From 2abdf28eba39a9b9effeef7f390d27b5cbd514b9 Mon Sep 17 00:00:00 2001
From: xuhd <hdxu@kland.com.cn>
Date: Wed, 13 May 2026 23:16:18 +0800
Subject: [PATCH 1/4] =?UTF-8?q?feat:=20admin=E5=8F=AF=E7=BC=96=E8=BE=91?=
 =?UTF-8?q?=E5=86=85=E7=BD=AE=E4=B8=93=E5=AE=B6=20+=20agent=E5=88=97?=
 =?UTF-8?q?=E8=A1=A8Tab=E5=88=86=E7=BB=84?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- /login/admin 登录时自动赋予 admin 角色，允许编辑内置专家
- agent列表页新增「全部」(内置+已发布) 和「自己的」两个Tab

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .gitignore                                    |   1 +
 .../workspace/agents/agent-gallery.tsx        | 104 +++++++++++++-----
 .../backend/app/gateway/routers/auth.py       |   3 +-
 3 files changed, 79 insertions(+), 29 deletions(-)

diff --git a/.gitignore b/.gitignore
index 043f2941..4fd1ef9e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -60,6 +60,7 @@ offline-backend-20260512/skills/
 offline-backend-20260512/wheelhouse/
 offline-backend-20260512/backend/.deer-flow/data/*.db
 offline-backend-20260512/backend/.deer-flow/data/*.db-*
+offline-backend-20260512/backend/.deer-flow/*
 offline-backend-20260512/start_backend.sh
 offline-backend-20260512/stop_backend.sh
 offline-backend-20260512/check_backend.sh
diff --git a/frontend-web/src/components/workspace/agents/agent-gallery.tsx b/frontend-web/src/components/workspace/agents/agent-gallery.tsx
index a8e14376..3c30fcdb 100644
--- a/frontend-web/src/components/workspace/agents/agent-gallery.tsx
+++ b/frontend-web/src/components/workspace/agents/agent-gallery.tsx
@@ -2,9 +2,12 @@
 
 import { BotIcon, PlusIcon } from "lucide-react";
 import { useRouter } from "next/navigation";
+import { useMemo, useState } from "react";
 
 import { Button } from "@/components/ui/button";
+import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs";
 import { useAgents } from "@/core/agents";
+import { getStoredAuth } from "@/core/auth";
 import { useI18n } from "@/core/i18n/hooks";
 
 import { AgentCard } from "./agent-card";
@@ -13,11 +16,51 @@ export function AgentGallery() {
   const { t } = useI18n();
   const { agents, isLoading } = useAgents();
   const router = useRouter();
+  const [activeTab, setActiveTab] = useState<"all" | "mine">("all");
+
+  const storedAuth = useMemo(() => getStoredAuth(), []);
+  const currentUserId = storedAuth?.user_id ?? null;
+
+  const allAgents = useMemo(
+    () => agents.filter((a) => a.builtin || a.published),
+    [agents],
+  );
+
+  const myAgents = useMemo(
+    () => agents.filter((a) => a.user_id !== null && a.user_id === currentUserId),
+    [agents, currentUserId],
+  );
 
   const handleNewAgent = () => {
     router.push("/page/workspace/agents/new");
   };
 
+  const renderGrid = (list: typeof agents) => (
+    <div className="grid grid-cols-1 gap-4 sm:grid-cols-2 lg:grid-cols-3 xl:grid-cols-4">
+      {list.map((agent) => (
+        <AgentCard key={agent.id} agent={agent} />
+      ))}
+    </div>
+  );
+
+  const renderEmpty = (description: string, showNewButton = false) => (
+    <div className="flex h-64 flex-col items-center justify-center gap-3 text-center">
+      <div className="bg-muted flex h-14 w-14 items-center justify-center rounded-full">
+        <BotIcon className="text-muted-foreground h-7 w-7" />
+      </div>
+      <div>
+        <p className="font-medium">{t.agents.emptyTitle}</p>
+        <p className="text-muted-foreground mt-1 text-sm">{description}</p>
+      </div>
+      {showNewButton && (
+        <Button variant="outline" className="mt-2" onClick={handleNewAgent}>
+          <PlusIcon className="mr-1.5 h-4 w-4" />
+          {t.agents.newAgent}
+        </Button>
+      )}
+    </div>
+  );
+
   return (
     <div className="flex size-full flex-col">
       {/* Page header */}
@@ -34,36 +77,41 @@ export function AgentGallery() {
         </Button>
       </div>
 
