@cloudbase/cloudbase-mcp 2.23.6 → 2.23.7

package/dist/index.cjs

@@ -1990,13 +1990,14 @@ async function fetchAvailableEnvCandidates(cloudBaseOptions, server) {
         return [];
     }
 }
-const CODEBUDDY_AUTH_ACTIONS = ["status", "set_env"];
+const CODEBUDDY_AUTH_ACTIONS = ["status", "set_env", "login_by_api_key"];
 const DEFAULT_AUTH_ACTIONS = [
     "status",
     "start_auth",
     "set_env",
     "logout",
     "get_temp_credentials",
+    "login_by_api_key",
 ];
 function maskSensitiveValue(value) {
     if (value.length <= 4) {
@@ -2553,12 +2554,12 @@ function registerEnvTools(server) {
     if (server.ide !== 'wxide') {
         server.registerTool?.("auth", {
             title: "CloudBase 开发阶段登录与环境",
-            description: "CloudBase（腾讯云开发）开发阶段登录与环境绑定。登录后即可访问云资源；环境(env)是云函数、数据库、静态托管等资源的隔离单元，绑定环境后其他 MCP 工具才能操作该环境。支持：查询状态、发起登录、绑定环境(set_env)、退出登录。",
+            description: "CloudBase（腾讯云开发）开发阶段登录与环境绑定。登录后即可访问云资源；环境(env)是云函数、数据库、静态托管等资源的隔离单元，绑定环境后其他 MCP 工具才能操作该环境。支持：查询状态、发起登录、API Key登录、绑定环境(set_env)、退出登录。",
             inputSchema: {
                 action: zod_1.z
                     .enum(authActionEnum)
                     .optional()
-                    .describe("动作：status=查询状态，start_auth=发起登录，set_env=绑定环境(传envId)，logout=退出登录"),
+                    .describe("动作：status=查询状态，start_auth=发起登录，login_by_api_key=API Key登录，set_env=绑定环境(传envId)，logout=退出登录"),
                 ...(supportedAuthActions.includes("start_auth")
                     ? {
                         authMode: zod_1.z
@@ -2583,6 +2584,18 @@ function registerEnvTools(server) {
                     .string()
                     .optional()
                     .describe("环境ID(CloudBase 环境唯一标识)，绑定后工具将操作该环境。action=set_env 时必填"),
+                ...(supportedAuthActions.includes("login_by_api_key")
+                    ? {
+                        apiKey: zod_1.z
+                            .string()
+                            .optional()
+                            .describe("CloudBase API Key，action=login_by_api_key 时必填"),
+                        apiKeyEnvId: zod_1.z
+                            .string()
+                            .optional()
+                            .describe("CloudBase 环境ID(EnvId)，action=login_by_api_key 时必填，用于指定 API Key 所属环境"),
+                    }
+                    : {}),
                 ...(supportedAuthActions.includes("logout")
                     ? {
                         confirm: zod_1.z
@@ -2898,6 +2911,78 @@ function registerEnvTools(server) {
                         next_step: envPreparation.nextStep,
                     });
                 }
+                if (action === "login_by_api_key") {
+                    const toolApiKey = normalizeOptionalToolString(rawArgs.apiKey);
+                    const toolApiKeyEnvId = normalizeOptionalToolString(rawArgs.apiKeyEnvId);
+                    if (!toolApiKey || !toolApiKeyEnvId) {
+                        return (0, tool_result_js_1.buildJsonToolResult)({
+                            ok: false,
+                            code: "INVALID_ARGS",
+                            message: "action=login_by_api_key 时必须同时提供 apiKey 和 envId。",
+                            next_step: (0, tool_result_js_1.buildAuthNextStep)("login_by_api_key", {
+                                suggestedArgs: { action: "login_by_api_key", apiKey: "<your-api-key>", envId: "<your-env-id>" },
+                            }),
+                        });
+                    }
+                    // 写入 process.env（与 cli.ts 处理 --api-key/--env-id 的逻辑一致）
+                    process.env.CLOUDBASE_API_KEY = toolApiKey;
+                    process.env.CLOUDBASE_ENV_ID = toolApiKeyEnvId;
+                    try {
+                        const loginState = await (0, auth_js_1.peekLoginState)();
+                        if (loginState) {
+                            const envPreparation = await prepareAuthEnvironment({
+                                server,
+                                cloudBaseOptions,
+                                loginState,
+                            });
+                            return (0, tool_result_js_1.buildJsonToolResult)({
+                                ok: true,
+                                code: "AUTH_READY",
+                                message: "API Key 认证成功，已获取临时密钥。",
+                                auth_mode: "api_key",
+                                ...buildAuthEnvSetupPayload(envPreparation),
+                                next_step: envPreparation.nextStep,
+                            });
+                        }
+                        // API Key 换取失败：清理 env vars 并返回诊断信息
+                        delete process.env.CLOUDBASE_API_KEY;
+                        delete process.env.CLOUDBASE_ENV_ID;
+                        let diagMessage = "API Key 换取临时密钥失败。";
