@qingflow-tech/qingflow-cli 1.1.46 → 1.1.47-beta.1

package/README.md

@@ -7,7 +7,7 @@ Qingflow CLI 是轻流面向开发者和 AI Agent 的命令行工具。它把轻
 ## 安装
 
 ```bash
-npm install @qingflow-tech/qingflow-cli@1.1.46
+npm install @qingflow-tech/qingflow-cli@1.1.47-beta.1
 ```
 
 推荐从官网复制这一条一键安装 Qingflow CLI：
@@ -21,7 +21,7 @@ npx qingflow-cli@latest install
 ## 运行
 
 ```bash
-npx -y -p @qingflow-tech/qingflow-cli@1.1.46 qingflow
+npx -y -p @qingflow-tech/qingflow-cli@1.1.47-beta.1 qingflow
 ```
 
 全局安装后可以直接运行：
@@ -62,7 +62,7 @@ qingflow-skills install --agent codex --scope user
 如果你通过一次性 `npx -p` 执行 skills 安装，建议加 `--copy`，避免 symlink 指向 npm 临时执行缓存：
 
 ```bash
-npx -y -p @qingflow-tech/qingflow-cli@1.1.46 qingflow-skills install --agent codex --scope user --copy
+npx -y -p @qingflow-tech/qingflow-cli@1.1.47-beta.1 qingflow-skills install --agent codex --scope user --copy
 ```
 
 `qingflow-skills install` 默认使用 symlink，且遇到同名 skill 不会覆盖；只有显式传入 `--force` 才会替换。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qingflow-tech/qingflow-cli",
-  "version": "1.1.46",
+  "version": "1.1.47-beta.1",
   "description": "Human-friendly Qingflow command line interface for auth, record operations, import, tasks, and stable builder flows.",
   "license": "MIT",
   "type": "module",

package/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "qingflow-mcp"
-version = "1.1.46"
+version = "1.1.47b1"
 description = "User-authenticated MCP server for Qingflow"
 readme = "README.md"
 license = "MIT"

package/skills/qingflow-cli/SKILL.md

@@ -439,14 +439,28 @@ qingflow auth logout --forget-persisted
 
 | 分组 | 骨架（细则见上文章节 + 「关联文件」） |
 | ---- | ------------------------------------ |
-| **auth** | `auth whoami` · `auth use-credential --base-url "$QINGFLOW_BASE_URL" --credential-stdin --persist` · `auth login …`（见「失败恢复时的认证方式」）· `auth logout --forget-persisted` |
+| **auth** | `auth whoami` · `auth use-credential --base-url "$QINGFLOW_BASE_URL" --credential-stdin --persist` · `auth login …`（见「失败恢复时的认证方式」）· `auth login-link [--redirect-path PATH]`（临时网页登录链接）· `auth logout --forget-persisted` |
 | **workspace** | `workspace list` · `workspace get --ws-id` · `workspace select`（慎用，可读数前不必；可能 **59004**） |
 | **app / portal / view / chart** | `app list [--query 关键词]` → **`app get --app-key`**（`accessible_views` / `view_id`、`import_capability`）· `builder package list [--query 关键词]` → `builder package get --package-id` · `portal list` · `portal get --dash-key` · `view get --view-id`（只读视图元信息；`baseInfo` 或 `viewConfig` 只有 40002 / 40027 / 404 这类权限/缺失边界可用另一侧降级，非权限类后端错误不隐藏；解析 app 仅依赖同源 view/form 与可见应用树，不回退旧应用搜索）· `chart get --chart-id`（图表 `baseInfo` / 数据 / 配置分阶段读取；单个辅助阶段 40002 / 40027 / 404 只作为 warning，非权限类后端错误不隐藏） |
 | **record** | `record schema insert`（新建记录 insert-ready schema，仅 `--app-key`）· **`browse`/`list`/`access`：`--app-key` + `--view-id`（缺一常 CONFIG）** · `record list --query ... [--query-field FIELD_ID] [--page-size N]` 用于候选定位/样本浏览 · `record get --record-id` 读详情页首屏上下文 · `record logs --record-id` 读完整数据/流程日志 JSONL · `record insert --items-file`（单条也是 items 一行）· `schema update --record-id [--view-id]` / **`update`**（单条 `--fields-file` **或** 批量 `--items-file`/`--dry-run`，二者勿混）· `record delete --app-key --record-id --view-id system:*` / `--record-ids-file` · `export start/direct --view-id` 仅用于明确导出文件 · **大 schema**：先 **[FIELD_DATA_TYPES](./reference/core/QINGFLOW_CLI_FIELD_DATA_TYPES.md)** / **[RECORD_CREATE](./reference/record/QINGFLOW_CLI_RECORD_CREATE_WORKFLOW.md)** / **[RECORD_UPDATE](./reference/record/QINGFLOW_CLI_RECORD_UPDATE_WORKFLOW.md)** / **[RECORD_DELETE](./reference/record/QINGFLOW_CLI_RECORD_DELETE_WORKFLOW.md)**，再 `-h` |
 | **import** | `record schema import?` · `import template` → `verify` → `repair?` → `start`（**`being-enter-auditing` 必填**）→ `status`（**三者 selector 只选一**）；导入权限预检的 `baseInfo` 只有 40002 / 40027 / 404 可降级为 unknown，非权限错误不能当成无导入权或继续执行；**链路与本机目录**只靠本节不够 → **[RECORD_IMPORT](./reference/record/QINGFLOW_CLI_RECORD_IMPORT_WORKFLOW.md)** |
-| **builder** | **搭建／系统化配置**：先按 **[INDEX](./reference/00-INDEX.md)** / **[BUILDER](./reference/builder/README.md)** 选主路径，再读 `builder contract`。**完整系统/应用包**：`builder package apply --config-file` → 每个应用依次执行 `builder app-form schema`、更新时 `get --app-key APP_KEY --being-draft`、`validate --schema-version VERSION --file DECLARATION.json`、`apply --file DECLARATION.json`（固定版本、完整声明、记录返回的 `appKey`）→ 视图（按钮随视图 `action_buttons` 写）→ 门户（缺报表时写 `chart`）→ 发布/回读。旧 `schema apply` / `layout apply` 不在当前 CLI parser 中。超时、`partial_success`、`write_executed=true`、`safe_to_retry=false` 或回读不完整时先读取 AppForm draft/published，再恢复，不得重复创建或创建 V2/测试/随机后缀绕过重名。**单应用**：新建和更新遵循同一 AppForm CLI 链路，再按需求配置流程/视图。更新动作归入对应资源文档：AppForm [30](./reference/builder/30-schema-fields.md)、视图 [50](./reference/builder/50-views.md)、报表 [60](./reference/builder/60-charts.md)、门户 [70](./reference/builder/70-portal.md)、关联资源/非主链路按钮维护 [80](./reference/builder/80-buttons-associated-resources.md)、流程 [90](./reference/builder/90-workflow.md)、发布 [99](./reference/builder/99-publish-verify.md)。 |
+| **builder** | **搭建／系统化配置**：先按 **[INDEX](./reference/00-INDEX.md)** / **[BUILDER](./reference/builder/README.md)** 选主路径，再读 `builder contract`。**完整系统/应用包**：`builder package apply --config-file` → 每个应用依次执行 `builder app-form schema`、更新时 `get --app-key APP_KEY --being-draft`、`validate --schema-version VERSION --file DECLARATION.json`、`apply --file DECLARATION.json`（固定版本、完整声明、记录返回的 `appKey`）→ 视图（按钮随视图 `action_buttons` 写）→ 门户（缺报表时写 `chart`）→ 发布/回读。旧 `schema apply` / `layout apply` 不在当前 CLI parser 中。超时、`partial_success`、`write_executed=true`、`safe_to_retry=false` 或回读不完整时先读取 AppForm draft/published，再恢复，不得重复创建或创建 V2/测试/随机后缀绕过重名。**单应用**：新建和更新遵循同一 AppForm CLI 链路，再按需求配置流程/视图。更新动作归入对应资源文档：AppForm [30](./reference/builder/30-schema-fields.md)、视图 [50](./reference/builder/50-views.md)、报表 [60](./reference/builder/60-charts.md)、门户 [70](./reference/builder/70-portal.md)、关联资源/非主链路按钮维护 [80](./reference/builder/80-buttons-associated-resources.md)、流程 [90](./reference/builder/90-workflow.md)、发布 [99](./reference/builder/99-publish-verify.md)。**AI 公式/代码块校验**：`builder app-form validate-formula --app-key KEY --formula '<公式>' --test-case <文件路径>`（`--formula` 内联；`--test-case` **只收文件路径或 `-` stdin，不收内联 JSON**）与 `builder app-form validate-code-block --app-key KEY --code <内联文本|@文件路径> --test-case <文件路径>`（本地静态 + 后端真跑，输出 `staticErrors` / `runResult` / `runError`）；两者是公式/代码块生成场景的真实校验命令，校验结论必须来自其真实执行，不得以本地模拟替代。代码内占位符 `qf_field.{字段名$$queId$$}`（**字段名不带引号**，带引号会被 CLI 自动剥离但勿依赖）与 `keyQueId` 均使用**十进制** queId（CLI 真跑前自动编码为运行时形态；错误回显自动还原为十进制，勿逆向编码 id）。test-case values 按类型：文本/电话=字符串、数字=数字字面量、日期=yyyy-MM-dd、附件=URL 字符串数组、单选/下拉/多选=选项文案（CLI 自动译为选项 id）、成员/部门=不可提供（代码判空,覆盖校验豁免）。 |
 | **task**（须落盘见上文） | `task list [--task-box][--flow-status][--app-key][--query] --page --page-size`（**枚举、`--query`、与 `record` 视图口径勿混**：见上文 SOP · **[TASK_CONTEXT](./reference/task/QINGFLOW_CLI_TASK_CONTEXT_WORKFLOW.md)**）· **`get`/`log`/`report`/`action`**：默认只传 `task list` 返回的 **`data.items[].task_id`**；`report` 另须必选 **`--report-id`**；`action` **无 `--dry-run`** |
 
