@nocobase/cli 2.3.0-alpha.1 → 2.3.0-beta.10

package/assets/env-proxy/nginx/snippets/maps-http.conf

@@ -12,3 +12,8 @@ map $http_host $final_host {
     default $http_host;
     ""      $host;
 }
+
+map $request_uri $legacy_file_app {
+    default "";
+    ~[?&]__appName=(?<legacy_file_app_name>[A-Za-z0-9_-]+)(?:&|$) $legacy_file_app_name;
+}

package/assets/env-proxy/nginx/snippets/uploads-location.conf

@@ -1,12 +1,19 @@
-add_header Cache-Control "public" always;
+auth_request /_nocobase_legacy_file_auth;
+auth_request_set $legacy_auth_set_cookie $upstream_http_set_cookie;
+
+add_header Cache-Control "private, no-store" always;
+add_header Set-Cookie $legacy_auth_set_cookie always;
+add_header Content-Security-Policy "sandbox" always;
 add_header X-Content-Type-Options "nosniff" always;
 
 access_log off;
 autoindex off;
 
 # Force potentially renderable uploaded files to download.
-location ~* \.(?:htm|html|svg|svgz|xhtml)$ {
-    add_header Cache-Control "public" always;
+location ~* \.(?:htm|html|pdf|svg|svgz|xht|xhtml|xml|xsl|xslt)$ {
+    add_header Cache-Control "private, no-store" always;
+    add_header Set-Cookie $legacy_auth_set_cookie always;
+    add_header Content-Security-Policy "sandbox" always;
     add_header X-Content-Type-Options "nosniff" always;
     add_header Content-Disposition "attachment" always;
 }
@@ -15,7 +22,9 @@ location ~* \.(?:htm|html|svg|svgz|xhtml)$ {
 location ~* \.md$ {
     default_type text/markdown;
 
-    add_header Cache-Control "public" always;
+    add_header Cache-Control "private, no-store" always;
+    add_header Set-Cookie $legacy_auth_set_cookie always;
+    add_header Content-Security-Policy "sandbox" always;
     add_header X-Content-Type-Options "nosniff" always;
     add_header Content-Disposition "inline" always;
 }

package/dist/commands/api/resource/create.js

@@ -1,10 +1,19 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
 import { Command } from '@oclif/core';
 import { buildCreateArgs, createFlags, runResourceCommand } from '../../../lib/resource-command.js';
 export default class ResourceCreate extends Command {
-    static summary = 'Create a record in a resource';
-    static description = 'Create a record in a generic resource. Pass record content through --values as a JSON object.';
+    static summary = 'Create one or more records in a resource';
+    static description = 'Create records in a generic resource. Pass record content through --values as a JSON object, or as a JSON array of objects to create multiple records in a single request.';
     static examples = [
         `<%= config.bin %> <%= command.id %> --resource users --values '{"nickname":"Ada"}'`,
+        `<%= config.bin %> <%= command.id %> --resource users --values '[{"nickname":"Ada"},{"nickname":"Grace"}]'`,
         `<%= config.bin %> <%= command.id %> --resource posts.comments --source-id 1 --values '{"content":"Hello"}'`,
     ];
     static flags = createFlags;

package/dist/lib/api-client.js

@@ -199,6 +199,13 @@ async function createMultipartBody(flags, operation) {
         if (value === undefined) {
             continue;
         }
+        if (Array.isArray(value)) {
+            for (const item of value) {
+                formData.append(parameter.name, typeof item === 'object' ? JSON.stringify(item) : String(item));
+            }
+            hasValues = hasValues || value.length > 0;
+            continue;
+        }
         formData.append(parameter.name, typeof value === 'object' ? JSON.stringify(value) : String(value));
         hasValues = true;
     }

package/dist/lib/browser.js

@@ -0,0 +1,29 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+import { spawn } from 'node:child_process';
+export async function openUrlInDefaultBrowser(url) {
+    const [command, args, options] = process.platform === 'darwin'
+        ? ['open', [url], { detached: true, stdio: 'ignore' }]
+        : process.platform === 'win32'
+            ? ['cmd', ['/c', 'start', '', url], { detached: true, stdio: 'ignore', windowsHide: true }]
+            : ['xdg-open', [url], { detached: true, stdio: 'ignore' }];
+    return new Promise((resolve) => {
+        try {
+            const child = spawn(command, args, options);
+            child.once('error', () => resolve(false));
+            child.once('spawn', () => {
+                child.unref();
+                resolve(true);
+            });
+        }
+        catch {
+            resolve(false);
+        }
+    });
+}

