@josephyan/qingflow-app-builder-mcp 1.0.9 → 1.1.2

package/src/qingflow_mcp/public_surface.py

@@ -38,7 +38,6 @@ USER_PUBLIC_TOOL_SPECS: tuple[PublicToolSpec, ...] = (
     PublicToolSpec(USER_DOMAIN, "workspace_get", ("workspace_get",), ("workspace", "get")),
     PublicToolSpec(USER_DOMAIN, "workspace_select", ("workspace_select",), ("workspace", "select")),
     PublicToolSpec(USER_DOMAIN, "app_list", ("app_list",), ("app", "list"), cli_show_effective_context=True),
-    PublicToolSpec(USER_DOMAIN, "app_search", ("app_search",), ("app", "search"), cli_show_effective_context=True),
     PublicToolSpec(USER_DOMAIN, "app_get", ("app_get",), ("app", "get"), cli_show_effective_context=True),
     PublicToolSpec(USER_DOMAIN, "portal_list", ("portal_list",), ("portal", "list"), cli_show_effective_context=True),
     PublicToolSpec(USER_DOMAIN, "portal_get", ("portal_get",), ("portal", "get"), cli_show_effective_context=True),
@@ -78,12 +77,13 @@ USER_PUBLIC_TOOL_SPECS: tuple[PublicToolSpec, ...] = (
         ("record_code_block_schema_get_public",),
         ("record", "schema", "code-block"),
     ),
-    PublicToolSpec(USER_DOMAIN, "record_member_candidates", ("record_member_candidates",), cli_public=False),
-    PublicToolSpec(USER_DOMAIN, "record_department_candidates", ("record_department_candidates",), cli_public=False),
-    PublicToolSpec(USER_DOMAIN, "record_analyze", ("record_analyze",), ("record", "analyze")),
+    PublicToolSpec(USER_DOMAIN, "record_member_candidates", ("record_member_candidates",), ("record", "member-candidates")),
+    PublicToolSpec(USER_DOMAIN, "record_department_candidates", ("record_department_candidates",), ("record", "department-candidates")),
+    PublicToolSpec(USER_DOMAIN, "record_analyze", ("record_analyze",), ("record", "analyze"), mcp_public=False),
     PublicToolSpec(USER_DOMAIN, "record_list", ("record_list",), ("record", "list"), cli_show_effective_context=True),
     PublicToolSpec(USER_DOMAIN, "record_access", ("record_access",), ("record", "access"), cli_show_effective_context=True),
     PublicToolSpec(USER_DOMAIN, "record_get", ("record_get_public",), ("record", "get"), cli_show_effective_context=True),
+    PublicToolSpec(USER_DOMAIN, "record_logs_get", ("record_logs_get",), ("record", "logs"), cli_show_effective_context=True),
     PublicToolSpec(USER_DOMAIN, "record_insert", ("record_insert_public",), ("record", "insert"), cli_show_effective_context=True, cli_context_write=True),
     PublicToolSpec(USER_DOMAIN, "record_update", ("record_update_public",), ("record", "update"), cli_show_effective_context=True, cli_context_write=True),
     PublicToolSpec(USER_DOMAIN, "record_delete", ("record_delete_public",), ("record", "delete"), cli_show_effective_context=True, cli_context_write=True),
@@ -127,6 +127,8 @@ BUILDER_PUBLIC_TOOL_SPECS: tuple[PublicToolSpec, ...] = (
     PublicToolSpec(BUILDER_DOMAIN, "file_upload_local", ("file_upload_local",), ("builder", "file", "upload-local"), has_contract=True, cli_show_effective_context=True, cli_context_write=True),
     PublicToolSpec(BUILDER_DOMAIN, "feedback_submit", ("feedback_submit",), ("builder", "feedback", "submit"), has_contract=True),
     PublicToolSpec(BUILDER_DOMAIN, "builder_tool_contract", ("builder_tool_contract",), ("builder", "contract"), has_contract=False),
+    PublicToolSpec(BUILDER_DOMAIN, "workspace_icon_catalog_get", ("workspace_icon_catalog_get",), ("builder", "icon", "catalog"), has_contract=True, cli_show_effective_context=True),
+    PublicToolSpec(BUILDER_DOMAIN, "package_list", ("package_list",), ("builder", "package", "list"), has_contract=True, cli_show_effective_context=True),
     PublicToolSpec(BUILDER_DOMAIN, "package_get", ("package_get",), ("builder", "package", "get"), has_contract=True, cli_show_effective_context=True),
     PublicToolSpec(BUILDER_DOMAIN, "package_apply", ("package_apply",), ("builder", "package", "apply"), has_contract=True, cli_show_effective_context=True, cli_context_write=True),
     PublicToolSpec(BUILDER_DOMAIN, "solution_install", ("solution_install",), ("builder", "solution", "install"), has_contract=True, cli_show_effective_context=True, cli_context_write=True),
@@ -136,11 +138,10 @@ BUILDER_PUBLIC_TOOL_SPECS: tuple[PublicToolSpec, ...] = (