+                        diagMessage += `\n\n诊断信息：`;
+                        diagMessage += `\n- CLOUDBASE_ENV_ID: ${toolApiKeyEnvId}`;
+                        diagMessage += `\n- CLOUDBASE_API_KEY: ${toolApiKey.slice(0, 20)}...（已截断）`;
+                        diagMessage += `\n\n可能原因：`;
+                        diagMessage += `\n1. API Key 已过期或被删除`;
+                        diagMessage += `\n2. CLOUDBASE_ENV_ID 与 API Key 所属环境不匹配`;
+                        diagMessage += `\n3. 网络连接问题`;
+                        diagMessage += `\n\n建议：请检查 API Key 和环境 ID 是否正确。`;
+                        return (0, tool_result_js_1.buildJsonToolResult)({
+                            ok: false,
+                            code: "API_KEY_AUTH_FAILED",
+                            message: diagMessage,
+                            auth_mode: "api_key",
+                            envId: toolApiKeyEnvId,
+                            next_step: (0, tool_result_js_1.buildAuthNextStep)("login_by_api_key", {
+                                suggestedArgs: { action: "login_by_api_key", apiKey: "<your-api-key>", envId: "<your-env-id>" },
+                            }),
+                        });
+                    }
+                    catch (error) {
+                        // 异常时清理 env vars
+                        delete process.env.CLOUDBASE_API_KEY;
+                        delete process.env.CLOUDBASE_ENV_ID;
+                        const message = error instanceof Error ? error.message : String(error);
+                        return (0, tool_result_js_1.buildJsonToolResult)({
+                            ok: false,
+                            code: "API_KEY_AUTH_FAILED",
+                            message: `API Key 认证异常: ${message}`,
+                            auth_mode: "api_key",
+                            next_step: (0, tool_result_js_1.buildAuthNextStep)("login_by_api_key", {
+                                suggestedArgs: { action: "login_by_api_key", apiKey: "<your-api-key>", envId: "<your-env-id>" },
+                            }),
+                        });
+                    }
+                }
                 if (action === "set_env") {
                     const loginState = await (0, auth_js_1.peekLoginState)();
                     if (!loginState) {
@@ -39137,6 +39222,18 @@ function buildErrorEnvelope(error) {
 function normalizeString(value) {
     return typeof value === "string" && value.trim().length > 0 ? value.trim() : undefined;
 }
+/**
+ * Sanitize agent name for CloudBase backend.
+ * The backend creates a cloud function alias from the agent name (e.g. "agent-{name}"),
+ * and SCF aliases only allow alphanumeric characters and hyphens.
+ * This function replaces any character that is not [a-zA-Z0-9] with a hyphen,
+ * then collapses consecutive hyphens into one.
+ */
+function sanitizeAgentName(name) {
+    return name
+        .replace(/[^a-zA-Z0-9]+/g, "-")
+        .replace(/^-+|-+$/g, "");
+}
 function normalizeNumber(value) {
     return typeof value === "number" && Number.isFinite(value) ? value : undefined;
 }
@@ -39291,13 +39388,19 @@ function registerAgentTools(server) {
                 }
                 // CloudBase 后端在创建 Agent 时会同步创建云函数，函数名/别名长度受 SCF 限制（最大 64 字符）。
                 // envId 可能被用作前缀或别名的一部分，因此这里预留足够余量，避免后端 CreateFunction 失败。
-                if (normalizedName.length > 30) {
-                    throw new Error(`agent name 过长（当前 ${normalizedName.length} 字符）。CloudBase 创建 Agent 时会同步创建云函数，` +
-                        `函数名/别名受 SCF 64 字符限制，且 envId 可能作为前缀拼接。请将 name 控制在 30 字符以内。`);
+                // 同时，后端会用 name 生成云函数 alias（如 "agent-{name}"），而 SCF alias 只允许字母、数字和连字符，
+                // 因此需要对 name 做 sanitize，将非法字符（如下划线）替换为连字符。
+                const sanitizedName = sanitizeAgentName(normalizedName);
+                if (!sanitizedName) {
+                    throw new Error(`name "${normalizedName}" 经 sanitize 后为空，请使用包含字母或数字的 name`);
+                }
+                if (sanitizedName.length > 30) {
+                    throw new Error(`agent name 过长（当前 ${sanitizedName.length} 字符）。CloudBase 创建 Agent 时会同步创建云函数，` +
+                        `函数名/别名受 SCF 64 字符长度限制，且 envId 可能作为前缀拼接。请将 name 控制在 30 字符以内。`);
                 }
                 const createPayload = {
                     ...payload,
-                    Name: normalizedName,
+                    Name: sanitizedName,
                     Runtime: normalizeString(payload.Runtime) ?? "Nodejs20.19",
                 };
                 const result = await cloudbase.agent.createAgent(createPayload);
@@ -113931,18 +114034,31 @@ function checkIfAgentProject(projectPath) {
     }
 }
 /**
- * Validate and normalize file path
+ * Validate and normalize file path.
+ * Accepts absolute paths as-is; for relative paths, resolves against CWD and
+ * ensures the result does not escape the CWD (path-traversal protection).
