@fieldwangai/agentflow 0.1.53 → 0.1.55

package/bin/lib/catalog-flows.mjs

@@ -274,7 +274,7 @@ export function listNodesJson(workspaceRoot, flowId, flowSource, opts = {}) {
   addFromDir(PACKAGE_BUILTIN_NODES_DIR, "project");
   addFromDir(path.join(root, LEGACY_NODES_DIR), "project");
   addFromDir(path.join(root, PROJECT_NODES_DIR), "project");
-  for (const manifest of listMarketplaceNodes(root, marketplaceFlowData)) {
+  for (const manifest of listMarketplaceNodes(root, marketplaceFlowData, opts)) {
     let type = "agent";
     const runtimeType = String(manifest.baseDefinitionId || manifest.runtime?.type || manifest.type || "").toLowerCase();
     if (runtimeType.startsWith("control")) type = "control";
@@ -524,7 +524,7 @@ export function readNodeJson(workspaceRoot, nodeId, flowId, flowSource, opts = {
         } catch (_) {}
       }
     }
-    const resolved = resolveMarketplaceNodePackage(root, flowDir, nodeId, opts.flowData || null);
+    const resolved = resolveMarketplaceNodePackage(root, flowDir, nodeId, opts.flowData || null, opts);
     if (!resolved) return { error: "Node not found: " + nodeId };
     const readmePath = path.join(resolved.packageDir, "README.md");
     let type = "agent";
@@ -751,7 +751,7 @@ function resolveNodeFileScope(workspaceRoot, nodeId, flowId, flowSource, opts =
         } catch (_) {}
       }
     }
-    const resolved = resolveMarketplaceNodePackage(workspaceRoot, flowDir, nodeId, flowData);
+    const resolved = resolveMarketplaceNodePackage(workspaceRoot, flowDir, nodeId, flowData, opts);
     if (!resolved) return null;
     return { baseDir: resolved.packageDir, allowAllFiles: true, primaryFilePath: path.join(resolved.packageDir, "node.yaml"), manifest: resolved };
   }

package/bin/lib/marketplace.mjs

@@ -109,6 +109,17 @@ function normalizeManifest(raw, packageDir, source = "workspace") {
   };
 }
 
+function manifestOwnerUserId(manifest) {
+  return String(manifest?.ownerUserId || manifest?.createdBy || "").trim();
+}
+
+function canAccessMarketplaceNode(manifest, opts = {}) {
+  const requestedUserId = String(opts.userId || "").trim();
+  if (!requestedUserId) return true;
+  if ((manifest?.source || "marketplace") !== "marketplace") return true;
+  return manifestOwnerUserId(manifest) === requestedUserId;
+}
+
 function sortVersionsDesc(versions) {
   return [...versions].sort((a, b) => b.localeCompare(a, undefined, { numeric: true, sensitivity: "base" }));
 }
@@ -297,12 +308,13 @@ function collectionDeps(flowData) {
   return deps && Array.isArray(deps.collections) ? deps.collections : [];
 }
 
-export function resolveMarketplaceNodePackage(workspaceRoot, flowDir, definitionId, flowData = null) {
+export function resolveMarketplaceNodePackage(workspaceRoot, flowDir, definitionId, flowData = null, opts = {}) {
   const parsed = parseMarketplaceDefinitionId(definitionId);
   if (!parsed) return null;
   const id = parsed.id;
   const requestedVersion = parsed.version || dependencyVersion(flowData, id) || lockVersion(flowDir, id);
   let packageDir = findNodePackageDir(workspaceRoot, id, requestedVersion);
+  let packageSource = "marketplace";
 
   if (!packageDir) {
     for (const dir of iterCollectionNodeDirs(workspaceRoot, collectionDeps(flowData))) {
@@ -311,13 +323,15 @@ export function resolveMarketplaceNodePackage(workspaceRoot, flowDir, definition
       if (!manifest || manifest.id !== id) continue;
       if (requestedVersion && manifest.version !== requestedVersion) continue;
       packageDir = dir;
+      packageSource = "collection";
       break;
     }
   }
 
