@polymorphism-tech/morph-spec 4.20.0 → 4.21.0

package/README.md

@@ -3,7 +3,7 @@
 > Spec-driven development framework for multi-stack projects. Turns feature requests into implementation-ready code through structured, AI-orchestrated phases.
 
 **Package:** `@polymorphism-tech/morph-spec`
-**Version:** 4.20.0  
+**Version:** 4.21.0  
 **Requires:** Node.js 18+, Claude Code
 
 ---
@@ -364,4 +364,4 @@ Code generated by morph-spec (contracts, templates, implementation output) belon
 
 ---
 
-*morph-spec v4.20.0 by [Polymorphism Tech](https://polymorphism.tech)*
+*morph-spec v4.21.0 by [Polymorphism Tech](https://polymorphism.tech)*

package/claude-plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "morph-spec",
-  "version": "4.20.0",
+  "version": "4.21.0",
   "displayName": "MORPH-SPEC Framework",
   "description": "Spec-driven development with 38 agents and 8-phase workflow for .NET/Blazor/Next.js/Azure",
   "publisher": "polymorphism-tech",

package/docs/CHEATSHEET.md

@@ -196,4 +196,4 @@ These files are never edited directly. Use CLI commands or `morph-spec update` i
 
 ---
 
-*morph-spec v4.20.0 by Polymorphism Tech*
+*morph-spec v4.21.0 by Polymorphism Tech*

package/docs/QUICKSTART.md

@@ -197,4 +197,4 @@ morph-spec doctor
 
 ---
 
-*morph-spec v4.20.0 by Polymorphism Tech*
+*morph-spec v4.21.0 by Polymorphism Tech*

package/framework/skills/level-0-meta/mcp-registry.json

@@ -164,20 +164,33 @@
         "testCall": "Call list_projects to verify connectivity",
         "testParams": {},
         "successIndicator": "Returns a list of projects (possibly empty) without auth errors",
-        "failureHint": "Stitch MCP not responding. Ensure @_davideast/stitch-mcp is installed or configure official MCP: claude mcp add stitch --transport http https://stitch.googleapis.com/mcp"
+        "failureHint": "Stitch MCP not responding. Verify gcloud auth: run 'gcloud auth application-default print-access-token'. Check .claude/stitch-proxy.cjs exists and GCP project ID is correct."
       },
       "install": {
-        "autoInstall": true,
+        "autoInstall": false,
         "transport": "stdio",
         "config": {
-          "command": "cmd",
-          "args": ["/c", "npx", "-y", "@_davideast/stitch-mcp@latest", "proxy"]
+          "command": "node",
+          "args": [".claude/stitch-proxy.cjs"]
         },
-        "credentials": [],
-        "prerequisites": [],
+        "credentials": [
+          {
+            "name": "GCP Project ID",
+            "envVar": "STITCH_GCP_PROJECT",
+            "secret": false,
+            "helpUrl": "https://console.cloud.google.com/projectselector2/home/dashboard"
+          }
+        ],
+        "prerequisites": [
+          {
+            "name": "gcloud CLI",
+            "checkCommand": "gcloud --version",
+            "installUrl": "https://cloud.google.com/sdk/docs/install"
+          }
+        ],
         "stackRelevance": ["nextjs", "nextjs-neon", "vite"],
-        "warnings": ["Community MCP tool. Official alternative: claude mcp add stitch --transport http https://stitch.googleapis.com/mcp (requires gcloud auth)"],
-        "setupGuide": "Auto-installed via npx. For official Google MCP: claude mcp add stitch --transport http https://stitch.googleapis.com/mcp"
+        "warnings": ["Requires gcloud CLI with application-default credentials. Run 'gcloud auth application-default login' before setup.", "Add .claude/stitch-proxy.cjs to .gitignore (contains your GCP project ID)."],
+        "setupGuide": "Run: morph-spec mcp setup stitch (generates OAuth proxy script)"
       },
       "companionSkills": {
         "repo": "google-labs-code/stitch-skills",

