@cloudbase/cloudbase-mcp 2.18.0 → 2.19.5

package/dist/index.js

@@ -161,12 +161,71 @@ function simplifyEnvDomains(domains) {
         }
         const source = domain;
         return {
+            ...(source.Id !== undefined ? { Id: source.Id } : {}),
             ...(source.Domain !== undefined ? { Domain: source.Domain } : {}),
+            ...(source.CreateTime !== undefined ? { CreateTime: source.CreateTime } : {}),
+            ...(source.UpdateTime !== undefined ? { UpdateTime: source.UpdateTime } : {}),
             ...(source.Status !== undefined ? { Status: source.Status } : {}),
             ...(source.Type !== undefined ? { Type: source.Type } : {}),
         };
     });
 }
+function buildEnvDomainManagementResult(params) {
+    const { action, domains, result } = params;
+    const rawResult = result && typeof result === "object" && !Array.isArray(result)
+        ? result
+        : { result };
+    if (action === "create") {
+        return {
+            ...rawResult,
+            ok: true,
+            code: "DOMAIN_UPDATE_PENDING",
+            operation: action,
+            targetDomains: domains,
+            asyncState: "PENDING",
+            message: '安全域名已提交添加请求。该变更通常需要约 10 分钟传播，请继续轮询 envQuery(action="domains")，直到目标域名状态为 ENABLE。',
+            propagation: {
+                requiresPolling: true,
+                pollTool: "envQuery",
+                pollAction: "domains",
+                pollIntervalSuggestionSeconds: 10,
+                timeoutSuggestionSeconds: 600,
+                successCondition: '目标域名出现在 envQuery(action="domains") 返回中，且 Status 为 ENABLE。',
+            },
+            next_step: {
+                tool: "envQuery",
+                action: "domains",
+                suggested_args: {
+                    action: "domains",
+                },
+            },
+        };
+    }
+    return {
+        ...rawResult,
+        ok: true,
+        code: "DOMAIN_DELETE_PENDING",
+        operation: action,
+        targetDomains: domains,
+        asyncState: "PENDING",
+        message: '安全域名已提交删除请求。该变更可能需要数分钟传播，请继续轮询 envQuery(action="domains")，直到目标域名不再出现。',
+        propagation: {
+            requiresPolling: true,
+            pollTool: "envQuery",
+            pollAction: "domains",
+            pollIntervalSuggestionSeconds: 10,
+            timeoutSuggestionSeconds: 600,
+            successCondition: '目标域名不再出现在 envQuery(action="domains") 返回中。',
+        },
+        next_step: {
+            tool: "envQuery",
+            action: "domains",
+            suggested_args: {
+                action: "domains",
+            },
+        },
+    };
+}
 function formatDeviceAuthHint(deviceAuthInfo) {
     if (!deviceAuthInfo) {
         return "";
@@ -503,6 +562,49 @@ function normalizeOptionalToolString(value) {
         ? value.trim()
         : undefined;
 }
+/**
+ * Build enhanced error message for envQuery tool errors
+ * Provides actionable guidance based on error patterns
+ */
+function buildEnvQueryErrorMessage(error, action) {
+    const baseMessage = error instanceof Error ? error.message : String(error);
+    // Check for common error patterns and provide specific guidance
+    const hasInvalidParameterError = /400|invalid parameter|invalid argument|parameter value/i.test(baseMessage);
+    const hasAuthError = /未登录|auth required|unauthorized|authentication|credential|token|secret/i.test(baseMessage);
+    const hasNetworkError = /ECONNRESET|socket hang up|ETIMEDOUT|ENOTFOUND|timeout/i.test(baseMessage);
+    const hasPermissionError = /permission|denied|forbidden|无权|拒绝/i.test(baseMessage);
+    const hasEnvNotFoundError = /env|environment|环境.*不存在|not found/i.test(baseMessage);
+    const suggestions = [];
+    if (hasInvalidParameterError) {
+        suggestions.push("参数错误：可能是认证信息无效或已过期，请尝试以下步骤：");
+        suggestions.push("1. 先调用 auth(action=\"status\") 检查当前登录状态");
+        suggestions.push("2. 如果未登录，调用 auth(action=\"start_auth\", authMode=\"device\") 完成登录");
+        suggestions.push("3. 登录完成后再次调用 envQuery(action=\"list\")");
+    }
+    if (hasAuthError) {
+        suggestions.push("认证错误：当前未登录或认证已过期。");
+        suggestions.push("建议先执行 auth(action=\"status\") 查看状态，然后按提示完成登录。");
+    }
+    if (hasPermissionError) {
+        suggestions.push("权限错误：当前账号可能没有访问该资源的权限。");
+        suggestions.push("请确认：1) 已选择正确的环境 2) 账号有对应权限");
+    }
+    if (hasEnvNotFoundError) {
+        suggestions.push("环境错误：指定的环境不存在或无法访问。");
+        suggestions.push("请使用 envQuery(action=\"list\") 查看可用的环境列表。");
+    }
+    if (hasNetworkError) {
+        suggestions.push("网络错误：请检查网络连接，稍后重试。");
+    }
+    // If no specific pattern matched, provide general guidance
+    if (suggestions.length === 0) {
+        suggestions.push("查询环境信息时出错，建议：");
+        suggestions.push("1. 先调用 auth(action=\"status\") 确认登录状态");
+        suggestions.push("2. 如未登录，执行 auth(action=\"start_auth\") 完成认证");
+        suggestions.push("3. 确认环境 ID 正确且可访问");
+    }
+    return `[envQuery/${action}] 调用失败: ${baseMessage}\n\n解决建议：\n${suggestions.join("\n")}`;
+}
 function normalizeOptionalToolBoolean(value) {
     return typeof value === "boolean" ? value : undefined;
 }
@@ -967,17 +1069,17 @@ function registerEnvTools(server) {
             });
         }
     });
-    // envQuery - 环境查询（合并 listEnvs + getEnvInfo + getEnvAuthDomains + getWebsiteConfig）
+    // envQuery - 环境查询（合并 listEnvs + getEnvInfo + getEnvAuthDomains）
     server.registerTool?.("envQuery", {
         title: "环境查询",
-        description: "查询云开发环境相关信息，支持查询环境列表、当前环境信息、安全域名和静态网站托管配置。（原工具名：listEnvs/getEnvInfo/getEnvAuthDomains/getWebsiteConfig，为兼容旧AI规则可继续使用这些名称）当 action=list 时，标准返回字段为 EnvId、Alias、Status、EnvType、Region、PackageId、PackageName、IsDefault，并支持通过 fields 白名单裁剪这些字段；aliasExact=true 时会按别名精确筛选，避免把前缀相近的环境误当作候选；即使传入 envId，action=list 也只返回摘要，不会返回完整资源明细或 expiry。如需查询某个已知环境的详细信息，请使用 action=info。action=info 会在可用时补充 BillingInfo（如 ExpireTime、PayMode、IsAutoRenew 等计费字段）。",
+        description: "查询云开发环境相关信息，支持查询环境列表、指定环境详情和安全域名。（原工具名：listEnvs/getEnvInfo/getEnvAuthDomains，为兼容旧AI规则可继续使用这些名称）当 action=list 时，会按 DescribeEnvs 语义做列表/筛选，标准返回字段为 EnvId、Alias、Status、EnvType、Region、PackageId、PackageName、IsDefault，并支持通过 fields 白名单裁剪这些字段；aliasExact=true 时会按别名精确筛选，避免把前缀相近的环境误当作候选；即使传入 envId，action=list 也只返回摘要，不会返回完整资源明细或 expiry。如需查询某个已知 EnvId 对应环境的详细信息（包括资源字段和计费信息），必须使用 action=info 并传入目标环境的 envId 参数。action=info 会在可用时补充 BillingInfo（如 ExpireTime、PayMode、IsAutoRenew 等计费字段）。",
         inputSchema: {
             action: zod_1.z
-                .enum(["list", "info", "domains", "hosting"])
-                .describe("查询类型：list=环境列表/摘要筛选（即使传 envId 也只返回 EnvId、Alias、Status、EnvType、Region、PackageId、PackageName、IsDefault，不支持 expiry），info=当前环境详细信息（详情中可查看更完整资源字段），domains=安全域名列表，hosting=静态网站托管配置"),
+                .enum(["list", "info", "domains"])
+                .describe("查询类型：list=环境列表/摘要筛选（按 DescribeEnvs 语义筛选，支持通过 envId 筛选，返回 EnvId、Alias、Status、EnvType、Region、PackageId、PackageName、IsDefault，不支持 expiry），info=指定环境的详细信息（必须传入 envId，返回资源字段和计费信息），domains=安全域名列表"),
             alias: zod_1.z.string().optional().describe("按环境别名筛选。action=list 时可选"),
             aliasExact: zod_1.z.boolean().optional().describe("按环境别名精确筛选。action=list 时可选；与 alias 配合使用"),
-            envId: zod_1.z.string().optional().describe("按环境 ID 精确筛选。action=list 时可选；注意 list + envId 仍只返回摘要，如需该环境详情请改用 action=info"),
+            envId: zod_1.z.string().optional().describe("按环境 ID 筛选。action=list 时可选（仅按 DescribeEnvs 语义做筛选，仍返回摘要）；action=info 时必填（返回该环境的详细信息，包含资源字段和计费信息）。如果任务已经给出了明确的 EnvId 并要求查询详情，请直接使用 action=info + envId，而不是 action=list"),
             limit: zod_1.z.number().int().positive().optional().describe("返回数量上限。action=list 时可选"),
             offset: zod_1.z.number().int().min(0).optional().describe("分页偏移。action=list 时可选"),
             fields: zod_1.z
@@ -1044,14 +1146,12 @@ function registerEnvTools(server) {
                                 return toolPayloadResult;
                             }
                             (0, logger_js_1.debug)("降级到 listEnvs() 也失败:", fallbackError instanceof Error ? fallbackError : new Error(String(fallbackError)));
+                            const enhancedMessage = buildEnvQueryErrorMessage(fallbackError, "list");
                             return {
                                 content: [
                                     {
                                         type: "text",
-                                        text: "获取环境列表时出错: " +
-                                            (fallbackError instanceof Error
-                                                ? fallbackError.message
-                                                : String(fallbackError)),
+                                        text: enhancedMessage,
                                     },
                                 ],
                             };
@@ -1116,29 +1216,6 @@ function registerEnvTools(server) {
                         };
                     }
                     break;
-                case "hosting": {
-                    const cloudbaseHosting = await getManager();
-                    const websiteConfig = await cloudbaseHosting.hosting.getWebsiteConfig();
-                    (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, websiteConfig);
-                    const hostingResult = {
-                        ...websiteConfig,
-                        CdnDomain: websiteConfig.CdnDomain ?? null,
-                        Bucket: websiteConfig.Bucket ?? null,
-                    };
-                    try {
-                        const envInfo = await cloudbaseHosting.env.getEnvInfo();
-                        (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, envInfo);
-                        hostingResult.CdnDomain = envInfo.EnvInfo?.StaticStorages?.[0]?.StaticDomain ?? hostingResult.CdnDomain;
-                        hostingResult.Bucket = envInfo.EnvInfo?.StaticStorages?.[0]?.Bucket ?? hostingResult.Bucket;
-                    }
-                    catch (hostingInfoError) {
-                        (0, logger_js_1.debug)("Failed to enrich hosting envQuery result with env info", {
-                            error: hostingInfoError,
-                        });
-                    }
-                    result = hostingResult;
-                    break;
-                }
                 default:
                     throw new Error(`不支持的查询类型: ${action}`);
             }
@@ -1157,11 +1234,12 @@ function registerEnvTools(server) {
             if (toolPayloadResult) {
                 return toolPayloadResult;
             }
+            const enhancedMessage = buildEnvQueryErrorMessage(error, action);
             return {
                 content: [
                     {
                         type: "text",
-                        text: `环境查询失败: ${error instanceof Error ? error.message : String(error)}`,
+                        text: enhancedMessage,
                     },
                 ],
             };
@@ -1169,13 +1247,13 @@ function registerEnvTools(server) {
     });
     // envDomainManagement - 环境域名管理（合并 createEnvDomain + deleteEnvDomain）
     server.registerTool?.("envDomainManagement", {
-        title: "环境域名管理",
-        description: "管理云开发环境的安全域名，支持添加和删除操作。（原工具名：createEnvDomain/deleteEnvDomain，为兼容旧AI规则可继续使用这些名称）当浏览器 Web 应用需要从本地 Vite / dev server 或自定义域名直接访问 CloudBase 资源时，应先用 envQuery(action=domains) 检查当前实际浏览器 origin 对应的 host:port 是否已在白名单中，再按该实际值添加。",
+        title: "环境域名管理（安全域名 / CORS 白名单）",
+        description: "管理云开发环境的安全域名（安全域名 / CORS 白名单），支持添加和删除操作。（原工具名：createEnvDomain/deleteEnvDomain，为兼容旧AI规则可继续使用这些名称）当浏览器 Web 应用需要从本地 Vite / dev server 直接访问 CloudBase 资源时，应先用 envQuery(action=domains) 检查当前实际浏览器 origin 对应的 host:port 是否已在白名单中，再按该实际值添加。新增或删除后通常需要继续轮询 envQuery(action=domains) 确认状态收敛；安全域名一般约 10 分钟生效。⚠️ 重要：此工具仅用于 CORS/请求来源验证，不涉及 SSL 证书。如需绑定自定义域名供公网 HTTPS 访问，请使用 manageGateway(action=\"bindCustomDomain\")。",
         inputSchema: {
             action: zod_1.z
                 .enum(["create", "delete"])
-                .describe("操作类型：create=添加域名，delete=删除域名"),
-            domains: zod_1.z.array(zod_1.z.string()).describe("安全域名数组"),
+                .describe("操作类型：create=添加安全域名，delete=删除安全域名"),
+            domains: zod_1.z.array(zod_1.z.string()).describe("安全域名数组（格式：host:port，例如 localhost:5173 或 127.0.0.1:4173）。注意：不是自定义域名，不需要证书。"),
         },
         annotations: {
             readOnlyHint: false,
@@ -1200,14 +1278,11 @@ function registerEnvTools(server) {
                 default:
                     throw new Error(`不支持的操作类型: ${action}`);
             }
-            return {
-                content: [
-                    {
-                        type: "text",
-                        text: `${JSON.stringify(result, null, 2)}\n\n请注意安全域名需要10分钟才能生效，用户也应该了解这一点。`,
-                    },
-                ],
-            };
+            return (0, tool_result_js_1.buildJsonToolResult)(buildEnvDomainManagementResult({
+                action,
+                domains,
+                result,
+            }));
         }
         catch (error) {
             const toolPayloadResult = (0, tool_result_js_1.toolPayloadErrorToResult)(error);
@@ -1324,6 +1399,7 @@ function buildCapiErrorMessage(service, action, error) {
     const tcbEntry = service === "tcb" ? findTcbActionEntry(action) : undefined;
     const hasInvalidActionError = /invalid or not found|does not exist|not recognized/i.test(baseMessage);
     const hasParameterError = /parameter\s+`?.+?`?\s+is not recognized|MissingParameter|missing parameter|missing required/i.test(baseMessage);
+    const hasInvalidParameterValueError = /invalid parameter value/i.test(baseMessage);
     if (hasInvalidActionError) {
         suggestions.push(`Action \`${action}\` 可能不存在或不对外开放。请不要继续猜测 Action 名称，先确认 service=\`${service}\` 下该 Action 在当前 API 版本是否真实存在。`);
         if (service === "tcb") {
@@ -1354,6 +1430,20 @@ function buildCapiErrorMessage(service, action, error) {
             }
         }
     }
+    if (hasInvalidParameterValueError) {
+        suggestions.push("请求参数值格式不正确或超出有效范围。请检查：");
+        suggestions.push("1. 字符串参数是否为空或包含非法字符");
+        suggestions.push("2. 数值参数是否在允许范围内");
+        suggestions.push("3. 枚举值是否使用了正确的取值（区分大小写）");
+        suggestions.push("4. 必填参数是否有值");
+        if (service === "tcb" && tcbEntry) {
+            const paramsTypeHint = formatTcbParamsTypeHint(tcbEntry.action);
+            if (paramsTypeHint) {
+                suggestions.push("参数类型参考：");
+                suggestions.push(paramsTypeHint);
+            }
+        }
+    }
     if (/ECONNRESET|socket hang up|ETIMEDOUT|ENOTFOUND/i.test(baseMessage)) {
         suggestions.push("网络请求异常，建议稍后重试，并检查本地网络/代理设置。");
     }
@@ -1532,7 +1622,7 @@ ${envIdSection}
 ## 环境信息
 - 操作系统: ${os_1.default.type()} ${os_1.default.release()}
 - Node.js版本: ${process.version}
-- MCP 版本：${process.env.npm_package_version || "2.18.0" || 0}
+- MCP 版本：${process.env.npm_package_version || "2.19.5" || 0}
 - 系统架构: ${os_1.default.arch()}
 - 时间: ${new Date().toISOString()}
 - 请求ID: ${requestId}
@@ -1612,7 +1702,8 @@ function createWrappedHandler(name, handler, server) {
                 requestId: (typeof error === 'object' && error && 'requestId' in error) ? error.requestId : '',
                 ide: server.ide || process.env.INTEGRATION_IDE || ''
             });
-            const enhancedErrorMessage = `${errorMessage}\n\n🔗 遇到问题？请复制以下链接到浏览器打开\n即可自动携带错误详情快速创建 GitHub Issue：\n${issueLink}`;
+            const mcpVersion =  true ? "2.19.5" : 0;
+            const enhancedErrorMessage = `${errorMessage}\n\n📦 CloudBase MCP v${mcpVersion}\n🔗 遇到问题？请复制以下链接到浏览器打开\n即可自动携带错误详情快速创建 GitHub Issue：\n${issueLink}`;
             // 创建新的错误对象，保持原有的错误类型但更新消息
             const enhancedError = error instanceof Error
                 ? new Error(enhancedErrorMessage)
@@ -1799,6 +1890,7 @@ const DEFAULT_PLUGINS = [
     "cloudrun",
     "gateway",
     "app-auth",
+    "apps",
     "permissions",
     "logs",
     "agents",
@@ -1928,7 +2020,9 @@ async function createCloudBaseMcpServer(options) {
         }
         catch (error) {
             if ((0, tool_result_js_1.isToolPayloadError)(error)) {
-                return (0, tool_result_js_1.buildJsonToolResult)(error.payload);
+                // 在结构化错误返回中注入 MCP 版本号
+                const payload = { ...error.payload, mcpVersion: version };
+                return (0, tool_result_js_1.buildJsonToolResult)(payload);
             }
             throw error;
         }
@@ -2055,16 +2149,59 @@ function registerLogTools(server) {
     const getManager = () => (0, cloudbase_manager_js_1.getCloudBaseManager)({ cloudBaseOptions });
     server.registerTool?.("queryLogs", {
         title: "查询日志服务",
-        description: "日志域统一只读入口。支持检查日志服务状态并搜索 CLS 日志。",
+        description: "日志域统一只读入口。支持检查日志服务状态并搜索 CLS 日志。" +
+            "\n\n**重要区分**：" +
+            "\n- 查询云函数日志：使用 `queryFunctions(action=\"listFunctionLogs\", functionName=\"xxx\")`" +
+            "\n- 查询 CLS 日志（跨服务日志聚合）：使用本工具 `queryLogs(action=\"searchLogs\")`" +
+            "\n\n**适用场景**：" +
+            "\n- 检查 CLS 日志服务是否开通：`action=\"checkLogService\"`" +
+            "\n- 跨服务日志搜索（如搜索所有 ERROR 日志）：`action=\"searchLogs\"`" +
+            "\n- 按 CLS 语法检索特定服务的日志：`action=\"searchLogs\", service=\"tcb|tcbr\"`",
         inputSchema: {
-            action: zod_1.z.enum(QUERY_LOG_ACTIONS),
-            queryString: zod_1.z.string().optional(),
-            service: zod_1.z.enum(["tcb", "tcbr"]).optional(),
-            startTime: zod_1.z.string().optional(),
-            endTime: zod_1.z.string().optional(),
-            limit: zod_1.z.number().optional(),
-            context: zod_1.z.string().optional(),
-            sort: zod_1.z.enum(["asc", "desc"]).optional(),
+            action: zod_1.z
+                .enum(QUERY_LOG_ACTIONS)
+                .describe("操作类型：" +
+                "\n- `checkLogService`: 检查 CLS 日志服务是否开通" +
+                "\n- `searchLogs`: 搜索 CLS 日志（需要提供 queryString）"),
+            queryString: zod_1.z
+                .string()
+                .optional()
+                .describe("CLS 查询语句，**action=\"searchLogs\" 时必填**，需严格遵循 CLS（Cloud Log Service）语法规范，详见 https://cloud.tencent.com/document/api/876/128127" +
+                "\n\n**云函数相关查询**：" +
+                "\n- 云函数日志：`(src:app OR src:system) AND log:\"START RequestId\"`" +
+                "\n- 聚合云函数请求状态：`| select request_id, max(status_code) as status where ((request_id='44738f94-16dd-11f1-****' AND retry_num=0) AND retry_num=0) AND status_code!=202 group by request_id, retry_num`" +
+                "\n\n**云数据库 / 文档型**：" +
+                "\n- 云数据库（文档型）：`module:database`" +
+                "\n- 云数据库（文档型）事件：`module:database AND eventType:(MongoSlowQuery)`（MongoSlowQuery 为文档型数据库慢查询事件）" +
