@fieldwangai/agentflow 0.1.138 → 0.1.142

package/bin/lib/ui-server.mjs

@@ -83,7 +83,7 @@ import {
 } from "./composer-log.mjs";
 import { runNodeScript } from "./pipeline-scripts.mjs";
 import { computeNextRunAt, readFlowSchedule, writeFlowSchedule } from "./schedule-config.mjs";
-import { listScheduleStatuses } from "./scheduler.mjs";
+import { cancelScheduledRun, listScheduleStatuses } from "./scheduler.mjs";
 import {
   mergeWorkspaceGraphs,
   workspaceDesignRevision,
@@ -153,6 +153,7 @@ import {
 } from "./workspace-collaboration.mjs";
 import {
   addPrdWorkflowCollaborationMember,
+  bindPrdWorkflowProject,
   ensurePrdWorkflowCollaboration,
   getPrdWorkflowCollaborationById,
   getPrdWorkflowCollaborationByShareToken,
@@ -161,12 +162,14 @@ import {
   ensurePrdWorkflowShareLink,
   listPrdWorkflowCollaborationsForUser,
   listPrdWorkflowCollaborationsForTeam,
+  listPrdWorkflowProjectBindings,
   prdWorkflowCollaborationAccess,
   prdWorkflowCollaborationSummary,
   removePrdWorkflowCollaborationMember,
   revokePrdWorkflowShareLink,
   setPrdWorkflowKnowledgeBindings,
   syncPrdWorkflowAuthority,
+  unbindPrdWorkflowProject,
 } from "./prd-workflow-collaboration.mjs";
 import {
   createTeam,
@@ -185,6 +188,8 @@ import {
   mergeWorkflowArtifactLists,
   mergeWorkflowArtifacts,
   mergeWorkflowGlobalState,
+  isSafeWorkflowUrl,
+  normalizeWorkflowChecklistItemStatus,
   normalizeWorkflowReference,
   normalizeWorkflowReport,
   removeWorkflowGlobalStatePath,
@@ -3592,6 +3597,95 @@ function prdWorkflowShareLinkSummary(record, shareToken, publicBaseUrl, userId =
   };
 }
 
+function listAccessibleProjectFlows(root, userCtx = {}) {
+  const flows = listFlowsJson(root, { ...userCtx, includeWorkspaceFlows: true })
+    .filter((flow) => (
+      !workspaceFlowCollaborationGuard(
+        flow.id,
+        flow.source || "user",
+        flow.archived === true,
+        userCtx,
+        "read",
+      )
+    ))
+    .map((flow) => {
+      const source = flow.source || "user";
+      const collaboration = source === "workspace"
+        ? getWorkspaceCollaborationByFlow(flow.id, flow.archived === true)
+        : getWorkspaceCollaborationForProject({
+            flowId: flow.id,
+            flowSource: source,
+            archived: flow.archived === true,
+            ownerId: userCtx.userId,
+          });
+      return collaboration
+        ? { ...flow, collaboration: workspaceCollaborationSummaryWithUsers(collaboration, userCtx.userId) }
+        : flow;
+    });
+  const existingCollaborationIds = new Set(flows.map((flow) => flow.collaboration?.id).filter(Boolean));
+  for (const record of listWorkspaceCollaborationsForUser(userCtx.userId)) {
+    const source = record.projectSource || record.flowSource || "workspace";
+    if (source !== "user" || record.ownerId === userCtx.userId) continue;
+    if (existingCollaborationIds.has(record.id)) continue;
+    const ownerFlow = listFlowsJson(root, { userId: record.ownerId })
+      .find((flow) => (
+        flow.id === record.flowId
+        && (flow.source || "user") === "user"
+        && Boolean(flow.archived) === Boolean(record.archived)
+      ));
+    if (!ownerFlow) continue;
+    flows.push({
+      ...ownerFlow,
+      collaboration: workspaceCollaborationSummaryWithUsers(record, userCtx.userId),
+    });
+    existingCollaborationIds.add(record.id);
+  }
+  return flows;
+}
+
+function workflowProjectBindingRows(bindings = [], accessibleProjects = [], userCtx = {}) {
+  return (Array.isArray(bindings) ? bindings : []).flatMap((binding) => {
+    const workspaceId = String(binding?.workspaceId || "").trim();
+    if (!workspaceId) return [];
+    const project = accessibleProjects.find((flow) => String(flow?.collaboration?.id || "") === workspaceId);
+    if (!project) return [];
+    const role = String(project.collaboration?.role || "");
+    return [{
+      workspaceId,
+      flowId: String(project.id || binding.flowId || ""),
+      flowSource: String(project.source || binding.flowSource || "user"),
+      archived: project.archived === true,
+      label: String(project.id || binding.flowId || "Project"),
+      description: String(project.description || ""),
+      role: role || ((project.source || "user") === "user" ? "owner" : "editor"),
+      canManage: role === "owner" || role === "editor" || (!role && (project.source || "user") === "user"),
+      boundBy: String(binding.boundBy || ""),
+      boundAt: String(binding.boundAt || ""),
+    }];
+  });
+}
+
+function availableWorkflowBindingProjects(accessibleProjects = [], bindings = []) {
+  const bound = new Set((Array.isArray(bindings) ? bindings : []).map((item) => String(item?.workspaceId || "")).filter(Boolean));
+  return accessibleProjects
+    .filter((project) => {
+      const source = String(project?.source || "user");
+      const role = String(project?.collaboration?.role || "");
+      const workspaceId = String(project?.collaboration?.id || "");
+      return !project?.archived
+        && (source === "user" || source === "workspace")
+        && !bound.has(workspaceId)
+        && (!role || role === "owner" || role === "editor");
+    })
+    .map((project) => ({
+      flowId: String(project.id || ""),
+      flowSource: String(project.source || "user"),
+      workspaceId: String(project.collaboration?.id || ""),
+      label: String(project.id || "Project"),
+      description: String(project.description || ""),
+    }));
+}
+
 function prdWorkflowDashboardActions(snapshot = {}) {
   const rows = new Map();
   for (const field of ["actions", "workflowActions", "workflow_actions", "timeline", "history"]) {
@@ -3639,7 +3733,7 @@ function prdWorkflowDashboardTimestamp(item = {}) {
   return 0;
 }
 
-function prdWorkflowDashboardSummary(record, snapshot = {}, userCtx = {}) {
+function prdWorkflowDashboardSummary(record, snapshot = {}, userCtx = {}, projectBindings = []) {
   const tapdId = String(record?.tapdId || snapshot?.tapdId || snapshot?.tapd_id || "").trim();
   const collaboration = prdWorkflowCollaborationSummaryWithUsers(record, userCtx?.userId) || {};
   const actions = prdWorkflowDashboardActions(snapshot);
@@ -3669,11 +3763,11 @@ function prdWorkflowDashboardSummary(record, snapshot = {}, userCtx = {}) {
     ? snapshot.overall.requirement
     : {};
   const title = String(
-    requirement.title
+    snapshot?.globalState?.title
+    || requirement.title
     || requirement.name
     || snapshot?.prd?.title
     || snapshot?.raw?.prd?.title
-    || snapshot?.title
     || "",
   ).trim();
   const timeline = Array.isArray(snapshot?.projections?.timeline)
@@ -3685,6 +3779,8 @@ function prdWorkflowDashboardSummary(record, snapshot = {}, userCtx = {}) {
           id: String(entry.id || ""),
           title: String(entry.title || entry.label || entry.id || ""),
           date: String(entry.date || ""),
+          startDate: String(entry.startDate || entry.start_date || entry.start || ""),
+          endDate: String(entry.endDate || entry.end_date || entry.end || entry.date || ""),
           source: String(entry.source || ""),
           dimensions: entry.dimensions && typeof entry.dimensions === "object" && !Array.isArray(entry.dimensions)
             ? entry.dimensions
@@ -3727,10 +3823,73 @@ function prdWorkflowDashboardSummary(record, snapshot = {}, userCtx = {}) {
     teamName: String(getTeamById(collaboration.teamId)?.name || ""),
     shareActive: collaboration.shareActive === true,
     updatedAt: updatedAtTimestamp ? new Date(updatedAtTimestamp).toISOString() : String(record?.updatedAt || ""),
+    projectBindings,
   };
 }
 
