@fieldwangai/agentflow 0.1.159 → 0.1.162

package/bin/lib/auth.mjs

@@ -11,6 +11,17 @@ import {
 
 const SESSION_COOKIE = "af_session";
 const SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+const CLI_SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+const CLI_AUTHORIZATION_TTL_MS = 10 * 60 * 1000;
+const CLI_AUTHORIZATION_SCOPES = [
+  "workspace:read",
+  "workspace:write",
+  "workspace:run",
+  "flow:publish",
+  "schedule:manage",
+  "node-package:manage",
+  "workflow:manage",
+];
 
 function authRoot() {
   return path.join(getAgentflowDataRoot(), "auth");
@@ -24,6 +35,10 @@ function sessionsPath() {
   return path.join(authRoot(), "sessions.json");
 }
 
+function cliAuthorizationsPath() {
+  return path.join(authRoot(), "cli-authorizations.json");
+}
+
 function userAllowlistPath() {
   return path.join(authRoot(), "user-allowlist.json");
 }
@@ -62,6 +77,67 @@ function hashToken(token) {
   return crypto.createHash("sha256").update(String(token)).digest("hex");
 }
 
+function createSessionForUser(userId, options = {}) {
+  const users = readAuthUsers();
+  const user = users[userId];
+  if (!user) return { ok: false, error: "用户不存在" };
+  const now = Date.now();
+  const token = crypto.randomBytes(32).toString("base64url");
+  const sessions = readJsonObject(sessionsPath());
+  sessions[hashToken(token)] = {
+    userId,
+    kind: String(options.kind || "web"),
+    clientName: String(options.clientName || "").trim(),
+    scopes: Array.isArray(options.scopes) ? options.scopes.map(String).filter(Boolean) : [],
+    createdAt: now,
+    expiresAt: now + (Number(options.ttlMs) || SESSION_TTL_MS),
+  };
+  writeJsonObject(sessionsPath(), sessions);
+  return {
+    ok: true,
+    token,
+    expiresAt: sessions[hashToken(token)].expiresAt,
+    user: { userId, username: user.username || userId, isAdmin: Boolean(user.isAdmin) },
+  };
+}
+
+function purgeExpiredCliAuthorizations(authorizations, now = Date.now()) {
+  let changed = false;
+  for (const [requestId, record] of Object.entries(authorizations)) {
+    if (Number(record?.expiresAt) > now && record?.status !== "consumed") continue;
+    delete authorizations[requestId];
+    changed = true;
+  }
+  return changed;
+}
+
+function normalizedCliClientName(value) {
+  const text = String(value || "AgentFlow CLI").trim().slice(0, 80);
+  return text || "AgentFlow CLI";
+}
+
+function cliAuthorizationSummary(requestId, record) {
+  if (!record) return null;
+  return {
+    requestId,
+    userCode: String(record.userCode || ""),
+    clientName: String(record.clientName || "AgentFlow CLI"),
+    scopes: Array.isArray(record.scopes) ? record.scopes.map(String) : [],
+    status: String(record.status || "pending"),
+    createdAt: Number(record.createdAt) || 0,
+    expiresAt: Number(record.expiresAt) || 0,
+    approvedUserId: String(record.approvedUserId || ""),
+  };
+}
+
+function randomUserCode() {
+  const alphabet = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
+  const bytes = crypto.randomBytes(8);
+  let out = "";
+  for (let i = 0; i < 8; i += 1) out += alphabet[bytes[i] % alphabet.length];
+  return `${out.slice(0, 4)}-${out.slice(4)}`;
+}
+
 function parseCookies(header) {
   const out = {};
   for (const part of String(header || "").split(";")) {
@@ -322,9 +398,160 @@ export function getAuthUserFromRequest(req) {
     userId: session.userId,
     username: user.username || session.userId,
     isAdmin: Boolean(user.isAdmin),
+    sessionKind: String(session.kind || "web"),
+    clientName: String(session.clientName || ""),
+    scopes: Array.isArray(session.scopes) ? session.scopes.map(String) : [],
+    sessionExpiresAt: Number(session.expiresAt) || 0,
+  };
+}
+
+export function createCliAuthorization({ publicBaseUrl, clientName } = {}) {
+  const now = Date.now();
+  const requestId = crypto.randomBytes(18).toString("base64url");
+  const deviceCode = crypto.randomBytes(32).toString("base64url");
+  const approvalNonce = crypto.randomBytes(24).toString("base64url");
+  const authorizations = readJsonObject(cliAuthorizationsPath());
+  purgeExpiredCliAuthorizations(authorizations, now);
+  const active = Object.entries(authorizations)
+    .sort((left, right) => Number(left[1]?.createdAt) - Number(right[1]?.createdAt));
+  while (active.length >= 256) {
+    const [oldestId] = active.shift();
+    delete authorizations[oldestId];
+  }
+  authorizations[requestId] = {
+    deviceCodeHash: hashToken(deviceCode),
+    approvalNonceHash: hashToken(approvalNonce),
+    approvalNonce,
+    userCode: randomUserCode(),
+    clientName: normalizedCliClientName(clientName),
+    scopes: [...CLI_AUTHORIZATION_SCOPES],
+    status: "pending",
+    createdAt: now,
+    expiresAt: now + CLI_AUTHORIZATION_TTL_MS,
+  };
+  writeJsonObject(cliAuthorizationsPath(), authorizations);
+  const base = String(publicBaseUrl || "").replace(/\/+$/, "");
+  return {
+    ...cliAuthorizationSummary(requestId, authorizations[requestId]),
+    deviceCode,
+    approvalNonce,
+    verificationUrl: `${base}/cli/authorize?request=${encodeURIComponent(requestId)}`,
+    pollInterval: 3,
   };
 }
 
