@fieldwangai/agentflow 0.1.160 → 0.1.163

package/bin/lib/ui-server.mjs

@@ -52,6 +52,7 @@ import { packageResolverFor, scanAvailableNodePackages } from "./flow-dsl/packag
 import { runStartupStorageMigrations } from "./startup-storage-migrations.mjs";
 import { getPipelineFiles } from "./workspace-tree.mjs";
 import { listExpiredWorkspacePreviews } from "./workspace-preview.mjs";
+import { listExpiredWorkspaceDrafts } from "./workspace-draft.mjs";
 import { LEGACY_FLOW_EXECUTION_DISABLED, LEGACY_FLOW_EXECUTION_MESSAGE } from "./legacy-flow-execution.mjs";
 import {
   listRecentComposerSessions,
@@ -71,7 +72,11 @@ import {
   authSetupRequired,
   buildClearSessionCookie,
   buildSessionCookie,
+  createCliAuthorization,
+  decideCliAuthorization,
+  exchangeCliAuthorization,
   getAuthUserFromRequest,
+  getCliAuthorization,
   getSessionTokenFromRequest,
   isAuthUserAllowed,
   listAuthUsers,
@@ -80,8 +85,13 @@ import {
   readAuthUsers,
   readUserAllowlist,
   resetAuthUserPassword,
+  revokeSessionToken,
   writeUserAllowlist,
 } from "./auth.mjs";
+import {
+  renderCliAuthorizationPage,
+  renderCliAuthorizationResult,
+} from "./cli-auth-page.mjs";
 import { readGlobalEnvRows, readUserEnvRows, writeGlobalEnvRows, writeUserEnvRows } from "./user-env.mjs";
 import {
   readAdminBuiltinPipelineConfig,
@@ -120,7 +130,6 @@ import { json, readBody } from "./http-util.mjs";
 
 // 从 ui-server 拆出去的 Workspace 子系统；路由仍在下面的 startUiServer 里
 import {
-  USER_WORKSPACES_FILENAME,
   WORKSPACE_DEFERRED_RUN_POLL_MS,
   WORKSPACE_SCHEDULE_POLL_MS,
   activeWorkspaceRunUsageRecords,
@@ -131,6 +140,7 @@ import {
   displayShareOutputUrl,
   isReadonlyBuiltinFlowSource,
   isValidFlowSourceRead,
+  listConfiguredWorkspaces,
   listWorkspaceScheduleStatuses,
   normalizeDisplayShareExpiry,
   normalizeDisplayShareNodeIds,
@@ -141,11 +151,11 @@ import {
   readCursorMcpConfig,
   readCursorMcpServers,
   readDisplayShares,
+  readUserWorkspaces,
   readUserMcpPrivate,
   readWorkspaceGraph,
   readWorkspaceRunUsageRecords,
   readWorkspaceScheduleRegistry,
-  readWorkspacesFromPath,
   resolveWorkspaceFilePath,
   resolveWorkspaceScopeRoot,
   runStatusBucket,
@@ -163,11 +173,22 @@ import {
   workspaceDownloadContentDisposition,
   workspaceFlowCollaborationGuard,
   workspaceScheduleNextRunAt,
-  workspacesPath,
   writeDisplayShares,
   writeWorkspaceGraph,
 } from "./workspace-server.mjs";
-import { handleWorkspaceRoutes } from "./workspace-routes.mjs";
+import { handleWorkspaceRoutes, workspaceGraphWithScheduleMode } from "./workspace-routes.mjs";
+import {
+  createSpace,
+  deleteSpacePage,
+  getSpaceById,
+  getSpaceByRoute,
+  listSpacesForUser,
+  readSpaces,
+  normalizeSpacePagePath,
+  normalizeSpaceVisibility,
+  updateSpace,
+  upsertSpacePage,
+} from "./spaces.mjs";
 
 const MIME = {
   ".html": "text/html; charset=utf-8",
@@ -206,10 +227,8 @@ const BUILTIN_SKILL_COLLECTIONS = [
     id: "pipeline",
     name: "Pipeline",
     defaultKeys: [
-      "agentflow-flow-add-instances",
-      "agentflow-flow-edit-node-fields",
+      "agentflow-flow-dsl",
       "agentflow-flow-recipes",
-      "agentflow-flow-sync-ui",
       "agentflow-node-reference",
       "agentflow-placeholder-reference",
       "agentflow-runtime-reference",
@@ -219,7 +238,7 @@ const BUILTIN_SKILL_COLLECTIONS = [
     id: "workspace",
     name: "Workspace",
     defaultKeys: [
-      "agentflow-workspace-graph",
+      "agentflow-flow-dsl",
       "agentflow-workspace-markdown",
       "agentflow-workspace-mermaid",
       "agentflow-workspace-ascii",
@@ -233,7 +252,18 @@ const BUILTIN_SKILL_COLLECTIONS = [
     ],
     legacyDefaultKeys: [
       [
-        "agentflow-workspace-graph",
+        "agentflow-workspace-markdown",
+        "agentflow-workspace-mermaid",
+        "agentflow-workspace-ascii",
