@qingflow-tech/qingflow-cli 1.1.41 → 1.1.43-beta.1

package/src/qingflow_mcp/server_app_builder.py

@@ -37,14 +37,14 @@ def build_builder_server() -> FastMCP:
             "Use solution_install when the user explicitly wants to install a packaged solution/template by solution_key, optionally copying bundled demo data. "
             "Use package_list to find visible app packages by keyword and package_get to read package detail before editing; if creating or updating an app package may be appropriate, use package_apply with explicit user intent; otherwise use app_resolve to locate app resources, "
             "Use workspace_icon_catalog_get before creating app packages, apps, or portals when supported icon/color candidates are needed; new workspace resources require explicit non-template icon + color, and the CLI validates choices without inferring business defaults. "
-            "app_get as the default app map read, then app_get_fields/app_repair_code_blocks/app_get_layout/app_get_views/app_get_flow/app_get_charts/portal_list/portal_get/view_get/chart_get for focused configuration reads, "
+            "app_form_schema plus app_form_get for versioned form work, using being_draft=true only for editing and the published default for relation or record consumers; use app_get as the default non-form app map read, then app_get_fields/app_repair_code_blocks/app_get_layout/app_get_views/app_get_flow/app_get_charts/portal_list/portal_get/view_get/chart_get for focused compatibility or non-form reads, "
             "member_search/role_search/role_create when workflow assignees must come from the directory or role catalog, preferring roles over explicit members unless the user explicitly names members, "
-            "then app_schema_apply/app_layout_apply/app_flow_apply/app_views_apply/app_associated_resources_apply/app_charts_apply/portal_apply/portal_delete to execute normalized patches; app_custom_buttons_apply is maintenance-only for explicit standalone button work outside normal view design. These apply/delete tools perform basic validation, normalization, writes, and readback verification where applicable. Schema/layout/views noop requests skip publish, app_custom_buttons_apply and app_associated_resources_apply publish after at least one write succeeds and expose no draft-only parameter, charts are immediate-live without publish and resolve targets by chart_id first then exact unique chart name, portal updates use replace semantics only when sections are supplied and edit-mode base-info-only updates may omit sections, portal delete separates DELETE execution from readback verification, portal pc layout is a 24-column grid and mobile is a 6-column grid so omit position or use layout_preset when unsure, publish=false only guarantees draft/base-info updates for tools that still expose that parameter, and flow should use publish=false whenever you only want draft/precheck behavior. "
+            "then app_form_apply for complete app form targets, explicit app_delete for application deletion, and app_flow_apply/app_views_apply/app_associated_resources_apply/app_charts_apply/portal_apply/portal_delete for non-form patches. app_custom_buttons_apply is maintenance-only for explicit standalone button work outside normal view design. These apply/delete tools perform validation, normalization, writes, and readback verification where applicable. AppForm publishes only after a draft change or when the published form lags behind; views noop requests skip publish, app_custom_buttons_apply and app_associated_resources_apply publish after at least one write succeeds and expose no draft-only parameter, charts are immediate-live without publish and resolve targets by chart_id first then exact unique chart name, portal updates use replace semantics only when sections are supplied and edit-mode base-info-only updates may omit sections, portal delete separates DELETE execution from readback verification, portal pc layout is a 24-column grid and mobile is a 6-column grid so omit position or use layout_preset when unsure, publish=false only guarantees draft/base-info updates for tools that still expose that parameter, and flow should use publish=false whenever you only want draft/precheck behavior. "
             "Builder apply/write outputs include schema_version, operation, summary, and resources[]; use resources[].id/key/name/ids/parent as the stable UI and agent display entry, and keep legacy fields such as field_diff/views_diff/chart_results only for compatibility or troubleshooting. "
             "For existing object parameter replacement, prefer patch_views, patch_buttons, patch_resources, and patch_charts with set/unset; the tool reads current config and full-saves internally, while upsert_* is for creation or full target configuration and should not be used as an incomplete partial update. "
             "For builder delete/remove apply results, separate delete execution from readback verification: after DELETE is sent, resources expose delete_executed, readback_status, and safe_to_retry_delete=false. If readback_status is unavailable or still_exists, do not blindly repeat the delete; confirm later with app_get/view_get/chart_get or the relevant apply readback. Views/buttons use single-item readback; associated resources use one app-level resource-pool readback because there is no confirmed single-item GET. "
             "For builder write/apply results, separate write execution from final readback verification: status=partial_success with write_executed=true and safe_to_retry=false means the write was sent or succeeded, while final readback, publish verification, or metadata confirmation is pending or permission-restricted. Report it as written but unverified; do not repeat the same write blindly. "
-            "For app_schema_apply, configure data title and data cover directly in field JSON with as_data_title=true and as_data_cover=true; data title is required and exactly one field may be marked, while data cover is optional and must be a top-level attachment field. For multi-app creation, pass apps[]/--apps-file on app_schema_apply; each item may have client_key, and relation fields may use target_app_ref to point at another same-call client_key. "
+            "For app_form_apply, pin the version from app_form_schema, validate the JSON declaration with the qingflow-app-form Skill command, preserve the complete body and existing IDs from a draft get, and use dataTitle/dataCover on canonical fields; exactly one top-level dataTitle is required for a non-empty body, while dataCover is optional and must be a top-level attachment field. A root appKey means update and may include packageId; no appKey means create and requires packageId plus spec.appName, spec.icon, and spec.color selected from workspace_icon_catalog_get, with template forbidden. "
             "For app_views_apply, keep fixed saved filters in filters and configure the frontend query panel separately with query_conditions; query_conditions.rows is a matrix of field names compiled to backend queryCondition queIds. New views default associated report/view display to visible with limit_type=all; existing views preserve their current associated display unless associated_resources is explicitly patched. View writes use ViewManagementAuth (beingViewManageStatus), falling back to DataManageAuth when advanced app permissions are not enabled. "
             "For ordinary business buttons, declare them on the target view with app_views_apply.views[].action_buttons; app_views_apply writes the view first, then creates/binds the button. Use app_custom_buttons_apply only when the user explicitly asks to maintain existing standalone buttons outside view design, such as custom style/icon changes, cross-view reuse, deleting button bodies, bulk binding reorder, or exact qRobot/wings config. Button body writes require EditAppAuth; view_configs placement writes require ViewManagementAuth, matching the backend viewConfig route. For addData buttons, prefer action_buttons.target_app_key + field_mappings/default_values on the view path; do not ask agents to write raw que_relation unless maintaining a legacy config. field_mappings.source_field accepts source schema fields and supported system fields: 数据ID/row_record_id/apply_id/_id means current record id (-17), 编号/record_number means visible record number (0). To fill a target relation with the current record, map {'source_field': '数据ID', 'target_field': '目标引用字段'}; default_values is only for static constants. View button bindings merge by default; standalone view_configs are only for explicit maintenance. Builder view_key arguments are raw keys from app_get.views[].view_key and must not be prefixed with custom:. "
             "For BI reports, keep report-body development separate from Qingflow in-app display: use app_charts_apply to create, update, remove, or reorder app-source QingBI chart bodies/configs with dataSourceType=qingflow; chart dimension/metric/filter/query fields must come from app_get_fields.chart_fields, not record schema or form-only fields; dataset BI reports are not created or edited by app_charts_apply yet and should be created in QingBI first, then attached with app_associated_resources_apply using report_source=dataset. "
@@ -180,6 +180,41 @@ def build_builder_server() -> FastMCP:
     def builder_tool_contract(tool_name: str = "") -> dict:
         return ai_builder.builder_tool_contract(tool_name=tool_name)
 
