@qingflow-tech/qingflow-cli 1.1.46 → 1.1.47-beta.2

package/src/qingflow_mcp/tools/app_tools.py

@@ -10,6 +10,7 @@ from ..config import DEFAULT_PROFILE
 from ..errors import QingflowApiError, backend_code_int, is_auth_like_error, raise_tool_error
 from ..json_types import JSONObject
 from ..list_type_labels import SYSTEM_VIEW_DEFINITIONS, get_app_publish_status_label
+from ..resource_uri import try_build_resource_uri
 from ..solution.compiler.icon_utils import workspace_icon_config
 from .base import ToolBase
 
@@ -46,6 +47,15 @@ class AppTools(ToolBase):
             unfiltered_count = len(items)
             if normalized_query:
                 items = self._filter_visible_apps(items, normalized_query)
+            for item in items:
+                uri, warning = try_build_resource_uri(
+                    ws_id=session_profile.selected_ws_id,
+                    resource_type="app",
+                    app_key=item.get("app_key"),
+                )
+                if uri:
+                    item["uri"] = uri
+                _append_unique_warning(warnings, warning)
             response = {
                 "profile": profile,
                 "ws_id": session_profile.selected_ws_id,
@@ -200,9 +210,10 @@ class AppTools(ToolBase):
                 if not _is_optional_app_metadata_error(exc):
                     raise
                 visible_app = self._resolve_visible_app(context, app_key)
-                if visible_app is not None:
-                    app_name = str(visible_app.get("app_name") or visible_app.get("title") or app_key).strip() or app_key
-                    app_icon = str(visible_app.get("app_icon") or "").strip() or None
+                if visible_app is None:
+                    raise
+                app_name = str(visible_app.get("app_name") or visible_app.get("title") or app_key).strip() or app_key
+                app_icon = str(visible_app.get("app_icon") or "").strip() or None
                 warnings.append(
                     _with_api_error_fields(
                         {
@@ -224,22 +235,45 @@ class AppTools(ToolBase):
             accessible_views.extend(custom_views)
             import_capability, import_warnings = _derive_import_capability(base_info)
             warnings.extend(import_warnings)
+            app_uri, uri_warning = try_build_resource_uri(
+                ws_id=session_profile.selected_ws_id,
+                resource_type="app",
+                app_key=app_key,
+            )
+            _append_unique_warning(warnings, uri_warning)
+            for view in accessible_views:
+                view_id = str(view.get("view_id") or "")
+                view_kind, separator, view_key = view_id.partition(":")
+                if not separator:
+                    continue
+                uri, warning = try_build_resource_uri(
+                    ws_id=session_profile.selected_ws_id,
+                    resource_type="view",
+                    app_key=app_key,
+                    view_kind=view_kind,
+                    view_key=view_key,
+                )
+                if uri:
+                    view["uri"] = uri
+                _append_unique_warning(warnings, warning)
+            data: JSONObject = {
+                "app_key": app_key,
+                "app_name": app_name,
+                "app_icon": app_icon,
+                "icon_config": workspace_icon_config(app_icon),
+                **({"uri": app_uri} if app_uri else {}),
+                **({"visible_app": visible_app} if base_info is None and visible_app is not None else {}),
+                "can_create": can_create,
+                "import_capability": import_capability,
+                "accessible_views": accessible_views,
+            }
             return {
                 "profile": profile,
                 "ws_id": session_profile.selected_ws_id,
                 "ok": True,
                 "request_route": {"base_url": context.base_url, "qf_version": context.qf_version},
                 "warnings": warnings,
-                "data": {
-                    "app_key": app_key,
-                    "app_name": app_name,
-                    "app_icon": app_icon,
-                    "icon_config": workspace_icon_config(app_icon),
-                    **({"visible_app": visible_app} if base_info is None and visible_app is not None else {}),
-                    "can_create": can_create,
-                    "import_capability": import_capability,
-                    "accessible_views": accessible_views,
-                },
+                "data": data,
             }
 
         return self._run(profile, runner, tool_name='应用详情')
@@ -1048,6 +1082,11 @@ def _derive_editability(base_info: Any) -> tuple[JSONObject, list[JSONObject]]:
     }, warnings
 
