@cubis/foundry 0.3.57 → 0.3.60

package/CHANGELOG.md

@@ -2,6 +2,33 @@
 
 All notable changes to this project are documented in this file.
 
+## [0.3.60] - 2026-03-05
+
+### Fixed
+
+- Fixed `cbx mcp serve` runtime failure from global npm installs by including required MCP runtime dependencies in the main package (`@modelcontextprotocol/sdk`, `zod`).
+- Improved Codex global Postman MCP startup reliability:
+  - after registration, CBX now patches Codex MCP config to use static Authorization headers when a managed Postman key is available
+  - avoids startup failures caused by missing shell-exported `POSTMAN_API_KEY_DEFAULT`.
+
+## [0.3.59] - 2026-03-05
+
+### Added
+
+- Added dedicated Postman workflow routing across supported platforms:
+  - new `/postman` workflow definition
+  - generated platform assets for Codex, Antigravity, and Copilot
+  - generated wrapper skill `workflow-postman` for Codex.
+
+### Changed
+
+- Tightened Postman guidance to be MCP-first:
+  - explicitly prefer `postman.*` / `postman_*` tools for execution
+  - disallow default fallback to raw JSON/curl/Newman unless explicitly requested.
+- Updated Postman setup/troubleshooting docs to be scope-aware (`project|global`) so project installs stop drifting to global-only guidance.
+- Updated Codex rules template to reinforce no default JSON/curl fallback when Postman MCP tools are available.
+- Updated smoke test expectations from 18 to 19 workflows/prompts/commands where applicable.
+
 ## [0.3.57] - 2026-03-05
 
