@fieldwangai/agentflow 0.1.159 → 0.1.162

package/skills/agentflow-cli/scripts/agentflow-auth-store.mjs

@@ -0,0 +1,113 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+function emptyStore() {
+  return { version: 1, profiles: {}, pending: {} };
+}
+
+export function agentFlowAuthFile() {
+  const configured = String(process.env.AGENTFLOW_AUTH_FILE || "").trim();
+  return path.resolve(configured || path.join(os.homedir(), ".agentflow", "auth.json"));
+}
+
+export function readAgentFlowAuthStore() {
+  const file = agentFlowAuthFile();
+  try {
+    const data = JSON.parse(fs.readFileSync(file, "utf-8"));
+    if (!data || typeof data !== "object" || Array.isArray(data)) return emptyStore();
+    return {
+      version: 1,
+      profiles: data.profiles && typeof data.profiles === "object" && !Array.isArray(data.profiles) ? data.profiles : {},
+      pending: data.pending && typeof data.pending === "object" && !Array.isArray(data.pending) ? data.pending : {},
+    };
+  } catch {
+    return emptyStore();
+  }
+}
+
+export function writeAgentFlowAuthStore(store) {
+  const file = agentFlowAuthFile();
+  const dir = path.dirname(file);
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  try { fs.chmodSync(dir, 0o700); } catch {}
+  const temp = `${file}.${process.pid}.${crypto.randomBytes(6).toString("hex")}.tmp`;
+  fs.writeFileSync(temp, `${JSON.stringify(store, null, 2)}\n`, { encoding: "utf-8", mode: 0o600 });
+  try { fs.chmodSync(temp, 0o600); } catch {}
+  fs.renameSync(temp, file);
+  try { fs.chmodSync(file, 0o600); } catch {}
+  return file;
+}
+
+function profileKey(baseUrl) {
+  return String(baseUrl || "").replace(/\/+$/, "");
+}
+
+export function savedAgentFlowProfile(baseUrl) {
+  const key = profileKey(baseUrl);
+  const profile = readAgentFlowAuthStore().profiles[key];
+  if (!profile || typeof profile !== "object") return null;
+  if (Number(profile.expiresAt) > 0 && Number(profile.expiresAt) <= Date.now()) return null;
+  const token = String(profile.token || "").trim();
+  return token ? { ...profile, token } : null;
+}
+
+export function savedAgentFlowPendingAuthorization(baseUrl) {
+  const key = profileKey(baseUrl);
+  const pending = readAgentFlowAuthStore().pending[key];
+  if (!pending || typeof pending !== "object") return null;
+  if (Number(pending.expiresAt) > 0 && Number(pending.expiresAt) <= Date.now()) return null;
+  return { ...pending };
+}
+
+export function saveAgentFlowPendingAuthorization(baseUrl, pending) {
+  const key = profileKey(baseUrl);
+  const store = readAgentFlowAuthStore();
+  store.pending[key] = {
+    requestId: String(pending.requestId || ""),
+    deviceCode: String(pending.deviceCode || ""),
+    userCode: String(pending.userCode || ""),
+    verificationUrl: String(pending.verificationUrl || ""),
+    expiresAt: Number(pending.expiresAt) || 0,
+    pollInterval: Number(pending.pollInterval) || 3,
+    createdAt: Date.now(),
+  };
+  writeAgentFlowAuthStore(store);
+  return { ...store.pending[key], deviceCode: undefined };
+}
+
+export function saveAgentFlowProfile(baseUrl, profile) {
+  const key = profileKey(baseUrl);
+  const store = readAgentFlowAuthStore();
+  store.profiles[key] = {
+    token: String(profile.token || ""),
+    tokenType: String(profile.tokenType || "Bearer"),
+    expiresAt: Number(profile.expiresAt) || 0,
+    user: profile.user && typeof profile.user === "object" ? profile.user : null,
+    scopes: Array.isArray(profile.scopes) ? profile.scopes.map(String) : [],
+    updatedAt: Date.now(),
+  };
+  delete store.pending[key];
+  const file = writeAgentFlowAuthStore(store);
+  return { file, profile: { ...store.profiles[key], token: undefined } };
+}
+
+export function clearAgentFlowPendingAuthorization(baseUrl) {
+  const key = profileKey(baseUrl);
+  const store = readAgentFlowAuthStore();
+  if (!store.pending[key]) return false;
+  delete store.pending[key];
+  writeAgentFlowAuthStore(store);
+  return true;
+}
+
+export function clearAgentFlowProfile(baseUrl) {
+  const key = profileKey(baseUrl);
+  const store = readAgentFlowAuthStore();
+  const existed = Boolean(store.profiles[key] || store.pending[key]);
+  delete store.profiles[key];
+  delete store.pending[key];
+  if (existed) writeAgentFlowAuthStore(store);
+  return existed;
+}

