secufusion-mcp 1.0.5 → 1.0.7

package/README.md

@@ -14,7 +14,7 @@
 
 | Tool | Phase | What it does |
 |---|---|---|
-| `manage_feature_spec` | Planning & Execution | Creates/updates a `.current-task-spec.md` blueprint (works for single-repo or cross-repo tasks) |
+| `manage_branch_state` | Planning & Execution | Manages a `.secufusion-state.json` tracker tied to the active Git branch |
 | `log_rejected_pattern` | Course Correction | Records bad patterns to `.rejected-patterns.json` so they are never repeated |
 | `run_pre_pr_checks` | PR Handoff | Discovers modified microservices across the workspace and gates PRs via AST-level linters + structural checks |
 
@@ -102,69 +102,40 @@ Open Cline settings → MCP Servers → Add:
 
 ## Tools Reference
 
-### 1. `manage_feature_spec`
+### 1. manage_branch_state
 
-Creates or updates the `.current-task-spec.md` file — your single source of truth for every task. The AI reads this before writing any code.
+Manages a structured JSON state file (`.secufusion-state.json`) keyed to the current Git branch. This replaces unstructured Markdown parsing and ensures the AI can resume perfectly.
 
 **Parameters:**
 
 | Parameter | Type | Required | Description |
 |---|---|---|---|
-| `action` | `"create"` \| `"update"` \| `"read"` | Yes | What to do with the spec |
-| `task_description` | string | When `action=create` | Full description of the task/feature |
-| `update_content` | string | When `action=update` | Markdown lines to merge (e.g. tick checkboxes) |
-| `work_item_id` | string | No | Azure DevOps work item ID |
-| `reference_file_path` | string | No | Path to an existing source file to extract coding patterns from |
-
-**Example — Create a spec:**
-
-```
-Ask your AI assistant:
-"Start working on WI-1042: Add tenant-scoped audit log export to CSV.
-Reference file: src/services/AuditService.java"
-```
-
-The AI will call:
+| `action` | string | Yes | `initialize`, `read`, or `update` |
+| `task_description` | string | No | (For `initialize`) Summary of the work |
+| `pending_acs` | array | No | Array of strings for pending tasks (For `initialize`/`update`) |
+| `completed_acs` | array | No | Array of completed AC strings (For `update`) |
+| `next_step` | string | No | **CRITICAL for `update`**: A clear instruction on what to do next to allow instant resumption. |
+| `reference_file_path` | string | No | Path to a reference file with standard coding patterns |
+
+**Example — Starting a new task:**
 ```json
 {
-  "action": "create",
-  "task_description": "Add tenant-scoped audit log export to CSV...",
-  "work_item_id": "1042",
-  "reference_file_path": "src/services/AuditService.java"
+  "action": "initialize",
+  "task_description": "Implement DeviceActivitySummaryDTO with browserUsage map.",
+  "pending_acs": ["Add browserUsage map", "Add unit tests", "Update OpenAPI"]
 }
 ```
 
-This generates `.current-task-spec.md` with:
-- Task description
-- Pre-filled guardrails checklist
-- Acceptance criteria placeholders
-- Reference code snippet
-- Session log
-
-**Example — Tick off completed work:**
-
-```
-Ask: "Mark the tenantId scoping and unit tests as done in the spec."
-```
-
-The AI will call:
+**Example — Updating progress:**
 ```json
 {
   "action": "update",
-  "update_content": "- [x] All DB queries / event payloads are scoped with `tenantId`\n- [x] Unit tests written / updated for new business logic"
+  "pending_acs": ["Update OpenAPI"],
+  "completed_acs": ["Add browserUsage map", "Add unit tests"],
+  "next_step": "Generate the OpenAPI YAML for DeviceActivitySummaryDTO and test generation."
 }
 ```
 
-**Example — Read current spec:**
-
-```
-Ask: "Where did we leave off? Read the current spec."
-```
-
-```json
-{ "action": "read" }
-```
-
 ---
 
 ### 2. `log_rejected_pattern`
@@ -219,15 +190,16 @@ This writes to `.rejected-patterns.json`:
 |---|---|---|---|
 | `work_item_id` | string | Yes | Azure DevOps work item ID |
 | `root_dir` | string | No | Directory to scan (defaults to cwd) |
-| `skip_checks` | array | No | `spec_boxes`, `console_logs`, `hardcoded_urls`, `flyway_migrations` |
+| `skip_checks` | array | No | `branch_state`, `console_logs`, `tenant_isolation`, `hardcoded_urls`, `flyway_migrations` |
 
 **Guardrail checks:**
 
 | Check | Fails when |
 |---|---|
-| **SPEC** | `.current-task-spec.md` is missing or has unchecked `- [ ]` boxes |
+| **STATE** | `.secufusion-state.json` has pending ACs for the active branch |
 | **LINTING** | AST linters (ESLint, Checkstyle) fail in any discovered microservice. Fix natively, do not suppress! (Falls back to regex if no linters exist) |
 | **SECURITY** | Hardcoded IPs or `uat.*` / `prod.*` / `staging.*` URLs in source or config files |
+| **TENANT ISOLATION** | `*Repository.java` files contain query methods or `@Query` annotations that do NOT include `tenant` filtering |
 | **FLYWAY** | `@Entity`-annotated Java files exist but no `V*__.sql` Flyway migrations found |
 