+        "agentflow-workspace-chart",
+        "agentflow-workspace-table",
+        "agentflow-workspace-html",
+        "agentflow-workspace-image",
+        "agentflow-node-reference",
+        "agentflow-placeholder-reference",
+        "agentflow-runtime-reference",
+      ],
+      [
         "agentflow-workspace-markdown",
         "agentflow-workspace-mermaid",
         "agentflow-workspace-ascii",
@@ -244,7 +274,6 @@ const BUILTIN_SKILL_COLLECTIONS = [
         "agentflow-runtime-reference",
       ],
       [
-        "agentflow-workspace-graph",
         "agentflow-workspace-markdown",
         "agentflow-workspace-mermaid",
         "agentflow-workspace-ascii",
@@ -917,70 +946,6 @@ function skillhubInstallArgs(payload, { uninstall = false } = {}) {
 }
 
 const DISPLAY_SHARE_TTL_MS = 30 * 24 * 60 * 60 * 1000;
-function legacyUserWorkspacesPath(userCtx = {}) {
-  return path.join(getAgentflowUserDataRoot(userCtx.userId || ""), USER_WORKSPACES_FILENAME);
-}
-
-function readLegacyAdminWorkspaces(userCtx = {}) {
-  const users = readAuthUsers();
-  const candidates = [];
-  for (const [userId, user] of Object.entries(users || {})) {
-    if (user?.isAdmin) candidates.push(String(userId || ""));
-  }
-  if (userCtx?.isAdmin && userCtx.userId) candidates.unshift(String(userCtx.userId));
-  const seenPaths = new Set();
-  const seenEntries = new Set();
-  const out = [];
-  for (const userId of candidates) {
-    const p = legacyUserWorkspacesPath({ userId });
-    const resolved = path.resolve(p);
-    if (seenPaths.has(resolved) || resolved === path.resolve(workspacesPath())) continue;
-    seenPaths.add(resolved);
-    for (const entry of readWorkspacesFromPath(p, { userId })) {
-      const key = entry.id || entry.path || entry.repoUrl;
-      if (seenEntries.has(key)) continue;
-      seenEntries.add(key);
-      out.push(entry);
-    }
-  }
-  return out;
-}
-
-function readUserWorkspaces(userCtx = {}) {
-  const globalPath = workspacesPath();
-  const globalWorkspaces = fs.existsSync(globalPath) ? readWorkspacesFromPath(globalPath, userCtx) : [];
-  const adminLegacy = readLegacyAdminWorkspaces(userCtx);
-  if (globalWorkspaces.length || adminLegacy.length) {
-    const seen = new Set();
-    const out = [];
-    for (const entry of [...globalWorkspaces, ...adminLegacy]) {
-      const key = entry.id || entry.path || entry.repoUrl;
-      if (seen.has(key)) continue;
-      seen.add(key);
-      out.push(entry);
-    }
-    return out;
-  }
-  return readWorkspacesFromPath(legacyUserWorkspacesPath(userCtx), userCtx);
-}
-
-function listConfiguredWorkspaces(root, scopedRoot, userCtx = {}) {
-  const currentRoot = path.resolve(scopedRoot || root);
-  const homeRoot = path.resolve(os.homedir());
-  const builtins = [
-    { id: "current", label: "当前流程工作区", kind: "local", path: currentRoot, builtin: true, exists: fs.existsSync(currentRoot) && fs.statSync(currentRoot).isDirectory(), type: "flow", enabled: true },
-    { id: "home", label: "用户 Home", kind: "local", path: homeRoot, builtin: true, exists: fs.existsSync(homeRoot) && fs.statSync(homeRoot).isDirectory(), type: "local", enabled: true },
-  ];
-  const custom = readUserWorkspaces(userCtx).filter((entry) => entry.enabled !== false).map((entry) => ({ ...entry, builtin: false }));
-  const seen = new Set();
-  return [...builtins, ...custom].filter((entry) => {
-    const key = path.resolve(entry.path);
-    if (seen.has(key)) return false;
-    seen.add(key);
-    return true;
-  });
-}
-
 function workflowBindableWorkspaces(userCtx = {}) {
   return readUserWorkspaces(userCtx)
     .filter((entry) => entry.enabled !== false && entry.exists)
@@ -1333,6 +1298,12 @@ function isDisplayShareExpired(share) {
   return Number.isFinite(expiresAt) && expiresAt <= Date.now();
 }
 
+function canReadDisplayShare(share, userCtx = {}) {
