secufusion-mcp 1.0.27 → 1.0.29

package/.secufusion-project-spec.json

@@ -12,6 +12,9 @@
     "branch_naming_convention": "Mixed, not strictly enforced. Common patterns: feature/<kebab-description>, fix/<desc> or bugfix/<ticket-or-desc>, ticket-only (TASK-####, TASK-####-<desc>, BUG-####-<desc>), release-<major>.<minor>.<patch> (dash, not slash) for release branches. Trunk branches are 'main' and 'develop' in every repo, but which one is checked out as the working default varies per repo (sfn-events-api and sfn-web-ui default to develop; snf-browser-extn defaults to main). Many ad hoc/free-text branch names also exist.",
     "commit_message_pattern": "No single enforced convention. Recurring mixture: (1) Azure Repos auto-generated 'Merged PR <number>: <title>' on PR completion (dominant pattern in all 3 sampled repos), (2) ticket-prefixed 'TASK-<number>: <desc>' or 'TASK-<number>-<desc>' (common in sfn-events-api), (3) conventional-commit style 'feat(<scope>): ...' / 'fix(<scope>): ...' (used consistently within recent 'ai-ops' feature work in sfn-web-ui, not elsewhere), (4) plain imperative descriptive messages with no prefix at all. Work items referenced via https://dev.azure.com/secufusion/SFCloud-MSSP/_workitems/edit/<id>."
   },
+  "coding_patterns": {
+    "timestamp_handling": "backend ONLY produces UTC timestamp strings. All time formatting and local timezone conversion MUST be handled by the frontend."
+  },
   "microservices": {
     "sfn-auth-api": {
       "artifact_id": "sfn-auth-api",

package/index.js

@@ -1462,6 +1462,73 @@ server.tool("record_retrospective", "Records a structured retrospective after ta
     }
     return appendTelemetry({ content: [{ type: "text", text: out }] }, inputChars);
 });
+const STOP_WORDS = new Set([
+    "the", "a", "an", "is", "are", "was", "were", "be",
+    "been", "being", "have", "has", "had", "do", "does",
+    "did", "will", "would", "could", "should", "may",
+    "might", "shall", "can", "to", "of", "in", "on", "at",
+    "by", "for", "with", "about", "against", "between",
+    "into", "through", "during", "before", "after",
+    "from", "up", "down", "out", "off", "over", "under",
+    "and", "but", "or", "nor", "so", "yet", "both",
+    "either", "neither", "not", "only", "same", "than",
+    "too", "very", "just", "that", "this", "these",
+    "those", "it", "its", "itself", "which", "who",
+    "what", "where", "when", "why", "how", "all", "each",
+    "every", "few", "more", "most", "other", "some",
+    "such", "no", "own", "also", "instead", "rather",
+    "shows", "show", "display", "displays", "showing",
+    "shown", "currently", "now", "then", "also", "there",
+    "their", "they", "them", "we", "our", "your", "my",
+    "his", "her", "its", "page", "modal", "screen"
+]);
+function extractSymptomWords(text) {
+    return text
+        .toLowerCase()
+        .replace(/[^a-z0-9\s]/g, " ")
+        .split(/\s+/)
+        .filter(w => w.length > 3)
+        .filter(w => !STOP_WORDS.has(w))
+        .filter(w => !/^\d+$/.test(w));
+}
+function levenshteinClose(a, b, threshold = 2) {
+    if (Math.abs(a.length - b.length) > threshold)
+        return false;
+    let matrix = Array.from({ length: a.length + 1 }, (_, i) => [i, ...Array(b.length).fill(0)]);
+    for (let j = 0; j <= b.length; j++)
+        matrix[0][j] = j;
+    for (let i = 1; i <= a.length; i++) {
+        for (let j = 1; j <= b.length; j++) {
+            matrix[i][j] = a[i - 1] === b[j - 1]
+                ? matrix[i - 1][j - 1]
+                : 1 + Math.min(matrix[i - 1][j], matrix[i][j - 1], matrix[i - 1][j - 1]);
+        }
+    }
+    return matrix[a.length][b.length] <= threshold;
+}
+function buildScopeText(signals, domain) {
+    if (signals.length === 0) {
+        return `${domain} changes required`;
+    }
+    const serviceNames = signals.filter(s => s.includes("-api") || s.includes("-service") ||
+        s.includes("sfn-"));
+    const techTerms = signals.filter(s => !s.includes("-api") && !s.includes("-service") &&
+        !s.includes("sfn-"));