+                "\n\n**云数据库 / SQL 型**：" +
+                "\n- 云数据库（SQL 型）：`module:rdb`" +
+                "\n- 云数据库（SQL 型）事件：`module:rdb AND eventType:(MysqlFreeze OR MysqlRecover OR MysqlSlowQuery)`（MysqlFreeze 冻结、MysqlRecover 恢复、MysqlSlowQuery 慢查询）" +
+                "\n\n**其它服务**：" +
+                "\n- 审批流：`module:workflow`" +
+                "\n- 模型：`module:model`" +
+                "\n- 用户权限：`module:auth`" +
+                "\n- 大模型：`module:llm AND logType:llm-tracelog`" +
+                "\n- 网关服务调用：`logType:accesslog`" +
+                "\n- 应用发布/删除事件：`module:app AND eventType:(AppProdPub OR AppProdDel)`（AppProdPub 发布事件、AppProdDel 删除事件）" +
+                "\n\n以上仅为示例，实际使用时请根据具体日志内容调整。" +
+                "\n\n**注意**：查询特定云函数的执行日志时，优先使用 `queryFunctions(action=\"listFunctionLogs\", functionName=\"xxx\")`。"),
+            service: zod_1.z
+                .enum(["tcb", "tcbr"])
+                .optional()
+                .describe("日志来源服务：" +
+                "\n- `tcb`: 云函数、数据库、存储等基础服务日志" +
+                "\n- `tcbr`: CloudRun 容器服务日志"),
+            startTime: zod_1.z
+                .string()
+                .optional()
+                .describe("查询开始时间，格式：`YYYY-MM-DD HH:mm:ss`，如 `2024-01-01 00:00:00`"),
+            endTime: zod_1.z
+                .string()
+                .optional()
+                .describe("查询结束时间，格式：`YYYY-MM-DD HH:mm:ss`，如 `2024-01-01 23:59:59`"),
+            limit: zod_1.z.number().optional().describe("返回日志条数限制，默认 20"),
+            context: zod_1.z.string().optional().describe("翻页上下文，用于继续上一次查询"),
+            sort: zod_1.z.enum(["asc", "desc"]).optional().describe("按时间排序：`asc` 升序，`desc` 降序"),
         },
         annotations: {
             readOnlyHint: true,
@@ -2082,7 +2219,14 @@ function registerLogTools(server) {
                 }, enabled ? "日志服务已开通" : "日志服务未开通或仍在初始化中"));
             }
             if (!queryString) {
-                throw new Error("action=searchLogs 时必须提供 queryString");
+                throw new Error("action=\"searchLogs\" 时必须提供 queryString 参数（CLS 查询语句，需遵循 CLS 语法规范，参考 https://cloud.tencent.com/document/api/876/128127）。" +
+                    "\n\n常用查询示例：" +
+                    "\n- 云函数日志：`(src:app OR src:system) AND log:\"START RequestId\"`" +
+                    "\n- 文档型数据库：`module:database`" +
+                    "\n- SQL 型数据库：`module:rdb`" +
+                    "\n- 网关访问日志：`logType:accesslog`" +
+                    "\n- 大模型 trace 日志：`module:llm AND logType:llm-tracelog`" +
+                    "\n\n如果需要查询特定云函数的执行日志，建议使用 `queryFunctions(action=\"listFunctionLogs\", functionName=\"xxx\")`。");
             }
             const result = await cloudbase.log.searchClsLog({
                 queryString,
@@ -3552,20 +3696,9 @@ async function getCloudBaseManager(options = {}) {
         }
         // envId priority: explicit option > envManager cache > loginState.envId
         const resolvedEnvId = finalEnvId || loginEnvId;
-        let region = fallbackRegion;
-        if (resolvedEnvId && !cloudBaseOptions?.region) {
-            try {
-                const envCandidates = await listAvailableEnvCandidates({ loginState });
-                const matchedEnv = envCandidates.find((candidate) => candidate.envId === resolvedEnvId);
-                if (matchedEnv?.region) {
-                    region = matchedEnv.region;
-                    (0, logger_js_1.debug)('使用环境实际 region:', { envId: resolvedEnvId, region });
-                }
-            }
-            catch {
-                (0, logger_js_1.debug)('无法获取环境列表，使用 fallback region');
-            }
-        }
+        // region 直接使用 fallbackRegion（来自 cloudBaseOptions?.region ?? TCB_REGION ?? 'ap-shanghai'）
+        // 不再通过 DescribeEnvs 查询 region，以兼容 STS 临时密钥场景
+        const region = fallbackRegion;
         const manager = new manager_node_1.default({
             secretId,
             secretKey,
@@ -3771,13 +3904,8 @@ async function resolveNoSqlInstanceId(options) {
     return resolved;
 }
 async function callNoSqlContentApi(options) {
-    const resolvedInstance = await resolveNoSqlInstanceId({
-        toolName: options.toolName,
-        cloudbase: options.cloudbase,
-        cloudBaseOptions: options.cloudBaseOptions,
-        instanceIdOverride: options.instanceIdOverride,
-        collectionName: options.collectionName,
-    });
+    // 直接使用 EnvId 替代 Tag，无需通过 DescribeEnvs 获取 instanceId
+    const envId = await (0, cloudbase_manager_js_1.getEnvId)(options.cloudBaseOptions);
     const startedAt = Date.now();
     try {
         const result = await options.cloudbase
@@ -3787,14 +3915,14 @@ async function callNoSqlContentApi(options) {
             Param: {
                 ...options.param,
                 TableName: options.collectionName,
-                Tag: resolvedInstance.instanceId,
+                EnvId: envId,
             },
         });
         logNoSqlLatency(options.toolName, "cloudApiCall", {
             collectionName: options.collectionName,
             action: options.action,
             durationMs: Date.now() - startedAt,
-            instanceIdSource: resolvedInstance.source,
+            instanceIdSource: "envId",
             requestId: result?.RequestId,
         });
         return result;
@@ -3804,20 +3932,9 @@ async function callNoSqlContentApi(options) {
             collectionName: options.collectionName,
             action: options.action,
             durationMs: Date.now() - startedAt,
-            instanceIdSource: resolvedInstance.source,
+            instanceIdSource: "envId",
             message: error instanceof Error ? error.message : String(error),
         });
-        if (!options.instanceIdOverride &&
-            resolvedInstance.cacheKey &&
-            isInvalidInstanceIdError(error)) {
-            (0, cloudbase_manager_js_1.invalidateDatabaseInstanceIdCache)({
-                cacheKey: resolvedInstance.cacheKey,
-            });
-            logNoSqlLatency(options.toolName, "invalidateInstanceIdCache", {
-                collectionName: options.collectionName,
-                cacheKey: resolvedInstance.cacheKey,
-            });
-        }
         throw error;
     }
 }
@@ -3835,18 +3952,25 @@ async function waitForCollectionReady({ cloudbase, collectionName, logger, timeo
     });
     while (Date.now() <= deadline) {
         try {
-            const result = await cloudbase.database.checkCollectionExists(collectionName);
+            // 直接用 commonService 调用 DescribeTable 检查集合是否存在，避免 SDK lazyInit → DescribeEnvs
+            const envId = await (0, cloudbase_manager_js_1.getEnvId)();
+            const result = await cloudbase.commonService("tcb", "2018-06-08").call({
+                Action: "DescribeTable",
+                Param: {
+                    EnvId: envId,
+                    TableName: collectionName,
+                },
+            });
             (0, cloudbase_manager_js_1.logCloudBaseResult)(logger, result);
-            if (result.Exists) {
-                logger?.({
-                    type: "toolInfo",
-                    toolName: "writeNoSqlDatabaseStructure",
-                    message: "NoSQL collection is ready for subsequent operations",
-                    collectionName,
-                    waitedMs: Date.now() - startedAt,
-                });
-                return;
-            }
+            // DescribeTable 成功返回即表示集合存在
+            logger?.({
+                type: "toolInfo",
+                toolName: "writeNoSqlDatabaseStructure",
+                message: "NoSQL collection is ready for subsequent operations",
+                collectionName,
+                waitedMs: Date.now() - startedAt,
+            });
+            return;
         }
         catch (error) {
             lastError = error;
@@ -3878,7 +4002,7 @@ function registerDatabaseTools(server) {
     // readNoSqlDatabaseStructure
     server.registerTool?.("readNoSqlDatabaseStructure", {
         title: "读取 NoSQL 数据库结构",
-        description: "读取 NoSQL 数据库集合与索引结构，支持列出集合、查看集合详情、列出索引以及检查索引是否存在。",
+        description: "读取 NoSQL 数据库集合与索引结构，支持列出集合、查看集合详情、列出索引以及检查索引是否存在。本工具为服务端管理工具，用于管理端查询数据库结构，不用于编写客户端代码。",
         inputSchema: {
             action: zod_1.z.enum([
                 "listCollections",
@@ -3916,9 +4040,14 @@ checkIndex: 检查指定索引是否存在`),
     }, async ({ action, limit, offset, collectionName, indexName }) => {
         const cloudbase = await getManager();
         if (action === "listCollections") {
-            const result = await cloudbase.database.listCollections({
-                MgoOffset: offset,
-                MgoLimit: limit,
+            const envId = await (0, cloudbase_manager_js_1.getEnvId)(server.cloudBaseOptions);
+            const result = await cloudbase.commonService("tcb", "2018-06-08").call({
+                Action: "ListTables",
+                Param: {
+                    EnvId: envId,
+                    MgoOffset: offset ?? 0,
+                    MgoLimit: limit ?? 100,
+                },
             });
             (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
             return {
@@ -3928,7 +4057,7 @@ checkIndex: 检查指定索引是否存在`),
                         text: JSON.stringify({
                             success: true,
                             requestId: result.RequestId,
-                            collections: result.Collections,
+                            collections: result.Tables,
                             pager: result.Pager,
                             message: "获取 NoSQL 数据库集合列表成功",
                         }, null, 2),
@@ -3940,17 +4069,30 @@ checkIndex: 检查指定索引是否存在`),
             if (!collectionName) {
                 throw new Error("检查集合时必须提供 collectionName");
             }
-            const result = await cloudbase.database.checkCollectionExists(collectionName);
-            (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+            const envId = await (0, cloudbase_manager_js_1.getEnvId)(server.cloudBaseOptions);
+            let exists = false;
+            let requestId = "";
+            try {
+                const result = await cloudbase.commonService("tcb", "2018-06-08").call({
+                    Action: "DescribeTable",
+                    Param: { EnvId: envId, TableName: collectionName },
+                });
+                exists = true;
+                requestId = result?.RequestId ?? "";
+            }
+            catch (e) {
+                // DescribeTable 失败即集合不存在
+                requestId = e?.requestId ?? "";
+            }
             return {
                 content: [
                     {
                         type: "text",
                         text: JSON.stringify(withCollectionName(collectionName, {
                             success: true,
-                            exists: result.Exists,
-                            requestId: result.RequestId,
-                            message: result.Exists
+                            exists,
+                            requestId,
+                            message: exists
                                 ? "云开发数据库集合已存在"
                                 : "云开发数据库集合不存在",
                         }), null, 2),
@@ -3962,7 +4104,11 @@ checkIndex: 检查指定索引是否存在`),
             if (!collectionName) {
                 throw new Error("查看集合详情时必须提供 collectionName");
             }
-            const result = await cloudbase.database.describeCollection(collectionName);
+            const envId = await (0, cloudbase_manager_js_1.getEnvId)(server.cloudBaseOptions);
+            const result = await cloudbase.commonService("tcb", "2018-06-08").call({
+                Action: "DescribeTable",
+                Param: { EnvId: envId, TableName: collectionName },
+            });
             (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
             return {
                 content: [
@@ -3983,7 +4129,11 @@ checkIndex: 检查指定索引是否存在`),
             if (!collectionName) {
                 throw new Error("获取索引列表时必须提供 collectionName");
             }
-            const result = await cloudbase.database.describeCollection(collectionName);
+            const envId = await (0, cloudbase_manager_js_1.getEnvId)(server.cloudBaseOptions);
+            const result = await cloudbase.commonService("tcb", "2018-06-08").call({
+                Action: "DescribeTable",
+                Param: { EnvId: envId, TableName: collectionName },
+            });
             (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
             return {
                 content: [
@@ -4004,8 +4154,22 @@ checkIndex: 检查指定索引是否存在`),
             if (!collectionName || !indexName) {
                 throw new Error("检查索引时必须提供 collectionName 和 indexName");
             }
-            const result = await cloudbase.database.checkIndexExists(collectionName, indexName);
-            (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+            const envId = await (0, cloudbase_manager_js_1.getEnvId)(server.cloudBaseOptions);
+            let exists = false;
+            let requestId = "";
+            try {
+                const result = await cloudbase.commonService("tcb", "2018-06-08").call({
+                    Action: "DescribeTable",
+                    Param: { EnvId: envId, TableName: collectionName },
+                });
+                requestId = result?.RequestId ?? "";
+                const indexes = result?.Indexes ?? result?.IndexNum ? result?.Indexes : [];
+                exists = Array.isArray(indexes) && indexes.some((idx) => idx.IndexName === indexName);
+            }
+            catch (e) {
+                requestId = e?.requestId ?? "";
+            }
+            (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, { RequestId: requestId });
             return {
                 content: [
                     {
@@ -4013,9 +4177,9 @@ checkIndex: 检查指定索引是否存在`),
                         text: JSON.stringify(withCollectionName(collectionName, {
                             success: true,
                             indexName,
-                            exists: result.Exists,
-                            requestId: result.RequestId,
-                            message: result.Exists ? "索引已存在" : "索引不存在",
+                            exists,
+                            requestId,
+                            message: exists ? "索引已存在" : "索引不存在",
                         }), null, 2),
                     },
                 ],
@@ -4025,8 +4189,8 @@ checkIndex: 检查指定索引是否存在`),
     });
     // writeNoSqlDatabaseStructure
     server.registerTool?.("writeNoSqlDatabaseStructure", {
-        title: "修改 NoSQL 数据库结构",
-        description: "修改 NoSQL 数据库结构，支持创建/删除集合，以及通过 updateCollection 的 updateOptions.CreateIndexes / updateOptions.DropIndexes 添加索引和删除索引。",
+        title: "创建并管理 NoSQL 数据库集合",
+        description: "创建、删除和管理 NoSQL 数据库集合（collection）。支持创建新集合、删除现有集合，以及通过 updateCollection 的 updateOptions.CreateIndexes / updateOptions.DropIndexes 添加索引和删除索引。当需要新建集合时，使用 action=createCollection。本工具为服务端管理工具，用于管理端操作集合和索引结构，不用于编写客户端代码。",
         inputSchema: {
             action: zod_1.z.enum([
                 "createCollection",
@@ -4073,9 +4237,22 @@ deleteCollection: 删除集合`),
     }, async ({ action, collectionName, updateOptions }) => {
         const cloudbase = await getManager();
         if (action === "createCollection") {
-            const existsResult = await cloudbase.database.checkCollectionExists(collectionName);
-            (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, existsResult);
-            if (existsResult.Exists) {
+            // 检查集合是否存在 - 使用 commonService 避免 SDK lazyInit → DescribeEnvs
+            const envId = await (0, cloudbase_manager_js_1.getEnvId)(server.cloudBaseOptions);
+            let collectionExists = false;
+            let existsRequestId = "";
+            try {
+                const descResult = await cloudbase.commonService("tcb", "2018-06-08").call({
+                    Action: "DescribeTable",
+                    Param: { EnvId: envId, TableName: collectionName },
+                });
+                collectionExists = true;
+                existsRequestId = descResult?.RequestId ?? "";
+            }
+            catch (e) {
+                existsRequestId = e?.requestId ?? "";
+            }
+            if (collectionExists) {
                 return {
                     content: [
                         {
@@ -4083,7 +4260,7 @@ deleteCollection: 删除集合`),
                             text: JSON.stringify(withCollectionName(collectionName, {
                                 success: true,
                                 action,
-                                requestId: existsResult.RequestId,
+                                requestId: existsRequestId,
                                 message: "集合已存在，无需重复创建",
                                 exists: true,
                             }), null, 2),
@@ -4091,7 +4268,13 @@ deleteCollection: 删除集合`),
                     ],
                 };
             }
-            const result = await cloudbase.database.createCollection(collectionName);
+            const result = await cloudbase.commonService("tcb", "2018-06-08").call({
+                Action: "CreateTable",
+                Param: {
+                    EnvId: await (0, cloudbase_manager_js_1.getEnvId)(server.cloudBaseOptions),
+                    TableName: collectionName,
+                },
+            });
             (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
             await waitForCollectionReady({
                 cloudbase,
@@ -4116,7 +4299,14 @@ deleteCollection: 删除集合`),
             if (!updateOptions) {
                 throw new Error("更新集合时必须提供 options");
             }
-            const result = await cloudbase.database.updateCollection(collectionName, updateOptions);
+            const result = await cloudbase.commonService("tcb", "2018-06-08").call({
+                Action: "UpdateTable",
+                Param: {
+                    EnvId: await (0, cloudbase_manager_js_1.getEnvId)(server.cloudBaseOptions),
+                    TableName: collectionName,
+                    ...updateOptions,
+                },
+            });
             (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
             return {
                 content: [
@@ -4133,7 +4323,13 @@ deleteCollection: 删除集合`),
             };
         }
         if (action === "deleteCollection") {
-            const result = await cloudbase.database.deleteCollection(collectionName);
+            const result = await cloudbase.commonService("tcb", "2018-06-08").call({
+                Action: "DeleteTable",
+                Param: {
+                    EnvId: await (0, cloudbase_manager_js_1.getEnvId)(server.cloudBaseOptions),
