@fieldwangai/agentflow 0.1.38 → 0.1.40

package/bin/lib/agent-runners.mjs

@@ -9,7 +9,7 @@ import { normalizeCursorModelForCli } from "./model-config.mjs";
 import { appendRunLogLine } from "./run-events.mjs";
 import { writeWithPrefix } from "./terminal.mjs";
 import { t } from "./i18n.mjs";
-import { readUserEnvObject } from "./user-env.mjs";
+import { readMergedEnvObject } from "./user-env.mjs";
 import { outputNodeBasename } from "../pipeline/get-exec-id.mjs";
 
 function shouldPassCursorModelArg(model) {
@@ -20,7 +20,7 @@ function shouldPassCursorModelArg(model) {
 function childEnv(options = {}, extra = {}) {
   const optEnv = options && options.env && typeof options.env === "object" ? options.env : {};
   const userId = optEnv.AGENTFLOW_USER_ID || process.env.AGENTFLOW_USER_ID || "";
-  return { ...process.env, ...readUserEnvObject(userId), ...optEnv, ...extra };
+  return { ...process.env, ...readMergedEnvObject(userId), ...optEnv, ...extra };
 }
 
 function writeAgentTextArtifacts(absResultPath, absRunDir, instanceId, text) {

package/bin/lib/apply.mjs

@@ -23,7 +23,7 @@ import { formatDuration } from "./terminal.mjs";
 import { printEntryAndFlowFiles, printNodeStatusTable, runValidateFlowAndExitIfInvalid } from "./ui-print.mjs";
 import { clearApplyActiveLock, writeApplyActiveLock } from "./run-apply-active-lock.mjs";
 import { ensureReference, findFlowNameByUuid, getFlowDir, getRunDir } from "./workspace.mjs";
-import { readUserEnvObject } from "./user-env.mjs";
+import { readMergedEnvObject } from "./user-env.mjs";
 
 const PARALLEL_PREFIX_COLORS = [
   (s) => chalk.cyan(s),
@@ -347,7 +347,7 @@ ${currentContent}
                     
 	                    const result = spawnSync(opencodeCmd, ["--prompt-file", tmpPromptFile, "--print"], {
 	                      cwd: workspaceRoot,
-	                      env: { ...process.env, ...readUserEnvObject(process.env.AGENTFLOW_USER_ID || ""), OPENCODE_NON_INTERACTIVE: "1" },
+	                      env: { ...process.env, ...readMergedEnvObject(process.env.AGENTFLOW_USER_ID || ""), OPENCODE_NON_INTERACTIVE: "1" },
 	                      stdio: ["ignore", "pipe", "pipe"],
 	                    });
                     

package/bin/lib/composer-agent.mjs

@@ -5,9 +5,10 @@
  *   用户 prompt → planner 分解 → [script 直执 | agent 子调用(按复杂度选模型)] → sync UI
  */
 import fs from "fs";
+import os from "os";
 import path from "path";
-import { getAgentflowDataRoot, sanitizeAgentflowUserId } from "./paths.mjs";
-import { readUserEnvObject } from "./user-env.mjs";
+import { getAgentflowDataRoot, getAgentflowUserDataRoot, sanitizeAgentflowUserId } from "./paths.mjs";
+import { readMergedEnvObject } from "./user-env.mjs";
 import { resolveCliAndModel } from "./model-config.mjs";
 import { runClaudeCodeAgentWithPrompt, runCursorAgentWithPrompt, runOpenCodeAgentWithPrompt } from "./agent-runners.mjs";
 import { planComposerTasks, hasPlannerApiAvailable, shouldUsePhased, classifyComplexity, classifyTaskComplexity, PHASED_DEFINITIONS } from "./composer-planner.mjs";
@@ -24,9 +25,68 @@ const MAX_PROMPT_CHARS = 500_000;
 const MAX_COMPOSER_VALIDATION_REPAIR = 5;
 const MAX_SCRIPT_INJECT_BYTES = 30_000;
 