   if (!packageDir) return null;
-  const manifest = normalizeManifest(readYamlObject(path.join(packageDir, NODE_MANIFEST)), packageDir);
+  const manifest = normalizeManifest(readYamlObject(path.join(packageDir, NODE_MANIFEST)), packageDir, packageSource);
   if (!manifest) return null;
+  if (!canAccessMarketplaceNode(manifest, opts)) return null;
   return {
     ...manifest,
     requestedDefinitionId: definitionId,
@@ -325,13 +339,14 @@ export function resolveMarketplaceNodePackage(workspaceRoot, flowDir, definition
   };
 }
 
-export function listMarketplaceNodes(workspaceRoot, flowData = null) {
+export function listMarketplaceNodes(workspaceRoot, flowData = null, opts = {}) {
   const root = workspacePackageRoot(workspaceRoot);
   const out = [];
   const seen = new Set();
   const addManifest = (dir, source = "marketplace") => {
     const manifest = normalizeManifest(readYamlObject(path.join(dir, NODE_MANIFEST)), dir, source);
     if (!manifest) return;
+    if (!canAccessMarketplaceNode(manifest, opts)) return;
     const key = `${manifest.id}@${manifest.version}`;
     if (seen.has(key)) return;
     seen.add(key);
@@ -357,7 +372,7 @@ export function listMarketplaceNodes(workspaceRoot, flowData = null) {
 
 export function listMarketplacePackages(workspaceRoot, opts = {}) {
   const root = workspacePackageRoot(workspaceRoot);
-  const nodes = listMarketplaceNodes(workspaceRoot).map((n) => ({
+  const nodes = listMarketplaceNodes(workspaceRoot, null, opts).map((n) => ({
     id: n.id,
     version: n.version,
     definitionId: n.definitionId,
@@ -392,10 +407,11 @@ export function listMarketplacePackages(workspaceRoot, opts = {}) {
   return { nodes, collections };
 }
 
-export function listMarketplaceFlowSnippets(workspaceRoot) {
+export function listMarketplaceFlowSnippets(workspaceRoot, opts = {}) {
   const root = workspacePackageRoot(workspaceRoot);
   const snippetsRoot = path.join(root, "flow-snippets");
   const snippets = [];
+  const requestedUserId = String(opts.userId || "").trim();
   if (!fs.existsSync(snippetsRoot)) return { snippets };
   for (const entry of fs.readdirSync(snippetsRoot, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
@@ -405,6 +421,8 @@ export function listMarketplaceFlowSnippets(workspaceRoot) {
       const manifest = readYamlObject(path.join(dir, FLOW_SNIPPET_MANIFEST));
       if (!manifest) continue;
       const snippet = manifest.snippet && typeof manifest.snippet === "object" ? manifest.snippet : {};
+      const ownerUserId = String(manifest.ownerUserId || manifest.createdBy || "").trim();
+      if (requestedUserId && ownerUserId !== requestedUserId) continue;
       snippets.push({
         id: manifest.id || entry.name,
         version: manifest.version || version,
@@ -415,6 +433,7 @@ export function listMarketplaceFlowSnippets(workspaceRoot) {
         edgeCount: Number(manifest.edgeCount) || (Array.isArray(snippet.edges) ? snippet.edges.length : 0),
         createdAt: manifest.createdAt || "",
         updatedAt: manifest.updatedAt || "",
+        ownerUserId,
         packageDir: dir,
         snippet,
       });
@@ -430,9 +449,15 @@ export function listMarketplaceFlowSnippets(workspaceRoot) {
 export function deleteMarketplaceNodePackage(workspaceRoot, id, version, opts = {}) {
   const packageDir = resolveWorkspaceNodePackageDir(workspaceRoot, id, version);
   if (!packageDir) return { ok: false, error: "Invalid marketplace node id or version" };
-  if (!fs.existsSync(path.join(packageDir, NODE_MANIFEST))) {
+  const manifestPath = path.join(packageDir, NODE_MANIFEST);
+  if (!fs.existsSync(manifestPath)) {
     return { ok: false, error: `Marketplace node package not found: ${id}@${version}` };
   }
+  const manifest = normalizeManifest(readYamlObject(manifestPath), packageDir, "marketplace");
+  const requestedUserId = String(opts.userId || "").trim();
+  if (!requestedUserId || !manifest || manifestOwnerUserId(manifest) !== requestedUserId) {
+    return { ok: false, error: "Marketplace node permission denied" };
+  }
   const usage = listMarketplaceNodeUsages(workspaceRoot, id, version, opts);
   if (usage.length > 0) {
     return { ok: false, error: "Marketplace node is still used by flows", usage };
@@ -449,12 +474,19 @@ export function deleteMarketplaceNodePackage(workspaceRoot, id, version, opts =
   return { ok: true, id, version, packageDir };
 }
 
