c0de-agent 1.4.0 → 1.5.0

package/dist/core/index.d.ts

@@ -12,5 +12,5 @@ export type { CollectedToolCall, ToolCallResult } from './tool-exec.js';
 export { executeToolCall, executeToolCalls, partitionByConflict } from './tool-exec.js';
 export type { AgentConfig, AgentDependencies, AgentError, AgentEvent, AgentState, AgentStatus, CommandContext, CommandResult, LLMSegment, PendingToolCall, ProjectInfo, PromptContext, SlashCommand, TokenBudget, } from './types.js';
 export { buildWorkflowNotice, containsWorkflow, WORKFLOW_NOTICE } from './workflow.js';
-export type { WorkflowAgentResult, WorkflowContext, WorkflowEntry, WorkflowMeta, WorkflowRegistry, WorkflowResult, WorkflowUtils, } from './workflows/index.js';
-export { BUILTIN_WORKFLOWS, buildWorkflowContext, createAndPopulateRegistry, createBuiltinWorkflows, createWorkflowRegistry, discoverWorkflows, executeWorkflow, } from './workflows/index.js';
+export type { SaveResult, SaveTarget, WorkflowAgentResult, WorkflowContext, WorkflowEntry, WorkflowMeta, WorkflowRegistry, WorkflowResult, WorkflowUtils, } from './workflows/index.js';
+export { BUILTIN_WORKFLOWS, buildWorkflowContext, createAndPopulateRegistry, createBuiltinWorkflows, createWorkflowRegistry, discoverWorkflows, executeWorkflow, reloadRegistry, saveWorkflow, } from './workflows/index.js';

package/dist/core/index.js

@@ -10,4 +10,4 @@ export { builtinCommands, createSlashRegistry, parseSlashInput } from './slash.j
 export { clearSteering, drainSteering, injectSteering } from './steering.js';
 export { executeToolCall, executeToolCalls, partitionByConflict } from './tool-exec.js';
 export { buildWorkflowNotice, containsWorkflow, WORKFLOW_NOTICE } from './workflow.js';
-export { BUILTIN_WORKFLOWS, buildWorkflowContext, createAndPopulateRegistry, createBuiltinWorkflows, createWorkflowRegistry, discoverWorkflows, executeWorkflow, } from './workflows/index.js';
+export { BUILTIN_WORKFLOWS, buildWorkflowContext, createAndPopulateRegistry, createBuiltinWorkflows, createWorkflowRegistry, discoverWorkflows, executeWorkflow, reloadRegistry, saveWorkflow, } from './workflows/index.js';

package/dist/core/slash.js

@@ -1,6 +1,6 @@
 import { createSession } from '../session/session.js';
 import { createAgent } from './agent.js';
-import { BUILTIN_WORKFLOWS, createWorkflowRegistry, executeWorkflow } from './workflows/index.js';
+import { BUILTIN_WORKFLOWS, createWorkflowRegistry, executeWorkflow, reloadRegistry, saveWorkflow, } from './workflows/index.js';
 function parseSlashInput(input) {
     const trimmed = input.trim();
     if (!trimmed.startsWith('/'))
@@ -109,7 +109,7 @@ const configCommand = {
 const workflowCommand = {
     name: 'workflow',
     description: 'Manage and run workflows',
-    argsHint: '[run|show|list] [name] [args]',
+    argsHint: '[list|run|show|create|edit] [name] [args]',
     execute: async (args, ctx) => {
         const parts = args.split(/\s+/).filter(Boolean);
         const subcommand = parts[0] ?? 'list';
@@ -129,7 +129,11 @@ const workflowCommand = {
                 lines.push(`  /${wf.meta.name}${phases}  — ${wf.meta.description} (${wf.source})`);
             }
             lines.push('');
-            lines.push('Usage: /workflow run <name> [args]');
+            lines.push('Usage:');
+            lines.push('  /workflow run <name> [args]     — 执行工作流');
+            lines.push('  /workflow create <name> --file <path>  — 从文件创建工作流');
+            lines.push('  /workflow edit <name>           — 编辑工作流源码');
+            lines.push('  /workflow show <name>           — 查看工作流源码');
             return { _tag: 'text', text: lines.join('\n') };
         }
         if (subcommand === 'show') {
@@ -146,6 +150,64 @@ const workflowCommand = {
                 text: `// ${wf.meta.name}: ${wf.meta.description}\n\n${code}`,
             };
         }
+        if (subcommand === 'create') {
+            const name = parts[1];
+            if (!name)
+                return { _tag: 'error', message: 'Usage: /workflow create <name> --file <path>' };
+            // 解析 --file <path> 参数
+            const fileIdx = parts.indexOf('--file');
+            if (fileIdx === -1 || !parts[fileIdx + 1]) {
+                return { _tag: 'error', message: 'Usage: /workflow create <name> --file <path>\nTip: 也可通过 REST API POST /api/workflows { name, source } 创建' };
+            }
+            const filePath = parts[fileIdx + 1] ?? '';
+            let source;
+            try {
+                source = await import('node:fs/promises').then((fs) => fs.readFile(filePath, 'utf-8'));
+            }
+            catch {
+                return { _tag: 'error', message: `Cannot read file: ${filePath}` };
+            }
+            const result = await saveWorkflow(name, source, 'project', ctx.cwd);
+            if (!result.ok) {
+                return { _tag: 'error', message: result.error };
+            }
+            // 热重载注册表
+            if (ctx.workflowRegistry) {
+                await reloadRegistry(ctx.workflowRegistry, ctx.cwd);
+            }
+            return {
+                _tag: 'success',
+                message: `Workflow "${name}" saved to ${result.filePath}\n现在可以用 /workflow run ${name} 执行，或在对话中输入 /${name} 调用。`,
+            };
+        }
+        if (subcommand === 'edit') {
+            const name = parts[1];
+            if (!name)
+                return { _tag: 'error', message: 'Usage: /workflow edit <name>' };
+            const wf = registry.get(name);
+            if (!wf) {
+                return { _tag: 'error', message: `Unknown workflow: ${name}` };
+            }
+            if (wf.source === 'builtin') {
+                return { _tag: 'error', message: 'Cannot edit builtin workflow. Fork it first: /workflow create <new-name> --file <path>' };
+            }
+            if (!wf.filePath) {
+                return { _tag: 'error', message: `Workflow file path not available for "${name}"` };
+            }
+            const editor = process.env.EDITOR || process.env.VISUAL || 'vi';
+            try {
+                const { spawnSync } = await import('node:child_process');
+                spawnSync(editor, [wf.filePath], { stdio: 'inherit' });
+            }
+            catch {
+                return { _tag: 'error', message: `Failed to launch editor: ${editor}` };
+            }
+            // 编辑后热重载
+            if (ctx.workflowRegistry) {
+                await reloadRegistry(ctx.workflowRegistry, ctx.cwd);
+            }
+            return { _tag: 'success', message: `Workflow "${name}" reloaded after edit.` };
+        }
         if (subcommand === 'run') {
             const name = parts[1];
             if (!name)
@@ -170,7 +232,7 @@ const workflowCommand = {
         }
         return {
             _tag: 'error',
-            message: `Unknown subcommand: ${subcommand}. Use: list, run, show`,
+            message: `Unknown subcommand: ${subcommand}. Use: list, run, show, create, edit`,
         };
     },
 };

package/dist/core/workflow.d.ts

@@ -25,7 +25,7 @@ export declare function containsWorkflow(text: string): boolean;
  *
  * 适配 c0de-agent 的 task 工具 schema（subagent_type + context + tasks[]）。
  */
-export declare const WORKFLOW_NOTICE = "<workflow-notice>\nThe user's message contains the **workflowz** keyword: you MUST drive this task as a deterministic multi-subagent workflow using the `task` tool for batched fan-out. This is not optional \u2014 the keyword signals the user explicitly wants parallel sub-agent decomposition, not inline work. This overrides any default tendency to do the whole task inline.\n\n<when>\nThe user typed workflowz intentionally \u2014 they want fan-out. You may do a brief inline scout (1-2 tool calls to list files/scope the work), but your NEXT action after scouting MUST be a `task` tool call to fan out. Do NOT spend the entire turn reading files inline \u2014 that defeats the purpose. Common shapes:\n- **Understand** \u2014 parallel readers over subsystems \u2192 structured map.\n- **Design** \u2014 independent approaches \u2192 scored synthesis.\n- **Review** \u2014 split dimensions \u2192 find per dimension \u2192 adversarially verify each finding.\n- **Research** \u2014 multi-modal sweep \u2192 deep-read the hits \u2192 synthesize.\n- **Migrate** \u2014 discover sites \u2192 transform each \u2192 verify.\n</when>\n\n<task-contract>\nCall `task` once per independent fan-out batch using the batch form:\n\n    task({\n      subagent_type: \"coder\",\n      context: \"shared background all subagents need\",\n      tasks: [\n        { role: \"coder\", assignment: \"specific assignment for agent 1\", description: \"short label\" },\n        { role: \"reviewer\", assignment: \"specific assignment for agent 2\", description: \"short label\" },\n      ]\n    })\n\nAvailable subagent types: `general` (full tools, recursive), `coder` (implementation), `researcher` (read-only scout), `reviewer` (code review). Pick the type that matches each task's intent.\n\n`context` carries shared background prepended to every subagent's prompt \u2014 put the shared contract, conventions, and coordination rules here.\n\nEach task in `tasks[]` must be self-contained:\n- `role`: specialist type for this sub-task (e.g. coder, reviewer, researcher)\n- `assignment`: exact target (files, symbols, subsystem) + what to do + acceptance criteria\n- `description`: short label for the UI\n\nEach subagent runs in an isolated session and returns its result via the `yield` tool. Subagents skip formatters, linters, and project-wide tests \u2014 the parent runs shared proof once after all results return.\n</task-contract>\n\n<structure>\nDecompose first, then batch the independent leaves:\n\n    task({\n      subagent_type: \"coder\",\n      context: \"# Goal\nImplement feature X across the codebase\n# Constraints\nFollow existing patterns...\n# Contract\nReturn findings as structured data...\",\n      tasks: [\n        { role: \"coder\", assignment: \"# Target\nsrc/auth/login.ts\n# Change\nAdd rate limiting to login endpoint\n# Acceptance\nRate limiter works, tests pass\", description: \"Login rate limiting\" },\n        { role: \"coder\", assignment: \"# Target\nsrc/auth/signup.ts\n# Change\nAdd input validation\n# Acceptance\nValidation blocks invalid emails\", description: \"Signup validation\" },\n      ]\n    })\n\nPrefer one wide batch over serial calls when work items do not share files. If tasks overlap, have agents coordinate before editing.\n</structure>\n\n<patterns>\n- **Adversarial verify** \u2014 dispatch skeptical reviewers with distinct targets, then keep only findings you can verify against source.\n- **Perspective-diverse review** \u2014 use separate correctness, security, performance roles instead of identical reviewers.\n- **Completeness critic** \u2014 after the first batch, dispatch one read-only critic that asks what was missed.\n- **No silent caps** \u2014 if you bound coverage (top-N, sampling), state what was dropped and why.\n- **Parent owns closure** \u2014 subagents return evidence; the parent reads it, resolves contradictions, runs proof, and makes the final decision.\n</patterns>\n\n<execution>\n- **You MUST call the `task` tool** \u2014 this is the defining action of a workflowz request. A response that only does inline read/glob/edit without dispatching sub-agents is a failure.\n- Capture multi-phase workflow state in the visible todo system when available.\n- Batch independent subagents in one `task` call.\n- Give every subagent a narrow target, explicit non-goals, and a concrete return packet.\n- After fan-out returns, read the results, patch or decide, and run the shared gate.\n- Keep going until the task is closed \u2014 returned fan-out is a step, not a stopping point.\n</execution>\n</workflow-notice>";
