@fieldwangai/agentflow 0.1.29 → 0.1.31

package/bin/lib/ui-server.mjs

@@ -7,11 +7,19 @@
  */
 import fs from "fs";
 import http from "http";
+import os from "os";
 import path from "path";
-import { spawn } from "child_process";
+import { execFile, spawn } from "child_process";
 import busboy from "busboy";
 import { log } from "./log.mjs";
-import { getFlowYamlAbs, listFlowsJson, listNodesJson, readFlowJson } from "./catalog-flows.mjs";
+import {
+  getFlowYamlAbs,
+  listFlowsJson,
+  listNodesJson,
+  readFlowJson,
+  readNodeDetailJson,
+  readNodeFilePreview,
+} from "./catalog-flows.mjs";
 import {
   FLOW_YAML_FILENAME,
   archiveFlowPipeline,
@@ -33,6 +41,7 @@ import { t } from "./i18n.mjs";
 import {
   PACKAGE_ROOT,
   getAgentflowUserConfigAbs,
+  getAgentflowUserDataRoot,
   getModelListsAbs,
   getRunDir,
 } from "./paths.mjs";
@@ -42,6 +51,7 @@ import {
   loadResourcesForIntents,
   loadResourcesForSkillKeys,
   listComposerSkills,
+  readComposerSkillDetail,
   buildSkillInjectionBlock,
   buildSkillCompactInjectionBlock,
 } from "./composer-skill-router.mjs";
@@ -65,6 +75,15 @@ import { runNodeScript } from "./pipeline-scripts.mjs";
 import { readFlowSchedule, writeFlowSchedule } from "./schedule-config.mjs";
 import { listScheduleStatuses } from "./scheduler.mjs";
 import { installFlowDependency, listMarketplacePackages, publishNodeFromInstance } from "./marketplace.mjs";
+import {
+  authSetupRequired,
+  buildClearSessionCookie,
+  buildSessionCookie,
+  getAuthUserFromRequest,
+  loginOrCreateUser,
+  logoutRequest,
+} from "./auth.mjs";
+import { readUserEnvObject, readUserEnvRows, writeUserEnvRows } from "./user-env.mjs";
 
 const MIME = {
   ".html": "text/html; charset=utf-8",
@@ -76,6 +95,49 @@ const MIME = {
 };
 
 const RUN_CONFIG_FILENAME = "run-config.json";
+const SKILL_COLLECTIONS_FILENAME = "skill-collections.json";
+const BUILTIN_SKILL_COLLECTIONS = [
+  {
+    id: "pipeline",
+    name: "Pipeline",
+    defaultKeys: [
+      "agentflow-flow-add-instances",
+      "agentflow-flow-edit-node-fields",
+      "agentflow-flow-recipes",
+      "agentflow-flow-sync-ui",
+      "agentflow-node-reference",
+      "agentflow-placeholder-reference",
+      "agentflow-runtime-reference",
+    ],
+  },
+  {
+    id: "workspace",
+    name: "Workspace",
+    defaultKeys: [
+      "agentflow-workspace-graph",
+      "agentflow-workspace-markdown",
+      "agentflow-workspace-mermaid",
+      "agentflow-workspace-ascii",
+      "agentflow-node-reference",
+      "agentflow-placeholder-reference",
+      "agentflow-runtime-reference",
+    ],
+    legacyDefaultKeys: [
+      [
+        "agentflow-flow-add-instances",
+        "agentflow-flow-edit-node-fields",
+        "agentflow-node-reference",
+        "agentflow-placeholder-reference",
+        "agentflow-runtime-reference",
+      ],
+      [
+        "agentflow-node-reference",
+        "agentflow-placeholder-reference",
+        "agentflow-runtime-reference",
+      ],
+    ],
+  },
+];
 
 function json(res, status, obj) {
   const body = JSON.stringify(obj);
@@ -86,6 +148,155 @@ function json(res, status, obj) {
   res.end(body);
 }
 
+function skillCollectionsAbs(userCtx = {}) {
+  return path.join(getAgentflowUserDataRoot(userCtx.userId), SKILL_COLLECTIONS_FILENAME);
+}
+
+function slugifySkillCollectionId(name, fallback = "collection") {
+  const raw = String(name || "").trim().toLowerCase();
+  const id = raw
+    .replace(/[^a-z0-9_-]+/g, "-")
+    .replace(/^-+|-+$/g, "")
+    .slice(0, 48);
+  return id || fallback;
+}
+
+function isBuiltinSkillCollectionId(id) {
+  return BUILTIN_SKILL_COLLECTIONS.some((collection) => collection.id === id);
+}
+
+function resolveSkillKeys(skillNamesOrKeys = [], availableSkills = []) {
+  const byToken = buildSkillKeyLookup(availableSkills);
+  return skillNamesOrKeys.map((key) => byToken.get(key)).filter(Boolean);
+}
+
+function buildSkillKeyLookup(availableSkills = []) {
+  const byToken = new Map();
+  for (const skill of availableSkills) {
+    const key = String(skill?.key || "").trim();
+    if (!key) continue;
+    for (const token of [skill.key, skill.name, skill.id]) {
+      const normalized = String(token || "").trim();
+      if (normalized && !byToken.has(normalized)) byToken.set(normalized, key);
+    }
+  }
+  return byToken;
+}
+
+function defaultSkillKeysForCollection(def, availableSkills = []) {
+  const exact = resolveSkillKeys(def.defaultKeys, availableSkills);
+  if (exact.length > 0) return exact;
+  return availableSkills
+    .filter((skill) => String(skill?.name || skill?.id || skill?.key || "").includes("agentflow-"))
+    .map((skill) => String(skill.key || "").trim())
+    .filter(Boolean);
+}
+
+function sameSkillKeySet(a = [], b = []) {
+  if (a.length !== b.length) return false;
+  const set = new Set(a);
+  return b.every((key) => set.has(key));
+}
+
+function normalizeSkillCollectionConfig(value) {
+  const now = Date.now();
+  const seenIds = new Set();
+  const collections = [];
+  const input = Array.isArray(value?.collections) ? value.collections : [];
+  for (const item of input) {
+    if (!item || typeof item !== "object") continue;
+    const name = String(item.name || item.id || "").trim().slice(0, 80);
+    if (!name) continue;
+    let id = slugifySkillCollectionId(item.id || name);
+    let suffix = 2;
+    while (seenIds.has(id)) {
+      id = `${slugifySkillCollectionId(item.id || name)}-${suffix++}`;
+    }
+    seenIds.add(id);
+    const skillSeen = new Set();
+    const skillKeys = [];
+    for (const key of Array.isArray(item.skillKeys) ? item.skillKeys : []) {
+      const normalized = String(key || "").trim();
+      if (!normalized || skillSeen.has(normalized)) continue;
+      skillSeen.add(normalized);
+      skillKeys.push(normalized);
+    }
+    collections.push({
+      id,
+      name,
+      skillKeys,
+      builtin: Boolean(item.builtin) || isBuiltinSkillCollectionId(id),
+      createdAt: Number.isFinite(item.createdAt) ? Number(item.createdAt) : now,
+      updatedAt: Number.isFinite(item.updatedAt) ? Number(item.updatedAt) : now,
+    });
+  }
+  return { version: 1, collections };
+}
+
+function withBuiltinSkillCollections(config, availableSkills = []) {
+  const normalized = normalizeSkillCollectionConfig(config);
+  const byId = new Map(normalized.collections.map((collection) => [collection.id, collection]));
+  const out = [];
+  const now = Date.now();
+  for (const def of BUILTIN_SKILL_COLLECTIONS) {
+    const existing = byId.get(def.id);
+    if (existing) {
+      const nextDefaultKeys = defaultSkillKeysForCollection(def, availableSkills);
+      const legacyDefaultSets = (Array.isArray(def.legacyDefaultKeys) ? def.legacyDefaultKeys : [])
+        .map((keys) => Array.isArray(keys) ? resolveSkillKeys(keys, availableSkills) : [])
+        .filter((keys) => keys.length > 0);
+      const shouldMigrateLegacyDefault =
+        existing.skillKeys.length > 0 &&
+        legacyDefaultSets.some((keys) => sameSkillKeySet(existing.skillKeys, keys));
+      out.push({
+        ...existing,
+        name: def.name,
+        builtin: true,
+        skillKeys: existing.skillKeys.length > 0 && !shouldMigrateLegacyDefault ? existing.skillKeys : nextDefaultKeys,
+      });
+      byId.delete(def.id);
+    } else {
+      out.push({
+        id: def.id,
+        name: def.name,
+        builtin: true,
+        skillKeys: defaultSkillKeysForCollection(def, availableSkills),
+        createdAt: now,
+        updatedAt: now,
+      });
+    }
+  }
+  out.push(...Array.from(byId.values()).map((collection) => ({ ...collection, builtin: false })));
+  return { version: 1, collections: out };
+}
+
+function readSkillCollectionConfig(userCtx = {}, availableSkills = []) {
+  const p = skillCollectionsAbs(userCtx);
+  try {
+    if (!fs.existsSync(p)) return withBuiltinSkillCollections({}, availableSkills);
+    return withBuiltinSkillCollections(JSON.parse(fs.readFileSync(p, "utf-8")), availableSkills);
+  } catch {
+    return withBuiltinSkillCollections({}, availableSkills);
+  }
+}
+
+function writeSkillCollectionConfig(userCtx = {}, payload = {}, availableSkills = []) {
+  const p = skillCollectionsAbs(userCtx);
+  const config = withBuiltinSkillCollections(payload, availableSkills);
+  fs.mkdirSync(path.dirname(p), { recursive: true });
+  fs.writeFileSync(p, JSON.stringify(config, null, 2) + "\n", "utf-8");
+  return config;
+}
+
+function runtimeEnvForUser(userCtx = {}, extra = {}) {
+  return {
+    ...process.env,
+    ...readUserEnvObject(userCtx.userId),
+    ...extra,
+    AGENTFLOW_USER_ID: userCtx.userId || "",
+  };
+}
+
 function readAgentflowUserConfigObject() {
   const p = getAgentflowUserConfigAbs();
   try {
@@ -123,6 +334,99 @@ function readModelListsFromDisk(workspaceRoot) {
   }
 }
 