+function readJsonObject(filePath) {
+  try {
+    if (!fs.existsSync(filePath)) return {};
+    const data = JSON.parse(fs.readFileSync(filePath, "utf-8"));
+    return data && typeof data === "object" && !Array.isArray(data) ? data : {};
+  } catch {
+    return {};
+  }
+}
+
+function readUserMcpPrivateEnvObject(userId) {
+  const safe = sanitizeAgentflowUserId(userId);
+  const data = readJsonObject(path.join(getAgentflowUserDataRoot(safe), "mcp-private.json"));
+  const servers = data?.servers && typeof data.servers === "object" && !Array.isArray(data.servers) ? data.servers : {};
+  const env = {};
+  for (const server of Object.values(servers)) {
+    const serverEnv = server?.env && typeof server.env === "object" && !Array.isArray(server.env) ? server.env : {};
+    for (const [key, value] of Object.entries(serverEnv)) {
+      const envKey = String(key || "").trim();
+      if (envKey) env[envKey] = String(value ?? "");
+    }
+  }
+  return env;
+}
+
+function pruneCursorMcpPrivateEnvPlaceholders() {
+  const filePath = path.join(os.homedir(), ".cursor", "mcp.json");
+  const config = readJsonObject(filePath);
+  const servers = config?.mcpServers && typeof config.mcpServers === "object" && !Array.isArray(config.mcpServers)
+    ? config.mcpServers
+    : null;
+  if (!servers) return;
+  let changed = false;
+  const nextServers = {};
+  for (const [name, raw] of Object.entries(servers)) {
+    const server = raw && typeof raw === "object" && !Array.isArray(raw) ? { ...raw } : raw;
+    const privateEnvKeys = Array.isArray(server?.__agentflowPrivateKeys?.env)
+      ? server.__agentflowPrivateKeys.env.map((key) => String(key || "").trim()).filter(Boolean)
+      : [];
+    if (!privateEnvKeys.length || !server?.env || typeof server.env !== "object" || Array.isArray(server.env)) {
+      nextServers[name] = server;
+      continue;
+    }
+    const nextEnv = { ...server.env };
+    for (const key of privateEnvKeys) {
+      if (Object.prototype.hasOwnProperty.call(nextEnv, key) && String(nextEnv[key] ?? "") === "") {
+        delete nextEnv[key];
+        changed = true;
+      }
+    }
+    nextServers[name] = { ...server, env: nextEnv };
+    if (Object.keys(nextEnv).length === 0) delete nextServers[name].env;
+  }
+  if (!changed) return;
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, JSON.stringify({ ...config, mcpServers: nextServers }, null, 2) + "\n", "utf-8");
+}
+
 function agentflowUserEnv(userId) {
   const safe = sanitizeAgentflowUserId(userId);
-  return safe ? { ...readUserEnvObject(safe), AGENTFLOW_USER_ID: safe } : {};
+  pruneCursorMcpPrivateEnvPlaceholders();
+  return { ...readMergedEnvObject(safe), ...(safe ? readUserMcpPrivateEnvObject(safe) : {}), AGENTFLOW_USER_ID: safe };
 }
 
 // ─── script 内容注入辅助 ─────────────────────────────────────────────────

package/bin/lib/marketplace.mjs

@@ -449,6 +449,24 @@ export function deleteMarketplaceNodePackage(workspaceRoot, id, version, opts =
   return { ok: true, id, version, packageDir };
 }
 
+export function deleteMarketplaceFlowSnippetPackage(workspaceRoot, id, version) {
+  const packageDir = resolveWorkspaceFlowSnippetPackageDir(workspaceRoot, id, version);
+  if (!packageDir) return { ok: false, error: "Invalid flow snippet id or version" };
+  if (!fs.existsSync(path.join(packageDir, FLOW_SNIPPET_MANIFEST))) {
+    return { ok: false, error: `Flow snippet package not found: ${id}@${version}` };
+  }
+  fs.rmSync(packageDir, { recursive: true, force: true });
+  const versionRoot = path.dirname(packageDir);
+  try {
+    if (fs.existsSync(versionRoot) && fs.readdirSync(versionRoot).length === 0) {
+      fs.rmdirSync(versionRoot);
+    }
+  } catch {
+    /* keep non-empty or unreadable parent */
+  }
+  return { ok: true, id, version, packageDir };
+}
+
 export function writeFlowMarketplaceLock(workspaceRoot, flowDir, flowData) {
   if (!flowData || !flowData.instances || typeof flowData.instances !== "object") return null;
   const nodes = {};

package/bin/lib/scheduler.mjs

@@ -12,7 +12,7 @@ import {
 import { getAgentflowUserContexts, getRunDir, PACKAGE_ROOT } from "./paths.mjs";
 import { isApplyProcessAlive } from "./run-apply-active-lock.mjs";
 import { log } from "./log.mjs";
-import { readUserEnvObject } from "./user-env.mjs";
+import { readMergedEnvObject } from "./user-env.mjs";
 import { writeResult } from "../pipeline/write-result.mjs";
 
 const DEFAULT_POLL_MS = 30_000;
@@ -258,7 +258,7 @@ function startScheduledRun(workspaceRoot, flow, schedule, state, opts = {}) {
   const child = spawn(process.execPath, args, {
     cwd: path.resolve(workspaceRoot),
     stdio: ["ignore", "pipe", "pipe"],
-    env: { ...process.env, ...readUserEnvObject(opts.userId), FORCE_COLOR: "0", AGENTFLOW_USER_ID: opts.userId || "" },
+    env: { ...process.env, ...readMergedEnvObject(opts.userId), FORCE_COLOR: "0", AGENTFLOW_USER_ID: opts.userId || "" },
     detached: true,
   });
 
