@fieldwangai/agentflow 0.1.42 → 0.1.44

package/bin/lib/composer-agent.mjs

@@ -50,6 +50,13 @@ function readUserMcpPrivateEnvObject(userId) {
   return env;
 }
 
+function readUserMcpPrivateServers(userId) {
+  const safe = sanitizeAgentflowUserId(userId);
+  if (!safe) return {};
+  const data = readJsonObject(path.join(getAgentflowUserDataRoot(safe), "mcp-private.json"));
+  return data?.servers && typeof data.servers === "object" && !Array.isArray(data.servers) ? data.servers : {};
+}
+
 function pruneCursorMcpPrivateEnvPlaceholders() {
   const filePath = path.join(os.homedir(), ".cursor", "mcp.json");
   const config = readJsonObject(filePath);
@@ -83,12 +90,98 @@ function pruneCursorMcpPrivateEnvPlaceholders() {
   fs.writeFileSync(filePath, JSON.stringify({ ...config, mcpServers: nextServers }, null, 2) + "\n", "utf-8");
 }
 
+function cursorMcpServersFromFile(filePath) {
+  const config = readJsonObject(filePath);
+  return config?.mcpServers && typeof config.mcpServers === "object" && !Array.isArray(config.mcpServers)
+    ? config.mcpServers
+    : {};
+}
+
+function materializeWorkspaceCursorMcpPrivateConfig(workspaceRoot, userId) {
+  const safe = sanitizeAgentflowUserId(userId);
+  if (!safe) return () => {};
+  const privateServers = readUserMcpPrivateServers(safe);
+  if (!Object.keys(privateServers).length) return () => {};
+
+  const workspace = path.resolve(workspaceRoot || process.cwd());
+  const filePath = path.join(workspace, ".cursor", "mcp.json");
+  const globalFilePath = path.join(os.homedir(), ".cursor", "mcp.json");
+  const existed = fs.existsSync(filePath);
+  const original = existed ? fs.readFileSync(filePath, "utf-8") : "";
+  const config = readJsonObject(filePath);
+  const localServers = cursorMcpServersFromFile(filePath);
+  const globalServers = cursorMcpServersFromFile(globalFilePath);
+  const nextServers = { ...localServers };
+  let changed = false;
+
+  for (const [name, privateServer] of Object.entries(privateServers)) {
+    const current = nextServers[name] || globalServers[name];
+    if (!current || typeof current !== "object" || Array.isArray(current)) continue;
+    const privateEnv = privateServer?.env && typeof privateServer.env === "object" && !Array.isArray(privateServer.env) ? privateServer.env : {};
+    const privateHeaders = privateServer?.headers && typeof privateServer.headers === "object" && !Array.isArray(privateServer.headers) ? privateServer.headers : {};
+    if (!Object.keys(privateEnv).length && !Object.keys(privateHeaders).length) continue;
+
+    const next = { ...current };
+    if (Object.keys(privateEnv).length) {
+      const currentEnv = current.env && typeof current.env === "object" && !Array.isArray(current.env) ? current.env : {};
+      next.env = { ...currentEnv, ...privateEnv };
+      changed = true;
+    }
+    if (Object.keys(privateHeaders).length) {
+      const currentHeaders = current.headers && typeof current.headers === "object" && !Array.isArray(current.headers) ? current.headers : {};
+      next.headers = { ...currentHeaders, ...privateHeaders };
+      changed = true;
+    }
+    nextServers[name] = next;
+  }
+
+  if (!changed) return () => {};
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, JSON.stringify({ ...config, mcpServers: nextServers }, null, 2) + "\n", "utf-8");
+
+  let restored = false;
+  return () => {
+    if (restored) return;
+    restored = true;
+    try {
+      if (existed) fs.writeFileSync(filePath, original, "utf-8");
+      else if (fs.existsSync(filePath)) fs.rmSync(filePath, { force: true });
+    } catch {
+      // Best-effort restore; do not fail an already-running agent on cleanup.
+    }
+  };
+}
+
 function agentflowUserEnv(userId) {
   const safe = sanitizeAgentflowUserId(userId);
   pruneCursorMcpPrivateEnvPlaceholders();
   return { ...readMergedEnvObject(safe), ...(safe ? readUserMcpPrivateEnvObject(safe) : {}), AGENTFLOW_USER_ID: safe };
 }
 