-export function deleteMarketplaceFlowSnippetPackage(workspaceRoot, id, version) {
+export function deleteMarketplaceFlowSnippetPackage(workspaceRoot, id, version, opts = {}) {
   const packageDir = resolveWorkspaceFlowSnippetPackageDir(workspaceRoot, id, version);
   if (!packageDir) return { ok: false, error: "Invalid flow snippet id or version" };
-  if (!fs.existsSync(path.join(packageDir, FLOW_SNIPPET_MANIFEST))) {
+  const manifestPath = path.join(packageDir, FLOW_SNIPPET_MANIFEST);
+  if (!fs.existsSync(manifestPath)) {
     return { ok: false, error: `Flow snippet package not found: ${id}@${version}` };
   }
+  const manifest = readYamlObject(manifestPath) || {};
+  const ownerUserId = String(manifest.ownerUserId || manifest.createdBy || "").trim();
+  const requestedUserId = String(opts.userId || "").trim();
+  if (!requestedUserId || ownerUserId !== requestedUserId) {
+    return { ok: false, error: "Flow snippet permission denied" };
+  }
   fs.rmSync(packageDir, { recursive: true, force: true });
   const versionRoot = path.dirname(packageDir);
   try {
@@ -467,12 +499,12 @@ export function deleteMarketplaceFlowSnippetPackage(workspaceRoot, id, version)
   return { ok: true, id, version, packageDir };
 }
 
-export function writeFlowMarketplaceLock(workspaceRoot, flowDir, flowData) {
+export function writeFlowMarketplaceLock(workspaceRoot, flowDir, flowData, opts = {}) {
   if (!flowData || !flowData.instances || typeof flowData.instances !== "object") return null;
   const nodes = {};
   for (const inst of Object.values(flowData.instances)) {
     const defId = inst && (inst.marketplaceRef || inst.definitionId);
-    const resolved = resolveMarketplaceNodePackage(workspaceRoot, flowDir, defId, flowData);
+    const resolved = resolveMarketplaceNodePackage(workspaceRoot, flowDir, defId, flowData, opts);
     if (!resolved) continue;
     nodes[resolved.id] = {
       version: resolved.version,
@@ -663,6 +695,8 @@ export function publishNodeFromInstance(workspaceRoot, payload = {}, options = {
   const version = normalizeVersion(payload.version || "1.0.0");
   const sourceDefinitionId = String(payload.definitionId || "").trim();
   if (!id) return { ok: false, error: "Invalid package id" };
+  const ownerUserId = String(options.userId || "").trim();
+  if (!ownerUserId) return { ok: false, error: "Authentication required" };
 