@@ -331,7 +331,7 @@ function startWaitingRunResume(workspaceRoot, flow, waitState, opts = {}) {
   const child = spawn(process.execPath, args, {
     cwd: path.resolve(workspaceRoot),
     stdio: ["ignore", "pipe", "pipe"],
-    env: { ...process.env, ...readUserEnvObject(opts.userId), FORCE_COLOR: "0", AGENTFLOW_USER_ID: opts.userId || "" },
+    env: { ...process.env, ...readMergedEnvObject(opts.userId), FORCE_COLOR: "0", AGENTFLOW_USER_ID: opts.userId || "" },
     detached: true,
   });
   child.stdout.on("data", () => {});

package/bin/lib/ui-server.mjs

@@ -77,6 +77,7 @@ import { runNodeScript } from "./pipeline-scripts.mjs";
 import { readFlowSchedule, writeFlowSchedule } from "./schedule-config.mjs";
 import { listScheduleStatuses } from "./scheduler.mjs";
 import {
+  deleteMarketplaceFlowSnippetPackage,
   deleteMarketplaceNodePackage,
   installFlowDependency,
   listMarketplaceFlowSnippets,
@@ -96,7 +97,7 @@ import {
   logoutRequest,
   readUserAllowlist,
 } from "./auth.mjs";
-import { readUserEnvObject, readUserEnvRows, writeUserEnvRows } from "./user-env.mjs";
+import { readGlobalEnvRows, readMergedEnvObject, readUserEnvRows, writeGlobalEnvRows, writeUserEnvRows } from "./user-env.mjs";
 import {
   readAdminBuiltinPipelineConfig,
   updateAdminBuiltinPipelineConfig,
@@ -189,7 +190,6 @@ function writeFeedbackItems(items) {
 function createFeedbackItem(payload, user) {
   const title = String(payload?.title || "").trim().slice(0, 120);
   const content = String(payload?.content || "").trim().slice(0, 5000);
-  const contact = String(payload?.contact || "").trim().slice(0, 160);
   const pageUrl = String(payload?.pageUrl || "").trim().slice(0, 500);
   if (!title) return { error: "Missing feedback title" };
   if (!content) return { error: "Missing feedback content" };
@@ -198,7 +198,6 @@ function createFeedbackItem(payload, user) {
       id: `fb_${Date.now().toString(36)}_${crypto.randomBytes(5).toString("hex")}`,
       title,
       content,
-      contact,
       pageUrl,
       userId: String(user?.userId || ""),
       username: String(user?.username || user?.userId || ""),
@@ -389,7 +388,7 @@ function removeSkillhubCollectionGroup(userCtx = {}, collectionId = "", root = p
 function runtimeEnvForUser(userCtx = {}, extra = {}) {
   return {
     ...process.env,
-    ...readUserEnvObject(userCtx.userId),
+    ...readMergedEnvObject(userCtx.userId),
     ...extra,
     AGENTFLOW_USER_ID: userCtx.userId || "",
   };
@@ -564,8 +563,6 @@ function writeCursorMcpServer(payload = {}, userCtx = {}) {
     env: omitObjectKeys(server.env || {}, privateEnvKeys),
     headers: omitObjectKeys(server.headers || {}, privateHeaderKeys),
   };
-  publicServer.env = withPrivatePlaceholders(publicServer.env, privateEnvKeys);
-  publicServer.headers = withPrivatePlaceholders(publicServer.headers, privateHeaderKeys);
   if (privateEnvKeys.size || privateHeaderKeys.size) {
     publicServer.__agentflowPrivateKeys = {
       ...(privateEnvKeys.size ? { env: Array.from(privateEnvKeys) } : {}),
@@ -1368,6 +1365,125 @@ function workspaceSetOutputSlot(instance, name, value) {
   };
 }
 
