septum 0.1.6 → 0.1.8

package/src/mcp/tools/boundary.ts

@@ -0,0 +1,17 @@
+import type { BoundaryEvaluator } from "../../core/boundary/evaluator.ts";
+import type { ValidatedSeptumConfig } from "../../core/config/schema.ts";
+import type { SeptumRepository } from "../../core/database/repository.ts";
+import type { BoundaryToolArgs } from "../schemas.ts";
+import { handleCheckBoundary } from "./check-boundary.ts";
+
+export type { BoundaryToolArgs };
+
+export async function handleBoundaryTool(
+  evaluator: BoundaryEvaluator,
+  config: ValidatedSeptumConfig,
+  args: BoundaryToolArgs,
+  repo?: SeptumRepository,
+  workspaceRoot?: string
+) {
+  return await handleCheckBoundary(evaluator, config, args as any, repo, workspaceRoot);
+}

package/src/mcp/tools/check-boundary.ts

@@ -1,23 +1,88 @@
-import { execSync } from "node:child_process";
+import { relative, resolve } from "node:path";
+import { auditStagedFiles } from "../../core/boundary/staged-auditor.ts";
 import type { BoundaryEvaluator } from "../../core/boundary/evaluator.ts";
 import type { ValidatedSeptumConfig } from "../../core/config/schema.ts";
 import type { SeptumRepository } from "../../core/database/repository.ts";
+import { SessionManager } from "../../core/session/session-manager.ts";
 import type { BoundaryViolation } from "../../types/index.ts";
-import { normalizeBoundaryArgs, type CheckBoundaryArgs } from "../schemas.ts";
+import { CheckBoundarySchema, type CheckBoundaryArgs } from "../schemas.ts";
 
 export type { CheckBoundaryArgs } from "../schemas.ts";
 
-export function handleCheckBoundary(
+export async function handleCheckBoundary(
   evaluator: BoundaryEvaluator,
   config: ValidatedSeptumConfig,
   rawArgs: CheckBoundaryArgs & Record<string, unknown>,
   repo?: SeptumRepository,
   workspaceRoot?: string
 ) {
-  const args = (normalizeBoundaryArgs(rawArgs ?? {}) ?? {}) as CheckBoundaryArgs & Record<string, unknown>;
+  const args = CheckBoundarySchema.parse(rawArgs ?? {});
+  if (args.domain) {
+    const domain = Object.keys(config.domains || {}).find(name => name.toLowerCase() === args.domain!.toLowerCase());
+    if (!domain) throw new Error(`Unknown boundary domain '${args.domain}'. Choose a registered domain.`);
+    args.domain = domain;
+  }
   const root = workspaceRoot || args.workspace_path || process.cwd();
   const proposedImports = args.proposed_imports ?? [];
-  const featureKey = args.feature_key;
+
+  const activeSession = SessionManager.getActiveSession(root);
+
+  let effectiveFeatureKey = args.feature_key;
+  if (activeSession) {
+    if (args.feature_key && args.feature_key !== activeSession.feature_key) {
+      throw new Error(
+        `Active feature lock is '${activeSession.feature_key}' (owner: ${activeSession.owner_id}). Cannot check boundaries for different feature '${args.feature_key}' while another feature is locked.`
+      );
+    }
+    effectiveFeatureKey = activeSession.feature_key;
+    if (!config.features) config.features = {};
+    if (!config.features[activeSession.feature_key]) {
+      config.features[activeSession.feature_key] = {
+        domain: activeSession.domain,
+        description: `Active session: ${activeSession.feature_key}`,
+        allowed_touchpoints: activeSession.touchpoints,
+        reuse_symbols: [],
+        input_contract: {},
+        output_contract: {},
+      };
+    }
+  }
+
+  const syncState = repo?.getMeta("sync_state");
+  const syncError = repo?.getMeta("sync_error");
+  if (!syncState || syncState === "running" || syncState === "error" || syncState !== "complete" || syncError) {
+    return {
+      content: [
+        {
+          type: "text" as const,
+          text: JSON.stringify({
+            status: "unknown",
+            sync_state: syncState || "unindexed",
+            sync_error: syncError || undefined,
+            message: "Boundary audit is incomplete because workspace synchronization has not completed.",
+          }),
+        },
+      ],
+    };
+  }
+  const skipped = JSON.parse(repo?.getMeta("skipped_files") || "[]") as {path: string; reason: string}[];
+  const unsupported = JSON.parse(repo?.getMeta("unsupported_files") || "[]") as string[];
+  const requested = [...(Array.isArray(args.file_path) ? args.file_path : args.file_path ? [args.file_path] : []), ...(args.file_paths || [])]
+    .map(file => relative(root, resolve(root, file)).replace(/\\/g, "/"));
+  const relevantUnsupported = unsupported.filter(file =>
+    (!args.domain || evaluator.resolveSourceDomain(file, config) === args.domain) &&
+    (requested.length === 0 || requested.includes(file))
+  );
+  const relevantSkipped = skipped.filter(file =>
+    (!args.domain || evaluator.resolveSourceDomain(file.path, config) === args.domain) &&
+    (requested.length === 0 || requested.includes(file.path))
+  );
+  if (relevantSkipped.length > 0 && args.scope !== "staged" && !args.staged) {
+    return { content: [{type: "text" as const, text: JSON.stringify({status: "unknown", skipped_files: relevantSkipped, message: "Boundary audit is incomplete because source files exceed resource limits."})}] };
+  }
+  if (relevantUnsupported.length > 0 && args.scope !== "staged" && !args.staged) {
+    return { content: [{ type: "text" as const, text: JSON.stringify({ status: "unknown", unsupported_files: relevantUnsupported, message: "Boundary audit is incomplete because source files have no supported parser." }) }] };
+  }
 
