feat: lean foundry profile defaults and concise env guidance

[anand-testcompare]

Summary

This PR delivers a lean v1 implementation for:

• Foundry defaults: hard-signature profiles and unified default policy #22
• Improve missing env guidance while keeping local docs tools available #27

Commit 1 (feat: simplify foundry profile detection and tool policy defaults)

• Replaced heuristic scoring with hard-signature-only profile detection.
• Collapsed fallback behavior to a single default profile.
• Removed all/unknown profile IDs from active profile resolution.
• Switched tool policy to default-enable with explicit deny rules.
• Separated policy behavior between foundry-librarian and foundry.
• Set foundry agent default mode to all when mode is unset (while preserving explicit user modes).
• Added focused regression tests for profile detection and policy behavior.
• Added inventory artifacts with normalized CSV line endings.

Commit 2 (feat: add concise foundry env guidance without prompt bloat)

• Added concise, actionable missing-env guidance for setup/rescan command paths.
• Kept local docs tool availability explicit in guidance text.
• Added low-noise env status hints to command descriptions.
• Added test coverage for missing-env guidance behavior.

Design Notes

• Detection complexity stays intentionally minimal: hard signatures only.
• Context control is done via role separation (librarian vs normal foundry), not via broad detection heuristics.
• Prompt surface remains lean; guidance is surfaced via command output/description instead of prompt bloat.

Validation

• bun test (pass: 71, skip: 1, fail: 0)
• mise run lint (pass)

Closes #22
Closes #27

Summary by CodeRabbit

• New Features

  • Clearer environment-variable guidance for Foundry setup; agent defaults now reflect per-role modes (subagent/all)
  • Policy-driven tool allowlisting to determine which tools are available per profile

• Tests

  • Added and expanded tests covering allowlists, env-var guidance, agent modes, setup/rescan flows, and repo scanning

• Refactor

  • Repo scanning now uses signature-based profile detection with a default profile fallback

[coderabbitai]

Walkthrough

Implements hard-signature repo profiling with a single default fallback, replaces heuristic tool heuristics with policy-driven allowlists (explicit deny rules), adds Foundry env-var detection and concise guidance, and introduces agent.mode defaults ('all' for foundry, 'subagent' otherwise). Tests updated accordingly.

Changes

Cohort / File(s)	Summary
Profile detection & repo scan src/palantir-mcp/repo-scan.ts, src/palantir-mcp/types.ts, src/__tests__/repoScan.test.ts	Replaced scoring-based classification with hard-signature matching; removed scores from RepoScanResult; replaced all/unknown with default profile; added tests for signature cases and default fallback.
Policy-driven tool allowlist src/palantir-mcp/allowlist.ts, src/__tests__/allowlist.test.ts	Introduced ProfilePolicy and deny patterns (LIBRARIAN_MUTATION_DENY, FOUNDRY_DISCOVERY_DENY); removed isMutating/isReadOnly heuristics; computeAllowedTools now applies per-profile deny rules.
Env handling & command UX src/index.ts, src/palantir-mcp/commands.ts, src/palantir-mcp/mcp-client.ts, src/docs/fetch.ts	Centralized trimmed env helpers (getTrimmedEnvVar), added formatted missing-env guidance, threaded missing-foundry detection into command descriptions and error messages, and attached error causes in a few catch paths.
Agent defaults & config validation src/palantir-mcp/opencode-config.ts, src/palantir-mcp/opencode-config.ts	Validate/set agent.mode to a computed default (foundry -> all, others -> subagent) when not explicitly valid.
Config & bootstrap tests src/__tests__/autoBootstrap.test.ts, src/__tests__/configHook.test.ts, src/__tests__/palantirMcpRescan.test.ts, src/__tests__/palantirMcpSetup.test.ts	Added/updated tests asserting agent.mode values and concise missing-env guidance; adjusted expectations for palantir-mcp tool toggles and that listPalantirMcpTools is not called when token missing.
Allowlist/commands integration src/palantir-mcp/commands.ts, src/palantir-mcp/allowlist.ts	Simplified resolveProfile to return ProfileId; updated call sites to use new policy-driven allowlist and env-aware checks.
Build/test deps & misc package.json, src/fetch.ts	Dependency bumps (peer/dev/deps) and minor error cause addition when parsing metadata.

