@commandgarden/cli 1.4.2 → 2.1.0

package/node_modules/@commandgarden/daemon/connectors/outlook-my-meetings.yaml

@@ -0,0 +1,41 @@
+site: outlook
+name: my-meetings
+version: "1.0"
+description: "User's own meeting schedule from Outlook Calendar for a given day"
+access: read
+
+domains:
+  - "outlook.cloud.microsoft.mcas.ms"
+capabilities:
+  - navigate
+  - js_evaluate
+
+args:
+  - name: date
+    type: string
+    required: true
+    help: "Day to fetch in YYYY-MM-DD format"
+    pattern: "^\\d{4}-\\d{2}-\\d{2}$"
+
+columns:
+  - name: date
+    type: string
+  - name: subject
+    type: string
+  - name: start
+    type: string
+  - name: end
+    type: string
+  - name: durationMin
+    type: number
+  - name: state
+    type: string
+
+pipeline:
+  - step: navigate
+    url: "https://outlook.cloud.microsoft.mcas.ms/calendar/deeplink/compose"
+  - step: wait
+    selector: "body"
+    timeout: 30000
+  - step: js_evaluate
+    file: outlook-my-meetings.eval.js

package/node_modules/@commandgarden/daemon/connectors/socket-security-news.yaml

@@ -0,0 +1,63 @@
+site: socket
+name: security-news
+version: "1.0"
+description: "Latest security news from Socket.dev blog"
+access: read
+
+domains:
+  - "socket.dev"
+capabilities:
+  - navigate
+  - cookie_read
+
+args:
+  - name: tag
+    type: string
+    required: false
+    default: ""
+    help: "Filter by tag (e.g. 'Research', 'Security News')"
+
+columns:
+  - name: title
+    type: string
+  - name: summary
+    type: string
+  - name: url
+    type: string
+  - name: date
+    type: string
+  - name: author
+    type: string
+  - name: tags
+    type: string
+
+pipeline:
+  - step: navigate
+    url: "https://socket.dev/"
+  - step: wait
+    selector: "body"
+    timeout: 30000
+  - step: fetch
+    url: "https://socket.dev/api/blog/feed.json"
+    method: "GET"
+    headers:
+      Accept: "application/json"
+    as: "feed"
+  - step: transform
+    type: json_unwrap
+    input: feed
+    as: _data
+    options:
+      path: "items"
+  - step: map
+    fields:
+      title: "${{ row.title }}"
+      summary: "${{ row.summary }}"
+      url: "${{ row.url }}"
+      date: "${{ row.date_published }}"
+      author: "${{ row.author.name }}"
+      tags: "${{ row.tags }}"
+  - step: filter  # empty tag = show all (contains '' is always true)
+    field: tags
+    operator: contains
+    value: "${{ args.tag | default('') }}"

package/node_modules/@commandgarden/daemon/connectors/tldrsec-newsletter.eval.js

@@ -0,0 +1,27 @@
+// tldrsec-newsletter.eval.js
+// Extracts newsletter posts from Remix's __remixContext embedded JSON.
+// Returns an array of flattened post objects for the pipeline.
+// NOTE: No IIFE — evaluateInPage wraps this in AsyncFunction already.
+
+const ctx = window.__remixContext;
+if (!ctx) throw new Error('__remixContext not found');
+
+const loaderData = ctx.state?.loaderData;
+if (!loaderData) throw new Error('loaderData not found in __remixContext');
+
+// The route key for the tag/category page
+const categoryData = loaderData['routes/t/$category'];
+if (!categoryData) throw new Error('routes/t/$category loader data not found');
+
+const posts = categoryData.paginatedPosts?.posts;
+if (!Array.isArray(posts)) throw new Error('paginatedPosts.posts is not an array');
+
+return posts.map((p) => ({
+  title: p.web_title || p.meta_default_title || '',
+  slug: p.slug || '',
+  url: 'https://tldrsec.com/p/' + (p.slug || ''),
+  publishedAt: p.override_scheduled_at || p.created_at || '',
+  excerpt: p.web_subtitle || p.meta_default_description || '',
+  authors: (p.authors || []).map((a) => a.name).join(', '),
+  tags: (p.content_tags || []).map((t) => t.display).join(', '),
+}));

