secufusion-mcp 1.0.28 → 1.0.30

package/.secufusion-project-spec.json

@@ -12,6 +12,9 @@
     "branch_naming_convention": "Mixed, not strictly enforced. Common patterns: feature/<kebab-description>, fix/<desc> or bugfix/<ticket-or-desc>, ticket-only (TASK-####, TASK-####-<desc>, BUG-####-<desc>), release-<major>.<minor>.<patch> (dash, not slash) for release branches. Trunk branches are 'main' and 'develop' in every repo, but which one is checked out as the working default varies per repo (sfn-events-api and sfn-web-ui default to develop; snf-browser-extn defaults to main). Many ad hoc/free-text branch names also exist.",
     "commit_message_pattern": "No single enforced convention. Recurring mixture: (1) Azure Repos auto-generated 'Merged PR <number>: <title>' on PR completion (dominant pattern in all 3 sampled repos), (2) ticket-prefixed 'TASK-<number>: <desc>' or 'TASK-<number>-<desc>' (common in sfn-events-api), (3) conventional-commit style 'feat(<scope>): ...' / 'fix(<scope>): ...' (used consistently within recent 'ai-ops' feature work in sfn-web-ui, not elsewhere), (4) plain imperative descriptive messages with no prefix at all. Work items referenced via https://dev.azure.com/secufusion/SFCloud-MSSP/_workitems/edit/<id>."
   },
+  "coding_patterns": {
+    "timestamp_handling": "backend ONLY produces UTC timestamp strings. All time formatting and local timezone conversion MUST be handled by the frontend."
+  },
   "microservices": {
     "sfn-auth-api": {
       "artifact_id": "sfn-auth-api",

package/index.js

@@ -1462,6 +1462,73 @@ server.tool("record_retrospective", "Records a structured retrospective after ta
     }
     return appendTelemetry({ content: [{ type: "text", text: out }] }, inputChars);
 });
+const STOP_WORDS = new Set([
+    "the", "a", "an", "is", "are", "was", "were", "be",
+    "been", "being", "have", "has", "had", "do", "does",
+    "did", "will", "would", "could", "should", "may",
+    "might", "shall", "can", "to", "of", "in", "on", "at",
+    "by", "for", "with", "about", "against", "between",
+    "into", "through", "during", "before", "after",
+    "from", "up", "down", "out", "off", "over", "under",
+    "and", "but", "or", "nor", "so", "yet", "both",
+    "either", "neither", "not", "only", "same", "than",
+    "too", "very", "just", "that", "this", "these",
+    "those", "it", "its", "itself", "which", "who",
+    "what", "where", "when", "why", "how", "all", "each",
+    "every", "few", "more", "most", "other", "some",
+    "such", "no", "own", "also", "instead", "rather",
+    "shows", "show", "display", "displays", "showing",
+    "shown", "currently", "now", "then", "also", "there",
+    "their", "they", "them", "we", "our", "your", "my",
+    "his", "her", "its", "page", "modal", "screen"
+]);
+function extractSymptomWords(text) {
+    return text
+        .toLowerCase()
+        .replace(/[^a-z0-9\s]/g, " ")
+        .split(/\s+/)
+        .filter(w => w.length > 3)
+        .filter(w => !STOP_WORDS.has(w))
+        .filter(w => !/^\d+$/.test(w));
+}
+function levenshteinClose(a, b, threshold = 2) {
+    if (Math.abs(a.length - b.length) > threshold)
+        return false;
+    let matrix = Array.from({ length: a.length + 1 }, (_, i) => [i, ...Array(b.length).fill(0)]);
+    for (let j = 0; j <= b.length; j++)
+        matrix[0][j] = j;
+    for (let i = 1; i <= a.length; i++) {
+        for (let j = 1; j <= b.length; j++) {
+            matrix[i][j] = a[i - 1] === b[j - 1]
+                ? matrix[i - 1][j - 1]
+                : 1 + Math.min(matrix[i - 1][j], matrix[i][j - 1], matrix[i - 1][j - 1]);
+        }
+    }
+    return matrix[a.length][b.length] <= threshold;
+}
+function buildScopeText(signals, domain) {
+    if (signals.length === 0) {
+        return `${domain} changes required`;
+    }
+    const serviceNames = signals.filter(s => s.includes("-api") || s.includes("-service") ||
+        s.includes("sfn-"));
+    const techTerms = signals.filter(s => !s.includes("-api") && !s.includes("-service") &&