Possibly related PRs

• feat: add Foundry sub-agents and palantir-mcp tool gating setup #8 — Modifies palantir-mcp tool gating and touches the same allowlist/computeAllowedTools logic.
• feat: one-liner install registers commands/agents + auto-bootstrap #20 — Refactors auto-bootstrap and tool-gating logic that depends on allowlist computation and profile defaults.

Poem

🐰 I hopped through code with glee and cheer,
Hard-signatures now lead the year.
Policies tidy, denials lean,
Env hints clear and quietly seen.
Modes set kindly — subagent or all — hooray! 🥕

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The PR title 'Lean Foundry profile defaults + concise env guidance' directly and concisely summarizes the main changes: lean/simplified profile defaults and environment guidance improvements.
Linked Issues check	✅ Passed	All key objectives from issues #22 and #27 are met: hard-signature-only profile detection implemented (#22), 'all'/'unknown' removed with 'default' fallback, default-enable policy with explicit deny rules, agent.foundry.mode set to 'all' when unset, missing env detection with concise guidance (#27), and local docs tools remain available.
Out of Scope Changes check	✅ Passed	Changes are tightly scoped to linked issues: profile detection, tool policy, agent defaults, and env guidance. Dependency upgrades in package.json are necessary supporting changes, not out-of-scope.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch feat/lean-foundry-profiles-env-guidance

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

src/palantir-mcp/mcp-client.ts (1)

192-199: Consider removing [ERROR] prefix from the error message.

The coding guidelines specify using [ERROR] prefix when logging errors, not within error message strings. Embedding it in the thrown error can cause redundant prefixes when the error is later caught and logged (e.g., [ERROR] [ERROR] Failed to...). The error chaining via cause is a good improvement.

Suggested fix

   } catch (err) {
     const stderrText: string = stderrChunks.join('');
     throw new Error(
-      `[ERROR] Failed to list palantir-mcp tools: ${formatError(err)}\n${stderrText}`,
+      `Failed to list palantir-mcp tools: ${formatError(err)}\n${stderrText}`,
       {
         cause: err,
       }
     );
   } finally {

As per coding guidelines: "Log errors with [ERROR] prefix for consistency" — this applies to log statements, not error message content.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/palantir-mcp/mcp-client.ts` around lines 192 - 199, The thrown Error in
the catch block of the function that lists palantir-mcp tools contains a
redundant "[ERROR]" prefix; remove the "[ERROR]" prefix from the Error message
(leave the rest: `Failed to list palantir-mcp tools:
${formatError(err)}\n${stderrText}`) and keep the `cause: err` chaining; ensure
any logging of this error (e.g., calls to processLogger.error or similar) is
responsible for adding the "[ERROR]" prefix instead of embedding it in the
thrown message.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@package.json`:
- Around line 31-33: The package.json peerDependencies entry for
"@opencode-ai/plugin" is pointing to a non-existent version ^1.2.6; update the
peerDependencies block to reference the correct published version (e.g.,
"^1.1.53") or the intended released version, ensuring the key "peerDependencies"
and the package name "@opencode-ai/plugin" are updated accordingly so consumers
can install without errors.

---

Nitpick comments:
In `@src/palantir-mcp/mcp-client.ts`:
- Around line 192-199: The thrown Error in the catch block of the function that
lists palantir-mcp tools contains a redundant "[ERROR]" prefix; remove the
"[ERROR]" prefix from the Error message (leave the rest: `Failed to list
palantir-mcp tools: ${formatError(err)}\n${stderrText}`) and keep the `cause:
err` chaining; ensure any logging of this error (e.g., calls to
processLogger.error or similar) is responsible for adding the "[ERROR]" prefix
instead of embedding it in the thrown message.