+### 临时网页登录链接
+
+仅在用户需要进入网页查看或继续操作时生成，纯数据查询不自动调用：
+
+```bash
+qingflow --json auth login-link
+qingflow --profile default --json auth login-link --redirect-path "/index/app/123?view=abc"
+```
+
+- 默认使用当前会话和已选工作区；缺失时按实际错误恢复，不额外预查或重新登录。
+- `--redirect-path` 可选，仅接受已确认的站内业务路径，可包含 query/hash；不接受外域或认证入口。示例 ID 仅作格式展示，不得照抄或编造实际目标；省略时进入工作区首页。
+- 将返回的 `url` 作为可点击链接交付，不修改或拼造。链接短时有效且仅可使用一次，失效后重新获取，不写入公共文档或日志。
+- 命令不会自动打开浏览器；用户仅索取链接时不提前打开，明确要求打开时才调用浏览器。
+
 **高发必败**：旧应用搜索入口 · **`record list`/`browse`/`access` 缺 `--view-id`** · **`task report` 缺 `--report-id`** · **`record update` 批量与单条参数混用**。
 
 更多成员策略：**[reference/QINGFLOW_CLI_MEMBER_CHEATSHEET.md](./reference/core/QINGFLOW_CLI_MEMBER_CHEATSHEET.md)** · 一次性长模板：**[reference/QINGFLOW_CLI_ONE_SHOT_CHEATSHEET.md](./reference/core/QINGFLOW_CLI_ONE_SHOT_CHEATSHEET.md)** · 对齐说明：**[reference/QINGFLOW_CLI_EXPLORATION_REPORT.md](./reference/core/QINGFLOW_CLI_EXPLORATION_REPORT.md)**。

package/skills/qingflow-common/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: qingflow-common
-description: Route Qingflow work through the shared public concepts and choose the matching CLI or MCP package. Use when comparing Qingflow CLI and MCP capabilities, selecting an execution surface, or handing work between record, task, form, workflow, and builder skills.
+description: 解释轻流公共业务概念并选择 CLI 或 MCP 入口。用于能力比较、记录与任务操作、表单与流程搭建的任务分流，以及从 AI 对话进入页面查看结果、继续编辑、处理业务或进入工作区的场景。
 ---
 
 # Qingflow Common Concepts
@@ -31,6 +31,7 @@ Do not require both surfaces. If only one is installed, complete the workflow on
 | Form schema/read/apply/delete | `qingflow --json builder app-form ...` / `builder app delete` | `app_form_schema`, `app_form_get`, `app_form_apply`, `app_delete` |
 | AppForm static validation | `qingflow --json builder app-form validate --file ...` | Performed inside `app_form_apply`; no separate tool |
 | Record and task work | `qingflow --json record ...` / `task ...` | Qingflow MCP record and task tools |
+| 免登录打开网页或指定业务页面 | `qingflow --json auth login-link [--redirect-path PATH]` | `get_login_link` |
 | Package, view, portal, chart, workflow | `qingflow --json builder ...` | Qingflow MCP configuration tools |
 
 The operation names and payload schemas are defined by the public surface. Use the current Schema or tool input schema as the source of truth, not a legacy command name or backend payload.
@@ -42,6 +43,21 @@ The operation names and payload schemas are defined by the public surface. Use t
 
 Each package includes this common Skill. The CLI package installs its CLI guidance; the MCP package installs every MCP domain Skill. The source of every packaged Skill is `qingflow-support/mcp-server/skills/`.
 
+## 从 AI 对话进入轻流页面
+
+用户需要查看结果、继续编辑、处理业务或进入工作区页面时，MCP 调用 `get_login_link`，CLI 调用 `qingflow --json auth login-link`。纯数据查询无需页面，不自动生成链接。
+
+- 目标路径使用用户提供或业务工具确认的站内路径，不根据应用、记录标识猜测地址。
+- 用户明确指定页面但路径未知时继续定位或说明限制，不猜测，也不静默替换成首页。搜索未命中时继续搜索 `login` 或查看服务工具列表，不擅自打开固定正式站点；失败时如实说明。
+
+- 默认使用当前会话及已选工作区；需要指定会话时使用 MCP 的 `profile` 或 CLI 的 `--profile`。
+- `redirect_path` 可选，默认空：省略时进入工作区首页；传入时仅支持以单个 `/` 开头的站内业务路径，可带 query/hash。不得传完整 URL、外部地址、认证入口或多层编码路径。
+- 示例：`get_login_link({})`；指定目标示例：`get_login_link({"redirect_path":"/index/app/123?view=abc"})`。示例标识仅作格式展示，实际目标必须来自用户提供或已经确认的页面信息，不得编造应用、记录标识。
+- 临近交付时再生成，使用返回的 `url`，文案贴合“查看记录”“继续编辑”等上下文，不展示工作区数字 ID 或原始 JSON。
+- CLI 示例：`qingflow --json auth login-link`；指定目标使用 `qingflow --profile default --json auth login-link --redirect-path "/index/app/123?view=abc"`，同样不得编造实际路径。
+- 链接短时有效且仅可使用一次，失效后重新获取，不修改或拼造链接；只交付给请求用户，不写入公共文档或日志。
+- 用户要求“给我链接”时仅交付，不提前消费；要求“打开”时才使用可用浏览器打开。浏览器不可用时提供可点击链接，不假称已经打开。
+
 ## Route Next
 
 Use the installed package's relevant domain Skill. In the unified MCP package, select the Skill by the requested work, not by an assumed user or builder server role. Do not link to or invoke a domain Skill that the current package did not install.

package/src/qingflow_mcp/app_form_validator.py

@@ -24,6 +24,8 @@ _INTEGRATION_OUTPUT_TARGET_FIELD_TYPES = {
 }
 _Q_LINKER_TEMPLATE_RE = re.compile(r"\{\{(?P<key>[^{}\s]+)\}\}")
 _FORMULA_IDENTIFIER_RE = re.compile(r"[A-Za-z_][A-Za-z0-9_]*")
+#: 公式字段引用正则（#queId_<id>$，支持表格嵌套 <id>.<id>）
+_FORMULA_FIELD_REF_RE = re.compile(r"#queId_([^$]+)\$")
 
