@cloudbase/cloudbase-mcp 2.24.1 → 2.25.1

package/dist/index.js

@@ -684,8 +684,8 @@ async function enrichEnvInfoWithRuntimeMode(result, manager) {
                 : "No legacy NoSQL Database/Storage observed in this env.",
             MysqlNotAvailable: hasMysql
                 ? "MySQL instance(s) detected — see EnvInfo.MysqlInstances."
-                : "No MySQL instance is provisioned for this env. Do NOT use `manageMysqlDatabase` / `queryMysqlDatabase` (those are MySQL-specific) and do NOT read the `relational-database-tool` skill — that family targets MySQL, not CloudBase PG.",
-            RecommendedSkills: "Read `postgresql-development` first for new PG code. `no-sql-web-sdk` is still applicable for existing NoSQL collections in this env. Skip `relational-database-tool` (MySQL-only) entirely.",
+                : "No MySQL instance is provisioned for this env. Do NOT use `manageMysqlDatabase` / `queryMysqlDatabase` (those are MySQL-specific) and do NOT read the `relational-database-mcp-cloudbase` skill — that family targets MySQL, not CloudBase PG.",
+            RecommendedSkills: "Read `postgresql-development-cloudbase` first for new PG code. `cloudbase-document-database-web-sdk` is still applicable for existing NoSQL collections in this env. Skip `relational-database-mcp-cloudbase` (MySQL-only) entirely.",
         }
         : {
             PrimaryBackend: "PostgreSQL is NOT provisioned in this env — this is a legacy NoSQL CloudBase backend.",
@@ -694,8 +694,8 @@ async function enrichEnvInfoWithRuntimeMode(result, manager) {
             Storage: "Browser uploads use `app.uploadFile()` against the bucket exposed in `EnvInfo.Storages[].Bucket`.",
             MysqlNotAvailable: hasMysql
                 ? "MySQL instance(s) detected — see EnvInfo.MysqlInstances."
-                : "No MySQL instance in this env. `manageMysqlDatabase` / `queryMysqlDatabase` and the `relational-database-tool` skill are not applicable.",
-            RecommendedSkills: "Read `no-sql-web-sdk` (and `cloud-storage-web` for uploads). `postgresql-development` and `relational-database-tool` are not applicable to this env.",
+                : "No MySQL instance in this env. `manageMysqlDatabase` / `queryMysqlDatabase` and the `relational-database-mcp-cloudbase` skill are not applicable.",
+            RecommendedSkills: "Read `cloudbase-document-database-web-sdk` (and `cloud-storage-web` for uploads). `postgresql-development-cloudbase` and `relational-database-mcp-cloudbase` are not applicable to this env.",
         };
     return {
         ...result,
@@ -1616,7 +1616,7 @@ function registerEnvTools(server) {
     // Register primary tool name (queryEnv)
     const queryEnvToolSchema = {
         title: "CloudBase 环境查询",
-        description: "查询 CloudBase 环境相关信息，支持查询环境列表、指定环境详情和安全域名。（曾用名：envQuery、listEnvs、getEnvInfo、getEnvAuthDomains）当 action=list 时，会按 DescribeEnvs 语义做列表/筛选，标准返回字段为 EnvId、Alias、Status、EnvType、Region、PackageId、PackageName、IsDefault，并支持通过 fields 白名单裁剪这些字段；aliasExact=true 时会按别名精确筛选，避免把前缀相近的环境误当作候选；即使传入 envId，action=list 也只返回摘要，不会返回完整资源明细或 expiry。如需查询某个已知 EnvId 对应环境的详细信息（包括资源字段和计费信息），必须使用 action=info 并传入目标环境的 envId 参数。action=info 会在可用时补充 BillingInfo（如 ExpireTime、PayMode、IsAutoRenew 等计费字段）。\n\n🔍 action=info 还会派生三个用于后端选型的字段：\n- `EnvInfo.RuntimeMode`：'postgresql' 或 'nosql'，表示新业务建议默认使用的后端（PG 已开通时为 postgresql，否则为 nosql）。\n- `EnvInfo.RuntimeBackends`：`{postgresql, nosql, mysql}` 三个布尔值，描述当前环境实际并存的后端。\n- `EnvInfo.RuntimeModeHints`：每个后端对应的 API/工具/skill 提示。\n\nAI 在写业务/权限/存储代码前必须先看这三项：PG 模式下新业务推荐 `app.rdb()` + RLS（`managePgDatabase action=execute` 跑 `CREATE POLICY`）+ pgstore；已存在的 NoSQL 集合 / 旧 storage / `managePermissions(resourceType=\"noSqlDatabase\")` 在 PG 环境下仍然有效。真正不适用的是 MySQL：当 `RuntimeBackends.mysql === false` 时，`manageMysqlDatabase` / `queryMysqlDatabase` / `relational-database-tool` skill 都不该使用。",
+        description: "查询 CloudBase 环境相关信息，支持查询环境列表、指定环境详情和安全域名。（曾用名：envQuery、listEnvs、getEnvInfo、getEnvAuthDomains）当 action=list 时，会按 DescribeEnvs 语义做列表/筛选，标准返回字段为 EnvId、Alias、Status、EnvType、Region、PackageId、PackageName、IsDefault，并支持通过 fields 白名单裁剪这些字段；aliasExact=true 时会按别名精确筛选，避免把前缀相近的环境误当作候选；即使传入 envId，action=list 也只返回摘要，不会返回完整资源明细或 expiry。如需查询某个已知 EnvId 对应环境的详细信息（包括资源字段和计费信息），必须使用 action=info 并传入目标环境的 envId 参数。action=info 会在可用时补充 BillingInfo（如 ExpireTime、PayMode、IsAutoRenew 等计费字段）。\n\n🔍 action=info 还会派生三个用于后端选型的字段：\n- `EnvInfo.RuntimeMode`：'postgresql' 或 'nosql'，表示新业务建议默认使用的后端（PG 已开通时为 postgresql，否则为 nosql）。\n- `EnvInfo.RuntimeBackends`：`{postgresql, nosql, mysql}` 三个布尔值，描述当前环境实际并存的后端。\n- `EnvInfo.RuntimeModeHints`：每个后端对应的 API/工具/skill 提示。\n\nAI 在写业务/权限/存储代码前必须先看这三项：PG 模式下新业务推荐 `app.rdb()` + RLS（`managePgDatabase action=execute` 跑 `CREATE POLICY`）+ pgstore；已存在的 NoSQL 集合 / 旧 storage / `managePermissions(resourceType=\"noSqlDatabase\")` 在 PG 环境下仍然有效。真正不适用的是 MySQL：当 `RuntimeBackends.mysql === false` 时，`manageMysqlDatabase` / `queryMysqlDatabase` / `relational-database-mcp-cloudbase` skill 都不该使用。",
         inputSchema: {
             action: zod_1.z
                 .enum(["list", "info", "domains"])
@@ -2233,7 +2233,7 @@ ${envIdSection}
 ## 环境信息
 - 操作系统: ${os_1.default.type()} ${os_1.default.release()}
 - Node.js版本: ${process.version}
-- MCP 版本：${process.env.npm_package_version || "2.24.1" || 0}
+- MCP 版本：${process.env.npm_package_version || "2.25.1" || 0}
 - 系统架构: ${os_1.default.arch()}
 - 时间: ${new Date().toISOString()}
 - 请求ID: ${requestId}
@@ -2314,7 +2314,7 @@ function createWrappedHandler(name, handler, server) {
                 requestId: (typeof error === 'object' && error && 'requestId' in error) ? error.requestId : '',
                 ide: server.ide || process.env.INTEGRATION_IDE || ''
             });
-            const mcpVersion =  true ? "2.24.1" : 0;
+            const mcpVersion =  true ? "2.25.1" : 0;
             const requestIdSuffix = requestId ? `\n🆔 RequestId: ${requestId}` : '';
             const enhancedErrorMessage = `${errorMessage}${requestIdSuffix}\n\n📦 CloudBase MCP v${mcpVersion}\n🔗 遇到问题？请复制以下链接到浏览器打开\n即可自动携带错误详情快速创建 GitHub Issue：\n${issueLink}`;
             // 创建新的错误对象，保持原有的错误类型但更新消息
@@ -2483,7 +2483,6 @@ const capi_js_1 = __webpack_require__(738);
 const cloudrun_js_1 = __webpack_require__(5023);
 const dataModel_js_1 = __webpack_require__(4052);
 const gateway_js_1 = __webpack_require__(4319);
-const invite_code_js_1 = __webpack_require__(4760);
 const agents_js_1 = __webpack_require__(9527);
 const app_auth_js_1 = __webpack_require__(5313);
 const apps_js_1 = __webpack_require__(6817);
@@ -2514,7 +2513,6 @@ const DEFAULT_PLUGINS = [
     "logs",
     "agents",
     "download",
-    "invite-code",
     "capi",
 ];
 function registerDatabase(server) {
@@ -2556,7 +2554,6 @@ const AVAILABLE_PLUGINS = {
     logs: { name: "logs", register: logs_js_1.registerLogTools },
     agents: { name: "agents", register: agents_js_1.registerAgentTools },
     apps: { name: "apps", register: apps_js_1.registerAppTools },
-    "invite-code": { name: "invite-code", register: invite_code_js_1.registerInviteCodeTools },
     cloudrun: { name: "cloudrun", register: cloudrun_js_1.registerCloudRunTools },
     capi: { name: "capi", register: capi_js_1.registerCapiTools },
 };
@@ -7153,21 +7150,23 @@ const zod_1 = __webpack_require__(2971);
 const cloudbase_manager_js_1 = __webpack_require__(3431);
 const json_content_js_1 = __webpack_require__(4365);
 const QUERY_GATEWAY_ACTIONS = [
-    "getAccess",
-    "listDomains",
     "listRoutes",
     "getRoute",
     "listCustomDomains",
 ];
 const MANAGE_GATEWAY_ACTIONS = [
-    "createAccess",
     "createRoute",
     "updateRoute",
     "deleteRoute",
     "bindCustomDomain",
     "deleteCustomDomain",
-    "deleteAccess",
-    "updatePathAuth",
+];
+const UPSTREAM_RESOURCE_TYPES = [
+    "SCF",
+    "WEB_SCF",
+    "CBR",
+    "STATIC_STORE",
+    "LH",
 ];
 function normalizeAccessPath(path) {
     if (!path) {
@@ -7198,24 +7197,11 @@ function registerGatewayTools(server) {
