secufusion-mcp 1.0.60 → 1.2.0

package/index.js

@@ -2675,8 +2675,13 @@ server.tool("run_pre_pr_checks_with_reviewer_agent", "Unified, single-call PR re
     skip_checks: z.array(z.enum(["tenant_isolation", "n_plus_one", "missing_index", "kafka_sync", "early_return", "ai_review", "context_review"])).optional().default([]).describe("Checks to skip. Mechanical: tenant_isolation | n_plus_one | missing_index | kafka_sync | early_return. " +
         "Review tiers: ai_review (Tier 2) | context_review (Tier 3). " +
         "Use sparingly — only for acknowledged legacy files or CI environments where context is unavailable."),
-}, async ({ work_item_id, skip_checks = [] }) => {
-    const inputChars = JSON.stringify({ work_item_id, skip_checks }).length;
+    suppressions: z.array(z.object({
+        check: z.enum(["TENANT_ISOLATION", "N_PLUS_ONE", "MISSING_INDEX", "KAFKA_SYNC", "EARLY_RETURN"]),
+        method: z.string().describe("Method name to suppress, e.g. 'countOrphanedByDeviceUserId'"),
+        reason: z.string().describe("Mandatory justification for suppression")
+    })).optional().default([]).describe("Method-scoped suppressions with mandatory reasons.")
+}, async ({ work_item_id, skip_checks = [], suppressions = [] }) => {
+    const inputChars = JSON.stringify({ work_item_id, skip_checks, suppressions }).length;
     const wsRoot = getWorkspaceRoot();
     const startTime = Date.now();
     // ══════════════════════════════════════════════════════════════════════
@@ -2794,6 +2799,7 @@ server.tool("run_pre_pr_checks_with_reviewer_agent", "Unified, single-call PR re
     // ══════════════════════════════════════════════════════════════════════
     // ── P1: TENANT_ISOLATION ──────────────────────────────────────────────
     const p1 = [];
+    const p1Suppressed = [];
     if (!skip_checks.includes("tenant_isolation")) {
         for (const f of fileRecords.filter(f => f.isRepo)) {
             const queryAnnotationLines = [];
@@ -2804,23 +2810,85 @@ server.tool("run_pre_pr_checks_with_reviewer_agent", "Unified, single-call PR re
             f.lines.forEach((line, idx) => {
                 const dm = line.match(/(?:find|delete|count|exists)\w+By(\w+)/);
                 if (dm && !dm[1].toLowerCase().includes("tenant")) {
-                    p1.push({ check: "TENANT_ISOLATION", severity: "BLOCKING", file: f.file_path, line: idx + 1,
-                        message: `Derived query \`${line.trim()}\` does not filter by tenantId`,
-                        suggestion: "Rename to include AndTenantId, e.g. findByIdAndTenantId(UUID id, UUID tenantId)" });
+                    let suppressionReason = "";
+                    const explicitSup = suppressions.find(s => s.check === "TENANT_ISOLATION" && (s.method === dm[0] || s.method.endsWith(`.${dm[0]}`)));
+                    if (explicitSup)
+                        suppressionReason = explicitSup.reason;
+                    else {
+                        for (let i = Math.max(0, idx - 5); i < idx; i++) {
+                            const match = f.lines[i].match(/@TenantScopeException\s*\(\s*"([^"]+)"\s*\)/i);
+                            if (match)
+                                suppressionReason = match[1];
+                        }
+                    }
+                    if (suppressionReason) {
+                        p1Suppressed.push({ file: f.file_path, line: idx + 1, reason: suppressionReason, method: dm[0] });
+                    }
+                    else {
+                        p1.push({ check: "TENANT_ISOLATION", severity: "BLOCKING", file: f.file_path, line: idx + 1,
+                            message: `Derived query \`${line.trim()}\` does not filter by tenantId`,
+                            suggestion: "Rename to include AndTenantId, e.g. findByIdAndTenantId(UUID id, UUID tenantId)" });
+                    }
                 }
             });
             queryAnnotationLines.forEach(ai => {
                 const block = f.lines.slice(ai, ai + 5).join(" ");
                 if (!/tenantId|tenant_id|:tenantId/i.test(block)) {
-                    p1.push({ check: "TENANT_ISOLATION", severity: "BLOCKING", file: f.file_path, line: ai + 1,
-                        message: `@Query at line ${ai + 1} has no tenantId filter`,
-                        suggestion: "Add WHERE e.tenantId = :tenantId to the JPQL/SQL query" });
+                    let suppressionReason = "";
+                    let queryMethodName = "";
+                    const methodDeclMatch = block.match(/(?:List|Optional|Page|long|int|boolean|void|[A-Z]\w+)\s+(\w+)\s*\(/);
+                    if (methodDeclMatch)
+                        queryMethodName = methodDeclMatch[1];
+                    if (queryMethodName) {
+                        const explicitSup = suppressions.find(s => s.check === "TENANT_ISOLATION" && (s.method === queryMethodName || s.method.endsWith(`.${queryMethodName}`)));
+                        if (explicitSup)
+                            suppressionReason = explicitSup.reason;
