secufusion-mcp 2.2.7 → 2.2.9

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "secufusion-mcp",
   "description": "SecuFusion MSSP platform dev agent — project-level spec driven, tenant-isolation enforced, zero-trust guardrails. 5 Core Slash Commands: /sfn-init (dynamic DNA + architecture diagram + watcher), /sfn-plan (philosophy check + intent WHY + classify + plan), /sfn-code (spec-driven implementation), /sfn-review (zero-tolerance 3-tier PR gate), /sfn-explore (on-demand service graph or blast-radius analysis).",
-  "version": "2.2.7",
+  "version": "2.2.9",
   "author": {
     "name": "Motivity Labs"
   },

package/agents/AGENTS.md

@@ -1,4 +1,4 @@
-# SecuFusion MCP Workflow Router
+# SecuFusion MCP Workflow Router
 
 You are an elite Senior Developer and Architect. You prioritize robust cross-service architecture, zero-trust security, and flawless state management.
 
@@ -47,7 +47,7 @@ Call `philosophy_check` AFTER DNA is loaded — never before. The engine us
 
 **This check is completely invisible to the user.** You do not announce it. You do not show scores, verdicts, or "philosophy" terminology. You surface a concern to the user only if the verdict is FAIL or BLOCKED — and you translate it into plain developer language.
 
-For `bug` and `hotfix`: philosophy check still applies, though the scoring engine evaluates them with slightly relaxed thresholds since defects have an inherent "WHY".
+For `bug` and `hotfix`: philosophy check **fully runs** — no skip. The scoring engine applies relaxed thresholds: WHY gets a +20 head-start (something is broken = implicit justification), WHO gets a +15 head-start (reporter = implicit authority), and `NO_JUSTIFICATION` is not a blocking verdict. However, ADVISORY and FAIL still fire normally — a high-risk bug fix (auth regression, data-loss, multi-tenant blast) will still be challenged.
 
