@fieldwangai/agentflow 0.1.142 → 0.1.144

package/README.md

@@ -58,6 +58,9 @@ npm install -g @fieldwangai/agentflow
 # Launch Web UI (port 8765)
 agentflow ui
 
+# Generate and open a single-file static preview using the platform canvas (no local server)
+agentflow flow preview ./my-flow/flow.yaml
+
 # Or run a flow directly
 agentflow apply <FlowName>
 ```
@@ -125,6 +128,8 @@ AgentFlow provides specialized skills for common operations:
 
 | Skill | Description |
 |-------|-------------|
+| `agentflow-author-flow` | Generate a Flow from natural language in Codex/Cursor, validate it, open a static preview, and publish it to personal, workspace, or team scope after confirmation |
+| `agentflow-cli` | Query, publish, and run platform Flows directly with a token and no MCP |
 | `agentflow-flow-add-instances` | Add new nodes to flow.yaml with proper YAML structure, connection design, and positioning |
 | `agentflow-flow-edit-node-fields` | Edit allowed fields in existing nodes (label, body, role, input/output values) without breaking topology |
 | `agentflow-flow-sync-ui` | Sync flow.yaml changes to Web UI canvas after saving to disk |
@@ -132,6 +137,8 @@ AgentFlow provides specialized skills for common operations:
 
 Skills are automatically loaded when relevant tasks are detected, providing domain-specific instructions and workflows.
 
+For example, tell Codex/Cursor: “Use `agentflow-author-flow` to generate a Flow that sends a WeCom notification after a Jenkins build, open the local preview first, and publish it to my team after I confirm.” The agent handles the local files, validation, preview, and publish command; the user only confirms the result.
+
 ## Tutorials
 
 - [Quickstart: PR Workflow Automation](docs/wiki/quickstart-pr-workflow.en.md)
@@ -144,6 +151,7 @@ Skills are automatically loaded when relevant tasks are detected, providing doma
 |---------|-------------|
 | `list` | List all pipelines |
 | `ui` | Start Web UI |
+| `flow preview <FlowName\|flow.yaml>` | Generate a single-file static Flow preview; use `--output` to choose the HTML path |
 | `apply` | Execute flow |
 | `validate` | Validate flow structure |
 | `resume` | Resume from breakpoint |

package/README.zh-CN.md

@@ -58,6 +58,9 @@ npm install -g @fieldwangai/agentflow
 # 启动 Web UI（端口 8765）
 agentflow ui
 
+# 生成并打开平台同款画布的单文件静态预览（无需本地服务）
+agentflow flow preview ./my-flow/flow.yaml
+
 # 或直接运行流程
 agentflow apply <FlowName>
 ```
@@ -125,6 +128,8 @@ AgentFlow 提供专用技能用于常见操作：
 
 | 技能 | 说明 |
 |------|------|
+| `agentflow-author-flow` | 在 Codex/Cursor 中根据自然语言生成 Flow，自动校验并打开静态预览；确认后发布到个人、Workspace 或团队 |
+| `agentflow-cli` | 通过 token 直接查询、发布和运行平台 Flow，无需 MCP |
 | `agentflow-flow-add-instances` | 向 flow.yaml 添加新节点，包括正确的 YAML 结构、连线设计和位置定位 |
 | `agentflow-flow-edit-node-fields` | 编辑已有节点的允许字段（label、body、role、input/output 值）而不破坏拓扑 |
 | `agentflow-flow-sync-ui` | 保存 flow.yaml 到磁盘后同步变更到 Web UI 画布 |
@@ -132,6 +137,8 @@ AgentFlow 提供专用技能用于常见操作：
 
 技能在检测到相关任务时自动加载，提供领域特定的指令和工作流。
 
+例如直接对 Codex/Cursor 说：“用 `agentflow-author-flow` 生成一个 Jenkins 构建完成后通知企业微信的 Flow，先打开本地预览，我确认后发布到团队。” Agent 会处理本地文件、校验、预览和发布命令；用户只负责确认效果。
+
 ## 教程
 