+    @server.tool()
+    def app_form_schema(
+        schema_version: str | None = None,
+        field_type: str | None = None,
+    ) -> dict:
+        return ai_builder.app_form_schema(schema_version=schema_version, field_type=field_type)
+
+    @server.tool()
+    def app_form_get(
+        profile: str = DEFAULT_PROFILE,
+        app_key: str = "",
+        schema_version: str | None = None,
+        being_draft: bool = False,
+    ) -> dict:
+        return ai_builder.app_form_get(
+            profile=profile,
+            app_key=app_key,
+            schema_version=schema_version,
+            being_draft=being_draft,
+        )
+
+    @server.tool()
+    def app_form_apply(
+        profile: str = DEFAULT_PROFILE,
+        spec: dict | None = None,
+    ) -> dict:
+        return ai_builder.app_form_apply(profile=profile, spec=spec or {})
+
+    @server.tool(description=ai_builder._high_risk_tool_description(operation="delete", target="app configuration"))
+    def app_delete(
+        profile: str = DEFAULT_PROFILE,
+        app_key: str = "",
+    ) -> dict:
+        return ai_builder.app_delete(profile=profile, app_key=app_key)
+
     @server.tool()
     def workspace_icon_catalog_get(profile: str = DEFAULT_PROFILE) -> dict:
         return ai_builder.workspace_icon_catalog_get(profile=profile)
@@ -414,89 +449,6 @@ def build_builder_server() -> FastMCP:
     def chart_get(profile: str = DEFAULT_PROFILE, chart_id: str = "") -> dict:
         return ai_builder.chart_get(profile=profile, chart_id=chart_id)
 
