@cliangdev/conductor 0.6.1 → 0.8.0

package/assets/claude/commands/conductor/workflow.md

@@ -37,8 +37,10 @@ If ambiguous, ask:
 Run these in parallel before designing anything:
 
 ```
-1. list_integration_tools  → what data sources are connected + their operations
-2. list_workflows          → existing workflows (for naming/area conventions)
+1. list_integration_tools    → what data sources/actions are already connected + their operations
+2. list_workflows            → existing workflows (for naming/area conventions)
+3. list_connector_catalog    → integrations NOT yet connected, for recommending a fit
+4. list_workflow_secrets     → which ${{ secrets.X }} keys already exist (never their values)
 ```
 
 Then ask the user (use AskUserQuestion for structured choices where applicable):
@@ -50,11 +52,21 @@ Then ask the user (use AskUserQuestion for structured choices where applicable):
    - Work Item status change → `on: conductor.work_item.status_changed:`
    - Manual run button → `on: workflow_dispatch:`
 3. **What data or actions does it need?** (use `list_integration_tools` output to suggest connected options)
-4. **Where do results go?** Discord webhook, Slack, create a Conductor issue, HTTP POST, etc.
+4. **Where do results go?** Discord/Slack post, create a Conductor issue, HTTP POST, etc.
 
 If `list_integration_tools` shows relevant connected integrations, name them explicitly:
 > "I can see Google Search Console is connected (operations: search_analytics, top_queries, top_pages). Should I use that as the data source?"
 
+If the goal needs a data source or outbound action that **isn't** connected yet, check
+`list_connector_catalog` and name the specific connector rather than falling back to a raw `http`
+step silently:
+> "Posting to Discord needs the Discord connector — it's not connected yet. Connect it under
+> **Settings → Integrations**, or I can use a raw `http` step with a webhook secret instead."
+
+If the design will reference `${{ secrets.SOME_KEY }}`, confirm it's in the `list_workflow_secrets`
+result before designing around it — don't assume a secret exists because the user mentioned it.
+Secrets are added under **Settings → Secrets**.
+
 ---
 
 ## Step 2 — Design
@@ -92,19 +104,30 @@ steps:
 | Step type | `uses` value | When to use |
 |-----------|-------------|-------------|
 | Integration | `integration` | Connected data source (GSC, PostHog, RevenueCat, GCP Billing) |
+| Action | `action` | Outbound side effect via a connector with the ACTION capability (e.g. `discord post_message`) |
 | HTTP | `http` | Any REST API call; custom integrations |
 | Docker | `docker://image` | Run a script or CLI tool in a container |
+| Agent | `agent` | Hand a task to a named AI agent (Settings → Agents) |
+| Claude Code | `claude-code` | Headless Claude Code (`claude -p`), full tool-calling loop, optional Conductor MCP access |
 | Condition | `condition` | Branch to different jobs based on a runtime value |
 | Kestra | `kestra` | Delegate to an existing Kestra flow |
 
+Prefer `uses: action` over a raw `http` step with a webhook-secret whenever an action connector
+exists for the target — same reasoning as preferring `integration` over `http` for reads:
+credentials stay off the connector, never in the YAML.
+
 ### Reference: Interpolation
 
 | Expression | Value |
 |------------|-------|
 | `${{ event.FIELD }}` | Trigger event payload field |
 | `${{ secrets.SECRET_NAME }}` | Project secret (custom secrets only; integrations don't need this) |
+| `${{ inputs.KEY }}` | A manual-dispatch input value (see `on.workflow_dispatch.inputs`) |
 | `${{ steps.STEP_ID.outputs.KEY }}` | Output from a step in the current job |
+| `${{ steps.STEP_ID.result }}` | Terminal result of a prior step: `success` / `failure` / `skipped` |
 | `${{ needs.JOB_ID.outputs.KEY }}` | Output from a completed upstream job |
+| `${{ needs.JOB_ID.result }}` | Terminal result of an upstream job: `success` / `failure` / `skipped` |
+| `${{ needs.JOB_ID.artifacts.NAME }}` | Signed download URL for an artifact an upstream job produced |
 | `${{ loop.iteration }}` | Current loop iteration (1-based) |
 
 ### Annotated example — Weekly SEO report
@@ -131,14 +154,70 @@ jobs:
     runs-on: conductor
     steps:
       - id: notify
-        uses: http
+        uses: action
         with:
-          method: POST
-          url: ${{ secrets.DISCORD_WEBHOOK_URL }}
-          body: >
-            {"content": "📊 Weekly SEO Report\nTop pages: ${{ needs.fetch_seo.outputs.data }}"}
+          connector: discord
+          action: post_message
+          input:
+            content: "📊 Weekly SEO Report\nTop pages: ${{ needs.fetch_seo.outputs.data }}"
+```
+
+---
+
+## Resilience patterns
+
+These are the skill's key value-add for digest/report-style workflows: don't let one failed
+collector job silently kill the whole report.