   const filesToCheck: string[] = [];
   if (args.file_paths && Array.isArray(args.file_paths) && args.file_paths.length > 0) {
@@ -36,22 +101,9 @@ export function handleCheckBoundary(
       args.scope ?? (args.staged ? "staged" : args.domain ? "domain" : "all");
 
     if (effectiveScope === "staged") {
-      let stagedFiles: string[] = [];
-      try {
-        const gitOut = execSync("git diff --name-only --cached", {
-          cwd: root,
-          encoding: "utf-8",
-          timeout: 5000,
-        });
-        stagedFiles = gitOut
-          .split("\n")
-          .map((f) => f.trim())
-          .filter(Boolean);
-      } catch {
-        stagedFiles = [];
-      }
+      const { files: stagedFiles, violations: stagedViolations } = await auditStagedFiles(evaluator, config, root, effectiveFeatureKey, repo);
 
-      if (stagedFiles.length === 0) {
+      if (stagedFiles.length === 0 && stagedViolations.length === 0) {
         return {
           content: [
             {
@@ -75,23 +127,6 @@ export function handleCheckBoundary(
         };
       }
 
-      const codebaseViolations = evaluator.auditCodebase(config);
-      const stagedNormalized = new Set(
-        stagedFiles.map((f) => f.replace(/\\/g, "/").replace(/^\.\//, ""))
-      );
-      const stagedViolations: BoundaryViolation[] = [];
-
-      for (const filePath of stagedFiles) {
-        const evalViolations = evaluator.evaluate(filePath, proposedImports, featureKey, config);
-        stagedViolations.push(...evalViolations);
-      }
-      for (const v of codebaseViolations) {
-        const normFile = v.file.replace(/\\/g, "/").replace(/^\.\//, "");
-        if (stagedNormalized.has(normFile)) {
-          stagedViolations.push(v);
-        }
-      }
-
       const filteredViolations = args.domain
         ? stagedViolations.filter(
             (v) =>
@@ -135,6 +170,25 @@ export function handleCheckBoundary(
     }
 