 
+def _append_unique_warning(warnings: list[JSONObject], warning: JSONObject | None) -> None:
+    if warning and not any(item.get("code") == warning.get("code") for item in warnings):
+        warnings.append(warning)
+
+
 def _coerce_positive_int(value: Any) -> int | None:
     try:
         number = int(value)

package/src/qingflow_mcp/tools/login_link_tools.py

@@ -0,0 +1,134 @@
+from __future__ import annotations
+
+import posixpath
+from typing import Any
+from urllib.parse import parse_qs, unquote, urlencode, urlsplit
+
+from mcp.server.fastmcp import FastMCP
+
+from ..config import DEFAULT_PROFILE, get_web_base_url
+from ..errors import QingflowApiError
+from ..json_types import JSONObject
+from ..resource_uri import parse_resource_path
+from .base import ToolBase
+
+LOGIN_LINK_DESCRIPTION = (
+    "轻流页面入口：查看页面、继续编辑、处理业务、查看结果或进入工作区（open/view/visit page in browser，login）。"
+    "从 AI 对话进入页面时，使用当前 MCP 身份和工作区生成短时（约 5 分钟）一次性免登录链接。"
+    "redirect_path 可选：传已确认的站内业务路径，可带 query/hash；省略进入首页，不接受外部地址或认证入口。"
+    "纯数据查询无需调用；用户指定页面但路径未知时先定位，不猜路径或静默改为首页。"
+    "返回 url 和毫秒整数 expires_at；必要安全验证及原有页面权限仍然生效。"
+    "交付应用包、应用、视图或安装结果时，目标浏览器登录态未知则默认用资源 uri 的同源 pathname 独立签发；"
+    "只有用户确认同一浏览器、网页域名、账号和工作区已登录时才直接交付稳定 uri。"
+    "调用过本工具或 Agent 自动化浏览器已登录不等于用户浏览器已登录；纯中间查询不签发。"
+    "用户要链接时仅交付，不提前消费；要求打开时才用浏览器打开返回的完整链接。"
+)
+
+
+def validate_redirect_path(value: str) -> str:
+    """只接受业务站内路径；解码仅用于校验，不改写查询参数或片段。"""
+    if not value or not value.strip():
+        return ""
+    auth_paths = (
+        "/mcp-login", "/qingclaw-login", "/passport", "/login-third-party", "/third-party-login",
+        "/third-party", "/oidc-authorize", "/oauth2/authorize", "/authorize", "/sso", "/ldap",
+        "/pcWechatAutoBind", "/code-login", "/work-wechat-error", "/ding-check-ws",
+    )
+    try:
+        path = unquote(urlsplit(value).path, errors="strict")
+        if (
+            not value.startswith("/") or value.startswith("//") or path.startswith("//")
+            or "\\" in value or "\\" in path or any(c in path for c in "%?#")
+            or any(ord(c) < 32 or ord(c) == 127 for c in value + path)
+        ):
+            raise ValueError
+        normalized = posixpath.normpath(path)
+        if any(normalized == p or normalized.startswith(p + "/") for p in auth_paths):
+            raise ValueError
+    except (ValueError, UnicodeError):
+        raise QingflowApiError(category="validation", message="redirect_path 必须是站内业务路径，不能指向认证入口") from None
+    return value
+
+
+class LoginLinkTools(ToolBase):
+    """登录链接工具（中文名：临时免登录链接）。
+
+    类型：会话辅助工具。
+    主要职责：
+    1. 为当前 MCP 用户签发进入当前工作区网页端的临时免登录链接；
+    2. 链接短时（5 分钟）、一次性，不携带 MCP 长期凭证或正式登录 token。
+
+    安全约束：
+    - 用户身份仅来自当前 MCP 会话（业务 token），不接收任何 uid 参数；
+    - 目标工作区固定为当前选中的 MCP 工作区，不开放任意跳转地址。
+    """
+
+    def register(self, mcp: FastMCP) -> None:
+        """注册当前工具到 MCP 服务。"""
+
+        @mcp.tool(description=LOGIN_LINK_DESCRIPTION)
+        def get_login_link(profile: str = DEFAULT_PROFILE, redirect_path: str = "") -> dict[str, Any]:
+            return self.get_login_link(profile=profile, redirect_path=redirect_path)
+
+    def get_login_link(self, *, profile: str, redirect_path: str = "") -> JSONObject:
+        """执行工具方法逻辑。"""
+
+        def runner(session_profile, context):
+            requested_target = redirect_path or ""
+            if requested_target.startswith("/resources"):
+                target = requested_target
+                try:
+                    resource = parse_resource_path(target)
+                except ValueError:
+                    raise QingflowApiError(
+                        category="validation",
+                        message="redirect_path 必须是合法的稳定资源路径",
+                    ) from None
+                if resource.ws_id != session_profile.selected_ws_id:
+                    raise QingflowApiError(
+                        category="validation",
+                        message="redirect_path 的资源工作区必须与当前选中工作区一致",
+                    )
+            else:
+                target = validate_redirect_path(requested_target)
+            web_base_url = get_web_base_url()
+            result = self.backend.request(
+                "POST",
+                context,
+                "/mcp/auth/login-link",
+                json_body={"wsId": session_profile.selected_ws_id},
+            )
+            # 后端仅提供票据，网页地址由 MCP 配置确定，避免工作区域名为空。
+            try:
+                source_url = result.get("url") if isinstance(result, dict) else None
+                if not isinstance(source_url, str):
+                    raise ValueError
+                tickets = parse_qs(urlsplit(source_url).query, keep_blank_values=True).get("ticket", [])
+                if len(tickets) != 1 or not tickets[0].strip():
+                    raise ValueError
+                # 后端可能把毫秒时间戳序列化为字符串，不能截断浮点数或伪造缺失值。
+                expiry = result.get("expiresAt")
+                if type(expiry) is int:
+                    expires_at = expiry
+                elif isinstance(expiry, str) and expiry.isascii() and expiry.isdecimal():
+                    expires_at = int(expiry)
+                else:
+                    raise ValueError
+                if expires_at <= 0:
+                    raise ValueError
+            except ValueError:
+                # 不把原始响应或票据放入错误信息。
+                raise QingflowApiError(
+                    category="backend",
+                    message="INVALID_LOGIN_LINK: 后端免登录链接的票据或有效期无效，请重新获取",
+                ) from None
+            query = {"ticket": tickets[0]}
+            if target:
+                query["redirect_path"] = target
+            return {
+                "url": f"{web_base_url}/mcp-login?{urlencode(query)}",
+                "expires_at": expires_at,
+            }
+
+        # require_workspace=True：目标工作区恒为当前 MCP 会话选中的工作区
+        return self._run(profile, runner, tool_name="获取临时免登录链接")

