@cubis/foundry 0.3.82 → 0.3.84

package/mcp/src/cbxConfig/serviceConfig.ts

@@ -1,192 +0,0 @@
-/**
- * Cubis Foundry MCP Server – credential service config normalization.
- *
- * Supports both legacy object-map and current profile-array shapes.
- */
-
-import type { CbxConfig } from "./types.js";
-
-export interface CredentialProfileState {
-  name: string;
-  apiKeyEnvVar: string;
-  workspaceId?: string | null;
-  url?: string | null;
-  hasInlineApiKey: boolean;
-}
-
-export interface CredentialServiceState {
-  mcpUrl: string | null;
-  activeProfileName: string | null;
-  activeProfile: CredentialProfileState | null;
-  profiles: CredentialProfileState[];
-  useSystemGcloud?: boolean;
-}
-
-const DEFAULT_POSTMAN_URL = "https://mcp.postman.com/minimal";
-const DEFAULT_STITCH_URL = "https://stitch.googleapis.com/mcp";
-const DEFAULT_PLAYWRIGHT_PORT = 8931;
-const DEFAULT_PLAYWRIGHT_URL = `http://localhost:${DEFAULT_PLAYWRIGHT_PORT}/mcp`;
-const DEFAULT_PROFILE_NAME = "default";
-const DEFAULT_POSTMAN_ENV_VAR = "POSTMAN_API_KEY";
-const DEFAULT_STITCH_ENV_VAR = "STITCH_API_KEY";
-
-function asRecord(value: unknown): Record<string, unknown> | null {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
-  return value as Record<string, unknown>;
-}
-
-function normalizeName(
-  value: unknown,
-  fallback = DEFAULT_PROFILE_NAME,
-): string {
-  const normalized = typeof value === "string" ? value.trim() : "";
-  return normalized || fallback;
-}
-
-function normalizeEnvVar(value: unknown, fallback: string): string {
-  const normalized = typeof value === "string" ? value.trim() : "";
-  return normalized || fallback;
-}
-
-function normalizeOptionalString(value: unknown): string | null {
-  if (value === null || value === undefined) return null;
-  const normalized = String(value).trim();
-  return normalized || null;
-}
-
-export function parsePostmanState(config: CbxConfig): CredentialServiceState {
-  const section = asRecord(config.postman) ?? {};
-  const mcpUrl = normalizeOptionalString(section.mcpUrl) ?? DEFAULT_POSTMAN_URL;
-  const fallbackEnvVar = normalizeEnvVar(
-    section.apiKeyEnvVar,
-    DEFAULT_POSTMAN_ENV_VAR,
-  );
-  const rawProfiles = Array.isArray(section.profiles) ? section.profiles : [];
-  const profiles: CredentialProfileState[] = [];
-
-  for (const rawProfile of rawProfiles) {
-    const profile = asRecord(rawProfile);
-    if (!profile) continue;
-    profiles.push({
-      name: normalizeName(profile.name, DEFAULT_PROFILE_NAME),
-      apiKeyEnvVar: normalizeEnvVar(profile.apiKeyEnvVar, fallbackEnvVar),
-      workspaceId: normalizeOptionalString(
-        profile.workspaceId ?? profile.defaultWorkspaceId,
-      ),
-      hasInlineApiKey:
-        typeof profile.apiKey === "string" && profile.apiKey.trim().length > 0,
-    });
-  }
-
-  if (profiles.length === 0) {
-    profiles.push({
-      name: DEFAULT_PROFILE_NAME,
-      apiKeyEnvVar: fallbackEnvVar,
-      workspaceId: normalizeOptionalString(section.defaultWorkspaceId),
-      hasInlineApiKey:
-        typeof section.apiKey === "string" && section.apiKey.trim().length > 0,
-    });
-  }
-
-  const requestedActive = normalizeOptionalString(section.activeProfileName);
-  const activeProfile =
