@qingflow-tech/qingflow-cli 1.1.61-beta.4 → 1.1.61

package/src/qingflow_mcp/tool_catalog_i18n.py

@@ -1,185 +0,0 @@
-from __future__ import annotations
-
-
-DEFAULT_LOCALE = "zh-CN"
-SUPPORTED_LOCALES = ("zh-CN", "en-US")
-
-# 每项为（中文显示名称、英文显示名称、英文能力说明）；中文能力说明沿用 tool_catalog.py。
-# 这里只维护工具本身的文案，不包含 Wingent-X 的产品分类、排序或分类标签。
-TOOL_DISPLAY_TEXT: dict[str, tuple[str, str, str]] = {
-    "builder:app_associated_resources_apply": ("配置关联资源", "Configure associated resources", "Configure associated views, reports, and their display rules for each view."),
-    "builder:app_charts_apply": ("配置应用图表", "Configure application charts", "Create, update, delete, or reorder charts and reports using Qingflow application data sources."),
-    "builder:app_custom_buttons_apply": ("配置自定义按钮", "Configure custom buttons", "Maintain standalone button definitions, styles, bindings across views, and ordering."),
-    "builder:app_delete": ("删除应用", "Delete application", "Delete an application and its configuration, retaining existing permission and confirmation checks."),
-    "builder:app_flow_apply": ("配置工作流", "Configure workflow", "Replace workflow declarations or modify nodes; deleting existing nodes retains destructive change confirmation."),
-    "builder:app_flow_get": ("读取工作流声明", "Read workflow declaration", "Read the current draft or a specified historical workflow declaration."),
-    "builder:app_flow_get_schema": ("读取工作流结构", "Read workflow schema", "Read the versioned schema for workflow declarations."),
-    "builder:app_flow_list_versions": ("列出工作流版本", "List workflow versions", "List historical workflow versions available for restoration."),
-    "builder:app_flow_restore_version": ("恢复工作流版本", "Restore workflow version", "Restore a specified historical workflow version to the draft; this is a write operation."),
-    "builder:app_flow_validate": ("校验工作流", "Validate workflow", "Validate workflow declarations with existing maintenance and contract checks."),
-    "builder:app_form_apply": ("配置应用表单", "Configure application form", "Create or update applications, fields, layouts, and related configuration from a complete form declaration."),
-    "builder:app_form_get": ("读取表单声明", "Read form declaration", "Read the application's canonical form declaration."),
-    "builder:app_form_schema": ("读取表单结构", "Read form schema", "Read versioned schemas for form declarations, fields, or formulas."),
-    "builder:app_form_validate": ("校验表单声明", "Validate form declaration", "Validate form declarations locally without accessing the business backend."),
-    "builder:app_form_validate_code_block": ("校验表单代码块", "Validate form code block", "Perform static code checks and, when applicable, execute a test run on the backend."),
-    "builder:app_form_validate_formula": ("校验表单公式", "Validate form formula", "Validate formula syntax and evaluate the formula on the backend."),
-    "builder:app_get": ("读取应用配置概览", "Read application configuration overview", "Read the application configuration overview and references to form, view, and workflow resources."),
-    "builder:app_get_associated_resources": ("读取关联资源", "Read associated resources", "Read associated views, reports, and their display configuration."),
-    "builder:app_get_buttons": ("读取应用按钮", "Read application buttons", "Read application button definitions and binding configuration."),
-    "builder:app_get_charts": ("读取应用图表配置", "Read application chart configuration", "Read application chart and report configuration."),
-    "builder:app_get_fields": ("读取应用字段", "Read application fields", "Read application fields and the field capabilities available for chart configuration."),
-    "builder:app_get_flow": ("读取工作流概览", "Read workflow overview", "Read an overview of the application's workflow configuration."),
-    "builder:app_get_layout": ("读取表单布局", "Read form layout", "Read the application's form layout configuration."),
-    "builder:app_get_views": ("读取视图配置概览", "Read view configuration overview", "Read an overview of application view configuration."),
-    "builder:app_publish_verify": ("发布并核验应用", "Publish and verify application", "Verify the application's current publication state; when needed, publish, finish editing, and verify the published result."),
-    "builder:app_release_edit_lock_if_mine": ("释放本人编辑锁", "Release own edit lock", "Release an application edit lock only when it belongs to the current user."),