+                    TableName: collectionName,
+                },
+            });
             (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
             const body = withCollectionName(collectionName, {
                 success: true,
@@ -4158,7 +4354,7 @@ deleteCollection: 删除集合`),
     // readNoSqlDatabaseContent
     server.registerTool?.("readNoSqlDatabaseContent", {
         title: "查询并获取 NoSQL 数据库数据记录",
-        description: "查询并获取 NoSQL 数据库数据记录",
+        description: "查询并获取 NoSQL 数据库数据记录。⚠️ 本工具为服务端管理工具，用于管理端/运维端查询。当任务要求编写客户端应用代码时（例如「用 JS SDK 读取数据」），不应使用本工具，而应在项目代码中编写 @cloudbase/js-sdk 客户端代码（如 db.collection().where().get()）。",
         inputSchema: {
             collectionName: zod_1.z.string().describe("集合名称"),
             instanceId: zod_1.z
@@ -4245,7 +4441,7 @@ deleteCollection: 删除集合`),
     // writeNoSqlDatabaseContent
     server.registerTool?.("writeNoSqlDatabaseContent", {
         title: "修改 NoSQL 数据库数据记录",
-        description: "修改 NoSQL 数据库数据记录。可按 MongoDB updateOne/updateMany 的心智模型理解：部分更新必须使用 `$set`、`$inc`、`$push` 等更新操作符；如果直接传“字段到值的普通对象”这类内容，底层会把它当作替换内容，存在覆盖整条文档的风险。更新嵌套对象中的某个字段时必须使用点号路径，例如把 `address.city` 设为 `shenzhen`；如果把整个 `address` 对象作为 `$set` 的值传入，则整个 `address` 对象会被替换，同级其他字段将丢失。若集合中的角色/档案文档会在前端通过 `db.collection(...).doc(uid)` 读取，请确保文档 `_id` 就是该 `uid`；不要用按 `uid` 条件查询再配合 `upsert=true` 的方式去更新 `users` / `profiles`，否则经常会生成一个不同的 `_id`，导致后续 `doc(uid)` 读取命中不到。",
+        description: "修改 NoSQL 数据库数据记录。⚠️ 本工具为服务端管理工具，用于管理端/运维端操作（如后台脚本、数据迁移、批量修改）。当任务要求编写客户端应用代码时（例如「用 JS SDK 登录并插入数据」、「在前端读写数据库」），不应使用本工具，而应在项目代码中编写 @cloudbase/js-sdk 客户端代码（如 app.database().collection().add()、db.collection().where().get() 等）。可按 MongoDB updateOne/updateMany 的心智模型理解：部分更新必须使用 `$set`、`$inc`、`$push` 等更新操作符；如果直接传「字段到值的普通对象」这类内容，底层会把它当作替换内容，存在覆盖整条文档的风险。⚠️ 嵌套对象部分更新务必使用点号路径：要更新 `shipping.city`，应传 `$set: {\"shipping.city\": \"guangzhou\"}`，绝不能传 `$set: {\"shipping\": {\"city\": \"guangzhou\"}}`（后者会丢失 shipping 下的其他字段）。若集合中的角色/档案文档会在前端通过 `db.collection(...).doc(uid)` 读取，请确保文档 `_id` 就是该 `uid`；不要用按 `uid` 条件查询再配合 `upsert=true` 的方式去更新 `users` / `profiles`，否则经常会生成一个不同的 `_id`，导致后续 `doc(uid)` 读取命中不到。",
         inputSchema: {
             action: zod_1.z
                 .enum(["insert", "update", "delete"])
@@ -4266,7 +4462,11 @@ deleteCollection: 删除集合`),
             update: zod_1.z
                 .union([zod_1.z.object({}).passthrough(), zod_1.z.string()])
                 .optional()
-                .describe("更新内容(对象或字符串,推荐对象)(update 操作必填)。按 MongoDB 更新语义传入 MgoUpdate：部分更新请使用 `$set`、`$inc`、`$unset`、`$push` 等操作符，例如使用 `$set` 更新 `status`；不要直接传“字段到值的普通对象”，否则可能替换整条文档。更新嵌套字段时必须使用点号路径，例如通过 `$set` 更新 `address.city`；不要把整个 `address` 对象作为 `$set` 的值传入，否则会替换整个 `address` 对象。"),
+                .describe(`更新内容(对象或字符串,推荐对象)(update 操作必填)。按 MongoDB 更新语义传入 MgoUpdate：部分更新请使用 \`$set\`、\`$inc\`、\`$unset\`、\`$push\` 等操作符，例如使用 \`$set\` 更新 \`status\`；不要直接传"字段到值的普通对象"，否则可能替换整条文档。
+
+⚠️ 嵌套字段必须用点号路径（如 \`shipping.city\`），禁止整对象替换：
+- ❌ 错误：{ "$set": { "shipping": { "city": "guangzhou" } } } — shipping 被整块替换，原有 address/province 等字段全部丢失
+- ✅ 正确：{ "$set": { "shipping.city": "guangzhou" } } — 仅更新 city，shipping 下其他字段保留`),
             isMulti: zod_1.z
                 .boolean()
                 .optional()
@@ -5729,11 +5929,24 @@ function requireStringParam(value, fieldName, action) {
     }
     return value.trim();
 }
+function buildOptionalStringEnum(values, description) {
+    const uniqueValues = [...new Set(values.filter((value) => value.trim()))];
+    if (uniqueValues.length > 0) {
+        return zod_1.z
+            .enum(uniqueValues)
+            .optional()
+            .describe(description);
+    }
+    return zod_1.z
+        .string()
+        .optional()
+        .describe(`${description} 当前暂时无法枚举可选值；如需查看当前可用项，可直接传入字符串，工具会在执行时返回可用列表。`);
+}
 // OpenAPI 文档 URL 列表
 const OPENAPI_SOURCES = [
     {
         name: "mysqldb",
-        description: "MySQL RESTful API - 云开发 MySQL 数据库 HTTP API",
+        description: "关系型数据库 RESTful API (MySQL/PostgreSQL) - 云开发关系型数据库 HTTP API",
         url: "https://docs.cloudbase.net/openapi/mysqldb.v1.openapi.yaml",
     },
     {
@@ -5756,6 +5969,16 @@ const OPENAPI_SOURCES = [
         description: "Storage API - 云存储 HTTP API",
         url: "https://docs.cloudbase.net/openapi/storage.v1.openapi.yaml",
     },
+    {
+        name: "nosql",
+        description: "NoSQL RESTful API - 文档型数据库 HTTP API",
+        url: "https://docs.cloudbase.net/openapi/nosql.v1.openapi.yaml",
+    },
+    {
+        name: "ai_model",
+        description: "AI 大模型接入 API - 统一 AI 模型 HTTP API",
+        url: "https://docs.cloudbase.net/openapi/ai_model.v1.openapi.yaml",
+    },
 ];
 async function downloadWebTemplate() {
     const zipPath = path.join(CACHE_BASE_DIR, "web-cloudbase-project.zip");
@@ -6031,6 +6254,8 @@ async function registerRagTools(server) {
             error,
         });
     }
+    const skillNames = skills.map((skill) => path.basename(path.dirname(skill.absolutePath)));
+    const openapiNames = openapis.map((api) => api.name);
     const getDocsManager = () => (0, cloudbase_manager_js_1.createCloudBaseManagerWithOptions)(server.cloudBaseOptions ?? {})
         ?.docs;
     server.registerTool?.("searchKnowledgeBase", {
@@ -6039,6 +6264,11 @@ async function registerRagTools(server) {
 
       强烈推荐始终优先使用固定技能文档 (skill)、OpenAPI 文档 (openapi) 或 CloudBase 官方文档 (docs) 模式进行检索，仅当固定文档无法覆盖你的问题时，再使用向量查询 (vector) 模式。
 
+      ⚠️ 重要：当 CloudBase skills 处于禁用状态或当前 IDE 不支持 skill 文件读取时，必须使用 searchKnowledgeBase(mode=skill, skillName=...) 来获取 CloudBase 技能文档内容，而不是尝试直接读取 skill 文件。直接读取可能返回 400 错误。示例：
+      - 需要 auth-tool 指南时：searchKnowledgeBase(mode=skill, skillName=auth-tool)
+      - 需要 auth-web 指南时：searchKnowledgeBase(mode=skill, skillName=auth-web)
+      - 需要 cloudbase-agent 指南时：searchKnowledgeBase(mode=skill, skillName=cloudbase-agent)
+
       固定技能文档 (skill) 查询当前支持 ${skills.length} 个固定文档，分别是：
       ${skills
             .map((skill) => `文档名：${path.basename(path.dirname(skill.absolutePath))} 文档介绍：${skill.description}`)
@@ -6050,14 +6280,8 @@ async function registerRagTools(server) {
             .join("\n")}`,
         inputSchema: {
             mode: SearchKnowledgeModeEnum,
-            skillName: zod_1.z
-                .enum(skills.map((skill) => path.basename(path.dirname(skill.absolutePath))))
-                .optional()
-                .describe("mode=skill 时指定。技能名称。"),
-            apiName: zod_1.z
-                .enum(openapis.map((api) => api.name))
-                .optional()
-                .describe("mode=openapi 时指定。API 名称。"),
+            skillName: buildOptionalStringEnum(skillNames, "mode=skill 时指定。技能名称。"),
+            apiName: buildOptionalStringEnum(openapiNames, "mode=openapi 时指定。API 名称。"),
             action: CloudBaseDocsActionEnum.optional().describe("mode=docs 时指定。CloudBase 文档操作类型：listModules=列出所有文档模块，listModuleDocs=获取指定模块的目录结构，findByName=按名称/路径/URL 智能查找，readDoc=读取指定文档 Markdown，searchDocs=全文搜索官方文档。"),
             moduleName: zod_1.z
                 .string()
@@ -6150,7 +6374,7 @@ async function registerRagTools(server) {
                     content: [
                         {
                             type: "text",
-                            text: `Skill document "${skillName}" not found. Available skill docs: ${skills.map((item) => path.basename(path.dirname(item.absolutePath))).join(", ") || "none"}`,
+                            text: `Skill document "${skillName}" not found. Available skill docs: ${skillNames.join(", ") || "none"}`,
                         },
                     ],
                 };
@@ -6171,7 +6395,7 @@ async function registerRagTools(server) {
                     content: [
                         {
                             type: "text",
-                            text: `OpenAPI document "${apiName}" not found. Available APIs: ${openapis.map((a) => a.name).join(", ") || "none"}`,
+                            text: `OpenAPI document "${apiName}" not found. Available APIs: ${openapiNames.join(", ") || "none"}`,
                         },
                     ],
                 };
@@ -6323,17 +6547,10 @@ function normalizeAccessPath(path) {
     }
     return path.startsWith("/") ? path : `/${path}`;
 }
-function ensureGatewayEnvId(cloudBaseOptions) {
-    const envId = cloudBaseOptions?.envId;
-    if (!envId) {
-        throw new Error("当前网关操作需要已绑定 envId");
-    }
-    return envId;
-}
 function registerGatewayTools(server) {
     const cloudBaseOptions = server.cloudBaseOptions;
     const getManager = () => (0, cloudbase_manager_js_1.getCloudBaseManager)({ cloudBaseOptions });
-    const getGatewayEnvId = () => ensureGatewayEnvId(cloudBaseOptions);
+    const resolveEnvId = () => (0, cloudbase_manager_js_1.getEnvId)(cloudBaseOptions);
     const buildEnvelope = (data, message, nextActions) => ({
         success: true,
         data,
@@ -6370,7 +6587,7 @@ function registerGatewayTools(server) {
     const listHttpServiceRoutes = async (domain) => {
         const cloudbase = await getManager();
         const result = await cloudbase.env.describeHttpServiceRoute({
-            EnvId: getGatewayEnvId(),
+            EnvId: await resolveEnvId(),
             ...(domain
                 ? {
                     Filters: [
@@ -6406,7 +6623,7 @@ function registerGatewayTools(server) {
             throw new Error("route.serviceType 和 route.serviceName 为必填项");
         }
         return {
-            EnvId: getGatewayEnvId(),
+            EnvId: await resolveEnvId(),
             Domain: {
                 Domain: await resolveRouteDomain(domain),
                 Routes: [
@@ -6516,6 +6733,9 @@ function registerGatewayTools(server) {
                 if (!input.targetName || !input.targetType) {
                     throw new Error("action=createAccess 时必须提供 targetType 和 targetName");
                 }
+                if (!input.type) {
+                    throw new Error("action=createAccess 且 targetType=function 时必须显式提供 type。HTTP 云函数传 HTTP；Event 函数传 Event。省略会默认按 Event 路由处理，可能让 HTTP 云函数访问后返回 FUNCTION_PARAM_INVALID。");
+                }
                 const cloudbase = await getManager();
                 const accessPath = normalizeAccessPath(input.path || `/${input.targetName}`);
                 let result;
@@ -6523,7 +6743,7 @@ function registerGatewayTools(server) {
                     result = await cloudbase.access.createAccess({
                         name: input.targetName,
                         path: accessPath,
-                        type: ((input.type || "Event") === "HTTP" ? 6 : 1),
+                        type: (input.type === "HTTP" ? 6 : 1),
                         auth: input.auth,
                     });
                 }
@@ -6531,7 +6751,7 @@ function registerGatewayTools(server) {
                     if (err.message && err.message.includes("An error has occurred")) {
                         let hint = "为目标资源配置访问路由失败（后端内部错误）。请确保：1) 目标云函数已成功创建并处于 Active 状态；2) 环境默认 HTTP 域名已完成初始化；3) 该访问路径未被占用。";
                         if (input.type === "HTTP") {
-                            hint += "此外注意：如果目标函数最初是作为 Event 函数创建的，这里 type 必须依然传 Event（或省略），传 HTTP 会导致此错误。";
+                            hint += "此外注意：如果目标函数最初是作为 Event 函数创建的，这里 type 仍必须传 Event；误传 HTTP 会导致此错误。";
                         }
                         throw new Error(`${hint} 原始错误：${err.message}`);
                     }
@@ -6544,12 +6764,22 @@ function registerGatewayTools(server) {
                     targetName: input.targetName,
                     path: accessPath,
                     raw: result,
-                }, `已为目标 ${input.targetName} 创建网关访问路径。注意：路由配置传播通常需要等待 30 秒到 3 分钟，请勿立即访问。`, [
+                }, `已为目标 ${input.targetName} 创建网关访问路径。注意：路由配置传播通常需要等待 30 秒到 3 分钟，请勿立即访问。该操作只创建网关入口，不会自动放开函数安全规则；若需要匿名或浏览器直接访问，请继续检查函数资源权限。`, [
                     {
                         tool: "queryGateway",
                         action: "getAccess",
                         reason: "等待 30 秒到 3 分钟后再确认访问入口是否已生效",
                     },
+                    {
+                        tool: "queryPermissions",
+                        action: "getResourcePermission",
+                        reason: "确认函数安全规则是否允许预期访问方；网关 auth=false 不等于函数已允许匿名访问",
+                    },
+                    {
+                        tool: "managePermissions",
+                        action: "updateResourcePermission",
+                        reason: "只有在确认需要匿名或浏览器直连访问时，才按实际安全要求更新函数权限",
+                    },
                 ]);
             }
             case "createRoute": {
@@ -6580,7 +6810,7 @@ function registerGatewayTools(server) {
                 const cloudbase = await getManager();
                 const domain = await resolveRouteDomain(input.domain);
                 const result = await cloudbase.env.deleteHttpServiceRoute({
-                    EnvId: getGatewayEnvId(),
+                    EnvId: await resolveEnvId(),
                     Domain: domain,
                     Paths: [normalizeAccessPath(routePath)],
                 });
@@ -6598,7 +6828,7 @@ function registerGatewayTools(server) {
                 }
                 const cloudbase = await getManager();
                 const result = await cloudbase.env.bindCustomDomain({
-                    EnvId: getGatewayEnvId(),
+                    EnvId: await resolveEnvId(),
                     Domain: {
                         Domain: input.domain,
                         CertId: input.certificateId,
@@ -6618,7 +6848,7 @@ function registerGatewayTools(server) {
                 }
                 const cloudbase = await getManager();
                 const result = await cloudbase.env.deleteCustomDomain({
-                    EnvId: getGatewayEnvId(),
+                    EnvId: await resolveEnvId(),
                     Domain: input.domain,
                 });
                 (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
@@ -6702,18 +6932,32 @@ function registerGatewayTools(server) {
         },
     }, async (input) => withEnvelope(() => handleQueryGateway(input)));
     server.registerTool?.("manageGateway", {
-        title: "管理网关域资源",
-        description: "网关域统一写入口。通过 action 创建目标访问入口，后续承接更通用的网关配置能力。",
+        title: "管理网关域资源（含自定义域名绑定）",
+        description: "网关域统一写入口。通过 action 创建目标访问入口，后续承接更通用的网关配置能力。为已存在的 HTTP 云函数补默认域名访问时，通常使用 createAccess 并提供 targetType=\"function\"、targetName、type=\"HTTP\" 与期望 path。注意 createAccess 只创建网关入口，不会自动修改函数资源权限。⚠️ 如需绑定带 SSL 证书的自定义域名供公网 HTTPS 访问，使用 action=\"bindCustomDomain\"（需要 domain 和 certificateId 参数）；如需配置 CORS/安全域名（无证书），请使用 envDomainManagement 工具。",
         inputSchema: {
-            action: zod_1.z.enum(MANAGE_GATEWAY_ACTIONS).describe("写操作类型，例如 createAccess"),
+            action: zod_1.z
+                .enum(MANAGE_GATEWAY_ACTIONS)
+                .describe('写操作类型，例如 createAccess。为已有函数补默认域名访问入口时使用 createAccess；若 action=createAccess 且 targetType=function，必须显式提供 type。'),
             targetType: zod_1.z
                 .enum(["function"])
                 .optional()
                 .describe("目标资源类型。当前支持 function，后续可扩展"),
-            targetName: zod_1.z.string().optional().describe("目标资源名称"),
-            path: zod_1.z.string().optional().describe("访问路径，默认 /{targetName}"),
-            type: zod_1.z.enum(["Event", "HTTP"]).optional().describe("目标函数的本身类型（非接入形式）。如果被访问的函数是 Event 型（默认），此处必须传 Event；只有当被访问函数在创建时就是 HTTP 函数时才传 HTTP。"),
-            auth: zod_1.z.boolean().optional().describe("是否开启鉴权"),
+            targetName: zod_1.z
+                .string()
+                .optional()
+                .describe("目标资源名称。createAccess 到云函数时填写函数名"),
+            path: zod_1.z
+                .string()
+                .optional()
+                .describe("访问路径，默认 /{targetName}。例如为 HTTP 函数暴露 /api/hello 时传 /api/hello。该参数只创建网关入口，不会自动放开函数资源权限。"),
+            type: zod_1.z
+                .enum(["Event", "HTTP"])
+                .optional()
+                .describe("目标函数的运行时类型，不是接入协议。createAccess 到已创建的 HTTP 云函数时传 HTTP；给 Event 函数补网关访问时传 Event 或省略。省略会默认按 Event 路由处理，可能让 HTTP 云函数访问后返回 FUNCTION_PARAM_INVALID。"),
+            auth: zod_1.z
+                .boolean()
+                .optional()
+                .describe("是否开启网关路径鉴权。若要走默认域名做匿名或浏览器访问，通常设为 false；该开关仅控制网关入口本身，不会修改函数资源权限，仍需检查并按需调整函数安全规则。"),
             route: zod_1.z
                 .object({
                 routeId: zod_1.z.string().optional(),
@@ -6847,16 +7091,54 @@ function registerInviteCodeTools(server) {
 /***/ }),
 
 /***/ 4848:
-/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+/***/ (function(__unused_webpack_module, exports, __webpack_require__) {
 
 
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.registerStorageTools = registerStorageTools;
+const fs = __importStar(__webpack_require__(7932));
+const os = __importStar(__webpack_require__(8116));
+const path = __importStar(__webpack_require__(2521));
 const zod_1 = __webpack_require__(2971);
 const cloudbase_manager_js_1 = __webpack_require__(3431);
+const MAX_INLINE_TEXT_BYTES = 256 * 1024;
+const STORAGE_READ_TEMP_PREFIX = 'cloudbase-mcp-storage-read-';
 // Input schema for queryStorage tool
 const queryStorageInputSchema = {
-    action: zod_1.z.enum(['list', 'info', 'url']).describe('查询操作类型：list=列出目录下的所有文件，info=获取指定文件的详细信息，url=获取文件的临时下载链接'),
+    action: zod_1.z.enum(['list', 'info', 'url', 'read']).describe('查询操作类型：list=列出目录下的所有文件，info=获取指定文件的详细信息，url=获取文件的临时下载链接，read=读取文本文件内容'),
     cloudPath: zod_1.z.string().describe('云端文件路径，例如 files/data.txt 或 files/（目录）'),
     maxAge: zod_1.z.number().min(1).max(86400).optional().default(3600).describe('临时链接有效期，单位为秒，取值范围：1-86400，默认值：3600（1小时）')
 };
@@ -6868,6 +7150,63 @@ const manageStorageInputSchema = {
     force: zod_1.z.boolean().optional().default(false).describe('强制操作开关，删除操作时建议设置为true以确认删除，默认false'),
     isDirectory: zod_1.z.boolean().optional().default(false).describe('是否为目录操作，true=目录操作，false=文件操作，默认false')
 };
+function getStorageTempFileName(cloudPath) {
+    const baseName = path.posix.basename(cloudPath);
+    return baseName || 'storage-file';
+}
+function decodeInlineTextContent(buffer) {
+    const inlineBuffer = buffer.subarray(0, MAX_INLINE_TEXT_BYTES);
+    if (inlineBuffer.includes(0)) {
+        throw new Error('queryStorage action=read 仅支持读取文本文件内容；二进制文件请改用 action=url 获取下载链接，或使用 manageStorage(action="download") 下载到本地。');
+    }
+    return {
+        content: inlineBuffer.toString('utf8'),
+        truncated: buffer.length > MAX_INLINE_TEXT_BYTES,
+        sizeBytes: buffer.length,
+        encoding: 'utf8',
+    };
+}
+function getNonEmptyString(value) {
+    if (typeof value !== 'string') {
+        return null;
+    }
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : null;
+}
+function buildStoragePublicUrl(cdnDomain, cloudPath) {
+    if (!cdnDomain) {
+        return null;
+    }