-    @server.tool()
-    def app_schema_apply(
-        profile: str = DEFAULT_PROFILE,
-        app_key: str = "",
-        package_id: int | None = None,
-        app_name: str = "",
-        app_title: str = "",
-        icon: str = "",
-        color: str = "",
-        visibility: dict | None = None,
-        publish: bool = True,
-        form: list[dict] | None = None,
-        add_fields: list[dict] | None = None,
-        update_fields: list[dict] | None = None,
-        remove_fields: list[dict] | None = None,
-        apps: list[dict] | None = None,
-    ) -> dict:
-        if apps:
-            if app_key or app_name or app_title or form or add_fields or update_fields or remove_fields:
-                return _config_failure(
-                    "app_schema_apply multi-app mode accepts package_id plus apps only.",
-                    fix_hint="Use apps[].form for batch mode, or use the single-app arguments without apps.",
-                )
-            if package_id is None:
-                return _config_failure(
-                    "app_schema_apply multi-app mode requires package_id.",
-                    fix_hint="Pass `package_id` and `apps[].app_name` for new apps, or `apps[].app_key` for existing apps.",
-                )
-            return ai_builder.app_schema_apply(
-                profile=profile,
-                package_id=package_id,
-                visibility=visibility,
-                publish=publish,
-                form=None,
-                add_fields=[],
-                update_fields=[],
-                remove_fields=[],
-                apps=apps,
-            )
-        has_app_key = bool((app_key or "").strip())
-        has_app_name = bool((app_name or "").strip())
-        has_app_title = bool((app_title or "").strip())
-        has_package_id = package_id is not None
-        create_by_shape = has_package_id and (has_app_name or has_app_title)
-        if has_app_key:
-            if has_package_id:
-                return _config_failure(
-                    "app_schema_apply edit mode accepts app_key and optional app_name rename only.",
-                    fix_hint="For existing apps, use `app_key` and optionally `app_name`. For create mode, use `package_id + app_name`.",
-                )
-        elif not create_by_shape:
-            return _config_failure(
-                "app_schema_apply create mode requires package_id and app_name.",
-                fix_hint="Use `app_key` for existing apps, or pass `package_id + app_name` to create a new app.",
-            )
-        return ai_builder.app_schema_apply(
-            profile=profile,
-            app_key=app_key,
-            package_id=package_id,
-            app_name=app_name,
-            app_title=app_title,
-            icon=icon,
-            color=color,
-            visibility=visibility,
-            publish=publish,
-            form=form or [],
-            add_fields=add_fields or [],
-            update_fields=update_fields or [],
-            remove_fields=remove_fields or [],
-            apps=None,
-        )
-
-    @server.tool()
-    def app_layout_apply(
-        profile: str = DEFAULT_PROFILE,
-        app_key: str = "",
-        mode: str = "merge",
-        publish: bool = True,
-        sections: list[dict] | None = None,
-        apps: list[dict] | None = None,
-    ) -> dict:
-        return ai_builder.app_layout_apply(profile=profile, app_key=app_key, mode=mode, publish=publish, sections=sections or [], apps=apps)
-
     @server.tool()
     def app_flow_get(
         profile: str = DEFAULT_PROFILE,

package/src/qingflow_mcp/server_app_user.py

@@ -22,11 +22,12 @@ from .tools.task_context_tools import TaskContextTools
 from .tools.workspace_tools import WorkspaceTools
 
 
-def build_user_server() -> FastMCP:
+def build_user_server(*, stateless_http: bool = False) -> FastMCP:
     today = date.today()
     current_year = today.year
     server = FastMCP(
         "Qingflow App User MCP",
+        stateless_http=stateless_http,
         instructions=f"""Use this server for Qingflow operational workflows. Current date: `{today.isoformat()}`.
 
