secufusion-mcp 1.1.0 → 1.2.1

package/AGENTS.md

@@ -468,6 +468,7 @@ STEP 1: call run_pre_pr_checks_with_reviewer_agent(work_item_id: <id>)
             P3 MISSING_INDEX     — new query columns have migration index
             P4 KAFKA_SYNC        — no sync work inside @KafkaListener
             P5 EARLY_RETURN      — no early returns (single-exit rule)
+            (Note: If a mechanical check is a false positive, pass the `suppressions` parameter to the tool with `{ check, method, reason }` instead of ignoring it.)
         — Tier 2: AI File Reviewer (only after P1–P5 pass)
             Checks: hardcoded URLs, missing @Transactional(readOnly),
             missing @PreAuthorize, debug statements, exception swallowing,
@@ -727,37 +728,37 @@ Before Phase 0.7 plan presentation:
 **Audience:** Technical and Non-Technical stakeholders on the Azure DevOps board.
 **Format rules:**
 - Layman summary: NO class names, NO method names, NO technical terms. Pure English.
-- Technical deep-dive: BE specific. Exact class names, exact method names, exact file paths. Source from `files-touched.json`.
+- Execution Flow: BE specific. Exact class names, exact method names, exact file paths. Source from `files-touched.json`.
+- Sequential flow ONLY. Do not use before/after framing (e.g., avoid "not X directly," "exactly as before," "hardened after review," etc.). Just state what happens and in what order.
 - Tables must have content in every cell. If unknown → "not recorded".
 - Max 2 sentences in any single prose paragraph.
 - Max 600 words.
 
 ```markdown
 ## Layman Summary
-{layman_summary — 2-3 sentences max}
+{layman_summary — 2-3 sentences max. Sequential flow only.}
 
-## Technical Deep-Dive
+## Execution Flow
 {If auth/permission gating exists:}
-> Both endpoints gated by `{permission}` authority.
+> 1. Request gated by `{permission}` authority.
 
-### Scenarios Handled
-**Happy path:**
-{happy_path from scenarios.json — one sentence}
+{Describe the straight sequence of what happens, in order, step-by-step. E.g.:}
+2. **Trigger:** {How the flow starts}
+3. **Validation:** {What checks occur}
+4. **Processing:** {What data is transformed or queried}
+5. **Result:** {What is returned or persisted}
 
-**Sad paths handled:**
-{for each sad_path in scenarios.json:}
-- {sad_path description} → {how handled}
-
-**Security cases:**
+### Security & Error Handling
 {for each security_case in scenarios.json:}
 - {security concern} → {enforcement}
+{for each sad_path in scenarios.json:}
+- {sad_path description} → {how handled}
 
-### What did NOT change
+### Infrastructure Impact
 | Area | Status |
 |---|---|
 | DB migration | {✅ Not required / ⚠️ Created: V{n}__...sql} |
 | Kafka topics | {✅ No new topics / ⚠️ New topic: {name}} |
-| {other_service}-api | {✅ No changes / ⚠️ Changes required} |
 | API contract | {✅ No breaking changes / ⚠️ See decisions} |
 
 ---
@@ -767,7 +768,8 @@ Before Phase 0.7 plan presentation:
 ### PR Comment Template (`pr-comment.md`)
 **Audience:** Busy Developer Reviewers reading the PR description.
 **Format rules:**
-- Group changes by WHAT changed, not by file name (e.g., "New endpoint: GET /path", "Test coverage: N scenarios").
+- Group changes by the sequence of execution, not by file name.
+- Sequential flow ONLY. No before/after comparisons. Just state what the code does now.
 - ✅ for things NOT changing is equally important.
 - Guardrails section is mandatory.
 - Max 400 words. Condense changes table if longer.