             return (0, json_content_js_1.jsonContent)(buildErrorEnvelope(error));
         }
     };
-    const listGatewayDomains = async () => {
-        const cloudbase = await getManager();
-        const result = await cloudbase.access.getDomainList();
-        (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
-        const domains = [
-            result.DefaultDomain,
-            ...(result.ServiceSet || []).map((item) => item.Domain),
-        ].filter(Boolean);
-        return {
-            domains,
-            enableService: result.EnableService,
-            raw: result,
-        };
-    };
     const listHttpServiceRoutes = async (domain) => {
         const cloudbase = await getManager();
         const result = await cloudbase.env.describeHttpServiceRoute({
             EnvId: await resolveEnvId(),
+            Limit: 1000,
             ...(domain
                 ? {
                     Filters: [
@@ -7231,123 +7217,176 @@ function registerGatewayTools(server) {
         return result;
     };
     const flattenRoutes = (result) => (result.Domains ?? []).flatMap((domainItem) => (domainItem.Routes ?? []).map((route) => ({
-        Domain: domainItem.Domain,
+        Domain: domainItem.Domain ?? "",
         DomainType: domainItem.DomainType,
         AccessType: domainItem.AccessType,
+        IsDefault: domainItem.IsDefault,
         ...route,
     })));
+    const buildRouteUrls = (routes) => Array.from(new Set(routes
+        .filter((route) => route.Domain && route.Path)
+        .map((route) => `https://${route.Domain}${normalizeAccessPath(String(route.Path))}`)));
+    const resolveDefaultHttpDomain = async () => {
+        const routeInfo = await listHttpServiceRoutes();
+        const domains = routeInfo.Domains ?? [];
+        const defaultCandidates = domains.filter((item) => item.IsDefault === true && item.Domain);
+        const preferred = defaultCandidates.find((item) => item.Enable !== false && item.Status === "SUCCESS") ??
+            defaultCandidates.find((item) => item.Enable !== false) ??
+            defaultCandidates[0];
+        if (!preferred?.Domain) {
+            throw new Error("环境默认 HTTP 访问域名未就绪或未开通。请先在控制台开通 HTTP 访问服务，或用 queryGateway(action=\"listRoutes\") 确认 Domains 中是否存在 IsDefault=true 的域名；也可以显式传入 domain 后重试 createRoute/updateRoute/deleteRoute。");
+        }
+        return preferred.Domain;
+    };
     const resolveRouteDomain = async (preferredDomain) => {
         if (preferredDomain) {
             return preferredDomain;
         }
-        const routeInfo = await listHttpServiceRoutes();
-        return routeInfo.OriginDomain;
+        return resolveDefaultHttpDomain();
+    };
+    const resolveUpstreamResourceType = (input) => {
+        const resolved = input.routeUpstreamResourceType ?? input.upstreamResourceType;
+        if (resolved) {
+            return resolved;
+        }
+        throw new Error("必须提供 upstreamResourceType（或 route.upstreamResourceType）：" +
+            "WEB_SCF=HTTP云函数，SCF=Event云函数，CBR=云托管，STATIC_STORE=静态托管，LH=轻量应用服务器。" +
+            "禁止仅凭 targetName/serviceName 推断上游类型。");
     };
-    const normalizeRoutePayload = async (route, fallback, domain) => {
-        const path = normalizeAccessPath(route?.path ?? fallback.path);
-        const serviceType = route?.serviceType ?? fallback.targetType;
-        const serviceName = route?.serviceName ?? fallback.targetName;
-        if (!serviceType || !serviceName) {
-            throw new Error("route.serviceType 和 route.serviceName 为必填项");
+    const normalizeRoutePayload = async (input) => {
+        const upstreamResourceName = input.route?.serviceName ?? input.targetName;
+        if (!upstreamResourceName) {
+            throw new Error("必须提供 targetName 或 route.serviceName 作为上游资源名称：" +
+                "云函数名、云托管服务名，或静态托管实例名（常见为 staticstore）。");
+        }
+        const upstreamResourceType = resolveUpstreamResourceType({
+            upstreamResourceType: input.upstreamResourceType,
+            routeUpstreamResourceType: input.route?.upstreamResourceType,
+        });
+        const path = normalizeAccessPath(input.route?.path ?? input.path ?? `/${upstreamResourceName}`);
+        const domain = await resolveRouteDomain(input.domain);
+        const enableAuth = input.route?.auth !== undefined
+            ? input.route.auth
+            : input.auth !== undefined
+                ? input.auth
+                : undefined;
+        const enablePathTransmission = input.route?.enablePathTransmission !== undefined
+            ? input.route.enablePathTransmission
+            : input.enablePathTransmission !== undefined
+                ? input.enablePathTransmission
+                : undefined;
+        const route = {
+            Path: path,
+            UpstreamResourceType: upstreamResourceType,
+            UpstreamResourceName: upstreamResourceName,
+            EnableAuth: enableAuth,
+        };
+        if (enablePathTransmission !== undefined) {
+            route.EnablePathTransmission = enablePathTransmission;
         }
         return {
             EnvId: await resolveEnvId(),
             Domain: {
-                Domain: await resolveRouteDomain(domain),
-                Routes: [
-                    {
-                        Path: path,
-                        UpstreamResourceType: serviceType === "function" ? "SCF" : "CBR",
-                        UpstreamResourceName: serviceName,
-                        EnableAuth: route?.auth !== undefined
-                            ? route.auth
-                            : fallback.auth !== undefined
-                                ? fallback.auth
-                                : undefined,
-                    },
-                ],
+                Domain: domain,
+                Routes: [route],
+            },
+            resolved: {
+                domain,
+                path,
+                upstreamResourceType,
+                upstreamResourceName,
+                enableAuth,
+                enablePathTransmission,
             },
         };
     };
+    const routeMutationNextActions = (targetName) => [
+        {
+            tool: "queryGateway",
+            action: "getRoute",
+            reason: "等待 30 秒到 3 分钟后再确认访问入口是否已生效",
+        },
+        {
+            tool: "queryPermissions",
+            action: "getResourcePermission",
+            reason: "确认函数安全规则是否允许预期访问方；网关 EnableAuth/auth=false 不等于函数已允许匿名访问",
+        },
+        {
+            tool: "managePermissions",
+            action: "updateResourcePermission",
+            reason: "只有在确认需要匿名或浏览器直连访问时，才按实际安全要求更新函数权限",
+        },
+    ];
     const handleQueryGateway = async (input) => {
         switch (input.action) {
-            case "listDomains": {
-                const result = await listGatewayDomains();
-                return buildEnvelope({
-                    action: input.action,
-                    domains: result.domains,
-                    enableService: result.enableService,
-                    raw: result.raw,
-                }, `已获取 ${result.domains.length} 个网关域名`, [
-                    {
-                        tool: "queryGateway",
-                        action: "getAccess",
-                        reason: "查看某个目标当前的访问入口",
-                    },
-                ]);
-            }
             case "listCustomDomains": {
-                const result = await listGatewayDomains();
+                const result = await listHttpServiceRoutes();
+                const customDomains = (result.Domains ?? []).filter((item) => item.IsDefault !== true);
                 return buildEnvelope({
                     action: input.action,
-                    domains: result.raw.ServiceSet ?? [],
-                    total: (result.raw.ServiceSet ?? []).length,
-                    raw: result.raw,
-                }, `已获取 ${(result.raw.ServiceSet ?? []).length} 个自定义域名`);
+                    domains: customDomains,
+                    total: customDomains.length,