+export declare const WORKFLOW_NOTICE = "<workflow-notice>\nThe user's message contains the **workflowz** keyword: you MUST drive this task as a deterministic multi-subagent workflow using the `task` tool for batched fan-out. This is not optional \u2014 the keyword signals the user explicitly wants parallel sub-agent decomposition, not inline work. This overrides any default tendency to do the whole task inline.\n\n<when>\nThe user typed workflowz intentionally \u2014 they want fan-out. You may do a brief inline scout (1-2 tool calls to list files/scope the work), but your NEXT action after scouting MUST be a `task` tool call to fan out. Do NOT spend the entire turn reading files inline \u2014 that defeats the purpose. Common shapes:\n- **Understand** \u2014 parallel readers over subsystems \u2192 structured map.\n- **Design** \u2014 independent approaches \u2192 scored synthesis.\n- **Review** \u2014 split dimensions \u2192 find per dimension \u2192 adversarially verify each finding.\n- **Research** \u2014 multi-modal sweep \u2192 deep-read the hits \u2192 synthesize.\n- **Migrate** \u2014 discover sites \u2192 transform each \u2192 verify.\n</when>\n\n<task-contract>\nCall `task` once per independent fan-out batch using the batch form:\n\n    task({\n      subagent_type: \"coder\",\n      context: \"shared background all subagents need\",\n      tasks: [\n        { role: \"coder\", assignment: \"specific assignment for agent 1\", description: \"short label\" },\n        { role: \"reviewer\", assignment: \"specific assignment for agent 2\", description: \"short label\" },\n      ]\n    })\n\nAvailable subagent types: `general` (full tools, recursive), `coder` (implementation), `researcher` (read-only scout), `reviewer` (code review). Pick the type that matches each task's intent.\n\n`context` carries shared background prepended to every subagent's prompt \u2014 put the shared contract, conventions, and coordination rules here.\n\nEach task in `tasks[]` must be self-contained:\n- `role`: specialist type for this sub-task (e.g. coder, reviewer, researcher)\n- `assignment`: exact target (files, symbols, subsystem) + what to do + acceptance criteria\n- `description`: short label for the UI\n\nEach subagent runs in an isolated session and returns its result via the `yield` tool. Subagents skip formatters, linters, and project-wide tests \u2014 the parent runs shared proof once after all results return.\n</task-contract>\n\n<structure>\nDecompose first, then batch the independent leaves:\n\n    task({\n      subagent_type: \"coder\",\n      context: \"# Goal\nImplement feature X across the codebase\n# Constraints\nFollow existing patterns...\n# Contract\nReturn findings as structured data...\",\n      tasks: [\n        { role: \"coder\", assignment: \"# Target\nsrc/auth/login.ts\n# Change\nAdd rate limiting to login endpoint\n# Acceptance\nRate limiter works, tests pass\", description: \"Login rate limiting\" },\n        { role: \"coder\", assignment: \"# Target\nsrc/auth/signup.ts\n# Change\nAdd input validation\n# Acceptance\nValidation blocks invalid emails\", description: \"Signup validation\" },\n      ]\n    })\n\nPrefer one wide batch over serial calls when work items do not share files. If tasks overlap, have agents coordinate before editing.\n</structure>\n\n<patterns>\n- **Adversarial verify** \u2014 dispatch skeptical reviewers with distinct targets, then keep only findings you can verify against source.\n- **Perspective-diverse review** \u2014 use separate correctness, security, performance roles instead of identical reviewers.\n- **Completeness critic** \u2014 after the first batch, dispatch one read-only critic that asks what was missed.\n- **No silent caps** \u2014 if you bound coverage (top-N, sampling), state what was dropped and why.\n- **Parent owns closure** \u2014 subagents return evidence; the parent reads it, resolves contradictions, runs proof, and makes the final decision.\n- **Save reusable workflows** \u2014 if the fan-out pattern is reusable, save it as a `/workflow create <name>` command. Generate a JS file with `export const meta = { name, description, phases }` and a default async function that orchestrates via `ctx.runSubagents`. Use the REST API `POST /api/workflows` with body `{ name, source }` to save it, or write the file directly to `.c0de/workflows/<name>.js`. Saved workflows become slash commands (`/<name>`) that can be re-run anytime.\n</patterns>\n\n<execution>\n- **You MUST call the `task` tool** \u2014 this is the defining action of a workflowz request. A response that only does inline read/glob/edit without dispatching sub-agents is a failure.\n- Capture multi-phase workflow state in the visible todo system when available.\n- Batch independent subagents in one `task` call.\n- Give every subagent a narrow target, explicit non-goals, and a concrete return packet.\n- After fan-out returns, read the results, patch or decide, and run the shared gate.\n- Keep going until the task is closed \u2014 returned fan-out is a step, not a stopping point.\n</execution>\n</workflow-notice>";
 /**
  * 构建工作流 steering 通知：基础通知 + 可选的已注册工作流列表。
  * 无工作流时退化为纯基础通知（向后兼容）。