 **Example — Run checks before PR:**
@@ -247,14 +219,14 @@ The AI will call:
 ```
 # ✅ Pre-PR Checks PASSED — Work Item #1042
 
-✅ [SPEC] All spec checkboxes are checked.
+✅ [STATE] All branch tasks completed.
 ✅ [LOGGING] No console.log / System.out.println found.
 ✅ [SECURITY] No hardcoded UAT/Prod IPs or environment URLs found.
 ✅ [FLYWAY] Flyway migration coverage looks good.
 
 ## PR Summary
 - Work Item: #1042
-- Spec: All acceptance criteria verified ✅
+- State: All pending ACs resolved ✅
 - Ready to raise PR 🚀
 ```
 
@@ -262,7 +234,7 @@ The AI will call:
 ```
 # ❌ Pre-PR Checks FAILED — Work Item #1042
 
-❌ [SPEC] 3 unchecked item(s) in the spec:
+❌ [STATE] 3 pending AC(s) remain in .secufusion-state.json:
    • Flyway SQL migration created for every modified JPA @Entity
    • Unit tests written / updated for new business logic
    • API contract updated if endpoints changed
@@ -283,7 +255,7 @@ These rules are enforced automatically — the AI will never violate them:
 ✅ No console.log() or System.out.println() in any source file
 ✅ No hardcoded UAT/Prod IPs or environment URLs
 ✅ Every JPA @Entity change accompanied by a Flyway .sql migration
-✅ Spec must be fully checked before PR is raised
+✅ State in .secufusion-state.json must be fully resolved before PR is raised
 ```
 
 ---
@@ -292,7 +264,7 @@ These rules are enforced automatically — the AI will never violate them:
 
 | File | Description |
 |---|---|
-| `.current-task-spec.md` | Living task blueprint — created per feature, updated as work progresses |
+| `.secufusion-state.json` | Living task blueprint — tracks pending/completed ACs per branch |
 | `.rejected-patterns.json` | Cumulative log of all rejected patterns across sessions |
 
 > **Tip:** Commit both files to your repo so the entire team benefits from the shared knowledge.
@@ -305,11 +277,11 @@ These rules are enforced automatically — the AI will never violate them:
 ┌─────────────────────────────────────────────────────┐
 │                 SecuFusion MCP Workflow              │
 ├──────────────┬──────────────────────────────────────┤
-│  Phase 1     │  manage_feature_spec (action=create)  │
-│  Planning    │  → Generates .current-task-spec.md    │
+│  Phase 1     │  manage_branch_state (action=init)    │
+│  Planning    │  → Initializes .secufusion-state.json │
 ├──────────────┼──────────────────────────────────────┤
-│  Phase 2     │  manage_feature_spec (action=update)  │
-│  Execution   │  → Tick off ACs as you complete them  │
+│  Phase 2     │  manage_branch_state (action=update)  │
+│  Execution   │  → Resolve ACs & define next_step     │
 ├──────────────┼──────────────────────────────────────┤
 │  Phase 3     │  log_rejected_pattern                 │
 │  Correction  │  → Record mistakes to avoid repeat    │
@@ -372,46 +344,14 @@ Admin users must be forced through TOTP verification before
 accessing any dashboard route. Exempt service accounts.
 ```
 
-**The AI automatically calls `manage_feature_spec` and creates `.current-task-spec.md`:**
-```markdown
-# SecuFusion Feature Spec
-
-**Generated:** 2026-08-26T14:35:00.000Z
-**Azure DevOps Work Item:** 2847 → https://dev.azure.com/secufusion/_workitems/edit/2847
-
-## Task Description
-Add MFA enforcement for admin users on login...
-
-## Guardrails Checklist
-- [ ] All DB queries / event payloads are scoped with `tenantId`
-- [ ] No `console.log` / `System.out.println` left in source files
-- [ ] No hardcoded UAT/Prod IPs or environment URLs
-- [ ] Flyway SQL migration created for every modified JPA `@Entity`
-- [ ] Unit tests written / updated for new business logic
-- [ ] API contract updated if endpoints changed
-
-## Acceptance Criteria
-- [ ] AC-1: (fill in from ticket)
-- [ ] AC-2: (fill in from ticket)
-
-## Session Log
-| 2026-08-26T14:35:00Z | Spec created |
-```
-
-You can paste as little or as much as you want:
-
-```
-# Minimal — one liner
-WI-2847: MFA for admin login with TOTP.
-
-# Full ticket paste — straight from Azure
-WI-2847
-Title: Add MFA enforcement for admin users
-Description: Admin users must complete TOTP verification...
-Acceptance Criteria:
-  - Given admin logs in, When MFA not done, Then redirect to /mfa
-  - Service accounts in GROUP_SERVICE_ACCOUNTS are exempt
-Priority: High
+**The AI automatically calls `manage_branch_state` and creates/initializes `.secufusion-state.json`:**
+```json
+{
+  "task": "WI-2847: Add MFA enforcement",
+  "pending_acs": ["AC-1: Auth flow", "AC-2: Redirects", "AC-3: Exemptions"],
+  "completed_acs": [],
+  "next_step": "Implement MFA logic in AuthController"
+}
 ```
 
