Workspaces should be able to ship reusable scripts that workflows can explicitly invoke.

Today, workflows can run inline commands, but there is no first-class way for a workspace to deliver scripts that workflow stages can depend on. This makes automation brittle for tasks like starting AWS CodeBuild jobs, updating Demovoice videos, checking release state, or doing workspace-specific API calls.

Proposal

• Support workspace scripts under:

.elasticclaw/workspaces/<workspace>/scripts/

• Deliver those files into the claw workspace at a predictable path, so workflows can reference them as:

scripts/foo.py
scripts/build_android.py
scripts/update_video.js

• Scripts should not auto-run. They are workspace-owned assets only.
• Workflows should invoke them explicitly from on_enter.run.command.

Example:

stages:
  - id: build_android
    on_enter:
      run:
        command: python3 scripts/start_codebuild.py
        output: codebuild

  - id: notify_agent
    on_enter:
      inject: |
        CodeBuild started.

        Build ID: {{ .Outputs.codebuild.build_id }}
        Build URL: {{ .Outputs.codebuild.url }}

Requirements

• Preserve the scripts/ directory structure from the workspace.
• Make it obvious in logs/status that workspace scripts are being installed.
• Scripts should be available before any workflow on_enter.run.command executes.
• Bash, Python, and Node scripts should be supported, either by ensuring runtimes are present or by failing with clear diagnostics.
• The workflow runner should capture script execution results:
  • exit code
  • stdout
  • stderr
  • parsed JSON output from stdout when available
• Named outputs from on_enter.run.output should be available to later workflow templates, for example {{ .Outputs.codebuild.build_id }}.
• Outputs should be persisted in workflow/pipeline state so they survive hub restarts.
• Failed scripts should surface actionable diagnostics, including relevant stdout/stderr.
• Scripts should not be able to escape the workspace scripts root through path traversal or unsafe symlinks.

Acceptance criteria

• Given .elasticclaw/workspaces/acme/scripts/start_codebuild.py, a workflow in workspace acme can run python3 scripts/start_codebuild.py.
• The script is present before the stage command runs.
• If the script prints JSON to stdout and the run config declares output: codebuild, later stages can reference values via {{ .Outputs.codebuild.* }}.
• Missing scripts, failed scripts, and unavailable runtimes produce clear dashboard/agent diagnostics.
• Tests cover script delivery, explicit workflow invocation, output capture, JSON parsing, persistence, and failure cases.