@cloudbase/cloudbase-mcp 2.15.2-beta.1 → 2.15.2-beta.2

package/dist/index.js

@@ -62,6 +62,8 @@ function simplifyEnvList(envList) {
             simplified.EnvType = env.EnvType;
         if (env.Region !== undefined)
             simplified.Region = env.Region;
+        if (env.PackageId !== undefined)
+            simplified.PackageId = env.PackageId;
         if (env.PackageName !== undefined)
             simplified.PackageName = env.PackageName;
         if (env.IsDefault !== undefined)
@@ -76,6 +78,7 @@ const DEFAULT_ENV_FIELDS = [
     "Status",
     "EnvType",
     "Region",
+    "PackageId",
     "PackageName",
     "IsDefault",
 ];
@@ -91,10 +94,14 @@ function selectEnvFields(env, fields) {
 }
 function filterEnvList(envList, filters) {
     const alias = filters.alias?.trim().toLowerCase();
+    const aliasExact = filters.aliasExact === true;
     const envId = filters.envId?.trim().toLowerCase();
     return envList.filter((env) => {
+        const normalizedAlias = String(env.Alias ?? "").toLowerCase();
         const matchesAlias = alias
-            ? String(env.Alias ?? "").toLowerCase().includes(alias)
+            ? aliasExact
+                ? normalizedAlias === alias
+                : normalizedAlias.includes(alias)
             : true;
         const matchesEnvId = envId
             ? String(env.EnvId ?? "").toLowerCase() === envId
@@ -198,9 +205,17 @@ function buildEnvQueryListResult(params) {
         : envList;
     const filteredList = filterEnvList(baseList, {
         alias: params.filters.alias,
+        aliasExact: params.filters.aliasExact,
         envId: params.filters.envId,
     });
     const paginated = paginateEnvList(filteredList, params.filters.offset, params.filters.limit);
+    const exactEnvIdSummaryHint = params.filters.envId
+        ? {
+            tool: "envQuery",
+            action: "info",
+            reason: "action=list with envId only returns a concise summary. Use action=info to fetch detailed environment information such as full resource metadata and additional environment details.",
+        }
+        : undefined;
     return {
         EnvList: paginated.items.map((env) => selectEnvFields(env, params.filters.fields)),
         TotalCount: paginated.total,
@@ -209,12 +224,58 @@ function buildEnvQueryListResult(params) {
         HasMore: paginated.offset + paginated.items.length < paginated.total,
         AppliedFilters: {
             alias: params.filters.alias ?? null,
+            aliasExact: params.filters.aliasExact ?? null,
             envId: params.filters.envId ?? null,
             fields: params.filters.fields ?? [...DEFAULT_ENV_FIELDS],
             currentEnvOnly: shouldRestrictToCurrentEnv,
         },
+        ...(exactEnvIdSummaryHint
+            ? {
+                RecommendedNextAction: exactEnvIdSummaryHint,
+            }
+            : {}),
     };
 }
+async function enrichEnvInfoWithBilling(params) {
+    const targetEnvId = params.envId ||
+        params.result?.EnvInfo?.EnvId;
+    if (!targetEnvId || !params.result?.EnvInfo) {
+        return params.result;
+    }
+    try {
+        const billingResult = await params.manager.commonService("tcb", "2018-06-08").call({
+            Action: "DescribeBillingInfo",
+            Param: {
+                EnvId: targetEnvId,
+            },
+        });
+        (0, cloudbase_manager_js_1.logCloudBaseResult)(params.logger, billingResult);
+        const billingList = billingResult?.EnvBillingInfoList ||
+            billingResult?.Response?.EnvBillingInfoList ||
+            billingResult?.Data?.EnvBillingInfoList ||
+            [];
+        const matchedBillingInfo = Array.isArray(billingList)
+            ? billingList.find((item) => item?.EnvId === targetEnvId) ?? billingList[0]
+            : undefined;
+        if (!matchedBillingInfo) {
+            return params.result;
+        }
+        return {
+            ...params.result,
+            EnvInfo: {
+                ...params.result.EnvInfo,
+                BillingInfo: matchedBillingInfo,
+            },
+        };
+    }
+    catch (billingError) {
+        (0, logger_js_1.debug)("DescribeBillingInfo enrichment failed, continuing without billing info", {
+            error: billingError,
+            envId: targetEnvId,
+        });
+        return params.result;
+    }
+}
 async function getGuidePrompt(server) {
     if (getCurrentIde(server) === "CodeBuddy" ||
         process.env.CLOUDBASE_GUIDE_PROMPT === "false") {
@@ -232,6 +293,16 @@ function registerEnvTools(server) {
     // 获取 cloudBaseOptions，如果没有则为 undefined
     const cloudBaseOptions = server.cloudBaseOptions;
     const getManager = () => (0, cloudbase_manager_js_1.getCloudBaseManager)({ cloudBaseOptions, mcpServer: server });
+    const getManagerForEnvQuery = (targetEnvId, requireEnvId = true) => (0, cloudbase_manager_js_1.getCloudBaseManager)({
+        cloudBaseOptions: targetEnvId && targetEnvId !== cloudBaseOptions?.envId
+            ? {
+                ...cloudBaseOptions,
+                envId: targetEnvId,
+            }
+            : cloudBaseOptions,
+        requireEnvId,
+        mcpServer: server,
+    });
     const hasEnvId = typeof cloudBaseOptions?.envId === 'string' && cloudBaseOptions?.envId.length > 0;
     const supportedAuthActions = getSupportedAuthActions(server);
     const authActionEnum = [...supportedAuthActions];
@@ -597,26 +668,27 @@ function registerEnvTools(server) {
     // envQuery - 环境查询（合并 listEnvs + getEnvInfo + getEnvAuthDomains + getWebsiteConfig）
     server.registerTool?.("envQuery", {
         title: "环境查询",
-        description: "查询云开发环境相关信息，支持查询环境列表、当前环境信息、安全域名和静态网站托管配置。（原工具名：listEnvs/getEnvInfo/getEnvAuthDomains/getWebsiteConfig，为兼容旧AI规则可继续使用这些名称）当 action=list 时，标准返回字段为 EnvId、Alias、Status、EnvType、Region、PackageName、IsDefault，并支持通过 fields 白名单裁剪这些字段。当前 MCP 输出不支持套餐/计划到期时间（expiry / expire time）查询。",
+        description: "查询云开发环境相关信息，支持查询环境列表、当前环境信息、安全域名和静态网站托管配置。（原工具名：listEnvs/getEnvInfo/getEnvAuthDomains/getWebsiteConfig，为兼容旧AI规则可继续使用这些名称）当 action=list 时，标准返回字段为 EnvId、Alias、Status、EnvType、Region、PackageId、PackageName、IsDefault，并支持通过 fields 白名单裁剪这些字段；aliasExact=true 时会按别名精确筛选，避免把前缀相近的环境误当作候选；即使传入 envId，action=list 也只返回摘要，不会返回完整资源明细或 expiry。如需查询某个已知环境的详细信息，请使用 action=info。action=info 会在可用时补充 BillingInfo（如 ExpireTime、PayMode、IsAutoRenew 等计费字段）。",
         inputSchema: {
             action: zod_1.z
                 .enum(["list", "info", "domains", "hosting"])
-                .describe("查询类型：list=环境列表（标准字段：EnvId、Alias、Status、EnvType、Region、PackageName、IsDefault；不支持 expiry），info=当前环境信息，domains=安全域名列表，hosting=静态网站托管配置"),
+                .describe("查询类型：list=环境列表/摘要筛选（即使传 envId 也只返回 EnvId、Alias、Status、EnvType、Region、PackageId、PackageName、IsDefault，不支持 expiry），info=当前环境详细信息（详情中可查看更完整资源字段），domains=安全域名列表，hosting=静态网站托管配置"),
             alias: zod_1.z.string().optional().describe("按环境别名筛选。action=list 时可选"),
-            envId: zod_1.z.string().optional().describe("按环境 ID 精确筛选。action=list 时可选"),
+            aliasExact: zod_1.z.boolean().optional().describe("按环境别名精确筛选。action=list 时可选；与 alias 配合使用"),