 ---
@@ -434,23 +374,20 @@ As you finish pieces of the feature, tell the AI:
 
 ```
 I've finished the tenantId scoping on all queries and written the unit tests.
-Update the spec.
+Update the state.
 ```
 
-The AI calls `manage_feature_spec` with `action=update` and the spec updates:
-
-```markdown
-# Before
-- [ ] All DB queries / event payloads are scoped with `tenantId`
-- [ ] Unit tests written / updated for new business logic
+The AI calls `manage_branch_state` with `action=update` and the state updates:
 
-# After
-- [x] All DB queries / event payloads are scoped with `tenantId`
-- [x] Unit tests written / updated for new business logic
+```json
+{
+  "task": "WI-2847: Add MFA enforcement",
+  "pending_acs": ["AC-3: Exemptions"],
+  "completed_acs": ["Add tenantId scoping", "Add unit tests"],
+  "next_step": "Implement exemption logic for service accounts"
+}
 ```
 
-A new row is also appended to the Session Log automatically, so you always have an audit trail of progress across sessions.
-
 ---
 
 ### Step 5 — Course correction (if the AI does something wrong)
@@ -473,23 +410,6 @@ The AI **immediately** calls `log_rejected_pattern`:
 }
 ```
 
-This gets appended to `.rejected-patterns.json`:
-
-```json
-[
-  {
-    "id": 1,
-    "timestamp": "2026-08-26T15:10:00.000Z",
-    "category": "security",
-    "pattern": "Hardcoded staging URL https://staging.secufusion.io in source files",
-    "reason": "Must use @Value from application.properties...",
-    "file_context": "src/services/NotificationService.java"
-  }
-]
-```
-
-From this point on, the AI checks this file before every suggestion — the mistake will never be repeated, even in future sessions.
-
 ---
 
 ### Step 6 — Pre-PR checks (PR Handoff phase)
@@ -507,104 +427,44 @@ The AI scans your entire repo and produces a report.
 # ✅ Pre-PR Checks PASSED — Work Item #2847
 
 Scanned directory: C:\projects\secufusion-backend
-Timestamp: 2026-08-26T16:00:00.000Z
 
-✅ [SPEC] All spec checkboxes are checked.
+✅ [STATE] All tasks resolved.
 ✅ [LOGGING] No console.log / System.out.println found.
 ✅ [SECURITY] No hardcoded UAT/Prod IPs or environment URLs found.
 ✅ [FLYWAY] Flyway migration coverage looks good.
 