     // Scope: "all" or "domain"
+    if (args.feature_key) {
+      return {
+        content: [
+          {
+            type: "text" as const,
+            text: JSON.stringify(
+              {
+                status: "rejected",
+                scope: effectiveScope,
+                message: `Scope '${effectiveScope}' is an architectural audit across domains and does not support feature touchpoint validation ('feature_key'). Feature scopes only apply to 'file', 'batch', or 'staged'.`,
+              },
+              null,
+              2
+            ),
+          },
+        ],
+      };
+    }
+
     let violations = evaluator.auditCodebase(config);
     if (args.domain) {
       const targetDom = args.domain.toLowerCase();
@@ -175,7 +229,7 @@ export function handleCheckBoundary(
                     args.domain ? ` in domain '${args.domain}'` : " across codebase"
                   }.`
                 : domainCount === 0
-                ? "No boundary violations detected. [Septum Notice: Domain catalog is currently unindexed. Run 'septum_register_domain' to initialize bounded contexts.]"
+                ? "No boundary violations detected. [Septum Notice: Domain catalog is currently unindexed. Run 'septum_domain' with action='register' to initialize bounded contexts.]"
                 : `All domain boundaries are clean${
                     args.domain ? ` for domain '${args.domain}'` : ""
                   }. Zero cross-domain leaks or circular dependencies detected.`,
@@ -191,7 +245,7 @@ export function handleCheckBoundary(
   // Multi-file batch evaluation
   if (filesToCheck.length > 1) {
     const results = filesToCheck.map((filePath) => {
-      const violations = evaluator.evaluate(filePath, proposedImports, featureKey, config);
+      const violations = evaluator.evaluate(filePath, proposedImports, effectiveFeatureKey, config);
       const impact = repo?.getFileInboundImpact(filePath);
       return {
         file: filePath,
@@ -224,7 +278,7 @@ export function handleCheckBoundary(
               message: hasViolations
                 ? `${totalViolations} boundary violation(s) detected across ${filesToCheck.length} file(s).`
                 : Object.keys(config?.domains || {}).length === 0
-                ? `All ${filesToCheck.length} file(s) approved. [Septum Notice: Domain catalog is currently unindexed. Run 'septum_register_domain' to initialize bounded contexts.]`
+                ? `All ${filesToCheck.length} file(s) approved. [Septum Notice: Domain catalog is currently unindexed. Run 'septum_domain' with action='register' to initialize bounded contexts.]`
                 : `All ${filesToCheck.length} file(s) approved. No boundary violations detected.`,
             },
             null,
@@ -237,7 +291,7 @@ export function handleCheckBoundary(
 
   // Single file evaluation (backward-compatible output)
   const singleFile = filesToCheck[0];
-  const violations = evaluator.evaluate(singleFile, proposedImports, featureKey, config);
+  const violations = evaluator.evaluate(singleFile, proposedImports, effectiveFeatureKey, config);
   const impact = repo?.getFileInboundImpact(singleFile);
 
   if (violations.length > 0) {
@@ -261,7 +315,7 @@ export function handleCheckBoundary(
                 : undefined,
               message:
                 Object.keys(config?.domains || {}).length === 0
-                  ? "Boundary integrity check failed: Domain catalog is currently unindexed. Run 'septum_register_domain' to initialize bounded contexts."
+                  ? "Boundary integrity check failed: Domain catalog is currently unindexed. Run 'septum_domain' with action='register' to initialize bounded contexts."
                   : violations.some((v) => v.rule === "unmapped_domain")
                   ? "Boundary integrity check failed: File does not belong to any declared bounded context."
                   : "Boundary violation detected. Proposed imports violate bounded context architecture.",
@@ -292,7 +346,7 @@ export function handleCheckBoundary(
               : undefined,
             message:
               Object.keys(config?.domains || {}).length === 0
-                ? "No boundary violations detected. [Septum Notice: Domain catalog is currently unindexed. Run 'septum_register_domain' to initialize bounded contexts.]"
+                ? "No boundary violations detected. [Septum Notice: Domain catalog is currently unindexed. Run 'septum_domain' with action='register' to initialize bounded contexts.]"
                 : impact && impact.direct_dependents_count > 0
                 ? `No boundary violations detected. Caution: ${impact.direct_dependents_count} dependent file(s) consume this file.`
                 : "No boundary violations detected. Proposed imports are permissible.",