@@ -779,13 +781,14 @@ Before Phase 0.7 plan presentation:
 
 ---
 ## Summary
-{2-3 sentences MAX. What changed and why.}
+{2-3 sentences MAX. What the code does. Sequential flow only.}
 
 ---
-## Changes
-| Area | What changed |
-|---|---|
-| {logical area} | {what changed in plain terms} |
+## Implementation Sequence
+1. {Step 1 of the new flow}
+2. {Step 2 of the new flow}
+3. {Step 3 of the new flow}
+4. {Step 4 of the new flow}
 
 ---
 ## Affected Service
@@ -793,16 +796,13 @@ Before Phase 0.7 plan presentation:
 
 ---
 ## Impact
-- ✅ No functional or behavioral changes {OR describe actual behavioral change}
+- ✅ No functional or behavioral changes {OR describe actual behavioral change sequentially}
 - ✅ No DB migration required {OR: ⚠️ Flyway migration V{n} included}
 - ✅ No Kafka topic changes {OR: ⚠️ New topic: {name}}
-- ✅ No API contract changes {OR: ⚠️ New endpoints: see Changes above}
+- ✅ No API contract changes {OR: ⚠️ New endpoints: see Implementation Sequence above}
 
 ---
-## Scenarios
-**Happy path:** {happy_path one line}
-
-**Sad paths handled:**
+## Error Handling
 - {what fails} → {how handled}
 
 ---

package/index.js

@@ -2675,8 +2675,13 @@ server.tool("run_pre_pr_checks_with_reviewer_agent", "Unified, single-call PR re
     skip_checks: z.array(z.enum(["tenant_isolation", "n_plus_one", "missing_index", "kafka_sync", "early_return", "ai_review", "context_review"])).optional().default([]).describe("Checks to skip. Mechanical: tenant_isolation | n_plus_one | missing_index | kafka_sync | early_return. " +
         "Review tiers: ai_review (Tier 2) | context_review (Tier 3). " +
         "Use sparingly — only for acknowledged legacy files or CI environments where context is unavailable."),
-}, async ({ work_item_id, skip_checks = [] }) => {
-    const inputChars = JSON.stringify({ work_item_id, skip_checks }).length;
+    suppressions: z.array(z.object({
+        check: z.enum(["TENANT_ISOLATION", "N_PLUS_ONE", "MISSING_INDEX", "KAFKA_SYNC", "EARLY_RETURN"]),
+        method: z.string().describe("Method name to suppress, e.g. 'countOrphanedByDeviceUserId'"),
+        reason: z.string().describe("Mandatory justification for suppression")
+    })).optional().default([]).describe("Method-scoped suppressions with mandatory reasons.")
+}, async ({ work_item_id, skip_checks = [], suppressions = [] }) => {
+    const inputChars = JSON.stringify({ work_item_id, skip_checks, suppressions }).length;
     const wsRoot = getWorkspaceRoot();
     const startTime = Date.now();
     // ══════════════════════════════════════════════════════════════════════
@@ -2806,10 +2811,15 @@ server.tool("run_pre_pr_checks_with_reviewer_agent", "Unified, single-call PR re
                 const dm = line.match(/(?:find|delete|count|exists)\w+By(\w+)/);
                 if (dm && !dm[1].toLowerCase().includes("tenant")) {
                     let suppressionReason = "";
-                    for (let i = Math.max(0, idx - 5); i < idx; i++) {
-                        const match = f.lines[i].match(/@TenantScopeException\s*\(\s*"([^"]+)"\s*\)/i);
-                        if (match)
-                            suppressionReason = match[1];
+                    const explicitSup = suppressions.find(s => s.check === "TENANT_ISOLATION" && (s.method === dm[0] || s.method.endsWith(`.${dm[0]}`)));
+                    if (explicitSup)
+                        suppressionReason = explicitSup.reason;
+                    else {
+                        for (let i = Math.max(0, idx - 5); i < idx; i++) {
+                            const match = f.lines[i].match(/@TenantScopeException\s*\(\s*"([^"]+)"\s*\)/i);
+                            if (match)
+                                suppressionReason = match[1];
+                        }
                     }
                     if (suppressionReason) {
                         p1Suppressed.push({ file: f.file_path, line: idx + 1, reason: suppressionReason, method: dm[0] });
@@ -2825,13 +2835,24 @@ server.tool("run_pre_pr_checks_with_reviewer_agent", "Unified, single-call PR re
                 const block = f.lines.slice(ai, ai + 5).join(" ");
                 if (!/tenantId|tenant_id|:tenantId/i.test(block)) {
                     let suppressionReason = "";
-                    for (let i = Math.max(0, ai - 5); i < ai; i++) {
-                        const match = f.lines[i].match(/@TenantScopeException\s*\(\s*"([^"]+)"\s*\)/i);
-                        if (match)
-                            suppressionReason = match[1];
+                    let queryMethodName = "";
+                    const methodDeclMatch = block.match(/(?:List|Optional|Page|long|int|boolean|void|[A-Z]\w+)\s+(\w+)\s*\(/);
+                    if (methodDeclMatch)
+                        queryMethodName = methodDeclMatch[1];
+                    if (queryMethodName) {
+                        const explicitSup = suppressions.find(s => s.check === "TENANT_ISOLATION" && (s.method === queryMethodName || s.method.endsWith(`.${queryMethodName}`)));
+                        if (explicitSup)
+                            suppressionReason = explicitSup.reason;
+                    }
+                    if (!suppressionReason) {
+                        for (let i = Math.max(0, ai - 5); i < ai; i++) {
+                            const match = f.lines[i].match(/@TenantScopeException\s*\(\s*"([^"]+)"\s*\)/i);
+                            if (match)
+                                suppressionReason = match[1];
+                        }
                     }
                     if (suppressionReason) {
-                        p1Suppressed.push({ file: f.file_path, line: ai + 1, reason: suppressionReason, method: "@Query method" });
+                        p1Suppressed.push({ file: f.file_path, line: ai + 1, reason: suppressionReason, method: queryMethodName || "@Query method" });
                     }
                     else {
                         p1.push({ check: "TENANT_ISOLATION", severity: "BLOCKING", file: f.file_path, line: ai + 1,
@@ -3480,8 +3501,13 @@ server.tool("run_pre_pr_checks", "Full-spectrum PR review system — runs BEFORE
     work_item_id: z.string().describe("Active work item ID, e.g. 'WI-1234'."),
     skip_checks: z.array(z.enum(["tenant_isolation", "n_plus_one", "missing_index", "kafka_sync", "early_return", "ai_review"])).optional().default([]).describe("Checks to skip. Options: tenant_isolation | n_plus_one | missing_index | kafka_sync | early_return | ai_review. " +
         "Use sparingly — only for acknowledged legacy files that pre-date the rule."),
-}, async ({ work_item_id, skip_checks = [] }) => {
-    const inputChars = JSON.stringify({ work_item_id, skip_checks }).length;
+    suppressions: z.array(z.object({
+        check: z.enum(["TENANT_ISOLATION", "N_PLUS_ONE", "MISSING_INDEX", "KAFKA_SYNC", "EARLY_RETURN"]),
+        method: z.string().describe("Method name to suppress, e.g. 'countOrphanedByDeviceUserId'"),
+        reason: z.string().describe("Mandatory justification for suppression")
+    })).optional().default([]).describe("Method-scoped suppressions with mandatory reasons.")
