@cloudbase/cloudbase-mcp 2.15.4 → 2.16.1-beta.1

package/dist/index.js

@@ -169,7 +169,21 @@ const DEFAULT_AUTH_ACTIONS = [
     "start_auth",
     "set_env",
     "logout",
+    "get_temp_credentials",
 ];
+function maskSensitiveValue(value) {
+    if (value.length <= 4) {
+        return "*".repeat(value.length);
+    }
+    return `${value.slice(0, 2)}******${value.slice(-2)}`;
+}
+function isTemporaryCredentialLoginState(loginState) {
+    const refreshToken = normalizeOptionalToolString(loginState.refreshToken);
+    const token = normalizeOptionalToolString(loginState.token);
+    const accessTokenExpired = typeof loginState.accessTokenExpired === "number" ||
+        typeof loginState.accessTokenExpired === "string";
+    return Boolean(token && (refreshToken || accessTokenExpired));
+}
 function getCurrentIde(server) {
     return server.ide || process.env.INTEGRATION_IDE || "";
 }
@@ -532,6 +546,14 @@ function registerEnvTools(server) {
                         .describe("action=logout 时确认操作，传 yes"),
                 }
                 : {}),
+            ...(supportedAuthActions.includes("get_temp_credentials")
+                ? {
+                    reveal: zod_1.z
+                        .boolean()
+                        .optional()
+                        .describe("action=get_temp_credentials 时可选。true=返回明文临时密钥；默认 false 仅返回脱敏结果"),
+                }
+                : {}),
         },
         annotations: {
             readOnlyHint: false,
@@ -550,6 +572,7 @@ function registerEnvTools(server) {
         const oauthCustom = normalizeOptionalToolBoolean(rawArgs.oauthCustom);
         const envId = rawArgs.envId;
         const confirm = rawArgs.confirm === "yes" ? "yes" : undefined;
+        const reveal = normalizeOptionalToolBoolean(rawArgs.reveal) === true;
         const resolvedAuthOptions = resolveToolAuthOptions(server, {
             authMode,
             oauthEndpoint,
@@ -860,6 +883,58 @@ function registerEnvTools(server) {
                     message: "✅ 已退出登录",
                 });
             }
+            if (action === "get_temp_credentials") {
+                const loginState = (await (0, auth_js_1.peekLoginState)());
+                if (!loginState) {
+                    return (0, tool_result_js_1.buildJsonToolResult)({
+                        ok: false,
+                        code: "AUTH_REQUIRED",
+                        message: "当前未登录，请先完成管理端认证后再获取临时密钥。",
+                        next_step: buildAuthRequiredNextStep(server),
+                    });
+                }
+                if (confirm !== "yes") {
+                    return (0, tool_result_js_1.buildJsonToolResult)({
+                        ok: false,
+                        code: "INVALID_ARGS",
+                        message: "action=get_temp_credentials 时必须显式传 confirm=\"yes\"，以确认你要导出当前管理端临时密钥。",
+                        next_step: (0, tool_result_js_1.buildAuthNextStep)("get_temp_credentials", {
+                            suggestedArgs: { action: "get_temp_credentials", confirm: "yes" },
+                        }),
+                    });
+                }
+                if (!isTemporaryCredentialLoginState(loginState)) {
+                    return (0, tool_result_js_1.buildJsonToolResult)({
+                        ok: false,
+                        code: "UNSUPPORTED_CREDENTIAL_TYPE",
+                        message: "当前登录态不是可导出的临时密钥。仅支持通过 Web / device 登录得到的临时密钥，永久密钥登录不允许导出。",
+                    });
+                }
+                const secretId = normalizeOptionalToolString(loginState.secretId);
+                const secretKey = normalizeOptionalToolString(loginState.secretKey);
+                const token = normalizeOptionalToolString(loginState.token);
+                if (!secretId || !secretKey || !token) {
+                    return (0, tool_result_js_1.buildJsonToolResult)({
+                        ok: false,
+                        code: "INTERNAL_ERROR",
+                        message: "当前登录态缺少完整的临时密钥字段，请重新登录后再试。",
+                    });
+                }
+                return (0, tool_result_js_1.buildJsonToolResult)({
+                    ok: true,
+                    code: "TEMP_CREDENTIALS_READY",
+                    message: reveal
+                        ? "当前管理端临时密钥已准备好，请注意避免泄露。"
+                        : "当前管理端临时密钥已准备好，默认仅返回脱敏结果。",
+                    env_id: normalizeOptionalToolString(loginState.envId) ?? null,
+                    credentials: {
+                        secretId: reveal ? secretId : maskSensitiveValue(secretId),
+                        secretKey: reveal ? secretKey : maskSensitiveValue(secretKey),
+                        token: reveal ? token : maskSensitiveValue(token),
+                        masked: !reveal,
+                    },
+                });
+            }
             return (0, tool_result_js_1.buildJsonToolResult)({
                 ok: false,
                 code: "NOT_SUPPORTED",
@@ -1282,7 +1357,15 @@ function registerCapiTools(server) {
     const getManager = () => (0, cloudbase_manager_js_1.getCloudBaseManager)({ cloudBaseOptions });
     server.registerTool?.("callCloudApi", {
         title: "调用云API",
-        description: `通用的云 API 调用工具，主要用于 CloudBase / 腾讯云管控面与依赖资源相关 API 调用。调用前请先确认 service、Action 与 Param，避免猜测 Action 名称。如果你的目标是通过 HTTP 协议直接集成 auth/functions/cloudrun/storage/mysqldb 等 CloudBase 业务 API，请不要优先使用 callCloudApi，而应优先查看对应 OpenAPI / Swagger。现有 OpenAPI / Swagger 能力不是通用的管控面 Action 集合；管控面 API 请优先参考 CloudBase API 概览 ${CLOUDBASE_CONTROL_PLANE_DOC_URL} 与云开发依赖资源接口指引 ${CLOUDBASE_DEPENDENCY_API_DOC_URL}。对于 tcb，可参考类似 \`CreateEnv\`、\`ModifyEnv\`、\`DestroyEnv\` 这类真实 Action 组织请求；销毁环境时，常见做法是至少带上 \`EnvId\` 和 \`BypassCheck: true\`，如果环境已经处于隔离期再按文档补 \`IsForce: true\`。`,
+        description: `通用的云 API 调用工具，主要用于 CloudBase / 腾讯云管控面与依赖资源相关 API 调用。调用前请先确认 service、Action 与 Param，避免猜测 Action 名称。如果你的目标是通过 HTTP 协议直接集成 auth/functions/cloudrun/storage/mysqldb 等 CloudBase 业务 API，请不要优先使用 callCloudApi，而应优先查看对应 OpenAPI / Swagger。现有 OpenAPI / Swagger 能力不是通用的管控面 Action 集合；管控面 API 请优先参考 CloudBase API 概览 ${CLOUDBASE_CONTROL_PLANE_DOC_URL} 与云开发依赖资源接口指引 ${CLOUDBASE_DEPENDENCY_API_DOC_URL}。对于 tcb service，常用 Action 分类如下：
+
+**环境管理**: \`CreateEnv\`、\`ModifyEnv\`、\`DescribeEnvs\`、\`DestroyEnv\`
+**用户管理**: \`CreateUser\`、\`ModifyUser\`、\`DescribeUserList\`、\`DeleteUsers\`
+**认证配置**: \`EditAuthConfig\`、\`DescribeAuthDomains\`
+**云函数**: \`DescribeFunctions\`、\`CreateFunction\`、\`UpdateFunctionCode\`、\`DeleteFunction\`
+**数据库**: \`CreateMySQLInstance\`、\`DescribeMySQLInstances\`、\`DestroyMySQLInstance\`
+
+销毁环境时，常见做法是至少带上 \`EnvId\` 和 \`BypassCheck: true\`，如果环境已经处于隔离期再按文档补 \`IsForce: true\`。`,
         inputSchema: {
             service: zod_1.z
                 .enum(ALLOWED_SERVICES)
@@ -1290,7 +1373,7 @@ function registerCapiTools(server) {
             action: zod_1.z
                 .string()
                 .min(1)
-                .describe("具体 Action 名称，需符合对应服务的官方 API 定义。若不确定正确 Action，请先查官方文档；不要用近义词或历史命名进行猜测。对于 tcb，可优先参考 `CreateEnv`、`ModifyEnv`、`DestroyEnv`、`DescribeBillingInfo` 等真实 Action。"),
+                .describe("具体 Action 名称，需符合对应服务的官方 API 定义。若不确定正确 Action，请先查官方文档；不要用近义词或历史命名进行猜测。tcb 常用 Action：环境管理 CreateEnv/ModifyEnv/DescribeEnvs/DestroyEnv、用户管理 CreateUser/ModifyUser/DescribeUserList/DeleteUsers、认证配置 EditAuthConfig、云函数 DescribeFunctions/CreateFunction、数据库 CreateMySQLInstance 等。"),
             params: zod_1.z
                 .record(zod_1.z.any())
                 .optional()
@@ -1426,7 +1509,7 @@ ${envIdSection}
 ## 环境信息
 - 操作系统: ${os_1.default.type()} ${os_1.default.release()}
 - Node.js版本: ${process.version}
-- MCP 版本：${process.env.npm_package_version || "2.15.4" || 0}
+- MCP 版本：${process.env.npm_package_version || "2.16.1-beta.1" || 0}
 - 系统架构: ${os_1.default.arch()}
 - 时间: ${new Date().toISOString()}
 - 请求ID: ${requestId}
@@ -1637,10 +1720,14 @@ const cloudrun_js_1 = __webpack_require__(5023);
 const dataModel_js_1 = __webpack_require__(4052);
 const gateway_js_1 = __webpack_require__(4319);
 const invite_code_js_1 = __webpack_require__(4760);
-const security_rule_js_1 = __webpack_require__(7862);
+const agents_js_1 = __webpack_require__(9527);
+const app_auth_js_1 = __webpack_require__(5313);
+const apps_js_1 = __webpack_require__(6817);
+const logs_js_1 = __webpack_require__(2322);
+const permissions_js_1 = __webpack_require__(6485);
 const cloud_mode_js_1 = __webpack_require__(9684);
 const logger_js_1 = __webpack_require__(3039);
-const tencet_cloud_js_1 = __webpack_require__(5018);
+const tencent_cloud_js_1 = __webpack_require__(1454);
 const tool_result_js_1 = __webpack_require__(9835);
 const tool_wrapper_js_1 = __webpack_require__(1363);
 // 默认插件列表
@@ -1654,15 +1741,18 @@ const DEFAULT_PLUGINS = [
     "rag",
     "cloudrun",
     "gateway",
+    "app-auth",
+    "permissions",
+    "logs",
+    "agents",
     "download",
-    "security-rule",
     "invite-code",
     "capi",
 ];
 function registerDatabase(server) {
     // Skip NoSQL database tools for international region (Singapore) as it doesn't support NoSQL DB
     const region = server.cloudBaseOptions?.region || process.env.TCB_REGION;
-    if (!(0, tencet_cloud_js_1.isInternationalRegion)(region)) {
+    if (!(0, tencent_cloud_js_1.isInternationalRegion)(region)) {
         (0, databaseNoSQL_js_1.registerDatabaseTools)(server);
     }
     (0, databaseSQL_js_1.registerSQLDatabaseTools)(server);
@@ -1679,15 +1769,28 @@ const AVAILABLE_PLUGINS = {
     rag: { name: "rag", register: rag_js_1.registerRagTools },
     download: { name: "download", register: download_js_1.registerDownloadTools },
     gateway: { name: "gateway", register: gateway_js_1.registerGatewayTools },
-    // miniprogram: { name: 'miniprogram', register: registerMiniprogramTools },
-    "security-rule": {
-        name: "security-rule",
-        register: security_rule_js_1.registerSecurityRuleTools,
-    },
+    "app-auth": { name: "app-auth", register: app_auth_js_1.registerAppAuthTools },
+    permissions: { name: "permissions", register: permissions_js_1.registerPermissionTools },
+    logs: { name: "logs", register: logs_js_1.registerLogTools },
+    agents: { name: "agents", register: agents_js_1.registerAgentTools },
+    apps: { name: "apps", register: apps_js_1.registerAppTools },
     "invite-code": { name: "invite-code", register: invite_code_js_1.registerInviteCodeTools },
     cloudrun: { name: "cloudrun", register: cloudrun_js_1.registerCloudRunTools },
     capi: { name: "capi", register: capi_js_1.registerCapiTools },
 };
+const PLUGIN_ALIASES = {
+    "access-control": "permissions",
+    "auth-config": "app-auth",
+    "security-rule": "permissions",
+    "security-rules": "permissions",
+    "secret-rule": "permissions",
+    "secret-rules": "permissions",
+    users: "permissions",
+};
+function normalizePluginName(name) {
+    const normalized = name.trim().toLowerCase().replace(/\s+/g, "-");
+    return PLUGIN_ALIASES[normalized] ?? normalized;
+}
 /**
  * Parse enabled plugins list
  * @param pluginsEnabled Optional array of enabled plugin names (takes precedence over env var)
@@ -1710,12 +1813,19 @@ function parseEnabledPlugins(pluginsEnabled, pluginsDisabled) {
     }
     const allDisabledPlugins = new Set();
     if (disabledEnv) {
-        disabledEnv.split(",").map((p) => p.trim()).forEach((p) => allDisabledPlugins.add(p));
+        disabledEnv
+            .split(",")
+            .map((p) => normalizePluginName(p))
+            .forEach((p) => allDisabledPlugins.add(p));
     }
     if (pluginsDisabled && pluginsDisabled.length > 0) {
-        pluginsDisabled.forEach((p) => allDisabledPlugins.add(p));
+        pluginsDisabled
+            .map((p) => normalizePluginName(p))
+            .forEach((p) => allDisabledPlugins.add(p));
     }
-    enabledPlugins = enabledPlugins.filter((p) => !allDisabledPlugins.has(p));
+    enabledPlugins = Array.from(new Set(enabledPlugins
+        .map((p) => normalizePluginName(p))
+        .filter((p) => !allDisabledPlugins.has(p))));
     return enabledPlugins;
 }
 /**
@@ -1823,6 +1933,26 @@ Object.defineProperty(exports, "reportToolkitLifecycle", ({ enumerable: true, ge
 Object.defineProperty(exports, "telemetryReporter", ({ enumerable: true, get: function () { return telemetry_js_1.telemetryReporter; } }));
 