-    "builder:app_repair_code_blocks": ("检查并修复代码块", "Inspect and repair code blocks", "Inspect and optionally repair code blocks with output bindings; apply=false/true share the same full tool permission."),
-    "builder:app_resolve": ("定位应用", "Resolve application", "Resolve the target application by name or reference."),
-    "builder:app_views_apply": ("配置应用视图", "Configure application views", "Create or modify views, filters, and query panels; may also create and bind view buttons."),
-    "builder:app_views_get": ("读取视图声明", "Read view declaration", "Read canonical view declarations and related configuration."),
-    "builder:app_views_schema": ("读取视图结构", "Read view schema", "Read the versioned schema for view declarations."),
-    "builder:app_views_validate": ("校验视图声明", "Validate view declaration", "Validate view declarations."),
-    "builder:auth_logout": ("退出认证", "Log out", "Leave the current authentication context and optionally clear saved credentials."),
-    "builder:auth_use_credential": ("使用凭据认证", "Authenticate with credential", "Establish an authentication context with the supplied credential and save it when requested."),
-    "builder:auth_whoami": ("查看当前身份", "Read current identity", "Read the current authenticated identity."),
-    "builder:builder_tool_contract": ("读取配置工具合同", "Read builder tool contract", "Read configuration tool contracts covering forms, views, workflows, charts, application packages, and members."),
-    "builder:button_style_catalog_get": ("读取按钮样式目录", "Read button style catalog", "Read available button styles, colors, and icons."),
-    "builder:chart_get": ("读取图表配置", "Read chart configuration", "Read the target chart's configuration."),
-    "builder:feedback_submit": ("提交产品反馈", "Submit product feedback", "Submit product feedback with existing user confirmation requirements."),
-    "builder:file_upload_local": ("上传本地文件", "Upload local file", "Upload a local file to Qingflow."),
-    "builder:get_login_link": ("生成免登录链接", "Generate login link", "Generate a short lived login link for a specified Qingflow page."),
-    "builder:member_search": ("搜索工作区成员", "Search workspace members", "Search workspace members."),
-    "builder:package_apply": ("配置应用包", "Configure application package", "Create or update application package metadata, visibility, groups, and ordering."),
-    "builder:package_get": ("读取应用包详情", "Read application package", "Read application package details."),
-    "builder:package_list": ("列出应用包", "List application packages", "List accessible application packages."),
-    "builder:portal_apply": ("配置门户", "Configure portal", "Create or update a portal and optionally create its embedded charts."),
-    "builder:portal_delete": ("删除门户", "Delete portal", "Delete a portal with existing destructive operation confirmation requirements."),
-    "builder:portal_get": ("读取门户配置", "Read portal configuration", "Read portal configuration."),
-    "builder:portal_list": ("列出门户", "List portals", "List accessible portals."),
-    "builder:role_create": ("创建工作区角色", "Create workspace role", "Create a workspace role."),
-    "builder:role_search": ("搜索工作区角色", "Search workspace roles", "Search workspace roles."),
-    "builder:solution_install": ("安装完整方案", "Install complete solution", "Install a complete solution; may create application packages, applications, fields, views, workflows, charts, portals, and roles, and copy business data when requested."),
-    "builder:view_get": ("读取视图配置", "Read view configuration", "Read the target view's configuration."),
-    "builder:workspace_get": ("读取工作区信息", "Read workspace information", "Read workspace information."),
-    "builder:workspace_icon_catalog_get": ("读取工作区图标目录", "Read workspace icon catalog", "Read workspace icons and colors available for application configuration."),
-    "builder:workspace_list": ("列出工作区", "List workspaces", "List accessible workspaces."),
-    "user:app_get": ("读取应用业务信息", "Read application business information", "Read application information, data access scope, and accessible views."),
-    "user:app_list": ("列出应用", "List applications", "List accessible applications or search them by name."),
-    "user:auth_login": ("登录轻流", "Log in to Qingflow", "Log in and establish a Qingflow authentication context."),