package/src/qingflow_mcp/tools/resource_read_tools.py

@@ -6,6 +6,7 @@ from typing import Any
 from ..errors import QingflowApiError, backend_code_int, is_auth_like_error, raise_tool_error
 from ..json_types import JSONObject
 from ..list_type_labels import SYSTEM_VIEW_DEFINITIONS
+from ..resource_uri import try_build_resource_uri
 from ..solution.compiler.icon_utils import workspace_icon_config
 from .app_tools import _analysis_supported_for_view_type
 from .base import ToolBase
@@ -227,6 +228,17 @@ class ResourceReadTools(ToolBase):
                             "message": f"view_get supports exporting `{view_id}`, but the export call still needs an explicit `app_key` from the parent app context.",
                         }
                     )
+            uri = None
+            if resolved_app_key:
+                uri, uri_warning = try_build_resource_uri(
+                    ws_id=session_profile.selected_ws_id,
+                    resource_type="view",
+                    app_key=resolved_app_key,
+                    view_kind="custom",
+                    view_key=view_key,
+                )
+                if uri_warning:
+                    warnings.append(uri_warning)
             return {
                 "profile": profile,
                 "ws_id": session_profile.selected_ws_id,
@@ -249,6 +261,7 @@ class ResourceReadTools(ToolBase):
                     ],
                     "analysis_supported": _analysis_supported_for_view_type(raw_view_type or None),
                     "export_capability": export_capability,
+                    **({"uri": uri} if uri else {}),
                 },
             }