 
+/***/ }),
+
+/***/ 1454:
+/***/ ((__unused_webpack_module, exports) => {
+
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.isInternationalRegion = void 0;
+exports.isValidRegion = isValidRegion;
+const REGION = {
+    SHANGHAI: 'ap-shanghai',
+    SINGAPORE: 'ap-singapore',
+};
+const isInternationalRegion = (region) => region === REGION.SINGAPORE;
+exports.isInternationalRegion = isInternationalRegion;
+function isValidRegion(region) {
+    return Object.values(REGION).includes(region);
+}
+
+
 /***/ }),
 
 /***/ 1622:
@@ -1837,6 +1967,90 @@ module.exports = __WEBPACK_EXTERNAL_MODULE_open__;
 
 module.exports = __WEBPACK_EXTERNAL_MODULE__cloudbase_toolbox_034e5bd0__;
 
+/***/ }),
+
+/***/ 2322:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.registerLogTools = registerLogTools;
+const zod_1 = __webpack_require__(2971);
+const cloudbase_manager_js_1 = __webpack_require__(3431);
+const json_content_js_1 = __webpack_require__(4365);
+const QUERY_LOG_ACTIONS = ["checkLogService", "searchLogs"];
+function buildEnvelope(data, message) {
+    return {
+        success: true,
+        data,
+        message,
+    };
+}
+function buildErrorEnvelope(error) {
+    return {
+        success: false,
+        data: {},
+        message: error instanceof Error ? error.message : String(error),
+    };
+}
+function registerLogTools(server) {
+    const cloudBaseOptions = server.cloudBaseOptions;
+    const getManager = () => (0, cloudbase_manager_js_1.getCloudBaseManager)({ cloudBaseOptions });
+    server.registerTool?.("queryLogs", {
+        title: "查询日志服务",
+        description: "日志域统一只读入口。支持检查日志服务状态并搜索 CLS 日志。",
+        inputSchema: {
+            action: zod_1.z.enum(QUERY_LOG_ACTIONS),
+            queryString: zod_1.z.string().optional(),
+            service: zod_1.z.enum(["tcb", "tcbr"]).optional(),
+            startTime: zod_1.z.string().optional(),
+            endTime: zod_1.z.string().optional(),
+            limit: zod_1.z.number().optional(),
+            context: zod_1.z.string().optional(),
+            sort: zod_1.z.enum(["asc", "desc"]).optional(),
+        },
+        annotations: {
+            readOnlyHint: true,
+            openWorldHint: true,
+            category: "logs",
+        },
+    }, async ({ action, queryString, service, startTime, endTime, limit, context, sort, }) => {
+        try {
+            const cloudbase = await getManager();
+            if (action === "checkLogService") {
+                const enabled = await cloudbase.log.checkLogServiceEnabled();
+                return (0, json_content_js_1.jsonContent)(buildEnvelope({
+                    action,
+                    enabled,
+                }, enabled ? "日志服务已开通" : "日志服务未开通或仍在初始化中"));
+            }
+            if (!queryString) {
+                throw new Error("action=searchLogs 时必须提供 queryString");
+            }
+            const result = await cloudbase.log.searchClsLog({
+                queryString,
+                StartTime: startTime ?? "1970-01-01 00:00:00",
+                EndTime: endTime ?? "2099-12-31 23:59:59",
+                Limit: limit ?? 20,
+                Context: context,
+                Sort: sort,
+                service,
+            });
+            (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+            return (0, json_content_js_1.jsonContent)(buildEnvelope({
+                action,
+                queryString,
+                results: result.LogResults ?? null,
+                raw: result,
+            }, "日志检索成功"));
+        }
+        catch (error) {
+            return (0, json_content_js_1.jsonContent)(buildErrorEnvelope(error));
+        }
+    });
+}
+
+
 /***/ }),
 
 /***/ 2344:
@@ -3257,7 +3471,13 @@ async function getCloudBaseManager(options = {}) {
  * @returns CloudBase manager instance
  */
 function createCloudBaseManagerWithOptions(cloudBaseOptions) {
-    (0, logger_js_1.debug)('Create manager with provided CloudBase options:', cloudBaseOptions);
+    (0, logger_js_1.debug)('Create manager with provided CloudBase options:', {
+        envId: cloudBaseOptions.envId,
+        region: cloudBaseOptions.region,
+        hasSecretId: !!cloudBaseOptions.secretId,
+        hasSecretKey: !!cloudBaseOptions.secretKey,
+        hasToken: !!cloudBaseOptions.token,
+    });
     // Region priority: cloudBaseOptions.region > process.env.TCB_REGION > undefined (use SDK default)
     const region = cloudBaseOptions.region ?? process.env.TCB_REGION ?? undefined;
     const manager = new manager_node_1.default({
@@ -3329,6 +3549,8 @@ const cloudbase_manager_js_1 = __webpack_require__(3431);
 const CATEGORY = "NoSQL database";
 const COLLECTION_READY_TIMEOUT_MS = 10000;
 const COLLECTION_READY_POLL_INTERVAL_MS = 500;
+/** Convert object values to JSON strings for API calls */
+const toJSONString = (v) => typeof v === "object" && v !== null ? JSON.stringify(v) : v;
 // 获取数据库实例ID
 async function getDatabaseInstanceId(getManager) {
     const cloudbase = await getManager();
@@ -3762,7 +3984,6 @@ deleteCollection: 删除集合`),
     }, async ({ collectionName, query, projection, sort, limit, offset }) => {
         const cloudbase = await getManager();
         const instanceId = await getDatabaseInstanceId(getManager);
-        const toJSONString = (v) => typeof v === "object" && v !== null ? JSON.stringify(v) : v;
         const normalizedSort = normalizeSortInput(sort);
         const result = await cloudbase.commonService("tcb", "2018-06-08").call({
             Action: "QueryRecords",
@@ -3799,7 +4020,7 @@ deleteCollection: 删除集合`),
     // writeNoSqlDatabaseContent
     server.registerTool?.("writeNoSqlDatabaseContent", {
         title: "修改 NoSQL 数据库数据记录",
-        description: "修改 NoSQL 数据库数据记录。可按 MongoDB updateOne/updateMany 的心智模型理解：部分更新必须使用 $set/$inc/$push 等更新操作符；如果直接传 { field: value } 这类普通对象，底层会把它当作替换内容，存在覆盖整条文档的风险。",
+        description: "修改 NoSQL 数据库数据记录。可按 MongoDB updateOne/updateMany 的心智模型理解：部分更新必须使用 $set/$inc/$push 等更新操作符；如果直接传 { field: value } 这类普通对象，底层会把它当作替换内容，存在覆盖整条文档的风险。更新嵌套对象中的某个字段时必须使用点号路径（如 { \"$set\": { \"address.city\": \"shenzhen\" } }），若写成 { \"$set\": { \"address\": { \"city\": \"shenzhen\" } } } 则整个 address 对象会被替换，同级其他字段将丢失。",
         inputSchema: {
             action: zod_1.z
                 .enum(["insert", "update", "delete"])
@@ -3816,7 +4037,7 @@ deleteCollection: 删除集合`),
             update: zod_1.z
                 .union([zod_1.z.object({}).passthrough(), zod_1.z.string()])
                 .optional()
-                .describe("更新内容(对象或字符串,推荐对象)(update 操作必填)。按 MongoDB 更新语义传入 MgoUpdate：部分更新请使用 $set/$inc/$unset/$push 等操作符，例如 { \"$set\": { \"status\": \"pending\" } }；不要直接传 { \"status\": \"pending\" }，否则可能替换整条文档。"),
+                .describe("更新内容(对象或字符串,推荐对象)(update 操作必填)。按 MongoDB 更新语义传入 MgoUpdate：部分更新请使用 $set/$inc/$unset/$push 等操作符，例如 { \"$set\": { \"status\": \"pending\" } }；不要直接传 { \"status\": \"pending\" }，否则可能替换整条文档。更新嵌套字段时必须用点号路径，如 { \"$set\": { \"address.city\": \"shenzhen\" } }，不要写成 { \"$set\": { \"address\": { \"city\": \"shenzhen\" } } }（会替换整个 address 对象）。"),
             isMulti: zod_1.z
                 .boolean()
                 .optional()
@@ -3927,7 +4148,6 @@ async function insertDocuments({ collectionName, documents, getManager, logger,
 async function updateDocuments({ collectionName, query, update, isMulti, upsert, getManager, logger, }) {
     const cloudbase = await getManager();
     const instanceId = await getDatabaseInstanceId(getManager);
-    const toJSONString = (v) => typeof v === "object" && v !== null ? JSON.stringify(v) : v;
     const result = await cloudbase.commonService("tcb", "2018-06-08").call({
         Action: "UpdateItem",
         Param: {
@@ -3952,7 +4172,6 @@ async function updateDocuments({ collectionName, query, update, isMulti, upsert,
 async function deleteDocuments({ collectionName, query, isMulti, getManager, logger, }) {
     const cloudbase = await getManager();
     const instanceId = await getDatabaseInstanceId(getManager);
-    const toJSONString = (v) => typeof v === "object" && v !== null ? JSON.stringify(v) : v;
     const result = await cloudbase.commonService("tcb", "2018-06-08").call({
         Action: "DeleteItem",
         Param: {
@@ -5668,32 +5887,41 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.registerGatewayTools = registerGatewayTools;
 const zod_1 = __webpack_require__(2971);
 const cloudbase_manager_js_1 = __webpack_require__(3431);
+const json_content_js_1 = __webpack_require__(4365);
 const QUERY_GATEWAY_ACTIONS = [
     "getAccess",
     "listDomains",
+    "listRoutes",
+    "getRoute",
+    "listCustomDomains",
 ];
 const MANAGE_GATEWAY_ACTIONS = [
     "createAccess",
+    "createRoute",
+    "updateRoute",
+    "deleteRoute",
+    "bindCustomDomain",
+    "deleteCustomDomain",
+    "deleteAccess",
+    "updatePathAuth",
 ];
-function jsonContent(body) {
-    return {
-        content: [
-            {
-                type: "text",
-                text: JSON.stringify(body, null, 2),
-            },
-        ],
-    };
-}
 function normalizeAccessPath(path) {
     if (!path) {
         return "/";
     }
     return path.startsWith("/") ? path : `/${path}`;
 }
+function ensureGatewayEnvId(cloudBaseOptions) {
+    const envId = cloudBaseOptions?.envId;
+    if (!envId) {
+        throw new Error("当前网关操作需要已绑定 envId");
+    }
+    return envId;
+}
 function registerGatewayTools(server) {
     const cloudBaseOptions = server.cloudBaseOptions;
     const getManager = () => (0, cloudbase_manager_js_1.getCloudBaseManager)({ cloudBaseOptions });
+    const getGatewayEnvId = () => ensureGatewayEnvId(cloudBaseOptions);
     const buildEnvelope = (data, message, nextActions) => ({
         success: true,
         data,
@@ -5707,10 +5935,10 @@ function registerGatewayTools(server) {
     });
     const withEnvelope = async (handler) => {
         try {
-            return jsonContent(await handler());
+            return (0, json_content_js_1.jsonContent)(await handler());
         }
         catch (error) {
-            return jsonContent(buildErrorEnvelope(error));
+            return (0, json_content_js_1.jsonContent)(buildErrorEnvelope(error));
         }
     };
     const listGatewayDomains = async () => {
@@ -5727,6 +5955,63 @@ function registerGatewayTools(server) {
             raw: result,
         };
     };
+    const listHttpServiceRoutes = async (domain) => {
+        const cloudbase = await getManager();
+        const result = await cloudbase.env.describeHttpServiceRoute({
+            EnvId: getGatewayEnvId(),
+            ...(domain
+                ? {
+                    Filters: [
+                        {
+                            Name: "Domain",
+                            Values: [domain],
+                        },
+                    ],
+                }
+                : {}),
+        });
+        (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+        return result;
+    };
+    const flattenRoutes = (result) => (result.Domains ?? []).flatMap((domainItem) => (domainItem.Routes ?? []).map((route) => ({
+        Domain: domainItem.Domain,
+        DomainType: domainItem.DomainType,
+        AccessType: domainItem.AccessType,
+        ...route,
+    })));
+    const resolveRouteDomain = async (preferredDomain) => {
+        if (preferredDomain) {
+            return preferredDomain;
+        }
+        const routeInfo = await listHttpServiceRoutes();
+        return routeInfo.OriginDomain;
+    };
+    const normalizeRoutePayload = async (route, fallback, domain) => {
+        const path = normalizeAccessPath(route?.path ?? fallback.path);
+        const serviceType = route?.serviceType ?? fallback.targetType;
+        const serviceName = route?.serviceName ?? fallback.targetName;
+        if (!serviceType || !serviceName) {
+            throw new Error("route.serviceType 和 route.serviceName 为必填项");
+        }
+        return {
+            EnvId: getGatewayEnvId(),
+            Domain: {
+                Domain: await resolveRouteDomain(domain),
+                Routes: [
+                    {
+                        Path: path,
+                        UpstreamResourceType: serviceType === "function" ? "SCF" : "CBR",
+                        UpstreamResourceName: serviceName,
+                        EnableAuth: route?.auth !== undefined
+                            ? route.auth
+                            : fallback.auth !== undefined
+                                ? fallback.auth
+                                : undefined,
+                    },
+                ],
+            },
+        };
+    };
     const handleQueryGateway = async (input) => {
         switch (input.action) {
             case "listDomains": {
@@ -5744,6 +6029,36 @@ function registerGatewayTools(server) {
                     },
                 ]);
             }
+            case "listCustomDomains": {
+                const result = await listGatewayDomains();
+                return buildEnvelope({
+                    action: input.action,
+                    domains: result.raw.ServiceSet ?? [],
+                    total: (result.raw.ServiceSet ?? []).length,
+                    raw: result.raw,
+                }, `已获取 ${(result.raw.ServiceSet ?? []).length} 个自定义域名`);
+            }
+            case "listRoutes": {
+                const result = await listHttpServiceRoutes();
+                const routes = flattenRoutes(result);
+                return buildEnvelope({
+                    action: input.action,
+                    routes,
+                    total: result.TotalCount ?? routes.length,
+                    raw: result,
+                }, `已获取 ${result.TotalCount ?? routes.length} 条 HTTP 路由`);
+            }
+            case "getRoute": {
+                const result = await listHttpServiceRoutes();
+                const route = flattenRoutes(result).find((item) => (input.routeId && item.RouteId === input.routeId) ||
+                    (input.targetName && item.UpstreamResourceName === input.targetName)) ?? null;
+                return buildEnvelope({
+                    action: input.action,
+                    routeId: input.routeId ?? null,
+                    route,
+                    raw: result,
+                }, route ? "已获取路由详情" : "未找到对应路由");
+            }
             case "getAccess": {
                 if (!input.targetName) {
                     throw new Error("getAccess 操作时，targetName 参数是必需的");
@@ -5786,6 +6101,9 @@ function registerGatewayTools(server) {
     const handleManageGateway = async (input) => {
         switch (input.action) {
             case "createAccess": {
+                if (!input.targetName || !input.targetType) {
+                    throw new Error("action=createAccess 时必须提供 targetType 和 targetName");
+                }
                 const cloudbase = await getManager();
                 const accessPath = normalizeAccessPath(input.path || `/${input.targetName}`);
                 const result = await cloudbase.access.createAccess({
@@ -5809,6 +6127,128 @@ function registerGatewayTools(server) {
                     },
                 ]);
             }
+            case "createRoute": {
+                const cloudbase = await getManager();
+                const result = await cloudbase.env.createHttpServiceRoute((await normalizeRoutePayload(input.route, input, input.domain)));
+                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                return buildEnvelope({
+                    action: input.action,
+                    route: input.route ?? null,
+                    raw: result,
+                }, "HTTP 路由创建成功");
+            }
+            case "updateRoute": {
+                const cloudbase = await getManager();
+                const result = await cloudbase.env.modifyHttpServiceRoute((await normalizeRoutePayload(input.route, input, input.domain)));
+                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                return buildEnvelope({
+                    action: input.action,
+                    route: input.route ?? null,
+                    raw: result,
+                }, "HTTP 路由更新成功");
+            }
+            case "deleteRoute": {
+                const routePath = input.route?.path ?? input.path;
+                if (!routePath) {
+                    throw new Error("action=deleteRoute 时必须提供 route.path 或 path");
+                }
+                const cloudbase = await getManager();
+                const domain = await resolveRouteDomain(input.domain);
+                const result = await cloudbase.env.deleteHttpServiceRoute({
+                    EnvId: getGatewayEnvId(),
+                    Domain: domain,
+                    Paths: [normalizeAccessPath(routePath)],
+                });
+                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                return buildEnvelope({
+                    action: input.action,
+                    domain,
+                    path: normalizeAccessPath(routePath),
+                    raw: result,
+                }, "HTTP 路由删除成功");
+            }
+            case "bindCustomDomain": {
+                if (!input.domain || !input.certificateId) {
+                    throw new Error("action=bindCustomDomain 时必须提供 domain 和 certificateId");
+                }
+                const cloudbase = await getManager();
+                const result = await cloudbase.env.bindCustomDomain({
+                    EnvId: getGatewayEnvId(),
+                    Domain: {
+                        Domain: input.domain,
+                        CertId: input.certificateId,
+                    },
+                });
+                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                return buildEnvelope({
+                    action: input.action,
+                    domain: input.domain,
+                    certificateId: input.certificateId,
+                    raw: result,
+                }, "自定义域名绑定成功");
+            }
+            case "deleteCustomDomain": {
+                if (!input.domain) {
+                    throw new Error("action=deleteCustomDomain 时必须提供 domain");
+                }
+                const cloudbase = await getManager();
+                const result = await cloudbase.env.deleteCustomDomain({
+                    EnvId: getGatewayEnvId(),
+                    Domain: input.domain,
+                });
+                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                return buildEnvelope({
+                    action: input.action,
+                    domain: input.domain,
+                    raw: result,
+                }, "自定义域名删除成功");
+            }
+            case "deleteAccess": {
+                const cloudbase = await getManager();
+                const accessPath = input.path ? normalizeAccessPath(input.path) : undefined;
+                const result = await cloudbase.access.deleteAccess({
+                    ...(input.targetName ? { name: input.targetName } : {}),
+                    ...(accessPath ? { path: accessPath } : {}),
+                });
+                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                return buildEnvelope({
+                    action: input.action,
+                    targetName: input.targetName ?? null,
+                    path: accessPath ?? null,
+                    raw: result,
+                }, "网关访问入口删除成功");
+            }
+            case "updatePathAuth": {
+                if (!input.targetName && !input.path) {
+                    throw new Error("action=updatePathAuth 时至少需要提供 targetName 或 path");
+                }
+                if (input.auth === undefined) {
+                    throw new Error("action=updatePathAuth 时必须提供 auth");
+                }
+                const cloudbase = await getManager();
+                const accessPath = input.path ? normalizeAccessPath(input.path) : undefined;
+                const accessList = await cloudbase.access.getAccessList({
+                    ...(input.targetName ? { name: input.targetName } : {}),
+                    ...(accessPath ? { path: accessPath } : {}),
+                });
+                const apiIds = (accessList.APISet ?? []).map((item) => item.APIId).filter(Boolean);
+                if (apiIds.length === 0) {
+                    throw new Error("未找到可更新鉴权状态的访问入口");
+                }
+                const result = await cloudbase.access.switchPathAuth({
+                    apiIds,
+                    auth: input.auth,
+                });
+                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                return buildEnvelope({
+                    action: input.action,
+                    targetName: input.targetName ?? null,
+                    path: accessPath ?? null,
+                    auth: input.auth,
+                    apiIds,
+                    raw: result,
+                }, "网关路径鉴权更新成功");
+            }
             default:
                 throw new Error(`不支持的操作类型: ${input.action}`);
         }
@@ -5828,6 +6268,7 @@ function registerGatewayTools(server) {
                 .string()
                 .optional()
                 .describe("目标资源名称。getAccess 时必填"),
+            routeId: zod_1.z.string().optional().describe("路由 ID。getRoute 时可选"),
         },
         annotations: {
             readOnlyHint: true,
@@ -5842,11 +6283,25 @@ function registerGatewayTools(server) {
             action: zod_1.z.enum(MANAGE_GATEWAY_ACTIONS).describe("写操作类型，例如 createAccess"),
             targetType: zod_1.z
                 .enum(["function"])
+                .optional()
                 .describe("目标资源类型。当前支持 function，后续可扩展"),
-            targetName: zod_1.z.string().describe("目标资源名称"),
+            targetName: zod_1.z.string().optional().describe("目标资源名称"),
             path: zod_1.z.string().optional().describe("访问路径，默认 /{targetName}"),
             type: zod_1.z.enum(["Event", "HTTP"]).optional().describe("函数接入类型"),
             auth: zod_1.z.boolean().optional().describe("是否开启鉴权"),
+            route: zod_1.z
+                .object({
+                routeId: zod_1.z.string().optional(),
+                path: zod_1.z.string().optional(),
+                serviceType: zod_1.z.string().optional(),
+                serviceName: zod_1.z.string().optional(),
+                auth: zod_1.z.boolean().optional(),
+            })
+                .optional()
+                .describe("HTTP 路由配置对象"),
+            domain: zod_1.z.string().optional().describe("自定义域名"),
+            certificateId: zod_1.z.string().optional().describe("证书 ID"),
+            accessName: zod_1.z.string().optional().describe("访问入口名称，保留字段"),
         },
         annotations: {
             readOnlyHint: false,
@@ -5866,6 +6321,26 @@ function registerGatewayTools(server) {
 
