@cubis/foundry 0.3.24 → 0.3.26

package/CHANGELOG.md

@@ -2,6 +2,26 @@
 
 All notable changes to this project are documented in this file.
 
+## [0.3.26] - 2026-02-26
+
+### Fixed
+
+- Fixed MCP install merge behavior for existing JSONC config files (comments/trailing commas), so existing MCP entries are preserved instead of being reset.
+- Fixed Postman MCP patching to parse and merge JSONC for platform config targets (for example `.vscode/mcp.json`).
+
+## [0.3.25] - 2026-02-26
+
+### Added
+
+- Added `cbx workflows config` command to view and edit `cbx_config.json` from terminal.
+- Added `cbx skills config` alias for compatibility with deprecated `skills` command group.
+- Added docs for showing/updating/clearing Postman `defaultWorkspaceId` after install.
+
+### Changed
+
+- Improved Postman install warnings when workspace selection is not persisted because existing `cbx_config.json` was skipped.
+- Included actionable follow-up command in warnings (`cbx workflows config ...`).
+
 ## [0.3.23] - 2026-02-26
 
 ### Added

package/README.md

@@ -5,6 +5,7 @@ Workflow-first installer for AI agent environments, with Codex callable-skill wr
 Repository layout note: reusable workflow/skill/power assets are stored under `Ai Agent Workflow/`.
 
 Primary support in this release:
+
 - Antigravity
 - Codex
 - Copilot (VS Code Chat + Copilot CLI)
@@ -22,6 +23,7 @@ cbx --help
 ```
 
 Compatibility binaries are still shipped for migration:
+
 - `cubiskill`
 - `cubis`
 
@@ -36,11 +38,11 @@ export POSTMAN_API_KEY="<your-postman-api-key>"
 export STITCH_API_KEY="<your-stitch-api-key>" # Antigravity StitchMCP only
 
 # 3) Install workflow bundle for your platform
-cbx workflows install --platform codex --bundle agent-environment-setup --postman --yes
+cbx workflows install --platform codex --bundle agent-environment-setup --postman
 
 # 4) Optional: install for other platforms too
-cbx workflows install --platform antigravity --bundle agent-environment-setup --postman --yes
-cbx workflows install --platform copilot --bundle agent-environment-setup --postman --yes
+cbx workflows install --platform antigravity --bundle agent-environment-setup --postman
+cbx workflows install --platform copilot --bundle agent-environment-setup --postman
 ```
 