package/dist/core/workflow.js

@@ -93,6 +93,7 @@ Prefer one wide batch over serial calls when work items do not share files. If t
 - **Completeness critic** — after the first batch, dispatch one read-only critic that asks what was missed.
 - **No silent caps** — if you bound coverage (top-N, sampling), state what was dropped and why.
 - **Parent owns closure** — subagents return evidence; the parent reads it, resolves contradictions, runs proof, and makes the final decision.
+- **Save reusable workflows** — if the fan-out pattern is reusable, save it as a \`/workflow create <name>\` command. Generate a JS file with \`export const meta = { name, description, phases }\` and a default async function that orchestrates via \`ctx.runSubagents\`. Use the REST API \`POST /api/workflows\` with body \`{ name, source }\` to save it, or write the file directly to \`.c0de/workflows/<name>.js\`. Saved workflows become slash commands (\`/<name>\`) that can be re-run anytime.
 </patterns>
 
 <execution>
@@ -113,8 +114,10 @@ export function buildWorkflowNotice(workflows) {
         ? `\n<registered-workflows>
 Available workflow templates you can invoke with the task tool's workflow parameter:
 ${workflows.map((w) => `- ${w.name}: ${w.description}`).join('\n')}
-If none fit, orchestrate inline using runSubagent fan-out as described below.
+If none fit, orchestrate inline using runSubagent fan-out as described below, then save your workflow with POST /api/workflows { name, source } for reuse.
 </registered-workflows>`
-        : '';
+        : `\n<registered-workflows>
+No saved workflows yet. After orchestrating a successful fan-out, save it with POST /api/workflows { name, source } for reuse.
+</registered-workflows>`;
     return WORKFLOW_NOTICE + registeredSection;
 }

package/dist/core/workflows/discovery.d.ts

@@ -1,4 +1,4 @@
-import type { WorkflowEntry } from './types.js';
+import type { WorkflowEntry, WorkflowMeta } from './types.js';
 /**
  * 扫描项目目录下的 `.c0de/workflows/*.js` 文件，source 标记为 'project'。
  */
@@ -8,4 +8,25 @@ declare function discoverWorkflows(projectDir: string): Promise<WorkflowEntry[]>
  * 目录不存在时返回空数组（与项目级一致）。
  */
 declare function discoverGlobalWorkflows(): Promise<WorkflowEntry[]>;
-export { discoverGlobalWorkflows, discoverWorkflows };
+/** saveWorkflow 的目标层级。 */
+type SaveTarget = 'project' | 'user';
+/** saveWorkflow 的结果。 */
+type SaveResult = {
+    ok: true;
+    filePath: string;
+    meta: WorkflowMeta;
+} | {
+    ok: false;
+    error: string;
+};
+/**
+ * 将工作流源码保存到磁盘并验证可加载。
+ *
+ * - name 必须匹配 `[a-z0-9-]+`
+ * - 写入 `<projectDir>/.c0de/workflows/<name>.js`（project）或 `~/.c0de/workflows/<name>.js`（user）
+ * - 写入后 dynamic import 验证 meta + default 导出存在；验证失败则删除文件
+ * - 返回 { ok, filePath, meta } 或 { ok: false, error }
+ */
+declare function saveWorkflow(name: string, source: string, target?: SaveTarget, projectDir?: string): Promise<SaveResult>;
+export { discoverGlobalWorkflows, discoverWorkflows, saveWorkflow };
+export type { SaveResult, SaveTarget };

