@qingflow-tech/qingflow-cli 1.1.47-beta.5 → 1.1.48

package/src/qingflow_mcp/tools/app_tools.py

@@ -10,7 +10,6 @@ from ..config import DEFAULT_PROFILE
 from ..errors import QingflowApiError, backend_code_int, is_auth_like_error, raise_tool_error
 from ..json_types import JSONObject
 from ..list_type_labels import SYSTEM_VIEW_DEFINITIONS, get_app_publish_status_label
-from ..resource_uri import try_build_resource_uri
 from ..solution.compiler.icon_utils import workspace_icon_config
 from .base import ToolBase
 
@@ -47,15 +46,6 @@ class AppTools(ToolBase):
             unfiltered_count = len(items)
             if normalized_query:
                 items = self._filter_visible_apps(items, normalized_query)
-            for item in items:
-                uri, warning = try_build_resource_uri(
-                    ws_id=session_profile.selected_ws_id,
-                    resource_type="app",
-                    app_key=item.get("app_key"),
-                )
-                if uri:
-                    item["uri"] = uri
-                _append_unique_warning(warnings, warning)
             response = {
                 "profile": profile,
                 "ws_id": session_profile.selected_ws_id,
@@ -210,10 +200,9 @@ class AppTools(ToolBase):
                 if not _is_optional_app_metadata_error(exc):
                     raise
                 visible_app = self._resolve_visible_app(context, app_key)
-                if visible_app is None:
-                    raise
-                app_name = str(visible_app.get("app_name") or visible_app.get("title") or app_key).strip() or app_key
-                app_icon = str(visible_app.get("app_icon") or "").strip() or None
+                if visible_app is not None:
+                    app_name = str(visible_app.get("app_name") or visible_app.get("title") or app_key).strip() or app_key
+                    app_icon = str(visible_app.get("app_icon") or "").strip() or None
                 warnings.append(
                     _with_api_error_fields(
                         {
@@ -235,45 +224,22 @@ class AppTools(ToolBase):
             accessible_views.extend(custom_views)
             import_capability, import_warnings = _derive_import_capability(base_info)
             warnings.extend(import_warnings)
-            app_uri, uri_warning = try_build_resource_uri(
-                ws_id=session_profile.selected_ws_id,
-                resource_type="app",
-                app_key=app_key,
-            )
-            _append_unique_warning(warnings, uri_warning)
-            for view in accessible_views:
-                view_id = str(view.get("view_id") or "")
-                view_kind, separator, view_key = view_id.partition(":")
-                if not separator:
-                    continue
-                uri, warning = try_build_resource_uri(
-                    ws_id=session_profile.selected_ws_id,
-                    resource_type="view",
-                    app_key=app_key,
-                    view_kind=view_kind,
-                    view_key=view_key,
-                )
-                if uri:
-                    view["uri"] = uri
-                _append_unique_warning(warnings, warning)
-            data: JSONObject = {
-                "app_key": app_key,
-                "app_name": app_name,
-                "app_icon": app_icon,
-                "icon_config": workspace_icon_config(app_icon),
-                **({"uri": app_uri} if app_uri else {}),
-                **({"visible_app": visible_app} if base_info is None and visible_app is not None else {}),
-                "can_create": can_create,
-                "import_capability": import_capability,
-                "accessible_views": accessible_views,
-            }
             return {
                 "profile": profile,
                 "ws_id": session_profile.selected_ws_id,
                 "ok": True,
                 "request_route": {"base_url": context.base_url, "qf_version": context.qf_version},
                 "warnings": warnings,
-                "data": data,
+                "data": {
+                    "app_key": app_key,
+                    "app_name": app_name,
+                    "app_icon": app_icon,
+                    "icon_config": workspace_icon_config(app_icon),
+                    **({"visible_app": visible_app} if base_info is None and visible_app is not None else {}),
+                    "can_create": can_create,
+                    "import_capability": import_capability,
+                    "accessible_views": accessible_views,
+                },
             }
 
         return self._run(profile, runner, tool_name='应用详情')
@@ -1082,11 +1048,6 @@ def _derive_editability(base_info: Any) -> tuple[JSONObject, list[JSONObject]]:
     }, warnings
 