package/skills/agentflow-cli/scripts/agentflow-cli.mjs

@@ -7,6 +7,15 @@ import {
   loadAgentFlowRuntime,
   resolveAgentFlowPackageRoot,
 } from "./agentflow-runtime.mjs";
+import {
+  agentFlowAuthFile,
+  clearAgentFlowPendingAuthorization,
+  clearAgentFlowProfile,
+  saveAgentFlowPendingAuthorization,
+  saveAgentFlowProfile,
+  savedAgentFlowPendingAuthorization,
+  savedAgentFlowProfile,
+} from "./agentflow-auth-store.mjs";
 import { createWorkflowReportClient } from "./workflow-report-client.mjs";
 
 const DEFAULT_BASE_URL = "http://ai.mengma.bigo.inner/";
@@ -48,13 +57,20 @@ Usage:
 Config:
   --base-url <url>       Override AGENTFLOW_BASE_URL
   --token <token>        Override AGENTFLOW_TOKEN
-  --agentflow-package-root <dir>  Override the local @fieldwangai/agentflow runtime
+  --agentflow-package-root <dir>  Development override for the bundled Skill runtime
   AGENTFLOW_BASE_URL     Defaults to ${DEFAULT_BASE_URL}
-  AGENTFLOW_TOKEN        Required unless AGENTFLOW_SESSION_TOKEN is set
+  AGENTFLOW_TOKEN        Overrides saved browser authorization
   AGENTFLOW_ENV_FILE     Optional dotenv file path
+  AGENTFLOW_AUTH_FILE    Optional saved authorization path
 