package/framework/skills/level-0-meta/morph-frontend-review/SKILL.md

@@ -10,7 +10,7 @@ allowed-tools: Read, Write, Edit, Bash, Glob, Grep, AskUserQuestion,
   mcp__playwright__browser_navigate, mcp__playwright__browser_resize,
   mcp__playwright__browser_take_screenshot, mcp__playwright__browser_snapshot,
   mcp__playwright__browser_evaluate, mcp__playwright__browser_console_messages
-cliVersion: "4.20.0"
+cliVersion: "4.21.0"
 stacks:
   - nextjs
 ---

package/framework/skills/level-1-workflows/morph-phase-codebase-analysis/SKILL.md

@@ -3,7 +3,7 @@ name: morph-phase-codebase-analysis
 description: MORPH-SPEC Design sub-phase that analyzes existing codebase and database schema, producing schema-analysis.md with real column names, types, relationships, and field mismatches. Use at the start of Design phase before generating contracts.cs to prevent incorrect field names or types.
 user-invocable: false
 allowed-tools: Read, Write, Edit, Bash, Glob, Grep, AskUserQuestion
-cliVersion: "4.20.0"
+cliVersion: "4.21.0"
 ---
 
 # MORPH Codebase Analysis - Design Sub-phase

package/framework/skills/level-1-workflows/morph-phase-design/SKILL.md

@@ -4,7 +4,7 @@ description: MORPH-SPEC Phase 2 (Design). Schema-first interactive design: reads
 argument-hint: "[feature-name]"
 user-invocable: false
 allowed-tools: Read, Write, Edit, Bash, Glob, Grep, AskUserQuestion, Agent
-cliVersion: "4.20.0"
+cliVersion: "4.21.0"
 ---
 
 # MORPH Design — Phase 2

package/framework/skills/level-1-workflows/morph-phase-implement/SKILL.md

@@ -5,7 +5,7 @@ argument-hint: "[feature-name]"
 context: fork
 agent: general-purpose
 user-invocable: false
-cliVersion: "4.20.0"
+cliVersion: "4.21.0"
 allowed-tools: Read, Write, Edit, Bash, Glob, Grep, AskUserQuestion, Agent
 ---
 

package/framework/skills/level-1-workflows/morph-phase-plan/SKILL.md

@@ -4,7 +4,7 @@ description: MORPH-SPEC Phase 3 (Plan). Generates a detailed implementation plan
 argument-hint: "[feature-name]"
 user-invocable: false
 allowed-tools: Read, Write, Edit, Bash, Glob, Grep, AskUserQuestion
-cliVersion: "4.20.0"
+cliVersion: "4.21.0"
 ---
 
 # MORPH Plan — Phase 3

package/framework/skills/level-1-workflows/morph-phase-tasks/SKILL.md

@@ -4,7 +4,7 @@ description: MORPH-SPEC Phase 4 (Tasks). Breaks approved spec into bottom-up ord
 argument-hint: "[feature-name]"
 user-invocable: false
 allowed-tools: Read, Write, Edit, Bash, Glob, Grep, AskUserQuestion
-cliVersion: "4.20.0"
+cliVersion: "4.21.0"
 ---
 
 # MORPH Tasks — Phase 4

package/framework/skills/level-1-workflows/morph-phase-uiux/SKILL.md

@@ -4,7 +4,7 @@ description: MORPH-SPEC Phase 2 (UI/UX). Creates design-system.md, mockups.md, c
 argument-hint: "[feature-name]"
 user-invocable: false
 allowed-tools: Read, Write, Edit, Bash, Glob, Grep, AskUserQuestion
-cliVersion: "4.20.0"
+cliVersion: "4.21.0"
 ---
 
 # MORPH UI/UX Design - Phase 2

package/framework/skills/level-1-workflows/morph-scope-escalation/SKILL.md

@@ -4,7 +4,7 @@ description: Guided workflow for mid-implementation scope escalation — analyze
 user-invocable: true
 argument-hint: "[feature-name]"
 allowed-tools: Read, Write, Edit, Bash, Glob, Grep, AskUserQuestion
-cliVersion: "4.20.0"
+cliVersion: "4.21.0"
 ---
 
