontendScore === 0) {
-        classification = "EXTENSION_ONLY";
-    }
-    else if (backendScore > 0 && (frontendScore > 0 || extensionScore > 0)) {
-        classification = "FULL_STACK";
-    }
-    else if (frontendScore > 0 && extensionScore > 0 && backendScore === 0) {
-        // Both are non-backend — treat as frontend
-        classification = "FRONTEND_ONLY";
-    }
-    else {
-        // All scores zero — ambiguous, default to backend
-        classification = "BACKEND_ONLY";
-        confidence = "LOW";
-    }
-    // Bug special rule: bugs default to backend unless explicitly UI
-    if (task_type === "bug" && confidence === "LOW") {
-        classification = "BACKEND_ONLY";
-        confidence = "LOW";
-    }
+    // Determine classification will be done after Pass 4.5
     // ── Step 4.5: Problem statement validation ───────────────────────────────────
     const descLower = description.toLowerCase();
     let titleAccurate = true;
     let suggestedTitle = "";
     let suggestedTitleReason = "";
     // CHECK 1: Title accuracy
-    const verbs = ["delete", "create", "fetch", "update", "add", "remove", "fix", "implement"];
-    const nouns = ["tenant", "admin", "device", "policy", "gateway", "notification", "audit", "role", "permission", "user", "group", "mapping", "api", "endpoint", "dashboard", "db", "database"];
-    const services = [];
-    if (spec) {
-        if (spec.microservices)
-            Object.keys(spec.microservices).forEach(k => services.push(k.toLowerCase()));
-        if (spec.frontend && spec.frontend.repo)
-            services.push(spec.frontend.repo.toLowerCase());
-        if (spec.chrome_extension && spec.chrome_extension.repo)
-            services.push(spec.chrome_extension.repo.toLowerCase());
-    }
-    if (services.length === 0) {
-        services.push("sfn-iam-api", "sfn-events-api", "sfn-tenants-api", "sfn-policy-api", "sfn-gateway-api", "sfn-web-ui");
-    }
-    const foundConcepts = [];
-    [...verbs, ...nouns, ...services].forEach(word => {
-        if (descLower.includes(word))
-            foundConcepts.push(word);
-    });
-    const titleLower = title.toLowerCase();
-    const matchedConcepts = foundConcepts.filter(c => titleLower.includes(c));
-    if (foundConcepts.length > 0 && matchedConcepts.length < (foundConcepts.length * 0.5)) {
-        titleAccurate = false;
-        const mainAction = verbs.find(v => descLower.includes(v)) || "Update";
-        const mainEntity = nouns.find(n => descLower.includes(n)) || "component";
-        const serviceName = services.find(s => descLower.includes(s)) || "service";
-        suggestedTitle = `${task_type.toUpperCase()}: ${mainAction} ${mainEntity} in ${serviceName}`;
-        suggestedTitleReason = "Title misses major concept from description";
-        if (title === "Tenant dashboard not loading" && descLower.includes("500") && descLower.includes("deletion")) {
-            suggestedTitle = "BUG: Fix false HTTP 500 response on successful tenant deletion in sfn-tenants-api";
-            suggestedTitleReason = "Title says dashboard loading issue but description is about API response after successful DB deletion";
+    const STOP_WORDS = new Set([
+        "the", "a", "an", "is", "are", "was", "were",
+        "be", "been", "being", "have", "has", "had",
+        "do", "does", "did", "will", "would", "could",
+        "should", "may", "might", "shall", "can",
+        "to", "of", "in", "on", "at", "by", "for",
+        "with", "about", "against", "between", "into",
+        "through", "during", "before", "after", "above",
+        "below", "from", "up", "down", "out", "off",
+        "over", "under", "again", "further", "then",
+        "once", "and", "but", "or", "nor", "so", "yet",
+        "both", "either", "neither", "not", "only",
+        "same", "than", "too", "very", "just", "that",
+        "this", "these", "those", "it", "its", "itself",
+        "which", "who", "whom", "what", "where", "when",
+        "why", "how", "all", "each", "every",
+        "few", "more", "most", "other", "some", "such",
+        "no", "own", "also", "instead", "rather",
+        "shows", "show", "display", "displays", "showing", "shown",
+        "currently", "now"
+    ]);
+    function extractSymptomWords(text) {
+        return text
+            .toLowerCase()
+            .replace(/[^a-z0-9\s]/g, ' ')
+            .split(/\s+/)
+            .filter(w => w.length > 3)
+            .filter(w => !STOP_WORDS.has(w))
+            .filter(w => !w.match(/^\d+$/));
+    }
+    const titleSymptoms = extractSymptomWords(title);
+    const descSymptoms = extractSymptomWords(description);
+    const firstSentence = description.split('.')[0] || "";
+    const coreSymptoms = extractSymptomWords(firstSentence).slice(0, 5);
+    const titleCoverage = coreSymptoms.filter(sym => titleSymptoms.some(ts => ts.includes(sym) || sym.includes(ts))).length / Math.max(coreSymptoms.length, 1);
+    titleAccurate = titleCoverage >= 0.4;
+    function detectDomain(text) {
+        const t = text.toLowerCase();
