@commandgarden/cli 1.4.2 → 2.1.0

package/node_modules/@commandgarden/app/dist/server/journal/sources/git.source.js

@@ -0,0 +1,72 @@
+/**
+ * Git data source — fetches commits and PRs via the ado/git-commits
+ * commandGarden connector through the daemon API.
+ *
+ * Phase 3 rewrite: replaced direct REST API calls + PAT auth with a single
+ * daemon.post('/api/run') call per repo. The connector uses the browser's
+ * MSAL session token — no PAT required.
+ */
+export class GitSource {
+    daemon;
+    org;
+    repos;
+    author;
+    constructor(daemon, config) {
+        this.daemon = daemon;
+        this.org = config.azureDevOps.org;
+        this.repos = config.azureDevOps.repos;
+        this.author = config.author;
+    }
+    async fetch(weekStart, weekEnd) {
+        try {
+            // Call the ado/git-commits connector once per configured repo via daemon
+            const results = await Promise.all(this.repos.map((r) => this.fetchRepo(r.project, r.repo, weekStart, weekEnd)));
+            // Aggregate daily commits across all repos
+            const dailyMap = new Map();
+            const repoActivity = [];
+            let totalPRsMerged = 0;
+            for (let i = 0; i < this.repos.length; i++) {
+                const { project, repo } = this.repos[i];
+                const rows = results[i];
+                const commitRows = rows.filter((r) => r.isPR !== 'true');
+                const prRows = rows.filter((r) => r.isPR === 'true');
+                repoActivity.push({ project, repo, commits: commitRows.length });
+                totalPRsMerged += prRows.length;
+                for (const r of commitRows) {
+                    const date = r.date;
+                    const entry = dailyMap.get(date) ?? { date, commits: 0, filesChanged: 0 };
+                    entry.commits += 1;
+                    entry.filesChanged += (r.filesAdded ?? 0) + (r.filesEdited ?? 0) + (r.filesDeleted ?? 0);
+                    dailyMap.set(date, entry);
+                }
+            }
+            const daily = [...dailyMap.values()].sort((a, b) => a.date.localeCompare(b.date));
+            const totalCommits = daily.reduce((sum, d) => sum + d.commits, 0);
+            return {
+                totalCommits,
+                totalPRsMerged,
+                totalPRsReviewed: 0,
+                daily,
+                repos: repoActivity.filter((r) => r.commits > 0),
+            };
+        }
+        catch (e) {
+            console.error('[git] fetch error:', e);
+            // Graceful degradation: return empty data instead of failing
+            return { totalCommits: 0, totalPRsMerged: 0, totalPRsReviewed: 0, daily: [], repos: [] };
+        }
+    }
+    /** Fetch a single repo's commits+PRs via the daemon connector. */
+    async fetchRepo(project, repo, fromDate, toDate) {
+        try {
+            const result = await this.daemon.post('/api/run', {
+                connector: 'ado/git-commits',
+                args: { org: this.org, project, repo, fromDate, toDate, author: this.author },
+            });
+            return result.ok && result.data ? result.data : [];
+        }
+        catch {
+            return [];
+        }
+    }
+}

package/node_modules/@commandgarden/app/dist/server/journal/sources/jira.source.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Jira Cloud data source — fetches tickets via the jira/my-tickets
+ * commandGarden connector through the daemon API.
+ *
+ * Uses Jira Cloud REST API (mercedes-benz.atlassian.net) with the browser's
+ * Atlassian session — no API token required. Connector returns rows with a
+ * `category` field (resolved/inProgress/blocker) and Jira issue keys (e.g. PROJ-123).
+ */
+import type { DaemonClient } from '@commandgarden/shared';
+import type { JiraData } from '../journal.types.js';
+export declare class JiraSource {
+    private readonly daemon;
+    constructor(daemon: DaemonClient);
+    fetch(weekStart: string, weekEnd: string): Promise<JiraData | null>;
+}

package/node_modules/@commandgarden/app/dist/server/journal/sources/jira.source.js