package/dist/core/workflows/discovery.js

@@ -1,4 +1,4 @@
-import { readdir, readFile } from 'node:fs/promises';
+import { mkdir, readdir, readFile, unlink, writeFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { basename, join } from 'node:path';
 import { pathToFileURL } from 'node:url';
@@ -66,4 +66,40 @@ async function discoverWorkflows(projectDir) {
 async function discoverGlobalWorkflows() {
     return discoverFromDir(join(homedir(), GLOBAL_WORKFLOWS_DIR), 'user');
 }
-export { discoverGlobalWorkflows, discoverWorkflows };
+/** 合法工作流名称：仅小写字母、数字、连字符。 */
+const WORKFLOW_NAME_RE = /^[a-z0-9-]+$/;
+/**
+ * 将工作流源码保存到磁盘并验证可加载。
+ *
+ * - name 必须匹配 `[a-z0-9-]+`
+ * - 写入 `<projectDir>/.c0de/workflows/<name>.js`（project）或 `~/.c0de/workflows/<name>.js`（user）
+ * - 写入后 dynamic import 验证 meta + default 导出存在；验证失败则删除文件
+ * - 返回 { ok, filePath, meta } 或 { ok: false, error }
+ */
+async function saveWorkflow(name, source, target = 'project', projectDir) {
+    if (!WORKFLOW_NAME_RE.test(name)) {
+        return { ok: false, error: `Invalid workflow name "${name}": must match [a-z0-9-]+` };
+    }
+    const dir = target === 'project'
+        ? join(projectDir ?? '.', PROJECT_WORKFLOWS_DIR)
+        : join(homedir(), GLOBAL_WORKFLOWS_DIR);
+    await mkdir(dir, { recursive: true });
+    const filePath = join(dir, `${name}.js`);
+    await writeFile(filePath, source, 'utf-8');
+    // 验证：dynamic import 检查 meta + default
+    try {
+        const fileUrl = pathToFileURL(filePath).href;
+        const mod = (await import(`${fileUrl}#${Date.now()}`));
+        if (!mod.meta || typeof mod.default !== 'function') {
+            await unlink(filePath);
+            return { ok: false, error: 'Workflow source missing `export const meta` or default export' };
+        }
+        const meta = { ...mod.meta, name: mod.meta.name ?? name };
+        return { ok: true, filePath, meta };
+    }
+    catch (e) {
+        await unlink(filePath);
+        return { ok: false, error: `Failed to load workflow: ${e instanceof Error ? e.message : String(e)}` };
+    }
+}
+export { discoverGlobalWorkflows, discoverWorkflows, saveWorkflow };

package/dist/core/workflows/index.d.ts

@@ -1,7 +1,8 @@
 export { BUILTIN_WORKFLOWS, createBuiltinWorkflows } from './builtins.js';
 export { buildWorkflowContext } from './context.js';
-export { discoverGlobalWorkflows, discoverWorkflows } from './discovery.js';
+export { discoverGlobalWorkflows, discoverWorkflows, saveWorkflow } from './discovery.js';
+export type { SaveResult, SaveTarget } from './discovery.js';
 export type { WorkflowRegistry } from './registry.js';
-export { createAndPopulateRegistry, createWorkflowRegistry } from './registry.js';
+export { createAndPopulateRegistry, createWorkflowRegistry, reloadRegistry } from './registry.js';
 export { executeWorkflow } from './runtime.js';
 export type { WorkflowAgentResult, WorkflowContext, WorkflowEntry, WorkflowMeta, WorkflowModule, WorkflowResult, WorkflowSource, WorkflowUtils, } from './types.js';

package/dist/core/workflows/index.js

@@ -1,5 +1,5 @@
 export { BUILTIN_WORKFLOWS, createBuiltinWorkflows } from './builtins.js';
 export { buildWorkflowContext } from './context.js';
-export { discoverGlobalWorkflows, discoverWorkflows } from './discovery.js';
-export { createAndPopulateRegistry, createWorkflowRegistry } from './registry.js';
+export { discoverGlobalWorkflows, discoverWorkflows, saveWorkflow } from './discovery.js';
+export { createAndPopulateRegistry, createWorkflowRegistry, reloadRegistry } from './registry.js';
 export { executeWorkflow } from './runtime.js';

