@cubis/foundry 0.3.33 → 0.3.35

package/mcp/src/cbxConfig/writer.ts

@@ -0,0 +1,90 @@
+/**
+ * Cubis Foundry MCP Server – cbxConfig writer.
+ *
+ * Atomic writes: write to temp file, then rename.
+ * Mutates only the target field (e.g., postman.mcpUrl or stitch.activeProfileName).
+ * Never exposes or logs apiKey.
+ */
+
+import {
+  readFileSync,
+  writeFileSync,
+  renameSync,
+  mkdirSync,
+  existsSync,
+} from "node:fs";
+import path from "node:path";
+import { parse as parseJsonc } from "jsonc-parser";
+import { resolveConfigPath } from "./paths.js";
+import type { CbxConfig, ConfigScope } from "./types.js";
+import { logger } from "../utils/logger.js";
+import { configNotFound } from "../utils/errors.js";
+
+/**
+ * Set a nested field in cbx_config.json atomically.
+ *
+ * @param fieldPath - dot-separated path, e.g. "postman.mcpUrl"
+ * @param value - the value to set
+ * @param scope - config scope to write to
+ * @param workspaceRoot - workspace root for project scope
+ */
+export function writeConfigField(
+  fieldPath: string,
+  value: unknown,
+  scope?: ConfigScope | "auto",
+  workspaceRoot?: string,
+): { writtenPath: string; scope: ConfigScope } {
+  const resolved = resolveConfigPath(scope, workspaceRoot);
+  const configPath = resolved.path;
+
+  // Read existing config or start fresh
+  let config: CbxConfig = {};
+  if (existsSync(configPath)) {
+    try {
+      const raw = readFileSync(configPath, "utf8");
+      config = parseJsonc(raw) as CbxConfig;
+    } catch {
+      logger.warn(
+        `Cannot parse existing config at ${configPath}, creating new`,
+      );
+    }
+  }
+
+  // Set the nested field
+  const parts = fieldPath.split(".");
+  let current: Record<string, unknown> = config;
+  for (let i = 0; i < parts.length - 1; i++) {
+    const key = parts[i];
+    if (typeof current[key] !== "object" || current[key] === null) {
+      current[key] = {};
+    }
+    current = current[key] as Record<string, unknown>;
+  }
+  current[parts[parts.length - 1]] = value;
+
+  // Atomic write: temp file + rename
+  const dir = path.dirname(configPath);
+  if (!existsSync(dir)) {
+    mkdirSync(dir, { recursive: true });
+  }
+
+  const tmpPath = `${configPath}.tmp.${Date.now()}`;
+  writeFileSync(tmpPath, JSON.stringify(config, null, 2) + "\n", "utf8");
+  renameSync(tmpPath, configPath);
+
+  logger.debug(`Config field "${fieldPath}" written to ${configPath}`);
+  return { writtenPath: configPath, scope: resolved.scope };
+}
+
+/**
+ * Verify a config file exists at the resolved path, or throw the exact error message.
+ */
+export function ensureConfigExists(
+  scope?: ConfigScope | "auto",
+  workspaceRoot?: string,
+): void {
+  const resolved = resolveConfigPath(scope, workspaceRoot);
+  if (!existsSync(resolved.path)) {
+    configNotFound();
+  }
+}