-    "user:auth_logout": ("退出认证", "Log out", "Leave the current authentication context and optionally clear saved credentials."),
-    "user:auth_use_credential": ("使用凭据认证", "Authenticate with credential", "Establish an authentication context with the supplied credential and save it when requested."),
-    "user:auth_whoami": ("查看当前身份", "Read current identity", "Read the current authenticated identity."),
-    "user:chart_get": ("读取图表", "Read chart", "Read the target chart."),
-    "user:data_delete": ("删除应用数据", "Delete application data", "Delete application records in batches with existing data scope and permission checks."),
-    "user:data_get": ("读取应用数据", "Read application data", "Read application data by record ID, with optional field information."),
-    "user:data_insert": ("新增应用数据", "Insert application data", "Insert application records in batches."),
-    "user:data_query": ("查询应用数据", "Query application data", "Query application data by field ID, with filtering, sorting, pagination, and complete CSV export."),
-    "user:data_update": ("更新应用数据", "Update application data", "Update selected fields in application records in batches."),
-    "user:directory_list_all_departments": ("读取全部可访问部门", "Read all accessible departments", "Read all accessible departments."),
-    "user:directory_list_all_internal_users": ("读取全部可访问内部成员", "Read all accessible internal members", "Read all accessible internal members."),
-    "user:directory_list_external_members": ("列出外部成员", "List external members", "List external members."),
-    "user:directory_list_internal_departments": ("列出内部部门", "List internal departments", "List internal departments."),
-    "user:directory_list_internal_users": ("列出内部成员", "List internal members", "List internal members."),
-    "user:directory_list_sub_departments": ("列出子部门", "List subdepartments", "List subdepartments of a specified department."),
-    "user:directory_search": ("搜索通讯录", "Search directory", "Search directory members or departments."),
-    "user:feedback_submit": ("提交产品反馈", "Submit product feedback", "Submit product feedback with existing user confirmation requirements."),
-    "user:file_get_upload_info": ("获取文件上传信息", "Read file upload information", "Read the information required for a file upload."),
-    "user:file_upload_local": ("上传本地文件", "Upload local file", "Upload a local file to Qingflow."),
-    "user:get_login_link": ("生成免登录链接", "Generate login link", "Generate a short lived login link for a specified Qingflow page."),
-    "user:navigation_create": ("创建导航", "Create navigation", "Create navigation configuration."),
-    "user:navigation_delete": ("删除导航", "Delete navigation", "Delete navigation configuration."),
-    "user:navigation_get_detail": ("读取导航详情", "Read navigation details", "Read navigation details."),
-    "user:navigation_get_status": ("读取导航状态", "Read navigation status", "Read navigation status."),
-    "user:navigation_list_draft_all": ("读取全部导航草稿", "Read all navigation drafts", "Read all navigation drafts."),
-    "user:navigation_list_draft_page": ("分页读取导航草稿", "Read navigation draft page", "Read a page of navigation drafts."),
-    "user:navigation_list_published": ("读取已发布导航", "Read published navigation", "Read published navigation."),
-    "user:navigation_publish": ("发布导航", "Publish navigation", "Publish navigation configuration."),
-    "user:navigation_reorder": ("调整导航排序", "Reorder navigation", "Change navigation ordering."),
-    "user:navigation_set_visible": ("调整导航可见性", "Set navigation visibility", "Change navigation visibility."),
-    "user:navigation_update": ("更新导航", "Update navigation", "Update navigation configuration."),
-    "user:package_create": ("创建应用包", "Create application package", "Create an application package."),
-    "user:package_delete": ("删除应用包", "Delete application package", "Delete an application package; deleted_all_data may also delete business data and associated application configuration."),
-    "user:package_get": ("读取应用包详情", "Read application package", "Read application package details."),
-    "user:package_get_base": ("读取应用包基础信息", "Read application package base information", "Read application package base information."),
-    "user:package_list": ("列出应用包", "List application packages", "List application packages."),
-    "user:package_update": ("更新应用包", "Update application package", "Update application package configuration."),