+            envId: zod_1.z.string().optional().describe("按环境 ID 精确筛选。action=list 时可选；注意 list + envId 仍只返回摘要，如需该环境详情请改用 action=info"),
             limit: zod_1.z.number().int().positive().optional().describe("返回数量上限。action=list 时可选"),
             offset: zod_1.z.number().int().min(0).optional().describe("分页偏移。action=list 时可选"),
             fields: zod_1.z
                 .array(zod_1.z.enum(DEFAULT_ENV_FIELDS))
                 .optional()
-                .describe("返回字段白名单。仅支持 EnvId、Alias、Status、EnvType、Region、PackageName、IsDefault。action=list 时可选"),
+                .describe("返回字段白名单。仅支持 EnvId、Alias、Status、EnvType、Region、PackageId、PackageName、IsDefault。action=list 时可选"),
         },
         annotations: {
             readOnlyHint: true,
             openWorldHint: true,
             category: "env",
         },
-    }, async ({ action, alias, envId, limit, offset, fields, }) => {
+    }, async ({ action, alias, aliasExact, envId, limit, offset, fields, }) => {
         try {
             let result;
             switch (action) {
@@ -689,6 +761,7 @@ function registerEnvTools(server) {
                         hasEnvId,
                         filters: {
                             alias,
+                            aliasExact,
                             envId,
                             limit,
                             offset,
@@ -697,20 +770,44 @@ function registerEnvTools(server) {
                     });
                     break;
                 case "info":
-                    const cloudbaseInfo = await getManager();
+                    const cloudbaseInfo = await getManagerForEnvQuery(envId);
                     result = await cloudbaseInfo.env.getEnvInfo();
                     (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                    result = await enrichEnvInfoWithBilling({
+                        manager: cloudbaseInfo,
+                        result,
+                        envId,
+                        logger: server.logger,
+                    });
                     break;
                 case "domains":
                     const cloudbaseDomains = await getManager();
                     result = await cloudbaseDomains.env.getEnvAuthDomains();
                     (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
                     break;
-                case "hosting":
+                case "hosting": {
                     const cloudbaseHosting = await getManager();
-                    result = await cloudbaseHosting.hosting.getWebsiteConfig();
-                    (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                    const websiteConfig = await cloudbaseHosting.hosting.getWebsiteConfig();
+                    (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, websiteConfig);
+                    const hostingResult = {
+                        ...websiteConfig,
+                        CdnDomain: websiteConfig.CdnDomain ?? null,
+                        Bucket: websiteConfig.Bucket ?? null,
+                    };
+                    try {
+                        const envInfo = await cloudbaseHosting.env.getEnvInfo();
+                        (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, envInfo);
+                        hostingResult.CdnDomain = envInfo.EnvInfo?.StaticStorages?.[0]?.StaticDomain ?? hostingResult.CdnDomain;
+                        hostingResult.Bucket = envInfo.EnvInfo?.StaticStorages?.[0]?.Bucket ?? hostingResult.Bucket;
+                    }
+                    catch (hostingInfoError) {
+                        (0, logger_js_1.debug)("Failed to enrich hosting envQuery result with env info", {
+                            error: hostingInfoError,
+                        });
+                    }
+                    result = hostingResult;
                     break;
+                }
                 default:
                     throw new Error(`不支持的查询类型: ${action}`);
             }
@@ -968,7 +1065,7 @@ function registerCapiTools(server) {
     const getManager = () => (0, cloudbase_manager_js_1.getCloudBaseManager)({ cloudBaseOptions });
     server.registerTool?.("callCloudApi", {
         title: "调用云API",
-        description: `通用的云 API 调用工具，主要用于 CloudBase / 腾讯云管控面与依赖资源相关 API 调用。调用前请先确认 service、Action 与 Param，避免猜测 Action 名称。如果你的目标是通过 HTTP 协议直接集成 auth/functions/cloudrun/storage/mysqldb 等 CloudBase 业务 API，请不要优先使用 callCloudApi，而应优先查看对应 OpenAPI / Swagger。现有 OpenAPI / Swagger 能力不是通用的管控面 Action 集合；管控面 API 请优先参考 CloudBase API 概览 ${CLOUDBASE_CONTROL_PLANE_DOC_URL} 与云开发依赖资源接口指引 ${CLOUDBASE_DEPENDENCY_API_DOC_URL}。对于 tcb，可参考类似 \`CreateEnv\`、\`ModifyEnv\`、\`DestroyEnv\` 这类真实 Action 组织请求。`,
+        description: `通用的云 API 调用工具，主要用于 CloudBase / 腾讯云管控面与依赖资源相关 API 调用。调用前请先确认 service、Action 与 Param，避免猜测 Action 名称。如果你的目标是通过 HTTP 协议直接集成 auth/functions/cloudrun/storage/mysqldb 等 CloudBase 业务 API，请不要优先使用 callCloudApi，而应优先查看对应 OpenAPI / Swagger。现有 OpenAPI / Swagger 能力不是通用的管控面 Action 集合；管控面 API 请优先参考 CloudBase API 概览 ${CLOUDBASE_CONTROL_PLANE_DOC_URL} 与云开发依赖资源接口指引 ${CLOUDBASE_DEPENDENCY_API_DOC_URL}。对于 tcb，可参考类似 \`CreateEnv\`、\`ModifyEnv\`、\`DestroyEnv\` 这类真实 Action 组织请求；销毁环境时，常见做法是至少带上 \`EnvId\` 和 \`BypassCheck: true\`，如果环境已经处于隔离期再按文档补 \`IsForce: true\`。`,
         inputSchema: {
             service: zod_1.z
                 .enum(ALLOWED_SERVICES)
@@ -980,7 +1077,7 @@ function registerCapiTools(server) {
             params: zod_1.z
                 .record(zod_1.z.any())
                 .optional()
-                .describe("Action 对应的参数对象，键名需与官方 API 定义一致。某些 Action 需要携带 EnvId 等信息；如不确定参数结构，请先查官方文档。tcb 示例：`{ \"service\": \"tcb\", \"action\": \"DestroyEnv\", \"params\": { \"EnvId\": \"env-xxx\" } }` 或 `{ \"service\": \"tcb\", \"action\": \"ModifyEnv\", \"params\": { \"EnvId\": \"env-xxx\", \"Alias\": \"demo\" } }`。若你的场景是通过 HTTP 协议直接集成 auth/functions/cloudrun/storage/mysqldb 等 CloudBase 业务 API，请优先使用 OpenAPI / Swagger 或 searchKnowledgeBase(mode=\"openapi\")，而不是优先使用 callCloudApi。"),
+                .describe("Action 对应的参数对象，键名需与官方 API 定义一致。某些 Action 需要携带 EnvId 等信息；如不确定参数结构，请先查官方文档。tcb 示例：`{ \"service\": \"tcb\", \"action\": \"DestroyEnv\", \"params\": { \"EnvId\": \"env-xxx\", \"BypassCheck\": true } }`，如果环境已经处于隔离期，可再补 `IsForce: true`；更新环境别名则可用 `{ \"service\": \"tcb\", \"action\": \"ModifyEnv\", \"params\": { \"EnvId\": \"env-xxx\", \"Alias\": \"demo\" } }`。若你的场景是通过 HTTP 协议直接集成 auth/functions/cloudrun/storage/mysqldb 等 CloudBase 业务 API，请优先使用 OpenAPI / Swagger 或 searchKnowledgeBase(mode=\"openapi\")，而不是优先使用 callCloudApi。"),
         },
         annotations: {
             readOnlyHint: false,
@@ -1112,7 +1209,7 @@ ${envIdSection}
 ## 环境信息
 - 操作系统: ${os_1.default.type()} ${os_1.default.release()}
 - Node.js版本: ${process.version}
-- MCP 版本：${process.env.npm_package_version || "2.15.2-beta.1" || 0}
+- MCP 版本：${process.env.npm_package_version || "2.15.2-beta.2" || 0}
 - 系统架构: ${os_1.default.arch()}
 - 时间: ${new Date().toISOString()}
 - 请求ID: ${requestId}
@@ -5738,9 +5835,9 @@ async function getCloudBaseManager(options = {}) {
     }
     try {
         // Get region from environment variable for auth URL
-        const region = cloudBaseOptions?.region ?? process.env.TCB_REGION;
+        const fallbackRegion = cloudBaseOptions?.region ?? process.env.TCB_REGION;
         const loginState = authStrategy === 'ensure'
-            ? await (0, auth_js_1.getLoginState)({ region })
+            ? await (0, auth_js_1.getLoginState)({ region: fallbackRegion })
             : await (0, auth_js_1.peekLoginState)();
         if (!loginState) {
             const authState = await (0, auth_js_1.getAuthProgressState)();
@@ -5788,13 +5885,29 @@ async function getCloudBaseManager(options = {}) {
         }
         // envId priority: envManager.cachedEnvId > envManager.getEnvId() > loginState.envId > undefined
         // Note: envManager.cachedEnvId has highest priority as it reflects user's latest environment switch
-        // Region priority: process.env.TCB_REGION > undefined (use SDK default)
-        // At this point, cloudBaseOptions is undefined (checked above), so only use env var if present
-        // Reuse region variable declared above (line 259) for CloudBase initialization
+        // Region priority: envCandidates[].region (actual env region) > process.env.TCB_REGION > undefined
+        // Resolving the environment's own region avoids INVALID_REGION errors when TCB_REGION
+        // is set to a different region than the target environment.
+        const resolvedEnvId = finalEnvId || loginEnvId;
+        let region = fallbackRegion;
+        if (resolvedEnvId && !cloudBaseOptions?.region) {
+            try {
+                const envCandidates = await listAvailableEnvCandidates({ loginState });
+                const matchedEnv = envCandidates.find(c => c.envId === resolvedEnvId);
+                if (matchedEnv?.region) {
+                    region = matchedEnv.region;
+                    (0, logger_js_1.debug)('使用环境实际 region:', { envId: resolvedEnvId, region });
+                }
+            }
+            catch {
+                // If env listing fails, fall back to TCB_REGION / undefined
+                (0, logger_js_1.debug)('无法获取环境列表，使用 fallback region');
+            }
+        }
         const manager = new manager_node_1.default({
             secretId,
             secretKey,
-            envId: finalEnvId || loginEnvId,
+            envId: resolvedEnvId,
             token,
             proxy: process.env.http_proxy,
             region,
@@ -6647,6 +6760,31 @@ async function getDatabaseInstanceId(getManager) {
 function delay(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
+function parseNoSqlDocument(value) {
+    if (typeof value !== "string") {
+        return value;
+    }
+    try {
+        const parsed = JSON.parse(value);
+        return parsed !== null && typeof parsed === "object" ? parsed : value;
+    }
+    catch {
+        return value;
+    }
+}
+function normalizeNoSqlDocuments(data) {
+    if (!Array.isArray(data)) {
+        return [];
+    }
+    return data.map((item) => parseNoSqlDocument(item));
+}
+function withCollectionName(collectionName, payload) {
+    return {
+        ...payload,
+        collection: collectionName,
+        collectionName,
+    };
+}
 async function waitForCollectionReady({ cloudbase, collectionName, logger, timeoutMs = COLLECTION_READY_TIMEOUT_MS, pollIntervalMs = COLLECTION_READY_POLL_INTERVAL_MS, }) {
     const startedAt = Date.now();
     const deadline = startedAt + timeoutMs;
@@ -6772,14 +6910,14 @@ checkIndex: 检查索引是否存在`),
                 content: [
                     {
                         type: "text",
-                        text: JSON.stringify({
+                        text: JSON.stringify(withCollectionName(collectionName, {
                             success: true,
                             exists: result.Exists,
                             requestId: result.RequestId,
                             message: result.Exists
                                 ? "云开发数据库集合已存在"
                                 : "云开发数据库集合不存在",
-                        }, null, 2),
+                        }), null, 2),
                     },
                 ],
             };
@@ -6794,13 +6932,13 @@ checkIndex: 检查索引是否存在`),
                 content: [
                     {
                         type: "text",
-                        text: JSON.stringify({
+                        text: JSON.stringify(withCollectionName(collectionName, {
                             success: true,
                             requestId: result.RequestId,
                             indexNum: result.IndexNum,
                             indexes: result.Indexes,
                             message: "获取云开发数据库集合信息成功",
-                        }, null, 2),
+                        }), null, 2),
                     },
                 ],
             };
@@ -6815,13 +6953,13 @@ checkIndex: 检查索引是否存在`),
                 content: [
                     {
                         type: "text",
-                        text: JSON.stringify({
+                        text: JSON.stringify(withCollectionName(collectionName, {
                             success: true,
                             requestId: result.RequestId,
                             indexNum: result.IndexNum,
                             indexes: result.Indexes,
                             message: "获取索引列表成功",
-                        }, null, 2),
+                        }), null, 2),
                     },
                 ],
             };
@@ -6836,12 +6974,13 @@ checkIndex: 检查索引是否存在`),
                 content: [
                     {
                         type: "text",
-                        text: JSON.stringify({
+                        text: JSON.stringify(withCollectionName(collectionName, {
                             success: true,
+                            indexName,
                             exists: result.Exists,
                             requestId: result.RequestId,
                             message: result.Exists ? "索引已存在" : "索引不存在",
-                        }, null, 2),
+                        }), null, 2),
                     },
                 ],
             };
@@ -6905,12 +7044,12 @@ deleteCollection: 删除集合`),
                 content: [
                     {
                         type: "text",
-                        text: JSON.stringify({
+                        text: JSON.stringify(withCollectionName(collectionName, {
                             success: true,
                             requestId: result.RequestId,
                             action,
                             message: "云开发数据库集合创建成功",
-                        }, null, 2),
+                        }), null, 2),
                     },
                 ],
             };
@@ -6925,12 +7064,12 @@ deleteCollection: 删除集合`),
                 content: [
                     {
                         type: "text",
-                        text: JSON.stringify({
+                        text: JSON.stringify(withCollectionName(collectionName, {
                             success: true,
                             requestId: result.RequestId,
                             action,
                             message: "云开发数据库集合更新成功",
-                        }, null, 2),
