@qingflow-tech/qingflow-cli 1.1.49 → 1.1.50

package/src/qingflow_mcp/tools/app_tools.py

@@ -10,6 +10,7 @@ from ..config import DEFAULT_PROFILE
 from ..errors import QingflowApiError, backend_code_int, is_auth_like_error, raise_tool_error
 from ..json_types import JSONObject
 from ..list_type_labels import SYSTEM_VIEW_DEFINITIONS, get_app_publish_status_label
+from ..resource_uri import try_build_resource_uri
 from ..solution.compiler.icon_utils import workspace_icon_config
 from .base import ToolBase
 
@@ -46,6 +47,15 @@ class AppTools(ToolBase):
             unfiltered_count = len(items)
             if normalized_query:
                 items = self._filter_visible_apps(items, normalized_query)
+            for item in items:
+                uri, warning = try_build_resource_uri(
+                    ws_id=session_profile.selected_ws_id,
+                    resource_type="app",
+                    app_key=item.get("app_key"),
+                )
+                if uri:
+                    item["uri"] = uri
+                _append_unique_warning(warnings, warning)
             response = {
                 "profile": profile,
                 "ws_id": session_profile.selected_ws_id,
@@ -200,9 +210,10 @@ class AppTools(ToolBase):
                 if not _is_optional_app_metadata_error(exc):
                     raise
                 visible_app = self._resolve_visible_app(context, app_key)
-                if visible_app is not None:
-                    app_name = str(visible_app.get("app_name") or visible_app.get("title") or app_key).strip() or app_key
-                    app_icon = str(visible_app.get("app_icon") or "").strip() or None
+                if visible_app is None:
+                    raise
+                app_name = str(visible_app.get("app_name") or visible_app.get("title") or app_key).strip() or app_key
+                app_icon = str(visible_app.get("app_icon") or "").strip() or None
                 warnings.append(
                     _with_api_error_fields(
                         {
@@ -224,22 +235,45 @@ class AppTools(ToolBase):
             accessible_views.extend(custom_views)
             import_capability, import_warnings = _derive_import_capability(base_info)
             warnings.extend(import_warnings)
+            app_uri, uri_warning = try_build_resource_uri(
+                ws_id=session_profile.selected_ws_id,
+                resource_type="app",
+                app_key=app_key,
+            )
+            _append_unique_warning(warnings, uri_warning)
+            for view in accessible_views:
+                view_id = str(view.get("view_id") or "")
+                view_kind, separator, view_key = view_id.partition(":")
+                if not separator:
+                    continue
+                uri, warning = try_build_resource_uri(
+                    ws_id=session_profile.selected_ws_id,
+                    resource_type="view",
+                    app_key=app_key,
+                    view_kind=view_kind,
+                    view_key=view_key,
+                )
+                if uri:
+                    view["uri"] = uri
+                _append_unique_warning(warnings, warning)
+            data: JSONObject = {
+                "app_key": app_key,
+                "app_name": app_name,
+                "app_icon": app_icon,
+                "icon_config": workspace_icon_config(app_icon),
+                **({"uri": app_uri} if app_uri else {}),
+                **({"visible_app": visible_app} if base_info is None and visible_app is not None else {}),
+                "can_create": can_create,
+                "import_capability": import_capability,
+                "accessible_views": accessible_views,
+            }
             return {
                 "profile": profile,
                 "ws_id": session_profile.selected_ws_id,
                 "ok": True,
                 "request_route": {"base_url": context.base_url, "qf_version": context.qf_version},
                 "warnings": warnings,
-                "data": {
-                    "app_key": app_key,
-                    "app_name": app_name,
-                    "app_icon": app_icon,
-                    "icon_config": workspace_icon_config(app_icon),
-                    **({"visible_app": visible_app} if base_info is None and visible_app is not None else {}),
-                    "can_create": can_create,
-                    "import_capability": import_capability,
-                    "accessible_views": accessible_views,
-                },
+                "data": data,
             }
 
         return self._run(profile, runner, tool_name='应用详情')
@@ -1048,6 +1082,11 @@ def _derive_editability(base_info: Any) -> tuple[JSONObject, list[JSONObject]]:
     }, warnings
 