-    profiles.find((profile) => profile.name === requestedActive) ?? profiles[0];
-
-  return {
-    mcpUrl,
-    activeProfileName: activeProfile?.name ?? null,
-    activeProfile: activeProfile ?? null,
-    profiles,
-  };
-}
-
-export function parseStitchState(config: CbxConfig): CredentialServiceState {
-  const section = asRecord(config.stitch) ?? {};
-  const mcpUrl = normalizeOptionalString(section.mcpUrl) ?? DEFAULT_STITCH_URL;
-  const fallbackEnvVar = normalizeEnvVar(
-    section.apiKeyEnvVar,
-    DEFAULT_STITCH_ENV_VAR,
-  );
-  const rawProfiles = section.profiles;
-  const profiles: CredentialProfileState[] = [];
-
-  if (Array.isArray(rawProfiles)) {
-    for (const rawProfile of rawProfiles) {
-      const profile = asRecord(rawProfile);
-      if (!profile) continue;
-      profiles.push({
-        name: normalizeName(profile.name, DEFAULT_PROFILE_NAME),
-        apiKeyEnvVar: normalizeEnvVar(profile.apiKeyEnvVar, fallbackEnvVar),
-        url: normalizeOptionalString(profile.url),
-        hasInlineApiKey:
-          typeof profile.apiKey === "string" &&
-          profile.apiKey.trim().length > 0,
-      });
-    }
-  } else if (asRecord(rawProfiles)) {
-    for (const [profileName, rawProfile] of Object.entries(
-      rawProfiles as Record<string, unknown>,
-    )) {
-      const profile = asRecord(rawProfile);
-      if (!profile) continue;
-      profiles.push({
-        name: normalizeName(profileName, DEFAULT_PROFILE_NAME),
-        apiKeyEnvVar: normalizeEnvVar(profile.apiKeyEnvVar, fallbackEnvVar),
-        url: normalizeOptionalString(profile.url),
-        hasInlineApiKey:
-          typeof profile.apiKey === "string" &&
-          profile.apiKey.trim().length > 0,
-      });
-    }
-  }
-
-  if (profiles.length === 0) {
-    profiles.push({
-      name: DEFAULT_PROFILE_NAME,
-      apiKeyEnvVar: fallbackEnvVar,
-      url: normalizeOptionalString(section.url) ?? mcpUrl,
-      hasInlineApiKey:
-        typeof section.apiKey === "string" && section.apiKey.trim().length > 0,
-    });
-  }
-
-  const requestedActive = normalizeOptionalString(section.activeProfileName);
-  const activeProfile =
-    profiles.find((profile) => profile.name === requestedActive) ?? profiles[0];
-
-  return {
-    mcpUrl,
-    activeProfileName: activeProfile?.name ?? null,
-    activeProfile: activeProfile ?? null,
-    profiles,
-    useSystemGcloud: Boolean(section.useSystemGcloud),
-  };
-}
-
-export interface PlaywrightServiceState {
-  mcpUrl: string;
-  port: number;
-}
-
-export function parsePlaywrightState(
-  config: CbxConfig,
-): PlaywrightServiceState {
-  const section = asRecord(config.playwright) ?? {};
-  const portRaw =
-    typeof section.port === "number" ? section.port : DEFAULT_PLAYWRIGHT_PORT;
-  const port =
-    Number.isFinite(portRaw) && portRaw > 0 && portRaw < 65536
-      ? portRaw
-      : DEFAULT_PLAYWRIGHT_PORT;
-  const envPort = process.env.PLAYWRIGHT_MCP_PORT
-    ? Number(process.env.PLAYWRIGHT_MCP_PORT)
-    : undefined;
-  const effectivePort =
-    envPort && Number.isFinite(envPort) && envPort > 0 && envPort < 65536
-      ? envPort
-      : port;
-  const mcpUrl =
-    normalizeOptionalString(section.mcpUrl) ??
-    `http://localhost:${effectivePort}/mcp`;
-  return { mcpUrl, port: effectivePort };
-}

