@fieldwangai/agentflow 0.1.39 → 0.1.41

package/bin/lib/agent-runners.mjs

@@ -9,7 +9,7 @@ import { normalizeCursorModelForCli } from "./model-config.mjs";
 import { appendRunLogLine } from "./run-events.mjs";
 import { writeWithPrefix } from "./terminal.mjs";
 import { t } from "./i18n.mjs";
-import { readUserEnvObject } from "./user-env.mjs";
+import { readMergedEnvObject } from "./user-env.mjs";
 import { outputNodeBasename } from "../pipeline/get-exec-id.mjs";
 
 function shouldPassCursorModelArg(model) {
@@ -20,7 +20,7 @@ function shouldPassCursorModelArg(model) {
 function childEnv(options = {}, extra = {}) {
   const optEnv = options && options.env && typeof options.env === "object" ? options.env : {};
   const userId = optEnv.AGENTFLOW_USER_ID || process.env.AGENTFLOW_USER_ID || "";
-  return { ...process.env, ...readUserEnvObject(userId), ...optEnv, ...extra };
+  return { ...process.env, ...readMergedEnvObject(userId), ...optEnv, ...extra };
 }
 
 function writeAgentTextArtifacts(absResultPath, absRunDir, instanceId, text) {

package/bin/lib/apply.mjs

@@ -23,7 +23,7 @@ import { formatDuration } from "./terminal.mjs";
 import { printEntryAndFlowFiles, printNodeStatusTable, runValidateFlowAndExitIfInvalid } from "./ui-print.mjs";
 import { clearApplyActiveLock, writeApplyActiveLock } from "./run-apply-active-lock.mjs";
 import { ensureReference, findFlowNameByUuid, getFlowDir, getRunDir } from "./workspace.mjs";
-import { readUserEnvObject } from "./user-env.mjs";
+import { readMergedEnvObject } from "./user-env.mjs";
 
 const PARALLEL_PREFIX_COLORS = [
   (s) => chalk.cyan(s),
@@ -347,7 +347,7 @@ ${currentContent}
                     
 	                    const result = spawnSync(opencodeCmd, ["--prompt-file", tmpPromptFile, "--print"], {
 	                      cwd: workspaceRoot,
-	                      env: { ...process.env, ...readUserEnvObject(process.env.AGENTFLOW_USER_ID || ""), OPENCODE_NON_INTERACTIVE: "1" },
+	                      env: { ...process.env, ...readMergedEnvObject(process.env.AGENTFLOW_USER_ID || ""), OPENCODE_NON_INTERACTIVE: "1" },
 	                      stdio: ["ignore", "pipe", "pipe"],
 	                    });
                     

package/bin/lib/composer-agent.mjs

@@ -5,9 +5,10 @@
  *   用户 prompt → planner 分解 → [script 直执 | agent 子调用(按复杂度选模型)] → sync UI
  */
 import fs from "fs";
+import os from "os";
 import path from "path";
-import { getAgentflowDataRoot, sanitizeAgentflowUserId } from "./paths.mjs";
-import { readUserEnvObject } from "./user-env.mjs";
+import { getAgentflowDataRoot, getAgentflowUserDataRoot, sanitizeAgentflowUserId } from "./paths.mjs";
+import { readMergedEnvObject } from "./user-env.mjs";
 import { resolveCliAndModel } from "./model-config.mjs";
 import { runClaudeCodeAgentWithPrompt, runCursorAgentWithPrompt, runOpenCodeAgentWithPrompt } from "./agent-runners.mjs";
 import { planComposerTasks, hasPlannerApiAvailable, shouldUsePhased, classifyComplexity, classifyTaskComplexity, PHASED_DEFINITIONS } from "./composer-planner.mjs";
@@ -24,9 +25,68 @@ const MAX_PROMPT_CHARS = 500_000;
 const MAX_COMPOSER_VALIDATION_REPAIR = 5;
 const MAX_SCRIPT_INJECT_BYTES = 30_000;
 