+                        }), null, 2),
                     },
                 ],
             };
@@ -6938,12 +7077,12 @@ deleteCollection: 删除集合`),
         if (action === "deleteCollection") {
             const result = await cloudbase.database.deleteCollection(collectionName);
             (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
-            const body = {
+            const body = withCollectionName(collectionName, {
                 success: true,
                 requestId: result.RequestId,
                 action,
                 message: result.Exists === false ? "集合不存在" : "云开发数据库集合删除成功",
-            };
+            });
             if (result.Exists === false) {
                 body.exists = false;
             }
@@ -7009,17 +7148,21 @@ deleteCollection: 删除集合`),
             },
         });
         (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+        const documents = normalizeNoSqlDocuments(result.Data);
         return {
             content: [
                 {
                     type: "text",
-                    text: JSON.stringify({
+                    text: JSON.stringify(withCollectionName(collectionName, {
                         success: true,
                         requestId: result.RequestId,
-                        data: result.Data,
+                        data: documents,
+                        total: typeof result.Pager?.Total === "number"
+                            ? result.Pager.Total
+                            : documents.length,
                         pager: result.Pager,
                         message: "文档查询成功",
-                    }, null, 2),
+                    }), null, 2),
                 },
             ],
         };
@@ -7142,12 +7285,15 @@ async function insertDocuments({ collectionName, documents, getManager, logger,
         },
     });
     (0, cloudbase_manager_js_1.logCloudBaseResult)(logger, result);
-    return JSON.stringify({
+    return JSON.stringify(withCollectionName(collectionName, {
         success: true,
         requestId: result.RequestId,
         insertedIds: result.InsertedIds,
+        insertedCount: Array.isArray(result.InsertedIds)
+            ? result.InsertedIds.length
+            : undefined,
         message: "文档插入成功",
-    }, null, 2);
+    }), null, 2);
 }
 async function updateDocuments({ collectionName, query, update, isMulti, upsert, getManager, logger, }) {
     const cloudbase = await getManager();
@@ -7165,14 +7311,14 @@ async function updateDocuments({ collectionName, query, update, isMulti, upsert,
         },
     });
     (0, cloudbase_manager_js_1.logCloudBaseResult)(logger, result);
-    return JSON.stringify({
+    return JSON.stringify(withCollectionName(collectionName, {
         success: true,
         requestId: result.RequestId,
         modifiedCount: result.ModifiedNum,
         matchedCount: result.MatchedNum,
         upsertedId: result.UpsertedId,
         message: "文档更新成功",
-    }, null, 2);
+    }), null, 2);
 }
 async function deleteDocuments({ collectionName, query, isMulti, getManager, logger, }) {
     const cloudbase = await getManager();
@@ -7188,12 +7334,12 @@ async function deleteDocuments({ collectionName, query, isMulti, getManager, log
         },
     });
     (0, cloudbase_manager_js_1.logCloudBaseResult)(logger, result);
-    return JSON.stringify({
+    return JSON.stringify(withCollectionName(collectionName, {
         success: true,
         requestId: result.RequestId,
         deleted: result.Deleted,
         message: "文档删除成功",
-    }, null, 2);
+    }), null, 2);
 }
 
 
@@ -9056,11 +9202,11 @@ function registerGatewayTools(server) {
                     targetName: input.targetName,
                     path: accessPath,
                     raw: result,
-                }, `已为目标 ${input.targetName} 创建网关访问路径`, [
+                }, `已为目标 ${input.targetName} 创建网关访问路径。注意：路由配置传播通常需要等待 30 秒到 3 分钟，请勿立即访问。`, [
                     {
                         tool: "queryGateway",
                         action: "getAccess",
-                        reason: "确认访问入口是否已生效",
+                        reason: "等待 30 秒到 3 分钟后再确认访问入口是否已生效",
                     },
                 ]);
             }
@@ -9316,7 +9462,7 @@ function registerStorageTools(server) {
     // Tool 2: manageStorage - 管理存储文件（写操作）
     server.registerTool("manageStorage", {
         title: "管理存储文件",
-        description: "管理云存储文件，支持上传文件/目录、下载文件/目录、删除文件/目录等操作。删除操作需要设置force=true进行确认，防止误删除重要文件。",
+        description: "管理云存储文件，仅用于 COS/Storage 对象，不用于静态网站托管。支持上传文件/目录、下载文件/目录、删除文件/目录等操作。删除操作需要设置force=true进行确认，防止误删除重要文件。",
         inputSchema: manageStorageInputSchema,
         annotations: {
             readOnlyHint: false,
@@ -10385,7 +10531,7 @@ class TelemetryReporter {
         const nodeVersion = process.version; // Node.js版本
         const arch = os_1.default.arch(); // 系统架构
         // 从构建时注入的版本号获取MCP版本信息
-        const mcpVersion = process.env.npm_package_version || "2.15.2-beta.1" || 0;
+        const mcpVersion = process.env.npm_package_version || "2.15.2-beta.2" || 0;
         return {
             userAgent: `${osType} ${osRelease} ${arch} ${nodeVersion} CloudBase-MCP/${mcpVersion}`,
             deviceId: this.deviceId,
@@ -10699,11 +10845,14 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.MANAGE_FUNCTION_ACTIONS = exports.QUERY_FUNCTION_ACTIONS = exports.TRIGGER_CONFIG_EXAMPLES = exports.SUPPORTED_TRIGGER_TYPES = exports.DEFAULT_NODEJS_RUNTIME = exports.SUPPORTED_NODEJS_RUNTIMES = exports.RECOMMENDED_RUNTIMES = exports.DEFAULT_RUNTIME = exports.ALL_SUPPORTED_RUNTIMES = exports.SUPPORTED_RUNTIMES = void 0;
 exports.formatRuntimeList = formatRuntimeList;
+exports.shouldInstallDependencyForFunction = shouldInstallDependencyForFunction;
+exports.buildFunctionOperationErrorMessage = buildFunctionOperationErrorMessage;
 exports.registerFunctionTools = registerFunctionTools;
 const zod_1 = __webpack_require__(2971);
 const cloudbase_manager_js_1 = __webpack_require__(3431);
 const cloud_mode_js_1 = __webpack_require__(9684);
 const logger_js_1 = __webpack_require__(3039);
+const fs_1 = __webpack_require__(4421);
 const path_1 = __importDefault(__webpack_require__(2521));
 exports.SUPPORTED_RUNTIMES = {
     nodejs: [
@@ -10892,6 +11041,12 @@ function getExpectedFunctionPath(functionRootPath, functionName) {
         return undefined;
     return path_1.default.join(path_1.default.normalize(functionRootPath), functionName);
 }
+function shouldInstallDependencyForFunction(functionType, hasPackageJson) {
+    if (functionType === "HTTP") {
+        return hasPackageJson;
+    }
+    return true;
+}
 function buildFunctionOperationErrorMessage(operation, functionName, functionRootPath, error) {
     const baseMessage = error instanceof Error ? error.message : String(error);
     const suggestions = [];
@@ -10903,6 +11058,13 @@ function buildFunctionOperationErrorMessage(operation, functionName, functionRoo
         suggestions.push(`当前工具会从 \`functionRootPath + 函数名\` 查找代码目录，期望目录是 \`${expectedFunctionPath}\`。`);
         suggestions.push("如果你传入的已经是函数目录本身，请改为传它的父目录。");
     }
+    if (/paths\[0\].*undefined/i.test(baseMessage)) {
