secufusion-mcp 1.2.7 → 2.0.0

package/{index.js → mcp/dist/server.js}

@@ -20,15 +20,31 @@ import { z } from "zod";
 import fs from "fs";
 import path from "path";
 import { execSync } from "child_process";
+import { parseDomainModels } from "./parsers/domain.js";
+import { parseApiEndpoints } from "./parsers/api.js";
+import { parseEventTopics } from "./parsers/events.js";
+import { inferPatterns } from "./parsers/patterns.js";
+import { parseFrontend } from "./parsers/frontend.js";
+import { parseNodeApis } from "./parsers/backend-node.js";
+import { parseInfra } from "./parsers/infra.js";
+import { parseDatabase } from "./parsers/database.js";
+import { parseSecurity } from "./parsers/security.js";
+import { parseConfig, parseExternalEnv } from "./parsers/config.js";
+import chokidar from "chokidar";
 // ─────────────────────────────────────────────
 //  Constants / helpers
 // ─────────────────────────────────────────────
 const STATE_FILE = ".secufusion-state.json";
 const REJECTED_FILE = ".rejected-patterns.json";
 const TOKEN_FILE = ".secufusion-tokens.json";
+const argv = process.argv.slice(2);
+const rootFlag = argv.indexOf('--root');
+const ROOT = rootFlag !== -1
+    ? path.resolve(argv[rootFlag + 1] ?? '.')
+    : process.cwd();
 /** Find the workspace root by walking up from cwd to find a project marker. */
 function getWorkspaceRoot() {
-    let currentDir = process.cwd();
+    let currentDir = ROOT;
     const rootMarkers = [".git", "package.json", "pom.xml", ".secufusion-project-spec.json", ".agents"];
     for (let i = 0; i < 10; i++) {
         for (const marker of rootMarkers) {
@@ -41,7 +57,7 @@ function getWorkspaceRoot() {
             break; // Reached filesystem root
         currentDir = parent;
     }
-    return process.cwd(); // Fallback to current directory
+    return ROOT; // Fallback to ROOT directory
 }
 /** Resolve a path relative to workspace root (where the MCP server is invoked). */
 function resolve(file) {
@@ -2708,7 +2724,8 @@ server.tool("run_pre_pr_checks_with_reviewer_agent", "Unified, single-call PR re
 }, async ({ work_item_id, skip_checks = [], suppressions = [] }) => {
     try {
         const cp = require('child_process');
-        const scriptPath = require('path').resolve(__dirname, 'scripts/sfn-pr-check.js');
+        const __dirname = require('url').fileURLToPath(new URL('.', import.meta.url));
+        const scriptPath = require('path').resolve(__dirname, '../../scripts/sfn-pr-check.js');
         const args = JSON.stringify({ work_item_id, skip_checks, suppressions });
         const output = cp.execFileSync(process.execPath, [scriptPath, args], { encoding: 'utf-8' });
         return { content: [{ type: 'text', text: output }] };
@@ -3937,7 +3954,7 @@ server.tool("reviewer_agent", "Context-aware architectural review agent — call
     return appendTelemetry({ content: [{ type: "text", text: out }] }, inputChars);
 });
 // ─── Resource & Prompt for Personas ──────────────────────────────────────────
-const AGENTS_DIR = path.resolve(path.dirname(new URL(import.meta.url).pathname.replace(/^\/([A-Z]:)/, "$1")), "../.agents");
+const AGENTS_DIR = path.resolve(path.dirname(new URL(import.meta.url).pathname.replace(/^\/([A-Z]:)/, "$1")), "../../agents");
 const PLANNER_MD_PATH = path.join(AGENTS_DIR, "planner.md");
 const CODER_MD_PATH = path.join(AGENTS_DIR, "coder.md");
 const REVIEWER_MD_PATH = path.join(AGENTS_DIR, "reviewer.md");
@@ -4001,5 +4018,392 @@ server.tool("skill_recommend", "Searches the skill catalog for matching domain s
         return appendTelemetry({ content: [{ type: "text", text: "Error parsing skills catalog." }] }, 0);
     }
 });
+let watcher = null;
+function getEcosystemRoot(workspaceRoot) {
+    const parentDir = path.dirname(workspaceRoot);
+    if (fs.existsSync(parentDir)) {
+        const parentChildren = fs.readdirSync(parentDir);
+        const sfnRepos = parentChildren.filter((c) => c.startsWith("sfn-") || c === "secufusion");
+        if (sfnRepos.length > 1) {
+            return parentDir;
+        }
+    }
+    return workspaceRoot;
+}
+const getDnaPath = (ecosystemRoot) => path.join(ecosystemRoot, ".secufusion", "dna.json");
+function ensureDnaFile(ecosystemRoot) {
+    const dnaPath = getDnaPath(ecosystemRoot);
+    const dir = path.dirname(dnaPath);
+    if (!fs.existsSync(dir)) {
+        fs.mkdirSync(dir, { recursive: true });
+    }
+    if (!fs.existsSync(dnaPath)) {
+        fs.writeFileSync(dnaPath, JSON.stringify({
+            domains: [],
+            apis: [],
+            events: [],
+            node_apis: [],
+            frontend: [],
+            infra: [],
+            databases: [],
+            security: [],
+            configurations: [],
+            inferred_patterns: []
+        }, null, 2));
+    }
+    return dnaPath;
+}
+function readDna(ecosystemRoot) {
+    ensureDnaFile(ecosystemRoot);
+    return JSON.parse(fs.readFileSync(getDnaPath(ecosystemRoot), "utf-8"));
+}
+function writeDna(ecosystemRoot, dna) {
+    fs.writeFileSync(getDnaPath(ecosystemRoot), JSON.stringify(dna, null, 2));
+}
+const VALID_EXTENSIONS = ['.java', '.ts', '.js', '.tsx', '.jsx', '.vue', '.sql', '.prisma', '.tf', '.yaml', '.yml', '.env', '.env.example', '.env.local', '.properties'];
+function getAllSourceFiles(dirPath, repoName, arrayOfFiles = []) {
+    if (!fs.existsSync(dirPath))
+        return arrayOfFiles;
+    const files = fs.readdirSync(dirPath);
+    files.forEach(function (file) {
+        const fullPath = path.join(dirPath, file);
+        if (fs.statSync(fullPath).isDirectory()) {
+            if (file !== "node_modules" && file !== "target" && file !== ".git" && file !== "build") {
+                arrayOfFiles = getAllSourceFiles(fullPath, repoName, arrayOfFiles);
+            }
+        }
+        else {
+            if (VALID_EXTENSIONS.some(ext => file.endsWith(ext)) || file === 'docker-compose.yml') {
+                arrayOfFiles.push({ path: fullPath, repo: repoName });
+            }
+        }
+    });
+    return arrayOfFiles;
+}
+function getPolyRepoSourceFiles(ecosystemRoot) {
+    let allFiles = [];
+    const children = fs.readdirSync(ecosystemRoot);
+    for (const child of children) {
+        const childPath = path.join(ecosystemRoot, child);
+        if (fs.statSync(childPath).isDirectory() && (child.startsWith("sfn-") || child === "secufusion")) {
+            allFiles = allFiles.concat(getAllSourceFiles(childPath, child));
+        }
+        else if (fs.statSync(childPath).isDirectory() && ecosystemRoot === childPath) {
+            allFiles = allFiles.concat(getAllSourceFiles(childPath, path.basename(childPath)));
+        }
+    }
+    return allFiles;
+}
+function performFullExtraction(ecosystemRoot) {
+    const sourceFiles = getPolyRepoSourceFiles(ecosystemRoot);
+    const models = [];
+    const apis = [];
+    const events = [];
+    const nodeApis = [];
+    const frontend = [];
+    const infra = [];
+    const databases = [];
+    const security = [];
+    const configurations = [];
+    for (const fileObj of sourceFiles) {
+        const content = fs.readFileSync(fileObj.path, 'utf-8');
+        if (fileObj.path.endsWith('.java')) {
+            models.push(...parseDomainModels(fileObj.path, content, fileObj.repo));
+            apis.push(...parseApiEndpoints(fileObj.path, content, fileObj.repo));
+            events.push(...parseEventTopics(fileObj.path, content, fileObj.repo));
+        }
+        nodeApis.push(...parseNodeApis(fileObj.path, content, fileObj.repo));
+        frontend.push(...parseFrontend(fileObj.path, content, fileObj.repo));
+        infra.push(...parseInfra(fileObj.path, content, fileObj.repo));
+        databases.push(...parseDatabase(fileObj.path, content, fileObj.repo));
+        security.push(...parseSecurity(fileObj.path, content, fileObj.repo));
+        configurations.push(...parseConfig(fileObj.path, content, fileObj.repo));
+    }
+    const dna = readDna(ecosystemRoot);
+    dna.domains = models;
+    dna.apis = apis;
+    dna.events = events;
+    dna.node_apis = nodeApis;
+    dna.frontend = frontend;
+    dna.infra = infra;
+    dna.databases = databases;
+    dna.security = security;
+    dna.configurations = configurations;
+    // Apply Pattern Inference
+    dna.inferred_patterns = inferPatterns(dna);
+    writeDna(ecosystemRoot, dna);
+    return {
+        modelsCount: models.length,
+        apisCount: apis.length + nodeApis.length,
+        eventsCount: events.length,
+        frontendCount: frontend.length,
+        infraCount: infra.length,
+        databasesCount: databases.length,
+        securityCount: security.length,
+        configurationsCount: configurations.length,
+        inferredCount: dna.inferred_patterns.length
+    };
+}
+server.tool("scan_repository_stack", "Analyzes the ecosystem root to identify the framework and infrastructure", {
+    workspace_root: z.string().describe("Root directory of the workspace")
+}, async ({ workspace_root }) => {
+    try {
+        const ecosystemRoot = getEcosystemRoot(workspace_root);
+        ensureDnaFile(ecosystemRoot);
+        const files = fs.readdirSync(ecosystemRoot);
+        let stack = [];
+        if (files.includes("package.json"))
+            stack.push("Node.js");
+        if (files.includes("pom.xml") || files.includes("build.gradle"))
+            stack.push("Java/Spring");
+        if (files.includes("docker-compose.yml"))
+            stack.push("Docker");
+        let warningMsg = "";
+        // Look for .secufusion-project-spec.json in ecosystemRoot or workspaceRoot
+        const specPathEcosystem = path.join(ecosystemRoot, ".secufusion-project-spec.json");
+        const specPathWorkspace = path.join(workspace_root, ".secufusion-project-spec.json");
+        const specPath = fs.existsSync(specPathWorkspace) ? specPathWorkspace : (fs.existsSync(specPathEcosystem) ? specPathEcosystem : null);
+        if (specPath) {
+            try {
+                const specData = JSON.parse(fs.readFileSync(specPath, "utf-8"));
+                if (specData) {
+                    let expectedServices = [];
+                    if (specData.microservices) {
+                        expectedServices = expectedServices.concat(Object.keys(specData.microservices));
+                    }
+                    if (specData.frontend && specData.frontend.repo) {
+                        expectedServices.push(specData.frontend.repo);
+                    }
+                    if (specData.chrome_extension && specData.chrome_extension.repo) {
+                        expectedServices.push(specData.chrome_extension.repo);
+                    }
+                    const physicalDirs = files.filter(f => fs.statSync(path.join(ecosystemRoot, f)).isDirectory());
+                    const missingServices = expectedServices.filter(svc => !physicalDirs.includes(svc));
+                    if (missingServices.length > 0) {
+                        warningMsg = `\n\n[WARNING] According to .secufusion-project-spec.json, the following mandatory repositories (microservices/frontend/ext) are missing from your local workspace: ${missingServices.join(", ")}. Please clone them to ensure a complete DNA map.`;
+                    }
+                }
+            }
+            catch (e) {
+                warningMsg = `\n\n[WARNING] Failed to parse .secufusion-project-spec.json: ${e.message}`;
+            }
+        }
+        return {
+            content: [{ type: "text", text: `Scanned ecosystem at ${ecosystemRoot}. Detected stack: ${stack.join(", ")}${warningMsg}` }]
+        };
+    }
+    catch (e) {
+        return { content: [{ type: "text", text: `Error: ${e.message}` }], isError: true };
+    }
+});
+server.tool("extract_domain_models", "Parses files across the ecosystem to build the Domain Encyclopedia and checks Golden Rules", {
+    workspace_root: z.string().describe("Root directory of the workspace"),
+}, async ({ workspace_root }) => {
+    try {
+        const ecosystemRoot = getEcosystemRoot(workspace_root);
+        const stats = performFullExtraction(ecosystemRoot);
+        return {
+            content: [{ type: "text", text: `Extracted ${stats.modelsCount} domain models. Derived ${stats.inferredCount} architectural patterns.` }]
+        };
+    }
+    catch (e) {
+        return { content: [{ type: "text", text: `Error: ${e.message}` }], isError: true };
