@cloudbase/cloudbase-mcp 2.23.5 → 2.23.7

package/dist/index.js

@@ -261,13 +261,14 @@ async function fetchAvailableEnvCandidates(cloudBaseOptions, server) {
         return [];
     }
 }
-const CODEBUDDY_AUTH_ACTIONS = ["status", "set_env"];
+const CODEBUDDY_AUTH_ACTIONS = ["status", "set_env", "login_by_api_key"];
 const DEFAULT_AUTH_ACTIONS = [
     "status",
     "start_auth",
     "set_env",
     "logout",
     "get_temp_credentials",
+    "login_by_api_key",
 ];
 function maskSensitiveValue(value) {
     if (value.length <= 4) {
@@ -593,7 +594,7 @@ async function enrichEnvInfoWithBilling(params) {
  *   for new code, including an explicit `MysqlNotAvailable` line when
  *   MySQL is absent — that one IS a hard "do not use" signal.
  */
-function enrichEnvInfoWithRuntimeMode(result) {
+async function enrichEnvInfoWithRuntimeMode(result, manager) {
     const envInfo = result?.EnvInfo;
     if (!envInfo || typeof envInfo !== "object") {
         return result;
@@ -623,7 +624,29 @@ function enrichEnvInfoWithRuntimeMode(result) {
         }
         return [];
     })();
-    const hasMysql = mysqlList.length > 0;
+    let hasMysql = mysqlList.length > 0;
+    // Fallback: if MySQL not detected from DescribeEnvInfo fields, probe via
+    // DescribeMySQLClusterDetail (dedicated MySQL API). This covers cases where
+    // the SDK strips MySQL fields from the DescribeEnvInfo response.
+    if (!hasMysql && manager?.commonService) {
+        try {
+            const probeResult = await manager
+                .commonService("tcb", "2018-06-08")
+                .call({
+                Action: "DescribeMySQLClusterDetail",
+                Param: { EnvId: envInfo.EnvId },
+            });
+            const clusterId = probeResult?.DbClusterId ||
+                probeResult?.Response?.DbClusterId ||
+                probeResult?.Data?.DbClusterId;
+            if (clusterId) {
+                hasMysql = true;
+            }
+        }
+        catch {
+            // Probe failure means MySQL is not provisioned — keep hasMysql = false
+        }
+    }
     // Primary mode: prefer PG when it is provisioned, otherwise fall back to
     // legacy NoSQL labeling. This drives "what skill to read first / what API
     // to reach for when starting new business code".
@@ -641,7 +664,7 @@ function enrichEnvInfoWithRuntimeMode(result) {
                 : "No legacy NoSQL Database/Storage observed in this env.",
             MysqlNotAvailable: hasMysql
                 ? "MySQL instance(s) detected — see EnvInfo.MysqlInstances."
-                : "No MySQL instance is provisioned for this env. Do NOT use `manageSqlDatabase` / `querySqlDatabase` (those are MySQL-specific) and do NOT read the `relational-database-tool` skill — that family targets MySQL, not CloudBase PG.",
+                : "No MySQL instance is provisioned for this env. Do NOT use `manageMysqlDatabase` / `queryMysqlDatabase` (those are MySQL-specific) and do NOT read the `relational-database-tool` skill — that family targets MySQL, not CloudBase PG.",
             RecommendedSkills: "Read `postgresql-development` first for new PG code. `no-sql-web-sdk` is still applicable for existing NoSQL collections in this env. Skip `relational-database-tool` (MySQL-only) entirely.",
         }
         : {
@@ -651,7 +674,7 @@ function enrichEnvInfoWithRuntimeMode(result) {
             Storage: "Browser uploads use `app.uploadFile()` against the bucket exposed in `EnvInfo.Storages[].Bucket`.",
             MysqlNotAvailable: hasMysql
                 ? "MySQL instance(s) detected — see EnvInfo.MysqlInstances."
-                : "No MySQL instance in this env. `manageSqlDatabase` / `querySqlDatabase` and the `relational-database-tool` skill are not applicable.",
+                : "No MySQL instance in this env. `manageMysqlDatabase` / `queryMysqlDatabase` and the `relational-database-tool` skill are not applicable.",
             RecommendedSkills: "Read `no-sql-web-sdk` (and `cloud-storage-web` for uploads). `postgresql-development` and `relational-database-tool` are not applicable to this env.",
         };
     return {
@@ -802,12 +825,12 @@ function registerEnvTools(server) {
     if (server.ide !== 'wxide') {
         server.registerTool?.("auth", {
             title: "CloudBase 开发阶段登录与环境",
-            description: "CloudBase（腾讯云开发）开发阶段登录与环境绑定。登录后即可访问云资源；环境(env)是云函数、数据库、静态托管等资源的隔离单元，绑定环境后其他 MCP 工具才能操作该环境。支持：查询状态、发起登录、绑定环境(set_env)、退出登录。",
+            description: "CloudBase（腾讯云开发）开发阶段登录与环境绑定。登录后即可访问云资源；环境(env)是云函数、数据库、静态托管等资源的隔离单元，绑定环境后其他 MCP 工具才能操作该环境。支持：查询状态、发起登录、API Key登录、绑定环境(set_env)、退出登录。",
             inputSchema: {
                 action: zod_1.z
                     .enum(authActionEnum)
                     .optional()
-                    .describe("动作：status=查询状态，start_auth=发起登录，set_env=绑定环境(传envId)，logout=退出登录"),
+                    .describe("动作：status=查询状态，start_auth=发起登录，login_by_api_key=API Key登录，set_env=绑定环境(传envId)，logout=退出登录"),
                 ...(supportedAuthActions.includes("start_auth")
                     ? {
                         authMode: zod_1.z
@@ -832,6 +855,18 @@ function registerEnvTools(server) {
                     .string()
                     .optional()
                     .describe("环境ID(CloudBase 环境唯一标识)，绑定后工具将操作该环境。action=set_env 时必填"),
+                ...(supportedAuthActions.includes("login_by_api_key")
+                    ? {
+                        apiKey: zod_1.z
+                            .string()
+                            .optional()
+                            .describe("CloudBase API Key，action=login_by_api_key 时必填"),
+                        apiKeyEnvId: zod_1.z
+                            .string()
+                            .optional()
+                            .describe("CloudBase 环境ID(EnvId)，action=login_by_api_key 时必填，用于指定 API Key 所属环境"),
+                    }
+                    : {}),
                 ...(supportedAuthActions.includes("logout")
