secufusion-mcp 1.2.2 → 1.2.4

package/index.js

@@ -638,8 +638,19 @@ server.tool("manage_task", "Manages structured task records in .secufusion/tasks
         return appendTelemetry({ isError: true, content: [{ type: "text", text: `ERROR: Task WI-${work_item_id} not found. Call action=initialize first.\n\nExpected folder: ${dir}` }] }, inputChars);
     }
     if (action === "read") {
-        const full = { spec: readJson(specPath), progress: readJson(progressPath), decisions: readJson(decisionsPath), files_touched: readJson(filesPath), scenarios: readJson(scenariosPath) };
-        return appendTelemetry({ content: [{ type: "text", text: JSON.stringify(full, null, 2) }] }, inputChars);
+        const specObj = readJson(specPath) || {};
+        const decisions = readJson(decisionsPath) || [];
+        const files = readJson(filesPath) || [];
+        const scenarios = readJson(scenariosPath) || [];
+        let out = `## Task ${work_item_id} (Thin Index)\n\n`;
+        out += `**Title:** ${specObj.title || 'unknown'}\n\n`;
+        out += `To optimize context, full task JSON is not returned. Use \`view_file\` on the following absolute paths if you need details:\n`;
+        out += `- **Spec**: ${specPath}\n`;
+        out += `- **Progress**: ${progressPath}\n`;
+        out += `- **Decisions** (${decisions.length}): ${decisionsPath}\n`;
+        out += `- **Files Touched** (${files.length}): ${filesPath}\n`;
+        out += `- **Scenarios** (${scenarios.length}): ${scenariosPath}\n`;
+        return appendTelemetry({ content: [{ type: "text", text: out }] }, inputChars);
     }
     if (action === "read_summary") {
         const spec = readJson(specPath) || {};
@@ -2136,7 +2147,13 @@ server.tool("prime_session", "Hyper-efficient session startup — combines Phase
         if (pending.length > 0) {
             out += `**Pending ACs:**\n${pending.map(ac => `  - [ ] ${ac}`).join("\n")}\n`;
         }
-        out += "\n";
+        out += "\n### Artifact Pointers\n";
+        out += `Use \`view_file\` on these absolute paths to read full task JSON data:\n`;
+        out += `- **Spec**: ${path.join(taskDir, "spec.json")}\n`;
+        out += `- **Progress**: ${path.join(taskDir, "progress.json")}\n`;
+        out += `- **Decisions**: ${path.join(taskDir, "decisions.json")}\n`;
+        out += `- **Files Touched**: ${path.join(taskDir, "files-touched.json")}\n`;
+        out += `- **Scenarios**: ${path.join(taskDir, "scenarios.json")}\n\n`;
     }
     else {
         out += `⚠️ No active task found for ${work_item_id}. Call manage_task(initialize) to create it.\n\n`;
@@ -2689,801 +2706,16 @@ server.tool("run_pre_pr_checks_with_reviewer_agent", "Unified, single-call PR re
         reason: z.string().describe("Mandatory justification for suppression")
     })).optional().default([]).describe("Method-scoped suppressions with mandatory reasons.")
 }, async ({ work_item_id, skip_checks = [], suppressions = [] }) => {
-    const inputChars = JSON.stringify({ work_item_id, skip_checks, suppressions }).length;
-    const wsRoot = getWorkspaceRoot();
-    const startTime = Date.now();
-    // ══════════════════════════════════════════════════════════════════════
-    // SETUP — resolve task folder and read all task brain files once
-    // ══════════════════════════════════════════════════════════════════════
-    // ── Resolve task folder ────────────────────────────────────────────────
-    const registry = readRegistry();
-    const taskEntry = registry.find(r => r["work_item_id"] === work_item_id);
-    let taskDir = null;
-    if (taskEntry?.["folder_name"]) {
-        taskDir = path.resolve(wsRoot, `.secufusion/tasks/${taskEntry["folder_name"]}`);
-    }
-    if (!taskDir || !fs.existsSync(taskDir)) {
-        const tasksBase = path.resolve(wsRoot, ".secufusion/tasks");
-        if (fs.existsSync(tasksBase)) {
-            const folders = fs.readdirSync(tasksBase);
-            const match = folders.find(f => f.startsWith(work_item_id));
-            if (match)
-                taskDir = path.join(tasksBase, match);
-        }
-    }
-    if (!taskDir || !fs.existsSync(taskDir)) {
-        return appendTelemetry({
-            isError: true,
-            content: [{ type: "text", text: `❌ Task folder not found for ${work_item_id}. Call manage_task(initialize) first.` }]
-        }, inputChars);
-    }
-    const taskSpec = (() => { try {
-        return JSON.parse(readFileSafe(path.join(taskDir, "spec.json")) || "{}");
-    }
-    catch {
-        return {};
-    } })();
-    const taskProgress = (() => { try {
-        return JSON.parse(readFileSafe(path.join(taskDir, "progress.json")) || "{}");
-    }
-    catch {
-        return {};
-    } })();
-    const decisions = (() => { try {
-        return JSON.parse(readFileSafe(path.join(taskDir, "decisions.json")) || "[]");
-    }
-    catch {
-        return [];
-    } })();
-    const filesTouched = (() => { try {
-        return JSON.parse(readFileSafe(path.join(taskDir, "files-touched.json")) || "[]");
-    }
-    catch {
-        return [];
-    } })();
-    const scenarios = (() => { try {
-        return JSON.parse(readFileSafe(path.join(taskDir, "scenarios.json")) || "[]");
-    }
-    catch {
-        return [];
-    } })();
-    if (filesTouched.length === 0) {
-        return appendTelemetry({
-            content: [{ type: "text", text: `⚠️ No files logged for ${work_item_id}. Log files with manage_task(log_file_touched) before running checks.` }]
-        }, inputChars);
-    }
-    // ── Load project spec (golden rules + rejected patterns) ───────────────
-    const PROJ_SPEC_FILE = ".secufusion-project-spec.json";
-    const specCandidates = [
-        path.resolve(path.dirname(new URL(import.meta.url).pathname.replace(/^\/([A-Z]:)/, "$1")), PROJ_SPEC_FILE),
-        path.resolve(wsRoot, PROJ_SPEC_FILE),
-    ];
-    let projectSpec = null;
-    for (const c of specCandidates) {
-        if (fs.existsSync(c)) {
-            try {
-                projectSpec = JSON.parse(readFileSafe(c) || "null");
-            }
-            catch { }
-            break;
-        }
-    }
-    const goldenRules = projectSpec?.golden_rules || {};
-    const codingStyle = goldenRules.coding_style || {};
-    const authorityRules = goldenRules.authority_rules || [];
-    let rejectedPatterns = [];
     try {
-        rejectedPatterns = JSON.parse(readFileSafe(resolve(".rejected-patterns.json")) || "[]");
-    }
-    catch { }
-    const fileRecords = filesTouched.map(ft => {
-        const abs = path.resolve(wsRoot, ft.file_path);
-        const raw = readFileSafe(abs) || "";
-        const ext = path.extname(ft.file_path).toLowerCase();
-        const base = path.basename(ft.file_path);
-        return {
-            file_path: ft.file_path,
-            change_summary: ft.change_summary,
-            content: raw,
-            lines: raw.split("\n"),
-            ext,
-            isJava: ext === ".java",
-            isTS: ext === ".ts" || ext === ".tsx",
-            isRepo: /Repository/i.test(base) && ext === ".java",
-            isKafka: raw.includes("@KafkaListener"),
-            isMigration: ft.file_path.includes("migration") || ft.file_path.includes("flyway") || ext === ".sql",
-            isController: /Controller/i.test(base) && ext === ".java",
-            isService: /Service/i.test(base) && ext === ".java",
-            isTest: /test|spec/i.test(ft.file_path),
-            exists: fs.existsSync(abs),