+function runCursorAgentWithPrivateMcp(cliWorkspace, prompt, options, userId) {
+  const restore = materializeWorkspaceCursorMcpPrivateConfig(cliWorkspace, userId);
+  let handle;
+  try {
+    handle = runCursorAgentWithPrompt(cliWorkspace, prompt, options);
+  } catch (e) {
+    restore();
+    throw e;
+  }
+
+  let restored = false;
+  const safeRestore = () => {
+    if (restored) return;
+    restored = true;
+    restore();
+  };
+  if (handle?.child?.once) {
+    handle.child.once("exit", safeRestore);
+    handle.child.once("error", safeRestore);
+  }
+  const finished = Promise.resolve(handle.finished).finally(safeRestore);
+  return { ...handle, finished };
+}
+
 // ─── script 内容注入辅助 ─────────────────────────────────────────────────
 
 /**
@@ -203,10 +296,10 @@ export function startComposerAgent(opts) {
     });
   }
 
-  return runCursorAgentWithPrompt(cliWs, prompt, {
+  return runCursorAgentWithPrivateMcp(cliWs, prompt, {
     ...common,
     model: model || undefined,
-  });
+  }, opts.agentflowUserId);
 }
 
 // ─── 为单个 agent 步骤构建 prompt ──────────────────────────────────────────
@@ -496,12 +589,12 @@ export async function runComposerPostFlowValidationAndRepair(opts) {
         setChild(handle.child);
         await handle.finished;
       } else {
-        const handle = runCursorAgentWithPrompt(cliWs, agentPrompt, {
+        const handle = runCursorAgentWithPrivateMcp(cliWs, agentPrompt, {
           onStreamEvent: stepEmit,
           model: model || undefined,
           force: Boolean(opts.force),
           env,
-        });
+        }, opts.agentflowUserId || opts.flowContext?.userId);
         setChild(handle.child);
         await handle.finished;
       }
@@ -769,12 +862,12 @@ export function startComposerMultiStep(opts) {
               currentChild = handle.child;
               await handle.finished;
             } else {
-              const handle = runCursorAgentWithPrompt(cliWs, agentPrompt, {
+              const handle = runCursorAgentWithPrivateMcp(cliWs, agentPrompt, {
                 onStreamEvent: stepEmit,
                 model: model || undefined,
                 force: Boolean(opts.force),
                 env,
-              });
+              }, opts.agentflowUserId || opts.flowContext?.userId);
               currentChild = handle.child;
               await handle.finished;
             }

package/bin/lib/ui-server.mjs

@@ -108,8 +108,13 @@ const MIME = {
   ".js": "text/javascript; charset=utf-8",
   ".css": "text/css; charset=utf-8",
   ".json": "application/json; charset=utf-8",
-  ".ico": "image/x-icon",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".webp": "image/webp",
   ".svg": "image/svg+xml",
+  ".ico": "image/x-icon",
 };
 
 const RUN_CONFIG_FILENAME = "run-config.json";
@@ -1125,6 +1130,7 @@ const WORKSPACE_TEXT_EXTS = new Set([
   ".mjs",
   ".cjs",
 ]);
+const WORKSPACE_IMAGE_EXTS = new Set([".png", ".jpg", ".jpeg", ".gif", ".webp", ".svg"]);
 
 function resolveWorkspaceFilePath(workspaceRoot, relPath) {
   const root = path.resolve(workspaceRoot);
@@ -1144,9 +1150,59 @@ function workspaceFileIcon(fileName, isDir = false) {
   if ([".yaml", ".yml", ".json"].includes(ext)) return "data_object";
   if (ext === ".css") return "palette";
   if (ext === ".html") return "web";
+  if (WORKSPACE_IMAGE_EXTS.has(ext)) return "image";
   return "draft";
 }
 