+export function getCliAuthorization(requestId, { includeApprovalNonce = false } = {}) {
+  const id = String(requestId || "").trim();
+  if (!id) return { ok: false, status: 400, error: "缺少授权请求" };
+  const authorizations = readJsonObject(cliAuthorizationsPath());
+  const changed = purgeExpiredCliAuthorizations(authorizations);
+  if (changed) writeJsonObject(cliAuthorizationsPath(), authorizations);
+  const record = authorizations[id];
+  if (!record) return { ok: false, status: 404, error: "授权请求不存在或已过期" };
+  return {
+    ok: true,
+    authorization: cliAuthorizationSummary(id, record),
+    ...(includeApprovalNonce ? { approvalNonce: String(record.approvalNonce || "") } : {}),
+  };
+}
+
+export function decideCliAuthorization({ requestId, approvalNonce, userId, approved }) {
+  const id = String(requestId || "").trim();
+  const normalizedUserId = sanitizeAgentflowUserId(userId);
+  if (!id || !normalizedUserId) return { ok: false, status: 400, error: "授权请求无效" };
+  const authorizations = readJsonObject(cliAuthorizationsPath());
+  purgeExpiredCliAuthorizations(authorizations);
+  const record = authorizations[id];
+  if (!record) {
+    writeJsonObject(cliAuthorizationsPath(), authorizations);
+    return { ok: false, status: 404, error: "授权请求不存在或已过期" };
+  }
+  if (record.status !== "pending") {
+    return { ok: false, status: 409, error: "授权请求已经处理" };
+  }
+  const suppliedNonce = String(approvalNonce || "");
+  if (!suppliedNonce || hashToken(suppliedNonce) !== String(record.approvalNonceHash || "")) {
+    return { ok: false, status: 403, error: "授权确认已失效，请刷新页面" };
+  }
+  record.status = approved ? "approved" : "denied";
+  record.approvedUserId = normalizedUserId;
+  record.decidedAt = Date.now();
+  authorizations[id] = record;
+  writeJsonObject(cliAuthorizationsPath(), authorizations);
+  return { ok: true, authorization: cliAuthorizationSummary(id, record) };
+}
+
+export function exchangeCliAuthorization(deviceCode) {
+  const codeHash = hashToken(String(deviceCode || ""));
+  if (!String(deviceCode || "").trim()) return { ok: false, status: 400, error: "缺少 deviceCode" };
+  const now = Date.now();
+  const authorizations = readJsonObject(cliAuthorizationsPath());
+  purgeExpiredCliAuthorizations(authorizations, now);
+  const entry = Object.entries(authorizations).find(([, record]) => record?.deviceCodeHash === codeHash);
+  if (!entry) {
+    writeJsonObject(cliAuthorizationsPath(), authorizations);
+    return { ok: false, status: 410, error: "授权请求不存在或已过期", code: "expired_token" };
+  }
+  const [requestId, record] = entry;
+  if (record.status === "pending") {
+    if (Number(record.lastPolledAt) > 0 && now - Number(record.lastPolledAt) < 1000) {
+      return {
+        ok: false,
+        status: 429,
+        error: "轮询过于频繁",
+        code: "slow_down",
+        authorization: cliAuthorizationSummary(requestId, record),
+      };
+    }
+    record.lastPolledAt = now;
+    authorizations[requestId] = record;
+    writeJsonObject(cliAuthorizationsPath(), authorizations);
+    return {
+      ok: false,
+      status: 202,
+      error: "等待用户授权",
+      code: "authorization_pending",
+      authorization: cliAuthorizationSummary(requestId, record),
+    };
+  }
+  if (record.status === "denied") {
+    delete authorizations[requestId];
+    writeJsonObject(cliAuthorizationsPath(), authorizations);
+    return { ok: false, status: 403, error: "用户拒绝了授权", code: "access_denied" };
+  }
+  if (record.status !== "approved" || !record.approvedUserId) {
+    return { ok: false, status: 409, error: "授权状态无效", code: "invalid_grant" };
+  }
+  const session = createSessionForUser(record.approvedUserId, {
+    kind: "cli",
+    clientName: record.clientName,
+    scopes: record.scopes,
+    ttlMs: CLI_SESSION_TTL_MS,
+  });
+  if (!session.ok) return { ok: false, status: 401, error: session.error || "无法创建 CLI Session" };
+  delete authorizations[requestId];
+  writeJsonObject(cliAuthorizationsPath(), authorizations);
+  return {
+    ok: true,
+    token: session.token,
+    tokenType: "Bearer",
+    expiresAt: session.expiresAt,
+    user: session.user,
+    scopes: Array.isArray(record.scopes) ? record.scopes.map(String) : [],
+  };
+}
+
+export function revokeSessionToken(token) {
+  const raw = String(token || "").trim();
+  if (!raw) return false;
+  const sessions = readJsonObject(sessionsPath());
+  const key = hashToken(raw);
+  if (!sessions[key]) return false;
+  delete sessions[key];
+  writeJsonObject(sessionsPath(), sessions);
+  return true;
+}
+
 export function loginOrCreateUser(username, password) {
   const userId = sanitizeAgentflowUserId(username);
   if (!userId) {
@@ -364,26 +591,16 @@ export function loginOrCreateUser(username, password) {
     }
   }
 
