@qingflow-tech/qingflow-app-user-mcp 1.0.10 → 1.0.12

package/src/qingflow_mcp/cli/formatters.py

@@ -8,8 +8,11 @@ from typing import Any, TextIO
 def emit_text_result(result: dict[str, Any], *, hint: str, stream: TextIO) -> None:
     text = _format_cancelled_result(result)
     if text is None:
-        formatter = _FORMATTERS.get(hint, _format_generic)
-        text = formatter(result)
+        if _is_failed_result(result) and hint != "task_action_execute":
+            text = _format_failed_result(result)
+        else:
+            formatter = _FORMATTERS.get(hint, _format_generic)
+            text = formatter(result)
     stream.write(text)
     if not text.endswith("\n"):
         stream.write("\n")
@@ -21,6 +24,50 @@ def _format_cancelled_result(result: dict[str, Any]) -> str | None:
     return str(result.get("message") or "已取消") + "\n"
 
 
+def _is_failed_result(result: dict[str, Any]) -> bool:
+    if _is_executed_nonfatal_result(result):
+        return False
+    if result.get("ok") is False:
+        return True
+    return str(result.get("status") or "").lower() in {"failed", "blocked"}
+
+
+def _is_executed_nonfatal_result(result: dict[str, Any]) -> bool:
+    status = str(result.get("status") or "").lower()
+    executed = bool(
+        result.get("write_executed")
+        or result.get("delete_executed")
+        or result.get("action_executed")
+        or result.get("export_executed")
+    )
+    return executed and status in {"partial_success", "verification_failed", "running", "queued", "unknown"}
+
+
+def _format_failed_result(result: dict[str, Any]) -> str:
+    lines = [f"Status: {result.get('status') or 'failed'}"]
+    for key, label in (
+        ("error_code", "Error Code"),
+        ("message", "Message"),
+        ("backend_code", "Backend Code"),
+        ("request_id", "Request ID"),
+        ("http_status", "HTTP Status"),
+        ("category", "Category"),
+    ):
+        value = result.get(key)
+        if value not in (None, ""):
+            lines.append(f"{label}: {value}")
+
+    data = result.get("data") if isinstance(result.get("data"), dict) else {}
+    selection = data.get("selection") if isinstance(data.get("selection"), dict) else {}
+    if selection:
+        lines.append("Selection:")
+        lines.extend(f"- {line}" for line in _dict_scalar_lines(selection))
+
+    _append_warnings(lines, result.get("warnings"))
+    _append_verification(lines, result.get("verification"))
+    return "\n".join(lines) + "\n"
+
+
 def _format_generic(result: dict[str, Any]) -> str:
     lines: list[str] = []
     title = _first_present(result, "status", "message")
@@ -292,6 +339,147 @@ def _format_record_get(result: dict[str, Any]) -> str:
     return "\n".join(lines) + "\n"
 