+                    raw: result,
+                }, `已获取 ${customDomains.length} 个自定义域名`);
             }
             case "listRoutes": {
-                const result = await listHttpServiceRoutes();
+                const result = await listHttpServiceRoutes(input.domain);
                 const routes = flattenRoutes(result);
                 return buildEnvelope({
                     action: input.action,
                     routes,
+                    urls: buildRouteUrls(routes),
                     total: result.TotalCount ?? routes.length,
                     raw: result,
                 }, `已获取 ${result.TotalCount ?? routes.length} 条 HTTP 路由`);
             }
             case "getRoute": {
-                const result = await listHttpServiceRoutes();
-                const route = flattenRoutes(result).find((item) => (input.routeId && item.RouteId === input.routeId) ||
-                    (input.targetName && item.UpstreamResourceName === input.targetName)) ?? null;
+                if (!input.routeId && !input.targetName && !input.path) {
+                    throw new Error("action=getRoute 时至少需要提供 routeId、targetName 或 path");
+                }
+                const result = await listHttpServiceRoutes(input.domain);
+                const normalizedPath = input.path
+                    ? normalizeAccessPath(input.path)
+                    : undefined;
+                const matches = flattenRoutes(result).filter((item) => {
+                    if (input.routeId && item.RouteId !== input.routeId) {
+                        return false;
+                    }
+                    if (input.domain && item.Domain !== input.domain) {
+                        return false;
+                    }
+                    if (normalizedPath &&
+                        normalizeAccessPath(String(item.Path ?? "")) !== normalizedPath) {
+                        return false;
+                    }
+                    if (input.targetName &&
+                        item.UpstreamResourceName !== input.targetName) {
+                        return false;
+                    }
+                    return Boolean(input.routeId || input.targetName || normalizedPath);
+                });
+                const route = matches.length === 1 ? matches[0] : null;
+                const urls = buildRouteUrls(matches);
                 return buildEnvelope({
                     action: input.action,
                     routeId: input.routeId ?? null,
+                    targetName: input.targetName ?? null,
+                    path: normalizedPath ?? null,
+                    domain: input.domain ?? null,
                     route,
-                    raw: result,
-                }, route ? "已获取路由详情" : "未找到对应路由");
-            }
-            case "getAccess": {
-                if (!input.targetName) {
-                    throw new Error("getAccess 操作时，targetName 参数是必需的");
-                }
-                const cloudbase = await getManager();
-                const [accessList, domainInfo] = await Promise.all([
-                    cloudbase.access.getAccessList({ name: input.targetName }),
-                    listGatewayDomains(),
-                ]);
-                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, accessList);
-                const urls = Array.from(new Set((accessList.APISet || []).flatMap((api) => domainInfo.domains.map((domain) => {
-                    const normalizedPath = normalizeAccessPath(api.Path);
-                    return `https://${domain}${normalizedPath}`;
-                }))));
-                return buildEnvelope({
-                    action: input.action,
-                    targetType: input.targetType ?? "function",
-                    targetName: input.targetName,
-                    apis: accessList.APISet || [],
-                    total: accessList.Total || 0,
-                    domains: domainInfo.domains,
+                    routes: matches,
+                    total: matches.length,
                     urls,
-                    enableService: accessList.EnableService ?? domainInfo.enableService ?? false,
-                    raw: {
-                        accessList,
-                        domainList: domainInfo.raw,
-                    },
-                }, `已获取目标 ${input.targetName} 的网关访问配置`, [
+                    raw: result,
+                }, matches.length === 0
+                    ? "未找到对应路由"
+                    : matches.length === 1
+                        ? "已获取路由详情"
+                        : `匹配到 ${matches.length} 条路由，请补充 path 或 domain 精确定位`, [
                     {
                         tool: "manageGateway",
-                        action: "createAccess",
-                        reason: "为该目标新增访问路径",
+                        action: "createRoute",
+                        reason: "为该目标新增 Domain/Route 访问路径",
                     },
                 ]);
             }
@@ -7357,78 +7396,74 @@ function registerGatewayTools(server) {
     };
     const handleManageGateway = async (input) => {
         switch (input.action) {
-            case "createAccess": {
-                if (!input.targetName || !input.targetType) {
-                    throw new Error("action=createAccess 时必须提供 targetType 和 targetName");
-                }
-                if (!input.type) {
-                    throw new Error("action=createAccess 且 targetType=function 时必须显式提供 type。HTTP 云函数传 HTTP；Event 函数传 Event。省略会默认按 Event 路由处理，可能让 HTTP 云函数访问后返回 FUNCTION_PARAM_INVALID。");
-                }
+            case "createRoute": {
                 const cloudbase = await getManager();
-                const accessPath = normalizeAccessPath(input.path || `/${input.targetName}`);
+                const payload = await normalizeRoutePayload(input);
                 let result;
                 try {
-                    result = await cloudbase.access.createAccess({
-                        name: input.targetName,
-                        path: accessPath,
-                        type: (input.type === "HTTP" ? 6 : 1),
-                        auth: input.auth,
+                    result = await cloudbase.env.createHttpServiceRoute({
+                        EnvId: payload.EnvId,
+                        Domain: payload.Domain,
                     });
                 }
                 catch (err) {
-                    if (err.message && err.message.includes("An error has occurred")) {
-                        let hint = "为目标资源配置访问路由失败（后端内部错误）。请确保：1) 目标云函数已成功创建并处于 Active 状态；2) 环境默认 HTTP 域名已完成初始化；3) 该访问路径未被占用。";
-                        if (input.type === "HTTP") {
-                            hint += "此外注意：如果目标函数最初是作为 Event 函数创建的，这里 type 仍必须传 Event；误传 HTTP 会导致此错误。";
+                    const message = err instanceof Error ? err.message : String(err);
+                    if (message.includes("An error has occurred")) {
+                        let hint = "为目标资源配置访问路由失败（后端内部错误）。请确保：1) 目标云函数已成功创建并处于 Active 状态；2) 环境默认 HTTP 域名已完成初始化（IsDefault）；3) 该访问路径未被占用。";
+                        if (payload.resolved.upstreamResourceType === "WEB_SCF" ||
+                            payload.resolved.upstreamResourceType === "SCF") {
+                            hint +=
+                                "此外注意：HTTP 云函数必须用 upstreamResourceType=WEB_SCF，Event 云函数必须用 SCF；互标会导致此错误。";
                         }
-                        throw new Error(`${hint} 原始错误：${err.message}`);
+                        throw new Error(`${hint} 原始错误：${message}`);
                     }
                     throw err;
                 }
                 (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
                 return buildEnvelope({
                     action: input.action,
-                    targetType: input.targetType,
-                    targetName: input.targetName,
-                    path: accessPath,
-                    raw: result,