+function sanitizeWorkspaceUploadName(filename) {
+  const parsed = path.parse(String(filename || "image").replace(/\\/g, "/").split("/").pop() || "image");
+  const stem = (parsed.name || "image")
+    .trim()
+    .replace(/[^a-zA-Z0-9._-]+/g, "-")
+    .replace(/^-+|-+$/g, "")
+    .slice(0, 80) || "image";
+  const ext = String(parsed.ext || "").toLowerCase();
+  return `${stem}${WORKSPACE_IMAGE_EXTS.has(ext) ? ext : ".png"}`;
+}
+
+function uniqueWorkspaceRelPath(workspaceRoot, relPath) {
+  let { abs, rel } = resolveWorkspaceFilePath(workspaceRoot, relPath);
+  if (!fs.existsSync(abs)) return { abs, rel };
+  const parsed = path.parse(rel);
+  for (let i = 1; i < 1000; i += 1) {
+    const candidate = path.posix.join(parsed.dir, `${parsed.name}-${i}${parsed.ext}`);
+    const resolved = resolveWorkspaceFilePath(workspaceRoot, candidate);
+    if (!fs.existsSync(resolved.abs)) return resolved;
+  }
+  return { abs, rel };
+}
+
+function workspaceDownloadContentDisposition(relPath) {
+  const fallbackName = path.basename(String(relPath || "download")) || "download";
+  const quotedName = fallbackName.replace(/[\r\n"\\]/g, "_");
+  return `attachment; filename="${quotedName}"; filename*=UTF-8''${encodeURIComponent(fallbackName)}`;
+}
+
+const WORKSPACE_FILE_SKIP_REL_PREFIXES = [
+  ".workspace/agentflow/worktrees",
+  ".workspace/agentflow/git-repos",
+  ".workspace/agentflow/runBuild",
+  ".workspace/agentflow/composer-logs",
+];
+
+function workspacePathInside(parent, candidate) {
+  const base = path.resolve(parent);
+  const target = path.resolve(candidate);
+  return target === base || target.startsWith(base + path.sep);
+}
+
+function shouldSkipWorkspaceFileRelPath(relPath) {
+  const normalized = String(relPath || "").replace(/\\/g, "/").replace(/^\/+/, "");
+  return WORKSPACE_FILE_SKIP_REL_PREFIXES.some((prefix) => (
+    normalized === prefix || normalized.startsWith(`${prefix}/`)
+  ));
+}
+
 function readWorkspaceFilesRecursive(dir, root, depth = 0, maxDepth = 3, budget = { count: 0 }) {
   if (depth > maxDepth || budget.count > 500) return [];
   let entries;
@@ -1161,6 +1217,7 @@ function readWorkspaceFilesRecursive(dir, root, depth = 0, maxDepth = 3, budget
     if (entry.name.startsWith(".") && entry.name !== ".agents" && entry.name !== ".codex") continue;
     const abs = path.join(dir, entry.name);
     const rel = path.relative(root, abs).replace(/\\/g, "/");
+    if (shouldSkipWorkspaceFileRelPath(rel)) continue;
     if (entry.isDirectory()) {
       if (WORKSPACE_FILE_SKIP_DIRS.has(entry.name)) continue;
       budget.count++;
@@ -1174,7 +1231,7 @@ function readWorkspaceFilesRecursive(dir, root, depth = 0, maxDepth = 3, budget
     } else if (entry.isFile()) {
       if (WORKSPACE_FILE_SKIP_FILES.has(entry.name)) continue;
       const ext = path.extname(entry.name).toLowerCase();
-      if (!WORKSPACE_TEXT_EXTS.has(ext)) continue;
+      if (!WORKSPACE_TEXT_EXTS.has(ext) && !WORKSPACE_IMAGE_EXTS.has(ext)) continue;
       let size = 0;
       try { size = fs.statSync(abs).size; } catch {}
       budget.count++;
@@ -1232,6 +1289,43 @@ function normalizeWorkspaceGraphPayload(payload) {
   };
 }
 