 
+def _format_record_logs(result: dict[str, Any]) -> str:
+    app = result.get("app") if isinstance(result.get("app"), dict) else {}
+    view = result.get("view") if isinstance(result.get("view"), dict) else {}
+    record = result.get("record") if isinstance(result.get("record"), dict) else {}
+    data_logs = result.get("data_logs") if isinstance(result.get("data_logs"), dict) else {}
+    workflow_logs = result.get("workflow_logs") if isinstance(result.get("workflow_logs"), dict) else {}
+    integrity = result.get("context_integrity") if isinstance(result.get("context_integrity"), dict) else {}
+    lines = [
+        f"Status: {result.get('status') or '-'}",
+        f"App: {app.get('app_name') or app.get('app_key') or '-'} ({app.get('app_key') or '-'})",
+        f"View: {view.get('name') or view.get('view_id') or '-'}",
+        f"Record: {record.get('title') or '-'} ({record.get('record_id') or '-'})",
+        f"Data logs: {data_logs.get('status') or '-'} / count={data_logs.get('items_count')} / pages={data_logs.get('pages_fetched')} / complete={data_logs.get('complete')}",
+        f"Workflow logs: {workflow_logs.get('status') or '-'} / count={workflow_logs.get('items_count')} / pages={workflow_logs.get('pages_fetched')} / complete={workflow_logs.get('complete')}",
+        f"Safe for full log conclusion: {integrity.get('safe_for_full_log_conclusion')}",
+    ]
+    if result.get("local_dir"):
+        lines.append(f"Local dir: {result.get('local_dir')}")
+    if data_logs.get("local_path"):
+        lines.append(f"Data logs file: {data_logs.get('local_path')}")
+    if workflow_logs.get("local_path"):
+        lines.append(f"Workflow logs file: {workflow_logs.get('local_path')}")
+    if result.get("summary_path"):
+        lines.append(f"Summary file: {result.get('summary_path')}")
+    _append_warnings(lines, result.get("warnings"))
+    unavailable = result.get("unavailable_context") if isinstance(result.get("unavailable_context"), list) else []
+    if unavailable:
+        lines.append(f"Unavailable contexts: {len(unavailable)}")
+    return "\n".join(lines) + "\n"
+
+
+def _format_record_write(result: dict[str, Any]) -> str:
+    status = str(result.get("status") or "").strip().lower()
+    write_executed = bool(result.get("write_executed"))
+    verification_status = str(result.get("verification_status") or "").strip().lower()
+    if write_executed and verification_status == "failed":
+        title = "写入已提交（回读验证未完成）"
+    elif write_executed and status in {"success", "completed"}:
+        title = "写入成功"
+    elif status:
+        title = status
+    else:
+        title = "写入结果"
+
+    lines = [title]
+    if result.get("record_id") not in (None, ""):
+        lines.append(f"Record ID: {result.get('record_id')}")
+    if result.get("apply_id") not in (None, "") and result.get("apply_id") != result.get("record_id"):
+        lines.append(f"Apply ID: {result.get('apply_id')}")
+
+    update_route = result.get("update_route") if isinstance(result.get("update_route"), dict) else {}
+    route_name = update_route.get("route") or update_route.get("type") or update_route.get("label")
+    if route_name:
+        lines.append(f"Update Route: {route_name}")
+
+    if verification_status:
+        lines.append(f"Verification: {verification_status}")
+    if write_executed:
+        lines.append("Safe To Retry: false")
+
+    if write_executed and verification_status == "failed":
+        verification = result.get("data", {}).get("verification") if isinstance(result.get("data"), dict) else None
+        if isinstance(verification, dict):
+            warning_codes = [
+                str(item.get("code"))
+                for item in verification.get("warnings", [])
+                if isinstance(item, dict) and item.get("code")
+            ]
+            if warning_codes:
+                lines.append("Verification Note: " + ", ".join(warning_codes[:3]))
+        lines.append("说明：写请求已执行；当前结果只表示后置回读未能确认字段值，不等同于写入被拒绝。")
+
+    _append_warnings(lines, result.get("warnings"))
+    return "\n".join(lines) + "\n"
+
+
+def _format_record_delete(result: dict[str, Any]) -> str:
+    status = str(result.get("status") or "").strip().lower()
+    deleted_ids = [str(item) for item in result.get("deleted_ids", []) if item not in (None, "")]
+    failed_ids = [str(item) for item in result.get("failed_ids", []) if item not in (None, "")]
+    write_executed = bool(result.get("write_executed"))
+
+    if deleted_ids and failed_ids:
+        title = "删除部分完成"
+    elif deleted_ids:
+        title = "删除完成"
+    elif status == "failed" or result.get("ok") is False:
+        title = "删除未执行"
+    else:
+        title = "删除结果"
+
+    lines = [title]
+    lines.append(f"Deleted: {len(deleted_ids)}")
+    if deleted_ids:
+        lines.append("Deleted IDs: " + ", ".join(deleted_ids[:20]))
+    lines.append(f"Failed: {len(failed_ids)}")
+    if failed_ids:
+        lines.append("Failed IDs: " + ", ".join(failed_ids[:20]))
+    if write_executed:
+        lines.append("Safe To Retry: false")
+    elif result.get("safe_to_retry") is not None:
+        lines.append(f"Safe To Retry: {str(bool(result.get('safe_to_retry'))).lower()}")
+    _append_warnings(lines, result.get("warnings"))
+    return "\n".join(lines) + "\n"
+
+
+def _format_code_block_run(result: dict[str, Any]) -> str:
+    status = str(result.get("status") or "").strip().lower()
+    execution = result.get("execution") if isinstance(result.get("execution"), dict) else {}
+    writeback = result.get("writeback") if isinstance(result.get("writeback"), dict) else {}
+    executed = bool(execution.get("executed"))
+    writeback_applied = bool(writeback.get("applied"))
+    write_verified = writeback.get("write_verified")
+
+    if executed and writeback_applied and status == "verification_failed":
+        title = "代码块已执行，回写已提交（验证未完成）"
+    elif executed and writeback_applied:
+        title = "代码块已执行，回写成功"
+    elif executed:
+        title = "代码块已执行"
+    elif status:
+        title = status
+    else:
+        title = "代码块结果"
+
+    lines = [title]
+    if result.get("record_id") not in (None, ""):
+        lines.append(f"Record ID: {result.get('record_id')}")
+    code_block_field = result.get("code_block_field") if isinstance(result.get("code_block_field"), dict) else {}
+    if code_block_field.get("title"):
+        lines.append(f"Code Block Field: {code_block_field.get('title')}")
+    if execution:
+        lines.append(f"Result Count: {execution.get('result_count', 0)}")
+    if writeback:
+        lines.append(f"Writeback: attempted={writeback.get('attempted')} applied={writeback_applied} verified={write_verified}")
+    if executed and writeback_applied and status == "verification_failed":
+        lines.append("说明：代码块执行和回写请求已完成；当前结果只表示后置回读未能确认字段值，不等同于回写被拒绝。")
+    _append_warnings(lines, result.get("warnings"))
+    return "\n".join(lines) + "\n"
+
+
 def _format_task_list(result: dict[str, Any]) -> str:
     data = result.get("data") if isinstance(result.get("data"), dict) else {}
     items = data.get("items") if isinstance(data.get("items"), list) else []
@@ -494,6 +682,42 @@ def _format_import_verify(result: dict[str, Any]) -> str:
     return "\n".join(lines) + "\n"
 