+        !s.includes("sfn-"));
+    const parts = [];
+    if (serviceNames.length > 0) {
+        parts.push(`Services: ${serviceNames.join(", ")}`);
+    }
+    if (techTerms.length > 0 && techTerms.length <= 4) {
+        parts.push(`Changes: ${techTerms.join(", ")}`);
+    }
+    else if (techTerms.length > 4) {
+        parts.push(`Changes: ${techTerms.slice(0, 3).join(", ")}` +
+            ` (+${techTerms.length - 3} more)`);
+    }
+    return parts.length > 0
+        ? parts.join("\n  ")
+        : `${domain} implementation required`;
+}
 // ─── Tool 9: classify_task ────────────────────────────────────────────────────
 server.tool("classify_task", "MANDATORY FIRST STEP for every task without exception. " +
     "Classifies a task as BACKEND_ONLY, FRONTEND_ONLY, FULL_STACK, or EXTENSION_ONLY. " +
@@ -1612,56 +1679,53 @@ server.tool("classify_task", "MANDATORY FIRST STEP for every task without except
     let suggestedTitle = "";
     let suggestedTitleReason = "";
     // CHECK 1: Title accuracy
-    const STOP_WORDS = new Set([
-        "the", "a", "an", "is", "are", "was", "were",
-        "be", "been", "being", "have", "has", "had",
-        "do", "does", "did", "will", "would", "could",
-        "should", "may", "might", "shall", "can",
-        "to", "of", "in", "on", "at", "by", "for",
-        "with", "about", "against", "between", "into",
-        "through", "during", "before", "after", "above",
-        "below", "from", "up", "down", "out", "off",
-        "over", "under", "again", "further", "then",
-        "once", "and", "but", "or", "nor", "so", "yet",
-        "both", "either", "neither", "not", "only",
-        "same", "than", "too", "very", "just", "that",
-        "this", "these", "those", "it", "its", "itself",
-        "which", "who", "whom", "what", "where", "when",
-        "why", "how", "all", "each", "every",
-        "few", "more", "most", "other", "some", "such",
-        "no", "own", "also", "instead", "rather",
-        "shows", "show", "display", "displays", "showing", "shown",
-        "currently", "now"
-    ]);
-    function extractSymptomWords(text) {
-        return text
-            .toLowerCase()
-            .replace(/[^a-z0-9\s]/g, ' ')
-            .split(/\s+/)
-            .filter(w => w.length > 3)
-            .filter(w => !STOP_WORDS.has(w))
-            .filter(w => !w.match(/^\d+$/));
-    }
-    const titleSymptoms = extractSymptomWords(title);
-    const descSymptoms = extractSymptomWords(description);
-    const firstSentence = description.split('.')[0] || "";
-    const coreSymptoms = extractSymptomWords(firstSentence).slice(0, 5);
-    const titleCoverage = coreSymptoms.filter(sym => titleSymptoms.some(ts => ts.includes(sym) || sym.includes(ts))).length / Math.max(coreSymptoms.length, 1);
-    titleAccurate = titleCoverage >= 0.4;
-    function detectDomain(text) {
-        const t = text.toLowerCase();
-        if (t.includes("modal") || t.includes("display") || t.includes("shows") || t.includes("screen"))
-            return "display/UI";
-        if (t.includes("database") || t.includes("query") || t.includes("table"))
-            return "database";
-        return "unknown";
-    }
+    const services = [];
+    if (spec) {
+        if (spec.microservices)
+            Object.keys(spec.microservices).forEach(k => services.push(k.toLowerCase()));
+        if (spec.frontend && spec.frontend.repo)
+            services.push(spec.frontend.repo.toLowerCase());
+        if (spec.chrome_extension && spec.chrome_extension.repo)
+            services.push(spec.chrome_extension.repo.toLowerCase());
+    }
+    if (services.length === 0) {
+        services.push("sfn-iam-api", "sfn-events-api", "sfn-tenants-api", "sfn-policy-api", "sfn-gateway-api", "sfn-web-ui");
+    }
+    const firstSentence = description.split(/[.!?]/)[0] || description;
+    const coreSymptoms = extractSymptomWords(firstSentence).slice(0, 6);
+    const titleWords = extractSymptomWords(title);
+    // Title is accurate if covers >= 35% of
