@cubis/foundry 0.3.39 → 0.3.40

package/bin/cubis.js

@@ -2506,6 +2506,13 @@ function rewriteCodexWorkflowAgentReferences(sourceBody, agentIds) {
   return rewritten;
 }
 
+function rewriteCodexAgentSkillReferences(sourceBody) {
+  if (!sourceBody) return sourceBody;
+  // Agent source files live under platforms/*/agents, but wrapper skills live
+  // under .agents/skills/agent-*. Rebase ../skills/<id> links accordingly.
+  return sourceBody.replace(/\(\.\.\/skills\//g, "(../");
+}
+
 async function parseWorkflowMetadata(filePath) {
   const raw = await readFile(filePath, "utf8");
   const { frontmatter, body } = extractFrontmatter(raw);
@@ -2730,11 +2737,15 @@ async function generateCodexWrapperSkills({
     }
 
     const metadata = await parseAgentMetadata(source);
+    const rewrittenBody = rewriteCodexAgentSkillReferences(metadata.body);
     const wrapperSkillId = `${CODEX_AGENT_SKILL_PREFIX}${metadata.id}`;
     const destinationDir = path.join(skillsDir, wrapperSkillId);
     const content = buildCodexAgentWrapperSkillMarkdown(
       wrapperSkillId,
-      metadata,
+      {
+        ...metadata,
+        body: rewrittenBody,
+      },
     );
 
     const result = await writeGeneratedSkillArtifact({
@@ -2759,6 +2770,22 @@ async function generateCodexWrapperSkills({
   };
 }
 
+async function resolvePlatformAgentSkillDependencies({
+  platformRoot,
+  platformSpec,
+}) {
+  const dependencyIds = [];
+
+  for (const agentFile of platformSpec.agents || []) {
+    const source = path.join(platformRoot, "agents", agentFile);
+    if (!(await pathExists(source))) continue;
+    const metadata = await parseAgentMetadata(source);
+    dependencyIds.push(...metadata.skills);
+  }
+
+  return unique(dependencyIds.filter(Boolean));
+}
+
 async function collectInstalledWorkflows(
   profileId,
   scope,
@@ -4902,9 +4929,13 @@ async function installBundleArtifacts({
       skipped.push(destination);
     else installed.push(destination);
   }
+  const agentSkillDependencies = await resolvePlatformAgentSkillDependencies({
+    platformRoot,
+    platformSpec,
+  });
   const skillIds = await resolveInstallSkillIds({
     platformSpec,
-    extraSkillIds,
+    extraSkillIds: [...extraSkillIds, ...agentSkillDependencies],
     skillProfile,
   });
   for (const skillId of skillIds) {
@@ -7047,7 +7078,8 @@ async function collectInlineHeaderFindings({
   const scanFile = async (filePath) => {
     if (!(await pathExists(filePath))) return;
     const raw = await readFile(filePath, "utf8");
-    const unsafeStitchHeader = /X-Goog-Api-Key:\s*(?!\$\{)[^"\n]+/i;
+    const unsafeStitchHeader =
+      /X-Goog-Api-Key:(?!\s*\$\{[A-Za-z_][A-Za-z0-9_]*\})\s*[^"\n]+/i;
     const unsafeBearerHeader = /"Authorization"\s*:\s*"Bearer\s+(?!\$\{)[^"]+/i;
     if (unsafeStitchHeader.test(raw) || unsafeBearerHeader.test(raw)) {
       findings.push(filePath);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cubis/foundry",
-  "version": "0.3.39",
+  "version": "0.3.40",
   "description": "Cubis Foundry CLI for workflow-first AI agent environments",
   "type": "module",
   "bin": {

package/workflows/skills/documentation-templates/docs/api.md

@@ -0,0 +1,16 @@
+# API Reference Template
+
+Use this file as the canonical entry point for API endpoint documentation.
+
+## Endpoint Index
+
+- `GET /resource`
+- `POST /resource`
+- `PATCH /resource/{id}`
+- `DELETE /resource/{id}`
+
+## Conventions
+
+- Include auth requirements per endpoint.
+- Include request/response examples.
+- Include error codes and retry guidance.