+function workspaceRunTouchedNodeIds(result) {
+  const ids = new Set();
+  for (const id of Array.isArray(result?.order) ? result.order : []) {
+    const text = String(id || "").trim();
+    if (text) ids.add(text);
+  }
+  for (const event of Array.isArray(result?.events) ? result.events : []) {
+    const nodeId = String(event?.nodeId || "").trim();
+    if (nodeId) ids.add(nodeId);
+    for (const displayId of Array.isArray(event?.displayNodeIds) ? event.displayNodeIds : []) {
+      const text = String(displayId || "").trim();
+      if (text) ids.add(text);
+    }
+  }
+  return ids;
+}
+
+function mergeWorkspaceRunGraph(currentGraph, runGraph, touchedIds) {
+  const current = normalizeWorkspaceGraphPayload(currentGraph || {});
+  const run = normalizeWorkspaceGraphPayload(runGraph || {});
+  const ids = touchedIds instanceof Set ? touchedIds : new Set(touchedIds || []);
+  const instances = { ...(current.instances || {}) };
+  for (const id of ids) {
+    if (run.instances && Object.prototype.hasOwnProperty.call(run.instances, id)) {
+      instances[id] = run.instances[id];
+    }
+  }
+  return {
+    ...current,
+    version: 1,
+    instances,
+    edges: Array.isArray(current.edges) ? current.edges : [],
+    ui: current.ui && typeof current.ui === "object" ? current.ui : { nodePositions: {} },
+    updatedAt: new Date().toISOString(),
+  };
+}
+
 function resolveWorkspaceScopeRoot(workspaceRoot, params = {}, opts = {}) {
   const flowId = params.flowId != null ? String(params.flowId).trim() : "";
   if (!flowId) return { root: path.resolve(workspaceRoot), flowId: "", flowSource: "", archived: false };
@@ -1952,6 +2046,39 @@ function workspaceTaskUpstreamText(graph, nodeId, outputs) {
   return workspaceOutputSlotValueForEdge(graph, outputs, contentEdge);
 }
 
+function workspaceInputValues(graph, nodeId, outputs) {
+  const values = {};
+  const edges = Array.isArray(graph?.edges) ? graph.edges : [];
+  const instances = graph?.instances && typeof graph.instances === "object" ? graph.instances : {};
+  const target = instances[String(nodeId || "")] || {};
+  const inputSlots = Array.isArray(target.input) ? target.input : [];
+  for (const edge of edges) {
+    if (String(edge?.target || "") !== String(nodeId)) continue;
+    const index = workspaceHandleIndex(edge?.targetHandle, "input");
+    const slot = inputSlots[index] || null;
+    const name = String(slot?.name || "").trim();
+    if (!name || isWorkspaceSemanticInputSlot(slot)) continue;
+    const value = workspaceOutputSlotValueForEdge(graph, outputs, edge);
+    if (String(value || "").trim()) values[name] = String(value);
+  }
+  for (const slot of inputSlots) {
+    const name = String(slot?.name || "").trim();
+    if (!name || isWorkspaceSemanticInputSlot(slot) || Object.prototype.hasOwnProperty.call(values, name)) continue;
+    const value = workspaceSlotValue(slot);
+    if (String(value || "").trim()) values[name] = String(value);
+  }
+  return values;
+}
+
+function workspaceResolveBodyPlaceholders(body, inputValues = {}) {
+  const raw = String(body || "");
+  if (!raw.includes("${")) return raw;
+  return raw.replace(/\$\{([A-Za-z_][A-Za-z0-9_-]*)\}/g, (match, name) => {
+    if (!Object.prototype.hasOwnProperty.call(inputValues, name)) return match;
+    return String(inputValues[name] ?? "");
+  });
+}
+
 function parseWorkspaceSkillKeys(raw) {
   const text = String(raw || "").trim();
   if (!text) return [];
@@ -2116,9 +2243,9 @@ function workspaceUpdateDirectDisplays(graph, sourceId, content, outputs = null)
   return updated;
 }
 
-function workspaceNodePrompt(graph, nodeId, upstreamText, skillsBlock, mcpBlock = "") {
+function workspaceNodePrompt(graph, nodeId, upstreamText, skillsBlock, mcpBlock = "", inputValues = {}) {
   const instance = graph.instances[nodeId] || {};
-  const body = String(instance.body || "").trim();
+  const body = workspaceResolveBodyPlaceholders(instance.body || "", inputValues).trim();
   const label = String(instance.label || nodeId).trim();
   const downstreamRequirements = workspaceDownstreamDisplayRequirements(graph, nodeId);
   const outputProtocolRequirements = workspaceOutputProtocolRequirements(graph, nodeId);
@@ -2136,6 +2263,72 @@ function workspaceNodePrompt(graph, nodeId, upstreamText, skillsBlock, mcpBlock
   ].filter(Boolean).join("\n");
 }
 