 
+def _format_import_template(result: dict[str, Any]) -> str:
+    verification = result.get("verification") if isinstance(result.get("verification"), dict) else {}
+    template_source = verification.get("template_source")
+    if not template_source:
+        template_source = "official" if result.get("template_url") else ("local_generated" if result.get("downloaded_to_path") else "unknown")
+    if result.get("downloaded_to_path"):
+        title = "导入模板已生成" if template_source == "local_generated" else "导入模板已下载"
+    elif result.get("template_url"):
+        title = "导入模板已获取"
+    else:
+        title = "导入模板结果"
+
+    lines = [
+        title,
+        f"App Key: {result.get('app_key') or '-'}",
+        f"Template Source: {template_source}",
+    ]
+    if result.get("downloaded_to_path"):
+        lines.append(f"Local Path: {result.get('downloaded_to_path')}")
+    if result.get("template_url"):
+        lines.append(f"Template URL: {result.get('template_url')}")
+    import_capability = result.get("import_capability") if isinstance(result.get("import_capability"), dict) else {}
+    if import_capability:
+        lines.append(
+            "Import Capability: "
+            f"{import_capability.get('auth_source') or 'unknown'} / "
+            f"can_import={import_capability.get('can_import')}"
+        )
+    expected_columns = result.get("expected_columns") if isinstance(result.get("expected_columns"), list) else []
+    if expected_columns:
+        lines.append(f"Columns: {len(expected_columns)}")
+    _append_warnings(lines, result.get("warnings"))
+    _append_verification(lines, result.get("verification"))
+    return "\n".join(lines) + "\n"
+
+
 def _format_import_status(result: dict[str, Any]) -> str:
     lines = [
         f"Status: {result.get('status') or '-'}",
@@ -690,21 +914,23 @@ def _task_action_failure_label(action: str) -> str:
 