-  const token = crypto.randomBytes(32).toString("base64url");
-  const sessions = readJsonObject(sessionsPath());
-  sessions[hashToken(token)] = {
-    userId,
-    createdAt: Date.now(),
-    expiresAt: Date.now() + SESSION_TTL_MS,
-  };
-  writeJsonObject(sessionsPath(), sessions);
+  const session = createSessionForUser(userId, { kind: "web" });
   return {
     ok: true,
-    token,
+    token: session.token,
     user: { userId, username: user.username || userId, isAdmin: Boolean(user.isAdmin) },
     migration,
   };
 }
 
 export function logoutRequest(req) {
-  const token = parseCookies(req.headers.cookie || "")[SESSION_COOKIE];
-  if (!token) return;
-  const sessions = readJsonObject(sessionsPath());
-  delete sessions[hashToken(token)];
-  writeJsonObject(sessionsPath(), sessions);
+  const token = getSessionTokenFromRequest(req);
+  revokeSessionToken(token);
 }

package/bin/lib/catalog-flows.mjs

@@ -28,7 +28,9 @@ import {
   resolveMarketplaceNodePackage,
 } from "./marketplace.mjs";
 import { isWorkspacePreviewDir } from "./workspace-preview.mjs";
+import { isWorkspaceDraftDir } from "./workspace-draft.mjs";
 import { RETIRED_NODE_IDS } from "./legacy-flow-execution.mjs";
+import { normalizeNodeUiForSlots } from "./node-ui-kit.mjs";
 
 /** 从指定目录收集含 flow.yaml 的子目录名。 */
 export function collectPipelineNamesFromDir(dirPath) {
@@ -38,6 +40,7 @@ export function collectPipelineNamesFromDir(dirPath) {
     .filter((e) => e.isDirectory())
     .filter((e) => isFlowDir(path.join(dirPath, e.name)))
     .filter((e) => !isWorkspacePreviewDir(path.join(dirPath, e.name)))
+    .filter((e) => !isWorkspaceDraftDir(path.join(dirPath, e.name)))
     .map((e) => e.name);
 }
 
