secufusion-mcp 1.0.60 → 1.1.0

package/index.js

@@ -2794,6 +2794,7 @@ server.tool("run_pre_pr_checks_with_reviewer_agent", "Unified, single-call PR re
     // ══════════════════════════════════════════════════════════════════════
     // ── P1: TENANT_ISOLATION ──────────────────────────────────────────────
     const p1 = [];
+    const p1Suppressed = [];
     if (!skip_checks.includes("tenant_isolation")) {
         for (const f of fileRecords.filter(f => f.isRepo)) {
             const queryAnnotationLines = [];
@@ -2804,23 +2805,69 @@ server.tool("run_pre_pr_checks_with_reviewer_agent", "Unified, single-call PR re
             f.lines.forEach((line, idx) => {
                 const dm = line.match(/(?:find|delete|count|exists)\w+By(\w+)/);
                 if (dm && !dm[1].toLowerCase().includes("tenant")) {
-                    p1.push({ check: "TENANT_ISOLATION", severity: "BLOCKING", file: f.file_path, line: idx + 1,
-                        message: `Derived query \`${line.trim()}\` does not filter by tenantId`,
-                        suggestion: "Rename to include AndTenantId, e.g. findByIdAndTenantId(UUID id, UUID tenantId)" });
+                    let suppressionReason = "";
+                    for (let i = Math.max(0, idx - 5); i < idx; i++) {
+                        const match = f.lines[i].match(/@TenantScopeException\s*\(\s*"([^"]+)"\s*\)/i);
+                        if (match)
+                            suppressionReason = match[1];
+                    }
+                    if (suppressionReason) {
+                        p1Suppressed.push({ file: f.file_path, line: idx + 1, reason: suppressionReason, method: dm[0] });
+                    }
+                    else {
+                        p1.push({ check: "TENANT_ISOLATION", severity: "BLOCKING", file: f.file_path, line: idx + 1,
+                            message: `Derived query \`${line.trim()}\` does not filter by tenantId`,
+                            suggestion: "Rename to include AndTenantId, e.g. findByIdAndTenantId(UUID id, UUID tenantId)" });
+                    }
                 }
             });
             queryAnnotationLines.forEach(ai => {
                 const block = f.lines.slice(ai, ai + 5).join(" ");
                 if (!/tenantId|tenant_id|:tenantId/i.test(block)) {
-                    p1.push({ check: "TENANT_ISOLATION", severity: "BLOCKING", file: f.file_path, line: ai + 1,
-                        message: `@Query at line ${ai + 1} has no tenantId filter`,
-                        suggestion: "Add WHERE e.tenantId = :tenantId to the JPQL/SQL query" });
+                    let suppressionReason = "";
+                    for (let i = Math.max(0, ai - 5); i < ai; i++) {
+                        const match = f.lines[i].match(/@TenantScopeException\s*\(\s*"([^"]+)"\s*\)/i);
+                        if (match)
+                            suppressionReason = match[1];
+                    }
+                    if (suppressionReason) {
+                        p1Suppressed.push({ file: f.file_path, line: ai + 1, reason: suppressionReason, method: "@Query method" });
+                    }
+                    else {
+                        p1.push({ check: "TENANT_ISOLATION", severity: "BLOCKING", file: f.file_path, line: ai + 1,
+                            message: `@Query at line ${ai + 1} has no tenantId filter`,
+                            suggestion: "Add WHERE e.tenantId = :tenantId to the JPQL/SQL query" });
+                    }
                 }
             });
         }
     }
     mechanical.push(...p1);
-    passResults.push({ name: "TENANT_ISOLATION", skipped: skip_checks.includes("tenant_isolation"), passed: p1.length === 0, count: p1.length });
+    passResults.push({ name: "TENANT_ISOLATION", skipped: skip_checks.includes("tenant_isolation"), passed: p1.length === 0, count: p1.length, suppressedCount: p1Suppressed.length });
+    // Auto-log suppressions to decisions.json
+    if (p1Suppressed.length > 0) {
+        const tasksRoot = resolve(TASKS_DIR);
+        const dir = resolveTaskFolder(work_item_id, tasksRoot);
+        if (dir) {
+            const decisionsPath = path.join(dir, "decisions.json");
+            const decisions = readJson(decisionsPath) || [];
+            let modified = false;
+            for (const sup of p1Suppressed) {
+                const desc = `Exempted TENANT_ISOLATION on ${sup.method}`;
+                if (!decisions.some(d => d.decision === desc)) {
+                    decisions.push({
+                        id: decisions.length + 1,
+                        decision: desc,
+                        rationale: sup.reason,
+                        logged_at: new Date().toISOString()