 - [快速上手：PR 流程自动化](docs/wiki/quickstart-pr-workflow.zh-CN.md)
@@ -144,6 +151,7 @@ AgentFlow 提供专用技能用于常见操作：
 |------|------|
 | `list` | 列出所有流水线 |
 | `ui` | 启动 Web UI |
+| `flow preview <FlowName\|flow.yaml>` | 生成平台同款画布的单文件静态 Flow 预览；可用 `--output` 指定 HTML |
 | `apply` | 执行流程 |
 | `validate` | 校验流程结构 |
 | `resume` | 断点续跑 |

package/bin/lib/auth.mjs

@@ -88,6 +88,58 @@ export function readAuthUsers() {
   return readJsonObject(usersPath());
 }
 
+export function listAuthUsers() {
+  return Object.entries(readAuthUsers())
+    .map(([userId, user]) => ({
+      userId,
+      username: String(user?.username || userId),
+      isAdmin: Boolean(user?.isAdmin),
+      createdAt: String(user?.createdAt || ""),
+      updatedAt: String(user?.updatedAt || user?.createdAt || ""),
+    }))
+    .sort((left, right) => left.username.localeCompare(right.username));
+}
+
+export function resetAuthUserPassword(userId, password) {
+  const normalizedUserId = sanitizeAgentflowUserId(userId);
+  if (!normalizedUserId) return { ok: false, status: 400, error: "用户名无效" };
+  const nextPassword = String(password || "");
+  if (nextPassword.length < 4) return { ok: false, status: 400, error: "密码至少 4 位" };
+
+  const users = readAuthUsers();
+  const user = users[normalizedUserId];
+  if (!user) return { ok: false, status: 404, error: "用户不存在" };
+
+  const nextCredential = hashPassword(nextPassword);
+  users[normalizedUserId] = {
+    ...user,
+    salt: nextCredential.salt,
+    hash: nextCredential.hash,
+    updatedAt: new Date().toISOString(),
+  };
+  writeJsonObject(usersPath(), users);
+
+  const sessions = readJsonObject(sessionsPath());
+  let revokedSessions = 0;
+  for (const [sessionKey, session] of Object.entries(sessions)) {
+    if (session?.userId !== normalizedUserId) continue;
+    delete sessions[sessionKey];
+    revokedSessions += 1;
+  }
+  writeJsonObject(sessionsPath(), sessions);
+
+  return {
+    ok: true,
+    user: {
+      userId: normalizedUserId,
+      username: String(user.username || normalizedUserId),
+      isAdmin: Boolean(user.isAdmin),
+      updatedAt: users[normalizedUserId].updatedAt,
+    },
+    revokedSessions,
+  };
+}
+
 export function authSetupRequired() {
   return Object.keys(readAuthUsers()).length === 0;
 }

package/bin/lib/catalog-flows.mjs

@@ -229,7 +229,7 @@ export function parseNodeFrontmatter(raw) {
  * @param {string} workspaceRoot
  * @param {string} flowId
  * @param {string} flowSource
- * @param {{ archived?: boolean }} [opts]
+ * @param {{ archived?: boolean, staticFlowPath?: string }} [opts]
  */
 export function listNodesJson(workspaceRoot, flowId, flowSource, opts = {}) {
   const root = path.resolve(workspaceRoot);
@@ -238,7 +238,14 @@ export function listNodesJson(workspaceRoot, flowId, flowSource, opts = {}) {
   const byId = new Map();
   const pipelineTranslations = {};
   let marketplaceFlowData = null;
-  if (flowId && flowSource) {
+  const staticFlowPath = opts.staticFlowPath ? path.resolve(String(opts.staticFlowPath)) : "";
+  const staticFlowDir = staticFlowPath ? path.dirname(staticFlowPath) : "";
+  if (staticFlowPath && fs.existsSync(staticFlowPath) && fs.statSync(staticFlowPath).isFile()) {
+    try {
+      const parsed = yaml.load(fs.readFileSync(staticFlowPath, "utf-8"));
+      if (parsed && typeof parsed === "object") marketplaceFlowData = parsed;
+    } catch (_) {}
+  } else if (flowId && flowSource) {
     const flowPath = getFlowYamlAbs(workspaceRoot, flowId, flowSource, opts);
     if (flowPath.path && fs.existsSync(flowPath.path)) {
       try {
@@ -315,6 +322,24 @@ export function listNodesJson(workspaceRoot, flowId, flowSource, opts = {}) {
       runtime: manifest.runtime,
     });
   }
+  if (staticFlowDir) {
+    addFromDir(path.join(staticFlowDir, "nodes"), "flow", flowId);
+    const flowData = marketplaceFlowData;
+    if (flowData?.instances) {
+      pipelineTranslations[flowId] = pipelineTranslations[flowId] || {};
+      for (const [nodeId, inst] of Object.entries(flowData.instances)) {
+        pipelineTranslations[flowId][nodeId] = {
+          label: inst?.label,
+          body: inst?.body,
+          description: inst?.description || inst?.userDescription,
+        };
+      }
+    }
+    if (flowData?.ui?.description) {
+      pipelineTranslations[flowId] = pipelineTranslations[flowId] || {};
+      pipelineTranslations[flowId].__flowDescription = flowData.ui.description;
+    }
+  }
   if (flowId && flowSource) {
     if (flowSource === "builtin") {
       addFromDir(path.join(PACKAGE_BUILTIN_PIPELINES_DIR, flowId, "nodes"), "flow", flowId);