 
 class AppFormValidationError(ValueError):
@@ -460,3 +462,305 @@ def validate_declaration(
         issues = [{"pointer": pointer, "message": message} for pointer, message in sorted(found)]
         raise AppFormValidationError(issues, schema_version=pinned, api_version=api_version)
     return {"valid": True, "schemaVersion": pinned, "apiVersion": api_version, "fieldTypes": list(types)}
+
+
+def validate_formula_expression(
+    formula: str,
+    fields: list[dict[str, Any]] | None = None,
+) -> list[dict[str, str]]:
+    """校验单条公式表达式：函数名合法 + 字段引用存在性。不依赖整份 AppForm，不调后端。
+
+    Args:
+        formula: 公式文本，如 ``CONCAT(#queId_101$, "：", #queId_102$)``。
+        fields: 字段清单 ``[{queId, name}]``（兼容 ``que_id``/``id``）；提供时校验字段引用存在性，
+            不提供时跳过字段引用校验。
+    Returns:
+        错误列表 ``[{pointer, message}]``，空列表表示本地语法通过。
+    """
+    errors: list[dict[str, str]] = []
+    if not isinstance(formula, str) or not formula.strip():
+        errors.append({"pointer": "formula", "message": "formula is empty"})
+        return errors
+
+    # 函数名合法性（复用 AppForm formula Schema 的函数目录）
+    supported = _supported_formula_functions("v1alpha1")
+    unknown = sorted(
+        name for name in _formula_function_calls(formula) if name.upper() not in supported
+    )
+    for name in unknown:
+        errors.append({"pointer": "formula", "message": f"unsupported formula function '{name}'"})
+
+    # 字段引用存在性（#queId_<id>$，支持表格嵌套 <id>.<id>，按叶子 id 与原始 id 双重匹配）
+    if fields:
+        known_ids = {
+            str(identifier)
+            for field in fields
+            if isinstance(field, dict)
+            for identifier in (
+                field.get("queId"),
+                field.get("que_id"),
+                field.get("id"),
+            )
+            if identifier is not None and str(identifier) != ""
+        }
+        for match in _FORMULA_FIELD_REF_RE.finditer(formula):
+            raw_id = match.group(1)
+            leaf_id = raw_id.split(".")[-1]
+            if leaf_id not in known_ids and raw_id not in known_ids:
+                errors.append(
+                    {
+                        "pointer": "formula",
+                        "message": f"field reference '{match.group(0)}' refers to unknown queId {raw_id}",
+                    }
+                )
+    return errors
+
+
+def validate_code_block_static(code: str) -> list[dict[str, str]]:
+    """校验代码块静态结构：qf_output 赋值 + 基本语法。不调后端。
+
+    Args:
+        code: 代码文本。
+    Returns:
+        错误列表 ``[{pointer, message}]``，空列表表示本地静态校验通过。
+    """
+    errors: list[dict[str, str]] = []
+    if not isinstance(code, str) or not code.strip():
+        errors.append({"pointer": "code", "message": "code is empty"})
+        return errors
+
+    # qf_output 必须直接赋值（不能用 const/let 声明）；仅当代码涉及 outputs 绑定时才提示
+    has_qf_output = bool(re.search(r"(^|[^A-Za-z0-9_$])qf_output\s*=(?!=)", code))
+    has_outputs_binding = "outputs" in code
+    if not has_qf_output and has_outputs_binding:
+        errors.append(
+            {
+                "pointer": "code",
+                "message": "code declares outputs but does not assign qf_output; "
+                "use 'qf_output = {...}' (not const/let)",
+            }
+        )
+    return errors
+
+
+# ---------------------------------------------------------------------------
+# 代码块字段占位符编码
+#
+# 后端 codeBlockTest 运行时通过 CustomPushContentConverter.getQueId 解码代码里的
+# ``qf_field.{label$$<encoded>$$}`` 段（私有混淆编码，非十进制），再按解码出的十进制
+# queId 匹配 --test-case 的 keyQueId 填值；匹配不上会静默跳过（占位符原样留跑）。
+# AI 生成的代码按十进制 queId 书写（与 skill/编辑器上下文一致），本模块在真跑前把
+# 纯数字的 ``$$<digits>$$`` 段编码为运行时形态——与后端采纳链路（encryptQueId）同一
+# 编码、同一"纯数字才编码"规则，已编码（含字母）的段原样保留，避免双重编码。
+# ---------------------------------------------------------------------------
+
+_ENC_KEY = 1000013
+_INT_TO_HEX = "0123456789ABCDEF"
+_DECIMAL_PLACEHOLDER = re.compile(r"\$\$(-?\d+)\$\$")
+
+
+def encode_que_id(que_id: int) -> str:
+    """Java ``CustomPushContentConverter.encryptQueId`` 的逐行为等价移植。"""
+    have_prefix = que_id < 0
+    abs_id = abs(que_id)
+    ran = abs_id * 17
+    inp = str(abs_id)
+    seeds: list[int] = []
+    salt_sum = 0
+    for _ in range(max(0, 4 - len(inp))):
+        tmp = (ran % 20) + 71
+        ran = ((ran + 13) * 17) % _ENC_KEY
+        salt_sum += tmp
+        seeds.append(tmp)
+    result = [(salt_sum + i + int(ch, 16)) % 15 for i, ch in enumerate(inp)]
+    for seed in seeds:
+        pos = (ran + seed) % len(result)
+        ran = ((ran + 13) * 17) % _ENC_KEY
+        result.insert(pos, seed)
+    encoded = "".join(chr(value) if value > 15 else _INT_TO_HEX[value] for value in result)
+    return ("-" if have_prefix else "") + encoded
+
+
+def encode_code_block_field_ids(code: str) -> str:
+    """把代码里的十进制 queId 占位符段编码为后端运行时形态。
+
+    仅处理纯数字（可带负号）的 ``$$...$$`` 段；混有字母的段视为已编码，原样保留。
+    """
+    if not isinstance(code, str):
+        return code
+    return _DECIMAL_PLACEHOLDER.sub(
+        lambda match: f"$${encode_que_id(int(match.group(1)))}$$", code
+    )
+
+
+def referenced_code_block_field_ids(code: str) -> set[int]:
+    """提取代码里以十进制 queId 引用的字段 id 集合（供 test-case 覆盖校验）。
+
+    只统计纯数字（可带负号）的 ``$$...$$`` 段；已编码（含字母）段解码依赖后端实现，
+    不在此覆盖校验范围内。
+    """
+    if not isinstance(code, str):
+        return set()
+    return {int(match.group(1)) for match in _DECIMAL_PLACEHOLDER.finditer(code)}
+
+
+# ---------------------------------------------------------------------------
+# 代码块校验的占位符容错与回显还原
+#
+# 现场问题(agent 实测):
+# 1. 模型常把占位符写成 qf_field.{"字段名$$id$$"} —— 字段名带引号。后端替换正则要求
+#    结尾恰为 `$$}`,带引号变成 `$$"}` 匹配失败,占位符原样留在代码里直接语法错误。
+#    这里在编码归一化前剥离字段名两侧引号,带引号写法自动修正。
+# 2. CLI 把 `$$十进制$$` 编码为混淆形态后,校验失败的错误回显里是编码 id,模型认不出
+#    是自己写的 queId,会试图逆向"哈希"浪费大量轮次。这里记录 编码→十进制 映射,
+#    输出前把错误文本里的编码段还原为十进制。
+# ---------------------------------------------------------------------------
+
+_QUOTED_PLACEHOLDER = re.compile(r'(qf_field\.\{)["\']([^$\'"{]+?)\$\$(-?\d+)\$\$["\'](\})')
+
+
+def strip_placeholder_quotes(code: str) -> tuple[str, int]:
+    """剥离占位符字段名两侧引号:qf_field.{"名$$id$$"} → qf_field.{名$$id$$}。
+
+    Returns:
+        (修正后的代码, 修正处数)
+    """
+    if not isinstance(code, str):
+        return code, 0
+    count = 0
+
+    def _strip(match: re.Match[str]) -> str:
+        nonlocal count
+        count += 1
+        return f"{match.group(1)}{match.group(2)}$${match.group(3)}$$}}"
+
+    return _QUOTED_PLACEHOLDER.sub(_strip, code), count
+
+
+def build_encoded_id_map(code: str) -> dict[str, str]:
+    """对代码里的纯数字占位段构建 编码形态→十进制 映射(用于错误回显还原)。"""
+    if not isinstance(code, str):
+        return {}
+    return {
+        encode_que_id(int(match.group(1))): match.group(1)
+        for match in _DECIMAL_PLACEHOLDER.finditer(code)
+    }
+
+
+def restore_decimal_ids_in_text(text: str, id_map: dict[str, str]) -> str:
+    """把文本里出现的 `$$<编码>$$` 还原为 `$$<十进制>$$`(错误回显可读化)。"""
+    if not isinstance(text, str) or not id_map:
+        return text
+    for encoded, decimal in id_map.items():
+        text = text.replace(f"$${encoded}$$", f"$${decimal}$$")
+    return text
+
+
+# 选择类字段 test-case 值翻译:后端只认选项 optId(数字),传文案静默变 null;
+# 模型不可能知道 optId,这里按字段定义把"选项文案"翻译成 optId。
+_SELECT_FIELD_TYPES = {"single_choice", "single_select", "multi_select"}
+# 值不可推导的字段类型(成员/部门要 uid/部门id,模型无从得知):覆盖校验跳过。
+_UNDERIVABLE_FIELD_TYPES = {"member", "department"}
+
+
+def translate_select_test_case_values(
+    fields: list[dict] | None, key_que_values: list[dict]
+) -> tuple[list[dict], list[dict[str, str]], list[str]]:
+    """把选择类字段的"选项文案"值翻译为 optId。
+
+    Args:
+        fields: 字段定义清单(含 que_id/type/option_details;可为 None 表示未取到)。
+        key_que_values: 已规范化的 test-case。
+    Returns:
+        (翻译后的 test-case, 翻译记录[{queId, from, to}], 无法翻译的选项错误清单)
+    """
+    if not fields:
+        return key_que_values, [], []
+    option_lookup: dict[int, dict[str, object]] = {}
+    type_by_que: dict[int, str] = {}
+    for field in fields:
+        if not isinstance(field, dict):
+            continue
+        que_id = field.get("que_id") or field.get("queId")
+        if not isinstance(que_id, int):
+            continue
+        field_type = str(field.get("type") or "")
+        type_by_que[que_id] = field_type
+        details = field.get("option_details")
+        if isinstance(details, list):
+            by_value = {
+                str(item.get("value") or "").strip(): item.get("id")
+                for item in details
+                if isinstance(item, dict) and item.get("id") is not None
+            }
+            if by_value:
+                option_lookup[que_id] = by_value
+
+    translated = [dict(item) for item in key_que_values]
+    changes: list[dict[str, str]] = []
+    errors: list[str] = []
+    for item in translated:
+        key = item.get("keyQueId")
+        if not isinstance(key, int) or key not in option_lookup:
+            continue
+        by_value = option_lookup[key]
+        new_values: list[object] = []
+        for value in item.get("values") or []:
+            text = str(value).strip()
+            if text in by_value:
+                new_values.append(by_value[text])
+                changes.append({"queId": str(key), "from": text, "to": str(by_value[text])})
+            elif str(value).isdigit() and int(value) in set(by_value.values()):
+                new_values.append(int(value))
+            else:
+                errors.append(
+                    f"field queId {key}: 选项「{text}」不存在,可选:{'/'.join(by_value.keys())}"
+                )
+                new_values.append(value)
+        item["values"] = new_values
+    return translated, changes, errors
+
+
+# ---------------------------------------------------------------------------
+# 公式校验的引用提取与选择类值翻译
+#
+# 实测(真实后端 /ai/coding/formula/validate):
+# - 缺值字段静默变空(CONCAT 直接跳过)→ 空洞通过,需要覆盖门;
+# - 单选/多选必须传 **[optId 数组]**:文案/optId 标量均报错;返回值为 optId 串(非文案);
+# - 日期字段裸引用报错,套日期函数(YEAR 等)+ "yyyy-MM-dd" 字符串可用。
+# ---------------------------------------------------------------------------
+
+_FORMULA_REFERENCE = re.compile(r"#queId_(\d+)\$")
+
+
+def referenced_formula_field_ids(formula: str) -> set[int]:
+    """提取公式 `#queId_<id>$` 引用的字段 id 集合(供覆盖校验)。"""
+    if not isinstance(formula, str):
+        return set()
+    return {int(m.group(1)) for m in _FORMULA_REFERENCE.finditer(formula)}
+
+
+def translate_formula_test_case_values(
+    fields: list[dict] | None, test_case: dict
+) -> tuple[dict, list[dict[str, str]], list[str]]:
+    """公式 testCase 值归一化(全类型实测契约)。
+
+    实测核心规律:**裸引用/函数求值统一要求 [数组] 形态**,标量一律报错(含文本/数字/日期);
+    单选/多选传 ["选项文案"] 数组直接可过且求值结果是文案本身(优于内部 id)。
+    因此本函数只做一件事:把所有标量值包装成 [标量];已是数组原样保留。
+
+    Args:
+        fields: 字段定义(当前未用,保留签名兼容;数组包装与类型无关)。
+        test_case: {queId: value} 对象。
+    Returns:
+        (归一化 test-case, 包装记录, 错误清单——恒空)
+    """
+    if not isinstance(test_case, dict):
+        return test_case, [], []
+    translated = dict(test_case)
+    changes: list[dict[str, str]] = []
+    for key, value in list(translated.items()):
+        if not isinstance(value, list):
+            translated[key] = [value]
+            changes.append({"queId": str(key), "from": f"scalar:{value}", "to": f"[{value}]"})
+    return translated, changes, []