+  if (!share) return false;
+  if (String(share.visibility || "public") !== "private") return true;
+  return userCtx?.isAdmin === true || String(share.userId || "") === String(userCtx?.userId || "");
+}
+
 function getDisplayShareOrExpired(id) {
   const shares = readDisplayShares();
   const share = shares[id];
@@ -1358,10 +1329,78 @@ function displayShareSummary(share, baseUrl = "") {
     expiresAt: String(share?.expiresAt || ""),
     expiresMode: String(share?.expiresMode || (share?.expiresAt ? "days" : "permanent")),
     expiresInDays: share?.expiresInDays == null ? null : Number(share.expiresInDays),
+    visibility: String(share?.visibility || "public") === "private" ? "private" : "public",
     url: displayShareOutputUrl(share?.id || "", baseUrl),
   };
 }
 
+function spacePublicSummary(space = {}, baseUrl = "") {
+  const ownerId = String(space.ownerId || "");
+  const slug = String(space.slug || "");
+  const rootPath = `/s/${encodeURIComponent(ownerId)}/${encodeURIComponent(slug)}`;
+  const base = normalizePublicBaseUrl(baseUrl);
+  const absoluteRoot = base ? new URL(rootPath, base.endsWith("/") ? base : `${base}/`).href : rootPath;
+  return {
+    id: String(space.id || ""),
+    ownerId,
+    slug,
+    title: String(space.title || slug),
+    description: String(space.description || ""),
+    visibility: normalizeSpaceVisibility(space.visibility),
+    status: String(space.status || "active"),
+    pages: (Array.isArray(space.pages) ? space.pages : []).map((page) => ({
+      id: String(page.id || ""),
+      title: String(page.title || ""),
+      path: normalizeSpacePagePath(page.path || "/"),
+      shareId: String(page.shareId || ""),
+      hidden: page.hidden === true,
+      order: Number(page.order || 0),
+    })),
+    url: absoluteRoot,
+    createdAt: String(space.createdAt || ""),
+    updatedAt: String(space.updatedAt || ""),
+  };
+}
+
+function canManageSpace(space, userCtx = {}) {
+  return Boolean(space) && (userCtx?.isAdmin === true || String(space.ownerId || "") === String(userCtx?.userId || ""));
+}
+
+function displayShareSpaceReferences(shareId = "") {
+  const wanted = String(shareId || "").trim();
+  if (!wanted) return [];
+  const refs = [];
+  for (const space of readSpaces()) {
+    for (const page of Array.isArray(space.pages) ? space.pages : []) {
+      if (String(page.shareId || "") !== wanted) continue;
+      refs.push({ spaceId: space.id, ownerId: space.ownerId, slug: space.slug, pageId: page.id, path: page.path });
+    }
+  }
+  return refs;
+}
+
+function syncSpaceShareVisibility(space) {
+  if (!space) return;
+  const shares = readDisplayShares();
+  let changed = false;
+  for (const page of Array.isArray(space.pages) ? space.pages : []) {
+    const share = shares[String(page.shareId || "")];
+    if (!share || String(share.userId || "") !== String(space.ownerId || "")) continue;
+    const visibility = normalizeSpaceVisibility(space.visibility);
+    if (share.visibility === visibility && !share.expiresAt) continue;
+    shares[page.shareId] = {
+      ...share,
+      visibility,
+      expiresAt: "",
+      expiresMode: "permanent",
+      expiresInDays: null,
+      updatedAt: new Date().toISOString(),
+    };
+    changed = true;
+  }
+  if (changed) writeDisplayShares(shares);
+}
+
 function listDisplaySharesForUser(userCtx = {}, baseUrl = "") {
   const userId = String(userCtx?.userId || "");
   const isAdmin = userCtx?.isAdmin === true;
@@ -1389,6 +1428,9 @@ function updateDisplayShareExpiryForUser(id, userCtx = {}, patch = {}) {
   const userId = String(userCtx?.userId || "");
   if (userCtx?.isAdmin !== true && String(share.userId || "") !== userId) return { status: 403, error: "Forbidden" };
   const expiry = normalizeDisplayShareExpiry(patch, new Date());
