@fieldwangai/agentflow 0.1.29 → 0.1.31

package/bin/lib/auth.mjs

@@ -0,0 +1,240 @@
+import crypto from "crypto";
+import fs from "fs";
+import path from "path";
+import {
+  ARCHIVED_PIPELINES_DIR_NAME,
+  getAgentflowDataRoot,
+  getUserPipelinesRoot,
+  sanitizeAgentflowUserId,
+} from "./paths.mjs";
+
+const SESSION_COOKIE = "af_session";
+const SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+
+function authRoot() {
+  return path.join(getAgentflowDataRoot(), "auth");
+}
+
+function usersPath() {
+  return path.join(authRoot(), "users.json");
+}
+
+function sessionsPath() {
+  return path.join(authRoot(), "sessions.json");
+}
+
+function readJsonObject(filePath) {
+  try {
+    if (!fs.existsSync(filePath)) return {};
+    const data = JSON.parse(fs.readFileSync(filePath, "utf-8"));
+    return data && typeof data === "object" && !Array.isArray(data) ? data : {};
+  } catch {
+    return {};
+  }
+}
+
+function writeJsonObject(filePath, data) {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, JSON.stringify(data && typeof data === "object" ? data : {}, null, 2) + "\n", "utf-8");
+}
+
+function hashPassword(password, salt = crypto.randomBytes(16).toString("hex")) {
+  const hash = crypto.scryptSync(String(password), salt, 64).toString("hex");
+  return { salt, hash };
+}
+
+function verifyPassword(password, record) {
+  if (!record || typeof record.salt !== "string" || typeof record.hash !== "string") return false;
+  const next = hashPassword(password, record.salt).hash;
+  try {
+    return crypto.timingSafeEqual(Buffer.from(next, "hex"), Buffer.from(record.hash, "hex"));
+  } catch {
+    return false;
+  }
+}
+
+function hashToken(token) {
+  return crypto.createHash("sha256").update(String(token)).digest("hex");
+}
+
+function parseCookies(header) {
+  const out = {};
+  for (const part of String(header || "").split(";")) {
+    const idx = part.indexOf("=");
+    if (idx <= 0) continue;
+    const key = part.slice(0, idx).trim();
+    const value = part.slice(idx + 1).trim();
+    if (!key) continue;
+    try {
+      out[key] = decodeURIComponent(value);
+    } catch {
+      out[key] = value;
+    }
+  }
+  return out;
+}
+
+export function readAuthUsers() {
+  return readJsonObject(usersPath());
+}
+
+export function authSetupRequired() {
+  return Object.keys(readAuthUsers()).length === 0;
+}
+
+function listFlowDirs(root) {
+  try {
+    if (!fs.existsSync(root) || !fs.statSync(root).isDirectory()) return [];
+    return fs.readdirSync(root, { withFileTypes: true })
+      .filter((entry) => entry.isDirectory())
+      .filter((entry) => entry.name !== ARCHIVED_PIPELINES_DIR_NAME)
+      .filter((entry) => fs.existsSync(path.join(root, entry.name, "flow.yaml")))
+      .map((entry) => entry.name)
+      .sort((a, b) => a.localeCompare(b));
+  } catch {
+    return [];
+  }
+}
+
+function copyMissingFlowDirs(sourceRoot, targetRoot, relativeRoot = "") {
+  const fromRoot = path.join(sourceRoot, relativeRoot);
+  const toRoot = path.join(targetRoot, relativeRoot);
+  const copied = [];
+  const skipped = [];
+  for (const name of listFlowDirs(fromRoot)) {
+    const fromDir = path.join(fromRoot, name);
+    const toDir = path.join(toRoot, name);
+    if (fs.existsSync(toDir)) {
+      skipped.push(path.join(relativeRoot, name).replace(/\\/g, "/"));
+      continue;
+    }
+    fs.mkdirSync(path.dirname(toDir), { recursive: true });
+    fs.cpSync(fromDir, toDir, { recursive: true });
+    copied.push(path.join(relativeRoot, name).replace(/\\/g, "/"));
+  }
+  return { copied, skipped };
+}
+
+export function migrateLegacyPipelinesToAdminUser(userId) {
+  const safeUserId = sanitizeAgentflowUserId(userId);
+  if (!safeUserId) return { copied: [], skipped: [], source: "", target: "", error: "invalid userId" };