+const SKILLHUB_TIMEOUT_MS = 60_000;
+
+function runSkillhub(args, opts = {}) {
+  return new Promise((resolve) => {
+    execFile("skillhub", args, {
+      cwd: opts.cwd || process.cwd(),
+      timeout: opts.timeoutMs || SKILLHUB_TIMEOUT_MS,
+      maxBuffer: opts.maxBuffer || 2 * 1024 * 1024,
+      env: {
+        ...process.env,
+        FORCE_COLOR: "0",
+      },
+    }, (error, stdout, stderr) => {
+      const out = String(stdout || "");
+      const err = String(stderr || "");
+      resolve({
+        ok: !error,
+        code: error && typeof error.code === "number" ? error.code : 0,
+        error: error ? (err.trim() || error.message || "skillhub failed") : "",
+        stdout: out,
+        stderr: err,
+      });
+    });
+  });
+}
+
+function parseJsonText(text, fallback = null) {
+  const s = String(text || "").trim();
+  if (!s) return fallback;
+  try {
+    return JSON.parse(s);
+  } catch {
+    const match = s.match(/(\{[\s\S]*\}|\[[\s\S]*\])\s*$/);
+    if (!match) return fallback;
+    try { return JSON.parse(match[1]); } catch { return fallback; }
+  }
+}
+
+function normalizeSkillhubSearchPayload(raw) {
+  const data = raw && typeof raw === "object" ? raw : {};
+  const items = Array.isArray(data.items) ? data.items : Array.isArray(data.results) ? data.results : [];
+  return {
+    total: Number(data.total) || items.length,
+    mode: typeof data.mode === "string" ? data.mode : "",
+    degraded: Boolean(data.degraded),
+    items: items.map((item) => {
+      const x = item && typeof item === "object" ? item : {};
+      const id = x.id ?? x.skillId ?? x.skill_id ?? "";
+      const slug = String(x.slug ?? x.name ?? x.displayName ?? x.display_name ?? id ?? "").trim();
+      return {
+        id: String(id || slug),
+        slug,
+        name: String(x.displayName ?? x.display_name ?? x.name ?? slug),
+        summary: String(x.summary ?? x.description ?? ""),
+        version: String(x.version ?? x.latestVersion ?? x.latest_version ?? ""),
+        tags: Array.isArray(x.tags) ? x.tags.map(String) : [],
+      };
+    }).filter((x) => x.slug || x.name),
+  };
+}
+
+function normalizeSkillhubListPayload(raw) {
+  const arr = Array.isArray(raw) ? raw : [];
+  return arr.map((x) => ({
+    name: String(x?.name ?? ""),
+    baseDir: String(x?.baseDir ?? ""),
+    path: String(x?.path ?? ""),
+    kind: String(x?.kind ?? ""),
+    agent: String(x?.agent ?? ""),
+  })).filter((x) => x.name);
+}
+
+function skillhubInstallArgs(payload, { uninstall = false } = {}) {
+  const slug = String(payload?.slug || payload?.name || "").trim();
+  if (!slug && !payload?.collection) return null;
+  const args = [uninstall ? "uninstall" : "install"];
+  if (payload?.collection) {
+    args.push("--collection", String(payload.collection).trim());
+  } else {
+    args.push(slug);
+  }
+  if (payload?.skillId) args.push("--skill-id", String(payload.skillId).trim());
+  const target = String(payload?.target || "project").trim();
+  const agent = String(payload?.agent || "codex").trim();
+  if (target === "global") {
+    args.push("--global", "--agent", agent);
+  } else if (payload?.dir) {
+    args.push("--dir", String(payload.dir).trim());
+  }
+  if (payload?.force) args.push("--force");
+  return args;
+}
+
 function readBody(req) {
   return new Promise((resolve, reject) => {
     const chunks = [];
@@ -132,6 +436,550 @@ function readBody(req) {
   });
 }
 