 Commands:
   config
+  auth start | auth login
+  auth complete
+  auth status
+  auth logout
+  dsl-lint --file <flowDir|workspace.flow.js> [--workspace-root <dir>]
+  dsl-layout --file <flowDir|workspace.flow.js> [--workspace-root <dir>] [--all]
   list-workspace | list-workspaces
   list-flows
   node-package-list
@@ -63,17 +79,27 @@ Commands:
   node-package-install --node <id>@<version> [--workspace-root <dir>]
   node-package-sync --flow <flowDir|workspace.flow.js> [--workspace-root <dir>]
   pull-flow --flow-id <id> [--flow-source user] [--output <flowDir>] [--workspace-root <dir>] [--replace]
-  publish-flow --flow-id <id> --file <flowDir|workspace.flow.js|flow.yaml> [--target-space personal|workspace|team] [--with-dependencies] [--replace]
+  publish-flow --flow-id <id> --file <flowDir|workspace.flow.js|flow.yaml> [--target-space personal|workspace|team] [--schedule enabled|disabled|preserve] [--with-dependencies] [--replace]
   get-graph --flow-id <id> [--flow-source user]
   migrate-flow --flow-id <id> [--flow-source user] [--archived] [--allow-loss]
   migrate-all [--include-archived] [--allow-loss] [--dry-run]
   workspace-preview --file <flowDir|workspace.flow.js|workspace.graph.json> [--preview-id <id>] [--ttl-seconds <n>]
+  draft-create --file <flowDir|workspace.flow.js|workspace.graph.json> [--draft-id <id>] [--ttl-seconds <n>] [--with-dependencies]
+  draft-pull --draft-id <id> [--output <flowDir>] [--workspace-root <dir>] [--replace]
+  draft-update --draft-id <id> --base-revision <revision> --file <flowDir|workspace.flow.js|workspace.graph.json> [--ttl-seconds <n>] [--with-dependencies]
+  draft-run --draft-id <id> [--run-node-id <id>] [--input k=v]
+  draft-publish --draft-id <id> --flow-id <id> [--target-space personal|workspace|team] [--schedule enabled|disabled|preserve]
   run --flow-id <id> [--flow-source user] [--run-node-id <id>] [--input k=v]
   status --flow-id <id> [--flow-source user]
   list-run-by-workspace | list-runs-by-workspace --workspace <flowId> [--limit 20]
   list-runs [--flow-id <id>] [--flow-source user] [--limit 20]
   logs --run-id <id>
   display-outputs --flow-id <id> [--flow-source user]
+  schedule-list [--flow-id <id>] [--flow-source user]
+  schedule-set --flow-id <id> --schedule-node-id <id> [--enabled true|false] [--cron <expr>] [--timezone <tz>] [--overlap-policy skip]
+  schedule-enable --flow-id <id> --schedule-node-id <id>
+  schedule-disable --flow-id <id> --schedule-node-id <id>
+  schedule-run-now --flow-id <id> --schedule-node-id <id> [--input k=v]
   sync-workspace --workspace <id>
   workflow-get --workflow tapd:<id> [--flow-id <id>] [--runtime-only] [--admin-operation repair-version-membership]
   workflow-access-sync --workflow tapd:<id> --file <access.json>
@@ -158,11 +184,23 @@ function normalizedBaseUrl(args) {
   return String(raw).replace(/\/+$/, "");
 }
 
+function resolvedAuth(args) {
+  const fromFlag = option(args, "token");
+  if (fromFlag) return { token: fromFlag, source: "flag", profile: null };
+  const fromTokenEnv = String(process.env.AGENTFLOW_TOKEN || "").trim();
+  if (fromTokenEnv) return { token: fromTokenEnv, source: "AGENTFLOW_TOKEN", profile: null };
+  const fromSessionEnv = String(process.env.AGENTFLOW_SESSION_TOKEN || "").trim();
+  if (fromSessionEnv) return { token: fromSessionEnv, source: "AGENTFLOW_SESSION_TOKEN", profile: null };
+  const profile = savedAgentFlowProfile(normalizedBaseUrl(args));
+  return profile?.token
+    ? { token: profile.token, source: "saved-auth", profile }
+    : { token: "", source: "", profile: null };
+}
+
 function authToken(args, required = true) {
-  const token = option(args, "token") || process.env.AGENTFLOW_TOKEN || process.env.AGENTFLOW_SESSION_TOKEN || "";
-  const trimmed = String(token).trim();
+  const trimmed = String(resolvedAuth(args).token || "").trim();
   if (required && !trimmed) {
-    throw new Error("Missing AGENTFLOW_TOKEN. Set it in env, .env, .agentflow.env, or pass --token.");
+    throw new Error("AgentFlow authorization is missing. Run `auth start`, open the returned URL, then run `auth complete`; or set AGENTFLOW_TOKEN.");
   }
   return trimmed;
 }
@@ -488,6 +526,7 @@ async function pullFlow(args) {
     ok: true,
     flowId,
     flowSource,
+    draft: current.draft === true,
     outputDir,
     revision: current.revision || "",
     format: written.format,
@@ -529,6 +568,60 @@ function parseInputs(args) {
   return inputs;
 }
 