 ## PR Summary
 - Work Item: #2847
-- Spec: All acceptance criteria verified ✅
-- Guardrails: tenantId scoping, no debug logs, no hardcoded URLs, Flyway covered ✅
+- State: All pending ACs resolved ✅
+- Guardrails: tenant isolation secured, no debug logs, no hardcoded URLs, Flyway covered ✅
 - Ready to raise PR 🚀
-
-🚫 Rejected Patterns Reminder (1 on record)
-- [security] Hardcoded staging URL https://staging.secufusion.io in source files
-```
-
-**❌ Checks fail — you must fix before PR:**
-```
-# ❌ Pre-PR Checks FAILED — Work Item #2847
-
-## Errors (must fix before PR)
-
-❌ [SPEC] 2 unchecked item(s) in the spec:
-   • Flyway SQL migration created for every modified JPA @Entity
-   • API contract (OpenAPI / TS types) updated if endpoints changed
-
-❌ [LINTING] 2 linter error(s) across workspace — fix natively in their respective microservices:
-   • [ESLint] apps/admin-dashboard/src/components/MfaSetup.tsx:47 — Unexpected console statement (no-console)
-   • [Checkstyle/Maven] Build failed: [ERROR] AuditService.java:[112] Line contains System.out.println
-
-## Passed
-✅ [SECURITY] No hardcoded UAT/Prod IPs or environment URLs found.
-✅ [FLYWAY] Flyway migration coverage looks good.
 ```
 
-Fix the issues, run checks again, and only raise the PR once it's fully green.
-
----
-
-### Quick cheat sheet
-
-| What you want to do | What to say to the AI |
-|---|---|
-| Start a new task | `WI-XXXX: [paste description from Azure]` |
-| Check where you left off | `Read the current spec` |
-| Mark work as done | `Mark the tenantId scoping as complete in the spec` |
-| Record a mistake | `Never do [X] again because [Y]` |
-| Gate the PR | `Run pre-PR checks for WI-XXXX` |
-| Resume after a break | `What's left on the current task?` |
-| Use a reference file | `WI-XXXX: [desc]. Reference: src/services/MyService.java` |
-
 ---
 
-## How It Actually Works — The Invoker
-
-There are two layers that need to be in place for the MCP server to work automatically.
-
-### Layer 1 — `mcp_config.json` (makes tools available)
-
-This tells the IDE to start the MCP server process when it launches. The tools become registered and ready, but nothing calls them yet.
-
-```
-IDE starts → reads mcp_config.json → spawns node index.js → tools registered
-```
-
-### Layer 2 — `AGENTS.md` (the invoker — tells AI when to call each tool)
-
-Without this, the tools sit idle. The AI doesn't know when to invoke them.
-Create `.agents/AGENTS.md` in your project root:
+## How It Works (The 2 Layers)
 
-```markdown
-# SecuFusion MCP Workflow Rules
+To prevent AI amnesia or generic bad habits across your projects, the SecuFusion MCP relies on structured branch-aware JSON and native AST tooling.
 
-You are an elite Senior Developer and Architect working on the SecuFusion workspace (containing multiple microservice repositories). You prioritize robust cross-service architecture, zero-trust security (tenant isolation), and flawless state management. You rely on standard AST-aware build tools (ESLint/Checkstyle) for code hygiene. You strictly follow project standards and always use the custom MCP tools provided.
+## Phase 0 — Resume (TRIGGER: new session, switching branches, or user says "resume" or "continue")
+- Call `manage_branch_state` with `action: "read"`. The tool will automatically detect the current Git branch and return the structured JSON state for that specific branch. Do not re-read requirements; immediately begin executing the item explicitly listed in the `next_step` field.
 
 ## Phase 1 — Planning (TRIGGER: user assigns a task or work item)
-- Do NOT write code immediately. First, call `manage_feature_spec`.
-- Determine which microservices are likely affected. Pass a `reference_file_path` to observe exact coding patterns.
-- Pass the user's requirements into `task_description` to generate the workspace-level `.current-task-spec.md` blueprint.
-- Wait for the spec to be generated before writing any code.
+- Call `manage_branch_state` with `action: "initialize"`. Pass the `task_description` and `reference_file_path`. The tool will generate a branch-bound JSON state file tracking the Acceptance Criteria (ACs) as a structured array of pending tasks, keyed to your active Git branch.
 
-## Phase 2 — Execution (TRIGGER: as you complete work)
-- Keep the `.current-task-spec.md` file updated as your source of truth.
-- Whenever you finish a logical chunk, call `manage_feature_spec` with `update_content` to check off the `[ ]` boxes to `[x]`.
-- If you are resuming a session, always call `manage_feature_spec` with `action=read` first to know exactly where you left off.
+## Phase 2 — Execution (TRIGGER: as you complete ACs, or before ending a session/response)
+- Call `manage_branch_state` with `action: "update"`. Move completed items from `pending_acs` to `completed_acs`.
+- CRITICAL: You must explicitly write a clear, actionable instruction into the `next_step` parameter (e.g., "Implement browserUsage map in DeviceActivitySummaryDTO"). This ensures your future self can resume instantly without parsing the full spec.
 
 ## Phase 3 — Course Correction (TRIGGER: user corrects you or rejects an approach)
-- Immediately call `log_rejected_pattern`.
-- Pass the bad `pattern` you used and the `reason`/correction the user provided.
-- Always check `.rejected-patterns.json` implicitly before suggesting architectural choices to ensure you never repeat past mistakes.
+- Immediately call `log_rejected_pattern`. Pass the bad `pattern` and the `reason`. Always check `.rejected-patterns.json` implicitly before suggesting architectural choices.
 
-## Phase 4 — PR Handoff (TRIGGER: user says "prepare PR", "finish up", or "run checks")
-- Call `run_pre_pr_checks` with the Azure DevOps `work_item_id`. The tool will automatically discover all modified microservices in the workspace and run their native linters.
-- If the tool throws an error for a specific repository (e.g., missing Flyway SQL migration, or a linter failing due to console logs/bad formatting), YOU MUST navigate to that specific microservice, FIX THE ERROR in the codebase, and run the tool again until the entire workspace passes. Do not suppress linter warnings.
+## Phase 4 — PR Handoff (TRIGGER: user says "prepare PR" or "run checks")
+- Call `run_pre_pr_checks` with the Azure DevOps `workItemId`. The tool checks the structured branch state to ensure `pending_acs` is empty, then discovers modified microservices to run native linters, Flyway checks, and the Tenant-Isolation scanner.
+- If an error is thrown, YOU MUST navigate to that microservice, FIX THE ERROR natively, and rerun until the workspace passes.
 
 ## Guardrails (enforce always, no exceptions)
-- All DB queries and event payloads MUST be scoped with `tenantId` unless the spec explicitly notes it as a global/system operation.
+- TENANT SAFETY IS AUTOMATED: The PR Gatekeeper actively scans all `*Repository.java` files. If you write a database query (derived method or `@Query`) that does not explicitly filter by `tenantId` or contain the word `tenant`, the PR will be blocked. Write secure, tenant-isolated queries on your first attempt.
 - Do not ignore linter errors. AST-level tools (ESLint, Checkstyle/Maven) are the source of truth for hygiene. Fix them natively.
 - Never hardcode UAT/Prod IPs or URLs. Use environment variables or configuration properties.
 - If you modify a JPA `@Entity` in any backend repo, you MUST create the corresponding Flyway `.sql` migration script before running PR checks.
@@ -619,9 +479,9 @@ mcp_config.json       →  starts the server (tools available)
       ↓
 You say: "WI-1042: Add audit log export"
       ↓
-AI reads AGENTS.md → Phase 1 triggered → calls manage_feature_spec
+AI reads AGENTS.md → Phase 1 triggered → calls manage_branch_state
       ↓
-.current-task-spec.md created in your project root
+.secufusion-state.json initialized for your Git branch
 ```
 