package/bin/lib/flow-static-preview.mjs

@@ -0,0 +1,104 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+
+function assetPathFromHtml(indexHtml, pattern, label, distDir) {
+  const match = indexHtml.match(pattern);
+  if (!match?.[1]) throw new Error(`AgentFlow Web UI ${label} asset is missing; run npm run build:web-ui first`);
+  const assetPath = path.join(distDir, match[1].replace(/^\/+/, ""));
+  if (!fs.existsSync(assetPath) || !fs.statSync(assetPath).isFile()) {
+    throw new Error(`AgentFlow Web UI ${label} asset not found: ${assetPath}`);
+  }
+  return assetPath;
+}
+
+function safeInlineJson(value) {
+  return JSON.stringify(value)
+    .replace(/</g, "\\u003c")
+    .replace(/\u2028/g, "\\u2028")
+    .replace(/\u2029/g, "\\u2029");
+}
+
+function safeInlineScript(source) {
+  return String(source).replace(/<\/script/gi, "<\\/script");
+}
+
+function safeInlineStyle(source) {
+  return String(source).replace(/<\/style/gi, "<\\/style");
+}
+
+function escapeHtml(value) {
+  return String(value)
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;");
+}
+
+/**
+ * Build one self-contained, read-only HTML snapshot using the production Web UI bundle.
+ * No local HTTP server or AgentFlow process is required after this function returns.
+ */
+export function writeStaticFlowPreview({
+  flowId,
+  flowPath,
+  nodeCatalog,
+  outputPath,
+  distDir,
+}) {
+  const indexPath = path.join(distDir, "index.html");
+  if (!fs.existsSync(indexPath)) {
+    throw new Error(`AgentFlow Web UI build not found: ${indexPath}; run npm run build:web-ui first`);
+  }
+  const indexHtml = fs.readFileSync(indexPath, "utf-8");
+  const scriptPath = assetPathFromHtml(
+    indexHtml,
+    /<script[^>]+src=["']([^"']+\.js)["'][^>]*><\/script>/i,
+    "JavaScript",
+    distDir,
+  );
+  const stylePath = assetPathFromHtml(
+    indexHtml,
+    /<link[^>]+href=["']([^"']+\.css)["'][^>]*>/i,
+    "CSS",
+    distDir,
+  );
+  const flowYaml = fs.readFileSync(flowPath, "utf-8");
+  const payload = {
+    format: "agentflow-static-preview-v1",
+    flow: { id: String(flowId || "local-preview"), source: "preview", archived: false },
+    flowYaml,
+    nodeCatalog: nodeCatalog && typeof nodeCatalog === "object" ? nodeCatalog : { nodes: [] },
+    revision: crypto.createHash("sha256").update(flowYaml).digest("hex").slice(0, 24),
+  };
+  const appScript = safeInlineScript(fs.readFileSync(scriptPath, "utf-8"));
+  const appStyle = safeInlineStyle(fs.readFileSync(stylePath, "utf-8"));
+  const title = `${escapeHtml(flowId || "Flow")} · AgentFlow Preview`;
+  const html = `<!doctype html>
+<html class="af-dark" lang="zh-CN">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <meta name="generator" content="AgentFlow static Flow preview" />
+    <title>${title}</title>
+    <link rel="preconnect" href="https://fonts.googleapis.com" />
+    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
+    <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600&family=Space+Grotesk:wght@400;500;600;700&display=swap" rel="stylesheet" />
+    <link href="https://fonts.googleapis.com/css2?family=Material+Symbols+Outlined:opsz,wght,FILL,GRAD@24,400,0,0" rel="stylesheet" />
+    <style>${appStyle}</style>
+    <script>window.__AGENTFLOW_STATIC_FLOW_PREVIEW__=${safeInlineJson(payload)};</script>
+  </head>
+  <body>
+    <div id="root"></div>
+    <script type="module">${appScript}</script>
+  </body>
+</html>
+`;
+  fs.mkdirSync(path.dirname(outputPath), { recursive: true });
+  fs.writeFileSync(outputPath, html, "utf-8");
+  return {
+    outputPath,
+    bytes: Buffer.byteLength(html),
+    revision: payload.revision,
+  };
+}