+    const parts = [];
+    if (serviceNames.length > 0) {
+        parts.push(`Services: ${serviceNames.join(", ")}`);
+    }
+    if (techTerms.length > 0 && techTerms.length <= 4) {
+        parts.push(`Changes: ${techTerms.join(", ")}`);
+    }
+    else if (techTerms.length > 4) {
+        parts.push(`Changes: ${techTerms.slice(0, 3).join(", ")}` +
+            ` (+${techTerms.length - 3} more)`);
+    }
+    return parts.length > 0
+        ? parts.join("\n  ")
+        : `${domain} implementation required`;
+}
 // ─── Tool 9: classify_task ────────────────────────────────────────────────────
 server.tool("classify_task", "MANDATORY FIRST STEP for every task without exception. " +
     "Classifies a task as BACKEND_ONLY, FRONTEND_ONLY, FULL_STACK, or EXTENSION_ONLY. " +
@@ -1605,43 +1672,13 @@ server.tool("classify_task", "MANDATORY FIRST STEP for every task without except
     if (corpus.includes("pure ui") || corpus.includes("no backend changes") || corpus.includes("frontend only")) {
         backendScore = 0;
     }
-    // Determine classification
-    let classification;
-    let confidence = "HIGH";
-    if (backendScore > 0 && frontendScore === 0 && extensionScore === 0) {
-        classification = "BACKEND_ONLY";
-    }
-    else if (frontendScore > 0 && backendScore === 0 && extensionScore === 0) {
-        classification = "FRONTEND_ONLY";
-    }
-    else if (extensionScore > 0 && backendScore === 0 && frontendScore === 0) {
-        classification = "EXTENSION_ONLY";
-    }
-    else if (backendScore > 0 && (frontendScore > 0 || extensionScore > 0)) {
-        classification = "FULL_STACK";
-    }
-    else if (frontendScore > 0 && extensionScore > 0 && backendScore === 0) {
-        // Both are non-backend — treat as frontend
-        classification = "FRONTEND_ONLY";
-    }
-    else {
-        // All scores zero — ambiguous, default to backend
-        classification = "BACKEND_ONLY";
-        confidence = "LOW";
-    }
-    // Bug special rule: bugs default to backend unless explicitly UI
-    if (task_type === "bug" && confidence === "LOW") {
-        classification = "BACKEND_ONLY";
-        confidence = "LOW";
-    }
+    // Determine classification will be done after Pass 4.5
     // ── Step 4.5: Problem statement validation ───────────────────────────────────
     const descLower = description.toLowerCase();
     let titleAccurate = true;
     let suggestedTitle = "";
     let suggestedTitleReason = "";
     // CHECK 1: Title accuracy
-    const verbs = ["delete", "create", "fetch", "update", "add", "remove", "fix", "implement"];
-    const nouns = ["tenant", "admin", "device", "policy", "gateway", "notification", "audit", "role", "permission", "user", "group", "mapping", "api", "endpoint", "dashboard", "db", "database"];
     const services = [];
     if (spec) {
         if (spec.microservices)
@@ -1654,23 +1691,45 @@ server.tool("classify_task", "MANDATORY FIRST STEP for every task without except
     if (services.length === 0) {
         services.push("sfn-iam-api", "sfn-events-api", "sfn-tenants-api", "sfn-policy-api", "sfn-gateway-api", "sfn-web-ui");
     }
-    const foundConcepts = [];
-    [...verbs, ...nouns, ...services].forEach(word => {
-        if (descLower.includes(word))
-            foundConcepts.push(word);
-    });
-    const titleLower = title.toLowerCase();
-    const matchedConcepts = foundConcepts.filter(c => titleLower.includes(c));
-    if (foundConcepts.length > 0 && matchedConcepts.length < (foundConcepts.length * 0.5)) {
-        titleAccurate = false;
-        const mainAction = verbs.find(v => descLower.includes(v)) || "Update";
-        const mainEntity = nouns.find(n => descLower.includes(n)) || "component";
-        const serviceName = services.find(s => descLower.includes(s)) || "service";
-        suggestedTitle = `${task_type.toUpperCase()}: ${mainAction} ${mainEntity} in ${serviceName}`;
-        suggestedTitleReason = "Title misses major concept from description";
