secufusion-mcp 1.0.53 → 1.0.56

package/AGENTS.md

@@ -237,23 +237,15 @@ Coordination required before proceeding.
 If zero breaking changes: → Note "No breaking changes detected" → proceed normally.
 
 ---
-### Suggested title in comments
-
-When validation found title_accurate: false —
-even if developer said YES to proceed —
-in EVERY file created or modified for this task,
-add this comment at the top of the class:
-
-Java files:
-/**
- * {work_item_id} — {suggested_title}
- *
- * Note: Azure work item title may be misleading.
- * This file was created for: {suggested_title_reason}
- */
-
-This ensures codebase comments reflect reality
-even when Azure ticket title is wrong.
+### NO TICKET IDS IN CODE COMMENTS (STRICT RULE)
+
+Work item IDs (e.g. "WI-1097", "BUG-1173") must **NEVER** appear inside code comments, javadoc, or JS comments across repos and services.
+Comments should explain the durable WHY (what the code does and why it exists), not point back to a ticket that rots as the codebase evolves and the ticket gets closed/renumbered.
+The ONLY acceptable places for a work item id are:
+- File/folder naming (e.g. `.secufusion/tasks/1097-...`)
+- Git branch names
+- Commit references
+Never inline in comments describing the code itself.
 ---
 
 ---

package/README.md

@@ -697,6 +697,12 @@ As of version **1.0.50**, the MCP server strictly enforces **Rule 0** and adds i
 - **Frontend Service Resolution**: `get_service` now intelligently resolves frontend and extension repositories (like `sfn-web-ui`) even when they aren't explicitly keyed as backend microservices.
 - **Explicit AC Recognition**: `classify_task` now overrides `VAGUE` completeness warnings if it detects explicit Acceptance Criteria in the task description.
 
+### Strict Comment Guardrails & Slugification Fixes (v1.0.55+)
+
+As of version **1.0.55**, the MCP server introduces two new quality-of-life and enforcement updates:
+- **No Ticket IDs in Comments**: A strict rule has been added to `AGENTS.md` and the Tier 2 AI Reviewer now explicitly flags any inline ticket IDs (e.g., `// WI-1097`) inside code comments as a CRITICAL violation. Comments must explain the durable WHY, not point to decaying tracking tickets.
+- **Clean Task Slugs**: `manage_task initialize` now automatically strips leading ticket prefixes (like `BUG-1173: `) from the title before generating the folder slug, preventing duplicated IDs in the folder path (e.g., no more `1173-bug-1173-`).
+
 ---
 
 ## Talking to the AI — What You'll Ever Say

package/index.js

@@ -511,7 +511,9 @@ function resolveTaskFolder(workItemId, tasksRoot, registryData) {
     return null;
 }
 function generateNewTaskFolder(workItemId, title, tasksRoot) {
-    const slug = title.toLowerCase()
+    // Strip potential leading ID prefix like "BUG-1173: " or "BUG-1173 " or "WI-1173: "
+    const strippedTitle = title.replace(/^[a-zA-Z]+-\d+[:\s]*/i, '');
+    const slug = strippedTitle.toLowerCase()
         .replace(/[:\s]+/g, '-')
         .replace(/[^a-z0-9-]+/g, '')
         .replace(/-+/g, '-')
@@ -2969,6 +2971,14 @@ server.tool("run_pre_pr_checks_with_reviewer_agent", "Unified, single-call PR re
                     detail: "Comments explain WHY, not WHAT. Remove or replace with architectural rationale.",
                     action: "Replace // Get the user with // Required because tenant context is not available in JWT claims" });
             }
+            // Work Item IDs in comments
+            const ticketIdComments = f.lines.map((l, i) => ({ l, i })).filter(({ l }) => /(\/\/|\/\*|\*)\s*.*(?:BUG|WI)-\d+/i.test(l));
+            if (ticketIdComments.length > 0) {
+                reviewComments.push({ tier: 2, file: f.file_path, line: ticketIdComments[0].i + 1, severity: "CRITICAL", area: "CODE_QUALITY",
+                    title: "Ticket ID in code comment",
+                    detail: `Line ${ticketIdComments[0].i + 1} contains a work item ID: \`${ticketIdComments[0].l.trim()}\``,
+                    action: "Remove the ticket ID. Explain the durable WHY instead." });
+            }
             // Hardcoded URLs/IPs
             const hardcoded = f.lines.map((l, i) => ({ l, i })).filter(({ l }) => /https?:\/\/[0-9]{1,3}\.[0-9]{1,3}|localhost:[0-9]{4}|uat\.|staging\.|prod\./i.test(l) && !/\/\//.test(l));
             if (hardcoded.length > 0) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "secufusion-mcp",
-  "version": "1.0.53",
+  "version": "1.0.56",
   "type": "module",
   "description": "SecuFusion MCP server - developer workflow tooling with guardrails",
   "main": "index.js",