 
+def _append_unique_warning(warnings: list[JSONObject], warning: JSONObject | None) -> None:
+    if warning and not any(item.get("code") == warning.get("code") for item in warnings):
+        warnings.append(warning)
+
+
 def _coerce_positive_int(value: Any) -> int | None:
     try:
         number = int(value)

package/src/qingflow_mcp/tools/csv_export.py

@@ -0,0 +1,168 @@
+from __future__ import annotations
+
+import csv
+import json
+import time
+from pathlib import Path
+from typing import Any, Callable
+
+from ..json_types import JSONObject
+
+
+PageFetcher = Callable[[int, int], JSONObject]
+RowProjector = Callable[[JSONObject], list[str]]
+
+
+class CsvPageFailure(RuntimeError):
+    """后续分页返回结构化业务错误；已写文件保留为不完整结果。"""
+
+    def __init__(self, payload: JSONObject) -> None:
+        super().__init__(str(payload.get("message") or "分页请求失败"))
+        self.payload = payload
+
+
+class CsvShardWriter:
+    """视图无关的 UTF-8 BOM CSV 分片写入器。"""
+
+    def __init__(self, *, output_dir: Path, file_prefix: str, header: list[str], shard_rows: int) -> None:
+        self.output_dir = output_dir
+        self.file_prefix = file_prefix
+        self.header = header
+        self.shard_rows = shard_rows
+        self.files: list[JSONObject] = []
+        self.row_count = 0
+        self._part = 0
+        self._current_rows = 0
+        self._file: Any | None = None
+        self._writer: Any | None = None
+        output_dir.mkdir(parents=True, exist_ok=True)
+
+    def write(self, values: list[str]) -> None:
+        if self._current_rows >= self.shard_rows:
+            self.close_shard()
+        self._ensure_writer().writerow(values)
+        self._current_rows += 1
+        self.row_count += 1
+
+    def close_shard(self) -> None:
+        if self._file is None:
+            return
+        path = Path(self._file.name)
+        self._file.close()
+        self.files.append({"local_path": str(path), "row_count": self._current_rows, "part": len(self.files) + 1})
+        self._file = None
+        self._writer = None
+        self._current_rows = 0
+
+    def _ensure_writer(self) -> Any:
+        if self._writer is not None:
+            return self._writer
+        self._part += 1
+        path = self.output_dir / f"{self.file_prefix}-{self._part:04d}.csv"
+        self._file = path.open("w", newline="", encoding="utf-8-sig")
+        self._writer = csv.writer(self._file)
+        self._writer.writerow(self.header)
+        return self._writer
+
+
+def export_csv_pages(
+    *,
+    fetch_page: PageFetcher,
+    header: list[str],
+    project_row: RowProjector,
+    output_dir: Path,
+    file_prefix: str,
+    page_size: int,
+    shard_rows: int,
+    time_budget_seconds: float,
+) -> JSONObject:
+    """执行与业务权限无关的分页、CSV 分片和时间预算控制。"""
+    output_dir.mkdir(parents=True, exist_ok=True)
+    deadline = time.monotonic() + time_budget_seconds
+    files: list[JSONObject] = []
+    row_count = 0
+    fetched_pages = 0
+    current_page = 1