package/bin/lib/help.mjs

@@ -18,6 +18,7 @@ AgentFlow CLI — 使用 Cursor / OpenCode / Claude Code / Codex CLI 流式输
   agentflow download <slug|title> [--user|--workspace] [--as <id>] [--raw [--output <dir>]]  从 Hub 下载流程（默认 --user 安装到 ~/agentflow/pipelines/<id>；--workspace 安装到当前工程 .workspace/agentflow/pipelines/<id>；--raw 仅保留压缩包）
   agentflow list                              列出所有流水线
   agentflow ui [--host <addr>] [--port <n>] [--scheduler] [--no-open] [--hide-community-links]  本地 HTTP：流水线列表 + React Flow 节点流程图编辑保存（默认 127.0.0.1:8765；可用 AGENTFLOW_UI_HOST）
+  agentflow flow preview <FlowName|flow.yaml> [--output <preview.html>] [--no-open]  生成平台同款画布的单文件静态 Flow 预览
   agentflow mcp                              启动 AgentFlow MCP stdio server，供 Cursor/Codex 运行流程并读取 display 输出
   agentflow scheduler start [--poll-ms <ms>]  启动定时执行调度器（读取各流水线 schedule.json）
   agentflow scheduler status [--json]         查看定时执行配置与状态
@@ -88,6 +89,7 @@ Usage:
   agentflow download <slug|title> [--user|--workspace] [--as <id>] [--raw [--output <dir>]]  Download flow (default --user → ~/agentflow/pipelines/<id>; --workspace → current project's .workspace/agentflow/pipelines/<id>; --raw keeps the archive)
   agentflow list                              List all pipelines
   agentflow ui [--host <addr>] [--port <n>] [--scheduler] [--no-open] [--hide-community-links]  Local HTTP: pipeline list + React Flow node diagram editor (default 127.0.0.1:8765; AGENTFLOW_UI_HOST supported)
+  agentflow flow preview <FlowName|flow.yaml> [--output <preview.html>] [--no-open]  Generate a single-file static Flow preview using the platform canvas
   agentflow mcp                              Start the AgentFlow MCP stdio server for Cursor/Codex to run flows and read display outputs
   agentflow scheduler start [--poll-ms <ms>]  Start the scheduled-run scheduler (reads each pipeline schedule.json)
   agentflow scheduler status [--json]         Show scheduled-run configuration and state

package/bin/lib/main.mjs

@@ -1,5 +1,7 @@
 import { spawn } from "child_process";
+import fs from "fs";
 import path from "path";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import chalk from "chalk";
 import { apply, replay, resume } from "./apply.mjs";
 import {
@@ -33,6 +35,7 @@ import { hubListRemote, hubDownload } from "./hub-remote.mjs";
 import { cancelScheduledRun, listScheduleStatuses, startScheduler } from "./scheduler.mjs";
 import { installFlowDependency, listMarketplacePackages, publishNodePackage } from "./marketplace.mjs";
 import { startMcpServer } from "./mcp-server.mjs";
+import { writeStaticFlowPreview } from "./flow-static-preview.mjs";
 
