npm - @fieldwangai/agentflow - Versions diffs - 0.1.143 → 0.1.144 - Mend

@fieldwangai/agentflow 0.1.143 → 0.1.144

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (21) hide show

package/README.md +8 -0
package/README.zh-CN.md +8 -0
package/bin/lib/auth.mjs +52 -0
package/bin/lib/catalog-flows.mjs +27 -2
package/bin/lib/flow-static-preview.mjs +104 -0
package/bin/lib/help.mjs +2 -0
package/bin/lib/main.mjs +64 -0
package/bin/lib/ui-server.mjs +52 -5
package/builtin/web-ui/dist/assets/{WorkflowAssistantThread-BttvNPJr.js → WorkflowAssistantThread-CnqBhGXJ.js} +1 -1
package/builtin/web-ui/dist/assets/index-5wTTj_jN.css +1 -0
package/builtin/web-ui/dist/assets/index-BnXKlBQj.js +889 -0
package/builtin/web-ui/dist/index.html +2 -2
package/package.json +1 -1
package/skills/agentflow-author-flow/SKILL.md +49 -0
package/skills/agentflow-author-flow/agents/openai.yaml +4 -0
package/skills/agentflow-cli/SKILL.md +15 -2
package/skills/agentflow-cli/scripts/agentflow-cli.mjs +120 -1
package/skills/agentflow-workflow-report/SKILL.md +1 -0
package/skills/agentflow-workflow-report/references/protocol.md +3 -0
package/builtin/web-ui/dist/assets/index-CtG65J3e.css +0 -1
package/builtin/web-ui/dist/assets/index-c8AUUsSF.js +0 -839

package/builtin/web-ui/dist/index.html CHANGED Viewed

@@ -15,8 +15,8 @@
       href="https://fonts.googleapis.com/css2?family=Material+Symbols+Outlined:opsz,wght,FILL,GRAD@24,400,0,0"
       rel="stylesheet"
     />
-    <script type="module" crossorigin src="/assets/index-c8AUUsSF.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-CtG65J3e.css">
+    <script type="module" crossorigin src="/assets/index-BnXKlBQj.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-5wTTj_jN.css">
   </head>
   <body>
     <div id="root"></div>

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@fieldwangai/agentflow",
-  "version": "0.1.143",
+  "version": "0.1.144",
   "description": "Orchestration system for long-running complex agent tasks using Cursor, OpenCode, Claude Code, or Codex as execution backends",
   "type": "module",
   "main": "bin/agentflow.mjs",