+    file_handle: Any | None = None
+    writer: Any | None = None
+    current_rows = 0
+    part = 0
+    has_more = False
+    stopped_reason: str | None = None
+    page_error: JSONObject | None = None
+
+    def close_file() -> None:
+        nonlocal file_handle, writer, current_rows
+        if file_handle is None:
+            return
+        path = Path(file_handle.name)
+        file_handle.close()
+        files.append({"local_path": str(path), "row_count": current_rows, "part": len(files) + 1})
+        file_handle = None
+        writer = None
+        current_rows = 0
+
+    def get_writer() -> Any:
+        nonlocal file_handle, writer, part
+        if writer is not None:
+            return writer
+        part += 1
+        path = output_dir / f"{file_prefix}-{part:04d}.csv"
+        file_handle = path.open("w", newline="", encoding="utf-8-sig")
+        writer = csv.writer(file_handle)
+        writer.writerow(header)
+        return writer
+
+    try:
+        while True:
+            page = fetch_page(current_page, page_size)
+            records = page.get("records") if isinstance(page, dict) else None
+            container = records if isinstance(records, dict) else page
+            raw_items = container.get("items", container.get("list", [])) if isinstance(container, dict) else []
+            items = raw_items if isinstance(raw_items, list) else []
+            has_more = bool(container.get("has_more")) if isinstance(container, dict) else False
+            for item in items:
+                if not isinstance(item, dict):
+                    continue
+                if current_rows >= shard_rows:
+                    close_file()
+                get_writer().writerow(project_row(item))
+                current_rows += 1
+                row_count += 1
+            fetched_pages += 1
+            if not has_more:
+                break
+            if time.monotonic() >= deadline:
+                stopped_reason = "TIME_BUDGET_EXCEEDED"
+                break
+            current_page += 1
+    except CsvPageFailure as exception:
+        stopped_reason = "PAGE_FETCH_FAILED"
+        page_error = exception.payload
+    except Exception:
+        # 已落盘分片仍是有效的部分结果；调用方据此禁止形成完整性结论。
+        stopped_reason = "PAGE_FETCH_FAILED"
+    finally:
+        close_file()
+
+    complete = stopped_reason is None and not has_more
+    result: JSONObject = {
+        "files": files,
+        "row_count": row_count,
+        "complete": complete,
+        "truncated": not complete,
+        "safe_for_final_conclusion": complete,
+        "fetched_pages": fetched_pages,
+        "stopped_reason": stopped_reason,
+    }
+    if page_error is not None:
+        result["page_error"] = page_error
+    return result
+
+
+def csv_cell(value: Any) -> str:
+    if value is None:
+        return ""
+    if isinstance(value, (dict, list)):
+        return json.dumps(value, ensure_ascii=False, separators=(",", ":"))
+    return str(value)