@@ -219,6 +222,7 @@ export function parseNodeFrontmatter(raw) {
     displayName: undefined,
     description: undefined,
     guide: undefined,
+    ui: undefined,
     runtime: "native",
     type: "",
     paletteHidden: false,
@@ -242,6 +246,7 @@ export function parseNodeFrontmatter(raw) {
       data.paletteHidden = String(parsed.palette ?? "").trim().toLowerCase() === "hidden";
       data.input = normalizeFrontmatterSlots(parsed.input);
       data.output = normalizeFrontmatterSlots(parsed.output);
+      data.ui = normalizeNodeUiForSlots(parsed.ui, data.input, data.output);
       return data;
     }
   } catch {
@@ -320,7 +325,7 @@ export function listNodesJson(workspaceRoot, flowId, flowSource, opts = {}) {
         // frontmatter 的 type: 优先于按 id 前缀的推断（workspace_run 等不带前缀的节点靠它归类）
         if (data.type) type = data.type;
         // frontmatter 的 palette: hidden 与 RETIRED_NODE_IDS 等价，让节点自带可见性
-        if (data.paletteHidden) continue;
+        if (data.paletteHidden && !opts.includeHidden) continue;
         const strippedId =
           id.replace(/^agent_?/i, "").replace(/^control_?/i, "").replace(/^provide_?/i, "").replace(/^tool_?/i, "") || id;
         const label = data.displayName ?? strippedId;
@@ -343,6 +348,8 @@ export function listNodesJson(workspaceRoot, flowId, flowSource, opts = {}) {
           displayName: translatedDisplayName || data.displayName,
           description: translatedDescription || data.description,
           guide: translatedGuide || data.guide,
+          ui: data.ui,
+          paletteHidden: Boolean(data.paletteHidden),
           inputs: data.input,
           outputs: data.output,
           source: flowIdOpt ? "flow" : "project",
@@ -364,6 +371,7 @@ export function listNodesJson(workspaceRoot, flowId, flowSource, opts = {}) {
         label: manifest.displayName,
         displayName: manifest.displayName,
         description: manifest.description,
+        ui: manifest.ui,
         inputs: manifest.input,
         outputs: manifest.output,
         source: flowIdOpt ? "flow" : "project",
@@ -392,6 +400,7 @@ export function listNodesJson(workspaceRoot, flowId, flowSource, opts = {}) {
       label: manifest.displayName,
       displayName: manifest.displayName,
       description: manifest.description,
+      ui: manifest.ui,
       inputs: manifest.input,
       outputs: manifest.output,
       source: manifest.source || "marketplace",
@@ -664,6 +673,7 @@ export function readNodeJson(workspaceRoot, nodeId, flowId, flowSource, opts = {
       version: resolved.version,
       packageDir: resolved.packageDir,
       runtime: resolved.runtime,
+      ui: resolved.ui,
     };
   }
   const fileName = nodeId.endsWith(".md") ? nodeId : `${nodeId}.md`;
@@ -724,6 +734,7 @@ export function readNodeJson(workspaceRoot, nodeId, flowId, flowSource, opts = {
         executionLogic: content || undefined,
         description: data.description,
         guide: data.guide,
+        ui: data.ui,
       };
     } catch (_) {}
   }

