stageflow 0.33.0 → 0.36.0

package/examples/triggers-readiness/stageflow.yaml

@@ -0,0 +1,13 @@
+version: 1
+model: cursor/auto
+catalog:
+  pipelines:
+    - .
+  tasks:
+    - .
+  triggers:
+    - triggers
+  patterns:
+    pipeline: "*.pipeline.yaml"
+    task: "*.task.yaml"
+    trigger: "*.trigger.yaml"

package/examples/triggers-readiness/triggers/readiness-dynamic-manual.trigger.yaml

@@ -0,0 +1,4 @@
+id: readiness-dynamic-manual
+pipeline: readiness
+kind: manual
+enabled: false

package/examples/triggers-readiness/triggers/readiness-email.trigger.yaml

@@ -0,0 +1,12 @@
+id: readiness-email
+pipeline: readiness
+task: readiness-task
+kind: event
+enabled: false
+event:
+  source: email.message
+  config:
+    host: imap.example.com
+    port: 993
+    user: notifications@example.com
+    secretRef: EMAIL_PASSWORD

package/examples/triggers-readiness/triggers/readiness-github-pr.trigger.yaml

@@ -0,0 +1,12 @@
+id: readiness-github-pr
+pipeline: readiness
+task: readiness-task
+kind: event
+enabled: false
+event:
+  source: github.pull_request
+  match:
+    action: opened
+  config:
+    repo: tejasghutukade/stageflow
+    secretRef: GITHUB_TOKEN

package/examples/triggers-readiness/triggers/readiness-manual.trigger.yaml

@@ -0,0 +1,5 @@
+id: readiness-manual
+pipeline: readiness
+task: readiness-task
+kind: manual
+enabled: true

package/examples/triggers-readiness/triggers/readiness-schedule.trigger.yaml

@@ -0,0 +1,8 @@
+id: readiness-schedule
+pipeline: readiness
+task: readiness-task
+kind: schedule
+enabled: false
+schedule:
+  cron: "*/5 * * * *"
+  timezone: UTC

package/examples/triggers-readiness/triggers/readiness-webhook.trigger.yaml

@@ -0,0 +1,11 @@
+id: readiness-webhook
+pipeline: readiness
+task: readiness-task
+kind: event
+enabled: false
+event:
+  source: webhook
+  config:
+    secretRef: WEBHOOK_SECRET
+    header: x-hub-signature-256
+    scheme: hex

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "stageflow",
-  "version": "0.33.0",
+  "version": "0.36.0",
   "description": "Stageflow — CLI pipeline runtime for configurable stages on Pi",
   "type": "module",
   "main": "./dist/index.js",
@@ -82,11 +82,11 @@
     "@modelcontextprotocol/node": "^2.0.0",
     "@modelcontextprotocol/server": "^2.0.0",
     "better-sqlite3": "^13.0.3",
+    "croner": "^10.0.1",
     "imapflow": "^2.2.5",
+    "jiti": "^2.7.0",
     "mailparser": "^3.9.36",
     "nodemailer": "^10.0.15",
-    "croner": "^10.0.1",
-    "jiti": "^2.7.0",
     "octokit": "^5.0.5",
     "pi-cursor-sdk": "^0.5.0",
     "pi-mcp-adapter": "^2.32.1",
@@ -98,5 +98,10 @@
   },
   "allowScripts": {
     "better-sqlite3@13.0.3": true
+  },
+  "optionalDependencies": {
+    "@spectrum-ts/core": "12.10.1",
+    "@spectrum-ts/imessage": "12.10.1",
+    "@spectrum-ts/whatsapp-business": "12.10.1"
   }
 }

package/skills/stageflow/references/control-surface.md

@@ -15,7 +15,7 @@ The script `GET`s `{baseUrl}/api/health` (default `http://127.0.0.1:3847`, 1500
 
 Stdout is one line: `up <baseUrl>` or `down <baseUrl>`, with an optional trailing `bearer` when `STAGEFLOW_CONTROL_TOKEN` or `STAGEFLOW_CONTROL_TOKEN_FILE` is set in this environment (MCP/Compose need `Authorization: Bearer` — see [`../../stageflow-run/references/mcp-call.md`](../../stageflow-run/references/mcp-call.md)). Exit `0` when up, `1` when down, `2` on usage error.
 
