secufusion-mcp 1.2.3 → 1.2.4

package/README.md

@@ -38,6 +38,18 @@ The SecuFusion MCP has been refactored to align with the advanced MLMCPS framewo
 2. **Subprocess PR Checks**: Tier 1 mechanical checks (`TENANT_ISOLATION`, `N_PLUS_ONE`, etc.) are now extracted into a standalone CLI script (`scripts/sfn-pr-check.js`), allowing them to be run by the AI *or* natively within your CI/CD pipelines.
 3. **Thin Index Token Discipline**: Context bloat is gone. Tools like `manage_task(read)` and `prime_session` now return lightweight "Thin Indexes"—compact Markdown summaries with absolute file paths—so the AI only reads the full JSON via `view_file` when truly necessary.
 4. **Dynamic Skill Registry**: A new `skill_recommend` tool allows the AI to dynamically discover domain-specific architectural skills without bloating the base prompt.
+5. **Poly-Repo DNA Discovery**: Through the standalone `secufusion-dna-plugin`, the AI can dynamically analyze the entire codebase of any poly-repo project at session start. It maps out microservices, API contracts, and event topologies on the fly, creating a living knowledge graph.
+
+---
+
+## 🧬 SecuFusion DNA Discovery Plugin
+
+A new standalone Claude plugin has been introduced: **SecuFusion DNA Discovery MCP** (`secufusion-dna-plugin`). This plugin empowers agents to autonomously discover, analyze, and build a living knowledge graph of your entire software ecosystem when handed over to a new team member.
+
+**Key Features:**
+- **Dynamic Stack Analysis:** Identifies Java/Spring, Node, Docker, and other frameworks on the fly.
+- **Slash Command Agents:** Use `/analyze`, `/map-architecture`, and `/blast-radius` directly in your AI chat to orchestrate complex codebase queries.
+- **Automated Dependency Mapping:** Generates cross-service dependency maps and evaluates the blast radius of potential changes.
 
 ---
 

package/index.js

@@ -2706,583 +2706,16 @@ server.tool("run_pre_pr_checks_with_reviewer_agent", "Unified, single-call PR re
         reason: z.string().describe("Mandatory justification for suppression")
     })).optional().default([]).describe("Method-scoped suppressions with mandatory reasons.")
 }, async ({ work_item_id, skip_checks = [], suppressions = [] }) => {
-    const inputChars = JSON.stringify({ work_item_id, skip_checks, suppressions }).length;
-    const wsRoot = getWorkspaceRoot();
-    const startTime = Date.now();
-    // ══════════════════════════════════════════════════════════════════════
-    // SETUP — resolve task folder and read all task brain files once
-    // ══════════════════════════════════════════════════════════════════════
-    // ── Resolve task folder ────────────────────────────────────────────────
-    const registry = readRegistry();
-    const taskEntry = registry.find(r => r["work_item_id"] === work_item_id);
-    let taskDir = null;
-    if (taskEntry?.["folder_name"]) {
-        taskDir = path.resolve(wsRoot, `.secufusion/tasks/${taskEntry["folder_name"]}`);
-    }
-    if (!taskDir || !fs.existsSync(taskDir)) {
-        const tasksBase = path.resolve(wsRoot, ".secufusion/tasks");
-        if (fs.existsSync(tasksBase)) {
-            const folders = fs.readdirSync(tasksBase);
-            const match = folders.find(f => f.startsWith(work_item_id));
-            if (match)
-                taskDir = path.join(tasksBase, match);
-        }
-    }
-    if (!taskDir || !fs.existsSync(taskDir)) {
-        return appendTelemetry({
-            isError: true,
-            content: [{ type: "text", text: `❌ Task folder not found for ${work_item_id}. Call manage_task(initialize) first.` }]
-        }, inputChars);
-    }
-    const taskSpec = (() => { try {
-        return JSON.parse(readFileSafe(path.join(taskDir, "spec.json")) || "{}");
-    }
-    catch {
-        return {};
-    } })();
-    const taskProgress = (() => { try {
-        return JSON.parse(readFileSafe(path.join(taskDir, "progress.json")) || "{}");
-    }
-    catch {
-        return {};
-    } })();
-    const decisions = (() => { try {
-        return JSON.parse(readFileSafe(path.join(taskDir, "decisions.json")) || "[]");
-    }
-    catch {
-        return [];
-    } })();
-    const filesTouched = (() => { try {
-        return JSON.parse(readFileSafe(path.join(taskDir, "files-touched.json")) || "[]");
-    }
-    catch {
-        return [];
-    } })();
-    const scenarios = (() => { try {
-        return JSON.parse(readFileSafe(path.join(taskDir, "scenarios.json")) || "[]");
-    }
-    catch {
-        return [];
-    } })();
-    if (filesTouched.length === 0) {
-        return appendTelemetry({
-            content: [{ type: "text", text: `⚠️ No files logged for ${work_item_id}. Log files with manage_task(log_file_touched) before running checks.` }]
-        }, inputChars);
-    }