-                }, `已为目标 ${input.targetName} 创建网关访问路径。注意：路由配置传播通常需要等待 30 秒到 3 分钟，请勿立即访问。该操作只创建网关入口，不会自动放开函数安全规则；若需要匿名或浏览器直接访问，请继续检查函数资源权限。`, [
-                    {
-                        tool: "queryGateway",
-                        action: "getAccess",
-                        reason: "等待 30 秒到 3 分钟后再确认访问入口是否已生效",
-                    },
-                    {
-                        tool: "queryPermissions",
-                        action: "getResourcePermission",
-                        reason: "确认函数安全规则是否允许预期访问方；网关 auth=false 不等于函数已允许匿名访问",
-                    },
-                    {
-                        tool: "managePermissions",
-                        action: "updateResourcePermission",
-                        reason: "只有在确认需要匿名或浏览器直连访问时，才按实际安全要求更新函数权限",
-                    },
-                ]);
-            }
-            case "createRoute": {
-                const cloudbase = await getManager();
-                const result = await cloudbase.env.createHttpServiceRoute((await normalizeRoutePayload(input.route, input, input.domain)));
-                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
-                return buildEnvelope({
-                    action: input.action,
-                    route: input.route ?? null,
+                    model: "httpServiceRoute",
+                    targetName: payload.resolved.upstreamResourceName,
+                    domain: payload.resolved.domain,
+                    path: payload.resolved.path,
+                    upstreamResourceType: payload.resolved.upstreamResourceType,
+                    upstreamResourceName: payload.resolved.upstreamResourceName,
+                    auth: payload.resolved.enableAuth ?? null,
+                    enablePathTransmission: payload.resolved.enablePathTransmission ?? null,
                     raw: result,
-                }, "HTTP 路由创建成功");
+                }, `已为目标 ${payload.resolved.upstreamResourceName} 在域名 ${payload.resolved.domain} 创建路由 ${payload.resolved.path}（${payload.resolved.upstreamResourceType}）` +
+                    (payload.resolved.enablePathTransmission === true
+                        ? "；已开启路径透传（后端收到完整请求路径）"
+                        : payload.resolved.enablePathTransmission === false
+                            ? "；路径透传关闭（网关会剥掉触发路径前缀后再转发给后端）"
+                            : "；路径透传未显式设置（平台默认 false，会剥掉触发路径前缀）") +
+                    `。注意：路由配置传播通常需要等待 30 秒到 3 分钟，请勿立即访问。该操作只创建网关入口，不会自动放开上游权限；若上游是云函数且需要匿名或浏览器直接访问，请继续检查函数资源权限。`, routeMutationNextActions(payload.resolved.upstreamResourceName));
             }
             case "updateRoute": {
                 const cloudbase = await getManager();
-                const result = await cloudbase.env.modifyHttpServiceRoute((await normalizeRoutePayload(input.route, input, input.domain)));
+                const payload = await normalizeRoutePayload(input);
+                const result = await cloudbase.env.modifyHttpServiceRoute({
+                    EnvId: payload.EnvId,
+                    Domain: payload.Domain,
+                });
                 (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
                 return buildEnvelope({
                     action: input.action,
-                    route: input.route ?? null,
+                    model: "httpServiceRoute",
+                    domain: payload.resolved.domain,
+                    path: payload.resolved.path,
+                    upstreamResourceType: payload.resolved.upstreamResourceType,
+                    upstreamResourceName: payload.resolved.upstreamResourceName,
+                    auth: payload.resolved.enableAuth ?? null,
+                    enablePathTransmission: payload.resolved.enablePathTransmission ?? null,
                     raw: result,
-                }, "HTTP 路由更新成功");
+                }, `HTTP 路由更新成功（${payload.resolved.domain}${payload.resolved.path}` +
+                    (payload.resolved.enablePathTransmission === true
+                        ? "，路径透传=开启"
+                        : payload.resolved.enablePathTransmission === false
+                            ? "，路径透传=关闭"
+                            : "") +
+                    `）`, routeMutationNextActions(payload.resolved.upstreamResourceName));
             }
             case "deleteRoute": {
                 const routePath = input.route?.path ?? input.path;
@@ -7437,16 +7472,18 @@ function registerGatewayTools(server) {
                 }
                 const cloudbase = await getManager();
                 const domain = await resolveRouteDomain(input.domain);
+                const normalizedPath = normalizeAccessPath(routePath);
                 const result = await cloudbase.env.deleteHttpServiceRoute({
                     EnvId: await resolveEnvId(),
                     Domain: domain,
-                    Paths: [normalizeAccessPath(routePath)],
+                    Paths: [normalizedPath],
                 });
                 (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
                 return buildEnvelope({
                     action: input.action,
+                    model: "httpServiceRoute",
                     domain,
-                    path: normalizeAccessPath(routePath),
+                    path: normalizedPath,
                     raw: result,
                 }, "HTTP 路由删除成功");
             }
@@ -7486,114 +7523,32 @@ function registerGatewayTools(server) {
                     raw: result,
                 }, "自定义域名删除成功");
             }
-            case "deleteAccess": {
-                const cloudbase = await getManager();
-                const accessPath = input.path ? normalizeAccessPath(input.path) : undefined;
-                let resolvedAccessId = input.accessId;
-                let resolvedName;
-                if (!resolvedAccessId) {
-                    if (!input.targetName && !accessPath) {
-                        throw new Error("action=deleteAccess 时至少需要提供 accessId，或提供 targetName/path 用于定位入口");
-                    }
-                    const accessList = await cloudbase.access.getAccessList({
-                        ...(input.targetName ? { name: input.targetName } : {}),
-                        ...(accessPath ? { path: accessPath } : {}),
-                    });
-                    const candidates = (accessList.APISet ?? []).filter((item) => {
-                        if (!accessPath) {
-                            return true;
-                        }
-                        return normalizeAccessPath(item.Path) === accessPath;
-                    });
-                    if (candidates.length === 0) {
-                        throw new Error("未找到可删除的访问入口，请确认 targetName/path 或直接传 accessId");
-                    }
-                    if (candidates.length > 1 && !accessPath) {
-                        throw new Error("匹配到多个访问入口，请补充 path 或直接传 accessId");
-                    }
-                    resolvedAccessId = candidates[0]?.APIId;
-                    resolvedName = candidates[0]?.Name;
-                }
-                else {
-                    // 仅传入 accessId 时，先查询获取 name 等信息，确保删除参数完整
-                    try {
-                        const accessList = await cloudbase.access.getAccessList({});
-                        const match = (accessList.APISet ?? []).find((item) => item.APIId === resolvedAccessId);
-                        if (match) {
-                            resolvedName = match.Name;
-                        }
-                    }
-                    catch {
-                        // 查询失败不影响主流程，继续用 accessId 删除
-                    }
-                }
-                if (!resolvedAccessId) {
-                    throw new Error("无法解析访问入口 accessId，请改为显式传入 accessId");
-                }
-                const result = await cloudbase.access.deleteAccess({
-                    ...(resolvedName ? { name: resolvedName } : {}),
-                    apiId: resolvedAccessId,
-                });
-                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