 ## Command Model
@@ -69,6 +71,7 @@ cbx workflows install --platform copilot --postman
 ```
 
 Install bootstrap behavior:
+
 - `cbx workflows install` now also bootstraps `ENGINEERING_RULES.md` and `TECH.md` (creates when missing; keeps existing files unless explicitly regenerated).
 - When install scope is `global` (default), skills/powers install to global paths, while workflows + agents stay in workspace (`project`) paths.
 - Rule sync + engineering artifacts (`AGENTS.md`/`GEMINI.md`/Copilot instructions, `ENGINEERING_RULES.md`, `TECH.md`) are maintained in workspace (`project`) scope.
@@ -79,6 +82,7 @@ Install bootstrap behavior:
 - Use `cbx rules init --platform <platform> --overwrite` to force-regenerate both files.
 
 Postman + Antigravity Stitch setup behavior:
+
 - `cbx_config.json` is generated in workspace root (project MCP scope) or `~/.cbx/cbx_config.json` (global MCP scope).
 - Managed MCP definition files are generated under `.cbx/mcp/<platform>/postman.json` (workspace scope) or `~/.cbx/mcp/<platform>/postman.json` (global scope).
 - Env-first auth is supported: when `POSTMAN_API_KEY` is set, generated settings keep `apiKey: null` and MCP config uses `Bearer ${POSTMAN_API_KEY}`.
@@ -89,7 +93,54 @@ Postman + Antigravity Stitch setup behavior:
 - Stitch key source priority for Antigravity: `--stitch-api-key` then `STITCH_API_KEY`; when unset, generated config keeps placeholder `X-Goog-Api-Key: ur stitch key`.
 - In project MCP scope, `cbx_config.json` and `.cbx/mcp/` are auto-added to `.gitignore` (no duplicate entries).
 
+Codex Postman workspace selection:
+
+```bash
+# Set Postman API key first
+export POSTMAN_API_KEY="<your-postman-api-key>"
+
+# Interactive workspace selector (recommended)
+cbx workflows install --platform codex --bundle agent-environment-setup --postman
+```
+
+- Do not use `--yes` here (it skips prompts).
+- You will get a workspace selector and the selected value is saved as `defaultWorkspaceId`.
+
+Direct/manual workspace ID:
+
+```bash
+cbx workflows install --platform codex --bundle agent-environment-setup --postman --postman-workspace-id "<workspace-id>" --yes
+```
+
+Clear default workspace:
+
+```bash
+cbx workflows install --platform codex --bundle agent-environment-setup --postman --postman-workspace-id null --yes
+```
+
+Important:
+
+- If `cbx_config.json` already exists and you want to change the saved workspace, use `--overwrite` (or edit config manually), because existing config is preserved by default.
+- If install output shows `Config file: skipped (...)`, your newly selected workspace is not persisted. Use `--overwrite` or edit with the config command below.
+
+View/edit config in terminal:
+
+```bash
+# View config
+cbx workflows config --scope global --show
+
+# Interactive edit (workspace ID)
+cbx workflows config --scope global --edit
+
+# Direct set workspace ID
+cbx workflows config --scope global --workspace-id "<workspace-id>"
+
+# Clear workspace ID
+cbx workflows config --scope global --clear-workspace-id
+```
+
 Platform runtime MCP placement:
+
 - Codex:
   - Global MCP scope: `~/.codex/config.toml` via `codex mcp add`.
   - Workspace MCP scope: `.vscode/mcp.json`.
@@ -101,6 +152,7 @@ Platform runtime MCP placement:
   - Global MCP scope: `~/.copilot/mcp-config.json`.
 
 API key docs:
+
 - Google Stitch MCP setup docs: [stitch.withgoogle.com/docs/mcp/setup](https://stitch.withgoogle.com/docs/mcp/setup)
 - Google Stitch settings (create API key): [stitch.withgoogle.com/settings](https://stitch.withgoogle.com/settings)
 - Google Cloud API key guidance: [Authenticate to Google and Google Cloud MCP servers](https://docs.cloud.google.com/mcp/authenticate-mcp)
@@ -119,12 +171,14 @@ cbx rules init --platform codex --dry-run
 ```
 
 What `cbx rules init` does:
+
 - Creates `ENGINEERING_RULES.md` next to the active platform rule file.
 - Appends/patches one managed engineering block in that rule file.
 - Generates `TECH.md` at workspace root by scanning the current codebase.
 - Preserves user content outside managed markers.
 
 `TECH.md` scanner coverage (deterministic, no AI calls):
+
 - Language/file signals from workspace scan.
 - JS/TS package signals from `package.json` (including nested/monorepo package files).
 - Flutter/Dart package signals from `pubspec.yaml`.
@@ -145,6 +199,7 @@ Ai Agent Workflow/workflows/
 ```
 
 First bundled profile:
+
 - `agent-environment-setup`
 
 Bundle manifest:
@@ -154,6 +209,7 @@ Ai Agent Workflow/workflows/agent-environment-setup/manifest.json
 ```
 
 Bundle contains platform-specific:
+
 - workflow templates (`workflows/*.md`)
 - specialist agent templates (`agents/*.md`)
 - mapped reusable skills copied from `Ai Agent Workflow/skills/<id>/`
@@ -163,13 +219,14 @@ Bundle contains platform-specific:
 ## Installed Capability Set (v1)
 
 Database capability stack:
+
 - `database-skills` (engine hub)
 - `database-design` (schema/migration design)
 - `database-optimizer` (query/index/tuning triage)
 - `drift-flutter` (Flutter local persistence)
 
-
 Core workflows:
+
 - `/brainstorm`
 - `/plan`
 - `/create`
@@ -184,6 +241,7 @@ Core workflows:
 - `/qa`
 
 Routing behavior:
+
 - Antigravity/Copilot: workflow + agent markdown can be routed by platform conventions.
 - Codex: use generated callable wrapper skills (`$workflow-*`, `$agent-*`).
 - Example for backend intent in Codex: `$workflow-backend` or `$agent-backend-specialist`.
@@ -195,6 +253,7 @@ Codex does not currently execute custom workflow slash commands or custom `@agen
 Codex skill invocation syntax is `$skill-name` (not `@agent-name`).
 