package/src/qingflow_mcp/tools/data_tools.py

@@ -0,0 +1,284 @@
+from __future__ import annotations
+
+from datetime import datetime
+from pathlib import Path
+from typing import Any, Literal, TypedDict
+
+from mcp.server.fastmcp import FastMCP
+
+from ..backend_client import BackendRequestContext
+from ..config import DEFAULT_PROFILE
+from ..errors import QingflowApiError, raise_tool_error
+from ..json_types import JSONObject, JSONValue
+from .base import ToolBase
+from .csv_export import CsvPageFailure, csv_cell, export_csv_pages
+
+
+DATA_PAGE_SIZE = 1000
+DATA_CSV_SHARD_ROWS = 20_000
+DATA_UNBOUNDED_ROW_THRESHOLD = 50_000
+DATA_CSV_TIME_BUDGET_SECONDS = 55.0
+
+DataFilterOperator = Literal[
+    "eq", "ne", "contains", "not_contains", "gt", "gte", "lt", "lte", "in", "not_in"
+]
+DataSortDirection = Literal["asc", "desc"]
+
+
+class DataWhereItem(TypedDict):
+    """数据面筛选项；in/not_in 使用数组，其余操作符使用单值。"""
+
+    field_id: int
+    op: DataFilterOperator
+    value: JSONValue
+
+
+class DataSortItem(TypedDict):
+    """数据面排序项。"""
+
+    field_id: int
+    direction: DataSortDirection
+
+
+class DataInsertItem(TypedDict):
+    """数据面新增项，fields 的键为字符串形式 field_id。"""
+
+    fields: dict[str, JSONValue]
+
+
+class DataTools(ToolBase):
+    """视图无关的应用数据面工具。"""
+
+    def register(self, mcp: FastMCP) -> None:
+        @mcp.tool()
+        def data_query(
+            profile: str = DEFAULT_PROFILE,
+            app_key: str = "",
+            columns: list[int] | None = None,
+            where: list[DataWhereItem] | None = None,
+            sort: list[DataSortItem] | None = None,
+            search: str = "",
+            page: int = 1,
+            page_size: int = 100,
+            include_schema: bool = True,
+            all_pages: bool = False,
+            output: str = "json",
+        ) -> JSONObject:
+            """按字段 ID 查询应用数据；先读取 field_capabilities 再构造 where 和 sort。"""
+            return self.data_query(
+                profile=profile, app_key=app_key, columns=columns or [], where=where or [], sort=sort or [],
+                search=search, page=page, page_size=page_size, include_schema=include_schema,
+                all_pages=all_pages, output=output,
+            )
+
+        @mcp.tool()
+        def data_get(
+            profile: str = DEFAULT_PROFILE, app_key: str = "", record_id: str = "", include_schema: bool = True
+        ) -> JSONObject:
+            return self.data_get(profile=profile, app_key=app_key, record_id=record_id, include_schema=include_schema)
+
+        @mcp.tool()
+        def data_insert(
+            profile: str = DEFAULT_PROFILE, app_key: str = "", items: list[DataInsertItem] | None = None,
+            include_schema: bool = True,
+        ) -> JSONObject:
+            """新增应用数据；每项形如 {"fields": {"字段ID": 值}}。"""
+            return self.data_insert(profile=profile, app_key=app_key, items=items or [], include_schema=include_schema)
+
+        @mcp.tool()
+        def data_update(
+            profile: str = DEFAULT_PROFILE, app_key: str = "", record_id: str = "",
+            fields: dict | None = None, include_schema: bool = True,
+        ) -> JSONObject:
+            return self.data_update(
+                profile=profile, app_key=app_key, record_id=record_id, fields=fields or {},
+                include_schema=include_schema,
+            )
+
+        @mcp.tool()
+        def data_delete(
+            profile: str = DEFAULT_PROFILE, app_key: str = "", record_ids: list[str | int] | None = None,
+        ) -> JSONObject:
+            return self.data_delete(profile=profile, app_key=app_key, record_ids=record_ids or [])
+
+    def data_query(
+        self, *, profile: str, app_key: str, columns: list[int], where: list[DataWhereItem],
+        sort: list[DataSortItem],
+        search: str = "", page: int = 1, page_size: int = 100, include_schema: bool = True,
+        all_pages: bool = False, output: str = "json",
+    ) -> JSONObject:
+        self._require_app_key(app_key)
+        if all_pages and output != "csv":
+            raise_tool_error(QingflowApiError.config_error("all_pages 仅支持 output=csv"))
+
+        def runner(session_profile, context):
+            body: JSONObject = {
+                "page": page, "page_size": page_size, "columns": columns, "where": where, "sort": sort,
+                "search": search, "include_schema": include_schema,
+            }
+            if not all_pages:
+                return self._attach_context(