-        };
-    });
-    const mechanical = [];
-    const passResults = [];
-    const reviewComments = [];
-    let aiCost = 0;
-    // ══════════════════════════════════════════════════════════════════════
-    // TIER 1 — MECHANICAL CHECKS (P1–P5)
-    // ══════════════════════════════════════════════════════════════════════
-    // ── P1: TENANT_ISOLATION ──────────────────────────────────────────────
-    const p1 = [];
-    const p1Suppressed = [];
-    if (!skip_checks.includes("tenant_isolation")) {
-        for (const f of fileRecords.filter(f => f.isRepo)) {
-            const queryAnnotationLines = [];
-            f.lines.forEach((line, idx) => {
-                if (/@Query\s*\(/i.test(line))
-                    queryAnnotationLines.push(idx);
-            });
-            f.lines.forEach((line, idx) => {
-                const dm = line.match(/(?:find|delete|count|exists)\w+By(\w+)/);
-                if (dm && !dm[1].toLowerCase().includes("tenant")) {
-                    let suppressionReason = "";
-                    const explicitSup = suppressions.find(s => s.check === "TENANT_ISOLATION" && (s.method === dm[0] || s.method.endsWith(`.${dm[0]}`)));
-                    if (explicitSup)
-                        suppressionReason = explicitSup.reason;
-                    else {
-                        for (let i = Math.max(0, idx - 5); i < idx; i++) {
-                            const match = f.lines[i].match(/@TenantScopeException\s*\(\s*"([^"]+)"\s*\)/i);
-                            if (match)
-                                suppressionReason = match[1];
-                        }
-                    }
-                    if (suppressionReason) {
-                        p1Suppressed.push({ file: f.file_path, line: idx + 1, reason: suppressionReason, method: dm[0] });
-                    }
-                    else {
-                        p1.push({ check: "TENANT_ISOLATION", severity: "BLOCKING", file: f.file_path, line: idx + 1,
-                            message: `Derived query \`${line.trim()}\` does not filter by tenantId`,
-                            suggestion: "Rename to include AndTenantId, e.g. findByIdAndTenantId(UUID id, UUID tenantId)" });
-                    }
-                }
-            });
-            queryAnnotationLines.forEach(ai => {
-                const block = f.lines.slice(ai, ai + 5).join(" ");
-                if (!/tenantId|tenant_id|:tenantId/i.test(block)) {
-                    let suppressionReason = "";
-                    let queryMethodName = "";
-                    const methodDeclMatch = block.match(/(?:List|Optional|Page|long|int|boolean|void|[A-Z]\w+)\s+(\w+)\s*\(/);
-                    if (methodDeclMatch)
-                        queryMethodName = methodDeclMatch[1];
-                    if (queryMethodName) {
-                        const explicitSup = suppressions.find(s => s.check === "TENANT_ISOLATION" && (s.method === queryMethodName || s.method.endsWith(`.${queryMethodName}`)));
-                        if (explicitSup)
-                            suppressionReason = explicitSup.reason;
-                    }
-                    if (!suppressionReason) {
-                        for (let i = Math.max(0, ai - 5); i < ai; i++) {
-                            const match = f.lines[i].match(/@TenantScopeException\s*\(\s*"([^"]+)"\s*\)/i);
-                            if (match)
-                                suppressionReason = match[1];
-                        }
-                    }
-                    if (suppressionReason) {
-                        p1Suppressed.push({ file: f.file_path, line: ai + 1, reason: suppressionReason, method: queryMethodName || "@Query method" });
-                    }
-                    else {
-                        p1.push({ check: "TENANT_ISOLATION", severity: "BLOCKING", file: f.file_path, line: ai + 1,
-                            message: `@Query at line ${ai + 1} has no tenantId filter`,
-                            suggestion: "Add WHERE e.tenantId = :tenantId to the JPQL/SQL query" });
-                    }
-                }
-            });
-        }
-    }
-    mechanical.push(...p1);
-    passResults.push({ name: "TENANT_ISOLATION", skipped: skip_checks.includes("tenant_isolation"), passed: p1.length === 0, count: p1.length, suppressedCount: p1Suppressed.length });
-    // Auto-log suppressions to decisions.json
-    if (p1Suppressed.length > 0) {
-        const tasksRoot = resolve(TASKS_DIR);
-        const dir = resolveTaskFolder(work_item_id, tasksRoot);
-        if (dir) {
-            const decisionsPath = path.join(dir, "decisions.json");
-            const decisions = readJson(decisionsPath) || [];
-            let modified = false;
-            for (const sup of p1Suppressed) {
-                const desc = `Exempted TENANT_ISOLATION on ${sup.method}`;
-                if (!decisions.some(d => d.decision === desc)) {
-                    decisions.push({
-                        id: decisions.length + 1,
-                        decision: desc,
-                        rationale: sup.reason,
-                        logged_at: new Date().toISOString()
-                    });
-                    modified = true;
-                }
-            }
-            if (modified)
-                writeFile(decisionsPath, JSON.stringify(decisions, null, 2));
-        }
+        const cp = require('child_process');
+        const scriptPath = require('path').resolve(__dirname, 'scripts/sfn-pr-check.js');
+        const args = JSON.stringify({ work_item_id, skip_checks, suppressions });
+        const output = cp.execFileSync(process.execPath, [scriptPath, args], { encoding: 'utf-8' });
+        return { content: [{ type: 'text', text: output }] };
     }
-    // ── P2: N_PLUS_ONE ────────────────────────────────────────────────────
-    const p2 = [];
-    if (!skip_checks.includes("n_plus_one")) {
-        for (const f of fileRecords.filter(f => f.isJava || f.isTS)) {
-            let depth = 0, inLoop = false, loopDepth = -1;
-            f.lines.forEach((line, idx) => {
-                const o = (line.match(/\{/g) || []).length;
-                const c = (line.match(/\}/g) || []).length;
-                if (/\b(for|forEach|stream\(\)|\.map\(|\.forEach\(|while\s*\()/i.test(line) && !inLoop) {
-                    inLoop = true;
-                    loopDepth = depth;
-                }
-                if (inLoop) {
-                    const rm = /\.(findById|findByIdAndTenantId|findAll|findAllBy|save|saveAll|delete|deleteById|existsById|count)\s*\(/.exec(line);
-                    if (rm)
-                        p2.push({ check: "N_PLUS_ONE", severity: "BLOCKING", file: f.file_path, line: idx + 1,
-                            message: `Repository call \`${rm[0]}\` inside a loop`,
-                            suggestion: "Extract IDs first, then use findAllById() / saveAll() outside the loop" });
-                }
-                depth += o - c;
-                if (inLoop && depth <= loopDepth) {
-                    inLoop = false;
-                    loopDepth = -1;
-                }
-            });
-        }
-    }
-    mechanical.push(...p2);
-    passResults.push({ name: "N_PLUS_ONE", skipped: skip_checks.includes("n_plus_one"), passed: p2.length === 0, count: p2.length });
-    // ── P3: MISSING_INDEX ─────────────────────────────────────────────────
-    const p3 = [];