+    const normalizedCloudPath = cloudPath.replace(/^\/+/, '');
+    if (!normalizedCloudPath) {
+        return `https://${cdnDomain}`;
+    }
+    return `https://${cdnDomain}/${normalizedCloudPath}`;
+}
+async function resolveStoragePublicAccess(params) {
+    const { cloudPath, cloudBaseOptions, manager } = params;
+    try {
+        const envId = await (0, cloudbase_manager_js_1.getEnvId)(cloudBaseOptions);
+        const describeEnvsResult = await manager.commonService('tcb', '2018-06-08').call({
+            Action: 'DescribeEnvs',
+            Param: {
+                EnvId: envId,
+            },
+        });
+        const storageList = describeEnvsResult?.EnvList?.[0]?.Storages ?? describeEnvsResult?.EnvInfo?.Storages ?? [];
+        const storageCdnDomain = getNonEmptyString(storageList[0]?.CdnDomain);
+        return {
+            storageCdnDomain,
+            publicUrl: buildStoragePublicUrl(storageCdnDomain, cloudPath),
+        };
+    }
+    catch {
+        return {
+            storageCdnDomain: null,
+            publicUrl: null,
+        };
+    }
+}
 function registerStorageTools(server) {
     // 获取 cloudBaseOptions，如果没有则为 undefined
     const cloudBaseOptions = server.cloudBaseOptions;
@@ -6876,7 +7215,7 @@ function registerStorageTools(server) {
     // Tool 1: queryStorage - 查询存储信息（只读操作）
     server.registerTool("queryStorage", {
         title: "查询存储信息",
-        description: "查询云存储信息，支持列出目录文件、获取文件信息、获取临时下载链接等只读操作。返回的文件信息包括文件名、大小、修改时间、下载链接等。",
+        description: "查询云存储信息，支持列出目录文件、获取文件信息、获取临时下载链接等只读操作。返回的文件信息包括文件名、大小、修改时间、下载链接等。注意：action=url 返回的 temporaryUrl 是临时签名链接，有效期由 maxAge 参数决定（默认1小时），不要当作永久公网地址使用。工具还会基于 DescribeEnvs 返回的 Storages[0].CdnDomain 推导出 publicUrl，⚠️ 警告：publicUrl 仅在存储桶 ACL 为公有读（所有用户可读）时才能被匿名访问；默认私有读写存储桶返回的 publicUrl 会 403，此时请继续使用 temporaryUrl 或先通过控制台/SDK 将目标路径设置为公有读。",
         inputSchema: queryStorageInputSchema,
         annotations: {
             readOnlyHint: true,
@@ -6935,6 +7274,11 @@ function registerStorageTools(server) {
                         cloudPath: input.cloudPath,
                         maxAge: input.maxAge || 3600
                     }]);
+                const publicAccess = await resolveStoragePublicAccess({
+                    cloudPath: input.cloudPath,
+                    cloudBaseOptions,
+                    manager,
+                });
                 return {
                     content: [
                         {
@@ -6946,7 +7290,10 @@ function registerStorageTools(server) {
                                     cloudPath: input.cloudPath,
                                     temporaryUrl: result[0]?.url || "",
                                     expireTime: `${input.maxAge || 3600}秒`,
-                                    fileId: result[0]?.fileId || ""
+                                    fileId: result[0]?.fileId || "",
+                                    storageCdnDomain: publicAccess.storageCdnDomain,
+                                    publicUrl: publicAccess.publicUrl,
+                                    note: "temporaryUrl 是临时签名链接，会按 expireTime 过期。publicUrl 基于 DescribeEnvs 返回的 Storages[0].CdnDomain 推导，⚠️ 仅在存储桶 ACL 为公有读（所有用户可读）时才能被匿名访问；默认私有读写存储桶返回的 publicUrl 会 403，此时请继续使用 temporaryUrl 或先将目标路径设置为公有读。"
                                 },
                                 message: `Successfully generated temporary URL for '${input.cloudPath}'`
                             }, null, 2)
@@ -6954,6 +7301,42 @@ function registerStorageTools(server) {
                     ]
                 };
             }
+            case 'read': {
+                const tempDir = await fs.mkdtemp(path.join(os.tmpdir(), STORAGE_READ_TEMP_PREFIX));
+                const localPath = path.join(tempDir, getStorageTempFileName(input.cloudPath));
+                try {
+                    await storageService.downloadFile({
+                        cloudPath: input.cloudPath,
+                        localPath
+                    });
+                    const buffer = await fs.readFile(localPath);
+                    const decoded = decodeInlineTextContent(buffer);
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: JSON.stringify({
+                                    success: true,
+                                    data: {
+                                        action: 'read',
+                                        cloudPath: input.cloudPath,
+                                        content: decoded.content,
+                                        encoding: decoded.encoding,
+                                        sizeBytes: decoded.sizeBytes,
+                                        truncated: decoded.truncated
+                                    },
+                                    message: decoded.truncated
+                                        ? `Successfully read text content for '${input.cloudPath}' (truncated to ${MAX_INLINE_TEXT_BYTES} bytes)`
+                                        : `Successfully read text content for '${input.cloudPath}'`
+                                }, null, 2)
+                            }
+                        ]
+                    };
+                }
+                finally {
+                    await fs.rm(tempDir, { recursive: true, force: true });
+                }
+            }
             default:
                 throw new Error(`Unsupported action: ${input.action}`);
         }
@@ -6961,7 +7344,7 @@ function registerStorageTools(server) {
     // Tool 2: manageStorage - 管理存储文件（写操作）
     server.registerTool("manageStorage", {
         title: "管理存储文件",
-        description: "管理云存储文件，仅用于 COS/Storage 对象，不用于静态网站托管。支持上传文件/目录、下载文件/目录、删除文件/目录等操作。删除操作需要设置force=true进行确认，防止误删除重要文件。",
+        description: "管理云存储文件，仅用于 COS/Storage 对象，不用于静态网站托管。支持上传文件/目录、下载文件/目录、删除文件/目录等操作。删除操作需要设置force=true进行确认，防止误删除重要文件。注意：上传后返回的 temporaryUrl 是临时签名链接，1小时后过期，不要当作永久公网地址写入配置或持久化存储。工具还会基于 DescribeEnvs 返回的 Storages[0].CdnDomain 推导 publicUrl，⚠️ 警告：publicUrl 仅在存储桶 ACL 为公有读（所有用户可读）时才能被匿名访问；默认私有读写存储桶返回的 publicUrl 会 403，此时请继续使用 temporaryUrl 或先通过控制台/SDK 将目标路径设置为公有读。",
         inputSchema: manageStorageInputSchema,
         annotations: {
             readOnlyHint: false,
@@ -7001,6 +7384,11 @@ function registerStorageTools(server) {
                         cloudPath: input.cloudPath,
                         maxAge: 3600
                     }]);
+                const publicAccess = await resolveStoragePublicAccess({
+                    cloudPath: input.cloudPath,
+                    cloudBaseOptions,
+                    manager,
+                });
                 return {
                     content: [
                         {
@@ -7013,7 +7401,10 @@ function registerStorageTools(server) {
                                     cloudPath: input.cloudPath,
                                     isDirectory: input.isDirectory,
                                     temporaryUrl: fileUrls[0]?.url || "",
-                                    expireTime: "1小时"
+                                    expireTime: "1小时",
+                                    storageCdnDomain: publicAccess.storageCdnDomain,
+                                    publicUrl: publicAccess.publicUrl,
+                                    note: "temporaryUrl 是临时签名链接，1小时后过期，不要当作永久公网地址写入配置或持久化存储。publicUrl 基于 DescribeEnvs 返回的 Storages[0].CdnDomain 推导，⚠️ 仅在存储桶 ACL 为公有读（所有用户可读）时才能被匿名访问；默认私有读写存储桶返回的 publicUrl 会 403，此时请继续使用 temporaryUrl 或先将目标路径设置为公有读。"
                                 },
                                 message: `Successfully uploaded ${input.isDirectory ? 'directory' : 'file'} from '${input.localPath}' to '${input.cloudPath}'`
                             }, null, 2)
@@ -8353,7 +8744,7 @@ function registerAppAuthTools(server) {
     };
     server.registerTool?.("queryAppAuth", {
         title: "查询应用认证配置",
-        description: "应用侧认证配置只读入口。用于查询登录方式、provider、publishable key、API key、client 配置和静态域名等认证准备状态。若业务要接受普通用户名样式标识符，先查询 action=getLoginConfig；若 usernamePassword=false，下一步应立即调用 manageAppAuth(action=patchLoginStrategy, patch={ usernamePassword: true })，不要直接写 email 登录 API。",
+        description: "应用侧认证配置只读入口。用于查询登录方式、provider、publishable key、API key、client 配置和静态域名等认证准备状态。⚠️ 本工具为管理端配置查询工具，不执行用户登录。当任务要求编写客户端登录代码时（例如「用 JS SDK 登录」），应先通过本工具确认配置状态，再在项目代码中编写 @cloudbase/js-sdk 客户端登录代码（如 auth.signInWithPassword()），而非使用本工具完成登录。若业务要接受普通用户名样式标识符，先查询 action=getLoginConfig；若 usernamePassword=false，下一步应立即调用 manageAppAuth(action=patchLoginStrategy, patch={ usernamePassword: true })，不要直接写 email 登录 API。",
         inputSchema: {
             action: zod_1.z.enum(QUERY_APP_AUTH_ACTIONS),
             providerId: zod_1.z.string().optional().describe("provider 标识，如 email、google"),
@@ -8464,7 +8855,7 @@ function registerAppAuthTools(server) {
     }));
     server.registerTool?.("manageAppAuth", {
         title: "管理应用认证配置",
-        description: "应用侧认证配置写入口。用于修改登录方式、provider、client 配置，确保 publishable key，以及创建或删除 API key、自定义登录密钥。若前端要接受普通用户名样式标识符，应先执行 action=patchLoginStrategy 并传入 patch={ usernamePassword: true }，再实现对应前端登录逻辑。",
+        description: "应用侧认证配置写入口。用于修改登录方式、provider、client 配置，确保 publishable key，以及创建或删除 API key、自定义登录密钥。⚠️ 本工具为管理端配置工具，不执行用户登录。当任务要求编写客户端登录代码时（例如「用 JS SDK 登录」），应先通过本工具完成配置（如启用 usernamePassword、获取 publishable key），再在项目代码中编写 @cloudbase/js-sdk 客户端登录代码（如 auth.signInWithPassword()），而非使用本工具完成登录。若前端要接受普通用户名样式标识符，应先执行 action=patchLoginStrategy 并传入 patch={ usernamePassword: true }，再实现对应前端登录逻辑。",
         inputSchema: {
             action: zod_1.z.enum(MANAGE_APP_AUTH_ACTIONS),
             patch: zod_1.z
@@ -8731,7 +9122,7 @@ class TelemetryReporter {
         const nodeVersion = process.version; // Node.js版本
         const arch = os_1.default.arch(); // 系统架构
         // 从构建时注入的版本号获取MCP版本信息
-        const mcpVersion = process.env.npm_package_version || "2.18.0" || 0;
+        const mcpVersion = process.env.npm_package_version || "2.19.5" || 0;
         return {
             userAgent: `${osType} ${osRelease} ${arch} ${nodeVersion} CloudBase-MCP/${mcpVersion}`,
             deviceId: this.deviceId,
@@ -9114,6 +9505,7 @@ exports.MANAGE_FUNCTION_ACTIONS = [
     "updateFunctionCode",
     "updateFunctionConfig",
     "invokeFunction",
+    "deleteFunction",
     "createFunctionTrigger",
     "deleteFunctionTrigger",
     "createLayerVersion",
@@ -9257,14 +9649,32 @@ function buildFunctionOperationErrorMessage(operation, functionName, functionRoo
     if (/路径不存在/i.test(baseMessage) && expectedFunctionPath) {
         suggestions.push(`当前工具会从 \`functionRootPath + 函数名\` 查找代码目录，期望目录是 \`${expectedFunctionPath}\`。`);
         suggestions.push("如果你传入的已经是函数目录本身，请改为传它的父目录。");
+        if (functionRootPath) {
+            const lastDir = path_1.default.basename(path_1.default.normalize(functionRootPath));
+            if (lastDir !== "cloudfunctions" && lastDir !== "functions") {
+                suggestions.push(`functionRootPath 应该是直接包含函数文件夹的目录（如 cloudfunctions 或 functions），而不是项目根目录。` +
+                    `请将 functionRootPath 改为 \`${path_1.default.join(path_1.default.normalize(functionRootPath), "cloudfunctions")}\` ` +
+                    `或 \`${path_1.default.join(path_1.default.normalize(functionRootPath), "functions")}\`。`);
+            }
+        }
     }
     if (/paths\[0\].*undefined/i.test(baseMessage)) {
-        suggestions.push("HTTP 函数创建时需要提供 functionRootPath（指向 cloudfunctions 父目录）或 zipFile，否则 SDK 无法定位函数目录。");
+        suggestions.push("HTTP 函数创建时需要提供 functionRootPath（指向 cloudfunctions 或 functions 目录的绝对路径，不是项目根目录）或 zipFile，否则 SDK 无法定位函数目录。");
     }
     if (/依赖安装失败|package\.json/i.test(baseMessage)) {
         suggestions.push("如果 HTTP 函数只使用原生 Node.js API 且没有第三方依赖，可以保留函数目录中的 index.js 和 scf_bootstrap，工具会跳过依赖安装。");
         suggestions.push("如果你确实依赖 npm 包，请在函数目录下补充 package.json 后重试。");
     }
+    // Handle invalid parameter value errors from CloudBase API
+    if (/invalid parameter value/i.test(baseMessage)) {
+        suggestions.push("检测到参数值格式错误。请重点检查以下配置项：");
+        suggestions.push("1. runtime: 请使用支持的运行时版本，如 Nodejs18.15、Nodejs16.13、Nodejs20.19 等（区分大小写，不要加空格）");
+        suggestions.push("2. handler: Event 函数默认使用 index.main，HTTP 函数默认使用 app.handler 或 scf_bootstrap 启动");
+        suggestions.push("3. functionName: 函数名称只能包含字母、数字、下划线、连字符，不能以数字开头");
+        suggestions.push("4. timeout: 超时时间需为整数，单位为秒，范围 1-900");
+        suggestions.push("5. envVariables: 环境变量键值对不能为空字符串");
+        suggestions.push("6. type: 函数类型只能是 Event 或 HTTP（区分大小写）");
+    }
     if (suggestions.length === 0) {
         suggestions.push("请检查函数名、目录结构和环境中的函数状态后重试。");
     }
@@ -9321,10 +9731,17 @@ function registerFunctionTools(server) {
             throw new Error("createLayerVersion 在 cloud mode 下不支持 contentPath，本地文件内容请改为 base64Content 或改用本地模式执行。");
         }
     };
+    const TIME_FORMAT_REGEX = /^\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}$/;
     const validateLogRange = (startTime, endTime, offset, limit) => {
         if ((offset || 0) + (limit || 0) > 10000) {
             throw new Error("offset+limit 不能大于 10000");
         }
+        if (startTime && !TIME_FORMAT_REGEX.test(startTime)) {
+            throw new Error(`startTime 格式错误: "${startTime}"。必须使用 YYYY-MM-DD HH:mm:ss 格式（如 2024-01-01 00:00:00）`);
+        }
+        if (endTime && !TIME_FORMAT_REGEX.test(endTime)) {
+            throw new Error(`endTime 格式错误: "${endTime}"。必须使用 YYYY-MM-DD HH:mm:ss 格式（如 2024-01-01 23:59:59）`);
+        }
         if (startTime && endTime) {
             const start = new Date(startTime).getTime();
             const end = new Date(endTime).getTime();
@@ -9404,15 +9821,29 @@ function registerFunctionTools(server) {
                 }
                 validateLogRange(input.startTime, input.endTime, input.offset, input.limit);
                 const cloudbase = await getManager();
-                const result = await cloudbase.functions.getFunctionLogsV2({
-                    name: input.functionName,
-                    offset: input.offset,
-                    limit: input.limit,
-                    startTime: input.startTime,
-                    endTime: input.endTime,
-                    requestId: input.requestId,
-                    qualifier: input.qualifier,
-                });
+                let result;
+                try {
+                    result = await cloudbase.functions.getFunctionLogsV2({
+                        name: input.functionName,
+                        offset: input.offset,
+                        limit: input.limit,
+                        startTime: input.startTime,
+                        endTime: input.endTime,
+                        requestId: input.requestId,
+                        qualifier: input.qualifier,
+                    });
+                }
+                catch (error) {
+                    const errMsg = error instanceof Error ? error.message : String(error);
+                    if (/invalid parameter/i.test(errMsg)) {
+                        throw new Error(`${errMsg}\n\n常见原因：\n` +
+                            `1. startTime/endTime 格式错误，必须为 YYYY-MM-DD HH:mm:ss（如 2024-01-01 00:00:00），不支持 ISO 8601 或时间戳\n` +
+                            `2. startTime 和 endTime 间隔超过一天\n` +
+                            `3. functionName 不存在或格式不正确\n` +
+                            `建议：不传 startTime/endTime 时默认查询最近一天的日志。`);
+                    }
+                    throw error;
+                }
                 (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
                 return buildEnvelope({
                     action: input.action,
@@ -9434,11 +9865,24 @@ function registerFunctionTools(server) {
                 }
                 validateLogRange(input.startTime, input.endTime);
                 const cloudbase = await getManager();
-                const result = await cloudbase.functions.getFunctionLogDetail({
-                    startTime: input.startTime,
-                    endTime: input.endTime,
-                    logRequestId: input.requestId,
-                });
+                let result;
+                try {
+                    result = await cloudbase.functions.getFunctionLogDetail({
+                        startTime: input.startTime,
+                        endTime: input.endTime,
+                        logRequestId: input.requestId,
+                    });
+                }
+                catch (error) {
+                    const errMsg = error instanceof Error ? error.message : String(error);
+                    if (/invalid parameter/i.test(errMsg)) {
+                        throw new Error(`${errMsg}\n\n常见原因：\n` +
+                            `1. startTime/endTime 格式错误，必须为 YYYY-MM-DD HH:mm:ss（如 2024-01-01 00:00:00），不支持 ISO 8601 或时间戳\n` +
+                            `2. startTime 和 endTime 间隔超过一天\n` +
+                            `建议：不传 startTime/endTime 时默认查询最近一天的日志。`);
+                    }
+                    throw error;
+                }
                 (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
                 return buildEnvelope({
                     action: input.action,
@@ -9634,7 +10078,7 @@ function registerFunctionTools(server) {
                 const functionType = typeof func.type === "string" ? func.type : undefined;
                 const expectedFunctionPath = getExpectedFunctionPath(processedRootPath, functionName);
                 if (functionType === "HTTP" && !processedRootPath && !input.zipFile) {
-                    throw new Error("createFunction 创建 HTTP 函数时，需要提供 functionRootPath（指向 cloudfunctions 父目录）或 zipFile。");
+                    throw new Error("createFunction 创建 HTTP 函数时，需要提供 functionRootPath（指向 cloudfunctions 或 functions 目录的绝对路径，不是项目根目录）或 zipFile。");
                 }
                 const hasPackageJson = expectedFunctionPath !== undefined
                     ? (0, fs_1.existsSync)(path_1.default.join(expectedFunctionPath, "package.json"))
@@ -9673,7 +10117,7 @@ function registerFunctionTools(server) {
                     nextActions.push({
                         tool: "manageGateway",
                         action: "createAccess",
-                        reason: "如果需要通过 URL 访问 HTTP 函数，请按实际路径和鉴权需求显式创建访问入口，不要默认假设 /函数名 已存在",
+                        reason: "如果需要通过 URL 访问 HTTP 函数，请调用 manageGateway(action=\"createAccess\") 并显式传 type=\"HTTP\"，再按实际路径和鉴权需求创建访问入口，不要默认假设 /函数名 已存在",
                     });
                     nextActions.push({
                         tool: "queryGateway",
@@ -9692,7 +10136,7 @@ function registerFunctionTools(server) {
                     });
                 }
                 const message = func.type === "HTTP"