+function workspaceDefaultWorktreeRoot(scopedRoot) {
+  return path.join(path.resolve(scopedRoot), ".workspace", "agentflow", "worktrees");
+}
+
+function workspaceShouldAutoCleanupWorktree(scopedRoot, worktreePath, hasExplicitWorktreePath) {
+  if (hasExplicitWorktreePath || !worktreePath) return false;
+  return workspacePathInside(workspaceDefaultWorktreeRoot(scopedRoot), worktreePath);
+}
+
+function workspaceTrackAutoCleanupWorktree(list, item) {
+  const rawTarget = String(item?.worktreePath || "").trim();
+  if (!rawTarget) return;
+  const target = path.resolve(rawTarget);
+  if (list.some((entry) => path.resolve(entry.worktreePath) === target)) return;
+  list.push({ ...item, worktreePath: target });
+}
+
+function workspaceUntrackAutoCleanupWorktree(list, worktreePath) {
+  const rawTarget = String(worktreePath || "").trim();
+  if (!rawTarget) return;
+  const target = path.resolve(rawTarget);
+  for (let i = list.length - 1; i >= 0; i -= 1) {
+    if (path.resolve(list[i].worktreePath) === target) list.splice(i, 1);
+  }
+}
+
+function workspaceMarkAutoWorktreeCleaned(graph, entry) {
+  const instance = graph?.instances?.[entry.nodeId];
+  if (!instance) return false;
+  let nextInstance = workspaceSetOutputSlot(instance, "worktreePath", "");
+  nextInstance = workspaceSetOutputSlot(nextInstance, "gitContext", "");
+  nextInstance = workspaceSetOutputSlot(nextInstance, "workspaceContext", "");
+  graph.instances[entry.nodeId] = nextInstance;
+  return true;
+}
+
+function workspaceCleanupAutoWorktrees(list, graph, emit) {
+  for (const entry of [...list].reverse()) {
+    try {
+      const result = unloadGitWorktree({
+        repoPath: entry.repoPath,
+        worktreePath: entry.worktreePath,
+        force: false,
+        prune: true,
+      });
+      emit({
+        type: "natural",
+        kind: "status",
+        nodeId: entry.nodeId,
+        text: `已清理临时 worktree：${result.worktreePath}`,
+      });
+      if (workspaceMarkAutoWorktreeCleaned(graph, entry)) {
+        emit({ type: "graph", nodeId: entry.nodeId, graph });
+      }
+    } catch (e) {
+      emit({
+        type: "natural",
+        kind: "warning",
+        nodeId: entry.nodeId,
+        text: `临时 worktree 未自动清理：${entry.worktreePath}\n原因：${e?.message || String(e)}`,
+      });
+    }
+  }
+  list.splice(0, list.length);
+}
+
 async function runWorkspaceGraph(root, scopedRoot, payload, userCtx = {}, opts = {}) {
   const graph = normalizeWorkspaceGraphPayload(payload.graph || {});
   const runNodeId = String(payload?.runNodeId || "").trim();
@@ -2193,7 +2386,9 @@ async function runWorkspaceGraph(root, scopedRoot, payload, userCtx = {}, opts =
   };
   let cwd = scopedRoot;
   const modelKey = typeof payload?.model === "string" ? payload.model.trim() : "";
+  const autoCleanupWorktrees = [];
 