-    if (!skip_checks.includes("missing_index")) {
-        const queryCols = [];
-        for (const f of fileRecords.filter(f => f.isRepo)) {
-            f.lines.forEach((line, idx) => {
-                const dm = line.match(/(?:find|delete|count|exists)\w+By([\w]+)/);
-                if (dm) {
-                    for (const p of dm[1].replace(/And|Or/g, ",").split(",")) {
-                        const col = p.charAt(0).toLowerCase() + p.slice(1);
-                        if (!["tenantId", "id"].includes(col))
-                            queryCols.push({ col, file: f.file_path, line: idx + 1 });
-                    }
-                }
-                const wm = line.match(/WHERE\s+\w+\.(\w+)\s*=/gi);
-                if (wm)
-                    for (const w of wm) {
-                        const cm = w.match(/\.(\w+)\s*=/i);
-                        if (cm && !["tenantId", "id", "tenant_id"].includes(cm[1]))
-                            queryCols.push({ col: cm[1], file: f.file_path, line: idx + 1 });
-                    }
-            });
-        }
-        const migrationContent = fileRecords.filter(f => f.isMigration).map(f => f.content.toLowerCase()).join("\n");
-        if (fileRecords.some(f => f.isMigration)) {
-            for (const { col, file, line } of queryCols) {
-                const snake = col.replace(/([A-Z])/g, "_$1").toLowerCase();
-                if (!new RegExp(`create.*index.*(${snake}|${col.toLowerCase()})`, "i").test(migrationContent)) {
-                    p3.push({ check: "MISSING_INDEX", severity: "WARNING", file, line,
-                        message: `Query on column \`${col}\` has no CREATE INDEX in migration`,
-                        suggestion: `Add: CREATE INDEX idx_<table>_${snake} ON <table>(${snake});` });
-                }
-            }
-        }
-    }
-    mechanical.push(...p3);
-    passResults.push({ name: "MISSING_INDEX", skipped: skip_checks.includes("missing_index"), passed: p3.length === 0, count: p3.length });
-    // ── P4: KAFKA_SYNC ────────────────────────────────────────────────────
-    const p4 = [];
-    if (!skip_checks.includes("kafka_sync")) {
-        for (const f of fileRecords.filter(f => f.isKafka)) {
-            let inListener = false, lDepth = 0;
-            f.lines.forEach((line, idx) => {
-                if (/@KafkaListener/.test(line)) {
-                    inListener = true;
-                    lDepth = 0;
-                }
-                if (inListener) {
-                    lDepth += (line.match(/\{/g) || []).length;
-                    lDepth -= (line.match(/\}/g) || []).length;
-                    const sm = /\.(save|saveAll|findById|findAll|delete|deleteById|restTemplate|webClient|getForObject|postForObject|exchange)\s*\(/.exec(line);
-                    if (sm) {
-                        const isAsync = /@Async|CompletableFuture|executorService|threadPool/i.test(f.lines.slice(Math.max(0, idx - 3), idx + 1).join(" "));
-                        if (!isAsync)
-                            p4.push({ check: "KAFKA_SYNC", severity: "BLOCKING", file: f.file_path, line: idx + 1,
-                                message: `Sync call \`${sm[0]}\` inside @KafkaListener — blocks consumer thread`,
-                                suggestion: "Offload to @Async method or a dedicated ExecutorService" });
-                    }
-                    if (lDepth <= 0 && lDepth !== 0)
-                        inListener = false;
-                }
-            });
-        }
-    }
-    mechanical.push(...p4);
-    passResults.push({ name: "KAFKA_SYNC", skipped: skip_checks.includes("kafka_sync"), passed: p4.length === 0, count: p4.length });
-    // ── P5: EARLY_RETURN ──────────────────────────────────────────────────
-    // Algorithm: collect all return lines per method via flush-on-close.
-    // Every return except the last in a method body is an early return.
-    const p5 = [];
-    if (!skip_checks.includes("early_return")) {
-        for (const f of fileRecords.filter(f => f.isJava || f.isTS)) {
-            let depth = 0, methodDepth = -1, methodStart = -1, inMethod = false, mName = "";
-            let mReturns = [], mBody = [];
-            const flush = () => {
-                if (mReturns.length > 1) {
-                    for (const ri of mReturns.slice(0, -1)) {
-                        p5.push({ check: "EARLY_RETURN", severity: "BLOCKING", file: f.file_path, line: ri + 1,
-                            message: `Early return in \`${mName}()\` — violates single-exit rule`,
-                            suggestion: "Declare result at top, use nested if blocks, single return at method end" });
-                    }
-                }
-                else if (mReturns.length === 1) {
-                    const ri = mReturns[0];
-                    const after = f.lines.slice(ri + 1).map((l, o) => ({ l: l.trim(), ai: ri + 1 + o })).filter(({ l }) => l.length > 0 && l !== "}" && l !== "};" && !l.startsWith("//"));
-                    if (after.length > 0 && mBody.length > 0 && after[0].ai <= mBody[mBody.length - 1]) {
-                        p5.push({ check: "EARLY_RETURN", severity: "BLOCKING", file: f.file_path, line: ri + 1,
-                            message: `Early return in \`${mName}()\` — violates single-exit rule`,
-                            suggestion: "Declare result at top, use nested if blocks, single return at method end" });
-                    }
-                }
-                mReturns = [];
-                mBody = [];
-            };
-            f.lines.forEach((line, idx) => {
-                const trimmed = line.trim();
-                const o = (line.match(/\{/g) || []).length;
-                const c = (line.match(/\}/g) || []).length;
-                const jm = line.match(/(?:public|private|protected|static)\s+\S+\s+(\w+)\s*\(/);
-                const tm = line.match(/(?:function\s+(\w+)|(?:const|let|var)\s+(\w+)\s*=\s*(?:async\s*)?\(|async\s+(\w+)\s*\()/);
-                if ((f.isJava ? jm : tm) && !inMethod) {
-                    inMethod = true;
-                    methodDepth = depth;
-                    methodStart = idx;
-                    mReturns = [];
-                    mBody = [];
-                    mName = jm?.[1] || tm?.[1] || tm?.[2] || tm?.[3] || "unknown";
-                }
-                depth += o - c;
-                if (inMethod && idx > methodStart) {
-                    if (trimmed.length > 0)
-                        mBody.push(idx);
-                    if (/\breturn\b/.test(line) && !/^\s*\/\//.test(line))
-                        mReturns.push(idx);
-                    if (depth <= methodDepth) {
-                        flush();
-                        inMethod = false;
-                        methodDepth = -1;
-                    }
-                }
-            });
-        }
-    }
-    mechanical.push(...p5);
-    passResults.push({ name: "EARLY_RETURN", skipped: skip_checks.includes("early_return"), passed: p5.length === 0, count: p5.length });
-    // ── Tier 1 gate ────────────────────────────────────────────────────────
-    const blockingMechanical = mechanical.filter(f => f.severity === "BLOCKING");
-    const tier1Passed = blockingMechanical.length === 0;
-    // ══════════════════════════════════════════════════════════════════════
-    // TIER 2 — AI FILE REVIEWER (Pass 6)
-    // Reads each changed file, applies architectural heuristics.