package/src/mcp/tools/domain.ts

@@ -0,0 +1,40 @@
+import type { ValidatedSeptumConfig } from "../../core/config/schema.ts";
+import type { SeptumRepository } from "../../core/database/repository.ts";
+import type { DomainToolArgs } from "../schemas.ts";
+import { handleGetDomainCatalog } from "./get-domain-catalog.ts";
+import { handleRegisterDomain } from "./register-domain.ts";
+import { handleGetEnvironmentTopology } from "./get-environment-topology.ts";
+
+export type { DomainToolArgs };
+
+export async function handleDomainTool(
+  repo: SeptumRepository,
+  config: ValidatedSeptumConfig,
+  args: DomainToolArgs,
+  workspaceRoot?: string,
+  signal?: AbortSignal
+) {
+  const action = args.action || "catalog";
+
+  switch (action) {
+    case "register":
+      return await handleRegisterDomain(repo, config, args, workspaceRoot, signal);
+
+    case "topology":
+      return handleGetEnvironmentTopology(
+        repo,
+        config,
+        {
+          resolve: args.resolve,
+          resolveNode: args.resolve_node,
+          refresh: args.refresh,
+          workspace_path: args.workspace_path,
+        },
+        workspaceRoot || args.workspace_path || process.cwd()
+      );
+
+    case "catalog":
+    default:
+      return handleGetDomainCatalog(repo, config, args, workspaceRoot);
+  }
+}

package/src/mcp/tools/feature.ts

@@ -0,0 +1,67 @@
+import type { ValidatedSeptumConfig } from "../../core/config/schema.ts";
+import type { SeptumRepository } from "../../core/database/repository.ts";
+import type { FeatureToolArgs } from "../schemas.ts";
+import { handleGetFeatureContext, handleClearFeatureContext } from "./get-feature-context.ts";
+import { handleRegisterFeature } from "./register-feature.ts";
+
+export type { FeatureToolArgs };
+
+export async function handleFeatureTool(
+  repo: SeptumRepository,
+  config: ValidatedSeptumConfig,
+  args: FeatureToolArgs,
+  workspaceRoot?: string
+) {
+  const action = args.action || "get";
+
+  switch (action) {
+    case "lock":
+      return await handleRegisterFeature(
+        repo,
+        config,
+        {
+          feature_key: args.feature_key || args.feature || "",
+          feature: args.feature || args.feature_key || "",
+          domain: args.domain || args.domain_name || "",
+          domain_name: args.domain_name || args.domain || "",
+          description: args.description,
+          allowed_touchpoints: args.allowed_touchpoints,
+          reuse_symbols: args.reuse_symbols,
+          input_contract: args.input_contract,
+          output_contract: args.output_contract,
+          workspace_path: args.workspace_path,
+        },
+        workspaceRoot || args.workspace_path || process.cwd()
+      );
+
+    case "release": {
+      const cleared = handleClearFeatureContext(
+        workspaceRoot || args.workspace_path || process.cwd(),
+        Boolean(args.force)
+      );
+      return {
+        content: [
+          {
+            type: "text" as const,
+            text: cleared
+              ? "Active feature session successfully released."
+              : "No active feature session found to release.",
+          },
+        ],
+      };
+    }
+
+    case "get":
+    default:
+      return handleGetFeatureContext(
+        repo,
+        config,
+        {
+          feature_key: args.feature_key || args.feature,
+          feature: args.feature || args.feature_key,
+          workspace_path: args.workspace_path,
+        },
+        workspaceRoot || args.workspace_path || process.cwd()
+      );
+  }
+}