 `cbx` handles this by generating callable Codex skills:
+
 - Workflow wrappers: `$workflow-<name>` (for example `$workflow-review`, `$workflow-plan`)
 - Agent wrappers: `$agent-<name>` (for example `$agent-backend-specialist`)
 
@@ -206,6 +265,7 @@ Do not rely on custom `/workflow` execution or custom `@agent` invocation in Cod
 ### Antigravity
 
 Project scope:
+
 - Workflows: `.agent/workflows`
 - Agents: `.agent/agents`
 - Skills: `.agent/skills`
@@ -213,6 +273,7 @@ Project scope:
 - Terminal integration (optional): `.agent/terminal-integration`
 
 Global scope:
+
 - Skills: `~/.gemini/antigravity/skills`
 - Rules: `~/.gemini/GEMINI.md`
 - Workflows/agents/terminal-integration: default install keeps these in workspace (`.agent/...`) paths.
@@ -220,10 +281,12 @@ Global scope:
 ### Antigravity Terminal Integration (Optional)
 
 Install-time options:
+
 - `--terminal-integration`
 - `--terminal-verifier <codex|gemini>`
 
 Behavior:
+
 - Interactive installs prompt whether to enable terminal verification integration.
 - If enabled, cbx writes managed scripts/config under `.agent/terminal-integration`.
 - cbx also writes a managed terminal verification block into Antigravity rule files so post-task verification commands are explicit.
@@ -232,6 +295,7 @@ Behavior:
 ### Codex
 
 Project scope:
+
 - Workflow templates (reference docs): `.agents/workflows`
 - Skills: `.agents/skills`
 - Rules: `AGENTS.md`
@@ -242,17 +306,20 @@ Project scope:
   - Example usage: `$workflow-plan`, `$agent-backend-specialist`
 
 Global scope:
+
 - Skills: `~/.agents/skills`
 - Rules: `~/.codex/AGENTS.md`
 - Workflow templates (reference docs): default install keeps these in workspace `.agents/workflows`
 - Agents: not installed for Codex runtime
 
 Legacy compatibility note:
+
 - `.codex/skills` is treated as legacy and flagged by `doctor` with migration guidance.
 
 ### Copilot
 
 Project scope:
+
 - Workflows: `.github/copilot/workflows`
 - Agents: `.github/agents`
 - Skills: `.github/skills`
@@ -260,6 +327,7 @@ Project scope:
 - Skill schema note: `cbx` normalizes Copilot skill frontmatter by removing unsupported top-level keys like `displayName` and `keywords` during install.
 
 Global scope:
+
 - Skills: `~/.copilot/skills`
 - Rules: `~/.copilot/copilot-instructions.md`
 - Workflows/agents: default install keeps these in workspace (`.github/...`) paths.
@@ -272,11 +340,14 @@ Markers:
 
 ```md
 <!-- cbx:workflows:auto:start platform=<platform-id> version=1 -->
+
 ...
+
 <!-- cbx:workflows:auto:end -->
 ```
 
 Behavior:
+
 - Preserves user content outside markers.
 - Replaces first valid managed block in place.
 - Appends a managed block if missing.
@@ -286,6 +357,7 @@ Behavior:
 ## Scope and Detection
 
 Default scope:
+
 - Install/init commands:
   - `cbx workflows install`
   - `cbx workflows init`
@@ -298,15 +370,18 @@ Default scope:
 - Other workflow/rules commands default to `project`.
 
 Optional:
+
 - `--scope global`
 - `--scope project`
 
 Platform auto-detection:
+
 - Uses repo markers for Antigravity/Codex/Copilot.
 - Prompts when ambiguous.
 - Remembers last selected platform in local state.
 