@@ -0,0 +1,42 @@
+/**
+ * Jira Cloud data source — fetches tickets via the jira/my-tickets
+ * commandGarden connector through the daemon API.
+ *
+ * Uses Jira Cloud REST API (mercedes-benz.atlassian.net) with the browser's
+ * Atlassian session — no API token required. Connector returns rows with a
+ * `category` field (resolved/inProgress/blocker) and Jira issue keys (e.g. PROJ-123).
+ */
+export class JiraSource {
+    daemon;
+    constructor(daemon) {
+        this.daemon = daemon;
+    }
+    async fetch(weekStart, weekEnd) {
+        try {
+            // assignee left empty → connector uses Jira's currentUser() function
+            const result = await this.daemon.post('/api/run', {
+                connector: 'jira/my-tickets',
+                args: { fromDate: weekStart, toDate: weekEnd },
+            });
+            if (!result.ok || !result.data || result.data.length === 0)
+                return null;
+            // Map connector rows by category to the JiraData sub-arrays.
+            // Connector returns Jira issue keys directly (e.g. "PROJ-123").
+            const rows = result.data;
+            return {
+                resolved: rows
+                    .filter((r) => r.category === 'resolved')
+                    .map((r) => ({ key: r.key, summary: r.summary, resolvedDate: r.resolvedDate })),
+                inProgress: rows
+                    .filter((r) => r.category === 'inProgress')
+                    .map((r) => ({ key: r.key, summary: r.summary })),
+                blockers: rows
+                    .filter((r) => r.category === 'blocker')
+                    .map((r) => ({ key: r.key, summary: r.summary, staleDays: r.staleDays })),
+            };
+        }
+        catch {
+            return null;
+        }
+    }
+}

package/node_modules/@commandgarden/app/dist/server/journal/sources/meetings.source.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Meetings data source — DISABLED for v1.
+ *
+ * The Outlook connector is blocked by the corporate MCAS proxy
+ * (outlook.cloud.microsoft.mcas.ms) which prevents all standard auth patterns:
+ * - OWA REST API: X-OWA-CANARY cookie is HttpOnly (JS can't read it)
+ * - Graph API: no Graph-scoped MSAL token available in MCAS session storage
+ * - Response interception: eval script installs after OWA's initial data fetch
+ *
+ * Returns null immediately — the journal renders without meeting data
+ * (graceful degradation). Git + Jira provide a strong 2-source story.
+ *
+ * TODO: Revisit post-demo with MCAS-specific auth investigation.
+ */
+import type { DaemonClient } from '@commandgarden/shared';
+import type { MeetingsData } from '../journal.types.js';
+export declare class MeetingsSource {
+    private readonly _daemon;
+    constructor(_daemon: DaemonClient);
+    fetch(_weekStart: string, _weekEnd: string): Promise<MeetingsData | null>;
+}

package/node_modules/@commandgarden/app/dist/server/journal/sources/meetings.source.js

@@ -0,0 +1,25 @@
+/**
+ * Meetings data source — DISABLED for v1.
+ *
+ * The Outlook connector is blocked by the corporate MCAS proxy
+ * (outlook.cloud.microsoft.mcas.ms) which prevents all standard auth patterns:
+ * - OWA REST API: X-OWA-CANARY cookie is HttpOnly (JS can't read it)
+ * - Graph API: no Graph-scoped MSAL token available in MCAS session storage
+ * - Response interception: eval script installs after OWA's initial data fetch
+ *
+ * Returns null immediately — the journal renders without meeting data
+ * (graceful degradation). Git + Jira provide a strong 2-source story.
+ *
+ * TODO: Revisit post-demo with MCAS-specific auth investigation.
+ */
+export class MeetingsSource {
+    _daemon;
+    constructor(_daemon) {
+        this._daemon = _daemon;
+    }
+    async fetch(_weekStart, _weekEnd) {
+        // Disabled for v1 — MCAS proxy blocks all standard auth patterns.
+        // Returns null so the journal renders without meeting data.
+        return null;
+    }
+}

package/node_modules/@commandgarden/app/dist/server/journal/sources/timetracking.source.d.ts

@@ -0,0 +1,17 @@
+/**
+ * TimeTracking data source — fetches hours via commandGarden daemon.
+ * Ported from dashboard/api/src/journal/sources/timetracking.source.ts.
+ *
+ * Replaces OpencliService (CLI spawn) with DaemonClient (HTTP to daemon).
+ * The daemon runs the timetracking/report connector via browser automation.
+ * Returns null gracefully when the connector isn't available (Phase 2 dependency).
+ */
+import type { DaemonClient } from '@commandgarden/shared';
+import type { TimetrackingData } from '../journal.types.js';
+import type { JournalConfig } from '../journal.config.js';
+export declare class TimetrackingSource {
+    private readonly daemon;
+    private readonly config;
+    constructor(daemon: DaemonClient, config: JournalConfig);
+    fetch(weekStart: string, weekEnd: string): Promise<TimetrackingData | null>;
+}

package/node_modules/@commandgarden/app/dist/server/journal/sources/timetracking.source.js