package/src/mcp/tools/get-domain-catalog.ts

@@ -15,6 +15,12 @@ export function handleGetDomainCatalog(
 ) {
   const targetRoot = args.workspace_path || workspaceRoot || (repo as any)?.projectRoot || process.cwd();
   const domainName = args.domain ?? args.name;
+  const indexStatus = {
+    unsupported_files: JSON.parse(repo.getMeta("unsupported_files") || "[]"),
+    watcher_mode: repo.getMeta("watcher_mode") || "manual",
+    sync_state: repo.getMeta("sync_state") || "unknown",
+    skipped_files: JSON.parse(repo.getMeta("skipped_files") || "[]"),
+  };
 
   if (!domainName) {
     const allDomains = repo.getAllDomains();
@@ -25,15 +31,16 @@ export function handleGetDomainCatalog(
         total_domains: 0,
         message: `Workspace '${root}' belum memiliki domain terdaftar dalam Septum catalog.`,
         suggested_action: {
-          tool: "septum_register_domain",
+          tool: "septum_domain",
           params: {
+            action: "register",
             name: "core",
             root: "src",
             ingest_now: true,
           },
         },
         agent_guidance:
-          "Panggil tool 'septum_register_domain(name: \"core\", root: \"src\", ingest_now: true)' untuk mendaftarkan dan mengindeks domain utama secara otomatis, atau jalankan 'septum init' di terminal workspace.",
+          "Panggil tool 'septum_domain(action: \"register\", name: \"core\", root: \"src\", ingest_now: true)' untuk mendaftarkan dan mengindeks domain utama secara otomatis, atau jalankan 'septum init' di terminal workspace.",
       };
       return {
         content: [
@@ -55,6 +62,7 @@ export function handleGetDomainCatalog(
         : repo.getAllVerticalSlices().length;
 
     const macroMap = {
+      index_status: indexStatus,
       telescope_view: {
         project_type: projectType,
         framework,
@@ -70,7 +78,7 @@ export function handleGetDomainCatalog(
         forbidden_dependencies: JSON.parse(d.forbidden_deps_json || "[]"),
       })),
       agent_instruction:
-        "Macro semantic map loaded from SQLite SSOT. Use 'septum_get_domain_catalog' with domain='<name>' for granular file/symbol catalogs, or 'septum_trace_vertical_slice' with query='<route|command|intent>' for end-to-end execution flow.",
+        "Macro semantic map loaded from SQLite SSOT. Use 'septum_domain' with domain='<name>' for granular file/symbol catalogs, or 'septum_slice' with query='<route|command|intent>' for end-to-end execution flow.",
     };
 
     return {
@@ -106,8 +114,8 @@ export function handleGetDomainCatalog(
       available_domains: available,
       suggestions: suggestions.length > 0 ? suggestions : available,
       suggested_action: {
-        tool: "septum_register_domain",
-        params: { domain: domainName, root: `src/domains/${domainName}` },
+        tool: "septum_domain",
+        params: { action: "register", domain: domainName, root: `src/domains/${domainName}` },
       },
     };
     return {
@@ -129,7 +137,7 @@ export function handleGetDomainCatalog(
     content: [
       {
         type: "text" as const,
-        text: JSON.stringify(catalog, null, 2),
+        text: JSON.stringify({ ...catalog, index_status: indexStatus }, null, 2),
       },
     ],
   };
@@ -139,7 +147,7 @@ function recordCatalogAccess(domain: string, projectRoot: string = process.cwd()
   try {
     const septumDir = path.resolve(projectRoot, ".septum");
     if (!fs.existsSync(septumDir)) {
-      fs.mkdirSync(septumDir, { recursive: true });
+      return;
     }
     const logPath = path.join(septumDir, "catalog_access.json");
     let log: { domains?: Record<string, string>; features?: Record<string, string> } = {};