-    "user:portal_create": ("创建门户", "Create portal", "Create a portal."),
-    "user:portal_delete": ("删除门户", "Delete portal", "Delete a portal."),
-    "user:portal_get": ("读取门户详情", "Read portal details", "Read portal details."),
-    "user:portal_get_base_info": ("读取门户基础信息", "Read portal base information", "Read portal base information."),
-    "user:portal_list": ("列出门户", "List portals", "List portals."),
-    "user:portal_publish": ("发布门户", "Publish portal", "Publish a portal."),
-    "user:portal_update": ("更新门户内容", "Update portal content", "Update portal content configuration."),
-    "user:portal_update_base_info": ("更新门户基础信息", "Update portal base information", "Update portal base information."),
-    "user:qingbi_report_delete": ("删除轻析报表", "Delete Qingbi report", "Delete a Qingbi report."),
-    "user:qingbi_report_get_base": ("读取轻析报表基础信息", "Read Qingbi report base information", "Read Qingbi report base information."),
-    "user:qingbi_report_get_config": ("读取轻析报表配置", "Read Qingbi report configuration", "Read Qingbi report configuration."),
-    "user:qingbi_report_get_data": ("读取轻析报表数据", "Read Qingbi report data", "Read Qingbi report data."),
-    "user:qingbi_report_list": ("列出轻析报表", "List Qingbi reports", "List Qingbi reports."),
-    "user:qingbi_report_list_field_options": ("读取报表字段配置项", "Read report field options", "Read available configuration options for Qingbi report fields."),
-    "user:qingbi_report_list_fields": ("读取报表字段", "Read report fields", "Read Qingbi report fields."),
-    "user:qingbi_report_reorder": ("调整轻析报表排序", "Reorder Qingbi reports", "Change Qingbi report ordering."),
-    "user:record_access": ("解析记录访问入口", "Resolve record access", "Resolve application and view data access entrypoints with existing permission scopes."),
-    "user:record_analyze": ("分析记录数据", "Analyze records", "Analyze records in a specified application or view."),
-    "user:record_browse_schema_get": ("读取记录浏览结构", "Read record browsing schema", "Read the field contract for browsing records by view."),
-    "user:record_code_block_run": ("执行记录代码块", "Run record code block", "Execute a code block related to record data."),
-    "user:record_code_block_schema_get": ("读取记录代码块结构", "Read record code block schema", "Read the input and output contract for a record code block."),
-    "user:record_delete": ("删除记录", "Delete record", "Delete records through the existing record API."),
-    "user:record_department_candidates": ("读取字段可选部门", "Read field department candidates", "Read department candidates for record fields."),
-    "user:record_export_direct": ("直接导出记录", "Export records directly", "Export record data directly."),
-    "user:record_export_get": ("获取记录导出结果", "Read record export result", "Read a record export result."),
-    "user:record_export_start": ("启动记录导出", "Start record export", "Start a record export task."),
-    "user:record_export_status_get": ("读取记录导出状态", "Read record export status", "Read the status of a record export task."),
-    "user:record_get": ("读取单条记录", "Read record", "Read a single record."),
-    "user:record_import_repair_local": ("修复本地导入文件", "Repair local import file", "Repair a local record import file."),
-    "user:record_import_schema_get": ("读取记录导入结构", "Read record import schema", "Read the field contract for importing records."),
-    "user:record_import_start": ("启动记录导入", "Start record import", "Start a record import task."),
-    "user:record_import_status_get": ("读取记录导入状态", "Read record import status", "Read the status of a record import task."),
-    "user:record_import_template_get": ("获取记录导入模板", "Read record import template", "Read a record import template."),
-    "user:record_import_verify": ("校验记录导入结果", "Verify record import", "Verify record import results."),
-    "user:record_insert": ("新增记录", "Insert record", "Insert records through the existing record API."),
-    "user:record_insert_schema_get": ("读取记录新增结构", "Read record insertion schema", "Read the field contract for inserting records."),
-    "user:record_list": ("按视图列出记录", "List records by view", "Read records by view."),
-    "user:record_logs_get": ("读取记录操作日志", "Read record operation logs", "Read record operation logs."),
-    "user:record_member_candidates": ("读取字段可选成员", "Read field member candidates", "Read member candidates for record fields."),
