Skip to content

station-v0.19 · airlock bridge + MCP workflow tools + 10 wired handlers

Choose a tag to compare

View all tags
@SamyBchaalia SamyBchaalia released this 23 Jul 09:35
station-v0.19
2005473

Studio's Builder now composes bridge-ready specs → each row of a run materializes an airlock preview → human approves → real send + signed receipt.

Ships:

  • Builder → airlock bridge: LLM emits command_id + inputs_template per step, flow_engine substitutes per row, /api/flow/run creates pending airlock previews grouped by workflow_run
  • Approval-replay fix: single-use approvals (attempted once, then invalidated regardless of outcome)
  • MCP workflow tools: railcall_workflow_list, railcall_workflow_run, railcall_pending_list — external AI can drive a workflow; human still gates every write in Studio's Sends UI
  • Vault-backed credential storage with in-Studio Configure UI (no more env-var exports)
  • Programs Run button + inline data-file dropdown
  • Prompt secret redaction (10 formats: stripe/openai/anthropic/github/slack/aws/google/discord webhook/bearer/pk_*)
  • Versioned workflow filenames (no more silent overwrites)
  • Client-side elapsed timer during compose

Wired airlock command handlers (10):

  • local.csv_append, local.file_write — governed local disk writes, atomic
  • discord.post_message, slack.post_webhook — webhook messaging
  • webhook.post_generic — POST to any URL (Zapier catch-hooks, custom services)
  • github.create_issue — Bearer + owner/repo in vault
  • notion.add_page — Bearer + Notion-Version header, database_id in vault
  • linear.create_issue — GraphQL, raw-key auth (Linear quirk)
  • airtable.create_record — Bearer + base/table in vault
  • pagerduty.trigger_incident — routing-key auth, Events API v2
  • stripe.create_refund — Bearer + form-encoded + Idempotency-Key from airlock payload_hash (no double-refund on wire retry)
  • twilio.send_sms — HTTP Basic Auth + form body
  • sendgrid.send_email — Bearer + JSON, X-Message-Id captured for receipt

Auth patterns proven: Bearer, Bearer+version-header, raw-key, HTTP Basic, routing-key-in-body, JSON body, form-encoded body, GraphQL. Any new provider = ~30 line handler in this pattern.

Sha-256 (verify before pinning):

3e19dedb54682b394e32681b5d97957063bb89ac49368fbdc80524a502baed52  railcall_station.tar.gz

engine=f4a0534f3 built=2026-07-23

Assets 3
Loading