 ## App Discovery

package/src/qingflow_mcp/server_cloud.py

@@ -10,7 +10,13 @@ from mcp.server.fastmcp import FastMCP
 
 from .backend_client import BackendClient
 from .cloud_auth import CloudAuthBroker
-from .cloud_context import current_cloud_context
+from .cloud_context import CloudMcpContext, current_call_platform, current_cloud_context
+from .cloud_oauth_proxy import (
+    CloudOAuthProxyConfig,
+    OAuthAccessTokenResolver,
+    OAuthProxyResponse,
+    OAuthServiceProxy,
+)
 from .config import get_cloud_http_allowed_hosts, get_cloud_http_host, get_cloud_http_port
 from .errors import QingflowApiError, is_auth_like_error
 from .server_app_builder import build_builder_server
@@ -18,6 +24,7 @@ from .server_app_user import build_user_server
 
 
 BUILDER_TOOL_PREFIX = "builder_"
+MAX_OAUTH_PROXY_BODY_BYTES = 64 * 1024
 
 
 ASGIApp = Callable[
@@ -36,11 +43,15 @@ class CloudMcpAuthApp:
         app: ASGIApp,
         broker: CloudAuthBroker,
         *,
+        oauth_proxy: OAuthServiceProxy | None = None,
+        oauth_token_resolver: OAuthAccessTokenResolver | None = None,
         allowed_hosts: list[str] | None = None,
         internal_host: str | None = None,
     ) -> None:
         self._app = app
         self._broker = broker
+        self._oauth_proxy = oauth_proxy
+        self._oauth_token_resolver = oauth_token_resolver
         self._allowed_hosts = [
             host.strip().lower()
             for host in (allowed_hosts if allowed_hosts is not None else get_cloud_http_allowed_hosts())
@@ -69,22 +80,52 @@ class CloudMcpAuthApp:
             await self._json_response(send, 200, {"status": "ok"})
             return
 
-        credential = self._extract_credential(scope)
-        if credential is None:
-            await self._json_response(
-                send,
-                401,
-                {
-                    "error": "missing_mcp_credential",
-                    "message": "Authorization: Bearer <mcp_credential> is required",
-                },
-            )
+        if self._oauth_proxy is not None:
+            backend_metadata_path = self._oauth_proxy.config.backend_metadata_path(path)
+            if backend_metadata_path is not None:
+                await self._proxy_oauth_metadata(
+                    scope,
+                    send,
+                    backend_metadata_path,
+                )
+                return
+            backend_oauth_path = self._oauth_proxy.config.backend_oauth_endpoint_path(path)
+            if backend_oauth_path is not None:
+                await self._proxy_oauth_endpoint(
+                    scope,
+                    receive,
+                    send,
+                    backend_oauth_path,
+                )
+                return
+
+        auth_value, explicit_credential, call_platform = self._extract_auth_value(scope)
+        if auth_value is None:
+            await self._authentication_required(send)
             return
 
+        use_oauth = (
+            not explicit_credential
+            and self._oauth_token_resolver is not None
+            and not auth_value.startswith("mcp_")
+        )
         try:
-            cloud_context = await anyio.to_thread.run_sync(self._broker.resolve, credential)
+            if use_oauth:
+                assert self._oauth_token_resolver is not None
+                cloud_context = await anyio.to_thread.run_sync(
+                    self._resolve_oauth_or_legacy_credential,
+                    auth_value,
+                )
+            else:
+                cloud_context = await anyio.to_thread.run_sync(
+                    self._broker.resolve,
+                    auth_value,
+                )
         except QingflowApiError as error:
             status = 401 if is_auth_like_error(error) else 500
+            if status == 401 and use_oauth:
+                await self._oauth_authentication_required(send, "invalid_token", error.message)
+                return
             await self._json_response(
                 send,
                 status,
@@ -97,30 +138,158 @@ class CloudMcpAuthApp:
             )
             return
 