package/src/mcp/tools/get-environment-topology.ts

@@ -122,9 +122,9 @@ export function handleGetEnvironmentTopology(
       output += `- ${q}\n`;
     }
     output += `\n*Untuk mengunci jawaban pengguna ke SQLite SSOT, panggil kembali tool ini dengan argumen:*\n`;
-    output += `\`septum_get_environment_topology(resolve: { layer: "<layer_name>", platform: "<platform_name>" })\`\n`;
+    output += `\`septum_domain(action: "topology", resolve: { layer: "<layer_name>", platform: "<platform_name>" })\`\n`;
     output += `*atau untuk entitas terdistribusi:*\n`;
-    output += `\`septum_get_environment_topology(resolveNode: { id: "<node_id>", layer: "<layer>", name: "<name>", platform: "<platform>", domain_or_ip: "<domain_or_ip>", role: "<role>" })\`\n`;
+    output += `\`septum_domain(action: "topology", resolve_node: { id: "<node_id>", layer: "<layer>", name: "<name>", platform: "<platform>", domain_or_ip: "<domain_or_ip>", role: "<role>" })\`\n`;
   }
 
   return {

package/src/mcp/tools/get-feature-context.ts

@@ -8,8 +8,11 @@ import type { GetFeatureContextArgs } from "../schemas.ts";
 
 export type { GetFeatureContextArgs } from "../schemas.ts";
 
-export function handleClearFeatureContext(workspaceRoot: string = process.cwd()): boolean {
-  return SessionManager.clearActiveSession(workspaceRoot);
+export function handleClearFeatureContext(
+  workspaceRoot: string = process.cwd(),
+  force: boolean = false
+): boolean {
+  return SessionManager.clearActiveSession(workspaceRoot, undefined, force);
 }
 
 export function handleGetFeatureContext(
@@ -41,7 +44,7 @@ export function handleGetFeatureContext(
               status: "prompt",
               message: "No feature specified. Please specify 'feature_key' from the registered features below or trace routes.",
               available_features: available.length > 0 ? available : [],
-              instructions: "Call 'septum_get_feature_context({ feature_key: \"<name>\" })' or register a new feature with 'septum_register_feature'.",
+              instructions: "Call 'septum_feature({ action: \"get\", feature_key: \"<name>\" })' or lock a feature with 'septum_feature({ action: \"lock\", feature_key: \"<name>\", domain: \"<domain>\" })'.",
             },
             null,
             2
@@ -127,8 +130,8 @@ export function handleGetFeatureContext(
                 feature_key: featureKey,
                 message: `Feature '${featureKey}' not found in configuration or vertical slices. Available features: [${availableStr}].`,
                 recovery_options: [
-                  `septum_register_feature({ feature_key: "${featureKey}", domain: "<domain_name>", allowed_touchpoints: ["path/to/file"] })`,
-                  `septum_trace_vertical_slice({ entry_file: "routes/web.php" })`,
+                  `septum_feature({ action: "lock", feature_key: "${featureKey}", domain: "<domain_name>", allowed_touchpoints: ["path/to/file"] })`,
+                  `septum_slice({ query: "routes/web.php" })`,
                 ],
               },
               null,
@@ -140,13 +143,7 @@ export function handleGetFeatureContext(
     }
   }
 
-  // Record Active Feature Session Lease (.septum/session.json)
-  SessionManager.saveActiveSession(workspaceRoot, {
-    feature_key: featureKey,
-    domain: featureConfig.domain,
-    touchpoints: featureConfig.allowed_touchpoints ?? [],
-    locked_at: new Date().toISOString(),
-  });
+  // MCP-14: handleGetFeatureContext is strictly read-only and does not mutate session leases
 
