@fieldwangai/agentflow 0.1.28 → 0.1.30

package/bin/lib/ui-server.mjs

@@ -8,10 +8,17 @@
 import fs from "fs";
 import http from "http";
 import path from "path";
-import { spawn } from "child_process";
+import { execFile, spawn } from "child_process";
 import busboy from "busboy";
 import { log } from "./log.mjs";
-import { getFlowYamlAbs, listFlowsJson, listNodesJson, readFlowJson } from "./catalog-flows.mjs";
+import {
+  getFlowYamlAbs,
+  listFlowsJson,
+  listNodesJson,
+  readFlowJson,
+  readNodeDetailJson,
+  readNodeFilePreview,
+} from "./catalog-flows.mjs";
 import {
   FLOW_YAML_FILENAME,
   archiveFlowPipeline,
@@ -42,6 +49,7 @@ import {
   loadResourcesForIntents,
   loadResourcesForSkillKeys,
   listComposerSkills,
+  readComposerSkillDetail,
   buildSkillInjectionBlock,
   buildSkillCompactInjectionBlock,
 } from "./composer-skill-router.mjs";
@@ -65,6 +73,14 @@ import { runNodeScript } from "./pipeline-scripts.mjs";
 import { readFlowSchedule, writeFlowSchedule } from "./schedule-config.mjs";
 import { listScheduleStatuses } from "./scheduler.mjs";
 import { installFlowDependency, listMarketplacePackages, publishNodeFromInstance } from "./marketplace.mjs";
+import {
+  authSetupRequired,
+  buildClearSessionCookie,
+  buildSessionCookie,
+  getAuthUserFromRequest,
+  loginOrCreateUser,
+  logoutRequest,
+} from "./auth.mjs";
 
 const MIME = {
   ".html": "text/html; charset=utf-8",
@@ -123,6 +139,99 @@ function readModelListsFromDisk(workspaceRoot) {
   }
 }
 
+const SKILLHUB_TIMEOUT_MS = 60_000;
+
+function runSkillhub(args, opts = {}) {
+  return new Promise((resolve) => {
+    execFile("skillhub", args, {
+      cwd: opts.cwd || process.cwd(),
+      timeout: opts.timeoutMs || SKILLHUB_TIMEOUT_MS,
+      maxBuffer: opts.maxBuffer || 2 * 1024 * 1024,
+      env: {
+        ...process.env,
+        FORCE_COLOR: "0",
+      },
+    }, (error, stdout, stderr) => {
+      const out = String(stdout || "");
+      const err = String(stderr || "");
+      resolve({
+        ok: !error,
+        code: error && typeof error.code === "number" ? error.code : 0,
+        error: error ? (err.trim() || error.message || "skillhub failed") : "",
+        stdout: out,
+        stderr: err,
+      });
+    });
+  });
+}
+
+function parseJsonText(text, fallback = null) {
+  const s = String(text || "").trim();
+  if (!s) return fallback;
+  try {
+    return JSON.parse(s);
+  } catch {
+    const match = s.match(/(\{[\s\S]*\}|\[[\s\S]*\])\s*$/);
+    if (!match) return fallback;
+    try { return JSON.parse(match[1]); } catch { return fallback; }
+  }
+}
+
+function normalizeSkillhubSearchPayload(raw) {
+  const data = raw && typeof raw === "object" ? raw : {};
+  const items = Array.isArray(data.items) ? data.items : Array.isArray(data.results) ? data.results : [];
+  return {
+    total: Number(data.total) || items.length,
+    mode: typeof data.mode === "string" ? data.mode : "",
+    degraded: Boolean(data.degraded),
+    items: items.map((item) => {
+      const x = item && typeof item === "object" ? item : {};
+      const id = x.id ?? x.skillId ?? x.skill_id ?? "";
+      const slug = String(x.slug ?? x.name ?? x.displayName ?? x.display_name ?? id ?? "").trim();
+      return {
+        id: String(id || slug),
+        slug,
+        name: String(x.displayName ?? x.display_name ?? x.name ?? slug),
+        summary: String(x.summary ?? x.description ?? ""),
+        version: String(x.version ?? x.latestVersion ?? x.latest_version ?? ""),
+        tags: Array.isArray(x.tags) ? x.tags.map(String) : [],
+      };
+    }).filter((x) => x.slug || x.name),
+  };
+}
+
+function normalizeSkillhubListPayload(raw) {
+  const arr = Array.isArray(raw) ? raw : [];
+  return arr.map((x) => ({
+    name: String(x?.name ?? ""),
+    baseDir: String(x?.baseDir ?? ""),
+    path: String(x?.path ?? ""),
+    kind: String(x?.kind ?? ""),
+    agent: String(x?.agent ?? ""),
+  })).filter((x) => x.name);
+}
+
+function skillhubInstallArgs(payload, { uninstall = false } = {}) {
+  const slug = String(payload?.slug || payload?.name || "").trim();
+  if (!slug && !payload?.collection) return null;
+  const args = [uninstall ? "uninstall" : "install"];
+  if (payload?.collection) {
+    args.push("--collection", String(payload.collection).trim());
+  } else {
+    args.push(slug);
+  }
+  if (payload?.skillId) args.push("--skill-id", String(payload.skillId).trim());
+  const target = String(payload?.target || "project").trim();
+  const agent = String(payload?.agent || "codex").trim();
+  if (target === "global") {
+    args.push("--global", "--agent", agent);
+  } else if (payload?.dir) {
+    args.push("--dir", String(payload.dir).trim());
+  }
+  if (payload?.force) args.push("--force");
+  return args;
+}
+
 function readBody(req) {
   return new Promise((resolve, reject) => {
     const chunks = [];
@@ -132,6 +241,231 @@ function readBody(req) {
   });
 }
 