 async function readStdin() {
   const chunks = [];
@@ -346,6 +349,67 @@ export async function main() {
     process.stdout.write(JSON.stringify(result.success ? { success: true } : result) + "\n");
     process.exit(result.success ? 0 : 1);
   }
+  if (sub === "flow" && argv[0] === "preview") {
+    shift();
+    const target = shift();
+    if (!target) throw new Error("Usage: agentflow flow preview <FlowName|flow.yaml> [--output <preview.html>] [--no-open]");
+    let outputPath = "";
+    const outputIdx = argv.indexOf("--output");
+    if (outputIdx >= 0 && argv[outputIdx + 1]) {
+      outputPath = path.resolve(workspaceRoot, argv[outputIdx + 1]);
+      argv.splice(outputIdx, 2);
+    }
+    const noOpen = argv.includes("--no-open");
+    if (noOpen) argv.splice(argv.indexOf("--no-open"), 1);
+    if (argv.length > 0) throw new Error(`Unknown flow preview option: ${argv[0]}`);
+
+    const targetPath = path.resolve(workspaceRoot, target);
+    let previewFlowPath = "";
+    if (fs.existsSync(targetPath)) {
+      previewFlowPath = fs.statSync(targetPath).isDirectory()
+        ? path.join(targetPath, "flow.yaml")
+        : targetPath;
+    } else {
+      const flowDir = getFlowDir(workspaceRoot, target);
+      if (flowDir) previewFlowPath = path.join(flowDir, "flow.yaml");
+    }
+    if (!previewFlowPath || !fs.existsSync(previewFlowPath) || !fs.statSync(previewFlowPath).isFile()) {
+      throw new Error(`Flow not found: ${target}`);
+    }
+    previewFlowPath = fs.realpathSync(previewFlowPath);
+    const flowId = path.basename(path.dirname(previewFlowPath)) || "local-preview";
+    const safeFlowId = flowId.replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^-+|-+$/g, "") || "flow-preview";
+    if (!outputPath) {
+      outputPath = path.join(workspaceRoot, ".workspace", "agentflow", "previews", `${safeFlowId}.html`);
+    }
+    if (!/\.html?$/i.test(outputPath)) throw new Error("Preview output must be an HTML file");
+    const nodeCatalog = listNodesJson(workspaceRoot, flowId, "", {
+      staticFlowPath: previewFlowPath,
+      marketplaceScope: "all",
+    });
+    const result = writeStaticFlowPreview({
+      flowId,
+      flowPath: previewFlowPath,
+      nodeCatalog,
+      outputPath,
+      distDir: path.join(path.dirname(path.dirname(path.dirname(fileURLToPath(import.meta.url)))), "builtin", "web-ui", "dist"),
+    });
+    const url = pathToFileURL(result.outputPath).href;
+    process.stderr.write(`AgentFlow static preview: ${result.outputPath}\nSource: ${previewFlowPath}\n`);
+    if (!noOpen) {
+      if (process.platform === "win32") {
+        const child = spawn("cmd", ["/c", "start", "", url], { detached: true, stdio: "ignore" });
+        child.unref();
+      } else if (process.platform === "darwin") {
+        const child = spawn("open", [url], { detached: true, stdio: "ignore" });
+        child.unref();
+      } else {
+        const child = spawn("xdg-open", [url], { detached: true, stdio: "ignore" });
+        child.unref();
+      }
+    }
+    return;
+  }
   if (sub === "ui") {
     let port = 8765;
     let host = process.env.AGENTFLOW_UI_HOST || "127.0.0.1";