-    // ── Load project spec (golden rules + rejected patterns) ───────────────
-    const PROJ_SPEC_FILE = ".secufusion-project-spec.json";
-    const specCandidates = [
-        path.resolve(path.dirname(new URL(import.meta.url).pathname.replace(/^\/([A-Z]:)/, "$1")), PROJ_SPEC_FILE),
-        path.resolve(wsRoot, PROJ_SPEC_FILE),
-    ];
-    let projectSpec = null;
-    for (const c of specCandidates) {
-        if (fs.existsSync(c)) {
-            try {
-                projectSpec = JSON.parse(readFileSafe(c) || "null");
-            }
-            catch { }
-            break;
-        }
-    }
-    const goldenRules = projectSpec?.golden_rules || {};
-    const codingStyle = goldenRules.coding_style || {};
-    const authorityRules = goldenRules.authority_rules || [];
-    let rejectedPatterns = [];
     try {
-        rejectedPatterns = JSON.parse(readFileSafe(resolve(".rejected-patterns.json")) || "[]");
-    }
-    catch { }
-    const fileRecords = filesTouched.map(ft => {
-        const abs = path.resolve(wsRoot, ft.file_path);
-        const raw = readFileSafe(abs) || "";
-        const ext = path.extname(ft.file_path).toLowerCase();
-        const base = path.basename(ft.file_path);
-        return {
-            file_path: ft.file_path,
-            change_summary: ft.change_summary,
-            content: raw,
-            lines: raw.split("\n"),
-            ext,
-            isJava: ext === ".java",
-            isTS: ext === ".ts" || ext === ".tsx",
-            isRepo: /Repository/i.test(base) && ext === ".java",
-            isKafka: raw.includes("@KafkaListener"),
-            isMigration: ft.file_path.includes("migration") || ft.file_path.includes("flyway") || ext === ".sql",
-            isController: /Controller/i.test(base) && ext === ".java",
-            isService: /Service/i.test(base) && ext === ".java",
-            isTest: /test|spec/i.test(ft.file_path),
-            exists: fs.existsSync(abs),
-        };
-    });
-    let mechanical = [];
-    const passResults = [];
-    const reviewComments = [];
-    let aiCost = 0;
-    // ══════════════════════════════════════════════════════════════════════
-    // TIER 1 — MECHANICAL CHECKS (P1–P5) Via Subprocess
-    // ══════════════════════════════════════════════════════════════════════
-    let tier1Passed = false;
-    try {
-        const scriptPath = path.resolve(path.dirname(new URL(import.meta.url).pathname.replace(/^\/([A-Z]:)/, "$1")), "scripts/sfn-pr-check.js");
-        const execResult = require('child_process').execFileSync('node', [scriptPath, '--task', work_item_id, '--workspace', wsRoot], { encoding: 'utf-8' });
-        const jsonStr = execResult.trim().split('\n').pop() || "{}";
-        const parsed = JSON.parse(jsonStr);
-        mechanical = parsed.mechanical || [];
-        tier1Passed = parsed.pass === true;
+        const cp = require('child_process');
+        const scriptPath = require('path').resolve(__dirname, 'scripts/sfn-pr-check.js');
+        const args = JSON.stringify({ work_item_id, skip_checks, suppressions });
+        const output = cp.execFileSync(process.execPath, [scriptPath, args], { encoding: 'utf-8' });
+        return { content: [{ type: 'text', text: output }] };
     }
     catch (e) {
-        if (e.stdout) {
-            const jsonStr = e.stdout.trim().split('\n').pop() || "{}";
-            try {
-                const parsed = JSON.parse(jsonStr);
-                mechanical = parsed.mechanical || [];
-            }
-            catch (e2) { }
-        }
-        tier1Passed = false;
-    }
-    const p1 = mechanical.filter(m => m.check === "TENANT_ISOLATION");
-    passResults.push({ name: "TENANT_ISOLATION", skipped: skip_checks.includes("tenant_isolation"), passed: p1.length === 0, count: p1.length });
-    const p2 = mechanical.filter(m => m.check === "N_PLUS_ONE");
-    passResults.push({ name: "N_PLUS_ONE", skipped: skip_checks.includes("n_plus_one"), passed: p2.length === 0, count: p2.length });
-    const p3 = mechanical.filter(m => m.check === "MISSING_INDEX");
-    passResults.push({ name: "MISSING_INDEX", skipped: skip_checks.includes("missing_index"), passed: p3.length === 0, count: p3.length });
-    const p4 = mechanical.filter(m => m.check === "KAFKA_SYNC");
-    passResults.push({ name: "KAFKA_SYNC", skipped: skip_checks.includes("kafka_sync"), passed: p4.length === 0, count: p4.length });
-    const p5 = mechanical.filter(m => m.check === "EARLY_RETURN");
-    passResults.push({ name: "EARLY_RETURN", skipped: skip_checks.includes("early_return"), passed: p5.length === 0, count: p5.length });
-    const blockingMechanical = mechanical.filter(f => f.severity === "BLOCKING");
-    // ══════════════════════════════════════════════════════════════════════
-    // TIER 2 — AI FILE REVIEWER (Pass 6)
-    // Reads each changed file, applies architectural heuristics.