-function prdWorkflowDashboardTimeline(workflows = []) {
+function prdWorkflowDashboardTimelineDimensionValues(value) {
+  return (Array.isArray(value) ? value : [value])
+    .flatMap((item) => Array.isArray(item) ? item : [item])
+    .map((item) => String(item ?? "").trim())
+    .filter(Boolean);
+}
+
+function prdWorkflowDashboardTimelineIdentity(entry = {}) {
+  const id = String(entry?.id || "").trim();
+  const source = String(entry?.source || "").trim().toLowerCase();
+  const kind = String(entry?.kind || "").trim().toLowerCase();
+  const dimensions = entry?.dimensions && typeof entry.dimensions === "object" && !Array.isArray(entry.dimensions)
+    ? entry.dimensions
+    : {};
+  const legacyPlatformIdentity = id.match(/^(android|ios|all)[:_-](.+)$/i);
+  const declaredPlatforms = [
+    ...prdWorkflowDashboardTimelineDimensionValues(dimensions.platform),
+    ...prdWorkflowDashboardTimelineDimensionValues(dimensions.platforms),
+  ].map((value) => value.toLowerCase());
+  if (
+    source === "prd-flow"
+    && ["version", "iteration"].includes(kind)
+    && legacyPlatformIdentity
+    && declaredPlatforms.includes(legacyPlatformIdentity[1].toLowerCase())
+  ) {
+    return legacyPlatformIdentity[2].trim().toLowerCase();
+  }
+  return id.toLowerCase();
+}
+
+function prdWorkflowDashboardTimelineGroupKey(entry = {}) {
+  const source = String(entry?.source || "").trim().toLowerCase();
+  const kind = String(entry?.kind || "").trim().toLowerCase();
+  const identity = prdWorkflowDashboardTimelineIdentity(entry);
+  const dimensions = entry?.dimensions && typeof entry.dimensions === "object" && !Array.isArray(entry.dimensions)
+    ? entry.dimensions
+    : {};
+  const nonPlatformDimensions = Object.entries(dimensions)
+    .filter(([key]) => !["platform", "platforms", "client", "clients", "os"].includes(String(key).trim().toLowerCase()))
+    .map(([key, value]) => [
+      String(key).trim().toLowerCase(),
+      prdWorkflowDashboardTimelineDimensionValues(value).map((item) => item.toLowerCase()).sort(),
+    ])
+    .sort(([left], [right]) => left.localeCompare(right));
+  if (identity) return JSON.stringify([source, kind, identity, nonPlatformDimensions]);
+  return String(entry?.key || [entry?.source, entry?.kind, entry?.id].filter(Boolean).join(":"));
+}
+
+function prdWorkflowDashboardMergeTimelineDimensions(current = {}, incoming = {}) {
+  const out = {};
+  for (const key of new Set([...Object.keys(current || {}), ...Object.keys(incoming || {})])) {
+    const values = [
+      ...prdWorkflowDashboardTimelineDimensionValues(current?.[key]),
+      ...prdWorkflowDashboardTimelineDimensionValues(incoming?.[key]),
+    ];
+    const unique = Array.from(new Map(values.map((value) => [value.toLowerCase(), value])).values());
+    if (unique.length === 1) out[key] = unique[0];
+    else if (unique.length > 1) out[key] = unique;
+  }
+  return out;
+}
+
+export function prdWorkflowDashboardTimeline(workflows = []) {
   const buckets = new Map();
   const assignedWorkflowIds = new Set();
   const rows = [...(Array.isArray(workflows) ? workflows : [])].sort((left, right) => {
@@ -3744,16 +3903,19 @@ function prdWorkflowDashboardTimeline(workflows = []) {
     const workflowId = String(workflow?.id || workflow?.tapdId || "");
     const seen = new Set();
     for (const entry of Array.isArray(workflow?.timeline) ? workflow.timeline : []) {
-      const key = String(entry?.key || [entry?.source, entry?.kind, entry?.id].filter(Boolean).join(":"));
-      if (!key || seen.has(key)) continue;
-      seen.add(key);
+      const memberKey = String(entry?.key || [entry?.source, entry?.kind, entry?.id].filter(Boolean).join(":"));
+      const identity = prdWorkflowDashboardTimelineIdentity(entry);
+      const groupKey = prdWorkflowDashboardTimelineGroupKey(entry);
+      if (!memberKey || !groupKey) continue;
       assignedWorkflowIds.add(workflowId);
-      const current = buckets.get(key) || {
-        key,
+      const current = buckets.get(groupKey) || {
+        key: memberKey,
         kind: String(entry.kind || ""),
-        id: String(entry.id || ""),
+        id: identity || String(entry.id || ""),
         title: String(entry.title || entry.id || ""),
         date: String(entry.date || ""),
+        startDate: String(entry.startDate || ""),
+        endDate: String(entry.endDate || entry.date || ""),
         source: String(entry.source || ""),
         dimensions: entry.dimensions && typeof entry.dimensions === "object" && !Array.isArray(entry.dimensions)
           ? entry.dimensions
@@ -3763,21 +3925,27 @@ function prdWorkflowDashboardTimeline(workflows = []) {
         completedCount: 0,
         blockedCount: 0,
         workflowIds: [],
+        memberKeys: [],
       };
       current.kind = String(entry.kind || current.kind);
-      current.id = String(entry.id || current.id);
       current.title = String(entry.title || current.title);
       current.date = String(entry.date || current.date);
+      current.startDate = String(entry.startDate || current.startDate);
+      current.endDate = String(entry.endDate || entry.date || current.endDate);
       current.source = String(entry.source || current.source);
-      current.dimensions = entry.dimensions && typeof entry.dimensions === "object" && !Array.isArray(entry.dimensions)
-        ? entry.dimensions
-        : current.dimensions;
+      current.dimensions = prdWorkflowDashboardMergeTimelineDimensions(current.dimensions, entry.dimensions);
       current.order = Number.isFinite(Number(entry.order)) ? Number(entry.order) : current.order;
-      current.workflowCount += 1;
-      if (workflow?.state === "completed") current.completedCount += 1;
-      if (workflow?.state === "blocked") current.blockedCount += 1;
-      current.workflowIds.push(workflowId);
-      buckets.set(key, current);
+      if (!current.memberKeys.includes(memberKey)) current.memberKeys.push(memberKey);
+      current.memberKeys.sort();
+      current.key = current.memberKeys[0] || memberKey;
+      if (!seen.has(groupKey)) {
+        seen.add(groupKey);
+        current.workflowCount += 1;
+        if (workflow?.state === "completed") current.completedCount += 1;
+        if (workflow?.state === "blocked") current.blockedCount += 1;
+        if (!current.workflowIds.includes(workflowId)) current.workflowIds.push(workflowId);
+      }
+      buckets.set(groupKey, current);
     }
   }
   const timeline = Array.from(buckets.values()).sort((left, right) => {
@@ -3796,6 +3964,112 @@ function prdWorkflowDashboardTimeline(workflows = []) {
   };
 }
 
+function prdWorkflowTimelineTimestamp(value, endOfDay = false) {
+  const text = String(value || "").trim();
+  if (!text) return Number.NaN;
+  const timestamp = Date.parse(text);
+  if (!Number.isFinite(timestamp)) return Number.NaN;
+  return endOfDay && /^\d{4}-\d{2}-\d{2}$/.test(text)
+    ? timestamp + (24 * 60 * 60 * 1000) - 1
+    : timestamp;
+}
+
+export function prdWorkflowDefaultTimelineKey(timeline = [], now = Date.now()) {
+  const rows = (Array.isArray(timeline) ? timeline : [])
+    .map((entry) => ({
+      entry,
+      startAt: prdWorkflowTimelineTimestamp(entry?.startDate || entry?.start),
+      endAt: prdWorkflowTimelineTimestamp(entry?.endDate || entry?.end || entry?.date, true),
+    }))
+    .filter(({ entry, endAt }) => String(entry?.key || "").trim() && Number.isFinite(endAt));
+  const active = rows
+    .filter(({ startAt, endAt }) => Number.isFinite(startAt) && startAt <= now && now <= endAt)
+    .sort((left, right) => left.endAt - right.endAt);
+  if (active.length > 0) return String(active[0].entry.key);
+  const upcoming = rows