package/skills/agentflow-author-flow/SKILL.md ADDED Viewed

@@ -0,0 +1,49 @@
+---
+name: agentflow-author-flow
+description: Generate or revise an AgentFlow flow locally from a natural-language request, validate its flow.yaml, open a single-file platform-style preview, and publish it to personal, workspace, or team scope after user confirmation. Use when a user asks Codex, Cursor, Claude Code, or another coding agent to create, draw, preview, sync, upload, or publish an AgentFlow flow without using AI Composer or manually dragging nodes.
+---
+# Author an AgentFlow
+Turn the user's request into a locally reviewable Flow and handle the commands on their behalf. Do not ask the user to run preview or publish commands.
+## Required references
+Before creating or changing node schemas or edges, read:
+- [Builtin node schemas](../agentflow-node-reference/references/builtin-nodes.md)
+- [Control capabilities](../../reference/flow-control-capabilities.md)
+- [Flow layout](../../reference/flow-layout.md)
+Read [prompt and handler checks](../../reference/flow-prompt-handler-check.md) when the Flow contains agent nodes. Read [standard recipes](../agentflow-flow-recipes/references/recipes.md) when a recipe matches the request.
+## Workflow
+1. Convert the request into a short node plan. Ask only for a business choice that materially changes behavior; do not ask for YAML details.
+2. Choose a stable lowercase flow ID using letters, digits, hyphens, or underscores.
+3. Create the draft at `.workspace/agentflow/pipelines/<flow-id>/flow.yaml`. Start from the packaged `builtin/pipelines/new/flow.yaml` when available. Preserve any unrelated workspace files.
+4. Build nodes from authoritative definitions. Never invent `definitionId`, slot order, slot type, handle index, or control semantics. Give every instance a unique position and keep the main path left-to-right.
+5. Validate the draft with `agentflow validate <flow-id> --json`. In this repository, use `node bin/agentflow.mjs validate <flow-id> --json`. Fix all errors before continuing; surface warnings that affect behavior.
+6. Generate and open the static preview with `agentflow flow preview <path-to-flow.yaml>`. In this repository, use `node bin/agentflow.mjs flow preview <path-to-flow.yaml>`. This command must exit after opening the generated `file://` HTML; do not start `agentflow ui` or another server.
+7. Report the draft path and a compact node/edge summary, then wait for the user's visual confirmation. Do not write to the AgentFlow platform before confirmation unless the user explicitly requested direct publish without review.
+8. Ask for `personal`, `workspace`, or `team` only if the user has not already chosen the destination. `team` means a workspace Flow shared as editor with the current account's active team.
+9. Publish through the sibling `agentflow-cli` skill:
+   ```bash
+   node ../agentflow-cli/scripts/agentflow-cli.mjs publish-flow \
+     --flow-id <flow-id> \
+     --file <path-to-flow.yaml> \
+     --target-space <personal|workspace|team>
+   ```
+   Resolve the script relative to this `SKILL.md`. Never expose the token.
+10. If the server reports that the Flow already exists, stop and explain the conflict. Use `--replace` only after the user explicitly confirms updating that exact Flow and destination. The CLI reads the current revision before replacement.
+11. Verify the published graph with `get-graph --flow-id <flow-id> --flow-source <user|workspace>` and report the platform Flow ID, scope, and result.
+## Safety rules
+- Treat local generation and preview as reversible; treat platform publish and replacement as external writes.
+- Never silently convert a personal Flow into a shared Flow.
+- Never create a temporary test Flow on the production platform merely to validate tooling. Use an isolated local AgentFlow server or mock API for integration tests.
+- Do not run the Flow unless the user asks to execute it; publishing is not execution.
+- Keep a failed draft on disk so it can be inspected and repaired.

package/skills/agentflow-author-flow/agents/openai.yaml ADDED Viewed

@@ -0,0 +1,4 @@
+interface:
+  display_name: "AgentFlow Flow Authoring"
+  short_description: "Generate, preview, confirm, and publish AgentFlow flows"
+  default_prompt: "Use $agentflow-author-flow to generate a local AgentFlow, open its platform-style preview, and publish it after I confirm."