+const WORKSPACE_FILE_SKIP_DIRS = new Set([
+  ".git",
+  "node_modules",
+  ".next",
+  ".nuxt",
+  ".turbo",
+  "dist",
+  "build",
+  "coverage",
+]);
+
+const WORKSPACE_TEXT_EXTS = new Set([
+  ".md",
+  ".markdown",
+  ".txt",
+  ".json",
+  ".yaml",
+  ".yml",
+  ".js",
+  ".jsx",
+  ".ts",
+  ".tsx",
+  ".css",
+  ".html",
+  ".mjs",
+  ".cjs",
+]);
+
+function resolveWorkspaceFilePath(workspaceRoot, relPath) {
+  const root = path.resolve(workspaceRoot);
+  const rel = String(relPath || "").replace(/^[/\\]+/, "");
+  const abs = path.resolve(root, rel);
+  if (abs !== root && !abs.startsWith(root + path.sep)) {
+    throw new Error("Path traversal not allowed");
+  }
+  return { root, rel: path.relative(root, abs).replace(/\\/g, "/"), abs };
+}
+
+function workspaceFileIcon(fileName, isDir = false) {
+  if (isDir) return "folder";
+  const ext = path.extname(fileName).toLowerCase();
+  if (ext === ".md" || ext === ".markdown") return "article";
+  if ([".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs"].includes(ext)) return "code";
+  if ([".yaml", ".yml", ".json"].includes(ext)) return "data_object";
+  if (ext === ".css") return "palette";
+  if (ext === ".html") return "web";
+  return "draft";
+}
+
+function readWorkspaceFilesRecursive(dir, root, depth = 0, maxDepth = 3, budget = { count: 0 }) {
+  if (depth > maxDepth || budget.count > 500) return [];
+  let entries;
+  try {
+    entries = fs.readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const entry of entries) {
+    if (budget.count > 500) break;
+    if (entry.name.startsWith(".") && entry.name !== ".agents" && entry.name !== ".codex") continue;
+    const abs = path.join(dir, entry.name);
+    const rel = path.relative(root, abs).replace(/\\/g, "/");
+    if (entry.isDirectory()) {
+      if (WORKSPACE_FILE_SKIP_DIRS.has(entry.name)) continue;
+      budget.count++;
+      out.push({
+        type: "directory",
+        name: entry.name,
+        path: rel,
+        icon: workspaceFileIcon(entry.name, true),
+        children: readWorkspaceFilesRecursive(abs, root, depth + 1, maxDepth, budget),
+      });
+    } else if (entry.isFile()) {
+      const ext = path.extname(entry.name).toLowerCase();
+      if (!WORKSPACE_TEXT_EXTS.has(ext)) continue;
+      let size = 0;
+      try { size = fs.statSync(abs).size; } catch {}
+      budget.count++;
+      out.push({ type: "file", name: entry.name, path: rel, icon: workspaceFileIcon(entry.name), size });
+    }
+  }
+  out.sort((a, b) => {
+    if (a.type !== b.type) return a.type === "directory" ? -1 : 1;
+    return a.name.localeCompare(b.name);
+  });
+  return out;
+}
+
+function readWorkspaceFiles(workspaceRoot) {
+  const root = path.resolve(workspaceRoot);
+  return { root, files: readWorkspaceFilesRecursive(root, root) };
+}
+
+const WORKSPACE_GRAPH_FILENAME = "workspace.graph.json";
+
+function workspaceGraphPath(workspaceRoot) {
+  return path.join(path.resolve(workspaceRoot), WORKSPACE_GRAPH_FILENAME);
+}
+
+function emptyWorkspaceGraph() {
+  return { version: 1, instances: {}, edges: [], ui: { nodePositions: {} } };
+}
+
+function readWorkspaceGraph(workspaceRoot) {
+  const graphPath = workspaceGraphPath(workspaceRoot);
+  if (!fs.existsSync(graphPath)) return { path: graphPath, graph: emptyWorkspaceGraph() };
+  const raw = fs.readFileSync(graphPath, "utf-8");
+  if (!raw.trim()) return { path: graphPath, graph: emptyWorkspaceGraph() };
+  const parsed = JSON.parse(raw);
+  const graph = parsed && typeof parsed === "object" ? parsed : {};
+  return {
+    path: graphPath,
+    graph: {
+      version: Number(graph.version) || 1,
+      instances: graph.instances && typeof graph.instances === "object" && !Array.isArray(graph.instances) ? graph.instances : {},
+      edges: Array.isArray(graph.edges) ? graph.edges : [],
+      ui: graph.ui && typeof graph.ui === "object" ? graph.ui : { nodePositions: {} },
+    },
+  };
+}
+
+function normalizeWorkspaceGraphPayload(payload) {
+  const graph = payload?.graph && typeof payload.graph === "object" ? payload.graph : payload;
+  return {
+    version: 1,
+    instances: graph?.instances && typeof graph.instances === "object" && !Array.isArray(graph.instances) ? graph.instances : {},
+    edges: Array.isArray(graph?.edges) ? graph.edges : [],
+    ui: graph?.ui && typeof graph.ui === "object" ? graph.ui : { nodePositions: {} },
+    updatedAt: new Date().toISOString(),
+  };
+}
+
+function resolveWorkspaceScopeRoot(workspaceRoot, params = {}, opts = {}) {
+  const flowId = params.flowId != null ? String(params.flowId).trim() : "";
+  if (!flowId) return { root: path.resolve(workspaceRoot), flowId: "", flowSource: "", archived: false };
+  const flowSource = params.flowSource != null && String(params.flowSource).trim()
+    ? String(params.flowSource).trim()
+    : "user";
+  const archived = params.archived === true || params.archived === "1" || params.flowArchived === true;
+  if (!isValidFlowSourceRead(flowSource)) {
+    return { root: "", error: "Invalid flowSource" };
+  }
+  const result = getPipelineFiles(workspaceRoot, flowId, flowSource, archived, opts);
+  if (result.error || !result.path) {
+    return { root: "", error: result.error || "Pipeline workspace not found" };
+  }
+  return { root: path.resolve(result.path), flowId, flowSource, archived };
+}
+
+function buildWorkspaceGeneratePrompt(payload) {
+  const userPrompt = String(payload?.prompt || "").trim();
+  const outputKind = String(payload?.outputKind || payload?.kind || "markdown").trim().toLowerCase();
+  const allowFlowYaml = payload?.allowFlowYaml === true || payload?.allowFlowYaml === "1";
+  const workspaceGraph = payload?.workspaceGraph && typeof payload.workspaceGraph === "object" ? payload.workspaceGraph : null;
+  const selectedNodeIds = Array.isArray(payload?.selectedNodeIds)
+    ? payload.selectedNodeIds.map((id) => String(id || "").trim()).filter(Boolean)
+    : [];
+  const skillsBlock = typeof payload?.skillsBlock === "string" ? payload.skillsBlock.trim() : "";
+  const contexts = Array.isArray(payload?.contexts) ? payload.contexts : [];
+  const contextBlocks = contexts
+    .map((ctx, idx) => {
+      const title = String(ctx?.title || ctx?.path || `context-${idx + 1}`).trim();
+      const kind = String(ctx?.kind || "text").trim();
+      const content = String(ctx?.content || "").trim();
+      if (!content) return "";
+      return `### ${title} (${kind})\n\n${content}`;
+    })
+    .filter(Boolean)
+    .join("\n\n---\n\n");
+  const kindInstruction =
+    outputKind === "mermaid"
+      ? [
+          "你是 workspace Mermaid 图节点的内容生成器。",
+          "请根据用户 prompt 和上游节点/文件上下文生成 Mermaid flowchart 源码。",
+          "只输出 Mermaid 源码，不要解释，不要包裹 Markdown 代码围栏。",
+          "优先使用 `flowchart TD` 或 `graph TD`，节点 ID 使用简单英文/数字/下划线，节点 label 使用清晰短文本。",
+        ].join("\n")
+      : outputKind === "ascii"
+        ? [
+            "你是 workspace ASCII 图节点的内容生成器。",
+            "请根据用户 prompt 和上游节点/文件上下文生成等宽字体下可读的 ASCII 图。",
+            "只输出 ASCII 图正文，不要解释，不要包裹 Markdown 代码围栏。",
+            "使用 +-|/\\<> 等字符表达结构，尽量保持对齐。",
+          ].join("\n")
+        : [
+            "你是 workspace Markdown 节点的内容生成器。",
+            "请根据用户 prompt 和上游节点/文件上下文，生成可直接保存到工作区的 Markdown 正文。",
+            "只输出最终 Markdown 内容，不要解释你如何执行，也不要包裹代码围栏，除非正文本身需要代码块。",
+          ].join("\n");
+  return [
+    "你正在 AgentFlow 的 Workspace 工作画布中执行任务。",
+    "Workspace 是当前 pipeline 的临时工作区，用于分析、试验、生成中间文件和展示结果。",
+    allowFlowYaml
+      ? "用户已允许你考虑正式 flow.yaml；如需修改仍必须明确说明影响。"
+      : "默认不要修改正式 flow.yaml；优先在 workspace 文件、workspace.graph.json 或回复内容中完成任务。",
+    workspaceGraph ? `\n## 当前 workspace graph\n\n${JSON.stringify(workspaceGraph, null, 2)}` : "",
+    selectedNodeIds.length > 0 ? `\n## 当前用户选中的 workspace 节点\n\n${selectedNodeIds.map((id) => `- ${id}`).join("\n")}` : "",
+    skillsBlock ? `\n## Workspace Skills\n\n${skillsBlock}` : "",
+    kindInstruction,
+    contextBlocks ? `\n## 上下文\n\n${contextBlocks}` : "",
+    `\n## 用户 prompt\n\n${userPrompt}`,
+  ].filter(Boolean).join("\n");
+}
+
+function isTransientAgentNetworkError(err) {
+  const text = [
+    err?.message,
+    err?.cursorStderrTail,
+    err?.stderr,
+    err?.stack,
+  ].filter(Boolean).join("\n");
+  return /Client network socket disconnected before secure TLS connection was established/i.test(text) ||
+    /secure TLS connection was established/i.test(text) ||
+    /\bECONNRESET\b/i.test(text) ||
+    /\bETIMEDOUT\b/i.test(text) ||
+    /\bEAI_AGAIN\b/i.test(text) ||
+    /network socket disconnected/i.test(text) ||
+    /socket hang up/i.test(text);
+}
+
+function sleepMs(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
 /** ZIP 本地头：PK\x03\x04 / \x05\x06 / \x07\x08 */
 function bufferLooksLikeZip(buf) {
   return (
@@ -211,12 +545,12 @@ const flowEditorSyncSubscribers = new Map();
 /** 每次 broadcastFlowEditorSync 时递增，供轮询端点 /api/flow-editor-sync-poll 使用 */
 const flowEditorSyncVersions = new Map();
 