-                return buildEnvelope({
-                    action: input.action,
-                    targetName: resolvedName ?? input.targetName ?? null,
-                    path: accessPath ?? null,
-                    accessId: resolvedAccessId,
-                    raw: result,
-                }, "网关访问入口删除成功");
-            }
-            case "updatePathAuth": {
-                if (!input.targetName && !input.path) {
-                    throw new Error("action=updatePathAuth 时至少需要提供 targetName 或 path");
-                }
-                if (input.auth === undefined) {
-                    throw new Error("action=updatePathAuth 时必须提供 auth");
-                }
-                const cloudbase = await getManager();
-                const accessPath = input.path ? normalizeAccessPath(input.path) : undefined;
-                const accessList = await cloudbase.access.getAccessList({
-                    ...(input.targetName ? { name: input.targetName } : {}),
-                    ...(accessPath ? { path: accessPath } : {}),
-                });
-                const apiIds = (accessList.APISet ?? []).map((item) => item.APIId).filter(Boolean);
-                if (apiIds.length === 0) {
-                    throw new Error("未找到可更新鉴权状态的访问入口");
-                }
-                const result = await cloudbase.access.switchPathAuth({
-                    apiIds,
-                    auth: input.auth,
-                });
-                (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
-                return buildEnvelope({
-                    action: input.action,
-                    targetName: input.targetName ?? null,
-                    path: accessPath ?? null,
-                    auth: input.auth,
-                    apiIds,
-                    raw: result,
-                }, "网关路径鉴权更新成功");
-            }
             default:
                 throw new Error(`不支持的操作类型: ${input.action}`);
         }
     };
     server.registerTool?.("queryGateway", {
         title: "查询 CloudBase 网关",
-        description: "CloudBase 网关统一只读入口。通过 action 查询网关域名、访问入口和目标暴露情况。",
+        description: "CloudBase HTTP 网关统一只读入口（Domain/Route）。查询域名下路径路由及其上游：" +
+            "WEB_SCF/SCF=云函数，CBR=云托管，STATIC_STORE=静态托管，LH=轻量应用服务器。" +
+            "主键为 Domain + Path；listRoutes / getRoute / listCustomDomains。",
         inputSchema: {
             action: zod_1.z
                 .enum(QUERY_GATEWAY_ACTIONS)
-                .describe("只读操作类型，例如 getAccess、listDomains"),
-            targetType: zod_1.z
-                .enum(["function"])
-                .optional()
-                .describe("目标资源类型。当前支持 function，后续可扩展"),
+                .describe("只读操作类型：listRoutes、getRoute、listCustomDomains"),
             targetName: zod_1.z
                 .string()
                 .optional()
-                .describe("目标资源名称。getAccess 时必填"),
+                .describe("上游资源名过滤（UpstreamResourceName）：云函数名、云托管服务名，或静态托管实例名（常见 staticstore）。"),
             routeId: zod_1.z.string().optional().describe("路由 ID。getRoute 时可选"),
+            path: zod_1.z
+                .string()
+                .optional()
+                .describe("路由路径。getRoute / listRoutes 过滤时可选"),
+            domain: zod_1.z
+                .string()
+                .optional()
+                .describe("域名。getRoute / listRoutes 过滤时可选"),
         },
         annotations: {
             readOnlyHint: true,
@@ -7603,45 +7558,76 @@ function registerGatewayTools(server) {
     }, async (input) => withEnvelope(() => handleQueryGateway(input)));
     server.registerTool?.("manageGateway", {
         title: "管理 CloudBase 网关",
-        description: "CloudBase 网关统一写入口。通过 action 创建目标访问入口，后续承接更通用的网关配置能力。为已存在的 HTTP 云函数补默认域名访问时，通常使用 createAccess 并提供 targetType=\"function\"、targetName、type=\"HTTP\" 与期望 path。注意 createAccess 只创建网关入口，不会自动修改函数资源权限。⚠️ 如需绑定带 SSL 证书的自定义域名供公网 HTTPS 访问，使用 action=\"bindCustomDomain\"（需要 domain 和 certificateId 参数）；如需配置 CORS/安全域名（无证书），请使用 envDomainManagement 工具。",
+        description: "CloudBase HTTP 网关统一写入口（Domain/Route）。createRoute/updateRoute/deleteRoute 把域名下的 path 转到上游；未传 domain 时用 IsDefault 默认域名。" +
+            "上游类型只用一个参数 upstreamResourceType（也可写在 route.upstreamResourceType，route 优先）：" +
+            "WEB_SCF=HTTP云函数，SCF=Event云函数，CBR=云托管，STATIC_STORE=静态托管，LH=轻量应用服务器；" +
+            "配合 targetName 或 route.serviceName（云函数名/云托管服务名/静态托管实例名，常见 staticstore）。" +
+            "createRoute 只建网关入口，不改上游权限。" +
+            "enablePathTransmission：默认 false 剥触发路径前缀；true 透传完整路径（CBR 多路由、WEB_SCF 自管子路径常需 true；STATIC_STORE 自定义触发路径映射站点根通常 false）。" +
+            "⚠️ SSL 自定义域名用 bindCustomDomain；CORS/安全域名用 envDomainManagement。",
         inputSchema: {
             action: zod_1.z
                 .enum(MANAGE_GATEWAY_ACTIONS)
-                .describe('写操作类型，例如 createAccess。为已有函数补默认域名访问入口时使用 createAccess；若 action=createAccess 且 targetType=function，必须显式提供 type。'),
-            targetType: zod_1.z
-                .enum(["function"])
-                .optional()
-                .describe("目标资源类型。当前支持 function，后续可扩展"),
+                .describe("写操作：createRoute/updateRoute/deleteRoute 管理路由；bindCustomDomain/deleteCustomDomain 管理自定义域名。" +
+                "createRoute/updateRoute 必须提供 upstreamResourceType。"),
             targetName: zod_1.z
                 .string()
                 .optional()
-                .describe("目标资源名称。createAccess 到云函数时填写函数名"),
+                .describe("上游资源名称（UpstreamResourceName），与 route.serviceName 二选一（route 优先）。" +
+                "云函数=函数名；云托管=服务名；静态托管=实例名（常见 staticstore）。不会自动推断上游类型。"),
             path: zod_1.z
                 .string()
                 .optional()
-                .describe("访问路径，默认 /{targetName}。例如为 HTTP 函数暴露 /api/hello 时传 /api/hello。该参数只创建网关入口，不会自动放开函数资源权限。"),
-            type: zod_1.z
-                .enum(["Event", "HTTP"])
+                .describe("触发路径（网关匹配前缀），默认 /{上游名}。例：云函数 /api/hello、云托管 /api、静态托管 / 或 /app。" +
+                "只建网关入口；与 enablePathTransmission 共同决定上游实际收到的路径。"),
+            upstreamResourceType: zod_1.z
+                .enum(UPSTREAM_RESOURCE_TYPES)
                 .optional()
-                .describe("目标函数的运行时类型，不是接入协议。createAccess 到已创建的 HTTP 云函数时传 HTTP；给 Event 函数补网关访问时传 Event 或省略。省略会默认按 Event 路由处理，可能让 HTTP 云函数访问后返回 FUNCTION_PARAM_INVALID。"),
+                .describe("上游类型（与 route.upstreamResourceType 二选一，route 优先）。" +
+                "WEB_SCF=HTTP云函数，SCF=Event云函数，CBR=云托管，STATIC_STORE=静态托管，LH=轻量应用服务器。" +
+                "createRoute/updateRoute 必填其一；勿把 manageFunctions 的 type=HTTP|Event 传到本字段。"),
             auth: zod_1.z
                 .boolean()
                 .optional()
-                .describe("是否开启网关路径鉴权。若要走默认域名做匿名或浏览器访问，通常设为 false；该开关仅控制网关入口本身，不会修改函数资源权限，仍需检查并按需调整函数安全规则。"),
+                .describe("网关路径鉴权（EnableAuth）。匿名/浏览器公网访问通常 false。" +
+                "只控制网关入口；云函数安全规则、云托管鉴权、静态托管权限需各自工具另行配置。"),
+            enablePathTransmission: zod_1.z
+                .boolean()
+                .optional()
+                .describe("路径透传（EnablePathTransmission），平台默认 false。例 path=/api 且请求 /api/users：" +
+                "false→上游收到 /users；true→上游收到 /api/users。" +
+                "CBR 云托管（Express 等自管子路由）与 WEB_SCF 多路径函数常需 true；" +
+                "STATIC_STORE 把触发路径映射到站点根目录（如 /app → 托管 /）时通常 false；" +
+                "单入口/根路径处理保持 false。也可用 route.enablePathTransmission（route 优先）。"),
             route: zod_1.z
                 .object({
-                routeId: zod_1.z.string().optional(),
                 path: zod_1.z.string().optional(),
-                serviceType: zod_1.z.string().optional(),
-                serviceName: zod_1.z.string().optional(),
+                serviceName: zod_1.z
+                    .string()
+                    .optional()
+                    .describe("上游实例名：云函数名 / 云托管服务名 / 静态托管实例名（常见 staticstore）/ LH 实例。优先于顶层 targetName。"),
+                upstreamResourceType: zod_1.z
+                    .enum(UPSTREAM_RESOURCE_TYPES)
+                    .optional()
