
Security News
minimatch Patches 3 High-Severity ReDoS Vulnerabilities
minimatch patched three high-severity ReDoS vulnerabilities that can stall the Node.js event loop, and Socket has released free certified patches.
@cubis/foundry
Advanced tools
cbx)Workflow-first installer for AI agent environments, with Codex callable-skill wrappers.
Repository layout note: reusable workflow/skill/power assets are stored under Ai Agent Workflow/.
Primary support in this release:
CHANGELOG.md.npm install -g @cubis/foundry
cbx --help
Compatibility binaries are still shipped for migration:
cubiskillcubis# 1) Install CLI
npm install -g @cubis/foundry
# 2) Set API keys once (recommended: env mode)
export POSTMAN_API_KEY="<your-postman-api-key>"
export STITCH_API_KEY="<your-stitch-api-key>" # Antigravity StitchMCP only
# 3) Install workflow bundle for your platform
cbx workflows install --platform codex --bundle agent-environment-setup --postman --yes
# 4) Optional: install for other platforms too
cbx workflows install --platform antigravity --bundle agent-environment-setup --postman --yes
cbx workflows install --platform copilot --bundle agent-environment-setup --postman --yes
workflows is now the primary command group.
cbx workflows install --platform antigravity
cbx workflows install --platform codex
cbx workflows install --platform copilot
cbx workflows remove <bundle-or-workflow> --platform antigravity
cbx workflows sync-rules --platform codex
cbx workflows doctor codex
cbx workflows platforms
cbx workflows install --platform antigravity --dry-run
cbx workflows install --platform antigravity --terminal-integration --terminal-verifier codex
cbx workflows install --platform codex --postman
cbx workflows install --platform codex --postman --postman-workspace-id null
cbx workflows install --platform codex --postman --postman-workspace-id "<workspace-id>"
cbx workflows install --platform codex --postman --postman-api-key "<key>"
cbx workflows install --platform codex --postman --mcp-scope global
cbx workflows install --platform copilot --postman --mcp-scope project
cbx workflows install --platform antigravity --postman
cbx workflows install --platform antigravity --postman --stitch-api-key "<key>"
cbx workflows install --platform copilot --postman
Install bootstrap behavior:
cbx workflows install now also bootstraps ENGINEERING_RULES.md and TECH.md (creates when missing; keeps existing files unless explicitly regenerated).global (default), skills/powers install to global paths, while workflows + agents stay in workspace (project) paths.AGENTS.md/GEMINI.md/Copilot instructions, ENGINEERING_RULES.md, TECH.md) are maintained in workspace (project) scope..agents/workflows so workflow-wrapper routing remains discoverable in project rules.--postman bootstrap creates cbx_config.json, stores managed MCP definitions in .cbx/mcp/, and installs/configures Postman MCP for Codex, Antigravity, and Copilot.--postman also installs a default StitchMCP entry (stitch.googleapis.com/mcp) using key from --stitch-api-key or STITCH_API_KEY.--mcp-scope <project|workspace|global|user> to choose where MCP runtime config is installed (interactive installs prompt for this when not provided).cbx rules init --platform <platform> --overwrite to force-regenerate both files.Postman + Antigravity Stitch setup behavior:
cbx_config.json is generated in workspace root (project MCP scope) or ~/.cbx/cbx_config.json (global MCP scope)..cbx/mcp/<platform>/postman.json (workspace scope) or ~/.cbx/mcp/<platform>/postman.json (global scope).POSTMAN_API_KEY is set, generated settings keep apiKey: null and MCP config uses Bearer ${POSTMAN_API_KEY}.--postman-api-key <key>.--postman-workspace-id null writes JSON null for defaultWorkspaceId.POSTMAN_API_KEY is available and install is interactive (no --yes) without --postman-workspace-id, cbx fetches your Postman workspaces and prompts you to pick one as default..cbx/mcp/antigravity/stitch.json (or ~/.cbx/mcp/antigravity/stitch.json in global MCP scope).--stitch-api-key then STITCH_API_KEY; when unset, generated config keeps placeholder X-Goog-Api-Key: ur stitch key.cbx_config.json and .cbx/mcp/ are auto-added to .gitignore (no duplicate entries).Codex Postman workspace selection:
# Set Postman API key first
export POSTMAN_API_KEY="<your-postman-api-key>"