package/src/qingflow_mcp/builder_facade/service.py

@@ -21167,6 +21167,11 @@ def _compact_public_field_read(*, field: dict[str, Any], layout: dict[str, Any],
         "required": bool(field.get("required")),
         "section_id": None if nested else _find_field_section_id(layout, str(field.get("name") or "")),
     }
+    if field.get("type") in {FieldType.single_select.value, FieldType.multi_select.value} and field.get(
+        "option_details"
+    ):
+        # 选项 id 透出:validate-code-block 需要把"选项文案"翻译成 optId(后端只认 optId)
+        payload["option_details"] = deepcopy(field.get("option_details"))
     if field.get("type") == FieldType.relation.value:
         payload["target_app_key"] = field.get("target_app_key")
         payload["relation_mode"] = _normalize_relation_mode(field.get("relation_mode"))

package/src/qingflow_mcp/cli/commands/auth.py

@@ -40,11 +40,19 @@ def register(subparsers: argparse._SubParsersAction[argparse.ArgumentParser]) ->
     whoami = auth_subparsers.add_parser("whoami", help="查看当前登录态")
     whoami.set_defaults(handler=_handle_whoami, format_hint="auth_whoami")
 
+    login_link = auth_subparsers.add_parser("login-link", help="生成当前工作区的临时一次性登录链接（不自动打开）")
+    login_link.add_argument("--redirect-path", default="", help="登录后跳转的站内路径，可包含查询参数和锚点")
+    login_link.set_defaults(handler=_handle_login_link, format_hint="login_link")
+
     logout = auth_subparsers.add_parser("logout", help="退出登录")
     logout.add_argument("--forget-persisted", action="store_true")
     logout.set_defaults(handler=_handle_logout, format_hint="")
 
 
+def _handle_login_link(args: argparse.Namespace, context: CliContext) -> dict:
+    return context.login_link.get_login_link(profile=args.profile, redirect_path=args.redirect_path)
+
+
 def _handle_login(args: argparse.Namespace, context: CliContext) -> dict:
     if args.method == "oauth":
         return _handle_oauth_login(args, context)

package/src/qingflow_mcp/cli/commands/builder.py

@@ -2,9 +2,23 @@ from __future__ import annotations
 
 import argparse
 from copy import deepcopy
+from pathlib import Path
 
 from ..context import CliContext
-from ...app_form_validator import AppFormValidationError, validate_declaration
+from ...app_form_validator import (
+    AppFormValidationError,
+    build_encoded_id_map,
+    referenced_formula_field_ids,
+    translate_formula_test_case_values,
+    encode_code_block_field_ids,
+    referenced_code_block_field_ids,
+    restore_decimal_ids_in_text,
+    strip_placeholder_quotes,
+    translate_select_test_case_values,
+    validate_code_block_static,
+    validate_declaration,
+    validate_formula_expression,
+)
 from ..json_io import load_json_value
 from .common import load_list_arg, load_object_arg, parse_bool_text, raise_config_error, require_list_arg
 
@@ -128,6 +142,41 @@ def register(subparsers: argparse._SubParsersAction[argparse.ArgumentParser]) ->
     app_form_validate.add_argument("--schema-version", help="固定使用的 AppForm Schema 版本")
     app_form_validate.set_defaults(handler=_handle_app_form_validate, format_hint="builder_summary", force_json_output=True)
 
+    app_form_validate_formula = app_form_subparsers.add_parser(
+        "validate-formula", help="校验公式表达式（本地语法 + 后端求值）"
+    )
+    app_form_validate_formula.add_argument("--app-key", required=True, help="目标应用 key")
+    app_form_validate_formula.add_argument("--formula", required=True, help="公式文本")
+    app_form_validate_formula.add_argument(
+        "--test-case",
+        required=True,
+        help="测试用例 JSON 文件路径，- 表示 stdin；格式 {queId: value}",
+    )
+    app_form_validate_formula.add_argument(
+        "--fields",
+        required=False,
+        help="字段清单 JSON 文件路径（用于本地字段引用校验）；缺省时从后端拉取",
+    )
+    app_form_validate_formula.set_defaults(
+        handler=_handle_app_form_validate_formula, format_hint="builder_summary", force_json_output=True
+    )
+
+    app_form_validate_code_block = app_form_subparsers.add_parser(
+        "validate-code-block", help="校验代码块（本地静态 + 后端真跑）"
+    )
+    app_form_validate_code_block.add_argument("--app-key", required=True, help="目标应用 key")
+    app_form_validate_code_block.add_argument(
+        "--code", required=True, help="代码文本（或 @文件路径读取）"
+    )
+    app_form_validate_code_block.add_argument(
+        "--test-case",
+        required=True,
+        help="测试用例 JSON 文件路径，- 表示 stdin；格式 [{keyQueId, ordinal?, values}]",
+    )
+    app_form_validate_code_block.set_defaults(
+        handler=_handle_app_form_validate_code_block, format_hint="builder_summary", force_json_output=True
+    )
+
     app = builder_subparsers.add_parser("app", help="应用")
     app_subparsers = app.add_subparsers(dest="builder_app_command", required=True)
 