+                    .describe("同顶层 upstreamResourceType。route 内设置时优先于顶层。"),
                 auth: zod_1.z.boolean().optional(),
+                enablePathTransmission: zod_1.z
+                    .boolean()
+                    .optional()
+                    .describe("同顶层 enablePathTransmission。route 内设置时优先于顶层。"),
             })
                 .optional()
-                .describe("HTTP 路由配置对象"),
-            domain: zod_1.z.string().optional().describe("自定义域名"),
-            certificateId: zod_1.z.string().optional().describe("证书 ID"),
-            accessName: zod_1.z.string().optional().describe("访问入口名称，保留字段"),
-            accessId: zod_1.z.string().optional().describe("访问入口 ID。deleteAccess 时可直接传入，避免参数歧义"),
+                .describe("路由对象（可选写法）。例：云函数 {upstreamResourceType:\"WEB_SCF\",serviceName:\"fn\",path:\"/api\"}；" +
+                "云托管 {upstreamResourceType:\"CBR\",serviceName:\"svc\",path:\"/api\"}；" +
+                "静态托管 {upstreamResourceType:\"STATIC_STORE\",serviceName:\"staticstore\",path:\"/\"}。"),
+            domain: zod_1.z
+                .string()
+                .optional()
+                .describe("域名。省略时自动使用环境 IsDefault 默认 HTTP 域名；自定义域名场景请显式传入"),
+            certificateId: zod_1.z
+                .string()
+                .optional()
+                .describe("证书 ID。bindCustomDomain 时必填"),
         },
         annotations: {
             readOnlyHint: false,
@@ -7695,70 +7681,6 @@ module.exports = __WEBPACK_EXTERNAL_MODULE_fs__;
 
 module.exports = __WEBPACK_EXTERNAL_MODULE__modelcontextprotocol_sdk_server_mcp_js_45c326f0__;
 
-/***/ }),
-
-/***/ 4760:
-/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
-
-
-Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.registerInviteCodeTools = registerInviteCodeTools;
-const zod_1 = __webpack_require__(2971);
-const cloudbase_manager_js_1 = __webpack_require__(3431);
-function registerInviteCodeTools(server) {
-    const cloudBaseOptions = server.cloudBaseOptions;
-    const getManager = () => (0, cloudbase_manager_js_1.getCloudBaseManager)({ cloudBaseOptions });
-    server.registerTool?.("activateInviteCode", {
-        title: "激活邀请码",
-        description: "云开发 AI编程激励计划，通过邀请码激活用户激励。",
-        inputSchema: {
-            InviteCode: zod_1.z.string().describe("待激活的邀请码")
-        },
-        annotations: {
-            readOnlyHint: false,
-            destructiveHint: false,
-            idempotentHint: false,
-            openWorldHint: true,
-            category: "invite-code"
-        }
-    }, async ({ InviteCode }) => {
-        if (!InviteCode) {
-            return {
-                content: [
-                    {
-                        type: "text",
-                        text: JSON.stringify({
-                            ErrorCode: 'MissingParameter',
-                            ErrorMsg: '邀请码为必填项',
-                            RequestId: ''
-                        }, null, 2)
-                    }
-                ]
-            };
-        }
-        const manager = await getManager();
-        const EnvId = await (0, cloudbase_manager_js_1.getEnvId)(cloudBaseOptions);
-        const result = await manager.commonService().call({
-            Action: 'ActivateInviteCode',
-            Param: { InviteCode, EnvId }
-        });
-        (0, cloudbase_manager_js_1.logCloudBaseResult)(server.logger, result);
-        return {
-            content: [
-                {
-                    type: "text",
-                    text: JSON.stringify({
-                        ErrorCode: result?.ErrorCode || '',
-                        ErrorMsg: result?.ErrorMsg || '',
-                        RequestId: result?.RequestId || ''
-                    }, null, 2)
-                }
-            ]
-        };
-    });
-}
-
-
 /***/ }),
 
 /***/ 4848:
@@ -8288,6 +8210,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.CLOUDRUN_ACCESS_TYPES = exports.CLOUDRUN_SERVICE_TYPES = void 0;
+exports.detectCloudRunDbNetworkRisk = detectCloudRunDbNetworkRisk;
 exports.registerCloudRunTools = registerCloudRunTools;
 const child_process_1 = __webpack_require__(5814);
 const fs_1 = __importDefault(__webpack_require__(4421));
@@ -8330,7 +8253,7 @@ const ManageCloudRunInputSchema = {
         })).optional().describe('扩缩容配置数组，用于配置服务的自动扩缩容策略。可配置多个扩缩容策略'),
         CustomLogs: zod_1.z.string().optional().describe('自定义日志配置，用于配置服务的日志收集和存储策略'),
         Port: zod_1.z.number().min(1).max(65535).optional().describe('服务监听端口配置。函数型服务固定为3000，容器型服务可自定义。服务代码必须监听此端口才能正常接收请求'),
-        EnvParams: zod_1.z.string().optional().describe('环境变量配置，JSON字符串格式。用于传递配置信息给服务代码，如\'{"DATABASE_URL":"mysql://...","NODE_ENV":"production"}\'。SDK v5.6.1+ 会自动对传入的环境变量进行 AES-256-CBC 加密传输'),
+        EnvParams: zod_1.z.string().optional().describe('环境变量配置，JSON字符串格式。用于传递配置信息给服务代码，如\'{"DATABASE_URL":"postgres://user:pass@10.x.x.x:5432/db","NODE_ENV":"production"}\'。SDK v5.6.1+ 会自动对传入的环境变量进行 AES-256-CBC 加密传输。⚠️ 若 EnvParams 含 DATABASE_URL / MYSQL_* / POSTGRES_* / REDIS_* 等传统 TCP 连库变量，必须同时配置 VpcConf，否则实例通常无法访问 VPC 内数据库'),
         Dockerfile: zod_1.z.string().optional().describe('Dockerfile文件名配置，仅容器型服务需要。指定用于构建容器镜像的Dockerfile文件路径，默认为项目根目录下的Dockerfile'),
         BuildDir: zod_1.z.string().optional().describe('构建目录配置，指定代码构建的目录路径。当代码结构与标准不同时使用，默认为项目根目录'),
         InternalAccess: zod_1.z.string().optional().describe('内网访问开关配置，控制是否启用内网访问。true=启用内网访问（可通过云开发SDK直接调用），false=关闭内网访问（仅公网访问）'),
@@ -8354,9 +8277,9 @@ const ManageCloudRunInputSchema = {
             ReplicaNum: zod_1.z.number().min(0).describe('定时扩缩容的目标副本数，最小值0（缩容到0）')
         })).optional().describe('定时扩缩容配置数组，用于配置服务的定时自动扩缩容策略。可配置多个时间段的扩缩容计划，支持每日/每周/每月循环'),
         VpcConf: zod_1.z.object({
-            VpcId: zod_1.z.string().describe('VPC网络ID，指定服务所在的私有网络'),
-            SubnetId: zod_1.z.string().describe('子网ID，指定服务所在的子网'),
-        }).optional().describe('VPC网络配置，用于将云托管服务部署到指定的私有网络中。需要提前创建好VPC和子网'),
+            VpcId: zod_1.z.string().describe('VPC网络ID，格式如 vpc-xxxxxxxx。必须与目标数据库/Redis 处于同一地域，并优先选择同一 VPC。禁止猜测或使用占位符；须来自数据库控制台、已有资源详情、callCloudApi 或用户确认。建议首次创建即配置；已存在服务也可在 deploy 时传入，部署后必须用 queryCloudRun detail 复核是否生效'),
+            SubnetId: zod_1.z.string().describe('子网ID，格式如 subnet-xxxxxxxx。云托管实例将占用该子网 IP，需确保有足够可用 IP'),
+        }).optional().describe('VPC网络配置（实例出网/私有网络）。用于让云托管实例接入指定 VPC，从而内网访问 MySQL/PostgreSQL/Redis/CVM 等资源。与 OpenAccessTypes（外部如何访问本服务）是不同概念。TCP 连库场景必须配置。禁止猜测 VpcId/SubnetId，须来自数据库控制台、已有资源详情、callCloudApi 或用户确认。MCP 在创建时会将 VpcConf 映射为 SDK vpcInfo(CreateType=2)；更新后必须用 queryCloudRun detail 复核 ServerConfig.VpcConf，未生效再走控制台网络设置或删建兜底'),
         VolumesConf: zod_1.z.array(zod_1.z.object({
             VolumeName: zod_1.z.string().describe('存储卷名称'),
             VolumeType: zod_1.z.string().describe('存储卷类型，如CFS表示云文件存储'),
@@ -8460,6 +8383,74 @@ function buildManageCloudRunErrorMessage(action, serverName, error) {
     }
     return `[manageCloudRun/${action}] ${baseMessage}\n建议：${suggestions.join(" ")}`;
 }
+const CLOUDRUN_DB_ENV_KEY_PATTERN = /^(DATABASE_URL|DB_HOST|DB_PORT|DB_USER|DB_PASSWORD|DB_NAME|MYSQL_|POSTGRES_|PGHOST|PGPORT|PGUSER|PGPASSWORD|PGDATABASE|PG_|REDIS_|MONGO_|MONGODB_|SQLALCHEMY_DATABASE_URI|SPRING_DATASOURCE_)/i;
+const CLOUDRUN_DB_URL_PATTERN = /(mysql|mariadb|postgres|postgresql|mongodb(\+srv)?|redis|rediss):\/\//i;
+/**
+ * Detect likely TCP database/cache env usage without VpcConf.
+ * Soft signal for AI agents — does not block deploy.
+ */
+function detectCloudRunDbNetworkRisk(options) {
+    const vpcId = options.vpcConf?.VpcId?.trim();
+    const subnetId = options.vpcConf?.SubnetId?.trim();
+    if (vpcId && subnetId) {
+        return null;
+    }
+    const rawEnv = options.envParams?.trim();
+    if (!rawEnv) {
+        return null;
+    }
+    let parsed;
+    try {
+        const value = JSON.parse(rawEnv);
+        if (!value || typeof value !== "object" || Array.isArray(value)) {
+            return null;
+        }
+        parsed = value;
+    }
+    catch {
+        // Non-JSON EnvParams still may embed connection URLs as plain text.