package/bin/lib/ui-server.mjs

@@ -109,10 +109,12 @@ import {
   getAuthUserFromRequest,
   getSessionTokenFromRequest,
   isAuthUserAllowed,
+  listAuthUsers,
   loginOrCreateUser,
   logoutRequest,
   readAuthUsers,
   readUserAllowlist,
+  resetAuthUserPassword,
   writeUserAllowlist,
 } from "./auth.mjs";
 import { readGlobalEnvRows, readMergedEnvObject, readUserEnvRows, writeGlobalEnvRows, writeUserEnvRows } from "./user-env.mjs";
@@ -3905,6 +3907,8 @@ export function prdWorkflowDashboardTimeline(workflows = []) {
     for (const entry of Array.isArray(workflow?.timeline) ? workflow.timeline : []) {
       const memberKey = String(entry?.key || [entry?.source, entry?.kind, entry?.id].filter(Boolean).join(":"));
       const identity = prdWorkflowDashboardTimelineIdentity(entry);
+      const rawId = String(entry?.id || "").trim();
+      const projectionId = identity && identity !== rawId.toLowerCase() ? identity : rawId;
       const groupKey = prdWorkflowDashboardTimelineGroupKey(entry);
       if (!memberKey || !groupKey) continue;
       assignedWorkflowIds.add(workflowId);
@@ -3912,6 +3916,7 @@ export function prdWorkflowDashboardTimeline(workflows = []) {
         key: memberKey,
         kind: String(entry.kind || ""),
         id: identity || String(entry.id || ""),
+        projectionId,
         title: String(entry.title || entry.id || ""),
         date: String(entry.date || ""),
         startDate: String(entry.startDate || ""),
@@ -3928,6 +3933,7 @@ export function prdWorkflowDashboardTimeline(workflows = []) {
         memberKeys: [],
       };
       current.kind = String(entry.kind || current.kind);
+      current.projectionId = projectionId || current.projectionId;
       current.title = String(entry.title || current.title);
       current.date = String(entry.date || current.date);
       current.startDate = String(entry.startDate || current.startDate);
@@ -11676,10 +11682,8 @@ function prdWorkflowMergeProducerTimeline(report, currentSnapshot = {}) {
   };
 }
 
-function prdWorkflowAdminVersionRepairIntent(payload = {}, report = {}, userCtx = {}) {
-  const operation = String(
-    payload.adminOperation || payload.admin_operation || payload.administrativeOperation || payload.administrative_operation || "",
-  ).trim().toLowerCase();
+function prdWorkflowAdminVersionRepairOperation(value = "", userCtx = {}) {
+  const operation = String(value || "").trim().toLowerCase();
   if (!operation) return { requested: false };
   if (operation !== "repair-version-membership") {
     return { requested: true, status: 400, error: `Unsupported admin Workflow operation: ${operation}` };
@@ -11687,6 +11691,15 @@ function prdWorkflowAdminVersionRepairIntent(payload = {}, report = {}, userCtx
   if (userCtx.isAdmin !== true) {
     return { requested: true, status: 403, error: "Admin permission required" };
   }
+  return { requested: true, operation };
+}
+
+function prdWorkflowAdminVersionRepairIntent(payload = {}, report = {}, userCtx = {}) {
+  const intent = prdWorkflowAdminVersionRepairOperation(
+    payload.adminOperation || payload.admin_operation || payload.administrativeOperation || payload.administrative_operation || "",
+    userCtx,
+  );
+  if (!intent.requested || intent.error) return intent;
   const forbiddenKeys = ["action", "artifacts", "observation", "globalState", "global_state", "extensions", "extension"]
     .filter((key) => Object.prototype.hasOwnProperty.call(payload, key));
   if (forbiddenKeys.length) {
@@ -11714,10 +11727,17 @@ function prdWorkflowAdminVersionRepairIntent(payload = {}, report = {}, userCtx
   if (!report.expectedRevision) {
     return { requested: true, status: 400, error: "Admin version repair requires expectedRevision" };
   }
-  return { requested: true, operation };
+  const rawReason = String(payload.adminReason || payload.admin_reason || "");
+  if (rawReason.length > 500) {
+    return { requested: true, status: 400, error: "Admin version repair reason exceeds 500 characters" };
+  }
+  if (/[\0\r\n]/.test(rawReason)) {
+    return { requested: true, status: 400, error: "Admin version repair reason contains control characters" };
+  }
+  return { ...intent, reason: rawReason.trim() };
 }
 