+function parseBooleanOption(value, name) {
+  if (value === true || value === "true" || value === "1") return true;
+  if (value === false || value === "false" || value === "0") return false;
+  throw new Error(`${name} must be true or false.`);
+}
+
+async function runRemoteWorkspace(args, { flowId, flowSource = "user", runNodeId = "" }) {
+  const graphPayload = await httpJson(args, `/api/workspace/graph${query({ flowId, flowSource })}`);
+  const result = await httpJson(args, "/api/workspace/run", {
+    method: "POST",
+    body: {
+      flowId,
+      flowSource,
+      runNodeId,
+      runAlias: option(args, "run-alias") || "",
+      graph: graphPayload.graph,
+      inputs: parseInputs(args),
+    },
+  });
+  return {
+    ...result,
+    displayOutputs: extractDisplayOutputs(result?.graph),
+  };
+}
+
+async function prepareDraftGraph(args) {
+  const requestedFile = option(args, "file");
+  const withDependencies = args["with-dependencies"] === true;
+  let publishedNodePackages = [];
+  let rewrittenImports = [];
+  if (withDependencies) {
+    const rawSource = readFlowSourceFile(requestedFile, { allowPackageDependencies: true });
+    const source = await prepareFlowWithDependencies(args, requestedFile, rawSource);
+    publishedNodePackages = source.publishedNodePackages || [];
+    rewrittenImports = source.rewrittenImports || [];
+  }
+  const graph = await readWorkspaceGraphArg(requestedFile, path.resolve(option(args, "workspace-root") || process.cwd()));
+  const nodeDependencies = await graphNodePackageDependencies(graph);
+  if (nodeDependencies.length) {
+    const remoteByKey = await remoteNodePackageCatalog(args);
+    const missing = nodeDependencies.filter((item) => !remoteByKey.has(`${item.id}@${item.version}`));
+    if (missing.length) {
+      throw new Error(`Cannot create draft: server is missing node packages ${missing.map((item) => item.specifier).join(", ")}.`);
+    }
+  }
+  return {
+    graph,
+    file: path.resolve(String(requestedFile || "")),
+    nodeDependencies: nodeDependencies.map((item) => item.specifier),
+    publishedNodePackages,
+    rewrittenImports,
+  };
+}
+
 function slotText(slots, names = []) {
   const wanted = new Set(names.map(String));
   for (const slot of Array.isArray(slots) ? slots : []) {
@@ -566,6 +659,125 @@ function printJson(data) {
   process.stdout.write(`${JSON.stringify(data, null, 2)}\n`);
 }
 