+        if (!CLOUDRUN_DB_URL_PATTERN.test(rawEnv)) {
+            return null;
+        }
+        return {
+            code: "MISSING_VPC_FOR_DB_ENV",
+            message: "EnvParams appears to include a database/cache connection URL, but serverConfig.VpcConf is missing. CloudRun instances usually cannot reach VPC-private MySQL/PostgreSQL/Redis without VpcConf.",
+            matchedKeys: ["<non-json-envParams>"],
+            remediation: [
+                "Set serverConfig.VpcConf to the same region/VPC (and a subnet with free IPs) as the database.",
+                "Do NOT invent VpcId/SubnetId. Resolve real IDs from the DB console, resource detail, callCloudApi, or the user.",
+                "Use the database private/intranet hostname in EnvParams, not localhost or docker-compose service names.",
+                "Ensure the DB security group allows the CloudRun subnet on the DB port.",
+                "Re-deploy after VpcConf is set. OpenAccessTypes alone does not provide VPC egress to databases.",
+            ],
+        };
+    }
+    const matchedKeys = [];
+    for (const [key, value] of Object.entries(parsed)) {
+        if (CLOUDRUN_DB_ENV_KEY_PATTERN.test(key)) {
+            matchedKeys.push(key);
+            continue;
+        }
+        if (typeof value === "string" && CLOUDRUN_DB_URL_PATTERN.test(value)) {
+            matchedKeys.push(key);
+        }
+    }
+    if (matchedKeys.length === 0) {
+        return null;
+    }
+    return {
+        code: "MISSING_VPC_FOR_DB_ENV",
+        message: "EnvParams includes database/cache connection settings, but serverConfig.VpcConf is missing. Deploy may succeed while runtime DB connections fail.",
+        matchedKeys,
+        remediation: [
+            "Set serverConfig.VpcConf.VpcId and SubnetId to the database VPC/subnet (same region).",
+            "Do NOT invent VpcId/SubnetId. Resolve real IDs from the DB console, resource detail, callCloudApi, or the user.",
+            "Use the private DB endpoint in EnvParams.",
+            "Confirm security group / allowlist permits CloudRun subnet access to the DB port.",
+            "Do not confuse OpenAccessTypes (ingress) with VpcConf (egress to VPC resources).",
+        ],
+    };
+}
 function getCloudRunQueryServerName(input) {
     return input.detailServerName || input.serverName;
 }
@@ -8957,6 +8948,17 @@ for await (let x of res.textStream) {
                 if (input.serverConfig) {
                     deployParams.serverConfig = input.serverConfig;
                 }
+                // Manager SDK create path prefers top-level vpcInfo (CreateCloudRunServer.VpcInfo).
+                // Map serverConfig.VpcConf → vpcInfo so first-time create actually binds VPC.
+                // Update path still sends Items.VpcConf; platform may ignore VPC changes on existing services.
+                const vpcConf = input.serverConfig?.VpcConf;
+                if (vpcConf?.VpcId?.trim() && vpcConf?.SubnetId?.trim()) {
+                    deployParams.vpcInfo = {
+                        VpcId: vpcConf.VpcId.trim(),
+                        CreateType: 2,
+                        SubnetIds: [vpcConf.SubnetId.trim()],
+                    };
+                }
                 let result;
                 try {
                     result = await cloudrunService.deploy(deployParams);
@@ -9030,6 +9032,14 @@ for await (let x of res.textStream) {
                     // Notification failure should not affect deployment flow
                     // Error is already logged in sendDeployNotification
                 }
+                const dbNetworkRisk = detectCloudRunDbNetworkRisk({
+                    envParams: input.serverConfig?.EnvParams,
+                    vpcConf: input.serverConfig?.VpcConf,
+                });
+                const warnings = dbNetworkRisk ? [dbNetworkRisk] : [];
+                const warningSuffix = dbNetworkRisk
+                    ? ` Warning: ${dbNetworkRisk.message} Set serverConfig.VpcConf before relying on DB connectivity.`
+                    : "";
                 return {
                     content: [
                         {
@@ -9042,9 +9052,10 @@ for await (let x of res.textStream) {
                                     deployPath: targetPath,
                                     serverType: serverType,
                                     cloudbasercGenerated: true,
-                                    consoleUrl
+                                    consoleUrl,
+                                    ...(warnings.length > 0 ? { warnings } : {}),
                                 },
-                                message: `Triggered deployment for ${serverType} service '${input.serverName}' from ${targetPath}. You can follow the progress in ${consoleUrl}`
+                                message: `Triggered deployment for ${serverType} service '${input.serverName}' from ${targetPath}. You can follow the progress in ${consoleUrl}.${warningSuffix}`
                             }, null, 2)
                         }
                     ]
@@ -9973,7 +9984,7 @@ class TelemetryReporter {
         const nodeVersion = process.version; // Node.js版本
         const arch = os_1.default.arch(); // 系统架构
         // 从构建时注入的版本号获取MCP版本信息
-        const mcpVersion = process.env.npm_package_version || "2.24.1" || 0;
+        const mcpVersion = process.env.npm_package_version || "2.25.1" || 0;
         return {
             userAgent: `${osType} ${osRelease} ${arch} ${nodeVersion} CloudBase-MCP/${mcpVersion}`,
             deviceId: this.deviceId,
@@ -10412,8 +10423,12 @@ exports.MANAGE_FUNCTION_ACTIONS = [
     "incrementalDeployFunction", // 增量部署，需通过 pluginOptions.functions 注入实现
 ];
 const VPC_SCHEMA = zod_1.z.object({
-    vpcId: zod_1.z.string(),
-    subnetId: zod_1.z.string(),
+    vpcId: zod_1.z
+        .string()
+        .describe("VPC ID from the real database/network console (e.g. vpc-xxxxxxxx). Required for non-native TCP DB access. Do NOT invent or use placeholders."),
+    subnetId: zod_1.z
+        .string()
+        .describe("Subnet ID in the same VPC as the private DB endpoint (e.g. subnet-xxxxxxxx). Do NOT invent or use placeholders."),
 });
 // 镜像部署值，对应 SCF Runtime=CustomImage
 exports.CUSTOM_IMAGE_RUNTIME = "CustomImage";
@@ -10497,8 +10512,11 @@ const CREATE_FUNCTION_SCHEMA = zod_1.z.object({
     })
         .optional(),
     timeout: zod_1.z.number().optional().describe("函数超时时间"),
-    envVariables: zod_1.z.record(zod_1.z.string()).optional().describe("环境变量"),
-    vpc: VPC_SCHEMA.optional().describe("私有网络配置"),
+    envVariables: zod_1.z
+        .record(zod_1.z.string())
+        .optional()
+        .describe("环境变量。若包含 DATABASE_URL / MYSQL_* / POSTGRES_* / REDIS_* 等传统 TCP 连库变量，必须同时配置 vpc（vpcId+subnetId），且 ID 必须来自真实库/网络信息，禁止猜测。原生 app.rdb()/app.database() 不需要 VPC。"),
+    vpc: VPC_SCHEMA.optional().describe("私有网络配置（出网）。非原生 SDK、用 TCP 访问 VPC 内 MySQL/PostgreSQL/Redis 时必填。vpcId/subnetId 必须与数据库内网 VPC 一致；未知时先查控制台或询问用户，禁止填占位符。"),
     runtime: zod_1.z
         .string()
         .optional()
@@ -10752,7 +10770,7 @@ function registerFunctionTools(server) {
                     },
                     {