@@ -0,0 +1,83 @@
+/**
+ * TimeTracking data source — fetches hours via commandGarden daemon.
+ * Ported from dashboard/api/src/journal/sources/timetracking.source.ts.
+ *
+ * Replaces OpencliService (CLI spawn) with DaemonClient (HTTP to daemon).
+ * The daemon runs the timetracking/report connector via browser automation.
+ * Returns null gracefully when the connector isn't available (Phase 2 dependency).
+ */
+export class TimetrackingSource {
+    daemon;
+    config;
+    constructor(daemon, config) {
+        this.daemon = daemon;
+        this.config = config;
+    }
+    async fetch(weekStart, weekEnd) {
+        try {
+            // Determine which month(s) the week spans
+            const startMonth = weekStart.slice(0, 7);
+            const endMonth = weekEnd.slice(0, 7);
+            const months = startMonth === endMonth ? [startMonth] : [startMonth, endMonth];
+            // Fetch each month's report via daemon
+            const allRows = [];
+            for (const month of months) {
+                const result = await this.daemon.post('/api/run', {
+                    connector: 'timetracking/report',
+                    args: { month },
+                });
+                if (result.ok && result.data) {
+                    allRows.push(...result.data);
+                }
+            }
+            // Filter to rows within the week range
+            const weekRows = allRows.filter((r) => {
+                if (!r.date)
+                    return false;
+                return r.date >= weekStart && r.date <= weekEnd;
+            });
+            // Group by date
+            const dailyMap = new Map();
+            for (const row of weekRows) {
+                const date = row.date;
+                const entry = dailyMap.get(date) ?? { date, hours: 0, projects: [] };
+                const hrs = typeof row.hours === 'number' ? row.hours : 0;
+                entry.hours += hrs;
+                if (row.projectId) {
+                    const proj = entry.projects.find((p) => p.projectId === row.projectId);
+                    if (proj)
+                        proj.hours += hrs;
+                    else
+                        entry.projects.push({ projectId: row.projectId, hours: hrs });
+                }
+                dailyMap.set(date, entry);
+            }
+            const daily = [...dailyMap.values()].sort((a, b) => a.date.localeCompare(b.date));
+            const totalHours = Math.round(daily.reduce((sum, d) => sum + d.hours, 0) * 100) / 100;
+            // Find gaps: weekdays in range with 0 hours
+            const gaps = [];
+            const cursor = new Date(weekStart);
+            const end = new Date(weekEnd);
+            while (cursor <= end) {
+                const day = cursor.getDay();
+                if (day >= 1 && day <= 5) {
+                    const iso = cursor.toISOString().slice(0, 10);
+                    const entry = dailyMap.get(iso);
+                    if (!entry || entry.hours === 0)
+                        gaps.push(iso);
+                }
+                cursor.setDate(cursor.getDate() + 1);
+            }
+            return {
+                totalHours,
+                targetHours: this.config.targetHours,
+                daily,
+                gaps,
+            };
+        }
+        catch {
+            // Graceful degradation: connector not available yet (Phase 2 dependency)
+            return null;
+        }
+    }
+}

package/node_modules/@commandgarden/app/dist/server/routes/connectors.js

@@ -2,6 +2,8 @@ import { HIGH_RISK_CAPABILITIES } from '@commandgarden/shared';
 const APP_ROUTES = {
     'timetracking/report': '/apps/timetracking',
     'teams/room-availability': '/apps/rooms',
+    'tokenmaster/clients-list': '/apps/trusted-peer-expiry',
+    'tokenmaster/client-trustedby': '/apps/trusted-peer-expiry',
 };
 export function connectorRoutes(app, daemon) {
     app.get('/api/connectors', async () => {

