@cubis/foundry 0.3.33 → 0.3.35

package/mcp/package.json

@@ -0,0 +1,36 @@
+{
+  "name": "@cubis/foundry-mcp",
+  "version": "0.1.0",
+  "description": "Cubis Foundry MCP Server – SkillPointer vault, Postman mode, and Stitch profile tools",
+  "type": "module",
+  "main": "dist/index.js",
+  "bin": {
+    "cubis-mcp": "dist/index.js"
+  },
+  "scripts": {
+    "dev": "nodemon --watch src --ext ts --exec 'tsx src/index.ts -- --transport stdio'",
+    "build": "tsup src/index.ts --format esm --dts --clean",
+    "start": "node dist/index.js",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "scan": "tsx src/index.ts --scan-only",
+    "mcp:inspect": "npx @modelcontextprotocol/inspector -- tsx src/index.ts"
+  },
+  "engines": {
+    "node": ">=18.17"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.27.0",
+    "jsonc-parser": "^3.3.1",
+    "zod": "^3.25.0"
+  },
+  "devDependencies": {
+    "@types/node": "^20.14.0",
+    "nodemon": "^3.1.0",
+    "tsup": "^8.1.0",
+    "tsx": "^4.16.0",
+    "typescript": "^5.5.0",
+    "vitest": "^2.0.0"
+  },
+  "license": "MIT"
+}

package/mcp/src/cbxConfig/index.ts

@@ -0,0 +1,23 @@
+/**
+ * Cubis Foundry MCP Server – cbxConfig barrel export.
+ */
+export type {
+  ConfigScope,
+  PostmanConfig,
+  StitchConfig,
+  CbxConfig,
+  EffectiveConfig,
+} from "./types.js";
+
+export {
+  globalConfigPath,
+  projectConfigPath,
+  resolveConfigPath,
+} from "./paths.js";
+export {
+  readEffectiveConfig,
+  readScopedConfig,
+  redactConfig,
+} from "./reader.js";
+export { writeConfigField, ensureConfigExists } from "./writer.js";
+export { parsePostmanState, parseStitchState } from "./serviceConfig.js";

package/mcp/src/cbxConfig/paths.ts

@@ -0,0 +1,45 @@
+/**
+ * Cubis Foundry MCP Server – cbxConfig path resolution.
+ *
+ * Global: ~/.cbx/cbx_config.json
+ * Project: <workspace>/cbx_config.json
+ * Auto-effective: project if exists, else global.
+ */
+
+import path from "node:path";
+import os from "node:os";
+import { existsSync } from "node:fs";
+import type { ConfigScope } from "./types.js";
+
+export function globalConfigPath(): string {
+  return path.join(os.homedir(), ".cbx", "cbx_config.json");
+}
+
+export function projectConfigPath(workspaceRoot?: string): string {
+  const root = workspaceRoot ?? process.cwd();
+  return path.join(root, "cbx_config.json");
+}
+
+/**
+ * Resolve the effective config path.
+ * If scope is explicit, use that. Otherwise auto-detect:
+ *   project config if exists, else global.
+ */
+export function resolveConfigPath(
+  scope?: ConfigScope | "auto",
+  workspaceRoot?: string,
+): { path: string; scope: ConfigScope } {
+  if (scope === "global") {
+    return { path: globalConfigPath(), scope: "global" };
+  }
+  if (scope === "project") {
+    return { path: projectConfigPath(workspaceRoot), scope: "project" };
+  }
+
+  // Auto-effective: project if exists, else global
+  const projectPath = projectConfigPath(workspaceRoot);
+  if (existsSync(projectPath)) {
+    return { path: projectPath, scope: "project" };
+  }
+  return { path: globalConfigPath(), scope: "global" };
+}