                         tool: "queryGateway",
-                        action: "getAccess",
+                        action: "getRoute",
                         reason: "查看该函数是否已暴露网关访问入口",
                     },
                 ]);
@@ -11062,7 +11080,7 @@ function registerFunctionTools(server) {
                         raw: imageResult,
                     }, `已基于镜像 ${createImageConfig.imageUri} 创建 HTTP 函数 ${functionName}。` +
                         `请确认 TCR、SCF 与构建管道处于同一地域；如需通过 URL 访问，请显式调用 ` +
-                        `manageGateway(action="createAccess", type="HTTP") 并按需调整函数安全规则。` +
+                        `manageGateway(action="createRoute", upstreamResourceType="WEB_SCF") 并按需调整函数安全规则。` +
                         `部署后可用 queryFunctions(action="getFunctionDetail") 确认函数已就绪。`, [
                         {
                             tool: "queryFunctions",
@@ -11076,8 +11094,8 @@ function registerFunctionTools(server) {
                         },
                         {
                             tool: "manageGateway",
-                            action: "createAccess",
-                            reason: "如需通过 URL 访问镜像 HTTP 函数，显式创建网关访问入口并传 type=\"HTTP\"",
+                            action: "createRoute",
+                            reason: "如需通过 URL 访问镜像 HTTP 函数，显式创建 Domain/Route 访问入口并传 type=\"HTTP\"（映射 WEB_SCF）",
                         },
                     ]);
                 }
@@ -11132,12 +11150,12 @@ function registerFunctionTools(server) {
                 if (func.type === "HTTP") {
                     nextActions.push({
                         tool: "manageGateway",
-                        action: "createAccess",
-                        reason: "如果需要通过 URL 访问 HTTP 函数，请调用 manageGateway(action=\"createAccess\") 并显式传 type=\"HTTP\"，再按实际路径和鉴权需求创建访问入口，不要默认假设 /函数名 已存在",
+                        action: "createRoute",
+                        reason: "如果需要通过 URL 访问 HTTP 函数，请调用 manageGateway(action=\"createRoute\") 并显式传 upstreamResourceType=\"WEB_SCF\"，再按实际路径和鉴权需求创建访问入口，不要默认假设 /函数名 已存在",
                     });
                     nextActions.push({
                         tool: "queryGateway",
-                        action: "getAccess",
+                        action: "getRoute",
                         reason: "交付前确认 HTTP 访问路径是否已存在并已生效",
                     });
                     nextActions.push({
@@ -11152,7 +11170,7 @@ function registerFunctionTools(server) {
                     });
                 }
                 const message = func.type === "HTTP"
-                    ? `已创建 HTTP 函数 ${functionName}。如果后续需要通过 URL 访问，请显式调用 manageGateway(action="createAccess")，并把 type="HTTP" 一起传入，再按实际路径和鉴权需求创建访问入口。评测或其他外部调用方可能会以匿名身份访问，而且失败后不一定会把 EXCEED_AUTHORITY 再反馈给 AI；交付前请主动确认访问路径和函数安全规则，若已出现 EXCEED_AUTHORITY，请先调用 queryPermissions(action="getResourcePermission", resourceType="function", resourceId="${functionName}") 查看当前规则，再按需要使用 managePermissions(action="updateResourcePermission") 调整权限。`
+                    ? `已创建 HTTP 函数 ${functionName}。如果后续需要通过 URL 访问，请显式调用 manageGateway(action="createRoute")，并把 upstreamResourceType="WEB_SCF" 一起传入，再按实际路径和鉴权需求创建访问入口。评测或其他外部调用方可能会以匿名身份访问，而且失败后不一定会把 EXCEED_AUTHORITY 再反馈给 AI；交付前请主动确认访问路径和函数安全规则，若已出现 EXCEED_AUTHORITY，请先调用 queryPermissions(action="getResourcePermission", resourceType="function", resourceId="${functionName}") 查看当前规则，再按需要使用 managePermissions(action="updateResourcePermission") 调整权限。`
                     : `已创建函数 ${functionName}`;
                 return buildEnvelope({
                     action: input.action,
@@ -11640,8 +11658,11 @@ function registerFunctionTools(server) {
             zipFile: zod_1.z.string().optional().describe("仅兼容特殊场景：预先准备好的代码包 base64 编码。普通 createFunction/updateFunctionCode 默认不要先压缩 zip，优先使用 functionRootPath。"),
             handler: zod_1.z.string().optional().describe("函数入口"),
             timeout: zod_1.z.number().optional().describe("配置更新时的超时时间"),
-            envVariables: zod_1.z.record(zod_1.z.string()).optional().describe("配置更新时要合并的环境变量"),
-            vpc: VPC_SCHEMA.optional().describe("配置更新时的 VPC 信息"),
+            envVariables: zod_1.z
+                .record(zod_1.z.string())
+                .optional()
+                .describe("配置更新时要合并的环境变量。若含 DATABASE_URL / MYSQL_* / POSTGRES_* / REDIS_* 等 TCP 连库变量，必须同时提供真实 vpc（或函数已绑定完整 VPC）。禁止猜测 vpcId/subnetId。"),
+            vpc: VPC_SCHEMA.optional().describe("配置更新时的 VPC 信息。非原生 TCP 连库场景必填真实 vpcId+subnetId；不要用占位符。"),
             params: zod_1.z.record(zod_1.z.any()).optional().describe("invokeFunction 的调用参数"),
             triggers: zod_1.z
                 .array(TRIGGER_SCHEMA)
@@ -14275,7 +14296,7 @@ function registerSetupTools(server) {
     server.registerTool("downloadTemplate", {
         title: "下载项目模板",
         description: `自动下载并部署CloudBase项目模板。
-**Note**: Call this tool when the user requests to create a new project using a CloudBase template.\n\n支持的模板:\n- react: React + CloudBase 全栈应用模板\n- vue: Vue + CloudBase 全栈应用模板\n- miniprogram: 微信小程序 + 云开发模板  \n- uniapp: UniApp + CloudBase 跨端应用模板\n- rules: 只包含AI编辑器配置文件（包含Cursor、WindSurf、CodeBuddy等所有主流编辑器配置），适合在已有项目中补充AI编辑器配置\n\n支持的IDE类型:\n- all: 下载所有IDE配置\n- cursor: Cursor AI编辑器\n- 其他IDE类型见下方列表\n\n注意：如果未传入 ide 参数且无法从环境变量检测到 IDE，将提示错误并要求传入 ide 参数\n- windsurf: WindSurf AI编辑器\n- codebuddy: CodeBuddy AI编辑器\n- claude-code: Claude Code AI编辑器\n- cline: Cline AI编辑器\n- gemini-cli: Gemini CLI\n- opencode: OpenCode AI编辑器\n- qwen-code: 通义灵码\n- baidu-comate: 百度Comate\n- openai-codex-cli: OpenAI Codex CLI\n- augment-code: Augment Code\n- github-copilot: GitHub Copilot\n- roocode: RooCode AI编辑器\n- tongyi-lingma: 通义灵码\n- trae: Trae AI编辑器\n- qoder: Qoder AI编辑器\n- antigravity: Google Antigravity AI编辑器\n- vscode: Visual Studio Code\n- kiro: Kiro AI编辑器\n- aider: Aider AI编辑器\n\n特别说明：\n- rules 模板会自动包含当前 mcp 版本号信息（版本号：${ true ? "2.24.1" : 0}），便于后续维护和版本追踪\n- 下载 rules 模板时，如果项目中已存在 README.md 文件，系统会自动保护该文件不被覆盖（除非设置 overwrite=true）`,
+**Note**: Call this tool when the user requests to create a new project using a CloudBase template.\n\n支持的模板:\n- react: React + CloudBase 全栈应用模板\n- vue: Vue + CloudBase 全栈应用模板\n- miniprogram: 微信小程序 + 云开发模板  \n- uniapp: UniApp + CloudBase 跨端应用模板\n- rules: 只包含AI编辑器配置文件（包含Cursor、WindSurf、CodeBuddy等所有主流编辑器配置），适合在已有项目中补充AI编辑器配置\n\n支持的IDE类型:\n- all: 下载所有IDE配置\n- cursor: Cursor AI编辑器\n- 其他IDE类型见下方列表\n\n注意：如果未传入 ide 参数且无法从环境变量检测到 IDE，将提示错误并要求传入 ide 参数\n- windsurf: WindSurf AI编辑器\n- codebuddy: CodeBuddy AI编辑器\n- claude-code: Claude Code AI编辑器\n- cline: Cline AI编辑器\n- gemini-cli: Gemini CLI\n- opencode: OpenCode AI编辑器\n- qwen-code: 通义灵码\n- baidu-comate: 百度Comate\n- openai-codex-cli: OpenAI Codex CLI\n- augment-code: Augment Code\n- github-copilot: GitHub Copilot\n- roocode: RooCode AI编辑器\n- tongyi-lingma: 通义灵码\n- trae: Trae AI编辑器\n- qoder: Qoder AI编辑器\n- antigravity: Google Antigravity AI编辑器\n- vscode: Visual Studio Code\n- kiro: Kiro AI编辑器\n- aider: Aider AI编辑器\n\n特别说明：\n- rules 模板会自动包含当前 mcp 版本号信息（版本号：${ true ? "2.25.1" : 0}），便于后续维护和版本追踪\n- 下载 rules 模板时，如果项目中已存在 README.md 文件，系统会自动保护该文件不被覆盖（除非设置 overwrite=true）`,
         inputSchema: {
             template: zod_1.z
                 .enum(["react", "vue", "miniprogram", "uniapp", "rules"])