-        if (title === "Tenant dashboard not loading" && descLower.includes("500") && descLower.includes("deletion")) {
-            suggestedTitle = "BUG: Fix false HTTP 500 response on successful tenant deletion in sfn-tenants-api";
-            suggestedTitleReason = "Title says dashboard loading issue but description is about API response after successful DB deletion";
+    const firstSentence = description.split(/[.!?]/)[0] || description;
+    const coreSymptoms = extractSymptomWords(firstSentence).slice(0, 6);
+    const titleWords = extractSymptomWords(title);
+    // Title is accurate if covers >= 35% of
+    // core symptom words from first sentence
+    const matchCount = coreSymptoms.filter(sym => titleWords.some(tw => tw.includes(sym) || sym.includes(tw) ||
+        levenshteinClose(tw, sym))).length;
+    const titleCoverage = coreSymptoms.length > 0
+        ? matchCount / coreSymptoms.length
+        : 1.0;
+    titleAccurate = titleCoverage >= 0.35;
+    // Secondary check: if title and desc are
+    // about same domain → not misleading
+    // even if coverage is low
+    if (!titleAccurate) {
+        const DISPLAY_WORDS = [
+            "show", "display", "render", "modal", "page",
+            "screen", "ui", "view", "format", "time", "date",
+            "timezone", "utc", "local", "color", "layout",
+            "button", "icon", "text", "label"
+        ];
+        const BACKEND_WORDS = [
+            "api", "service", "endpoint", "db", "database",
+            "query", "kafka", "migration", "entity", "null",
+            "exception", "500", "error", "timeout", "token"
+        ];
+        const titleIsDisplay = DISPLAY_WORDS.some(w => title.toLowerCase().includes(w));
+        const descIsDisplay = DISPLAY_WORDS.some(w => description.toLowerCase().includes(w));
+        const titleIsBackend = BACKEND_WORDS.some(w => title.toLowerCase().includes(w));
+        const descIsBackend = BACKEND_WORDS.some(w => description.toLowerCase().includes(w));
+        // Same domain = not misleading
+        if ((titleIsDisplay && descIsDisplay) ||
+            (titleIsBackend && descIsBackend)) {
+            titleAccurate = true;
+            // Optional advisory — not a blocking flag
+        }
+        else {
+            suggestedTitle = "BUG: " + firstSentence.slice(0, 50) + "...";
+            suggestedTitleReason = "Title symptoms do not match description core symptoms";
         }
     }
     // CHECK 2: Problem statement completeness
@@ -1740,30 +1799,26 @@ server.tool("classify_task", "MANDATORY FIRST STEP for every task without except
             scopeQuestions.push("2. Which component or service is affected?");
         }
     }
-    // CHECK 5: Task type correctness
-    let taskTypeCorrect = true;
-    let suggestedTaskType = "";
-    let taskTypeReason = "";
-    if (task_type === "bug" && (descLower.includes("add new feature") || descLower.includes("implement a new") || descLower.includes("create"))) {
-        taskTypeCorrect = false;
-        suggestedTaskType = "feature";
-        taskTypeReason = "Description implements new functionality, not fixing a defect";
-    }
-    else if (task_type === "user_story" && (descLower.includes("fix") || descLower.includes("broken") || descLower.includes("error") || descLower.includes("exception") || descLower.includes("failing"))) {
-        taskTypeCorrect = false;
-        suggestedTaskType = "bug";
-        taskTypeReason = "Description describes fixing a defect, not a user story";
-    }
-    else if (task_type === "refactor" && (descLower.includes("users are reporting") || descLower.includes("production issue"))) {
-        taskTypeCorrect = false;
-        suggestedTaskType = "hotfix";
-        taskTypeReason = "Description implies a production issue, not a refactor";
-    }
-    else if (task_type === "chore" && (descLower.includes("core business logic") || descLower.includes("endpoint"))) {
-        taskTypeCorrect = false;
-        suggestedTaskType = "feature";
-        taskTypeReason = "Description involves functional changes, not a chore";