package/skills/agentflow-cli/SKILL.md CHANGED Viewed

@@ -1,6 +1,6 @@
 ---
 name: agentflow-cli
-description: Direct AgentFlow platform operation through a bundled token-backed CLI, without MCP. Use when Codex needs to list AgentFlow workspaces or flows, start or inspect runs, read graphs and logs, or fetch display outputs through AgentFlow HTTP APIs using AGENTFLOW_TOKEN from env or .env. Default AgentFlow base URL is http://ai.mengma.bigo.inner/.
+description: Direct AgentFlow platform operation through a bundled token-backed CLI, without MCP. Use when Codex needs to list or publish AgentFlow flows, start or inspect runs, read graphs and logs, or fetch display outputs through AgentFlow HTTP APIs using AGENTFLOW_TOKEN from env or .env. Default AgentFlow base URL is http://ai.mengma.bigo.inner/.
 ---
 # AgentFlow CLI
@@ -71,6 +71,17 @@ List flows:
 node skills/agentflow-cli/scripts/agentflow-cli.mjs list-flows
 ```
+Publish a new local Flow after the user has reviewed it:
+```bash
+node skills/agentflow-cli/scripts/agentflow-cli.mjs publish-flow \
+  --flow-id release-check \
+  --file .workspace/agentflow/pipelines/release-check/flow.yaml \
+  --target-space personal
+```
+Destinations are `personal`, `workspace`, and `team`. `team` creates a workspace Flow and shares it as editor with the current account's active team. Publishing is create-only by default. If the exact Flow already exists, stop and ask whether to update it; only after explicit confirmation rerun with `--replace`. Replacement first reads the server revision and submits it with the update.
 Read one flow graph:
 ```bash
@@ -132,13 +143,15 @@ The only admin write exception is audited version-membership repair. Read its st
 ## Workflow
 1. Check token availability with `config`.
-2. Use `list-workspace` or `list-flows` to discover targets.
+2. Use `list-workspace` or `list-flows` to discover targets. Use `publish-flow` only after a local Flow has passed validation and the user has confirmed the preview.
 3. Use `run` to start the flow. If the task needs the generated page/text, inspect returned `displayOutputs` or call `display-outputs`.
 4. Use `status`, `list-run-by-workspace`, and `logs` when a run is active, failed, or needs debugging.
 ## Failure Handling
 - If the CLI says the token is missing, ask the user to set `AGENTFLOW_TOKEN` in env or `.env`.
+- If `publish-flow` returns 409, do not add `--replace` automatically. Ask the user to confirm updating the existing Flow.
+- If team publishing says no active team is assigned, keep the local draft and ask the user to choose personal/workspace or have an admin assign the account to a team.
 - If the API returns 401/403, do not retry with a printed token. Ask the user to refresh the token.
 - If `run` fails because a flow is already running, call `status` and `list-run-by-workspace` before retrying.
 - If local debugging is needed, override `AGENTFLOW_BASE_URL`; otherwise keep the default internal URL.