                     ? {
                         confirm: zod_1.z
@@ -1147,6 +1182,78 @@ function registerEnvTools(server) {
                         next_step: envPreparation.nextStep,
                     });
                 }
+                if (action === "login_by_api_key") {
+                    const toolApiKey = normalizeOptionalToolString(rawArgs.apiKey);
+                    const toolApiKeyEnvId = normalizeOptionalToolString(rawArgs.apiKeyEnvId);
+                    if (!toolApiKey || !toolApiKeyEnvId) {
+                        return (0, tool_result_js_1.buildJsonToolResult)({
+                            ok: false,
+                            code: "INVALID_ARGS",
+                            message: "action=login_by_api_key 时必须同时提供 apiKey 和 envId。",
+                            next_step: (0, tool_result_js_1.buildAuthNextStep)("login_by_api_key", {
+                                suggestedArgs: { action: "login_by_api_key", apiKey: "<your-api-key>", envId: "<your-env-id>" },
+                            }),
+                        });
+                    }
+                    // 写入 process.env（与 cli.ts 处理 --api-key/--env-id 的逻辑一致）
+                    process.env.CLOUDBASE_API_KEY = toolApiKey;
+                    process.env.CLOUDBASE_ENV_ID = toolApiKeyEnvId;
+                    try {
+                        const loginState = await (0, auth_js_1.peekLoginState)();
+                        if (loginState) {
+                            const envPreparation = await prepareAuthEnvironment({
+                                server,
+                                cloudBaseOptions,
+                                loginState,
+                            });
+                            return (0, tool_result_js_1.buildJsonToolResult)({
+                                ok: true,
+                                code: "AUTH_READY",
+                                message: "API Key 认证成功，已获取临时密钥。",
+                                auth_mode: "api_key",
+                                ...buildAuthEnvSetupPayload(envPreparation),
+                                next_step: envPreparation.nextStep,
+                            });
+                        }
+                        // API Key 换取失败：清理 env vars 并返回诊断信息
+                        delete process.env.CLOUDBASE_API_KEY;
+                        delete process.env.CLOUDBASE_ENV_ID;
+                        let diagMessage = "API Key 换取临时密钥失败。";
+                        diagMessage += `\n\n诊断信息：`;
+                        diagMessage += `\n- CLOUDBASE_ENV_ID: ${toolApiKeyEnvId}`;
+                        diagMessage += `\n- CLOUDBASE_API_KEY: ${toolApiKey.slice(0, 20)}...（已截断）`;
+                        diagMessage += `\n\n可能原因：`;
+                        diagMessage += `\n1. API Key 已过期或被删除`;
+                        diagMessage += `\n2. CLOUDBASE_ENV_ID 与 API Key 所属环境不匹配`;
+                        diagMessage += `\n3. 网络连接问题`;
+                        diagMessage += `\n\n建议：请检查 API Key 和环境 ID 是否正确。`;
+                        return (0, tool_result_js_1.buildJsonToolResult)({
+                            ok: false,
+                            code: "API_KEY_AUTH_FAILED",
+                            message: diagMessage,
+                            auth_mode: "api_key",
+                            envId: toolApiKeyEnvId,
+                            next_step: (0, tool_result_js_1.buildAuthNextStep)("login_by_api_key", {
+                                suggestedArgs: { action: "login_by_api_key", apiKey: "<your-api-key>", envId: "<your-env-id>" },
+                            }),
+                        });
+                    }
+                    catch (error) {
+                        // 异常时清理 env vars
+                        delete process.env.CLOUDBASE_API_KEY;
+                        delete process.env.CLOUDBASE_ENV_ID;
+                        const message = error instanceof Error ? error.message : String(error);
+                        return (0, tool_result_js_1.buildJsonToolResult)({
+                            ok: false,
+                            code: "API_KEY_AUTH_FAILED",
+                            message: `API Key 认证异常: ${message}`,
+                            auth_mode: "api_key",
+                            next_step: (0, tool_result_js_1.buildAuthNextStep)("login_by_api_key", {
+                                suggestedArgs: { action: "login_by_api_key", apiKey: "<your-api-key>", envId: "<your-env-id>" },
+                            }),
+                        });
+                    }
+                }
                 if (action === "set_env") {
                     const loginState = await (0, auth_js_1.peekLoginState)();
                     if (!loginState) {
@@ -1415,7 +1522,7 @@ function registerEnvTools(server) {
                     if (envId) {
                         result = await enrichEnvInfoWithMissingFields(cloudbaseInfo, result, envId);
                     }
-                    result = enrichEnvInfoWithRuntimeMode(result);
+                    result = await enrichEnvInfoWithRuntimeMode(result, cloudbaseInfo);
                     break;
                 case "domains":
                     const cloudbaseDomains = await getManager();
@@ -1483,7 +1590,7 @@ function registerEnvTools(server) {
     // Register primary tool name (queryEnv)
     const queryEnvToolSchema = {
         title: "CloudBase 环境查询",