-    // Only runs if Tier 1 passes.
-    // ══════════════════════════════════════════════════════════════════════
-    const AI_COST_PER_100 = 0.0008;
-    if (tier1Passed && !skip_checks.includes("ai_review")) {
-        for (const f of fileRecords) {
-            aiCost += (f.lines.length / 100) * AI_COST_PER_100;
-            // Obvious comments
-            const obviousComments = f.lines.filter(l => /\/\/\s*(get the|set the|loop|return|initialize|this method|this function|create a|update the)/i.test(l));
-            if (obviousComments.length > 0) {
-                reviewComments.push({ tier: 2, file: f.file_path, severity: "WARNING", area: "CODE_QUALITY",
-                    title: `${obviousComments.length} obvious comment(s)`,
-                    detail: "Comments explain WHY, not WHAT. Remove or replace with architectural rationale.",
-                    action: "Replace // Get the user with // Required because tenant context is not available in JWT claims" });
-            }
-            // Work Item IDs in comments
-            const ticketIdComments = f.lines.map((l, i) => ({ l, i })).filter(({ l }) => /(\/\/|\/\*|\*)\s*.*(?:BUG|WI)-\d+/i.test(l));
-            if (ticketIdComments.length > 0) {
-                reviewComments.push({ tier: 2, file: f.file_path, line: ticketIdComments[0].i + 1, severity: "CRITICAL", area: "CODE_QUALITY",
-                    title: "Ticket ID in code comment",
-                    detail: `Line ${ticketIdComments[0].i + 1} contains a work item ID: \`${ticketIdComments[0].l.trim()}\``,
-                    action: "Remove the ticket ID. Explain the durable WHY instead." });
-            }
-            // Hardcoded URLs/IPs
-            const hardcoded = f.lines.map((l, i) => ({ l, i })).filter(({ l }) => /https?:\/\/[0-9]{1,3}\.[0-9]{1,3}|localhost:[0-9]{4}|uat\.|staging\.|prod\./i.test(l) && !/\/\//.test(l));
-            if (hardcoded.length > 0) {
-                reviewComments.push({ tier: 2, file: f.file_path, line: hardcoded[0].i + 1, severity: "CRITICAL", area: "SECURITY",
-                    title: "Hardcoded URL/IP detected",
-                    detail: `Line ${hardcoded[0].i + 1}: \`${hardcoded[0].l.trim()}\``,
-                    action: "Move to application.properties / environment variables immediately" });
-            }
-            // Missing @Transactional(readOnly=true) on service GET methods
-            if (f.isService && !f.isTest) {
-                const getters = f.lines.map((l, i) => ({ l, i })).filter(({ l }) => /public.*(?:List|Page|Optional|DTO|Response)\s+\w+\s*\(/.test(l));
-                for (const { l, i } of getters) {
-                    const prev = f.lines.slice(Math.max(0, i - 3), i).join(" ");
-                    if (!/readOnly.*true/.test(prev)) {
-                        reviewComments.push({ tier: 2, file: f.file_path, line: i + 1, severity: "WARNING", area: "PERFORMANCE",
-                            title: "Missing @Transactional(readOnly = true)",
-                            detail: `\`${(l.match(/\w+\s*\(/) || [""])[0].trim()}\` returns data without readOnly — allows dirty reads and skips DB optimizations`,
-                            action: "Add @Transactional(readOnly = true) above this method" });
-                        break;
-                    }
-                }
-            }
-            // Missing @PreAuthorize on controller endpoints
-            if (f.isController && !f.isTest) {
-                const endpoints = f.lines.map((l, i) => ({ l, i })).filter(({ l }) => /@(GetMapping|PostMapping|PutMapping|DeleteMapping|PatchMapping)/.test(l));
-                for (const { l, i } of endpoints) {
-                    const prev = f.lines.slice(Math.max(0, i - 5), i).join(" ");
-                    if (!/PreAuthorize|permitAll/.test(prev)) {
-                        reviewComments.push({ tier: 2, file: f.file_path, line: i + 1, severity: "CRITICAL", area: "SECURITY",
-                            title: "Endpoint missing @PreAuthorize",
-                            detail: `Endpoint at line ${i + 1} has no @PreAuthorize annotation`,
-                            action: "Add @PreAuthorize(\"hasAuthority('domain.action')\") above the mapping" });
-                    }