+function authAction(command, args) {
+  if (command === "auth") return String(args._[1] || "status").trim().toLowerCase();
+  if (command.startsWith("auth-")) return command.slice("auth-".length).toLowerCase();
+  return "";
+}
+
+async function runAuthCommand(action, args) {
+  const baseUrl = normalizedBaseUrl(args);
+  if (action === "start" || action === "login") {
+    const authorization = await httpJson(args, "/api/auth/cli/device", {
+      method: "POST",
+      tokenRequired: false,
+      body: {
+        clientName: option(args, "client-name") || "AgentFlow CLI",
+      },
+    });
+    const saved = saveAgentFlowPendingAuthorization(baseUrl, authorization);
+    printJson({
+      status: "authorization_required",
+      baseUrl,
+      requestId: saved.requestId,
+      userCode: saved.userCode,
+      verificationUrl: saved.verificationUrl,
+      expiresAt: saved.expiresAt,
+      next: "Open verificationUrl, approve access, then run `auth complete`.",
+    });
+    return;
+  }
+
+  if (action === "complete") {
+    const pending = savedAgentFlowPendingAuthorization(baseUrl);
+    if (!pending?.deviceCode) {
+      throw new Error("No pending AgentFlow authorization. Run `auth start` first.");
+    }
+    let result;
+    try {
+      result = await httpJson(args, "/api/auth/cli/token", {
+        method: "POST",
+        tokenRequired: false,
+        body: { deviceCode: pending.deviceCode },
+      });
+    } catch (error) {
+      const code = String(error?.response?.code || "");
+      if (["access_denied", "expired_token", "invalid_grant"].includes(code)) {
+        clearAgentFlowPendingAuthorization(baseUrl);
+      }
+      throw error;
+    }
+    if (result?.code === "authorization_pending") {
+      printJson({
+        status: "authorization_pending",
+        baseUrl,
+        requestId: pending.requestId,
+        verificationUrl: pending.verificationUrl,
+        expiresAt: pending.expiresAt,
+      });
+      process.exitCode = 2;
+      return;
+    }
+    if (!result?.token) throw new Error("AgentFlow authorization exchange did not return a token.");
+    const saved = saveAgentFlowProfile(baseUrl, result);
+    printJson({
+      status: "authenticated",
+      baseUrl,
+      user: result.user || null,
+      scopes: Array.isArray(result.scopes) ? result.scopes : [],
+      expiresAt: result.expiresAt || 0,
+      credentialFile: saved.file,
+    });
+    return;
+  }
+
+  if (action === "status") {
+    const auth = resolvedAuth(args);
+    if (!auth.token) {
+      printJson({ authenticated: false, baseUrl, tokenSource: "", credentialFile: agentFlowAuthFile() });
+      return;
+    }
+    const me = await httpJson(args, "/api/auth/me", { tokenRequired: false });
+    printJson({
+      authenticated: Boolean(me?.authenticated),
+      baseUrl,
+      tokenSource: auth.source,
+      user: me?.user || null,
+      expiresAt: auth.profile?.expiresAt || me?.user?.sessionExpiresAt || 0,
+      credentialFile: auth.source === "saved-auth" ? agentFlowAuthFile() : "",
+    });
+    return;
+  }
+
+  if (action === "logout") {
+    const auth = resolvedAuth(args);
+    let revoked = false;
+    let remoteError = "";
+    if (auth.token) {
+      try {
+        const response = await httpJson(args, "/api/auth/cli/revoke", { method: "POST", body: {} });
+        revoked = Boolean(response?.ok);
+      } catch (error) {
+        remoteError = error?.message || String(error);
+      }
+    }
+    const localCleared = clearAgentFlowProfile(baseUrl);
+    printJson({
+      authenticated: false,
+      baseUrl,
+      revoked,
+      localCleared,
+      tokenSource: auth.source,
+      warning: auth.source && auth.source !== "saved-auth"
+        ? `${auth.source} is still configured outside the CLI credential store.`
+        : remoteError || "",
+    });
+    return;
+  }
+
+  throw new Error(`Unknown auth command: ${action}. Use auth start, complete, status, or logout.`);
+}
+
 function requireFlowId(args) {
   const flowId = option(args, "flow-id") || option(args, "flow");
   if (!flowId) throw new Error("Missing --flow-id.");
@@ -755,16 +967,48 @@ function isMissingPublishedFlowError(error) {
   return error?.status === 400 && /Pipeline directory not found/i.test(String(error?.message || ""));
 }
 
-async function importFlow(args, { flowId, targetSpace, resolved, flowYaml }) {
+async function importFlow(args, { flowId, targetSpace, scheduleMode = "disabled", resolved, flowYaml }) {
   const form = new FormData();
   form.set("flowId", flowId);
   form.set("targetSpace", targetSpace);
+  form.set("scheduleMode", scheduleMode);
   const name = path.basename(resolved);
   const mime = /\.m?js$/i.test(name) ? "application/javascript" : "application/yaml";
   form.set("file", new Blob([flowYaml], { type: mime }), name);
   return httpMultipart(args, "/api/flows/import", form);
 }
 
