Add Dynamic Workflow Console (workflow-console)

README.md

@@ -57,6 +57,7 @@ The MiniMax Code Agent communicates through the host MCP client. Business reques
 
 | MiniApp | What it does | Author |
 | --- | --- | --- |
+| [Dynamic Workflow Console](plugins/stevenjj33/workflow-console/) | Run and supervise MiniMax Code dynamic workflows from one page: live status, a stage-and-dependency flow graph, per-node output, approval and control, templates, and report export | [stevenjj33](https://github.com/stevenjj33) |
 | [MiniMax Photo](plugins/webguhui/minimax-photo/) | Layered image editing with an in-app AI assistant, local recovery and programmatic editing tools | [WebGuHui](https://github.com/WebGuHui) |
 | [MiniMax Video](plugins/webguhui/minimax-video/) | Local video editing with captions, a host Agent assistant, reviewable timeline edits, and MP4/MP3 export | [WebGuHui](https://github.com/WebGuHui) |
 | [AI Office](plugins/cristinamadureira353-svg/ai-office/) | Manage five model-powered employees in a pixel office: client tasks, chats, breaks, meetings and quota-aware offline states; uses your own API keys | [最爱双皮奶](https://github.com/cristinamadureira353-svg) |

README.zh-CN.md

@@ -57,6 +57,7 @@ MiniMax Code Agent 通过宿主 MCP 客户端与 MiniApp 协作。业务请求
 
 | MiniApp | 功能 | 作者 |
 | --- | --- | --- |
+| [动态工作流控制台](plugins/stevenjj33/workflow-console/README.zh-CN.md) | 在一个页面里运行并盯住 MiniMax Code 动态工作流：实时状态、按阶段与依赖画出的流程图、节点输出、审核与控制、模板与报告导出 | [stevenjj33](https://github.com/stevenjj33) |
 | [MiniMax Photo](plugins/webguhui/minimax-photo/) | 图层图片编辑、应用内 AI 助手、本地恢复与程序化编辑工具 | [WebGuHui](https://github.com/WebGuHui) |
 | [MiniMax Video](plugins/webguhui/minimax-video/) | 本地视频剪辑、字幕、宿主 Agent 助手、可预览的时间线修改与 MP4/MP3 导出 | [WebGuHui](https://github.com/WebGuHui) |
 | [AI 事务所](plugins/cristinamadureira353-svg/ai-office/README.zh-CN.md) | 五位真实模型员工的像素事务所：接单、聊天、休息和开会，额度耗尽时角色暂停；使用玩家自己的 API Key | [最爱双皮奶](https://github.com/cristinamadureira353-svg) |

plugins/stevenjj33/workflow-console/.gitattributes

@@ -0,0 +1,20 @@
+# The working tree of this plugin must be byte-identical to what is committed.
+#
+# Without this file, core.autocrlf=true rewrites LF blobs to CRLF on checkout, and git then
+# reports the result as clean because it normalises line endings when it compares. The rewrite is
+# invisible to `git status` while it is happening.
+#
+# That matters more here than in most plugins: `miniapp/node/vendor/dynamic-workflows/` is an
+# unmodified copy of the upstream 0.8.2 runtime, and its own LICENSE and THIRD_PARTY_NOTICES.txt
+# say the files are redistributed as-is. `text=auto` leaves git free to keep deciding for itself
+# which files are binary; `eol=lf` is the part that pins the result. Every blob here is already
+# LF, so adding this changes no committed content — it only stops the working tree from
+# disagreeing with it.
+#
+# This file lives in the plugin directory, not the repository root. At the root it would rewrite
+# line endings for every other plugin in the repository, and this is a single-plugin change.
+* text=auto eol=lf
+
+# The files in this plugin that are not text.
+*.png binary
+*.wasm binary