  * @param inputPath User provided path
  * @returns Absolute path
  */
 function validateAndNormalizePath(inputPath) {
-    let normalizedPath = path_1.default.resolve(inputPath);
-    // Security check - ensure path is within current working directory
+    const normalizedPath = path_1.default.resolve(inputPath);
+    // On Windows, path.resolve may return a path on a different drive/UNC share.
+    // That is safe — the user explicitly provided an absolute path there.
+    // Only apply the traversal check when the resolved path shares the same root
+    // as CWD (i.e. the path was relative or on the same drive).
     const cwd = process.cwd();
-    const prefix = cwd.endsWith(path_1.default.sep) ? cwd : cwd + path_1.default.sep;
-    if (!normalizedPath.startsWith(prefix) && normalizedPath !== cwd) {
-        throw new Error(`Path must be within current working directory: ${cwd}`);
-    }
+    const cwdRoot = path_1.default.parse(cwd).root;
+    const pathRoot = path_1.default.parse(normalizedPath).root;
+    if (cwdRoot === pathRoot) {
+        // Same filesystem root — ensure the resolved path is still inside CWD
+        // (or is exactly CWD) to block "../" traversal.
+        const prefix = cwd.endsWith(path_1.default.sep) ? cwd : cwd + path_1.default.sep;
+        if (!normalizedPath.startsWith(prefix) && normalizedPath !== cwd) {
+            throw new Error(`Path must be within current working directory: ${cwd}`);
+        }
+    }
+    // Cross-root absolute paths (e.g. D:\ on Windows when CWD is C:\) are
+    // allowed — the user own the machine and the path is explicitly absolute.
     return normalizedPath;
 }
 function buildManageCloudRunErrorMessage(action, serverName, error) {
@@ -136691,7 +136807,7 @@ class TelemetryReporter {
         const nodeVersion = process.version; // Node.js版本
         const arch = os_1.default.arch(); // 系统架构
         // 从构建时注入的版本号获取MCP版本信息
-        const mcpVersion = process.env.npm_package_version || "2.23.6" || 0;
+        const mcpVersion = process.env.npm_package_version || "2.23.7" || 0;
         return {
             userAgent: `${osType} ${osRelease} ${arch} ${nodeVersion} CloudBase-MCP/${mcpVersion}`,
             deviceId: this.deviceId,
@@ -196476,7 +196592,7 @@ ${envIdSection}
 ## 环境信息
 - 操作系统: ${os_1.default.type()} ${os_1.default.release()}
 - Node.js版本: ${process.version}
-- MCP 版本：${process.env.npm_package_version || "2.23.6" || 0}
+- MCP 版本：${process.env.npm_package_version || "2.23.7" || 0}
 - 系统架构: ${os_1.default.arch()}
 - 时间: ${new Date().toISOString()}
 - 请求ID: ${requestId}
@@ -196557,7 +196673,7 @@ function createWrappedHandler(name, handler, server) {
                 requestId: (typeof error === 'object' && error && 'requestId' in error) ? error.requestId : '',
                 ide: server.ide || process.env.INTEGRATION_IDE || ''
             });
-            const mcpVersion =  true ? "2.23.6" : 0;
+            const mcpVersion =  true ? "2.23.7" : 0;
             const requestIdSuffix = requestId ? `\n🆔 RequestId: ${requestId}` : '';
             const enhancedErrorMessage = `${errorMessage}${requestIdSuffix}\n\n📦 CloudBase MCP v${mcpVersion}\n🔗 遇到问题？请复制以下链接到浏览器打开\n即可自动携带错误详情快速创建 GitHub Issue：\n${issueLink}`;
             // 创建新的错误对象，保持原有的错误类型但更新消息
@@ -212571,7 +212687,7 @@ function registerSetupTools(server) {
     server.registerTool("downloadTemplate", {
         title: "下载项目模板",
         description: `自动下载并部署CloudBase项目模板。
-**Note**: Call this tool when the user requests to create a new project using a CloudBase template.\n\n支持的模板:\n- react: React + CloudBase 全栈应用模板\n- vue: Vue + CloudBase 全栈应用模板\n- miniprogram: 微信小程序 + 云开发模板  \n- uniapp: UniApp + CloudBase 跨端应用模板\n- rules: 只包含AI编辑器配置文件（包含Cursor、WindSurf、CodeBuddy等所有主流编辑器配置），适合在已有项目中补充AI编辑器配置\n\n支持的IDE类型:\n- all: 下载所有IDE配置\n- cursor: Cursor AI编辑器\n- 其他IDE类型见下方列表\n\n注意：如果未传入 ide 参数且无法从环境变量检测到 IDE，将提示错误并要求传入 ide 参数\n- windsurf: WindSurf AI编辑器\n- codebuddy: CodeBuddy AI编辑器\n- claude-code: Claude Code AI编辑器\n- cline: Cline AI编辑器\n- gemini-cli: Gemini CLI\n- opencode: OpenCode AI编辑器\n- qwen-code: 通义灵码\n- baidu-comate: 百度Comate\n- openai-codex-cli: OpenAI Codex CLI\n- augment-code: Augment Code\n- github-copilot: GitHub Copilot\n- roocode: RooCode AI编辑器\n- tongyi-lingma: 通义灵码\n- trae: Trae AI编辑器\n- qoder: Qoder AI编辑器\n- antigravity: Google Antigravity AI编辑器\n- vscode: Visual Studio Code\n- kiro: Kiro AI编辑器\n- aider: Aider AI编辑器\n\n特别说明：\n- rules 模板会自动包含当前 mcp 版本号信息（版本号：${ true ? "2.23.6" : 0}），便于后续维护和版本追踪\n- 下载 rules 模板时，如果项目中已存在 README.md 文件，系统会自动保护该文件不被覆盖（除非设置 overwrite=true）`,