-    // Only runs if Tier 1 passes.
-    // ══════════════════════════════════════════════════════════════════════
-    const AI_COST_PER_100 = 0.0008;
-    if (tier1Passed && !skip_checks.includes("ai_review")) {
-        for (const f of fileRecords) {
-            aiCost += (f.lines.length / 100) * AI_COST_PER_100;
-            // Obvious comments
-            const obviousComments = f.lines.filter(l => /\/\/\s*(get the|set the|loop|return|initialize|this method|this function|create a|update the)/i.test(l));
-            if (obviousComments.length > 0) {
-                reviewComments.push({ tier: 2, file: f.file_path, severity: "WARNING", area: "CODE_QUALITY",
-                    title: `${obviousComments.length} obvious comment(s)`,
-                    detail: "Comments explain WHY, not WHAT. Remove or replace with architectural rationale.",
-                    action: "Replace // Get the user with // Required because tenant context is not available in JWT claims" });
-            }
-            // Work Item IDs in comments
-            const ticketIdComments = f.lines.map((l, i) => ({ l, i })).filter(({ l }) => /(\/\/|\/\*|\*)\s*.*(?:BUG|WI)-\d+/i.test(l));
-            if (ticketIdComments.length > 0) {
-                reviewComments.push({ tier: 2, file: f.file_path, line: ticketIdComments[0].i + 1, severity: "CRITICAL", area: "CODE_QUALITY",
-                    title: "Ticket ID in code comment",
-                    detail: `Line ${ticketIdComments[0].i + 1} contains a work item ID: \`${ticketIdComments[0].l.trim()}\``,
-                    action: "Remove the ticket ID. Explain the durable WHY instead." });
-            }
-            // Hardcoded URLs/IPs
-            const hardcoded = f.lines.map((l, i) => ({ l, i })).filter(({ l }) => /https?:\/\/[0-9]{1,3}\.[0-9]{1,3}|localhost:[0-9]{4}|uat\.|staging\.|prod\./i.test(l) && !/\/\//.test(l));
-            if (hardcoded.length > 0) {
-                reviewComments.push({ tier: 2, file: f.file_path, line: hardcoded[0].i + 1, severity: "CRITICAL", area: "SECURITY",
-                    title: "Hardcoded URL/IP detected",
-                    detail: `Line ${hardcoded[0].i + 1}: \`${hardcoded[0].l.trim()}\``,
-                    action: "Move to application.properties / environment variables immediately" });
-            }
-            // Missing @Transactional(readOnly=true) on service GET methods
-            if (f.isService && !f.isTest) {
-                const getters = f.lines.map((l, i) => ({ l, i })).filter(({ l }) => /public.*(?:List|Page|Optional|DTO|Response)\s+\w+\s*\(/.test(l));
-                for (const { l, i } of getters) {
-                    const prev = f.lines.slice(Math.max(0, i - 3), i).join(" ");
-                    if (!/readOnly.*true/.test(prev)) {
-                        reviewComments.push({ tier: 2, file: f.file_path, line: i + 1, severity: "WARNING", area: "PERFORMANCE",
-                            title: "Missing @Transactional(readOnly = true)",
-                            detail: `\`${(l.match(/\w+\s*\(/) || [""])[0].trim()}\` returns data without readOnly — allows dirty reads and skips DB optimizations`,
-                            action: "Add @Transactional(readOnly = true) above this method" });
-                        break;
-                    }
-                }
-            }
-            // Missing @PreAuthorize on controller endpoints
-            if (f.isController && !f.isTest) {
-                const endpoints = f.lines.map((l, i) => ({ l, i })).filter(({ l }) => /@(GetMapping|PostMapping|PutMapping|DeleteMapping|PatchMapping)/.test(l));
-                for (const { l, i } of endpoints) {
-                    const prev = f.lines.slice(Math.max(0, i - 5), i).join(" ");
-                    if (!/PreAuthorize|permitAll/.test(prev)) {
-                        reviewComments.push({ tier: 2, file: f.file_path, line: i + 1, severity: "CRITICAL", area: "SECURITY",
-                            title: "Endpoint missing @PreAuthorize",
-                            detail: `Endpoint at line ${i + 1} has no @PreAuthorize annotation`,
-                            action: "Add @PreAuthorize(\"hasAuthority('domain.action')\") above the mapping" });
-                    }
-                }
-            }
-            // Debug statements in production code
-            if (!f.isTest) {
-                const debug = f.lines.map((l, i) => ({ l, i })).filter(({ l }) => /console\.log|System\.out\.print|e\.printStackTrace/.test(l));
-                if (debug.length > 0) {
-                    reviewComments.push({ tier: 2, file: f.file_path, line: debug[0].i + 1, severity: "WARNING", area: "CODE_QUALITY",
-                        title: "Debug statement in production code",
-                        detail: `\`${debug[0].l.trim()}\` at line ${debug[0].i + 1}`,
-                        action: "Replace with SLF4J log.debug() or remove entirely" });
-                }
-            }
-            // Exception swallowing
-            if (f.isJava) {
-                f.lines.forEach((line, idx) => {
-                    if (/catch\s*\(\s*Exception\s+/.test(line)) {
-                        const block = f.lines.slice(idx, idx + 5).join(" ");
-                        if (!/log\.|logger\.|throw/.test(block)) {
-                            reviewComments.push({ tier: 2, file: f.file_path, line: idx + 1, severity: "WARNING", area: "ERROR_HANDLING",
-                                title: "Catch-all exception may be swallowed",
-                                detail: `catch(Exception) at line ${idx + 1} has no log or rethrow`,
-                                action: "Log with context: log.error(\"[WI-xxx] failed: {}\", e.getMessage(), e) or rethrow as domain exception" });
-                        }
-                    }
-                });
-            }
-            // TypeScript any overuse
-            if (f.isTS && !f.isTest) {
-                const anyLines = f.lines.filter(l => /:\s*any\b/.test(l) && !/\/\//.test(l));
-                if (anyLines.length > 2) {
-                    reviewComments.push({ tier: 2, file: f.file_path, severity: "WARNING", area: "TYPE_SAFETY",
-                        title: `${anyLines.length} uses of \`: any\``,
-                        detail: "Type safety defeated. `any` propagates silently through the call chain.",
-                        action: "Replace with explicit interfaces or `unknown` with a type guard" });
-                }
-            }
-            // Missing Flyway for @Entity
-            if (f.isJava && /@Entity/.test(f.content) && !f.isTest && !fileRecords.some(r => r.isMigration)) {
-                reviewComments.push({ tier: 2, file: f.file_path, severity: "CRITICAL", area: "DATABASE",
-                    title: "@Entity change with no Flyway migration in PR",
-                    detail: "Every JPA entity schema change requires a Flyway migration",
-                    action: "Create src/main/resources/db/migration/Vxxx__describe_change.sql and log it with manage_task(log_file_touched)" });
-            }
-            // Cross-service call timeout
-            if (f.isJava && /RestTemplate|WebClient|FeignClient/i.test(f.content) && !/connectTimeout|readTimeout|timeout/i.test(f.content)) {
-                reviewComments.push({ tier: 2, file: f.file_path, severity: "WARNING", area: "RESILIENCE",
-                    title: "Cross-service call with no timeout",
-                    detail: "RestTemplate/WebClient/FeignClient used without connectTimeout + readTimeout",
-                    action: "Configure explicit timeouts. For WebClient: .responseTimeout(Duration.ofSeconds(5))" });
-            }
-            // Praise: proper SLF4J logging
-            if (/log\.(info|debug|warn|error)\(/.test(f.content) && !f.isTest) {
-                reviewComments.push({ tier: 2, file: f.file_path, severity: "PRAISE", area: "CODE_QUALITY",
-                    title: "Proper SLF4J logging observed", detail: "" });
-            }
-        }
-    }
-    // ── Tier 2 gate ────────────────────────────────────────────────────────
-    const tier2Blocking = reviewComments.filter(c => c.tier === 2 && c.severity === "CRITICAL");
-    const tier2Passed = tier1Passed && tier2Blocking.length === 0;
-    // ══════════════════════════════════════════════════════════════════════
-    // TIER 3 — CONTEXT REVIEWER
-    // Cross-references task brain + project-spec + file contents.