+    .filter(({ endAt }) => endAt >= now)
+    .sort((left, right) => left.endAt - right.endAt);
+  if (upcoming.length > 0) return String(upcoming[0].entry.key);
+  const latestPast = rows.sort((left, right) => right.endAt - left.endAt)[0];
+  return latestPast ? String(latestPast.entry.key) : "all";
+}
+
+function prdWorkflowDashboardSearchValues(workflow = {}) {
+  return [
+    workflow.tapdId,
+    workflow.title,
+    workflow.pointer,
+    workflow.phase,
+    workflow.ownerUsername,
+    workflow.latestAction?.title,
+    ...(Array.isArray(workflow.timeline) ? workflow.timeline : []).flatMap((entry) => [
+      entry?.title,
+      entry?.kind,
+      entry?.date,
+      ...Object.values(entry?.dimensions || {}).flatMap((value) => Array.isArray(value) ? value : [value]),
+    ]),
+  ];
+}
+
+export function prdWorkflowDashboardPage(workflows = [], dashboardTimeline = {}, options = {}) {
+  const allWorkflows = Array.isArray(workflows) ? workflows : [];
+  const timeline = Array.isArray(dashboardTimeline?.timeline) ? dashboardTimeline.timeline : [];
+  const unassignedCount = Number(dashboardTimeline?.unassignedCount || 0);
+  const defaultTimelineKey = prdWorkflowDefaultTimelineKey(timeline, options.now);
+  const requestedTimelineKey = String(options.timelineKey || "").trim();
+  const matchedTimeline = timeline.find((entry) => (
+    entry.key === requestedTimelineKey
+    || (Array.isArray(entry.memberKeys) && entry.memberKeys.includes(requestedTimelineKey))
+  ));
+  const selectedTimelineKey = requestedTimelineKey === "all"
+    ? "all"
+    : requestedTimelineKey === "unassigned" && unassignedCount > 0
+      ? "unassigned"
+      : matchedTimeline?.key || defaultTimelineKey;
+  const selectedTimeline = timeline.find((entry) => entry.key === selectedTimelineKey) || null;
+  const selectedWorkflowIds = new Set(
+    Array.isArray(selectedTimeline?.workflowIds)
+      ? selectedTimeline.workflowIds.map((value) => String(value))
+      : [],
+  );
+  const query = String(options.query || "").trim().toLowerCase();
+  const scope = ["owned", "collaborating"].includes(options.scope) ? options.scope : "all";
+  const state = ["active", "completed", "blocked"].includes(options.state) ? options.state : "all";
+  const filtered = allWorkflows.filter((workflow) => {
+    const workflowId = String(workflow?.id || workflow?.tapdId || "");
+    if (selectedTimelineKey === "unassigned" && (workflow.timeline || []).length > 0) return false;
+    if (selectedTimeline && !selectedWorkflowIds.has(workflowId)) return false;
+    if (scope === "owned" && workflow.role !== "owner") return false;
+    if (scope === "collaborating" && workflow.role === "owner") return false;
+    if (state !== "all" && workflow.state !== state) return false;
+    if (query && !prdWorkflowDashboardSearchValues(workflow).some(
+      (value) => String(value || "").toLowerCase().includes(query),
+    )) return false;
+    return true;
+  });
+  const requestedPageSize = Number.parseInt(String(options.pageSize || "20"), 10);
+  const pageSize = [20, 50, 100].includes(requestedPageSize) ? requestedPageSize : 20;
+  const total = filtered.length;
+  const totalPages = Math.max(1, Math.ceil(total / pageSize));
+  const requestedPage = Number.parseInt(String(options.page || "1"), 10);
+  const page = Math.min(totalPages, Math.max(1, Number.isFinite(requestedPage) ? requestedPage : 1));
+  const start = (page - 1) * pageSize;
+  return {
+    workflows: filtered.slice(start, start + pageSize),
+    availableCount: allWorkflows.length,
+    selectedTimelineKey,
+    defaultTimelineKey,
+    pagination: {
+      page,
+      pageSize,
+      total,
+      totalPages,
+      hasPrevious: page > 1,
+      hasNext: page < totalPages,
+    },
+  };
+}
+
 function workspaceConversationsPath(scopedRoot) {
   return path.join(path.resolve(scopedRoot), ".workspace", "agentflow", "conversations.json");
 }
@@ -8025,6 +8299,10 @@ function resolvePrdWorkflowScope(workspaceRoot, params = {}, userCtx = {}, capab
     return { error: "Admin permission required", status: 403 };
   }
   const adminOwner = adminOwnerId ? adminWorkspaceOwnerSummary(adminOwnerId) : null;
+  const adminVersionRepair = capability === "admin-version-repair";
+  if (adminVersionRepair && userCtx.isAdmin !== true) {
+    return { error: "Admin permission required", status: 403 };
+  }
   if (adminOwnerId && !adminOwner) {
     return { error: "Workspace owner not found", status: 404 };
   }
@@ -8040,19 +8318,24 @@ function resolvePrdWorkflowScope(workspaceRoot, params = {}, userCtx = {}, capab
     ? getPrdWorkflowCollaborationForUser(tapdId, userCtx?.userId)
     : null;
   const existingCollaboration = tapdId ? getPrdWorkflowCollaborationByTapdId(tapdId) : null;
-  if (!adminOwner && !linkCollaboration && existingCollaboration && !memberCollaboration) {
+  if (!adminOwner && !linkCollaboration && existingCollaboration && !memberCollaboration && !adminVersionRepair) {
     return { error: "PRD Workflow collaboration permission denied", status: 403 };
   }
-  const collaboration = adminOwner ? null : (linkCollaboration || memberCollaboration);
+  if (adminVersionRepair && !existingCollaboration) {
+    return { error: "PRD Workflow collaboration not found", status: 404 };
+  }
+  const collaboration = adminOwner ? null : (adminVersionRepair ? existingCollaboration : (linkCollaboration || memberCollaboration));
   const access = adminOwner
     ? { allowed: true, writable: false, role: "admin-viewer", via: "admin-review" }
+    : adminVersionRepair
+    ? { allowed: true, writable: true, role: "admin-version-repair", via: "admin-version-repair" }
     : linkCollaboration
     ? { allowed: true, writable: false, role: "viewer", via: "share-link" }
     : prdWorkflowCollaborationAccess(collaboration, userCtx?.userId);
   if (collaboration && !access.allowed) {
     return { error: "PRD Workflow collaboration permission denied", status: 403 };
   }
-  if (capability === "write" && (linkCollaboration || (collaboration && !access.writable))) {
+  if ((capability === "write" || adminVersionRepair) && (linkCollaboration || (collaboration && !access.writable))) {
     return { error: "PRD Workflow collaboration edit permission denied", status: 403 };
   }
   const ownerId = String(adminOwner?.userId || collaboration?.ownerId || userCtx?.userId || "").trim();
@@ -8085,6 +8368,7 @@ function resolvePrdWorkflowScope(workspaceRoot, params = {}, userCtx = {}, capab
     shareToken,
     sharedByLink: Boolean(linkCollaboration),
     adminReadonly: Boolean(adminOwner),
+    adminVersionRepair,
     flowId,
     flowSource,
     archived,
@@ -11392,6 +11676,72 @@ function prdWorkflowMergeProducerTimeline(report, currentSnapshot = {}) {
   };
 }
 
+function prdWorkflowAdminVersionRepairIntent(payload = {}, report = {}, userCtx = {}) {
+  const operation = String(
+    payload.adminOperation || payload.admin_operation || payload.administrativeOperation || payload.administrative_operation || "",
+  ).trim().toLowerCase();
+  if (!operation) return { requested: false };
+  if (operation !== "repair-version-membership") {
+    return { requested: true, status: 400, error: `Unsupported admin Workflow operation: ${operation}` };
+  }
+  if (userCtx.isAdmin !== true) {
+    return { requested: true, status: 403, error: "Admin permission required" };
+  }
+  const forbiddenKeys = ["action", "artifacts", "observation", "globalState", "global_state", "extensions", "extension"]
+    .filter((key) => Object.prototype.hasOwnProperty.call(payload, key));
+  if (forbiddenKeys.length) {
+    return {
+      requested: true,
+      status: 400,