 
-def _append_unique_warning(warnings: list[JSONObject], warning: JSONObject | None) -> None:
-    if warning and not any(item.get("code") == warning.get("code") for item in warnings):
-        warnings.append(warning)
-
-
 def _coerce_positive_int(value: Any) -> int | None:
     try:
         number = int(value)

package/src/qingflow_mcp/tools/login_link_tools.py

@@ -6,30 +6,18 @@ from urllib.parse import parse_qs, unquote, urlencode, urlsplit
 
 from mcp.server.fastmcp import FastMCP
 
-from ..config import DEFAULT_PROFILE
+from ..config import DEFAULT_PROFILE, get_web_base_url
 from ..errors import QingflowApiError
 from ..json_types import JSONObject
-from ..resource_uri import parse_resource_path, resolve_resource_web_origin
 from .base import ToolBase
 
 LOGIN_LINK_DESCRIPTION = (
     "轻流页面入口：查看页面、继续编辑、处理业务、查看结果或进入工作区（open/view/visit page in browser，login）。"
     "从 AI 对话进入页面时，使用当前 MCP 身份和工作区生成短时（约 5 分钟）一次性免登录链接。"
     "redirect_path 可选：传已确认的站内业务路径，可带 query/hash；省略进入首页，不接受外部地址或认证入口。"
-    "用户指定页面但路径未知时先定位，不猜路径或静默改为首页。"
+    "纯数据查询无需调用；用户指定页面但路径未知时先定位，不猜路径或静默改为首页。"
     "返回 url 和毫秒整数 expires_at；必要安全验证及原有页面权限仍然生效。"
-    "创建、修改或安装轻流资源后，最终回复主动提供主要结果的可点击页面入口，无需等待用户再次索要；"
-    "采用“完成结果 + 查看入口”，文案使用“在轻流中查看应用／应用包／视图”，不默认称为“继续编辑”。"
-    "安装方案默认提供应用包入口；直接创建或修改应用、视图时提供对应入口；用户明确要求多个主要对象时分别提供。"
-    "使用业务结果中的稳定 `uri`，按 URI 去重，不为全部子资源预签票据；主要对象没有可靠 URI 时说明限制，不猜地址或替换为不相关页面。"
-    "部分成功时仅交付已确认成功且可定位的主要结果，保留失败或未验证说明；"
-    "纯数据问答、中间读取、失败资源和删除操作不自动签发，用户明确要求不提供链接时遵从。"
-    "目标浏览器登录态未知时，临近交付用资源 URI 的同源 pathname 为每个实际展示的入口分别签发，使用返回的完整 URL，不额外追问登录态。"
-    "只有已有用户确认同一浏览器、网页域名、账号和工作区已登录且无失效信号的事实时，才直接交付稳定 URI；"
-    "调用过本工具或 Agent 自动化浏览器已登录不等于用户浏览器已登录，已消费链接不可复用。"
-    "用户未要求打开时不提前打开或消费链接；要求打开时才用浏览器打开返回的完整链接。"
-    "签发失败时说明免登录链接未生成，提供标注“需登录”的稳定 URI 作为备用入口，不重做业务操作。"
-    "机器结果继续保留稳定 URI，临时登录链接仅用于面向用户交付。"
+    "用户要链接时仅交付，不提前消费；要求打开时才用浏览器打开返回的完整链接。"
 )
 
 
@@ -82,31 +70,15 @@ class LoginLinkTools(ToolBase):
         """执行工具方法逻辑。"""
 