+    // core symptom words from first sentence
+    const matchCount = coreSymptoms.filter(sym => titleWords.some(tw => tw.includes(sym) || sym.includes(tw) ||
+        levenshteinClose(tw, sym))).length;
+    const titleCoverage = coreSymptoms.length > 0
+        ? matchCount / coreSymptoms.length
+        : 1.0;
+    titleAccurate = titleCoverage >= 0.35;
+    // Secondary check: if title and desc are
+    // about same domain → not misleading
+    // even if coverage is low
     if (!titleAccurate) {
-        const titleDomain = detectDomain(title);
-        const descDomain = detectDomain(description);
-        if (titleDomain === descDomain && titleDomain !== "unknown") {
+        const DISPLAY_WORDS = [
+            "show", "display", "render", "modal", "page",
+            "screen", "ui", "view", "format", "time", "date",
+            "timezone", "utc", "local", "color", "layout",
+            "button", "icon", "text", "label"
+        ];
+        const BACKEND_WORDS = [
+            "api", "service", "endpoint", "db", "database",
+            "query", "kafka", "migration", "entity", "null",
+            "exception", "500", "error", "timeout", "token"
+        ];
+        const titleIsDisplay = DISPLAY_WORDS.some(w => title.toLowerCase().includes(w));
+        const descIsDisplay = DISPLAY_WORDS.some(w => description.toLowerCase().includes(w));
+        const titleIsBackend = BACKEND_WORDS.some(w => title.toLowerCase().includes(w));
+        const descIsBackend = BACKEND_WORDS.some(w => description.toLowerCase().includes(w));
+        // Same domain = not misleading
+        if ((titleIsDisplay && descIsDisplay) ||
+            (titleIsBackend && descIsBackend)) {
             titleAccurate = true;
-            // Will add to advisories later
+            // Optional advisory — not a blocking flag
         }
         else {
             suggestedTitle = "BUG: " + firstSentence.slice(0, 50) + "...";
@@ -1735,29 +1799,26 @@ server.tool("classify_task", "MANDATORY FIRST STEP for every task without except
             scopeQuestions.push("2. Which component or service is affected?");
         }
     }
-    // CHECK 5: Task type correctness
-    let taskTypeCorrect = true;
-    let suggestedTaskType = "";
-    let taskTypeReason = "";
     const DEFECT_SIGNALS = [
-        "instead of", "rather than", "shows",
-        "displays", "not showing", "not displaying",
-        "incorrect", "wrong", "broken", "failing",
-        "error", "exception", "crash", "null",
-        "missing", "unexpected", "should show",
-        "should display", "expected", "actual",
-        "bug", "fix", "issue", "problem",
-        "not working", "doesn't work", "fails"
+        "instead of", "rather than", "incorrect", "wrong",
+        "broken", "failing", "error", "exception", "crash",
+        "null", "missing", "unexpected", "should show",
+        "should display", "expected", "actual", "not working",
+        "doesn't work", "fails", "not showing", "bug",
+        "fix", "issue", "problem", "invalid", "400", "500",
+        "404", "403", "401", "timeout", "slow", "blank",
+        "empty", "duplicate", "stale", "outdated"
     ];
-    const hasDefectSignal = DEFECT_SIGNALS.some(s => (title + " " + description).toLowerCase().includes(s));
-    if (task_type === "bug" && !hasDefectSignal) {
-        taskTypeCorrect = false;
-        suggestedTaskType = "feature";
-        taskTypeReason = "No defect signals found in description";
-    }
-    else {
-        taskTypeCorrect = true;
-    }
+    const hasDefectSignal = DEFECT_SIGNALS.some(s => (title + " " + description)
+        .toLowerCase()
+        .includes(s));
+    // Only flag wrong task type when NO defect
+    // signals exist at all
+    let taskTypeCorrect = task_type !== "bug" || hasDefectSignal;
+    let suggestedTaskType = !taskTypeCorrect ? "feature" : task_type;
+    let taskTypeReason = !taskTypeCorrect
+        ? "No defect signals found in title or description. Description appears to implement new functionality."