 ### Changed

package/dist/cli/core.js

@@ -811,9 +811,35 @@ function buildEngineeringRulesTemplate() {
         "## 8) Response Contract (Decision Log Required)",
         "",
         "- For planning/review/execution summaries, use a `Decision Log` structure.",
-        "- Each decision entry should include: `Context`, `Decision`, `Rationale`, `Tradeoffs`, `Validation`.",
-        "- Include a `Files Used` section with full absolute paths (not shorthand names).",
+        "- Each decision entry must include: `Context`, `Decision`, `Rationale`, `Tradeoffs`, `Validation`.",
+        "- Include `Files Used` with labeled keys and full absolute paths (not shorthand names).",
+        "- Include `Skills Used` with skill IDs and full skill file paths when skills are loaded.",
+        "- Minimum required entries in `Files Used` for project work:",
+        "  - `active_rules_file`: active platform rules file path (for example `AGENTS.md`, `.agent/rules/GEMINI.md`, or `.github/copilot-instructions.md`)",
+        "  - `engineering_rules_file`: `/abs/path/ENGINEERING_RULES.md`",
+        "  - `tech_map_file`: `/abs/path/TECH.md`",
+        "- If no skill is loaded, write `Skills Used: none` explicitly.",
         "- Never hide key file paths behind aliases or abbreviated labels.",
+        "- A Decision Log without required `Files Used` and `Skills Used` is incomplete and must be corrected before final response.",
+        "",
+        "Required shape:",
+        "",
+        "Decision Log",
+        "1. Context: ...",
+        "Decision: ...",
+        "Rationale: ...",
+        "Tradeoffs: ...",
+        "Validation: ...",
+        "",
+        "Files Used",
+        "- active_rules_file: /abs/path/<platform-rule-file>",
+        "- engineering_rules_file: /abs/path/ENGINEERING_RULES.md",
+        "- tech_map_file: /abs/path/TECH.md",
+        "- implementation_file: /abs/path/other/file.ts (as needed)",
+        "",
+        "Skills Used",
+        "- skill-id: /abs/path/<platform-skills-root>/<skill-id>/SKILL.md",
+        "- or: none",
         "",
         "## 9) Keep TECH.md Fresh",
         "",
@@ -842,7 +868,10 @@ function buildEngineeringRulesManagedBlock({ platform, engineeringRulesFilePath,
         "3. Apply SOLID pragmatically to reduce change risk, not add ceremony.",
         "4. Use clear naming with focused responsibilities and explicit boundaries.",
         "5. Require validation evidence (lint/types/tests) before merge.",
-        "6. Use Decision Log response style and include full absolute file paths in `Files Used`.",
+        "6. Use Decision Log response style.",
+        "7. Every Decision Log must include both `Files Used` and `Skills Used` sections.",
+        "8. `Files Used` must include labeled keys (`active_rules_file`, `engineering_rules_file`, `tech_map_file`) with full absolute paths.",
+        "9. If no skill loaded, `Skills Used: none` is mandatory.",
         "",
         "<!-- cbx:engineering:auto:end -->",
     ].join("\n");
@@ -999,6 +1028,79 @@ function parseTomlSections(content) {
     }
     return sections;
 }
+function escapeTomlBasicString(value) {
+    return String(value ?? "")
+        .replace(/\\/g, "\\\\")
+        .replace(/"/g, '\\"');
+}
+async function patchCodexPostmanHttpHeaders({ configPath, mcpUrl, bearerToken, dryRun = false, }) {
+    const warnings = [];
+    const normalizedToken = normalizePostmanApiKey(bearerToken);
+    if (!normalizedToken) {
+        return {
+            action: "skipped",
+            warnings: [
+                "Postman API key is unavailable in current environment. Kept bearer_token_env_var wiring in Codex config.",
+            ],
+        };
+    }
+    const configExists = await pathExists(configPath);
+    const original = configExists ? await readFile(configPath, "utf8") : "";
+    const lines = original.split(/\r?\n/);
+    const nextLines = [];
+    const headerLine = `http_headers = { Authorization = "Bearer ${escapeTomlBasicString(normalizedToken)}" }`;
+    const serverHeader = "[mcp_servers.postman]";
+    let inPostmanSection = false;
+    let postmanSectionFound = false;
+    let insertedHeaders = false;
+    const flushPostmanHeaderIfNeeded = () => {
+        if (inPostmanSection && !insertedHeaders) {
+            nextLines.push(headerLine);
+            insertedHeaders = true;
+        }
+    };
+    for (const line of lines) {
+        const sectionMatch = line.match(/^\s*\[([^\]]+)\]\s*$/);
+        if (sectionMatch) {
+            flushPostmanHeaderIfNeeded();
+            const sectionName = sectionMatch[1].trim();
+            inPostmanSection = sectionName === "mcp_servers.postman";
+            if (inPostmanSection) {
+                postmanSectionFound = true;
+                insertedHeaders = false;
+            }
+            nextLines.push(line);
+            continue;
+        }
+        if (inPostmanSection) {
+            if (/^\s*(bearer_token_env_var|http_headers|env_http_headers)\s*=/.test(line)) {
+                continue;
+            }
+        }
+        nextLines.push(line);
+    }
+    flushPostmanHeaderIfNeeded();
+    if (!postmanSectionFound) {
+        if (nextLines.length > 0 && nextLines[nextLines.length - 1].trim() !== "") {
+            nextLines.push("");
+        }
+        nextLines.push(serverHeader);
+        nextLines.push(`url = "${escapeTomlBasicString(mcpUrl || POSTMAN_MCP_URL)}"`);
+        nextLines.push(headerLine);
+    }
+    const next = `${nextLines.join("\n").replace(/\n+$/g, "")}\n`;
+    if (next === original) {
+        return { action: "unchanged", warnings };
+    }
+    if (!dryRun) {
+        await mkdir(path.dirname(configPath), { recursive: true });
+        await writeFile(configPath, next, "utf8");
+    }
+    return {
+        action: dryRun ? "would-patch" : "patched",
+        warnings,
+    };
+}
 function parsePubspecDependencyNames(content) {
     const packages = new Set();
     let currentSection = null;
@@ -4194,6 +4296,19 @@ async function applyPostmanMcpForPlatform({ platform, mcpScope, apiKeyEnvVar, mc
                     "--bearer-token-env-var",
                     apiKeyEnvVar || POSTMAN_API_KEY_ENV_VAR,
                 ], { cwd });
+                const postmanToken = normalizePostmanApiKey(process.env[apiKeyEnvVar || POSTMAN_API_KEY_ENV_VAR]);
+                const postmanPatch = await patchCodexPostmanHttpHeaders({
+                    configPath: codexConfigPath,
+                    mcpUrl,
+                    bearerToken: postmanToken,
+                    dryRun: false,
+                });
+                if (postmanPatch.action === "patched") {
+                    warnings.push("Codex Postman MCP config patched to static Authorization header for startup reliability.");
+                }
+                if (postmanPatch.warnings?.length) {
+                    warnings.push(...postmanPatch.warnings);
+                }
             }
             catch (error) {
                 warnings.push(`Failed to register Postman MCP via Codex CLI. Ensure 'codex' is installed and rerun. (${error.message})`);