+    }
+});
+server.tool("extract_api_endpoints", "Scans for REST/GraphQL endpoints across the ecosystem", {
+    workspace_root: z.string().describe("Root directory of the workspace")
+}, async ({ workspace_root }) => {
+    try {
+        const ecosystemRoot = getEcosystemRoot(workspace_root);
+        const stats = performFullExtraction(ecosystemRoot);
+        return {
+            content: [{ type: "text", text: `Extracted ${stats.apisCount} API controllers. Derived ${stats.inferredCount} architectural patterns.` }]
+        };
+    }
+    catch (e) {
+        return { content: [{ type: "text", text: `Error: ${e.message}` }], isError: true };
+    }
+});
+server.tool("extract_event_topics", "Scans for event listener/producer usage across the ecosystem", {
+    workspace_root: z.string().describe("Root directory of the workspace")
+}, async ({ workspace_root }) => {
+    try {
+        const ecosystemRoot = getEcosystemRoot(workspace_root);
+        const stats = performFullExtraction(ecosystemRoot);
+        return {
+            content: [{ type: "text", text: `Extracted ${stats.eventsCount} event classes. Derived ${stats.inferredCount} architectural patterns.` }]
+        };
+    }
+    catch (e) {
+        return { content: [{ type: "text", text: `Error: ${e.message}` }], isError: true };
+    }
+});
+server.tool("query_knowledge_graph", "Queries the relationships in the central dna.json", {
+    workspace_root: z.string().describe("Root directory of the workspace"),
+    query: z.string().describe("What to query")
+}, async ({ workspace_root, query }) => {
+    try {
+        const ecosystemRoot = getEcosystemRoot(workspace_root);
+        const dnaPath = getDnaPath(ecosystemRoot);
+        if (!fs.existsSync(dnaPath)) {
+            return { content: [{ type: "text", text: `No DNA found at ${dnaPath}.` }] };
+        }
+        const dna = JSON.parse(fs.readFileSync(dnaPath, "utf-8"));
+        const result = JSON.stringify(dna, null, 2);
+        return {
+            content: [{ type: "text", text: `Ecosystem Knowledge Graph Data:\n${result}` }]
+        };
+    }
+    catch (e) {
+        return { content: [{ type: "text", text: `Error: ${e.message}` }], isError: true };
+    }
+});
+server.tool("calculate_blast_radius", "Calculates the impact of changing a specific component, entity, or API", {
+    workspace_root: z.string().describe("Root directory of the workspace"),
+    component_name: z.string().describe("Name of the component, entity, or API to analyze")
+}, async ({ workspace_root, component_name }) => {
+    try {
+        const ecosystemRoot = getEcosystemRoot(workspace_root);
+        const dnaPath = getDnaPath(ecosystemRoot);
+        if (!fs.existsSync(dnaPath)) {
+            return { content: [{ type: "text", text: `No DNA found at ${dnaPath}.` }] };
+        }
+        const dna = JSON.parse(fs.readFileSync(dnaPath, "utf-8"));
+        // Simple search across all arrays to find dependencies
+        const impacts = [];
+        for (const key of Object.keys(dna)) {
+            if (Array.isArray(dna[key])) {
+                for (const item of dna[key]) {
+                    const itemStr = JSON.stringify(item);
+                    if (itemStr.includes(component_name)) {
+                        impacts.push(`- Found in ${key}: ${item.controllerName || item.componentName || item.tableName || item.name || item.filePath || item.key}`);
+                    }
+                }
+            }
+        }
+        return {
+            content: [{ type: "text", text: `Blast Radius for '${component_name}':\n${impacts.join('\n')}` }]
+        };
+    }
+    catch (e) {
+        return { content: [{ type: "text", text: `Error: ${e.message}` }], isError: true };
+    }
+});
+server.tool("load_external_env_file", "Loads an unmasked external environment file to override masked values in the knowledge graph", {
+    workspace_root: z.string().describe("Root directory of the workspace"),
+    absolute_file_path: z.string().describe("Absolute path to the unmasked .env or .properties file")
+}, async ({ workspace_root, absolute_file_path }) => {