package/dist/lib/env-proxy.js

@@ -510,6 +510,19 @@ function buildNginxManagedConfigBlock(context) {
         `    include ${context.snippetsDir}/mime-types.conf;`,
         `    include ${context.snippetsDir}/gzip.conf;`,
         '',
+        '    location = /_nocobase_legacy_file_auth {',
+        '        internal;',
+        `        proxy_pass ${context.backendUrl}${context.apiBasePath}auth:checkLegacyFileAccess;`,
+        '        proxy_pass_request_body off;',
+        '        proxy_set_header Content-Length "";',
+        '        proxy_set_header Cookie $http_cookie;',
+        '        proxy_set_header Authorization $http_authorization;',
+        '        proxy_set_header X-App $legacy_file_app;',
+        '        proxy_set_header X-Original-URI $request_uri;',
+        '        proxy_set_header Host $final_host;',
+        '        proxy_set_header X-Forwarded-Proto $upstream_x_forwarded_proto;',
+        '    }',
+        '',
         `    location ${context.appPublicPath}storage/uploads/ {`,
         `        alias ${context.uploadsDir}/;`,
         `        include ${context.snippetsDir}/uploads-location.conf;`,
@@ -1010,20 +1023,41 @@ function renderNginxLocationTemplate(context) {
     const proxyPassBlock = buildNginxProxyPassBlock(context.proxyHost, context.apiPort);
     const wsProxyPassTarget = `http://${context.proxyHost}:${context.apiPort}${context.wsPath}`;
     const apiBasePathNoTrailingSlash = trimTrailingSlash(context.apiBasePath);
-    return `    location ~* ^${context.appPublicPath}storage/uploads/(.*\\.md)$ {
+    return `    location = /_nocobase_legacy_file_auth {
+        internal;
+        proxy_pass http://${context.proxyHost}:${context.apiPort}${context.apiBasePath}auth:checkLegacyFileAccess;
+        proxy_pass_request_body off;
+        proxy_set_header Content-Length "";
+        proxy_set_header Cookie $http_cookie;
+        proxy_set_header Authorization $http_authorization;
+        proxy_set_header X-App $legacy_file_app;
+        proxy_set_header X-Original-URI $request_uri;
+        proxy_set_header Host $final_host;
+        proxy_set_header X-Forwarded-Proto $upstream_x_forwarded_proto;
+    }
+
+    location ~* ^${context.appPublicPath}storage/uploads/(.*\\.md)$ {
         alias ${context.uploadsPath}/$1;
         default_type text/markdown;
-        add_header Cache-Control "public";
+        auth_request /_nocobase_legacy_file_auth;
+        auth_request_set $legacy_auth_set_cookie $upstream_http_set_cookie;
+        add_header Cache-Control "private, no-store" always;
+        add_header Set-Cookie $legacy_auth_set_cookie always;
         add_header Content-Disposition "inline";
+        add_header Content-Security-Policy "sandbox" always;
         add_header X-Content-Type-Options "nosniff" always;
         access_log off;
         autoindex off;
     }
 
-    location ~* ^${context.appPublicPath}storage/uploads/(.*\\.(?:htm|html|svg|svgz|xhtml|pdf))$ {
+    location ~* ^${context.appPublicPath}storage/uploads/(.*\\.(?:htm|html|pdf|svg|svgz|xht|xhtml|xml|xsl|xslt))$ {
         alias ${context.uploadsPath}/$1;
-        add_header Cache-Control "public";
+        auth_request /_nocobase_legacy_file_auth;
+        auth_request_set $legacy_auth_set_cookie $upstream_http_set_cookie;
+        add_header Cache-Control "private, no-store" always;
+        add_header Set-Cookie $legacy_auth_set_cookie always;
         add_header Content-Disposition "attachment" always;
+        add_header Content-Security-Policy "sandbox" always;
         add_header X-Content-Type-Options "nosniff" always;
         access_log off;
         autoindex off;
@@ -1031,7 +1065,11 @@ function renderNginxLocationTemplate(context) {
 