+        if (t.includes("modal") || t.includes("display") || t.includes("shows") || t.includes("screen"))
+            return "display/UI";
+        if (t.includes("database") || t.includes("query") || t.includes("table"))
+            return "database";
+        return "unknown";
+    }
+    if (!titleAccurate) {
+        const titleDomain = detectDomain(title);
+        const descDomain = detectDomain(description);
+        if (titleDomain === descDomain && titleDomain !== "unknown") {
+            titleAccurate = true;
+            // Will add to advisories later
+        }
+        else {
+            suggestedTitle = "BUG: " + firstSentence.slice(0, 50) + "...";
+            suggestedTitleReason = "Title symptoms do not match description core symptoms";
         }
     }
     // CHECK 2: Problem statement completeness
@@ -1744,25 +1739,24 @@ server.tool("classify_task", "MANDATORY FIRST STEP for every task without except
     let taskTypeCorrect = true;
     let suggestedTaskType = "";
     let taskTypeReason = "";
-    if (task_type === "bug" && (descLower.includes("add new feature") || descLower.includes("implement a new") || descLower.includes("create"))) {
+    const DEFECT_SIGNALS = [
+        "instead of", "rather than", "shows",
+        "displays", "not showing", "not displaying",
+        "incorrect", "wrong", "broken", "failing",
+        "error", "exception", "crash", "null",
+        "missing", "unexpected", "should show",
+        "should display", "expected", "actual",
+        "bug", "fix", "issue", "problem",
+        "not working", "doesn't work", "fails"
+    ];
+    const hasDefectSignal = DEFECT_SIGNALS.some(s => (title + " " + description).toLowerCase().includes(s));
+    if (task_type === "bug" && !hasDefectSignal) {
         taskTypeCorrect = false;
         suggestedTaskType = "feature";
-        taskTypeReason = "Description implements new functionality, not fixing a defect";
+        taskTypeReason = "No defect signals found in description";
     }
-    else if (task_type === "user_story" && (descLower.includes("fix") || descLower.includes("broken") || descLower.includes("error") || descLower.includes("exception") || descLower.includes("failing"))) {
-        taskTypeCorrect = false;
-        suggestedTaskType = "bug";
-        taskTypeReason = "Description describes fixing a defect, not a user story";
-    }
-    else if (task_type === "refactor" && (descLower.includes("users are reporting") || descLower.includes("production issue"))) {
-        taskTypeCorrect = false;
-        suggestedTaskType = "hotfix";
-        taskTypeReason = "Description implies a production issue, not a refactor";
-    }
-    else if (task_type === "chore" && (descLower.includes("core business logic") || descLower.includes("endpoint"))) {
-        taskTypeCorrect = false;
-        suggestedTaskType = "feature";
-        taskTypeReason = "Description involves functional changes, not a chore";
+    else {
+        taskTypeCorrect = true;
     }
     // CHECK 6: SecuFusion-specific validation
     const secufusionFlags = [];
@@ -1771,15 +1765,88 @@ server.tool("classify_task", "MANDATORY FIRST STEP for every task without except
             secufusionFlags.push(`This may re-introduce rejected pattern #${r.id}: ${r.pattern}`);
         }
     });
+    const architectureOwnershipSignals = [];
+    let ownershipNotes = [];
     // Dynamically inject coding patterns from project spec
     if (spec && spec.coding_patterns) {
-        Object.entries(spec.coding_patterns).forEach(([key, rule]) => {
-            const keyTokens = key.toLowerCase().split('_');
-            // if any token from the key is in the corpus, add the rule
-            if (keyTokens.some(token => corpus.includes(token))) {
-                secufusionFlags.push(`Architecture Rule (${key}): ${rule}`);
+        const FRONTEND_OWNERSHIP_PHRASES = [
+            "frontend must", "frontend should", "handled by the frontend",
+            "must be handled by the frontend", "frontend handles", "ui must",
+            "client must", "client side", "never returns pre-formatted",
+            "frontend converts", "browser must", "only produces", "backend only produces"
+        ];
+        const BACKEND_OWNERSHIP_PHRASES = [
+            "backend must", "backend should", "server must", "service must",
+            "always scoped with", "must filter by", "never expose",
+            "controller resolves", "service layer must"
+        ];
+        const extractKw = (text) => text.toLowerCase().replace(/[^a-z0-9\s]/g, ' ').split(/\s+/).filter(w => w.length > 3);
+        for (const [ruleName, ruleText] of Object.entries(spec.coding_patterns)) {
+            const rText = ruleText;
+            const ruleTextLower = rText.toLowerCase();
+            const descLowerCombined = (title + " " + description).toLowerCase();
+            const ruleKeywords = extractKw(rText);
+            const taskMentionsRule = ruleKeywords.some(kw => descLowerCombined.includes(kw));
+            if (!taskMentionsRule)
+                continue;