 module.exports = __WEBPACK_EXTERNAL_MODULE_net__;
 
+/***/ }),
+
+/***/ 4365:
+/***/ ((__unused_webpack_module, exports) => {
+
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.jsonContent = jsonContent;
+function jsonContent(body) {
+    return {
+        content: [
+            {
+                type: "text",
+                text: JSON.stringify(body, null, 2),
+            },
+        ],
+    };
+}
+
+
 /***/ }),
 
 /***/ 4421:
@@ -6198,26 +6673,6 @@ function registerStorageTools(server) {
 }
 
 
-/***/ }),
-
-/***/ 5018:
-/***/ ((__unused_webpack_module, exports) => {
-
-
-Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.isInternationalRegion = void 0;
-exports.isValidRegion = isValidRegion;
-const REGION = {
-    SHANGHAI: 'ap-shanghai',
-    SINGAPORE: 'ap-singapore',
-};
-const isInternationalRegion = (region) => region === REGION.SINGAPORE;
-exports.isInternationalRegion = isInternationalRegion;
-function isValidRegion(region) {
-    return Object.values(REGION).includes(region);
-}
-
-
 /***/ }),
 
 /***/ 5023:
@@ -6235,6 +6690,7 @@ const fs_1 = __importDefault(__webpack_require__(4421));
 const path_1 = __importDefault(__webpack_require__(2521));
 const zod_1 = __webpack_require__(2971);
 const cloudbase_manager_js_1 = __webpack_require__(3431);
+const logger_js_1 = __webpack_require__(3039);
 const notification_js_1 = __webpack_require__(2720);
 // CloudRun service types
 exports.CLOUDRUN_SERVICE_TYPES = ['function', 'container'];
@@ -6337,9 +6793,10 @@ function checkIfAgentProject(projectPath) {
  */
 function validateAndNormalizePath(inputPath) {
     let normalizedPath = path_1.default.resolve(inputPath);
-    // Basic security check - ensure path is within current working directory or explicit absolute path
+    // Security check - ensure path is within current working directory
     const cwd = process.cwd();
-    if (!normalizedPath.startsWith(cwd) && !path_1.default.isAbsolute(inputPath)) {
+    const prefix = cwd.endsWith(path_1.default.sep) ? cwd : cwd + path_1.default.sep;
+    if (!normalizedPath.startsWith(prefix) && normalizedPath !== cwd) {
         throw new Error(`Path must be within current working directory: ${cwd}`);
     }
     return normalizedPath;
@@ -6738,7 +7195,7 @@ for await (let x of res.textStream) {
                     fs_1.default.writeFileSync(cloudbasercPath, JSON.stringify(cloudbasercContent, null, 2));
                 }
                 catch (error) {
-                    // Ignore cloudbaserc.json creation errors
+                    (0, logger_js_1.debug)('cloudbaserc.json creation skipped:', error instanceof Error ? error : new Error(String(error)));
                 }
                 // Send deployment notification to CodeBuddy IDE
                 try {
@@ -6865,39 +7322,34 @@ for await (let x of res.textStream) {
                 };
                 // Choose execution method based on run mode
                 let child;
-                let command;
+                const script = `const { runCLI } = require('@cloudbase/functions-framework'); runCLI();`;
                 if (runMode === 'agent') {
-                    // For Agent mode, use a different approach since functions-framework doesn't support Agent mode
-                    // We'll use a custom script that sets up the Agent environment
-                    command = `node -e "
-                const { runCLI } = require('@cloudbase/functions-framework');
-                process.env.PORT = '${runPort}';
-                process.env.ENABLE_CORS = 'true';
-                process.env.ALLOWED_ORIGINS = '*';
-                process.env.RUN_MODE = 'agent';
-                ${Object.entries(extraEnv).map(([key, value]) => `process.env.${key} = '${value}';`).join('\n')}
-                runCLI();
-              "`;
-                    child = (0, child_process_1.spawn)(process.execPath, ['-e', command], {
+                    const childEnv = {
+                        ...env,
+                        PORT: String(runPort),
+                        ENABLE_CORS: 'true',
+                        ALLOWED_ORIGINS: '*',
+                        RUN_MODE: 'agent',
+                        ...extraEnv,
+                    };
+                    child = (0, child_process_1.spawn)(process.execPath, ['-e', script], {
                         cwd: targetPath,
-                        env,
+                        env: childEnv,
                         stdio: ['ignore', 'pipe', 'pipe'],
                         detached: true
                     });
                 }
                 else {
-                    // Normal function mode
-                    command = `node -e "
-                const { runCLI } = require('@cloudbase/functions-framework');
-                process.env.PORT = '${runPort}';
-                process.env.ENABLE_CORS = 'true';
-                process.env.ALLOWED_ORIGINS = '*';
-                ${Object.entries(extraEnv).map(([key, value]) => `process.env.${key} = '${value}';`).join('\n')}
-                runCLI();
-              "`;
-                    child = (0, child_process_1.spawn)(process.execPath, ['-e', command], {
+                    const childEnv = {
+                        ...env,
+                        PORT: String(runPort),
+                        ENABLE_CORS: 'true',
+                        ALLOWED_ORIGINS: '*',
+                        ...extraEnv,
+                    };
+                    child = (0, child_process_1.spawn)(process.execPath, ['-e', script], {
                         cwd: targetPath,
-                        env,
+                        env: childEnv,
                         stdio: ['ignore', 'pipe', 'pipe'],
                         detached: true
                     });
@@ -6927,7 +7379,7 @@ for await (let x of res.textStream) {
                                     port: runPort,
                                     runMode: runMode,
                                     isAgent: isAgent,
-                                    command: command,
+                                    command: script,
                                     cwd: targetPath
                                 },
                                 message: `Started local run for ${runMode} service '${input.serverName}' on port ${runPort} (pid=${child.pid})`
@@ -6957,7 +7409,7 @@ for await (let x of res.textStream) {
                     fs_1.default.writeFileSync(cloudbasercPath, JSON.stringify(cloudbasercContent, null, 2));
                 }
                 catch (error) {
-                    // Ignore cloudbaserc.json creation errors
+                    (0, logger_js_1.debug)('cloudbaserc.json creation skipped:', error instanceof Error ? error : new Error(String(error)));
                 }
                 return {
                     content: [
@@ -7033,7 +7485,7 @@ for await (let x of res.textStream) {
                     fs_1.default.writeFileSync(cloudbasercPath, JSON.stringify(cloudbasercContent, null, 2));
                 }
                 catch (error) {
-                    // Ignore cloudbaserc.json creation errors
+                    (0, logger_js_1.debug)('cloudbaserc.json creation skipped:', error instanceof Error ? error : new Error(String(error)));
                 }
                 return {
                     content: [
@@ -7063,12 +7515,296 @@ for await (let x of res.textStream) {
 
 /***/ }),
 
-/***/ 5814:
-/***/ ((module) => {
-
-module.exports = __WEBPACK_EXTERNAL_MODULE_child_process__;
+/***/ 5313:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
 
