@cubis/foundry 0.3.13 → 0.3.15

package/Ai Agent Workflow/powers/postman/POWER.md

@@ -12,7 +12,7 @@ Before proceeding, validate that the user has completed the following steps befo
 
 ## Step 1
 
-Prompt the user to configure their own Postman API key for authentication. They can either set it as an environment variable named POSTMAN_API_KEY on their system, or hardcode it directly into the user level MCP configuration file (usually at ~/.kiro/settings/mcp.json) in the power section. To obtain an API key, they log into their Postman account, navigate to Settings → API Keys, and generate a new key with appropriate permissions for workspace, collection, and environment management. The key will be automatically used by the MCP server to authenticate all API requests to Postman's services.
+Generate and maintain `postman_setting.json` as the primary Postman configuration. Use env-first authentication by default: keep `apiKey` as `null`, set `apiKeyEnvVar` to `POSTMAN_API_KEY`, and read the key from environment variables. Only store `apiKey` inline when the user explicitly requests file-based key storage. Keep `defaultWorkspaceId` nullable (`null` when unknown) so workflows can run without a preselected workspace.
 
 ## Step 2
 
@@ -68,7 +68,7 @@ Create a hook that runs anytime the source code or configuration file has been c
 
 Automate API testing and collection management with Postman. Create workspaces, collections, environments, and run tests programmatically.
 
-**Authentication**: Requires Postman API key (Settings → API Keys at postman.com)
+**Authentication**: Env-first via `postman_setting.json` + `POSTMAN_API_KEY`; inline `apiKey` is optional.
 
 ## Available MCP Servers
 

package/Ai Agent Workflow/powers/postman/SKILL.md

@@ -10,7 +10,7 @@ Before proceeding, validate that the user has completed the following steps befo
 
 ## Step 1
 
-Prompt the user to configure their own Postman API key for authentication. They can either set it as an environment variable named POSTMAN_API_KEY on their system, or hardcode it directly into the user level MCP configuration file (usually at ~/.kiro/settings/mcp.json) in the power section. To obtain an API key, they log into their Postman account, navigate to Settings → API Keys, and generate a new key with appropriate permissions for workspace, collection, and environment management. The key will be automatically used by the MCP server to authenticate all API requests to Postman's services.
+Generate and maintain `postman_setting.json` as the primary Postman configuration. Use env-first authentication by default: keep `apiKey` as `null`, set `apiKeyEnvVar` to `POSTMAN_API_KEY`, and read the key from environment variables. Only store `apiKey` inline when the user explicitly requests file-based key storage. Keep `defaultWorkspaceId` nullable (`null` when unknown) so workflows can run without a preselected workspace.
 
 ## Step 2
 
@@ -66,7 +66,7 @@ Create a hook that runs anytime the source code or configuration file has been c
 
 Automate API testing and collection management with Postman. Create workspaces, collections, environments, and run tests programmatically.
 
-**Authentication**: Requires Postman API key (Settings → API Keys at postman.com)
+**Authentication**: Env-first via `postman_setting.json` + `POSTMAN_API_KEY`; inline `apiKey` is optional.
 
 ## Available MCP Servers
 

package/Ai Agent Workflow/skills/postman/POWER.md

@@ -12,7 +12,7 @@ Before proceeding, validate that the user has completed the following steps befo
 
 ## Step 1
 
-Prompt the user to configure their own Postman API key for authentication. They can either set it as an environment variable named POSTMAN_API_KEY on their system, or hardcode it directly into the user level MCP configuration file (usually at ~/.kiro/settings/mcp.json) in the power section. To obtain an API key, they log into their Postman account, navigate to Settings → API Keys, and generate a new key with appropriate permissions for workspace, collection, and environment management. The key will be automatically used by the MCP server to authenticate all API requests to Postman's services.
+Generate and maintain `postman_setting.json` as the primary Postman configuration. Use env-first authentication by default: keep `apiKey` as `null`, set `apiKeyEnvVar` to `POSTMAN_API_KEY`, and read the key from environment variables. Only store `apiKey` inline when the user explicitly requests file-based key storage. Keep `defaultWorkspaceId` nullable (`null` when unknown) so workflows can run without a preselected workspace.
 
 ## Step 2
 
@@ -68,7 +68,7 @@ Create a hook that runs anytime the source code or configuration file has been c
 
 Automate API testing and collection management with Postman. Create workspaces, collections, environments, and run tests programmatically.
 
-**Authentication**: Requires Postman API key (Settings → API Keys at postman.com)
+**Authentication**: Env-first via `postman_setting.json` + `POSTMAN_API_KEY`; inline `apiKey` is optional.
 
 ## Available MCP Servers
 
@@ -239,4 +239,4 @@ for (const collection of collections) {
 
 **Full mode (112 tools):** Change URL to `https://mcp.postman.com/full`
 
-**API Key Permissions:** Workspace management, collection read/write, environment read/write, collection runs
+**API Key Permissions:** Workspace management, collection read/write, environment read/write, collection runs

package/Ai Agent Workflow/skills/postman/SKILL.md

@@ -10,7 +10,7 @@ Before proceeding, validate that the user has completed the following steps befo
 
 ## Step 1
 
-Prompt the user to configure their own Postman API key for authentication. They can either set it as an environment variable named POSTMAN_API_KEY on their system, or hardcode it directly into the user level MCP configuration file (usually at ~/.kiro/settings/mcp.json) in the power section. To obtain an API key, they log into their Postman account, navigate to Settings → API Keys, and generate a new key with appropriate permissions for workspace, collection, and environment management. The key will be automatically used by the MCP server to authenticate all API requests to Postman's services.
+Generate and maintain `postman_setting.json` as the primary Postman configuration. Use env-first authentication by default: keep `apiKey` as `null`, set `apiKeyEnvVar` to `POSTMAN_API_KEY`, and read the key from environment variables. Only store `apiKey` inline when the user explicitly requests file-based key storage. Keep `defaultWorkspaceId` nullable (`null` when unknown) so workflows can run without a preselected workspace.
 
 ## Step 2
 
@@ -66,7 +66,7 @@ Create a hook that runs anytime the source code or configuration file has been c
 
 Automate API testing and collection management with Postman. Create workspaces, collections, environments, and run tests programmatically.
 
