@fieldwangai/agentflow 0.1.35 → 0.1.36

package/bin/lib/auth.mjs

@@ -23,6 +23,10 @@ function sessionsPath() {
   return path.join(authRoot(), "sessions.json");
 }
 
+function userAllowlistPath() {
+  return path.join(authRoot(), "user-allowlist.json");
+}
+
 function readJsonObject(filePath) {
   try {
     if (!fs.existsSync(filePath)) return {};
@@ -82,6 +86,57 @@ export function authSetupRequired() {
   return Object.keys(readAuthUsers()).length === 0;
 }
 
+function normalizeUserAllowlistInput(value) {
+  if (Array.isArray(value)) return value.map((item) => String(item || "").trim()).filter(Boolean);
+  if (typeof value === "string") {
+    return value
+      .split(/[\s,;]+/g)
+      .map((item) => item.trim())
+      .filter(Boolean);
+  }
+  return [];
+}
+
+export function readUserAllowlist() {
+  const fromEnv = normalizeUserAllowlistInput(process.env.AGENTFLOW_USER_WHITELIST || process.env.AGENTFLOW_ALLOWED_USERS || "");
+  let fromFile = [];
+  try {
+    const p = userAllowlistPath();
+    if (fs.existsSync(p)) {
+      const data = JSON.parse(fs.readFileSync(p, "utf-8"));
+      fromFile = normalizeUserAllowlistInput(Array.isArray(data) ? data : data?.users);
+    }
+  } catch {
+    fromFile = [];
+  }
+  const users = Array.from(new Set([...fromFile, ...fromEnv].map((item) => String(item || "").trim()).filter(Boolean)));
+  return { enabled: users.length > 0, users, path: userAllowlistPath() };
+}
+
+function userAllowlistMatchSet(users) {
+  const out = new Set();
+  for (const user of users) {
+    const raw = String(user || "").trim().toLowerCase();
+    if (raw) out.add(raw);
+    const safe = sanitizeAgentflowUserId(user);
+    if (safe) out.add(safe);
+  }
+  return out;
+}
+
+export function isAuthUserAllowed(user) {
+  const allowlist = readUserAllowlist();
+  if (!allowlist.enabled) return true;
+  const allowed = userAllowlistMatchSet(allowlist.users);
+  const candidates = [
+    String(user?.userId || "").trim().toLowerCase(),
+    String(user?.username || "").trim().toLowerCase(),
+    sanitizeAgentflowUserId(user?.userId),
+    sanitizeAgentflowUserId(user?.username),
+  ].filter(Boolean);
+  return candidates.some((candidate) => allowed.has(candidate));
+}
+
 function listFlowDirs(root) {
   try {
     if (!fs.existsSync(root) || !fs.statSync(root).isDirectory()) return [];
@@ -184,6 +239,9 @@ export function loginOrCreateUser(username, password) {
   if (!userId) {
     return { ok: false, error: "用户名须以字母开头，仅可使用字母、数字、下划线与连字符，最多 64 字符" };
   }
+  if (!isAuthUserAllowed({ userId, username: String(username || "").trim() })) {
+    return { ok: false, forbidden: true, error: "用户不在白名单中，请联系管理员开通访问权限" };
+  }
   const pwd = String(password || "");
   if (pwd.length < 4) return { ok: false, error: "密码至少 4 位" };
 

package/bin/lib/catalog-flows.mjs

@@ -257,11 +257,13 @@ export function listNodesJson(workspaceRoot, flowId, flowSource, opts = {}) {
   addFromDir(path.join(root, PROJECT_NODES_DIR), "project");
   for (const manifest of listMarketplaceNodes(root, marketplaceFlowData)) {
     let type = "agent";
-    const runtimeType = String(manifest.runtime?.type || manifest.type || "").toLowerCase();
+    const runtimeType = String(manifest.baseDefinitionId || manifest.runtime?.type || manifest.type || "").toLowerCase();
     if (runtimeType.startsWith("control")) type = "control";
     else if (runtimeType.startsWith("provide")) type = "provide";
     byId.set(manifest.definitionId, {
       id: manifest.definitionId,
+      baseDefinitionId: manifest.baseDefinitionId || manifest.runtime?.type || "",
+      marketplaceDefinitionId: manifest.definitionId,
       packageId: manifest.id,
       version: manifest.version,
       type,