+**Note**: Call this tool when the user requests to create a new project using a CloudBase template.\n\n支持的模板:\n- react: React + CloudBase 全栈应用模板\n- vue: Vue + CloudBase 全栈应用模板\n- miniprogram: 微信小程序 + 云开发模板  \n- uniapp: UniApp + CloudBase 跨端应用模板\n- rules: 只包含AI编辑器配置文件（包含Cursor、WindSurf、CodeBuddy等所有主流编辑器配置），适合在已有项目中补充AI编辑器配置\n\n支持的IDE类型:\n- all: 下载所有IDE配置\n- cursor: Cursor AI编辑器\n- 其他IDE类型见下方列表\n\n注意：如果未传入 ide 参数且无法从环境变量检测到 IDE，将提示错误并要求传入 ide 参数\n- windsurf: WindSurf AI编辑器\n- codebuddy: CodeBuddy AI编辑器\n- claude-code: Claude Code AI编辑器\n- cline: Cline AI编辑器\n- gemini-cli: Gemini CLI\n- opencode: OpenCode AI编辑器\n- qwen-code: 通义灵码\n- baidu-comate: 百度Comate\n- openai-codex-cli: OpenAI Codex CLI\n- augment-code: Augment Code\n- github-copilot: GitHub Copilot\n- roocode: RooCode AI编辑器\n- tongyi-lingma: 通义灵码\n- trae: Trae AI编辑器\n- qoder: Qoder AI编辑器\n- antigravity: Google Antigravity AI编辑器\n- vscode: Visual Studio Code\n- kiro: Kiro AI编辑器\n- aider: Aider AI编辑器\n\n特别说明：\n- rules 模板会自动包含当前 mcp 版本号信息（版本号：${ true ? "2.23.7" : 0}），便于后续维护和版本追踪\n- 下载 rules 模板时，如果项目中已存在 README.md 文件，系统会自动保护该文件不被覆盖（除非设置 overwrite=true）`,
         inputSchema: {
             template: zod_1.z
                 .enum(["react", "vue", "miniprogram", "uniapp", "rules"])
@@ -229992,6 +230108,7 @@ function registerGatewayTools(server) {
                 const cloudbase = await getManager();
                 const accessPath = input.path ? normalizeAccessPath(input.path) : undefined;
                 let resolvedAccessId = input.accessId;
+                let resolvedName;
                 if (!resolvedAccessId) {
                     if (!input.targetName && !accessPath) {
                         throw new Error("action=deleteAccess 时至少需要提供 accessId，或提供 targetName/path 用于定位入口");
@@ -230013,18 +230130,32 @@ function registerGatewayTools(server) {
                         throw new Error("匹配到多个访问入口，请补充 path 或直接传 accessId");
                     }
                     resolvedAccessId = candidates[0]?.APIId;
+                    resolvedName = candidates[0]?.Name;
+                }
+                else {
+                    // 仅传入 accessId 时，先查询获取 name 等信息，确保删除参数完整
+                    try {
+                        const accessList = await cloudbase.access.getAccessList({});
+                        const match = (accessList.APISet ?? []).find((item) => item.APIId === resolvedAccessId);
+                        if (match) {
+                            resolvedName = match.Name;
+                        }
+                    }
+                    catch {
+                        // 查询失败不影响主流程，继续用 accessId 删除
+                    }
                 }
                 if (!resolvedAccessId) {
                     throw new Error("无法解析访问入口 accessId，请改为显式传入 accessId");
                 }
                 const result = await cloudbase.access.deleteAccess({
-                    ...(input.targetName ? { name: input.targetName } : {}),
+                    ...(resolvedName ? { name: resolvedName } : {}),
                     apiId: resolvedAccessId,
                 });
                 (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
                 return buildEnvelope({
                     action: input.action,
-                    targetName: input.targetName ?? null,
+                    targetName: resolvedName ?? input.targetName ?? null,
                     path: accessPath ?? null,
                     accessId: resolvedAccessId,
                     raw: result,

package/dist/index.js

@@ -261,13 +261,14 @@ async function fetchAvailableEnvCandidates(cloudBaseOptions, server) {
         return [];
     }
 }
-const CODEBUDDY_AUTH_ACTIONS = ["status", "set_env"];
+const CODEBUDDY_AUTH_ACTIONS = ["status", "set_env", "login_by_api_key"];
 const DEFAULT_AUTH_ACTIONS = [
     "status",
     "start_auth",
     "set_env",
     "logout",
     "get_temp_credentials",
+    "login_by_api_key",
 ];
 function maskSensitiveValue(value) {
     if (value.length <= 4) {
@@ -824,12 +825,12 @@ function registerEnvTools(server) {
     if (server.ide !== 'wxide') {
         server.registerTool?.("auth", {
             title: "CloudBase 开发阶段登录与环境",
-            description: "CloudBase（腾讯云开发）开发阶段登录与环境绑定。登录后即可访问云资源；环境(env)是云函数、数据库、静态托管等资源的隔离单元，绑定环境后其他 MCP 工具才能操作该环境。支持：查询状态、发起登录、绑定环境(set_env)、退出登录。",
+            description: "CloudBase（腾讯云开发）开发阶段登录与环境绑定。登录后即可访问云资源；环境(env)是云函数、数据库、静态托管等资源的隔离单元，绑定环境后其他 MCP 工具才能操作该环境。支持：查询状态、发起登录、API Key登录、绑定环境(set_env)、退出登录。",
             inputSchema: {
                 action: zod_1.z
                     .enum(authActionEnum)
                     .optional()
-                    .describe("动作：status=查询状态，start_auth=发起登录，set_env=绑定环境(传envId)，logout=退出登录"),
