secufusion-mcp 1.0.37 → 1.0.38

package/AGENTS.md

@@ -436,25 +436,13 @@ STEP 3: do NOT repeat the rejected pattern — ever
 ## Phase 4 — PR Handoff
 (TRIGGER: developer says "prepare PR", "run checks", or "ready to merge")
 
-### MANDATORY sequence — do not raise a PR until all steps pass with zero errors
+### MANDATORY sequence
 
 ```
 STEP 1: call manage_task(action: "complete", work_item_id: <id>)
         — marks status complete, auto-generates pr-summary.md
 
-STEP 2: call run_pre_pr_checks(work_item_id: <id>)
-        — runs: spec checkbox check, AST linting, tenant isolation scan,
-          hardcoded URL scan, Flyway migration coverage
-
-STEP 3: if run_pre_pr_checks returns ANY error:
-        → navigate to the failing microservice
-        → fix the error NATIVELY in source code
-        → call run_pre_pr_checks again
-        → repeat until ZERO errors — no exceptions
-
-STEP 4: raise PR only when run_pre_pr_checks reports zero errors
-
-STEP 5: call generate_ado_comments(work_item_id, layman_summary, technical_deep_dive)
+STEP 2: call generate_ado_comments(work_item_id, layman_summary, technical_deep_dive)
         — Use this tool to output two distinct comments for the developer to paste into the Azure DevOps (ADO) board:
           1. **Layman Summary**: A short, fundamental, non-technical explanation of the business value and what was resolved.
           2. **Technical Deep-Dive**: A comprehensive, highly technical breakdown of the architectural changes, core optimizations, and exact implementation details.
@@ -463,10 +451,6 @@ STEP 5: call generate_ado_comments(work_item_id, layman_summary, technical_deep_
 ### Hard enforcement
 
 ❌ Do NOT raise a PR while `pending_acs` is non-empty  
-❌ Do NOT suppress linter warnings to pass the gate — fix them natively  
-❌ Do NOT skip `run_pre_pr_checks` and assume the workspace is clean  
-❌ Do NOT raise a PR if tenant isolation violations are present — security breach  
-❌ Do NOT raise a PR if Flyway coverage is missing for a modified `@Entity`  
 
 ## Phase 5 — Retrospective
 (TRIGGER: after manage_task action=complete is called

package/index.js

@@ -112,207 +112,6 @@ function appendTelemetry(response, inputChars) {
     return response;
 }
 // ─────────────────────────────────────────────
-//  run_pre_pr_checks helpers
-// ─────────────────────────────────────────────
-const CONSOLE_LOG_REGEX = [
-    { regex: /console\.log\s*\(/g, label: "console.log()", ext: [".ts", ".tsx", ".js", ".jsx"] },
-    { regex: /System\.out\.println\s*\(/g, label: "System.out.println()", ext: [".java"] },
-];
-const HARDCODED_URL_PATTERN = /(?:https?:\/\/)?(?:\d{1,3}\.){3}\d{1,3}(?::\d+)?|(?:uat|prod|staging|preprod)\.[a-z0-9.-]+\.[a-z]{2,}/gi;
-function walkDir(dir, exts) {
-    let results = [];
-    try {
-        const list = fs.readdirSync(dir);
-        for (const file of list) {
-            if (file === "node_modules" || file === ".git" || file === "dist" || file === "target")
-                continue;
-            const filePath = path.join(dir, file);
-            const stat = fs.statSync(filePath);
-            if (stat && stat.isDirectory()) {
-                results = results.concat(walkDir(filePath, exts));
-            }
-            else {
-                if (exts.some(ext => file.endsWith(ext))) {
-                    results.push(filePath);
-                }
-            }
-        }
-    }
-    catch (e) {
-        /* ignore */
-    }
-    return results;
-}
-// ── AST-level linting via ESLint (preferred over regex for JS/TS) ─────────────
-function runEslint(rootDir) {
-    // Check if ESLint is configured in the project
-    const eslintConfigs = [".eslintrc", ".eslintrc.js", ".eslintrc.json", ".eslintrc.yml",
-        ".eslintrc.yaml", "eslint.config.js", "eslint.config.mjs"];
-    const hasEslintConfig = eslintConfigs.some((f) => fs.existsSync(path.join(rootDir, f)));
-    const hasPkgEslint = (() => {
-        const pkg = readFileSafe(path.join(rootDir, "package.json"));
-        if (!pkg)
-            return false;
-        try {
-            return !!(JSON.parse(pkg).eslintConfig);
-        }
-        catch {
-            return false;
-        }
-    })();
-    if (!hasEslintConfig && !hasPkgEslint)