 ### Reusing across projects
@@ -647,14 +507,14 @@ Once both layers are in place, you interact completely naturally:
 | Situation | What you say |
 |---|---|
 | 🆕 New task | `WI-XXXX: [paste description from Azure]` |
-| ✅ Done a chunk | `Done with the tenantId scoping, update the spec` |
+| ✅ Done a chunk | `Done with the tenantId scoping, update the state` |
 | ❌ AI did something wrong | `Don't do X, do Y instead` |
 | 🚀 Ready for PR | `Run checks for WI-XXXX` or `Prepare PR` |
 | 🔄 Resuming after a break | `What's left?` or `Resume the current task` |
 
 **Before `AGENTS.md`:** You had to remember which tool to invoke and when.
 
-**After `AGENTS.md`:** You just describe work. The AI follows the 4-phase workflow automatically — no commands, no syntax, no manual tool calls.
+**After `AGENTS.md`:** You just describe work. The AI follows the 5-phase workflow automatically — no commands, no syntax, no manual tool calls.
 
 ---
 

package/index.js

@@ -8,7 +8,7 @@
  *   - run_pre_pr_checks    : gate PRs via AST-level linters (ESLint / Maven Checkstyle) + structural checks
  *
  * Guardrails enforced:
- *   1. All DB queries and event payloads must carry tenantId.
+ *   1. TENANT SAFETY AUTOMATED: Active scanning of *Repository.java for tenantId scoping.
  *   2. Code hygiene (console.log, unused vars, formatting) enforced via ESLint / Checkstyle — not regex.
  *   3. No hardcoded UAT/Prod IPs or environment URLs.
  *   4. Every modified JPA @Entity must have a matching Flyway SQL migration.
@@ -22,7 +22,7 @@ import { execSync } from "child_process";
 // ─────────────────────────────────────────────
 //  Constants / helpers
 // ─────────────────────────────────────────────
-const SPEC_FILE = ".current-task-spec.md";
+const STATE_FILE = ".secufusion-state.json";
 const REJECTED_FILE = ".rejected-patterns.json";
 /** Resolve a path relative to cwd (where the MCP server is invoked). */
 function resolve(file) {
@@ -40,56 +40,13 @@ function writeFile(filePath, content) {
     fs.mkdirSync(path.dirname(filePath), { recursive: true });
     fs.writeFileSync(filePath, content, "utf-8");
 }
-// ─────────────────────────────────────────────
-//  manage_feature_spec helpers
-// ─────────────────────────────────────────────
-function buildInitialSpec(taskDescription, workItemId, referenceSnippet) {
-    const now = new Date().toISOString();
-    const wiLine = workItemId
-        ? `**Azure DevOps Work Item:** [${workItemId}](https://dev.azure.com/secufusion/_workitems/edit/${workItemId})\n`
-        : "";
-    const refSection = referenceSnippet
-        ? `\n## Reference Code Pattern\n\n> Extracted from the provided reference file to guide implementation style.\n\n\`\`\`\n${referenceSnippet.slice(0, 800)}\n\`\`\`\n`
-        : "";
-    return `# SecuFusion Feature Spec
-<!-- AUTO-GENERATED — do not remove the checkboxes; they are used by run_pre_pr_checks -->
-
-**Generated:** ${now}
-${wiLine}
-## Task Description
-
-${taskDescription}
-${refSection}
-## Guardrails Checklist
-
-- [ ] All DB queries / event payloads are scoped with \`tenantId\`
-- [ ] No \`console.log\` / \`System.out.println\` left in source files
-- [ ] No hardcoded UAT/Prod IPs or environment URLs
-- [ ] Flyway SQL migration created for every modified JPA \`@Entity\`
-- [ ] Unit tests written / updated for new business logic
-- [ ] API contract (OpenAPI / TS types) updated if endpoints changed
-
-## Acceptance Criteria
-
-- [ ] AC-1: (fill in from ticket)
-- [ ] AC-2: (fill in from ticket)
-- [ ] AC-3: (fill in from ticket)
-
-## Implementation Notes
-
-> Add architecture decisions, edge-cases, and external dependency notes here.
-
-## Session Log
-
-| Timestamp | Update |
-|-----------|--------|
-| ${now} | Spec created |
-`;
-}
-function appendSessionLog(existing, update) {
-    const ts = new Date().toISOString();
-    const logRow = `| ${ts} | ${update} |`;
-    return existing.replace(/(\| [^\n]+ \|)\s*$/, `$1\n${logRow}`);
+function getCurrentBranch(cwd) {
+    try {
+        return execSync("git rev-parse --abbrev-ref HEAD", { cwd, stdio: "pipe" }).toString().trim();
+    }
+    catch {
+        return "unknown-branch";
+    }
 }
 // ─────────────────────────────────────────────
 //  run_pre_pr_checks helpers
@@ -100,34 +57,29 @@ const CONSOLE_LOG_REGEX = [
 ];
 const HARDCODED_URL_PATTERN = /(?:https?:\/\/)?(?:\d{1,3}\.){3}\d{1,3}(?::\d+)?|(?:uat|prod|staging|preprod)\.[a-z0-9.-]+\.[a-z]{2,}/gi;
 function walkDir(dir, exts) {
-    const results = [];
-    if (!fs.existsSync(dir))
-        return results;
-    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
-        const full = path.join(dir, entry.name);
-        if (entry.isDirectory()) {
-            if (["node_modules", ".git", "dist", "build", "target", ".idea"].includes(entry.name))
+    let results = [];
+    try {
+        const list = fs.readdirSync(dir);
+        for (const file of list) {
+            if (file === "node_modules" || file === ".git" || file === "dist" || file === "target")
                 continue;
-            results.push(...walkDir(full, exts));
-        }
-        else if (exts.some((e) => entry.name.endsWith(e))) {
-            results.push(full);
+            const filePath = path.join(dir, file);
+            const stat = fs.statSync(filePath);