-        description: "查询 CloudBase 环境相关信息，支持查询环境列表、指定环境详情和安全域名。（曾用名：envQuery、listEnvs、getEnvInfo、getEnvAuthDomains）当 action=list 时，会按 DescribeEnvs 语义做列表/筛选，标准返回字段为 EnvId、Alias、Status、EnvType、Region、PackageId、PackageName、IsDefault，并支持通过 fields 白名单裁剪这些字段；aliasExact=true 时会按别名精确筛选，避免把前缀相近的环境误当作候选；即使传入 envId，action=list 也只返回摘要，不会返回完整资源明细或 expiry。如需查询某个已知 EnvId 对应环境的详细信息（包括资源字段和计费信息），必须使用 action=info 并传入目标环境的 envId 参数。action=info 会在可用时补充 BillingInfo（如 ExpireTime、PayMode、IsAutoRenew 等计费字段）。\n\n🔍 action=info 还会派生三个用于后端选型的字段：\n- `EnvInfo.RuntimeMode`：'postgresql' 或 'nosql'，表示新业务建议默认使用的后端（PG 已开通时为 postgresql，否则为 nosql）。\n- `EnvInfo.RuntimeBackends`：`{postgresql, nosql, mysql}` 三个布尔值，描述当前环境实际并存的后端。\n- `EnvInfo.RuntimeModeHints`：每个后端对应的 API/工具/skill 提示。\n\nAI 在写业务/权限/存储代码前必须先看这三项：PG 模式下新业务推荐 `app.rdb()` + RLS（`managePgDatabase action=execute` 跑 `CREATE POLICY`）+ pgstore；已存在的 NoSQL 集合 / 旧 storage / `managePermissions(resourceType=\"noSqlDatabase\")` 在 PG 环境下仍然有效。真正不适用的是 MySQL：当 `RuntimeBackends.mysql === false` 时，`manageSqlDatabase` / `querySqlDatabase` / `relational-database-tool` skill 都不该使用。",
+        description: "查询 CloudBase 环境相关信息，支持查询环境列表、指定环境详情和安全域名。（曾用名：envQuery、listEnvs、getEnvInfo、getEnvAuthDomains）当 action=list 时，会按 DescribeEnvs 语义做列表/筛选，标准返回字段为 EnvId、Alias、Status、EnvType、Region、PackageId、PackageName、IsDefault，并支持通过 fields 白名单裁剪这些字段；aliasExact=true 时会按别名精确筛选，避免把前缀相近的环境误当作候选；即使传入 envId，action=list 也只返回摘要，不会返回完整资源明细或 expiry。如需查询某个已知 EnvId 对应环境的详细信息（包括资源字段和计费信息），必须使用 action=info 并传入目标环境的 envId 参数。action=info 会在可用时补充 BillingInfo（如 ExpireTime、PayMode、IsAutoRenew 等计费字段）。\n\n🔍 action=info 还会派生三个用于后端选型的字段：\n- `EnvInfo.RuntimeMode`：'postgresql' 或 'nosql'，表示新业务建议默认使用的后端（PG 已开通时为 postgresql，否则为 nosql）。\n- `EnvInfo.RuntimeBackends`：`{postgresql, nosql, mysql}` 三个布尔值，描述当前环境实际并存的后端。\n- `EnvInfo.RuntimeModeHints`：每个后端对应的 API/工具/skill 提示。\n\nAI 在写业务/权限/存储代码前必须先看这三项：PG 模式下新业务推荐 `app.rdb()` + RLS（`managePgDatabase action=execute` 跑 `CREATE POLICY`）+ pgstore；已存在的 NoSQL 集合 / 旧 storage / `managePermissions(resourceType=\"noSqlDatabase\")` 在 PG 环境下仍然有效。真正不适用的是 MySQL：当 `RuntimeBackends.mysql === false` 时，`manageMysqlDatabase` / `queryMysqlDatabase` / `relational-database-tool` skill 都不该使用。",
         inputSchema: {
             action: zod_1.z
                 .enum(["list", "info", "domains"])
@@ -2095,7 +2202,7 @@ ${envIdSection}
 ## 环境信息
 - 操作系统: ${os_1.default.type()} ${os_1.default.release()}
 - Node.js版本: ${process.version}
-- MCP 版本：${process.env.npm_package_version || "2.23.5" || 0}
+- MCP 版本：${process.env.npm_package_version || "2.23.7" || 0}
 - 系统架构: ${os_1.default.arch()}
 - 时间: ${new Date().toISOString()}
 - 请求ID: ${requestId}
@@ -2176,7 +2283,7 @@ function createWrappedHandler(name, handler, server) {
                 requestId: (typeof error === 'object' && error && 'requestId' in error) ? error.requestId : '',
                 ide: server.ide || process.env.INTEGRATION_IDE || ''
             });
-            const mcpVersion =  true ? "2.23.5" : 0;
+            const mcpVersion =  true ? "2.23.7" : 0;
             const requestIdSuffix = requestId ? `\n🆔 RequestId: ${requestId}` : '';
             const enhancedErrorMessage = `${errorMessage}${requestIdSuffix}\n\n📦 CloudBase MCP v${mcpVersion}\n🔗 遇到问题？请复制以下链接到浏览器打开\n即可自动携带错误详情快速创建 GitHub Issue：\n${issueLink}`;
             // 创建新的错误对象，保持原有的错误类型但更新消息
@@ -2361,6 +2468,7 @@ const DEFAULT_PLUGINS = [
     "database",
     "pg_database",
     "pg_storage",
+    "mysql_database",
     "functions",
     "hosting",
     "storage",
@@ -2383,10 +2491,6 @@ function registerDatabase(server) {
     if (!(0, tencent_cloud_js_1.isInternationalRegion)(region)) {
         (0, databaseNoSQL_js_1.registerDatabaseTools)(server);
     }
-    const pgPluginEnabled = server.enabledPlugins?.some((pluginName) => pluginName === "pg_database" || pluginName === "pg_storage");
-    if (!pgPluginEnabled) {
-        (0, databaseSQL_js_1.registerSQLDatabaseTools)(server);
-    }
     (0, dataModel_js_1.registerDataModelTools)(server);
 }
 function registerMysqlDatabase(server) {
@@ -7348,6 +7452,7 @@ function registerGatewayTools(server) {
                 const cloudbase = await getManager();
                 const accessPath = input.path ? normalizeAccessPath(input.path) : undefined;
                 let resolvedAccessId = input.accessId;
+                let resolvedName;
                 if (!resolvedAccessId) {
                     if (!input.targetName && !accessPath) {
                         throw new Error("action=deleteAccess 时至少需要提供 accessId，或提供 targetName/path 用于定位入口");
@@ -7369,18 +7474,32 @@ function registerGatewayTools(server) {
                         throw new Error("匹配到多个访问入口，请补充 path 或直接传 accessId");
                     }
                     resolvedAccessId = candidates[0]?.APIId;
+                    resolvedName = candidates[0]?.Name;
+                }
+                else {
+                    // 仅传入 accessId 时，先查询获取 name 等信息，确保删除参数完整
+                    try {
+                        const accessList = await cloudbase.access.getAccessList({});
+                        const match = (accessList.APISet ?? []).find((item) => item.APIId === resolvedAccessId);
+                        if (match) {
+                            resolvedName = match.Name;
+                        }
+                    }
+                    catch {
+                        // 查询失败不影响主流程，继续用 accessId 删除
+                    }
                 }
                 if (!resolvedAccessId) {
                     throw new Error("无法解析访问入口 accessId，请改为显式传入 accessId");
                 }
                 const result = await cloudbase.access.deleteAccess({
-                    ...(input.targetName ? { name: input.targetName } : {}),
+                    ...(resolvedName ? { name: resolvedName } : {}),
                     apiId: resolvedAccessId,
                 });
                 (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
                 return buildEnvelope({
                     action: input.action,
-                    targetName: input.targetName ?? null,
+                    targetName: resolvedName ?? input.targetName ?? null,
                     path: accessPath ?? null,
                     accessId: resolvedAccessId,
                     raw: result,
@@ -8212,18 +8331,31 @@ function checkIfAgentProject(projectPath) {
     }
 }
 /**
- * Validate and normalize file path
+ * Validate and normalize file path.