package/mcp/src/cbxConfig/reader.ts

@@ -0,0 +1,149 @@
+/**
+ * Cubis Foundry MCP Server – cbxConfig reader.
+ *
+ * Reads and merges global + project configs.
+ * Project values override global values.
+ * Never exposes or logs apiKey.
+ */
+
+import { readFileSync, existsSync } from "node:fs";
+import { parse as parseJsonc } from "jsonc-parser";
+import {
+  globalConfigPath,
+  projectConfigPath,
+  resolveConfigPath,
+} from "./paths.js";
+import type { CbxConfig, ConfigScope, EffectiveConfig } from "./types.js";
+import { logger } from "../utils/logger.js";
+
+function readConfigFile(filePath: string): CbxConfig | null {
+  if (!existsSync(filePath)) return null;
+  try {
+    const raw = readFileSync(filePath, "utf8");
+    return parseJsonc(raw) as CbxConfig;
+  } catch (err) {
+    logger.warn(`Failed to parse config at ${filePath}: ${err}`);
+    return null;
+  }
+}
+
+/**
+ * Deep merge two config objects. `override` values take precedence.
+ */
+function mergeConfigs(base: CbxConfig, override: CbxConfig): CbxConfig {
+  const result: CbxConfig = { ...base };
+  for (const [key, value] of Object.entries(override)) {
+    if (
+      value !== undefined &&
+      value !== null &&
+      typeof value === "object" &&
+      !Array.isArray(value)
+    ) {
+      result[key] = mergeConfigs(
+        (result[key] as CbxConfig) ?? {},
+        value as CbxConfig,
+      );
+    } else {
+      result[key] = value;
+    }
+  }
+  return result;
+}
+
+/**
+ * Read config for a specific scope only.
+ */
+export function readScopedConfig(
+  scope: ConfigScope,
+  workspaceRoot?: string,
+): EffectiveConfig | null {
+  const configPath =
+    scope === "global" ? globalConfigPath() : projectConfigPath(workspaceRoot);
+
+  const config = readConfigFile(configPath);
+  if (!config) return null;
+
+  return { config, scope, path: configPath };
+}
+
+/**
+ * Read the effective config (merged global + project, project overrides).
+ * If scope is explicit ("global" or "project"), reads that scope only.
+ * If scope is "auto" or omitted, merges both with project taking precedence.
+ */
+export function readEffectiveConfig(
+  scope?: ConfigScope | "auto",
+  workspaceRoot?: string,
+): EffectiveConfig | null {
+  // Explicit scope = read that scope only
+  if (scope === "global" || scope === "project") {
+    return readScopedConfig(scope, workspaceRoot);
+  }
+
+  // Auto: merge global + project
+  const globalConf = readConfigFile(globalConfigPath());
+  const projectPath = projectConfigPath(workspaceRoot);
+  const projectConf = readConfigFile(projectPath);
+
+  if (!globalConf && !projectConf) return null;
+
+  const base = globalConf ?? {};
+  const override = projectConf ?? {};
+  const config = mergeConfigs(base, override);
+
+  // Determine which scope is "effective"
+  const resolved = resolveConfigPath("auto", workspaceRoot);
+
+  return {
+    config,
+    scope: resolved.scope,
+    path: resolved.path,
+  };
+}
+
+/**
+ * Redact apiKey values from config for safe logging/display.
+ */
+export function redactConfig(config: CbxConfig): CbxConfig {
+  const redacted = JSON.parse(JSON.stringify(config)) as CbxConfig;
+  if (redacted.postman && typeof redacted.postman === "object") {
+    const postman = redacted.postman as Record<string, unknown>;
+    if (typeof postman.apiKey === "string") {
+      postman.apiKey = "***REDACTED***";
+    }
+    if (Array.isArray(postman.profiles)) {
+      for (const rawProfile of postman.profiles) {
+        if (!rawProfile || typeof rawProfile !== "object") continue;
+        const profile = rawProfile as Record<string, unknown>;
+        if (typeof profile.apiKey === "string") {
+          profile.apiKey = "***REDACTED***";
+        }
+      }
+    }
+  }
+
+  if (redacted.stitch && typeof redacted.stitch === "object") {
+    const stitch = redacted.stitch as Record<string, unknown>;
+    if (typeof stitch.apiKey === "string") {
+      stitch.apiKey = "***REDACTED***";
+    }
+    if (Array.isArray(stitch.profiles)) {
+      for (const rawProfile of stitch.profiles) {
+        if (!rawProfile || typeof rawProfile !== "object") continue;
+        const profile = rawProfile as Record<string, unknown>;
+        if (typeof profile.apiKey === "string") {
+          profile.apiKey = "***REDACTED***";
+        }
+      }
+    } else if (stitch.profiles && typeof stitch.profiles === "object") {
+      for (const profile of Object.values(
+        stitch.profiles as Record<string, Record<string, unknown>>,
+      )) {
+        if (typeof profile.apiKey === "string") {
+          profile.apiKey = "***REDACTED***";
+        }
+      }
+    }
+  }
+  return redacted;
+}