package/mcp/src/cbxConfig/types.ts

@@ -1,50 +0,0 @@
-/**
- * Cubis Foundry MCP Server – cbxConfig types.
- */
-
-export type ConfigScope = "global" | "project";
-
-export interface ServiceProfile {
-  name?: string;
-  mcpUrl?: string;
-  url?: string;
-  workspaceId?: string | null;
-  defaultWorkspaceId?: string | null;
-  apiKey?: string;
-  apiKeyEnvVar?: string;
-  tokenEnvVar?: string;
-}
-
-export interface PostmanConfig {
-  mcpUrl?: string;
-  defaultWorkspaceId?: string | null;
-  activeProfileName?: string;
-  apiKeyEnvVar?: string;
-  tokenEnvVar?: string;
-  profiles?: ServiceProfile[] | Record<string, ServiceProfile>;
-}
-
-export interface StitchConfig {
-  mcpUrl?: string;
-  activeProfileName?: string;
-  apiKeyEnvVar?: string;
-  profiles?: ServiceProfile[] | Record<string, ServiceProfile>;
-}
-
-export interface PlaywrightConfig {
-  mcpUrl?: string;
-  port?: number;
-}
-
-export interface CbxConfig {
-  postman?: PostmanConfig;
-  stitch?: StitchConfig;
-  playwright?: PlaywrightConfig;
-  [key: string]: unknown;
-}
-
-export interface EffectiveConfig {
-  config: CbxConfig;
-  scope: ConfigScope;
-  path: string;
-}

package/mcp/src/cbxConfig/writer.ts

@@ -1,90 +0,0 @@
-/**
- * Cubis Foundry MCP Server – cbxConfig writer.
- *
- * Atomic writes: write to temp file, then rename.
- * Mutates only the target field (e.g., postman.mcpUrl or stitch.activeProfileName).
- * Never exposes or logs apiKey.
- */
-
-import {
-  readFileSync,
-  writeFileSync,
-  renameSync,
-  mkdirSync,
-  existsSync,
-} from "node:fs";
-import path from "node:path";
-import { parse as parseJsonc } from "jsonc-parser";
-import { resolveConfigPath } from "./paths.js";
-import type { CbxConfig, ConfigScope } from "./types.js";
-import { logger } from "../utils/logger.js";
-import { configNotFound } from "../utils/errors.js";
-
-/**
- * Set a nested field in cbx_config.json atomically.
- *
- * @param fieldPath - dot-separated path, e.g. "postman.mcpUrl"
- * @param value - the value to set
- * @param scope - config scope to write to
- * @param workspaceRoot - workspace root for project scope
- */
-export function writeConfigField(
-  fieldPath: string,
-  value: unknown,
-  scope?: ConfigScope | "auto",
-  workspaceRoot?: string,
-): { writtenPath: string; scope: ConfigScope } {
-  const resolved = resolveConfigPath(scope, workspaceRoot);
-  const configPath = resolved.path;
-
-  // Read existing config or start fresh
-  let config: CbxConfig = {};
-  if (existsSync(configPath)) {
-    try {
-      const raw = readFileSync(configPath, "utf8");
-      config = parseJsonc(raw) as CbxConfig;
-    } catch {
-      logger.warn(
-        `Cannot parse existing config at ${configPath}, creating new`,
-      );
-    }
-  }
-
-  // Set the nested field
-  const parts = fieldPath.split(".");
-  let current: Record<string, unknown> = config;
-  for (let i = 0; i < parts.length - 1; i++) {
-    const key = parts[i];
-    if (typeof current[key] !== "object" || current[key] === null) {
-      current[key] = {};
-    }
-    current = current[key] as Record<string, unknown>;
-  }
-  current[parts[parts.length - 1]] = value;
-
-  // Atomic write: temp file + rename
-  const dir = path.dirname(configPath);
-  if (!existsSync(dir)) {
-    mkdirSync(dir, { recursive: true });
-  }
-
-  const tmpPath = `${configPath}.tmp.${Date.now()}`;
-  writeFileSync(tmpPath, JSON.stringify(config, null, 2) + "\n", "utf8");
-  renameSync(tmpPath, configPath);
-
-  logger.debug(`Config field "${fieldPath}" written to ${configPath}`);
-  return { writtenPath: configPath, scope: resolved.scope };
-}
-
-/**
- * Verify a config file exists at the resolved path, or throw the exact error message.
- */
-export function ensureConfigExists(
-  scope?: ConfigScope | "auto",
-  workspaceRoot?: string,
-): void {
-  const resolved = resolveConfigPath(scope, workspaceRoot);
-  if (!existsSync(resolved.path)) {
-    configNotFound();
-  }
-}