+            if (stat && stat.isDirectory()) {
+                results = results.concat(walkDir(filePath, exts));
+            }
+            else {
+                if (exts.some(ext => file.endsWith(ext))) {
+                    results.push(filePath);
+                }
+            }
         }
     }
+    catch (e) {
+        /* ignore */
+    }
     return results;
 }
-function checkSpecFile() {
-    const content = readFileSafe(resolve(SPEC_FILE));
-    if (!content)
-        return { unchecked: [], missing: true };
-    const unchecked = [];
-    for (const line of content.split("\n")) {
-        const match = line.match(/^- \[ \] (.+)/);
-        if (match)
-            unchecked.push(match[1].trim());
-    }
-    return { unchecked, missing: false };
-}
 // ── AST-level linting via ESLint (preferred over regex for JS/TS) ─────────────
 function runEslint(rootDir) {
     // Check if ESLint is configured in the project
@@ -246,6 +198,31 @@ function findProjectRoots(dir, depth = 0) {
     }
     return [...new Set(roots)];
 }
+// ── Automated Tenant Isolation Scanner ────────────────────────────────────────
+function checkTenantIsolation(rootDir) {
+    const violations = [];
+    const files = walkDir(rootDir, [".java"]).filter(f => f.endsWith("Repository.java"));
+    const queryMethodRegex = /\b(?:find|get|read|query|search|stream|count|exists|delete|remove)(?:All)?By[A-Z0-9]/;
+    const atQueryRegex = /@Query\s*\(/;
+    for (const file of files) {
+        const content = readFileSafe(file);
+        if (!content)
+            continue;
+        const lines = content.split("\n");
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i];
+            if (queryMethodRegex.test(line) || atQueryRegex.test(line)) {
+                // Look at current line and the next to handle simple wrapping
+                const combinedContext = line + (lines[i + 1] || "");
+                if (!/tenant/i.test(combinedContext)) {
+                    violations.push(`Missing tenant isolation in ${path.relative(rootDir, file)}:${i + 1} — query lacks 'tenantId':\n` +
+                        `      ${line.trim()}`);
+                }
+            }
+        }
+    }
+    return violations;
+}
 function checkFlywayMigrations(rootDir) {
     const warnings = [];
     const javaFiles = walkDir(rootDir, [".java"]);
@@ -279,128 +256,113 @@ const server = new McpServer({
     name: "secufusion-mcp",
     version: "1.0.0",
 });
-// ─── Tool 1: manage_feature_spec ─────────────────────────────────────────────
-server.tool("manage_feature_spec", "Create or update the .current-task-spec.md blueprint for the current feature. " +
-    "Use this during the Planning and Execution phases. " +
-    "Works for both single-repo and cross-repo workspace tasks.", {
+// ─── Tool 1: manage_branch_state ─────────────────────────────────────────────
+server.tool("manage_branch_state", "Manage the structured JSON state for the current Git branch. Use to initialize new tasks, track pending/completed ACs, and leave explicit next steps for resuming.", {
+    action: z
+        .enum(["initialize", "read", "update"])
+        .describe("Action to perform on the branch state."),
     task_description: z
         .string()
         .optional()
-        .describe("Full description of the new feature/task (used when creating a spec from scratch)."),
-    update_content: z
+        .describe("Used with 'initialize' to describe the task."),
+    reference_file_path: z
         .string()
         .optional()
-        .describe("Partial markdown update / session-log entry to merge into the existing spec. " +
-        "Use to tick checkboxes: replace '- [ ] AC-1' with '- [x] AC-1'."),
-    work_item_id: z
-        .string()
+        .describe("Used with 'initialize' to note a reference file."),
+    pending_acs: z
+        .array(z.string())
         .optional()
-        .describe("Azure DevOps work item ID to embed in the spec header."),
-    reference_file_path: z
+        .describe("Array of ACs. Used with 'initialize' or 'update' to set pending tasks."),
+    completed_acs: z
+        .array(z.string())
+        .optional()
+        .describe("Array of completed ACs. Used with 'update'."),
+    next_step: z
         .string()
         .optional()
-        .describe("Absolute or cwd-relative path to an existing source file whose coding patterns should " +
-        "be embedded as a reference snippet in the new spec."),
-    action: z
-        .enum(["create", "update", "read"])
-        .default("create")
-        .describe("'create' generates a new spec (overwrites if one exists), " +
-        "'update' patches the existing spec, " +
-        "'read' returns the current spec content without modification."),
-}, async ({ task_description, update_content, work_item_id, reference_file_path, action }) => {
-    const specPath = resolve(SPEC_FILE);
-    if (action === "read") {
-        const content = readFileSafe(specPath);
-        if (!content) {
-            return {
-                content: [
-                    {
-                        type: "text",
-                        text: `No spec file found at ${SPEC_FILE}. Run with action='create' to generate one.`,
-                    },