package/mcp/src/cbxConfig/readerWriter.test.ts

@@ -0,0 +1,147 @@
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import {
+  ensureConfigExists,
+  readEffectiveConfig,
+  redactConfig,
+  resolveConfigPath,
+  writeConfigField,
+} from "./index.js";
+
+let tempHomeDir = "";
+let workspaceDir = "";
+const originalHome = process.env.HOME;
+const originalCwd = process.cwd();
+
+function writeJson(filePath: string, value: unknown): void {
+  mkdirSync(path.dirname(filePath), { recursive: true });
+  writeFileSync(filePath, JSON.stringify(value, null, 2) + "\n", "utf8");
+}
+
+function readJson(filePath: string): Record<string, unknown> {
+  return JSON.parse(readFileSync(filePath, "utf8")) as Record<string, unknown>;
+}
+
+beforeEach(() => {
+  tempHomeDir = mkdtempSync(path.join(os.tmpdir(), "mcp-home-"));
+  workspaceDir = mkdtempSync(path.join(os.tmpdir(), "mcp-workspace-"));
+  process.env.HOME = tempHomeDir;
+  process.chdir(workspaceDir);
+});
+
+afterEach(() => {
+  process.chdir(originalCwd);
+  if (originalHome === undefined) {
+    delete process.env.HOME;
+  } else {
+    process.env.HOME = originalHome;
+  }
+  rmSync(tempHomeDir, { recursive: true, force: true });
+  rmSync(workspaceDir, { recursive: true, force: true });
+});
+
+describe("config path resolution", () => {
+  it("chooses global scope when no project config exists", () => {
+    const resolved = resolveConfigPath("auto", workspaceDir);
+    expect(resolved.scope).toBe("global");
+    expect(resolved.path).toBe(
+      path.join(tempHomeDir, ".cbx", "cbx_config.json"),
+    );
+  });
+
+  it("chooses project scope when project config exists", () => {
+    const projectPath = path.join(workspaceDir, "cbx_config.json");
+    writeJson(projectPath, { postman: { mcpUrl: "https://mcp.postman.com/code" } });
+
+    const resolved = resolveConfigPath("auto", workspaceDir);
+    expect(resolved.scope).toBe("project");
+    expect(resolved.path).toBe(projectPath);
+  });
+});
+
+describe("read/write behavior", () => {
+  it("writes nested fields to project config", () => {
+    const result = writeConfigField(
+      "postman.mcpUrl",
+      "https://mcp.postman.com/full",
+      "project",
+      workspaceDir,
+    );
+
+    expect(result.scope).toBe("project");
+    const written = readJson(result.writtenPath);
+    expect(written).toMatchObject({
+      postman: { mcpUrl: "https://mcp.postman.com/full" },
+    });
+  });
+
+  it("merges global and project config with project precedence", () => {
+    writeJson(path.join(tempHomeDir, ".cbx", "cbx_config.json"), {
+      postman: { mcpUrl: "https://mcp.postman.com/minimal" },
+      stitch: {
+        activeProfileName: "prod",
+        profiles: {
+          prod: { url: "https://prod.example.com", apiKey: "secret" },
+        },
+      },
+    });
+    writeJson(path.join(workspaceDir, "cbx_config.json"), {
+      postman: { defaultWorkspaceId: "ws_123" },
+      stitch: {
+        activeProfileName: "staging",
+        profiles: { staging: { url: "https://staging.example.com" } },
+      },
+    });
+
+    const effective = readEffectiveConfig("auto", workspaceDir);
+    expect(effective).not.toBeNull();
+    expect(effective?.scope).toBe("project");
+    expect(effective?.config).toMatchObject({
+      postman: {
+        mcpUrl: "https://mcp.postman.com/minimal",
+        defaultWorkspaceId: "ws_123",
+      },
+      stitch: {
+        activeProfileName: "staging",
+        profiles: {
+          prod: { url: "https://prod.example.com", apiKey: "secret" },
+          staging: { url: "https://staging.example.com" },
+        },
+      },
+    });
+  });
+
+  it("ensureConfigExists throws when target config is missing", () => {
+    expect(() => ensureConfigExists("project", workspaceDir)).toThrow(
+      "cbx_config.json not found",
+    );
+  });
+
+  it("ensureConfigExists passes when target config exists", () => {
+    writeJson(path.join(workspaceDir, "cbx_config.json"), { stitch: {} });
+    expect(() => ensureConfigExists("project", workspaceDir)).not.toThrow();
+  });
+
+  it("redacts stitch api keys for safe display", () => {
+    const redacted = redactConfig({
+      stitch: {
+        profiles: {
+          production: { url: "https://stitch.prod", apiKey: "top-secret" },
+        },
+      },
+    });
+
+    expect(redacted).toMatchObject({
+      stitch: {
+        profiles: {
+          production: {
+            url: "https://stitch.prod",
+            apiKey: "***REDACTED***",
+          },
+        },
+      },
+    });
+  });
+});