package/bin/lib/composer-agent.mjs

@@ -269,6 +269,8 @@ function buildAgentStepPrompt(step, flowContext) {
     parts.push(
       "## 上下文已就绪（禁止 forage）\n" +
       "- 节点定义见上方 schema 表，**禁止** Glob/Read `builtin/nodes/`、`.workspace/agentflow/nodes/`、历史 `runBuild/` 来推断节点结构。\n" +
+      "- 默认不要读取、搜索或 Glob 历史运行产物；除非用户明确要求分析历史 run/log，否则检索时必须排除 `**/runBuild/**`、`**/logs/**`、`.workspace/agentflow/**/runBuild/**`、`~/agentflow/runBuild/**`、`node_modules/**`、`dist/**`。\n" +
+      "- 不要从历史 runBuild/logs 中推断业务事实、指标资产或 skill 文档；优先读取当前 workspace 的源文件、analytics-docs、skills、配置与用户给出的上下文。\n" +
       "- 目标 instance 的当前 YAML 已附上（若 instanceId 已知）；tool_nodejs 节点引用的 .mjs 脚本内容也已附上（若存在）。\n" +
       "- 如需查看整份 flow，仅在确实需要时读取一次。"
     );

package/bin/lib/git-worktree.mjs

@@ -165,8 +165,42 @@ export function listGitWorktrees(repoRoot) {
 }
 
 export function findRegisteredWorktree(repoRoot, worktreePath) {
-  const target = path.resolve(worktreePath);
-  return listGitWorktrees(repoRoot).find((entry) => path.resolve(entry.path) === target) || null;
+  const target = canonicalPathForCompare(worktreePath);
+  return listGitWorktrees(repoRoot).find((entry) => canonicalPathForCompare(entry.path) === target) || null;
+}
+
+function canonicalPathForCompare(rawPath) {
+  const abs = path.resolve(String(rawPath || ""));
+  try {
+    return fs.realpathSync.native(abs);
+  } catch {
+    /* missing path: canonicalize the nearest existing parent */
+  }
+  const missingParts = [];
+  let cursor = abs;
+  while (cursor && !fs.existsSync(cursor)) {
+    const parent = path.dirname(cursor);
+    if (parent === cursor) break;
+    missingParts.unshift(path.basename(cursor));
+    cursor = parent;
+  }
+  try {
+    return path.join(fs.realpathSync.native(cursor), ...missingParts);
+  } catch {
+    return abs;
+  }
+}
+
+function pruneGitWorktrees(repoRoot) {
+  const result = runGit(["worktree", "prune", "--expire", "now"], repoRoot);
+  if (result.status !== 0) {
+    throw new Error(`git worktree prune failed: ${result.stderr || result.stdout}`);
+  }
+}
+
+function isMissingRegisteredWorktreeError(result) {
+  const text = String(result?.stderr || result?.stdout || "");
+  return /missing but already registered worktree/i.test(text);
 }
 
 function branchExists(repoRoot, branch) {
@@ -187,7 +221,7 @@ function actualWorktreeBranch(worktreePath) {
   return branch === "HEAD" ? "DETACHED" : branch;
 }
 
-export function loadGitWorktree({ repoPath, branch = "", worktreePath = "", pipelineWorkspace }) {
+export function loadGitWorktree({ repoPath, branch = "", worktreePath = "", pipelineWorkspace, force = false, pruneMissing = true }) {
   const repoRoot = resolveGitRepoRoot(repoPath);
   const wantedBranch = String(branch || "").trim();
   const target = path.resolve(worktreePath || defaultWorktreePath(pipelineWorkspace || repoRoot, repoRoot, wantedBranch));
@@ -196,7 +230,7 @@ export function loadGitWorktree({ repoPath, branch = "", worktreePath = "", pipe
     throw new Error(`branch does not exist in repoPath: ${wantedBranch}`);
   }
 
-  const registered = findRegisteredWorktree(repoRoot, target);
+  let registered = findRegisteredWorktree(repoRoot, target);
   if (fs.existsSync(target)) {
     if (!registered) {
       throw new Error(`worktreePath exists but is not registered for repoPath: ${target}`);
@@ -205,11 +239,26 @@ export function loadGitWorktree({ repoPath, branch = "", worktreePath = "", pipe
       throw new Error(`worktreePath branch mismatch: expected ${wantedBranch}, got ${registered.branch || "DETACHED"}`);
     }
   } else {
+    if (registered && pruneMissing) {
+      pruneGitWorktrees(repoRoot);
+      registered = findRegisteredWorktree(repoRoot, target);
+    }
+    if (registered && !force) {
+      throw new Error(`worktreePath is missing but still registered: ${target}; set pruneMissing=true or force=true`);
+    }
     fs.mkdirSync(path.dirname(target), { recursive: true });
-    const args = wantedBranch
-      ? ["worktree", "add", target, wantedBranch]
-      : ["worktree", "add", "--detach", target, "HEAD"];
-    const result = runGit(args, repoRoot);
+    const args = ["worktree", "add"];
+    if (force) args.push("--force");
+    if (wantedBranch) {
+      args.push(target, wantedBranch);
+    } else {
+      args.push("--detach", target, "HEAD");
+    }
+    let result = runGit(args, repoRoot);
+    if (result.status !== 0 && pruneMissing && isMissingRegisteredWorktreeError(result)) {
+      pruneGitWorktrees(repoRoot);
+      result = runGit(args, repoRoot);
+    }
     if (result.status !== 0) {
       throw new Error(`git worktree add failed: ${result.stderr || result.stdout}`);
     }