-**Authentication**: Requires Postman API key (Settings → API Keys at postman.com)
+**Authentication**: Env-first via `postman_setting.json` + `POSTMAN_API_KEY`; inline `apiKey` is optional.
 
 ## Available MCP Servers
 

package/Ai Agent Workflow/workflows/agent-environment-setup/platforms/antigravity/agents/backend-specialist.md

@@ -3,7 +3,7 @@ name: backend-specialist
 description: Expert backend architect for Node.js, Python, and modern serverless/edge systems. Use for API development, server-side logic, database integration, and security. Triggers on backend, server, api, endpoint, database, auth.
 tools: Read, Grep, Glob, Bash, Edit, Write
 model: inherit
-skills: clean-code, nodejs-best-practices, python-patterns, api-patterns, database-design, database-optimizer, database-skills, mcp-builder, lint-and-validate, powershell-windows, bash-linux, rust-pro, api-designer, architecture-designer, typescript-pro, nestjs-expert, fastapi-expert, secure-code-guardian, test-master
+skills: clean-code, nodejs-best-practices, python-patterns, api-patterns, openapi-docs, database-design, database-optimizer, database-skills, mcp-builder, lint-and-validate, powershell-windows, bash-linux, rust-pro, api-designer, architecture-designer, typescript-pro, nestjs-expert, fastapi-expert, secure-code-guardian, test-master
 ---
 
 # Backend Development Architect

package/Ai Agent Workflow/workflows/agent-environment-setup/platforms/antigravity/workflows/backend.md

@@ -14,4 +14,14 @@ Use this workflow when backend architecture or implementation is primary.
 1. Ask `@backend-specialist` for solution outline.
 2. Validate API contracts, data model, and failure handling.
 3. Implement backend changes with tests and observability.
-4. Return summary including migration and rollout notes.
+4. Always update API docs: OpenAPI spec, Swagger UI route, and Stoplight Elements route/component.
+5. Return summary including migration and rollout notes.
+
+## Output Contract
+- API/contract changes
+- OpenAPI spec path
+- Swagger UI route
+- Stoplight route/component status
+- Migration impact
+- Reliability/security notes
+- Verification evidence

package/Ai Agent Workflow/workflows/agent-environment-setup/platforms/codex/agents/backend-specialist.md

@@ -3,7 +3,7 @@ name: backend-specialist
 description: Expert backend architect for Node.js, Python, and modern serverless/edge systems. Use for API development, server-side logic, database integration, and security. Triggers on backend, server, api, endpoint, database, auth.
 tools: Read, Grep, Glob, Bash, Edit, Write
 model: inherit
-skills: clean-code, nodejs-best-practices, python-patterns, api-patterns, database-design, database-optimizer, database-skills, mcp-builder, lint-and-validate, powershell-windows, bash-linux, rust-pro, api-designer, architecture-designer, typescript-pro, nestjs-expert, fastapi-expert, secure-code-guardian, test-master
+skills: clean-code, nodejs-best-practices, python-patterns, api-patterns, openapi-docs, database-design, database-optimizer, database-skills, mcp-builder, lint-and-validate, powershell-windows, bash-linux, rust-pro, api-designer, architecture-designer, typescript-pro, nestjs-expert, fastapi-expert, secure-code-guardian, test-master
 ---
 
 # Backend Development Architect

package/Ai Agent Workflow/workflows/agent-environment-setup/platforms/codex/workflows/backend.md

@@ -16,10 +16,14 @@ Use this when backend architecture or service logic is primary.
 1. Ask specialist(s) for design and risk assessment.
 2. Validate contracts, data model, and failure handling.
 3. Implement backend changes with observability.
-4. Run targeted tests and summarize rollout notes.
+4. Always update API docs: OpenAPI spec, Swagger UI route, and Stoplight Elements route/component.
+5. Run targeted tests and summarize rollout notes.
 
 ## Output Contract
 - API/contract changes
+- OpenAPI spec path
+- Swagger UI route
+- Stoplight route/component status
 - Migration impact
 - Reliability/security notes
 - Verification evidence

package/Ai Agent Workflow/workflows/agent-environment-setup/platforms/copilot/agents/backend-specialist.md

@@ -2,7 +2,7 @@
 name: backend-specialist
 description: Expert backend architect for Node.js, Python, and modern serverless/edge systems. Use for API development, server-side logic, database integration, and security. Triggers on backend, server, api, endpoint, database, auth.
 tools: Read, Grep, Glob, Bash, Edit, Write
-skills: clean-code, nodejs-best-practices, python-patterns, api-patterns, database-design, database-optimizer, database-skills, mcp-builder, lint-and-validate, powershell-windows, bash-linux, rust-pro, api-designer, architecture-designer, typescript-pro, nestjs-expert, fastapi-expert, secure-code-guardian, test-master
+skills: clean-code, nodejs-best-practices, python-patterns, api-patterns, openapi-docs, database-design, database-optimizer, database-skills, mcp-builder, lint-and-validate, powershell-windows, bash-linux, rust-pro, api-designer, architecture-designer, typescript-pro, nestjs-expert, fastapi-expert, secure-code-guardian, test-master
 ---
 
 # Backend Development Architect

package/Ai Agent Workflow/workflows/agent-environment-setup/platforms/copilot/workflows/backend.md

@@ -16,10 +16,14 @@ Use this when backend architecture or service logic is primary.
 1. Ask specialist(s) for design and risk assessment.
 2. Validate contracts, data model, and failure handling.
 3. Implement backend changes with observability.
-4. Run targeted tests and summarize rollout notes.
+4. Always update API docs: OpenAPI spec, Swagger UI route, and Stoplight Elements route/component.
+5. Run targeted tests and summarize rollout notes.
 