     PublicToolSpec(BUILDER_DOMAIN, "app_release_edit_lock_if_mine", ("app_release_edit_lock_if_mine",), ("builder", "app", "release-edit-lock-if-mine"), has_contract=True, cli_show_effective_context=True, cli_context_write=True),
     PublicToolSpec(BUILDER_DOMAIN, "app_resolve", ("app_resolve",), ("builder", "app", "resolve"), has_contract=True, cli_show_effective_context=True),
     PublicToolSpec(BUILDER_DOMAIN, "button_style_catalog_get", ("button_style_catalog_get",), ("builder", "button", "catalog"), has_contract=True, cli_show_effective_context=True),
-    PublicToolSpec(BUILDER_DOMAIN, "app_custom_button_list", ("app_custom_button_list",), ("builder", "button", "list"), has_contract=True, cli_show_effective_context=True),
-    PublicToolSpec(BUILDER_DOMAIN, "app_custom_button_get", ("app_custom_button_get",), ("builder", "button", "get"), has_contract=True, cli_show_effective_context=True),
-    PublicToolSpec(BUILDER_DOMAIN, "app_custom_button_create", ("app_custom_button_create",), ("builder", "button", "create"), has_contract=True, cli_show_effective_context=True, cli_context_write=True),
-    PublicToolSpec(BUILDER_DOMAIN, "app_custom_button_update", ("app_custom_button_update",), ("builder", "button", "update"), has_contract=True, cli_show_effective_context=True, cli_context_write=True),
-    PublicToolSpec(BUILDER_DOMAIN, "app_custom_button_delete", ("app_custom_button_delete",), ("builder", "button", "delete"), has_contract=True, cli_show_effective_context=True, cli_context_write=True),
+    PublicToolSpec(BUILDER_DOMAIN, "app_get_buttons", ("app_get_buttons",), ("builder", "button", "get"), has_contract=True, cli_show_effective_context=True),
+    PublicToolSpec(BUILDER_DOMAIN, "app_custom_buttons_apply", ("app_custom_buttons_apply",), ("builder", "button", "apply"), has_contract=True, cli_show_effective_context=True, cli_context_write=True),
+    PublicToolSpec(BUILDER_DOMAIN, "app_get_associated_resources", ("app_get_associated_resources",), ("builder", "associated-resource", "get"), has_contract=True, cli_show_effective_context=True),
+    PublicToolSpec(BUILDER_DOMAIN, "app_associated_resources_apply", ("app_associated_resources_apply",), ("builder", "associated-resource", "apply"), has_contract=True, cli_show_effective_context=True, cli_context_write=True),
     PublicToolSpec(BUILDER_DOMAIN, "app_get", ("app_get",), ("builder", "app", "get", "summary"), has_contract=True, cli_show_effective_context=True),
     PublicToolSpec(BUILDER_DOMAIN, "app_get_fields", ("app_get_fields",), ("builder", "app", "get", "fields"), has_contract=True, cli_show_effective_context=True),
     PublicToolSpec(BUILDER_DOMAIN, "app_repair_code_blocks", ("app_repair_code_blocks",), ("builder", "app", "repair-code-blocks"), has_contract=True, cli_show_effective_context=True),
@@ -154,6 +155,8 @@ BUILDER_PUBLIC_TOOL_SPECS: tuple[PublicToolSpec, ...] = (
     PublicToolSpec(BUILDER_DOMAIN, "chart_get", ("chart_get",), ("builder", "chart", "get"), has_contract=True, cli_show_effective_context=True),
     PublicToolSpec(BUILDER_DOMAIN, "app_schema_apply", ("app_schema_apply",), ("builder", "schema", "apply"), has_contract=True, cli_show_effective_context=True, cli_context_write=True),
     PublicToolSpec(BUILDER_DOMAIN, "app_layout_apply", ("app_layout_apply",), ("builder", "layout", "apply"), has_contract=True, cli_show_effective_context=True, cli_context_write=True),
+    PublicToolSpec(BUILDER_DOMAIN, "app_flow_get_schema", ("app_flow_get_schema",), ("builder", "flow", "schema"), has_contract=True, cli_show_effective_context=True),
+    PublicToolSpec(BUILDER_DOMAIN, "app_flow_get", ("app_flow_get",), ("builder", "flow", "get"), has_contract=True, cli_show_effective_context=True),
     PublicToolSpec(BUILDER_DOMAIN, "app_flow_apply", ("app_flow_apply",), ("builder", "flow", "apply"), has_contract=True, cli_show_effective_context=True, cli_context_write=True),
     PublicToolSpec(BUILDER_DOMAIN, "app_views_apply", ("app_views_apply",), ("builder", "views", "apply"), has_contract=True, cli_show_effective_context=True, cli_context_write=True),
     PublicToolSpec(BUILDER_DOMAIN, "app_charts_apply", ("app_charts_apply",), ("builder", "charts", "apply"), has_contract=True, cli_show_effective_context=True, cli_context_write=True),