-        return { violations: [], available: false };
-    try {
-        execSync("npx eslint . --format json --max-warnings=0 --no-error-on-unmatched-pattern", { cwd: rootDir, stdio: "pipe" });
-        return { violations: [], available: true };
-    }
-    catch (e) {
-        const raw = e.stdout?.toString() ?? "";
-        try {
-            const results = JSON.parse(raw);
-            const violations = [];
-            for (const file of results) {
-                for (const msg of file.messages) {
-                    if (msg.severity > 0) {
-                        violations.push(`[ESLint] ${path.relative(rootDir, file.filePath)}:${msg.line} — ${msg.message}${msg.ruleId ? ` (${msg.ruleId})` : ""}`);
-                    }
-                }
-            }
-            return { violations, available: true };
-        }
-        catch {
-            // ESLint output not JSON — return raw stderr summary
-            const stderr = e.stderr?.toString() ?? "";
-            return { violations: stderr ? [`[ESLint] ${stderr.slice(0, 400)}`] : [], available: true };
-        }
-    }
-}
-// ── Maven + Checkstyle for Java/Spring projects ───────────────────────────────
-function runCheckstyle(rootDir) {
-    const hasPom = fs.existsSync(path.join(rootDir, "pom.xml"));
-    if (!hasPom)
-        return { violations: [], available: false };
-    try {
-        execSync("mvn checkstyle:check -q --no-transfer-progress", { cwd: rootDir, stdio: "pipe" });
-        return { violations: [], available: true };
-    }
-    catch (e) {
-        const output = ((e.stdout?.toString() ?? "") + (e.stderr?.toString() ?? "")).slice(0, 1200);
-        return {
-            violations: [`[Checkstyle/Maven] Build failed:\n${output}`],
-            available: true,
-        };
-    }
-}
-// ── Regex fallback — used only when no linter is configured ──────────────────
-function checkConsoleLogsRegex(rootDir) {
-    const violations = [];
-    for (const { regex, label, ext } of CONSOLE_LOG_REGEX) {
-        const files = walkDir(rootDir, ext);
-        for (const file of files) {
-            const content = readFileSafe(file);
-            if (!content)
-                continue;
-            const lines = content.split("\n");
-            lines.forEach((line, idx) => {
-                if (regex.test(line)) {
-                    violations.push(`${label} found at ${path.relative(rootDir, file)}:${idx + 1}`);
-                }
-                regex.lastIndex = 0;
-            });
-        }
-    }
-    return violations;
-}
-function checkHardcodedUrls(rootDir) {
-    const violations = [];
-    const exts = [".ts", ".tsx", ".js", ".jsx", ".java", ".properties", ".yml", ".yaml"];
-    const files = walkDir(rootDir, exts);
-    for (const file of files) {
-        const content = readFileSafe(file);
-        if (!content)
-            continue;
-        const matches = content.match(HARDCODED_URL_PATTERN);
-        if (matches) {
-            violations.push(`Hardcoded URL/IP in ${path.relative(rootDir, file)}: ${[...new Set(matches)].join(", ")}`);
-        }
-    }
-    return violations;
-}
-// ── Workspace / Microservice Discovery ───────────────────────────────────────
-function findProjectRoots(dir, depth = 0) {
-    if (depth > 3)
-        return []; // Limit depth to avoid scanning massive trees
-    if (!fs.existsSync(dir))
-        return [];
-    const entries = fs.readdirSync(dir, { withFileTypes: true });
-    const hasPackageJson = entries.some(e => e.name === "package.json");
-    const hasPomXml = entries.some(e => e.name === "pom.xml");
-    const roots = [];
-    if (hasPackageJson || hasPomXml) {
-        roots.push(dir);
-    }
-    for (const entry of entries) {
-        if (entry.isDirectory()) {
-            if (["node_modules", ".git", "dist", "build", "target", ".idea"].includes(entry.name))
-                continue;
-            roots.push(...findProjectRoots(path.join(dir, entry.name), depth + 1));
-        }
-    }
-    return [...new Set(roots)];
-}
-// ── Automated Tenant Isolation Scanner ────────────────────────────────────────
-function checkTenantIsolation(rootDir) {
-    const violations = [];