+const WORKSPACE_FILE_SKIP_DIRS = new Set([
+  ".git",
+  "node_modules",
+  ".next",
+  ".nuxt",
+  ".turbo",
+  "dist",
+  "build",
+  "coverage",
+]);
+
+const WORKSPACE_TEXT_EXTS = new Set([
+  ".md",
+  ".markdown",
+  ".txt",
+  ".json",
+  ".yaml",
+  ".yml",
+  ".js",
+  ".jsx",
+  ".ts",
+  ".tsx",
+  ".css",
+  ".html",
+  ".mjs",
+  ".cjs",
+]);
+
+function resolveWorkspaceFilePath(workspaceRoot, relPath) {
+  const root = path.resolve(workspaceRoot);
+  const rel = String(relPath || "").replace(/^[/\\]+/, "");
+  const abs = path.resolve(root, rel);
+  if (abs !== root && !abs.startsWith(root + path.sep)) {
+    throw new Error("Path traversal not allowed");
+  }
+  return { root, rel: path.relative(root, abs).replace(/\\/g, "/"), abs };
+}
+
+function workspaceFileIcon(fileName, isDir = false) {
+  if (isDir) return "folder";
+  const ext = path.extname(fileName).toLowerCase();
+  if (ext === ".md" || ext === ".markdown") return "article";
+  if ([".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs"].includes(ext)) return "code";
+  if ([".yaml", ".yml", ".json"].includes(ext)) return "data_object";
+  if (ext === ".css") return "palette";
+  if (ext === ".html") return "web";
+  return "draft";
+}
+
+function readWorkspaceFilesRecursive(dir, root, depth = 0, maxDepth = 3, budget = { count: 0 }) {
+  if (depth > maxDepth || budget.count > 500) return [];
+  let entries;
+  try {
+    entries = fs.readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const entry of entries) {
+    if (budget.count > 500) break;
+    if (entry.name.startsWith(".") && entry.name !== ".agents" && entry.name !== ".codex") continue;
+    const abs = path.join(dir, entry.name);
+    const rel = path.relative(root, abs).replace(/\\/g, "/");
+    if (entry.isDirectory()) {
+      if (WORKSPACE_FILE_SKIP_DIRS.has(entry.name)) continue;
+      budget.count++;
+      out.push({
+        type: "directory",
+        name: entry.name,
+        path: rel,
+        icon: workspaceFileIcon(entry.name, true),
+        children: readWorkspaceFilesRecursive(abs, root, depth + 1, maxDepth, budget),
+      });
+    } else if (entry.isFile()) {
+      const ext = path.extname(entry.name).toLowerCase();
+      if (!WORKSPACE_TEXT_EXTS.has(ext)) continue;
+      let size = 0;
+      try { size = fs.statSync(abs).size; } catch {}
+      budget.count++;
+      out.push({ type: "file", name: entry.name, path: rel, icon: workspaceFileIcon(entry.name), size });
+    }
+  }
+  out.sort((a, b) => {
+    if (a.type !== b.type) return a.type === "directory" ? -1 : 1;
+    return a.name.localeCompare(b.name);
+  });
+  return out;
+}
+
+function readWorkspaceFiles(workspaceRoot) {
+  const root = path.resolve(workspaceRoot);
+  return { root, files: readWorkspaceFilesRecursive(root, root) };
+}
+
+const WORKSPACE_GRAPH_FILENAME = "workspace.graph.json";
+
+function workspaceGraphPath(workspaceRoot) {
+  return path.join(path.resolve(workspaceRoot), WORKSPACE_GRAPH_FILENAME);
+}
+
+function emptyWorkspaceGraph() {
+  return { version: 1, instances: {}, edges: [], ui: { nodePositions: {} } };
+}
+
+function readWorkspaceGraph(workspaceRoot) {
+  const graphPath = workspaceGraphPath(workspaceRoot);
+  if (!fs.existsSync(graphPath)) return { path: graphPath, graph: emptyWorkspaceGraph() };
+  const raw = fs.readFileSync(graphPath, "utf-8");
+  if (!raw.trim()) return { path: graphPath, graph: emptyWorkspaceGraph() };
+  const parsed = JSON.parse(raw);
+  const graph = parsed && typeof parsed === "object" ? parsed : {};
+  return {
+    path: graphPath,
+    graph: {
+      version: Number(graph.version) || 1,
+      instances: graph.instances && typeof graph.instances === "object" && !Array.isArray(graph.instances) ? graph.instances : {},
+      edges: Array.isArray(graph.edges) ? graph.edges : [],
+      ui: graph.ui && typeof graph.ui === "object" ? graph.ui : { nodePositions: {} },
+    },
+  };
+}
+
+function normalizeWorkspaceGraphPayload(payload) {
+  const graph = payload?.graph && typeof payload.graph === "object" ? payload.graph : payload;
+  return {
+    version: 1,
+    instances: graph?.instances && typeof graph.instances === "object" && !Array.isArray(graph.instances) ? graph.instances : {},
+    edges: Array.isArray(graph?.edges) ? graph.edges : [],
+    ui: graph?.ui && typeof graph.ui === "object" ? graph.ui : { nodePositions: {} },
+    updatedAt: new Date().toISOString(),
+  };
+}
+
+function resolveWorkspaceScopeRoot(workspaceRoot, params = {}, opts = {}) {
+  const flowId = params.flowId != null ? String(params.flowId).trim() : "";
+  if (!flowId) return { root: path.resolve(workspaceRoot), flowId: "", flowSource: "", archived: false };
+  const flowSource = params.flowSource != null && String(params.flowSource).trim()
+    ? String(params.flowSource).trim()
+    : "user";
+  const archived = params.archived === true || params.archived === "1" || params.flowArchived === true;
+  if (!isValidFlowSourceRead(flowSource)) {
+    return { root: "", error: "Invalid flowSource" };
+  }
+  const result = getPipelineFiles(workspaceRoot, flowId, flowSource, archived, opts);
+  if (result.error || !result.path) {
+    return { root: "", error: result.error || "Pipeline workspace not found" };
+  }
+  return { root: path.resolve(result.path), flowId, flowSource, archived };
+}
+
+function buildWorkspaceGeneratePrompt(payload) {
+  const userPrompt = String(payload?.prompt || "").trim();
+  const outputKind = String(payload?.outputKind || payload?.kind || "markdown").trim().toLowerCase();
+  const allowFlowYaml = payload?.allowFlowYaml === true || payload?.allowFlowYaml === "1";
+  const workspaceGraph = payload?.workspaceGraph && typeof payload.workspaceGraph === "object" ? payload.workspaceGraph : null;
+  const selectedNodeIds = Array.isArray(payload?.selectedNodeIds)
+    ? payload.selectedNodeIds.map((id) => String(id || "").trim()).filter(Boolean)
+    : [];
+  const skillsBlock = typeof payload?.skillsBlock === "string" ? payload.skillsBlock.trim() : "";
+  const contexts = Array.isArray(payload?.contexts) ? payload.contexts : [];
+  const contextBlocks = contexts
+    .map((ctx, idx) => {
+      const title = String(ctx?.title || ctx?.path || `context-${idx + 1}`).trim();
+      const kind = String(ctx?.kind || "text").trim();
+      const content = String(ctx?.content || "").trim();
+      if (!content) return "";
+      return `### ${title} (${kind})\n\n${content}`;
+    })
+    .filter(Boolean)
+    .join("\n\n---\n\n");
+  const kindInstruction =
+    outputKind === "mermaid"
+      ? [
+          "你是 workspace Mermaid 图节点的内容生成器。",
+          "请根据用户 prompt 和上游节点/文件上下文生成 Mermaid flowchart 源码。",
+          "只输出 Mermaid 源码，不要解释，不要包裹 Markdown 代码围栏。",
+          "优先使用 `flowchart TD` 或 `graph TD`，节点 ID 使用简单英文/数字/下划线，节点 label 使用清晰短文本。",
+        ].join("\n")
+      : outputKind === "ascii"
+        ? [
+            "你是 workspace ASCII 图节点的内容生成器。",
+            "请根据用户 prompt 和上游节点/文件上下文生成等宽字体下可读的 ASCII 图。",
+            "只输出 ASCII 图正文，不要解释，不要包裹 Markdown 代码围栏。",
+            "使用 +-|/\\<> 等字符表达结构，尽量保持对齐。",
+          ].join("\n")
+        : [
+            "你是 AgentFlow Workspace Composer。",
+            "优先根据已选择的 Skills 操作 workspace.graph.json，创建或修改 workspace 画布节点、连线与展示节点。",
+            "如果用户请求需要项目分析、加载代码、整理流程或生成展示结果，不要只给泛泛回答；应先让 Skills 驱动画布建模，例如创建 Git/工作目录/Load Skills/Agent/Markdown Display 等合适节点。",
+            "只有当用户明确只是询问概念或无需画布变更时，才直接输出 Markdown 回复。",
+          ].join("\n");
+  return [
+    "你正在 AgentFlow 的 Workspace 工作画布中执行任务。",
+    "Workspace 是当前 pipeline 的临时工作区，用于分析、试验、生成中间文件和展示结果。",
+    "Workspace 与 Pipeline 各自有独立的 Skill collection；此处只使用当前 Workspace Composer 选择的 collections / skills 作为本次行为规则与编辑依据。",
+    "当 Skills 提到修改 flow.yaml / instances / edges / ui 时，在 Workspace 视图下应映射为修改当前工作区的 workspace.graph.json，除非用户显式勾选并要求修改正式 flow.yaml。",
+    "workspace.graph.json 使用 JSON：{ version, instances, edges, ui: { nodePositions, nodeSizes } }。instances 的结构与 flow.yaml instances 一致；edges 使用 source/target/sourceHandle/targetHandle；ui.nodePositions 记录节点坐标。",
+    allowFlowYaml
+      ? "用户已允许你考虑正式 flow.yaml；如需修改仍必须明确说明影响。"
+      : "默认不要修改正式 flow.yaml；优先在 workspace 文件、workspace.graph.json 或回复内容中完成任务。",
+    workspaceGraph ? `\n## 当前 workspace graph\n\n${JSON.stringify(workspaceGraph, null, 2)}` : "",
+    selectedNodeIds.length > 0 ? `\n## 当前用户选中的 workspace 节点\n\n${selectedNodeIds.map((id) => `- ${id}`).join("\n")}` : "",
+    skillsBlock ? `\n## Selected Skills\n\n${skillsBlock}` : "",
+    kindInstruction,
+    contextBlocks ? `\n## 上下文\n\n${contextBlocks}` : "",
+    `\n## 用户 prompt\n\n${userPrompt}`,
+  ].filter(Boolean).join("\n");
+}
+
+function workspaceSlotValue(slot) {
+  if (!slot || typeof slot !== "object") return "";
+  for (const key of ["value", "default"]) {
+    if (slot[key] != null && String(slot[key]).trim()) return String(slot[key]);
+  }
+  return "";
+}
+
+function workspaceInstanceText(instance) {
+  const body = String(instance?.body || "").trim();
+  if (body) return body;
+  const slots = [...(Array.isArray(instance?.input) ? instance.input : []), ...(Array.isArray(instance?.output) ? instance.output : [])];
+  const textSlot = slots.find((slot) => String(slot?.type || "") === "text" && workspaceSlotValue(slot).trim());
+  return textSlot ? workspaceSlotValue(textSlot) : "";
+}
+
+function workspaceDisplayKind(definitionId) {
+  const id = String(definitionId || "");
+  if (id === "display_markdown") return "markdown";
+  if (id === "display_mermaid") return "mermaid";
+  if (id === "display_ascii") return "ascii";
+  return "";
+}
+
+function workspaceRunOrder(graph, runNodeId) {
+  const instances = graph?.instances && typeof graph.instances === "object" ? graph.instances : {};
+  const edges = Array.isArray(graph?.edges) ? graph.edges : [];
+  const target = String(runNodeId || "").trim();
+  if (!target || !instances[target]) throw new Error("Missing workspace run node");
+  const upstream = new Map();
+  const downstream = new Map();
+  for (const edge of edges) {
+    const source = String(edge?.source || "");
+    const dest = String(edge?.target || "");
+    if (!source || !dest || !instances[source] || !instances[dest]) continue;
+    if (!upstream.has(dest)) upstream.set(dest, []);
+    upstream.get(dest).push(source);
+    if (!downstream.has(source)) downstream.set(source, []);
+    downstream.get(source).push(dest);
+  }
+  const reachable = new Set();
+  const visit = (id) => {
+    if (!id || reachable.has(id)) return;
+    reachable.add(id);
+    for (const next of downstream.get(id) || []) visit(next);
+  };
+  visit(target);
+  reachable.delete(target);
+  const needed = reachable;
+  const indegree = new Map(Array.from(needed).map((id) => [id, 0]));
+  for (const id of needed) {
+    for (const prev of upstream.get(id) || []) {
+      if (needed.has(prev)) indegree.set(id, (indegree.get(id) || 0) + 1);
+    }
+  }
+  const ready = Array.from(needed).filter((id) => (indegree.get(id) || 0) === 0);
+  const ordered = [];
+  while (ready.length) {
+    const id = ready.shift();
+    ordered.push(id);
+    for (const next of downstream.get(id) || []) {
+      if (!needed.has(next)) continue;
+      const n = (indegree.get(next) || 0) - 1;
+      indegree.set(next, n);
+      if (n === 0) ready.push(next);
+    }
+  }
+  if (ordered.length !== needed.size) {
+    throw new Error("Workspace run graph contains a cycle");
+  }
+  return ordered;
+}
+
+function workspaceUpstreamText(graph, nodeId, outputs) {
+  const edges = Array.isArray(graph?.edges) ? graph.edges : [];
+  const instances = graph?.instances && typeof graph.instances === "object" ? graph.instances : {};
+  const incoming = edges.filter((edge) => String(edge?.target || "") === String(nodeId));
+  const contentEdge = incoming.find((edge) => String(edge?.targetHandle || "") === "input-1") || incoming[0];
+  if (!contentEdge) return "";
+  const sourceId = String(contentEdge.source || "");
+  const out = outputs.get(sourceId);
+  if (out != null && String(out).trim()) return String(out);
+  return workspaceInstanceText(instances[sourceId]);
+}
+
+function parseWorkspaceSkillKeys(raw) {
+  const text = String(raw || "").trim();
+  if (!text) return [];
+  try {
+    const parsed = JSON.parse(text);
+    if (Array.isArray(parsed)) return parsed.map((item) => String(item || "").trim()).filter(Boolean);
+  } catch {
+    /* plain list fallback */
+  }
+  return text.split(/[\n,]+/).map((item) => item.trim()).filter(Boolean);
+}
+
+function selectedSkillKeysFromInstance(instance) {
+  const bodyKeys = parseWorkspaceSkillKeys(instance?.body || "");
+  if (bodyKeys.length > 0) return bodyKeys;
+  const slots = [...(Array.isArray(instance?.input) ? instance.input : []), ...(Array.isArray(instance?.output) ? instance.output : [])];
+  const slot = slots.find((item) => item?.name === "skillsContext") || slots.find((item) => item?.name === "skillKeys");
+  return parseWorkspaceSkillKeys(workspaceSlotValue(slot) || "");
+}
+
+function workspaceUpstreamSkillBlocks(graph, nodeId, outputs) {
+  const edges = Array.isArray(graph?.edges) ? graph.edges : [];
+  return edges
+    .filter((edge) => String(edge?.target || "") === String(nodeId))
+    .map((edge) => String(outputs.get(String(edge.source || "")) || ""))
+    .filter((text) => text.includes("##") || text.includes("Skill"))
+    .join("\n\n---\n\n");
+}
+
+function workspaceWriteDisplayContent(instance, content) {
+  const next = { ...(instance || {}) };
+  const text = String(content || "");
+  next.body = text;
+  next.input = (Array.isArray(next.input) ? next.input : []).map((slot) => (
+    String(slot?.name || "") === "content" || String(slot?.type || "") === "text"
+      ? { ...slot, default: text, value: text }
+      : slot
+  ));
+  next.output = (Array.isArray(next.output) ? next.output : []).map((slot) => (
+    String(slot?.name || "") === "content" || String(slot?.type || "") === "text"
+      ? { ...slot, default: text, value: text }
+      : slot
+  ));
+  return next;
+}
+
+function workspaceUpdateDirectDisplays(graph, sourceId, content) {
+  const instances = graph?.instances && typeof graph.instances === "object" ? graph.instances : {};
+  const edges = Array.isArray(graph?.edges) ? graph.edges : [];
+  const updated = [];
+  for (const edge of edges) {
+    if (String(edge?.source || "") !== String(sourceId)) continue;
+    const targetId = String(edge?.target || "");
+    const target = instances[targetId];
+    if (!target || !workspaceDisplayKind(target.definitionId)) continue;
+    instances[targetId] = workspaceWriteDisplayContent(target, content);
+    updated.push(targetId);
+  }
+  return updated;
+}
+
+function workspaceNodePrompt(graph, nodeId, upstreamText, skillsBlock) {
+  const instance = graph.instances[nodeId] || {};
+  const body = String(instance.body || "").trim();
+  const label = String(instance.label || nodeId).trim();
+  return [
+    "你正在执行 AgentFlow Workspace 画布中的一个临时节点。",
+    "只输出该节点要传给下游展示/后续节点的正文，不要解释运行过程。",
+    skillsBlock ? `\n## Selected Skills\n\n${skillsBlock}` : "",
+    upstreamText ? `\n## 上游上下文\n\n${upstreamText}` : "",
+    `\n## 当前节点\n\n- id: ${nodeId}\n- label: ${label}\n- definitionId: ${instance.definitionId || ""}`,
+    `\n## 节点任务\n\n${body || upstreamText}`,
+  ].filter(Boolean).join("\n");
+}
+
+async function runWorkspaceGraph(root, scopedRoot, payload, userCtx = {}, opts = {}) {
+  const graph = normalizeWorkspaceGraphPayload(payload.graph || {});
+  const runNodeId = String(payload?.runNodeId || "").trim();
+  const order = workspaceRunOrder(graph, runNodeId);
+  const fallbackSelectedSkillKeys = Array.isArray(payload?.selectedSkills)
+    ? payload.selectedSkills.map((x) => String(x || "").trim()).filter(Boolean)
+    : [];
+  const skillsBlockCache = new Map();
+  const loadSkillsBlockForKeys = (keys) => {
+    const normalized = Array.from(new Set((keys || []).map((x) => String(x || "").trim()).filter(Boolean)));
+    const cacheKey = normalized.join("\n");
+    if (skillsBlockCache.has(cacheKey)) return skillsBlockCache.get(cacheKey);
+    const selectedSkillResources = normalized.length > 0
+      ? loadResourcesForSkillKeys(normalized, PACKAGE_ROOT, scopedRoot)
+      : { skills: [], references: [] };
+    const block = normalized.length > 0
+      ? buildSkillCompactInjectionBlock(selectedSkillResources.skills, selectedSkillResources.references)
+      : "";
+    skillsBlockCache.set(cacheKey, block);
+    return block;
+  };
+  const outputs = new Map();
+  const events = [];
+  const emit = (event) => {
+    events.push(event);
+    if (typeof opts.onEvent === "function") opts.onEvent(event);
+  };
+  let cwd = scopedRoot;
+  const modelKey = typeof payload?.model === "string" ? payload.model.trim() : "";
+
+  for (const nodeId of order) {
+    const instance = graph.instances[nodeId];
+    if (!instance) continue;
+    const defId = String(instance.definitionId || "");
+    emit({ type: "node-start", nodeId, definitionId: defId });
+
+    if (defId === "workspace_run") {
+      continue;
+    }
+
+    if (defId === "control_load_skills") {
+      const nodeSkillKeys = selectedSkillKeysFromInstance(instance);
+      const activeSkillKeys = nodeSkillKeys.length > 0 ? nodeSkillKeys : fallbackSelectedSkillKeys;
+      const skillsBlock = loadSkillsBlockForKeys(activeSkillKeys);
+      graph.instances[nodeId] = {
+        ...instance,
+        output: (Array.isArray(instance.output) ? instance.output : []).map((slot) => (
+          String(slot?.name || "") === "skillsContext" || String(slot?.type || "") === "text"
+            ? { ...slot, default: skillsBlock, value: skillsBlock }
+            : slot
+        )),
+      };
+      outputs.set(nodeId, skillsBlock);
+      workspaceUpdateDirectDisplays(graph, nodeId, skillsBlock);
+      emit({ type: "graph", nodeId, graph });
+      emit({ type: "node-done", nodeId, definitionId: defId });
+      continue;
+    }
+
+    if (workspaceDisplayKind(defId)) {
+      const content = workspaceUpstreamText(graph, nodeId, outputs);
+      graph.instances[nodeId] = workspaceWriteDisplayContent(instance, content);
+      outputs.set(nodeId, content);
+      emit({ type: "graph", nodeId, graph });
+      emit({ type: "node-done", nodeId, definitionId: defId });
+      continue;
+    }
+
+    if (defId === "provide_str") {
+      const content = workspaceInstanceText(instance);
+      outputs.set(nodeId, content);
+      emit({ type: "node-done", nodeId, definitionId: defId });
+      continue;
+    }
+
+    if (defId === "provide_file") {
+      const fileValue = workspaceSlotValue(Array.isArray(instance.output) ? instance.output[0] : null) || workspaceInstanceText(instance);
+      const abs = path.resolve(scopedRoot, fileValue);
+      if (!abs.startsWith(path.resolve(scopedRoot) + path.sep) && abs !== path.resolve(scopedRoot)) {
+        throw new Error(`Workspace file is outside root: ${fileValue}`);
+      }
+      const content = fs.existsSync(abs) && fs.statSync(abs).isFile() ? fs.readFileSync(abs, "utf-8") : fileValue;
+      outputs.set(nodeId, content);
+      emit({ type: "node-done", nodeId, definitionId: defId });
+      continue;
+    }
+
+    if (defId === "control_cd_workspace") {
+      const inputText = workspaceUpstreamText(graph, nodeId, outputs);
+      const inputSlots = Array.isArray(instance.input) ? instance.input : [];
+      const pathSlot = inputSlots.find((slot) => String(slot?.name || "") === "path") ||
+        inputSlots.find((slot) => String(slot?.name || "") === "target");
+      const candidate = workspaceSlotValue(pathSlot) || workspaceInstanceText(instance) || inputText;
+      const abs = candidate ? path.resolve(scopedRoot, candidate) : scopedRoot;
+      if (fs.existsSync(abs) && fs.statSync(abs).isDirectory()) cwd = abs;
+      outputs.set(nodeId, cwd);
+      emit({ type: "node-done", nodeId, definitionId: defId });
+      continue;
+    }
+
+    if (defId === "control_user_workspace") {
+      cwd = path.resolve(os.homedir());
+      outputs.set(nodeId, cwd);
+      emit({ type: "node-done", nodeId, definitionId: defId });
+      continue;
+    }
+
+    const upstreamText = workspaceUpstreamText(graph, nodeId, outputs);
+    const body = String(instance.body || "").trim();
+    if (defId === "agent_subAgent" && !body && !String(upstreamText || "").trim()) {
+      throw new Error(`Workspace node ${nodeId} has no task. Fill the node body or connect upstream text.`);
+    }
+    const upstreamSkillBlocks = workspaceUpstreamSkillBlocks(graph, nodeId, outputs);
+    const prompt = workspaceNodePrompt(graph, nodeId, upstreamText, upstreamSkillBlocks || loadSkillsBlockForKeys(fallbackSelectedSkillKeys));
+    let content = "";
+    const maxAttempts = 3;
+    for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+      let attemptContent = "";
+      try {
+        const handle = startComposerAgent({
+          uiWorkspaceRoot: scopedRoot,
+          cliWorkspace: cwd,
+          prompt,
+          modelKey,
+          agentflowUserId: userCtx.userId || "",
+          onStreamEvent: (ev) => {
+            emit({ ...ev, nodeId });
+            if (ev?.type === "natural" && ev.kind === "assistant" && typeof ev.text === "string") {
+              attemptContent += (attemptContent ? "\n" : "") + ev.text;
+              const updatedDisplays = workspaceUpdateDirectDisplays(graph, nodeId, attemptContent);
+              if (updatedDisplays.length) emit({ type: "graph", nodeId, displayNodeIds: updatedDisplays, graph });
+            }
+          },
+        });
+        await handle.finished;
+        content = attemptContent.trim();
+        break;
+      } catch (e) {
+        if (attempt < maxAttempts && isTransientAgentNetworkError(e)) {
+          emit({ type: "status", nodeId, line: `Workspace node retry ${attempt + 1}/${maxAttempts} after network error` });
+          await sleepMs(Math.min(1500 * attempt, 5000));
+          continue;
+        }
+        throw e;
+      }
+    }
+    outputs.set(nodeId, content);
+    const updatedDisplays = workspaceUpdateDirectDisplays(graph, nodeId, content);
+    if (updatedDisplays.length) emit({ type: "graph", nodeId, displayNodeIds: updatedDisplays, graph });
+    emit({ type: "node-done", nodeId, definitionId: defId });
+  }
+  graph.updatedAt = new Date().toISOString();
+  return { graph, events, order };
+}
+
+function isTransientAgentNetworkError(err) {
+  const text = [
+    err?.message,
+    err?.cursorStderrTail,
+    err?.stderr,
+    err?.stack,
+  ].filter(Boolean).join("\n");
+  return /Client network socket disconnected before secure TLS connection was established/i.test(text) ||
+    /secure TLS connection was established/i.test(text) ||
+    /\bECONNRESET\b/i.test(text) ||
+    /\bETIMEDOUT\b/i.test(text) ||
+    /\bEAI_AGAIN\b/i.test(text) ||
+    /network socket disconnected/i.test(text) ||
+    /socket hang up/i.test(text);
+}
+
+function sleepMs(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
 /** ZIP 本地头：PK\x03\x04 / \x05\x06 / \x07\x08 */
 function bufferLooksLikeZip(buf) {
   return (
@@ -211,12 +1059,12 @@ const flowEditorSyncSubscribers = new Map();
 /** 每次 broadcastFlowEditorSync 时递增，供轮询端点 /api/flow-editor-sync-poll 使用 */
 const flowEditorSyncVersions = new Map();
 