-    // Only runs if both Tier 1 and Tier 2 pass.
-    // ══════════════════════════════════════════════════════════════════════
-    if (tier2Passed && !skip_checks.includes("context_review")) {
-        // ── AC Coverage ────────────────────────────────────────────────────
-        const allACs = [...new Set([
-                ...(taskSpec.acceptance_criteria || []),
-                ...(taskProgress.completed_acs || []),
-                ...(taskProgress.pending_acs || []),
-            ])];
-        const changeCorpus = [
-            ...fileRecords.map(f => f.file_path + " " + f.change_summary),
-            ...decisions.map(d => (d.decision || "") + " " + (d.rationale || "")),
-        ].join(" ").toLowerCase();
-        for (const ac of allACs) {
-            if (!ac?.trim())
-                continue;
-            const kws = ac.toLowerCase().split(/\s+/).filter(w => w.length > 3 && !/^(must|shall|should|the|and|for|with|that|this|when|from|into|not|does|will|have|been|each|only|any|all)$/.test(w));
-            const cov = kws.length > 0 ? kws.filter(kw => changeCorpus.includes(kw)).length / kws.length : 1;
-            if (cov < 0.25) {
-                reviewComments.push({ tier: 3, severity: "CRITICAL", area: "AC_COVERAGE",
-                    title: "AC may not be implemented",
-                    detail: `"${ac.substring(0, 120)}${ac.length > 120 ? "..." : ""}" — no matching file changes or decisions`,
-                    action: "Verify this AC is addressed. If so, enrich the change_summary for the relevant file." });
-            }
-            else if (cov < 0.5) {
-                reviewComments.push({ tier: 3, severity: "WARNING", area: "AC_COVERAGE",
-                    title: "AC has weak coverage signal",
-                    detail: `"${ac.substring(0, 120)}..." — only ${Math.round(cov * 100)}% keyword match in change corpus`,
-                    action: "Confirm AC is satisfied; enrich the file change_summary to improve signal." });
-            }
-        }
-        // Pending ACs
-        if ((taskProgress.pending_acs || []).length > 0) {
-            reviewComments.push({ tier: 3, severity: "CRITICAL", area: "AC_COVERAGE",
-                title: `${taskProgress.pending_acs.length} AC(s) still pending`,
-                detail: taskProgress.pending_acs.map(a => `• ${a}`).join("\n"),
-                action: "Complete all ACs. Call manage_task(update_spec) to move them to completed_acs." });
-        }
-        // ── Decision Drift ─────────────────────────────────────────────────
-        const fileCorpus = fileRecords.map(f => f.file_path + " " + f.change_summary).join(" ").toLowerCase();
-        for (const dec of decisions) {
-            if (!dec.decision || /rollback|strategy|SAFE|RISKY|DANGEROUS/i.test(dec.decision))
-                continue;
-            const kws = dec.decision.toLowerCase().split(/\s+/).filter(w => w.length > 4 && !/^(using|added|decided|chose|going|will|this|that|with|from|into|the|and|for)$/.test(w));
-            const trace = kws.length >= 3 ? kws.filter(kw => fileCorpus.includes(kw)).length / kws.length : 1;
-            if (trace < 0.2) {
-                reviewComments.push({ tier: 3, severity: "WARNING", area: "DECISION_DRIFT",
-                    title: `Decision #${dec.id} not traceable in files touched`,
-                    detail: `"${dec.decision?.substring(0, 120)}"`,
-                    action: "Verify this decision was implemented. Log the file with manage_task(log_file_touched) if missing." });
-            }
-        }
-        // ── Scope Creep ────────────────────────────────────────────────────
-        const specCorpus = [taskSpec.title || "", taskSpec.description || "", ...(taskSpec.acceptance_criteria || []), ...decisions.map(d => (d.decision || "") + " " + (d.rationale || ""))].join(" ").toLowerCase();
-        for (const f of fileRecords.filter(f => !f.isTest)) {
-            const base = path.basename(f.file_path).replace(/\.[^.]+$/, "").toLowerCase();
-            const words = base.replace(/([A-Z])/g, " $1").toLowerCase().trim().split(/[\s_-]+/).filter(w => w.length > 3);
-            if (words.length > 0 && !words.some(w => specCorpus.includes(w))) {
-                reviewComments.push({ tier: 3, file: f.file_path, severity: "INFO", area: "SCOPE_CREEP",
-                    title: "File may be outside task scope",
-                    detail: `\`${f.file_path}\` not mentioned in spec, ACs, or decisions`,
-                    action: "If intentional, add a decision: manage_task(log_decision) explaining the touch." });
-            }
-        }
-        // ── Rejected Patterns ──────────────────────────────────────────────
-        for (const f of fileRecords.filter(f => f.exists)) {
-            for (const rp of rejectedPatterns) {
-                if (!rp.pattern)
-                    continue;
-                const kws = rp.pattern.toLowerCase().split(/\s+/).filter(w => w.length > 4).slice(0, 4);
-                const hits = kws.filter(kw => f.content.toLowerCase().includes(kw)).length;
-                if (kws.length > 0 && hits / kws.length >= 0.75) {
-                    reviewComments.push({ tier: 3, file: f.file_path, severity: "CRITICAL", area: "REJECTED_PATTERNS",
-                        title: "Rejected pattern detected",
-                        detail: `Pattern: "${rp.pattern}"\nReason: ${rp.reason || "See .rejected-patterns.json"} (category: ${rp.category || "unknown"})`,
-                        action: "This pattern was explicitly rejected. Refactor before merging." });
-                }
-            }
-        }
-        // ── Test Coverage ──────────────────────────────────────────────────
-        const testFiles = fileRecords.filter(f => f.isTest);
-        const srcFiles = fileRecords.filter(f => !f.isTest && (f.isJava || f.isTS));
-        if (srcFiles.length > 0 && testFiles.length === 0) {
-            reviewComments.push({ tier: 3, severity: "CRITICAL", area: "TEST_COVERAGE",
-                title: "No test files in PR",
-                detail: `${srcFiles.length} source file(s) changed, zero test files in files-touched`,
-                action: "Add unit and integration tests. Log them with manage_task(log_file_touched)." });