+
+**`if: always()` / `if: failure()` on downstream jobs.** A digest job should usually still post even
+if one collector failed — pair with `needs.JOB.result` to mark that section unavailable instead of
+skipping the whole digest:
+
+```yaml
+digest:
+  needs: [collect_gsc, collect_posthog]
+  if: always()
+  steps:
+    - uses: action
+      with:
+        connector: discord
+        action: post_message
+        input:
+          content: "GSC (${{ needs.collect_gsc.result }}): ${{ needs.collect_gsc.outputs.data }}"
+```
+
+**Step-level `continue-on-error`.** Let one optional step fail without failing the job; branch later
+steps on `${{ steps.ID.result }}`:
+
+```yaml
+- id: optional_lint
+  type: http
+  url: https://lint.example.com/check
+  continue-on-error: true
+```
+
+**Dispatch `inputs` for parameterized/backfill runs.** Declare `on.workflow_dispatch.inputs` so a
+manual re-run (e.g. `dispatch_workflow` with `inputs: {date: "2026-06-01"}`) can target a specific
+date/env rather than always running "now":
+
+```yaml
+on:
+  workflow_dispatch:
+    inputs:
+      date: { description: "Backfill date (YYYY-MM-DD)", required: false }
 ```
 
+Reference it as `${{ inputs.date }}` anywhere in the workflow.
+
+## Artifacts
+
+For whole-file handoff between jobs (a build binary, a rendered report, a dataset) — not the small
+string values `outputs:` is for — a `docker` or `claude-code` step declares `artifacts: [{name, path}]`
+and a downstream job declares `consumes: [name]`. Reach for this when a job needs to hand a real file
+to another job rather than a string. Note: `docker` artifact producers require `runs-on: self-hosted`
+(the Conductor-hosted docker path doesn't support artifact upload); `claude-code` supports artifacts
+on any runtime.
+
 ---
 
 ## Step 3 — Creation Loop
@@ -174,9 +253,10 @@ publish_workflow(workflowId)
 
 ### 3d. Test dispatch (optional)
 
-dispatch_workflow(workflowId)
+dispatch_workflow(workflowId, inputs?)
 
-Offer to trigger a test run immediately so the user can see it work. Returns workflowId + runId.
+Offer to trigger a test run immediately so the user can see it work. Pass `inputs` if the workflow
+declares `on.workflow_dispatch.inputs` (e.g. a backfill date) — otherwise omit it. Returns workflowId + runId.
 
 After dispatching, call get_workflow_run once to check the run started:
 
@@ -184,6 +264,9 @@ get_workflow_run(workflowId, runId)
 
 Don't poll — one check is enough since runs are async. Include the status in the final report to the user. A RUNNING or SUCCESS status means the workflow is live and executing.
 
+For a scheduled or event-triggered workflow (no immediate dispatch to check), use
+`list_workflow_runs(workflowId)` later to see whether it has actually fired since going live.
+
 ---
 
 ## Step 4 — Report to User
@@ -267,10 +350,10 @@ publish_workflow(workflowId)                 // DRAFT → PUBLISHED
 These rules apply regardless of the user's request. Never deviate from them.
 
 1. **Always call `list_integration_tools` before designing** — never guess what integrations are available from secret key names or conversation context.
-2. **Use `uses: integration` for any connected integration** — credentials must never appear in workflow YAML.
+2. **Use `uses: integration` for reads and `uses: action` for outbound side effects** on any connected integration — credentials must never appear in workflow YAML.
 3. **Always call `get_workflow` after `create_workflow`** — close the observability loop before publishing.
