@cubis/foundry - npm Package Compare versions

Comparing version 0.3.25 to 0.3.26

CHANGELOG.md

@@ -5,2 +5,9 @@ # Changelog
 
+## [0.3.26] - 2026-02-26
+
+### Fixed
+
+- Fixed MCP install merge behavior for existing JSONC config files (comments/trailing commas), so existing MCP entries are preserved instead of being reset.
+- Fixed Postman MCP patching to parse and merge JSONC for platform config targets (for example `.vscode/mcp.json`).
+
 ## [0.3.25] - 2026-02-26
@@ -7,0 +14,0 @@

package.json

 {
   "name": "@cubis/foundry",
-  "version": "0.3.25",
+  "version": "0.3.26",
   "description": "Cubis Foundry CLI for workflow-first AI agent environments",
@@ -49,4 +49,5 @@ "type": "module",
     "@inquirer/prompts": "^7.8.6",
-    "commander": "^14.0.1"
+    "commander": "^14.0.1",
+    "jsonc-parser": "^3.3.1"
   }
 }

README.md

@@ -8,2 +8,3 @@ # Cubis Foundry CLI (`cbx`)
 Primary support in this release:
+
 - Antigravity
@@ -26,2 +27,3 @@ - Codex
 Compatibility binaries are still shipped for migration:
+
 - `cubiskill`
@@ -41,7 +43,7 @@ - `cubis`
 # 3) Install workflow bundle for your platform
-cbx workflows install --platform codex --bundle agent-environment-setup --postman --yes
+cbx workflows install --platform codex --bundle agent-environment-setup --postman
 