         def runner(session_profile, context):
-            requested_target = redirect_path or ""
-            if requested_target.startswith("/resources"):
-                target = requested_target
-                try:
-                    resource = parse_resource_path(target)
-                except ValueError:
-                    raise QingflowApiError(
-                        category="validation",
-                        message="redirect_path 必须是合法的稳定资源路径",
-                    ) from None
-                if resource.ws_id != session_profile.selected_ws_id:
-                    raise QingflowApiError(
-                        category="validation",
-                        message="redirect_path 的资源工作区必须与当前选中工作区一致",
-                    )
-            else:
-                target = validate_redirect_path(requested_target)
-            web_base_url = resolve_resource_web_origin()
+            target = validate_redirect_path(redirect_path)
+            web_base_url = get_web_base_url()
             result = self.backend.request(
                 "POST",
                 context,
                 "/mcp/auth/login-link",
                 json_body={"wsId": session_profile.selected_ws_id},
             )
-            # 后端仅提供票据；CLI 使用 QINGFLOW_BASE_URL 对应网页环境，MCP 使用独立网页配置。
+            # 后端仅提供票据，网页地址由 MCP 配置确定，避免工作区域名为空。
             try:
                 source_url = result.get("url") if isinstance(result, dict) else None
                 if not isinstance(source_url, str):

package/src/qingflow_mcp/tools/record_tools.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import csv
 import html
 import mimetypes
 import json
@@ -33,7 +34,6 @@ from ..list_type_labels import (
 )
 from .base import ToolBase
 from .directory_tools import _directory_has_more, _directory_items
-from .csv_export import CsvShardWriter
 
 
 DEFAULT_QUERY_PAGE_SIZE = 50
@@ -2263,22 +2263,57 @@ class RecordTools(ToolBase):
                 }
 
             run_dir = _record_access_run_dir()
+            run_dir.mkdir(parents=True, exist_ok=True)
             header = ["record_id"] + [str(field["column_name"]) for field in fields_payload]
-            shard_writer = CsvShardWriter(
-                output_dir=run_dir,
-                file_prefix="records",
-                header=header,
-                shard_rows=DEFAULT_RECORD_ACCESS_SHARD_ROWS,
-            )
+            files: list[JSONObject] = []
+            shard_part = 0
+            shard_rows = 0
+            row_count = 0
+            file_handle: Any | None = None
+            writer: Any | None = None
+
+            def close_shard() -> None:
+                nonlocal file_handle, writer, shard_rows
+                if file_handle is None:
+                    return
+                path = Path(file_handle.name)
+                file_handle.close()
+                files.append(
+                    {
+                        "local_path": str(path),
+                        "row_count": shard_rows,
+                        "part": len(files) + 1,
+                    }
+                )
+                file_handle = None
+                writer = None
+                shard_rows = 0
+
+            def ensure_writer() -> Any:
+                nonlocal file_handle, writer, shard_part
+                if writer is not None:
+                    return writer
+                shard_part += 1
+                path = run_dir / f"records-{shard_part:04d}.csv"
+                file_handle = path.open("w", newline="", encoding="utf-8-sig")
+                writer = csv.writer(file_handle)
+                writer.writerow(header)
+                return writer
 
             def write_record(apply_id: int | None, answer_list: list[JSONValue]) -> None:
+                nonlocal row_count, shard_rows
                 if apply_id is None:
                     return
+                if shard_rows >= DEFAULT_RECORD_ACCESS_SHARD_ROWS:
+                    close_shard()
+                csv_writer = ensure_writer()
                 values: list[str] = [_public_record_id_text(apply_id) or ""]
                 for field in selected_fields:
                     answer = _find_answer_for_field(answer_list, field)
                     values.append(_record_access_csv_cell(_normalize_answer_field_value_for_output(answer, field)))
-                shard_writer.write(values)
+                csv_writer.writerow(values)
+                row_count += 1
+                shard_rows += 1
 
             current_page = 1
             has_more = False
@@ -2318,7 +2353,7 @@ class RecordTools(ToolBase):
                         break
                     page = fetch_page(current_page, BACKEND_RECORD_ACCESS_PAGE_SIZE)
             finally:
-                shard_writer.close_shard()
+                close_shard()
 
             if stopped_reason == "TIME_BUDGET_EXCEEDED":
                 warnings.append(_record_access_time_budget_warning(reported_total=reported_total, fetched_pages=fetched_pages))
@@ -2343,11 +2378,11 @@ class RecordTools(ToolBase):
                 "view_id": view_route.view_id,
                 "format": "csv",
                 "local_dir": str(run_dir),
-                "row_count": shard_writer.row_count,
+                "row_count": row_count,
                 "complete": complete,
                 "truncated": not complete,
                 "safe_for_final_conclusion": safe_for_final_conclusion,
-                "files": shard_writer.files,
+                "files": files,
                 "fields": fields_payload,
                 "warnings": warnings,
                 "verification": verification_payload,