package/src/qingflow_mcp/response_trim.py

@@ -57,6 +57,13 @@ def trim_public_response(tool_name: str | None, payload: dict[str, Any]) -> dict
     if not isinstance(payload, dict):
         return payload
     if _looks_like_failure_payload(payload):
+        status = str(payload.get("status") or "").lower()
+        if tool_name in {"user:record_insert", "user:record_update", "user:record_delete"} and status in {
+            "blocked",
+            "needs_confirmation",
+            "partial_success",
+        }:
+            return trim_success_response(tool_name, payload)
         return _trim_returned_failure(payload)
     return trim_success_response(tool_name, payload)
 
@@ -65,7 +72,12 @@ def trim_success_response(tool_name: str | None, payload: dict[str, Any]) -> dic
     if not isinstance(payload, dict):
         return payload
     trimmed = deepcopy(payload)
-    _drop_top_keys(trimmed, COMMON_SUCCESS_DROP_TOP)
+    drop_keys = COMMON_SUCCESS_DROP_TOP
+    if tool_name in {"user:record_get", "user:record_logs_get"}:
+        drop_keys = COMMON_SUCCESS_DROP_TOP - {"output_profile"}
+    if tool_name in {"user:record_insert", "user:record_update", "user:record_delete"} and payload.get("ok") is False:
+        drop_keys = drop_keys - {"ok"}
+    _drop_top_keys(trimmed, drop_keys)
     transformer = SUCCESS_POLICY_BY_TOOL.get(tool_name or "")
     if transformer is not None:
         transformer(trimmed)
@@ -81,7 +93,12 @@ def trim_error_response(payload: dict[str, Any]) -> dict[str, Any]:
     _drop_deep_keys(trimmed.get("details"), {"request_route", "base_url", "normalized_args", "suggested_next_call", "transport", "response", "body", "raw"})
     details = trimmed.get("details")
     if isinstance(details, dict):
+        preserved = {}
+        for key in ("blocking_issues", "compiled_match_rules"):
+            if key in details:
+                preserved[key] = details.get(key)
         compact_details = _compact_scalar_dict(details)
+        compact_details.update(preserved)
         if compact_details:
             trimmed["details"] = compact_details
         else:
@@ -137,7 +154,7 @@ def _looks_like_failure_payload(payload: dict[str, Any]) -> bool:
     if payload.get("ok") is False:
         return True
     status = str(payload.get("status") or "").lower()
-    return status in {"failed", "blocked", "verification_failed"}
+    return status in {"failed", "blocked"}
 
 
 def _trim_returned_failure(payload: dict[str, Any]) -> dict[str, Any]:
@@ -146,7 +163,12 @@ def _trim_returned_failure(payload: dict[str, Any]) -> dict[str, Any]:
     _drop_deep_keys(trimmed.get("details"), {"request_route", "base_url", "normalized_args", "suggested_next_call", "transport", "response", "body", "raw"})
     details = trimmed.get("details")
     if isinstance(details, dict):
+        preserved = {}
+        for key in ("blocking_issues", "compiled_match_rules"):
+            if key in details:
+                preserved[key] = details.get(key)
         compact_details = _compact_scalar_dict(details)
+        compact_details.update(preserved)
         if compact_details:
             trimmed["details"] = compact_details
         else:
@@ -272,7 +294,7 @@ def _trim_workspace_get(payload: JSONObject) -> None:
         )
 
 
-def _trim_app_search_like(payload: JSONObject) -> None:
+def _trim_app_list_like(payload: JSONObject) -> None:
     payload.pop("apps", None)
     _trim_item_list(payload, "items", allowed=("app_key", "app_name", "package_name"))
 
@@ -365,10 +387,17 @@ def _trim_record_write(payload: JSONObject) -> None:
     data = payload.get("data")
     if not isinstance(data, dict):
         return
+    if payload.get("mode") == "batch" or data.get("mode") == "batch":
+        _trim_record_write_batch(payload, data)
+        return
     data.pop("debug", None)
     data.pop("normalized_payload", None)
     data.pop("human_review", None)
     data.pop("action", None)
+    for key in ("update_route", "tried_routes"):
+        value = payload.get(key)
+        if value not in (None, [], {}, ""):
+            data[key] = value
     resource = _compact_record_resource(data.get("resource"))
     if resource:
         data["resource"] = resource
@@ -394,7 +423,48 @@ def _trim_record_write(payload: JSONObject) -> None:
             data.pop(key, None)
 