+                    .describe("动作：status=查询状态，start_auth=发起登录，login_by_api_key=API Key登录，set_env=绑定环境(传envId)，logout=退出登录"),
                 ...(supportedAuthActions.includes("start_auth")
                     ? {
                         authMode: zod_1.z
@@ -854,6 +855,18 @@ function registerEnvTools(server) {
                     .string()
                     .optional()
                     .describe("环境ID(CloudBase 环境唯一标识)，绑定后工具将操作该环境。action=set_env 时必填"),
+                ...(supportedAuthActions.includes("login_by_api_key")
+                    ? {
+                        apiKey: zod_1.z
+                            .string()
+                            .optional()
+                            .describe("CloudBase API Key，action=login_by_api_key 时必填"),
+                        apiKeyEnvId: zod_1.z
+                            .string()
+                            .optional()
+                            .describe("CloudBase 环境ID(EnvId)，action=login_by_api_key 时必填，用于指定 API Key 所属环境"),
+                    }
+                    : {}),
                 ...(supportedAuthActions.includes("logout")
                     ? {
                         confirm: zod_1.z
@@ -1169,6 +1182,78 @@ function registerEnvTools(server) {
                         next_step: envPreparation.nextStep,
                     });
                 }
+                if (action === "login_by_api_key") {
+                    const toolApiKey = normalizeOptionalToolString(rawArgs.apiKey);
+                    const toolApiKeyEnvId = normalizeOptionalToolString(rawArgs.apiKeyEnvId);
+                    if (!toolApiKey || !toolApiKeyEnvId) {
+                        return (0, tool_result_js_1.buildJsonToolResult)({
+                            ok: false,
+                            code: "INVALID_ARGS",
+                            message: "action=login_by_api_key 时必须同时提供 apiKey 和 envId。",
+                            next_step: (0, tool_result_js_1.buildAuthNextStep)("login_by_api_key", {
+                                suggestedArgs: { action: "login_by_api_key", apiKey: "<your-api-key>", envId: "<your-env-id>" },
+                            }),
+                        });
+                    }
+                    // 写入 process.env（与 cli.ts 处理 --api-key/--env-id 的逻辑一致）
+                    process.env.CLOUDBASE_API_KEY = toolApiKey;
+                    process.env.CLOUDBASE_ENV_ID = toolApiKeyEnvId;
+                    try {
+                        const loginState = await (0, auth_js_1.peekLoginState)();
+                        if (loginState) {
+                            const envPreparation = await prepareAuthEnvironment({
+                                server,
+                                cloudBaseOptions,
+                                loginState,
+                            });
+                            return (0, tool_result_js_1.buildJsonToolResult)({
+                                ok: true,
+                                code: "AUTH_READY",
+                                message: "API Key 认证成功，已获取临时密钥。",
+                                auth_mode: "api_key",
+                                ...buildAuthEnvSetupPayload(envPreparation),
+                                next_step: envPreparation.nextStep,
+                            });
+                        }
+                        // API Key 换取失败：清理 env vars 并返回诊断信息
+                        delete process.env.CLOUDBASE_API_KEY;
+                        delete process.env.CLOUDBASE_ENV_ID;
+                        let diagMessage = "API Key 换取临时密钥失败。";
+                        diagMessage += `\n\n诊断信息：`;
+                        diagMessage += `\n- CLOUDBASE_ENV_ID: ${toolApiKeyEnvId}`;
+                        diagMessage += `\n- CLOUDBASE_API_KEY: ${toolApiKey.slice(0, 20)}...（已截断）`;
+                        diagMessage += `\n\n可能原因：`;
+                        diagMessage += `\n1. API Key 已过期或被删除`;
+                        diagMessage += `\n2. CLOUDBASE_ENV_ID 与 API Key 所属环境不匹配`;
+                        diagMessage += `\n3. 网络连接问题`;
+                        diagMessage += `\n\n建议：请检查 API Key 和环境 ID 是否正确。`;
+                        return (0, tool_result_js_1.buildJsonToolResult)({
+                            ok: false,
+                            code: "API_KEY_AUTH_FAILED",
+                            message: diagMessage,
+                            auth_mode: "api_key",
+                            envId: toolApiKeyEnvId,
+                            next_step: (0, tool_result_js_1.buildAuthNextStep)("login_by_api_key", {
+                                suggestedArgs: { action: "login_by_api_key", apiKey: "<your-api-key>", envId: "<your-env-id>" },