+    try {
+        const ecosystemRoot = getEcosystemRoot(workspace_root);
+        if (!fs.existsSync(absolute_file_path)) {
+            return { content: [{ type: "text", text: `File not found: ${absolute_file_path}` }], isError: true };
+        }
+        const content = fs.readFileSync(absolute_file_path, "utf-8");
+        const realValues = parseExternalEnv(content);
+        const dnaPath = getDnaPath(ecosystemRoot);
+        if (!fs.existsSync(dnaPath)) {
+            return { content: [{ type: "text", text: `No DNA found at ${dnaPath}.` }], isError: true };
+        }
+        const dna = JSON.parse(fs.readFileSync(dnaPath, "utf-8"));
+        let updatedCount = 0;
+        if (dna.configurations) {
+            for (const config of dna.configurations) {
+                for (const entry of config.entries) {
+                    if (entry.requiresRealValues && realValues[entry.key]) {
+                        entry.value = realValues[entry.key];
+                        entry.requiresRealValues = false;
+                        updatedCount++;
+                    }
+                }
+            }
+        }
+        writeDna(ecosystemRoot, dna);
+        return {
+            content: [{ type: "text", text: `Successfully loaded ${updatedCount} real configuration values into the Knowledge Graph.` }]
+        };
+    }
+    catch (e) {
+        return { content: [{ type: "text", text: `Error: ${e.message}` }], isError: true };
+    }
+});
+server.tool("start_dna_watcher", "Starts a continuous file watcher to automatically sync the DNA when files are modified", {
+    workspace_root: z.string().describe("Root directory of the workspace")
+}, async ({ workspace_root }) => {
+    try {
+        if (watcher) {
+            return { content: [{ type: "text", text: `DNA Watcher is already running.` }] };
+        }
+        const ecosystemRoot = getEcosystemRoot(workspace_root);
+        watcher = chokidar.watch(ecosystemRoot, {
+            ignored: /(^|[\/\\])\..|node_modules|target|build/,
+            persistent: true
+        });
+        watcher.on('change', (path) => {
+            if (VALID_EXTENSIONS.some(ext => path.endsWith(ext))) {
+                console.log(`[DNA Watcher] Detected change in ${path}. Re-syncing DNA...`);
+                performFullExtraction(ecosystemRoot);
+            }
+        });
+        return {
+            content: [{ type: "text", text: `Successfully started DNA File Watcher on ${ecosystemRoot}. The knowledge graph will now update automatically in the background.` }]
+        };
+    }
+    catch (e) {
+        return { content: [{ type: "text", text: `Error starting watcher: ${e.message}` }], isError: true };
+    }
+});
+// ─── MCP Prompts (appear as slash commands in Claude IDE picker) ──────────────
+server.prompt("sfn-init", "Prime the SecuFusion ecosystem — scan the entire codebase, map the architectural DNA (services, models, APIs, events), and write it to .secufusion/dna.json. Run this once when you first open a new project.", {
+    workspace_root: z.string().describe("Absolute path to the project root. Leave blank to use the current working directory.")
+}, ({ workspace_root }) => ({
+    messages: [{
+            role: "user",
+            content: {
+                type: "text",
+                text: `You are executing **sfn:init** — the SecuFusion DNA bootstrap command.
+
+Workspace root: ${workspace_root || process.cwd()}
+
+**This is a learn-first command. Do NOT write implementation code. Study THIS project and produce real findings.**
+
+## Phase 1 — SCAN (run all 4 tool calls concurrently in a single message)
+1. Call \`scan_repository_stack\` — identify language, framework, microservices, build/test commands. Flag monorepos.
+2. Call \`extract_domain_models\` — map all domain entities, fields, and relationships.
+3. Call \`extract_api_endpoints\` — map all REST/GraphQL endpoints, methods, and owning services.
+4. Call \`extract_event_topics\` — map all Kafka/event-bus topics, producers, and consumers.
+
+## Phase 2 — WRITE DNA
+- Write combined findings to \`.secufusion/dna.json\` at the workspace root.