 
+def _trim_record_write_batch(payload: JSONObject, data: JSONObject) -> None:
+    data.pop("items", None)
+    data.pop("debug", None)
+    for key in ("summary", "app_key", "mode"):
+        if data.get(key) in (None, [], {}, ""):
+            data.pop(key, None)
+    items = payload.get("items")
+    if isinstance(items, list):
+        payload["items"] = [
+            _pick(
+                item,
+                (
+                    "index",
+                    "row_number",
+                    "status",
+                    "record_id",
+                    "apply_id",
+                    "write_executed",
+                    "verification_status",
+                    "safe_to_retry",
+                    "update_route",
+                    "tried_routes",
+                    "failed_fields",
+                    "confirmation_requests",
+                    "blockers",
+                    "error",
+                    "warnings",
+                    "resource",
+                    "verification",
+                ),
+            )
+            for item in items
+            if isinstance(item, dict)
+        ]
+    if payload.get("items") in (None, [], {}, ""):
+        payload.pop("items", None)
+
+
 def _trim_record_get(payload: JSONObject) -> None:
+    if payload.get("fields") is not None or payload.get("semantic_context") is not None:
+        _trim_detail_context_record_get(payload)
+        return
     data = payload.get("data")
     if not isinstance(data, dict):
         return
@@ -417,22 +487,142 @@ def _trim_record_get(payload: JSONObject) -> None:
     payload["data"] = compact
 
 
+def _trim_detail_context_record_get(payload: JSONObject) -> None:
+    _trim_item_list(
+        payload,
+        "fields",
+        allowed=("field_id", "title", "type", "value", "display_value", "requested_focus", "asset_ids", "file_asset_ids"),
+    )
+    references = payload.get("references")
+    if isinstance(references, list):
+        compact_refs: list[JSONObject] = []
+        for item in references:
+            if not isinstance(item, dict):
+                continue
+            compact = _pick(
+                item,
+                (
+                    "field_id",
+                    "field_title",
+                    "target_app_key",
+                    "target_record_id",
+                    "target_title",
+                    "target_detail_completeness",
+                    "self_reference",
+                ),
+            )
+            target_fields = item.get("target_fields") if isinstance(item.get("target_fields"), list) else []
+            if target_fields:
+                compact["target_fields"] = [
+                    _pick(field, ("field_id", "title", "type", "value", "display_value", "asset_ids", "file_asset_ids"))
+                    for field in target_fields
+                    if isinstance(field, dict)
+                ]
+            compact_refs.append(compact)
+        payload["references"] = compact_refs
+    media_assets = payload.get("media_assets")
+    if isinstance(media_assets, dict):
+        compact_media = _pick(media_assets, ("status", "local_dir", "warnings"))
+        items = media_assets.get("items") if isinstance(media_assets.get("items"), list) else []
+        compact_media["items"] = [
+            _pick(
+                item,
+                (
+                    "asset_id",
+                    "kind",
+                    "source",
+                    "field_id",
+                    "field_title",
+                    "local_path",
+                    "access_status",
+                    "readable_by_agent",
+                    "mime_type",
+                    "size_bytes",
+                    "download_strategy",
+                    "storage_auth_type",
+                    "storage_cookie_prefix",
+                    "redirected",
+                ),
+            )
+            for item in items
+            if isinstance(item, dict)
+        ]
+        payload["media_assets"] = compact_media
+    file_assets = payload.get("file_assets")
+    if isinstance(file_assets, dict):
+        compact_files = _pick(file_assets, ("status", "local_dir", "warnings"))
+        items = file_assets.get("items") if isinstance(file_assets.get("items"), list) else []
+        compact_files["items"] = [
+            _pick(
+                item,
+                (
+                    "file_asset_id",
+                    "media_asset_id",
+                    "kind",
+                    "source",
+                    "field_id",
+                    "field_title",
+                    "file_name",
+                    "local_path",
+                    "access_status",
+                    "readable_by_agent",
+                    "mime_type",
+                    "size_bytes",
+                    "download_strategy",
+                    "storage_auth_type",
+                    "storage_cookie_prefix",
+                    "redirected",
+                    "extraction",
+                ),
+            )
+            for item in items
+            if isinstance(item, dict)
+        ]
+        payload["file_assets"] = compact_files
+    for key in ("data_logs", "workflow_logs"):
+        node = payload.get(key)
+        if not isinstance(node, dict):
+            continue
+        compact_node = _pick(
+            node,
+            (
+                "status",
+                "visible",
+                "reason",
+                "page",
+                "page_size",
+                "items_loaded",
+                "reported_total",
+                "has_more",
+                "complete",
+                "items",
+            ),
+        )
+        payload[key] = compact_node
+    associated_resources = payload.get("associated_resources")
+    if isinstance(associated_resources, list):
+        payload["associated_resources"] = [
+            _pick(item, ("type", "resource_type", "name", "app_key", "app_name", "view_key", "chart_key", "view_type", "report_source", "data_access"))
+            for item in associated_resources
+            if isinstance(item, dict)
+        ]
+    _drop_deep_keys(payload, {"raw", "debug"})
+
+
 def _trim_record_list(payload: JSONObject) -> None:
     data = payload.get("data")
     if not isinstance(data, dict):
         return
     pagination = data.get("pagination") if isinstance(data.get("pagination"), dict) else {}
-    returned_items = pagination.get("returned_items")
-    result_amount = pagination.get("result_amount")
-    limit = pagination.get("limit")
-    truncated = False
-    if isinstance(result_amount, int) and isinstance(returned_items, int):
+    returned_items = pagination.get("returned_count", pagination.get("returned_items"))
+    result_amount = pagination.get("total_count", pagination.get("result_amount"))
+    truncated = bool(pagination.get("truncated"))
+    if not truncated and isinstance(result_amount, int) and isinstance(returned_items, int):
         truncated = result_amount > returned_items
     compact_pagination = {
         "loaded": True,
-        "page_size": limit,
-        "fetched_pages": 1,
-        "reported_total": result_amount,
+        "returned_count": returned_items,
+        "total_count": result_amount,
         "truncated": truncated,
     }
     selection = data.get("selection") if isinstance(data.get("selection"), dict) else {}
@@ -445,6 +635,17 @@ def _trim_record_list(payload: JSONObject) -> None:
     if view:
         compact["view"] = _pick(view, ("view_id", "name"))
     payload["data"] = compact
+    lookup = payload.get("lookup") if isinstance(payload.get("lookup"), dict) else {}
+    if lookup:
+        payload["lookup"] = {
+            "mode": lookup.get("mode"),
+            "query": lookup.get("query"),
+            "total_count": lookup.get("total_count", lookup.get("reported_total")),
+            "returned_count": lookup.get("returned_count"),
+            "truncated": lookup.get("truncated"),
+            "confidence": lookup.get("confidence"),
+            "next_action": lookup.get("next_action"),
+        }
 