+ * Accepts absolute paths as-is; for relative paths, resolves against CWD and
+ * ensures the result does not escape the CWD (path-traversal protection).
  * @param inputPath User provided path
  * @returns Absolute path
  */
 function validateAndNormalizePath(inputPath) {
-    let normalizedPath = path_1.default.resolve(inputPath);
-    // Security check - ensure path is within current working directory
+    const normalizedPath = path_1.default.resolve(inputPath);
+    // On Windows, path.resolve may return a path on a different drive/UNC share.
+    // That is safe — the user explicitly provided an absolute path there.
+    // Only apply the traversal check when the resolved path shares the same root
+    // as CWD (i.e. the path was relative or on the same drive).
     const cwd = process.cwd();
-    const prefix = cwd.endsWith(path_1.default.sep) ? cwd : cwd + path_1.default.sep;
-    if (!normalizedPath.startsWith(prefix) && normalizedPath !== cwd) {
-        throw new Error(`Path must be within current working directory: ${cwd}`);
-    }
+    const cwdRoot = path_1.default.parse(cwd).root;
+    const pathRoot = path_1.default.parse(normalizedPath).root;
+    if (cwdRoot === pathRoot) {
+        // Same filesystem root — ensure the resolved path is still inside CWD
+        // (or is exactly CWD) to block "../" traversal.
+        const prefix = cwd.endsWith(path_1.default.sep) ? cwd : cwd + path_1.default.sep;
+        if (!normalizedPath.startsWith(prefix) && normalizedPath !== cwd) {
+            throw new Error(`Path must be within current working directory: ${cwd}`);
+        }
+    }
+    // Cross-root absolute paths (e.g. D:\ on Windows when CWD is C:\) are
+    // allowed — the user own the machine and the path is explicitly absolute.
     return normalizedPath;
 }
 function buildManageCloudRunErrorMessage(action, serverName, error) {
@@ -9756,7 +9888,7 @@ class TelemetryReporter {
         const nodeVersion = process.version; // Node.js版本
         const arch = os_1.default.arch(); // 系统架构
         // 从构建时注入的版本号获取MCP版本信息
-        const mcpVersion = process.env.npm_package_version || "2.23.5" || 0;
+        const mcpVersion = process.env.npm_package_version || "2.23.7" || 0;
         return {
             userAgent: `${osType} ${osRelease} ${arch} ${nodeVersion} CloudBase-MCP/${mcpVersion}`,
             deviceId: this.deviceId,
@@ -13077,7 +13209,7 @@ function registerPermissionTools(server) {
     }));
     server.registerTool?.("managePermissions", {
         title: "管理 CloudBase 权限与用户配置",
-        description: "管理 CloudBase 权限与用户配置，支持修改资源权限（数据库/云函数/存储桶等）、角色管理、成员与策略增删、应用用户 CRUD。\n\n示例：\n- 设置存储桶为私有：`action=\"updateResourcePermission\", resourceType=\"storage\", resourceId=\"bucket-name\", permission=\"PRIVATE\"`\n- 创建角色：`action=\"createRole\", roleName=\"admin\", roleIdentity=\"admin\"`\n\n注意：`createUser` / `updateUser` 是环境侧应用用户管理能力，适合测试账号、管理员或预置用户，不应替代浏览器里的 Web SDK 注册表单；前端用户名密码注册应使用 `auth.signUp({ username, password })`，登录应使用 `auth.signInWithPassword({ username, password })`。直接在浏览器里用 `auth.signUp` 创建用户名密码用户取决于 SDK/provider 支持，使用前必须验证；不支持时应走后端或管理端边界，不能在浏览器暴露密钥。`securityRule` 的详细语义取决于 `resourceType`：`doc._openid`、`auth.openid`、查询条件子集校验，以及 `create` / `update` / `delete` JSON 模板仅适用于 `resourceType=\"noSqlDatabase\"` 的文档数据库安全规则；配置 `function` 或 `storage` 时，请参考各自官方安全规则文档，而不是复用 NoSQL 模板。\n\n📌 跨后端边界提示：调用前先用 `envQuery(action=\"info\", envId=...)` 看 `EnvInfo.RuntimeBackends`：\n- `resourceType=\"noSqlDatabase\"` 仅作用于 CloudBase NoSQL 文档数据库的集合；CloudBase PostgreSQL（PG）表的行级权限**不**受它控制——PG 表请改用 RLS：`managePgDatabase(action=\"execute\", confirm=true)` 跑 `ALTER TABLE ... ENABLE ROW LEVEL SECURITY` 与 `CREATE POLICY ...`。同一个 PG 环境里如果还有 NoSQL 集合在用，对那些**集合**继续使用 `noSqlDatabase` 规则是正确的——不是\"PG 环境就禁用本工具\"。\n- `resourceType=\"storage\"` 控制的是 NoSQL/COS 存储桶 ACL；PG 的 `pgstore` bucket 不在此 `resourceType` 覆盖范围内。\n- 本工具不涉及 MySQL；MySQL 数据库权限请走 MySQL 自身的 GRANT/REVOKE 语句（通过 `manageSqlDatabase`）。",