+
+  const source = getUserPipelinesRoot("");
+  const target = getUserPipelinesRoot(safeUserId);
+  if (path.resolve(source) === path.resolve(target)) {
+    return { copied: [], skipped: [], source, target };
+  }
+  if (!fs.existsSync(source)) {
+    return { copied: [], skipped: [], source, target };
+  }
+
+  const active = copyMissingFlowDirs(source, target);
+  const archived = copyMissingFlowDirs(source, target, ARCHIVED_PIPELINES_DIR_NAME);
+  return {
+    copied: [...active.copied, ...archived.copied],
+    skipped: [...active.skipped, ...archived.skipped],
+    source,
+    target,
+  };
+}
+
+export function getSessionCookieName() {
+  return SESSION_COOKIE;
+}
+
+export function buildSessionCookie(token) {
+  const attrs = [
+    `${SESSION_COOKIE}=${encodeURIComponent(token)}`,
+    "Path=/",
+    "HttpOnly",
+    "SameSite=Lax",
+    `Max-Age=${Math.floor(SESSION_TTL_MS / 1000)}`,
+  ];
+  return attrs.join("; ");
+}
+
+export function buildClearSessionCookie() {
+  return `${SESSION_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
+}
+
+export function getAuthUserFromRequest(req) {
+  const token = parseCookies(req.headers.cookie || "")[SESSION_COOKIE];
+  if (!token) return null;
+  const sessions = readJsonObject(sessionsPath());
+  const key = hashToken(token);
+  const session = sessions[key];
+  if (!session || typeof session.userId !== "string") return null;
+  if (Number(session.expiresAt) <= Date.now()) {
+    delete sessions[key];
+    writeJsonObject(sessionsPath(), sessions);
+    return null;
+  }
+  const users = readAuthUsers();
+  const user = users[session.userId];
+  if (!user) return null;
+  return {
+    userId: session.userId,
+    username: user.username || session.userId,
+    isAdmin: Boolean(user.isAdmin),
+  };
+}
+
+export function loginOrCreateUser(username, password) {
+  const userId = sanitizeAgentflowUserId(username);
+  if (!userId) {
+    return { ok: false, error: "用户名须以字母开头，仅可使用字母、数字、下划线与连字符，最多 64 字符" };
+  }
+  const pwd = String(password || "");
+  if (pwd.length < 4) return { ok: false, error: "密码至少 4 位" };
+
+  const users = readAuthUsers();
+  const firstUser = Object.keys(users).length === 0;
+  let user = users[userId];
+  if (!user) {
+    const hashed = hashPassword(pwd);
+    user = {
+      userId,
+      username: String(username).trim(),
+      salt: hashed.salt,
+      hash: hashed.hash,
+      isAdmin: firstUser,
+      createdAt: new Date().toISOString(),
+    };
+    users[userId] = user;
+    writeJsonObject(usersPath(), users);
+  } else if (!verifyPassword(pwd, user)) {
+    return { ok: false, error: "用户名或密码错误" };
+  }
+
+  let migration = null;
+  if (Boolean(user.isAdmin)) {
+    try {
+      migration = migrateLegacyPipelinesToAdminUser(userId);
+    } catch (e) {
+      migration = { copied: [], skipped: [], error: (e && e.message) || String(e) };
+    }
+  }
+
+  const token = crypto.randomBytes(32).toString("base64url");
+  const sessions = readJsonObject(sessionsPath());
+  sessions[hashToken(token)] = {
+    userId,
+    createdAt: Date.now(),
+    expiresAt: Date.now() + SESSION_TTL_MS,
+  };
+  writeJsonObject(sessionsPath(), sessions);
+  return {
+    ok: true,
+    token,
+    user: { userId, username: user.username || userId, isAdmin: Boolean(user.isAdmin) },
+    migration,
+  };
+}
+
+export function logoutRequest(req) {
+  const token = parseCookies(req.headers.cookie || "")[SESSION_COOKIE];
+  if (!token) return;
+  const sessions = readJsonObject(sessionsPath());
+  delete sessions[hashToken(token)];
+  writeJsonObject(sessionsPath(), sessions);
+}

package/bin/lib/catalog-agents.mjs

@@ -278,10 +278,10 @@ description: ${description != null ? String(description).replace(/\n/g, " ") : "
   }
 }
 