+function workspaceSourceSlotForEdge(graph, edge) {
+  const instances = graph?.instances && typeof graph.instances === "object" ? graph.instances : {};
+  const source = instances[String(edge?.source || "")];
+  const output = Array.isArray(source?.output) ? source.output : [];
+  return output[workspaceHandleIndex(edge?.sourceHandle, "output")] || null;
+}
+
+function workspaceOutputSlotValueForEdge(graph, outputs, edge) {
+  const sourceId = String(edge?.source || "");
+  const slot = workspaceSourceSlotForEdge(graph, edge);
+  if (slot && String(slot?.type || "") !== "node") {
+    const value = workspaceSlotValue(slot);
+    if (value.trim()) return value;
+  }
+  const out = outputs.get(sourceId);
+  if (out != null && String(out).trim()) return String(out);
+  const instances = graph?.instances && typeof graph.instances === "object" ? graph.instances : {};
+  return workspaceInstanceText(instances[sourceId]);
+}
+
+function workspaceParseJsonObjectFromText(text) {
+  const raw = String(text || "").trim();
+  if (!raw) return null;
+  const candidates = [raw];
+  const fenced = raw.match(/```(?:json)?\s*([\s\S]*?)```/i);
+  if (fenced?.[1]) candidates.unshift(fenced[1].trim());
+  const first = raw.indexOf("{");
+  const last = raw.lastIndexOf("}");
+  if (first >= 0 && last > first) candidates.unshift(raw.slice(first, last + 1));
+  for (const candidate of candidates) {
+    try {
+      const parsed = JSON.parse(candidate);
+      if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) return parsed;
+    } catch {
+      /* try next */
+    }
+  }
+  return null;
+}
+
+function workspaceStringifyOutputValue(value) {
+  if (value == null) return "";
+  return typeof value === "string" ? value : JSON.stringify(value, null, 2);
+}
+
+function workspaceStructuredAgentOutput(content) {
+  const raw = String(content || "").trim();
+  const parsed = workspaceParseJsonObjectFromText(raw);
+  if (!parsed) return { result: raw, outParams: {}, structured: false, parsed: null };
+  const hasEnvelope = Object.prototype.hasOwnProperty.call(parsed, "result") ||
+    Object.prototype.hasOwnProperty.call(parsed, "outParams");
+  if (!hasEnvelope) return { result: raw, outParams: {}, structured: false, parsed };
+  const outParamsRaw = parsed.outParams && typeof parsed.outParams === "object" && !Array.isArray(parsed.outParams)
+    ? parsed.outParams
+    : {};
+  const outParams = {};
+  for (const [key, value] of Object.entries(outParamsRaw)) {
+    const name = String(key || "").trim();
+    if (name) outParams[name] = workspaceStringifyOutputValue(value);
+  }
+  return {
+    result: workspaceStringifyOutputValue(parsed.result ?? ""),
+    outParams,
+    structured: true,
+    parsed,
+  };
+}
+
+function workspaceExtractNamedOutputValue(content, slotName) {
+  const name = String(slotName || "").trim();
+  if (!name) return "";
+  const structured = workspaceStructuredAgentOutput(content);
+  if (Object.prototype.hasOwnProperty.call(structured.outParams, name)) {
+    return String(structured.outParams[name] ?? "");
+  }
+  const parsed = structured.parsed || workspaceParseJsonObjectFromText(content);
+  if (parsed && Object.prototype.hasOwnProperty.call(parsed, name)) {
+    const value = parsed[name];
+    return workspaceStringifyOutputValue(value);
+  }
+  const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const patterns = [
+    new RegExp(`(?:\\$\\{${escaped}\\}|\\$${escaped})\\s*[=:：]\\s*([^\\n\\r]+)`, "i"),
+    new RegExp(`(?:^|[\\n\\r])\\s*${escaped}\\s*[=:：]\\s*([^\\n\\r]+)`, "i"),
+  ];
+  for (const pattern of patterns) {
+    const match = pattern.exec(String(content || ""));
+    if (!match?.[1]) continue;
+    return match[1].replace(/^["'`]|["'`]$/g, "").trim();