package/node_modules/@commandgarden/daemon/connectors/tldrsec-newsletter.yaml

@@ -0,0 +1,38 @@
+site: tldrsec
+name: newsletter
+version: "1.0"
+description: "Latest newsletter issues from tl;dr sec — titles, summaries, authors, tags, and publish dates"
+access: read
+
+domains:
+  - "tldrsec.com"
+capabilities:
+  - navigate
+  - js_evaluate
+
+args: []
+
+columns:
+  - name: title
+    type: string
+  - name: slug
+    type: string
+  - name: url
+    type: string
+  - name: publishedAt
+    type: string
+  - name: excerpt
+    type: string
+  - name: authors
+    type: string
+  - name: tags
+    type: string
+
+pipeline:
+  - step: navigate
+    url: "https://tldrsec.com/t/Newsletter"
+  - step: wait
+    selector: "body"
+    timeout: 15000
+  - step: js_evaluate
+    file: tldrsec-newsletter.eval.js

package/node_modules/@commandgarden/daemon/connectors/tokenmaster-client-trustedby.yaml

@@ -0,0 +1,62 @@
+site: tokenmaster
+name: client-trustedby
+version: "2.0"
+description: "List the clients that trust a given client in TokenMaster"
+access: read
+
+vars:
+  domains:
+    emea: tma.query.api.dvb.corpinter.net
+    amap: tma.query.api.am.dvb.corpinter.net
+    cn: tma.query.api.dvb.corpinter.net.cn
+
+args:
+  - name: clientid
+    type: string
+    required: true
+    help: "The client ID to look up trustedby relationships for"
+  - name: region
+    type: string
+    required: false
+    default: "emea"
+    enum: [emea, amap, cn]
+    help: "Region to query (emea, amap, cn, or 'all' for fan-out). Default: emea"
+
+domains:
+  - "tma.query.api.dvb.corpinter.net"
+  - "tma.query.api.am.dvb.corpinter.net"
+  - "tma.query.api.dvb.corpinter.net.cn"
+capabilities:
+  - navigate
+  - cookie_read
+
+columns:
+  - name: id
+    type: string
+  - name: name
+    type: string
+  - name: is_onboard_client
+    type: boolean
+  - name: idDisplay
+    type: string
+  - name: expiry_date
+    type: string
+
+pipeline:
+  - step: navigate
+    url: "https://${{ args.region | lookup(vars.domains) }}/v2/clients/${{ args.clientid }}/trustedby"
+  - step: wait
+    selector: "body"
+    timeout: 30000
+  - step: fetch
+    url: "https://${{ args.region | lookup(vars.domains) }}/v2/clients/${{ args.clientid }}/trustedby"
+    method: "GET"
+    headers:
+      Accept: "application/json"
+  - step: map
+    fields:
+      id: "${{ row.id }}"
+      name: "${{ row.name }}"
+      is_onboard_client: "${{ row.is_onboard_client }}"
+      idDisplay: "${{ row.idDisplay }}"
+      expiry_date: "${{ row.expiry_date }}"

package/node_modules/@commandgarden/daemon/connectors/tokenmaster-clients-list.yaml

@@ -0,0 +1,55 @@
+site: tokenmaster
+name: clients-list
+version: "2.0"
+description: "List the clients managed by the current user in TokenMaster"
+access: read
+
+vars:
+  domains:
+    emea: tma.query.api.dvb.corpinter.net
+    amap: tma.query.api.am.dvb.corpinter.net
+    cn: tma.query.api.dvb.corpinter.net.cn
+
+args:
+  - name: region
+    type: string
+    required: false
+    default: "all"
+    enum: [emea, amap, cn]
+    help: "Region to query (emea, amap, cn, or 'all' for fan-out). Default: all"
+
+domains:
+  - "tma.query.api.dvb.corpinter.net"
+  - "tma.query.api.am.dvb.corpinter.net"
+  - "tma.query.api.dvb.corpinter.net.cn"
+capabilities:
+  - navigate
+  - cookie_read
+
+columns:
+  - name: id
+    type: string
+  - name: name
+    type: string
+  - name: status
+    type: string
+  - name: admins
+    type: string
+
+pipeline:
+  - step: navigate
+    url: "https://${{ args.region | lookup(vars.domains) }}/v1/clients"
+  - step: wait
+    selector: "body"
+    timeout: 30000
+  - step: fetch
+    url: "https://${{ args.region | lookup(vars.domains) }}/v1/clients"
+    method: "GET"
+    headers:
+      Accept: "application/json"
+  - step: map
+    fields:
+      id: "${{ row.id }}"
+      name: "${{ row.name }}"
+      status: "${{ row.status }}"
+      admins: "${{ row.admins }}"