 
 def _trim_record_access(payload: JSONObject) -> None:
@@ -461,7 +662,6 @@ def _trim_record_access(payload: JSONObject) -> None:
         "truncated",
         "safe_for_final_conclusion",
         "files",
-        "metadata_files",
         "fields",
         "warnings",
         "verification",
@@ -474,6 +674,49 @@ def _trim_record_access(payload: JSONObject) -> None:
     payload.update(compact)
 
 
+def _trim_record_logs(payload: JSONObject) -> None:
+    compact: dict[str, Any] = {}
+    for key in (
+        "ok",
+        "status",
+        "output_profile",
+        "app",
+        "view",
+        "record",
+        "local_dir",
+        "summary_path",
+        "warnings",
+        "unavailable_context",
+        "context_integrity",
+    ):
+        value = payload.get(key)
+        if value is not None:
+            compact[key] = value
+    for key in ("data_logs", "workflow_logs"):
+        node = payload.get(key)
+        if isinstance(node, dict):
+            compact[key] = _pick(
+                node,
+                (
+                    "status",
+                    "visible",
+                    "source",
+                    "reason",
+                    "complete",
+                    "items_count",
+                    "pages_fetched",
+                    "page_size",
+                    "reported_total",
+                    "local_path",
+                    "preview_items",
+                    "warnings",
+                    "stopped_reason",
+                ),
+            )
+    payload.clear()
+    payload.update(compact)
+
+
 def _trim_record_analyze(payload: JSONObject) -> None:
     summary: dict[str, Any] = {}
     completeness = payload.get("completeness")
@@ -520,13 +763,18 @@ def _trim_record_delete(payload: JSONObject) -> None:
     if not isinstance(data, dict):
         return
     resource = data.get("resource")
-    deleted_ids: list[str] = []
-    if isinstance(resource, dict):
+    deleted_ids = payload.get("deleted_ids") if isinstance(payload.get("deleted_ids"), list) else data.get("deleted_ids")
+    failed_ids = payload.get("failed_ids") if isinstance(payload.get("failed_ids"), list) else data.get("failed_ids")
+    if not isinstance(deleted_ids, list):
+        deleted_ids = []
+    if not isinstance(failed_ids, list):
+        failed_ids = []
+    if not deleted_ids and isinstance(resource, dict):
         raw_ids = resource.get("record_ids") or resource.get("apply_ids") or resource.get("applyIds")
         if isinstance(raw_ids, list):
             deleted_ids = [str(item) for item in raw_ids if item not in (None, "")]
-    data["deleted_ids"] = deleted_ids
-    data.setdefault("failed_ids", [])
+    data["deleted_ids"] = [str(item) for item in deleted_ids if item not in (None, "")]
+    data["failed_ids"] = [str(item) for item in failed_ids if item not in (None, "")]
     for key in (
         "resource",
         "action",
@@ -594,6 +842,19 @@ def _compact_schema_field(item: Any, *, template_map: dict[str, Any] | None) ->
         compact["required"] = bool(item.get("required"))
     if template_map is not None and isinstance(title, str) and title in template_map:
         compact["template"] = template_map.get(title)
+    for key in (
+        "format_hint",
+        "example_value",
+        "linkage",
+        "may_become_required",
+        "activation_sources",