+- Update the \`<MEMORY>\` block in \`agents/claude.md\`: set \`DNA_LOADED = true\`, \`LAST_INIT\` = now, and \`ARCHITECTURE_SUMMARY\` = a 2-3 sentence human-readable summary.
+
+## Phase 3 — REPORT
+- Count: services, domain models, API endpoints, event topics found.
+- Flag anything marked \`(inferred)\` that the human should verify.
+- Confirm \`.secufusion/dna.json\` was written successfully.
+
+**Next step:** Run \`/sfn-plan\` with a ticket ID to start your first task.`
+            }
+        }]
+}));
+server.prompt("sfn-watch", "Enable continuous background DNA learning — starts a file watcher that automatically re-syncs .secufusion/dna.json whenever source files change.", {
+    workspace_root: z.string().describe("Absolute path to the project root to watch.")
+}, ({ workspace_root }) => ({
+    messages: [{
+            role: "user",
+            content: {
+                type: "text",
+                text: `You are executing **sfn:watch** — the SecuFusion continuous DNA watcher.
+
+Workspace root: ${workspace_root || process.cwd()}
+
+Call \`start_dna_watcher\` with workspace_root = "${workspace_root || process.cwd()}".
+
+This will start a background file watcher that automatically re-scans and updates \`.secufusion/dna.json\` whenever source files are modified, keeping the architectural knowledge graph fresh without manual re-runs of \`/sfn-init\`.
+
+Confirm to the user when the watcher is active and which directory is being watched.`
+            }
+        }]
+}));
+// ─────────────────────────────────────────────────────────────────────────────
 const transport = new StdioServerTransport();
 await server.connect(transport);

package/package.json

@@ -1,30 +1,33 @@
 {
   "name": "secufusion-mcp",
-  "version": "1.2.7",
+  "version": "2.0.0",
   "type": "module",
   "description": "SecuFusion MCP server - developer workflow tooling with guardrails",
-  "main": "index.js",
+  "main": "mcp/dist/server.js",
   "files": [
-    "index.js",
-    "index.d.ts",
-    "README.md",
-    ".secufusion-project-spec.json",
-    "AGENTS.md",
-    "commands/",
-    ".claude-plugin/"
+    ".claude-plugin",
+    ".mcp.json",
+    ".claude",
+    "agents",
+    "commands",
+    "hooks",
+    "mcp/dist",
+    "scripts",
+    "README.md"
   ],
   "bin": {
-    "secufusion-mcp": "index.js"
+    "secufusion-mcp": "mcp/dist/server.js"
   },
   "engines": {
     "node": ">=18.0.0"
   },
   "scripts": {
-    "build": "tsc",
-    "prepublishOnly": "copy ..\\README.md README.md && copy ..\\.agents\\AGENTS.md AGENTS.md && npm run build",
+    "build": "tsc --project mcp/tsconfig.json",
+    "prepublishOnly": "copy ..\\README.md README.md && npm run build",
     "postpublish": "del README.md",
-    "start": "node index.js",
-    "dev": "tsc && node index.js"
+    "start": "node mcp/dist/server.js",
+    "dev": "tsc --project mcp/tsconfig.json && node mcp/dist/server.js",
+    "postinstall": "node -e \"try { require('fs').chmodSync('hooks/knowledge-drift.sh', 0o755) } catch(e) {}\""
   },
   "keywords": [
     "mcp",
@@ -35,7 +38,8 @@
   "license": "ISC",
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0",
-    "zod": "^3.23.8"
+    "zod": "^3.23.8",
+    "chokidar": "^5.0.0"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",

package/scripts/sfn-pr-check.js

@@ -0,0 +1,108 @@
+import * as fs from 'fs';
+import * as path from 'path';
+import { resolve, readFileSafe, getWorkspaceRoot } from './utils.js';
+function parseArgs() {
+    try {
+        return JSON.parse(process.argv[2] || '{}');
+    }
+    catch {
+        return { work_item_id: 'UNKNOWN', skip_checks: [], suppressions: [] };
+    }
+}
+async function runTier1Checks(workItemId, skipChecks, suppressions) {
+    const wsRoot = getWorkspaceRoot();
+    // Find task folder
+    const tasksBase = resolve(".secufusion/tasks");
+    let taskDir = null;
+    if (fs.existsSync(tasksBase)) {
+        const folders = fs.readdirSync(tasksBase);
+        const match = folders.find(f => f.startsWith(workItemId));