+  }
+  return "";
+}
+
+function workspaceApplyAgentOutputSlots(instance, content) {
+  const structured = workspaceStructuredAgentOutput(content);
+  const text = String(structured.result || "").trim();
+  let changed = false;
+  const next = {
+    ...(instance || {}),
+    output: (Array.isArray(instance?.output) ? instance.output : []).map((slot, index) => {
+      const name = String(slot?.name || "").trim();
+      const type = String(slot?.type || "");
+      if (type === "node" || name === "next" || !name) return slot;
+      let value = "";
+      if (name === "result" || name === "content" || index === 0) {
+        value = text;
+      } else if (Object.prototype.hasOwnProperty.call(structured.outParams, name)) {
+        value = structured.outParams[name];
+      } else {
+        value = workspaceExtractNamedOutputValue(text, name);
+      }
+      if (!value) return slot;
+      changed = true;
+      return { ...slot, default: value, value };
+    }),
+  };
+  return { instance: changed ? next : instance, changed };
+}
+
 function workspaceResolvePath(baseCwd, raw) {
   const text = String(raw || "").trim();
   if (!text) return "";
@@ -1452,25 +1568,25 @@ function workspaceDownstreamDisplayRequirements(graph, nodeId) {
   if (kinds.size === 0) return "";
   const rules = [];
   if (kinds.has("html")) {
-    rules.push("- 下游连接了 HTML 展示节点：输出可直接放入 iframe 渲染的 HTML。可以是完整 HTML 文档或 HTML fragment；不要使用 Markdown 代码围栏；不要解释生成过程。");
+    rules.push("- 下游连接了 HTML 展示节点：将可直接放入 iframe 渲染的 HTML 放在输出协议的 `result` 字段中。可以是完整 HTML 文档或 HTML fragment；不要使用 Markdown 代码围栏。");
   }
   if (kinds.has("markdown")) {
-    rules.push("- 下游连接了 Markdown 展示节点：输出 Markdown 正文；不要包裹在代码围栏中，除非正文确实需要代码块。");
+    rules.push("- 下游连接了 Markdown 展示节点：将 Markdown 正文放在输出协议的 `result` 字段中；除非正文确实需要代码块，否则不要额外包裹代码围栏。");
   }
   if (kinds.has("mermaid")) {
-    rules.push("- 下游连接了 Mermaid 展示节点：只输出 Mermaid 图表代码，例如 flowchart/sequenceDiagram；不要使用 Markdown 代码围栏；不要附加解释。");
+    rules.push("- 下游连接了 Mermaid 展示节点：将 Mermaid 图表代码放在输出协议的 `result` 字段中，例如 flowchart/sequenceDiagram；不要使用 Markdown 代码围栏。");
   }
   if (kinds.has("ascii")) {
-    rules.push("- 下游连接了 ASCII 展示节点：输出纯文本/ASCII 图或表格；不要输出 HTML 或 Markdown 装饰。");
+    rules.push("- 下游连接了 ASCII 展示节点：将纯文本/ASCII 图或表格放在输出协议的 `result` 字段中；不要输出 HTML 或 Markdown 装饰。");
   }
   if (kinds.has("image")) {
-    rules.push("- 下游连接了图片展示节点：输出可作为 img src 使用的图片地址、data URL 或 base64 data URL；不要输出 Markdown 图片语法或解释文字。");
+    rules.push("- 下游连接了图片展示节点：将可作为 img src 使用的图片地址、data URL 或 base64 data URL 放在输出协议的 `result` 字段中；不要输出 Markdown 图片语法。");
   }
   if (kinds.has("chart")) {
-    rules.push('- 下游连接了 Chart 展示节点：只输出 ChartSpec JSON 对象，不要 Markdown 代码围栏，不要解释文字。格式必须包含 `"type":"chart"`、`"version":"1.0"`、`"renderer":"echarts"`、`"option"`；`option.series[].type` 只使用 line/bar/pie/scatter/radar/heatmap/tree/treemap/sunburst/sankey/graph/gauge/funnel；不要输出 HTML、script、iframe 或 JS 函数。');
+    rules.push('- 下游连接了 Chart 展示节点：将 ChartSpec JSON 对象放在输出协议的 `result` 字段中。ChartSpec 必须包含 `"type":"chart"`、`"version":"1.0"`、`"renderer":"echarts"`、`"option"`；`option.series[].type` 只使用 line/bar/pie/scatter/radar/heatmap/tree/treemap/sunburst/sankey/graph/gauge/funnel；不要输出 HTML、script、iframe 或 JS 函数。');
   }
   if (kinds.has("table")) {
-    rules.push('- 下游连接了表格展示节点：优先只输出表格 JSON，不要解释文字。推荐格式：`{"columns":["列名1","列名2"],"rows":[["值1","值2"]]}`；也可输出对象数组、Markdown 表格、CSV 或 TSV。不要输出 HTML。');
+    rules.push('- 下游连接了表格展示节点：将表格数据放在输出协议的 `result` 字段中。推荐格式：`{"columns":["列名1","列名2"],"rows":[["值1","值2"]]}`；也可使用对象数组、Markdown 表格、CSV 或 TSV。不要输出 HTML。');
   }
   return [
     "## 下游输出要求",
@@ -1481,6 +1597,35 @@ function workspaceDownstreamDisplayRequirements(graph, nodeId) {
   ].join("\n");
 }
 