-                }
-            }
-            // Debug statements in production code
-            if (!f.isTest) {
-                const debug = f.lines.map((l, i) => ({ l, i })).filter(({ l }) => /console\.log|System\.out\.print|e\.printStackTrace/.test(l));
-                if (debug.length > 0) {
-                    reviewComments.push({ tier: 2, file: f.file_path, line: debug[0].i + 1, severity: "WARNING", area: "CODE_QUALITY",
-                        title: "Debug statement in production code",
-                        detail: `\`${debug[0].l.trim()}\` at line ${debug[0].i + 1}`,
-                        action: "Replace with SLF4J log.debug() or remove entirely" });
-                }
-            }
-            // Exception swallowing
-            if (f.isJava) {
-                f.lines.forEach((line, idx) => {
-                    if (/catch\s*\(\s*Exception\s+/.test(line)) {
-                        const block = f.lines.slice(idx, idx + 5).join(" ");
-                        if (!/log\.|logger\.|throw/.test(block)) {
-                            reviewComments.push({ tier: 2, file: f.file_path, line: idx + 1, severity: "WARNING", area: "ERROR_HANDLING",
-                                title: "Catch-all exception may be swallowed",
-                                detail: `catch(Exception) at line ${idx + 1} has no log or rethrow`,
-                                action: "Log with context: log.error(\"[WI-xxx] failed: {}\", e.getMessage(), e) or rethrow as domain exception" });
-                        }
-                    }
-                });
-            }
-            // TypeScript any overuse
-            if (f.isTS && !f.isTest) {
-                const anyLines = f.lines.filter(l => /:\s*any\b/.test(l) && !/\/\//.test(l));
-                if (anyLines.length > 2) {
-                    reviewComments.push({ tier: 2, file: f.file_path, severity: "WARNING", area: "TYPE_SAFETY",
-                        title: `${anyLines.length} uses of \`: any\``,
-                        detail: "Type safety defeated. `any` propagates silently through the call chain.",
-                        action: "Replace with explicit interfaces or `unknown` with a type guard" });
-                }
-            }
-            // Missing Flyway for @Entity
-            if (f.isJava && /@Entity/.test(f.content) && !f.isTest && !fileRecords.some(r => r.isMigration)) {
-                reviewComments.push({ tier: 2, file: f.file_path, severity: "CRITICAL", area: "DATABASE",
-                    title: "@Entity change with no Flyway migration in PR",
-                    detail: "Every JPA entity schema change requires a Flyway migration",
-                    action: "Create src/main/resources/db/migration/Vxxx__describe_change.sql and log it with manage_task(log_file_touched)" });
-            }
-            // Cross-service call timeout
-            if (f.isJava && /RestTemplate|WebClient|FeignClient/i.test(f.content) && !/connectTimeout|readTimeout|timeout/i.test(f.content)) {
-                reviewComments.push({ tier: 2, file: f.file_path, severity: "WARNING", area: "RESILIENCE",
-                    title: "Cross-service call with no timeout",
-                    detail: "RestTemplate/WebClient/FeignClient used without connectTimeout + readTimeout",
-                    action: "Configure explicit timeouts. For WebClient: .responseTimeout(Duration.ofSeconds(5))" });
-            }
-            // Praise: proper SLF4J logging
-            if (/log\.(info|debug|warn|error)\(/.test(f.content) && !f.isTest) {
-                reviewComments.push({ tier: 2, file: f.file_path, severity: "PRAISE", area: "CODE_QUALITY",
-                    title: "Proper SLF4J logging observed", detail: "" });
-            }
-        }
-    }
-    // ── Tier 2 gate ────────────────────────────────────────────────────────
-    const tier2Blocking = reviewComments.filter(c => c.tier === 2 && c.severity === "CRITICAL");
-    const tier2Passed = tier1Passed && tier2Blocking.length === 0;
-    // ══════════════════════════════════════════════════════════════════════
-    // TIER 3 — CONTEXT REVIEWER
-    // Cross-references task brain + project-spec + file contents.
-    // Only runs if both Tier 1 and Tier 2 pass.