package/mcp/src/config/index.test.ts

@@ -1,82 +0,0 @@
-import { afterEach, describe, expect, it } from "vitest";
-import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import { loadServerConfig } from "./index.js";
-import { rejectCredentialFields } from "./schema.js";
-
-const tempDirs: string[] = [];
-
-function createTempDir(prefix: string): string {
-  const dir = mkdtempSync(path.join(os.tmpdir(), prefix));
-  tempDirs.push(dir);
-  return dir;
-}
-
-afterEach(() => {
-  while (tempDirs.length > 0) {
-    const dir = tempDirs.pop();
-    if (dir) {
-      rmSync(dir, { recursive: true, force: true });
-    }
-  }
-});
-
-describe("config loading", () => {
-  it("loads an explicit config file and applies schema defaults", () => {
-    const dir = createTempDir("mcp-config-");
-    const configPath = path.join(dir, "config.json");
-
-    writeFileSync(
-      configPath,
-      JSON.stringify({
-        server: { name: "cubis-foundry-mcp", version: "0.1.0" },
-        vault: { roots: ["../workflows/skills"] },
-        transport: { default: "stdio" },
-      }),
-      "utf8",
-    );
-
-    const config = loadServerConfig(configPath);
-    expect(config.server.name).toBe("cubis-foundry-mcp");
-    expect(config.vault.summaryMaxLength).toBe(200);
-    expect(config.telemetry.charsPerToken).toBe(4);
-  });
-
-  it("throws for a missing config file", () => {
-    expect(() => loadServerConfig("/definitely/missing/config.json")).toThrow(
-      "Cannot read server config",
-    );
-  });
-
-  it("throws for an invalid config shape", () => {
-    const dir = createTempDir("mcp-config-invalid-");
-    const configPath = path.join(dir, "config.json");
-    writeFileSync(configPath, JSON.stringify({ transport: {} }), "utf8");
-
-    expect(() => loadServerConfig(configPath)).toThrow("Invalid server config");
-  });
-});
-
-describe("credential field rejection", () => {
-  it("rejects forbidden credential keys anywhere in config", () => {
-    expect(() =>
-      rejectCredentialFields({
-        stitch: {
-          profiles: {
-            production: { apiKey: "secret" },
-          },
-        },
-      }),
-    ).toThrow('must not contain credential field "apiKey"');
-  });
-
-  it("allows safe non-secret config fields", () => {
-    expect(() =>
-      rejectCredentialFields({
-        server: { name: "ok", version: "1.0.0" },
-        vault: { roots: ["../workflows/skills"] },
-      }),
-    ).not.toThrow();
-  });
-});