-        }
-        else if (testFiles.length > 0) {
-            reviewComments.push({ tier: 3, severity: "PRAISE", area: "TEST_COVERAGE",
-                title: `${testFiles.length} test file(s) included`,
-                detail: testFiles.map(f => `• ${f.file_path}`).join("\n") });
-        }
-        if (scenarios.filter(s => s.type === "unit").length === 0 && srcFiles.length > 0) {
-            reviewComments.push({ tier: 3, severity: "WARNING", area: "TEST_COVERAGE",
-                title: "No unit test scenarios logged",
-                detail: "manage_task(add_scenario, type='unit') was never called",
-                action: "Call suggest_test_scenarios to auto-generate scenarios from ACs." });
-        }
-        // ── Golden Rules ───────────────────────────────────────────────────
-        // @PreAuthorize on controllers
-        for (const f of fileRecords.filter(f => f.isController && !f.isTest)) {
-            const hasAuth = f.content.includes("@PreAuthorize");
-            const hasEndpoints = /@(GetMapping|PostMapping|PutMapping|DeleteMapping|PatchMapping)/.test(f.content);
-            if (hasEndpoints && hasPreAuth(f.content)) {
-                reviewComments.push({ tier: 3, file: f.file_path, severity: "PRAISE", area: "GOLDEN_RULES",
-                    title: "@PreAuthorize correctly applied", detail: `\`${f.file_path}\`` });
-            }
-        }
-        // Entity + migration praise
-        const entityFiles = fileRecords.filter(f => f.isJava && /@Entity/.test(f.content) && !f.isTest);
-        const migFiles = fileRecords.filter(f => f.isMigration);
-        if (entityFiles.length > 0 && migFiles.length > 0) {
-            reviewComments.push({ tier: 3, severity: "PRAISE", area: "GOLDEN_RULES",
-                title: "@Entity change has matching Flyway migration",
-                detail: migFiles.map(f => path.basename(f.file_path)).join(", ") });
-        }
-        // Decision quality praise
-        if (decisions.length >= 3) {
-            reviewComments.push({ tier: 3, severity: "PRAISE", area: "DECISIONS",
-                title: `${decisions.length} architectural decisions logged`,
-                detail: "Good decision hygiene — future agents will benefit from this audit trail." });
-        }
-        if (scenarios.length >= 5) {
-            reviewComments.push({ tier: 3, severity: "PRAISE", area: "TEST_COVERAGE",
-                title: `${scenarios.length} test scenarios logged`,
-                detail: "Comprehensive scenario coverage documented." });
-        }
-    }
-    // ── Helper (moved inside scope) ────────────────────────────────────────
-    function hasPreAuth(content) { return content.includes("@PreAuthorize"); }
-    // ══════════════════════════════════════════════════════════════════════
-    // VERDICT — unified across all three tiers
-    // ══════════════════════════════════════════════════════════════════════
-    const allCriticals = [
-        ...blockingMechanical,
-        ...reviewComments.filter(c => c.severity === "CRITICAL"),
-    ];
-    const allWarnings = [
-        ...mechanical.filter(f => f.severity === "WARNING"),
-        ...reviewComments.filter(c => c.severity === "WARNING"),
-    ];
-    const allInfos = reviewComments.filter(c => c.severity === "INFO");
-    const allPraises = reviewComments.filter(c => c.severity === "PRAISE");
-    let verdict;
-    let verdictReason;
-    if (allCriticals.length > 0) {
-        verdict = "❌ CHANGES_REQUESTED";
-        verdictReason = `${allCriticals.length} blocking finding(s) across Tiers 1–3 must be resolved before this PR can merge.`;
-    }
-    else if (allWarnings.length > 3) {
-        verdict = "💬 DISCUSS";
-        verdictReason = `All checks passed. ${allWarnings.length} warnings worth discussing before merge.`;
-    }
-    else if (allWarnings.length > 0) {
-        verdict = "✅ APPROVED";
-        verdictReason = `All checks passed. ${allWarnings.length} minor warning(s) — address at your discretion.`;
-    }
-    else {
-        verdict = "✅ APPROVED";
-        verdictReason = `Full review passed — mechanical checks clean, AI review clean, context review clean.`;
-    }
-    // ══════════════════════════════════════════════════════════════════════
-    // OUTPUT
-    // ══════════════════════════════════════════════════════════════════════
-    const elapsed = ((Date.now() - startTime) / 1000).toFixed(1);
-    const skippedList = skip_checks.length > 0 ? ` (skipped: ${skip_checks.join(", ")})` : "";
-    let out = `## run_pre_pr_checks_with_reviewer_agent — ${work_item_id}\n\n`;
-    out += `📁 **${fileRecords.length} file(s)** reviewed in **${elapsed}s**${skippedList}\n\n`;
-    // Task context strip
-    out += `> 📋 **${taskSpec.title || "(untitled)"}** | `;
-    out += `ACs: ${(taskSpec.acceptance_criteria || []).length} total, ${(taskProgress.completed_acs || []).length} done, ${(taskProgress.pending_acs || []).length} pending | `;
-    out += `Decisions: ${decisions.length} | Scenarios: ${scenarios.length}\n\n`;
-    // ── Tier 1: Mechanical table ───────────────────────────────────────────
-    out += `### 🔩 Tier 1 — Mechanical Checks\n`;
-    out += `| Pass | Check | Status | Issues |\n|---|---|---|---|\n`;
-    for (let i = 0; i < passResults.length; i++) {
-        const p = passResults[i];
-        const icon = p.skipped ? "⏭️ SKIP" : p.passed ? "✅ PASS" : "❌ FAIL";
-        const issueText = p.skipped ? "—" : (p.suppressedCount ? `${p.count} (${p.suppressedCount} suppressed)` : `${p.count}`);
-        out += `| P${i + 1} | ${p.name} | ${icon} | ${issueText} |\n`;
-    }
-    if (blockingMechanical.length > 0) {
-        out += `\n#### ❌ Blocking Mechanical Findings\n`;
-        for (const f of blockingMechanical) {
-            out += `\n**[${f.check}]** \`${f.file}\`${f.line ? ` line ${f.line}` : ""}\n`;
-            out += `> ${f.message}\n> 💡 *${f.suggestion}*\n`;
-        }
-    }
-    if (p1Suppressed.length > 0) {
-        out += `\n#### 🛡️ Suppressed Findings (${p1Suppressed.length})\n`;
-        for (const sup of p1Suppressed) {
-            out += `\n**[TENANT_ISOLATION]** \`${sup.file}\` line ${sup.line}\n`;
-            out += `> Suppressed — ${sup.reason}\n`;
-        }
-    }