+function workspaceOutputProtocolRequirements(graph, nodeId) {
+  const instance = graph?.instances?.[nodeId] || {};
+  const slots = (Array.isArray(instance.output) ? instance.output : [])
+    .filter((slot) => {
+      const name = String(slot?.name || "").trim();
+      const type = String(slot?.type || "");
+      return name && type !== "node" && name !== "next" && name !== "result" && name !== "content";
+    })
+    .map((slot) => String(slot.name).trim());
+  const outParamsExample = slots.length
+    ? Object.fromEntries(slots.map((name) => [name, `<${name} 的值>`]))
+    : {};
+  return [
+    "## Workspace 输出协议",
+    "",
+    "最终回复必须是一个 JSON 对象，不要使用 Markdown 代码围栏，不要在 JSON 外追加解释文字。",
+    "固定格式：",
+    "",
+    JSON.stringify({ result: "<给用户看的完整正文>", outParams: outParamsExample }, null, 2),
+    "",
+    "- `result`：完整正文，写入 `result` / `content` 输出口，直连默认展示节点时展示它。",
+    "- `outParams`：具名输出参数，只写入同名输出引脚。",
+    ...(slots.length
+      ? [`- 当前节点具名输出槽：${slots.map((name) => `\`${name}\``).join("、")}。例如任务要求写入 \`${slots[0]}\` 时，放到 \`outParams.${slots[0]}\`。`]
+      : ["- 当前节点没有额外具名输出槽，`outParams` 返回空对象即可。"]),
+    "- 如果 `result` 需要承载表格、ChartSpec、HTML 等结构化内容，可把对象或字符串放入 `result`；系统会把它转换给下游展示节点。",
+  ].join("\n");
+}
+
 function workspaceRunPlan(graph, runNodeId) {
   const instances = graph?.instances && typeof graph.instances === "object" ? graph.instances : {};
   const edges = Array.isArray(graph?.edges) ? graph.edges : [];
@@ -1541,10 +1686,7 @@ function workspaceUpstreamText(graph, nodeId, outputs) {
   const incoming = edges.filter((edge) => String(edge?.target || "") === String(nodeId));
   const contentEdge = incoming.find((edge) => String(edge?.targetHandle || "") === "input-1") || incoming[0];
   if (!contentEdge) return "";
-  const sourceId = String(contentEdge.source || "");
-  const out = outputs.get(sourceId);
-  if (out != null && String(out).trim()) return String(out);
-  return workspaceInstanceText(instances[sourceId]);
+  return workspaceOutputSlotValueForEdge(graph, outputs, contentEdge);
 }
 