# Interactive workspace selector (recommended)
cbx workflows install --platform codex --bundle agent-environment-setup --postman
--yes here (it skips prompts).defaultWorkspaceId.Direct/manual workspace ID:
cbx workflows install --platform codex --bundle agent-environment-setup --postman --postman-workspace-id "<workspace-id>" --yes
Clear default workspace:
cbx workflows install --platform codex --bundle agent-environment-setup --postman --postman-workspace-id null --yes
Important:
cbx_config.json already exists and you want to change the saved workspace, use --overwrite (or edit config manually), because existing config is preserved by default.Config file: skipped (...), your newly selected workspace is not persisted. Use --overwrite or edit with the config command below.View/edit config in terminal:
# View config
cbx workflows config --scope global --show
# Interactive edit (workspace ID)
cbx workflows config --scope global --edit
# Direct set workspace ID
cbx workflows config --scope global --workspace-id "<workspace-id>"
# Clear workspace ID
cbx workflows config --scope global --clear-workspace-id
Platform runtime MCP placement:
~/.codex/config.toml via codex mcp add..vscode/mcp.json.~/.gemini/settings.json (mcpServers, includes postman + default StitchMCP)..gemini/settings.json (mcpServers, includes postman + default StitchMCP)..vscode/mcp.json.~/.copilot/mcp-config.json.API key docs:
rules manages strict engineering policy and a generated codebase tech map:
cbx rules init --platform antigravity
cbx rules init --platform codex
cbx rules init --platform copilot
cbx rules init --platform codex --scope global
cbx rules tech-md --overwrite
cbx rules init --platform codex --dry-run
What cbx rules init does:
ENGINEERING_RULES.md next to the active platform rule file.TECH.md at workspace root by scanning the current codebase.TECH.md scanner coverage (deterministic, no AI calls):
package.json (including nested/monorepo package files).pubspec.yaml.go.mod.requirements*.txt and pyproject.toml.Cargo.toml.cbx skills ... still works for one minor cycle and prints a deprecation notice.
Catalog root:
Ai Agent Workflow/workflows/
First bundled profile:
agent-environment-setupBundle manifest:
Ai Agent Workflow/workflows/agent-environment-setup/manifest.json
Bundle contains platform-specific:
workflows/*.md)agents/*.md)Ai Agent Workflow/skills/<id>/rules/*.md)Database capability stack:
database-skills (engine hub)database-design (schema/migration design)database-optimizer (query/index/tuning triage)drift-flutter (Flutter local persistence)Core workflows:
/brainstorm/plan/create/test/debug/implement-track/backend/security/database/mobile/devops/qaRouting behavior:
$workflow-*, $agent-*).$workflow-backend or $agent-backend-specialist.Codex does not currently execute custom workflow slash commands or custom @agent markdown files as first-class runtime entities.
Codex skill invocation syntax is $skill-name (not @agent-name).
cbx handles this by generating callable Codex skills:
$workflow-<name> (for example $workflow-review, $workflow-plan)$agent-<name> (for example $agent-backend-specialist)Use these wrappers directly in Codex prompts.
Do not rely on custom /workflow execution or custom @agent invocation in Codex runtime.
Project scope:
.agent/workflows.agent/agents.agent/skills.agent/rules/GEMINI.md.agent/terminal-integrationGlobal scope:
~/.gemini/antigravity/skills~/.gemini/GEMINI.md.agent/...) paths.Install-time options:
--terminal-integration--terminal-verifier <codex|gemini>Behavior:
.agent/terminal-integration.Project scope:
.agents/workflows.agents/skillsAGENTS.md.agents/skills as:
workflow-<workflow-id>agent-<agent-id>$workflow-plan, $agent-backend-specialistGlobal scope:
~/.agents/skills~/.codex/AGENTS.md.agents/workflowsLegacy compatibility note:
.codex/skills is treated as legacy and flagged by doctor with migration guidance.Project scope:
.github/copilot/workflows.github/agents.github/skillsAGENTS.md (preferred), fallback .github/copilot-instructions.mdcbx normalizes Copilot skill frontmatter by removing unsupported top-level keys like displayName and keywords during install.Global scope:
~/.copilot/skills~/.copilot/copilot-instructions.md.github/...) paths.cbx maintains a single managed block in the active platform rule file.