-                    ? `已创建 HTTP 函数 ${functionName}。如果后续需要通过 URL 访问，请显式调用 manageGateway(action="createAccess") 按实际路径和鉴权需求创建访问入口。评测或其他外部调用方可能会以匿名身份访问，而且失败后不一定会把 EXCEED_AUTHORITY 再反馈给 AI；交付前请主动确认访问路径和函数安全规则，若已出现 EXCEED_AUTHORITY，请先调用 queryPermissions(action="getResourcePermission", resourceType="function", resourceId="${functionName}") 查看当前规则，再按需要使用 managePermissions(action="updateResourcePermission") 调整权限。`
+                    ? `已创建 HTTP 函数 ${functionName}。如果后续需要通过 URL 访问，请显式调用 manageGateway(action="createAccess")，并把 type="HTTP" 一起传入，再按实际路径和鉴权需求创建访问入口。评测或其他外部调用方可能会以匿名身份访问，而且失败后不一定会把 EXCEED_AUTHORITY 再反馈给 AI；交付前请主动确认访问路径和函数安全规则，若已出现 EXCEED_AUTHORITY，请先调用 queryPermissions(action="getResourcePermission", resourceType="function", resourceId="${functionName}") 查看当前规则，再按需要使用 managePermissions(action="updateResourcePermission") 调整权限。`
                     : `已创建函数 ${functionName}`;
                 return buildEnvelope({
                     action: input.action,
@@ -9807,7 +10251,27 @@ function registerFunctionTools(server) {
                     throw error;
                 }
             }
-            case "createFunctionTrigger": {
+            case "deleteFunction": {
+                if (!input.functionName) {
+                    throw new Error("deleteFunction 操作时，functionName 参数是必需的");
+                }
+                requireConfirm(input.action, input.confirm);
+                const cloudbase = await getManager();
+                const result = await cloudbase.functions.deleteFunction(input.functionName);
+                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                return buildEnvelope({
+                    action: input.action,
+                    functionName: input.functionName,
+                    raw: result,
+                }, `已删除函数 ${input.functionName}`, [
+                    {
+                        tool: "queryFunctions",
+                        action: "listFunctions",
+                        reason: "确认函数已被删除",
+                    },
+                ]);
+            }
+            case "createFunctionTrigger": {
                 if (!input.functionName) {
                     throw new Error("createFunctionTrigger 操作时，functionName 参数是必需的");
                 }
@@ -10019,23 +10483,58 @@ function registerFunctionTools(server) {
     };
     server.registerTool?.("queryFunctions", {
         title: "查询云函数域资源",
-        description: "函数域统一只读入口。通过更自解释的 action 查询函数列表、函数详情、日志、层、触发器和代码下载地址。",
+        description: "函数域统一只读入口。通过更自解释的 action 查询 CloudBase 云函数列表、函数详情、执行日志、层、触发器和代码下载地址。" +
+            "\n\n**分页说明**：`listFunctions`、`listLayers` 支持 `limit` 和 `offset` 参数。" +
+            "\n- `limit`: 分页数量，默认值由后端决定" +
+            "\n- `offset`: 分页偏移，从 0 开始" +
+            "\n- 示例：`queryFunctions(action=\"listFunctions\", offset=10, limit=10)`" +
+            "\n\n**查询 CloudBase 云函数日志**：使用 `action=\"listFunctionLogs\"`，需要提供 `functionName` 参数。" +
+            "\n- 示例：`queryFunctions(action=\"listFunctionLogs\", functionName=\"my-function\")`" +
+            "\n- 如需查看日志详情：`queryFunctions(action=\"getFunctionLogDetail\", requestId=\"xxx\")`" +
+            "\n\n**定时任务 / cron / 定时跑**：使用 `listFunctionTriggers` 查询函数的 timer 触发器配置。" +
+            "\n\n**区分 `queryLogs` 工具**：" +
+            "\n- 本工具用于查询特定 CloudBase 云函数的执行日志" +
+            "\n- `queryLogs` 工具用于搜索 CLS 日志服务（跨服务日志聚合）",
         inputSchema: {
             action: zod_1.z
                 .enum(exports.QUERY_FUNCTION_ACTIONS)
-                .describe("只读操作类型，例如 listFunctions、getFunctionDetail、listFunctionLogs"),
-            functionName: zod_1.z.string().optional().describe("函数名称。函数相关 action 必填"),
-            limit: zod_1.z.number().optional().describe("分页数量。列表类 action 可选"),
-            offset: zod_1.z.number().optional().describe("分页偏移。列表类 action 可选"),
-            codeSecret: zod_1.z.string().optional().describe("代码保护密钥"),
-            startTime: zod_1.z.string().optional().describe("日志查询开始时间"),
-            endTime: zod_1.z.string().optional().describe("日志查询结束时间"),
-            requestId: zod_1.z.string().optional().describe("日志 requestId。获取日志详情时必填"),
-            qualifier: zod_1.z.string().optional().describe("函数版本，日志查询时可选"),
-            runtime: zod_1.z.string().optional().describe("层查询的运行时筛选"),
+                .describe("只读操作类型：" +
+                "\n- `listFunctions`: 列出所有 CloudBase 云函数" +
+                "\n- `getFunctionDetail`: 获取 CloudBase 云函数详情（需要 functionName）" +
+                "\n- `listFunctionLogs`: 查询 CloudBase 云函数执行日志（需要 functionName）" +
+                "\n- `getFunctionLogDetail`: 获取日志详情（需要 requestId）" +
+                "\n- `listFunctionLayers`: 列出函数绑定的层" +
+                "\n- `listLayers`: 列出所有层" +
+                "\n- `listLayerVersions`: 列出层的版本（注意：是 Versions 不是 Version）" +
+                "\n- `getLayerVersionDetail`: 获取层版本详情" +
+                "\n- `listFunctionTriggers`: 列出函数触发器（用于查看定时任务 / cron / timer 配置）" +
+                "\n- `getFunctionDownloadUrl`: 获取函数代码下载地址"),
+            functionName: zod_1.z
+                .string()
+                .optional()
+                .describe("CloudBase 云函数名称。`getFunctionDetail`、`listFunctionLogs`、`listFunctionLayers`、`listFunctionTriggers`、`getFunctionDownloadUrl` 时必填"),
+            limit: zod_1.z.number().optional().describe("分页数量（limit）。列表类 action 可选，默认值由后端决定"),
+            offset: zod_1.z.number().optional().describe("分页偏移（offset）。列表类 action 可选，默认 0"),
+            codeSecret: zod_1.z.string().optional().describe("代码保护密钥，用于解密函数代码"),
+            startTime: zod_1.z
+                .string()
+                .optional()
+                .describe("日志查询开始时间，格式必须为 YYYY-MM-DD HH:mm:ss（如 2024-01-01 00:00:00）。" +
+                "与 endTime 间隔不能超过一天。不传时默认查询最近一天"),
+            endTime: zod_1.z
+                .string()
+                .optional()
+                .describe("日志查询结束时间，格式必须为 YYYY-MM-DD HH:mm:ss（如 2024-01-01 23:59:59）。" +
+                "与 startTime 间隔不能超过一天。不传时默认为当前时间"),
+            requestId: zod_1.z
+                .string()
+                .optional()
+                .describe("日志请求 ID。`getFunctionLogDetail` 操作必填，可从 `listFunctionLogs` 结果中获取"),
+            qualifier: zod_1.z.string().optional().describe("函数版本别名，如 $LATEST、$DEFAULT。日志查询时可选"),
+            runtime: zod_1.z.string().optional().describe("层查询的运行时筛选，如 Nodejs18.15"),
             searchKey: zod_1.z.string().optional().describe("层名称搜索关键字"),
-            layerName: zod_1.z.string().optional().describe("层名称。层相关 action 必填"),
-            layerVersion: zod_1.z.number().optional().describe("层版本号。获取层版本详情时必填"),
+            layerName: zod_1.z.string().optional().describe("层名称。`listLayerVersions`、`getLayerVersionDetail` 操作必填"),
+            layerVersion: zod_1.z.number().optional().describe("层版本号。`getLayerVersionDetail` 操作必填"),
         },
         annotations: {
             readOnlyHint: true,
@@ -10045,15 +10544,20 @@ function registerFunctionTools(server) {
     }, async (input) => withEnvelope(() => handleQueryFunctions(input)));
     server.registerTool?.("manageFunctions", {
         title: "管理云函数域资源",
-        description: "函数域统一写入口。通过 action 管理函数创建、代码更新、配置更新、调用函数、触发器和层绑定。危险操作需要显式 confirm=true。",
+        description: "函数域统一写入口。支持创建函数、更新代码、更新配置、调用函数、管理定时跑 / 定时任务 / scheduled job 的 timer 触发器和层绑定。" +
+            "如果要创建 cron 定时任务，先用 createFunction 创建函数，再用 createFunctionTrigger 创建 timer 触发器（支持7段cron表达式），deleteFunctionTrigger 删除触发器。" +
+            "危险操作需要显式 confirm=true。",
         inputSchema: {
             action: zod_1.z
                 .enum(exports.MANAGE_FUNCTION_ACTIONS)
-                .describe("写操作类型，例如 createFunction、invokeFunction、attachLayer"),
+                .describe("写操作类型，例如 createFunction、updateFunctionCode、invokeFunction、deleteFunction、" +
+                "createFunctionTrigger（定时任务 / cron / timer）、deleteFunctionTrigger、attachLayer、detachLayer"),
             func: CREATE_FUNCTION_SCHEMA.optional().describe("createFunction 操作的函数配置"),
-            functionRootPath: zod_1.z.string().optional().describe("创建或更新函数代码时默认推荐的本地目录方式。函数根目录（父目录绝对路径）。" +
-                "本地应按 cloudfunctions/<functionName>/index.js 布局，" +
-                "此参数传 cloudfunctions 目录的绝对路径（如 /abs/path/cloudfunctions），不要传到函数名子目录。" +
+            functionRootPath: zod_1.z.string().optional().describe("创建或更新函数代码时默认推荐的本地目录方式。" +
+                "必须是直接包含函数文件夹的目录绝对路径（如 /abs/path/cloudfunctions 或 /abs/path/functions），" +
+                "不要传项目根目录（如 /abs/path），也不要传到函数名子目录（如 /abs/path/cloudfunctions/hello）。" +
+                "本地应按 cloudfunctions/<functionName>/index.js 或 functions/<functionName>/index.js 布局，" +
+                "此参数传 cloudfunctions 或 functions 目录的绝对路径。" +
                 "SDK 会自动拼接函数名子目录，无需预先压缩 zip 或 base64 编码。"),
             force: zod_1.z.boolean().optional().describe("createFunction 时是否覆盖"),
             functionName: zod_1.z.string().optional().describe("函数名称。大多数 action 使用该字段作为统一目标"),
@@ -10063,7 +10567,11 @@ function registerFunctionTools(server) {
             envVariables: zod_1.z.record(zod_1.z.string()).optional().describe("配置更新时要合并的环境变量"),
             vpc: VPC_SCHEMA.optional().describe("配置更新时的 VPC 信息"),
             params: zod_1.z.record(zod_1.z.any()).optional().describe("invokeFunction 的调用参数"),
-            triggers: zod_1.z.array(TRIGGER_SCHEMA).optional().describe("createFunctionTrigger 的触发器列表"),
+            triggers: zod_1.z
+                .array(TRIGGER_SCHEMA)
+                .optional()
+                .describe("createFunctionTrigger 的触发器列表，用于定时跑 / 定时任务 / scheduled job。timer 触发器使用7段 cron 表达式（秒 分 时 日 月 星期 年），" +
+                '如 "0 */5 * * * * *" 表示每5分钟执行一次'),
             triggerName: zod_1.z.string().optional().describe("deleteFunctionTrigger 的目标触发器名称"),
             layerName: zod_1.z.string().optional().describe("层名称"),
             layerVersion: zod_1.z.number().optional().describe("层版本号"),
@@ -10077,7 +10585,7 @@ function registerFunctionTools(server) {
                 .optional()
                 .describe("updateFunctionLayers 的目标层列表，顺序即最终顺序"),
             codeSecret: zod_1.z.string().optional().describe("层绑定时的代码保护密钥"),
-            confirm: zod_1.z.boolean().optional().describe("危险操作确认开关"),
+            confirm: zod_1.z.boolean().optional().describe("危险操作确认开关。deleteFunction、deleteFunctionTrigger、deleteLayerVersion、detachLayer 等删除类操作需要显式传入 confirm=true"),
         },
         annotations: {
             readOnlyHint: false,
@@ -10303,6 +10811,23 @@ function buildPermissionHints(securityRule, resourceId) {
         buildTemplateLiteralRuleHint(securityRule, resourceId),
     ].filter(Boolean);
 }
+async function ensureStorageBucketsExist(cloudbase, resourceIds) {
+    if (!resourceIds.length) {
+        return;
+    }
+    const envInfo = await cloudbase.env.getEnvInfo();
+    const existingBuckets = new Set((envInfo?.EnvInfo?.Storages ?? [])
+        .map((item) => item?.Bucket)
+        .filter((bucket) => Boolean(bucket)));
+    const missingBuckets = resourceIds.filter((resourceId) => !existingBuckets.has(resourceId));
+    if (missingBuckets.length === 0) {
+        return;
+    }
+    if (missingBuckets.length === 1) {
+        throw new Error(`存储 Bucket ${missingBuckets[0]} 不存在`);
+    }
+    throw new Error(`以下存储 Bucket 不存在: ${missingBuckets.join(", ")}`);
+}
 function registerPermissionTools(server) {
     const cloudBaseOptions = server.cloudBaseOptions;
     const getManager = () => (0, cloudbase_manager_js_1.getCloudBaseManager)({ cloudBaseOptions });
@@ -10345,20 +10870,24 @@ function registerPermissionTools(server) {
                 if (!resourceType || !resourceId) {
                     throw new Error("action=getResourcePermission 时必须提供 resourceType 和 resourceId");
                 }
+                if (resourceType === "storage") {
+                    await ensureStorageBucketsExist(cloudbase, [resourceId]);
+                }
                 const result = await cloudbase.permission.describeResourcePermission({
                     resourceType: mapResourceType(resourceType),
                     resources: [resourceId],
                 });
                 (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
                 const permissions = result.Data.PermissionList ?? [];
-                const securityRule = permissions.find((item) => item.Resource === resourceId)?.SecurityRule ??
-                    permissions[0]?.SecurityRule;
+                const matchedPermission = permissions.find((item) => item.Resource === resourceId) ?? permissions[0];
+                const securityRule = matchedPermission?.SecurityRule;
                 const hints = buildPermissionHints(securityRule, resourceId);
                 return buildEnvelope({
                     action,
                     envId,
                     resourceType,
                     resourceId,
+                    aclTag: matchedPermission?.Permission,
                     permissions,
                     hints,
                     raw: result,
@@ -10368,6 +10897,9 @@ function registerPermissionTools(server) {
                 if (!resourceType) {
                     throw new Error("action=listResourcePermissions 时必须提供 resourceType");
                 }
+                if (resourceType === "storage" && resourceIds?.length) {
+                    await ensureStorageBucketsExist(cloudbase, resourceIds);
+                }
                 const result = await cloudbase.permission.describeResourcePermission({
                     resourceType: mapResourceType(resourceType),
                     resources: resourceIds,
@@ -10720,7 +11252,9 @@ const http = __importStar(__webpack_require__(3782));
 const https = __importStar(__webpack_require__(3871));
 const os = __importStar(__webpack_require__(8116));
 const path = __importStar(__webpack_require__(2521));
+const url_1 = __webpack_require__(6887);
 const zod_1 = __webpack_require__(2971);
+const remote_url_safety_js_1 = __webpack_require__(9192);
 // CloudBase 模板配置
 const TEMPLATES = {
     react: {
@@ -10913,13 +11447,18 @@ function resolveDownloadTemplateIDE(ide, integrationIDE) {
         supportedIDEs: exports.IDE_TYPES.filter((t) => t !== "all"),
     };
 }
+const MAX_REDIRECT_HOPS = 5;
 // 根据 INTEGRATION_IDE 环境变量获取默认 IDE 类型
 // 下载文件到临时目录
-async function downloadFile(url, filePath) {
+async function downloadFile(url, filePath, redirectCount = 0) {
+    if (redirectCount > MAX_REDIRECT_HOPS) {
+        throw new Error(`重定向次数超过 ${MAX_REDIRECT_HOPS} 次限制`);
+    }
+    const { requestUrl, requestOptions } = await (0, remote_url_safety_js_1.prepareSafeRemoteRequest)(url);
+    const client = requestUrl.protocol === "https:" ? https : http;
     return new Promise((resolve, reject) => {
-        const client = url.startsWith("https:") ? https : http;
         client
-            .get(url, (res) => {
+            .get(requestUrl, requestOptions ?? {}, (res) => {
             if (res.statusCode === 200) {
                 const file = fs.createWriteStream(filePath);
                 res.pipe(file);
@@ -10929,10 +11468,11 @@ async function downloadFile(url, filePath) {
                 });
                 file.on("error", reject);
             }
-            else if (res.statusCode === 302 || res.statusCode === 301) {
+            else if (res.statusCode && res.statusCode >= 300 && res.statusCode < 400) {
                 // 处理重定向
                 if (res.headers.location) {
-                    downloadFile(res.headers.location, filePath)
+                    const redirectUrl = new url_1.URL(res.headers.location, requestUrl).toString();
+                    downloadFile(redirectUrl, filePath, redirectCount + 1)
                         .then(resolve)
                         .catch(reject);
                 }
@@ -11128,9 +11668,8 @@ function registerSetupTools(server) {
     // downloadTemplate - 下载项目模板 (cloud-incompatible)
     server.registerTool("downloadTemplate", {
         title: "下载项目模板",
-        description: `自动下载并部署CloudBase项目模板。⚠️ **MANDATORY FOR NEW PROJECTS** ⚠️
-
-**CRITICAL**: This tool MUST be called FIRST when starting a new project.\n\n支持的模板:\n- react: React + CloudBase 全栈应用模板\n- vue: Vue + CloudBase 全栈应用模板\n- miniprogram: 微信小程序 + 云开发模板  \n- uniapp: UniApp + CloudBase 跨端应用模板\n- rules: 只包含AI编辑器配置文件（包含Cursor、WindSurf、CodeBuddy等所有主流编辑器配置），适合在已有项目中补充AI编辑器配置\n\n支持的IDE类型:\n- all: 下载所有IDE配置\n- cursor: Cursor AI编辑器\n- 其他IDE类型见下方列表\n\n注意：如果未传入 ide 参数且无法从环境变量检测到 IDE，将提示错误并要求传入 ide 参数\n- windsurf: WindSurf AI编辑器\n- codebuddy: CodeBuddy AI编辑器\n- claude-code: Claude Code AI编辑器\n- cline: Cline AI编辑器\n- gemini-cli: Gemini CLI\n- opencode: OpenCode AI编辑器\n- qwen-code: 通义灵码\n- baidu-comate: 百度Comate\n- openai-codex-cli: OpenAI Codex CLI\n- augment-code: Augment Code\n- github-copilot: GitHub Copilot\n- roocode: RooCode AI编辑器\n- tongyi-lingma: 通义灵码\n- trae: Trae AI编辑器\n- qoder: Qoder AI编辑器\n- antigravity: Google Antigravity AI编辑器\n- vscode: Visual Studio Code\n- kiro: Kiro AI编辑器\n- aider: Aider AI编辑器\n\n特别说明：\n- rules 模板会自动包含当前 mcp 版本号信息（版本号：${ true ? "2.18.0" : 0}），便于后续维护和版本追踪\n- 下载 rules 模板时，如果项目中已存在 README.md 文件，系统会自动保护该文件不被覆盖（除非设置 overwrite=true）`,
+        description: `自动下载并部署CloudBase项目模板。
+**Note**: Call this tool when the user requests to create a new project using a CloudBase template.\n\n支持的模板:\n- react: React + CloudBase 全栈应用模板\n- vue: Vue + CloudBase 全栈应用模板\n- miniprogram: 微信小程序 + 云开发模板  \n- uniapp: UniApp + CloudBase 跨端应用模板\n- rules: 只包含AI编辑器配置文件（包含Cursor、WindSurf、CodeBuddy等所有主流编辑器配置），适合在已有项目中补充AI编辑器配置\n\n支持的IDE类型:\n- all: 下载所有IDE配置\n- cursor: Cursor AI编辑器\n- 其他IDE类型见下方列表\n\n注意：如果未传入 ide 参数且无法从环境变量检测到 IDE，将提示错误并要求传入 ide 参数\n- windsurf: WindSurf AI编辑器\n- codebuddy: CodeBuddy AI编辑器\n- claude-code: Claude Code AI编辑器\n- cline: Cline AI编辑器\n- gemini-cli: Gemini CLI\n- opencode: OpenCode AI编辑器\n- qwen-code: 通义灵码\n- baidu-comate: 百度Comate\n- openai-codex-cli: OpenAI Codex CLI\n- augment-code: Augment Code\n- github-copilot: GitHub Copilot\n- roocode: RooCode AI编辑器\n- tongyi-lingma: 通义灵码\n- trae: Trae AI编辑器\n- qoder: Qoder AI编辑器\n- antigravity: Google Antigravity AI编辑器\n- vscode: Visual Studio Code\n- kiro: Kiro AI编辑器\n- aider: Aider AI编辑器\n\n特别说明：\n- rules 模板会自动包含当前 mcp 版本号信息（版本号：${ true ? "2.19.5" : 0}），便于后续维护和版本追踪\n- 下载 rules 模板时，如果项目中已存在 README.md 文件，系统会自动保护该文件不被覆盖（除非设置 overwrite=true）`,
         inputSchema: {
             template: zod_1.z
                 .enum(["react", "vue", "miniprogram", "uniapp", "rules"])
@@ -11327,6 +11866,7 @@ const cloudbase_manager_js_1 = __webpack_require__(3431);
 const json_content_js_1 = __webpack_require__(4365);
 const QUERY_APP_ACTIONS = ["listApps", "getApp", "listAppVersions", "getAppVersion"];
 const MANAGE_APP_ACTIONS = ["deployApp", "deleteApp", "deleteAppVersion"];
+const APP_FRAMEWORKS = ["vue", "react", "next", "nuxt", "vite", "angular", "static"];
 function buildEnvelope(data, message) {
     return {
         success: true,
@@ -11349,15 +11889,24 @@ function registerAppTools(server) {
     const getManager = () => (0, cloudbase_manager_js_1.getCloudBaseManager)({ cloudBaseOptions });