+      error: `Admin version repair may only update projections.timeline; remove: ${forbiddenKeys.join(", ")}`,
+    };
+  }
+  const projections = payload.projections;
+  if (!projections || typeof projections !== "object" || Array.isArray(projections) || !Array.isArray(projections.timeline)) {
+    return { requested: true, status: 400, error: "Admin version repair requires projections.timeline" };
+  }
+  const extraProjectionKeys = Object.keys(projections).filter((key) => key !== "timeline");
+  if (extraProjectionKeys.length) {
+    return { requested: true, status: 400, error: "Admin version repair may only update projections.timeline" };
+  }
+  const nonVersionEntry = report?.projections?.timeline?.find((item) => String(item?.kind || "").trim().toLowerCase() !== "version");
+  if (nonVersionEntry) {
+    return { requested: true, status: 400, error: "Admin version repair only accepts timeline entries with kind=version" };
+  }
+  if (!report.idempotencyKey) {
+    return { requested: true, status: 400, error: "Admin version repair requires idempotencyKey" };
+  }
+  if (!report.expectedRevision) {
+    return { requested: true, status: 400, error: "Admin version repair requires expectedRevision" };
+  }
+  return { requested: true, operation };
+}
+
+function prdWorkflowMergeAdminVersionTimeline(report, currentSnapshot = {}) {
+  const source = prdWorkflowRuntimeEventProducer(report?.event || {});
+  const current = Array.isArray(currentSnapshot?.projections?.timeline) ? currentSnapshot.projections.timeline : [];
+  const incoming = Array.isArray(report?.projections?.timeline) ? report.projections.timeline : [];
+  const retained = current.filter((item) => (
+    prdWorkflowRuntimeEventProducer(item) !== source
+    || String(item?.kind || "").trim().toLowerCase() !== "version"
+  ));
+  const timeline = [...retained, ...incoming];
+  const administrativeRepair = {
+    kind: "version-attribution",
+    operation: "repair-version-membership",
+  };
+  return {
+    ...report,
+    projections: { ...report.projections, timeline },
+    event: {
+      ...report.event,
+      projections: { ...report.event.projections, timeline },
+      administrativeRepair,
+      administrative_repair: administrativeRepair,
+    },
+  };
+}
+
 function prdWorkflowRuntimeEventDedupeKey(event = {}, index = 0) {
   const producer = prdWorkflowRuntimeEventProducer(event);
   const operation = prdWorkflowRuntimeEventOperation(event);
@@ -11678,6 +12028,136 @@ function prdWorkflowGlobalStateFromEvents(tapdId, snapshot = {}, runtimeEvents =
   return state;
 }
 
+function prdWorkflowChecklistActionKey(action = {}) {
+  return String(
+    action?.actionModel?.key ||
+    action?.key ||
+    action?.actionKey ||
+    action?.action_key ||
+    action?.action ||
+    action?.actionId ||
+    action?.action_id ||
+    action?.stageKey ||
+    action?.stage_key ||
+    "",
+  ).trim();
+}
+
+function prdWorkflowChecklistResourceKey(producer, actionKey, itemKey) {
+  return `checklist:${String(producer || "").trim().toLowerCase()}:${String(actionKey || "").trim()}:${String(itemKey || "").trim()}`;
+}
+
+function prdWorkflowChecklistStateEntries(runtimeEvents = []) {
+  const states = new Map();
+  for (const event of Array.isArray(runtimeEvents) ? runtimeEvents : []) {
+    const state = event?.checklistState || event?.checklist_state;
+    if (!state || typeof state !== "object" || Array.isArray(state)) continue;
+    const producer = String(state.producer || state.source || "").trim().toLowerCase();
+    const actionKey = String(state.actionKey || state.action_key || "").trim();
+    const itemKey = String(state.itemKey || state.item_key || "").trim();
+    if (!producer || !actionKey || !itemKey) continue;
+    const resourceKey = prdWorkflowChecklistResourceKey(producer, actionKey, itemKey);
+    const version = workflowSnapshotResourceVersions({ runtimeEvents: [event] })[resourceKey] || "absent";
+    states.set(resourceKey, { ...state, producer, actionKey, itemKey, resourceKey, version });
+  }
+  return states;
+}
+
+function prdWorkflowMaterializeChecklists(snapshot = {}, runtimeEvents = []) {
+  const actionSources = new Map();
+  for (const event of Array.isArray(runtimeEvents) ? runtimeEvents : []) {
+    const actionKey = prdWorkflowChecklistActionKey(event);
+    const producer = String(event?.source || event?.producer || "").trim().toLowerCase();
+    if (!actionKey || !producer || (!event?.checklist && !event?.actionModel?.checklist)) continue;
+    const existing = actionSources.get(actionKey);
+    actionSources.set(actionKey, existing && existing !== producer ? "" : producer);
+  }
+  const stateEntries = prdWorkflowChecklistStateEntries(runtimeEvents);
+  const terminalStatuses = new Set(["passed", "skipped"]);
+  const decorate = (action) => {
+    if (!action || typeof action !== "object" || Array.isArray(action)) return action;
+    const definition = action.checklist || action.actionModel?.checklist;
+    if (!definition || typeof definition !== "object" || Array.isArray(definition)) return action;
+    const actionKey = prdWorkflowChecklistActionKey(action);
+    const producer = String(
+      definition.source || action.source || action.producer || action.actionModel?.source || actionSources.get(actionKey) || "",
+    ).trim().toLowerCase();
+    const items = (Array.isArray(definition.items) ? definition.items : []).map((item) => {
+      const itemKey = String(item?.key || item?.id || "").trim();
+      const resourceKey = producer && actionKey && itemKey
+        ? prdWorkflowChecklistResourceKey(producer, actionKey, itemKey)
+        : "";
+      const stored = resourceKey ? stateEntries.get(resourceKey) : null;
+      const state = stored || {
+        producer,
+        actionKey,
+        itemKey,
+        status: "pending",
+        note: "",
+        evidence: [],
+        resourceKey,
+        version: "absent",
+      };
+      return { ...item, state };
+    });
+    const required = items.filter((item) => item.required !== false);
+    const completed = items.filter((item) => terminalStatuses.has(String(item?.state?.status || "pending"))).length;
+    const requiredCompleted = required.filter((item) => terminalStatuses.has(String(item?.state?.status || "pending"))).length;
+    const completionPolicy = String(definition.completionPolicy || definition.completion_policy || "all_required").trim().toLowerCase();
+    const completionCandidates = required.length ? required : items;
+    const ready = completionPolicy === "manual"
+      ? false
+      : completionPolicy === "any_required"
+        ? completionCandidates.some((item) => terminalStatuses.has(String(item?.state?.status || "pending")))
+        : completionCandidates.length > 0 && completionCandidates.every((item) => terminalStatuses.has(String(item?.state?.status || "pending")));
+    const checklist = {
+      ...definition,
+      source: producer,
+      items,
+      progress: {
+        total: items.length,
+        completed,
+        required: required.length,
+        requiredCompleted,
+        percent: items.length ? Math.round((completed / items.length) * 100) : 0,
+        ready,
+      },
+    };
+    return {
+      ...action,
+      checklist,
+      ...(action.actionModel && typeof action.actionModel === "object" && !Array.isArray(action.actionModel)
+        ? { actionModel: { ...action.actionModel, checklist } }
+        : {}),
+    };
+  };
+  const out = { ...snapshot };
+  for (const key of ["actions", "workflowActions", "workflow_actions", "timeline", "history", "events", "runtimeEvents", "runtime_events"]) {