-    "user:record_schema_get": ("读取申请表单结构", "Read applicant form schema", "Read the field contract for the applicant form."),
-    "user:record_update": ("更新记录", "Update record", "Update records through the existing record API."),
-    "user:record_update_schema_get": ("读取记录更新结构", "Read record update schema", "Read the field contract for updating records."),
-    "user:role_create": ("创建工作区角色", "Create workspace role", "Create a workspace role."),
-    "user:role_delete": ("删除工作区角色", "Delete workspace role", "Delete a workspace role."),
-    "user:role_search": ("搜索工作区角色", "Search workspace roles", "Search workspace roles."),
-    "user:role_update": ("更新工作区角色", "Update workspace role", "Update a workspace role."),
-    "user:solution_build_all": ("搭建完整方案", "Build complete solution", "Plan, apply, or repair a complete solution; may create application packages, roles, applications, fields, workflows, views, charts, portals, navigation, and initial business data."),
-    "user:solution_build_analytics_portal": ("搭建图表与门户", "Build charts and portals", "Plan, apply, or repair charts and portals; may enable the corresponding workspace plugins."),
-    "user:solution_build_app": ("搭建应用", "Build application", "Plan, apply, or repair an application; may create application packages, roles, fields, and initial business data."),
-    "user:solution_build_app_flow": ("搭建应用与流程", "Build application and workflow", "Plan, apply, or repair applications and workflows; may create application packages, roles, fields, and initial business data."),
-    "user:solution_build_app_from_requirements": ("按需求搭建应用", "Build application from requirements", "Build an application from requirements; may create application packages, roles, fields, and initial business data."),
-    "user:solution_build_flow": ("搭建流程", "Build workflow", "Plan, apply, or repair workflows; may create workspace roles referenced by the workflow."),
-    "user:solution_build_navigation": ("搭建导航", "Build navigation", "Plan, apply, or repair navigation; may enable the corresponding workspace plugins."),
-    "user:solution_build_status": ("读取方案搭建状态", "Read solution build status", "Read the progress and results of a solution build task."),
-    "user:solution_build_views": ("搭建视图", "Build views", "Plan, apply, or repair view configuration in a solution."),
-    "user:solution_design_session": ("管理本地方案设计会话", "Manage local solution design session", "Create, read, or update a local solution design session."),
-    "user:solution_schema_example": ("读取方案结构与示例", "Read solution schema and examples", "Read solution declaration schemas and examples."),
-    "user:task_action_execute": ("执行待办动作", "Execute task action", "Execute a task action with existing approval permissions and confirmation requirements."),
-    "user:task_associated_report_detail_get": ("读取待办关联报表", "Read task associated report", "Read details of a report associated with a task."),
-    "user:task_get": ("读取待办详情", "Read task details", "Read task details."),
-    "user:task_list": ("列出待办", "List tasks", "List tasks."),
-    "user:task_workbench": ("使用交互式待办工作台", "Use interactive task workbench", "Open the interactive task workbench to read tasks and execute their existing approval actions."),
-    "user:task_workflow_log_get": ("读取待办流程日志", "Read task workflow logs", "Read workflow logs for a task."),
-    "user:view_board_get_lane_base_info": ("读取看板泳道信息", "Read board lane information", "Read lane information for a board view."),
-    "user:view_get": ("读取视图业务信息", "Read view business information", "Read an accessible view's business information and export capabilities."),
-    "user:view_get_base_info": ("读取视图基础信息", "Read view base information", "Read view base information."),
-    "user:view_get_config": ("读取视图配置", "Read view configuration", "Read view configuration."),
-    "user:view_get_future_nodes": ("读取视图后续流程节点", "Read future view workflow nodes", "Read future workflow nodes for records in a view."),
-    "user:view_get_workflow_status": ("读取视图记录流程状态", "Read view record workflow status", "Read workflow status for records in a view."),
-    "user:view_list": ("列出视图", "List views", "List views."),
-    "user:view_list_associations": ("读取视图关联资源", "Read view associations", "Read resources associated with a view."),
-    "user:view_list_flat": ("读取扁平视图列表", "Read flat view list", "Read a flat list of views."),