+                    self._request_data_plane(context, "POST", self._base_path(app_key) + "/query", json_body=body),
+                    profile, session_profile.selected_ws_id,
+                )
+            return self._export_all(
+                context=context, profile=profile, ws_id=session_profile.selected_ws_id, app_key=app_key,
+                body=body, has_scope=bool(where or search),
+            )
+
+        return self._run(profile, runner, tool_name="数据面查询")
+
+    def data_get(self, *, profile: str, app_key: str, record_id: str | int, include_schema: bool = True) -> JSONObject:
+        self._require_app_key(app_key)
+        self._require_record_id(record_id)
+        return self._run(
+            profile,
+            lambda session_profile, context: self._attach_context(
+                self._request_data_plane(
+                    context, "GET", f"{self._base_path(app_key)}/{record_id}",
+                    params={"include_schema": include_schema},
+                ), profile, session_profile.selected_ws_id,
+            ),
+            tool_name="数据面单条读取",
+        )
+
+    def data_insert(
+        self, *, profile: str, app_key: str, items: list[DataInsertItem], include_schema: bool = True
+    ) -> JSONObject:
+        self._require_app_key(app_key)
+        return self._write(profile, app_key, "POST", self._base_path(app_key), {"items": items, "include_schema": include_schema}, "数据面新增")
+
+    def data_update(
+        self, *, profile: str, app_key: str, record_id: str | int, fields: dict, include_schema: bool = True
+    ) -> JSONObject:
+        self._require_app_key(app_key)
+        self._require_record_id(record_id)
+        return self._write(
+            profile, app_key, "POST", f"{self._base_path(app_key)}/{record_id}/update",
+            {"fields": fields, "include_schema": include_schema}, "数据面更新",
+        )
+
+    def data_delete(self, *, profile: str, app_key: str, record_ids: list[str | int]) -> JSONObject:
+        self._require_app_key(app_key)
+        return self._write(profile, app_key, "POST", self._base_path(app_key) + "/delete", {"record_ids": record_ids}, "数据面删除")
+
+    def _write(self, profile: str, app_key: str, method: str, path: str, body: JSONObject, tool_name: str) -> JSONObject:
+        return self._run(
+            profile,
+            lambda session_profile, context: self._attach_context(
+                self._request_data_plane(context, method, path, json_body=body), profile, session_profile.selected_ws_id,
+            ),
+            tool_name=tool_name,
+        )
+
+    def _request_data_plane(
+        self, context: BackendRequestContext, method: str, path: str, *, params: JSONObject | None = None,
+        json_body: JSONValue = None,
+    ) -> JSONObject:
+        raw = self.backend.request(method, context, path, params=params, json_body=json_body, unwrap=False)
+        if not isinstance(raw, dict):
+            raise QingflowApiError(category="backend", message="数据面返回了非对象响应")
+        code = raw.get("code")
+        payload = raw.get("data")
+        result: JSONObject = dict(payload) if isinstance(payload, dict) else {}
+        success = code in (None, 0, 200, 20000) or str(code).lower() in {"success", "ok"}
+        result.setdefault("ok", success)
+        result.setdefault("status", "success" if success else "failed")
+        result.setdefault("hints", [])
+        if not success:
+            result.setdefault("message", str(raw.get("message") or raw.get("msg") or "数据面请求失败"))
+            result.setdefault("backend_code", code)
+        return result
+
+    def _export_all(
+        self, *, context: BackendRequestContext, profile: str, ws_id: int | None, app_key: str,
+        body: JSONObject, has_scope: bool,
+    ) -> JSONObject:
+        probe_body = dict(body)
+        probe_body.update({"page": 1, "page_size": 1, "include_schema": True})
+        probe = self._request_data_plane(context, "POST", self._base_path(app_key) + "/query", json_body=probe_body)
+        if probe.get("ok") is False:
+            # 探测请求没有产生文件，保留后端结构化错误，不把失败误报为空数据成功。
+            return self._attach_context(probe, profile, ws_id)
+        records = probe.get("records") if isinstance(probe.get("records"), dict) else {}
+        total = records.get("total") if isinstance(records, dict) else None
+        if isinstance(total, int) and total > DATA_UNBOUNDED_ROW_THRESHOLD and not has_scope:
+            return self._attach_context({