-    }
+    const DEFECT_SIGNALS = [
+        "instead of", "rather than", "incorrect", "wrong",
+        "broken", "failing", "error", "exception", "crash",
+        "null", "missing", "unexpected", "should show",
+        "should display", "expected", "actual", "not working",
+        "doesn't work", "fails", "not showing", "bug",
+        "fix", "issue", "problem", "invalid", "400", "500",
+        "404", "403", "401", "timeout", "slow", "blank",
+        "empty", "duplicate", "stale", "outdated"
+    ];
+    const hasDefectSignal = DEFECT_SIGNALS.some(s => (title + " " + description)
+        .toLowerCase()
+        .includes(s));
+    // Only flag wrong task type when NO defect
+    // signals exist at all
+    let taskTypeCorrect = task_type !== "bug" || hasDefectSignal;
+    let suggestedTaskType = !taskTypeCorrect ? "feature" : task_type;
+    let taskTypeReason = !taskTypeCorrect
+        ? "No defect signals found in title or description. Description appears to implement new functionality."
+        : "";
     // CHECK 6: SecuFusion-specific validation
     const secufusionFlags = [];
     rejectedPatterns.forEach(r => {
@@ -1771,15 +1826,107 @@ server.tool("classify_task", "MANDATORY FIRST STEP for every task without except
             secufusionFlags.push(`This may re-introduce rejected pattern #${r.id}: ${r.pattern}`);
         }
     });
-    // Dynamically inject coding patterns from project spec
+    const architectureOwnershipSignals = [];
+    const FRONTEND_OWNERSHIP_PHRASES = [
+        "frontend must",
+        "frontend should",
+        "handled by the frontend",
+        "must be handled by the frontend",
+        "frontend handles",
+        "frontend converts",
+        "ui must",
+        "client must",
+        "client side",
+        "never returns pre-formatted",
+        "only produces",
+        "backend only produces",
+        "browser must",
+        "all time formatting",
+        "timezone conversion must"
+    ];
+    const BACKEND_OWNERSHIP_PHRASES = [
+        "backend must",
+        "backend should",
+        "server must",
+        "service must",
+        "always scoped with",
+        "must filter by",
+        "never expose",
+        "controller resolves",
+        "service layer must",
+        "repository must",
+        "always include tenantid"
+    ];
     if (spec && spec.coding_patterns) {
-        Object.entries(spec.coding_patterns).forEach(([key, rule]) => {
-            const keyTokens = key.toLowerCase().split('_');
-            // if any token from the key is in the corpus, add the rule
-            if (keyTokens.some(token => corpus.includes(token))) {
-                secufusionFlags.push(`Architecture Rule (${key}): ${rule}`);
+        for (const [ruleName, ruleText] of Object.entries(spec.coding_patterns)) {
+            const ruleStr = String(ruleText).toLowerCase();
+            const taskText = (title + " " + description).toLowerCase();
+            const ruleWords = ruleName
+                .toLowerCase()
+                .replace(/_/g, " ")
+                .split(" ")
+                .filter(w => w.length > 3);
+            const ruleApplies = ruleWords.some(w => taskText.includes(w)) || Object.keys(spec.coding_patterns).some(k => taskText.includes(k.toLowerCase().replace(/_/g, " ")));
+            if (!ruleApplies)
+                continue;
+            const isFrontendOwnership = FRONTEND_OWNERSHIP_PHRASES.some(phrase => ruleStr.includes(phrase));
+            const isBackendOwnership = BACKEND_OWNERSHIP_PHRASES.some(phrase => ruleStr.includes(phrase));
+            if (isFrontendOwnership) {
+                frontendScore = (frontendScore || 0) + 8;
+                architectureOwnershipSignals.push({
+                    rule: ruleName,
+                    direction: "FRONTEND",
+                    note: String(ruleText).slice(0, 120)
+                });
             }
-        });
+            else if (isBackendOwnership) {
+                backendScore = (backendScore || 0) + 8;