package/mcp/src/config/index.ts

@@ -1,45 +0,0 @@
-/**
- * Cubis Foundry MCP Server – config loader.
- *
- * Reads and validates config.json at startup.
- */
-
-import { readFileSync } from "node:fs";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import {
-  ServerConfigSchema,
-  rejectCredentialFields,
-  type ServerConfig,
-} from "./schema.js";
-import { logger } from "../utils/logger.js";
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-const PKG_ROOT =
-  path.basename(__dirname) === "config"
-    ? path.resolve(__dirname, "../..")
-    : path.resolve(__dirname, "..");
-const DEFAULT_CONFIG_PATH = path.resolve(PKG_ROOT, "config.json");
-
-export function loadServerConfig(configPath?: string): ServerConfig {
-  const resolved = configPath ?? DEFAULT_CONFIG_PATH;
-  logger.debug(`Loading server config from ${resolved}`);
-
-  let raw: string;
-  try {
-    raw = readFileSync(resolved, "utf8");
-  } catch {
-    throw new Error(`Cannot read server config: ${resolved}`);
-  }
-
-  const parsed = JSON.parse(raw) as Record<string, unknown>;
-
-  // Security gate: reject credential fields
-  rejectCredentialFields(parsed);
-
-  const result = ServerConfigSchema.safeParse(parsed);
-  if (!result.success) {
-    throw new Error(`Invalid server config: ${result.error.message}`);
-  }
-  return result.data;
-}

package/mcp/src/config/schema.ts

@@ -1,60 +0,0 @@
-/**
- * Cubis Foundry MCP Server – config schema (Zod v4 via zod/v4 import path).
- *
- * Validates the server's own config.json. Rejects credential fields.
- */
-
-import { z } from "zod";
-
-export const ServerConfigSchema = z.object({
-  server: z.object({
-    name: z.string(),
-    version: z.string(),
-    description: z.string().optional(),
-  }),
-  vault: z.object({
-    roots: z.array(z.string()).min(1),
-    summaryMaxLength: z.number().int().positive().default(200),
-  }),
-  telemetry: z
-    .object({
-      charsPerToken: z.number().positive().default(4),
-    })
-    .default({ charsPerToken: 4 }),
-  transport: z.object({
-    default: z.enum(["stdio", "streamable-http"]).default("stdio"),
-    http: z
-      .object({
-        port: z.number().int().positive().default(3100),
-        host: z.string().default("127.0.0.1"),
-      })
-      .optional(),
-  }),
-});
-
-export type ServerConfig = z.infer<typeof ServerConfigSchema>;
-
-/**
- * Keys that must NEVER appear in the server config (security gate).
- * These belong in cbx_config.json, not here.
- */
-const FORBIDDEN_KEYS = [
-  "apiKey",
-  "api_key",
-  "secret",
-  "token",
-  "password",
-  "credential",
-];
-
-export function rejectCredentialFields(raw: Record<string, unknown>): void {
-  const json = JSON.stringify(raw);
-  for (const key of FORBIDDEN_KEYS) {
-    if (json.includes(`"${key}"`)) {
-      throw new Error(
-        `Server config.json must not contain credential field "${key}". ` +
-          `Store credentials in cbx_config.json instead.`,
-      );
-    }
-  }
-}

package/mcp/src/gateway/catalog.ts

@@ -1,37 +0,0 @@
-/**
- * Cubis Foundry MCP Server – non-secret upstream tool catalog persistence.
- */
-
-import { mkdirSync, writeFileSync } from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import type { ConfigScope } from "../cbxConfig/types.js";
-import type { CatalogPayload, UpstreamProvider } from "./types.js";
-
-export function resolveCatalogDir(
-  scope: ConfigScope | null,
-  configPath: string | null,
-): string {
-  if (scope === "project" && configPath) {
-    return path.join(path.dirname(configPath), ".cbx", "mcp", "catalog");
-  }
-
-  return path.join(os.homedir(), ".cbx", "mcp", "catalog");
-}
-
-export function catalogFilePath(
-  catalogDir: string,
-  provider: UpstreamProvider,
-): string {
-  return path.join(catalogDir, `${provider}.tools.json`);
-}
-
-export function persistCatalog(
-  catalogDir: string,
-  payload: CatalogPayload,
-): string {
-  mkdirSync(catalogDir, { recursive: true });
-  const filePath = catalogFilePath(catalogDir, payload.provider);
-  writeFileSync(filePath, JSON.stringify(payload, null, 2) + "\n", "utf8");
-  return filePath;
-}