package/node_modules/@commandgarden/daemon/connectors/wiz-blog-security.eval.js

@@ -0,0 +1,29 @@
+// wiz-blog-security.eval.js
+// Extracts blog posts from Next.js __NEXT_DATA__ embedded JSON.
+// Returns an array of flattened post objects for the pipeline.
+// NOTE: No IIFE — evaluateInPage wraps this in AsyncFunction already.
+
+const script = document.getElementById('__NEXT_DATA__');
+if (!script) throw new Error('__NEXT_DATA__ script tag not found');
+
+const raw = script.textContent;
+if (!raw) throw new Error('__NEXT_DATA__ script tag is empty');
+
+const nextData = JSON.parse(raw);
+const pageProps = nextData?.props?.pageProps;
+if (!pageProps) throw new Error('pageProps not found in __NEXT_DATA__');
+
+const posts = pageProps.initialPosts;
+if (!Array.isArray(posts)) throw new Error('initialPosts is not an array');
+
+return posts
+  .filter((p) => !p.hiddenFromArchive)
+  .map((p) => ({
+    title: p.title || '',
+    slug: p.slug || '',
+    url: 'https://www.wiz.io/blog/' + (p.slug || ''),
+    publishedAt: p._firstPublishedAt || '',
+    excerpt: p.excerpt || '',
+    authors: (p.authors || []).map((a) => a.fullName).join(', '),
+    tags: (p.tags || []).map((t) => t.name).join(', '),
+  }));

package/node_modules/@commandgarden/daemon/connectors/wiz-blog-security.yaml

@@ -0,0 +1,44 @@
+site: wiz
+name: blog-security
+version: "1.0"
+description: "Latest security blog posts from Wiz — titles, excerpts, authors, tags, and publish dates"
+access: read
+
+domains:
+  - "www.wiz.io"
+capabilities:
+  - navigate
+  - js_evaluate
+
+args:
+  - name: tag
+    type: string
+    required: false
+    default: "security"
+    pattern: "^[a-z0-9-]+$"
+    help: "Blog tag slug to filter by (e.g. 'security', 'research', 'ai'). Default: security"
+
+columns:
+  - name: title
+    type: string
+  - name: slug
+    type: string
+  - name: url
+    type: string
+  - name: publishedAt
+    type: string
+  - name: excerpt
+    type: string
+  - name: authors
+    type: string
+  - name: tags
+    type: string
+
+pipeline:
+  - step: navigate
+    url: "https://www.wiz.io/blog/tag/${{ args.tag }}"
+  - step: wait
+    selector: "#__NEXT_DATA__"
+    timeout: 15000
+  - step: js_evaluate
+    file: wiz-blog-security.eval.js

package/node_modules/@commandgarden/daemon/dist/daemon-runner.d.ts

@@ -0,0 +1,12 @@
+import type { PipelineStep } from '@commandgarden/shared';
+export interface DaemonRunnerInput {
+    steps: PipelineStep[];
+    data: Record<string, unknown>[];
+    vars: Record<string, unknown>;
+    args?: Record<string, string | number | boolean>;
+}
+export declare function runDaemonSteps(input: DaemonRunnerInput): {
+    data: Record<string, unknown>[];
+    vars: Record<string, unknown>;
+};
+//# sourceMappingURL=daemon-runner.d.ts.map

package/node_modules/@commandgarden/daemon/dist/daemon-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-runner.d.ts","sourceRoot":"","sources":["../src/daemon-runner.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAsC,MAAM,uBAAuB,CAAC;AAI9F,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;CAClD;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,iBAAiB,GAAG;IACxD,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B,CAwDA"}