package/skills/agentflow-cli/scripts/agentflow-cli.mjs CHANGED Viewed

@@ -33,6 +33,7 @@ Commands:
   config
   list-workspace | list-workspaces
   list-flows
+  publish-flow --flow-id <id> --file <flow.yaml> [--target-space personal|workspace|team] [--replace]
   get-graph --flow-id <id> [--flow-source user]
   run --flow-id <id> [--flow-source user] [--run-node-id <id>] [--input k=v]
   status --flow-id <id> [--flow-source user]
@@ -166,7 +167,36 @@ async function httpJson(args, pathname, { method = "GET", body, tokenRequired =
   }
   if (!response.ok) {
     const message = data?.error || data?.message || text || `HTTP ${response.status}`;
-    throw new Error(`${method} ${url.pathname} failed: ${message}`);
+    const error = new Error(`${method} ${url.pathname} failed: ${message}`);
+    error.status = response.status;
+    error.response = data;
+    throw error;
+  }
+  return data;
+}
+async function httpMultipart(args, pathname, form) {
+  const token = authToken(args);
+  const url = new URL(pathname, normalizedBaseUrl(args));
+  const headers = { Accept: "application/json" };
+  if (token) {
+    headers.Authorization = `Bearer ${token}`;
+    headers.Cookie = `af_session=${encodeURIComponent(token)}`;
+  }
+  const response = await fetch(url, { method: "POST", headers, body: form });
+  const text = await response.text();
+  let data = null;
+  try {
+    data = text ? JSON.parse(text) : null;
+  } catch {
+    data = { text };
+  }
+  if (!response.ok) {
+    const message = data?.error || data?.message || text || `HTTP ${response.status}`;
+    const error = new Error(`POST ${url.pathname} failed: ${message}`);
+    error.status = response.status;
+    error.response = data;
+    throw error;
   }
   return data;
 }
@@ -277,6 +307,54 @@ function readJsonFile(filePath) {
   }
 }
+function readFlowYamlFile(filePath) {
+  const requested = String(filePath || "").trim();
+  if (!requested) throw new Error("Missing --file <flow.yaml>.");
+  const resolved = path.resolve(requested);
+  let flowYaml;
+  try {
+    flowYaml = fs.readFileSync(resolved, "utf8");
+  } catch (error) {
+    throw new Error(`Cannot read flow file ${resolved}: ${error?.message || String(error)}`);
+  }
+  if (!flowYaml.trim()) throw new Error(`Flow file is empty: ${resolved}`);
+  return { resolved, flowYaml };
+}
+function targetDestinationFromArgs(args) {
+  const requested = (option(args, "target-space") || option(args, "flow-source") || "personal").toLowerCase();
+  if (requested === "personal" || requested === "user") return { flowSource: "user", shareWithTeam: false };
+  if (requested === "workspace") return { flowSource: "workspace", shareWithTeam: false };
+  if (requested === "team") return { flowSource: "workspace", shareWithTeam: true };
+  throw new Error("Invalid --target-space. Use personal|workspace|team (alias: user).");
+}
+async function importFlow(args, { flowId, targetSpace, resolved, flowYaml }) {
+  const form = new FormData();
+  form.set("flowId", flowId);
+  form.set("targetSpace", targetSpace);
+  form.set("file", new Blob([flowYaml], { type: "application/yaml" }), path.basename(resolved));
+  return httpMultipart(args, "/api/flows/import", form);
+}
+async function resolvePublishTeam(args, shareWithTeam) {
+  if (!shareWithTeam) return null;
+  const result = await httpJson(args, "/api/teams/me");
+  if (!result?.team?.id) {
+    throw new Error("Cannot publish to team: the current AgentFlow account is not assigned to an active team.");
+  }
+  return result.team;
+}
+async function sharePublishedFlowWithTeam(args, { flowId, flowSource, team }) {
+  if (!team) return null;
+  const result = await httpJson(args, "/api/workspace/collaboration/team-share", {
+    method: "POST",
+    body: { flowId, flowSource, teamId: team.id, role: "editor" },
+  });
+  return result?.team || team;
+}
 async function main() {
   loadEnvFiles();
   const args = parseArgv(process.argv.slice(2));
@@ -312,6 +390,47 @@ async function main() {
     return;
   }
+  if (command === "publish-flow") {
+    const flowId = requireFlowId(args);
+    const destination = targetDestinationFromArgs(args);
+    const targetSpace = destination.flowSource;
+    const source = readFlowYamlFile(option(args, "file"));
+    const replace = args.replace === true;
+    const team = await resolvePublishTeam(args, destination.shareWithTeam);
+    if (!replace) {
+      const result = await importFlow(args, { flowId, targetSpace, ...source });
+      const sharedTeam = await sharePublishedFlowWithTeam(args, { flowId, flowSource: targetSpace, team });
+      printJson({ ...result, action: "created", targetSpace: team ? "team" : targetSpace, team: sharedTeam, file: source.resolved });
+      return;
+    }
+    let current = null;
+    try {
+      current = await httpJson(args, `/api/flow${query({ flowId, flowSource: targetSpace })}`);
+    } catch (error) {
+      if (error?.status !== 404) throw error;
+    }
+    if (!current) {
+      const result = await importFlow(args, { flowId, targetSpace, ...source });
+      const sharedTeam = await sharePublishedFlowWithTeam(args, { flowId, flowSource: targetSpace, team });
+      printJson({ ...result, action: "created", targetSpace: team ? "team" : targetSpace, team: sharedTeam, file: source.resolved });
+      return;
+    }
+    const result = await httpJson(args, "/api/flow", {
+      method: "POST",
+      body: {
+        flowId,
+        flowSource: targetSpace,
+        flowYaml: source.flowYaml,
+        baseRevision: current.revision,
+      },
+    });
+    const sharedTeam = await sharePublishedFlowWithTeam(args, { flowId, flowSource: targetSpace, team });
+    printJson({ ...result, flowId, flowSource: targetSpace, action: "updated", targetSpace: team ? "team" : targetSpace, team: sharedTeam, file: source.resolved });
+    return;
+  }
   if (command === "get-graph") {
     const flowId = requireFlowId(args);
     const flowSource = option(args, "flow-source") || "user";