+function readJsonObject(filePath) {
+  try {
+    if (!fs.existsSync(filePath)) return {};
+    const data = JSON.parse(fs.readFileSync(filePath, "utf-8"));
+    return data && typeof data === "object" && !Array.isArray(data) ? data : {};
+  } catch {
+    return {};
+  }
+}
+
+function readUserMcpPrivateEnvObject(userId) {
+  const safe = sanitizeAgentflowUserId(userId);
+  const data = readJsonObject(path.join(getAgentflowUserDataRoot(safe), "mcp-private.json"));
+  const servers = data?.servers && typeof data.servers === "object" && !Array.isArray(data.servers) ? data.servers : {};
+  const env = {};
+  for (const server of Object.values(servers)) {
+    const serverEnv = server?.env && typeof server.env === "object" && !Array.isArray(server.env) ? server.env : {};
+    for (const [key, value] of Object.entries(serverEnv)) {
+      const envKey = String(key || "").trim();
+      if (envKey) env[envKey] = String(value ?? "");
+    }
+  }
+  return env;
+}
+
+function pruneCursorMcpPrivateEnvPlaceholders() {
+  const filePath = path.join(os.homedir(), ".cursor", "mcp.json");
+  const config = readJsonObject(filePath);
+  const servers = config?.mcpServers && typeof config.mcpServers === "object" && !Array.isArray(config.mcpServers)
+    ? config.mcpServers
+    : null;
+  if (!servers) return;
+  let changed = false;
+  const nextServers = {};
+  for (const [name, raw] of Object.entries(servers)) {
+    const server = raw && typeof raw === "object" && !Array.isArray(raw) ? { ...raw } : raw;
+    const privateEnvKeys = Array.isArray(server?.__agentflowPrivateKeys?.env)
+      ? server.__agentflowPrivateKeys.env.map((key) => String(key || "").trim()).filter(Boolean)
+      : [];
+    if (!privateEnvKeys.length || !server?.env || typeof server.env !== "object" || Array.isArray(server.env)) {
+      nextServers[name] = server;
+      continue;
+    }
+    const nextEnv = { ...server.env };
+    for (const key of privateEnvKeys) {
+      if (Object.prototype.hasOwnProperty.call(nextEnv, key) && String(nextEnv[key] ?? "") === "") {
+        delete nextEnv[key];
+        changed = true;
+      }
+    }
+    nextServers[name] = { ...server, env: nextEnv };
+    if (Object.keys(nextEnv).length === 0) delete nextServers[name].env;
+  }
+  if (!changed) return;
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, JSON.stringify({ ...config, mcpServers: nextServers }, null, 2) + "\n", "utf-8");
+}
+
 function agentflowUserEnv(userId) {
   const safe = sanitizeAgentflowUserId(userId);
-  return safe ? { ...readUserEnvObject(safe), AGENTFLOW_USER_ID: safe } : {};
+  pruneCursorMcpPrivateEnvPlaceholders();
+  return { ...readMergedEnvObject(safe), ...(safe ? readUserMcpPrivateEnvObject(safe) : {}), AGENTFLOW_USER_ID: safe };
 }
 
 // ─── script 内容注入辅助 ─────────────────────────────────────────────────

package/bin/lib/scheduler.mjs

@@ -12,7 +12,7 @@ import {
 import { getAgentflowUserContexts, getRunDir, PACKAGE_ROOT } from "./paths.mjs";
 import { isApplyProcessAlive } from "./run-apply-active-lock.mjs";
 import { log } from "./log.mjs";
-import { readUserEnvObject } from "./user-env.mjs";
+import { readMergedEnvObject } from "./user-env.mjs";
 import { writeResult } from "../pipeline/write-result.mjs";
 
 const DEFAULT_POLL_MS = 30_000;
@@ -258,7 +258,7 @@ function startScheduledRun(workspaceRoot, flow, schedule, state, opts = {}) {
   const child = spawn(process.execPath, args, {
     cwd: path.resolve(workspaceRoot),
     stdio: ["ignore", "pipe", "pipe"],
-    env: { ...process.env, ...readUserEnvObject(opts.userId), FORCE_COLOR: "0", AGENTFLOW_USER_ID: opts.userId || "" },
+    env: { ...process.env, ...readMergedEnvObject(opts.userId), FORCE_COLOR: "0", AGENTFLOW_USER_ID: opts.userId || "" },
     detached: true,
   });
 
@@ -331,7 +331,7 @@ function startWaitingRunResume(workspaceRoot, flow, waitState, opts = {}) {
   const child = spawn(process.execPath, args, {
     cwd: path.resolve(workspaceRoot),
     stdio: ["ignore", "pipe", "pipe"],
-    env: { ...process.env, ...readUserEnvObject(opts.userId), FORCE_COLOR: "0", AGENTFLOW_USER_ID: opts.userId || "" },
+    env: { ...process.env, ...readMergedEnvObject(opts.userId), FORCE_COLOR: "0", AGENTFLOW_USER_ID: opts.userId || "" },
     detached: true,
   });
   child.stdout.on("data", () => {});