+  if (displayShareSpaceReferences(id).length > 0 && expiry.expiresMode !== "permanent") {
+    return { status: 409, error: "Space 页面使用中的展示内容必须永久有效；请先从空间移除页面" };
+  }
   const updated = {
     ...share,
     expiresAt: expiry.expiresAt,
@@ -1407,6 +1449,9 @@ function deleteDisplayShareForUser(id, userCtx = {}) {
   if (!share) return { status: 404, error: "Display share not found" };
   const userId = String(userCtx?.userId || "");
   if (userCtx?.isAdmin !== true && String(share.userId || "") !== userId) return { status: 403, error: "Forbidden" };
+  if (displayShareSpaceReferences(id).length > 0) {
+    return { status: 409, error: "展示内容仍被 Space 页面引用；请先从空间移除页面" };
+  }
   delete shares[id];
   writeDisplayShares(shares);
   return { status: 200 };
@@ -1450,6 +1495,25 @@ function serverPublicBaseUrl(req, host, port, payload = null) {
   return configuredPublicBaseUrl(payload) || requestPublicBaseUrl(req) || normalizePublicBaseUrl(`http://${host}:${port}`);
 }
 
+function html(res, status, content, headers = {}) {
+  const body = String(content || "");
+  res.writeHead(status, {
+    "Content-Type": "text/html; charset=utf-8",
+    "Content-Length": Buffer.byteLength(body),
+    "Cache-Control": "no-store, max-age=0",
+    "Content-Security-Policy": "default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'",
+    "X-Content-Type-Options": "nosniff",
+    "Referrer-Policy": "no-referrer",
+    ...headers,
+  });
+  res.end(body);
+}
+
+async function readUrlEncodedBody(req) {
+  const body = await readBody(req);
+  return new URLSearchParams(String(body || ""));
+}
+
 function publicDisplayPayloadFromShare(root, share) {
   const scoped = resolveWorkspaceScopeRoot(root, {
     flowId: share.flowId || "",
@@ -1684,7 +1748,7 @@ function bufferLooksLikeZip(buf) {
 
 /**
  * @param {import('http').IncomingMessage} req
- * @returns {Promise<{ targetSpace: string, flowIdField: string, file: Buffer, filename: string, gotFile: boolean }>}
+ * @returns {Promise<{ targetSpace: string, flowIdField: string, scheduleMode: string, file: Buffer, filename: string, gotFile: boolean }>}
  */
 function parseFlowsImportForm(req) {
   return new Promise((resolve, reject) => {
@@ -1694,6 +1758,7 @@ function parseFlowsImportForm(req) {
     });
     let targetSpace = "user";
     let flowIdField = "";
+    let scheduleMode = "disabled";
     /** @type {Buffer[]} */
     const chunks = [];
     let filename = "";
@@ -1706,6 +1771,9 @@ function parseFlowsImportForm(req) {
       if (name === "flowId" && typeof val === "string") {
         flowIdField = val;
       }
+      if (name === "scheduleMode" && typeof val === "string") {
+        scheduleMode = val.trim().toLowerCase();
+      }
     });
 
     bb.on("file", (name, file, info) => {
@@ -1725,6 +1793,7 @@ function parseFlowsImportForm(req) {
       resolve({
         targetSpace,
         flowIdField: flowIdField.trim(),
+        scheduleMode,
         file: Buffer.concat(chunks),
         filename,
         gotFile,
@@ -1748,12 +1817,16 @@ function cleanupExpiredWorkspacePreviews(workspaceRoot = "") {
   }
   let removed = 0;
   for (const pipelinesRoot of roots) {
-    for (const item of listExpiredWorkspacePreviews(pipelinesRoot)) {
+    const expired = [
+      ...listExpiredWorkspacePreviews(pipelinesRoot),
+      ...listExpiredWorkspaceDrafts(pipelinesRoot),
+    ];
+    for (const item of expired) {
       try {
         fs.rmSync(item.flowDir, { recursive: true, force: true });
         removed += 1;
       } catch (e) {
-        log.debug(`[workspace-preview] cleanup failed: ${(e && e.message) || String(e)}`);
+        log.debug(`[workspace-temporary] cleanup failed: ${(e && e.message) || String(e)}`);
       }
     }
   }
@@ -2013,12 +2086,12 @@ function buildComposerPromptWithFlowContext(p) {
     `- flowSource：${p.flowSource}`,
     ...builtinExtra,