 ## Output Contract
 - API/contract changes
+- OpenAPI spec path
+- Swagger UI route
+- Stoplight route/component status
 - Migration impact
 - Reliability/security notes
 - Verification evidence

package/README.md

@@ -34,10 +34,13 @@ cbx workflows doctor codex
 cbx workflows platforms
 cbx workflows install --platform antigravity --dry-run
 cbx workflows install --platform antigravity --terminal-integration --terminal-verifier codex
+cbx workflows install --platform codex --postman
+cbx workflows install --platform codex --postman --postman-workspace-id null
 ```
 
 Install bootstrap behavior:
 - `cbx workflows install` now also bootstraps `ENGINEERING_RULES.md` and `TECH.md` (creates when missing; keeps existing files unless explicitly regenerated).
+- Optional `--postman` bootstrap creates `postman_setting.json` and installs/configures the Postman skill.
 - Use `cbx rules init --platform <platform> --overwrite` to force-regenerate both files.
 
 `rules` manages strict engineering policy and a generated codebase tech map:
@@ -112,6 +115,7 @@ Routing behavior:
 - Antigravity/Copilot: workflow + agent markdown can be routed by platform conventions.
 - Codex: use generated callable wrapper skills (`$workflow-*`, `$agent-*`).
 - Example for backend intent in Codex: `$workflow-backend` or `$agent-backend-specialist`.
+- Backend workflow policy: always include OpenAPI updates plus Swagger UI and Stoplight Elements status in output.
 
 ### Codex Runtime Mode
 

package/bin/cubis.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-import { confirm, select } from "@inquirer/prompts";
+import { confirm, input, select } from "@inquirer/prompts";
 import { Command } from "commander";
 import { existsSync } from "node:fs";
 import {
@@ -122,6 +122,12 @@ const CODEX_WORKFLOW_SKILL_PREFIX = "workflow-";
 const CODEX_AGENT_SKILL_PREFIX = "agent-";
 const TERMINAL_VERIFIER_PROVIDERS = ["codex", "gemini"];
 const DEFAULT_TERMINAL_VERIFIER = "codex";
+const POSTMAN_API_KEY_ENV_VAR = "POSTMAN_API_KEY";
+const POSTMAN_MCP_URL = "https://mcp.postman.com/minimal";
+const POSTMAN_SKILL_ID = "postman";
+const POSTMAN_SETTINGS_FILENAME = "postman_setting.json";
+const POSTMAN_API_KEY_MISSING_WARNING =
+  `Postman API key is not configured. Set ${POSTMAN_API_KEY_ENV_VAR} or update ${POSTMAN_SETTINGS_FILENAME}.`;
 const TECH_SCAN_MAX_FILES = 5000;
 const TECH_SCAN_IGNORED_DIRS = new Set([
   ".git",
@@ -166,6 +172,54 @@ const TECH_LANGUAGE_BY_EXTENSION = new Map([
   [".sh", "Shell"],
   [".ps1", "PowerShell"]
 ]);
+const TECH_PACKAGE_PREVIEW_LIMIT = 40;
+const TECH_JS_FRAMEWORK_SIGNALS = [
+  ["next", "Next.js"],
+  ["react", "React"],
+  ["vue", "Vue"],
+  ["nuxt", "Nuxt"],
+  ["svelte", "Svelte"],
+  ["@nestjs/core", "NestJS"],
+  ["express", "Express"],
+  ["fastify", "Fastify"],
+  ["hono", "Hono"],
+  ["tailwindcss", "Tailwind CSS"],
+  ["prisma", "Prisma"],
+  ["drizzle-orm", "Drizzle ORM"],
+  ["mongoose", "Mongoose"],
+  ["typeorm", "TypeORM"],
+  ["@playwright/test", "Playwright"],
+  ["vitest", "Vitest"],
+  ["jest", "Jest"],
+  ["cypress", "Cypress"]
+];
+const TECH_DART_FRAMEWORK_SIGNALS = [
+  ["flutter_riverpod", "Riverpod"],
+  ["riverpod", "Riverpod"],
+  ["go_router", "go_router"],
+  ["dio", "Dio"],
+  ["freezed", "Freezed"],
+  ["bloc", "BLoC"]
+];
+const TECH_GO_FRAMEWORK_SIGNALS = [
+  ["github.com/gofiber/fiber/v2", "Go Fiber"],
+  ["github.com/gin-gonic/gin", "Gin"],
+  ["github.com/labstack/echo/v4", "Echo"],
+  ["github.com/go-chi/chi/v5", "Chi"]
+];
+const TECH_PYTHON_FRAMEWORK_SIGNALS = [
+  ["fastapi", "FastAPI"],
+  ["django", "Django"],
+  ["flask", "Flask"],
+  ["pydantic", "Pydantic"],
+  ["sqlalchemy", "SQLAlchemy"]
+];
+const TECH_RUST_FRAMEWORK_SIGNALS = [
+  ["axum", "Axum"],
+  ["actix-web", "Actix Web"],
+  ["rocket", "Rocket"],
+  ["tokio", "Tokio"]
+];
 
 function platformInstallsCustomAgents(platformId) {
   const profile = WORKFLOW_PROFILES[platformId];
@@ -231,6 +285,13 @@ function normalizeTerminalVerifier(value) {
   return TERMINAL_VERIFIER_ALIASES[normalized] || null;
 }
 
+function normalizePostmanWorkspaceId(value) {
+  if (value === undefined || value === null) return null;
+  const normalized = String(value).trim();
+  if (!normalized || normalized.toLowerCase() === "null") return null;
+  return normalized;
+}
+
 function defaultState() {
   return {
     schemaVersion: 1,
@@ -572,6 +633,198 @@ async function upsertEngineeringRulesBlock({
   };
 }
 
+function normalizeTechPackageName(value) {
+  if (value === undefined || value === null) return null;
+  const normalized = String(value).trim().replace(/^['"]|['"]$/g, "").toLowerCase();
+  return normalized || null;
+}
+
+function parseTomlSections(content) {
+  const sections = new Map();
+  let currentSection = "";
+  sections.set(currentSection, []);
+
+  for (const line of content.split(/\r?\n/)) {
+    const sectionMatch = line.match(/^\s*\[([^\]]+)\]\s*$/);
+    if (sectionMatch) {
+      currentSection = sectionMatch[1].trim();
+      if (!sections.has(currentSection)) sections.set(currentSection, []);
+      continue;
+    }
+    sections.get(currentSection).push(line);
+  }
+
+  return sections;
+}
+
+function parsePubspecDependencyNames(content) {
+  const packages = new Set();
+  let currentSection = null;
+
+  for (const rawLine of content.split(/\r?\n/)) {
+    const line = rawLine.replace(/\t/g, "  ");