+        suggestions.push("HTTP 函数创建时需要提供 functionRootPath（指向 cloudfunctions 父目录）或 zipFile，否则 SDK 无法定位函数目录。");
+    }
+    if (/依赖安装失败|package\.json/i.test(baseMessage)) {
+        suggestions.push("如果 HTTP 函数只使用原生 Node.js API 且没有第三方依赖，可以保留函数目录中的 index.js 和 scf_bootstrap，工具会跳过依赖安装。");
+        suggestions.push("如果你确实依赖 npm 包，请在函数目录下补充 package.json 后重试。");
+    }
     if (suggestions.length === 0) {
         suggestions.push("请检查函数名、目录结构和环境中的函数状态后重试。");
     }
@@ -11278,8 +11440,21 @@ function registerFunctionTools(server) {
                         throw new Error(`不支持的运行时环境: "${String(func.runtime)}"\n\n支持的运行时:\n${formatRuntimeList()}`);
                     }
                 }
-                func.installDependency = true;
                 const processedRootPath = processFunctionRootPath(input.functionRootPath, functionName);
+                const functionType = typeof func.type === "string" ? func.type : undefined;
+                const expectedFunctionPath = getExpectedFunctionPath(processedRootPath, functionName);
+                if (functionType === "HTTP" && !processedRootPath && !input.zipFile) {
+                    throw new Error("createFunction 创建 HTTP 函数时，需要提供 functionRootPath（指向 cloudfunctions 父目录）或 zipFile。");
+                }
+                const hasPackageJson = expectedFunctionPath !== undefined
+                    ? (0, fs_1.existsSync)(path_1.default.join(expectedFunctionPath, "package.json"))
+                    : false;
+                func.installDependency = input.zipFile
+                    ? true
+                    : shouldInstallDependencyForFunction(functionType, hasPackageJson);
+                if (functionType === "HTTP" && processedRootPath && !hasPackageJson) {
+                    console.warn(`检测到 HTTP 函数 ${functionName} 目录下没有 package.json，已跳过依赖安装；如果你需要第三方依赖，请补充 package.json 后重试。`);
+                }
                 let result;
                 try {
                     result = await cloudbase.functions.createFunction({
@@ -11292,11 +11467,7 @@ function registerFunctionTools(server) {
                     throw wrapFunctionOperationError("createFunction", functionName, processedRootPath, error);
                 }
                 (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
-                return buildEnvelope({
-                    action: input.action,
-                    functionName,
-                    raw: result,
-                }, `已创建函数 ${functionName}`, [
+                const nextActions = [
                     {
                         tool: "queryFunctions",
                         action: "getFunctionDetail",
@@ -11307,7 +11478,37 @@ function registerFunctionTools(server) {
                         action: "listFunctionTriggers",
                         reason: "检查函数触发器",
                     },
-                ]);
+                ];
+                if (func.type === "HTTP") {
+                    nextActions.push({
+                        tool: "manageGateway",
+                        action: "createAccess",
+                        reason: "如果需要通过 URL 访问 HTTP 函数，请按实际路径和鉴权需求显式创建访问入口，不要默认假设 /函数名 已存在",
+                    });
+                    nextActions.push({
+                        tool: "queryGateway",
+                        action: "getAccess",
+                        reason: "交付前确认 HTTP 访问路径是否已存在并已生效",
+                    });
+                    nextActions.push({
+                        tool: "readSecurityRule",
+                        action: "读取安全规则",
+                        reason: "评测、浏览器或其他外部调用方可能以匿名身份访问；若直接报 EXCEED_AUTHORITY，应先读取当前函数安全规则",
+                    });
+                    nextActions.push({
+                        tool: "writeSecurityRule",
+                        action: "写入安全规则",
+                        reason: "只有在确认需要匿名访问时，才按实际安全要求调整函数安全规则，例如处理 EXCEED_AUTHORITY",
+                    });
+                }
+                const message = func.type === "HTTP"
+                    ? `已创建 HTTP 函数 ${functionName}。如果后续需要通过 URL 访问，请显式调用 manageGateway(action="createAccess") 按实际路径和鉴权需求创建访问入口。评测或其他外部调用方可能会以匿名身份访问，而且失败后不一定会把 EXCEED_AUTHORITY 再反馈给 AI；交付前请主动确认访问路径和函数安全规则，若已出现 EXCEED_AUTHORITY，请先调用 readSecurityRule(resourceType="function") 查看当前规则，再按需要使用 writeSecurityRule 调整权限。`
+                    : `已创建函数 ${functionName}`;
+                return buildEnvelope({
+                    action: input.action,
+                    functionName,
+                    raw: result,
+                }, message, nextActions);
             }
             case "updateFunctionCode": {
                 if (!input.functionName) {
@@ -11352,6 +11553,9 @@ function registerFunctionTools(server) {
                 }
                 const cloudbase = await getManager();
                 const functionDetail = await cloudbase.functions.getFunctionDetail(input.functionName);
+                if (!functionDetail) {
+                    throw new Error(`函数 ${input.functionName} 不存在或无法获取详情`);
+                }
                 const currentVpc = typeof functionDetail.VpcConfig === "object" &&
                     functionDetail.VpcConfig !== null &&
                     functionDetail.VpcConfig.SubnetId &&
@@ -12159,7 +12363,7 @@ function registerSetupTools(server) {
         title: "下载项目模板",
         description: `自动下载并部署CloudBase项目模板。⚠️ **MANDATORY FOR NEW PROJECTS** ⚠️
 
-**CRITICAL**: This tool MUST be called FIRST when starting a new project.\n\n支持的模板:\n- react: React + CloudBase 全栈应用模板\n- vue: Vue + CloudBase 全栈应用模板\n- miniprogram: 微信小程序 + 云开发模板  \n- uniapp: UniApp + CloudBase 跨端应用模板\n- rules: 只包含AI编辑器配置文件（包含Cursor、WindSurf、CodeBuddy等所有主流编辑器配置），适合在已有项目中补充AI编辑器配置\n\n支持的IDE类型:\n- all: 下载所有IDE配置\n- cursor: Cursor AI编辑器\n- 其他IDE类型见下方列表\n\n注意：如果未传入 ide 参数且无法从环境变量检测到 IDE，将提示错误并要求传入 ide 参数\n- windsurf: WindSurf AI编辑器\n- codebuddy: CodeBuddy AI编辑器\n- claude-code: Claude Code AI编辑器\n- cline: Cline AI编辑器\n- gemini-cli: Gemini CLI\n- opencode: OpenCode AI编辑器\n- qwen-code: 通义灵码\n- baidu-comate: 百度Comate\n- openai-codex-cli: OpenAI Codex CLI\n- augment-code: Augment Code\n- github-copilot: GitHub Copilot\n- roocode: RooCode AI编辑器\n- tongyi-lingma: 通义灵码\n- trae: Trae AI编辑器\n- qoder: Qoder AI编辑器\n- antigravity: Google Antigravity AI编辑器\n- vscode: Visual Studio Code\n- kiro: Kiro AI编辑器\n- aider: Aider AI编辑器\n\n特别说明：\n- rules 模板会自动包含当前 mcp 版本号信息（版本号：${ true ? "2.15.2-beta.1" : 0}），便于后续维护和版本追踪\n- 下载 rules 模板时，如果项目中已存在 README.md 文件，系统会自动保护该文件不被覆盖（除非设置 overwrite=true）`,
+**CRITICAL**: This tool MUST be called FIRST when starting a new project.\n\n支持的模板:\n- react: React + CloudBase 全栈应用模板\n- vue: Vue + CloudBase 全栈应用模板\n- miniprogram: 微信小程序 + 云开发模板  \n- uniapp: UniApp + CloudBase 跨端应用模板\n- rules: 只包含AI编辑器配置文件（包含Cursor、WindSurf、CodeBuddy等所有主流编辑器配置），适合在已有项目中补充AI编辑器配置\n\n支持的IDE类型:\n- all: 下载所有IDE配置\n- cursor: Cursor AI编辑器\n- 其他IDE类型见下方列表\n\n注意：如果未传入 ide 参数且无法从环境变量检测到 IDE，将提示错误并要求传入 ide 参数\n- windsurf: WindSurf AI编辑器\n- codebuddy: CodeBuddy AI编辑器\n- claude-code: Claude Code AI编辑器\n- cline: Cline AI编辑器\n- gemini-cli: Gemini CLI\n- opencode: OpenCode AI编辑器\n- qwen-code: 通义灵码\n- baidu-comate: 百度Comate\n- openai-codex-cli: OpenAI Codex CLI\n- augment-code: Augment Code\n- github-copilot: GitHub Copilot\n- roocode: RooCode AI编辑器\n- tongyi-lingma: 通义灵码\n- trae: Trae AI编辑器\n- qoder: Qoder AI编辑器\n- antigravity: Google Antigravity AI编辑器\n- vscode: Visual Studio Code\n- kiro: Kiro AI编辑器\n- aider: Aider AI编辑器\n\n特别说明：\n- rules 模板会自动包含当前 mcp 版本号信息（版本号：${ true ? "2.15.2-beta.2" : 0}），便于后续维护和版本追踪\n- 下载 rules 模板时，如果项目中已存在 README.md 文件，系统会自动保护该文件不被覆盖（除非设置 overwrite=true）`,
         inputSchema: {
             template: zod_1.z
                 .enum(["react", "vue", "miniprogram", "uniapp", "rules"])
@@ -13846,10 +14050,10 @@ function registerHostingTools(server) {
     // uploadFiles - 上传文件到静态网站托管 (cloud-incompatible)
     server.registerTool("uploadFiles", {
         title: "上传静态文件",
-        description: "上传文件到静态网站托管。部署前请先完成构建；如果站点会部署到子路径，请检查构建配置中的 publicPath、base、assetPrefix 等是否使用相对路径，避免静态资源加载失败。",
+        description: "上传文件到静态网站托管，仅用于 Web 站点部署，不用于云存储对象上传。部署前请先完成构建；如果站点会部署到子路径，请检查构建配置中的 publicPath、base、assetPrefix 等是否使用相对路径，避免静态资源加载失败。若需要上传 COS 云存储文件，请使用 manageStorage。",
         inputSchema: {
             localPath: zod_1.z.string().optional().describe("本地文件或文件夹路径，需要是绝对路径，例如 /tmp/files/data.txt。"),
-            cloudPath: zod_1.z.string().optional().describe("云端文件或文件夹路径，例如 files/data.txt。若部署到子路径，请同时检查构建配置中的 publicPath、base、assetPrefix 等是否为相对路径。"),
+            cloudPath: zod_1.z.string().optional().describe("静态托管云端文件或文件夹路径，例如 files/data.txt。若部署到子路径，请同时检查构建配置中的 publicPath、base、assetPrefix 等是否为相对路径。云存储对象路径请改用 manageStorage。"),
             files: zod_1.z.array(zod_1.z.object({
                 localPath: zod_1.z.string(),
                 cloudPath: zod_1.z.string()
@@ -14579,11 +14783,68 @@ module.exports = __WEBPACK_EXTERNAL_MODULE_crypto__;
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.WRITE_SECURITY_RULE = exports.READ_SECURITY_RULE = void 0;
+exports.normalizeCustomSecurityRule = normalizeCustomSecurityRule;
+exports.buildSecurityRuleErrorMessage = buildSecurityRuleErrorMessage;
 exports.registerSecurityRuleTools = registerSecurityRuleTools;
 const zod_1 = __webpack_require__(2971);
 const cloudbase_manager_js_1 = __webpack_require__(3431);
 exports.READ_SECURITY_RULE = "readSecurityRule";
 exports.WRITE_SECURITY_RULE = "writeSecurityRule";
+const FUNCTION_CUSTOM_RULE_EXAMPLE = JSON.stringify({
+    "*": {
+        invoke: true,
+    },
+}, null, 2);
+function isPlainObject(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        !Array.isArray(value));
+}
+function formatSecurityRuleInputHint(resourceType) {
+    if (resourceType === "function") {
+        return `函数自定义安全规则应传 JSON 对象或 JSON 字符串，例如 ${FUNCTION_CUSTOM_RULE_EXAMPLE}。`;
+    }
+    if (resourceType === "noSqlDatabase") {
+        return "NoSQL 自定义安全规则应传 JSON 对象或 JSON 字符串，例如 {\"read\":\"true\",\"write\":\"true\"}。";
+    }
+    return "自定义安全规则应传 JSON 对象或 JSON 字符串，并与 readSecurityRule 返回的规则结构保持一致。";
+}
+function normalizeCustomSecurityRule(resourceType, rule) {
+    if (rule === undefined) {
+        throw new Error(`resourceType=${resourceType} 且 aclTag=CUSTOM 时必须提供 rule 字段`);
+    }
+    if (typeof rule === "string") {
+        try {
+            const parsed = JSON.parse(rule);
+            if (!isPlainObject(parsed)) {
+                throw new Error(`rule 必须是 JSON 对象，不支持 ${Array.isArray(parsed) ? "数组" : typeof parsed}。`);
+            }
+            return JSON.stringify(parsed);
+        }
+        catch (error) {
+            const baseMessage = error instanceof Error ? error.message : "rule 不是合法的 JSON 字符串";
+            throw new Error(`${baseMessage} ${formatSecurityRuleInputHint(resourceType)}`);
+        }
+    }
+    if (!isPlainObject(rule)) {
+        throw new Error(`rule 必须是 JSON 对象或 JSON 字符串。${formatSecurityRuleInputHint(resourceType)}`);
+    }
+    return JSON.stringify(rule);
+}
+function buildSecurityRuleErrorMessage(operation, resourceType, aclTag, error) {
+    const baseMessage = error instanceof Error ? error.message : String(error);
+    const suggestions = [];
+    if (operation === "writeSecurityRule" && aclTag === "CUSTOM") {
+        suggestions.push(formatSecurityRuleInputHint(resourceType));
+    }
+    if (/INVALID_VALUE|ModifySecurityRule|错误的值|JSON/i.test(baseMessage)) {
+        suggestions.push("请先把 CUSTOM 规则整理成 JSON 对象，再传给 writeSecurityRule。");
+    }
+    if (suggestions.length === 0) {
+        suggestions.push("请检查 resourceType、aclTag 和 rule 是否与官方安全规则格式一致后重试。");
+    }
+    return `[${operation}] 调用失败: ${baseMessage}\n建议：${suggestions.join(" ")}`;
+}
 /**
  * 注册安全规则相关 Tool
  * @param server MCP Server 实例
@@ -14594,7 +14855,7 @@ function registerSecurityRuleTools(server) {
     // 读取安全规则 Tool
     server.registerTool?.(exports.READ_SECURITY_RULE, {
         title: "读取安全规则",
-        description: `读取指定资源（noSQL 数据库、SQL 数据库、云函数、存储桶）的安全规则和权限类别。`,
+        description: `读取指定资源（noSQL 数据库、SQL 数据库、云函数、存储桶）的安全规则和权限类别。\n\n安全规则文档：\n- 云函数安全规则：https://docs.cloudbase.net/cloud-function/security-rules\n- 存储安全规则：https://docs.cloudbase.net/storage/security-rules\n- 文档型数据库安全规则：https://docs.cloudbase.net/database/security-rules`,
         inputSchema: {
             resourceType: zod_1.z
                 .enum(["noSqlDatabase", "sqlDatabase", "function", "storage"])
@@ -14680,7 +14941,7 @@ function registerSecurityRuleTools(server) {
     // 写入安全规则 Tool
     server.registerTool?.(exports.WRITE_SECURITY_RULE, {
         title: "写入安全规则",
-        description: `设置指定资源（数据库集合、云函数、存储桶）的安全规则。`,
+        description: `设置指定资源（数据库集合、云函数、存储桶）的安全规则。\n\n安全规则文档：\n- 云函数安全规则：https://docs.cloudbase.net/cloud-function/security-rules\n- 存储安全规则：https://docs.cloudbase.net/storage/security-rules\n- 数据库安全规则：https://docs.cloudbase.net/database/security-rules\n\n云函数安全规则仅支持 aclTag="CUSTOM"，rule 字段为 JSON 字符串。例如放开所有访问可设置 rule="true"。`,
         inputSchema: {
             resourceType: zod_1.z
                 .enum(["sqlDatabase", "noSqlDatabase", "function", "storage"])
@@ -14692,9 +14953,9 @@ function registerSecurityRuleTools(server) {
                 .enum(["READONLY", "PRIVATE", "ADMINWRITE", "ADMINONLY", "CUSTOM"])
                 .describe("权限类别"),
             rule: zod_1.z
-                .string()
+                .union([zod_1.z.string(), zod_1.z.record(zod_1.z.any())])
                 .optional()
-                .describe("自定义安全规则内容，仅当 aclTag 为 CUSTOM 时必填"),
+                .describe(`自定义安全规则内容，仅当 aclTag 为 CUSTOM 时必填。可以直接传 JSON 对象，或者传可解析为 JSON 对象的字符串。函数示例：${FUNCTION_CUSTOM_RULE_EXAMPLE}`),
         },
         annotations: {
             readOnlyHint: false,
@@ -14702,138 +14963,140 @@ function registerSecurityRuleTools(server) {
             category: "security-rule",
         },
     }, async ({ resourceType, resourceId, aclTag, rule }) => {
-        const cloudbase = await getManager();
-        const envId = await (0, cloudbase_manager_js_1.getEnvId)(cloudBaseOptions);
-        let result;
-        if (resourceType === "noSqlDatabase") {
-            if (aclTag === "CUSTOM") {
-                if (!rule)
-                    throw new Error("noSQL 数据库自定义安全规则（CUSTOM）必须提供 rule 字段");
-                result = await cloudbase.commonService().call({
-                    Action: "ModifySafeRule",