 # 4) Optional: install for other platforms too
-cbx workflows install --platform antigravity --bundle agent-environment-setup --postman --yes
-cbx workflows install --platform copilot --bundle agent-environment-setup --postman --yes
+cbx workflows install --platform antigravity --bundle agent-environment-setup --postman
+cbx workflows install --platform copilot --bundle agent-environment-setup --postman
 ```
@@ -75,2 +77,3 @@
 Install bootstrap behavior:
+
 - `cbx workflows install` now also bootstraps `ENGINEERING_RULES.md` and `TECH.md` (creates when missing; keeps existing files unless explicitly regenerated).
@@ -86,2 +89,3 @@ - When install scope is `global` (default), skills/powers install to global paths, while workflows + agents stay in workspace (`project`) paths.
 Postman + Antigravity Stitch setup behavior:
+
 - `cbx_config.json` is generated in workspace root (project MCP scope) or `~/.cbx/cbx_config.json` (global MCP scope).
@@ -123,2 +127,3 @@ - Managed MCP definition files are generated under `.cbx/mcp/<platform>/postman.json` (workspace scope) or `~/.cbx/mcp/<platform>/postman.json` (global scope).
 Important:
+
 - If `cbx_config.json` already exists and you want to change the saved workspace, use `--overwrite` (or edit config manually), because existing config is preserved by default.
@@ -144,2 +149,3 @@ - If install output shows `Config file: skipped (...)`, your newly selected workspace is not persisted. Use `--overwrite` or edit with the config command below.
 Platform runtime MCP placement:
+
 - Codex:
@@ -156,2 +162,3 @@ - Global MCP scope: `~/.codex/config.toml` via `codex mcp add`.
 API key docs:
+
 - Google Stitch MCP setup docs: [stitch.withgoogle.com/docs/mcp/setup](https://stitch.withgoogle.com/docs/mcp/setup)
@@ -175,2 +182,3 @@ - Google Stitch settings (create API key): [stitch.withgoogle.com/settings](https://stitch.withgoogle.com/settings)
 What `cbx rules init` does:
+
 - Creates `ENGINEERING_RULES.md` next to the active platform rule file.
@@ -182,2 +190,3 @@ - Appends/patches one managed engineering block in that rule file.
 `TECH.md` scanner coverage (deterministic, no AI calls):
+
 - Language/file signals from workspace scan.
@@ -203,2 +212,3 @@ - JS/TS package signals from `package.json` (including nested/monorepo package files).
 First bundled profile:
+
 - `agent-environment-setup`
@@ -213,2 +223,3 @@
 Bundle contains platform-specific:
+
 - workflow templates (`workflows/*.md`)
@@ -223,2 +234,3 @@ - specialist agent templates (`agents/*.md`)
 Database capability stack:
+
 - `database-skills` (engine hub)
@@ -229,4 +241,4 @@ - `database-design` (schema/migration design)
 
+Core workflows:
 
-Core workflows:
 - `/brainstorm`
@@ -246,2 +258,3 @@ - `/plan`
 Routing behavior:
+
 - Antigravity/Copilot: workflow + agent markdown can be routed by platform conventions.
@@ -258,2 +271,3 @@ - Codex: use generated callable wrapper skills (`$workflow-*`, `$agent-*`).
 `cbx` handles this by generating callable Codex skills:
+
 - Workflow wrappers: `$workflow-<name>` (for example `$workflow-review`, `$workflow-plan`)
@@ -270,2 +284,3 @@ - Agent wrappers: `$agent-<name>` (for example `$agent-backend-specialist`)
 Project scope:
+
 - Workflows: `.agent/workflows`
@@ -278,2 +293,3 @@ - Agents: `.agent/agents`
 Global scope:
+
 - Skills: `~/.gemini/antigravity/skills`
@@ -286,2 +302,3 @@ - Rules: `~/.gemini/GEMINI.md`
 Install-time options:
+
 - `--terminal-integration`
@@ -291,2 +308,3 @@ - `--terminal-verifier <codex|gemini>`
 Behavior:
+
 - Interactive installs prompt whether to enable terminal verification integration.
@@ -300,2 +318,3 @@ - If enabled, cbx writes managed scripts/config under `.agent/terminal-integration`.
 Project scope:
+
 - Workflow templates (reference docs): `.agents/workflows`
@@ -311,2 +330,3 @@ - Skills: `.agents/skills`
 Global scope:
+
 - Skills: `~/.agents/skills`
@@ -318,2 +338,3 @@ - Rules: `~/.codex/AGENTS.md`
 Legacy compatibility note:
+
 - `.codex/skills` is treated as legacy and flagged by `doctor` with migration guidance.
@@ -324,2 +345,3 @@
 Project scope:
+
 - Workflows: `.github/copilot/workflows`
@@ -332,2 +354,3 @@ - Agents: `.github/agents`
 Global scope:
+
 - Skills: `~/.copilot/skills`
@@ -345,3 +368,5 @@ - Rules: `~/.copilot/copilot-instructions.md`
 <!-- cbx:workflows:auto:start platform=<platform-id> version=1 -->
+
 ...
+
 <!-- cbx:workflows:auto:end -->
@@ -351,2 +376,3 @@ ```
 Behavior:
+
 - Preserves user content outside markers.
@@ -361,2 +387,3 @@ - Replaces first valid managed block in place.
 Default scope:
+
 - Install/init commands:
@@ -374,2 +401,3 @@ - `cbx workflows install`
 Optional:
+
 - `--scope global`
@@ -379,2 +407,3 @@ - `--scope project`
 Platform auto-detection:
+
 - Uses repo markers for Antigravity/Codex/Copilot.
@@ -385,2 +414,3 @@ - Prompts when ambiguous.
 State files:
+
 - Project: `.cbx/workflows-state.json`
@@ -401,2 +431,3 @@ - Global: `~/.cbx/state.json`
 Dry-run behavior:
+
 - prints planned file changes
@@ -441,2 +472,3 @@ - prints planned managed-block action (`would-create`/`would-patch`)
 `cbx workflows doctor` validates:
+
 - workflow/agent/skill path existence
@@ -443,0 +475,0 @@ - active rule file status

New alerts

Network access

Supply chain risk

This module accesses the network.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

Fixed alerts

Network access

Supply chain risk

This module accesses the network.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

21063827

0.01%

Lines of code

38113

0.09%

Number of lines in readme file

510

6.69%

Worsened metrics

Dependency count

3

50%

Dependency changes

• + Added

  jsonc-parser@^3.3.1

• + Added

  jsonc-parser@3.3.1
  (transitive)