package/src/qingflow_mcp/tools/resource_read_tools.py

@@ -6,7 +6,6 @@ from typing import Any
 from ..errors import QingflowApiError, backend_code_int, is_auth_like_error, raise_tool_error
 from ..json_types import JSONObject
 from ..list_type_labels import SYSTEM_VIEW_DEFINITIONS
-from ..resource_uri import try_build_resource_uri
 from ..solution.compiler.icon_utils import workspace_icon_config
 from .app_tools import _analysis_supported_for_view_type
 from .base import ToolBase
@@ -228,17 +227,6 @@ class ResourceReadTools(ToolBase):
                             "message": f"view_get supports exporting `{view_id}`, but the export call still needs an explicit `app_key` from the parent app context.",
                         }
                     )
-            uri = None
-            if resolved_app_key:
-                uri, uri_warning = try_build_resource_uri(
-                    ws_id=session_profile.selected_ws_id,
-                    resource_type="view",
-                    app_key=resolved_app_key,
-                    view_kind="custom",
-                    view_key=view_key,
-                )
-                if uri_warning:
-                    warnings.append(uri_warning)
             return {
                 "profile": profile,
                 "ws_id": session_profile.selected_ws_id,
@@ -261,7 +249,6 @@ class ResourceReadTools(ToolBase):
                     ],
                     "analysis_supported": _analysis_supported_for_view_type(raw_view_type or None),
                     "export_capability": export_capability,
-                    **({"uri": uri} if uri else {}),
                 },
             }
 

