secufusion-mcp 1.1.0 → 1.2.0

package/index.js

@@ -2675,8 +2675,13 @@ server.tool("run_pre_pr_checks_with_reviewer_agent", "Unified, single-call PR re
     skip_checks: z.array(z.enum(["tenant_isolation", "n_plus_one", "missing_index", "kafka_sync", "early_return", "ai_review", "context_review"])).optional().default([]).describe("Checks to skip. Mechanical: tenant_isolation | n_plus_one | missing_index | kafka_sync | early_return. " +
         "Review tiers: ai_review (Tier 2) | context_review (Tier 3). " +
         "Use sparingly — only for acknowledged legacy files or CI environments where context is unavailable."),
-}, async ({ work_item_id, skip_checks = [] }) => {
-    const inputChars = JSON.stringify({ work_item_id, skip_checks }).length;
+    suppressions: z.array(z.object({
+        check: z.enum(["TENANT_ISOLATION", "N_PLUS_ONE", "MISSING_INDEX", "KAFKA_SYNC", "EARLY_RETURN"]),
+        method: z.string().describe("Method name to suppress, e.g. 'countOrphanedByDeviceUserId'"),
+        reason: z.string().describe("Mandatory justification for suppression")
+    })).optional().default([]).describe("Method-scoped suppressions with mandatory reasons.")
+}, async ({ work_item_id, skip_checks = [], suppressions = [] }) => {
+    const inputChars = JSON.stringify({ work_item_id, skip_checks, suppressions }).length;
     const wsRoot = getWorkspaceRoot();
     const startTime = Date.now();
     // ══════════════════════════════════════════════════════════════════════
@@ -2806,10 +2811,15 @@ server.tool("run_pre_pr_checks_with_reviewer_agent", "Unified, single-call PR re
                 const dm = line.match(/(?:find|delete|count|exists)\w+By(\w+)/);
                 if (dm && !dm[1].toLowerCase().includes("tenant")) {
                     let suppressionReason = "";
-                    for (let i = Math.max(0, idx - 5); i < idx; i++) {
-                        const match = f.lines[i].match(/@TenantScopeException\s*\(\s*"([^"]+)"\s*\)/i);
-                        if (match)
-                            suppressionReason = match[1];
+                    const explicitSup = suppressions.find(s => s.check === "TENANT_ISOLATION" && (s.method === dm[0] || s.method.endsWith(`.${dm[0]}`)));
+                    if (explicitSup)
+                        suppressionReason = explicitSup.reason;
+                    else {
+                        for (let i = Math.max(0, idx - 5); i < idx; i++) {
+                            const match = f.lines[i].match(/@TenantScopeException\s*\(\s*"([^"]+)"\s*\)/i);
+                            if (match)
+                                suppressionReason = match[1];
+                        }
                     }
                     if (suppressionReason) {
                         p1Suppressed.push({ file: f.file_path, line: idx + 1, reason: suppressionReason, method: dm[0] });
@@ -2825,13 +2835,24 @@ server.tool("run_pre_pr_checks_with_reviewer_agent", "Unified, single-call PR re
                 const block = f.lines.slice(ai, ai + 5).join(" ");
                 if (!/tenantId|tenant_id|:tenantId/i.test(block)) {
                     let suppressionReason = "";
-                    for (let i = Math.max(0, ai - 5); i < ai; i++) {
-                        const match = f.lines[i].match(/@TenantScopeException\s*\(\s*"([^"]+)"\s*\)/i);
-                        if (match)
-                            suppressionReason = match[1];
+                    let queryMethodName = "";
+                    const methodDeclMatch = block.match(/(?:List|Optional|Page|long|int|boolean|void|[A-Z]\w+)\s+(\w+)\s*\(/);
+                    if (methodDeclMatch)
+                        queryMethodName = methodDeclMatch[1];
+                    if (queryMethodName) {
+                        const explicitSup = suppressions.find(s => s.check === "TENANT_ISOLATION" && (s.method === queryMethodName || s.method.endsWith(`.${queryMethodName}`)));
+                        if (explicitSup)
+                            suppressionReason = explicitSup.reason;
+                    }
+                    if (!suppressionReason) {
+                        for (let i = Math.max(0, ai - 5); i < ai; i++) {
+                            const match = f.lines[i].match(/@TenantScopeException\s*\(\s*"([^"]+)"\s*\)/i);
+                            if (match)
+                                suppressionReason = match[1];
+                        }
                     }
                     if (suppressionReason) {
-                        p1Suppressed.push({ file: f.file_path, line: ai + 1, reason: suppressionReason, method: "@Query method" });
+                        p1Suppressed.push({ file: f.file_path, line: ai + 1, reason: suppressionReason, method: queryMethodName || "@Query method" });
                     }
                     else {
                         p1.push({ check: "TENANT_ISOLATION", severity: "BLOCKING", file: f.file_path, line: ai + 1,
@@ -3480,8 +3501,13 @@ server.tool("run_pre_pr_checks", "Full-spectrum PR review system — runs BEFORE
     work_item_id: z.string().describe("Active work item ID, e.g. 'WI-1234'."),
     skip_checks: z.array(z.enum(["tenant_isolation", "n_plus_one", "missing_index", "kafka_sync", "early_return", "ai_review"])).optional().default([]).describe("Checks to skip. Options: tenant_isolation | n_plus_one | missing_index | kafka_sync | early_return | ai_review. " +
         "Use sparingly — only for acknowledged legacy files that pre-date the rule."),
-}, async ({ work_item_id, skip_checks = [] }) => {
-    const inputChars = JSON.stringify({ work_item_id, skip_checks }).length;
+    suppressions: z.array(z.object({
+        check: z.enum(["TENANT_ISOLATION", "N_PLUS_ONE", "MISSING_INDEX", "KAFKA_SYNC", "EARLY_RETURN"]),
+        method: z.string().describe("Method name to suppress, e.g. 'countOrphanedByDeviceUserId'"),
+        reason: z.string().describe("Mandatory justification for suppression")
+    })).optional().default([]).describe("Method-scoped suppressions with mandatory reasons.")
