@cubis/foundry 0.3.59 → 0.3.60

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 All notable changes to this project are documented in this file.
 
+## [0.3.60] - 2026-03-05
+
+### Fixed
+
+- Fixed `cbx mcp serve` runtime failure from global npm installs by including required MCP runtime dependencies in the main package (`@modelcontextprotocol/sdk`, `zod`).
+- Improved Codex global Postman MCP startup reliability:
+  - after registration, CBX now patches Codex MCP config to use static Authorization headers when a managed Postman key is available
+  - avoids startup failures caused by missing shell-exported `POSTMAN_API_KEY_DEFAULT`.
+
 ## [0.3.59] - 2026-03-05
 
 ### Added

package/dist/cli/core.js

@@ -1028,6 +1028,79 @@ function parseTomlSections(content) {
     }
     return sections;
 }
+function escapeTomlBasicString(value) {
+    return String(value ?? "")
+        .replace(/\\/g, "\\\\")
+        .replace(/"/g, '\\"');
+}
+async function patchCodexPostmanHttpHeaders({ configPath, mcpUrl, bearerToken, dryRun = false, }) {
+    const warnings = [];
+    const normalizedToken = normalizePostmanApiKey(bearerToken);
+    if (!normalizedToken) {
+        return {
+            action: "skipped",
+            warnings: [
+                "Postman API key is unavailable in current environment. Kept bearer_token_env_var wiring in Codex config.",
+            ],
+        };
+    }
+    const configExists = await pathExists(configPath);
+    const original = configExists ? await readFile(configPath, "utf8") : "";
+    const lines = original.split(/\r?\n/);
+    const nextLines = [];
+    const headerLine = `http_headers = { Authorization = "Bearer ${escapeTomlBasicString(normalizedToken)}" }`;
+    const serverHeader = "[mcp_servers.postman]";
+    let inPostmanSection = false;
+    let postmanSectionFound = false;
+    let insertedHeaders = false;
+    const flushPostmanHeaderIfNeeded = () => {
+        if (inPostmanSection && !insertedHeaders) {
+            nextLines.push(headerLine);
+            insertedHeaders = true;
+        }
+    };
+    for (const line of lines) {
+        const sectionMatch = line.match(/^\s*\[([^\]]+)\]\s*$/);
+        if (sectionMatch) {
+            flushPostmanHeaderIfNeeded();
+            const sectionName = sectionMatch[1].trim();
+            inPostmanSection = sectionName === "mcp_servers.postman";
+            if (inPostmanSection) {
+                postmanSectionFound = true;
+                insertedHeaders = false;
+            }
+            nextLines.push(line);
+            continue;
+        }
+        if (inPostmanSection) {
+            if (/^\s*(bearer_token_env_var|http_headers|env_http_headers)\s*=/.test(line)) {
+                continue;
+            }
+        }
+        nextLines.push(line);
+    }
+    flushPostmanHeaderIfNeeded();
+    if (!postmanSectionFound) {
+        if (nextLines.length > 0 && nextLines[nextLines.length - 1].trim() !== "") {
+            nextLines.push("");
+        }
+        nextLines.push(serverHeader);
+        nextLines.push(`url = "${escapeTomlBasicString(mcpUrl || POSTMAN_MCP_URL)}"`);
+        nextLines.push(headerLine);
+    }
+    const next = `${nextLines.join("\n").replace(/\n+$/g, "")}\n`;
+    if (next === original) {
+        return { action: "unchanged", warnings };
+    }
+    if (!dryRun) {
+        await mkdir(path.dirname(configPath), { recursive: true });
+        await writeFile(configPath, next, "utf8");
+    }
+    return {
+        action: dryRun ? "would-patch" : "patched",
+        warnings,
+    };
+}
 function parsePubspecDependencyNames(content) {
     const packages = new Set();
     let currentSection = null;
@@ -4223,6 +4296,19 @@ async function applyPostmanMcpForPlatform({ platform, mcpScope, apiKeyEnvVar, mc
                     "--bearer-token-env-var",
                     apiKeyEnvVar || POSTMAN_API_KEY_ENV_VAR,
                 ], { cwd });
+                const postmanToken = normalizePostmanApiKey(process.env[apiKeyEnvVar || POSTMAN_API_KEY_ENV_VAR]);
+                const postmanPatch = await patchCodexPostmanHttpHeaders({
+                    configPath: codexConfigPath,
+                    mcpUrl,
+                    bearerToken: postmanToken,
+                    dryRun: false,
+                });
+                if (postmanPatch.action === "patched") {
+                    warnings.push("Codex Postman MCP config patched to static Authorization header for startup reliability.");
+                }
+                if (postmanPatch.warnings?.length) {
+                    warnings.push(...postmanPatch.warnings);
+                }
             }
             catch (error) {
                 warnings.push(`Failed to register Postman MCP via Codex CLI. Ensure 'codex' is installed and rerun. (${error.message})`);