secufusion-mcp 1.0.56 → 1.0.58

package/AGENTS.md

@@ -485,10 +485,12 @@ STEP 2: call manage_task(action: "complete", work_item_id: <id>)
         — Only permitted after APPROVED or DISCUSS verdict
         — Marks status complete, auto-generates pr-summary.md
 
-STEP 3: call generate_ado_comments(work_item_id, layman_summary, technical_deep_dive)
-        — Generates two ADO board comments:
-          1. Layman Summary: non-technical explanation of business value
-          2. Technical Deep-Dive: architectural changes and implementation details
+STEP 3: Generate and save PR & ADO Documents manually
+        — Read files-touched.json, decisions.json, and scenarios.json from the task folder
+        — Generate ado-comments.md and pr-comment.md inside .secufusion/tasks/{id}-{slug}/
+        — Follow the strict templates and guardrails defined in the [Document Generation Protocol] section
+        — Present the documents to the developer for review
+        — call manage_task(action: "log_decision", decision: "ADO comments and PR comment generated")
 ```
 
 ### Hard enforcement
@@ -717,3 +719,123 @@ Before Phase 0.7 plan presentation:
 ❌ Do NOT skip `get_task_history` if a match exists — "I remember it" is not a substitute  
 ❌ Do NOT re-solve a solved problem — task history exists precisely to prevent this  
 ❌ Re-using a rejected pattern found in task history is a violation even if you disagree with the rejection  
+
+## Document Generation Protocol
+(For Phase 4 — PR Handoff)
+
+### ADO Comments Template (`ado-comments.md`)
+**Audience:** Technical and Non-Technical stakeholders on the Azure DevOps board.
+**Format rules:**
+- Layman summary: NO class names, NO method names, NO technical terms. Pure English.
+- Technical deep-dive: BE specific. Exact class names, exact method names, exact file paths. Source from `files-touched.json`.
+- Tables must have content in every cell. If unknown → "not recorded".
+- Max 2 sentences in any single prose paragraph.
+- Max 600 words.
+
+```markdown
+## Layman Summary
+{layman_summary — 2-3 sentences max}
+
+## Technical Deep-Dive
+{If auth/permission gating exists:}
+> Both endpoints gated by `{permission}` authority.
+
+### Scenarios Handled
+**Happy path:**
+{happy_path from scenarios.json — one sentence}
+
+**Sad paths handled:**
+{for each sad_path in scenarios.json:}
+- {sad_path description} → {how handled}
+
+**Security cases:**
+{for each security_case in scenarios.json:}
+- {security concern} → {enforcement}
+
+### What did NOT change
+| Area | Status |
+|---|---|
+| DB migration | {✅ Not required / ⚠️ Created: V{n}__...sql} |
+| Kafka topics | {✅ No new topics / ⚠️ New topic: {name}} |
+| {other_service}-api | {✅ No changes / ⚠️ Changes required} |
+| API contract | {✅ No breaking changes / ⚠️ See decisions} |
+
+---
+*Generated by SecuFusion MCP · {service} · {work_item_id}*
+```
+
+### PR Comment Template (`pr-comment.md`)
+**Audience:** Busy Developer Reviewers reading the PR description.
+**Format rules:**
+- Group changes by WHAT changed, not by file name (e.g., "New endpoint: GET /path", "Test coverage: N scenarios").
+- ✅ for things NOT changing is equally important.
+- Guardrails section is mandatory.
+- Max 400 words. Condense changes table if longer.
+
+```markdown
+# {task_type_emoji} {work_item_id}: {title}
+
+> **Type:** {task_type_display} · **Service:** `{service}` · **Work Item:** [{work_item_id}]({devops_url}/{work_item_id})
+
+---
+## Summary
+{2-3 sentences MAX. What changed and why.}
+
+---
+## Changes
+| Area | What changed |
+|---|---|
+| {logical area} | {what changed in plain terms} |
+
+---
+## Affected Service
+- `{service-name}`
+
+---
+## Impact
+- ✅ No functional or behavioral changes {OR describe actual behavioral change}
+- ✅ No DB migration required {OR: ⚠️ Flyway migration V{n} included}
+- ✅ No Kafka topic changes {OR: ⚠️ New topic: {name}}
+- ✅ No API contract changes {OR: ⚠️ New endpoints: see Changes above}
+
+---
+## Scenarios
+**Happy path:** {happy_path one line}
+
+**Sad paths handled:**
+- {what fails} → {how handled}
+
+---
+## Guardrails
+- ✅ No `console.log` / `System.out.println` in source
+- ✅ No hardcoded UAT/Prod URLs or IPs
+- ✅ `tenantId` scoping maintained on all queries
+- ✅ No `@Entity` changes — Flyway not required
+- ✅ All pre-PR checks passed
+
+{if any rejected patterns were relevant:}
+**Patterns avoided:**
+- Rejected pattern #{id}: {short description}
+```
+
+### Task Type Emoji Map
+- bug → 🐛