-    "user:view_list_questions": ("读取视图字段", "Read view fields", "Read view fields."),
-    "user:workflow_get_future_nodes": ("读取记录后续流程节点", "Read future record workflow nodes", "Read future workflow nodes for a record."),
-    "user:workflow_get_future_nodes_app": ("读取应用后续流程节点", "Read future application workflow nodes", "Read future nodes in an application's workflow."),
-    "user:workspace_get": ("读取工作区信息", "Read workspace information", "Read workspace information."),
-    "user:workspace_list": ("列出工作区", "List workspaces", "List accessible workspaces."),
-    "user:workspace_select": ("切换工作区", "Select workspace", "Switch the current workspace context."),
-    "user:workspace_set_plugin_status": ("启停工作区插件", "Enable or disable workspace plugins", "Enable or disable workspace business plugins; this is a controlled business write operation."),
-}

package/src/qingflow_mcp/tool_policy.py

@@ -1,197 +0,0 @@
-from __future__ import annotations
-
-import json
-import os
-from dataclasses import dataclass
-from typing import Any, Literal, Mapping, Sequence
-from urllib.parse import parse_qs
-
-from mcp.server.fastmcp import FastMCP
-from mcp.server.fastmcp.exceptions import ToolError
-
-from .cloud_context import current_http_tool_policy, current_tool_policy_header
-from .tool_catalog import TOOL_ID_PATTERN, require_registered_tool_id, tool_is_exempt
-
-
-TOOL_POLICY_ENV = "QINGFLOW_TOOL_POLICY"
-TOOL_POLICY_HEADER = "X-Qingflow-Tool-Policy"
-TOOL_POLICY_INVALID = "TOOL_POLICY_INVALID"
-TOOL_POLICY_DENIED = "TOOL_POLICY_DENIED"
-
-
-@dataclass(frozen=True, slots=True)
-class ToolPolicySnapshot:
-    mode: Literal["unrestricted", "restricted", "invalid"]
-    allowed_tools: tuple[str, ...] = ()
-    error: str | None = None
-
-    def violation_for(self, stable_id: str) -> "ToolPolicyViolation | None":
-        # 基础恢复能力在非法策略下也必须可用。
-        if tool_is_exempt(stable_id):
-            return None
-        if self.mode == "unrestricted":
-            return None
-        if self.mode == "invalid":
-            return ToolPolicyViolation(TOOL_POLICY_INVALID, stable_id, self.error or "工具策略无效")
-        if stable_id in self.allowed_tools:
-            return None
-        return ToolPolicyViolation(TOOL_POLICY_DENIED, stable_id, "当前策略未允许该工具")
-
-
-class ToolPolicyViolation(Exception):
-    def __init__(self, code: str, tool_id_value: str, message: str) -> None:
-        super().__init__(message)
-        self.code = code
-        self.tool_id = tool_id_value
-        self.message = message
-
-    def payload(self, *, camel_case: bool = False) -> dict[str, Any]:
-        if camel_case:
-            return {
-                "status": "failed",
-                "errorCode": self.code,
-                "message": self.message,
-                "toolId": self.tool_id,
-            }
-        return {
-            "status": "failed",
-            "error_code": self.code,
-            "message": self.message,
-            "toolId": self.tool_id,
-        }
-
-
-def parse_tool_policy(value: str | Mapping[str, Any] | None) -> ToolPolicySnapshot:
-    if value is None:
-        return ToolPolicySnapshot("unrestricted")
-    payload: Any = value
-    if isinstance(value, str):
-        if value == "":
-            return ToolPolicySnapshot("unrestricted")
-        try:
-            payload = json.loads(value)
-        except json.JSONDecodeError:
-            return ToolPolicySnapshot("invalid", error="工具策略不是合法 JSON")
-    if not isinstance(payload, Mapping):
-        return ToolPolicySnapshot("invalid", error="工具策略必须是对象")
-    if set(payload) != {"version", "allowed_tools"}:
-        return ToolPolicySnapshot("invalid", error="工具策略字段必须为 version 和 allowed_tools")
-    if type(payload.get("version")) is not int or payload.get("version") != 1:  # noqa: E721
-        return ToolPolicySnapshot("invalid", error="工具策略 version 必须为 1")
-    allowed = payload.get("allowed_tools")
-    if not isinstance(allowed, list):
-        return ToolPolicySnapshot("invalid", error="allowed_tools 必须是数组")
-    normalized: set[str] = set()
-    for stable_id in allowed:
-        if not isinstance(stable_id, str) or TOOL_ID_PATTERN.fullmatch(stable_id) is None:
-            return ToolPolicySnapshot("invalid", error="allowed_tools 包含非法工具 ID")
-        normalized.add(stable_id)
-    return ToolPolicySnapshot("restricted", tuple(sorted(normalized)))
-
-