package/bin/lib/ui-server.mjs

@@ -97,7 +97,7 @@ import {
   logoutRequest,
   readUserAllowlist,
 } from "./auth.mjs";
-import { readUserEnvObject, readUserEnvRows, writeUserEnvRows } from "./user-env.mjs";
+import { readGlobalEnvRows, readMergedEnvObject, readUserEnvRows, writeGlobalEnvRows, writeUserEnvRows } from "./user-env.mjs";
 import {
   readAdminBuiltinPipelineConfig,
   updateAdminBuiltinPipelineConfig,
@@ -190,7 +190,6 @@ function writeFeedbackItems(items) {
 function createFeedbackItem(payload, user) {
   const title = String(payload?.title || "").trim().slice(0, 120);
   const content = String(payload?.content || "").trim().slice(0, 5000);
-  const contact = String(payload?.contact || "").trim().slice(0, 160);
   const pageUrl = String(payload?.pageUrl || "").trim().slice(0, 500);
   if (!title) return { error: "Missing feedback title" };
   if (!content) return { error: "Missing feedback content" };
@@ -199,7 +198,6 @@ function createFeedbackItem(payload, user) {
       id: `fb_${Date.now().toString(36)}_${crypto.randomBytes(5).toString("hex")}`,
       title,
       content,
-      contact,
       pageUrl,
       userId: String(user?.userId || ""),
       username: String(user?.username || user?.userId || ""),
@@ -390,7 +388,7 @@ function removeSkillhubCollectionGroup(userCtx = {}, collectionId = "", root = p
 function runtimeEnvForUser(userCtx = {}, extra = {}) {
   return {
     ...process.env,
-    ...readUserEnvObject(userCtx.userId),
+    ...readMergedEnvObject(userCtx.userId),
     ...extra,
     AGENTFLOW_USER_ID: userCtx.userId || "",
   };
@@ -565,8 +563,6 @@ function writeCursorMcpServer(payload = {}, userCtx = {}) {
     env: omitObjectKeys(server.env || {}, privateEnvKeys),
     headers: omitObjectKeys(server.headers || {}, privateHeaderKeys),
   };
-  publicServer.env = withPrivatePlaceholders(publicServer.env, privateEnvKeys);
-  publicServer.headers = withPrivatePlaceholders(publicServer.headers, privateHeaderKeys);
   if (privateEnvKeys.size || privateHeaderKeys.size) {
     publicServer.__agentflowPrivateKeys = {
       ...(privateEnvKeys.size ? { env: Array.from(privateEnvKeys) } : {}),
@@ -1369,6 +1365,188 @@ function workspaceSetOutputSlot(instance, name, value) {
   };
 }
 