package/node_modules/@commandgarden/daemon/dist/daemon-runner.js

@@ -0,0 +1,65 @@
+import { interpolate } from '@commandgarden/shared';
+import { getTransform } from './transforms.js';
+export function runDaemonSteps(input) {
+    const vars = { ...input.vars };
+    const args = input.args ?? {};
+    let data = input.data;
+    for (const step of input.steps) {
+        switch (step.step) {
+            case 'transform': {
+                const ts = step;
+                const inputVal = vars[ts.input] ?? '';
+                const fn = getTransform(ts.type);
+                const result = fn(inputVal, ts.options);
+                if (Array.isArray(result)) {
+                    data = result;
+                }
+                else if (typeof result === 'object') {
+                    Object.assign(vars, result);
+                }
+                else {
+                    vars[ts.as] = result;
+                }
+                break;
+            }
+            // map and filter are dual-mode — they run here when they appear after a transform
+            case 'map': {
+                const ms = step;
+                data = data.map(row => {
+                    const mapped = {};
+                    const ctx = { args, vars: { ...vars, row }, cookies: {}, row };
+                    for (const [key, expr] of Object.entries(ms.fields)) {
+                        mapped[key] = interpolate(expr, ctx);
+                    }
+                    return mapped;
+                });
+                break;
+            }
+            case 'filter': {
+                const fs = step;
+                const filterCtx = { args, vars, cookies: {} };
+                const filterValue = interpolate(fs.value, filterCtx);
+                data = data.filter(row => {
+                    const actual = row[fs.field];
+                    switch (fs.operator) {
+                        case 'eq': return actual === filterValue;
+                        case 'ne': return actual !== filterValue;
+                        case 'contains': return String(actual).includes(String(filterValue));
+                        case 'matches': try {
+                            return new RegExp(String(filterValue)).test(String(actual));
+                        }
+                        catch {
+                            return false;
+                        }
+                        default: return true;
+                    }
+                });
+                break;
+            }
+            default:
+                throw new Error(`DaemonRunner does not support step type: ${step.step}`);
+        }
+    }
+    return { data, vars };
+}
+//# sourceMappingURL=daemon-runner.js.map

package/node_modules/@commandgarden/daemon/dist/daemon-runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-runner.js","sourceRoot":"","sources":["../src/daemon-runner.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAoB,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAS/C,MAAM,UAAU,cAAc,CAAC,KAAwB;IAIrD,MAAM,IAAI,GAAG,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;IAC9B,IAAI,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IAEtB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,KAAK,WAAW,CAAC,CAAC,CAAC;gBACjB,MAAM,EAAE,GAAG,IAAqB,CAAC;gBACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;gBACtC,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;gBACjC,MAAM,MAAM,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;gBACxC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC1B,IAAI,GAAG,MAAmC,CAAC;gBAC7C,CAAC;qBAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;oBACtC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAC9B,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC;gBACvB,CAAC;gBACD,MAAM;YACR,CAAC;YACD,kFAAkF;YAClF,KAAK,KAAK,CAAC,CAAC,CAAC;gBACX,MAAM,EAAE,GAAG,IAAe,CAAC;gBAC3B,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;oBACpB,MAAM,MAAM,GAA4B,EAAE,CAAC;oBAC3C,MAAM,GAAG,GAAgB,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC;oBAC5E,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;wBACpD,MAAM,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;oBACvC,CAAC;oBACD,OAAO,MAAM,CAAC;gBAChB,CAAC,CAAC,CAAC;gBACH,MAAM;YACR,CAAC;YACD,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,EAAE,GAAG,IAAkB,CAAC;gBAC9B,MAAM,SAAS,GAAgB,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;gBAC3D,MAAM,WAAW,GAAG,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;gBACrD,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;oBACvB,MAAM,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;oBAC7B,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC;wBACpB,KAAK,IAAI,CAAC,CAAC,OAAO,MAAM,KAAK,WAAW,CAAC;wBACzC,KAAK,IAAI,CAAC,CAAC,OAAO,MAAM,KAAK,WAAW,CAAC;wBACzC,KAAK,UAAU,CAAC,CAAC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;wBACrE,KAAK,SAAS,CAAC,CAAC,IAAI,CAAC;4BAAC,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;wBAAC,CAAC;wBAAC,MAAM,CAAC;4BAAC,OAAO,KAAK,CAAC;wBAAC,CAAC;wBAC5G,OAAO,CAAC,CAAC,OAAO,IAAI,CAAC;oBACvB,CAAC;gBACH,CAAC,CAAC,CAAC;gBACH,MAAM;YACR,CAAC;YACD;gBACE,MAAM,IAAI,KAAK,CAAC,4CAA4C,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC"}