+}, async ({ work_item_id, skip_checks = [], suppressions = [] }) => {
+    const inputChars = JSON.stringify({ work_item_id, skip_checks, suppressions }).length;
     const wsRoot = getWorkspaceRoot();
     // ── Resolve task folder ────────────────────────────────────────────────
     const registry = readRegistry();
@@ -3559,10 +3585,15 @@ server.tool("run_pre_pr_checks", "Full-spectrum PR review system — runs BEFORE
                     const byClause = derivedMatch[1].toLowerCase();
                     if (!byClause.includes("tenantid") && !byClause.includes("tenant")) {
                         let suppressionReason = "";
-                        for (let i = Math.max(0, idx - 5); i < idx; i++) {
-                            const match = f.lines[i].match(/@TenantScopeException\s*\(\s*"([^"]+)"\s*\)/i);
-                            if (match)
-                                suppressionReason = match[1];
+                        const explicitSup = suppressions.find(s => s.check === "TENANT_ISOLATION" && (s.method === derivedMatch[0] || s.method.endsWith(`.${derivedMatch[0]}`)));
+                        if (explicitSup)
+                            suppressionReason = explicitSup.reason;
+                        else {
+                            for (let i = Math.max(0, idx - 5); i < idx; i++) {
+                                const match = f.lines[i].match(/@TenantScopeException\s*\(\s*"([^"]+)"\s*\)/i);
+                                if (match)
+                                    suppressionReason = match[1];
+                            }
                         }
                         if (suppressionReason) {
                             p1Suppressed.push({ file: f.file_path, line: idx + 1, reason: suppressionReason, method: derivedMatch[0] });
@@ -3586,13 +3617,24 @@ server.tool("run_pre_pr_checks", "Full-spectrum PR review system — runs BEFORE
                 const queryBlock = f.lines.slice(annotIdx, annotIdx + 5).join(" ");
                 if (!/tenantId|tenant_id|:tenantId/i.test(queryBlock)) {
                     let suppressionReason = "";
-                    for (let i = Math.max(0, annotIdx - 5); i < annotIdx; i++) {
-                        const match = f.lines[i].match(/@TenantScopeException\s*\(\s*"([^"]+)"\s*\)/i);
-                        if (match)
-                            suppressionReason = match[1];
+                    let queryMethodName = "";
+                    const methodDeclMatch = queryBlock.match(/(?:List|Optional|Page|long|int|boolean|void|[A-Z]\w+)\s+(\w+)\s*\(/);
+                    if (methodDeclMatch)
+                        queryMethodName = methodDeclMatch[1];
+                    if (queryMethodName) {
+                        const explicitSup = suppressions.find(s => s.check === "TENANT_ISOLATION" && (s.method === queryMethodName || s.method.endsWith(`.${queryMethodName}`)));
+                        if (explicitSup)
+                            suppressionReason = explicitSup.reason;
+                    }
+                    if (!suppressionReason) {
+                        for (let i = Math.max(0, annotIdx - 5); i < annotIdx; i++) {
+                            const match = f.lines[i].match(/@TenantScopeException\s*\(\s*"([^"]+)"\s*\)/i);
+                            if (match)
+                                suppressionReason = match[1];
+                        }
                     }
                     if (suppressionReason) {
-                        p1Suppressed.push({ file: f.file_path, line: annotIdx + 1, reason: suppressionReason, method: "@Query method" });
+                        p1Suppressed.push({ file: f.file_path, line: annotIdx + 1, reason: suppressionReason, method: queryMethodName || "@Query method" });
                     }
                     else {
                         p1Findings.push({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "secufusion-mcp",
-  "version": "1.1.0",
+  "version": "1.2.1",
   "type": "module",
   "description": "SecuFusion MCP server - developer workflow tooling with guardrails",
   "main": "index.js",