 State files:
+
 - Project: `.cbx/workflows-state.json`
 - Global: `~/.cbx/state.json`
 
@@ -322,6 +397,7 @@ cbx workflows sync-rules --platform codex --dry-run
 ```
 
 Dry-run behavior:
+
 - prints planned file changes
 - prints planned managed-block action (`would-create`/`would-patch`)
 - does not write files
@@ -361,6 +437,7 @@ cbx workflows remove agent-environment-setup --platform antigravity --yes
 ## Doctor Checks
 
 `cbx workflows doctor` validates:
+
 - workflow/agent/skill path existence
 - active rule file status
 - managed block health

package/bin/cubis.js

@@ -2,6 +2,7 @@
 
 import { confirm, input, select } from "@inquirer/prompts";
 import { Command } from "commander";
+import { parse as parseJsonc } from "jsonc-parser";
 import { existsSync } from "node:fs";
 import {
   cp,
@@ -2497,11 +2498,44 @@ function parseStoredStitchConfig(raw) {
   };
 }
 
+function parseJsonLenient(raw) {
+  try {
+    return {
+      ok: true,
+      value: JSON.parse(raw),
+      mode: "json"
+    };
+  } catch (jsonError) {
+    const errors = [];
+    const value = parseJsonc(raw, errors, {
+      allowTrailingComma: true,
+      disallowComments: false,
+      allowEmptyContent: false
+    });
+    if (errors.length === 0) {
+      return {
+        ok: true,
+        value,
+        mode: "jsonc"
+      };
+    }
+    return {
+      ok: false,
+      value: null,
+      error: jsonError
+    };
+  }
+}
+
 async function readJsonFileIfExists(filePath) {
   if (!(await pathExists(filePath))) return { exists: false, value: null };
   try {
     const raw = await readFile(filePath, "utf8");
-    return { exists: true, value: JSON.parse(raw) };
+    const parsed = parseJsonLenient(raw);
+    if (!parsed.ok) {
+      return { exists: true, value: null, error: parsed.error };
+    }
+    return { exists: true, value: parsed.value };
   } catch (error) {
     return { exists: true, value: null, error };
   }
@@ -2515,9 +2549,11 @@ async function upsertJsonObjectFile({ targetPath, updater, dryRun = false }) {
   if (exists) {
     try {
       const raw = await readFile(targetPath, "utf8");
-      const decoded = JSON.parse(raw);
-      if (decoded && typeof decoded === "object" && !Array.isArray(decoded)) {
-        parsed = decoded;
+      const decoded = parseJsonLenient(raw);
+      if (!decoded.ok) {
+        warnings.push(`Existing JSON at ${targetPath} could not be parsed. Resetting structure.`);
+      } else if (decoded.value && typeof decoded.value === "object" && !Array.isArray(decoded.value)) {
+        parsed = decoded.value;
       } else {
         warnings.push(`Existing JSON at ${targetPath} was not an object. Resetting structure.`);
       }
@@ -2792,6 +2828,7 @@ async function resolvePostmanInstallSelection({
   let defaultWorkspaceId = hasWorkspaceOption
     ? normalizePostmanWorkspaceId(options.postmanWorkspaceId)
     : null;
+  let workspaceSelectionSource = hasWorkspaceOption ? "option" : "none";
   const requestedMcpScope = options.mcpScope
     ? normalizeMcpScope(options.mcpScope, normalizeMcpScope(scope, "project"))
     : null;
@@ -2868,6 +2905,7 @@ async function resolvePostmanInstallSelection({
     }
 
     defaultWorkspaceId = selectedWorkspaceId;
+    workspaceSelectionSource = "interactive";
   }
 
   if (canPrompt && stitchEnabled && !hasStitchApiKeyOption && !stitchApiKey && !envStitchApiKey) {
@@ -2945,6 +2983,7 @@ async function resolvePostmanInstallSelection({
     stitchApiKey,
     stitchApiKeySource,
     defaultWorkspaceId: defaultWorkspaceId ?? null,
+    workspaceSelectionSource,
     mcpScope,
     warnings,
     cbxConfig,
@@ -3013,6 +3052,21 @@ async function configurePostmanInstallArtifacts({
       effectiveStitchApiKey = storedStitchConfig.apiKey;