@@ -395,6 +444,283 @@ def _handle_app_form_validate(args: argparse.Namespace, _context: CliContext) ->
     return {"category": "validation", "status": "success", "ok": True, **result, "message": "AppForm declaration is valid"}
 
 
+def _handle_app_form_validate_formula(args: argparse.Namespace, context: CliContext) -> dict:
+    formula = args.formula
+    test_case = load_json_value(
+        args.test_case, option_name="--test-case", max_bytes=1 * 1024 * 1024, max_depth=32
+    )
+    if not isinstance(test_case, dict):
+        raise_config_error(
+            "--test-case must be a JSON object {queId: value}", error_code="INVALID_TEST_CASE"
+        )
+
+    # 字段定义:优先 --fields;缺省拉全量(保留 option_details 供选择类值翻译)
+    fields_path = getattr(args, "fields", None)
+    if fields_path:
+        fields = _load_fields_for_validation(args, context)
+    else:
+        fields = _load_code_block_validation_fields(args, context) or _load_fields_for_validation(args, context)
+
+    # ① 本地语法校验（函数名 + 字段引用存在性）
+    syntax_fields = [
+        {"queId": f.get("que_id") or f.get("queId"), "name": f.get("name")} for f in (fields or [])
+    ] if fields else None
+    syntax_errors = validate_formula_expression(formula, syntax_fields)
+
+    # ①' 选择类值翻译:实测后端只认 [optId 数组],文案/标量 optId 均报错——把文案自动翻成 [optId]
+    test_case, select_changes, option_errors = translate_formula_test_case_values(fields, test_case)
+
+    # ①'' 覆盖校验:公式引用缺值字段会静默变空(CONCAT 直接跳过)→ 空洞通过,这里拦下
+    referenced_ids = referenced_formula_field_ids(formula)
+    underivable = _underivable_field_ids(fields)
+    covered_ids = {int(k) for k in test_case if str(k).isdigit()}
+    missing_ids = sorted((referenced_ids - covered_ids) - underivable)
+    coverage_errors = [
+        {
+            "pointer": "test-case",
+            "message": f"field queId {que_id} is referenced by formula but has no test-case value "
+            f"(reference would evaluate as empty)",
+        }
+        for que_id in missing_ids
+    ]
+
+    # ② 后端求值校验（本地有错时不浪费后端调用）
+    evaluation = None
+    evaluation_error = None
+    if not syntax_errors and not coverage_errors and not option_errors:
+        result = context.builder.app_form_evaluate_formula(
+            profile=args.profile, app_key=args.app_key, formula=formula, test_case=test_case
+        )
+        evaluation = result.get("evaluation")
+        evaluation_error = result.get("evaluationError")
+
+    ok = bool(
+        not syntax_errors
+        and not coverage_errors
+        and not option_errors
+        and isinstance(evaluation, dict)
+        and evaluation.get("valid") is True
+    )
+    return {
+        "category": "validation",
+        "status": "success" if ok else "failed",
+        "ok": ok,
+        "syntaxErrors": syntax_errors,
+        "coverageErrors": coverage_errors,
+        "optionErrors": option_errors,
+        "autoFixes": {"selectValuesTranslated": select_changes},
+        "evaluation": evaluation,
+        "evaluationError": evaluation_error,
+        "message": "formula is valid" if ok else "formula validation failed",
+    }
+
+
+def _handle_app_form_validate_code_block(args: argparse.Namespace, context: CliContext) -> dict:
+    raw_code = _read_code_arg(args.code)
+    # 占位符容错:模型常给字段名加引号(qf_field.{"名$$id$$"}),后端替换正则要求结尾恰为
+    # `$$}`,带引号直接匹配失败→占位符原样进 JS→语法错误。先剥离引号再进编码。
+    code_after_quotes, quote_fixes = strip_placeholder_quotes(raw_code)
+    # 后端运行时按 encryptQueId 的编码形态解码代码里的 $$id$$ 段再匹配 test-case 填值；
+    # AI 生成的代码是十进制 queId，先编码归一化（含字母的已编码段原样保留，防双重编码）。
+    code = encode_code_block_field_ids(code_after_quotes)
+    # 错误回显还原映射:后端错误里出现的编码 id 还原为模型写的十进制,避免模型逆向混淆。
+    encoded_id_map = build_encoded_id_map(code_after_quotes)
+    test_case = load_json_value(
+        args.test_case, option_name="--test-case", max_bytes=1 * 1024 * 1024, max_depth=32
+    )
+    if not isinstance(test_case, list):
+        raise_config_error(
+            "--test-case must be a JSON array [{keyQueId, ordinal?, values}]",
+            error_code="INVALID_TEST_CASE",
+        )
+
+    # 字段定义(选项翻译/覆盖豁免用;拉取失败不阻断,只是少一层自动修正)
+    fields = _load_code_block_validation_fields(args, context)
+
+    # ① 本地静态校验（qf_output 赋值 + 基本语法）
+    static_errors = validate_code_block_static(code)
+
+    # ①' 选择类值翻译:后端只认选项 optId,传文案静默变 null——把文案自动翻成 optId。
+    key_que_values = _normalize_code_block_test_case(test_case)
+    key_que_values, select_changes, option_errors = translate_select_test_case_values(fields, key_que_values)
+
+    # ①'' 测试覆盖校验：代码引用的字段必须在 test-case 中给值（成员/部门类豁免——
+    # 其值是 uid/部门 id,模型无从得知,代码须自行 null 安全）。缺值时后端会把占位符
+    # 替换成字面量 null 静默跑通（空洞通过）——在这里拦下，逼 test-case 补全而不是放行。
+    covered_ids = _code_block_test_case_field_ids(key_que_values)
+    underivable = _underivable_field_ids(fields)
+    referenced_ids = referenced_code_block_field_ids(raw_code)
+    missing_ids = sorted((referenced_ids - covered_ids) - underivable)
+    coverage_errors = [
+        {
+            "pointer": "test-case",
+            "message": f"field queId {que_id} is referenced by code but has no test-case value "
+            f"(placeholder would run as literal null)",
+        }
+        for que_id in missing_ids
+    ]
+
+    # ② 后端真跑校验（本地有错时不浪费后端调用）
+    run_result = None
+    run_error = None
+    if not static_errors and not coverage_errors and not option_errors:
+        result = context.builder.app_form_run_code_block(
+            profile=args.profile, app_key=args.app_key, code=code, key_que_values=key_que_values
+        )
+        run_result = result.get("runResult")
+        run_error = result.get("runError")
+
+    if isinstance(run_error, str):
+        run_error = restore_decimal_ids_in_text(run_error, encoded_id_map)
+
+    ok = not static_errors and not coverage_errors and not option_errors and run_result is not None
+    return {
+        "category": "validation",
+        "status": "success" if ok else "failed",
+        "ok": ok,
+        "staticErrors": static_errors,
+        "coverageErrors": coverage_errors,
+        "optionErrors": option_errors,
+        "autoFixes": {
+            "placeholderQuotesStripped": quote_fixes,
+            "selectValuesTranslated": select_changes,
+        },
+        "runResult": run_result,
+        "runError": run_error,
+        "message": "code block is valid" if ok else "code block validation failed",
+    }
+
+
+def _load_code_block_validation_fields(
+    args: argparse.Namespace, context: CliContext
+) -> list[dict] | None:
+    """加载字段定义(类型+选项 optId),供选择类值翻译与成员/部门覆盖豁免;失败返回 None。"""
+    try:
+        fetched = context.builder.app_get_fields(profile=args.profile, app_key=args.app_key)
+    except Exception:  # noqa: BLE001 - 字段拉取失败不阻断校验主流程
+        return None
+    if not isinstance(fetched, dict) or fetched.get("status") != "success":
+        return None
+    raw_fields = fetched.get("fields")
+    if not isinstance(raw_fields, list):
+        return None
+    return [field for field in raw_fields if isinstance(field, dict)]
+
+
+def _underivable_field_ids(fields: list[dict] | None) -> set[int]:
+    """值不可由模型推导的字段(成员/部门):test-case 覆盖校验豁免。"""
+    if not fields:
+        return set()
+    result: set[int] = set()
+    for field in fields:
+        field_type = str(field.get("type") or "")
+        if field_type in {"member", "department"}:
+            que_id = field.get("que_id") or field.get("queId")
+            if isinstance(que_id, int):
+                result.add(que_id)
+    return result
+
+
+def _code_block_test_case_field_ids(key_que_values: list[dict]) -> set[int]:
+    """test-case 覆盖的字段 id 集合：顶层 keyQueId + 表格 tableValues 行内 keyQueId。"""
+    covered: set[int] = set()
+    for item in key_que_values:
+        key = item.get("keyQueId")
+        if isinstance(key, int):
+            covered.add(key)
+        for row in item.get("tableValues") or []:
+            if isinstance(row, list):
+                for cell in row:
+                    if isinstance(cell, dict) and isinstance(cell.get("keyQueId"), int):
+                        covered.add(cell["keyQueId"])
+    return covered
+
+
+def _load_fields_for_validation(args: argparse.Namespace, context: CliContext) -> list[dict] | None:
+    """加载字段清单：优先 --fields 参数，缺省时从后端拉取应用字段。
+
+    后端拉取失败时返回 None（跳过字段引用校验，不阻断流程）。
+    """
+    fields_path = getattr(args, "fields", None)
+    if fields_path:
+        fields = load_json_value(
+            fields_path, option_name="--fields", max_bytes=2 * 1024 * 1024, max_depth=64
+        )
+        if not isinstance(fields, list):
+            raise_config_error(
+                "--fields must be a JSON array of field objects", error_code="INVALID_FIELDS"
+            )
+        return fields
+    fetched = context.builder.app_get_fields(profile=args.profile, app_key=args.app_key)
+    if not isinstance(fetched, dict) or fetched.get("status") != "success":
+        return None
+    raw_fields = fetched.get("fields")
+    if not isinstance(raw_fields, list):
+        return None
+    return [
+        {"queId": field.get("que_id"), "name": field.get("name")}
+        for field in raw_fields
+        if isinstance(field, dict)
+    ]
+
+
+def _read_code_arg(code_arg: str) -> str:
+    """读取 --code 参数：@ 前缀读文件内容，否则当文本。"""
+    if not isinstance(code_arg, str) or not code_arg:
+        raise_config_error("--code is required", error_code="INVALID_CODE")
+    if code_arg.startswith("@"):
+        path = code_arg[1:]
+        try:
+            return Path(path).expanduser().read_text(encoding="utf-8")
+        except OSError as exc:
+            raise_config_error(
+                f"failed to read --code from '{path}': {exc}", error_code="INVALID_CODE"
+            )
+    return code_arg
+
+
+def _normalize_code_block_test_case(test_case: list) -> list[dict]:
+    """将 --test-case 规范化为后端 OpenMatchQueValue 结构 [{keyQueId, ordinal?, values}]。"""
+    normalized: list[dict] = []
+    for item in test_case:
+        if not isinstance(item, dict):
+            raise_config_error(
+                "--test-case items must be JSON objects {keyQueId, ordinal?, values}",
+                error_code="INVALID_TEST_CASE",
+            )
+        raw_que_id = item.get("keyQueId", item.get("key_que_id"))
+        if raw_que_id is None:
+            raise_config_error(
+                "--test-case items require keyQueId", error_code="INVALID_TEST_CASE"
+            )
+        try:
+            key_que_id = int(raw_que_id)
+        except (TypeError, ValueError):
+            raise_config_error(
+                f"--test-case keyQueId must be an integer, got {raw_que_id!r}",
+                error_code="INVALID_TEST_CASE",
+            )
+        entry: dict = {"keyQueId": key_que_id}
+        if item.get("ordinal") is not None:
+            try:
+                entry["ordinal"] = int(item.get("ordinal"))
+            except (TypeError, ValueError):
+                raise_config_error(
+                    f"--test-case ordinal must be an integer, got {item.get('ordinal')!r}",
+                    error_code="INVALID_TEST_CASE",
+                )
+        values = item.get("values", [])
+        if not isinstance(values, list):
+            raise_config_error(
+                "--test-case item values must be a JSON array", error_code="INVALID_TEST_CASE"
+            )
+        entry["values"] = [str(value) for value in values]
+        if item.get("tableValues") is not None:
+            entry["tableValues"] = item.get("tableValues")
+        normalized.append(entry)
+    return normalized
+
+
 def _handle_app_delete(args: argparse.Namespace, context: CliContext) -> dict:
     return context.builder.app_delete(profile=args.profile, app_key=args.app_key)
 