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+
+    if (!line.startsWith(" ")) {
+      const sectionMatch = trimmed.match(/^([a-zA-Z0-9_]+):\s*$/);
+      if (!sectionMatch) {
+        currentSection = null;
+        continue;
+      }
+      currentSection = sectionMatch[1];
+      continue;
+    }
+
+    if (currentSection !== "dependencies" && currentSection !== "dev_dependencies") continue;
+    const depMatch = trimmed.match(/^([a-zA-Z0-9_]+):/);
+    if (!depMatch) continue;
+    const packageName = normalizeTechPackageName(depMatch[1]);
+    if (!packageName || packageName === "flutter" || packageName === "sdk") continue;
+    packages.add(packageName);
+  }
+
+  return packages;
+}
+
+function parseGoModuleNames(content) {
+  const modules = new Set();
+  let inRequireBlock = false;
+
+  for (const rawLine of content.split(/\r?\n/)) {
+    const trimmed = rawLine.trim();
+    if (!trimmed || trimmed.startsWith("//")) continue;
+
+    if (trimmed.startsWith("require (")) {
+      inRequireBlock = true;
+      continue;
+    }
+    if (inRequireBlock && trimmed === ")") {
+      inRequireBlock = false;
+      continue;
+    }
+
+    if (inRequireBlock) {
+      const moduleName = normalizeTechPackageName(trimmed.split(/\s+/)[0]);
+      if (moduleName) modules.add(moduleName);
+      continue;
+    }
+
+    if (trimmed.startsWith("require ")) {
+      const moduleName = normalizeTechPackageName(trimmed.slice("require ".length).trim().split(/\s+/)[0]);
+      if (moduleName) modules.add(moduleName);
+    }
+  }
+
+  return modules;
+}
+
+function parseRequirementsPackageNames(content) {
+  const packages = new Set();
+  for (const rawLine of content.split(/\r?\n/)) {
+    const withoutComment = rawLine.split("#")[0].trim();
+    if (!withoutComment) continue;
+    if (withoutComment.startsWith("-")) continue;
+
+    const cleaned = withoutComment.split(";")[0].trim();
+    const match = cleaned.match(/^([A-Za-z0-9_.-]+)/);
+    if (!match) continue;
+    const packageName = normalizeTechPackageName(match[1]);
+    if (packageName) packages.add(packageName);
+  }
+  return packages;
+}
+
+function parsePyprojectPackageNames(content) {
+  const packages = new Set();
+  const sections = parseTomlSections(content);
+
+  const projectSection = sections.get("project");
+  if (projectSection) {
+    const projectBody = projectSection.join("\n");
+    const dependenciesArrayMatch = projectBody.match(/dependencies\s*=\s*\[([\s\S]*?)\]/m);
+    if (dependenciesArrayMatch) {
+      const entries = dependenciesArrayMatch[1].match(/"([^"]+)"|'([^']+)'/g) || [];
+      for (const entry of entries) {
+        const normalizedEntry = normalizeTechPackageName(entry);
+        if (!normalizedEntry) continue;
+        const packageName = normalizeTechPackageName(normalizedEntry.split(/[<>=!~\s\[]/)[0]);
+        if (packageName) packages.add(packageName);
+      }
+    }
+
+    for (const line of projectSection) {
+      const trimmed = line.trim();
+      const optionalDepsMatch = trimmed.match(
+        /^([A-Za-z0-9_.-]+)\s*=\s*\[\s*("([^"]+)"|'([^']+)')/
+      );
+      if (!optionalDepsMatch) continue;
+      const entry = optionalDepsMatch[3] || optionalDepsMatch[4];
+      const packageName = normalizeTechPackageName(String(entry).split(/[<>=!~\s\[]/)[0]);
+      if (packageName) packages.add(packageName);
+    }
+  }
+
+  for (const [sectionName, lines] of sections.entries()) {
+    const isPoetryDependencySection =
+      sectionName === "tool.poetry.dependencies" ||
+      /^tool\.poetry\.group\.[^.]+\.dependencies$/.test(sectionName);
+    if (!isPoetryDependencySection) continue;
+
+    for (const line of lines) {
+      const trimmed = line.trim();
+      if (!trimmed || trimmed.startsWith("#")) continue;
+      const depMatch = trimmed.match(/^([A-Za-z0-9_.-]+)\s*=/);
+      if (!depMatch) continue;
+      const packageName = normalizeTechPackageName(depMatch[1]);
+      if (!packageName || packageName === "python") continue;
+      packages.add(packageName);
+    }
+  }
+
+  return packages;
+}
+
+function parseCargoCrateNames(content) {
+  const crates = new Set();
+  const sections = parseTomlSections(content);
+
+  for (const [sectionName, lines] of sections.entries()) {
+    const isDependencySection =
+      sectionName === "dependencies" ||
+      sectionName === "dev-dependencies" ||
+      sectionName === "build-dependencies" ||
+      sectionName === "workspace.dependencies" ||
+      /\.dependencies$/.test(sectionName) ||
+      /\.dev-dependencies$/.test(sectionName) ||
+      /\.build-dependencies$/.test(sectionName);
+    if (!isDependencySection) continue;
+
+    for (const line of lines) {
+      const trimmed = line.trim();
+      if (!trimmed || trimmed.startsWith("#")) continue;
+      const depMatch = trimmed.match(/^([A-Za-z0-9_-]+)\s*=/);
+      if (!depMatch) continue;
+      const crateName = normalizeTechPackageName(depMatch[1]);
+      if (crateName) crates.add(crateName);
+    }
+  }
+
+  return crates;
+}
+
+function addFrameworkSignalsFromPackages({ packages, frameworks, signals }) {
+  for (const [signal, frameworkLabel] of signals) {
+    if (packages.has(signal.toLowerCase())) {
+      frameworks.add(frameworkLabel);
+    }
+  }
+}
+
+function toSortedArray(values) {
+  return [...values].sort((a, b) => a.localeCompare(b));
+}
+
 async function collectTechSnapshot(rootDir) {