-function flowEditorSyncKey(flowId, flowSource, flowArchived) {
-  return `${String(flowId)}\t${String(flowSource)}\t${flowArchived ? "1" : "0"}`;
+function flowEditorSyncKey(flowId, flowSource, flowArchived, userId = "") {
+  return `${String(userId || "")}\t${String(flowId)}\t${String(flowSource)}\t${flowArchived ? "1" : "0"}`;
 }
 
-function broadcastFlowEditorSync(flowId, flowSource, flowArchived = false) {
-  const key = flowEditorSyncKey(flowId, flowSource, flowArchived);
+function broadcastFlowEditorSync(flowId, flowSource, flowArchived = false, userId = "") {
+  const key = flowEditorSyncKey(flowId, flowSource, flowArchived, userId);
 
   /* 递增轮询版本号 */
   flowEditorSyncVersions.set(key, (flowEditorSyncVersions.get(key) ?? 0) + 1);
@@ -340,6 +674,7 @@ function normalizeContextInstanceIds(raw) {
  * @param {object} opts
  * @param {string} opts.workspaceRoot
  * @param {number} opts.port
+ * @param {boolean} [opts.hideCommunityLinks]
  * @param {string} [opts.staticDir] 默认 PACKAGE_ROOT/builtin/web-ui/dist（npm run build 产出）
  * @returns {Promise<import('http').Server>}
  */
@@ -347,10 +682,12 @@ export function startUiServer({
   workspaceRoot,
   port,
   host = "127.0.0.1",
+  hideCommunityLinks = false,
   staticDir = path.join(PACKAGE_ROOT, "builtin", "web-ui", "dist"),
 }) {
   const root = path.resolve(workspaceRoot);
   const uiPort = port;
+  const uiConfig = { hideCommunityLinks: Boolean(hideCommunityLinks) };
 
   const server = http.createServer(async (req, res) => {
     const url = new URL(req.url || "/", "http://127.0.0.1");
@@ -363,10 +700,58 @@ export function startUiServer({
       return origEnd(...args);
     };
 
+    if (url.pathname === "/api/auth/me" && req.method === "GET") {
+      const user = getAuthUserFromRequest(req);
+      json(res, 200, { authenticated: Boolean(user), user: user || null, setupRequired: authSetupRequired() });
+      return;
+    }
+
+    if (url.pathname === "/api/auth/login" && req.method === "POST") {
+      let payload;
+      try {
+        payload = JSON.parse(await readBody(req));
+      } catch {
+        json(res, 400, { error: "Invalid JSON body" });
+        return;
+      }
+      const result = loginOrCreateUser(payload?.username, payload?.password);
+      if (!result.ok) {
+        json(res, 401, { error: result.error || "Login failed", setupRequired: authSetupRequired() });
+        return;
+      }
+      const body = JSON.stringify({ authenticated: true, user: result.user, setupRequired: false, migration: result.migration || null });
+      res.writeHead(200, {
+        "Content-Type": "application/json; charset=utf-8",
+        "Content-Length": Buffer.byteLength(body),
+        "Set-Cookie": buildSessionCookie(result.token),
+      });
+      res.end(body);
+      return;
+    }
+
+    if (url.pathname === "/api/auth/logout" && req.method === "POST") {
+      logoutRequest(req);
+      const body = JSON.stringify({ ok: true });
+      res.writeHead(200, {
+        "Content-Type": "application/json; charset=utf-8",
+        "Content-Length": Buffer.byteLength(body),
+        "Set-Cookie": buildClearSessionCookie(),
+      });
+      res.end(body);
+      return;
+    }
+
+    const authUser = getAuthUserFromRequest(req);
+    const userCtx = authUser ? { userId: authUser.userId } : {};
+    if (url.pathname.startsWith("/api/") && !authUser) {
+      json(res, 401, { error: "Authentication required", setupRequired: authSetupRequired() });
+      return;
+    }
+
     if (url.pathname === "/api/flows") {
       if (req.method === "GET") {
         try {
-          json(res, 200, listFlowsJson(root));
+          json(res, 200, listFlowsJson(root, userCtx));
         } catch (e) {
           json(res, 500, { error: (e && e.message) || String(e) });
         }
@@ -400,7 +785,7 @@ export function startUiServer({
         if (ts === "workspace" || ts === "user") {
           targetSpace = ts;
         }
-        const existing = listFlowsJson(root);
+        const existing = listFlowsJson(root, userCtx);
         if (
           existing.some(
             (f) => f.id === flowId && (f.source ?? "user") === targetSpace && !f.archived,
@@ -410,7 +795,7 @@ export function startUiServer({
           return;
         }
         const flowYaml = buildEmptyUserFlowYaml({ description: desc });
-        const result = writeFlowYaml(root, flowId, targetSpace, flowYaml);
+        const result = writeFlowYaml(root, flowId, targetSpace, flowYaml, userCtx);
         if (!result.success) {
           json(res, 400, result);
           return;
@@ -456,7 +841,7 @@ export function startUiServer({
       }
       const flowId = idCheck.flowId;
       const targetSpace = parsed.targetSpace === "workspace" ? "workspace" : "user";
-      const existing = listFlowsJson(root);
+      const existing = listFlowsJson(root, userCtx);
       if (
         existing.some(
           (f) => f.id === flowId && (f.source ?? "user") === targetSpace && !f.archived,
@@ -487,7 +872,7 @@ export function startUiServer({
         filesMap = new Map([["flow.yaml", Buffer.from(text, "utf8")]]);
       }
 