 function workspaceHandleIndex(handle, prefix) {
@@ -1572,10 +1714,7 @@ function workspaceTaskUpstreamText(graph, nodeId, outputs) {
   const contentEdges = incoming.filter((edge) => !isWorkspaceSemanticInputSlot(workspaceTargetSlotForEdge(graph, edge)));
   const contentEdge = contentEdges.find((edge) => String(edge?.targetHandle || "") === "input-1") || contentEdges[0];
   if (!contentEdge) return "";
-  const sourceId = String(contentEdge.source || "");
-  const out = outputs.get(sourceId);
-  if (out != null && String(out).trim()) return String(out);
-  return workspaceInstanceText(instances[sourceId]);
+  return workspaceOutputSlotValueForEdge(graph, outputs, contentEdge);
 }
 
 function parseWorkspaceSkillKeys(raw) {
@@ -1726,7 +1865,7 @@ function workspaceWriteDisplayContent(instance, content) {
   return next;
 }
 
-function workspaceUpdateDirectDisplays(graph, sourceId, content) {
+function workspaceUpdateDirectDisplays(graph, sourceId, content, outputs = null) {
   const instances = graph?.instances && typeof graph.instances === "object" ? graph.instances : {};
   const edges = Array.isArray(graph?.edges) ? graph.edges : [];
   const updated = [];
@@ -1735,7 +1874,8 @@ function workspaceUpdateDirectDisplays(graph, sourceId, content) {
     const targetId = String(edge?.target || "");
     const target = instances[targetId];
     if (!target || !workspaceDisplayKind(target.definitionId)) continue;
-    instances[targetId] = workspaceWriteDisplayContent(target, content);
+    const value = outputs ? workspaceOutputSlotValueForEdge(graph, outputs, edge) : String(content || "");
+    instances[targetId] = workspaceWriteDisplayContent(target, value || content);
     updated.push(targetId);
   }
   return updated;
@@ -1746,14 +1886,16 @@ function workspaceNodePrompt(graph, nodeId, upstreamText, skillsBlock, mcpBlock
   const body = String(instance.body || "").trim();
   const label = String(instance.label || nodeId).trim();
   const downstreamRequirements = workspaceDownstreamDisplayRequirements(graph, nodeId);
+  const outputProtocolRequirements = workspaceOutputProtocolRequirements(graph, nodeId);
   return [
     "你正在执行 AgentFlow Workspace 画布中的一个临时节点。",
-    "只输出该节点要传给下游展示/后续节点的正文，不要解释运行过程。",
+    "按 Workspace 输出协议返回该节点要传给下游展示/后续节点的数据。",
     workspaceSearchGuardrailsBlock(),
     skillsBlock ? `\n## Available Skills\n\n${skillsBlock}` : "",
     mcpBlock ? `\n## Available MCP\n\n${mcpBlock}` : "",
     upstreamText ? `\n## 上游上下文\n\n${upstreamText}` : "",
     downstreamRequirements ? `\n${downstreamRequirements}` : "",
+    outputProtocolRequirements ? `\n${outputProtocolRequirements}` : "",
     `\n## 当前节点\n\n- id: ${nodeId}\n- label: ${label}\n- definitionId: ${instance.definitionId || ""}`,
     `\n## 节点任务\n\n${body || upstreamText}`,
   ].filter(Boolean).join("\n");
@@ -1843,7 +1985,7 @@ async function runWorkspaceGraph(root, scopedRoot, payload, userCtx = {}, opts =
         )),
       };
       outputs.set(nodeId, skillsBlock);
-      workspaceUpdateDirectDisplays(graph, nodeId, skillsBlock);
+      workspaceUpdateDirectDisplays(graph, nodeId, skillsBlock, outputs);
       emit({ type: "graph", nodeId, graph });
       emit({ type: "node-done", nodeId, definitionId: defId });
       continue;
@@ -1863,7 +2005,7 @@ async function runWorkspaceGraph(root, scopedRoot, payload, userCtx = {}, opts =
         )),
       };
       outputs.set(nodeId, mcpBlock);
-      workspaceUpdateDirectDisplays(graph, nodeId, mcpBlock);
+      workspaceUpdateDirectDisplays(graph, nodeId, mcpBlock, outputs);
       emit({ type: "graph", nodeId, graph });
       emit({ type: "node-done", nodeId, definitionId: defId });
       continue;
@@ -2165,9 +2307,13 @@ async function runWorkspaceGraph(root, scopedRoot, payload, userCtx = {}, opts =
         throw e;
       }
     }
-    outputs.set(nodeId, content);
-    const updatedDisplays = workspaceUpdateDirectDisplays(graph, nodeId, content);
-    if (updatedDisplays.length) emit({ type: "graph", nodeId, displayNodeIds: updatedDisplays, graph });
+    const normalizedAgentOutput = workspaceStructuredAgentOutput(content);
+    const resultContent = normalizedAgentOutput.result || content;
+    outputs.set(nodeId, resultContent);
+    const slotUpdate = workspaceApplyAgentOutputSlots(instance, content);
+    if (slotUpdate.changed) graph.instances[nodeId] = slotUpdate.instance;
+    const updatedDisplays = workspaceUpdateDirectDisplays(graph, nodeId, resultContent, outputs);
+    if (slotUpdate.changed || updatedDisplays.length) emit({ type: "graph", nodeId, displayNodeIds: updatedDisplays, graph });
     emit({ type: "node-done", nodeId, definitionId: defId });
   }
   if (pauseNodeIds.length > 0) {
@@ -3568,7 +3714,11 @@ export function startUiServer({
 
     if (req.method === "GET" && url.pathname === "/api/user-env") {
       try {
-        json(res, 200, { env: readUserEnvRows(userCtx.userId) });
+        json(res, 200, {
+          env: readUserEnvRows(userCtx.userId),
+          globalEnv: authUser?.isAdmin ? readGlobalEnvRows() : [],
+          canEditGlobalEnv: Boolean(authUser?.isAdmin),
+        });
       } catch (e) {
         json(res, 500, { error: (e && e.message) || String(e) });
       }
@@ -3584,8 +3734,20 @@ export function startUiServer({
         return;
       }
       try {
+        if (Object.prototype.hasOwnProperty.call(payload || {}, "globalEnv") && !authUser?.isAdmin) {
+          json(res, 403, { error: "Admin permission required" });
+          return;
+        }
         const envRows = writeUserEnvRows(userCtx.userId, payload?.env || []);
-        json(res, 200, { success: true, env: envRows });
+        const globalEnvRows = authUser?.isAdmin && Object.prototype.hasOwnProperty.call(payload || {}, "globalEnv")
+          ? writeGlobalEnvRows(payload?.globalEnv || [])
+          : readGlobalEnvRows();
+        json(res, 200, {
+          success: true,
+          env: envRows,
+          globalEnv: authUser?.isAdmin ? globalEnvRows : [],
+          canEditGlobalEnv: Boolean(authUser?.isAdmin),
+        });
       } catch (e) {
         json(res, 500, { error: (e && e.message) || String(e) });
       }
@@ -3849,6 +4011,22 @@ export function startUiServer({
       return;
     }
 