-    // ══════════════════════════════════════════════════════════════════════
-    if (tier2Passed && !skip_checks.includes("context_review")) {
-        // ── AC Coverage ────────────────────────────────────────────────────
-        const allACs = [...new Set([
-                ...(taskSpec.acceptance_criteria || []),
-                ...(taskProgress.completed_acs || []),
-                ...(taskProgress.pending_acs || []),
-            ])];
-        const changeCorpus = [
-            ...fileRecords.map(f => f.file_path + " " + f.change_summary),
-            ...decisions.map(d => (d.decision || "") + " " + (d.rationale || "")),
-        ].join(" ").toLowerCase();
-        for (const ac of allACs) {
-            if (!ac?.trim())
-                continue;
-            const kws = ac.toLowerCase().split(/\s+/).filter(w => w.length > 3 && !/^(must|shall|should|the|and|for|with|that|this|when|from|into|not|does|will|have|been|each|only|any|all)$/.test(w));
-            const cov = kws.length > 0 ? kws.filter(kw => changeCorpus.includes(kw)).length / kws.length : 1;
-            if (cov < 0.25) {
-                reviewComments.push({ tier: 3, severity: "CRITICAL", area: "AC_COVERAGE",
-                    title: "AC may not be implemented",
-                    detail: `"${ac.substring(0, 120)}${ac.length > 120 ? "..." : ""}" — no matching file changes or decisions`,
-                    action: "Verify this AC is addressed. If so, enrich the change_summary for the relevant file." });
-            }
-            else if (cov < 0.5) {
-                reviewComments.push({ tier: 3, severity: "WARNING", area: "AC_COVERAGE",
-                    title: "AC has weak coverage signal",
-                    detail: `"${ac.substring(0, 120)}..." — only ${Math.round(cov * 100)}% keyword match in change corpus`,
-                    action: "Confirm AC is satisfied; enrich the file change_summary to improve signal." });
-            }
-        }
-        // Pending ACs
-        if ((taskProgress.pending_acs || []).length > 0) {
-            reviewComments.push({ tier: 3, severity: "CRITICAL", area: "AC_COVERAGE",
-                title: `${taskProgress.pending_acs.length} AC(s) still pending`,
-                detail: taskProgress.pending_acs.map(a => `• ${a}`).join("\n"),
-                action: "Complete all ACs. Call manage_task(update_spec) to move them to completed_acs." });
-        }
-        // ── Decision Drift ─────────────────────────────────────────────────
-        const fileCorpus = fileRecords.map(f => f.file_path + " " + f.change_summary).join(" ").toLowerCase();
-        for (const dec of decisions) {
-            if (!dec.decision || /rollback|strategy|SAFE|RISKY|DANGEROUS/i.test(dec.decision))
-                continue;
-            const kws = dec.decision.toLowerCase().split(/\s+/).filter(w => w.length > 4 && !/^(using|added|decided|chose|going|will|this|that|with|from|into|the|and|for)$/.test(w));
-            const trace = kws.length >= 3 ? kws.filter(kw => fileCorpus.includes(kw)).length / kws.length : 1;
-            if (trace < 0.2) {
-                reviewComments.push({ tier: 3, severity: "WARNING", area: "DECISION_DRIFT",
-                    title: `Decision #${dec.id} not traceable in files touched`,
-                    detail: `"${dec.decision?.substring(0, 120)}"`,
-                    action: "Verify this decision was implemented. Log the file with manage_task(log_file_touched) if missing." });
-            }
-        }
-        // ── Scope Creep ────────────────────────────────────────────────────
-        const specCorpus = [taskSpec.title || "", taskSpec.description || "", ...(taskSpec.acceptance_criteria || []), ...decisions.map(d => (d.decision || "") + " " + (d.rationale || ""))].join(" ").toLowerCase();
-        for (const f of fileRecords.filter(f => !f.isTest)) {
-            const base = path.basename(f.file_path).replace(/\.[^.]+$/, "").toLowerCase();
-            const words = base.replace(/([A-Z])/g, " $1").toLowerCase().trim().split(/[\s_-]+/).filter(w => w.length > 3);
-            if (words.length > 0 && !words.some(w => specCorpus.includes(w))) {
-                reviewComments.push({ tier: 3, file: f.file_path, severity: "INFO", area: "SCOPE_CREEP",
-                    title: "File may be outside task scope",
-                    detail: `\`${f.file_path}\` not mentioned in spec, ACs, or decisions`,
-                    action: "If intentional, add a decision: manage_task(log_decision) explaining the touch." });
-            }
-        }
-        // ── Rejected Patterns ──────────────────────────────────────────────
-        for (const f of fileRecords.filter(f => f.exists)) {
-            for (const rp of rejectedPatterns) {