+                            }),
+                        });
+                    }
+                    catch (error) {
+                        // 异常时清理 env vars
+                        delete process.env.CLOUDBASE_API_KEY;
+                        delete process.env.CLOUDBASE_ENV_ID;
+                        const message = error instanceof Error ? error.message : String(error);
+                        return (0, tool_result_js_1.buildJsonToolResult)({
+                            ok: false,
+                            code: "API_KEY_AUTH_FAILED",
+                            message: `API Key 认证异常: ${message}`,
+                            auth_mode: "api_key",
+                            next_step: (0, tool_result_js_1.buildAuthNextStep)("login_by_api_key", {
+                                suggestedArgs: { action: "login_by_api_key", apiKey: "<your-api-key>", envId: "<your-env-id>" },
+                            }),
+                        });
+                    }
+                }
                 if (action === "set_env") {
                     const loginState = await (0, auth_js_1.peekLoginState)();
                     if (!loginState) {
@@ -2117,7 +2202,7 @@ ${envIdSection}
 ## 环境信息
 - 操作系统: ${os_1.default.type()} ${os_1.default.release()}
 - Node.js版本: ${process.version}
-- MCP 版本：${process.env.npm_package_version || "2.23.6" || 0}
+- MCP 版本：${process.env.npm_package_version || "2.23.7" || 0}
 - 系统架构: ${os_1.default.arch()}
 - 时间: ${new Date().toISOString()}
 - 请求ID: ${requestId}
@@ -2198,7 +2283,7 @@ function createWrappedHandler(name, handler, server) {
                 requestId: (typeof error === 'object' && error && 'requestId' in error) ? error.requestId : '',
                 ide: server.ide || process.env.INTEGRATION_IDE || ''
             });
-            const mcpVersion =  true ? "2.23.6" : 0;
+            const mcpVersion =  true ? "2.23.7" : 0;
             const requestIdSuffix = requestId ? `\n🆔 RequestId: ${requestId}` : '';
             const enhancedErrorMessage = `${errorMessage}${requestIdSuffix}\n\n📦 CloudBase MCP v${mcpVersion}\n🔗 遇到问题？请复制以下链接到浏览器打开\n即可自动携带错误详情快速创建 GitHub Issue：\n${issueLink}`;
             // 创建新的错误对象，保持原有的错误类型但更新消息
@@ -7367,6 +7452,7 @@ function registerGatewayTools(server) {
                 const cloudbase = await getManager();
                 const accessPath = input.path ? normalizeAccessPath(input.path) : undefined;
                 let resolvedAccessId = input.accessId;
+                let resolvedName;
                 if (!resolvedAccessId) {
                     if (!input.targetName && !accessPath) {
                         throw new Error("action=deleteAccess 时至少需要提供 accessId，或提供 targetName/path 用于定位入口");
@@ -7388,18 +7474,32 @@ function registerGatewayTools(server) {
                         throw new Error("匹配到多个访问入口，请补充 path 或直接传 accessId");
                     }
                     resolvedAccessId = candidates[0]?.APIId;
+                    resolvedName = candidates[0]?.Name;
+                }
+                else {
+                    // 仅传入 accessId 时，先查询获取 name 等信息，确保删除参数完整
+                    try {
+                        const accessList = await cloudbase.access.getAccessList({});
+                        const match = (accessList.APISet ?? []).find((item) => item.APIId === resolvedAccessId);
+                        if (match) {
+                            resolvedName = match.Name;
+                        }
+                    }
+                    catch {
+                        // 查询失败不影响主流程，继续用 accessId 删除
+                    }
                 }
                 if (!resolvedAccessId) {
                     throw new Error("无法解析访问入口 accessId，请改为显式传入 accessId");
                 }
                 const result = await cloudbase.access.deleteAccess({
-                    ...(input.targetName ? { name: input.targetName } : {}),
+                    ...(resolvedName ? { name: resolvedName } : {}),
                     apiId: resolvedAccessId,
                 });
                 (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
                 return buildEnvelope({
                     action: input.action,
-                    targetName: input.targetName ?? null,
+                    targetName: resolvedName ?? input.targetName ?? null,
                     path: accessPath ?? null,
                     accessId: resolvedAccessId,
                     raw: result,
@@ -8231,18 +8331,31 @@ function checkIfAgentProject(projectPath) {
     }
 }
 /**
- * Validate and normalize file path
+ * Validate and normalize file path.
