secufusion-mcp 1.0.52 → 1.0.55

package/AGENTS.md

@@ -53,7 +53,7 @@ You are NOW allowed to reason about the task. Not before.
 
 ### Why this is non-negotiable
 
-`classify_task` does a background scan of the project spec JSON file, but the **AI agent itself** must independently load the spec into its own active context. The background scan is not a substitute. Without this step, the agent:
+`classify_task`, `run_pre_pr_checks_with_reviewer_agent`, and every other analytical tool performs a background scan of the project spec JSON file, but the **AI agent itself** must independently load the spec into its own active context. The background scan is not a substitute. Without this step, the agent:
 - Cannot accurately reason about service boundaries
 - Cannot validate task scope against architecture
 - Cannot enforce golden rules during classification
@@ -237,23 +237,15 @@ Coordination required before proceeding.
 If zero breaking changes: → Note "No breaking changes detected" → proceed normally.
 
 ---
-### Suggested title in comments
-
-When validation found title_accurate: false —
-even if developer said YES to proceed —
-in EVERY file created or modified for this task,
-add this comment at the top of the class:
-
-Java files:
-/**
- * {work_item_id} — {suggested_title}
- *
- * Note: Azure work item title may be misleading.
- * This file was created for: {suggested_title_reason}
- */
-
-This ensures codebase comments reflect reality
-even when Azure ticket title is wrong.
+### NO TICKET IDS IN CODE COMMENTS (STRICT RULE)
+
+Work item IDs (e.g. "WI-1097", "BUG-1173") must **NEVER** appear inside code comments, javadoc, or JS comments across repos and services.
+Comments should explain the durable WHY (what the code does and why it exists), not point back to a ticket that rots as the codebase evolves and the ticket gets closed/renumbered.
+The ONLY acceptable places for a work item id are:
+- File/folder naming (e.g. `.secufusion/tasks/1097-...`)
+- Git branch names
+- Commit references
+Never inline in comments describing the code itself.
 ---
 
 ---

package/index.js

@@ -511,7 +511,9 @@ function resolveTaskFolder(workItemId, tasksRoot, registryData) {
     return null;
 }
 function generateNewTaskFolder(workItemId, title, tasksRoot) {
-    const slug = title.toLowerCase()
+    // Strip potential leading ID prefix like "BUG-1173: " or "BUG-1173 " or "WI-1173: "
+    const strippedTitle = title.replace(/^[a-zA-Z]+-\d+[:\s]*/i, '');
+    const slug = strippedTitle.toLowerCase()
         .replace(/[:\s]+/g, '-')
         .replace(/[^a-z0-9-]+/g, '')
         .replace(/-+/g, '-')
@@ -2969,6 +2971,14 @@ server.tool("run_pre_pr_checks_with_reviewer_agent", "Unified, single-call PR re
                     detail: "Comments explain WHY, not WHAT. Remove or replace with architectural rationale.",
                     action: "Replace // Get the user with // Required because tenant context is not available in JWT claims" });
             }
+            // Work Item IDs in comments
+            const ticketIdComments = f.lines.map((l, i) => ({ l, i })).filter(({ l }) => /(\/\/|\/\*|\*)\s*.*(?:BUG|WI)-\d+/i.test(l));
+            if (ticketIdComments.length > 0) {
+                reviewComments.push({ tier: 2, file: f.file_path, line: ticketIdComments[0].i + 1, severity: "CRITICAL", area: "CODE_QUALITY",
+                    title: "Ticket ID in code comment",
+                    detail: `Line ${ticketIdComments[0].i + 1} contains a work item ID: \`${ticketIdComments[0].l.trim()}\``,
+                    action: "Remove the ticket ID. Explain the durable WHY instead." });
+            }
             // Hardcoded URLs/IPs
             const hardcoded = f.lines.map((l, i) => ({ l, i })).filter(({ l }) => /https?:\/\/[0-9]{1,3}\.[0-9]{1,3}|localhost:[0-9]{4}|uat\.|staging\.|prod\./i.test(l) && !/\/\//.test(l));
             if (hardcoded.length > 0) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "secufusion-mcp",
-  "version": "1.0.52",
+  "version": "1.0.55",
   "type": "module",
   "description": "SecuFusion MCP server - developer workflow tooling with guardrails",
   "main": "index.js",