 
 def _task_action_partial_success_message(result: dict[str, Any]) -> str:
-    error_code = str(result.get("error_code") or "").strip().upper()
-    if error_code == "WORKFLOW_CONTINUATION_UNVERIFIED":
-        return "动作已提交，但暂未完成后续流程验证。可使用 --json 查看详细信息。"
-    if error_code == "TASK_ALREADY_PROCESSED":
-        return "当前待办已不可操作，系统判断流程可能已被其他人处理。可使用 --json 查看详细信息。"
     warnings = result.get("warnings")
     if isinstance(warnings, list):
         for warning in warnings:
             if not isinstance(warning, dict):
                 continue
             code = str(warning.get("code") or "").strip().upper()
+            if code == "TASK_ACTION_VERIFICATION_PERMISSION_UNAVAILABLE":
+                return "动作已提交；后置验证读取受当前权限限制，不能据此判断动作被拒绝。可使用 --json 查看详细信息。"
             if code == "TASK_ALREADY_PROCESSED_UNCONFIRMED_ACTOR":
                 return "当前待办已不可操作，系统判断流程可能已被其他人处理。可使用 --json 查看详细信息。"
             if code == "WORKFLOW_CONTINUATION_UNVERIFIED":
                 return "动作已提交，但暂未完成后续流程验证。可使用 --json 查看详细信息。"
+    error_code = str(result.get("error_code") or "").strip().upper()
+    if error_code == "WORKFLOW_CONTINUATION_UNVERIFIED":
+        return "动作已提交，但暂未完成后续流程验证。可使用 --json 查看详细信息。"
+    if error_code == "TASK_ALREADY_PROCESSED":
+        return "当前待办已不可操作，系统判断流程可能已被其他人处理。可使用 --json 查看详细信息。"
     return "动作已提交，但结果验证不完整。可使用 --json 查看详细信息。"
 
 
@@ -788,16 +1014,20 @@ _FORMATTERS = {
     "workspace_get": _format_workspace_get,
     "workspace_select": _format_workspace_select,
     "app_list": _format_app_items,
-    "app_search": _format_app_items,
     "app_get": _format_app_get,
     "record_list": _format_record_list,
     "record_access": _format_record_access,
     "record_get": _format_record_get,
+    "record_logs": _format_record_logs,
+    "record_write": _format_record_write,
+    "record_delete": _format_record_delete,
+    "code_block_run": _format_code_block_run,
     "task_list": _format_task_list,
     "task_workbench": _format_task_workbench,
     "task_get": _format_task_get,
     "task_action_execute": _format_task_action,
     "task_associated_report_detail_get": _format_task_associated_report_detail,
+    "import_template": _format_import_template,
     "import_verify": _format_import_verify,
     "import_status": _format_import_status,
     "export_start": _format_export_start,

package/src/qingflow_mcp/cli/main.py

@@ -5,7 +5,7 @@ import json
 import sys
 from typing import Any, Callable, TextIO
 
-from ..errors import QingflowApiError
+from ..errors import QingflowApiError, backend_code_value_int, message_looks_like_invalid_token
 from ..public_surface import cli_public_tool_spec_from_namespace
 from ..response_trim import resolve_cli_tool_name, trim_error_response, trim_public_response
 from ..tools.ai_builder_tools import _attach_builder_apply_envelope
@@ -323,6 +323,8 @@ def _emit_error(payload: dict[str, Any], *, json_mode: bool, stdout: TextIO, std
         f"Category: {payload.get('category') or 'error'}",
         f"Message: {payload.get('message') or 'Unknown error'}",
     ]
+    if payload.get("error_code"):
+        lines.append(f"Error Code: {payload.get('error_code')}")
     if payload.get("backend_code") is not None:
         lines.append(f"Backend Code: {payload.get('backend_code')}")
     if payload.get("request_id"):
@@ -337,23 +339,65 @@ def _emit_error(payload: dict[str, Any], *, json_mode: bool, stdout: TextIO, std
 
 
 def _error_exit_code(payload: dict[str, Any]) -> int:
-    category = str(payload.get("category") or "").lower()
-    if category in {"auth", "workspace"}:
+    if _is_auth_or_workspace_payload(payload):
         return 3
     return 4
 