-                if (!rp.pattern)
-                    continue;
-                const kws = rp.pattern.toLowerCase().split(/\s+/).filter(w => w.length > 4).slice(0, 4);
-                const hits = kws.filter(kw => f.content.toLowerCase().includes(kw)).length;
-                if (kws.length > 0 && hits / kws.length >= 0.75) {
-                    reviewComments.push({ tier: 3, file: f.file_path, severity: "CRITICAL", area: "REJECTED_PATTERNS",
-                        title: "Rejected pattern detected",
-                        detail: `Pattern: "${rp.pattern}"\nReason: ${rp.reason || "See .rejected-patterns.json"} (category: ${rp.category || "unknown"})`,
-                        action: "This pattern was explicitly rejected. Refactor before merging." });
-                }
-            }
-        }
-        // ── Test Coverage ──────────────────────────────────────────────────
-        const testFiles = fileRecords.filter(f => f.isTest);
-        const srcFiles = fileRecords.filter(f => !f.isTest && (f.isJava || f.isTS));
-        if (srcFiles.length > 0 && testFiles.length === 0) {
-            reviewComments.push({ tier: 3, severity: "CRITICAL", area: "TEST_COVERAGE",
-                title: "No test files in PR",
-                detail: `${srcFiles.length} source file(s) changed, zero test files in files-touched`,
-                action: "Add unit and integration tests. Log them with manage_task(log_file_touched)." });
-        }
-        else if (testFiles.length > 0) {
-            reviewComments.push({ tier: 3, severity: "PRAISE", area: "TEST_COVERAGE",
-                title: `${testFiles.length} test file(s) included`,
-                detail: testFiles.map(f => `• ${f.file_path}`).join("\n") });
-        }
-        if (scenarios.filter(s => s.type === "unit").length === 0 && srcFiles.length > 0) {
-            reviewComments.push({ tier: 3, severity: "WARNING", area: "TEST_COVERAGE",
-                title: "No unit test scenarios logged",
-                detail: "manage_task(add_scenario, type='unit') was never called",
-                action: "Call suggest_test_scenarios to auto-generate scenarios from ACs." });
-        }
-        // ── Golden Rules ───────────────────────────────────────────────────
-        // @PreAuthorize on controllers
-        for (const f of fileRecords.filter(f => f.isController && !f.isTest)) {
-            const hasAuth = f.content.includes("@PreAuthorize");
-            const hasEndpoints = /@(GetMapping|PostMapping|PutMapping|DeleteMapping|PatchMapping)/.test(f.content);
-            if (hasEndpoints && hasPreAuth(f.content)) {
-                reviewComments.push({ tier: 3, file: f.file_path, severity: "PRAISE", area: "GOLDEN_RULES",
-                    title: "@PreAuthorize correctly applied", detail: `\`${f.file_path}\`` });
-            }
-        }
-        // Entity + migration praise
-        const entityFiles = fileRecords.filter(f => f.isJava && /@Entity/.test(f.content) && !f.isTest);
-        const migFiles = fileRecords.filter(f => f.isMigration);
-        if (entityFiles.length > 0 && migFiles.length > 0) {
-            reviewComments.push({ tier: 3, severity: "PRAISE", area: "GOLDEN_RULES",
-                title: "@Entity change has matching Flyway migration",
-                detail: migFiles.map(f => path.basename(f.file_path)).join(", ") });
-        }
-        // Decision quality praise
-        if (decisions.length >= 3) {
-            reviewComments.push({ tier: 3, severity: "PRAISE", area: "DECISIONS",
-                title: `${decisions.length} architectural decisions logged`,
-                detail: "Good decision hygiene — future agents will benefit from this audit trail." });
-        }
-        if (scenarios.length >= 5) {
-            reviewComments.push({ tier: 3, severity: "PRAISE", area: "TEST_COVERAGE",
-                title: `${scenarios.length} test scenarios logged`,
-                detail: "Comprehensive scenario coverage documented." });
-        }
-    }
-    // ── Helper (moved inside scope) ────────────────────────────────────────
-    function hasPreAuth(content) { return content.includes("@PreAuthorize"); }
-    // ══════════════════════════════════════════════════════════════════════
-    // VERDICT — unified across all three tiers
-    // ══════════════════════════════════════════════════════════════════════
-    const allCriticals = [
-        ...blockingMechanical,
-        ...reviewComments.filter(c => c.severity === "CRITICAL"),
-    ];
-    const allWarnings = [
-        ...mechanical.filter(f => f.severity === "WARNING"),
-        ...reviewComments.filter(c => c.severity === "WARNING"),
-    ];
-    const allInfos = reviewComments.filter(c => c.severity === "INFO");