-/***/ }),
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.registerAppAuthTools = registerAppAuthTools;
+const zod_1 = __webpack_require__(2971);
+const cloudbase_manager_js_1 = __webpack_require__(3431);
+const json_content_js_1 = __webpack_require__(4365);
+const QUERY_APP_AUTH_ACTIONS = [
+    "getLoginConfig",
+    "listProviders",
+    "getProvider",
+    "getClientConfig",
+    "listApiKeyTokens",
+    "getStaticDomain",
+];
+const MANAGE_APP_AUTH_ACTIONS = [
+    "updateLoginConfig",
+    "updateProvider",
+    "updateClientConfig",
+    "createApiKeyToken",
+    "createCustomLoginKeys",
+];
+function buildEnvelope(data, message) {
+    return {
+        success: true,
+        data,
+        message,
+    };
+}
+function buildErrorEnvelope(error) {
+    return {
+        success: false,
+        data: {},
+        message: error instanceof Error ? error.message : String(error),
+    };
+}
+function normalizePlainObject(value, label) {
+    if (value === undefined) {
+        return undefined;
+    }
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        throw new Error(`${label} 必须是对象`);
+    }
+    return value;
+}
+function extractLoginStrategyState(value) {
+    const source = normalizePlainObject(value, "loginStrategy") ?? {};
+    const data = normalizePlainObject(source.Data, "loginStrategy.Data") ?? source;
+    return {
+        PhoneNumberLogin: Boolean(data.PhoneNumberLogin ?? data.PhoneLogin ?? false),
+        EmailLogin: Boolean(data.EmailLogin ?? false),
+        AnonymousLogin: Boolean(data.AnonymousLogin ?? false),
+        UserNameLogin: Boolean(data.UserNameLogin ?? data.UsernameLogin ?? false),
+        ...(data.SmsVerificationConfig ? { SmsVerificationConfig: data.SmsVerificationConfig } : {}),
+        ...(typeof data.Mfa === "boolean" ? { Mfa: data.Mfa } : {}),
+        ...(data.MfaConfig ? { MfaConfig: data.MfaConfig } : {}),
+        ...(data.PwdUpdateStrategy ? { PwdUpdateStrategy: data.PwdUpdateStrategy } : {}),
+    };
+}
+function normalizeLoginConfigPatch(value) {
+    const { PhoneLogin, UsernameLogin, ...rest } = value;
+    return {
+        ...rest,
+        ...(typeof PhoneLogin === "boolean" ? { PhoneNumberLogin: PhoneLogin } : {}),
+        ...(typeof UsernameLogin === "boolean" ? { UserNameLogin: UsernameLogin } : {}),
+    };
+}
+function registerAppAuthTools(server) {
+    const cloudBaseOptions = server.cloudBaseOptions;
+    const getManager = () => (0, cloudbase_manager_js_1.getCloudBaseManager)({ cloudBaseOptions });
+    const withEnvelope = async (handler) => {
+        try {
+            return (0, json_content_js_1.jsonContent)(await handler());
+        }
+        catch (error) {
+            return (0, json_content_js_1.jsonContent)(buildErrorEnvelope(error));
+        }
+    };
+    const callControlPlaneAction = async (action, params) => {
+        const cloudbase = await getManager();
+        const service = cloudbase.commonService("tcb", "2018-06-08");
+        const result = await service.call({
+            Action: action,
+            Param: params ?? {},
+        });
+        (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+        return result;
+    };
+    server.registerTool?.("queryAppAuth", {
+        title: "查询应用认证配置",
+        description: "应用侧认证配置只读入口。用于查询登录方式、provider、publishable key、client 配置和静态域名等认证准备状态。",
+        inputSchema: {
+            action: zod_1.z.enum(QUERY_APP_AUTH_ACTIONS),
+            providerId: zod_1.z.string().optional().describe("provider 标识，如 email、google"),
+        },
+        annotations: {
+            readOnlyHint: true,
+            openWorldHint: true,
+            category: "auth",
+        },
+    }, async ({ action, providerId, }) => withEnvelope(async () => {
+        const envId = await (0, cloudbase_manager_js_1.getEnvId)(cloudBaseOptions);
+        const cloudbase = await getManager();
+        switch (action) {
+            case "getLoginConfig": {
+                // Manager SDK v5 provides a dedicated helper for login config.
+                const result = await cloudbase.env.getLoginConfigListV2();
+                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                return buildEnvelope({
+                    action,
+                    envId,
+                    loginConfig: result,
+                }, "应用登录配置查询成功");
+            }
+            case "listProviders": {
+                const result = await callControlPlaneAction("GetProviders", {
+                    EnvId: envId,
+                });
+                return buildEnvelope({
+                    action,
+                    envId,
+                    providers: result.Providers ?? result.ProviderList ?? result.Data ?? result,
+                    raw: result,
+                }, "应用 provider 列表查询成功");
+            }
+            case "getProvider": {
+                if (!providerId) {
+                    throw new Error("action=getProvider 时必须提供 providerId");
+                }
+                const result = await callControlPlaneAction("GetProviders", {
+                    EnvId: envId,
+                });
+                const providers = (result.Providers ??
+                    result.ProviderList ??
+                    result.Data ??
+                    []);
+                const provider = providers.find((item) => item.Id === providerId || item.id === providerId) ?? null;
+                return buildEnvelope({
+                    action,
+                    envId,
+                    providerId,
+                    provider,
+                    raw: result,
+                }, `应用 provider ${providerId} 查询成功`);
+            }
+            case "getClientConfig": {
+                const result = await callControlPlaneAction("DescribeClient", {
+                    EnvId: envId,
+                });
+                return buildEnvelope({
+                    action,
+                    envId,
+                    clientConfig: result,
+                }, "应用 client 配置查询成功");
+            }
+            case "listApiKeyTokens": {
+                const result = await callControlPlaneAction("DescribeApiKeyTokens", {
+                    EnvId: envId,
+                });
+                return buildEnvelope({
+                    action,
+                    envId,
+                    apiKeyTokens: result.ApiKeyTokens ?? result.Data ?? result,
+                    raw: result,
+                }, "应用 publishable key 列表查询成功");
+            }
+            case "getStaticDomain": {
+                const result = await callControlPlaneAction("DescribeStaticDomain", {
+                    EnvId: envId,
+                });
+                return buildEnvelope({
+                    action,
+                    envId,
+                    staticDomain: result,
+                }, "应用静态域名查询成功");
+            }
+        }
+    }));
+    server.registerTool?.("manageAppAuth", {
+        title: "管理应用认证配置",
+        description: "应用侧认证配置写入口。用于修改登录方式、provider、client 配置，创建 publishable key 和自定义登录密钥。",
+        inputSchema: {
+            action: zod_1.z.enum(MANAGE_APP_AUTH_ACTIONS),
+            loginConfig: zod_1.z.record(zod_1.z.any()).optional().describe("updateLoginConfig 使用的登录配置对象"),
+            providerId: zod_1.z.string().optional().describe("provider 标识，如 email、google"),
+            config: zod_1.z.record(zod_1.z.any()).optional().describe("provider / client / api key 的配置对象"),
+        },
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: true,
+            idempotentHint: false,
+            openWorldHint: true,
+            category: "auth",
+        },
+    }, async ({ action, loginConfig, providerId, config, }) => withEnvelope(async () => {
+        const envId = await (0, cloudbase_manager_js_1.getEnvId)(cloudBaseOptions);
+        const cloudbase = await getManager();
+        switch (action) {
+            case "updateLoginConfig": {
+                const normalized = normalizePlainObject(loginConfig, "loginConfig");
+                if (!normalized) {
+                    throw new Error("action=updateLoginConfig 时必须提供 loginConfig");
+                }
+                const current = await cloudbase.env.getLoginConfigListV2();
+                const merged = {
+                    EnvId: envId,
+                    ...extractLoginStrategyState(current),
+                    ...normalizeLoginConfigPatch(normalized),
+                };
+                // Manager SDK v5 provides a dedicated helper for login config updates.
+                const result = await cloudbase.env.updateLoginConfigV2(merged);
+                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                return buildEnvelope({
+                    action,
+                    envId,
+                    appliedLoginConfig: merged,
+                    raw: result,
+                }, "应用登录配置更新成功");
+            }
+            case "updateProvider": {
+                const normalized = normalizePlainObject(config, "config");
+                if (!providerId) {
+                    throw new Error("action=updateProvider 时必须提供 providerId");
+                }
+                if (!normalized) {
+                    throw new Error("action=updateProvider 时必须提供 config");
+                }
+                const result = await callControlPlaneAction("ModifyProvider", {
+                    EnvId: envId,
+                    Id: providerId,
+                    ...normalized,
+                });
+                return buildEnvelope({
+                    action,
+                    envId,
+                    providerId,
+                    raw: result,
+                }, `应用 provider ${providerId} 更新成功`);
+            }
+            case "updateClientConfig": {
+                const normalized = normalizePlainObject(config, "config");
+                if (!normalized) {
+                    throw new Error("action=updateClientConfig 时必须提供 config");
+                }
+                const result = await callControlPlaneAction("ModifyClient", {
+                    EnvId: envId,
+                    ...normalized,
+                });
+                return buildEnvelope({
+                    action,
+                    envId,
+                    raw: result,
+                }, "应用 client 配置更新成功");
+            }
+            case "createApiKeyToken": {
+                const normalized = normalizePlainObject(config, "config");
+                const result = await callControlPlaneAction("CreateApiKeyToken", {
+                    EnvId: envId,
+                    ...(normalized ?? {}),
+                });
+                return buildEnvelope({
+                    action,
+                    envId,
+                    raw: result,
+                }, "应用 publishable key 创建成功");
+            }
+            case "createCustomLoginKeys": {
+                const result = await cloudbase.env.createCustomLoginKeys();
+                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                return buildEnvelope({
+                    action,
+                    envId,
+                    raw: result,
+                }, "自定义登录密钥创建成功");
+            }
+        }
+    }));
+}
+
+
+/***/ }),
+
+/***/ 5814:
+/***/ ((module) => {
+
+module.exports = __WEBPACK_EXTERNAL_MODULE_child_process__;
+
+/***/ }),
 