     `- 当前关联的节点实例 ID（顺序：画布选中优先，再输入框 @提及）：${idsLine}`,
-    "- 像普通 agent 请求一样处理用户说明：可能只是问问题，也可能要求编辑文件。不要因为存在 flowId 就默认修改 flow.yaml。",
+    "- 像普通 agent 请求一样处理用户说明：可能只是问问题，也可能要求编辑文件。不要因为存在 flowId 就默认修改流程。",
     "- 按需使用当前环境可用的 skills；如果用户点名某个 skill，遵循该 skill 的 SKILL.md。",
     "- 如果你判断需要编辑 AgentFlow 流程，可按需读取这些本地 skills：",
-    "  - `skills/agentflow-flow-add-instances/SKILL.md`：新增实例、边和布局",
-    "  - `skills/agentflow-flow-edit-node-fields/SKILL.md`：只改已有节点字段",
-    "  - `skills/agentflow-flow-sync-ui/SKILL.md`：保存 flow.yaml 后刷新画布",
+    "  - `skills/agentflow-flow-dsl/SKILL.md`：新建或修改 workspace.flow.js、节点、字段、连线、子流程与受控循环",
+    "  - `skills/agentflow-node-dsl/SKILL.md`：仅在需要确定性自定义代码节点时使用",
+    "  - `skills/agentflow-author-flow/SKILL.md`：需要 Draft、试运行、动态修改、发布或定时时使用完整生命周期",
     "- 如果只是回答问题，不要修改文件。",
     "",
     ...(p.selectedSkillBlock ? [p.selectedSkillBlock, ""] : []),
@@ -2091,6 +2164,132 @@ export function startUiServer({
       return;
     }
 
+    if (url.pathname === "/api/auth/cli/device" && req.method === "POST") {
+      let payload = {};
+      try {
+        const raw = await readBody(req);
+        payload = raw ? JSON.parse(raw) : {};
+      } catch {
+        json(res, 400, { error: "Invalid JSON body" });
+        return;
+      }
+      const authorization = createCliAuthorization({
+        publicBaseUrl: serverPublicBaseUrl(req, host, uiPort),
+        clientName: payload?.clientName,
+      });
+      json(res, 201, {
+        requestId: authorization.requestId,
+        deviceCode: authorization.deviceCode,
+        userCode: authorization.userCode,
+        verificationUrl: authorization.verificationUrl,
+        expiresAt: authorization.expiresAt,
+        pollInterval: authorization.pollInterval,
+      });
+      return;
+    }
+
+    if (url.pathname === "/api/auth/cli/token" && req.method === "POST") {
+      let payload = {};
+      try {
+        const raw = await readBody(req);
+        payload = raw ? JSON.parse(raw) : {};
+      } catch {
+        json(res, 400, { error: "Invalid JSON body" });
+        return;
+      }
+      const result = exchangeCliAuthorization(payload?.deviceCode);
+      if (!result.ok) {
+        json(res, result.status || 400, {
+          error: result.error,
+          code: result.code || "invalid_request",
+          authorization: result.authorization || undefined,
+        });
+        return;
+      }
+      json(res, 200, result);
+      return;
+    }
+
+    if (url.pathname === "/api/auth/cli/revoke" && req.method === "POST") {
+      const token = getSessionTokenFromRequest(req);
+      if (!token || !getAuthUserFromRequest(req)) {
+        json(res, 401, { error: "Unauthorized" });
+        return;
+      }
+      revokeSessionToken(token);
+      json(res, 200, { ok: true });
+      return;
+    }
+
+    if (url.pathname === "/cli/authorize" && req.method === "GET") {
+      const requestId = String(url.searchParams.get("request") || "").trim();
+      const user = getAuthUserFromRequest(req);
+      const result = getCliAuthorization(requestId, { includeApprovalNonce: Boolean(user) });
+      if (result.ok && result.authorization.status !== "pending") {
+        html(res, 200, renderCliAuthorizationResult({
+          approved: result.authorization.status === "approved",
+          clientName: result.authorization.clientName,
+        }));
+        return;
+      }
+      html(res, result.ok ? 200 : result.status || 404, renderCliAuthorizationPage({
+        authorization: result.authorization || null,
+        approvalNonce: result.approvalNonce || "",
+        user,
+        error: result.ok ? "" : result.error,
+      }));
+      return;
+    }
+
+    if (url.pathname === "/cli/authorize/login" && req.method === "POST") {
+      const form = await readUrlEncodedBody(req);