-    const files = walkDir(rootDir, [".java"]).filter(f => f.endsWith("Repository.java"));
-    const queryMethodRegex = /\b(?:find|get|read|query|search|stream|count|exists|delete|remove)(?:All)?By[A-Z0-9]/;
-    const atQueryRegex = /@Query\s*\(/;
-    for (const file of files) {
-        const content = readFileSafe(file);
-        if (!content)
-            continue;
-        const lines = content.split("\n");
-        for (let i = 0; i < lines.length; i++) {
-            const line = lines[i];
-            if (queryMethodRegex.test(line) || atQueryRegex.test(line)) {
-                // Look at current line and the next to handle simple wrapping
-                const combinedContext = line + (lines[i + 1] || "");
-                if (!/tenant/i.test(combinedContext)) {
-                    violations.push(`Missing tenant isolation in ${path.relative(rootDir, file)}:${i + 1} — query lacks 'tenantId':\n` +
-                        `      ${line.trim()}`);
-                }
-            }
-        }
-    }
-    return violations;
-}
-function checkFlywayMigrations(rootDir) {
-    const warnings = [];
-    const javaFiles = walkDir(rootDir, [".java"]);
-    const entityFiles = javaFiles.filter((f) => {
-        const content = readFileSafe(f);
-        return content && /@Entity\b/.test(content);
-    });
-    if (entityFiles.length === 0)
-        return warnings;
-    const flywayDirs = [
-        path.join(rootDir, "src", "main", "resources", "db", "migration"),
-        path.join(rootDir, "src", "main", "resources", "db", "migrations"),
-        path.join(rootDir, "resources", "db", "migration"),
-    ];
-    const flywayDir = flywayDirs.find((d) => fs.existsSync(d));
-    if (!flywayDir) {
-        warnings.push(`Found ${entityFiles.length} JPA @Entity file(s) but no Flyway migration directory detected. ` +
-            `Expected at: src/main/resources/db/migration/`);
-        return warnings;
-    }
-    const migrationFiles = fs.readdirSync(flywayDir).filter((f) => /^V\d+__.*\.sql$/i.test(f));
-    if (migrationFiles.length === 0) {
-        warnings.push(`Found ${entityFiles.length} JPA @Entity file(s) but no Flyway SQL migrations exist in ${flywayDir}`);
-    }
-    return warnings;
-}
-// ─────────────────────────────────────────────
 //  MCP Server bootstrap
 // ─────────────────────────────────────────────
 const server = new McpServer({
@@ -500,201 +299,6 @@ server.tool("log_rejected_pattern", "Record a coding pattern that was rejected b
         ],
     }, inputChars);
 });
-// ─── Tool 3: run_pre_pr_checks ───────────────────────────────────────────────
-server.tool("run_pre_pr_checks", "Run all SecuFusion pre-PR guardrail checks across the workspace. " +
-    "Automatically discovers modified microservices and runs native linters, database script checks, and strict tenant-isolation scanners. " +
-    "Validates: spec checkboxes, hardcoded IPs/URLs, tenantId in Repositories, and Flyway migration coverage for JPA entities. " +
-    "Linter/isolation errors must be fixed natively — do not suppress warnings to pass the gate. " +
-    "MUST pass with zero errors before a PR is raised.", {
-    work_item_id: z
-        .string()
-        .describe("Azure DevOps work item ID to include in the PR summary."),
-    root_dir: z
-        .string()
-        .optional()
-        .describe("Root directory to scan (defaults to cwd). Use when the source repo is in a sub-folder."),
-    skip_checks: z
-        .array(z.enum([
-        "spec_boxes",
-        "console_logs",
-        "tenant_isolation",
-        "hardcoded_urls",
-        "flyway_migrations",
-    ]))
-        .optional()
-        .describe("Explicitly skip specific checks. Use sparingly — document the reason in your PR description."),
-}, async ({ work_item_id, root_dir, skip_checks = [] }) => {
-    const inputChars = JSON.stringify({ work_item_id, root_dir, skip_checks }).length;
-    const scanRoot = root_dir ? path.resolve(root_dir) : getWorkspaceRoot();
-    const errors = [];
-    const warnings = [];
-    const passed = [];
-    // ── 1. Branch state check ─────────────────────────────────────────────
-    if (!skip_checks.includes("spec_boxes")) {
-        const branch = getCurrentBranch(scanRoot);
