feat: 支持智能体可见范围管理

- 未分类智能体按可见范围绕过分类白名单

- 提供个人、部门、公开范围配置及列表状态标签

easyflow-modules/easyflow-module-agent/src/main/java/tech/easyflow/agent/security/AgentVisibilityQueryHelper.java

@@ -59,21 +59,36 @@ public class AgentVisibilityQueryHelper {
             return;
         }
         QueryCondition owner = AGENT.CREATED_BY.eq(accountId);
-        if (access.isRestricted() && access.getCategoryIds().isEmpty()) {
-            queryWrapper.and(owner);
-            return;
-        }
         Set<BigInteger> readableDeptIds = account.getDeptId() == null
                 ? Collections.emptySet()
                 : sysDeptService.getSelfAndAncestorDeptIds(account.getDeptId());
-        QueryCondition visible = AGENT.VISIBILITY_SCOPE.eq(VisibilityScope.PUBLIC.name());
-        if (!readableDeptIds.isEmpty()) {
-            visible = visible.or(AGENT.VISIBILITY_SCOPE.eq(VisibilityScope.DEPT.name())
-                    .and(AGENT.DEPT_ID.in(readableDeptIds)));
-        }
+        QueryCondition visible = buildScopeVisibleCondition(readableDeptIds);
         if (access.isRestricted()) {
-            visible = AGENT.CATEGORY_ID.in(access.getCategoryIds()).and(visible);
+            // Agent 未设置分类时表示不受分类白名单限制，仍需满足其可见范围。
+            QueryCondition readableCategories = AGENT.CATEGORY_ID.isNull()
+                    .and(buildScopeVisibleCondition(readableDeptIds));
+            if (!access.getCategoryIds().isEmpty()) {
+                readableCategories = readableCategories.or(
+                        AGENT.CATEGORY_ID.in(access.getCategoryIds())
+                                .and(buildScopeVisibleCondition(readableDeptIds)));
+            }
+            visible = readableCategories;
         }
         queryWrapper.and(owner.or(visible));
     }
+
+    /**
+     * 构建可见范围条件。
+     *
+     * @param readableDeptIds 当前账号可读取的部门 ID 集合
+     * @return 可见范围条件
+     */
+    private QueryCondition buildScopeVisibleCondition(Set<BigInteger> readableDeptIds) {
+        QueryCondition scopeVisible = AGENT.VISIBILITY_SCOPE.eq(VisibilityScope.PUBLIC.name());
+        if (!readableDeptIds.isEmpty()) {
+            scopeVisible = scopeVisible.or(AGENT.VISIBILITY_SCOPE.eq(VisibilityScope.DEPT.name())
+                    .and(AGENT.DEPT_ID.in(readableDeptIds)));
+        }
+        return scopeVisible;
+    }
 }

easyflow-modules/easyflow-module-agent/src/main/java/tech/easyflow/agent/service/AgentService.java

@@ -35,6 +35,15 @@ public interface AgentService extends IService<Agent> {
      */
     Agent updateDraft(Agent agent);
 
+    /**
+     * 更新 Agent 的可见范围。
+     *
+     * @param agentId Agent ID
+     * @param visibilityScope 可见范围编码
+     * @return 更新后的 Agent
+     */
+    Agent updateVisibilityScope(BigInteger agentId, String visibilityScope);
+
     /**
      * 获取已发布运行视图。
      *

easyflow-modules/easyflow-module-agent/src/main/java/tech/easyflow/agent/service/impl/AgentServiceImpl.java

@@ -114,6 +114,29 @@ public class AgentServiceImpl extends ServiceImpl<AgentMapper, Agent> implements
         });
     }
 
+    /**
+     * {@inheritDoc}
+     */
+    @Override
+    @Transactional(rollbackFor = Exception.class)
+    public Agent updateVisibilityScope(BigInteger agentId, String visibilityScope) {
+        if (agentId == null) {
+            throw new BusinessException("Agent ID 不能为空");
+        }
+        VisibilityScope scope = parseVisibilityScope(visibilityScope);
+        return agentBindingLockExecutor.execute(agentId, () -> {
+            Agent existing = requireAgentForUpdate(agentId);
+            resourceAccessService.assertAccess(
+                    CategoryResourceType.AGENT, existing, ResourceAction.MANAGE, "无权限管理该 Agent");
+            LoginAccount account = requireCurrentLoginAccount();
+            existing.setVisibilityScope(scope.name());
+            existing.setModified(new Date());
+            existing.setModifiedBy(account.getId());
+            updateById(existing);
+            return getDetail(existing.getId());
+        });
+    }
+
     /**
      * {@inheritDoc}
      */
@@ -244,6 +267,20 @@ public class AgentServiceImpl extends ServiceImpl<AgentMapper, Agent> implements
         agent.setExecutionConfigJson(normalizeExecutionConfig(agent.getExecutionConfigJson()));
     }
 
+    /**
+     * 解析并校验 Agent 可见范围。
+     *
+     * @param visibilityScope 可见范围编码
+     * @return 标准化后的可见范围
+     */
+    private VisibilityScope parseVisibilityScope(String visibilityScope) {
+        try {
+            return VisibilityScope.from(visibilityScope);
+        } catch (IllegalArgumentException error) {
+            throw new BusinessException(error.getMessage());
+        }
+    }
+
     /**
      * 规范并校验 Agent 运行配置中的文档上下文预算。
      *