     location ${context.appPublicPath}storage/uploads/ {
         alias ${context.uploadsPath}/;
-        add_header Cache-Control "public";
+        auth_request /_nocobase_legacy_file_auth;
+        auth_request_set $legacy_auth_set_cookie $upstream_http_set_cookie;
+        add_header Cache-Control "private, no-store" always;
+        add_header Set-Cookie $legacy_auth_set_cookie always;
+        add_header Content-Security-Policy "sandbox" always;
         add_header X-Content-Type-Options "nosniff" always;
         access_log off;
         autoindex off;
@@ -1080,7 +1118,12 @@ function renderNginxLocationTemplate(context) {
 `;
 }
 function renderLegacyEnvProxyAppTemplate(context) {
-    return `server {
+    return `map $request_uri $legacy_file_app {
+    default "";
+    ~[?&]__appName=(?<legacy_file_app_name>[A-Za-z0-9_-]+)(?:&|$) $legacy_file_app_name;
+}
+
+server {
     listen 80;
     server_name _;
     client_max_body_size 0;
@@ -1153,10 +1196,31 @@ function renderCaddyAppTemplate(siteAddress, context, publicDir) {
         `    encode zstd gzip${rootRedirectBlock}${appPublicPathRedirectBlock}${modernClientRedirectBlock}${shorthandModernClientRedirectBlock}`,
         '',
         `    handle_path ${uploadsPathMatcher} {`,
-        `        root * ${context.uploadsPath}`,
-        '        header Cache-Control public',
-        '        header X-Content-Type-Options nosniff',
-        '        file_server',
+        '        route {',
+        '            request_header -X-NocoBase-Auth-Set-Cookie',
+        `            forward_auth ${context.proxyHost}:${context.apiPort} {`,
+        `                uri ${context.apiBasePath}auth:checkLegacyFileAccess`,
+        '                header_up X-App {query.__appName}',
+        '                copy_headers Set-Cookie>X-NocoBase-Auth-Set-Cookie',
+        '            }',
+        '',
+        '            @refreshedAuth header X-NocoBase-Auth-Set-Cookie *',
+        '            header @refreshedAuth Set-Cookie {header.X-NocoBase-Auth-Set-Cookie}',
+        '            header Cache-Control "private, no-store"',
+        '            header Content-Security-Policy sandbox',
+        '            header X-Content-Type-Options nosniff',
+        '            header Content-Disposition inline',
+        '',
+        '            @activeUploadedContent path_regexp activeUploadedContent (?i)\\.(?:htm|html|pdf|svg|svgz|xht|xhtml|xml|xsl|xslt)$',
+        '            header @activeUploadedContent Content-Disposition attachment',
+        '            @download query download=1',
+        '            header @download Content-Disposition attachment',
+        '            @markdown path_regexp markdown (?i)\\.md$',
+        '            header @markdown Content-Type text/markdown',
+        '',
+        `            root * ${context.uploadsPath}`,
+        '            file_server',
+        '        }',
         '    }',
         '',
         `    handle_path ${distPathMatcher} {`,