+  try {
   for (const nodeId of order) {
     throwIfAborted();
     const instance = graph.instances[nodeId];
@@ -2378,13 +2573,23 @@ async function runWorkspaceGraph(root, scopedRoot, payload, userCtx = {}, opts =
         (gitContext?.repoPath ? path.resolve(gitContext.repoPath) : "");
       if (!repoPath) throw new Error("Load Worktree requires repoPath");
       const branch = workspaceSlotValue(workspaceSlotByName(instance, "branch")).trim();
-      const rawWorktreePath = workspaceSlotValue(workspaceSlotByName(instance, "worktreePath")).trim();
+      const worktreeInputSlot = (Array.isArray(instance.input) ? instance.input : [])
+        .find((slot) => String(slot?.name || "") === "worktreePath") || null;
+      const rawWorktreePath = workspaceSlotValue(worktreeInputSlot || workspaceSlotByName(instance, "worktreePath")).trim();
       const worktreePath = rawWorktreePath ? workspaceResolvePath(cwd, rawWorktreePath) : (gitContext?.worktreePath ? path.resolve(gitContext.worktreePath) : "");
+      const hasExplicitWorktreePath = Boolean(rawWorktreePath) || Boolean(gitContext?.worktreePath);
       const previousCwd = cwd;
       const force = ["true", "1", "yes", "on"].includes(workspaceSlotValue(workspaceSlotByName(instance, "force")).trim().toLowerCase());
       const pruneMissingRaw = workspaceSlotValue(workspaceSlotByName(instance, "pruneMissing")).trim().toLowerCase();
       const pruneMissing = pruneMissingRaw !== "false";
       const result = loadGitWorktree({ repoPath, branch, worktreePath, pipelineWorkspace: scopedRoot, force, pruneMissing });
+      if (workspaceShouldAutoCleanupWorktree(scopedRoot, result.worktreePath, hasExplicitWorktreePath)) {
+        workspaceTrackAutoCleanupWorktree(autoCleanupWorktrees, {
+          nodeId,
+          repoPath: result.repoRoot,
+          worktreePath: result.worktreePath,
+        });
+      }
       const outGitContext = buildGitContext({
         repoPath: result.repoRoot,
         worktreePath: result.worktreePath,
@@ -2427,6 +2632,7 @@ async function runWorkspaceGraph(root, scopedRoot, payload, userCtx = {}, opts =
       const pruneRaw = workspaceSlotValue(workspaceSlotByName(instance, "prune")).trim().toLowerCase();
       const prune = pruneRaw !== "false";
       const result = unloadGitWorktree({ repoPath, worktreePath, force, prune });
+      workspaceUntrackAutoCleanupWorktree(autoCleanupWorktrees, result.worktreePath);
       const previousContext = workspaceContext?.previous && typeof workspaceContext.previous === "object" ? workspaceContext.previous : null;
       cwd = previousContext?.cwd ? path.resolve(String(previousContext.cwd)) : scopedRoot;
       let nextInstance = workspaceSetOutputSlot(instance, "removed", "true");
@@ -2483,14 +2689,15 @@ async function runWorkspaceGraph(root, scopedRoot, payload, userCtx = {}, opts =
 
     const prepareStartedAt = Date.now();
     const upstreamText = workspaceTaskUpstreamText(graph, nodeId, outputs);
-    const body = String(instance.body || "").trim();
+    const inputValues = workspaceInputValues(graph, nodeId, outputs);
+    const body = workspaceResolveBodyPlaceholders(instance.body || "", inputValues).trim();
     if (defId === "agent_subAgent" && !body && !String(upstreamText || "").trim()) {
       throw new Error(`Workspace node ${nodeId} has no task. Fill the node body or connect upstream text.`);
     }
     const upstreamSkillBlocks = workspaceUpstreamSkillBlocks(graph, nodeId, outputs);
     const promptSkillsBlock = mergeWorkspaceSkillBlocks(upstreamSkillBlocks, upstreamSkillBlocks ? "" : loadSkillsBlockForKeys(fallbackSelectedSkillKeys));
     const promptMcpBlock = workspaceUpstreamMcpBlocks(graph, nodeId, outputs);
-    const prompt = workspaceNodePrompt(graph, nodeId, upstreamText, promptSkillsBlock, promptMcpBlock);
+    const prompt = workspaceNodePrompt(graph, nodeId, upstreamText, promptSkillsBlock, promptMcpBlock, inputValues);
     emitTiming(nodeId, "prepare-agent-prompt", prepareStartedAt, { promptChars: prompt.length, upstreamChars: String(upstreamText || "").length, skillsChars: promptSkillsBlock.length, mcpChars: promptMcpBlock.length });
     emit({ type: "natural", kind: "prompt", nodeId, text: prompt });
     let content = "";
@@ -2551,6 +2758,9 @@ async function runWorkspaceGraph(root, scopedRoot, payload, userCtx = {}, opts =
     if (slotUpdate.changed || updatedDisplays.length) emit({ type: "graph", nodeId, displayNodeIds: updatedDisplays, graph });
     emit({ type: "node-done", nodeId, definitionId: defId });
   }
+  } finally {
+    workspaceCleanupAutoWorktrees(autoCleanupWorktrees, graph, emit);
+  }
   if (pauseNodeIds.length > 0) {
     emit({ type: "paused", nodeIds: pauseNodeIds, message: `Workspace run paused at ${pauseNodeIds.join(", ")}` });
   }
@@ -2655,6 +2865,47 @@ function parseFlowsImportForm(req) {
   });
 }
 