-        const statePath = path.resolve(scanRoot, STATE_FILE);
-        let branchState = null;
-        if (fs.existsSync(statePath)) {
-            try {
-                const stateData = JSON.parse(readFileSafe(statePath) || "{}");
-                branchState = stateData[branch];
-            }
-            catch { }
-        }
-        if (!branchState) {
-            errors.push(`❌ [STATE] No branch state found for '${branch}' in \`${STATE_FILE}\`. ` +
-                `Call \`manage_branch_state\` with action='initialize' before raising a PR.`);
-        }
-        else if (branchState.pending_acs && branchState.pending_acs.length > 0) {
-            errors.push(`❌ [STATE] ${branchState.pending_acs.length} pending AC(s) remain for branch '${branch}':\n` +
-                branchState.pending_acs.map((u) => `   • ${u}`).join("\n"));
-        }
-        else {
-            passed.push(`✅ [STATE] Branch state for '${branch}' is clear (no pending ACs).`);
-        }
-    }
-    else {
-        warnings.push("⚠️  [STATE] Branch state check SKIPPED (manually bypassed).");
-    }
-    // ── 2. AST-level linting (Workspace Discovery → ESLint/Checkstyle → regex fallback)
-    if (!skip_checks.includes("console_logs")) {
-        let projectRoots = findProjectRoots(scanRoot);
-        if (projectRoots.length === 0)
-            projectRoots.push(scanRoot);
-        let anyLinterAvailable = false;
-        const allLintViolations = [];
-        const usedLinters = new Set();
-        for (const pRoot of projectRoots) {
-            const eslint = runEslint(pRoot);
-            const checkstyle = runCheckstyle(pRoot);
-            if (eslint.available) {
-                anyLinterAvailable = true;
-                usedLinters.add("ESLint");
-                allLintViolations.push(...eslint.violations);
-            }
-            if (checkstyle.available) {
-                anyLinterAvailable = true;
-                usedLinters.add("Checkstyle");
-                allLintViolations.push(...checkstyle.violations);
-            }
-        }
-        if (anyLinterAvailable) {
-            // AST linters found and ran — they are the source of truth
-            if (allLintViolations.length > 0) {
-                errors.push(`❌ [LINTING] ${allLintViolations.length} linter error(s) across workspace — fix natively in their respective microservices:\n` +
-                    allLintViolations.map((v) => `   • ${v}`).join("\n"));
-            }
-            else {
-                passed.push(`✅ [LINTING] AST-level linting passed across workspace (${Array.from(usedLinters).join(" + ")}).`);
-            }
-        }
-        else {
-            // No linters configured — fall back to regex scan with a warning
-            const regexViolations = checkConsoleLogsRegex(scanRoot);
-            if (regexViolations.length > 0) {
-                errors.push(`❌ [LOGGING] ${regexViolations.length} prohibited log statement(s) found via regex fallback\n` +
-                    `   (No ESLint/Checkstyle config detected in any workspace project — configure a linter for AST-level accuracy):\n` +
-                    regexViolations.map((v) => `   • ${v}`).join("\n"));
-            }
-            else {
-                warnings.push("⚠️  [LOGGING] No ESLint/Checkstyle config found in workspace — used regex fallback. " +
-                    "Consider adding a linter for AST-level hygiene.");
-            }
-        }
-    }
-    else {
-        warnings.push("⚠️  [LINTING] Linter check SKIPPED (manually bypassed).");
-    }
-    // ── 3. Tenant Isolation Scanner ──────────────────────────────────────────
-    if (!skip_checks.includes("tenant_isolation")) {
-        const tenantViolations = checkTenantIsolation(scanRoot);
-        if (tenantViolations.length > 0) {
-            errors.push(`❌ [SECURITY] Tenant Isolation Failed: Found ${tenantViolations.length} query method(s) in *Repository.java without tenant scoping:\n` +
-                tenantViolations.map((v) => `   • ${v}`).join("\n"));
-        }
-        else {
-            passed.push("✅ [SECURITY] Tenant isolation active: All database queries correctly scoped with tenantId.");
-        }
-    }
-    else {