-export function copyBuiltinJson(workspaceRoot, flowId, targetFlowId) {
+export function copyBuiltinJson(workspaceRoot, flowId, targetFlowId, opts = {}) {
   const destId = (targetFlowId && targetFlowId.trim()) || flowId;
   const srcDir = path.join(PACKAGE_BUILTIN_PIPELINES_DIR, flowId);
-  const pipelinesRoot = getUserPipelinesRoot();
+  const pipelinesRoot = getUserPipelinesRoot(opts.userId);
   const destDir = path.join(pipelinesRoot, destId);
   if (!fs.existsSync(srcDir) || !fs.existsSync(path.join(srcDir, "flow.yaml"))) {
     return { success: false, error: t("catalog.builtin_flow_not_found") };

package/bin/lib/catalog-flows.mjs

@@ -50,7 +50,7 @@ export function readPipelineListDescription(flowDir) {
   }
 }
 
-export function listFlowsJson(workspaceRoot) {
+export function listFlowsJson(workspaceRoot, opts = {}) {
   const root = path.resolve(workspaceRoot);
   const out = [];
   const fromBuiltin = collectPipelineNamesFromDir(PACKAGE_BUILTIN_PIPELINES_DIR);
@@ -59,7 +59,7 @@ export function listFlowsJson(workspaceRoot) {
     const description = readPipelineListDescription(dir);
     out.push({ id: name, path: dir, source: "builtin", ...(description ? { description } : {}) });
   }
-  const userPipelinesRoot = getUserPipelinesRoot();
+  const userPipelinesRoot = getUserPipelinesRoot(opts.userId);
   const fromUserData = collectPipelineNamesFromDir(userPipelinesRoot);
   for (const name of fromUserData) {
     if (name === ARCHIVED_PIPELINES_DIR_NAME) continue;
@@ -129,7 +129,10 @@ function normalizeFrontmatterSlots(arr) {
     let def = item.default !== undefined && item.default !== null ? item.default : item.value;
     if (def === undefined || def === null) def = "";
     else if (typeof def !== "string") def = String(def);
-    return { type, name, default: def };
+    const slot = { type, name, default: def };
+    if (item.required != null) slot.required = Boolean(item.required);
+    if (item.showOnNode != null) slot.showOnNode = Boolean(item.showOnNode);
+    return slot;
   });
 }
 