+      const requestId = String(form.get("request") || "").trim();
+      const pending = getCliAuthorization(requestId);
+      if (!pending.ok) {
+        html(res, pending.status || 404, renderCliAuthorizationPage({ error: pending.error }));
+        return;
+      }
+      const result = loginOrCreateUser(form.get("username"), form.get("password"));
+      if (!result.ok) {
+        html(res, result.forbidden ? 403 : 401, renderCliAuthorizationPage({
+          authorization: pending.authorization,
+          error: result.error || "Login failed",
+        }));
+        return;
+      }
+      res.writeHead(303, {
+        Location: `/cli/authorize?request=${encodeURIComponent(requestId)}`,
+        "Set-Cookie": buildSessionCookie(result.token),
+        "Cache-Control": "no-store, max-age=0",
+      });
+      res.end();
+      return;
+    }
+
+    if (url.pathname === "/cli/authorize/decision" && req.method === "POST") {
+      const user = getAuthUserFromRequest(req);
+      if (!user) {
+        html(res, 401, renderCliAuthorizationResult({ error: "登录状态已失效，请重新打开授权链接。" }));
+        return;
+      }
+      const form = await readUrlEncodedBody(req);
+      const requestId = String(form.get("request") || "").trim();
+      const current = getCliAuthorization(requestId);
+      const approved = form.get("decision") === "approve";
+      const result = decideCliAuthorization({
+        requestId,
+        approvalNonce: form.get("approvalNonce"),
+        userId: user.userId,
+        approved,
+      });
+      html(res, result.ok ? 200 : result.status || 400, renderCliAuthorizationResult({
+        approved,
+        clientName: current.authorization?.clientName,
+        error: result.ok ? "" : result.error,
+      }));
+      return;
+    }
+
     if (url.pathname === "/api/app-version" && req.method === "GET") {
       res.setHeader("Cache-Control", "no-store, max-age=0");
       json(res, 200, {
@@ -2167,6 +2366,154 @@ export function startUiServer({
       json(res, 200, { token: getSessionTokenFromRequest(req) || "" });
       return;
     }
+
+    if (req.method === "GET" && url.pathname === "/api/spaces/public") {
+      try {
+        const ownerId = String(url.searchParams.get("owner") || "").trim();
+        const slug = String(url.searchParams.get("slug") || "").trim();
+        const space = getSpaceByRoute(ownerId, slug);
+        if (!space || (!canManageSpace(space, userCtx) && normalizeSpaceVisibility(space.visibility) === "private")) {
+          json(res, 404, { error: "Space not found" });
+          return;
+        }
+        if (space.status === "paused" && !canManageSpace(space, userCtx)) {
+          json(res, 410, { error: "Space is paused" });
+          return;
+        }
+        json(res, 200, {
+          space: spacePublicSummary(space, requestPublicBaseUrl(req)),
+          manageable: canManageSpace(space, userCtx),
+        });
+      } catch (e) {
+        json(res, 500, { error: (e && e.message) || String(e) });
+      }
+      return;
+    }
+
+    if (req.method === "GET" && url.pathname === "/api/spaces") {
+      if (!authUser?.userId) {
+        json(res, 401, { error: "Unauthorized" });
+        return;
+      }
+      const spaces = listSpacesForUser(userCtx.userId, userCtx.isAdmin)
+        .map((space) => spacePublicSummary(space, requestPublicBaseUrl(req)));
+      json(res, 200, { spaces });
+      return;
+    }
+
+    if (req.method === "POST" && url.pathname === "/api/spaces") {
+      if (!authUser?.userId) {
+        json(res, 401, { error: "Unauthorized" });
+        return;
+      }
+      try {
+        const payload = JSON.parse(await readBody(req));
+        const result = createSpace({
+          ownerId: userCtx.userId,
+          slug: payload.slug,
+          title: payload.title,
+          description: payload.description,