+    if (Array.isArray(snapshot?.[key])) out[key] = snapshot[key].map(decorate);
+  }
+  out.checklistStates = [...stateEntries.values()];
+  return out;
+}
+
+function prdWorkflowFindChecklistAction(snapshot = {}, producer = "", actionKey = "") {
+  const wantedProducer = String(producer || "").trim().toLowerCase();
+  const wantedActionKey = String(actionKey || "").trim();
+  const matches = [];
+  for (const key of ["actions", "workflowActions", "workflow_actions", "timeline", "history", "events", "runtimeEvents", "runtime_events"]) {
+    for (const action of Array.isArray(snapshot?.[key]) ? snapshot[key] : []) {
+      if (!action || typeof action !== "object" || Array.isArray(action)) continue;
+      const checklist = action.checklist || action.actionModel?.checklist;
+      if (!checklist || typeof checklist !== "object" || Array.isArray(checklist)) continue;
+      const resolvedActionKey = prdWorkflowChecklistActionKey(action);
+      const resolvedProducer = String(checklist.source || action.source || action.producer || "").trim().toLowerCase();
+      if (resolvedActionKey !== wantedActionKey) continue;
+      if (wantedProducer && resolvedProducer !== wantedProducer) continue;
+      matches.push({ ...action, checklist, source: resolvedProducer || wantedProducer });
+    }
+  }
+  return matches.at(-1) || null;
+}
+
 function prdWorkflowMergeRuntimeEvents(scopedRoot, tapdId, snapshot) {
   const runtime = prdWorkflowReadRuntimeEvents(scopedRoot, tapdId);
   const runtimeEvents = runtime.events;
@@ -11694,7 +12174,7 @@ function prdWorkflowMergeRuntimeEvents(scopedRoot, tapdId, snapshot) {
   for (const key of ["issues", "issueGroups", "issue_groups", "epics", "epicGroups", "epic_groups", "aiDocs", "ai_docs"]) {
     if (Object.prototype.hasOwnProperty.call(prdFlowExtension, key)) prdFlowExtensionView[key] = prdFlowExtension[key];
   }
-  const materialized = {
+  let materialized = {
     ...snapshot,
     ...prdFlowExtensionView,
     workflow: globalState.workflow,
@@ -11711,6 +12191,7 @@ function prdWorkflowMergeRuntimeEvents(scopedRoot, tapdId, snapshot) {
       runtimeEventsUpdatedAt: runtime.updatedAt || "",
     },
   };
+  materialized = prdWorkflowMaterializeChecklists(materialized, runtimeEvents);
   materialized.resourceVersions = workflowSnapshotResourceVersions(materialized);
   return materialized;
 }
@@ -13220,13 +13701,25 @@ export function startUiServer({
             ? getTeamById(requestedTeamId)
             : getTeamForUser(userCtx.userId);
           if (!team || team.status !== "active") {
-            json(res, 200, { ok: true, view: "team", team: null, workflows: [], timeline: [], unassignedCount: 0 });
+            json(res, 200, {
+              ok: true,
+              view: "team",
+              team: null,
+              workflows: [],
+              timeline: [],
+              unassignedCount: 0,
+              availableCount: 0,
+              selectedTimelineKey: "all",
+              defaultTimelineKey: "all",
+              pagination: { page: 1, pageSize: 20, total: 0, totalPages: 1, hasPrevious: false, hasNext: false },
+            });
             return;
           }
           records = listPrdWorkflowCollaborationsForTeam(team.id);
         } else {
           records = listPrdWorkflowCollaborationsForUser(userCtx.userId);
         }
+        const accessibleProjects = listAccessibleProjectFlows(root, userCtx);
         const workflows = records.map((record) => {
           const stateRoot = path.resolve(getAgentflowUserDataRoot(record.stateOwnerId || record.ownerId));
           const tapdId = String(record.tapdId || "").trim();
@@ -13235,14 +13728,23 @@ export function startUiServer({
           const legacy = prdWorkflowReadCachedSnapshot(stateRoot, tapdId);
           const snapshot = project?.snapshot || latestClient || legacy?.snapshot || {};
           const materialized = prdWorkflowMergeRuntimeEvents(stateRoot, tapdId, snapshot);
-          return prdWorkflowDashboardSummary(record, materialized, userCtx);
+          const projectBindings = workflowProjectBindingRows(record.projectBindings, accessibleProjects, userCtx);
+          return prdWorkflowDashboardSummary(record, materialized, userCtx, projectBindings);
         });
         const dashboardTimeline = prdWorkflowDashboardTimeline(workflows);
+        const dashboardPage = prdWorkflowDashboardPage(workflows, dashboardTimeline, {
+          timelineKey: url.searchParams.has("timelineKey") ? url.searchParams.get("timelineKey") : "",
+          query: url.searchParams.get("q"),
+          scope: url.searchParams.get("scope"),
+          state: url.searchParams.get("state"),
+          page: url.searchParams.get("page"),
+          pageSize: url.searchParams.get("pageSize"),
+        });
         json(res, 200, {
           ok: true,
           view: view === "team" ? "team" : "personal",
           team: teamSummaryWithUsers(team),
-          workflows,
+          ...dashboardPage,
           ...dashboardTimeline,
         });
       } catch (error) {
@@ -13373,6 +13875,177 @@ export function startUiServer({
       });
       return;
     }
+    if (req.method === "GET" && url.pathname === "/api/workflows/project-bindings") {
+      if (!authUser?.userId) {
+        json(res, 401, { error: "Authentication required" });
+        return;
+      }
+      const tapdId = String(url.searchParams.get("tapdId") || url.searchParams.get("id") || "").trim();
+      if (!tapdId) {
+        json(res, 400, { error: "Missing tapdId" });
+        return;
+      }
+      const existing = getPrdWorkflowCollaborationByTapdId(tapdId);
+      const result = listPrdWorkflowProjectBindings({ tapdId, userId: userCtx.userId });
+      if (existing && result.error) {
+        json(res, 403, { error: "PRD Workflow collaboration permission denied" });
+        return;
+      }
+      const accessibleProjects = listAccessibleProjectFlows(root, userCtx);
+      const bindings = workflowProjectBindingRows(result.projectBindings || [], accessibleProjects, userCtx);
+      json(res, 200, {
+        ok: true,
+        bindings,
+        availableProjects: availableWorkflowBindingProjects(accessibleProjects, bindings),
+      });
+      return;
+    }
+    if (req.method === "POST" && url.pathname === "/api/workflows/project-bindings") {
+      if (!authUser?.userId) {
+        json(res, 401, { error: "Authentication required" });
+        return;
+      }
+      let payload;
+      try {
+        payload = JSON.parse(await readBody(req, 128 * 1024));
+      } catch {
+        json(res, 400, { error: "Invalid JSON body" });
+        return;
+      }
+      const tapdId = String(payload?.tapdId || payload?.tapd_id || "").trim();
+      const flowId = String(payload?.flowId || "").trim();
+      const flowSource = String(payload?.flowSource || "user").trim() || "user";
+      const workspaceId = String(payload?.workspaceId || "").trim();
+      if (!tapdId || !flowId) {
+        json(res, 400, { error: "Project binding requires tapdId and flowId" });
+        return;
+      }
+      if (flowSource !== "user" && flowSource !== "workspace") {
+        json(res, 400, { error: "Only editable Projects can be bound" });
+        return;
+      }
+      const existingWorkflow = getPrdWorkflowCollaborationByTapdId(tapdId);
+      if (existingWorkflow && !getPrdWorkflowCollaborationForUser(tapdId, userCtx.userId)) {
+        json(res, 403, { error: "PRD Workflow collaboration permission denied" });
+        return;
+      }
+      const scoped = resolveWorkspaceScopeRoot(root, {
+        flowId,
+        flowSource,
+        workspaceId,
+        archived: false,