 /***/ 5880:
 /***/ (function(__unused_webpack_module, exports, __webpack_require__) {
@@ -7130,7 +7866,7 @@ class TelemetryReporter {
         const nodeVersion = process.version; // Node.js版本
         const arch = os_1.default.arch(); // 系统架构
         // 从构建时注入的版本号获取MCP版本信息
-        const mcpVersion = process.env.npm_package_version || "2.15.4" || 0;
+        const mcpVersion = process.env.npm_package_version || "2.16.1-beta.1" || 0;
         return {
             userAgent: `${osType} ${osRelease} ${arch} ${nodeVersion} CloudBase-MCP/${mcpVersion}`,
             deviceId: this.deviceId,
@@ -7277,16 +8013,16 @@ class TelemetryReporter {
 }
 // 创建全局实例
 exports.telemetryReporter = new TelemetryReporter();
-// 便捷方法
-const reportToolCall = async (params) => {
-    const { nodeVersion, osType, osRelease, arch, mcpVersion } = exports.telemetryReporter.getUserAgent();
-    // 安全获取环境ID，优先使用传入的配置
-    let envId;
+/**
+ * 解析环境ID
+ * 优先级：传入配置 > envManager缓存 > 环境变量 > unknown
+ */
+function resolveEnvId(cloudBaseOptions) {
+    let envId = 'unknown';
     let envIdSource = 'unknown';
     try {
-        // 优先级：传入配置 > envManager缓存 > 环境变量 > unknown
-        if (params.cloudBaseOptions?.envId) {
-            envId = params.cloudBaseOptions.envId;
+        if (cloudBaseOptions?.envId) {
+            envId = cloudBaseOptions.envId;
             envIdSource = 'cloudBaseOptions';
         }
         else {
@@ -7304,20 +8040,26 @@ const reportToolCall = async (params) => {
                 envIdSource = 'default';
             }
         }
-        (0, logger_js_1.debug)('[telemetry] 工具调用 envId 获取结果', {
-            toolName: params.toolName,
-            envId,
-            envIdSource,
-            hasCloudBaseOptions: !!params.cloudBaseOptions,
-            cloudBaseOptionsEnvId: params.cloudBaseOptions?.envId || null
-        });
     }
     catch (err) {
-        // 忽略错误，使用 unknown
         (0, logger_js_1.debug)('获取环境ID失败，遥测数据将使用 unknown', err instanceof Error ? err : new Error(String(err)));
         envId = 'unknown';
         envIdSource = 'error';
     }
+    return { envId, envIdSource };
+}
+// 便捷方法
+const reportToolCall = async (params) => {
+    const { nodeVersion, osType, osRelease, arch, mcpVersion } = exports.telemetryReporter.getUserAgent();
+    // 安全获取环境ID，优先使用传入的配置
+    const { envId, envIdSource } = resolveEnvId(params.cloudBaseOptions);
+    (0, logger_js_1.debug)('[telemetry] 工具调用 envId 获取结果', {
+        toolName: params.toolName,
+        envId,
+        envIdSource,
+        hasCloudBaseOptions: !!params.cloudBaseOptions,
+        cloudBaseOptionsEnvId: params.cloudBaseOptions?.envId || null
+    });
     // 报告工具调用情况
     const eventData = {
         toolName: params.toolName,
@@ -7367,43 +8109,14 @@ exports.reportToolCall = reportToolCall;
 const reportToolkitLifecycle = async (params) => {
     const { nodeVersion, osType, osRelease, arch, mcpVersion } = exports.telemetryReporter.getUserAgent();
     // 安全获取环境ID，优先使用传入的配置
-    let envId;
-    let envIdSource = 'unknown';
-    try {
-        // 优先级：传入配置 > envManager缓存 > 环境变量 > unknown
-        if (params.cloudBaseOptions?.envId) {
-            envId = params.cloudBaseOptions.envId;
-            envIdSource = 'cloudBaseOptions';
-        }
-        else {
-            const cachedEnvId = (0, cloudbase_manager_js_1.getCachedEnvId)();
-            if (cachedEnvId) {
-                envId = cachedEnvId;
-                envIdSource = 'envManager.cachedEnvId';
-            }
-            else if (process.env.CLOUDBASE_ENV_ID) {
-                envId = process.env.CLOUDBASE_ENV_ID;
-                envIdSource = 'process.env.CLOUDBASE_ENV_ID';
-            }
-            else {
-                envId = 'unknown';
-                envIdSource = 'default';
-            }
-        }
-        (0, logger_js_1.debug)('[telemetry] 生命周期事件 envId 获取结果', {
-            event: params.event,
-            envId,
-            envIdSource,
-            hasCloudBaseOptions: !!params.cloudBaseOptions,
-            cloudBaseOptionsEnvId: params.cloudBaseOptions?.envId || null
-        });
-    }
-    catch (err) {
-        // 忽略错误，使用 unknown
-        (0, logger_js_1.debug)('获取环境ID失败，遥测数据将使用 unknown', err instanceof Error ? err : new Error(String(err)));
-        envId = 'unknown';
-        envIdSource = 'error';
-    }
+    const { envId, envIdSource } = resolveEnvId(params.cloudBaseOptions);
+    (0, logger_js_1.debug)('[telemetry] 生命周期事件 envId 获取结果', {
+        event: params.event,
+        envId,
+        envIdSource,
+        hasCloudBaseOptions: !!params.cloudBaseOptions,
+        cloudBaseOptionsEnvId: params.cloudBaseOptions?.envId || null
+    });
     // 报告 Toolkit 生命周期事件
     const eventData = {
         event: params.event,
@@ -7445,11 +8158,13 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.MANAGE_FUNCTION_ACTIONS = exports.QUERY_FUNCTION_ACTIONS = exports.TRIGGER_CONFIG_EXAMPLES = exports.SUPPORTED_TRIGGER_TYPES = exports.DEFAULT_NODEJS_RUNTIME = exports.SUPPORTED_NODEJS_RUNTIMES = exports.RECOMMENDED_RUNTIMES = exports.DEFAULT_RUNTIME = exports.ALL_SUPPORTED_RUNTIMES = exports.SUPPORTED_RUNTIMES = void 0;
 exports.formatRuntimeList = formatRuntimeList;
 exports.shouldInstallDependencyForFunction = shouldInstallDependencyForFunction;
+exports.resolveEventFunctionRuntime = resolveEventFunctionRuntime;
 exports.buildFunctionOperationErrorMessage = buildFunctionOperationErrorMessage;
 exports.registerFunctionTools = registerFunctionTools;
 const zod_1 = __webpack_require__(2971);
 const cloudbase_manager_js_1 = __webpack_require__(3431);
 const cloud_mode_js_1 = __webpack_require__(9684);
+const json_content_js_1 = __webpack_require__(4365);
 const logger_js_1 = __webpack_require__(3039);
 const fs_1 = __webpack_require__(4421);
 const path_1 = __importDefault(__webpack_require__(2521));
@@ -7601,16 +8316,6 @@ const MANAGE_LAYER_SCHEMA = zod_1.z.object({
     layerName: zod_1.z.string().describe("层名称"),
     layerVersion: zod_1.z.number().describe("层版本号"),
 });
-function jsonContent(body) {
-    return {
-        content: [
-            {
-                type: "text",
-                text: JSON.stringify(body, null, 2),
-            },
-        ],
-    };
-}
 function normalizeFunctionLayers(layers) {
     if (!Array.isArray(layers)) {
         return [];
@@ -7646,6 +8351,16 @@ function shouldInstallDependencyForFunction(functionType, hasPackageJson) {
     }
     return true;
 }
+function resolveEventFunctionRuntime(runtime) {
+    if (typeof runtime !== "string" || !runtime.trim()) {
+        return exports.DEFAULT_RUNTIME;
+    }
+    const normalizedRuntime = runtime.replace(/\s+/g, "");
+    if (exports.ALL_SUPPORTED_RUNTIMES.includes(normalizedRuntime)) {
+        return normalizedRuntime;
+    }
+    throw new Error(`不支持的运行时环境: "${String(runtime)}"\n\n支持的运行时:\n${formatRuntimeList()}`);
+}
 function buildFunctionOperationErrorMessage(operation, functionName, functionRootPath, error) {
     const baseMessage = error instanceof Error ? error.message : String(error);
     const suggestions = [];
@@ -7698,10 +8413,10 @@ function registerFunctionTools(server) {
     });
     const withEnvelope = async (handler) => {
         try {
-            return jsonContent(await handler());
+            return (0, json_content_js_1.jsonContent)(await handler());
         }
         catch (error) {
-            return jsonContent(buildErrorEnvelope(error));
+            return (0, json_content_js_1.jsonContent)(buildErrorEnvelope(error));
         }
     };
     const requireConfirm = (action, confirm) => {
@@ -8021,22 +8736,12 @@ function registerFunctionTools(server) {
                 const functionName = String(func.name);
                 (0, logger_js_1.debug)(`[createFunction] name=${functionName}, type=${String(func.type || "Event")}`);
                 if (func.type !== "HTTP") {
-                    if (!func.runtime || typeof func.runtime !== "string") {
-                        func.runtime = exports.DEFAULT_RUNTIME;
-                    }
-                    else {
-                        const normalizedRuntime = func.runtime.replace(/\s+/g, "");
-                        if (exports.ALL_SUPPORTED_RUNTIMES.includes(normalizedRuntime)) {
-                            func.runtime = normalizedRuntime;
-                        }
-                        else if (func.runtime.includes(" ")) {
-                            console.warn(`检测到 runtime 参数包含空格: "${func.runtime}"，已自动移除空格`);
-                            func.runtime = normalizedRuntime;
-                        }
-                    }
-                    if (typeof func.runtime !== "string" ||
-                        !exports.ALL_SUPPORTED_RUNTIMES.includes(func.runtime)) {
-                        throw new Error(`不支持的运行时环境: "${String(func.runtime)}"\n\n支持的运行时:\n${formatRuntimeList()}`);
+                    const originalRuntime = typeof func.runtime === "string" ? func.runtime : undefined;
+                    func.runtime = resolveEventFunctionRuntime(func.runtime);
+                    if (typeof originalRuntime === "string" &&
+                        originalRuntime.includes(" ") &&
+                        originalRuntime.replace(/\s+/g, "") === func.runtime) {
+                        console.warn(`检测到 runtime 参数包含空格: "${originalRuntime}"，已自动移除空格`);
                     }
                 }
                 const processedRootPath = processFunctionRootPath(input.functionRootPath, functionName);
@@ -8090,18 +8795,18 @@ function registerFunctionTools(server) {
                         reason: "交付前确认 HTTP 访问路径是否已存在并已生效",
                     });
                     nextActions.push({
-                        tool: "readSecurityRule",
-                        action: "读取安全规则",
+                        tool: "queryPermissions",
+                        action: "getResourcePermission",
                         reason: "评测、浏览器或其他外部调用方可能以匿名身份访问；若直接报 EXCEED_AUTHORITY，应先读取当前函数安全规则",
                     });
                     nextActions.push({
-                        tool: "writeSecurityRule",
-                        action: "写入安全规则",
+                        tool: "managePermissions",
+                        action: "updateResourcePermission",
                         reason: "只有在确认需要匿名访问时，才按实际安全要求调整函数安全规则，例如处理 EXCEED_AUTHORITY",
                     });
                 }
                 const message = func.type === "HTTP"
-                    ? `已创建 HTTP 函数 ${functionName}。如果后续需要通过 URL 访问，请显式调用 manageGateway(action="createAccess") 按实际路径和鉴权需求创建访问入口。评测或其他外部调用方可能会以匿名身份访问，而且失败后不一定会把 EXCEED_AUTHORITY 再反馈给 AI；交付前请主动确认访问路径和函数安全规则，若已出现 EXCEED_AUTHORITY，请先调用 readSecurityRule(resourceType="function") 查看当前规则，再按需要使用 writeSecurityRule 调整权限。`
+                    ? `已创建 HTTP 函数 ${functionName}。如果后续需要通过 URL 访问，请显式调用 manageGateway(action="createAccess") 按实际路径和鉴权需求创建访问入口。评测或其他外部调用方可能会以匿名身份访问，而且失败后不一定会把 EXCEED_AUTHORITY 再反馈给 AI；交付前请主动确认访问路径和函数安全规则，若已出现 EXCEED_AUTHORITY，请先调用 queryPermissions(action="getResourcePermission", resourceType="function", resourceId="${functionName}") 查看当前规则，再按需要使用 managePermissions(action="updateResourcePermission") 调整权限。`
                     : `已创建函数 ${functionName}`;
                 return buildEnvelope({
                     action: input.action,
@@ -8497,6 +9202,401 @@ function registerFunctionTools(server) {
 
 module.exports = __WEBPACK_EXTERNAL_MODULE_ws__;
 
+/***/ }),
+
+/***/ 6485:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.registerPermissionTools = registerPermissionTools;
+const zod_1 = __webpack_require__(2971);
+const cloudbase_manager_js_1 = __webpack_require__(3431);
+const json_content_js_1 = __webpack_require__(4365);
+const QUERY_PERMISSION_ACTIONS = [
+    "getResourcePermission",
+    "listResourcePermissions",
+    "listRoles",
+    "getRole",
+    "listUsers",
+    "getUser",
+];
+const MANAGE_PERMISSION_ACTIONS = [
+    "updateResourcePermission",
+    "createRole",
+    "updateRole",
+    "deleteRoles",
+    "addRoleMembers",
+    "removeRoleMembers",
+    "addRolePolicies",
+    "removeRolePolicies",
+    "createUser",
+    "updateUser",
+    "deleteUsers",
+];
+function buildEnvelope(data, message) {
+    return {
+        success: true,
+        data,
+        message,
+    };
+}
+function buildErrorEnvelope(error) {
+    return {
+        success: false,
+        data: {},
+        message: error instanceof Error ? error.message : String(error),
+    };
+}
+function mapResourceType(resourceType) {
+    const resourceTypeMap = {
+        noSqlDatabase: "collection",
+        sqlDatabase: "table",
+        function: "function",
+        storage: "storage",
+    };
+    return resourceTypeMap[resourceType];
+}
+function normalizeRecordArray(value, label) {
+    if (value === undefined) {
+        return undefined;
+    }
+    if (!Array.isArray(value)) {
+        throw new Error(`${label} 必须是数组`);
+    }
+    return value;
+}
+function registerPermissionTools(server) {
+    const cloudBaseOptions = server.cloudBaseOptions;
+    const getManager = () => (0, cloudbase_manager_js_1.getCloudBaseManager)({ cloudBaseOptions });
+    const withEnvelope = async (handler) => {
+        try {
+            return (0, json_content_js_1.jsonContent)(await handler());
+        }
+        catch (error) {
+            return (0, json_content_js_1.jsonContent)(buildErrorEnvelope(error));
+        }
+    };
+    server.registerTool?.("queryPermissions", {
+        title: "查询权限与用户配置",
+        description: "权限域统一只读入口。支持查询资源权限、角色列表/详情、应用用户列表/详情。",
+        inputSchema: {
+            action: zod_1.z.enum(QUERY_PERMISSION_ACTIONS),
+            resourceType: zod_1.z
+                .enum(["noSqlDatabase", "sqlDatabase", "function", "storage"])
+                .optional(),
+            resourceId: zod_1.z.string().optional(),
+            resourceIds: zod_1.z.array(zod_1.z.string()).optional(),
+            roleId: zod_1.z.string().optional(),
+            roleIdentity: zod_1.z.string().optional(),
+            roleName: zod_1.z.string().optional(),
+            uid: zod_1.z.string().optional(),
+            username: zod_1.z.string().optional(),
+            pageNo: zod_1.z.number().optional(),
+            pageSize: zod_1.z.number().optional(),
+        },
+        annotations: {
+            readOnlyHint: true,
+            openWorldHint: true,
+            category: "permissions",
+        },
+    }, async ({ action, resourceType, resourceId, resourceIds, roleId, roleIdentity, roleName, uid, username, pageNo, pageSize, }) => withEnvelope(async () => {
+        const envId = await (0, cloudbase_manager_js_1.getEnvId)(cloudBaseOptions);
+        const cloudbase = await getManager();
+        switch (action) {
+            case "getResourcePermission": {
+                if (!resourceType || !resourceId) {
+                    throw new Error("action=getResourcePermission 时必须提供 resourceType 和 resourceId");
+                }
+                const result = await cloudbase.permission.describeResourcePermission({
+                    resourceType: mapResourceType(resourceType),
+                    resources: [resourceId],
+                });
+                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                return buildEnvelope({
+                    action,
+                    envId,
+                    resourceType,
+                    resourceId,
+                    permissions: result.Data.PermissionList ?? [],
+                    raw: result,
+                }, "资源权限查询成功");
+            }
+            case "listResourcePermissions": {
+                if (!resourceType) {
+                    throw new Error("action=listResourcePermissions 时必须提供 resourceType");
+                }
+                const result = await cloudbase.permission.describeResourcePermission({
+                    resourceType: mapResourceType(resourceType),
+                    resources: resourceIds,
+                });
+                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                return buildEnvelope({
+                    action,
+                    envId,
+                    resourceType,
+                    permissions: result.Data.PermissionList ?? [],
+                    total: result.Data.TotalCount ?? 0,
+                    raw: result,
+                }, "资源权限列表查询成功");
+            }
+            case "listRoles": {
+                const result = await cloudbase.permission.describeRoleList({
+                    pageNumber: pageNo ?? 1,
+                    pageSize: pageSize ?? 20,
+                    loadDetails: true,
+                });
+                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                return buildEnvelope({
+                    action,
+                    envId,
+                    systemRoles: result.Data.SystemRoles ?? [],
+                    customRoles: result.Data.CustomRoles ?? [],
+                    total: result.Data.TotalCount ?? 0,
+                    raw: result,
+                }, "角色列表查询成功");
+            }
+            case "getRole": {
+                const result = await cloudbase.permission.describeRoleList({
+                    roleId,
+                    roleIdentity,
+                    roleName,
+                    pageNumber: 1,
+                    pageSize: 20,
+                    loadDetails: true,
+                });
+                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                const roles = [
+                    ...(result.Data.SystemRoles ?? []),
+                    ...(result.Data.CustomRoles ?? []),
+                ];
+                const role = roles.find((item) => (roleId && item.RoleId === roleId) ||
+                    (roleIdentity && item.RoleIdentity === roleIdentity) ||
+                    (roleName && item.RoleName === roleName)) ?? null;
+                return buildEnvelope({
+                    action,
+                    envId,
+                    role,
+                    raw: result,
+                }, "角色详情查询成功");
+            }
+            case "listUsers": {
+                const result = await cloudbase.user.describeUserList({
+                    pageNo: pageNo ?? 1,
+                    pageSize: pageSize ?? 20,
+                    name: username,
+                });
+                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                return buildEnvelope({
+                    action,
+                    envId,
+                    users: result.Data.UserList ?? [],
+                    total: result.Data.Total ?? 0,
+                    raw: result,
+                }, "应用用户列表查询成功");
+            }
+            case "getUser": {
+                if (!uid && !username) {
+                    throw new Error("action=getUser 时必须提供 uid 或 username");
+                }
+                const result = await cloudbase.user.describeUserList({
+                    pageNo: 1,
+                    pageSize: 20,
+                    name: username,
+                });
+                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                const user = (result.Data.UserList ?? []).find((item) => (uid && item.Uid === uid) || (username && item.Name === username)) ?? null;
+                return buildEnvelope({
+                    action,
+                    envId,
+                    user,
+                    raw: result,
+                }, "应用用户详情查询成功");
+            }
+        }
+    }));
+    server.registerTool?.("managePermissions", {
+        title: "管理权限与用户配置",
+        description: "权限域统一写入口。支持修改资源权限、角色管理、成员与策略增删、应用用户 CRUD。",
+        inputSchema: {
+            action: zod_1.z.enum(MANAGE_PERMISSION_ACTIONS),
+            resourceType: zod_1.z
+                .enum(["noSqlDatabase", "sqlDatabase", "function", "storage"])
+                .optional(),
+            resourceId: zod_1.z.string().optional(),
+            permission: zod_1.z
+                .enum(["READONLY", "PRIVATE", "ADMINWRITE", "ADMINONLY", "CUSTOM"])
+                .optional(),
+            securityRule: zod_1.z.string().optional(),
+            roleId: zod_1.z.string().optional(),
+            roleIds: zod_1.z.array(zod_1.z.string()).optional(),
+            roleName: zod_1.z.string().optional(),
+            roleIdentity: zod_1.z.string().optional(),
+            description: zod_1.z.string().optional(),
+            memberUids: zod_1.z.array(zod_1.z.string()).optional(),
+            policies: zod_1.z.array(zod_1.z.record(zod_1.z.any())).optional(),
+            uid: zod_1.z.string().optional(),
+            uids: zod_1.z.array(zod_1.z.string()).optional(),
+            username: zod_1.z.string().optional(),
+            password: zod_1.z.string().optional(),
+            userStatus: zod_1.z.enum(["ACTIVE", "BLOCKED"]).optional(),
+        },
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: true,
+            idempotentHint: false,
+            openWorldHint: true,
+            category: "permissions",
+        },
+    }, async ({ action, resourceType, resourceId, permission, securityRule, roleId, roleIds, roleName, roleIdentity, description, memberUids, policies, uid, uids, username, password, userStatus, }) => withEnvelope(async () => {
+        const envId = await (0, cloudbase_manager_js_1.getEnvId)(cloudBaseOptions);
+        const cloudbase = await getManager();
+        const normalizedPolicies = normalizeRecordArray(policies, "policies");
+        switch (action) {
+            case "updateResourcePermission": {
+                if (!resourceType || !resourceId || !permission) {
+                    throw new Error("action=updateResourcePermission 时必须提供 resourceType、resourceId 和 permission");
+                }
+                const result = await cloudbase.permission.modifyResourcePermission({
+                    resourceType: mapResourceType(resourceType),
+                    resource: resourceId,
+                    permission,
+                    securityRule,
+                });
+                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                return buildEnvelope({
+                    action,
+                    envId,
+                    resourceType,
+                    resourceId,
+                    permission,
+                    raw: result,
+                }, "资源权限更新成功");
+            }
+            case "createRole": {
+                if (!roleName || !roleIdentity) {
+                    throw new Error("action=createRole 时必须提供 roleName 和 roleIdentity");
+                }
+                const result = await cloudbase.permission.createRole({
+                    roleName,
+                    roleIdentity,
+                    description,
+                    memberUids,
+                    policies: normalizedPolicies,
+                });
+                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                return buildEnvelope({
+                    action,
+                    envId,
+                    roleName,
+                    raw: result,
+                }, "角色创建成功");
+            }
+            case "updateRole":
+            case "addRoleMembers":
+            case "removeRoleMembers":
+            case "addRolePolicies":
+            case "removeRolePolicies": {
+                if (!roleId) {
+                    throw new Error(`action=${action} 时必须提供 roleId`);
+                }
+                const result = await cloudbase.permission.modifyRole({
+                    roleId,
+                    ...(action === "updateRole"
+                        ? {
+                            roleName,
+                            description,
+                            addMemberUids: memberUids,
+                            addPolicies: normalizedPolicies,
+                        }
+                        : {}),
+                    ...(action === "addRoleMembers" ? { addMemberUids: memberUids } : {}),
+                    ...(action === "removeRoleMembers" ? { removeMemberUids: memberUids } : {}),
+                    ...(action === "addRolePolicies" ? { addPolicies: normalizedPolicies } : {}),
+                    ...(action === "removeRolePolicies"
+                        ? { removePolicies: normalizedPolicies }
+                        : {}),
+                });
+                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                return buildEnvelope({
+                    action,
+                    envId,
+                    roleId,
+                    raw: result,
+                }, "角色更新成功");
+            }
+            case "deleteRoles": {
+                if (!roleIds?.length) {
+                    throw new Error("action=deleteRoles 时必须提供 roleIds");
+                }
+                const result = await cloudbase.permission.deleteRoles({
+                    roleIds,
+                });
+                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                return buildEnvelope({
+                    action,
+                    envId,
+                    roleIds,
+                    raw: result,
+                }, "角色删除成功");
+            }
+            case "createUser": {
+                if (!username || !password) {
+                    throw new Error("action=createUser 时必须提供 username 和 password");
+                }
+                const result = await cloudbase.user.createUser({
+                    name: username,
+                    password,
+                    userStatus,
+                    description,
+                });
+                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                return buildEnvelope({
+                    action,
+                    envId,
+                    username,
+                    raw: result,
+                }, "应用用户创建成功");
+            }
+            case "updateUser": {
+                if (!uid) {
+                    throw new Error("action=updateUser 时必须提供 uid");
+                }
+                const result = await cloudbase.user.modifyUser({
+                    uid,
+                    name: username,
+                    password,
+                    userStatus,
+                    description,
+                });
+                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                return buildEnvelope({
+                    action,
+                    envId,
+                    uid,
+                    raw: result,
+                }, "应用用户更新成功");
+            }
+            case "deleteUsers": {
+                if (!uids?.length) {
+                    throw new Error("action=deleteUsers 时必须提供 uids");
+                }
+                const result = await cloudbase.user.deleteUsers({
+                    uids,
+                });
+                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                return buildEnvelope({
+                    action,
+                    envId,
+                    uids,
+                    raw: result,
+                }, "应用用户删除成功");
+            }
+        }
+    }));
+}
+
+
 /***/ }),
 
