secufusion-mcp 2.2.9 → 2.4.0

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "secufusion-mcp",
   "description": "SecuFusion MSSP platform dev agent — project-level spec driven, tenant-isolation enforced, zero-trust guardrails. 5 Core Slash Commands: /sfn-init (dynamic DNA + architecture diagram + watcher), /sfn-plan (philosophy check + intent WHY + classify + plan), /sfn-code (spec-driven implementation), /sfn-review (zero-tolerance 3-tier PR gate), /sfn-explore (on-demand service graph or blast-radius analysis).",
-  "version": "2.2.9",
+  "version": "2.4.0",
   "author": {
     "name": "Motivity Labs"
   },

package/mcp/dist/server.js

@@ -1556,15 +1556,31 @@ server.tool("philosophy_check", "MANDATORY PHASE -1 STEP — runs BEFORE classif
     // Check cache
     const philosophyDir = resolve(".secufusion/philosophy");
     const philosophyFile = path.join(philosophyDir, `${work_item_id}.json`);
+    let cached = null;
     if (fs.existsSync(philosophyFile)) {
         try {
-            const cached = JSON.parse(readFileSafe(philosophyFile) || "null");
+            cached = JSON.parse(readFileSafe(philosophyFile) || "null");
             if (cached && (cached.philosophy_verdict === "PHILOSOPHY_PASS" || cached.philosophy_verdict === "PHILOSOPHY_ADVISORY")) {
                 return appendTelemetry({ content: [{ type: "text", text: `[PHILOSOPHY CACHED] ${work_item_id} — verdict: ${cached.philosophy_verdict}\n\n${cached.developer_message}` }] }, inputChars);
             }
         }
         catch { }
     }
+    // Mandatory interview for features/stories
+    if ((task_type === "feature" || task_type === "user_story") && (!cached || !cached.interview_completed)) {
+        const interviewText = `[PHILOSOPHY FAIL] ${work_item_id}\n\nBefore I help you build this, talk to me.\n\nWhat problem is this solving?\nWalk me through what the user is experiencing today\nwithout this feature. What's broken? What's painful?\nWhat happens if we don't build this at all?\n\nWho will actually use this and how often?\nIs this solving a problem for 1 client or all tenants?\n\nI see you said WHO: CONFIRMED —\nbut confirmed by whom exactly?\nIs that a verbal yes in a meeting or\na written requirement from the client?\nThose are very different things.\n\nDo NOT call classify_task. Re-run philosophy_check after resolving.`;
+        if (!fs.existsSync(philosophyDir))
+            fs.mkdirSync(philosophyDir, { recursive: true });
+        try {
+            writeFile(philosophyFile, JSON.stringify({
+                work_item_id,
+                philosophy_verdict: "PHILOSOPHY_FAIL",
+                interview_completed: true
+            }, null, 2));
+        }
+        catch { }
+        return appendTelemetry({ content: [{ type: "text", text: interviewText }] }, inputChars);
+    }
     const wsRoot = getWorkspaceRoot();
     let rejectedPatterns = [];
     const rejRaw = readFileSafe(resolve(REJECTED_FILE));
@@ -2033,15 +2049,40 @@ server.tool("classify_task", "MANDATORY FIRST STEP for every task without except
     }
     // ── Step 4: Signal scoring ────────────────────────────────────────────
     const corpus = (title + " " + description).toLowerCase();
-    const BACKEND_SIGNALS = [
-        "api", "endpoint", "service", "repository", "database", "db", "query",
+    // Structural backend terms — always a reliable signal of backend work regardless of task type
+    const BACKEND_STRUCTURAL = [
         "migration", "kafka", "consumer", "producer", "topic",
-        "backend", "server", "rest", "json response", "payload",
+        "database", "db", "repository", "backend",
+    ];
+    // Contextual backend terms — these appear naturally when *describing* a bug symptom
+    // ("the events API returns X", "service returns wrong value") without implying
+    // backend work is needed. Counted for non-bugs only, OR for bugs that also contain
+    // explicit backend-change language (see BACKEND_CHANGE_PHRASES below).
+    const BACKEND_CONTEXTUAL = [
+        "api", "endpoint", "service", "server", "rest",
+        "json response", "payload", "query", "schema",
+    ];
+    // Explicit backend-change phrases: these restore contextual terms even for bugs,
+    // because they signal genuine backend scope rather than symptom description.
+    const BACKEND_CHANGE_PHRASES = [
+        "change the api", "update the api", "fix the api", "api contract",
+        "update endpoint", "change endpoint", "fix endpoint", "new endpoint",
+        "modify schema", "update schema", "alter table", "add column",
+        "api change", "breaking change", "response contract", "request body",
+        "fix the service", "update the service",
+    ];
+    const hasExplicitBackendChange = BACKEND_CHANGE_PHRASES.some(p => corpus.includes(p));
+    const isBugOrHotfix = task_type === "bug" || task_type === "hotfix";
+    const BACKEND_SIGNALS = [
+        ...BACKEND_STRUCTURAL,
+        // For bugs: contextual terms only re-admitted when description explicitly calls for backend change
+        ...(isBugOrHotfix && !hasExplicitBackendChange ? [] : BACKEND_CONTEXTUAL),
         ...learnedSignals.backend, ...learnedSignals.phrase, ...learnedSignals.bug_category
     ];
     const FRONTEND_SIGNALS = [
         "ui", "frontend", "react", "component", "page", "screen", "button",
         "modal", "layout", "style", "css", "web ui", "browser ui", "render",
+        "timestamp", "date format", "timezone", "display", "label", "icon", "text",
         ...learnedSignals.frontend
     ];
     const EXTENSION_SIGNALS = [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "secufusion-mcp",
-  "version": "2.2.9",
+  "version": "2.4.0",
   "type": "module",
   "description": "Project-level spec driven AI workflow tooling for SecuFusion, MCP server - developer workflow tooling with guardrails",
   "main": "mcp/dist/server.js",