@@ -200,6 +203,7 @@ export function parseNodeFrontmatter(raw) {
 export function listNodesJson(workspaceRoot, flowId, flowSource, opts = {}) {
   const root = path.resolve(workspaceRoot);
   const archived = Boolean(opts.archived);
+  const userPipelinesRoot = getUserPipelinesRoot(opts.userId);
   const byId = new Map();
   const pipelineTranslations = {};
   let marketplaceFlowData = null;
@@ -293,13 +297,9 @@ export function listNodesJson(workspaceRoot, flowId, flowSource, opts = {}) {
       } catch (_) {}
     } else if (flowSource === "user") {
       if (archived) {
-        addFromDir(
-          path.join(getUserPipelinesRoot(), ARCHIVED_PIPELINES_DIR_NAME, flowId, "nodes"),
-          "flow",
-          flowId,
-        );
+        addFromDir(path.join(userPipelinesRoot, ARCHIVED_PIPELINES_DIR_NAME, flowId, "nodes"), "flow", flowId);
       } else {
-        addFromDir(path.join(getUserPipelinesRoot(), flowId, "nodes"), "flow", flowId);
+        addFromDir(path.join(userPipelinesRoot, flowId, "nodes"), "flow", flowId);
         addFromDir(path.join(root, PIPELINES_DIR, flowId, "nodes"), "flow", flowId);
         addFromDir(path.join(root, LEGACY_PIPELINES_DIR, flowId, "nodes"), "flow", flowId);
       }
@@ -342,13 +342,14 @@ export function printNodesTable(list) {
 export function readFlowJson(workspaceRoot, flowId, flowSource, options = {}) {
   const root = path.resolve(workspaceRoot);
   const archived = Boolean(options.archived);
+  const userPipelinesRoot = getUserPipelinesRoot(options.userId);
   let flowDir;
   if (archived) {
     if (flowSource === "builtin") {
       return { error: t("catalog.builtin_flow_archive_not_supported") };
     }
     if (flowSource === "user") {
-      flowDir = path.join(getUserPipelinesRoot(), ARCHIVED_PIPELINES_DIR_NAME, flowId);
+      flowDir = path.join(userPipelinesRoot, ARCHIVED_PIPELINES_DIR_NAME, flowId);
     } else if (flowSource === "workspace") {
       flowDir = path.join(root, PIPELINES_DIR, ARCHIVED_PIPELINES_DIR_NAME, flowId);
     } else {
@@ -377,7 +378,7 @@ export function readFlowJson(workspaceRoot, flowId, flowSource, options = {}) {
   if (flowSource === "builtin") {
     flowDir = path.join(PACKAGE_BUILTIN_PIPELINES_DIR, flowId);
   } else if (flowSource === "user") {
-    flowDir = path.join(getUserPipelinesRoot(), flowId);
+    flowDir = path.join(userPipelinesRoot, flowId);
   } else if (flowSource === "workspace") {
     flowDir = path.join(root, PIPELINES_DIR, flowId);
   } else {
@@ -422,13 +423,14 @@ export function readFlowJson(workspaceRoot, flowId, flowSource, options = {}) {
 export function getFlowYamlAbs(workspaceRoot, flowId, flowSource, options = {}) {
   const root = path.resolve(workspaceRoot);
   const archived = Boolean(options.archived);
+  const userPipelinesRoot = getUserPipelinesRoot(options.userId);
   let yamlPath;
   if (archived) {
     if (flowSource === "builtin") {
       return { error: t("catalog.builtin_flow_archive_path_not_supported") };
     }
     if (flowSource === "user") {
-      yamlPath = path.join(getUserPipelinesRoot(), ARCHIVED_PIPELINES_DIR_NAME, flowId, "flow.yaml");
+      yamlPath = path.join(userPipelinesRoot, ARCHIVED_PIPELINES_DIR_NAME, flowId, "flow.yaml");
     } else if (flowSource === "workspace") {
       yamlPath = path.join(root, PIPELINES_DIR, ARCHIVED_PIPELINES_DIR_NAME, flowId, "flow.yaml");
       if (!fs.existsSync(yamlPath)) {
@@ -447,7 +449,7 @@ export function getFlowYamlAbs(workspaceRoot, flowId, flowSource, options = {})
   if (flowSource === "builtin") {
     yamlPath = path.join(PACKAGE_BUILTIN_PIPELINES_DIR, flowId, "flow.yaml");
   } else if (flowSource === "user") {
-    yamlPath = path.join(getUserPipelinesRoot(), flowId, "flow.yaml");
+    yamlPath = path.join(userPipelinesRoot, flowId, "flow.yaml");
     if (!fs.existsSync(yamlPath)) {
       const alt = path.join(root, PIPELINES_DIR, flowId, "flow.yaml");
       if (fs.existsSync(alt)) yamlPath = alt;
@@ -474,6 +476,7 @@ export function getFlowYamlAbs(workspaceRoot, flowId, flowSource, options = {})
 export function readNodeJson(workspaceRoot, nodeId, flowId, flowSource, opts = {}) {
   const root = path.resolve(workspaceRoot);
   const archived = Boolean(opts.archived);
+  const userPipelinesRoot = getUserPipelinesRoot(opts.userId);
   const marketSpec = parseMarketplaceDefinitionId(nodeId);
   if (marketSpec) {
     let flowDir = root;
@@ -515,11 +518,9 @@ export function readNodeJson(workspaceRoot, nodeId, flowId, flowSource, opts = {
       pathsToTry.push(path.join(PACKAGE_BUILTIN_PIPELINES_DIR, flowId, "nodes", fileName));
     } else if (flowSource === "user") {
       if (archived) {
-        pathsToTry.push(
-          path.join(getUserPipelinesRoot(), ARCHIVED_PIPELINES_DIR_NAME, flowId, "nodes", fileName),
-        );
+        pathsToTry.push(path.join(userPipelinesRoot, ARCHIVED_PIPELINES_DIR_NAME, flowId, "nodes", fileName));
       } else {
-        pathsToTry.push(path.join(getUserPipelinesRoot(), flowId, "nodes", fileName));
+        pathsToTry.push(path.join(userPipelinesRoot, flowId, "nodes", fileName));
         pathsToTry.push(path.join(root, PIPELINES_DIR, flowId, "nodes", fileName));
         pathsToTry.push(path.join(root, LEGACY_PIPELINES_DIR, flowId, "nodes", fileName));
       }
@@ -568,6 +569,184 @@ export function readNodeJson(workspaceRoot, nodeId, flowId, flowSource, opts = {
   return { error: "Node not found: " + nodeId };
 }
 