-function flowEditorSyncKey(flowId, flowSource, flowArchived) {
-  return `${String(flowId)}\t${String(flowSource)}\t${flowArchived ? "1" : "0"}`;
+function flowEditorSyncKey(flowId, flowSource, flowArchived, userId = "") {
+  return `${String(userId || "")}\t${String(flowId)}\t${String(flowSource)}\t${flowArchived ? "1" : "0"}`;
 }
 
-function broadcastFlowEditorSync(flowId, flowSource, flowArchived = false) {
-  const key = flowEditorSyncKey(flowId, flowSource, flowArchived);
+function broadcastFlowEditorSync(flowId, flowSource, flowArchived = false, userId = "") {
+  const key = flowEditorSyncKey(flowId, flowSource, flowArchived, userId);
 
   /* 递增轮询版本号 */
   flowEditorSyncVersions.set(key, (flowEditorSyncVersions.get(key) ?? 0) + 1);
@@ -340,6 +1188,7 @@ function normalizeContextInstanceIds(raw) {
  * @param {object} opts
  * @param {string} opts.workspaceRoot
  * @param {number} opts.port
+ * @param {boolean} [opts.hideCommunityLinks]
  * @param {string} [opts.staticDir] 默认 PACKAGE_ROOT/builtin/web-ui/dist（npm run build 产出）
  * @returns {Promise<import('http').Server>}
  */
@@ -347,10 +1196,12 @@ export function startUiServer({
   workspaceRoot,
   port,
   host = "127.0.0.1",
+  hideCommunityLinks = false,
   staticDir = path.join(PACKAGE_ROOT, "builtin", "web-ui", "dist"),
 }) {
   const root = path.resolve(workspaceRoot);
   const uiPort = port;
+  const uiConfig = { hideCommunityLinks: Boolean(hideCommunityLinks) };
 
   const server = http.createServer(async (req, res) => {
     const url = new URL(req.url || "/", "http://127.0.0.1");
@@ -363,10 +1214,58 @@ export function startUiServer({
       return origEnd(...args);
     };
 
+    if (url.pathname === "/api/auth/me" && req.method === "GET") {
+      const user = getAuthUserFromRequest(req);
+      json(res, 200, { authenticated: Boolean(user), user: user || null, setupRequired: authSetupRequired() });
+      return;
+    }
+
+    if (url.pathname === "/api/auth/login" && req.method === "POST") {
+      let payload;
+      try {
+        payload = JSON.parse(await readBody(req));
+      } catch {
+        json(res, 400, { error: "Invalid JSON body" });
+        return;
+      }
+      const result = loginOrCreateUser(payload?.username, payload?.password);
+      if (!result.ok) {
+        json(res, 401, { error: result.error || "Login failed", setupRequired: authSetupRequired() });
+        return;
+      }
+      const body = JSON.stringify({ authenticated: true, user: result.user, setupRequired: false, migration: result.migration || null });
+      res.writeHead(200, {
+        "Content-Type": "application/json; charset=utf-8",
+        "Content-Length": Buffer.byteLength(body),
+        "Set-Cookie": buildSessionCookie(result.token),
+      });
+      res.end(body);
+      return;
+    }
+
+    if (url.pathname === "/api/auth/logout" && req.method === "POST") {
+      logoutRequest(req);
+      const body = JSON.stringify({ ok: true });
+      res.writeHead(200, {
+        "Content-Type": "application/json; charset=utf-8",
+        "Content-Length": Buffer.byteLength(body),
+        "Set-Cookie": buildClearSessionCookie(),
+      });
+      res.end(body);
+      return;
+    }
+
+    const authUser = getAuthUserFromRequest(req);
+    const userCtx = authUser ? { userId: authUser.userId } : {};
+    if (url.pathname.startsWith("/api/") && !authUser) {
+      json(res, 401, { error: "Authentication required", setupRequired: authSetupRequired() });
+      return;
+    }
+
     if (url.pathname === "/api/flows") {
       if (req.method === "GET") {
         try {
-          json(res, 200, listFlowsJson(root));
+          json(res, 200, listFlowsJson(root, userCtx));
         } catch (e) {
           json(res, 500, { error: (e && e.message) || String(e) });
         }
@@ -400,7 +1299,7 @@ export function startUiServer({
         if (ts === "workspace" || ts === "user") {
           targetSpace = ts;
         }
-        const existing = listFlowsJson(root);
+        const existing = listFlowsJson(root, userCtx);
         if (
           existing.some(
             (f) => f.id === flowId && (f.source ?? "user") === targetSpace && !f.archived,
@@ -410,7 +1309,7 @@ export function startUiServer({
           return;
         }
         const flowYaml = buildEmptyUserFlowYaml({ description: desc });
-        const result = writeFlowYaml(root, flowId, targetSpace, flowYaml);
+        const result = writeFlowYaml(root, flowId, targetSpace, flowYaml, userCtx);
         if (!result.success) {
           json(res, 400, result);
           return;
@@ -456,7 +1355,7 @@ export function startUiServer({
       }
       const flowId = idCheck.flowId;
       const targetSpace = parsed.targetSpace === "workspace" ? "workspace" : "user";
-      const existing = listFlowsJson(root);
+      const existing = listFlowsJson(root, userCtx);
       if (
         existing.some(
           (f) => f.id === flowId && (f.source ?? "user") === targetSpace && !f.archived,
@@ -487,7 +1386,7 @@ export function startUiServer({
         filesMap = new Map([["flow.yaml", Buffer.from(text, "utf8")]]);
       }
 