+- user_story → 📖
+- feature → ✨
+- hotfix → 🚨
+- refactor → 🔄
+- chore → 🧹
+
+### Presentation Format
+When presenting to the developer, output this exactly:
+```text
+────────────────────────────────────────────────
+✅ Two documents generated for {work_item_id}:
+
+📄 ADO Comments  → paste into WI comment thread
+📄 PR Comment    → paste into PR description
+
+Review below. Say LGTM to confirm, or tell me what to change.
+────────────────────────────────────────────────
+```
+Then show the full `ado-comments.md` followed by a `────────────────────────────────` divider, followed by the full `pr-comment.md`.

package/index.js

@@ -3366,7 +3366,7 @@ server.tool("run_pre_pr_checks_with_reviewer_agent", "Unified, single-call PR re
     if (verdict === "✅ APPROVED") {
         out += `\n**Next steps:**\n`;
         out += `1. \`manage_task(action: "complete", work_item_id: "${work_item_id}")\`\n`;
-        out += `2. \`generate_ado_comments\` → paste into ADO board\n`;
+        out += `2. Generate PR and ADO documents manually using AGENTS.md rules\n`;
         out += `3. Raise the PR\n`;
     }
     else if (verdict === "❌ CHANGES_REQUESTED") {
@@ -4010,7 +4010,7 @@ server.tool("run_pre_pr_checks", "Full-spectrum PR review system — runs BEFORE
     if (verdict === "✅ APPROVED") {
         out += `\n**Next steps:**\n`;
         out += `1. Call \`manage_task(action: "complete", work_item_id: "${work_item_id}")\`\n`;
-        out += `2. Call \`generate_ado_comments\` to prepare ADO board comments\n`;
+        out += `2. Generate PR and ADO documents manually as per Phase 4\n`;
         out += `3. Raise the PR\n`;
     }
     else if (verdict === "❌ CHANGES_REQUESTED") {
@@ -4509,7 +4509,7 @@ server.tool("reviewer_agent", "Context-aware architectural review agent — call
     if (verdict === "✅ APPROVED") {
         out += `\n**Next steps:**\n`;
         out += `1. Call \`manage_task(action: "complete", work_item_id: "${work_item_id}")\`\n`;
-        out += `2. Call \`generate_ado_comments\` to prepare ADO board comments\n`;
+        out += `2. Generate PR and ADO documents manually as per Phase 4\n`;
         out += `3. Raise the PR\n`;
     }
     else if (verdict === "❌ CHANGES_REQUESTED") {
@@ -4563,31 +4563,5 @@ server.tool("get_secufusion_rules", "Fetches the mandatory AGENTS.md workflow ru
         content: [{ type: "text", text: content }]
     }, 0);
 });
-server.tool("generate_ado_comments", "Generates and formats the final Azure DevOps board comments for a completed task. Call this in Phase 4 after PR checks pass.", {
-    work_item_id: z.string().describe("Azure DevOps work item ID, e.g. 'BUG-1140'."),
-    layman_summary: z.string().describe("A short, fundamental, non-technical explanation of the business value and what was resolved."),
-    technical_deep_dive: z.string().describe("A comprehensive, highly technical breakdown of the architectural changes, core optimizations, and exact implementation details.")
-}, async ({ work_item_id, layman_summary, technical_deep_dive }) => {
-    const inputChars = JSON.stringify({ work_item_id, layman_summary, technical_deep_dive }).length;
-    let out = `## ADO Board Comments for ${work_item_id}\n\n`;
-    out += `Please paste the following two comments into the Azure DevOps board:\n\n`;
-    out += `### 1. Layman Summary\n`;
-    out += `\`\`\`text\n${layman_summary}\n\`\`\`\n\n`;
-    out += `### 2. Technical Deep-Dive\n`;
-    out += `\`\`\`text\n${technical_deep_dive}\n\`\`\`\n\n`;
-    try {
-        const classifDir = resolve(".secufusion/classifications");
-        if (!fs.existsSync(classifDir)) {
-            fs.mkdirSync(classifDir, { recursive: true });
-        }
-        const commentsFile = path.join(classifDir, `${work_item_id}-comments.json`);
-        writeFile(commentsFile, JSON.stringify({ layman_summary, technical_deep_dive, generated_at: new Date().toISOString() }, null, 2));
-        out += `✅ Comments persisted to \`.secufusion/classifications/${work_item_id}-comments.json\`\n`;
-    }
-    catch (e) {
-        // ignore
-    }
-    return appendTelemetry({ content: [{ type: "text", text: out }] }, inputChars);
-});
 const transport = new StdioServerTransport();
 await server.connect(transport);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "secufusion-mcp",
-  "version": "1.0.56",
+  "version": "1.0.58",
   "type": "module",
   "description": "SecuFusion MCP server - developer workflow tooling with guardrails",
   "main": "index.js",