+    if (req.method === "DELETE" && url.pathname === "/api/marketplace/flow-snippet") {
+      const id = url.searchParams.get("id") || "";
+      const version = url.searchParams.get("version") || "";
+      if (!id || !version) {
+        json(res, 400, { ok: false, error: "Missing flow snippet id or version" });
+        return;
+      }
+      try {
+        const result = deleteMarketplaceFlowSnippetPackage(root, id, version);
+        json(res, result.ok ? 200 : 400, result);
+      } catch (e) {
+        json(res, 500, { ok: false, error: (e && e.message) || String(e) });
+      }
+      return;
+    }
+
     if (req.method === "POST" && url.pathname === "/api/marketplace/install-node") {
       let payload;
       try {

package/bin/lib/user-env.mjs

@@ -2,7 +2,7 @@ import fs from "fs";
 import os from "os";
 import path from "path";
 
-import { getAgentflowUserEnvAbs, sanitizeAgentflowUserId } from "./paths.mjs";
+import { getAgentflowDataRoot, getAgentflowUserEnvAbs, sanitizeAgentflowUserId } from "./paths.mjs";
 
 function normalizeEnvKey(key) {
   return String(key || "").trim();
@@ -60,6 +60,35 @@ export function readUserEnvObject(userId) {
   return out;
 }
 
+function getGlobalEnvAbs() {
+  return path.join(getAgentflowDataRoot(), "admin", "env.json");
+}
+
+export function readGlobalEnvRows() {
+  const data = readJsonObject(getGlobalEnvAbs());
+  return normalizeUserEnvRows(Array.isArray(data.env) ? data.env : []);
+}
+
+export function readGlobalEnvObject() {
+  const out = {};
+  for (const row of readGlobalEnvRows()) {
+    out[row.key] = row.value;
+  }
+  return out;
+}
+
+export function writeGlobalEnvRows(rows) {
+  const normalized = normalizeUserEnvRows(rows);
+  const filePath = getGlobalEnvAbs();
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, JSON.stringify({ version: 1, env: normalized }, null, 2) + "\n", "utf-8");
+  return normalized;
+}
+
+export function readMergedEnvObject(userId) {
+  return { ...readGlobalEnvObject(), ...readUserEnvObject(userId) };
+}
+
 export function writeUserEnvRows(userId, rows) {
   const normalized = normalizeUserEnvRows(rows);
   const safeUserId = sanitizeAgentflowUserId(userId);
@@ -74,10 +103,11 @@ export function resolveUserEnvValue(key, userId) {
   if (!keyStr) return "";
   const userEnv = readUserEnvObject(userId);
   if (Object.prototype.hasOwnProperty.call(userEnv, keyStr)) return String(userEnv[keyStr] ?? "");
+  const globalEnv = readGlobalEnvObject();
+  if (Object.prototype.hasOwnProperty.call(globalEnv, keyStr)) return String(globalEnv[keyStr] ?? "");
   const processValue = process.env[keyStr];
   if (processValue != null && processValue !== "") return String(processValue);
   const configPath = path.join(os.homedir(), ".cursor", "config.json");
   const fromConfig = getFromConfig(readJsonObject(configPath), keyStr);
   return fromConfig !== undefined ? fromConfig : "";
 }
-

package/bin/pipeline/run-tool-nodejs.mjs

@@ -19,7 +19,7 @@ import path from "path";
 import { fileURLToPath } from "url";
 
 import { getRunDir } from "../lib/paths.mjs";
-import { readUserEnvObject } from "../lib/user-env.mjs";
+import { readMergedEnvObject } from "../lib/user-env.mjs";
 import { validateAndParse } from "./validate-script-output.mjs";
 import { writeResult } from "./write-result.mjs";
 import { loadExecId, outputNodeBasename, outputDirForNode } from "./get-exec-id.mjs";
@@ -31,7 +31,7 @@ const MAX_RETRIES = 3;
 const RETRY_DELAY_MS = 1000;
 
 function runtimeEnv() {
-  return { ...process.env, ...readUserEnvObject(process.env.AGENTFLOW_USER_ID || "") };
+  return { ...process.env, ...readMergedEnvObject(process.env.AGENTFLOW_USER_ID || "") };
 }
 
 function runOnce(workspaceRoot, flowName, uuid, instanceId, execId, scriptArgs) {