package/mcp/src/cbxConfig/serviceConfig.test.ts

@@ -0,0 +1,42 @@
+import { describe, expect, it } from "vitest";
+import { parsePostmanState, parseStitchState } from "./serviceConfig.js";
+
+describe("service config normalization", () => {
+  it("normalizes postman profile arrays", () => {
+    const state = parsePostmanState({
+      postman: {
+        mcpUrl: "https://mcp.postman.com/code",
+        activeProfileName: "team-a",
+        profiles: [
+          {
+            name: "team-a",
+            apiKeyEnvVar: "POSTMAN_API_KEY_TEAM_A",
+            workspaceId: "ws_123",
+          },
+        ],
+      },
+    });
+
+    expect(state.mcpUrl).toBe("https://mcp.postman.com/code");
+    expect(state.activeProfileName).toBe("team-a");
+    expect(state.activeProfile?.apiKeyEnvVar).toBe("POSTMAN_API_KEY_TEAM_A");
+  });
+
+  it("normalizes legacy stitch profile maps", () => {
+    const state = parseStitchState({
+      stitch: {
+        activeProfileName: "prod",
+        profiles: {
+          prod: {
+            url: "https://stitch.googleapis.com/mcp",
+            apiKeyEnvVar: "STITCH_API_KEY_PROD",
+          },
+        },
+      },
+    });
+
+    expect(state.activeProfileName).toBe("prod");
+    expect(state.activeProfile?.url).toBe("https://stitch.googleapis.com/mcp");
+    expect(state.activeProfile?.apiKeyEnvVar).toBe("STITCH_API_KEY_PROD");
+  });
+});