+const NODE_DETAIL_MAX_FILES = 300;
+const NODE_FILE_MAX_BYTES = 256 * 1024;
+
+function isTextPreviewPath(filePath) {
+  const ext = path.extname(filePath).toLowerCase();
+  return [
+    ".md", ".mdx", ".txt", ".json", ".yaml", ".yml", ".js", ".mjs", ".cjs", ".ts", ".tsx", ".jsx",
+    ".py", ".sh", ".css", ".html", ".xml", ".toml", ".ini", ".env", ".sql",
+  ].includes(ext);
+}
+
+function listNodeFiles(baseDir, allowAllFiles, primaryFilePath = "") {
+  const root = path.resolve(baseDir);
+  const out = [];
+  const addFile = (filePath) => {
+    if (out.length >= NODE_DETAIL_MAX_FILES) return;
+    try {
+      const stat = fs.statSync(filePath);
+      if (!stat.isFile()) return;
+      const rel = path.relative(root, filePath).replace(/\\/g, "/");
+      out.push({
+        path: rel,
+        size: stat.size,
+        previewable: isTextPreviewPath(filePath),
+      });
+    } catch (_) {}
+  };
+  if (!allowAllFiles) {
+    if (primaryFilePath) addFile(primaryFilePath);
+    return out;
+  }
+  const walk = (dir) => {
+    if (out.length >= NODE_DETAIL_MAX_FILES) return;
+    let entries = [];
+    try {
+      entries = fs.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    entries.sort((a, b) => a.name.localeCompare(b.name));
+    for (const entry of entries) {
+      if (out.length >= NODE_DETAIL_MAX_FILES) return;
+      if (entry.name === "node_modules" || entry.name === ".git") continue;
+      const p = path.join(dir, entry.name);
+      if (entry.isDirectory()) walk(p);
+      else if (entry.isFile()) addFile(p);
+    }
+  };
+  walk(root);
+  return out;
+}
+
+function resolveMarkdownNodeFile(workspaceRoot, nodeId, flowId, flowSource, opts = {}) {
+  const root = path.resolve(workspaceRoot);
+  const archived = Boolean(opts.archived);
+  const userPipelinesRoot = getUserPipelinesRoot(opts.userId);
+  const fileName = nodeId.endsWith(".md") ? nodeId : `${nodeId}.md`;
+  const pathsToTry = [];
+  if (flowId && flowSource) {
+    if (flowSource === "builtin") {
+      pathsToTry.push(path.join(PACKAGE_BUILTIN_PIPELINES_DIR, flowId, "nodes", fileName));
+    } else if (flowSource === "user") {
+      if (archived) {
+        pathsToTry.push(path.join(userPipelinesRoot, ARCHIVED_PIPELINES_DIR_NAME, flowId, "nodes", fileName));
+      } else {
+        pathsToTry.push(path.join(userPipelinesRoot, flowId, "nodes", fileName));
+        pathsToTry.push(path.join(root, PIPELINES_DIR, flowId, "nodes", fileName));
+        pathsToTry.push(path.join(root, LEGACY_PIPELINES_DIR, flowId, "nodes", fileName));
+      }
+    } else if (flowSource === "workspace") {
+      if (archived) {
+        pathsToTry.push(path.join(root, PIPELINES_DIR, ARCHIVED_PIPELINES_DIR_NAME, flowId, "nodes", fileName));
+        pathsToTry.push(path.join(root, LEGACY_PIPELINES_DIR, ARCHIVED_PIPELINES_DIR_NAME, flowId, "nodes", fileName));
+      } else {
+        pathsToTry.push(path.join(root, PIPELINES_DIR, flowId, "nodes", fileName));
+        pathsToTry.push(path.join(root, LEGACY_PIPELINES_DIR, flowId, "nodes", fileName));
+      }
+    }
+  }
+  pathsToTry.push(path.join(root, PROJECT_NODES_DIR, fileName));
+  pathsToTry.push(path.join(root, LEGACY_NODES_DIR, fileName));
+  pathsToTry.push(path.join(PACKAGE_BUILTIN_NODES_DIR, fileName));
+  return pathsToTry.find((p) => fs.existsSync(p) && fs.statSync(p).isFile()) || "";
+}
+
+function readNodeUsage(workspaceRoot, nodeId, opts = {}) {
+  const usage = [];
+  for (const flow of listFlowsJson(workspaceRoot, opts)) {
+    const flowPath = getFlowYamlAbs(workspaceRoot, flow.id, flow.source || "user", { archived: Boolean(flow.archived), userId: opts.userId });
+    if (!flowPath.path) continue;
+    try {
+      const data = yaml.load(fs.readFileSync(flowPath.path, "utf-8"));
+      const instances = data && typeof data === "object" ? data.instances : null;
+      if (!instances || typeof instances !== "object") continue;
+      const hits = Object.entries(instances)
+        .filter(([, inst]) => inst && inst.definitionId === nodeId)