+                "ok": True, "status": "needs_scope", "app_key": app_key, "format": "csv", "row_count": 0,
+                "complete": False, "truncated": True, "safe_for_final_conclusion": False, "files": [],
+                "hints": probe.get("hints", []),
+                "schema": probe.get("schema", {}),
+                "field_capabilities": probe.get("field_capabilities", []),
+                "scope": {"reported_total": total, "row_threshold": DATA_UNBOUNDED_ROW_THRESHOLD},
+            }, profile, ws_id)
+        schema = probe.get("schema") if isinstance(probe.get("schema"), dict) else {}
+        fields = schema.get("fields") if isinstance(schema, dict) else None
+        field_list = fields if isinstance(fields, list) else []
+        business_fields = [field for field in field_list if isinstance(field, dict) and field.get("field_id") is not None]
+        columns = [(str(field.get("field_id")), str(field.get("title") or field.get("field_id"))) for field in business_fields]
+        header = ["record_id"] + [f"{title}__field_{field_id}" for field_id, title in columns]
+        run_dir = Path.home() / ".qingflow" / "data-exports" / datetime.now().strftime("%Y%m%d-%H%M%S-%f")
+        latest_hints = probe.get("hints", [])
+        latest_schema = schema
+        latest_capabilities = probe.get("field_capabilities", [])
+
+        def fetch_page(page: int, page_size: int) -> JSONObject:
+            nonlocal latest_hints, latest_schema, latest_capabilities
+            request_body = dict(body)
+            # 每页都请求 schema，使最后一页的后端原始 hints 同时准确表达完整性和字段能力。
+            request_body.update({"page": page, "page_size": page_size, "include_schema": True})
+            response = self._request_data_plane(
+                context, "POST", self._base_path(app_key) + "/query", json_body=request_body
+            )
+            if response.get("ok") is False:
+                raise CsvPageFailure(response)
+            latest_hints = response.get("hints", [])
+            if isinstance(response.get("schema"), dict):
+                latest_schema = response["schema"]
+            if isinstance(response.get("field_capabilities"), list):
+                latest_capabilities = response["field_capabilities"]
+            return response
+
+        def project_row(record: JSONObject) -> list[str]:
+            values = record.get("fields") if isinstance(record.get("fields"), dict) else record
+            return [str(record.get("record_id") or "")] + [csv_cell(values.get(field_id)) for field_id, _ in columns]
+
+        exported = export_csv_pages(
+            fetch_page=fetch_page, header=header, project_row=project_row, output_dir=run_dir,
+            file_prefix="records", page_size=DATA_PAGE_SIZE, shard_rows=DATA_CSV_SHARD_ROWS,
+            time_budget_seconds=DATA_CSV_TIME_BUDGET_SECONDS,
+        )
+        page_error = exported.pop("page_error", None)
+        result: JSONObject = {
+            "ok": True, "status": "success" if exported["complete"] else "partial", "app_key": app_key,
+            "format": "csv", "local_dir": str(run_dir), "fields": business_fields,
+            "schema": latest_schema, "field_capabilities": latest_capabilities, "hints": latest_hints,
+            **exported,
+        }
+        if isinstance(page_error, dict):
+            # 后续页失败时保留已落盘分片，同时把后端稳定错误字段原样带回。
+            result["ok"] = False
+            for key in ("error_code", "message", "backend_code", "write_executed", "retry_safe", "field_errors"):
+                if key in page_error:
+                    result[key] = page_error[key]
+            if "hints" in page_error:
+                result["hints"] = page_error["hints"]
+        return self._attach_context(result, profile, ws_id)
+
+    @staticmethod
+    def _base_path(app_key: str) -> str:
+        return f"/app/{app_key}/data/v1/records"
+
+    @staticmethod
+    def _attach_context(result: JSONObject, profile: str, ws_id: int | None) -> JSONObject:
+        return {"profile": profile, "ws_id": ws_id, **result}
+
+    @staticmethod
+    def _require_app_key(app_key: str) -> None:
+        if not str(app_key or "").strip():
+            raise_tool_error(QingflowApiError.config_error("app_key is required"))
+
+    @staticmethod
+    def _require_record_id(record_id: str | int) -> None:
+        if not str(record_id or "").strip():
+            raise_tool_error(QingflowApiError.config_error("record_id is required"))