-**Health is not auth.** `GET /api/health` is ungated (Host/Origin only — no bearer). Do **not** treat a health 200 as authenticated MCP. Non-loopback and Compose Hosts require a drive bearer (`STAGEFLOW_CONTROL_TOKEN`); MCP and protected API calls need `Authorization: Bearer <drive-token>` when a control token is set. See Stageflow docs: MCP (Access control); Docker and self-hosting — Local try.
+**Health is not auth.** `GET /api/health` is ungated (Host/Origin only — no bearer). Do **not** treat a health 200 as authenticated MCP. Non-loopback Hosts require a drive bearer (`STAGEFLOW_CONTROL_TOKEN`) unless `STAGEFLOW_ALLOW_UNAUTHENTICATED_BIND=1` (the shipped local Compose file sets that and publishes `127.0.0.1` only). MCP and protected API calls need `Authorization: Bearer <drive-token>` when a control token is set. See Stageflow docs: MCP (Access control); Docker and self-hosting — Local try.
 
 Start a host with `sf ui` or `sf mcp` when the user wants MCP. Do not auto-start one. Compose local try is the standing-Host path — see `stageflow-setup` and Stageflow docs: Docker and self-hosting.
 

package/skills/stageflow-author/references/catalog-write-conventions.md

@@ -18,9 +18,9 @@ One directory (or the project root) holds:
 | File | Required fields |
 |---|---|
 | `<pipeline-id>.pipeline.yaml` | `id` matching the filename stem; `stages:` array of object entries |
-| `<stage-id>.yaml` | `id`, `system_prompt`; `model` when not inherited; required `io.input.schema` and `io.output.schema`; `verify` / `gate_kinds` when the step needs them |
+| `<stage-id>.yaml` | `id`, `system_prompt`; `model` when not inherited; required `io.input.schema` and `io.output.schema`; optional `skill:`; `verify` / `gate_kinds` when the step needs them |
 
-Each pipeline stage entry has `id` and `uses: ./<id>.yaml` (path relative to the pipeline file). At least one root marks `entry: true`. Sources list forward `route: [{ to: <id> }, …]`. Optional `on:` is skip-cascade policy (default succeeded-only); it does not launch from skipped/failed. Optional `if` gates a successor after the source succeeds (predicate on required `io.output.schema` fields). A review that can send work back adds `{ type: loop, to, max_replays, on_max_replays, replay_session }` inside `route`. A Clone Chain emitter puts `clone_cap` and `clone_mode` on that **pipeline entry**, never on the reusable stage body. Put `on_verify_fail` on the pipeline entry when after-phase `verify` should repair or wait for an operator. `secrets` and `requires` may sit on the stage body or the `uses:` wrapper — stages get a curated env, not Host ambient credentials; see [`catalog-mapping.md`](catalog-mapping.md#stage-secrets). Filename stem matches `id`. Optional pipeline-root `model` fills stages that omit `model`. Sequencing rules: [`catalog-mapping.md`](catalog-mapping.md). Catalog load rejects `needs`, `fork`, and `feedback_loop` as YAML keys.
+Each pipeline stage entry has `id` and `uses: ./<id>.yaml` (path relative to the pipeline file). At least one root marks `entry: true`. Sources list forward `route: [{ to: <id> }, …]`. Optional `on:` is skip-cascade policy (default succeeded-only); it does not launch from skipped/failed. Optional `if` gates a successor after the source succeeds (predicate on required `io.output.schema` fields). A review that can send work back adds `{ type: loop, to, max_replays, on_max_replays, replay_session }` inside `route`. A Clone Chain emitter puts `clone_cap` and `clone_mode` on that **pipeline entry**, never on the reusable stage body. Put `on_verify_fail` on the pipeline entry when after-phase `verify` should repair or wait for an operator. Put `skill:` on the **stage file** (or inline body), never on a `uses:` wrapper. `secrets` and `requires` may sit on the stage body or the `uses:` wrapper — stages get a curated env, not Host ambient credentials; see [`catalog-mapping.md`](catalog-mapping.md#stage-secrets). Filename stem matches `id`. Optional pipeline-root `model` fills stages that omit `model`. Sequencing rules: [`catalog-mapping.md`](catalog-mapping.md). Catalog load rejects `needs`, `fork`, and `feedback_loop` as YAML keys.
 