     server.registerTool?.("queryApps", {
         title: "查询 CloudApp",
-        description: "CloudApp 域统一只读入口。支持应用、版本列表与版本详情查询。",
+        description: "CloudApp 域统一只读入口。可先查应用/版本，再在重新部署后用 listAppVersions 或 getAppVersion 按 serviceName 验证是否生成了新版本与最新构建状态。",
         inputSchema: {
             action: zod_1.z.enum(QUERY_APP_ACTIONS),
-            serviceName: zod_1.z.string().optional(),
-            searchKey: zod_1.z.string().optional(),
-            pageNo: zod_1.z.number().optional(),
-            pageSize: zod_1.z.number().optional(),
-            versionName: zod_1.z.string().optional(),
-            buildId: zod_1.z.string().optional(),
+            serviceName: zod_1.z
+                .string()
+                .optional()
+                .describe("CloudApp 服务名。getApp / listAppVersions / getAppVersion 时必填；重新部署后复用同一个 serviceName 查询版本历史。"),
+            searchKey: zod_1.z.string().optional().describe("按应用服务名模糊搜索关键词，仅 action=listApps 时使用。"),
+            pageNo: zod_1.z.number().optional().describe("分页页码，从 1 开始。"),
+            pageSize: zod_1.z.number().optional().describe("分页大小。"),
+            versionName: zod_1.z
+                .string()
+                .optional()
+                .describe("版本名称。getAppVersion 时可与 buildId 二选一；已知版本号时优先传该值。"),
+            buildId: zod_1.z
+                .string()
+                .optional()
+                .describe("构建 ID。getAppVersion 时可与 versionName 二选一；部署返回 BuildId 后可直接用它轮询状态。"),
         },
         annotations: {
             readOnlyHint: true,
@@ -11436,20 +11985,49 @@ function registerAppTools(server) {
     });
     server.registerTool?.("manageApps", {
         title: "管理 CloudApp",
-        description: "CloudApp 域统一写入口。首轮仅支持静态部署、删除应用和删除版本。",
+        description: "CloudApp 域统一写入口。action=deployApp 会先 uploadCode 再 createApp；首次调用创建应用，后续复用同一个 serviceName 会直接触发重新部署并生成新版本，无需先删除旧应用。",
         inputSchema: {
             action: zod_1.z.enum(MANAGE_APP_ACTIONS),
-            serviceName: zod_1.z.string(),
-            localPath: zod_1.z.string().optional(),
-            appPath: zod_1.z.string().optional(),
-            buildPath: zod_1.z.string().optional(),
-            framework: zod_1.z.string().optional(),
-            nodeJsVersion: zod_1.z.string().optional(),
-            installCmd: zod_1.z.string().optional(),
-            buildCmd: zod_1.z.string().optional(),
-            deployCmd: zod_1.z.string().optional(),
-            ignore: zod_1.z.array(zod_1.z.string()).optional(),
-            versionName: zod_1.z.string().optional(),
+            serviceName: zod_1.z
+                .string()
+                .describe("CloudApp 服务名。deployApp 时复用现有 serviceName 会新增一个部署版本并触发重新部署，而不是删除重建。"),
+            filePath: zod_1.z
+                .string()
+                .optional()
+                .describe("要上传并部署的本地项目根目录或 zip 文件绝对路径。deployApp 时必填；通常传源码所在目录而不是 build 产物目录，构建产物目录请用 buildPath 指定。"),
+            appPath: zod_1.z
+                .string()
+                .optional()
+                .describe("应用线上访问路径（hosting mount path），例如 /my-web-app。不是本地目录路径；省略时默认为 /serviceName。"),
+            buildPath: zod_1.z
+                .string()
+                .optional()
+                .describe("构建产物目录，相对于 filePath，例如 dist 或 build。纯静态 HTML 如果入口文件直接在项目根目录，可省略。"),
+            framework: zod_1.z
+                .enum(APP_FRAMEWORKS)
+                .optional()
+                .describe("前端框架类型。可选值：vue、react、next、nuxt、vite、angular、static；纯 HTML/静态站点请传 static。"),
+            nodeJsVersion: zod_1.z
+                .string()
+                .optional()
+                .describe("构建时使用的 Node.js 版本；不传时由 CloudApp 使用默认值。"),
+            installCmd: zod_1.z
+                .string()
+                .optional()
+                .describe("依赖安装命令，例如 npm install；静态资源无需安装依赖时可省略。"),
+            buildCmd: zod_1.z
+                .string()
+                .optional()
+                .describe("构建命令，例如 npm run build；纯静态 HTML 无构建步骤时可省略。"),
+            deployCmd: zod_1.z
+                .string()
+                .optional()
+                .describe("自定义部署命令。通常无需填写，只有在默认部署步骤不满足要求时才传。"),
+            ignore: zod_1.z.array(zod_1.z.string()).optional().describe("上传时忽略的文件/目录 glob 模式，例如 **/node_modules/**。"),
+            versionName: zod_1.z
+                .string()
+                .optional()
+                .describe("要删除的历史版本名，仅 action=deleteAppVersion 时必填。"),
         },
         annotations: {
             readOnlyHint: false,
@@ -11458,7 +12036,7 @@ function registerAppTools(server) {
             openWorldHint: true,
             category: "apps",
         },
-    }, async ({ action, serviceName, localPath, appPath, buildPath, framework, nodeJsVersion, installCmd, buildCmd, deployCmd, ignore, versionName, }) => {
+    }, async ({ action, serviceName, filePath, appPath, buildPath, framework, nodeJsVersion, installCmd, buildCmd, deployCmd, ignore, versionName, }) => {
         try {
             const cloudbase = await getManager();
             const appService = getCloudAppService(cloudbase);
@@ -11466,13 +12044,13 @@ function registerAppTools(server) {
                 throw new Error("当前 manager 未提供 cloudAppService");
             }
             if (action === "deployApp") {
-                if (!localPath) {
-                    throw new Error("action=deployApp 时必须提供 localPath");
+                if (!filePath) {
+                    throw new Error("action=deployApp 时必须提供 filePath");
                 }
                 const uploadResult = await appService.uploadCode({
                     deployType: "static-hosting",
                     serviceName,
-                    localPath,
+                    localPath: filePath,
                     ignore,
                 });
                 (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, uploadResult);
@@ -12031,7 +12609,65 @@ const fs_1 = __importDefault(__webpack_require__(4421));
 const path_1 = __importDefault(__webpack_require__(2521));
 const zod_1 = __webpack_require__(2971);
 const cloudbase_manager_js_1 = __webpack_require__(3431);
+const cloud_mode_js_1 = __webpack_require__(9684);
 const notification_js_1 = __webpack_require__(2720);
+const tool_result_js_1 = __webpack_require__(9835);
+const routingRuleSchema = zod_1.z.object({
+    keyPrefixEquals: zod_1.z.string().optional().describe('匹配前缀规则，例如 app/ 或 assets/。与 httpErrorCodeReturnedEquals 二选一或按 CloudBase 规则组合使用。'),
+    httpErrorCodeReturnedEquals: zod_1.z.string().optional().describe('匹配 HTTP 错误码，例如 404。SPA 回退常用 404。'),
+    replaceKeyWith: zod_1.z.string().optional().describe('把匹配结果替换为固定文件路径，例如 index.html。'),
+    replaceKeyPrefixWith: zod_1.z.string().optional().describe('把匹配前缀替换成新的前缀路径。'),
+});
+const domainConfigSchema = zod_1.z.object({
+    Refer: zod_1.z.object({
+        Switch: zod_1.z.string().describe('Referer 防盗链开关，例如 on/off。'),
+        RefererRules: zod_1.z.array(zod_1.z.object({
+            RefererType: zod_1.z.string().describe('Referer 规则类型。'),
+            Referers: zod_1.z.array(zod_1.z.string()).describe('Referer 规则值列表。'),
+            AllowEmpty: zod_1.z.boolean().describe('是否允许空 Referer。'),
+        })).optional().describe('Referer 规则列表。'),
+    }).optional().describe('Referer 防盗链配置。'),
+    Cache: zod_1.z.array(zod_1.z.object({
+        RuleType: zod_1.z.string().describe('缓存规则类型，例如 fileType/path。'),
+        RuleValue: zod_1.z.string().describe('规则匹配值。'),
+        CacheTtl: zod_1.z.number().describe('缓存 TTL，单位秒。'),
+    })).optional().describe('CDN 缓存规则列表。'),
+    IpFilter: zod_1.z.object({
+        Switch: zod_1.z.string().describe('IP 访问控制开关，例如 on/off。'),
+        FilterType: zod_1.z.string().optional().describe('过滤类型，例如 blacklist/whitelist。'),
+        Filters: zod_1.z.array(zod_1.z.string()).optional().describe('IP 规则列表。'),
+    }).optional().describe('IP 访问控制配置。'),
+    IpFreqLimit: zod_1.z.object({
+        Switch: zod_1.z.string().describe('IP 频控开关，例如 on/off。'),
+        Qps: zod_1.z.number().optional().describe('每个 IP 的 QPS 上限。'),
+    }).optional().describe('IP 频控配置。'),
+});
+const queryHostingInputSchema = {
+    action: zod_1.z.enum(['websiteConfig', 'status', 'findFiles', 'listFiles', 'domainStatus']).describe('查询类型：websiteConfig=查询静态托管网站文档配置与站点域名信息，status=查询静态托管服务状态，findFiles=按前缀查找托管文件，listFiles=列出静态托管中的全部文件，domainStatus=查询自定义域名配置与生效状态。该工具严格只读，不会修改任何资源。'),
+    prefix: zod_1.z.string().optional().describe('文件前缀过滤条件。仅 action=findFiles 时使用，例如 app/ 或 assets/logo。'),
+    marker: zod_1.z.string().optional().describe('分页起始标记。仅 action=findFiles 时使用，用于续查上一页之后的结果。'),
+    maxKeys: zod_1.z.number().int().positive().optional().describe('单次返回的最大文件条数。仅 action=findFiles 时使用。'),
+    domains: zod_1.z.array(zod_1.z.string()).optional().describe('要查询的自定义域名列表。仅 action=domainStatus 时使用，例如 ["www.example.com"]。'),
+};
+const manageHostingInputSchema = {
+    action: zod_1.z.enum(['upload', 'delete', 'setWebsiteDocument', 'enableService', 'bindDomain', 'unbindDomain', 'updateDomain', 'downloadFile', 'downloadDirectory']).describe('管理类型：upload=上传本地构建产物到静态托管，delete=删除静态托管文件或目录，setWebsiteDocument=设置首页/错误页/路由规则，enableService=开通静态托管服务，bindDomain=绑定自定义域名，unbindDomain=解绑自定义域名，updateDomain=更新域名缓存/防盗链/IP 规则，downloadFile=下载单个托管文件到本地，downloadDirectory=下载托管目录到本地。'),
+    localPath: zod_1.z.string().optional().describe('本地路径。action=upload 时表示要上传的本地文件/目录路径；action=downloadFile 或 downloadDirectory 时表示下载到本地的目标路径。建议传绝对路径。'),
+    cloudPath: zod_1.z.string().optional().describe('静态托管中的目标路径。action=upload 时表示上传后的托管路径；action=delete/downloadFile/downloadDirectory 时表示托管侧文件或目录路径。'),
+    files: zod_1.z.array(zod_1.z.object({
+        localPath: zod_1.z.string().describe('单个待上传文件的本地绝对路径。'),
+        cloudPath: zod_1.z.string().describe('该文件上传到静态托管后的托管路径。'),
+    })).default([]).describe('多文件上传配置。仅 action=upload 时可选；传入后会逐项上传，不再依赖单个 localPath/cloudPath。'),
+    ignore: zod_1.z.union([zod_1.z.string(), zod_1.z.array(zod_1.z.string())]).optional().describe('上传时忽略的文件模式。仅 action=upload 时可选，例如 node_modules 或 ["**/*.map", "**/.DS_Store"]。'),
+    isDir: zod_1.z.boolean().optional().default(false).describe('是否把 cloudPath 视为目录。仅 action=delete 时使用；true=删除目录，false=删除单个文件。'),
+    confirm: zod_1.z.boolean().optional().default(false).describe('高风险操作确认开关。action=delete 和 action=unbindDomain 时必须显式传 true，避免误删文件或误解绑域名。'),
+    indexDocument: zod_1.z.string().optional().describe('网站首页文档名称。仅 action=setWebsiteDocument 时必填，例如 index.html。'),
+    errorDocument: zod_1.z.string().optional().describe('错误页文档名称。仅 action=setWebsiteDocument 时可选，例如 404.html。'),
+    routingRules: zod_1.z.array(routingRuleSchema).optional().describe('网站路由规则列表。仅 action=setWebsiteDocument 时可选。SPA 常见配置是将 404 重写到 index.html。'),
+    domain: zod_1.z.string().optional().describe('自定义域名。action=bindDomain / unbindDomain / updateDomain 时使用，例如 www.example.com。'),
+    certId: zod_1.z.string().optional().describe('证书 ID。仅 action=bindDomain 时必填。'),
+    domainId: zod_1.z.number().optional().describe('域名 ID。仅 action=updateDomain 时必填，用于精确更新指定域名配置。'),
+    domainConfig: domainConfigSchema.optional().describe('域名配置。仅 action=updateDomain 时必填，支持缓存、Referer、防盗链、IP 规则与频控。'),
+};
 function isDirectoryUploadTarget(localPath, cloudPath) {
     if (localPath) {
         try {
@@ -12061,277 +12697,661 @@ function buildHostingAccessUrl(staticDomain, cloudPath, localPath) {
     const pathname = isDirectory ? `${normalizedCloudPath}/` : normalizedCloudPath;
     return `https://${staticDomain}/${pathname}`;
 }
-function buildUploadFilesErrorMessage(error, localPath) {
+function buildUploadErrorMessage(error, localPath) {
     const baseMessage = error instanceof Error ? error.message : String(error);
     const suggestions = [];
     if (/路径不存在|无读写权限/i.test(baseMessage)) {
         if (localPath) {
             suggestions.push(`请先确认本地路径 \`${localPath}\` 存在且当前进程有读取权限。`);
         }
-        suggestions.push("如果报错的是构建产物中的某个静态资源文件，请检查构建后的资源引用路径是否正确。");
-        suggestions.push("若站点部署到子路径，请确认 `publicPath`、`base`、`assetPrefix` 等配置没有把资源指向不存在的位置。");
+        suggestions.push('如果报错的是构建产物中的某个静态资源文件，请检查构建后的资源引用路径是否正确。');
+        suggestions.push('若站点部署到子路径，请确认 publicPath、base、assetPrefix 等配置没有把资源指向不存在的位置。');
     }
     if (suggestions.length === 0) {
-        suggestions.push("请检查上传目录、文件权限和构建产物完整性后重试。");
+        suggestions.push('请检查上传目录、文件权限和构建产物完整性后重试。');
+    }
+    return `[manageHosting(upload)] ${baseMessage}\n建议：${suggestions.join(' ')}`;
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function getRecordString(record, keys) {
+    for (const key of keys) {
+        const value = record[key];
+        if (typeof value === 'string' && value.trim()) {
+            return value;
+        }
+    }
+    return undefined;
+}
+function collectDomainRecords(value, seen = new Set(), depth = 0) {
+    if (depth > 5 || !value || typeof value !== 'object' || seen.has(value)) {
+        return [];
+    }
+    seen.add(value);
+    if (Array.isArray(value)) {
+        return value.flatMap((item) => collectDomainRecords(item, seen, depth + 1));
+    }
+    const record = value;
+    const current = getRecordString(record, ['Domain', 'domain'])
+        ? [record]
+        : [];
+    return current.concat(Object.values(record).flatMap((item) => collectDomainRecords(item, seen, depth + 1)));
+}
+function summarizeHostingDomainCheck(domains, result) {
+    const targetSet = new Set(domains);
+    const matchedRecords = collectDomainRecords(result).filter((record) => {
+        const domain = getRecordString(record, ['Domain', 'domain']);
+        return domain ? targetSet.has(domain) : false;
+    });
+    const matchedDomains = Array.from(new Set(matchedRecords
+        .map((record) => getRecordString(record, ['Domain', 'domain']))
+        .filter((domain) => Boolean(domain))));
+    return {
+        matchedDomains,
+        missingDomains: domains.filter((domain) => !matchedDomains.includes(domain)),
+        domainDetails: matchedRecords,
+    };
+}
+function extractTaskStatus(result) {
+    const candidates = [result];
+    if (isRecord(result)) {
+        candidates.push(result.Data, result.Task, result.Result);
+    }
+    for (const candidate of candidates) {
+        if (!isRecord(candidate)) {
+            continue;
+        }
+        const value = getRecordString(candidate, ['Status', 'status', 'TaskStatus', 'State']);
+        if (value) {
+            return value;
+        }
+    }
+    return undefined;
+}
+function buildDomainStatusNextStep(domains) {
+    return {
+        tool: 'queryHosting',
+        action: 'domainStatus',
+        suggested_args: {
+            action: 'domainStatus',
+            domains,
+        },
+    };
+}
+function buildStatusNextStep() {
+    return {
+        tool: 'queryHosting',
+        action: 'status',
+        suggested_args: {
+            action: 'status',
+        },
+    };
+}
+function buildWebsiteConfigNextStep() {
+    return {
+        tool: 'queryHosting',
+        action: 'websiteConfig',
+        suggested_args: {
+            action: 'websiteConfig',
+        },
+    };
+}
+function buildFindFilesNextStep(prefix) {
+    return {
+        tool: 'queryHosting',
+        action: 'findFiles',
+        suggested_args: {
+            action: 'findFiles',
+            prefix,
+        },
+    };
+}
+async function callTcbHostingAction(cloudbase, action, param, logger) {
+    const service = cloudbase.commonService?.('tcb', '2018-06-08');
+    if (!service?.call) {
+        throw new Error(`当前 CloudBase Manager 实例不支持 commonService.call，无法执行 ${action}。`);
+    }
+    const result = await service.call({
+        Action: action,
+        Param: param,
+    });
+    (0, cloudbase_manager_js_1.logCloudBaseResult)(logger, result);
+    return result;
+}
+function extractStaticStores(value) {
+    if (!value || typeof value !== 'object') {
+        return [];
+    }
+    const payload = value;
+    const stores = payload.Data;
+    return Array.isArray(stores) ? stores.filter(isRecord) : [];
+}
+async function describeHostingDomainTask(cloudbase, cloudBaseOptions, logger) {
+    try {
+        const envId = await (0, cloudbase_manager_js_1.getEnvId)(cloudBaseOptions);
+        const result = await callTcbHostingAction(cloudbase, 'DescribeHostingDomainTask', { EnvId: envId }, logger);
+        return {
+            rawStatus: extractTaskStatus(result),
+            raw: result,
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+function buildDomainMutationResult(params) {
+    const { action, domain, certId, domainId, domainConfig, result, taskStatus } = params;
+    const actionLabel = action === 'bindDomain'
+        ? '绑定'
+        : action === 'unbindDomain'
+            ? '解绑'
+            : '修改';
+    const successIndicator = action === 'bindDomain'
+        ? `继续调用 queryHosting(action="domainStatus", domains=["${domain}"])，直到返回中出现该域名，并且相关状态字段显示为已生效。`
+        : action === 'unbindDomain'
+            ? `继续调用 queryHosting(action="domainStatus", domains=["${domain}"])，直到返回中不再出现该域名。`
+            : `继续调用 queryHosting(action="domainStatus", domains=["${domain}"])，确认返回中的配置字段已更新为最新值。`;
+    return {
+        success: true,
+        data: {
+            action,
+            targetDomains: [domain],
+            ...(certId ? { certId } : {}),
+            ...(domainId !== undefined ? { domainId } : {}),
+            ...(domainConfig ? { domainConfig } : {}),
+            asyncState: 'PENDING',
+            ...(taskStatus ? { taskStatus } : {}),
+            propagation: {
+                requiresPolling: true,
+                pollTool: 'queryHosting',
+                pollAction: 'domainStatus',
+                pollIntervalSuggestionSeconds: 30,
+                timeoutSuggestionSeconds: 600,
+                successIndicator,
+            },
+            nextActions: [buildDomainStatusNextStep([domain])],
+            result,
+        },
+        message: `静态托管域名${actionLabel}请求已提交。域名配置、证书校验和边缘侧传播通常需要 30 秒到 10 分钟，请继续调用 queryHosting(action="domainStatus") 确认最终结果。`,
+    };
+}
+async function getHostingWebsiteConfig(cloudbase, logger) {
+    const websiteConfig = await cloudbase.hosting.getWebsiteConfig();
+    (0, cloudbase_manager_js_1.logCloudBaseResult)(logger, websiteConfig);
+    const hostingResult = {
+        ...websiteConfig,
+        CdnDomain: websiteConfig.CdnDomain ?? null,
+        Bucket: websiteConfig.Bucket ?? null,
+    };
+    try {
+        const envInfo = await cloudbase.env.getEnvInfo();
+        (0, cloudbase_manager_js_1.logCloudBaseResult)(logger, envInfo);
+        hostingResult.CdnDomain = envInfo.EnvInfo?.StaticStorages?.[0]?.StaticDomain ?? hostingResult.CdnDomain;
+        hostingResult.Bucket = envInfo.EnvInfo?.StaticStorages?.[0]?.Bucket ?? hostingResult.Bucket;
+    }
+    catch {
+        // Ignore enrichment failures and return the website config as-is.