-    const warnings1 = mechanical.filter(f => f.severity === "WARNING");
-    if (warnings1.length > 0) {
-        out += `\n#### ⚠️ Warnings\n`;
-        for (const f of warnings1) {
-            out += `\n**[${f.check}]** \`${f.file}\`${f.line ? ` line ${f.line}` : ""}\n`;
-            out += `> ${f.message}\n> 💡 *${f.suggestion}*\n`;
-        }
-    }
-    // ── Tier 2: AI Reviewer ────────────────────────────────────────────────
-    out += `\n### 🤖 Tier 2 — AI File Reviewer\n`;
-    if (!tier1Passed) {
-        out += `> ⏸️ Skipped — resolve Tier 1 blocking failures first.\n`;
-    }
-    else if (skip_checks.includes("ai_review")) {
-        out += `> ⏭️ Skipped by skip_checks.\n`;
-    }
-    else {
-        const t2c = reviewComments.filter(c => c.tier === 2 && c.severity === "CRITICAL");
-        const t2w = reviewComments.filter(c => c.tier === 2 && c.severity === "WARNING");
-        const t2p = reviewComments.filter(c => c.tier === 2 && c.severity === "PRAISE");
-        if (t2c.length > 0) {
-            out += `\n#### 🔴 Critical (${t2c.length})\n`;
-            for (const c of t2c) {
-                out += `\n**\`${c.file}\`**${c.line ? ` line ${c.line}` : ""}\n> [${c.area}] **${c.title}** — ${c.detail}\n> 🔧 *${c.action}*\n`;
-            }
-        }
-        if (t2w.length > 0) {
-            out += `\n#### 🟡 Warnings (${t2w.length})\n`;
-            for (const c of t2w) {
-                out += `\n**\`${c.file}\`**${c.line ? ` line ${c.line}` : ""}\n> [${c.area}] ${c.title} — ${c.detail}\n> 💡 *${c.action}*\n`;
-            }
-        }
-        if (t2p.length > 0) {
-            out += `\n#### ✅ Praise\n`;
-            for (const c of t2p) {
-                out += `- \`${c.file}\`: ${c.title}\n`;
-            }
-        }
-        if (t2c.length === 0 && t2w.length === 0 && t2p.length === 0) {
-            out += `> ✅ No file-level issues found.\n`;
-        }
-        out += `> 💰 *AI review cost: ~$${aiCost.toFixed(4)}*\n`;
-    }
-    // ── Tier 3: Context Reviewer ───────────────────────────────────────────
-    out += `\n### 🧠 Tier 3 — Context Reviewer\n`;
-    if (!tier2Passed) {
-        out += `> ⏸️ Skipped — resolve Tier 1 and Tier 2 issues first.\n`;
-    }
-    else if (skip_checks.includes("context_review")) {
-        out += `> ⏭️ Skipped by skip_checks.\n`;
-    }
-    else {
-        const t3c = reviewComments.filter(c => c.tier === 3 && c.severity === "CRITICAL");
-        const t3w = reviewComments.filter(c => c.tier === 3 && c.severity === "WARNING");
-        const t3i = reviewComments.filter(c => c.tier === 3 && c.severity === "INFO");
-        const t3p = reviewComments.filter(c => c.tier === 3 && c.severity === "PRAISE");
-        if (t3c.length > 0) {
-            out += `\n#### 🔴 Critical (${t3c.length})\n`;
-            for (const c of t3c) {
-                out += `\n**[${c.area}] ${c.title}**${c.file ? ` — \`${c.file}\`` : ""}\n`;
-                out += `> ${c.detail.replace(/\n/g, "\n> ")}\n`;
-                if (c.action)
-                    out += `> 🔧 *${c.action}*\n`;
-            }
-        }
-        if (t3w.length > 0) {
-            out += `\n#### 🟡 Warnings (${t3w.length})\n`;
-            for (const c of t3w) {
-                out += `\n**[${c.area}] ${c.title}**${c.file ? ` — \`${c.file}\`` : ""}\n`;
-                out += `> ${c.detail.replace(/\n/g, "\n> ")}\n`;
-                if (c.action)
-                    out += `> 💡 *${c.action}*\n`;
-            }
-        }
-        if (t3i.length > 0) {
-            out += `\n#### 🟢 Info (${t3i.length})\n`;
-            for (const c of t3i) {
-                out += `- **[${c.area}]** \`${c.file || ""}\` — ${c.detail}\n`;
-                if (c.action)
-                    out += `  > 💡 *${c.action}*\n`;
-            }
-        }
-        if (t3p.length > 0) {
-            out += `\n#### ✅ Praise\n`;
-            for (const c of t3p)
-                out += `- **${c.title}** — ${c.detail.replace(/\n/g, " ")}\n`;
-        }
-        if (t3c.length === 0 && t3w.length === 0 && t3i.length === 0 && t3p.length === 0) {
-            out += `> ✅ Task brain cross-reference clean — all ACs traceable, no rejected patterns, no scope creep.\n`;
-        }
-    }
-    // ── Summary table ──────────────────────────────────────────────────────
-    out += `\n---\n`;
-    out += `| Tier | Scope | 🔴 Critical | 🟡 Warning | 🟢 Info | ✅ Praise |\n|---|---|---|---|---|---|\n`;
-    out += `| Tier 1 | Mechanical | ${blockingMechanical.length} | ${warnings1.length} | — | — |\n`;
-    out += `| Tier 2 | AI File Review | ${reviewComments.filter(c => c.tier === 2 && c.severity === "CRITICAL").length} | ${reviewComments.filter(c => c.tier === 2 && c.severity === "WARNING").length} | — | ${reviewComments.filter(c => c.tier === 2 && c.severity === "PRAISE").length} |\n`;
-    out += `| Tier 3 | Context Review | ${reviewComments.filter(c => c.tier === 3 && c.severity === "CRITICAL").length} | ${reviewComments.filter(c => c.tier === 3 && c.severity === "WARNING").length} | ${allInfos.length} | ${reviewComments.filter(c => c.tier === 3 && c.severity === "PRAISE").length} |\n`;
-    out += `| **Total** | | **${allCriticals.length}** | **${allWarnings.length}** | **${allInfos.length}** | **${allPraises.length}** |\n\n`;
-    // ── Verdict ────────────────────────────────────────────────────────────
-    out += `## ${verdict}\n\n${verdictReason}\n`;
-    if (verdict === "✅ APPROVED") {
-        out += `\n**Next steps:**\n`;
-        out += `1. \`manage_task(action: "complete", work_item_id: "${work_item_id}")\`\n`;
-        out += `2. Generate PR and ADO documents manually using AGENTS.md rules\n`;
-        out += `3. Raise the PR\n`;
-    }
-    else if (verdict === "❌ CHANGES_REQUESTED") {
-        out += `\n**Resolve all 🔴 Critical findings above, then re-run \`run_pre_pr_checks_with_reviewer_agent\`.**\n`;
-    }
-    else {
-        out += `\n**Discuss 🟡 warnings with your team, then proceed with \`manage_task(complete)\`.**\n`;
+    catch (e) {
+        return { content: [{ type: 'text', text: e.stdout || e.message }], isError: true };
     }
-    return appendTelemetry({ content: [{ type: "text", text: out }] }, inputChars);
 });
 // Full-spectrum PR review system.