+      }, userCtx);
+      if (scoped.error) {
+        json(res, scoped.status || 400, { error: scoped.error });
+        return;
+      }
+      if (scoped.archived || (scoped.collaboration && !scoped.collaborationAccess?.writable)) {
+        json(res, 403, { error: "Only Project owners and editors can bind an iteration" });
+        return;
+      }
+      const projectCollaboration = scoped.collaboration
+        ? { record: scoped.collaboration, workspace: workspaceCollaborationSummary(scoped.collaboration, userCtx.userId) }
+        : ensureWorkspaceCollaboration({
+            flowId: scoped.flowId,
+            flowSource: scoped.flowSource,
+            archived: false,
+            userId: userCtx.userId,
+          });
+      if (projectCollaboration.error || !projectCollaboration.record?.id) {
+        json(res, projectCollaboration.status || 400, { error: projectCollaboration.error || "Project collaboration is unavailable" });
+        return;
+      }
+      const projectAccess = workspaceCollaborationAccess(projectCollaboration.record, userCtx.userId);
+      if (!projectAccess.writable) {
+        json(res, 403, { error: "Only Project owners and editors can bind an iteration" });
+        return;
+      }
+      const ensuredWorkflow = ensurePrdWorkflowCollaboration({ tapdId, userId: userCtx.userId });
+      if (ensuredWorkflow.error) {
+        json(res, ensuredWorkflow.status || 400, { error: ensuredWorkflow.error });
+        return;
+      }
+      const result = bindPrdWorkflowProject({
+        tapdId,
+        userId: userCtx.userId,
+        project: {
+          workspaceId: projectCollaboration.record.id,
+          flowId: scoped.flowId,
+          flowSource: scoped.flowSource,
+          archived: false,
+          ownerId: projectCollaboration.record.ownerId,
+        },
+      });
+      if (result.error) {
+        json(res, result.status || 400, { error: result.error });
+        return;
+      }
+      const accessibleProjects = listAccessibleProjectFlows(root, userCtx);
+      const bindings = workflowProjectBindingRows(result.projectBindings, accessibleProjects, userCtx);
+      json(res, 200, {
+        ok: true,
+        created: result.created === true,
+        bindings,
+        availableProjects: availableWorkflowBindingProjects(accessibleProjects, bindings),
+      });
+      return;
+    }
+    if (req.method === "DELETE" && url.pathname === "/api/workflows/project-bindings") {
+      if (!authUser?.userId) {
+        json(res, 401, { error: "Authentication required" });
+        return;
+      }
+      let payload;
+      try {
+        payload = JSON.parse(await readBody(req, 128 * 1024));
+      } catch {
+        json(res, 400, { error: "Invalid JSON body" });
+        return;
+      }
+      const tapdId = String(payload?.tapdId || payload?.tapd_id || "").trim();
+      const workspaceId = String(payload?.workspaceId || "").trim();
+      if (!tapdId || !workspaceId) {
+        json(res, 400, { error: "Unbinding requires tapdId and workspaceId" });
+        return;
+      }
+      const listed = listPrdWorkflowProjectBindings({ tapdId, userId: userCtx.userId });
+      if (listed.error) {
+        json(res, listed.status || 400, { error: listed.error });
+        return;
+      }
+      const binding = listed.projectBindings.find((item) => item.workspaceId === workspaceId);
+      if (!binding) {
+        json(res, 404, { error: "Project binding not found" });
+        return;
+      }
+      const scoped = resolveWorkspaceScopeRoot(root, {
+        flowId: binding.flowId,
+        flowSource: binding.flowSource,
+        workspaceId,
+        archived: binding.archived === true,
+      }, userCtx);
+      if (scoped.error) {
+        json(res, scoped.status || 400, { error: scoped.error });
+        return;
+      }
+      if (!scoped.collaborationAccess?.writable) {
+        json(res, 403, { error: "Only Project owners and editors can unbind an iteration" });
+        return;
+      }
+      const result = unbindPrdWorkflowProject({ tapdId, userId: userCtx.userId, workspaceId });
+      if (result.error) {
+        json(res, result.status || 400, { error: result.error });
+        return;
+      }
+      const accessibleProjects = listAccessibleProjectFlows(root, userCtx);
+      const bindings = workflowProjectBindingRows(result.projectBindings, accessibleProjects, userCtx);
+      json(res, 200, {
+        ok: true,
+        bindings,
+        availableProjects: availableWorkflowBindingProjects(accessibleProjects, bindings),
+      });
+      return;
+    }
     if (req.method === "GET" && url.pathname === "/api/workflows/knowledge-bindings") {
       if (!authUser?.userId) {
         json(res, 401, { error: "Authentication required" });
@@ -13713,6 +14386,276 @@ export function startUiServer({
       }
       return;
     }
+    if (req.method === "GET" && url.pathname === "/api/workflows/checklist") {
+      try {
+        const workflow = normalizeWorkflowReference({ workflow: url.searchParams.get("workflow") || "" });
+        if (workflow.error) {
+          json(res, 400, { error: workflow.error });
+          return;
+        }
+        if (workflow.namespace !== "tapd") {
+          json(res, 400, { error: `Unsupported workflow namespace: ${workflow.namespace}` });
+          return;
+        }
+        const source = String(url.searchParams.get("source") || "").trim().toLowerCase();
+        const actionKey = String(url.searchParams.get("actionKey") || url.searchParams.get("action_key") || "").trim();
+        if (!/^[a-z][a-z0-9._-]{0,119}$/.test(source)) {
+          json(res, 400, { error: "Invalid checklist source" });
+          return;
+        }
+        if (!actionKey || actionKey.length > 240 || /[\0\r\n]/.test(actionKey)) {
+          json(res, 400, { error: "Invalid checklist actionKey" });
+          return;
+        }
+        const flowId = String(url.searchParams.get("flowId") || "").trim();
+        const flowSource = String(url.searchParams.get("flowSource") || "user").trim() || "user";
+        const workflowScope = resolvePrdWorkflowScope(root, {
+          tapdId: workflow.id,
+          flowId,
+          flowSource,
+          archived: url.searchParams.get("archived") === "1",
+          workspaceId: url.searchParams.get("workspaceId") || "",
+          workflowShare: url.searchParams.get("workflowShare") || "",
+        }, userCtx, "read");
+        if (workflowScope.error) {
+          json(res, workflowScope.status || 400, { error: workflowScope.error });
+          return;
+        }
+        prdWorkflowMigrateLegacyState(workflowScope.executionRoot, workflowScope.stateRoot, workflow.id);
+        const snapshot = prdWorkflowMaterializeSnapshot(
+          workflowScope.executionRoot,
+          workflowScope.stateRoot,
+          workflow.id,
+          userCtx,
+          { flowSource, flowId },
+        );
+        const action = prdWorkflowFindChecklistAction(snapshot, source, actionKey);
+        if (!action) {
+          json(res, 404, { error: "Workflow Action checklist not found" });
+          return;
+        }
+        const access = workflowScope.collaborationAccess || {};
+        const canWrite = Boolean(authUser?.userId) && !workflowScope.sharedByLink && !workflowScope.adminReadonly && (
+          workflowScope.collaboration ? access.writable === true : true
+        );
+        json(res, 200, {
+          ok: true,
+          workflow,
+          action: {
+            key: actionKey,
+            source,
+            title: String(action.title || action.label || actionKey),
+            status: String(action.status || "pending"),