+          visibility: payload.visibility,
+        });
+        if (result.error) {
+          json(res, 400, { error: result.error });
+          return;
+        }
+        json(res, 200, { ok: true, space: spacePublicSummary(result.space, requestPublicBaseUrl(req)) });
+      } catch (e) {
+        json(res, 400, { error: (e && e.message) || String(e) });
+      }
+      return;
+    }
+
+    if (req.method === "PATCH" && url.pathname === "/api/spaces") {
+      if (!authUser?.userId) {
+        json(res, 401, { error: "Unauthorized" });
+        return;
+      }
+      try {
+        const payload = JSON.parse(await readBody(req));
+        const current = getSpaceById(payload.id);
+        if (!canManageSpace(current, userCtx)) {
+          json(res, current ? 403 : 404, { error: current ? "Forbidden" : "Space not found" });
+          return;
+        }
+        const result = updateSpace(payload.id, payload);
+        if (result.error) {
+          json(res, 400, { error: result.error });
+          return;
+        }
+        syncSpaceShareVisibility(result.space);
+        json(res, 200, { ok: true, space: spacePublicSummary(result.space, requestPublicBaseUrl(req)) });
+      } catch (e) {
+        json(res, 400, { error: (e && e.message) || String(e) });
+      }
+      return;
+    }
+
+    if (req.method === "POST" && url.pathname === "/api/spaces/page") {
+      if (!authUser?.userId) {
+        json(res, 401, { error: "Unauthorized" });
+        return;
+      }
+      try {
+        const payload = JSON.parse(await readBody(req));
+        const space = getSpaceById(payload.spaceId);
+        if (!canManageSpace(space, userCtx)) {
+          json(res, space ? 403 : 404, { error: space ? "Forbidden" : "Space not found" });
+          return;
+        }
+        const { share } = getDisplayShareOrExpired(String(payload.shareId || "").trim());
+        if (!share || (userCtx.isAdmin !== true && String(share.userId || "") !== String(userCtx.userId || ""))) {
+          json(res, 400, { error: "Display share not found or not owned by current user" });
+          return;
+        }
+        const foreignSpaceRef = displayShareSpaceReferences(share.id).find((ref) => ref.spaceId !== space.id);
+        if (foreignSpaceRef) {
+          json(res, 409, { error: "同一展示内容不能绑定到多个空间；请从 Workspace 重新生成一次展示" });
+          return;
+        }
+        const result = upsertSpacePage(space.id, {
+          title: payload.title,
+          path: payload.path,
+          shareId: share.id,
+          hidden: payload.hidden === true,
+        });
+        if (result.error) {
+          json(res, 400, { error: result.error });
+          return;
+        }
+        syncSpaceShareVisibility(result.space);
+        json(res, 200, {
+          ok: true,
+          page: result.page,
+          space: spacePublicSummary(result.space, requestPublicBaseUrl(req)),
+        });
+      } catch (e) {
+        json(res, 400, { error: (e && e.message) || String(e) });
+      }
+      return;
+    }
+
+    if (req.method === "DELETE" && url.pathname === "/api/spaces/page") {
+      if (!authUser?.userId) {
+        json(res, 401, { error: "Unauthorized" });
+        return;
+      }
+      const space = getSpaceById(url.searchParams.get("spaceId") || "");
+      if (!canManageSpace(space, userCtx)) {
+        json(res, space ? 403 : 404, { error: space ? "Forbidden" : "Space not found" });
+        return;
+      }
+      const result = deleteSpacePage(space.id, url.searchParams.get("pageId") || "");
+      if (result.error) {
+        json(res, 404, { error: result.error });
+        return;
+      }
+      json(res, 200, { ok: true, space: spacePublicSummary(result.space, requestPublicBaseUrl(req)) });
+      return;
+    }
+
     if (req.method === "GET" && url.pathname === "/api/display/shares") {