-      const w = writePipelineTree(root, flowId, targetSpace, filesMap);
+      const w = writePipelineTree(root, flowId, targetSpace, filesMap, userCtx);
       if (!w.success) {
         json(res, 400, { error: w.error });
         return;
@@ -507,7 +892,7 @@ export function startUiServer({
           return;
         }
         const { getNodeExecContext } = await import("./node-exec-context.mjs");
-        json(res, 200, getNodeExecContext(root, flowId, instanceId, runId));
+        json(res, 200, getNodeExecContext(root, flowId, instanceId, runId, userCtx));
       } catch (e) {
         json(res, 500, { error: (e && e.message) || String(e) });
       }
@@ -516,7 +901,7 @@ export function startUiServer({
 
     if (req.method === "GET" && url.pathname === "/api/pipeline-recent-runs") {
       try {
-        json(res, 200, { runs: listRecentRunsFromDisk(root) });
+        json(res, 200, { runs: listRecentRunsFromDisk(root, userCtx) });
       } catch (e) {
         json(res, 500, { error: (e && e.message) || String(e) });
       }
@@ -532,7 +917,7 @@ export function startUiServer({
           return;
         }
         const { getRunNodeStatusesFromDisk } = await import("./run-node-statuses-from-disk.mjs");
-        json(res, 200, { statuses: getRunNodeStatusesFromDisk(root, flowId, runId) });
+        json(res, 200, { statuses: getRunNodeStatusesFromDisk(root, flowId, runId, userCtx) });
       } catch (e) {
         json(res, 500, { error: (e && e.message) || String(e) });
       }
@@ -554,7 +939,7 @@ export function startUiServer({
         const { getRunDir } = await import("./workspace.mjs");
         const { RUN_LOG_REL } = await import("./paths.mjs");
         const { default: fsMod } = await import("node:fs");
-        const logPath = path.join(getRunDir(root, flowId, runId), RUN_LOG_REL);
+        const logPath = path.join(getRunDir(root, flowId, runId, userCtx), RUN_LOG_REL);
         if (!fsMod.existsSync(logPath)) {
           json(res, 200, { bytes: 0, text: "" });
           return;
@@ -596,6 +981,303 @@ export function startUiServer({
       return;
     }
 
+    if (req.method === "GET" && url.pathname === "/api/workspace/files") {
+      try {
+        const scoped = resolveWorkspaceScopeRoot(root, {
+          flowId: url.searchParams.get("flowId") || "",
+          flowSource: url.searchParams.get("flowSource") || "user",
+          archived: url.searchParams.get("archived") === "1",
+        }, userCtx);
+        if (scoped.error) {
+          json(res, 400, { error: scoped.error });
+          return;
+        }
+        json(res, 200, { ...readWorkspaceFiles(scoped.root), flowId: scoped.flowId, flowSource: scoped.flowSource, archived: scoped.archived });
+      } catch (e) {
+        json(res, 500, { error: (e && e.message) || String(e) });
+      }
+      return;
+    }
+
+    if (req.method === "GET" && url.pathname === "/api/workspace/graph") {
+      try {
+        const scoped = resolveWorkspaceScopeRoot(root, {
+          flowId: url.searchParams.get("flowId") || "",
+          flowSource: url.searchParams.get("flowSource") || "user",
+          archived: url.searchParams.get("archived") === "1",
+        }, userCtx);
+        if (scoped.error) {
+          json(res, 400, { error: scoped.error });
+          return;
+        }
+        const { path: graphPath, graph } = readWorkspaceGraph(scoped.root);
+        json(res, 200, {
+          ok: true,
+          graph,
+          path: graphPath,
+          root: scoped.root,
+          flowId: scoped.flowId,
+          flowSource: scoped.flowSource,
+          archived: scoped.archived,
+          writable: !(scoped.archived || scoped.flowSource === "builtin"),
+        });
+      } catch (e) {
+        json(res, 500, { error: (e && e.message) || String(e) });
+      }
+      return;
+    }
+
+    if (req.method === "POST" && url.pathname === "/api/workspace/graph") {
+      let payload;
+      try {
+        payload = JSON.parse(await readBody(req));
+      } catch {
+        json(res, 400, { error: "Invalid JSON body" });
+        return;
+      }
+      try {
+        const scoped = resolveWorkspaceScopeRoot(root, {
+          flowId: payload.flowId || "",
+          flowSource: payload.flowSource || "user",
+          archived: payload.archived === true || payload.flowArchived === true,
+        }, userCtx);
+        if (scoped.error) {
+          json(res, 400, { error: scoped.error });
+          return;
+        }
+        if (scoped.archived || scoped.flowSource === "builtin") {
+          json(res, 400, { error: "Cannot write workspace graph for builtin or archived pipeline" });
+          return;
+        }
+        const graph = normalizeWorkspaceGraphPayload(payload.graph || payload);
+        const graphPath = workspaceGraphPath(scoped.root);
+        fs.writeFileSync(graphPath, JSON.stringify(graph, null, 2) + "\n", "utf-8");
+        json(res, 200, { ok: true, path: graphPath, graph });
+      } catch (e) {
+        json(res, 500, { error: (e && e.message) || String(e) });
+      }
+      return;
+    }
+
+    if (req.method === "GET" && url.pathname === "/api/workspace/file") {
+      try {
+        const scoped = resolveWorkspaceScopeRoot(root, {
+          flowId: url.searchParams.get("flowId") || "",
+          flowSource: url.searchParams.get("flowSource") || "user",
+          archived: url.searchParams.get("archived") === "1",
+        }, userCtx);
+        if (scoped.error) {
+          json(res, 400, { error: scoped.error });
+          return;
+        }
+        const { abs, rel } = resolveWorkspaceFilePath(scoped.root, url.searchParams.get("path") || "");
+        if (!fs.existsSync(abs) || !fs.statSync(abs).isFile()) {
+          json(res, 404, { error: "File not found" });
+          return;
+        }
+        const stat = fs.statSync(abs);
+        if (stat.size > 2 * 1024 * 1024) {
+          json(res, 413, { error: "File too large" });
+          return;
+        }
+        json(res, 200, { path: rel, content: fs.readFileSync(abs, "utf-8"), size: stat.size });
+      } catch (e) {
+        json(res, /traversal/i.test(String(e.message || e)) ? 403 : 500, { error: (e && e.message) || String(e) });
+      }
+      return;
+    }
+
+    if (req.method === "POST" && url.pathname === "/api/workspace/file") {
+      let payload;
+      try {
+        payload = JSON.parse(await readBody(req));
+      } catch {
+        json(res, 400, { error: "Invalid JSON body" });
+        return;
+      }
+      try {
+        const scoped = resolveWorkspaceScopeRoot(root, {
+          flowId: payload.flowId || "",
+          flowSource: payload.flowSource || "user",
+          archived: payload.archived === true || payload.flowArchived === true,
+        }, userCtx);
+        if (scoped.error) {
+          json(res, 400, { error: scoped.error });
+          return;
+        }
+        if (scoped.archived || scoped.flowSource === "builtin") {
+          json(res, 400, { error: "Cannot write to builtin or archived pipeline workspace" });
+          return;
+        }
+        const { abs, rel } = resolveWorkspaceFilePath(scoped.root, payload.path || "");
+        if (!rel) {
+          json(res, 400, { error: "Missing path" });
+          return;
+        }
+        fs.mkdirSync(path.dirname(abs), { recursive: true });
+        fs.writeFileSync(abs, String(payload.content ?? ""), "utf-8");
+        json(res, 200, { ok: true, path: rel });
+      } catch (e) {