+        description: "管理 CloudBase 权限与用户配置，支持修改资源权限（数据库/云函数/存储桶等）、角色管理、成员与策略增删、应用用户 CRUD。\n\n示例：\n- 设置存储桶为私有：`action=\"updateResourcePermission\", resourceType=\"storage\", resourceId=\"bucket-name\", permission=\"PRIVATE\"`\n- 创建角色：`action=\"createRole\", roleName=\"admin\", roleIdentity=\"admin\"`\n\n注意：`createUser` / `updateUser` 是环境侧应用用户管理能力，适合测试账号、管理员或预置用户，不应替代浏览器里的 Web SDK 注册表单；前端用户名密码注册应使用 `auth.signUp({ username, password })`，登录应使用 `auth.signInWithPassword({ username, password })`。直接在浏览器里用 `auth.signUp` 创建用户名密码用户取决于 SDK/provider 支持，使用前必须验证；不支持时应走后端或管理端边界，不能在浏览器暴露密钥。`securityRule` 的详细语义取决于 `resourceType`：`doc._openid`、`auth.openid`、查询条件子集校验，以及 `create` / `update` / `delete` JSON 模板仅适用于 `resourceType=\"noSqlDatabase\"` 的文档数据库安全规则；配置 `function` 或 `storage` 时，请参考各自官方安全规则文档，而不是复用 NoSQL 模板。\n\n📌 跨后端边界提示：调用前先用 `envQuery(action=\"info\", envId=...)` 看 `EnvInfo.RuntimeBackends`：\n- `resourceType=\"noSqlDatabase\"` 仅作用于 CloudBase NoSQL 文档数据库的集合；CloudBase PostgreSQL（PG）表的行级权限**不**受它控制——PG 表请改用 RLS：`managePgDatabase(action=\"execute\", confirm=true)` 跑 `ALTER TABLE ... ENABLE ROW LEVEL SECURITY` 与 `CREATE POLICY ...`。同一个 PG 环境里如果还有 NoSQL 集合在用，对那些**集合**继续使用 `noSqlDatabase` 规则是正确的——不是\"PG 环境就禁用本工具\"。\n- `resourceType=\"storage\"` 控制的是 NoSQL/COS 存储桶 ACL；PG 的 `pgstore` bucket 不在此 `resourceType` 覆盖范围内。\n- 本工具不涉及 MySQL；MySQL 数据库权限请走 MySQL 自身的 GRANT/REVOKE 语句（通过 `manageMysqlDatabase`）。",
         inputSchema: {
             action: zod_1.z.enum(MANAGE_PERMISSION_ACTIONS),
             resourceType: zod_1.z
@@ -13767,7 +13899,7 @@ function registerSetupTools(server) {
     server.registerTool("downloadTemplate", {
         title: "下载项目模板",
         description: `自动下载并部署CloudBase项目模板。
-**Note**: Call this tool when the user requests to create a new project using a CloudBase template.\n\n支持的模板:\n- react: React + CloudBase 全栈应用模板\n- vue: Vue + CloudBase 全栈应用模板\n- miniprogram: 微信小程序 + 云开发模板  \n- uniapp: UniApp + CloudBase 跨端应用模板\n- rules: 只包含AI编辑器配置文件（包含Cursor、WindSurf、CodeBuddy等所有主流编辑器配置），适合在已有项目中补充AI编辑器配置\n\n支持的IDE类型:\n- all: 下载所有IDE配置\n- cursor: Cursor AI编辑器\n- 其他IDE类型见下方列表\n\n注意：如果未传入 ide 参数且无法从环境变量检测到 IDE，将提示错误并要求传入 ide 参数\n- windsurf: WindSurf AI编辑器\n- codebuddy: CodeBuddy AI编辑器\n- claude-code: Claude Code AI编辑器\n- cline: Cline AI编辑器\n- gemini-cli: Gemini CLI\n- opencode: OpenCode AI编辑器\n- qwen-code: 通义灵码\n- baidu-comate: 百度Comate\n- openai-codex-cli: OpenAI Codex CLI\n- augment-code: Augment Code\n- github-copilot: GitHub Copilot\n- roocode: RooCode AI编辑器\n- tongyi-lingma: 通义灵码\n- trae: Trae AI编辑器\n- qoder: Qoder AI编辑器\n- antigravity: Google Antigravity AI编辑器\n- vscode: Visual Studio Code\n- kiro: Kiro AI编辑器\n- aider: Aider AI编辑器\n\n特别说明：\n- rules 模板会自动包含当前 mcp 版本号信息（版本号：${ true ? "2.23.5" : 0}），便于后续维护和版本追踪\n- 下载 rules 模板时，如果项目中已存在 README.md 文件，系统会自动保护该文件不被覆盖（除非设置 overwrite=true）`,
+**Note**: Call this tool when the user requests to create a new project using a CloudBase template.\n\n支持的模板:\n- react: React + CloudBase 全栈应用模板\n- vue: Vue + CloudBase 全栈应用模板\n- miniprogram: 微信小程序 + 云开发模板  \n- uniapp: UniApp + CloudBase 跨端应用模板\n- rules: 只包含AI编辑器配置文件（包含Cursor、WindSurf、CodeBuddy等所有主流编辑器配置），适合在已有项目中补充AI编辑器配置\n\n支持的IDE类型:\n- all: 下载所有IDE配置\n- cursor: Cursor AI编辑器\n- 其他IDE类型见下方列表\n\n注意：如果未传入 ide 参数且无法从环境变量检测到 IDE，将提示错误并要求传入 ide 参数\n- windsurf: WindSurf AI编辑器\n- codebuddy: CodeBuddy AI编辑器\n- claude-code: Claude Code AI编辑器\n- cline: Cline AI编辑器\n- gemini-cli: Gemini CLI\n- opencode: OpenCode AI编辑器\n- qwen-code: 通义灵码\n- baidu-comate: 百度Comate\n- openai-codex-cli: OpenAI Codex CLI\n- augment-code: Augment Code\n- github-copilot: GitHub Copilot\n- roocode: RooCode AI编辑器\n- tongyi-lingma: 通义灵码\n- trae: Trae AI编辑器\n- qoder: Qoder AI编辑器\n- antigravity: Google Antigravity AI编辑器\n- vscode: Visual Studio Code\n- kiro: Kiro AI编辑器\n- aider: Aider AI编辑器\n\n特别说明：\n- rules 模板会自动包含当前 mcp 版本号信息（版本号：${ true ? "2.23.7" : 0}），便于后续维护和版本追踪\n- 下载 rules 模板时，如果项目中已存在 README.md 文件，系统会自动保护该文件不被覆盖（除非设置 overwrite=true）`,
         inputSchema: {
             template: zod_1.z
                 .enum(["react", "vue", "miniprogram", "uniapp", "rules"])
@@ -16920,6 +17052,18 @@ function buildErrorEnvelope(error) {
 function normalizeString(value) {
     return typeof value === "string" && value.trim().length > 0 ? value.trim() : undefined;
 }
+/**
+ * Sanitize agent name for CloudBase backend.