+ * Accepts absolute paths as-is; for relative paths, resolves against CWD and
+ * ensures the result does not escape the CWD (path-traversal protection).
  * @param inputPath User provided path
  * @returns Absolute path
  */
 function validateAndNormalizePath(inputPath) {
-    let normalizedPath = path_1.default.resolve(inputPath);
-    // Security check - ensure path is within current working directory
+    const normalizedPath = path_1.default.resolve(inputPath);
+    // On Windows, path.resolve may return a path on a different drive/UNC share.
+    // That is safe — the user explicitly provided an absolute path there.
+    // Only apply the traversal check when the resolved path shares the same root
+    // as CWD (i.e. the path was relative or on the same drive).
     const cwd = process.cwd();
-    const prefix = cwd.endsWith(path_1.default.sep) ? cwd : cwd + path_1.default.sep;
-    if (!normalizedPath.startsWith(prefix) && normalizedPath !== cwd) {
-        throw new Error(`Path must be within current working directory: ${cwd}`);
-    }
+    const cwdRoot = path_1.default.parse(cwd).root;
+    const pathRoot = path_1.default.parse(normalizedPath).root;
+    if (cwdRoot === pathRoot) {
+        // Same filesystem root — ensure the resolved path is still inside CWD
+        // (or is exactly CWD) to block "../" traversal.
+        const prefix = cwd.endsWith(path_1.default.sep) ? cwd : cwd + path_1.default.sep;
+        if (!normalizedPath.startsWith(prefix) && normalizedPath !== cwd) {
+            throw new Error(`Path must be within current working directory: ${cwd}`);
+        }
+    }
+    // Cross-root absolute paths (e.g. D:\ on Windows when CWD is C:\) are
+    // allowed — the user own the machine and the path is explicitly absolute.
     return normalizedPath;
 }
 function buildManageCloudRunErrorMessage(action, serverName, error) {
@@ -9775,7 +9888,7 @@ class TelemetryReporter {
         const nodeVersion = process.version; // Node.js版本
         const arch = os_1.default.arch(); // 系统架构
         // 从构建时注入的版本号获取MCP版本信息
-        const mcpVersion = process.env.npm_package_version || "2.23.6" || 0;
+        const mcpVersion = process.env.npm_package_version || "2.23.7" || 0;
         return {
             userAgent: `${osType} ${osRelease} ${arch} ${nodeVersion} CloudBase-MCP/${mcpVersion}`,
             deviceId: this.deviceId,
@@ -13786,7 +13899,7 @@ function registerSetupTools(server) {
     server.registerTool("downloadTemplate", {
         title: "下载项目模板",
         description: `自动下载并部署CloudBase项目模板。
-**Note**: Call this tool when the user requests to create a new project using a CloudBase template.\n\n支持的模板:\n- react: React + CloudBase 全栈应用模板\n- vue: Vue + CloudBase 全栈应用模板\n- miniprogram: 微信小程序 + 云开发模板  \n- uniapp: UniApp + CloudBase 跨端应用模板\n- rules: 只包含AI编辑器配置文件（包含Cursor、WindSurf、CodeBuddy等所有主流编辑器配置），适合在已有项目中补充AI编辑器配置\n\n支持的IDE类型:\n- all: 下载所有IDE配置\n- cursor: Cursor AI编辑器\n- 其他IDE类型见下方列表\n\n注意：如果未传入 ide 参数且无法从环境变量检测到 IDE，将提示错误并要求传入 ide 参数\n- windsurf: WindSurf AI编辑器\n- codebuddy: CodeBuddy AI编辑器\n- claude-code: Claude Code AI编辑器\n- cline: Cline AI编辑器\n- gemini-cli: Gemini CLI\n- opencode: OpenCode AI编辑器\n- qwen-code: 通义灵码\n- baidu-comate: 百度Comate\n- openai-codex-cli: OpenAI Codex CLI\n- augment-code: Augment Code\n- github-copilot: GitHub Copilot\n- roocode: RooCode AI编辑器\n- tongyi-lingma: 通义灵码\n- trae: Trae AI编辑器\n- qoder: Qoder AI编辑器\n- antigravity: Google Antigravity AI编辑器\n- vscode: Visual Studio Code\n- kiro: Kiro AI编辑器\n- aider: Aider AI编辑器\n\n特别说明：\n- rules 模板会自动包含当前 mcp 版本号信息（版本号：${ true ? "2.23.6" : 0}），便于后续维护和版本追踪\n- 下载 rules 模板时，如果项目中已存在 README.md 文件，系统会自动保护该文件不被覆盖（除非设置 overwrite=true）`,