+            checklist: action.checklist,
+          },
+          canWrite,
+        });
+      } catch (error) {
+        json(res, 500, { error: (error && error.message) || String(error) });
+      }
+      return;
+    }
+    if (req.method === "PATCH" && url.pathname === "/api/workflows/checklist") {
+      if (!authUser?.userId) {
+        json(res, 401, { error: "Authentication required" });
+        return;
+      }
+      let payload;
+      try {
+        payload = JSON.parse(await readBody(req, 1024 * 1024));
+      } catch (error) {
+        json(res, error?.status === 413 ? 413 : 400, { error: error?.status === 413 ? error.message : "Invalid JSON body" });
+        return;
+      }
+      let releaseWorkflowWriteLock = null;
+      try {
+        const workflow = normalizeWorkflowReference(payload);
+        if (workflow.error) {
+          json(res, 400, { error: workflow.error });
+          return;
+        }
+        if (workflow.namespace !== "tapd") {
+          json(res, 400, { error: `Unsupported workflow namespace: ${workflow.namespace}` });
+          return;
+        }
+        const source = String(payload.source || "").trim().toLowerCase();
+        const actionKey = String(payload.actionKey || payload.action_key || "").trim();
+        const itemKey = String(payload.itemKey || payload.item_key || "").trim();
+        if (!/^[a-z][a-z0-9._-]{0,119}$/.test(source)) {
+          json(res, 400, { error: "Invalid checklist source" });
+          return;
+        }
+        if (!actionKey || actionKey.length > 240 || /[\0\r\n]/.test(actionKey)) {
+          json(res, 400, { error: "Invalid checklist actionKey" });
+          return;
+        }
+        if (!itemKey || itemKey.length > 240 || /[\0\r\n]/.test(itemKey)) {
+          json(res, 400, { error: "Invalid checklist itemKey" });
+          return;
+        }
+        const rawStatus = String(payload.status || "pending").trim().toLowerCase();
+        if (!["pending", "passed", "failed", "blocked", "skipped", "done", "complete", "completed", "success", "error", "cancelled", "canceled"].includes(rawStatus)) {
+          json(res, 400, { error: `Invalid checklist item status: ${rawStatus}` });
+          return;
+        }
+        const status = normalizeWorkflowChecklistItemStatus(rawStatus);
+        const note = String(payload.note || "").trim();
+        if (note.length > 4000) {
+          json(res, 400, { error: "Checklist note exceeds 4000 characters" });
+          return;
+        }
+        const rawEvidence = Array.isArray(payload.evidence) ? payload.evidence : [];
+        if (rawEvidence.length > 20) {
+          json(res, 400, { error: "Checklist evidence supports at most 20 entries" });
+          return;
+        }
+        const evidence = [];
+        for (let index = 0; index < rawEvidence.length; index += 1) {
+          const item = rawEvidence[index];
+          if (!item || typeof item !== "object" || Array.isArray(item)) {
+            json(res, 400, { error: `evidence[${index}] must be an object` });
+            return;
+          }
+          const evidenceUrl = String(item.url || item.href || "").trim();
+          if (!evidenceUrl || evidenceUrl.length > 4000 || !isSafeWorkflowUrl(evidenceUrl)) {
+            json(res, 400, { error: `evidence[${index}].url must use http, https, or an absolute application path` });
+            return;
+          }
+          evidence.push({
+            title: String(item.title || item.label || `证据 ${index + 1}`).trim().slice(0, 500),
+            url: evidenceUrl,
+          });
+        }
+        const expectedVersion = String(payload.expectedVersion || payload.expected_version || "").trim();
+        if (!expectedVersion) {
+          json(res, 400, { error: "Checklist update requires expectedVersion" });
+          return;
+        }
+        const flowId = String(payload.flowId || payload.flow_id || "").trim();
+        const flowSource = String(payload.flowSource || payload.flow_source || "user").trim() || "user";
+        const workflowScope = resolvePrdWorkflowScope(root, {
+          ...payload,
+          tapdId: workflow.id,
+          flowId,
+          flowSource,
+        }, userCtx, "write");
+        if (workflowScope.error) {
+          json(res, workflowScope.status || 400, { error: workflowScope.error });
+          return;
+        }
+        if (!workflowScope.collaboration) {
+          const ensured = ensurePrdWorkflowCollaboration({ tapdId: workflow.id, userId: userCtx.userId });
+          if (ensured.error) {
+            json(res, ensured.status || 400, { error: ensured.error });
+            return;
+          }
+        }
+        const scopedRoot = workflowScope.stateRoot;
+        prdWorkflowMigrateLegacyState(workflowScope.executionRoot, scopedRoot, workflow.id);
+        releaseWorkflowWriteLock = await prdWorkflowAcquireWriteLock(`${scopedRoot}\t${workflow.id}`);
+        let snapshot = prdWorkflowMaterializeSnapshot(
+          workflowScope.executionRoot,
+          scopedRoot,
+          workflow.id,
+          userCtx,
+          { flowSource, flowId },
+        );
+        const idempotencyKey = String(payload.idempotencyKey || payload.idempotency_key || "").trim().slice(0, 500);
+        if (idempotencyKey) {
+          const existing = prdWorkflowFindIdempotencyEvent(scopedRoot, workflow.id, idempotencyKey, "agentflow-checklist", false, "checklist.update");
+          if (existing) {
+            json(res, 200, { ok: true, alreadyApplied: true, workflow, checklistState: existing.checklistState, snapshot });
+            return;
+          }
+        }
+        const action = prdWorkflowFindChecklistAction(snapshot, source, actionKey);
+        const checklistItem = action?.checklist?.items?.find((item) => String(item?.key || "") === itemKey);
+        if (!action || !checklistItem) {
+          json(res, 404, { error: "Workflow Action checklist item not found" });
+          return;
+        }
+        if (status === "passed" && checklistItem.evidenceRequired === true && evidence.length === 0) {
+          json(res, 400, { error: "Checklist item requires evidence before it can pass" });
+          return;
+        }
+        const resourceKey = prdWorkflowChecklistResourceKey(source, actionKey, itemKey);
+        const currentVersion = String(snapshot.resourceVersions?.[resourceKey] || "absent");
+        if (expectedVersion !== currentVersion) {
+          json(res, 409, {
+            error: "Checklist item changed; refresh it before saving",
+            conflict: { type: "workflow-resource-conflict", conflicts: [{ resourceKey, expectedVersion, currentVersion }], workflow },
+            snapshot,
+          });
+          return;
+        }
+        const now = new Date().toISOString();
+        const checklistState = {
+          producer: source,
+          actionKey,
+          itemKey,
+          status,
+          note,
+          evidence,
+          updatedAt: now,
+          updatedBy: {
+            userId: String(userCtx.userId || ""),
+            username: String(authUser.username || userCtx.userId || ""),
+          },
+        };
+        const event = prdWorkflowAppendRuntimeEvent(scopedRoot, workflow.id, {
+          id: `checklist_state_${prdWorkflowSafeStateId([source, actionKey, itemKey].join(":"))}`,
+          type: "workflow-checklist-update",
+          operation: "checklist.update",
+          source: "agentflow-checklist",
+          auxiliary: true,
+          aggregateByStage: false,
+          status: "done",
+          checklistState,
+          ...(idempotencyKey ? { idempotencyKey } : {}),
+        });
