@qingflow-tech/qingflow-cli 1.1.47-beta.3 → 1.1.47-beta.4

package/README.md

@@ -7,7 +7,7 @@ Qingflow CLI 是轻流面向开发者和 AI Agent 的命令行工具。它把轻
 ## 安装
 
 ```bash
-npm install @qingflow-tech/qingflow-cli@1.1.47-beta.3
+npm install @qingflow-tech/qingflow-cli@1.1.47-beta.4
 ```
 
 推荐从官网复制这一条一键安装 Qingflow CLI：
@@ -21,7 +21,7 @@ npx qingflow-cli@latest install
 ## 运行
 
 ```bash
-npx -y -p @qingflow-tech/qingflow-cli@1.1.47-beta.3 qingflow
+npx -y -p @qingflow-tech/qingflow-cli@1.1.47-beta.4 qingflow
 ```
 
 全局安装后可以直接运行：
@@ -62,7 +62,7 @@ qingflow-skills install --agent codex --scope user
 如果你通过一次性 `npx -p` 执行 skills 安装，建议加 `--copy`，避免 symlink 指向 npm 临时执行缓存：
 
 ```bash
-npx -y -p @qingflow-tech/qingflow-cli@1.1.47-beta.3 qingflow-skills install --agent codex --scope user --copy
+npx -y -p @qingflow-tech/qingflow-cli@1.1.47-beta.4 qingflow-skills install --agent codex --scope user --copy
 ```
 
 `qingflow-skills install` 默认使用 symlink，且遇到同名 skill 不会覆盖；只有显式传入 `--force` 才会替换。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qingflow-tech/qingflow-cli",
-  "version": "1.1.47-beta.3",
+  "version": "1.1.47-beta.4",
   "description": "Human-friendly Qingflow command line interface for auth, record operations, import, tasks, and stable builder flows.",
   "license": "MIT",
   "type": "module",

package/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "qingflow-mcp"
-version = "1.1.47b3"
+version = "1.1.47b4"
 description = "User-authenticated MCP server for Qingflow"
 readme = "README.md"
 license = "MIT"

package/skills/qingflow-cli/SKILL.md

@@ -130,6 +130,8 @@ qingflow --json auth whoami
 
 默认只交付用户请求的主要结果：安装方案默认提供应用包入口；直接创建或修改应用、视图时提供对应入口；用户明确要求多个主要对象时分别提供。使用业务结果中的稳定 `uri`，按 URI 去重，不为全部子资源预签票据。主要对象没有可靠 URI 时说明限制，不猜地址，也不替换为不相关页面。
 
+CLI 返回的稳定 `uri` 以 `QINGFLOW_BASE_URL` 为当前环境来源：去除末尾 API 路径后使用同一 HTTP(S) 域名；仅当该变量为空时回退 `https://qingflow.com`。若非空配置非法，保留 URI 不可用诊断，不自行替换或拼接其他环境地址。
+
 部分成功时仅交付已确认成功且可定位的主要结果，保留失败或未验证说明。纯数据问答、中间读取、失败资源和删除操作不自动签发；用户明确要求不提供链接时遵从。用户明确要求查看或打开页面时也使用已确认的路径。
 
 目标浏览器登录态未知时，临近交付取该 URI 的 pathname 执行：

package/src/qingflow_mcp/cli/main.py

@@ -2,11 +2,13 @@ from __future__ import annotations
 
 import argparse
 import json
+import os
 import sys
 from typing import Any, Callable, TextIO
 
 from ..errors import QingflowApiError, backend_code_value_int, message_looks_like_invalid_token
 from ..public_surface import cli_public_tool_spec_from_namespace
+from ..resource_uri import cli_resource_base_url
 from ..response_trim import resolve_cli_tool_name, trim_error_response, trim_public_response
 from ..tools.ai_builder_tools import _attach_builder_apply_envelope
 from ..version import get_cli_version, get_cli_version_info
@@ -94,7 +96,8 @@ def run(
         context = context_factory()
         if not bool(args.json):
             _emit_cli_effective_context_notice(args, context, stream=err)
-        result = handler(args, context)
+        with cli_resource_base_url(os.getenv("QINGFLOW_BASE_URL") or ""):
+            result = handler(args, context)
     except SystemExit as exc:
         return int(exc.code or 0)
     except RuntimeError as exc:

package/src/qingflow_mcp/resource_uri.py

@@ -1,17 +1,24 @@
 from __future__ import annotations
 
 import re
+from collections.abc import Iterator
+from contextlib import contextmanager
+from contextvars import ContextVar
 from dataclasses import dataclass
 from typing import Any
 from urllib.parse import quote, unquote, urlsplit, urlunsplit
 