package/node_modules/@commandgarden/app/dist/server/routes/index.js

@@ -6,6 +6,9 @@ import { configRoutes } from './config.js';
 import { preferencesRoutes } from './preferences.js';
 import { goalsRoutes } from './goals.js';
 import { timetrackingCacheRoutes } from './timetracking-cache.js';
+import { journalRoutes } from './journal.js';
+import { securityNewsCacheRoutes } from './security-news-cache.js';
+import { skillsRoutes } from './skills.js';
 export function registerRoutes(app, daemon, store) {
     statusRoutes(app, daemon);
     connectorRoutes(app, daemon);
@@ -15,4 +18,7 @@ export function registerRoutes(app, daemon, store) {
     preferencesRoutes(app, store);
     goalsRoutes(app, store);
     timetrackingCacheRoutes(app, store);
+    journalRoutes(app, daemon, store);
+    securityNewsCacheRoutes(app, store);
+    skillsRoutes(app);
 }

package/node_modules/@commandgarden/app/dist/server/routes/journal.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Journal Fastify route — POST /api/journal/generate.
+ * Reads journal config from user preferences (SQLite), instantiates
+ * sources with that config, and generates the weekly report.
+ */
+import type { FastifyInstance } from 'fastify';
+import type { DaemonClient } from '@commandgarden/shared';
+import type { AppStore } from '../store.js';
+export declare function journalRoutes(app: FastifyInstance, daemon: DaemonClient, store: AppStore): void;

package/node_modules/@commandgarden/app/dist/server/routes/journal.js

@@ -0,0 +1,56 @@
+/**
+ * Journal Fastify route — POST /api/journal/generate.
+ * Reads journal config from user preferences (SQLite), instantiates
+ * sources with that config, and generates the weekly report.
+ */
+import { getJournalConfig } from '../journal/journal.config.js';
+import { GitSource } from '../journal/sources/git.source.js';
+import { JiraSource } from '../journal/sources/jira.source.js';
+import { TimetrackingSource } from '../journal/sources/timetracking.source.js';
+import { MeetingsSource } from '../journal/sources/meetings.source.js';
+import { JournalService } from '../journal/journal.service.js';
+export function journalRoutes(app, daemon, store) {
+    app.post('/api/journal/generate', async (req, reply) => {
+        const body = req.body;
+        // Validate weekStart is present and matches YYYY-MM-DD format
+        if (!body?.weekStart || !/^\d{4}-(0[1-9]|1[0-2])-(0[1-9]|[12]\d|3[01])$/.test(body.weekStart)) {
+            return reply.code(400).send({
+                ok: false,
+                error: 'weekStart is required and must be YYYY-MM-DD format',
+            });
+        }
+        // Build config from user preferences (configured via GUI Config page)
+        const config = getJournalConfig(store);
+        // Check that required settings are configured
+        if (!config.azureDevOps.org || config.azureDevOps.repos.length === 0) {
+            return reply.code(400).send({
+                ok: false,
+                error: 'Journal not configured. Go to Configuration → Journal Settings and set your ADO org and repos.',
+            });
+        }
+        try {
+            const start = Date.now();
+            // Sources receive config from preferences — no env vars needed
+            const git = new GitSource(daemon, config);
+            const jira = new JiraSource(daemon);
+            const timetracking = new TimetrackingSource(daemon, config);
+            const meetings = new MeetingsSource(daemon);
+            const service = new JournalService(git, timetracking, meetings, jira);
+            const result = await service.generate({ weekStart: body.weekStart });
+            // Audit log (non-blocking — failure should not break the response)
+            const durationMs = Date.now() - start;
+            daemon.post('/api/audit/log', {
+                command: 'journal generate',
+                args: { weekStart: body.weekStart },
+                status: result.status,
+                durationMs,
+            }).catch(() => { });
+            return result;
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : 'Unknown error';
+            console.error('[journal] generate error:', message);
+            return reply.code(500).send({ ok: false, error: message });
+        }
+    });
+}

package/node_modules/@commandgarden/app/dist/server/routes/security-news-cache.d.ts

@@ -0,0 +1,3 @@
+import type { FastifyInstance } from 'fastify';
+import type { AppStore } from '../store.js';
+export declare function securityNewsCacheRoutes(app: FastifyInstance, store: AppStore): void;

package/node_modules/@commandgarden/app/dist/server/routes/security-news-cache.js