package/dist/lib/generated-command.js

@@ -15,12 +15,20 @@
  * For more information, please refer to: https://www.nocobase.com/agreement.
  */
 import { Command, Flags } from '@oclif/core';
+import { getCurrentEnvName, getEnv } from './auth-store.js';
 import { executeApiRequest } from './api-client.js';
+import { resolveAppUrlFromApiBaseUrl } from '../commands/env/shared.js';
 import { findApiCommandCompatViolation, formatApiCommandCompatViolation } from './api-command-compat.js';
+import { openUrlInDefaultBrowser } from './browser.js';
 import { ensureCrossEnvConfirmed } from './env-guard.js';
 import { applyPostProcessor } from './post-processors.js';
 import { readInstalledManagedSkillsVersion } from './skills-manager.js';
 import { registerPostProcessors } from '../post-processors/index.js';
+const UI_OPERATION_QUERY_KEY = '_operation_';
+const UI_OPERATION_VERSION = 1;
+function encodeUIOperation(operation) {
+    return Buffer.from(JSON.stringify(operation), 'utf8').toString('base64url');
+}
 function buildParameterFlag(parameter, options) {
     const hints = [parameter.in];
     if (parameter.isFile) {
@@ -104,6 +112,13 @@ export function createGeneratedFlags(operation) {
             required: true,
         });
     }
+    if (operation.ui) {
+        flags.ui = Flags.boolean({
+            description: 'Open the corresponding page in the NocoBase UI',
+            default: false,
+            helpGroup: 'Global',
+        });
+    }
     flags['api-base-url'] = Flags.string({
         description: 'NocoBase API base URL, for example http://localhost:13000/api',
         helpGroup: 'Global',
@@ -142,6 +157,68 @@ export function createGeneratedFlags(operation) {
     });
     return flags;
 }
+function hasFlagValue(value) {
+    if (Array.isArray(value)) {
+        return value.length > 0;
+    }
+    return value !== undefined && value !== '';
+}
+function listProvidedBodyFlags(flags, operation) {
+    const rawBodyFlags = ['body', 'body-file'].filter((flagName) => hasFlagValue(flags[flagName])).map((flagName) => `--${flagName}`);
+    const uiParameterNames = new Set(operation.ui?.parameters ?? []);
+    const bodyFieldFlags = operation.parameters
+        .filter((parameter) => parameter.in === 'body' && !uiParameterNames.has(parameter.name) && hasFlagValue(flags[parameter.flagName]))
+        .map((parameter) => `--${parameter.flagName}`);
+    return [...rawBodyFlags, ...bodyFieldFlags];
+}
+async function resolveUiAppUrl(flags) {
+    const apiBaseUrl = typeof flags['api-base-url'] === 'string' ? flags['api-base-url'] : undefined;
+    if (apiBaseUrl) {
+        return resolveAppUrlFromApiBaseUrl(apiBaseUrl);
+    }
+    const requestedEnv = typeof flags.env === 'string' ? flags.env : undefined;
+    const envName = requestedEnv ?? (await getCurrentEnvName());
+    const env = await getEnv(envName);
+    if (!env?.baseUrl) {
+        throw new Error(env
+            ? `Env "${envName}" is missing a base URL. Use --api-base-url or update env "${envName}" with \`nb env update ${envName} --api-base-url <url>\` first.`
+            : `Env "${envName}" is not configured. Use --api-base-url or run \`nb init --ui --env ${envName}\` first.`);
+    }
+    return resolveAppUrlFromApiBaseUrl(env.baseUrl);
+}
+function buildUiOperationUrl(appUrl, path, encodedOperation) {
+    const url = new URL(appUrl);
+    url.pathname = `${url.pathname.replace(/\/+$/, '')}/${path}`;
+    url.searchParams.set(UI_OPERATION_QUERY_KEY, encodedOperation);
+    return url.toString();
+}
+async function openUiOperation(command, operation, flags) {
+    const { operationId, ui } = operation;
+    if (!ui || !operationId) {
+        command.error('This API operation does not support --ui.');
+    }
+    const bodyFlags = listProvidedBodyFlags(flags, operation);
+    if (bodyFlags.length) {
+        command.error('--ui cannot be combined with API request body flags. Remove --ui to submit through the API, or remove the body flags to open the UI.');
+    }
+    const uiParameterNames = new Set(ui.parameters ?? []);
+    const params = Object.fromEntries(operation.parameters
+        .filter((parameter) => uiParameterNames.has(parameter.name) && hasFlagValue(flags[parameter.flagName]))
+        .map((parameter) => [parameter.name, flags[parameter.flagName]]));
+    const uiOperation = {
+        v: UI_OPERATION_VERSION,
+        operationId,
+        ...(Object.keys(params).length ? { params } : {}),
+    };
+    const encodedOperation = encodeUIOperation(uiOperation);
+    const appUrl = await resolveUiAppUrl(flags);
+    const targetUrl = buildUiOperationUrl(appUrl, ui.path, encodedOperation);
+    const opened = await openUrlInDefaultBrowser(targetUrl);
+    command.log(targetUrl);
+    if (!opened) {
+        command.warn('Could not open the default browser. Copy the URL above to continue.');
+    }
+}
 export class GeneratedApiCommand extends Command {
     static operation;
     static runtimeVersion;
@@ -169,6 +246,10 @@ export class GeneratedApiCommand extends Command {
         if (compatViolation) {
             this.error(formatApiCommandCompatViolation(compatViolation));
         }
+        if (flags.ui) {
+            await openUiOperation(this, ctor.operation, flags);
+            return;
+        }
         const response = await executeApiRequest({
             cliVersion,
             skillsVersion,