package/mcp/src/config/index.test.ts

@@ -0,0 +1,81 @@
+import { afterEach, describe, expect, it } from "vitest";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { loadServerConfig } from "./index.js";
+import { rejectCredentialFields } from "./schema.js";
+
+const tempDirs: string[] = [];
+
+function createTempDir(prefix: string): string {
+  const dir = mkdtempSync(path.join(os.tmpdir(), prefix));
+  tempDirs.push(dir);
+  return dir;
+}
+
+afterEach(() => {
+  while (tempDirs.length > 0) {
+    const dir = tempDirs.pop();
+    if (dir) {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  }
+});
+
+describe("config loading", () => {
+  it("loads an explicit config file and applies schema defaults", () => {
+    const dir = createTempDir("mcp-config-");
+    const configPath = path.join(dir, "config.json");
+
+    writeFileSync(
+      configPath,
+      JSON.stringify({
+        server: { name: "cubis-foundry-mcp", version: "0.1.0" },
+        vault: { roots: ["../workflows/skills"] },
+        transport: { default: "stdio" },
+      }),
+      "utf8",
+    );
+
+    const config = loadServerConfig(configPath);
+    expect(config.server.name).toBe("cubis-foundry-mcp");
+    expect(config.vault.summaryMaxLength).toBe(200);
+  });
+
+  it("throws for a missing config file", () => {
+    expect(() => loadServerConfig("/definitely/missing/config.json")).toThrow(
+      "Cannot read server config",
+    );
+  });
+
+  it("throws for an invalid config shape", () => {
+    const dir = createTempDir("mcp-config-invalid-");
+    const configPath = path.join(dir, "config.json");
+    writeFileSync(configPath, JSON.stringify({ transport: {} }), "utf8");
+
+    expect(() => loadServerConfig(configPath)).toThrow("Invalid server config");
+  });
+});
+
+describe("credential field rejection", () => {
+  it("rejects forbidden credential keys anywhere in config", () => {
+    expect(() =>
+      rejectCredentialFields({
+        stitch: {
+          profiles: {
+            production: { apiKey: "secret" },
+          },
+        },
+      }),
+    ).toThrow('must not contain credential field "apiKey"');
+  });
+
+  it("allows safe non-secret config fields", () => {
+    expect(() =>
+      rejectCredentialFields({
+        server: { name: "ok", version: "1.0.0" },
+        vault: { roots: ["../workflows/skills"] },
+      }),
+    ).not.toThrow();
+  });
+});

package/mcp/src/config/index.ts

@@ -0,0 +1,45 @@
+/**
+ * Cubis Foundry MCP Server – config loader.
+ *
+ * Reads and validates config.json at startup.
+ */
+
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import {
+  ServerConfigSchema,
+  rejectCredentialFields,
+  type ServerConfig,
+} from "./schema.js";
+import { logger } from "../utils/logger.js";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const PKG_ROOT =
+  path.basename(__dirname) === "config"
+    ? path.resolve(__dirname, "../..")
+    : path.resolve(__dirname, "..");
+const DEFAULT_CONFIG_PATH = path.resolve(PKG_ROOT, "config.json");
+
+export function loadServerConfig(configPath?: string): ServerConfig {
+  const resolved = configPath ?? DEFAULT_CONFIG_PATH;
+  logger.debug(`Loading server config from ${resolved}`);
+
+  let raw: string;
+  try {
+    raw = readFileSync(resolved, "utf8");
+  } catch {
+    throw new Error(`Cannot read server config: ${resolved}`);
+  }
+
+  const parsed = JSON.parse(raw) as Record<string, unknown>;
+
+  // Security gate: reject credential fields
+  rejectCredentialFields(parsed);
+
+  const result = ServerConfigSchema.safeParse(parsed);
+  if (!result.success) {
+    throw new Error(`Invalid server config: ${result.error.message}`);
+  }
+  return result.data;
+}

package/mcp/src/config/schema.ts

@@ -0,0 +1,55 @@
+/**
+ * Cubis Foundry MCP Server – config schema (Zod v4 via zod/v4 import path).
+ *
+ * Validates the server's own config.json. Rejects credential fields.
+ */
+
+import { z } from "zod";
+
+export const ServerConfigSchema = z.object({
+  server: z.object({
+    name: z.string(),
+    version: z.string(),
+    description: z.string().optional(),
+  }),
+  vault: z.object({
+    roots: z.array(z.string()).min(1),
+    summaryMaxLength: z.number().int().positive().default(200),
+  }),
+  transport: z.object({
+    default: z.enum(["stdio", "streamable-http"]).default("stdio"),
+    http: z
+      .object({
+        port: z.number().int().positive().default(3100),
+        host: z.string().default("127.0.0.1"),
+      })
+      .optional(),
+  }),
+});
+
+export type ServerConfig = z.infer<typeof ServerConfigSchema>;
+
+/**
+ * Keys that must NEVER appear in the server config (security gate).
+ * These belong in cbx_config.json, not here.
+ */
+const FORBIDDEN_KEYS = [
+  "apiKey",
+  "api_key",
+  "secret",
+  "token",
+  "password",
+  "credential",
+];
+
+export function rejectCredentialFields(raw: Record<string, unknown>): void {
+  const json = JSON.stringify(raw);
+  for (const key of FORBIDDEN_KEYS) {
+    if (json.includes(`"${key}"`)) {
+      throw new Error(
+        `Server config.json must not contain credential field "${key}". ` +
+          `Store credentials in cbx_config.json instead.`,
+      );
+    }
+  }
+}