+function normalizeScheduleMode(args, fallback = "disabled") {
+  const scheduleMode = String(option(args, "schedule") || fallback).trim().toLowerCase();
+  if (!["enabled", "disabled", "preserve"].includes(scheduleMode)) {
+    throw new Error("--schedule must be enabled, disabled, or preserve.");
+  }
+  return scheduleMode;
+}
+
+function graphWithScheduleMode(graph, scheduleMode = "disabled") {
+  if (scheduleMode === "preserve") return graph;
+  const instances = { ...(graph?.instances || {}) };
+  let scheduleCount = 0;
+  for (const [nodeId, instance] of Object.entries(instances)) {
+    if (String(instance?.definitionId || "") !== "workspace_scheduled_run") continue;
+    scheduleCount += 1;
+    let config = {};
+    try {
+      const parsed = JSON.parse(String(instance.body || "{}"));
+      if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) config = parsed;
+    } catch {}
+    instances[nodeId] = {
+      ...instance,
+      body: JSON.stringify({ ...config, enabled: scheduleMode === "enabled" }),
+    };
+  }
+  if (scheduleMode === "enabled" && scheduleCount === 0) {
+    throw new Error("Cannot enable scheduling: the Flow has no Scheduled Run node.");
+  }
+  return { ...graph, instances };
+}
+
 async function resolvePublishTeam(args, shareWithTeam) {
   if (!shareWithTeam) return null;
   const result = await httpJson(args, "/api/teams/me");
@@ -793,6 +1037,12 @@ async function main() {
     return;
   }
 
+  const selectedAuthAction = authAction(command, args);
+  if (selectedAuthAction) {
+    await runAuthCommand(selectedAuthAction, args);
+    return;
+  }
+
   if (command === "config") {
     let localRuntime = { available: false, root: "", version: "" };
     try {
@@ -802,15 +1052,39 @@ async function main() {
     } catch (error) {
       localRuntime.error = error?.message || String(error);
     }
+    const auth = resolvedAuth(args);
     printJson({
       baseUrl: normalizedBaseUrl(args),
-      hasToken: Boolean(authToken(args, false)),
-      tokenSource: option(args, "token") ? "flag" : process.env.AGENTFLOW_TOKEN ? "AGENTFLOW_TOKEN" : process.env.AGENTFLOW_SESSION_TOKEN ? "AGENTFLOW_SESSION_TOKEN" : "",
+      hasToken: Boolean(auth.token),
+      tokenSource: auth.source,
+      credentialFile: auth.source === "saved-auth" ? agentFlowAuthFile() : "",
       localRuntime,
     });
     return;
   }
 
+  if (command === "dsl-lint" || command === "dsl-layout") {
+    const target = option(args, "file");
+    if (!target) throw new Error(`${command} requires --file <flowDir|workspace.flow.js>.`);
+    const resolved = path.resolve(target);
+    const stat = fs.statSync(resolved);
+    const flowDir = stat.isDirectory() ? resolved : path.dirname(resolved);
+    const workspaceRoot = path.resolve(option(args, "workspace-root") || process.cwd());
+    const runtime = await loadAgentFlowRuntime();
+    if (command === "dsl-lint") {
+      const result = runtime.lintWorkspaceFlowDir(flowDir, { workspaceRoot });
+      printJson(result);
+      if (result.errors.length) process.exitCode = 1;
+      return;
+    }
+    const result = runtime.layoutWorkspaceFlowDir(flowDir, {
+      all: args.all === true,
+      workspaceRoot,
+    });
+    printJson(result);
+    return;
+  }
+
   if (command === "list-workspace" || command === "list-workspaces") {
     printJson(await httpJson(args, "/api/workspaces"));
     return;
@@ -885,10 +1159,23 @@ async function main() {
     return;
   }
 
+  if (command === "draft-pull") {
+    const draftId = option(args, "draft-id");
+    if (!draftId) throw new Error("draft-pull requires --draft-id <id>.");
+    args["flow-id"] = draftId;
+    args["flow-source"] = "user";
+    const result = await pullFlow(args);
+    if (result.ok && result.draft !== true) throw new Error(`${draftId} is not a Workspace Draft.`);
+    printJson({ ...result, draftId });
+    if (!result.ok) process.exitCode = 2;
+    return;
+  }
+
   if (command === "publish-flow") {
     const flowId = requireFlowId(args);
     const destination = targetDestinationFromArgs(args);
     const targetSpace = destination.flowSource;
+    const scheduleMode = normalizeScheduleMode(args);
     const withDependencies = args["with-dependencies"] === true;
     const requestedFile = option(args, "file");
     const rawSource = readFlowSourceFile(requestedFile, { allowPackageDependencies: withDependencies });
@@ -915,7 +1202,7 @@ async function main() {
     const dependencyPreflight = await preflightRemoteFlowDependencies(args, source);
 