-function prdWorkflowMergeAdminVersionTimeline(report, currentSnapshot = {}) {
+function prdWorkflowMergeAdminVersionTimeline(report, currentSnapshot = {}, adminIntent = {}) {
   const source = prdWorkflowRuntimeEventProducer(report?.event || {});
   const current = Array.isArray(currentSnapshot?.projections?.timeline) ? currentSnapshot.projections.timeline : [];
   const incoming = Array.isArray(report?.projections?.timeline) ? report.projections.timeline : [];
@@ -11729,6 +11749,7 @@ function prdWorkflowMergeAdminVersionTimeline(report, currentSnapshot = {}) {
   const administrativeRepair = {
     kind: "version-attribution",
     operation: "repair-version-membership",
+    ...(adminIntent.reason ? { reason: adminIntent.reason } : {}),
   };
   return {
     ...report,
@@ -13478,7 +13499,6 @@ export function startUiServer({
   const root = path.resolve(workspaceRoot);
   const uiPort = port;
   const uiConfig = { hideCommunityLinks: Boolean(hideCommunityLinks) };
-
   const server = http.createServer(async (req, res) => {
     const url = new URL(req.url || "/", "http://127.0.0.1");
     const reqStart = Date.now();
@@ -14356,6 +14376,14 @@ export function startUiServer({
         }
         const flowId = String(url.searchParams.get("flowId") || "").trim();
         const flowSource = String(url.searchParams.get("flowSource") || "user").trim() || "user";
+        const adminVersionRepair = prdWorkflowAdminVersionRepairOperation(
+          url.searchParams.get("adminOperation") || url.searchParams.get("admin_operation") || "",
+          userCtx,
+        );
+        if (adminVersionRepair.error) {
+          json(res, adminVersionRepair.status || 400, { error: adminVersionRepair.error });
+          return;
+        }
         const workflowScope = resolvePrdWorkflowScope(root, {
           tapdId: workflow.id,
           flowId,
@@ -14363,14 +14391,15 @@ export function startUiServer({
           archived: url.searchParams.get("archived") === "1",
           workspaceId: url.searchParams.get("workspaceId") || "",
           workflowShare: url.searchParams.get("workflowShare") || "",
-        }, userCtx);
+        }, userCtx, adminVersionRepair.requested ? "admin-version-repair" : "read");
         if (workflowScope.error) {
           json(res, workflowScope.status || 400, { error: workflowScope.error });
           return;
         }
         const scopedRoot = workflowScope.stateRoot;
         prdWorkflowMigrateLegacyState(workflowScope.executionRoot, scopedRoot, workflow.id);
-        const runtimeOnly = url.searchParams.get("runtimeOnly") === "1" ||
+        const runtimeOnly = adminVersionRepair.requested ||
+          url.searchParams.get("runtimeOnly") === "1" ||
           url.searchParams.get("runtime_only") === "1" ||
           url.searchParams.get("cached") === "1";
         const baseSnapshot = runtimeOnly
@@ -15606,7 +15635,7 @@ export function startUiServer({
           return;
         }
         report = adminVersionRepair.requested
-          ? prdWorkflowMergeAdminVersionTimeline(report, currentSnapshot)
+          ? prdWorkflowMergeAdminVersionTimeline(report, currentSnapshot, adminVersionRepair)
           : prdWorkflowMergeProducerTimeline(report, currentSnapshot);
         if (report.error) {
           json(res, 400, { error: report.error });
@@ -16066,7 +16095,7 @@ export function startUiServer({
           artifacts: [artifact],
           links: [{
             key: artifactKey,
-            label: "Markdown Review",
+            label: artifact.label,
             kind: artifact.kind,
             url: displayUrl,
             canonicalUrl: reviewUrl,
@@ -16652,6 +16681,40 @@ export function startUiServer({
       }
     }
 
+    if (url.pathname === "/api/admin/users" || url.pathname === "/api/admin/users/reset-password") {
+      if (!authUser?.isAdmin) {
+        json(res, 403, { error: "Admin permission required" });
+        return;
+      }
+      if (req.method === "GET" && url.pathname === "/api/admin/users") {
+        json(res, 200, { users: listAuthUsers() });
+        return;
+      }
+      if (req.method === "POST" && url.pathname === "/api/admin/users/reset-password") {
+        let payload;
+        try {
+          payload = JSON.parse(await readBody(req));
+        } catch {
+          json(res, 400, { error: "Invalid JSON body" });
+          return;
+        }
+        const targetUserId = String(payload?.userId || "").trim();
+        if (targetUserId === userCtx.userId) {
+          json(res, 400, { error: "不能在当前会话中重置自己的密码" });
+          return;
+        }
+        const result = resetAuthUserPassword(targetUserId, payload?.password);
+        if (!result.ok) {
+          json(res, result.status || 400, { error: result.error || "Password reset failed" });
+          return;
+        }
+        json(res, 200, result);
+        return;
+      }
+      json(res, 405, { error: "Method not allowed" });
+      return;
+    }
+
     if (url.pathname === "/api/flows") {
       if (req.method === "GET") {
         try {