+        json(res, /traversal/i.test(String(e.message || e)) ? 403 : 500, { error: (e && e.message) || String(e) });
+      }
+      return;
+    }
+
+    if (req.method === "POST" && url.pathname === "/api/workspace/folder") {
+      let payload;
+      try {
+        payload = JSON.parse(await readBody(req));
+      } catch {
+        json(res, 400, { error: "Invalid JSON body" });
+        return;
+      }
+      try {
+        const scoped = resolveWorkspaceScopeRoot(root, {
+          flowId: payload.flowId || "",
+          flowSource: payload.flowSource || "user",
+          archived: payload.archived === true || payload.flowArchived === true,
+        }, userCtx);
+        if (scoped.error) {
+          json(res, 400, { error: scoped.error });
+          return;
+        }
+        if (scoped.archived || scoped.flowSource === "builtin") {
+          json(res, 400, { error: "Cannot write to builtin or archived pipeline workspace" });
+          return;
+        }
+        const { abs, rel } = resolveWorkspaceFilePath(scoped.root, payload.path || "");
+        if (!rel) {
+          json(res, 400, { error: "Missing path" });
+          return;
+        }
+        fs.mkdirSync(abs, { recursive: true });
+        json(res, 200, { ok: true, path: rel });
+      } catch (e) {
+        json(res, /traversal/i.test(String(e.message || e)) ? 403 : 500, { error: (e && e.message) || String(e) });
+      }
+      return;
+    }
+
+    if (req.method === "POST" && url.pathname === "/api/workspace/delete") {
+      let payload;
+      try {
+        payload = JSON.parse(await readBody(req));
+      } catch {
+        json(res, 400, { error: "Invalid JSON body" });
+        return;
+      }
+      try {
+        const scoped = resolveWorkspaceScopeRoot(root, {
+          flowId: payload.flowId || "",
+          flowSource: payload.flowSource || "user",
+          archived: payload.archived === true || payload.flowArchived === true,
+        }, userCtx);
+        if (scoped.error) {
+          json(res, 400, { error: scoped.error });
+          return;
+        }
+        if (scoped.archived || scoped.flowSource === "builtin") {
+          json(res, 400, { error: "Cannot write to builtin or archived pipeline workspace" });
+          return;
+        }
+        const { abs, rel } = resolveWorkspaceFilePath(scoped.root, payload.path || "");
+        if (!rel) {
+          json(res, 400, { error: "Missing path" });
+          return;
+        }
+        if (!fs.existsSync(abs)) {
+          json(res, 404, { error: "Path not found" });
+          return;
+        }
+        fs.rmSync(abs, { recursive: true, force: true });
+        json(res, 200, { ok: true, path: rel });
+      } catch (e) {
+        json(res, /traversal/i.test(String(e.message || e)) ? 403 : 500, { error: (e && e.message) || String(e) });
+      }
+      return;
+    }
+
+    if (req.method === "POST" && url.pathname === "/api/workspace/generate") {
+      let payload;
+      try {
+        payload = JSON.parse(await readBody(req));
+      } catch {
+        json(res, 400, { error: "Invalid JSON body" });
+        return;
+      }
+      const prompt = String(payload?.prompt || "").trim();
+      if (!prompt) {
+        json(res, 400, { error: "Missing prompt" });
+        return;
+      }
+      try {
+        const scoped = resolveWorkspaceScopeRoot(root, {
+          flowId: payload.flowId || "",
+          flowSource: payload.flowSource || "user",
+          archived: payload.archived === true || payload.flowArchived === true,
+        }, userCtx);
+        if (scoped.error) {
+          json(res, 400, { error: scoped.error });
+          return;
+        }
+        const selectedSkillKeys = Array.isArray(payload?.selectedSkills)
+          ? payload.selectedSkills.map((x) => String(x || "").trim()).filter(Boolean)
+          : [];
+        const selectedSkillResources = selectedSkillKeys.length > 0
+          ? loadResourcesForSkillKeys(selectedSkillKeys, PACKAGE_ROOT, scoped.root)
+          : { skills: [], references: [] };
+        const skillsBlock = selectedSkillKeys.length > 0
+          ? buildSkillCompactInjectionBlock(selectedSkillResources.skills, selectedSkillResources.references)
+          : "";
+        let content = "";
+        const events = [];
+        const maxAttempts = 3;
+        const promptText = buildWorkspaceGeneratePrompt({ ...payload, skillsBlock });
+        const modelKey = typeof payload?.model === "string" ? payload.model.trim() : "";
+        for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+          let attemptContent = "";
+          try {
+            if (attempt > 1) {
+              events.push({
+                type: "status",
+                line: `Workspace agent retry ${attempt}/${maxAttempts} after transient network failure...`,
+              });
+              await sleepMs(Math.min(1500 * attempt, 5000));
+            }
+            const handle = startComposerAgent({
+              uiWorkspaceRoot: scoped.root,
+              cliWorkspace: scoped.root,
+              prompt: promptText,
+              modelKey,
+              agentflowUserId: userCtx.userId || "",
+              onStreamEvent: (ev) => {
+                events.push(ev);
+                if (ev?.type === "natural" && typeof ev.text === "string") {
+                  attemptContent += (attemptContent ? "\n" : "") + ev.text;
+                }
+              },
+            });
+            await handle.finished;
+            content = attemptContent;
+            break;
+          } catch (e) {
+            if (attempt < maxAttempts && isTransientAgentNetworkError(e)) {
+              events.push({
+                type: "status",
+                line: `Workspace agent transient network error: ${String(e.message || e).slice(0, 220)}`,
+              });
+              continue;
+            }
+            throw e;
+          }
+        }
+        json(res, 200, { ok: true, content: content.trim(), events });
+      } catch (e) {
+        json(res, 500, { error: (e && e.message) || String(e) });
+      }
+      return;
+    }
+
     if (req.method === "GET" && url.pathname === "/api/pipeline-files") {
       const flowId = url.searchParams.get("flowId");
       const flowSource = url.searchParams.get("flowSource") || "user";
@@ -605,7 +1287,7 @@ export function startUiServer({
         return;
       }
       try {
-        const result = getPipelineFiles(root, flowId, flowSource, archived);
+        const result = getPipelineFiles(root, flowId, flowSource, archived, userCtx);
         json(res, 200, result);
       } catch (e) {
         json(res, 500, { error: (e && e.message) || String(e) });
@@ -623,7 +1305,7 @@ export function startUiServer({
         return;
       }
       try {
-        const result = getPipelineFiles(root, flowId, flowSource, archived);
+        const result = getPipelineFiles(root, flowId, flowSource, archived, userCtx);
         if (result.error) {
           json(res, 404, { error: result.error });
           return;
@@ -669,7 +1351,7 @@ export function startUiServer({
         content = String(body);
       }
       try {
-        const result = getPipelineFiles(root, flowId, flowSource, archived);
+        const result = getPipelineFiles(root, flowId, flowSource, archived, userCtx);
         if (result.error) {
           json(res, 404, { error: result.error });
           return;
@@ -702,7 +1384,7 @@ export function startUiServer({
 