       effectiveStitchMcpUrl = storedStitchConfig.mcpUrl || STITCH_MCP_URL;
     }
+
+    if (postmanSelection.workspaceSelectionSource && postmanSelection.workspaceSelectionSource !== "none") {
+      const requestedWorkspaceId = postmanSelection.defaultWorkspaceId ?? null;
+      const persistedWorkspaceId = effectiveDefaultWorkspaceId ?? null;
+      if (requestedWorkspaceId !== persistedWorkspaceId) {
+        const configScope = postmanSelection.mcpScope === "global" ? "global" : "project";
+        const configHint =
+          requestedWorkspaceId === null
+            ? `cbx workflows config --scope ${configScope} --clear-workspace-id`
+            : `cbx workflows config --scope ${configScope} --workspace-id \"${requestedWorkspaceId}\"`;
+        warnings.push(
+          `Selected Postman workspace (${requestedWorkspaceId === null ? "null" : requestedWorkspaceId}) was not saved because ${CBX_CONFIG_FILENAME} already exists. Re-run with --overwrite or run '${configHint}'.`
+        );
+      }
+    }
   }
 
   const envApiKey = normalizePostmanApiKey(process.env[POSTMAN_API_KEY_ENV_VAR]);
@@ -4519,6 +4573,105 @@ async function runWorkflowDoctor(platformArg, options) {
   }
 }
 
+async function runWorkflowConfig(options) {
+  try {
+    const cwd = process.cwd();
+    const scope = normalizeMcpScope(options.scope, "global");
+    const dryRun = Boolean(options.dryRun);
+    const hasWorkspaceIdOption = options.workspaceId !== undefined;
+    const wantsClearWorkspaceId = Boolean(options.clearWorkspaceId);
+    const wantsInteractiveEdit = Boolean(options.edit);
+
+    if (hasWorkspaceIdOption && wantsClearWorkspaceId) {
+      throw new Error("Use either --workspace-id or --clear-workspace-id, not both.");
+    }
+
+    const wantsMutation = hasWorkspaceIdOption || wantsClearWorkspaceId || wantsInteractiveEdit;
+    const showOnly = Boolean(options.show) || !wantsMutation;
+    const configPath = resolveCbxConfigPath({ scope, cwd });
+    const existing = await readJsonFileIfExists(configPath);
+    const existingValue =
+      existing.value && typeof existing.value === "object" && !Array.isArray(existing.value) ? existing.value : null;
+
+    if (showOnly) {
+      console.log(`Config file: ${configPath}`);
+      if (!existing.exists) {
+        console.log("Status: missing");
+        return;
+      }
+      if (!existingValue) {
+        throw new Error(`Existing config at ${configPath} is not valid JSON object.`);
+      }
+      console.log(`Status: ${existing.exists ? "exists" : "missing"}`);
+      console.log(JSON.stringify(existingValue, null, 2));
+      return;
+    }
+
+    if (existing.exists && !existingValue) {
+      throw new Error(`Existing config at ${configPath} is not valid JSON object.`);
+    }
+
+    const next = existingValue ? JSON.parse(JSON.stringify(existingValue)) : {};
+    if (!next.schemaVersion || typeof next.schemaVersion !== "number") next.schemaVersion = 1;
+    next.generatedBy = "cbx workflows config";
+    next.generatedAt = new Date().toISOString();
+
+    if (!next.mcp || typeof next.mcp !== "object" || Array.isArray(next.mcp)) next.mcp = {};
+    next.mcp.scope = scope;
+    if (!next.mcp.server) next.mcp.server = POSTMAN_SKILL_ID;
+
+    if (!next.postman || typeof next.postman !== "object" || Array.isArray(next.postman)) next.postman = {};
+    next.postman.apiKey = normalizePostmanApiKey(next.postman.apiKey);
+    next.postman.apiKeyEnvVar = String(next.postman.apiKeyEnvVar || POSTMAN_API_KEY_ENV_VAR).trim() || POSTMAN_API_KEY_ENV_VAR;
+    next.postman.mcpUrl = String(next.postman.mcpUrl || POSTMAN_MCP_URL).trim() || POSTMAN_MCP_URL;
+
+    let workspaceId = normalizePostmanWorkspaceId(next.postman.defaultWorkspaceId);