   const inputs = normalizeSlotList(payload.inputs || payload.input).map((slot) => ({
     type: slot.type,
@@ -682,6 +716,12 @@ export function publishNodeFromInstance(workspaceRoot, payload = {}, options = {
   const body = String(payload.body || "").trim();
   const description = String(payload.description || body || `Published from node ${label}`).trim();
   const dest = path.join(workspacePackageRoot(workspaceRoot), "nodes", id, version);
+  const existingManifest = readYamlObject(path.join(dest, NODE_MANIFEST));
+  if (existingManifest) {
+    const existingOwner = manifestOwnerUserId(existingManifest);
+    if (existingOwner !== ownerUserId) return { ok: false, error: "Marketplace node permission denied" };
+  }
+  const now = new Date().toISOString();
   fs.mkdirSync(path.dirname(dest), { recursive: true });
   fs.rmSync(dest, { recursive: true, force: true });
   fs.mkdirSync(dest, { recursive: true });
@@ -711,6 +751,10 @@ export function publishNodeFromInstance(workspaceRoot, payload = {}, options = {
     runtime,
     inputs,
     outputs,
+    ownerUserId,
+    createdBy: ownerUserId,
+    createdAt: existingManifest?.createdAt || now,
+    updatedAt: now,
   };
   if (packagedScript?.packagedFiles?.length) manifest.packagedFiles = packagedScript.packagedFiles;
   fs.writeFileSync(path.join(dest, NODE_MANIFEST), yaml.dump(manifest, { lineWidth: -1 }), "utf-8");
@@ -732,11 +776,13 @@ export function publishNodeFromInstance(workspaceRoot, payload = {}, options = {
   };
 }
 
-export function publishFlowSnippet(workspaceRoot, payload = {}) {
+export function publishFlowSnippet(workspaceRoot, payload = {}, opts = {}) {
   const label = String(payload.displayName || payload.name || payload.id || "flow snippet").trim();
   const id = safePackageId(payload.id || payload.packageId || label);
   const version = normalizeVersion(payload.version || "1.0.0");
   if (!id) return { ok: false, error: "Invalid snippet id" };
+  const ownerUserId = String(opts.userId || "").trim();
+  if (!ownerUserId) return { ok: false, error: "Authentication required" };
 
   const rawSnippet = payload.snippet && typeof payload.snippet === "object" ? payload.snippet : {};
   const instances = rawSnippet.instances && typeof rawSnippet.instances === "object" ? rawSnippet.instances : {};
@@ -748,6 +794,11 @@ export function publishFlowSnippet(workspaceRoot, payload = {}) {
   const now = new Date().toISOString();
   const dest = resolveWorkspaceFlowSnippetPackageDir(workspaceRoot, id, version);
   if (!dest) return { ok: false, error: "Invalid snippet id or version" };
+  const existingManifest = readYamlObject(path.join(dest, FLOW_SNIPPET_MANIFEST));
+  if (existingManifest) {
+    const existingOwner = String(existingManifest.ownerUserId || existingManifest.createdBy || "").trim();
+    if (existingOwner !== ownerUserId) return { ok: false, error: "Flow snippet permission denied" };
+  }
   fs.mkdirSync(path.dirname(dest), { recursive: true });
   fs.rmSync(dest, { recursive: true, force: true });
   fs.mkdirSync(dest, { recursive: true });
@@ -759,6 +810,8 @@ export function publishFlowSnippet(workspaceRoot, payload = {}) {
     displayName: label,
     description: String(payload.description || "").trim(),
     tags: Array.isArray(payload.tags) ? payload.tags.map((x) => String(x).trim()).filter(Boolean) : [],
+    ownerUserId,
+    createdBy: ownerUserId,
     nodeCount,
     edgeCount: edges.length,
     createdAt: now,
@@ -783,10 +836,10 @@ export function publishFlowSnippet(workspaceRoot, payload = {}) {
   return { ok: true, id, version, packageDir: dest, snippet: manifest.snippet };
 }
 
