secufusion-mcp 1.0.39 → 1.0.41

package/AGENTS.md

@@ -227,10 +227,9 @@ Kafka topics, Keycloak config, coding patterns, auth flow, and all golden rules.
 ❌ Ask how tenantId is extracted  
 ❌ Assume any service details from memory  
 ❌ Write any code  
-❌ Call classify_task  
 ❌ Proceed to any other phase  
 
-The ONLY tool calls permitted in Phase 00 are the `manage_project_spec` calls listed above.
+The ONLY tool calls permitted in Phase 0.5 are the `manage_project_spec` calls listed above.
 
 ---
 

package/README.md

@@ -21,7 +21,7 @@
 | `get_pattern_from_task` | **Phase 1** — Cross-Task Intelligence | Extracts reusable decisions, file patterns, and test scenarios from a completed task |
 | `manage_branch_state` | Legacy — Branch State | Backward-compatible branch-scoped JSON state tracker (for tasks before `manage_task`) |
 | `log_rejected_pattern` | **Phase 3** — Course Correction | Records bad patterns to `.rejected-patterns.json` so they are never repeated |
-| `run_pre_pr_checks` | **Phase 4** — PR Handoff | Discovers modified microservices and gates PRs via AST-level linters + structural checks |
+| `generate_ado_comments` | **Phase 4** — PR Handoff | Generates distinct Layman and Technical Deep-Dive summaries for the Azure DevOps board |
 | `get_secufusion_rules` | **Setup** | Returns the `AGENTS.md` rules for AI clients that don't natively support MCP Resources |
 | `classify_task` | **Phase 0.5** — Task Classification | **NEW** — Deep multi-pass analysis engine. Classifies any task as `BACKEND_ONLY`, `FRONTEND_ONLY`, `FULL_STACK`, or `EXTENSION_ONLY` based on root cause (where the fix lives), not surface symptoms. Must be the first tool called on any task. |
 
@@ -231,65 +231,21 @@ This writes to `.rejected-patterns.json`:
 
 ---
 
-### 3. run_pre_pr_checks
+### 3. generate_ado_comments
 
 | Parameter | Type | Required | Description |
 |---|---|---|---|
 | `work_item_id` | string | Yes | Azure DevOps work item ID |
-| `root_dir` | string | No | Directory to scan (defaults to cwd) |
-| `skip_checks` | array | No | `branch_state`, `console_logs`, `tenant_isolation`, `hardcoded_urls`, `flyway_migrations` |
+| `layman_summary` | string | Yes | Non-technical explanation of the business value and what was resolved |
+| `technical_deep_dive` | string | Yes | Comprehensive breakdown of the architectural changes and optimizations |
 
-**Guardrail checks:**
-
-| Check | Fails when |
-|---|---|
-| **STATE** | `.secufusion-state.json` has pending ACs for the active branch |
-| **LINTING** | AST linters (ESLint, Checkstyle) fail in any discovered microservice. Fix natively, do not suppress! (Falls back to regex if no linters exist) |
-| **SECURITY** | Hardcoded IPs or `uat.*` / `prod.*` / `staging.*` URLs in source or config files |
-| **TENANT ISOLATION** | `*Repository.java` files contain query methods or `@Query` annotations that do NOT include `tenant` filtering |
-| **FLYWAY** | `@Entity`-annotated Java files exist but no `V*__.sql` Flyway migrations found |
-
-**Example — Run checks before PR:**
+**Example — Generate ADO board comments:**
 
 ```
 Ask: "Prepare the PR for work item 1042."
 ```
 
-The AI will call:
-```json
-{
-  "work_item_id": "1042"
-}
-```
-
-**✅ Passing output:**
-```
-# ✅ Pre-PR Checks PASSED — Work Item #1042
-
-✅ [STATE] All branch tasks completed.
-✅ [LOGGING] No console.log / System.out.println found.
-✅ [SECURITY] No hardcoded UAT/Prod IPs or environment URLs found.
-✅ [FLYWAY] Flyway migration coverage looks good.
-
-## PR Summary
-- Work Item: #1042
-- State: All pending ACs resolved ✅
-- Ready to raise PR 🚀
-```
-
-**❌ Failing output (example):**
-```
-# ❌ Pre-PR Checks FAILED — Work Item #1042
-
-❌ [STATE] 3 pending AC(s) remain in .secufusion-state.json:
-   • Flyway SQL migration created for every modified JPA @Entity
-   • Unit tests written / updated for new business logic
-   • API contract updated if endpoints changed
-
-❌ [LOGGING] Found 2 prohibited log statement(s):
-   • console.log() found at src/components/AuditTable.tsx:47
-   • System.out.println() found at src/main/java/AuditService.java:112
-```
+The AI will complete the task, then call `generate_ado_comments`. The output is explicitly formatted for the developer to paste into the Azure DevOps board.
 