-      const w = writePipelineTree(root, flowId, targetSpace, filesMap);
+      const w = writePipelineTree(root, flowId, targetSpace, filesMap, userCtx);
       if (!w.success) {
         json(res, 400, { error: w.error });
         return;
@@ -507,7 +1406,7 @@ export function startUiServer({
           return;
         }
         const { getNodeExecContext } = await import("./node-exec-context.mjs");
-        json(res, 200, getNodeExecContext(root, flowId, instanceId, runId));
+        json(res, 200, getNodeExecContext(root, flowId, instanceId, runId, userCtx));
       } catch (e) {
         json(res, 500, { error: (e && e.message) || String(e) });
       }
@@ -516,7 +1415,7 @@ export function startUiServer({
 
     if (req.method === "GET" && url.pathname === "/api/pipeline-recent-runs") {
       try {
-        json(res, 200, { runs: listRecentRunsFromDisk(root) });
+        json(res, 200, { runs: listRecentRunsFromDisk(root, userCtx) });
       } catch (e) {
         json(res, 500, { error: (e && e.message) || String(e) });
       }
@@ -532,7 +1431,7 @@ export function startUiServer({
           return;
         }
         const { getRunNodeStatusesFromDisk } = await import("./run-node-statuses-from-disk.mjs");
-        json(res, 200, { statuses: getRunNodeStatusesFromDisk(root, flowId, runId) });
+        json(res, 200, { statuses: getRunNodeStatusesFromDisk(root, flowId, runId, userCtx) });
       } catch (e) {
         json(res, 500, { error: (e && e.message) || String(e) });
       }
@@ -554,7 +1453,7 @@ export function startUiServer({
         const { getRunDir } = await import("./workspace.mjs");
         const { RUN_LOG_REL } = await import("./paths.mjs");
         const { default: fsMod } = await import("node:fs");
-        const logPath = path.join(getRunDir(root, flowId, runId), RUN_LOG_REL);
+        const logPath = path.join(getRunDir(root, flowId, runId, userCtx), RUN_LOG_REL);
         if (!fsMod.existsSync(logPath)) {
           json(res, 200, { bytes: 0, text: "" });
           return;
@@ -596,6 +1495,357 @@ export function startUiServer({
       return;
     }
 
+    if (req.method === "GET" && url.pathname === "/api/workspace/files") {
+      try {
+        const scoped = resolveWorkspaceScopeRoot(root, {
+          flowId: url.searchParams.get("flowId") || "",
+          flowSource: url.searchParams.get("flowSource") || "user",
+          archived: url.searchParams.get("archived") === "1",
+        }, userCtx);
+        if (scoped.error) {
+          json(res, 400, { error: scoped.error });
+          return;
+        }
+        json(res, 200, { ...readWorkspaceFiles(scoped.root), flowId: scoped.flowId, flowSource: scoped.flowSource, archived: scoped.archived });
+      } catch (e) {
+        json(res, 500, { error: (e && e.message) || String(e) });
+      }
+      return;
+    }
+
+    if (req.method === "GET" && url.pathname === "/api/workspace/graph") {
+      try {
+        const scoped = resolveWorkspaceScopeRoot(root, {
+          flowId: url.searchParams.get("flowId") || "",
+          flowSource: url.searchParams.get("flowSource") || "user",
+          archived: url.searchParams.get("archived") === "1",
+        }, userCtx);
+        if (scoped.error) {
+          json(res, 400, { error: scoped.error });
+          return;
+        }
+        const { path: graphPath, graph } = readWorkspaceGraph(scoped.root);
+        json(res, 200, {
+          ok: true,
+          graph,
+          path: graphPath,
+          root: scoped.root,
+          flowId: scoped.flowId,
+          flowSource: scoped.flowSource,
+          archived: scoped.archived,
+          writable: !(scoped.archived || scoped.flowSource === "builtin"),
+        });
+      } catch (e) {
+        json(res, 500, { error: (e && e.message) || String(e) });
+      }
+      return;
+    }
+
+    if (req.method === "POST" && url.pathname === "/api/workspace/graph") {
+      let payload;
+      try {
+        payload = JSON.parse(await readBody(req));
+      } catch {
+        json(res, 400, { error: "Invalid JSON body" });
+        return;
+      }
+      try {
+        const scoped = resolveWorkspaceScopeRoot(root, {
+          flowId: payload.flowId || "",
+          flowSource: payload.flowSource || "user",
+          archived: payload.archived === true || payload.flowArchived === true,
+        }, userCtx);
+        if (scoped.error) {
+          json(res, 400, { error: scoped.error });
+          return;
+        }
+        if (scoped.archived || scoped.flowSource === "builtin") {
+          json(res, 400, { error: "Cannot write workspace graph for builtin or archived pipeline" });
+          return;
+        }
+        const graph = normalizeWorkspaceGraphPayload(payload.graph || payload);
+        const graphPath = workspaceGraphPath(scoped.root);
+        fs.writeFileSync(graphPath, JSON.stringify(graph, null, 2) + "\n", "utf-8");
+        json(res, 200, { ok: true, path: graphPath, graph });
+      } catch (e) {
+        json(res, 500, { error: (e && e.message) || String(e) });
+      }
+      return;
+    }
+
+    if (req.method === "POST" && url.pathname === "/api/workspace/run") {
+      let payload;
+      try {
+        payload = JSON.parse(await readBody(req));
+      } catch {
+        json(res, 400, { error: "Invalid JSON body" });
+        return;
+      }
+      try {
+        const scoped = resolveWorkspaceScopeRoot(root, {
+          flowId: payload.flowId || "",
+          flowSource: payload.flowSource || "user",
+          archived: payload.archived === true || payload.flowArchived === true,
+        }, userCtx);
+        if (scoped.error) {
+          json(res, 400, { error: scoped.error });
+          return;
+        }
+        if (scoped.archived || scoped.flowSource === "builtin") {
+          json(res, 400, { error: "Cannot run workspace graph for builtin or archived pipeline" });
+          return;
+        }
+        const wantsStream = /\bapplication\/x-ndjson\b/i.test(req.headers.accept || "") || payload.stream === true;
+        if (wantsStream) {
+          const graphPath = workspaceGraphPath(scoped.root);
+          res.writeHead(200, {
+            "Content-Type": "application/x-ndjson; charset=utf-8",
+            "Cache-Control": "no-cache",
+            "X-Accel-Buffering": "no",
+          });
+          const writeEvent = (event) => {
+            res.write(JSON.stringify(event) + "\n");
+          };
+          try {
+            const result = await runWorkspaceGraph(root, scoped.root, payload, userCtx, { onEvent: writeEvent });
+            fs.writeFileSync(graphPath, JSON.stringify(result.graph, null, 2) + "\n", "utf-8");
+            writeEvent({ type: "done", ok: true, path: graphPath, graph: result.graph, order: result.order });
+            res.end();
+          } catch (e) {
+            writeEvent({ type: "error", error: (e && e.message) || String(e) });
+            res.end();
+          }
+          return;
+        }
+        const result = await runWorkspaceGraph(root, scoped.root, payload, userCtx);
+        const graphPath = workspaceGraphPath(scoped.root);
+        fs.writeFileSync(graphPath, JSON.stringify(result.graph, null, 2) + "\n", "utf-8");
+        json(res, 200, { ok: true, path: graphPath, ...result });
+      } catch (e) {
+        json(res, 500, { error: (e && e.message) || String(e) });
+      }
+      return;
+    }
+
+    if (req.method === "GET" && url.pathname === "/api/workspace/file") {
+      try {
+        const scoped = resolveWorkspaceScopeRoot(root, {
+          flowId: url.searchParams.get("flowId") || "",
+          flowSource: url.searchParams.get("flowSource") || "user",
+          archived: url.searchParams.get("archived") === "1",
+        }, userCtx);
+        if (scoped.error) {
+          json(res, 400, { error: scoped.error });
+          return;
+        }
+        const { abs, rel } = resolveWorkspaceFilePath(scoped.root, url.searchParams.get("path") || "");
+        if (!fs.existsSync(abs) || !fs.statSync(abs).isFile()) {
+          json(res, 404, { error: "File not found" });
+          return;
+        }
+        const stat = fs.statSync(abs);
+        if (stat.size > 2 * 1024 * 1024) {
+          json(res, 413, { error: "File too large" });
+          return;
+        }
+        json(res, 200, { path: rel, content: fs.readFileSync(abs, "utf-8"), size: stat.size });
+      } catch (e) {
+        json(res, /traversal/i.test(String(e.message || e)) ? 403 : 500, { error: (e && e.message) || String(e) });
+      }
+      return;
+    }
+
+    if (req.method === "POST" && url.pathname === "/api/workspace/file") {
+      let payload;
+      try {
+        payload = JSON.parse(await readBody(req));
+      } catch {
+        json(res, 400, { error: "Invalid JSON body" });
+        return;
+      }
+      try {
+        const scoped = resolveWorkspaceScopeRoot(root, {
+          flowId: payload.flowId || "",
+          flowSource: payload.flowSource || "user",
+          archived: payload.archived === true || payload.flowArchived === true,
+        }, userCtx);
+        if (scoped.error) {
+          json(res, 400, { error: scoped.error });
+          return;
+        }
+        if (scoped.archived || scoped.flowSource === "builtin") {
+          json(res, 400, { error: "Cannot write to builtin or archived pipeline workspace" });
+          return;
+        }
+        const { abs, rel } = resolveWorkspaceFilePath(scoped.root, payload.path || "");
+        if (!rel) {
+          json(res, 400, { error: "Missing path" });
+          return;
+        }
+        fs.mkdirSync(path.dirname(abs), { recursive: true });
+        fs.writeFileSync(abs, String(payload.content ?? ""), "utf-8");
+        json(res, 200, { ok: true, path: rel });
+      } catch (e) {
+        json(res, /traversal/i.test(String(e.message || e)) ? 403 : 500, { error: (e && e.message) || String(e) });
+      }
+      return;
+    }
+
+    if (req.method === "POST" && url.pathname === "/api/workspace/folder") {
+      let payload;
+      try {
+        payload = JSON.parse(await readBody(req));
+      } catch {
+        json(res, 400, { error: "Invalid JSON body" });
+        return;
+      }
+      try {
+        const scoped = resolveWorkspaceScopeRoot(root, {
+          flowId: payload.flowId || "",
+          flowSource: payload.flowSource || "user",
+          archived: payload.archived === true || payload.flowArchived === true,
+        }, userCtx);
+        if (scoped.error) {
+          json(res, 400, { error: scoped.error });
+          return;
+        }
+        if (scoped.archived || scoped.flowSource === "builtin") {
+          json(res, 400, { error: "Cannot write to builtin or archived pipeline workspace" });
+          return;
+        }
+        const { abs, rel } = resolveWorkspaceFilePath(scoped.root, payload.path || "");
+        if (!rel) {
+          json(res, 400, { error: "Missing path" });
+          return;
+        }
+        fs.mkdirSync(abs, { recursive: true });
+        json(res, 200, { ok: true, path: rel });
+      } catch (e) {
+        json(res, /traversal/i.test(String(e.message || e)) ? 403 : 500, { error: (e && e.message) || String(e) });
+      }
+      return;
+    }
+
+    if (req.method === "POST" && url.pathname === "/api/workspace/delete") {
+      let payload;
+      try {
+        payload = JSON.parse(await readBody(req));
+      } catch {
+        json(res, 400, { error: "Invalid JSON body" });
+        return;
+      }
+      try {
+        const scoped = resolveWorkspaceScopeRoot(root, {
+          flowId: payload.flowId || "",
+          flowSource: payload.flowSource || "user",
+          archived: payload.archived === true || payload.flowArchived === true,
+        }, userCtx);
+        if (scoped.error) {
+          json(res, 400, { error: scoped.error });
+          return;
+        }
+        if (scoped.archived || scoped.flowSource === "builtin") {
+          json(res, 400, { error: "Cannot write to builtin or archived pipeline workspace" });
+          return;
+        }
+        const { abs, rel } = resolveWorkspaceFilePath(scoped.root, payload.path || "");
+        if (!rel) {
+          json(res, 400, { error: "Missing path" });
+          return;
+        }
+        if (!fs.existsSync(abs)) {
+          json(res, 404, { error: "Path not found" });
+          return;
+        }
+        fs.rmSync(abs, { recursive: true, force: true });
+        json(res, 200, { ok: true, path: rel });
+      } catch (e) {
+        json(res, /traversal/i.test(String(e.message || e)) ? 403 : 500, { error: (e && e.message) || String(e) });
+      }
+      return;
+    }
+
+    if (req.method === "POST" && url.pathname === "/api/workspace/generate") {
+      let payload;
+      try {
+        payload = JSON.parse(await readBody(req));
+      } catch {
+        json(res, 400, { error: "Invalid JSON body" });
+        return;
+      }
+      const prompt = String(payload?.prompt || "").trim();
+      if (!prompt) {
+        json(res, 400, { error: "Missing prompt" });
+        return;
+      }
+      try {
+        const scoped = resolveWorkspaceScopeRoot(root, {
+          flowId: payload.flowId || "",
+          flowSource: payload.flowSource || "user",
+          archived: payload.archived === true || payload.flowArchived === true,
+        }, userCtx);
+        if (scoped.error) {
+          json(res, 400, { error: scoped.error });
+          return;
+        }
+        const selectedSkillKeys = Array.isArray(payload?.selectedSkills)
+          ? payload.selectedSkills.map((x) => String(x || "").trim()).filter(Boolean)
+          : [];
+        const selectedSkillResources = selectedSkillKeys.length > 0
+          ? loadResourcesForSkillKeys(selectedSkillKeys, PACKAGE_ROOT, scoped.root)
+          : { skills: [], references: [] };
+        const skillsBlock = selectedSkillKeys.length > 0
+          ? buildSkillCompactInjectionBlock(selectedSkillResources.skills, selectedSkillResources.references)
+          : "";
+        let content = "";
+        const events = [];
+        const maxAttempts = 3;
+        const promptText = buildWorkspaceGeneratePrompt({ ...payload, skillsBlock });
+        const modelKey = typeof payload?.model === "string" ? payload.model.trim() : "";
+        for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+          let attemptContent = "";
+          try {
+            if (attempt > 1) {
+              events.push({
+                type: "status",
+                line: `Workspace agent retry ${attempt}/${maxAttempts} after transient network failure...`,
+              });
+              await sleepMs(Math.min(1500 * attempt, 5000));
+            }
+            const handle = startComposerAgent({
+              uiWorkspaceRoot: scoped.root,
+              cliWorkspace: scoped.root,
+              prompt: promptText,
+              modelKey,
+              agentflowUserId: userCtx.userId || "",
+              onStreamEvent: (ev) => {
+                events.push(ev);
+                if (ev?.type === "natural" && ev.kind === "assistant" && typeof ev.text === "string") {
+                  attemptContent += (attemptContent ? "\n" : "") + ev.text;
+                }
+              },
+            });
+            await handle.finished;
+            content = attemptContent;
+            break;
+          } catch (e) {
+            if (attempt < maxAttempts && isTransientAgentNetworkError(e)) {
+              events.push({
+                type: "status",
+                line: `Workspace agent transient network error: ${String(e.message || e).slice(0, 220)}`,
+              });
+              continue;
+            }
+            throw e;
+          }
+        }
+        json(res, 200, { ok: true, content: content.trim(), events });
+      } catch (e) {
+        json(res, 500, { error: (e && e.message) || String(e) });
+      }
+      return;
+    }
+
     if (req.method === "GET" && url.pathname === "/api/pipeline-files") {
       const flowId = url.searchParams.get("flowId");
       const flowSource = url.searchParams.get("flowSource") || "user";
@@ -605,7 +1855,7 @@ export function startUiServer({
         return;
       }
       try {
-        const result = getPipelineFiles(root, flowId, flowSource, archived);
+        const result = getPipelineFiles(root, flowId, flowSource, archived, userCtx);
         json(res, 200, result);
       } catch (e) {
         json(res, 500, { error: (e && e.message) || String(e) });
@@ -623,7 +1873,7 @@ export function startUiServer({
         return;
       }
       try {
-        const result = getPipelineFiles(root, flowId, flowSource, archived);
+        const result = getPipelineFiles(root, flowId, flowSource, archived, userCtx);
         if (result.error) {
           json(res, 404, { error: result.error });
           return;
@@ -669,7 +1919,7 @@ export function startUiServer({
         content = String(body);
       }
       try {
-        const result = getPipelineFiles(root, flowId, flowSource, archived);
+        const result = getPipelineFiles(root, flowId, flowSource, archived, userCtx);
         if (result.error) {
           json(res, 404, { error: result.error });
           return;
@@ -702,7 +1952,7 @@ export function startUiServer({
 