+        "requirement_reason",
+        "accepts_natural_input",
+        "requires_upload",
+    ):
+        value = item.get(key)
+        if value not in (None, [], {}, ""):
+            compact[key] = value
     candidate_hint = item.get("candidate_hint")
     if isinstance(candidate_hint, dict):
         compact["candidate_hint"] = candidate_hint
@@ -747,7 +1008,11 @@ def _trim_builder_envelope(payload: JSONObject) -> None:
         details = payload.get("details")
         if isinstance(details, dict):
             _drop_deep_keys(details, {"request_route", "base_url", "normalized_args", "suggested_next_call", "transport", "response", "body", "raw"})
+            preserved = {}
+            if isinstance(details.get("compiled_match_rules"), dict):
+                preserved["compiled_match_rules"] = details.get("compiled_match_rules")
             compact = _compact_scalar_dict(details)
+            compact.update(preserved)
             if compact:
                 payload["details"] = compact
             else:
@@ -768,7 +1033,7 @@ _register_policy((USER_DOMAIN, BUILDER_DOMAIN), ("auth_use_credential", "auth_wh
 _register_policy((USER_DOMAIN, BUILDER_DOMAIN), ("auth_logout",), _trim_auth_logout)
 _register_policy((USER_DOMAIN, BUILDER_DOMAIN), ("workspace_list",), _trim_workspace_list)
 _register_policy((USER_DOMAIN, BUILDER_DOMAIN), ("workspace_get", "workspace_select"), _trim_workspace_get)
-_register_policy((USER_DOMAIN,), ("app_list", "app_search"), _trim_app_search_like)
+_register_policy((USER_DOMAIN,), ("app_list",), _trim_app_list_like)
 _register_policy((USER_DOMAIN, BUILDER_DOMAIN), ("app_get",), _trim_app_get)
 _register_policy((BUILDER_DOMAIN,), ("app_repair_code_blocks",), _trim_builder_list_like)
 _register_policy((USER_DOMAIN, BUILDER_DOMAIN), ("portal_list", "portal_get", "view_get", "chart_get"), _trim_builder_list_like)
@@ -811,6 +1076,7 @@ _register_policy((USER_DOMAIN,), ("record_insert", "record_update"), _trim_recor
 _register_policy((USER_DOMAIN,), ("record_get",), _trim_record_get)
 _register_policy((USER_DOMAIN,), ("record_list",), _trim_record_list)
 _register_policy((USER_DOMAIN,), ("record_access",), _trim_record_access)
+_register_policy((USER_DOMAIN,), ("record_logs_get",), _trim_record_logs)
 _register_policy((USER_DOMAIN,), ("record_analyze",), _trim_record_analyze)
 _register_policy((USER_DOMAIN,), ("record_code_block_run",), _trim_code_block_run)
 _register_policy((USER_DOMAIN,), ("task_list",), _trim_task_list)
@@ -851,6 +1117,8 @@ _register_policy(
     (BUILDER_DOMAIN,),
     (
         "builder_tool_contract",
+        "workspace_icon_catalog_get",
+        "package_list",
         "package_get",
         "package_apply",
         "solution_install",
@@ -860,11 +1128,8 @@ _register_policy(
         "app_release_edit_lock_if_mine",
         "app_resolve",
         "button_style_catalog_get",
-        "app_custom_button_list",
-        "app_custom_button_get",
-        "app_custom_button_create",
-        "app_custom_button_update",
-        "app_custom_button_delete",
+        "app_custom_buttons_apply",
+        "app_associated_resources_apply",
         "app_get_fields",
         "app_repair_code_blocks",
         "app_get_layout",

package/src/qingflow_mcp/server.py

@@ -48,17 +48,17 @@ All resource tools operate with the logged-in user's Qingflow permissions.
 