package/dist/lib/naming.js

@@ -1,6 +1,15 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
 import path from 'node:path';
 export function toKebabCase(value) {
     return value
+        .replace(/([A-Z]+)([A-Z][a-z])/g, '$1-$2')
         .replace(/([a-z0-9])([A-Z])/g, '$1-$2')
         .replace(/[^a-zA-Z0-9]+/g, '-')
         .replace(/-+/g, '-')

package/dist/lib/plugin-import.js

@@ -207,6 +207,29 @@ async function openPluginSource(source, npmRegistry, runFn = run) {
     }
     return await packNpmPluginSource(source, npmRegistry, runFn);
 }
+/**
+ * Locate the directory holding the plugin's `package.json` inside a freshly extracted archive.
+ *
+ * Archives reach us in two shapes: npm-style tarballs (`npm pack`, registry downloads) wrap everything in a single
+ * top-level directory — conventionally `package/` — while NocoBase's own `yarn build <plugin> --tar` writes entries at
+ * the archive root. Extracting with a fixed `strip: 1` would silently discard the root-level files of the latter, so we
+ * extract verbatim and pick the package root here instead. When neither shape matches, return the extract root and let
+ * `readPluginMetadata` report the missing `package.json`.
+ */
+async function resolveArchivePackageRoot(extractRoot) {
+    if (await pathExists(path.join(extractRoot, 'package.json'))) {
+        return extractRoot;
+    }
+    const entries = await fsp.readdir(extractRoot, { withFileTypes: true });
+    const directories = entries.filter((entry) => entry.isDirectory());
+    if (directories.length === 1) {
+        const nestedRoot = path.join(extractRoot, directories[0].name);
+        if (await pathExists(path.join(nestedRoot, 'package.json'))) {
+            return nestedRoot;
+        }
+    }
+    return extractRoot;
+}
 async function readPluginMetadata(extractRoot, sourceLabel) {
     const packageJsonPath = path.join(extractRoot, 'package.json');
     let content;
@@ -241,22 +264,21 @@ export async function importPluginSource(source, options = {}) {
     await fsp.mkdir(storagePluginsPath, { recursive: true });
     const archive = await openPluginSource(normalizedSource, options.npmRegistry, options.runFn);
     const stageDir = await fsp.mkdtemp(path.join(storagePluginsPath, '.nb-plugin-import-'));
-    let stageMoved = false;
     try {
         try {
-            await pipeline(archive.stream, createGunzip(), tar.extract({ cwd: stageDir, strip: 1 }));
+            await pipeline(archive.stream, createGunzip(), tar.extract({ cwd: stageDir }));
         }
         catch (error) {
             const message = error instanceof Error ? error.message : String(error);
             throw new Error(`Failed to extract plugin archive from ${archive.source}: ${message}`);
         }
-        const { packageName, packageVersion } = await readPluginMetadata(stageDir, archive.source);
+        const packageRoot = await resolveArchivePackageRoot(stageDir);
+        const { packageName, packageVersion } = await readPluginMetadata(packageRoot, archive.source);
         const outputDir = resolvePluginOutputDir(storagePluginsPath, packageName);
         const action = (await pathExists(outputDir)) ? 'updated' : 'installed';
         await fsp.mkdir(path.dirname(outputDir), { recursive: true });
         await fsp.rm(outputDir, { recursive: true, force: true });
-        await fsp.rename(stageDir, outputDir);
-        stageMoved = true;
+        await fsp.rename(packageRoot, outputDir);
         return {
             action,
             packageName,
@@ -268,9 +290,9 @@ export async function importPluginSource(source, options = {}) {
         };
     }
     finally {
-        if (!stageMoved) {
-            await fsp.rm(stageDir, { recursive: true, force: true });
-        }
+        // Always removes the staging directory: it is either untouched (failure), or an empty wrapper left behind after the
+        // nested package root was renamed out of it.
+        await fsp.rm(stageDir, { recursive: true, force: true });
         await archive.cleanup();
     }
 }