+function workspaceSourceSlotForEdge(graph, edge) {
+  const instances = graph?.instances && typeof graph.instances === "object" ? graph.instances : {};
+  const source = instances[String(edge?.source || "")];
+  const output = Array.isArray(source?.output) ? source.output : [];
+  return output[workspaceHandleIndex(edge?.sourceHandle, "output")] || null;
+}
+
+function workspaceOutputSlotValueForEdge(graph, outputs, edge) {
+  const sourceId = String(edge?.source || "");
+  const slot = workspaceSourceSlotForEdge(graph, edge);
+  if (slot && String(slot?.type || "") !== "node") {
+    const value = workspaceSlotValue(slot);
+    if (value.trim()) return value;
+  }
+  const out = outputs.get(sourceId);
+  if (out != null && String(out).trim()) return String(out);
+  const instances = graph?.instances && typeof graph.instances === "object" ? graph.instances : {};
+  return workspaceInstanceText(instances[sourceId]);
+}
+
+function workspaceParseJsonObjectFromText(text) {
+  const raw = String(text || "").trim();
+  if (!raw) return null;
+  const candidates = [raw];
+  const fenced = raw.match(/```(?:json)?\s*([\s\S]*?)```/i);
+  if (fenced?.[1]) candidates.unshift(fenced[1].trim());
+  const first = raw.indexOf("{");
+  const last = raw.lastIndexOf("}");
+  if (first >= 0 && last > first) candidates.unshift(raw.slice(first, last + 1));
+  for (const candidate of candidates) {
+    try {
+      const parsed = JSON.parse(candidate);
+      if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) return parsed;
+    } catch {
+      /* try next */
+    }
+  }
+  return null;
+}
+
+function workspaceStringifyOutputValue(value) {
+  if (value == null) return "";
+  return typeof value === "string" ? value : JSON.stringify(value, null, 2);
+}
+
+function workspaceUnescapeLooseJsonString(value) {
+  return String(value ?? "")
+    .replace(/\\n/g, "\n")
+    .replace(/\\r/g, "\r")
+    .replace(/\\t/g, "\t")
+    .replace(/\\"/g, '"')
+    .replace(/\\\\/g, "\\")
+    .trim();
+}
+
+function workspaceExtractLooseOutParams(raw) {
+  const text = String(raw || "");
+  const out = {};
+  const startMatch = /["']outParams["']\s*:\s*\{/i.exec(text);
+  if (!startMatch) return out;
+  const start = startMatch.index + startMatch[0].length;
+  const end = text.indexOf("}", start);
+  const block = end >= start ? text.slice(start, end) : text.slice(start);
+  const pairRe = /["']?([A-Za-z_][A-Za-z0-9_-]*)["']?\s*:\s*(?:"([^"]*)"|'([^']*)'|([^,\n\r}]+))/g;
+  let match;
+  while ((match = pairRe.exec(block))) {
+    const key = String(match[1] || "").trim();
+    const value = match[2] ?? match[3] ?? match[4] ?? "";
+    if (key) out[key] = workspaceUnescapeLooseJsonString(value).replace(/^["'`]|["'`]$/g, "").trim();
+  }
+  return out;
+}
+
+function workspaceExtractLooseResult(raw) {
+  const text = String(raw || "").trim();
+  const resultMatch = /["']result["']\s*:\s*(["'])/i.exec(text);
+  if (!resultMatch) return "";
+  const quote = resultMatch[1];
+  const start = resultMatch.index + resultMatch[0].length;
+  const outParamsMatch = /,\s*["']outParams["']\s*:/i.exec(text.slice(start));
+  if (outParamsMatch) {
+    const end = start + outParamsMatch.index;
+    let value = text.slice(start, end).trim();
+    if (value.endsWith(quote)) value = value.slice(0, -1);
+    return workspaceUnescapeLooseJsonString(value);
+  }
+  const end = text.lastIndexOf(quote);
+  if (end > start) return workspaceUnescapeLooseJsonString(text.slice(start, end));
+  return "";
+}
+
+function workspaceStructuredAgentOutput(content) {
+  const raw = String(content || "").trim();
+  const parsed = workspaceParseJsonObjectFromText(raw);
+  if (!parsed) {
+    const looseResult = workspaceExtractLooseResult(raw);
+    const looseOutParams = workspaceExtractLooseOutParams(raw);
+    if (looseResult || Object.keys(looseOutParams).length) {
+      return {
+        result: looseResult || raw,
+        outParams: looseOutParams,
+        structured: true,
+        parsed: null,
+      };
+    }
+    return { result: raw, outParams: {}, structured: false, parsed: null };
+  }
+  const hasEnvelope = Object.prototype.hasOwnProperty.call(parsed, "result") ||
+    Object.prototype.hasOwnProperty.call(parsed, "outParams");
+  if (!hasEnvelope) return { result: raw, outParams: {}, structured: false, parsed };
+  const outParamsRaw = parsed.outParams && typeof parsed.outParams === "object" && !Array.isArray(parsed.outParams)
+    ? parsed.outParams
+    : {};
+  const outParams = {};
+  for (const [key, value] of Object.entries(outParamsRaw)) {
+    const name = String(key || "").trim();
+    if (name) outParams[name] = workspaceStringifyOutputValue(value);
+  }
+  return {
+    result: workspaceStringifyOutputValue(parsed.result ?? ""),
+    outParams,
+    structured: true,
+    parsed,
+  };
+}
+
+function workspaceExtractNamedOutputValue(content, slotName) {
+  const name = String(slotName || "").trim();
+  if (!name) return "";
+  const structured = workspaceStructuredAgentOutput(content);
+  if (Object.prototype.hasOwnProperty.call(structured.outParams, name)) {
+    return String(structured.outParams[name] ?? "");
+  }
+  const parsed = structured.parsed || workspaceParseJsonObjectFromText(content);
+  if (parsed && Object.prototype.hasOwnProperty.call(parsed, name)) {
+    const value = parsed[name];
+    return workspaceStringifyOutputValue(value);
+  }
+  const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const looseOutParams = workspaceExtractLooseOutParams(content);
+  if (Object.prototype.hasOwnProperty.call(looseOutParams, name)) {
+    return String(looseOutParams[name] ?? "").trim();
+  }
+  const patterns = [
+    new RegExp(`["']?${escaped}["']?\\s*:\\s*["']?([^"',}\\n\\r]+)`, "i"),
+    new RegExp(`(?:\\$\\{${escaped}\\}|\\$${escaped})\\s*[=:：]\\s*([^\\n\\r]+)`, "i"),
+    new RegExp(`(?:^|[\\n\\r])\\s*${escaped}\\s*[=:：]\\s*([^\\n\\r]+)`, "i"),
+  ];
+  for (const pattern of patterns) {
+    const match = pattern.exec(String(content || ""));
+    if (!match?.[1]) continue;
+    return match[1].replace(/^["'`]|["'`]$/g, "").trim();
+  }
+  return "";
+}
+
+function workspaceApplyAgentOutputSlots(instance, content) {
+  const structured = workspaceStructuredAgentOutput(content);
+  const text = String(structured.result || "").trim();
+  let changed = false;
+  const next = {
+    ...(instance || {}),
+    output: (Array.isArray(instance?.output) ? instance.output : []).map((slot, index) => {
+      const name = String(slot?.name || "").trim();
+      const type = String(slot?.type || "");
+      if (type === "node" || name === "next" || !name) return slot;
+      let value = "";
+      if (name === "result" || name === "content" || index === 0) {
+        value = text;
+      } else if (Object.prototype.hasOwnProperty.call(structured.outParams, name)) {
+        value = structured.outParams[name];
+      } else {
+        value = workspaceExtractNamedOutputValue(text, name);
+      }
+      if (!value) return slot;
+      changed = true;
+      return { ...slot, default: value, value };
+    }),
+  };
+  return { instance: changed ? next : instance, changed };
+}
+
 function workspaceResolvePath(baseCwd, raw) {
   const text = String(raw || "").trim();
   if (!text) return "";
@@ -1407,6 +1585,60 @@ function workspaceDisplayKind(definitionId) {
   return "";
 }
 