     if (req.method === "GET" && url.pathname === "/api/ui-context") {
       try {
-        json(res, 200, { workspaceRoot: root });
+        json(res, 200, { workspaceRoot: root, ...uiConfig });
       } catch (e) {
         json(res, 500, { error: (e && e.message) || String(e) });
       }
@@ -812,6 +2062,32 @@ export function startUiServer({
       return;
     }
 
+    if (req.method === "GET" && url.pathname === "/api/user-env") {
+      try {
+        json(res, 200, { env: readUserEnvRows(userCtx.userId) });
+      } catch (e) {
+        json(res, 500, { error: (e && e.message) || String(e) });
+      }
+      return;
+    }
+
+    if (req.method === "POST" && url.pathname === "/api/user-env") {
+      let payload;
+      try {
+        payload = JSON.parse(await readBody(req));
+      } catch {
+        json(res, 400, { error: "Invalid JSON body" });
+        return;
+      }
+      try {
+        const envRows = writeUserEnvRows(userCtx.userId, payload?.env || []);
+        json(res, 200, { success: true, env: envRows });
+      } catch (e) {
+        json(res, 500, { error: (e && e.message) || String(e) });
+      }
+      return;
+    }
+
     if (req.method === "POST" && url.pathname === "/api/update-model-lists") {
       try {
         let opencodeProviderOverride = "";
@@ -833,15 +2109,108 @@ export function startUiServer({
       return;
     }
 