+                    }
+                    if (!suppressionReason) {
+                        for (let i = Math.max(0, ai - 5); i < ai; i++) {
+                            const match = f.lines[i].match(/@TenantScopeException\s*\(\s*"([^"]+)"\s*\)/i);
+                            if (match)
+                                suppressionReason = match[1];
+                        }
+                    }
+                    if (suppressionReason) {
+                        p1Suppressed.push({ file: f.file_path, line: ai + 1, reason: suppressionReason, method: queryMethodName || "@Query method" });
+                    }
+                    else {
+                        p1.push({ check: "TENANT_ISOLATION", severity: "BLOCKING", file: f.file_path, line: ai + 1,
+                            message: `@Query at line ${ai + 1} has no tenantId filter`,
+                            suggestion: "Add WHERE e.tenantId = :tenantId to the JPQL/SQL query" });
+                    }
                 }
             });
         }
     }
     mechanical.push(...p1);
-    passResults.push({ name: "TENANT_ISOLATION", skipped: skip_checks.includes("tenant_isolation"), passed: p1.length === 0, count: p1.length });
+    passResults.push({ name: "TENANT_ISOLATION", skipped: skip_checks.includes("tenant_isolation"), passed: p1.length === 0, count: p1.length, suppressedCount: p1Suppressed.length });
+    // Auto-log suppressions to decisions.json
+    if (p1Suppressed.length > 0) {
+        const tasksRoot = resolve(TASKS_DIR);
+        const dir = resolveTaskFolder(work_item_id, tasksRoot);
+        if (dir) {
+            const decisionsPath = path.join(dir, "decisions.json");
+            const decisions = readJson(decisionsPath) || [];
+            let modified = false;
+            for (const sup of p1Suppressed) {
+                const desc = `Exempted TENANT_ISOLATION on ${sup.method}`;
+                if (!decisions.some(d => d.decision === desc)) {
+                    decisions.push({
+                        id: decisions.length + 1,
+                        decision: desc,
+                        rationale: sup.reason,
+                        logged_at: new Date().toISOString()
+                    });
+                    modified = true;
+                }
+            }
+            if (modified)
+                writeFile(decisionsPath, JSON.stringify(decisions, null, 2));
+        }
+    }
     // ── P2: N_PLUS_ONE ────────────────────────────────────────────────────
     const p2 = [];
     if (!skip_checks.includes("n_plus_one")) {
@@ -3278,7 +3346,8 @@ server.tool("run_pre_pr_checks_with_reviewer_agent", "Unified, single-call PR re
     for (let i = 0; i < passResults.length; i++) {
         const p = passResults[i];
         const icon = p.skipped ? "⏭️ SKIP" : p.passed ? "✅ PASS" : "❌ FAIL";
-        out += `| P${i + 1} | ${p.name} | ${icon} | ${p.skipped ? "—" : p.count} |\n`;
+        const issueText = p.skipped ? "—" : (p.suppressedCount ? `${p.count} (${p.suppressedCount} suppressed)` : `${p.count}`);
+        out += `| P${i + 1} | ${p.name} | ${icon} | ${issueText} |\n`;
     }
     if (blockingMechanical.length > 0) {
         out += `\n#### ❌ Blocking Mechanical Findings\n`;
@@ -3287,6 +3356,13 @@ server.tool("run_pre_pr_checks_with_reviewer_agent", "Unified, single-call PR re
             out += `> ${f.message}\n> 💡 *${f.suggestion}*\n`;
         }
     }
+    if (p1Suppressed.length > 0) {
+        out += `\n#### 🛡️ Suppressed Findings (${p1Suppressed.length})\n`;
+        for (const sup of p1Suppressed) {
+            out += `\n**[TENANT_ISOLATION]** \`${sup.file}\` line ${sup.line}\n`;
+            out += `> Suppressed — ${sup.reason}\n`;
+        }
+    }
     const warnings1 = mechanical.filter(f => f.severity === "WARNING");
     if (warnings1.length > 0) {
         out += `\n#### ⚠️ Warnings\n`;
@@ -3425,8 +3501,13 @@ server.tool("run_pre_pr_checks", "Full-spectrum PR review system — runs BEFORE
     work_item_id: z.string().describe("Active work item ID, e.g. 'WI-1234'."),
     skip_checks: z.array(z.enum(["tenant_isolation", "n_plus_one", "missing_index", "kafka_sync", "early_return", "ai_review"])).optional().default([]).describe("Checks to skip. Options: tenant_isolation | n_plus_one | missing_index | kafka_sync | early_return | ai_review. " +
         "Use sparingly — only for acknowledged legacy files that pre-date the rule."),
-}, async ({ work_item_id, skip_checks = [] }) => {
-    const inputChars = JSON.stringify({ work_item_id, skip_checks }).length;
+    suppressions: z.array(z.object({
+        check: z.enum(["TENANT_ISOLATION", "N_PLUS_ONE", "MISSING_INDEX", "KAFKA_SYNC", "EARLY_RETURN"]),
+        method: z.string().describe("Method name to suppress, e.g. 'countOrphanedByDeviceUserId'"),
+        reason: z.string().describe("Mandatory justification for suppression")
+    })).optional().default([]).describe("Method-scoped suppressions with mandatory reasons.")