+ * The backend creates a cloud function alias from the agent name (e.g. "agent-{name}"),
+ * and SCF aliases only allow alphanumeric characters and hyphens.
+ * This function replaces any character that is not [a-zA-Z0-9] with a hyphen,
+ * then collapses consecutive hyphens into one.
+ */
+function sanitizeAgentName(name) {
+    return name
+        .replace(/[^a-zA-Z0-9]+/g, "-")
+        .replace(/^-+|-+$/g, "");
+}
 function normalizeNumber(value) {
     return typeof value === "number" && Number.isFinite(value) ? value : undefined;
 }
@@ -17074,13 +17218,19 @@ function registerAgentTools(server) {
                 }
                 // CloudBase 后端在创建 Agent 时会同步创建云函数，函数名/别名长度受 SCF 限制（最大 64 字符）。
                 // envId 可能被用作前缀或别名的一部分，因此这里预留足够余量，避免后端 CreateFunction 失败。
-                if (normalizedName.length > 30) {
-                    throw new Error(`agent name 过长（当前 ${normalizedName.length} 字符）。CloudBase 创建 Agent 时会同步创建云函数，` +
-                        `函数名/别名受 SCF 64 字符限制，且 envId 可能作为前缀拼接。请将 name 控制在 30 字符以内。`);
+                // 同时，后端会用 name 生成云函数 alias（如 "agent-{name}"），而 SCF alias 只允许字母、数字和连字符，
+                // 因此需要对 name 做 sanitize，将非法字符（如下划线）替换为连字符。
+                const sanitizedName = sanitizeAgentName(normalizedName);
+                if (!sanitizedName) {
+                    throw new Error(`name "${normalizedName}" 经 sanitize 后为空，请使用包含字母或数字的 name`);
+                }
+                if (sanitizedName.length > 30) {
+                    throw new Error(`agent name 过长（当前 ${sanitizedName.length} 字符）。CloudBase 创建 Agent 时会同步创建云函数，` +
+                        `函数名/别名受 SCF 64 字符长度限制，且 envId 可能作为前缀拼接。请将 name 控制在 30 字符以内。`);
                 }
                 const createPayload = {
                     ...payload,
-                    Name: normalizedName,
+                    Name: sanitizedName,
                     Runtime: normalizeString(payload.Runtime) ?? "Nodejs20.19",
                 };
                 const result = await cloudbase.agent.createAgent(createPayload);
@@ -17264,7 +17414,7 @@ async function checkMysqlGate(server) {
             success: false,
             errorCode: "MYSQL_NOT_AVAILABLE",
             message: `This environment (${envId}) does not have MySQL. Use managePgDatabase / queryPgDatabase instead.`,
-            nextActions: [{ tool: "managePgDatabase", params: { action: "execute" }, description: "Use managePgDatabase" }],
+            nextActions: [{ tool: "managePgDatabase", params: { action: "execute" }, description: "Use managePgDatabase for PostgreSQL operations" }],
         });
     }
     try {
@@ -17276,7 +17426,7 @@ async function checkMysqlGate(server) {
             return (0, tool_result_js_1.buildJsonToolResult)({
                 success: false,
                 errorCode: "MYSQL_NOT_AVAILABLE",
-                message: `This environment (${envId}) has PostgreSQL enabled but MySQL is NOT available. Use managePgDatabase / queryPgDatabase instead of manageSqlDatabase / querySqlDatabase.`,
+                message: `This environment (${envId}) has PostgreSQL enabled but MySQL is NOT available. Use managePgDatabase / queryPgDatabase instead of manageMysqlDatabase / queryMysqlDatabase.`,
                 nextActions: [{ tool: "managePgDatabase", params: { action: "execute" }, description: "Use managePgDatabase for PostgreSQL operations" }],
             });
         }
@@ -17285,8 +17435,8 @@ async function checkMysqlGate(server) {
     MYSQL_GATE_CACHE.set(envId, true);
     return null;
 }
-const QUERY_SQL_DATABASE = "querySqlDatabase";
-const MANAGE_SQL_DATABASE = "manageSqlDatabase";
+const QUERY_MYSQL_DATABASE = "queryMysqlDatabase";
+const MANAGE_MYSQL_DATABASE = "manageMysqlDatabase";
 const QUERY_PERMISSIONS = "queryPermissions";
 const MANAGE_PERMISSIONS = "managePermissions";
 const QUERY_ACTIONS = [
@@ -17578,14 +17728,14 @@ async function getSqlInstanceInfo({ getManager, cloudBaseOptions, server, }) {
 function buildProvisionNextActions(status, request) {
     if (status === "READY") {
         return [
-            buildNextAction(MANAGE_SQL_DATABASE, "initializeSchema", "MySQL is ready. Initialize tables and indexes next."),
+            buildNextAction(MANAGE_MYSQL_DATABASE, "initializeSchema", "MySQL is ready. Initialize tables and indexes next."),
         ];
     }
     if (status === "FAILED") {
         return [];
     }
     return [
-        buildNextAction(QUERY_SQL_DATABASE, "describeCreateResult", "MySQL provisioning is still running. Check the create result again before initializing schema.", request
+        buildNextAction(QUERY_MYSQL_DATABASE, "describeCreateResult", "MySQL provisioning is still running. Check the create result again before initializing schema.", request
             ? { action: "describeCreateResult", request }
             : { action: "describeCreateResult" }),
     ];
@@ -17604,15 +17754,15 @@ function buildTaskStatusNextActions(status, request) {
     if (status === "READY") {
         if (inferTaskKind(request) === "destroy") {
             return [
-                buildNextAction(QUERY_SQL_DATABASE, "getInstanceInfo", "The destroy task completed. Confirm whether the MySQL instance no longer exists."),
+                buildNextAction(QUERY_MYSQL_DATABASE, "getInstanceInfo", "The destroy task completed. Confirm whether the MySQL instance no longer exists."),
             ];
         }
         return [
-            buildNextAction(MANAGE_SQL_DATABASE, "initializeSchema", "MySQL is ready. Initialize tables and indexes next."),