+    if (req.method === "GET" && url.pathname === "/api/skillhub/status") {
+      const versionRes = await runSkillhub(["version"], { cwd: root, timeoutMs: 15_000 });
+      const whoRes = await runSkillhub(["whoami"], { cwd: root, timeoutMs: 15_000 });
+      json(res, 200, {
+        available: versionRes.ok,
+        version: versionRes.ok ? versionRes.stdout.trim() : "",
+        loggedIn: whoRes.ok,
+        user: whoRes.ok ? whoRes.stdout.trim() : "",
+        error: versionRes.ok ? "" : versionRes.error,
+      });
+      return;
+    }
+
+    if (req.method === "GET" && url.pathname === "/api/skillhub/list") {
+      const target = url.searchParams.get("target") || "global";
+      const agent = url.searchParams.get("agent") || "codex";
+      const args = ["list", "--json"];
+      if (target === "all") args.push("--all");
+      else if (target === "global") args.push("--global", "--agent", agent);
+      const result = await runSkillhub(args, { cwd: root });
+      if (!result.ok) {
+        json(res, 500, { error: result.error, stdout: result.stdout });
+        return;
+      }
+      json(res, 200, { skills: normalizeSkillhubListPayload(parseJsonText(result.stdout, [])) });
+      return;
+    }
+
+    if (req.method === "GET" && url.pathname === "/api/skillhub/search") {
+      const q = (url.searchParams.get("q") || "").trim();
+      if (!q) {
+        json(res, 200, { total: 0, items: [] });
+        return;
+      }
+      const result = await runSkillhub(["search", "-q", q], { cwd: root });
+      if (!result.ok) {
+        json(res, 500, { error: result.error, stdout: result.stdout });
+        return;
+      }
+      json(res, 200, normalizeSkillhubSearchPayload(parseJsonText(result.stdout, {})));
+      return;
+    }
+
+    if (req.method === "POST" && url.pathname === "/api/skillhub/install") {
+      let payload;
+      try {
+        payload = JSON.parse(await readBody(req));
+      } catch {
+        json(res, 400, { error: "Invalid JSON body" });
+        return;
+      }
+      const args = skillhubInstallArgs(payload);
+      if (!args) {
+        json(res, 400, { error: "Missing skill slug or collection" });
+        return;
+      }
+      const result = await runSkillhub(args, { cwd: root, timeoutMs: 180_000, maxBuffer: 4 * 1024 * 1024 });
+      if (!result.ok) {
+        json(res, 500, { error: result.error, stdout: result.stdout });
+        return;
+      }
+      json(res, 200, { ok: true, stdout: result.stdout });
+      return;
+    }
+
+    if (req.method === "POST" && url.pathname === "/api/skillhub/uninstall") {
+      let payload;
+      try {
+        payload = JSON.parse(await readBody(req));
+      } catch {
+        json(res, 400, { error: "Invalid JSON body" });
+        return;
+      }
+      const args = skillhubInstallArgs(payload, { uninstall: true });
+      if (!args) {
+        json(res, 400, { error: "Missing skill slug or collection" });
+        return;
+      }
+      const result = await runSkillhub(args, { cwd: root, timeoutMs: 120_000, maxBuffer: 4 * 1024 * 1024 });
+      if (!result.ok) {
+        json(res, 500, { error: result.error, stdout: result.stdout });
+        return;
+      }
+      json(res, 200, { ok: true, stdout: result.stdout });
+      return;
+    }
+
+    if (req.method === "POST" && url.pathname === "/api/skillhub/update") {
+      const result = await runSkillhub(["update"], { cwd: root, timeoutMs: 180_000, maxBuffer: 4 * 1024 * 1024 });
+      if (!result.ok) {
+        json(res, 500, { error: result.error, stdout: result.stdout });
+        return;
+      }
+      json(res, 200, { ok: true, stdout: result.stdout });
+      return;
+    }
+
     if (req.method === "GET" && url.pathname === "/api/nodes") {
       const flowId = url.searchParams.get("flowId");
       const flowSource = url.searchParams.get("flowSource") || "user";
       const lang = url.searchParams.get("lang") || "en";
-      if (!flowId) {
-        json(res, 400, { error: "Missing flowId" });
-        return;
-      }
-      if (!isValidFlowSourceRead(flowSource)) {
+      if (flowId && !isValidFlowSourceRead(flowSource)) {
         json(res, 400, { error: "Invalid flowSource" });
         return;
       }
@@ -849,7 +2218,60 @@ export function startUiServer({
       try {
         const { setLanguage } = await import("./i18n.mjs");
         setLanguage(lang);
-        json(res, 200, listNodesJson(root, flowId, flowSource, { archived: nodesArchived }));
+        json(res, 200, listNodesJson(root, flowId || "", flowId ? flowSource : "", { archived: nodesArchived, ...userCtx }));
+      } catch (e) {
+        json(res, 500, { error: (e && e.message) || String(e) });
+      }
+      return;
+    }
+
+    if (req.method === "GET" && url.pathname === "/api/nodes/detail") {
+      const nodeId = url.searchParams.get("id") || "";
+      const flowId = url.searchParams.get("flowId") || "";
+      const flowSource = url.searchParams.get("flowSource") || "";
+      if (!nodeId) {
+        json(res, 400, { error: "Missing node id" });
+        return;
+      }
+      if (flowId && !isValidFlowSourceRead(flowSource || "user")) {
+        json(res, 400, { error: "Invalid flowSource" });
+        return;
+      }
+      const archived = url.searchParams.get("archived") === "1";
+      try {
+        const detail = readNodeDetailJson(root, nodeId, flowId, flowId ? (flowSource || "user") : "", { archived, ...userCtx });
+        if (detail.error) {
+          json(res, 404, { error: detail.error });
+          return;
+        }
+        json(res, 200, detail);
+      } catch (e) {
+        json(res, 500, { error: (e && e.message) || String(e) });
+      }
+      return;
+    }
+
+    if (req.method === "GET" && url.pathname === "/api/nodes/file") {
+      const nodeId = url.searchParams.get("id") || "";
+      const relPath = url.searchParams.get("path") || "";
+      const flowId = url.searchParams.get("flowId") || "";
+      const flowSource = url.searchParams.get("flowSource") || "";
+      if (!nodeId || !relPath) {
+        json(res, 400, { error: "Missing node id or path" });
+        return;
+      }
+      if (flowId && !isValidFlowSourceRead(flowSource || "user")) {
+        json(res, 400, { error: "Invalid flowSource" });
+        return;
+      }
+      const archived = url.searchParams.get("archived") === "1";
+      try {
+        const file = readNodeFilePreview(root, nodeId, relPath, flowId, flowId ? (flowSource || "user") : "", { archived, ...userCtx });
+        if (file.error) {
+          json(res, 404, { error: file.error });
+          return;
+        }
+        json(res, 200, file);
       } catch (e) {
         json(res, 500, { error: (e && e.message) || String(e) });
       }
@@ -890,7 +2312,7 @@ export function startUiServer({
         return;
       }
       try {
-        const resolved = resolveFlowDirForWrite(root, flowId, flowSource);
+        const resolved = resolveFlowDirForWrite(root, flowId, flowSource, userCtx);
         if (resolved.error || !resolved.flowDir) {
           json(res, 400, { error: resolved.error || "Could not resolve flow directory" });
           return;
@@ -916,7 +2338,7 @@ export function startUiServer({
         const flowSource = payload?.flowSource || "user";
         let flowDir = "";
         if (flowId && isValidFlowSourceWrite(flowSource)) {
-          const resolved = resolveFlowDirForWrite(root, flowId, flowSource);
+          const resolved = resolveFlowDirForWrite(root, flowId, flowSource, userCtx);
           if (!resolved.error && resolved.flowDir) flowDir = resolved.flowDir;
         }
         const result = publishNodeFromInstance(root, payload || {}, { flowDir });
@@ -939,7 +2361,7 @@ export function startUiServer({
         return;
       }
       const flowArchived = url.searchParams.get("archived") === "1";
-      const result = readFlowJson(root, flowId, flowSource, { archived: flowArchived });
+      const result = readFlowJson(root, flowId, flowSource, { archived: flowArchived, ...userCtx });
       if (result.error) {
         json(res, 404, result);
         return;
@@ -965,7 +2387,7 @@ export function startUiServer({
           json(res, 400, { error: "Missing runUuid, instanceId, or content" });
           return;
         }
-        const runDir = path.join(getRunDir(root, payload.flowId || "unknown", runUuid));
+        const runDir = path.join(getRunDir(root, payload.flowId || "unknown", runUuid, userCtx));
         const outputPath = path.join(runDir, `output/${instanceId}/node_${instanceId}_content.md`);
         try {
           fs.mkdirSync(path.dirname(outputPath), { recursive: true });
@@ -1000,7 +2422,7 @@ ${content}
 