package/mcp/src/cbxConfig/serviceConfig.ts

@@ -0,0 +1,157 @@
+/**
+ * Cubis Foundry MCP Server – credential service config normalization.
+ *
+ * Supports both legacy object-map and current profile-array shapes.
+ */
+
+import type { CbxConfig } from "./types.js";
+
+export interface CredentialProfileState {
+  name: string;
+  apiKeyEnvVar: string;
+  workspaceId?: string | null;
+  url?: string | null;
+  hasInlineApiKey: boolean;
+}
+
+export interface CredentialServiceState {
+  mcpUrl: string | null;
+  activeProfileName: string | null;
+  activeProfile: CredentialProfileState | null;
+  profiles: CredentialProfileState[];
+  useSystemGcloud?: boolean;
+}
+
+const DEFAULT_POSTMAN_URL = "https://mcp.postman.com/minimal";
+const DEFAULT_STITCH_URL = "https://stitch.googleapis.com/mcp";
+const DEFAULT_PROFILE_NAME = "default";
+const DEFAULT_POSTMAN_ENV_VAR = "POSTMAN_API_KEY";
+const DEFAULT_STITCH_ENV_VAR = "STITCH_API_KEY";
+
+function asRecord(value: unknown): Record<string, unknown> | null {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  return value as Record<string, unknown>;
+}
+
+function normalizeName(value: unknown, fallback = DEFAULT_PROFILE_NAME): string {
+  const normalized = typeof value === "string" ? value.trim() : "";
+  return normalized || fallback;
+}
+
+function normalizeEnvVar(value: unknown, fallback: string): string {
+  const normalized = typeof value === "string" ? value.trim() : "";
+  return normalized || fallback;
+}
+
+function normalizeOptionalString(value: unknown): string | null {
+  if (value === null || value === undefined) return null;
+  const normalized = String(value).trim();
+  return normalized || null;
+}
+
+export function parsePostmanState(config: CbxConfig): CredentialServiceState {
+  const section = asRecord(config.postman) ?? {};
+  const mcpUrl = normalizeOptionalString(section.mcpUrl) ?? DEFAULT_POSTMAN_URL;
+  const fallbackEnvVar = normalizeEnvVar(
+    section.apiKeyEnvVar,
+    DEFAULT_POSTMAN_ENV_VAR,
+  );
+  const rawProfiles = Array.isArray(section.profiles) ? section.profiles : [];
+  const profiles: CredentialProfileState[] = [];
+
+  for (const rawProfile of rawProfiles) {
+    const profile = asRecord(rawProfile);
+    if (!profile) continue;
+    profiles.push({
+      name: normalizeName(profile.name, DEFAULT_PROFILE_NAME),
+      apiKeyEnvVar: normalizeEnvVar(profile.apiKeyEnvVar, fallbackEnvVar),
+      workspaceId: normalizeOptionalString(
+        profile.workspaceId ?? profile.defaultWorkspaceId,
+      ),
+      hasInlineApiKey:
+        typeof profile.apiKey === "string" && profile.apiKey.trim().length > 0,
+    });
+  }
+
+  if (profiles.length === 0) {
+    profiles.push({
+      name: DEFAULT_PROFILE_NAME,
+      apiKeyEnvVar: fallbackEnvVar,
+      workspaceId: normalizeOptionalString(section.defaultWorkspaceId),
+      hasInlineApiKey:
+        typeof section.apiKey === "string" && section.apiKey.trim().length > 0,
+    });
+  }
+
+  const requestedActive = normalizeOptionalString(section.activeProfileName);
+  const activeProfile =
+    profiles.find((profile) => profile.name === requestedActive) ?? profiles[0];
+
+  return {
+    mcpUrl,
+    activeProfileName: activeProfile?.name ?? null,
+    activeProfile: activeProfile ?? null,
+    profiles,
+  };
+}
+
+export function parseStitchState(config: CbxConfig): CredentialServiceState {
+  const section = asRecord(config.stitch) ?? {};
+  const mcpUrl = normalizeOptionalString(section.mcpUrl) ?? DEFAULT_STITCH_URL;
+  const fallbackEnvVar = normalizeEnvVar(
+    section.apiKeyEnvVar,
+    DEFAULT_STITCH_ENV_VAR,
+  );
+  const rawProfiles = section.profiles;
+  const profiles: CredentialProfileState[] = [];
+
+  if (Array.isArray(rawProfiles)) {
+    for (const rawProfile of rawProfiles) {
+      const profile = asRecord(rawProfile);
+      if (!profile) continue;
+      profiles.push({
+        name: normalizeName(profile.name, DEFAULT_PROFILE_NAME),
+        apiKeyEnvVar: normalizeEnvVar(profile.apiKeyEnvVar, fallbackEnvVar),
+        url: normalizeOptionalString(profile.url),
+        hasInlineApiKey:
+          typeof profile.apiKey === "string" && profile.apiKey.trim().length > 0,
+      });
+    }
+  } else if (asRecord(rawProfiles)) {
+    for (const [profileName, rawProfile] of Object.entries(
+      rawProfiles as Record<string, unknown>,
+    )) {
+      const profile = asRecord(rawProfile);
+      if (!profile) continue;
+      profiles.push({
+        name: normalizeName(profileName, DEFAULT_PROFILE_NAME),
+        apiKeyEnvVar: normalizeEnvVar(profile.apiKeyEnvVar, fallbackEnvVar),
+        url: normalizeOptionalString(profile.url),
+        hasInlineApiKey:
+          typeof profile.apiKey === "string" && profile.apiKey.trim().length > 0,
+      });
+    }
+  }
+
+  if (profiles.length === 0) {
+    profiles.push({
+      name: DEFAULT_PROFILE_NAME,
+      apiKeyEnvVar: fallbackEnvVar,
+      url: normalizeOptionalString(section.url) ?? mcpUrl,
+      hasInlineApiKey:
+        typeof section.apiKey === "string" && section.apiKey.trim().length > 0,
+    });
+  }
+
+  const requestedActive = normalizeOptionalString(section.activeProfileName);
+  const activeProfile =
+    profiles.find((profile) => profile.name === requestedActive) ?? profiles[0];
+
+  return {
+    mcpUrl,
+    activeProfileName: activeProfile?.name ?? null,
+    activeProfile: activeProfile ?? null,
+    profiles,
+    useSystemGcloud: Boolean(section.useSystemGcloud),
+  };
+}