-                    Param: {
-                        CollectionName: resourceId,
-                        EnvId: envId,
-                        AclTag: aclTag,
-                        Rule: rule,
-                    },
-                });
-                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+        try {
+            const cloudbase = await getManager();
+            const envId = await (0, cloudbase_manager_js_1.getEnvId)(cloudBaseOptions);
+            let result;
+            if (resourceType === "noSqlDatabase") {
+                if (aclTag === "CUSTOM") {
+                    const normalizedRule = normalizeCustomSecurityRule(resourceType, rule);
+                    result = await cloudbase.commonService().call({
+                        Action: "ModifySafeRule",
+                        Param: {
+                            CollectionName: resourceId,
+                            EnvId: envId,
+                            AclTag: aclTag,
+                            Rule: normalizedRule,
+                        },
+                    });
+                    (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                }
+                else {
+                    result = await cloudbase.commonService().call({
+                        Action: "ModifyDatabaseACL",
+                        Param: {
+                            CollectionName: resourceId,
+                            EnvId: envId,
+                            AclTag: aclTag,
+                        },
+                    });
+                    (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                }
             }
-            else {
+            else if (resourceType === "function") {
+                if (aclTag !== "CUSTOM")
+                    throw new Error("云函数安全规则仅支持 CUSTOM 权限类别");
+                const normalizedRule = normalizeCustomSecurityRule(resourceType, rule);
                 result = await cloudbase.commonService().call({
-                    Action: "ModifyDatabaseACL",
+                    Action: "ModifySecurityRule",
                     Param: {
-                        CollectionName: resourceId,
-                        EnvId: envId,
                         AclTag: aclTag,
-                    },
-                });
-                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
-            }
-        }
-        else if (resourceType === "function") {
-            if (aclTag !== "CUSTOM")
-                throw new Error("云函数安全规则仅支持 CUSTOM 权限类别");
-            if (!rule)
-                throw new Error("云函数自定义安全规则（CUSTOM）必须提供 rule 字段");
-            result = await cloudbase.commonService().call({
-                Action: "ModifySecurityRule",
-                Param: {
-                    AclTag: aclTag,
-                    EnvId: envId,
-                    ResourceType: "FUNCTION",
-                    Rule: rule,
-                },
-            });
-            (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
-        }
-        else if (resourceType === "storage") {
-            if (aclTag === "CUSTOM") {
-                if (!rule)
-                    throw new Error("存储自定义安全规则（CUSTOM）必须提供 rule 字段");
-                result = await cloudbase.commonService().call({
-                    Action: "ModifyStorageSafeRule",
-                    Param: {
-                        Bucket: resourceId,
                         EnvId: envId,
-                        AclTag: aclTag,
-                        Rule: rule,
+                        ResourceType: "FUNCTION",
+                        Rule: normalizedRule,
                     },
                 });
                 (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
             }
-            else {
-                result = await cloudbase.commonService().call({
-                    Action: "ModifyStorageSafeRule",
+            else if (resourceType === "storage") {
+                if (aclTag === "CUSTOM") {
+                    const normalizedRule = normalizeCustomSecurityRule(resourceType, rule);
+                    result = await cloudbase.commonService().call({
+                        Action: "ModifyStorageSafeRule",
+                        Param: {
+                            Bucket: resourceId,
+                            EnvId: envId,
+                            AclTag: aclTag,
+                            Rule: normalizedRule,
+                        },
+                    });
+                    (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                }
+                else {
+                    result = await cloudbase.commonService().call({
+                        Action: "ModifyStorageSafeRule",
+                        Param: {
+                            Bucket: resourceId,
+                            EnvId: envId,
+                            AclTag: aclTag,
+                        },
+                    });
+                    (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                }
+            }
+            else if (resourceType === "sqlDatabase") {
+                if (aclTag === "CUSTOM") {
+                    throw new Error("SQL 数据库不支持自定义安全规则（CUSTOM）");
+                }
+                const schema = envId;
+                const tableName = resourceId;
+                const instanceId = "default";
+                const resource = `${instanceId}#${schema}#${tableName}`;
+                const resourceType = "table";
+                const effect = "allow";
+                const policyList = [
+                    "allUser",
+                    "anonymousUser",
+                    "externalUser",
+                    "internalUser",
+                ].map((roleIdentity) => ({
+                    RoleIdentity: roleIdentity,
+                    ResourceType: resourceType,
+                    ResourceId: resource,
+                    RowPermission: [],
+                    Effect: effect,
+                }));
+                policyList[0].RowPermission = getRowPermission(aclTag);
+                result = await cloudbase.commonService("lowcode").call({
+                    Action: "BatchCreateResourcePolicy",
                     Param: {
-                        Bucket: resourceId,
                         EnvId: envId,
-                        AclTag: aclTag,
+                        PolicyList: policyList,
                     },
                 });
                 (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                function getRowPermission(policy) {
+                    return {
+                        READONLY: [
+                            { Key: "all", Value: "r" },
+                            { Key: "me", Value: "rw" },
+                        ],
+                        PRIVATE: [{ Key: "me", Value: "rw" }],
+                        ADMINWRITE: [{ Key: "all", Value: "r" }],
+                        ADMINONLY: [],
+                    }[policy];
+                }
             }
-        }
-        else if (resourceType === "sqlDatabase") {
-            if (aclTag === "CUSTOM") {