     if (req.method === "GET" && url.pathname === "/api/ui-context") {
       try {
-        json(res, 200, { workspaceRoot: root });
+        json(res, 200, { workspaceRoot: root, ...uiConfig });
       } catch (e) {
         json(res, 500, { error: (e && e.message) || String(e) });
       }
@@ -833,15 +1515,108 @@ export function startUiServer({
       return;
     }
 
+    if (req.method === "GET" && url.pathname === "/api/skillhub/status") {
+      const versionRes = await runSkillhub(["version"], { cwd: root, timeoutMs: 15_000 });
+      const whoRes = await runSkillhub(["whoami"], { cwd: root, timeoutMs: 15_000 });
+      json(res, 200, {
+        available: versionRes.ok,
+        version: versionRes.ok ? versionRes.stdout.trim() : "",
+        loggedIn: whoRes.ok,
+        user: whoRes.ok ? whoRes.stdout.trim() : "",
+        error: versionRes.ok ? "" : versionRes.error,
+      });
+      return;
+    }
+
+    if (req.method === "GET" && url.pathname === "/api/skillhub/list") {
+      const target = url.searchParams.get("target") || "global";
+      const agent = url.searchParams.get("agent") || "codex";
+      const args = ["list", "--json"];
+      if (target === "all") args.push("--all");
+      else if (target === "global") args.push("--global", "--agent", agent);
+      const result = await runSkillhub(args, { cwd: root });
+      if (!result.ok) {
+        json(res, 500, { error: result.error, stdout: result.stdout });
+        return;
+      }
+      json(res, 200, { skills: normalizeSkillhubListPayload(parseJsonText(result.stdout, [])) });
+      return;
+    }
+
+    if (req.method === "GET" && url.pathname === "/api/skillhub/search") {
+      const q = (url.searchParams.get("q") || "").trim();
+      if (!q) {
+        json(res, 200, { total: 0, items: [] });
+        return;
+      }
+      const result = await runSkillhub(["search", "-q", q], { cwd: root });
+      if (!result.ok) {
+        json(res, 500, { error: result.error, stdout: result.stdout });
+        return;
+      }
+      json(res, 200, normalizeSkillhubSearchPayload(parseJsonText(result.stdout, {})));
+      return;
+    }
+
+    if (req.method === "POST" && url.pathname === "/api/skillhub/install") {
+      let payload;
+      try {
+        payload = JSON.parse(await readBody(req));
+      } catch {
+        json(res, 400, { error: "Invalid JSON body" });
+        return;
+      }
+      const args = skillhubInstallArgs(payload);
+      if (!args) {
+        json(res, 400, { error: "Missing skill slug or collection" });
+        return;
+      }
+      const result = await runSkillhub(args, { cwd: root, timeoutMs: 180_000, maxBuffer: 4 * 1024 * 1024 });
+      if (!result.ok) {
+        json(res, 500, { error: result.error, stdout: result.stdout });
+        return;
+      }
+      json(res, 200, { ok: true, stdout: result.stdout });
+      return;
+    }
+
+    if (req.method === "POST" && url.pathname === "/api/skillhub/uninstall") {
+      let payload;
+      try {
+        payload = JSON.parse(await readBody(req));
+      } catch {
+        json(res, 400, { error: "Invalid JSON body" });
+        return;
+      }
+      const args = skillhubInstallArgs(payload, { uninstall: true });
+      if (!args) {
+        json(res, 400, { error: "Missing skill slug or collection" });
+        return;
+      }
+      const result = await runSkillhub(args, { cwd: root, timeoutMs: 120_000, maxBuffer: 4 * 1024 * 1024 });
+      if (!result.ok) {
+        json(res, 500, { error: result.error, stdout: result.stdout });
+        return;
+      }
+      json(res, 200, { ok: true, stdout: result.stdout });
+      return;
+    }
+
+    if (req.method === "POST" && url.pathname === "/api/skillhub/update") {
+      const result = await runSkillhub(["update"], { cwd: root, timeoutMs: 180_000, maxBuffer: 4 * 1024 * 1024 });
+      if (!result.ok) {
+        json(res, 500, { error: result.error, stdout: result.stdout });
+        return;
+      }
+      json(res, 200, { ok: true, stdout: result.stdout });
+      return;
+    }
+
     if (req.method === "GET" && url.pathname === "/api/nodes") {
       const flowId = url.searchParams.get("flowId");
       const flowSource = url.searchParams.get("flowSource") || "user";
       const lang = url.searchParams.get("lang") || "en";
-      if (!flowId) {
-        json(res, 400, { error: "Missing flowId" });
-        return;
-      }
-      if (!isValidFlowSourceRead(flowSource)) {
+      if (flowId && !isValidFlowSourceRead(flowSource)) {
         json(res, 400, { error: "Invalid flowSource" });
         return;
       }
@@ -849,7 +1624,60 @@ export function startUiServer({
       try {
         const { setLanguage } = await import("./i18n.mjs");
         setLanguage(lang);
-        json(res, 200, listNodesJson(root, flowId, flowSource, { archived: nodesArchived }));
+        json(res, 200, listNodesJson(root, flowId || "", flowId ? flowSource : "", { archived: nodesArchived, ...userCtx }));
+      } catch (e) {
+        json(res, 500, { error: (e && e.message) || String(e) });
+      }
+      return;
+    }
+
+    if (req.method === "GET" && url.pathname === "/api/nodes/detail") {
+      const nodeId = url.searchParams.get("id") || "";
+      const flowId = url.searchParams.get("flowId") || "";
+      const flowSource = url.searchParams.get("flowSource") || "";
+      if (!nodeId) {
+        json(res, 400, { error: "Missing node id" });
+        return;
+      }
+      if (flowId && !isValidFlowSourceRead(flowSource || "user")) {
+        json(res, 400, { error: "Invalid flowSource" });
+        return;
+      }
+      const archived = url.searchParams.get("archived") === "1";
+      try {
+        const detail = readNodeDetailJson(root, nodeId, flowId, flowId ? (flowSource || "user") : "", { archived, ...userCtx });
+        if (detail.error) {
+          json(res, 404, { error: detail.error });
+          return;
+        }
+        json(res, 200, detail);
+      } catch (e) {
+        json(res, 500, { error: (e && e.message) || String(e) });
+      }
+      return;
+    }
+
+    if (req.method === "GET" && url.pathname === "/api/nodes/file") {
+      const nodeId = url.searchParams.get("id") || "";
+      const relPath = url.searchParams.get("path") || "";
+      const flowId = url.searchParams.get("flowId") || "";
+      const flowSource = url.searchParams.get("flowSource") || "";
+      if (!nodeId || !relPath) {
+        json(res, 400, { error: "Missing node id or path" });
+        return;
+      }
+      if (flowId && !isValidFlowSourceRead(flowSource || "user")) {
+        json(res, 400, { error: "Invalid flowSource" });
+        return;
+      }
+      const archived = url.searchParams.get("archived") === "1";
+      try {
+        const file = readNodeFilePreview(root, nodeId, relPath, flowId, flowId ? (flowSource || "user") : "", { archived, ...userCtx });
+        if (file.error) {
+          json(res, 404, { error: file.error });
+          return;
+        }
+        json(res, 200, file);
       } catch (e) {
         json(res, 500, { error: (e && e.message) || String(e) });
       }
@@ -890,7 +1718,7 @@ export function startUiServer({
         return;
       }
       try {
-        const resolved = resolveFlowDirForWrite(root, flowId, flowSource);
+        const resolved = resolveFlowDirForWrite(root, flowId, flowSource, userCtx);
         if (resolved.error || !resolved.flowDir) {
           json(res, 400, { error: resolved.error || "Could not resolve flow directory" });
           return;
@@ -916,7 +1744,7 @@ export function startUiServer({
         const flowSource = payload?.flowSource || "user";
         let flowDir = "";
         if (flowId && isValidFlowSourceWrite(flowSource)) {
-          const resolved = resolveFlowDirForWrite(root, flowId, flowSource);
+          const resolved = resolveFlowDirForWrite(root, flowId, flowSource, userCtx);
           if (!resolved.error && resolved.flowDir) flowDir = resolved.flowDir;
         }
         const result = publishNodeFromInstance(root, payload || {}, { flowDir });
@@ -939,7 +1767,7 @@ export function startUiServer({
         return;
       }
       const flowArchived = url.searchParams.get("archived") === "1";
-      const result = readFlowJson(root, flowId, flowSource, { archived: flowArchived });
+      const result = readFlowJson(root, flowId, flowSource, { archived: flowArchived, ...userCtx });
       if (result.error) {
         json(res, 404, result);
         return;
@@ -965,7 +1793,7 @@ export function startUiServer({
           json(res, 400, { error: "Missing runUuid, instanceId, or content" });
           return;
         }
-        const runDir = path.join(getRunDir(root, payload.flowId || "unknown", runUuid));
+        const runDir = path.join(getRunDir(root, payload.flowId || "unknown", runUuid, userCtx));
         const outputPath = path.join(runDir, `output/${instanceId}/node_${instanceId}_content.md`);
         try {
           fs.mkdirSync(path.dirname(outputPath), { recursive: true });
@@ -1000,7 +1828,7 @@ ${content}
 