 ## Collisions
 

package/skills/stageflow-run/SKILL.md

@@ -37,7 +37,7 @@ node ../stageflow/scripts/detect-host.mjs --base-url http://127.0.0.1:3847
 | `up <baseUrl>` … | [MCP path](#mcp-path) |
 | `down <baseUrl>` | [CLI path](#cli-path) |
 
-Optional trailing `bearer` means `STAGEFLOW_CONTROL_TOKEN` (or `_FILE`) is set in this environment — send it on MCP via [`mcp-call.md`](references/mcp-call.md) (Compose / non-loopback Hosts require a token). `/api/health` stays unauthenticated; the probe does not break loopback.
+Optional trailing `bearer` means `STAGEFLOW_CONTROL_TOKEN` (or `_FILE`) is set in this environment — send it on MCP via [`mcp-call.md`](references/mcp-call.md). A non-loopback Host requires a token unless `STAGEFLOW_ALLOW_UNAUTHENTICATED_BIND=1`. `/api/health` stays unauthenticated; the probe does not break loopback.
 
 **Done when** you have `up` or `down` and the base URL.
 

package/skills/stageflow-run/references/mcp-call.md

@@ -10,7 +10,7 @@ Default `--base-url` is `http://127.0.0.1:3847`. `--args` defaults to `{}`.
 
 ## Auth
 
-When `STAGEFLOW_CONTROL_TOKEN` or `STAGEFLOW_CONTROL_TOKEN_FILE` is set, the script sends `Authorization: Bearer <token>` on every `/mcp` request (initialize, tools/call, session DELETE). Docker Compose and any non-loopback Host require a drive token — set the same env in the harness before calling. Loopback with no token stays unauthenticated. `/api/health` (detect-host) does not need a bearer.
+When `STAGEFLOW_CONTROL_TOKEN` or `STAGEFLOW_CONTROL_TOKEN_FILE` is set, the script sends `Authorization: Bearer <token>` on every `/mcp` request (initialize, tools/call, session DELETE). A non-loopback Host requires a drive token unless `STAGEFLOW_ALLOW_UNAUTHENTICATED_BIND=1` (the shipped local Compose file sets that). When a token is set, put the same env in the harness before calling. Loopback with no token stays unauthenticated. `/api/health` (detect-host) does not need a bearer.
 
 ## Session
 

package/skills/stageflow-setup/SKILL.md

@@ -123,7 +123,7 @@ Do not invent compose flags or env names. See Stageflow docs: Docker and self-ho
 
 1. From a Stageflow checkout (or image + compose that matches shipped contracts), copy `.env.example` → `.env`. Do not commit `.env`.
 
-2. Set `STAGEFLOW_CONTROL_TOKEN` to ≥32 characters, no whitespace (e.g. `openssl rand -hex 32`). Required when the image binds non-loopback.
+2. The shipped Compose file sets `STAGEFLOW_ALLOW_UNAUTHENTICATED_BIND=1` and publishes `127.0.0.1:3847` only, so no control token is required. If you remove that opt-in, set `STAGEFLOW_CONTROL_TOKEN` to ≥32 characters, no whitespace (e.g. `openssl rand -hex 32`).
 
 3. Set Host boot providers as `STAGEFLOW_PROVIDER_<ID>_API_KEY` or `_FILE` (e.g. `STAGEFLOW_PROVIDER_OPENROUTER_API_KEY`). Not bare `OPENROUTER_API_KEY` alone.