+function workspaceOutputFieldForSlot(slot, index = 0) {
+  const name = String(slot?.name || "").trim();
+  if (!name || name === "result" || name === "content" || index === 0) return "result";
+  return `outParams.${name}`;
+}
+
+function workspaceDisplayKindExample(kind, field) {
+  if (kind === "table") return { columns: ["列名1", "列名2"], rows: [["值1", "值2"]] };
+  if (kind === "chart") return { type: "chart", version: "1.0", renderer: "echarts", option: { xAxis: { type: "category", data: [] }, yAxis: { type: "value" }, series: [{ type: "bar", data: [] }] } };
+  if (kind === "html") return "<可直接渲染的 HTML>";
+  if (kind === "mermaid") return "flowchart TD\n  A[开始] --> B[结束]";
+  if (kind === "ascii") return "+---+\n|   |\n+---+";
+  if (kind === "image") return "<图片 URL 或 data URL>";
+  if (kind === "markdown") return field === "result" ? "<给用户看的完整 Markdown 正文>" : "<Markdown 正文>";
+  return `<${field} 的值>`;
+}
+
+function workspaceDisplayFieldRule(kind, field, slotName = "") {
+  const slotText = field === "result" ? "`result` 字段" : `\`${field}\``;
+  const prefix = slotName ? `- 输出引脚 \`${slotName}\` 连接了 ${kind} 展示节点：` : `- 下游连接了 ${kind} 展示节点：`;
+  if (kind === "html") return `${prefix}将可直接放入 iframe 渲染的 HTML 放在 ${slotText} 中。可以是完整 HTML 文档或 HTML fragment；不要使用 Markdown 代码围栏。`;
+  if (kind === "markdown") return `${prefix}将 Markdown 正文放在 ${slotText} 中；除非正文确实需要代码块，否则不要额外包裹代码围栏。`;
+  if (kind === "mermaid") return `${prefix}将 Mermaid 图表代码放在 ${slotText} 中，例如 flowchart/sequenceDiagram；不要使用 Markdown 代码围栏。`;
+  if (kind === "ascii") return `${prefix}将纯文本/ASCII 图或表格放在 ${slotText} 中；不要输出 HTML 或 Markdown 装饰。`;
+  if (kind === "image") return `${prefix}将可作为 img src 使用的图片地址、data URL 或 base64 data URL 放在 ${slotText} 中；不要输出 Markdown 图片语法。`;
+  if (kind === "chart") return `${prefix}将 ChartSpec JSON 对象放在 ${slotText} 中。ChartSpec 必须包含 "type":"chart"、"version":"1.0"、"renderer":"echarts"、"option"；option.series[].type 只使用 line/bar/pie/scatter/radar/heatmap/tree/treemap/sunburst/sankey/graph/gauge/funnel；不要输出 HTML、script、iframe 或 JS 函数。`;
+  if (kind === "table") return `${prefix}将表格数据放在 ${slotText} 中。推荐格式：{"columns":["列名1","列名2"],"rows":[["值1","值2"]]}；也可使用对象数组、Markdown 表格、CSV 或 TSV。不要输出 HTML。`;
+  return `${prefix}将展示内容放在 ${slotText} 中。`;
+}
+
+function workspaceDownstreamOutputDisplayBindings(graph, nodeId) {
+  const instances = graph?.instances && typeof graph.instances === "object" ? graph.instances : {};
+  const edges = Array.isArray(graph?.edges) ? graph.edges : [];
+  const source = instances[String(nodeId || "")] || {};
+  const output = Array.isArray(source.output) ? source.output : [];
+  const bindings = [];
+  for (const edge of edges) {
+    if (String(edge?.source || "") !== String(nodeId)) continue;
+    const target = instances[String(edge?.target || "")];
+    const kind = workspaceDisplayKind(target?.definitionId);
+    if (!kind) continue;
+    const index = workspaceHandleIndex(edge?.sourceHandle, "output");
+    const slot = output[index] || null;
+    const name = String(slot?.name || "").trim() || (index === 0 ? "result" : `output-${index}`);
+    bindings.push({
+      kind,
+      index,
+      name,
+      field: workspaceOutputFieldForSlot(slot, index),
+    });
+  }
+  return bindings;
+}
+
 function normalizeHtmlDisplayContent(content) {
   let text = String(content || "").trim();
   if (!text) return "";
@@ -1441,47 +1673,67 @@ function normalizeHtmlDisplayContent(content) {
 }
 