+        if (match)
+            taskDir = path.join(tasksBase, match);
+    }
+    if (!taskDir) {
+        return `❌ CHANGES_REQUESTED: Task folder not found for ${workItemId}`;
+    }
+    // Read files-touched.json
+    let filesTouched = [];
+    try {
+        const ftContent = readFileSafe(path.join(taskDir, 'files-touched.json'));
+        if (ftContent)
+            filesTouched = JSON.parse(ftContent);
+    }
+    catch { }
+    let out = `## run_pre_pr_checks_with_reviewer_agent — ${workItemId}\n\n`;
+    out += `Found ${filesTouched.length} modified files.\n\n`;
+    let allPassed = true;
+    let failedChecks = [];
+    for (const file of filesTouched) {
+        const fullPath = path.resolve(wsRoot, file);
+        const content = readFileSafe(fullPath);
+        if (!content)
+            continue;
+        const isJava = file.endsWith('.java');
+        const isTs = file.endsWith('.ts');
+        const isSql = file.endsWith('.sql');
+        // P1 TENANT_ISOLATION
+        if (!skipChecks.includes('tenant_isolation') && isJava && file.includes('Repository')) {
+            const hasTenantFilter = /tenantid|tenant_id|\.tenant/i.test(content);
+            if (!hasTenantFilter) {
+                const suppressed = suppressions.find(s => s.check === 'TENANT_ISOLATION');
+                if (!suppressed) {
+                    allPassed = false;
+                    failedChecks.push(`❌ P1 TENANT_ISOLATION: ${file} lacks tenant filtering.`);
+                }
+            }
+        }
+        // P2 N_PLUS_ONE
+        if (!skipChecks.includes('n_plus_one') && (isJava || isTs)) {
+            // Very naive check for loop containing repository/dao calls
+            if (/(for|while)\s*\(.*\)[\s\S]*?(repository\.|dao\.)/i.test(content)) {
+                allPassed = false;
+                failedChecks.push(`❌ P2 N_PLUS_ONE: Potential DB call inside loop in ${file}.`);
+            }
+        }
+        // P3 MISSING_INDEX
+        if (!skipChecks.includes('missing_index') && isSql) {
+            if (/create table|alter table.*add column/i.test(content) && !/create index/i.test(content)) {
+                allPassed = false;
+                failedChecks.push(`❌ P3 MISSING_INDEX: Schema modification without an index in ${file}.`);
+            }
+        }
+        // P4 KAFKA_SYNC
+        if (!skipChecks.includes('kafka_sync') && isJava && content.includes('@KafkaListener')) {
+            if (/resttemplate|webclient|httpclient/i.test(content)) {
+                allPassed = false;
+                failedChecks.push(`❌ P4 KAFKA_SYNC: Synchronous HTTP call inside @KafkaListener in ${file}.`);
+            }
+        }
+        // P5 EARLY_RETURN
+        if (!skipChecks.includes('early_return') && (isJava || isTs)) {
+            // Count number of return statements. If > 1 in a method block, flag it (naive implementation)
+            const returns = (content.match(/\breturn\b/g) || []).length;
+            if (returns > 1 && !file.includes('Test')) {
+                allPassed = false;
+                failedChecks.push(`❌ P5 EARLY_RETURN: Multiple exit points detected in ${file}.`);
+            }
+        }
+    }
+    if (!allPassed) {
+        out += `### Tier 1: Mechanical Checks Failed\n`;
+        out += failedChecks.join('\n') + '\n\n';
+        out += `Verdict: ❌ CHANGES_REQUESTED\n`;
+    }
+    else {
+        out += `### Tier 1: Mechanical Checks Passed\n`;
+        out += `All files passed zero-tolerance P1-P5 validation.\n\n`;
+        if (!skipChecks.includes('ai_review') || !skipChecks.includes('context_review')) {
+            out += `### Tier 2 & 3: AI Reviewer\n`;
+            out += `(AI logic would execute here using Claude context)\n\n`;
+        }
+        out += `Verdict: ✅ APPROVED\n`;
+    }
+    return out;
+}
+const args = parseArgs();
+runTier1Checks(args.work_item_id, args.skip_checks, args.suppressions).then(out => {
+    console.log(out);
+});