     if (!replace) {
-      const result = await importFlow(args, { flowId, targetSpace, ...source });
+      const result = await importFlow(args, { flowId, targetSpace, scheduleMode, ...source });
       const sharedTeam = await sharePublishedFlowWithTeam(args, { flowId, flowSource: targetSpace, team });
       printJson({ ...result, action: "created", targetSpace: team ? "team" : targetSpace, team: sharedTeam, file: source.resolved, nodeDependencies: dependencyPreflight.map((item) => item.specifier), rewrittenImports: source.rewrittenImports || [], publishedNodePackages: source.publishedNodePackages || [] });
       return;
@@ -924,16 +1211,16 @@ async function main() {
     // 更新走哪条路取决于存储格式：yaml 流程改 /api/flow，代码化流程改 Workspace 图。
     // /api/flow 只认 flowYaml 字符串，代码化的流程发过去等于把图退回成 yaml。
     if (!current) {
-      const result = await importFlow(args, { flowId, targetSpace, ...source });
+      const result = await importFlow(args, { flowId, targetSpace, scheduleMode, ...source });
       const sharedTeam = await sharePublishedFlowWithTeam(args, { flowId, flowSource: targetSpace, team });
       printJson({ ...result, action: "created", targetSpace: team ? "team" : targetSpace, team: sharedTeam, file: source.resolved, nodeDependencies: dependencyPreflight.map((item) => item.specifier), rewrittenImports: source.rewrittenImports || [], publishedNodePackages: source.publishedNodePackages || [] });
       return;
     }
     if (source.isCode) {
-      const graph = await readWorkspaceGraphArg(
+      const graph = graphWithScheduleMode(await readWorkspaceGraphArg(
         option(args, "file"),
         path.resolve(option(args, "workspace-root") || process.cwd()),
-      );
+      ), scheduleMode);
       const updated = await httpJson(args, "/api/workspace/graph", {
         method: "POST",
         body: { flowId, flowSource: targetSpace, graph, baseRevision: current.revision },
@@ -1088,26 +1375,66 @@ async function main() {
     return;
   }
 