+        .map(([instanceId, inst]) => ({ instanceId, label: inst.label || instanceId }));
+      if (hits.length > 0) {
+        usage.push({ flowId: flow.id, flowSource: flow.source || "user", archived: Boolean(flow.archived), instances: hits });
+      }
+    } catch (_) {}
+  }
+  return usage;
+}
+
+function resolveNodeFileScope(workspaceRoot, nodeId, flowId, flowSource, opts = {}) {
+  const marketSpec = parseMarketplaceDefinitionId(nodeId);
+  if (marketSpec) {
+    let flowDir = path.resolve(workspaceRoot);
+    let flowData = null;
+    if (flowId && flowSource) {
+      const flowPath = getFlowYamlAbs(workspaceRoot, flowId, flowSource, opts);
+      if (flowPath.path) {
+        flowDir = path.dirname(flowPath.path);
+        try {
+          const parsed = yaml.load(fs.readFileSync(flowPath.path, "utf-8"));
+          if (parsed && typeof parsed === "object") flowData = parsed;
+        } catch (_) {}
+      }
+    }
+    const resolved = resolveMarketplaceNodePackage(workspaceRoot, flowDir, nodeId, flowData);
+    if (!resolved) return null;
+    return { baseDir: resolved.packageDir, allowAllFiles: true, primaryFilePath: path.join(resolved.packageDir, "node.yaml"), manifest: resolved };
+  }
+  const filePath = resolveMarkdownNodeFile(workspaceRoot, nodeId, flowId, flowSource, opts);
+  if (!filePath) return null;
+  return { baseDir: path.dirname(filePath), allowAllFiles: false, primaryFilePath: filePath, manifest: null };
+}
+
+export function readNodeDetailJson(workspaceRoot, nodeId, flowId = "", flowSource = "", opts = {}) {
+  if (!nodeId) return { error: "Missing node id" };
+  const node = readNodeJson(workspaceRoot, nodeId, flowId, flowSource, opts);
+  if (node.error) return node;
+  const scope = resolveNodeFileScope(workspaceRoot, nodeId, flowId, flowSource, opts);
+  const files = scope ? listNodeFiles(scope.baseDir, scope.allowAllFiles, scope.primaryFilePath) : [];
+  return {
+    node: { id: nodeId, ...node },
+    readOnly: true,
+    manifest: scope?.manifest || null,
+    runtime: node.runtime || scope?.manifest?.runtime || null,
+    body: node.executionLogic || "",
+    baseDir: scope?.baseDir || "",
+    files,
+    usage: readNodeUsage(workspaceRoot, nodeId, opts),
+  };
+}
+
+export function readNodeFilePreview(workspaceRoot, nodeId, relPath, flowId = "", flowSource = "", opts = {}) {
+  if (!nodeId) return { error: "Missing node id" };
+  const rel = String(relPath || "").trim();
+  if (!rel || rel.includes("\0") || path.isAbsolute(rel) || rel.split(/[\\/]+/).includes("..")) {
+    return { error: "Invalid file path" };
+  }
+  const scope = resolveNodeFileScope(workspaceRoot, nodeId, flowId, flowSource, opts);
+  if (!scope) return { error: "Node files not found" };
+  if (!scope.allowAllFiles) {
+    const primaryRel = path.relative(scope.baseDir, scope.primaryFilePath).replace(/\\/g, "/");
+    if (rel !== primaryRel) return { error: "File is outside node preview scope" };
+  }
+  const base = path.resolve(scope.baseDir);
+  const abs = path.resolve(base, rel);
+  if (abs !== base && !abs.startsWith(base + path.sep)) return { error: "File is outside node package" };
+  if (!fs.existsSync(abs) || !fs.statSync(abs).isFile()) return { error: "File not found" };
+  const stat = fs.statSync(abs);
+  if (!isTextPreviewPath(abs)) {
+    return { path: rel, size: stat.size, binary: true, content: "", truncated: false };
+  }
+  const fd = fs.openSync(abs, "r");
+  try {
+    const len = Math.min(stat.size, NODE_FILE_MAX_BYTES);
+    const buf = Buffer.alloc(len);
+    fs.readSync(fd, buf, 0, len, 0);
+    return { path: rel, size: stat.size, binary: false, content: buf.toString("utf-8"), truncated: stat.size > len };
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+
 /** 列出所有 pipeline（包内 builtin + ~/agentflow/pipelines + 项目内 .workspace/.cursor agentflow/pipelines）；nodes 见 PROJECT_NODES_DIR / LEGACY_NODES_DIR */
 export function listPipelines(workspaceRoot) {
   const rows = listFlowsJson(workspaceRoot);