package/bin/lib/locales/en.json

@@ -329,6 +329,10 @@
       "displayName": "Image Display",
       "description": "Preview an image URL, data URL, or image path on the Workspace canvas and pass the source downstream"
     },
+    "display_chart": {
+      "displayName": "Chart Display",
+      "description": "Render ChartSpec/ECharts JSON on the Workspace canvas and pass the JSON downstream"
+    },
     "provide_str": {
       "displayName": "Text",
       "description": "Provide a text value directly, value will be passed to downstream as-is"

package/bin/lib/locales/zh.json

@@ -329,6 +329,10 @@
       "displayName": "图片展示",
       "description": "在 Workspace 画布中预览图片 URL、data URL 或图片路径，并将来源继续传给下游"
     },
+    "display_chart": {
+      "displayName": "图表展示",
+      "description": "在 Workspace 画布中渲染 ChartSpec/ECharts JSON，并将 JSON 继续传给下游"
+    },
     "provide_str": {
       "displayName": "文本",
       "description": "直接提供一段文本，value 会原样供下游引用"

package/bin/lib/marketplace.mjs

@@ -85,12 +85,21 @@ function normalizeManifest(raw, packageDir, source = "workspace") {
   const version = raw.version != null ? String(raw.version).trim() : "";
   if (!id || !version) return null;
   const runtime = raw.runtime && typeof raw.runtime === "object" ? raw.runtime : {};
+  const baseDefinitionId =
+    raw.baseDefinitionId != null && String(raw.baseDefinitionId).trim() !== ""
+      ? String(raw.baseDefinitionId).trim()
+      : raw.sourceDefinitionId != null && String(raw.sourceDefinitionId).trim() !== ""
+        ? String(raw.sourceDefinitionId).trim()
+        : runtime.type != null && String(runtime.type).trim() !== ""
+          ? String(runtime.type).trim()
+          : "";
   return {
     ...raw,
     id,
     version,
     packageDir,
     definitionId: `marketplace:${id}@${version}`,
+    baseDefinitionId,
     displayName: raw.displayName != null ? String(raw.displayName) : raw.name != null ? String(raw.name) : id,
     description: raw.description != null ? String(raw.description) : "",
     input: normalizeSlotList(raw.input || raw.inputs),
@@ -176,8 +185,11 @@ function depMatchesNode(dep, id, version) {
 }
 
 function instanceMatchesNode(inst, id, version) {
-  const parsed = parseMarketplaceDefinitionId(inst?.definitionId);
-  return Boolean(parsed && parsed.id === id && (!parsed.version || parsed.version === version));
+  const parsed =
+    parseMarketplaceDefinitionId(inst?.definitionId) ||
+    parseMarketplaceDefinitionId(inst?.marketplaceRef);
+  if (parsed) return Boolean(parsed.id === id && (!parsed.version || parsed.version === version));
+  return inst?.marketplacePackageId === id && (inst?.marketplaceVersion == null || String(inst.marketplaceVersion) === version);
 }
 
 export function listMarketplaceNodeUsages(workspaceRoot, id, version, opts = {}) {
@@ -349,6 +361,7 @@ export function listMarketplacePackages(workspaceRoot, opts = {}) {
     id: n.id,
     version: n.version,
     definitionId: n.definitionId,
+    baseDefinitionId: n.baseDefinitionId,
     displayName: n.displayName,
     description: n.description,
     inputs: n.input,
@@ -440,7 +453,7 @@ export function writeFlowMarketplaceLock(workspaceRoot, flowDir, flowData) {
   if (!flowData || !flowData.instances || typeof flowData.instances !== "object") return null;
   const nodes = {};
   for (const inst of Object.values(flowData.instances)) {
-    const defId = inst && inst.definitionId;
+    const defId = inst && (inst.marketplaceRef || inst.definitionId);
     const resolved = resolveMarketplaceNodePackage(workspaceRoot, flowDir, defId, flowData);
     if (!resolved) continue;
     nodes[resolved.id] = {
@@ -630,6 +643,7 @@ export function publishNodeFromInstance(workspaceRoot, payload = {}, options = {
   const label = String(payload.label || payload.instanceId || "node").trim();
   const id = safePackageId(payload.id || payload.packageId || label);
   const version = normalizeVersion(payload.version || "1.0.0");
+  const sourceDefinitionId = String(payload.definitionId || "").trim();
   if (!id) return { ok: false, error: "Invalid package id" };
 