 ---
 
@@ -466,7 +422,7 @@ These rules are enforced automatically — the AI will never violate them:
 │  Correction  │  → Record mistakes to avoid repeat                             │
 ├──────────────┼──────────────────────────────────────────────────────────────┤
 │  Phase 4     │  manage_task (action=complete) → pr-summary.md generated      │
-│  PR Handoff  │  run_pre_pr_checks → must pass before raising PR              │
+│  PR Handoff  │  generate_ado_comments → outputs Layman & Tech summaries      │
 └──────────────┴──────────────────────────────────────────────────────────────┘
 ```
 
@@ -609,32 +565,25 @@ The AI **immediately** calls `log_rejected_pattern`:
 
 ---
 
-### Step 6 — Pre-PR checks (PR Handoff phase)
+### Step 6 — Complete the task (PR Handoff phase)
 
 When you're done, say:
 
 ```
-Run pre-PR checks for work item 2847.
+I'm done with WI-2847. Please complete the task and generate the ADO comments.
 ```
 
-The AI scans your entire repo and produces a report.
+The AI marks the task complete, auto-generates a PR summary locally, and then outputs two Azure DevOps comments for you to paste into the ticket:
 
-**✅ Everything passes — ready to ship:**
+**✅ Passing output:**
 ```
-# ✅ Pre-PR Checks PASSED — Work Item #2847
-
-Scanned directory: C:\projects\secufusion-backend
+Here are the comments for your ADO ticket:
 
-✅ [STATE] All tasks resolved.
-✅ [LOGGING] No console.log / System.out.println found.
-✅ [SECURITY] No hardcoded UAT/Prod IPs or environment URLs found.
-✅ [FLYWAY] Flyway migration coverage looks good.
+**Layman Summary:**
+The problem where some devices weren't accurately appearing on the admin dashboard has been resolved. The fix ensures that the system accurately tallies the registered hardware without throwing silent errors.
 
-## PR Summary
-- Work Item: #2847
-- State: All pending ACs resolved ✅
-- Guardrails: tenant isolation secured, no debug logs, no hardcoded URLs, Flyway covered ✅
-- Ready to raise PR 🚀
+**Technical Deep-Dive:**
+The `DeviceActivitySummaryDTO` was throwing a NullPointerException because the `browserUsage` map was uninitialized when `deviceList` was empty. I added an explicit `ConcurrentHashMap` initialization and scoped the iteration inside a `tenantId` check to preserve cross-tenant boundaries.
 ```
 
 ---
@@ -746,7 +695,7 @@ Once all three layers are in place, you interact completely naturally:
 
 **Before Phase 0.5 + 0.7:** The AI started coding immediately with no ownership check or explicit plan.
 
-**After Phase 0.5 + 0.7:** The AI calls `classify_task` first (no exceptions). The deep analysis engine classifies by root cause — not surface symptoms — runs a performance risk and breaking change scan, presents a complete plan with rollback strategy, and **waits for your approval before writing a single line of code**.
+**After Phase 0.5 + 0.7:** The AI performs deep code investigation, writes an **Ultimate Reasoning** block to prove its root-cause understanding, and then calls `classify_task`. The deep analysis engine confirms the classification, runs a performance risk and breaking change scan, presents a complete plan with rollback strategy, and **waits for your approval before writing a single line of code**.
 
 **Before strict AGENTS.md:** Each phase was a soft bullet list with suggestions. The AI could skip steps.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "secufusion-mcp",
-  "version": "1.0.39",
+  "version": "1.0.41",
   "type": "module",
   "description": "SecuFusion MCP server - developer workflow tooling with guardrails",
   "main": "index.js",