package/dist/lib/resource-command.js

@@ -41,6 +41,22 @@ function parseObjectFlag(value, flagName) {
     }
     return parsed;
 }
+function parseValuesFlag(value, flagName) {
+    if (value === undefined) {
+        return undefined;
+    }
+    const parsed = parseJson(value, flagName);
+    if (!parsed || typeof parsed !== 'object') {
+        throw new Error(`--${flagName} must be a JSON object, or a JSON array of objects to create multiple records`);
+    }
+    if (Array.isArray(parsed)) {
+        const invalidIndex = parsed.findIndex((item) => !item || Array.isArray(item) || typeof item !== 'object');
+        if (invalidIndex !== -1) {
+            throw new Error(`--${flagName} array items must all be JSON objects, but item ${invalidIndex} is not`);
+        }
+    }
+    return parsed;
+}
 function parseJsonArrayFlag(value, flagName) {
     if (value === undefined) {
         return undefined;
@@ -187,7 +203,7 @@ export const createFlags = {
     ...resourceBaseFlags,
     ...resourceAssociationFlags,
     values: Flags.string({
-        description: 'Record values used by create as a JSON object.',
+        description: 'Record values used by create as a JSON object, or a JSON array of objects to create multiple records in one request.',
         required: true,
     }),
     whitelist: Flags.string({
@@ -298,7 +314,7 @@ export function buildGetArgs(flags) {
 export function buildCreateArgs(flags) {
     return {
         ...pickSharedArgs(flags),
-        values: parseObjectFlag(flags.values, 'values'),
+        values: parseValuesFlag(flags.values, 'values'),
         whitelist: parseStringArrayFlags(flags.whitelist, 'whitelist'),
         blacklist: parseStringArrayFlags(flags.blacklist, 'blacklist'),
     };

package/dist/lib/resource-request.js

@@ -1,3 +1,11 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
 import { executeRawApiRequest } from './api-client.js';
 function buildActionUrl(resource, action, sourceId) {
     if (typeof sourceId === 'undefined' || sourceId === null || !resource.includes('.')) {

package/dist/lib/runtime-generator.js

@@ -18,7 +18,31 @@ import { createHash } from 'node:crypto';
 import { loadBuildConfig } from './build-config.js';
 import { toKebabCase, toLogicalActionName, toLogicalResourceName, toResourceSegments } from './naming.js';
 import { collectOperations } from './openapi.js';
-const RESERVED_FLAG_NAMES = new Set(['api-base-url', 'base-url', 'env', 'token', 'json-output', 'body', 'body-file', 'yes']);
+const RESERVED_FLAG_NAMES = new Set(['api-base-url', 'base-url', 'env', 'token', 'json-output', 'body', 'body-file', 'ui', 'yes']);
+const isRecord = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
+const isStringArray = (value) => Array.isArray(value) && value.every((item) => typeof item === 'string' && Boolean(item));
+function getGeneratedUIOperation(operation, parameters) {
+    if (!operation.operationId) {
+        return undefined;
+    }
+    const extension = operation['x-nocobase-cli-ui'];
+    if (!isRecord(extension) || typeof extension.path !== 'string') {
+        return undefined;
+    }
+    const path = extension.path.trim();
+    if (!path || path.startsWith('/') || /[?#]/.test(path) || /^[a-z][a-z\d+.-]*:/i.test(path)) {
+        return undefined;
+    }
+    const mappedParameters = extension.parameters === undefined ? [] : extension.parameters;
+    if (!isStringArray(mappedParameters) || new Set(mappedParameters).size !== mappedParameters.length) {
+        return undefined;
+    }
+    const allowedParameters = new Set(parameters.map((parameter) => parameter.name));
+    if (!mappedParameters.every((parameter) => allowedParameters.has(parameter))) {
+        return undefined;
+    }
+    return { path, parameters: mappedParameters };
+}
 function matchesPattern(value, pattern) {
     if (!value) {
         return false;
@@ -425,6 +449,7 @@ export async function generateRuntime(document, configFile, baseUrl) {
         const parameters = (operation.parameters ?? []).filter(isSupportedParameter).map((parameter) => toGeneratedParameter(parameter, usedFlagNames));
         const bodyParameters = extractBodyParameters(operation.requestBody, usedFlagNames);
         const allParameters = [...parameters, ...bodyParameters];
+        const ui = getGeneratedUIOperation(operation, allParameters);
         const hasBody = Boolean(operation.requestBody && !('$ref' in operation.requestBody));
         const requestContentType = getRequestContentType(operation.requestBody);
         const responseType = getResponseType(operation);
@@ -456,6 +481,8 @@ export async function generateRuntime(document, configFile, baseUrl) {
             resourceDisplayName,
             resourceDescription,
             commandId: segments.join(' '),
+            operationId: operation.operationId,
+            ui,
             method,
             pathTemplate,
             tags: operation.tags,