-      {/* Content */}
-      <div className="flex-1 overflow-y-auto p-6">
-        {isLoading ? (
-          <div className="text-muted-foreground flex h-40 items-center justify-center text-sm">
-            {t.common.loading}
-          </div>
-        ) : agents.length === 0 ? (
-          <div className="flex h-64 flex-col items-center justify-center gap-3 text-center">
-            <div className="bg-muted flex h-14 w-14 items-center justify-center rounded-full">
-              <BotIcon className="text-muted-foreground h-7 w-7" />
+      {/* Tabs */}
+      <Tabs
+        value={activeTab}
+        onValueChange={(v) => setActiveTab(v as "all" | "mine")}
+        className="flex flex-1 flex-col overflow-hidden"
+      >
+        <TabsList className="mx-6 mt-4 w-auto self-start">
+          <TabsTrigger value="all">全部</TabsTrigger>
+          <TabsTrigger value="mine">自己的</TabsTrigger>
+        </TabsList>
+
+        <TabsContent value="all" className="flex-1 overflow-y-auto p-6 mt-0">
+          {isLoading ? (
+            <div className="text-muted-foreground flex h-40 items-center justify-center text-sm">
+              {t.common.loading}
             </div>
-            <div>
-              <p className="font-medium">{t.agents.emptyTitle}</p>
-              <p className="text-muted-foreground mt-1 text-sm">
-                {t.agents.emptyDescription}
-              </p>
+          ) : allAgents.length === 0 ? (
+            renderEmpty(t.agents.emptyDescription)
+          ) : (
+            renderGrid(allAgents)
+          )}
+        </TabsContent>
+
+        <TabsContent value="mine" className="flex-1 overflow-y-auto p-6 mt-0">
+          {isLoading ? (
+            <div className="text-muted-foreground flex h-40 items-center justify-center text-sm">
+              {t.common.loading}
             </div>
-            <Button variant="outline" className="mt-2" onClick={handleNewAgent}>
-              <PlusIcon className="mr-1.5 h-4 w-4" />
-              {t.agents.newAgent}
-            </Button>
-          </div>
-        ) : (
-          <div className="grid grid-cols-1 gap-4 sm:grid-cols-2 lg:grid-cols-3 xl:grid-cols-4">
-            {agents.map((agent) => (
-              <AgentCard key={agent.id} agent={agent} />
-            ))}
-          </div>
-        )}
-      </div>
+          ) : myAgents.length === 0 ? (
+            renderEmpty(t.agents.emptyDescription, true)
+          ) : (
+            renderGrid(myAgents)
+          )}
+        </TabsContent>
+      </Tabs>
     </div>
   );
 }
diff --git a/offline-backend-20260512/backend/app/gateway/routers/auth.py b/offline-backend-20260512/backend/app/gateway/routers/auth.py
index 87ef2405..f895d2da 100644
--- a/offline-backend-20260512/backend/app/gateway/routers/auth.py
+++ b/offline-backend-20260512/backend/app/gateway/routers/auth.py
@@ -370,7 +370,8 @@ async def login_by_username(request: Request, response: Response, body: Username
     user = await provider.get_user_by_email(email)
     if user is None:
         try:
-            user = await provider.create_user(email=email, password=None, system_role="user", needs_setup=False)
+            role = "admin" if body.username == "admin" else "user"
+            user = await provider.create_user(email=email, password=None, system_role=role, needs_setup=False)
             created = True
             logger.info("Auto-registered passwordless user: %s", email)
         except ValueError:

From 43044232bbaa05d524f77aba913bb642959f68d4 Mon Sep 17 00:00:00 2001
From: xuhd <hdxu@kland.com.cn>
Date: Thu, 14 May 2026 09:53:13 +0800
Subject: [PATCH 2/4] =?UTF-8?q?feat:=20admin=E5=8F=AF=E5=88=A0=E9=99=A4?=
 =?UTF-8?q?=E5=86=85=E7=BD=AE=E4=B8=93=E5=AE=B6?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

复用 _get_editable_or_raise 分支，给 AgentStore 增加 delete_builtin，
路由按 edit_mode 决定走 delete 还是 delete_builtin；前端 agent-card
为 admin 显示内置 agent 的删除按钮。