 4. **DRAFT is the safe buffer** — only call `publish_workflow` when the design is fully confirmed.
 5. **Fix publish errors in place** — call `update_workflow` and retry; never call `create_workflow` a second time for the same workflow.
-6. **Do not invent connector IDs** — only use `connectorId` values returned by `list_integration_tools`.
+6. **Never invent connector IDs** — use `list_integration_tools` for what's connected, `list_connector_catalog` for what's available but not yet connected. Same for secrets: verify with `list_workflow_secrets` before designing around a `${{ secrets.X }}` reference.
 7. **Register a custom skill before binding it** — for a statechart `skill` step whose id is not a built-in or
    already registered (`list_skills`), call `register_skill` first, or Publish will reject the definition.

package/dist/commands/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/commands/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAoBnC,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAiGrD"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/commands/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAyBnC,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAoIrD"}

package/dist/commands/config.js

@@ -10,6 +10,11 @@ function redactApiKey(apiKey) {
         return '***';
     return `${apiKey.slice(0, 4)}...${apiKey.slice(-4)}`;
 }
+function redactToken(token) {
+    if (!token)
+        return 'not set';
+    return redactApiKey(token);
+}
 export function registerConfig(program) {
     const config = program
         .command('config')
@@ -43,6 +48,7 @@ Examples:
                 projectName: cfg.projectName,
                 email: cfg.email,
                 apiKey: redactApiKey(cfg.apiKey),
+                claudeCodeOauthToken: redactToken(cfg.claudeCodeOauthToken),
             };
             process.stdout.write(JSON.stringify(output, null, 2) + '\n');
             process.exit(0);
@@ -53,6 +59,7 @@ Examples:
         console.log(`projectName: ${cfg.projectName}`);
         console.log(`email:       ${cfg.email}`);
         console.log(`apiKey:      ${redactApiKey(cfg.apiKey)}`);
+        console.log(`claudeCodeOauthToken: ${redactToken(cfg.claudeCodeOauthToken)}`);
     });
     config
         .command('use <env>')
@@ -102,5 +109,36 @@ Examples:
         writeConfig(cfg);
         console.log(`API URL updated to: ${url}`);
     });
+    config
+        .command('set-claude-code-oauth-token <token>')
+        .description('Store a Claude Code subscription token (from `claude setup-token`) for the claude-code workflow step')
+        .addHelpText('after', `
+Examples:
+  conductor config set-claude-code-oauth-token sk-ant-oat01-...`)
+        .action((token) => {
+        const cfg = readConfig();
+        if (!cfg) {
+            console.error('No config found — run conductor login first');
+            process.exit(1);
+            return;
+        }
+        cfg.claudeCodeOauthToken = token;
+        writeConfig(cfg);
+        console.log(`Claude Code OAuth token saved: ${redactToken(token)}`);
+    });
+    config
+        .command('unset-claude-code-oauth-token')
+        .description('Remove the stored Claude Code subscription token')
+        .action(() => {
+        const cfg = readConfig();
+        if (!cfg) {
+            console.error('No config found — run conductor login first');
+            process.exit(1);
+            return;
+        }
+        delete cfg.claudeCodeOauthToken;
+        writeConfig(cfg);
+        console.log('Claude Code OAuth token removed.');
+    });
 }
 //# sourceMappingURL=config.js.map