       try {
         if (!authUser?.userId) {
@@ -2194,6 +2541,10 @@ export function startUiServer({
           json(res, expired ? 410 : 404, { error: expired ? "Display share has expired" : "Display share not found" });
           return;
         }
+        if (!canReadDisplayShare(share, userCtx)) {
+          json(res, 404, { error: "Display share not found" });
+          return;
+        }
         const payload = publicDisplayPayloadFromShare(root, share);
         if (payload.error) {
           json(res, 404, { error: payload.error });
@@ -2274,6 +2625,10 @@ export function startUiServer({
           json(res, expired ? 410 : 404, { error: expired ? "Display share has expired" : "Display share not found" });
           return;
         }
+        if (!canReadDisplayShare(share, userCtx)) {
+          json(res, 404, { error: "Display share not found" });
+          return;
+        }
         const scoped = resolveWorkspaceScopeRoot(root, {
           flowId: share.flowId || "",
           flowSource: share.flowSource || "user",
@@ -2706,6 +3061,10 @@ export function startUiServer({
       }
       const flowId = idCheck.flowId;
       const targetSpace = parsed.targetSpace === "workspace" ? "workspace" : "user";
+      if (!["enabled", "disabled", "preserve"].includes(parsed.scheduleMode)) {
+        json(res, 400, { error: "scheduleMode must be enabled, disabled, or preserve" });
+        return;
+      }
       const existing = listFlowsJson(root, {
         ...userCtx,
         includeWorkspaceFlows: targetSpace === "workspace",
@@ -2747,10 +3106,37 @@ export function startUiServer({
         json(res, 400, { error: w.error });
         return;
       }
-      if (targetSpace === "workspace") {
-        ensureWorkspaceCollaboration({ flowId, userId: userCtx.userId });
+      const targetDir = targetSpace === "workspace"
+        ? path.join(path.resolve(root), PIPELINES_DIR, flowId)
+        : path.join(getUserPipelinesRoot(userCtx.userId), flowId);
+      let collaborationCreated = false;
+      try {
+        if (targetSpace === "workspace") {
+          ensureWorkspaceCollaboration({ flowId, userId: userCtx.userId });
+          collaborationCreated = true;
+        }
+        const scoped = resolveWorkspaceScopeRoot(root, { flowId, flowSource: targetSpace }, userCtx);
+        if (scoped.error) throw new Error(scoped.error);
+        const importedGraph = readWorkspaceGraph(scoped.root, root).graph;
+        const graph = workspaceGraphWithScheduleMode(importedGraph, parsed.scheduleMode);
+        if (graph !== importedGraph) writeWorkspaceGraph(scoped.root, graph, root);
+        const persisted = readWorkspaceGraph(scoped.root, root).graph;
+        const workspaceSchedules = syncWorkspaceSchedulesForGraph(root, scoped, persisted, authUser, userCtx);
+        json(res, 200, {
+          success: true,
+          flowId,
+          flowSource: targetSpace,
+          scheduleMode: parsed.scheduleMode,
+          workspaceSchedules,
+        });
+      } catch (e) {
+        try { fs.rmSync(targetDir, { recursive: true, force: true }); } catch (_) {}
+        if (collaborationCreated) deleteWorkspaceCollaborationForFlow(flowId, false);
+        json(res, 500, {
+          error: `Flow publication rolled back: ${(e && e.message) || String(e)}`,
+          rolledBack: true,
+        });
       }
-      json(res, 200, { success: true, flowId, flowSource: targetSpace });
       return;
     }
 
@@ -2893,6 +3279,7 @@ export function startUiServer({
           expiresInDays: payload.expiresInDays,
           permanent: payload.permanent,
           expiresAt: payload.expiresAt,
+          visibility: payload.visibility,
         });
         json(res, 200, { ok: true, share, url: `/display/${encodeURIComponent(share.id)}` });
       } catch (e) {