-        token = current_cloud_context.set(cloud_context)
+        if not call_platform:
+            call_platform = await anyio.to_thread.run_sync(
+                self._broker.resolve_call_platform,
+                cloud_context.token,
+            )
+
+        context_token = current_cloud_context.set(cloud_context)
+        call_platform_token = current_call_platform.set(call_platform)
         try:
             scope = _ensure_streamable_http_accept(scope)
             await self._app(scope, receive, send)
         finally:
-            current_cloud_context.reset(token)
+            current_call_platform.reset(call_platform_token)
+            current_cloud_context.reset(context_token)
 
-    def _extract_credential(self, scope: dict[str, Any]) -> str | None:
+    def _resolve_oauth_or_legacy_credential(self, auth_value: str) -> CloudMcpContext:
+        assert self._oauth_token_resolver is not None
+        try:
+            return self._oauth_token_resolver.resolve(auth_value)
+        except QingflowApiError as oauth_error:
+            if not is_auth_like_error(oauth_error):
+                raise
+            try:
+                return self._broker.resolve(auth_value)
+            except QingflowApiError:
+                raise oauth_error
+
+    def _extract_auth_value(self, scope: dict[str, Any]) -> tuple[str | None, bool, str]:
         headers = {
             key.decode("latin1").lower(): value.decode("latin1")
             for key, value in scope.get("headers", [])
         }
+        call_platform = headers.get("x-qf-callplatform", "").strip()
         authorization = headers.get("authorization", "")
         if authorization.lower().startswith("bearer "):
-            credential = authorization[7:].strip()
-            return credential or None
+            bearer_token = authorization[7:].strip()
+            return bearer_token or None, False, call_platform
         credential = headers.get("x-qingflow-client-id", "").strip()
-        return credential or None
+        return credential or None, True, call_platform
+
+    async def _authentication_required(
+        self,
+        send: Callable[[dict[str, Any]], Awaitable[None]],
+    ) -> None:
+        if self._oauth_proxy is not None:
+            await self._oauth_authentication_required(
+                send,
+                "invalid_token",
+                "Authentication required",
+            )
+            return
+        await self._json_response(
+            send,
+            401,
+            {
+                "error": "missing_mcp_credential",
+                "message": "Authorization: Bearer <mcp_credential> is required",
+            },
+        )
+
+    async def _oauth_authentication_required(
+        self,
+        send: Callable[[dict[str, Any]], Awaitable[None]],
+        error: str,
+        description: str,
+    ) -> None:
+        assert self._oauth_proxy is not None
+        challenge = (
+            'Bearer realm="OAuth", '
+            f'error="{_escape_auth_param(error)}", '
+            f'error_description="{_escape_auth_param(description)}", '
+            f'resource_metadata="{self._oauth_proxy.config.resource_metadata_url}"'
+        )
+        await self._json_response(
+            send,
+            401,
+            {"error": error, "error_description": description},
+            extra_headers=[
+                (b"www-authenticate", challenge.encode("latin1", errors="replace")),
+                (b"cache-control", b"no-store"),
+                (b"pragma", b"no-cache"),
+            ],
+        )
+
+    async def _proxy_oauth_metadata(
+        self,
+        scope: dict[str, Any],
+        send: Callable[[dict[str, Any]], Awaitable[None]],
+        backend_path: str,
+    ) -> None:
+        assert self._oauth_proxy is not None
+        try:
+            response = await anyio.to_thread.run_sync(
+                self._oauth_proxy.request_metadata,
+                str(scope.get("method") or "GET"),
+                backend_path,
+                bytes(scope.get("query_string") or b""),
+            )
+        except QingflowApiError as error:
+            await self._json_response(
+                send,
+                502,
+                {"error": "oauth_service_unavailable", "message": error.message},
+            )
+            return
+        await self._raw_response(send, response)
+
+    async def _proxy_oauth_endpoint(
+        self,
+        scope: dict[str, Any],
+        receive: Callable[[], Awaitable[dict[str, Any]]],
+        send: Callable[[dict[str, Any]], Awaitable[None]],
+        backend_path: str,
+    ) -> None:
+        assert self._oauth_proxy is not None
+        try:
+            body = await _read_request_body(receive, MAX_OAUTH_PROXY_BODY_BYTES)
+        except ValueError:
+            await self._json_response(
+                send,
+                413,
+                {
+                    "error": "invalid_request",
+                    "error_description": "OAuth request body is too large",
+                },
+            )
+            return
+        try:
+            response = await anyio.to_thread.run_sync(
+                self._oauth_proxy.request_oauth_endpoint,
+                str(scope.get("method") or "GET"),
+                backend_path,
+                bytes(scope.get("query_string") or b""),
+                body,
+                tuple(scope.get("headers") or ()),
+            )
+        except QingflowApiError as error:
+            await self._json_response(
+                send,
+                502,
+                {"error": "oauth_service_unavailable", "message": error.message},
+            )
+            return
+        await self._raw_response(send, response)
 