plugins/stevenjj33/workflow-console/.minimax-plugin/plugin.json

@@ -0,0 +1,17 @@
+{
+  "schemaVersion": 1,
+  "name": "workflow-console",
+  "displayName": "Dynamic Workflow Console / 动态工作流控制台",
+  "version": "1.1.0",
+  "description": "Run and supervise MiniMax Code dynamic workflows from one page: live status, a stage-and-dependency flow graph, per-node output, approval and control, templates, and report export. 自带的动态工作流监控与控制台：内置 Workflow Studio 引擎，无需安装插件即可运行。提供运行列表、实时日志、拓扑与节点结果、审核后开始执行、暂停取消恢复、模板保存与复用、报告导出。",
+  "author": "书先生 (stevenjj33)",
+  "icon": "icon.png",
+  "category": "Productivity",
+  "exampleQueries": [
+    "打开动态工作流控制台，看一下当前项目的运行进度。",
+    "控制台里那个待审核的工作流，核对拓扑后开始执行。"
+  ],
+  "apps": [],
+  "mcpServers": [],
+  "skills": []
+}

plugins/stevenjj33/workflow-console/LICENSE

@@ -0,0 +1,40 @@
+MIT License
+
+Copyright (c) 2026 stevenjj33
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+--------------------------------------------------------------------------------
+Third-party components
+--------------------------------------------------------------------------------
+
+`miniapp/node/vendor/dynamic-workflows/` contains an unmodified copy of the
+`mcode-dynamic-workflows` plugin runtime (version 0.8.2) by hetaoBackend,
+obtained from:
+
+    https://github.com/MiniMax-AI/MiniMax-Code-Plugins/tree/main/plugins/hetaoBackend/mcode-dynamic-workflows
+
+That component is licensed under the Apache License, Version 2.0. Its full
+license text is in `miniapp/node/vendor/dynamic-workflows/LICENSE`, and its
+attribution is in `miniapp/node/vendor/dynamic-workflows/THIRD_PARTY_NOTICES.txt`.
+The differences between the vendored copy and the upstream package are recorded
+in `miniapp/node/vendor/dynamic-workflows/VENDOR.md`.
+
+The vendored copy also bundles QuickJS (`dist/quickjs.wasm`); its attribution
+is in the same THIRD_PARTY_NOTICES.txt file.