package/src/qingflow_mcp/cli/commands/data.py

@@ -1,107 +0,0 @@
-from __future__ import annotations
-
-import argparse
-
-from ..context import CliContext
-from .common import load_list_arg, require_list_arg, require_object_arg, raise_config_error
-
-
-def register(subparsers: argparse._SubParsersAction[argparse.ArgumentParser]) -> None:
-    parser = subparsers.add_parser("data", help="视图无关的应用数据面")
-    commands = parser.add_subparsers(dest="data_command", required=True, metavar="{query,get,insert,update,delete}")
-
-    query = commands.add_parser("query", help="分页查询应用数据")
-    query.add_argument("--app-key", required=True)
-    query.add_argument("--columns-file")
-    query.add_argument("--where-file")
-    query.add_argument("--sort-file")
-    query.add_argument("--search", default="")
-    query.add_argument("--page", type=int, default=1)
-    query.add_argument("--page-size", type=int, default=100)
-    query.add_argument("--no-schema", action="store_false", dest="include_schema", default=True)
-    query.add_argument("--all", action="store_true", dest="all_pages")
-    query.add_argument("--output", choices=("json", "csv"), default="json")
-    query.set_defaults(handler=_handle_query, format_hint="data_query")
-
-    get = commands.add_parser("get", help="读取单条应用数据")
-    get.add_argument("--app-key", required=True)
-    get.add_argument("--record-id", required=True)
-    get.add_argument("--no-schema", action="store_false", dest="include_schema", default=True)
-    get.set_defaults(handler=_handle_get, format_hint="data_get")
-
-    insert = commands.add_parser("insert", help="新增应用数据")
-    insert.add_argument("--app-key", required=True)
-    insert.add_argument("--items-file", required=True)
-    insert.add_argument("--no-schema", action="store_false", dest="include_schema", default=True)
-    insert.set_defaults(handler=_handle_insert, format_hint="data_insert")
-
-    update = commands.add_parser("update", help="更新应用数据")
-    update.add_argument("--app-key", required=True)
-    update.add_argument("--record-id", required=True)
-    update.add_argument("--fields-file", required=True)
-    update.add_argument("--no-schema", action="store_false", dest="include_schema", default=True)
-    update.set_defaults(handler=_handle_update, format_hint="data_update")
-
-    delete = commands.add_parser("delete", help="删除应用数据")
-    delete.add_argument("--app-key", required=True)
-    delete.add_argument(
-        "--record-ids", action="append", default=[], metavar="ID[,ID...]",
-        help="待删除记录 ID；支持逗号分隔，也可重复传入",
-    )
-    delete.add_argument("--record-ids-file", help="附加的记录 ID JSON 数组文件")
-    delete.set_defaults(handler=_handle_delete, format_hint="data_delete")
-
-
-def _handle_query(args: argparse.Namespace, context: CliContext) -> dict:
-    if args.all_pages != (args.output == "csv"):
-        raise_config_error(
-            "--all 与 --output csv 必须同时使用。",
-            fix_hint="使用 `qingflow data query ... --all --output csv`，普通分页查询不要传这两个参数。",
-        )
-    return context.data.data_query(
-        profile=args.profile,
-        app_key=args.app_key,
-        columns=load_list_arg(args.columns_file, option_name="--columns-file"),
-        where=load_list_arg(args.where_file, option_name="--where-file"),
-        sort=load_list_arg(args.sort_file, option_name="--sort-file"),
-        search=args.search,
-        page=args.page,
-        page_size=args.page_size,
-        include_schema=args.include_schema,
-        all_pages=args.all_pages,
-        output=args.output,
-    )
-
-
-def _handle_get(args: argparse.Namespace, context: CliContext) -> dict:
-    return context.data.data_get(
-        profile=args.profile, app_key=args.app_key, record_id=args.record_id, include_schema=args.include_schema
-    )
-
-
-def _handle_insert(args: argparse.Namespace, context: CliContext) -> dict:
-    return context.data.data_insert(
-        profile=args.profile, app_key=args.app_key,
-        items=require_list_arg(args.items_file, option_name="--items-file"), include_schema=args.include_schema,
-    )
-
-
-def _handle_update(args: argparse.Namespace, context: CliContext) -> dict:
-    return context.data.data_update(
-        profile=args.profile, app_key=args.app_key, record_id=args.record_id,
-        fields=require_object_arg(args.fields_file, option_name="--fields-file"), include_schema=args.include_schema,
-    )
-
-
-def _handle_delete(args: argparse.Namespace, context: CliContext) -> dict:
-    record_ids = [item.strip() for group in args.record_ids for item in group.split(",") if item.strip()]
-    record_ids.extend(load_list_arg(args.record_ids_file, option_name="--record-ids-file"))
-    if not record_ids:
-        raise_config_error(
-            "至少传入一个记录 ID。",
-            fix_hint="使用 `--record-ids ID[,ID...]`；也可附加 `--record-ids-file ids.json`。",
-        )
-    return context.data.data_delete(
-        profile=args.profile, app_key=args.app_key,
-        record_ids=record_ids,
-    )