package/src/qingflow_mcp/cli/context.py

@@ -10,6 +10,7 @@ from ..session_store import SessionStore
 from ..tools.ai_builder_tools import AiBuilderTools
 from ..tools.app_tools import AppTools
 from ..tools.auth_tools import AuthTools
+from ..tools.login_link_tools import LoginLinkTools
 from ..tools.code_block_tools import CodeBlockTools
 from ..tools.export_tools import ExportTools
 from ..tools.feedback_tools import FeedbackTools
@@ -27,6 +28,7 @@ class CliContext:
     sessions: CliSessionFacade
     backend: BackendClient
     auth: AuthTools
+    login_link: LoginLinkTools
     workspace: WorkspaceTools
     app: AppTools
     resource: ResourceReadTools
@@ -57,6 +59,7 @@ def build_cli_context() -> CliContext:
         sessions=sessions,
         backend=backend,
         auth=AuthTools(sessions, backend),
+        login_link=LoginLinkTools(sessions, backend),
         workspace=WorkspaceTools(sessions, backend),
         app=AppTools(sessions, backend),
         resource=ResourceReadTools(sessions, backend),

package/src/qingflow_mcp/cli/formatters.py

@@ -1566,7 +1566,12 @@ def _task_action_debug_lines(result: dict[str, Any]) -> list[str]:
     return lines
 
 
+def _format_login_link(result: dict[str, Any]) -> str:
+    return f"登录链接：{result['url']}\n过期时间（Unix 毫秒）：{result['expires_at']}\n链接仅可使用一次，请勿泄露。\n"
+
+
 _FORMATTERS = {
+    "login_link": _format_login_link,
     "auth_whoami": _format_whoami,
     "workspace_list": _format_workspace_list,
     "workspace_get": _format_workspace_get,

package/src/qingflow_mcp/config.py

@@ -2,16 +2,20 @@ from __future__ import annotations
 
 import json
 import os
+import re
 from pathlib import Path
 from typing import Any
 from urllib.parse import urlsplit, urlunsplit
 
+from .errors import QingflowApiError
+
 DEFAULT_PROFILE = "default"
 DEFAULT_TIMEOUT_SECONDS = 30.0
 DEFAULT_USER_AGENT = "qingflow-mcp/1.0"
 DEFAULT_RECORD_LIST_TYPE = 8
 ATTACHMENT_QUESTION_TYPE = 13
 DEFAULT_BASE_URL = "https://qingflow.com/api"
+DEFAULT_WEB_BASE_URL = "https://qingflow.com"
 DEFAULT_CLI_OAUTH_RESOURCE_URL = "https://mcp.qingflow.com/mcp"
 DEFAULT_FEEDBACK_APP_KEY = "e0d017kju002"
 DEFAULT_FEEDBACK_QSOURCE_TOKEN = "mcp-feedback-7755d14748fc"
@@ -153,6 +157,41 @@ def get_default_base_url() -> str | None:
     return normalize_base_url(value) if value else None
 
 
+def get_web_base_url() -> str:
+    """读取网页根地址；空白配置逐级回退，不复用后端或 OAuth 地址。"""
+    value = os.getenv("QINGFLOW_MCP_WEB_BASE_URL")
+    if value is None or not value.strip():
+        value = get_config_value("web_base_url", default=DEFAULT_WEB_BASE_URL)
+    if isinstance(value, str) and not value.strip():
+        value = DEFAULT_WEB_BASE_URL
+    try:
+        if not isinstance(value, str):
+            raise ValueError
+        value = value.strip()
+        parsed = urlsplit(value)
+        host = parsed.hostname or ""
+        # urlsplit 会校验 IPv6；域名标签额外拒绝空格、转义字符及无效边界。
+        valid_host = bool(host) and (":" in host or all(
+            re.fullmatch(r"[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?", label)
+            for label in host.rstrip(".").split(".")
+        ))
+        if (
+            parsed.scheme not in {"http", "https"}
+            or not valid_host or host.lower() in {"null", "undefined"}
+            or parsed.username is not None or parsed.password is not None
+            or parsed.path not in {"", "/"} or "?" in value or "#" in value
+            or any(character.isspace() or ord(character) < 32 for character in value)
+        ):
+            raise ValueError
+        # 访问 port 触发 urllib 的端口格式与范围校验。
+        _ = parsed.port
+        return urlunsplit((parsed.scheme, parsed.netloc, "", "", ""))
+    except ValueError:
+        raise QingflowApiError.config_error(
+            "QINGFLOW_MCP_WEB_BASE_URL（web_base_url）必须是有效的 HTTP(S) 网页根地址，不包含路径、查询参数或用户凭证"
+        ) from None
+
+
 def get_default_qf_version() -> str | None:
     """获取默认的 qfVersion 路由值"""
     value = get_config_value(