@@ -0,0 +1,17 @@
+export function securityNewsCacheRoutes(app, store) {
+    app.get('/api/security-news/cache', async () => {
+        const cached = store.getCachedSecurityNews();
+        if (!cached)
+            return { ok: true, data: null, fetchedAt: null };
+        return { ok: true, data: cached.data, fetchedAt: cached.fetchedAt };
+    });
+    app.post('/api/security-news/cache', async (req, reply) => {
+        const { data } = req.body;
+        if (!Array.isArray(data)) {
+            reply.code(400);
+            return { ok: false, error: 'Missing data array' };
+        }
+        store.cacheSecurityNews(data);
+        return { ok: true };
+    });
+}

package/node_modules/@commandgarden/app/dist/server/routes/skills.d.ts

@@ -0,0 +1,2 @@
+import type { FastifyInstance } from 'fastify';
+export declare function skillsRoutes(app: FastifyInstance): void;

package/node_modules/@commandgarden/app/dist/server/routes/skills.js

@@ -0,0 +1,65 @@
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
+const __dirname = dirname(fileURLToPath(import.meta.url));
+function findSkillsDir() {
+    const candidates = [
+        // From app/{dist,src}/server/routes/ → commandGarden/skills/
+        join(__dirname, '..', '..', '..', '..', 'skills'),
+        // From app/{dist,src}/server/routes/ → app/skills/ (bundled via prepare-bundle)
+        join(__dirname, '..', '..', '..', 'skills'),
+    ];
+    for (const p of candidates) {
+        if (existsSync(p) && statSync(p).isDirectory())
+            return p;
+    }
+    return null;
+}
+function parseFrontmatter(content) {
+    const match = content.match(/^---\s*\n([\s\S]*?)\n---\s*\n([\s\S]*)$/);
+    if (!match)
+        return { description: '', body: content };
+    const frontmatter = match[1];
+    const body = match[2];
+    const descMatch = frontmatter.match(/description:\s*"(.+?)"/);
+    return { description: descMatch?.[1] ?? '', body };
+}
+function loadSkills(dir) {
+    const entries = readdirSync(dir, { withFileTypes: true });
+    const skills = [];
+    for (const entry of entries) {
+        if (!entry.isDirectory())
+            continue;
+        const skillDir = join(dir, entry.name);
+        const skillMd = join(skillDir, 'SKILL.md');
+        if (!existsSync(skillMd))
+            continue;
+        const skillContent = readFileSync(skillMd, 'utf-8');
+        const { description } = parseFrontmatter(skillContent);
+        const files = [];
+        for (const f of readdirSync(skillDir)) {
+            const fp = join(skillDir, f);
+            if (statSync(fp).isFile() && f.endsWith('.md')) {
+                files.push({ name: f, content: readFileSync(fp, 'utf-8') });
+            }
+        }
+        skills.push({ name: entry.name, description, files });
+    }
+    return skills.sort((a, b) => a.name.localeCompare(b.name));
+}
+export function skillsRoutes(app) {
+    app.get('/api/skills', async (_req, reply) => {
+        const dir = findSkillsDir();
+        if (!dir) {
+            reply.code(404).send({ ok: false, error: 'Skills directory not found' });
+            return;
+        }
+        try {
+            const skills = loadSkills(dir);
+            return { ok: true, skills };
+        }
+        catch (err) {
+            reply.code(500).send({ ok: false, error: err instanceof Error ? err.message : 'Failed to load skills' });
+        }
+    });
+}

package/node_modules/@commandgarden/app/dist/server/store.d.ts

@@ -43,5 +43,10 @@ export declare class AppStore {
         data: Record<string, unknown>[];
         fetchedAt: string;
     } | null;
+    cacheSecurityNews(data: Record<string, unknown>[]): void;
+    getCachedSecurityNews(): {
+        data: Record<string, unknown>[];
+        fetchedAt: string;
+    } | null;
     close(): void;
 }

package/node_modules/@commandgarden/app/dist/server/store.js

@@ -96,6 +96,11 @@ export class AppStore {
       id         INTEGER PRIMARY KEY CHECK (id = 1),
       data       TEXT NOT NULL,
       fetched_at TEXT NOT NULL
+    )`);
+        this.db.run(`CREATE TABLE IF NOT EXISTS security_news_cache (
+      id         INTEGER PRIMARY KEY CHECK (id = 1),
+      data       TEXT NOT NULL,
+      fetched_at TEXT NOT NULL
     )`);
     }
     getPreference(key) {
@@ -195,6 +200,20 @@ export class AppStore {
             fetchedAt: rows[0].fetched_at,
         };
     }
+    cacheSecurityNews(data) {
+        const now = new Date().toISOString();
+        this.db.run('INSERT OR REPLACE INTO security_news_cache (id, data, fetched_at) VALUES (1, ?, ?)', [JSON.stringify(data), now]);
+        this.persist();
+    }
+    getCachedSecurityNews() {
+        const rows = this.query('SELECT data, fetched_at FROM security_news_cache WHERE id = 1');
+        if (rows.length === 0)
+            return null;
+        return {
+            data: JSON.parse(rows[0].data),
+            fetchedAt: rows[0].fetched_at,
+        };
+    }
     close() {
         this.db.close();
     }