package/skills/agentflow-workflow-report/SKILL.md CHANGED Viewed

@@ -93,6 +93,7 @@ For local Markdown or other content that must become a browser URL, publish it f
 - Keep explicit grants separate from derived TAPD membership. Allow Owner and explicit Reporter writes. Treat TAPD participant Viewer, explicit Viewer, same-team Viewer, share-link Viewer, and ordinary admin review as read-only. The only admin write exception is an explicit audited `adminOperation=repair-version-membership` Report containing only `kind=version` timeline projections, with required `expectedRevision` and `idempotencyKey`; it must never admit Action, Artifact, Observation, GlobalState, Extension, Checklist, or non-version projection writes. Accept legacy `editor` only as a compatibility alias for Reporter.
 - An admin obtaining the strict revision for that repair must explicitly read state with
   `adminOperation=repair-version-membership` (CLI: `workflow-get --runtime-only --admin-operation repair-version-membership`). The server resolves only that read as `admin-version-repair`; it does not grant ordinary admin CLI access to unrelated Workflows.
+- Admin management UI must provide a concise `adminReason` for the audit event. Keep it optional for legacy CLI compatibility, but never omit it from new interactive management flows.
 - `observation.state` replaces the complete previous observation for the same `clientId`.
 - `globalState.patch` recursively merges objects; arrays and scalars replace; `null` and `remove` delete explicit paths. The first reporting source to write a path owns it; another source cannot overwrite an owned path.
 - Reusing an `action.key` updates the same semantic stage. Do not create a new key for refreshes or retries.

package/skills/agentflow-workflow-report/references/protocol.md CHANGED Viewed

@@ -316,6 +316,7 @@ Authorization: Bearer <AGENTFLOW_TOKEN>
 | `expectedRevision` | string | 兼容字段 | 仅在没有 `expectedVersions` 时启用的整 Workflow 严格锁；新接入不要使用 |
 | `idempotencyKey` | string | 强烈建议 | 一次业务语义操作的稳定身份，不使用时间戳或随机 UUID |
 | `adminOperation` | string | 管理员特例 | 仅 `repair-version-membership`；详见 5.3 |
+| `adminReason` | string | 管理员 UI 建议必填 | 版本归属修复原因，最多 500 字符；写入审计事件 |
 | `observation` | object | 条件必填 | 同一 `clientId` 的完整生产方观察 |
 | `action` | object | 条件必填 | 一条关键业务阶段 |
 | `artifacts` | array | 条件必填 | Action 证据或全局证据 |
@@ -358,6 +359,7 @@ Authorization: Bearer <AGENTFLOW_TOKEN>
   "workflow": "tapd:1013667",
   "source": "prd-flow",
   "adminOperation": "repair-version-membership",
+  "adminReason": "清理测试版本并归属到正式迭代",
   "projections": {
     "timeline": [{
       "kind": "version",
@@ -380,6 +382,7 @@ Authorization: Bearer <AGENTFLOW_TOKEN>
 - 所有新投影必须是 `kind=version`；当前 source 的非版本投影和其他 source 的全部投影原子保留。
 - `expectedRevision` 与 `idempotencyKey` 必填。并发变化返回 `409`，失败时不产生部分写入。
 - 运行态事件写入 `administrativeRepair.kind=version-attribution`、管理员 actor 和时间，供审计追踪。
+- 管理 UI 必须提交 `adminReason`；旧 CLI 请求可暂时省略以保持兼容。
 - 空 `timeline` 表示清空该 source 的版本归属，但仍保留该 source 的 Sprint/Milestone 等非版本条目。
 ## 6. POST /api/workflow-artifacts/publish：发布 Markdown 预览