+            buildNextAction(MANAGE_MYSQL_DATABASE, "initializeSchema", "MySQL is ready. Initialize tables and indexes next."),
         ];
     }
     return [
-        buildNextAction(QUERY_SQL_DATABASE, "describeTaskStatus", "MySQL task is still running. Check task status again before continuing.", request ? { action: "describeTaskStatus", request } : { action: "describeTaskStatus" }),
+        buildNextAction(QUERY_MYSQL_DATABASE, "describeTaskStatus", "MySQL task is still running. Check task status again before continuing.", request ? { action: "describeTaskStatus", request } : { action: "describeTaskStatus" }),
     ];
 }
 async function handleRunQuery(args, context) {
@@ -17622,7 +17772,7 @@ async function handleRunQuery(args, context) {
             errorCode: "SQL_REQUIRED",
             message: "`sql` is required when action is `runQuery`.",
             nextActions: [
-                buildNextAction(QUERY_SQL_DATABASE, "runQuery", "Provide a read-only SQL statement such as SELECT/SHOW/DESCRIBE."),
+                buildNextAction(QUERY_MYSQL_DATABASE, "runQuery", "Provide a read-only SQL statement such as SELECT/SHOW/DESCRIBE."),
             ],
         });
     }
@@ -17630,9 +17780,9 @@ async function handleRunQuery(args, context) {
         return buildSqlToolResult({
             success: false,
             errorCode: "READ_ONLY_SQL_REQUIRED",
-            message: "`querySqlDatabase(action=runQuery)` only accepts read-only SQL statements.",
+            message: "`queryMysqlDatabase(action=runQuery)` only accepts read-only SQL statements.",
             nextActions: [
-                buildNextAction(MANAGE_SQL_DATABASE, "runStatement", "Use the manage tool for INSERT/UPDATE/DELETE/DDL statements."),
+                buildNextAction(MANAGE_MYSQL_DATABASE, "runStatement", "Use the manage tool for INSERT/UPDATE/DELETE/DDL statements."),
             ],
         });
     }
@@ -17660,7 +17810,7 @@ async function handleRunQuery(args, context) {
                 errorCode: "MYSQL_NOT_CREATED",
                 message: "MySQL is not provisioned yet or not found. Please provision MySQL before running queries.",
                 nextActions: [
-                    buildNextAction(MANAGE_SQL_DATABASE, "provisionMySQL", "Provision MySQL before querying data.", { action: "provisionMySQL", confirm: true }),
+                    buildNextAction(MANAGE_MYSQL_DATABASE, "provisionMySQL", "Provision MySQL before querying data.", { action: "provisionMySQL", confirm: true }),
                 ],
             });
         }
@@ -17759,7 +17909,7 @@ async function handleGetInstanceInfo(context) {
         nextActions: instanceInfo.exists
             ? undefined
             : [
-                buildNextAction(MANAGE_SQL_DATABASE, "provisionMySQL", "Provision MySQL before running SQL statements or schema initialization.", { action: "provisionMySQL", confirm: true }),
+                buildNextAction(MANAGE_MYSQL_DATABASE, "provisionMySQL", "Provision MySQL before running SQL statements or schema initialization.", { action: "provisionMySQL", confirm: true }),
             ],
     });
 }
@@ -17770,7 +17920,7 @@ async function handleProvisionMySQL(args, context) {
             errorCode: "CONFIRM_REQUIRED",
             message: "Provisioning MySQL creates billable resources. Re-run with `confirm: true` to continue.",
             nextActions: [
-                buildNextAction(MANAGE_SQL_DATABASE, "provisionMySQL", "Explicit confirmation is required before provisioning MySQL.", { action: "provisionMySQL", confirm: true }),
+                buildNextAction(MANAGE_MYSQL_DATABASE, "provisionMySQL", "Explicit confirmation is required before provisioning MySQL.", { action: "provisionMySQL", confirm: true }),
             ],
         });
     }
@@ -17784,7 +17934,7 @@ async function handleProvisionMySQL(args, context) {
             message: "A SQL database instance already exists for the current environment.",
             nextActions: existing.status === "READY"
                 ? [
-                    buildNextAction(MANAGE_SQL_DATABASE, "initializeSchema", "The instance already exists. You can initialize schema next if needed."),
+                    buildNextAction(MANAGE_MYSQL_DATABASE, "initializeSchema", "The instance already exists. You can initialize schema next if needed."),
                 ]
                 : undefined,
         });
@@ -17830,7 +17980,7 @@ async function handleDestroyMySQL(args, context) {
             errorCode: "CONFIRM_REQUIRED",
             message: "Destroying MySQL removes database resources. Re-run with `confirm: true` to continue.",
             nextActions: [
-                buildNextAction(MANAGE_SQL_DATABASE, "destroyMySQL", "Explicit confirmation is required before destroying MySQL.", { action: "destroyMySQL", confirm: true }),
+                buildNextAction(MANAGE_MYSQL_DATABASE, "destroyMySQL", "Explicit confirmation is required before destroying MySQL.", { action: "destroyMySQL", confirm: true }),
             ],
         });
     }
@@ -17877,7 +18027,7 @@ async function handleDestroyMySQL(args, context) {
             : "MySQL destroy request was rejected.",
         nextActions: isSuccess
             ? [
-                buildNextAction(QUERY_SQL_DATABASE, "describeTaskStatus", "Check the MySQL destroy task status before assuming the instance is gone.", {
+                buildNextAction(QUERY_MYSQL_DATABASE, "describeTaskStatus", "Check the MySQL destroy task status before assuming the instance is gone.", {