+    }
+    return hostingResult;
+}
+async function resolveHostingStaticDomain(cloudbase, logger) {
+    try {
+        const envInfo = await cloudbase.env.getEnvInfo();
+        (0, cloudbase_manager_js_1.logCloudBaseResult)(logger, envInfo);
+        return envInfo.EnvInfo?.StaticStorages?.[0]?.StaticDomain;
+    }
+    catch {
+        return undefined;
+    }
+}
+function buildFailureResult(action, error) {
+    return (0, tool_result_js_1.buildJsonToolResult)({
+        success: false,
+        errorCode: `HOSTING_${action.toUpperCase()}_FAILED`,
+        message: error instanceof Error ? error.message : String(error),
+    });
+}
+function normalizeFileFields(files) {
+    if (!Array.isArray(files))
+        return [];
+    return files.map(file => {
+        if (typeof file !== 'object' || file === null)
+            return file;
+        const record = file;
+        return {
+            key: record.Key ?? record.key ?? '',
+            size: record.Size ?? record.size ?? 0,
+            lastModified: record.LastModified ?? record.lastModified ?? '',
+            ...record,
+        };
+    });
+}
+function normalizeHostingStatus(current) {
+    if (!current)
+        return null;
+    return {
+        ...current,
+        status: current.Status ?? current.status ?? 'unknown',
+        staticDomain: current.StaticDomain ?? current.staticDomain ?? null,
+        bucket: current.Bucket ?? current.bucket ?? null,
+    };
+}
+function ensureManageHostingActionAllowedInCloudMode(input) {
+    if (!(0, cloud_mode_js_1.isCloudMode)()) {
+        return;
+    }
+    if (input.action === 'upload' || input.action === 'downloadFile' || input.action === 'downloadDirectory') {
+        throw new Error(`manageHosting(action="${input.action}") 在 cloud mode 下不可用，因为该操作依赖本地文件路径。请改用本地模式执行；若只需要远端管理静态托管，可继续使用 delete / setWebsiteDocument / enableService / bindDomain / unbindDomain / updateDomain。`);
     }
-    return `[uploadFiles] ${baseMessage}\n建议：${suggestions.join(" ")}`;
 }
 function registerHostingTools(server) {
-    // 获取 cloudBaseOptions，如果没有则为 undefined
     const cloudBaseOptions = server.cloudBaseOptions;
-    // 创建闭包函数来获取 CloudBase Manager
     const getManager = () => (0, cloudbase_manager_js_1.getCloudBaseManager)({ cloudBaseOptions });
-    // uploadFiles - 上传文件到静态网站托管 (cloud-incompatible)
-    server.registerTool("uploadFiles", {
-        title: "上传静态文件",
-        description: "上传文件到静态网站托管，仅用于 Web 站点部署，不用于云存储对象上传。部署前请先完成构建；如果站点会部署到子路径，请检查构建配置中的 publicPath、base、assetPrefix 等是否使用相对路径，避免静态资源加载失败。若需要上传 COS 云存储文件，请使用 manageStorage。对于本地评测、现有脚手架补全或仅需本地开发服务器验证的任务，通常不需要调用此工具，除非用户明确要求部署站点。",
-        inputSchema: {
-            localPath: zod_1.z.string().optional().describe("本地文件或文件夹路径，需要是绝对路径，例如 /tmp/files/data.txt。"),
-            cloudPath: zod_1.z.string().optional().describe("静态托管云端文件或文件夹路径，例如 files/data.txt。若部署到子路径，请同时检查构建配置中的 publicPath、base、assetPrefix 等是否为相对路径。云存储对象路径请改用 manageStorage。"),
-            files: zod_1.z.array(zod_1.z.object({
-                localPath: zod_1.z.string(),
-                cloudPath: zod_1.z.string()
-            })).default([]).describe("多文件上传配置"),
-            ignore: zod_1.z.union([zod_1.z.string(), zod_1.z.array(zod_1.z.string())]).optional().describe("忽略文件模式")
-        },
+    server.registerTool('queryHosting', {
+        title: '查询静态托管',
+        description: '查询 CloudBase 静态托管的只读信息。适合 AI 先做发现再决定下一步：action=websiteConfig 查询首页/错误页/路由规则与站点域名信息；action=status 查询托管服务状态；action=findFiles 按前缀查找文件；action=listFiles 列出全部托管文件；action=domainStatus 查询自定义域名的当前状态与配置。该工具不会产生任何副作用。',
+        inputSchema: queryHostingInputSchema,
         annotations: {
-            readOnlyHint: false,
-            destructiveHint: false,
-            idempotentHint: false,
+            readOnlyHint: true,
             openWorldHint: true,
-            category: "hosting"
-        }
-    }, async ({ localPath, cloudPath, files = [], ignore }) => {
-        const cloudbase = await getManager();
-        let result;
-        try {
-            result = await cloudbase.hosting.uploadFiles({
-                localPath,
-                cloudPath,
-                files,
-                ignore
-            });
-        }
-        catch (error) {
-            throw new Error(buildUploadFilesErrorMessage(error, localPath));
-        }
-        (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
-        const uploadResult = result;
-        // 获取环境信息
-        const envInfo = await cloudbase.env.getEnvInfo();
-        (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, envInfo);
-        const staticDomain = envInfo.EnvInfo?.StaticStorages?.[0]?.StaticDomain;
-        const accessUrl = buildHostingAccessUrl(staticDomain, cloudPath, localPath);
-        // Send deployment notification to CodeBuddy IDE
+            category: 'hosting',
+        },
+    }, async (args) => {
         try {
-            const envId = await (0, cloudbase_manager_js_1.getEnvId)(cloudBaseOptions);
-            // Extract project name from localPath
-            let projectName = "unknown";
-            if (localPath) {
-                try {
-                    // If localPath is a file, get parent directory name; if it's a directory, get directory name
-                    const stats = fs_1.default.statSync(localPath);
-                    if (stats.isFile()) {
-                        projectName = path_1.default.basename(path_1.default.dirname(localPath));
-                    }
-                    else {
-                        projectName = path_1.default.basename(localPath);
+            const input = args;
+            const cloudbase = await getManager();
+            switch (input.action) {
+                case 'websiteConfig': {
+                    const websiteConfig = await getHostingWebsiteConfig(cloudbase, server.logger);
+                    return (0, tool_result_js_1.buildJsonToolResult)({
+                        success: true,
+                        data: {
+                            action: 'websiteConfig',
+                            websiteConfig,
+                        },
+                        message: '已获取静态托管网站文档配置与站点域名信息。',
+                    });
+                }
+                case 'status': {
+                    const envId = await (0, cloudbase_manager_js_1.getEnvId)(cloudBaseOptions);
+                    const result = await callTcbHostingAction(cloudbase, 'DescribeStaticStore', { EnvId: envId }, server.logger);
+                    const hostingInfo = extractStaticStores(result);
+                    const current = normalizeHostingStatus(hostingInfo[0] ?? null);
+                    const normalizedHostingInfo = hostingInfo.map(item => normalizeHostingStatus(item));
+                    return (0, tool_result_js_1.buildJsonToolResult)({
+                        success: true,
+                        data: {
+                            action: 'status',
+                            enabled: hostingInfo.length > 0,
+                            current,
+                            hostingInfo: normalizedHostingInfo,
+                            result,
+                        },
+                        message: hostingInfo.length > 0
+                            ? '已获取静态托管服务状态。'
+                            : '静态托管服务当前未返回可用实例信息，可能尚未开通。',
+                    });
+                }
+                case 'findFiles': {
+                    if (!input.prefix) {
+                        throw new Error('queryHosting(action="findFiles") 需要提供 prefix，用于按前缀查找托管文件。');
                     }
+                    const result = await cloudbase.hosting.findFiles({
+                        prefix: input.prefix,
+                        marker: input.marker,
+                        maxKeys: input.maxKeys,
+                    });
+                    (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                    const normalizedFiles = normalizeFileFields(result);
+                    return (0, tool_result_js_1.buildJsonToolResult)({
+                        success: true,
+                        data: {
+                            action: 'findFiles',
+                            prefix: input.prefix,
+                            marker: input.marker,
+                            maxKeys: input.maxKeys,
+                            files: normalizedFiles,
+                            result,
+                        },
+                        message: `已按前缀 \`${input.prefix}\` 查询静态托管文件，共 ${Array.isArray(normalizedFiles) ? normalizedFiles.length : 0} 个。`,
+                    });
+                }
+                case 'listFiles': {
+                    const result = await cloudbase.hosting.listFiles();
+                    (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                    const normalizedFiles = normalizeFileFields(result);
+                    const maxKeys = input.maxKeys ?? 100;
+                    const start = input.marker ? parseInt(input.marker, 10) : 0;
+                    const paginatedFiles = normalizedFiles.slice(start, start + maxKeys);
+                    const nextMarker = start + maxKeys < normalizedFiles.length ? String(start + maxKeys) : undefined;
+                    return (0, tool_result_js_1.buildJsonToolResult)({
+                        success: true,
+                        data: {
+                            action: 'listFiles',
+                            files: paginatedFiles,
+                            totalCount: normalizedFiles.length,
+                            marker: input.marker,
+                            maxKeys,
+                            nextMarker,
+                            isTruncated: nextMarker !== undefined,
+                        },
+                        message: `已列出静态托管中的文件（第 ${start + 1}-${start + paginatedFiles.length} 个，共 ${normalizedFiles.length} 个）。${nextMarker ? ' 还有更多文件，可使用 nextMarker 继续查询。' : ''}`,
+                    });
                 }
-                catch (statErr) {
-                    // If stat fails, try to extract from path directly
-                    projectName = path_1.default.basename(localPath);
+                case 'domainStatus': {
+                    if (!input.domains || input.domains.length === 0) {
+                        throw new Error('queryHosting(action="domainStatus") 需要提供 domains 数组，例如 ["www.example.com"]。');
+                    }
+                    const result = await cloudbase.hosting.tcbCheckResource({
+                        domains: input.domains,
+                    });
+                    (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                    const summary = summarizeHostingDomainCheck(input.domains, result);
+                    const allMatched = summary.missingDomains.length === 0;
+                    return (0, tool_result_js_1.buildJsonToolResult)({
+                        success: true,
+                        data: {
+                            action: 'domainStatus',
+                            queriedDomains: input.domains,
+                            matchedDomains: summary.matchedDomains,
+                            missingDomains: summary.missingDomains,
+                            domainDetails: summary.domainDetails,
+                            ...(allMatched
+                                ? {}
+                                : {
+                                    propagation: {
+                                        requiresPolling: true,
+                                        pollTool: 'queryHosting',
+                                        pollAction: 'domainStatus',
+                                        pollIntervalSuggestionSeconds: 30,
+                                        timeoutSuggestionSeconds: 600,
+                                        successIndicator: '目标域名出现在返回结果中，并且相关状态字段显示为已生效。',
+                                    },
+                                    nextActions: [buildDomainStatusNextStep(summary.missingDomains)],
+                                }),
+                            result,
+                        },
+                        message: allMatched
+                            ? '已查询到目标静态托管域名配置。若这是绑定或修改后的确认步骤，请继续核对状态字段、证书信息和配置内容是否符合预期。'
+                            : '部分目标静态托管域名尚未在查询结果中出现。若这是绑定后的确认步骤，请继续调用 queryHosting(action="domainStatus") 直到结果收敛或达到超时。',
+                    });
                 }
             }
-            // Build console URL
-            const consoleUrl = `https://tcb.cloud.tencent.com/dev?envId=${envId}#/static-hosting`;
-            // Send notification
-            await (0, notification_js_1.sendDeployNotification)(server, {
-                deployType: 'hosting',
-                url: accessUrl,
-                projectId: envId,
-                projectName: projectName,
-                consoleUrl: consoleUrl
-            });
         }
-        catch (notifyErr) {
-            // Notification failure should not affect deployment flow
-            // Error is already logged in sendDeployNotification
+        catch (error) {
+            const toolPayloadResult = (0, tool_result_js_1.toolPayloadErrorToResult)(error);
+            if (toolPayloadResult) {
+                return toolPayloadResult;
+            }
+            return buildFailureResult(args.action, error);
         }
-        return {
-            content: [
-                {
-                    type: "text",
-                    text: JSON.stringify({
-                        ...uploadResult,
-                        staticDomain,
-                        message: "文件上传成功",
-                        accessUrl: accessUrl
-                    }, null, 2)
-                }
-            ]
-        };
     });
-    // deleteFiles - 删除静态网站托管文件
-    server.registerTool?.("deleteFiles", {
-        title: "删除静态文件",
-        description: "删除静态网站托管的文件或文件夹",
-        inputSchema: {
-            cloudPath: zod_1.z.string().describe("云端文件或文件夹路径"),
-            isDir: zod_1.z.boolean().default(false).describe("是否为文件夹")
-        },
+    server.registerTool('manageHosting', {
+        title: '管理静态托管',
+        description: '管理 CloudBase 静态托管的变更操作。action=upload 上传本地构建产物；action=delete 删除托管文件或目录（必须 confirm=true）；action=setWebsiteDocument 设置首页/错误页/路由规则；action=enableService 开通静态托管；action=bindDomain / unbindDomain / updateDomain 管理自定义域名；action=downloadFile / downloadDirectory 下载托管内容到本地。若任务只是查看配置、文件或域名状态，请改用 queryHosting。',
+        inputSchema: manageHostingInputSchema,
         annotations: {
             readOnlyHint: false,
             destructiveHint: true,
-            idempotentHint: true,
+            idempotentHint: false,
             openWorldHint: true,
-            category: "hosting"
-        }
-    }, async ({ cloudPath, isDir = false }) => {
-        const cloudbase = await getManager();
-        const result = await cloudbase.hosting.deleteFiles({
-            cloudPath,
-            isDir
-        });
-        (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
-        return {
-            content: [
-                {
-                    type: "text",
-                    text: JSON.stringify(result, null, 2)
-                }
-            ]
-        };
-    });
-    // findFiles - 搜索文件
-    server.registerTool?.("findFiles", {
-        title: "搜索静态文件",
-        description: "搜索静态网站托管的文件",
-        inputSchema: {
-            prefix: zod_1.z.string().describe("匹配前缀"),
-            marker: zod_1.z.string().optional().describe("起始对象键标记"),
-            maxKeys: zod_1.z.number().optional().describe("单次返回最大条目数")
+            category: 'hosting',
         },
-        annotations: {
-            readOnlyHint: true,
-            openWorldHint: true,
-            category: "hosting"
-        }
-    }, async ({ prefix, marker, maxKeys }) => {
-        const cloudbase = await getManager();
-        const result = await cloudbase.hosting.findFiles({
-            prefix,
-            marker,
-            maxKeys
-        });
-        (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
-        return {
-            content: [
-                {
-                    type: "text",
-                    text: JSON.stringify(result, null, 2)
+    }, async (args) => {
+        try {
+            const input = args;
+            ensureManageHostingActionAllowedInCloudMode(input);
+            const cloudbase = await getManager();
+            switch (input.action) {
+                case 'upload': {
+                    if ((!input.localPath || !input.cloudPath) && (!input.files || input.files.length === 0)) {
+                        throw new Error('manageHosting(action="upload") 需要提供 localPath + cloudPath，或提供 files 多文件上传列表。');
+                    }
+                    let result;
+                    try {
+                        result = await cloudbase.hosting.uploadFiles({
+                            localPath: input.localPath,
+                            cloudPath: input.cloudPath,
+                            files: input.files ?? [],
+                            ignore: input.ignore,
+                        });
+                    }
+                    catch (error) {
+                        throw new Error(buildUploadErrorMessage(error, input.localPath));
+                    }
+                    (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                    const staticDomain = await resolveHostingStaticDomain(cloudbase, server.logger);
+                    const accessUrl = buildHostingAccessUrl(staticDomain, input.cloudPath, input.localPath);
+                    try {
+                        const envId = await (0, cloudbase_manager_js_1.getEnvId)(cloudBaseOptions);
+                        let projectName = 'unknown';
+                        if (input.localPath) {
+                            try {
+                                const stats = fs_1.default.statSync(input.localPath);
+                                projectName = stats.isFile()
+                                    ? path_1.default.basename(path_1.default.dirname(input.localPath))
+                                    : path_1.default.basename(input.localPath);
+                            }
+                            catch {
+                                projectName = path_1.default.basename(input.localPath);
+                            }
+                        }
+                        await (0, notification_js_1.sendDeployNotification)(server, {
+                            deployType: 'hosting',
+                            url: accessUrl,
+                            projectId: envId,
+                            projectName,
+                            consoleUrl: `https://tcb.cloud.tencent.com/dev?envId=${envId}#/static-hosting`,
+                        });
+                    }
+                    catch {
+                        // Notification failure should not block uploads.
+                    }
+                    const uploadPrefix = input.cloudPath ?? input.files?.[0]?.cloudPath ?? '';
+                    return (0, tool_result_js_1.buildJsonToolResult)({
+                        success: true,
+                        data: {
+                            action: 'upload',
+                            localPath: input.localPath,
+                            cloudPath: input.cloudPath,
+                            files: input.files ?? [],
+                            ignore: input.ignore,
+                            staticDomain,
+                            accessUrl,
+                            result,
+                            nextActions: uploadPrefix ? [buildFindFilesNextStep(uploadPrefix.replace(/^\/+/, ''))] : undefined,
+                        },
+                        message: '静态托管文件上传成功。若需要校验上传结果，请继续调用 queryHosting(action="findFiles") 或 queryHosting(action="listFiles")。',
+                    });
                 }
-            ]
-        };
-    });
-    // domainManagement - 统一的域名管理工具
-    server.registerTool?.("domainManagement", {
-        title: "静态托管域名管理",
-        description: "统一的域名管理工具，支持绑定、解绑、查询和修改域名配置",
-        inputSchema: {
-            action: zod_1.z.enum(["create", "delete", "check", "modify"]).describe("操作类型: create=绑定域名, delete=解绑域名, check=查询域名配置, modify=修改域名配置"),
-            // 绑定域名参数
-            domain: zod_1.z.string().optional().describe("域名"),
-            certId: zod_1.z.string().optional().describe("证书ID（绑定域名时必需）"),
-            domains: zod_1.z.array(zod_1.z.string()).optional().describe("域名列表（查询配置时使用）"),
-            // 修改域名参数
-            domainId: zod_1.z.number().optional().describe("域名ID（修改配置时必需）"),
-            domainConfig: zod_1.z.object({
-                Refer: zod_1.z.object({
-                    Switch: zod_1.z.string(),
-                    RefererRules: zod_1.z.array(zod_1.z.object({
-                        RefererType: zod_1.z.string(),
-                        Referers: zod_1.z.array(zod_1.z.string()),
-                        AllowEmpty: zod_1.z.boolean()
-                    })).optional()
-                }).optional(),
-                Cache: zod_1.z.array(zod_1.z.object({
-                    RuleType: zod_1.z.string(),
-                    RuleValue: zod_1.z.string(),
-                    CacheTtl: zod_1.z.number()
-                })).optional(),
-                IpFilter: zod_1.z.object({
-                    Switch: zod_1.z.string(),
-                    FilterType: zod_1.z.string().optional(),
-                    Filters: zod_1.z.array(zod_1.z.string()).optional()
-                }).optional(),
-                IpFreqLimit: zod_1.z.object({
-                    Switch: zod_1.z.string(),
-                    Qps: zod_1.z.number().optional()
-                }).optional()
-            }).optional().describe("域名配置（修改配置时使用）")
-        },
-        annotations: {
-            readOnlyHint: false,
-            destructiveHint: false,
-            idempotentHint: false,
-            openWorldHint: true,
-            category: "hosting"
-        }
-    }, async ({ action, domain, certId, domains, domainId, domainConfig }) => {
-        const cloudbase = await getManager();
-        let result;
-        switch (action) {
-            case "create":
-                if (!domain || !certId) {
-                    throw new Error("绑定域名需要提供域名和证书ID");
+                case 'delete': {
+                    if (!input.cloudPath) {
+                        throw new Error('manageHosting(action="delete") 需要提供 cloudPath。');
+                    }
+                    if (!input.confirm) {
+                        throw new Error('manageHosting(action="delete") 是破坏性操作，必须显式传 confirm=true。');
+                    }
+                    const result = await cloudbase.hosting.deleteFiles({
+                        cloudPath: input.cloudPath,
+                        isDir: input.isDir ?? false,
+                    });
+                    (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                    // Post-validation: verify deletion was successful
+                    let deleteVerified = true;
+                    let verificationError;
+                    try {
+                        const checkResult = await cloudbase.hosting.findFiles({
+                            prefix: input.cloudPath,
+                            maxKeys: 1,
+                        });
+                        if (Array.isArray(checkResult) && checkResult.length > 0) {
+                            deleteVerified = false;
+                            verificationError = `删除后验证失败：文件仍在静态托管中`;
+                        }
+                    }
+                    catch (error) {
+                        // If query fails, assume deletion was successful
+                        // (file might have been deleted, causing query to return empty)
+                    }
+                    return (0, tool_result_js_1.buildJsonToolResult)({
+                        success: deleteVerified,
+                        data: {
+                            action: 'delete',
+                            cloudPath: input.cloudPath,
+                            isDir: input.isDir ?? false,
+                            result,
+                            verified: deleteVerified,
+                            ...(verificationError ? { error: verificationError } : {}),
+                        },
+                        message: deleteVerified
+                            ? `已删除静态托管${input.isDir ? '目录' : '文件'} \`${input.cloudPath}\`。`
+                            : `删除操作已提交，但验证发现文件可能未完全删除，请手动确认。`,
+                    });
                 }
-                result = await cloudbase.hosting.CreateHostingDomain({
-                    domain,
-                    certId
-                });
-                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
-                break;
-            case "delete":
-                if (!domain) {
-                    throw new Error("解绑域名需要提供域名");
+                case 'setWebsiteDocument': {
+                    if (!input.indexDocument) {
+                        throw new Error('manageHosting(action="setWebsiteDocument") 需要提供 indexDocument，例如 index.html。');
+                    }
+                    const result = await cloudbase.hosting.setWebsiteDocument({
+                        indexDocument: input.indexDocument,
+                        errorDocument: input.errorDocument,
+                        routingRules: input.routingRules,
+                    });
+                    (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                    return (0, tool_result_js_1.buildJsonToolResult)({
+                        success: true,
+                        data: {
+                            action: 'setWebsiteDocument',
+                            indexDocument: input.indexDocument,
+                            errorDocument: input.errorDocument,
+                            routingRules: input.routingRules,
+                            result,
+                            nextActions: [buildWebsiteConfigNextStep()],
+                        },
+                        message: '静态托管网站文档配置已提交。若需要确认最终配置，请继续调用 queryHosting(action="websiteConfig")。',
+                    });
                 }
-                result = await cloudbase.hosting.deleteHostingDomain({
-                    domain
-                });
-                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
-                break;
-            case "check":
-                if (!domains || domains.length === 0) {
-                    throw new Error("查询域名配置需要提供域名列表");
+                case 'enableService': {
+                    const envId = await (0, cloudbase_manager_js_1.getEnvId)(cloudBaseOptions);