package/nocobase-ctl.config.json

@@ -202,6 +202,117 @@
         }
       }
     },
+    "ai": {
+      "name": "ai",
+      "description": "Discover LLM providers and manage LLM services and AI employees.",
+      "include": true,
+      "resources": {
+        "includes": ["ai", "llmServices", "aiEmployees"],
+        "excludes": [],
+        "overrides": {
+          "ai": {
+            "name": "llm-providers",
+            "description": "Discover providers and models and test unsaved LLM settings.",
+            "topLevel": false,
+            "operations": {
+              "includes": [
+                "ai:listLLMProviders",
+                "ai:listProviderModels",
+                "ai:testFlight",
+                "ai:listModels",
+                "ai:listLLMServices"
+              ]
+            }
+          },
+          "llmServices": {
+            "name": "llm-services",
+            "description": "Manage saved LLM service configurations.",
+            "topLevel": false,
+            "operations": {
+              "includes": [
+                "llmServices:list",
+                "llmServices:get",
+                "llmServices:create",
+                "llmServices:update",
+                "llmServices:destroy"
+              ]
+            }
+          },
+          "aiEmployees": {
+            "name": "employees",
+            "description": "Manage AI employees.",
+            "topLevel": false,
+            "operations": {
+              "includes": [
+                "aiEmployees:list",
+                "aiEmployees:get",
+                "aiEmployees:create",
+                "aiEmployees:update",
+                "aiEmployees:destroy"
+              ]
+            }
+          }
+        }
+      }
+    },
+    "kb": {
+      "name": "kb",
+      "description": "Manage vector databases, knowledge bases, documents, vectorization, and retrieval tests.",
+      "include": true,
+      "resources": {
+        "includes": ["aiVectorDatabases", "aiKnowledgeBase", "aiKnowledgeBaseDocs"],
+        "excludes": [],
+        "overrides": {
+          "aiVectorDatabases": {
+            "name": "vector-databases",
+            "description": "Manage vector database connections.",
+            "topLevel": false,
+            "operations": {
+              "includes": [
+                "aiVectorDatabases:listProviders",
+                "aiVectorDatabases:testConnection",
+                "aiVectorDatabases:list",
+                "aiVectorDatabases:get",
+                "aiVectorDatabases:create",
+                "aiVectorDatabases:update",
+                "aiVectorDatabases:destroy"
+              ]
+            }
+          },
+          "aiKnowledgeBase": {
+            "name": "kb",
+            "segments": ["kb"],
+            "description": "Manage knowledge bases and retrieval tests.",
+            "topLevel": true,
+            "operations": {
+              "includes": [
+                "aiKnowledgeBase:list",
+                "aiKnowledgeBase:get",
+                "aiKnowledgeBase:create",
+                "aiKnowledgeBase:update",
+                "aiKnowledgeBase:destroy",
+                "aiKnowledgeBase:runHitTest",
+                "aiKnowledgeBase:listExternalVectorStoreProviders"
+              ]
+            }
+          },
+          "aiKnowledgeBaseDocs": {
+            "name": "documents",
+            "description": "Manage knowledge base documents and vectorization.",
+            "topLevel": false,
+            "operations": {
+              "includes": [
+                "aiKnowledgeBaseDocs:list",
+                "aiKnowledgeBaseDocs:get",
+                "aiKnowledgeBaseDocs:upload",
+                "aiKnowledgeBaseDocs:vectorization",
+                "aiKnowledgeBaseDocs:destroy"
+              ]
+            }
+          }
+        }
+      }
+    },
     "flow-engine": {
       "name": "flow-engine",
       "description": "Manage flow surface composition, configuration, layout, and mutation APIs.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nocobase/cli",
-  "version": "2.3.0-alpha.1",
+  "version": "2.3.0-beta.10",
   "description": "NocoBase Command Line Tool",
   "type": "module",
   "main": "dist/generated/command-registry.js",
@@ -144,5 +144,5 @@
     "type": "git",
     "url": "git+https://github.com/nocobase/nocobase.git"
   },
-  "gitHead": "2377df8ceb12549149017f7f14a61207bf6e49a2"
+  "gitHead": "7aa3dce6cf3201752882f7012c72997898015d89"
 }