 /***/ 6556:
@@ -8962,7 +10062,7 @@ function registerSetupTools(server) {
         title: "下载项目模板",
         description: `自动下载并部署CloudBase项目模板。⚠️ **MANDATORY FOR NEW PROJECTS** ⚠️
 
-**CRITICAL**: This tool MUST be called FIRST when starting a new project.\n\n支持的模板:\n- react: React + CloudBase 全栈应用模板\n- vue: Vue + CloudBase 全栈应用模板\n- miniprogram: 微信小程序 + 云开发模板  \n- uniapp: UniApp + CloudBase 跨端应用模板\n- rules: 只包含AI编辑器配置文件（包含Cursor、WindSurf、CodeBuddy等所有主流编辑器配置），适合在已有项目中补充AI编辑器配置\n\n支持的IDE类型:\n- all: 下载所有IDE配置\n- cursor: Cursor AI编辑器\n- 其他IDE类型见下方列表\n\n注意：如果未传入 ide 参数且无法从环境变量检测到 IDE，将提示错误并要求传入 ide 参数\n- windsurf: WindSurf AI编辑器\n- codebuddy: CodeBuddy AI编辑器\n- claude-code: Claude Code AI编辑器\n- cline: Cline AI编辑器\n- gemini-cli: Gemini CLI\n- opencode: OpenCode AI编辑器\n- qwen-code: 通义灵码\n- baidu-comate: 百度Comate\n- openai-codex-cli: OpenAI Codex CLI\n- augment-code: Augment Code\n- github-copilot: GitHub Copilot\n- roocode: RooCode AI编辑器\n- tongyi-lingma: 通义灵码\n- trae: Trae AI编辑器\n- qoder: Qoder AI编辑器\n- antigravity: Google Antigravity AI编辑器\n- vscode: Visual Studio Code\n- kiro: Kiro AI编辑器\n- aider: Aider AI编辑器\n\n特别说明：\n- rules 模板会自动包含当前 mcp 版本号信息（版本号：${ true ? "2.15.4" : 0}），便于后续维护和版本追踪\n- 下载 rules 模板时，如果项目中已存在 README.md 文件，系统会自动保护该文件不被覆盖（除非设置 overwrite=true）`,
+**CRITICAL**: This tool MUST be called FIRST when starting a new project.\n\n支持的模板:\n- react: React + CloudBase 全栈应用模板\n- vue: Vue + CloudBase 全栈应用模板\n- miniprogram: 微信小程序 + 云开发模板  \n- uniapp: UniApp + CloudBase 跨端应用模板\n- rules: 只包含AI编辑器配置文件（包含Cursor、WindSurf、CodeBuddy等所有主流编辑器配置），适合在已有项目中补充AI编辑器配置\n\n支持的IDE类型:\n- all: 下载所有IDE配置\n- cursor: Cursor AI编辑器\n- 其他IDE类型见下方列表\n\n注意：如果未传入 ide 参数且无法从环境变量检测到 IDE，将提示错误并要求传入 ide 参数\n- windsurf: WindSurf AI编辑器\n- codebuddy: CodeBuddy AI编辑器\n- claude-code: Claude Code AI编辑器\n- cline: Cline AI编辑器\n- gemini-cli: Gemini CLI\n- opencode: OpenCode AI编辑器\n- qwen-code: 通义灵码\n- baidu-comate: 百度Comate\n- openai-codex-cli: OpenAI Codex CLI\n- augment-code: Augment Code\n- github-copilot: GitHub Copilot\n- roocode: RooCode AI编辑器\n- tongyi-lingma: 通义灵码\n- trae: Trae AI编辑器\n- qoder: Qoder AI编辑器\n- antigravity: Google Antigravity AI编辑器\n- vscode: Visual Studio Code\n- kiro: Kiro AI编辑器\n- aider: Aider AI编辑器\n\n特别说明：\n- rules 模板会自动包含当前 mcp 版本号信息（版本号：${ true ? "2.16.1-beta.1" : 0}），便于后续维护和版本追踪\n- 下载 rules 模板时，如果项目中已存在 README.md 文件，系统会自动保护该文件不被覆盖（除非设置 overwrite=true）`,
         inputSchema: {
             template: zod_1.z
                 .enum(["react", "vue", "miniprogram", "uniapp", "rules"])
@@ -9139,13 +10239,235 @@ function registerSetupTools(server) {
 }
 
 
-/***/ }),
-
-/***/ 6665:
-/***/ ((module) => {
-
-module.exports = __WEBPACK_EXTERNAL_MODULE__cloudbase_manager_node_6a52ea40__;
-
+/***/ }),
+
+/***/ 6665:
+/***/ ((module) => {
+
+module.exports = __WEBPACK_EXTERNAL_MODULE__cloudbase_manager_node_6a52ea40__;
+
+/***/ }),
+
+/***/ 6817:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.registerAppTools = registerAppTools;
+const zod_1 = __webpack_require__(2971);
+const cloudbase_manager_js_1 = __webpack_require__(3431);
+const json_content_js_1 = __webpack_require__(4365);
+const QUERY_APP_ACTIONS = ["listApps", "getApp", "listAppVersions", "getAppVersion"];
+const MANAGE_APP_ACTIONS = ["deployApp", "deleteApp", "deleteAppVersion"];
+function buildEnvelope(data, message) {
+    return {
+        success: true,
+        data,
+        message,
+    };
+}
+function buildErrorEnvelope(error) {
+    return {
+        success: false,
+        data: {},
+        message: error instanceof Error ? error.message : String(error),
+    };
+}
+function getCloudAppService(cloudbase) {
+    return cloudbase.cloudAppService ?? cloudbase.getCloudAppService?.();
+}
+function registerAppTools(server) {
+    const cloudBaseOptions = server.cloudBaseOptions;
+    const getManager = () => (0, cloudbase_manager_js_1.getCloudBaseManager)({ cloudBaseOptions });
+    server.registerTool?.("queryApps", {
+        title: "查询 CloudApp",
+        description: "CloudApp 域统一只读入口。支持应用、版本列表与版本详情查询。",
+        inputSchema: {
+            action: zod_1.z.enum(QUERY_APP_ACTIONS),
+            serviceName: zod_1.z.string().optional(),
+            searchKey: zod_1.z.string().optional(),
+            pageNo: zod_1.z.number().optional(),
+            pageSize: zod_1.z.number().optional(),
+            versionName: zod_1.z.string().optional(),
+            buildId: zod_1.z.string().optional(),
+        },
+        annotations: {
+            readOnlyHint: true,
+            openWorldHint: true,
+            category: "apps",
+        },
+    }, async ({ action, serviceName, searchKey, pageNo, pageSize, versionName, buildId, }) => {
+        try {
+            const cloudbase = await getManager();
+            const appService = getCloudAppService(cloudbase);
+            if (!appService) {
+                throw new Error("当前 manager 未提供 cloudAppService");
+            }
+            if (action === "listApps") {
+                const result = await appService.describeAppList({
+                    deployType: "static-hosting",
+                    pageNo: pageNo ?? 1,
+                    pageSize: pageSize ?? 20,
+                    searchKey,
+                });
+                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                return (0, json_content_js_1.jsonContent)(buildEnvelope({
+                    action,
+                    apps: result.ServiceList ?? [],
+                    total: result.Total ?? 0,
+                    raw: result,
+                }, "CloudApp 列表查询成功"));
+            }
+            if (!serviceName) {
+                throw new Error(`action=${action} 时必须提供 serviceName`);
+            }
+            if (action === "getApp") {
+                const result = await appService.describeAppInfo({
+                    deployType: "static-hosting",
+                    serviceName,
+                });
+                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                return (0, json_content_js_1.jsonContent)(buildEnvelope({
+                    action,
+                    serviceName,
+                    app: result,
+                }, "CloudApp 详情查询成功"));
+            }
+            if (action === "listAppVersions") {
+                const result = await appService.describeAppVersionList({
+                    deployType: "static-hosting",
+                    serviceName,
+                    pageNo: pageNo ?? 1,
+                    pageSize: pageSize ?? 20,
+                });
+                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                return (0, json_content_js_1.jsonContent)(buildEnvelope({
+                    action,
+                    serviceName,
+                    versions: result.VersionList ?? [],
+                    total: result.Total ?? 0,
+                    raw: result,
+                }, "CloudApp 版本列表查询成功"));
+            }
+            const result = await appService.describeAppVersion({
+                deployType: "static-hosting",
+                serviceName,
+                versionName,
+                buildId,
+            });
+            (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+            return (0, json_content_js_1.jsonContent)(buildEnvelope({
+                action,
+                serviceName,
+                version: result,
+            }, "CloudApp 版本详情查询成功"));
+        }
+        catch (error) {
+            return (0, json_content_js_1.jsonContent)(buildErrorEnvelope(error));
+        }
+    });
+    server.registerTool?.("manageApps", {
+        title: "管理 CloudApp",
+        description: "CloudApp 域统一写入口。首轮仅支持静态部署、删除应用和删除版本。",
+        inputSchema: {
+            action: zod_1.z.enum(MANAGE_APP_ACTIONS),
+            serviceName: zod_1.z.string(),
+            localPath: zod_1.z.string().optional(),
+            appPath: zod_1.z.string().optional(),
+            buildPath: zod_1.z.string().optional(),
+            framework: zod_1.z.string().optional(),
+            nodeJsVersion: zod_1.z.string().optional(),
+            installCmd: zod_1.z.string().optional(),
+            buildCmd: zod_1.z.string().optional(),
+            deployCmd: zod_1.z.string().optional(),
+            ignore: zod_1.z.array(zod_1.z.string()).optional(),
+            versionName: zod_1.z.string().optional(),
+        },
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: true,
+            idempotentHint: false,
+            openWorldHint: true,
+            category: "apps",
+        },
+    }, async ({ action, serviceName, localPath, appPath, buildPath, framework, nodeJsVersion, installCmd, buildCmd, deployCmd, ignore, versionName, }) => {
+        try {
+            const cloudbase = await getManager();
+            const appService = getCloudAppService(cloudbase);
+            if (!appService) {
+                throw new Error("当前 manager 未提供 cloudAppService");
+            }
+            if (action === "deployApp") {
+                if (!localPath) {
+                    throw new Error("action=deployApp 时必须提供 localPath");
+                }
+                const uploadResult = await appService.uploadCode({
+                    deployType: "static-hosting",
+                    serviceName,
+                    localPath,
+                    ignore,
+                });
+                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, uploadResult);
+                const result = await appService.createApp({
+                    deployType: "static-hosting",
+                    serviceName,
+                    buildType: "ZIP",
+                    staticConfig: {
+                        appPath,
+                        buildPath,
+                        framework,
+                        nodeJsVersion,
+                        cosTimestamp: uploadResult.cosTimestamp,
+                        staticCmd: {
+                            installCmd,
+                            buildCmd,
+                            deployCmd,
+                        },
+                    },
+                });
+                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                return (0, json_content_js_1.jsonContent)(buildEnvelope({
+                    action,
+                    serviceName,
+                    upload: uploadResult,
+                    deployment: result,
+                }, "CloudApp 部署成功"));
+            }
+            if (action === "deleteApp") {
+                const result = await appService.deleteApp({
+                    deployType: "static-hosting",
+                    serviceName,
+                });
+                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                return (0, json_content_js_1.jsonContent)(buildEnvelope({
+                    action,
+                    serviceName,
+                    raw: result,
+                }, "CloudApp 删除成功"));
+            }
+            if (!versionName) {
+                throw new Error("action=deleteAppVersion 时必须提供 versionName");
+            }
+            const result = await appService.deleteAppVersion({
+                deployType: "static-hosting",
+                serviceName,
+                versionName,
+            });
+            (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+            return (0, json_content_js_1.jsonContent)(buildEnvelope({
+                action,
+                serviceName,
+                versionName,
+                raw: result,
+            }, "CloudApp 版本删除成功"));
+        }
+        catch (error) {
+            return (0, json_content_js_1.jsonContent)(buildErrorEnvelope(error));
+        }
+    });
+}
+
+
 /***/ }),
 