-  if (command === "run") {
-    const flowId = requireFlowId(args);
-    const flowSource = option(args, "flow-source") || "user";
-    const runNodeId = option(args, "run-node-id") || "";
-    const graphPayload = await httpJson(args, `/api/workspace/graph${query({ flowId, flowSource })}`);
-    const result = await httpJson(args, "/api/workspace/run", {
+  if (command === "draft-create" || command === "draft-update" || command === "workspace-draft") {
+    const draftId = option(args, "draft-id") || "";
+    if (command === "draft-update" && !draftId) throw new Error("draft-update requires --draft-id <id>.");
+    const baseRevision = option(args, "base-revision") || "";
+    if (command === "draft-update" && !baseRevision) {
+      throw new Error("draft-update requires --base-revision <revision>. Pull the Draft first if the revision is unknown.");
+    }
+    const prepared = await prepareDraftGraph(args);
+    const result = await httpJson(args, "/api/workspace/draft", {
       method: "POST",
       body: {
-        flowId,
-        flowSource,
-        runNodeId,
-        runAlias: option(args, "run-alias") || "",
-        graph: graphPayload.graph,
-        inputs: parseInputs(args),
+        graph: prepared.graph,
+        draftId,
+        baseRevision,
+        title: option(args, "title") || "Workspace Draft",
+        ttlSeconds: option(args, "ttl-seconds") ? Number(option(args, "ttl-seconds")) : undefined,
+        resetRuntime: args["keep-runtime"] !== true,
       },
     });
-    printJson({
-      ...result,
-      displayOutputs: extractDisplayOutputs(result?.graph),
+    printJson({ ...result, ...prepared });
+    return;
+  }
+
+  if (command === "draft-run") {
+    const draftId = option(args, "draft-id");
+    if (!draftId) throw new Error("draft-run requires --draft-id <id>.");
+    printJson(await runRemoteWorkspace(args, {
+      flowId: draftId,
+      flowSource: "user",
+      runNodeId: option(args, "run-node-id") || "",
+    }));
+    return;
+  }
+
+  if (command === "draft-publish" || command === "draft-promote") {
+    const draftId = option(args, "draft-id");
+    if (!draftId) throw new Error("draft-publish requires --draft-id <id>.");
+    const flowId = requireFlowId(args);
+    const destination = targetDestinationFromArgs(args);
+    const targetSpace = destination.shareWithTeam ? "team" : destination.flowSource === "user" ? "personal" : "workspace";
+    const scheduleMode = normalizeScheduleMode(args);
+    const team = await resolvePublishTeam(args, destination.shareWithTeam);
+    const result = await httpJson(args, "/api/workspace/draft/publish", {
+      method: "POST",
+      body: { draftId, flowId, targetSpace, scheduleMode },
+    });
+    const sharedTeam = await sharePublishedFlowWithTeam(args, {
+      flowId,
+      flowSource: destination.flowSource,
+      team,
     });
+    printJson({ ...result, team: sharedTeam, targetSpace });
+    return;
+  }
+
+  if (command === "run") {
+    const flowId = requireFlowId(args);
+    const flowSource = option(args, "flow-source") || "user";
+    const runNodeId = option(args, "run-node-id") || "";
+    printJson(await runRemoteWorkspace(args, { flowId, flowSource, runNodeId }));
     return;
   }
 
@@ -1151,6 +1478,44 @@ async function main() {
     return;
   }
 
+  if (command === "schedule-list") {
+    const flowId = option(args, "flow-id") || "";
+    const flowSource = option(args, "flow-source") || "user";
+    if (flowId) {
+      printJson(await httpJson(args, `/api/workspace/schedules${query({ flowId, flowSource })}`));
+    } else {
+      printJson(await httpJson(args, "/api/schedules"));
+    }
+    return;
+  }
+
+  if (["schedule-set", "schedule-enable", "schedule-disable"].includes(command)) {
+    const flowId = requireFlowId(args);
+    const flowSource = option(args, "flow-source") || "user";
+    const scheduleNodeId = option(args, "schedule-node-id");
+    if (!scheduleNodeId) throw new Error(`${command} requires --schedule-node-id <id>.`);
+    const body = { flowId, flowSource, scheduleNodeId };
+    if (command === "schedule-enable") body.enabled = true;
+    if (command === "schedule-disable") body.enabled = false;
+    if (command === "schedule-set" && args.enabled !== undefined) {
+      body.enabled = parseBooleanOption(args.enabled, "--enabled");
+    }
+    if (args.cron !== undefined) body.cron = option(args, "cron");
+    if (args.timezone !== undefined) body.timezone = option(args, "timezone");
+    if (args["overlap-policy"] !== undefined) body.overlapPolicy = option(args, "overlap-policy");
+    printJson(await httpJson(args, "/api/workspace/schedule/config", { method: "POST", body }));
+    return;
+  }
+
+  if (command === "schedule-run-now") {
+    const flowId = requireFlowId(args);
+    const flowSource = option(args, "flow-source") || "user";
+    const scheduleNodeId = option(args, "schedule-node-id");
+    if (!scheduleNodeId) throw new Error("schedule-run-now requires --schedule-node-id <id>.");
+    printJson(await runRemoteWorkspace(args, { flowId, flowSource, runNodeId: scheduleNodeId }));
+    return;
+  }
+
   if (command === "workflow-get") {
     const workflow = workflowReferenceFromArgs(args);
     if (workflow.namespace !== "tapd") {