package/src/qingflow_mcp/public_surface.py

@@ -33,6 +33,7 @@ USER_PUBLIC_TOOL_SPECS: tuple[PublicToolSpec, ...] = (
     PublicToolSpec(USER_DOMAIN, "auth_login", cli_route=("auth", "login"), mcp_public=False),
     PublicToolSpec(USER_DOMAIN, "auth_use_credential", ("auth_use_credential",), ("auth", "use-credential")),
     PublicToolSpec(USER_DOMAIN, "auth_whoami", ("auth_whoami",), ("auth", "whoami")),
+    PublicToolSpec(USER_DOMAIN, "get_login_link", ("get_login_link",), ("auth", "login-link")),
     PublicToolSpec(USER_DOMAIN, "auth_logout", ("auth_logout",), ("auth", "logout")),
     PublicToolSpec(USER_DOMAIN, "workspace_list", ("workspace_list",), ("workspace", "list")),
     PublicToolSpec(USER_DOMAIN, "workspace_get", ("workspace_get",), ("workspace", "get")),
@@ -144,6 +145,8 @@ BUILDER_PUBLIC_TOOL_SPECS: tuple[PublicToolSpec, ...] = (
     PublicToolSpec(BUILDER_DOMAIN, "app_resolve", ("app_resolve",), ("builder", "app", "resolve"), has_contract=True, cli_show_effective_context=True),
     PublicToolSpec(BUILDER_DOMAIN, "app_form_schema", ("app_form_schema",), ("builder", "app-form", "schema")),
     PublicToolSpec(BUILDER_DOMAIN, "app_form_validate", (), ("builder", "app-form", "validate"), mcp_public=False),
+    PublicToolSpec(BUILDER_DOMAIN, "app_form_validate_formula", (), ("builder", "app-form", "validate-formula"), mcp_public=False),
+    PublicToolSpec(BUILDER_DOMAIN, "app_form_validate_code_block", (), ("builder", "app-form", "validate-code-block"), mcp_public=False),
     PublicToolSpec(BUILDER_DOMAIN, "app_form_get", ("app_form_get",), ("builder", "app-form", "get"), cli_show_effective_context=True),
     PublicToolSpec(BUILDER_DOMAIN, "app_form_apply", ("app_form_apply",), ("builder", "app-form", "apply"), cli_show_effective_context=True, cli_context_write=True),
     PublicToolSpec(BUILDER_DOMAIN, "app_delete", ("app_delete",), ("builder", "app", "delete"), cli_show_effective_context=True, cli_context_write=True),

package/src/qingflow_mcp/response_trim.py

@@ -51,6 +51,10 @@ COMMON_ERROR_DROP_TOP = {
 
 SUCCESS_POLICY_BY_TOOL: dict[str, TransformFn] = {}
 
+#: 这两个校验命令的产出契约明确包含 ok 字段（供阶段 2 SKILL.md 引用），
+#: 需在 success 裁剪时保留 ok（默认 COMMON_SUCCESS_DROP_TOP 会丢弃 ok）。
+_KEEP_OK_TOOLS = {"builder:app_form_validate_formula", "builder:app_form_validate_code_block"}
+
 
 def trim_public_response(tool_name: str | None, payload: dict[str, Any]) -> dict[str, Any]:
     if not isinstance(payload, dict):
@@ -85,6 +89,8 @@ def trim_success_response(tool_name: str | None, payload: dict[str, Any]) -> dic
         drop_keys = COMMON_SUCCESS_DROP_TOP - {"output_profile"}
     if tool_name in {"user:record_insert", "user:record_update", "user:record_delete"} and payload.get("ok") is False:
         drop_keys = drop_keys - {"ok"}
+    if tool_name in _KEEP_OK_TOOLS:
+        drop_keys = drop_keys - {"ok"}
     if tool_name == "builder:app_form_apply" and payload.get("mustReadCurrentStateBeforeRepair") is True:
         drop_keys = drop_keys - {"suggested_next_call"}
     _drop_top_keys(trimmed, drop_keys)
@@ -1128,6 +1134,13 @@ def _summarize_form_diff(diff: dict[str, Any]) -> dict[str, Any]:
     return summary
 
 
+def _trim_login_link(payload: JSONObject) -> None:
+    # 临时票据只通过链接交付，必须保留链接和过期时间。
+    for key in list(payload):
+        if key not in {"url", "expires_at"}:
+            payload.pop(key)
+
+
 def _register_policy(domains: tuple[str, ...], names: tuple[str, ...], transform: TransformFn) -> None:
     for domain in domains:
         for name in names:
@@ -1135,6 +1148,7 @@ def _register_policy(domains: tuple[str, ...], names: tuple[str, ...], transform
 
 
 _register_policy((USER_DOMAIN, BUILDER_DOMAIN), ("auth_use_credential", "auth_whoami"), _trim_auth_payload)
+_register_policy((USER_DOMAIN,), ("get_login_link",), _trim_login_link)
 _register_policy((USER_DOMAIN, BUILDER_DOMAIN), ("auth_logout",), _trim_auth_logout)
 _register_policy((USER_DOMAIN, BUILDER_DOMAIN), ("workspace_list",), _trim_workspace_list)
 _register_policy((USER_DOMAIN, BUILDER_DOMAIN), ("workspace_get", "workspace_select"), _trim_workspace_get)

package/src/qingflow_mcp/server.py

@@ -13,6 +13,7 @@ from .tools.feedback_tools import FeedbackTools
 from .tools.export_tools import ExportTools
 from .tools.file_tools import FileTools
 from .tools.import_tools import ImportTools
+from .tools.login_link_tools import LoginLinkTools
 from .tools.package_tools import PackageTools
 from .tools.navigation_tools import NavigationTools
 from .tools.directory_tools import DirectoryTools
@@ -238,6 +239,7 @@ If the current MCP capability is unsupported, the workflow is awkward, or the us
     sessions = SessionStore()
     backend = BackendClient()
     AuthTools(sessions, backend).register(server)
+    LoginLinkTools(sessions, backend).register(server)
     FeedbackTools(backend, mcp_side="通用").register(server)
     WorkspaceTools(sessions, backend).register(server)
     FileTools(sessions, backend).register(server)

package/src/qingflow_mcp/server_app_user.py

@@ -17,6 +17,7 @@ from .tools.export_tools import ExportTools
 from .tools.feedback_tools import FeedbackTools
 from .tools.file_tools import FileTools
 from .tools.import_tools import ImportTools
+from .tools.login_link_tools import LOGIN_LINK_DESCRIPTION, LoginLinkTools
 from .tools.resource_read_tools import ResourceReadTools
 from .tools.task_context_tools import TaskContextTools
 from .tools.workspace_tools import WorkspaceTools
@@ -30,6 +31,16 @@ def build_user_server(*, stateless_http: bool = False) -> FastMCP:
         stateless_http=stateless_http,
         instructions=f"""Use this server for Qingflow operational workflows. Current date: `{today.isoformat()}`.
 
+## 页面交接
+
+用户需要查看结果、继续编辑、处理业务或进入工作区页面时，使用 `get_login_link`；纯数据查询不自动签发链接。
+目标路径由业务工具或领域 Skill 根据真实前端路由确定，不由票据工具根据业务标识推导。
+已知目标传可选 `redirect_path`；明确指定页面但路径未知时继续定位或说明限制，不猜测，也不静默改为首页。
+搜索未命中时继续搜索 `login` 或查看服务工具列表，不擅自打开固定正式站点；鉴权或工具失败时如实说明。
+临近交付时再签发，使用返回的完整 URL。要求“给我链接”时仅交付，不提前消费；要求“打开”时才调用浏览器。
+浏览器不可用时提供可点击链接；用“查看记录”“继续编辑”等文案，不展示工作区数字 ID 或原始 JSON。
+链接约 5 分钟内一次性有效，不能作为长期书签；安全验证及原有业务权限不变。
+
 ## App Discovery
 
 If `app_key` is unknown, use `app_list` first. Pass `query` to filter visible apps by keyword.
@@ -237,6 +248,7 @@ If the current MCP capability is unsupported, the workflow is awkward, or the us
     code_block_tools = wrap_trimmed_methods(CodeBlockTools(sessions, backend), USER_SERVER_METHOD_MAP)
     task_context_tools = wrap_trimmed_methods(TaskContextTools(sessions, backend), USER_SERVER_METHOD_MAP)
     directory_tools = wrap_trimmed_methods(DirectoryTools(sessions, backend), USER_SERVER_METHOD_MAP)
+    login_link = LoginLinkTools(sessions, backend)
 
     @server.tool()
     def auth_use_credential(
@@ -258,6 +270,11 @@ If the current MCP capability is unsupported, the workflow is awkward, or the us
     def auth_whoami(profile: str = DEFAULT_PROFILE) -> dict:
         return auth.auth_whoami(profile=profile)
 