+**Note**: Call this tool when the user requests to create a new project using a CloudBase template.\n\n支持的模板:\n- react: React + CloudBase 全栈应用模板\n- vue: Vue + CloudBase 全栈应用模板\n- miniprogram: 微信小程序 + 云开发模板  \n- uniapp: UniApp + CloudBase 跨端应用模板\n- rules: 只包含AI编辑器配置文件（包含Cursor、WindSurf、CodeBuddy等所有主流编辑器配置），适合在已有项目中补充AI编辑器配置\n\n支持的IDE类型:\n- all: 下载所有IDE配置\n- cursor: Cursor AI编辑器\n- 其他IDE类型见下方列表\n\n注意：如果未传入 ide 参数且无法从环境变量检测到 IDE，将提示错误并要求传入 ide 参数\n- windsurf: WindSurf AI编辑器\n- codebuddy: CodeBuddy AI编辑器\n- claude-code: Claude Code AI编辑器\n- cline: Cline AI编辑器\n- gemini-cli: Gemini CLI\n- opencode: OpenCode AI编辑器\n- qwen-code: 通义灵码\n- baidu-comate: 百度Comate\n- openai-codex-cli: OpenAI Codex CLI\n- augment-code: Augment Code\n- github-copilot: GitHub Copilot\n- roocode: RooCode AI编辑器\n- tongyi-lingma: 通义灵码\n- trae: Trae AI编辑器\n- qoder: Qoder AI编辑器\n- antigravity: Google Antigravity AI编辑器\n- vscode: Visual Studio Code\n- kiro: Kiro AI编辑器\n- aider: Aider AI编辑器\n\n特别说明：\n- rules 模板会自动包含当前 mcp 版本号信息（版本号：${ true ? "2.23.7" : 0}），便于后续维护和版本追踪\n- 下载 rules 模板时，如果项目中已存在 README.md 文件，系统会自动保护该文件不被覆盖（除非设置 overwrite=true）`,
         inputSchema: {
             template: zod_1.z
                 .enum(["react", "vue", "miniprogram", "uniapp", "rules"])
@@ -16939,6 +17052,18 @@ function buildErrorEnvelope(error) {
 function normalizeString(value) {
     return typeof value === "string" && value.trim().length > 0 ? value.trim() : undefined;
 }
+/**
+ * Sanitize agent name for CloudBase backend.
+ * The backend creates a cloud function alias from the agent name (e.g. "agent-{name}"),
+ * and SCF aliases only allow alphanumeric characters and hyphens.
+ * This function replaces any character that is not [a-zA-Z0-9] with a hyphen,
+ * then collapses consecutive hyphens into one.
+ */
+function sanitizeAgentName(name) {
+    return name
+        .replace(/[^a-zA-Z0-9]+/g, "-")
+        .replace(/^-+|-+$/g, "");
+}
 function normalizeNumber(value) {
     return typeof value === "number" && Number.isFinite(value) ? value : undefined;
 }
@@ -17093,13 +17218,19 @@ function registerAgentTools(server) {
                 }
                 // CloudBase 后端在创建 Agent 时会同步创建云函数，函数名/别名长度受 SCF 限制（最大 64 字符）。
                 // envId 可能被用作前缀或别名的一部分，因此这里预留足够余量，避免后端 CreateFunction 失败。
-                if (normalizedName.length > 30) {
-                    throw new Error(`agent name 过长（当前 ${normalizedName.length} 字符）。CloudBase 创建 Agent 时会同步创建云函数，` +
-                        `函数名/别名受 SCF 64 字符限制，且 envId 可能作为前缀拼接。请将 name 控制在 30 字符以内。`);
+                // 同时，后端会用 name 生成云函数 alias（如 "agent-{name}"），而 SCF alias 只允许字母、数字和连字符，
+                // 因此需要对 name 做 sanitize，将非法字符（如下划线）替换为连字符。
+                const sanitizedName = sanitizeAgentName(normalizedName);
+                if (!sanitizedName) {
+                    throw new Error(`name "${normalizedName}" 经 sanitize 后为空，请使用包含字母或数字的 name`);
+                }
+                if (sanitizedName.length > 30) {
+                    throw new Error(`agent name 过长（当前 ${sanitizedName.length} 字符）。CloudBase 创建 Agent 时会同步创建云函数，` +
+                        `函数名/别名受 SCF 64 字符长度限制，且 envId 可能作为前缀拼接。请将 name 控制在 30 字符以内。`);
                 }
                 const createPayload = {
                     ...payload,
-                    Name: normalizedName,
+                    Name: sanitizedName,
                     Runtime: normalizeString(payload.Runtime) ?? "Nodejs20.19",
                 };
                 const result = await cloudbase.agent.createAgent(createPayload);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cloudbase/cloudbase-mcp",
-  "version": "2.23.6",
+  "version": "2.23.7",
   "packageManager": "pnpm@10.8.0",
   "description": "腾讯云开发 MCP Server，通过AI提示词和MCP协议+云开发，让开发更智能、更高效,当你在Cursor/ VSCode GitHub Copilot/WinSurf/CodeBuddy/Augment Code/Claude Code等AI编程工具里写代码时，它能自动帮你生成可直接部署的前后端应用+小程序，并一键发布到腾讯云开发 CloudBase。",
   "main": "./dist/index.cjs",