-export function installFlowDependency(workspaceRoot, flowDir, spec) {
+export function installFlowDependency(workspaceRoot, flowDir, spec, opts = {}) {
   const parsed = parseMarketplaceDefinitionId(spec.startsWith("marketplace:") ? spec : `marketplace:${spec}`);
   if (!parsed) return { ok: false, error: `Invalid marketplace node spec: ${spec}` };
-  const resolved = resolveMarketplaceNodePackage(workspaceRoot, flowDir, `marketplace:${parsed.id}${parsed.version ? `@${parsed.version}` : ""}`, { dependencies: {} });
+  const resolved = resolveMarketplaceNodePackage(workspaceRoot, flowDir, `marketplace:${parsed.id}${parsed.version ? `@${parsed.version}` : ""}`, { dependencies: {} }, opts);
   if (!resolved) return { ok: false, error: `Marketplace node not found: ${spec}` };
 
   const flowYamlPath = path.join(flowDir, "flow.yaml");
@@ -798,6 +851,6 @@ export function installFlowDependency(workspaceRoot, flowDir, spec) {
   if (!exists) nodes.push({ id: resolved.id, version: resolved.version });
   data.dependencies = { ...deps, nodes };
   fs.writeFileSync(flowYamlPath, yaml.dump(data, { lineWidth: -1 }), "utf-8");
-  writeFlowMarketplaceLock(workspaceRoot, flowDir, data);
+  writeFlowMarketplaceLock(workspaceRoot, flowDir, data, opts);
   return { ok: true, id: resolved.id, version: resolved.version, definitionId: `marketplace:${resolved.id}@${resolved.version}` };
 }

package/bin/lib/ui-server.mjs

@@ -4842,7 +4842,7 @@ export function startUiServer({
 
     if (req.method === "GET" && url.pathname === "/api/marketplace/flow-snippets") {
       try {
-        json(res, 200, listMarketplaceFlowSnippets(root));
+        json(res, 200, listMarketplaceFlowSnippets(root, userCtx));
       } catch (e) {
         json(res, 500, { error: (e && e.message) || String(e) });
       }
@@ -4873,7 +4873,7 @@ export function startUiServer({
         return;
       }
       try {
-        const result = deleteMarketplaceFlowSnippetPackage(root, id, version);
+        const result = deleteMarketplaceFlowSnippetPackage(root, id, version, userCtx);
         json(res, result.ok ? 200 : 400, result);
       } catch (e) {
         json(res, 500, { ok: false, error: (e && e.message) || String(e) });
@@ -4911,7 +4911,7 @@ export function startUiServer({
           json(res, 400, { error: resolved.error || "Could not resolve flow directory" });
           return;
         }
-        const result = installFlowDependency(root, resolved.flowDir, nodeSpec);
+        const result = installFlowDependency(root, resolved.flowDir, nodeSpec, userCtx);
         json(res, result.ok ? 200 : 400, result);
       } catch (e) {
         json(res, 500, { ok: false, error: (e && e.message) || String(e) });
@@ -4935,7 +4935,7 @@ export function startUiServer({
           const resolved = resolveFlowDirForWrite(root, flowId, flowSource, userCtx);
           if (!resolved.error && resolved.flowDir) flowDir = resolved.flowDir;
         }
-        const result = publishNodeFromInstance(root, payload || {}, { flowDir });
+        const result = publishNodeFromInstance(root, payload || {}, { flowDir, ...userCtx });
         json(res, result.ok ? 200 : 400, result);
       } catch (e) {
         json(res, 500, { ok: false, error: (e && e.message) || String(e) });
@@ -4952,7 +4952,7 @@ export function startUiServer({
         return;
       }
       try {
-        const result = publishFlowSnippet(root, payload || {});
+        const result = publishFlowSnippet(root, payload || {}, userCtx);
         json(res, result.ok ? 200 : 400, result);
       } catch (e) {
         json(res, 500, { ok: false, error: (e && e.message) || String(e) });