+}, async ({ work_item_id, skip_checks = [], suppressions = [] }) => {
+    const inputChars = JSON.stringify({ work_item_id, skip_checks, suppressions }).length;
     const wsRoot = getWorkspaceRoot();
     // ── Resolve task folder ────────────────────────────────────────────────
     const registry = readRegistry();
@@ -3487,6 +3568,7 @@ server.tool("run_pre_pr_checks", "Full-spectrum PR review system — runs BEFORE
     // Rule: every Repository method must filter by tenantId
     // ══════════════════════════════════════════════════════════════════════
     const p1Findings = [];
+    const p1Suppressed = [];
     if (!skip_checks.includes("tenant_isolation")) {
         for (const f of fileRecords.filter(f => f.isRepo)) {
             // Find method signatures in repository interface/class
@@ -3502,14 +3584,30 @@ server.tool("run_pre_pr_checks", "Full-spectrum PR review system — runs BEFORE
                 if (derivedMatch) {
                     const byClause = derivedMatch[1].toLowerCase();
                     if (!byClause.includes("tenantid") && !byClause.includes("tenant")) {
-                        p1Findings.push({
-                            check: "TENANT_ISOLATION",
-                            severity: "BLOCKING",
-                            file: f.file_path,
-                            line: idx + 1,
-                            message: `Derived query \`${line.trim()}\` does not filter by tenantId`,
-                            suggestion: "Rename to include AndTenantId: e.g. findByIdAndTenantId(UUID id, UUID tenantId)",
-                        });
+                        let suppressionReason = "";
+                        const explicitSup = suppressions.find(s => s.check === "TENANT_ISOLATION" && (s.method === derivedMatch[0] || s.method.endsWith(`.${derivedMatch[0]}`)));
+                        if (explicitSup)
+                            suppressionReason = explicitSup.reason;
+                        else {
+                            for (let i = Math.max(0, idx - 5); i < idx; i++) {
+                                const match = f.lines[i].match(/@TenantScopeException\s*\(\s*"([^"]+)"\s*\)/i);
+                                if (match)
+                                    suppressionReason = match[1];
+                            }
+                        }
+                        if (suppressionReason) {
+                            p1Suppressed.push({ file: f.file_path, line: idx + 1, reason: suppressionReason, method: derivedMatch[0] });
+                        }
+                        else {
+                            p1Findings.push({
+                                check: "TENANT_ISOLATION",
+                                severity: "BLOCKING",
+                                file: f.file_path,
+                                line: idx + 1,
+                                message: `Derived query \`${line.trim()}\` does not filter by tenantId`,
+                                suggestion: "Rename to include AndTenantId: e.g. findByIdAndTenantId(UUID id, UUID tenantId)",
+                            });
+                        }
                     }
                 }
             });
@@ -3518,20 +3616,66 @@ server.tool("run_pre_pr_checks", "Full-spectrum PR review system — runs BEFORE
                 // Look at this line and next 3 lines for the query body
                 const queryBlock = f.lines.slice(annotIdx, annotIdx + 5).join(" ");
                 if (!/tenantId|tenant_id|:tenantId/i.test(queryBlock)) {
-                    p1Findings.push({
-                        check: "TENANT_ISOLATION",
-                        severity: "BLOCKING",
-                        file: f.file_path,
-                        line: annotIdx + 1,
-                        message: `@Query at line ${annotIdx + 1} does not include tenantId filter`,
-                        suggestion: "Add WHERE e.tenantId = :tenantId to the JPQL/SQL query",
-                    });
+                    let suppressionReason = "";
+                    let queryMethodName = "";
+                    const methodDeclMatch = queryBlock.match(/(?:List|Optional|Page|long|int|boolean|void|[A-Z]\w+)\s+(\w+)\s*\(/);
+                    if (methodDeclMatch)
+                        queryMethodName = methodDeclMatch[1];
+                    if (queryMethodName) {
+                        const explicitSup = suppressions.find(s => s.check === "TENANT_ISOLATION" && (s.method === queryMethodName || s.method.endsWith(`.${queryMethodName}`)));
+                        if (explicitSup)