package/dist/commands/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/commands/config.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAO1D,MAAM,OAAO,GAA2B;IACtC,IAAI,EAAE;QACJ,MAAM,EAAE,4DAA4D;QACpE,WAAW,EAAE,6DAA6D;KAC3E;CACF,CAAA;AAED,SAAS,YAAY,CAAC,MAAc;IAClC,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,KAAK,CAAA;IACpC,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AACtD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAgB;IAC7C,MAAM,MAAM,GAAG,OAAO;SACnB,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,0BAA0B,CAAC;SACvC,WAAW,CAAC,OAAO,EAAE;;;;;0DAKgC,CAAC,CAAA;IAEzD,MAAM;SACH,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,+BAA+B,CAAC;SAC5C,MAAM,CAAC,QAAQ,EAAE,4CAA4C,CAAC;SAC9D,WAAW,CAAC,OAAO,EAAE;;;+BAGK,CAAC;SAC3B,MAAM,CAAC,CAAC,OAA2B,EAAE,EAAE;QACtC,MAAM,GAAG,GAAG,UAAU,EAAE,CAAA;QACxB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAA;YAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACf,OAAM;QACR,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG;gBACb,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;aACjC,CAAA;YACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;YAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACf,OAAM;QACR,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;QACzC,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,CAAC,SAAS,EAAE,CAAC,CAAA;QAC5C,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,CAAC,WAAW,EAAE,CAAC,CAAA;QAC9C,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,CAAC,KAAK,EAAE,CAAC,CAAA;QACxC,OAAO,CAAC,GAAG,CAAC,gBAAgB,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IACzD,CAAC,CAAC,CAAA;IAEJ,MAAM;SACH,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,sCAAsC,CAAC;SACnD,WAAW,CAAC,OAAO,EAAE;;4BAEE,CAAC;SACxB,MAAM,CAAC,CAAC,GAAW,EAAE,EAAE;QACtB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;QAC3B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,KAAK,CAAC,wBAAwB,GAAG,gBAAgB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YAC3F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACf,OAAM;QACR,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAA;QAC7B,MAAM,GAAG,GAAG,QAAQ,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAA;QAC9G,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;QAC1B,GAAG,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAA;QACpC,WAAW,CAAC,GAAG,CAAC,CAAA;QAChB,OAAO,CAAC,GAAG,CAAC,eAAe,GAAG,GAAG,CAAC,CAAA;QAClC,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;QAC3C,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;QAChD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAA;QACvD,CAAC;IACH,CAAC,CAAC,CAAA;IAEJ,MAAM;SACH,OAAO,CAAC,eAAe,CAAC;SACxB,WAAW,CAAC,oBAAoB,CAAC;SACjC,WAAW,CAAC,OAAO,EAAE;;;iDAGuB,CAAC;SAC7C,MAAM,CAAC,CAAC,GAAW,EAAE,EAAE;QACtB,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9D,OAAO,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAA;YACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACf,OAAM;QACR,CAAC;QACD,MAAM,GAAG,GAAG,UAAU,EAAE,CAAA;QACxB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAA;YAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACf,OAAM;QACR,CAAC;QACD,GAAG,CAAC,MAAM,GAAG,GAAG,CAAA;QAChB,WAAW,CAAC,GAAG,CAAC,CAAA;QAChB,OAAO,CAAC,GAAG,CAAC,uBAAuB,GAAG,EAAE,CAAC,CAAA;IAC3C,CAAC,CAAC,CAAA;AACN,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/commands/config.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAO1D,MAAM,OAAO,GAA2B;IACtC,IAAI,EAAE;QACJ,MAAM,EAAE,4DAA4D;QACpE,WAAW,EAAE,6DAA6D;KAC3E;CACF,CAAA;AAED,SAAS,YAAY,CAAC,MAAc;IAClC,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,KAAK,CAAA;IACpC,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AACtD,CAAC;AAED,SAAS,WAAW,CAAC,KAAyB;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAA;IAC5B,OAAO,YAAY,CAAC,KAAK,CAAC,CAAA;AAC5B,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAgB;IAC7C,MAAM,MAAM,GAAG,OAAO;SACnB,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,0BAA0B,CAAC;SACvC,WAAW,CAAC,OAAO,EAAE;;;;;0DAKgC,CAAC,CAAA;IAEzD,MAAM;SACH,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,+BAA+B,CAAC;SAC5C,MAAM,CAAC,QAAQ,EAAE,4CAA4C,CAAC;SAC9D,WAAW,CAAC,OAAO,EAAE;;;+BAGK,CAAC;SAC3B,MAAM,CAAC,CAAC,OAA2B,EAAE,EAAE;QACtC,MAAM,GAAG,GAAG,UAAU,EAAE,CAAA;QACxB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAA;YAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACf,OAAM;QACR,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG;gBACb,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;gBAChC,oBAAoB,EAAE,WAAW,CAAC,GAAG,CAAC,oBAAoB,CAAC;aAC5D,CAAA;YACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;YAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACf,OAAM;QACR,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;QACzC,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,CAAC,SAAS,EAAE,CAAC,CAAA;QAC5C,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,CAAC,WAAW,EAAE,CAAC,CAAA;QAC9C,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,CAAC,KAAK,EAAE,CAAC,CAAA;QACxC,OAAO,CAAC,GAAG,CAAC,gBAAgB,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACvD,OAAO,CAAC,GAAG,CAAC,yBAAyB,WAAW,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAA;IAC/E,CAAC,CAAC,CAAA;IAEJ,MAAM;SACH,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,sCAAsC,CAAC;SACnD,WAAW,CAAC,OAAO,EAAE;;4BAEE,CAAC;SACxB,MAAM,CAAC,CAAC,GAAW,EAAE,EAAE;QACtB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;QAC3B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,KAAK,CAAC,wBAAwB,GAAG,gBAAgB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YAC3F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACf,OAAM;QACR,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAA;QAC7B,MAAM,GAAG,GAAG,QAAQ,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAA;QAC9G,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;QAC1B,GAAG,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAA;QACpC,WAAW,CAAC,GAAG,CAAC,CAAA;QAChB,OAAO,CAAC,GAAG,CAAC,eAAe,GAAG,GAAG,CAAC,CAAA;QAClC,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;QAC3C,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;QAChD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAA;QACvD,CAAC;IACH,CAAC,CAAC,CAAA;IAEJ,MAAM;SACH,OAAO,CAAC,eAAe,CAAC;SACxB,WAAW,CAAC,oBAAoB,CAAC;SACjC,WAAW,CAAC,OAAO,EAAE;;;iDAGuB,CAAC;SAC7C,MAAM,CAAC,CAAC,GAAW,EAAE,EAAE;QACtB,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9D,OAAO,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAA;YACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACf,OAAM;QACR,CAAC;QACD,MAAM,GAAG,GAAG,UAAU,EAAE,CAAA;QACxB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAA;YAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACf,OAAM;QACR,CAAC;QACD,GAAG,CAAC,MAAM,GAAG,GAAG,CAAA;QAChB,WAAW,CAAC,GAAG,CAAC,CAAA;QAChB,OAAO,CAAC,GAAG,CAAC,uBAAuB,GAAG,EAAE,CAAC,CAAA;IAC3C,CAAC,CAAC,CAAA;IAEJ,MAAM;SACH,OAAO,CAAC,qCAAqC,CAAC;SAC9C,WAAW,CAAC,sGAAsG,CAAC;SACnH,WAAW,CAAC,OAAO,EAAE;;gEAEsC,CAAC;SAC5D,MAAM,CAAC,CAAC,KAAa,EAAE,EAAE;QACxB,MAAM,GAAG,GAAG,UAAU,EAAE,CAAA;QACxB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAA;YAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACf,OAAM;QACR,CAAC;QACD,GAAG,CAAC,oBAAoB,GAAG,KAAK,CAAA;QAChC,WAAW,CAAC,GAAG,CAAC,CAAA;QAChB,OAAO,CAAC,GAAG,CAAC,kCAAkC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IACrE,CAAC,CAAC,CAAA;IAEJ,MAAM;SACH,OAAO,CAAC,+BAA+B,CAAC;SACxC,WAAW,CAAC,kDAAkD,CAAC;SAC/D,MAAM,CAAC,GAAG,EAAE;QACX,MAAM,GAAG,GAAG,UAAU,EAAE,CAAA;QACxB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAA;YAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACf,OAAM;QACR,CAAC;QACD,OAAO,GAAG,CAAC,oBAAoB,CAAA;QAC/B,WAAW,CAAC,GAAG,CAAC,CAAA;QAChB,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAA;IACjD,CAAC,CAAC,CAAA;AACN,CAAC"}

package/dist/daemon/job-runner.d.ts

@@ -0,0 +1,81 @@
+import type { Config } from '../lib/config.js';
+/**
+ * Pointer-only daemon event for the per-job dispatch protocol ("protocol 2").
+ * Carries no secrets/env — the daemon fetches the interpolated dispatch
+ * payload (env, steps, run token) at pickup. The events API delivers
+ * {eventId, type, payload: {...}}; the watcher flattens the payload into
+ * this top-level shape before enqueueing.