   const discoveredFiles = [];
   const queue = [rootDir];
@@ -601,6 +854,12 @@ async function collectTechSnapshot(rootDir) {
 
   const languageCounts = new Map();
   const topDirs = new Set();
+  const packageJsonFiles = [];
+  const pubspecFiles = [];
+  const goModFiles = [];
+  const pyprojectFiles = [];
+  const requirementsFiles = [];
+  const cargoTomlFiles = [];
 
   for (const fullPath of discoveredFiles) {
     const rel = toPosixPath(path.relative(rootDir, fullPath));
@@ -609,15 +868,31 @@ async function collectTechSnapshot(rootDir) {
 
     const extension = path.extname(fullPath).toLowerCase();
     const language = TECH_LANGUAGE_BY_EXTENSION.get(extension);
-    if (!language) continue;
-    languageCounts.set(language, (languageCounts.get(language) || 0) + 1);
+    if (language) {
+      languageCounts.set(language, (languageCounts.get(language) || 0) + 1);
+    }
+
+    const baseName = path.basename(fullPath).toLowerCase();
+    if (baseName === "package.json") packageJsonFiles.push(fullPath);
+    if (baseName === "pubspec.yaml") pubspecFiles.push(fullPath);
+    if (baseName === "go.mod") goModFiles.push(fullPath);
+    if (baseName === "pyproject.toml") pyprojectFiles.push(fullPath);
+    if (baseName === "cargo.toml") cargoTomlFiles.push(fullPath);
+    if (baseName === "requirements.txt" || /^requirements(?:[-_.].+)?\.txt$/.test(baseName)) {
+      requirementsFiles.push(fullPath);
+    }
   }
 
   const fileExists = (name) => existsSync(path.join(rootDir, name));
-  const packageJsonPath = path.join(rootDir, "package.json");
+  const rootPackageJsonPath = path.join(rootDir, "package.json");
   const packageScripts = new Map();
   const frameworks = new Set();
   const lockfiles = [];
+  const javascriptPackages = new Set();
+  const dartPackages = new Set();
+  const goModules = new Set();
+  const pythonPackages = new Set();
+  const rustCrates = new Set();
 
   if (fileExists("bun.lock") || fileExists("bun.lockb")) lockfiles.push("bun");
   if (fileExists("pnpm-lock.yaml")) lockfiles.push("pnpm");
@@ -628,54 +903,118 @@ async function collectTechSnapshot(rootDir) {
   if (fileExists("go.sum")) lockfiles.push("go");
   if (fileExists("pubspec.lock")) lockfiles.push("pub");
 
-  if (fileExists("pubspec.yaml")) frameworks.add("Flutter");
-  if (fileExists("go.mod")) frameworks.add("Go Modules");
-  if (fileExists("Cargo.toml")) frameworks.add("Rust Cargo");
-  if (fileExists("requirements.txt") || fileExists("pyproject.toml")) frameworks.add("Python");
+  if (pubspecFiles.length > 0) frameworks.add("Flutter");
+  if (goModFiles.length > 0) frameworks.add("Go Modules");
+  if (cargoTomlFiles.length > 0) frameworks.add("Rust Cargo");
+  if (requirementsFiles.length > 0 || pyprojectFiles.length > 0) frameworks.add("Python");
 
-  if (existsSync(packageJsonPath)) {
+  for (const packageJsonFile of packageJsonFiles) {
     try {
-      const parsed = JSON.parse(await readFile(packageJsonPath, "utf8"));
-      const scripts = parsed.scripts && typeof parsed.scripts === "object" ? parsed.scripts : {};
-      for (const [name, command] of Object.entries(scripts)) {
-        if (typeof command !== "string") continue;
-        packageScripts.set(name, command);
-      }
-
+      const parsed = JSON.parse(await readFile(packageJsonFile, "utf8"));
       const deps = {
         ...(parsed.dependencies || {}),
         ...(parsed.devDependencies || {}),
-        ...(parsed.peerDependencies || {})
+        ...(parsed.peerDependencies || {}),
+        ...(parsed.optionalDependencies || {})
       };
-      const depNames = new Set(Object.keys(deps));
-      const frameworkSignals = [
-        ["next", "Next.js"],
-        ["react", "React"],
-        ["vue", "Vue"],
-        ["nuxt", "Nuxt"],
-        ["svelte", "Svelte"],
-        ["@nestjs/core", "NestJS"],
-        ["express", "Express"],
-        ["fastify", "Fastify"],
-        ["hono", "Hono"],
-        ["tailwindcss", "Tailwind CSS"],
-        ["prisma", "Prisma"],
-        ["drizzle-orm", "Drizzle ORM"],
-        ["mongoose", "Mongoose"],
-        ["typeorm", "TypeORM"],
-        ["@playwright/test", "Playwright"],
-        ["vitest", "Vitest"],
-        ["jest", "Jest"],
-        ["cypress", "Cypress"]
-      ];
-      for (const [signal, label] of frameworkSignals) {
-        if (depNames.has(signal)) frameworks.add(label);
+      for (const depName of Object.keys(deps)) {
+        const normalized = normalizeTechPackageName(depName);
+        if (normalized) javascriptPackages.add(normalized);
+      }
+
+      if (path.resolve(packageJsonFile) === path.resolve(rootPackageJsonPath)) {
+        const scripts = parsed.scripts && typeof parsed.scripts === "object" ? parsed.scripts : {};
+        for (const [name, command] of Object.entries(scripts)) {
+          if (typeof command !== "string") continue;
+          packageScripts.set(name, command);
+        }
       }
     } catch {
       // ignore malformed package.json
     }
   }
 
+  for (const pubspecFile of pubspecFiles) {
+    try {
+      const content = await readFile(pubspecFile, "utf8");
+      for (const packageName of parsePubspecDependencyNames(content)) {
+        dartPackages.add(packageName);
+      }
+    } catch {
+      // ignore malformed pubspec.yaml
+    }
+  }
+
+  for (const goModFile of goModFiles) {
+    try {
+      const content = await readFile(goModFile, "utf8");