+function parseWorkspaceUploadForm(req) {
+  return new Promise((resolve, reject) => {
+    const bb = busboy({
+      headers: req.headers,
+      limits: { files: 1, fileSize: 10 * 1024 * 1024, parts: 32 },
+    });
+    const fields = {};
+    const chunks = [];
+    let filename = "";
+    let mimeType = "";
+    let gotFile = false;
+    bb.on("field", (name, val) => {
+      fields[String(name || "")] = String(val || "");
+    });
+    bb.on("file", (name, file, info) => {
+      if (name !== "file") {
+        file.resume();
+        return;
+      }
+      gotFile = true;
+      filename = info.filename || "";
+      mimeType = info.mimeType || "";
+      file.on("data", (d) => chunks.push(d));
+      file.on("limit", () => {
+        reject(new Error("FILE_TOO_LARGE"));
+      });
+    });
+    bb.on("finish", () => {
+      resolve({
+        fields,
+        file: Buffer.concat(chunks),
+        filename,
+        mimeType,
+        gotFile,
+      });
+    });
+    bb.on("error", reject);
+    req.pipe(bb);
+  });
+}
+
 /** GET 读 flow / nodes / SSE 等 */
 function isValidFlowSourceRead(s) {
   return s === "builtin" || s === "admin" || s === "user" || s === "workspace";
@@ -3331,8 +3582,11 @@ export function startUiServer({
               signal: controller.signal,
               onActiveChild: setActiveChild,
             });
-            fs.writeFileSync(graphPath, JSON.stringify(result.graph, null, 2) + "\n", "utf-8");
-            writeEvent({ type: "done", ok: true, path: graphPath, graph: result.graph, order: result.order, pauseNodeIds: result.pauseNodeIds || [] });
+            const currentGraph = readWorkspaceGraph(scoped.root).graph;
+            const touchedIds = workspaceRunTouchedNodeIds(result);
+            const mergedGraph = mergeWorkspaceRunGraph(currentGraph, result.graph, touchedIds);
+            fs.writeFileSync(graphPath, JSON.stringify(mergedGraph, null, 2) + "\n", "utf-8");
+            writeEvent({ type: "done", ok: true, path: graphPath, graph: mergedGraph, order: result.order, touchedNodeIds: Array.from(touchedIds), pauseNodeIds: result.pauseNodeIds || [] });
             res.end();
           } catch (e) {
             if (isWorkspaceRunAbortError(e) || controller.signal.aborted) {
@@ -3352,8 +3606,11 @@ export function startUiServer({
             onActiveChild: setActiveChild,
           });
           const graphPath = workspaceGraphPath(scoped.root);
-          fs.writeFileSync(graphPath, JSON.stringify(result.graph, null, 2) + "\n", "utf-8");
-          json(res, 200, { ok: true, path: graphPath, ...result });
+          const currentGraph = readWorkspaceGraph(scoped.root).graph;
+          const touchedIds = workspaceRunTouchedNodeIds(result);
+          const mergedGraph = mergeWorkspaceRunGraph(currentGraph, result.graph, touchedIds);
+          fs.writeFileSync(graphPath, JSON.stringify(mergedGraph, null, 2) + "\n", "utf-8");
+          json(res, 200, { ok: true, path: graphPath, ...result, graph: mergedGraph, touchedNodeIds: Array.from(touchedIds) });
         } catch (e) {
           if (isWorkspaceRunAbortError(e) || controller.signal.aborted) {
             json(res, 200, { ok: false, stopped: true, message: "Workspace run stopped" });
@@ -3422,6 +3679,41 @@ export function startUiServer({
       return;
     }
 