package/src/qingflow_mcp/resource_uri.py

@@ -1,241 +0,0 @@
-from __future__ import annotations
-
-import re
-from collections.abc import Iterator
-from contextlib import contextmanager
-from contextvars import ContextVar
-from dataclasses import dataclass
-from typing import Any
-from urllib.parse import quote, unquote, urlsplit, urlunsplit
-
-from .config import DEFAULT_WEB_BASE_URL, get_web_base_url
-from .errors import QingflowApiError
-from .json_types import JSONObject
-
-
-SYSTEM_VIEW_NAMES = frozenset({"all", "initiated", "todo", "done", "cc"})
-_ENCODED_OCTET = re.compile(r"%[0-9A-Fa-f]{2}")
-_CLI_RESOURCE_BASE_URL: ContextVar[str | None] = ContextVar(
-    "qingflow_cli_resource_base_url",
-    default=None,
-)
-
-
-@dataclass(frozen=True, slots=True)
-class ResourcePath:
-    resource_type: str
-    ws_id: int
-    package_id: int | None = None
-    app_key: str | None = None
-    view_kind: str | None = None
-    view_key: str | None = None
-
-
-@contextmanager
-def cli_resource_base_url(value: str) -> Iterator[None]:
-    """让一次 CLI 调用的资源 URI 使用 QINGFLOW_BASE_URL 对应的网页环境。"""
-    token = _CLI_RESOURCE_BASE_URL.set(value)
-    try:
-        yield
-    finally:
-        _CLI_RESOURCE_BASE_URL.reset(token)
-
-
-def validate_resource_identity(value: object, field: str = "resource_id") -> str:
-    """按资源 URI 单路径段合同校验并返回规范身份，不读取网页域名配置。"""
-    return _validate_identity(value, field)
-
-
-def validate_positive_resource_id(value: object, field: str = "resource_id") -> int:
-    """按资源 URI 数字路径段合同校验正整数，不接受布尔值或浮点截断。"""
-    return int(_positive_int_segment(value, field))
-
-
-def build_resource_uri(
-    *,
-    ws_id: object,
-    resource_type: str,
-    package_id: object = None,
-    app_key: object = None,
-    view_kind: str | None = None,
-    view_key: object = None,
-    web_origin: str | None = None,
-) -> str:
-    """按固定公共合同构造资源 URI，不接受通用目标路由。"""
-    workspace = _positive_int_segment(ws_id, "ws_id")
-    if resource_type == "package":
-        path = f"/resources/ws/{workspace}/package/{_positive_int_segment(package_id, 'package_id')}"
-    elif resource_type == "app":
-        path = f"/resources/ws/{workspace}/app/{_identity_segment(app_key, 'app_key')}"
-    elif resource_type == "view":
-        app_segment = _identity_segment(app_key, "app_key")
-        if view_kind == "custom":
-            view_segment = _identity_segment(view_key, "view_key")
-        elif view_kind == "system":
-            name = str(view_key or "").strip()
-            if name not in SYSTEM_VIEW_NAMES:
-                raise ValueError("system view name is not supported")
-            view_segment = name
-        else:
-            raise ValueError("view_kind must be custom or system")
-        path = f"/resources/ws/{workspace}/app/{app_segment}/view/{view_kind}/{view_segment}"
-    else:
-        raise ValueError("resource_type is not supported")
-    return f"{resolve_resource_web_origin(web_origin)}{path}"
-
-
-def parse_resource_path(value: str) -> ResourcePath:
-    """严格解析资源 pathname，供免登录签发前校验工作区。"""
-    try:
-        parsed = urlsplit(value)
-        if parsed.scheme or parsed.netloc or parsed.query or parsed.fragment or parsed.path != value:
-            raise ValueError
-        parts = parsed.path.split("/")
-        if len(parts) < 6 or parts[:3] != ["", "resources", "ws"]:
-            raise ValueError
-        ws_id = int(_decode_segment(parts[3], "ws_id"))
-        if ws_id <= 0:
-            raise ValueError
-        if len(parts) == 6 and parts[4] == "package":
-            package_id = int(_decode_segment(parts[5], "package_id"))
-            if package_id <= 0:
-                raise ValueError
-            return ResourcePath("package", ws_id, package_id=package_id)
-        if len(parts) == 6 and parts[4] == "app":
-            return ResourcePath("app", ws_id, app_key=_decode_segment(parts[5], "app_key"))
-        if len(parts) == 9 and parts[4] == "app" and parts[6] == "view":
-            app_key = _decode_segment(parts[5], "app_key")
-            view_kind = parts[7]
-            view_key = _decode_segment(parts[8], "view_key")
-            if view_kind == "system" and view_key not in SYSTEM_VIEW_NAMES:
-                raise ValueError
-            if view_kind not in {"custom", "system"}:
-                raise ValueError
-            return ResourcePath("view", ws_id, app_key=app_key, view_kind=view_kind, view_key=view_key)
-    except (TypeError, ValueError, UnicodeError):
-        pass
-    raise ValueError("resource path is invalid")
-
-
-def try_build_resource_uri(**kwargs: Any) -> tuple[str | None, JSONObject | None]:
-    try:
-        return build_resource_uri(**kwargs), None
-    except (QingflowApiError, ValueError, UnicodeError) as error:
-        return None, {
-            "code": "RESOURCE_URI_UNAVAILABLE",
-            "message": f"resource URI was omitted because its identity or web origin is invalid: {error}",
-        }
-
-
-def _positive_int_segment(value: object, field: str) -> str:
-    if isinstance(value, bool):
-        raise ValueError(f"{field} must be a positive integer")
-    try:
-        parsed = int(value)
-    except (TypeError, ValueError):
-        raise ValueError(f"{field} must be a positive integer") from None
-    if parsed <= 0 or str(value).strip() != str(parsed):
-        raise ValueError(f"{field} must be a positive integer")
-    return str(parsed)
-
-
-def _normalize_web_origin(value: str) -> str:
-    try:
-        parsed = urlsplit(value.strip())
-        if (
-            parsed.scheme not in {"http", "https"}
-            or not parsed.hostname
-            or parsed.username is not None
-            or parsed.password is not None
-            or parsed.path not in {"", "/"}
-            or parsed.query
-            or parsed.fragment
-            or any(character.isspace() or ord(character) < 32 for character in value)
-        ):
-            raise ValueError
-        _ = parsed.port
-    except (AttributeError, ValueError):
-        raise ValueError("web_origin must be an absolute HTTP(S) origin") from None
-    return urlunsplit((parsed.scheme, parsed.netloc, "", "", ""))
-
-
-def resolve_resource_web_origin(web_origin: str | None = None) -> str:
-    """解析当前调用面的网页根地址；CLI 与 MCP 分别沿用各自的环境配置。"""
-    if web_origin is not None:
-        return _normalize_web_origin(web_origin)
-    cli_base_url = _CLI_RESOURCE_BASE_URL.get()
-    if cli_base_url is None:
-        return get_web_base_url()
-    return _web_origin_from_api_base_url(cli_base_url)
-
-
-def _web_origin_from_api_base_url(value: str) -> str:
-    normalized = value.strip()
-    if not normalized:
-        return DEFAULT_WEB_BASE_URL
-    try:
-        parsed = urlsplit(normalized)
-        host = parsed.hostname or ""
-        valid_host = bool(host) and (":" in host or all(
-            re.fullmatch(r"[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?", label)
-            for label in host.rstrip(".").split(".")
-        ))
-        if (
-            parsed.scheme not in {"http", "https"}
-            or not valid_host
-            or host.lower() in {"null", "undefined"}
-            or parsed.username is not None
-            or parsed.password is not None
-            or parsed.query
-            or parsed.fragment
-            or any(character.isspace() or ord(character) < 32 for character in normalized)
-        ):
-            raise ValueError
-        _ = parsed.port
-        return _normalize_web_origin(urlunsplit((parsed.scheme, parsed.netloc, "", "", "")))
-    except ValueError:
-        raise QingflowApiError.config_error(
-            "QINGFLOW_BASE_URL 必须是有效的 HTTP(S) API 地址，不包含查询参数、片段或用户凭证"
-        ) from None
-
-
-def _identity_segment(value: object, field: str) -> str:
-    raw = _validate_identity(value, field)
-    return quote(raw, safe="")
-
-
-def _decode_segment(value: str, field: str) -> str:
-    decoded = _validate_identity(unquote(value, errors="strict"), field)
-    if quote(decoded, safe="") != value:
-        raise ValueError(f"{field} must use canonical path encoding")
-    return decoded
-
-
-def _validate_identity(value: object, field: str) -> str:
-    source = str(value or "")
-    if any(ord(character) < 32 or ord(character) == 127 for character in source):
-        raise ValueError(f"{field} must be one safe path segment")
-    raw = source.strip()
-    if not raw:
-        raise ValueError(f"{field} is required")
-    current = raw
-    for _ in range(8):
-        if (
-            current in {".", ".."}
-            or any(character in current for character in "/\\?#")
-            or any(ord(character) < 32 or ord(character) == 127 for character in current)
-        ):
-            raise ValueError(f"{field} must be one safe path segment")
-        decoded = unquote(current, errors="strict")
-        if decoded == current:
-            return raw
-        current = decoded
-    if (
-        current in {".", ".."}
-        or any(character in current for character in "/\\?#")
-        or any(ord(character) < 32 or ord(character) == 127 for character in current)
-    ):
-        raise ValueError(f"{field} must be one safe path segment")
-    if _ENCODED_OCTET.search(current):
-        raise ValueError(f"{field} has excessive encoding")
-    return raw