package/dist/core/workflows/registry.d.ts

@@ -6,6 +6,8 @@ declare function createWorkflowRegistry(): {
     list(): WorkflowEntry[];
     has(name: string): boolean;
     delete(name: string): boolean;
+    /** 清空注册表（热重载前调用）。 */
+    clear(): void;
 };
 type WorkflowRegistry = ReturnType<typeof createWorkflowRegistry>;
 /**
@@ -16,5 +18,10 @@ type WorkflowRegistry = ReturnType<typeof createWorkflowRegistry>;
  * 覆盖优先级：project > user > builtin。
  */
 declare function createAndPopulateRegistry(projectDir: string): Promise<WorkflowRegistry>;
+/**
+ * 重新填充已有注册表：清空 → 三级发现 → 注册。
+ * 用于 create/save 后热重载，保留同一 registry 引用。
+ */
+declare function reloadRegistry(registry: WorkflowRegistry, projectDir: string): Promise<void>;
 export type { WorkflowRegistry };
-export { createAndPopulateRegistry, createWorkflowRegistry };
+export { createAndPopulateRegistry, createWorkflowRegistry, reloadRegistry };

package/dist/core/workflows/registry.js

@@ -19,6 +19,10 @@ function createWorkflowRegistry() {
         delete(name) {
             return entries.delete(name);
         },
+        /** 清空注册表（热重载前调用）。 */
+        clear() {
+            entries.clear();
+        },
     };
 }
 /**
@@ -46,4 +50,20 @@ async function createAndPopulateRegistry(projectDir) {
     }
     return registry;
 }
-export { createAndPopulateRegistry, createWorkflowRegistry };
+/**
+ * 重新填充已有注册表：清空 → 三级发现 → 注册。
+ * 用于 create/save 后热重载，保留同一 registry 引用。
+ */
+async function reloadRegistry(registry, projectDir) {
+    registry.clear();
+    for (const wf of await createBuiltinWorkflows()) {
+        registry.register(wf);
+    }
+    for (const wf of await discoverGlobalWorkflows()) {
+        registry.register(wf);
+    }
+    for (const wf of await discoverWorkflows(projectDir)) {
+        registry.register(wf);
+    }
+}
+export { createAndPopulateRegistry, createWorkflowRegistry, reloadRegistry };

package/dist/server/routes/workflows.js

@@ -3,6 +3,8 @@ import { Hono } from 'hono';
 import { streamSSE } from 'hono/streaming';
 import { createAgent } from '../../core/agent.js';
 import { executeWorkflow } from '../../core/workflows/runtime.js';
+import { reloadRegistry } from '../../core/workflows/registry.js';
+import { saveWorkflow } from '../../core/workflows/discovery.js';
 import { createSession } from '../../session/session.js';
 import { autoAllowChecker } from '../../tools/permission.js';
 import { apiError } from '../middleware/error.js';
@@ -24,6 +26,37 @@ function createWorkflowsRoute(ctx) {
         }));
         return c.json({ workflows });
     });
+    // POST / — 创建/保存工作流（写入 .c0de/workflows/<name>.js，验证后热重载注册表）
+    app.post('/', async (c) => {
+        const registry = ctx.workflowRegistry;
+        if (!registry) {
+            return apiError(c, 500, 'NOT_INITIALIZED', 'Workflow registry not initialized');
+        }
+        const body = await c.req.json().catch(() => ({}));
+        const { name, source, target } = body;
+        if (!name || typeof name !== 'string') {
+            return apiError(c, 400, 'BAD_REQUEST', 'Missing required field: name');
+        }
+        if (!source || typeof source !== 'string') {
+            return apiError(c, 400, 'BAD_REQUEST', 'Missing required field: source');
+        }
+        // 保存到磁盘 + dynamic import 验证
+        const result = await saveWorkflow(name, source, target ?? 'project', ctx.cwd);
+        if (!result.ok) {
+            return apiError(c, 400, 'SAVE_FAILED', result.error);
+        }
+        // 热重载注册表（清空 → 三级重新发现）
+        await reloadRegistry(registry, ctx.cwd);
+        const entry = registry.get(name);
+        return c.json({
+            ok: true,
+            name: result.meta.name,
+            description: result.meta.description,
+            filePath: result.filePath,
+            phases: entry?.meta.phases,
+            source: entry?.source ?? 'project',
+        });
+    });
     // GET /:name — 元数据 + 源码
     app.get('/:name', (c) => {
         const name = c.req.param('name');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "c0de-agent",
-  "version": "1.4.0",
+  "version": "1.5.0",
   "description": "Open-source AI coding assistant with Browser-Server architecture",
   "type": "module",
   "bin": {