-        warnings.push("⚠️  [SECURITY] Tenant isolation check SKIPPED (manually bypassed).");
-    }
-    // ── 4. Hardcoded URL check (regex) ───────────────────────────────────────
-    if (!skip_checks.includes("hardcoded_urls")) {
-        const urlViolations = checkHardcodedUrls(scanRoot);
-        if (urlViolations.length > 0) {
-            errors.push(`❌ [SECURITY] Found ${urlViolations.length} hardcoded URL/IP(s):\n` +
-                urlViolations.map((v) => `   • ${v}`).join("\n"));
-        }
-        else {
-            passed.push("✅ [SECURITY] No hardcoded UAT/Prod IPs or environment URLs found.");
-        }
-    }
-    else {
-        warnings.push("⚠️  [SECURITY] Hardcoded URL check SKIPPED (manually bypassed).");
-    }
-    // ── 4. Flyway migration check ──────────────────────────────────────────
-    if (!skip_checks.includes("flyway_migrations")) {
-        const flywayWarnings = checkFlywayMigrations(scanRoot);
-        if (flywayWarnings.length > 0) {
-            errors.push(...flywayWarnings.map((w) => `❌ [FLYWAY] ${w}`));
-        }
-        else {
-            passed.push("✅ [FLYWAY] Flyway migration coverage looks good.");
-        }
-    }
-    else {
-        warnings.push("⚠️  [FLYWAY] Flyway migration check SKIPPED (manually bypassed).");
-    }
-    // ── Surface rejected patterns as a reminder ───────────────────────────
-    const rejectedContent = readFileSafe(resolve(REJECTED_FILE));
-    let rejectedReminder = "";
-    if (rejectedContent) {
-        try {
-            const rejected = JSON.parse(rejectedContent);
-            if (rejected.length > 0) {
-                rejectedReminder =
-                    `\n\n---\n### 🚫 Rejected Patterns Reminder (${rejected.length} on record)\n` +
-                        rejected.map((r) => `- [${r.category}] ${r.pattern}`).join("\n");
-            }
-        }
-        catch {
-            /* ignore parse errors */
-        }
-    }
-    // ── Build final report ─────────────────────────────────────────────────
-    const hasErrors = errors.length > 0;
-    const timestamp = new Date().toISOString();
-    let report;
-    if (hasErrors) {
-        report =
-            `# ❌ Pre-PR Checks FAILED — Work Item #${work_item_id}\n\n` +
-                `**Scanned directory:** \`${scanRoot}\`\n` +
-                `**Timestamp:** ${timestamp}\n\n` +
-                `## Errors (must fix before PR)\n\n${errors.join("\n\n")}\n\n` +
-                (warnings.length > 0 ? `## Warnings\n\n${warnings.join("\n")}\n\n` : "") +
-                (passed.length > 0 ? `## Passed\n\n${passed.join("\n")}\n` : "") +
-                rejectedReminder;
-    }
-    else {
-        report =
-            `# ✅ Pre-PR Checks PASSED — Work Item #${work_item_id}\n\n` +
-                `**Scanned directory:** \`${scanRoot}\`\n` +
-                `**Timestamp:** ${timestamp}\n\n` +
-                `## All Checks Passed\n\n${passed.join("\n")}\n\n` +
-                (warnings.length > 0 ? `## Warnings\n\n${warnings.join("\n")}\n\n` : "") +
-                `## PR Summary\n\n` +
-                `- **Work Item:** [#${work_item_id}](https://dev.azure.com/secufusion/_workitems/edit/${work_item_id})\n` +
-                `- **Spec:** All acceptance criteria verified ✅\n` +
-                `- **Guardrails:** tenantId scoping, no debug logs, no hardcoded URLs, Flyway covered ✅\n` +
-                `- **Ready to raise PR** 🚀\n` +
-                rejectedReminder;
-    }
-    return appendTelemetry({
-        content: [{ type: "text", text: report }],
-        isError: hasErrors,
-    }, inputChars);
-});
 // ─── Tool 4: manage_project_spec ─────────────────────────────────────────────
 server.tool("manage_project_spec", "Manages the .secufusion-project-spec.json file — the permanent project memory containing all service ports, repos, domains, infrastructure config, coding patterns, auth flow, and golden rules. Every session must read this before writing any code.", {
     action: z

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "secufusion-mcp",
-  "version": "1.0.37",
+  "version": "1.0.38",
   "type": "module",
   "description": "SecuFusion MCP server - developer workflow tooling with guardrails",
   "main": "index.js",