+                    });
+                    modified = true;
+                }
+            }
+            if (modified)
+                writeFile(decisionsPath, JSON.stringify(decisions, null, 2));
+        }
+    }
     // ── P2: N_PLUS_ONE ────────────────────────────────────────────────────
     const p2 = [];
     if (!skip_checks.includes("n_plus_one")) {
@@ -3278,7 +3325,8 @@ server.tool("run_pre_pr_checks_with_reviewer_agent", "Unified, single-call PR re
     for (let i = 0; i < passResults.length; i++) {
         const p = passResults[i];
         const icon = p.skipped ? "⏭️ SKIP" : p.passed ? "✅ PASS" : "❌ FAIL";
-        out += `| P${i + 1} | ${p.name} | ${icon} | ${p.skipped ? "—" : p.count} |\n`;
+        const issueText = p.skipped ? "—" : (p.suppressedCount ? `${p.count} (${p.suppressedCount} suppressed)` : `${p.count}`);
+        out += `| P${i + 1} | ${p.name} | ${icon} | ${issueText} |\n`;
     }
     if (blockingMechanical.length > 0) {
         out += `\n#### ❌ Blocking Mechanical Findings\n`;
@@ -3287,6 +3335,13 @@ server.tool("run_pre_pr_checks_with_reviewer_agent", "Unified, single-call PR re
             out += `> ${f.message}\n> 💡 *${f.suggestion}*\n`;
         }
     }
+    if (p1Suppressed.length > 0) {
+        out += `\n#### 🛡️ Suppressed Findings (${p1Suppressed.length})\n`;
+        for (const sup of p1Suppressed) {
+            out += `\n**[TENANT_ISOLATION]** \`${sup.file}\` line ${sup.line}\n`;
+            out += `> Suppressed — ${sup.reason}\n`;
+        }
+    }
     const warnings1 = mechanical.filter(f => f.severity === "WARNING");
     if (warnings1.length > 0) {
         out += `\n#### ⚠️ Warnings\n`;
@@ -3487,6 +3542,7 @@ server.tool("run_pre_pr_checks", "Full-spectrum PR review system — runs BEFORE
     // Rule: every Repository method must filter by tenantId
     // ══════════════════════════════════════════════════════════════════════
     const p1Findings = [];
+    const p1Suppressed = [];
     if (!skip_checks.includes("tenant_isolation")) {
         for (const f of fileRecords.filter(f => f.isRepo)) {
             // Find method signatures in repository interface/class
@@ -3502,14 +3558,25 @@ server.tool("run_pre_pr_checks", "Full-spectrum PR review system — runs BEFORE
                 if (derivedMatch) {
                     const byClause = derivedMatch[1].toLowerCase();
                     if (!byClause.includes("tenantid") && !byClause.includes("tenant")) {
-                        p1Findings.push({
-                            check: "TENANT_ISOLATION",
-                            severity: "BLOCKING",
-                            file: f.file_path,
-                            line: idx + 1,
-                            message: `Derived query \`${line.trim()}\` does not filter by tenantId`,
-                            suggestion: "Rename to include AndTenantId: e.g. findByIdAndTenantId(UUID id, UUID tenantId)",
-                        });
+                        let suppressionReason = "";
+                        for (let i = Math.max(0, idx - 5); i < idx; i++) {
+                            const match = f.lines[i].match(/@TenantScopeException\s*\(\s*"([^"]+)"\s*\)/i);
+                            if (match)
+                                suppressionReason = match[1];
+                        }
+                        if (suppressionReason) {
+                            p1Suppressed.push({ file: f.file_path, line: idx + 1, reason: suppressionReason, method: derivedMatch[0] });
+                        }
+                        else {
+                            p1Findings.push({
+                                check: "TENANT_ISOLATION",
+                                severity: "BLOCKING",
+                                file: f.file_path,
+                                line: idx + 1,
+                                message: `Derived query \`${line.trim()}\` does not filter by tenantId`,
+                                suggestion: "Rename to include AndTenantId: e.g. findByIdAndTenantId(UUID id, UUID tenantId)",
+                            });
+                        }
                     }
                 }
             });
@@ -3518,20 +3585,55 @@ server.tool("run_pre_pr_checks", "Full-spectrum PR review system — runs BEFORE
                 // Look at this line and next 3 lines for the query body
                 const queryBlock = f.lines.slice(annotIdx, annotIdx + 5).join(" ");
                 if (!/tenantId|tenant_id|:tenantId/i.test(queryBlock)) {
-                    p1Findings.push({
-                        check: "TENANT_ISOLATION",
-                        severity: "BLOCKING",
-                        file: f.file_path,