plugins/stevenjj33/workflow-console/README.md

@@ -0,0 +1,196 @@
+# Dynamic Workflow Console (`workflow-console`)
+
+A Mini App that runs, supervises, and inspects MiniMax Code dynamic workflows from one page.
+
+It embeds the `mcode-dynamic-workflows` runtime, so it works on a machine where that plugin was
+never installed. Open the app and the console starts its own Workflow Studio engine, binds it to a
+project directory, and shows every run of that project: status, live event log, a stage-and-dependency
+flow graph, per-node output, and the final report. Runs can be approved, started, paused, cancelled,
+resumed, exported to Markdown or HTML, saved as a template, and restored from a template.
+
+The user interface is in Chinese.
+
+## Based on which project
+
+This package is built **on top of the `mcode-dynamic-workflows` plugin** by `hetaoBackend`, from
+<https://github.com/MiniMax-AI/MiniMax-Code-Plugins/tree/main/plugins/hetaoBackend/mcode-dynamic-workflows>
+(Apache-2.0).
+
+That plugin is an MCP server that orchestrates multi-agent workflows. It normally has to be installed
+as a MiniMax Code plugin and reached through MCP. This package takes its runtime and runs it as a
+**self-contained Mini App**:
+
+- The upstream runtime is vendored into `miniapp/node/vendor/dynamic-workflows/`, and the console
+  starts it as a child process.
+- The upstream `web/` canvas (`graph-model.mjs`) is imported directly, so the flow graph in this
+  console is the same graph model Workflow Studio draws, not a second implementation.
+- The console adds what the plugin does not provide: a per-project run list, a live event stream,
+  run approval and control, template management, report export, and a working-directory picker.
+
+### Vendored runtime: exact version and provenance
+
+| | |
+| --- | --- |
+| Upstream repository | `MiniMax-AI/MiniMax-Code-Plugins` |
+| Upstream path | `plugins/hetaoBackend/mcode-dynamic-workflows` |
+| Upstream commit | `6481e4ae1e0375a4ddb3d5e9b29845354ab1cead` (2026-09-21) |
+| Upstream plugin version | **0.8.0** (the only version upstream has ever published) |
+| License | Apache-2.0 — `LICENSE` and `THIRD_PARTY_NOTICES.txt` in the vendor directory |
+
+Every vendored file is a byte-for-byte copy of that commit. This is not a claim but a check:
+`tests/vendor-integrity.test.mjs` records each file's **git blob object ID** in the upstream
+repository and recomputes the git blob hash locally (`sha1("blob <size>\0" + content)`) to compare.
+Any edit, any version drift, and the test fails.
+
+The bundle is about 2.3 MB (`dist/main.mjs` ~1.0 MB, `dist/quickjs.wasm` ~0.5 MB, `web/` ~0.27 MB).
+It is pinned to one commit and does not follow upstream automatically; the update procedure — how to
+copy the files, how to refresh the recorded blob IDs, and what to re-check afterwards — is written
+down in `miniapp/node/vendor/dynamic-workflows/VENDOR.md`.
+
+## Install
+
+Copy this directory, including the hidden `.minimax-plugin/`, into the MiniMax Code plugins
+directory as `workflow-console/` (`~/.minimax/plugins/workflow-console/` by default; the root
+README's Install section explains where that directory is). Restart MiniMax Code and ask the Agent
+to "打开动态工作流控制台" (open the Dynamic Workflow Console).
+
+The app has no configuration step and no build step.
+
+### Choosing a project directory
+
+The console needs to know which project the engine should work in, and it will **not guess**:
+
+- If the Host declares the current project through an environment variable
+  (`MCODE_WORKSPACE`, `MCODE_PROJECT_DIR`, `PROJECT_DIR`, `WORKSPACE`), that directory is used.
+- Otherwise the console uses the directory you typed in the always-visible **Working directory** bar
+  at the top of the page, remembered under `context.dataDir`.
+- If neither is available, **the engine does not start at all** and the page asks for an absolute
+  project path. It never falls back to your home directory — a run started there could act on your
+  whole home folder — and it never uses the Host's temporary deployment directory.
+
+Saving the bar restarts the embedded engine against the new directory; run history is kept in the
+engine's own database and is not affected by the change.
+
+Running real workflows still requires a working `mcode` CLI: the engine orchestrates agents through
+it. The demo executor works without it.
+
+## Tested environment
+
+- MiniMax Code 3.1.4 on Windows 11, Node.js 22 and 26. Installed from this directory, opened
+  through the Agent, page rendered, engine started, run approved and executed with the demo
+  executor.
+- MiniMax Code on macOS (arm64), Node.js 26.8.1. Installed from this directory on a machine where
+  the upstream plugin had never been installed; working-directory resolution, the "no project
+  directory yet" state, and the same demo-executor run were verified there.
+- Browser: Chromium-based desktop browser, 1280x720 and 589x899 viewports, light and dark themes.
+
+Not verified: real model execution, and the pause/resume/cancel path on the real executor. Every
+execution in testing used the `demo` executor, which does not call a model. `mcodeAvailable: true`
+only means the `mcode` binary exists on the machine; its login state and quota are not checked by
+this app.
+
+## Data & access