         const opencodeCmd = process.env.OPENCODE_CMD || "opencode";
         const tmpPromptFile = path.join(
-          getRunDir(root, payload.flowId || "unknown", runUuid),
+          getRunDir(root, payload.flowId || "unknown", runUuid, userCtx),
           "intermediate",
           `${instanceId}_ai_edit_prompt.txt`,
         );
@@ -1045,7 +1873,7 @@ ${content}
           json(res, 400, { error: "Missing runUuid or instanceId" });
           return;
         }
-        const runDir = path.join(getRunDir(root, payload.flowId || "unknown", runUuid));
+        const runDir = path.join(getRunDir(root, payload.flowId || "unknown", runUuid, userCtx));
         const resultPath = path.join(runDir, `intermediate/${instanceId}/${instanceId}.result.md`);
         try {
           fs.mkdirSync(path.dirname(resultPath), { recursive: true });
@@ -1075,7 +1903,7 @@ finishedAt: "${new Date().toISOString()}"
           json(res, 400, { error: "Missing runUuid, instanceId, or branch" });
           return;
         }
-        const runDir = path.join(getRunDir(root, payload.flowId || "unknown", runUuid));
+        const runDir = path.join(getRunDir(root, payload.flowId || "unknown", runUuid, userCtx));
         const resultPath = path.join(runDir, `intermediate/${instanceId}/${instanceId}.result.md`);
         try {
           fs.mkdirSync(path.dirname(resultPath), { recursive: true });
@@ -1123,7 +1951,7 @@ finishedAt: "${new Date().toISOString()}"
         return;
       }
       const flowArchived = Boolean(payload.flowArchived);
-      const result = writeFlowYaml(root, flowId, flowSource, flowYaml, { archived: flowArchived });
+      const result = writeFlowYaml(root, flowId, flowSource, flowYaml, { archived: flowArchived, ...userCtx });
       if (!result.success) {
         json(res, 400, result);
         return;
@@ -1151,7 +1979,7 @@ finishedAt: "${new Date().toISOString()}"
         return;
       }
       const flowArchived = Boolean(payload.flowArchived);
-      broadcastFlowEditorSync(flowId, flowSource, flowArchived);
+      broadcastFlowEditorSync(flowId, flowSource, flowArchived, userCtx.userId);
       json(res, 200, { ok: true });
       return;
     }
@@ -1168,7 +1996,7 @@ finishedAt: "${new Date().toISOString()}"
         return;
       }
       const flowArchived = url.searchParams.get("archived") === "1";
-      const key = flowEditorSyncKey(flowId, flowSource, flowArchived);
+      const key = flowEditorSyncKey(flowId, flowSource, flowArchived, userCtx.userId);
       let set = flowEditorSyncSubscribers.get(key);
       if (!set) {
         set = new Set();
@@ -1202,7 +2030,7 @@ finishedAt: "${new Date().toISOString()}"
         return;
       }
       const flowArchived = url.searchParams.get("archived") === "1";
-      const key = flowEditorSyncKey(flowId, flowSource, flowArchived);
+      const key = flowEditorSyncKey(flowId, flowSource, flowArchived, userCtx.userId);
       const serverVer = flowEditorSyncVersions.get(key) ?? 0;
       const clientVer = parseInt(url.searchParams.get("v") ?? "0", 10) || 0;
       json(res, 200, { version: serverVer, changed: serverVer > clientVer });
@@ -1232,7 +2060,7 @@ finishedAt: "${new Date().toISOString()}"
         json(res, 400, { error: "Invalid toSource" });
         return;
       }
-      const result = moveFlowDirectory(root, flowId.trim(), fromSource, toSource);
+      const result = moveFlowDirectory(root, flowId.trim(), fromSource, toSource, userCtx);
       if (!result.success) {
         json(res, 400, { error: result.error || "Move failed" });
         return;
@@ -1269,7 +2097,7 @@ finishedAt: "${new Date().toISOString()}"
         json(res, 200, { success: true, flowId, flowSource });
         return;
       }
-      const yamlRes = getFlowYamlAbs(root, flowId, flowSource, { archived: false });
+      const yamlRes = getFlowYamlAbs(root, flowId, flowSource, { archived: false, ...userCtx });
       if (yamlRes.error || !yamlRes.path) {
         json(res, 404, { error: yamlRes.error || "找不到流水线" });
         return;
@@ -1312,7 +2140,7 @@ finishedAt: "${new Date().toISOString()}"
         json(res, 400, { error: "仅支持归档用户目录或工作区流水线" });
         return;
       }
-      const result = archiveFlowPipeline(root, flowId, flowSource);
+      const result = archiveFlowPipeline(root, flowId, flowSource, userCtx);
       if (!result.success) {
         json(res, 400, { error: result.error || "归档失败" });
         return;
@@ -1345,7 +2173,7 @@ finishedAt: "${new Date().toISOString()}"
         json(res, 400, { error: "仅支持删除用户目录或工作区流水线" });
         return;
       }
-      const result = deleteFlowPipeline(root, flowId, flowSource, { archived: flowArchived });
+      const result = deleteFlowPipeline(root, flowId, flowSource, { archived: flowArchived, ...userCtx });
       if (!result.success) {
         json(res, 400, { error: result.error || "删除失败" });
         return;
@@ -1366,7 +2194,7 @@ finishedAt: "${new Date().toISOString()}"
         json(res, 400, { error: "Invalid flowSource" });
         return;
       }
-      const yamlRes = getFlowYamlAbs(root, flowId, flowSource, { archived: flowArchived });
+      const yamlRes = getFlowYamlAbs(root, flowId, flowSource, { archived: flowArchived, ...userCtx });
       if (yamlRes.error) {
         json(res, 404, { error: yamlRes.error });
         return;
@@ -1407,7 +2235,7 @@ finishedAt: "${new Date().toISOString()}"
         json(res, 400, { error: "Cannot save config to builtin or archived flow" });
         return;
       }
-      const yamlRes = getFlowYamlAbs(root, flowId, flowSource, { archived: flowArchived });
+      const yamlRes = getFlowYamlAbs(root, flowId, flowSource, { archived: flowArchived, ...userCtx });
       if (yamlRes.error) {
         json(res, 404, { error: yamlRes.error });
         return;
@@ -1437,12 +2265,12 @@ finishedAt: "${new Date().toISOString()}"
         json(res, 400, { error: "Invalid flowSource" });
         return;
       }
-      const result = readFlowSchedule(root, flowId, flowSource, { archived: flowArchived });
+      const result = readFlowSchedule(root, flowId, flowSource, { archived: flowArchived, ...userCtx });
       if (!result.success) {
         json(res, 400, { error: result.error || "Could not read schedule" });
         return;
       }
-      const status = listScheduleStatuses(root).find(
+      const status = listScheduleStatuses(root, userCtx).find(
         (s) => s.flowId === flowId && (s.flowSource || "user") === (flowSource || "user"),
       );
       json(res, 200, { schedule: result.schedule, state: result.state || {}, status: status || null });
@@ -1468,7 +2296,7 @@ finishedAt: "${new Date().toISOString()}"
         json(res, 400, { error: "Cannot save schedule to builtin or archived flow" });
         return;
       }
-      const result = writeFlowSchedule(root, flowId, flowSource, payload.schedule || {});
+      const result = writeFlowSchedule(root, flowId, flowSource, payload.schedule || {}, userCtx);
       if (!result.success) {
         json(res, 400, { error: result.error || "Could not save schedule" });
         return;
@@ -1491,7 +2319,8 @@ finishedAt: "${new Date().toISOString()}"
         return;
       }
       const runUuid = typeof payload.uuid === "string" ? payload.uuid.trim() : "";
-      if (activeFlowRuns.has(flowId)) {
+      const runKey = `${userCtx.userId || ""}:${payload.flowSource || "user"}:${flowId}`;
+      if (activeFlowRuns.has(runKey)) {
         json(res, 409, { error: "该流水线已在运行中" });
         return;
       }
@@ -1500,7 +2329,7 @@ finishedAt: "${new Date().toISOString()}"
       // UI 轮询会把 runMode 翻回 stopped，即便 CLI 正在运行也显示 PAUSED。
       if (runUuid) {
         try {
-          const runDir = getRunDir(root, flowId, runUuid);
+          const runDir = getRunDir(root, flowId, runUuid, userCtx);
           const interruptedPath = path.join(runDir, RUN_INTERRUPTED_FILENAME);
           if (fs.existsSync(interruptedPath)) fs.unlinkSync(interruptedPath);
         } catch (e) {
@@ -1542,7 +2371,7 @@ finishedAt: "${new Date().toISOString()}"
       const endSafe = () => {
         if (responseEnded) return;
         responseEnded = true;
-        activeFlowRuns.delete(flowId);
+        activeFlowRuns.delete(runKey);
         try {
           res.end();
         } catch (_) {}
@@ -1557,7 +2386,7 @@ finishedAt: "${new Date().toISOString()}"
         child = spawn(process.execPath, args, {
           cwd: root,
           stdio: ["ignore", "pipe", "pipe"],
-          env: { ...process.env, FORCE_COLOR: "0" },
+          env: { ...process.env, FORCE_COLOR: "0", AGENTFLOW_USER_ID: userCtx.userId || "" },
           // detached: true 使 child 成为新进程组 leader，/api/flow/run/stop 时
           // 用 process.kill(-pid) 可以一次性 SIGTERM 整棵进程树（含 cursor-agent 等孙进程）
           detached: true,
@@ -1570,7 +2399,7 @@ finishedAt: "${new Date().toISOString()}"
 