 # Scope Escalation Workflow

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@polymorphism-tech/morph-spec",
-  "version": "4.20.0",
+  "version": "4.21.0",
   "description": "MORPH-SPEC: AI-First development framework with validation pipeline and multi-stack support",
   "keywords": [
     "claude-code",

package/src/commands/mcp/mcp-setup.js

@@ -13,6 +13,8 @@
 import chalk from 'chalk';
 import inquirer from 'inquirer';
 import ora from 'ora';
+import { readFileSync, existsSync } from 'fs';
+import { join } from 'path';
 import {
   orchestrateMcpSetup,
   installAutoMcps,
@@ -21,15 +23,34 @@ import {
   generateSetupInstructions,
   formatMcpStatusTable,
   loadMcpRegistry,
-  isRemoteMcp
+  isRemoteMcp,
+  generateStitchProxy,
+  patchConfigForPlatform
 } from '../../lib/installers/mcp-installer.js';
 import { detectClaudeConfig } from '../../lib/detectors/claude-config-detector.js';
 import { detectProject } from '../../lib/detectors/index.js';
+import { installMcpServers } from '../../utils/claude-settings-manager.js';
 
 /**
- * Detect the current project's stack
+ * Detect the current project's stack.
+ * Prefers .morph/config/config.json (set during morph-spec init) over filesystem re-detection.
  */
 async function detectStack(targetPath) {
+  // 1. Prefer the authoritative config (handles compound stacks like nextjs+dotnet)
+  try {
+    const configPath = join(targetPath, '.morph', 'config', 'config.json');
+    if (existsSync(configPath)) {
+      const config = JSON.parse(readFileSync(configPath, 'utf-8'));
+      const configStack = config.project?.stack;
+      if (configStack && configStack !== 'unknown') {
+        return configStack;
+      }
+    }
+  } catch {
+    // Fall through to filesystem detection
+  }
+
+  // 2. Fallback: detect from filesystem
   try {
     const results = await detectProject(targetPath, { conversation: false, generateStandards: false });
     return results.structure?.stack || 'unknown';
@@ -186,6 +207,60 @@ async function setupSpecificMcp(targetPath, name, stack, existingMcps) {
 
   const credentials = mcpEntry.install.credentials || [];
 
+  // Stitch MCP — custom OAuth proxy setup
+  if (name === 'stitch' && !mcpEntry.install.autoInstall) {
+    console.log(chalk.cyan(`\n  Setting up Stitch MCP (OAuth proxy)\n`));
+    console.log(chalk.gray(`  Usage: ${mcpEntry.usage}`));
+    console.log('');
+
+    const gcpCred = credentials.find(c => c.envVar === 'STITCH_GCP_PROJECT');
+    const { gcpProject } = await inquirer.prompt([{
+      type: 'input',
+      name: 'gcpProject',
+      message: gcpCred ? `${gcpCred.name}:` : 'GCP Project ID:',
+    }]);
+
+    if (!gcpProject || !gcpProject.trim()) {
+      console.log(chalk.red('  GCP Project ID is required.'));
+      console.log('');
+      return;
+    }
+
+    const spinner = ora('Generating Stitch proxy...').start();
+    const { proxyPath } = generateStitchProxy(targetPath, gcpProject.trim());
+    spinner.succeed(`Proxy script generated: ${proxyPath}`);
+
+    const config = { ...mcpEntry.install.config };
+    const result = await installMcpServers(targetPath, { stitch: patchConfigForPlatform(config) });
+    if (result.added.length > 0) {
+      console.log(chalk.green(`  ✓ Stitch MCP configured (using OAuth proxy)`));
+    } else {
+      console.log(chalk.yellow(`  ⚠ Stitch MCP already configured`));
+    }
+
+    if (mcpEntry.companionSkills?.installCommand) {
+      const { installSkills } = await inquirer.prompt([{
+        type: 'confirm',
+        name: 'installSkills',
+        message: 'Install Stitch companion skills (design, loop, etc.)?',
+        default: true
+      }]);
+      if (installSkills) {
+        const skillResults = installCompanionSkills({ stitch: mcpEntry });
+        for (const r of skillResults) {
+          if (r.success) {
+            console.log(chalk.green(`  ✓ Companion skills installed: ${r.repo}`));
+          } else {
+            console.log(chalk.yellow(`  ⚠ Failed to install companion skills: ${r.repo}`));
+          }
+        }
+      }
+    }
+
+    console.log('');
+    return;
+  }
+
   // Auto-installable — just install
   if (mcpEntry.install.autoInstall) {
     const spinner = ora(`Installing ${name}...`).start();
@@ -349,6 +424,28 @@ async function interactiveWizard(targetPath, stack, existingMcps) {
       }]);
 