         const opencodeCmd = process.env.OPENCODE_CMD || "opencode";
         const tmpPromptFile = path.join(
-          getRunDir(root, payload.flowId || "unknown", runUuid),
+          getRunDir(root, payload.flowId || "unknown", runUuid, userCtx),
           "intermediate",
           `${instanceId}_ai_edit_prompt.txt`,
         );
@@ -1045,7 +2467,7 @@ ${content}
           json(res, 400, { error: "Missing runUuid or instanceId" });
           return;
         }
-        const runDir = path.join(getRunDir(root, payload.flowId || "unknown", runUuid));
+        const runDir = path.join(getRunDir(root, payload.flowId || "unknown", runUuid, userCtx));
         const resultPath = path.join(runDir, `intermediate/${instanceId}/${instanceId}.result.md`);
         try {
           fs.mkdirSync(path.dirname(resultPath), { recursive: true });
@@ -1075,7 +2497,7 @@ finishedAt: "${new Date().toISOString()}"
           json(res, 400, { error: "Missing runUuid, instanceId, or branch" });
           return;
         }
-        const runDir = path.join(getRunDir(root, payload.flowId || "unknown", runUuid));
+        const runDir = path.join(getRunDir(root, payload.flowId || "unknown", runUuid, userCtx));
         const resultPath = path.join(runDir, `intermediate/${instanceId}/${instanceId}.result.md`);
         try {
           fs.mkdirSync(path.dirname(resultPath), { recursive: true });
@@ -1123,7 +2545,7 @@ finishedAt: "${new Date().toISOString()}"
         return;
       }
       const flowArchived = Boolean(payload.flowArchived);
-      const result = writeFlowYaml(root, flowId, flowSource, flowYaml, { archived: flowArchived });
+      const result = writeFlowYaml(root, flowId, flowSource, flowYaml, { archived: flowArchived, ...userCtx });
       if (!result.success) {
         json(res, 400, result);
         return;
@@ -1151,7 +2573,7 @@ finishedAt: "${new Date().toISOString()}"
         return;
       }
       const flowArchived = Boolean(payload.flowArchived);
-      broadcastFlowEditorSync(flowId, flowSource, flowArchived);
+      broadcastFlowEditorSync(flowId, flowSource, flowArchived, userCtx.userId);
       json(res, 200, { ok: true });
       return;
     }
@@ -1168,7 +2590,7 @@ finishedAt: "${new Date().toISOString()}"
         return;
       }
       const flowArchived = url.searchParams.get("archived") === "1";
-      const key = flowEditorSyncKey(flowId, flowSource, flowArchived);
+      const key = flowEditorSyncKey(flowId, flowSource, flowArchived, userCtx.userId);
       let set = flowEditorSyncSubscribers.get(key);
       if (!set) {
         set = new Set();
@@ -1202,7 +2624,7 @@ finishedAt: "${new Date().toISOString()}"
         return;
       }
       const flowArchived = url.searchParams.get("archived") === "1";
-      const key = flowEditorSyncKey(flowId, flowSource, flowArchived);
+      const key = flowEditorSyncKey(flowId, flowSource, flowArchived, userCtx.userId);
       const serverVer = flowEditorSyncVersions.get(key) ?? 0;
       const clientVer = parseInt(url.searchParams.get("v") ?? "0", 10) || 0;
       json(res, 200, { version: serverVer, changed: serverVer > clientVer });
@@ -1232,7 +2654,7 @@ finishedAt: "${new Date().toISOString()}"
         json(res, 400, { error: "Invalid toSource" });
         return;
       }
-      const result = moveFlowDirectory(root, flowId.trim(), fromSource, toSource);
+      const result = moveFlowDirectory(root, flowId.trim(), fromSource, toSource, userCtx);
       if (!result.success) {
         json(res, 400, { error: result.error || "Move failed" });
         return;
@@ -1269,7 +2691,7 @@ finishedAt: "${new Date().toISOString()}"
         json(res, 200, { success: true, flowId, flowSource });
         return;
       }
-      const yamlRes = getFlowYamlAbs(root, flowId, flowSource, { archived: false });
+      const yamlRes = getFlowYamlAbs(root, flowId, flowSource, { archived: false, ...userCtx });
       if (yamlRes.error || !yamlRes.path) {
         json(res, 404, { error: yamlRes.error || "找不到流水线" });
         return;
@@ -1312,7 +2734,7 @@ finishedAt: "${new Date().toISOString()}"
         json(res, 400, { error: "仅支持归档用户目录或工作区流水线" });
         return;
       }
-      const result = archiveFlowPipeline(root, flowId, flowSource);
+      const result = archiveFlowPipeline(root, flowId, flowSource, userCtx);
       if (!result.success) {
         json(res, 400, { error: result.error || "归档失败" });
         return;
@@ -1345,7 +2767,7 @@ finishedAt: "${new Date().toISOString()}"
         json(res, 400, { error: "仅支持删除用户目录或工作区流水线" });
         return;
       }
-      const result = deleteFlowPipeline(root, flowId, flowSource, { archived: flowArchived });
+      const result = deleteFlowPipeline(root, flowId, flowSource, { archived: flowArchived, ...userCtx });
       if (!result.success) {
         json(res, 400, { error: result.error || "删除失败" });
         return;
@@ -1366,7 +2788,7 @@ finishedAt: "${new Date().toISOString()}"
         json(res, 400, { error: "Invalid flowSource" });
         return;
       }
-      const yamlRes = getFlowYamlAbs(root, flowId, flowSource, { archived: flowArchived });
+      const yamlRes = getFlowYamlAbs(root, flowId, flowSource, { archived: flowArchived, ...userCtx });
       if (yamlRes.error) {
         json(res, 404, { error: yamlRes.error });
         return;
@@ -1407,7 +2829,7 @@ finishedAt: "${new Date().toISOString()}"
         json(res, 400, { error: "Cannot save config to builtin or archived flow" });
         return;
       }
-      const yamlRes = getFlowYamlAbs(root, flowId, flowSource, { archived: flowArchived });
+      const yamlRes = getFlowYamlAbs(root, flowId, flowSource, { archived: flowArchived, ...userCtx });
       if (yamlRes.error) {
         json(res, 404, { error: yamlRes.error });
         return;
@@ -1437,12 +2859,12 @@ finishedAt: "${new Date().toISOString()}"
         json(res, 400, { error: "Invalid flowSource" });
         return;
       }
-      const result = readFlowSchedule(root, flowId, flowSource, { archived: flowArchived });
+      const result = readFlowSchedule(root, flowId, flowSource, { archived: flowArchived, ...userCtx });
       if (!result.success) {
         json(res, 400, { error: result.error || "Could not read schedule" });
         return;
       }
-      const status = listScheduleStatuses(root).find(
+      const status = listScheduleStatuses(root, userCtx).find(
         (s) => s.flowId === flowId && (s.flowSource || "user") === (flowSource || "user"),
       );
       json(res, 200, { schedule: result.schedule, state: result.state || {}, status: status || null });
@@ -1468,7 +2890,7 @@ finishedAt: "${new Date().toISOString()}"
         json(res, 400, { error: "Cannot save schedule to builtin or archived flow" });
         return;
       }
-      const result = writeFlowSchedule(root, flowId, flowSource, payload.schedule || {});
+      const result = writeFlowSchedule(root, flowId, flowSource, payload.schedule || {}, userCtx);
       if (!result.success) {
         json(res, 400, { error: result.error || "Could not save schedule" });
         return;
@@ -1491,7 +2913,8 @@ finishedAt: "${new Date().toISOString()}"
         return;
       }
       const runUuid = typeof payload.uuid === "string" ? payload.uuid.trim() : "";
-      if (activeFlowRuns.has(flowId)) {
+      const runKey = `${userCtx.userId || ""}:${payload.flowSource || "user"}:${flowId}`;
+      if (activeFlowRuns.has(runKey)) {
         json(res, 409, { error: "该流水线已在运行中" });
         return;
       }
@@ -1500,7 +2923,7 @@ finishedAt: "${new Date().toISOString()}"
       // UI 轮询会把 runMode 翻回 stopped，即便 CLI 正在运行也显示 PAUSED。
       if (runUuid) {
         try {
-          const runDir = getRunDir(root, flowId, runUuid);
+          const runDir = getRunDir(root, flowId, runUuid, userCtx);
           const interruptedPath = path.join(runDir, RUN_INTERRUPTED_FILENAME);
           if (fs.existsSync(interruptedPath)) fs.unlinkSync(interruptedPath);
         } catch (e) {
@@ -1542,7 +2965,7 @@ finishedAt: "${new Date().toISOString()}"
       const endSafe = () => {
         if (responseEnded) return;
         responseEnded = true;
-        activeFlowRuns.delete(flowId);
+        activeFlowRuns.delete(runKey);
         try {
           res.end();
         } catch (_) {}
@@ -1557,7 +2980,7 @@ finishedAt: "${new Date().toISOString()}"
         child = spawn(process.execPath, args, {
           cwd: root,
           stdio: ["ignore", "pipe", "pipe"],
-          env: { ...process.env, FORCE_COLOR: "0" },
+          env: runtimeEnvForUser(userCtx, { FORCE_COLOR: "0" }),
           // detached: true 使 child 成为新进程组 leader，/api/flow/run/stop 时
           // 用 process.kill(-pid) 可以一次性 SIGTERM 整棵进程树（含 cursor-agent 等孙进程）
           detached: true,
@@ -1570,7 +2993,7 @@ finishedAt: "${new Date().toISOString()}"
 
       /** @type {{ child: import("child_process").ChildProcess, runUuid: string | null }} */
       const runEntry = { child, runUuid: runUuid || null };
-      activeFlowRuns.set(flowId, runEntry);
+      activeFlowRuns.set(runKey, runEntry);
       log.debug(`[ui] flow/run: spawned pid=${child.pid} flowId=${flowId}${runUuid ? ` uuid=${runUuid}` : ""}`);
 
       let stdoutBuf = "";
@@ -1643,7 +3066,8 @@ finishedAt: "${new Date().toISOString()}"
         json(res, 400, { error: "Missing flowId" });
         return;
       }
-      const entry = activeFlowRuns.get(flowId);
+      const runKey = `${userCtx.userId || ""}:${payload.flowSource || "user"}:${flowId}`;
+      const entry = activeFlowRuns.get(runKey);
       if (!entry || !entry.child) {
         json(res, 404, { error: "该流水线未在运行" });
         return;
@@ -1661,10 +3085,10 @@ finishedAt: "${new Date().toISOString()}"
         try { entry.child.kill("SIGTERM"); } catch (_) {}
       }
       const uuid = entry.runUuid;
-      activeFlowRuns.delete(flowId);
+      activeFlowRuns.delete(runKey);
       if (uuid) {
         try {
-          const runDir = getRunDir(root, flowId, uuid);
+          const runDir = getRunDir(root, flowId, uuid, userCtx);
           fs.mkdirSync(runDir, { recursive: true });
           fs.writeFileSync(
             path.join(runDir, RUN_INTERRUPTED_FILENAME),
@@ -1684,6 +3108,38 @@ finishedAt: "${new Date().toISOString()}"
       return;
     }
 
+    if (req.method === "GET" && url.pathname === "/api/skill-collections") {
+      json(res, 200, readSkillCollectionConfig(userCtx, listComposerSkills(PACKAGE_ROOT, root)));
+      return;
+    }
+
+    if (req.method === "POST" && url.pathname === "/api/skill-collections") {
+      let payload;
+      try {
+        payload = JSON.parse(await readBody(req));
+      } catch {
+        json(res, 400, { error: "Invalid JSON body" });
+        return;
+      }
+      try {
+        json(res, 200, writeSkillCollectionConfig(userCtx, payload, listComposerSkills(PACKAGE_ROOT, root)));
+      } catch (e) {
+        json(res, 500, { error: (e && e.message) || String(e) });
+      }
+      return;
+    }
+
+    if (req.method === "GET" && url.pathname === "/api/skills/detail") {
+      const key = url.searchParams.get("key") || url.searchParams.get("name") || "";
+      const detail = readComposerSkillDetail(PACKAGE_ROOT, root, key);
+      if (!detail) {
+        json(res, 404, { error: "Skill not found" });
+        return;
+      }
+      json(res, 200, { skill: detail });
+      return;
+    }
+
     if (req.method === "POST" && url.pathname === "/api/composer-agent") {
       let payload;
       try {
@@ -1739,7 +3195,7 @@ finishedAt: "${new Date().toISOString()}"
           return;
         }
         const flowArchived = Boolean(payload.flowArchived);
-        const yamlRes = getFlowYamlAbs(root, flowId, flowSource, { archived: flowArchived });
+        const yamlRes = getFlowYamlAbs(root, flowId, flowSource, { archived: flowArchived, ...userCtx });
         if (yamlRes.error || !yamlRes.path) {
           json(res, 400, { error: yamlRes.error || "Could not resolve flow.yaml" });
           return;
@@ -1750,7 +3206,7 @@ finishedAt: "${new Date().toISOString()}"
         let editorSyncFlowSource = flowSource;
         let flowDirForCli = path.dirname(flowYamlAbs);
         if (flowSource === "builtin") {
-          const w = resolveFlowDirForWrite(root, flowId, "workspace");
+          const w = resolveFlowDirForWrite(root, flowId, "workspace", userCtx);
           if (w.error || !w.flowDir) {
             json(res, 400, { error: w.error || "Could not resolve workspace flow directory" });
             return;
@@ -1783,6 +3239,7 @@ finishedAt: "${new Date().toISOString()}"
           flowYamlAbs,
           flowId,
           flowSource,
+          userId: userCtx.userId || "",
           intents: multiStepIntents,
           canvasInstanceIds: instanceIds,
           skillsHint: multiStepResources.skillsHint,
@@ -1939,6 +3396,7 @@ finishedAt: "${new Date().toISOString()}"
             thread,
             phaseContext,
             phaseRole: phaseRole || undefined,
+            agentflowUserId: userCtx.userId || "",
             force: true,
             onStreamEvent,
           });
@@ -1952,7 +3410,7 @@ finishedAt: "${new Date().toISOString()}"
                   flowSource: flowSource || null,
                 });
                 if (flowId && flowSource) {
-                  broadcastFlowEditorSync(flowId, flowSource, Boolean(payload.flowArchived));
+                  broadcastFlowEditorSync(flowId, flowSource, Boolean(payload.flowArchived), userCtx.userId);
                 }
                 try { res.write(JSON.stringify({ type: "done" }) + "\n"); } catch (_) {}
               }
@@ -1989,6 +3447,7 @@ finishedAt: "${new Date().toISOString()}"
             cliWorkspace,
             prompt: finalPrompt,
             modelKey: typeof model === "string" ? model.trim() : "",
+            agentflowUserId: userCtx.userId || "",
             onStreamEvent,
           });
           child = handle.child;
@@ -2007,6 +3466,7 @@ finishedAt: "${new Date().toISOString()}"
                     flowYamlAbs,
                     flowContext: flowContextForMultiStep,
                     modelKey: typeof model === "string" ? model.trim() : "",
+                    agentflowUserId: userCtx.userId || "",
                     force: true,
                     onStreamEvent,
                     getAborted: () => clientDisconnected || responseEnded,
@@ -2029,7 +3489,7 @@ finishedAt: "${new Date().toISOString()}"
                   flowSource: flowSource || null,
                 });
                 if (flowYamlChanged && flowId && flowSource) {
-                  broadcastFlowEditorSync(flowId, flowSource, Boolean(payload.flowArchived));
+                  broadcastFlowEditorSync(flowId, flowSource, Boolean(payload.flowArchived), userCtx.userId);
                 }
                 try { res.write(JSON.stringify({ type: "done" }) + "\n"); } catch (_) {}
               }