-    const allPraises = reviewComments.filter(c => c.severity === "PRAISE");
-    let verdict;
-    let verdictReason;
-    if (allCriticals.length > 0) {
-        verdict = "❌ CHANGES_REQUESTED";
-        verdictReason = `${allCriticals.length} blocking finding(s) across Tiers 1–3 must be resolved before this PR can merge.`;
-    }
-    else if (allWarnings.length > 3) {
-        verdict = "💬 DISCUSS";
-        verdictReason = `All checks passed. ${allWarnings.length} warnings worth discussing before merge.`;
-    }
-    else if (allWarnings.length > 0) {
-        verdict = "✅ APPROVED";
-        verdictReason = `All checks passed. ${allWarnings.length} minor warning(s) — address at your discretion.`;
+        return { content: [{ type: 'text', text: e.stdout || e.message }], isError: true };
     }
-    else {
-        verdict = "✅ APPROVED";
-        verdictReason = `Full review passed — mechanical checks clean, AI review clean, context review clean.`;
-    }
-    // ══════════════════════════════════════════════════════════════════════
-    // OUTPUT
-    // ══════════════════════════════════════════════════════════════════════
-    const elapsed = ((Date.now() - startTime) / 1000).toFixed(1);
-    const skippedList = skip_checks.length > 0 ? ` (skipped: ${skip_checks.join(", ")})` : "";
-    let out = `## run_pre_pr_checks_with_reviewer_agent — ${work_item_id}\n\n`;
-    out += `📁 **${fileRecords.length} file(s)** reviewed in **${elapsed}s**${skippedList}\n\n`;
-    // Task context strip
-    out += `> 📋 **${taskSpec.title || "(untitled)"}** | `;
-    out += `ACs: ${(taskSpec.acceptance_criteria || []).length} total, ${(taskProgress.completed_acs || []).length} done, ${(taskProgress.pending_acs || []).length} pending | `;
-    out += `Decisions: ${decisions.length} | Scenarios: ${scenarios.length}\n\n`;
-    // ── Tier 1: Mechanical table ───────────────────────────────────────────
-    out += `### 🔩 Tier 1 — Mechanical Checks\n`;
-    out += `| Pass | Check | Status | Issues |\n|---|---|---|---|\n`;
-    for (let i = 0; i < passResults.length; i++) {
-        const p = passResults[i];
-        const icon = p.skipped ? "⏭️ SKIP" : p.passed ? "✅ PASS" : "❌ FAIL";
-        const issueText = p.skipped ? "—" : (p.suppressedCount ? `${p.count} (${p.suppressedCount} suppressed)` : `${p.count}`);
-        out += `| P${i + 1} | ${p.name} | ${icon} | ${issueText} |\n`;
-    }
-    if (blockingMechanical.length > 0) {
-        out += `\n#### ❌ Blocking Mechanical Findings\n`;
-        for (const f of blockingMechanical) {
-            out += `\n**[${f.check}]** \`${f.file}\`${f.line ? ` line ${f.line}` : ""}\n`;
-            out += `> ${f.message}\n> 💡 *${f.suggestion}*\n`;
-        }
-    }
-    if (p1Suppressed.length > 0) {
-        out += `\n#### 🛡️ Suppressed Findings (${p1Suppressed.length})\n`;
-        for (const sup of p1Suppressed) {
-            out += `\n**[TENANT_ISOLATION]** \`${sup.file}\` line ${sup.line}\n`;
-            out += `> Suppressed — ${sup.reason}\n`;
-        }
-    }
-    const warnings1 = mechanical.filter(f => f.severity === "WARNING");
-    if (warnings1.length > 0) {
-        out += `\n#### ⚠️ Warnings\n`;
-        for (const f of warnings1) {
-            out += `\n**[${f.check}]** \`${f.file}\`${f.line ? ` line ${f.line}` : ""}\n`;
-            out += `> ${f.message}\n> 💡 *${f.suggestion}*\n`;
-        }
-    }
-    // ── Tier 2: AI Reviewer ────────────────────────────────────────────────
-    out += `\n### 🤖 Tier 2 — AI File Reviewer\n`;
-    if (!tier1Passed) {
-        out += `> ⏸️ Skipped — resolve Tier 1 blocking failures first.\n`;
-    }
-    else if (skip_checks.includes("ai_review")) {
-        out += `> ⏭️ Skipped by skip_checks.\n`;
-    }
-    else {
-        const t2c = reviewComments.filter(c => c.tier === 2 && c.severity === "CRITICAL");
-        const t2w = reviewComments.filter(c => c.tier === 2 && c.severity === "WARNING");
-        const t2p = reviewComments.filter(c => c.tier === 2 && c.severity === "PRAISE");
-        if (t2c.length > 0) {
-            out += `\n#### 🔴 Critical (${t2c.length})\n`;
-            for (const c of t2c) {
-                out += `\n**\`${c.file}\`**${c.line ? ` line ${c.line}` : ""}\n> [${c.area}] **${c.title}** — ${c.detail}\n> 🔧 *${c.action}*\n`;
-            }
-        }
-        if (t2w.length > 0) {
-            out += `\n#### 🟡 Warnings (${t2w.length})\n`;
-            for (const c of t2w) {
-                out += `\n**\`${c.file}\`**${c.line ? ` line ${c.line}` : ""}\n> [${c.area}] ${c.title} — ${c.detail}\n> 💡 *${c.action}*\n`;
-            }
-        }
-        if (t2p.length > 0) {
-            out += `\n#### ✅ Praise\n`;