       if (setupNow) {
+        // Stitch — custom OAuth proxy flow
+        if (name === 'stitch' && !entry.install.autoInstall) {
+          const gcpCred = entry.install.credentials?.find(c => c.envVar === 'STITCH_GCP_PROJECT');
+          const { gcpProject } = await inquirer.prompt([{
+            type: 'input',
+            name: 'gcpProject',
+            message: gcpCred ? `${gcpCred.name}:` : 'GCP Project ID:',
+          }]);
+          if (gcpProject?.trim()) {
+            const { proxyPath } = generateStitchProxy(targetPath, gcpProject.trim());
+            console.log(chalk.green(`  ✓ Proxy generated: ${proxyPath}`));
+            const config = { ...entry.install.config };
+            await installMcpServers(targetPath, { stitch: patchConfigForPlatform(config) });
+            console.log(chalk.green(`  ✓ Stitch configured (OAuth proxy)`));
+            const skillResults = installCompanionSkills({ stitch: entry });
+            for (const r of skillResults) {
+              if (r.success) console.log(chalk.green(`  ✓ Companion skills: ${r.repo}`));
+            }
+          }
+          continue;
+        }
+
         // Remote MCPs — launch OAuth via claude mcp add
         if (isRemoteMcp(entry.install.config)) {
           console.log(chalk.cyan(`  Launching ${capitalizedName} OAuth...`));

package/src/lib/detectors/index.js

@@ -30,7 +30,7 @@ export function detectProject(targetPath, opts = {}) {
   try {
     // ── Package.json analysis ──────────────────────────────────────────────
     // Collect deps from root and common monorepo subfolders
-    const pkgLocations = ['.', 'src/frontend', 'frontend', 'apps/web', 'packages/app'];
+    const pkgLocations = ['.', 'src/frontend', 'src/web', 'frontend', 'apps/web', 'packages/app'];
     const allDeps = {};
     let rootPkg = null;
     let scripts = [];

package/src/lib/installers/mcp-installer.js

@@ -7,7 +7,7 @@
  */
 
 import { join } from 'path';
-import { readFileSync, existsSync } from 'fs';
+import { readFileSync, existsSync, writeFileSync, mkdirSync } from 'fs';
 import { execSync } from 'child_process';
 import { installMcpServers } from '../../utils/claude-settings-manager.js';
 
@@ -173,6 +173,145 @@ export function installCompanionSkills(mcpsInstalled, exec = execSync) {
   return results;
 }
 