-                        line: annotIdx + 1,
-                        message: `@Query at line ${annotIdx + 1} does not include tenantId filter`,
-                        suggestion: "Add WHERE e.tenantId = :tenantId to the JPQL/SQL query",
-                    });
+                    let suppressionReason = "";
+                    for (let i = Math.max(0, annotIdx - 5); i < annotIdx; i++) {
+                        const match = f.lines[i].match(/@TenantScopeException\s*\(\s*"([^"]+)"\s*\)/i);
+                        if (match)
+                            suppressionReason = match[1];
+                    }
+                    if (suppressionReason) {
+                        p1Suppressed.push({ file: f.file_path, line: annotIdx + 1, reason: suppressionReason, method: "@Query method" });
+                    }
+                    else {
+                        p1Findings.push({
+                            check: "TENANT_ISOLATION",
+                            severity: "BLOCKING",
+                            file: f.file_path,
+                            line: annotIdx + 1,
+                            message: `@Query at line ${annotIdx + 1} does not include tenantId filter`,
+                            suggestion: "Add WHERE e.tenantId = :tenantId to the JPQL/SQL query",
+                        });
+                    }
                 }
             });
         }
     }
     allFindings.push(...p1Findings);
-    passResults.push({ name: "TENANT_ISOLATION", skipped: skip_checks.includes("tenant_isolation"), passed: p1Findings.length === 0, count: p1Findings.length });
+    passResults.push({ name: "TENANT_ISOLATION", skipped: skip_checks.includes("tenant_isolation"), passed: p1Findings.length === 0, count: p1Findings.length, suppressedCount: p1Suppressed.length });
+    // Auto-log suppressions to decisions.json
+    if (p1Suppressed.length > 0 && work_item_id) {
+        const tasksRoot = resolve(TASKS_DIR);
+        const dir = resolveTaskFolder(work_item_id, tasksRoot);
+        if (dir) {
+            const decisionsPath = path.join(dir, "decisions.json");
+            const decisions = readJson(decisionsPath) || [];
+            let modified = false;
+            for (const sup of p1Suppressed) {
+                const desc = `Exempted TENANT_ISOLATION on ${sup.method}`;
+                if (!decisions.some(d => d.decision === desc)) {
+                    decisions.push({
+                        id: decisions.length + 1,
+                        decision: desc,
+                        rationale: sup.reason,
+                        logged_at: new Date().toISOString()
+                    });
+                    modified = true;
+                }
+            }
+            if (modified)
+                writeFile(decisionsPath, JSON.stringify(decisions, null, 2));
+        }
+    }
     // ══════════════════════════════════════════════════════════════════════
     // PASS 2 — N_PLUS_ONE
     // Rule: no repository method calls inside for/forEach loops
@@ -3958,7 +4060,8 @@ server.tool("run_pre_pr_checks", "Full-spectrum PR review system — runs BEFORE
     out += `| Pass | Check | Status | Findings |\n|---|---|---|---|\n`;
     for (const p of passResults) {
         const statusIcon = p.skipped ? "⏭️ SKIPPED" : p.passed ? "✅ PASS" : "❌ FAIL";
-        out += `| P${passResults.indexOf(p) + 1} | ${p.name} | ${statusIcon} | ${p.skipped ? "—" : p.count} |\n`;
+        const issueText = p.skipped ? "—" : (p.suppressedCount ? `${p.count} (${p.suppressedCount} suppressed)` : `${p.count}`);
+        out += `| P${passResults.indexOf(p) + 1} | ${p.name} | ${statusIcon} | ${issueText} |\n`;
     }
     // ── Blocking findings detail ──────────────────────────────────────────
     if (blockingFindings.length > 0) {
@@ -3969,6 +4072,13 @@ server.tool("run_pre_pr_checks", "Full-spectrum PR review system — runs BEFORE
             out += `> 💡 *${f.suggestion}*\n`;
         }
     }
+    if (p1Suppressed.length > 0) {
+        out += `\n### 🛡️ Suppressed Findings (${p1Suppressed.length})\n`;
+        for (const sup of p1Suppressed) {
+            out += `\n**[TENANT_ISOLATION]** \`${sup.file}\` line ${sup.line}\n`;
+            out += `> Suppressed — ${sup.reason}\n`;
+        }
+    }
     // ── Warning findings detail ───────────────────────────────────────────
     const warnings = allFindings.filter(f => f.severity === "WARNING");
     if (warnings.length > 0) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "secufusion-mcp",
-  "version": "1.0.60",
+  "version": "1.1.0",
   "type": "module",
   "description": "SecuFusion MCP server - developer workflow tooling with guardrails",
   "main": "index.js",