fix(workflow): harden publishing and editor testing

Require high-risk actions to reference human confirmation outputs, filter deleted workflows from dashboard lists, and keep template metadata synchronized. Add safe browser-side debug execution for business nodes without triggering real side effects.

internal/ai/workflow/validator/validator.go

@@ -169,7 +169,9 @@ func (v *definitionValidator) validateConfirmationGuards() {
 func (v *definitionValidator) validateConfirmedInput(nodeID string, node dsl.Node) {
 	value, ok := node.Data.InputsValues["confirmed"]
 	sourceNodeID, sourceField, refOK := value.Ref()
+	field := "nodes." + nodeID + ".data.inputsValues.confirmed"
 	if !ok || !refOK || strings.TrimSpace(sourceNodeID) == "" || strings.TrimSpace(sourceField) == "" {
+		v.addError(field, "confirmed input must come from human_confirm.confirmed")
 		return
 	}
 	sourceNode, ok := v.nodesByID[sourceNodeID]
@@ -177,7 +179,7 @@ func (v *definitionValidator) validateConfirmedInput(nodeID string, node dsl.Nod
 		return
 	}
 	if sourceNode.Type != registry.NodeTypeHumanConfirm || strings.TrimSpace(sourceField) != "confirmed" {
-		v.addError("nodes."+nodeID+".data.inputsValues.confirmed", "confirmed input must come from human_confirm.confirmed")
+		v.addError(field, "confirmed input must come from human_confirm.confirmed")
 	}
 }
 

internal/ai/workflow/validator/validator_test.go

@@ -106,6 +106,31 @@ func TestValidateDefinitionRejectsMissingRequiredInputValue(t *testing.T) {
 	}
 }
 
+func TestValidateDefinitionRejectsConstantConfirmationForHighRiskNode(t *testing.T) {
+	def := dsl.Definition{
+		Nodes: []dsl.Node{
+			node("start_1", "start", nil, nil),
+			node("confirm_1", "human_confirm", inputs("prompt", dsl.ConstantValue("请确认")), nil),
+			node("create_1", "create_ticket", map[string]dsl.Value{
+				"ticketDraft": dsl.ConstantValue(map[string]any{"title": "测试", "description": "测试描述"}),
+				"confirmed":   dsl.ConstantValue(false),
+			}, nil),
+			node("end_1", "end", nil, nil),
+		},
+		Edges: []dsl.Edge{
+			edge("start_1", "confirm_1"),
+			edge("confirm_1", "create_1"),
+			edge("create_1", "end_1"),
+		},
+	}
+
+	result := validator.ValidateDefinition(def, registry.DefaultRegistry())
+
+	if result.Valid || !hasValidationMessage(result, "confirmed input must come from human_confirm.confirmed") {
+		t.Fatalf("expected confirmation-source error, got %#v", result.Errors)
+	}
+}
+
 func TestValidateDefinitionRejectsUnknownInputSourceNode(t *testing.T) {
 	def := minimalDefinition()
 	def.Nodes[1].Data.InputsValues["replyText"] = dsl.RefValue("missing_1", "replyText")