 
+def _is_auth_or_workspace_payload(payload: dict[str, Any]) -> bool:
+    category = str(payload.get("category") or "").lower()
+    error_code = str(payload.get("error_code") or "").upper()
+    http_status = backend_code_value_int(payload.get("http_status"))
+    if category in {"auth", "workspace"} or error_code in {"AUTH_REQUIRED", "WORKSPACE_NOT_SELECTED"}:
+        return True
+    if http_status == 401 or message_looks_like_invalid_token(payload.get("message")):
+        return True
+    return False
+
+
 def _result_exit_code(result: dict[str, Any]) -> int:
     if not isinstance(result, dict):
         return 0
+    if _is_executed_nonfatal_result(result):
+        return 0
+    if _is_auth_or_workspace_payload(result):
+        return 3
     if result.get("ok") is False:
         return 4
     status = str(result.get("status") or "").lower()
+    if status == "partial_success" and result.get("ok") is not True and not _has_readback_unavailable_verification(result):
+        return 4
     if status in {"failed", "blocked"}:
         return 4
     return 0
 
 
+def _is_executed_nonfatal_result(result: dict[str, Any]) -> bool:
+    status = str(result.get("status") or "").lower()
+    executed = bool(
+        result.get("write_executed")
+        or result.get("delete_executed")
+        or result.get("action_executed")
+        or result.get("export_executed")
+    )
+    return executed and status in {"partial_success", "verification_failed", "running", "queued", "unknown"}
+
+
+def _has_readback_unavailable_verification(result: dict[str, Any]) -> bool:
+    verification = result.get("verification")
+    if not isinstance(verification, dict):
+        return False
+    return any(
+        bool(verification.get(key))
+        for key in (
+            "readback_unavailable",
+            "readback_pending",
+            "metadata_unverified",
+            "views_read_unavailable",
+        )
+    )
+
+
 def _emit_cli_effective_context_notice(args: argparse.Namespace, context: CliContext, *, stream: TextIO) -> None:
     spec = cli_public_tool_spec_from_namespace(args)
     if spec is None or not spec.cli_show_effective_context:

package/src/qingflow_mcp/errors.py

@@ -9,11 +9,24 @@ from .json_types import JSONObject, JSONScalar
 INVALID_TOKEN_MARKERS = (
     "invalid token",
     "token invalid",
+    "token expired",
+    "expired token",
     "token失效",
     "无效token",
     "登录失效",
+    "登录过期",
+    "会话过期",
+    "session expired",
+    "session invalid",
     "login token invalid",
     "access token invalid",
+    "not logged in",
+    "not login",
+    "please login",
+    "please log in",
+    "未登录",
+    "请登录",
+    "重新登录",
 )
 
 
@@ -36,8 +49,7 @@ class QingflowApiError(Exception):
         return self.as_json()
 
     def looks_like_invalid_token(self) -> bool:
-        text = self.message.lower()
-        return any(marker in text for marker in INVALID_TOKEN_MARKERS)
+        return message_looks_like_invalid_token(self.message)
 
     @classmethod
     def auth_required(cls, profile: str) -> "QingflowApiError":
@@ -64,3 +76,32 @@ class QingflowApiError(Exception):
 
 def raise_tool_error(error: QingflowApiError) -> None:
     raise RuntimeError(error.as_json())
+
+
+def backend_code_value_int(code: JSONScalar) -> int | None:
+    if isinstance(code, bool) or code is None:
+        return None
+    if isinstance(code, int):
+        return code
+    if isinstance(code, str):
+        text = code.strip()
+        if text:
+            try:
+                return int(text)
+            except ValueError:
+                return None
+    return None
+
+
+def backend_code_int(error: QingflowApiError) -> int | None:
+    return backend_code_value_int(error.backend_code)
+
+
+def message_looks_like_invalid_token(message: object) -> bool:
+    text = str(message or "").lower()
+    return any(marker in text for marker in INVALID_TOKEN_MARKERS)
+
+
+def is_auth_like_error(error: QingflowApiError) -> bool:
+    category = str(error.category or "").strip().lower()
+    return category == "auth" or error.http_status == 401 or error.looks_like_invalid_token()