+/**
+ * Generate the Stitch OAuth proxy template script.
+ * @param {string} gcpProject - GCP project ID for x-goog-user-project header
+ * @returns {string} CJS proxy script content
+ */
+export function getStitchProxyTemplate(gcpProject) {
+  return `/**
+ * Stitch MCP OAuth Proxy
+ * Generated by morph-spec mcp setup stitch
+ *
+ * Bridges stdio JSON-RPC to https://stitch.googleapis.com/mcp
+ * using gcloud application-default credentials (OAuth2 bearer token).
+ */
+const { execSync } = require('child_process');
+const https = require('https');
+
+const GCP_PROJECT = '${gcpProject}';
+const STITCH_HOST = 'stitch.googleapis.com';
+const STITCH_PATH = '/mcp';
+const TOKEN_TTL_MS = 50 * 60 * 1000; // 50 minutes
+
+let cachedToken = null;
+let tokenExpiresAt = 0;
+
+function getAccessToken() {
+  if (cachedToken && Date.now() < tokenExpiresAt) return cachedToken;
+  try {
+    cachedToken = execSync('gcloud auth application-default print-access-token', {
+      encoding: 'utf-8',
+      timeout: 10000,
+      stdio: ['pipe', 'pipe', 'pipe']
+    }).trim();
+    tokenExpiresAt = Date.now() + TOKEN_TTL_MS;
+    return cachedToken;
+  } catch (err) {
+    process.stderr.write('[stitch-proxy] Failed to get access token. Run: gcloud auth application-default login\\n');
+    throw err;
+  }
+}
+
+function clearTokenCache() {
+  cachedToken = null;
+  tokenExpiresAt = 0;
+}
+
+function sendRequest(body) {
+  return new Promise((resolve, reject) => {
+    const token = getAccessToken();
+    const data = JSON.stringify(body);
+    const options = {
+      hostname: STITCH_HOST,
+      path: STITCH_PATH,
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'Content-Length': Buffer.byteLength(data),
+        'Authorization': \`Bearer \${token}\`,
+        'x-goog-user-project': GCP_PROJECT,
+      },
+    };
+
+    const req = https.request(options, (res) => {
+      let responseData = '';
+      res.on('data', (chunk) => { responseData += chunk; });
+      res.on('end', () => {
+        if (res.statusCode === 401) {
+          // Token expired — retry once with fresh token
+          clearTokenCache();
+          const retryToken = getAccessToken();
+          options.headers['Authorization'] = \`Bearer \${retryToken}\`;
+          const retryData = JSON.stringify(body);
+          options.headers['Content-Length'] = Buffer.byteLength(retryData);
+          const retryReq = https.request(options, (retryRes) => {
+            let retryResponse = '';
+            retryRes.on('data', (chunk) => { retryResponse += chunk; });
+            retryRes.on('end', () => resolve(retryResponse));
+          });
+          retryReq.on('error', reject);
+          retryReq.write(retryData);
+          retryReq.end();
+        } else {
+          resolve(responseData);
+        }
+      });
+    });
+
+    req.on('error', reject);
+    req.write(data);
+    req.end();
+  });
+}
+
+// Buffer stdin and split on newlines (JSON-RPC messages)
+let buffer = '';
+process.stdin.setEncoding('utf-8');
+process.stdin.on('data', async (chunk) => {
+  buffer += chunk;
+  const lines = buffer.split('\\n');
+  buffer = lines.pop(); // keep incomplete line in buffer
+
+  for (const line of lines) {
+    if (!line.trim()) continue;
+    try {
+      const request = JSON.parse(line);
+      const response = await sendRequest(request);
+      process.stdout.write(response + '\\n');
+    } catch (err) {
+      const errorResponse = JSON.stringify({
+        jsonrpc: '2.0',
+        id: null,
+        error: { code: -32603, message: err.message || 'Proxy error' }
+      });
+      process.stdout.write(errorResponse + '\\n');
+    }
+  }
+});
+
+process.stderr.write(\`[stitch-proxy] Ready — GCP project: \${GCP_PROJECT}\\n\`);
+`;
+}
+
+/**
+ * Generate and write the Stitch OAuth proxy script to the target project.
+ * @param {string} targetPath - Project root directory
+ * @param {string} gcpProject - GCP project ID
+ * @returns {{ proxyPath: string }} Path to the generated proxy script
+ */
+export function generateStitchProxy(targetPath, gcpProject) {
+  const claudeDir = join(targetPath, '.claude');
+  if (!existsSync(claudeDir)) {
+    mkdirSync(claudeDir, { recursive: true });
+  }
+
+  const proxyPath = join(claudeDir, 'stitch-proxy.cjs');
+  writeFileSync(proxyPath, getStitchProxyTemplate(gcpProject), 'utf-8');
+
+  return { proxyPath };
+}
+
 /**
  * Install a single MCP with provided credentials
  * @param {string} targetPath - Project root directory