 **Verdicts:**
 - `PHILOSOPHY_PASS` → Silent. Proceed immediately.

package/mcp/dist/server.js

@@ -897,14 +897,15 @@ server.tool("manage_task", "Manages structured task records in .secufusion/tasks
     completed_acs: z.array(z.string()).optional().describe("Completed AC list. Used with 'update_spec'."),
     next_step: z.string().optional().describe("Next actionable step. Required for 'update_spec'."),
     tags: z.array(z.string()).optional().describe("Tags for searchability, e.g. ['tenant', 'iam', 'security']."),
+    task_type: z.enum(["bug", "user_story", "feature", "hotfix", "refactor", "chore"]).optional().describe("Type of work item. Persisted to spec.json so search_tasks and filter_type work correctly. Pass on initialize and wherever classify_task supplies it."),
     file_path: z.string().optional().describe("File path to log. Used with 'log_file_touched'."),
     change_summary: z.string().optional().describe("One-line summary of the change. Used with 'log_file_touched'."),
     decision: z.string().optional().describe("Architectural decision to record. Used with 'log_decision'."),
     rationale: z.string().optional().describe("Why this decision was made. Used with 'log_decision'."),
     scenario: z.string().optional().describe("Test scenario description. Used with 'add_scenario'."),
     scenario_type: z.enum(["unit", "integration", "e2e", "manual"]).optional().describe("Test scenario type. Used with 'add_scenario'."),
-}, async ({ action, work_item_id, title, description, acceptance_criteria, pending_acs, completed_acs, next_step, tags, file_path, change_summary, decision, rationale, scenario, scenario_type }) => {
-    const inputChars = JSON.stringify({ action, work_item_id, title, description, acceptance_criteria, pending_acs, completed_acs, next_step, tags, file_path, change_summary, decision, rationale, scenario, scenario_type }).length;
+}, async ({ action, work_item_id, title, description, acceptance_criteria, pending_acs, completed_acs, next_step, tags, task_type, file_path, change_summary, decision, rationale, scenario, scenario_type }) => {
+    const inputChars = JSON.stringify({ action, work_item_id, title, description, acceptance_criteria, pending_acs, completed_acs, next_step, tags, task_type, file_path, change_summary, decision, rationale, scenario, scenario_type }).length;
     const tasksRoot = resolve(TASKS_DIR);
     let dir = resolveTaskFolder(work_item_id, tasksRoot);
     if (action === "initialize") {
@@ -926,7 +927,7 @@ server.tool("manage_task", "Manages structured task records in .secufusion/tasks
         if (!title)
             return appendTelemetry({ isError: true, content: [{ type: "text", text: "ERROR: 'title' is required for action=initialize." }] }, inputChars);
         const now = new Date().toISOString();
-        const spec = { work_item_id, title, description: description || "", acceptance_criteria: acceptance_criteria || [], tags: tags || [], created_at: now, status: "active" };
+        const spec = { work_item_id, title, description: description || "", acceptance_criteria: acceptance_criteria || [], tags: tags || [], task_type: task_type || "unknown", created_at: now, status: "active" };
         const progress = { pending_acs: acceptance_criteria || [], completed_acs: [], next_step: "Review spec and begin implementation.", last_updated: now };
         if (!fs.existsSync(specPath)) {
             writeFile(specPath, JSON.stringify(spec, null, 2));
@@ -935,8 +936,8 @@ server.tool("manage_task", "Manages structured task records in .secufusion/tasks
             writeFile(filesPath, JSON.stringify([], null, 2));
             writeFile(scenariosPath, JSON.stringify([], null, 2));
         }
-        upsertRegistry({ work_item_id, title, status: "active", created_at: now, tags: tags || [], folder: path.basename(dir) });
-        return appendTelemetry({ content: [{ type: "text", text: `✅ Task WI-${work_item_id} initialized.\n\n**Folder:** ${dir}\n**Title:** ${title}\n**ACs:** ${(acceptance_criteria || []).length}\n\n${JSON.stringify(spec, null, 2)}` }] }, inputChars);
+        upsertRegistry({ work_item_id, title, status: "active", created_at: now, tags: tags || [], task_type: task_type || "unknown", folder: path.basename(dir) });
+        return appendTelemetry({ content: [{ type: "text", text: `✅ Task WI-${work_item_id} initialized.\n\n**Folder:** ${dir}\n**Title:** ${title}\n**Type:** ${task_type || "unknown"}\n**ACs:** ${(acceptance_criteria || []).length}\n\n${JSON.stringify(spec, null, 2)}` }] }, inputChars);
     }
     if (!fs.existsSync(specPath)) {
         return appendTelemetry({ isError: true, content: [{ type: "text", text: `ERROR: Task WI-${work_item_id} not found. Call action=initialize first.\n\nExpected folder: ${dir}` }] }, inputChars);
@@ -967,7 +968,7 @@ server.tool("manage_task", "Manages structured task records in .secufusion/tasks
         if (!next_step)
             return appendTelemetry({ isError: true, content: [{ type: "text", text: "ERROR: 'next_step' is required for action=update_spec." }] }, inputChars);
         const now = new Date().toISOString();
-        if (description !== undefined || acceptance_criteria !== undefined || tags !== undefined) {
+        if (description !== undefined || acceptance_criteria !== undefined || tags !== undefined || task_type !== undefined) {
             const spec = readJson(specPath) || {};
             if (description !== undefined)
                 spec["description"] = description;
@@ -975,6 +976,10 @@ server.tool("manage_task", "Manages structured task records in .secufusion/tasks
                 spec["acceptance_criteria"] = acceptance_criteria;
             if (tags !== undefined)
                 spec["tags"] = tags;
+            if (task_type !== undefined) {
+                spec["task_type"] = task_type;
+                upsertRegistry({ work_item_id, task_type });
+            }
             writeFile(specPath, JSON.stringify(spec, null, 2));
         }
         const progress = readJson(progressPath) || {};
@@ -1542,10 +1547,12 @@ server.tool("philosophy_check", "MANDATORY PHASE -1 STEP — runs BEFORE classif
     client_confirmed: z.boolean().optional().describe("Has the decision maker explicitly confirmed this is needed?"),
 }, async ({ work_item_id, title, description, task_type, reported_by, client_confirmed }) => {
     const inputChars = JSON.stringify({ work_item_id, title, description, task_type }).length;
-    // Fast-path: bugs and hotfixes skip philosophy check
-    if (task_type === "bug" || task_type === "hotfix") {
-        return appendTelemetry({ content: [{ type: "text", text: `[PHILOSOPHY SKIPPED] ${work_item_id} — task_type="${task_type}". Bugs/hotfixes skip philosophy. Proceeding directly to classify_task.` }] }, inputChars);
-    }
+    // Bugs and hotfixes run through the full philosophy engine with relaxed scoring:
+    //   WHY  → +20 head-start (defects have an inherent "WHY": something is broken)
+    //   WHO  → +15 head-start (reporter is implicit authority for a defect)
+    //   RISK → NO_JUSTIFICATION block exempted for bug/hotfix (see Pass 5)
+    // This ensures high-risk bug fixes (auth regressions, data-loss fixes, multi-tenant
+    // defects) still surface ADVISORY or FAIL when the blast radius warrants it.
     // Check cache
     const philosophyDir = resolve(".secufusion/philosophy");
     const philosophyFile = path.join(philosophyDir, `${work_item_id}.json`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "secufusion-mcp",
-  "version": "2.2.7",
+  "version": "2.2.9",
   "type": "module",
   "description": "Project-level spec driven AI workflow tooling for SecuFusion, MCP server - developer workflow tooling with guardrails",
   "main": "mcp/dist/server.js",