package/mcp/src/gateway/catalog.ts

@@ -0,0 +1,37 @@
+/**
+ * Cubis Foundry MCP Server – non-secret upstream tool catalog persistence.
+ */
+
+import { mkdirSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import type { ConfigScope } from "../cbxConfig/types.js";
+import type { CatalogPayload, UpstreamProvider } from "./types.js";
+
+export function resolveCatalogDir(
+  scope: ConfigScope | null,
+  configPath: string | null,
+): string {
+  if (scope === "project" && configPath) {
+    return path.join(path.dirname(configPath), ".cbx", "mcp", "catalog");
+  }
+
+  return path.join(os.homedir(), ".cbx", "mcp", "catalog");
+}
+
+export function catalogFilePath(
+  catalogDir: string,
+  provider: UpstreamProvider,
+): string {
+  return path.join(catalogDir, `${provider}.tools.json`);
+}
+
+export function persistCatalog(
+  catalogDir: string,
+  payload: CatalogPayload,
+): string {
+  mkdirSync(catalogDir, { recursive: true });
+  const filePath = catalogFilePath(catalogDir, payload.provider);
+  writeFileSync(filePath, JSON.stringify(payload, null, 2) + "\n", "utf8");
+  return filePath;
+}

package/mcp/src/gateway/config.ts

@@ -0,0 +1,247 @@
+/**
+ * Cubis Foundry MCP Server – upstream gateway config resolution.
+ */
+
+import { readEffectiveConfig } from "../cbxConfig/index.js";
+import type {
+  ConfigScope,
+  ServiceProfile,
+  PostmanConfig,
+  StitchConfig,
+} from "../cbxConfig/types.js";
+import type { UpstreamConfig, UpstreamProvider } from "./types.js";
+
+const STITCH_DEFAULT_MCP_URL = "https://stitch.googleapis.com/mcp";
+
+interface ResolvedGatewayConfig {
+  scope: ConfigScope | null;
+  configPath: string | null;
+  providers: Record<UpstreamProvider, UpstreamConfig>;
+}
+
+interface NamedProfile {
+  name: string;
+  profile: ServiceProfile;
+}
+
+function isNonEmptyString(value: unknown): value is string {
+  return typeof value === "string" && value.trim().length > 0;
+}
+
+function firstString(...values: Array<unknown>): string | null {
+  for (const value of values) {
+    if (isNonEmptyString(value)) {
+      return value.trim();
+    }
+  }
+  return null;
+}
+
+function normalizeProfiles(
+  profiles?: ServiceProfile[] | Record<string, ServiceProfile>,
+): NamedProfile[] {
+  if (!profiles) {
+    return [];
+  }
+
+  if (Array.isArray(profiles)) {
+    return profiles
+      .map((profile, index) => ({
+        name: firstString(profile.name) ?? `profile_${index + 1}`,
+        profile,
+      }))
+      .filter((entry) => !!entry.profile);
+  }
+
+  return Object.entries(profiles).map(([name, profile]) => ({
+    name,
+    profile,
+  }));
+}
+
+function selectActiveProfile(
+  profiles: NamedProfile[],
+  activeProfileName?: string,
+): NamedProfile | null {
+  if (profiles.length === 0) {
+    return null;
+  }
+
+  const active = firstString(activeProfileName);
+  if (active) {
+    const hit = profiles.find((profile) => profile.name === active);
+    if (hit) {
+      return hit;
+    }
+  }
+
+  return profiles[0];
+}
+
+function buildPostmanConfig(
+  postman: PostmanConfig | undefined,
+  scope: ConfigScope | null,
+  configPath: string | null,
+): UpstreamConfig {
+  const warnings: string[] = [];
+  const profiles = normalizeProfiles(postman?.profiles);
+  const active = selectActiveProfile(profiles, postman?.activeProfileName);
+
+  const mcpUrl = firstString(postman?.mcpUrl, active?.profile.mcpUrl, active?.profile.url);
+  if (!mcpUrl) {
+    warnings.push("Postman MCP URL is not configured (postman.mcpUrl).");
+  }
+
+  const authEnvVar = firstString(
+    active?.profile.tokenEnvVar,
+    active?.profile.apiKeyEnvVar,
+    postman?.tokenEnvVar,
+    postman?.apiKeyEnvVar,
+  );
+