+                            suppressionReason = explicitSup.reason;
+                    }
+                    if (!suppressionReason) {
+                        for (let i = Math.max(0, annotIdx - 5); i < annotIdx; i++) {
+                            const match = f.lines[i].match(/@TenantScopeException\s*\(\s*"([^"]+)"\s*\)/i);
+                            if (match)
+                                suppressionReason = match[1];
+                        }
+                    }
+                    if (suppressionReason) {
+                        p1Suppressed.push({ file: f.file_path, line: annotIdx + 1, reason: suppressionReason, method: queryMethodName || "@Query method" });
+                    }
+                    else {
+                        p1Findings.push({
+                            check: "TENANT_ISOLATION",
+                            severity: "BLOCKING",
+                            file: f.file_path,
+                            line: annotIdx + 1,
+                            message: `@Query at line ${annotIdx + 1} does not include tenantId filter`,
+                            suggestion: "Add WHERE e.tenantId = :tenantId to the JPQL/SQL query",
+                        });
+                    }
                 }
             });
         }
     }
     allFindings.push(...p1Findings);
-    passResults.push({ name: "TENANT_ISOLATION", skipped: skip_checks.includes("tenant_isolation"), passed: p1Findings.length === 0, count: p1Findings.length });
+    passResults.push({ name: "TENANT_ISOLATION", skipped: skip_checks.includes("tenant_isolation"), passed: p1Findings.length === 0, count: p1Findings.length, suppressedCount: p1Suppressed.length });
+    // Auto-log suppressions to decisions.json
+    if (p1Suppressed.length > 0 && work_item_id) {
+        const tasksRoot = resolve(TASKS_DIR);
+        const dir = resolveTaskFolder(work_item_id, tasksRoot);
+        if (dir) {
+            const decisionsPath = path.join(dir, "decisions.json");
+            const decisions = readJson(decisionsPath) || [];
+            let modified = false;
+            for (const sup of p1Suppressed) {
+                const desc = `Exempted TENANT_ISOLATION on ${sup.method}`;
+                if (!decisions.some(d => d.decision === desc)) {
+                    decisions.push({
+                        id: decisions.length + 1,
+                        decision: desc,
+                        rationale: sup.reason,
+                        logged_at: new Date().toISOString()
+                    });
+                    modified = true;
+                }
+            }
+            if (modified)
+                writeFile(decisionsPath, JSON.stringify(decisions, null, 2));
+        }
+    }
     // ══════════════════════════════════════════════════════════════════════
     // PASS 2 — N_PLUS_ONE
     // Rule: no repository method calls inside for/forEach loops
@@ -3958,7 +4102,8 @@ server.tool("run_pre_pr_checks", "Full-spectrum PR review system — runs BEFORE
     out += `| Pass | Check | Status | Findings |\n|---|---|---|---|\n`;
     for (const p of passResults) {
         const statusIcon = p.skipped ? "⏭️ SKIPPED" : p.passed ? "✅ PASS" : "❌ FAIL";
-        out += `| P${passResults.indexOf(p) + 1} | ${p.name} | ${statusIcon} | ${p.skipped ? "—" : p.count} |\n`;
+        const issueText = p.skipped ? "—" : (p.suppressedCount ? `${p.count} (${p.suppressedCount} suppressed)` : `${p.count}`);
+        out += `| P${passResults.indexOf(p) + 1} | ${p.name} | ${statusIcon} | ${issueText} |\n`;
     }
     // ── Blocking findings detail ──────────────────────────────────────────
     if (blockingFindings.length > 0) {
@@ -3969,6 +4114,13 @@ server.tool("run_pre_pr_checks", "Full-spectrum PR review system — runs BEFORE
             out += `> 💡 *${f.suggestion}*\n`;
         }
     }
+    if (p1Suppressed.length > 0) {
+        out += `\n### 🛡️ Suppressed Findings (${p1Suppressed.length})\n`;
+        for (const sup of p1Suppressed) {
+            out += `\n**[TENANT_ISOLATION]** \`${sup.file}\` line ${sup.line}\n`;
+            out += `> Suppressed — ${sup.reason}\n`;
+        }
+    }
     // ── Warning findings detail ───────────────────────────────────────────
     const warnings = allFindings.filter(f => f.severity === "WARNING");
     if (warnings.length > 0) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "secufusion-mcp",
-  "version": "1.0.60",
+  "version": "1.2.0",
   "type": "module",
   "description": "SecuFusion MCP server - developer workflow tooling with guardrails",
   "main": "index.js",