package/bin/lib/composer-agent.mjs

@@ -6,7 +6,8 @@
  */
 import fs from "fs";
 import path from "path";
-import { getAgentflowDataRoot } from "./paths.mjs";
+import { getAgentflowDataRoot, sanitizeAgentflowUserId } from "./paths.mjs";
+import { readUserEnvObject } from "./user-env.mjs";
 import { resolveCliAndModel } from "./model-config.mjs";
 import { runClaudeCodeAgentWithPrompt, runCursorAgentWithPrompt, runOpenCodeAgentWithPrompt } from "./agent-runners.mjs";
 import { planComposerTasks, hasPlannerApiAvailable, shouldUsePhased, classifyComplexity, classifyTaskComplexity, PHASED_DEFINITIONS } from "./composer-planner.mjs";
@@ -23,6 +24,11 @@ const MAX_PROMPT_CHARS = 500_000;
 const MAX_COMPOSER_VALIDATION_REPAIR = 5;
 const MAX_SCRIPT_INJECT_BYTES = 30_000;
 
+function agentflowUserEnv(userId) {
+  const safe = sanitizeAgentflowUserId(userId);
+  return safe ? { ...readUserEnvObject(safe), AGENTFLOW_USER_ID: safe } : {};
+}
+
 // ─── script 内容注入辅助 ─────────────────────────────────────────────────
 