package/node_modules/@commandgarden/chrome/dist/content-script.js

@@ -43,6 +43,61 @@
       return record;
     });
   }
+  function extractHtml(selector) {
+    const el = document.querySelector(selector);
+    if (!el) throw new Error(`Element "${selector}" not found`);
+    return el.innerHTML;
+  }
+  function extractTree(rootSelector, group, leaf, pathSeparator) {
+    const root = document.querySelector(rootSelector);
+    if (!root) throw new Error(`Root "${rootSelector}" not found`);
+    function extractField(el, spec) {
+      if (spec === "textContent") return el.textContent?.trim().replace(/\s+/g, " ") ?? "";
+      if (spec === "href") return el.getAttribute("href") ?? "";
+      if (spec.startsWith("attr:")) return el.getAttribute(spec.slice(5)) ?? "";
+      return el.textContent?.trim() ?? "";
+    }
+    function walk(container, ancestors, depth) {
+      const results = [];
+      for (const child of Array.from(container.children)) {
+        if (child.matches(leaf.match)) {
+          const row = {};
+          for (const [name, spec] of Object.entries(leaf.fields)) {
+            row[name] = extractField(child, spec);
+          }
+          const title = row.title || child.textContent?.trim() || "";
+          const section = ancestors.length > 0 ? ancestors[0] : title;
+          const pathParts = [...ancestors, title];
+          row.section = section;
+          row.path = pathParts.join(pathSeparator);
+          row.depth = depth;
+          results.push(row);
+        } else if (child.matches(group.match)) {
+          const titleEl = child.querySelector(group.title);
+          const groupTitle = titleEl?.textContent?.trim().replace(/\s+/g, " ") ?? "";
+          const childContainer = child.querySelector(group.children);
+          if (childContainer) {
+            results.push(...walk(childContainer, [...ancestors, groupTitle], depth + 1));
+          }
+        } else {
+          results.push(...walk(child, ancestors, depth));
+        }
+      }
+      return results;
+    }
+    return walk(root, [], 0);
+  }
+  async function clickAll(selector, pause, maxRounds, settle) {
+    for (let round = 0; round < maxRounds; round++) {
+      const elements = document.querySelectorAll(selector);
+      if (elements.length === 0) break;
+      for (const el of Array.from(elements)) {
+        el.click();
+        if (pause > 0) await new Promise((r) => setTimeout(r, pause));
+      }
+    }
+    if (settle > 0) await new Promise((r) => setTimeout(r, settle));
+  }
   async function clickElement(selector) {
     const el = document.querySelector(selector);
     if (!el) throw new Error(`Element "${selector}" not found`);
@@ -86,19 +141,46 @@
         return void 0;
       case "extract":
         return extractData(p.selector, p.fields);
+      case "extract_html":
+        return extractHtml(p.selector);
+      case "extract_tree":
+        return extractTree(
+          p.root,
+          p.group,
+          p.leaf,
+          p.pathSeparator ?? " / "
+        );
       case "click":
         await clickElement(p.selector);
         return void 0;
+      case "click_all":
+        await clickAll(
+          p.selector,
+          p.pause ?? 200,
+          p.maxRounds ?? 10,
+          p.settle ?? 300
+        );
+        return void 0;
       case "type":
         await typeIntoElement(p.selector, p.value);
         return void 0;
-      case "fetch":
-        return fetchFromPage(
+      case "fetch": {
+        const result = await fetchFromPage(
           p.url,
           p.method,
           p.headers,
           p.body
         );
+        if (p.dataPath && result != null && typeof result === "object" && !Array.isArray(result)) {
+          let nested = result;
+          for (const key of p.dataPath.split(".")) {
+            if (nested == null || typeof nested !== "object") return [];
+            nested = nested[key];
+          }
+          return Array.isArray(nested) ? nested : [];
+        }
+        return result;
+      }
       default:
         throw new Error(`Unknown action: ${req.action}`);
     }