+
+    if (wantsInteractiveEdit) {
+      const promptedWorkspaceId = await input({
+        message: "Postman default workspace ID (optional, leave blank or 'null' to clear):",
+        default: workspaceId || ""
+      });
+      workspaceId = normalizePostmanWorkspaceId(promptedWorkspaceId);
+    }
+
+    if (hasWorkspaceIdOption) {
+      workspaceId = normalizePostmanWorkspaceId(options.workspaceId);
+    }
+
+    if (wantsClearWorkspaceId) {
+      workspaceId = null;
+    }
+
+    next.postman.defaultWorkspaceId = workspaceId;
+    const envApiKey = normalizePostmanApiKey(process.env[POSTMAN_API_KEY_ENV_VAR]);
+    next.postman.apiKeySource = getPostmanApiKeySource({
+      apiKey: next.postman.apiKey,
+      envApiKey
+    });
+
+    const content = `${JSON.stringify(next, null, 2)}\n`;
+    if (!dryRun) {
+      await mkdir(path.dirname(configPath), { recursive: true });
+      await writeFile(configPath, content, "utf8");
+    }
+
+    console.log(`Config file: ${configPath}`);
+    console.log(`Action: ${dryRun ? (existing.exists ? "would-update" : "would-create") : existing.exists ? "updated" : "created"}`);
+    console.log(`postman.defaultWorkspaceId: ${workspaceId === null ? "null" : workspaceId}`);
+    if (Boolean(options.showAfter)) {
+      console.log(JSON.stringify(next, null, 2));
+    }
+  } catch (error) {
+    if (error?.name === "ExitPromptError") {
+      console.error("\nCancelled.");
+      process.exit(130);
+    }
+    console.error(`\nError: ${error.message}`);
+    process.exit(1);
+  }
+}
+
 function printRulesInitSummary({
   platform,
   scope,
@@ -4750,6 +4903,18 @@ withWorkflowBaseOptions(
     .option("--json", "output JSON")
 ).action(runWorkflowDoctor);
 
+workflowsCommand
+  .command("config")
+  .description("View or edit cbx_config.json from terminal")
+  .option("--scope <scope>", "config scope: project|workspace|global|user", "global")
+  .option("--show", "show current config (default when no edit flags)")
+  .option("--edit", "edit Postman default workspace ID interactively")
+  .option("--workspace-id <id|null>", "set postman.defaultWorkspaceId")
+  .option("--clear-workspace-id", "set postman.defaultWorkspaceId to null")
+  .option("--show-after", "print JSON after update")
+  .option("--dry-run", "preview changes without writing files")
+  .action(runWorkflowConfig);
+
 workflowsCommand.action(() => {
   workflowsCommand.help();
 });
@@ -4809,6 +4974,21 @@ withWorkflowBaseOptions(
   await runWorkflowDoctor(platform, options);
 });
 
+skillsCommand
+  .command("config")
+  .description("Alias for workflows config")
+  .option("--scope <scope>", "config scope: project|workspace|global|user", "global")
+  .option("--show", "show current config (default when no edit flags)")
+  .option("--edit", "edit Postman default workspace ID interactively")
+  .option("--workspace-id <id|null>", "set postman.defaultWorkspaceId")
+  .option("--clear-workspace-id", "set postman.defaultWorkspaceId to null")
+  .option("--show-after", "print JSON after update")
+  .option("--dry-run", "preview changes without writing files")
+  .action(async (options) => {
+    printSkillsDeprecation();
+    await runWorkflowConfig(options);
+  });
+
 skillsCommand.action(() => {
   printSkillsDeprecation();
   skillsCommand.help();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cubis/foundry",
-  "version": "0.3.24",
+  "version": "0.3.26",
   "description": "Cubis Foundry CLI for workflow-first AI agent environments",
   "type": "module",
   "bin": {
@@ -46,6 +46,7 @@
   },
   "dependencies": {
     "@inquirer/prompts": "^7.8.6",
-    "commander": "^14.0.1"
+    "commander": "^14.0.1",
+    "jsonc-parser": "^3.3.1"
   }
 }