 function workspaceDownstreamDisplayRequirements(graph, nodeId) {
-  const instances = graph?.instances && typeof graph.instances === "object" ? graph.instances : {};
-  const edges = Array.isArray(graph?.edges) ? graph.edges : [];
-  const kinds = new Set();
-  for (const edge of edges) {
-    if (String(edge?.source || "") !== String(nodeId)) continue;
-    const target = instances[String(edge?.target || "")];
-    const kind = workspaceDisplayKind(target?.definitionId);
-    if (kind) kinds.add(kind);
-  }
-  if (kinds.size === 0) return "";
+  const bindings = workspaceDownstreamOutputDisplayBindings(graph, nodeId);
+  if (bindings.length === 0) return "";
+  const seen = new Set();
   const rules = [];
-  if (kinds.has("html")) {
-    rules.push("- 下游连接了 HTML 展示节点：输出可直接放入 iframe 渲染的 HTML。可以是完整 HTML 文档或 HTML fragment；不要使用 Markdown 代码围栏；不要解释生成过程。");
-  }
-  if (kinds.has("markdown")) {
-    rules.push("- 下游连接了 Markdown 展示节点：输出 Markdown 正文；不要包裹在代码围栏中，除非正文确实需要代码块。");
-  }
-  if (kinds.has("mermaid")) {
-    rules.push("- 下游连接了 Mermaid 展示节点：只输出 Mermaid 图表代码，例如 flowchart/sequenceDiagram；不要使用 Markdown 代码围栏；不要附加解释。");
-  }
-  if (kinds.has("ascii")) {
-    rules.push("- 下游连接了 ASCII 展示节点：输出纯文本/ASCII 图或表格；不要输出 HTML 或 Markdown 装饰。");
-  }
-  if (kinds.has("image")) {
-    rules.push("- 下游连接了图片展示节点：输出可作为 img src 使用的图片地址、data URL 或 base64 data URL；不要输出 Markdown 图片语法或解释文字。");
-  }
-  if (kinds.has("chart")) {
-    rules.push('- 下游连接了 Chart 展示节点：只输出 ChartSpec JSON 对象，不要 Markdown 代码围栏，不要解释文字。格式必须包含 `"type":"chart"`、`"version":"1.0"`、`"renderer":"echarts"`、`"option"`；`option.series[].type` 只使用 line/bar/pie/scatter/radar/heatmap/tree/treemap/sunburst/sankey/graph/gauge/funnel；不要输出 HTML、script、iframe 或 JS 函数。');
-  }
-  if (kinds.has("table")) {
-    rules.push('- 下游连接了表格展示节点：优先只输出表格 JSON，不要解释文字。推荐格式：`{"columns":["列名1","列名2"],"rows":[["值1","值2"]]}`；也可输出对象数组、Markdown 表格、CSV 或 TSV。不要输出 HTML。');
+  for (const binding of bindings) {
+    const key = `${binding.field}:${binding.kind}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    rules.push(workspaceDisplayFieldRule(binding.kind, binding.field, binding.name));
   }
   return [
     "## 下游输出要求",
     "",
     ...rules,
     "",
+    "这些要求按输出引脚分别生效：不要把非 `result` 引脚连接的展示内容误写到 `result`；具名引脚应写入 `outParams.<引脚名>`。",
     "如果用户任务与下游展示格式没有冲突，优先满足上述格式要求；如果用户明确指定了其他格式，以用户任务为准。",
   ].join("\n");
 }
 