-            for (const c of t2p) {
-                out += `- \`${c.file}\`: ${c.title}\n`;
-            }
-        }
-        if (t2c.length === 0 && t2w.length === 0 && t2p.length === 0) {
-            out += `> ✅ No file-level issues found.\n`;
-        }
-        out += `> 💰 *AI review cost: ~$${aiCost.toFixed(4)}*\n`;
-    }
-    // ── Tier 3: Context Reviewer ───────────────────────────────────────────
-    out += `\n### 🧠 Tier 3 — Context Reviewer\n`;
-    if (!tier2Passed) {
-        out += `> ⏸️ Skipped — resolve Tier 1 and Tier 2 issues first.\n`;
-    }
-    else if (skip_checks.includes("context_review")) {
-        out += `> ⏭️ Skipped by skip_checks.\n`;
-    }
-    else {
-        const t3c = reviewComments.filter(c => c.tier === 3 && c.severity === "CRITICAL");
-        const t3w = reviewComments.filter(c => c.tier === 3 && c.severity === "WARNING");
-        const t3i = reviewComments.filter(c => c.tier === 3 && c.severity === "INFO");
-        const t3p = reviewComments.filter(c => c.tier === 3 && c.severity === "PRAISE");
-        if (t3c.length > 0) {
-            out += `\n#### 🔴 Critical (${t3c.length})\n`;
-            for (const c of t3c) {
-                out += `\n**[${c.area}] ${c.title}**${c.file ? ` — \`${c.file}\`` : ""}\n`;
-                out += `> ${c.detail.replace(/\n/g, "\n> ")}\n`;
-                if (c.action)
-                    out += `> 🔧 *${c.action}*\n`;
-            }
-        }
-        if (t3w.length > 0) {
-            out += `\n#### 🟡 Warnings (${t3w.length})\n`;
-            for (const c of t3w) {
-                out += `\n**[${c.area}] ${c.title}**${c.file ? ` — \`${c.file}\`` : ""}\n`;
-                out += `> ${c.detail.replace(/\n/g, "\n> ")}\n`;
-                if (c.action)
-                    out += `> 💡 *${c.action}*\n`;
-            }
-        }
-        if (t3i.length > 0) {
-            out += `\n#### 🟢 Info (${t3i.length})\n`;
-            for (const c of t3i) {
-                out += `- **[${c.area}]** \`${c.file || ""}\` — ${c.detail}\n`;
-                if (c.action)
-                    out += `  > 💡 *${c.action}*\n`;
-            }
-        }
-        if (t3p.length > 0) {
-            out += `\n#### ✅ Praise\n`;
-            for (const c of t3p)
-                out += `- **${c.title}** — ${c.detail.replace(/\n/g, " ")}\n`;
-        }
-        if (t3c.length === 0 && t3w.length === 0 && t3i.length === 0 && t3p.length === 0) {
-            out += `> ✅ Task brain cross-reference clean — all ACs traceable, no rejected patterns, no scope creep.\n`;
-        }
-    }
-    // ── Summary table ──────────────────────────────────────────────────────
-    out += `\n---\n`;
-    out += `| Tier | Scope | 🔴 Critical | 🟡 Warning | 🟢 Info | ✅ Praise |\n|---|---|---|---|---|---|\n`;
-    out += `| Tier 1 | Mechanical | ${blockingMechanical.length} | ${warnings1.length} | — | — |\n`;
-    out += `| Tier 2 | AI File Review | ${reviewComments.filter(c => c.tier === 2 && c.severity === "CRITICAL").length} | ${reviewComments.filter(c => c.tier === 2 && c.severity === "WARNING").length} | — | ${reviewComments.filter(c => c.tier === 2 && c.severity === "PRAISE").length} |\n`;
-    out += `| Tier 3 | Context Review | ${reviewComments.filter(c => c.tier === 3 && c.severity === "CRITICAL").length} | ${reviewComments.filter(c => c.tier === 3 && c.severity === "WARNING").length} | ${allInfos.length} | ${reviewComments.filter(c => c.tier === 3 && c.severity === "PRAISE").length} |\n`;
-    out += `| **Total** | | **${allCriticals.length}** | **${allWarnings.length}** | **${allInfos.length}** | **${allPraises.length}** |\n\n`;
-    // ── Verdict ────────────────────────────────────────────────────────────
-    out += `## ${verdict}\n\n${verdictReason}\n`;
-    if (verdict === "✅ APPROVED") {
-        out += `\n**Next steps:**\n`;
-        out += `1. \`manage_task(action: "complete", work_item_id: "${work_item_id}")\`\n`;
-        out += `2. Generate PR and ADO documents manually using AGENTS.md rules\n`;
-        out += `3. Raise the PR\n`;
-    }
-    else if (verdict === "❌ CHANGES_REQUESTED") {
-        out += `\n**Resolve all 🔴 Critical findings above, then re-run \`run_pre_pr_checks_with_reviewer_agent\`.**\n`;
-    }
-    else {
-        out += `\n**Discuss 🟡 warnings with your team, then proceed with \`manage_task(complete)\`.**\n`;
-    }
-    return appendTelemetry({ content: [{ type: "text", text: out }] }, inputChars);
 });
 // Full-spectrum PR review system.
 //

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "secufusion-mcp",
-  "version": "1.2.3",
+  "version": "1.2.4",
   "type": "module",
   "description": "SecuFusion MCP server - developer workflow tooling with guardrails",
   "main": "index.js",