+}, async ({ work_item_id, skip_checks = [], suppressions = [] }) => {
+    const inputChars = JSON.stringify({ work_item_id, skip_checks, suppressions }).length;
     const wsRoot = getWorkspaceRoot();
     // ── Resolve task folder ────────────────────────────────────────────────
     const registry = readRegistry();
@@ -3559,10 +3585,15 @@ server.tool("run_pre_pr_checks", "Full-spectrum PR review system — runs BEFORE
                     const byClause = derivedMatch[1].toLowerCase();
                     if (!byClause.includes("tenantid") && !byClause.includes("tenant")) {
                         let suppressionReason = "";
-                        for (let i = Math.max(0, idx - 5); i < idx; i++) {
-                            const match = f.lines[i].match(/@TenantScopeException\s*\(\s*"([^"]+)"\s*\)/i);
-                            if (match)
-                                suppressionReason = match[1];
+                        const explicitSup = suppressions.find(s => s.check === "TENANT_ISOLATION" && (s.method === derivedMatch[0] || s.method.endsWith(`.${derivedMatch[0]}`)));
+                        if (explicitSup)
+                            suppressionReason = explicitSup.reason;
+                        else {
+                            for (let i = Math.max(0, idx - 5); i < idx; i++) {
+                                const match = f.lines[i].match(/@TenantScopeException\s*\(\s*"([^"]+)"\s*\)/i);
+                                if (match)
+                                    suppressionReason = match[1];
+                            }
                         }
                         if (suppressionReason) {
                             p1Suppressed.push({ file: f.file_path, line: idx + 1, reason: suppressionReason, method: derivedMatch[0] });
@@ -3586,13 +3617,24 @@ server.tool("run_pre_pr_checks", "Full-spectrum PR review system — runs BEFORE
                 const queryBlock = f.lines.slice(annotIdx, annotIdx + 5).join(" ");
                 if (!/tenantId|tenant_id|:tenantId/i.test(queryBlock)) {
                     let suppressionReason = "";
-                    for (let i = Math.max(0, annotIdx - 5); i < annotIdx; i++) {
-                        const match = f.lines[i].match(/@TenantScopeException\s*\(\s*"([^"]+)"\s*\)/i);
-                        if (match)
-                            suppressionReason = match[1];
+                    let queryMethodName = "";
+                    const methodDeclMatch = queryBlock.match(/(?:List|Optional|Page|long|int|boolean|void|[A-Z]\w+)\s+(\w+)\s*\(/);
+                    if (methodDeclMatch)
+                        queryMethodName = methodDeclMatch[1];
+                    if (queryMethodName) {
+                        const explicitSup = suppressions.find(s => s.check === "TENANT_ISOLATION" && (s.method === queryMethodName || s.method.endsWith(`.${queryMethodName}`)));
+                        if (explicitSup)
+                            suppressionReason = explicitSup.reason;
+                    }
+                    if (!suppressionReason) {
+                        for (let i = Math.max(0, annotIdx - 5); i < annotIdx; i++) {
+                            const match = f.lines[i].match(/@TenantScopeException\s*\(\s*"([^"]+)"\s*\)/i);
+                            if (match)
+                                suppressionReason = match[1];
+                        }
                     }
                     if (suppressionReason) {
-                        p1Suppressed.push({ file: f.file_path, line: annotIdx + 1, reason: suppressionReason, method: "@Query method" });
+                        p1Suppressed.push({ file: f.file_path, line: annotIdx + 1, reason: suppressionReason, method: queryMethodName || "@Query method" });
                     }
                     else {
                         p1Findings.push({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "secufusion-mcp",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "type": "module",
   "description": "SecuFusion MCP server - developer workflow tooling with guardrails",
   "main": "index.js",