   // Deterministically fetch signatures, methods, and properties for reuse_symbols from SQLite
   const reuseSymbolsWithMeta: FeatureContextResponse["reuse_symbols"] = [];

package/src/mcp/tools/get-symbol-impact.ts

@@ -6,7 +6,7 @@ export function handleGetSymbolImpact(
   repo: SeptumRepository,
   _config: ValidatedSeptumConfig,
   args: GetSymbolImpactArgs,
-  _workspaceRoot?: string
+  workspaceRoot?: string
 ) {
   const symbol = (args.symbol || (args as unknown as Record<string, unknown>).query || "").toString().trim();
   if (!symbol) {
@@ -15,7 +15,10 @@ export function handleGetSymbolImpact(
     );
   }
 
-  const impact = repo.getSymbolImpact(symbol);
+  const impact = repo.getSymbolImpact(symbol, {
+    domain: args.domain,
+    workspaceRoot: workspaceRoot || args.workspace_path,
+  });
 
   return {
     content: [

package/src/mcp/tools/get-symbol.ts

@@ -7,7 +7,7 @@ export function handleGetSymbol(
   repo: SeptumRepository,
   _config: ValidatedSeptumConfig,
   args: GetSymbolArgs,
-  _workspaceRoot?: string
+  workspaceRoot?: string
 ) {
   const symbol = (args.symbol || (args as unknown as Record<string, unknown>).query || "").toString().trim();
   if (!symbol) {
@@ -19,6 +19,7 @@ export function handleGetSymbol(
   const details = repo.getSymbolDetails(symbol, {
     domain: args.domain,
     includeDependencies: args.include_dependencies,
+    workspaceRoot: workspaceRoot || args.workspace_path,
   });
 
   if (details) {

package/src/mcp/tools/locate-symbol.ts

@@ -43,11 +43,11 @@ export async function handleLocateSymbol(
         query,
         message: `Workspace '${root}' belum terindeks dalam Septum catalog.`,
         suggested_action: {
-          tool: "septum_register_domain",
-          params: { name: "core", root: "src", ingest_now: true },
+          tool: "septum_domain",
+          params: { action: "register", name: "core", root: "src", ingest_now: true },
         },
         agent_guidance:
-          "Panggil tool 'septum_register_domain(name: \"core\", root: \"src\", ingest_now: true)' untuk mendaftarkan dan mengindeks codebase ini, atau jalankan 'septum init' di terminal workspace.",
+          "Panggil tool 'septum_domain(action: \"register\", name: \"core\", root: \"src\", ingest_now: true)' untuk mendaftarkan dan mengindeks codebase ini, atau jalankan 'septum init' di terminal workspace.",
       };
 
       return {
@@ -100,18 +100,41 @@ export async function handleLocateSymbol(
     }
   }
 
+  const exactLineCount = result.exact_symbol
+    ? result.exact_symbol.line_end - result.exact_symbol.line_start + 1
+    : 0;
+  const complexitySmell =
+    exactLineCount > 300
+      ? {
+          is_high_complexity: true,
+          threshold: 300,
+          total_lines: exactLineCount,
+          warning: `Symbol '${result.exact_symbol?.name}' spans ${exactLineCount} lines (exceeds 300-line threshold). Candidate for decomposition/refactoring.`,
+        }
+      : undefined;
+
   const suggestions = (result.suggestions || []).slice(0, limit);
-  const summary = result.found
+  let summary = result.found
     ? `[FOUND] ${result.exact_symbol?.name || query} in ${result.file_path} (lines ${result.exact_symbol?.line_start}-${result.exact_symbol?.line_end})`
     : `[NOT FOUND] Symbol '${query}' not found. ${suggestions.length > 0 ? `Top suggestions: ${suggestions.map((s) => s.name).slice(0, 3).join(", ")}` : "No close suggestions."}`;
 