+                    const result = await callTcbHostingAction(cloudbase, 'CreateStaticStore', { EnvId: envId }, server.logger);
+                    return (0, tool_result_js_1.buildJsonToolResult)({
+                        success: true,
+                        data: {
+                            action: 'enableService',
+                            asyncState: 'PENDING',
+                            result,
+                            nextActions: [buildStatusNextStep()],
+                        },
+                        message: '静态托管服务开通请求已提交。请继续调用 queryHosting(action="status") 确认服务是否已可用。',
+                    });
                 }
-                result = await cloudbase.hosting.tcbCheckResource({
-                    domains
-                });
-                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
-                break;
-            case "modify":
-                if (!domain || domainId === undefined || !domainConfig) {
-                    throw new Error("修改域名配置需要提供域名、域名ID和配置信息");
+                case 'bindDomain': {
+                    if (!input.domain || !input.certId) {
+                        throw new Error('manageHosting(action="bindDomain") 需要提供 domain 和 certId。');
+                    }
+                    const result = await cloudbase.hosting.CreateHostingDomain({
+                        domain: input.domain,
+                        certId: input.certId,
+                    });
+                    (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                    const taskStatus = await describeHostingDomainTask(cloudbase, cloudBaseOptions, server.logger);
+                    return (0, tool_result_js_1.buildJsonToolResult)(buildDomainMutationResult({
+                        action: 'bindDomain',
+                        domain: input.domain,
+                        certId: input.certId,
+                        result,
+                        taskStatus,
+                    }));
                 }
-                result = await cloudbase.hosting.tcbModifyAttribute({
-                    domain,
-                    domainId,
-                    domainConfig
-                });
-                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
-                break;
-            default:
-                throw new Error(`不支持的操作类型: ${action}`);
-        }
-        return {
-            content: [
-                {
-                    type: "text",
-                    text: JSON.stringify(result, null, 2)
+                case 'unbindDomain': {
+                    if (!input.domain) {
+                        throw new Error('manageHosting(action="unbindDomain") 需要提供 domain。');
+                    }
+                    if (!input.confirm) {
+                        throw new Error('manageHosting(action="unbindDomain") 会解绑现有自定义域名，必须显式传 confirm=true。');
+                    }
+                    const result = await cloudbase.hosting.deleteHostingDomain({
+                        domain: input.domain,
+                    });
+                    (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                    const taskStatus = await describeHostingDomainTask(cloudbase, cloudBaseOptions, server.logger);
+                    return (0, tool_result_js_1.buildJsonToolResult)(buildDomainMutationResult({
+                        action: 'unbindDomain',
+                        domain: input.domain,
+                        result,
+                        taskStatus,
+                    }));
                 }
-            ]
-        };
+                case 'updateDomain': {
+                    if (!input.domain || input.domainId === undefined || !input.domainConfig) {
+                        throw new Error('manageHosting(action="updateDomain") 需要同时提供 domain、domainId 和 domainConfig。');
+                    }
+                    const result = await cloudbase.hosting.tcbModifyAttribute({
+                        domain: input.domain,
+                        domainId: input.domainId,
+                        domainConfig: input.domainConfig,
+                    });
+                    (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                    const taskStatus = await describeHostingDomainTask(cloudbase, cloudBaseOptions, server.logger);
+                    return (0, tool_result_js_1.buildJsonToolResult)(buildDomainMutationResult({
+                        action: 'updateDomain',
+                        domain: input.domain,
+                        domainId: input.domainId,
+                        domainConfig: input.domainConfig,
+                        result,
+                        taskStatus,
+                    }));
+                }
+                case 'downloadFile': {
+                    if (!input.cloudPath || !input.localPath) {
+                        throw new Error('manageHosting(action="downloadFile") 需要同时提供 cloudPath 和 localPath，localPath 应包含目标文件名。');
+                    }
+                    const result = await cloudbase.hosting.downloadFile({
+                        cloudPath: input.cloudPath,
+                        localPath: input.localPath,
+                    });
+                    (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                    return (0, tool_result_js_1.buildJsonToolResult)({
+                        success: true,
+                        data: {
+                            action: 'downloadFile',
+                            cloudPath: input.cloudPath,
+                            localPath: input.localPath,
+                            result,
+                        },
+                        message: `已将静态托管文件 \`${input.cloudPath}\` 下载到本地路径 \`${input.localPath}\`。`,
+                    });
+                }
+                case 'downloadDirectory': {
+                    if (!input.cloudPath || !input.localPath) {
+                        throw new Error('manageHosting(action="downloadDirectory") 需要同时提供 cloudPath 和 localPath，localPath 应为本地目录路径。');
+                    }
+                    const result = await cloudbase.hosting.downloadDirectory({
+                        cloudPath: input.cloudPath,
+                        localPath: input.localPath,
+                    });
+                    (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
+                    return (0, tool_result_js_1.buildJsonToolResult)({
+                        success: true,
+                        data: {
+                            action: 'downloadDirectory',
+                            cloudPath: input.cloudPath,
+                            localPath: input.localPath,
+                            result,
+                        },
+                        message: `已将静态托管目录 \`${input.cloudPath}\` 下载到本地目录 \`${input.localPath}\`。`,
+                    });
+                }
+            }
+        }
+        catch (error) {
+            const toolPayloadResult = (0, tool_result_js_1.toolPayloadErrorToResult)(error);
+            if (toolPayloadResult) {
+                return toolPayloadResult;
+            }
+            return buildFailureResult(args.action, error);
+        }
     });
 }
 
@@ -12753,15 +13773,14 @@ const fs = __importStar(__webpack_require__(4421));
 const fsPromises = __importStar(__webpack_require__(7932));
 const http = __importStar(__webpack_require__(3782));
 const https = __importStar(__webpack_require__(3871));
-const net = __importStar(__webpack_require__(4357));
 const os = __importStar(__webpack_require__(8116));
 const path = __importStar(__webpack_require__(2521));
 const url_1 = __webpack_require__(6887);
 const zod_1 = __webpack_require__(2971);
-const dns = __importStar(__webpack_require__(7793));
+const remote_url_safety_js_1 = __webpack_require__(9192);
 // 常量定义
 const MAX_FILE_SIZE = 100 * 1024 * 1024; // 100MB
-const ALLOWED_PROTOCOLS = ["http:", "https:"];
+const MAX_REDIRECT_HOPS = 5;
 const ALLOWED_CONTENT_TYPES = [
     "text/",
     "image/",
@@ -12810,65 +13829,6 @@ function calculateDownloadPath(relativePath) {
     }
     return finalPath;
 }
-// 检查是否为内网 IP
-function isPrivateIP(ip) {
-    // 如果不是有效的 IP 地址，返回 true（保守处理）
-    if (!net.isIP(ip)) {
-        return true;
-    }
-    // 检查特殊地址
-    if (ip === '127.0.0.1' ||
-        ip === 'localhost' ||
-        ip === '::1' || // IPv6 本地回环
-        ip.startsWith('169.254.') || // 链路本地地址
-        ip.startsWith('0.')) { // 特殊用途地址
-        return true;
-    }
-    // 转换 IP 地址为长整数进行范围检查
-    const ipv4Parts = ip.split('.').map(part => parseInt(part, 10));
-    if (ipv4Parts.length === 4) {
-        const ipNum = ((ipv4Parts[0] << 24) >>> 0) + (ipv4Parts[1] << 16) + (ipv4Parts[2] << 8) + ipv4Parts[3];
-        // 检查私有 IP 范围
-        // 10.0.0.0 - 10.255.255.255
-        if (ipNum >= 167772160 && ipNum <= 184549375)
-            return true;
-        // 172.16.0.0 - 172.31.255.255
-        if (ipNum >= 2886729728 && ipNum <= 2887778303)
-            return true;
-        // 192.168.0.0 - 192.168.255.255
-        if (ipNum >= 3232235520 && ipNum <= 3232301055)
-            return true;
-    }
-    // 检查 IPv6 私有地址
-    if (net.isIPv6(ip)) {
-        const normalizedIP = ip.toLowerCase();
-        if (normalizedIP.startsWith('fc00:') || // 唯一本地地址
-            normalizedIP.startsWith('fe80:') || // 链路本地地址
-            normalizedIP.startsWith('fec0:') || // 站点本地地址
-            normalizedIP.startsWith('::1')) { // 本地回环
-            return true;
-        }
-    }
-    return false;
-}
-// 检查域名是否解析到内网 IP
-async function doesDomainResolveToPrivateIP(hostname) {
-    try {
-        const addresses = await new Promise((resolve, reject) => {
-            dns.resolve(hostname, (err, addresses) => {
-                if (err)
-                    reject(err);
-                else
-                    resolve(addresses);
-            });
-        });
-        return addresses.some(ip => isPrivateIP(ip));
-    }
-    catch (error) {
-        // 如果解析失败，为安全起见返回 true
-        return true;
-    }
-}
 // 生成随机文件名
 function generateRandomFileName(extension = '') {
     const randomBytes = crypto.randomBytes(16);
@@ -12919,45 +13879,52 @@ function getFileExtension(url, contentType, contentDisposition) {
     }
     return extension;
 }
-// 验证 URL 和内容类型是否安全
-async function isUrlAndContentTypeSafe(url, contentType) {
-    try {
-        const parsedUrl = new url_1.URL(url);
-        // 检查协议
-        if (!ALLOWED_PROTOCOLS.includes(parsedUrl.protocol)) {
-            return false;
-        }
-        // 检查主机名是否为 IP 地址
-        const hostname = parsedUrl.hostname;
-        if (net.isIP(hostname) && isPrivateIP(hostname)) {
-            return false;
-        }
-        // 如果是域名，检查它是否解析到内网 IP
-        if (!net.isIP(hostname) && await doesDomainResolveToPrivateIP(hostname)) {
-            return false;
-        }
-        // 检查内容类型
-        return ALLOWED_CONTENT_TYPES.some(allowedType => contentType.startsWith(allowedType));
-    }
-    catch {
-        return false;
-    }
+function isAllowedContentType(contentType) {
+    return ALLOWED_CONTENT_TYPES.some((allowedType) => contentType.startsWith(allowedType));
+}
+// 检查是否为可重试的网络错误
+function isRetryableError(error) {
+    const retryableCodes = [
+        'ECONNRESET',
+        'ECONNREFUSED',
+        'ETIMEDOUT',
+        'ESOCKETTIMEDOUT',
+        'ENOTFOUND',
+        'EHOSTUNREACH',
+        'ENETUNREACH',
+        'ECONNABORTED'
+    ];
+    return retryableCodes.includes(error.code || '');
 }
-// 下载文件到指定路径
-function downloadFileToPath(url, targetPath) {
+// 下载文件到指定路径（带重试逻辑）
+async function downloadFileToPath(url, targetPath, retryCount = 0, redirectCount = 0) {
+    const MAX_RETRIES = 3;
+    const BASE_DELAY_MS = 1000; // 1秒基础延迟
+    if (redirectCount > MAX_REDIRECT_HOPS) {
+        throw new Error(`重定向次数超过 ${MAX_REDIRECT_HOPS} 次限制`);
+    }
+    const { requestUrl, requestOptions } = await (0, remote_url_safety_js_1.prepareSafeRemoteRequest)(url);
+    const client = requestUrl.protocol === "https:" ? https : http;
     return new Promise((resolve, reject) => {
-        const client = url.startsWith('https:') ? https : http;
-        client.get(url, async (res) => {
+        const request = client.get(requestUrl, requestOptions ?? {}, async (res) => {
+            // 处理重定向
+            if (res.statusCode && res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
+                try {
+                    const redirectUrl = new url_1.URL(res.headers.location, requestUrl).toString();
+                    return resolve(await downloadFileToPath(redirectUrl, targetPath, retryCount, redirectCount + 1));
+                }
+                catch (error) {
+                    return reject(error);
+                }
+            }
             if (res.statusCode !== 200) {
                 reject(new Error(`HTTP Error: ${res.statusCode}`));
                 return;
             }
-            const contentType = res.headers['content-type'] || '';
-            const contentLength = parseInt(res.headers['content-length'] || '0', 10);
-            const contentDisposition = res.headers['content-disposition'];
-            // 安全检查
-            if (!await isUrlAndContentTypeSafe(url, contentType)) {
-                reject(new Error('不安全的 URL 或内容类型，或者目标为内网地址'));
+            const contentType = res.headers["content-type"] || "";
+            const contentLength = parseInt(res.headers["content-length"] || "0", 10);
+            if (!isAllowedContentType(contentType)) {
+                reject(new Error(`不允许的内容类型: ${contentType || "unknown"}`));
                 return;
             }
             // 文件大小检查
@@ -12971,13 +13938,13 @@ function downloadFileToPath(url, targetPath) {
                 await fsPromises.mkdir(targetDir, { recursive: true });
             }
             catch (error) {
-                reject(new Error(`无法创建目标目录: ${error instanceof Error ? error.message : '未知错误'}`));
+                reject(new Error(`无法创建目标目录: ${error instanceof Error ? error.message : "未知错误"}`));
                 return;
             }
             // 创建写入流
             const fileStream = fs.createWriteStream(targetPath);
             let downloadedSize = 0;
-            res.on('data', (chunk) => {
+            res.on("data", (chunk) => {
                 downloadedSize += chunk.length;
                 if (downloadedSize > MAX_FILE_SIZE) {
                     fileStream.destroy();
@@ -12986,37 +13953,65 @@ function downloadFileToPath(url, targetPath) {
                 }
             });
             res.pipe(fileStream);
-            fileStream.on('finish', () => {
+            fileStream.on("finish", () => {
                 resolve({
                     filePath: targetPath,
                     contentType,
-                    fileSize: downloadedSize
+                    fileSize: downloadedSize,
                 });
             });
-            fileStream.on('error', (error) => {
+            fileStream.on("error", (error) => {
                 fsPromises.unlink(targetPath).catch(() => { });
                 reject(error);
             });
-        }).on('error', (error) => {
+        });
+        request.on("error", async (error) => {
+            // 检查是否可重试
+            if (isRetryableError(error) && retryCount < MAX_RETRIES) {
+                const delay = BASE_DELAY_MS * Math.pow(2, retryCount); // 指数退避
+                console.warn(`下载失败 (${error.code})，${delay}ms 后重试 (${retryCount + 1}/${MAX_RETRIES})...`);
+                await new Promise((resolveDelay) => setTimeout(resolveDelay, delay));
+                try {
+                    return resolve(await downloadFileToPath(url, targetPath, retryCount + 1, redirectCount));
+                }
+                catch (retryError) {
+                    return reject(retryError);
+                }
+            }
             reject(error);
         });
     });
 }
-// 下载文件到临时目录（保持向后兼容）
-function downloadFile(url) {
+// 下载文件到临时目录（保持向后兼容，带重试逻辑）
+async function downloadFile(url, retryCount = 0, redirectCount = 0) {
+    const MAX_RETRIES = 3;
+    const BASE_DELAY_MS = 1000; // 1秒基础延迟
+    if (redirectCount > MAX_REDIRECT_HOPS) {
+        throw new Error(`重定向次数超过 ${MAX_REDIRECT_HOPS} 次限制`);
+    }
+    const { requestUrl, requestOptions } = await (0, remote_url_safety_js_1.prepareSafeRemoteRequest)(url);
+    const client = requestUrl.protocol === "https:" ? https : http;
     return new Promise((resolve, reject) => {
-        const client = url.startsWith('https:') ? https : http;
-        client.get(url, async (res) => {
+        const request = client.get(requestUrl, requestOptions ?? {}, async (res) => {
+            // 处理重定向
+            if (res.statusCode && res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
+                try {
+                    const redirectUrl = new url_1.URL(res.headers.location, requestUrl).toString();
+                    return resolve(await downloadFile(redirectUrl, retryCount, redirectCount + 1));
+                }
+                catch (error) {
+                    return reject(error);
+                }
+            }
             if (res.statusCode !== 200) {
                 reject(new Error(`HTTP Error: ${res.statusCode}`));
                 return;
             }
-            const contentType = res.headers['content-type'] || '';
-            const contentLength = parseInt(res.headers['content-length'] || '0', 10);
-            const contentDisposition = res.headers['content-disposition'];
-            // 安全检查
-            if (!await isUrlAndContentTypeSafe(url, contentType)) {
-                reject(new Error('不安全的 URL 或内容类型，或者目标为内网地址'));
+            const contentType = res.headers["content-type"] || "";
+            const contentLength = parseInt(res.headers["content-length"] || "0", 10);
+            const contentDisposition = res.headers["content-disposition"];
+            if (!isAllowedContentType(contentType)) {
+                reject(new Error(`不允许的内容类型: ${contentType || "unknown"}`));
                 return;
             }
             // 文件大小检查
@@ -13025,13 +14020,13 @@ function downloadFile(url) {
                 return;
             }
             // 生成临时文件路径
-            const extension = getFileExtension(url, contentType, contentDisposition);
+            const extension = getFileExtension(requestUrl.toString(), contentType, contentDisposition);
             const fileName = generateRandomFileName(extension);
             const filePath = getSafeTempFilePath(fileName);
             // 创建写入流
             const fileStream = fs.createWriteStream(filePath);
             let downloadedSize = 0;
-            res.on('data', (chunk) => {
+            res.on("data", (chunk) => {
                 downloadedSize += chunk.length;
                 if (downloadedSize > MAX_FILE_SIZE) {
                     fileStream.destroy();
@@ -13040,18 +14035,31 @@ function downloadFile(url) {
                 }
             });
             res.pipe(fileStream);
-            fileStream.on('finish', () => {
+            fileStream.on("finish", () => {
                 resolve({
                     filePath,
                     contentType,
-                    fileSize: downloadedSize
+                    fileSize: downloadedSize,
                 });
             });
-            fileStream.on('error', (error) => {
+            fileStream.on("error", (error) => {
                 fsPromises.unlink(filePath).catch(() => { });
                 reject(error);
             });
-        }).on('error', (error) => {
+        });
+        request.on("error", async (error) => {
+            // 检查是否可重试
+            if (isRetryableError(error) && retryCount < MAX_RETRIES) {
+                const delay = BASE_DELAY_MS * Math.pow(2, retryCount); // 指数退避
+                console.warn(`下载失败 (${error.code})，${delay}ms 后重试 (${retryCount + 1}/${MAX_RETRIES})...`);
+                await new Promise((resolveDelay) => setTimeout(resolveDelay, delay));
+                try {
+                    return resolve(await downloadFile(url, retryCount + 1, redirectCount));
+                }
+                catch (retryError) {
+                    return reject(retryError);
+                }
+            }
             reject(error);
         });
     });
@@ -13064,7 +14072,8 @@ function buildDownloadRemoteFileErrorMessage(url, error) {
         suggestions.push("请先在浏览器中确认该链接可访问，再重新执行下载。");
     }
     if (/ENOTFOUND|ECONNRESET|ETIMEDOUT|socket hang up/i.test(baseMessage)) {
-        suggestions.push("下载过程中出现网络异常，建议检查本地网络或代理后重试。");
+        suggestions.push("下载过程中出现网络异常，系统已自动重试 3 次但均失败。");
+        suggestions.push("建议：1) 检查本地网络或代理设置；2) 该网站可能限频，请尝试更换其他图片源（如 Unsplash、Pexels）；3) 稍后重试。");
     }
     if (suggestions.length === 0) {
         suggestions.push("请检查 URL 是否可访问，以及目标资源是否允许直接下载。");
@@ -13135,6 +14144,191 @@ function registerDownloadTools(server) {
 }
 
 
+/***/ }),
+
+/***/ 9192:
+/***/ (function(__unused_webpack_module, exports, __webpack_require__) {
+
+
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.isPrivateIP = isPrivateIP;
+exports.prepareSafeRemoteRequest = prepareSafeRemoteRequest;
+exports.assertRemoteUrlSafe = assertRemoteUrlSafe;
+exports.getRemoteUrlSafetyErrorMessage = getRemoteUrlSafetyErrorMessage;
+const dns = __importStar(__webpack_require__(7793));
+const net = __importStar(__webpack_require__(4357));
+const url_1 = __webpack_require__(6887);
+const ALLOWED_PROTOCOLS = new Set(["http:", "https:"]);
+const DISALLOWED_ERROR_MESSAGE = "不安全的 URL 或目标为内网地址";
+function ipv4ToNumber(ip) {
+    const parts = ip.split(".").map((part) => Number.parseInt(part, 10));
+    return ((parts[0] << 24) >>> 0) + (parts[1] << 16) + (parts[2] << 8) + parts[3];
+}
+function isIpv4InRange(ip, start, end) {
+    const ipNumber = ipv4ToNumber(ip);
+    return ipNumber >= ipv4ToNumber(start) && ipNumber <= ipv4ToNumber(end);
+}
+function normalizeIpAddress(ip) {
+    const normalized = ip.toLowerCase();
+    if (normalized.startsWith("::ffff:")) {
+        const mappedIpv4 = normalized.slice(7);
+        if (net.isIPv4(mappedIpv4)) {
+            return mappedIpv4;
+        }
+    }
+    return normalized;
+}
+function isPrivateIP(ip) {
+    const normalizedIp = normalizeIpAddress(ip);
+    if (!net.isIP(normalizedIp)) {
+        return true;
+    }
+    if (net.isIPv4(normalizedIp)) {
+        return [
+            ["0.0.0.0", "0.255.255.255"],
+            ["10.0.0.0", "10.255.255.255"],
+            ["100.64.0.0", "100.127.255.255"],
+            ["127.0.0.0", "127.255.255.255"],
+            ["169.254.0.0", "169.254.255.255"],
+            ["172.16.0.0", "172.31.255.255"],
+            ["192.0.0.0", "192.0.0.255"],
+            ["192.0.2.0", "192.0.2.255"],
+            ["192.168.0.0", "192.168.255.255"],
+            ["198.18.0.0", "198.19.255.255"],
+            ["198.51.100.0", "198.51.100.255"],
+            ["203.0.113.0", "203.0.113.255"],
+            ["224.0.0.0", "255.255.255.255"],
+        ].some(([start, end]) => isIpv4InRange(normalizedIp, start, end));
+    }
+    return normalizedIp === "::" ||
+        normalizedIp === "::1" ||
+        normalizedIp.startsWith("fc") ||
+        normalizedIp.startsWith("fd") ||
+        normalizedIp.startsWith("fe8") ||
+        normalizedIp.startsWith("fe9") ||
+        normalizedIp.startsWith("fea") ||
+        normalizedIp.startsWith("feb") ||
+        normalizedIp.startsWith("fec0:") ||
+        normalizedIp.startsWith("ff") ||
+        normalizedIp.startsWith("2001:db8:");
+}
+async function resolveSafeAddresses(hostname) {
+    let resolvedAddresses;
+    try {
+        resolvedAddresses = await dns.promises.lookup(hostname, {
+            all: true,
+            verbatim: true,
+        });
+    }
+    catch {
+        throw new Error(DISALLOWED_ERROR_MESSAGE);
+    }
+    if (resolvedAddresses.length === 0) {
+        throw new Error(DISALLOWED_ERROR_MESSAGE);
+    }
+    const normalizedAddresses = resolvedAddresses.map(({ address, family }) => ({
+        address: normalizeIpAddress(address),
+        family,
+    }));
+    if (normalizedAddresses.some(({ address }) => isPrivateIP(address))) {
+        throw new Error(DISALLOWED_ERROR_MESSAGE);
+    }
+    return normalizedAddresses.filter((candidate, index, collection) => collection.findIndex(({ address, family }) => address === candidate.address && family === candidate.family) === index);
+}
+function createPinnedLookup(addresses) {
+    return ((hostname, options, callback) => {
+        const normalizedOptions = typeof options === "number" ? { family: options } : (options ?? {});
+        const family = normalizedOptions.family;
+        const candidates = family === 4 || family === 6
+            ? addresses.filter((address) => address.family === family)
+            : addresses;
+        if (candidates.length === 0) {
+            const error = Object.assign(new Error(`No safe address resolved for ${hostname}`), {
+                code: "ENOTFOUND",
+            });
+            callback(error);
+            return;
+        }
+        if (normalizedOptions.all) {
+            callback(null, candidates);
+            return;
+        }
+        callback(null, candidates[0].address, candidates[0].family);
+    });
+}
+async function prepareSafeRemoteRequest(url) {
+    let requestUrl;
+    try {
+        requestUrl = new url_1.URL(url);
+    }
+    catch {
+        throw new Error(DISALLOWED_ERROR_MESSAGE);
+    }
+    if (!ALLOWED_PROTOCOLS.has(requestUrl.protocol)) {
+        throw new Error(DISALLOWED_ERROR_MESSAGE);
+    }
+    const hostname = requestUrl.hostname;
+    if (!hostname) {
+        throw new Error(DISALLOWED_ERROR_MESSAGE);
+    }
+    if (hostname.toLowerCase() === "localhost") {
+        throw new Error(DISALLOWED_ERROR_MESSAGE);
+    }
+    if (net.isIP(hostname)) {
+        if (isPrivateIP(hostname)) {
+            throw new Error(DISALLOWED_ERROR_MESSAGE);
+        }
+        return { requestUrl };
+    }
+    const safeAddresses = await resolveSafeAddresses(hostname);
+    return {
+        requestUrl,
+        requestOptions: {
+            lookup: createPinnedLookup(safeAddresses),
+        },
+    };
+}
+async function assertRemoteUrlSafe(url) {
+    await prepareSafeRemoteRequest(url);
+}
+function getRemoteUrlSafetyErrorMessage() {
+    return DISALLOWED_ERROR_MESSAGE;
+}
+
+
 /***/ }),
 
 /***/ 9322:
@@ -13400,8 +14594,7 @@ function shouldRegisterTool(toolName) {
         'auth',
         // Storage tools - local file uploads
         'uploadFile',
-        // Hosting tools - local file uploads  
-        'uploadFiles',
+        // Hosting tools - action-level cloud gating is handled inside manageHosting
         // Function tools - local code uploads
         'updateFunctionCode',
         'createFunction', // also involves local files