       /** @type {{ child: import("child_process").ChildProcess, runUuid: string | null }} */
       const runEntry = { child, runUuid: runUuid || null };
-      activeFlowRuns.set(flowId, runEntry);
+      activeFlowRuns.set(runKey, runEntry);
       log.debug(`[ui] flow/run: spawned pid=${child.pid} flowId=${flowId}${runUuid ? ` uuid=${runUuid}` : ""}`);
 
       let stdoutBuf = "";
@@ -1643,7 +2472,8 @@ finishedAt: "${new Date().toISOString()}"
         json(res, 400, { error: "Missing flowId" });
         return;
       }
-      const entry = activeFlowRuns.get(flowId);
+      const runKey = `${userCtx.userId || ""}:${payload.flowSource || "user"}:${flowId}`;
+      const entry = activeFlowRuns.get(runKey);
       if (!entry || !entry.child) {
         json(res, 404, { error: "该流水线未在运行" });
         return;
@@ -1661,10 +2491,10 @@ finishedAt: "${new Date().toISOString()}"
         try { entry.child.kill("SIGTERM"); } catch (_) {}
       }
       const uuid = entry.runUuid;
-      activeFlowRuns.delete(flowId);
+      activeFlowRuns.delete(runKey);
       if (uuid) {
         try {
-          const runDir = getRunDir(root, flowId, uuid);
+          const runDir = getRunDir(root, flowId, uuid, userCtx);
           fs.mkdirSync(runDir, { recursive: true });
           fs.writeFileSync(
             path.join(runDir, RUN_INTERRUPTED_FILENAME),
@@ -1684,6 +2514,17 @@ finishedAt: "${new Date().toISOString()}"
       return;
     }
 
+    if (req.method === "GET" && url.pathname === "/api/skills/detail") {
+      const key = url.searchParams.get("key") || url.searchParams.get("name") || "";
+      const detail = readComposerSkillDetail(PACKAGE_ROOT, root, key);
+      if (!detail) {
+        json(res, 404, { error: "Skill not found" });
+        return;
+      }
+      json(res, 200, { skill: detail });
+      return;
+    }
+
     if (req.method === "POST" && url.pathname === "/api/composer-agent") {
       let payload;
       try {
@@ -1739,7 +2580,7 @@ finishedAt: "${new Date().toISOString()}"
           return;
         }
         const flowArchived = Boolean(payload.flowArchived);
-        const yamlRes = getFlowYamlAbs(root, flowId, flowSource, { archived: flowArchived });
+        const yamlRes = getFlowYamlAbs(root, flowId, flowSource, { archived: flowArchived, ...userCtx });
         if (yamlRes.error || !yamlRes.path) {
           json(res, 400, { error: yamlRes.error || "Could not resolve flow.yaml" });
           return;
@@ -1750,7 +2591,7 @@ finishedAt: "${new Date().toISOString()}"
         let editorSyncFlowSource = flowSource;
         let flowDirForCli = path.dirname(flowYamlAbs);
         if (flowSource === "builtin") {
-          const w = resolveFlowDirForWrite(root, flowId, "workspace");
+          const w = resolveFlowDirForWrite(root, flowId, "workspace", userCtx);
           if (w.error || !w.flowDir) {
             json(res, 400, { error: w.error || "Could not resolve workspace flow directory" });
             return;
@@ -1783,6 +2624,7 @@ finishedAt: "${new Date().toISOString()}"
           flowYamlAbs,
           flowId,
           flowSource,
+          userId: userCtx.userId || "",
           intents: multiStepIntents,
           canvasInstanceIds: instanceIds,
           skillsHint: multiStepResources.skillsHint,
@@ -1939,6 +2781,7 @@ finishedAt: "${new Date().toISOString()}"
             thread,
             phaseContext,
             phaseRole: phaseRole || undefined,
+            agentflowUserId: userCtx.userId || "",
             force: true,
             onStreamEvent,
           });
@@ -1952,7 +2795,7 @@ finishedAt: "${new Date().toISOString()}"
                   flowSource: flowSource || null,
                 });
                 if (flowId && flowSource) {
-                  broadcastFlowEditorSync(flowId, flowSource, Boolean(payload.flowArchived));
+                  broadcastFlowEditorSync(flowId, flowSource, Boolean(payload.flowArchived), userCtx.userId);
                 }
                 try { res.write(JSON.stringify({ type: "done" }) + "\n"); } catch (_) {}
               }
@@ -1989,6 +2832,7 @@ finishedAt: "${new Date().toISOString()}"
             cliWorkspace,
             prompt: finalPrompt,
             modelKey: typeof model === "string" ? model.trim() : "",
+            agentflowUserId: userCtx.userId || "",
             onStreamEvent,
           });
           child = handle.child;
@@ -2007,6 +2851,7 @@ finishedAt: "${new Date().toISOString()}"
                     flowYamlAbs,
                     flowContext: flowContextForMultiStep,
                     modelKey: typeof model === "string" ? model.trim() : "",
+                    agentflowUserId: userCtx.userId || "",
                     force: true,
                     onStreamEvent,
                     getAborted: () => clientDisconnected || responseEnded,
@@ -2029,7 +2874,7 @@ finishedAt: "${new Date().toISOString()}"
                   flowSource: flowSource || null,
                 });
                 if (flowYamlChanged && flowId && flowSource) {
-                  broadcastFlowEditorSync(flowId, flowSource, Boolean(payload.flowArchived));
+                  broadcastFlowEditorSync(flowId, flowSource, Boolean(payload.flowArchived), userCtx.userId);
                 }
                 try { res.write(JSON.stringify({ type: "done" }) + "\n"); } catch (_) {}
               }