+
+### Files
+
+Read:
+
+- `miniapp/client/` and `miniapp/node/vendor/` — this package's own assets.
+- The project directory it is bound to — the engine runs with it as its working directory, and the
+  `mcode` CLI it launches reads and writes inside it.
+
+This app reads **nothing** outside its own package and the project directory. In particular it does
+not read `~/.mcode-dynamic-workflows/`, which belongs to the separate `mcode-dynamic-workflows`
+plugin: that directory holds that plugin's service addresses and access tokens, and the console
+neither reads it nor connects to the services registered there. The console runs its own bundled
+engine and nothing else.
+
+Written — always under `context.dataDir`, never elsewhere:
+
+- `workspace.json` — the working directory the embedded engine is bound to.
+- `hidden-runs.json` — the list of runs hidden locally. Hiding is not deletion; the run record
+  stays in the engine's database and can be restored.
+- `engine/` — `address.json`, `endpoint.json`, `service.log`, and `workflows.sqlite`, written by the
+  embedded engine.
+
+### Network
+
+Loopback only. The embedded engine binds `http://127.0.0.1:<port>` and the console proxies the
+page to it. No outbound internet host is contacted, and no other local service is contacted.
+
+### Processes
+
+One child process, spawned with an argv array and no shell:
+
+```
+node <pluginRoot>/miniapp/node/vendor/dynamic-workflows/dist/main.mjs --workspace <directory> --data-dir <directory>
+```
+
+`<directory>` is the working directory shown in the page's top bar: either declared by the Host or
+typed by the user. User input is passed as a separate argv element, never concatenated into a
+command line. The process tree is terminated when the app is disposed.
+
+The engine itself may launch the local `mcode` CLI to run agents. See **Agent turns** below.
+
+### Agent turns
+
+None started by this package. The package declares no `agentAccess` and starts no Agent turn itself.
+
+The embedded engine may invoke the local `mcode` CLI when a run uses the real executor. That is the
+behaviour of the upstream plugin, and it is worth spelling out: the engine calls
+`mcode exec --permission smart`, so **during a run some file writes and commands are approved
+automatically, and any step that would need the user's confirmation fails that node instead of
+waiting for you**. The "开始执行" (start) confirmation dialog in the page says the same thing before
+you approve a run.
+
+### State
+
+Everything durable lives in `context.dataDir` (see **Files** above). The page keeps no domain data
+in browser storage.
+
+## Files
+
+```text
+.minimax-plugin/plugin.json                 Plugin manifest
+package.json                                Mini App declaration
+miniapp/miniapp.json                        Payload roots, Node entry, page route
+miniapp/client/index.html                   The page served at /dashboard
+miniapp/client/app.js                       Front end (plain HTML/CSS/JS, no framework, no build)
+miniapp/client/style.css                    Styling, light and dark themes
+miniapp/node/server.mjs                     Node entry: start(context) -> { dispose }
+miniapp/node/miniapp-api.ts                 Type declarations for the runtime context
+miniapp/node/vendor/dynamic-workflows/      Vendored upstream runtime (0.8.0, Apache-2.0)
+tests/workspace-resolution.test.mjs         Working-directory resolution
+tests/engine-isolation.test.mjs             The bundled engine is the only backend
+tests/vendor-integrity.test.mjs             Vendored files match the recorded upstream commit
+tests/end-to-end.test.mjs                   Full engine lifecycle, from empty workspace to a finished run
+tests/manual-mac-scenario.mjs               Boots an isolated instance that mimics a fresh macOS host
+icon.png                                    Plugin icon
+```
+
+## Tests
+
+The tests use Node's built-in test runner and start an isolated console instance in a sandbox home
+directory, so they never touch a real project:
+
+```bash
+node --test "tests/*.test.mjs"
+```
+
+`tests/workspace-resolution.test.mjs` covers working-directory resolution: the Host's temporary
+deployment directory and other implausible paths are rejected, the home directory is never used as
+a fallback, and the engine does not start until a project directory is known.
+`tests/engine-isolation.test.mjs` plants a fake registry of the other plugin's services — pointing
+at a local server that records every request — and asserts the console never contacts it.
+`tests/vendor-integrity.test.mjs` verifies that every vendored file still matches the upstream
+commit recorded above.
+`tests/end-to-end.test.mjs` starts the real bundled engine and walks the whole path: empty
+workspace → project directory chosen → engine live → a demo run created → the flow graph →
+approve → the run finishing → report export → hide and restore → switching to another project →
+invalid directories refused. It uses the `demo` executor, so it calls no model.
+`tests/manual-mac-scenario.mjs` starts a console whose working directory is a temporary deployment
+directory and prints the URL to open for manual inspection.
+
+## License
+
+[MIT](./LICENSE). The vendored upstream runtime keeps its own Apache-2.0 license.