package/node_modules/@commandgarden/daemon/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AACA,OAAO,OAAO,MAAM,SAAS,CAAC;AAM9B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAKxC,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,YAAY,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,UAAU,EAAE,UAAU,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,UAAU,sSA+TlD"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AACA,OAAO,OAAO,MAAM,SAAS,CAAC;AAM9B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAKxC,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,YAAY,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,UAAU,EAAE,UAAU,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,UAAU,sSA6YlD"}

package/node_modules/@commandgarden/daemon/dist/server.js

@@ -2,8 +2,9 @@
 import Fastify from 'fastify';
 import websocket from '@fastify/websocket';
 import { randomUUID, createHash } from 'node:crypto';
-import { isRunCommandRequest, createAuditEvent, STEP_CAPABILITY_MAP } from '@commandgarden/shared';
+import { isRunCommandRequest, createAuditEvent, STEP_CAPABILITY_MAP, expandFanOut, validateEnumArgs, splitPipeline } from '@commandgarden/shared';
 import { userInfo } from 'node:os';
+import { runDaemonSteps } from './daemon-runner.js';
 import { validateCommand } from './validator.js';
 import { validateToken } from './auth.js';
 import { SseManager } from './sse-manager.js';
@@ -182,11 +183,16 @@ export async function createServer(deps) {
             reply.code(404).send({ ok: false, error: validation.denialReason });
             return;
         }
+        const connector = validation.connector;
+        const enumError = validateEnumArgs(body.args, connector.args ?? []);
+        if (enumError) {
+            reply.code(400).send({ ok: false, error: enumError });
+            return;
+        }
         if (!deps.wsRelay.connected) {
             reply.code(503).send({ ok: false, error: 'Extension not connected' });
             return;
         }
-        const connector = validation.connector;
         const requiresApproval = connectorNeedsApproval(body.connector, connector);
         const approvalConfig = requiresApproval ? buildApprovalConfig() : undefined;
         const correlationId = randomUUID();
@@ -195,10 +201,20 @@ export async function createServer(deps) {
             ? createHash('sha256').update(meta.yamlContent).digest('hex').slice(0, 16)
             : undefined;
         const startTime = Date.now();
+        // Fan-out: expand "all" on enum args into sequential runs
+        const fanOut = expandFanOut(body.args, connector.args ?? []);
+        if (fanOut.isFanOut && requiresApproval) {
+            reply.code(400).send({
+                ok: false,
+                error: 'Fan-out (--region all) is not supported with approval-required connectors. Specify a single region.',
+            });
+            return;
+        }
+        const resolvedArgs = fanOut.argSets[0];
         try {
             deps.auditStore.insert(createAuditEvent({
                 type: 'command.start', connector: body.connector, user,
-                args: body.args,
+                args: fanOut.isFanOut ? body.args : resolvedArgs,
                 domains: connector.domains, capabilities: [...connector.capabilities],
                 correlationId, connectorHash,
             }));
@@ -207,24 +223,48 @@ export async function createServer(deps) {
             reply.code(500).send({ ok: false, error: 'Audit system unavailable \u2014 command blocked' });
             return;
         }
-        const runPipeline = async (requestId) => {
+        const runPipeline = async (requestId, runArgs) => {
             try {
-                const resp = await deps.wsRelay.send(connector, body.args, approvalConfig, undefined, requestId || undefined);
+                // Split pipeline: extension steps run in browser, daemon steps run here
+                const { extensionSteps, daemonSteps } = splitPipeline(connector.pipeline);
+                const extConnector = { ...connector, pipeline: extensionSteps };
+                const resp = await deps.wsRelay.send(extConnector, runArgs, approvalConfig, undefined, requestId || undefined);
+                // Run daemon-side steps (e.g. transform) if extension succeeded
+                let finalData = resp.data;
+                let finalVars = resp.vars ?? {};
+                if (resp.ok && daemonSteps.length > 0) {
+                    // Also include data row fields as vars for daemon transforms
+                    const dataVars = finalData.length > 0 ? finalData[0] : {};
+                    const mergedVars = { ...dataVars, ...finalVars };
+                    const daemonResult = runDaemonSteps({ steps: daemonSteps, data: finalData, vars: mergedVars, args: runArgs });
+                    finalData = daemonResult.data;
+                    finalVars = daemonResult.vars;