package/bin/lib/cli-auth-page.mjs

@@ -0,0 +1,103 @@
+function escapeHtml(value) {
+  return String(value ?? "")
+    .replace(/&/g, "&")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+    .replace(/'/g, "&#39;");
+}
+
+function pageShell(title, body) {
+  return `<!doctype html>
+<html lang="zh-CN">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <meta name="referrer" content="no-referrer" />
+  <title>${escapeHtml(title)} · AgentFlow</title>
+  <style>
+    :root { color-scheme: dark; font-family: Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; }
+    * { box-sizing: border-box; }
+    body { margin: 0; min-height: 100vh; display: grid; place-items: center; color: #f6f3ff; background: radial-gradient(circle at top, #2b2048 0, #15121f 42%, #0c0b10 100%); }
+    main { width: min(92vw, 580px); border: 1px solid #4b4265; border-radius: 22px; padding: 30px; background: rgba(28, 25, 36, .96); box-shadow: 0 28px 80px rgba(0,0,0,.48); }
+    .brand { color: #ae98ff; font-size: 13px; font-weight: 800; letter-spacing: .14em; text-transform: uppercase; }
+    h1 { margin: 12px 0 8px; font-size: 28px; }
+    p { color: #bdb7cb; line-height: 1.6; }
+    .code { display: inline-block; margin: 10px 0 18px; padding: 9px 13px; border: 1px solid #51466e; border-radius: 10px; color: #d4c8ff; background: #15121d; font-family: ui-monospace, SFMono-Regular, Menlo, monospace; letter-spacing: .08em; }
+    .card { margin: 20px 0; padding: 16px; border: 1px solid #3d374c; border-radius: 14px; background: #23202b; }
+    ul { margin: 10px 0 0; padding-left: 22px; color: #d0cadb; line-height: 1.8; }
+    label { display: block; margin: 14px 0 6px; color: #c9c2d7; font-size: 13px; font-weight: 700; }
+    input { width: 100%; padding: 12px 13px; border: 1px solid #514a60; border-radius: 10px; color: #fff; background: #15131a; font: inherit; }
+    .actions { display: flex; justify-content: flex-end; gap: 10px; margin-top: 22px; }
+    button { min-width: 112px; padding: 11px 18px; border: 1px solid #554d66; border-radius: 999px; color: #fff; background: #302b39; font: inherit; font-weight: 750; cursor: pointer; }
+    button.primary { border-color: #8d72ff; background: #7352ef; }
+    button.danger { color: #ffc8c8; }
+    .error { padding: 12px 14px; border: 1px solid #8b454d; border-radius: 10px; color: #ffd1d4; background: #351d22; }
+    .identity { color: #8edcb5; }
+    .fine { margin-top: 22px; color: #837d90; font-size: 12px; }
+  </style>
+</head>
+<body><main>${body}</main></body>
+</html>`;
+}
+
+const SCOPE_LABELS = new Map([
+  ["workspace:read", "读取你的 Workspace 与 Flow"],
+  ["workspace:write", "创建和修改 Draft Workspace"],
+  ["workspace:run", "运行 Draft 与已发布 Flow"],
+  ["flow:publish", "发布 Flow 到你的空间"],
+  ["schedule:manage", "配置和触发定时运行"],
+  ["node-package:manage", "管理可复用节点包"],
+  ["workflow:manage", "读取和更新 Workflow 数据"],
+]);
+
+export function renderCliAuthorizationPage({ authorization, approvalNonce = "", user = null, error = "" } = {}) {
+  if (!authorization) {
+    return pageShell("CLI 授权", `<div class="brand">AgentFlow CLI</div><h1>授权请求无效</h1><p>${escapeHtml(error || "该链接不存在或已经过期。")}</p>`);
+  }
+  const requestId = escapeHtml(authorization.requestId);
+  const clientName = escapeHtml(authorization.clientName || "AgentFlow CLI");
+  const code = escapeHtml(authorization.userCode || "");
+  const errorBlock = error ? `<div class="error">${escapeHtml(error)}</div>` : "";
+  if (!user) {
+    return pageShell("登录并授权", `
+      <div class="brand">AgentFlow CLI Authorization</div>
+      <h1>登录后授权 ${clientName}</h1>
+      <p>请求代码</p><div class="code">${code}</div>
+      ${errorBlock}
+      <form method="post" action="/cli/authorize/login">
+        <input type="hidden" name="request" value="${requestId}" />
+        <label for="username">用户名</label><input id="username" name="username" autocomplete="username" required />
+        <label for="password">密码</label><input id="password" name="password" type="password" autocomplete="current-password" required />
+        <div class="actions"><button class="primary" type="submit">登录并继续</button></div>
+      </form>
+      <div class="fine">密码只提交给当前 AgentFlow 服务，不会传给 CLI。</div>`);
+  }
+  const scopes = (authorization.scopes || []).map((scope) => `<li>${escapeHtml(SCOPE_LABELS.get(scope) || scope)}</li>`).join("");
+  return pageShell("确认 CLI 授权", `
+    <div class="brand">AgentFlow CLI Authorization</div>
+    <h1>允许 ${clientName} 访问？</h1>
+    <p class="identity">当前账号：${escapeHtml(user.username || user.userId)}</p>
+    <p>请求代码</p><div class="code">${code}</div>
+    ${errorBlock}
+    <div class="card"><strong>授权后 CLI 可以：</strong><ul>${scopes}</ul></div>
+    <form method="post" action="/cli/authorize/decision">
+      <input type="hidden" name="request" value="${requestId}" />
+      <input type="hidden" name="approvalNonce" value="${escapeHtml(approvalNonce)}" />
+      <div class="actions">
+        <button class="danger" type="submit" name="decision" value="deny">拒绝</button>
+        <button class="primary" type="submit" name="decision" value="approve">允许</button>
+      </div>
+    </form>
+    <div class="fine">CLI 将获得独立凭据；撤销 CLI 授权不会退出当前网页。</div>`);
+}
+
+export function renderCliAuthorizationResult({ approved, clientName = "AgentFlow CLI", error = "" } = {}) {
+  const title = error ? "授权失败" : approved ? "授权完成" : "已拒绝授权";
+  const message = error
+    ? escapeHtml(error)
+    : approved
+      ? `已允许 ${escapeHtml(clientName)} 访问。你可以关闭此页面并返回终端。`
+      : `没有授予 ${escapeHtml(clientName)} 访问权限。你可以关闭此页面。`;
+  return pageShell(title, `<div class="brand">AgentFlow CLI</div><h1>${title}</h1><p>${message}</p>`);
+}