+                architectureOwnershipSignals.push({
+                    rule: ruleName,
+                    direction: "BACKEND",
+                    note: String(ruleText).slice(0, 120)
+                });
+            }
+            else {
+                secufusionFlags.push(`Note — Architecture Rule (${ruleName}): ` +
+                    `${String(ruleText).slice(0, 100)}` +
+                    ` (verify this applies to your implementation)`);
+            }
+        }
+    }
+    // Pass 5 — Confidence gate & Classification assignment
+    let classification;
+    let confidence = "HIGH";
+    if (backendScore > 0 && frontendScore === 0 && extensionScore === 0) {
+        classification = "BACKEND_ONLY";
+    }
+    else if (frontendScore > 0 && backendScore === 0 && extensionScore === 0) {
+        classification = "FRONTEND_ONLY";
+    }
+    else if (extensionScore > 0 && backendScore === 0 && frontendScore === 0) {
+        classification = "EXTENSION_ONLY";
+    }
+    else if (backendScore > 0 && (frontendScore > 0 || extensionScore > 0)) {
+        if (frontendScore > backendScore * 2.5) {
+            classification = "FRONTEND_ONLY";
+        }
+        else if (backendScore > frontendScore * 2.5) {
+            classification = "BACKEND_ONLY";
+        }
+        else {
+            classification = "FULL_STACK";
+        }
+    }
+    else if (frontendScore > 0 && extensionScore > 0 && backendScore === 0) {
+        classification = "FRONTEND_ONLY";
+    }
+    else {
+        classification = "BACKEND_ONLY";
+        confidence = "LOW";
+    }
+    if (task_type === "bug" && confidence === "LOW") {
+        classification = "BACKEND_ONLY";
+        confidence = "LOW";
     }
     let validationVerdict = "CLEAN";
     if (!titleAccurate || !taskTypeCorrect || (task_type === "bug" && rootCauseAssumed)) {
@@ -1893,10 +2040,18 @@ server.tool("classify_task", "MANDATORY FIRST STEP for every task without except
     else if (classification === "FULL_STACK") {
         allowedNextAction = "CONFIRM";
         nextPhase = "Confirm backend scope, then plan API contract first";
+        const uniqueBackendSignals = [
+            ...new Set(backendFound.filter(Boolean))
+        ];
+        const uniqueFrontendSignals = [
+            ...new Set(frontendFound.filter(Boolean))
+        ];
+        const backendScopeText = buildScopeText(uniqueBackendSignals, "backend");
+        const frontendScopeText = buildScopeText(uniqueFrontendSignals, "frontend");
         developerMessage =
             `⚠️ FULL STACK TASK\n\n` +
-                `Backend scope (yours): ${backendFound.slice(0, 8).join(", ")}\n` +
-                `Frontend scope (not yours): ${frontendFound.slice(0, 8).join(", ")}\n\n` +
+                `Backend scope (yours):\n  → ${backendScopeText}\n` +
+                `Frontend scope (not yours):\n  → ${frontendScopeText}\n\n` +
                 `I will implement the backend only and define the API contract first.\n` +
                 `Confirm and I will proceed to plan.`;
     }
@@ -1942,6 +2097,14 @@ server.tool("classify_task", "MANDATORY FIRST STEP for every task without except
             finalDeveloperMessage += "\n────────────────────────────────────────\n";
         }
     }
+    if (architectureOwnershipSignals.length > 0) {
+        finalDeveloperMessage += `\n📐 Architecture ownership signals:\n`;
+        for (const sig of architectureOwnershipSignals) {
+            finalDeveloperMessage +=
+                `  → [${sig.direction}] Rule '${sig.rule}':\n` +
+                    `    ${sig.note}\n`;
+        }
+    }
     if (learnedLogs.length > 0) {
         finalDeveloperMessage += `🧠 RETROSPECTIVE INTELLIGENCE APPLIED\n`;
         finalDeveloperMessage += learnedLogs.join("\n") + "\n\n";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "secufusion-mcp",
-  "version": "1.0.27",
+  "version": "1.0.29",
   "type": "module",
   "description": "SecuFusion MCP server - developer workflow tooling with guardrails",
   "main": "index.js",