-def parse_http_tool_policy(header: str | None, query_string: bytes) -> ToolPolicySnapshot:
-    header_policy = parse_tool_policy(header)
-    # 保留空值并在 URL 解码后检查重复，tools= 与缺省不能合并为同一种状态。
-    values = parse_qs(query_string.decode("latin1"), keep_blank_values=True).get("tools", [])
-    if len(values) > 1:
-        return ToolPolicySnapshot("invalid", error="tools 查询参数不能重复")
-    url_policy = parse_tool_policy(
-        {"version": 1, "allowed_tools": values[0].split(",") if values[0] else []}
-        if values else None
-    )
-    if header_policy.mode == "invalid":
-        return header_policy
-    if url_policy.mode == "invalid":
-        return ToolPolicySnapshot("invalid", error=f"tools 查询参数无效: {url_policy.error}")
-    if header_policy.mode == "unrestricted":
-        return url_policy
-    if url_policy.mode == "unrestricted":
-        return header_policy
-    return ToolPolicySnapshot(
-        "restricted", tuple(sorted(set(header_policy.allowed_tools).intersection(url_policy.allowed_tools)))
-    )
-
-
-class PolicyAwareFastMCP(FastMCP):
-    """让 MCP 列表与调用在 FastMCP handler 边界共用策略快照。"""
-
-    def __init__(self, *args: Any, **kwargs: Any) -> None:
-        self._tool_policy_bindings: dict[str, str] | None = None
-        self._tool_policy_source: Literal["environment", "request"] = "environment"
-        self._tool_policy_environment_snapshot = ToolPolicySnapshot("unrestricted")
-        super().__init__(*args, **kwargs)
-
-    def configure_tool_policy(
-        self,
-        bindings: Mapping[str, str],
-        *,
-        source: Literal["environment", "request"],
-    ) -> None:
-        registered = set(self._tool_manager._tools)
-        bound = set(bindings)
-        if registered != bound:
-            missing = sorted(registered - bound)
-            extra = sorted(bound - registered)
-            raise ValueError(f"工具策略绑定不完整: missing={missing}, extra={extra}")
-        for stable_id in bindings.values():
-            # 登记校验只依赖提供方稳定 ID，不依赖 Wingent-X 的产品分类。
-            require_registered_tool_id(stable_id)
-        self._tool_policy_bindings = dict(bindings)
-        self._tool_policy_source = source
-        if source == "environment":
-            self._tool_policy_environment_snapshot = parse_tool_policy(os.getenv(TOOL_POLICY_ENV))
-
-    @property
-    def tool_policy_bindings(self) -> dict[str, str]:
-        return dict(self._tool_policy_bindings or {})
-
-    async def list_tools(self):  # type: ignore[no-untyped-def]
-        tools = await super().list_tools()
-        bindings = self._require_bindings()
-        snapshot = self._current_snapshot()
-        return [
-            tool
-            for tool in tools
-            if snapshot.violation_for(bindings[tool.name]) is None
-        ]
-
-    async def call_tool(self, name: str, arguments: dict[str, Any]) -> Sequence[Any] | dict[str, Any]:
-        bindings = self._require_bindings()
-        stable_id = bindings.get(name)
-        if stable_id is None:
-            raise ToolError(json.dumps(
-                {
-                    "status": "failed",
-                    "errorCode": TOOL_POLICY_INVALID,
-                    "message": "工具未登记稳定 ID",
-                },
-                ensure_ascii=False,
-            ))
-        violation = self._current_snapshot().violation_for(stable_id)
-        if violation is not None:
-            raise ToolError(json.dumps(violation.payload(camel_case=True), ensure_ascii=False))
-        return await super().call_tool(name, arguments)
-
-    def _require_bindings(self) -> dict[str, str]:
-        if self._tool_policy_bindings is None:
-            raise RuntimeError("MCP 工具策略绑定尚未配置")
-        return self._tool_policy_bindings
-
-    def _current_snapshot(self) -> ToolPolicySnapshot:
-        if self._tool_policy_source == "request":
-            snapshot = current_http_tool_policy.get()
-            if snapshot is not None:
-                return snapshot
-            # 保留未经过 HTTP 入口的请求头上下文用法，绝不回退共享 env。
-            return parse_tool_policy(current_tool_policy_header.get())
-        return self._tool_policy_environment_snapshot
-
-
-def configure_tool_policy(
-    server: PolicyAwareFastMCP,
-    bindings: Mapping[str, str],
-    *,
-    source: Literal["environment", "request"],
-) -> PolicyAwareFastMCP:
-    server.configure_tool_policy(bindings, source=source)
-    return server