+        : "";
     // CHECK 6: SecuFusion-specific validation
     const secufusionFlags = [];
     rejectedPatterns.forEach(r => {
@@ -1766,51 +1827,70 @@ server.tool("classify_task", "MANDATORY FIRST STEP for every task without except
         }
     });
     const architectureOwnershipSignals = [];
-    let ownershipNotes = [];
-    // Dynamically inject coding patterns from project spec
+    const FRONTEND_OWNERSHIP_PHRASES = [
+        "frontend must",
+        "frontend should",
+        "handled by the frontend",
+        "must be handled by the frontend",
+        "frontend handles",
+        "frontend converts",
+        "ui must",
+        "client must",
+        "client side",
+        "never returns pre-formatted",
+        "only produces",
+        "backend only produces",
+        "browser must",
+        "all time formatting",
+        "timezone conversion must"
+    ];
+    const BACKEND_OWNERSHIP_PHRASES = [
+        "backend must",
+        "backend should",
+        "server must",
+        "service must",
+        "always scoped with",
+        "must filter by",
+        "never expose",
+        "controller resolves",
+        "service layer must",
+        "repository must",
+        "always include tenantid"
+    ];
     if (spec && spec.coding_patterns) {
-        const FRONTEND_OWNERSHIP_PHRASES = [
-            "frontend must", "frontend should", "handled by the frontend",
-            "must be handled by the frontend", "frontend handles", "ui must",
-            "client must", "client side", "never returns pre-formatted",
-            "frontend converts", "browser must", "only produces", "backend only produces"
-        ];
-        const BACKEND_OWNERSHIP_PHRASES = [
-            "backend must", "backend should", "server must", "service must",
-            "always scoped with", "must filter by", "never expose",
-            "controller resolves", "service layer must"
-        ];
-        const extractKw = (text) => text.toLowerCase().replace(/[^a-z0-9\s]/g, ' ').split(/\s+/).filter(w => w.length > 3);
         for (const [ruleName, ruleText] of Object.entries(spec.coding_patterns)) {
-            const rText = ruleText;
-            const ruleTextLower = rText.toLowerCase();
-            const descLowerCombined = (title + " " + description).toLowerCase();
-            const ruleKeywords = extractKw(rText);
-            const taskMentionsRule = ruleKeywords.some(kw => descLowerCombined.includes(kw));
-            if (!taskMentionsRule)
+            const ruleStr = String(ruleText).toLowerCase();
+            const taskText = (title + " " + description).toLowerCase();
+            const ruleWords = ruleName
+                .toLowerCase()
+                .replace(/_/g, " ")
+                .split(" ")
+                .filter(w => w.length > 3);
+            const ruleApplies = ruleWords.some(w => taskText.includes(w)) || Object.keys(spec.coding_patterns).some(k => taskText.includes(k.toLowerCase().replace(/_/g, " ")));
+            if (!ruleApplies)
                 continue;
-            const isFrontendOwnership = FRONTEND_OWNERSHIP_PHRASES.some(phrase => ruleTextLower.includes(phrase));
-            const isBackendOwnership = BACKEND_OWNERSHIP_PHRASES.some(phrase => ruleTextLower.includes(phrase));
+            const isFrontendOwnership = FRONTEND_OWNERSHIP_PHRASES.some(phrase => ruleStr.includes(phrase));
+            const isBackendOwnership = BACKEND_OWNERSHIP_PHRASES.some(phrase => ruleStr.includes(phrase));
             if (isFrontendOwnership) {
-                frontendScore += 8;
-                ownershipNotes.push(`Architecture rule '${ruleName}' confirms frontend ownership: ${rText.slice(0, 80)}...`);
+                frontendScore = (frontendScore || 0) + 8;
                 architectureOwnershipSignals.push({
                     rule: ruleName,
                     direction: "FRONTEND",