+    if (req.method === "GET" && url.pathname === "/api/workspace/file/raw") {
+      try {
+        const scoped = resolveWorkspaceScopeRoot(root, {
+          flowId: url.searchParams.get("flowId") || "",
+          flowSource: url.searchParams.get("flowSource") || "user",
+          archived: url.searchParams.get("archived") === "1",
+        }, userCtx);
+        if (scoped.error) {
+          json(res, 400, { error: scoped.error });
+          return;
+        }
+        const { abs, rel } = resolveWorkspaceFilePath(scoped.root, url.searchParams.get("path") || "");
+        if (!fs.existsSync(abs) || !fs.statSync(abs).isFile()) {
+          json(res, 404, { error: "File not found" });
+          return;
+        }
+        const ext = path.extname(abs).toLowerCase();
+        const type = MIME[ext] || "application/octet-stream";
+        const data = fs.readFileSync(abs);
+        const headers = {
+          "Content-Type": type,
+          "Content-Length": data.length,
+          "Cache-Control": "no-store",
+        };
+        if (url.searchParams.get("download") === "1") {
+          headers["Content-Disposition"] = workspaceDownloadContentDisposition(rel);
+        }
+        res.writeHead(200, headers);
+        res.end(data);
+      } catch (e) {
+        json(res, /traversal/i.test(String(e.message || e)) ? 403 : 500, { error: (e && e.message) || String(e) });
+      }
+      return;
+    }
+
     if (req.method === "POST" && url.pathname === "/api/workspace/file") {
       let payload;
       try {
@@ -3458,6 +3750,54 @@ export function startUiServer({
       return;
     }
 
+    if (req.method === "POST" && url.pathname === "/api/workspace/upload") {
+      let parsed;
+      try {
+        parsed = await parseWorkspaceUploadForm(req);
+      } catch (e) {
+        json(res, /FILE_TOO_LARGE/.test(String(e.message || e)) ? 413 : 400, { error: (e && e.message) || String(e) });
+        return;
+      }
+      try {
+        if (!parsed.gotFile || !parsed.file.length) {
+          json(res, 400, { error: "Missing upload file" });
+          return;
+        }
+        const scoped = resolveWorkspaceScopeRoot(root, {
+          flowId: parsed.fields.flowId || "",
+          flowSource: parsed.fields.flowSource || "user",
+          archived: parsed.fields.archived === "1" || parsed.fields.archived === "true" || parsed.fields.flowArchived === "true",
+        }, userCtx);
+        if (scoped.error) {
+          json(res, 400, { error: scoped.error });
+          return;
+        }
+        if (scoped.archived || isReadonlyBuiltinFlowSource(scoped.flowSource)) {
+          json(res, 400, { error: "Cannot write to builtin or archived pipeline workspace" });
+          return;
+        }
+        const safeName = sanitizeWorkspaceUploadName(parsed.filename);
+        const ext = path.extname(safeName).toLowerCase();
+        if (!WORKSPACE_IMAGE_EXTS.has(ext) || (parsed.mimeType && !/^image\//i.test(parsed.mimeType))) {
+          json(res, 400, { error: "Only image uploads are supported" });
+          return;
+        }
+        const targetDir = String(parsed.fields.dir || "img").trim().replace(/^[/\\]+/, "") || "img";
+        const target = uniqueWorkspaceRelPath(scoped.root, path.posix.join(targetDir.replace(/\\/g, "/"), safeName));
+        fs.mkdirSync(path.dirname(target.abs), { recursive: true });
+        fs.writeFileSync(target.abs, parsed.file);
+        json(res, 200, {
+          ok: true,
+          path: target.rel,
+          size: parsed.file.length,
+          mimeType: parsed.mimeType,
+        });
+      } catch (e) {
+        json(res, /traversal/i.test(String(e.message || e)) ? 403 : 500, { error: (e && e.message) || String(e) });
+      }
+      return;
+    }
+
     if (req.method === "POST" && url.pathname === "/api/workspace/folder") {
       let payload;
       try {

package/builtin/nodes/display_ascii.md

@@ -15,6 +15,7 @@ output:
   - type: text
     name: content
     default: ""
+    showOnNode: true
   - type: node
     name: next
     default: ""

package/builtin/nodes/display_chart.md

@@ -23,7 +23,7 @@ output:
   - type: text
     name: content
     default: ""
-    showOnNode: false
+    showOnNode: true
   - type: node
     name: next
     default: ""