+    @server.tool(description=LOGIN_LINK_DESCRIPTION)
+    def get_login_link(profile: str = DEFAULT_PROFILE, redirect_path: str = "") -> dict:
+        """获取一次性免登录链接；redirect_path 可选，仅接受站内业务路径，省略进入首页。"""
+        return login_link.get_login_link(profile=profile, redirect_path=redirect_path)
+
     @server.tool()
     def auth_logout(profile: str = DEFAULT_PROFILE, forget_persisted: bool = False) -> dict:
         return auth.auth_logout(profile=profile, forget_persisted=forget_persisted)

package/src/qingflow_mcp/tools/ai_builder_tools.py

@@ -852,6 +852,64 @@ class AiBuilderTools(ToolBase):
         """Reconcile one complete declarative AppForm target."""
         return self._app_form.apply(profile=profile, spec=spec)
 
+    def app_form_evaluate_formula(
+        self,
+        *,
+        profile: str,
+        app_key: str,
+        formula: str,
+        test_case: dict[int, Any],
+    ) -> JSONObject:
+        """调用后端 POST /ai/coding/formula/validate 对公式求值。
+
+        本地语法校验由 CLI handler 负责；本方法只做后端求值，捕获后端错误为 evaluationError。
+        鉴权/会话错误（未登录/未选工作区）按既有约定向上抛出 QingflowApiError。
+        """
+        _session_profile, _backend_session, context = self._require_context(profile, require_workspace=True)
+        evaluation_result: Any = None
+        evaluation_error: str | None = None
+        try:
+            evaluation_result = self.backend.request(
+                "POST",
+                context,
+                "/ai/coding/formula/validate",
+                json_body={"appKey": app_key, "formula": formula, "testCase": test_case},
+            )
+        except QingflowApiError as exc:
+            evaluation_error = exc.message
+        return {"evaluation": evaluation_result, "evaluationError": evaluation_error}
+
+    def app_form_run_code_block(
+        self,
+        *,
+        profile: str,
+        app_key: str,
+        code: str,
+        key_que_values: list[JSONObject],
+    ) -> JSONObject:
+        """调用后端 POST /data/{appKey}/codeBlock/detection 真跑代码块。
+
+        本地静态校验由 CLI handler 负责；本方法只做后端真跑，捕获后端错误为 runError。
+        ``key_que_values`` 需符合后端 OpenMatchQueValue 结构 ``{keyQueId, ordinal?, values}``。
+
+        传入的 ``code`` 是原始 JS（未经前端字段公式加密），必须声明 ``unEncrypted=True``；
+        否则后端 ``DataSvcImpl.codeBlockTest`` 会走 ``FormulaDecoder.extractFormula``
+        对原始 JS 解密并抛 ``QFRuntimeException``，导致后端真跑对所有真实代码必然失败。
+        """
+        _session_profile, _backend_session, context = self._require_context(profile, require_workspace=True)
+        run_result: Any = None
+        run_error: str | None = None
+        try:
+            run_result = self.backend.request(
+                "POST",
+                context,
+                f"/data/{app_key}/codeBlock/detection",
+                json_body={"code": code, "keyQueValues": key_que_values, "unEncrypted": True},
+            )
+        except QingflowApiError as exc:
+            run_error = exc.message
+        return {"runResult": run_result, "runError": run_error}
+
     def app_delete(self, *, profile: str, app_key: str) -> JSONObject:
         """Delete an application explicitly."""
         return self._app_form.delete(profile=profile, app_key=app_key)

package/src/qingflow_mcp/tools/login_link_tools.py

@@ -0,0 +1,114 @@
+from __future__ import annotations
+
+import posixpath
+from typing import Any
+from urllib.parse import parse_qs, unquote, urlencode, urlsplit
+
+from mcp.server.fastmcp import FastMCP
+
+from ..config import DEFAULT_PROFILE, get_web_base_url
+from ..errors import QingflowApiError
+from ..json_types import JSONObject
+from .base import ToolBase
+
+LOGIN_LINK_DESCRIPTION = (
+    "轻流页面入口：查看页面、继续编辑、处理业务、查看结果或进入工作区（open/view/visit page in browser，login）。"
+    "从 AI 对话进入页面时，使用当前 MCP 身份和工作区生成短时（约 5 分钟）一次性免登录链接。"
+    "redirect_path 可选：传已确认的站内业务路径，可带 query/hash；省略进入首页，不接受外部地址或认证入口。"
+    "纯数据查询无需调用；用户指定页面但路径未知时先定位，不猜路径或静默改为首页。"
+    "返回 url 和毫秒整数 expires_at；必要安全验证及原有页面权限仍然生效。"
+    "用户要链接时仅交付，不提前消费；要求打开时才用浏览器打开返回的完整链接。"
+)
+
+
+def validate_redirect_path(value: str) -> str:
+    """只接受业务站内路径；解码仅用于校验，不改写查询参数或片段。"""
+    if not value or not value.strip():
+        return ""
+    auth_paths = (
+        "/mcp-login", "/qingclaw-login", "/passport", "/login-third-party", "/third-party-login",
+        "/third-party", "/oidc-authorize", "/oauth2/authorize", "/authorize", "/sso", "/ldap",
+        "/pcWechatAutoBind", "/code-login", "/work-wechat-error", "/ding-check-ws",
+    )
+    try:
+        path = unquote(urlsplit(value).path, errors="strict")
+        if (
+            not value.startswith("/") or value.startswith("//") or path.startswith("//")
+            or "\\" in value or "\\" in path or any(c in path for c in "%?#")
+            or any(ord(c) < 32 or ord(c) == 127 for c in value + path)
+        ):
+            raise ValueError
+        normalized = posixpath.normpath(path)
+        if any(normalized == p or normalized.startswith(p + "/") for p in auth_paths):
+            raise ValueError
+    except (ValueError, UnicodeError):
+        raise QingflowApiError(category="validation", message="redirect_path 必须是站内业务路径，不能指向认证入口") from None
+    return value
+
+
+class LoginLinkTools(ToolBase):
+    """登录链接工具（中文名：临时免登录链接）。
+
+    类型：会话辅助工具。
+    主要职责：
+    1. 为当前 MCP 用户签发进入当前工作区网页端的临时免登录链接；
+    2. 链接短时（5 分钟）、一次性，不携带 MCP 长期凭证或正式登录 token。
+
+    安全约束：
+    - 用户身份仅来自当前 MCP 会话（业务 token），不接收任何 uid 参数；
+    - 目标工作区固定为当前选中的 MCP 工作区，不开放任意跳转地址。
+    """
+
+    def register(self, mcp: FastMCP) -> None:
+        """注册当前工具到 MCP 服务。"""
+
+        @mcp.tool(description=LOGIN_LINK_DESCRIPTION)
+        def get_login_link(profile: str = DEFAULT_PROFILE, redirect_path: str = "") -> dict[str, Any]:
+            return self.get_login_link(profile=profile, redirect_path=redirect_path)
+
+    def get_login_link(self, *, profile: str, redirect_path: str = "") -> JSONObject:
+        """执行工具方法逻辑。"""
+
+        def runner(session_profile, context):
+            target = validate_redirect_path(redirect_path)
+            web_base_url = get_web_base_url()
+            result = self.backend.request(
+                "POST",
+                context,
+                "/mcp/auth/login-link",
+                json_body={"wsId": session_profile.selected_ws_id},
+            )
+            # 后端仅提供票据，网页地址由 MCP 配置确定，避免工作区域名为空。
+            try:
+                source_url = result.get("url") if isinstance(result, dict) else None
+                if not isinstance(source_url, str):
+                    raise ValueError
+                tickets = parse_qs(urlsplit(source_url).query, keep_blank_values=True).get("ticket", [])
+                if len(tickets) != 1 or not tickets[0].strip():
+                    raise ValueError
+                # 后端可能把毫秒时间戳序列化为字符串，不能截断浮点数或伪造缺失值。
+                expiry = result.get("expiresAt")
+                if type(expiry) is int:
+                    expires_at = expiry
+                elif isinstance(expiry, str) and expiry.isascii() and expiry.isdecimal():
+                    expires_at = int(expiry)
+                else:
+                    raise ValueError
+                if expires_at <= 0:
+                    raise ValueError
+            except ValueError:
+                # 不把原始响应或票据放入错误信息。
+                raise QingflowApiError(
+                    category="backend",
+                    message="INVALID_LOGIN_LINK: 后端免登录链接的票据或有效期无效，请重新获取",
+                ) from None
+            query = {"ticket": tickets[0]}
+            if target:
+                query["redirect_path"] = target
+            return {
+                "url": f"{web_base_url}/mcp-login?{urlencode(query)}",
+                "expires_at": expires_at,
+            }
+
+        # require_workspace=True：目标工作区恒为当前 MCP 会话选中的工作区
+        return self._run(profile, runner, tool_name="获取临时免登录链接")