package/src/qingflow_mcp/tools/login_link_tools.py

@@ -6,18 +6,30 @@ from urllib.parse import parse_qs, unquote, urlencode, urlsplit
 
 from mcp.server.fastmcp import FastMCP
 
-from ..config import DEFAULT_PROFILE, get_web_base_url
+from ..config import DEFAULT_PROFILE
 from ..errors import QingflowApiError
 from ..json_types import JSONObject
+from ..resource_uri import parse_resource_path, resolve_resource_web_origin
 from .base import ToolBase
 
 LOGIN_LINK_DESCRIPTION = (
     "轻流页面入口：查看页面、继续编辑、处理业务、查看结果或进入工作区（open/view/visit page in browser，login）。"
     "从 AI 对话进入页面时，使用当前 MCP 身份和工作区生成短时（约 5 分钟）一次性免登录链接。"
     "redirect_path 可选：传已确认的站内业务路径，可带 query/hash；省略进入首页，不接受外部地址或认证入口。"
-    "纯数据查询无需调用；用户指定页面但路径未知时先定位，不猜路径或静默改为首页。"
+    "用户指定页面但路径未知时先定位，不猜路径或静默改为首页。"
     "返回 url 和毫秒整数 expires_at；必要安全验证及原有页面权限仍然生效。"
-    "用户要链接时仅交付，不提前消费；要求打开时才用浏览器打开返回的完整链接。"
+    "创建、修改或安装轻流资源后，最终回复主动提供主要结果的可点击页面入口，无需等待用户再次索要；"
+    "采用“完成结果 + 查看入口”，文案使用“在轻流中查看应用／应用包／视图”，不默认称为“继续编辑”。"
+    "安装方案默认提供应用包入口；直接创建或修改应用、视图时提供对应入口；用户明确要求多个主要对象时分别提供。"
+    "使用业务结果中的稳定 `uri`，按 URI 去重，不为全部子资源预签票据；主要对象没有可靠 URI 时说明限制，不猜地址或替换为不相关页面。"
+    "部分成功时仅交付已确认成功且可定位的主要结果，保留失败或未验证说明；"
+    "纯数据问答、中间读取、失败资源和删除操作不自动签发，用户明确要求不提供链接时遵从。"
+    "目标浏览器登录态未知时，临近交付用资源 URI 的同源 pathname 为每个实际展示的入口分别签发，使用返回的完整 URL，不额外追问登录态。"
+    "只有已有用户确认同一浏览器、网页域名、账号和工作区已登录且无失效信号的事实时，才直接交付稳定 URI；"
+    "调用过本工具或 Agent 自动化浏览器已登录不等于用户浏览器已登录，已消费链接不可复用。"
+    "用户未要求打开时不提前打开或消费链接；要求打开时才用浏览器打开返回的完整链接。"
+    "签发失败时说明免登录链接未生成，提供标注“需登录”的稳定 URI 作为备用入口，不重做业务操作。"
+    "机器结果继续保留稳定 URI，临时登录链接仅用于面向用户交付。"
 )
 
 
@@ -70,15 +82,31 @@ class LoginLinkTools(ToolBase):
         """执行工具方法逻辑。"""
 
         def runner(session_profile, context):
-            target = validate_redirect_path(redirect_path)
-            web_base_url = get_web_base_url()
+            requested_target = redirect_path or ""
+            if requested_target.startswith("/resources"):
+                target = requested_target
+                try:
+                    resource = parse_resource_path(target)
+                except ValueError:
+                    raise QingflowApiError(
+                        category="validation",
+                        message="redirect_path 必须是合法的稳定资源路径",
+                    ) from None
+                if resource.ws_id != session_profile.selected_ws_id:
+                    raise QingflowApiError(
+                        category="validation",
+                        message="redirect_path 的资源工作区必须与当前选中工作区一致",
+                    )
+            else:
+                target = validate_redirect_path(requested_target)
+            web_base_url = resolve_resource_web_origin()
             result = self.backend.request(
                 "POST",
                 context,
                 "/mcp/auth/login-link",
                 json_body={"wsId": session_profile.selected_ws_id},
             )
-            # 后端仅提供票据，网页地址由 MCP 配置确定，避免工作区域名为空。
+            # 后端仅提供票据；CLI 使用 QINGFLOW_BASE_URL 对应网页环境，MCP 使用独立网页配置。
             try:
                 source_url = result.get("url") if isinstance(result, dict) else None
                 if not isinstance(source_url, str):