+      for (const moduleName of parseGoModuleNames(content)) {
+        goModules.add(moduleName);
+      }
+    } catch {
+      // ignore unreadable go.mod
+    }
+  }
+
+  for (const pyprojectFile of pyprojectFiles) {
+    try {
+      const content = await readFile(pyprojectFile, "utf8");
+      for (const packageName of parsePyprojectPackageNames(content)) {
+        pythonPackages.add(packageName);
+      }
+    } catch {
+      // ignore malformed pyproject.toml
+    }
+  }
+
+  for (const requirementsFile of requirementsFiles) {
+    try {
+      const content = await readFile(requirementsFile, "utf8");
+      for (const packageName of parseRequirementsPackageNames(content)) {
+        pythonPackages.add(packageName);
+      }
+    } catch {
+      // ignore unreadable requirements file
+    }
+  }
+
+  for (const cargoTomlFile of cargoTomlFiles) {
+    try {
+      const content = await readFile(cargoTomlFile, "utf8");
+      for (const crateName of parseCargoCrateNames(content)) {
+        rustCrates.add(crateName);
+      }
+    } catch {
+      // ignore malformed Cargo.toml
+    }
+  }
+
+  addFrameworkSignalsFromPackages({
+    packages: javascriptPackages,
+    frameworks,
+    signals: TECH_JS_FRAMEWORK_SIGNALS
+  });
+  addFrameworkSignalsFromPackages({
+    packages: dartPackages,
+    frameworks,
+    signals: TECH_DART_FRAMEWORK_SIGNALS
+  });
+  addFrameworkSignalsFromPackages({
+    packages: goModules,
+    frameworks,
+    signals: TECH_GO_FRAMEWORK_SIGNALS
+  });
+  addFrameworkSignalsFromPackages({
+    packages: pythonPackages,
+    frameworks,
+    signals: TECH_PYTHON_FRAMEWORK_SIGNALS
+  });
+  addFrameworkSignalsFromPackages({
+    packages: rustCrates,
+    frameworks,
+    signals: TECH_RUST_FRAMEWORK_SIGNALS
+  });
+
   const sortedLanguages = [...languageCounts.entries()].sort((a, b) => b[1] - a[1]);
   const sortedFrameworks = [...frameworks].sort((a, b) => a.localeCompare(b));
   const sortedTopDirs = [...topDirs].sort((a, b) => a.localeCompare(b)).slice(0, 12);
@@ -704,10 +1043,33 @@ async function collectTechSnapshot(rootDir) {
     frameworks: sortedFrameworks,
     lockfiles: sortedLockfiles,
     topDirs: sortedTopDirs,
-    keyScripts
+    keyScripts,
+    packageSignals: {
+      javascript: toSortedArray(javascriptPackages),
+      dart: toSortedArray(dartPackages),
+      go: toSortedArray(goModules),
+      python: toSortedArray(pythonPackages),
+      rust: toSortedArray(rustCrates)
+    }
   };
 }
 
+function appendTechPackageSection(lines, heading, packages) {
+  lines.push(`### ${heading}`);
+  if (!packages || packages.length === 0) {
+    lines.push("- None detected.");
+  } else {
+    const preview = packages.slice(0, TECH_PACKAGE_PREVIEW_LIMIT);
+    for (const packageName of preview) {
+      lines.push(`- \`${packageName}\``);
+    }
+    if (packages.length > TECH_PACKAGE_PREVIEW_LIMIT) {
+      lines.push(`- ... (+${packages.length - TECH_PACKAGE_PREVIEW_LIMIT} more)`);
+    }
+  }
+  lines.push("");
+}
+
 function buildTechMd(snapshot) {
   const lines = [];
   lines.push("# TECH.md");
@@ -737,6 +1099,13 @@ function buildTechMd(snapshot) {
   }
   lines.push("");
 
+  lines.push("## Package Signals");
+  appendTechPackageSection(lines, "JavaScript / TypeScript (package.json)", snapshot.packageSignals.javascript);
+  appendTechPackageSection(lines, "Dart / Flutter (pubspec.yaml)", snapshot.packageSignals.dart);
+  appendTechPackageSection(lines, "Go Modules (go.mod)", snapshot.packageSignals.go);
+  appendTechPackageSection(lines, "Python Packages (requirements / pyproject)", snapshot.packageSignals.python);
+  appendTechPackageSection(lines, "Rust Crates (Cargo.toml)", snapshot.packageSignals.rust);
+
   lines.push("## Tooling and Lockfiles");
   if (snapshot.lockfiles.length === 0) {
     lines.push("- No lockfiles detected.");
@@ -1872,6 +2241,237 @@ async function writeGeneratedArtifact({ destination, content, dryRun = false })
   return { action: exists ? "replaced" : "installed", path: destination };
 }
 
+function resolvePostmanSettingsPath({ scope, cwd = process.cwd() }) {
+  if (scope === "global") {
+    return path.join(os.homedir(), ".cbx", POSTMAN_SETTINGS_FILENAME);
+  }
+  const workspaceRoot = findWorkspaceRoot(cwd);
+  return path.join(workspaceRoot, POSTMAN_SETTINGS_FILENAME);
+}
+
+function buildPostmanMcpConfig({ apiKey = null, mcpUrl = POSTMAN_MCP_URL }) {
+  const authHeader = apiKey
+    ? `Bearer ${apiKey}`
+    : `Bearer \${${POSTMAN_API_KEY_ENV_VAR}}`;
+  return {
+    mcpServers: {
+      postman: {
+        url: mcpUrl,
+        headers: {
+          Authorization: authHeader
+        }
+      }
+    },
+    disabled: false
+  };
+}
+
+function getPostmanApiKeySource({ apiKey, envApiKey }) {
+  if (apiKey) return "inline";
+  if (envApiKey) return "env";
+  return "unset";
+}
+
+function normalizePostmanApiKey(value) {
+  if (value === undefined || value === null) return null;
+  const normalized = String(value).trim();
+  return normalized || null;
+}
+
+async function ensureGitIgnoreEntry({
+  filePath,
+  entry,
+  dryRun = false
+}) {
+  const exists = await pathExists(filePath);
+  const original = exists ? await readFile(filePath, "utf8") : "";
+  const lines = original.split(/\r?\n/).map((line) => line.trim());
+  const alreadyPresent = lines.includes(entry);
+
+  if (alreadyPresent) {