 /**
@@ -113,10 +119,12 @@ export function startComposerAgent(opts) {
   const cliWs = opts.cliWorkspace ? String(opts.cliWorkspace) : getAgentflowDataRoot();
   const modelKey = opts.modelKey != null ? String(opts.modelKey).trim() : "";
   const { cli, model } = resolveCliAndModel(uiRoot, modelKey || null, null);
+  const env = agentflowUserEnv(opts.agentflowUserId);
 
   const common = {
     onStreamEvent: opts.onStreamEvent,
     force: Boolean(opts.force),
+    env,
   };
 
   if (cli === "opencode") {
@@ -185,6 +193,10 @@ function buildAgentStepPrompt(step, flowContext) {
       parts.push(`- flowId：${flowContext.flowId}`);
       parts.push(`- flowSource：${flowContext.flowSource || "user"}`);
     }
+    if (flowContext.userId) {
+      parts.push(`- agentflow 用户：${flowContext.userId}`);
+      parts.push(`- 执行 agentflow 命令时保留当前环境中的 AGENTFLOW_USER_ID，必要时显式前置 AGENTFLOW_USER_ID='${flowContext.userId}'。`);
+    }
     if (flowContext.skillsHint) {
       parts.push(flowContext.skillsHint);
     }
@@ -344,6 +356,7 @@ export async function runComposerPostFlowValidationAndRepair(opts) {
   const flowYamlAbs = String(opts.flowYamlAbs || "").trim();
   const cliWs = opts.cliWorkspace ? String(opts.cliWorkspace) : getAgentflowDataRoot();
   const maxRepair = Math.max(1, Math.min(10, Number(opts.maxRepairAttempts) || MAX_COMPOSER_VALIDATION_REPAIR));
+  const env = agentflowUserEnv(opts.agentflowUserId || opts.flowContext?.userId);
 
   if (!uiRoot || !flowYamlAbs) {
     return { ok: true, result: { skipped: true } };
@@ -405,6 +418,7 @@ export async function runComposerPostFlowValidationAndRepair(opts) {
           onStreamEvent: stepEmit,
           model: model || undefined,
           force: Boolean(opts.force),
+          env,
         });
         setChild(handle.child);
         await handle.finished;
@@ -413,6 +427,7 @@ export async function runComposerPostFlowValidationAndRepair(opts) {
           onStreamEvent: stepEmit,
           model: model || undefined,
           force: Boolean(opts.force),
+          env,
         });
         setChild(handle.child);
         await handle.finished;
@@ -421,6 +436,7 @@ export async function runComposerPostFlowValidationAndRepair(opts) {
           onStreamEvent: stepEmit,
           model: model || undefined,
           force: Boolean(opts.force),
+          env,
         });
         setChild(handle.child);
         await handle.finished;
@@ -490,6 +506,7 @@ export function startComposerMultiStep(opts) {
   const emit = typeof opts.onStreamEvent === "function" ? opts.onStreamEvent : () => {};
   let aborted = false;
   let currentChild = null;
+  const env = agentflowUserEnv(opts.agentflowUserId || opts.flowContext?.userId);
 
   const abort = () => {
     aborted = true;
@@ -674,6 +691,7 @@ export function startComposerMultiStep(opts) {
                 onStreamEvent: stepEmit,
                 model: model || undefined,
                 force: Boolean(opts.force),
+                env,
               });
               currentChild = handle.child;
               await handle.finished;
@@ -682,6 +700,7 @@ export function startComposerMultiStep(opts) {
                 onStreamEvent: stepEmit,
                 model: model || undefined,
                 force: Boolean(opts.force),
+                env,
               });
               currentChild = handle.child;
               await handle.finished;
@@ -690,6 +709,7 @@ export function startComposerMultiStep(opts) {
                 onStreamEvent: stepEmit,
                 model: model || undefined,
                 force: Boolean(opts.force),
+                env,
               });
               currentChild = handle.child;
               await handle.finished;
@@ -757,6 +777,7 @@ export function startComposerMultiStep(opts) {
           flowContext: opts.flowContext,
           modelKey: opts.modelKey,
           force: Boolean(opts.force),
+          agentflowUserId: opts.agentflowUserId || opts.flowContext?.userId,
           onStreamEvent: emit,
           getAborted: () => aborted,
           setCurrentChild: (c) => {