package/src/qingflow_mcp/public_surface.py

@@ -38,7 +38,6 @@ USER_PUBLIC_TOOL_SPECS: tuple[PublicToolSpec, ...] = (
     PublicToolSpec(USER_DOMAIN, "workspace_get", ("workspace_get",), ("workspace", "get")),
     PublicToolSpec(USER_DOMAIN, "workspace_select", ("workspace_select",), ("workspace", "select")),
     PublicToolSpec(USER_DOMAIN, "app_list", ("app_list",), ("app", "list"), cli_show_effective_context=True),
-    PublicToolSpec(USER_DOMAIN, "app_search", ("app_search",), ("app", "search"), cli_show_effective_context=True),
     PublicToolSpec(USER_DOMAIN, "app_get", ("app_get",), ("app", "get"), cli_show_effective_context=True),
     PublicToolSpec(USER_DOMAIN, "portal_list", ("portal_list",), ("portal", "list"), cli_show_effective_context=True),
     PublicToolSpec(USER_DOMAIN, "portal_get", ("portal_get",), ("portal", "get"), cli_show_effective_context=True),
@@ -52,46 +51,52 @@ USER_PUBLIC_TOOL_SPECS: tuple[PublicToolSpec, ...] = (
         "record_schema_get",
         cli_route=("record", "schema", "applicant"),
         mcp_public=False,
+        cli_public=False,
     ),
     PublicToolSpec(
         USER_DOMAIN,
         "record_browse_schema_get",
         ("record_browse_schema_get_public",),
         ("record", "schema", "browse"),
+        cli_show_effective_context=True,
     ),
     PublicToolSpec(
         USER_DOMAIN,
         "record_insert_schema_get",
         ("record_insert_schema_get_public",),
         ("record", "schema", "insert"),
+        cli_show_effective_context=True,
     ),
     PublicToolSpec(
         USER_DOMAIN,
         "record_update_schema_get",
         ("record_update_schema_get_public",),
         ("record", "schema", "update"),
+        cli_show_effective_context=True,
     ),
-    PublicToolSpec(USER_DOMAIN, "record_import_schema_get", ("record_import_schema_get",), ("record", "schema", "import")),
+    PublicToolSpec(USER_DOMAIN, "record_import_schema_get", ("record_import_schema_get",), ("record", "schema", "import"), cli_show_effective_context=True),
     PublicToolSpec(
         USER_DOMAIN,
         "record_code_block_schema_get",
         ("record_code_block_schema_get_public",),
         ("record", "schema", "code-block"),
+        cli_show_effective_context=True,
     ),
-    PublicToolSpec(USER_DOMAIN, "record_member_candidates", ("record_member_candidates",), ("record", "member-candidates")),
-    PublicToolSpec(USER_DOMAIN, "record_department_candidates", ("record_department_candidates",), ("record", "department-candidates")),
-    PublicToolSpec(USER_DOMAIN, "record_analyze", ("record_analyze",), ("record", "analyze"), mcp_public=False),
+    PublicToolSpec(USER_DOMAIN, "record_member_candidates", ("record_member_candidates",), ("record", "member-candidates"), cli_show_effective_context=True),
+    PublicToolSpec(USER_DOMAIN, "record_department_candidates", ("record_department_candidates",), ("record", "department-candidates"), cli_show_effective_context=True),
+    PublicToolSpec(USER_DOMAIN, "record_analyze", ("record_analyze",), ("record", "analyze"), mcp_public=False, cli_public=False),
     PublicToolSpec(USER_DOMAIN, "record_list", ("record_list",), ("record", "list"), cli_show_effective_context=True),
     PublicToolSpec(USER_DOMAIN, "record_access", ("record_access",), ("record", "access"), cli_show_effective_context=True),
     PublicToolSpec(USER_DOMAIN, "record_get", ("record_get_public",), ("record", "get"), cli_show_effective_context=True),
+    PublicToolSpec(USER_DOMAIN, "record_logs_get", ("record_logs_get",), ("record", "logs"), cli_show_effective_context=True),
     PublicToolSpec(USER_DOMAIN, "record_insert", ("record_insert_public",), ("record", "insert"), cli_show_effective_context=True, cli_context_write=True),