+    return { action: "unchanged", filePath };
+  }
+
+  if (dryRun) {
+    return {
+      action: exists ? "would-patch" : "would-create",
+      filePath
+    };
+  }
+
+  const suffix = original.endsWith("\n") || original.length === 0 ? "" : "\n";
+  const nextContent = `${original}${suffix}${entry}\n`;
+  await mkdir(path.dirname(filePath), { recursive: true });
+  await writeFile(filePath, nextContent, "utf8");
+  return {
+    action: exists ? "patched" : "created",
+    filePath
+  };
+}
+
+async function resolvePostmanInstallSelection({
+  scope,
+  options,
+  cwd = process.cwd()
+}) {
+  const hasApiKeyOption = options.postmanApiKey !== undefined;
+  const hasWorkspaceOption = options.postmanWorkspaceId !== undefined;
+  const enabled = Boolean(options.postman) || hasApiKeyOption || hasWorkspaceOption;
+  if (!enabled) return { enabled: false };
+
+  const explicitApiKey = hasApiKeyOption ? String(options.postmanApiKey || "").trim() : "";
+  let apiKey = explicitApiKey || null;
+  const envApiKey = String(process.env[POSTMAN_API_KEY_ENV_VAR] || "").trim();
+  let defaultWorkspaceId = hasWorkspaceOption
+    ? normalizePostmanWorkspaceId(options.postmanWorkspaceId)
+    : null;
+  const warnings = [];
+
+  const canPrompt = !options.yes && process.stdin.isTTY;
+  if (canPrompt && !hasApiKeyOption && !apiKey && !envApiKey) {
+    const promptedApiKey = String(
+      await input({
+        message: `Postman API key (optional, leave blank to keep ${POSTMAN_API_KEY_ENV_VAR} env mode):`,
+        default: ""
+      })
+    ).trim();
+    if (promptedApiKey) {
+      apiKey = promptedApiKey;
+    }
+  }
+
+  if (canPrompt && !hasWorkspaceOption) {
+    const promptedWorkspaceId = await input({
+      message: "Default Postman workspace ID (optional, leave blank for null):",
+      default: ""
+    });
+    defaultWorkspaceId = normalizePostmanWorkspaceId(promptedWorkspaceId);
+  }
+
+  const apiKeySource = getPostmanApiKeySource({ apiKey, envApiKey });
+  if (apiKeySource === "unset") {
+    warnings.push(POSTMAN_API_KEY_MISSING_WARNING);
+  }
+
+  const settingsPath = resolvePostmanSettingsPath({ scope, cwd });
+  const settings = {
+    apiKey: apiKey || null,
+    apiKeyEnvVar: POSTMAN_API_KEY_ENV_VAR,
+    apiKeySource,
+    defaultWorkspaceId: defaultWorkspaceId ?? null,
+    mcpUrl: POSTMAN_MCP_URL,
+    generatedBy: "cbx workflows install --postman",
+    generatedAt: new Date().toISOString()
+  };
+
+  return {
+    enabled: true,
+    apiKey,
+    apiKeySource,
+    defaultWorkspaceId: defaultWorkspaceId ?? null,
+    warnings,
+    settings,
+    settingsPath
+  };
+}
+
+async function configurePostmanInstallArtifacts({
+  scope,
+  profilePaths,
+  postmanSelection,
+  overwrite = false,
+  dryRun = false,
+  cwd = process.cwd()
+}) {
+  if (!postmanSelection?.enabled) return null;
+
+  let warnings = postmanSelection.warnings.filter((warning) => warning !== POSTMAN_API_KEY_MISSING_WARNING);
+  const settingsContent = `${JSON.stringify(postmanSelection.settings, null, 2)}\n`;
+  const settingsResult = await writeTextFile({
+    targetPath: postmanSelection.settingsPath,
+    content: settingsContent,
+    overwrite,
+    dryRun
+  });
+
+  let effectiveApiKey = normalizePostmanApiKey(postmanSelection.settings.apiKey);
+  let effectiveDefaultWorkspaceId = postmanSelection.defaultWorkspaceId ?? null;
+  let effectiveMcpUrl = postmanSelection.settings.mcpUrl || POSTMAN_MCP_URL;
+
+  if (settingsResult.action === "skipped" || settingsResult.action === "would-skip") {
+    try {
+      const existingSettingsRaw = await readFile(postmanSelection.settingsPath, "utf8");
+      const existingSettings = JSON.parse(existingSettingsRaw);
+      effectiveApiKey = normalizePostmanApiKey(existingSettings?.apiKey);
+      effectiveDefaultWorkspaceId = normalizePostmanWorkspaceId(existingSettings?.defaultWorkspaceId);
+      const existingMcpUrl = String(existingSettings?.mcpUrl || "").trim();
+      if (existingMcpUrl) {
+        effectiveMcpUrl = existingMcpUrl;
+      }
+    } catch {
+      warnings.push(
+        `Existing ${POSTMAN_SETTINGS_FILENAME} could not be parsed. Using install-time Postman values for MCP config.`
+      );
+    }
+  }
+
+  const envApiKey = normalizePostmanApiKey(process.env[POSTMAN_API_KEY_ENV_VAR]);
+  const effectiveApiKeySource = getPostmanApiKeySource({
+    apiKey: effectiveApiKey,
+    envApiKey
+  });
+  if (effectiveApiKeySource === "unset") {
+    warnings.push(POSTMAN_API_KEY_MISSING_WARNING);
+  }
+
+  let gitIgnoreResult = null;
+  if (scope === "project") {
+    const workspaceRoot = findWorkspaceRoot(cwd);
+    const gitIgnorePath = path.join(workspaceRoot, ".gitignore");
+    gitIgnoreResult = await ensureGitIgnoreEntry({
+      filePath: gitIgnorePath,
+      entry: POSTMAN_SETTINGS_FILENAME,
+      dryRun
+    });
+  }
+
+  const postmanSkillDir = path.join(profilePaths.skillsDir, POSTMAN_SKILL_ID);
+  const postmanMcpPath = path.join(postmanSkillDir, "mcp.json");
+  let mcpResult = null;
+  const postmanSkillExists = await pathExists(postmanSkillDir);
+  if (!dryRun && !postmanSkillExists) {
+    mcpResult = {
+      action: "missing-postman-skill",
+      path: postmanMcpPath
+    };
+  } else {
+    const mcpConfigContent = `${JSON.stringify(
+      buildPostmanMcpConfig({
+        apiKey: effectiveApiKey,
+        mcpUrl: effectiveMcpUrl
+      }),
+      null,