+                    // Merge daemon vars back into data rows
+                    if (finalData.length > 0) {
+                        for (const row of finalData) {
+                            for (const [k, v] of Object.entries(finalVars)) {
+                                if (connector.columns?.some(c => c.name === k) && !(k in row)) {
+                                    row[k] = v;
+                                }
+                            }
+                        }
+                    }
+                }
                 const durationMs = Date.now() - startTime;
                 deps.auditStore.insert(createAuditEvent({
                     type: resp.ok ? 'command.success' : 'command.error',
                     connector: body.connector, user,
-                    args: body.args,
+                    args: runArgs,
                     domains: connector.domains, capabilities: [...connector.capabilities],
-                    rowCount: resp.data.length,
+                    rowCount: finalData.length,
                     columns: connector.columns?.map(c => c.name),
                     durationMs, error: resp.error,
                     correlationId, connectorHash, steps: resp.steps,
                 }));
                 return {
-                    ok: resp.ok, connector: body.connector, rowCount: resp.data.length,
+                    ok: resp.ok, connector: body.connector, rowCount: finalData.length,
                     columns: connector.columns?.map(c => c.name) ?? [],
-                    data: resp.data, error: resp.error, durationMs,
+                    data: finalData, error: resp.error, durationMs,
                     requestId, requiresApproval,
                 };
             }
@@ -233,16 +273,50 @@ export async function createServer(deps) {
                 const error = err instanceof Error ? err.message : 'Unknown error';
                 deps.auditStore.insert(createAuditEvent({
                     type: 'command.error', connector: body.connector, user,
-                    args: body.args, durationMs, error,
+                    args: runArgs, durationMs, error,
                     correlationId, connectorHash,
                 }));
                 return { ok: false, data: [], error, durationMs, requestId, requiresApproval };
             }
         };
+        if (fanOut.isFanOut) {
+            const { fanOutArgName } = fanOut;
+            const allData = [];
+            const errors = [];
+            for (const argSet of fanOut.argSets) {
+                const result = await runPipeline('', argSet);
+                if (result.ok) {
+                    for (const row of result.data) {
+                        row[fanOutArgName] = argSet[fanOutArgName];
+                        allData.push(row);
+                    }
+                }
+                else if (result.error) {
+                    errors.push(`${argSet[fanOutArgName]}: ${result.error}`);
+                }
+            }
+            const columns = connector.columns?.map(c => c.name) ?? [];
+            if (!columns.includes(fanOutArgName)) {
+                columns.unshift(fanOutArgName);
+            }
+            const durationMs = Date.now() - startTime;
+            const hasErrors = errors.length > 0;
+            return {
+                ok: !hasErrors || allData.length > 0,
+                connector: body.connector,
+                rowCount: allData.length,
+                columns,
+                data: allData,
+                error: hasErrors ? errors.join('; ') : undefined,
+                durationMs,
+                requestId: '',
+                requiresApproval: false,
+            };
+        }
         if (requiresApproval) {
             const requestId = randomUUID();
             sse.waitForConnection(requestId, SSE_CONNECT_TIMEOUT_MS)
-                .then(() => runPipeline(requestId))
+                .then(() => runPipeline(requestId, resolvedArgs))
                 .then(result => {
                 sse.send(requestId, 'result', result);
                 sse.remove(requestId);
@@ -251,7 +325,7 @@ export async function createServer(deps) {
                 const durationMs = Date.now() - startTime;
                 deps.auditStore.insert(createAuditEvent({
                     type: 'command.error', connector: body.connector, user,
-                    args: body.args, durationMs,
+                    args: resolvedArgs, durationMs,
                     error: err instanceof Error ? err.message : 'SSE timeout',
                 }));
             });
@@ -261,7 +335,7 @@ export async function createServer(deps) {
             });
         }
         else {
-            const result = await runPipeline('');
+            const result = await runPipeline('', resolvedArgs);
             if (!result.ok) {
                 reply.code(500).send(result);
                 return;