-                    note: rText
+                    note: String(ruleText).slice(0, 120)
                 });
             }
             else if (isBackendOwnership) {
-                backendScore += 8;
-                ownershipNotes.push(`Architecture rule '${ruleName}' confirms backend ownership: ${rText.slice(0, 80)}...`);
+                backendScore = (backendScore || 0) + 8;
                 architectureOwnershipSignals.push({
                     rule: ruleName,
                     direction: "BACKEND",
-                    note: rText
+                    note: String(ruleText).slice(0, 120)
                 });
             }
             else {
-                secufusionFlags.push(`Note — Architecture Rule (${ruleName}): ${rText.slice(0, 100)}... (verify this applies to your implementation)`);
+                secufusionFlags.push(`Note — Architecture Rule (${ruleName}): ` +
+                    `${String(ruleText).slice(0, 100)}` +
+                    ` (verify this applies to your implementation)`);
             }
         }
     }
@@ -1960,22 +2040,18 @@ server.tool("classify_task", "MANDATORY FIRST STEP for every task without except
     else if (classification === "FULL_STACK") {
         allowedNextAction = "CONFIRM";
         nextPhase = "Confirm backend scope, then plan API contract first";
-        const backendScopeLines = [];
-        const matchedServiceNames = backendFound.filter(s => s.startsWith("sfn-"));
-        const matchedTechConstructs = backendFound.filter(s => !s.startsWith("sfn-"));
-        if (matchedServiceNames.length > 0) {
-            backendScopeLines.push(`Services: ${[...new Set(matchedServiceNames)].join(", ")}`);
-        }
-        if (matchedTechConstructs.length > 0) {
-            backendScopeLines.push(`Changes: ${[...new Set(matchedTechConstructs)].join(", ")}`);
-        }
-        const backendScopeText = backendScopeLines.length > 0
-            ? backendScopeLines.join("\n  → ")
-            : "Backend logic changes required";
+        const uniqueBackendSignals = [
+            ...new Set(backendFound.filter(Boolean))
+        ];
+        const uniqueFrontendSignals = [
+            ...new Set(frontendFound.filter(Boolean))
+        ];
+        const backendScopeText = buildScopeText(uniqueBackendSignals, "backend");
+        const frontendScopeText = buildScopeText(uniqueFrontendSignals, "frontend");
         developerMessage =
             `⚠️ FULL STACK TASK\n\n` +
                 `Backend scope (yours):\n  → ${backendScopeText}\n` +
-                `Frontend scope (not yours): ${[...new Set(frontendFound)].slice(0, 8).join(", ")}\n\n` +
+                `Frontend scope (not yours):\n  → ${frontendScopeText}\n\n` +
                 `I will implement the backend only and define the API contract first.\n` +
                 `Confirm and I will proceed to plan.`;
     }
@@ -2022,8 +2098,12 @@ server.tool("classify_task", "MANDATORY FIRST STEP for every task without except
         }
     }
     if (architectureOwnershipSignals.length > 0) {
-        finalDeveloperMessage += "📐 Architecture ownership signals:\n" +
-            architectureOwnershipSignals.map(s => `  → [${s.direction}] Rule '${s.rule}': ${s.note.slice(0, 80)}...`).join("\n") + "\n\n";
+        finalDeveloperMessage += `\n📐 Architecture ownership signals:\n`;
+        for (const sig of architectureOwnershipSignals) {
+            finalDeveloperMessage +=
+                `  → [${sig.direction}] Rule '${sig.rule}':\n` +
+                    `    ${sig.note}\n`;
+        }
     }
     if (learnedLogs.length > 0) {
         finalDeveloperMessage += `🧠 RETROSPECTIVE INTELLIGENCE APPLIED\n`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "secufusion-mcp",
-  "version": "1.0.28",
+  "version": "1.0.30",
   "type": "module",
   "description": "SecuFusion MCP server - developer workflow tooling with guardrails",
   "main": "index.js",