   const inputs = normalizeSlotList(payload.inputs || payload.input).map((slot) => ({
@@ -667,7 +681,7 @@ export function publishNodeFromInstance(workspaceRoot, payload = {}, options = {
           command: script,
         }
       : {
-          type: "agent_subAgent",
+          type: sourceDefinitionId || "agent_subAgent",
         }
   );
   const manifest = {
@@ -675,6 +689,7 @@ export function publishNodeFromInstance(workspaceRoot, payload = {}, options = {
     version,
     name: label,
     description,
+    baseDefinitionId: sourceDefinitionId || runtime.type || "agent_subAgent",
     runtime,
     inputs,
     outputs,
@@ -693,6 +708,8 @@ export function publishNodeFromInstance(workspaceRoot, payload = {}, options = {
     version,
     packageDir: dest,
     definitionId: `marketplace:${id}@${version}`,
+    baseDefinitionId: manifest.baseDefinitionId,
+    marketplaceDefinitionId: `marketplace:${id}@${version}`,
     packagedFiles: packagedScript?.packagedFiles || [],
   };
 }

package/bin/lib/runtime-context.mjs

@@ -1,4 +1,5 @@
 import path from "path";
+import yaml from "js-yaml";
 import { getFlowDir } from "./workspace.mjs";
 import { PACKAGE_ROOT, PIPELINES_DIR } from "./paths.mjs";
 import { listSkills, listSkillsFromSources, workspaceSkillSources } from "./skill-registry.mjs";
@@ -118,6 +119,7 @@ function skillBodyFromRegistryItem(skill) {
     name: skill.name,
     key: skill.key,
     description: skill.description,
+    frontmatter: skill.frontmatter,
     source: skill.source,
     sourceLabel: skill.sourceLabel,
     path: skill.path,
@@ -201,6 +203,7 @@ export function buildSkillsContext({ workspaceContext, source = "current-workspa
       name: s.name,
       key: s.key,
       description: s.description,
+      frontmatter: s.frontmatter,
       sourceLabel: s.sourceLabel,
       path: s.path,
       body: s.body,
@@ -208,18 +211,33 @@ export function buildSkillsContext({ workspaceContext, source = "current-workspa
   };
 }
 
+function renderSkillFrontmatter(frontmatter) {
+  if (!frontmatter || typeof frontmatter !== "object" || Array.isArray(frontmatter)) return "";
+  const extra = Object.fromEntries(
+    Object.entries(frontmatter).filter(([key, value]) => {
+      if (key === "name" || key === "description") return false;
+      if (value == null) return false;
+      if (typeof value === "string" && value.trim() === "") return false;
+      return true;
+    }),
+  );
+  if (Object.keys(extra).length === 0) return "";
+  return yaml.dump(extra, { lineWidth: 100, noRefs: true }).trim();
+}
+
 export function renderSkillsContextForPrompt(skillsContext) {
   const ctx = normalizeSkillsContext(skillsContext);
   if (!ctx || !Array.isArray(ctx.skillBodies) || ctx.skillBodies.length === 0) return "";
   const blocks = ctx.skillBodies.slice(0, 20).map((skill) => {
     const body = String(skill.body || "").trim();
-    return [
+    const frontmatter = renderSkillFrontmatter(skill.frontmatter);
+    const header = [
       `### ${skill.name}`,
       skill.description ? `说明：${skill.description}` : "",
       `来源：${skill.path || skill.sourceLabel || ""}`,
-      "",
-      body.slice(0, 16000),
+      frontmatter ? `元数据：\n${frontmatter}` : "",
     ].filter(Boolean).join("\n");
+    return [header, body.slice(0, 16000)].filter(Boolean).join("\n\n");
   });
-  return ["## 已加载 Skills", "", ...blocks].join("\n\n");
+  return ["## 已加载 Skills", ...blocks].join("\n\n");
 }

package/bin/lib/skill-registry.mjs

@@ -38,7 +38,8 @@ function parseSkillFrontmatter(content) {
   const match = String(content || "").match(/^---\s*\r?\n([\s\S]*?)\r?\n---/);
   if (!match) return {};
   try {
-    return yaml.load(match[1]) || {};
+    const parsed = yaml.load(match[1]) || {};
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
   } catch {
     return {};
   }
@@ -58,6 +59,7 @@ export function parseSkillFile(absPath, source = {}) {
     id: name,
     name,
     description: String(meta.description || "").trim(),
+    frontmatter: meta,
     source: sourceId,
     sourceLabel,
     path: absPath,