-                ],
-            };
+        .describe("Explicit actionable instruction for resuming. Required for 'update'."),
+}, async ({ action, task_description, reference_file_path, pending_acs, completed_acs, next_step }) => {
+    const cwd = process.cwd();
+    const branch = getCurrentBranch(cwd);
+    const statePath = path.resolve(STATE_FILE);
+    let state = {};
+    if (fs.existsSync(statePath)) {
+        try {
+            state = JSON.parse(readFileSafe(statePath) || "{}");
+        }
+        catch {
+            state = {};
         }
-        return { content: [{ type: "text", text: content }] };
     }
-    if (action === "create") {
-        if (!task_description) {
+    if (action === "read") {
+        const branchState = state[branch];
+        if (!branchState) {
             return {
                 content: [
                     {
                         type: "text",
-                        text: "ERROR: `task_description` is required when action='create'.",
+                        text: `No state found for branch '${branch}'. Please initialize first.`,
                     },
                 ],
-                isError: true,
             };
         }
-        let refSnippet = null;
-        if (reference_file_path) {
-            refSnippet = readFileSafe(path.isAbsolute(reference_file_path)
-                ? reference_file_path
-                : resolve(reference_file_path));
-        }
-        const spec = buildInitialSpec(task_description, work_item_id, refSnippet);
-        writeFile(specPath, spec);
+        return {
+            content: [{ type: "text", text: JSON.stringify(branchState, null, 2) }],
+        };
+    }
+    if (action === "initialize") {
+        state[branch] = {
+            task_description: task_description || "",
+            reference_file_path: reference_file_path || "",
+            pending_acs: pending_acs || [],
+            completed_acs: [],
+            next_step: "Review requirements and begin implementation.",
+            last_updated: new Date().toISOString()
+        };
+        writeFile(statePath, JSON.stringify(state, null, 2));
         return {
             content: [
                 {
                     type: "text",
-                    text: `✅ Spec created at \`${SPEC_FILE}\`.\n\n` +
-                        `Review and fill in the Acceptance Criteria before starting implementation.\n\n` +
-                        `---\n\n${spec}`,
+                    text: `✅ Branch state initialized for '${branch}'.\n\nState:\n${JSON.stringify(state[branch], null, 2)}`,
                 },
             ],
         };
     }
     if (action === "update") {
-        if (!update_content) {
+        if (!state[branch]) {
             return {
+                isError: true,
                 content: [
-                    {
-                        type: "text",
-                        text: "ERROR: `update_content` is required when action='update'.",
-                    },
+                    { type: "text", text: `No state found for branch '${branch}'. Initialize first.` },
                 ],
-                isError: true,
             };
         }
-        const existing = readFileSafe(specPath);
-        if (!existing) {
+        if (!next_step) {
             return {
+                isError: true,
                 content: [
-                    {
-                        type: "text",
-                        text: `ERROR: No spec file found at ${SPEC_FILE}. Create one first with action='create'.`,
-                    },
+                    { type: "text", text: "ERROR: 'next_step' is required when updating." },
                 ],
-                isError: true,
             };
         }
-        let updated = existing;
-        for (const line of update_content.split("\n")) {
-            const checkedMatch = line.match(/^- \[x\] (.+)/);
-            if (checkedMatch) {
-                const label = checkedMatch[1].trim().replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-                updated = updated.replace(new RegExp(`- \\[ \\] ${label}`, "g"), `- [x] ${checkedMatch[1].trim()}`);
-            }
-        }
-        updated = appendSessionLog(updated, update_content.replace(/\n/g, " ").slice(0, 120));
-        writeFile(specPath, updated);
+        if (pending_acs)
+            state[branch].pending_acs = pending_acs;
+        if (completed_acs)
+            state[branch].completed_acs = completed_acs;
+        state[branch].next_step = next_step;
+        state[branch].last_updated = new Date().toISOString();
+        writeFile(statePath, JSON.stringify(state, null, 2));
         return {
             content: [
                 {
                     type: "text",
-                    text: `✅ Spec updated at \`${SPEC_FILE}\`.\n\n---\n\n${updated}`,
+                    text: `✅ Branch state updated for '${branch}'. Next step recorded:\n> ${next_step}`,
                 },
             ],
         };
     }
-    return {
-        content: [{ type: "text", text: "Unknown action." }],
-        isError: true,
-    };
+    return { content: [{ type: "text", text: "Invalid action." }] };
 });
 // ─── Tool 2: log_rejected_pattern ────────────────────────────────────────────