     PublicToolSpec(USER_DOMAIN, "record_update", ("record_update_public",), ("record", "update"), cli_show_effective_context=True, cli_context_write=True),
     PublicToolSpec(USER_DOMAIN, "record_delete", ("record_delete_public",), ("record", "delete"), cli_show_effective_context=True, cli_context_write=True),
-    PublicToolSpec(USER_DOMAIN, "record_import_template_get", ("record_import_template_get",), ("import", "template")),
-    PublicToolSpec(USER_DOMAIN, "record_import_verify", ("record_import_verify",), ("import", "verify")),
+    PublicToolSpec(USER_DOMAIN, "record_import_template_get", ("record_import_template_get",), ("import", "template"), cli_show_effective_context=True),
+    PublicToolSpec(USER_DOMAIN, "record_import_verify", ("record_import_verify",), ("import", "verify"), cli_show_effective_context=True),
     PublicToolSpec(USER_DOMAIN, "record_import_repair_local", ("record_import_repair_local",), ("import", "repair")),
-    PublicToolSpec(USER_DOMAIN, "record_import_start", ("record_import_start",), ("import", "start")),
-    PublicToolSpec(USER_DOMAIN, "record_import_status_get", ("record_import_status_get",), ("import", "status")),
+    PublicToolSpec(USER_DOMAIN, "record_import_start", ("record_import_start",), ("import", "start"), cli_show_effective_context=True, cli_context_write=True),
+    PublicToolSpec(USER_DOMAIN, "record_import_status_get", ("record_import_status_get",), ("import", "status"), cli_show_effective_context=True),
     PublicToolSpec(USER_DOMAIN, "record_export_start", ("record_export_start",), ("export", "start"), cli_show_effective_context=True),
     PublicToolSpec(USER_DOMAIN, "record_export_status_get", ("record_export_status_get",), ("export", "status"), cli_show_effective_context=True),
     PublicToolSpec(USER_DOMAIN, "record_export_get", ("record_export_get",), ("export", "get"), cli_show_effective_context=True),
@@ -109,12 +114,12 @@ USER_PUBLIC_TOOL_SPECS: tuple[PublicToolSpec, ...] = (
     ),
     PublicToolSpec(USER_DOMAIN, "task_workflow_log_get", ("task_workflow_log_get",), ("task", "log"), cli_show_effective_context=True),
     PublicToolSpec(USER_DOMAIN, "directory_search", ("directory_search",), cli_public=False),
-    PublicToolSpec(USER_DOMAIN, "directory_list_internal_users", ("directory_list_internal_users",), cli_public=False),
-    PublicToolSpec(USER_DOMAIN, "directory_list_all_internal_users", ("directory_list_all_internal_users",), cli_public=False),
-    PublicToolSpec(USER_DOMAIN, "directory_list_internal_departments", ("directory_list_internal_departments",), cli_public=False),
-    PublicToolSpec(USER_DOMAIN, "directory_list_all_departments", ("directory_list_all_departments",), cli_public=False),
-    PublicToolSpec(USER_DOMAIN, "directory_list_sub_departments", ("directory_list_sub_departments",), cli_public=False),
-    PublicToolSpec(USER_DOMAIN, "directory_list_external_members", ("directory_list_external_members",), cli_public=False),
+    PublicToolSpec(USER_DOMAIN, "directory_list_internal_users", ("directory_list_internal_users",), mcp_public=False, cli_public=False),
+    PublicToolSpec(USER_DOMAIN, "directory_list_all_internal_users", ("directory_list_all_internal_users",), mcp_public=False, cli_public=False),
+    PublicToolSpec(USER_DOMAIN, "directory_list_internal_departments", ("directory_list_internal_departments",), mcp_public=False, cli_public=False),
+    PublicToolSpec(USER_DOMAIN, "directory_list_all_departments", ("directory_list_all_departments",), mcp_public=False, cli_public=False),
+    PublicToolSpec(USER_DOMAIN, "directory_list_sub_departments", ("directory_list_sub_departments",), mcp_public=False, cli_public=False),
+    PublicToolSpec(USER_DOMAIN, "directory_list_external_members", ("directory_list_external_members",), mcp_public=False, cli_public=False),
 )
 