package/mcp/src/cbxConfig/types.ts

@@ -0,0 +1,44 @@
+/**
+ * Cubis Foundry MCP Server – cbxConfig types.
+ */
+
+export type ConfigScope = "global" | "project";
+
+export interface ServiceProfile {
+  name?: string;
+  mcpUrl?: string;
+  url?: string;
+  workspaceId?: string | null;
+  defaultWorkspaceId?: string | null;
+  apiKey?: string;
+  apiKeyEnvVar?: string;
+  tokenEnvVar?: string;
+}
+
+export interface PostmanConfig {
+  mcpUrl?: string;
+  defaultWorkspaceId?: string | null;
+  activeProfileName?: string;
+  apiKeyEnvVar?: string;
+  tokenEnvVar?: string;
+  profiles?: ServiceProfile[] | Record<string, ServiceProfile>;
+}
+
+export interface StitchConfig {
+  mcpUrl?: string;
+  activeProfileName?: string;
+  apiKeyEnvVar?: string;
+  profiles?: ServiceProfile[] | Record<string, ServiceProfile>;
+}
+
+export interface CbxConfig {
+  postman?: PostmanConfig;
+  stitch?: StitchConfig;
+  [key: string]: unknown;
+}
+
+export interface EffectiveConfig {
+  config: CbxConfig;
+  scope: ConfigScope;
+  path: string;
+}