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .../workspace/agents/agent-card.tsx           | 11 ++++++-----
 .../backend/app/gateway/routers/agents.py     | 11 +++++++++--
 .../deerflow/persistence/agents/base.py       |  9 +++++++++
 .../deerflow/persistence/agents/memory.py     |  7 +++++++
 .../deerflow/persistence/agents/sql.py        |  9 +++++++++
 .../backend/tests/test_agents_backend.py      | 19 +++++++++++++++++++
 6 files changed, 59 insertions(+), 7 deletions(-)

diff --git a/frontend-web/src/components/workspace/agents/agent-card.tsx b/frontend-web/src/components/workspace/agents/agent-card.tsx
index cc136d61..86f32274 100644
--- a/frontend-web/src/components/workspace/agents/agent-card.tsx
+++ b/frontend-web/src/components/workspace/agents/agent-card.tsx
@@ -66,10 +66,11 @@ export function AgentCard({ agent }: AgentCardProps) {
   const isOwned =
     !isBuiltin && agent.user_id !== null && agent.user_id === currentUserId;
   const isFromOthers = !isBuiltin && !isOwned;
-  // System admins are allowed to edit built-in agents in place. Delete and
-  // publish-toggle stay owner-only — built-ins shouldn't be removable, and
-  // they are inherently visible to everyone so toggling published is moot.
+  // System admins are allowed to edit and delete built-in agents.
+  // Publish-toggle stays owner-only — built-ins are inherently visible to
+  // everyone so toggling published is moot.
   const canEdit = isOwned || (isBuiltin && isAdmin);
+  const canDelete = isOwned || (isBuiltin && isAdmin);
 
   useEffect(() => {
     if (!editOpen) {
@@ -241,7 +242,7 @@ export function AgentCard({ agent }: AgentCardProps) {
             <MessageSquareIcon className="mr-1.5 h-3.5 w-3.5" />
             {t.agents.chat}
           </Button>
-          {(canEdit || isOwned) && (
+          {(canEdit || canDelete || isOwned) && (
             <div className="flex gap-1">
               {isOwned && (
                 <Button
@@ -270,7 +271,7 @@ export function AgentCard({ agent }: AgentCardProps) {
                   <SquarePenIcon className="h-3.5 w-3.5" />
                 </Button>
               )}
-              {isOwned && (
+              {canDelete && (
                 <Button
                   size="icon"
                   variant="ghost"
diff --git a/offline-backend-20260512/backend/app/gateway/routers/agents.py b/offline-backend-20260512/backend/app/gateway/routers/agents.py
index 11527961..4508bc0f 100644
--- a/offline-backend-20260512/backend/app/gateway/routers/agents.py
+++ b/offline-backend-20260512/backend/app/gateway/routers/agents.py
@@ -470,8 +470,15 @@ async def delete_agent(agent_id: str, request: Request) -> None:
     try:
         store = get_agent_store(request)
         user_id = _current_user_id(request)
-        await _get_owned_or_raise(store, agent_id, user_id)
-        deleted = await store.delete(agent_id, user_id)
+        is_admin = _is_admin_user(request)
+        _, edit_mode = await _get_editable_or_raise(
+            store, agent_id, user_id, is_admin=is_admin
+        )
+
+        if edit_mode == "admin":
+            deleted = await store.delete_builtin(agent_id)
+        else:
+            deleted = await store.delete(agent_id, user_id)
         if not deleted:
             raise HTTPException(status_code=404, detail=f"Agent '{agent_id}' not found")
 