-from .config import get_web_base_url
+from .config import DEFAULT_WEB_BASE_URL, get_web_base_url
 from .errors import QingflowApiError
 from .json_types import JSONObject
 
 
 SYSTEM_VIEW_NAMES = frozenset({"all", "initiated", "todo", "done", "cc"})
 _ENCODED_OCTET = re.compile(r"%[0-9A-Fa-f]{2}")
+_CLI_RESOURCE_BASE_URL: ContextVar[str | None] = ContextVar(
+    "qingflow_cli_resource_base_url",
+    default=None,
+)
 
 
 @dataclass(frozen=True, slots=True)
@@ -24,6 +31,16 @@ class ResourcePath:
     view_key: str | None = None
 
 
+@contextmanager
+def cli_resource_base_url(value: str) -> Iterator[None]:
+    """让一次 CLI 调用的资源 URI 使用 QINGFLOW_BASE_URL 对应的网页环境。"""
+    token = _CLI_RESOURCE_BASE_URL.set(value)
+    try:
+        yield
+    finally:
+        _CLI_RESOURCE_BASE_URL.reset(token)
+
+
 def validate_resource_identity(value: object, field: str = "resource_id") -> str:
     """按资源 URI 单路径段合同校验并返回规范身份，不读取网页域名配置。"""
     return _validate_identity(value, field)
@@ -64,7 +81,7 @@ def build_resource_uri(
         path = f"/resources/ws/{workspace}/app/{app_segment}/view/{view_kind}/{view_segment}"
     else:
         raise ValueError("resource_type is not supported")
-    return f"{_normalize_web_origin(web_origin) if web_origin is not None else get_web_base_url()}{path}"
+    return f"{_resolve_web_origin(web_origin)}{path}"
 
 
 def parse_resource_path(value: str) -> ResourcePath:
@@ -142,6 +159,45 @@ def _normalize_web_origin(value: str) -> str:
     return urlunsplit((parsed.scheme, parsed.netloc, "", "", ""))
 
 
+def _resolve_web_origin(web_origin: str | None) -> str:
+    if web_origin is not None:
+        return _normalize_web_origin(web_origin)
+    cli_base_url = _CLI_RESOURCE_BASE_URL.get()
+    if cli_base_url is None:
+        return get_web_base_url()
+    return _web_origin_from_api_base_url(cli_base_url)
+
+
+def _web_origin_from_api_base_url(value: str) -> str:
+    normalized = value.strip()
+    if not normalized:
+        return DEFAULT_WEB_BASE_URL
+    try:
+        parsed = urlsplit(normalized)
+        host = parsed.hostname or ""
+        valid_host = bool(host) and (":" in host or all(
+            re.fullmatch(r"[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?", label)
+            for label in host.rstrip(".").split(".")
+        ))
+        if (
+            parsed.scheme not in {"http", "https"}
+            or not valid_host
+            or host.lower() in {"null", "undefined"}
+            or parsed.username is not None
+            or parsed.password is not None
+            or parsed.query
+            or parsed.fragment
+            or any(character.isspace() or ord(character) < 32 for character in normalized)
+        ):
+            raise ValueError
+        _ = parsed.port
+        return _normalize_web_origin(urlunsplit((parsed.scheme, parsed.netloc, "", "", "")))
+    except ValueError:
+        raise QingflowApiError.config_error(
+            "QINGFLOW_BASE_URL 必须是有效的 HTTP(S) API 地址，不包含查询参数、片段或用户凭证"
+        ) from None
+
+
 def _identity_segment(value: object, field: str) -> str:
     raw = _validate_identity(value, field)
     return quote(raw, safe="")