 /***/ 6887:
@@ -9968,7 +11290,7 @@ exports.getLoginState = getLoginState;
 exports.logout = logout;
 const toolbox_1 = __webpack_require__(2090);
 const logger_js_1 = __webpack_require__(3039);
-const tencet_cloud_js_1 = __webpack_require__(5018);
+const tencent_cloud_js_1 = __webpack_require__(1454);
 const auth = toolbox_1.AuthSupervisor.getInstance({});
 const authProgressState = {
     status: "IDLE",
@@ -10157,7 +11479,7 @@ async function peekLoginState(options) {
     return auth.getLoginState();
 }
 async function ensureLogin(options) {
-    (0, logger_js_1.debug)("TENCENTCLOUD_SECRETID", { secretId: process.env.TENCENTCLOUD_SECRETID });
+    (0, logger_js_1.debug)("TENCENTCLOUD_SECRETID", { hasSecretId: !!process.env.TENCENTCLOUD_SECRETID });
     const loginState = await peekLoginState({
         ignoreEnvVars: options?.ignoreEnvVars,
     });
@@ -10178,14 +11500,14 @@ async function ensureLogin(options) {
         const loginOptions = { flow: mode };
         if (mode === "web") {
             loginOptions.getAuthUrl =
-                options?.fromCloudBaseLoginPage && !(0, tencet_cloud_js_1.isInternationalRegion)(options?.region)
+                options?.fromCloudBaseLoginPage && !(0, tencent_cloud_js_1.isInternationalRegion)(options?.region)
                     ? (url) => {
                         const separator = url.includes("?") ? "&" : "?";
                         const urlWithParam = `${url}${separator}allowNoEnv=true`;
                         return `https://tcb.cloud.tencent.com/login?_redirect_uri=${encodeURIComponent(urlWithParam)}`;
                     }
                     : (url) => {
-                        if ((0, tencet_cloud_js_1.isInternationalRegion)(options?.region)) {
+                        if ((0, tencent_cloud_js_1.isInternationalRegion)(options?.region)) {
                             url = url.replace("cloud.tencent.com", "tencentcloud.com");
                         }
                         const separator = url.includes("?") ? "&" : "?";
@@ -10253,332 +11575,6 @@ module.exports = __WEBPACK_EXTERNAL_MODULE_dns__;
 
 module.exports = __WEBPACK_EXTERNAL_MODULE_crypto__;
 
-/***/ }),
-
-/***/ 7862:
-/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
-
-
-Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.WRITE_SECURITY_RULE = exports.READ_SECURITY_RULE = void 0;
-exports.normalizeCustomSecurityRule = normalizeCustomSecurityRule;
-exports.buildSecurityRuleErrorMessage = buildSecurityRuleErrorMessage;
-exports.registerSecurityRuleTools = registerSecurityRuleTools;
-const zod_1 = __webpack_require__(2971);
-const cloudbase_manager_js_1 = __webpack_require__(3431);
-exports.READ_SECURITY_RULE = "readSecurityRule";
-exports.WRITE_SECURITY_RULE = "writeSecurityRule";
-const FUNCTION_CUSTOM_RULE_EXAMPLE = JSON.stringify({
-    "*": {
-        invoke: true,
-    },
-}, null, 2);
-function isPlainObject(value) {
-    return (typeof value === "object" &&
-        value !== null &&
-        !Array.isArray(value));
-}
-function formatSecurityRuleInputHint(resourceType) {
-    if (resourceType === "function") {
-        return `函数自定义安全规则应传 JSON 对象或 JSON 字符串，例如 ${FUNCTION_CUSTOM_RULE_EXAMPLE}。`;
-    }
-    if (resourceType === "noSqlDatabase") {
-        return "NoSQL 自定义安全规则应传 JSON 对象或 JSON 字符串，例如 {\"read\":\"true\",\"write\":\"true\"}。";
-    }
-    return "自定义安全规则应传 JSON 对象或 JSON 字符串，并与 readSecurityRule 返回的规则结构保持一致。";
-}
-function normalizeCustomSecurityRule(resourceType, rule) {
-    if (rule === undefined) {
-        throw new Error(`resourceType=${resourceType} 且 aclTag=CUSTOM 时必须提供 rule 字段`);
-    }
-    if (typeof rule === "string") {
-        try {
-            const parsed = JSON.parse(rule);
-            if (!isPlainObject(parsed)) {
-                throw new Error(`rule 必须是 JSON 对象，不支持 ${Array.isArray(parsed) ? "数组" : typeof parsed}。`);
-            }
-            return JSON.stringify(parsed);
-        }
-        catch (error) {
-            const baseMessage = error instanceof Error ? error.message : "rule 不是合法的 JSON 字符串";
-            throw new Error(`${baseMessage} ${formatSecurityRuleInputHint(resourceType)}`);
-        }
-    }
-    if (!isPlainObject(rule)) {
-        throw new Error(`rule 必须是 JSON 对象或 JSON 字符串。${formatSecurityRuleInputHint(resourceType)}`);
-    }
-    return JSON.stringify(rule);
-}
-function buildSecurityRuleErrorMessage(operation, resourceType, aclTag, error) {
-    const baseMessage = error instanceof Error ? error.message : String(error);
-    const suggestions = [];
-    if (operation === "writeSecurityRule" && aclTag === "CUSTOM") {
-        suggestions.push(formatSecurityRuleInputHint(resourceType));
-    }
-    if (/INVALID_VALUE|ModifySecurityRule|错误的值|JSON/i.test(baseMessage)) {
-        suggestions.push("请先把 CUSTOM 规则整理成 JSON 对象，再传给 writeSecurityRule。");
-    }
-    if (suggestions.length === 0) {
-        suggestions.push("请检查 resourceType、aclTag 和 rule 是否与官方安全规则格式一致后重试。");
-    }
-    return `[${operation}] 调用失败: ${baseMessage}\n建议：${suggestions.join(" ")}`;
-}
-/**
- * 注册安全规则相关 Tool
- * @param server MCP Server 实例
- */
-function registerSecurityRuleTools(server) {
-    const cloudBaseOptions = server.cloudBaseOptions;
-    const getManager = () => (0, cloudbase_manager_js_1.getCloudBaseManager)({ cloudBaseOptions });
-    // 读取安全规则 Tool
-    server.registerTool?.(exports.READ_SECURITY_RULE, {
-        title: "读取安全规则",
-        description: `读取指定资源（noSQL 数据库、SQL 数据库、云函数、存储桶）的安全规则和权限类别。\n\n安全规则文档：\n- 云函数安全规则：https://docs.cloudbase.net/cloud-function/security-rules\n- 存储安全规则：https://docs.cloudbase.net/storage/security-rules\n- 文档型数据库安全规则：https://docs.cloudbase.net/database/security-rules`,
-        inputSchema: {
-            resourceType: zod_1.z
-                .enum(["noSqlDatabase", "sqlDatabase", "function", "storage"])
-                .describe("资源类型：noSqlDatabase=noSQL 数据库，sqlDatabase=SQL 数据库，function=云函数，storage=存储桶"),
-            resourceId: zod_1.z
-                .string()
-                .describe("资源唯一标识。noSQL 数据库为集合名，SQL 数据库为表名，云函数为函数名，存储为桶名（完整格式如 '6169-xxx-1257473911'，可通过 envQuery action=info 获取 EnvInfo.Storages[].Bucket）。"),
-        },
-        annotations: {
-            readOnlyHint: true,
-            openWorldHint: true,
-            category: "security-rule",
-        },
-    }, async ({ resourceType, resourceId }) => {
-        const envId = await (0, cloudbase_manager_js_1.getEnvId)(cloudBaseOptions);
-        const cloudbase = await getManager();
-        let result;
-        if (resourceType === "noSqlDatabase") {
-            result = await cloudbase.commonService().call({
-                Action: "DescribeSafeRule",
-                Param: {
-                    CollectionName: resourceId,
-                    EnvId: envId,
-                },
-            });
-            (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
-        }
-        else if (resourceType === "function") {
-            result = await cloudbase.commonService().call({
-                Action: "DescribeSecurityRule",
-                Param: {
-                    ResourceType: "FUNCTION",
-                    EnvId: envId,
-                },
-            });
-            (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
-        }
-        else if (resourceType === "storage") {
-            result = await cloudbase.commonService().call({
-                Action: "DescribeStorageSafeRule",
-                Param: {
-                    Bucket: resourceId,
-                    EnvId: envId,
-                },
-            });
-            (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
-        }
-        else if (resourceType === "sqlDatabase") {
-            const instanceId = "default";
-            const schema = envId;
-            const tableName = resourceId;
-            result = await cloudbase.commonService("lowcode").call({
-                Action: "DescribeDataSourceBasicPolicy",
-                Param: {
-                    EnvId: envId,
-                    ResourceType: "table",
-                    ResourceId: `${instanceId}#${schema}#${tableName}`,
-                    RoleIdentityList: ["allUser"],
-                },
-            });
-            (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
-        }
-        else {
-            throw new Error(`不支持的资源类型: ${resourceType}`);
-        }
-        return {
-            content: [
-                {
-                    type: "text",
-                    text: JSON.stringify({
-                        success: true,
-                        resourceType,
-                        resourceId,
-                        aclTag: result.AclTag,
-                        rule: result.Rule ?? null,
-                        raw: result,
-                        message: "安全规则读取成功",
-                    }, null, 2),
-                },
-            ],
-        };
-    });
-    // 写入安全规则 Tool
-    server.registerTool?.(exports.WRITE_SECURITY_RULE, {
-        title: "写入安全规则",
-        description: `设置指定资源（数据库集合、云函数、存储桶）的安全规则。\n\n安全规则文档：\n- 云函数安全规则：https://docs.cloudbase.net/cloud-function/security-rules\n- 存储安全规则：https://docs.cloudbase.net/storage/security-rules\n- 数据库安全规则：https://docs.cloudbase.net/database/security-rules\n\n云函数安全规则仅支持 aclTag="CUSTOM"，rule 字段为 JSON 字符串。例如放开所有访问可设置 rule="true"。`,
-        inputSchema: {
-            resourceType: zod_1.z
-                .enum(["sqlDatabase", "noSqlDatabase", "function", "storage"])
-                .describe("资源类型：sqlDatabase=SQL 数据库，noSqlDatabase=noSQL 数据库，function=云函数，storage=存储桶"),
-            resourceId: zod_1.z
-                .string()
-                .describe("资源唯一标识。sqlDatabase=表名，noSqlDatabase=集合名，云函数为函数名，存储为桶名（完整格式如 '6169-xxx-1257473911'，可通过 envQuery action=info 获取 EnvInfo.Storages[].Bucket）。"),
-            aclTag: zod_1.z
-                .enum(["READONLY", "PRIVATE", "ADMINWRITE", "ADMINONLY", "CUSTOM"])
-                .describe("权限类别"),
-            rule: zod_1.z
-                .union([zod_1.z.string(), zod_1.z.record(zod_1.z.any())])
-                .optional()
-                .describe(`自定义安全规则内容，仅当 aclTag 为 CUSTOM 时必填。可以直接传 JSON 对象，或者传可解析为 JSON 对象的字符串。函数示例：${FUNCTION_CUSTOM_RULE_EXAMPLE}`),
-        },
-        annotations: {
-            readOnlyHint: false,
-            openWorldHint: true,
-            category: "security-rule",
-        },
-    }, async ({ resourceType, resourceId, aclTag, rule }) => {
-        try {
-            const cloudbase = await getManager();
-            const envId = await (0, cloudbase_manager_js_1.getEnvId)(cloudBaseOptions);
-            let result;
-            if (resourceType === "noSqlDatabase") {
-                if (aclTag === "CUSTOM") {
-                    const normalizedRule = normalizeCustomSecurityRule(resourceType, rule);
-                    result = await cloudbase.commonService().call({
-                        Action: "ModifySafeRule",
-                        Param: {
-                            CollectionName: resourceId,
-                            EnvId: envId,
-                            AclTag: aclTag,
-                            Rule: normalizedRule,
-                        },
-                    });
-                    (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
-                }
-                else {
-                    result = await cloudbase.commonService().call({
-                        Action: "ModifyDatabaseACL",
-                        Param: {
-                            CollectionName: resourceId,
-                            EnvId: envId,
-                            AclTag: aclTag,
-                        },
-                    });
-                    (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
-                }
-            }
-            else if (resourceType === "function") {
-                if (aclTag !== "CUSTOM")
-                    throw new Error("云函数安全规则仅支持 CUSTOM 权限类别");
-                const normalizedRule = normalizeCustomSecurityRule(resourceType, rule);
-                result = await cloudbase.commonService().call({
-                    Action: "ModifySecurityRule",
-                    Param: {
-                        AclTag: aclTag,
-                        EnvId: envId,
-                        ResourceType: "FUNCTION",
-                        Rule: normalizedRule,
-                    },
-                });
-                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
-            }
-            else if (resourceType === "storage") {
-                if (aclTag === "CUSTOM") {
-                    const normalizedRule = normalizeCustomSecurityRule(resourceType, rule);
-                    result = await cloudbase.commonService().call({
-                        Action: "ModifyStorageSafeRule",
-                        Param: {
-                            Bucket: resourceId,
-                            EnvId: envId,
-                            AclTag: aclTag,
-                            Rule: normalizedRule,
-                        },
-                    });
-                    (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
-                }
-                else {
-                    result = await cloudbase.commonService().call({
-                        Action: "ModifyStorageSafeRule",
-                        Param: {
-                            Bucket: resourceId,
-                            EnvId: envId,
-                            AclTag: aclTag,
-                        },
-                    });
-                    (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
-                }
-            }
-            else if (resourceType === "sqlDatabase") {
-                if (aclTag === "CUSTOM") {
-                    throw new Error("SQL 数据库不支持自定义安全规则（CUSTOM）");
-                }
-                const schema = envId;
-                const tableName = resourceId;
-                const instanceId = "default";
-                const resource = `${instanceId}#${schema}#${tableName}`;
-                const resourceType = "table";
-                const effect = "allow";
-                const policyList = [
-                    "allUser",
-                    "anonymousUser",
-                    "externalUser",
-                    "internalUser",
-                ].map((roleIdentity) => ({
-                    RoleIdentity: roleIdentity,
-                    ResourceType: resourceType,
-                    ResourceId: resource,
-                    RowPermission: [],
-                    Effect: effect,
-                }));
-                policyList[0].RowPermission = getRowPermission(aclTag);
-                result = await cloudbase.commonService("lowcode").call({
-                    Action: "BatchCreateResourcePolicy",
-                    Param: {
-                        EnvId: envId,
-                        PolicyList: policyList,
-                    },
-                });
-                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
-                function getRowPermission(policy) {
-                    return {
-                        READONLY: [
-                            { Key: "all", Value: "r" },
-                            { Key: "me", Value: "rw" },
-                        ],
-                        PRIVATE: [{ Key: "me", Value: "rw" }],
-                        ADMINWRITE: [{ Key: "all", Value: "r" }],
-                        ADMINONLY: [],
-                    }[policy];
-                }
-            }
-            else {
-                throw new Error(`不支持的资源类型: ${resourceType}`);
-            }
-            return {
-                content: [
-                    {
-                        type: "text",
-                        text: JSON.stringify({
-                            success: true,
-                            requestId: result.RequestId,
-                            raw: result,
-                            message: "安全规则写入成功",
-                        }, null, 2),
-                    },
-                ],
-            };
-        }
-        catch (error) {
-            throw new Error(buildSecurityRuleErrorMessage("writeSecurityRule", resourceType, aclTag, error));
-        }
-    });
-}
-
-
 /***/ }),
 