-                throw new Error("SQL 数据库不支持自定义安全规则（CUSTOM）");
-            }
-            const schema = envId;
-            const tableName = resourceId;
-            const instanceId = "default";
-            const resource = `${instanceId}#${schema}#${tableName}`;
-            const resourceType = "table";
-            const effect = "allow";
-            const policyList = [
-                "allUser",
-                "anonymousUser",
-                "externalUser",
-                "internalUser",
-            ].map((roleIdentity) => ({
-                RoleIdentity: roleIdentity,
-                ResourceType: resourceType,
-                ResourceId: resource,
-                RowPermission: [],
-                Effect: effect,
-            }));
-            policyList[0].RowPermission = getRowPermission(aclTag);
-            result = await cloudbase.commonService("lowcode").call({
-                Action: "BatchCreateResourcePolicy",
-                Param: {
-                    EnvId: envId,
-                    PolicyList: policyList,
-                },
-            });
-            (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
-            function getRowPermission(policy) {
-                return {
-                    READONLY: [
-                        { Key: "all", Value: "r" },
-                        { Key: "me", Value: "rw" },
-                    ],
-                    PRIVATE: [{ Key: "me", Value: "rw" }],
-                    ADMINWRITE: [{ Key: "all", Value: "r" }],
-                    ADMINONLY: [],
-                }[policy];
+            else {
+                throw new Error(`不支持的资源类型: ${resourceType}`);
             }
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: JSON.stringify({
+                            success: true,
+                            requestId: result.RequestId,
+                            raw: result,
+                            message: "安全规则写入成功",
+                        }, null, 2),
+                    },
+                ],
+            };
         }
-        else {
-            throw new Error(`不支持的资源类型: ${resourceType}`);
+        catch (error) {
+            throw new Error(buildSecurityRuleErrorMessage("writeSecurityRule", resourceType, aclTag, error));
         }
-        return {
-            content: [
-                {
-                    type: "text",
-                    text: JSON.stringify({
-                        success: true,
-                        requestId: result.RequestId,
-                        raw: result,
-                        message: "安全规则写入成功",
-                    }, null, 2),
-                },
-            ],
-        };
     });
 }
 
@@ -14954,12 +15217,15 @@ As the most important part of application development, the following four core c
 **Refer to deployment process in \`rules/web-development/rule.md\`**
 - Use CloudBase static hosting after build completion
 - Deploy using \`uploadFiles\` tool
+- \`uploadFiles\` is only for static hosting deployment; do not use it for COS / cloud storage uploads. For storage objects, use \`manageStorage(action="upload")\`
 - Remind users that CDN has a few minutes of cache after deployment
 - Generate markdown format access links with random queryString
 
 ### 4. Backend Deployment (Cloud Functions or CloudRun)
 **Refer to \`rules/cloudrun-development/rule.md\`**
-- **Cloud Function Deployment**: Prefer \`queryFunctions\` to inspect current state, then use \`manageFunctions\` with \`action="createFunction"\` or \`action="updateFunctionCode"\`
+- **Cloud Function Deployment**: Prefer \`queryFunctions\` to inspect current state, then use \`manageFunctions\` with \`action="createFunction"\` or \`action="updateFunctionCode"\`.
+- In agent / non-interactive runs, treat \`manageFunctions\` as the default deployment path for both Event and HTTP functions; do not fall back to CLI login flows unless MCP tools are unavailable.
+- For HTTP functions, create or update them through \`manageFunctions\` with \`func.type="HTTP"\` instead of relying on \`tcb fn deploy\` as the primary path.
 - **CloudRun Deployment**: Use \`manageCloudRun\` tool for containerized deployment
 - Ensure backend code supports CORS, prepare Dockerfile (for container type)
 
@@ -15058,11 +15324,11 @@ If remote links are needed in the application, can continue to call uploadFile t
 
 ### Deployment Process
 
-1. **Cloud Function Deployment Process**: Prefer \`queryFunctions\` to query current functions, then call \`manageFunctions\` with \`action="createFunction"\` or \`action="updateFunctionCode"\` to deploy cloud function code. Only need to point \`functionRootPath\` to the parent directory of the cloud function directory (for example, the absolute path of the \`cloudfunctions\` directory). No need for code compression or other preprocessing.
+1. **Cloud Function Deployment Process**: Prefer \`queryFunctions\` to query current functions, then call \`manageFunctions\` with \`action="createFunction"\` or \`action="updateFunctionCode"\` to deploy cloud function code. In agent / non-interactive runs, keep deployment on MCP tools instead of CLI login flows. For HTTP functions, set \`func.type="HTTP"\` when creating them. Only need to point \`functionRootPath\` to the parent directory of the cloud function directory (for example, the absolute path of the \`cloudfunctions\` directory). No need for code compression or other preprocessing.
 
 2. **CloudRun Deployment Process**: For non-cloud function backend services (Java, Go, PHP, Python, Node.js, etc.), use manageCloudRun tool for deployment. Ensure backend code supports CORS, prepare Dockerfile, then call manageCloudRun for containerized deployment. For details, refer to \`rules/cloudrun-development/rule.md\`
 
-3. **Static Hosting Deployment Process**: Deploy using uploadFiles tool. After deployment, remind users that CDN has a few minutes of cache. Can generate markdown format access links with random queryString. For details, refer to \`rules/web-development/rule.md\`
+3. **Static Hosting Deployment Process**: Deploy using uploadFiles tool for static hosting only. If the task needs a COS object that must be queried or polled with the storage SDK, use \`manageStorage\` / \`queryStorage\` instead. After deployment, remind users that CDN has a few minutes of cache. Can generate markdown format access links with random queryString. For details, refer to \`rules/web-development/rule.md\`
 
 ### Documentation Generation Rules
 
@@ -16066,7 +16332,9 @@ function buildProvisionNextActions(status, request) {
         return [];
     }
     return [
-        buildNextAction(QUERY_SQL_DATABASE, "describeTaskStatus", "MySQL provisioning is still running. Check task status before initializing schema.", request ? { action: "describeTaskStatus", request } : { action: "describeTaskStatus" }),
+        buildNextAction(QUERY_SQL_DATABASE, "describeCreateResult", "MySQL provisioning is still running. Check the create result again before initializing schema.", request
+            ? { action: "describeCreateResult", request }
+            : { action: "describeCreateResult" }),
     ];
 }
 function inferTaskKind(request) {