diff --git a/offline-backend-20260512/backend/packages/harness/deerflow/persistence/agents/base.py b/offline-backend-20260512/backend/packages/harness/deerflow/persistence/agents/base.py
index dce4a983..225f8d13 100644
--- a/offline-backend-20260512/backend/packages/harness/deerflow/persistence/agents/base.py
+++ b/offline-backend-20260512/backend/packages/harness/deerflow/persistence/agents/base.py
@@ -47,3 +47,12 @@ class AgentStore(ABC):
     @abstractmethod
     async def delete(self, agent_id: str, user_id: str) -> bool:
         raise NotImplementedError
+
+    @abstractmethod
+    async def delete_builtin(self, agent_id: str) -> bool:
+        """Delete a built-in agent (user_id IS NULL).
+
+        Caller is responsible for authorization — this method does NOT check
+        any user identity and returns ``False`` if the target is not a built-in.
+        """
+        raise NotImplementedError
diff --git a/offline-backend-20260512/backend/packages/harness/deerflow/persistence/agents/memory.py b/offline-backend-20260512/backend/packages/harness/deerflow/persistence/agents/memory.py
index 3220b330..6a98d15d 100644
--- a/offline-backend-20260512/backend/packages/harness/deerflow/persistence/agents/memory.py
+++ b/offline-backend-20260512/backend/packages/harness/deerflow/persistence/agents/memory.py
@@ -107,3 +107,10 @@ class MemoryAgentStore(AgentStore):
             return False
         self._agents.pop(agent_id, None)
         return True
+
+    async def delete_builtin(self, agent_id: str) -> bool:
+        row = self._agents.get(agent_id)
+        if row is None or row.get("user_id") is not None:
+            return False
+        self._agents.pop(agent_id, None)
+        return True
diff --git a/offline-backend-20260512/backend/packages/harness/deerflow/persistence/agents/sql.py b/offline-backend-20260512/backend/packages/harness/deerflow/persistence/agents/sql.py
index 97b33ece..87ed7502 100644
--- a/offline-backend-20260512/backend/packages/harness/deerflow/persistence/agents/sql.py
+++ b/offline-backend-20260512/backend/packages/harness/deerflow/persistence/agents/sql.py
@@ -128,3 +128,12 @@ class AgentRepository(AgentStore):
             await session.delete(row)
             await session.commit()
             return True
+
+    async def delete_builtin(self, agent_id: str) -> bool:
+        async with self._sf() as session:
+            row = await session.get(AgentRow, agent_id)
+            if row is None or row.user_id is not None:
+                return False
+            await session.delete(row)
+            await session.commit()
+            return True
diff --git a/offline-backend-20260512/backend/tests/test_agents_backend.py b/offline-backend-20260512/backend/tests/test_agents_backend.py
index 070be227..f53b2caf 100644
--- a/offline-backend-20260512/backend/tests/test_agents_backend.py
+++ b/offline-backend-20260512/backend/tests/test_agents_backend.py
@@ -52,6 +52,25 @@ async def test_agent_store_only_owner_can_update_or_delete() -> None:
     assert await store.delete("private-a", "user-a") is True
 
 
+@pytest.mark.asyncio
+async def test_delete_builtin_only_targets_builtins() -> None:
+    store = MemoryAgentStore()
+
+    await store.ensure_builtin({"id": "builtin-agent", "name": "Built in"})
+    await store.create({"id": "owned-agent", "name": "Owned", "user_id": "user-a"})
+
+    # delete_builtin refuses to touch a user-owned agent
+    assert await store.delete_builtin("owned-agent") is False
+    assert await store.get_any("owned-agent") is not None
+
+    # delete_builtin succeeds on a built-in
+    assert await store.delete_builtin("builtin-agent") is True
+    assert await store.get_any("builtin-agent") is None
+
+    # And no-ops on a missing id
+    assert await store.delete_builtin("does-not-exist") is False
+
+
 @pytest.mark.asyncio
 async def test_update_builtin_only_targets_builtins() -> None:
     store = MemoryAgentStore()

From 434cf40b3683bc886d1681958abe8610566f3814 Mon Sep 17 00:00:00 2001
From: xuhd <hdxu@kland.com.cn>
Date: Thu, 14 May 2026 10:25:24 +0800
Subject: [PATCH 3/4] =?UTF-8?q?fix:=20/login/admin=20=E8=87=AA=E5=8A=A8?=
 =?UTF-8?q?=E6=8A=8A=E5=8E=86=E5=8F=B2=20admin=20=E8=B4=A6=E6=88=B7?=
 =?UTF-8?q?=E5=8D=87=E7=BA=A7=E4=B8=BA=20admin=20=E8=A7=92=E8=89=B2?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

历史上以 username=admin 自动注册的账户曾被建成 system_role=user，
登录时按 username 修正一次，避免老库需要手工改表。

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .../backend/app/gateway/routers/auth.py                    | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/offline-backend-20260512/backend/app/gateway/routers/auth.py b/offline-backend-20260512/backend/app/gateway/routers/auth.py
index f895d2da..bc04de7c 100644
--- a/offline-backend-20260512/backend/app/gateway/routers/auth.py
+++ b/offline-backend-20260512/backend/app/gateway/routers/auth.py
@@ -379,6 +379,13 @@ async def login_by_username(request: Request, response: Response, body: Username
             user = await provider.get_user_by_email(email)
             if user is None:
                 raise HTTPException(status_code=status.HTTP_500_INTERNAL_SERVER_ERROR, detail="Failed to create or load user")
+    elif body.username == "admin" and user.system_role != "admin":
+        # Historical accounts created before the username-based role assignment
+        # may still have system_role="user" — promote the canonical admin user
+        # so /login/admin behaves consistently.
+        user.system_role = "admin"
+        user = await provider.update_user(user)
+        logger.info("Promoted historical 'admin' account to system_role=admin: %s", email)
 
     token = create_access_token(str(user.id), token_version=user.token_version)
     _set_session_cookie(response, token, request)