 /***/ 7932:
@@ -11015,7 +12011,7 @@ function isPrivateIP(ip) {
     // 转换 IP 地址为长整数进行范围检查
     const ipv4Parts = ip.split('.').map(part => parseInt(part, 10));
     if (ipv4Parts.length === 4) {
-        const ipNum = (ipv4Parts[0] << 24) + (ipv4Parts[1] << 16) + (ipv4Parts[2] << 8) + ipv4Parts[3];
+        const ipNum = ((ipv4Parts[0] << 24) >>> 0) + (ipv4Parts[1] << 16) + (ipv4Parts[2] << 8) + ipv4Parts[3];
         // 检查私有 IP 范围
         // 10.0.0.0 - 10.255.255.255
         if (ipNum >= 167772160 && ipNum <= 184549375)
@@ -11330,6 +12326,191 @@ function registerDownloadTools(server) {
 
 module.exports = __WEBPACK_EXTERNAL_MODULE_winston__;
 
+/***/ }),
+
+/***/ 9527:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.registerAgentTools = registerAgentTools;
+const zod_1 = __webpack_require__(2971);
+const cloudbase_manager_js_1 = __webpack_require__(3431);
+const json_content_js_1 = __webpack_require__(4365);
+const QUERY_AGENT_ACTIONS = ["listAgents", "getAgent", "getAgentLogs"];
+const MANAGE_AGENT_ACTIONS = ["createAgent", "updateAgent", "deleteAgent"];
+function buildEnvelope(data, message) {
+    return {
+        success: true,
+        data,
+        message,
+    };
+}
+function buildErrorEnvelope(error) {
+    return {
+        success: false,
+        data: {},
+        message: error instanceof Error ? error.message : String(error),
+    };
+}
+function normalizeString(value) {
+    return typeof value === "string" && value.trim().length > 0 ? value.trim() : undefined;
+}
+function normalizeNumber(value) {
+    return typeof value === "number" && Number.isFinite(value) ? value : undefined;
+}
+function normalizeBoolean(value) {
+    return typeof value === "boolean" ? value : undefined;
+}
+function normalizeAgentPayload(params) {
+    if (!params) {
+        return {};
+    }
+    const { name, agentId, runtime, timeout, memorySize, installDependency, ...rest } = params;
+    return {
+        ...rest,
+        ...(normalizeString(name) ? { Name: normalizeString(name) } : {}),
+        ...(normalizeString(agentId) ? { AgentId: normalizeString(agentId) } : {}),
+        ...(normalizeString(runtime) ? { Runtime: normalizeString(runtime) } : {}),
+        ...(normalizeNumber(timeout) !== undefined ? { Timeout: normalizeNumber(timeout) } : {}),
+        ...(normalizeNumber(memorySize) !== undefined
+            ? { MemorySize: normalizeNumber(memorySize) }
+            : {}),
+        ...(normalizeBoolean(installDependency) !== undefined
+            ? { InstallDependency: normalizeBoolean(installDependency) }
+            : {}),
+    };
+}
+function registerAgentTools(server) {
+    const cloudBaseOptions = server.cloudBaseOptions;
+    const getManager = () => (0, cloudbase_manager_js_1.getCloudBaseManager)({ cloudBaseOptions });
+    server.registerTool?.("queryAgents", {
+        title: "查询 Agent",
+        description: "Agent 域统一只读入口。支持列表、详情与日志查询。",
+        inputSchema: {
+            action: zod_1.z.enum(QUERY_AGENT_ACTIONS),
+            agentId: zod_1.z.string().optional(),
+            pageNumber: zod_1.z.number().optional(),
+            pageSize: zod_1.z.number().optional(),
+            params: zod_1.z.record(zod_1.z.any()).optional(),
+        },
+        annotations: {
+            readOnlyHint: true,
+            openWorldHint: true,
+            category: "agents",
+        },
+    }, async ({ action, agentId, pageNumber, pageSize, params, }) => {
+        try {
+            const cloudbase = await getManager();
+            if (action === "listAgents") {
+                const result = await cloudbase.agent.describeAgentList({
+                    PageNumber: pageNumber ?? 1,
+                    PageSize: pageSize ?? 20,
+                });
+                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                return (0, json_content_js_1.jsonContent)(buildEnvelope({
+                    action,
+                    agents: result.AgentList ?? result.Agents ?? [],
+                    total: result.Total ?? 0,
+                    raw: result,
+                }, "Agent 列表查询成功"));
+            }
+            if (!agentId) {
+                throw new Error(`action=${action} 时必须提供 agentId`);
+            }
+            if (action === "getAgent") {
+                const result = await cloudbase.agent.describeAgent(agentId);
+                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                return (0, json_content_js_1.jsonContent)(buildEnvelope({
+                    action,
+                    agentId,
+                    agent: result.AgentInfo ?? null,
+                    readiness: {
+                        isReady: result.IsReady,
+                        reason: result.NotReadyReason ?? null,
+                    },
+                    raw: result,
+                }, "Agent 详情查询成功"));
+            }
+            const result = await cloudbase.agent.getAgentLogs({
+                AgentId: agentId,
+                ...(params ?? {}),
+            });
+            (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+            return (0, json_content_js_1.jsonContent)(buildEnvelope({
+                action,
+                agentId,
+                logs: result,
+            }, "Agent 日志查询成功"));
+        }
+        catch (error) {
+            return (0, json_content_js_1.jsonContent)(buildErrorEnvelope(error));
+        }
+    });
+    server.registerTool?.("manageAgents", {
+        title: "管理 Agent",
+        description: "Agent 域统一写入口。支持创建、更新和删除远端 Agent。",
+        inputSchema: {
+            action: zod_1.z.enum(MANAGE_AGENT_ACTIONS),
+            agentId: zod_1.z.string().optional(),
+            params: zod_1.z.record(zod_1.z.any()).optional(),
+        },
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: true,
+            idempotentHint: false,
+            openWorldHint: true,
+            category: "agents",
+        },
+    }, async ({ action, agentId, params, }) => {
+        try {
+            const cloudbase = await getManager();
+            const payload = normalizeAgentPayload(params);
+            if (action === "createAgent") {
+                const createPayload = {
+                    ...payload,
+                    Name: normalizeString(payload.Name) ?? "",
+                    Runtime: normalizeString(payload.Runtime) ?? "Nodejs20.19",
+                };
+                const result = await cloudbase.agent.createAgent(createPayload);
+                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                return (0, json_content_js_1.jsonContent)(buildEnvelope({
+                    action,
+                    raw: result,
+                }, "Agent 创建成功"));
+            }
+            if (!agentId) {
+                throw new Error(`action=${action} 时必须提供 agentId`);
+            }
+            if (action === "updateAgent") {
+                const result = await cloudbase.agent.updateAgent({
+                    AgentId: agentId,
+                    ...payload,
+                });
+                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                return (0, json_content_js_1.jsonContent)(buildEnvelope({
+                    action,
+                    agentId,
+                    raw: result,
+                }, "Agent 更新成功"));
+            }
+            const result = await cloudbase.agent.deleteAgent({
+                AgentId: agentId,
+            });
+            (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+            return (0, json_content_js_1.jsonContent)(buildEnvelope({
+                action,
+                agentId,
+                raw: result,
+            }, "Agent 删除成功"));
+        }
+        catch (error) {
+            return (0, json_content_js_1.jsonContent)(buildErrorEnvelope(error));
+        }
+    });
+}
+
+
 /***/ }),
 
 /***/ 9684:
@@ -11408,8 +12589,6 @@ function shouldRegisterTool(toolName) {
         // Function tools - local code uploads
         'updateFunctionCode',
         'createFunction', // also involves local files
-        // Miniprogram tools - local code uploads
-        'uploadMiniprogramCode',
         // Download tools - local file downloads
         'downloadTemplate',
         'downloadRemoteFile',
@@ -11439,10 +12618,11 @@ exports.registerSQLDatabaseTools = registerSQLDatabaseTools;
 const zod_1 = __webpack_require__(2971);
 const cloudbase_manager_js_1 = __webpack_require__(3431);
 const tool_result_js_1 = __webpack_require__(9835);
-const security_rule_js_1 = __webpack_require__(7862);
 const CATEGORY = "SQL database";
 const QUERY_SQL_DATABASE = "querySqlDatabase";
 const MANAGE_SQL_DATABASE = "manageSqlDatabase";
+const QUERY_PERMISSIONS = "queryPermissions";
+const MANAGE_PERMISSIONS = "managePermissions";
 const QUERY_ACTIONS = [
     "runQuery",
     "describeCreateResult",
@@ -12069,7 +13249,7 @@ async function handleRunStatement(args, context) {
             statementType,
         },
         message: statementType === "CREATE"
-            ? `SQL statement executed successfully. If you created a table, include the required _openid column and verify its security rule with \`${security_rule_js_1.WRITE_SECURITY_RULE}\` and \`${security_rule_js_1.READ_SECURITY_RULE}\`.`
+            ? `SQL statement executed successfully. If you created a table, include the required _openid column and verify its permission configuration with \`${QUERY_PERMISSIONS}(action="getResourcePermission")\` and \`${MANAGE_PERMISSIONS}(action="updateResourcePermission")\`.`
             : "SQL statement executed successfully.",
     });
 }
@@ -12199,7 +13379,7 @@ async function handleInitializeSchema(args, context) {
             requestIdList,
         },
         message: success
-            ? `Schema initialization completed successfully. Remember to verify table security rules with \`${security_rule_js_1.WRITE_SECURITY_RULE}\` and \`${security_rule_js_1.READ_SECURITY_RULE}\`, and include the required _openid column in newly created tables.`
+            ? `Schema initialization completed successfully. Remember to verify table permissions with \`${QUERY_PERMISSIONS}(action="getResourcePermission")\` and \`${MANAGE_PERMISSIONS}(action="updateResourcePermission")\`, and include the required _openid column in newly created tables.`
             : "Schema initialization stopped because one statement failed.",
     });
 }
@@ -12255,7 +13435,7 @@ function registerSQLDatabaseTools(server) {
     });
     server.registerTool?.(MANAGE_SQL_DATABASE, {
         title: "Manage SQL database lifecycle or execute write SQL",
-        description: "Manage SQL database resources. Supports MySQL provisioning, MySQL destruction, write SQL/DDL execution, and schema initialization after the instance becomes ready.",
+        description: "Manage SQL database resources. Supports MySQL provisioning, MySQL destruction, write SQL/DDL execution, and schema initialization. IMPORTANT: MySQL must be provisioned first (action=provisionMySQL with confirm=true) before any runStatement or initializeSchema call. If MySQL is not yet provisioned, the tool will return MYSQL_NOT_CREATED with a nextAction to provision first.",
         inputSchema: {
             action: zod_1.z
                 .enum(MANAGE_ACTIONS)