secufusion-mcp 2.2.5 → 2.2.7

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "secufusion-mcp",
   "description": "SecuFusion MSSP platform dev agent — project-level spec driven, tenant-isolation enforced, zero-trust guardrails. 5 Core Slash Commands: /sfn-init (dynamic DNA + architecture diagram + watcher), /sfn-plan (philosophy check + intent WHY + classify + plan), /sfn-code (spec-driven implementation), /sfn-review (zero-tolerance 3-tier PR gate), /sfn-explore (on-demand service graph or blast-radius analysis).",
-  "version": "2.2.5",
+  "version": "2.2.7",
   "author": {
     "name": "Motivity Labs"
   },

package/mcp/dist/server.js

@@ -679,7 +679,7 @@ server.tool("spec_create_intent", "Creates a structured Markdown intent file in
     })).optional().describe("Polyglot service map — lists every service involved regardless of language. This is the polyglot bridge."),
     notes: z.string().optional().describe("Any additional context, constraints, or dependencies.")
 }, async ({ work_item_id, title, business_goal, pm_owner, ticket_url, acceptance_criteria, out_of_scope, risk, services_involved, notes }) => {
-    const inputChars = JSON.stringify(arguments).length;
+    const inputChars = JSON.stringify({ work_item_id, title, business_goal, pm_owner, ticket_url, acceptance_criteria, out_of_scope, risk, services_involved, notes }).length;
     const num = nextIntentNumber();
     const slug = slugify(title);
     const filename = `${num}-WI-${work_item_id}-${slug}.md`;
@@ -2044,10 +2044,20 @@ server.tool("classify_task", "MANDATORY FIRST STEP for every task without except
     ];
     if (spec) {
         if (spec.microservices) {
-            Object.keys(spec.microservices).forEach(k => BACKEND_SIGNALS.push(k.toLowerCase()));
+            // FIX A: Only add service/table names when they appear as a whole word in the corpus.
+            // Substring matching caused "events" or "incidents" in a bug description to
+            // match sfn-events-api and its owned tables, inflating backendScore falsely.
+            const wholeWord = (token) => new RegExp(`(?<![a-z0-9-])${token.replace(/[-]/g, '[\\-\\s]?')}(?![a-z0-9-])`, "i").test(corpus);
+            Object.keys(spec.microservices).forEach(k => {
+                if (wholeWord(k.toLowerCase()))
+                    BACKEND_SIGNALS.push(k.toLowerCase());
+            });
             Object.values(spec.microservices).forEach(svc => {
                 if (Array.isArray(svc.owns_tables)) {
-                    svc.owns_tables.forEach(t => BACKEND_SIGNALS.push(t.toLowerCase()));
+                    svc.owns_tables.forEach(t => {
+                        if (wholeWord(t.toLowerCase()))
+                            BACKEND_SIGNALS.push(t.toLowerCase());
+                    });
                 }
             });
         }
@@ -2316,10 +2326,14 @@ server.tool("classify_task", "MANDATORY FIRST STEP for every task without except
         classification = "EXTENSION_ONLY";
     }
     else if (backendScore > 0 && (frontendScore > 0 || extensionScore > 0)) {
-        if (frontendScore > backendScore * 2.5) {
+        // FIX C: Threshold reduced from 2.5x to 1.5x. The original 2.5x was set
+        // before spec signal injection existed; now that injection can inflate
+        // backendScore with service/table name hits, a genuine frontend-only task
+        // with a few domain words could never clear 2.5x and was trapped as FULL_STACK.
+        if (frontendScore > backendScore * 1.5) {
             classification = "FRONTEND_ONLY";
         }
-        else if (backendScore > frontendScore * 2.5) {
+        else if (backendScore > frontendScore * 1.5) {
             classification = "BACKEND_ONLY";
         }
         else {
@@ -2374,16 +2388,12 @@ server.tool("classify_task", "MANDATORY FIRST STEP for every task without except
         "column", "table", "migration", "entity", "@entity",
         "schema", "alter", "add column", "drop column", "rename column",
     ];
-    if (spec && spec.microservices) {
-        Object.values(spec.microservices).forEach(svc => {
-            if (Array.isArray(svc.owns_tables)) {
-                svc.owns_tables.forEach(t => DB_CHANGE_SIGNALS.push(t.toLowerCase()));
-            }
-            if (Array.isArray(svc.kafka_consumes)) {
-                svc.kafka_consumes.forEach(topic => KAFKA_CHANGE_SIGNALS.push(topic.toLowerCase()));
-            }
-        });
-    }
+    // FIX B: Do NOT append Kafka topic names or DB table names from the spec into the
+    // signal arrays. Topic names like "device-registration" or table names like "events"
+    // appear in ordinary bug descriptions and trigger false breaking-change warnings.
+    // The structural keywords already in KAFKA_CHANGE_SIGNALS / DB_CHANGE_SIGNALS
+    // ("kafka", "migration", "alter", "add column", etc.) are sufficient — those only
+    // fire when the description explicitly discusses infrastructure changes.
     const endpointRisk = ENDPOINT_CHANGE_SIGNALS.some(s => corpus.includes(s));
     const kafkaRisk = KAFKA_CHANGE_SIGNALS.some(s => corpus.includes(s));
     const dbRisk = DB_CHANGE_SIGNALS.some(s => corpus.includes(s));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "secufusion-mcp",
-  "version": "2.2.5",
+  "version": "2.2.7",
   "type": "module",
   "description": "Project-level spec driven AI workflow tooling for SecuFusion, MCP server - developer workflow tooling with guardrails",
   "main": "mcp/dist/server.js",