+ */
+export interface WorkflowJobEvent {
+    eventId: string;
+    type: string;
+    protocol: 2;
+    workflowRunId: string;
+    jobId: string;
+    jobRunId: string;
+    projectId: string;
+    workflowName: string;
+}
+/** One declared producer artifact — {@link DispatchStep.artifacts}. */
+export interface DispatchArtifact {
+    name: string;
+    path: string;
+}
+/** One resolved consumed artifact — {@link DispatchPayload.consumedArtifacts}. */
+export interface ConsumedArtifact {
+    name: string;
+    downloadUrl: string;
+}
+export interface DispatchStep {
+    stepIndex: number;
+    workerJobId: string;
+    stepId: string;
+    stepName: string;
+    stepType: string;
+    prompt?: string;
+    env?: Record<string, string>;
+    timeoutMinutes?: number;
+    conductorMcp?: boolean;
+    allowedTools?: string;
+    maxTurns?: number;
+    inputsJson?: string;
+    outputSchemaJson?: string;
+    /** This step's declared `artifacts:` (docker/claude-code only). Optional/additive. */
+    artifacts?: DispatchArtifact[];
+}
+export interface DispatchPayload {
+    jobRunId: string;
+    protocol: number;
+    image?: string;
+    env: Record<string, string>;
+    steps: DispatchStep[];
+    runToken: string;
+    callbacks: {
+        logChunkUrlTemplate: string;
+        stepCompleteUrlTemplate: string;
+    };
+    /** Internal base URL for this run's artifact endpoints. Present iff any step declares artifacts. */
+    artifactsUrl?: string;
+    /** This job's `consumes:` artifacts, pre-resolved to signed download URLs. Optional/additive. */
+    consumedArtifacts?: ConsumedArtifact[];
+}
+export declare const DEFAULT_RUNNER_IMAGE = "ghcr.io/cliangdev/conductor-runner:3";
+export declare const DEFAULT_TIMEOUT_MINUTES = 30;
+/** Fills a `{workerJobId}` placeholder in a callback URL template. Templates
+ * with no placeholder (e.g. a run-scoped log-chunk URL) are returned as-is. */
+export declare function fillTemplate(template: string, workerJobId: string): string;
+/**
+ * Assembles the container env contract for a single step: job-level payload
+ * env, overridden by step-level env, overridden by the CONDUCTOR_* contract
+ * vars. `ANTHROPIC_API_KEY` is stripped unconditionally — self-hosted jobs
+ * must never carry it, even if it leaked into the payload's env — since it
+ * silently overrides subscription auth in `claude -p`.
+ */
+export declare function buildStepEnv(payload: DispatchPayload, step: DispatchStep, event: WorkflowJobEvent, config: Config, stepCompleteUrl: string, logChunkUrl: string): Record<string, string>;
+/**
+ * Handles a single `workflow.job` event end-to-end: fetches the interpolated
+ * dispatch payload, runs each step sequentially (stopping at the first
+ * failure), posts the job-level completion, then acks the event.
+ */
+export declare function runWorkflowJob(event: WorkflowJobEvent, config: Config): Promise<void>;
+//# sourceMappingURL=job-runner.d.ts.map

package/dist/daemon/job-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"job-runner.d.ts","sourceRoot":"","sources":["../../src/daemon/job-runner.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAM9C;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,CAAC,CAAA;IACX,aAAa,EAAE,MAAM,CAAA;IACrB,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,uEAAuE;AACvE,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;CACb;AAED,kFAAkF;AAClF,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,sFAAsF;IACtF,SAAS,CAAC,EAAE,gBAAgB,EAAE,CAAA;CAC/B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC3B,KAAK,EAAE,YAAY,EAAE,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE;QACT,mBAAmB,EAAE,MAAM,CAAA;QAC3B,uBAAuB,EAAE,MAAM,CAAA;KAChC,CAAA;IACD,oGAAoG;IACpG,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,iGAAiG;IACjG,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,CAAA;CACvC;AAUD,eAAO,MAAM,oBAAoB,yCAAyC,CAAA;AAC1E,eAAO,MAAM,uBAAuB,KAAK,CAAA;AAqCzC;+EAC+E;AAC/E,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAE1E;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE,YAAY,EAClB,KAAK,EAAE,gBAAgB,EACvB,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,EACvB,WAAW,EAAE,MAAM,GAClB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA0CxB;AAmbD;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA4D3F"}