+            const isFrontendOwnership = FRONTEND_OWNERSHIP_PHRASES.some(phrase => ruleTextLower.includes(phrase));
+            const isBackendOwnership = BACKEND_OWNERSHIP_PHRASES.some(phrase => ruleTextLower.includes(phrase));
+            if (isFrontendOwnership) {
+                frontendScore += 8;
+                ownershipNotes.push(`Architecture rule '${ruleName}' confirms frontend ownership: ${rText.slice(0, 80)}...`);
+                architectureOwnershipSignals.push({
+                    rule: ruleName,
+                    direction: "FRONTEND",
+                    note: rText
+                });
             }
-        });
+            else if (isBackendOwnership) {
+                backendScore += 8;
+                ownershipNotes.push(`Architecture rule '${ruleName}' confirms backend ownership: ${rText.slice(0, 80)}...`);
+                architectureOwnershipSignals.push({
+                    rule: ruleName,
+                    direction: "BACKEND",
+                    note: rText
+                });
+            }
+            else {
+                secufusionFlags.push(`Note — Architecture Rule (${ruleName}): ${rText.slice(0, 100)}... (verify this applies to your implementation)`);
+            }
+        }
+    }
+    // Pass 5 — Confidence gate & Classification assignment
+    let classification;
+    let confidence = "HIGH";
+    if (backendScore > 0 && frontendScore === 0 && extensionScore === 0) {
+        classification = "BACKEND_ONLY";
+    }
+    else if (frontendScore > 0 && backendScore === 0 && extensionScore === 0) {
+        classification = "FRONTEND_ONLY";
+    }
+    else if (extensionScore > 0 && backendScore === 0 && frontendScore === 0) {
+        classification = "EXTENSION_ONLY";
+    }
+    else if (backendScore > 0 && (frontendScore > 0 || extensionScore > 0)) {
+        if (frontendScore > backendScore * 2.5) {
+            classification = "FRONTEND_ONLY";
+        }
+        else if (backendScore > frontendScore * 2.5) {
+            classification = "BACKEND_ONLY";
+        }
+        else {
+            classification = "FULL_STACK";
+        }
+    }
+    else if (frontendScore > 0 && extensionScore > 0 && backendScore === 0) {
+        classification = "FRONTEND_ONLY";
+    }
+    else {
+        classification = "BACKEND_ONLY";
+        confidence = "LOW";
+    }
+    if (task_type === "bug" && confidence === "LOW") {
+        classification = "BACKEND_ONLY";
+        confidence = "LOW";
     }
     let validationVerdict = "CLEAN";
     if (!titleAccurate || !taskTypeCorrect || (task_type === "bug" && rootCauseAssumed)) {
@@ -1893,10 +1960,22 @@ server.tool("classify_task", "MANDATORY FIRST STEP for every task without except
     else if (classification === "FULL_STACK") {
         allowedNextAction = "CONFIRM";
         nextPhase = "Confirm backend scope, then plan API contract first";
+        const backendScopeLines = [];
+        const matchedServiceNames = backendFound.filter(s => s.startsWith("sfn-"));
+        const matchedTechConstructs = backendFound.filter(s => !s.startsWith("sfn-"));
+        if (matchedServiceNames.length > 0) {
+            backendScopeLines.push(`Services: ${[...new Set(matchedServiceNames)].join(", ")}`);
+        }
+        if (matchedTechConstructs.length > 0) {
+            backendScopeLines.push(`Changes: ${[...new Set(matchedTechConstructs)].join(", ")}`);
+        }
+        const backendScopeText = backendScopeLines.length > 0
+            ? backendScopeLines.join("\n  → ")
+            : "Backend logic changes required";
         developerMessage =
             `⚠️ FULL STACK TASK\n\n` +
-                `Backend scope (yours): ${backendFound.slice(0, 8).join(", ")}\n` +
-                `Frontend scope (not yours): ${frontendFound.slice(0, 8).join(", ")}\n\n` +
+                `Backend scope (yours):\n  → ${backendScopeText}\n` +
+                `Frontend scope (not yours): ${[...new Set(frontendFound)].slice(0, 8).join(", ")}\n\n` +
                 `I will implement the backend only and define the API contract first.\n` +
                 `Confirm and I will proceed to plan.`;
     }
@@ -1942,6 +2021,10 @@ server.tool("classify_task", "MANDATORY FIRST STEP for every task without except
             finalDeveloperMessage += "\n────────────────────────────────────────\n";
         }
     }
+    if (architectureOwnershipSignals.length > 0) {
+        finalDeveloperMessage += "📐 Architecture ownership signals:\n" +
+            architectureOwnershipSignals.map(s => `  → [${s.direction}] Rule '${s.rule}': ${s.note.slice(0, 80)}...`).join("\n") + "\n\n";
+    }
     if (learnedLogs.length > 0) {
         finalDeveloperMessage += `🧠 RETROSPECTIVE INTELLIGENCE APPLIED\n`;
         finalDeveloperMessage += learnedLogs.join("\n") + "\n\n";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "secufusion-mcp",
-  "version": "1.0.26",
+  "version": "1.0.28",
   "type": "module",
   "description": "SecuFusion MCP server - developer workflow tooling with guardrails",
   "main": "index.js",