+function workspaceOutputProtocolRequirements(graph, nodeId) {
+  const instance = graph?.instances?.[nodeId] || {};
+  const outputSlots = Array.isArray(instance.output) ? instance.output : [];
+  const displayBindings = workspaceDownstreamOutputDisplayBindings(graph, nodeId);
+  const displayByField = new Map();
+  for (const binding of displayBindings) {
+    if (!displayByField.has(binding.field)) displayByField.set(binding.field, binding.kind);
+  }
+  const slots = outputSlots
+    .filter((slot) => {
+      const name = String(slot?.name || "").trim();
+      const type = String(slot?.type || "");
+      return name && type !== "node" && name !== "next" && name !== "result" && name !== "content";
+    })
+    .map((slot) => String(slot.name).trim());
+  const outParamsExample = slots.length
+    ? Object.fromEntries(slots.map((name) => [name, workspaceDisplayKindExample(displayByField.get(`outParams.${name}`) || "", name)]))
+    : {};
+  const resultExample = workspaceDisplayKindExample(displayByField.get("result") || "markdown", "result");
+  const slotDisplayRules = displayBindings
+    .map((binding) => `- 输出引脚 \`${binding.name}\` -> ${binding.kind} 展示节点：写入 \`${binding.field}\`。`)
+    .filter((line, index, arr) => arr.indexOf(line) === index);
+  return [
+    "## Workspace 输出协议",
+    "",
+    "最终回复必须是一个 JSON 对象，必须直接以 `{` 开头并以 `}` 结尾；不要使用 Markdown 代码围栏，不要在 JSON 外追加解释文字、进度说明或自然语言前后缀。",
+    "JSON 必须可被 `JSON.parse` 解析；如果 `result` 是多行 Markdown，必须在 JSON 字符串里使用 `\\n` 转义换行，不能把裸 Markdown 直接塞进未转义的字符串。",
+    "固定格式：",
+    "",
+    JSON.stringify({ result: resultExample, outParams: outParamsExample }, null, 2),
+    "",
+    "- `result`：完整正文，写入 `result` / `content` 输出口，直连默认展示节点时展示它。",
+    "- `outParams`：具名输出参数，只写入同名输出引脚。",
+    ...(slotDisplayRules.length ? ["- 当前输出引脚与展示节点映射：", ...slotDisplayRules] : []),
+    ...(slots.length
+      ? [`- 当前节点具名输出槽：${slots.map((name) => `\`${name}\``).join("、")}。例如任务要求写入 \`${slots[0]}\` 时，放到 \`outParams.${slots[0]}\`。`]
+      : ["- 当前节点没有额外具名输出槽，`outParams` 返回空对象即可。"]),
+    "- 如果 `result` 需要承载表格、ChartSpec、HTML 等结构化内容，可把对象或字符串放入 `result`；系统会把它转换给下游展示节点。",
+  ].join("\n");
+}
+
 function workspaceRunPlan(graph, runNodeId) {
   const instances = graph?.instances && typeof graph.instances === "object" ? graph.instances : {};
   const edges = Array.isArray(graph?.edges) ? graph.edges : [];
@@ -1542,10 +1794,7 @@ function workspaceUpstreamText(graph, nodeId, outputs) {
   const incoming = edges.filter((edge) => String(edge?.target || "") === String(nodeId));
   const contentEdge = incoming.find((edge) => String(edge?.targetHandle || "") === "input-1") || incoming[0];
   if (!contentEdge) return "";
-  const sourceId = String(contentEdge.source || "");
-  const out = outputs.get(sourceId);
-  if (out != null && String(out).trim()) return String(out);
-  return workspaceInstanceText(instances[sourceId]);
+  return workspaceOutputSlotValueForEdge(graph, outputs, contentEdge);
 }
 
 function workspaceHandleIndex(handle, prefix) {
@@ -1573,10 +1822,7 @@ function workspaceTaskUpstreamText(graph, nodeId, outputs) {
   const contentEdges = incoming.filter((edge) => !isWorkspaceSemanticInputSlot(workspaceTargetSlotForEdge(graph, edge)));
   const contentEdge = contentEdges.find((edge) => String(edge?.targetHandle || "") === "input-1") || contentEdges[0];
   if (!contentEdge) return "";
-  const sourceId = String(contentEdge.source || "");
-  const out = outputs.get(sourceId);
-  if (out != null && String(out).trim()) return String(out);
-  return workspaceInstanceText(instances[sourceId]);
+  return workspaceOutputSlotValueForEdge(graph, outputs, contentEdge);
 }
 
 function parseWorkspaceSkillKeys(raw) {
@@ -1727,7 +1973,7 @@ function workspaceWriteDisplayContent(instance, content) {
   return next;
 }
 