+        if (!event) throw new Error("Failed to store checklist state");
+        snapshot = prdWorkflowMaterializeSnapshot(
+          workflowScope.executionRoot,
+          scopedRoot,
+          workflow.id,
+          userCtx,
+          { flowSource, flowId },
+        );
+        const updatedAction = prdWorkflowFindChecklistAction(snapshot, source, actionKey);
+        const updatedItem = updatedAction?.checklist?.items?.find((item) => String(item?.key || "") === itemKey);
+        prdWorkflowAppendAudit(scopedRoot, workflow.id, {
+          type: "checklist-item-updated",
+          source,
+          actionKey,
+          itemKey,
+          status,
+          resourceKey,
+          actorUserId: String(userCtx.userId || ""),
+        });
+        prdWorkflowBroadcast(prdWorkflowKey(userCtx, flowSource, flowId, workflow.id), {
+          type: "workflow-checklist-updated",
+          tapdId: workflow.id,
+          source,
+          actionKey,
+          itemKey,
+          checklistState: updatedItem?.state || checklistState,
+          snapshot,
+        });
+        json(res, 200, {
+          ok: true,
+          alreadyApplied: false,
+          workflow,
+          checklistState: updatedItem?.state || checklistState,
+          checklist: updatedAction?.checklist || null,
+          snapshot,
+        });
+      } catch (error) {
+        json(res, 500, { error: (error && error.message) || String(error) });
+      } finally {
+        releaseWorkflowWriteLock?.();
+      }
+      return;
+    }
     if (req.method === "GET" && url.pathname === "/api/prd-workflow/snapshot") {
       try {
         const tapdId = String(url.searchParams.get("tapdId") || "").trim();
@@ -14534,6 +15477,11 @@ export function startUiServer({
           json(res, 400, { error: `Unsupported workflow namespace: ${report.workflow.namespace}` });
           return;
         }
+        const adminVersionRepair = prdWorkflowAdminVersionRepairIntent(payload, report, userCtx);
+        if (adminVersionRepair.error) {
+          json(res, adminVersionRepair.status || 400, { error: adminVersionRepair.error });
+          return;
+        }
         const tapdId = report.workflow.id;
         const flowId = report.flowId;
         const flowSource = report.flowSource || "user";
@@ -14544,12 +15492,12 @@ export function startUiServer({
           flowId,
           flowSource,
           archived,
-        }, userCtx, "write");
+        }, userCtx, adminVersionRepair.requested ? "admin-version-repair" : "write");
         if (workflowScope.error) {
           json(res, workflowScope.status || 400, { error: workflowScope.error });
           return;
         }
-        if (!workflowScope.collaboration) {
+        if (!workflowScope.collaboration && !adminVersionRepair.requested) {
           const ensured = ensurePrdWorkflowCollaboration({ tapdId, userId: userCtx.userId });
           if (ensured.error) {
             json(res, ensured.status || 400, { error: ensured.error });
@@ -14657,7 +15605,9 @@ export function startUiServer({
           });
           return;
         }
-        report = prdWorkflowMergeProducerTimeline(report, currentSnapshot);
+        report = adminVersionRepair.requested
+          ? prdWorkflowMergeAdminVersionTimeline(report, currentSnapshot)
+          : prdWorkflowMergeProducerTimeline(report, currentSnapshot);
         if (report.error) {
           json(res, 400, { error: report.error });
           return;
@@ -14704,11 +15654,17 @@ export function startUiServer({
           getSessionTokenFromRequest(req) || "",
         );
         prdWorkflowBroadcast(
-          prdWorkflowKey(userCtx, flowSource, flowId, tapdId),
+          prdWorkflowKey(
+            adminVersionRepair.requested ? { userId: workflowScope.stateOwnerId } : userCtx,
+            flowSource,
+            flowId,
+            tapdId,
+          ),
           { type: "workflow-report", tapdId, workflow: report.workflow, event, observation: Boolean(observation), snapshot },
         );
         json(res, 200, {
           ok: true,
+          ...(adminVersionRepair.requested ? { administrativeRepair: report.event.administrativeRepair } : {}),
           report,
           resourceKeys,
           event,
@@ -15701,48 +16657,7 @@ export function startUiServer({
         try {
           const projectView = String(url.searchParams.get("view") || "all").trim().toLowerCase();
           const currentTeam = getTeamForUser(userCtx.userId);
-          const flows = listFlowsJson(root, { ...userCtx, includeWorkspaceFlows: true })
-            .filter((flow) => (
-              !workspaceFlowCollaborationGuard(
-                flow.id,
-                flow.source || "user",
-                flow.archived === true,
-                userCtx,
-                "read",
-              )
-            ))
-            .map((flow) => {
-              const source = flow.source || "user";
-              const collaboration = source === "workspace"
-                ? getWorkspaceCollaborationByFlow(flow.id, flow.archived === true)
-                : getWorkspaceCollaborationForProject({
-                  flowId: flow.id,
-                  flowSource: source,
-                  archived: flow.archived === true,
-                  ownerId: userCtx.userId,
-                });
-              return collaboration
-                ? { ...flow, collaboration: workspaceCollaborationSummaryWithUsers(collaboration, userCtx.userId) }
-                : flow;
-            });
-          const existingCollaborationIds = new Set(flows.map((flow) => flow.collaboration?.id).filter(Boolean));
-          for (const record of listWorkspaceCollaborationsForUser(userCtx.userId)) {
-            const source = record.projectSource || record.flowSource || "workspace";
-            if (source !== "user" || record.ownerId === userCtx.userId) continue;
-            if (existingCollaborationIds.has(record.id)) continue;
-            const ownerFlow = listFlowsJson(root, { userId: record.ownerId })
-              .find((flow) => (
-                flow.id === record.flowId
-                && (flow.source || "user") === "user"
-                && Boolean(flow.archived) === Boolean(record.archived)
-              ));
-            if (!ownerFlow) continue;
-            flows.push({
-              ...ownerFlow,
-              collaboration: workspaceCollaborationSummaryWithUsers(record, userCtx.userId),
-            });
-            existingCollaborationIds.add(record.id);
-          }
+          const flows = listAccessibleProjectFlows(root, userCtx);
           const visibleFlows = projectView === "team"
             ? flows.filter((flow) => (
                 currentTeam
@@ -19585,6 +20500,7 @@ finishedAt: "${new Date().toISOString()}"
         return;
       }
       const flowSource = payload.flowSource || "user";
+      const requestedRunId = typeof payload.runId === "string" ? payload.runId.trim() : "";
       const collaborationDenied = workspaceFlowCollaborationGuard(
         flowId,
         flowSource,
@@ -19599,6 +20515,13 @@ finishedAt: "${new Date().toISOString()}"
       const runKey = workspaceRunKey(userCtx, flowSource, flowId);
       const entry = activeFlowRuns.get(runKey);
       if (!entry || !entry.child) {
+        if (requestedRunId) {
+          const cancelled = cancelScheduledRun(root, flowId, requestedRunId, userCtx);
+          if (cancelled.ok && cancelled.updatedWaits > 0) {
+            json(res, 200, { ok: true, cancelledWaitingRun: true, ...cancelled });
+            return;
+          }
+        }
         json(res, 404, { error: "该流水线未在运行" });
         return;
       }