 //
@@ -4704,48 +3936,70 @@ server.tool("reviewer_agent", "Context-aware architectural review agent — call
     }
     return appendTelemetry({ content: [{ type: "text", text: out }] }, inputChars);
 });
-// ─── Resource & Prompt for AGENTS.md ──────────────────────────────────────────
-const AGENTS_MD_PATH = path.resolve(path.dirname(new URL(import.meta.url).pathname.replace(/^\/([A-Z]:)/, "$1")), "AGENTS.md");
-server.resource("secufusion_rules", "secufusion://rules", async (uri) => {
-    const content = readFileSafe(AGENTS_MD_PATH);
-    if (!content) {
-        throw new Error(`Rules file not found at ${AGENTS_MD_PATH}`);
-    }
+// ─── Resource & Prompt for Personas ──────────────────────────────────────────
+const AGENTS_DIR = path.resolve(path.dirname(new URL(import.meta.url).pathname.replace(/^\/([A-Z]:)/, "$1")), "../.agents");
+const PLANNER_MD_PATH = path.join(AGENTS_DIR, "planner.md");
+const CODER_MD_PATH = path.join(AGENTS_DIR, "coder.md");
+const REVIEWER_MD_PATH = path.join(AGENTS_DIR, "reviewer.md");
+const SKILLS_CATALOG_PATH = path.resolve(path.dirname(new URL(import.meta.url).pathname.replace(/^\/([A-Z]:)/, "$1")), "skills-catalog.json");
+server.prompt("secufusion_planner", "Starts a conversation with the SecuFusion planner workflow rules loaded (Phase 00 - Phase 1).", async () => {
+    const content = readFileSafe(PLANNER_MD_PATH);
+    if (!content)
+        throw new Error(`Rules file not found at ${PLANNER_MD_PATH}`);
     return {
-        contents: [{
-                uri: uri.href,
-                text: content
-            }]
+        messages: [{ role: "user", content: { type: "text", text: `You are now the SecuFusion Planner. Here are your rules:\n\n${content}` } }]
     };
 });
-server.prompt("secufusion_developer", "Starts a conversation with the SecuFusion developer workflow rules loaded.", async () => {
-    const content = readFileSafe(AGENTS_MD_PATH);
-    if (!content) {
-        throw new Error(`Rules file not found at ${AGENTS_MD_PATH}`);
-    }
+server.prompt("secufusion_coder", "Starts a conversation with the SecuFusion coder workflow rules loaded (Phase 2 - Phase 3).", async () => {
+    const content = readFileSafe(CODER_MD_PATH);
+    if (!content)
+        throw new Error(`Rules file not found at ${CODER_MD_PATH}`);
     return {
-        messages: [
-            {
-                role: "user",
-                content: {
-                    type: "text",
-                    text: `You are now the SecuFusion Senior Architect. Here are your rules:\n\n${content}`
-                }
-            }
-        ]
+        messages: [{ role: "user", content: { type: "text", text: `You are now the SecuFusion Coder. Here are your rules:\n\n${content}` } }]
     };
 });
-// ─────────────────────────────────────────────
-//  Start transport
-// ─────────────────────────────────────────────
-server.tool("get_secufusion_rules", "Fetches the mandatory AGENTS.md workflow rules for the SecuFusion project. Call this before starting any work.", {}, async () => {
-    const content = readFileSafe(AGENTS_MD_PATH);
-    if (!content) {
-        throw new Error(`Rules file not found at ${AGENTS_MD_PATH}`);
+server.prompt("secufusion_reviewer", "Starts a conversation with the SecuFusion reviewer workflow rules loaded (Phase 4 - Phase 5).", async () => {
+    const content = readFileSafe(REVIEWER_MD_PATH);
+    if (!content)
+        throw new Error(`Rules file not found at ${REVIEWER_MD_PATH}`);
+    return {
+        messages: [{ role: "user", content: { type: "text", text: `You are now the SecuFusion Reviewer. Here are your rules:\n\n${content}` } }]
+    };
+});
+// ─── Slash Commands (Aliases for Personas / Workflows) ───────────────────────
+server.prompt("sfn_spec", "Slash command to start Phase 0.5 (Classification) and Phase 1 (Planning)", async () => {
+    const content = readFileSafe(PLANNER_MD_PATH);
+    return { messages: [{ role: "user", content: { type: "text", text: `[Command: /sfn_spec]\nYou are in Spec/Planning mode. Execute Phase 00, Phase 0.5, and Phase 1 rules:\n\n${content}` } }] };
+});
+server.prompt("sfn_code", "Slash command to start Phase 2 (Execution) and Phase 3 (Course Correction)", async () => {
+    const content = readFileSafe(CODER_MD_PATH);
+    return { messages: [{ role: "user", content: { type: "text", text: `[Command: /sfn_code]\nYou are in Coder mode. Execute Phase 2 and Phase 3 rules:\n\n${content}` } }] };
+});
+server.prompt("sfn_review", "Slash command to start Phase 4 (PR Checks) and Phase 5 (Retrospective)", async () => {
+    const content = readFileSafe(REVIEWER_MD_PATH);
+    return { messages: [{ role: "user", content: { type: "text", text: `[Command: /sfn_review]\nYou are in Review mode. Execute Phase 4 and Phase 5 rules:\n\n${content}` } }] };
+});
+// ─── Tools ─────────────────────────────────────────────
+server.tool("skill_recommend", "Searches the skill catalog for matching domain skills based on keywords.", {
+    keywords: z.array(z.string()).describe("Keywords to search for (e.g., 'kafka', 'react')")
+}, async ({ keywords }) => {
+    const content = readFileSafe(SKILLS_CATALOG_PATH);
+    if (!content)
+        return appendTelemetry({ content: [{ type: "text", text: "No skills catalog found." }] }, 0);
+    try {
+        const catalog = JSON.parse(content);
+        const matches = catalog.skills.filter((skill) => keywords.some(kw => skill.tags.includes(kw.toLowerCase())));
+        if (matches.length === 0)
+            return appendTelemetry({ content: [{ type: "text", text: "No matching skills found." }] }, content.length);
+        let out = "Found the following relevant skills:\n";
+        matches.forEach((s) => {
+            out += `- **${s.name}**: ${s.description}\n  *Read file:* \`${s.path}\`\n`;
+        });
+        return appendTelemetry({ content: [{ type: "text", text: out }] }, content.length);
+    }
+    catch (e) {
+        return appendTelemetry({ content: [{ type: "text", text: "Error parsing skills catalog." }] }, 0);
     }
-    return appendTelemetry({
-        content: [{ type: "text", text: content }]
-    }, 0);
 });
 const transport = new StdioServerTransport();
 await server.connect(transport);