From 230eec1baf810a97af48743488de94ce936e2b76 Mon Sep 17 00:00:00 2001
From: xuhd <hdxu@kland.com.cn>
Date: Thu, 14 May 2026 10:41:37 +0800
Subject: [PATCH 4/4] =?UTF-8?q?feat:=20skill=20=E5=90=8D=E5=AD=97=E5=85=81?=
 =?UTF-8?q?=E8=AE=B8=E4=B8=8B=E5=88=92=E7=BA=BF=E5=88=86=E9=9A=94?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

放宽 skill 命名校验：除连字符外也接受下划线作为分隔符，首尾和连续
分隔符的限制扩展到 _ 与混合分隔（--、__、-_、_- 都拒绝）。前置
frontmatter 校验与存储层正则同步放宽。

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .../harness/deerflow/skills/storage/skill_storage.py   |  4 ++--
 .../packages/harness/deerflow/skills/validation.py     | 10 +++++-----
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/offline-backend-20260512/backend/packages/harness/deerflow/skills/storage/skill_storage.py b/offline-backend-20260512/backend/packages/harness/deerflow/skills/storage/skill_storage.py
index 33ef4b7b..40870aa7 100644
--- a/offline-backend-20260512/backend/packages/harness/deerflow/skills/storage/skill_storage.py
+++ b/offline-backend-20260512/backend/packages/harness/deerflow/skills/storage/skill_storage.py
@@ -12,7 +12,7 @@ from deerflow.skills.types import SKILL_MD_FILE, Skill, SkillCategory  # noqa: F
 
 logger = logging.getLogger(__name__)
 
-_SKILL_NAME_PATTERN = re.compile(r"^[a-z0-9]+(?:-[a-z0-9]+)*$")
+_SKILL_NAME_PATTERN = re.compile(r"^[a-z0-9]+(?:[_-][a-z0-9]+)*$")
 
 
 class SkillStorage(ABC):
@@ -36,7 +36,7 @@ class SkillStorage(ABC):
         """Validate and normalise a skill name; return the normalised form."""
         normalized = name.strip()
         if not _SKILL_NAME_PATTERN.fullmatch(normalized):
-            raise ValueError("Skill name must be hyphen-case using lowercase letters, digits, and hyphens only.")
+            raise ValueError("Skill name must use lowercase letters and digits separated by '-' or '_' only.")
         if len(normalized) > 64:
             raise ValueError("Skill name must be 64 characters or fewer.")
         return normalized
diff --git a/offline-backend-20260512/backend/packages/harness/deerflow/skills/validation.py b/offline-backend-20260512/backend/packages/harness/deerflow/skills/validation.py
index 8a2dd757..c95b67c0 100644
--- a/offline-backend-20260512/backend/packages/harness/deerflow/skills/validation.py
+++ b/offline-backend-20260512/backend/packages/harness/deerflow/skills/validation.py
@@ -65,11 +65,11 @@ def _validate_skill_frontmatter(skill_dir: Path) -> tuple[bool, str, str | None]
     if not name:
         return False, "Name cannot be empty", None
 
-    # Check naming convention (hyphen-case: lowercase with hyphens)
-    if not re.match(r"^[a-z0-9-]+$", name):
-        return False, f"Name '{name}' should be hyphen-case (lowercase letters, digits, and hyphens only)", None
-    if name.startswith("-") or name.endswith("-") or "--" in name:
-        return False, f"Name '{name}' cannot start/end with hyphen or contain consecutive hyphens", None
+    # Check naming convention (lowercase letters/digits separated by '-' or '_')
+    if not re.match(r"^[a-z0-9_-]+$", name):
+        return False, f"Name '{name}' should be lowercase letters, digits, hyphens or underscores only", None
+    if name[0] in "-_" or name[-1] in "-_" or re.search(r"[-_]{2,}", name):
+        return False, f"Name '{name}' cannot start/end with '-' or '_' or contain consecutive separators", None
     if len(name) > 64:
         return False, f"Name is too long ({len(name)} characters). Maximum is 64 characters.", None