 server.tool("log_rejected_pattern", "Record a coding pattern that was rejected by the team so it is never repeated. " +
@@ -464,9 +426,9 @@ server.tool("log_rejected_pattern", "Record a coding pattern that was rejected b
 });
 // ─── Tool 3: run_pre_pr_checks ───────────────────────────────────────────────
 server.tool("run_pre_pr_checks", "Run all SecuFusion pre-PR guardrail checks across the workspace. " +
-    "Automatically discovers modified microservices and runs their native linters (ESLint, Maven Checkstyle). " +
-    "Also validates: spec checkboxes, hardcoded IPs/URLs, and Flyway migration coverage for JPA entities. " +
-    "Linter errors must be fixed natively — do not suppress warnings to pass the gate. " +
+    "Automatically discovers modified microservices and runs native linters, database script checks, and strict tenant-isolation scanners. " +
+    "Validates: spec checkboxes, hardcoded IPs/URLs, tenantId in Repositories, and Flyway migration coverage for JPA entities. " +
+    "Linter/isolation errors must be fixed natively — do not suppress warnings to pass the gate. " +
     "MUST pass with zero errors before a PR is raised.", {
     work_item_id: z
         .string()
@@ -479,6 +441,7 @@ server.tool("run_pre_pr_checks", "Run all SecuFusion pre-PR guardrail checks acr
         .array(z.enum([
         "spec_boxes",
         "console_logs",
+        "tenant_isolation",
         "hardcoded_urls",
         "flyway_migrations",
     ]))
@@ -489,23 +452,32 @@ server.tool("run_pre_pr_checks", "Run all SecuFusion pre-PR guardrail checks acr
     const errors = [];
     const warnings = [];
     const passed = [];
-    // ── 1. Spec checkbox check ─────────────────────────────────────────────
+    // ── 1. Branch state check ─────────────────────────────────────────────
     if (!skip_checks.includes("spec_boxes")) {
-        const { unchecked, missing } = checkSpecFile();
-        if (missing) {
-            errors.push(`❌ [SPEC] No \`.current-task-spec.md\` found. ` +
-                `Call \`manage_feature_spec\` with action='create' before raising a PR.`);
+        const branch = getCurrentBranch(scanRoot);
+        const statePath = path.resolve(scanRoot, STATE_FILE);
+        let branchState = null;
+        if (fs.existsSync(statePath)) {
+            try {
+                const stateData = JSON.parse(readFileSafe(statePath) || "{}");
+                branchState = stateData[branch];
+            }
+            catch { }
+        }
+        if (!branchState) {
+            errors.push(`❌ [STATE] No branch state found for '${branch}' in \`${STATE_FILE}\`. ` +
+                `Call \`manage_branch_state\` with action='initialize' before raising a PR.`);
         }
-        else if (unchecked.length > 0) {
-            errors.push(`❌ [SPEC] ${unchecked.length} unchecked item(s) in the spec:\n` +
-                unchecked.map((u) => `   • ${u}`).join("\n"));
+        else if (branchState.pending_acs && branchState.pending_acs.length > 0) {
+            errors.push(`❌ [STATE] ${branchState.pending_acs.length} pending AC(s) remain for branch '${branch}':\n` +
+                branchState.pending_acs.map((u) => `   • ${u}`).join("\n"));
         }
         else {
-            passed.push("✅ [SPEC] All spec checkboxes are checked.");
+            passed.push(`✅ [STATE] Branch state for '${branch}' is clear (no pending ACs).`);
         }
     }
     else {
-        warnings.push("⚠️  [SPEC] Spec checkbox check SKIPPED (manually bypassed).");
+        warnings.push("⚠️  [STATE] Branch state check SKIPPED (manually bypassed).");
     }
     // ── 2. AST-level linting (Workspace Discovery → ESLint/Checkstyle → regex fallback)
     if (!skip_checks.includes("console_logs")) {
@@ -556,7 +528,21 @@ server.tool("run_pre_pr_checks", "Run all SecuFusion pre-PR guardrail checks acr
     else {
         warnings.push("⚠️  [LINTING] Linter check SKIPPED (manually bypassed).");
     }
-    // ── 3. Hardcoded URL check (regex — no AST equivalent needed here) ───────
+    // ── 3. Tenant Isolation Scanner ──────────────────────────────────────────
+    if (!skip_checks.includes("tenant_isolation")) {
+        const tenantViolations = checkTenantIsolation(scanRoot);
+        if (tenantViolations.length > 0) {
+            errors.push(`❌ [SECURITY] Tenant Isolation Failed: Found ${tenantViolations.length} query method(s) in *Repository.java without tenant scoping:\n` +
+                tenantViolations.map((v) => `   • ${v}`).join("\n"));
+        }
+        else {
+            passed.push("✅ [SECURITY] Tenant isolation active: All database queries correctly scoped with tenantId.");
+        }
+    }
+    else {
+        warnings.push("⚠️  [SECURITY] Tenant isolation check SKIPPED (manually bypassed).");
+    }
+    // ── 4. Hardcoded URL check (regex) ───────────────────────────────────────
     if (!skip_checks.includes("hardcoded_urls")) {
         const urlViolations = checkHardcodedUrls(scanRoot);
         if (urlViolations.length > 0) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "secufusion-mcp",
-  "version": "1.0.5",
+  "version": "1.0.7",
   "type": "module",
   "description": "SecuFusion MCP server - developer workflow tooling with guardrails",
   "main": "index.js",