+  const rawApiKeySet = !!firstString(active?.profile.apiKey);
+  if (rawApiKeySet) {
+    warnings.push("Postman profile apiKey is ignored; configure apiKeyEnvVar/tokenEnvVar alias instead.");
+  }
+
+  if (!authEnvVar) {
+    warnings.push("Postman auth env var alias is missing (active profile apiKeyEnvVar/tokenEnvVar).");
+    return {
+      provider: "postman",
+      mcpUrl,
+      authHeader: null,
+      authEnvVar: null,
+      scope,
+      configPath,
+      warnings,
+    };
+  }
+
+  const token = process.env[authEnvVar];
+  if (!isNonEmptyString(token)) {
+    warnings.push(`Postman auth env var \"${authEnvVar}\" is not set.`);
+    return {
+      provider: "postman",
+      mcpUrl,
+      authHeader: null,
+      authEnvVar,
+      scope,
+      configPath,
+      warnings,
+    };
+  }
+
+  return {
+    provider: "postman",
+    mcpUrl,
+    authHeader: { Authorization: `Bearer ${token}` },
+    authEnvVar,
+    scope,
+    configPath,
+    warnings,
+  };
+}
+
+function buildStitchConfig(
+  stitch: StitchConfig | undefined,
+  scope: ConfigScope | null,
+  configPath: string | null,
+): UpstreamConfig {
+  const warnings: string[] = [];
+  const profiles = normalizeProfiles(stitch?.profiles);
+  const active = selectActiveProfile(profiles, stitch?.activeProfileName);
+
+  const mcpUrl =
+    firstString(stitch?.mcpUrl, active?.profile.mcpUrl, active?.profile.url) ??
+    STITCH_DEFAULT_MCP_URL;
+
+  const authEnvVar = firstString(active?.profile.apiKeyEnvVar, stitch?.apiKeyEnvVar);
+
+  const rawApiKeySet = !!firstString(active?.profile.apiKey);
+  if (rawApiKeySet) {
+    warnings.push("Stitch profile apiKey is ignored; configure apiKeyEnvVar alias instead.");
+  }
+
+  if (!authEnvVar) {
+    warnings.push("Stitch auth env var alias is missing (active profile apiKeyEnvVar).");
+    return {
+      provider: "stitch",
+      mcpUrl,
+      authHeader: null,
+      authEnvVar: null,
+      scope,
+      configPath,
+      warnings,
+    };
+  }
+
+  const apiKey = process.env[authEnvVar];
+  if (!isNonEmptyString(apiKey)) {
+    warnings.push(`Stitch auth env var \"${authEnvVar}\" is not set.`);
+    return {
+      provider: "stitch",
+      mcpUrl,
+      authHeader: null,
+      authEnvVar,
+      scope,
+      configPath,
+      warnings,
+    };
+  }
+
+  return {
+    provider: "stitch",
+    mcpUrl,
+    authHeader: { "X-Goog-Api-Key": apiKey },
+    authEnvVar,
+    scope,
+    configPath,
+    warnings,
+  };
+}
+
+export function resolveGatewayConfig(
+  scope: ConfigScope | "auto" = "auto",
+): ResolvedGatewayConfig {
+  const effective = readEffectiveConfig(scope);
+
+  if (!effective) {
+    const warning =
+      "cbx_config.json not found. Configure Postman/Stitch profiles to enable upstream passthrough.";
+    return {
+      scope: null,
+      configPath: null,
+      providers: {
+        postman: {
+          provider: "postman",
+          mcpUrl: null,
+          authHeader: null,
+          authEnvVar: null,
+          scope: null,
+          configPath: null,
+          warnings: [warning],
+        },
+        stitch: {
+          provider: "stitch",
+          mcpUrl: STITCH_DEFAULT_MCP_URL,
+          authHeader: null,
+          authEnvVar: null,
+          scope: null,
+          configPath: null,
+          warnings: [warning],
+        },
+      },
+    };
+  }
+
+  return {
+    scope: effective.scope,
+    configPath: effective.path,
+    providers: {
+      postman: buildPostmanConfig(effective.config.postman, effective.scope, effective.path),
+      stitch: buildStitchConfig(effective.config.stitch, effective.scope, effective.path),
+    },
+  };
+}
+
+export { STITCH_DEFAULT_MCP_URL };