     async def _json_response(
         self,
         send: Callable[[dict[str, Any]], Awaitable[None]],
         status: int,
         payload: dict[str, Any],
+        *,
+        extra_headers: list[tuple[bytes, bytes]] | None = None,
     ) -> None:
         body = json.dumps(payload, ensure_ascii=False).encode("utf-8")
         await send(
@@ -130,11 +299,26 @@ class CloudMcpAuthApp:
                 "headers": [
                     (b"content-type", b"application/json; charset=utf-8"),
                     (b"content-length", str(len(body)).encode("ascii")),
-                ],
+                ] + list(extra_headers or []),
             }
         )
         await send({"type": "http.response.body", "body": body})
 
+    async def _raw_response(
+        self,
+        send: Callable[[dict[str, Any]], Awaitable[None]],
+        response: OAuthProxyResponse,
+    ) -> None:
+        await send(
+            {
+                "type": "http.response.start",
+                "status": response.status_code,
+                "headers": list(response.headers)
+                + [(b"content-length", str(len(response.body)).encode("ascii"))],
+            }
+        )
+        await send({"type": "http.response.body", "body": response.body})
+
     async def _plain_response(
         self,
         send: Callable[[dict[str, Any]], Awaitable[None]],
@@ -176,12 +360,25 @@ def build_cloud_user_app() -> CloudMcpAuthApp:
 
 def build_cloud_app() -> CloudMcpAuthApp:
     server = build_combined_server()
-    broker = CloudAuthBroker.from_config(backend=BackendClient())
-    return CloudMcpAuthApp(server.streamable_http_app(), broker)
+    backend = BackendClient()
+    broker = CloudAuthBroker.from_config(backend=backend)
+    oauth_config = CloudOAuthProxyConfig.from_config()
+    oauth_proxy = OAuthServiceProxy(oauth_config) if oauth_config is not None else None
+    oauth_token_resolver = (
+        OAuthAccessTokenResolver.from_config(backend)
+        if oauth_config is not None
+        else None
+    )
+    return CloudMcpAuthApp(
+        server.streamable_http_app(),
+        broker,
+        oauth_proxy=oauth_proxy,
+        oauth_token_resolver=oauth_token_resolver,
+    )
 
 
 def build_combined_server() -> FastMCP:
-    server = build_user_server()
+    server = build_user_server(stateless_http=True)
     builder_server = build_builder_server()
     server._mcp_server.name = "Qingflow Combined MCP"
     _register_prefixed_builder_tools(server, builder_server)
@@ -237,6 +434,22 @@ def _extract_host(scope: dict[str, Any]) -> str:
     return ""
 
 
+async def _read_request_body(
+    receive: Callable[[], Awaitable[dict[str, Any]]],
+    limit: int,
+) -> bytes:
+    body = bytearray()
+    while True:
+        message = await receive()
+        if message.get("type") != "http.request":
+            return bytes(body)
+        body.extend(bytes(message.get("body") or b""))
+        if len(body) > limit:
+            raise ValueError("request body is too large")
+        if not message.get("more_body", False):
+            return bytes(body)
+
+
 def _is_allowed_host(host: str, allowed_hosts: list[str]) -> bool:
     normalized_host = host.strip().lower().rstrip(".")
     host_without_port = _strip_port(normalized_host)
@@ -308,6 +521,16 @@ def _ensure_streamable_http_accept(scope: dict[str, Any]) -> dict[str, Any]:
     return rewritten
 
 
+def _escape_auth_param(value: str) -> str:
+    return (
+        str(value or "")
+        .replace("\\", "\\\\")
+        .replace('"', '\\"')
+        .replace("\r", " ")
+        .replace("\n", " ")
+    )
+
+
 app = LazyCloudApp()