 ## App Discovery
 
-If `app_key` is unknown, use `app_list` or `app_search` first.
+If `app_key` is unknown, use `app_list` first. Pass `query` to filter visible apps by keyword.
 If the app is known but the data range is not, use `app_get` first and choose from `accessible_views`.
-If an accessible view has `analysis_supported=false`, do not use it for `record_list` or `record_analyze`. `boardView` and `ganttView` are special UI views, not list/analyze targets.
+If an accessible view has `analysis_supported=false`, do not use it for `record_access` or `record_list`. `boardView` and `ganttView` are special UI views, not data-access targets.
 `view_get(view_id=...)` also returns `export_capability`; it only means there is a supported export route, not that export permission has been verified.
 
 ## Schema-First Rule
 
 Call `record_insert_schema_get` before `record_insert`.
-Call `record_update_schema_get` before `record_update`.
+For simple field changes after the target record is clear, call `record_update` directly. Use `record_update_schema_get` for diagnostics, ambiguous fields, or complex writable-scope inspection.
 Call `record_code_block_schema_get` before `record_code_block_run`.
-Call `app_get` first when the data range is unclear, then use `record_browse_schema_get(view_id=...)` before `record_list`, `record_get`, or `record_analyze`.
+Call `app_get` first when the data range is unclear, then use `record_browse_schema_get(view_id=...)` before `record_access`, `record_list`, `record_get`, or `record_logs_get`.
 Call `record_import_schema_get` when the import field mapping is unclear before template download or verify.
 
 - All `field_id` values must come from the schema response.
@@ -67,8 +67,9 @@ Call `record_import_schema_get` when the import field mapping is unclear before
 ## Schema Scope
 
 `record_insert_schema_get` returns the current user's insert-ready applicant schema; read `required_fields`, `optional_fields`, `runtime_linked_required_fields`, and `payload_template`.
-`record_update_schema_get` returns the current record's overall update-ready writable field set across matched accessible views; read `writable_fields` and `payload_template`.
-`record_browse_schema_get(view_id=...)` returns browse-schema fields for the selected accessible view.
+`record_update_schema_get` returns the current record's overall update-ready writable field set and route diagnostics across matched accessible views; read `writable_fields`, `payload_template`, `available_update_routes`, and `recommended_update_route`.
+`record_browse_schema_get(view_id=...)` returns the same readable fields shown in the selected Qingflow table view header.
+`record_access.fields` / CSV columns and `record_list.columns / where / order_by / query_fields` use that exact same view schema.
 `record_code_block_schema_get` returns code-block-ready schema for exact code block field selection.
 `record_import_schema_get` returns import-ready column metadata.
 
@@ -78,16 +79,17 @@ Call `record_import_schema_get` when the import field mapping is unclear before
 
 ## Analytics Path
 
-`app_get -> record_browse_schema_get(view_id=...) -> record_analyze`
+`app_get -> record_browse_schema_get(view_id=...) -> record_access -> Python`
 
 Prefer `view_id` entries from `accessible_views` where `analysis_supported=true`.
 
+Use `record_access` to write local CSV shard files for analysis, then use Python to compute counts, rankings, ratios, trends, and final conclusions.
+
 Use this DSL shape:
 
-- `dimensions`: `{{field_id, alias, bucket}}`
-- `metrics`: `{{op, field_id, alias}}`
-- `filters`: `{{field_id, op, value}}`
-- `sort`: `{{by, order}}`
+- `columns`: `[{{field_id}}]`
+- `where`: `[{{field_id, op, value}}]`
+- `order_by`: `[{{field_id, direction}}]`
 
 Important key rules:
 
@@ -101,30 +103,37 @@ Analysis answers must include concrete numbers. When applicable, include percent
 
 ## Record CRUD Path
 
-`app_get -> record_browse_schema_get(view_id=...) -> record_list / record_get`
-`record_insert_schema_get -> record_insert`
-`record_update_schema_get -> record_update`
+`app_get -> record_browse_schema_get(view_id=...) -> record_list / record_get / record_logs_get`
+`record_insert_schema_get -> record_insert(items)`
+`record_update` for simple updates; `record_update_schema_get -> record_update` when the writable field scope is unclear.
 `record_list / record_get -> record_delete`
 `record_code_block_schema_get -> record_code_block_run`
 
 - Use `columns` as `[{{field_id}}]`
+- Use `record_list(query=..., query_fields=[{{field_id}}])` for fuzzy single-record lookup, then follow `lookup.next_action`; `query_fields` is search scope and `columns` is display shape.
 - Use `where` items as `{{field_id, op, value}}`
 - Use `order_by` items as `{{field_id, direction}}`
 - Legacy forms such as bare integer `field_id`, `fieldId`, `operator`, `values`, or `order` may still parse, but they are compatibility-only and not the canonical DSL
 