Markers:
<!-- cbx:workflows:auto:start platform=<platform-id> version=1 -->
...
<!-- cbx:workflows:auto:end -->
Behavior:
Default scope:
cbx workflows installcbx workflows initcbx skills installcbx skills initcbx install (legacy alias)cbx init (legacy alias)global.project.Optional:
--scope global--scope projectPlatform auto-detection:
State files:
.cbx/workflows-state.json~/.cbx/state.jsonPreview mode is supported on install/remove/sync:
cbx workflows install --platform antigravity --bundle agent-environment-setup --dry-run
cbx workflows install --platform antigravity --bundle agent-environment-setup --terminal-integration --terminal-verifier codex --dry-run
cbx workflows remove agent-environment-setup --platform antigravity --dry-run
cbx workflows sync-rules --platform codex --dry-run
Dry-run behavior:
would-create/would-patch)Use this script-style sequence to validate end-to-end behavior:
# 1) Create isolated workspace
TMP_DIR="$(mktemp -d /tmp/cbx-smoke.XXXXXX)"
cd "$TMP_DIR"
# 2) Antigravity preview + apply + doctor
cbx workflows install --platform antigravity --bundle agent-environment-setup --dry-run
cbx workflows install --platform antigravity --bundle agent-environment-setup --terminal-integration --terminal-verifier codex --yes
cbx workflows doctor antigravity --json
# 3) Codex preview + apply + doctor
mkdir -p .codex/skills # optional: simulate legacy path warning
cbx workflows install --platform codex --bundle agent-environment-setup --dry-run
cbx workflows install --platform codex --bundle agent-environment-setup --yes
cbx workflows doctor codex --json
# Codex runtime usage (in prompt): $workflow-review or $agent-backend-specialist
# 4) Copilot preview + apply + doctor
cbx workflows install --platform copilot --bundle agent-environment-setup --dry-run
cbx workflows install --platform copilot --bundle agent-environment-setup --yes
cbx workflows doctor copilot --json
# 5) Remove bundle preview + apply
cbx workflows remove agent-environment-setup --platform antigravity --dry-run
cbx workflows remove agent-environment-setup --platform antigravity --yes
cbx workflows doctor validates:
$workflow-*, $agent-*) through installed skills path.codex/skills).gitignore warning for .agent/ with recommendation to use .git/info/exclude for local-only excludes.github/agents, .github/skills, AGENTS.md / .github/copilot-instructions.md)No automatic Conductor installation is performed.
If Conductor artifacts already exist, workflows may reference them as supporting context.
Run CLI help locally:
node bin/cubis.js --help
Run attribute validation (non-strict):
npm run test:attributes
Run attribute validation (strict, fails on warnings):
npm run test:attributes:strict
Run TECH.md scanner integration tests:
npm run test:tech-md
Run full workflow smoke test:
bash scripts/smoke-workflows.sh
Run the full suite:
npm run test:all
Run the full suite in strict mode:
npm run test:all:strict
FAQs
Cubis Foundry CLI for workflow-first AI agent environments
The npm package @cubis/foundry receives a total of 1,832 weekly downloads. As such, @cubis/foundry popularity was classified as popular.
We found that @cubis/foundry demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
minimatch patched three high-severity ReDoS vulnerabilities that can stall the Node.js event loop, and Socket has released free certified patches.

Research
/Security News
Socket uncovered 26 malicious npm packages tied to North Korea's Contagious Interview campaign, retrieving a live 9-module infostealer and RAT from the adversary's C2.

Research
An impersonated golang.org/x/crypto clone exfiltrates passwords, executes a remote shell stager, and delivers a Rekoobe backdoor on Linux.