secufusion-mcp 1.0.51 → 1.0.52

package/README.md

@@ -22,6 +22,7 @@
 | `manage_branch_state` | Legacy — Branch State | Backward-compatible branch-scoped JSON state tracker (for tasks before `manage_task`) |
 | `log_rejected_pattern` | **Phase 3** — Course Correction | Records bad patterns to `.rejected-patterns.json` so they are never repeated |
 | `generate_ado_comments` | **Phase 4** — PR Handoff | Generates distinct Layman and Technical Deep-Dive summaries for the Azure DevOps board |
+| `run_pre_pr_checks_with_reviewer_agent` | **Phase 4** — PR Handoff | **NEW** — Unified 3-tier PR gate. Runs mechanical checks, AI file reviews, and context-aware task evaluation in a single pass. |
 | `get_secufusion_rules` | **Setup** | Returns the `AGENTS.md` rules for AI clients that don't natively support MCP Resources |
 | `classify_task` | **Phase 0.5** — Task Classification | **NEW** — Deep multi-pass analysis engine. Classifies any task as `BACKEND_ONLY`, `FRONTEND_ONLY`, `FULL_STACK`, or `EXTENSION_ONLY` based on root cause (where the fix lives), not surface symptoms. Must be the first tool called on any task. |
 
@@ -425,8 +426,9 @@ These rules are enforced automatically — the AI will never violate them:
 │  Phase 3     │  log_rejected_pattern                                          │
 │  Correction  │  → Record mistakes permanently to avoid repeat                │
 ├──────────────┼──────────────────────────────────────────────────────────────┤
-│  Phase 4     │  manage_task (action=complete) → pr-summary.md generated      │
-│  PR Handoff  │  generate_ado_comments → Layman + Technical Deep-Dive for ADO │
+│  Phase 4     │  run_pre_pr_checks_with_reviewer_agent                        │
+│  PR Handoff  │  → manage_task (action=complete) → pr-summary.md generated    │
+│              │  → generate_ado_comments → Layman & Technical Deep-Dive (ADO) │
 └──────────────┴──────────────────────────────────────────────────────────────┘
 ```
 
@@ -643,7 +645,8 @@ Phase 1: search_tasks (always) → get_task_history → manage_task initialize
       ↓
 Phase 2: code + log_file_touched + log_decision + add_scenario (ALL mandatory)
       ↓
-Phase 4: manage_task complete  →  pr-summary.md generated
+Phase 4: run_pre_pr_checks_with_reviewer_agent → APPROVED / DISCUSS
+       → manage_task complete  →  pr-summary.md generated
        → generate_ado_comments  →  Layman + Technical Deep-Dive for ADO board
 ```
 
@@ -807,7 +810,7 @@ Proceeding to plan presentation. No developer confirmation needed.
 | **Phase 1 (Planning)** | `"Call search_tasks if relevant"` | `search_tasks` is **unconditional** — STEP 1 always, even if "sure" there's no prior work |
 | **Phase 2 (Execution)** | Bullet suggestions | MANDATORY code block for all 4 tool calls + `next_step` contract with explicit VIOLATION labels |
 | **Phase 3 (Correction)** | `"Immediately call log_rejected_pattern"` | Explicit STEP 1/2/3 + ❌ list — log immediately, not end of session |
-| **Phase 4 (PR Handoff)** | `"Call complete → run checks → fix if error"` | Explicit STEP 1-4 **fix → recheck loop** until ZERO errors |
+| **Phase 4 (PR Handoff)** | `"Call complete → run checks → fix if error"` | Explicit STEP 1-3 **fix → recheck loop** until ZERO errors (Unified 3-tier check) |
 | **Guardrails** | Mixed soft/hard language | All `should` → `MUST`, all `avoid` → `FORBIDDEN`, linter errors explicitly blocking |
 | **Cross-Task Intelligence** | Prose bullets | MANDATORY STEP 1-4 sequence + ❌ list |
 

package/index.js

@@ -55,6 +55,22 @@ function readFileSafe(filePath) {
         return null;
     }
 }
+function loadProjectSpec(wsRoot) {
+    const SPEC_FILE = ".secufusion-project-spec.json";
+    const candidates = [
+        path.resolve(path.dirname(new URL(import.meta.url).pathname.replace(/^\/([A-Z]:)/, "$1")), SPEC_FILE),
+        path.resolve(wsRoot, SPEC_FILE),
+    ];
+    for (const c of candidates) {
+        if (fs.existsSync(c)) {
+            try {
+                return JSON.parse(readFileSafe(c) || "null");
+            }
+            catch { }
+        }
+    }
+    return null;
+}
 function writeFile(filePath, content) {
     fs.mkdirSync(path.dirname(filePath), { recursive: true });
     fs.writeFileSync(filePath, content, "utf-8");
@@ -2149,6 +2165,7 @@ server.tool("score_change_risk", "Quantifies the risk of a planned change BEFORE
     })).describe("List of all planned file changes from the implementation plan."),
 }, async ({ work_item_id, planned_changes }) => {
     const inputChars = JSON.stringify({ work_item_id, planned_changes }).length;
+    const projectSpec = loadProjectSpec(getWorkspaceRoot()); // DNA Loaded to prevent hallucinations
     const corpus = planned_changes.map(c => c.description + " " + c.file).join(" ").toLowerCase();
     // ── 6-category scoring matrix ──────────────────────────────────────────
     let tenantScore = 0;
@@ -2432,6 +2449,7 @@ server.tool("suggest_test_scenarios", "Auto-generates a complete test plan from
     task_type: z.enum(["bug", "user_story", "feature", "hotfix", "refactor", "chore"]).default("user_story"),
 }, async ({ work_item_id, acceptance_criteria, service_name, task_type }) => {
     const inputChars = JSON.stringify({ work_item_id, acceptance_criteria, service_name, task_type }).length;
+    const projectSpec = loadProjectSpec(getWorkspaceRoot()); // DNA Loaded to prevent hallucinations
     // ── Generate test scenarios from ACs ──────────────────────────────────
     const unitTests = [];
     const integrationTests = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "secufusion-mcp",
-  "version": "1.0.51",
+  "version": "1.0.52",
   "type": "module",
   "description": "SecuFusion MCP server - developer workflow tooling with guardrails",
   "main": "index.js",