-- `record_insert` uses an applicant-node `fields` map keyed by field title.
-- `record_update` uses a field-title keyed `fields` map and internally selects the first accessible view that can execute the current payload.
+- `record_insert` defaults to an applicant-node `items` array; each item contains a field-title keyed `fields` map. A single insert is one item.
+- `record_update` uses a field-title keyed `fields` map. It first tries the data-manager direct update route, then falls back to the frontend custom-view detail edit route when the selected view can cover the payload; if a unique current-user todo task for the same record exposes editable fields, it can finally use the workflow save-only route. Read `update_route` and `tried_routes` after execution.
 - For insert, `runtime_linked_required_fields` means required-but-not-directly-writable fields that are usually supplied by runtime linkage or upstream context.
 - For insert, fields marked `may_become_required=true` stay in `optional_fields`; they are still directly writable, but linked visibility or option-driven rules can make them required at runtime.
 - Read field-level `linkage` whenever present on `record_insert_schema_get` or `record_update_schema_get`; it is the static hint for linked visibility, reference-driven auto fill, and formula/default auto-fill behavior.
 - `linkage.sources` lists upstream field titles that influence the current field; `linkage.affects_fields` lists downstream fields that may change when the current field changes.
 - `linkage.kind=logic_visibility` means linked visibility or option-driven rules are involved; `linkage.kind=reference_fill` means reference/default matching logic is involved; `linkage.kind=formula_fill` means formula/default auto-fill logic is involved.
-- `record_update_schema_get` exposes the overall writable field set for the record, but not every field combination is guaranteed; `record_update` still needs one single matched accessible view that can cover the payload.
+- `record_update_schema_get` exposes the overall writable field set and route candidates for the record, but not every field combination is guaranteed; `record_update` still needs data-manager permission, one single matched custom view that can cover the payload, or one unique editable current-user todo task.
 - `record_delete` deletes by `record_id` or `record_ids`.
-- When readback shape matters after insert or update, prefer `record_get(..., output_profile="normalized")` or `record_list(..., output_profile="normalized")`.
+- `record_get` is the single-record frontend detail context tool. It returns detail-page visible fields, one-level relation targets, first-page data/workflow logs, associated views/reports, local readable image assets, local downloadable file assets, unavailable context, and `semantic_context`.
+- Use `record_logs_get` only when the user needs the full visible data/workflow log history for a specific record. It writes JSONL files locally and returns file paths plus completeness metadata; do not expect full log arrays in the response.
+- Read record images from `record_get.media_assets.items[].local_path` when `readable_by_agent=true`; read attachments/documents/tables from `record_get.file_assets.items[].local_path` and `extraction.text_path` when present. `record_get` follows the frontend storage cookie redirect path for Qingflow attachments, and remote file URLs should not be treated as directly readable.
+- `record_get.columns` are focus hints only; they do not project the detail fields. Read facts from top-level `fields[]`.
+- When readback shape matters after insert or update, prefer `record_get` for human/detail-page context, or `record_list(..., output_profile="normalized")` for batch-shaped normalized rows.
 
 - Read relation targets from `record_insert_schema_get` / `record_update_schema_get` relation metadata before preparing relation writes.
-- Member and department fields may be written with natural strings directly on `record_insert` / `record_update`; only fall back to `record_member_candidates` or `record_department_candidates` when the user wants explicit candidate browsing or the write returns ambiguity that needs confirmation.
+- Member, department, and relation fields may be written with natural strings directly on `record_insert` / `record_update`; only fall back to candidate tools when the user wants explicit candidate browsing or the write returns ambiguity that needs confirmation.
+- CLI-only agents can use `qingflow record member-candidates --app-key APP_KEY --field-id FIELD_ID --keyword NAME --json` or `qingflow record department-candidates --app-key APP_KEY --field-id FIELD_ID --keyword DEPT --json` for that fallback; pass `--record-id`, `--workflow-node-id`, and `--fields-file` only when the candidate scope must match an existing runtime context.
+- For batch insert `partial_success`, read `created_record_ids`, failed `items[].row_number`, and `failed_fields`; repair only failed rows and never retry the whole batch after any row has `write_executed=true`.
 - If explicit candidate browsing is needed for default-all member or department fields, prefer those field candidate tools instead of starting with `directory_*`.
 
 ## Code Block Path
@@ -177,7 +186,7 @@ Use `record_code_block_run` when the user wants to execute a form code-block fie
 - `task_action_execute(task_id=..., action=...)` is also supported; MCP resolves the current todo locator internally before calling the real action route.
 - `task_workflow_log_get(task_id=...)` and `task_associated_report_detail_get(task_id=...)` are also supported for the current todo context.
 - Use `task_associated_report_detail_get` for associated view or report details.
-- Use `task_workflow_log_get` for full workflow log history.
+- Use `task_workflow_log_get` for the current task context workflow log page. For full record-level data/workflow logs, use `record_logs_get(app_key, record_id, view_id?)`.
 - Task actions operate on `app_key + record_id + workflow_node_id`, not `task_id`.
 
 ## Time Handling