-function workspaceUpdateDirectDisplays(graph, sourceId, content) {
+function workspaceUpdateDirectDisplays(graph, sourceId, content, outputs = null) {
   const instances = graph?.instances && typeof graph.instances === "object" ? graph.instances : {};
   const edges = Array.isArray(graph?.edges) ? graph.edges : [];
   const updated = [];
@@ -1736,7 +1982,8 @@ function workspaceUpdateDirectDisplays(graph, sourceId, content) {
     const targetId = String(edge?.target || "");
     const target = instances[targetId];
     if (!target || !workspaceDisplayKind(target.definitionId)) continue;
-    instances[targetId] = workspaceWriteDisplayContent(target, content);
+    const value = outputs ? workspaceOutputSlotValueForEdge(graph, outputs, edge) : String(content || "");
+    instances[targetId] = workspaceWriteDisplayContent(target, value || content);
     updated.push(targetId);
   }
   return updated;
@@ -1747,14 +1994,16 @@ function workspaceNodePrompt(graph, nodeId, upstreamText, skillsBlock, mcpBlock
   const body = String(instance.body || "").trim();
   const label = String(instance.label || nodeId).trim();
   const downstreamRequirements = workspaceDownstreamDisplayRequirements(graph, nodeId);
+  const outputProtocolRequirements = workspaceOutputProtocolRequirements(graph, nodeId);
   return [
     "你正在执行 AgentFlow Workspace 画布中的一个临时节点。",
-    "只输出该节点要传给下游展示/后续节点的正文，不要解释运行过程。",
+    "按 Workspace 输出协议返回该节点要传给下游展示/后续节点的数据。",
     workspaceSearchGuardrailsBlock(),
     skillsBlock ? `\n## Available Skills\n\n${skillsBlock}` : "",
     mcpBlock ? `\n## Available MCP\n\n${mcpBlock}` : "",
     upstreamText ? `\n## 上游上下文\n\n${upstreamText}` : "",
     downstreamRequirements ? `\n${downstreamRequirements}` : "",
+    outputProtocolRequirements ? `\n${outputProtocolRequirements}` : "",
     `\n## 当前节点\n\n- id: ${nodeId}\n- label: ${label}\n- definitionId: ${instance.definitionId || ""}`,
     `\n## 节点任务\n\n${body || upstreamText}`,
   ].filter(Boolean).join("\n");
@@ -1844,7 +2093,7 @@ async function runWorkspaceGraph(root, scopedRoot, payload, userCtx = {}, opts =
         )),
       };
       outputs.set(nodeId, skillsBlock);
-      workspaceUpdateDirectDisplays(graph, nodeId, skillsBlock);
+      workspaceUpdateDirectDisplays(graph, nodeId, skillsBlock, outputs);
       emit({ type: "graph", nodeId, graph });
       emit({ type: "node-done", nodeId, definitionId: defId });
       continue;
@@ -1864,7 +2113,7 @@ async function runWorkspaceGraph(root, scopedRoot, payload, userCtx = {}, opts =
         )),
       };
       outputs.set(nodeId, mcpBlock);
-      workspaceUpdateDirectDisplays(graph, nodeId, mcpBlock);
+      workspaceUpdateDirectDisplays(graph, nodeId, mcpBlock, outputs);
       emit({ type: "graph", nodeId, graph });
       emit({ type: "node-done", nodeId, definitionId: defId });
       continue;
@@ -2166,9 +2415,13 @@ async function runWorkspaceGraph(root, scopedRoot, payload, userCtx = {}, opts =
         throw e;
       }
     }
-    outputs.set(nodeId, content);
-    const updatedDisplays = workspaceUpdateDirectDisplays(graph, nodeId, content);
-    if (updatedDisplays.length) emit({ type: "graph", nodeId, displayNodeIds: updatedDisplays, graph });
+    const normalizedAgentOutput = workspaceStructuredAgentOutput(content);
+    const resultContent = normalizedAgentOutput.result || content;
+    outputs.set(nodeId, resultContent);
+    const slotUpdate = workspaceApplyAgentOutputSlots(instance, content);
+    if (slotUpdate.changed) graph.instances[nodeId] = slotUpdate.instance;
+    const updatedDisplays = workspaceUpdateDirectDisplays(graph, nodeId, resultContent, outputs);
+    if (slotUpdate.changed || updatedDisplays.length) emit({ type: "graph", nodeId, displayNodeIds: updatedDisplays, graph });
     emit({ type: "node-done", nodeId, definitionId: defId });
   }
   if (pauseNodeIds.length > 0) {
@@ -3569,7 +3822,11 @@ export function startUiServer({
 
     if (req.method === "GET" && url.pathname === "/api/user-env") {
       try {
-        json(res, 200, { env: readUserEnvRows(userCtx.userId) });
+        json(res, 200, {
+          env: readUserEnvRows(userCtx.userId),
+          globalEnv: authUser?.isAdmin ? readGlobalEnvRows() : [],
+          canEditGlobalEnv: Boolean(authUser?.isAdmin),
+        });
       } catch (e) {
         json(res, 500, { error: (e && e.message) || String(e) });
       }
@@ -3585,8 +3842,20 @@ export function startUiServer({
         return;
       }
       try {
+        if (Object.prototype.hasOwnProperty.call(payload || {}, "globalEnv") && !authUser?.isAdmin) {
+          json(res, 403, { error: "Admin permission required" });
+          return;
+        }
         const envRows = writeUserEnvRows(userCtx.userId, payload?.env || []);
-        json(res, 200, { success: true, env: envRows });
+        const globalEnvRows = authUser?.isAdmin && Object.prototype.hasOwnProperty.call(payload || {}, "globalEnv")
+          ? writeGlobalEnvRows(payload?.globalEnv || [])
+          : readGlobalEnvRows();
+        json(res, 200, {
+          success: true,
+          env: envRows,
+          globalEnv: authUser?.isAdmin ? globalEnvRows : [],
+          canEditGlobalEnv: Boolean(authUser?.isAdmin),
+        });
       } catch (e) {
         json(res, 500, { error: (e && e.message) || String(e) });
       }