package/workflows/skills/documentation-templates/docs/architecture.md

@@ -0,0 +1,23 @@
+# Architecture Overview Template
+
+Use this file to describe system boundaries and data flow.
+
+## Components
+
+- API layer
+- Domain/service layer
+- Persistence layer
+- External integrations
+
+## Runtime Flow
+
+1. Request enters API layer
+2. Domain logic validates and processes
+3. Persistence reads/writes state
+4. Response returns with observability metadata
+
+## Non-Functional Notes
+
+- Reliability/SLOs
+- Security model
+- Scaling strategy

package/workflows/workflows/agent-environment-setup/platforms/antigravity/rules/GEMINI.md

@@ -110,7 +110,13 @@ If Antigravity script harness exists, prefer:
 Use these commands to keep this setup healthy:
 
 - Install/update bundle:
-  `cbx workflows install --platform antigravity --bundle agent-environment-setup --scope global --overwrite`
+  `cbx workflows install --platform antigravity --bundle agent-environment-setup --scope global --overwrite --postman --stitch --mcp-runtime docker --mcp-fallback local --mcp-tool-sync`
+- Start MCP Docker runtime:
+  `cbx mcp runtime up --scope global --name cbx-mcp --port 3310 --replace`
+- Check MCP Docker runtime:
+  `cbx mcp runtime status --scope global --name cbx-mcp`
+- Stop MCP Docker runtime:
+  `cbx mcp runtime down --name cbx-mcp`
 - Rebuild managed routing block:
   `cbx workflows sync-rules --platform antigravity --scope project`
 - Diagnose setup issues:

package/workflows/workflows/agent-environment-setup/platforms/codex/rules/AGENTS.md

@@ -100,7 +100,13 @@ Before multi-file or architecture-impacting changes, ask targeted questions when
 Use these commands to keep this setup healthy:
 
 - Install/update bundle:
-  `cbx workflows install --platform codex --bundle agent-environment-setup --scope global --overwrite`
+  `cbx workflows install --platform codex --bundle agent-environment-setup --scope global --overwrite --postman --stitch --mcp-runtime docker --mcp-fallback local --mcp-tool-sync`
+- Start MCP Docker runtime:
+  `cbx mcp runtime up --scope global --name cbx-mcp --port 3310 --replace`
+- Check MCP Docker runtime:
+  `cbx mcp runtime status --scope global --name cbx-mcp`
+- Stop MCP Docker runtime:
+  `cbx mcp runtime down --name cbx-mcp`
 - Rebuild managed routing block:
   `cbx workflows sync-rules --platform codex --scope project`
 - Diagnose setup issues:

package/workflows/workflows/agent-environment-setup/platforms/copilot/rules/AGENTS.md

@@ -109,7 +109,13 @@ Before multi-file or architecture-impacting changes, ask targeted questions when
 Use these commands to keep this setup healthy:
 
 - Install/update bundle:
-  `cbx workflows install --platform copilot --bundle agent-environment-setup --scope global --overwrite`
+  `cbx workflows install --platform copilot --bundle agent-environment-setup --scope global --overwrite --postman --stitch --mcp-runtime docker --mcp-fallback local --mcp-tool-sync`
+- Start MCP Docker runtime:
+  `cbx mcp runtime up --scope global --name cbx-mcp --port 3310 --replace`
+- Check MCP Docker runtime:
+  `cbx mcp runtime status --scope global --name cbx-mcp`
+- Stop MCP Docker runtime:
+  `cbx mcp runtime down --name cbx-mcp`
 - Rebuild managed routing block:
   `cbx workflows sync-rules --platform copilot --scope project`
 - Diagnose setup issues:

package/workflows/workflows/agent-environment-setup/platforms/copilot/rules/copilot-instructions.md

@@ -108,7 +108,13 @@ Before multi-file or architecture-impacting changes, ask targeted questions when
 Use these commands to keep this setup healthy:
 
 - Install/update bundle:
-  `cbx workflows install --platform copilot --bundle agent-environment-setup --scope global --overwrite`
+  `cbx workflows install --platform copilot --bundle agent-environment-setup --scope global --overwrite --postman --stitch --mcp-runtime docker --mcp-fallback local --mcp-tool-sync`
+- Start MCP Docker runtime:
+  `cbx mcp runtime up --scope global --name cbx-mcp --port 3310 --replace`
+- Check MCP Docker runtime:
+  `cbx mcp runtime status --scope global --name cbx-mcp`
+- Stop MCP Docker runtime:
+  `cbx mcp runtime down --name cbx-mcp`
 - Rebuild managed routing block:
   `cbx workflows sync-rules --platform copilot --scope project`
 - Diagnose setup issues: