@fieldwangai/agentflow 0.1.75 → 0.1.77

package/bin/lib/locales/en.json

@@ -297,6 +297,10 @@
       "displayName": "WeCom App Markdown",
       "description": "Send a Markdown message to users through a WeCom enterprise application"
     },
+    "tool_display_share_link": {
+      "displayName": "Display Share Link",
+      "description": "Publish upstream Display nodes as a shareable link and output the URL"
+    },
     "tool_nodejs": {
       "displayName": "Node.js Script",
       "description": "Execute Node.js script, success determined by exit code, stdout as result"
@@ -309,6 +313,10 @@
       "displayName": "Get Env",
       "description": "Get environment variable value"
     },
+    "tool_set_run_env": {
+      "displayName": "Set Run Env",
+      "description": "Set temporary environment variables for downstream nodes in the current run"
+    },
     "tool_save_key": {
       "displayName": "Save Key",
       "description": "Save key-value pair to global storage"
@@ -353,6 +361,10 @@
       "displayName": "File",
       "description": "Provide file path or content directly, value will be passed to downstream as-is"
     },
+    "provide_password": {
+      "displayName": "Password",
+      "description": "Provide a password or secret text value without showing it on the node card"
+    },
     "provide_bool": {
       "displayName": "Boolean",
       "description": "Provide a true/false boolean value directly to downstream bool pins"

package/bin/lib/locales/zh.json

@@ -297,6 +297,10 @@
       "displayName": "企业微信应用 Markdown",
       "description": "通过企业微信应用消息接口发送 Markdown 给用户"
     },
+    "tool_display_share_link": {
+      "displayName": "展示分享链接",
+      "description": "将上游 Display 节点发布为可分享链接，并输出 URL"
+    },
     "tool_nodejs": {
       "displayName": "Node.js 脚本",
       "description": "执行 Node.js 脚本，以 exit code 判断成败，stdout 作为结果"
@@ -309,6 +313,10 @@
       "displayName": "获取环境变量",
       "description": "获取环境变量值"
     },
+    "tool_set_run_env": {
+      "displayName": "设置 Run Env",
+      "description": "为当前运行设置临时环境变量，只影响后续节点"
+    },
     "tool_save_key": {
       "displayName": "保存键值",
       "description": "保存键值对到全局存储"
@@ -353,6 +361,10 @@
       "displayName": "文件",
       "description": "直接提供文件路径或内容，value 会原样供下游引用"
     },
+    "provide_password": {
+      "displayName": "密码",
+      "description": "直接提供密码或密钥文本，默认不在节点卡片上展示"
+    },
     "provide_bool": {
       "displayName": "布尔",
       "description": "直接提供 true/false 布尔值，value 会供下游 bool 引脚引用"

package/bin/lib/paths.mjs

@@ -332,11 +332,14 @@ export const LOCAL_ONLY_DEFINITION_IDS = new Set([
   "tool_gitlab_create_mr",
   "tool_wecom_send_group_markdown",
   "tool_wecom_send_app_markdown",
+  "tool_display_share_link",
+  "tool_set_run_env",
   "tool_print",
   "tool_user_check",
   "tool_user_ask",
   "provide_str",
   "provide_file",
+  "provide_password",
   "provide_bool",
 ]);
 
@@ -347,5 +350,6 @@ export const LOCAL_ONLY_TERMINAL_SUCCESS_IDS = new Set([
   "tool_print",
   "provide_str",
   "provide_file",
+  "provide_password",
   "provide_bool",
 ]);

package/bin/lib/ui-server.mjs

@@ -66,6 +66,7 @@ import {
 import { clearSkillRegistryCache } from "./skill-registry.mjs";
 import { COMPOSER_NODE_SPEC_FILENAME } from "./composer-planner.mjs";
 import { listRecentRunsFromDisk } from "./recent-runs.mjs";
+import { parseBool } from "../pipeline/parse-bool.mjs";
 import {
   unzipAndNormalizePipelineZip,
   validateImportedFlowYaml,
@@ -1249,8 +1250,11 @@ function sanitizeWorkspaceUploadName(filename) {
     .replace(/[^a-zA-Z0-9._-]+/g, "-")
     .replace(/^-+|-+$/g, "")
     .slice(0, 80) || "image";
-  const ext = String(parsed.ext || "").toLowerCase();
-  return `${stem}${WORKSPACE_IMAGE_EXTS.has(ext) ? ext : ".png"}`;
+  const ext = String(parsed.ext || "")
+    .toLowerCase()
+    .replace(/[^a-z0-9.]+/g, "")
+    .slice(0, 24);
+  return `${stem}${ext}`;
 }
 
 function uniqueWorkspaceRelPath(workspaceRoot, relPath) {
@@ -1434,8 +1438,6 @@ function readWorkspaceFilesRecursive(dir, root, depth = 0, maxDepth = 3, budget
       budget.count++;
     } else if (entry.isFile()) {
       if (WORKSPACE_FILE_SKIP_FILES.has(entry.name)) continue;
-      const ext = path.extname(entry.name).toLowerCase();
-      if (!WORKSPACE_TEXT_EXTS.has(ext) && !WORKSPACE_IMAGE_EXTS.has(ext)) continue;
       let size = 0;
       try { size = fs.statSync(abs).size; } catch {}
       budget.count++;
@@ -1964,6 +1966,102 @@ function normalizeDisplayShareNodeIds(ids, graph) {
   return out;
 }
 
+function normalizeDisplayShareLayout(layout, fallback = "canvas") {
+  const text = String(layout || "").trim();
+  return ["canvas", "gallery", "slides", "document", "single"].includes(text) ? text : fallback;
+}
+
+function createDisplayShareRecord({ userId, flowId, flowSource, archived, title, layout, nodeIds }) {
+  const shares = readDisplayShares();
+  let id = createDisplayShareId();
+  while (shares[id]) id = createDisplayShareId();
+  const nowDate = new Date();
+  const now = nowDate.toISOString();
+  const share = {
+    id,
+    userId: String(userId || ""),
+    flowId: String(flowId || ""),
+    flowSource: String(flowSource || "user"),
+    archived: archived === true,
+    title: String(title || "").trim() || "AgentFlow Display",
+    layout: normalizeDisplayShareLayout(layout, "canvas"),
+    nodeIds: Array.isArray(nodeIds) ? nodeIds : [],
+    createdAt: now,
+    updatedAt: now,
+    expiresAt: displayShareExpiresAt(nowDate),
+  };
+  shares[id] = share;
+  writeDisplayShares(shares);
+  return share;
+}
+
+function parseDisplayShareNodeIdInput(value) {
+  return String(value || "")
+    .split(/[\s,，]+/g)
+    .map((id) => id.trim())
+    .filter(Boolean);
+}
+
+function inferUpstreamDisplayNodeIds(graph, nodeId) {
+  const instances = graph?.instances && typeof graph.instances === "object" ? graph.instances : {};
+  const edges = Array.isArray(graph?.edges) ? graph.edges : [];
+  const ids = [];
+  const seen = new Set();
+  for (const edge of edges) {
+    if (String(edge?.target || "") !== String(nodeId || "")) continue;
+    const sourceId = String(edge?.source || "").trim();
+    if (!sourceId || seen.has(sourceId)) continue;
+    if (!workspaceDisplayKind(instances[sourceId]?.definitionId)) continue;
+    seen.add(sourceId);
+    ids.push(sourceId);
+  }
+  return ids;
+}
+
+function displayShareOutputUrl(shareId, baseUrl = "") {
+  const pathPart = `/display/${encodeURIComponent(String(shareId || ""))}`;
+  const base = String(baseUrl || "").trim();
+  if (!base) return pathPart;
+  try {
+    return new URL(pathPart, base.endsWith("/") ? base : `${base}/`).href;
+  } catch {
+    return pathPart;
+  }
+}
+
+function normalizeRunEnvKey(key) {
+  const text = String(key || "").trim();
+  return /^[A-Za-z_][A-Za-z0-9_]*$/.test(text) ? text : "";
+}
+
+function parseRunEnvAssignments(raw = "") {
+  const text = String(raw || "").trim();
+  if (!text) return {};
+  if (text.startsWith("{")) {
+    const parsed = JSON.parse(text);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("Run Env JSON must be an object");
+    const out = {};
+    for (const [key, value] of Object.entries(parsed)) {
+      const normalizedKey = normalizeRunEnvKey(key);
+      if (!normalizedKey) throw new Error(`Invalid env key: ${key}`);
+      out[normalizedKey] = String(value ?? "");
+    }
+    return out;
+  }
+  const out = {};
+  for (const line of text.split(/\r?\n/g)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const normalized = trimmed.replace(/^export\s+/i, "");
+    const eq = normalized.indexOf("=");
+    if (eq <= 0) throw new Error(`Invalid env assignment: ${trimmed}`);
+    const key = normalizeRunEnvKey(normalized.slice(0, eq));
+    if (!key) throw new Error(`Invalid env key: ${normalized.slice(0, eq).trim()}`);
+    out[key] = normalized.slice(eq + 1);
+  }
+  return out;
+}
+
 function publicDisplayPayloadFromShare(root, share) {
   const scoped = resolveWorkspaceScopeRoot(root, {
     flowId: share.flowId || "",
@@ -3324,6 +3422,13 @@ function workspaceIsControlEdge(graph, edge) {
     workspaceIsControlInputSlot(workspaceTargetSlotForEdge(graph, edge));
 }
 
+function workspaceControlIfBranchToSourceHandle(branch) {
+  const text = String(branch || "").trim().toLowerCase();
+  if (text === "true" || text === "next1") return "output-0";
+  if (text === "false" || text === "next2") return "output-1";
+  return null;
+}
+
 function workspaceNeedsUpstreamExecutionForEdge(graph, edge, scopedRoot = "") {
   if (workspaceIsControlEdge(graph, edge)) return true;
   return !workspaceEdgeHasCachedOutput(graph, edge, scopedRoot);
@@ -3341,7 +3446,7 @@ function workspaceEdgeHasCachedOutput(graph, edge, scopedRoot = "") {
   }
   const defId = String(source.definitionId || "");
   if (workspaceDisplayKind(defId) && String(source.body || "").trim()) return true;
-  if (defId === "provide_str" || defId === "provide_bool" || defId === "provide_file") {
+  if (defId === "provide_str" || defId === "provide_bool" || defId === "provide_file" || defId === "provide_password") {
     return Boolean(String(workspaceInstanceText(source) || "").trim());
   }
   return false;
@@ -4396,6 +4501,7 @@ async function workspaceRunToolNodejsScript({
   inputValues,
   runPackage,
   userCtx,
+  envOverlay = {},
   emit,
 }) {
   const scriptRef = String(instance?.scriptRef || "").trim();
@@ -4431,6 +4537,7 @@ async function workspaceRunToolNodejsScript({
   emit?.({ type: "status", line: `Run script: ${scriptRef || command.slice(0, 120)}` });
 
   const env = runtimeEnvForUser(userCtx, {
+    ...envOverlay,
     AGENTFLOW_WORKSPACE_ROOT: path.resolve(scopedRoot),
     AGENTFLOW_NODE_RUN_DIR: runPackage.nodeRunDir,
     AGENTFLOW_NODE_TMP_DIR: runPackage.nodeTmpDir,
@@ -4542,8 +4649,34 @@ async function runWorkspaceGraph(root, scopedRoot, payload, userCtx = {}, opts =
   };
   let cwd = scopedRoot;
   const modelKey = typeof payload?.model === "string" ? payload.model.trim() : "";
+  const runEnv = {};
+  const runtimeEnv = (extra = {}) => runtimeEnvForUser(userCtx, { ...runEnv, ...(extra || {}) });
   const autoCleanupWorktrees = [];
   const runTmpRoot = workspaceCreateRunTmpRoot(scopedRoot, runNodeId);
+  const controlBranches = new Map();
+  const skippedNodes = new Set();
+  const incomingControlEdgesByTarget = new Map();
+  for (const edge of Array.isArray(graph?.edges) ? graph.edges : []) {
+    const target = String(edge?.target || "");
+    if (!target || !workspaceIsControlEdge(graph, edge)) continue;
+    if (!incomingControlEdgesByTarget.has(target)) incomingControlEdgesByTarget.set(target, []);
+    incomingControlEdgesByTarget.get(target).push(edge);
+  }
+  const skipReasonForNode = (nodeId) => {
+    for (const edge of incomingControlEdgesByTarget.get(nodeId) || []) {
+      const sourceId = String(edge?.source || "");
+      if (!sourceId) continue;
+      if (skippedNodes.has(sourceId)) return `上游 ${sourceId} 已被分支跳过`;
+      const sourceDefId = String(graph.instances?.[sourceId]?.definitionId || "");
+      if (sourceDefId !== "control_if" || !controlBranches.has(sourceId)) continue;
+      const expectedHandle = workspaceControlIfBranchToSourceHandle(controlBranches.get(sourceId));
+      const actualHandle = String(edge?.sourceHandle || "output-0");
+      if (expectedHandle && actualHandle !== expectedHandle) {
+        return `control_if ${sourceId} 分支为 ${controlBranches.get(sourceId)}，跳过 ${actualHandle}`;
+      }
+    }
+    return "";
+  };
 
   try {
   for (const nodeId of order) {
@@ -4551,6 +4684,13 @@ async function runWorkspaceGraph(root, scopedRoot, payload, userCtx = {}, opts =
     const instance = graph.instances[nodeId];
     if (!instance) continue;
     const defId = String(instance.definitionId || "");
+    const skipReason = skipReasonForNode(nodeId);
+    if (skipReason) {
+      skippedNodes.add(nodeId);
+      emit({ type: "status", nodeId, line: `Skipped: ${skipReason}` });
+      emit({ type: "node-done", nodeId, definitionId: defId, skipped: true });
+      continue;
+    }
     emit({ type: "node-start", nodeId, definitionId: defId });
 
     if (defId === "workspace_run" || defId === "workspace_scheduled_run") {
@@ -4606,7 +4746,24 @@ async function runWorkspaceGraph(root, scopedRoot, payload, userCtx = {}, opts =
       continue;
     }
 
-    if (defId === "provide_str") {
+    if (defId === "control_if") {
+      const inputValues = workspaceInputValues(graph, nodeId, outputs, scopedRoot);
+      const boolSlot = (Array.isArray(instance.input) ? instance.input : [])
+        .find((slot) => String(slot?.type || "").trim().toLowerCase() === "bool");
+      const boolSlotName = String(boolSlot?.name || "").trim();
+      const rawValue = boolSlotName && Object.prototype.hasOwnProperty.call(inputValues, boolSlotName)
+        ? inputValues[boolSlotName]
+        : workspaceSlotValue(boolSlot);
+      const boolValue = parseBool(rawValue);
+      const branch = boolValue ? "true" : "false";
+      controlBranches.set(nodeId, branch);
+      outputs.set(nodeId, branch);
+      emit({ type: "status", nodeId, line: `control_if branch: ${branch}` });
+      emit({ type: "node-done", nodeId, definitionId: defId, branch });
+      continue;
+    }
+
+    if (defId === "provide_str" || defId === "provide_password") {
       const content = workspaceInstanceText(instance);
       outputs.set(nodeId, content);
       emit({ type: "node-done", nodeId, definitionId: defId });
@@ -4633,6 +4790,26 @@ async function runWorkspaceGraph(root, scopedRoot, payload, userCtx = {}, opts =
       continue;
     }
 
+    if (defId === "tool_set_run_env") {
+      const inputValues = workspaceInputValues(graph, nodeId, outputs, scopedRoot);
+      const assignments = {
+        ...parseRunEnvAssignments(inputValues.variables || workspaceSlotValue(workspaceSlotByName(instance, "variables"))),
+      };
+      const key = normalizeRunEnvKey(inputValues.key || workspaceSlotValue(workspaceSlotByName(instance, "key")));
+      if (key) assignments[key] = String(inputValues.value ?? workspaceSlotValue(workspaceSlotByName(instance, "value")) ?? "");
+      const keys = Object.keys(assignments);
+      if (!keys.length) throw new Error("Set Run Env requires key/value or variables");
+      Object.assign(runEnv, assignments);
+      let nextInstance = workspaceSetOutputSlot(instance, "keys", keys.join(", "));
+      nextInstance = workspaceSetOutputSlot(nextInstance, "count", String(keys.length));
+      graph.instances[nodeId] = nextInstance;
+      outputs.set(nodeId, keys.join(", "));
+      emit({ type: "status", nodeId, line: `Set run env: ${keys.join(", ")}`, envKeys: keys });
+      emit({ type: "graph", nodeId, graph });
+      emit({ type: "node-done", nodeId, definitionId: defId });
+      continue;
+    }
+
     if (defId === "control_cd_workspace") {
       const inputText = workspaceUpstreamText(graph, nodeId, outputs, scopedRoot);
       const inputSlots = Array.isArray(instance.input) ? instance.input : [];
@@ -4829,7 +5006,7 @@ async function runWorkspaceGraph(root, scopedRoot, payload, userCtx = {}, opts =
         gitlabApiBase: workspaceSlotValue(workspaceSlotByName(instance, "gitlabApiBase")),
         removeSourceBranch: workspaceSlotValue(workspaceSlotByName(instance, "removeSourceBranch")),
         squash: workspaceSlotValue(workspaceSlotByName(instance, "squash")),
-      }, runtimeEnvForUser(userCtx));
+      }, runtimeEnv());
       let nextInstance = workspaceSetOutputSlot(instance, "mrUrl", result.mrUrl);
       nextInstance = workspaceSetOutputSlot(nextInstance, "created", result.created ? "true" : "false");
       nextInstance = workspaceSetOutputSlot(nextInstance, "mrIid", result.mrIid ?? "");
@@ -4856,12 +5033,12 @@ async function runWorkspaceGraph(root, scopedRoot, payload, userCtx = {}, opts =
             corpSecret: inputValues.corpSecret || workspaceSlotValue(workspaceSlotByName(instance, "corpSecret")),
             agentId: inputValues.agentId || workspaceSlotValue(workspaceSlotByName(instance, "agentId")),
             accessToken: inputValues.accessToken || workspaceSlotValue(workspaceSlotByName(instance, "accessToken")),
-          }, runtimeEnvForUser(userCtx))
+          }, runtimeEnv())
         : await sendWecomGroupMarkdown({
             markdown,
             webhookUrl: inputValues.webhookUrl || workspaceSlotValue(workspaceSlotByName(instance, "webhookUrl")),
             webhookKey: inputValues.webhookKey || workspaceSlotValue(workspaceSlotByName(instance, "webhookKey")),
-          }, runtimeEnvForUser(userCtx));
+          }, runtimeEnv());
       let nextInstance = workspaceSetOutputSlot(instance, "sent", "true");
       nextInstance = workspaceSetOutputSlot(nextInstance, "message", result.message);
       nextInstance = workspaceSetOutputSlot(nextInstance, "response", JSON.stringify(result.response || {}));
@@ -4872,6 +5049,52 @@ async function runWorkspaceGraph(root, scopedRoot, payload, userCtx = {}, opts =
       continue;
     }
 
+    if (defId === "tool_display_share_link") {
+      const inputValues = workspaceInputValues(graph, nodeId, outputs, scopedRoot);
+      const explicitNodeIds = parseDisplayShareNodeIdInput(inputValues.nodeIds || workspaceSlotValue(workspaceSlotByName(instance, "nodeIds")));
+      const inferredNodeIds = explicitNodeIds.length ? explicitNodeIds : inferUpstreamDisplayNodeIds(graph, nodeId);
+      const nodeIds = normalizeDisplayShareNodeIds(inferredNodeIds, graph);
+      if (nodeIds.length === 0) throw new Error("Display Share Link requires at least one connected display node or nodeIds input");
+
+      const layout = normalizeDisplayShareLayout(inputValues.layout || workspaceSlotValue(workspaceSlotByName(instance, "layout")), "single");
+      const title = inputValues.title || workspaceSlotValue(workspaceSlotByName(instance, "title"));
+      const env = runtimeEnv();
+      const baseUrl = inputValues.baseUrl ||
+        workspaceSlotValue(workspaceSlotByName(instance, "baseUrl")) ||
+        env.AGENTFLOW_PUBLIC_BASE_URL ||
+        env.AGENTFLOW_BASE_URL ||
+        env.PUBLIC_BASE_URL ||
+        "";
+
+      const graphPath = workspaceGraphPath(scopedRoot);
+      try {
+        const currentGraph = readWorkspaceGraph(scopedRoot).graph;
+        const mergedGraph = mergeWorkspaceRunGraph(currentGraph, graph, new Set([nodeId, ...nodeIds]));
+        fs.writeFileSync(graphPath, JSON.stringify(mergedGraph, null, 2) + "\n", "utf-8");
+      } catch (e) {
+        emit({ type: "natural", kind: "warning", text: `保存分享展示内容失败：${(e && e.message) || String(e)}` });
+      }
+
+      const share = createDisplayShareRecord({
+        userId: userCtx.userId,
+        flowId: payload.flowId || "",
+        flowSource: payload.flowSource || "user",
+        archived: payload.archived === true || payload.flowArchived === true,
+        title,
+        layout,
+        nodeIds,
+      });
+      const url = displayShareOutputUrl(share.id, baseUrl);
+      let nextInstance = workspaceSetOutputSlot(instance, "url", url);
+      nextInstance = workspaceSetOutputSlot(nextInstance, "shareId", share.id);
+      nextInstance = workspaceSetOutputSlot(nextInstance, "expiresAt", share.expiresAt);
+      graph.instances[nodeId] = nextInstance;
+      outputs.set(nodeId, url);
+      emit({ type: "graph", nodeId, graph, displayNodeIds: nodeIds });
+      emit({ type: "node-done", nodeId, definitionId: defId });
+      continue;
+    }
+
     if (defId === "tool_nodejs") {
       const prepareStartedAt = Date.now();
       const inputValues = workspaceInputValues(graph, nodeId, outputs, scopedRoot);
@@ -4893,6 +5116,7 @@ async function runWorkspaceGraph(root, scopedRoot, payload, userCtx = {}, opts =
         inputValues: runtimeInputValues,
         runPackage,
         userCtx,
+        envOverlay: runEnv,
         emit: (event) => emit({ ...event, nodeId }),
       });
       const normalizedAgentOutput = workspacePublishAgentOutputFiles(workspaceStructuredAgentOutput(content), runPackage);
@@ -4974,12 +5198,12 @@ async function runWorkspaceGraph(root, scopedRoot, payload, userCtx = {}, opts =
           prompt,
           modelKey,
           agentflowUserId: userCtx.userId || "",
-          extraEnv: {
+          extraEnv: runtimeEnv({
             AGENTFLOW_WORKSPACE_TMP_ROOT: runTmpRoot,
             AGENTFLOW_NODE_RUN_DIR: runPackage.nodeRunDir,
             AGENTFLOW_NODE_TMP_DIR: runPackage.nodeTmpDir,
             AGENTFLOW_OUTPUTS_DIR: runPackage.outputsDir,
-          },
+          }),
           onStreamEvent: (ev) => {
             if (!firstAgentEventSeen) {
               firstAgentEventSeen = true;
@@ -6363,27 +6587,16 @@ export function startUiServer({
           json(res, 400, { error: "请选择至少一个 display 节点" });
           return;
         }
-        const shares = readDisplayShares();
-        let id = createDisplayShareId();
-        while (shares[id]) id = createDisplayShareId();
-        const nowDate = new Date();
-        const now = nowDate.toISOString();
-        const share = {
-          id,
+        const share = createDisplayShareRecord({
           userId: authUser.userId,
           flowId: scoped.flowId || "",
           flowSource: scoped.flowSource || "user",
           archived: scoped.archived === true,
-          title: String(payload.title || "").trim() || "AgentFlow Display",
-          layout: ["canvas", "gallery", "slides", "document", "single"].includes(String(payload.layout || "")) ? String(payload.layout) : "canvas",
+          title: payload.title,
+          layout: payload.layout,
           nodeIds,
-          createdAt: now,
-          updatedAt: now,
-          expiresAt: displayShareExpiresAt(nowDate),
-        };
-        shares[id] = share;
-        writeDisplayShares(shares);
-        json(res, 200, { ok: true, share, url: `/display/${encodeURIComponent(id)}` });
+        });
+        json(res, 200, { ok: true, share, url: `/display/${encodeURIComponent(share.id)}` });
       } catch (e) {
         json(res, 500, { error: (e && e.message) || String(e) });
       }
@@ -6897,13 +7110,9 @@ export function startUiServer({
           return;
         }
         const safeName = sanitizeWorkspaceUploadName(parsed.filename);
-        const ext = path.extname(safeName).toLowerCase();
-        if (!WORKSPACE_IMAGE_EXTS.has(ext) || (parsed.mimeType && !/^image\//i.test(parsed.mimeType))) {
-          json(res, 400, { error: "Only image uploads are supported" });
-          return;
-        }
-        const targetDir = String(parsed.fields.dir || "img").trim().replace(/^[/\\]+/, "") || "img";
-        const target = uniqueWorkspaceRelPath(scoped.root, path.posix.join(targetDir.replace(/\\/g, "/"), safeName));
+        const targetDir = String(parsed.fields.dir ?? "").trim().replace(/^[/\\]+/, "").replace(/\\/g, "/");
+        const targetRel = targetDir ? path.posix.join(targetDir, safeName) : safeName;
+        const target = uniqueWorkspaceRelPath(scoped.root, targetRel);
         fs.mkdirSync(path.dirname(target.abs), { recursive: true });
         fs.writeFileSync(target.abs, parsed.file);
         json(res, 200, {

package/builtin/nodes/provide_password.md

@@ -0,0 +1,13 @@
+---
+# Built-in node: directly provide a hidden password/secret value
+description: Provide a secret text value without showing it on the node card
+displayName: Password
+input: []
+output:
+  - type: text
+    name: value
+    default: ""
+    required: true
+    showOnNode: true
+---
+${USER_PROMPT}

package/builtin/nodes/tool_display_share_link.md

@@ -0,0 +1,46 @@
+---
+# Built-in node: create share link for Display nodes
+description: Create a public share link for upstream Display nodes
+displayName: Display Share Link
+input:
+  - type: node
+    name: prev
+    default: ""
+  - type: text
+    name: title
+    default: ""
+    description: "分享页标题；为空时使用 AgentFlow Display。"
+    showOnNode: true
+  - type: text
+    name: layout
+    default: "single"
+    description: "分享布局：single、gallery、slides、document、canvas。"
+    showOnNode: true
+  - type: text
+    name: nodeIds
+    default: ""
+    description: "可选。逗号或空格分隔的 Display 节点 ID；为空时自动使用连接到本节点的上游 Display 节点。"
+    showOnNode: false
+  - type: text
+    name: baseUrl
+    default: ""
+    description: "可选。输出绝对链接的站点地址，例如 https://agentflow.example.com；为空时输出 /display/<id>。"
+    showOnNode: false
+output:
+  - type: node
+    name: next
+    default: ""
+  - type: text
+    name: url
+    default: ""
+    showOnNode: true
+  - type: text
+    name: shareId
+    default: ""
+    showOnNode: false
+  - type: text
+    name: expiresAt
+    default: ""
+    showOnNode: false
+---
+Create a share link for connected Display nodes.

package/builtin/nodes/tool_set_run_env.md

@@ -0,0 +1,37 @@
+---
+# Built-in node: set environment variables for the current run only
+description: Set environment variables for downstream nodes in the current workspace run
+displayName: Set Run Env
+input:
+  - type: node
+    name: prev
+    default: ""
+  - type: text
+    name: key
+    default: ""
+    description: "单个环境变量名，例如 IMAP_USER。"
+    showOnNode: true
+  - type: text
+    name: value
+    default: ""
+    description: "单个环境变量值。"
+    showOnNode: true
+  - type: text
+    name: variables
+    default: ""
+    description: "批量设置，支持多行 KEY=VALUE 或 JSON object。"
+    showOnNode: false
+output:
+  - type: node
+    name: next
+    default: ""
+  - type: text
+    name: keys
+    default: ""
+    showOnNode: false
+  - type: text
+    name: count
+    default: ""
+    showOnNode: false
+---
+Set environment variables for downstream nodes in this run only.