 
@@ -127,6 +132,8 @@ BUILDER_PUBLIC_TOOL_SPECS: tuple[PublicToolSpec, ...] = (
     PublicToolSpec(BUILDER_DOMAIN, "file_upload_local", ("file_upload_local",), ("builder", "file", "upload-local"), has_contract=True, cli_show_effective_context=True, cli_context_write=True),
     PublicToolSpec(BUILDER_DOMAIN, "feedback_submit", ("feedback_submit",), ("builder", "feedback", "submit"), has_contract=True),
     PublicToolSpec(BUILDER_DOMAIN, "builder_tool_contract", ("builder_tool_contract",), ("builder", "contract"), has_contract=False),
+    PublicToolSpec(BUILDER_DOMAIN, "workspace_icon_catalog_get", ("workspace_icon_catalog_get",), ("builder", "icon", "catalog"), has_contract=True, cli_show_effective_context=True),
+    PublicToolSpec(BUILDER_DOMAIN, "package_list", ("package_list",), ("builder", "package", "list"), has_contract=True, cli_show_effective_context=True),
     PublicToolSpec(BUILDER_DOMAIN, "package_get", ("package_get",), ("builder", "package", "get"), has_contract=True, cli_show_effective_context=True),
     PublicToolSpec(BUILDER_DOMAIN, "package_apply", ("package_apply",), ("builder", "package", "apply"), has_contract=True, cli_show_effective_context=True, cli_context_write=True),
     PublicToolSpec(BUILDER_DOMAIN, "solution_install", ("solution_install",), ("builder", "solution", "install"), has_contract=True, cli_show_effective_context=True, cli_context_write=True),
@@ -155,7 +162,7 @@ BUILDER_PUBLIC_TOOL_SPECS: tuple[PublicToolSpec, ...] = (
     PublicToolSpec(BUILDER_DOMAIN, "app_views_apply", ("app_views_apply",), ("builder", "views", "apply"), has_contract=True, cli_show_effective_context=True, cli_context_write=True),
     PublicToolSpec(BUILDER_DOMAIN, "app_charts_apply", ("app_charts_apply",), ("builder", "charts", "apply"), has_contract=True, cli_show_effective_context=True, cli_context_write=True),
     PublicToolSpec(BUILDER_DOMAIN, "portal_apply", ("portal_apply",), ("builder", "portal", "apply"), has_contract=True, cli_show_effective_context=True, cli_context_write=True),
-    PublicToolSpec(BUILDER_DOMAIN, "app_publish_verify", ("app_publish_verify",), ("builder", "publish", "verify"), has_contract=True, cli_show_effective_context=True),
+    PublicToolSpec(BUILDER_DOMAIN, "app_publish_verify", ("app_publish_verify",), ("builder", "publish", "verify"), has_contract=True, cli_show_effective_context=True, cli_context_write=True),
 )
 
 
@@ -233,6 +240,7 @@ def cli_route_from_namespace(args: Namespace) -> tuple[str, ...] | None:
     builder_command = getattr(args, "builder_command", None)
     if not isinstance(builder_command, str) or not builder_command:
         return None
+    builder_command = "associated-resource" if builder_command == "associated-resources" else builder_command
     if builder_command == "contract":
         return ("builder", "contract")
     if builder_command == "app":