                     action: "describeTaskStatus",
                     request: taskRequest,
                 }),
@@ -17900,7 +18050,7 @@ async function handleRunStatement(args, context) {
             errorCode: "MYSQL_NOT_CREATED",
             message: "MySQL is not provisioned for the current environment yet.",
             nextActions: [
-                buildNextAction(MANAGE_SQL_DATABASE, "provisionMySQL", "Provision MySQL before executing write statements or DDL.", { action: "provisionMySQL", confirm: true }),
+                buildNextAction(MANAGE_MYSQL_DATABASE, "provisionMySQL", "Provision MySQL before executing write statements or DDL.", { action: "provisionMySQL", confirm: true }),
             ],
         });
     }
@@ -17910,7 +18060,7 @@ async function handleRunStatement(args, context) {
             errorCode: "MYSQL_NOT_READY",
             message: `MySQL is not ready yet (current status: ${instanceInfo.status}).`,
             nextActions: [
-                buildNextAction(QUERY_SQL_DATABASE, "getInstanceInfo", "Check current instance status before retrying the statement."),
+                buildNextAction(QUERY_MYSQL_DATABASE, "getInstanceInfo", "Check current instance status before retrying the statement."),
             ],
         });
     }
@@ -17937,7 +18087,7 @@ async function handleRunStatement(args, context) {
                 errorCode: "MYSQL_NOT_CREATED",
                 message: "MySQL is not provisioned yet or not found. Please provision MySQL before running statements.",
                 nextActions: [
-                    buildNextAction(MANAGE_SQL_DATABASE, "provisionMySQL", "Provision MySQL before executing statements.", { action: "provisionMySQL", confirm: true }),
+                    buildNextAction(MANAGE_MYSQL_DATABASE, "provisionMySQL", "Provision MySQL before executing statements.", { action: "provisionMySQL", confirm: true }),
                 ],
             });
         }
@@ -17966,7 +18116,7 @@ async function resolveInitializationReadiness(args, context) {
                 errorCode: "MYSQL_NOT_CREATED",
                 message: "MySQL is not provisioned yet. Initialize schema only after provisioning completes.",
                 nextActions: [
-                    buildNextAction(MANAGE_SQL_DATABASE, "provisionMySQL", "Provision MySQL before schema initialization.", { action: "provisionMySQL", confirm: true }),
+                    buildNextAction(MANAGE_MYSQL_DATABASE, "provisionMySQL", "Provision MySQL before schema initialization.", { action: "provisionMySQL", confirm: true }),
                 ],
             }),
         };
@@ -18006,7 +18156,7 @@ async function resolveInitializationReadiness(args, context) {
                     rawStatus,
                 },
                 nextActions: [
-                    buildNextAction(QUERY_SQL_DATABASE, "describeTaskStatus", "Check MySQL task status until the instance becomes ready.", args.statusContext?.taskStatusRequest
+                    buildNextAction(QUERY_MYSQL_DATABASE, "describeTaskStatus", "Check MySQL task status until the instance becomes ready.", args.statusContext?.taskStatusRequest
                         ? {
                             action: "describeTaskStatus",
                             request: args.statusContext.taskStatusRequest,
@@ -18063,7 +18213,7 @@ async function handleInitializeSchema(args, context) {
                         errorCode: "MYSQL_NOT_CREATED",
                         message: "MySQL is not provisioned yet or not found. Please provision MySQL before initializing schema.",
                         nextActions: [
-                            buildNextAction(MANAGE_SQL_DATABASE, "provisionMySQL", "Provision MySQL before executing statements.", { action: "provisionMySQL", confirm: true }),
+                            buildNextAction(MANAGE_MYSQL_DATABASE, "provisionMySQL", "Provision MySQL before executing statements.", { action: "provisionMySQL", confirm: true }),
                         ],
                     });
                 }
@@ -18111,7 +18261,7 @@ function registerSQLDatabaseTools(server) {
         cloudBaseOptions,
         server,
     };
-    server.registerTool?.(QUERY_SQL_DATABASE, {
+    server.registerTool?.(QUERY_MYSQL_DATABASE, {
         title: "查询 CloudBase MySQL 数据库状态或执行只读 SQL",
         description: "查询 CloudBase MySQL 数据库信息。支持执行只读 SQL、查询 MySQL 开通结果、查询 MySQL 任务状态，以及获取当前实例上下文信息。",
         inputSchema: {
@@ -18157,7 +18307,7 @@ function registerSQLDatabaseTools(server) {
                 throw new Error(`Unsupported SQL query action: ${args.action}`);
         }
     });
-    server.registerTool?.(MANAGE_SQL_DATABASE, {
+    server.registerTool?.(MANAGE_MYSQL_DATABASE, {
         title: "管理 CloudBase MySQL 数据库生命周期或执行写入 SQL",
         description: "管理 CloudBase MySQL 数据库资源。支持开通 MySQL、销毁 MySQL、执行写入 SQL/DDL，以及初始化数据库 Schema。注意：必须先开通 MySQL（action=provisionMySQL，confirm=true）才能执行 runStatement 或 initializeSchema。若 MySQL 尚未开通，工具会返回 MYSQL_NOT_CREATED 并给出开通的 nextAction 提示。",
         inputSchema: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cloudbase/cloudbase-mcp",
-  "version": "2.23.5",
+  "version": "2.23.7",
   "packageManager": "pnpm@10.8.0",
   "description": "腾讯云开发 MCP Server，通过AI提示词和MCP协议+云开发，让开发更智能、更高效,当你在Cursor/ VSCode GitHub Copilot/WinSurf/CodeBuddy/Augment Code/Claude Code等AI编程工具里写代码时，它能自动帮你生成可直接部署的前后端应用+小程序，并一键发布到腾讯云开发 CloudBase。",
   "main": "./dist/index.cjs",