+  if (complexitySmell) {
+    summary += ` | ⚠️ High-Complexity Smell: spans ${exactLineCount} lines (> 300L)`;
+  }
+
   const payload = {
     status: result.found ? "success" : "not_found",
     found: result.found,
     query,
     file_path: result.file_path || null,
     container_name: result.container_name || null,
-    exact_symbol: result.exact_symbol || null,
+    exact_symbol: result.exact_symbol
+      ? {
+          ...result.exact_symbol,
+          total_lines: exactLineCount,
+        }
+      : null,
+    complexity_smell: complexitySmell,
     sibling_methods: result.sibling_methods || [],
     suggestions,
     summary,

package/src/mcp/tools/register-domain.ts

@@ -1,6 +1,7 @@
 import type { ValidatedSeptumConfig } from "../../core/config/schema.ts";
 import type { SeptumRepository } from "../../core/database/repository.ts";
 import { IngestionPipeline, type IngestionMetrics } from "../../core/ingestion/pipeline.ts";
+import { assertPathContained } from "../../core/resolver/path-resolver.ts";
 import type { RegisterDomainArgs } from "../schemas.ts";
 
 export type { RegisterDomainArgs } from "../schemas.ts";
@@ -9,24 +10,39 @@ export async function handleRegisterDomain(
   repo: SeptumRepository,
   config: ValidatedSeptumConfig,
   args: Partial<RegisterDomainArgs>,
-  workspaceRoot: string = process.cwd()
+  workspaceRoot: string = process.cwd(),
+  signal?: AbortSignal
 ) {
+  signal?.throwIfAborted();
   const domainName = (args.domain || args.name || "").trim();
   if (!domainName || !args.root) {
     throw new Error("Missing required arguments: 'domain' (or 'name') and 'root' are required.");
   }
 
+  // SV-02: Enforce workspace containment (reject traversal/absolute/symlink escape)
+  assertPathContained(args.root, workspaceRoot, "Domain root");
+  signal?.throwIfAborted();
+
   const domainConfig = {
     root: args.root,
     description: args.description || `Domain: ${domainName}`,
-    allowed_dependencies: args.allowed_dependencies || [],
-    forbidden_dependencies: args.forbidden_dependencies || [],
-    archetypes: args.archetypes || {},
+    allowed_dependencies: args.allowed_dependencies,
+    forbidden_dependencies: args.forbidden_dependencies,
+    archetypes: args.archetypes,
   };
 
   const domainId = repo.domains.upsertDomain(domainName, domainConfig);
+  const stored = repo.domains.getDomainByName(domainName);
+  const canonicalName = stored?.name || domainName;
+  const finalConfig = {
+    root: stored?.root_path || domainConfig.root,
+    description: domainConfig.description,
+    allowed_dependencies: stored ? JSON.parse(stored.allowed_deps_json || "[]") : (domainConfig.allowed_dependencies || []),
+    forbidden_dependencies: stored ? JSON.parse(stored.forbidden_deps_json || "[]") : (domainConfig.forbidden_dependencies || []),
+    archetypes: stored ? JSON.parse(stored.archetypes_json || "{}") : (domainConfig.archetypes || {}),
+  };
 
-  config.domains[domainName] = domainConfig;
+  config.domains[canonicalName] = finalConfig;
 
   let ingestionMetrics: IngestionMetrics | null = null;
   if (args.ingest_now) {
@@ -41,13 +57,13 @@ export async function handleRegisterDomain(
         text: JSON.stringify(
           {
             status: "success",
-            message: `Domain '${domainName}' successfully registered in SQLite SSOT.${
+            message: `Domain '${canonicalName}' successfully registered in SQLite SSOT.${
               args.ingest_now ? " Initial ingestion completed." : ""
             }`,
             domain_id: domainId,
-            domain: domainName,
-            name: domainName,
-            config: domainConfig,
+            domain: canonicalName,
+            name: canonicalName,
+            config: finalConfig,
             ...(ingestionMetrics ? { ingestion_metrics: ingestionMetrics } : {}),
           },
           null,