+      2
+    )}\n`;
+    mcpResult = await writeGeneratedArtifact({
+      destination: postmanMcpPath,
+      content: mcpConfigContent,
+      dryRun
+    });
+  }
+
+  return {
+    enabled: true,
+    apiKeySource: effectiveApiKeySource,
+    defaultWorkspaceId: effectiveDefaultWorkspaceId,
+    warnings,
+    settingsPath: postmanSelection.settingsPath,
+    settingsResult,
+    gitIgnoreResult,
+    mcpResult
+  };
+}
+
 async function installAntigravityTerminalIntegrationArtifacts({
   profilePaths,
   provider,
@@ -2032,6 +2632,7 @@ async function installBundleArtifacts({
   platform,
   scope,
   overwrite,
+  extraSkillIds = [],
   terminalVerifierSelection = null,
   dryRun = false,
   cwd = process.cwd()
@@ -2092,7 +2693,8 @@ async function installBundleArtifacts({
     else installed.push(destination);
   }
 
-  const skillIds = Array.isArray(platformSpec.skills) ? platformSpec.skills : [];
+  const manifestSkillIds = Array.isArray(platformSpec.skills) ? platformSpec.skills : [];
+  const skillIds = unique([...manifestSkillIds, ...extraSkillIds.filter(Boolean)]);
   for (const skillId of skillIds) {
     const source = path.join(agentAssetsRoot(), "skills", skillId);
     const destination = path.join(profilePaths.skillsDir, skillId);
@@ -2389,6 +2991,32 @@ function printInstallSummary({
   }
 }
 
+function printPostmanSetupSummary({ postmanSetup }) {
+  if (!postmanSetup?.enabled) return;
+
+  console.log("\nPostman setup:");
+  console.log(`- Settings file: ${postmanSetup.settingsResult.action} (${postmanSetup.settingsPath})`);
+  console.log(`- API key source: ${postmanSetup.apiKeySource}`);
+  console.log(
+    `- Default workspace ID: ${postmanSetup.defaultWorkspaceId === null ? "null" : postmanSetup.defaultWorkspaceId}`
+  );
+  if (postmanSetup.gitIgnoreResult) {
+    console.log(
+      `- .gitignore (${postmanSetup.gitIgnoreResult.filePath}): ${postmanSetup.gitIgnoreResult.action}`
+    );
+  }
+  if (postmanSetup.mcpResult) {
+    console.log(`- Postman MCP config (${postmanSetup.mcpResult.path}): ${postmanSetup.mcpResult.action}`);
+  }
+
+  if (postmanSetup.warnings.length > 0) {
+    console.log("- Warnings:");
+    for (const warning of postmanSetup.warnings) {
+      console.log(`  - ${warning}`);
+    }
+  }
+}
+
 function printRemoveSummary({
   platform,
   scope,
@@ -2694,6 +3322,18 @@ function withInstallOptions(command) {
   return withWorkflowBaseOptions(command)
     .option("-b, --bundle <bundle>", "bundle id (default: agent-environment-setup)")
     .option("--overwrite", "overwrite existing files")
+    .option(
+      "--postman",
+      "optional: install Postman skill and generate postman_setting.json"
+    )
+    .option(
+      "--postman-api-key <key>",
+      "optional: set Postman API key inline for generated postman_setting.json and installed Postman MCP config"
+    )
+    .option(
+      "--postman-workspace-id <id|null>",
+      "optional: set default Postman workspace ID (use 'null' for no default)"
+    )
     .option(
       "--terminal-integration",
       "Antigravity only: enable terminal verification integration (prompts for verifier when interactive)"
@@ -2854,6 +3494,11 @@ async function runWorkflowInstall(options) {
       platform,
       options
     });
+    const postmanSelection = await resolvePostmanInstallSelection({
+      scope,
+      options,
+      cwd: process.cwd()
+    });
 
     const installResult = await installBundleArtifacts({
       bundleId,
@@ -2861,6 +3506,7 @@ async function runWorkflowInstall(options) {
       platform,
       scope,
       overwrite: Boolean(options.overwrite),
+      extraSkillIds: postmanSelection.enabled ? [POSTMAN_SKILL_ID] : [],
       terminalVerifierSelection,
       dryRun,
       cwd: process.cwd()
@@ -2890,6 +3536,14 @@ async function runWorkflowInstall(options) {
       skipTech: false,
       cwd: process.cwd()
     });
+    const postmanSetupResult = await configurePostmanInstallArtifacts({
+      scope,
+      profilePaths: installResult.profilePaths,
+      postmanSelection,
+      overwrite: Boolean(options.overwrite),
+      dryRun,
+      cwd: process.cwd()
+    });
 
     const terminalVerificationRuleResult =
       platform === "antigravity" && installResult.terminalIntegration
@@ -2930,6 +3584,9 @@ async function runWorkflowInstall(options) {
       engineeringResults: engineeringArtifactsResult.engineeringResults,
       techResult: engineeringArtifactsResult.techResult
     });
+    printPostmanSetupSummary({
+      postmanSetup: postmanSetupResult
+    });
     if (dryRun) {
       console.log("\nDry-run complete. Re-run without `--dry-run` to apply changes.");
     } else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cubis/foundry",
-  "version": "0.3.13",
+  "version": "0.3.15",
   "description": "Cubis Foundry CLI for workflow-first AI agent environments",
   "type": "module",
   "bin": {
@@ -18,6 +18,7 @@
     "check": "node bin/cubis.js --help",
     "test:attributes": "node scripts/validate-platform-attributes.mjs",
     "test:attributes:strict": "node scripts/validate-platform-attributes.mjs --strict",
+    "test:tech-md": "node scripts/test-tech-md-scanner.mjs",
     "test:smoke": "bash scripts/smoke-workflows.sh",
     "test:all": "npm run test:attributes && npm run test:smoke",
     "test:all:strict": "npm run test:attributes:strict && npm run test:smoke",